diff --git a/thys/MiniSail/BTVSubst.thy b/thys/MiniSail/BTVSubst.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/BTVSubst.thy
@@ -0,0 +1,1550 @@
+(*<*)
+theory BTVSubst
+  imports Syntax
+begin
+  (*>*)
+chapter \<open>Basic Type Variable Substitution\<close>
+
+section \<open>Class\<close>
+
+class has_subst_b = fs +
+  fixes subst_b :: "'a::fs \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> 'a::fs" ("_[_::=_]\<^sub>b" [1000,50,50] 1000)
+
+assumes fresh_subst_if:  "j \<sharp> (t[i::=x]\<^sub>b )  \<longleftrightarrow> (atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))" 
+  and    forget_subst[simp]:  "atom a \<sharp> tm \<Longrightarrow> tm[a::=x]\<^sub>b  = tm"
+  and    subst_id[simp]:      "tm[a::=(B_var a)]\<^sub>b  = tm"
+  and    eqvt[simp,eqvt]:          "(p::perm) \<bullet> (subst_b t1 x1 v ) = (subst_b (p \<bullet>t1) (p \<bullet>x1) (p \<bullet>v) )"
+  and    flip_subst[simp]:    "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+  and    flip_subst_subst[simp]: "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+begin
+
+lemmas flip_subst_b = flip_subst_subst
+
+lemma subst_b_simple_commute:
+  fixes x::bv
+  assumes "atom x \<sharp> c" 
+  shows "(c[z::=B_var x]\<^sub>b)[x::=b]\<^sub>b = c[z::=b]\<^sub>b" 
+proof - 
+  have "(c[z::=B_var x]\<^sub>b)[x::=b]\<^sub>b = (( x \<leftrightarrow> z) \<bullet> c)[x::=b]\<^sub>b" using flip_subst assms by simp
+  thus ?thesis using flip_subst_subst assms by simp
+qed
+
+lemma subst_b_flip_eq_one:
+  fixes z1::bv and z2::bv and x1::bv and x2::bv  
+  assumes "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
+    and "atom x1 \<sharp> (z1,z2,c1,c2)"
+  shows "(c1[z1::=B_var x1]\<^sub>b) = (c2[z2::=B_var x1]\<^sub>b)"
+proof -  
+  have "(c1[z1::=B_var x1]\<^sub>b) = (x1 \<leftrightarrow> z1) \<bullet> c1" using assms flip_subst by auto
+  moreover have  "(c2[z2::=B_var x1]\<^sub>b) = (x1 \<leftrightarrow> z2) \<bullet> c2" using assms flip_subst by auto
+  ultimately show ?thesis using Abs1_eq_iff_all(3)[of z1 c1 z2 c2 z1]  assms 
+    by (metis Abs1_eq_iff_fresh(3) flip_commute)
+qed
+
+lemma subst_b_flip_eq_two:
+  fixes z1::bv and z2::bv and x1::bv and x2::bv  
+  assumes "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
+  shows "(c1[z1::=b]\<^sub>b) = (c2[z2::=b]\<^sub>b)"
+proof -
+  obtain x::bv where *:"atom x \<sharp> (z1,z2,c1,c2)" using obtain_fresh by metis
+  hence "(c1[z1::=B_var x]\<^sub>b) = (c2[z2::=B_var x]\<^sub>b)" using subst_b_flip_eq_one[OF assms, of x] by metis
+  hence "(c1[z1::=B_var x]\<^sub>b)[x::=b]\<^sub>b = (c2[z2::=B_var x]\<^sub>b)[x::=b]\<^sub>b" by auto
+  thus ?thesis using subst_b_simple_commute * fresh_prod4 by metis
+qed
+
+lemma subst_b_fresh_x:
+  fixes tm::"'a::fs" and x::x
+  shows "atom x \<sharp> tm = atom x \<sharp> tm[bv::=b']\<^sub>b"
+  using fresh_subst_if[of "atom x" tm bv b'] using x_fresh_b by auto
+
+lemma subst_b_x_flip[simp]:
+  fixes x'::x and x::x and bv::bv 
+  shows "((x' \<leftrightarrow> x) \<bullet> tm)[bv::=b']\<^sub>b = (x' \<leftrightarrow> x) \<bullet> (tm[bv::=b']\<^sub>b)"
+proof - 
+  have "(x' \<leftrightarrow> x) \<bullet> bv = bv" using pure_supp flip_fresh_fresh by force
+  moreover have "(x' \<leftrightarrow> x) \<bullet> b' = b'" using x_fresh_b flip_fresh_fresh by auto
+  ultimately show ?thesis using eqvt by simp
+qed
+
+end
+
+section \<open>Base Type\<close>
+
+nominal_function subst_bb :: "b \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> b" where
+  "subst_bb  (B_var bv2) bv1 b  = (if bv1 = bv2 then b else (B_var bv2))"
+| "subst_bb  B_int bv1 b  = B_int"
+| "subst_bb B_bool bv1 b = B_bool"
+| "subst_bb (B_id s) bv1 b = B_id s "
+| "subst_bb (B_pair b1 b2) bv1 b = B_pair (subst_bb b1 bv1 b) (subst_bb b2 bv1 b)"
+| "subst_bb B_unit bv1 b = B_unit  "
+| "subst_bb B_bitvec bv1 b = B_bitvec "
+| "subst_bb (B_app s b2) bv1 b = B_app s (subst_bb b2 bv1 b)"
+                      apply (simp add: eqvt_def subst_bb_graph_aux_def )
+                      apply (simp add: eqvt_def subst_bb_graph_aux_def )
+  by (auto,meson b.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_bb_abbrev :: "b \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> b" ("_[_::=_]\<^sub>b\<^sub>b" [1000,50,50] 1000)
+  where 
+    "b[bv::=b']\<^sub>b\<^sub>b  \<equiv> subst_bb b bv b' " 
+
+instantiation b :: has_subst_b
+begin
+definition "subst_b = subst_bb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::b
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof (induct t rule: b.induct)
+    case (B_id x)
+    then show ?case using subst_bb.simps fresh_def pure_fresh subst_b_b_def by auto
+  next
+    case (B_var x)
+    then show ?case using subst_bb.simps fresh_def pure_fresh subst_b_b_def by auto
+  next
+    case (B_app x1 x2)
+    then show ?case using subst_bb.simps fresh_def pure_fresh subst_b_b_def by auto
+  qed(auto simp add: subst_bb.simps fresh_def pure_fresh subst_b_b_def)+
+
+  fix a::bv and tm::b and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> tm[a::=x]\<^sub>b = tm"
+    by (induct tm rule: b.induct, auto simp add: fresh_at_base subst_bb.simps subst_b_b_def)
+
+  fix a::bv and tm::b
+  show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
+    by (induct tm rule: b.induct, auto simp add: fresh_at_base subst_bb.simps subst_b_b_def)
+
+  fix p::perm and x1::bv and v::b and t1::b
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    by (induct tm rule: b.induct, auto simp add: fresh_at_base subst_bb.simps subst_b_b_def)
+
+  fix  bv::bv and c::b and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    by (induct c rule: b.induct,  (auto simp add: fresh_at_base subst_bb.simps subst_b_b_def permute_pure pure_supp )+)
+
+  fix bv::bv and c::b and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    by (induct c rule: b.induct,  (auto simp add: fresh_at_base subst_bb.simps subst_b_b_def permute_pure pure_supp )+)
+qed
+end
+
+lemma subst_bb_inject:
+  assumes "b1 = b2[bv::=b]\<^sub>b\<^sub>b" and "b2 \<noteq> B_var bv" 
+  shows 
+    "b1 = B_int \<Longrightarrow> b2 = B_int" and 
+    "b1 = B_bool \<Longrightarrow> b2 = B_bool" and 
+    "b1 = B_unit \<Longrightarrow> b2 = B_unit" and 
+    "b1 = B_bitvec \<Longrightarrow> b2 = B_bitvec" and 
+    "b1 = B_pair b11 b12 \<Longrightarrow> (\<exists>b11' b12' . b11 = b11'[bv::=b]\<^sub>b\<^sub>b \<and> b12 = b12'[bv::=b]\<^sub>b\<^sub>b \<and> b2 = B_pair b11' b12')" and
+    "b1 = B_var bv' \<Longrightarrow> b2 = B_var bv'" and
+    "b1 = B_id tyid  \<Longrightarrow> b2 = B_id tyid" and
+    "b1 = B_app tyid b11 \<Longrightarrow> (\<exists>b11'. b11= b11'[bv::=b]\<^sub>b\<^sub>b \<and> b2 = B_app tyid b11')"
+  using assms by(nominal_induct b2 rule:b.strong_induct,auto+)
+
+lemma flip_b_subst4:
+  fixes b1::b and bv1::bv and c::bv and b::b
+  assumes "atom c \<sharp> (b1,bv1)" 
+  shows "b1[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> b1)[c ::= b]\<^sub>b\<^sub>b" 
+  using assms proof(nominal_induct b1 rule: b.strong_induct)
+  case B_int
+  then show ?case using subst_bb.simps b.perm_simps by auto
+next
+  case B_bool
+  then show ?case using subst_bb.simps b.perm_simps by auto
+next
+  case (B_id x)
+  hence "atom bv1 \<sharp> x \<and> atom c \<sharp> x" using fresh_def  pure_supp by auto
+  hence "((bv1 \<leftrightarrow> c) \<bullet> B_id x) = B_id x" using fresh_Pair b.fresh(3) flip_fresh_fresh b.perm_simps fresh_def pure_supp by metis
+  then show ?case using subst_bb.simps by simp
+next
+  case (B_pair x1 x2)
+  hence "x1[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> x1)[c::=b]\<^sub>b\<^sub>b" using  b.perm_simps(4) b.fresh(4) fresh_Pair  by metis
+  moreover have  "x2[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> x2)[c::=b]\<^sub>b\<^sub>b" using  b.perm_simps(4) b.fresh(4) fresh_Pair B_pair by metis
+  ultimately  show ?case using subst_bb.simps(5) b.perm_simps(4) b.fresh(4) fresh_Pair by auto
+next
+  case B_unit
+  then show ?case using subst_bb.simps b.perm_simps by auto
+next
+  case B_bitvec
+  then show ?case using subst_bb.simps b.perm_simps by auto
+next
+  case (B_var x)
+  then show ?case proof(cases "x=bv1")
+    case True
+    then show ?thesis using B_var subst_bb.simps b.perm_simps by simp
+  next
+    case False
+    moreover have "x\<noteq>c" using B_var b.fresh fresh_def supp_at_base fresh_Pair by fastforce
+    ultimately show ?thesis using B_var subst_bb.simps(1) b.perm_simps(7) by simp
+  qed
+next
+  case (B_app x1 x2)
+  hence "x2[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> x2)[c::=b]\<^sub>b\<^sub>b" using  b.perm_simps b.fresh fresh_Pair  by metis 
+  thus ?case using subst_bb.simps b.perm_simps b.fresh fresh_Pair B_app 
+    by (simp add: permute_pure)
+qed
+
+lemma subst_bb_flip_sym:
+  fixes b1::b and b2::b
+  assumes "atom c \<sharp> b" and "atom c \<sharp> (bv1,bv2, b1, b2)" and "(bv1 \<leftrightarrow> c) \<bullet> b1 = (bv2 \<leftrightarrow> c) \<bullet> b2" 
+  shows "b1[bv1::=b]\<^sub>b\<^sub>b = b2[bv2::=b]\<^sub>b\<^sub>b"
+  using assms  flip_b_subst4[of c b1 bv1 b]   flip_b_subst4[of c b2 bv2 b] fresh_prod4 fresh_Pair by simp
+
+section \<open>Value\<close>
+
+nominal_function subst_vb :: "v \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> v" where
+  "subst_vb (V_lit l) x v = V_lit l"
+| "subst_vb (V_var y) x v = V_var y"
+| "subst_vb (V_cons tyid c v') x v  = V_cons tyid c (subst_vb v' x v)"
+| "subst_vb (V_consp tyid c b v') x v  = V_consp tyid c (subst_bb b x v) (subst_vb v' x v)"
+| "subst_vb (V_pair v1 v2) x v = V_pair (subst_vb v1 x v ) (subst_vb v2 x v )"
+                   apply (simp add: eqvt_def subst_vb_graph_aux_def)
+                  apply auto
+  using v.strong_exhaust by meson
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_vb_abbrev :: "v \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> v" ("_[_::=_]\<^sub>v\<^sub>b" [1000,50,50] 500)
+  where 
+    "e[bv::=b]\<^sub>v\<^sub>b  \<equiv> subst_vb e bv b" 
+
+instantiation v :: has_subst_b
+begin
+definition "subst_b = subst_vb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::v
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof (induct t rule: v.induct)
+    case (V_lit l)
+    have "j \<sharp> subst_b (V_lit l) i x = j \<sharp> (V_lit l)"  using subst_vb.simps fresh_def pure_fresh 
+        subst_b_v_def v.supp  v.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def by auto
+    also have "... = True" using fresh_at_base v.fresh l.fresh supp_l_empty fresh_def by metis      
+    moreover have "(atom i \<sharp>  (V_lit l) \<and> j \<sharp>  (V_lit l) \<or> j \<sharp> x \<and> (j \<sharp>  (V_lit l) \<or> j = atom i)) = True" using fresh_at_base v.fresh l.fresh supp_l_empty fresh_def by metis
+    ultimately show ?case by simp
+  next
+    case (V_var y)
+    then show ?case using  subst_b_v_def subst_vb.simps pure_fresh by force   
+  next
+    case (V_pair x1a x2a)
+    then show ?case using subst_b_v_def subst_vb.simps by auto  
+  next
+    case (V_cons x1a x2a x3)       
+    then show ?case using V_cons subst_b_v_def subst_vb.simps pure_fresh by force
+  next
+    case (V_consp x1a x2a x3 x4)
+    then show ?case using  subst_b_v_def subst_vb.simps pure_fresh  has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def by fastforce
+  qed
+
+  fix a::bv and tm::v and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
+    apply(induct tm rule: v.induct)
+        apply(auto simp add: fresh_at_base subst_vb.simps subst_b_v_def)
+    using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
+    using has_subst_b_class.forget_subst by fastforce
+
+  fix a::bv and tm::v
+  show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
+    apply (induct tm rule: v.induct)
+        apply(auto simp add: fresh_at_base subst_vb.simps subst_b_v_def)
+    using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
+    using has_subst_b_class.subst_id by metis
+
+  fix p::perm and x1::bv and v::b and t1::v
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    apply(induct tm rule: v.induct)
+        apply(auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
+    using has_subst_b_class.eqvt  subst_b_b_def e.fresh 
+    using has_subst_b_class.eqvt 
+    by (simp add: subst_b_v_def)+
+
+  fix  bv::bv and c::v and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (induct c rule: v.induct,  (auto simp add: fresh_at_base  subst_vb.simps subst_b_v_def permute_pure pure_supp )+)
+     apply (metis flip_fresh_fresh flip_l_eq permute_flip_cancel2)
+    using  fresh_at_base flip_fresh_fresh[of bv  x z] 
+    apply (simp add: flip_fresh_fresh)
+    using subst_b_b_def by argo
+
+  fix bv::bv and c::v and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    apply (induct c rule: v.induct,  (auto simp add: fresh_at_base  subst_vb.simps subst_b_v_def permute_pure pure_supp )+)
+     apply (metis flip_fresh_fresh flip_l_eq permute_flip_cancel2)
+    using  fresh_at_base flip_fresh_fresh[of bv  x z] 
+    apply (simp add: flip_fresh_fresh)
+    using     subst_b_b_def  flip_subst_subst by fastforce
+
+qed
+end
+
+section \<open>Constraints Expressions\<close>
+
+nominal_function subst_ceb :: "ce \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> ce" where
+  "subst_ceb  ( (CE_val v') ) bv b = ( CE_val (subst_vb v' bv b) )"
+| "subst_ceb  ( (CE_op opp v1 v2) ) bv b = ( (CE_op opp (subst_ceb v1 bv b)(subst_ceb v2 bv b)) )"
+| "subst_ceb  ( (CE_fst v')) bv b = CE_fst (subst_ceb v' bv b)"
+| "subst_ceb  ( (CE_snd v')) bv b = CE_snd (subst_ceb v' bv b)"
+| "subst_ceb  ( (CE_len v')) bv b = CE_len (subst_ceb v' bv b)"
+| "subst_ceb  ( CE_concat v1 v2) bv b = CE_concat (subst_ceb v1 bv b) (subst_ceb v2 bv b)"
+                      apply (simp add: eqvt_def subst_ceb_graph_aux_def)
+                      apply auto
+  by (meson ce.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_ceb_abbrev :: "ce \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> ce" ("_[_::=_]\<^sub>c\<^sub>e\<^sub>b" [1000,50,50] 500)
+  where 
+    "ce[bv::=b]\<^sub>c\<^sub>e\<^sub>b  \<equiv> subst_ceb ce bv b" 
+
+instantiation ce :: has_subst_b
+begin
+definition "subst_b = subst_ceb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::ce
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof (induct t rule: ce.induct)
+    case (CE_val v)
+    then show ?case using subst_ceb.simps fresh_def pure_fresh subst_b_ce_def ce.supp v.supp  ce.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def
+      by metis
+  next
+    case (CE_op opp v1 v2)    
+
+    have "(j \<sharp> v1[i::=x]\<^sub>c\<^sub>e\<^sub>b \<and> j \<sharp> v2[i::=x]\<^sub>c\<^sub>e\<^sub>b) = ((atom i \<sharp> v1 \<and> atom i \<sharp> v2) \<and> j \<sharp> v1 \<and> j \<sharp> v2 \<or> j \<sharp> x \<and> (j \<sharp> v1 \<and> j \<sharp> v2 \<or> j = atom i))"
+      using has_subst_b_class.fresh_subst_if subst_b_v_def 
+      using CE_op.hyps(1) CE_op.hyps(2) subst_b_ce_def by auto
+
+    thus ?case  unfolding subst_ceb.simps subst_b_ce_def ce.fresh 
+      using fresh_def pure_fresh opp.fresh subst_b_v_def  opp.exhaust fresh_e_opp_all
+      by (metis (full_types))      
+  next
+    case (CE_concat x1a x2)
+    then show ?case  using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by force
+  next
+    case (CE_fst x)
+    then show ?case using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by metis
+
+  next
+    case (CE_snd x)
+    then show ?case using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by metis
+  next
+    case (CE_len x)
+    then show ?case using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by metis
+  qed
+
+  fix a::bv and tm::ce and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
+    apply(induct tm rule: ce.induct)
+         apply( auto simp add: fresh_at_base subst_ceb.simps subst_b_ce_def)
+    using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
+    using has_subst_b_class.forget_subst subst_b_v_def apply metis+
+    done
+
+  fix a::bv and tm::ce
+  show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
+    apply (induct tm rule: ce.induct)
+         apply(auto simp add: fresh_at_base subst_ceb.simps subst_b_ce_def)
+    using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
+    using has_subst_b_class.subst_id subst_b_v_def apply metis+
+    done
+
+  fix p::perm and x1::bv and v::b and t1::ce
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    apply(induct tm rule: ce.induct)
+         apply( auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
+    using has_subst_b_class.eqvt  subst_b_b_def ce.fresh 
+    using has_subst_b_class.eqvt 
+    by (simp add: subst_b_ce_def)+
+
+  fix  bv::bv and c::ce and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (induct c rule: ce.induct,  (auto simp add: fresh_at_base  subst_ceb.simps subst_b_ce_def permute_pure pure_supp )+)
+    using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def apply metis
+    using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def 
+    by (simp add: flip_fresh_fresh fresh_opp_all)  
+
+  fix bv::bv and c::ce and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+  proof (induct c rule: ce.induct)
+    case (CE_val x)
+    then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
+  next
+    case (CE_op x1a x2 x3)
+    then show ?case unfolding subst_ceb.simps subst_b_ce_def ce.perm_simps using flip_subst_subst subst_b_v_def  opp.perm_simps opp.strong_exhaust 
+      by (metis (full_types) ce.fresh(2))
+  next
+    case (CE_concat x1a x2)
+    then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
+  next
+    case (CE_fst x)
+    then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
+  next
+    case (CE_snd x)
+    then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
+  next
+    case (CE_len x)
+    then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
+  qed
+qed
+end
+
+section \<open>Constraints\<close>
+
+nominal_function subst_cb :: "c \<Rightarrow> bv \<Rightarrow> b  \<Rightarrow> c" where
+  "subst_cb (C_true) x v = C_true"
+|  "subst_cb (C_false) x v = C_false"
+|  "subst_cb (C_conj c1 c2) x v = C_conj (subst_cb c1 x v ) (subst_cb c2 x v )"
+|  "subst_cb (C_disj c1 c2) x v = C_disj (subst_cb c1 x v ) (subst_cb c2 x v )"
+|  "subst_cb (C_imp c1 c2) x v = C_imp (subst_cb c1 x v ) (subst_cb c2 x v )"
+|  "subst_cb (C_eq e1 e2) x v = C_eq (subst_ceb e1 x v ) (subst_ceb e2 x v )"
+|  "subst_cb (C_not c) x v = C_not (subst_cb c x v )"
+                      apply (simp add: eqvt_def subst_cb_graph_aux_def)
+                      apply auto 
+  using c.strong_exhaust apply metis
+  done
+nominal_termination (eqvt)  by lexicographic_order
+
+abbreviation 
+  subst_cb_abbrev :: "c \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> c" ("_[_::=_]\<^sub>c\<^sub>b" [1000,50,50] 500)
+  where 
+    "c[bv::=b]\<^sub>c\<^sub>b  \<equiv> subst_cb c bv b" 
+
+instantiation c :: has_subst_b
+begin
+definition "subst_b = subst_cb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::c
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+    by (induct t rule: c.induct, unfold subst_cb.simps subst_b_c_def c.fresh,
+        (metis has_subst_b_class.fresh_subst_if subst_b_ce_def c.fresh)+
+        )
+
+  fix a::bv and tm::c and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
+    by(induct tm rule: c.induct, unfold subst_cb.simps subst_b_c_def c.fresh,
+        (metis has_subst_b_class.forget_subst subst_b_ce_def)+)
+
+  fix a::bv and tm::c
+  show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_c_def 
+    by(induct tm rule: c.induct, unfold subst_cb.simps subst_b_c_def c.fresh,
+        (metis has_subst_b_class.subst_id subst_b_ce_def)+)
+
+  fix p::perm and x1::bv and v::b and t1::c
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    apply(induct tm rule: c.induct,unfold subst_cb.simps subst_b_c_def c.fresh)
+    by( auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
+
+  fix  bv::bv and c::c and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (induct c rule: c.induct,  (auto simp add: fresh_at_base  subst_cb.simps subst_b_c_def permute_pure pure_supp )+)
+    using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def apply metis
+    using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def 
+    apply (metis opp.perm_simps(2) opp.strong_exhaust)+
+    done
+
+  fix bv::bv and c::c and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    apply (induct c rule: c.induct,  (auto simp add: fresh_at_base  subst_cb.simps subst_b_c_def permute_pure pure_supp )+)
+    using flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def 
+    using flip_subst_subst apply fastforce
+    using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def 
+      opp.perm_simps(2) opp.strong_exhaust 
+  proof -
+    fix x1a :: ce and x2 :: ce
+    assume a1: "atom bv \<sharp> x2"
+    then have "((bv \<leftrightarrow> z) \<bullet> x2)[bv::=v]\<^sub>b = x2[z::=v]\<^sub>b"
+      by (metis flip_subst_subst) (* 0.0 ms *)
+    then show "x2[z::=B_var bv]\<^sub>b[bv::=v]\<^sub>c\<^sub>e\<^sub>b = x2[z::=v]\<^sub>c\<^sub>e\<^sub>b"
+      using a1 by (simp add: subst_b_ce_def) (* 0.0 ms *)
+  qed
+
+qed
+end
+
+section \<open>Types\<close>
+
+nominal_function subst_tb :: "\<tau> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<tau>" where
+  "subst_tb  (\<lbrace> z : b2 | c \<rbrace>) bv1 b1 = \<lbrace> z : b2[bv1::=b1]\<^sub>b\<^sub>b | c[bv1::=b1]\<^sub>c\<^sub>b \<rbrace>"
+proof(goal_cases)
+  case 1
+  then show ?case using eqvt_def subst_tb_graph_aux_def by force
+next
+  case (2 x y)
+  then show ?case by auto
+next
+  case (3 P x)
+  then show ?case using eqvt_def subst_tb_graph_aux_def \<tau>.strong_exhaust 
+    by (metis b_of.cases prod_cases3)
+next
+  case (4 z' b2' c' bv1' b1' z b2 c bv1 b1)
+  show ?case unfolding \<tau>.eq_iff proof
+    have *:"[[atom z']]lst. c' = [[atom z]]lst. c" using  \<tau>.eq_iff 4 by auto
+    show "[[atom z']]lst. c'[bv1'::=b1']\<^sub>c\<^sub>b = [[atom z]]lst. c[bv1::=b1]\<^sub>c\<^sub>b" 
+    proof(subst Abs1_eq_iff_all(3),rule,rule,rule)
+      fix ca::x
+      assume "atom ca \<sharp> z" and 1:"atom ca \<sharp> (z', z, c'[bv1'::=b1']\<^sub>c\<^sub>b, c[bv1::=b1]\<^sub>c\<^sub>b)" 
+      hence 2:"atom ca \<sharp> (c',c)" using fresh_subst_if subst_b_c_def fresh_Pair fresh_prod4 fresh_at_base subst_b_fresh_x by metis
+      hence "(z' \<leftrightarrow> ca) \<bullet> c' = (z \<leftrightarrow> ca) \<bullet> c"  using 1 2 * Abs1_eq_iff_all(3) by auto
+      hence "((z' \<leftrightarrow> ca) \<bullet> c')[bv1'::=b1']\<^sub>c\<^sub>b = ((z \<leftrightarrow> ca) \<bullet> c)[bv1'::=b1']\<^sub>c\<^sub>b" by auto      
+      hence "(z' \<leftrightarrow> ca) \<bullet> c'[(z' \<leftrightarrow> ca) \<bullet> bv1'::=(z' \<leftrightarrow> ca) \<bullet> b1']\<^sub>c\<^sub>b = (z \<leftrightarrow> ca) \<bullet> c[(z \<leftrightarrow> ca) \<bullet> bv1'::=(z \<leftrightarrow> ca) \<bullet> b1']\<^sub>c\<^sub>b" by auto  
+      thus "(z' \<leftrightarrow> ca) \<bullet> c'[bv1'::=b1']\<^sub>c\<^sub>b = (z \<leftrightarrow> ca) \<bullet> c[bv1::=b1]\<^sub>c\<^sub>b" using  4  flip_x_b_cancel by simp
+    qed
+    show "b2'[bv1'::=b1']\<^sub>b\<^sub>b = b2[bv1::=b1]\<^sub>b\<^sub>b" using 4 by simp
+  qed
+qed
+
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_tb_abbrev :: "\<tau> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<tau>" ("_[_::=_]\<^sub>\<tau>\<^sub>b" [1000,50,50] 1000)
+  where 
+    "t[bv::=b']\<^sub>\<tau>\<^sub>b  \<equiv> subst_tb t bv b' " 
+
+instantiation \<tau> :: has_subst_b
+begin
+definition "subst_b = subst_tb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::\<tau>
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof (nominal_induct t avoiding: i x j rule: \<tau>.strong_induct)
+    case (T_refined_type z b c)
+    then show ?case
+      unfolding subst_b_\<tau>_def  subst_tb.simps \<tau>.fresh
+      using fresh_subst_if[of j b i x ] subst_b_b_def subst_b_c_def
+      by (metis has_subst_b_class.fresh_subst_if list.distinct(1) list.set_cases not_self_fresh set_ConsD)
+  qed
+
+  fix a::bv and tm::\<tau> and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x  = tm"
+  proof (nominal_induct tm avoiding: a x rule: \<tau>.strong_induct)
+    case (T_refined_type xx bb cc )
+    moreover hence "atom a \<sharp> bb \<and> atom a \<sharp> cc" using \<tau>.fresh by auto
+    ultimately show   ?case  
+      unfolding  subst_b_\<tau>_def subst_tb.simps 
+      using forget_subst subst_b_b_def subst_b_c_def forget_subst \<tau>.fresh by metis
+  qed
+
+  fix a::bv and tm::\<tau>
+  show "subst_b tm a (B_var a) = tm" 
+  proof (nominal_induct tm rule: \<tau>.strong_induct)
+    case (T_refined_type xx bb cc)
+    thus  ?case  
+      unfolding  subst_b_\<tau>_def subst_tb.simps 
+      using subst_id subst_b_b_def subst_b_c_def by metis
+  qed
+
+  fix p::perm and x1::bv and v::b and t1::\<tau>
+  show "p \<bullet> subst_b t1 x1 v = subst_b (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v) " 
+    by (induct tm rule: \<tau>.induct, auto simp add: fresh_at_base subst_tb.simps subst_b_\<tau>_def subst_bb.simps subst_b_b_def)
+
+  fix  bv::bv and c::\<tau> and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (induct c rule: \<tau>.induct,  (auto simp add: fresh_at_base  subst_ceb.simps subst_b_ce_def permute_pure pure_supp )+)
+    using  flip_fresh_fresh permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_c_def  subst_b_b_def 
+    by (simp add: flip_fresh_fresh subst_b_\<tau>_def)
+
+  fix bv::bv and c::\<tau> and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+  proof (induct c rule: \<tau>.induct)
+    case (T_refined_type x1a x2a x3a)
+    hence "atom bv \<sharp> x2a \<and> atom bv \<sharp> x3a \<and> atom bv \<sharp> x1a" using fresh_at_base \<tau>.fresh by simp
+    then show ?case 
+      unfolding subst_tb.simps subst_b_\<tau>_def \<tau>.perm_simps 
+      using fresh_at_base flip_fresh_fresh[of bv x1a z] flip_subst_subst subst_b_b_def  subst_b_c_def T_refined_type 
+    proof -
+      have "atom z \<sharp> x1a"
+        by (metis b.fresh(7) fresh_at_base(2) x_fresh_b) (* 0.0 ms *)
+      then show "\<lbrace> (bv \<leftrightarrow> z) \<bullet> x1a : ((bv \<leftrightarrow> z) \<bullet> x2a)[bv::=v]\<^sub>b\<^sub>b | ((bv \<leftrightarrow> z) \<bullet> x3a)[bv::=v]\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x1a : x2a[z::=v]\<^sub>b\<^sub>b | x3a[z::=v]\<^sub>c\<^sub>b \<rbrace>"
+        by (metis \<open>\<lbrakk>atom bv \<sharp> x1a; atom z \<sharp> x1a\<rbrakk> \<Longrightarrow> (bv \<leftrightarrow> z) \<bullet> x1a = x1a\<close> \<open>atom bv \<sharp> x2a \<and> atom bv \<sharp> x3a \<and> atom bv \<sharp> x1a\<close> flip_subst_subst subst_b_b_def subst_b_c_def) (* 78 ms *)
+    qed 
+  qed
+
+qed
+end
+
+lemma subst_bb_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_bb (subst_bb A i t ) j u ) = subst_bb A i (subst_bb t j u) "
+  by (nominal_induct A avoiding: i j t u rule: b.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_vb_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_vb  (subst_vb A i t )) j u = subst_vb A i (subst_bb t j u ) "
+  by (nominal_induct A avoiding: i j t u rule: v.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_ceb_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_ceb  (subst_ceb A i t )) j u = subst_ceb A i (subst_bb t j u ) "
+  by (nominal_induct A avoiding: i j t u rule: ce.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_cb_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_cb  (subst_cb A i t )) j u = subst_cb A i (subst_bb t j u ) "
+  by (nominal_induct A avoiding: i j t u rule: c.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_tb_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_tb  (subst_tb A i t )) j u = subst_tb A i (subst_bb t j u ) "
+proof (nominal_induct A avoiding: i j t u rule: \<tau>.strong_induct)
+  case (T_refined_type z b c)
+  then show ?case using subst_tb.simps subst_bb_commute subst_cb_commute by simp
+qed
+
+section \<open>Expressions\<close>
+
+nominal_function subst_eb :: "e \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> e" where
+  "subst_eb ( (AE_val v')) bv b  = ( AE_val (subst_vb v' bv b))"
+| "subst_eb ( (AE_app f v') ) bv b = ( (AE_app f (subst_vb v' bv b)) )"                
+| "subst_eb ( (AE_appP f b' v') ) bv b = ( (AE_appP f (b'[bv::=b]\<^sub>b\<^sub>b) (subst_vb v' bv b)))"   
+| "subst_eb ( (AE_op opp v1 v2) ) bv b = ( (AE_op opp (subst_vb v1 bv b) (subst_vb v2 bv b)) )"
+| "subst_eb ( (AE_fst v')) bv b = AE_fst (subst_vb v' bv b)"
+| "subst_eb ( (AE_snd v')) bv b = AE_snd (subst_vb v' bv b)"
+| "subst_eb ( (AE_mvar u)) bv b = AE_mvar u"
+| "subst_eb ( (AE_len v')) bv b = AE_len (subst_vb v' bv b)"
+| "subst_eb ( AE_concat v1 v2) bv b = AE_concat (subst_vb v1 bv b) (subst_vb v2 bv b)"
+| "subst_eb ( AE_split v1 v2) bv b = AE_split (subst_vb v1 bv b) (subst_vb v2 bv b)"
+                      apply (simp add: eqvt_def subst_eb_graph_aux_def)
+                      apply auto
+  by (meson e.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_eb_abbrev :: "e \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> e" ("_[_::=_]\<^sub>e\<^sub>b" [1000,50,50] 500)
+  where 
+    "e[bv::=b]\<^sub>e\<^sub>b  \<equiv> subst_eb e bv b" 
+
+instantiation e :: has_subst_b
+begin
+definition "subst_b = subst_eb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::e
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof (induct t rule: e.induct)
+    case (AE_val v)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  
+        e.fresh has_subst_b_class.fresh_subst_if subst_b_e_def subst_b_v_def
+      by metis
+  next
+    case (AE_app f v)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def 
+        e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def 
+      by (metis (mono_tags, hide_lams) e.fresh(2))
+  next
+    case (AE_appP f b' v)
+    then show ?case unfolding subst_eb.simps   subst_b_e_def e.fresh using
+        fresh_def pure_fresh subst_b_e_def e.supp v.supp
+        e.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_vb_def   by (metis subst_b_v_def)
+  next
+    case (AE_op opp v1 v2)
+    then show ?case unfolding subst_eb.simps   subst_b_e_def e.fresh using
+        fresh_def pure_fresh subst_b_e_def e.supp v.supp fresh_e_opp_all
+        e.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_vb_def   by (metis subst_b_v_def)  
+  next
+    case (AE_concat x1a x2)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  
+        has_subst_b_class.fresh_subst_if subst_b_v_def 
+      by (metis subst_vb.simps(5))
+  next
+    case (AE_split x1a x2)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  
+        has_subst_b_class.fresh_subst_if subst_b_v_def 
+      by (metis subst_vb.simps(5))
+  next
+    case (AE_fst x)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  by metis
+  next
+    case (AE_snd x)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp using  has_subst_b_class.fresh_subst_if subst_b_v_def  by metis
+  next
+    case (AE_mvar x)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  by auto
+  next
+    case (AE_len x)
+    then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp   using  has_subst_b_class.fresh_subst_if subst_b_v_def  by metis
+  qed
+
+  fix a::bv and tm::e and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
+    apply(induct tm rule: e.induct)
+             apply( auto simp add: fresh_at_base subst_eb.simps subst_b_e_def)
+    using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
+    using has_subst_b_class.forget_subst subst_b_v_def apply metis+
+    done
+
+  fix a::bv and tm::e
+  show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
+    apply (induct tm rule: e.induct)
+             apply(auto simp add: fresh_at_base subst_eb.simps subst_b_e_def)
+    using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
+    using has_subst_b_class.subst_id subst_b_v_def apply metis+
+    done
+
+  fix p::perm and x1::bv and v::b and t1::e
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    apply(induct tm rule: e.induct)
+             apply( auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
+    using has_subst_b_class.eqvt  subst_b_b_def e.fresh 
+    using has_subst_b_class.eqvt 
+    by (simp add: subst_b_e_def)+
+
+  fix  bv::bv and c::e and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (induct c rule: e.induct)
+             apply(auto simp add: fresh_at_base  subst_eb.simps subst_b_e_def subst_b_v_def  permute_pure pure_supp )
+    using  flip_fresh_fresh permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def  subst_b_b_def 
+      flip_fresh_fresh subst_b_\<tau>_def apply metis
+    apply (metis (full_types) opp.perm_simps  opp.strong_exhaust)
+    done
+
+  fix bv::bv and c::e and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    apply (induct c rule: e.induct)
+             apply(auto simp add: fresh_at_base  subst_eb.simps subst_b_e_def subst_b_v_def  permute_pure pure_supp )
+    using  flip_fresh_fresh permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def  subst_b_b_def 
+      flip_fresh_fresh subst_b_\<tau>_def apply simp
+
+    apply (metis (full_types) opp.perm_simps  opp.strong_exhaust)
+    done
+qed
+end
+
+section \<open>Statements\<close>
+
+nominal_function (default "case_sum (\<lambda>x. Inl undefined) (case_sum (\<lambda>x. Inl undefined) (\<lambda>x. Inr undefined))")
+  subst_sb :: "s \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> s"
+  and subst_branchb :: "branch_s \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> branch_s" 
+  and subst_branchlb :: "branch_list \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> branch_list"
+  where
+    "subst_sb (AS_val v') bv b         = (AS_val (subst_vb v' bv b))"
+  | "subst_sb  (AS_let y  e s)  bv b   = (AS_let y  (e[bv::=b]\<^sub>e\<^sub>b) (subst_sb s bv b ))"  
+  | "subst_sb (AS_let2 y t s1 s2) bv b = (AS_let2 y (subst_tb t bv b) (subst_sb s1 bv b ) (subst_sb s2 bv b))"  
+  | "subst_sb (AS_match v'  cs) bv b   = AS_match  (subst_vb v' bv b)  (subst_branchlb cs bv b)"
+  | "subst_sb  (AS_assign y v') bv b   = AS_assign y (subst_vb v' bv b)"
+  | "subst_sb  (AS_if v' s1 s2) bv b   = (AS_if (subst_vb v' bv b) (subst_sb s1 bv b ) (subst_sb s2 bv b ) )"  
+  | "subst_sb  (AS_var u \<tau> v' s) bv b  = AS_var u (subst_tb  \<tau> bv b)  (subst_vb v' bv b) (subst_sb s bv b )"
+  | "subst_sb  (AS_while s1 s2) bv b   = AS_while (subst_sb s1 bv b  ) (subst_sb s2 bv b )"
+  | "subst_sb  (AS_seq s1 s2)  bv b    = AS_seq (subst_sb s1 bv b ) (subst_sb s2 bv b )"
+  | "subst_sb  (AS_assert c s)  bv b   = AS_assert (subst_cb c bv b ) (subst_sb s bv b )"
+
+| "subst_branchb (AS_branch dc x1 s') bv b = AS_branch dc x1 (subst_sb s' bv b)"
+
+| "subst_branchlb  (AS_final sb)  bv b     = AS_final (subst_branchb sb bv b )"
+| "subst_branchlb  (AS_cons sb ssb) bv b   = AS_cons (subst_branchb sb bv b) (subst_branchlb ssb bv b)"
+
+                      apply (simp add: eqvt_def subst_sb_subst_branchb_subst_branchlb_graph_aux_def )                    
+                      apply (auto,metis s_branch_s_branch_list.exhaust s_branch_s_branch_list.exhaust(2) old.sum.exhaust surj_pair)
+
+proof(goal_cases)
+
+  have eqvt_at_proj: "\<And> s xa va . eqvt_at subst_sb_subst_branchb_subst_branchlb_sumC (Inl (s, xa, va)) \<Longrightarrow> 
+           eqvt_at (\<lambda>a. projl (subst_sb_subst_branchb_subst_branchlb_sumC (Inl a))) (s, xa, va)"
+    apply(simp only: eqvt_at_def)
+    apply(rule)
+    apply(subst Projl_permute)
+     apply(thin_tac _)+
+     apply(simp add: subst_sb_subst_branchb_subst_branchlb_sumC_def)
+     apply(simp add: THE_default_def)
+     apply(case_tac "Ex1 (subst_sb_subst_branchb_subst_branchlb_graph (Inl (s,xa,va)))")
+      apply simp
+      apply(auto)[1]
+      apply(erule_tac x="x" in allE)
+      apply simp
+      apply(cases rule: subst_sb_subst_branchb_subst_branchlb_graph.cases)    
+                   apply(assumption)
+                  apply(rule_tac x="Sum_Type.projl x" in exI,clarify,rule the1_equality,blast,simp (no_asm) only: sum.sel)+
+        apply(blast)+
+    apply(simp)+      
+    done
+  {
+    case (1 y s bv b ya sa c)
+    moreover have  "atom y \<sharp> (bv, b) \<and> atom ya \<sharp> (bv, b)" using x_fresh_b x_fresh_bv fresh_Pair by simp  
+    ultimately show ?case 
+      using eqvt_triple eqvt_at_proj by metis
+  next
+    case (2 y s1 s2 bv b ya s2a c)
+    moreover have  "atom y \<sharp> (bv, b) \<and> atom ya \<sharp> (bv, b)" using x_fresh_b x_fresh_bv   fresh_Pair by simp
+    ultimately show ?case 
+      using eqvt_triple eqvt_at_proj by metis
+  next
+    case (3 u s bv b ua sa c)
+    moreover have  "atom u \<sharp> (bv, b) \<and> atom ua \<sharp> (bv, b)" using x_fresh_b x_fresh_bv   fresh_Pair by simp
+    ultimately show ?case using eqvt_triple eqvt_at_proj by metis
+  next
+    case (4 x1 s' bv b x1a s'a c)
+    moreover have  "atom x1 \<sharp> (bv, b) \<and> atom x1a \<sharp> (bv, b)" using x_fresh_b x_fresh_bv   fresh_Pair by simp
+    ultimately show ?case using eqvt_triple eqvt_at_proj by metis
+  }
+qed
+
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_sb_abbrev :: "s \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> s" ("_[_::=_]\<^sub>s\<^sub>b" [1000,50,50] 1000)
+  where 
+    "b[bv::=b']\<^sub>s\<^sub>b  \<equiv> subst_sb b bv b'" 
+
+lemma fresh_subst_sb_if [simp]: 
+  "(j \<sharp> (subst_sb A i x  ))  = ((atom i \<sharp> A \<and> j \<sharp> A) \<or> (j \<sharp> x \<and> (j \<sharp> A \<or> j = atom i)))" and
+  "(j \<sharp> (subst_branchb B i x  ))  = ((atom i \<sharp> B \<and> j \<sharp> B) \<or> (j \<sharp> x \<and> (j \<sharp> B \<or> j = atom i)))"  and
+  "(j \<sharp> (subst_branchlb C i x  ))  = ((atom i \<sharp> C \<and> j \<sharp> C) \<or> (j \<sharp> x \<and> (j \<sharp> C \<or> j = atom i)))"  
+proof (nominal_induct A and B and C avoiding: i x rule: s_branch_s_branch_list.strong_induct)
+  case (AS_branch x1 x2 x3)
+  have " (j \<sharp> subst_branchb (AS_branch x1 x2 x3) i x ) =  (j \<sharp> (AS_branch x1 x2 (subst_sb x3 i x)))" by auto
+  also have "... = ((j \<sharp> x3[i::=x]\<^sub>s\<^sub>b \<or> j \<in> set [atom x2]) \<and> j \<sharp> x1)" using s_branch_s_branch_list.fresh by auto
+  also have "...  = ((atom i \<sharp> AS_branch x1 x2 x3 \<and> j \<sharp> AS_branch x1 x2 x3) \<or> j \<sharp> x \<and> (j \<sharp> AS_branch x1 x2 x3 \<or> j = atom i))"  
+    using subst_branchb.simps(1) s_branch_s_branch_list.fresh(1)  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_\<tau>_def 
+      v.fresh AS_branch
+  proof -
+    have f1: "\<forall>cs b. atom (b::bv) \<sharp> (cs::char list)" using pure_fresh by auto
+
+    then have "j \<sharp> x \<and> atom i = j \<longrightarrow> ((j \<sharp> x3[i::=x]\<^sub>s\<^sub>b \<or> j \<in> set [atom x2]) \<and> j \<sharp> x1) = (atom i \<sharp> AS_branch x1 x2 x3 \<and> j \<sharp> AS_branch x1 x2 x3 \<or> j \<sharp> x \<and> (j \<sharp> AS_branch x1 x2 x3 \<or> j = atom i))"
+      by (metis (full_types) AS_branch.hyps(3))
+    then have "j \<sharp> x \<longrightarrow> ((j \<sharp> x3[i::=x]\<^sub>s\<^sub>b \<or> j \<in> set [atom x2]) \<and> j \<sharp> x1) = (atom i \<sharp> AS_branch x1 x2 x3 \<and> j \<sharp> AS_branch x1 x2 x3 \<or> j \<sharp> x \<and> (j \<sharp> AS_branch x1 x2 x3 \<or> j = atom i))"
+      using  AS_branch.hyps s_branch_s_branch_list.fresh by metis
+    moreover
+    { assume "\<not> j \<sharp> x"
+      have ?thesis
+        using f1 AS_branch.hyps(2) AS_branch.hyps(3) by force  }
+    ultimately show ?thesis
+      by satx 
+  qed   
+  finally show ?case by auto  
+next
+  case (AS_cons cs css i x)
+  show ?case 
+    unfolding subst_branchlb.simps s_branch_s_branch_list.fresh 
+    using AS_cons by auto
+next
+  case (AS_val xx)
+  then show ?case using  subst_sb.simps(1) s_branch_s_branch_list.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def by metis
+next
+  case (AS_let x1 x2 x3)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_e_def 
+    by fastforce
+next
+  case (AS_let2 x1 x2 x3 x4)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_\<tau>_def
+    by fastforce
+next
+  case (AS_if x1 x2 x3)
+  then show ?case unfolding   subst_sb.simps s_branch_s_branch_list.fresh using
+      has_subst_b_class.fresh_subst_if  subst_b_v_def   by metis
+next
+  case (AS_var u t v s)
+
+  have "(((atom i \<sharp> s \<and> j \<sharp> s \<or> j \<sharp> x \<and> (j \<sharp> s \<or> j = atom i)) \<or> j \<in> set [atom u]) \<and> j \<sharp> t[i::=x]\<^sub>\<tau>\<^sub>b \<and> j \<sharp> v[i::=x]\<^sub>v\<^sub>b) = 
+          (((atom i \<sharp> s \<and> j \<sharp> s \<or> j \<sharp> x \<and> (j \<sharp> s \<or> j = atom i)) \<or> j \<in> set [atom u]) \<and> 
+                    ((atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))) \<and>
+                    ((atom i \<sharp> v \<and> j \<sharp> v \<or> j \<sharp> x \<and> (j \<sharp> v \<or> j = atom i))))" 
+    using    has_subst_b_class.fresh_subst_if  subst_b_v_def  subst_b_\<tau>_def by metis
+  also have "... =  (((atom i \<sharp> s \<or> atom i \<in> set [atom u]) \<and> atom i \<sharp> t \<and> atom i \<sharp> v) \<and> 
+               (j \<sharp> s \<or> j \<in> set [atom u]) \<and> j \<sharp> t \<and> j \<sharp> v \<or> j \<sharp> x \<and> ((j \<sharp> s \<or> j \<in> set [atom u]) \<and> j \<sharp> t \<and> j \<sharp> v \<or> j = atom i))" 
+    using u_fresh_b by auto
+  finally show ?case using  subst_sb.simps s_branch_s_branch_list.fresh AS_var 
+    by simp
+next
+  case (AS_assign u v )
+  then show ?case unfolding   subst_sb.simps s_branch_s_branch_list.fresh using
+      has_subst_b_class.fresh_subst_if  subst_b_v_def by force
+next
+  case (AS_match v cs)
+  have " j \<sharp> (AS_match v cs)[i::=x]\<^sub>s\<^sub>b = j \<sharp> (AS_match (subst_vb v i x) (subst_branchlb cs i x ))" using subst_sb.simps by auto
+  also have "... = (j \<sharp> (subst_vb v i x) \<and> j \<sharp> (subst_branchlb cs i x ))" using s_branch_s_branch_list.fresh by simp
+  also have "... = (j \<sharp> (subst_vb v i x) \<and> ((atom i \<sharp> cs \<and> j \<sharp> cs) \<or> j \<sharp> x \<and> (j \<sharp> cs \<or> j = atom i)))" using  AS_match[of i x] by auto
+  also have "... =  (atom i \<sharp> AS_match v cs \<and> j \<sharp> AS_match v cs \<or> j \<sharp> x \<and> (j \<sharp> AS_match v cs \<or> j = atom i))" 
+    by (metis (no_types) s_branch_s_branch_list.fresh has_subst_b_class.fresh_subst_if subst_b_v_def) (* 93 ms *)  
+  finally show ?case by auto
+next
+  case (AS_while x1 x2)
+  then show ?case by auto
+next
+  case (AS_seq x1 x2)
+  then show ?case by auto
+next
+  case (AS_assert x1 x2)
+  then show ?case unfolding subst_sb.simps  s_branch_s_branch_list.fresh 
+    using  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_e_def 
+    by (metis subst_b_c_def)   
+qed(auto+)
+
+lemma 
+  forget_subst_sb[simp]: "atom a \<sharp> A \<Longrightarrow> subst_sb A a x = A" and
+  forget_subst_branchb [simp]: "atom a \<sharp> B \<Longrightarrow> subst_branchb B a x = B" and 
+  forget_subst_branchlb[simp]: "atom a \<sharp> C \<Longrightarrow> subst_branchlb C a x = C"
+proof (nominal_induct A and B and C avoiding: a x rule: s_branch_s_branch_list.strong_induct)
+  case (AS_let x1 x2 x3)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_let2 x1 x2 x3 x4)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_\<tau>_def by force
+next
+  case (AS_var x1 x2 x3 x4)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def  using subst_b_\<tau>_def 
+  proof -
+    have f1: "(atom a \<sharp> x4 \<or> atom a \<in> set [atom x1]) \<and> atom a \<sharp> x2 \<and> atom a \<sharp> x3"
+      using AS_var.prems s_branch_s_branch_list.fresh  by simp
+    then have "atom a \<sharp> x4"
+      by (metis (no_types) "Nominal-Utils.fresh_star_singleton" AS_var.hyps(1) empty_set fresh_star_def list.simps(15) not_self_fresh) (* 46 ms *)
+    then show ?thesis
+      using f1 by (metis AS_var.hyps(3) has_subst_b_class.forget_subst subst_b_\<tau>_def subst_b_v_def subst_sb.simps(7)) (* 62 ms *)
+  qed
+next
+  case (AS_branch x1 x2 x3)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_cons x1 x2 x3 x4)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_val x)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_if x1 x2 x3)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_assign x1 x2)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_match x1 x2)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_while x1 x2)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_seq x1 x2)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
+next
+  case (AS_assert c s)
+  then show ?case unfolding  subst_sb.simps using
+      s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def  subst_b_c_def subst_cb.simps  by force
+qed(auto+)
+
+lemma   subst_sb_id: "subst_sb A a (B_var a) = A" and
+  subst_branchb_id [simp]: "subst_branchb B a (B_var a) = B" and
+  subst_branchlb_id: "subst_branchlb C a (B_var a) = C"
+proof(nominal_induct A and B and C avoiding: a  rule: s_branch_s_branch_list.strong_induct)
+  case (AS_branch x1 x2 x3)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def 
+    by simp
+next
+  case (AS_cons x1 x2 )
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by simp
+next
+  case (AS_val x)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_if x1 x2 x3)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_assign x1 x2)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_match x1 x2)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_while x1 x2)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_seq x1 x2)
+  then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_let x1 x2 x3)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.subst_id by metis
+next
+  case (AS_let2 x1 x2 x3 x4)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id by metis
+next
+  case (AS_var x1 x2 x3 x4)
+  then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
+next
+  case (AS_assert c s )
+  then show ?case unfolding subst_sb.simps using s_branch_s_branch_list.fresh subst_b_c_def has_subst_b_class.subst_id by metis
+qed (auto)
+
+lemma flip_subst_s:
+  fixes  bv::bv and s::s and cs::branch_s and z::bv
+  shows   "atom bv \<sharp> s \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> s) = s[z::=B_var bv]\<^sub>s\<^sub>b"  and
+    "atom bv \<sharp> cs \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> cs) = subst_branchb  cs z (B_var bv) " and
+    "atom bv \<sharp> css \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> css) = subst_branchlb css z (B_var bv) "
+
+proof(nominal_induct s and cs and css  rule: s_branch_s_branch_list.strong_induct)
+  case (AS_branch x1 x2 x3)
+  hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1"  using pure_fresh fresh_at_base flip_fresh_fresh  by metis
+  moreover have "((bv \<leftrightarrow> z) \<bullet> x2) = x2" using  fresh_at_base flip_fresh_fresh[of bv x2 z] AS_branch  by auto
+  ultimately show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using s_branch_s_branch_list.fresh(1) AS_branch by auto
+next
+  case (AS_cons x1 x2 )
+  hence "((bv \<leftrightarrow> z) \<bullet> x1) =  subst_branchb x1 z (B_var bv)"  using pure_fresh fresh_at_base flip_fresh_fresh  s_branch_s_branch_list.fresh(13)  by metis
+  moreover have "((bv \<leftrightarrow> z) \<bullet> x2) =  subst_branchlb x2 z (B_var bv)" using  fresh_at_base flip_fresh_fresh[of bv x2 z] AS_cons s_branch_s_branch_list.fresh by metis
+  ultimately show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using s_branch_s_branch_list.fresh(1) AS_cons by auto
+next
+  case (AS_val x)
+  then show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using flip_subst subst_b_v_def by simp
+next
+  case (AS_let x1 x2 x3)
+  moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
+  ultimately show ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def s_branch_s_branch_list.fresh by auto 
+next
+  case (AS_let2 x1 x2 x3 x4)
+  moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
+  ultimately show ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst s_branch_s_branch_list.fresh(5) subst_b_\<tau>_def by auto
+next
+  case (AS_if x1 x2 x3) 
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_var x1 x2 x3 x4)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def subst_b_\<tau>_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
+next
+  case (AS_assign x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
+next
+  case (AS_match x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_while x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_seq x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_assert x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_c_def subst_b_v_def s_branch_s_branch_list.fresh by simp
+qed(auto)
+
+lemma flip_subst_subst_s:
+  fixes  bv::bv and s::s and cs::branch_s and z::bv
+  shows   "atom bv \<sharp> s \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> s)[bv::=v]\<^sub>s\<^sub>b = s[z::=v]\<^sub>s\<^sub>b"    and
+    "atom bv \<sharp> cs \<Longrightarrow> subst_branchb ((bv \<leftrightarrow> z) \<bullet> cs) bv v = subst_branchb cs z v" and
+    "atom bv \<sharp> css \<Longrightarrow> subst_branchlb ((bv \<leftrightarrow> z) \<bullet> css) bv v = subst_branchlb  css z v " 
+proof(nominal_induct s  and cs and css rule: s_branch_s_branch_list.strong_induct)
+  case (AS_branch x1 x2 x3)
+  hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1"  using pure_fresh fresh_at_base flip_fresh_fresh  by metis
+  moreover have "((bv \<leftrightarrow> z) \<bullet> x2) = x2" using  fresh_at_base flip_fresh_fresh[of bv x2 z] AS_branch  by auto
+  ultimately show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using s_branch_s_branch_list.fresh(1) AS_branch by auto
+next
+  case (AS_cons x1 x2 )
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_branchlb.simps
+    using s_branch_s_branch_list.fresh(1) AS_cons by auto
+
+next
+  case (AS_val x)
+  then show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using flip_subst subst_b_v_def by simp
+next
+  case (AS_let x1 x2 x3)
+  moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
+  ultimately show ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst_subst subst_b_e_def s_branch_s_branch_list.fresh by force
+next
+  case (AS_let2 x1 x2 x3 x4)
+  moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
+  ultimately show ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst s_branch_s_branch_list.fresh(5) subst_b_\<tau>_def by auto
+next
+  case (AS_if x1 x2 x3) 
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_var x1 x2 x3 x4)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def subst_b_\<tau>_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
+next
+  case (AS_assign x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
+next
+  case (AS_match x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_while x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_seq x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
+next
+  case (AS_assert x1 x2)
+  thus ?case 
+    unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
+    using flip_subst subst_b_e_def subst_b_c_def s_branch_s_branch_list.fresh by auto
+qed(auto)
+
+instantiation s :: has_subst_b
+begin
+definition "subst_b = (\<lambda>s bv b. subst_sb s bv b)"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::s
+  show  "j \<sharp> subst_b t i x = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))" 
+    using fresh_subst_sb_if subst_b_s_def by metis
+
+  fix a::bv and tm::s and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm" using subst_b_s_def forget_subst_sb by metis
+
+  fix a::bv and tm::s
+  show "subst_b tm a (B_var a) = tm" using subst_b_s_def  subst_sb_id   by metis
+
+  fix p::perm and x1::bv and v::b and t1::s
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" using subst_b_s_def subst_sb_subst_branchb_subst_branchlb.eqvt by metis
+
+  fix  bv::bv and c::s and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    using subst_b_s_def flip_subst_s by metis
+
+  fix bv::bv and c::s and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    using flip_subst_subst_s subst_b_s_def by metis
+qed
+end
+
+section \<open>Function Type\<close>
+
+nominal_function subst_ft_b :: "fun_typ \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> fun_typ" where
+  "subst_ft_b ( AF_fun_typ z b c t (s::s)) x v = AF_fun_typ z (subst_bb b x v) (subst_cb c x v) t[x::=v]\<^sub>\<tau>\<^sub>b s[x::=v]\<^sub>s\<^sub>b"
+     apply(simp add: eqvt_def subst_ft_b_graph_aux_def )
+    apply(simp add:fun_typ.strong_exhaust,auto )
+  apply(rule_tac y=a and c="(a,b)" in fun_typ.strong_exhaust)
+  apply (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
+  done
+
+nominal_termination (eqvt) by lexicographic_order
+
+nominal_function subst_ftq_b :: "fun_typ_q \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> fun_typ_q" where
+  "atom bv \<sharp> (x,v) \<Longrightarrow>  subst_ftq_b (AF_fun_typ_some bv ft) x v = (AF_fun_typ_some bv (subst_ft_b ft x v))" 
+|  "subst_ftq_b (AF_fun_typ_none  ft) x v = (AF_fun_typ_none (subst_ft_b ft x v))" 
+       apply(simp add: eqvt_def subst_ftq_b_graph_aux_def )
+      apply(simp add:fun_typ_q.strong_exhaust,auto )
+  apply(rule_tac y=a and c="(aa,b)" in fun_typ_q.strong_exhaust)
+  by (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
+nominal_termination (eqvt) by lexicographic_order
+
+instantiation fun_typ :: has_subst_b
+begin
+definition "subst_b = subst_ft_b"
+
+text \<open>Note: Using just simp in the second apply unpacks and gives a single goal
+whereas auto gives 43 non-intuitive goals. These goals are easier to solve 
+and tedious, however they that it clear if a mistake is made in the definition of the function. 
+For example, I saw that one of the goals was 
+going through with metis and the next wasn't. 
+It turned out the definition of the function itself was wrong\<close>
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::fun_typ
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+    apply(nominal_induct t avoiding: i x rule:fun_typ.strong_induct)
+    apply(auto simp add: subst_b_fun_typ_def )       
+    by(metis fresh_subst_if subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def)+
+
+  fix a::bv and tm::fun_typ and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x  = tm"
+    apply (nominal_induct tm avoiding: a x rule: fun_typ.strong_induct)
+    apply(simp add: subst_b_fun_typ_def Abs1_eq_iff')
+    using subst_b_b_def  subst_b_fun_typ_def subst_b_\<tau>_def subst_b_c_def subst_b_s_def
+      forget_subst fresh_at_base list.set_cases neq_Nil_conv set_ConsD
+      subst_ft_b.simps  by metis
+
+  fix a::bv and tm::fun_typ
+  show "subst_b tm a (B_var a) = tm" 
+    apply (nominal_induct tm rule: fun_typ.strong_induct)
+    apply(simp add: subst_b_fun_typ_def Abs1_eq_iff',auto)
+    using subst_b_b_def  subst_b_fun_typ_def subst_b_\<tau>_def subst_b_c_def subst_b_s_def
+      forget_subst fresh_at_base list.set_cases neq_Nil_conv set_ConsD
+      subst_ft_b.simps 
+    by (metis has_subst_b_class.subst_id)+
+
+  fix p::perm and x1::bv and v::b and t1::fun_typ
+  show "p \<bullet> subst_b t1 x1 v = subst_b (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v) " 
+    apply (nominal_induct t1 avoiding: x1 v rule: fun_typ.strong_induct)
+    by(auto simp add: subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps)
+
+  fix  bv::bv and c::fun_typ and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (nominal_induct c avoiding: z bv rule: fun_typ.strong_induct)
+    by(auto simp add: subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps subst_b_b_def subst_b_c_def  subst_b_\<tau>_def  subst_b_s_def)
+
+  fix bv::bv and c::fun_typ and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    apply (nominal_induct c avoiding:  bv v z rule: fun_typ.strong_induct)
+    apply(auto simp add: subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps subst_b_b_def subst_b_c_def  subst_b_\<tau>_def  subst_b_s_def flip_subst_subst flip_subst)
+    using  subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps subst_b_b_def subst_b_c_def  subst_b_\<tau>_def  subst_b_s_def flip_subst_subst flip_subst 
+    using flip_subst_s(1) flip_subst_subst_s(1) by auto
+qed
+end
+
+instantiation fun_typ_q :: has_subst_b
+begin
+definition "subst_b = subst_ftq_b"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::fun_typ_q
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+    apply (nominal_induct t avoiding: i x j rule: fun_typ_q.strong_induct,auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps)
+    using  fresh_subst_if subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def apply metis+
+    done
+
+  fix a::bv and t::fun_typ_q and x::b
+  show "atom a \<sharp> t \<Longrightarrow> subst_b t a x  = t"
+    apply (nominal_induct t avoiding: a x  rule: fun_typ_q.strong_induct)
+     apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
+    using  forget_subst subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def eqvt by metis+
+
+  fix p::perm and x1::bv and v::b and t::fun_typ_q
+  show "p \<bullet> subst_b t x1 v = subst_b (p \<bullet> t) (p \<bullet> x1) (p \<bullet> v) " 
+    apply (nominal_induct t avoiding: x1 v  rule: fun_typ_q.strong_induct)
+    by(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
+
+  fix a::bv and tm::fun_typ_q
+  show "subst_b tm a (B_var a) = tm" 
+    apply (nominal_induct tm avoiding: a rule: fun_typ_q.strong_induct)
+     apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff')
+    using subst_id subst_b_b_def  subst_b_fun_typ_def subst_b_\<tau>_def subst_b_c_def subst_b_s_def
+      forget_subst fresh_at_base list.set_cases neq_Nil_conv set_ConsD
+      subst_ft_b.simps by metis+
+
+  fix  bv::bv and c::fun_typ_q and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+    apply (nominal_induct c avoiding: z bv  rule: fun_typ_q.strong_induct)
+     apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
+    using  forget_subst subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def eqvt by metis+
+
+  fix bv::bv and c::fun_typ_q and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+    apply (nominal_induct c avoiding: z v bv  rule: fun_typ_q.strong_induct)
+     apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
+    using  flip_subst flip_subst_subst forget_subst subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def eqvt by metis+
+
+qed
+end
+
+section \<open>Contexts\<close>
+
+subsection \<open>Immutable Variables\<close>
+nominal_function subst_gb :: "\<Gamma> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Gamma>" where
+  "subst_gb GNil _ _  = GNil"
+| "subst_gb ((y,b',c)#\<^sub>\<Gamma>\<Gamma>) bv b = ((y,b'[bv::=b]\<^sub>b\<^sub>b,c[bv::=b]\<^sub>c\<^sub>b)#\<^sub>\<Gamma> (subst_gb \<Gamma> bv b))"
+       apply (simp add: eqvt_def subst_gb_graph_aux_def )+
+     apply auto
+  apply (insert \<Gamma>.exhaust neq_GNil_conv, force)
+  done
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_gb_abbrev :: "\<Gamma> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Gamma>" ("_[_::=_]\<^sub>\<Gamma>\<^sub>b" [1000,50,50] 1000)
+  where 
+    "g[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<equiv> subst_gb g bv b'" 
+
+instantiation \<Gamma> :: has_subst_b
+begin
+definition "subst_b = subst_gb"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::\<Gamma>
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof(induct t rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using fresh_GNil  subst_gb.simps  fresh_def pure_fresh subst_b_\<Gamma>_def has_subst_b_class.fresh_subst_if fresh_GNil fresh_GCons by metis
+  next
+    case (GCons x' b' c' \<Gamma>')
+    have *: "atom i \<sharp> x' " using  fresh_at_base by simp
+
+    have "j \<sharp> subst_b ((x', b', c') #\<^sub>\<Gamma> \<Gamma>') i x = j \<sharp> ((x', b'[i::=x]\<^sub>b\<^sub>b, c'[i::=x]\<^sub>c\<^sub>b) #\<^sub>\<Gamma> (subst_b \<Gamma>' i x))" using subst_gb.simps  subst_b_\<Gamma>_def by auto
+    also have "... = (j \<sharp> ((x', b'[i::=x]\<^sub>b\<^sub>b, c'[i::=x]\<^sub>c\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))" using fresh_GCons by auto
+    also have "... = (((j  \<sharp> x') \<and> (j  \<sharp> b'[i::=x]\<^sub>b\<^sub>b) \<and> (j  \<sharp> c'[i::=x]\<^sub>c\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))"  by auto
+    also have "... = (((j  \<sharp> x') \<and> ((atom i \<sharp> b' \<and> j \<sharp> b' \<or> j \<sharp> x \<and> (j \<sharp> b' \<or> j = atom i))) \<and> 
+                                   ((atom i \<sharp> c' \<and> j \<sharp> c' \<or> j \<sharp> x \<and> (j \<sharp> c' \<or> j = atom i))) \<and> 
+                                   ((atom i \<sharp> \<Gamma>' \<and> j \<sharp> \<Gamma>' \<or> j \<sharp> x \<and> (j \<sharp> \<Gamma>' \<or> j = atom i)))))" 
+      using fresh_subst_if[of j b' i x] fresh_subst_if[of j c' i x] GCons subst_b_b_def  subst_b_c_def  by simp
+    also have "... = ((atom i \<sharp> (x', b', c') #\<^sub>\<Gamma> \<Gamma>' \<and> j \<sharp> (x', b', c') #\<^sub>\<Gamma> \<Gamma>') \<or> (j \<sharp> x \<and> (j \<sharp> (x', b', c') #\<^sub>\<Gamma> \<Gamma>' \<or> j = atom i)))" using * fresh_GCons fresh_prod3 by metis
+
+    finally show ?case  by auto
+  qed
+
+  fix a::bv and tm::\<Gamma> and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
+  proof (induct tm rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using  subst_gb.simps subst_b_\<Gamma>_def by auto
+  next
+    case (GCons x' b' c' \<Gamma>')
+    have *:"b'[a::=x]\<^sub>b\<^sub>b = b' \<and> c'[a::=x]\<^sub>c\<^sub>b = c'" using GCons fresh_GCons[of "atom a"] fresh_prod3[of "atom a"] has_subst_b_class.forget_subst  subst_b_b_def subst_b_c_def by metis
+    have "subst_b ((x', b', c') #\<^sub>\<Gamma> \<Gamma>') a x = ((x', b'[a::=x]\<^sub>b\<^sub>b, c'[a::=x]\<^sub>c\<^sub>b) #\<^sub>\<Gamma> (subst_b \<Gamma>' a x))" using  subst_b_\<Gamma>_def subst_gb.simps by auto
+    also have "... = ((x', b', c') #\<^sub>\<Gamma> \<Gamma>')" using * GCons  fresh_GCons[of "atom a"]  by auto 
+    finally show ?case using   has_subst_b_class.forget_subst fresh_GCons fresh_prod3 GCons subst_b_\<Gamma>_def has_subst_b_class.forget_subst[of a b' x] fresh_prod3[of "atom a"] by argo
+  qed
+
+  fix a::bv and tm::\<Gamma>
+  show "subst_b tm a (B_var a) = tm"
+  proof(induct tm rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using  subst_gb.simps subst_b_\<Gamma>_def by auto
+  next
+    case (GCons x' b' c' \<Gamma>')
+    then show ?case using    has_subst_b_class.subst_id  subst_b_\<Gamma>_def subst_b_b_def subst_b_c_def subst_gb.simps by metis
+  qed
+
+  fix p::perm and x1::bv and v::b and t1::\<Gamma>
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+  proof (induct tm rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using subst_b_\<Gamma>_def subst_gb.simps by simp
+  next
+    case (GCons x' b' c' \<Gamma>')
+    then show ?case using subst_b_\<Gamma>_def subst_gb.simps has_subst_b_class.eqvt by argo
+  qed
+
+  fix  bv::bv and c::\<Gamma> and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+  proof (induct c rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using subst_b_\<Gamma>_def subst_gb.simps by auto
+  next
+    case (GCons x b c \<Gamma>')   
+    have *:"(bv \<leftrightarrow> z) \<bullet> (x, b, c) = (x, (bv \<leftrightarrow> z) \<bullet> b, (bv \<leftrightarrow> z) \<bullet> c)" using flip_bv_x_cancel by auto
+    then show ?case 
+      unfolding subst_gb.simps subst_b_\<Gamma>_def permute_\<Gamma>.simps  * 
+      using GCons subst_b_\<Gamma>_def subst_gb.simps flip_subst subst_b_b_def subst_b_c_def fresh_GCons by auto
+  qed
+
+  fix bv::bv and c::\<Gamma> and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+  proof (induct c rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using subst_b_\<Gamma>_def subst_gb.simps by auto
+  next
+    case (GCons x b c \<Gamma>')   
+    have *:"(bv \<leftrightarrow> z) \<bullet> (x, b, c) = (x, (bv \<leftrightarrow> z) \<bullet> b, (bv \<leftrightarrow> z) \<bullet> c)" using flip_bv_x_cancel by auto
+    then show ?case 
+      unfolding subst_gb.simps subst_b_\<Gamma>_def permute_\<Gamma>.simps  * 
+      using GCons subst_b_\<Gamma>_def subst_gb.simps flip_subst subst_b_b_def subst_b_c_def fresh_GCons by auto
+  qed
+qed
+end
+
+lemma subst_b_base_for_lit:
+  "(base_for_lit l)[bv::=b]\<^sub>b\<^sub>b = base_for_lit l"
+  using base_for_lit.simps l.strong_exhaust 
+  by (metis subst_bb.simps(2) subst_bb.simps(3) subst_bb.simps(6) subst_bb.simps(7))
+
+lemma subst_b_lookup:
+  assumes "Some (b, c) = lookup \<Gamma> x"
+  shows " Some (b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) = lookup \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b x"
+  using assms by(induct \<Gamma> rule: \<Gamma>_induct, auto)
+
+lemma subst_g_b_x_fresh:
+  fixes x::x and b::b and \<Gamma>::\<Gamma> and bv::bv
+  assumes "atom x \<sharp> \<Gamma>"
+  shows  "atom x \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b"
+  using subst_b_fresh_x subst_b_\<Gamma>_def assms by metis
+
+subsection \<open>Mutable Variables\<close>
+
+nominal_function subst_db :: "\<Delta> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Delta>" where
+  "subst_db []\<^sub>\<Delta> _ _  = []\<^sub>\<Delta>"
+| "subst_db  ((u,t) #\<^sub>\<Delta> \<Delta>) bv b = ((u,t[bv::=b]\<^sub>\<tau>\<^sub>b) #\<^sub>\<Delta> (subst_db \<Delta> bv b))"
+       apply (simp add: eqvt_def subst_db_graph_aux_def,auto )
+  using list.exhaust delete_aux.elims
+  using neq_DNil_conv by fastforce
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_db_abbrev :: "\<Delta> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Delta>" ("_[_::=_]\<^sub>\<Delta>\<^sub>b" [1000,50,50] 1000)
+  where 
+    "\<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<equiv> subst_db \<Delta> bv b" 
+
+instantiation \<Delta> :: has_subst_b
+begin
+definition "subst_b = subst_db"
+
+instance proof
+  fix j::atom and i::bv and  x::b and t::\<Delta>
+  show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
+  proof(induct t rule: \<Delta>_induct)
+    case DNil
+    then show ?case using fresh_DNil  subst_db.simps  fresh_def pure_fresh subst_b_\<Delta>_def has_subst_b_class.fresh_subst_if fresh_DNil fresh_DCons by metis
+  next
+    case (DCons u t \<Gamma>')
+    have "j \<sharp> subst_b ((u, t) #\<^sub>\<Delta> \<Gamma>') i x = j \<sharp> ((u, t[i::=x]\<^sub>\<tau>\<^sub>b) #\<^sub>\<Delta> (subst_b \<Gamma>' i x))" using subst_db.simps  subst_b_\<Delta>_def by auto
+    also have "... = (j \<sharp> ((u, t[i::=x]\<^sub>\<tau>\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))" using fresh_DCons by auto
+    also have "... = (((j  \<sharp> u) \<and> (j  \<sharp> t[i::=x]\<^sub>\<tau>\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))"  by auto
+    also have "... =   ((j  \<sharp> u) \<and>  ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))) \<and> (atom i \<sharp> \<Gamma>' \<and> j \<sharp> \<Gamma>' \<or> j \<sharp> x \<and> (j \<sharp> \<Gamma>' \<or> j = atom i)))" 
+      using has_subst_b_class.fresh_subst_if[of j t i x] subst_b_\<tau>_def DCons  subst_b_\<Delta>_def by auto
+    also have "... = (atom i \<sharp> (u, t) #\<^sub>\<Delta> \<Gamma>' \<and> j \<sharp> (u, t) #\<^sub>\<Delta> \<Gamma>' \<or> j \<sharp> x \<and> (j \<sharp> (u, t) #\<^sub>\<Delta> \<Gamma>' \<or> j = atom i))" 
+      using DCons subst_db.simps(2)  has_subst_b_class.fresh_subst_if fresh_DCons subst_b_\<Delta>_def  pure_fresh fresh_at_base by auto
+    finally show ?case  by auto
+  qed
+
+  fix a::bv and tm::\<Delta> and x::b
+  show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
+  proof (induct tm rule: \<Delta>_induct)
+    case DNil
+    then show ?case using  subst_db.simps subst_b_\<Delta>_def by auto
+  next
+    case (DCons u t \<Gamma>')
+    have *:"t[a::=x]\<^sub>\<tau>\<^sub>b = t" using DCons fresh_DCons[of "atom a"] fresh_prod2[of "atom a"] has_subst_b_class.forget_subst  subst_b_\<tau>_def by metis
+    have "subst_b ((u,t) #\<^sub>\<Delta> \<Gamma>') a x = ((u,t[a::=x]\<^sub>\<tau>\<^sub>b) #\<^sub>\<Delta> (subst_b \<Gamma>' a x))" using  subst_b_\<Delta>_def subst_db.simps by auto
+    also have "... = ((u, t) #\<^sub>\<Delta> \<Gamma>')" using * DCons  fresh_DCons[of "atom a"]  by auto 
+    finally show ?case using   
+        has_subst_b_class.forget_subst fresh_DCons fresh_prod3 
+        DCons subst_b_\<Delta>_def has_subst_b_class.forget_subst[of a t x] fresh_prod3[of "atom a"] by argo
+  qed
+
+  fix a::bv and tm::\<Delta>
+  show "subst_b tm a (B_var a) = tm"
+  proof(induct tm rule: \<Delta>_induct)
+    case DNil
+    then show ?case using  subst_db.simps subst_b_\<Delta>_def by auto
+  next
+    case (DCons u t  \<Gamma>')
+    then show ?case using    has_subst_b_class.subst_id  subst_b_\<Delta>_def subst_b_\<tau>_def subst_db.simps by metis
+  qed
+
+  fix p::perm and x1::bv and v::b and t1::\<Delta>
+  show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+  proof (induct tm rule: \<Delta>_induct)
+    case DNil
+    then show ?case using subst_b_\<Delta>_def subst_db.simps by simp
+  next
+    case (DCons x' b' \<Gamma>')
+    then show ?case  by argo
+  qed
+
+  fix  bv::bv and c::\<Delta> and z::bv
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
+  proof (induct c rule: \<Delta>_induct)
+    case DNil
+    then show ?case using subst_b_\<Delta>_def subst_db.simps by auto
+  next
+    case (DCons u t')
+    then show ?case 
+      unfolding subst_db.simps subst_b_\<Delta>_def permute_\<Delta>.simps  
+      using DCons subst_b_\<Delta>_def subst_db.simps flip_subst subst_b_\<tau>_def flip_fresh_fresh fresh_at_base fresh_DCons flip_bv_u_cancel by simp
+  qed
+
+  fix bv::bv and c::\<Delta> and z::bv and v::b
+  show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
+  proof (induct c rule: \<Delta>_induct)
+    case DNil
+    then show ?case using subst_b_\<Delta>_def subst_db.simps by auto
+  next
+    case (DCons u t')
+    then show ?case 
+      unfolding subst_db.simps subst_b_\<Delta>_def permute_\<Delta>.simps  
+      using DCons subst_b_\<Delta>_def subst_db.simps flip_subst subst_b_\<tau>_def flip_fresh_fresh fresh_at_base fresh_DCons flip_bv_u_cancel by simp
+  qed
+qed
+end
+
+lemma subst_d_b_member:
+  assumes "(u, \<tau>) \<in> setD \<Delta>" 
+  shows  "(u, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) \<in> setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" 
+  using assms  by (induct \<Delta>,auto)
+
+lemmas ms_fresh_all = e.fresh s_branch_s_branch_list.fresh \<tau>.fresh c.fresh ce.fresh v.fresh l.fresh fresh_at_base opp.fresh pure_fresh ms_fresh
+
+lemmas fresh_intros[intro] = fresh_GNil x_not_in_b_set x_not_in_u_atoms x_fresh_b u_not_in_x_atoms bv_not_in_x_atoms u_not_in_b_atoms
+
+lemmas subst_b_simps = subst_tb.simps subst_cb.simps subst_ceb.simps subst_vb.simps subst_bb.simps  subst_eb.simps subst_branchb.simps subst_sb.simps
+
+lemma subst_d_b_x_fresh:
+  fixes x::x and b::b and \<Delta>::\<Delta> and bv::bv
+  assumes "atom x \<sharp> \<Delta>"
+  shows  "atom x \<sharp> \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b"
+  using subst_b_fresh_x subst_b_\<Delta>_def assms by metis
+
+lemma subst_b_fresh_x:
+  fixes  x::x
+  shows "atom x \<sharp> v \<Longrightarrow> atom x \<sharp> v[bv::=b']\<^sub>v\<^sub>b" and
+    "atom x \<sharp> ce \<Longrightarrow> atom x \<sharp> ce[bv::=b']\<^sub>c\<^sub>e\<^sub>b" and
+    "atom x \<sharp> e \<Longrightarrow> atom x \<sharp> e[bv::=b']\<^sub>e\<^sub>b" and
+    "atom x \<sharp> c \<Longrightarrow> atom x \<sharp> c[bv::=b']\<^sub>c\<^sub>b" and
+    "atom x \<sharp> t \<Longrightarrow> atom x \<sharp> t[bv::=b']\<^sub>\<tau>\<^sub>b" and
+    "atom x \<sharp> d \<Longrightarrow> atom x \<sharp> d[bv::=b']\<^sub>\<Delta>\<^sub>b" and
+    "atom x \<sharp> g \<Longrightarrow> atom x \<sharp> g[bv::=b']\<^sub>\<Gamma>\<^sub>b" and
+    "atom x \<sharp> s \<Longrightarrow> atom x \<sharp> s[bv::=b']\<^sub>s\<^sub>b"
+  using fresh_subst_if x_fresh_b subst_b_v_def subst_b_ce_def subst_b_e_def subst_b_c_def subst_b_\<tau>_def subst_b_s_def subst_g_b_x_fresh subst_d_b_x_fresh 
+  by metis+
+
+lemma subst_b_fresh_u_cls:
+  fixes tm::"'a::has_subst_b" and x::u
+  shows "atom x \<sharp> tm = atom x \<sharp> tm[bv::=b']\<^sub>b"
+  using fresh_subst_if[of "atom x" tm bv b'] using u_fresh_b by auto
+
+lemma subst_g_b_u_fresh:
+  fixes x::u and b::b and \<Gamma>::\<Gamma> and bv::bv
+  assumes "atom x \<sharp> \<Gamma>"
+  shows  "atom x \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b"
+  using subst_b_fresh_u_cls subst_b_\<Gamma>_def assms by metis
+
+lemma subst_d_b_u_fresh:
+  fixes x::u and b::b and \<Gamma>::\<Delta> and bv::bv
+  assumes "atom x \<sharp> \<Gamma>"
+  shows  "atom x \<sharp> \<Gamma>[bv::=b]\<^sub>\<Delta>\<^sub>b"
+  using subst_b_fresh_u_cls subst_b_\<Delta>_def assms by metis
+
+lemma subst_b_fresh_u:
+  fixes  x::u
+  shows "atom x \<sharp> v \<Longrightarrow> atom x \<sharp> v[bv::=b']\<^sub>v\<^sub>b" and
+    "atom x \<sharp> ce \<Longrightarrow> atom x \<sharp> ce[bv::=b']\<^sub>c\<^sub>e\<^sub>b" and
+    "atom x \<sharp> e \<Longrightarrow> atom x \<sharp> e[bv::=b']\<^sub>e\<^sub>b" and
+    "atom x \<sharp> c \<Longrightarrow> atom x \<sharp> c[bv::=b']\<^sub>c\<^sub>b" and
+    "atom x \<sharp> t \<Longrightarrow> atom x \<sharp> t[bv::=b']\<^sub>\<tau>\<^sub>b" and
+    "atom x \<sharp> d \<Longrightarrow> atom x \<sharp> d[bv::=b']\<^sub>\<Delta>\<^sub>b" and
+    "atom x \<sharp> g \<Longrightarrow> atom x \<sharp> g[bv::=b']\<^sub>\<Gamma>\<^sub>b" and
+    "atom x \<sharp> s \<Longrightarrow> atom x \<sharp> s[bv::=b']\<^sub>s\<^sub>b"
+  using fresh_subst_if u_fresh_b subst_b_v_def subst_b_ce_def subst_b_e_def subst_b_c_def subst_b_\<tau>_def subst_b_s_def subst_g_b_u_fresh subst_d_b_u_fresh 
+  by metis+
+
+lemma subst_db_u_fresh:
+  fixes u::u and b::b and D::\<Delta>
+  assumes "atom u \<sharp> D"
+  shows  "atom u \<sharp> D[bv::=b]\<^sub>\<Delta>\<^sub>b"
+  using assms proof(induct D rule: \<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u' t' D')
+  then show ?case using subst_db.simps fresh_def fresh_DCons fresh_subst_if subst_b_\<tau>_def 
+    by (metis fresh_Pair u_not_in_b_atoms)
+qed
+
+lemma flip_bt_subst4:
+  fixes t::\<tau> and bv::bv 
+  assumes "atom bv \<sharp> t" 
+  shows "t[bv'::=b]\<^sub>\<tau>\<^sub>b = ((bv' \<leftrightarrow> bv) \<bullet> t)[bv::=b]\<^sub>\<tau>\<^sub>b" 
+  using flip_subst_subst[OF assms,of bv' b] 
+  by (simp add: flip_commute subst_b_\<tau>_def)
+
+lemma subst_bt_flip_sym:
+  fixes t1::\<tau> and t2::\<tau>
+  assumes "atom bv \<sharp> b" and "atom bv \<sharp> (bv1, bv2, t1, t2)" and "(bv1 \<leftrightarrow> bv) \<bullet> t1 = (bv2 \<leftrightarrow> bv) \<bullet> t2"
+  shows " t1[bv1::=b]\<^sub>\<tau>\<^sub>b = t2[bv2::=b]\<^sub>\<tau>\<^sub>b"
+  using assms  flip_bt_subst4[of bv t1 bv1 b ]   flip_bt_subst4 fresh_prod4 fresh_Pair by metis
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/BTVSubstTypingL.thy b/thys/MiniSail/BTVSubstTypingL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/BTVSubstTypingL.thy
@@ -0,0 +1,635 @@
+(*<*)
+theory BTVSubstTypingL
+  imports  "HOL-Eisbach.Eisbach_Tools" ContextSubtypingL SubstMethods
+begin
+  (*>*)
+
+chapter \<open>Basic Type Variable Substitution Lemmas\<close>
+text \<open>Lemmas that show that types are preserved, in some way, 
+under basic type variable substitution\<close>
+
+lemma subst_vv_subst_bb_commute:
+  fixes bv::bv and b::b and x::x and v::v
+  assumes "atom bv \<sharp> v"
+  shows "(v'[x::=v]\<^sub>v\<^sub>v)[bv::=b]\<^sub>v\<^sub>b = (v'[bv::=b]\<^sub>v\<^sub>b)[x::=v]\<^sub>v\<^sub>v" 
+  using assms proof(nominal_induct v'  rule: v.strong_induct)
+  case (V_lit x)
+  then show ?case using subst_vb.simps subst_vv.simps by simp
+next
+  case (V_var y)
+  hence "v[bv::=b]\<^sub>v\<^sub>b=v" using forget_subst subst_b_v_def by metis
+  then show ?case unfolding subst_vb.simps(2) subst_vv.simps(2) using V_var by auto
+next
+  case (V_pair x1a x2a)
+  then show ?case using subst_vb.simps subst_vv.simps by simp
+next
+  case (V_cons x1a x2a x3)
+  then show ?case using subst_vb.simps subst_vv.simps by simp
+next
+  case (V_consp x1a x2a x3 x4)
+  then show ?case using subst_vb.simps subst_vv.simps by simp
+qed
+
+lemma subst_cev_subst_bb_commute:
+  fixes bv::bv and b::b and x::x and v::v
+  assumes "atom bv \<sharp> v"
+  shows "(ce[x::=v]\<^sub>v)[bv::=b]\<^sub>c\<^sub>e\<^sub>b = (ce[bv::=b]\<^sub>c\<^sub>e\<^sub>b)[x::=v]\<^sub>v" 
+  using assms apply (nominal_induct ce  rule: ce.strong_induct, (simp add: subst_vv_subst_bb_commute subst_ceb.simps subst_cv.simps))
+  using assms subst_vv_subst_bb_commute subst_ceb.simps subst_cv.simps 
+  by (simp add: subst_v_ce_def)+
+
+lemma subst_cv_subst_bb_commute:
+  fixes bv::bv and b::b and x::x and v::v
+  assumes "atom bv \<sharp> v"
+  shows "c[x::=v]\<^sub>c\<^sub>v[bv::=b]\<^sub>c\<^sub>b = (c[bv::=b]\<^sub>c\<^sub>b)[x::=v]\<^sub>c\<^sub>v" 
+  using assms apply (nominal_induct c  rule: c.strong_induct )
+  using assms subst_vv_subst_bb_commute subst_ceb.simps subst_cv.simps 
+    subst_v_c_def subst_b_c_def   apply auto
+  using subst_cev_subst_bb_commute subst_v_ce_def by auto+
+
+lemma subst_b_c_of:
+  "(c_of \<tau> z)[bv::=b]\<^sub>c\<^sub>b =  c_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) z"
+proof(nominal_induct \<tau> avoiding: z rule:\<tau>.strong_induct)
+  case (T_refined_type z' b' c')
+  moreover have "atom bv \<sharp> [ z ]\<^sup>v " using fresh_at_base v.fresh by auto
+  ultimately show ?case using subst_cv_subst_bb_commute[of bv "V_var z" c' z' b]  c_of.simps subst_tb.simps by metis
+qed
+
+lemma subst_b_b_of:
+  "(b_of \<tau>)[bv::=b]\<^sub>b\<^sub>b =  b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)"
+  by(nominal_induct \<tau> rule:\<tau>.strong_induct, simp add: b_of.simps subst_tb.simps )
+
+lemma subst_b_if:
+  "\<lbrace> z : b_of \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b  | CE_val (v[bv::=b]\<^sub>v\<^sub>b)  ==  CE_val (V_lit ll)   IMP  c_of \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b z  \<rbrace> = \<lbrace> z : b_of \<tau> | CE_val (v)  ==  CE_val (V_lit ll)   IMP  c_of \<tau> z  \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b "
+  unfolding subst_tb.simps subst_cb.simps subst_ceb.simps subst_vb.simps using subst_b_b_of   subst_b_c_of by auto
+
+lemma subst_b_top_eq:
+  "\<lbrace> z : B_unit  | TRUE \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b = \<lbrace> z : B_unit  | TRUE \<rbrace>" and "\<lbrace> z : B_bool  | TRUE \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b = \<lbrace> z : B_bool  | TRUE \<rbrace>"  and "\<lbrace> z : B_id tid | TRUE \<rbrace> = \<lbrace> z : B_id tid | TRUE \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b"
+  unfolding  subst_tb.simps subst_bb.simps subst_cb.simps by auto
+
+lemmas subst_b_eq = subst_b_c_of subst_b_b_of subst_b_if subst_b_top_eq
+
+lemma subst_cx_subst_bb_commute[simp]:
+  fixes bv::bv and b::b and x::x and v'::c
+  shows "(v'[x::=V_var y]\<^sub>c\<^sub>v)[bv::=b]\<^sub>c\<^sub>b = (v'[bv::=b]\<^sub>c\<^sub>b)[x::=V_var y]\<^sub>c\<^sub>v" 
+  using subst_cv_subst_bb_commute fresh_at_base  v.fresh by auto
+
+lemma subst_b_infer_b:
+  fixes l::l and b::b
+  assumes " \<turnstile> l \<Rightarrow> \<tau>" and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b" and "B = {|bv|}"
+  shows  "\<turnstile> l \<Rightarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" 
+  using assms infer_l_form3 infer_l_form4 wf_b_subst infer_l_wf subst_tb.simps base_for_lit.simps subst_tb.simps
+    subst_b_base_for_lit subst_cb.simps(6) subst_ceb.simps(1) subst_vb.simps(1) subst_vb.simps(2) type_l_eq
+  by metis
+
+lemma subst_b_subtype:
+  fixes s::s and b'::b
+  assumes  "\<Theta> ; {|bv|} ; \<Gamma>  \<turnstile> \<tau>1 \<lesssim> \<tau>2" and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b'"  and "B = {|bv|}" 
+  shows "\<Theta> ; {||} ; \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<turnstile> \<tau>1[bv::=b']\<^sub>\<tau>\<^sub>b \<lesssim> \<tau>2[bv::=b']\<^sub>\<tau>\<^sub>b"
+  using assms proof(nominal_induct "{|bv|}"  \<Gamma> \<tau>1 \<tau>2 rule:subtype.strong_induct)
+  case (subtype_baseI x \<Theta> \<Gamma> z c z' c' b)
+
+  hence **: "\<Theta> ; {|bv|} ; (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'[z'::=V_var x]\<^sub>c\<^sub>v " using validI subst_defs by metis
+
+  have "\<Theta> ; {||} ; \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<turnstile> \<lbrace> z : b[bv::=b']\<^sub>b\<^sub>b | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>  \<lesssim> \<lbrace> z' : b[bv::=b']\<^sub>b\<^sub>b | c'[bv::=b']\<^sub>c\<^sub>b \<rbrace>" proof(rule Typing.subtype_baseI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace> " 
+      using subtype_baseI assms wf_b_subst(4) subst_tb.simps subst_defs  by metis
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z' : b[bv::=b']\<^sub>b\<^sub>b  | c'[bv::=b']\<^sub>c\<^sub>b \<rbrace> " 
+      using subtype_baseI assms wf_b_subst(4) subst_tb.simps by metis
+    show "atom x \<sharp>(\<Theta>, {||}::bv fset, \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b,  z , c[bv::=b']\<^sub>c\<^sub>b ,  z'  , c'[bv::=b']\<^sub>c\<^sub>b )" 
+      apply(unfold fresh_prodN,auto simp add: * fresh_prodN fresh_empty_fset) 
+      using subst_b_fresh_x * fresh_prodN  \<open>atom x \<sharp> c\<close> \<open>atom x \<sharp> c'\<close> subst_defs subtype_baseI by metis+
+    have "\<Theta> ; {||} ; (x, b[bv::=b']\<^sub>b\<^sub>b, c[z::=V_var x]\<^sub>v[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<Turnstile> c'[z'::=V_var x]\<^sub>v[bv::=b']\<^sub>c\<^sub>b" 
+      using ** subst_b_valid subst_gb.simps assms  subtype_baseI  by metis
+    thus "\<Theta> ; {||} ; (x, b[bv::=b']\<^sub>b\<^sub>b, (c[bv::=b']\<^sub>c\<^sub>b)[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<Turnstile> (c'[bv::=b']\<^sub>c\<^sub>b)[z'::=V_var x]\<^sub>v" 
+      using subst_defs subst_cv_subst_bb_commute  by (metis subst_cx_subst_bb_commute)
+  qed
+  thus ?case using subtype_baseI subst_tb.simps subst_defs by metis
+qed
+
+lemma b_of_subst_bv:
+  "(b_of \<tau>)[x::=v]\<^sub>b\<^sub>b = b_of (\<tau>[x::=v]\<^sub>\<tau>\<^sub>b)"
+proof -
+  obtain z b c where *:"\<tau> = \<lbrace> z : b | c \<rbrace> \<and> atom z \<sharp> (x,v)" using obtain_fresh_z by metis
+  thus ?thesis  using subst_tv.simps * by auto 
+qed
+
+lemma subst_b_infer_v:
+  fixes v::v and b::b
+  assumes "\<Theta> ; B ; G \<turnstile> v \<Rightarrow> \<tau>" and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b" and "B = {|bv|}"
+  shows  "\<Theta> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" 
+  using assms proof(nominal_induct avoiding: b bv rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> \<Gamma> b' c x z)
+  show ?case unfolding  subst_b_simps proof
+    show "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b " using infer_v_varI wf_b_subst by metis
+    show "Some (b'[bv::=b]\<^sub>b\<^sub>b, c[bv::=b]\<^sub>c\<^sub>b) = lookup \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b x" using subst_b_lookup infer_v_varI by metis
+    show "atom z \<sharp> x" using infer_v_varI by auto
+    show "atom z \<sharp>  (\<Theta>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b) " by(fresh_mth add: infer_v_varI subst_b_fresh_x subst_b_\<Gamma>_def fresh_prodN fresh_empty_fset )
+  qed
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l \<tau>)
+  then show ?case using Typing.infer_v_litI subst_b_infer_b 
+    using wf_b_subst1(3) by auto
+next
+  case (infer_v_pairI z v1 v2 \<Theta> \<B> \<Gamma> t1 t2)
+  show ?case unfolding   subst_b_simps b_of_subst_bv proof
+    show "atom z \<sharp> (v1[bv::=b]\<^sub>v\<^sub>b, v2[bv::=b]\<^sub>v\<^sub>b)" by(fresh_mth add: infer_v_pairI subst_b_fresh_x)
+    show "atom z \<sharp> (\<Theta>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b)" by(fresh_mth add: infer_v_pairI subst_b_fresh_x subst_b_\<Gamma>_def fresh_empty_fset)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v1[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> t1[bv::=b]\<^sub>\<tau>\<^sub>b" using infer_v_pairI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> t2[bv::=b]\<^sub>\<tau>\<^sub>b" using infer_v_pairI by auto
+  qed
+next
+  case (infer_v_consI s dclist \<Theta> dc tc \<B> \<Gamma> v tv z)
+  show ?case unfolding   subst_b_simps b_of_subst_bv proof
+    show "AF_typedef s dclist \<in> set \<Theta>" using infer_v_consI by auto
+    show "(dc, tc) \<in> set dclist"  using infer_v_consI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> tv[bv::=b]\<^sub>\<tau>\<^sub>b" using infer_v_consI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> tv[bv::=b]\<^sub>\<tau>\<^sub>b \<lesssim> tc" proof -
+      have "atom bv \<sharp> tc" using wfTh_lookup_supp_empty fresh_def infer_v_consI infer_v_wf by fast
+      moreover have  "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> tv[bv::=b]\<^sub>\<tau>\<^sub>b \<lesssim> tc[bv::=b]\<^sub>\<tau>\<^sub>b"  
+        using subst_b_subtype infer_v_consI by simp     
+      ultimately show  ?thesis using forget_subst subst_b_\<tau>_def by metis
+    qed
+    show "atom z \<sharp> v[bv::=b]\<^sub>v\<^sub>b"  using infer_v_consI using  subst_b_fresh_x subst_b_v_def by metis
+    show "atom z \<sharp> (\<Theta>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b)"  by(fresh_mth add: infer_v_consI subst_b_fresh_x subst_b_\<Gamma>_def fresh_empty_fset)
+  qed
+next
+  case (infer_v_conspI s bv2 dclist2 \<Theta> dc tc \<B> \<Gamma> v tv ba z)
+
+  have "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> V_consp s dc (ba[bv::=b]\<^sub>b\<^sub>b) (v[bv::=b]\<^sub>v\<^sub>b) \<Rightarrow> \<lbrace> z : B_app s (ba[bv::=b]\<^sub>b\<^sub>b)  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc (ba[bv::=b]\<^sub>b\<^sub>b) (v[bv::=b]\<^sub>v\<^sub>b) ]\<^sup>c\<^sup>e  \<rbrace>"
+  proof(rule Typing.infer_v_conspI)
+    show "AF_typedef_poly s bv2 dclist2 \<in> set \<Theta>" using infer_v_conspI by auto
+    show "(dc, tc) \<in> set dclist2"  using infer_v_conspI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> tv[bv::=b]\<^sub>\<tau>\<^sub>b" 
+      using infer_v_conspI subst_tb.simps by metis
+
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> tv[bv::=b]\<^sub>\<tau>\<^sub>b \<lesssim> tc[bv2::=ba[bv::=b]\<^sub>b\<^sub>b]\<^sub>\<tau>\<^sub>b" proof -
+      have "supp tc \<subseteq> { atom bv2 }" using infer_v_conspI wfTh_poly_lookup_supp wfX_wfY by metis
+      moreover have "bv2 \<noteq> bv"  using \<open>atom bv2 \<sharp> \<B>\<close> \<open>\<B> = {|bv|} \<close> fresh_at_base fresh_def 
+        using fresh_finsert by fastforce
+      ultimately have "atom bv \<sharp> tc" unfolding fresh_def by auto
+      hence "tc[bv2::=ba[bv::=b]\<^sub>b\<^sub>b]\<^sub>\<tau>\<^sub>b = tc[bv2::=ba]\<^sub>\<tau>\<^sub>b[bv::=b]\<^sub>\<tau>\<^sub>b" 
+        using subst_tb_commute by metis
+      moreover  have "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> tv[bv::=b]\<^sub>\<tau>\<^sub>b \<lesssim> tc[bv2::=ba]\<^sub>\<tau>\<^sub>b[bv::=b]\<^sub>\<tau>\<^sub>b" 
+        using infer_v_conspI(7) subst_b_subtype infer_v_conspI by metis
+      ultimately show ?thesis by auto
+    qed    
+    show "atom z \<sharp> (\<Theta>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b, ba[bv::=b]\<^sub>b\<^sub>b)" 
+      apply(unfold fresh_prodN, intro conjI, auto simp add: infer_v_conspI fresh_empty_fset)
+      using \<open>atom z \<sharp> \<Gamma>\<close>  fresh_subst_if   subst_b_\<Gamma>_def x_fresh_b  apply metis
+      using \<open>atom z \<sharp> v\<close>  fresh_subst_if   subst_b_v_def x_fresh_b  by metis
+    show "atom bv2 \<sharp> (\<Theta>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b, ba[bv::=b]\<^sub>b\<^sub>b)" 
+      apply(unfold fresh_prodN, intro conjI, auto simp add: infer_v_conspI fresh_empty_fset)
+      using \<open>atom bv2 \<sharp> b\<close>  \<open>atom bv2 \<sharp> \<Gamma>\<close> fresh_subst_if   subst_b_\<Gamma>_def apply metis
+      using \<open>atom bv2 \<sharp> b\<close>  \<open>atom bv2 \<sharp> v\<close> fresh_subst_if   subst_b_v_def apply metis
+      using \<open>atom bv2 \<sharp> b\<close>  \<open>atom bv2 \<sharp> ba\<close> fresh_subst_if   subst_b_b_def by metis
+    show "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f ba[bv::=b]\<^sub>b\<^sub>b " 
+      using infer_v_conspI  wf_b_subst by metis
+  qed
+  thus ?case using subst_vb.simps subst_tb.simps subst_bb.simps by simp
+
+qed
+
+lemma subst_b_check_v:
+  fixes v::v and b::b
+  assumes "\<Theta> ; B ; G \<turnstile> v \<Leftarrow> \<tau>" and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b" and "B = {|bv|}"
+  shows  "\<Theta> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" 
+proof -
+  obtain \<tau>' where "\<Theta> ; B ; G \<turnstile> v \<Rightarrow> \<tau>' \<and>  \<Theta> ; B ; G  \<turnstile> \<tau>' \<lesssim> \<tau>" using check_v_elims[OF assms(1)] by metis
+  thus ?thesis using subst_b_subtype subst_b_infer_v assms 
+    by (metis (no_types)  check_v_subtypeI subst_b_infer_v subst_b_subtype)
+qed
+
+lemma subst_vv_subst_vb_switch:
+  shows  "(v'[bv::=b']\<^sub>v\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>v\<^sub>v = v'[x::=v]\<^sub>v\<^sub>v[bv::=b']\<^sub>v\<^sub>b"
+proof(nominal_induct v' rule:v.strong_induct)
+  case (V_lit x)
+  then show ?case using subst_vv.simps subst_vb.simps by auto
+next
+  case (V_var x)
+  then show ?case using subst_vv.simps subst_vb.simps by auto
+next
+  case (V_pair x1a x2a)
+  then show ?case using subst_vv.simps subst_vb.simps v.fresh by auto
+next
+  case (V_cons x1a x2a x3)
+  then show ?case using subst_vv.simps subst_vb.simps v.fresh by auto
+next
+  case (V_consp x1a x2a x3 x4)
+  then show ?case using subst_vv.simps subst_vb.simps v.fresh pure_fresh 
+    by (metis forget_subst subst_b_b_def)
+qed
+
+lemma subst_cev_subst_vb_switch:
+  shows  "(ce[bv::=b']\<^sub>c\<^sub>e\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>c\<^sub>e\<^sub>v = (ce[x::=v]\<^sub>c\<^sub>e\<^sub>v)[bv::=b']\<^sub>c\<^sub>e\<^sub>b"
+  by(nominal_induct ce rule:ce.strong_induct, auto simp add: subst_vv_subst_vb_switch ce.fresh)
+
+lemma subst_cv_subst_vb_switch:
+  shows  "(c[bv::=b']\<^sub>c\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>c\<^sub>v = c[x::=v]\<^sub>c\<^sub>v[bv::=b']\<^sub>c\<^sub>b"
+  by(nominal_induct c rule:c.strong_induct, auto simp add: subst_cev_subst_vb_switch c.fresh)
+
+lemma subst_tv_subst_vb_switch:
+  shows  "(\<tau>[bv::=b']\<^sub>\<tau>\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>\<tau>\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v[bv::=b']\<^sub>\<tau>\<^sub>b"
+proof(nominal_induct \<tau> avoiding: x v rule:\<tau>.strong_induct)
+  case (T_refined_type z b c )
+  hence ceq: "(c[bv::=b']\<^sub>c\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>c\<^sub>v = c[x::=v]\<^sub>c\<^sub>v[bv::=b']\<^sub>c\<^sub>b" using subst_cv_subst_vb_switch by auto
+
+  moreover have "atom z \<sharp> v[bv::=b']\<^sub>v\<^sub>b" using x_fresh_b fresh_subst_if subst_b_v_def T_refined_type by metis
+
+  hence "\<lbrace> z : b  | c \<rbrace>[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b[bv::=b']\<^sub>b\<^sub>b  | (c[bv::=b']\<^sub>c\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>c\<^sub>v \<rbrace>"
+    using subst_tv.simps subst_tb.simps T_refined_type fresh_Pair by metis
+
+  moreover have "\<lbrace> z : b[bv::=b']\<^sub>b\<^sub>b  | (c[bv::=b']\<^sub>c\<^sub>b)[x::=v[bv::=b']\<^sub>v\<^sub>b]\<^sub>c\<^sub>v \<rbrace>  =  \<lbrace> z : b  | c[x::=v]\<^sub>c\<^sub>v \<rbrace>[bv::=b']\<^sub>\<tau>\<^sub>b"
+    using subst_tv.simps subst_tb.simps ceq \<tau>.fresh forget_subst[of "bv" b b'] subst_b_b_def T_refined_type by metis
+
+  ultimately show ?case using subst_tv.simps subst_tb.simps ceq T_refined_type by auto
+qed
+
+lemma subst_tb_triple:
+  assumes "atom bv \<sharp> \<tau>'" 
+  shows  "\<tau>'[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>\<tau>\<^sub>b[x'::=v'[bv::=b]\<^sub>v\<^sub>b]\<^sub>\<tau>\<^sub>v = \<tau>'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v']\<^sub>\<tau>\<^sub>v[bv::=b]\<^sub>\<tau>\<^sub>b"  
+proof -
+  have "\<tau>'[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>\<tau>\<^sub>b[x'::=v'[bv::=b]\<^sub>v\<^sub>b]\<^sub>\<tau>\<^sub>v = \<tau>'[bv'::=b']\<^sub>\<tau>\<^sub>b[bv::=b]\<^sub>\<tau>\<^sub>b [x'::=v'[bv::=b]\<^sub>v\<^sub>b]\<^sub>\<tau>\<^sub>v"
+    using subst_tb_commute \<open>atom bv \<sharp> \<tau>'\<close> by auto
+  also have "... = \<tau>'[bv'::=b']\<^sub>\<tau>\<^sub>b [x'::=v']\<^sub>\<tau>\<^sub>v[bv::=b]\<^sub>\<tau>\<^sub>b" 
+    using subst_tv_subst_vb_switch by auto
+  finally show ?thesis using fresh_subst_if forget_subst by auto
+qed
+
+lemma subst_b_infer_e:
+  fixes s::s and b::b
+  assumes "\<Theta> ; \<Phi> ; B ; G; D \<turnstile> e \<Rightarrow> \<tau>" and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b"  and "B = {|bv|}" 
+  shows  "\<Theta> ; \<Phi> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b; D[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile> (e[bv::=b]\<^sub>e\<^sub>b) \<Rightarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" 
+  using assms proof(nominal_induct avoiding: b rule: infer_e.strong_induct)
+  case (infer_e_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v \<tau>)
+  thus ?case using  subst_eb.simps infer_e.intros wf_b_subst subst_db.simps wf_b_subst infer_v_wf subst_b_infer_v 
+    by (metis forget_subst ms_fresh_all(1) wfV_b_fresh)
+next
+  case (infer_e_plusI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+
+  show ?case unfolding subst_b_simps subst_eb.simps proof(rule Typing.infer_e_plusI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wf_b_subst(10) subst_db.simps infer_e_plusI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_plusI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v1[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z1 : B_int  | c1[bv::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_b_infer_v  infer_e_plusI subst_b_simps by force
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z2 : B_int  | c2[bv::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_b_infer_v  infer_e_plusI subst_b_simps by force
+    show "atom z3 \<sharp> AE_op Plus (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)" using  subst_b_simps infer_e_plusI subst_b_fresh_x subst_b_e_def by metis
+    show "atom z3 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_plusI by auto
+  qed
+next
+  case (infer_e_leqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_leqI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  " using wf_b_subst(10) subst_db.simps infer_e_leqI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_leqI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v1[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z1 : B_int  | c1[bv::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_b_infer_v  infer_e_leqI subst_b_simps by force
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z2 : B_int  | c2[bv::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_b_infer_v  infer_e_leqI subst_b_simps by force
+    show "atom z3 \<sharp> AE_op LEq (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)" using  subst_b_simps infer_e_leqI subst_b_fresh_x subst_b_e_def by metis
+    show "atom z3 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_leqI by auto
+  qed
+next
+  case (infer_e_eqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 bb c1 v2 z2 c2 z3)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_eqI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  " using wf_b_subst(10) subst_db.simps infer_e_eqI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_eqI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v1[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z1 : bb[bv::=b]\<^sub>b\<^sub>b  | c1[bv::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_b_infer_v  infer_e_eqI subst_b_simps by force
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z2 : bb[bv::=b]\<^sub>b\<^sub>b  | c2[bv::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_b_infer_v  infer_e_eqI subst_b_simps by force
+    show "atom z3 \<sharp> AE_op Eq (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)" using  subst_b_simps infer_e_eqI subst_b_fresh_x subst_b_e_def by metis
+    show "atom z3 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_eqI by auto
+    show "bb[bv::=b]\<^sub>b\<^sub>b  \<in> {B_bool, B_int, B_unit}" using infer_e_eqI by auto
+  qed
+next
+  case (infer_e_appI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b' c \<tau>' s' v \<tau>)
+  show ?case proof(subst subst_eb.simps, rule Typing.infer_e_appI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b"  using wf_b_subst(10) subst_db.simps infer_e_appI wfX_wfY by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_appI by auto
+    show "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b' c \<tau>' s'))) = lookup_fun \<Phi> f" using infer_e_appI by auto
+        (*show  "\<Theta> ; {||} ; (x, b', c) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>'" using infer_e_appI sory*)
+    have "atom bv \<sharp> b'"  using \<open>\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> infer_e_appI wfPhi_f_supp  fresh_def[of "atom bv" b'] by simp
+    hence "b' = b'[bv::=b]\<^sub>b\<^sub>b" using subst_b_simps 
+      using has_subst_b_class.forget_subst subst_b_b_def by force
+    moreover have  ceq:"c = c[bv::=b]\<^sub>c\<^sub>b" using subst_b_simps proof -
+      have "supp c \<subseteq> {atom x}" using infer_e_appI wfPhi_f_simple_supp_c[OF  _  \<open>\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>]  by simp
+      hence "atom bv \<sharp> c" using
+          fresh_def[of "atom bv" c] 
+        using fresh_def fresh_finsert insert_absorb 
+          insert_subset ms_fresh_all supp_at_base x_not_in_b_set fresh_prodN by metis
+      thus ?thesis 
+        using forget_subst subst_b_c_def  fresh_def[of "atom bv" c] by metis    
+    qed 
+    show   "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> x : b'  | c \<rbrace>"  
+      using subst_b_check_v subst_tb.simps subst_vb.simps infer_e_appI 
+    proof -
+      have "\<Theta> ; {|bv|} ; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> x : b' | c \<rbrace>"
+        by (metis \<open>\<B> = {|bv|}\<close> \<open>\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> x : b' | c \<rbrace>\<close>) (* 0.0 ms *)
+      then show ?thesis 
+        by (metis (no_types) \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b\<close> \<open>b' = b'[bv::=b]\<^sub>b\<^sub>b\<close> subst_b_check_v subst_tb.simps ceq) 
+    qed
+    show "atom x \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)"
+      apply (fresh_mth add:  fresh_prodN subst_g_b_x_fresh infer_e_appI )
+      using subst_b_fresh_x infer_e_appI apply metis+
+      done            
+    have "supp \<tau>' \<subseteq> { atom x }" using wfPhi_f_simple_supp_t  infer_e_appI by auto
+    hence "atom bv \<sharp> \<tau>'" using fresh_def fresh_at_base by force
+    then  show  "\<tau>'[x::=v[bv::=b]\<^sub>v\<^sub>b]\<^sub>v = \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b" using infer_e_appI 
+        forget_subst subst_b_\<tau>_def subst_tv_subst_vb_switch subst_defs by metis
+  qed
+next
+  case (infer_e_appPI \<Theta>' \<B> \<Gamma>' \<Delta> \<Phi>' b' f' bv' x' b1 c \<tau>' s' v' \<tau>1)
+
+  have beq: "b1[bv'::=b']\<^sub>b\<^sub>b[bv::=b]\<^sub>b\<^sub>b =  b1[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b\<^sub>b" 
+  proof -
+    have "supp b1 \<subseteq> { atom bv' }" using wfPhi_f_poly_supp_b infer_e_appPI 
+      using supp_at_base by blast
+    moreover have "bv \<noteq> bv'" using infer_e_appPI fresh_def supp_at_base 
+      by (simp add: fresh_def supp_at_base)
+    ultimately have "atom bv \<sharp> b1" using fresh_def fresh_at_base by force
+    thus ?thesis by simp
+  qed
+
+  have ceq: "(c[bv'::=b']\<^sub>c\<^sub>b)[bv::=b]\<^sub>c\<^sub>b = c[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>c\<^sub>b" proof -
+    have "supp c \<subseteq> { atom bv', atom x' }" using wfPhi_f_poly_supp_c infer_e_appPI 
+      using supp_at_base by blast
+    moreover have "bv \<noteq> bv'" using infer_e_appPI fresh_def supp_at_base 
+      by (simp add: fresh_def supp_at_base)
+    moreover have "atom x' \<noteq> atom bv" by auto
+    ultimately have "atom bv \<sharp> c" using fresh_def[of "atom bv" c] fresh_at_base by auto
+    thus ?thesis by simp
+  qed
+
+  show ?case proof(subst subst_eb.simps, rule Typing.infer_e_appPI)
+    show "\<Theta>' ; {||} ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wf_b_subst subst_db.simps infer_e_appPI wfX_wfY by metis
+    show "\<Theta>'  \<turnstile>\<^sub>w\<^sub>f \<Phi>' " using infer_e_appPI by auto
+    show "Some (AF_fundef f' (AF_fun_typ_some bv' (AF_fun_typ x' b1 c \<tau>' s'))) = lookup_fun \<Phi>' f'" using infer_e_appPI by auto
+    thus  "\<Theta>' ; {||} ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v'[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> x' : b1[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b  | c[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b \<rbrace>"  
+      using subst_b_check_v subst_tb.simps subst_b_simps infer_e_appPI 
+    proof -
+      have "\<Theta>' ; {||} ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v'[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> x' : b1[bv'::=b']\<^sub>b[bv::=b]\<^sub>b\<^sub>b  | (c[bv'::=b']\<^sub>b)[bv::=b]\<^sub>c\<^sub>b \<rbrace>" 
+        using  infer_e_appPI subst_b_check_v subst_tb.simps by metis
+      thus  ?thesis using beq ceq  subst_defs by metis
+    qed
+    show "atom x' \<sharp> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_appPI by auto
+    show  "\<tau>'[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b[x'::=v'[bv::=b]\<^sub>v\<^sub>b]\<^sub>v = \<tau>1[bv::=b]\<^sub>\<tau>\<^sub>b" proof - (* \<tau>'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v']\<^sub>\<tau>\<^sub>v = \<tau>1 *)
+
+      have "supp \<tau>' \<subseteq> { atom x', atom bv' }" using wfPhi_f_poly_supp_t  infer_e_appPI by auto
+      moreover hence "bv \<noteq> bv'" using infer_e_appPI fresh_def supp_at_base 
+        by (simp add: fresh_def supp_at_base)
+      ultimately have "atom bv \<sharp> \<tau>'" using fresh_def by force
+      hence "\<tau>'[bv'::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b[x'::=v'[bv::=b]\<^sub>v\<^sub>b]\<^sub>v = \<tau>'[bv'::=b']\<^sub>b[x'::=v']\<^sub>v[bv::=b]\<^sub>\<tau>\<^sub>b"  using subst_tb_triple subst_defs by auto 
+      thus ?thesis using infer_e_appPI by metis
+    qed
+    show "atom bv' \<sharp> (\<Theta>', \<Phi>', {||}, \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, b'[bv::=b]\<^sub>b\<^sub>b, v'[bv::=b]\<^sub>v\<^sub>b, \<tau>1[bv::=b]\<^sub>\<tau>\<^sub>b)" 
+      unfolding fresh_prodN apply( auto simp add: infer_e_appPI fresh_empty_fset)
+      using fresh_subst_if subst_b_\<Gamma>_def  subst_b_\<Delta>_def  subst_b_b_def subst_b_v_def subst_b_\<tau>_def infer_e_appPI by metis+
+    show "\<Theta>' ; {||}  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b " using infer_e_appPI wf_b_subst by simp
+  qed
+next
+  case (infer_e_fstI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b1 b2 c z)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_fstI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wf_b_subst(10) subst_db.simps infer_e_fstI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_fstI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z' : B_pair b1[bv::=b]\<^sub>b\<^sub>b b2[bv::=b]\<^sub>b\<^sub>b  | c[bv::=b]\<^sub>c\<^sub>b \<rbrace>" 
+      using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_fstI by force
+    show "atom z \<sharp> AE_fst (v[bv::=b]\<^sub>v\<^sub>b)" using infer_e_fstI subst_b_fresh_x subst_b_v_def e.fresh by metis
+    show "atom z \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_fstI by auto
+  qed
+next
+  case (infer_e_sndI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b1 b2 c z)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_sndI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  " using wf_b_subst(10) subst_db.simps infer_e_sndI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_sndI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z' : B_pair b1[bv::=b]\<^sub>b\<^sub>b b2[bv::=b]\<^sub>b\<^sub>b  | c[bv::=b]\<^sub>c\<^sub>b \<rbrace>" 
+      using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_sndI by force
+    show "atom z \<sharp> AE_snd (v[bv::=b]\<^sub>v\<^sub>b)" using infer_e_sndI subst_b_fresh_x subst_b_v_def e.fresh by metis
+    show "atom z \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_sndI by auto
+  qed
+next
+  case (infer_e_lenI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' c z)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_lenI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  " using wf_b_subst(10) subst_db.simps infer_e_lenI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_lenI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z' : B_bitvec  | c[bv::=b]\<^sub>c\<^sub>b \<rbrace>" 
+      using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_lenI by force
+    show "atom z \<sharp> AE_len (v[bv::=b]\<^sub>v\<^sub>b)" using infer_e_lenI subst_b_fresh_x subst_b_v_def e.fresh by metis
+    show "atom z \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_lenI by auto
+  qed
+next
+  case (infer_e_mvarI \<Theta> \<B> \<Gamma> \<Phi> \<Delta> u \<tau>)
+  show ?case proof(subst  subst subst_eb.simps, rule Typing.infer_e_mvarI)
+    show "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b " using infer_e_mvarI wf_b_subst by auto
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> "  using infer_e_mvarI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b "   using infer_e_mvarI  using wf_b_subst(10) subst_db.simps infer_e_sndI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "(u, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) \<in> setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b"  using infer_e_mvarI subst_db.simps set_insert 
+        subst_d_b_member by simp
+  qed
+next
+  case (infer_e_concatI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_concatI)
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wf_b_subst(10) subst_db.simps infer_e_concatI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_concatI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v1[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1[bv::=b]\<^sub>c\<^sub>b \<rbrace>" 
+      using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_concatI by force
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z2 : B_bitvec  | c2[bv::=b]\<^sub>c\<^sub>b \<rbrace>" 
+      using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_concatI by force
+    show "atom z3 \<sharp> AE_concat (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)" using infer_e_concatI subst_b_fresh_x subst_b_v_def e.fresh by metis
+    show "atom z3 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_g_b_x_fresh infer_e_concatI by auto
+  qed
+next
+  case (infer_e_splitI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  show ?case unfolding subst_b_simps proof(rule Typing.infer_e_splitI)
+    show \<open> \<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<close> using wf_b_subst(10) subst_db.simps infer_e_splitI wfX_wfY 
+      by (metis wf_b_subst(15))
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using infer_e_splitI by auto
+    show \<open> \<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v1[bv::=b]\<^sub>v\<^sub>b \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1[bv::=b]\<^sub>c\<^sub>b \<rbrace>\<close>  
+      using subst_b_infer_v subst_tb.simps subst_b_simps infer_e_splitI by force
+    show \<open>\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> z2 : B_int  | [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   AND
+                  [ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1[bv::=b]\<^sub>v\<^sub>b ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>\<close>  
+      using subst_b_check_v subst_tb.simps subst_b_simps infer_e_splitI 
+    proof -
+      have "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> v2[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> z2 : B_int | [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e == [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e AND [ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1 ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e == [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b"
+        using infer_e_splitI.hyps(7) infer_e_splitI.prems(1) infer_e_splitI.prems(2) subst_b_check_v by presburger (* 0.0 ms *)
+      then show ?thesis
+        by simp (* 0.0 ms *)
+    qed
+    show \<open>atom z1 \<sharp> AE_split (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)\<close> using infer_e_splitI subst_b_fresh_x subst_b_v_def e.fresh by metis
+    show \<open>atom z1 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b\<close> using subst_g_b_x_fresh infer_e_splitI by auto
+
+    show \<open>atom z2 \<sharp> AE_split (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)\<close>  using infer_e_splitI subst_b_fresh_x subst_b_v_def e.fresh by metis
+
+    show \<open>atom z2 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b\<close> using subst_g_b_x_fresh infer_e_splitI by auto
+    show \<open>atom z3 \<sharp> AE_split (v1[bv::=b]\<^sub>v\<^sub>b) (v2[bv::=b]\<^sub>v\<^sub>b)\<close>  using infer_e_splitI subst_b_fresh_x subst_b_v_def e.fresh by metis
+    show \<open>atom z3 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b\<close> using subst_g_b_x_fresh infer_e_splitI by auto
+  qed
+qed
+
+text \<open>This is needed for preservation. When we apply a function "f [b] v" we need to 
+substitute into the body of the function f replacing type-variable with b\<close>
+
+lemma subst_b_c_of_forget:
+  assumes "atom bv \<sharp> const"
+  shows "(c_of const x)[bv::=b]\<^sub>c\<^sub>b = c_of const x" 
+  using assms proof(nominal_induct const avoiding: x rule:\<tau>.strong_induct)
+  case (T_refined_type x' b' c')
+  hence "c_of \<lbrace> x' : b' | c' \<rbrace> x = c'[x'::=V_var x]\<^sub>c\<^sub>v" using c_of.simps by metis
+  moreover have "atom bv \<sharp> c'[x'::=V_var x]\<^sub>c\<^sub>v" proof -
+    have "atom bv \<sharp> c'" using T_refined_type \<tau>.fresh by simp
+    moreover have "atom bv \<sharp> V_var x" using v.fresh by simp
+    ultimately show ?thesis   
+      using T_refined_type \<tau>.fresh subst_b_c_def fresh_subst_if
+        \<tau>_fresh_c fresh_subst_cv_if has_subst_b_class.subst_b_fresh_x ms_fresh_all(37) ms_fresh_all assms by metis
+  qed
+  ultimately show ?case using forget_subst subst_b_c_def by metis
+qed
+
+lemma subst_b_check_s:
+  fixes s::s and b::b and cs::branch_s and css::branch_list and v::v and \<tau>::\<tau>
+  assumes "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b"  and "B = {|bv|}" (*and "D = []"*)
+  shows  "\<Theta> ; \<Phi> ; B ; G; D \<turnstile> s \<Leftarrow> \<tau> \<Longrightarrow> \<Theta> ; \<Phi> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b; D[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile> (s[bv::=b]\<^sub>s\<^sub>b) \<Leftarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" and
+    "\<Theta> ; \<Phi> ; B ; G; D ; tid ; cons ; const ; v \<turnstile> cs \<Leftarrow> \<tau> \<Longrightarrow> \<Theta> ; \<Phi> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b; D[bv::=b]\<^sub>\<Delta>\<^sub>b ; tid ; cons ; const ; v[bv::=b]\<^sub>v\<^sub>b \<turnstile> (subst_branchb cs bv b) \<Leftarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" and
+    "\<Theta> ; \<Phi> ; B ; G; D ; tid ; dclist ; v \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> \<Theta> ; \<Phi> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b; D[bv::=b]\<^sub>\<Delta>\<^sub>b ; tid ; dclist ; v[bv::=b]\<^sub>v\<^sub>b \<turnstile> (subst_branchlb css bv b ) \<Leftarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" 
+  using assms proof(induct  rule: check_s_check_branch_s_check_branch_list.inducts)
+  note facts = wfD_emptyI wfX_wfY wf_b_subst subst_b_subtype subst_b_infer_v
+  case (check_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v \<tau>' \<tau>)
+  show ?case 
+    apply(subst subst_sb.simps, rule Typing.check_valI) 
+    using facts check_valI apply metis
+    using check_valI subst_b_infer_v wf_b_subst subst_b_subtype apply blast
+    using check_valI subst_b_infer_v wf_b_subst subst_b_subtype apply blast  
+    using check_valI subst_b_infer_v wf_b_subst subst_b_subtype by metis
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b' c)
+  show ?case proof(subst subst_sb.simps, rule Typing.check_letI) 
+
+    show "atom x \<sharp>(\<Theta>, \<Phi>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, e[bv::=b]\<^sub>e\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" (*using check_letI  subst_b_\<tau>_def subst_b_\<Gamma>_def subst_b_fresh_x fresh_prod4 subst_b_c_def sory*)
+      apply(unfold fresh_prodN,auto)
+      apply(simp add: check_letI fresh_empty_fset)+
+      apply(metis *   subst_b_fresh_x check_letI fresh_prodN)+ done
+    show "atom z \<sharp> (x, \<Theta>, \<Phi>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, e[bv::=b]\<^sub>e\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b, s[bv::=b]\<^sub>s\<^sub>b)"  
+      apply(unfold fresh_prodN,auto)
+      apply(simp add: check_letI fresh_empty_fset)+
+      apply(metis *   subst_b_fresh_x check_letI fresh_prodN)+ done
+    show "\<Theta> ; \<Phi> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> e[bv::=b]\<^sub>e\<^sub>b \<Rightarrow> \<lbrace> z : b'[bv::=b]\<^sub>b\<^sub>b  | c[bv::=b]\<^sub>c\<^sub>b  \<rbrace>" 
+      using check_letI subst_b_infer_e subst_tb.simps by metis
+    have "c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v[bv::=b]\<^sub>c\<^sub>b =  (c[bv::=b]\<^sub>c\<^sub>b)[z::=V_var x]\<^sub>c\<^sub>v" 
+      using subst_cv_subst_bb_commute[of bv "V_var x" c z b] fresh_at_base by simp
+    thus "\<Theta> ; \<Phi> ; {||} ; ((x, b'[bv::=b]\<^sub>b\<^sub>b , (c[bv::=b]\<^sub>c\<^sub>b)[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b) ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b" 
+      using check_letI subst_gb.simps subst_defs by metis
+  qed
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  show ?case proof(subst subst_sb.simps, rule Typing.check_assertI)
+    show "atom x \<sharp> (\<Theta>, \<Phi>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b,  c[bv::=b]\<^sub>c\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b, s[bv::=b]\<^sub>s\<^sub>b)"   
+      apply(unfold fresh_prodN,auto)
+      apply(simp add: check_assertI fresh_empty_fset)+
+      apply(metis *   subst_b_fresh_x check_assertI fresh_prodN)+ done
+
+    have "\<Theta> ; \<Phi> ; {||} ; ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>)[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b" using  check_assertI
+      by metis
+    thus "\<Theta> ; \<Phi> ; {||} ; (x, B_bool, c[bv::=b]\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b" using  subst_gb.simps by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<Turnstile> c[bv::=b]\<^sub>c\<^sub>b " using subst_b_valid  check_assertI by simp
+    show " \<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wf_b_subst2(6) check_assertI by simp
+  qed
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> css)
+  then show ?case unfolding subst_branchlb.simps using Typing.check_branch_list_consI by simp
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
+  then show ?case unfolding subst_branchlb.simps using Typing.check_branch_list_finalI by simp
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
+
+  show ?case unfolding subst_b_simps proof(rule Typing.check_branch_s_branchI) 
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  "  using check_branch_s_branchI wf_b_subst subst_db.simps by metis
+    show "\<turnstile>\<^sub>w\<^sub>f \<Theta> " using check_branch_s_branchI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b "   using check_branch_s_branchI wf_b_subst by metis
+
+    show "atom x \<sharp>(\<Theta>, \<Phi>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, tid, cons , const, v[bv::=b]\<^sub>v\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)"       
+      apply(unfold fresh_prodN,auto)
+      apply(simp add: check_branch_s_branchI fresh_empty_fset)+
+      apply(metis *   subst_b_fresh_x check_branch_s_branchI fresh_prodN)+
+      done
+    show wft:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f  const" using check_branch_s_branchI  by auto
+    hence "(b_of const) = (b_of const)[bv::=b]\<^sub>b\<^sub>b" 
+      using wfT_nil_supp   fresh_def[of "atom bv" ] forget_subst subst_b_b_def \<tau>.supp
+        bot.extremum_uniqueI ex_in_conv fresh_def supp_empty_fset 
+      by (metis b_of_supp)
+    moreover have "(c_of const x)[bv::=b]\<^sub>c\<^sub>b = c_of const x" 
+      using wft   wfT_nil_supp   fresh_def[of "atom bv" ] forget_subst subst_b_c_def \<tau>.supp
+        bot.extremum_uniqueI ex_in_conv fresh_def supp_empty_fset  subst_b_c_of_forget by metis
+    ultimately show  "\<Theta> ; \<Phi> ; {||} ; (x, b_of const, CE_val (v[bv::=b]\<^sub>v\<^sub>b)  ==  CE_val(V_cons tid cons (V_var x)) AND c_of const x) #\<^sub>\<Gamma> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b   \<turnstile> s[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b"  
+      using check_branch_s_branchI subst_gb.simps by auto
+  qed
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  show ?case unfolding subst_b_simps proof(rule  Typing.check_ifI) 
+    show \<open>atom z \<sharp> (\<Theta>, \<Phi>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b, s1[bv::=b]\<^sub>s\<^sub>b, s2[bv::=b]\<^sub>s\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)\<close> 
+      by(unfold fresh_prodN,auto, auto simp add: check_ifI fresh_empty_fset subst_b_fresh_x )
+    have "\<lbrace> z : B_bool  | TRUE \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b  = \<lbrace> z : B_bool  | TRUE \<rbrace>"  by auto
+    thus \<open>\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>\<close> using check_ifI subst_b_check_v by metis
+    show \<open> \<Theta> ; \<Phi> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s1[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<lbrace> z : b_of \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b  | CE_val (v[bv::=b]\<^sub>v\<^sub>b)  ==  CE_val (V_lit L_true)   IMP  c_of \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b z  \<rbrace>\<close> 
+      using subst_b_if check_ifI by metis
+    show \<open> \<Theta> ; \<Phi> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s2[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<lbrace> z : b_of \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b  | CE_val (v[bv::=b]\<^sub>v\<^sub>b)  ==  CE_val (V_lit L_false)   IMP  c_of \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b z  \<rbrace>\<close> 
+      using subst_b_if check_ifI by metis
+  qed
+next
+  case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2 )
+  show ?case unfolding subst_b_simps proof (rule Typing.check_let2I)
+    have "atom x \<sharp> b" using x_fresh_b by auto
+    show \<open>atom x \<sharp> (\<Theta>, \<Phi>, {||}, G[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, t[bv::=b]\<^sub>\<tau>\<^sub>b, s1[bv::=b]\<^sub>s\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)\<close>      
+      apply(unfold fresh_prodN, auto, auto simp add: check_let2I fresh_prodN fresh_empty_fset)
+      apply(metis  subst_b_fresh_x check_let2I fresh_prodN)+
+      done
+
+    show \<open> \<Theta> ; \<Phi> ; {||} ; G[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s1[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> t[bv::=b]\<^sub>\<tau>\<^sub>b \<close> using check_let2I subst_tb.simps  by auto
+    show \<open> \<Theta> ; \<Phi> ; {||} ; (x, b_of t[bv::=b]\<^sub>\<tau>\<^sub>b, c_of t[bv::=b]\<^sub>\<tau>\<^sub>b x) #\<^sub>\<Gamma> G[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s2[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b\<close> 
+      using check_let2I subst_tb.simps  subst_gb.simps b_of.simps subst_b_c_of subst_b_b_of by auto
+  qed
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  show ?case unfolding subst_b_simps proof(rule Typing.check_varI) 
+    show "atom u \<sharp>  (\<Theta>, \<Phi>, {||}, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, \<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) "
+      by(unfold fresh_prodN,auto simp add: check_varI fresh_empty_fset subst_b_fresh_u )
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b" using check_varI subst_b_check_v by auto
+    show "\<Theta> ; \<Phi> ; {||} ; (subst_gb  \<Gamma> bv b) ; (u, (\<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b)) #\<^sub>\<Delta> (subst_db  \<Delta> bv b)   \<turnstile> (s[bv::=b]\<^sub>s\<^sub>b) \<Leftarrow> (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)" using check_varI by auto
+  qed
+next
+  case (check_assignI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau> v z \<tau>')
+  show ?case unfolding subst_b_simps proof( rule Typing.check_assignI) 
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using check_assignI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wf_b_subst check_assignI by auto
+    show "(u, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) \<in> setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" using check_assignI subst_d_b_member  by simp
+    show " \<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b"  using check_assignI subst_b_check_v by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b" using check_assignI subst_b_subtype subst_b_simps subst_tb.simps by fastforce
+  qed
+next
+  case (check_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>')
+  show ?case unfolding subst_b_simps proof(rule Typing.check_whileI) 
+    show "\<Theta> ; \<Phi> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s1[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>" using check_whileI by auto
+    show "\<Theta> ; \<Phi> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<turnstile> s2[bv::=b]\<^sub>s\<^sub>b \<Leftarrow> \<lbrace> z : B_unit  | TRUE \<rbrace>" using check_whileI by auto
+    show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b"  using subst_b_subtype check_whileI by fastforce
+  qed     
+next
+  case (check_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>)
+  then show ?case unfolding subst_sb.simps using check_seqI Typing.check_seqI subst_b_eq by metis
+next
+  case (check_caseI \<Theta> \<Phi> \<B>  \<Gamma> \<Delta> tid dclist v cs \<tau>  z)
+  show ?case unfolding subst_b_simps proof(rule Typing.check_caseI)
+    show \<open> \<Theta> ;  \<Phi> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b ; tid ; dclist ; v[bv::=b]\<^sub>v\<^sub>b \<turnstile> subst_branchlb cs bv b \<Leftarrow> \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b\<close> using check_caseI by auto
+    show \<open>AF_typedef tid dclist \<in> set \<Theta>\<close> using check_caseI by auto
+    show \<open>\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> v[bv::=b]\<^sub>v\<^sub>b \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>\<close> using check_caseI subst_b_check_v subst_b_simps subst_tb.simps subst_b_simps       
+    proof -
+      have "\<lbrace> z : B_id tid | TRUE \<rbrace> = \<lbrace> z : B_id tid | TRUE \<rbrace>[bv::=b]\<^sub>\<tau>\<^sub>b" using subst_b_eq by auto
+      then show ?thesis
+        by (metis (no_types) check_caseI.hyps(4) check_caseI.prems(1) check_caseI.prems(2) subst_b_check_v) (* 31 ms *)
+    qed
+    show \<open>   \<turnstile>\<^sub>w\<^sub>f \<Theta> \<close> using check_caseI by auto
+  qed
+qed
+
+end
diff --git a/thys/MiniSail/ContextSubtypingL.thy b/thys/MiniSail/ContextSubtypingL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/ContextSubtypingL.thy
@@ -0,0 +1,1068 @@
+(*<*)
+theory ContextSubtypingL
+  imports TypingL "HOL-Eisbach.Eisbach_Tools" SubstMethods
+begin
+  (*>*)
+
+declare freshers[simp del]
+
+chapter \<open>Context Subtyping  Lemmas\<close>
+
+text \<open>Lemmas allowing us to replace the type of a variable in the context with a subtype
+and have the judgement remain valid. Also known as narrowing.\<close>
+
+section \<open>Replace or exchange type of variable in a context\<close>
+
+text \<open> Because the G-context is extended by the statements like let, we will need a generalised 
+substitution lemma for statements. 
+For this we setup a function that replaces in G (rig) for a particular x the constraint for it.
+We also define a well-formedness relation for RIGs that ensures that each new constraint 
+implies the old one\<close>
+
+nominal_function replace_in_g_many :: "\<Gamma> \<Rightarrow> (x*c) list \<Rightarrow> \<Gamma>" where
+  "replace_in_g_many G xcs = List.foldr (\<lambda>(x,c) G. G[x \<longmapsto> c]) xcs G"
+  by(auto,simp add: eqvt_def replace_in_g_many_graph_aux_def)
+nominal_termination (eqvt)  by lexicographic_order
+
+inductive replace_in_g_subtyped :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> (x*c) list \<Rightarrow> \<Gamma> \<Rightarrow> bool" (" _ ; _  \<turnstile> _ \<langle> _ \<rangle> \<leadsto> _" [100,50,50] 50) where
+  replace_in_g_subtyped_nilI: "\<Theta>; \<B> \<turnstile> G \<langle> [] \<rangle> \<leadsto> G"
+| replace_in_g_subtyped_consI:  "\<lbrakk> 
+       Some (b,c') = lookup G x ; 
+        \<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f c ;
+       \<Theta>; \<B>; G[x\<longmapsto>c] \<Turnstile> c' ; 
+       \<Theta>; \<B> \<turnstile> G[x\<longmapsto>c] \<langle> xcs \<rangle> \<leadsto> G'; x \<notin> fst ` set xcs \<rbrakk>  \<Longrightarrow> 
+       \<Theta>; \<B> \<turnstile> G \<langle> (x,c)#xcs \<rangle> \<leadsto> G'" 
+equivariance replace_in_g_subtyped
+nominal_inductive replace_in_g_subtyped .
+
+inductive_cases replace_in_g_subtyped_elims[elim!]:
+  "\<Theta>; \<B> \<turnstile> G \<langle> [] \<rangle> \<leadsto> G'"
+  "\<Theta>; \<B> \<turnstile> ((x,b,c)#\<^sub>\<Gamma>\<Gamma> G) \<langle> acs \<rangle> \<leadsto> ((x,b,c)#\<^sub>\<Gamma>G')"
+  "\<Theta>; \<B> \<turnstile> G' \<langle> (x,c)# acs \<rangle> \<leadsto> G"
+
+lemma rigs_atom_dom_eq:
+  assumes "\<Theta>; \<B> \<turnstile> G \<langle> xcs \<rangle> \<leadsto> G'"
+  shows "atom_dom G = atom_dom G'"
+  using assms proof(induct rule: replace_in_g_subtyped.induct)
+  case (replace_in_g_subtyped_nilI G)
+  then show ?case by simp
+next
+  case (replace_in_g_subtyped_consI b c' G x \<Theta> \<B> c xcs G')
+  then show ?case using rig_dom_eq atom_dom.simps dom.simps by simp
+qed
+
+lemma replace_in_g_wfG:
+  assumes "\<Theta>; \<B> \<turnstile> G \<langle> xcs \<rangle> \<leadsto> G'" and  "wfG \<Theta> \<B> G "
+  shows "wfG \<Theta> \<B> G'"
+  using assms proof(induct rule: replace_in_g_subtyped.induct)
+  case (replace_in_g_subtyped_nilI \<Theta> G)
+  then show ?case by auto
+next
+  case (replace_in_g_subtyped_consI b c' G x \<Theta> c xcs G')
+  then show ?case using valid_g_wf by auto
+qed
+
+lemma wfD_rig_single:
+  fixes \<Delta>::\<Delta> and x::x and c::c and G::\<Gamma>
+  assumes "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<Delta> " and  "wfG \<Theta> \<B> (G[x\<longmapsto>c])"
+  shows "\<Theta>; \<B>; G[x\<longmapsto>c]  \<turnstile>\<^sub>w\<^sub>f \<Delta>" 
+proof(cases "atom x \<in> atom_dom G")
+  case False
+  hence "(G[x\<longmapsto>c]) = G" using assms replace_in_g_forget wfX_wfY by metis
+  then show ?thesis using assms by auto
+next
+  case True
+  then obtain G1 G2 b c' where *: "G=G1@(x,b,c')#\<^sub>\<Gamma>G2" using split_G by fastforce
+  hence **: "(G[x\<longmapsto>c]) = G1@(x,b,c)#\<^sub>\<Gamma>G2" using replace_in_g_inside wfD_wf  assms wfD_wf by metis
+
+  hence "wfG \<Theta> \<B> ((x,b,c)#\<^sub>\<Gamma>G2)" using wfG_suffix assms by auto
+  hence "\<Theta>; \<B>; (x, b, TRUE) #\<^sub>\<Gamma> G2  \<turnstile>\<^sub>w\<^sub>f c" using wfG_elim2 by auto
+
+  thus ?thesis using wf_replace_inside1 assms * ** 
+    by (simp add: wf_replace_inside2(6))
+qed
+
+lemma wfD_rig:
+  assumes  "\<Theta>; \<B> \<turnstile> G \<langle> xcs \<rangle> \<leadsto> G'" and "wfD \<Theta> \<B> G \<Delta>" 
+  shows "wfD \<Theta> \<B> G' \<Delta>" 
+  using assms proof(induct rule: replace_in_g_subtyped.induct)
+  case (replace_in_g_subtyped_nilI \<Theta> G)
+  then show ?case by auto
+next
+  case (replace_in_g_subtyped_consI b c' G x \<Theta> c xcs G')
+  then show ?case using wfD_rig_single valid.simps wfC_wf by auto
+qed
+
+lemma replace_in_g_fresh:
+  fixes x::x
+  assumes "\<Theta>; \<B> \<turnstile> \<Gamma> \<langle> xcs \<rangle> \<leadsto> \<Gamma>'" and  "wfG \<Theta> \<B> \<Gamma>" and "wfG \<Theta> \<B> \<Gamma>'" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> \<Gamma>'"
+  using  wfG_dom_supp assms fresh_def rigs_atom_dom_eq by metis
+
+lemma replace_in_g_fresh1:
+  fixes x::x
+  assumes "\<Theta>; \<B> \<turnstile> \<Gamma> \<langle> xcs \<rangle> \<leadsto> \<Gamma>'" and  "wfG \<Theta> \<B> \<Gamma>" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> \<Gamma>'"
+proof -
+  have  "wfG \<Theta> \<B> \<Gamma>'" using  replace_in_g_wfG assms by auto
+  thus ?thesis using assms replace_in_g_fresh by metis
+qed
+
+text \<open> Wellscoping for an eXchange list\<close>
+
+inductive wsX:: "\<Gamma> \<Rightarrow> (x*c) list \<Rightarrow> bool" where
+  wsX_NilI: "wsX G []"
+|  wsX_ConsI: "\<lbrakk> wsX G xcs ; atom x \<in> atom_dom G ; x \<notin> fst ` set xcs \<rbrakk> \<Longrightarrow> wsX G ((x,c)#xcs)"
+equivariance wsX
+nominal_inductive wsX .
+
+lemma wsX_if1:
+  assumes "wsX G xcs"
+  shows "(( atom ` fst ` set xcs) \<subseteq> atom_dom G) \<and> List.distinct (List.map fst xcs)"
+  using assms by(induct rule: wsX.induct,force+ )
+
+lemma wsX_if2:
+  assumes  "(( atom ` fst ` set xcs) \<subseteq> atom_dom G) \<and> List.distinct (List.map fst xcs)"
+  shows  "wsX G xcs"
+  using assms proof(induct xcs)
+  case Nil
+  then show ?case using wsX_NilI by fast
+next
+  case (Cons a xcs)
+  then obtain x and c where xc: "a=(x,c)" by force
+  have " wsX G xcs" proof -
+    have "distinct (map fst xcs)" using Cons by force
+    moreover have " atom ` fst ` set xcs \<subseteq> atom_dom G" using Cons by simp
+    ultimately show ?thesis  using Cons by fast
+  qed
+  moreover have "atom x \<in> atom_dom G" using Cons xc 
+    by simp
+  moreover have "x \<notin> fst ` set xcs" using Cons xc 
+    by simp
+  ultimately show ?case using wsX_ConsI xc by blast
+qed
+
+lemma wsX_iff:
+  "wsX G xcs = ((( atom ` fst ` set xcs) \<subseteq> atom_dom G) \<and> List.distinct (List.map fst xcs))"
+  using wsX_if1 wsX_if2 by meson
+
+inductive_cases wsX_elims[elim!]:
+  "wsX G []"
+  "wsX G ((x,c)#xcs)"
+
+lemma wsX_cons:
+  assumes  "wsX \<Gamma> xcs" and  "x \<notin> fst ` set xcs" 
+  shows "wsX ((x, b, c1) #\<^sub>\<Gamma> \<Gamma>) ((x, c2) # xcs)" 
+  using assms proof(induct \<Gamma>)
+  case GNil
+  then show ?case using atom_dom.simps wsX_iff by auto
+next
+  case (GCons xbc \<Gamma>)
+  obtain x' and b' and c' where xbc: "xbc = (x',b',c')" using prod_cases3 by blast
+  then have "atom ` fst ` set xcs \<subseteq> atom_dom (xbc #\<^sub>\<Gamma> \<Gamma>) \<and> distinct (map fst xcs)"
+    using GCons.prems(1) wsX_iff by blast
+  then have "wsX ((x, b, c1) #\<^sub>\<Gamma> xbc #\<^sub>\<Gamma> \<Gamma>) xcs"
+    by (simp add: Un_commute subset_Un_eq wsX_if2) 
+  then show ?case   by (simp add: GCons.prems(2) wsX_ConsI) 
+qed
+
+lemma wsX_cons2:
+  assumes  "wsX \<Gamma> xcs" and  "x \<notin> fst ` set xcs" 
+  shows "wsX ((x, b, c1) #\<^sub>\<Gamma> \<Gamma>)  xcs" 
+  using assms proof(induct \<Gamma>)
+  case GNil
+  then show ?case using atom_dom.simps wsX_iff by auto
+next
+  case (GCons xbc \<Gamma>)
+  obtain x' and b' and c' where xbc: "xbc = (x',b',c')" using prod_cases3 by blast
+  then have "atom ` fst ` set xcs \<subseteq> atom_dom (xbc #\<^sub>\<Gamma> \<Gamma>) \<and> distinct (map fst xcs)"
+    using GCons.prems(1) wsX_iff by blast then show ?case by (simp add: Un_commute subset_Un_eq wsX_if2) 
+qed
+
+lemma wsX_cons3:
+  assumes  "wsX \<Gamma> xcs"  
+  shows "wsX ((x, b, c1) #\<^sub>\<Gamma> \<Gamma>)  xcs" 
+  using assms proof(induct \<Gamma>)
+  case GNil
+  then show ?case using atom_dom.simps wsX_iff by auto
+next
+  case (GCons xbc \<Gamma>)
+  obtain x' and b' and c' where xbc: "xbc = (x',b',c')" using prod_cases3 by blast
+  then have "atom ` fst ` set xcs \<subseteq> atom_dom (xbc #\<^sub>\<Gamma> \<Gamma>) \<and> distinct (map fst xcs)"
+    using GCons.prems(1) wsX_iff by blast then show ?case by (simp add: Un_commute subset_Un_eq wsX_if2) 
+qed
+
+lemma wsX_fresh:
+  assumes "wsX G xcs" and "atom x \<sharp> G" and "wfG \<Theta> \<B> G "
+  shows "x \<notin> fst ` set xcs"
+proof - 
+  have "atom x \<notin> atom_dom G" using assms 
+    using fresh_def wfG_dom_supp by auto
+  thus ?thesis using wsX_iff assms by blast
+qed
+
+lemma replace_in_g_dist:
+  assumes "x' \<noteq> x" 
+  shows "replace_in_g ((x, b,c) #\<^sub>\<Gamma> G) x' c'' = ((x, b,c) #\<^sub>\<Gamma> (replace_in_g G x' c''))" using replace_in_g.simps assms by presburger
+
+lemma wfG_replace_inside_rig:
+  fixes c''::c
+  assumes \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G[x'\<longmapsto>c'']\<close> \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> G \<close>
+  shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> G[x'\<longmapsto>c'']"
+proof(rule wfG_consI)
+
+  have "wfG \<Theta> \<B> G " using wfG_cons assms by auto
+
+  show *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G[x'\<longmapsto>c'']" using assms by auto
+  show "atom x \<sharp> G[x'\<longmapsto>c'']" using replace_in_g_fresh_single[OF *] assms wfG_elims assms by metis
+  show **:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b " using wfG_elim2 assms by auto
+  show "\<Theta>; \<B>; (x, b, TRUE) #\<^sub>\<Gamma> G[x'\<longmapsto>c'']  \<turnstile>\<^sub>w\<^sub>f c "
+  proof(cases "atom x' \<notin> atom_dom G")
+    case True
+    hence "G = G[x'\<longmapsto>c'']" using replace_in_g_forget \<open>wfG \<Theta> \<B> G\<close>  by auto
+    thus ?thesis using assms wfG_wfC by auto
+  next
+    case False
+    then obtain G1 G2 b' c' where **:"G=G1@(x',b',c')#\<^sub>\<Gamma>G2"
+      using split_G by fastforce
+    hence ***: "(G[x'\<longmapsto>c'']) = G1@(x',b',c'')#\<^sub>\<Gamma>G2"
+      using replace_in_g_inside \<open>wfG \<Theta> \<B> G \<close>  by metis
+    hence "\<Theta>; \<B>; (x, b, TRUE) #\<^sub>\<Gamma> G1@(x',b',c')#\<^sub>\<Gamma>G2  \<turnstile>\<^sub>w\<^sub>f c" using * ** assms wfG_wfC by auto
+    hence  "\<Theta>; \<B>; (x, b, TRUE) #\<^sub>\<Gamma> G1@(x',b',c'')#\<^sub>\<Gamma>G2  \<turnstile>\<^sub>w\<^sub>f c" using * *** wf_replace_inside assms
+      by (metis "**" append_g.simps(2) wfG_elim2 wfG_suffix)
+    thus ?thesis using ** * *** by auto
+  qed
+qed
+
+lemma replace_in_g_valid_weakening:
+  assumes "\<Theta>; \<B>; \<Gamma>[x'\<longmapsto>c''] \<Turnstile> c'" and "x' \<noteq> x" and  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> \<Gamma>[x'\<longmapsto>c'']"
+  shows "\<Theta>; \<B>; ((x, b,c) #\<^sub>\<Gamma> \<Gamma>)[x'\<longmapsto> c'']  \<Turnstile> c'"
+  apply(subst replace_in_g_dist,simp add: assms,rule valid_weakening)
+  using assms by auto+
+
+lemma replace_in_g_subtyped_cons:
+  assumes "replace_in_g_subtyped \<Theta> \<B> G xcs G'"  and "wfG \<Theta> \<B> ((x,b,c)#\<^sub>\<Gamma>G)"
+  shows "x \<notin> fst ` set xcs \<Longrightarrow> replace_in_g_subtyped \<Theta> \<B> ((x,b,c)#\<^sub>\<Gamma>G) xcs ((x,b,c)#\<^sub>\<Gamma>G')"
+  using assms proof(induct  rule: replace_in_g_subtyped.induct)
+  case (replace_in_g_subtyped_nilI G)
+  then show ?case 
+    by (simp add: replace_in_g_subtyped.replace_in_g_subtyped_nilI)
+next
+  case (replace_in_g_subtyped_consI b' c' G x' \<Theta> \<B> c'' xcs' G')
+  hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G[x'\<longmapsto>c'']" using valid.simps wfC_wf by auto
+
+  show ?case proof(rule replace_in_g_subtyped.replace_in_g_subtyped_consI)
+    show  " Some (b', c') = lookup ((x, b,c) #\<^sub>\<Gamma> G) x'" using lookup.simps 
+        fst_conv image_iff \<Gamma>_set_intros surj_pair replace_in_g_subtyped_consI by force
+    show wbc: " \<Theta>; \<B>; (x, b, c) #\<^sub>\<Gamma> G  \<turnstile>\<^sub>w\<^sub>f c'' "  using wf_weakening \<open> \<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f c''\<close> \<open>\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> G \<close> by fastforce
+    have  "x' \<noteq> x"  using replace_in_g_subtyped_consI by auto
+    have wbc1: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> G[x'\<longmapsto>c'']" proof -
+      have "(x, b, c) #\<^sub>\<Gamma> G[x'\<longmapsto>c''] = ((x, b, c) #\<^sub>\<Gamma> G)[x'\<longmapsto>c'']" using \<open>x' \<noteq> x\<close> using replace_in_g.simps by auto
+      thus  ?thesis using wfG_replace_inside_rig \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G[x'\<longmapsto>c'']\<close>  \<open>\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> G \<close> by fastforce   
+    qed
+    show  *: "\<Theta>; \<B>; replace_in_g ((x, b,c) #\<^sub>\<Gamma> G) x' c''  \<Turnstile> c'" 
+    proof - 
+      have "\<Theta>; \<B>; G[x'\<longmapsto>c'']  \<Turnstile> c'" using replace_in_g_subtyped_consI by auto
+      thus ?thesis using replace_in_g_valid_weakening wbc1 \<open>x'\<noteq>x\<close> by auto     
+    qed
+
+    show  "replace_in_g_subtyped \<Theta> \<B> (replace_in_g ((x, b,c) #\<^sub>\<Gamma> G) x' c'') xcs' ((x, b,c) #\<^sub>\<Gamma> G')"  
+      using replace_in_g_subtyped_consI wbc1 by auto
+    show  "x' \<notin> fst ` set xcs'" 
+      using replace_in_g_subtyped_consI by linarith
+  qed
+qed
+
+lemma replace_in_g_split:
+  fixes G::\<Gamma> 
+  assumes "\<Gamma> = replace_in_g \<Gamma>' x c" and "\<Gamma>' =  G'@(x,b,c')#\<^sub>\<Gamma>G" and "wfG \<Theta> \<B> \<Gamma>'"
+  shows "\<Gamma> =  G'@(x,b,c)#\<^sub>\<Gamma>G" 
+  using assms proof(induct G' arbitrary: G \<Gamma> \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by simp
+next
+  case (GCons x1 b1 c1 \<Gamma>1)
+  hence "x1 \<noteq> x"
+    using wfG_cons_fresh2[of \<Theta> \<B> x1 b1 c1 \<Gamma>1 x b ] 
+    using GCons.prems(2) GCons.prems(3) append_g.simps(2) by auto
+  moreover hence *: "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (\<Gamma>1 @ (x, b, c') #\<^sub>\<Gamma> G)" using GCons append_g.simps wfG_elims by metis
+  moreover hence "replace_in_g (\<Gamma>1 @ (x, b, c') #\<^sub>\<Gamma> G) x c = \<Gamma>1 @ (x, b, c) #\<^sub>\<Gamma> G" using GCons replace_in_g_inside[OF *, of c] by auto
+
+  ultimately  show ?case using replace_in_g.simps(2)[of x1 b1 c1 " \<Gamma>1 @ (x, b, c') #\<^sub>\<Gamma> G" x c] GCons
+    by (simp add: GCons.prems(1) GCons.prems(2)) 
+qed
+
+lemma replace_in_g_subtyped_split0:
+  fixes G::\<Gamma> 
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>'[(x,c)] \<Gamma>" and "\<Gamma>' =  G'@(x,b,c')#\<^sub>\<Gamma>G"  and "wfG \<Theta> \<B> \<Gamma>'"
+  shows "\<Gamma> =  G'@(x,b,c)#\<^sub>\<Gamma>G" 
+proof - 
+  have "\<Gamma> = replace_in_g \<Gamma>' x c" using assms replace_in_g_subtyped.simps
+    by (metis Pair_inject list.distinct(1) list.inject)
+  thus ?thesis using assms replace_in_g_split by blast
+qed
+
+lemma replace_in_g_subtyped_split:
+  assumes "Some (b, c') = lookup G x" and "\<Theta>; \<B>; replace_in_g G x c  \<Turnstile> c'" and "wfG \<Theta> \<B> G "
+  shows "\<exists> \<Gamma> \<Gamma>'. G = \<Gamma>'@(x,b,c')#\<^sub>\<Gamma>\<Gamma> \<and> \<Theta>; \<B>; \<Gamma>'@(x,b,c)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c'"
+proof -
+  obtain \<Gamma> and \<Gamma>' where "G = \<Gamma>'@(x,b,c')#\<^sub>\<Gamma>\<Gamma>" using assms lookup_split by blast
+  moreover hence  "replace_in_g G x c =  \<Gamma>'@(x,b,c)#\<^sub>\<Gamma>\<Gamma>" using replace_in_g_split assms by blast
+  ultimately show ?thesis by (metis assms(2))
+qed
+
+section \<open>Validity and Subtyping\<close>
+
+lemma wfC_replace_in_g:
+  fixes c::c and c0::c
+  assumes "\<Theta>; \<B>; \<Gamma>'@(x,b,c0')#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c" and "\<Theta>; \<B>; (x,b,TRUE)#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c0"
+  shows "\<Theta>; \<B>; \<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
+  using wf_replace_inside1(2) assms by auto 
+
+
+lemma ctx_subtype_valid:
+  assumes "\<Theta>; \<B>; \<Gamma>'@(x,b,c0')#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c" and 
+    "\<Theta>; \<B>; \<Gamma>'@(x,b,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'"
+  shows "\<Theta>; \<B>; \<Gamma>'@(x,b,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c"
+proof(rule validI)
+  show "\<Theta>; \<B>; \<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f c" proof - 
+    have  "\<Theta>; \<B>; \<Gamma>'@(x,b,c0')#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c" using valid.simps assms by auto
+    moreover have "\<Theta>; \<B>; (x,b,TRUE)#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c0" proof -
+      have "wfG \<Theta> \<B> (\<Gamma>'@(x,b,c0)#\<^sub>\<Gamma>\<Gamma>)" using assms valid.simps wfC_wf by auto
+      hence "wfG \<Theta> \<B> ((x,b,c0)#\<^sub>\<Gamma>\<Gamma>)" using wfG_suffix by auto
+      thus ?thesis using wfG_wfC by auto
+    qed
+    ultimately show ?thesis using assms wfC_replace_in_g by auto
+  qed
+
+  show "\<forall>i. wfI \<Theta> (\<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> \<Gamma>) i \<and> is_satis_g i (\<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> \<Gamma>) \<longrightarrow> is_satis i c" proof(rule,rule)
+    fix i
+    assume * : "wfI \<Theta> (\<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> \<Gamma>) i \<and> is_satis_g i (\<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> \<Gamma>) "
+
+    hence "is_satis_g i (\<Gamma>'@(x, b, c0) #\<^sub>\<Gamma> \<Gamma>) \<and> wfI \<Theta> (\<Gamma>'@(x, b, c0) #\<^sub>\<Gamma> \<Gamma>) i" using is_satis_g_append wfI_suffix by metis
+    moreover hence "is_satis i c0'" using valid.simps assms by presburger
+
+    moreover have "is_satis_g i \<Gamma>'"  using is_satis_g_append * by simp
+    ultimately have "is_satis_g i (\<Gamma>' @ (x, b, c0') #\<^sub>\<Gamma> \<Gamma>) " using is_satis_g_append by simp
+    moreover have "wfI \<Theta> (\<Gamma>' @ (x, b, c0') #\<^sub>\<Gamma> \<Gamma>) i" using wfI_def wfI_suffix * wfI_def wfI_replace_inside by metis
+    ultimately show  "is_satis i c" using assms valid.simps by metis
+  qed
+qed
+
+lemma ctx_subtype_subtype:
+  fixes \<Gamma>::\<Gamma>
+  shows "\<Theta>; \<B>; G \<turnstile> t1 \<lesssim> t2 \<Longrightarrow> G = \<Gamma>'@(x,b0,c0')#\<^sub>\<Gamma>\<Gamma> \<Longrightarrow> \<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0' \<Longrightarrow> \<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<turnstile> t1 \<lesssim> t2"
+proof(nominal_induct avoiding: c0 rule: subtype.strong_induct)
+
+  case (subtype_baseI x' \<Theta> \<B> \<Gamma>'' z c z' c' b)
+  let ?\<Gamma>c0 = "\<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma>" 
+  have wb1:  "wfG \<Theta> \<B> ?\<Gamma>c0" using valid.simps wfC_wf   subtype_baseI by metis
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace> \<close> using  wfT_replace_inside2[OF _ wb1] subtype_baseI by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z' : b  | c' \<rbrace> \<close> using  wfT_replace_inside2[OF _ wb1] subtype_baseI by metis
+    have "atom x' \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>" using fresh_prodN subtype_baseI fresh_replace_inside wb1 subtype_wf wfX_wfY by metis
+    thus  \<open>atom x' \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>,  z,  c , z' , c' )\<close>  using subtype_baseI fresh_prodN by metis
+    have "\<Theta>; \<B>; ((x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'[z'::=V_var x']\<^sub>v " proof(rule ctx_subtype_valid)
+      show 1: \<open>\<Theta>; \<B>; ((x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b0, c0') #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'[z'::=V_var x']\<^sub>v \<close> 
+        using  subtype_baseI append_g.simps subst_defs by metis
+      have *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> " proof(rule wfG_replace_inside2)
+        show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b0, c0') #\<^sub>\<Gamma> \<Gamma>" 
+          using * valid_wf_all wfC_wf 1 append_g.simps by metis
+        show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>" using wfG_suffix wb1 by auto
+      qed
+      moreover have "toSet (\<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet (((x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>)" using toSet.simps append_g.simps by auto
+      ultimately show  \<open>\<Theta>; \<B>; ((x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c0' \<close> using   valid_weakening subtype_baseI * by blast
+    qed
+    thus  \<open>\<Theta>; \<B>;  (x', b, c[z::=V_var x']\<^sub>v) #\<^sub>\<Gamma> \<Gamma>'  @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'[z'::=V_var x']\<^sub>v \<close> using append_g.simps subst_defs by simp     
+  qed
+qed
+
+lemma ctx_subtype_subtype_rig:
+  assumes   "replace_in_g_subtyped \<Theta>  \<B> \<Gamma>' [(x,c0)] \<Gamma>" and  "\<Theta>; \<B>; \<Gamma>' \<turnstile> t1 \<lesssim> t2"  
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> t1 \<lesssim> t2"
+proof -
+  have wf: "wfG \<Theta> \<B> \<Gamma>'" using subtype_g_wf assms by auto
+  obtain b and c0' where  "Some (b, c0') = lookup \<Gamma>' x \<and> (\<Theta>; \<B>; replace_in_g \<Gamma>' x c0  \<Turnstile> c0')" using 
+      replace_in_g_subtyped.simps[of  \<Theta> \<B> \<Gamma>' "[(x, c0)]" \<Gamma>] assms(1) 
+
+    by (metis fst_conv list.inject list.set_intros(1) list.simps(15) not_Cons_self2 old.prod.exhaust prod.inject set_ConsD surj_pair)
+  moreover then obtain G and G' where *: "\<Gamma>' = G'@(x,b,c0')#\<^sub>\<Gamma>G \<and> \<Theta>; \<B>; G'@(x,b,c0)#\<^sub>\<Gamma>G \<Turnstile> c0'" 
+    using replace_in_g_subtyped_split[of b  c0' \<Gamma>' x \<Theta> \<B> c0] wf by metis
+
+  ultimately show ?thesis using ctx_subtype_subtype 
+      assms(1) assms(2) replace_in_g_subtyped_split0 subtype_g_wf  
+    by (metis (no_types, lifting) local.wf replace_in_g_split)
+qed
+
+text \<open> We now prove versions of the @{text "ctx_subtype"} lemmas above using @{text "replace_in_g"}. First we do case where
+the replace is just for a single variable (indicated by suffix rig) and then the general case for
+multiple replacements (indicated by suffix rigs)\<close>
+
+lemma ctx_subtype_subtype_rigs:
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' xcs \<Gamma>" and  "\<Theta>; \<B>; \<Gamma>' \<turnstile> t1 \<lesssim> t2"  
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> t1 \<lesssim> t2"
+  using assms proof(induct xcs arbitrary: \<Gamma> \<Gamma>'  )
+  case Nil  
+  moreover have "\<Gamma>' = \<Gamma>" using replace_in_g_subtyped_nilI 
+    using calculation(1) by blast
+  ultimately show ?case by auto
+next
+  case (Cons a xcs)
+
+  then obtain x and c where "a=(x,c)" by fastforce
+  then obtain b and c' where bc: "Some (b, c') = lookup \<Gamma>' x \<and>
+         replace_in_g_subtyped \<Theta>  \<B> (replace_in_g \<Gamma>' x c) xcs \<Gamma> \<and>   \<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f c  \<and>
+         x \<notin> fst ` set xcs \<and>  \<Theta>; \<B>; (replace_in_g \<Gamma>' x c)  \<Turnstile> c' " using replace_in_g_subtyped_elims(3)[of \<Theta> \<B> \<Gamma>' x c xcs \<Gamma>] Cons
+    by (metis valid.simps)
+
+  hence *: "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' [(x,c)] (replace_in_g \<Gamma>' x c)" using replace_in_g_subtyped_consI 
+    by (meson image_iff list.distinct(1) list.set_cases replace_in_g_subtyped_nilI)
+
+  hence "\<Theta>; \<B>; (replace_in_g \<Gamma>' x c) \<turnstile>  t1 \<lesssim> t2"
+    using  ctx_subtype_subtype_rig * assms Cons.prems(2) by auto
+
+  moreover have "replace_in_g_subtyped \<Theta> \<B> (replace_in_g \<Gamma>' x c) xcs \<Gamma>" using Cons
+    using bc by blast
+
+  ultimately show ?case using Cons by blast
+qed
+
+lemma replace_in_g_inside_valid:
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' [(x,c0)] \<Gamma>" and "wfG \<Theta> \<B> \<Gamma>'"
+  shows "\<exists>b c0' G G'. \<Gamma>' = G' @ (x,b,c0')#\<^sub>\<Gamma>G \<and>  \<Gamma> = G' @ (x,b,c0)#\<^sub>\<Gamma>G \<and> \<Theta>; \<B>; G'@ (x,b,c0)#\<^sub>\<Gamma>G  \<Turnstile> c0'"
+proof - 
+  obtain b and c0' where  bc: "Some (b, c0') = lookup \<Gamma>' x \<and> \<Theta>; \<B>; replace_in_g \<Gamma>' x c0  \<Turnstile> c0'" using 
+      replace_in_g_subtyped.simps[of  \<Theta> \<B> \<Gamma>' "[(x, c0)]" \<Gamma>] assms(1) 
+    by (metis fst_conv list.inject list.set_intros(1) list.simps(15) not_Cons_self2 old.prod.exhaust prod.inject set_ConsD surj_pair)
+  then obtain G and G' where *: "\<Gamma>' = G'@(x,b,c0')#\<^sub>\<Gamma>G \<and> \<Theta>; \<B>; G'@(x,b,c0)#\<^sub>\<Gamma>G \<Turnstile> c0'" using replace_in_g_subtyped_split[of b c0' \<Gamma>' x \<Theta> \<B> c0] assms
+    by metis
+  thus ?thesis using replace_in_g_inside bc
+    using assms(1) assms(2) by blast
+qed
+
+lemma replace_in_g_valid:
+  assumes "\<Theta>; \<B>  \<turnstile> G \<langle> xcs \<rangle> \<leadsto> G'" and  "\<Theta>; \<B>; G  \<Turnstile> c "
+  shows  \<open>\<Theta>; \<B>; G'  \<Turnstile> c \<close>
+  using assms proof(induct rule: replace_in_g_subtyped.inducts)
+  case (replace_in_g_subtyped_nilI \<Theta> \<B> G)
+  then show ?case by auto
+next
+  case (replace_in_g_subtyped_consI b c1 G x \<Theta> \<B> c2 xcs G')
+  hence "\<Theta>; \<B>; G[x\<longmapsto>c2]  \<Turnstile> c" 
+    by (metis ctx_subtype_valid replace_in_g_split replace_in_g_subtyped_split valid_g_wf)
+  then show ?case using replace_in_g_subtyped_consI by auto
+qed
+
+section \<open>Literals\<close>
+
+section \<open>Values\<close>
+
+lemma lookup_inside_unique_b[simp]:
+  assumes "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)" and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b0,c0')#\<^sub>\<Gamma>\<Gamma>)"
+    and  "Some (b, c) = lookup (\<Gamma>' @ (x, b0, c0') #\<^sub>\<Gamma> \<Gamma>) y" and  "Some (b0,c0) = lookup (\<Gamma>'@((x,b0,c0))#\<^sub>\<Gamma>\<Gamma>) x" and "x=y"
+  shows "b = b0"
+  by (metis assms(2) assms(3) assms(5) lookup_inside_wf old.prod.exhaust option.inject prod.inject)
+
+lemma ctx_subtype_v_aux:
+  fixes v::v
+  assumes  "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1" and   "\<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'" 
+  shows "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1"
+  using assms proof(nominal_induct "\<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>)" v t1 avoiding: c0    rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> b c xa z)
+  have  wf:\<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<close> using wfG_inside_valid2 infer_v_varI by metis
+  have  xf1:\<open>atom z \<sharp> xa\<close> using  infer_v_varI by metis
+  have  xf2: \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>)\<close> apply( fresh_mth add:  infer_v_varI )
+    using fresh_def infer_v_varI wfG_supp fresh_append_g fresh_GCons fresh_prodN by metis+
+  show ?case proof (cases "x=xa")
+    case True
+    moreover have "b = b0" using infer_v_varI True by simp
+    moreover hence  \<open>Some (b, c0) = lookup (\<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>) xa\<close> using   lookup_inside_wf[OF wf] infer_v_varI True by auto
+    ultimately show ?thesis using  wf xf1 xf2 Typing.infer_v_varI by metis
+  next
+    case False
+    moreover hence  \<open>Some (b, c) = lookup (\<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>) xa\<close> using   lookup_inside2 infer_v_varI by metis
+    ultimately show ?thesis using wf xf1 xf2 Typing.infer_v_varI by simp
+  qed   
+next
+  case (infer_v_litI \<Theta> \<B> l \<tau>)
+  thus ?case using Typing.infer_v_litI wfG_inside_valid2 by simp
+next
+  case (infer_v_pairI z v1 v2 \<Theta> \<B> t1' t2' c0)
+  show  ?case proof
+    show "atom z \<sharp> (v1, v2)" using infer_v_pairI fresh_Pair by simp
+    show "atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>)"  apply( fresh_mth add:  infer_v_pairI )
+      using fresh_def infer_v_pairI wfG_supp fresh_append_g fresh_GCons fresh_prodN by metis+
+    show "\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v1 \<Rightarrow> t1'" using infer_v_pairI  by simp
+    show "\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v2 \<Rightarrow> t2'" using infer_v_pairI  by simp
+  qed   
+next
+  case (infer_v_consI s dclist \<Theta> dc tc \<B> v tv z)
+  show ?case proof
+    show \<open>AF_typedef s dclist \<in> set \<Theta>\<close> using infer_v_consI by auto
+    show \<open>(dc, tc) \<in> set dclist\<close> using infer_v_consI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v \<Rightarrow> tv\<close> using infer_v_consI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> tv \<lesssim> tc\<close> using infer_v_consI ctx_subtype_subtype by auto
+    show \<open>atom z \<sharp> v\<close> using infer_v_consI by auto
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>)\<close> apply( fresh_mth add:  infer_v_consI )
+      using fresh_def infer_v_consI wfG_supp fresh_append_g fresh_GCons fresh_prodN by metis+
+  qed
+next
+  case (infer_v_conspI s bv dclist \<Theta> dc tc \<B> v tv b z)
+  show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using infer_v_conspI by auto
+    show \<open>(dc, tc) \<in> set dclist\<close>  using infer_v_conspI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v \<Rightarrow> tv\<close>  using infer_v_conspI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> tv \<lesssim> tc[bv::=b]\<^sub>\<tau>\<^sub>b\<close>  using infer_v_conspI ctx_subtype_subtype by auto
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>, v, b)\<close>  apply( fresh_mth add:  infer_v_conspI )
+      using fresh_def infer_v_conspI wfG_supp fresh_append_g fresh_GCons fresh_prodN by metis+
+    show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>, v, b)\<close> apply( fresh_mth add:  infer_v_conspI )
+      using fresh_def infer_v_conspI wfG_supp fresh_append_g fresh_GCons fresh_prodN by metis+
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close>  using infer_v_conspI by auto
+  qed
+qed
+
+lemma ctx_subtype_v:
+  fixes v::v
+  assumes  "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1" and   "\<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'" 
+  shows "\<exists>t2.  \<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t2 \<and>  \<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> t2 \<lesssim> t1"
+proof -
+
+  have "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1 " using ctx_subtype_v_aux assms by auto
+  moreover hence "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> t1 \<lesssim> t1" using subtype_reflI2 infer_v_wf by simp
+  ultimately show ?thesis by auto
+qed
+
+lemma ctx_subtype_v_eq:
+  fixes v::v
+  assumes
+    "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1" and 
+    " \<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'" 
+  shows "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1"
+proof - 
+  obtain t1' where "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t1'" using ctx_subtype_v assms by metis
+  moreover have "replace_in_g (\<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>)) x c0 =  \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)" using replace_in_g_inside infer_v_wf assms by metis
+  ultimately show ?thesis using infer_v_uniqueness_rig assms by metis
+qed
+
+lemma ctx_subtype_check_v_eq:
+  assumes  "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Leftarrow> t1" and " \<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'"
+  shows "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Leftarrow> t1"
+proof - 
+  obtain t2 where t2: "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v \<Rightarrow> t2 \<and>   \<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> t2 \<lesssim> t1" 
+    using check_v_elims assms by blast
+  hence t3: "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)  \<turnstile> v \<Rightarrow> t2"
+    using assms ctx_subtype_v_eq by blast
+
+  have "\<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)  \<turnstile> v \<Rightarrow> t2" using t3 by auto
+  moreover have " \<Theta>; \<B>; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)  \<turnstile> t2 \<lesssim> t1" proof -
+
+    have " \<Theta>; \<B>; \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>) \<turnstile> t2 \<lesssim> t1" using t2 by auto
+    thus  ?thesis using subtype_trans
+      using assms(2) ctx_subtype_subtype by blast
+  qed
+  ultimately show ?thesis using check_v.intros by presburger 
+qed
+
+text \<open> Basically the same as @{text "ctx_subtype_v_eq"} but in a different form\<close>
+lemma ctx_subtype_v_rig_eq:
+  fixes v::v
+  assumes "replace_in_g_subtyped  \<Theta> \<B> \<Gamma>' [(x,c0)] \<Gamma>" and  
+    "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Rightarrow> t1" 
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> t1"
+proof - 
+  obtain b and c0' and G and G' where "\<Gamma>' = G' @ (x,b,c0')#\<^sub>\<Gamma>G \<and>  \<Gamma> = G' @ (x,b,c0)#\<^sub>\<Gamma>G \<and>  \<Theta>; \<B>; G'@ (x,b,c0)#\<^sub>\<Gamma>G  \<Turnstile> c0'"
+    using assms replace_in_g_inside_valid  infer_v_wf by metis
+  thus ?thesis using ctx_subtype_v_eq[of \<Theta> \<B> G' x b c0' G v t1 c0] assms by simp
+qed
+
+lemma ctx_subtype_v_rigs_eq:
+  fixes v::v
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' xcs \<Gamma>" and  
+    "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Rightarrow> t1" 
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> t1"
+  using assms proof(induct xcs arbitrary: \<Gamma> \<Gamma>' t1 )
+  case Nil
+  then show ?case by auto
+next
+  case (Cons a xcs)
+  then obtain x and c where "a=(x,c)" by fastforce
+
+  then obtain b and c' where bc: "Some (b, c') = lookup \<Gamma>' x \<and>
+         replace_in_g_subtyped  \<Theta> \<B> (replace_in_g \<Gamma>' x c) xcs \<Gamma> \<and>  \<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f c \<and>
+         x \<notin> fst ` set xcs \<and>   \<Theta>; \<B>; (replace_in_g \<Gamma>' x c)  \<Turnstile> c' "   
+    using replace_in_g_subtyped_elims(3)[of  \<Theta> \<B> \<Gamma>' x c xcs \<Gamma>] Cons  by (metis valid.simps)
+
+  hence *: "replace_in_g_subtyped  \<Theta> \<B> \<Gamma>' [(x,c)] (replace_in_g \<Gamma>' x c)" using replace_in_g_subtyped_consI 
+    by (meson image_iff list.distinct(1) list.set_cases replace_in_g_subtyped_nilI)
+  hence   t2: "\<Theta>; \<B>; (replace_in_g \<Gamma>' x c) \<turnstile> v \<Rightarrow> t1 " using ctx_subtype_v_rig_eq[OF * Cons(3)] by blast
+  moreover have **: "replace_in_g_subtyped  \<Theta> \<B> (replace_in_g \<Gamma>' x c) xcs \<Gamma>" using bc by auto
+  ultimately have  t2': "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> t1" using Cons by blast
+  thus ?case by blast
+qed
+
+lemma ctx_subtype_check_v_rigs_eq:
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' xcs \<Gamma>" and  
+    "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Leftarrow> t1" 
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> t1"
+proof - 
+  obtain t2 where  "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Rightarrow> t2 \<and>  \<Theta>; \<B>; \<Gamma>' \<turnstile> t2 \<lesssim> t1" using check_v_elims assms by fast
+  hence "\<Theta>; \<B>; \<Gamma>  \<turnstile> v \<Rightarrow> t2 \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile> t2 \<lesssim> t1" using ctx_subtype_v_rigs_eq ctx_subtype_subtype_rigs 
+    using assms(1) by blast
+  thus ?thesis 
+    using check_v_subtypeI by blast
+qed
+
+section \<open>Expressions\<close>
+
+lemma valid_wfC:
+  fixes c0::c
+  assumes  "\<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'" 
+  shows "\<Theta>; \<B>; (x, b0, TRUE) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c0"
+  using  wfG_elim2 valid.simps wfG_suffix 
+  using assms valid_g_wf by metis
+
+lemma ctx_subtype_e_eq:
+  fixes G::\<Gamma>
+  assumes
+    "\<Theta> ; \<Phi> ; \<B> ; G ; \<Delta> \<turnstile> e \<Rightarrow> t1" and "G =  \<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>)"
+    "\<Theta>; \<B>; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'" 
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>) ; \<Delta> \<turnstile> e \<Rightarrow> t1"
+  using assms proof(nominal_induct t1 avoiding: c0 rule: infer_e.strong_induct)
+  case (infer_e_valI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v \<tau>)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_valI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_valI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v \<Rightarrow> \<tau>\<close> using infer_e_valI ctx_subtype_v_eq by auto
+  qed
+next
+  case (infer_e_plusI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_plusI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using infer_e_plusI by auto
+    show *:\<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_int  | c1 \<rbrace>\<close> using infer_e_plusI ctx_subtype_v_eq by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_int  | c2 \<rbrace>\<close> using infer_e_plusI ctx_subtype_v_eq by auto
+    show \<open>atom z3 \<sharp> AE_op Plus v1 v2\<close> using infer_e_plusI by auto
+    show   \<open>atom z3 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using * infer_e_plusI fresh_replace_inside  infer_v_wf  by metis
+  qed
+next
+  case (infer_e_leqI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_leqI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using infer_e_leqI by auto
+    show *:\<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_int  | c1 \<rbrace>\<close> using infer_e_leqI ctx_subtype_v_eq by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_int  | c2 \<rbrace>\<close> using infer_e_leqI ctx_subtype_v_eq by auto
+    show \<open>atom z3 \<sharp> AE_op LEq v1 v2\<close> using infer_e_leqI by auto
+    show   \<open>atom z3 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using * infer_e_leqI fresh_replace_inside  infer_v_wf  by metis
+  qed
+next
+  case (infer_e_eqI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 bb c1 v2 z2 c2 z3)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_eqI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using infer_e_eqI by auto
+    show *:\<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : bb  | c1 \<rbrace>\<close> using infer_e_eqI ctx_subtype_v_eq by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : bb  | c2 \<rbrace>\<close> using infer_e_eqI ctx_subtype_v_eq by auto
+    show \<open>atom z3 \<sharp> AE_op Eq v1 v2\<close> using infer_e_eqI by auto
+    show   \<open>atom z3 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using * infer_e_eqI fresh_replace_inside  infer_v_wf  by metis
+    show "bb \<in> {B_bool, B_int, B_unit}" using infer_e_eqI by auto
+  qed
+next
+  case (infer_e_appI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> f x' b c \<tau>' s' v \<tau>)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_appI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_appI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x' b c \<tau>' s'))) = lookup_fun \<Phi> f\<close>  using infer_e_appI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v \<Leftarrow> \<lbrace> x' : b  | c \<rbrace>\<close> using infer_e_appI ctx_subtype_check_v_eq by auto
+    thus \<open>atom x' \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, v, \<tau>)\<close> 
+      using infer_e_appI fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 x']  infer_v_wf by auto
+    show \<open>\<tau>'[x'::=v]\<^sub>v = \<tau>\<close> using infer_e_appI by auto
+  qed
+next
+  case (infer_e_appPI \<Theta> \<B> \<Gamma>1 \<Delta> \<Phi> b' f bv x1 b c \<tau>' s' v \<tau>)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_appPI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_appPI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using infer_e_appPI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x1 b c \<tau>' s'))) = lookup_fun \<Phi> f\<close> using infer_e_appPI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v \<Leftarrow> \<lbrace> x1 : b[bv::=b']\<^sub>b  | c[bv::=b']\<^sub>b \<rbrace>\<close> using infer_e_appPI  ctx_subtype_check_v_eq subst_defs by auto
+    thus  \<open>atom x1 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using  fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma>  c0 x1 ] infer_v_wf infer_e_appPI by auto
+    show \<open>\<tau>'[bv::=b']\<^sub>b[x1::=v]\<^sub>v = \<tau>\<close> using infer_e_appPI by auto
+    have "atom bv \<sharp> \<Gamma>' @ (x, b0, c0') #\<^sub>\<Gamma> \<Gamma>" using infer_e_appPI by metis
+    hence "atom bv \<sharp>  \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>" 
+      unfolding fresh_append_g fresh_GCons fresh_prod3 using  \<open>atom bv \<sharp> c0 \<close> fresh_append_g by metis
+    thus  \<open>atom bv \<sharp>  (\<Theta>, \<Phi>, \<B>, \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, b', v, \<tau>)\<close> using infer_e_appPI by auto
+  qed
+next
+  case (infer_e_fstI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v z' b1 b2 c z)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_fstI by auto
+    show \<open> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_fstI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v \<Rightarrow> \<lbrace> z' : B_pair b1 b2  | c \<rbrace>\<close> using infer_e_fstI ctx_subtype_v_eq by auto
+    thus \<open>atom z \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using infer_e_fstI fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 z]  infer_v_wf by auto
+    show \<open>atom z \<sharp> AE_fst v\<close> using infer_e_fstI by auto
+  qed
+next
+  case (infer_e_sndI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v z' b1 b2 c z)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_sndI by auto
+    show \<open> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_sndI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v \<Rightarrow> \<lbrace> z' : B_pair b1 b2  | c \<rbrace>\<close> using infer_e_sndI ctx_subtype_v_eq by auto
+    thus \<open>atom z \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using infer_e_sndI fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 z]  infer_v_wf by auto
+    show \<open>atom z \<sharp> AE_snd v\<close> using infer_e_sndI by auto
+  qed
+next
+  case (infer_e_lenI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v z' c z)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_lenI by auto
+    show \<open> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_lenI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v \<Rightarrow> \<lbrace> z' : B_bitvec  | c \<rbrace>\<close> using infer_e_lenI ctx_subtype_v_eq by auto
+    thus \<open>atom z \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using infer_e_lenI fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 z]  infer_v_wf by auto
+    show \<open>atom z \<sharp> AE_len v\<close> using infer_e_lenI by auto
+  qed
+next
+  case (infer_e_mvarI \<Theta> \<B> \<Gamma>'' \<Phi> \<Delta> u \<tau>)
+  show ?case proof 
+    show "\<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>"   using wf_replace_inside2(6) valid_wfC infer_e_mvarI by auto
+    thus "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>" using infer_e_mvarI fresh_replace_inside  wfD_wf   by blast 
+    show "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> "  using infer_e_mvarI by auto
+    show "(u, \<tau>) \<in> setD \<Delta>" using infer_e_mvarI by auto
+  qed
+next
+  case (infer_e_concatI \<Theta>  \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  show ?case proof 
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_concatI by auto
+    thus  \<open>atom z3 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using infer_e_concatI fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 z3]  infer_v_wf wfX_wfY by metis
+    show \<open> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_concatI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1 \<rbrace>\<close> using infer_e_concatI ctx_subtype_v_eq by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_bitvec  | c2 \<rbrace>\<close> using infer_e_concatI ctx_subtype_v_eq by auto
+    show \<open>atom z3 \<sharp> AE_concat v1 v2\<close> using infer_e_concatI by auto  
+  qed
+next
+  case (infer_e_splitI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  show ?case proof
+    show *:\<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_inside2(6) valid_wfC infer_e_splitI by auto  
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_splitI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1 \<rbrace>\<close> using infer_e_splitI  ctx_subtype_v_eq by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>' @
+                 (x, b0, c0) #\<^sub>\<Gamma>
+                 \<Gamma>  \<turnstile> v2 \<Leftarrow> \<lbrace> z2 : B_int  | [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e AND
+                                 [ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1 ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>\<close> 
+      using infer_e_splitI  ctx_subtype_check_v_eq by auto
+
+    show  \<open>atom z1 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using  fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 z1] infer_e_splitI  infer_v_wf wfX_wfY * by metis
+    show  \<open>atom z2 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using  fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 ] infer_e_splitI  infer_v_wf wfX_wfY * by metis
+    show  \<open>atom z3 \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma>\<close> using  fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b0 c0' \<Gamma> c0 ] infer_e_splitI  infer_v_wf wfX_wfY * by metis
+    show \<open>atom z1 \<sharp> AE_split v1 v2\<close> using infer_e_splitI by auto
+    show \<open>atom z2 \<sharp> AE_split v1 v2\<close> using infer_e_splitI by auto
+    show \<open>atom z3 \<sharp> AE_split v1 v2\<close> using infer_e_splitI by auto
+  qed
+qed
+
+lemma ctx_subtype_e_rig_eq:
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' [(x,c0)] \<Gamma>" and  
+    "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>' ; \<Delta> \<turnstile> e \<Rightarrow> t1" 
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> t1"
+proof - 
+  obtain b and c0' and G and G' where "\<Gamma>' = G' @ (x,b,c0')#\<^sub>\<Gamma>G \<and>  \<Gamma> = G' @ (x,b,c0)#\<^sub>\<Gamma>G \<and>  \<Theta>; \<B>; G'@ (x,b,c0)#\<^sub>\<Gamma>G  \<Turnstile> c0'"
+    using assms replace_in_g_inside_valid infer_e_wf by meson
+  thus  ?thesis 
+    using assms ctx_subtype_e_eq by presburger
+qed
+
+lemma ctx_subtype_e_rigs_eq:
+  assumes "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' xcs \<Gamma>" and  
+    "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'; \<Delta> \<turnstile> e \<Rightarrow> t1" 
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> t1"
+  using assms proof(induct xcs arbitrary: \<Gamma> \<Gamma>' t1 )
+  case Nil
+  moreover have "\<Gamma>' = \<Gamma>" using replace_in_g_subtyped_nilI 
+    using calculation(1) by blast
+  moreover have "\<Theta>;\<B>;\<Gamma> \<turnstile> t1 \<lesssim> t1" using subtype_reflI2 Nil infer_e_t_wf by blast
+  ultimately show ?case by blast
+next
+  case (Cons a xcs)
+
+  then obtain x and c where "a=(x,c)" by fastforce
+  then obtain b and c' where bc: "Some (b, c') = lookup \<Gamma>' x \<and>
+         replace_in_g_subtyped \<Theta> \<B> (replace_in_g \<Gamma>' x c) xcs \<Gamma> \<and> \<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f c \<and>
+         x \<notin> fst ` set xcs \<and>   \<Theta>; \<B>; (replace_in_g \<Gamma>' x c)  \<Turnstile> c' " using replace_in_g_subtyped_elims(3)[of  \<Theta> \<B> \<Gamma>' x c xcs \<Gamma>] Cons
+    by (metis valid.simps)
+
+  hence *: "replace_in_g_subtyped \<Theta> \<B> \<Gamma>' [(x,c)] (replace_in_g \<Gamma>' x c)" using replace_in_g_subtyped_consI 
+    by (meson image_iff list.distinct(1) list.set_cases replace_in_g_subtyped_nilI)
+  hence   t2: "\<Theta> ; \<Phi> ; \<B> ; (replace_in_g \<Gamma>' x c) ; \<Delta> \<turnstile> e \<Rightarrow> t1 " using ctx_subtype_e_rig_eq[OF * Cons(3)] by blast
+  moreover have **: "replace_in_g_subtyped  \<Theta> \<B> (replace_in_g \<Gamma>' x c) xcs \<Gamma>" using bc by auto
+  ultimately have  t2': "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> t1" using Cons by blast
+  thus  ?case  by blast
+qed
+
+section \<open>Statements\<close>
+
+lemma ctx_subtype_s_rigs:
+  fixes c0::c and s::s and G'::\<Gamma> and xcs :: "(x*c) list" and css::branch_list
+  shows
+    "check_s \<Theta> \<Phi> \<B> G \<Delta>  s  t1 \<Longrightarrow> wsX G xcs  \<Longrightarrow> replace_in_g_subtyped \<Theta> \<B> G xcs G'  \<Longrightarrow> check_s \<Theta> \<Phi> \<B> G' \<Delta>  s  t1" and 
+    "check_branch_s \<Theta> \<Phi> \<B> G \<Delta> tid cons const v cs  t1 \<Longrightarrow>  wsX G xcs  \<Longrightarrow> replace_in_g_subtyped  \<Theta> \<B> G xcs G'  \<Longrightarrow> check_branch_s \<Theta> \<Phi> \<B> G' \<Delta> tid cons const v cs t1"
+    "check_branch_list \<Theta> \<Phi> \<B> G \<Delta> tid dclist v css  t1 \<Longrightarrow>  wsX G xcs  \<Longrightarrow> replace_in_g_subtyped  \<Theta> \<B> G xcs G'  \<Longrightarrow> check_branch_list \<Theta> \<Phi> \<B> G' \<Delta> tid dclist v css t1"
+proof(induction   arbitrary:  xcs G' and xcs G' and xcs G' rule: check_s_check_branch_s_check_branch_list.inducts)
+  case (check_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v \<tau>' \<tau>)
+  hence *:"\<Theta>; \<B>; G'  \<turnstile> v \<Rightarrow> \<tau>' \<and>  \<Theta>; \<B>; G'  \<turnstile> \<tau>' \<lesssim> \<tau>" using ctx_subtype_v_rigs_eq ctx_subtype_subtype_rigs 
+    by (meson check_v.simps)
+  show ?case proof
+    show \<open>\<Theta>; \<B>; G' \<turnstile>\<^sub>w\<^sub>f \<Delta>\<close> using check_valI wfD_rig by auto
+    show \<open>\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_valI by auto
+    show \<open>\<Theta>; \<B>; G'  \<turnstile> v \<Rightarrow> \<tau>'\<close> using * by auto
+    show \<open>\<Theta>; \<B>; G'  \<turnstile> \<tau>' \<lesssim> \<tau>\<close> using * by auto
+  qed
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z' s b' c')
+
+  show ?case proof
+    have wfG: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G'" using infer_e_wf check_letI replace_in_g_wfG   using infer_e_wf(2) by (auto simp add: freshers)
+    hence "atom x \<sharp> G'" using check_letI replace_in_g_fresh replace_in_g_wfG  by auto
+    thus  "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, G', \<Delta>, e, \<tau>)" using check_letI by auto
+    have "atom z' \<sharp> G'" apply(rule replace_in_g_fresh[OF check_letI(7)]) 
+      using replace_in_g_wfG check_letI fresh_prodN infer_e_wf by metis+
+    thus "atom z' \<sharp> (x, \<Theta>, \<Phi>, \<B>, G', \<Delta>, e, \<tau>, s)" using check_letI fresh_prodN by metis
+
+    show "\<Theta> ; \<Phi> ; \<B> ; G' ; \<Delta>  \<turnstile> e \<Rightarrow> \<lbrace> z' : b'  | c' \<rbrace>" 
+      using check_letI ctx_subtype_e_rigs_eq by blast 
+    show "\<Theta> ; \<Phi> ; \<B> ; (x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> G' ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" 
+    proof(rule  check_letI(5))
+      have vld: "\<Theta>;\<B>;((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile>  c'[z'::=V_var x]\<^sub>c\<^sub>v" proof -
+        have "wfG \<Theta> \<B> ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" using check_letI check_s_wf  by metis
+        hence "wfC \<Theta> \<B> ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) (c'[z'::=V_var x]\<^sub>c\<^sub>v)" using wfC_refl subst_defs by auto
+        thus ?thesis using  valid_reflI[of  \<Theta> \<B> x b' "c'[z'::=V_var x]\<^sub>v" \<Gamma> " c'[z'::=V_var x]\<^sub>v"] subst_defs by auto
+      qed
+      have xf: "x \<notin> fst ` set xcs" proof -
+        have  "atom ` fst ` set xcs \<subseteq> atom_dom \<Gamma>" using check_letI wsX_iff by meson 
+        moreover have "wfG \<Theta> \<B> \<Gamma>" using infer_e_wf check_letI by metis
+        ultimately show ?thesis using fresh_def  check_letI  wfG_dom_supp 
+          using wsX_fresh by auto
+      qed
+      show "replace_in_g_subtyped \<Theta> \<B> ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) ((x, c'[z'::=V_var x]\<^sub>v) # xcs) ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> G')" proof -
+
+        have "Some (b', c'[z'::=V_var x]\<^sub>v) =  lookup ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x" by auto
+
+        moreover have "\<Theta>; \<B>; replace_in_g ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x  (c'[z'::=V_var x]\<^sub>v) \<Turnstile>  c'[z'::=V_var x]\<^sub>v" proof -
+          have "replace_in_g ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x  (c'[z'::=V_var x]\<^sub>v) = ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" 
+            using replace_in_g.simps by presburger
+          thus ?thesis  using vld subst_defs by auto
+        qed
+
+        moreover have " replace_in_g_subtyped \<Theta> \<B> (replace_in_g ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x (c'[z'::=V_var x]\<^sub>v)) xcs ( ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> G'))" proof -
+          have "wfG \<Theta> \<B> ( ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>))"  using check_letI check_s_wf  by metis
+          hence "replace_in_g_subtyped \<Theta> \<B> ( ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)) xcs ( ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> G'))" 
+            using check_letI replace_in_g_subtyped_cons xf by meson
+          moreover have "replace_in_g ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x (c'[z'::=V_var x]\<^sub>v) = ( ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>))"
+            using replace_in_g.simps by presburger
+          ultimately show ?thesis by argo
+        qed      
+        moreover  have "\<Theta>; \<B>; (x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c'[z'::=V_var x]\<^sub>v " using vld subst_defs by auto
+        ultimately show ?thesis using  replace_in_g_subtyped_consI xf replace_in_g.simps(2) by metis
+      qed
+
+      show " wsX ((x, b', c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) ((x, c'[z'::=V_var x]\<^sub>v) # xcs)" 
+        using check_letI xf subst_defs  by (simp add: wsX_cons)  
+    qed
+  qed
+
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> css)
+  then show ?case using Typing.check_branch_list_consI by auto
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
+  then show ?case using Typing.check_branch_list_finalI by auto
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
+
+  have wfcons: "wfG \<Theta> \<B> ((x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x))  AND c_of const x) #\<^sub>\<Gamma> \<Gamma>)" using check_s_wf check_branch_s_branchI
+    by meson
+  hence wf: "wfG \<Theta> \<B> \<Gamma>" using  wfG_cons by metis
+
+  moreover have "atom x \<sharp> (const, G',v)"  proof -
+    have "atom x \<sharp> G'"  using check_branch_s_branchI wf replace_in_g_fresh 
+        wfG_dom_supp replace_in_g_wfG by simp
+    thus ?thesis using check_branch_s_branchI fresh_prodN by simp
+  qed
+
+  moreover have st: "\<Theta> ; \<Phi> ; \<B> ; (x, b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x))  AND  c_of const x) #\<^sub>\<Gamma> G' ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau> " proof -
+    have " wsX ((x, b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x))   AND c_of const x) #\<^sub>\<Gamma> \<Gamma>) xcs" using check_branch_s_branchI wsX_cons2 wsX_fresh wf by force
+    moreover have "replace_in_g_subtyped \<Theta> \<B> ((x,  b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x))   AND  c_of const x) #\<^sub>\<Gamma> \<Gamma>) xcs ((x,  b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x)) AND  c_of const x) #\<^sub>\<Gamma> G' )" 
+      using replace_in_g_subtyped_cons wsX_fresh wf check_branch_s_branchI wfcons by auto
+    thus ?thesis using check_branch_s_branchI  calculation by meson
+  qed
+  moreover have wft: " wfT \<Theta> \<B> G' \<tau> " using
+      check_branch_s_branchI ctx_subtype_subtype_rigs subtype_reflI2 subtype_wf by metis
+  moreover have "wfD \<Theta> \<B> G' \<Delta>" using check_branch_s_branchI wfD_rig by presburger
+  ultimately show ?case using 
+      Typing.check_branch_s_branchI 
+    using check_branch_s_branchI.hyps by simp
+
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  hence wf:"wfG \<Theta> \<B> \<Gamma>" using check_s_wf by presburger
+  show ?case proof(rule check_s_check_branch_s_check_branch_list.check_ifI)
+    show \<open>atom z \<sharp> (\<Theta>, \<Phi>, \<B>, G', \<Delta>, v, s1, s2, \<tau>)\<close> using fresh_prodN replace_in_g_fresh1 wf check_ifI by auto
+    show \<open>\<Theta>; \<B>; G'  \<turnstile> v \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>\<close> using ctx_subtype_check_v_rigs_eq check_ifI by presburger
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; G' ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_true)   IMP  c_of \<tau> z  \<rbrace>\<close> using  check_ifI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; G' ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_false)   IMP  c_of \<tau> z  \<rbrace>\<close> using  check_ifI by auto
+  qed
+next
+
+  case (check_let2I x P \<Phi> \<B> G \<Delta> t s1 \<tau> s2 )
+  show ?case proof
+    have "wfG P \<B> G" using check_let2I check_s_wf by metis
+    show  *: "P ; \<Phi> ; \<B> ; G' ; \<Delta>  \<turnstile> s1 \<Leftarrow>t" using check_let2I by blast
+    show  "atom x \<sharp> (P, \<Phi>, \<B>, G', \<Delta>, t, s1, \<tau>)" proof -
+      have "wfG P \<B> G'" using check_s_wf * by blast
+      hence "atom_dom G = atom_dom G'" using check_let2I rigs_atom_dom_eq by presburger
+      moreover have "atom x \<sharp> G" using check_let2I by auto
+      moreover have "wfG P \<B> G" using check_s_wf *  replace_in_g_wfG  check_let2I by simp
+      ultimately have "atom x \<sharp> G'" using wfG_dom_supp fresh_def \<open>wfG P \<B> G'\<close> by metis
+      thus ?thesis using check_let2I by auto
+    qed
+    show "P ; \<Phi> ; \<B> ;(x, b_of t, c_of t x) #\<^sub>\<Gamma> G' ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau> " proof - 
+      have "wsX ((x, b_of t, c_of t x) #\<^sub>\<Gamma> G) xcs" using check_let2I wsX_cons2  wsX_fresh \<open>wfG P \<B> G\<close> by simp
+      moreover have "replace_in_g_subtyped P \<B> ((x,  b_of t, c_of t x) #\<^sub>\<Gamma> G) xcs ((x,  b_of t, c_of t x) #\<^sub>\<Gamma> G')" proof(rule  replace_in_g_subtyped_cons )
+        show "replace_in_g_subtyped P \<B> G xcs G'" using check_let2I by auto
+        have "atom x \<sharp> G" using check_let2I by auto
+        moreover have "wfT P \<B> G t" using check_let2I check_s_wf by metis
+
+        moreover have "atom x \<sharp> t" using check_let2I check_s_wf wfT_supp by auto
+        ultimately show "wfG P \<B> ((x,  b_of t, c_of t x) #\<^sub>\<Gamma> G)" using wfT_wf_cons b_of_c_of_eq[of x t] by auto
+        show "x \<notin> fst ` set xcs" using check_let2I wsX_fresh \<open>wfG P \<B> G\<close> by simp
+      qed
+      ultimately show ?thesis using check_let2I by presburger
+    qed  
+  qed
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  show ?case proof
+    have "atom u \<sharp> G'" unfolding fresh_def
+      apply(rule  u_not_in_g , rule replace_in_g_wfG)
+      using check_v_wf check_varI by simp+
+    thus  \<open>atom u \<sharp> (\<Theta>, \<Phi>, \<B>, G', \<Delta>, \<tau>', v, \<tau>)\<close> unfolding fresh_prodN using check_varI by simp
+    show \<open>\<Theta>; \<B>; G'  \<turnstile> v \<Leftarrow> \<tau>'\<close> using ctx_subtype_check_v_rigs_eq check_varI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; G' ; (u, \<tau>') #\<^sub>\<Delta> \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> using  check_varI by auto
+  qed
+next
+  case (check_assignI P \<Phi> \<B> G \<Delta> u \<tau> v z \<tau>')
+  show ?case proof
+    show \<open>P  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  check_assignI by auto
+    show \<open>P ; \<B> ; G'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using  check_assignI wfD_rig by auto
+    show \<open>(u, \<tau>) \<in> setD \<Delta>\<close>  using  check_assignI by auto
+    show \<open>P ; \<B> ; G'  \<turnstile> v \<Leftarrow> \<tau>\<close> using ctx_subtype_check_v_rigs_eq check_assignI by auto
+    show \<open>P ; \<B> ; G'  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'\<close>  using ctx_subtype_subtype_rigs check_assignI by auto
+  qed
+next
+  case (check_whileI \<Delta> G P s1 z s2 \<tau>')
+  then show ?case using Typing.check_whileI
+    by (meson ctx_subtype_subtype_rigs)
+next
+  case (check_seqI \<Delta> G P s1 z s2 \<tau>)
+  then show ?case 
+    using check_s_check_branch_s_check_branch_list.check_seqI by blast
+next
+  case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> z)
+  show ?case proof
+    show " \<Theta> ;  \<Phi> ; \<B> ; G' ; \<Delta> ; tid ; dclist ; v \<turnstile> cs \<Leftarrow> \<tau>" using check_caseI ctx_subtype_check_v_rigs_eq by auto
+    show "AF_typedef tid dclist \<in> set  \<Theta>" using check_caseI by auto
+    show "\<Theta>; \<B>; G'  \<turnstile> v \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>" using check_caseI ctx_subtype_check_v_rigs_eq by auto
+    show "\<turnstile>\<^sub>w\<^sub>f \<Theta> " using check_caseI by auto
+  qed
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  show ?case proof
+    have wfG: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G'" using check_s_wf check_assertI replace_in_g_wfG wfX_wfY by metis
+    hence "atom x \<sharp> G'" using check_assertI replace_in_g_fresh replace_in_g_wfG  by auto
+    thus  \<open>atom x \<sharp> (\<Theta>, \<Phi>, \<B>, G', \<Delta>, c, \<tau>, s)\<close> using check_assertI fresh_prodN by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> G' ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> proof(rule check_assertI(5) )
+      show "wsX ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) xcs" using check_assertI wsX_cons3   by simp
+      show "\<Theta>; \<B>  \<turnstile> (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<langle> xcs \<rangle> \<leadsto> (x, B_bool, c) #\<^sub>\<Gamma> G'" proof(rule  replace_in_g_subtyped_cons)
+        show \<open> \<Theta>; \<B>  \<turnstile> \<Gamma> \<langle> xcs \<rangle> \<leadsto> G'\<close> using check_assertI by auto
+        show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<close> using check_assertI check_s_wf by metis
+        thus \<open>x \<notin> fst ` set xcs\<close> using check_assertI wsX_fresh wfG_elims wfX_wfY by metis
+      qed
+    qed
+    show \<open>\<Theta>; \<B>; G'  \<Turnstile> c \<close> using check_assertI replace_in_g_valid by auto
+    show \<open> \<Theta>; \<B>; G' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_assertI wfD_rig by auto
+  qed
+qed
+
+lemma replace_in_g_subtyped_empty:
+  assumes "wfG \<Theta> \<B> (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" 
+  shows  "replace_in_g_subtyped \<Theta> \<B> (replace_in_g (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x (c'[z'::=V_var x]\<^sub>c\<^sub>v)) [] (\<Gamma>' @ (x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)"
+proof -
+  have "replace_in_g (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x (c'[z'::=V_var x]\<^sub>c\<^sub>v) = (\<Gamma>' @ (x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" 
+    using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+    case GNil
+    then show ?case using replace_in_g.simps by auto
+  next
+    case (GCons x1 b1 c1 \<Gamma>1)
+    have "x \<notin> fst ` toSet ((x1,b1,c1)#\<^sub>\<Gamma>\<Gamma>1)"  using GCons wfG_inside_fresh atom_dom.simps dom.simps toSet.simps append_g.simps by fast
+    hence "x1 \<noteq> x" using assms wfG_inside_fresh GCons by force
+    hence "((x1,b1,c1) #\<^sub>\<Gamma> (\<Gamma>1 @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>))[x\<longmapsto>c'[z'::=V_var x]\<^sub>c\<^sub>v] = (x1,b1,c1) #\<^sub>\<Gamma> (\<Gamma>1 @ (x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)"
+      using replace_in_g.simps GCons wfG_elims append_g.simps by metis
+    thus ?case using append_g.simps by simp
+  qed
+  thus ?thesis using replace_in_g_subtyped_nilI by presburger
+qed
+
+lemma ctx_subtype_s:
+  fixes  s::s
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'@((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>" and 
+    "\<Theta>; \<B>; \<Gamma> \<turnstile> \<lbrace> z' : b | c' \<rbrace> \<lesssim> \<lbrace> z : b | c \<rbrace>" and 
+    "atom x \<sharp> (z,z',c,c')"
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'@(x,b,c'[z'::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>"
+proof - 
+
+  have wf: "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>))" using check_s_wf assms by meson
+  hence *:"x \<notin> fst ` toSet \<Gamma>'" using wfG_inside_fresh by force
+  have "wfG \<Theta> \<B> ((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)" using wf wfG_suffix by metis
+  hence xfg: "atom x \<sharp> \<Gamma>" using wfG_elims by metis
+  have "x \<noteq> z'"  using assms fresh_at_base fresh_prod4 by metis
+  hence  a2: "atom x \<sharp> c'" using assms fresh_prod4 by metis
+
+  have "atom x \<sharp> (z', c', z, c, \<Gamma>)" proof -       
+    have "x \<noteq> z" using assms  using assms fresh_at_base fresh_prod4 by metis
+    hence  a1 : "atom x \<sharp> c" using assms subtype_wf   subtype_wf assms wfT_fresh_c xfg by meson
+    thus ?thesis using a1 a2 \<open>atom x \<sharp> (z,z',c,c')\<close> fresh_prod4 fresh_Pair xfg by simp
+  qed
+  hence wc1:" \<Theta>; \<B>; (x, b, c'[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=V_var x]\<^sub>v"
+    using  subtype_valid assms fresh_prodN by metis  
+
+  have vld: "\<Theta>;\<B> ; (\<Gamma>'@(x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile> c[z::=V_var x]\<^sub>c\<^sub>v" proof - 
+
+    have "toSet ((x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet (\<Gamma>'@(x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" by auto
+    moreover have "wfG \<Theta> \<B> (\<Gamma>'@(x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" proof -
+      have *:"wfT \<Theta> \<B> \<Gamma> (\<lbrace> z' : b | c' \<rbrace>)" using subtype_wf assms by meson
+      moreover have "atom x \<sharp> (c',\<Gamma>)" using xfg a2 by simp
+      ultimately have "wfG \<Theta> \<B> ((x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" using wfT_wf_cons_flip  freshers by blast
+      thus ?thesis using wfG_replace_inside2 check_s_wf assms  by metis
+    qed
+    ultimately show ?thesis using wc1 valid_weakening subst_defs by metis
+  qed
+  hence  wbc: "\<Theta>; \<B>; \<Gamma>' @ (x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var x]\<^sub>c\<^sub>v" using valid.simps by auto
+  have wbc1: "\<Theta>; \<B>; (x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var x]\<^sub>c\<^sub>v" using wc1 valid.simps subst_defs by auto
+  have "wsX  (\<Gamma>'@((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)) [(x, c'[z'::=V_var x]\<^sub>c\<^sub>v)]" proof 
+    show "wsX (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) []" using wsX_NilI by auto
+    show "atom x \<in> atom_dom (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" by simp
+    show "x \<notin> fst ` set []" by auto
+  qed
+  moreover have "replace_in_g_subtyped \<Theta> \<B> (\<Gamma>'@((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)) [(x, c'[z'::=V_var x]\<^sub>c\<^sub>v)] (\<Gamma>'@(x,b,c'[z'::=V_var x]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)" proof
+    show "Some (b, c[z::=V_var x]\<^sub>c\<^sub>v) = lookup (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x" using lookup_inside* by auto
+    show "\<Theta>; \<B>; replace_in_g (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x (c'[z'::=V_var x]\<^sub>c\<^sub>v)  \<Turnstile> c[z::=V_var x]\<^sub>c\<^sub>v"  using vld replace_in_g_split wf by metis
+    show "replace_in_g_subtyped \<Theta> \<B> (replace_in_g (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) x (c'[z'::=V_var x]\<^sub>c\<^sub>v)) [] (\<Gamma>' @ (x, b, c'[z'::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" 
+      using replace_in_g_subtyped_empty wf by presburger
+    show "x \<notin> fst ` set []" by auto
+    show "\<Theta>; \<B>; \<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c'[z'::=V_var x]\<^sub>c\<^sub>v" 
+    proof(rule wf_weakening)
+      show \<open>\<Theta>; \<B>; (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c'[z'::=[ x ]\<^sup>v]\<^sub>c\<^sub>v \<close>   using wfC_cons_switch[OF wbc1] wf_weakening(6) check_s_wf assms toSet.simps  by metis 
+      show \<open>\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<close>   using wfC_cons_switch[OF wbc1] wf_weakening(6) check_s_wf assms toSet.simps  by metis
+      show \<open>toSet ((x, b, c[z::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet (\<Gamma>' @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)\<close> using append_g.simps toSet.simps by auto
+    qed    
+  qed
+  ultimately show ?thesis using ctx_subtype_s_rigs(1)[OF assms(1)] by presburger 
+qed
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/Examples.thy b/thys/MiniSail/Examples.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Examples.thy
@@ -0,0 +1,162 @@
+(*<*)
+theory Examples
+imports SubstMethods  fuzzyrule.fuzzyrule
+begin
+(*>*)
+
+subsection \<open>Examples from thesis\<close>
+
+text \<open>
+let x = false in 
+let y = 0b11 in 
+let z = 42 in 
+let w = (true,(z,y)) in ()
+\<close>
+
+method fresh_mth_aux uses add = (
+       (match conclusion in  "atom z \<sharp> GNil" for z   \<Rightarrow> \<open> simp add: fresh_GNil[of "atom z"] add\<close>)
+     |  (match conclusion in  "atom z \<sharp> DNil" for z   \<Rightarrow> \<open> simp add: fresh_DNil[of "atom z" ] add\<close>)
+     |  (match conclusion in  "atom z \<sharp> Nil" for z   \<Rightarrow> \<open> simp add: fresh_Nil[of "atom z" ] add\<close>)
+     |  (match conclusion in  "atom z \<sharp> {||}" for z   \<Rightarrow> \<open> simp add: fresh_empty_fset[of "atom z" ] add\<close>)
+     |  (match conclusion in  "atom (z::x) \<sharp> ((x::x,b::b,c::c)#\<^sub>\<Gamma>G)" for z x b c G   \<Rightarrow> \<open>simp add: fresh_GCons[of "atom z" "(x,b,c)" G] add\<close>)
+     |  (match conclusion in  "atom z \<sharp> (b::b)" for z b  \<Rightarrow> \<open> simp add: b.fresh[of "atom z" ] add\<close>)
+     |  (match conclusion in  "atom z \<sharp> (c::c)" for z c  \<Rightarrow> \<open> simp add: c.fresh[of "atom z" ] add\<close>)
+     |  (match conclusion in  "atom z \<sharp> (i::int)" for z i  \<Rightarrow> \<open> simp add: pure_fresh add\<close>)
+(* tbc delta and types
+     | (auto simp add: add x_fresh_b pure_fresh) (* Cases where there is no subst and so can most likely get what we want from induction premises *)*)
+)
+
+method fresh_mth_basic uses add = (
+     (unfold fresh_prodN, intro conjI)?,
+     (fresh_mth_aux add: add)+)
+
+method wf_ctx uses add = (
+  (rule wfPhi_emptyI | rule wfTh_emptyI| rule wfD_emptyI| rule wfG_nilI | rule wfG_cons2I )+
+)
+
+method wfb uses add = (
+  (rule wfB_boolI | rule wfB_intI | rule wfB_unitI | rule wfB_pairI  )+
+)
+
+method wfc uses add =  (
+  (rule wfC_trueI | rule wfC_falseI | rule wfC_notI | rule wfC_eqI  )+
+)
+
+method wfv uses add =  (
+  (rule wfV_varI | fuzzy_rule wfV_litI | rule wfV_pairI )+
+)
+
+method wfce uses add =  (
+  (rule wfCE_valI | rule wfCE_fstI | rule wfCE_sndI | rule wfCE_eqI )+
+)
+
+method wfe uses add =  (
+  (rule wfE_valI | rule wfE_fstI | rule wfE_sndI )+
+)
+
+method wfs uses add =  (
+  (rule wfS_letI | rule wfS_valI )+
+)
+
+method wf_all uses add = (
+  (wfb | wfv | wfc | wfce | wfe | wfs | auto simp add: add | wf_ctx | fresh_mth_basic add: add )+
+)
+
+method wf_all2 uses add = (
+  (wfb | wfv | wfc | wfce | wfe | wfs | wf_ctx )+
+)
+
+method wf_let uses add = (
+  (rule wfS_letI, rule wfE_valI, wf_ctx add: add ),
+  (rule wfV_litI,rule wfG_nilI, rule wfTh_emptyI))
+
+(*
+rule wfS_letI, rule wfE_valI, rule wfPhi_emptyI , rule wfTh_emptyI, rule wfD_emptyI, rule wfG_nilI, rule wfTh_emptyI),
+  (rule wfV_litI,rule wfG_nilI, rule wfTh_emptyI)
+*)
+
+lemma 
+  shows "[] ; [] ; {||} ; GNil ; []\<^sub>\<Delta> \<turnstile>\<^sub>w\<^sub>f LET x = [ [ L_false ]\<^sup>v ]\<^sup>e  IN  [[ L_unit ]\<^sup>v]\<^sup>s : B_unit"
+  apply wf_let
+  apply(rule wfS_valI,wf_ctx)
+  by(fuzzy_rule wfV_litI,  wf_all)
+
+lemma 
+  assumes " atom z \<sharp> x"
+  shows   "[] ; [] ; {||} ; GNil ; []\<^sub>\<Delta> \<turnstile>\<^sub>w\<^sub>f LET x = [ [ L_false ]\<^sup>v ]\<^sup>e IN 
+                                   LET z = [ [ L_num 42]\<^sup>v ]\<^sup>e IN  [[ L_unit ]\<^sup>v]\<^sup>s : B_unit"
+
+
+  apply wf_let
+  apply(rule wfS_letI)
+
+  apply(rule wfE_valI, wf_ctx,auto,wf_ctx)
+  by(wf_all add: assms)
+ 
+
+text \<open>
+val not_bool : (x : bool [ T ]) -> { z : bool | ~ (z = x) }
+function not_bool(x) = if x then F else T
+
+val eq_int : ( x : int x int [ T ]) -> { z : bool | z = (fst x = snd x ) }
+function eq_int ( x ) = 
+    let x1 = fst x in
+    let x2 = snd x in
+    let x3 = x1 = x2 in x3
+  
+val neq_int : ( ( x : int x int [ T ]) -> { z : bool | ~ ( z = (fst x = snd x )) }
+function neq_int (x) = not_bool(eq_int(x))
+\<close>
+
+
+lemma 
+  assumes "atom z \<sharp> x"
+  shows "wfFT [] []  {||}  (AF_fun_typ (x::x) B_bool C_true (\<lbrace> z : B_bool | C_not (C_eq (CE_val (V_var z)) (CE_val (V_var x))) \<rbrace>)
+      (AS_if (V_var x)  [[L_false]\<^sup>v]\<^sup>s [[L_true]\<^sup>v]\<^sup>s))"
+  apply(rule wfFTI,wf_all) 
+  apply (simp add: supp_at_base)+
+  apply(rule wfTI)
+  by(wf_all add: assms)
+
+lemma 
+  assumes "atom z \<sharp> x"
+  shows "wfFT [] []  {||}  (AF_fun_typ (x::x) (B_pair B_int B_int) C_true (\<lbrace> z : B_bool | (C_eq (CE_val (V_var z)) (CE_op Eq (CE_fst (CE_val (V_var x))) (CE_fst (CE_val (V_var x))))) \<rbrace>)
+      (AS_let x1 (AE_fst ((V_var x))) (
+       AS_let x2 (AE_snd ((V_var x))) (
+       AS_let x3 (AE_op Eq ((V_var x1)) ((V_var x2))) (AS_val (V_var x3))))))"
+     
+  apply(rule wfFTI,wf_all2) 
+  defer 1
+ 
+ 
+  apply simp
+  apply(rule wfTI)
+      apply(fresh_mth_basic )
+  defer 1
+          apply(wf_all )
+  using assms apply simp
+          apply(wf_all )
+  using assms apply simp
+           apply(wf_all )
+  using assms apply simp
+          apply(wf_all )
+  defer 1
+            apply(wf_all )
+ using assms apply simp
+(*,wf_ctx,rule wfC_eqI,rule wfCE_valI,rule wfV_varI, (wf_ctx|auto|wf1)+)*)
+     apply(fresh_mth_basic )
+    apply((wf_ctx|auto|wf1)+)
+   apply(rule wfCE_eqI,rule wfCE_fstI, rule wfCE_valI,rule wfV_varI)
+     apply((wf_ctx|auto|wf1)+)
+      apply(fresh_mth_basic add: assms)+
+     apply((wf_ctx|auto|wf1)+)
+  using assms apply simp
+   apply(rule wfCE_fstI ,rule wfCE_valI,rule wfV_varI)
+  apply((wf_ctx|auto|wf1)+)
+     apply(fresh_mth_basic add: assms)+
+    apply((wf_ctx|auto|wf1)+)
+  using assms apply simp
+  by((wf_ctx|auto|wf1)+)
+
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/IVSubst.thy b/thys/MiniSail/IVSubst.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/IVSubst.thy
@@ -0,0 +1,1446 @@
+(*<*)
+theory IVSubst
+  imports  Syntax
+begin
+  (*>*)
+
+chapter \<open>Immutable Variable Substitution\<close>
+
+text \<open>Substitution involving immutable variables. We define a class and instances for all
+of the term forms\<close>
+
+section \<open>Class\<close>
+
+class has_subst_v = fs +
+  fixes subst_v :: "'a::fs \<Rightarrow> x \<Rightarrow> v \<Rightarrow> 'a::fs"   ("_[_::=_]\<^sub>v" [1000,50,50] 1000)
+  assumes fresh_subst_v_if:  "y \<sharp> (subst_v a x v)  \<longleftrightarrow> (atom x \<sharp> a \<and> y \<sharp> a) \<or> (y \<sharp> v \<and> (y \<sharp> a \<or> y = atom x))" 
+    and    forget_subst_v[simp]:  "atom x \<sharp> a \<Longrightarrow> subst_v a  x v = a"
+    and    subst_v_id[simp]:      "subst_v a x (V_var x) = a"
+    and    eqvt[simp,eqvt]:       "(p::perm) \<bullet> (subst_v a x v) = (subst_v  (p \<bullet> a) (p \<bullet>x) (p \<bullet>v))"
+    and    flip_subst_v[simp]:    "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    and    subst_v_simple_commute[simp]: "atom x \<sharp> c \<Longrightarrow>(c[z::=[x]\<^sup>v]\<^sub>v)[x::=b]\<^sub>v = c[z::=b]\<^sub>v" 
+begin
+
+lemma subst_v_flip_eq_one:
+  fixes z1::x and z2::x and x1::x and x2::x  
+  assumes "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
+    and "atom x1 \<sharp> (z1,z2,c1,c2)"
+  shows "(c1[z1::=[x1]\<^sup>v]\<^sub>v) = (c2[z2::=[x1]\<^sup>v]\<^sub>v)"
+proof -  
+  have "(c1[z1::=[x1]\<^sup>v]\<^sub>v) = (x1 \<leftrightarrow> z1) \<bullet> c1" using assms flip_subst_v by auto
+  moreover have  "(c2[z2::=[x1]\<^sup>v]\<^sub>v) = (x1 \<leftrightarrow> z2) \<bullet> c2" using assms flip_subst_v by auto
+  ultimately show ?thesis using Abs1_eq_iff_all(3)[of z1 c1 z2 c2 z1]  assms 
+    by (metis Abs1_eq_iff_fresh(3) flip_commute)
+qed
+
+lemma subst_v_flip_eq_two:
+  fixes z1::x and z2::x and x1::x and x2::x 
+  assumes "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
+  shows "(c1[z1::=b]\<^sub>v) = (c2[z2::=b]\<^sub>v)"
+proof -
+  obtain x::x where *:"atom x \<sharp> (z1,z2,c1,c2)" using obtain_fresh by metis
+  hence "(c1[z1::=[x]\<^sup>v]\<^sub>v) = (c2[z2::=[x]\<^sup>v]\<^sub>v)" using subst_v_flip_eq_one[OF assms, of x] by metis
+  hence "(c1[z1::=[x]\<^sup>v]\<^sub>v)[x::=b]\<^sub>v = (c2[z2::=[x]\<^sup>v]\<^sub>v)[x::=b]\<^sub>v" by auto
+  thus ?thesis using subst_v_simple_commute * fresh_prod4 by metis
+qed
+
+lemma subst_v_flip_eq_three:
+  assumes "[[atom z1]]lst. c1 = [[atom z1']]lst. c1'"  and "atom x \<sharp> c1" and "atom x' \<sharp> (x,z1,z1', c1, c1')"
+  shows   "(x \<leftrightarrow> x') \<bullet> (c1[z1::=[x]\<^sup>v]\<^sub>v) =  c1'[z1'::=[x']\<^sup>v]\<^sub>v" 
+proof -
+  have "atom x' \<sharp> c1[z1::=[x]\<^sup>v]\<^sub>v" using assms fresh_subst_v_if by simp
+  hence "(x \<leftrightarrow> x') \<bullet> (c1[z1::=[x]\<^sup>v]\<^sub>v) = c1[z1::=[x]\<^sup>v]\<^sub>v[x::=[x']\<^sup>v]\<^sub>v" using flip_subst_v[of x' "c1[z1::=[x]\<^sup>v]\<^sub>v" x] flip_commute by metis
+  also have "... = c1[z1::=[x']\<^sup>v]\<^sub>v" using subst_v_simple_commute fresh_prod4 assms by auto
+  also have "... = c1'[z1'::=[x']\<^sup>v]\<^sub>v" using subst_v_flip_eq_one[of z1 c1 z1' c1' x'] using  assms by auto
+  finally show ?thesis by auto
+qed
+
+end
+
+section \<open>Values\<close>
+
+nominal_function 
+  subst_vv :: "v \<Rightarrow> x \<Rightarrow> v \<Rightarrow> v" where
+  "subst_vv (V_lit l) x v = V_lit l"
+| "subst_vv (V_var y) x v = (if x = y then v else V_var y)"
+| "subst_vv (V_cons tyid c v') x v  = V_cons tyid c (subst_vv v' x v)"
+| "subst_vv (V_consp tyid c b v') x v  = V_consp tyid c b (subst_vv v' x v)"
+| "subst_vv (V_pair v1 v2) x v = V_pair (subst_vv v1 x v ) (subst_vv v2 x v )"
+  by(auto simp: eqvt_def subst_vv_graph_aux_def, metis v.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_vv_abbrev :: "v \<Rightarrow> x \<Rightarrow> v \<Rightarrow> v" ("_[_::=_]\<^sub>v\<^sub>v" [1000,50,50] 1000)
+  where 
+    "v[x::=v']\<^sub>v\<^sub>v  \<equiv> subst_vv v x v'" 
+
+lemma fresh_subst_vv_if [simp]:
+  "j \<sharp> t[i::=x]\<^sub>v\<^sub>v  = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+  using supp_l_empty apply (induct t rule: v.induct,auto simp add: subst_vv.simps fresh_def, auto)
+  by (simp add: supp_at_base |metis b.supp supp_b_empty  )+
+
+lemma forget_subst_vv [simp]: "atom a \<sharp> tm \<Longrightarrow> tm[a::=x]\<^sub>v\<^sub>v = tm"
+  by (induct tm rule: v.induct) (simp_all add: fresh_at_base)
+
+lemma subst_vv_id [simp]: "tm[a::=V_var a]\<^sub>v\<^sub>v  = tm"
+  by (induct tm rule: v.induct) simp_all
+
+lemma subst_vv_commute [simp]:
+  "atom j \<sharp> tm \<Longrightarrow> tm[i::=t]\<^sub>v\<^sub>v[j::=u]\<^sub>v\<^sub>v = tm[i::=t[j::=u]\<^sub>v\<^sub>v]\<^sub>v\<^sub>v "
+  by (induct tm rule: v.induct) (auto simp: fresh_Pair)
+
+lemma subst_vv_commute_full [simp]:
+  "atom j \<sharp> t \<Longrightarrow> atom i \<sharp> u \<Longrightarrow> i \<noteq> j \<Longrightarrow> tm[i::=t]\<^sub>v\<^sub>v[j::=u]\<^sub>v\<^sub>v = tm[j::=u]\<^sub>v\<^sub>v[i::=t]\<^sub>v\<^sub>v"
+  by (induct tm rule: v.induct) auto
+
+lemma subst_vv_var_flip[simp]:
+  fixes v::v
+  assumes "atom y \<sharp> v"
+  shows "(y \<leftrightarrow> x) \<bullet> v = v [x::=V_var y]\<^sub>v\<^sub>v"
+  using assms apply(induct v rule:v.induct)
+      apply auto
+  using  l.fresh l.perm_simps l.strong_exhaust supp_l_empty permute_pure permute_list.simps fresh_def flip_fresh_fresh apply fastforce
+  using permute_pure apply blast+
+  done
+
+instantiation v :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_vv"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::v
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    using fresh_subst_vv_if[of j t i x] subst_v_v_def by metis
+
+  fix a::x and tm::v and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+    using forget_subst_vv subst_v_v_def by simp
+
+  fix a::x and tm::v
+  show "subst_v tm a (V_var a) = tm" using subst_vv_id  subst_v_v_def by simp
+
+  fix p::perm and x1::x and v::v and t1::v
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    using   subst_v_v_def by simp
+
+  fix x::x and c::v and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    using  subst_v_v_def by simp
+
+  fix x::x and c::v and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    using  subst_v_v_def by simp
+qed
+
+end
+
+section \<open>Expressions\<close>
+
+nominal_function subst_ev :: "e \<Rightarrow> x \<Rightarrow> v  \<Rightarrow> e" where
+  "subst_ev  ( (AE_val v') ) x v = ( (AE_val (subst_vv v' x v)) )"
+| "subst_ev  ( (AE_app f v') ) x v  = ( (AE_app f (subst_vv v' x v )) )"                
+| "subst_ev  ( (AE_appP f b v') ) x v = ( (AE_appP f b (subst_vv v' x v )) )"   
+| "subst_ev  ( (AE_op opp v1 v2) ) x v  = ( (AE_op opp (subst_vv v1 x v ) (subst_vv v2 x v )) )"
+| "subst_ev  [#1 v']\<^sup>e x v = [#1 (subst_vv v' x v )]\<^sup>e"
+| "subst_ev  [#2 v']\<^sup>e x v = [#2 (subst_vv v' x v )]\<^sup>e"
+| "subst_ev  ( (AE_mvar u)) x v = AE_mvar u"
+| "subst_ev  [| v' |]\<^sup>e x v = [| (subst_vv  v' x v ) |]\<^sup>e"
+| "subst_ev  ( AE_concat v1 v2) x v = AE_concat (subst_vv v1 x v ) (subst_vv v2 x v )"
+| "subst_ev  ( AE_split v1 v2) x v = AE_split (subst_vv v1 x v ) (subst_vv v2 x v )"
+  by(simp add: eqvt_def subst_ev_graph_aux_def,auto)(meson e.strong_exhaust)
+
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_ev_abbrev :: "e \<Rightarrow> x \<Rightarrow> v \<Rightarrow> e" ("_[_::=_]\<^sub>e\<^sub>v" [1000,50,50] 500)
+  where 
+    "e[x::=v']\<^sub>e\<^sub>v  \<equiv> subst_ev e x v' " 
+
+lemma size_subst_ev [simp]: "size ( subst_ev A i x) = size A"
+  apply (nominal_induct A avoiding: i x rule: e.strong_induct) 
+  by auto
+
+lemma forget_subst_ev [simp]: "atom a \<sharp> A \<Longrightarrow> subst_ev A a x  = A"
+  apply (nominal_induct A avoiding: a x rule: e.strong_induct) 
+  by (auto simp: fresh_at_base)
+
+lemma subst_ev_id [simp]: "subst_ev A a (V_var a)  = A"
+  by (nominal_induct A avoiding: a rule: e.strong_induct) (auto simp: fresh_at_base)
+
+lemma fresh_subst_ev_if [simp]:
+  "j \<sharp> (subst_ev A i x ) = ((atom i \<sharp> A \<and> j \<sharp> A) \<or> (j \<sharp> x \<and> (j \<sharp> A \<or> j = atom i)))"
+  apply (induct A rule: e.induct)
+  unfolding subst_ev.simps fresh_subst_vv_if apply auto+
+  using pure_fresh fresh_opp_all apply metis+
+  done
+
+lemma subst_ev_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (A[i::=t]\<^sub>e\<^sub>v)[j::=u]\<^sub>e\<^sub>v = A[i::=t[j::=u]\<^sub>v\<^sub>v]\<^sub>e\<^sub>v"
+  by (nominal_induct A avoiding: i j t u rule: e.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_ev_var_flip[simp]:
+  fixes e::e and y::x and x::x
+  assumes "atom y \<sharp> e"
+  shows "(y \<leftrightarrow> x) \<bullet> e = e [x::=V_var y]\<^sub>e\<^sub>v"
+  using assms apply(nominal_induct e rule:e.strong_induct)
+           apply (simp add: subst_v_v_def)  
+          apply (metis (mono_tags, lifting) b.eq_iff b.perm_simps e.fresh e.perm_simps flip_b_id subst_ev.simps subst_vv_var_flip)
+         apply (metis (mono_tags, lifting) b.eq_iff b.perm_simps e.fresh e.perm_simps flip_b_id subst_ev.simps subst_vv_var_flip)
+  subgoal for x
+    apply (rule_tac y=x in  opp.strong_exhaust)
+    using  subst_vv_var_flip flip_def by (simp add: flip_def permute_pure)+
+  using  subst_vv_var_flip flip_def by (simp add: flip_def permute_pure)+
+
+lemma subst_ev_flip:
+  fixes e::e and ea::e and c::x
+  assumes "atom c \<sharp> (e, ea)" and "atom c \<sharp> (x, xa, e, ea)" and "(x \<leftrightarrow> c) \<bullet> e = (xa \<leftrightarrow> c) \<bullet> ea" 
+  shows "e[x::=v']\<^sub>e\<^sub>v = ea[xa::=v']\<^sub>e\<^sub>v"
+proof -
+  have "e[x::=v']\<^sub>e\<^sub>v = (e[x::=V_var c]\<^sub>e\<^sub>v)[c::=v']\<^sub>e\<^sub>v" using subst_ev_commute assms by simp
+  also have "...  = ((c \<leftrightarrow> x) \<bullet> e)[c::=v']\<^sub>e\<^sub>v" using subst_ev_var_flip assms by simp
+  also have "... = ((c \<leftrightarrow> xa) \<bullet> ea)[c::=v']\<^sub>e\<^sub>v" using assms flip_commute by metis
+  also have "... = ea[xa::=v']\<^sub>e\<^sub>v"  using subst_ev_var_flip assms  by simp
+  finally show ?thesis by auto
+qed
+
+lemma subst_ev_var[simp]:
+  "(AE_val (V_var x))[x::=[z]\<^sup>v]\<^sub>e\<^sub>v = AE_val (V_var z)"
+  by auto
+
+instantiation e :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_ev"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::e
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    using fresh_subst_ev_if[of j t i x] subst_v_e_def by metis
+
+  fix a::x and tm::e and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+    using forget_subst_ev subst_v_e_def by simp
+
+  fix a::x and tm::e
+  show "subst_v tm a (V_var a) = tm" using subst_ev_id  subst_v_e_def by simp
+
+  fix p::perm and x1::x and v::v and t1::e
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    using subst_ev_commute  subst_v_e_def by simp
+
+  fix x::x and c::e and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    using  subst_v_e_def by simp
+
+  fix x::x and c::e and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    using  subst_v_e_def by simp
+qed
+end
+
+lemma subst_ev_commute_full:
+  fixes e::e and w::v and v::v
+  assumes "atom z \<sharp> v" and "atom x \<sharp> w" and "x \<noteq> z"
+  shows "subst_ev  (e[z::=w]\<^sub>e\<^sub>v) x v = subst_ev  (e[x::=v]\<^sub>e\<^sub>v) z w" 
+  using assms by(nominal_induct e rule: e.strong_induct,simp+)
+
+lemma subst_ev_v_flip1[simp]:
+  fixes e::e
+  assumes "atom z1 \<sharp> (z,e)" and "atom z1' \<sharp> (z,e)"
+  shows"(z1 \<leftrightarrow> z1') \<bullet> e[z::=v]\<^sub>e\<^sub>v =  e[z::= ((z1 \<leftrightarrow> z1') \<bullet> v)]\<^sub>e\<^sub>v"
+  using assms proof(nominal_induct e rule:e.strong_induct)
+qed  (simp add: flip_def fresh_Pair swap_fresh_fresh)+
+
+section \<open>Expressions in Constraints\<close>
+
+nominal_function subst_cev :: "ce \<Rightarrow> x \<Rightarrow> v  \<Rightarrow> ce" where
+  "subst_cev ( (CE_val v') ) x v = ( (CE_val (subst_vv  v' x v )) )" 
+| "subst_cev ( (CE_op opp v1 v2) ) x v = ( (CE_op opp (subst_cev  v1 x v ) (subst_cev v2 x v )) )"
+| "subst_cev ( (CE_fst v')) x v = CE_fst (subst_cev  v' x v )"
+| "subst_cev ( (CE_snd v')) x v = CE_snd (subst_cev  v' x v )"
+| "subst_cev ( (CE_len v')) x v = CE_len (subst_cev  v' x v )"
+| "subst_cev ( CE_concat v1 v2) x v = CE_concat (subst_cev v1 x v ) (subst_cev v2 x v )"
+                      apply (simp add: eqvt_def subst_cev_graph_aux_def,auto)
+  by (meson ce.strong_exhaust)
+
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_cev_abbrev :: "ce \<Rightarrow> x \<Rightarrow> v \<Rightarrow> ce" ("_[_::=_]\<^sub>c\<^sub>e\<^sub>v" [1000,50,50] 500)
+  where 
+    "e[x::=v']\<^sub>c\<^sub>e\<^sub>v  \<equiv> subst_cev  e x v'" 
+
+lemma size_subst_cev [simp]: "size ( subst_cev A i x ) = size A"
+  by (nominal_induct A avoiding: i x rule: ce.strong_induct,auto) 
+
+lemma forget_subst_cev [simp]: "atom a \<sharp> A \<Longrightarrow> subst_cev A a x  = A"
+  by (nominal_induct A avoiding: a x rule: ce.strong_induct, auto simp: fresh_at_base)
+
+lemma subst_cev_id [simp]: "subst_cev A a (V_var a)  = A"
+  by (nominal_induct A avoiding: a rule: ce.strong_induct) (auto simp: fresh_at_base)
+
+lemma fresh_subst_cev_if [simp]:
+  "j \<sharp> (subst_cev A i x ) = ((atom i \<sharp> A \<and> j \<sharp> A) \<or> (j \<sharp> x \<and> (j \<sharp> A \<or> j = atom i)))"
+proof(nominal_induct A avoiding: i x rule: ce.strong_induct)
+  case (CE_op opp v1 v2)
+  then show ?case  using fresh_subst_vv_if subst_ev.simps e.supp pure_fresh opp.fresh 
+      fresh_e_opp 
+    using fresh_opp_all by auto
+qed(auto)+
+
+lemma subst_cev_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_cev (subst_cev A i t ) j u) = subst_cev A i (subst_vv t j u )"
+  by (nominal_induct A avoiding: i j t u rule: ce.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_cev_var_flip[simp]:
+  fixes e::ce and y::x and x::x
+  assumes "atom y \<sharp> e"
+  shows "(y \<leftrightarrow> x) \<bullet> e = e [x::=V_var y]\<^sub>c\<^sub>e\<^sub>v"
+  using assms proof(nominal_induct e rule:ce.strong_induct)
+  case (CE_val v)
+  then show ?case using subst_vv_var_flip by auto
+next
+  case (CE_op opp v1 v2)
+  hence yf: "atom y \<sharp> v1 \<and> atom y \<sharp> v2" using ce.fresh by blast
+  have " (y \<leftrightarrow> x) \<bullet> (CE_op opp v1 v2 ) = CE_op ((y \<leftrightarrow> x) \<bullet> opp) ( (y \<leftrightarrow> x) \<bullet> v1 ) ( (y \<leftrightarrow> x) \<bullet> v2)" 
+    using opp.perm_simps ce.perm_simps permute_pure ce.fresh opp.strong_exhaust by presburger
+  also have "... = CE_op ((y \<leftrightarrow> x) \<bullet> opp) (v1[x::=V_var y]\<^sub>c\<^sub>e\<^sub>v) (v2 [x::=V_var y]\<^sub>c\<^sub>e\<^sub>v)" using yf 
+    by (simp add: CE_op.hyps(1) CE_op.hyps(2))
+  finally show ?case using subst_cev.simps  opp.perm_simps  opp.strong_exhaust 
+    by (metis (full_types))
+qed( (auto simp add: permute_pure subst_vv_var_flip)+)
+
+lemma subst_cev_flip:
+  fixes e::ce and ea::ce and c::x
+  assumes "atom c \<sharp> (e, ea)" and "atom c \<sharp> (x, xa, e, ea)" and "(x \<leftrightarrow> c) \<bullet> e = (xa \<leftrightarrow> c) \<bullet> ea" 
+  shows "e[x::=v']\<^sub>c\<^sub>e\<^sub>v = ea[xa::=v']\<^sub>c\<^sub>e\<^sub>v"
+proof -
+  have "e[x::=v']\<^sub>c\<^sub>e\<^sub>v = (e[x::=V_var c]\<^sub>c\<^sub>e\<^sub>v)[c::=v']\<^sub>c\<^sub>e\<^sub>v" using subst_ev_commute assms by simp
+  also have "...  = ((c \<leftrightarrow> x) \<bullet> e)[c::=v']\<^sub>c\<^sub>e\<^sub>v" using subst_ev_var_flip assms by simp
+  also have "... = ((c \<leftrightarrow> xa) \<bullet> ea)[c::=v']\<^sub>c\<^sub>e\<^sub>v" using assms flip_commute by metis
+  also have "... = ea[xa::=v']\<^sub>c\<^sub>e\<^sub>v"  using subst_ev_var_flip assms  by simp
+  finally show ?thesis by auto
+qed
+
+lemma subst_cev_var[simp]:
+  fixes z::x and x::x
+  shows  "[[x]\<^sup>v]\<^sup>c\<^sup>e [x::=[z]\<^sup>v]\<^sub>c\<^sub>e\<^sub>v = [[z]\<^sup>v]\<^sup>c\<^sup>e"
+  by auto
+
+instantiation ce :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_cev"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::ce
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    using fresh_subst_cev_if[of j t i x] subst_v_ce_def by metis
+
+  fix a::x and tm::ce and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+    using forget_subst_cev subst_v_ce_def by simp
+
+  fix a::x and tm::ce
+  show "subst_v tm a (V_var a) = tm" using subst_cev_id  subst_v_ce_def by simp
+
+  fix p::perm and x1::x and v::v and t1::ce
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    using subst_cev_commute  subst_v_ce_def by simp
+
+  fix x::x and c::ce and z::x 
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c [z::=V_var x]\<^sub>v"
+    using  subst_v_ce_def by simp
+
+  fix x::x and c::ce and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c [z::=V_var x]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    using  subst_v_ce_def by simp
+qed
+
+end
+
+lemma subst_cev_commute_full:
+  fixes e::ce and w::v and v::v
+  assumes "atom z \<sharp> v" and "atom x \<sharp> w" and "x \<noteq> z"
+  shows "subst_cev (e[z::=w]\<^sub>c\<^sub>e\<^sub>v) x v  = subst_cev (e[x::=v]\<^sub>c\<^sub>e\<^sub>v) z w " 
+  using assms by(nominal_induct e rule: ce.strong_induct,simp+)
+
+
+lemma subst_cev_v_flip1[simp]:
+  fixes e::ce
+  assumes "atom z1 \<sharp> (z,e)" and "atom z1' \<sharp> (z,e)"
+  shows"(z1 \<leftrightarrow> z1') \<bullet> e[z::=v]\<^sub>c\<^sub>e\<^sub>v =  e[z::= ((z1 \<leftrightarrow> z1') \<bullet> v)]\<^sub>c\<^sub>e\<^sub>v"
+  using assms apply(nominal_induct e rule:ce.strong_induct)
+  by (simp add: flip_def fresh_Pair swap_fresh_fresh)+
+
+section \<open>Constraints\<close>
+
+nominal_function subst_cv :: "c \<Rightarrow> x \<Rightarrow> v  \<Rightarrow> c" where
+  "subst_cv (C_true) x v = C_true"
+|  "subst_cv (C_false) x v = C_false"
+|  "subst_cv (C_conj c1 c2) x v = C_conj (subst_cv c1 x v ) (subst_cv c2 x v )"
+|  "subst_cv (C_disj c1 c2) x v = C_disj (subst_cv c1 x v ) (subst_cv c2 x v )"
+|  "subst_cv (C_imp c1 c2) x v = C_imp (subst_cv c1 x v ) (subst_cv c2 x v )"
+|  "subst_cv (e1 == e2) x v = ((subst_cev e1 x v ) == (subst_cev e2 x v ))"
+|  "subst_cv (C_not c) x v = C_not (subst_cv c x v )"
+                      apply (simp add: eqvt_def subst_cv_graph_aux_def,auto)
+  using c.strong_exhaust by metis
+nominal_termination (eqvt)  by lexicographic_order
+
+abbreviation 
+  subst_cv_abbrev :: "c \<Rightarrow> x \<Rightarrow> v \<Rightarrow> c" ("_[_::=_]\<^sub>c\<^sub>v" [1000,50,50] 1000)
+  where 
+    "c[x::=v']\<^sub>c\<^sub>v  \<equiv> subst_cv c x v'" 
+
+lemma size_subst_cv [simp]: "size ( subst_cv A i x ) = size A"
+  by (nominal_induct A avoiding: i x rule: c.strong_induct,auto) 
+
+lemma forget_subst_cv [simp]: "atom a \<sharp> A \<Longrightarrow> subst_cv A a x  = A"
+  by (nominal_induct A avoiding: a x rule: c.strong_induct, auto simp: fresh_at_base)
+
+lemma subst_cv_id [simp]: "subst_cv A a (V_var a)  = A"
+  by (nominal_induct A avoiding: a rule: c.strong_induct) (auto simp: fresh_at_base)
+
+lemma fresh_subst_cv_if [simp]:
+  "j \<sharp> (subst_cv A i x ) \<longleftrightarrow> (atom i \<sharp> A \<and> j \<sharp> A) \<or> (j \<sharp> x \<and> (j \<sharp> A \<or> j = atom i))"
+  by (nominal_induct A avoiding: i x rule: c.strong_induct, (auto simp add: pure_fresh)+)
+
+lemma subst_cv_commute [simp]:
+  "atom j \<sharp> A \<Longrightarrow> (subst_cv (subst_cv A i t ) j u ) = subst_cv A i (subst_vv t j u )"
+  by (nominal_induct A avoiding: i j t u rule: c.strong_induct) (auto simp: fresh_at_base)
+
+lemma let_s_size [simp]: "size s \<le> size (AS_let x e s)"
+  apply (nominal_induct s avoiding: e x rule: s_branch_s_branch_list.strong_induct(1)) 
+              apply auto
+  done
+
+lemma subst_cv_var_flip[simp]:
+  fixes c::c
+  assumes "atom y \<sharp> c"
+  shows "(y \<leftrightarrow> x) \<bullet> c = c[x::=V_var y]\<^sub>c\<^sub>v"
+  using assms by(nominal_induct c rule:c.strong_induct,(simp add: flip_subst_v subst_v_ce_def)+)
+
+instantiation c :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_cv"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::c
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    using fresh_subst_cv_if[of j t i x] subst_v_c_def by metis
+
+  fix a::x and tm::c and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+    using forget_subst_cv subst_v_c_def by simp
+
+  fix a::x and tm::c
+  show "subst_v tm a (V_var a) = tm" using subst_cv_id  subst_v_c_def by simp
+
+  fix p::perm and x1::x and v::v and t1::c
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    using subst_cv_commute  subst_v_c_def by simp
+
+  fix x::x and c::c and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    using subst_cv_var_flip subst_v_c_def by simp
+
+  fix x::x and c::c and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    using subst_cv_var_flip subst_v_c_def by simp
+qed
+
+end
+
+lemma subst_cv_var_flip1[simp]:
+  fixes c::c
+  assumes "atom y \<sharp> c"
+  shows "(x \<leftrightarrow> y) \<bullet> c = c[x::=V_var y]\<^sub>c\<^sub>v"
+  using subst_cv_var_flip flip_commute 
+  by (metis assms)
+
+lemma subst_cv_v_flip3[simp]:
+  fixes c::c
+  assumes "atom z1 \<sharp> c" and "atom z1' \<sharp> c"
+  shows"(z1 \<leftrightarrow> z1') \<bullet> c[z::=[z1]\<^sup>v]\<^sub>c\<^sub>v =  c[z::=[z1']\<^sup>v]\<^sub>c\<^sub>v"
+proof - 
+  consider "z1' = z" | "z1 = z" | "atom z1 \<sharp> z \<and> atom z1' \<sharp> z" by force
+  then show ?thesis proof(cases)
+    case 1
+    then show ?thesis using 1 assms by auto
+  next
+    case 2
+    then show ?thesis using 2 assms by auto
+  next
+    case 3
+    then show ?thesis using assms by auto
+  qed
+qed
+
+lemma subst_cv_v_flip[simp]:
+  fixes c::c
+  assumes "atom x \<sharp> c"
+  shows "((x \<leftrightarrow> z) \<bullet> c)[x::=v]\<^sub>c\<^sub>v = c [z::=v]\<^sub>c\<^sub>v"
+  using assms subst_v_c_def by auto
+
+lemma subst_cv_commute_full:
+  fixes c::c
+  assumes "atom z \<sharp> v" and "atom x \<sharp> w" and "x\<noteq>z"
+  shows "(c[z::=w]\<^sub>c\<^sub>v)[x::=v]\<^sub>c\<^sub>v = (c[x::=v]\<^sub>c\<^sub>v)[z::=w]\<^sub>c\<^sub>v" 
+  using assms proof(nominal_induct c rule: c.strong_induct)
+  case (C_eq e1 e2)
+  then show ?case using subst_cev_commute_full by simp
+qed(force+)
+
+lemma subst_cv_eq[simp]:
+  assumes  "atom z1 \<sharp> e1" 
+  shows "(CE_val (V_var z1)  ==  e1 )[z1::=[x]\<^sup>v]\<^sub>c\<^sub>v = (CE_val (V_var x)  ==  e1 )" (is "?A = ?B")
+proof -
+  have "?A = (((CE_val (V_var z1))[z1::=[x]\<^sup>v]\<^sub>c\<^sub>e\<^sub>v) == e1)" using subst_cv.simps assms by simp
+  thus ?thesis by simp
+qed
+
+section \<open>Variable Context\<close>
+
+text \<open>The idea of this substitution is to remove x from the context. We really want to add the condition 
+that x is fresh in v but this causes problems with proofs.\<close>
+
+nominal_function subst_gv :: "\<Gamma> \<Rightarrow> x \<Rightarrow> v  \<Rightarrow> \<Gamma>" where
+  "subst_gv GNil  x v = GNil"
+| "subst_gv ((y,b,c) #\<^sub>\<Gamma> \<Gamma>) x v  = (if x = y then \<Gamma> else ((y,b,c[x::=v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma> (subst_gv  \<Gamma> x v )))"
+proof(goal_cases)
+  case 1
+  then show ?case  by(simp add: eqvt_def subst_gv_graph_aux_def )
+next
+  case (3 P x)
+  then show ?case by (metis neq_GNil_conv prod_cases3)
+qed(fast+)
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_gv_abbrev :: "\<Gamma> \<Rightarrow> x \<Rightarrow> v \<Rightarrow> \<Gamma>" ("_[_::=_]\<^sub>\<Gamma>\<^sub>v" [1000,50,50] 1000)
+  where 
+    "g[x::=v]\<^sub>\<Gamma>\<^sub>v  \<equiv> subst_gv g x v" 
+
+lemma size_subst_gv [simp]: "size ( subst_gv G i x ) \<le> size G"
+  by (induct G,auto) 
+
+lemma forget_subst_gv [simp]: "atom a \<sharp> G \<Longrightarrow> subst_gv G a x = G"
+  apply (induct G ,auto) 
+  using fresh_GCons fresh_PairD(1) not_self_fresh apply blast
+   apply (simp add: fresh_GCons)+
+  done
+
+lemma fresh_subst_gv: "atom a \<sharp> G \<Longrightarrow> atom a \<sharp> v \<Longrightarrow> atom a \<sharp> subst_gv G x v"
+proof(induct G)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons xbc G)
+  obtain x' and b' and c' where xbc: "xbc = (x',b',c')" using prod_cases3 by blast
+  show ?case proof(cases "x=x'")
+    case True
+    have "atom a \<sharp> G" using GCons fresh_GCons by blast
+    thus ?thesis using subst_gv.simps(2)[of  x' b' c' G] GCons xbc True by presburger
+  next
+    case False
+    then show ?thesis using subst_gv.simps(2)[of  x' b' c' G] GCons xbc False fresh_GCons by simp
+  qed
+qed
+
+lemma subst_gv_flip: 
+  fixes x::x and xa::x and z::x and c::c and b::b and \<Gamma>::\<Gamma>
+  assumes "atom xa \<sharp> ((x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)"  and "atom xa \<sharp> \<Gamma>" and "atom x \<sharp> \<Gamma>" and "atom x \<sharp> (z, c)" and "atom xa \<sharp> (z, c)"
+  shows "(x \<leftrightarrow> xa) \<bullet>  ((x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) = (xa, b, c[z::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>"
+proof -
+  have  "(x \<leftrightarrow> xa) \<bullet>  ((x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) =  (( (x \<leftrightarrow> xa) \<bullet>  x, b, (x \<leftrightarrow> xa) \<bullet>  c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> ((x \<leftrightarrow> xa) \<bullet>  \<Gamma>))" 
+    using subst Cons_eqvt flip_fresh_fresh using G_cons_flip by simp
+  also have "... = ((xa, b, (x \<leftrightarrow> xa) \<bullet> c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> ((x \<leftrightarrow> xa) \<bullet>  \<Gamma>))" using assms by fastforce
+  also have "... =  ((xa, b,  c[z::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> ((x \<leftrightarrow> xa) \<bullet>  \<Gamma>))" using assms subst_cv_var_flip by fastforce
+  also have "... =  ((xa, b,  c[z::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)"  using assms flip_fresh_fresh by blast 
+  finally show ?thesis by simp
+qed
+
+section \<open>Types\<close>
+
+nominal_function subst_tv :: "\<tau> \<Rightarrow> x \<Rightarrow> v \<Rightarrow> \<tau>" where
+  "atom z \<sharp> (x,v) \<Longrightarrow> subst_tv  \<lbrace> z : b | c \<rbrace> x v  = \<lbrace> z : b | c[x::=v]\<^sub>c\<^sub>v \<rbrace>"
+     apply (simp add: eqvt_def subst_tv_graph_aux_def )
+    apply auto
+  subgoal for P a aa b
+    apply(rule_tac y=a and c="(aa,b)" in \<tau>.strong_exhaust)
+    by (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base) 
+  apply (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
+proof -
+  fix z :: x and c :: c and za :: x and xa :: x and va :: v and ca :: c and cb :: x
+  assume a1: "atom za \<sharp> va"  and  a2: "atom z \<sharp> va" and a3: "\<forall>cb. atom cb \<sharp> c \<and> atom cb \<sharp> ca \<longrightarrow> cb \<noteq> z \<and> cb \<noteq> za \<longrightarrow> c[z::=V_var cb]\<^sub>c\<^sub>v = ca[za::=V_var cb]\<^sub>c\<^sub>v"
+  assume a4: "atom cb \<sharp> c" and a5: "atom cb \<sharp> ca" and a6: "cb \<noteq> z" and a7: "cb \<noteq> za" and "atom cb \<sharp> va" and a8: "za \<noteq> xa" and a9: "z \<noteq> xa"
+  assume a10:"cb \<noteq> xa"
+  note assms = a10 a9 a8 a7 a6 a5 a4 a3 a2 a1 
+
+  have "c[z::=V_var cb]\<^sub>c\<^sub>v = ca[za::=V_var cb]\<^sub>c\<^sub>v" using assms  by auto
+  hence "c[z::=V_var cb]\<^sub>c\<^sub>v[xa::=va]\<^sub>c\<^sub>v = ca[za::=V_var cb]\<^sub>c\<^sub>v[xa::=va]\<^sub>c\<^sub>v" by simp
+  moreover have "c[z::=V_var cb]\<^sub>c\<^sub>v[xa::=va]\<^sub>c\<^sub>v = c[xa::=va]\<^sub>c\<^sub>v[z::=V_var cb]\<^sub>c\<^sub>v" using   subst_cv_commute_full[of z va xa "V_var cb" ]  assms fresh_def v.supp by fastforce
+  moreover  have "ca[za::=V_var cb]\<^sub>c\<^sub>v[xa::=va]\<^sub>c\<^sub>v = ca[xa::=va]\<^sub>c\<^sub>v[za::=V_var cb]\<^sub>c\<^sub>v" 
+    using   subst_cv_commute_full[of za va xa "V_var cb" ]  assms fresh_def v.supp by fastforce
+
+  ultimately show "c[xa::=va]\<^sub>c\<^sub>v[z::=V_var cb]\<^sub>c\<^sub>v = ca[xa::=va]\<^sub>c\<^sub>v[za::=V_var cb]\<^sub>c\<^sub>v" by simp
+qed
+
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_tv_abbrev :: "\<tau> \<Rightarrow> x \<Rightarrow> v \<Rightarrow> \<tau>" ("_[_::=_]\<^sub>\<tau>\<^sub>v" [1000,50,50] 1000)
+  where 
+    "t[x::=v]\<^sub>\<tau>\<^sub>v  \<equiv> subst_tv t x v" 
+
+lemma size_subst_tv [simp]: "size ( subst_tv A i x ) = size A"
+proof (nominal_induct A avoiding: i x  rule: \<tau>.strong_induct)
+  case (T_refined_type x' b' c')
+  then show ?case by auto
+qed
+
+lemma forget_subst_tv [simp]: "atom a \<sharp> A \<Longrightarrow> subst_tv A a x  = A"
+  apply (nominal_induct A avoiding: a x rule: \<tau>.strong_induct) 
+  apply(auto simp: fresh_at_base)
+  done
+
+lemma subst_tv_id [simp]: "subst_tv A a (V_var a) = A"
+  by (nominal_induct A avoiding: a rule: \<tau>.strong_induct) (auto simp: fresh_at_base)
+
+lemma fresh_subst_tv_if [simp]:
+  "j \<sharp> (subst_tv A i x ) \<longleftrightarrow> (atom i \<sharp> A \<and> j \<sharp> A) \<or> (j \<sharp> x \<and> (j \<sharp> A \<or> j = atom i))"
+  apply (nominal_induct A avoiding: i x rule: \<tau>.strong_induct)
+  using fresh_def supp_b_empty x_fresh_b by auto
+
+lemma subst_tv_commute [simp]:
+  "atom y \<sharp> \<tau> \<Longrightarrow> (\<tau>[x::= t]\<^sub>\<tau>\<^sub>v)[y::=v]\<^sub>\<tau>\<^sub>v = \<tau>[x::= t[y::=v]\<^sub>v\<^sub>v]\<^sub>\<tau>\<^sub>v "
+  by (nominal_induct \<tau> avoiding: x y t v rule: \<tau>.strong_induct) (auto simp: fresh_at_base)
+
+lemma subst_tv_var_flip [simp]:
+  fixes x::x and xa::x and \<tau>::\<tau>
+  assumes "atom xa \<sharp> \<tau>"
+  shows "(x \<leftrightarrow> xa) \<bullet> \<tau> = \<tau>[x::=V_var xa]\<^sub>\<tau>\<^sub>v"
+proof - 
+  obtain z::x and b and c where zbc: "atom z \<sharp> (x,xa, V_var xa) \<and> \<tau> = \<lbrace> z : b | c \<rbrace>" 
+    using obtain_fresh_z   by (metis prod.inject subst_tv.cases)
+  hence "atom xa \<notin> supp c - { atom z }" using \<tau>.supp[of z b c] fresh_def supp_b_empty assms 
+    by  auto
+  moreover have "xa \<noteq> z" using zbc fresh_prod3 by force
+  ultimately have xaf: "atom xa \<sharp> c" using fresh_def by auto
+  have "(x \<leftrightarrow> xa) \<bullet> \<tau> = \<lbrace> z : b | (x \<leftrightarrow> xa) \<bullet> c \<rbrace>" 
+    by (metis \<tau>.perm_simps empty_iff flip_at_base_simps(3) flip_fresh_fresh fresh_PairD(1) fresh_PairD(2) fresh_def not_self_fresh supp_b_empty v.fresh(2) zbc)
+  also have "... =  \<lbrace> z : b | c[x::=V_var xa]\<^sub>c\<^sub>v \<rbrace>"  using subst_cv_v_flip xaf  
+    by (metis permute_flip_cancel permute_flip_cancel2 subst_cv_var_flip)
+  finally show ?thesis using subst_tv.simps zbc 
+    using fresh_PairD(1) not_self_fresh by force
+qed
+
+instantiation \<tau> :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_tv"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::\<tau>
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+
+  proof(nominal_induct t avoiding: i x rule:\<tau>.strong_induct)
+    case (T_refined_type z b c)
+    hence " j \<sharp> \<lbrace> z : b  | c \<rbrace>[i::=x]\<^sub>v  =  j \<sharp> \<lbrace> z : b  | c[i::=x]\<^sub>c\<^sub>v \<rbrace>" using subst_tv.simps subst_v_\<tau>_def fresh_Pair by simp
+    also have "...  = (atom i \<sharp> \<lbrace> z : b  | c \<rbrace> \<and> j \<sharp> \<lbrace> z : b  | c \<rbrace> \<or> j \<sharp> x \<and> (j \<sharp> \<lbrace> z : b  | c \<rbrace> \<or> j = atom i))" 
+      unfolding \<tau>.fresh using subst_v_c_def fresh_subst_v_if 
+      using T_refined_type.hyps(1) T_refined_type.hyps(2) x_fresh_b by auto
+    finally show ?case by auto
+  qed
+
+  fix a::x and tm::\<tau> and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+    apply(nominal_induct tm avoiding: a x rule:\<tau>.strong_induct)
+    using subst_v_c_def forget_subst_v subst_tv.simps subst_v_\<tau>_def fresh_Pair by simp
+
+  fix a::x and tm::\<tau>
+  show "subst_v tm a (V_var a) = tm"     
+    apply(nominal_induct tm avoiding: a rule:\<tau>.strong_induct)
+    using subst_v_c_def forget_subst_v subst_tv.simps subst_v_\<tau>_def fresh_Pair by simp
+
+  fix p::perm and x1::x and v::v and t1::\<tau>
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    apply(nominal_induct tm avoiding: a x rule:\<tau>.strong_induct)
+    using subst_v_c_def forget_subst_v subst_tv.simps subst_v_\<tau>_def fresh_Pair by simp
+
+  fix x::x and c::\<tau> and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v" 
+    apply(nominal_induct c avoiding: z x rule:\<tau>.strong_induct)
+    using subst_v_c_def flip_subst_v subst_tv.simps subst_v_\<tau>_def fresh_Pair by auto
+
+  fix x::x and c::\<tau> and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    apply(nominal_induct c avoiding:  x v z rule:\<tau>.strong_induct)
+    using subst_v_c_def  subst_tv.simps subst_v_\<tau>_def fresh_Pair 
+    by (metis flip_commute subst_tv_commute subst_tv_var_flip subst_v_\<tau>_def subst_vv.simps(2))
+qed
+
+end
+
+lemma subst_tv_commute_full:
+  fixes c::\<tau>
+  assumes "atom z \<sharp> v" and "atom x \<sharp> w" and "x\<noteq>z"
+  shows "(c[z::=w]\<^sub>\<tau>\<^sub>v)[x::=v]\<^sub>\<tau>\<^sub>v = (c[x::=v]\<^sub>\<tau>\<^sub>v)[z::=w]\<^sub>\<tau>\<^sub>v" 
+  using assms proof(nominal_induct c avoiding: x v z w rule: \<tau>.strong_induct)
+  case (T_refined_type x1a x2a x3a)
+  then show ?case using subst_cv_commute_full by simp
+qed
+
+lemma type_eq_subst_eq:
+  fixes v::v and c1::c
+  assumes "\<lbrace> z1 : b1  |  c1 \<rbrace> = \<lbrace> z2 : b2  |  c2 \<rbrace>"
+  shows "c1[z1::=v]\<^sub>c\<^sub>v = c2[z2::=v]\<^sub>c\<^sub>v"
+  using subst_v_flip_eq_two[of z1 c1 z2 c2 v] \<tau>.eq_iff assms subst_v_c_def by simp
+
+text \<open>Extract constraint from a type. We cannot just project out the constraint as this would
+mean alpha-equivalent types give different answers \<close>
+
+nominal_function c_of :: "\<tau> \<Rightarrow> x \<Rightarrow> c" where
+  "atom z \<sharp> x \<Longrightarrow> c_of (T_refined_type z b c) x = c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v"
+proof(goal_cases)
+  case 1
+  then show ?case using eqvt_def c_of_graph_aux_def by force
+next
+  case (2 x y)
+  then show ?case using eqvt_def c_of_graph_aux_def by force
+next
+  case (3 P x)
+  then obtain x1::\<tau> and x2::x where *:"x = (x1,x2)" by force
+  obtain z' and b' and c' where "x1 = \<lbrace> z' : b' | c' \<rbrace> \<and> atom z' \<sharp> x2" using obtain_fresh_z by metis
+  then show ?case  using 3 * by auto
+next
+  case (4 z1 x1 b1 c1 z2 x2 b2 c2)
+  then show ?case using subst_v_flip_eq_two \<tau>.eq_iff   by (metis prod.inject type_eq_subst_eq)
+qed
+
+nominal_termination (eqvt) by lexicographic_order
+
+lemma c_of_eq:
+  shows  "c_of \<lbrace> x : b | c \<rbrace> x = c"
+proof(nominal_induct "\<lbrace> x : b | c \<rbrace>" avoiding: x rule: \<tau>.strong_induct)
+  case (T_refined_type x' c') 
+  moreover hence "c_of \<lbrace> x' : b | c' \<rbrace> x = c'[x'::=V_var x]\<^sub>c\<^sub>v" using c_of.simps by auto
+  moreover have "\<lbrace> x' : b  | c' \<rbrace> = \<lbrace> x : b  | c \<rbrace>" using T_refined_type  \<tau>.eq_iff by metis
+  moreover have "c'[x'::=V_var x]\<^sub>c\<^sub>v = c" using  T_refined_type Abs1_eq_iff flip_subst_v subst_v_c_def 
+    by (metis subst_cv_id)
+  ultimately show ?case by auto
+qed
+
+lemma obtain_fresh_z_c_of:
+  fixes t::"'b::fs"
+  obtains z  where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b_of \<tau> | c_of \<tau> z \<rbrace>"
+proof - 
+  obtain z and c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b_of \<tau> | c \<rbrace>" using obtain_fresh_z2 by metis
+  moreover hence "c = c_of \<tau> z" using c_of.simps using c_of_eq by metis
+  ultimately show ?thesis 
+    using that by auto
+qed
+
+lemma c_of_fresh:
+  fixes x::x
+  assumes  "atom x \<sharp> (t,z)" 
+  shows "atom x \<sharp> c_of t z" 
+proof -
+  obtain z' and c' where z:"t = \<lbrace> z' : b_of t | c' \<rbrace> \<and> atom z' \<sharp> (x,z)" using obtain_fresh_z_c_of by metis
+  hence *:"c_of t z = c'[z'::=V_var z]\<^sub>c\<^sub>v" using c_of.simps fresh_Pair by metis
+  have "(atom x \<sharp> c' \<or> atom x \<in> set [atom z']) \<and> atom x \<sharp> b_of t" using \<tau>.fresh assms z fresh_Pair by metis
+  hence "atom x \<sharp> c'" using fresh_Pair z fresh_at_base(2) by fastforce
+  moreover have "atom x \<sharp> V_var z" using assms fresh_Pair v.fresh by metis
+  ultimately show ?thesis using assms fresh_subst_v_if[of "atom x" c' z' "V_var z"] subst_v_c_def * by metis
+qed
+
+lemma c_of_switch:
+  fixes z::x
+  assumes "atom z \<sharp> t" 
+  shows "(c_of t z)[z::=V_var x]\<^sub>c\<^sub>v = c_of t x"
+proof -  
+  obtain z' and c' where z:"t = \<lbrace> z' : b_of t | c' \<rbrace> \<and> atom z' \<sharp> (x,z)" using obtain_fresh_z_c_of by metis
+  hence "(atom z \<sharp> c' \<or> atom z \<in> set [atom z']) \<and> atom z \<sharp> b_of t" using \<tau>.fresh[of "atom z" z' "b_of t" c'] assms by metis
+  moreover have " atom z \<notin> set [atom z']" using z fresh_Pair by force
+  ultimately have  **:"atom z \<sharp> c'" using fresh_Pair z fresh_at_base(2) by metis
+
+  have "(c_of t z)[z::=V_var x]\<^sub>c\<^sub>v = c'[z'::=V_var z]\<^sub>c\<^sub>v[z::=V_var x]\<^sub>c\<^sub>v"  using c_of.simps fresh_Pair  z by metis
+  also have "... = c'[z'::=V_var x]\<^sub>c\<^sub>v"  using subst_v_simple_commute subst_v_c_def assms c_of.simps z  ** by metis
+  finally show ?thesis using c_of.simps[of z' x "b_of t" c']  fresh_Pair z by metis
+qed
+
+lemma type_eq_subst_eq1:
+  fixes v::v and c1::c
+  assumes "\<lbrace> z1 : b1  |  c1 \<rbrace> = (\<lbrace> z2 : b2  |  c2 \<rbrace>)" and "atom z1 \<sharp> c2" 
+  shows "c1[z1::=v]\<^sub>c\<^sub>v = c2[z2::=v]\<^sub>c\<^sub>v" and "b1=b2" and " c1 = (z1 \<leftrightarrow> z2) \<bullet> c2"
+proof -
+  show "c1[z1::=v]\<^sub>c\<^sub>v = c2[z2::=v]\<^sub>c\<^sub>v" using type_eq_subst_eq assms by blast
+  show "b1=b2" using \<tau>.eq_iff assms by blast
+  have "z1 = z2 \<and> c1 = c2 \<or> z1 \<noteq> z2 \<and> c1 = (z1 \<leftrightarrow> z2) \<bullet> c2 \<and> atom z1 \<sharp> c2" 
+    using \<tau>.eq_iff Abs1_eq_iff[of z1 c1 z2 c2] assms by blast 
+  thus  "c1 = (z1 \<leftrightarrow> z2) \<bullet> c2" by auto
+qed
+
+lemma type_eq_subst_eq2:
+  fixes v::v and c1::c
+  assumes "\<lbrace> z1 : b1  |  c1 \<rbrace> = (\<lbrace> z2 : b2  |  c2 \<rbrace>)" 
+  shows "c1[z1::=v]\<^sub>c\<^sub>v = c2[z2::=v]\<^sub>c\<^sub>v" and "b1=b2" and "[[atom z1]]lst. c1 = [[atom z2]]lst. c2"
+proof -
+  show "c1[z1::=v]\<^sub>c\<^sub>v = c2[z2::=v]\<^sub>c\<^sub>v" using type_eq_subst_eq assms by blast
+  show "b1=b2" using \<tau>.eq_iff assms by blast
+  show  "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
+    using \<tau>.eq_iff assms by auto
+qed
+
+lemma type_eq_subst_eq3:
+  fixes v::v and c1::c
+  assumes "\<lbrace> z1 : b1  |  c1 \<rbrace> = (\<lbrace> z2 : b2  |  c2 \<rbrace>)" and "atom z1 \<sharp> c2" 
+  shows "c1 = c2[z2::=V_var z1]\<^sub>c\<^sub>v" and "b1=b2"
+  using type_eq_subst_eq1 assms  subst_v_c_def 
+  by (metis subst_cv_var_flip)+
+
+lemma type_eq_flip:
+  assumes "atom x \<sharp> c"
+  shows "\<lbrace> z : b  | c \<rbrace> = \<lbrace> x : b | (x \<leftrightarrow> z ) \<bullet> c \<rbrace>"
+  using \<tau>.eq_iff Abs1_eq_iff assms 
+  by (metis (no_types, lifting) flip_fresh_fresh)
+
+lemma c_of_true:
+  "c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x = C_true"
+proof(nominal_induct "\<lbrace> z' : B_bool  | TRUE \<rbrace>" avoiding: x rule:\<tau>.strong_induct)
+  case (T_refined_type x1a x3a)
+  hence "\<lbrace> z' : B_bool  | TRUE \<rbrace> = \<lbrace> x1a : B_bool  | x3a \<rbrace>" using \<tau>.eq_iff by metis
+  then show ?case using subst_cv.simps c_of.simps T_refined_type 
+      type_eq_subst_eq3 
+    by (metis type_eq_subst_eq)
+qed
+
+lemma type_eq_subst:
+  assumes "atom x \<sharp> c"
+  shows "\<lbrace> z : b  | c \<rbrace> = \<lbrace> x : b | c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v \<rbrace>"
+  using \<tau>.eq_iff Abs1_eq_iff assms 
+  using subst_cv_var_flip type_eq_flip by auto
+
+lemma type_e_subst_fresh:
+  fixes x::x and z::x
+  assumes "atom z \<sharp> (x,v)" and "atom x \<sharp> e" 
+  shows "\<lbrace> z : b  | CE_val (V_var z)  ==  e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b  | CE_val (V_var z)  ==  e  \<rbrace>"
+  using assms subst_tv.simps subst_cv.simps forget_subst_cev by simp
+
+lemma type_v_subst_fresh:
+  fixes x::x and z::x
+  assumes "atom z \<sharp> (x,v)" and "atom x \<sharp> v'" 
+  shows "\<lbrace> z : b  | CE_val (V_var z)  ==  CE_val v'  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b  | CE_val (V_var z)  ==  CE_val v'  \<rbrace>"
+  using assms subst_tv.simps subst_cv.simps  by simp
+
+lemma subst_tbase_eq:
+  "b_of \<tau> = b_of \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
+proof -
+  obtain z and b and c where zbc: "\<tau> = \<lbrace> z:b|c\<rbrace> \<and> atom z \<sharp> (x,v)" using \<tau>.exhaust
+    by (metis prod.inject subst_tv.cases)
+  hence "b_of \<lbrace> z:b|c\<rbrace> = b_of \<lbrace> z:b|c\<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v" using subst_tv.simps by simp
+  thus ?thesis using zbc by blast
+qed
+
+lemma subst_tv_if:
+  assumes "atom z1 \<sharp> (x,v)" and "atom z' \<sharp> (x,v)" 
+  shows "\<lbrace> z1 : b  | CE_val (v'[x::=v]\<^sub>v\<^sub>v)  ==  CE_val (V_lit l)   IMP  (c'[x::=v]\<^sub>c\<^sub>v)[z'::=[z1]\<^sup>v]\<^sub>c\<^sub>v  \<rbrace> = 
+         \<lbrace> z1 : b  | CE_val v'           ==  CE_val (V_lit l)   IMP  c'[z'::=[z1]\<^sup>v]\<^sub>c\<^sub>v  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v" 
+  using subst_cv_commute_full[of z' v x "V_var z1" c']  subst_tv.simps subst_vv.simps(1) subst_ev.simps  subst_cv.simps assms 
+  by simp
+
+lemma subst_tv_tid:
+  assumes "atom za \<sharp> (x,v)"
+  shows "\<lbrace> za : B_id tid  | TRUE \<rbrace> = \<lbrace> za : B_id tid   | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms subst_tv.simps subst_cv.simps by presburger
+
+
+lemma b_of_subst:
+  "b_of (\<tau>[x::=v]\<^sub>\<tau>\<^sub>v) = b_of \<tau>"
+proof -
+  obtain z b c where *:"\<tau> = \<lbrace> z : b | c \<rbrace> \<and> atom z \<sharp> (x,v)" using obtain_fresh_z by metis
+  thus ?thesis  using subst_tv.simps * by auto 
+qed
+
+lemma subst_tv_flip:
+  assumes "\<tau>'[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>" and "atom x \<sharp> (v,\<tau>)" and "atom x' \<sharp> (v,\<tau>)"
+  shows "((x' \<leftrightarrow> x) \<bullet> \<tau>')[x'::=v]\<^sub>\<tau>\<^sub>v = \<tau>"
+proof -
+  have "(x' \<leftrightarrow> x) \<bullet> v = v \<and> (x' \<leftrightarrow> x) \<bullet> \<tau> = \<tau>" using assms flip_fresh_fresh by auto
+  thus ?thesis using subst_tv.eqvt[of  "(x' \<leftrightarrow> x)"  \<tau>' x v ] assms by auto
+qed
+
+lemma subst_cv_true:
+  "\<lbrace> z : B_id tid  | TRUE \<rbrace> = \<lbrace> z : B_id tid  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v" 
+proof -
+  obtain za::x where "atom za \<sharp> (x,v)" using obtain_fresh by auto
+  hence "\<lbrace> z : B_id tid   | TRUE \<rbrace> = \<lbrace> za: B_id tid | TRUE \<rbrace>" using \<tau>.eq_iff Abs1_eq_iff by fastforce
+  moreover have  "\<lbrace> za : B_id tid   | TRUE \<rbrace> = \<lbrace> za : B_id tid   | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"  
+    using subst_cv.simps subst_tv.simps  by (simp add: \<open>atom za \<sharp> (x, v)\<close>)
+  ultimately show ?thesis by argo
+qed
+
+lemma t_eq_supp:
+  assumes "(\<lbrace> z : b | c \<rbrace>) = (\<lbrace>  z1 : b1 | c1 \<rbrace>)"
+  shows "supp c - { atom z } = supp c1 - { atom z1 }"
+proof - 
+  have "supp c - { atom z } \<union> supp b = supp c1 - { atom z1 } \<union> supp b1" using \<tau>.supp assms
+    by (metis list.set(1) list.simps(15) sup_bot.right_neutral supp_b_empty)
+  moreover have "supp b = supp b1" using assms  \<tau>.eq_iff by simp
+  moreover have "atom z1 \<notin> supp b1 \<and> atom z \<notin> supp b" using  supp_b_empty by simp
+  ultimately show ?thesis
+    by (metis \<tau>.eq_iff \<tau>.supp assms b.supp(1) list.set(1) list.set(2) sup_bot.right_neutral)
+qed
+
+lemma fresh_t_eq: 
+  fixes x::x
+  assumes  "(\<lbrace> z : b  | c \<rbrace>) = (\<lbrace> zz : b | cc \<rbrace>)" and "atom x \<sharp> c" and "x \<noteq> zz"
+  shows "atom x \<sharp> cc"
+proof - 
+  have "supp c - { atom z } \<union> supp b = supp cc - { atom zz } \<union> supp b" using \<tau>.supp assms
+    by (metis list.set(1) list.simps(15) sup_bot.right_neutral supp_b_empty)
+  moreover have "atom x \<notin> supp c" using assms fresh_def by blast
+  ultimately have "atom x \<notin> supp cc - { atom zz } \<union> supp b" by force
+  hence "atom x \<notin> supp cc" using assms by simp
+  thus ?thesis using fresh_def by auto
+qed
+
+section \<open>Mutable Variable Context\<close>
+
+nominal_function subst_dv :: "\<Delta> \<Rightarrow> x \<Rightarrow> v \<Rightarrow> \<Delta>" where
+  "subst_dv  DNil x v = DNil"
+| "subst_dv ((u,t) #\<^sub>\<Delta> \<Delta>) x v  = ((u,t[x::=v]\<^sub>\<tau>\<^sub>v) #\<^sub>\<Delta> (subst_dv \<Delta> x v ))"
+       apply (simp add: eqvt_def subst_dv_graph_aux_def,auto )
+  using delete_aux.elims by (metis \<Delta>.exhaust surj_pair)
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_dv_abbrev :: "\<Delta> \<Rightarrow> x \<Rightarrow> v \<Rightarrow> \<Delta>" ("_[_::=_]\<^sub>\<Delta>\<^sub>v" [1000,50,50] 1000)
+  where 
+    "\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<equiv> subst_dv \<Delta> x v " 
+
+nominal_function dmap :: "(u*\<tau> \<Rightarrow> u*\<tau>) \<Rightarrow> \<Delta> \<Rightarrow> \<Delta>" where
+  "dmap f DNil  = DNil"
+| "dmap  f ((u,t)#\<^sub>\<Delta>\<Delta>)  = (f (u,t) #\<^sub>\<Delta> (dmap f \<Delta> ))"
+       apply (simp add: eqvt_def dmap_graph_aux_def,auto )
+  using delete_aux.elims by (metis \<Delta>.exhaust surj_pair)
+nominal_termination (eqvt) by lexicographic_order
+
+lemma subst_dv_iff:
+  "\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v = dmap (\<lambda>(u,t). (u, t[x::=v]\<^sub>\<tau>\<^sub>v)) \<Delta>"
+  by(induct \<Delta>, auto)
+
+lemma size_subst_dv [simp]: "size ( subst_dv G i x) \<le> size G"
+  by (induct G,auto) 
+
+lemma forget_subst_dv [simp]: "atom a \<sharp> G \<Longrightarrow> subst_dv G a x = G"
+  apply (induct G ,auto) 
+  using fresh_DCons fresh_PairD(1) not_self_fresh apply fastforce
+  apply (simp add: fresh_DCons)+
+  done
+
+lemma subst_dv_member:
+  assumes "(u,\<tau>) \<in> setD \<Delta>"
+  shows  "(u, \<tau>[x::=v]\<^sub>\<tau>\<^sub>v) \<in> setD (\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v)"
+  using assms  by(induct \<Delta> rule: \<Delta>_induct,auto)
+
+lemma fresh_subst_dv:
+  fixes x::x
+  assumes "atom xa \<sharp> \<Delta>" and "atom xa \<sharp> v"
+  shows "atom xa \<sharp>\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v" 
+  using assms proof(induct \<Delta> rule:\<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u t  \<Delta>)
+  then show ?case using subst_dv.simps  subst_v_\<tau>_def fresh_DCons fresh_Pair by simp
+qed
+
+lemma fresh_subst_dv_if:
+  fixes j::atom and i::x and  x::v and t::\<Delta>
+  assumes "j \<sharp> t \<and> j \<sharp> x" 
+  shows  "(j \<sharp> subst_dv t i x)"
+  using assms proof(induct t rule: \<Delta>_induct)
+  case DNil
+  then show ?case using subst_gv.simps fresh_GNil by auto
+next
+  case (DCons u' t'  D')
+  then show ?case unfolding subst_dv.simps using fresh_DCons fresh_subst_tv_if fresh_Pair by metis
+qed
+
+section \<open>Statements\<close>
+
+text \<open> Using ideas from proofs at top of AFP/Launchbury/Substitution.thy.
+       Subproofs borrowed from there; hence the apply style proofs. \<close>
+
+nominal_function (default "case_sum (\<lambda>x. Inl undefined) (case_sum (\<lambda>x. Inl undefined) (\<lambda>x. Inr undefined))")
+  subst_sv :: "s \<Rightarrow> x \<Rightarrow> v  \<Rightarrow> s"
+  and subst_branchv :: "branch_s \<Rightarrow> x \<Rightarrow> v  \<Rightarrow> branch_s" 
+  and subst_branchlv :: "branch_list \<Rightarrow> x \<Rightarrow> v \<Rightarrow> branch_list" where
+  "subst_sv ( (AS_val v') ) x v = (AS_val (subst_vv v' x v  ))"
+| "atom y \<sharp> (x,v) \<Longrightarrow> subst_sv  (AS_let y  e s) x v = (AS_let y  (e[x::=v]\<^sub>e\<^sub>v) (subst_sv s x v ))"  
+| "atom y \<sharp> (x,v) \<Longrightarrow> subst_sv (AS_let2 y t s1 s2) x v = (AS_let2 y (t[x::=v]\<^sub>\<tau>\<^sub>v) (subst_sv s1 x v ) (subst_sv s2 x v ))"  
+| " subst_sv (AS_match v'  cs) x v = AS_match  (v'[x::=v]\<^sub>v\<^sub>v)  (subst_branchlv cs x v )"
+| "subst_sv (AS_assign y v') x v = AS_assign y (subst_vv v' x v )"
+| "subst_sv ( (AS_if v' s1 s2) ) x v = (AS_if (subst_vv v' x v ) (subst_sv s1 x v ) (subst_sv s2 x v ) )"  
+| "atom u \<sharp> (x,v) \<Longrightarrow> subst_sv (AS_var u \<tau> v' s) x v = AS_var u (subst_tv \<tau> x v ) (subst_vv v' x v ) (subst_sv s x v ) "
+| "subst_sv (AS_while s1 s2) x v = AS_while (subst_sv s1 x v ) (subst_sv s2 x v )"
+| "subst_sv (AS_seq s1 s2) x v = AS_seq (subst_sv s1 x v ) (subst_sv s2 x v )" 
+| "subst_sv (AS_assert c s) x v = AS_assert (subst_cv c x v) (subst_sv s x v)"
+| "atom x1 \<sharp> (x,v) \<Longrightarrow>  subst_branchv (AS_branch dc x1 s1 ) x v  = AS_branch dc x1 (subst_sv s1 x v )" 
+
+| "subst_branchlv (AS_final cs) x v = AS_final (subst_branchv  cs x v )"
+| "subst_branchlv (AS_cons cs css) x v = AS_cons (subst_branchv cs x v ) (subst_branchlv css x v )"
+                      apply (auto,simp add: eqvt_def subst_sv_subst_branchv_subst_branchlv_graph_aux_def )
+proof(goal_cases)
+
+  have eqvt_at_proj: "\<And> s xa va . eqvt_at subst_sv_subst_branchv_subst_branchlv_sumC (Inl (s, xa, va)) \<Longrightarrow> 
+           eqvt_at (\<lambda>a. projl (subst_sv_subst_branchv_subst_branchlv_sumC (Inl a))) (s, xa, va)"
+    apply(simp add: eqvt_at_def)
+    apply(rule)
+    apply(subst Projl_permute)
+     apply(thin_tac _)+
+     apply (simp add: subst_sv_subst_branchv_subst_branchlv_sumC_def)
+     apply (simp add: THE_default_def)
+     apply (case_tac "Ex1 (subst_sv_subst_branchv_subst_branchlv_graph (Inl (s,xa,va)))")
+      apply simp
+      apply(auto)[1]
+      apply (erule_tac x="x" in allE)
+      apply simp
+      apply(cases rule: subst_sv_subst_branchv_subst_branchlv_graph.cases)    
+                   apply(assumption)
+                  apply(rule_tac x="Sum_Type.projl x" in exI,clarify,rule the1_equality,blast,simp (no_asm) only: sum.sel)+
+        apply blast +
+
+    apply(simp)+      
+    done
+
+  {
+    case (1 P x')    
+    then show ?case proof(cases x')
+      case (Inl a) thus P 
+      proof(cases a)
+        case (fields aa bb cc)
+        thus P using Inl 1 s_branch_s_branch_list.strong_exhaust fresh_star_insert by metis
+      qed
+    next
+      case (Inr b) thus P
+      proof(cases b)
+        case (Inl a) thus P proof(cases a)
+          case (fields aa bb cc)
+          then show ?thesis  using Inr Inl 1 s_branch_s_branch_list.strong_exhaust fresh_star_insert by metis
+        qed
+      next
+        case Inr2: (Inr b) thus P proof(cases b)
+          case (fields aa bb cc)
+          then show ?thesis  using Inr Inr2 1 s_branch_s_branch_list.strong_exhaust fresh_star_insert by metis
+        qed
+      qed
+    qed
+  next
+    case (2 y s ya xa va sa c)
+    thus ?case using eqvt_triple eqvt_at_proj by blast
+  next
+    case (3 y s2 ya xa va s1a s2a c)
+    thus ?case using eqvt_triple eqvt_at_proj by blast
+  next
+    case (4 u xa va s ua sa c)
+    moreover have "atom u \<sharp> (xa, va) \<and> atom ua \<sharp> (xa, va)" 
+      using fresh_Pair u_fresh_xv by auto
+    ultimately show ?case using eqvt_triple[of u xa va ua s sa]  subst_sv_def eqvt_at_proj by metis
+  next
+    case (5 x1 s1 x1a xa va s1a c)
+    thus ?case using eqvt_triple eqvt_at_proj by blast
+  }
+qed
+nominal_termination (eqvt) by lexicographic_order
+
+abbreviation 
+  subst_sv_abbrev :: "s \<Rightarrow> x \<Rightarrow> v \<Rightarrow> s" ("_[_::=_]\<^sub>s\<^sub>v" [1000,50,50] 1000)
+  where 
+    "s[x::=v]\<^sub>s\<^sub>v  \<equiv> subst_sv s x v" 
+
+abbreviation 
+  subst_branchv_abbrev :: "branch_s \<Rightarrow> x \<Rightarrow> v \<Rightarrow> branch_s" ("_[_::=_]\<^sub>s\<^sub>v" [1000,50,50] 1000)
+  where 
+    "s[x::=v]\<^sub>s\<^sub>v  \<equiv> subst_branchv s x v" 
+
+lemma size_subst_sv [simp]:  "size (subst_sv A i x ) = size A" and  "size (subst_branchv B i x ) = size B"  and  "size (subst_branchlv C i x ) = size C"
+  by(nominal_induct A and B and C avoiding: i x rule: s_branch_s_branch_list.strong_induct,auto)
+
+lemma forget_subst_sv [simp]: shows  "atom a \<sharp> A \<Longrightarrow> subst_sv A a x = A" and "atom a \<sharp> B \<Longrightarrow> subst_branchv B a x = B" and "atom a \<sharp> C \<Longrightarrow> subst_branchlv C a x  = C"
+  by (nominal_induct A and B and C avoiding: a x rule: s_branch_s_branch_list.strong_induct,auto simp: fresh_at_base)
+
+lemma subst_sv_id [simp]: "subst_sv A a (V_var a) = A" and "subst_branchv B a (V_var a) = B" and  "subst_branchlv C a (V_var a)  = C"
+proof(nominal_induct A and B and C avoiding: a  rule: s_branch_s_branch_list.strong_induct) 
+  case (AS_let x option e s)
+  then show ?case 
+    by (metis (no_types, lifting) fresh_Pair not_None_eq subst_ev_id subst_sv.simps(2) subst_sv.simps(3) subst_tv_id v.fresh(2))
+next
+  case (AS_match v branch_s)
+  then show ?case using fresh_Pair not_None_eq subst_ev_id subst_sv.simps subst_sv.simps subst_tv_id v.fresh subst_vv_id
+    by metis 
+qed(auto)+ 
+
+lemma fresh_subst_sv_if_rl:
+  shows 
+    "(atom x \<sharp> s \<and> j \<sharp> s) \<or> (j \<sharp> v \<and> (j \<sharp> s \<or> j = atom x)) \<Longrightarrow> j \<sharp> (subst_sv s x v )" and
+    "(atom x \<sharp> cs \<and> j \<sharp> cs) \<or> (j \<sharp> v \<and> (j \<sharp> cs \<or> j = atom x)) \<Longrightarrow> j \<sharp> (subst_branchv cs x v)" and
+    "(atom x \<sharp> css \<and> j \<sharp> css) \<or> (j \<sharp> v \<and> (j \<sharp> css \<or> j = atom x)) \<Longrightarrow> j \<sharp> (subst_branchlv css x v )" 
+    apply(nominal_induct s and cs and css avoiding: v x rule: s_branch_s_branch_list.strong_induct)
+  using pure_fresh by force+
+
+lemma fresh_subst_sv_if_lr:
+  shows  "j \<sharp> (subst_sv s x v) \<Longrightarrow> (atom x \<sharp> s \<and> j \<sharp> s) \<or> (j \<sharp> v \<and> (j \<sharp> s \<or> j = atom x))" and
+    "j \<sharp> (subst_branchv cs x v) \<Longrightarrow> (atom x \<sharp> cs \<and> j \<sharp> cs) \<or> (j \<sharp> v \<and> (j \<sharp> cs \<or> j = atom x))" and       
+    "j \<sharp> (subst_branchlv css x v ) \<Longrightarrow> (atom x \<sharp> css \<and> j \<sharp> css) \<or> (j \<sharp> v \<and> (j \<sharp> css \<or> j = atom x))"
+proof(nominal_induct s and cs and css avoiding: v x rule: s_branch_s_branch_list.strong_induct)
+  case (AS_branch list x s )
+  then show ?case using s_branch_s_branch_list.fresh fresh_Pair list.distinct(1) list.set_cases pure_fresh set_ConsD subst_branchv.simps by metis
+next
+  case (AS_let y e s')
+  thus ?case proof(cases "atom x \<sharp>  (AS_let y e s')")
+    case True
+    hence "subst_sv (AS_let y  e s') x v  =  (AS_let y e s')" using forget_subst_sv by simp
+    hence "j \<sharp>  (AS_let y  e s')" using AS_let by argo
+    then show ?thesis using True by blast
+  next
+    case False
+    have "subst_sv (AS_let y  e s') x v  = AS_let y  (e[x::=v]\<^sub>e\<^sub>v) (s'[x::=v]\<^sub>s\<^sub>v)" using subst_sv.simps(2) AS_let by force
+    hence "((j \<sharp> s'[x::=v]\<^sub>s\<^sub>v \<or> j \<in> set [atom y]) \<and> j \<sharp> None \<and> j \<sharp> e[x::=v]\<^sub>e\<^sub>v)" using s_branch_s_branch_list.fresh AS_let 
+      by (simp add: fresh_None)
+    then show ?thesis using  AS_let  fresh_None fresh_subst_ev_if list.discI list.set_cases s_branch_s_branch_list.fresh set_ConsD 
+      by metis
+  qed
+next
+  case (AS_let2 y \<tau> s1 s2)
+  thus ?case proof(cases "atom x \<sharp>  (AS_let2 y \<tau> s1 s2)")
+    case True
+    hence "subst_sv  (AS_let2 y \<tau> s1 s2)  x v =  (AS_let2 y \<tau> s1 s2)" using forget_subst_sv by simp
+    hence "j \<sharp>  (AS_let2 y \<tau> s1 s2)" using AS_let2 by argo
+    then show ?thesis using True by blast
+  next
+    case False
+    have "subst_sv (AS_let2 y \<tau> s1 s2) x v  = AS_let2 y (\<tau>[x::=v]\<^sub>\<tau>\<^sub>v) (s1[x::=v]\<^sub>s\<^sub>v) (s2[x::=v]\<^sub>s\<^sub>v)" using subst_sv.simps AS_let2 by force
+    then show ?thesis using  AS_let2
+        fresh_subst_tv_if list.discI list.set_cases s_branch_s_branch_list.fresh(4) set_ConsD by auto
+  qed
+qed(auto)+
+
+lemma fresh_subst_sv_if[simp]:
+  fixes x::x and v::v
+  shows "j \<sharp> (subst_sv s x v) \<longleftrightarrow> (atom x \<sharp> s \<and> j \<sharp> s) \<or> (j \<sharp> v \<and> (j \<sharp> s \<or> j = atom x))" and
+    "j \<sharp> (subst_branchv cs x v) \<longleftrightarrow> (atom x \<sharp> cs \<and> j \<sharp> cs) \<or> (j \<sharp> v \<and> (j \<sharp> cs \<or> j = atom x))"
+  using fresh_subst_sv_if_lr fresh_subst_sv_if_rl by metis+
+
+lemma subst_sv_commute [simp]:
+  fixes A::s and t::v and j::x and i::x
+  shows  "atom j \<sharp> A \<Longrightarrow> (subst_sv (subst_sv A i t)  j u ) = subst_sv A i (subst_vv t j u )" and
+    "atom j \<sharp> B \<Longrightarrow> (subst_branchv  (subst_branchv B i t ) j u ) = subst_branchv B i (subst_vv t j u )" and
+    "atom j \<sharp> C \<Longrightarrow> (subst_branchlv  (subst_branchlv C i t) j u ) = subst_branchlv C i (subst_vv t j u   ) "
+    apply(nominal_induct A and B and C avoiding: i j t u rule: s_branch_s_branch_list.strong_induct) 
+  by(auto simp: fresh_at_base)
+
+lemma c_eq_perm:
+  assumes "( (atom z)  \<rightleftharpoons> (atom z') )  \<bullet> c = c'" and "atom z'  \<sharp> c"
+  shows "\<lbrace> z : b | c \<rbrace> = \<lbrace> z' : b | c' \<rbrace>"
+  using \<tau>.eq_iff Abs1_eq_iff(3) 
+  by (metis Nominal2_Base.swap_commute assms(1) assms(2) flip_def swap_fresh_fresh)
+
+lemma subst_sv_flip:
+  fixes s::s and sa::s and v'::v
+  assumes "atom c \<sharp> (s, sa)" and "atom c \<sharp> (v',x, xa, s, sa)" "atom x \<sharp> v'" and "atom xa \<sharp> v'" and "(x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa" 
+  shows "s[x::=v']\<^sub>s\<^sub>v = sa[xa::=v']\<^sub>s\<^sub>v"
+proof - 
+  have "atom x \<sharp> (s[x::=v']\<^sub>s\<^sub>v)" and xafr: "atom xa \<sharp> (sa[xa::=v']\<^sub>s\<^sub>v)" 
+    and  "atom c \<sharp> ( s[x::=v']\<^sub>s\<^sub>v, sa[xa::=v']\<^sub>s\<^sub>v)" using assms using  fresh_subst_sv_if assms  by( blast+ ,force)
+
+  hence "s[x::=v']\<^sub>s\<^sub>v = (x \<leftrightarrow> c) \<bullet> (s[x::=v']\<^sub>s\<^sub>v)"  by (simp add: flip_fresh_fresh fresh_Pair)
+  also have " ... = ((x \<leftrightarrow> c) \<bullet> s)[ ((x \<leftrightarrow> c) \<bullet> x) ::= ((x \<leftrightarrow> c) \<bullet> v') ]\<^sub>s\<^sub>v" using subst_sv_subst_branchv_subst_branchlv.eqvt  by blast
+  also have "... = ((xa \<leftrightarrow> c) \<bullet> sa)[ ((x \<leftrightarrow> c) \<bullet> x) ::= ((x \<leftrightarrow> c) \<bullet> v') ]\<^sub>s\<^sub>v" using assms by presburger
+  also have "... = ((xa \<leftrightarrow> c) \<bullet> sa)[ ((xa \<leftrightarrow> c) \<bullet> xa) ::= ((xa \<leftrightarrow> c) \<bullet> v') ]\<^sub>s\<^sub>v" using assms 
+    by (metis flip_at_simps(1) flip_fresh_fresh fresh_PairD(1))
+  also have "... =  (xa \<leftrightarrow> c) \<bullet> (sa[xa::=v']\<^sub>s\<^sub>v)" using subst_sv_subst_branchv_subst_branchlv.eqvt  by presburger
+  also have "... = sa[xa::=v']\<^sub>s\<^sub>v" using xafr assms by (simp add: flip_fresh_fresh fresh_Pair)
+  finally show ?thesis by simp
+qed
+
+lemma if_type_eq:
+  fixes \<Gamma>::\<Gamma> and v::v and z1::x
+  assumes "atom z1' \<sharp> (v, ca, (x, b, c) #\<^sub>\<Gamma> \<Gamma>,  (CE_val v  ==  CE_val (V_lit ll) IMP  ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v ))" and "atom z1 \<sharp> v" 
+    and "atom z1 \<sharp> (za,ca)" and "atom z1' \<sharp> (za,ca)"
+  shows "(\<lbrace> z1' : ba  | CE_val v  ==  CE_val (V_lit ll)   IMP  ca[za::=[z1']\<^sup>v]\<^sub>c\<^sub>v  \<rbrace>) = \<lbrace> z1 : ba  | CE_val v  ==  CE_val (V_lit ll) IMP  ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v  \<rbrace>"
+proof -
+  have "atom z1' \<sharp> (CE_val v  ==  CE_val (V_lit ll) IMP  ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v )" using assms fresh_prod4 by blast
+  moreover hence "(CE_val v  ==  CE_val (V_lit ll)   IMP  ca[za::=[z1']\<^sup>v]\<^sub>c\<^sub>v) = (z1' \<leftrightarrow> z1) \<bullet> (CE_val v  ==  CE_val (V_lit ll)   IMP  ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v )"
+  proof -
+    have "(z1' \<leftrightarrow> z1) \<bullet> (CE_val v  ==  CE_val (V_lit ll)   IMP  ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v ) = ( (z1' \<leftrightarrow> z1) \<bullet> (CE_val v  ==  CE_val (V_lit ll)) IMP  ((z1' \<leftrightarrow> z1) \<bullet> ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v ))"
+      by auto
+    also have "... = ((CE_val v  ==  CE_val (V_lit ll))   IMP  ((z1' \<leftrightarrow> z1) \<bullet> ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v ))"
+      using \<open>atom z1 \<sharp> v\<close> assms 
+      by (metis (mono_tags) \<open>atom z1' \<sharp> (CE_val v == CE_val (V_lit ll) IMP ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v )\<close> c.fresh(6) c.fresh(7) ce.fresh(1) flip_at_simps(2) flip_fresh_fresh fresh_at_base_permute_iff fresh_def supp_l_empty v.fresh(1))
+    also have "... =  ((CE_val v  ==  CE_val (V_lit ll))   IMP  (ca[za::=[z1']\<^sup>v]\<^sub>c\<^sub>v ))"
+      using assms   by fastforce
+    finally show ?thesis by auto
+  qed
+  ultimately show ?thesis    
+    using \<tau>.eq_iff Abs1_eq_iff(3)[of z1' "CE_val v  ==  CE_val (V_lit ll) IMP  ca[za::=[z1']\<^sup>v]\<^sub>c\<^sub>v" 
+        z1 "CE_val v  ==  CE_val (V_lit ll)   IMP ca[za::=[z1]\<^sup>v]\<^sub>c\<^sub>v"] by blast
+qed 
+
+lemma subst_sv_var_flip:
+  fixes x::x and s::s and z::x
+  shows "atom x \<sharp> s \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> s) = s[z::=[x]\<^sup>v]\<^sub>s\<^sub>v" and 
+    "atom x \<sharp> cs \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> cs) = subst_branchv cs z [x]\<^sup>v" and
+    "atom x \<sharp> css \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> css) = subst_branchlv css z [x]\<^sup>v"
+    apply(nominal_induct s and cs and css avoiding: z x rule: s_branch_s_branch_list.strong_induct)
+  using [[simproc del: alpha_lst]]
+              apply (auto  ) (* This unpacks subst, perm *)
+  using  subst_tv_var_flip  flip_fresh_fresh v.fresh s_branch_s_branch_list.fresh 
+    subst_v_\<tau>_def subst_v_v_def subst_vv_var_flip subst_v_e_def subst_ev_var_flip pure_fresh   apply auto 
+     defer 1 (* Sometimes defering hard goals to the end makes it easier to finish *)
+  using x_fresh_u   apply blast (* Next two involve u and flipping with x *)
+    defer 1
+  using x_fresh_u   apply blast
+   defer 1
+  using x_fresh_u Abs1_eq_iff'(3) flip_fresh_fresh 
+   apply (simp add: subst_v_c_def)
+  using x_fresh_u Abs1_eq_iff'(3) flip_fresh_fresh  
+  by (simp add: flip_fresh_fresh)
+
+instantiation s :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_sv"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::s
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    using fresh_subst_sv_if subst_v_s_def by auto
+
+  fix a::x and tm::s and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+    using forget_subst_sv subst_v_s_def by simp
+
+  fix a::x and tm::s
+  show "subst_v tm a (V_var a) = tm" using subst_sv_id  subst_v_s_def by simp
+
+  fix p::perm and x1::x and v::v and t1::s
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    using subst_sv_commute  subst_v_s_def by simp
+
+  fix x::x and c::s and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    using subst_sv_var_flip subst_v_s_def by simp
+
+  fix x::x and c::s and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    using subst_sv_var_flip subst_v_s_def by simp
+qed
+end
+
+section \<open>Type Definition\<close>
+
+nominal_function subst_ft_v :: "fun_typ \<Rightarrow> x \<Rightarrow> v \<Rightarrow> fun_typ" where
+  "atom z \<sharp> (x,v) \<Longrightarrow> subst_ft_v ( AF_fun_typ z b c t (s::s)) x v = AF_fun_typ z b c[x::=v]\<^sub>c\<^sub>v t[x::=v]\<^sub>\<tau>\<^sub>v s[x::=v]\<^sub>s\<^sub>v"
+     apply(simp add: eqvt_def subst_ft_v_graph_aux_def )
+    apply(simp add:fun_typ.strong_exhaust )
+   apply(auto) 
+    apply(rule_tac y=a and c="(aa,b)" in fun_typ.strong_exhaust)
+    apply (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
+
+proof(goal_cases)
+  case (1 z xa va c t s za ca ta sa cb)
+  hence  "c[z::=[ cb ]\<^sup>v]\<^sub>c\<^sub>v = ca[za::=[ cb ]\<^sup>v]\<^sub>c\<^sub>v" 
+    by (metis flip_commute subst_cv_var_flip)
+  hence  "c[z::=[ cb ]\<^sup>v]\<^sub>c\<^sub>v[xa::=va]\<^sub>c\<^sub>v = ca[za::=[ cb ]\<^sup>v]\<^sub>c\<^sub>v[xa::=va]\<^sub>c\<^sub>v" by auto
+  then show ?case using subst_cv_commute atom_eq_iff fresh_atom fresh_atom_at_base subst_cv_commute_full v.fresh 
+    using 1 subst_cv_var_flip  flip_commute by metis
+next
+  case (2 z xa va c t s za ca ta sa cb)
+  hence  "t[z::=[ cb ]\<^sup>v]\<^sub>\<tau>\<^sub>v = ta[za::=[ cb ]\<^sup>v]\<^sub>\<tau>\<^sub>v" by metis
+  hence  "t[z::=[ cb ]\<^sup>v]\<^sub>\<tau>\<^sub>v[xa::=va]\<^sub>\<tau>\<^sub>v = ta[za::=[ cb ]\<^sup>v]\<^sub>\<tau>\<^sub>v[xa::=va]\<^sub>\<tau>\<^sub>v" by auto
+  then show ?case using subst_tv_commute_full 2 
+    by (metis atom_eq_iff fresh_atom fresh_atom_at_base v.fresh(2))
+qed
+
+nominal_termination (eqvt) by lexicographic_order
+
+nominal_function subst_ftq_v :: "fun_typ_q \<Rightarrow> x \<Rightarrow> v \<Rightarrow> fun_typ_q" where
+  "atom bv \<sharp> (x,v) \<Longrightarrow> subst_ftq_v (AF_fun_typ_some bv ft) x v = (AF_fun_typ_some bv (subst_ft_v ft x v))" 
+|  "subst_ftq_v (AF_fun_typ_none  ft) x v = (AF_fun_typ_none (subst_ft_v ft x v))" 
+       apply(simp add: eqvt_def subst_ftq_v_graph_aux_def )
+      apply(simp add:fun_typ_q.strong_exhaust )
+     apply(auto) 
+   apply(rule_tac y=a and c="(aa,b)" in fun_typ_q.strong_exhaust)
+    apply (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
+proof(goal_cases)
+  case (1 bv ft bva fta xa va c)
+  then show ?case using subst_ft_v.simps  by (simp add: flip_fresh_fresh)
+qed
+nominal_termination (eqvt) by lexicographic_order
+
+lemma size_subst_ft[simp]:  "size (subst_ft_v A x v) = size A" 
+  by(nominal_induct A  avoiding: x v rule: fun_typ.strong_induct,auto)
+
+lemma forget_subst_ft [simp]: shows  "atom x \<sharp> A \<Longrightarrow> subst_ft_v A x a = A" 
+  by (nominal_induct A  avoiding: a x rule: fun_typ.strong_induct,auto simp: fresh_at_base)
+
+lemma subst_ft_id [simp]: "subst_ft_v A a (V_var a)  = A"
+  by(nominal_induct A  avoiding: a  rule: fun_typ.strong_induct,auto) 
+
+instantiation fun_typ :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_ft_v"
+
+instance proof
+
+  fix j::atom and i::x and  x::v and t::fun_typ
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    apply(nominal_induct t avoiding: i x rule:fun_typ.strong_induct)
+    apply(simp only: subst_v_fun_typ_def subst_ft_v.simps )
+    using fun_typ.fresh fresh_subst_v_if apply simp
+    by auto
+
+  fix a::x and tm::fun_typ and x::v
+  show "atom a \<sharp> tm \<Longrightarrow> subst_v tm a x  = tm"
+  proof(nominal_induct tm avoiding: a x rule:fun_typ.strong_induct)
+    case (AF_fun_typ x1a x2a x3a x4a x5a)
+    then show ?case unfolding subst_ft_v.simps subst_v_fun_typ_def fun_typ.fresh  using forget_subst_v subst_ft_v.simps subst_v_c_def forget_subst_sv subst_v_\<tau>_def by fastforce
+  qed
+
+  fix a::x and tm::fun_typ
+  show "subst_v tm a (V_var a) = tm" 
+  proof(nominal_induct tm avoiding: a x rule:fun_typ.strong_induct)
+    case (AF_fun_typ x1a x2a x3a x4a x5a)
+    then show ?case unfolding subst_ft_v.simps subst_v_fun_typ_def fun_typ.fresh  using forget_subst_v subst_ft_v.simps subst_v_c_def forget_subst_sv subst_v_\<tau>_def by fastforce
+  qed
+
+  fix p::perm and x1::x and v::v and t1::fun_typ
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+  proof(nominal_induct t1 avoiding: x1 v rule:fun_typ.strong_induct)
+    case (AF_fun_typ x1a x2a x3a x4a x5a)
+    then show ?case unfolding subst_ft_v.simps subst_v_fun_typ_def fun_typ.fresh  using forget_subst_v subst_ft_v.simps subst_v_c_def forget_subst_sv subst_v_\<tau>_def by fastforce
+  qed
+
+  fix x::x and c::fun_typ and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    apply(nominal_induct c avoiding: x z rule:fun_typ.strong_induct)
+    by (auto simp add: subst_v_c_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_def)
+
+  fix x::x and c::fun_typ and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    apply(nominal_induct c avoiding: z x v rule:fun_typ.strong_induct)
+    apply auto
+    by (auto simp add: subst_v_c_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_def )
+qed
+end
+
+instantiation fun_typ_q :: has_subst_v
+begin
+
+definition 
+  "subst_v = subst_ftq_v"
+
+instance proof
+  fix j::atom and i::x and  x::v and t::fun_typ_q
+  show  "(j \<sharp> subst_v t i x) = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))"
+    apply(nominal_induct t avoiding: i x rule:fun_typ_q.strong_induct,auto)
+                   apply(auto simp add: subst_v_fun_typ_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_q_def fresh_subst_v_if )    
+    by (metis (no_types) fresh_subst_v_if subst_v_fun_typ_def)+
+
+  fix i::x and t::fun_typ_q and x::v
+  show "atom i \<sharp> t \<Longrightarrow> subst_v t i x  = t"
+    apply(nominal_induct t avoiding: i x rule:fun_typ_q.strong_induct,auto)
+    by(auto simp add: subst_v_fun_typ_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_q_def fresh_subst_v_if )    
+
+  fix i::x and t::fun_typ_q
+  show "subst_v t i (V_var i) = t" using subst_cv_id  subst_v_fun_typ_def  
+    apply(nominal_induct t avoiding: i x rule:fun_typ_q.strong_induct,auto)
+    by(auto simp add: subst_v_fun_typ_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_q_def fresh_subst_v_if )  
+
+  fix p::perm and x1::x and v::v and t1::fun_typ_q
+  show "p \<bullet> subst_v t1 x1 v  = subst_v  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
+    apply(nominal_induct t1 avoiding: v x1 rule:fun_typ_q.strong_induct,auto)
+    by(auto simp add: subst_v_fun_typ_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_q_def fresh_subst_v_if )  
+
+  fix x::x and c::fun_typ_q and z::x
+  show "atom x \<sharp> c \<Longrightarrow> ((x \<leftrightarrow> z) \<bullet> c) = c[z::=[x]\<^sup>v]\<^sub>v"
+    apply(nominal_induct c avoiding: x z rule:fun_typ_q.strong_induct,auto)
+    by(auto simp add: subst_v_fun_typ_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_q_def fresh_subst_v_if )  
+
+  fix x::x and c::fun_typ_q and z::x
+  show  "atom x \<sharp> c \<Longrightarrow> c[z::=[x]\<^sup>v]\<^sub>v[x::=v]\<^sub>v = c[z::=v]\<^sub>v"
+    apply(nominal_induct c avoiding: z x v rule:fun_typ_q.strong_induct,auto)
+     apply(auto simp add: subst_v_fun_typ_def subst_v_s_def subst_v_\<tau>_def subst_v_fun_typ_q_def fresh_subst_v_if )  
+    by (metis subst_v_fun_typ_def flip_bv_x_cancel subst_ft_v.eqvt subst_v_simple_commute v.perm_simps )+
+qed
+
+end
+
+section \<open>Variable Context\<close>
+
+lemma subst_dv_fst_eq:
+  "fst ` setD (\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v) = fst ` setD \<Delta>" 
+  by(induct \<Delta> rule: \<Delta>_induct,simp,force)
+
+lemma subst_gv_member_iff:
+  fixes x'::x and x::x and v::v and c'::c
+  assumes "(x',b',c') \<in> toSet \<Gamma>" and "atom x \<notin> atom_dom \<Gamma>" 
+  shows "(x',b',c'[x::=v]\<^sub>c\<^sub>v) \<in> toSet \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v"
+proof -
+  have "x' \<noteq> x" using assms fresh_dom_free2 by metis
+  then show ?thesis  using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+    case GNil
+    then show ?case by auto
+  next
+    case (GCons x1 b1 c1 \<Gamma>')
+    show ?case proof(cases "(x',b',c') = (x1,b1,c1)")
+      case True
+      hence "((x1, b1, c1) #\<^sub>\<Gamma> \<Gamma>')[x::=v]\<^sub>\<Gamma>\<^sub>v = ((x1, b1, c1[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v))"  using subst_gv.simps  \<open>x'\<noteq>x\<close> by auto
+      then show ?thesis using True by auto
+    next
+      case False
+      have "x1\<noteq>x" using fresh_def fresh_GCons fresh_Pair supp_at_base GCons fresh_dom_free2 by auto
+      hence "(x', b', c') \<in> toSet \<Gamma>'" using GCons False toSet.simps by auto
+      moreover have "atom x \<notin> atom_dom \<Gamma>'" using fresh_GCons GCons dom.simps toSet.simps by simp
+      ultimately have  "(x', b', c'[x::=v]\<^sub>c\<^sub>v) \<in> toSet \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v" using GCons by auto
+      hence "(x', b', c'[x::=v]\<^sub>c\<^sub>v) \<in> toSet ((x1, b1, c1[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v))" by auto
+      then show ?thesis using subst_gv.simps \<open>x1\<noteq>x\<close> by auto
+    qed
+  qed
+qed
+
+lemma fresh_subst_gv_if:
+  fixes j::atom and i::x and  x::v and t::\<Gamma>
+  assumes "j \<sharp> t \<and> j \<sharp> x" 
+  shows  "(j \<sharp> subst_gv t i x)"
+  using assms proof(induct t rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using subst_gv.simps fresh_GNil by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  then show ?case unfolding subst_gv.simps using fresh_GCons fresh_subst_cv_if by auto
+qed
+
+section \<open>Lookup\<close>
+
+lemma set_GConsD: "y \<in> toSet (x #\<^sub>\<Gamma> xs) \<Longrightarrow> y=x \<or> y \<in> toSet xs"
+  by auto
+
+lemma  subst_g_assoc_cons:
+  assumes "x \<noteq> x'"
+  shows "(((x', b', c') #\<^sub>\<Gamma> \<Gamma>')[x::=v]\<^sub>\<Gamma>\<^sub>v @ G) = ((x', b', c'[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v) @ G))"
+  using subst_gv.simps append_g.simps assms by auto
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/IVSubstTypingL.thy b/thys/MiniSail/IVSubstTypingL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/IVSubstTypingL.thy
@@ -0,0 +1,1534 @@
+(*<*)
+theory IVSubstTypingL
+  imports  SubstMethods ContextSubtypingL
+begin
+  (*>*)
+
+chapter \<open>Immutable Variable Substitution Lemmas\<close>
+text \<open>Lemmas that show that types are preserved, in some way, 
+under immutable variable substitution\<close>
+
+section \<open>Proof Methods\<close>
+
+method subst_mth = (metis  subst_g_inside  infer_e_wf infer_v_wf infer_v_wf)
+
+method subst_tuple_mth uses add = (
+    (unfold fresh_prodN), (simp add: add  )+,
+    (rule,metis fresh_z_subst_g add fresh_Pair ),
+    (metis fresh_subst_dv add fresh_Pair ) )
+
+section \<open>Prelude\<close>
+
+lemma subst_top_eq:
+  "\<lbrace> z : b  | TRUE \<rbrace> = \<lbrace> z : b  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v" 
+proof -
+  obtain z'::x and c' where zeq: "\<lbrace> z : b  | TRUE \<rbrace> = \<lbrace> z' : b | c' \<rbrace> \<and> atom z' \<sharp> (x,v)" using obtain_fresh_z2 b_of.simps by metis
+  hence "\<lbrace> z' : b  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v =  \<lbrace> z' : b | TRUE \<rbrace>" using subst_tv.simps subst_cv.simps by metis
+  moreover have "c' = C_true" using \<tau>.eq_iff Abs1_eq_iff(3) c.fresh flip_fresh_fresh  by (metis zeq) 
+  ultimately show ?thesis using zeq by metis
+qed
+
+lemma wfD_subst:
+  fixes \<tau>\<^sub>1::\<tau> and v::v and \<Delta>::\<Delta> and \<Theta>::\<Theta> and \<Gamma>::\<Gamma>
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>\<^sub>1" and "wfD \<Theta>  \<B> (\<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>))  \<Delta>" and "b_of \<tau>\<^sub>1=b\<^sub>1"
+  shows " \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v"
+proof -
+  have "\<Theta> ; \<B> ; \<Gamma>\<turnstile>\<^sub>w\<^sub>f v : b\<^sub>1" using infer_v_v_wf assms by auto
+  moreover have  "(\<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>"  using subst_g_inside wfD_wf  assms by metis
+  ultimately show ?thesis  using  wf_subst assms by metis
+qed
+
+lemma subst_v_c_of:
+  assumes  "atom xa \<sharp> (v,x)"
+  shows  "c_of t[x::=v]\<^sub>\<tau>\<^sub>v xa = (c_of t xa)[x::=v]\<^sub>c\<^sub>v" 
+  using assms proof(nominal_induct t avoiding: x v xa rule:\<tau>.strong_induct)
+  case (T_refined_type z' b' c')
+  then have " c_of \<lbrace> z' : b'  | c' \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v xa  = c_of \<lbrace> z' : b'  | c'[x::=v]\<^sub>c\<^sub>v \<rbrace> xa" 
+    using subst_tv.simps fresh_Pair by metis
+  also have "... =  c'[x::=v]\<^sub>c\<^sub>v [z'::=V_var xa]\<^sub>c\<^sub>v" using c_of.simps T_refined_type by metis
+  also have "... = c' [z'::=V_var xa]\<^sub>c\<^sub>v[x::=v]\<^sub>c\<^sub>v" 
+    using subst_cv_commute_full[of z' v x "V_var xa" c'] subst_v_c_def T_refined_type fresh_Pair fresh_at_base v.fresh fresh_x_neq by metis
+  finally show ?case using c_of.simps T_refined_type by metis  
+qed
+
+section \<open>Context\<close>
+
+lemma subst_lookup:
+  assumes "Some (b,c) = lookup (\<Gamma>'@((x,b\<^sub>1,c\<^sub>1)#\<^sub>\<Gamma>\<Gamma>)) y" and "x \<noteq> y" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b\<^sub>1,c\<^sub>1)#\<^sub>\<Gamma>\<Gamma>))"
+  shows "\<exists>d. Some (b,d) = lookup ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) y" 
+  using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  hence "Some (b,c) = lookup \<Gamma> y"     by (simp add: assms(1))
+  then show ?case using subst_gv.simps by auto
+next
+  case (GCons x1 b1 c1  \<Gamma>1)
+  show ?case proof(cases "x1 = x")
+    case True
+    hence "atom x \<sharp> (\<Gamma>1 @ (x, b\<^sub>1, c\<^sub>1) #\<^sub>\<Gamma> \<Gamma>)" using GCons wfG_elims(2)
+        append_g.simps  by metis
+    moreover have  "atom x \<in> atom_dom (\<Gamma>1 @ (x, b\<^sub>1, c\<^sub>1) #\<^sub>\<Gamma> \<Gamma>)" by simp
+    ultimately show ?thesis 
+      using forget_subst_gv  not_GCons_self2 subst_gv.simps append_g.simps  
+      by (metis GCons.prems(3) True wfG_cons_fresh2 )
+  next
+    case False
+    hence "((x1,b1,c1) #\<^sub>\<Gamma> \<Gamma>1)[x::=v]\<^sub>\<Gamma>\<^sub>v = (x1,b1,c1[x::=v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>1[x::=v]\<^sub>\<Gamma>\<^sub>v"  using subst_gv.simps by auto
+    then show ?thesis  proof(cases "x1=y")
+      case True
+      then show ?thesis using GCons  using lookup.simps 
+        by (metis \<open>((x1, b1, c1) #\<^sub>\<Gamma> \<Gamma>1)[x::=v]\<^sub>\<Gamma>\<^sub>v = (x1, b1, c1[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>1[x::=v]\<^sub>\<Gamma>\<^sub>v\<close> append_g.simps fst_conv option.inject)
+    next
+      case False
+      then show ?thesis using GCons  using lookup.simps 
+        using \<open>((x1, b1, c1) #\<^sub>\<Gamma> \<Gamma>1)[x::=v]\<^sub>\<Gamma>\<^sub>v = (x1, b1, c1[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>1[x::=v]\<^sub>\<Gamma>\<^sub>v\<close> append_g.simps \<Gamma>.distinct \<Gamma>.inject wfG.simps wfG_elims by metis        
+    qed
+  qed
+qed
+
+section \<open>Validity\<close>
+
+lemma subst_self_valid: 
+  fixes v::v
+  assumes  "\<Theta> ; \<B> ; G \<turnstile> v \<Rightarrow> \<lbrace> z : b | c \<rbrace>" and "atom z \<sharp> v"
+  shows " \<Theta> ; \<B> ; G \<Turnstile> c[z::=v]\<^sub>c\<^sub>v"
+proof - 
+  have "c= (CE_val (V_var z)  ==  CE_val v )" using  infer_v_form2 assms by presburger
+  hence "c[z::=v]\<^sub>c\<^sub>v = (CE_val (V_var z)  ==  CE_val v )[z::=v]\<^sub>c\<^sub>v" by auto
+  also have "... = (((CE_val (V_var z))[z::=v]\<^sub>c\<^sub>e\<^sub>v) ==  ((CE_val v)[z::=v]\<^sub>c\<^sub>e\<^sub>v))" by fastforce
+  also have "... = ((CE_val v) ==  ((CE_val v)[z::=v]\<^sub>c\<^sub>e\<^sub>v))" using subst_cev.simps subst_vv.simps by presburger
+  also have "... = (CE_val v  ==  CE_val v )" using infer_v_form subst_cev.simps assms forget_subst_vv   by presburger
+  finally have *:"c[z::=v]\<^sub>c\<^sub>v = (CE_val v  ==  CE_val v )" by auto
+
+  have **:"\<Theta> ; \<B> ; G\<turnstile>\<^sub>w\<^sub>f CE_val v : b" using wfCE_valI  assms infer_v_v_wf b_of.simps by metis
+
+  show ?thesis proof(rule validI)
+    show  "\<Theta> ; \<B> ; G\<turnstile>\<^sub>w\<^sub>f c[z::=v]\<^sub>c\<^sub>v" proof -
+      have "\<Theta> ; \<B> ; G\<turnstile>\<^sub>w\<^sub>f v : b" using infer_v_v_wf assms b_of.simps by metis
+      moreover have "\<Theta> \<turnstile>\<^sub>w\<^sub>f ([]::\<Phi>)    \<and>  \<Theta> ; \<B> ; G\<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta>" using wfD_emptyI wfPhi_emptyI infer_v_wf assms by auto
+      ultimately show ?thesis using * wfCE_valI wfC_eqI by metis
+    qed
+    show "\<forall>i. wfI \<Theta> G i \<and> is_satis_g i G \<longrightarrow> is_satis i c[z::=v]\<^sub>c\<^sub>v" proof(rule,rule)
+      fix i 
+      assume \<open>wfI \<Theta> G i \<and> is_satis_g i G\<close>
+      thus \<open>is_satis i c[z::=v]\<^sub>c\<^sub>v\<close> using * ** is_satis_eq by auto
+    qed
+  qed
+qed
+
+lemma subst_valid_simple: 
+  fixes v::v
+  assumes "\<Theta> ; \<B> ; G \<turnstile> v \<Rightarrow> \<lbrace> z0 : b | c0 \<rbrace>" and 
+    "atom z0 \<sharp> c" and "atom z0 \<sharp> v"
+    "\<Theta>; \<B> ; (z0,b,c0)#\<^sub>\<Gamma>G \<Turnstile> c[z::=V_var z0]\<^sub>c\<^sub>v" 
+  shows " \<Theta> ; \<B> ; G \<Turnstile> c[z::=v]\<^sub>c\<^sub>v"
+proof -
+  have " \<Theta> ; \<B> ; G \<Turnstile> c0[z0::=v]\<^sub>c\<^sub>v"  using subst_self_valid assms by metis
+  moreover have "atom z0 \<sharp> G" using assms valid_wf_all by meson
+  moreover  have "wfV \<Theta> \<B> G v b" using infer_v_v_wf assms b_of.simps by metis
+  moreover have "(c[z::=V_var z0]\<^sub>c\<^sub>v)[z0::=v]\<^sub>c\<^sub>v = c[z::=v]\<^sub>c\<^sub>v" using subst_v_simple_commute assms subst_v_c_def by metis
+  ultimately show ?thesis  using valid_trans assms subst_defs by metis
+qed
+
+lemma wfI_subst1:
+  assumes " wfI \<Theta> (G'[x::=v]\<^sub>\<Gamma>\<^sub>v @ G) i" and "wfG \<Theta> \<B> (G' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> G)" and "eval_v i v sv" and "wfRCV \<Theta> sv b"
+  shows "wfI \<Theta> (G' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> G) ( i( x \<mapsto> sv))"
+proof - 
+  {
+    fix xa::x and ba::b  and ca::c
+    assume as: "(xa,ba,ca) \<in> toSet ((G' @ ((x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> G)))"
+    then have " \<exists>s. Some s = (i(x \<mapsto> sv)) xa \<and> wfRCV \<Theta> s ba"
+    proof(cases "x=xa") 
+      case True
+      have "Some sv =  (i(x \<mapsto> sv)) x \<and> wfRCV \<Theta> sv b" using as assms wfI_def by auto
+      moreover have "b=ba" using  assms as True wfG_member_unique by metis
+      ultimately show ?thesis using True by auto
+    next
+      case False
+
+      then obtain ca' where "(xa, ba, ca') \<in> toSet (G'[x::=v]\<^sub>\<Gamma>\<^sub>v @ G)" using wfG_member_subst2 assms as by metis
+      then obtain s where " Some s = i xa \<and> wfRCV \<Theta> s ba" using wfI_def assms False by blast
+      thus  ?thesis using False by auto
+    qed   
+  }
+  from this show ?thesis using wfI_def allI by blast 
+qed
+
+lemma subst_valid:
+  fixes v::v and c'::c and \<Gamma> ::\<Gamma>
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c[z::=v]\<^sub>c\<^sub>v" and  "\<Theta> ; \<B> ; \<Gamma>\<turnstile>\<^sub>w\<^sub>f v : b" and 
+    "\<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f \<Gamma>" and  "atom x \<sharp> c" and  "atom x \<sharp> \<Gamma>" and 
+    "\<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v ) #\<^sub>\<Gamma> \<Gamma>)" and          
+    "\<Theta> ; \<B> ; \<Gamma>'@(x,b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v ) #\<^sub>\<Gamma> \<Gamma> \<Turnstile> c'" (is " \<Theta> ; \<B>;  ?G \<Turnstile> c'")
+  shows   "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma> \<Turnstile> c'[x::=v]\<^sub>c\<^sub>v"
+proof -
+  have *:"wfC \<Theta> \<B> (\<Gamma>'@(x,b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v ) #\<^sub>\<Gamma> \<Gamma>) c'"  using valid.simps assms by metis
+  hence "wfC \<Theta> \<B> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) (c'[x::=v]\<^sub>c\<^sub>v)" using wf_subst(2)[OF *]  b_of.simps   assms subst_g_inside wfC_wf  by metis
+  moreover have "\<forall>i. wfI \<Theta> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) i \<and> is_satis_g i (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) \<longrightarrow> is_satis i (c'[x::=v]\<^sub>c\<^sub>v)" 
+
+  proof(rule,rule)
+    fix i
+    assume as: " wfI \<Theta> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) i \<and> is_satis_g i (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)"
+
+    hence wfig: "wfI \<Theta> \<Gamma> i" using wfI_suffix infer_v_wf assms by metis 
+    then obtain s where s:"eval_v i v s" and b:"wfRCV \<Theta> s b" using eval_v_exist infer_v_v_wf b_of.simps assms by metis
+
+    have is1: "is_satis_g ( i( x \<mapsto> s)) (\<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" proof(rule is_satis_g_i_upd2)
+      show "is_satis (i(x \<mapsto> s)) (c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)" proof - 
+        have "is_satis i  (c[z::=v]\<^sub>c\<^sub>v)" 
+          using subst_valid_simple assms as valid.simps infer_v_wf assms
+            is_satis_g_suffix wfI_suffix by metis
+        hence "is_satis i ((c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)[x::=v]\<^sub>c\<^sub>v)" using assms subst_v_simple_commute[of x c z v] subst_v_c_def by metis
+        moreover have "\<Theta> ; \<B> ; (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v" using wfC_refl wfG_suffix assms by metis
+        moreover have "\<Theta> ; \<B> ; \<Gamma>\<turnstile>\<^sub>w\<^sub>f v : b" using assms infer_v_v_wf b_of.simps by metis
+        ultimately show ?thesis using subst_c_satis[OF s , of \<Theta> \<B> x b  "c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v" \<Gamma> "c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v"] wfig by auto
+      qed        
+      show "atom x \<sharp> \<Gamma>" using assms by metis
+      show "wfG \<Theta> \<B> (\<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" using valid_wf_all assms by metis
+      show "\<Theta> ; \<B> ; \<Gamma>\<turnstile>\<^sub>w\<^sub>f v : b" using assms infer_v_v_wf by force
+      show "i \<lbrakk> v \<rbrakk> ~ s " using s by auto
+      show "\<Theta> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> i" using as by auto
+      show "i \<Turnstile> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> " using as by auto
+    qed
+    hence "is_satis ( i( x \<mapsto> s)) c'" proof -
+      have "wfI  \<Theta> (\<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) ( i( x \<mapsto> s))" 
+        using wfI_subst1[of \<Theta> \<Gamma>' x v  \<Gamma> i \<B> b c z  s] as b s assms  by metis
+      thus ?thesis using is1 valid.simps assms by presburger
+    qed
+
+    thus "is_satis i (c'[x::=v]\<^sub>c\<^sub>v)" using subst_c_satis_full[OF s] valid.simps as infer_v_v_wf b_of.simps assms by metis 
+
+  qed
+  ultimately show ?thesis using valid.simps by auto
+qed
+
+lemma subst_valid_infer_v:
+  fixes v::v and c'::c
+  assumes  "\<Theta> ; \<B> ; G \<turnstile> v \<Rightarrow> \<lbrace> z0 : b | c0 \<rbrace>" and  "atom x \<sharp> c" and  "atom x \<sharp> G" and "wfG \<Theta> \<B> (G'@(x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v ) #\<^sub>\<Gamma> G)" and "atom z0 \<sharp> v"
+    " \<Theta>;\<B>;(z0,b,c0)#\<^sub>\<Gamma>G \<Turnstile> c[z::=V_var z0]\<^sub>c\<^sub>v" and "atom z0 \<sharp> c" and
+    " \<Theta>;\<B>;G'@(x,b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v ) #\<^sub>\<Gamma> G \<Turnstile> c'" (is " \<Theta> ; \<B>;  ?G \<Turnstile> c'")
+  shows    " \<Theta>;\<B>;G'[x::=v]\<^sub>\<Gamma>\<^sub>v@G \<Turnstile> c'[x::=v]\<^sub>c\<^sub>v"
+proof - 
+  have "\<Theta> ; \<B> ; G \<Turnstile> c[z::=v]\<^sub>c\<^sub>v"  
+    using infer_v_wf subst_valid_simple valid.simps assms    using subst_valid_simple assms valid.simps infer_v_wf assms
+      is_satis_g_suffix wfI_suffix by metis
+  moreover have "wfV \<Theta> \<B> G v b" and "wfG \<Theta> \<B> G" 
+    using assms infer_v_wf b_of.simps apply metis  using assms infer_v_wf by metis
+  ultimately show ?thesis using assms subst_valid by metis
+qed
+
+section \<open>Subtyping\<close>
+
+lemma subst_subtype: 
+  fixes v::v
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> (\<lbrace>z0:b|c0\<rbrace>)" and
+    " \<Theta>;\<B>;\<Gamma> \<turnstile> (\<lbrace>z0:b|c0\<rbrace>) \<lesssim>  (\<lbrace> z : b | c \<rbrace>)" and
+    " \<Theta>;\<B>;\<Gamma>'@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> (\<lbrace> z1 : b1 | c1 \<rbrace>) \<lesssim> (\<lbrace> z2 : b1 | c2 \<rbrace>)" (is " \<Theta> ; \<B>; ?G1 \<turnstile> ?t1 \<lesssim> ?t2" ) and 
+    "atom z \<sharp> (x,v) \<and> atom z0 \<sharp> (c,x,v,z,\<Gamma>) \<and> atom z1 \<sharp> (x,v) \<and> atom z2 \<sharp> (x,v)" and "wsV \<Theta> \<B> \<Gamma> v" 
+  shows " \<Theta>;\<B>;\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma> \<turnstile>  \<lbrace> z1 : b1 | c1 \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim>  \<lbrace> z2 : b1 | c2 \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+proof -
+  have z2: "atom z2 \<sharp> (x,v) " using assms by auto
+  hence "x \<noteq> z2" by auto
+
+  obtain xx::x where xxf: "atom xx \<sharp> (x,z1, c1, z2, c2, \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>, c1[x::=v]\<^sub>c\<^sub>v, c2[x::=v]\<^sub>c\<^sub>v, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>, 
+                (\<Theta> , \<B>  , \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>,   z1 , c1[x::=v]\<^sub>c\<^sub>v ,  z2 ,     c2[x::=v]\<^sub>c\<^sub>v  ))" (is "atom xx \<sharp> ?tup")
+    using obtain_fresh by blast
+  hence xxf2: "atom xx \<sharp> (z1, c1, z2, c2, \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" using fresh_prod9 fresh_prod5 by fast    
+
+  have  vd1: " \<Theta>;\<B>;((xx, b1, c1[z1::=V_var xx]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>')[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<Turnstile> (c2[z2::=V_var xx]\<^sub>c\<^sub>v)[x::=v]\<^sub>c\<^sub>v"
+  proof(rule subst_valid_infer_v[of \<Theta> _ _ _ z0 b c0 _ c, where z=z])
+    show "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> v \<Rightarrow> \<lbrace> z0 : b  | c0 \<rbrace>" using assms by auto
+
+    show xf: "atom x \<sharp> \<Gamma>" using subtype_g_wf wfG_inside_fresh_suffix assms by metis
+
+    show "atom x \<sharp> c" proof -
+      have "wfT  \<Theta> \<B> \<Gamma> (\<lbrace> z : b | c \<rbrace>)" using subtype_wf[OF assms(2)] by auto
+      moreover have "x \<noteq> z" using assms(4) 
+        using fresh_Pair not_self_fresh by blast
+      ultimately show ?thesis using xf wfT_fresh_c assms by presburger
+    qed
+
+    show " \<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f ((xx, b1, c1[z1::=V_var xx]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> "
+    proof(subst append_g.simps,rule wfG_consI)
+      show *: \<open> \<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<close> using subtype_g_wf assms by metis
+      show \<open>atom xx \<sharp> \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<close>  using xxf fresh_prod9 by metis
+      show \<open> \<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f b1 \<close> using subtype_elims[OF assms(3)] wfT_wfC wfC_wf wfG_cons by metis
+      show "\<Theta> ; \<B> ; (xx, b1, TRUE) #\<^sub>\<Gamma> \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f c1[z1::=V_var xx]\<^sub>c\<^sub>v " proof(rule  wfT_wfC)
+        have "\<lbrace> z1 : b1  | c1 \<rbrace> =  \<lbrace> xx : b1  | c1[z1::=V_var xx]\<^sub>c\<^sub>v \<rbrace> " using xxf fresh_prod9 type_eq_subst xxf2 fresh_prodN by metis
+        thus "\<Theta> ; \<B> ; \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<lbrace> xx : b1  | c1[z1::=V_var xx]\<^sub>c\<^sub>v \<rbrace> " using subtype_wfT[OF assms(3)] by metis
+        show "atom xx \<sharp> \<Gamma>' @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" using xxf fresh_prod9 by metis
+      qed       
+    qed
+
+    show "atom z0 \<sharp> v" using assms fresh_prod5 by auto
+    have "\<Theta> ; \<B> ; (z0, b, c0) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=V_var z0]\<^sub>v "     
+      apply(rule obtain_fresh[of "(z0,c0, \<Gamma>, c, z)"],rule subtype_valid[OF assms(2), THEN valid_flip], 
+          (fastforce simp add: assms fresh_prodN)+) done
+    thus  "\<Theta> ; \<B> ; (z0, b, c0) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=V_var z0]\<^sub>c\<^sub>v "   using subst_defs by auto
+
+    show "atom z0 \<sharp> c" using assms fresh_prod5 by auto
+    show "\<Theta> ; \<B> ; ((xx, b1, c1[z1::=V_var xx]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c2[z2::=V_var xx]\<^sub>c\<^sub>v "
+      using subtype_valid  assms(3) xxf xxf2 fresh_prodN append_g.simps subst_defs by metis
+  qed
+
+  have xfw1: "atom z1 \<sharp> v \<and> atom x \<sharp> [ xx ]\<^sup>v \<and> x \<noteq> z1" 
+    apply(intro conjI)
+    apply(simp add: assms xxf fresh_at_base fresh_prodN freshers fresh_x_neq)+
+    using fresh_x_neq fresh_prodN xxf  apply blast
+    using fresh_x_neq fresh_prodN assms by blast
+
+  have xfw2: "atom z2 \<sharp> v \<and> atom x \<sharp> [ xx ]\<^sup>v \<and> x \<noteq> z2"     
+    apply(auto simp add: assms xxf fresh_at_base fresh_prodN freshers)
+    by(insert xxf fresh_at_base fresh_prodN assms, fast+) 
+
+  have wf1: "wfT \<Theta> \<B> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>) (\<lbrace> z1 : b1  | c1[x::=v]\<^sub>c\<^sub>v \<rbrace>)" proof -
+    have "wfT \<Theta> \<B> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>) (\<lbrace> z1 : b1  | c1 \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v" 
+      using wf_subst(4)  assms b_of.simps infer_v_v_wf subtype_wf subst_tv.simps subst_g_inside  wfT_wf by metis
+    moreover have "atom z1 \<sharp> (x,v)" using assms by auto
+    ultimately show ?thesis using subst_tv.simps by auto
+  qed
+  moreover have wf2: "wfT \<Theta> \<B> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>) (\<lbrace> z2 : b1  | c2[x::=v]\<^sub>c\<^sub>v \<rbrace>)" proof -
+    have "wfT \<Theta> \<B> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>) (\<lbrace> z2 : b1  | c2 \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v" using wf_subst(4)  assms b_of.simps infer_v_v_wf subtype_wf subst_tv.simps subst_g_inside  wfT_wf by metis
+    moreover have "atom z2 \<sharp> (x,v)" using assms by auto
+    ultimately show ?thesis using subst_tv.simps by auto
+  qed
+  moreover have "\<Theta> ; \<B> ; (xx, b1, c1[x::=v]\<^sub>c\<^sub>v[z1::=V_var xx]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> )  \<Turnstile> (c2[x::=v]\<^sub>c\<^sub>v)[z2::=V_var xx]\<^sub>c\<^sub>v" proof -
+    have "xx \<noteq> x" using  xxf fresh_Pair fresh_at_base by fast
+    hence "((xx, b1, subst_cv c1 z1 (V_var xx) ) #\<^sub>\<Gamma> \<Gamma>')[x::=v]\<^sub>\<Gamma>\<^sub>v = (xx, b1, (subst_cv c1 z1 (V_var xx) )[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)"
+      using subst_gv.simps by auto
+    moreover have "(c1[z1::=V_var xx]\<^sub>c\<^sub>v )[x::=v]\<^sub>c\<^sub>v = (c1[x::=v]\<^sub>c\<^sub>v) [z1::=V_var xx]\<^sub>c\<^sub>v" using subst_cv_commute_full xfw1 by metis
+    moreover have "c2[z2::=[ xx ]\<^sup>v]\<^sub>c\<^sub>v[x::=v]\<^sub>c\<^sub>v  =  (c2[x::=v]\<^sub>c\<^sub>v)[z2::=V_var xx]\<^sub>c\<^sub>v" using subst_cv_commute_full xfw2 by metis
+    ultimately show ?thesis using  vd1  append_g.simps by metis
+  qed
+  moreover have "atom xx \<sharp> (\<Theta> , \<B>  , \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>,  z1 , c1[x::=v]\<^sub>c\<^sub>v ,  z2  ,c2[x::=v]\<^sub>c\<^sub>v  )" 
+    using xxf fresh_prodN by metis
+  ultimately have  "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>  \<turnstile> \<lbrace> z1 : b1  | c1[x::=v]\<^sub>c\<^sub>v \<rbrace> \<lesssim> \<lbrace> z2 : b1  | c2[x::=v]\<^sub>c\<^sub>v \<rbrace>" 
+    using subtype_baseI  subst_defs  by metis
+  thus ?thesis using subst_tv.simps assms by presburger
+qed
+
+lemma subst_subtype_tau: 
+  fixes v::v
+  assumes   "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" and
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> \<tau> \<lesssim>  (\<lbrace> z : b | c \<rbrace>)"
+    "\<Theta> ; \<B> ; \<Gamma>'@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> \<tau>1 \<lesssim> \<tau>2" and 
+    "atom z \<sharp> (x,v)"
+  shows "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma> \<turnstile>  \<tau>1[x::=v]\<^sub>\<tau>\<^sub>v     \<lesssim>  \<tau>2[x::=v]\<^sub>\<tau>\<^sub>v"
+proof - 
+  obtain z0 and b0 and c0 where zbc0: "\<tau>=(\<lbrace> z0 : b0 | c0 \<rbrace>) \<and> atom z0 \<sharp> (c,x,v,z,\<Gamma>)" 
+    using obtain_fresh_z by metis
+  obtain z1 and b1 and c1 where zbc1: "\<tau>1=(\<lbrace> z1 : b1 | c1 \<rbrace>) \<and> atom z1 \<sharp> (x,v)"
+    using obtain_fresh_z by metis
+  obtain z2 and b2 and c2 where zbc2: "\<tau>2=(\<lbrace> z2 : b2 | c2 \<rbrace>) \<and> atom z2 \<sharp> (x,v)"
+    using obtain_fresh_z by metis
+
+  have "b0=b" using subtype_eq_base  zbc0 assms by blast
+
+  hence vinf: "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z0 : b | c0 \<rbrace>" using assms zbc0 by blast
+  have vsub: "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<lbrace> z0 : b | c0 \<rbrace> \<lesssim>  \<lbrace> z : b | c \<rbrace>" using assms zbc0 \<open>b0=b\<close> by blast
+  have beq:"b1=b2" using subtype_eq_base 
+    using zbc1 zbc2 assms by blast 
+  have "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> \<lbrace> z1 : b1  | c1 \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> \<lbrace> z2 : b1  | c2 \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v" 
+  proof(rule subst_subtype[OF vinf vsub] )
+    show  "\<Theta> ; \<B> ; \<Gamma>'@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> \<lbrace> z1 : b1 | c1 \<rbrace> \<lesssim> \<lbrace> z2 : b1 | c2 \<rbrace>" 
+      using beq assms zbc1 zbc2 by auto
+    show "atom z \<sharp> (x, v) \<and> atom z0 \<sharp> (c, x, v, z, \<Gamma>) \<and> atom z1 \<sharp> (x, v) \<and> atom z2 \<sharp> (x, v)" 
+      using zbc0 zbc1 zbc2 assms by blast
+    show "wfV \<Theta> \<B> \<Gamma> v (b_of \<tau>)" using infer_v_wf assms by simp
+  qed
+
+  thus ?thesis using zbc1 zbc2 \<open>b1=b2\<close> assms by blast
+qed
+
+lemma subtype_if1:
+  fixes v::v
+  assumes "P ; \<B> ; \<Gamma>  \<turnstile> t1  \<lesssim> t2" and "wfV P \<B> \<Gamma> v (base_for_lit l)" and         
+    "atom z1 \<sharp> v" and  "atom z2 \<sharp> v" and "atom z1 \<sharp> t1" and "atom z2 \<sharp> t2" and "atom z1 \<sharp> \<Gamma>" and "atom z2 \<sharp> \<Gamma>"
+  shows   "P ; \<B> ; \<Gamma> \<turnstile> \<lbrace> z1 : b_of t1  | CE_val v  ==  CE_val (V_lit l)   IMP  (c_of t1 z1)  \<rbrace> \<lesssim> \<lbrace> z2 : b_of t2  | CE_val v  ==  CE_val (V_lit l) IMP  (c_of t2 z2)  \<rbrace>"
+proof - 
+  obtain z1' where t1: "t1 = \<lbrace> z1' : b_of t1 | c_of t1 z1'\<rbrace> \<and> atom z1' \<sharp> (z1,\<Gamma>,t1)" using obtain_fresh_z_c_of by metis
+  obtain z2' where t2:  "t2 = \<lbrace> z2' : b_of t2 | c_of t2 z2'\<rbrace> \<and> atom z2' \<sharp> (z2,t2) " using obtain_fresh_z_c_of by metis
+  have beq:"b_of t1 = b_of t2" using subtype_eq_base2 assms by auto
+
+  have c1: "(c_of t1 z1')[z1'::=[ z1 ]\<^sup>v]\<^sub>c\<^sub>v = c_of t1 z1" using c_of_switch t1 assms by simp
+  have c2: "(c_of t2 z2')[z2'::=[ z2 ]\<^sup>v]\<^sub>c\<^sub>v = c_of t2 z2" using c_of_switch t2 assms by simp
+
+  have "P ; \<B> ; \<Gamma>  \<turnstile> \<lbrace> z1 : b_of t1  | [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  (c_of t1 z1')[z1'::=[z1]\<^sup>v]\<^sub>v  \<rbrace> \<lesssim> \<lbrace> z2 : b_of t1  | [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  (c_of t2 z2')[z2'::=[z2]\<^sup>v]\<^sub>v  \<rbrace>"
+  proof(rule subtype_if)
+    show \<open>P ; \<B> ; \<Gamma>  \<turnstile> \<lbrace> z1' : b_of t1  | c_of t1 z1' \<rbrace> \<lesssim> \<lbrace> z2' : b_of t1  | c_of t2 z2' \<rbrace>\<close> using t1 t2 assms beq by auto
+    show \<open> P ; \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<lbrace> z1 : b_of t1  | [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  (c_of t1 z1')[z1'::=[ z1 ]\<^sup>v]\<^sub>v  \<rbrace> \<close> using wfT_wfT_if_rev assms subtype_wfT c1 subst_defs by metis
+    show \<open> P ; \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<lbrace> z2 : b_of t1  | [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  (c_of t2 z2')[z2'::=[ z2 ]\<^sup>v]\<^sub>v  \<rbrace> \<close> using wfT_wfT_if_rev assms subtype_wfT c2 subst_defs beq by metis
+    show \<open>atom z1 \<sharp> v\<close> using assms by auto
+    show \<open>atom z1' \<sharp> \<Gamma>\<close> using t1 by auto
+    show \<open>atom z1 \<sharp> c_of t1 z1'\<close> using t1 assms c_of_fresh by force
+    show \<open>atom z2 \<sharp> c_of t2 z2'\<close> using t2 assms c_of_fresh by force
+    show \<open>atom z2 \<sharp> v\<close> using assms by auto
+  qed
+  then show ?thesis using t1 t2 assms c1 c2 beq subst_defs by metis
+qed
+
+section \<open>Values\<close>
+
+lemma subst_infer_aux:
+  fixes \<tau>\<^sub>1::\<tau> and v'::v
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<tau>\<^sub>1" and "\<Theta> ; \<B> ; \<Gamma>' \<turnstile> v' \<Rightarrow> \<tau>\<^sub>2" and "b_of \<tau>\<^sub>1 = b_of \<tau>\<^sub>2"
+  shows "\<tau>\<^sub>1 = (\<tau>\<^sub>2[x::=v]\<^sub>\<tau>\<^sub>v)"
+proof -
+  obtain z1 and b1 where zb1: "\<tau>\<^sub>1 = (\<lbrace> z1 : b1 | C_eq (CE_val (V_var z1)) (CE_val (v'[x::=v]\<^sub>v\<^sub>v)) \<rbrace>) \<and> atom z1 \<sharp> ((CE_val (v'[x::=v]\<^sub>v\<^sub>v), CE_val v),v'[x::=v]\<^sub>v\<^sub>v)" 
+    using infer_v_form_fresh[OF assms(1)] by fastforce
+  obtain z2 and b2 where zb2: "\<tau>\<^sub>2 = (\<lbrace> z2 : b2 | C_eq (CE_val (V_var z2)) (CE_val v') \<rbrace>) \<and> atom z2 \<sharp> ((CE_val (v'[x::=v]\<^sub>v\<^sub>v), CE_val v,x,v),v')" 
+    using infer_v_form_fresh [OF assms(2)] by fastforce
+  have beq: "b1 = b2" using assms zb1 zb2 by simp
+
+  hence "(\<lbrace> z2 : b2 | C_eq (CE_val (V_var z2)) (CE_val v') \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v = (\<lbrace> z2 : b2 | C_eq (CE_val (V_var z2)) (CE_val (v'[x::=v]\<^sub>v\<^sub>v)) \<rbrace>)" 
+    using subst_tv.simps subst_cv.simps subst_ev.simps  forget_subst_vv[of x "V_var z2"] zb2 by force 
+  also have  "... = (\<lbrace> z1 : b1 | C_eq (CE_val (V_var z1)) (CE_val (v'[x::=v]\<^sub>v\<^sub>v)) \<rbrace>)" 
+    using type_e_eq[of z2 "CE_val  (v'[x::=v]\<^sub>v\<^sub>v)"z1 b1 ] zb1 zb2 fresh_PairD(1) assms beq by metis
+  finally show ?thesis using zb1  zb2 by argo
+qed
+
+lemma subst_t_b_eq:
+  fixes x::x and v::v
+  shows  "b_of (\<tau>[x::=v]\<^sub>\<tau>\<^sub>v) = b_of \<tau>"
+proof - 
+  obtain z and b and c where "\<tau> = \<lbrace> z : b | c \<rbrace> \<and> atom z \<sharp> (x,v)"
+    using has_fresh_z by blast
+  thus ?thesis using subst_tv.simps  by simp
+qed
+
+lemma fresh_g_fresh_v:
+  fixes x::x
+  assumes "atom x \<sharp> \<Gamma>" and "wfV \<Theta> \<B> \<Gamma> v b"
+  shows "atom x \<sharp> v"
+  using assms  wfV_supp wfX_wfY wfG_atoms_supp_eq fresh_def 
+  by (metis wfV_x_fresh)
+
+lemma infer_v_fresh_g_fresh_v:
+  fixes x::x and \<Gamma>::\<Gamma> and v::v
+  assumes "atom x \<sharp> \<Gamma>'@\<Gamma>" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" 
+  shows "atom x \<sharp> v"
+proof - 
+  have "atom x \<sharp> \<Gamma>" using fresh_suffix assms by auto
+  moreover have "wfV \<Theta> \<B> \<Gamma> v (b_of \<tau>)" using infer_v_wf assms by auto
+  ultimately show ?thesis using fresh_g_fresh_v by metis
+qed
+
+lemma infer_v_fresh_g_fresh_xv:
+  fixes xa::x and v::v and \<Gamma>::\<Gamma>
+  assumes "atom xa \<sharp> \<Gamma>'@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" 
+  shows "atom xa \<sharp> (x,v)"
+proof -
+  have "atom xa \<sharp> x" using assms  fresh_in_g fresh_def by blast
+  moreover have "\<Gamma>'@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) = ((\<Gamma>'@(x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>GNil)@\<Gamma>)" using append_g.simps append_g_assoc by simp
+  moreover hence "atom xa \<sharp> v" using infer_v_fresh_g_fresh_v assms by metis
+  ultimately show ?thesis by auto
+qed
+
+lemma wfG_subst_infer_v:
+  fixes v::v
+  assumes "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" and "b_of \<tau> = b"
+  shows "\<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> "
+  using wfG_subst_wfV infer_v_v_wf assms by auto
+
+lemma fresh_subst_gv_inside:
+  fixes \<Gamma>::\<Gamma>
+  assumes "atom z \<sharp> \<Gamma>' @ (x, b\<^sub>1, c0[z0::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" and "atom z \<sharp> v" 
+  shows "atom z \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>" 
+  unfolding fresh_append_g  using fresh_append_g assms fresh_subst_gv fresh_GCons by metis
+
+lemma subst_t:
+  fixes x::x and b::b and xa::x
+  assumes "atom z \<sharp> x" and "atom z \<sharp> v"
+  shows   "(\<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v'[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  \<rbrace>) = (\<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v']\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v)"
+  using assms subst_vv.simps subst_tv.simps subst_cv.simps subst_cev.simps by auto
+
+lemma infer_l_fresh:
+  assumes  "\<turnstile> l \<Rightarrow> \<tau>"
+  shows "atom x \<sharp> \<tau>"
+proof -
+  have "[] ; {||}  \<turnstile>\<^sub>w\<^sub>f GNil" using wfG_nilI wfTh_emptyI by auto
+  hence "[] ; {||} ; GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>" using assms infer_l_wf by auto
+  thus ?thesis using  fresh_def wfT_supp by force
+qed
+
+lemma subst_infer_v:
+  fixes v::v and v'::v
+  assumes "\<Theta> ; \<B> ;  \<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v' \<Rightarrow> \<tau>\<^sub>2" and 
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>\<^sub>1" and           
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> \<tau>\<^sub>1 \<lesssim>  (\<lbrace> z0 : b\<^sub>1 | c0 \<rbrace>)" and "atom z0 \<sharp> (x,v)"
+  shows "\<Theta> ; \<B> ; (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v  \<Rightarrow> \<tau>\<^sub>2[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms proof(nominal_induct "\<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)" v' \<tau>\<^sub>2 avoiding: x v   rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> b c xa z)
+  have "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  \<rbrace>" 
+  proof(cases "x=xa")
+    case True   
+    have  "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e  \<rbrace>" 
+    proof(rule infer_v_g_weakening)
+      show *:\<open> \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e  \<rbrace>\<close> 
+        using infer_v_form infer_v_varI 
+        by (metis True lookup_inside_unique_b lookup_inside_wf ms_fresh_all(32) subtype_eq_base type_e_eq)
+      show \<open>toSet \<Gamma> \<subseteq> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)\<close> by simp
+      have "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b\<^sub>1" using infer_v_wf subtype_eq_base2 b_of.simps infer_v_varI by metis
+      thus  \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<close> 
+        using wfG_subst[OF infer_v_varI(3), of \<Gamma>' x b\<^sub>1 "c0[z0::=[ x ]\<^sup>v]\<^sub>c\<^sub>v" \<Gamma> v] subst_g_inside infer_v_varI by metis
+    qed
+
+    thus ?thesis using subst_vv.simps True by simp
+  next
+    case False
+    then obtain c' where c: "Some (b, c') = lookup (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) xa" using lookup_subst2 infer_v_varI by metis
+    have "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> [ xa ]\<^sup>v \<Rightarrow> \<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ xa ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" 
+    proof
+      have "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b\<^sub>1" using infer_v_wf subtype_eq_base2 b_of.simps infer_v_varI by metis
+      thus "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>" using infer_v_varI
+        using wfG_subst[OF infer_v_varI(3), of \<Gamma>' x b\<^sub>1 "c0[z0::=[ x ]\<^sup>v]\<^sub>c\<^sub>v" \<Gamma> v] subst_g_inside infer_v_varI by metis
+      show "atom z \<sharp> xa" using infer_v_varI by auto
+      show "Some (b, c') = lookup (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) xa" using c  by auto
+      show "atom z \<sharp> (\<Theta>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)" by (fresh_mth add: infer_v_varI fresh_subst_gv_inside)
+    qed    
+    then show ?thesis using subst_vv.simps False by simp
+  qed 
+  thus ?case using subst_t fresh_prodN infer_v_varI by metis
+next
+  case (infer_v_litI \<Theta> \<B> l \<tau>)
+  show ?case unfolding subst_vv.simps proof
+    show "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>" using wfG_subst_infer_v infer_v_litI subtype_eq_base2 b_of.simps by metis
+    have "atom x \<sharp> \<tau>" using infer_v_litI infer_l_fresh by metis
+    thus  "\<turnstile> l \<Rightarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" using infer_v_litI type_v_subst_fresh by simp
+  qed
+next
+  case (infer_v_pairI z v1 v2 \<Theta> \<B> t1 t2)
+  have " \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @
+              \<Gamma> \<turnstile> [ v1[x::=v]\<^sub>v\<^sub>v , v2[x::=v]\<^sub>v\<^sub>v ]\<^sup>v \<Rightarrow> \<lbrace> z : [ b_of t1[x::=v]\<^sub>\<tau>\<^sub>v , b_of
+      t2[x::=v]\<^sub>\<tau>\<^sub>v ]\<^sup>b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ v1[x::=v]\<^sub>v\<^sub>v , v2[x::=v]\<^sub>v\<^sub>v ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" 
+  proof
+    show \<open>atom z \<sharp> (v1[x::=v]\<^sub>v\<^sub>v, v2[x::=v]\<^sub>v\<^sub>v)\<close> by (fresh_mth add: infer_v_pairI)
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)\<close>  by (fresh_mth add: infer_v_pairI fresh_subst_gv_inside)
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> t1[x::=v]\<^sub>\<tau>\<^sub>v\<close> using infer_v_pairI by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> v2[x::=v]\<^sub>v\<^sub>v \<Rightarrow> t2[x::=v]\<^sub>\<tau>\<^sub>v\<close> using infer_v_pairI by metis
+  qed
+  then show ?case using  subst_vv.simps subst_tv.simps infer_v_pairI b_of_subst by simp
+next
+  case (infer_v_consI s dclist \<Theta> dc tc \<B> va tv z)
+
+  have " \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> (V_cons s dc va[x::=v]\<^sub>v\<^sub>v) \<Rightarrow> \<lbrace> z : B_id s  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_cons s dc va[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  \<rbrace>" 
+  proof
+    show td:\<open>AF_typedef s dclist \<in> set \<Theta>\<close> using infer_v_consI by auto
+    show dc:\<open>(dc, tc) \<in> set dclist\<close> using infer_v_consI by auto
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> va[x::=v]\<^sub>v\<^sub>v \<Rightarrow> tv[x::=v]\<^sub>\<tau>\<^sub>v\<close> using infer_v_consI by auto
+    have \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> tv[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> tc[x::=v]\<^sub>\<tau>\<^sub>v\<close> 
+      using    subst_subtype_tau infer_v_consI by metis
+    moreover have "atom x \<sharp> tc" using wfTh_lookup_supp_empty[OF td dc] infer_v_wf infer_v_consI fresh_def by fast
+    ultimately show \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> tv[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> tc\<close> by simp 
+    show \<open>atom z \<sharp> va[x::=v]\<^sub>v\<^sub>v\<close> using infer_v_consI by auto
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)\<close> by (fresh_mth add: infer_v_consI fresh_subst_gv_inside)
+  qed  
+  thus ?case using subst_vv.simps subst_t[of z x v ] infer_v_consI by metis
+
+next
+  case (infer_v_conspI s bv dclist \<Theta> dc tc \<B> va tv b z)
+  have "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> (V_consp s dc b va[x::=v]\<^sub>v\<^sub>v) \<Rightarrow> \<lbrace> z : B_app s b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc b va[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  \<rbrace>"
+  proof
+    show td:\<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using infer_v_conspI by auto
+    show dc:\<open>(dc, tc) \<in> set dclist\<close> using infer_v_conspI by auto
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> va[x::=v]\<^sub>v\<^sub>v \<Rightarrow> tv[x::=v]\<^sub>\<tau>\<^sub>v\<close> using  infer_v_conspI by metis
+    have \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> tv[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> tc[bv::=b]\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v\<close> 
+      using    subst_subtype_tau infer_v_conspI by metis
+    moreover  have "atom x \<sharp> tc[bv::=b]\<^sub>\<tau>\<^sub>b" proof -
+      have "supp tc \<subseteq> { atom bv }" using wfTh_poly_lookup_supp infer_v_conspI wfX_wfY by metis
+      hence "atom x \<sharp> tc" using x_not_in_b_set 
+        using fresh_def by fastforce
+      moreover have "atom x \<sharp> b" using x_fresh_b by auto
+      ultimately show ?thesis using fresh_subst_if subst_b_\<tau>_def by metis
+    qed
+    ultimately show \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> tv[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> tc[bv::=b]\<^sub>\<tau>\<^sub>b\<close> by simp 
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>, va[x::=v]\<^sub>v\<^sub>v, b)\<close>  proof -
+      have "atom z \<sharp> va[x::=v]\<^sub>v\<^sub>v" using fresh_subst_v_if infer_v_conspI subst_v_v_def by metis
+      moreover have "atom z \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>"  using fresh_subst_gv_inside infer_v_conspI by metis
+      ultimately show ?thesis using fresh_prodN infer_v_conspI by metis
+    qed
+    show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>, va[x::=v]\<^sub>v\<^sub>v, b)\<close>  proof -
+      have "atom bv \<sharp> va[x::=v]\<^sub>v\<^sub>v" using fresh_subst_v_if infer_v_conspI subst_v_v_def by metis
+      moreover have "atom bv \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>"  using fresh_subst_gv_inside infer_v_conspI by metis
+      ultimately show ?thesis using fresh_prodN infer_v_conspI by metis
+    qed
+    show  "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using infer_v_conspI by auto
+  qed
+  thus ?case using subst_vv.simps  subst_t[of z x v ] infer_v_conspI by metis
+
+qed
+
+lemma subst_infer_check_v:
+  fixes v::v and v'::v
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>\<^sub>1"  and
+    "check_v \<Theta> \<B> (\<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>))  v' \<tau>\<^sub>2"  and
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> \<tau>\<^sub>1 \<lesssim>  \<lbrace> z0 : b\<^sub>1 | c0 \<rbrace>" and "atom z0 \<sharp> (x,v)"
+  shows "check_v \<Theta> \<B> ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)  (v'[x::=v]\<^sub>v\<^sub>v) (\<tau>\<^sub>2[x::=v]\<^sub>\<tau>\<^sub>v)"
+proof -
+  obtain \<tau>\<^sub>2' where t2: "infer_v  \<Theta> \<B>  (\<Gamma>' @ (x, b\<^sub>1, c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)  v' \<tau>\<^sub>2' \<and>  \<Theta> ; \<B> ; (\<Gamma>' @ (x, b\<^sub>1, c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)  \<turnstile> \<tau>\<^sub>2' \<lesssim> \<tau>\<^sub>2"
+    using check_v_elims assms by blast
+  hence "infer_v \<Theta> \<B> ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)  (v'[x::=v]\<^sub>v\<^sub>v)  (\<tau>\<^sub>2'[x::=v]\<^sub>\<tau>\<^sub>v)"
+    using subst_infer_v[OF _ assms(1)  assms(3) assms(4)] by blast
+  moreover hence "\<Theta>;  \<B> ; ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) \<turnstile>\<tau>\<^sub>2'[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim>  \<tau>\<^sub>2[x::=v]\<^sub>\<tau>\<^sub>v" 
+    using subst_subtype assms t2 by (meson subst_subtype_tau subtype_trans)
+  ultimately show ?thesis using check_v.intros by blast
+qed
+
+lemma type_veq_subst[simp]:
+  assumes "atom z \<sharp> (x,v)"
+  shows "\<lbrace> z : b | CE_val (V_var z)  ==  CE_val v'  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b | CE_val (V_var z)  ==  CE_val v'[x::=v]\<^sub>v\<^sub>v  \<rbrace>"
+  using assms by auto
+
+lemma subst_infer_v_form:
+  fixes v::v and v'::v and \<Gamma>::\<Gamma>
+  assumes  "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>\<^sub>1" and 
+    "\<Theta> ; \<B> ; \<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v' \<Rightarrow> \<tau>\<^sub>2" and "b= b_of \<tau>\<^sub>2"
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> \<tau>\<^sub>1 \<lesssim>  (\<lbrace> z0 : b\<^sub>1 | c0 \<rbrace>)" and "atom z0 \<sharp> (x,v)" and "atom z3' \<sharp> (x,v,v', \<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) )"
+  shows \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z3' : b | CE_val (V_var z3')  ==  CE_val v'[x::=v]\<^sub>v\<^sub>v  \<rbrace>\<close>
+proof - 
+  have "\<Theta> ; \<B> ; \<Gamma>'@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) \<turnstile> v' \<Rightarrow> \<lbrace> z3' : b_of \<tau>\<^sub>2 |  C_eq (CE_val (V_var z3')) (CE_val v') \<rbrace>" 
+  proof(rule infer_v_form4)
+    show \<open> \<Theta> ; \<B> ; \<Gamma>' @ (x, b\<^sub>1, c0[z0::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v' \<Rightarrow> \<tau>\<^sub>2\<close> using assms by metis
+    show \<open>atom z3' \<sharp> (v', \<Gamma>' @ (x, b\<^sub>1, c0[z0::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)\<close> using assms fresh_prodN by metis
+    show \<open>b_of \<tau>\<^sub>2 = b_of \<tau>\<^sub>2\<close> by auto
+  qed
+  hence \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z3' : b_of \<tau>\<^sub>2 | CE_val (V_var z3')  ==  CE_val v'  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v\<close> 
+    using subst_infer_v assms by metis
+  thus ?thesis using type_veq_subst fresh_prodN assms by metis
+qed
+
+section \<open>Expressions\<close>
+
+text \<open>
+    For operator, fst and snd cases, we use elimination to get one or more values, apply the substitution lemma for values. The types always have
+the same form and are equal under substitution.
+    For function application, the subst value is a subtype of the value which is a subtype of the argument. The return of the function is the same
+    under substitution.
+\<close>
+
+text \<open> Observe a similar pattern for each case \<close>
+
+lemma subst_infer_e:
+  fixes v::v and e::e and \<Gamma>'::\<Gamma>
+  assumes 
+    "\<Theta> ; \<Phi> ; \<B> ; G ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>\<^sub>2" and "G = (\<Gamma>'@((x,b\<^sub>1,subst_cv c0 z0 (V_var x))#\<^sub>\<Gamma>\<Gamma>))"
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>\<^sub>1" and 
+    "\<Theta>;  \<B> ; \<Gamma> \<turnstile> \<tau>\<^sub>1 \<lesssim>  \<lbrace> z0 : b\<^sub>1 | c0 \<rbrace>" and "atom z0 \<sharp> (x,v)"
+  shows "\<Theta> ; \<Phi> ; \<B> ; ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) ; (\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v)  \<turnstile> (subst_ev e x v )  \<Rightarrow> \<tau>\<^sub>2[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms proof(nominal_induct  avoiding: x v rule: infer_e.strong_induct)
+  case (infer_e_valI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v' \<tau>)
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ;  \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> (AE_val (v'[x::=v]\<^sub>v\<^sub>v)) \<Rightarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"  
+  proof
+    show "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v"  using wfD_subst infer_e_valI subtype_eq_base2 
+      by (metis b_of.simps infer_v_v_wf subst_g_inside_simple wfD_wf wf_subst(11))
+    show "\<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi>" using infer_e_valI by auto
+    show "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" using subst_infer_v infer_e_valI using wfD_subst infer_e_valI subtype_eq_base2 
+      by metis
+  qed       
+  thus ?case using subst_ev.simps by simp
+next
+  case (infer_e_plusI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+
+  hence z3f: "atom z3 \<sharp> CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e" using e.fresh ce.fresh opp.fresh by metis
+
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,AE_op Plus v1 v2,   CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e , AE_op Plus v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v , CE_op Plus [v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e [v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> )" 
+    using obtain_fresh by metis
+  hence  **:"(\<lbrace> z3 : B_int  | CE_val (V_var z3)  ==  CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>) = \<lbrace> z3' : B_int  | CE_val (V_var z3')  ==  CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_plusI fresh_Pair z3f by metis
+
+  obtain z1' b1' c1' where  z1:"atom z1' \<sharp> (x,v) \<and> \<lbrace> z1 : B_int | c1 \<rbrace> = \<lbrace> z1' : b1' | c1' \<rbrace>" using obtain_fresh_z by metis
+  obtain z2' b2'  c2' where z2:"atom z2' \<sharp> (x,v) \<and> \<lbrace> z2 : B_int | c2 \<rbrace> = \<lbrace> z2' : b2' | c2' \<rbrace>" using obtain_fresh_z by metis
+
+  have bb:"b1' = B_int \<and> b2' = B_int" using z1 z2 \<tau>.eq_iff by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> (AE_op Plus (v1[x::=v]\<^sub>v\<^sub>v) (v2[x::=v]\<^sub>v\<^sub>v)) \<Rightarrow> \<lbrace> z3' : B_int  | CE_val (V_var z3')  ==  CE_op Plus ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace>"
+  proof 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> 
+      using infer_e_plusI wfD_subst subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_plusI by blast
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1' : B_int  | c1'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_plusI z1 bb by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v2[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z2' : B_int  | c2'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_plusI z2 bb by metis
+    show \<open>atom z3' \<sharp> AE_op Plus v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v\<close> using fresh_prod6 * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using * by auto
+  qed
+  moreover have "\<lbrace> z3' : B_int  | CE_val (V_var z3')  ==  CE_op Plus ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace> = \<lbrace> z3' : B_int  | CE_val (V_var z3')  ==  CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    by(subst subst_tv.simps,auto simp add: * )
+  ultimately show ?case using subst_ev.simps * ** by metis
+next
+  case (infer_e_leqI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+
+  hence z3f: "atom z3 \<sharp> CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e" using e.fresh ce.fresh opp.fresh by metis
+
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,AE_op LEq v1 v2, CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e , CE_op LEq [v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e [v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e , AE_op LEq v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> )"  
+    using obtain_fresh by metis
+  hence  **:"(\<lbrace> z3 : B_bool  | CE_val (V_var z3)  ==  CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>) = \<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_leqI fresh_Pair z3f by metis
+
+  obtain z1' b1' c1' where  z1:"atom z1' \<sharp> (x,v) \<and> \<lbrace> z1 : B_int | c1 \<rbrace> = \<lbrace> z1' : b1' | c1' \<rbrace>" using obtain_fresh_z by metis
+  obtain z2' b2'  c2' where z2:"atom z2' \<sharp> (x,v) \<and> \<lbrace> z2 : B_int | c2 \<rbrace> = \<lbrace> z2' : b2' | c2' \<rbrace>" using obtain_fresh_z by metis
+
+  have bb:"b1' = B_int \<and> b2' = B_int" using z1 z2 \<tau>.eq_iff by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> (AE_op LEq (v1[x::=v]\<^sub>v\<^sub>v) (v2[x::=v]\<^sub>v\<^sub>v)) \<Rightarrow> \<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op LEq ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace>"
+  proof 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using wfD_subst infer_e_leqI subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_leqI(2) by auto 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1' : B_int  | c1'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_leqI z1 bb by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v2[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z2' : B_int  | c2'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_leqI z2 bb by metis
+    show \<open>atom z3' \<sharp> AE_op LEq v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v\<close> using fresh_Pair * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using * by auto
+  qed
+  moreover have "\<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op LEq ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace> = \<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    using subst_tv.simps subst_ev.simps * by auto
+  ultimately show ?case using subst_ev.simps * ** by metis
+next
+  case (infer_e_eqI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 bb c1 v2 z2 c2 z3)
+
+  hence z3f: "atom z3 \<sharp> CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e" using e.fresh ce.fresh opp.fresh by metis
+
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,AE_op Eq v1 v2, CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e , CE_op Eq [v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e [v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e , AE_op Eq v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> )"  
+    using obtain_fresh by metis
+  hence  **:"(\<lbrace> z3 : B_bool  | CE_val (V_var z3)  ==  CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>) = \<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_eqI fresh_Pair z3f by metis
+
+  obtain z1' b1' c1' where  z1:"atom z1' \<sharp> (x,v) \<and> \<lbrace> z1 : bb | c1 \<rbrace> = \<lbrace> z1' : b1' | c1' \<rbrace>" using obtain_fresh_z by metis
+  obtain z2' b2'  c2' where z2:"atom z2' \<sharp> (x,v) \<and> \<lbrace> z2 : bb | c2 \<rbrace> = \<lbrace> z2' : b2' | c2' \<rbrace>" using obtain_fresh_z by metis
+
+  have bb:"b1' = bb \<and> b2' = bb" using z1 z2 \<tau>.eq_iff by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> (AE_op Eq (v1[x::=v]\<^sub>v\<^sub>v) (v2[x::=v]\<^sub>v\<^sub>v)) \<Rightarrow> \<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op Eq ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace>"
+  proof 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using wfD_subst infer_e_eqI subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_eqI(2) by auto 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1' : bb  | c1'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_eqI z1 bb by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v2[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z2' : bb  | c2'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_eqI z2 bb by metis
+    show \<open>atom z3' \<sharp> AE_op Eq v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v\<close> using fresh_Pair * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using * by auto
+    show "bb \<in> {B_bool, B_int, B_unit}" using infer_e_eqI by auto
+  qed
+  moreover have "\<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op Eq ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace> = \<lbrace> z3' : B_bool  | CE_val (V_var z3')  ==  CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    using subst_tv.simps subst_ev.simps * by auto
+  ultimately show ?case using subst_ev.simps * ** by metis
+next
+  case (infer_e_appI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> f x' b c \<tau>' s' v' \<tau>)
+
+  hence "x \<noteq> x'" using \<open>atom x' \<sharp> \<Gamma>''\<close> using wfG_inside_x_neq wfX_wfY by metis
+
+  show ?case proof(subst subst_ev.simps,rule)
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using infer_e_appI wfD_subst subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using  infer_e_appI by metis
+    show \<open>Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x' b c \<tau>' s'))) = lookup_fun \<Phi> f\<close> using  infer_e_appI by metis
+
+    have \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> x' : b  | c \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v\<close> proof(rule subst_infer_check_v )
+      show "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> v \<Rightarrow> \<tau>\<^sub>1" using infer_e_appI by metis
+      show "\<Theta> ; \<B> ; \<Gamma>' @ (x, b\<^sub>1, c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v' \<Leftarrow> \<lbrace> x' : b  | c \<rbrace>" using infer_e_appI by metis
+      show "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<tau>\<^sub>1 \<lesssim> \<lbrace> z0 : b\<^sub>1  | c0 \<rbrace>" using infer_e_appI by metis
+      show "atom z0 \<sharp> (x, v)" using infer_e_appI by metis
+    qed
+    moreover have "atom x \<sharp> c" using wfPhi_f_simple_supp_c  infer_e_appI fresh_def \<open>x\<noteq>x'\<close> 
+        atom_eq_iff empty_iff infer_e_appI.hyps insert_iff subset_singletonD by metis
+
+    moreover hence "atom x \<sharp> \<lbrace> x' : b  | c \<rbrace>" using \<tau>.fresh supp_b_empty fresh_def by blast
+    ultimately show  \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> x' : b  | c \<rbrace>\<close> using forget_subst_tv by metis
+
+    have *: "atom x' \<sharp> (x,v)" using infer_v_fresh_g_fresh_xv infer_e_appI check_v_wf by blast
+
+    show  \<open>atom x' \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, v'[x::=v]\<^sub>v\<^sub>v, \<tau>[x::=v]\<^sub>\<tau>\<^sub>v)\<close>   
+      apply(unfold fresh_prodN, intro conjI)
+      apply (fresh_subst_mth_aux add:  infer_e_appI fresh_subst_gv  wfD_wf subst_g_inside)
+      using infer_e_appI fresh_subst_gv  wfD_wf subst_g_inside apply metis
+      using infer_e_appI      fresh_subst_dv_if apply metis
+      done
+
+    have "supp \<tau>' \<subseteq> { atom x' } \<union> supp \<B>" using infer_e_appI wfT_supp wfPhi_f_simple_wfT 
+      by (meson infer_e_appI.hyps(2) le_supI1 wfPhi_f_simple_supp_t)
+    hence "atom x \<sharp> \<tau>'" using  \<open>x\<noteq>x'\<close> fresh_def supp_at_base x_not_in_b_set  by fastforce
+    thus  \<open>\<tau>'[x'::=v'[x::=v]\<^sub>v\<^sub>v]\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v\<close> using subst_tv_commute infer_e_appI subst_defs by metis
+  qed
+next
+  case (infer_e_appPI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> b' f bv x' b c \<tau>' s' v' \<tau>)
+
+  hence "x \<noteq> x'" using \<open>atom x' \<sharp> \<Gamma>''\<close> using wfG_inside_x_neq wfX_wfY by metis
+
+  show ?case proof(subst subst_ev.simps,rule)
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close>  using infer_e_appPI wfD_subst subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using  infer_e_appPI(4) by auto
+    show "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f b'"  using  infer_e_appPI(5) by auto
+    show "Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x' b c \<tau>' s'))) = lookup_fun \<Phi> f"  using  infer_e_appPI(6) by auto
+
+    show "\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> x' : b[bv::=b']\<^sub>b  | c[bv::=b']\<^sub>b \<rbrace>" proof -
+      have \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> x' : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v\<close> proof(rule subst_infer_check_v )
+        show "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> v \<Rightarrow> \<tau>\<^sub>1" using infer_e_appPI by metis
+        show "\<Theta> ; \<B> ; \<Gamma>' @ (x, b\<^sub>1, c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> v' \<Leftarrow> \<lbrace> x' : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>" using infer_e_appPI subst_defs by metis
+        show "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<tau>\<^sub>1 \<lesssim> \<lbrace> z0 : b\<^sub>1  | c0 \<rbrace>" using infer_e_appPI by metis
+        show "atom z0 \<sharp> (x, v)" using infer_e_appPI by metis
+      qed
+      moreover have "atom x \<sharp> c"  proof -
+        have "supp c \<subseteq> {atom x', atom bv}" using  wfPhi_f_poly_supp_c[OF infer_e_appPI(6)] infer_e_appPI by metis
+        thus ?thesis unfolding fresh_def using  \<open>x\<noteq>x'\<close>  atom_eq_iff by auto
+      qed
+      moreover hence "atom x \<sharp> \<lbrace> x' : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>" using \<tau>.fresh supp_b_empty fresh_def subst_b_fresh_x 
+        by (metis subst_b_c_def)
+      ultimately show ?thesis using forget_subst_tv subst_defs by metis
+    qed
+    have "supp \<tau>' \<subseteq> { atom x', atom bv }" using  wfPhi_f_poly_supp_t infer_e_appPI by metis
+    hence "atom x \<sharp> \<tau>'" using fresh_def \<open>x\<noteq>x'\<close> by force
+    hence *:"atom x \<sharp> \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b" using    subst_b_fresh_x subst_b_\<tau>_def by metis
+    have "atom x' \<sharp> (x,v)" using infer_v_fresh_g_fresh_xv infer_e_appPI check_v_wf by blast
+    thus  "atom x' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>" using infer_e_appPI fresh_subst_gv  wfD_wf subst_g_inside fresh_Pair by metis
+    show "\<tau>'[bv::=b']\<^sub>b[x'::=v'[x::=v]\<^sub>v\<^sub>v]\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"  using  infer_e_appPI subst_tv_commute[OF * ] subst_defs by metis
+    show "atom bv \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, b', v'[x::=v]\<^sub>v\<^sub>v, \<tau>[x::=v]\<^sub>\<tau>\<^sub>v)" 
+      by (fresh_mth add: infer_e_appPI fresh_subst_gv_inside)     
+  qed
+next
+  case (infer_e_fstI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v' z' b1 b2 c z)
+
+  hence zf: "atom z \<sharp> CE_fst [v']\<^sup>c\<^sup>e" using ce.fresh e.fresh opp.fresh by metis
+
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,AE_fst v', CE_fst [v']\<^sup>c\<^sup>e , AE_fst v'[x::=v]\<^sub>v\<^sub>v ,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> )" using obtain_fresh by auto
+  hence  **:"(\<lbrace> z : b1  | CE_val (V_var z)  ==  CE_fst [v']\<^sup>c\<^sup>e  \<rbrace>) = \<lbrace> z3' : b1  | CE_val (V_var z3')  ==  CE_fst [v']\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_fstI(4) fresh_Pair zf by metis
+
+  obtain z1' b1' c1' where  z1:"atom z1' \<sharp> (x,v) \<and> \<lbrace> z' : B_pair b1 b2 | c \<rbrace> = \<lbrace> z1' : b1' | c1' \<rbrace>" using obtain_fresh_z by metis
+
+  have bb:"b1' = B_pair b1 b2" using z1 \<tau>.eq_iff by metis
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> (AE_fst v'[x::=v]\<^sub>v\<^sub>v)  \<Rightarrow> \<lbrace> z3' : b1  | CE_val (V_var z3')  ==  CE_fst [v'[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e  \<rbrace>"
+  proof 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using wfD_subst infer_e_fstI  subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_fstI by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1' : B_pair b1 b2 | c1'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_fstI z1 bb by metis
+
+    show \<open>atom z3' \<sharp> AE_fst v'[x::=v]\<^sub>v\<^sub>v \<close> using fresh_Pair * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using * by auto
+  qed
+  moreover have "\<lbrace> z3' : b1  | CE_val (V_var z3')  ==  CE_fst [v'[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e \<rbrace> = \<lbrace> z3' : b1  | CE_val (V_var z3')  ==  CE_fst [v']\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    using subst_tv.simps subst_ev.simps * by auto
+  ultimately show ?case using subst_ev.simps * ** by metis 
+next
+  case (infer_e_sndI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v' z' b1 b2 c z)
+  hence zf: "atom z \<sharp> CE_snd [v']\<^sup>c\<^sup>e" using ce.fresh e.fresh opp.fresh by metis
+
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,AE_snd v', CE_snd [v']\<^sup>c\<^sup>e , AE_snd v'[x::=v]\<^sub>v\<^sub>v ,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ,v', \<Gamma>'')" using obtain_fresh by auto
+  hence  **:"(\<lbrace> z : b2  | CE_val (V_var z)  ==  CE_snd [v']\<^sup>c\<^sup>e  \<rbrace>) = \<lbrace> z3' : b2  | CE_val (V_var z3')  ==  CE_snd [v']\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_sndI(4) fresh_Pair zf by metis
+
+  obtain z1' b2' c1' where  z1:"atom z1' \<sharp> (x,v) \<and> \<lbrace> z' : B_pair b1 b2 | c \<rbrace> = \<lbrace> z1' : b2' | c1' \<rbrace>" using obtain_fresh_z by metis
+
+  have bb:"b2' = B_pair b1 b2" using z1 \<tau>.eq_iff by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> (AE_snd (v'[x::=v]\<^sub>v\<^sub>v))  \<Rightarrow> \<lbrace> z3' : b2  | CE_val (V_var z3')  ==  CE_snd ([v'[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace>"
+  proof 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using wfD_subst infer_e_sndI  subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_sndI by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1' : B_pair b1 b2 | c1'[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> using subst_tv.simps subst_infer_v infer_e_sndI z1 bb by metis
+
+    show \<open>atom z3' \<sharp> AE_snd v'[x::=v]\<^sub>v\<^sub>v \<close> using fresh_Pair * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using * by auto
+  qed
+  moreover have "\<lbrace> z3' : b2  | CE_val (V_var z3')  ==  CE_snd ([v'[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) \<rbrace> = \<lbrace> z3' : b2  | CE_val (V_var z3')  ==  CE_snd [v']\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    by(subst subst_tv.simps, auto simp add: fresh_prodN *)
+  ultimately show ?case using subst_ev.simps * ** by metis 
+next
+  case (infer_e_lenI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v' z' c z)
+  hence zf: "atom z \<sharp> CE_len [v']\<^sup>c\<^sup>e" using ce.fresh e.fresh opp.fresh by metis
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,AE_len v', CE_len [v']\<^sup>c\<^sup>e , AE_len v'[x::=v]\<^sub>v\<^sub>v ,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> , \<Gamma>'',v')" using obtain_fresh by auto
+  hence  **:"(\<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len [v']\<^sup>c\<^sup>e  \<rbrace>) = \<lbrace> z3' : B_int  | CE_val (V_var z3')  ==  CE_len [v']\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_lenI fresh_Pair zf by metis
+
+  have ***: "\<Theta> ; \<B> ; \<Gamma>''  \<turnstile> v' \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3') == CE_val v' \<rbrace>" 
+    using infer_e_lenI infer_v_form3[OF infer_e_lenI(3), of z3'] b_of.simps * fresh_Pair by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> (AE_len (v'[x::=v]\<^sub>v\<^sub>v))  \<Rightarrow> \<lbrace> z3' : B_int | CE_val (V_var z3')  ==  CE_len ([v'[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace>" 
+  proof
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close>  using wfD_subst infer_e_lenI  subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using  infer_e_lenI by metis
+
+    have \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3')  ==  CE_val v'  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v\<close> 
+    proof(rule subst_infer_v)
+      show \<open> \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>\<^sub>1\<close> using infer_e_lenI by metis
+      show  \<open> \<Theta> ; \<B> ; \<Gamma>' @ (x, b\<^sub>1, c0[z0::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile> v' \<Rightarrow> \<lbrace> z3' : B_bitvec  | [ [ z3' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v' ]\<^sup>c\<^sup>e  \<rbrace>\<close> using *** infer_e_lenI by metis
+      show "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<tau>\<^sub>1 \<lesssim> \<lbrace> z0 : b\<^sub>1  | c0 \<rbrace>" using infer_e_lenI by metis
+      show "atom z0 \<sharp> (x, v)" using infer_e_lenI by metis
+    qed
+
+    thus  \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3')  ==  CE_val v'[x::=v]\<^sub>v\<^sub>v  \<rbrace>\<close> 
+      using  subst_tv.simps subst_ev.simps fresh_Pair * fresh_prodN subst_vv.simps by auto
+
+    show \<open>atom z3' \<sharp> AE_len v'[x::=v]\<^sub>v\<^sub>v\<close> using fresh_Pair * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using fresh_Pair * by metis
+  qed
+
+  moreover have "\<lbrace> z3' : B_int | CE_val (V_var z3')  ==  CE_len ([v'[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) \<rbrace> = \<lbrace> z3' : B_int  | CE_val (V_var z3')  ==  CE_len [v']\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    using subst_tv.simps subst_ev.simps * by auto
+
+  ultimately show ?case using subst_ev.simps *  ** by metis 
+next
+  case (infer_e_mvarI \<Theta> \<B> \<Gamma>'' \<Phi> \<Delta> u \<tau>)
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> (AE_mvar u) \<Rightarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" 
+  proof
+    show \<open> \<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close>  proof - 
+      have "wfV \<Theta> \<B> \<Gamma> v (b_of \<tau>\<^sub>1)" using infer_v_wf infer_e_mvarI by auto
+      moreover have "b_of \<tau>\<^sub>1 = b\<^sub>1" using subtype_eq_base2 infer_e_mvarI b_of.simps by simp
+      ultimately show ?thesis using wf_subst(3)[OF infer_e_mvarI(1), of \<Gamma>' x b\<^sub>1 "c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v" \<Gamma> v] infer_e_mvarI subst_g_inside by metis
+    qed
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_mvarI  by auto
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using wfD_subst infer_e_mvarI  subtype_eq_base2 b_of.simps by metis
+    show \<open>(u, \<tau>[x::=v]\<^sub>\<tau>\<^sub>v) \<in> setD \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v\<close>  using infer_e_mvarI  subst_dv_member by metis
+  qed
+  moreover have " (AE_mvar u) =  (AE_mvar u)[x::=v]\<^sub>e\<^sub>v" using subst_ev.simps by auto
+  ultimately show ?case by auto
+
+next
+  case (infer_e_concatI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+
+  hence zf: "atom z3 \<sharp> CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e" using ce.fresh e.fresh opp.fresh by metis 
+
+  obtain z3'::x where *:"atom z3' \<sharp> (x,v,v1,v2,AE_concat v1 v2, CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e , AE_concat (v1[x::=v]\<^sub>v\<^sub>v) (v2[x::=v]\<^sub>v\<^sub>v) ,\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> , \<Gamma>'',v1 , v2)" using obtain_fresh by auto
+
+  hence  **:"(\<lbrace> z3 : B_bitvec  | CE_val (V_var z3)  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e \<rbrace>) = \<lbrace> z3' : B_bitvec  | CE_val (V_var z3')  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" 
+    using type_e_eq  infer_e_concatI fresh_Pair zf by metis
+  have zfx: "atom x \<sharp> z3'"  using fresh_at_base fresh_prodN * by auto
+
+  have v1: "\<Theta> ; \<B> ; \<Gamma>''  \<turnstile> v1 \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3') == CE_val v1 \<rbrace>" 
+    using infer_e_concatI infer_v_form3 b_of.simps * fresh_Pair by metis
+  have v2: "\<Theta> ; \<B> ; \<Gamma>''  \<turnstile> v2 \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3') == CE_val v2 \<rbrace>" 
+    using infer_e_concatI infer_v_form3 b_of.simps * fresh_Pair by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> (AE_concat (v1[x::=v]\<^sub>v\<^sub>v) (v2[x::=v]\<^sub>v\<^sub>v))  \<Rightarrow> \<lbrace> z3' : B_bitvec | CE_val (V_var z3')  ==  CE_concat ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e)  \<rbrace>" 
+  proof
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close>  using wfD_subst infer_e_concatI  subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> by(simp add: infer_e_concatI) 
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3')  ==  CE_val (v1[x::=v]\<^sub>v\<^sub>v)  \<rbrace>\<close>
+      using subst_infer_v_form infer_e_concatI fresh_prodN * b_of.simps by metis
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>  \<turnstile> v2[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z3' : B_bitvec  | CE_val (V_var z3')  ==  CE_val (v2[x::=v]\<^sub>v\<^sub>v)  \<rbrace>\<close>   
+      using subst_infer_v_form infer_e_concatI fresh_prodN * b_of.simps by metis
+    show \<open>atom z3' \<sharp> AE_concat v1[x::=v]\<^sub>v\<^sub>v  v2[x::=v]\<^sub>v\<^sub>v\<close> using fresh_Pair * by metis
+    show \<open>atom z3' \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close> using fresh_Pair * by metis
+  qed
+
+  moreover have "\<lbrace> z3' : B_bitvec | CE_val (V_var z3')  ==  CE_concat ([v1[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) ([v2[x::=v]\<^sub>v\<^sub>v]\<^sup>c\<^sup>e) \<rbrace> = \<lbrace> z3' : B_bitvec  | CE_val (V_var z3')  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+    using subst_tv.simps subst_ev.simps * by auto
+
+  ultimately show ?case using subst_ev.simps ** * by metis
+next
+  case (infer_e_splitI \<Theta> \<B> \<Gamma>'' \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  hence *:"atom z3 \<sharp> (x,v)" using fresh_Pair by auto
+  have \<open>x \<noteq> z3 \<close> using infer_e_splitI by force
+  have "\<Theta> ; \<Phi> ; \<B> ; (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>) ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> (AE_split v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v) \<Rightarrow> 
+               \<lbrace> z3 : [ B_bitvec , B_bitvec ]\<^sup>b  | [ v1[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  ==  [ [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   AND  
+                     [| [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  ==  [ v2[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e   \<rbrace>"
+  proof
+    show \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close>  using wfD_subst infer_e_splitI  subtype_eq_base2 b_of.simps by metis
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_splitI by auto
+    have  \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1 \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v\<close> 
+      using subst_infer_v infer_e_splitI by metis
+    thus \<open> \<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> \<turnstile> v1[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1[x::=v]\<^sub>c\<^sub>v \<rbrace>\<close> 
+      using infer_e_splitI subst_tv.simps fresh_Pair by metis
+    have \<open>x \<noteq> z2 \<close> using infer_e_splitI by force
+    have "(\<lbrace> z2 : B_int  | ([ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)   
+                     AND  ([ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )  \<rbrace>) = 
+         (\<lbrace> z2 : B_int  | ([ leq [ [ L_num  0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )  
+                     AND  ([ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1 ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v)"
+      unfolding subst_cv.simps subst_cev.simps subst_vv.simps using \<open>x \<noteq> z2\<close> infer_e_splitI fresh_Pair by simp
+    thus  \<open>\<Theta> ; \<B> ; \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @
+                 \<Gamma>  \<turnstile> v2[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> z2 : B_int  | [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   
+                     AND  [ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>\<close>
+      using infer_e_splitI  subst_infer_check_v fresh_Pair by metis
+
+    show \<open>atom z1 \<sharp> AE_split v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v\<close> using infer_e_splitI fresh_subst_vv_if by auto
+    show \<open>atom z2 \<sharp> AE_split v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v\<close> using infer_e_splitI fresh_subst_vv_if by auto
+    show \<open>atom z3 \<sharp> AE_split v1[x::=v]\<^sub>v\<^sub>v v2[x::=v]\<^sub>v\<^sub>v\<close> using infer_e_splitI fresh_subst_vv_if by auto
+
+    show \<open>atom z3 \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close>  using   fresh_subst_gv_inside infer_e_splitI by metis
+    show \<open>atom z2 \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close>  using   fresh_subst_gv_inside infer_e_splitI by metis
+    show \<open>atom z1 \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<close>  using   fresh_subst_gv_inside infer_e_splitI by metis
+  qed
+  thus ?case apply (subst subst_tv.simps)
+    using infer_e_splitI fresh_Pair apply metis
+    unfolding subst_tv.simps subst_ev.simps subst_cv.simps subst_cev.simps subst_vv.simps * 
+    using \<open>x \<noteq> z3\<close> by simp
+qed
+
+lemma infer_e_uniqueness:
+  assumes "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>  \<turnstile> e\<^sub>1 \<Rightarrow> \<tau>\<^sub>1" and "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>  \<turnstile> e\<^sub>1 \<Rightarrow> \<tau>\<^sub>2"
+  shows "\<tau>\<^sub>1 = \<tau>\<^sub>2"
+  using assms proof(nominal_induct rule:e.strong_induct)
+  case (AE_val x)
+  then show ?case using infer_e_elims(7)[OF AE_val(1)] infer_e_elims(7)[OF AE_val(2)] infer_v_uniqueness by metis
+next
+  case (AE_app f v)
+
+  obtain x1 b1 c1 s1' \<tau>1' where t1: "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f \<and>  \<tau>\<^sub>1 = \<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v" using  infer_e_app2E[OF AE_app(1)] by metis
+  moreover obtain x2 b2 c2 s2' \<tau>2' where t2: "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f \<and>  \<tau>\<^sub>2 = \<tau>2'[x2::=v]\<^sub>\<tau>\<^sub>v" using  infer_e_app2E[OF AE_app(2)] by metis
+
+  have "\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[x2::=v]\<^sub>\<tau>\<^sub>v" using t1 and t2  fun_ret_unique by metis
+  thus ?thesis using t1 t2 by auto
+next
+  case (AE_appP f b v)
+  obtain bv1 x1 b1 c1 s1' \<tau>1' where t1: "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f \<and>  \<tau>\<^sub>1 = \<tau>1'[bv1::=b]\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v" using  infer_e_appP2E[OF AE_appP(1)] by metis
+  moreover obtain bv2 x2 b2 c2 s2' \<tau>2' where t2: "Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f \<and>  \<tau>\<^sub>2 = \<tau>2'[bv2::=b]\<^sub>\<tau>\<^sub>b[x2::=v]\<^sub>\<tau>\<^sub>v" using  infer_e_appP2E[OF AE_appP(2)] by metis
+
+  have "\<tau>1'[bv1::=b]\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[bv2::=b]\<^sub>\<tau>\<^sub>b[x2::=v]\<^sub>\<tau>\<^sub>v" using t1 and t2  fun_poly_ret_unique by metis
+  thus ?thesis using t1 t2 by auto
+next
+  case (AE_op opp v1 v2)
+  show ?case proof(rule opp.exhaust)
+    assume "opp = plus"
+    hence "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<tau>\<^sub>1" and  "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<tau>\<^sub>2" using AE_op by auto
+    thus ?thesis using infer_e_elims(11)[OF \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<tau>\<^sub>1\<close> ] infer_e_elims(11)[OF \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<tau>\<^sub>2\<close> ]
+      by force
+  next
+    assume "opp = leq"
+    hence "opp = LEq" using opp.strong_exhaust by auto
+    hence "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op LEq v1 v2 \<Rightarrow> \<tau>\<^sub>1" and  "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op LEq v1 v2 \<Rightarrow> \<tau>\<^sub>2" using AE_op by auto
+    thus ?thesis using infer_e_elims(12)[OF \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op LEq v1 v2 \<Rightarrow> \<tau>\<^sub>1\<close> ] infer_e_elims(12)[OF \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op LEq v1 v2 \<Rightarrow> \<tau>\<^sub>2\<close> ]
+      by force
+  next
+    assume "opp = eq"
+    hence "opp = Eq" using opp.strong_exhaust by auto
+    hence "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Eq v1 v2 \<Rightarrow> \<tau>\<^sub>1" and  "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Eq v1 v2 \<Rightarrow> \<tau>\<^sub>2" using AE_op by auto
+    thus ?thesis using infer_e_elims(25)[OF \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Eq v1 v2 \<Rightarrow> \<tau>\<^sub>1\<close> ] infer_e_elims(25)[OF \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AE_op Eq v1 v2 \<Rightarrow> \<tau>\<^sub>2\<close> ]
+      by force
+  qed
+next
+  case (AE_concat v1 v2)
+
+  obtain z3::x where t1:"\<tau>\<^sub>1 = \<lbrace> z3 : B_bitvec  | [ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace> \<and> atom z3 \<sharp> v1 \<and> atom z3 \<sharp> v2 " using infer_e_elims(18)[OF AE_concat(1)] by metis
+  obtain z3'::x where t2:"\<tau>\<^sub>2 = \<lbrace> z3' : B_bitvec  | [ [ z3' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace> \<and> atom z3' \<sharp> v1 \<and> atom z3' \<sharp> v2" using infer_e_elims(18)[OF AE_concat(2)] by metis
+
+  thus ?case using t1 t2 type_e_eq ce.fresh by metis
+
+next
+  case (AE_fst v)
+
+  obtain z1 and b1 where "\<tau>\<^sub>1 = \<lbrace> z1 : b1  | CE_val (V_var z1)  ==  (CE_fst [v]\<^sup>c\<^sup>e)  \<rbrace>" using infer_v_form AE_fst by auto
+
+  obtain xx :: x and bb :: b and xxa :: x and bba :: b and cc :: c where
+    f1: "\<tau>\<^sub>2 = \<lbrace> xx : bb | CE_val (V_var xx) == CE_fst [v]\<^sup>c\<^sup>e \<rbrace> \<and> \<Theta> ; \<B> ; GNil\<turnstile>\<^sub>w\<^sub>f \<Delta> \<and> \<Theta> ; \<B> ; GNil \<turnstile> v \<Rightarrow> \<lbrace> xxa : B_pair bb bba | cc \<rbrace> \<and> atom xx \<sharp> v"
+    using infer_e_elims(8)[OF AE_fst(2)] by metis
+  obtain xxb :: x and bbb :: b and xxc :: x and bbc :: b and cca :: c where
+    f2: "\<tau>\<^sub>1 = \<lbrace> xxb : bbb | CE_val (V_var xxb) == CE_fst [v]\<^sup>c\<^sup>e \<rbrace> \<and> \<Theta> ; \<B> ; GNil\<turnstile>\<^sub>w\<^sub>f \<Delta> \<and> \<Theta> ; \<B> ; GNil \<turnstile> v \<Rightarrow> \<lbrace> xxc : B_pair bbb bbc | cca \<rbrace> \<and> atom xxb \<sharp> v"
+    using infer_e_elims(8)[OF AE_fst(1)] by metis
+  then have "B_pair bb bba = B_pair bbb bbc"
+    using f1 by (metis (no_types) b_of.simps infer_v_uniqueness) 
+  then have "\<lbrace> xx : bbb | CE_val (V_var xx) == CE_fst [v]\<^sup>c\<^sup>e \<rbrace> = \<tau>\<^sub>2"
+    using f1 by auto 
+  then show ?thesis
+    using f2 by (meson ce.fresh fresh_GNil type_e_eq wfG_x_fresh_in_v_simple) 
+next
+  case (AE_snd v)
+  obtain xx :: x and bb :: b and xxa :: x and bba :: b and cc :: c where
+    f1: "\<tau>\<^sub>2 = \<lbrace> xx : bba | CE_val (V_var xx) == CE_snd [v]\<^sup>c\<^sup>e \<rbrace> \<and> \<Theta> ; \<B> ; GNil\<turnstile>\<^sub>w\<^sub>f \<Delta> \<and> \<Theta> ; \<B> ; GNil \<turnstile> v \<Rightarrow> \<lbrace> xxa : B_pair bb bba | cc \<rbrace> \<and> atom xx \<sharp> v"
+    using infer_e_elims(9)[OF AE_snd(2)] by metis
+  obtain xxb :: x and bbb :: b and xxc :: x and bbc :: b and cca :: c where
+    f2: "\<tau>\<^sub>1 = \<lbrace> xxb : bbc | CE_val (V_var xxb) == CE_snd [v]\<^sup>c\<^sup>e \<rbrace> \<and> \<Theta> ; \<B> ; GNil\<turnstile>\<^sub>w\<^sub>f \<Delta> \<and> \<Theta> ; \<B> ; GNil \<turnstile> v \<Rightarrow> \<lbrace> xxc : B_pair bbb bbc | cca \<rbrace> \<and> atom xxb \<sharp> v"
+    using infer_e_elims(9)[OF AE_snd(1)] by metis
+  then have "B_pair bb bba = B_pair bbb bbc"
+    using f1 by (metis (no_types) b_of.simps infer_v_uniqueness) 
+  then have "\<lbrace> xx : bbc | CE_val (V_var xx) == CE_snd [v]\<^sup>c\<^sup>e \<rbrace> = \<tau>\<^sub>2"
+    using f1 by auto 
+  then show ?thesis
+    using f2 by (meson ce.fresh fresh_GNil type_e_eq wfG_x_fresh_in_v_simple) 
+next
+  case (AE_mvar x)
+  then show ?case using infer_e_elims(10)[OF AE_mvar(1)] infer_e_elims(10)[OF AE_mvar(2)] wfD_unique   by metis
+next
+  case (AE_len x)
+  then show ?case using infer_e_elims(16)[OF AE_len(1)] infer_e_elims(16)[OF AE_len(2)] by force
+next
+  case (AE_split x1a x2)
+  then show ?case using infer_e_elims(22)[OF AE_split(1)] infer_e_elims(22)[OF AE_split(2)] by force
+qed
+
+section \<open>Statements\<close>
+
+lemma subst_infer_check_v1:
+  fixes v::v and v'::v and \<Gamma>::\<Gamma>
+  assumes "\<Gamma> = \<Gamma>\<^sub>1@((x,b\<^sub>1,c0[z0::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>\<^sub>2)"  and 
+    "\<Theta> ; \<B> ; \<Gamma>\<^sub>2 \<turnstile> v \<Rightarrow> \<tau>\<^sub>1"  and
+    "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v' \<Leftarrow> \<tau>\<^sub>2"  and
+    "\<Theta> ; \<B> ; \<Gamma>\<^sub>2 \<turnstile> \<tau>\<^sub>1 \<lesssim>  \<lbrace> z0 : b\<^sub>1 | c0 \<rbrace>" and "atom z0 \<sharp> (x,v)"
+  shows "\<Theta> ; \<B>  ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v \<turnstile>  v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<tau>\<^sub>2[x::=v]\<^sub>\<tau>\<^sub>v"
+  using  subst_g_inside check_v_wf assms subst_infer_check_v by metis
+
+lemma infer_v_c_valid:
+  assumes " \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>"  and   "\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<tau> \<lesssim> \<lbrace> z : b  | c \<rbrace>"
+  shows  \<open>\<Theta> ; \<B> ; \<Gamma>  \<Turnstile> c[z::=v]\<^sub>c\<^sub>v \<close>
+proof -
+  obtain z1 and b1 and c1 where *:"\<tau> = \<lbrace> z1 : b1 | c1 \<rbrace> \<and> atom z1 \<sharp> (c,v,\<Gamma>)" using obtain_fresh_z by metis
+  then have "b1 = b" using assms subtype_eq_base by metis
+  moreover then have "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z1 : b | c1 \<rbrace>" using assms * by auto
+
+  moreover have "\<Theta> ; \<B> ; (z1, b, c1) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=[ z1 ]\<^sup>v]\<^sub>c\<^sub>v " proof -
+    have "\<Theta> ; \<B> ; (z1, b, c1[z1::=[ z1 ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=[ z1 ]\<^sup>v]\<^sub>v "
+      using subtype_valid[OF assms(2), of z1 z1 b c1 z c ] * fresh_prodN \<open>b1 = b\<close> by metis
+    moreover have "c1[z1::=[ z1 ]\<^sup>v]\<^sub>v = c1" using subst_v_v_def by simp
+    ultimately show ?thesis using subst_v_c_def by metis
+  qed
+  ultimately show ?thesis using * fresh_prodN subst_valid_simple by metis
+qed
+
+text \<open> Substitution Lemma for Statements \<close>
+
+lemma subst_infer_check_s:
+  fixes v::v and s::s and cs::branch_s and x::x and c::c and b::b and 
+    \<Gamma>\<^sub>1::\<Gamma> and \<Gamma>\<^sub>2::\<Gamma> and css::branch_list
+  assumes "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Rightarrow> \<tau>"  and "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> \<tau> \<lesssim> \<lbrace> z : b | c \<rbrace>"  and
+    "atom z \<sharp> (x, v)"
+  shows  "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>; \<Delta>  \<turnstile> s \<Leftarrow>  \<tau>'   \<Longrightarrow> 
+          \<Gamma> = (\<Gamma>\<^sub>2@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>\<^sub>1)) \<Longrightarrow> 
+          \<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<turnstile> s[x::=v]\<^sub>s\<^sub>v  \<Leftarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" 
+    and 
+    "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>; \<Delta>; tid ; cons ; const ; v' \<turnstile> cs \<Leftarrow> \<tau>' \<Longrightarrow> 
+          \<Gamma> = (\<Gamma>\<^sub>2@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>\<^sub>1)) \<Longrightarrow> 
+          \<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v; 
+          tid ; cons ; const ; v'[x::=v]\<^sub>v\<^sub>v \<turnstile> cs[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" 
+    and
+    "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>; \<Delta>; tid ; dclist ; v' \<turnstile> css \<Leftarrow> \<tau>' \<Longrightarrow> 
+         \<Gamma> = (\<Gamma>\<^sub>2@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>\<^sub>1)) \<Longrightarrow> 
+         \<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v; tid ; dclist ; v'[x::=v]\<^sub>v\<^sub>v \<turnstile> 
+             subst_branchlv css x v  \<Leftarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v"
+
+  using assms proof(nominal_induct \<tau>' and \<tau>' and \<tau>' avoiding: x v arbitrary: \<Gamma>\<^sub>2 and \<Gamma>\<^sub>2  and \<Gamma>\<^sub>2 
+    rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_valI \<Theta>  \<B> \<Gamma> \<Delta>  \<Phi>  v' \<tau>' \<tau>'')
+
+  have sg: " \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>1" using  check_valI  by subst_mth
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> (AS_val (v'[x::=v]\<^sub>v\<^sub>v)) \<Leftarrow> \<tau>''[x::=v]\<^sub>\<tau>\<^sub>v" proof
+    have "\<Theta> ; \<B> ; \<Gamma>\<^sub>1\<turnstile>\<^sub>w\<^sub>f v : b " using infer_v_v_wf subtype_eq_base2 b_of.simps check_valI by metis
+    thus  \<open>\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v\<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v\<close>  using wf_subst(15) check_valI by auto
+    show \<open> \<Theta>\<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_valI by auto
+    show \<open> \<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Rightarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v\<close> proof(subst sg, rule subst_infer_v)
+      show "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Rightarrow> \<tau>" using check_valI by auto
+      show "\<Theta> ; \<B> ; \<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1 \<turnstile> v' \<Rightarrow> \<tau>'"  using check_valI by metis
+      show "\<Theta> ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> \<tau> \<lesssim> \<lbrace> z: b   | c \<rbrace>" using check_valI by auto
+      show "atom z \<sharp> (x, v)" using check_valI by auto
+    qed
+    show \<open>\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile>  \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> \<tau>''[x::=v]\<^sub>\<tau>\<^sub>v\<close> using subst_subtype_tau check_valI sg by metis
+  qed
+
+  thus  ?case using Typing.check_valI subst_sv.simps sg by auto
+next
+  case (check_letI xa \<Theta> \<Phi> \<B> \<Gamma> \<Delta> ea \<tau>a za sa ba ca)
+  have *:"(AS_let xa ea sa)[x::=v]\<^sub>s\<^sub>v=(AS_let xa (ea[x::=v]\<^sub>e\<^sub>v) sa[x::=v]\<^sub>s\<^sub>v)" 
+    using subst_sv.simps \<open> atom xa \<sharp> x\<close>  \<open> atom xa \<sharp> v\<close> by auto
+  show ?case unfolding * proof
+
+    show "atom xa \<sharp> (\<Theta>,\<Phi>,\<B>,\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v,\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v,ea[x::=v]\<^sub>e\<^sub>v,\<tau>a[x::=v]\<^sub>\<tau>\<^sub>v)"
+      by(subst_tuple_mth add: check_letI)
+
+    show  "atom za \<sharp> (xa,\<Theta>,\<Phi>,\<B>,\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v,ea[x::=v]\<^sub>e\<^sub>v,
+                         \<tau>a[x::=v]\<^sub>\<tau>\<^sub>v,sa[x::=v]\<^sub>s\<^sub>v)"
+      by(subst_tuple_mth add: check_letI)
+
+    show "\<Theta>; \<Phi>; \<B>; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<turnstile> 
+                          ea[x::=v]\<^sub>e\<^sub>v \<Rightarrow>  \<lbrace> za : ba | ca[x::=v]\<^sub>c\<^sub>v \<rbrace>" 
+    proof - 
+      have "\<Theta>; \<Phi>; \<B>; \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<turnstile> 
+                          ea[x::=v]\<^sub>e\<^sub>v \<Rightarrow> \<lbrace> za : ba | ca \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v" 
+        using check_letI subst_infer_e by metis
+      thus ?thesis using check_letI subst_tv.simps 
+        by (metis fresh_prod2I infer_e_wf subst_g_inside_simple)
+    qed
+
+    show  "\<Theta>; \<Phi>; \<B>; (xa, ba, ca[x::=v]\<^sub>c\<^sub>v[za::=V_var xa]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v;
+                          \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> sa[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>a[x::=v]\<^sub>\<tau>\<^sub>v" 
+    proof -   
+      have "\<Theta>; \<Phi>; \<B>; ((xa, ba, ca[za::=V_var xa]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v ; 
+                          \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile>  sa[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>a[x::=v]\<^sub>\<tau>\<^sub>v" 
+        apply(rule check_letI(23)[of "(xa, ba, ca[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>2"])
+        by(metis check_letI append_g.simps subst_defs)+
+
+      moreover have "(xa, ba, ca[x::=v]\<^sub>c\<^sub>v[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = 
+                     ((xa, ba, ca[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v" 
+        using subst_cv_commute subst_gv.simps check_letI 
+        by (metis ms_fresh_all(39) ms_fresh_all(49) subst_cv_commute_full)
+      ultimately show ?thesis 
+        using subst_defs by  auto      
+    qed
+  qed
+next
+  case (check_assertI xa \<Theta> \<Phi> \<B> \<Gamma> \<Delta> ca \<tau> s)
+  show ?case unfolding subst_sv.simps proof  
+    show \<open>atom xa \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, ca[x::=v]\<^sub>c\<^sub>v, \<tau>[x::=v]\<^sub>\<tau>\<^sub>v, s[x::=v]\<^sub>s\<^sub>v)\<close> 
+      by(subst_tuple_mth add: check_assertI)
+    have "xa \<noteq> x" using check_assertI by fastforce
+    thus \<open> \<Theta> ; \<Phi> ; \<B> ; (xa, B_bool, ca[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v\<close> 
+      using check_assertI(12)[of "(xa, B_bool, c) #\<^sub>\<Gamma> \<Gamma>\<^sub>2" x v]  check_assertI subst_gv.simps append_g.simps by metis
+    have \<open>\<Theta> ; \<B> ; \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1  \<Turnstile> ca[x::=v]\<^sub>c\<^sub>v \<close> proof(rule  subst_valid )
+      show   \<open>\<Theta> ; \<B> ; \<Gamma>\<^sub>1  \<Turnstile> c[z::=v]\<^sub>c\<^sub>v \<close> using infer_v_c_valid check_assertI by metis
+      show \<open> \<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile>\<^sub>w\<^sub>f v : b \<close> using check_assertI infer_v_wf b_of.simps subtype_eq_base 
+        by (metis subtype_eq_base2)
+      show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>\<^sub>1 \<close> using check_assertI infer_v_wf by metis
+      have " \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>\<^sub>2 @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1" using check_assertI wfX_wfY by metis
+      thus  \<open>atom x \<sharp> \<Gamma>\<^sub>1\<close> using check_assertI wfG_suffix wfG_elims by metis    
+
+      moreover have "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b  | c \<rbrace>" using subtype_wfT check_assertI by metis
+      moreover have "x \<noteq> z" using fresh_Pair check_assertI fresh_x_neq by metis
+      ultimately show  \<open>atom x \<sharp> c\<close> using check_assertI wfT_fresh_c by metis
+
+      show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>\<^sub>2 @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1 \<close> using check_assertI wfX_wfY by metis
+      show \<open>\<Theta> ; \<B> ; \<Gamma>\<^sub>2 @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1  \<Turnstile> ca \<close> using check_assertI by auto
+    qed
+    thus  \<open>\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<Turnstile> ca[x::=v]\<^sub>c\<^sub>v \<close> using check_assertI 
+    proof -
+      show ?thesis
+        by (metis (no_types) \<open>\<Gamma> = \<Gamma>\<^sub>2 @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1\<close> \<open>\<Theta> ; \<B> ; \<Gamma> \<Turnstile> ca\<close> \<open>\<Theta> ; \<B> ; \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1 \<Turnstile> ca[x::=v]\<^sub>c\<^sub>v\<close> subst_g_inside valid_g_wf) (* 93 ms *)
+    qed
+
+    have "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile>\<^sub>w\<^sub>f v : b" using infer_v_wf b_of.simps check_assertI 
+      by (metis subtype_eq_base2)
+    thus  \<open> \<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<close> using wf_subst2(6) check_assertI by metis
+  qed
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist vv cs \<tau> css)  
+  show ?case unfolding * using subst_sv.simps check_branch_list_consI by simp
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
+  show ?case unfolding * using subst_sv.simps check_branch_list_finalI by simp
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const xa \<Phi> tid cons va sa)
+  hence *:"(AS_branch cons xa sa)[x::=v]\<^sub>s\<^sub>v = (AS_branch cons xa sa[x::=v]\<^sub>s\<^sub>v)" using subst_branchv.simps fresh_Pair by metis
+  show ?case unfolding *  proof
+
+    show "\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v\<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v "   
+      using wf_subst check_branch_s_branchI subtype_eq_base2 b_of.simps infer_v_wf by metis 
+
+    show  "\<turnstile>\<^sub>w\<^sub>f \<Theta> " using check_branch_s_branchI by metis
+
+    show  "\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v]\<^sub>\<tau>\<^sub>v " 
+      using wf_subst check_branch_s_branchI subtype_eq_base2 b_of.simps infer_v_wf by metis 
+
+    show wft:"\<Theta> ; {||} ; GNil\<turnstile>\<^sub>w\<^sub>f const "  using check_branch_s_branchI by metis
+
+    show "atom xa \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, tid, cons, const,va[x::=v]\<^sub>v\<^sub>v, \<tau>[x::=v]\<^sub>\<tau>\<^sub>v)"
+      apply(unfold fresh_prodN, (simp add: check_branch_s_branchI )+)
+      apply(rule,metis fresh_z_subst_g check_branch_s_branchI fresh_Pair )
+      by(metis fresh_subst_dv check_branch_s_branchI fresh_Pair )  
+
+    have "\<Theta> ; \<Phi> ; \<B> ; ((xa, b_of const, CE_val va  ==  CE_val(V_cons tid cons (V_var xa))   AND c_of const xa) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> sa[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" 
+      using check_branch_s_branchI   by (metis append_g.simps(2))
+
+    moreover have "(xa, b_of const, CE_val va[x::=v]\<^sub>v\<^sub>v  ==  CE_val (V_cons tid cons (V_var xa))   AND c_of (const) xa) #\<^sub>\<Gamma> \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = 
+                  ((xa, b_of const , CE_val va  ==  CE_val (V_cons tid cons (V_var xa)) AND c_of const xa) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v" 
+    proof -
+      have *:"xa \<noteq> x" using check_branch_s_branchI fresh_at_base by metis
+      have "atom x \<sharp> const" using wfT_nil_supp[OF wft]  fresh_def by auto
+      hence "atom x \<sharp> (const,xa)" using fresh_at_base wfT_nil_supp[OF wft] fresh_Pair fresh_def * by auto
+      moreover hence "(c_of (const) xa)[x::=v]\<^sub>c\<^sub>v =  c_of (const) xa"  
+        using c_of_fresh[of x const xa] forget_subst_cv wfT_nil_supp wft by metis
+      moreover hence "(V_cons tid cons (V_var xa))[x::=v]\<^sub>v\<^sub>v  = (V_cons tid cons (V_var xa))" using check_branch_s_branchI subst_vv.simps * by metis    
+      ultimately show ?thesis using subst_gv.simps check_branch_s_branchI subst_cv.simps subst_cev.simps *  by presburger
+    qed
+
+    ultimately show  "\<Theta> ; \<Phi> ; \<B> ; (xa, b_of const, CE_val va[x::=v]\<^sub>v\<^sub>v  ==  CE_val (V_cons tid cons (V_var xa))  AND  c_of const xa) #\<^sub>\<Gamma> \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> sa[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" 
+      by metis
+  qed
+
+next
+  case (check_let2I xa \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau>a s2 )
+  hence *:"(AS_let2 xa t s1 s2)[x::=v]\<^sub>s\<^sub>v = (AS_let2 xa t[x::=v]\<^sub>\<tau>\<^sub>v  (s1[x::=v]\<^sub>s\<^sub>v) s2[x::=v]\<^sub>s\<^sub>v)" using subst_sv.simps fresh_Pair by metis
+  have "xa \<noteq> x"  using check_let2I fresh_at_base by metis
+  show ?case unfolding * proof
+    show "atom xa \<sharp> (\<Theta>, \<Phi>, \<B>, G[x::=v]\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, t[x::=v]\<^sub>\<tau>\<^sub>v, s1[x::=v]\<^sub>s\<^sub>v, \<tau>a[x::=v]\<^sub>\<tau>\<^sub>v)" 
+      by(subst_tuple_mth add: check_let2I)    
+    show "\<Theta> ; \<Phi> ; \<B> ; G[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s1[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[x::=v]\<^sub>\<tau>\<^sub>v" using check_let2I by metis
+
+    have "\<Theta> ; \<Phi> ; \<B> ; ((xa, b_of t, c_of t xa) #\<^sub>\<Gamma> G)[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s2[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>a[x::=v]\<^sub>\<tau>\<^sub>v" 
+    proof(rule check_let2I(14))
+      show \<open>(xa, b_of t, c_of t xa) #\<^sub>\<Gamma> G = (((xa, b_of t, c_of t xa)#\<^sub>\<Gamma> \<Gamma>\<^sub>2)) @ (x, b, c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1\<close> 
+        using check_let2I append_g.simps by metis
+      show \<open> \<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Rightarrow> \<tau>\<close> using check_let2I by metis
+      show \<open>\<Theta> ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> \<tau> \<lesssim> \<lbrace> z : b  | c \<rbrace>\<close> using check_let2I by metis
+      show \<open>atom z \<sharp> (x, v)\<close> using check_let2I by metis
+    qed
+    moreover  have "c_of t[x::=v]\<^sub>\<tau>\<^sub>v xa = (c_of t xa)[x::=v]\<^sub>c\<^sub>v" using subst_v_c_of fresh_Pair check_let2I by metis
+    moreover have "b_of t[x::=v]\<^sub>\<tau>\<^sub>v = b_of t" using b_of.simps subst_tv.simps b_of_subst by metis
+    ultimately show " \<Theta> ; \<Phi> ; \<B> ; (xa, b_of t[x::=v]\<^sub>\<tau>\<^sub>v, c_of t[x::=v]\<^sub>\<tau>\<^sub>v xa) #\<^sub>\<Gamma> G[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s2[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>a[x::=v]\<^sub>\<tau>\<^sub>v" 
+      using check_let2I(14) subst_gv.simps \<open>xa \<noteq> x\<close> b_of.simps by metis
+  qed
+
+next
+
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' va \<tau>'' s)
+  have **: "\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>1" using subst_g_inside check_s_wf check_varI by meson
+
+  have "\<Theta> ; \<Phi>  ;\<B> ; subst_gv \<Gamma> x v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v \<turnstile> AS_var u \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v (va[x::=v]\<^sub>v\<^sub>v) (subst_sv s x v) \<Leftarrow> \<tau>''[x::=v]\<^sub>\<tau>\<^sub>v" 
+  proof(rule Typing.check_varI)
+    show "atom u \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v, va[x::=v]\<^sub>v\<^sub>v, \<tau>''[x::=v]\<^sub>\<tau>\<^sub>v)" 
+      by(subst_tuple_mth add: check_varI)    
+    show "\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> va[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" using check_varI subst_infer_check_v ** by metis
+    show "\<Theta> ; \<Phi> ; \<B> ; subst_gv \<Gamma> x v ; (u, \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v) #\<^sub>\<Delta> \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>''[x::=v]\<^sub>\<tau>\<^sub>v" proof - 
+      have "wfD \<Theta> \<B> (\<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1) ((u,\<tau>')#\<^sub>\<Delta> \<Delta>)" using check_varI check_s_wf  by meson
+      moreover have "wfV \<Theta> \<B> \<Gamma>\<^sub>1 v (b_of \<tau>)"  using infer_v_wf check_varI(6) check_varI by metis
+      have "wfD \<Theta> \<B> (\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v) ((u, \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v) #\<^sub>\<Delta> \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v)" proof(subst subst_dv.simps(2)[symmetric], subst **, rule wfD_subst)
+        show "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Rightarrow> \<tau>" using check_varI by auto
+        show "\<Theta> ; \<B> ; \<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1\<turnstile>\<^sub>w\<^sub>f (u, \<tau>') #\<^sub>\<Delta> \<Delta>" using check_varI check_s_wf by simp
+        show "b_of \<tau> = b" using check_varI subtype_eq_base2 b_of.simps by auto
+      qed
+      thus ?thesis using  check_varI by auto
+    qed
+  qed
+  moreover have "atom u \<sharp> (x,v)" using u_fresh_xv by auto
+  ultimately show ?case using subst_sv.simps(7) by auto
+
+next
+  case (check_assignI P \<Phi> \<B> \<Gamma> \<Delta> u \<tau>1  v' z1 \<tau>')  (* may need to revisit subst in \<Delta> as well *)
+
+  have "wfG P \<B> \<Gamma>" using check_v_wf check_assignI by simp
+  hence gs: "\<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1 = \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v" using subst_g_inside check_assignI by simp
+
+  have "P ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> AS_assign u (v'[x::=v]\<^sub>v\<^sub>v) \<Leftarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v"
+  proof(rule Typing.check_assignI)
+    show "P \<turnstile>\<^sub>w\<^sub>f \<Phi> " using check_assignI by auto
+    show "wfD P \<B> (\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v) \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v" using wf_subst(15)[OF check_assignI(2)] gs infer_v_v_wf check_assignI b_of.simps subtype_eq_base2 by metis
+    thus "(u, \<tau>1[x::=v]\<^sub>\<tau>\<^sub>v) \<in> setD \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v" using check_assignI  subst_dv_member by metis
+    thus  "P ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<tau>1[x::=v]\<^sub>\<tau>\<^sub>v" using subst_infer_check_v check_assignI gs by metis
+
+    have "P ; \<B> ; \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" proof(rule subst_subtype_tau)
+      show "P ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> v \<Rightarrow> \<tau>" using check_assignI by auto
+      show "P ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> \<tau> \<lesssim> \<lbrace> z : b  | c \<rbrace>" using check_assignI by meson
+      show "P ; \<B> ; \<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'" using check_assignI
+        by (metis Abs1_eq_iff(3) \<tau>.eq_iff c.fresh(1) c.perm_simps(1))
+      show "atom z \<sharp> (x, v)" using check_assignI by auto
+    qed
+    moreover have "\<lbrace> z : B_unit  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : B_unit  | TRUE \<rbrace>" using subst_tv.simps subst_cv.simps check_assignI by presburger
+    ultimately show   "P ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" using gs by auto
+  qed
+  thus ?case using subst_sv.simps(5) by auto
+
+next
+  case (check_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z' s2 \<tau>')
+  have " wfG \<Theta> \<B> (\<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1)" using check_whileI check_s_wf by meson
+  hence **: " \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>1" using subst_g_inside wf check_whileI  by auto
+  have teq: "(\<lbrace> z : B_unit  | TRUE \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v = (\<lbrace> z : B_unit  | TRUE \<rbrace>)"  by(auto simp add: subst_sv.simps check_whileI)
+  moreover have "(\<lbrace> z : B_unit  | TRUE \<rbrace>) = (\<lbrace> z' : B_unit  | TRUE \<rbrace>)" using type_eq_flip c.fresh flip_fresh_fresh by metis
+  ultimately have  teq2:"(\<lbrace> z' : B_unit  | TRUE \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v = (\<lbrace> z' : B_unit  | TRUE \<rbrace>)" by metis
+
+  hence "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s1[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<lbrace> z' : B_bool  | TRUE \<rbrace>" using check_whileI  subst_sv.simps subst_top_eq by metis
+  moreover have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s2[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<lbrace> z' : B_unit  | TRUE \<rbrace>" using check_whileI subst_top_eq by metis
+  moreover have "\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> \<lbrace> z' : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" proof -
+    have "\<Theta> ; \<B> ; \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1  \<turnstile> \<lbrace> z' : B_unit  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v \<lesssim> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" proof(rule subst_subtype_tau)
+      show "\<Theta> ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> v \<Rightarrow> \<tau>" by(auto simp add: check_whileI)
+      show "\<Theta> ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> \<tau> \<lesssim> \<lbrace> z : b  | c \<rbrace>"  by(auto simp add: check_whileI)
+      show "\<Theta> ; \<B> ; \<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1  \<turnstile> \<lbrace> z' : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'"  using check_whileI by metis
+      show "atom z \<sharp> (x, v)" by(auto simp add: check_whileI)
+    qed
+    thus ?thesis using teq2 ** by auto
+  qed
+
+  ultimately have  " \<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> AS_while s1[x::=v]\<^sub>s\<^sub>v s2[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v" 
+    using Typing.check_whileI  by metis
+  then show ?case  using subst_sv.simps by metis
+next
+  case (check_seqI P \<Phi> \<B> \<Gamma> \<Delta>   s1 z s2 \<tau> ) 
+  hence "P ; \<Phi>; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ;  \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v   \<turnstile> AS_seq (s1[x::=v]\<^sub>s\<^sub>v) (s2[x::=v]\<^sub>s\<^sub>v)  \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" using Typing.check_seqI subst_top_eq check_seqI by metis
+  then show ?case using subst_sv.simps by metis
+next
+  case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v' cs \<tau>  za)
+
+  have wf: "wfG \<Theta> \<B> \<Gamma>" using check_caseI  check_v_wf  by simp
+  have **: "\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>1" using subst_g_inside wf check_caseI by auto
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> AS_match (v'[x::=v]\<^sub>v\<^sub>v) (subst_branchlv cs x v) \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" proof(rule  Typing.check_caseI )
+    show "check_branch_list \<Theta> \<Phi> \<B> (\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v) \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v tid dclist v'[x::=v]\<^sub>v\<^sub>v (subst_branchlv cs x v ) (\<tau>[x::=v]\<^sub>\<tau>\<^sub>v)"  using check_caseI by auto
+    show "AF_typedef tid dclist \<in> set \<Theta>" using check_caseI by auto
+    show "\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> za : B_id tid  | TRUE \<rbrace>" proof -
+      have "\<Theta> ; \<B> ; \<Gamma>\<^sub>2 @ (x, b, c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1  \<turnstile> v' \<Leftarrow>  \<lbrace> za : B_id tid  | TRUE \<rbrace>"
+        using check_caseI by argo
+      hence "\<Theta> ; \<B> ; \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>\<^sub>1  \<turnstile> v'[x::=v]\<^sub>v\<^sub>v \<Leftarrow>  (\<lbrace> za : B_id tid  | TRUE \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v" 
+        using check_caseI subst_infer_check_v[OF check_caseI(7) _  check_caseI(8)  check_caseI(9)] by meson
+      moreover have "(\<lbrace> za : B_id tid  | TRUE \<rbrace>) = ((\<lbrace> za : B_id tid  | TRUE \<rbrace>)[x::=v]\<^sub>\<tau>\<^sub>v)"  
+        using subst_cv.simps subst_tv.simps subst_cv_true by fast
+      ultimately show  ?thesis using check_caseI ** by argo
+    qed
+    show "wfTh \<Theta>" using check_caseI by auto
+  qed
+  thus ?case using subst_branchlv.simps subst_sv.simps(4) by metis
+next
+  case (check_ifI z' \<Theta> \<Phi> \<B> \<Gamma> \<Delta> va s1 s2 \<tau>')
+  show ?case unfolding  subst_sv.simps proof
+    show \<open>atom z' \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v, va[x::=v]\<^sub>v\<^sub>v, s1[x::=v]\<^sub>s\<^sub>v, s2[x::=v]\<^sub>s\<^sub>v, \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v)\<close> 
+      by(subst_tuple_mth add: check_ifI)    
+    have *:"\<lbrace> z' : B_bool  | TRUE \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z' : B_bool  | TRUE \<rbrace>" using subst_tv.simps check_ifI 
+      by (metis freshers(19) subst_cv.simps(1) type_eq_subst)
+    have **: "\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>2[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>1" using subst_g_inside wf check_ifI check_v_wf by metis
+    show   \<open>\<Theta> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v  \<turnstile> va[x::=v]\<^sub>v\<^sub>v \<Leftarrow> \<lbrace> z' : B_bool  | TRUE \<rbrace>\<close> 
+    proof(subst *[symmetric], rule subst_infer_check_v1[where \<Gamma>\<^sub>1=\<Gamma>\<^sub>2 and \<Gamma>\<^sub>2=\<Gamma>\<^sub>1])
+      show "\<Gamma> = \<Gamma>\<^sub>2 @ ((x, b ,c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<^sub>1)" using check_ifI by metis
+      show \<open> \<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Rightarrow> \<tau>\<close> using check_ifI by metis
+      show \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile> va \<Leftarrow> \<lbrace> z' : B_bool  | TRUE \<rbrace>\<close> using check_ifI by metis
+      show \<open>\<Theta> ; \<B> ; \<Gamma>\<^sub>1  \<turnstile> \<tau> \<lesssim> \<lbrace> z : b  | c \<rbrace>\<close> using check_ifI by metis
+      show \<open>atom z \<sharp> (x, v)\<close> using check_ifI by metis
+    qed
+
+    have " \<lbrace> z' : b_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v  | [ va[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v z'  \<rbrace> = \<lbrace> z' : b_of \<tau>'  | [ va ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' z'  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+      by(simp add: subst_tv.simps fresh_Pair check_ifI b_of_subst subst_v_c_of)
+
+    thus  \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s1[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<lbrace> z' : b_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v  | [ va[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v z'  \<rbrace>\<close>      
+      using check_ifI by metis
+    have " \<lbrace> z' : b_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v  | [ va[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v z'  \<rbrace> = \<lbrace> z' : b_of \<tau>'  | [ va ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' z'  \<rbrace>[x::=v]\<^sub>\<tau>\<^sub>v"
+      by(simp add: subst_tv.simps fresh_Pair check_ifI b_of_subst subst_v_c_of)
+    thus \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s2[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<lbrace> z' : b_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v  | [ va[x::=v]\<^sub>v\<^sub>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v z'  \<rbrace>\<close> 
+      using check_ifI by metis
+  qed
+qed
+
+lemma subst_check_check_s:
+  fixes v::v and s::s and cs::branch_s and x::x and c::c and b::b and \<Gamma>\<^sub>1::\<Gamma> and \<Gamma>\<^sub>2::\<Gamma>
+  assumes "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Leftarrow> \<lbrace> z : b | c \<rbrace>"  and  "atom z \<sharp> (x, v)"
+    and  "check_s \<Theta> \<Phi> \<B> \<Gamma> \<Delta>  s  \<tau>'" and "\<Gamma>  = (\<Gamma>\<^sub>2@((x,b,c[z::=[x]\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>\<^sub>1))" 
+  shows "check_s \<Theta> \<Phi> \<B> (subst_gv \<Gamma> x v)    \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  (s[x::=v]\<^sub>s\<^sub>v)  (subst_tv  \<tau>' x v )" 
+proof -
+  obtain \<tau> where  "\<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> v \<Rightarrow> \<tau> \<and> \<Theta> ; \<B> ; \<Gamma>\<^sub>1 \<turnstile> \<tau> \<lesssim> \<lbrace> z : b | c \<rbrace>" using check_v_elims assms by auto
+  thus ?thesis using subst_infer_check_s assms by metis
+qed
+
+text \<open> If a statement checks against a type @{text "\<tau>"} then it checks against a supertype of @{text "\<tau>"} \<close>
+lemma check_s_supertype:
+  fixes v::v and s::s and cs::branch_s and x::x and c::c and b::b and \<Gamma>::\<Gamma> and \<Gamma>'::\<Gamma> and css::branch_list
+  shows  "check_s \<Theta> \<Phi> \<B> G \<Delta>  s  t1 \<Longrightarrow> \<Theta> ; \<B> ; G \<turnstile> t1 \<lesssim> t2  \<Longrightarrow> check_s \<Theta> \<Phi> \<B> G \<Delta>  s  t2"  and 
+    "check_branch_s \<Theta> \<Phi> \<B> G \<Delta> tid cons const v cs t1 \<Longrightarrow> \<Theta> ; \<B> ; G \<turnstile> t1 \<lesssim> t2 \<Longrightarrow> check_branch_s \<Theta> \<Phi> \<B> G \<Delta> tid cons const v cs t2" and
+    "check_branch_list \<Theta> \<Phi> \<B> G \<Delta> tid dclist v css t1 \<Longrightarrow> \<Theta> ; \<B> ; G \<turnstile> t1 \<lesssim> t2 \<Longrightarrow> check_branch_list \<Theta> \<Phi> \<B> G \<Delta> tid dclist v css t2"
+proof(induct arbitrary: t2 and t2 and t2 rule: check_s_check_branch_s_check_branch_list.inducts)
+  case (check_valI  \<Theta> \<B> \<Gamma> \<Delta>  \<Phi> v \<tau>' \<tau>  )
+  hence " \<Theta> ; \<B> ; \<Gamma> \<turnstile> \<tau>' \<lesssim> t2" using subtype_trans by meson
+  then show ?case using subtype_trans Typing.check_valI check_valI by metis
+
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  show ?case proof(rule Typing.check_letI)
+    show "atom x \<sharp>(\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, e, t2)" using check_letI subtype_fresh_tau fresh_prodN by metis
+    show "atom z \<sharp> (x, \<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, e, t2, s)" using check_letI(2) subtype_fresh_tau[of z \<tau> \<Gamma> _ _ t2] fresh_prodN check_letI(6) by auto
+    show "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" using check_letI by meson
+
+    have "wfG \<Theta> \<B> ((x, b, c[z::=[x]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" using check_letI check_s_wf subst_defs by metis
+    moreover have "toSet \<Gamma> \<subseteq> toSet ((x, b, c[z::=[x]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" by auto
+    ultimately have "  \<Theta> ; \<B> ; (x, b, c[z::=[x]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> \<tau> \<lesssim> t2" using subtype_weakening[OF check_letI(6)] by auto
+    thus  "\<Theta> ; \<Phi> ; \<B> ; (x, b, c[z::=[x]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> t2" using check_letI subst_defs by metis
+  qed
+next  
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> css)
+  then show ?case using  Typing.check_branch_list_consI by auto
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
+  then show ?case using  Typing.check_branch_list_finalI by auto
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
+  show  ?case proof
+    have "atom x \<sharp> t2" using subtype_fresh_tau[of x \<tau> ] check_branch_s_branchI(5,8)   fresh_prodN by metis
+    thus  "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, tid, cons, const, v, t2)" using check_branch_s_branchI  fresh_prodN by metis
+    show  "wfT \<Theta> \<B> \<Gamma> t2" using subtype_wf check_branch_s_branchI by meson
+    show  "\<Theta> ; \<Phi> ; \<B> ; (x, b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x)) AND c_of const x) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> t2" proof -
+      have "wfG \<Theta> \<B> ((x, b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x))   AND c_of const x) #\<^sub>\<Gamma> \<Gamma>)" using check_s_wf check_branch_s_branchI by metis
+      moreover have "toSet \<Gamma> \<subseteq> toSet ((x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x)) AND c_of const x) #\<^sub>\<Gamma> \<Gamma>)" by auto
+      hence "\<Theta> ; \<B> ; ((x, b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x)) AND c_of const x) #\<^sub>\<Gamma> \<Gamma>) \<turnstile> \<tau> \<lesssim> t2" 
+        using check_branch_s_branchI subtype_weakening 
+        using calculation by presburger
+      thus ?thesis using check_branch_s_branchI by presburger
+    qed
+  qed(auto simp add: check_branch_s_branchI)
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  show  ?case proof(rule Typing.check_ifI)
+    have *:"atom z \<sharp> t2" using subtype_fresh_tau[of z \<tau> \<Gamma> ] check_ifI   fresh_prodN by auto
+    thus \<open>atom z \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, v, s1, s2, t2)\<close> using check_ifI fresh_prodN by auto
+    show \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile> v \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>\<close> using check_ifI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<lbrace> z : b_of t2  | [ v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of t2 z  \<rbrace>\<close> 
+      using check_ifI subtype_if1 fresh_prodN base_for_lit.simps b_of.simps * check_v_wf by metis
+
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<lbrace> z : b_of t2  | [ v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of t2 z  \<rbrace>\<close>
+      using check_ifI subtype_if1 fresh_prodN base_for_lit.simps b_of.simps * check_v_wf by metis
+  qed
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+
+  show ?case proof
+    have "atom x \<sharp> t2" using subtype_fresh_tau[OF _ _ \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<tau> \<lesssim> t2\<close>] check_assertI fresh_prodN by simp
+    thus  "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, c, t2, s)"   using subtype_fresh_tau check_assertI   fresh_prodN by simp
+    have "\<Theta> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>  \<turnstile> \<tau> \<lesssim> t2" apply(rule subtype_weakening) 
+      using check_assertI apply simp
+      using toSet.simps apply blast
+      using check_assertI check_s_wf by simp
+    thus  "\<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> t2" using check_assertI by simp
+    show "\<Theta> ; \<B> ; \<Gamma>  \<Turnstile> c " using check_assertI by auto
+    show "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> " using check_assertI by auto
+  qed
+next
+  case (check_let2I x P \<Phi> \<B> G \<Delta> t s1 \<tau> s2 )
+  have "wfG P \<B> ((x, b_of t, c_of t x) #\<^sub>\<Gamma> G)" 
+    using check_let2I check_s_wf by metis
+  moreover have "toSet G \<subseteq> toSet ((x, b_of t, c_of t x) #\<^sub>\<Gamma> G)" by auto
+  ultimately have  *:"P ; \<B> ; (x, b_of t, c_of t x) #\<^sub>\<Gamma> G  \<turnstile> \<tau> \<lesssim> t2" using check_let2I subtype_weakening by metis
+  show  ?case proof(rule Typing.check_let2I)
+    have "atom x \<sharp> t2" using subtype_fresh_tau[of x \<tau> ] check_let2I   fresh_prodN by metis  
+    thus "atom x \<sharp> (P, \<Phi>, \<B>, G, \<Delta>, t, s1, t2)" using check_let2I  fresh_prodN by metis
+    show "P ; \<Phi> ; \<B> ; G ; \<Delta>  \<turnstile> s1 \<Leftarrow> t"  using check_let2I by blast
+    show "P ; \<Phi> ; \<B> ;(x, b_of t, c_of t x ) #\<^sub>\<Gamma> G ; \<Delta>  \<turnstile> s2 \<Leftarrow> t2" using check_let2I * by blast
+  qed
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  show ?case proof(rule Typing.check_varI)
+    have "atom u \<sharp> t2" using u_fresh_t by auto
+    thus \<open>atom u \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, \<tau>', v, t2)\<close> using check_varI  fresh_prodN by auto
+    show \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile> v \<Leftarrow> \<tau>'\<close> using check_varI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; (u, \<tau>') #\<^sub>\<Delta> \<Delta>  \<turnstile> s \<Leftarrow> t2\<close> using check_varI by auto
+  qed
+next
+  case (check_assignI \<Delta> u \<tau> P G v z \<tau>')
+  then show ?case using Typing.check_assignI by (meson subtype_trans)
+next
+  case (check_whileI \<Delta> G P s1 z s2 \<tau>')
+  then show ?case using Typing.check_whileI by (meson subtype_trans)
+next
+  case (check_seqI \<Delta> G P s1 z s2 \<tau>)
+  then show ?case using Typing.check_seqI by blast
+next
+  case (check_caseI \<Delta> \<Gamma> \<Theta> tid cs \<tau> v z)
+  then show ?case using Typing.check_caseI subtype_trans   by meson
+
+qed
+
+lemma subtype_let:
+  fixes s'::s and cs::branch_s and css::branch_list and v::v
+  shows "\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AS_let x e\<^sub>1 s \<Leftarrow> \<tau> \<Longrightarrow> \<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>  \<turnstile> e\<^sub>1 \<Rightarrow> \<tau>\<^sub>1 \<Longrightarrow> 
+        \<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>  \<turnstile> e\<^sub>2 \<Rightarrow> \<tau>\<^sub>2 \<Longrightarrow> \<Theta> ; \<B> ; GNil \<turnstile> \<tau>\<^sub>2 \<lesssim> \<tau>\<^sub>1 \<Longrightarrow> \<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AS_let x e\<^sub>2 s \<Leftarrow> \<tau>" and
+    "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+proof(nominal_induct GNil  \<Delta> "AS_let x e\<^sub>1 s" \<tau> and \<tau> and \<tau> avoiding: e\<^sub>2  \<tau>\<^sub>1 \<tau>\<^sub>2 
+    rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_letI x1 \<Theta> \<Phi> \<B>  \<Delta> \<tau>1 z1 s1 b1 c1)
+  obtain z2 and b2 and c2 where t2:"\<tau>\<^sub>2 = \<lbrace> z2 : b2 | c2 \<rbrace> \<and> atom z2 \<sharp> (x1, \<Theta>, \<Phi>, \<B>, GNil, \<Delta>, e\<^sub>2, \<tau>1, s1) " 
+    using obtain_fresh_z by metis
+
+  obtain z1a and b1a and c1a where t1:"\<tau>\<^sub>1 = \<lbrace> z1a : b1a  | c1a \<rbrace> \<and> atom z1a \<sharp> x1" using infer_e_uniqueness check_letI by  metis
+  hence t3: " \<lbrace> z1a : b1a  | c1a \<rbrace>  =  \<lbrace> z1 : b1  | c1 \<rbrace> " using infer_e_uniqueness check_letI by  metis 
+
+  have beq: "b1a = b2 \<and> b2 = b1" using check_letI subtype_eq_base t1 t2 t3 by metis
+
+  have " \<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>   \<turnstile> AS_let x1  e\<^sub>2 s1 \<Leftarrow> \<tau>1"  proof
+    show \<open>atom x1 \<sharp> (\<Theta>, \<Phi>, \<B>, GNil, \<Delta>, e\<^sub>2, \<tau>1)\<close> using check_letI t2 fresh_prodN by metis
+    show \<open>atom z2 \<sharp> (x1, \<Theta>, \<Phi>, \<B>, GNil, \<Delta>, e\<^sub>2, \<tau>1, s1)\<close> using check_letI t2  using check_letI t2 fresh_prodN by metis
+    show \<open>\<Theta> ; \<Phi> ; \<B> ; GNil ; \<Delta>  \<turnstile> e\<^sub>2 \<Rightarrow> \<lbrace> z2 : b2  | c2 \<rbrace>\<close> using check_letI t2 by metis
+
+    have \<open> \<Theta> ; \<Phi> ; \<B> ; GNil@(x1, b2, c2[z2::=[ x1 ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<tau>1\<close>
+    proof(rule ctx_subtype_s)
+      have "c1a[z1a::=[ x1 ]\<^sup>v]\<^sub>c\<^sub>v = c1[z1::=[ x1 ]\<^sup>v]\<^sub>c\<^sub>v" using subst_v_flip_eq_two subst_v_c_def t3 \<tau>.eq_iff by metis
+      thus  \<open> \<Theta> ; \<Phi> ; \<B> ; GNil @ (x1, b2, c1a[z1a::=[ x1 ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<tau>1\<close> using check_letI beq append_g.simps subst_defs by metis
+      show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> \<lbrace> z2 : b2  | c2 \<rbrace> \<lesssim> \<lbrace> z1a : b2  | c1a \<rbrace>\<close> using check_letI beq  t1 t2 by metis
+      have "atom x1 \<sharp> c2" using t2 check_letI \<tau>_fresh_c fresh_prodN  by blast
+      moreover have "atom x1 \<sharp> c1a" using t1 check_letI \<tau>_fresh_c fresh_prodN  by blast
+      ultimately show \<open>atom x1 \<sharp> (z1a, z2, c1a, c2)\<close> using t1 t2 fresh_prodN fresh_x_neq by metis
+    qed
+
+    thus \<open> \<Theta> ; \<Phi> ; \<B> ; (x1, b2, c2[z2::=[ x1 ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<tau>1\<close> using append_g.simps subst_defs by metis
+  qed
+
+  moreover have "AS_let x1  e\<^sub>2 s1 = AS_let x  e\<^sub>2 s" using check_letI s_branch_s_branch_list.eq_iff  by metis
+
+  ultimately show ?case  by metis
+
+qed(auto+)
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/MiniSail.thy b/thys/MiniSail/MiniSail.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/MiniSail.thy
@@ -0,0 +1,10 @@
+(*<*)
+theory MiniSail 
+  imports  
+    "Safety"   
+begin
+(*>*)
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MiniSail/Nominal-Utils.thy b/thys/MiniSail/Nominal-Utils.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Nominal-Utils.thy
@@ -0,0 +1,586 @@
+(*<*)
+theory "Nominal-Utils"
+imports Nominal2.Nominal2 "HOL-Library.AList"
+begin
+(*>*)
+
+chapter \<open>Prelude\<close>
+text \<open>Some useful Nominal lemmas. Many of these are from Launchbury.Nominal-Utils.\<close>
+
+section \<open>Lemmas helping with equivariance proofs\<close>
+
+lemma perm_rel_lemma:
+  assumes "\<And> \<pi> x y. r (\<pi> \<bullet> x) (\<pi> \<bullet> y) \<Longrightarrow> r x y"
+  shows "r (\<pi> \<bullet> x) (\<pi> \<bullet> y) \<longleftrightarrow> r x y" (is "?l \<longleftrightarrow> ?r")
+by (metis (full_types) assms permute_minus_cancel(2))
+
+lemma perm_rel_lemma2:
+  assumes "\<And> \<pi> x y. r x y \<Longrightarrow> r (\<pi> \<bullet> x) (\<pi> \<bullet> y)"
+  shows "r x y \<longleftrightarrow> r (\<pi> \<bullet> x) (\<pi> \<bullet> y)" (is "?l \<longleftrightarrow> ?r")
+by (metis (full_types) assms permute_minus_cancel(2))
+
+lemma fun_eqvtI:
+  assumes f_eqvt[eqvt]: "(\<And> p x. p \<bullet> (f x) = f (p \<bullet> x))"
+  shows "p \<bullet> f = f" by perm_simp rule
+
+lemma eqvt_at_apply:
+  assumes "eqvt_at f x"
+  shows "(p \<bullet> f) x = f x"
+by (metis (hide_lams, no_types) assms eqvt_at_def permute_fun_def permute_minus_cancel(1))
+
+lemma eqvt_at_apply':
+  assumes "eqvt_at f x"
+  shows "p \<bullet> f x = f (p \<bullet> x)"
+by (metis (hide_lams, no_types) assms eqvt_at_def)
+
+lemma eqvt_at_apply'':
+  assumes "eqvt_at f x"
+  shows "(p \<bullet> f) (p \<bullet> x) = f (p \<bullet> x)"
+by (metis (hide_lams, no_types) assms eqvt_at_def permute_fun_def permute_minus_cancel(1))
+
+lemma size_list_eqvt[eqvt]: "p \<bullet> size_list f x = size_list (p \<bullet> f) (p \<bullet> x)"
+proof (induction x)
+  case (Cons x xs)
+  have "f x = p \<bullet> (f x)" by (simp add: permute_pure)
+  also have "... = (p \<bullet> f) (p \<bullet> x)" by simp
+  with Cons
+  show ?case by (auto simp add: permute_pure)
+qed simp
+
+section \<open> Freshness via equivariance \<close>
+
+lemma eqvt_fresh_cong1: "(\<And>p x. p \<bullet> (f x) = f (p \<bullet> x)) \<Longrightarrow> a \<sharp> x \<Longrightarrow> a \<sharp> f x "
+  apply (rule fresh_fun_eqvt_app[of f])
+  apply (rule eqvtI)
+  apply (rule eq_reflection)
+  apply (rule ext)
+  apply (metis permute_fun_def permute_minus_cancel(1))
+  apply assumption
+  done
+
+lemma eqvt_fresh_cong2:
+  assumes eqvt: "(\<And>p x y. p \<bullet> (f x y) = f (p \<bullet> x) (p \<bullet> y))"
+  and fresh1: "a \<sharp> x" and fresh2: "a \<sharp> y"
+  shows "a \<sharp> f x y"
+proof-
+  have "eqvt (\<lambda> (x,y). f x y)"
+    using eqvt
+    apply (- , auto simp add: eqvt_def)
+    by (rule ext, auto, metis permute_minus_cancel(1))
+  moreover
+  have "a \<sharp> (x, y)" using fresh1 fresh2 by auto
+  ultimately
+  have "a \<sharp> (\<lambda> (x,y). f x y) (x, y)" by (rule fresh_fun_eqvt_app)
+  thus ?thesis by simp
+qed
+
+lemma eqvt_fresh_star_cong1:
+  assumes eqvt: "(\<And>p x. p \<bullet> (f x) = f (p \<bullet> x))"
+  and fresh1: "a \<sharp>* x"
+  shows "a \<sharp>* f x"
+  by (metis fresh_star_def eqvt_fresh_cong1 assms)
+
+lemma eqvt_fresh_star_cong2:
+  assumes eqvt: "(\<And>p x y. p \<bullet> (f x y) = f (p \<bullet> x) (p \<bullet> y))"
+  and fresh1: "a \<sharp>* x" and fresh2: "a \<sharp>* y"
+  shows "a \<sharp>* f x y"
+  by (metis fresh_star_def eqvt_fresh_cong2 assms)
+
+lemma eqvt_fresh_cong3:
+  assumes eqvt: "(\<And>p x y z. p \<bullet> (f x y z) = f (p \<bullet> x) (p \<bullet> y) (p \<bullet> z))"
+  and fresh1: "a \<sharp> x" and fresh2: "a \<sharp> y" and fresh3: "a \<sharp> z"
+  shows "a \<sharp> f x y z"
+proof-
+  have "eqvt (\<lambda> (x,y,z). f x y z)"
+    using eqvt
+    apply (- , auto simp add: eqvt_def)
+    by(rule ext, auto, metis permute_minus_cancel(1))
+  moreover
+  have "a \<sharp> (x, y, z)" using fresh1 fresh2 fresh3 by auto
+  ultimately
+  have "a \<sharp> (\<lambda> (x,y,z). f x y z) (x, y, z)" by (rule fresh_fun_eqvt_app)
+  thus ?thesis by simp
+qed
+
+lemma eqvt_fresh_star_cong3:
+  assumes eqvt: "(\<And>p x y z. p \<bullet> (f x y z) = f (p \<bullet> x) (p \<bullet> y) (p \<bullet> z))"
+  and fresh1: "a \<sharp>* x" and fresh2: "a \<sharp>* y" and fresh3: "a \<sharp>* z"
+  shows "a \<sharp>* f x y z"
+  by (metis fresh_star_def eqvt_fresh_cong3 assms)
+
+section \<open> Additional simplification rules \<close>
+
+lemma not_self_fresh[simp]: "atom x \<sharp> x \<longleftrightarrow> False"
+  by (metis fresh_at_base(2))
+
+lemma fresh_star_singleton: "{ x } \<sharp>* e \<longleftrightarrow> x \<sharp> e"
+  by (simp add: fresh_star_def)
+
+section \<open> Additional equivariance lemmas \<close>
+
+lemma eqvt_cases:
+  fixes f x \<pi>
+  assumes eqvt: "\<And>x. \<pi> \<bullet> f x = f (\<pi> \<bullet> x)"
+  obtains "f x" "f (\<pi> \<bullet> x)" | "\<not> f x " " \<not> f (\<pi> \<bullet> x)"
+  using assms[symmetric]
+   by (cases "f x") auto
+
+lemma range_eqvt: "\<pi> \<bullet> range Y = range (\<pi> \<bullet> Y)"
+  unfolding image_eqvt UNIV_eqvt ..
+
+lemma case_option_eqvt[eqvt]:
+  "\<pi> \<bullet> case_option d f x = case_option (\<pi> \<bullet> d) (\<pi> \<bullet> f) (\<pi> \<bullet> x)"
+  by(cases x)(simp_all)
+
+lemma supp_option_eqvt:
+  "supp (case_option d f x) \<subseteq> supp d \<union> supp f \<union> supp x"
+  apply (cases x)
+  apply (auto simp add: supp_Some )
+  apply (metis (mono_tags) Un_iff subsetCE supp_fun_app)
+  done
+
+lemma funpow_eqvt[simp,eqvt]:
+  "\<pi> \<bullet> ((f :: 'a \<Rightarrow> 'a::pt) ^^ n) = (\<pi> \<bullet> f) ^^ (\<pi> \<bullet> n)"
+ by (induct n,simp, rule ext, simp, perm_simp,simp)
+
+lemma delete_eqvt[eqvt]:
+  "\<pi> \<bullet> AList.delete x \<Gamma> = AList.delete (\<pi> \<bullet> x) (\<pi> \<bullet> \<Gamma>)"
+by (induct \<Gamma>, auto)
+
+lemma restrict_eqvt[eqvt]:
+  "\<pi> \<bullet> AList.restrict S \<Gamma> = AList.restrict (\<pi> \<bullet> S) (\<pi> \<bullet> \<Gamma>)"
+unfolding AList.restrict_eq by perm_simp rule
+
+lemma supp_restrict:
+  "supp (AList.restrict S \<Gamma>) \<subseteq> supp \<Gamma>"
+ by (induction \<Gamma>) (auto simp add: supp_Pair supp_Cons)
+
+lemma clearjunk_eqvt[eqvt]:
+  "\<pi> \<bullet> AList.clearjunk \<Gamma> = AList.clearjunk (\<pi> \<bullet> \<Gamma>)"
+  by (induction \<Gamma> rule: clearjunk.induct) auto
+
+lemma map_ran_eqvt[eqvt]:
+  "\<pi> \<bullet> map_ran f \<Gamma> = map_ran (\<pi> \<bullet> f) (\<pi> \<bullet> \<Gamma>)"
+by (induct \<Gamma>, auto)
+
+lemma dom_perm:
+  "dom (\<pi> \<bullet> f) = \<pi> \<bullet> (dom f)"
+  unfolding dom_def by (perm_simp) (simp)
+
+lemmas dom_perm_rev[simp,eqvt] = dom_perm[symmetric]
+
+lemma ran_perm[simp]:
+  "\<pi> \<bullet> (ran f) = ran (\<pi> \<bullet> f)"
+  unfolding ran_def by (perm_simp) (simp)
+
+lemma map_add_eqvt[eqvt]:
+  "\<pi> \<bullet> (m1 ++ m2) = (\<pi> \<bullet> m1) ++ (\<pi> \<bullet> m2)"
+  unfolding map_add_def
+  by (perm_simp, rule)
+
+lemma map_of_eqvt[eqvt]:
+  "\<pi> \<bullet> map_of l = map_of (\<pi> \<bullet> l)"
+  by (induct l, simp add: permute_fun_def,simp,perm_simp,auto)
+
+lemma concat_eqvt[eqvt]: "\<pi> \<bullet> concat l = concat (\<pi> \<bullet> l)"
+  by (induction l)(auto simp add: append_eqvt)
+
+lemma tranclp_eqvt[eqvt]: "\<pi> \<bullet> tranclp P v\<^sub>1 v\<^sub>2 = tranclp (\<pi> \<bullet> P) (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)" 
+  unfolding tranclp_def by perm_simp rule
+
+lemma rtranclp_eqvt[eqvt]: "\<pi> \<bullet> rtranclp P v\<^sub>1 v\<^sub>2 = rtranclp (\<pi> \<bullet> P) (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)" 
+  unfolding rtranclp_def by perm_simp rule
+
+lemma Set_filter_eqvt[eqvt]: "\<pi> \<bullet> Set.filter P S = Set.filter (\<pi> \<bullet> P) (\<pi> \<bullet> S)"
+  unfolding Set.filter_def
+  by perm_simp rule
+
+lemma Sigma_eqvt'[eqvt]: "\<pi> \<bullet> Sigma = Sigma"
+  apply (rule ext)
+  apply (rule ext)
+  apply (subst permute_fun_def)
+  apply (subst permute_fun_def)
+  unfolding Sigma_def
+  apply perm_simp
+  apply (simp add: permute_self)
+  done
+
+lemma override_on_eqvt[eqvt]:
+  "\<pi> \<bullet> (override_on m1 m2 S) = override_on (\<pi> \<bullet> m1) (\<pi> \<bullet> m2) (\<pi> \<bullet> S)"
+  by (auto simp add: override_on_def )
+
+lemma card_eqvt[eqvt]:
+  "\<pi> \<bullet> (card S) = card (\<pi> \<bullet> S)"
+by (cases "finite S", induct rule: finite_induct) (auto simp add: card_insert_if mem_permute_iff permute_pure)
+
+(* Helper lemmas provided by Christian Urban *)
+
+lemma Projl_permute:
+  assumes a: "\<exists>y. f = Inl y"
+  shows "(p \<bullet> (Sum_Type.projl f)) = Sum_Type.projl (p \<bullet> f)"
+using a by auto
+
+lemma Projr_permute:
+  assumes a: "\<exists>y. f = Inr y"
+  shows "(p \<bullet> (Sum_Type.projr f)) = Sum_Type.projr (p \<bullet> f)"
+using a by auto
+
+section \<open> Freshness lemmas \<close>
+
+lemma fresh_list_elem:
+  assumes "a \<sharp> \<Gamma>"
+  and "e \<in> set \<Gamma>"
+  shows "a \<sharp> e"
+using assms
+by(induct \<Gamma>)(auto simp add: fresh_Cons)
+
+lemma set_not_fresh:
+  "x \<in> set L \<Longrightarrow> \<not>(atom x \<sharp> L)"
+  by (metis fresh_list_elem not_self_fresh)
+
+lemma pure_fresh_star[simp]: "a \<sharp>* (x :: 'a :: pure)"
+  by (simp add: fresh_star_def pure_fresh)
+
+lemma supp_set_mem: "x \<in> set L \<Longrightarrow> supp x \<subseteq> supp L"
+  by (induct L) (auto simp add: supp_Cons)
+
+lemma set_supp_mono: "set L \<subseteq> set L2 \<Longrightarrow> supp L \<subseteq> supp L2"
+  by (induct L)(auto simp add: supp_Cons supp_Nil dest:supp_set_mem)
+
+lemma fresh_star_at_base:
+  fixes x :: "'a :: at_base"
+  shows "S \<sharp>* x \<longleftrightarrow> atom x \<notin> S"
+  by (metis fresh_at_base(2) fresh_star_def)
+
+section \<open> Freshness and support for subsets of variables \<close>
+
+lemma supp_mono: "finite (B::'a::fs set) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> supp A \<subseteq> supp B"
+  by (metis infinite_super subset_Un_eq supp_of_finite_union)
+
+lemma fresh_subset:
+  "finite B \<Longrightarrow> x \<sharp> (B :: 'a::at_base set) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> x \<sharp> A"
+  by (auto dest:supp_mono simp add: fresh_def)
+
+lemma fresh_star_subset:
+  "finite B \<Longrightarrow> x \<sharp>* (B :: 'a::at_base set) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> x \<sharp>* A"
+  by (metis fresh_star_def fresh_subset)
+
+lemma fresh_star_set_subset:
+  "x \<sharp>* (B :: 'a::at_base list) \<Longrightarrow> set A \<subseteq> set B \<Longrightarrow> x \<sharp>* A"
+  by (metis fresh_star_set fresh_star_subset[OF finite_set])
+
+section \<open> The set of free variables of an expression \<close>
+
+definition fv :: "'a::pt \<Rightarrow> 'b::at_base set"
+  where "fv e = {v. atom v \<in> supp e}"
+
+lemma fv_eqvt[simp,eqvt]: "\<pi> \<bullet> (fv e) = fv (\<pi> \<bullet> e)"
+  unfolding fv_def by simp
+
+lemma fv_Nil[simp]: "fv [] = {}"
+  by (auto simp add: fv_def supp_Nil)
+lemma fv_Cons[simp]: "fv (x # xs) = fv x \<union> fv xs"
+  by (auto simp add: fv_def supp_Cons)
+lemma fv_Pair[simp]: "fv (x, y) = fv x \<union> fv y"
+  by (auto simp add: fv_def supp_Pair)
+lemma fv_append[simp]: "fv (x @ y) = fv x \<union> fv y"
+  by (auto simp add: fv_def supp_append)
+lemma fv_at_base[simp]: "fv a = {a::'a::at_base}"
+  by (auto simp add: fv_def supp_at_base)
+lemma fv_pure[simp]: "fv (a::'a::pure) = {}"
+  by (auto simp add: fv_def pure_supp)
+
+lemma fv_set_at_base[simp]: "fv (l :: ('a :: at_base) list) = set l"
+  by (induction l) auto
+
+lemma flip_not_fv: "a \<notin> fv x \<Longrightarrow> b \<notin> fv x \<Longrightarrow> (a \<leftrightarrow> b) \<bullet> x = x"
+  by (metis flip_def fresh_def fv_def mem_Collect_eq swap_fresh_fresh)
+
+lemma fv_not_fresh: "atom x \<sharp> e \<longleftrightarrow> x \<notin> fv e"
+  unfolding fv_def fresh_def by blast
+
+lemma fresh_fv: "finite (fv e :: 'a set) \<Longrightarrow>  atom (x :: ('a::at_base)) \<sharp> (fv e :: 'a set) \<longleftrightarrow> atom x \<sharp> e"
+  unfolding fv_def fresh_def
+  by (auto simp add: supp_finite_set_at_base)
+
+lemma finite_fv[simp]: "finite (fv (e::'a::fs) :: ('b::at_base) set)"
+proof-
+  have "finite (supp e)" by (metis finite_supp)
+  hence "finite (atom -` supp e :: 'b set)" 
+    apply (rule finite_vimageI)
+    apply (rule inj_onI)
+    apply (simp)
+    done
+  moreover
+  have "(atom -` supp e  :: 'b set) = fv e"   unfolding fv_def by auto
+  ultimately
+  show ?thesis by simp
+qed
+
+definition fv_list :: "'a::fs \<Rightarrow> 'b::at_base list"
+  where "fv_list e = (SOME l. set l = fv e)"
+
+lemma set_fv_list[simp]: "set (fv_list e) = (fv e :: ('b::at_base) set)"
+proof-
+  have "finite (fv e :: 'b set)" by (rule finite_fv)
+  from finite_list[OF finite_fv]
+  obtain l where "set l = (fv e :: 'b set)"..
+  thus ?thesis
+    unfolding fv_list_def by (rule someI)
+qed
+
+lemma fresh_fv_list[simp]:
+  "a \<sharp> (fv_list e :: 'b::at_base list) \<longleftrightarrow> a \<sharp> (fv e :: 'b::at_base set)"
+proof-
+  have "a \<sharp> (fv_list e :: 'b::at_base list) \<longleftrightarrow> a \<sharp> set (fv_list e :: 'b::at_base list)"
+    by (rule fresh_set[symmetric])
+  also have "\<dots> \<longleftrightarrow> a \<sharp> (fv e :: 'b::at_base set)" by simp
+  finally show ?thesis.
+qed
+
+section \<open> Other useful lemmas \<close>
+
+lemma pure_permute_id: "permute p = (\<lambda> x. (x::'a::pure))"
+  by rule (simp add: permute_pure)
+
+lemma supp_set_elem_finite:
+  assumes "finite S"
+  and "(m::'a::fs) \<in> S"
+  and "y \<in> supp m"
+  shows "y \<in> supp S"
+  using assms supp_of_finite_sets
+  by auto
+
+lemmas fresh_star_Cons = fresh_star_list(2)
+
+lemma mem_permute_set: 
+  shows "x \<in> p \<bullet> S \<longleftrightarrow> (- p \<bullet> x) \<in> S"
+  by (metis mem_permute_iff permute_minus_cancel(2))
+
+lemma flip_set_both_not_in:
+  assumes "x \<notin> S" and "x' \<notin> S"
+  shows "((x' \<leftrightarrow> x) \<bullet> S) = S"
+  unfolding permute_set_def
+  by (auto) (metis assms flip_at_base_simps(3))+
+
+lemma inj_atom: "inj atom" by (metis atom_eq_iff injI)
+
+lemmas image_Int[OF inj_atom, simp]
+
+lemma eqvt_uncurry: "eqvt f \<Longrightarrow> eqvt (case_prod f)"
+  unfolding eqvt_def
+  by perm_simp simp
+
+lemma supp_fun_app_eqvt2:
+  assumes a: "eqvt f"
+  shows "supp (f x y) \<subseteq> supp x \<union> supp y"
+proof-
+  from supp_fun_app_eqvt[OF eqvt_uncurry [OF a]]
+  have "supp (case_prod f (x,y)) \<subseteq> supp (x,y)".
+  thus ?thesis by (simp add: supp_Pair)
+qed
+
+lemma supp_fun_app_eqvt3:
+  assumes a: "eqvt f"
+  shows "supp (f x y z) \<subseteq> supp x \<union> supp y \<union> supp z"
+proof-
+  from supp_fun_app_eqvt2[OF eqvt_uncurry [OF a]]
+  have "supp (case_prod f (x,y) z) \<subseteq> supp (x,y) \<union> supp z".
+  thus ?thesis by (simp add: supp_Pair)
+qed
+
+(* Fighting eta-contraction *)
+lemma permute_0[simp]: "permute 0 = (\<lambda> x. x)"
+  by auto
+lemma permute_comp[simp]: "permute x \<circ> permute y = permute (x + y)" by auto
+
+lemma map_permute: "map (permute p) = permute p"
+  apply rule
+  apply (induct_tac x)
+  apply auto
+  done
+
+lemma fresh_star_restrictA[intro]: "a \<sharp>* \<Gamma> \<Longrightarrow> a \<sharp>* AList.restrict V \<Gamma>"
+  by (induction \<Gamma>) (auto simp add: fresh_star_Cons)
+
+lemma Abs_lst_Nil_eq[simp]: "[[]]lst. (x::'a::fs) = [xs]lst. x' \<longleftrightarrow> (([],x) = (xs, x'))"
+  apply rule
+  apply (frule Abs_lst_fcb2[where f = "\<lambda> x y _ . (x,y)" and as = "[]" and bs = "xs" and c = "()"])
+  apply (auto simp add: fresh_star_def)
+  done
+
+lemma Abs_lst_Nil_eq2[simp]: "[xs]lst. (x::'a::fs) = [[]]lst. x' \<longleftrightarrow> ((xs,x) = ([], x'))"
+  by (subst eq_commute) auto
+
+lemma prod_cases8 [cases type]:
+  obtains (fields) a b c d e f g h where "y = (a, b, c, d, e, f, g,h)"
+  by (cases y, case_tac g) blast
+
+lemma prod_induct8 [case_names fields, induct type]:
+  "(\<And>a b c d e f g h. P (a, b, c, d, e, f, g, h)) \<Longrightarrow> P x"
+  by (cases x) blast
+
+lemma prod_cases9 [cases type]:
+  obtains (fields) a b c d e f g h i where "y = (a, b, c, d, e, f, g,h,i)"
+  by (cases y, case_tac h) blast
+
+lemma prod_induct9 [case_names fields, induct type]:
+  "(\<And>a b c d e f g h i. P (a, b, c, d, e, f, g, h, i)) \<Longrightarrow> P x"
+  by (cases x) blast
+
+named_theorems nominal_prod_simps 
+
+named_theorems ms_fresh "Facts for helping with freshness proofs"
+
+lemma fresh_prod2[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b) = (x \<sharp> a \<and> x \<sharp> b )"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod3[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod4[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod5[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod6[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod7[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod8[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h )"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod9[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h,i) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h \<and> x \<sharp> i)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod10[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h,i,j) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h \<and> x \<sharp> i \<and> x \<sharp> j)"
+  using fresh_def supp_Pair by fastforce
+
+lemma fresh_prod12[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h,i,j,k,l) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h \<and> x \<sharp> i \<and> x \<sharp> j \<and> x \<sharp> k \<and> x \<sharp> l)"
+  using fresh_def supp_Pair by fastforce
+
+lemmas fresh_prodN = fresh_Pair fresh_prod3  fresh_prod4  fresh_prod5 fresh_prod6 fresh_prod7 fresh_prod8 fresh_prod9 fresh_prod10 fresh_prod12
+
+lemma fresh_prod2I:
+  fixes x and x1 and x2
+  assumes "x \<sharp> x1" and "x \<sharp> x2" 
+  shows "x \<sharp> (x1,x2)" using fresh_prod2 assms by auto
+
+lemma fresh_prod3I:
+  fixes x and x1 and x2 and x3 
+  assumes "x \<sharp> x1" and "x \<sharp> x2" and "x \<sharp> x3" 
+  shows "x \<sharp> (x1,x2,x3)" using fresh_prod3 assms by auto
+
+lemma fresh_prod4I:
+  fixes x and x1 and x2 and x3 and x4
+  assumes "x \<sharp> x1" and "x \<sharp> x2" and "x \<sharp> x3" and "x \<sharp> x4" 
+  shows "x \<sharp> (x1,x2,x3,x4)" using fresh_prod4 assms by auto
+
+lemma fresh_prod5I:
+  fixes x and x1 and x2 and x3 and x4 and x5
+  assumes "x \<sharp> x1" and "x \<sharp> x2" and "x \<sharp> x3" and "x \<sharp> x4" and "x \<sharp> x5"
+  shows "x \<sharp> (x1,x2,x3,x4,x5)" using fresh_prod5 assms by auto
+
+lemma flip_collapse[simp]:
+  fixes b1::"'a::pt" and bv1::"'b::at" and bv2::"'b::at"
+  assumes "atom bv2 \<sharp> b1" and "atom c \<sharp> (bv1,bv2,b1)" and "bv1 \<noteq> bv2" 
+  shows "(bv2 \<leftrightarrow> c) \<bullet> (bv1 \<leftrightarrow> bv2) \<bullet> b1 = (bv1 \<leftrightarrow> c) \<bullet> b1"
+proof - 
+  have "c  \<noteq> bv1" and "bv2 \<noteq> bv1" using assms by auto+
+  hence "(bv2 \<leftrightarrow> c) + (bv1 \<leftrightarrow> bv2) + (bv2 \<leftrightarrow> c) =  (bv1 \<leftrightarrow> c)" using flip_triple[of c bv1 bv2] flip_commute by metis
+  hence "(bv2 \<leftrightarrow> c)  \<bullet> (bv1 \<leftrightarrow> bv2)  \<bullet> (bv2 \<leftrightarrow> c) \<bullet> b1 =  (bv1 \<leftrightarrow> c) \<bullet> b1" using permute_plus by metis
+  thus ?thesis using assms flip_fresh_fresh by force
+qed
+
+lemma triple_eqvt[simp]:
+  "p \<bullet> (x, b,c) = (p \<bullet> x,  p \<bullet> b , p \<bullet> c)"
+proof - 
+  have "(x,b,c) = (x,(b,c))" by simp
+  thus ?thesis using Pair_eqvt by simp
+qed
+
+lemma lst_fst:
+  fixes x::"'a::at" and t1::"'b::fs" and  x'::"'a::at" and t2::"'c::fs" 
+  assumes " ([[atom x]]lst. (t1,t2) = [[atom x']]lst. (t1',t2'))"
+  shows " ([[atom x]]lst. t1 = [[atom x']]lst. t1')"
+proof - 
+  have "(\<forall>c. atom c \<sharp> (t2,t2') \<longrightarrow> atom c \<sharp> (x, x', t1, t1') \<longrightarrow> (x \<leftrightarrow> c) \<bullet> t1 = (x' \<leftrightarrow> c) \<bullet> t1')" 
+  proof(rule,rule,rule)
+    fix c::'a
+    assume "atom c \<sharp>  (t2,t2')" and "atom c \<sharp> (x, x', t1, t1')" 
+    hence "atom c \<sharp> (x, x', (t1,t2), (t1',t2'))"  using fresh_prod2 by simp
+    thus  " (x \<leftrightarrow> c) \<bullet> t1 = (x' \<leftrightarrow> c) \<bullet> t1'" using assms Abs1_eq_iff_all(3) Pair_eqvt by simp
+  qed
+  thus ?thesis using Abs1_eq_iff_all(3)[of x t1 x' t1' "(t2,t2')"] by simp
+qed
+
+lemma lst_snd:
+  fixes x::"'a::at" and t1::"'b::fs" and  x'::"'a::at" and t2::"'c::fs" 
+  assumes " ([[atom x]]lst. (t1,t2) = [[atom x']]lst. (t1',t2'))"
+  shows " ([[atom x]]lst. t2 = [[atom x']]lst. t2')"
+proof - 
+  have "(\<forall>c. atom c \<sharp> (t1,t1') \<longrightarrow> atom c \<sharp> (x, x', t2, t2') \<longrightarrow> (x \<leftrightarrow> c) \<bullet> t2 = (x' \<leftrightarrow> c) \<bullet> t2')" 
+  proof(rule,rule,rule)
+    fix c::'a
+    assume "atom c \<sharp>  (t1,t1')" and "atom c \<sharp> (x, x', t2, t2')" 
+    hence "atom c \<sharp> (x, x', (t1,t2), (t1',t2'))"  using fresh_prod2 by simp
+    thus  " (x \<leftrightarrow> c) \<bullet> t2 = (x' \<leftrightarrow> c) \<bullet> t2'" using assms Abs1_eq_iff_all(3) Pair_eqvt by simp
+  qed
+  thus ?thesis using Abs1_eq_iff_all(3)[of x t2 x' t2' "(t1,t1')"] by simp
+qed
+
+lemma lst_head_cons_pair:
+  fixes y1::"'a ::at" and y2::"'a::at" and x1::"'b::fs" and x2::"'b::fs" and xs1::"('b::fs) list" and xs2::"('b::fs) list"
+  assumes "[[atom y1]]lst. (x1 # xs1) = [[atom y2]]lst. (x2 # xs2)"
+  shows "[[atom y1]]lst. (x1,xs1) = [[atom y2]]lst. (x2,xs2)"
+proof(subst  Abs1_eq_iff_all(3)[of y1 "(x1,xs1)"  y2 "(x2,xs2)"],rule,rule,rule)
+  fix c::'a
+  assume "atom c \<sharp> (x1#xs1,x2#xs2)" and "atom c \<sharp> (y1, y2, (x1, xs1), x2, xs2)" 
+  thus  "(y1 \<leftrightarrow> c) \<bullet> (x1, xs1) = (y2 \<leftrightarrow> c) \<bullet> (x2, xs2)"  using assms Abs1_eq_iff_all(3) by auto
+qed
+
+lemma lst_head_cons_neq_nil:
+  fixes y1::"'a ::at" and y2::"'a::at" and x1::"'b::fs" and x2::"'b::fs" and xs1::"('b::fs) list" and xs2::"('b::fs) list"
+  assumes "[[atom y1]]lst. (x1 # xs1) = [[atom y2]]lst. (xs2)"
+  shows "xs2 \<noteq> []"
+proof
+  assume as:"xs2 = []"
+  thus  False using Abs1_eq_iff(3)[of y1 "x1#xs1" y2 Nil]  assms as by auto
+qed
+
+lemma lst_head_cons:
+  fixes y1::"'a ::at" and y2::"'a::at" and x1::"'b::fs" and x2::"'b::fs" and xs1::"('b::fs) list" and xs2::"('b::fs) list"
+  assumes "[[atom y1]]lst. (x1 # xs1) = [[atom y2]]lst. (x2 # xs2)"
+  shows "[[atom y1]]lst. x1  = [[atom y2]]lst. x2" and "[[atom y1]]lst. xs1  = [[atom y2]]lst. xs2"
+  using lst_head_cons_pair lst_fst lst_snd assms by metis+
+
+lemma lst_pure:
+  fixes x1::"'a ::at" and t1::"'b::pure" and  x2::"'a ::at" and t2::"'b::pure" 
+  assumes "[[atom x1]]lst. t1 = [[atom x2]]lst. t2"
+  shows "t1=t2"
+  using assms Abs1_eq_iff_all(3) pure_fresh flip_fresh_fresh 
+  by (metis Abs1_eq(3) permute_pure)
+
+lemma lst_supp:
+ assumes "[[atom x1]]lst. t1 = [[atom x2]]lst. t2"
+ shows "supp t1 - {atom x1} = supp t2 - {atom x2}"
+proof -
+ have "supp ([[atom x1]]lst.t1) = supp ([[atom x2]]lst.t2)" using assms by auto
+ thus ?thesis using Abs_finite_supp  
+   by (metis assms empty_set list.simps(15) supp_lst.simps)
+qed
+
+lemma lst_supp_subset:
+   assumes "[[atom x1]]lst. t1 = [[atom x2]]lst. t2" and "supp t1 \<subseteq> {atom x1} \<union> B"
+   shows "supp t2 \<subseteq> {atom x2} \<union> B"
+  using assms lst_supp by fast
+
+lemma projl_inl_eqvt:
+  fixes \<pi> :: perm
+  shows   "\<pi> \<bullet> (projl (Inl x)) = projl (Inl (\<pi> \<bullet> x))"
+unfolding projl_def Inl_eqvt by simp
+
+end
diff --git a/thys/MiniSail/Operational.thy b/thys/MiniSail/Operational.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Operational.thy
@@ -0,0 +1,171 @@
+(*<*)
+theory Operational
+  imports Typing
+begin
+  (*>*)
+
+chapter \<open>Operational Semantics\<close>
+
+text \<open> Here we define the operational semantics in terms of a small-step reduction relation. \<close>
+
+section \<open>Reduction Rules\<close>
+
+text \<open> The store for mutable variables \<close>
+type_synonym \<delta> = "(u*v) list"
+
+nominal_function update_d :: "\<delta> \<Rightarrow> u \<Rightarrow> v \<Rightarrow> \<delta>" where
+  "update_d [] _ _ = []"
+| "update_d ((u',v')#\<delta>) u v = (if u = u' then ((u,v)#\<delta>) else ((u',v')# (update_d \<delta> u v)))"
+  by(auto,simp add: eqvt_def update_d_graph_aux_def ,metis neq_Nil_conv old.prod.exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+text \<open> Relates constructor to the branch in the case and binding variable and statement \<close>
+inductive find_branch :: "dc \<Rightarrow> branch_list  \<Rightarrow> branch_s  \<Rightarrow> bool" where
+  find_branch_finalI:  "dc' = dc                                  \<Longrightarrow> find_branch dc' (AS_final (AS_branch dc x s ))  (AS_branch dc x s)"
+| find_branch_branch_eqI: "dc' = dc                               \<Longrightarrow> find_branch dc' (AS_cons  (AS_branch dc x s) css)    (AS_branch dc x s)"
+| find_branch_branch_neqI:  "\<lbrakk> dc \<noteq> dc'; find_branch dc' css cs \<rbrakk> \<Longrightarrow> find_branch dc' (AS_cons  (AS_branch dc x s) css) cs"
+equivariance find_branch
+nominal_inductive find_branch .
+
+inductive_cases find_branch_elims[elim!]:
+  "find_branch dc (AS_final cs') cs"
+  "find_branch dc (AS_cons cs' css) cs"
+
+nominal_function lookup_branch :: "dc \<Rightarrow> branch_list \<Rightarrow> branch_s option" where
+  "lookup_branch dc (AS_final (AS_branch dc' x s)) = (if dc = dc' then (Some (AS_branch dc' x s)) else None)"
+| "lookup_branch dc (AS_cons (AS_branch dc' x s) css) = (if dc = dc' then (Some (AS_branch dc' x s)) else lookup_branch dc css)"
+       apply(auto,simp add: eqvt_def lookup_branch_graph_aux_def)
+  by(metis neq_Nil_conv old.prod.exhaust s_branch_s_branch_list.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+text \<open> Reduction rules \<close>
+inductive reduce_stmt :: "\<Phi> \<Rightarrow> \<delta> \<Rightarrow> s \<Rightarrow> \<delta> \<Rightarrow> s \<Rightarrow> bool"  (" _  \<turnstile> \<langle> _ , _\<rangle> \<longrightarrow> \<langle>  _ , _\<rangle>" [50, 50, 50] 50)  where
+  reduce_if_trueI:  " \<Phi> \<turnstile> \<langle>\<delta>, AS_if [L_true]\<^sup>v s1 s2\<rangle> \<longrightarrow> \<langle>\<delta>, s1\<rangle> "
+| reduce_if_falseI: " \<Phi> \<turnstile> \<langle>\<delta>, AS_if [L_false]\<^sup>v s1 s2\<rangle> \<longrightarrow> \<langle>\<delta>, s2\<rangle> "
+| reduce_let_valI:  " \<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_val v)  s\<rangle> \<longrightarrow> \<langle>\<delta>, s[x::=v]\<^sub>s\<^sub>v\<rangle>"  
+| reduce_let_plusI: " \<Phi> \<turnstile>  \<langle>\<delta>, AS_let x (AE_op Plus ((V_lit (L_num n1))) ((V_lit (L_num n2))))  s\<rangle> \<longrightarrow> 
+                           \<langle>\<delta>, AS_let x (AE_val (V_lit (L_num ( (( n1)+(n2)))))) s \<rangle> "  
+| reduce_let_leqI:  "b = (if (n1 \<le> n2) then L_true else L_false) \<Longrightarrow> 
+             \<Phi>  \<turnstile>  \<langle>\<delta>,  AS_let x  ((AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2)))) s\<rangle> \<longrightarrow> 
+                                                          \<langle>\<delta>, AS_let x  (AE_val (V_lit b)) s\<rangle>"  
+| reduce_let_eqI:  "b = (if (n1 = n2) then L_true else L_false) \<Longrightarrow> 
+             \<Phi>  \<turnstile>  \<langle>\<delta>,  AS_let x  ((AE_op Eq (V_lit n1) (V_lit n2))) s\<rangle> \<longrightarrow> 
+                                                          \<langle>\<delta>, AS_let x  (AE_val (V_lit b)) s\<rangle>"  
+| reduce_let_appI:  "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ z b c \<tau> s'))) = lookup_fun \<Phi> f \<Longrightarrow>  
+             \<Phi>  \<turnstile>  \<langle>\<delta>, AS_let x  ((AE_app f v)) s\<rangle> \<longrightarrow> \<langle>\<delta>,  AS_let2 x \<tau>[z::=v]\<^sub>\<tau>\<^sub>v s'[z::=v]\<^sub>s\<^sub>v s\<rangle> "     
+| reduce_let_appPI:  "Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ z b c \<tau> s'))) = lookup_fun \<Phi> f \<Longrightarrow>  
+             \<Phi>  \<turnstile>  \<langle>\<delta>, AS_let x  ((AE_appP f b' v)) s\<rangle> \<longrightarrow> \<langle>\<delta>,  AS_let2 x \<tau>[bv::=b']\<^sub>\<tau>\<^sub>b[z::=v]\<^sub>\<tau>\<^sub>v s'[bv::=b']\<^sub>s\<^sub>b[z::=v]\<^sub>s\<^sub>v s\<rangle> "  
+| reduce_let_fstI:  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_fst (V_pair v1 v2))  s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x (AE_val v1)  s\<rangle>"
+| reduce_let_sndI:  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_snd (V_pair v1 v2))  s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x (AE_val v2)  s\<rangle>"
+| reduce_let_concatI:  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_concat (V_lit (L_bitvec v1))  (V_lit (L_bitvec v2)))  s\<rangle> \<longrightarrow> 
+                            \<langle>\<delta>, AS_let x (AE_val (V_lit (L_bitvec (v1@v2))))  s\<rangle>"
+| reduce_let_splitI: " split n v (v1 , v2 )  \<Longrightarrow> \<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_split (V_lit (L_bitvec v))  (V_lit (L_num n)))  s\<rangle> \<longrightarrow> 
+                            \<langle>\<delta>, AS_let x (AE_val (V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))))  s\<rangle>"
+| reduce_let_lenI:  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_len (V_lit (L_bitvec v)))  s\<rangle> \<longrightarrow> 
+                              \<langle>\<delta>, AS_let x (AE_val (V_lit (L_num (int (List.length v)))))  s\<rangle>"
+| reduce_let_mvar:  "(u,v) \<in> set \<delta> \<Longrightarrow>  \<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_mvar u)  s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x (AE_val v) s \<rangle>" 
+| reduce_assert1I: "\<Phi> \<turnstile> \<langle>\<delta>, AS_assert c (AS_val v)\<rangle> \<longrightarrow> \<langle>\<delta>, AS_val v\<rangle>" 
+| reduce_assert2I:  " \<Phi>  \<turnstile> \<langle>\<delta>, s \<rangle> \<longrightarrow> \<langle> \<delta>', s'\<rangle> \<Longrightarrow> \<Phi>  \<turnstile> \<langle>\<delta>, AS_assert c s\<rangle> \<longrightarrow> \<langle> \<delta>', AS_assert c s'\<rangle>"  
+| reduce_varI: "atom u \<sharp> \<delta> \<Longrightarrow>  \<Phi>  \<turnstile>  \<langle>\<delta>, AS_var u \<tau> v s \<rangle> \<longrightarrow> \<langle> ((u,v)#\<delta>) , s\<rangle>"
+| reduce_assignI: "  \<Phi>  \<turnstile>  \<langle>\<delta>, AS_assign u v \<rangle> \<longrightarrow> \<langle> update_d \<delta> u v , AS_val (V_lit L_unit)\<rangle>"
+| reduce_seq1I: "\<Phi>   \<turnstile>  \<langle>\<delta>, AS_seq (AS_val (V_lit L_unit )) s \<rangle> \<longrightarrow> \<langle>\<delta>, s\<rangle>"
+| reduce_seq2I: "\<lbrakk>s1 \<noteq> AS_val v ; \<Phi>  \<turnstile>  \<langle>\<delta>, s1\<rangle> \<longrightarrow> \<langle> \<delta>', s1'\<rangle> \<rbrakk> \<Longrightarrow> 
+                          \<Phi>  \<turnstile>  \<langle>\<delta>, AS_seq s1 s2\<rangle> \<longrightarrow> \<langle> \<delta>', AS_seq s1' s2\<rangle>"
+| reduce_let2_valI:  "\<Phi>  \<turnstile>  \<langle>\<delta>, AS_let2 x t (AS_val v) s\<rangle> \<longrightarrow> \<langle>\<delta>, s[x::=v]\<^sub>s\<^sub>v\<rangle>" 
+| reduce_let2I:  " \<Phi>  \<turnstile> \<langle>\<delta>, s1 \<rangle> \<longrightarrow> \<langle> \<delta>', s1'\<rangle> \<Longrightarrow> \<Phi>  \<turnstile> \<langle>\<delta>, AS_let2 x t s1 s2\<rangle> \<longrightarrow> \<langle> \<delta>', AS_let2 x t s1' s2\<rangle>"  
+
+| reduce_caseI:  "\<lbrakk> Some (AS_branch dc x' s') = lookup_branch dc cs \<rbrakk> \<Longrightarrow>  \<Phi> \<turnstile>  \<langle>\<delta>, AS_match (V_cons tyid dc v) cs\<rangle>  \<longrightarrow> \<langle>\<delta>, s'[x'::=v]\<^sub>s\<^sub>v\<rangle> "
+| reduce_whileI: "\<lbrakk> atom x \<sharp> (s1,s2); atom z \<sharp> x \<rbrakk> \<Longrightarrow> 
+                    \<Phi>  \<turnstile>  \<langle>\<delta>, AS_while s1 s2 \<rangle> \<longrightarrow> 
+            \<langle>\<delta>, AS_let2 x (\<lbrace> z : B_bool | TRUE \<rbrace>) s1 (AS_if (V_var x) (AS_seq s2 (AS_while s1 s2))  (AS_val (V_lit L_unit))) \<rangle>"
+
+equivariance reduce_stmt
+nominal_inductive reduce_stmt .
+
+inductive_cases reduce_stmt_elims[elim!]:
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_if (V_lit L_true) s1 s2\<rangle> \<longrightarrow> \<langle>\<delta> , s1\<rangle>"
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_if (V_lit L_false) s1 s2\<rangle> \<longrightarrow> \<langle>\<delta>,s2\<rangle>"
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x (AE_val v)  s\<rangle> \<longrightarrow> \<langle>\<delta>,s'\<rangle>"
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  (AE_op Plus ((V_lit (L_num n1))) ((V_lit (L_num n2))))  s\<rangle> \<longrightarrow> 
+            \<langle>\<delta>, AS_let x  (AE_val (V_lit (L_num ( (( n1)+(n2)))))) s \<rangle>"
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2)))) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x  (AE_val (V_lit b)) s\<rangle>"
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_app f v)) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let2 x \<tau> (subst_sv s' x v ) s\<rangle> "  
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_len v)) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x  v' s\<rangle> "  
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_concat v1 v2)) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x  v' s\<rangle> " 
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_seq s1 s2\<rangle> \<longrightarrow> \<langle> \<delta>' ,s'\<rangle>"
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_appP  f b v)) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let2 x \<tau> (subst_sv s' z v) s\<rangle> "  
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_split v1 v2)) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x  v' s\<rangle> " 
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_assert c s \<rangle> \<longrightarrow> \<langle>\<delta>, s'\<rangle> "
+  "\<Phi> \<turnstile> \<langle>\<delta>, AS_let x  ((AE_op Eq (V_lit (n1)) (V_lit (n2)))) s\<rangle> \<longrightarrow> \<langle>\<delta>, AS_let x  (AE_val (V_lit b)) s\<rangle>"
+
+inductive reduce_stmt_many :: "\<Phi> \<Rightarrow> \<delta> \<Rightarrow> s \<Rightarrow> \<delta> \<Rightarrow> s \<Rightarrow> bool"    ("_ \<turnstile> \<langle> _ , _\<rangle> \<longrightarrow>\<^sup>* \<langle>  _ , _\<rangle>" [50, 50, 50] 50)  where  
+  reduce_stmt_many_oneI:  "\<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>  \<Longrightarrow> \<Phi> \<turnstile> \<langle>\<delta>  , s\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>', s'\<rangle> "
+| reduce_stmt_many_manyI:  "\<lbrakk> \<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow>   \<langle>\<delta>', s'\<rangle> ; \<Phi> \<turnstile>  \<langle>\<delta>', s'\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>'', s''\<rangle> \<rbrakk> \<Longrightarrow> \<Phi> \<turnstile>  \<langle>\<delta>, s\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>'', s''\<rangle>"
+
+nominal_function  convert_fds :: "fun_def list \<Rightarrow> (f*fun_def) list" where
+  "convert_fds [] = []"
+| "convert_fds ((AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)))#fs) = ((f,AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)))#convert_fds fs)"
+| "convert_fds ((AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)))#fs) = ((f,AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)))#convert_fds fs)"
+  apply(auto)
+  apply (simp add: eqvt_def convert_fds_graph_aux_def )
+  using fun_def.exhaust fun_typ.exhaust fun_typ_q.exhaust neq_Nil_conv 
+  by metis
+nominal_termination (eqvt) by lexicographic_order
+
+nominal_function  convert_tds :: "type_def list \<Rightarrow> (f*type_def) list" where
+  "convert_tds [] = []"
+| "convert_tds ((AF_typedef s dclist)#fs) = ((s,AF_typedef s dclist)#convert_tds fs)"
+| "convert_tds ((AF_typedef_poly s bv dclist)#fs) = ((s,AF_typedef_poly s bv dclist)#convert_tds fs)"
+  apply(auto)
+  apply (simp add: eqvt_def convert_tds_graph_aux_def )
+  by (metis type_def.exhaust neq_Nil_conv)
+nominal_termination (eqvt) by lexicographic_order
+
+inductive reduce_prog :: "p \<Rightarrow> v \<Rightarrow> bool" where
+  "\<lbrakk> reduce_stmt_many \<Phi> [] s \<delta> (AS_val v) \<rbrakk> \<Longrightarrow>  reduce_prog (AP_prog \<Theta> \<Phi> [] s) v"
+
+section \<open>Reduction Typing\<close>
+
+text \<open> Checks that the store is consistent with @{typ \<Delta>} \<close>
+inductive delta_sim :: "\<Theta> \<Rightarrow> \<delta> \<Rightarrow> \<Delta> \<Rightarrow> bool" ( "_  \<turnstile> _ \<sim> _ " [50,50] 50 )  where
+  delta_sim_nilI:  "\<Theta> \<turnstile> [] \<sim> []\<^sub>\<Delta> "
+| delta_sim_consI: "\<lbrakk> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> ; \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau> ; u \<notin> fst ` set \<delta>   \<rbrakk> \<Longrightarrow> \<Theta> \<turnstile> ((u,v)#\<delta>) \<sim> ((u,\<tau>)#\<^sub>\<Delta>\<Delta>)" 
+
+equivariance delta_sim
+nominal_inductive delta_sim .
+
+inductive_cases delta_sim_elims[elim!]:
+  "\<Theta> \<turnstile> [] \<sim> []\<^sub>\<Delta>"
+  "\<Theta> \<turnstile> ((u,v)#ds) \<sim> (u,\<tau>) #\<^sub>\<Delta> D"
+  "\<Theta> \<turnstile> ((u,v)#ds) \<sim> D"
+
+text \<open>A typing judgement that combines typing of the statement, the store and the condition that definitions are well-typed\<close>
+inductive config_type ::  "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<Delta> \<Rightarrow> \<delta> \<Rightarrow> s \<Rightarrow> \<tau> \<Rightarrow>  bool"   ("_ ; _ ; _ \<turnstile> \<langle> _ , _\<rangle> \<Leftarrow> _ " [50, 50, 50] 50)  where 
+  config_typeI: "\<lbrakk> \<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>; 
+                (\<forall> fd \<in> set \<Phi>. \<Theta> ; \<Phi> \<turnstile> fd) ;
+                \<Theta>  \<turnstile> \<delta> \<sim> \<Delta> \<rbrakk>
+                \<Longrightarrow> \<Theta> ; \<Phi> ; \<Delta> \<turnstile> \<langle> \<delta>  , s\<rangle> \<Leftarrow>  \<tau>"
+equivariance config_type
+nominal_inductive config_type .
+
+inductive_cases config_type_elims [elim!]:
+  " \<Theta> ; \<Phi>  ; \<Delta> \<turnstile> \<langle> \<delta>  , s\<rangle> \<Leftarrow>  \<tau>"
+
+nominal_function \<delta>_of  :: "var_def list \<Rightarrow> \<delta>" where
+  "\<delta>_of [] = []"
+| "\<delta>_of ((AV_def u t v)#vs) = (u,v) #  (\<delta>_of vs)" 
+  apply auto
+  using  eqvt_def \<delta>_of_graph_aux_def neq_Nil_conv old.prod.exhaust apply force
+  using  eqvt_def \<delta>_of_graph_aux_def neq_Nil_conv old.prod.exhaust 
+  by (metis var_def.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+inductive config_type_prog :: "p \<Rightarrow> \<tau> \<Rightarrow> bool"  (" \<turnstile> \<langle> _\<rangle> \<Leftarrow> _") where
+  "\<lbrakk>
+  \<Theta> ; \<Phi> ; \<Delta>_of \<G> \<turnstile> \<langle> \<delta>_of \<G>  , s\<rangle> \<Leftarrow>  \<tau>
+\<rbrakk> \<Longrightarrow> \<turnstile>  \<langle> AP_prog \<Theta> \<Phi> \<G> s\<rangle> \<Leftarrow> \<tau>"
+
+inductive_cases config_type_prog_elims [elim!]:
+  "\<turnstile>  \<langle> AP_prog \<Theta> \<Phi> \<G> s\<rangle> \<Leftarrow> \<tau>"
+
+end
diff --git a/thys/MiniSail/RCLogic.thy b/thys/MiniSail/RCLogic.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/RCLogic.thy
@@ -0,0 +1,222 @@
+(*<*)
+theory RCLogic
+  imports Wellformed
+begin
+  (*>*)
+
+hide_const Syntax.dom
+
+chapter \<open>Refinement Constraint Logic\<close>
+
+text \<open> Semantics for the logic we use in the refinement constraints. It is a multi-sorted, quantifier free
+logic with polymorphic datatypes and linear arithmetic. We could have modelled by using one of the 
+encodings to FOL however we wanted to explore using a more direct model. \<close>
+
+section \<open>Evaluation and Satisfiability\<close>
+
+subsection \<open>Valuation\<close>
+
+text \<open> Refinement constraint logic values. SUt is a value for the uninterpreted 
+       sort that corresponds to basic type variables. For now we only need one of these universes.
+       We wrap an smt\_val inside it during a process we call 'boxing' 
+       which is introduced in the RCLogicL theory \<close>
+nominal_datatype rcl_val = SBitvec "bit list" | SNum int | SBool bool | SPair rcl_val rcl_val | 
+  SCons tyid string rcl_val | SConsp tyid string b rcl_val |
+  SUnit | SUt rcl_val 
+
+text \<open> RCL sorts. Represent our domains. The universe is the union of all of the these.
+        S\_Ut is the single uninterpreted sort. These map almost directly to basic type 
+        but we have them to distinguish syntax (basic types) and semantics (RCL sorts) \<close>
+nominal_datatype rcl_sort = S_bool | S_int | S_unit | S_pair rcl_sort rcl_sort | S_id tyid | S_app tyid rcl_sort | S_bitvec | S_ut 
+
+type_synonym valuation = "(x,rcl_val) map"
+
+type_synonym type_valuation = "(bv,rcl_sort) map"
+
+text \<open>Well-sortedness for RCL values\<close>
+inductive wfRCV:: "\<Theta> \<Rightarrow> rcl_val \<Rightarrow> b \<Rightarrow> bool" ( " _  \<turnstile> _ : _" [50,50] 50) where
+  wfRCV_BBitvecI:  "P \<turnstile> (SBitvec bv)  : B_bitvec"
+| wfRCV_BIntI:  "P \<turnstile> (SNum n)  : B_int"
+| wfRCV_BBoolI: "P \<turnstile> (SBool b) : B_bool"
+| wfRCV_BPairI: "\<lbrakk> P \<turnstile> s1 : b1 ; P \<turnstile> s2 : b2 \<rbrakk> \<Longrightarrow> P \<turnstile> (SPair s1 s2) : (B_pair b1 b2)"
+| wfRCV_BConsI: "\<lbrakk>  AF_typedef s dclist \<in> set \<Theta>;
+      (dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist ;
+     \<Theta> \<turnstile> s1 : b \<rbrakk> \<Longrightarrow> \<Theta> \<turnstile>(SCons s dc s1) : (B_id s)"
+| wfRCV_BConsPI:"\<lbrakk> AF_typedef_poly s bv dclist \<in> set \<Theta>;
+      (dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist ;
+       atom bv \<sharp> (\<Theta>, SConsp s dc b' s1, B_app s b');
+     \<Theta> \<turnstile> s1 : b[bv::=b']\<^sub>b\<^sub>b \<rbrakk> \<Longrightarrow> \<Theta> \<turnstile>(SConsp s dc b' s1) : (B_app s b')"
+| wfRCV_BUnitI: "P \<turnstile> SUnit : B_unit"
+| wfRCV_BVarI: "P \<turnstile> (SUt n) : (B_var bv)"
+equivariance wfRCV
+nominal_inductive wfRCV 
+  avoids wfRCV_BConsPI: bv
+proof(goal_cases)
+  case (1 s bv dclist \<Theta> dc x b c b' s1)
+  then show ?case using fresh_star_def by auto
+next
+  case (2 s bv dclist \<Theta> dc x b c s1 b')
+  then show ?case by auto
+qed
+
+inductive_cases wfRCV_elims :
+  "wfRCV P s  B_bitvec"
+  "wfRCV P s (B_pair b1 b2)"
+  "wfRCV P s (B_int)"
+  "wfRCV P s (B_bool)"
+  "wfRCV P s (B_id ss)"
+  "wfRCV P s (B_var bv)"
+  "wfRCV P s (B_unit)"
+  "wfRCV P s (B_app tyid b)"
+  "wfRCV P (SBitvec bv) b"
+  "wfRCV P (SNum n)  b"
+  "wfRCV P (SBool n)  b"
+  "wfRCV P (SPair s1 s2) b"
+  "wfRCV P (SCons s dc s1) b"
+  "wfRCV P (SConsp s dc b' s1) b"
+  "wfRCV P SUnit b"
+  "wfRCV P (SUt s1) b"
+
+text \<open> Sometimes we want to assert @{text "P \<turnstile> s ~ b[bv=b']"} and we want to know what b is 
+however substitution is not injective so we can't write this in terms of @{text "wfRCV"}. 
+So we define a relation that makes the components of the substitution explicit. \<close>
+
+inductive wfRCV_subst:: "\<Theta> \<Rightarrow> rcl_val \<Rightarrow> b \<Rightarrow> (bv*b) option \<Rightarrow> bool" where
+  wfRCV_subst_BBitvecI:  "wfRCV_subst P (SBitvec bv) B_bitvec  sub "
+| wfRCV_subst_BIntI:  "wfRCV_subst P (SNum n)  B_int sub "
+| wfRCV_subst_BBoolI: "wfRCV_subst P (SBool b)  B_bool sub  "
+| wfRCV_subst_BPairI: "\<lbrakk> wfRCV_subst P s1 b1 sub ; wfRCV_subst P s2 b2 sub \<rbrakk> \<Longrightarrow> wfRCV_subst P (SPair s1 s2) (B_pair b1 b2) sub"
+| wfRCV_subst_BConsI: "\<lbrakk>  AF_typedef s dclist \<in> set \<Theta>;
+      (dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist ;
+     wfRCV_subst \<Theta> s1 b None \<rbrakk> \<Longrightarrow> wfRCV_subst \<Theta> (SCons s dc s1) (B_id s) sub"
+| wfRCV_subst_BConspI: "\<lbrakk>  AF_typedef_poly s bv dclist \<in> set \<Theta>;
+      (dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist ;
+     wfRCV_subst \<Theta> s1 (b[bv::=b']\<^sub>b\<^sub>b) sub  \<rbrakk> \<Longrightarrow> wfRCV_subst \<Theta> (SConsp s dc b' s1) (B_app s b') sub"
+| wfRCV_subst_BUnitI: "wfRCV_subst P SUnit B_unit sub "
+| wfRCV_subst_BVar1I: "bvar \<noteq> bv \<Longrightarrow> wfRCV_subst P (SUt n) (B_var bv)  (Some (bvar,bin))"
+| wfRCV_subst_BVar2I: "\<lbrakk> bvar = bv; wfRCV_subst P s bin None \<rbrakk> \<Longrightarrow> wfRCV_subst P s (B_var bv)  (Some (bvar,bin))"
+| wfRCV_subst_BVar3I: "wfRCV_subst P (SUt n) (B_var bv)  None"
+equivariance wfRCV_subst
+nominal_inductive wfRCV_subst .
+
+subsection \<open>Evaluation base-types\<close>
+
+inductive eval_b :: "type_valuation \<Rightarrow> b \<Rightarrow> rcl_sort \<Rightarrow> bool"  ( "_ \<lbrakk> _ \<rbrakk> ~ _ " ) where
+  "v \<lbrakk> B_bool \<rbrakk> ~ S_bool"
+| "v \<lbrakk> B_int \<rbrakk> ~ S_int"
+| "Some s = v bv \<Longrightarrow> v \<lbrakk> B_var bv \<rbrakk> ~ s"
+equivariance eval_b
+nominal_inductive eval_b .
+
+subsection \<open>Wellformed vvaluations\<close>
+
+definition wfI ::  "\<Theta> \<Rightarrow> \<Gamma> \<Rightarrow> valuation \<Rightarrow> bool" ( " _ ; _ \<turnstile> _" )  where
+  "\<Theta> ; \<Gamma> \<turnstile> i = (\<forall> (x,b,c) \<in> toSet \<Gamma>. \<exists>s. Some s = i x \<and> \<Theta> \<turnstile> s : b)"
+
+subsection \<open>Evaluating Terms\<close>
+
+nominal_function eval_l :: "l \<Rightarrow> rcl_val" ( "\<lbrakk> _ \<rbrakk> " ) where
+  "\<lbrakk> L_true \<rbrakk> = SBool True"
+|  "\<lbrakk> L_false \<rbrakk> = SBool False"
+|  "\<lbrakk> L_num n \<rbrakk> = SNum n"
+|  "\<lbrakk> L_unit \<rbrakk> = SUnit"
+|  "\<lbrakk> L_bitvec n \<rbrakk> = SBitvec n"
+                   apply(auto simp: eqvt_def eval_l_graph_aux_def)
+  by (metis l.exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+inductive eval_v :: "valuation \<Rightarrow> v \<Rightarrow> rcl_val \<Rightarrow> bool"  ( "_ \<lbrakk> _ \<rbrakk> ~ _ " ) where
+  eval_v_litI:   "i \<lbrakk> V_lit l \<rbrakk> ~ \<lbrakk> l \<rbrakk> "
+| eval_v_varI: "Some sv = i x  \<Longrightarrow> i \<lbrakk> V_var x \<rbrakk> ~ sv"
+| eval_v_pairI: "\<lbrakk> i \<lbrakk> v1 \<rbrakk> ~ s1 ; i \<lbrakk> v2 \<rbrakk> ~ s2 \<rbrakk> \<Longrightarrow> i \<lbrakk> V_pair v1 v2 \<rbrakk> ~ SPair s1 s2"
+| eval_v_consI: "i \<lbrakk> v \<rbrakk> ~ s \<Longrightarrow> i \<lbrakk> V_cons tyid dc v \<rbrakk> ~ SCons tyid dc s"
+| eval_v_conspI: "i \<lbrakk> v \<rbrakk> ~ s \<Longrightarrow> i \<lbrakk> V_consp tyid dc b v \<rbrakk> ~ SConsp tyid dc b s"
+equivariance eval_v
+nominal_inductive eval_v .
+
+inductive_cases eval_v_elims:
+  "i \<lbrakk> V_lit l \<rbrakk> ~  s"
+  "i \<lbrakk> V_var x \<rbrakk> ~  s"
+  "i \<lbrakk> V_pair v1 v2 \<rbrakk> ~ s"
+  "i \<lbrakk> V_cons tyid dc v \<rbrakk> ~ s"
+  "i \<lbrakk> V_consp tyid dc b v \<rbrakk> ~ s"
+
+inductive eval_e :: "valuation \<Rightarrow> ce \<Rightarrow> rcl_val \<Rightarrow> bool" ( "_ \<lbrakk> _ \<rbrakk> ~ _ " )  where
+  eval_e_valI: "i \<lbrakk> v \<rbrakk> ~  sv \<Longrightarrow> i \<lbrakk> CE_val v \<rbrakk> ~ sv"
+| eval_e_plusI: "\<lbrakk> i \<lbrakk> v1 \<rbrakk> ~ SNum n1; i \<lbrakk> v2 \<rbrakk> ~ SNum n2  \<rbrakk>  \<Longrightarrow> i \<lbrakk> (CE_op Plus v1 v2) \<rbrakk> ~ (SNum (n1+n2))"
+| eval_e_leqI: "\<lbrakk> i \<lbrakk> v1 \<rbrakk> ~ (SNum n1); i \<lbrakk> v2 \<rbrakk> ~ (SNum n2) \<rbrakk>  \<Longrightarrow> i \<lbrakk> (CE_op LEq v1 v2) \<rbrakk> ~ (SBool (n1 \<le> n2))"
+| eval_e_eqI: "\<lbrakk> i \<lbrakk> v1 \<rbrakk> ~ s1; i \<lbrakk> v2 \<rbrakk> ~ s2 \<rbrakk>  \<Longrightarrow> i \<lbrakk> (CE_op Eq v1 v2) \<rbrakk> ~ (SBool (s1 = s2))"
+| eval_e_fstI: "\<lbrakk> i \<lbrakk> v \<rbrakk> ~ SPair v1 v2  \<rbrakk> \<Longrightarrow> i \<lbrakk> (CE_fst v) \<rbrakk> ~ v1"
+| eval_e_sndI: "\<lbrakk> i \<lbrakk> v \<rbrakk> ~ SPair v1 v2  \<rbrakk> \<Longrightarrow> i \<lbrakk> (CE_snd v) \<rbrakk> ~ v2"
+| eval_e_concatI:"\<lbrakk> i \<lbrakk> v1 \<rbrakk> ~ (SBitvec bv1); i \<lbrakk> v2 \<rbrakk> ~ (SBitvec bv2) \<rbrakk> \<Longrightarrow> i \<lbrakk> (CE_concat v1 v2) \<rbrakk> ~ (SBitvec (bv1@bv2))"
+| eval_e_lenI:"\<lbrakk> i \<lbrakk> v \<rbrakk>  ~ (SBitvec bv) \<rbrakk> \<Longrightarrow> i \<lbrakk> (CE_len v) \<rbrakk> ~ (SNum (int (List.length bv)))"
+equivariance eval_e
+nominal_inductive eval_e .
+
+inductive_cases eval_e_elims:
+  "i \<lbrakk> (CE_val v) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_op Plus v1 v2) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_op LEq v1 v2) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_op Eq v1 v2) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_fst v) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_snd v) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_concat v1 v2) \<rbrakk> ~ s"
+  "i \<lbrakk> (CE_len v) \<rbrakk> ~ s"
+
+inductive eval_c :: "valuation \<Rightarrow> c \<Rightarrow> bool \<Rightarrow> bool" ( " _ \<lbrakk> _ \<rbrakk> ~ _ ")  where
+  eval_c_trueI:  "i \<lbrakk> C_true \<rbrakk> ~ True"
+| eval_c_falseI:"i \<lbrakk> C_false \<rbrakk> ~ False"
+| eval_c_conjI: "\<lbrakk> i \<lbrakk> c1 \<rbrakk> ~ b1 ; i \<lbrakk> c2 \<rbrakk> ~ b2 \<rbrakk> \<Longrightarrow>  i \<lbrakk> (C_conj c1 c2) \<rbrakk> ~  (b1 \<and> b2)"
+| eval_c_disjI: "\<lbrakk> i \<lbrakk> c1 \<rbrakk> ~ b1 ; i \<lbrakk> c2 \<rbrakk> ~ b2 \<rbrakk> \<Longrightarrow>  i \<lbrakk> (C_disj c1 c2) \<rbrakk> ~ (b1 \<or> b2)"
+| eval_c_impI:"\<lbrakk> i \<lbrakk> c1 \<rbrakk> ~ b1 ; i \<lbrakk> c2 \<rbrakk> ~ b2 \<rbrakk> \<Longrightarrow>  i \<lbrakk> (C_imp c1 c2) \<rbrakk> ~ (b1 \<longrightarrow> b2)"
+| eval_c_notI:"\<lbrakk> i \<lbrakk> c \<rbrakk> ~ b \<rbrakk> \<Longrightarrow> i \<lbrakk> (C_not c) \<rbrakk> ~ (\<not> b)"
+| eval_c_eqI:"\<lbrakk> i \<lbrakk> e1 \<rbrakk> ~ sv1; i \<lbrakk> e2 \<rbrakk> ~ sv2 \<rbrakk> \<Longrightarrow> i \<lbrakk> (C_eq e1 e2) \<rbrakk> ~ (sv1=sv2)"
+equivariance eval_c
+nominal_inductive eval_c .
+
+inductive_cases eval_c_elims:
+  "i \<lbrakk> C_true \<rbrakk> ~  True"
+  "i \<lbrakk> C_false \<rbrakk> ~ False"
+  "i \<lbrakk> (C_conj c1 c2)\<rbrakk> ~ s"
+  "i \<lbrakk> (C_disj c1 c2)\<rbrakk> ~ s"
+  "i \<lbrakk> (C_imp c1 c2)\<rbrakk> ~ s"
+  "i \<lbrakk> (C_not c) \<rbrakk> ~ s"
+  "i \<lbrakk> (C_eq e1 e2)\<rbrakk> ~ s"
+  "i \<lbrakk> C_true \<rbrakk> ~ s"
+  "i \<lbrakk> C_false \<rbrakk> ~ s"
+
+subsection \<open>Satisfiability\<close>
+
+inductive  is_satis :: "valuation \<Rightarrow> c \<Rightarrow> bool" ( " _ \<Turnstile> _ " ) where
+  "i \<lbrakk> c \<rbrakk> ~ True \<Longrightarrow> i \<Turnstile> c"
+equivariance is_satis
+nominal_inductive is_satis .
+
+nominal_function is_satis_g :: "valuation \<Rightarrow> \<Gamma> \<Rightarrow> bool" ( " _ \<Turnstile> _ " ) where
+  "i \<Turnstile> GNil = True"
+| "i \<Turnstile> ((x,b,c) #\<^sub>\<Gamma> G) = ( i \<Turnstile> c \<and>  i \<Turnstile> G)"
+       apply(auto simp: eqvt_def is_satis_g_graph_aux_def)
+  by (metis \<Gamma>.exhaust old.prod.exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+section \<open>Validity\<close>
+
+nominal_function  valid :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> c \<Rightarrow> bool"  ("_ ; _ ; _  \<Turnstile> _ " [50, 50] 50)  where
+  "P ; B ; G \<Turnstile> c = ( (P ; B ; G \<turnstile>\<^sub>w\<^sub>f c) \<and> (\<forall>i. (P ; G \<turnstile> i) \<and>  i \<Turnstile> G \<longrightarrow> i \<Turnstile> c))"
+  by (auto simp: eqvt_def wfI_def valid_graph_aux_def)
+nominal_termination (eqvt) by lexicographic_order
+
+section \<open>Lemmas\<close>
+text \<open>Lemmas needed for Examples\<close>
+
+lemma valid_trueI [intro]:
+  fixes G::\<Gamma>
+  assumes "P ; B \<turnstile>\<^sub>w\<^sub>f G"
+  shows "P ; B ; G \<Turnstile> C_true"
+proof -
+  have "\<forall>i. i \<Turnstile> C_true" using is_satis.simps eval_c_trueI by simp
+  moreover have "P ; B ; G \<turnstile>\<^sub>w\<^sub>f C_true" using wfC_trueI assms by simp
+  ultimately show ?thesis using valid.simps by simp
+qed
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/RCLogicL.thy b/thys/MiniSail/RCLogicL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/RCLogicL.thy
@@ -0,0 +1,2729 @@
+(*<*)
+theory RCLogicL
+  imports RCLogic WellformedL
+begin
+  (*>*)
+
+hide_const Syntax.dom
+
+chapter \<open>Refinement Constraint Logic Lemmas\<close>
+
+section \<open>Lemmas\<close>
+
+lemma wfI_domi:
+  assumes "\<Theta> ; \<Gamma> \<turnstile> i"
+  shows "fst ` toSet \<Gamma> \<subseteq> dom i"
+  using wfI_def toSet.simps assms by fastforce
+
+lemma wfI_lookup:
+  fixes G::\<Gamma> and b::b
+  assumes "Some (b,c) = lookup G x" and "P ; G \<turnstile> i" and "Some s = i x" and "P ; B \<turnstile>\<^sub>w\<^sub>f G"
+  shows "P \<turnstile> s : b"
+proof -
+  have "(x,b,c) \<in> toSet G" using lookup.simps assms
+    using lookup_in_g by blast
+  then obtain s' where *:"Some s' = i x \<and> wfRCV P s' b" using wfI_def assms by auto
+  hence "s' = s" using assms  by (metis option.inject)
+  thus ?thesis using * by auto
+qed
+
+lemma wfI_restrict_weakening:
+  assumes "wfI \<Theta> \<Gamma>' i'" and "i =  restrict_map i' (fst `toSet \<Gamma>)" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'"
+  shows  "\<Theta> ; \<Gamma> \<turnstile> i"
+proof -
+  { fix x
+    assume "x \<in> toSet \<Gamma>"
+    have "case x of (x, b, c) \<Rightarrow> \<exists>s. Some s = i x \<and> \<Theta> \<turnstile> s : b" using assms wfI_def
+    proof -
+      have "case x of (x, b, c) \<Rightarrow> \<exists>s. Some s = i' x \<and> \<Theta> \<turnstile> s : b"
+        using \<open>x \<in> toSet \<Gamma>\<close>  assms wfI_def by auto
+      then have "\<exists>s. Some s = i (fst x) \<and> wfRCV \<Theta> s (fst (snd x))"
+        by (simp add: \<open>x \<in> toSet \<Gamma>\<close> assms(2) case_prod_unfold)
+      then show ?thesis
+        by (simp add: case_prod_unfold)
+    qed
+  }
+  thus ?thesis using wfI_def assms by auto
+qed
+
+lemma wfI_suffix:
+  fixes G::\<Gamma>
+  assumes "wfI P (G'@G) i" and "P ; B \<turnstile>\<^sub>w\<^sub>f G"
+  shows "P ; G \<turnstile> i"
+  using wfI_def append_g.simps assms toSet.simps by simp
+
+lemma wfI_replace_inside:
+  assumes "wfI \<Theta> (\<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma>) i"
+  shows  "wfI \<Theta> (\<Gamma>' @ (x, b, c') #\<^sub>\<Gamma> \<Gamma>) i"
+  using wfI_def toSet_splitP assms by simp
+
+section \<open>Existence of evaluation\<close>
+
+lemma eval_l_base:
+  "\<Theta> \<turnstile> \<lbrakk> l \<rbrakk>  : (base_for_lit l)"
+  apply(nominal_induct l rule:l.strong_induct)
+  using wfRCV.intros eval_l.simps  base_for_lit.simps by auto+
+
+lemma obtain_fresh_bv_dclist:
+  fixes tm::"'a::fs"
+  assumes "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist" 
+  obtains bv1::bv and dclist1 x1 b1 c1 where "AF_typedef_poly tyid bv dclist =  AF_typedef_poly tyid bv1 dclist1 
+      \<and> (dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1 \<and> atom bv1 \<sharp> tm" 
+proof - 
+  obtain bv1 dclist1 where "AF_typedef_poly tyid bv dclist =  AF_typedef_poly tyid bv1 dclist1 \<and> atom bv1 \<sharp> tm" 
+    using obtain_fresh_bv by metis
+  moreover hence "[[atom bv]]lst. dclist = [[atom bv1]]lst. dclist1" using type_def.eq_iff by metis
+  moreover then obtain x1 b1 c1 where "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1" using td_lookup_eq_iff assms by metis
+  ultimately show ?thesis  using that by blast
+qed
+
+lemma obtain_fresh_bv_dclist_b_iff:
+  fixes tm::"'a::fs"
+  assumes "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist" and "AF_typedef_poly tyid bv dclist \<in> set P" and "\<turnstile>\<^sub>w\<^sub>f P"
+  obtains bv1::bv and dclist1 x1 b1 c1 where "AF_typedef_poly tyid bv dclist =  AF_typedef_poly tyid bv1 dclist1 
+      \<and> (dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1 \<and> atom bv1 \<sharp> tm \<and> b[bv::=b']\<^sub>b\<^sub>b=b1[bv1::=b']\<^sub>b\<^sub>b" 
+proof - 
+  obtain bv1 dclist1 x1 b1 c1 where *:"AF_typedef_poly tyid bv dclist =  AF_typedef_poly tyid bv1 dclist1 \<and> atom bv1 \<sharp> tm
+    \<and> (dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1" using obtain_fresh_bv_dclist assms by metis
+
+  hence "AF_typedef_poly tyid bv1 dclist1 \<in> set P" using assms by metis
+
+  hence "b[bv::=b']\<^sub>b\<^sub>b = b1[bv1::=b']\<^sub>b\<^sub>b" 
+    using  wfTh_typedef_poly_b_eq_iff[OF assms(2) assms(1) _ _ assms(3),of bv1 dclist1 x1 b1 c1 b']  * by metis
+
+  from this that show ?thesis using * by metis  
+qed
+
+lemma eval_v_exist:
+  fixes \<Gamma>::\<Gamma> and v::v and b::b
+  assumes "P ; \<Gamma>  \<turnstile> i" and "P ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b"
+  shows "\<exists>s. i \<lbrakk> v \<rbrakk> ~  s \<and> P \<turnstile> s : b "
+  using assms proof(nominal_induct v  arbitrary: b rule:v.strong_induct)
+  case (V_lit x)
+  then show ?case using eval_l_base eval_v.intros eval_l.simps wfV_elims rcl_val.supp pure_supp by metis
+next
+  case (V_var x)
+  then obtain c where  *:"Some (b,c) = lookup \<Gamma> x" using wfV_elims by metis
+  hence "x \<in> fst ` toSet \<Gamma>"  using lookup_x by blast
+  hence "x \<in> dom i" using wfI_domi using assms by blast
+  then obtain s where "i x = Some s" by auto
+  moreover hence "P \<turnstile> s : b" using wfRCV.intros wfI_lookup * V_var
+    by (metis wfV_wf)
+
+  ultimately show ?case using eval_v.intros rcl_val.supp b.supp  by metis
+next
+  case (V_pair v1 v2)
+  then  obtain b1 and b2 where *:"P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b1 \<and>  P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : b2 \<and> b = B_pair b1 b2" using wfV_elims by metis
+  then obtain s1 and s2 where "eval_v i v1 s1 \<and> wfRCV P s1 b1 \<and> eval_v i v2 s2 \<and> wfRCV P s2 b2" using V_pair by metis
+  thus   ?case using eval_v.intros wfRCV.intros * by metis
+next
+  case (V_cons tyid dc v)
+  then obtain  s and  b'::b and dclist and x::x and c::c where "(wfV P  B  \<Gamma> v  b') \<and> i \<lbrakk> v \<rbrakk> ~  s \<and> P \<turnstile> s : b' \<and> b = B_id tyid \<and>
+                 AF_typedef tyid dclist \<in> set P \<and> (dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist" using  wfV_elims(4) by metis
+  then show ?case using eval_v.intros(4) wfRCV.intros(5) V_cons by metis
+next
+  case (V_consp tyid dc b' v)
+
+  obtain  b'a::b and bv and dclist and x::x and c::c where *:"(wfV P  B  \<Gamma> v  b'a[bv::=b']\<^sub>b\<^sub>b) \<and> b = B_app tyid b' \<and>
+                 AF_typedef_poly tyid bv dclist \<in> set P \<and> (dc, \<lbrace> x : b'a  | c \<rbrace>) \<in> set dclist \<and> 
+           atom bv \<sharp> (P, B_app tyid b',B) " using  wf_strong_elim(1)[OF V_consp(3)] by metis
+
+  then obtain s where **:"i \<lbrakk> v \<rbrakk> ~ s  \<and>  P  \<turnstile> s : b'a[bv::=b']\<^sub>b\<^sub>b" using V_consp by auto
+
+  have " \<turnstile>\<^sub>w\<^sub>f P" using wfX_wfY V_consp  by metis
+  then obtain bv1::bv and dclist1 x1 b1 c1 where 3:"AF_typedef_poly tyid bv dclist =  AF_typedef_poly tyid bv1 dclist1 
+      \<and> (dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1 \<and> atom bv1 \<sharp>  (P, SConsp tyid dc b' s, B_app tyid b')
+          \<and> b'a[bv::=b']\<^sub>b\<^sub>b = b1[bv1::=b']\<^sub>b\<^sub>b" 
+    using  *  obtain_fresh_bv_dclist_b_iff by blast
+
+  have " i \<lbrakk> V_consp tyid dc b' v \<rbrakk> ~ SConsp tyid dc b' s" using  eval_v.intros  by (simp add: "**")
+
+  moreover have " P  \<turnstile>  SConsp tyid dc b' s : B_app tyid b'" proof
+    show \<open>AF_typedef_poly tyid bv1 dclist1 \<in> set P\<close> using 3 * by metis
+    show \<open>(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1\<close> using 3 by auto 
+    thus \<open>atom bv1 \<sharp> (P, SConsp tyid dc b' s, B_app tyid b')\<close> using * 3 fresh_prodN by metis
+    show \<open> P  \<turnstile> s : b1[bv1::=b']\<^sub>b\<^sub>b\<close> using  3 ** by auto
+  qed
+
+  ultimately show ?case using eval_v.intros wfRCV.intros V_consp * by auto
+qed
+
+lemma eval_v_uniqueness:
+  fixes v::v
+  assumes "i \<lbrakk> v \<rbrakk> ~  s" and "i \<lbrakk> v \<rbrakk> ~  s'"
+  shows "s=s'"
+  using assms proof(nominal_induct v arbitrary: s s' rule:v.strong_induct)
+  case (V_lit x)
+  then show ?case using eval_v_elims eval_l.simps by metis
+next
+  case (V_var x)
+  then show ?case using eval_v_elims   by (metis option.inject)
+next
+  case (V_pair v1 v2)
+  obtain s1 and s2 where s:"i \<lbrakk> v1 \<rbrakk> ~ s1  \<and> i \<lbrakk> v2 \<rbrakk> ~ s2 \<and> s = SPair s1 s2" using eval_v_elims V_pair by metis
+  obtain s1' and s2' where s':"i \<lbrakk> v1 \<rbrakk> ~ s1'  \<and> i \<lbrakk> v2 \<rbrakk> ~ s2' \<and> s' = SPair s1' s2'"  using eval_v_elims V_pair by metis
+  then show ?case using eval_v_elims  using V_pair s s' by auto
+next
+  case (V_cons tyid dc v1)
+  obtain sv1 where 1:"i \<lbrakk> v1 \<rbrakk> ~ sv1 \<and> s = SCons tyid dc sv1" using eval_v_elims V_cons by metis
+  moreover obtain sv2 where 2:"i \<lbrakk> v1 \<rbrakk> ~ sv2 \<and> s' = SCons tyid dc sv2" using eval_v_elims V_cons by metis
+  ultimately have "sv1 = sv2" using V_cons by auto
+  then show ?case  using 1 2 by auto 
+next
+  case (V_consp tyid dc b v1)
+  then show ?case using eval_v_elims  by metis
+
+qed
+
+lemma eval_v_base:
+  fixes \<Gamma>::\<Gamma> and v::v and b::b
+  assumes "P ; \<Gamma>  \<turnstile> i" and "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" and "i \<lbrakk> v \<rbrakk> ~  s"
+  shows "P \<turnstile> s : b"
+  using eval_v_exist eval_v_uniqueness assms by metis
+
+lemma eval_e_uniqueness:
+  fixes e::ce
+  assumes "i \<lbrakk> e \<rbrakk> ~ s" and "i \<lbrakk> e \<rbrakk> ~ s'"
+  shows "s=s'"
+  using assms proof(nominal_induct e arbitrary: s s' rule:ce.strong_induct)
+  case (CE_val x)
+  then show ?case using eval_v_uniqueness eval_e_elims by metis
+next
+  case (CE_op opp x1 x2)
+  consider "opp = Plus" | "opp = LEq" | "opp = Eq" using opp.exhaust by metis
+  thus  ?case proof(cases)
+    case 1
+    hence a1:"eval_e i (CE_op Plus x1 x2) s" and a2:"eval_e i (CE_op Plus x1 x2) s'" using CE_op by auto
+    then show ?thesis using   eval_e_elims(2)[OF a1] eval_e_elims(2)[OF a2]
+        CE_op eval_e_plusI 
+      by (metis rcl_val.eq_iff(2))
+  next
+    case 2
+    hence a1:"eval_e i (CE_op LEq x1 x2) s" and a2:"eval_e i (CE_op LEq x1 x2) s'" using CE_op by auto
+    then show ?thesis using eval_v_uniqueness  eval_e_elims(3)[OF a1] eval_e_elims(3)[OF a2]
+        CE_op eval_e_plusI 
+      by (metis rcl_val.eq_iff(2))
+  next
+    case 3
+    hence a1:"eval_e i (CE_op Eq x1 x2) s" and a2:"eval_e i (CE_op Eq x1 x2) s'" using CE_op by auto
+    then show ?thesis using eval_v_uniqueness  eval_e_elims(4)[OF a1] eval_e_elims(4)[OF a2]
+        CE_op eval_e_plusI 
+      by (metis rcl_val.eq_iff(2))
+  qed
+next
+  case (CE_concat x1 x2)
+  hence a1:"eval_e i (CE_concat x1 x2) s" and a2:"eval_e i (CE_concat x1 x2) s'" using CE_concat by auto
+  show ?case using  eval_e_elims(7)[OF a1] eval_e_elims(7)[OF a2] CE_concat eval_e_concatI rcl_val.eq_iff 
+  proof -
+    assume "\<And>P. (\<And>bv1 bv2. \<lbrakk>s' = SBitvec (bv1 @ bv2); i \<lbrakk> x1 \<rbrakk> ~ SBitvec bv1 ; i \<lbrakk> x2 \<rbrakk> ~ SBitvec bv2 \<rbrakk> \<Longrightarrow> P) \<Longrightarrow> P"
+    obtain bbs :: "bit list" and bbsa :: "bit list" where
+      "i \<lbrakk> x2 \<rbrakk> ~ SBitvec bbs \<and> i \<lbrakk> x1 \<rbrakk> ~ SBitvec bbsa \<and> SBitvec (bbsa @ bbs) = s'"
+      by (metis \<open>\<And>P. (\<And>bv1 bv2. \<lbrakk>s' = SBitvec (bv1 @ bv2); i \<lbrakk> x1 \<rbrakk> ~ SBitvec bv1 ; i \<lbrakk> x2 \<rbrakk> ~ SBitvec bv2 \<rbrakk> \<Longrightarrow> P) \<Longrightarrow> P\<close>) (* 93 ms *)
+    then have "s' = s"
+      by (metis (no_types) \<open>\<And>P. (\<And>bv1 bv2. \<lbrakk>s = SBitvec (bv1 @ bv2); i \<lbrakk> x1 \<rbrakk> ~ SBitvec bv1 ; i \<lbrakk> x2 \<rbrakk> ~ SBitvec bv2 \<rbrakk> \<Longrightarrow> P) \<Longrightarrow> P\<close> \<open>\<And>s' s. \<lbrakk>i \<lbrakk> x1 \<rbrakk> ~ s ; i \<lbrakk> x1 \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> s = s'\<close> \<open>\<And>s' s. \<lbrakk>i \<lbrakk> x2 \<rbrakk> ~ s ; i \<lbrakk> x2 \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> s = s'\<close> rcl_val.eq_iff(1)) (* 125 ms *)
+    then show ?thesis
+      by metis (* 0.0 ms *)
+  qed
+next
+  case (CE_fst x)
+  then show ?case using eval_v_uniqueness  by (meson eval_e_elims rcl_val.eq_iff)
+next
+  case (CE_snd x)
+  then show ?case using eval_v_uniqueness  by (meson eval_e_elims rcl_val.eq_iff)
+next
+  case (CE_len x)
+  then show ?case using  eval_e_elims rcl_val.eq_iff 
+  proof -
+    obtain bbs :: "rcl_val \<Rightarrow> ce \<Rightarrow> (x \<Rightarrow> rcl_val option) \<Rightarrow> bit list" where
+      "\<forall>x0 x1 x2. (\<exists>v3. x0 = SNum (int (length v3)) \<and> x2 \<lbrakk> x1 \<rbrakk> ~ SBitvec v3 ) = (x0 = SNum (int (length (bbs x0 x1 x2))) \<and> x2 \<lbrakk> x1 \<rbrakk> ~ SBitvec (bbs x0 x1 x2) )"
+      by moura (* 0.0 ms *)
+    then have "\<forall>f c r. \<not> f \<lbrakk> [| c |]\<^sup>c\<^sup>e \<rbrakk> ~ r \<or> r = SNum (int (length (bbs r c f))) \<and> f \<lbrakk> c \<rbrakk> ~ SBitvec (bbs r c f)"
+      by (meson eval_e_elims(8)) (* 46 ms *)
+    then show ?thesis
+      by (metis (no_types) CE_len.hyps CE_len.prems(1) CE_len.prems(2) rcl_val.eq_iff(1)) (* 31 ms *)
+  qed
+
+qed
+
+lemma wfV_eval_bitvec:
+  fixes v::v
+  assumes  "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_bitvec" and "P ; \<Gamma>  \<turnstile> i"
+  shows "\<exists>bv. eval_v i v (SBitvec bv)"
+proof -
+  obtain s where "i \<lbrakk> v \<rbrakk> ~  s \<and> wfRCV P s B_bitvec" using eval_v_exist assms by metis
+  moreover then obtain bv where "s = SBitvec bv" using wfRCV_elims(1)[of P s] by metis
+  ultimately show  ?thesis by metis
+qed
+
+lemma wfV_eval_pair:
+  fixes v::v
+  assumes  "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_pair b1 b2" and "P ; \<Gamma>  \<turnstile> i"
+  shows "\<exists>s1 s2. eval_v i v (SPair s1 s2)"
+proof -
+  obtain s  where "i \<lbrakk> v \<rbrakk> ~  s \<and> wfRCV P s (B_pair b1 b2)" using eval_v_exist assms by metis
+  moreover then obtain s1 and s2 where "s = SPair s1 s2" using wfRCV_elims(2)[of P s] by metis
+  ultimately show  ?thesis by metis
+qed
+
+lemma wfV_eval_int:
+  fixes v::v
+  assumes  "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_int" and "P ; \<Gamma>  \<turnstile> i"
+  shows "\<exists>n. eval_v i v (SNum n)"
+proof -
+  obtain s  where "i \<lbrakk> v \<rbrakk> ~  s \<and> wfRCV P s (B_int)" using eval_v_exist assms by metis
+  moreover then obtain n where "s = SNum n" using wfRCV_elims(3)[of P s] by metis
+  ultimately show  ?thesis by metis
+qed
+
+text \<open>Well sorted value with a well sorted valuation evaluates\<close>
+lemma wfI_wfV_eval_v:
+  fixes v::v and b::b
+  assumes "\<Theta> ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" and "wfI \<Theta>  \<Gamma> i"
+  shows "\<exists>s. i \<lbrakk> v \<rbrakk> ~  s \<and> \<Theta> \<turnstile> s : b"
+  using eval_v_exist assms by auto
+
+lemma wfI_wfCE_eval_e:
+  fixes e::ce and b::b
+  assumes "wfCE P B G e b" and "P ; G \<turnstile> i" 
+  shows "\<exists>s. i \<lbrakk> e \<rbrakk> ~ s \<and> P \<turnstile> s : b"
+  using assms proof(nominal_induct e arbitrary:  b  rule: ce.strong_induct)
+  case (CE_val v)
+  obtain s where "i \<lbrakk> v \<rbrakk> ~ s \<and> P \<turnstile> s : b" using wfI_wfV_eval_v[of P B G v b i]  assms wfCE_elims(1)  [of P B G v b] CE_val  by auto
+  then show ?case using CE_val   eval_e.intros(1)[of i v s ] by auto
+next
+  case (CE_op opp v1 v2)
+
+  consider "opp =Plus" | "opp=LEq" | "opp=Eq" using opp.exhaust by auto
+
+  thus ?case proof(cases)
+    case 1
+    hence  "wfCE P  B G v1 B_int \<and> wfCE P  B G v2 B_int" using wfCE_elims(2) CE_op
+
+      by blast
+    then obtain s1 and s2 where *: "eval_e i v1 s1 \<and> wfRCV P s1 B_int \<and> eval_e i v2 s2 \<and> wfRCV P s2 B_int"
+      using wfI_wfV_eval_v  CE_op by metis
+    then obtain n1 and n2 where **:"s2=SNum n2 \<and> s1 = SNum n1"  using wfRCV_elims  by meson
+    hence "eval_e i (CE_op Plus v1 v2) (SNum (n1+n2))" using eval_e_plusI * ** by simp
+    moreover have "wfRCV P (SNum (n1+n2)) B_int" using wfRCV.intros by auto
+    ultimately show ?thesis using 1
+      using CE_op.prems(1) wfCE_elims(2) by blast
+  next
+    case 2
+    hence  "wfCE P  B G v1 B_int \<and> wfCE P  B G v2 B_int" using wfCE_elims(3) CE_op
+      by blast
+    then obtain s1 and s2 where *: "eval_e i v1 s1 \<and> wfRCV P s1 B_int \<and> eval_e i v2 s2 \<and> wfRCV P s2 B_int"
+      using wfI_wfV_eval_v  CE_op by metis
+    then obtain n1 and n2 where **:"s2=SNum n2 \<and> s1 = SNum n1"  using wfRCV_elims  by meson
+    hence "eval_e i (CE_op LEq v1 v2) (SBool (n1 \<le> n2))" using eval_e_leqI * ** by simp
+    moreover have "wfRCV P (SBool (n1\<le>n2)) B_bool" using wfRCV.intros by auto
+    ultimately show ?thesis using 2
+      using CE_op.prems wfCE_elims by metis
+  next
+    case 3
+    then  obtain b2 where "wfCE P  B G v1 b2 \<and> wfCE P  B G v2 b2" using wfCE_elims(9) CE_op
+      by blast
+    then obtain s1 and s2 where *: "eval_e i v1 s1 \<and> wfRCV P s1 b2 \<and> eval_e i v2 s2 \<and> wfRCV P s2 b2"
+      using wfI_wfV_eval_v  CE_op by metis
+    hence "eval_e i (CE_op Eq v1 v2) (SBool (s1 = s2))" using eval_e_leqI *  
+      by (simp add: eval_e_eqI)
+    moreover have "wfRCV P (SBool (s1 = s2)) B_bool" using wfRCV.intros by auto
+    ultimately show ?thesis using 3
+      using CE_op.prems wfCE_elims by metis
+  qed
+next
+  case (CE_concat v1 v2)
+  then obtain s1 and s2 where *:"b = B_bitvec \<and> eval_e i v1 s1 \<and> eval_e i v2 s2 \<and>
+      wfRCV P s1 B_bitvec \<and> wfRCV P s2 B_bitvec" using  
+    CE_concat 
+    by (meson wfCE_elims(6))
+  thus ?case using  eval_e_concatI wfRCV.intros(1) wfRCV_elims 
+  proof -
+    obtain bbs :: "type_def list \<Rightarrow> rcl_val \<Rightarrow> bit list" where
+      "\<forall>ts s. \<not> ts \<turnstile> s : B_bitvec \<or> s = SBitvec (bbs ts s)"
+      using wfRCV_elims(1) by moura (* 156 ms *)
+    then show ?thesis
+      by (metis (no_types) "local.*" wfRCV_BBitvecI eval_e_concatI) (* 78 ms *)
+  qed
+next
+  case (CE_fst v1)
+  thus ?case using  eval_e_fstI  wfRCV.intros wfCE_elims wfI_wfV_eval_v
+    by (metis wfRCV_elims(2) rcl_val.eq_iff(4))
+next
+  case (CE_snd v1)
+  thus ?case using  eval_e_sndI  wfRCV.intros wfCE_elims wfI_wfV_eval_v
+    by (metis wfRCV_elims(2) rcl_val.eq_iff(4))
+next
+  case (CE_len x)
+  thus ?case using  eval_e_lenI  wfRCV.intros wfCE_elims wfI_wfV_eval_v wfV_eval_bitvec 
+    by (metis wfRCV_elims(1))
+qed
+
+lemma eval_e_exist:
+  fixes \<Gamma>::\<Gamma> and e::ce
+  assumes "P ; \<Gamma>  \<turnstile> i" and "P ;  B ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f e : b"
+  shows "\<exists>s. i \<lbrakk> e \<rbrakk> ~ s"
+  using assms proof(nominal_induct e arbitrary: b rule:ce.strong_induct)
+  case (CE_val v)
+  then show ?case using eval_v_exist wfCE_elims eval_e.intros by metis
+next
+  case (CE_op op v1 v2)
+
+  show ?case proof(rule opp.exhaust)
+    assume \<open>op = Plus\<close>
+    hence "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_int \<and> P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int \<and> b = B_int" using wfCE_elims CE_op by metis
+    then obtain n1 and n2 where "eval_e i v1 (SNum n1) \<and> eval_e i v2 (SNum n2)" using CE_op eval_v_exist wfV_eval_int 
+      by (metis wfI_wfCE_eval_e wfRCV_elims(3))
+    then show \<open>\<exists>a. eval_e i (CE_op op v1 v2) a\<close> using eval_e_plusI[of i v1 _ v2] \<open>op=Plus\<close> by auto
+  next
+    assume \<open>op = LEq\<close>
+    hence "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_int \<and> P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int \<and> b = B_bool" using wfCE_elims CE_op by metis
+    then obtain n1 and n2 where "eval_e i v1 (SNum n1) \<and> eval_e i v2 (SNum n2)" using CE_op eval_v_exist wfV_eval_int 
+      by (metis wfI_wfCE_eval_e wfRCV_elims(3))
+    then show \<open>\<exists>a. eval_e i (CE_op op v1 v2) a\<close> using eval_e_leqI[of i v1 _ v2] eval_v_exist \<open>op=LEq\<close> CE_op by auto
+  next
+    assume \<open>op = Eq\<close>
+    then obtain b1 where  "P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b1 \<and> P ;  B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : b1 \<and> b = B_bool" using wfCE_elims CE_op by metis
+    then obtain s1 and s2 where "eval_e i v1 s1 \<and> eval_e i v2 s2" using CE_op eval_v_exist wfV_eval_int 
+      by (metis wfI_wfCE_eval_e wfRCV_elims(3))
+    then show \<open>\<exists>a. eval_e i (CE_op op v1 v2) a\<close> using eval_e_eqI[of i v1 _ v2] eval_v_exist \<open>op=Eq\<close> CE_op by auto
+  qed
+next
+  case (CE_concat v1 v2)
+  then obtain bv1 and bv2 where "eval_e i v1 (SBitvec bv1) \<and> eval_e i v2 (SBitvec bv2)"
+    using wfV_eval_bitvec  wfCE_elims(6) 
+    by (meson eval_e_elims(7) wfI_wfCE_eval_e)
+  then show ?case using  eval_e.intros by metis
+next
+  case (CE_fst ce)
+  then obtain b2 where b:"P ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : B_pair b b2" using wfCE_elims by metis
+  then obtain s where s:"i \<lbrakk> ce \<rbrakk> ~ s" using CE_fst by auto
+  then obtain s1 and s2 where "s = (SPair s1 s2)" using eval_e_elims(4)  CE_fst wfI_wfCE_eval_e[of P B \<Gamma> ce "B_pair b b2" i,OF b] wfRCV_elims(2)[of P s b b2]    
+    by (metis eval_e_uniqueness)
+  then show ?case using s eval_e.intros by metis
+next
+  case (CE_snd ce)
+  then obtain b1 where b:"P ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : B_pair b1 b" using wfCE_elims by metis
+  then obtain s where s:"i \<lbrakk> ce \<rbrakk> ~ s" using CE_snd by auto
+  then obtain s1 and s2 where "s = (SPair s1 s2)" 
+    using eval_e_elims(5)  CE_snd wfI_wfCE_eval_e[of P B \<Gamma> ce "B_pair b1 b" i,OF b] wfRCV_elims(2)[of P s b b1]    
+      eval_e_uniqueness 
+    by (metis wfRCV_elims(2))
+  then show ?case using s eval_e.intros by metis
+next
+  case (CE_len v1)
+  then obtain bv1  where "eval_e i v1 (SBitvec bv1)"
+    using wfV_eval_bitvec  CE_len  wfCE_elims eval_e_uniqueness 
+    by (metis eval_e_elims(7) wfCE_concatI wfI_wfCE_eval_e)
+  then show ?case using  eval_e.intros by metis
+qed
+
+lemma eval_c_exist:
+  fixes \<Gamma>::\<Gamma> and c::c
+  assumes "P ; \<Gamma>  \<turnstile> i" and "P ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
+  shows "\<exists>s. i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(nominal_induct c  rule: c.strong_induct)
+  case C_true
+  then show ?case using eval_c.intros wfC_elims by metis
+next
+  case C_false
+  then show ?case using eval_c.intros wfC_elims by metis
+next
+  case (C_conj c1 c2)
+  then show ?case using eval_c.intros wfC_elims by metis
+next
+  case (C_disj x1 x2)
+  then show ?case using eval_c.intros wfC_elims by metis
+next
+  case (C_not x)
+  then show ?case using eval_c.intros wfC_elims by metis
+next
+  case (C_imp x1 x2)
+  then show ?case using eval_c.intros eval_e_exist wfC_elims by metis
+next
+  case (C_eq x1 x2)
+  then show ?case using eval_c.intros eval_e_exist wfC_elims by metis
+qed
+
+lemma eval_c_uniqueness:
+  fixes c::c
+  assumes "i \<lbrakk> c \<rbrakk> ~ s" and "i \<lbrakk> c \<rbrakk> ~ s'"
+  shows "s=s'"
+  using assms proof(nominal_induct c arbitrary: s s' rule:c.strong_induct)
+  case C_true
+  then show ?case using eval_c_elims by metis
+next
+  case C_false
+  then show ?case using eval_c_elims by metis
+next
+  case (C_conj x1 x2)
+  then show ?case using  eval_c_elims(3) by (metis (full_types))
+next
+  case (C_disj x1 x2)
+  then show ?case using eval_c_elims(4)  by (metis (full_types))
+next
+  case (C_not x)
+  then show ?case using eval_c_elims(6)  by (metis (full_types))
+next
+  case (C_imp x1 x2)
+  then show ?case using eval_c_elims(5)  by (metis (full_types))
+next
+  case (C_eq x1 x2)
+  then show ?case using eval_e_uniqueness eval_c_elims(7) by metis
+qed
+
+lemma wfI_wfC_eval_c:
+  fixes c::c
+  assumes "wfC P B G c" and "P ; G \<turnstile> i"
+  shows "\<exists>s. i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(nominal_induct c  rule: c.strong_induct)
+qed(metis wfC_elims wfI_wfCE_eval_e eval_c.intros)+
+
+section \<open>Satisfiability\<close>
+
+lemma satis_reflI:
+  fixes c::c
+  assumes "i \<Turnstile> ((x, b, c) #\<^sub>\<Gamma> G)"
+  shows "i \<Turnstile> c"
+  using assms by auto
+
+lemma is_satis_mp:
+  fixes c1::c and c2::c
+  assumes "i \<Turnstile> (c1 IMP c2)" and "i \<Turnstile> c1"
+  shows "i \<Turnstile> c2"
+  using assms proof -
+  have "eval_c i (c1 IMP c2) True" using is_satis.simps  using assms by blast
+  then obtain b1 and b2 where "True = (b1 \<longrightarrow> b2) \<and> eval_c i c1 b1 \<and> eval_c i c2 b2"
+    using eval_c_elims(5) by metis
+  moreover have "eval_c i c1 True" using is_satis.simps  using assms by blast
+  moreover have "b1 = True" using calculation eval_c_uniqueness  by blast
+  ultimately have "eval_c i c2 True" by auto
+  thus ?thesis using is_satis.intros by auto
+qed
+
+lemma is_satis_imp:
+  fixes c1::c and c2::c
+  assumes "i \<Turnstile> c1 \<longrightarrow> i \<Turnstile> c2" and "i \<lbrakk> c1 \<rbrakk> ~ b1" and "i \<lbrakk> c2 \<rbrakk> ~ b2"
+  shows "i \<Turnstile> (c1 IMP c2)"
+proof(cases b1)
+  case True
+  hence "i \<Turnstile> c2" using assms is_satis.simps by simp
+  hence "b2 = True" using is_satis.simps assms
+    using eval_c_uniqueness by blast
+  then show ?thesis using eval_c_impI is_satis.simps assms by force
+next
+  case False
+  then show ?thesis using assms eval_c_impI is_satis.simps by metis
+qed
+
+lemma is_satis_iff:
+  "i \<Turnstile> G  = (\<forall>x b c. (x,b,c) \<in> toSet G \<longrightarrow> i \<Turnstile> c)"
+  by(induct G,auto)
+
+lemma is_satis_g_append:
+  "i \<Turnstile> (G1@G2) = (i \<Turnstile>  G1 \<and> i \<Turnstile>  G2)"
+  using is_satis_g.simps  is_satis_iff by auto
+
+section \<open>Substitution for Evaluation\<close>
+
+lemma eval_v_i_upd:
+  fixes v::v
+  assumes "atom x \<sharp> v" and "i \<lbrakk> v \<rbrakk> ~  s'"
+  shows "eval_v ((i ( x \<mapsto>s))) v s' "
+  using assms proof(nominal_induct v arbitrary: s' rule:v.strong_induct)
+  case (V_lit x)
+  then show ?case  by (metis eval_v_elims(1) eval_v_litI)
+next
+  case (V_var y)
+  then obtain s where *: "Some s = i y \<and> s=s'" using eval_v_elims by metis
+  moreover have "x \<noteq> y" using \<open>atom x \<sharp> V_var y\<close> v.supp by simp
+  ultimately have "(i ( x \<mapsto>s)) y = Some s"
+    by (simp add: \<open>Some s = i y \<and> s = s'\<close>)
+  then show ?case using eval_v_varI *  \<open>x \<noteq> y\<close>
+    by (simp add: eval_v.eval_v_varI)
+next
+  case (V_pair v1 v2)
+  hence "atom x \<sharp> v1 \<and> atom x \<sharp> v2" using v.supp by simp
+  moreover obtain s1 and s2 where *: "eval_v i v1 s1 \<and> eval_v i v2 s2 \<and> s' = SPair s1 s2" using eval_v_elims V_pair by metis
+  ultimately have "eval_v ((i ( x \<mapsto>s))) v1 s1 \<and> eval_v ((i ( x \<mapsto>s))) v2 s2" using V_pair by blast
+  thus ?case using eval_v_pairI * by meson
+next
+  case (V_cons tyid dc v1)
+  hence "atom x \<sharp> v1" using v.supp by simp
+  moreover obtain s1 where *: "eval_v i v1 s1 \<and> s' = SCons tyid dc s1" using eval_v_elims V_cons by metis
+  ultimately have "eval_v ((i ( x \<mapsto>s))) v1 s1" using V_cons by blast
+  thus ?case using eval_v_consI * by meson
+next
+  case (V_consp tyid dc b1 v1)
+
+  hence "atom x \<sharp> v1" using v.supp by simp
+  moreover obtain s1 where *: "eval_v i v1 s1 \<and> s' = SConsp tyid dc b1 s1" using eval_v_elims V_consp by metis
+  ultimately have "eval_v ((i ( x \<mapsto>s))) v1 s1" using V_consp by blast
+  thus ?case using eval_v_conspI * by meson
+qed
+
+lemma eval_e_i_upd:
+  fixes e::ce
+  assumes "i \<lbrakk> e \<rbrakk> ~ s'" and "atom x \<sharp> e"
+  shows " (i ( x \<mapsto>s)) \<lbrakk> e \<rbrakk> ~ s'"
+  using assms apply(induct rule: eval_e.induct) using eval_v_i_upd eval_e_elims
+  by (meson ce.fresh eval_e.intros)+
+
+lemma eval_c_i_upd:
+  fixes c::c
+  assumes "i \<lbrakk> c \<rbrakk> ~ s'" and "atom x \<sharp> c"
+  shows "((i ( x \<mapsto>s))) \<lbrakk> c \<rbrakk> ~ s' "
+  using assms proof(induct rule:eval_c.induct)
+  case (eval_c_eqI i e1 sv1 e2 sv2)
+  then show ?case using RCLogic.eval_c_eqI eval_e_i_upd c.fresh by metis
+qed(simp add: eval_c.intros)+
+
+lemma subst_v_eval_v[simp]:
+  fixes v::v and v'::v
+  assumes "i \<lbrakk> v \<rbrakk> ~  s" and "i \<lbrakk> (v'[x::=v]\<^sub>v\<^sub>v) \<rbrakk> ~ s'"
+  shows "(i ( x \<mapsto> s )) \<lbrakk> v' \<rbrakk> ~ s'"
+  using assms proof(nominal_induct v' arbitrary: s' rule:v.strong_induct)
+  case (V_lit x)
+  then show ?case using subst_vv.simps
+    by (metis eval_v_elims(1) eval_v_litI)
+next
+  case (V_var x')
+  then show ?case proof(cases "x=x'")
+    case True
+    hence "(V_var x')[x::=v]\<^sub>v\<^sub>v = v" using subst_vv.simps by auto
+    then show ?thesis using V_var eval_v_elims eval_v_varI eval_v_uniqueness True
+      by (simp add: eval_v.eval_v_varI)
+  next
+    case False
+    hence "atom x \<sharp> (V_var x')" by simp
+    then show ?thesis using eval_v_i_upd False V_var by fastforce
+  qed
+next
+  case (V_pair v1 v2)
+  then obtain s1 and s2 where *:"eval_v i (v1[x::=v]\<^sub>v\<^sub>v) s1 \<and> eval_v i (v2[x::=v]\<^sub>v\<^sub>v) s2 \<and> s' = SPair s1 s2" using V_pair eval_v_elims subst_vv.simps by metis
+  hence "(i ( x \<mapsto> s )) \<lbrakk> v1 \<rbrakk> ~ s1 \<and> (i ( x \<mapsto> s )) \<lbrakk> v2 \<rbrakk> ~ s2" using V_pair by metis
+  thus  ?case  using eval_v_pairI subst_vv.simps * V_pair by metis
+next
+  case (V_cons tyid dc v1)
+  then obtain s1 where "eval_v i (v1[x::=v]\<^sub>v\<^sub>v) s1" using eval_v_elims subst_vv.simps by metis
+  thus ?case  using eval_v_consI V_cons
+    by (metis eval_v_elims subst_vv.simps)
+next
+  case (V_consp tyid dc b1 v1)
+
+  then obtain s1 where *:"eval_v i (v1[x::=v]\<^sub>v\<^sub>v) s1 \<and> s' = SConsp tyid dc b1 s1" using eval_v_elims subst_vv.simps by metis
+  hence "i ( x \<mapsto> s ) \<lbrakk> v1 \<rbrakk> ~ s1" using V_consp by metis
+  thus ?case  using * eval_v_conspI by metis 
+qed
+
+lemma subst_e_eval_v[simp]:
+  fixes y::x and e::ce and v::v and e'::ce
+  assumes  "i \<lbrakk> e' \<rbrakk> ~  s'" and "e'=(e[y::=v]\<^sub>c\<^sub>e\<^sub>v)" and "i \<lbrakk> v \<rbrakk> ~  s"
+  shows "(i ( y \<mapsto> s )) \<lbrakk> e \<rbrakk> ~ s'"
+  using assms proof(induct arbitrary: e rule: eval_e.induct)
+  case (eval_e_valI i v1 sv)
+  then obtain v1' where *:"e = CE_val v1' \<and> v1 = v1'[y::=v]\<^sub>v\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_v i (v1'[y::=v]\<^sub>v\<^sub>v) sv" using eval_e_valI by simp
+  hence "eval_v (i ( y \<mapsto> s )) v1' sv" using subst_v_eval_v eval_e_valI by simp
+  then show ?case using RCLogic.eval_e_valI * by meson
+next
+  case (eval_e_plusI i v1 n1 v2 n2)
+  then obtain v1' and v2' where *:"e = CE_op Plus v1' v2' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v \<and> v2 = v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SNum n1) \<and> eval_e i (v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SNum n2)" using eval_e_plusI by simp
+  hence "eval_e (i ( y \<mapsto> s )) v1' (SNum n1) \<and>  eval_e (i ( y \<mapsto> s )) v2' (SNum n2)" using subst_v_eval_v eval_e_plusI 
+    using "local.*" by blast
+  then show ?case using RCLogic.eval_e_plusI * by meson
+next
+  case (eval_e_leqI i v1 n1 v2 n2)
+  then obtain v1' and v2' where *:"e = CE_op LEq v1' v2' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v \<and> v2 = v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SNum n1) \<and> eval_e i (v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SNum n2)" using eval_e_leqI by simp
+  hence "eval_e (i ( y \<mapsto> s )) v1' (SNum n1) \<and>  eval_e (i ( y \<mapsto> s )) v2' (SNum n2)" using subst_v_eval_v eval_e_leqI 
+    using * by blast
+  then show ?case using RCLogic.eval_e_leqI * by meson
+next
+  case (eval_e_eqI i v1 n1 v2 n2)
+  then obtain v1' and v2' where *:"e = CE_op Eq v1' v2' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v \<and> v2 = v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) n1 \<and> eval_e i (v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v) n2" using eval_e_eqI by simp
+  hence "eval_e (i ( y \<mapsto> s )) v1' n1 \<and>  eval_e (i ( y \<mapsto> s )) v2' n2" using subst_v_eval_v eval_e_eqI 
+    using * by blast
+  then show ?case using RCLogic.eval_e_eqI * by meson
+next
+  case (eval_e_fstI i v1 s1 s2)
+  then obtain v1' and v2' where *:"e = CE_fst v1' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SPair s1 s2)" using eval_e_fstI by simp
+  hence "eval_e (i ( y \<mapsto> s )) v1' (SPair s1 s2)" using eval_e_fstI * by metis
+  then show ?case using RCLogic.eval_e_fstI * by meson
+next
+  case (eval_e_sndI i v1 s1 s2)
+  then obtain v1' and v2' where *:"e = CE_snd v1' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SPair s1 s2)" using eval_e_sndI by simp
+  hence "eval_e (i ( y \<mapsto> s )) v1' (SPair s1 s2)" using subst_v_eval_v eval_e_sndI * by blast
+  then show ?case using RCLogic.eval_e_sndI * by meson
+next
+  case (eval_e_concatI i v1 bv1 v2 bv2)
+  then obtain v1' and v2' where *:"e = CE_concat v1' v2' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v \<and> v2 = v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SBitvec bv1) \<and> eval_e i (v2'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SBitvec bv2)" using eval_e_concatI by simp
+  moreover hence "eval_e (i ( y \<mapsto> s )) v1' (SBitvec bv1) \<and>  eval_e (i ( y \<mapsto> s )) v2' (SBitvec bv2)" 
+    using subst_v_eval_v eval_e_concatI * by blast
+  ultimately show ?case using RCLogic.eval_e_concatI * eval_v_uniqueness  by (metis eval_e_concatI.hyps(1))
+next
+  case (eval_e_lenI i v1 bv)
+  then obtain v1' where *:"e = CE_len v1' \<and> v1 = v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v"
+    using assms by(nominal_induct e rule:ce.strong_induct,simp+)
+  hence "eval_e i (v1'[y::=v]\<^sub>c\<^sub>e\<^sub>v) (SBitvec bv)" using eval_e_lenI by simp
+  hence "eval_e (i ( y \<mapsto> s )) v1' (SBitvec bv)" using subst_v_eval_v eval_e_lenI * by blast
+  then show ?case using RCLogic.eval_e_lenI * by meson
+qed
+
+lemma subst_c_eval_v[simp]:
+  fixes v::v and c :: c
+  assumes "i \<lbrakk> v \<rbrakk> ~  s" and "i \<lbrakk> c[x::=v]\<^sub>c\<^sub>v \<rbrakk> ~ s1" and
+    "(i ( x \<mapsto> s)) \<lbrakk> c \<rbrakk> ~ s2"
+  shows "s1 = s2"
+  using assms proof(nominal_induct c arbitrary: s1 s2 rule: c.strong_induct)
+  case C_true
+  hence "s1 = True \<and> s2 = True" using eval_c_elims subst_cv.simps  by auto
+  then show ?case by auto
+next
+  case C_false
+  hence "s1 = False \<and> s2 = False" using eval_c_elims subst_cv.simps by metis
+  then show ?case by auto
+next
+  case (C_conj c1 c2)
+  hence *:"eval_c i (c1[x::=v]\<^sub>c\<^sub>v AND c2[x::=v]\<^sub>c\<^sub>v) s1" using subst_cv.simps by auto
+  then obtain s11 and s12 where "(s1 = (s11 \<and> s12)) \<and> eval_c i c1[x::=v]\<^sub>c\<^sub>v s11 \<and> eval_c i c2[x::=v]\<^sub>c\<^sub>v s12" using
+      eval_c_elims(3) by metis
+  moreover obtain   s21 and s22 where "eval_c  (i ( x \<mapsto> s)) c1 s21 \<and> eval_c  (i ( x \<mapsto> s)) c2 s22 \<and> (s2 = (s21 \<and> s22))" using
+      eval_c_elims(3) C_conj by metis
+  ultimately show ?case using C_conj  by (meson eval_c_elims)
+next
+  case (C_disj c1 c2)
+  hence *:"eval_c i (c1[x::=v]\<^sub>c\<^sub>v OR c2[x::=v]\<^sub>c\<^sub>v) s1" using subst_cv.simps by auto
+  then obtain s11 and s12 where "(s1 = (s11 \<or> s12)) \<and> eval_c i c1[x::=v]\<^sub>c\<^sub>v s11 \<and> eval_c i c2[x::=v]\<^sub>c\<^sub>v s12" using
+      eval_c_elims(4) by metis
+  moreover obtain   s21 and s22 where "eval_c  (i ( x \<mapsto> s)) c1 s21 \<and> eval_c  (i ( x \<mapsto> s)) c2 s22 \<and> (s2 = (s21 \<or> s22))" using
+      eval_c_elims(4) C_disj by metis
+  ultimately show ?case using C_disj  by (meson eval_c_elims)
+next
+  case (C_not c1)
+  then obtain s11 where "(s1 = (\<not> s11)) \<and> eval_c i c1[x::=v]\<^sub>c\<^sub>v s11" using
+      eval_c_elims(6)  by (metis subst_cv.simps(7))
+  moreover obtain   s21 where "eval_c  (i ( x \<mapsto> s)) c1 s21 \<and> (s2 = (\<not>s21))" using
+      eval_c_elims(6) C_not by metis
+  ultimately show ?case using C_not  by (meson eval_c_elims)
+next
+  case (C_imp c1 c2)
+  hence *:"eval_c i (c1[x::=v]\<^sub>c\<^sub>v IMP c2[x::=v]\<^sub>c\<^sub>v) s1" using subst_cv.simps by auto
+  then obtain s11 and s12 where "(s1 = (s11 \<longrightarrow> s12)) \<and> eval_c i c1[x::=v]\<^sub>c\<^sub>v s11 \<and> eval_c i c2[x::=v]\<^sub>c\<^sub>v s12" using
+      eval_c_elims(5) by metis
+  moreover obtain   s21 and s22 where "eval_c  (i ( x \<mapsto> s)) c1 s21 \<and> eval_c  (i ( x \<mapsto> s)) c2 s22 \<and> (s2 = (s21 \<longrightarrow> s22))" using
+      eval_c_elims(5) C_imp by metis
+  ultimately show ?case using C_imp  by (meson eval_c_elims)
+next
+  case (C_eq e1 e2)
+  hence *:"eval_c i (e1[x::=v]\<^sub>c\<^sub>e\<^sub>v == e2[x::=v]\<^sub>c\<^sub>e\<^sub>v) s1" using subst_cv.simps by auto
+  then obtain s11 and s12 where "(s1 = (s11 = s12)) \<and> eval_e i (e1[x::=v]\<^sub>c\<^sub>e\<^sub>v) s11 \<and> eval_e i (e2[x::=v]\<^sub>c\<^sub>e\<^sub>v) s12" using
+      eval_c_elims(7) by metis
+  moreover obtain   s21 and s22 where "eval_e  (i ( x \<mapsto> s)) e1 s21 \<and> eval_e  (i ( x \<mapsto> s)) e2 s22 \<and> (s2 = (s21 = s22))" using
+      eval_c_elims(7) C_eq by metis
+  ultimately show ?case using C_eq subst_e_eval_v  by (metis eval_e_uniqueness)
+qed
+
+lemma wfI_upd:
+  assumes  "wfI \<Theta> \<Gamma> i" and "wfRCV \<Theta> s b" and "wfG \<Theta> B ((x, b, c) #\<^sub>\<Gamma> \<Gamma>)"
+  shows "wfI \<Theta> ((x, b, c) #\<^sub>\<Gamma> \<Gamma>) (i(x \<mapsto> s))"
+proof(subst wfI_def,rule)
+  fix xa
+  assume as:"xa \<in> toSet ((x, b, c) #\<^sub>\<Gamma> \<Gamma>)"
+
+  then obtain x1::x and b1::b and c1::c where xa: "xa = (x1,b1,c1)" using toSet.simps
+    using prod_cases3 by blast
+
+  have "\<exists>sa. Some sa = (i(x \<mapsto> s)) x1 \<and> wfRCV \<Theta> sa b1" proof(cases "x=x1")
+    case True
+    hence "b=b1" using as xa wfG_unique assms by metis
+    hence "Some s = (i(x \<mapsto> s)) x1 \<and> wfRCV \<Theta> s b1" using assms True by simp
+    then show ?thesis by auto
+  next
+    case False
+    hence "(x1,b1,c1) \<in> toSet \<Gamma>" using xa as by auto
+    then obtain sa where "Some sa = i x1 \<and> wfRCV \<Theta> sa b1" using assms wfI_def as xa by auto
+    hence "Some sa = (i(x \<mapsto> s)) x1 \<and> wfRCV \<Theta> sa b1" using False by auto
+    then show ?thesis by auto
+  qed
+
+  thus  "case xa of (xa, ba, ca) \<Rightarrow> \<exists>sa. Some sa = (i(x \<mapsto> s)) xa \<and> wfRCV \<Theta> sa ba" using xa by auto
+qed
+
+lemma wfI_upd_full:
+  fixes v::v
+  assumes  "wfI \<Theta> G i" and "G =  ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" and "wfRCV \<Theta> s b" and "wfG \<Theta> B  (\<Gamma>'@((x,b,c)#\<^sub>\<Gamma>\<Gamma>))" and "\<Theta> ; B  ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b"
+  shows "wfI \<Theta>  (\<Gamma>'@((x,b,c)#\<^sub>\<Gamma>\<Gamma>)) (i(x \<mapsto> s))"
+proof(subst wfI_def,rule)
+  fix xa
+  assume as:"xa \<in> toSet (\<Gamma>'@((x,b,c)#\<^sub>\<Gamma>\<Gamma>))"
+
+  then obtain x1::x and b1::b and c1::c where xa: "xa = (x1,b1,c1)" using toSet.simps
+    using prod_cases3 by blast
+
+  have "\<exists>sa. Some sa = (i(x \<mapsto> s)) x1 \<and> wfRCV \<Theta> sa b1"
+  proof(cases "x=x1")
+    case True
+    hence "b=b1" using as xa wfG_unique_full assms by metis
+    hence "Some s = (i(x \<mapsto> s)) x1 \<and> wfRCV \<Theta> s b1" using assms True by simp
+    then show ?thesis by auto
+  next
+    case False
+    hence "(x1,b1,c1) \<in> toSet (\<Gamma>'@\<Gamma>)" using as xa by auto
+    then obtain c1' where  "(x1,b1,c1') \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)" using xa as wfG_member_subst assms  False by metis
+    then obtain sa where "Some sa = i x1 \<and> wfRCV \<Theta> sa b1" using assms wfI_def as xa by blast
+    hence "Some sa = (i(x \<mapsto> s)) x1 \<and> wfRCV \<Theta> sa b1" using False by auto
+    then show ?thesis by auto
+  qed
+
+  thus  "case xa of (xa, ba, ca) \<Rightarrow> \<exists>sa. Some sa = (i(x \<mapsto> s)) xa \<and> wfRCV \<Theta> sa ba" using xa by auto
+qed
+
+lemma subst_c_satis[simp]:
+  fixes v::v
+  assumes "i \<lbrakk> v \<rbrakk> ~  s" and "wfC \<Theta> B ((x,b,c')#\<^sub>\<Gamma>\<Gamma>) c" and "wfI \<Theta> \<Gamma> i" and  "\<Theta> ; B  ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b"
+  shows "i \<Turnstile> (c[x::=v]\<^sub>c\<^sub>v) \<longleftrightarrow> (i ( x \<mapsto> s)) \<Turnstile> c"
+proof -
+  have "wfI \<Theta> ((x, b, c') #\<^sub>\<Gamma> \<Gamma>) (i(x \<mapsto> s))" using wfI_upd assms wfC_wf eval_v_base by blast
+  then obtain s1 where s1:"eval_c (i(x \<mapsto> s)) c s1"  using  eval_c_exist[of \<Theta> "((x,b,c')#\<^sub>\<Gamma>\<Gamma>)" "(i ( x \<mapsto> s))" B c ] assms by auto
+
+  have "\<Theta> ; B  ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c[x::=v]\<^sub>c\<^sub>v" using wf_subst1(2)[OF assms(2) _ assms(4) , of GNil x   ] subst_gv.simps by simp
+  then obtain s2 where s2:"eval_c i c[x::=v]\<^sub>c\<^sub>v s2" using eval_c_exist[of \<Theta> "\<Gamma>" "i" B "c[x::=v]\<^sub>c\<^sub>v"  ] assms by auto
+
+  show ?thesis using s1 s2 subst_c_eval_v[OF assms(1) s2 s1] is_satis.cases
+    using eval_c_uniqueness is_satis.simps by auto
+qed
+
+text \<open> Key theorem telling us we can replace a substitution with an update to the valuation \<close>
+lemma subst_c_satis_full:
+  fixes v::v and \<Gamma>'::\<Gamma>
+  assumes "i \<lbrakk> v \<rbrakk> ~  s" and "wfC \<Theta> B  (\<Gamma>'@((x,b,c')#\<^sub>\<Gamma>\<Gamma>)) c" and "wfI \<Theta>  ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) i" and  "\<Theta> ; B  ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b"
+  shows "i \<Turnstile> (c[x::=v]\<^sub>c\<^sub>v) \<longleftrightarrow> (i ( x \<mapsto> s)) \<Turnstile> c"
+proof -
+  have "wfI \<Theta> (\<Gamma>'@((x, b, c')) #\<^sub>\<Gamma> \<Gamma>) (i(x \<mapsto> s))" using wfI_upd_full assms wfC_wf eval_v_base wfI_suffix wfI_def wfV_wf by fast
+  then obtain s1 where s1:"eval_c (i(x \<mapsto> s)) c s1" using  eval_c_exist[of \<Theta> "(\<Gamma>'@(x,b,c')#\<^sub>\<Gamma>\<Gamma>)" "(i ( x \<mapsto> s))" B c ] assms by auto
+
+  have "\<Theta> ; B ; ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c[x::=v]\<^sub>c\<^sub>v" using wbc_subst assms by auto
+
+  then obtain s2 where s2:"eval_c i c[x::=v]\<^sub>c\<^sub>v s2" using eval_c_exist[of \<Theta> "((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" "i" B "c[x::=v]\<^sub>c\<^sub>v" ] assms by auto
+
+  show ?thesis using s1 s2 subst_c_eval_v[OF assms(1) s2 s1] is_satis.cases
+    using eval_c_uniqueness is_satis.simps by auto
+qed
+
+section \<open>Validity\<close>
+
+lemma validI[intro]:
+  fixes c::c
+  assumes  "wfC P B G c" and "\<forall>i. P ; G \<turnstile> i \<and> i \<Turnstile> G \<longrightarrow> i \<Turnstile> c"
+  shows "P ; B ; G \<Turnstile> c"
+  using assms valid.simps by presburger
+
+lemma valid_g_wf:
+  fixes c::c and G::\<Gamma>
+  assumes "P ; B ; G \<Turnstile> c"
+  shows "P ; B \<turnstile>\<^sub>w\<^sub>f G"
+  using assms wfC_wf valid.simps by blast
+
+lemma valid_reflI [intro]:
+  fixes b::b
+  assumes  "P ; B ; ((x,b,c1)#\<^sub>\<Gamma>G) \<turnstile>\<^sub>w\<^sub>f c1" and "c1 = c2"
+  shows "P ; B ; ((x,b,c1)#\<^sub>\<Gamma>G) \<Turnstile> c2"
+  using satis_reflI assms by simp
+
+subsection \<open>Weakening and Strengthening\<close>
+
+text \<open> Adding to the domain of a valuation doesn't change the result \<close>
+
+lemma eval_v_weakening:
+  fixes c::v and B::"bv fset"
+  assumes "i = i'|` d" and "supp c \<subseteq> atom ` d \<union> supp B "  and "i \<lbrakk> c \<rbrakk> ~ s"
+  shows "i' \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(nominal_induct c arbitrary:s rule: v.strong_induct)
+  case (V_lit x)
+  then show ?case using eval_v_elims eval_v_litI by metis
+next
+  case (V_var x)
+  have "atom x \<in> atom ` d" using x_not_in_b_set[of x B] assms v.supp(2) supp_at_base 
+  proof -
+    show ?thesis
+      by (metis UnE V_var.prems(2) \<open>atom x \<notin> supp B\<close> singletonI subset_iff supp_at_base v.supp(2)) (* 46 ms *)
+  qed 
+  moreover have "Some s = i x" using assms eval_v_elims(2) 
+    using V_var.prems(3) by blast
+  hence "Some s= i' x" using assms insert_subset restrict_in  
+  proof -
+    show ?thesis
+      by (metis (no_types) \<open>i = i' |` d\<close> \<open>Some s = i x\<close> atom_eq_iff calculation imageE restrict_in) (* 31 ms *)
+  qed
+  thus ?case using eval_v.eval_v_varI by simp
+
+next
+  case (V_pair v1 v2)
+  then show ?case using eval_v_elims(3) eval_v_pairI v.supp
+    by (metis assms le_sup_iff)
+next
+  case (V_cons dc v1)
+  then show ?case using eval_v_elims(4) eval_v_consI v.supp
+    by (metis assms le_sup_iff)
+next
+  case (V_consp tyid dc b1 v1)
+
+  then obtain sv1 where *:"i \<lbrakk> v1 \<rbrakk> ~ sv1 \<and> s = SConsp tyid dc b1 sv1" using eval_v_elims by metis
+  hence "i' \<lbrakk> v1 \<rbrakk> ~ sv1" using V_consp by auto 
+  then show ?case using * eval_v_conspI v.supp eval_v.simps  assms le_sup_iff by metis
+qed
+
+lemma eval_v_restrict:
+  fixes c::v and B::"bv fset"
+  assumes "i = i' |` d" and "supp c \<subseteq> atom ` d \<union> supp B "  and "i' \<lbrakk> c \<rbrakk> ~ s"
+  shows "i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(nominal_induct c arbitrary:s rule: v.strong_induct)
+  case (V_lit x)
+  then show ?case using eval_v_elims eval_v_litI by metis
+next
+  case (V_var x)
+  have "atom x \<in> atom ` d" using x_not_in_b_set[of x B] assms v.supp(2) supp_at_base 
+  proof -
+    show ?thesis
+      by (metis UnE V_var.prems(2) \<open>atom x \<notin> supp B\<close> singletonI subset_iff supp_at_base v.supp(2)) (* 46 ms *)
+  qed 
+  moreover have "Some s = i' x" using assms eval_v_elims(2) 
+    using V_var.prems(3) by blast
+  hence "Some s= i x" using assms insert_subset restrict_in  
+  proof -
+    show ?thesis
+      by (metis (no_types) \<open>i = i' |` d\<close> \<open>Some s = i' x\<close> atom_eq_iff calculation imageE restrict_in) (* 31 ms *)
+  qed
+  thus ?case using eval_v.eval_v_varI by simp
+next
+  case (V_pair v1 v2)
+  then show ?case using eval_v_elims(3) eval_v_pairI v.supp
+    by (metis assms le_sup_iff)
+next
+  case (V_cons dc v1)
+  then show ?case using eval_v_elims(4) eval_v_consI v.supp
+    by (metis assms le_sup_iff)
+next
+  case (V_consp tyid dc b1 v1)
+  then obtain sv1 where *:"i' \<lbrakk> v1 \<rbrakk> ~ sv1 \<and> s = SConsp tyid dc b1 sv1" using eval_v_elims by metis
+  hence "i \<lbrakk> v1 \<rbrakk> ~ sv1" using V_consp by auto 
+  then show ?case using * eval_v_conspI v.supp eval_v.simps  assms le_sup_iff by metis
+qed
+
+lemma eval_e_weakening:
+  fixes e::ce and B::"bv fset"
+  assumes  "i \<lbrakk> e \<rbrakk> ~ s" and "i = i' |` d" and "supp e \<subseteq> atom ` d \<union> supp B "
+  shows "i' \<lbrakk> e \<rbrakk> ~ s"
+  using assms proof(induct rule: eval_e.induct)
+  case (eval_e_valI i v sv)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by auto
+next
+  case (eval_e_plusI i v1 n1 v2 n2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by auto
+next
+  case (eval_e_leqI i v1 n1 v2 n2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by auto
+next
+  case (eval_e_eqI i v1 n1 v2 n2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by auto
+next
+  case (eval_e_fstI i v v1 v2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by metis
+next
+  case (eval_e_sndI i v v1 v2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by metis
+next
+  case (eval_e_concatI i v1 bv2 v2 bv1)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by auto
+next
+  case (eval_e_lenI i v bv)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_weakening by auto
+qed
+
+lemma eval_e_restrict :
+  fixes e::ce and B::"bv fset"
+  assumes  "i' \<lbrakk> e \<rbrakk> ~ s" and "i = i' |` d" and "supp e \<subseteq> atom ` d \<union> supp B "
+  shows "i \<lbrakk> e \<rbrakk> ~ s"
+  using assms proof(induct rule: eval_e.induct)
+  case (eval_e_valI i v sv)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by auto
+next
+  case (eval_e_plusI i v1 n1 v2 n2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by auto
+next
+  case (eval_e_leqI i v1 n1 v2 n2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by auto
+next
+  case (eval_e_eqI i v1 n1 v2 n2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by auto
+next
+  case (eval_e_fstI i v v1 v2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by metis
+next
+  case (eval_e_sndI i v v1 v2)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by metis
+next
+  case (eval_e_concatI i v1 bv2 v2 bv1)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by auto
+next
+  case (eval_e_lenI i v bv)
+  then show ?case using ce.supp eval_e.intros
+    using eval_v_restrict by auto
+qed
+
+lemma eval_c_i_weakening:
+  fixes c::c and B::"bv fset"
+  assumes  "i \<lbrakk> c \<rbrakk> ~ s" and "i = i' |` d" and "supp c \<subseteq> atom ` d \<union> supp B"
+  shows "i' \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(induct rule:eval_c.induct)
+  case (eval_c_eqI i e1 sv1 e2 sv2)
+  then show ?case  using eval_c.intros eval_e_weakening by auto
+qed(auto simp add: eval_c.intros)+
+
+lemma eval_c_i_restrict:
+  fixes c::c and B::"bv fset"
+  assumes  "i' \<lbrakk> c \<rbrakk> ~ s" and "i = i' |` d" and "supp c \<subseteq> atom ` d \<union> supp B"
+  shows "i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(induct rule:eval_c.induct)
+  case (eval_c_eqI i e1 sv1 e2 sv2)
+  then show ?case  using eval_c.intros eval_e_restrict by auto
+qed(auto simp add: eval_c.intros)+
+
+lemma is_satis_i_weakening:
+  fixes c::c and B::"bv fset"
+  assumes "i = i' |` d" and "supp c \<subseteq> atom ` d  \<union> supp B " and  "i \<Turnstile> c"
+  shows "i' \<Turnstile> c"
+  using is_satis.simps eval_c_i_weakening[OF _ assms(1) assms(2) ]
+  using assms(3) by auto
+
+lemma is_satis_i_restrict:
+  fixes c::c and B::"bv fset"
+  assumes "i = i' |` d" and "supp c \<subseteq> atom ` d  \<union> supp B" and  "i' \<Turnstile> c"
+  shows "i \<Turnstile> c"
+  using is_satis.simps eval_c_i_restrict[OF _ assms(1) assms(2) ]
+  using assms(3) by auto
+
+lemma is_satis_g_restrict1:
+  fixes \<Gamma>'::\<Gamma> and  \<Gamma>::\<Gamma>
+  assumes "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "i \<Turnstile> \<Gamma>'"
+  shows "i \<Turnstile> \<Gamma>"
+  using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons xbc G)
+  obtain x and b and c::c where xbc: "xbc=(x,b,c)"
+    using prod_cases3 by blast
+  hence "i \<Turnstile> G" using GCons by auto
+  moreover have "i \<Turnstile> c" using GCons
+      is_satis_iff toSet.simps  subset_iff
+    using xbc by blast
+  ultimately show ?case using is_satis_g.simps GCons
+    by (simp add: xbc)
+qed
+
+lemma is_satis_g_restrict2:
+  fixes \<Gamma>'::\<Gamma> and  \<Gamma>::\<Gamma>
+  assumes "i \<Turnstile> \<Gamma>" and  "i' = i |` d" and "atom_dom \<Gamma> \<subseteq> atom ` d" and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "i' \<Turnstile> \<Gamma>"
+  using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x b c G)
+
+  hence "i' \<Turnstile> G" proof -
+    have "i \<Turnstile> G" using GCons  by simp
+    moreover have "atom_dom G \<subseteq> atom ` d" using  GCons by simp
+    ultimately show ?thesis using GCons wfG_cons2 by blast
+  qed
+
+  moreover have "i' \<Turnstile> c" proof -
+    have "i \<Turnstile> c" using GCons  by auto
+    moreover have "\<Theta> ; B ; (x, b, TRUE) #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c"  using wfG_wfC GCons by simp
+    moreover hence "supp c \<subseteq> atom ` d \<union> supp B" using wfC_supp GCons atom_dom_eq by blast
+    ultimately show ?thesis using is_satis_i_restrict[of i' i d c] GCons by simp
+  qed
+
+  ultimately show ?case by auto
+qed
+
+lemma is_satis_g_restrict:
+  fixes \<Gamma>'::\<Gamma> and \<Gamma>::\<Gamma>
+  assumes "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "i' \<Turnstile> \<Gamma>'" and  "i =   i' |` (fst ` toSet \<Gamma>)"  and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "i \<Turnstile> \<Gamma>"
+  using assms is_satis_g_restrict1[OF assms(1) assms(2)] is_satis_g_restrict2[OF _ assms(3)] by simp
+
+subsection \<open>Updating valuation\<close>
+
+lemma is_satis_c_i_upd:
+  fixes c::c
+  assumes "atom x \<sharp> c" and "i \<Turnstile> c"
+  shows "((i ( x \<mapsto>s))) \<Turnstile> c"
+  using assms eval_c_i_upd is_satis.simps by simp
+
+lemma is_satis_g_i_upd:
+  fixes G::\<Gamma>
+  assumes "atom x \<sharp> G"  and "i \<Turnstile> G"
+  shows "((i ( x \<mapsto>s))) \<Turnstile> G"
+  using assms proof(induct G rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' G')
+
+  hence *:"atom x \<sharp> G' \<and> atom x \<sharp> c'"
+    using fresh_def fresh_GCons GCons  by force
+  moreover hence "is_satis ((i ( x \<mapsto>s))) c'"
+    using is_satis_c_i_upd GCons is_satis_g.simps by auto
+  moreover have " is_satis_g (i(x \<mapsto> s)) G'" using GCons * by fastforce
+  ultimately show ?case
+    using GCons is_satis_g.simps(2) by metis
+qed
+
+lemma valid_weakening:
+  assumes "\<Theta> ; B ; \<Gamma> \<Turnstile> c" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "wfG \<Theta> B  \<Gamma>'"
+  shows  "\<Theta> ; B ; \<Gamma>' \<Turnstile> c"
+proof -
+  have "wfC \<Theta> B  \<Gamma> c" using assms valid.simps by auto
+  hence sp: "supp c \<subseteq> atom `(fst `toSet \<Gamma>) \<union> supp B" using wfX_wfY wfG_elims
+    using atom_dom.simps dom.simps wf_supp(2) by metis
+  have wfg: "wfG \<Theta> B  \<Gamma>" using assms valid.simps wfC_wf by auto
+
+  moreover have a1: "(\<forall>i. wfI \<Theta> \<Gamma>' i \<and> i \<Turnstile> \<Gamma>' \<longrightarrow> i \<Turnstile> c)" proof(rule allI, rule impI)
+    fix i
+    assume as: "wfI \<Theta> \<Gamma>' i \<and> i \<Turnstile> \<Gamma>'"
+    hence as1: "fst ` toSet \<Gamma> \<subseteq> dom i" using assms wfI_domi by blast
+    obtain i' where idash: "i' =  restrict_map i (fst `toSet \<Gamma>)" by blast
+    hence as2: "dom i' = (fst `toSet \<Gamma>)"  using dom_restrict as1 by auto
+
+    have id2: "\<Theta> ; \<Gamma> \<turnstile> i' \<and> i' \<Turnstile> \<Gamma>" proof -
+      have "wfI \<Theta>  \<Gamma> i'" using as2 wfI_restrict_weakening[of \<Theta> \<Gamma>' i i' \<Gamma>] as  assms
+        using idash by blast
+      moreover have "i' \<Turnstile> \<Gamma>" using is_satis_g_restrict[OF assms(2)] wfg as idash by auto
+      ultimately show ?thesis using idash by auto
+    qed
+    hence "i' \<Turnstile> c" using assms valid.simps by auto
+    thus  "i \<Turnstile> c" using assms valid.simps is_satis_i_weakening  idash sp by blast
+  qed
+  moreover have "wfC \<Theta> B \<Gamma>' c" using wf_weakening assms valid.simps
+    by (meson  wfg)
+  ultimately show  ?thesis using assms valid.simps by auto
+qed
+
+lemma is_satis_g_suffix:
+  fixes G::\<Gamma>
+  assumes "i \<Turnstile> (G'@G)"
+  shows "i \<Turnstile> G"
+  using assms proof(induct G' rule:\<Gamma>.induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons xbc x2)
+  obtain x and b and c::c where xbc: "xbc=(x,b,c)"
+    using prod_cases3 by blast
+  hence " i \<Turnstile> (xbc #\<^sub>\<Gamma> (x2 @ G))" using append_g.simps GCons by fastforce
+  then show ?case using is_satis_g.simps GCons xbc by blast
+qed
+
+lemma wfG_inside_valid2:
+  fixes x::x and \<Gamma>::\<Gamma> and c0::c and c0'::c
+  assumes "wfG \<Theta> B  (\<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>))" and
+    "\<Theta> ; B ; \<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c0'"
+  shows "wfG \<Theta> B  (\<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>))"
+proof -
+  have "wfG \<Theta>  B  (\<Gamma>'@(x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)" using valid.simps wfC_wf assms by auto
+  thus ?thesis using wfG_replace_inside_full assms by auto
+qed
+
+lemma valid_trans:
+  assumes   " \<Theta> ; \<B> ; \<Gamma> \<Turnstile> c0[z::=v]\<^sub>v"  and " \<Theta> ; \<B> ; (z,b,c0)#\<^sub>\<Gamma>\<Gamma> \<Turnstile> c1" and "atom z \<sharp> \<Gamma>" and "wfV \<Theta> \<B> \<Gamma> v b" 
+  shows " \<Theta> ; \<B> ; \<Gamma> \<Turnstile> c1[z::=v]\<^sub>v"
+proof - 
+  have *:"wfC \<Theta> \<B> ((z,b,c0)#\<^sub>\<Gamma>\<Gamma>) c1" using valid.simps assms by auto
+  hence "wfC \<Theta> \<B> \<Gamma> (c1[z::=v]\<^sub>v)" using wf_subst1(2)[OF * , of GNil ]  assms subst_gv.simps subst_v_c_def by force
+
+  moreover have "\<forall>i. wfI  \<Theta> \<Gamma>   i \<and> is_satis_g i \<Gamma> \<longrightarrow> is_satis i (c1[z::=v]\<^sub>v)" 
+  proof(rule,rule)
+    fix i
+    assume  as: "wfI  \<Theta> \<Gamma>   i \<and> is_satis_g i \<Gamma>"
+    then obtain sv where sv: "eval_v i v sv \<and> wfRCV \<Theta> sv b" using eval_v_exist assms by metis
+    hence "is_satis i (c0[z::=v]\<^sub>v)" using assms valid.simps as by metis
+    hence "is_satis (i(z \<mapsto> sv))  c0" using subst_c_satis sv as assms valid.simps wfC_wf wfG_elim2 subst_v_c_def by metis
+    moreover have "is_satis_g  (i(z \<mapsto> sv)) \<Gamma>" 
+      using is_satis_g_i_upd  assms  by (simp add: as)
+    ultimately have "is_satis_g  (i(z \<mapsto> sv)) ((z,b,c0)#\<^sub>\<Gamma>\<Gamma>)" 
+      using is_satis_g.simps by simp
+    moreover have "wfI \<Theta> ((z,b,c0)#\<^sub>\<Gamma>\<Gamma>) (i(z \<mapsto> sv))" using as wfI_upd sv assms valid.simps wfC_wf by metis
+    ultimately have "is_satis (i(z \<mapsto> sv)) c1" using assms valid.simps by auto
+    thus "is_satis i (c1[z::=v]\<^sub>v)" using subst_c_satis sv as assms valid.simps wfC_wf wfG_elim2 subst_v_c_def by metis
+  qed
+
+  ultimately show ?thesis using valid.simps by auto
+qed
+
+lemma valid_trans_full:
+  assumes  "\<Theta> ; \<B> ; ((x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile> c2[z2::=V_var x]\<^sub>v" and
+    "\<Theta> ; \<B> ; ((x, b, c2[z2::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile> c3[z3::=V_var x]\<^sub>v" 
+  shows  "\<Theta> ; \<B> ; ((x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile> c3[z3::=V_var x]\<^sub>v"
+  unfolding valid.simps proof
+  show "\<Theta> ; \<B> ; (x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c3[z3::=V_var x]\<^sub>v" using wf_trans valid.simps assms by metis
+
+  show "\<forall>i.  ( wfI  \<Theta> ((x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) i \<and>  (is_satis_g i ((x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>))  \<longrightarrow>  (is_satis i (c3[z3::=V_var x]\<^sub>v)) ) "
+  proof(rule,rule)
+    fix i
+    assume as: "\<Theta> ; (x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile> i \<and>  i \<Turnstile> (x, b, c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" 
+    have "i \<Turnstile> c2[z2::=V_var x]\<^sub>v" using is_satis_g.simps as assms by simp
+    moreover have  "i \<Turnstile> \<Gamma>"  using is_satis_g.simps as by simp
+    ultimately show "i \<Turnstile> c3[z3::=V_var x]\<^sub>v " using assms is_satis_g.simps valid.simps 
+      by (metis append_g.simps(1) as wfI_replace_inside)
+  qed
+qed
+
+lemma eval_v_weakening_x:
+  fixes c::v
+  assumes  "i' \<lbrakk> c \<rbrakk> ~ s" and "atom x \<sharp> c" and "i = i' (x \<mapsto> s')"
+  shows "i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(induct rule: eval_v.induct)
+  case (eval_v_litI i l)
+  then show ?case using eval_v.intros by auto
+next
+  case (eval_v_varI sv i1 x1)
+  hence "x \<noteq> x1" using v.fresh fresh_at_base by auto
+  hence "i x1 = Some sv" using eval_v_varI by simp
+  then show ?case  using eval_v.intros by auto
+next
+  case (eval_v_pairI i v1 s1 v2 s2)
+  then show ?case  using eval_v.intros by auto
+next
+  case (eval_v_consI i v s tyid dc)
+  then show ?case  using eval_v.intros by auto
+next
+  case (eval_v_conspI i v s tyid dc b)
+  then show ?case  using eval_v.intros by auto
+qed
+
+lemma eval_e_weakening_x:
+  fixes c::ce
+  assumes  "i' \<lbrakk> c \<rbrakk> ~ s" and "atom x \<sharp> c" and "i = i' (x \<mapsto> s')"
+  shows "i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(induct rule: eval_e.induct)
+  case (eval_e_valI i v sv)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_plusI i v1 n1 v2 n2)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_leqI i v1 n1 v2 n2)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_eqI i v1 n1 v2 n2)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_fstI i v v1 v2)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_sndI i v v1 v2)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_concatI i v1 bv1 v2 bv2)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+next
+  case (eval_e_lenI i v bv)
+  then show ?case using  eval_v_weakening_x eval_e.intros  ce.fresh by metis
+qed
+
+lemma eval_c_weakening_x:
+  fixes c::c
+  assumes  "i' \<lbrakk> c \<rbrakk> ~ s" and "atom x \<sharp> c" and "i = i' (x \<mapsto> s')"
+  shows "i \<lbrakk> c \<rbrakk> ~ s"
+  using assms proof(induct rule: eval_c.induct)
+  case (eval_c_trueI i)
+  then show ?case using eval_c.intros by auto
+next
+  case (eval_c_falseI i)
+  then show ?case using eval_c.intros by auto
+next
+  case (eval_c_conjI i c1 b1 c2 b2)
+  then show ?case using eval_c.intros by auto
+next
+  case (eval_c_disjI i c1 b1 c2 b2)
+  then show ?case using eval_c.intros by auto
+next
+  case (eval_c_impI i c1 b1 c2 b2)
+  then show ?case using eval_c.intros by auto
+next
+  case (eval_c_notI i c b)
+  then show ?case using eval_c.intros by auto
+next
+  case (eval_c_eqI i e1 sv1 e2 sv2)
+  then show ?case using eval_e_weakening_x c.fresh eval_c.intros by metis
+qed
+
+lemma is_satis_weakening_x:
+  fixes c::c
+  assumes "i' \<Turnstile> c" and "atom x \<sharp> c" and "i = i' (x \<mapsto> s)"
+  shows "i \<Turnstile> c"
+  using eval_c_weakening_x assms is_satis.simps by simp
+
+lemma is_satis_g_weakening_x:
+  fixes G::\<Gamma>
+  assumes "i' \<Turnstile> G" and "atom x \<sharp> G" and "i = i' (x \<mapsto> s)"
+  shows "i \<Turnstile> G"
+  using assms proof(induct G rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  hence "atom x \<sharp> c'" using fresh_GCons fresh_prodN by simp
+  moreover hence "i \<Turnstile> c'"  using is_satis_weakening_x  is_satis_g.simps(2) GCons by metis
+  then show ?case using   is_satis_g.simps(2)[of i x' b' c' \<Gamma>'] GCons fresh_GCons by simp
+qed
+
+section \<open>Base Type Substitution\<close>
+
+text \<open>The idea of boxing is to take an smt val and its base type and at nodes in the smt val that correspond to type variables we
+wrap them in an SUt smt val node. Another way of looking at it is that s' where the node for the base type variable is an 'any node'.
+It is needed to prove subst\_b\_valid - the base-type variable substitution lemma for validity.
+
+The first @{text "rcl_val"} is the expanded form (has type with base-variables replaced with base-type terms)
+ ; the second is its corresponding form
+
+We only have one variable so we need to ensure that in all of the  @{text "bs_boxed_BVarI"} cases, the s has the same
+  base type.
+
+For example is an SMT value is (SPair (SInt 1) (SBool true)) and it has sort (BPair (BVar x) BBool)[x::=BInt] then 
+the boxed version is SPair (SUt (SInt 1)) (SBool true) and is has sort (BPair (BVar x) BBool). We need to do this 
+so that we can obtain from a valuation i, that gives values like the first smt value, to a valuation i' that gives values like
+the second.
+\<close>
+
+inductive  boxed_b :: "\<Theta> \<Rightarrow> rcl_val \<Rightarrow> b \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> rcl_val \<Rightarrow> bool"   ( " _  \<turnstile> _ ~ _ [ _ ::= _ ] \<setminus> _ " [50,50] 50) where    
+  boxed_b_BVar1I:  "\<lbrakk> bv = bv' ;  wfRCV P s b \<rbrakk> \<Longrightarrow> boxed_b P s (B_var bv') bv b (SUt s)"
+| boxed_b_BVar2I:  "\<lbrakk> bv \<noteq> bv'; wfRCV P s  (B_var bv')  \<rbrakk> \<Longrightarrow> boxed_b P s (B_var bv') bv b s"
+| boxed_b_BIntI:"wfRCV P s B_int \<Longrightarrow> boxed_b P s B_int _ _ s"
+| boxed_b_BBoolI:"wfRCV P s B_bool \<Longrightarrow> boxed_b P s B_bool _ _ s "
+| boxed_b_BUnitI:"wfRCV P s B_unit \<Longrightarrow> boxed_b P s B_unit _ _ s"
+| boxed_b_BPairI:"\<lbrakk> boxed_b P s1 b1 bv b s1' ; boxed_b P s2 b2 bv b s2' \<rbrakk> \<Longrightarrow> boxed_b P (SPair s1 s2) (B_pair b1 b2) bv b (SPair s1' s2')"
+
+| boxed_b_BConsI:"\<lbrakk>  
+      AF_typedef tyid dclist \<in> set P;
+      (dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist ;
+      boxed_b P s1 b bv b' s1'
+      \<rbrakk> \<Longrightarrow>  
+     boxed_b P (SCons tyid dc s1) (B_id tyid) bv b' (SCons tyid dc s1')"
+
+| boxed_b_BConspI:"\<lbrakk>  AF_typedef_poly tyid bva dclist \<in> set P;
+      atom bva \<sharp> (b1,bv,b',s1,s1');
+      (dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist ;
+      boxed_b P s1 (b[bva::=b1]\<^sub>b\<^sub>b) bv b' s1' 
+      \<rbrakk> \<Longrightarrow>  
+      boxed_b P (SConsp tyid dc b1[bv::=b']\<^sub>b\<^sub>b s1) (B_app tyid b1) bv b' (SConsp tyid dc b1 s1')"
+
+| boxed_b_Bbitvec: "wfRCV P s B_bitvec \<Longrightarrow> boxed_b P s B_bitvec bv b s"
+
+equivariance boxed_b 
+nominal_inductive boxed_b .
+
+inductive_cases boxed_b_elims:
+  "boxed_b P s (B_var bv) bv' b s'"
+  "boxed_b P s B_int bv b s'"
+  "boxed_b P s B_bool bv b s'"
+  "boxed_b P s B_unit bv b s'"
+  "boxed_b P s (B_pair b1 b2) bv b s'"
+  "boxed_b P s (B_id dc) bv b s'"
+  "boxed_b P s B_bitvec bv b s'"
+  "boxed_b P s (B_app dc b') bv b s'"
+
+lemma boxed_b_wfRCV:
+  assumes  "boxed_b P s b bv b' s'" (*and "supp s = {}"*) and "\<turnstile>\<^sub>w\<^sub>f P"
+  shows "wfRCV P s b[bv::=b']\<^sub>b\<^sub>b \<and> wfRCV P s' b"
+  using assms proof(induct rule: boxed_b.inducts)
+  case (boxed_b_BVar1I bv bv' P s b )
+  then show ?case using wfRCV.intros by auto
+next
+  case (boxed_b_BVar2I bv bv' P s )
+  then show ?case using wfRCV.intros   by auto
+next
+  case (boxed_b_BPairI P s1 b1 bv b s1' s2 b2 s2')
+  then show ?case using wfRCV.intros rcl_val.supp by simp
+next
+  case (boxed_b_BConsI tyid dclist P dc x b c s1 bv b' s1')
+  hence "supp b = {}" using wfTh_supp_b by metis
+  hence "b [ bv ::= b' ]\<^sub>b\<^sub>b = b" using fresh_def subst_b_b_def forget_subst[of "bv" b b'] by auto
+  hence " P  \<turnstile> SCons tyid dc s1 : (B_id tyid)" using  wfRCV.intros rcl_val.supp subst_bb.simps boxed_b_BConsI by metis
+  moreover have "P  \<turnstile> SCons tyid dc s1' : B_id tyid" using boxed_b_BConsI  
+    using  wfRCV.intros rcl_val.supp subst_bb.simps boxed_b_BConsI by metis
+  ultimately show ?case using subst_bb.simps by metis
+next
+  case (boxed_b_BConspI tyid bva dclist P b1 bv b' s1 s1' dc x b c)
+
+  obtain bva2 and dclist2 where *:"AF_typedef_poly tyid bva dclist = AF_typedef_poly tyid bva2 dclist2 \<and> 
+             atom bva2 \<sharp> (bv,(P, SConsp tyid dc b1[bv::=b']\<^sub>b\<^sub>b s1, B_app tyid b1[bv::=b']\<^sub>b\<^sub>b))" 
+    using  obtain_fresh_bv by metis
+
+  then obtain x2 and b2 and c2 where **:\<open>(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2\<close>  
+    using boxed_b_BConspI td_lookup_eq_iff type_def.eq_iff by metis
+
+  have  "P  \<turnstile> SConsp tyid dc b1[bv::=b']\<^sub>b\<^sub>b s1 : (B_app tyid b1[bv::=b']\<^sub>b\<^sub>b)" proof
+    show 1: \<open>AF_typedef_poly tyid bva2 dclist2 \<in> set P\<close> using boxed_b_BConspI * by auto
+    show 2: \<open>(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2\<close> using boxed_b_BConspI using ** by simp
+
+    hence "atom bv \<sharp> b2" proof -
+      have "supp b2 \<subseteq> { atom bva2 }" using wfTh_poly_supp_b 1 2 boxed_b_BConspI by auto
+      moreover have "bv \<noteq> bva2" using  * fresh_Pair fresh_at_base by metis
+      ultimately show  ?thesis  using fresh_def by force
+    qed
+    moreover have "b[bva::=b1]\<^sub>b\<^sub>b = b2[bva2::=b1]\<^sub>b\<^sub>b"  using wfTh_typedef_poly_b_eq_iff * 2 boxed_b_BConspI by metis
+    ultimately show \<open> P  \<turnstile> s1 : b2[bva2::=b1[bv::=b']\<^sub>b\<^sub>b]\<^sub>b\<^sub>b\<close> using boxed_b_BConspI subst_b_b_def subst_bb_commute by auto
+    show "atom bva2 \<sharp> (P, SConsp tyid dc b1[bv::=b']\<^sub>b\<^sub>b s1, B_app tyid b1[bv::=b']\<^sub>b\<^sub>b)" using * fresh_Pair by metis
+  qed
+
+  moreover have "P  \<turnstile> SConsp tyid dc b1 s1' : B_app tyid b1" proof
+    show \<open>AF_typedef_poly tyid bva dclist \<in> set P\<close> using boxed_b_BConspI by auto
+    show \<open>(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist\<close> using boxed_b_BConspI by auto
+    show \<open> P  \<turnstile> s1' : b[bva::=b1]\<^sub>b\<^sub>b\<close> using boxed_b_BConspI by auto
+    have "atom bva \<sharp> P" using boxed_b_BConspI wfTh_fresh by metis
+    thus  "atom bva \<sharp> (P, SConsp tyid dc b1 s1', B_app tyid b1)" using boxed_b_BConspI rcl_val.fresh b.fresh pure_fresh fresh_prodN by metis
+  qed
+
+  ultimately show ?case using subst_bb.simps  by simp
+qed(auto)+
+
+lemma subst_b_var:
+  assumes  "B_var bv2 = b[bv::=b']\<^sub>b\<^sub>b"
+  shows  "(b = B_var bv \<and> b' = B_var bv2) \<or> (b=B_var bv2 \<and> bv \<noteq> bv2)"
+  using assms by(nominal_induct b rule: b.strong_induct,auto+)
+
+text \<open>Here the valuation i' is the conv wrap version of i. For every x in G, i' x is the conv wrap version of i x.
+The next lemma for a clearer explanation of what this is. i produces values of sort b[bv::=b'] and i' produces values of sort b\<close>
+
+inductive boxed_i :: "\<Theta> \<Rightarrow> \<Gamma> \<Rightarrow> b \<Rightarrow> bv \<Rightarrow> valuation \<Rightarrow> valuation \<Rightarrow> bool"  ( " _  ; _ ; _ , _ \<turnstile> _ \<approx> _" [50,50] 50) where
+  boxed_i_GNilI:  "\<Theta> ; GNil ; b , bv  \<turnstile> i \<approx> i"
+| boxed_i_GConsI: "\<lbrakk> Some s = i x;  boxed_b \<Theta> s b bv b' s' ;  \<Theta> ; \<Gamma> ; b' , bv \<turnstile> i \<approx> i' \<rbrakk> \<Longrightarrow> \<Theta> ; ((x,b,c)#\<^sub>\<Gamma>\<Gamma>) ; b' , bv \<turnstile> i \<approx> (i'(x \<mapsto> s'))"
+equivariance boxed_i
+nominal_inductive boxed_i .
+
+inductive_cases boxed_i_elims:
+  "\<Theta> ;GNil ; b , bv \<turnstile> i \<approx> i'"
+  "\<Theta> ; ((x,b,c)#\<^sub>\<Gamma>\<Gamma>) ; b' , bv \<turnstile> i \<approx> i'"
+
+lemma wfRCV_poly_elims:
+  fixes tm::"'a::fs" and b::b
+  assumes "T  \<turnstile> SConsp typid dc bdc s : b" 
+  obtains bva dclist x1 b1 c1 where "b = B_app typid bdc \<and>
+    AF_typedef_poly typid bva dclist \<in> set T \<and> (dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist \<and>  T  \<turnstile> s : b1[bva::=bdc]\<^sub>b\<^sub>b \<and> atom bva \<sharp> tm" 
+  using assms proof(nominal_induct "SConsp typid dc bdc s" b avoiding: tm rule:wfRCV.strong_induct)
+  case (wfRCV_BConsPI bv dclist \<Theta> x b c)
+  then show ?case by simp
+qed
+
+lemma boxed_b_ex:
+  assumes "wfRCV T s b[bv::=b']\<^sub>b\<^sub>b" and "wfTh T"
+  shows "\<exists>s'. boxed_b T s b bv b' s'"
+  using assms proof(nominal_induct s arbitrary: b rule: rcl_val.strong_induct)
+  case (SBitvec x)
+  have *:"b[bv::=b']\<^sub>b\<^sub>b = B_bitvec" using wfRCV_elims(9)[OF SBitvec(1)] by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SBitvec x : B_bitvec" using wfRCV.intros by simp
+    moreover hence "b' = B_bitvec" using True SBitvec subst_bb.simps * by simp
+    ultimately show ?thesis using boxed_b.intros  wfRCV.intros by metis
+  next
+    case False
+    hence "b = B_bitvec" using subst_bb_inject *  by metis  
+    then show ?thesis using * SBitvec boxed_b.intros by metis
+  qed
+next
+  case (SNum x)
+  have *:"b[bv::=b']\<^sub>b\<^sub>b = B_int" using wfRCV_elims(10)[OF SNum(1)] by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SNum x : B_int" using wfRCV.intros by simp
+    moreover hence "b' = B_int" using True SNum subst_bb.simps(1) * by simp
+    ultimately show ?thesis using boxed_b_BVar1I  wfRCV.intros by metis
+  next
+    case False
+    hence "b = B_int" using subst_bb_inject(1) *  by metis  
+    then show ?thesis using * SNum boxed_b_BIntI by metis
+  qed
+next
+  case (SBool x)
+  have *:"b[bv::=b']\<^sub>b\<^sub>b = B_bool" using wfRCV_elims(11)[OF SBool(1)] by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SBool x : B_bool" using wfRCV.intros by simp
+    moreover hence "b' = B_bool" using True SBool subst_bb.simps * by simp
+    ultimately show ?thesis using boxed_b.intros  wfRCV.intros by metis
+  next
+    case False
+    hence "b = B_bool" using subst_bb_inject *  by metis  
+    then show ?thesis using * SBool boxed_b.intros by metis
+  qed
+next
+  case (SPair s1 s2)
+  then obtain b1 and b2 where *:"b[bv::=b']\<^sub>b\<^sub>b = B_pair b1 b2 \<and> wfRCV T s1 b1 \<and> wfRCV T s2 b2" using wfRCV_elims(12)  by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SPair s1 s2 : B_pair b1 b2" using wfRCV.intros * by simp
+    moreover hence "b' = B_pair b1 b2" using True SPair subst_bb.simps(1) * by simp
+    ultimately show ?thesis using boxed_b_BVar1I by metis
+  next
+    case False
+    then obtain b1' and b2' where "b = B_pair b1' b2' \<and> b1=b1'[bv::=b']\<^sub>b\<^sub>b \<and> b2=b2'[bv::=b']\<^sub>b\<^sub>b" using subst_bb_inject(5)[OF _ False ] * by metis
+    then show ?thesis using *  SPair boxed_b_BPairI by blast
+  qed
+next
+  case (SCons tyid dc s1)
+  have *:"b[bv::=b']\<^sub>b\<^sub>b = B_id tyid" using wfRCV_elims(13)[OF SCons(2)] by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SCons tyid dc s1 : B_id tyid" using wfRCV.intros 
+      using "local.*" SCons.prems by auto
+    moreover hence "b' =  B_id tyid" using True SCons subst_bb.simps(1) * by simp
+    ultimately show ?thesis using boxed_b_BVar1I  wfRCV.intros by metis
+  next
+    case False
+    then obtain b1' where beq: "b = B_id tyid" using subst_bb_inject *  by metis  
+    then obtain b2 dclist x c where **:"AF_typedef tyid dclist \<in> set T \<and> (dc, \<lbrace> x : b2  | c \<rbrace>) \<in> set dclist \<and> wfRCV T s1 b2" using wfRCV_elims(13)  * SCons by metis
+    then have "atom bv \<sharp> b2" using \<open>wfTh T\<close> wfTh_lookup_supp_empty[of tyid dclist T dc "\<lbrace> x : b2  | c \<rbrace>"] \<tau>.fresh fresh_def by auto
+    then have "b2 = b2[ bv ::= b']\<^sub>b\<^sub>b" using forget_subst subst_b_b_def by metis
+    then obtain s1' where s1:"T  \<turnstile> s1 ~ b2 [ bv ::= b' ] \<setminus> s1'" using SCons ** by metis
+
+    have "T  \<turnstile> SCons tyid dc s1 ~ (B_id tyid) [ bv ::= b' ] \<setminus> SCons tyid dc s1'" proof(rule boxed_b_BConsI)
+      show "AF_typedef tyid dclist \<in> set T" using ** by auto
+      show "(dc, \<lbrace> x : b2  | c \<rbrace>) \<in> set dclist" using ** by auto
+      show "T  \<turnstile> s1 ~ b2 [ bv ::= b' ] \<setminus> s1' " using s1 ** by auto
+
+    qed
+    thus ?thesis using beq by metis
+  qed
+next
+  case (SConsp typid dc bdc s)
+
+  obtain bva dclist x1 b1 c1 where **:"b[bv::=b']\<^sub>b\<^sub>b = B_app typid bdc \<and>
+    AF_typedef_poly typid bva dclist \<in> set T \<and> (dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist \<and>  T  \<turnstile> s : b1[bva::=bdc]\<^sub>b\<^sub>b \<and> atom bva \<sharp> bv"
+    using wfRCV_poly_elims[OF SConsp(2)]  by metis
+
+  then have *:"B_app typid bdc = b[bv::=b']\<^sub>b\<^sub>b" using wfRCV_elims(14)[OF SConsp(2)] by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SConsp typid dc bdc s  : B_app typid bdc" using wfRCV.intros 
+      using "local.*" SConsp.prems(1) by auto
+    moreover hence "b' = B_app typid bdc" using True SConsp subst_bb.simps * by simp
+    ultimately show ?thesis using boxed_b.intros  wfRCV.intros by metis
+  next
+    case False
+    then obtain bdc' where bdc: "b = B_app typid bdc' \<and> bdc = bdc'[bv::=b']\<^sub>b\<^sub>b" using * subst_bb_inject(8)[OF *] by metis
+        (*hence beq:"b = B_app typid bdc" using subst_bb_inject *  sory (* going to be like the above as bdc is closed *)*)
+    have "atom bv \<sharp> b1" proof -
+      have "supp b1 \<subseteq> { atom bva }" using wfTh_poly_supp_b ** SConsp by metis
+      moreover have "bv \<noteq> bva" using ** by auto
+      ultimately show ?thesis using fresh_def by force
+    qed      
+    have "T  \<turnstile> s : b1[bva::=bdc]\<^sub>b\<^sub>b" using ** by auto
+    moreover have "b1[bva::=bdc']\<^sub>b\<^sub>b[bv::=b']\<^sub>b\<^sub>b = b1[bva::=bdc]\<^sub>b\<^sub>b" using bdc subst_bb_commute \<open>atom bv \<sharp> b1\<close> by auto
+    ultimately  obtain s' where s':"T  \<turnstile> s ~ b1[bva::=bdc']\<^sub>b\<^sub>b [ bv ::= b' ] \<setminus> s'" 
+      using SConsp(1)[of "b1[bva::=bdc']\<^sub>b\<^sub>b"] bdc SConsp by metis
+    have "T  \<turnstile> SConsp typid dc bdc'[bv::=b']\<^sub>b\<^sub>b s ~ (B_app typid bdc') [ bv ::= b' ] \<setminus> SConsp typid dc bdc' s'" 
+    proof - 
+
+      obtain bva3 and dclist3 where 3:"AF_typedef_poly typid bva3 dclist3 =  AF_typedef_poly typid bva dclist \<and> 
+            atom bva3 \<sharp> (bdc', bv, b', s, s')" using obtain_fresh_bv  by metis
+      then obtain x3 b3 c3 where 4:"(dc, \<lbrace> x3 : b3  | c3 \<rbrace>) \<in> set dclist3" 
+        using boxed_b_BConspI td_lookup_eq_iff type_def.eq_iff 
+        by (metis "**")
+
+      show ?thesis proof
+        show \<open>AF_typedef_poly typid bva3 dclist3 \<in> set T\<close> using 3 ** by metis 
+        show \<open>atom bva3 \<sharp> (bdc', bv, b', s, s')\<close> using 3 by metis
+        show 4:\<open>(dc, \<lbrace> x3 : b3  | c3 \<rbrace>) \<in> set dclist3\<close> using 4 by auto
+        have "b3[bva3::=bdc']\<^sub>b\<^sub>b = b1[bva::=bdc']\<^sub>b\<^sub>b" proof(rule wfTh_typedef_poly_b_eq_iff)
+          show \<open>AF_typedef_poly typid bva3 dclist3 \<in> set T\<close> using 3 ** by metis
+          show \<open>(dc, \<lbrace> x3 : b3  | c3 \<rbrace>) \<in> set dclist3\<close> using 4 by auto
+          show \<open>AF_typedef_poly typid bva dclist \<in> set T\<close> using ** by auto
+          show \<open>(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist\<close> using ** by auto
+        qed(simp add: ** SConsp)
+        thus  \<open> T  \<turnstile> s ~ b3[bva3::=bdc']\<^sub>b\<^sub>b [ bv ::= b' ] \<setminus> s' \<close> using s' by auto
+      qed
+    qed
+    then show ?thesis using bdc by auto
+
+  qed
+next 
+  case SUnit
+  have *:"b[bv::=b']\<^sub>b\<^sub>b = B_unit" using wfRCV_elims SUnit by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    moreover have "T  \<turnstile> SUnit : B_unit" using wfRCV.intros by simp
+    moreover hence "b' = B_unit" using True SUnit subst_bb.simps * by simp
+    ultimately show ?thesis using boxed_b.intros  wfRCV.intros by metis
+  next
+    case False
+    hence "b = B_unit" using subst_bb_inject *  by metis  
+    then show ?thesis using * SUnit boxed_b.intros by metis
+  qed
+next
+  case (SUt x) 
+  then obtain bv' where *:"b[bv::=b']\<^sub>b\<^sub>b= B_var bv'" using wfRCV_elims by metis
+  show ?case proof (cases "b = B_var bv")
+    case True
+    then show ?thesis using boxed_b_BVar1I 
+      using "local.*" wfRCV_BVarI by fastforce
+  next
+    case False
+    then show ?thesis using boxed_b_BVar1I  boxed_b_BVar2I
+      using "local.*" wfRCV_BVarI    by (metis subst_b_var)
+  qed
+qed
+
+lemma boxed_i_ex:
+  assumes "wfI T \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i" and "wfTh T"
+  shows  "\<exists>i'. T ; \<Gamma> ; b , bv \<turnstile> i \<approx> i'"
+  using assms proof(induct \<Gamma> arbitrary: i rule:\<Gamma>_induct)
+  case GNil
+  then show ?case using boxed_i_GNilI by metis
+next
+  case (GCons x' b' c' \<Gamma>')
+  then obtain s where 1:"Some s = i x' \<and> wfRCV T s b'[bv::=b]\<^sub>b\<^sub>b" using wfI_def subst_gb.simps by auto
+  then obtain s' where 2: "boxed_b T s b' bv b s'" using boxed_b_ex GCons by metis
+  then obtain i' where 3: "boxed_i T \<Gamma>' b bv i  i'" using GCons wfI_def subst_gb.simps by force
+  have "boxed_i T ((x', b', c') #\<^sub>\<Gamma> \<Gamma>') b bv i  (i'(x' \<mapsto> s'))" proof
+    show "Some s = i x'" using 1 by auto
+    show "boxed_b T s b' bv b s'" using 2 by auto
+    show "T  ; \<Gamma>' ; b , bv \<turnstile> i \<approx> i'"  using  "3" by auto
+  qed
+  thus ?case by auto
+qed
+
+lemma  boxed_b_eq:
+  assumes "boxed_b \<Theta> s1 b bv b' s1'" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "wfTh \<Theta> \<Longrightarrow> boxed_b \<Theta> s2 b bv b' s2' \<Longrightarrow> ( s1 = s2 ) = ( s1' = s2' )"
+  using assms proof(induct arbitrary: s2 s2'  rule: boxed_b.inducts )
+  case (boxed_b_BVar1I bv bv'  P s b )  
+  then show ?case 
+    using boxed_b_elims(1) rcl_val.eq_iff by metis
+next
+  case (boxed_b_BVar2I bv bv' P s b)
+  then show ?case using boxed_b_elims(1) by metis
+next
+  case (boxed_b_BIntI P s uu uv)
+  hence "s2 = s2'" using boxed_b_elims by metis
+  then show ?case by auto
+next
+  case (boxed_b_BBoolI P s uw ux)
+  hence "s2 = s2'" using boxed_b_elims by metis
+  then show ?case by auto
+next
+  case (boxed_b_BUnitI P s uy uz)
+  hence "s2 = s2'" using boxed_b_elims by metis
+  then show ?case by auto
+next
+  case (boxed_b_BPairI P s1 b1 bv b s1' s2a b2 s2a')
+  then show ?case
+    by (metis boxed_b_elims(5) rcl_val.eq_iff(4))
+next
+  case (boxed_b_BConsI tyid dclist P dc x b c s1 bv b' s1')
+  obtain s22 and s22' dclist2 dc2 x2 b2 c2 where *:"s2 = SCons tyid dc2 s22 \<and> s2' = SCons tyid dc2 s22' \<and> boxed_b P s22 b2 bv b' s22' 
+      \<and> AF_typedef tyid dclist2 \<in> set P \<and> (dc2, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" using boxed_b_elims(6)[OF boxed_b_BConsI(6)] by metis
+  show ?case proof(cases "dc = dc2")
+    case True
+    hence "b = b2"  using wfTh_ctor_unique \<tau>.eq_iff wfTh_dclist_unique wf boxed_b_BConsI * by metis
+    then show ?thesis using boxed_b_BConsI True * by auto
+  next
+    case False
+    then show ?thesis using * boxed_b_BConsI by simp
+  qed      
+next
+  case (boxed_b_Bbitvec P s bv b)
+  hence "s2 = s2'" using boxed_b_elims by metis
+  then show ?case by auto
+next
+  case (boxed_b_BConspI tyid bva dclist P b1 bv b' s1 s1' dc x b c)
+  obtain bva2 s22  s22' dclist2 dc2 x2 b2 c2 where *:"
+     s2 = SConsp tyid dc2 b1[bv::=b']\<^sub>b\<^sub>b s22 \<and> 
+     s2' = SConsp tyid dc2 b1 s22' \<and> 
+     boxed_b P s22 b2[bva2::=b1]\<^sub>b\<^sub>b  bv b' s22'  \<and> 
+     AF_typedef_poly tyid bva2 dclist2 \<in> set P \<and> (dc2, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" using boxed_b_elims(8)[OF boxed_b_BConspI(7)] by metis
+  show ?case proof(cases "dc = dc2")
+    case True
+    hence "AF_typedef_poly tyid bva2 dclist2 \<in> set P \<and> (dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" using * by auto
+    hence "b[bva::=b1]\<^sub>b\<^sub>b = b2[bva2::=b1]\<^sub>b\<^sub>b"  using wfTh_typedef_poly_b_eq_iff[OF boxed_b_BConspI(1) boxed_b_BConspI(3)] * boxed_b_BConspI by metis
+    then show ?thesis using boxed_b_BConspI True * by auto
+  next
+    case False
+    then show ?thesis using * boxed_b_BConspI by simp
+  qed    
+qed
+
+lemma bs_boxed_var:
+  assumes "boxed_i \<Theta> \<Gamma> b' bv i i'"
+  shows "Some (b,c) = lookup \<Gamma> x \<Longrightarrow> Some s = i x \<Longrightarrow> Some s' = i' x \<Longrightarrow> boxed_b \<Theta> s b bv b' s'"
+  using assms proof(induct rule: boxed_i.inducts)
+  case (boxed_i_GNilI T i)
+  then show ?case using lookup.simps by auto
+next
+  case (boxed_i_GConsI s i x1 \<Theta> b1 bv b' s'  \<Gamma> i' c)
+  show ?case proof (cases "x=x1")
+    case True
+    then show ?thesis using boxed_i_GConsI
+        fun_upd_same lookup.simps(2) option.inject prod.inject by metis
+  next
+    case False
+    then show ?thesis using boxed_i_GConsI
+        fun_upd_same lookup.simps option.inject prod.inject by auto
+  qed
+qed
+
+lemma eval_l_boxed_b:
+  assumes  "\<lbrakk> l \<rbrakk> = s"
+  shows   "boxed_b \<Theta> s (base_for_lit l) bv b' s"
+  using assms proof(nominal_induct l arbitrary: s  rule:l.strong_induct)
+qed(auto simp add:  boxed_b.intros wfRCV.intros )+
+
+lemma boxed_i_eval_v_boxed_b:
+  fixes v::v
+  assumes "boxed_i \<Theta> \<Gamma> b' bv i i'" and "i \<lbrakk> v[bv::=b']\<^sub>v\<^sub>b \<rbrakk> ~  s" and  "i' \<lbrakk> v \<rbrakk> ~ s'" and "wfV \<Theta> B \<Gamma> v b"  and "wfI \<Theta>  \<Gamma> i'"
+  shows "boxed_b \<Theta> s b bv b' s'"
+  using assms proof(nominal_induct v arbitrary: s s' b  rule:v.strong_induct)
+  case (V_lit l)
+  hence "\<lbrakk> l \<rbrakk> = s \<and> \<lbrakk> l \<rbrakk> = s'" using eval_v_elims by auto
+  moreover have "b = base_for_lit l" using wfV_elims(2) V_lit  by metis
+  ultimately show ?case using V_lit using  eval_l_boxed_b subst_b_base_for_lit by metis
+next
+  case (V_var x)   (* look at defn of bs_boxed *)
+  hence "Some s = i x \<and> Some s' = i' x" using eval_v_elims subst_vb.simps  by metis
+  moreover obtain c1  where bc:"Some (b,c1) = lookup \<Gamma> x" using wfV_elims V_var by metis
+  ultimately show ?case using bs_boxed_var V_var by metis
+
+next
+  case (V_pair v1 v2)
+  then obtain b1 and b2 where b:"b=B_pair b1 b2" using wfV_elims subst_vb.simps  by metis
+  obtain s1 and s2 where s: "eval_v i (v1[bv::=b']\<^sub>v\<^sub>b) s1 \<and> eval_v i (v2[bv::=b']\<^sub>v\<^sub>b) s2 \<and> s = SPair s1 s2" using eval_v_elims V_pair subst_vb.simps by metis
+  obtain s1' and s2' where s': "eval_v i' v1 s1' \<and> eval_v i' v2 s2' \<and> s' = SPair s1' s2'" using eval_v_elims V_pair  by metis
+  have  "boxed_b  \<Theta> (SPair s1 s2) (B_pair b1 b2)  bv b' (SPair s1' s2') " proof(rule boxed_b_BPairI)
+    show "boxed_b \<Theta> s1 b1 bv b' s1'" using V_pair eval_v_elims wfV_elims b s s' b.eq_iff by metis
+    show "boxed_b \<Theta> s2 b2 bv b' s2'" using V_pair eval_v_elims wfV_elims b s s' b.eq_iff by metis
+  qed
+  then show ?case using s s' b by auto
+next
+  case (V_cons tyid dc v1)
+
+  obtain dclist x b1 c where *: "b = B_id tyid \<and> AF_typedef tyid dclist \<in> set \<Theta> \<and> (dc, \<lbrace> x : b1  | c \<rbrace>) \<in> set dclist \<and>  \<Theta> ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b1"
+    using wfV_elims(4)[OF V_cons(5)] V_cons by metis
+  obtain s2 where s2: "s = SCons tyid dc s2 \<and>  i \<lbrakk> (v1[bv::=b']\<^sub>v\<^sub>b) \<rbrakk> ~ s2" using eval_v_elims V_cons subst_vb.simps by metis
+  obtain s2' where s2': "s' = SCons tyid dc s2' \<and>  i' \<lbrakk> v1 \<rbrakk> ~ s2'" using eval_v_elims V_cons by metis
+  have sp: "supp \<lbrace> x : b1  | c \<rbrace> = {}" using wfTh_lookup_supp_empty * wfX_wfY by metis
+
+  have "boxed_b \<Theta> (SCons tyid dc s2) (B_id tyid) bv b' (SCons tyid dc s2')"
+  proof(rule boxed_b_BConsI)
+    show 1:"AF_typedef tyid dclist \<in> set \<Theta>" using * by auto
+    show 2:"(dc, \<lbrace> x : b1  | c \<rbrace>) \<in> set dclist" using * by auto
+    have bvf:"atom bv \<sharp> b1" using sp  \<tau>.fresh fresh_def by auto    
+    show "\<Theta>  \<turnstile> s2 ~ b1 [ bv ::= b' ] \<setminus> s2'" using V_cons s2 s2' * by metis
+  qed
+  then show ?case using * s2 s2' by simp
+next
+  case (V_consp tyid dc b1 v1)
+
+  obtain bv2 dclist x2 b2 c2 where *: "b = B_app tyid b1 \<and> AF_typedef_poly tyid bv2 dclist \<in> set \<Theta> \<and> 
+       (dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist \<and>  \<Theta> ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b2[bv2::=b1]\<^sub>b\<^sub>b"
+    using wf_strong_elim(1)[OF V_consp (5)] by metis
+
+  obtain s2 where s2: "s = SConsp tyid dc b1[bv::=b']\<^sub>b\<^sub>b s2 \<and>  i \<lbrakk> (v1[bv::=b']\<^sub>v\<^sub>b) \<rbrakk> ~ s2" 
+    using eval_v_elims V_consp subst_vb.simps by metis
+
+  obtain s2' where s2': "s' = SConsp tyid dc b1 s2' \<and>  i' \<lbrakk> v1 \<rbrakk> ~ s2'" 
+    using eval_v_elims V_consp by metis
+
+  have "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using V_consp wfX_wfY by metis
+  then obtain bv3::bv and dclist3 x3 b3 c3 where **:" AF_typedef_poly tyid bv2 dclist =  AF_typedef_poly tyid bv3 dclist3 \<and>
+        (dc, \<lbrace> x3 : b3  | c3 \<rbrace>) \<in> set dclist3 \<and> atom bv3 \<sharp> (b1, bv, b', s2, s2') \<and> b2[bv2::=b1]\<^sub>b\<^sub>b = b3[bv3::=b1]\<^sub>b\<^sub>b"
+    using * obtain_fresh_bv_dclist_b_iff[where tm="(b1, bv, b', s2, s2')"] by metis
+
+  have "boxed_b \<Theta> (SConsp tyid dc b1[bv::=b']\<^sub>b\<^sub>b s2) (B_app tyid b1) bv b' (SConsp tyid dc b1 s2')"
+  proof(rule boxed_b_BConspI[of tyid bv3 dclist3 \<Theta>, where x=x3 and b=b3 and c=c3])
+    show 1:"AF_typedef_poly tyid bv3 dclist3 \<in> set \<Theta>" using * ** by auto
+    show 2:"(dc, \<lbrace> x3 : b3  | c3 \<rbrace>) \<in> set dclist3" using ** by auto
+    show "atom bv3 \<sharp> (b1, bv, b', s2, s2')" using ** by auto  
+    show " \<Theta>  \<turnstile> s2 ~ b3[bv3::=b1]\<^sub>b\<^sub>b [ bv ::= b' ] \<setminus> s2'" using V_consp s2 s2' * ** by metis
+  qed
+  then show ?case using * s2 s2' by simp
+qed
+
+lemma boxed_b_eq_eq:
+  assumes  "boxed_b \<Theta> n1 b1 bv b' n1'" and "boxed_b \<Theta> n2 b1 bv b' n2'" and "s = SBool (n1 = n2)" and  "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+    "s' = SBool (n1' = n2')"
+  shows  "s=s'" 
+  using boxed_b_eq assms by auto
+
+lemma boxed_i_eval_ce_boxed_b:
+  fixes e::ce
+  assumes "i' \<lbrakk> e \<rbrakk> ~  s'" and "i \<lbrakk> e[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ s" and "wfCE \<Theta> B \<Gamma> e b" and "boxed_i \<Theta> \<Gamma> b' bv i i'" and "wfI \<Theta> \<Gamma> i'"
+  shows "boxed_b \<Theta> s b bv b' s'"
+  using assms proof(nominal_induct e arbitrary: s s' b b' rule: ce.strong_induct)
+  case (CE_val x)
+  then show ?case using boxed_i_eval_v_boxed_b eval_e_elims wfCE_elims subst_ceb.simps by metis
+next
+  case (CE_op opp v1 v2)
+
+  show ?case proof(rule opp.exhaust)
+    assume \<open>opp = Plus\<close>
+    have 1:"wfCE \<Theta> B \<Gamma> v1 (B_int)" using wfCE_elims CE_op  \<open>opp = Plus\<close>  by metis
+    have 2:"wfCE \<Theta> B \<Gamma> v2 (B_int)" using wfCE_elims CE_op  \<open>opp = Plus\<close> by metis
+    have *:"b = B_int" using CE_op wfCE_elims 
+      by (metis \<open>opp = plus\<close>)
+
+    obtain n1 and n2 where n:"s = SNum (n1 + n2) \<and> i \<lbrakk> v1[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SNum n1 \<and> i \<lbrakk> v2[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SNum n2" using eval_e_elims CE_op subst_ceb.simps \<open>opp = plus\<close>  by metis
+    obtain n1' and n2' where n':"s' = SNum (n1' + n2') \<and> i' \<lbrakk> v1 \<rbrakk> ~ SNum n1' \<and> i' \<lbrakk> v2 \<rbrakk> ~ SNum n2'" using eval_e_elims Plus CE_op \<open>opp = plus\<close> by metis
+
+    have "boxed_b \<Theta> (SNum n1) B_int bv b' (SNum n1')" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op \<open>opp = plus\<close> by metis
+    moreover have "boxed_b \<Theta> (SNum n2) B_int bv b' (SNum n2')" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op by metis
+    ultimately have "s=s'" using n' n boxed_b_elims(2)
+      by (metis rcl_val.eq_iff(2))
+    thus ?thesis using  * n n' boxed_b_BIntI CE_op wfRCV.intros Plus by simp
+  next
+    assume \<open>opp = LEq\<close>
+    have 1:"wfCE \<Theta> B \<Gamma> v1 (B_int)" using wfCE_elims CE_op  \<open>opp = LEq\<close>  by metis
+    have 2:"wfCE \<Theta> B \<Gamma> v2 (B_int)" using wfCE_elims CE_op  \<open>opp = LEq\<close> by metis
+    hence *:"b = B_bool" using CE_op wfCE_elims \<open>opp = LEq\<close>   by metis
+    obtain n1 and n2 where n:"s = SBool (n1 \<le> n2) \<and> i \<lbrakk> v1[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SNum n1 \<and> i \<lbrakk> v2[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SNum n2" using eval_e_elims subst_ceb.simps CE_op \<open>opp = LEq\<close> by metis
+    obtain n1' and n2' where n':"s' = SBool (n1' \<le> n2') \<and> i' \<lbrakk> v1 \<rbrakk> ~ SNum n1' \<and> i' \<lbrakk> v2 \<rbrakk> ~ SNum n2'" using eval_e_elims CE_op \<open>opp = LEq\<close>  by metis
+
+    have "boxed_b \<Theta> (SNum n1) B_int bv b' (SNum n1')" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op by metis
+    moreover have "boxed_b \<Theta> (SNum n2) B_int bv b' (SNum n2')" using boxed_i_eval_v_boxed_b 1 2 n n' CE_op by metis
+    ultimately have "s=s'" using n' n boxed_b_elims(2)
+      by (metis rcl_val.eq_iff(2))
+    thus ?thesis using  * n n' boxed_b_BBoolI CE_op wfRCV.intros \<open>opp = LEq\<close> by simp
+  next
+    assume \<open>opp = Eq\<close>
+    obtain b1 where b1:"wfCE \<Theta> B \<Gamma> v1 b1 \<and> wfCE \<Theta> B \<Gamma> v2 b1" using wfCE_elims CE_op  \<open>opp = Eq\<close>  by metis
+
+    hence *:"b = B_bool" using CE_op wfCE_elims \<open>opp = Eq\<close>   by metis
+    obtain n1 and n2 where n:"s = SBool (n1 = n2) \<and> i \<lbrakk> v1[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ n1 \<and> i \<lbrakk> v2[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ n2" using eval_e_elims subst_ceb.simps CE_op \<open>opp = Eq\<close> by metis
+    obtain n1' and n2' where n':"s' = SBool (n1' = n2') \<and> i' \<lbrakk> v1 \<rbrakk> ~ n1' \<and> i' \<lbrakk> v2 \<rbrakk> ~ n2'" using eval_e_elims CE_op \<open>opp = Eq\<close>  by metis
+
+    have "boxed_b \<Theta> n1 b1 bv b' n1'" using boxed_i_eval_v_boxed_b b1  n n' CE_op by metis
+    moreover have "boxed_b \<Theta> n2 b1 bv b' n2'" using boxed_i_eval_v_boxed_b b1  n n' CE_op by metis
+    moreover have "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using b1 wfX_wfY by metis
+    ultimately have "s=s'" using n' n boxed_b_elims
+        boxed_b_eq_eq by metis
+    thus ?thesis using  * n n' boxed_b_BBoolI CE_op wfRCV.intros \<open>opp = Eq\<close> by simp
+  qed
+
+next
+  case (CE_concat v1 v2)
+
+  obtain bv1 and bv2 where s : "s = SBitvec (bv1 @ bv2) \<and> (i \<lbrakk> v1[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SBitvec bv1)  \<and> i \<lbrakk> v2[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SBitvec bv2"
+    using eval_e_elims(7) subst_ceb.simps CE_concat.prems(2) eval_e_elims(6) subst_ceb.simps(6) by metis
+  obtain bv1' and bv2' where s' : "s' = SBitvec (bv1' @ bv2') \<and> i' \<lbrakk> v1 \<rbrakk> ~ SBitvec bv1'  \<and> i' \<lbrakk> v2 \<rbrakk> ~ SBitvec bv2'"
+    using eval_e_elims(7) CE_concat by metis
+
+  then show ?case using boxed_i_eval_v_boxed_b wfCE_elims s s' CE_concat   
+    by (metis CE_concat.prems(3) assms assms(5) wfRCV_BBitvecI boxed_b_Bbitvec boxed_b_elims(7) eval_e_concatI eval_e_uniqueness)
+next
+  case (CE_fst ce)
+  obtain  s2 where 1:"i \<lbrakk> ce[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SPair s s2" using CE_fst eval_e_elims subst_ceb.simps by metis
+  obtain  s2' where 2:"i' \<lbrakk> ce \<rbrakk> ~ SPair s' s2'" using CE_fst eval_e_elims by metis
+  obtain b2 where 3:"wfCE \<Theta> B \<Gamma> ce (B_pair b b2)" using wfCE_elims(4) CE_fst by metis
+
+  have "boxed_b \<Theta> (SPair s s2) (B_pair b b2) bv b' (SPair s' s2')" 
+    using 1 2 3 CE_fst boxed_i_eval_v_boxed_b boxed_b_BPairI by auto
+  thus ?case using boxed_b_elims(5) by force
+next
+  case (CE_snd v)
+  obtain s1  where 1:"i \<lbrakk> v[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SPair s1 s" using CE_snd eval_e_elims subst_ceb.simps by metis
+  obtain s1' where 2:"i' \<lbrakk> v \<rbrakk> ~ SPair s1' s'" using CE_snd eval_e_elims by metis
+  obtain b1 where 3:"wfCE \<Theta> B \<Gamma> v (B_pair b1 b )" using wfCE_elims(5) CE_snd by metis
+
+  have "boxed_b \<Theta> (SPair s1 s ) (B_pair b1 b ) bv b' (SPair s1' s')" using 1 2 3 CE_snd boxed_i_eval_v_boxed_b by simp
+  thus ?case using boxed_b_elims(5) by force
+next
+  case (CE_len v)
+  obtain s1 where s: "i \<lbrakk> v[bv::=b']\<^sub>c\<^sub>e\<^sub>b \<rbrakk> ~ SBitvec s1" using CE_len eval_e_elims subst_ceb.simps by metis
+  obtain s1' where s': "i' \<lbrakk> v \<rbrakk> ~ SBitvec s1'" using CE_len eval_e_elims by metis
+
+  have "\<Theta> ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_bitvec \<and> b = B_int"  using wfCE_elims CE_len by metis
+  then show ?case using boxed_i_eval_v_boxed_b s s' CE_len 
+    by (metis boxed_b_BIntI boxed_b_elims(7) eval_e_lenI eval_e_uniqueness subst_ceb.simps(5) wfI_wfCE_eval_e)
+qed
+
+lemma eval_c_eq_bs_boxed:
+  fixes c::c
+  assumes "i \<lbrakk> c[bv::=b]\<^sub>c\<^sub>b \<rbrakk> ~ s" and "i' \<lbrakk> c \<rbrakk> ~ s'" and "wfC \<Theta> B \<Gamma> c" and "wfI \<Theta> \<Gamma> i'" and "\<Theta> ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> i "
+    and "boxed_i \<Theta> \<Gamma> b bv i i'"
+  shows "s = s'"
+  using assms proof(nominal_induct c arbitrary: s s'  rule:c.strong_induct)
+  case C_true
+  then show ?case using eval_c_elims subst_cb.simps by metis
+next
+  case C_false
+  then show ?case using eval_c_elims  subst_cb.simps by metis
+next
+  case (C_conj c1 c2)
+  obtain s1 and s2 where 1: "eval_c i (c1[bv::=b]\<^sub>c\<^sub>b) s1 \<and> eval_c i (c2[bv::=b]\<^sub>c\<^sub>b) s2 \<and> s = (s1\<and>s2)" using C_conj eval_c_elims(3) subst_cb.simps(3) by metis
+  obtain s1' and s2' where 2:"eval_c i' c1 s1' \<and> eval_c i' c2 s2' \<and> s' = (s1'\<and>s2')" using C_conj eval_c_elims(3) by metis
+  then show ?case using 1 2 wfC_elims C_conj by metis
+next
+  case (C_disj c1 c2)
+
+  obtain s1 and s2 where 1: "eval_c i (c1[bv::=b]\<^sub>c\<^sub>b) s1 \<and> eval_c i (c2[bv::=b]\<^sub>c\<^sub>b) s2 \<and> s = (s1\<or>s2)" using C_disj eval_c_elims(4) subst_cb.simps(4) by metis
+  obtain s1' and s2' where 2:"eval_c i' c1 s1' \<and> eval_c i' c2 s2' \<and> s' = (s1'\<or>s2')" using C_disj eval_c_elims(4) by metis
+  then show ?case using 1 2 wfC_elims C_disj by metis
+next
+  case (C_not c)
+  obtain s1::bool  where 1: "(i \<lbrakk> c[bv::=b]\<^sub>c\<^sub>b \<rbrakk> ~ s1) \<and> (s = (\<not> s1))" using  C_not eval_c_elims(6) subst_cb.simps(7)  by metis
+  obtain s1'::bool where 2: "(i' \<lbrakk> c \<rbrakk> ~ s1') \<and> (s' = (\<not> s1'))" using C_not eval_c_elims(6) by metis
+  then show ?case using 1 2 wfC_elims C_not by metis
+next
+  case (C_imp c1 c2)
+  obtain s1 and s2 where 1: "eval_c i (c1[bv::=b]\<^sub>c\<^sub>b) s1 \<and> eval_c i (c2[bv::=b]\<^sub>c\<^sub>b) s2 \<and> s = (s1 \<longrightarrow> s2)" using C_imp eval_c_elims(5) subst_cb.simps(5) by metis
+  obtain s1' and s2' where 2:"eval_c i' c1 s1' \<and> eval_c i' c2 s2' \<and> s' = (s1' \<longrightarrow> s2')" using C_imp eval_c_elims(5) by metis
+  then show ?case using 1 2 wfC_elims C_imp by metis
+next
+  case (C_eq e1 e2)
+  obtain be where be: "wfCE \<Theta> B \<Gamma> e1 be \<and> wfCE \<Theta> B \<Gamma> e2 be" using C_eq wfC_elims by metis
+  obtain s1 and s2 where 1: "eval_e i (e1[bv::=b]\<^sub>c\<^sub>e\<^sub>b) s1 \<and> eval_e i (e2[bv::=b]\<^sub>c\<^sub>e\<^sub>b) s2 \<and> s = (s1 = s2)" using C_eq eval_c_elims(7) subst_cb.simps(6) by metis
+  obtain s1' and s2' where 2:"eval_e i' e1 s1' \<and> eval_e i' e2 s2' \<and> s' = (s1' = s2' )" using C_eq eval_c_elims(7) by metis
+  have "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using C_eq wfX_wfY by metis
+  moreover have "\<Theta> ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile> i " using C_eq by auto
+  ultimately show ?case using boxed_b_eq[of \<Theta> s1 be bv b s1' s2 s2'] 1 2 boxed_i_eval_ce_boxed_b  C_eq wfC_elims subst_cb.simps 1 2 be by auto
+qed
+
+lemma is_satis_bs_boxed:
+  fixes c::c
+  assumes  "boxed_i \<Theta> \<Gamma> b bv i i'" and "wfC \<Theta> B \<Gamma> c" and "wfI \<Theta> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i" and "\<Theta> ; \<Gamma> \<turnstile> i'"
+    and  "(i \<Turnstile> c[bv::=b]\<^sub>c\<^sub>b)"
+  shows "(i' \<Turnstile> c)"
+proof -
+  have "eval_c i (c[bv::=b]\<^sub>c\<^sub>b) True" using is_satis.simps assms by auto
+  moreover obtain s where "i' \<lbrakk> c \<rbrakk> ~ s" using eval_c_exist assms by metis
+  ultimately show ?thesis using eval_c_eq_bs_boxed assms is_satis.simps by metis
+qed
+
+lemma is_satis_bs_boxed_rev:
+  fixes c::c
+  assumes  "boxed_i \<Theta> \<Gamma> b bv i i'" and "wfC \<Theta> B \<Gamma> c" and "wfI \<Theta> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i" and "\<Theta> ; \<Gamma> \<turnstile> i'" and  "wfC \<Theta> {||} \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b (c[bv::=b]\<^sub>c\<^sub>b)"
+    and  "(i' \<Turnstile> c)"
+  shows "(i \<Turnstile> c[bv::=b]\<^sub>c\<^sub>b)"
+proof -
+  have "eval_c i' c True" using is_satis.simps assms by auto
+  moreover obtain s where "i \<lbrakk> c[bv::=b]\<^sub>c\<^sub>b \<rbrakk> ~ s" using eval_c_exist assms by metis
+  ultimately show ?thesis using eval_c_eq_bs_boxed assms is_satis.simps by metis
+qed
+
+lemma bs_boxed_wfi_aux:
+  fixes b::b and bv::bv and \<Theta>::\<Theta> and B::\<B>
+  assumes   "boxed_i \<Theta> \<Gamma> b bv i i'" and "wfI \<Theta> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>" and "wfG \<Theta> B  \<Gamma>"
+  shows "\<Theta> ; \<Gamma> \<turnstile> i'"
+  using assms proof(induct rule: boxed_i.inducts)
+  case (boxed_i_GNilI T i)
+  then show ?case using wfI_def by auto
+next
+  case (boxed_i_GConsI s i x1 T b1 bv b s' G i' c1)
+  {
+    fix x2 b2 c2
+    assume as : "(x2,b2,c2) \<in> toSet ((x1, b1, c1) #\<^sub>\<Gamma> G)"
+
+    then consider (hd) "(x2,b2,c2) = (x1, b1, c1)" | (tail) "(x2,b2,c2) \<in> toSet G" using toSet.simps by auto
+    hence "\<exists>s. Some s = (i'(x1 \<mapsto> s')) x2 \<and> wfRCV T s b2" proof(cases)
+      case hd
+      hence "b1=b2" by auto
+      moreover have "(x2,b2[bv::=b]\<^sub>b\<^sub>b,c2[bv::=b]\<^sub>c\<^sub>b) \<in> toSet ((x1, b1, c1) #\<^sub>\<Gamma> G)[bv::=b]\<^sub>\<Gamma>\<^sub>b"  using hd subst_gb.simps by simp
+      moreover hence "wfRCV T s b2[bv::=b]\<^sub>b\<^sub>b" using wfI_def boxed_i_GConsI hd
+      proof -
+        obtain ss :: "b \<Rightarrow> x \<Rightarrow> (x \<Rightarrow> rcl_val option) \<Rightarrow> type_def list \<Rightarrow> rcl_val" where
+          "\<forall>x1a x2a x3 x4. (\<exists>v5. Some v5 = x3 x2a \<and> wfRCV x4 v5 x1a) = (Some (ss x1a x2a x3 x4) = x3 x2a \<and> wfRCV x4 (ss x1a x2a x3 x4) x1a)"
+          by moura (* 0.0 ms *)
+        then have f1: "Some (ss b2[bv::=b]\<^sub>b\<^sub>b x1 i T) = i x1 \<and> wfRCV T (ss b2[bv::=b]\<^sub>b\<^sub>b x1 i T) b2[bv::=b]\<^sub>b\<^sub>b"
+          using boxed_i_GConsI.prems(1) hd wfI_def by auto (* 31 ms *)
+        then have "ss b2[bv::=b]\<^sub>b\<^sub>b x1 i T = s"
+          by (metis (no_types) boxed_i_GConsI.hyps(1) option.inject) (* 0.0 ms *)
+        then show ?thesis
+          using f1 by blast (* 0.0 ms *)
+      qed
+      ultimately have "wfRCV T s' b2" using boxed_i_GConsI boxed_b_wfRCV by metis
+
+      then show ?thesis using hd by simp
+    next
+      case tail
+      hence "wfI T G i'" using boxed_i_GConsI wfI_suffix wfG_suffix subst_gb.simps
+        by (metis (no_types, lifting) Un_iff toSet.simps(2) wfG_cons2 wfI_def)
+      then show ?thesis using wfI_def[of T G i'] tail
+        using boxed_i_GConsI.prems(3) split_G wfG_cons_fresh2 by fastforce
+    qed
+  }
+  thus ?case using wfI_def by fast
+
+qed
+
+lemma is_satis_g_bs_boxed_aux:
+  fixes G::\<Gamma>
+  assumes  "boxed_i \<Theta> G1 b bv i i'" and "wfI \<Theta> G1[bv::=b]\<^sub>\<Gamma>\<^sub>b i" and "wfI \<Theta> G1 i'"  and "G1 = (G2@G)" and  "wfG \<Theta> B G1"
+    and "(i \<Turnstile> G[bv::=b]\<^sub>\<Gamma>\<^sub>b) "
+  shows  "(i' \<Turnstile> G)"
+  using assms proof(induct G arbitrary: G2 rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>' G2)
+  show ?case proof(subst is_satis_g.simps,rule)
+    have *:"wfC \<Theta> B G1 c'" using GCons wfG_wfC_inside by force
+    show "i' \<Turnstile> c'" using is_satis_bs_boxed[OF assms(1) * ] GCons by auto
+    obtain G3 where "G1 = G3 @ \<Gamma>'" using GCons append_g.simps
+      by (metis append_g_assoc)
+    then show "i' \<Turnstile> \<Gamma>'" using GCons append_g.simps by simp
+  qed
+qed
+
+lemma is_satis_g_bs_boxed:
+  fixes G::\<Gamma>
+  assumes  "boxed_i \<Theta> G b bv i i'" and "wfI \<Theta> G[bv::=b]\<^sub>\<Gamma>\<^sub>b i" and "wfI \<Theta> G i'"  and "wfG \<Theta> B G"
+    and "(i \<Turnstile> G[bv::=b]\<^sub>\<Gamma>\<^sub>b) "
+  shows  "(i' \<Turnstile> G)"
+  using is_satis_g_bs_boxed_aux assms
+  by (metis (full_types) append_g.simps(1))
+
+lemma subst_b_valid:
+  fixes s::s and b::b
+  assumes "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b"  and "B = {|bv|}" and "\<Theta> ; {|bv|} ;\<Gamma>  \<Turnstile> c"
+  shows "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<Turnstile> c[bv::=b]\<^sub>c\<^sub>b "
+proof(rule validI)
+
+  show **:"\<Theta> ; {||} ;  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f c[bv::=b]\<^sub>c\<^sub>b " using assms valid.simps wf_b_subst subst_gb.simps by metis
+  show "\<forall>i. (wfI \<Theta>  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i \<and> i \<Turnstile> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b) \<longrightarrow> i \<Turnstile> c[bv::=b]\<^sub>c\<^sub>b "
+  proof(rule,rule)
+    fix i
+    assume *:"wfI \<Theta>  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i \<and> i \<Turnstile> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b"
+
+    obtain i' where idash: "boxed_i \<Theta> \<Gamma> b bv i i'" using boxed_i_ex wfX_wfY assms * by fastforce
+
+    have wfc: "\<Theta> ; {|bv|} ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c" using valid.simps assms by simp
+    have wfg: "\<Theta> ; {|bv|} \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using valid.simps wfX_wfY assms by metis
+    hence wfi: "wfI \<Theta> \<Gamma> i'" using idash * bs_boxed_wfi_aux subst_gb.simps wfX_wfY by metis
+    moreover have "i' \<Turnstile>  \<Gamma>" proof (rule is_satis_g_bs_boxed[OF idash ] wfX_wfY(2)[OF wfc])
+      show "wfI \<Theta> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b i" using subst_gb.simps * by simp
+      show "wfI \<Theta> \<Gamma> i'" using wfi by auto
+      show "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f \<Gamma> " using wfg assms by auto
+      show "i \<Turnstile> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using subst_gb.simps * by simp
+    qed
+    ultimately have ic:"i' \<Turnstile> c" using assms valid_def   using valid.simps by blast
+
+    show  "i \<Turnstile> c[bv::=b]\<^sub>c\<^sub>b" proof(rule is_satis_bs_boxed_rev)
+      show "\<Theta>  ; \<Gamma> ; b , bv \<turnstile> i \<approx> i'" using idash by auto
+      show "\<Theta> ; B ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c " using wfc assms by auto
+      show "\<Theta> ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile> i" using subst_gb.simps * by simp
+      show "\<Theta> ; \<Gamma> \<turnstile> i'" using wfi by auto
+      show "\<Theta> ; {||} ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f c[bv::=b]\<^sub>c\<^sub>b " using ** by auto
+      show "i' \<Turnstile> c" using ic by auto
+    qed
+
+  qed
+qed
+
+section \<open>Expression Operator Lemmas\<close>
+
+lemma is_satis_len_imp:
+  assumes "i \<Turnstile> (CE_val (V_var x)  ==  CE_val (V_lit (L_num (int (length v)))) )" (is "is_satis i ?c1")
+  shows "i \<Turnstile> (CE_val (V_var x)  ==  CE_len [V_lit (L_bitvec v)]\<^sup>c\<^sup>e)"
+proof -
+  have *:"eval_c i ?c1 True" using assms is_satis.simps by blast
+  then have  "eval_e i (CE_val (V_lit (L_num (int (length v))))) (SNum (int (length v)))"
+    using eval_e_elims(1) eval_v_elims eval_l.simps  by (metis eval_e.intros(1) eval_v_litI)
+  hence "eval_e i (CE_val (V_var x)) (SNum (int (length v)))" using eval_c_elims(7)[OF *]
+    by (metis eval_e_elims(1) eval_v_elims(1))
+  moreover have "eval_e i (CE_len [V_lit (L_bitvec v)]\<^sup>c\<^sup>e) (SNum (int (length v)))"
+    using eval_e_elims(7) eval_v_elims eval_l.simps  by (metis eval_e.intros eval_v_litI)
+  ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce
+qed
+
+lemma is_satis_plus_imp:
+  assumes "i \<Turnstile> (CE_val (V_var x) ==  CE_val (V_lit (L_num (n1+n2))))" (is "is_satis i ?c1")
+  shows   "i \<Turnstile> (CE_val (V_var x)  ==  CE_op Plus ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e))"
+proof -
+  have *:"eval_c i ?c1 True" using assms is_satis.simps by blast
+  then have  "eval_e i (CE_val (V_lit (L_num (n1+n2)))) (SNum (n1+n2))"
+    using eval_e_elims(1) eval_v_elims eval_l.simps  by (metis eval_e.intros(1) eval_v_litI)
+  hence "eval_e i (CE_val (V_var x)) (SNum (n1+n2))" using eval_c_elims(7)[OF *]
+    by (metis eval_e_elims(1) eval_v_elims(1))
+  moreover have "eval_e i (CE_op Plus ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e)) (SNum (n1+n2))"
+    using eval_e_elims(7) eval_v_elims eval_l.simps  by (metis eval_e.intros eval_v_litI)
+  ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce
+qed
+
+lemma is_satis_leq_imp:
+  assumes "i \<Turnstile> (CE_val (V_var x) ==  CE_val (V_lit (if (n1 \<le> n2) then L_true else L_false)))" (is "is_satis i ?c1")
+  shows   "i \<Turnstile> (CE_val (V_var x)  ==  CE_op LEq [(V_lit (L_num n1))]\<^sup>c\<^sup>e [(V_lit (L_num n2))]\<^sup>c\<^sup>e)"
+proof -
+  have *:"eval_c i ?c1 True" using assms is_satis.simps by blast
+  then have  "eval_e i (CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false)))) (SBool (n1\<le>n2))"
+    using eval_e_elims(1) eval_v_elims eval_l.simps
+    by (metis (full_types) eval_e.intros(1) eval_v_litI)
+  hence "eval_e i (CE_val (V_var x)) (SBool (n1\<le>n2))" using eval_c_elims(7)[OF *]
+    by (metis eval_e_elims(1) eval_v_elims(1))
+  moreover have "eval_e i (CE_op LEq [(V_lit (L_num n1))]\<^sup>c\<^sup>e [(V_lit (L_num n2) )]\<^sup>c\<^sup>e) (SBool (n1\<le>n2))"
+    using eval_e_elims(3) eval_v_elims eval_l.simps  by (metis eval_e.intros eval_v_litI)
+  ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce
+qed
+
+lemma eval_lit_inj:
+  fixes n1::l and n2::l
+  assumes "\<lbrakk> n1  \<rbrakk> = s" and "\<lbrakk> n2 \<rbrakk> = s" 
+  shows "n1=n2" 
+  using assms proof(nominal_induct s rule: rcl_val.strong_induct)
+  case (SBitvec x)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case (SNum x)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case (SBool x)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case (SPair x1a x2a)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case (SCons x1a x2a x3a)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case (SConsp x1a x2a x3a x4)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case SUnit
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+next
+  case (SUt x)
+  then show ?case using eval_l.simps 
+    by (metis l.strong_exhaust rcl_val.distinct rcl_val.eq_iff)
+qed
+
+lemma eval_e_lit_inj:
+  fixes n1::l and n2::l
+  assumes "i \<lbrakk> [ [ n1 ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s" and "i \<lbrakk> [ [ n2 ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s" 
+  shows "n1=n2" 
+  using eval_lit_inj assms eval_e_elims eval_v_elims by metis
+
+lemma is_satis_eq_imp:
+  assumes "i \<Turnstile> (CE_val (V_var x) ==  CE_val (V_lit (if (n1 =  n2) then L_true else L_false)))" (is "is_satis i ?c1")
+  shows   "i \<Turnstile> (CE_val (V_var x)  ==  CE_op Eq [(V_lit (n1))]\<^sup>c\<^sup>e [(V_lit (n2))]\<^sup>c\<^sup>e)"
+proof -
+  have *:"eval_c i ?c1 True" using assms is_satis.simps by blast
+  then have  "eval_e i (CE_val (V_lit ((if (n1=n2) then L_true else L_false)))) (SBool (n1=n2))"
+    using eval_e_elims(1) eval_v_elims eval_l.simps
+    by (metis (full_types) eval_e.intros(1) eval_v_litI)
+  hence "eval_e i (CE_val (V_var x)) (SBool (n1=n2))" using eval_c_elims(7)[OF *]
+    by (metis eval_e_elims(1) eval_v_elims(1))
+  moreover have "eval_e i (CE_op Eq [(V_lit (n1))]\<^sup>c\<^sup>e [(V_lit (n2) )]\<^sup>c\<^sup>e) (SBool (n1=n2))"
+  proof -
+    obtain s1 and s2 where *:"i \<lbrakk> [ [ n1 ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s1  \<and> i \<lbrakk> [ [ n2 ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s2" using eval_l.simps eval_e.intros eval_v_litI by metis
+    moreover have " SBool (n1 = n2)  =  SBool (s1 = s2)" proof(cases "n1=n2")
+      case True
+      then show ?thesis using * 
+        by (simp add: calculation eval_e_uniqueness)
+    next
+      case False
+      then show ?thesis using *  eval_e_lit_inj by auto
+    qed
+    ultimately show ?thesis using eval_e_eqI[of i "[(V_lit (n1))]\<^sup>c\<^sup>e"  s1 "[(V_lit (n2))]\<^sup>c\<^sup>e" s2 ] by auto
+  qed
+  ultimately show ?thesis using eval_c.intros is_satis.simps by fastforce
+qed
+
+lemma valid_eq_e:
+  assumes "\<forall>i s1 s2. wfG P \<B> GNil \<and> wfI P GNil i \<and> eval_e i e1 s1 \<and> eval_e i e2 s2 \<longrightarrow> s1 = s2"   
+    and "wfCE P  \<B> GNil e1 b" and "wfCE P \<B> GNil e2 b" 
+  shows "P ; \<B> ; (x, b , CE_val (V_var x)  ==  e1 )#\<^sub>\<Gamma> GNil \<Turnstile>  CE_val (V_var x)  ==  e2"
+  unfolding valid.simps
+proof(intro conjI)
+  show \<open> P ; \<B> ; (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e1 ) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e2  \<close> 
+    using assms wf_intros wfX_wfY  b.eq_iff fresh_GNil wfC_e_eq2 wfV_elims  by meson
+  show \<open>\<forall>i.  ((P ; (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e1 ) #\<^sub>\<Gamma> GNil \<turnstile> i) \<and>  (i \<Turnstile> (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e1 ) #\<^sub>\<Gamma> GNil)  \<longrightarrow>
+             (i \<Turnstile> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e2)) \<close> proof(rule+)
+    fix i
+    assume as:"P ; (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e1 ) #\<^sub>\<Gamma> GNil \<turnstile> i \<and>  i \<Turnstile> (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e1 ) #\<^sub>\<Gamma> GNil"
+
+    have *: "P ; GNil \<turnstile> i " using wfI_def by auto
+
+    then obtain s1 where s1:"eval_e i e1 s1" using assms eval_e_exist  by metis
+    obtain s2 where s2:"eval_e i e2 s2" using assms eval_e_exist  * by metis
+    moreover have "i x = Some s1" proof -
+      have "i \<Turnstile> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e1" using as is_satis_g.simps by auto
+      thus ?thesis using s1 
+        by (metis eval_c_elims(7) eval_e_elims(1) eval_e_uniqueness eval_v_elims(2) is_satis.cases)
+    qed
+    moreover have "s1 = s2" using s1 s2 * assms wfG_nilI wfX_wfY by metis
+
+    ultimately show "i \<lbrakk> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  e2  \<rbrakk> ~ True" 
+      using eval_c.intros eval_e.intros eval_v.intros 
+    proof -
+      have "i \<lbrakk> e2 \<rbrakk> ~ s1"
+        by (metis \<open>s1 = s2\<close> s2) (* 0.0 ms *)
+      then show ?thesis
+        by (metis (full_types) \<open>i x = Some s1\<close> eval_c_eqI eval_e_valI eval_v_varI) (* 31 ms *)
+    qed
+  qed
+qed
+
+lemma valid_len:
+  assumes " \<turnstile>\<^sub>w\<^sub>f \<Theta>" 
+  shows  "\<Theta> ; \<B> ; (x, B_int, [[x]\<^sup>v]\<^sup>c\<^sup>e  ==  [[ L_num (int (length v)) ]\<^sup>v]\<^sup>c\<^sup>e) #\<^sub>\<Gamma> GNil  \<Turnstile> [[x]\<^sup>v]\<^sup>c\<^sup>e  ==  CE_len [[ L_bitvec v ]\<^sup>v]\<^sup>c\<^sup>e"  (is "\<Theta> ; \<B> ; ?G \<Turnstile> ?c" )
+proof - 
+  have *:"\<Theta>  \<turnstile>\<^sub>w\<^sub>f ([]::\<Phi>)  \<and>  \<Theta> ; \<B> ; GNil  \<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta> " using assms wfG_nilI wfD_emptyI wfPhi_emptyI by auto
+
+  moreover  hence "\<Theta>  ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit (L_num (int (length v)))) : B_int" 
+    using wfCE_valI * wfV_litI base_for_lit.simps 
+    by (metis wfE_valI wfX_wfY)
+
+  moreover have "\<Theta>  ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e : B_int"       
+    using wfE_valI * wfV_litI base_for_lit.simps  wfE_valI wfX_wfY wfCE_valI
+    by (metis wfCE_lenI)
+  moreover have "atom x \<sharp> GNil" by auto
+  ultimately have "\<Theta> ; \<B> ; ?G \<turnstile>\<^sub>w\<^sub>f ?c" using wfC_e_eq2 assms by simp
+  moreover have "(\<forall>i. wfI \<Theta> ?G i \<and> is_satis_g i ?G \<longrightarrow> is_satis i ?c)" using is_satis_len_imp by auto
+  ultimately show ?thesis using valid.simps by auto
+qed
+
+lemma valid_arith_bop:
+  assumes "wfG \<Theta> \<B>  \<Gamma>" and "opp = Plus \<and> ll = (L_num (n1+n2)) \<or> (opp = LEq \<and> ll = ( if n1\<le>n2 then L_true else L_false))"  
+    and "(opp = Plus \<longrightarrow> b = B_int) \<and> (opp = LEq \<longrightarrow> b = B_bool)" and
+    "atom x \<sharp> \<Gamma>" 
+  shows   "\<Theta>; \<B> ; (x, b, (CE_val (V_var x)  ==  CE_val (V_lit (ll)) )) #\<^sub>\<Gamma> \<Gamma>  
+                          \<Turnstile> (CE_val (V_var x)  ==  CE_op opp ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e ))" (is "\<Theta> ; \<B> ; ?G \<Turnstile> ?c")
+proof -
+  have "wfC \<Theta> \<B> ?G ?c" proof(rule wfC_e_eq2)
+    show "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit ll) : b" using wfCE_valI wfV_litI assms base_for_lit.simps by metis
+    show "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op opp ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e) : b " 
+      using wfCE_plusI wfCE_leqI   wfCE_eqI wfV_litI wfCE_valI base_for_lit.simps assms  by metis
+    show "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using assms wfX_wfY by auto 
+    show "atom x \<sharp> \<Gamma>" using assms by auto
+  qed
+
+  moreover have "\<forall>i. wfI \<Theta> ?G i \<and> is_satis_g i ?G \<longrightarrow> is_satis i ?c" proof(rule allI , rule impI)
+    fix i
+    assume "wfI \<Theta> ?G i \<and> is_satis_g i ?G" 
+
+    hence "is_satis i  ((CE_val (V_var x)  ==  CE_val (V_lit (ll)) ))"   by auto
+    thus  "is_satis i ((CE_val (V_var x)  ==  CE_op opp ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e)))" 
+      using is_satis_plus_imp assms opp.exhaust is_satis_leq_imp by auto
+  qed
+  ultimately show ?thesis using valid.simps by metis
+qed
+
+lemma valid_eq_bop:
+  assumes "wfG \<Theta> \<B>  \<Gamma>" and  "atom x \<sharp> \<Gamma>"  and  "base_for_lit l1 = base_for_lit l2"
+  shows   "\<Theta>; \<B> ; (x, B_bool, (CE_val (V_var x)  ==  CE_val (V_lit (if l1 = l2 then L_true else L_false)) )) #\<^sub>\<Gamma> \<Gamma>  
+                          \<Turnstile> (CE_val (V_var x)  ==  CE_op Eq ([V_lit (l1)]\<^sup>c\<^sup>e) ([V_lit (l2)]\<^sup>c\<^sup>e ))" (is "\<Theta> ; \<B> ; ?G \<Turnstile> ?c")
+proof -
+  let ?ll = "(if l1 = l2 then L_true else L_false)"
+  have "wfC \<Theta> \<B> ?G ?c" proof(rule wfC_e_eq2)
+    show "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit ?ll) : B_bool" using wfCE_valI wfV_litI assms base_for_lit.simps by metis
+    show "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op Eq ([V_lit (l1)]\<^sup>c\<^sup>e) ([V_lit (l2)]\<^sup>c\<^sup>e) : B_bool " 
+      using wfCE_eqI wfCE_leqI   wfCE_eqI wfV_litI wfCE_valI base_for_lit.simps assms by metis
+    show "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using assms wfX_wfY by auto 
+    show "atom x \<sharp> \<Gamma>" using assms by auto
+  qed
+
+  moreover have "\<forall>i. wfI \<Theta> ?G i \<and> is_satis_g i ?G \<longrightarrow> is_satis i ?c" proof(rule allI , rule impI)
+    fix i
+    assume "wfI \<Theta> ?G i \<and> is_satis_g i ?G" 
+
+    hence "is_satis i  ((CE_val (V_var x)  ==  CE_val (V_lit (?ll)) ))"   by auto
+    thus  "is_satis i ((CE_val (V_var x)  ==  CE_op Eq ([V_lit (l1)]\<^sup>c\<^sup>e) ([V_lit (l2)]\<^sup>c\<^sup>e)))" 
+      using is_satis_eq_imp assms  by auto
+  qed
+  ultimately show ?thesis using valid.simps by metis
+qed
+
+lemma valid_fst:
+  fixes x::x and v\<^sub>1::v and v\<^sub>2::v
+  assumes   "wfTh \<Theta>" and "wfV \<Theta> \<B> GNil (V_pair v\<^sub>1 v\<^sub>2) (B_pair b\<^sub>1 b\<^sub>2)"
+  shows "\<Theta> ; \<B> ; (x, b\<^sub>1, [[x]\<^sup>v]\<^sup>c\<^sup>e  ==  [v\<^sub>1]\<^sup>c\<^sup>e) #\<^sub>\<Gamma> GNil  \<Turnstile> [[x]\<^sup>v]\<^sup>c\<^sup>e  ==  [#1[[v\<^sub>1,v\<^sub>2]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e" 
+proof(rule valid_eq_e)
+  show \<open>\<forall>i s1 s2.  (\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f GNil)  \<and>  (\<Theta> ; GNil \<turnstile> i) \<and> (i \<lbrakk> [ v\<^sub>1 ]\<^sup>c\<^sup>e \<rbrakk> ~ s1)  \<and> (i \<lbrakk> [#1[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrakk> ~ s2)  \<longrightarrow> s1 = s2\<close> 
+  proof(rule+)
+    fix i s1 s2 
+    assume as:"\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f GNil  \<and>  \<Theta> ; GNil \<turnstile> i \<and> (i \<lbrakk> [ v\<^sub>1 ]\<^sup>c\<^sup>e \<rbrakk> ~ s1)  \<and> (i \<lbrakk> [#1[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrakk> ~ s2)"
+    then obtain s2' where *:"i \<lbrakk> [ v\<^sub>1 , v\<^sub>2 ]\<^sup>v \<rbrakk> ~ SPair s2 s2'" 
+      using eval_e_elims(5)[of i "[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e" s2] eval_e_elims 
+      by meson
+    then have " i \<lbrakk> v\<^sub>1 \<rbrakk> ~ s2" using eval_v_elims(3)[OF *] by auto
+    then show "s1 = s2" using eval_v_uniqueness as 
+      using eval_e_uniqueness eval_e_valI by blast
+  qed
+
+  show \<open>  \<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f [ v\<^sub>1 ]\<^sup>c\<^sup>e : b\<^sub>1 \<close> using assms 
+    by (metis b.eq_iff(4) wfV_elims(3) wfV_wfCE)
+  show \<open>  \<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f [#1[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e : b\<^sub>1 \<close> using assms using wfCE_fstI 
+    using wfCE_valI by blast
+qed
+
+lemma valid_snd: 
+  fixes x::x and v\<^sub>1::v and v\<^sub>2::v
+  assumes   "wfTh \<Theta>" and "wfV \<Theta> \<B> GNil (V_pair v\<^sub>1 v\<^sub>2) (B_pair b\<^sub>1 b\<^sub>2)"
+  shows "\<Theta> ; \<B> ; (x, b\<^sub>2, [[x]\<^sup>v]\<^sup>c\<^sup>e  ==  [v\<^sub>2]\<^sup>c\<^sup>e) #\<^sub>\<Gamma> GNil  \<Turnstile> [[x]\<^sup>v]\<^sup>c\<^sup>e  ==  [#2[[v\<^sub>1,v\<^sub>2]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e" 
+proof(rule valid_eq_e)
+  show \<open>\<forall>i s1 s2.  (\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f GNil)  \<and>  (\<Theta> ; GNil \<turnstile> i) \<and> (i \<lbrakk> [ v\<^sub>2 ]\<^sup>c\<^sup>e \<rbrakk> ~ s1)  \<and> 
+(i \<lbrakk> [#2[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrakk> ~ s2)  \<longrightarrow> s1 = s2\<close> 
+  proof(rule+)
+    fix i s1 s2 
+    assume as:"\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f GNil  \<and>  \<Theta> ; GNil \<turnstile> i \<and> (i \<lbrakk> [ v\<^sub>2 ]\<^sup>c\<^sup>e \<rbrakk> ~ s1)  \<and> (i \<lbrakk> [#2[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrakk> ~ s2)"
+    then obtain s2' where *:"i \<lbrakk> [ v\<^sub>1 , v\<^sub>2 ]\<^sup>v \<rbrakk> ~ SPair s2' s2" 
+      using eval_e_elims(5)[of i "[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e" s2] eval_e_elims 
+      by meson
+    then have " i \<lbrakk> v\<^sub>2 \<rbrakk> ~ s2" using eval_v_elims(3)[OF *] by auto
+    then show "s1 = s2" using eval_v_uniqueness as 
+      using eval_e_uniqueness eval_e_valI by blast
+  qed
+
+  show \<open>  \<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f [ v\<^sub>2 ]\<^sup>c\<^sup>e : b\<^sub>2 \<close> using assms 
+    by (metis b.eq_iff wfV_elims wfV_wfCE)
+  show \<open>  \<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f [#2[[ v\<^sub>1 , v\<^sub>2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e : b\<^sub>2 \<close> using assms using wfCE_sndI wfCE_valI by blast
+qed
+
+lemma valid_concat:
+  fixes v1::"bit list" and v2::"bit list"
+  assumes " \<turnstile>\<^sub>w\<^sub>f \<Pi>" 
+  shows "\<Pi> ; \<B> ; (x, B_bitvec, (CE_val (V_var x)  ==  CE_val (V_lit (L_bitvec (v1@ v2))))) #\<^sub>\<Gamma> GNil \<Turnstile>
+            (CE_val (V_var x)  ==  CE_concat ([V_lit (L_bitvec v1)]\<^sup>c\<^sup>e ) ([V_lit (L_bitvec v2)]\<^sup>c\<^sup>e) )"
+proof(rule valid_eq_e)                         
+  show \<open>\<forall>i s1 s2.  ((\<Pi> ; \<B>  \<turnstile>\<^sub>w\<^sub>f GNil)  \<and>  (\<Pi> ; GNil \<turnstile> i) \<and> 
+            (i \<lbrakk> [ [ L_bitvec (v1 @ v2) ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s1)  \<and> (i \<lbrakk> [[[ L_bitvec v1 ]\<^sup>v]\<^sup>c\<^sup>e  @@ [[ L_bitvec v2 ]\<^sup>v]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrakk> ~ s2)  \<longrightarrow>
+           s1 = s2)\<close> 
+  proof(rule+)
+    fix i s1 s2 
+    assume as: "(\<Pi> ; \<B>  \<turnstile>\<^sub>w\<^sub>f GNil)  \<and>  (\<Pi> ; GNil \<turnstile> i) \<and> (i \<lbrakk> [ [ L_bitvec (v1 @ v2) ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s1)  \<and> 
+            (i \<lbrakk> [[[ L_bitvec v1 ]\<^sup>v]\<^sup>c\<^sup>e @@ [[ L_bitvec v2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e  \<rbrakk> ~ s2) "
+
+    hence *: "i \<lbrakk> [[[ L_bitvec v1 ]\<^sup>v]\<^sup>c\<^sup>e @@ [[ L_bitvec v2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e  \<rbrakk> ~ s2"  by auto
+    obtain bv1 bv2 where s2:"s2 = SBitvec (bv1 @ bv2) \<and> i \<lbrakk> [ L_bitvec v1 ]\<^sup>v \<rbrakk> ~ SBitvec bv1  \<and> (i \<lbrakk> [ L_bitvec v2 ]\<^sup>v \<rbrakk> ~ SBitvec bv2)" 
+      using eval_e_elims(7)[OF *] eval_e_elims(1) by metis
+    hence "v1 = bv1 \<and> v2 = bv2" using eval_v_elims(1) eval_l.simps(5) by force
+    moreover then have "s1 = SBitvec  (bv1 @ bv2)" using s2 using eval_v_elims(1) eval_l.simps(5) 
+      by (metis as eval_e_elims(1))
+
+    then show "s1 = s2" using s2 by auto
+  qed  
+
+  show \<open>  \<Pi> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f [ [ L_bitvec (v1 @ v2) ]\<^sup>v ]\<^sup>c\<^sup>e : B_bitvec \<close> 
+    by (metis assms base_for_lit.simps(5) wfG_nilI wfV_litI wfV_wfCE)
+  show \<open>  \<Pi> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f [[[ L_bitvec v1 ]\<^sup>v]\<^sup>c\<^sup>e @@ [[ L_bitvec v2 ]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e  : B_bitvec \<close> 
+    by (metis assms base_for_lit.simps(5) wfCE_concatI wfG_nilI wfV_litI wfCE_valI)
+qed
+
+lemma valid_ce_eq:
+  fixes ce::ce
+  assumes  "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b"
+  shows \<open>\<Theta> ; \<B> ; \<Gamma>  \<Turnstile> ce  ==  ce \<close>
+  unfolding valid.simps proof 
+  show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f ce  ==  ce  \<close> using assms wfC_eqI by auto
+  show \<open>\<forall>i.  \<Theta> ; \<Gamma> \<turnstile> i \<and>  i \<Turnstile> \<Gamma>  \<longrightarrow>  i \<Turnstile> ce  ==  ce  \<close> proof(rule+)
+    fix i
+    assume "\<Theta> ; \<Gamma> \<turnstile> i \<and>  i \<Turnstile> \<Gamma>"
+    then obtain s where "i\<lbrakk> ce \<rbrakk> ~ s" using assms eval_e_exist by metis
+    then show "i \<lbrakk> ce  ==  ce  \<rbrakk> ~ True " using eval_c_eqI by metis
+  qed
+qed
+
+lemma valid_eq_imp:
+  fixes c1::c and c2::c
+  assumes " \<Theta> ; \<B> ; (x, b, c2) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c1 IMP c2"
+  shows  " \<Theta> ; \<B> ; (x, b, c2) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile>  c1   IMP  c2 "
+proof -
+  have "\<forall>i.  (\<Theta> ; (x, b, c2) #\<^sub>\<Gamma> \<Gamma> \<turnstile> i \<and>  i \<Turnstile> (x, b, c2) #\<^sub>\<Gamma> \<Gamma>)  \<longrightarrow>  i \<Turnstile> ( c1  IMP  c2 )"
+  proof(rule,rule)
+    fix i
+    assume as:"\<Theta> ; (x, b, c2) #\<^sub>\<Gamma> \<Gamma> \<turnstile> i \<and>  i \<Turnstile> (x, b, c2) #\<^sub>\<Gamma> \<Gamma>"
+
+    have "\<Theta> ; \<B> ; (x, b, c2) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c1" using wfC_elims assms by metis
+
+    then obtain sc where "i \<lbrakk> c1 \<rbrakk> ~ sc" using eval_c_exist assms as by metis
+    moreover have  "i \<lbrakk> c2 \<rbrakk> ~ True" using as is_satis_g.simps is_satis.simps by auto
+
+    ultimately have "i \<lbrakk> c1  IMP  c2 \<rbrakk> ~ True" using eval_c_impI by metis
+
+    thus  "i \<Turnstile> c1  IMP  c2" using is_satis.simps by auto
+  qed
+  thus ?thesis using assms by auto
+qed
+
+lemma valid_range:
+  assumes "0 \<le> n \<and> n \<le> m" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta> ; {||} ; (x, B_int  , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\<^sub>\<Gamma>  GNil \<Turnstile> 
+                              (C_eq (CE_op LEq (CE_val (V_var x)) (CE_val (V_lit (L_num m))))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e) AND
+                             (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x)))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)"
+    (is "\<Theta> ; {||} ; ?G \<Turnstile> ?c1 AND ?c2")
+proof(rule validI)
+  have wfg: " \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f (x, B_int, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil " 
+    using assms base_for_lit.simps wfG_nilI wfV_litI fresh_GNil wfB_intI wfC_v_eq wfG_cons1I wfG_cons2I by metis
+
+  show "\<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f ?c1 AND ?c2" 
+    using wfC_conjI wfC_eqI wfCE_leqI wfCE_valI wfV_varI wfg lookup.simps base_for_lit.simps wfV_litI wfB_intI wfB_boolI 
+    by metis
+
+  show "\<forall>i.  \<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G  \<longrightarrow> i \<Turnstile> ?c1 AND ?c2" proof(rule,rule)
+    fix i
+    assume a:"\<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G"
+    hence *:"i \<lbrakk> V_var x \<rbrakk> ~ SNum n" 
+    proof - 
+      obtain sv where sv: "i x = Some sv \<and> \<Theta> \<turnstile> sv : B_int" using a wfI_def by force
+      have "i \<lbrakk>  (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n)))) \<rbrakk> ~ True" 
+        using a is_satis_g.simps 
+        using is_satis.cases by blast
+      hence "i x = Some(SNum n)" using sv 
+        by (metis eval_c_elims(7) eval_e_elims(1) eval_l.simps(3) eval_v_elims(1) eval_v_elims(2))
+      thus ?thesis using eval_v_varI by auto
+    qed
+
+    show "i \<Turnstile> ?c1 AND ?c2" 
+    proof - 
+      have "i \<lbrakk> ?c1 \<rbrakk> ~ True" 
+      proof -
+        have "i \<lbrakk> [ leq [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e [ [ L_num m ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e\<rbrakk> ~ SBool True" 
+          using eval_e_leqI assms eval_v_litI eval_l.simps * 
+          by (metis (full_types) eval_e_valI)
+        moreover have "i \<lbrakk>  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk> ~ SBool True" 
+          using eval_v_litI eval_e_valI eval_l.simps by metis
+        ultimately show ?thesis using  eval_c_eqI by metis
+      qed
+
+      moreover have "i \<lbrakk> ?c2 \<rbrakk> ~ True" 
+      proof -
+        have "i \<lbrakk> [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrakk> ~ SBool True"
+          using eval_e_leqI assms eval_v_litI eval_l.simps * 
+          by (metis (full_types) eval_e_valI)
+        moreover have "i \<lbrakk>  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk> ~ SBool True" 
+          using eval_v_litI eval_e_valI eval_l.simps by metis
+        ultimately show ?thesis using  eval_c_eqI by metis
+      qed      
+      ultimately show ?thesis using eval_c_conjI is_satis.simps by metis
+    qed
+  qed
+qed
+
+lemma valid_range_length:
+  fixes \<Gamma>::\<Gamma>
+  assumes "0 \<le> n \<and> n \<le> int (length v)" and " \<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom x \<sharp> \<Gamma>"
+  shows "\<Theta> ; {||} ; (x, B_int  , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\<^sub>\<Gamma>  \<Gamma> \<Turnstile> 
+                     (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x)))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e) AND  
+                     (C_eq (CE_op LEq (CE_val (V_var x)) ([| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)
+                            "
+    (is "\<Theta> ; {||} ; ?G \<Turnstile> ?c1 AND ?c2")
+proof(rule validI)
+  have wfg: " \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f (x, B_int, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> \<Gamma> " apply(rule  wfG_cons1I)
+    apply simp
+    using assms apply simp+
+    using assms base_for_lit.simps wfG_nilI wfV_litI  wfB_intI wfC_v_eq  wfB_intI wfX_wfY assms by metis+
+
+  show "\<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f ?c1 AND ?c2" 
+    using wfC_conjI wfC_eqI wfCE_leqI wfCE_valI wfV_varI wfg lookup.simps base_for_lit.simps wfV_litI wfB_intI wfB_boolI     
+    by (metis (full_types) wfCE_lenI)
+
+  show "\<forall>i.  \<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G  \<longrightarrow> i \<Turnstile> ?c1 AND ?c2" proof(rule,rule)
+    fix i
+    assume a:"\<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G"
+    hence *:"i \<lbrakk> V_var x \<rbrakk> ~ SNum n" 
+    proof - 
+      obtain sv where sv: "i x = Some sv \<and> \<Theta> \<turnstile> sv : B_int" using a wfI_def by force
+      have "i \<lbrakk>  (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n)))) \<rbrakk> ~ True" 
+        using a is_satis_g.simps 
+        using is_satis.cases by blast
+      hence "i x = Some(SNum n)" using sv 
+        by (metis eval_c_elims(7) eval_e_elims(1) eval_l.simps(3) eval_v_elims(1) eval_v_elims(2))
+      thus ?thesis using eval_v_varI by auto
+    qed
+
+    show "i \<Turnstile> ?c1 AND ?c2" 
+    proof - 
+      have "i \<lbrakk> ?c2 \<rbrakk> ~ True" 
+      proof -
+        have "i \<lbrakk> [ leq [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e\<rbrakk> ~ SBool True" 
+          using eval_e_leqI assms eval_v_litI eval_l.simps * 
+          by (metis (full_types) eval_e_lenI eval_e_valI)        
+        moreover have "i \<lbrakk>  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk> ~ SBool True" 
+          using eval_v_litI eval_e_valI eval_l.simps by metis
+        ultimately show ?thesis using  eval_c_eqI by metis
+      qed
+
+      moreover have "i \<lbrakk> ?c1 \<rbrakk> ~ True" 
+      proof -
+        have "i \<lbrakk> [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrakk> ~ SBool True"
+          using eval_e_leqI assms eval_v_litI eval_l.simps * 
+          by (metis (full_types) eval_e_valI)
+        moreover have "i \<lbrakk>  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk> ~ SBool True" 
+          using eval_v_litI eval_e_valI eval_l.simps by metis
+        ultimately show ?thesis using  eval_c_eqI by metis
+      qed      
+      ultimately show ?thesis using eval_c_conjI is_satis.simps by metis
+    qed
+  qed
+qed
+
+lemma valid_range_length_inv_gnil:
+  fixes \<Gamma>::\<Gamma>
+  assumes  "\<turnstile>\<^sub>w\<^sub>f \<Theta> "
+    and  "\<Theta> ; {||} ; (x, B_int  , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\<^sub>\<Gamma>  GNil \<Turnstile> 
+                     (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x)))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e) AND  
+                     (C_eq (CE_op LEq (CE_val (V_var x)) ([| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)
+                            "
+    (is "\<Theta> ; {||} ; ?G \<Turnstile> ?c1 AND ?c2")
+  shows "0 \<le> n \<and> n \<le> int (length v)" 
+proof -
+  have *:"\<forall>i.  \<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G  \<longrightarrow> i \<Turnstile> ?c1 AND ?c2" using assms valid.simps by simp
+
+  obtain i where i: "i x = Some (SNum n)" by auto
+  have "\<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G" proof 
+    show  "\<Theta> ; ?G \<turnstile> i" unfolding wfI_def using wfRCV_BIntI i * by auto
+    have "i \<lbrakk> ([ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e )  \<rbrakk> ~ True" 
+      using * eval_c.intros(7) eval_e.intros eval_v.intros  eval_l.simps 
+      by (metis (full_types) i)
+    thus  "i \<Turnstile> ?G" unfolding  is_satis_g.simps is_satis.simps by auto
+  qed     
+  hence **:"i \<Turnstile> ?c1 AND ?c2" using * by auto
+
+  hence  1: "i \<lbrakk> ?c1 \<rbrakk> ~ True" using eval_c_elims(3) is_satis.simps 
+    by fastforce
+  then obtain sv1 and sv2 where "(sv1 = sv2) = True \<and> i \<lbrakk> [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrakk> ~ sv1 \<and> i \<lbrakk> [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk>  ~ sv2" 
+    using eval_c_elims(7) by metis
+  hence "sv1 = SBool True" using eval_e_elims eval_v_elims eval_l.simps i by metis
+  obtain n1 and n2 where "SBool True = SBool (n1 \<le> n2) \<and> (i \<lbrakk> [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SNum n1)  \<and> (i \<lbrakk> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SNum n2)" 
+    using eval_e_elims(3)[of i " [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e" "[ [ x ]\<^sup>v ]\<^sup>c\<^sup>e "  "SBool True"] 
+    using \<open>(sv1 = sv2) = True \<and> i \<lbrakk> [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrakk> ~ sv1 \<and> i \<lbrakk> [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ sv2\<close> \<open>sv1 = SBool True\<close> by fastforce
+  moreover hence "n1 = 0" and "n2 = n"  using eval_e_elims eval_v_elims i 
+    apply (metis eval_l.simps(3) rcl_val.eq_iff(2))
+    using eval_e_elims eval_v_elims i 
+    by (metis calculation option.inject rcl_val.eq_iff(2))
+  ultimately have  le1: "0 \<le> n " by simp
+
+  hence  2: "i \<lbrakk> ?c2 \<rbrakk> ~ True" using ** eval_c_elims(3) is_satis.simps 
+    by fastforce
+  then obtain sv1 and sv2 where sv: "(sv1 = sv2) = True \<and> i \<lbrakk> [ leq [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   \<rbrakk> ~ sv1 \<and> i \<lbrakk> [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk>  ~ sv2" 
+    using eval_c_elims(7) by metis
+  hence "sv1 = SBool True" using eval_e_elims eval_v_elims eval_l.simps i by metis
+  obtain n1 and n2 where ***:"SBool True = SBool (n1 \<le> n2) \<and>  (i \<lbrakk> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SNum n1) \<and> (i \<lbrakk> [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  \<rbrakk> ~ SNum n2)" 
+    using eval_e_elims(3) 
+    using sv \<open>sv1 = SBool True\<close> by metis
+  moreover hence "n1 = n" using eval_e_elims(1)[of i] eval_v_elims(2)[of i x "SNum n1"] i by auto
+  moreover  have "n2 = int (length v)"  using eval_e_elims(8) eval_v_elims(1) eval_l.simps i    
+    by (metis "***" eval_e_elims(1) rcl_val.eq_iff(1) rcl_val.eq_iff(2))    
+  ultimately have  le2: "n \<le> int (length v) " by simp
+
+  show ?thesis using le1 le2 by auto
+qed
+
+lemma wfI_cons:  
+  fixes i::valuation and \<Gamma>::\<Gamma>
+  assumes "i' \<Turnstile> \<Gamma>" and "\<Theta> ; \<Gamma> \<turnstile> i'" and "i = i' ( x \<mapsto> s)" and "\<Theta>  \<turnstile> s : b" and "atom x \<sharp> \<Gamma>"
+  shows "\<Theta> ; (x,b,c) #\<^sub>\<Gamma> \<Gamma> \<turnstile> i"  
+  unfolding wfI_def proof - 
+  {  
+    fix x' b' c' 
+    assume "(x',b',c') \<in> toSet ((x, b, c) #\<^sub>\<Gamma> \<Gamma>)"
+    then consider "(x',b',c') = (x,b,c)" | "(x',b',c') \<in> toSet \<Gamma>" using toSet.simps by auto
+    then have "\<exists>s. Some s = i x' \<and>  \<Theta>  \<turnstile> s : b'" proof(cases)
+      case 1
+      then show ?thesis using assms by auto
+    next
+      case 2
+      then obtain s where s:"Some s = i' x' \<and> \<Theta>  \<turnstile> s : b'" using assms wfI_def by auto
+      moreover have "x' \<noteq> x" using assms 2 fresh_dom_free by auto
+      ultimately have "Some s = i x'" using assms by auto
+      then show ?thesis using s  wfI_def by auto
+    qed
+  }
+  thus "\<forall>(x, b, c)\<in>toSet ((x, b, c) #\<^sub>\<Gamma> \<Gamma>). \<exists>s. Some s = i x \<and>  \<Theta>  \<turnstile> s : b" by auto
+qed
+
+lemma valid_range_length_inv:
+  fixes \<Gamma>::\<Gamma>
+  assumes  "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma> " and "atom x \<sharp> \<Gamma>" and "\<exists>i. i \<Turnstile> \<Gamma> \<and> \<Theta> ; \<Gamma> \<turnstile> i"
+    and  "\<Theta> ; B ; (x, B_int  , (C_eq (CE_val (V_var x)) (CE_val (V_lit (L_num n))))) #\<^sub>\<Gamma>  \<Gamma> \<Turnstile> 
+                     (C_eq (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var x)))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e) AND  
+                     (C_eq (CE_op LEq (CE_val (V_var x)) ([| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ))  [[ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)
+                            "
+    (is "\<Theta> ; ?B ; ?G \<Turnstile> ?c1 AND ?c2")
+  shows "0 \<le> n \<and> n \<le> int (length v)" 
+proof -
+  have *:"\<forall>i.  \<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G  \<longrightarrow> i \<Turnstile> ?c1 AND ?c2" using assms valid.simps by simp
+
+  obtain i' where idash: "is_satis_g i' \<Gamma> \<and> \<Theta> ; \<Gamma> \<turnstile> i'" using assms by auto
+  obtain i where i: "i = i' ( x \<mapsto> SNum n)" by auto
+  hence ix: "i x = Some (SNum n)" by auto
+  have "\<Theta> ; ?G \<turnstile> i \<and>  i \<Turnstile> ?G" proof 
+    show  "\<Theta> ; ?G \<turnstile> i" using wfI_cons i idash ix wfRCV_BIntI assms by simp
+
+    have **:"i \<lbrakk> ([ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e )  \<rbrakk> ~ True" 
+      using * eval_c.intros(7) eval_e.intros eval_v.intros  eval_l.simps i 
+      by (metis (full_types) ix)
+
+    show  "i \<Turnstile> ?G" unfolding  is_satis_g.simps proof 
+      show \<open> i \<Turnstile> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e  \<close> using ** is_satis.simps by auto
+      show \<open> i \<Turnstile> \<Gamma> \<close> using idash i assms is_satis_g_i_upd by metis
+    qed
+  qed     
+  hence **:"i \<Turnstile> ?c1 AND ?c2" using * by auto
+
+  hence  1: "i \<lbrakk> ?c1 \<rbrakk> ~ True" using eval_c_elims(3) is_satis.simps 
+    by fastforce
+  then obtain sv1 and sv2 where "(sv1 = sv2) = True \<and> i \<lbrakk> [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrakk> ~ sv1 \<and> i \<lbrakk> [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk>  ~ sv2" 
+    using eval_c_elims(7) by metis
+  hence "sv1 = SBool True" using eval_e_elims eval_v_elims eval_l.simps i by metis
+  obtain n1 and n2 where "SBool True = SBool (n1 \<le> n2) \<and> (i \<lbrakk> [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SNum n1)  \<and> (i \<lbrakk> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SNum n2)" 
+    using eval_e_elims(3)[of i " [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e" "[ [ x ]\<^sup>v ]\<^sup>c\<^sup>e "  "SBool True"] 
+    using \<open>(sv1 = sv2) = True \<and> i \<lbrakk> [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrakk> ~ sv1 \<and> i \<lbrakk> [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ sv2\<close> \<open>sv1 = SBool True\<close> by fastforce
+  moreover hence "n1 = 0" and "n2 = n"  using eval_e_elims eval_v_elims i 
+    apply (metis eval_l.simps(3) rcl_val.eq_iff(2))
+    using eval_e_elims eval_v_elims i 
+      calculation option.inject rcl_val.eq_iff(2)
+    by (metis ix)
+  ultimately have  le1: "0 \<le> n " by simp
+
+  hence  2: "i \<lbrakk> ?c2 \<rbrakk> ~ True" using ** eval_c_elims(3) is_satis.simps 
+    by fastforce
+  then obtain sv1 and sv2 where sv: "(sv1 = sv2) = True \<and> i \<lbrakk> [ leq [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   \<rbrakk> ~ sv1 \<and> i \<lbrakk> [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk>  ~ sv2" 
+    using eval_c_elims(7) by metis
+  hence "sv1 = SBool True" using eval_e_elims eval_v_elims eval_l.simps i by metis
+  obtain n1 and n2 where ***:"SBool True = SBool (n1 \<le> n2) \<and>  (i \<lbrakk> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SNum n1) \<and> (i \<lbrakk> [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  \<rbrakk> ~ SNum n2)" 
+    using eval_e_elims(3) 
+    using sv \<open>sv1 = SBool True\<close> by metis
+  moreover hence "n1 = n" using eval_e_elims(1)[of i] eval_v_elims(2)[of i x "SNum n1"] i by auto
+  moreover  have "n2 = int (length v)"  using eval_e_elims(8) eval_v_elims(1) eval_l.simps i    
+    by (metis "***" eval_e_elims(1) rcl_val.eq_iff(1) rcl_val.eq_iff(2))    
+  ultimately have  le2: "n \<le> int (length v) " by simp
+
+  show ?thesis using le1 le2 by auto
+qed
+
+lemma eval_c_conj2I[intro]: 
+  assumes "i \<lbrakk> c1 \<rbrakk> ~ True" and "i \<lbrakk> c2 \<rbrakk> ~ True"
+  shows "i \<lbrakk> (C_conj c1 c2) \<rbrakk> ~  True"
+  using assms eval_c_conjI by metis
+
+lemma valid_split:
+  assumes "split n v (v1,v2)" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta> ; {||} ; (z , [B_bitvec , B_bitvec ]\<^sup>b ,  [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ [ L_bitvec  v1 ]\<^sup>v , [ L_bitvec  v2 ]\<^sup>v ]\<^sup>v ]\<^sup>c\<^sup>e) #\<^sub>\<Gamma> GNil  
+\<Turnstile>  ([ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e)   AND  ([| [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e)"
+    (is "\<Theta> ;  {||} ;  ?G \<Turnstile> ?c1 AND ?c2")
+  unfolding valid.simps proof
+
+  have wfg: " \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f (z, [B_bitvec , B_bitvec ]\<^sup>b ,  [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ [ L_bitvec  v1 ]\<^sup>v , [ L_bitvec  v2 ]\<^sup>v ]\<^sup>v ]\<^sup>c\<^sup>e) #\<^sub>\<Gamma> GNil" 
+    using wf_intros assms base_for_lit.simps  fresh_GNil wfC_v_eq  wfG_intros2 by metis   
+
+  show "\<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f ?c1 AND ?c2" 
+    apply(rule wfC_conjI)
+    apply(rule wfC_eqI)
+    apply(rule wfCE_valI)
+    apply(rule wfV_litI)
+    using wf_intros wfg lookup.simps base_for_lit.simps wfC_v_eq 
+    apply (metis )+
+    done
+
+  have len:"int (length v1) = n" using assms split_length by auto
+
+  show "\<forall>i. \<Theta> ; ?G \<turnstile> i \<and> i \<Turnstile> ?G \<longrightarrow> i \<Turnstile> (?c1 AND ?c2)" 
+  proof(rule,rule)
+    fix i
+    assume a:"\<Theta> ; ?G \<turnstile> i \<and> i \<Turnstile> ?G"
+    hence "i \<lbrakk> [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ [ L_bitvec v1 ]\<^sup>v , [ L_bitvec v2 ]\<^sup>v ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ True" 
+      using is_satis_g.simps is_satis.simps by simp
+    then obtain sv where "i \<lbrakk> [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ sv \<and> i \<lbrakk>  [ [ [ L_bitvec v1 ]\<^sup>v , [ L_bitvec v2 ]\<^sup>v ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ sv" 
+      using eval_c_elims by metis
+    hence "i  \<lbrakk> [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ (SPair (SBitvec v1) (SBitvec v2))" using eval_c_eqI eval_v.intros eval_l.simps 
+      by (metis eval_e_elims(1) eval_v_uniqueness)
+    hence b:"i z = Some (SPair (SBitvec v1) (SBitvec v2))" using a eval_e_elims eval_v_elims by metis
+
+    have v1: "i \<lbrakk> [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrakk> ~ SBitvec v1 " 
+      using eval_e_fstI eval_e_valI eval_v_varI b by metis
+    have v2: "i \<lbrakk> [#2[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrakk> ~ SBitvec v2" 
+      using eval_e_sndI eval_e_valI eval_v_varI b by metis
+
+    have "i \<lbrakk> [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ SBitvec v" using eval_e.intros eval_v.intros eval_l.simps by metis
+    moreover have "i \<lbrakk>  [ [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrakk> ~ SBitvec v" 
+      using assms split_concat v1 v2 eval_e_concatI by metis
+    moreover have "i \<lbrakk>  [| [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e \<rbrakk> ~ SNum (int (length v1))" 
+      using v1 eval_e_lenI by auto
+    moreover have "i \<lbrakk>  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrakk> ~ SNum n" using eval_e.intros eval_v.intros eval_l.simps by metis
+    ultimately show  "i \<Turnstile> ?c1 AND ?c2" using is_satis.intros eval_c_conj2I eval_c_eqI len by metis
+  qed
+qed
+
+
+lemma is_satis_eq:
+  assumes "wfI \<Theta> G i" and "wfCE \<Theta> \<B> G e b"
+  shows "is_satis i (e == e)"
+proof(rule)
+  obtain s where "eval_e i e s" using eval_e_exist assms by metis
+  thus "eval_c i (e  ==  e ) True" using eval_c_eqI by metis
+qed
+
+lemma is_satis_g_i_upd2:
+  assumes "eval_v i v s" and "is_satis ((i ( x \<mapsto> s))) c0" and "atom x \<sharp> G" and "wfG \<Theta> \<B> (G3@((x,b,c0)#\<^sub>\<Gamma>G))" and "wfV \<Theta> \<B> G v b" and "wfI \<Theta> (G3[x::=v]\<^sub>\<Gamma>\<^sub>v@G) i" 
+    and  "is_satis_g i (G3[x::=v]\<^sub>\<Gamma>\<^sub>v@G)"
+  shows "is_satis_g (i ( x \<mapsto> s)) (G3@((x,b,c0)#\<^sub>\<Gamma>G))"
+  using assms proof(induct G3 rule: \<Gamma>_induct)
+  case GNil
+  hence "is_satis_g (i(x \<mapsto> s)) G" using is_satis_g_i_upd by auto
+  then show ?case using GNil using is_satis_g.simps append_g.simps by metis
+next
+  case (GCons x' b' c' \<Gamma>')
+  hence "x\<noteq>x'" using wfG_cons_append  by metis
+  hence "is_satis_g i (((x', b', c'[x::=v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v) @ G))" using subst_gv.simps GCons by auto
+  hence *:"is_satis i c'[x::=v]\<^sub>c\<^sub>v \<and> is_satis_g i ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v) @ G)" using subst_gv.simps by auto
+
+  have "is_satis_g (i(x \<mapsto> s)) ((x', b', c') #\<^sub>\<Gamma> (\<Gamma>'@  (x, b, c0) #\<^sub>\<Gamma> G))" proof(subst is_satis_g.simps,rule)
+    show "is_satis (i(x \<mapsto> s)) c'" proof(subst subst_c_satis_full[symmetric])
+      show \<open>eval_v i v s\<close> using GCons by auto
+      show \<open> \<Theta> ; \<B> ; ((x', b', c') #\<^sub>\<Gamma>\<Gamma>')@(x, b, c0) #\<^sub>\<Gamma> G \<turnstile>\<^sub>w\<^sub>f c' \<close> using GCons wfC_refl by auto
+      show \<open>wfI \<Theta> ((((x', b', c') #\<^sub>\<Gamma> \<Gamma>')[x::=v]\<^sub>\<Gamma>\<^sub>v) @ G) i\<close> using GCons  by auto
+      show \<open> \<Theta> ; \<B> ; G \<turnstile>\<^sub>w\<^sub>f v : b \<close> using GCons by auto
+      show \<open>is_satis i c'[x::=v]\<^sub>c\<^sub>v\<close> using * by auto
+    qed
+    show "is_satis_g (i(x \<mapsto> s)) (\<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> G)" proof(rule  GCons(1))
+      show \<open>eval_v i v s\<close> using GCons by auto
+      show \<open>is_satis (i(x \<mapsto> s)) c0\<close> using GCons by metis
+      show \<open>atom x \<sharp> G\<close> using GCons by auto
+      show \<open> \<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> G \<close> using GCons wfG_elims append_g.simps by metis
+      show \<open>is_satis_g i (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ G)\<close> using * by auto
+      show "wfI \<Theta> (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ G) i" using GCons wfI_def subst_g_assoc_cons \<open>x\<noteq>x'\<close> by auto
+      show "\<Theta> ; \<B> ; G \<turnstile>\<^sub>w\<^sub>f v : b "  using GCons by auto
+    qed
+  qed
+  moreover have "((x', b', c') #\<^sub>\<Gamma> \<Gamma>' @ (x, b, c0) #\<^sub>\<Gamma> G) = (((x', b', c') #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c0) #\<^sub>\<Gamma> G)" by auto
+  ultimately show ?case using GCons by metis
+qed
+
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/ROOT b/thys/MiniSail/ROOT
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/ROOT
@@ -0,0 +1,15 @@
+chapter AFP
+
+session "MiniSail" (AFP) = "HOL-Library" +
+  description \<open>Formalisation of MiniSail\<close>
+  options [timeout = 1200]
+  sessions   
+     "Nominal2"
+     "HOL-Eisbach" 
+     "Native_Word"
+     "Show"
+  theories
+    "MiniSail"
+  document_files
+    "root.tex"
+    "root.bib"
diff --git a/thys/MiniSail/Safety.thy b/thys/MiniSail/Safety.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Safety.thy
@@ -0,0 +1,1812 @@
+(*<*)
+theory Safety
+  imports Operational IVSubstTypingL BTVSubstTypingL 
+begin
+  (*>*)
+
+method supp_calc = (metis (mono_tags, hide_lams) pure_supp  c.supp e.supp v.supp supp_l_empty opp.supp sup_bot.right_neutral supp_at_base)
+declare infer_e.intros[simp]
+declare infer_e.intros[intro]
+
+chapter \<open>Safety\<close>
+
+text \<open>Lemmas about the operational semantics leading up to progress and preservation and then
+safety.\<close>
+
+section \<open>Store Lemmas\<close>
+
+abbreviation delta_ext (" _ \<sqsubseteq> _ ") where  
+  "delta_ext \<Delta> \<Delta>' \<equiv> (setD \<Delta> \<subseteq> setD \<Delta>')" 
+
+nominal_function dc_of :: "branch_s \<Rightarrow> string" where
+  "dc_of (AS_branch dc _ _) = dc"
+  apply(auto,simp add: eqvt_def dc_of_graph_aux_def)
+  using   s_branch_s_branch_list.exhaust by metis
+nominal_termination (eqvt) by lexicographic_order
+
+lemma delta_sim_fresh: 
+  assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and "atom u \<sharp> \<delta>"
+  shows "atom u \<sharp> \<Delta>"
+  using assms proof(induct rule : delta_sim.inducts)
+  case (delta_sim_nilI \<Theta>)
+  then show ?case using fresh_def supp_DNil by blast
+next
+  case (delta_sim_consI \<Theta> \<delta> \<Delta> v \<tau> u')
+  hence  "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using check_v_wf  by meson
+  hence  "supp \<tau> = {}" using  wfT_supp by fastforce
+  moreover have  "atom u \<sharp> u'" using delta_sim_consI fresh_Cons fresh_Pair by blast
+  moreover have "atom u \<sharp> \<Delta>" using delta_sim_consI fresh_Cons by blast
+  ultimately show ?case using fresh_Pair fresh_DCons fresh_def by blast
+qed
+
+lemma delta_sim_v: 
+  fixes \<Delta>::\<Delta>
+  assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta> " and "(u,v) \<in> set \<delta>" and "(u,\<tau>) \<in> setD \<Delta>" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>"
+  shows "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau>"
+  using assms proof(induct \<delta> arbitrary: \<Delta>)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons uv \<delta>)
+  obtain u' and v' where uv : "uv=(u',v')" by fastforce
+  show ?case proof(cases "u'=u")
+    case True
+    hence  *:"\<Theta> \<turnstile> ((u,v')#\<delta>) \<sim> \<Delta>" using uv Cons by blast
+    then obtain \<tau>' and \<Delta>' where tt: "\<Theta> ; {||} ; GNil \<turnstile> v' \<Leftarrow> \<tau>' \<and> u \<notin> fst ` set \<delta> \<and> \<Delta> = (u,\<tau>')#\<^sub>\<Delta>\<Delta>'" using delta_sim_elims(3)[OF *] by metis
+    moreover hence "v'=v" using Cons True 
+      by (metis Pair_inject fst_conv image_eqI set_ConsD uv)
+    moreover have "\<tau>=\<tau>'" using wfD_unique tt Cons 
+        setD.simps list.set_intros by blast
+    ultimately show ?thesis by metis
+  next
+    case False
+    hence  *:"\<Theta> \<turnstile> ((u',v')#\<delta>) \<sim> \<Delta>" using uv Cons by blast
+    then obtain \<tau>' and \<Delta>' where tt: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>' \<and> \<Theta> ; {||} ; GNil \<turnstile> v' \<Leftarrow> \<tau>' \<and> u' \<notin> fst ` set \<delta> \<and> \<Delta> = (u',\<tau>')#\<^sub>\<Delta>\<Delta>'" using delta_sim_elims(3)[OF *] by metis
+
+    moreover hence "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wfD_elims Cons delta_sim_elims by metis
+    ultimately show ?thesis using Cons  
+      using False by auto
+  qed
+qed
+
+lemma delta_sim_delta_lookup:
+  assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta> " and "(u, \<lbrace> z : b  | c \<rbrace>) \<in> setD \<Delta>" 
+  shows "\<exists>v. (u,v) \<in> set \<delta>"
+  using assms by(induct rule: delta_sim.inducts,auto+)
+
+lemma update_d_stable:
+  "fst ` set \<delta> = fst ` set (update_d \<delta> u v)"
+proof(induct \<delta>)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons a \<delta>)
+  then show ?case using update_d.simps
+    by (metis (no_types, lifting) eq_fst_iff image_cong image_insert list.simps(15) prod.exhaust_sel)
+qed
+
+lemma update_d_sim:
+  fixes \<Delta>::\<Delta>
+  assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau>" and "(u,\<tau>) \<in> setD \<Delta>" and "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>"
+  shows "\<Theta> \<turnstile> (update_d \<delta> u v) \<sim> \<Delta>"
+  using assms proof(induct \<delta> arbitrary: \<Delta>)
+  case Nil
+  then show ?case using delta_sim_consI by simp
+next
+  case (Cons uv \<delta>)
+  obtain u' and v' where uv : "uv=(u',v')" by fastforce
+
+  hence  *:"\<Theta> \<turnstile> ((u',v')#\<delta>) \<sim> \<Delta>" using uv Cons by blast
+  then obtain \<tau>' and \<Delta>' where tt: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>' \<and> \<Theta> ; {||} ; GNil \<turnstile> v' \<Leftarrow> \<tau>' \<and> u' \<notin> fst ` set \<delta> \<and> \<Delta> = (u',\<tau>')#\<^sub>\<Delta>\<Delta>'" using delta_sim_elims * by metis
+
+  show ?case proof(cases "u=u'")
+    case True
+    then have "(u,\<tau>') \<in> setD \<Delta>" using tt by auto
+    then have "\<tau> = \<tau>'" using Cons  wfD_unique by metis
+    moreover  have "update_d ((u',v')#\<delta>) u v = ((u',v)#\<delta>)" using update_d.simps True by presburger
+    ultimately show ?thesis using delta_sim_consI tt Cons True 
+      by (simp add: tt uv)
+  next
+    case False
+    have  "\<Theta> \<turnstile> (u',v') # (update_d \<delta> u v) \<sim> (u',\<tau>')#\<^sub>\<Delta>\<Delta>'" 
+    proof(rule delta_sim_consI)
+      show "\<Theta> \<turnstile> update_d \<delta> u v \<sim> \<Delta>' " using Cons using delta_sim_consI 
+          delta_sim.simps update_d.simps Cons  delta_sim_elims uv  tt 
+          False fst_conv set_ConsD wfG_elims wfD_elims  by (metis setD_ConsD)
+      show "\<Theta> ; {||} ; GNil  \<turnstile> v' \<Leftarrow> \<tau>'" using tt by auto
+      show "u' \<notin> fst ` set (update_d \<delta> u v)" using  update_d.simps Cons update_d_stable tt by auto
+    qed
+    thus  ?thesis using False update_d.simps uv 
+      by (simp add: tt)
+  qed
+qed
+
+section \<open>Preservation\<close>
+text \<open>Types are preserved under reduction step. Broken down into lemmas about different operations\<close>
+
+subsection \<open>Function Application\<close>
+
+lemma check_s_x_fresh:
+  fixes x::x and s::s
+  assumes "\<Theta> ; \<Phi> ; B ;  GNil ; D  \<turnstile> s \<Leftarrow> \<tau>" 
+  shows "atom x \<sharp> s \<and> atom x \<sharp> \<tau> \<and> atom x \<sharp> D"
+proof - 
+  have "\<Theta> ; \<Phi> ; B ; GNil ; D \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau>"  using check_s_wf[OF assms] by auto 
+  moreover have "\<Theta> ; B ; GNil   \<turnstile>\<^sub>w\<^sub>f \<tau> " using check_s_wf assms by auto
+  moreover have "\<Theta> ; B ; GNil   \<turnstile>\<^sub>w\<^sub>f D" using check_s_wf assms by auto
+  ultimately show ?thesis using wf_supp x_fresh_u 
+    by (meson fresh_GNil wfS_x_fresh wfT_x_fresh wfD_x_fresh)
+qed
+
+lemma check_funtyp_subst_b: 
+  fixes b'::b
+  assumes "check_funtyp \<Theta> \<Phi> {|bv|} (AF_fun_typ x b c \<tau> s)" and \<open> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close>
+  shows "check_funtyp \<Theta> \<Phi>  {||} (AF_fun_typ x b[bv::=b']\<^sub>b\<^sub>b (c[bv::=b']\<^sub>c\<^sub>b) \<tau>[bv::=b']\<^sub>\<tau>\<^sub>b s[bv::=b']\<^sub>s\<^sub>b)"
+  using assms proof (nominal_induct "{|bv|}" "AF_fun_typ x b c \<tau> s" rule: check_funtyp.strong_induct)
+  case (check_funtypI x' \<Theta> \<Phi> c' s' \<tau>')
+  have "check_funtyp \<Theta> \<Phi> {||} (AF_fun_typ x' b[bv::=b']\<^sub>b\<^sub>b (c'[bv::=b']\<^sub>c\<^sub>b) \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b s'[bv::=b']\<^sub>s\<^sub>b)" proof
+    show \<open>atom x' \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, b[bv::=b']\<^sub>b\<^sub>b)\<close> using check_funtypI fresh_prodN x_fresh_b fresh_empty_fset by metis
+
+    have  \<open> \<Theta> ; \<Phi> ; {||} ; ((x', b, c') #\<^sub>\<Gamma> GNil)[bv::=b']\<^sub>\<Gamma>\<^sub>b ; []\<^sub>\<Delta>[bv::=b']\<^sub>\<Delta>\<^sub>b  \<turnstile> s'[bv::=b']\<^sub>s\<^sub>b \<Leftarrow> \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b\<close>  proof(rule subst_b_check_s)
+      show \<open> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close> using check_funtypI by metis
+      show \<open>{|bv|} = {|bv|}\<close> by auto
+      show \<open> \<Theta> ; \<Phi> ; {|bv|} ; (x', b, c') #\<^sub>\<Gamma> GNil ; []\<^sub>\<Delta>  \<turnstile> s' \<Leftarrow> \<tau>'\<close> using check_funtypI by metis
+    qed
+
+    thus \<open> \<Theta> ; \<Phi> ; {||} ; (x', b[bv::=b']\<^sub>b\<^sub>b, c'[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> GNil ; []\<^sub>\<Delta>  \<turnstile> s'[bv::=b']\<^sub>s\<^sub>b \<Leftarrow> \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b\<close> 
+      using subst_gb.simps subst_db.simps by simp
+  qed
+
+  moreover have "(AF_fun_typ x b c \<tau> s) = (AF_fun_typ x' b c' \<tau>' s')"  using fun_typ.eq_iff check_funtypI by metis
+  moreover hence "(AF_fun_typ x b[bv::=b']\<^sub>b\<^sub>b (c[bv::=b']\<^sub>c\<^sub>b) \<tau>[bv::=b']\<^sub>\<tau>\<^sub>b s[bv::=b']\<^sub>s\<^sub>b) = (AF_fun_typ x' b[bv::=b']\<^sub>b\<^sub>b (c'[bv::=b']\<^sub>c\<^sub>b) \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b s'[bv::=b']\<^sub>s\<^sub>b)"
+    using  subst_ft_b.simps by metis
+  ultimately show  ?case by metis
+qed
+
+lemma funtyp_simple_check:
+  fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  
+  assumes "check_funtyp \<Theta> \<Phi>  ({||}::bv fset) (AF_fun_typ x b c \<tau> s)" and
+    "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b | c \<rbrace>" 
+  shows "\<Theta> ; \<Phi> ;  {||} ; GNil ; DNil \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms proof(nominal_induct  " ({||}::bv fset)" "AF_fun_typ x b c \<tau> s" avoiding: v x  rule: check_funtyp.strong_induct)
+  case (check_funtypI x' \<Theta> \<Phi> c' s' \<tau>')
+
+  hence eq1: "\<lbrace> x' : b  | c' \<rbrace> = \<lbrace> x : b  | c \<rbrace>" using funtyp_eq_iff_equalities by metis
+
+  obtain x'' and c'' where xf:"\<lbrace> x : b  | c \<rbrace> = \<lbrace> x'' : b | c'' \<rbrace> \<and> atom x'' \<sharp> (x',v) \<and> atom x'' \<sharp> (x,c)" using obtain_fresh_z3 by metis 
+  moreover have "atom x' \<sharp> c''" proof -
+    have "supp  \<lbrace> x'' : b | c'' \<rbrace> = {}" using eq1 check_funtypI xf check_v_wf wfT_nil_supp by metis 
+    hence "supp c'' \<subseteq> { atom x'' }" using  \<tau>.supp eq1 xf by (auto simp add: freshers)
+    moreover have "atom x' \<noteq> atom x''" using xf fresh_Pair fresh_x_neq by metis
+    ultimately show ?thesis using xf fresh_Pair fresh_x_neq fresh_def fresh_at_base by blast
+  qed
+  ultimately have eq2: "c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v = c'" using eq1  type_eq_subst_eq3(1)[of x' b c' x'' b  c''] by metis
+
+  have "atom x' \<sharp> c" proof -
+    have "supp  \<lbrace> x : b | c \<rbrace> = {}" using eq1 check_funtypI xf check_v_wf wfT_nil_supp by metis 
+    hence "supp c \<subseteq> { atom x }" using  \<tau>.supp by auto
+    moreover have "atom x \<noteq> atom x'" using check_funtypI fresh_Pair fresh_x_neq by metis
+    ultimately show ?thesis using fresh_def by force
+  qed
+  hence eq: " c[x::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v =  c' \<and> s'[x'::=v]\<^sub>s\<^sub>v = s[x::=v]\<^sub>s\<^sub>v \<and> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" 
+    using funtyp_eq_iff_equalities type_eq_subst_eq3 check_funtypI by metis
+
+  have " \<Theta> ; \<Phi> ; {||} ; ((x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil)[x'::=v]\<^sub>\<Gamma>\<^sub>v ; []\<^sub>\<Delta>[x'::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v" 
+  proof(rule subst_check_check_s )
+    show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x'' : b  | c'' \<rbrace>\<close> using check_funtypI eq1 xf by metis
+    show \<open>atom x'' \<sharp> (x', v)\<close> using check_funtypI fresh_x_neq fresh_Pair xf by metis
+    show \<open> \<Theta> ; \<Phi> ; {||} ; (x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; []\<^sub>\<Delta>  \<turnstile> s' \<Leftarrow> \<tau>'\<close> using check_funtypI eq2 by metis
+    show \<open> (x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil = GNil  @ (x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil\<close> using append_g.simps by auto
+  qed
+  hence " \<Theta>; \<Phi>; {||}; GNil; []\<^sub>\<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v" using subst_gv.simps subst_dv.simps by auto
+  thus ?case using eq  by auto
+qed
+
+lemma funtypq_simple_check:
+  fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  
+  assumes "check_funtypq \<Theta> \<Phi>   (AF_fun_typ_none (AF_fun_typ x b c t s))" and
+    "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b | c \<rbrace>" 
+  shows "\<Theta>; \<Phi>; {||}; GNil; DNil \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms proof(nominal_induct  "(AF_fun_typ_none (AF_fun_typ x b c t s))" avoiding: v rule: check_funtypq.strong_induct)
+  case (check_fundefq_simpleI \<Theta> \<Phi> x' c' t' s')
+  hence eq: "\<lbrace> x : b  | c \<rbrace> = \<lbrace> x' : b  | c' \<rbrace> \<and> s'[x'::=v]\<^sub>s\<^sub>v = s[x::=v]\<^sub>s\<^sub>v \<and> t[x::=v]\<^sub>\<tau>\<^sub>v = t'[x'::=v]\<^sub>\<tau>\<^sub>v" 
+    using funtyp_eq_iff_equalities by metis
+  hence "\<Theta>; \<Phi>; {||}; GNil; []\<^sub>\<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> t'[x'::=v]\<^sub>\<tau>\<^sub>v" 
+    using funtyp_simple_check[OF check_fundefq_simpleI(1)] check_fundefq_simpleI by metis
+  thus ?case  using eq by metis
+qed
+
+lemma funtyp_poly_eq_iff_equalities:
+  assumes "[[atom bv']]lst. AF_fun_typ x' b'' c' t' s' = [[atom bv]]lst. AF_fun_typ x b c t s" 
+  shows "\<lbrace> x' : b''[bv'::=b']\<^sub>b\<^sub>b  | c'[bv'::=b']\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace> \<and> 
+          s'[bv'::=b']\<^sub>s\<^sub>b[x'::=v]\<^sub>s\<^sub>v = s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<and> t'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v]\<^sub>\<tau>\<^sub>v = t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v" 
+proof - 
+  have "subst_ft_b (AF_fun_typ x' b'' c' t' s') bv' b' = subst_ft_b (AF_fun_typ x b c t s) bv b'"
+    using subst_b_flip_eq_two subst_b_fun_typ_def assms by metis
+  thus ?thesis using fun_typ.eq_iff subst_ft_b.simps funtyp_eq_iff_equalities subst_tb.simps 
+    by (metis (full_types) assms fun_poly_arg_unique)
+
+qed
+
+lemma funtypq_poly_check:
+  fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  and b'::b
+  assumes "check_funtypq \<Theta> \<Phi>   (AF_fun_typ_some bv (AF_fun_typ x b c t s))" and
+    "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>"   and
+    "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b'" 
+  shows "\<Theta>; \<Phi>; {||}; GNil; DNil \<turnstile> s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms proof(nominal_induct  "(AF_fun_typ_some bv (AF_fun_typ x b c t s))" avoiding: v rule: check_funtypq.strong_induct)
+  case (check_funtypq_polyI bv' \<Theta> \<Phi>  x' b'' c' t' s')
+
+  hence **:"\<lbrace> x' : b''[bv'::=b']\<^sub>b\<^sub>b  | c'[bv'::=b']\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace> \<and> 
+          s'[bv'::=b']\<^sub>s\<^sub>b[x'::=v]\<^sub>s\<^sub>v = s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<and> t'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v]\<^sub>\<tau>\<^sub>v = t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v" 
+    using funtyp_poly_eq_iff_equalities by metis
+
+  have *:"check_funtyp \<Theta> \<Phi> {||} (AF_fun_typ x' b''[bv'::=b']\<^sub>b\<^sub>b (c'[bv'::=b']\<^sub>c\<^sub>b) (t'[bv'::=b']\<^sub>\<tau>\<^sub>b) s'[bv'::=b']\<^sub>s\<^sub>b)"
+    using check_funtyp_subst_b[OF check_funtypq_polyI(5) check_funtypq_polyI(8)]  by metis
+  moreover have "\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x' : b''[bv'::=b']\<^sub>b\<^sub>b  | c'[bv'::=b']\<^sub>c\<^sub>b \<rbrace>" using ** check_funtypq_polyI by metis
+  ultimately have "\<Theta>; \<Phi>; {||}; GNil; []\<^sub>\<Delta>  \<turnstile> s'[bv'::=b']\<^sub>s\<^sub>b[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> t'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v]\<^sub>\<tau>\<^sub>v"
+    using funtyp_simple_check[OF *] check_funtypq_polyI by metis
+  thus ?case using ** by metis
+
+qed
+
+lemma fundef_simple_check:
+  fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  
+  assumes "check_fundef \<Theta> \<Phi>   (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c t s)))" and
+    "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b | c \<rbrace>" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>"
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[x::=v]\<^sub>\<tau>\<^sub>v"
+  using assms proof(nominal_induct  "(AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c t s)))" avoiding: v rule: check_fundef.strong_induct)
+  case (check_fundefI \<Theta> \<Phi>)
+  then show ?case using funtypq_simple_check[THEN check_s_d_weakening(1) ] setD.simps by auto
+qed
+
+lemma fundef_poly_check:
+  fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  and b'::b
+  assumes "check_fundef \<Theta> \<Phi>   (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c t s)))" and
+    "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>" and  "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b'" 
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v" 
+  using assms proof(nominal_induct  "(AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c t s)))" avoiding: v rule: check_fundef.strong_induct)
+  case (check_fundefI \<Theta> \<Phi>)
+  then show ?case using funtypq_poly_check[THEN check_s_d_weakening(1) ] setD.simps by auto
+qed
+
+lemma preservation_app:
+  assumes
+    "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and  "(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+  shows "\<Theta> ; \<Phi> ; B ; G ; \<Delta>  \<turnstile> ss \<Leftarrow> \<tau> \<Longrightarrow>  B = {||} \<Longrightarrow> G = GNil \<Longrightarrow> ss = LET x = (AE_app f v) IN s \<Longrightarrow>  
+           \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x : (\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v) = (s1'[x1::=v]\<^sub>s\<^sub>v) IN s \<Leftarrow> \<tau>" and
+    "check_branch_s \<Theta> \<Phi> \<B> GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+  using assms proof(nominal_induct \<tau> and \<tau> and \<tau>   avoiding: v rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_letI x2 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s2 b c)
+
+  hence eq: "e = (AE_app f v)" by simp
+  hence *:"\<Theta> ; \<Phi> ; {||} ;GNil ; \<Delta>  \<turnstile> (AE_app f v) \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" using check_letI by auto
+
+  then obtain x3 b3 c3 \<tau>3 s3 where
+    **:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<and>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x3 b3 c3 \<tau>3 s3))) = lookup_fun \<Phi> f \<and> 
+     \<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3  | c3 \<rbrace> \<and>  atom x3 \<sharp> (\<Theta>, \<Phi>, ({||}::bv fset), GNil, \<Delta>, v, \<lbrace> z : b  | c \<rbrace>) \<and>  \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b  | c \<rbrace>"
+    using infer_e_elims(6)[OF *] subst_defs by metis
+
+  obtain z3 where z3:"\<lbrace> x3 : b3  | c3 \<rbrace> =  \<lbrace> z3 : b3  | c3[x3::=V_var z3]\<^sub>c\<^sub>v \<rbrace> \<and>  atom z3 \<sharp> (x3, v,c3,x1,c1)" using obtain_fresh_z3 by metis
+
+  have seq:"[[atom x3]]lst. s3 = [[atom x1]]lst. s1'" using fun_def_eq check_letI ** option.inject by metis
+
+  let ?ft = "AF_fun_typ x3 b3 c3 \<tau>3 s3"
+
+
+  have sup: "supp \<tau>3 \<subseteq> { atom x3} \<and> supp s3 \<subseteq> { atom x3}"  using wfPhi_f_supp ** by metis
+
+  have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x2  \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v (s3[x3::=v]\<^sub>s\<^sub>v) s2 \<Leftarrow> \<tau>" proof
+    show \<open>atom x2 \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v, s3[x3::=v]\<^sub>s\<^sub>v, \<tau>)\<close>
+      unfolding fresh_prodN using check_letI fresh_subst_v_if subst_v_\<tau>_def sup
+      by (metis all_not_in_conv fresh_def fresh_empty_fset fresh_subst_sv_if fresh_subst_tv_if singleton_iff subset_singleton_iff)
+
+    show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s3[x3::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v\<close> proof(rule fundef_simple_check)
+      show \<open>check_fundef \<Theta> \<Phi> (AF_fundef f (AF_fun_typ_none (AF_fun_typ x3 b3 c3 \<tau>3 s3)))\<close> using ** check_letI lookup_fun_member by metis
+      show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3  | c3 \<rbrace>\<close> using ** by auto
+      show \<open> \<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using ** by auto
+    qed
+    show \<open> \<Theta> ; \<Phi> ; {||} ; (x2, b_of \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v, c_of \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v x2) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>\<close>  
+      using check_letI ** b_of.simps c_of.simps subst_defs  by metis
+  qed
+
+  moreover have "AS_let2 x2  \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v (s3[x3::=v]\<^sub>s\<^sub>v) s2 = AS_let2 x   (\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v) (s1'[x1::=v]\<^sub>s\<^sub>v) s" proof -
+    have *: "[[atom x2]]lst. s2 = [[atom x]]lst. s" using check_letI  s_branch_s_branch_list.eq_iff by auto
+    moreover have " \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v = \<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v" using fun_ret_unique ** check_letI by metis
+    moreover have "s3[x3::=v]\<^sub>s\<^sub>v = (s1'[x1::=v]\<^sub>s\<^sub>v)" using subst_v_flip_eq_two subst_v_s_def seq by metis
+    ultimately show ?thesis using s_branch_s_branch_list.eq_iff by metis
+  qed
+
+  ultimately show ?case using check_letI by auto
+qed(auto+)
+
+lemma fresh_subst_v_subst_b:
+  fixes x2::x and tm::"'a::{has_subst_v,has_subst_b}" and x::x
+  assumes  "supp tm \<subseteq> { atom bv, atom x }" and "atom x2 \<sharp> v" 
+  shows  "atom x2 \<sharp> tm[bv::=b]\<^sub>b[x::=v]\<^sub>v"  
+  using assms proof(cases "x2=x")
+  case True
+  then show ?thesis using fresh_subst_v_if assms by blast
+next
+  case False
+  hence "atom x2 \<sharp> tm" using assms fresh_def fresh_at_base by force
+  hence "atom x2 \<sharp> tm[bv::=b]\<^sub>b" using  assms fresh_subst_if x_fresh_b False by force
+  then show ?thesis using fresh_subst_v_if assms by auto
+qed
+
+lemma preservation_poly_app:
+  assumes
+    "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and  "(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+  shows "\<Theta> ; \<Phi> ; B ; G ; \<Delta>  \<turnstile> ss \<Leftarrow> \<tau> \<Longrightarrow>  B = {||} \<Longrightarrow> G = GNil \<Longrightarrow> ss = LET x = (AE_appP f b' v) IN s \<Longrightarrow> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b'  \<Longrightarrow> 
+               \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x : (\<tau>1'[bv1::=b']\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v) = (s1'[bv1::=b']\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v) IN s \<Leftarrow> \<tau>" and
+    "check_branch_s \<Theta> \<Phi> \<B> GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+  using assms proof(nominal_induct \<tau> and \<tau> and \<tau>   avoiding: v x1 rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_letI x2 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s2 b c)
+
+  hence eq: "e = (AE_appP f b' v)" by simp
+  hence *:"\<Theta> ; \<Phi> ; {||} ;GNil ; \<Delta>  \<turnstile> (AE_appP f b' v) \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" using check_letI by auto
+
+  then obtain x3 b3 c3 \<tau>3 s3 bv3 where
+    **:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<and>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  Some (AF_fundef f (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3))) = lookup_fun \<Phi> f \<and> 
+     \<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3[bv3::=b']\<^sub>b\<^sub>b   | c3[bv3::=b']\<^sub>c\<^sub>b  \<rbrace> \<and>  atom x3 \<sharp> GNil \<and>  \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b  | c \<rbrace>
+  \<and> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b'"
+    using infer_e_elims(21)[OF *] subst_defs  by metis
+
+  obtain z3 where z3:"\<lbrace> x3 : b3  | c3 \<rbrace> =  \<lbrace> z3 : b3  | c3[x3::=V_var z3]\<^sub>c\<^sub>v \<rbrace> \<and>  atom z3 \<sharp> (x3, v,c3,x1,c1)" using obtain_fresh_z3 by metis
+
+  let ?ft = "(AF_fun_typ x3 (b3[bv3::=b']\<^sub>b\<^sub>b) (c3[bv3::=b']\<^sub>c\<^sub>b) (\<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b) (s3[bv3::=b']\<^sub>s\<^sub>b))"
+
+  have *:"check_fundef \<Theta> \<Phi> (AF_fundef f (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3)))" using ** check_letI lookup_fun_member by metis
+
+  hence ftq:"check_funtypq \<Theta> \<Phi> (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3))" using check_fundef_elims by auto
+
+  let ?ft = "AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3)"
+
+  have sup: "supp \<tau>3 \<subseteq> { atom x3, atom bv3} \<and> supp s3 \<subseteq> { atom x3, atom bv3 }"  
+    using  wfPhi_f_poly_supp_t wfPhi_f_poly_supp_s ** by metis
+
+  have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x2  \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v (s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v) s2 \<Leftarrow> \<tau>" 
+  proof
+    show \<open>atom x2 \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v, s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v, \<tau>)\<close> 
+    proof -
+
+      have "atom x2 \<sharp> \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v" 
+        using fresh_subst_v_subst_b subst_v_\<tau>_def subst_b_\<tau>_def \<open> atom x2 \<sharp> v\<close> sup by fastforce      
+      moreover have "atom x2 \<sharp> s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v" 
+        using fresh_subst_v_subst_b subst_v_s_def subst_b_s_def \<open> atom x2 \<sharp> v\<close> sup 
+      proof -
+        have "\<forall>b. atom x2 = atom x3 \<or> atom x2 \<sharp> s3[bv3::=b]\<^sub>b"
+          by (metis (no_types) check_letI.hyps(1) fresh_subst_sv_if(1) fresh_subst_v_subst_b insert_commute subst_v_s_def sup) (* 140 ms *)
+        then show ?thesis
+          by (metis check_letI.hyps(1) fresh_subst_sb_if fresh_subst_sv_if(1) has_subst_b_class.subst_b_fresh_x x_fresh_b) (* 78 ms *)
+      qed
+      ultimately show ?thesis using fresh_prodN check_letI by metis
+    qed
+
+    show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v\<close> proof( rule fundef_poly_check)
+      show \<open>check_fundef \<Theta> \<Phi> (AF_fundef f (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3)))\<close>   
+        using **  lookup_fun_member check_letI by metis
+      show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3[bv3::=b']\<^sub>b\<^sub>b  | c3[bv3::=b']\<^sub>c\<^sub>b \<rbrace>\<close> using ** by metis
+      show \<open> \<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using ** by metis
+      show \<open> \<Theta> ;  {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close>  using ** by metis
+    qed
+    show \<open> \<Theta> ; \<Phi> ; {||} ; (x2, b_of \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v, c_of \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v x2) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>\<close> 
+      using check_letI ** b_of.simps c_of.simps subst_defs by metis
+  qed
+
+  moreover have "AS_let2 x2  \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v (s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v) s2 = AS_let2 x   (\<tau>1'[bv1::=b']\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v) (s1'[bv1::=b']\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v) s" proof -
+    have *: "[[atom x2]]lst. s2 = [[atom x]]lst. s" using check_letI  s_branch_s_branch_list.eq_iff by auto
+    moreover have " \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v = \<tau>1'[bv1::=b']\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v" using fun_poly_ret_unique ** check_letI by metis
+    moreover have "s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v = (s1'[bv1::=b']\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v)" using subst_v_flip_eq_two subst_v_s_def  fun_poly_body_unique ** check_letI by metis
+    ultimately show ?thesis using s_branch_s_branch_list.eq_iff by metis
+  qed
+
+  ultimately show ?case using check_letI by auto
+qed(auto+)
+
+lemma check_s_plus:
+  assumes "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2))) IN s'  \<Leftarrow> \<tau>" 
+  shows   "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_val (V_lit (L_num (n1+n2)))) IN s' \<Leftarrow> \<tau>"   
+proof  -
+  obtain t1 where 1: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2)) \<Rightarrow> t1"
+    using assms check_s_elims by metis
+  then obtain z1 where 2: "t1 =  \<lbrace> z1 : B_int  | CE_val (V_var z1)  ==  CE_op Plus  ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e)  \<rbrace>"
+    using infer_e_plus by metis
+
+  obtain z2 where 3: \<open>\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_val (V_lit (L_num (n1+n2))) \<Rightarrow> \<lbrace> z2 : B_int  | CE_val (V_var z2)  ==  CE_val (V_lit (L_num (n1+n2))) \<rbrace>\<close> 
+    using infer_v_form infer_e_valI infer_v_litI   infer_l.intros infer_e_wf 1 
+    by (simp add: fresh_GNil)
+
+  let ?e = " (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2)))"
+
+  show ?thesis proof(rule  subtype_let)
+    show "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> LET x = ?e IN s' \<Leftarrow> \<tau>" using assms by auto
+    show "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> ?e \<Rightarrow> t1" using 1 by auto
+    show "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> [ [ L_num (n1 + n2) ]\<^sup>v ]\<^sup>e \<Rightarrow> \<lbrace> z2 : B_int  | CE_val (V_var z2)  ==  CE_val (V_lit (L_num (n1+n2))) \<rbrace>" using 3 by auto
+    show "\<Theta> ; {||} ; GNil  \<turnstile>  \<lbrace> z2 : B_int  | CE_val (V_var z2)  ==  CE_val (V_lit (L_num (n1+n2))) \<rbrace>  \<lesssim> t1" using subtype_bop_arith 
+      by (metis "1" \<open>\<And>thesis. (\<And>z1. t1 = \<lbrace> z1 : B_int | [ [ z1 ]\<^sup>v ]\<^sup>c\<^sup>e == [ plus [ [ L_num n1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ L_num n2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrace> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> infer_e_wf(2) opp.distinct(1) type_for_lit.simps(3))
+  qed
+
+qed
+
+lemma check_s_leq:
+  assumes "\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> LET x = (AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2))) IN s'  \<Leftarrow> \<tau>" 
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_val (V_lit (if (n1 \<le> n2) then L_true else L_false))) IN s' \<Leftarrow> \<tau>"   
+proof -
+  obtain t1 where 1: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2)) \<Rightarrow> t1"
+    using assms check_s_elims by metis
+  then obtain z1 where 2: "t1 =  \<lbrace> z1 : B_bool  | CE_val (V_var z1)  ==  CE_op LEq  ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e)  \<rbrace>"
+    using infer_e_leq by auto
+
+  obtain z2 where 3: \<open>\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<rbrace>\<close> 
+    using infer_v_form infer_e_valI infer_v_litI   infer_l.intros infer_e_wf 1 
+      fresh_GNil 
+    by simp
+
+  show ?thesis proof(rule subtype_let)
+    show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op LEq [ L_num n1 ]\<^sup>v [ L_num n2 ]\<^sup>v) s' \<Leftarrow> \<tau>\<close> using assms by auto
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op LEq [ L_num n1 ]\<^sup>v [ L_num n2 ]\<^sup>v \<Rightarrow> t1\<close> using 1 by auto
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> [ [ if n1 \<le> n2 then L_true else L_false ]\<^sup>v ]\<^sup>e \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<rbrace>\<close> using 3 by auto
+    show \<open>\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<rbrace> \<lesssim> t1\<close> 
+      using subtype_bop_arith[where opp=LEq] check_s_wf assms 2  
+      by (metis opp.distinct(1) subtype_bop_arith type_l_eq)
+  qed
+qed
+
+lemma check_s_eq:
+  assumes "\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> LET x = (AE_op Eq (V_lit (n1)) (V_lit ( n2))) IN s'  \<Leftarrow> \<tau>" 
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_val (V_lit (if (n1 = n2) then L_true else L_false))) IN s' \<Leftarrow> \<tau>"   
+proof -
+  obtain t1 where 1: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op Eq (V_lit (n1)) (V_lit (n2)) \<Rightarrow> t1"
+    using assms check_s_elims by metis
+  then obtain z1 where 2: "t1 =  \<lbrace> z1 : B_bool  | CE_val (V_var z1)  ==  CE_op Eq  ([V_lit (n1)]\<^sup>c\<^sup>e) ([V_lit (n2)]\<^sup>c\<^sup>e)  \<rbrace>"
+    using infer_e_leq by auto
+
+  obtain z2 where 3: \<open>\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<rbrace>\<close> 
+    using infer_v_form infer_e_valI infer_v_litI   infer_l.intros infer_e_wf 1 
+      fresh_GNil 
+    by simp
+
+  show ?thesis proof(rule subtype_let)
+    show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op Eq [  n1 ]\<^sup>v [  n2 ]\<^sup>v) s' \<Leftarrow> \<tau>\<close> using assms by auto
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op Eq [  n1 ]\<^sup>v [  n2 ]\<^sup>v \<Rightarrow> t1\<close> using 1 by auto
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> [ [ if n1 = n2 then L_true else L_false ]\<^sup>v ]\<^sup>e \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<rbrace>\<close> using 3 by auto
+    show \<open>\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<rbrace> \<lesssim> t1\<close> 
+    proof -
+      have " \<lbrace> z2 : B_bool  | [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ eq [ [ n1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ n2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrace> = t1" using 2 
+        by (metis \<tau>_fresh_c fresh_opp_all infer_l_form2 infer_l_fresh ms_fresh_all(31) ms_fresh_all(33) obtain_fresh_z type_e_eq type_l_eq)
+      moreover have "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f GNil" using assms wfX_wfY by fastforce
+      moreover have "base_for_lit n1 = base_for_lit n2" using 1 infer_e_wf wfE_elims(12) wfV_elims 
+        by metis
+      ultimately show ?thesis using subtype_bop_eq[OF \<open>\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f GNil\<close>, of n1 n2 z2] by auto     
+    qed
+  qed
+qed
+
+subsection \<open>Operators\<close>
+
+lemma preservation_plus:
+  assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , LET x = (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2))) IN s' \<rangle> \<Leftarrow> \<tau>"        
+  shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , LET x =  (AE_val (V_lit (L_num (n1+n2)))) IN s' \<rangle> \<Leftarrow> \<tau>"
+proof -
+
+  have tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2))) s' \<Leftarrow> \<tau>" and dsim: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd:"(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+    using assms config_type_elims by blast+
+
+  hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>AS_let x (AE_val (V_lit  (L_num (n1+n2)))) s' \<Leftarrow> \<tau>" using check_s_plus assms by auto  
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit ( (L_num (n1+n2))))) s' \<rangle> \<Leftarrow> \<tau>" using dsim config_typeI fd by presburger
+  then show ?thesis using dsim config_typeI 
+    by (meson order_refl)
+qed
+
+lemma preservation_leq:
+  assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2))) s' \<rangle> \<Leftarrow> \<tau>"        
+  shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit (((if (n1 \<le> n2) then L_true else L_false))))) s' \<rangle> \<Leftarrow> \<tau>"
+proof -
+
+  have tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2))) s' \<Leftarrow> \<tau>" and dsim: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd:"(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+    using assms config_type_elims by blast+
+
+  hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>AS_let x (AE_val (V_lit  ( ((if (n1 \<le> n2) then L_true else L_false))))) s' \<Leftarrow> \<tau>" using check_s_leq assms by auto  
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit ( (((if (n1 \<le> n2) then L_true else L_false)))))) s' \<rangle> \<Leftarrow> \<tau>" using dsim config_typeI fd by presburger
+  then show ?thesis using dsim config_typeI 
+    by (meson order_refl)
+qed
+
+lemma preservation_eq:
+  assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_op Eq (V_lit (n1)) (V_lit (n2))) s' \<rangle> \<Leftarrow> \<tau>"        
+  shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit (((if (n1 = n2) then L_true else L_false))))) s' \<rangle> \<Leftarrow> \<tau>"
+proof -
+
+  have tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op Eq (V_lit (n1)) (V_lit (n2))) s' \<Leftarrow> \<tau>" and dsim: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd:"(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+    using assms config_type_elims by blast+
+
+  hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>AS_let x (AE_val (V_lit  ( ((if (n1 = n2) then L_true else L_false))))) s' \<Leftarrow> \<tau>" using check_s_eq assms by auto  
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit ( (((if (n1 = n2) then L_true else L_false)))))) s' \<rangle> \<Leftarrow> \<tau>" using dsim config_typeI fd by presburger
+  then show ?thesis using dsim config_typeI 
+    by (meson order_refl)
+qed
+
+subsection \<open>Let Statements\<close>
+
+lemma subst_s_abs_lst:
+  fixes s::s and sa::s and v'::v
+  assumes "[[atom x]]lst. s = [[atom xa]]lst. sa" and "atom xa \<sharp> v \<and> atom x \<sharp> v"
+  shows "s[x::=v]\<^sub>s\<^sub>v = sa[xa::=v]\<^sub>s\<^sub>v"
+proof -
+  obtain c'::x where cdash: "atom c' \<sharp> (v, x, xa, s, sa)" using obtain_fresh by blast    
+  moreover have " (x \<leftrightarrow> c') \<bullet> s = (xa \<leftrightarrow> c') \<bullet> sa" proof -
+    have "atom c' \<sharp> (s, sa) \<and> atom c' \<sharp> (x, xa, s, sa)" using cdash by auto
+    thus ?thesis using assms by auto
+  qed
+  ultimately show ?thesis using assms 
+    using subst_sv_flip by auto 
+qed
+
+lemma check_let_val: 
+  fixes v::v and s::s
+  shows "\<Theta> ; \<Phi> ; B ; G ; \<Delta>  \<turnstile> ss \<Leftarrow> \<tau> \<Longrightarrow>  B = {||} \<Longrightarrow> G = GNil \<Longrightarrow> 
+        ss = AS_let x (AE_val v) s \<or>  ss = AS_let2 x t (AS_val v) s \<Longrightarrow>  \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> (s[x::=v]\<^sub>s\<^sub>v) \<Leftarrow> \<tau>" and
+    "check_branch_s \<Theta> \<Phi> \<B> GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+proof(nominal_induct \<tau> and \<tau> and \<tau>  avoiding: v rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_letI x1 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s1 b c)
+  hence *:"e = AE_val v" by auto
+  let ?G = "(x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>"
+  have "\<Theta> ; \<Phi> ; \<B> ;  ?G[x1::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x1::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s1[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x1::=v]\<^sub>\<tau>\<^sub>v" 
+  proof(rule subst_infer_check_s(1))
+    show **:\<open> \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow>  \<lbrace> z : b  | c \<rbrace>\<close> using infer_e_elims check_letI * by fast
+    thus \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile>  \<lbrace> z : b  | c \<rbrace> \<lesssim> \<lbrace> z : b  | c \<rbrace>\<close> using subtype_reflI  infer_v_wf by metis
+    show \<open>atom z \<sharp> (x1, v)\<close> using check_letI fresh_Pair by auto
+    show \<open>\<Theta> ; \<Phi> ; \<B> ; (x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<tau>\<close> using check_letI subst_defs by auto
+    show "(x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" by auto
+  qed
+
+  hence "\<Theta> ; \<Phi> ; \<B> ;  \<Gamma> ; \<Delta>  \<turnstile> s1[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>"  using check_letI by auto
+  moreover have " s1[x1::=v]\<^sub>s\<^sub>v =  s[x::=v]\<^sub>s\<^sub>v" 
+    by (metis (full_types) check_letI fresh_GNil infer_e_elims(7) s_branch_s_branch_list.distinct s_branch_s_branch_list.eq_iff(2) 
+        subst_s_abs_lst wfG_x_fresh_in_v_simple)
+
+  ultimately show ?case using check_letI by simp
+next
+  case (check_let2I x1 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> t s1 \<tau> s2 )
+
+  hence s1eq:"s1 = AS_val v" by auto
+  let ?G = "(x1, b_of t, c_of t x1) #\<^sub>\<Gamma> \<Gamma>"
+  obtain z::x where *:"atom z \<sharp> (x1 , v,t)"  using obtain_fresh_z by metis
+  hence teq:"t =  \<lbrace> z : b_of t | c_of t z \<rbrace>" using b_of_c_of_eq by auto
+  have "\<Theta> ; \<Phi> ; \<B> ;  ?G[x1::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x1::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s2[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x1::=v]\<^sub>\<tau>\<^sub>v" 
+  proof(rule subst_check_check_s(1))
+    obtain t' where "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> t' \<and>  \<Theta> ; \<B> ; \<Gamma> \<turnstile> t' \<lesssim> t" using  check_s_elims(1) check_let2I(10) s1eq by auto
+    thus  **:\<open> \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> z : b_of t | c_of t z \<rbrace>\<close> using  check_v.intros teq by auto
+    show "atom z \<sharp> (x1, v)" using * by auto
+    show \<open>  \<Theta> ; \<Phi> ; \<B> ; (x1, b_of t, c_of t x1) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>\<close> using check_let2I by auto
+    show "(x1, b_of t , c_of t x1) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x1, b_of t, (c_of t z)[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" using append_g.simps c_of_switch * fresh_prodN by metis
+  qed
+
+  hence "\<Theta> ; \<Phi> ; \<B> ;  \<Gamma> ; \<Delta>  \<turnstile> s2[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>"  using check_let2I by auto
+  moreover have " s2[x1::=v]\<^sub>s\<^sub>v =  s[x::=v]\<^sub>s\<^sub>v" using
+      check_let2I fresh_GNil check_s_elims s_branch_s_branch_list.distinct s_branch_s_branch_list.eq_iff
+      subst_s_abs_lst wfG_x_fresh_in_v_simple
+  proof -
+    have "AS_let2 x t (AS_val v) s = AS_let2 x1 t s1 s2"
+      by (metis check_let2I.prems(3) s_branch_s_branch_list.distinct s_branch_s_branch_list.eq_iff(3)) (* 62 ms *)
+    then show ?thesis
+      by (metis (no_types) check_let2I check_let2I.prems(2) check_s_elims(1) fresh_GNil s_branch_s_branch_list.eq_iff(3) subst_s_abs_lst wfG_x_fresh_in_v_simple) (* 375 ms *)
+  qed
+
+  ultimately show ?case using check_let2I by simp
+qed(auto+)
+
+lemma preservation_let_val:
+  assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val v) s \<rangle> \<Leftarrow> \<tau> \<or> \<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let2 x t (AS_val v) s \<rangle> \<Leftarrow> \<tau>" (is "?A \<or> ?B")
+  shows " \<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta>'  \<turnstile> \<langle> \<delta> , s[x::=v]\<^sub>s\<^sub>v \<rangle> \<Leftarrow> \<tau>  \<and> \<Delta> \<sqsubseteq> \<Delta>'"
+proof -
+  have tt:  "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd: "(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+    using assms by blast+
+
+  have  "?A \<or> ?B" using assms by auto
+  then have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile>  s[x::=v]\<^sub>s\<^sub>v   \<Leftarrow> \<tau>"
+  proof
+    assume "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val v) s \<rangle> \<Leftarrow> \<tau>"
+    hence * : " \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile>  AS_let x (AE_val v) s  \<Leftarrow> \<tau>" by blast
+    thus ?thesis using check_let_val by simp
+  next
+    assume "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , AS_let2 x t (AS_val v) s \<rangle> \<Leftarrow> \<tau>"
+    hence * : "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile>  AS_let2 x t (AS_val v) s  \<Leftarrow> \<tau>" by blast
+    thus ?thesis using check_let_val by simp
+  qed
+
+  thus  ?thesis using tt config_typeI fd
+      order_refl by metis
+qed
+
+lemma check_s_fst_snd:
+  assumes "fst_snd = AE_fst \<and> v=v1 \<or> fst_snd = AE_snd \<and> v=v2" 
+    and   "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau>"
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x ( AE_val v) s' \<Leftarrow> \<tau>"
+proof -
+  have  1: \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau>\<close> using assms by auto
+
+  then obtain t1 where 2:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  (fst_snd (V_pair v1 v2)) \<Rightarrow> t1" using check_s_elims by auto
+
+  show ?thesis using subtype_let 1 2 assms 
+    by (meson infer_e_fst_pair infer_e_snd_pair)
+qed
+
+lemma preservation_fst_snd:
+  assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , LET x = (fst_snd (V_pair v1 v2)) IN s' \<rangle> \<Leftarrow> \<tau>" and 
+    "fst_snd = AE_fst \<and> v=v1 \<or> fst_snd = AE_snd \<and> v=v2"
+  shows "\<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , LET x = (AE_val v) IN s' \<rangle> \<Leftarrow> \<tau>  \<and> \<Delta> \<sqsubseteq> \<Delta>'"
+proof - 
+  have  tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta>" using assms by blast
+  hence t2: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau>" by auto
+
+  moreover have "\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd" using assms config_type_elims by auto
+  ultimately show ?thesis using config_typeI order_refl tt assms check_s_fst_snd by metis
+qed
+
+inductive_cases check_branch_s_elims2[elim!]:
+  "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta>; tid ; cons ; const ; v \<turnstile> cs \<Leftarrow> \<tau>"
+
+lemmas freshers = freshers atom_dom.simps toSet.simps fresh_def x_not_in_b_set
+declare freshers [simp]
+
+lemma subtype_eq_if:
+  fixes t::\<tau> and va::v
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b_of t  | c_of t z \<rbrace>" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> "
+  shows   "\<Theta> ; \<B> ; \<Gamma> \<turnstile> \<lbrace> z : b_of t  | c_of t z \<rbrace>  \<lesssim> \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> "
+proof -
+  obtain x::x where xf:"atom x \<sharp> ((\<Theta>, \<B>, \<Gamma>, z, c_of t z, z, c  IMP  c_of t z ),c)" using obtain_fresh by metis
+
+  moreover have "\<Theta> ; \<B> ; (x, b_of t, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> (c  IMP  c_of t z )[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v " 
+    unfolding subst_cv.simps 
+  proof(rule valid_eq_imp)
+
+    have "\<Theta> ; \<B> ; (x, b_of t, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f (c  IMP  (c_of t z))[z::=[ x ]\<^sup>v]\<^sub>v    " 
+      apply(rule  wfT_wfC_cons)
+      apply(simp add: assms, simp add: assms, unfold fresh_prodN )
+      using  xf fresh_prodN by metis+     
+    thus "\<Theta> ; \<B> ; (x, b_of t, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v  IMP  (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v " 
+      using subst_cv.simps subst_defs by auto
+  qed
+
+  ultimately show ?thesis using subtype_baseI assms fresh_Pair subst_defs by metis
+qed
+
+lemma subtype_eq_if_\<tau>:
+  fixes t::\<tau> and va::v
+  assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  t" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> " and "atom z \<sharp> t"
+  shows   "\<Theta> ; \<B> ; \<Gamma> \<turnstile> t  \<lesssim> \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> "
+proof -
+  have "t = \<lbrace> z : b_of t | c_of t z \<rbrace>" using b_of_c_of_eq assms by auto
+  thus ?thesis  using subtype_eq_if assms  c_of.simps b_of.simps by metis
+qed
+
+lemma valid_conj:
+  assumes  "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c1" and "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c2" 
+  shows "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c1 AND c2" 
+proof
+  show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c1  AND  c2  \<close> using valid.simps wfC_conjI assms by auto
+  show \<open>\<forall>i.  \<Theta> ; \<Gamma> \<turnstile> i \<and>  i \<Turnstile> \<Gamma>  \<longrightarrow>  i \<Turnstile> c1  AND  c2  \<close> 
+  proof(rule+)
+    fix i
+    assume *:"\<Theta> ; \<Gamma> \<turnstile> i \<and> i \<Turnstile> \<Gamma> " 
+    thus "i \<lbrakk> c1 \<rbrakk> ~ True" using assms valid.simps 
+      using is_satis.cases by blast
+    show "i \<lbrakk> c2 \<rbrakk> ~ True" using assms valid.simps 
+      using is_satis.cases * by blast  
+  qed
+qed
+
+subsection \<open>Other Statements\<close>
+
+lemma check_if:
+  fixes s'::s and cs::branch_s and css::branch_list and v::v
+  shows    "\<Theta>; \<Phi>; B; G; \<Delta> \<turnstile>  s' \<Leftarrow> \<tau> \<Longrightarrow> s' =  IF (V_lit ll) THEN s1 ELSE s2 \<Longrightarrow>  
+        \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> G = GNil \<Longrightarrow> B = {||} \<Longrightarrow> ll = L_true \<and> s = s1 \<or> ll = L_false \<and> s = s2 \<Longrightarrow> 
+        \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s \<Leftarrow> \<tau>" and
+    "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+proof(nominal_induct \<tau> and \<tau> and \<tau>  rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  obtain z' where teq: "\<tau> = \<lbrace> z' : b_of \<tau> | c_of \<tau> z' \<rbrace> \<and> atom z' \<sharp> (z,\<tau>)" using obtain_fresh_z_c_of by metis
+  hence ceq: "(c_of \<tau> z')[z'::=[ z ]\<^sup>v]\<^sub>c\<^sub>v = (c_of \<tau> z)" using c_of_switch fresh_Pair by metis
+  have zf: " atom z \<sharp> c_of \<tau> z'"
+    using c_of_fresh check_ifI teq fresh_Pair fresh_at_base by metis
+  hence 1:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s \<Leftarrow>  \<lbrace> z : b_of \<tau>  | CE_val (V_lit ll)  ==  CE_val (V_lit ll)  IMP  c_of \<tau> z  \<rbrace>" using check_ifI by auto
+  moreover have 2:"\<Theta> ; {||} ; GNil \<turnstile> (\<lbrace> z : b_of \<tau>  | CE_val (V_lit ll)  ==  CE_val (V_lit ll)  IMP  c_of \<tau> z  \<rbrace>) \<lesssim>  \<tau>" 
+  proof - 
+    have "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f (\<lbrace> z : b_of \<tau>  | CE_val (V_lit ll )  ==  CE_val (V_lit ll)   IMP c_of \<tau> z  \<rbrace>)" using check_ifI check_s_wf by auto
+    moreover have "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>" using  check_s_wf check_ifI by auto
+    ultimately show ?thesis using subtype_if_simp[of \<Theta> " {||}" z "b_of \<tau>" ll "c_of \<tau> z'" z'] using teq ceq zf subst_defs by metis
+  qed
+  ultimately show ?case  using check_s_supertype(1) check_ifI by metis
+qed(auto+)
+
+lemma preservation_if: 
+  assumes  "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , IF (V_lit ll) THEN s1 ELSE s2 \<rangle> \<Leftarrow> \<tau>" and 
+    "ll = L_true \<and> s = s1 \<or> ll = L_false \<and> s = s2"
+  shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>  \<and> setD \<Delta> \<subseteq> setD \<Delta>"
+proof -
+  have *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_if (V_lit ll) s1 s2 \<Leftarrow> \<tau> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using assms config_type_elims by metis
+  hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s \<Leftarrow> \<tau>" using check_s_wf check_if assms by metis
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>  \<and> setD \<Delta> \<subseteq> setD \<Delta>" using config_typeI * 
+    using assms(1) by blast
+  thus ?thesis by blast
+qed
+
+lemma wfT_conj:
+  assumes "\<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c1 \<rbrace>" and  "\<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c2 \<rbrace>"
+  shows  "\<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c1 AND c2\<rbrace>"
+proof
+  show \<open>atom z \<sharp> (\<Theta>, \<B>, GNil)\<close>
+    apply(unfold fresh_prodN, intro conjI) 
+    using wfTh_fresh wfT_wf assms apply metis
+    using fresh_GNil x_not_in_b_set fresh_def by metis+   
+  show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfT_elims assms by metis
+  have "\<Theta> ; \<B> ; (z, b, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f c1" using wfT_wfC fresh_GNil assms by auto
+  moreover have "\<Theta> ; \<B> ; (z, b, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f c2" using wfT_wfC fresh_GNil assms by auto
+  ultimately show \<open> \<Theta> ; \<B> ; (z, b, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f c1  AND  c2  \<close> using wfC_conjI by auto
+qed
+
+lemma subtype_conj:
+  assumes    "\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c1 \<rbrace>" and   "\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c2 \<rbrace>" 
+  shows   "\<Theta> ; \<B> ; GNil  \<turnstile> \<lbrace> z : b | c_of t z \<rbrace>  \<lesssim> \<lbrace> z : b | c1 AND c2 \<rbrace>" 
+proof -
+  have beq: "b_of t = b" using subtype_eq_base2 b_of.simps assms by metis
+  obtain x::x where x:\<open>atom x \<sharp> (\<Theta>, \<B>, GNil, z, c_of t z, z, c1  AND  c2 )\<close> using obtain_fresh by metis
+  thus ?thesis proof
+    have "atom z \<sharp> t" using subtype_wf wfT_supp fresh_def x_not_in_b_set atom_dom.simps toSet.simps assms dom.simps by fastforce
+    hence t:"t = \<lbrace> z : b_of t  | c_of t z \<rbrace>" using b_of_c_of_eq by auto
+    thus  \<open> \<Theta> ; \<B> ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c_of t z \<rbrace> \<close> using subtype_wf beq assms by auto
+
+    show \<open>\<Theta> ; \<B> ; (x, b, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> (c1  AND  c2 )[z::=[ x ]\<^sup>v]\<^sub>v \<close>      
+    proof -
+      have \<open>\<Theta> ; \<B> ; (x, b, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> c1[z::=[ x ]\<^sup>v]\<^sub>v \<close>
+      proof(rule subtype_valid)
+        show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c1 \<rbrace>\<close> using assms by auto
+        show \<open>atom x \<sharp> GNil\<close> using fresh_GNil by auto
+        show \<open>t = \<lbrace> z : b  | c_of t z \<rbrace>\<close> using t beq by auto
+        show \<open>\<lbrace> z : b  | c1 \<rbrace> = \<lbrace> z : b  | c1 \<rbrace>\<close> by auto
+      qed
+      moreover have \<open>\<Theta> ; \<B> ; (x, b, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> c2[z::=[ x ]\<^sup>v]\<^sub>v \<close>
+      proof(rule subtype_valid)
+        show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c2 \<rbrace>\<close> using assms by auto
+        show \<open>atom x \<sharp> GNil\<close> using fresh_GNil by auto
+        show \<open>t = \<lbrace> z : b  | c_of t z \<rbrace>\<close> using t beq by auto
+        show \<open>\<lbrace> z : b  | c2 \<rbrace> = \<lbrace> z : b  | c2 \<rbrace>\<close> by auto
+      qed
+      ultimately show ?thesis unfolding subst_cv.simps subst_v_c_def  using valid_conj by metis
+    qed
+    thus \<open> \<Theta> ; \<B> ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c1  AND  c2  \<rbrace> \<close> using subtype_wf wfT_conj assms by auto
+  qed
+qed
+
+lemma infer_v_conj:
+  assumes "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b | c1 \<rbrace>" and "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b | c2 \<rbrace>"
+  shows "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b | c1 AND c2 \<rbrace>" 
+proof -
+  obtain t1 where t1: "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Rightarrow> t1 \<and> \<Theta> ; \<B> ; GNil \<turnstile> t1 \<lesssim> \<lbrace> z : b | c1 \<rbrace>" 
+    using assms check_v_elims by metis
+  obtain t2 where t2: "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Rightarrow> t2 \<and> \<Theta> ; \<B> ; GNil \<turnstile> t2 \<lesssim> \<lbrace> z : b | c2 \<rbrace>" 
+    using assms check_v_elims by metis
+  have teq: "t1 = \<lbrace> z : b | c_of t1 z \<rbrace>" using subtype_eq_base2 b_of.simps 
+    by (metis (full_types) b_of_c_of_eq fresh_GNil infer_v_t_wf t1 wfT_x_fresh)
+  have "t1 = t2" using infer_v_uniqueness t1 t2 by auto
+  hence " \<Theta> ; \<B> ; GNil \<turnstile> \<lbrace> z : b | c_of t1 z \<rbrace> \<lesssim> \<lbrace> z : b | c1 AND c2 \<rbrace>" using subtype_conj t1 t2 by simp
+  hence " \<Theta> ; \<B> ; GNil \<turnstile> t1 \<lesssim> \<lbrace> z : b | c1 AND c2 \<rbrace>" using teq by auto
+  thus ?thesis using t1 using check_v.intros by auto
+qed
+
+lemma wfG_conj:
+  fixes c1::c
+  assumes  "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c1 AND c2) #\<^sub>\<Gamma> \<Gamma>"
+  shows "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c1) #\<^sub>\<Gamma> \<Gamma>"
+proof(cases "c1 \<in> {TRUE, FALSE}")
+  case True
+  then show ?thesis using assms wfG_cons2I  wfG_elims wfX_wfY by metis
+next
+  case False
+  then show ?thesis using assms wfG_cons1I  wfG_elims wfX_wfY wfC_elims 
+    by (metis wfG_elim2)
+qed
+
+lemma check_match:
+  fixes s'::s and s::s and css::branch_list and cs::branch_s
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>  s \<Leftarrow> \<tau> \<Longrightarrow> True" and
+    "\<Theta> ; \<Phi> ; B ; G ; \<Delta> ; tid ; dc ; const  ;  vcons \<turnstile>  cs \<Leftarrow>  \<tau> \<Longrightarrow> 
+             vcons = V_cons tid dc v \<Longrightarrow> B =  {||} \<Longrightarrow> G = GNil \<Longrightarrow> cs =  (dc x' \<Rightarrow> s') \<Longrightarrow>  
+             \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> const \<Longrightarrow> 
+             \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>" and
+    "\<Theta> ; \<Phi> ; B ; G ; \<Delta> ; tid ; dclist ; vcons  \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> distinct (map fst dclist) \<Longrightarrow>
+             vcons = V_cons tid dc v \<Longrightarrow> B =  {||} \<Longrightarrow> (dc, const) \<in> set dclist \<Longrightarrow> G = GNil \<Longrightarrow> 
+             Some (AS_branch dc x' s') = lookup_branch dc css \<Longrightarrow> \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> const \<Longrightarrow> 
+             \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>"
+proof(nominal_induct \<tau> and \<tau> and \<tau> avoiding: x' v  rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid consa consta va cs \<tau> dclist cssa)
+
+  then obtain xa and sa where cseq:"cs = AS_branch consa xa sa" using check_branch_s_elims2[OF check_branch_list_consI(1)] by metis
+
+  show ?case proof(cases "dc = consa")
+    case True
+    hence "cs = AS_branch consa x' s'" using check_branch_list_consI cseq 
+      by (metis lookup_branch.simps(2) option.inject)
+    moreover have "const = consta" using check_branch_list_consI distinct.simps 
+      by (metis True dclist_distinct_unique list.set_intros(1))
+    moreover have "va = V_cons tid consa v" using check_branch_list_consI True by auto
+    ultimately  show ?thesis using check_branch_list_consI  by auto
+  next
+    case False
+    hence "Some (AS_branch dc x' s') = lookup_branch dc cssa" using lookup_branch.simps(2) check_branch_list_consI(10) cseq by auto
+    moreover have "(dc, const) \<in> set dclist" using check_branch_list_consI False by simp
+    ultimately show ?thesis using check_branch_list_consI by auto
+  qed
+
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const va cs \<tau>)
+  hence " cs = AS_branch cons x' s'" using lookup.simps check_branch_list_finalI lookup_branch.simps option.inject 
+    by (metis map_of.simps(1) map_of_Cons_code(2) option.distinct(1) s_branch_s_branch_list.exhaust(2) weak_map_of_SomeI)
+  then show ?case using check_branch_list_finalI by auto
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons va s)
+
+  text \<open>Supporting facts here to make the main body of the proof concise\<close>
+  have xf:"atom x \<sharp> \<tau>" proof -
+    have "supp \<tau> \<subseteq> supp  \<B>" using wf_supp(4) check_branch_s_branchI  atom_dom.simps toSet.simps dom.simps by fastforce
+    thus ?thesis using fresh_def x_not_in_b_set by blast
+  qed
+
+  hence "\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>" using forget_subst_v subst_v_\<tau>_def by auto
+  have "\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v = \<Delta>" using forget_subst_dv  wfD_x_fresh fresh_GNil check_branch_s_branchI by metis
+
+  have "supp v = {}" using check_branch_s_branchI check_v_wf wfV_supp_nil by metis
+  hence "supp va = {}" using \<open> va = V_cons tid cons v\<close> v.supp pure_supp by auto
+
+  let ?G = "(x, b_of const, [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ x ]\<^sup>v ]\<^sup>c\<^sup>e   AND c_of const x ) #\<^sub>\<Gamma> \<Gamma>"
+  obtain z::x where z: "const = \<lbrace> z : b_of const | c_of const z \<rbrace> \<and> atom z \<sharp> (x', v,x,const,va)" 
+    using obtain_fresh_z_c_of by metis
+
+  have  vt: \<open>\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e  AND c_of const z \<rbrace>\<close>
+  proof(rule infer_v_conj)
+    obtain t' where t: "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Rightarrow> t' \<and> \<Theta> ; \<B> ; GNil \<turnstile> t' \<lesssim> const" 
+      using check_v_elims check_branch_s_branchI by metis
+    show "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>"        
+    proof(rule check_v_top)
+
+      show "\<Theta> ; \<B> ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> "     
+
+      proof(rule wfG_wfT)
+        show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b_of const, ([ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e    )[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil \<close>
+        proof -
+          have 1: "va[z::=[ x ]\<^sup>v]\<^sub>v\<^sub>v  = va" using  forget_subst_v subst_v_v_def  z fresh_prodN by metis
+          moreover have 2: "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b_of const, [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ x ]\<^sup>v ]\<^sup>c\<^sup>e   AND  c_of const x ) #\<^sub>\<Gamma> GNil  "
+            using    check_branch_s_branchI(17)[THEN check_s_wf] \<open>\<Gamma> = GNil\<close> by auto      
+          moreover hence "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b_of const, [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ x ]\<^sup>v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil" 
+            using wfG_conj by metis
+          ultimately show ?thesis
+            unfolding subst_cv.simps subst_cev.simps subst_vv.simps by auto
+        qed      
+        show \<open>atom x \<sharp> ([ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e   )\<close> unfolding c.fresh ce.fresh v.fresh
+          apply(intro conjI )        
+          using  check_branch_s_branchI fresh_at_base z freshers apply simp
+          using  check_branch_s_branchI fresh_at_base z freshers apply simp
+          using pure_supp apply force
+          using z fresh_x_neq fresh_prod5 by metis        
+      qed
+      show \<open>[ va ]\<^sup>c\<^sup>e = [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e[z::=v]\<^sub>c\<^sub>e\<^sub>v\<close> 
+        using \<open> va = V_cons tid cons v\<close> subst_cev.simps subst_vv.simps by auto
+      show \<open> \<Theta> ; \<B> ; GNil \<turnstile> v \<Leftarrow> const \<close> using check_branch_s_branchI by auto
+      show "supp [ va ]\<^sup>c\<^sup>e \<subseteq> supp \<B>" using \<open>supp va = {}\<close> ce.supp by simp
+    qed
+    show "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | c_of const z \<rbrace>" 
+      using check_branch_s_branchI z by auto
+  qed
+
+  text \<open>Main body of proof for this case\<close>
+  have "\<Theta> ; \<Phi> ; \<B> ; (?G)[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
+  proof(rule subst_check_check_s)
+    show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e   AND c_of const z \<rbrace>\<close> using vt by auto
+    show \<open>atom z \<sharp> (x, v)\<close> using z fresh_prodN by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; ?G ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> 
+      using check_branch_s_branchI by auto
+
+    show \<open> ?G = GNil @ (x, b_of const, ([ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e   AND c_of const z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil\<close>      
+    proof -
+      have "va[z::=[ x ]\<^sup>v]\<^sub>v\<^sub>v  = va" using  forget_subst_v subst_v_v_def  z fresh_prodN by metis
+      moreover have  "(c_of const z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v = c_of const x" 
+        using  c_of_switch[of z const x]  z fresh_prodN by metis
+      ultimately show ?thesis
+        unfolding subst_cv.simps subst_cev.simps subst_vv.simps append_g.simps         
+        using c_of_switch[of z const x]  z fresh_prodN z fresh_prodN  check_branch_s_branchI by argo
+    qed
+  qed
+  moreover have "s[x::=v]\<^sub>s\<^sub>v = s'[x'::=v]\<^sub>s\<^sub>v" 
+    using check_branch_s_branchI subst_v_flip_eq_two subst_v_s_def s_branch_s_branch_list.eq_iff by metis
+  ultimately show  ?case using  check_branch_s_branchI \<open>\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>\<close> \<open>\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v = \<Delta>\<close> by auto
+qed(auto+)
+
+text \<open>Lemmas for while reduction. Making these separate lemmas allows flexibility in wiring them into the main proof and robustness
+if we change it\<close>
+
+lemma check_unit:
+  fixes \<tau>::\<tau> and \<Phi>::\<Phi> and \<Delta>::\<Delta> and G::\<Gamma>
+  assumes "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>"  and "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>"  and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f G"
+  shows \<open> \<Theta> ; \<Phi> ; {||} ; G ; \<Delta>  \<turnstile> [[ L_unit ]\<^sup>v]\<^sup>s \<Leftarrow> \<tau>'\<close>
+proof - 
+  have *:"\<Theta> ; {||} ; GNil  \<turnstile> [L_unit]\<^sup>v \<Rightarrow> \<lbrace> z : B_unit  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_unit ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" 
+    using infer_l.intros(4) infer_v_litI fresh_GNil assms  wfX_wfY   by (meson subtype_g_wf)
+  moreover have "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z : B_unit  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_unit ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> \<lesssim> \<tau>'" 
+    using subtype_top subtype_trans * infer_v_wf 
+    by (meson assms(1))
+  ultimately show ?thesis (*apply(rule check_valI, auto simp add: assms,rule * )*)
+    using subtype_top subtype_trans fresh_GNil assms check_valI assms check_s_g_weakening assms toSet.simps 
+    by (metis bot.extremum infer_v_g_weakening subtype_weakening wfD_wf)
+qed
+
+lemma preservation_var:
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> VAR u : \<tau>' = v IN s \<Leftarrow> \<tau> \<Longrightarrow> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<Longrightarrow> atom u \<sharp> \<delta> \<Longrightarrow> atom u \<sharp> \<Delta> \<Longrightarrow>
+         \<Theta>; \<Phi>; {||}; GNil; (u,\<tau>')#\<^sub>\<Delta>\<Delta>  \<turnstile> s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> (u,v)#\<delta> \<sim> (u,\<tau>')#\<^sub>\<Delta>\<Delta>"
+    and
+    "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+proof(nominal_induct  "{||}::bv fset" GNil \<Delta> "VAR u : \<tau>' = v IN s" \<tau> and \<tau> and \<tau>  rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_varI u' \<Theta> \<Phi> \<Delta> \<tau> s')
+  hence "\<Theta>; \<Phi>; {||}; GNil; (u, \<tau>') #\<^sub>\<Delta> \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" using check_s_abs_u check_v_wf by metis
+
+  moreover have "\<Theta> \<turnstile> ((u,v)#\<delta>) \<sim> ((u,\<tau>')#\<^sub>\<Delta>\<Delta>)" proof
+    show \<open>\<Theta>  \<turnstile> \<delta> \<sim> \<Delta> \<close> using check_varI by auto
+    show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<tau>'\<close> using check_varI by auto
+    show \<open>u \<notin> fst ` set \<delta>\<close> using check_varI fresh_d_fst_d by auto
+  qed
+
+  ultimately show ?case by simp
+qed(auto+)
+
+lemma check_while:
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> WHILE s1 DO { s2 }  \<Leftarrow> \<tau> \<Longrightarrow> atom x \<sharp> (s1, s2) \<Longrightarrow>  atom z' \<sharp> x \<Longrightarrow>
+       \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x : (\<lbrace> z' : B_bool  | TRUE \<rbrace>) = s1 IN (IF (V_var x) THEN (s2 ;; (WHILE s1 DO {s2}))  
+            ELSE ([ V_lit L_unit]\<^sup>s))  \<Leftarrow> \<tau>" and
+    "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
+proof(nominal_induct  "{||}::bv fset" GNil \<Delta> "AS_while s1 s2" \<tau> and \<tau> and \<tau>  avoiding: s1 s2 x z' rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_whileI \<Theta> \<Phi> \<Delta> s1 z s2 \<tau>')
+  have teq:"\<lbrace> z' : B_bool  | TRUE \<rbrace> = \<lbrace> z : B_bool  | TRUE \<rbrace>" using \<tau>.eq_iff by auto
+
+  show ?case proof
+    have " atom x \<sharp> \<tau>' " using wfT_nil_supp fresh_def subtype_wfT check_whileI(5) by fast
+    moreover have "atom x \<sharp> \<lbrace> z' : B_bool  | TRUE \<rbrace> " using \<tau>.fresh c.fresh b.fresh by metis  
+    ultimately show \<open>atom x \<sharp> (\<Theta>, \<Phi>,  {||}, GNil, \<Delta>, \<lbrace> z' : B_bool  | TRUE \<rbrace>, s1, \<tau>')\<close>
+      apply(unfold fresh_prodN)  
+      using check_whileI  wb_x_fresh check_s_wf wfD_x_fresh fresh_empty_fset fresh_GNil fresh_Pair \<open>atom x \<sharp> \<tau>'\<close>  by metis
+
+    show \<open> \<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<lbrace> z' : B_bool  | TRUE \<rbrace>\<close> using check_whileI  teq by metis
+
+    let ?G =  "(x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x) #\<^sub>\<Gamma> GNil"
+
+    have cof:"(c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x) = C_true" using c_of.simps check_whileI subst_cv.simps by metis
+    have  wfg: "\<Theta> ;  {||} \<turnstile>\<^sub>w\<^sub>f ?G" proof 
+      show "c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x \<in> {TRUE, FALSE}" using subst_cv.simps cof by auto
+      show "\<Theta> ;  {||} \<turnstile>\<^sub>w\<^sub>f GNil " using wfG_nilI check_whileI wfX_wfY check_s_wf by metis
+      show "atom x \<sharp> GNil" using fresh_GNil by auto
+      show "\<Theta> ;  {||} \<turnstile>\<^sub>w\<^sub>f b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>  " using wfB_boolI wfX_wfY check_s_wf b_of.simps 
+        by (metis \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>)
+    qed
+
+    obtain zz::x where zf:\<open>atom zz \<sharp> ((\<Theta>, \<Phi>, {||}::bv fset, ?G , \<Delta>, [ x ]\<^sup>v, 
+                                  AS_seq s2 (AS_while s1 s2), AS_val [ L_unit ]\<^sup>v, \<tau>'),x,?G)\<close>
+      using obtain_fresh by blast
+    show \<open> \<Theta> ; \<Phi> ;  {||} ; ?G ; \<Delta>  \<turnstile> 
+                   AS_if [ x ]\<^sup>v (AS_seq s2 (AS_while s1 s2)) (AS_val [ L_unit ]\<^sup>v) \<Leftarrow> \<tau>'\<close> 
+    proof      
+      show "atom zz \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, ?G , \<Delta>, [ x ]\<^sup>v, AS_seq s2 (AS_while s1 s2), AS_val [ L_unit ]\<^sup>v, \<tau>')" using zf by auto
+      show \<open>\<Theta> ; {||} ; ?G  \<turnstile> [ x ]\<^sup>v \<Leftarrow> \<lbrace> zz : B_bool  | TRUE \<rbrace>\<close> proof
+        have "atom zz \<sharp> x \<and> atom zz \<sharp> (\<Theta>,  {||}::bv fset, ?G)" using zf fresh_prodN by metis
+        thus \<open> \<Theta> ; {||} ; ?G  \<turnstile> [ x ]\<^sup>v \<Rightarrow>\<lbrace> zz : B_bool |  [[zz]\<^sup>v]\<^sup>c\<^sup>e == [[ x ]\<^sup>v]\<^sup>c\<^sup>e  \<rbrace>\<close> 
+          using infer_v_varI lookup.simps wfg b_of.simps by metis
+        thus  \<open>\<Theta> ; {||} ; ?G  \<turnstile> \<lbrace> zz : B_bool |  [[ zz ]\<^sup>v]\<^sup>c\<^sup>e == [[ x ]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>  \<lesssim> \<lbrace> zz : B_bool  | TRUE \<rbrace>\<close>
+          using subtype_top infer_v_wf by metis
+      qed 
+      show \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_seq s2 (AS_while s1 s2) \<Leftarrow> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close> 
+      proof 
+        have "\<lbrace> zz : B_unit  | TRUE \<rbrace> = \<lbrace> z : B_unit  | TRUE \<rbrace>" using \<tau>.eq_iff by auto 
+        thus \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<lbrace> zz : B_unit  | TRUE \<rbrace>\<close> using check_s_g_weakening(1) [OF check_whileI(3) _ wfg] toSet.simps 
+          by (simp add: \<open>\<lbrace> zz : B_unit | TRUE \<rbrace> = \<lbrace> z : B_unit | TRUE \<rbrace>\<close>)
+
+        show \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_while s1 s2 \<Leftarrow> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close>
+        proof(rule check_s_supertype(1))
+          have \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_while s1 s2 \<Leftarrow> \<tau>'\<close> using  check_whileI by auto
+          thus *:\<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_while s1 s2 \<Leftarrow> \<tau>' \<close> using  check_s_g_weakening(1)[OF _ _ wfg] toSet.simps by auto
+
+          show \<open>\<Theta> ; {||} ; ?G  \<turnstile> \<tau>'  \<lesssim> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close> 
+          proof(rule subtype_eq_if_\<tau>)
+            show \<open> \<Theta> ; {||} ; ?G \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> using * check_s_wf by auto
+            show \<open> \<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace> \<close>
+              apply(rule wfT_eq_imp, simp add: base_for_lit.simps)
+              using subtype_wf check_whileI wfg zf fresh_prodN by metis+
+            show \<open>atom zz \<sharp> \<tau>'\<close> using  zf fresh_prodN by metis
+          qed
+        qed
+
+      qed
+      show \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_val [ L_unit ]\<^sup>v \<Leftarrow> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close>
+      proof(rule check_s_supertype(1))
+
+        show *:\<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_val [ L_unit ]\<^sup>v \<Leftarrow> \<tau>'\<close> 
+          using check_unit[OF check_whileI(5) _ _ wfg] using check_whileI wfg wfX_wfY check_s_wf by metis
+        show \<open>\<Theta> ; {||} ; ?G  \<turnstile> \<tau>' \<lesssim> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close> 
+        proof(rule subtype_eq_if_\<tau>)
+          show \<open> \<Theta> ; {||} ; ?G \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> using * check_s_wf by metis
+          show \<open> \<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace> \<close>                          
+            apply(rule wfT_eq_imp, simp add: base_for_lit.simps)
+            using subtype_wf check_whileI wfg zf fresh_prodN by metis+
+          show \<open>atom zz \<sharp> \<tau>'\<close> using  zf fresh_prodN by metis
+        qed
+      qed
+    qed
+  qed
+qed(auto+)
+
+lemma check_s_narrow:
+  fixes s::s and x::x
+  assumes "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, c, \<tau>, s)" and "\<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" and    
+    "\<Theta> ; \<B> ; \<Gamma>  \<Turnstile> c "
+  shows "\<Theta> ; \<Phi> ; \<B> ;  \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>"
+proof -
+  let ?B = "({||}::bv fset)"
+  let ?v = "V_lit L_true"
+
+  obtain z::x where z: "atom z \<sharp> (x, [ L_true ]\<^sup>v,c)" using obtain_fresh by metis
+
+  have "atom z \<sharp> c" using z fresh_prodN by auto
+  hence c:"  c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v = c" using  subst_v_c_def by simp
+
+  have "\<Theta> ; \<Phi> ; \<B> ; ((x,B_bool, c) #\<^sub>\<Gamma> \<Gamma>)[x::=?v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=?v]\<^sub>\<Delta>\<^sub>v   \<turnstile>  s[x::=?v]\<^sub>s\<^sub>v   \<Leftarrow> \<tau>[x::=?v]\<^sub>\<tau>\<^sub>v" proof(rule  subst_infer_check_s(1) )
+    show vt: \<open> \<Theta> ; \<B> ; \<Gamma>  \<turnstile> [ L_true ]\<^sup>v \<Rightarrow> \<lbrace> z : B_bool | (CE_val (V_var z)) == (CE_val (V_lit  L_true )) \<rbrace>   \<close> 
+      using infer_v_litI check_s_wf wfG_elims(2) infer_trueI assms by metis     
+    show \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<lbrace> z : B_bool | (CE_val (V_var z)) == (CE_val (V_lit  L_true )) \<rbrace> \<lesssim> \<lbrace> z : B_bool  | c[x::=[ z ]\<^sup>v]\<^sub>v \<rbrace>\<close> proof
+      show \<open>atom x \<sharp> (\<Theta>, \<B>, \<Gamma>, z, [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e , z, c[x::=[ z ]\<^sup>v]\<^sub>v)\<close> 
+        apply(unfold fresh_prodN, intro conjI) 
+        prefer 5
+        using c.fresh ce.fresh v.fresh z fresh_prodN apply auto[1]
+        prefer 6
+        using fresh_subst_v_if[of "atom x" c x] assms fresh_prodN apply simp
+        using z assms fresh_prodN apply metis
+        using z  assms fresh_prodN apply metis
+        using z assms  fresh_prodN apply metis
+        using z fresh_prodN assms fresh_at_base by metis+
+      show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : B_bool  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> \<close> using vt infer_v_wf by simp
+      show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : B_bool  | c[x::=[ z ]\<^sup>v]\<^sub>v \<rbrace> \<close> proof(rule wfG_wfT)    
+        show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<close> using c check_s_wf assms by metis
+        have " atom x \<sharp> [ z ]\<^sup>v" using v.fresh z fresh_at_base by auto
+        thus  \<open>atom x \<sharp> c[x::=[ z ]\<^sup>v]\<^sub>v\<close> using fresh_subst_v_if[of "atom x" c ] by auto
+      qed
+      have wfg: "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f(x, B_bool, ([ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" 
+        using wfT_wfG vt infer_v_wf fresh_prodN assms by simp
+      show  \<open>\<Theta> ; \<B> ; (x, B_bool, ([ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>v \<close> 
+        using c valid_weakening[OF assms(3) _ wfg ] toSet.simps 
+        using subst_v_c_def by auto
+    qed
+    show \<open>atom z \<sharp> (x, [ L_true ]\<^sup>v)\<close> using z fresh_prodN by metis
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> using assms by auto
+
+    thus \<open>(x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x, B_bool, c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<close> using append_g.simps c by auto
+  qed
+
+  moreover have "((x,B_bool, c) #\<^sub>\<Gamma> \<Gamma>)[x::=?v]\<^sub>\<Gamma>\<^sub>v = \<Gamma> " using subst_gv.simps by auto
+  ultimately show ?thesis using assms forget_subst_dv forget_subst_sv forget_subst_tv fresh_prodN  by metis
+qed
+
+lemma check_assert_s:
+  fixes s::s and x::x
+  assumes "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c s  \<Leftarrow> \<tau>"
+  shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s  \<Leftarrow> \<tau> \<and> \<Theta> ; {||} ; GNil  \<Turnstile> c "
+proof -
+  let ?B = "({||}::bv fset)"
+  let ?v = "V_lit L_true"
+
+  obtain x where x: "\<Theta> ; \<Phi> ; ?B ; (x,B_bool, c) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile>  s  \<Leftarrow> \<tau> \<and> atom x \<sharp> (\<Theta>, \<Phi>, ?B, GNil, \<Delta>, c, \<tau>, s ) \<and> \<Theta> ; ?B ; GNil \<Turnstile> c " 
+    using check_s_elims(10)[OF \<open>\<Theta> ; \<Phi> ; ?B ; GNil ; \<Delta>  \<turnstile>  AS_assert c s   \<Leftarrow> \<tau>\<close>] valid.simps by metis
+
+  show ?thesis using assms check_s_narrow x by metis
+qed
+
+lemma infer_v_pair2I:
+  "atom z \<sharp> (v1, v2) \<Longrightarrow>
+   atom z \<sharp> (\<Theta>, \<B>, \<Gamma>) \<Longrightarrow>
+   \<Theta> ; \<B> ; \<Gamma> \<turnstile> v1 \<Rightarrow> t1 \<Longrightarrow>
+   \<Theta> ; \<B> ; \<Gamma> \<turnstile> v2 \<Rightarrow> t2 \<Longrightarrow>
+   b1 = b_of t1 \<Longrightarrow> b2 = b_of t2 \<Longrightarrow> 
+  \<Theta> ; \<B> ; \<Gamma> \<turnstile> [ v1 , v2 ]\<^sup>v \<Rightarrow> \<lbrace> z : [ b1 , b2 ]\<^sup>b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ v1 , v2 ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>"
+  using infer_v_pairI by simp
+
+subsection \<open>Main Lemma\<close>
+
+lemma preservation: 
+  assumes "\<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>" and "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>"
+  shows "\<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle>\<delta>', s'\<rangle> \<Leftarrow> \<tau> \<and> \<Delta> \<sqsubseteq> \<Delta>'" 
+  using assms 
+proof(induct arbitrary: \<tau> rule: reduce_stmt.induct)
+  case (reduce_let_plusI \<delta> x n1 n2 s')
+  then show ?case using preservation_plus
+    by (metis order_refl)  
+next
+  case (reduce_let_leqI b n1 n2 \<delta> x s) 
+  then show ?case using preservation_leq  by (metis order_refl)  
+next
+  case (reduce_let_eqI b n1 n2 \<Phi> \<delta> x s)
+  then show ?case using preservation_eq[OF reduce_let_eqI(2)] order_refl by metis
+next
+  case (reduce_let_appI f z b c \<tau>' s' \<Phi> \<delta> x v s)
+  hence tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_app f v) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" using config_type_elims[OF reduce_let_appI(2)] by metis 
+  hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_app f v) s \<Leftarrow> \<tau>" by auto
+
+  hence  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x   (\<tau>'[z::=v]\<^sub>\<tau>\<^sub>v) (s'[z::=v]\<^sub>s\<^sub>v) s \<Leftarrow> \<tau>" 
+    using preservation_app reduce_let_appI tt by auto
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let2 x (\<tau>'[z::=v]\<^sub>\<tau>\<^sub>v) s'[z::=v]\<^sub>s\<^sub>v s \<rangle> \<Leftarrow> \<tau>"  using  config_typeI tt by auto
+  then show ?case using tt order_refl reduce_let_appI by metis
+
+next
+  case (reduce_let_appPI f bv z b c \<tau>' s' \<Phi> \<delta> x b' v s)
+
+  hence tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_appP f b' v) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" using config_type_elims[OF reduce_let_appPI(2)] by metis 
+  hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_appP f b' v) s \<Leftarrow> \<tau>" by auto
+
+  have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x   (\<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b[z::=v]\<^sub>\<tau>\<^sub>v) (s'[bv::=b']\<^sub>s\<^sub>b[z::=v]\<^sub>s\<^sub>v) s \<Leftarrow> \<tau>" 
+  proof(rule preservation_poly_app) 
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ z b c  \<tau>' s'))) = lookup_fun \<Phi> f\<close> using reduce_let_appPI by metis
+    show \<open>\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd\<close> using tt lookup_fun_member by metis
+    show \<open> \<Theta> ; \<Phi> ;{||} ; GNil ; \<Delta>  \<turnstile> AS_let x (AE_appP f b' v) s \<Leftarrow> \<tau>\<close> using * by auto
+    show \<open> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close> using check_s_elims infer_e_wf wfE_elims * by metis
+  qed(auto+)
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let2 x (\<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b[z::=v]\<^sub>\<tau>\<^sub>v) s'[bv::=b']\<^sub>s\<^sub>b[z::=v]\<^sub>s\<^sub>v s \<rangle> \<Leftarrow> \<tau>"  using  config_typeI tt by auto
+  then show ?case using tt order_refl reduce_let_appI by metis
+
+next
+  case (reduce_if_trueI \<delta> s1 s2) 
+  then show ?case using preservation_if by metis
+next
+  case (reduce_if_falseI uw \<delta> s1 s2)
+  then show ?case using preservation_if by metis
+next
+  case (reduce_let_valI \<delta> x v s)
+  then show ?case using preservation_let_val by presburger
+next
+  case (reduce_let_mvar u v \<delta> \<Phi>  x s)
+  hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_mvar u) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by blast
+
+  hence **: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_mvar u) s \<Leftarrow> \<tau>" by auto
+  obtain xa::x and za::x and ca::c and ba::b and sa::s where
+    sa1: "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_mvar u, \<tau>) \<and>  atom za \<sharp> (xa, \<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_mvar u, \<tau>, sa) \<and>
+     \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_mvar u \<Rightarrow> \<lbrace> za : ba  | ca \<rbrace> \<and>
+     \<Theta> ; \<Phi> ; {||} ; (xa, ba, ca[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> sa \<Leftarrow> \<tau> \<and>
+       (\<forall>c. atom c \<sharp> (s, sa) \<longrightarrow> atom c \<sharp> (x, xa, s, sa) \<longrightarrow> (x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa)" 
+    using check_s_elims(2)[OF **] subst_defs by metis
+
+  have "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow>  \<lbrace> za : ba  | ca \<rbrace>" proof -
+    have " (u , \<lbrace> za : ba  | ca \<rbrace>) \<in> setD \<Delta>" using infer_e_elims(11) sa1 by fast
+    thus  ?thesis using delta_sim_v reduce_let_mvar config_type_elims check_s_wf  by metis
+  qed
+
+  then obtain \<tau>' where  vst: "\<Theta> ; {||} ; GNil \<turnstile> v \<Rightarrow> \<tau>' \<and>
+        \<Theta> ; {||} ; GNil \<turnstile> \<tau>'  \<lesssim>  \<lbrace> za : ba  | ca \<rbrace>" using check_v_elims by blast
+
+  obtain za2 and ba2 and ca2 where  zbc: "\<tau>' = (\<lbrace> za2 : ba2 | ca2 \<rbrace>) \<and> atom za2 \<sharp> (xa, (xa, \<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_val v, \<tau>, sa))"
+    using obtain_fresh_z by blast
+  have beq: "ba=ba2" using subtype_eq_base vst zbc by blast
+
+  moreover have xaf: "atom xa \<sharp> (za, za2)" 
+    apply(unfold fresh_prodN, intro conjI)
+    using sa1 zbc fresh_prodN fresh_x_neq by metis+
+
+  have sat2: " \<Theta> ; \<Phi> ; {||} ; GNil@(xa, ba, ca2[za2::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> sa \<Leftarrow> \<tau>" proof(rule ctx_subtype_s)
+    show "\<Theta> ; \<Phi> ; {||} ; GNil @ (xa, ba, ca[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> sa \<Leftarrow> \<tau>" using sa1 by auto
+    show "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> za2 : ba  | ca2 \<rbrace> \<lesssim> \<lbrace> za : ba  | ca \<rbrace>" using beq zbc vst by fast
+    show "atom xa \<sharp> (za, za2, ca, ca2)" proof -
+      have *:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f (\<lbrace> za2 : ba2 | ca2 \<rbrace>) " using zbc vst subtype_wf by auto
+      hence "supp ca2 \<subseteq> { atom za2 }" using wfT_supp_c[OF *] supp_GNil by simp
+      moreover have "atom za2 \<sharp> xa" using zbc fresh_Pair fresh_x_neq by metis
+      ultimately have  "atom xa \<sharp> ca2" using zbc supp_at_base fresh_def 
+        by (metis empty_iff singleton_iff subset_singletonD)
+      moreover have "atom xa \<sharp> ca" proof -
+        have *:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f (\<lbrace> za : ba | ca \<rbrace>) " using zbc vst subtype_wf by auto
+        hence "supp ca \<subseteq> { atom za }" using wfT_supp \<tau>.supp by force
+        moreover have "xa \<noteq> za"  using   fresh_def fresh_x_neq xaf fresh_Pair by metis
+        ultimately show ?thesis using fresh_def by auto
+      qed
+      ultimately show ?thesis using xaf sa1 fresh_prod4 fresh_Pair by metis
+    qed
+  qed
+  hence dwf: "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>" using sa1 infer_e_wf by meson
+
+  have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let xa (AE_val v) sa \<Leftarrow> \<tau>" proof 
+    have "atom xa \<sharp> (AE_val v)" using infer_v_wf(1) wfV_supp fresh_def e.fresh x_not_in_b_set vst by fastforce
+    thus  "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_val v, \<tau>)" using sa1 freshers by simp 
+    have "atom za2 \<sharp> (AE_val v)" using infer_v_wf(1) wfV_supp fresh_def e.fresh x_not_in_b_set vst by fastforce
+    thus "atom za2 \<sharp> (xa, \<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_val v, \<tau>, sa)" using zbc freshers fresh_prodN by auto
+    have " \<Theta>    \<turnstile>\<^sub>w\<^sub>f \<Phi>" using sa1 infer_e_wf by auto
+    thus  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_val v \<Rightarrow> \<lbrace> za2 : ba  | ca2 \<rbrace>" 
+      using zbc vst beq dwf infer_e_valI by blast
+    show "\<Theta> ; \<Phi> ; {||} ; (xa, ba, ca2[za2::=V_var xa]\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> sa \<Leftarrow> \<tau>" using sat2 append_g.simps subst_defs by metis
+  qed
+  moreover have  "AS_let xa (AE_val v) sa =  AS_let x (AE_val v) s" proof -
+    have "[[atom x]]lst. s = [[atom xa]]lst. sa" 
+      using sa1 Abs1_eq_iff_all(3)[where z=" (s, sa)"] by metis
+    thus ?thesis using s_branch_s_branch_list.eq_iff(2) by metis
+  qed
+  ultimately have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_val v) s \<Leftarrow> \<tau>"  by auto
+
+  then show ?case using reduce_let_mvar * config_typeI
+    by (meson order_refl)
+next
+  case (reduce_let2I \<Phi> \<delta> s1 \<delta>' s1'  x t s2)
+  hence **: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let2 x t s1 s2  \<Leftarrow> \<tau>  \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" using config_type_elims[OF reduce_let2I(3)] by blast
+  hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let2 x t s1 s2  \<Leftarrow> \<tau>" by auto
+
+  obtain xa::x and  z::x and c and b and s2a::s where st: "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, t, s1, \<tau>)  \<and>
+       \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> s1 \<Leftarrow> t \<and>
+       \<Theta> ; \<Phi> ; {||} ; (xa, b_of t, c_of t xa) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> s2a \<Leftarrow> \<tau> \<and>  ([[atom x]]lst. s2 = [[atom xa]]lst. s2a) "
+    using check_s_elims(4)[OF *] Abs1_eq_iff_all(3) by metis
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , s1 \<rangle> \<Leftarrow> t"  using config_typeI ** by auto
+  then obtain \<Delta>' where s1r: "\<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s1' \<rangle> \<Leftarrow> t \<and> \<Delta> \<sqsubseteq> \<Delta>'" using reduce_let2I by presburger
+
+  have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> AS_let2 xa t s1' s2a  \<Leftarrow> \<tau>" 
+  proof(rule check_let2I)
+    show *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> s1' \<Leftarrow> t" using config_type_elims st s1r by metis
+    show  "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>',t, s1', \<tau>)" proof -  
+      have "atom xa \<sharp> s1'" using  check_s_x_fresh *  by auto
+      moreover have "atom xa \<sharp> \<Delta>'" using check_s_x_fresh * by auto
+      ultimately show ?thesis  using st fresh_prodN by metis
+    qed
+
+    show "\<Theta> ; \<Phi> ; {||} ; (xa, b_of t, c_of t xa) #\<^sub>\<Gamma> GNil ; \<Delta>'  \<turnstile> s2a \<Leftarrow> \<tau>"  proof -
+      have "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using * check_s_wf by auto
+      moreover have "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f ((xa, b_of t, c_of t xa) #\<^sub>\<Gamma> GNil)" using st check_s_wf by auto
+      ultimately have "\<Theta> ; {||} ; ((xa, b_of t , c_of t xa) #\<^sub>\<Gamma> GNil)  \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening by auto
+      thus  ?thesis using check_s_d_weakening check_s_wf st  s1r by metis
+    qed
+  qed
+  moreover have "AS_let2 xa t s1' s2a = AS_let2 x t s1' s2"  using st s_branch_s_branch_list.eq_iff by metis
+  ultimately have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> AS_let2 x t s1' s2  \<Leftarrow> \<tau>" using st by argo
+  moreover have "\<Theta> \<turnstile> \<delta>' \<sim> \<Delta>'" using config_type_elims s1r by fast
+  ultimately show ?case using config_typeI **
+    by (meson s1r)
+next
+  case (reduce_let2_valI vb \<delta> x t v s)
+  then show ?case using preservation_let_val by meson
+next
+  case (reduce_varI u \<delta> \<Phi> \<tau>' v s)
+
+  hence ** : "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_var u \<tau>' v s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by meson
+  have uf: "atom u \<sharp> \<Delta>" using reduce_varI delta_sim_fresh by force  
+  hence *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_var u \<tau>' v s \<Leftarrow> \<tau>" and " \<Theta> \<turnstile> \<delta> \<sim> \<Delta>" using **  by auto
+
+  thus ?case using preservation_var reduce_varI config_typeI ** set_subset_Cons
+      setD_ConsD subsetI  by (metis delta_sim_fresh)
+
+next
+  case (reduce_assignI \<Phi> \<delta> u v )
+  hence *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_assign u v  \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by meson
+  then obtain z and \<tau>' where zt: "\<Theta> ; {||} ; GNil \<turnstile> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<lesssim> \<tau> \<and> (u,\<tau>') \<in> setD \<Delta> \<and> \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau>' \<and> \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>" 
+    using check_s_elims(8) by metis
+  hence "\<Theta> \<turnstile> update_d \<delta> u v \<sim> \<Delta>" using update_d_sim  * by metis
+  moreover have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_val (V_lit L_unit ) \<Leftarrow> \<tau>" using zt * check_s_v_unit check_s_wf
+    by auto
+  ultimately show ?case using config_typeI * by (meson order_refl)
+next
+  case (reduce_seq1I \<Phi> \<delta> s)
+  hence "\<Theta> ; \<Phi> ;   {||} ; GNil ; \<Delta> \<turnstile> s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using check_s_elims config_type_elims by force
+  then show ?case  using config_typeI by blast
+next
+  case (reduce_seq2I s1 v \<Phi> \<delta> \<delta>' s1' s2)
+  hence tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_seq s1 s2 \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by blast
+  then obtain z where zz: "\<Theta> ; \<Phi> ; {||} ; GNil; \<Delta>  \<turnstile> s1 \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<and>  \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> s2 \<Leftarrow> \<tau>" 
+    using check_s_elims by blast
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , s1 \<rangle> \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>)" 
+    using tt config_typeI tt by simp 
+  then obtain \<Delta>' where *: "\<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s1' \<rangle> \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<and> \<Delta> \<sqsubseteq> \<Delta>'" 
+    using reduce_seq2I by meson
+  moreover hence  s't: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> s1' \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<and> \<Theta> \<turnstile> \<delta>' \<sim> \<Delta>'" 
+    using config_type_elims by force
+  moreover hence "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using check_s_wf by meson
+  moreover hence  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> s2 \<Leftarrow> \<tau>" 
+    using calculation(1) zz check_s_d_weakening * by metis
+  moreover hence  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> (AS_seq s1' s2) \<Leftarrow> \<tau>" 
+    using check_seqI zz s't by meson 
+  ultimately have  "\<Theta>; \<Phi>; \<Delta>'  \<turnstile> \<langle> \<delta>' , AS_seq s1' s2 \<rangle> \<Leftarrow> \<tau> \<and> \<Delta> \<sqsubseteq> \<Delta>'"
+    using zz config_typeI tt  by meson
+  then show ?case by meson
+next
+  case (reduce_whileI x  s1 s2 z' \<Phi> \<delta> )
+
+  hence *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_while s1 s2  \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by meson
+
+  hence  **:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_while s1 s2  \<Leftarrow> \<tau>" by auto
+  hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x (\<lbrace> z' : B_bool  | TRUE \<rbrace>) s1 (AS_if (V_var x) (AS_seq s2 (AS_while s1 s2))  (AS_val (V_lit L_unit)) ) \<Leftarrow> \<tau>"
+    using check_while reduce_whileI by auto
+  thus ?case  using config_typeI *   by (meson subset_refl)
+
+next
+  case (reduce_caseI dc x' s' css \<Phi> \<delta> tyid  v)
+
+  hence **: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_match (V_cons tyid dc v) css \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
+    using config_type_elims[OF reduce_caseI(2)] by metis
+  hence ***: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_match (V_cons tyid  dc v) css \<Leftarrow> \<tau>" by auto
+
+  let ?vcons = "V_cons tyid dc v"
+
+  obtain dclist tid  and z::x where cv:  "\<Theta>; {||} ; GNil \<turnstile> (V_cons tyid dc v) \<Leftarrow> (\<lbrace> z : B_id tid | TRUE \<rbrace>) \<and> 
+    \<Theta>; \<Phi>; {||}; GNil; \<Delta> ; tid ; dclist ; (V_cons tyid dc v) \<turnstile> css \<Leftarrow> \<tau> \<and>  AF_typedef tid dclist \<in> set \<Theta> \<and> 
+ \<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>"
+    using check_s_elims(9)[OF ***] by metis
+
+  hence vi:" \<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>" by auto
+  obtain tcons where vi2:" \<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Rightarrow> tcons \<and> \<Theta> ; {||} ; GNil  \<turnstile> tcons \<lesssim>  \<lbrace> z : B_id tid  | TRUE \<rbrace>" 
+    using check_v_elims(1)[OF vi] by metis
+  hence vi1: "\<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Rightarrow> tcons" by auto
+
+  show ?case proof(rule infer_v_elims(4)[OF vi1],goal_cases)
+    case (1 dclist2 tc tv z2)
+    have "tyid = tid" using \<tau>.eq_iff using subtype_eq_base vi2 1 by fastforce 
+    hence deq:"dclist = dclist2"  using check_v_wf wfX_wfY cv 1  wfTh_dclist_unique by metis
+    have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>" proof(rule check_match(3))     
+      show \<open> \<Theta> ;  \<Phi> ;  {||} ; GNil ; \<Delta> ; tyid ; dclist ; ?vcons \<turnstile> css \<Leftarrow> \<tau>\<close> using \<open>tyid = tid\<close> cv by auto
+      show "distinct (map fst dclist)" using wfTh_dclist_distinct check_v_wf wfX_wfY cv by metis
+      show \<open>?vcons = V_cons tyid dc v\<close> by auto
+      show \<open>{||} = {||}\<close> by auto
+      show \<open>(dc, tc) \<in> set dclist\<close> using 1 deq by auto
+      show \<open>GNil = GNil\<close> by auto
+      show \<open>Some (AS_branch dc x' s') = lookup_branch dc css\<close> using reduce_caseI by auto
+      show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> tc\<close> using 1 check_v.intros by auto
+    qed
+    thus  ?case using config_typeI ** by blast
+  qed
+
+next
+  case (reduce_let_fstI \<Phi> \<delta> x v1 v2 s)
+  thus ?case using preservation_fst_snd order_refl by metis
+next
+  case (reduce_let_sndI  \<Phi> \<delta> x v1 v2 s)
+  thus ?case using preservation_fst_snd order_refl by metis
+next
+  case (reduce_let_concatI \<Phi> \<delta> x v1 v2 s)
+  hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_let x (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) s \<Leftarrow> \<tau> \<and> 
+                  \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by metis
+
+  obtain z::x where z: "atom z \<sharp> (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2)), GNil, CE_val (V_lit (L_bitvec (v1 @ v2))))" 
+    using obtain_fresh by metis
+
+  have "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil" using check_s_wf elim by auto
+
+  have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x (AE_val (V_lit (L_bitvec (v1 @ v2)))) s \<Leftarrow> \<tau>" proof(rule subtype_let)
+    show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let x (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) s \<Leftarrow> \<tau>\<close> using elim by auto
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) \<Rightarrow> \<lbrace> z : B_bitvec  | CE_val (V_var z)  == (CE_concat ([V_lit (L_bitvec v1)]\<^sup>c\<^sup>e) ([V_lit (L_bitvec v2)]\<^sup>c\<^sup>e))\<rbrace> \<close> 
+      (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e1 \<Rightarrow> ?t1")
+    proof
+      show \<open> \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_s_wf elim by auto
+      show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_s_wf elim by auto
+      show \<open> \<Theta> ; {||} ; GNil  \<turnstile> V_lit (L_bitvec v1) \<Rightarrow> \<lbrace> z : B_bitvec | CE_val (V_var z) == CE_val (V_lit (L_bitvec v1)) \<rbrace>\<close> 
+        using infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil by auto
+      show \<open> \<Theta> ; {||} ; GNil  \<turnstile> V_lit (L_bitvec v2) \<Rightarrow> \<lbrace> z : B_bitvec | CE_val (V_var z) == CE_val (V_lit (L_bitvec v2)) \<rbrace>\<close> 
+        using infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil by auto
+      show \<open>atom z \<sharp> AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))\<close> using z fresh_Pair by metis
+      show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
+    qed
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_val (V_lit (L_bitvec (v1 @ v2))) \<Rightarrow>  \<lbrace> z : B_bitvec  | CE_val (V_var z) == CE_val (V_lit (L_bitvec (v1 @ v2))) \<rbrace> \<close> 
+      (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e2 \<Rightarrow> ?t2")
+      using infer_e_valI infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil check_s_wf elim by metis
+    show \<open>\<Theta> ; {||} ; GNil  \<turnstile> ?t2 \<lesssim> ?t1\<close> using subtype_concat check_s_wf elim by auto
+  qed
+
+  thus ?case  using config_typeI elim by (meson order_refl)
+next
+  case (reduce_let_lenI \<Phi> \<delta> x v s)
+  hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_let x (AE_len (V_lit (L_bitvec v))) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using check_s_elims config_type_elims by metis
+
+  then obtain t where t: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_len (V_lit (L_bitvec v)) \<Rightarrow> t"   using check_s_elims by meson
+
+  moreover then obtain z::x where  "t = \<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len ([V_lit (L_bitvec v)]\<^sup>c\<^sup>e)  \<rbrace>" using infer_e_elims by meson 
+
+  moreover obtain z'::x where "atom z' \<sharp> v" using obtain_fresh by metis
+  moreover have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile>  AE_val (V_lit (L_num (int (length v)))) \<Rightarrow> \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_val (V_lit (L_num (int (length v))))  \<rbrace>" 
+    using infer_e_valI infer_v_litI infer_l.intros(3)  t  check_s_wf elim 
+    by (metis infer_l_form2 type_for_lit.simps(3))
+
+  moreover have "\<Theta> ; {||} ; GNil \<turnstile>   \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_val (V_lit (L_num (int (length v))))  \<rbrace> \<lesssim> 
+                           \<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e  \<rbrace>" using subtype_len check_s_wf elim by auto
+
+  ultimately have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile>  AS_let x (AE_val (V_lit (L_num (int (length v)))))  s \<Leftarrow> \<tau>" using subtype_let by (meson elim)
+  thus ?case  using config_typeI elim by (meson order_refl)
+next
+  case (reduce_let_splitI n v v1 v2 \<Phi> \<delta> x s)
+  hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_let x (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n))) s \<Leftarrow> \<tau> \<and> 
+                  \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by metis
+
+  obtain z::x where z: "atom z \<sharp> (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n)), GNil, CE_val (V_lit (L_bitvec (v1 @ v2))), 
+([ L_bitvec v1 ]\<^sup>v, [ L_bitvec v2 ]\<^sup>v), \<Theta>, {||}::bv fset)" 
+    using obtain_fresh by metis
+
+  have *:"\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil" using check_s_wf elim by auto
+
+  have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x (AE_val (V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2)))) s \<Leftarrow> \<tau>" proof(rule subtype_let)
+
+    show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let x (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n))) s \<Leftarrow> \<tau>\<close> using elim by auto
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n))) \<Rightarrow> \<lbrace> z : B_pair B_bitvec B_bitvec  
+                 |   ((CE_val (V_lit (L_bitvec v))) == (CE_concat (CE_fst (CE_val (V_var z))) (CE_snd (CE_val (V_var z)))))
+                  AND (((CE_len (CE_fst (CE_val (V_var z))))) == (CE_val (V_lit (L_num n)))) \<rbrace> \<close> 
+      (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e1 \<Rightarrow> ?t1") 
+    proof
+      show \<open> \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_s_wf elim by auto
+      show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_s_wf elim by auto
+      show \<open> \<Theta> ; {||} ; GNil  \<turnstile> V_lit (L_bitvec v) \<Rightarrow> \<lbrace> z : B_bitvec | CE_val (V_var z) == CE_val (V_lit (L_bitvec v)) \<rbrace>\<close> 
+        using infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil by auto
+      show "\<Theta> ; {||} ; GNil  \<turnstile> ([ L_num
+                           n ]\<^sup>v) \<Leftarrow> \<lbrace> z : B_int  | (([ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e)  ==  ([ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e))   AND  [ leq [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e [| [ [ L_bitvec
+                   v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>" using split_n  reduce_let_splitI check_v_num_leq * wfX_wfY  by metis
+      show \<open>atom z \<sharp> AE_split [ L_bitvec v ]\<^sup>v [ L_num n ]\<^sup>v\<close> using z fresh_Pair by auto
+      show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
+      show \<open>atom z \<sharp> AE_split [ L_bitvec v ]\<^sup>v [ L_num n ]\<^sup>v\<close> using z fresh_Pair by auto
+      show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
+      show \<open>atom z \<sharp> AE_split [ L_bitvec v ]\<^sup>v [ L_num n ]\<^sup>v\<close> using z fresh_Pair by auto
+      show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
+    qed
+
+    show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_val (V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) \<Rightarrow>  \<lbrace> z : B_pair B_bitvec  B_bitvec  | CE_val (V_var z) == CE_val ((V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2)))) \<rbrace> \<close> 
+      (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e2 \<Rightarrow> ?t2")
+      apply(rule infer_e_valI)
+      using check_s_wf elim apply metis
+      using check_s_wf elim apply metis      
+      apply(rule infer_v_pair2I)
+      using z fresh_prodN apply metis
+      using z fresh_GNil fresh_prodN apply metis
+      using  infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close> b_of.simps  apply blast+
+      using b_of.simps apply simp+
+      done
+    show \<open>\<Theta> ; {||} ; GNil  \<turnstile> ?t2 \<lesssim> ?t1\<close> using subtype_split check_s_wf elim reduce_let_splitI by auto
+  qed
+
+  thus ?case  using config_typeI elim by (meson order_refl)
+next
+  case (reduce_assert1I \<Phi> \<delta> c v)
+
+  hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c [v]\<^sup>s   \<Leftarrow> \<tau> \<and> 
+                  \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims reduce_assert1I by metis
+  hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c [v]\<^sup>s   \<Leftarrow> \<tau>" by auto
+
+  have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  [v]\<^sup>s   \<Leftarrow> \<tau>" using  check_assert_s *  by metis
+  thus  ?case using elim config_typeI  by blast
+next
+  case (reduce_assert2I \<Phi> \<delta> s \<delta>' s' c)
+
+  hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c s  \<Leftarrow> \<tau> \<and> 
+                  \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
+    using config_type_elims by metis
+  hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c s   \<Leftarrow> \<tau>" by auto
+
+  have  cv: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s   \<Leftarrow> \<tau> \<and> \<Theta> ; {||} ; GNil  \<Turnstile> c " using check_assert_s *  by metis
+
+  hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>" using elim config_typeI by simp
+  then obtain \<Delta>' where D: "\<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s' \<rangle> \<Leftarrow> \<tau>  \<and> \<Delta> \<sqsubseteq> \<Delta>'" using reduce_assert2I by metis
+  hence **:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>' \<turnstile> s' \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta>' \<sim> \<Delta>'" using config_type_elims by metis
+
+  obtain x::x where x:"atom x \<sharp> (\<Theta>, \<Phi>, ({||}::bv fset), GNil, \<Delta>', c, \<tau>, s')" using obtain_fresh by metis
+
+  have *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> AS_assert c s'  \<Leftarrow> \<tau>" proof
+    show "atom x \<sharp> (\<Theta>, \<Phi>, {||}, GNil, \<Delta>', c, \<tau>, s')" using x by auto
+    have "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f c" using * check_s_wf by auto
+    hence wfg:"\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> GNil" using wfC_wfG wfB_boolI check_s_wf *  fresh_GNil by auto
+    moreover have cs: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>' \<turnstile> s' \<Leftarrow> \<tau>" using ** by auto
+    ultimately show  "\<Theta> ; \<Phi> ; {||} ; (x, B_bool, c) #\<^sub>\<Gamma> GNil ; \<Delta>'  \<turnstile> s' \<Leftarrow> \<tau>" using check_s_g_weakening(1)[OF cs _ wfg]   toSet.simps  by simp
+    show "\<Theta> ; {||} ; GNil  \<Turnstile> c " using cv by auto
+    show "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>' " using check_s_wf ** by auto
+  qed
+
+  thus  ?case using elim config_typeI D ** by metis
+qed
+
+lemma preservation_many: 
+  assumes " \<Phi>  \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow>\<^sup>* \<langle> \<delta>' , s' \<rangle>"
+  shows "\<Theta>; \<Phi>; \<Delta> \<turnstile>  \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau> \<Longrightarrow> \<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s' \<rangle> \<Leftarrow> \<tau> \<and> \<Delta> \<sqsubseteq> \<Delta>'" 
+  using assms proof(induct arbitrary: \<Delta> rule: reduce_stmt_many.induct)
+  case (reduce_stmt_many_oneI \<Phi> \<delta> s \<delta>' s')
+  then show ?case using preservation by simp
+next
+  case (reduce_stmt_many_manyI \<Phi> \<delta> s \<delta>' s' \<delta>'' s'')
+  then show ?case using preservation subset_trans by metis
+qed
+
+section \<open>Progress\<close>
+text \<open>We prove that a well typed program is either a value or we can make a step\<close>
+
+lemma check_let_op_infer:
+  assumes  "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>   \<turnstile> LET x = (AE_op opp v1 v2) IN s \<Leftarrow> \<tau>" and "supp ( LET x = (AE_op opp v1 v2) IN s) \<subseteq> atom`fst`setD \<Delta>"
+  shows  "\<exists> z b c. \<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile>  (AE_op opp v1 v2) \<Rightarrow> \<lbrace>z:b|c\<rbrace>"
+proof - 
+  have xx: "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile> LET x = (AE_op opp v1 v2) IN s \<Leftarrow> \<tau>" using assms by simp
+  then show ?thesis using check_s_elims(2)[OF xx] by meson
+qed
+
+lemma infer_pair:
+  assumes "\<Theta> ; B; \<Gamma> \<turnstile>  v  \<Rightarrow> \<lbrace> z : B_pair b1 b2  | c \<rbrace>" and "supp v = {}"
+  obtains v1 and v2 where "v = V_pair v1 v2" 
+  using assms proof(nominal_induct v rule: v.strong_induct)
+  case (V_lit x)
+  then show ?case by auto
+next
+  case (V_var x)
+  then show ?case using v.supp supp_at_base by auto
+next
+  case (V_pair x1a x2a)
+  then show ?case by auto
+next
+  case (V_cons x1a x2a x3)
+  then show ?case by auto
+next
+  case (V_consp x1a x2a x3 x4)
+  then show ?case by auto
+qed
+
+lemma progress_fst:
+  assumes  "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>  \<turnstile> LET x = (AE_fst v) IN s \<Leftarrow> \<tau>" and  "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and 
+    "supp (LET x = (AE_fst v) IN s)  \<subseteq> atom`fst`setD \<Delta>"
+  shows "\<exists>\<delta>' s'. \<Phi>  \<turnstile> \<langle> \<delta> , LET x = (AE_fst v) IN s \<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>"
+proof -
+  have *:"supp v = {}" using assms s_branch_s_branch_list.supp by auto
+  obtain z and b and c where "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile>  (AE_fst v ) \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" 
+    using check_s_elims(2)  using assms by meson
+  moreover obtain z' and b' and c' where "\<Theta> ; {||} ; \<Gamma> \<turnstile>  v  \<Rightarrow> \<lbrace> z' : B_pair b b'  | c' \<rbrace>" 
+    using infer_e_elims(8)  using calculation by auto 
+  moreover then obtain v1 and v2 where "V_pair v1 v2 = v" 
+    using * infer_pair by metis
+  ultimately show ?thesis using reduce_let_fstI assms  by metis
+qed
+
+lemma progress_let:
+  assumes "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile> LET x = e IN s \<Leftarrow> \<tau>" and "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and 
+    "supp (LET x = e IN s) \<subseteq> atom ` fst ` setD \<Delta>" and "sble \<Theta> \<Gamma>"
+  shows "\<exists>\<delta>' s'. \<Phi>  \<turnstile> \<langle> \<delta> , LET x = e IN s\<rangle> \<longrightarrow> \<langle> \<delta>' , s'\<rangle>"
+proof -
+  obtain z b c where *: "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>  \<turnstile> e \<Rightarrow> \<lbrace> z : b  | c \<rbrace> " using check_s_elims(2)[OF assms(1)] by metis
+  have **: "supp e \<subseteq> atom ` fst ` setD \<Delta>" using assms s_branch_s_branch_list.supp by auto
+  from * ** assms show ?thesis proof(nominal_induct "\<lbrace> z : b  | c \<rbrace>"  rule: infer_e.strong_induct)
+    case (infer_e_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v)
+    then show ?case using reduce_stmt_elims reduce_let_valI by metis
+  next
+    case (infer_e_plusI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+    hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
+    then obtain n1 and n2 where *: "v1 = V_lit (L_num n1)  \<and> v2 = (V_lit (L_num n2))" using infer_int infer_e_plusI by metis
+    then show ?case using reduce_let_plusI * by metis
+  next
+    case (infer_e_leqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+    hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
+    then obtain n1 and n2 where *: "v1 = V_lit (L_num n1)  \<and> v2 = (V_lit (L_num n2))" using infer_int infer_e_leqI by metis
+    then show ?case using reduce_let_leqI * by metis
+  next
+    case (infer_e_eqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 bb c1 v2 z2 c2 z3)
+    hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
+    then obtain n1 and n2 where *: "v1 = V_lit n1  \<and> v2 = (V_lit n2)" using infer_lit infer_e_eqI by metis
+    then show ?case using reduce_let_eqI by blast
+  next
+    case (infer_e_appI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau>' s' v)
+    then show ?case using reduce_let_appI by metis
+  next
+    case (infer_e_appPI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>' s' v)
+    then show ?case using reduce_let_appPI by metis
+  next
+    case (infer_e_fstI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b2 c z)
+    hence "supp v = {}" by force
+    then obtain v1 and v2 where "v = V_pair v1 v2" using infer_e_fstI infer_pair by metis
+    then show ?case using reduce_let_fstI * by metis
+  next
+    case (infer_e_sndI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b1 c z)
+    hence "supp v = {}" by force
+    then obtain v1 and v2 where "v = V_pair v1 v2" using infer_e_sndI infer_pair by metis
+    then show ?case using reduce_let_sndI * by metis
+  next
+    case (infer_e_lenI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' c za)
+    hence "supp v = {}" by force
+    then obtain bvec where "v = V_lit (L_bitvec bvec)" using infer_e_lenI infer_bitvec by metis
+    then show ?case using reduce_let_lenI * by metis
+  next
+    case (infer_e_mvarI \<Theta> \<B> \<Gamma> \<Phi> \<Delta> u)
+    hence "(u, \<lbrace> z : b  | c \<rbrace>) \<in> setD \<Delta>" using infer_e_elims(10) by meson
+    then obtain v where "(u,v) \<in> set \<delta>" using infer_e_mvarI delta_sim_delta_lookup by meson
+    then show ?case using reduce_let_mvar by metis
+  next
+    case (infer_e_concatI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+    hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
+    then obtain n1 and n2 where *: "v1 = V_lit (L_bitvec n1)  \<and> v2 = (V_lit (L_bitvec n2))" using infer_bitvec infer_e_concatI by metis
+    then show ?case using reduce_let_concatI * by metis
+  next
+    case (infer_e_splitI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+    hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
+    then obtain n1 and n2 where *: "v1 = V_lit (L_bitvec n1)  \<and> v2 = (V_lit (L_num n2))" using infer_bitvec infer_e_splitI check_int by metis
+
+    have "0 \<le> n2 \<and> n2 \<le> int (length n1)" using  check_v_range[OF _ * ]   infer_e_splitI by simp
+    then obtain bv1 and bv2 where "split n2 n1 (bv1 , bv2)" using obtain_split by metis
+    then show ?case using reduce_let_splitI * by metis
+  qed
+qed 
+
+lemma check_css_lookup_branch_exist:
+  fixes s::s and cs::branch_s and css::branch_list and v::v
+  shows 
+    "\<Theta>; \<Phi>; B; G; \<Delta> \<turnstile>  s \<Leftarrow> \<tau> \<Longrightarrow> True" and 
+    "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
+    "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid; dclist; v \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> (dc, t) \<in> set dclist \<Longrightarrow>  
+              \<exists>x' s'. Some (AS_branch dc x' s') = lookup_branch dc css"
+proof(nominal_induct \<tau> and \<tau> and \<tau>  rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau> dclist css)
+  then show ?case  using lookup_branch.simps check_branch_list_finalI by force
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau>)
+  then show ?case  using lookup_branch.simps check_branch_list_finalI by force
+qed(auto+)
+
+lemma progress_aux:  
+  shows    "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s \<Leftarrow> \<tau> \<Longrightarrow> \<B> = {||} \<Longrightarrow>  sble \<Theta> \<Gamma> \<Longrightarrow> supp s \<subseteq> atom ` fst ` setD \<Delta> \<Longrightarrow> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<Longrightarrow> 
+               (\<exists>v. s = [v]\<^sup>s) \<or> (\<exists>\<delta>' s'. \<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>)" and
+    "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>; tid; dc; const; v2 \<turnstile> cs \<Leftarrow> \<tau>  \<Longrightarrow> supp cs = {} \<Longrightarrow> True " 
+    "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>; tid; dclist; v2 \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> supp css = {} \<Longrightarrow> True " 
+proof(induct  rule: check_s_check_branch_s_check_branch_list.inducts)
+  case (check_valI \<Delta> \<Theta> \<Gamma> v \<tau>' \<tau>)
+  then show ?case by auto
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  hence "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>   \<turnstile>   AS_let x e s \<Leftarrow> \<tau>" using Typing.check_letI by meson
+  then show ?case using progress_let check_letI by metis
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
+  then show ?case by auto
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> css)
+  then show ?case by auto
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
+  then show ?case by auto
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  have "supp v = {}" using check_ifI s_branch_s_branch_list.supp by auto
+  hence "v = V_lit L_true \<or> v = V_lit L_false" using  check_bool_options check_ifI by auto
+  then show ?case using reduce_if_falseI reduce_if_trueI check_ifI by meson
+next
+  case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2 )
+  then consider  " (\<exists>v. s1 = AS_val v)" | "(\<exists>\<delta>' a. \<Phi>  \<turnstile> \<langle>\<delta>, s1\<rangle> \<longrightarrow> \<langle>\<delta>', a\<rangle>)" by auto
+  then show ?case proof(cases)
+    case 1
+    then show ?thesis using reduce_let2_valI by fast
+  next
+    case 2
+    then show ?thesis using reduce_let2I check_let2I by meson
+  qed
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+
+  obtain uu::u where uf: "atom uu \<sharp> (u,\<delta>,s) " using obtain_fresh by blast
+  obtain sa where " (uu \<leftrightarrow> u ) \<bullet> s = sa" by presburger
+  moreover have "atom uu \<sharp> s" using uf fresh_prod3 by auto
+  ultimately have "AS_var uu \<tau>' v sa = AS_var u \<tau>' v s" using s_branch_s_branch_list.eq_iff(7) Abs1_eq_iff(3)[of uu sa u s] by auto
+
+  moreover have "atom uu \<sharp> \<delta>" using uf fresh_prod3 by auto
+  ultimately have "\<Phi> \<turnstile> \<langle>\<delta>, AS_var u \<tau>' v s\<rangle> \<longrightarrow> \<langle>(uu, v) # \<delta>, sa\<rangle>"
+    using reduce_varI uf by metis
+  then show ?case by auto
+next
+  case (check_assignI \<Delta> u \<tau> P G v z \<tau>')
+  then show ?case using reduce_assignI by blast
+next
+  case (check_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>')
+  obtain x::x where "atom x \<sharp> (s1,s2)" using obtain_fresh by metis
+  moreover obtain z::x where "atom z \<sharp> x" using obtain_fresh by metis
+  ultimately show ?case using reduce_whileI by fast
+next
+  case (check_seqI P \<Phi> \<B> G \<Delta> s1 z s2 \<tau>)
+  thus  ?case proof(cases "\<exists>v. s1 = AS_val v")
+    case True
+    then obtain v where v: "s1 = AS_val v" by blast
+    hence "supp v = {}" using check_seqI by auto
+    have "\<exists>z1 c1. P; \<B>; G \<turnstile> v \<Rightarrow> (\<lbrace> z1 : B_unit | c1 \<rbrace>)" proof - 
+      obtain t where t:"P; \<B>; G \<turnstile> v \<Rightarrow> t \<and> P; \<B> ; G \<turnstile> t \<lesssim> (\<lbrace> z : B_unit | TRUE \<rbrace>)"  
+        using v check_seqI(1) check_s_elims(1) by blast
+      obtain z1 and b1 and c1 where teq: "t =  (\<lbrace> z1 : b1 | c1 \<rbrace>)" using obtain_fresh_z by meson
+      hence "b1 = B_unit" using subtype_eq_base t by meson
+      thus ?thesis using t teq by fast
+    qed
+    then obtain z1 and c1 where "P ; \<B> ; G \<turnstile> v \<Rightarrow> (\<lbrace> z1 : B_unit | c1 \<rbrace>)" by auto
+    hence "v = V_lit L_unit" using infer_v_unit_form \<open>supp v = {}\<close> by simp
+    hence "s1 = AS_val (V_lit L_unit)" using v by auto
+    then show ?thesis using check_seqI reduce_seq1I by meson
+  next
+    case False
+    then show ?thesis using check_seqI reduce_seq2I 
+      by (metis Un_subset_iff s_branch_s_branch_list.supp(9))
+  qed
+
+next
+  case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>  z)
+  hence "supp v = {}" by auto
+
+  then obtain v' and dc and t::\<tau> where v: "v = V_cons tid dc v' \<and> (dc, t) \<in> set dclist" 
+    using  check_v_tid_form check_caseI by metis
+  obtain z and b and c where teq: "t = (\<lbrace> z : b | c \<rbrace>)" using obtain_fresh_z by meson
+
+  moreover then obtain x' s' where  "Some (AS_branch dc x' s') = lookup_branch dc cs" using  v teq check_caseI check_css_lookup_branch_exist by metis
+  ultimately show ?case using reduce_caseI v check_caseI dc_of.cases by metis
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  hence sps: "supp s \<subseteq> atom ` fst ` setD \<Delta>" by auto
+  have "atom x \<sharp> c " using check_assertI by auto
+  have "atom x \<sharp> \<Gamma>" using check_assertI check_s_wf wfG_elims by metis
+  have "sble \<Theta> ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>)" proof -
+    obtain i' where i':" i' \<Turnstile> \<Gamma>  \<and>  \<Theta>; \<Gamma> \<turnstile> i'" using check_assertI sble_def by metis
+    obtain i::valuation where i:"i = i' ( x \<mapsto> SBool True)" by auto
+
+    have "i \<Turnstile> (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>" proof -
+      have "i' \<Turnstile> c" using valid.simps i'  check_assertI by metis
+      hence "i \<Turnstile> c" using is_satis_weakening_x i \<open>atom x \<sharp> c\<close> by auto
+      moreover have "i \<Turnstile> \<Gamma>"  using is_satis_g_weakening_x i' i  check_assertI \<open>atom x \<sharp> \<Gamma>\<close> by metis
+      ultimately show ?thesis   using is_satis_g.simps i by auto
+    qed
+    moreover have "\<Theta> ; ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<turnstile> i" proof(rule  wfI_cons)
+      show \<open> i' \<Turnstile> \<Gamma> \<close> using i' by auto
+      show \<open> \<Theta> ; \<Gamma> \<turnstile> i'\<close> using i' by auto
+      show \<open>i = i'(x \<mapsto> SBool True)\<close> using i by auto
+      show \<open> \<Theta>  \<turnstile> SBool True: B_bool\<close> using wfRCV_BBoolI by auto
+      show \<open>atom x \<sharp> \<Gamma>\<close> using check_assertI check_s_wf wfG_elims by auto
+    qed
+    ultimately show  ?thesis using sble_def by auto
+  qed
+  then consider "(\<exists>v. s = [v]\<^sup>s)" | "(\<exists>\<delta>' a.  \<Phi>  \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle> \<delta>', a\<rangle>)" using check_assertI sps by metis
+  hence "(\<exists>\<delta>' a.  \<Phi>  \<turnstile> \<langle>\<delta>, ASSERT c IN s\<rangle> \<longrightarrow> \<langle>\<delta>', a\<rangle>)" proof(cases)
+    case 1
+    then show ?thesis using reduce_assert1I by metis
+  next
+    case 2
+    then show ?thesis using reduce_assert2I by metis
+  qed  
+  thus ?case by auto
+qed
+
+lemma progress:
+  assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>" 
+  shows "(\<exists>v. s = [v]\<^sup>s) \<or> (\<exists>\<delta>' s'. \<Phi>  \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>)"
+proof -
+  have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> s \<Leftarrow> \<tau>" and "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>"
+    using config_type_elims[OF assms(1)] by auto+
+  moreover hence "supp s \<subseteq> atom ` fst ` setD \<Delta>" using check_s_wf wfS_supp by fastforce
+  moreover have "sble \<Theta> GNil" using sble_def wfI_def is_satis_g.simps by simp
+  ultimately show  ?thesis using progress_aux by blast
+qed
+
+section \<open>Safety\<close>
+
+lemma  safety_stmt:
+  assumes "\<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>', s'\<rangle>" and "\<Theta>; \<Phi>; \<Delta> \<turnstile>  \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>"
+  shows  "(\<exists>v. s' = [v]\<^sup>s) \<or> (\<exists>\<delta>'' s''. \<Phi>  \<turnstile> \<langle>\<delta>', s'\<rangle> \<longrightarrow> \<langle>\<delta>'', s''\<rangle>)"  
+  using preservation_many progress assms  by meson
+
+lemma safety:
+  assumes "\<turnstile> \<langle>PROG \<Theta> \<Phi> \<G> s\<rangle> \<Leftarrow> \<tau>" and  "\<Phi>  \<turnstile> \<langle>\<delta>_of \<G>, s\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>', s'\<rangle>"
+  shows  "(\<exists>v. s' = [v]\<^sup>s) \<or> (\<exists>\<delta>'' s''. \<Phi>  \<turnstile> \<langle>\<delta>', s'\<rangle> \<longrightarrow> \<langle>\<delta>'', s''\<rangle>)"   
+  using assms config_type_prog_elims safety_stmt by metis
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/SubstMethods.thy b/thys/MiniSail/SubstMethods.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/SubstMethods.thy
@@ -0,0 +1,71 @@
+theory SubstMethods
+  (* Its seems that it's best to load the Eisbach tools last *)
+  imports  IVSubst WellformedL "HOL-Eisbach.Eisbach_Tools" 
+begin
+
+text \<open>
+ See Eisbach/Examples.thy as well as Eisbach User Manual.
+
+Freshness for various substitution situations. It seems that if undirected and we throw all the 
+facts at them to try to solve in one shot, the automatic methods are *sometimes*  unable
+to handle the different variants, so some guidance is needed. 
+First we split into subgoals using fresh\_prodN and intro conjI
+
+The 'add', for example, will be induction premises that will contain freshness facts or freshness conditions from
+prior obtains
+
+Use different arguments for different things or just lump into one bucket\<close>
+
+method fresh_subst_mth_aux uses add = (
+    (match conclusion in  "atom z \<sharp> (\<Gamma>::\<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v" for z x v \<Gamma>  \<Rightarrow> \<open>auto simp add: fresh_subst_gv_if[of "atom z" \<Gamma> v x] add\<close>)
+  | (match conclusion in  "atom z \<sharp> (v'::v)[x::=v]\<^sub>v\<^sub>v" for z x v v' \<Rightarrow> \<open>auto simp add: v.fresh fresh_subst_v_if pure_fresh subst_v_v_def  add\<close> )
+  | (match conclusion in  "atom z \<sharp> (ce::ce)[x::=v]\<^sub>c\<^sub>e\<^sub>v" for z x v ce \<Rightarrow> \<open>auto simp add: fresh_subst_v_if subst_v_ce_def  add\<close> )
+  | (match conclusion in  "atom z \<sharp> (\<Delta>::\<Delta>)[x::=v]\<^sub>\<Delta>\<^sub>v" for z x v \<Delta> \<Rightarrow> \<open>auto simp add: fresh_subst_v_if fresh_subst_dv_if  add\<close> )
+  | (match conclusion in  "atom z \<sharp> \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>" for z x v \<Gamma>' \<Gamma> \<Rightarrow> \<open>metis  add \<close> )
+  | (match conclusion in  "atom z \<sharp> (\<tau>::\<tau>)[x::=v]\<^sub>\<tau>\<^sub>v" for z x v \<tau> \<Rightarrow> \<open>auto simp add: v.fresh fresh_subst_v_if pure_fresh subst_v_\<tau>_def  add\<close> )
+  | (match conclusion in  "atom z \<sharp> ({||} :: bv fset)" for z  \<Rightarrow> \<open>auto simp add: fresh_empty_fset\<close>)
+    (* tbc delta and types *)
+  | (auto simp add: add x_fresh_b pure_fresh) (* Cases where there is no subst and so can most likely get what we want from induction premises *)
+    )
+
+method fresh_mth uses add = (
+    (unfold fresh_prodN, intro conjI)?,
+    (fresh_subst_mth_aux add: add)+)
+
+
+notepad
+begin
+  fix \<Gamma>::\<Gamma> and z::x and x::x and v::v and \<Theta>::\<Theta> and v'::v and w::x and tyid::string and dc::string and b::b and ce::ce and bv::bv
+
+  assume as:"atom z \<sharp> (\<Gamma>,v',\<Theta>, v,w,ce) \<and> atom bv \<sharp>  (\<Gamma>,v',\<Theta>, v,w,ce,b) "
+
+  have "atom z \<sharp> \<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v" 
+    by (fresh_mth add: as)
+
+  hence "atom z \<sharp> v'[x::=v]\<^sub>v\<^sub>v" 
+    by (fresh_mth add: as)
+
+  hence "atom z \<sharp> \<Gamma>" 
+    by (fresh_mth add: as)
+
+  hence "atom z \<sharp> \<Theta>" 
+    by (fresh_mth add: as)
+
+  hence "atom z \<sharp>  (CE_val v == ce)[x::=v]\<^sub>c\<^sub>v"
+    using as by auto
+
+  hence "atom bv \<sharp>  (CE_val v == ce)[x::=v]\<^sub>c\<^sub>v"
+    using as by auto
+
+  have "atom z \<sharp> (\<Theta>,\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v,v'[x::=v]\<^sub>v\<^sub>v,w, V_pair v v, V_consp tyid dc b v, (CE_val v == ce)[x::=v]\<^sub>c\<^sub>v) " 
+    by (fresh_mth add: as)
+
+  have "atom bv \<sharp> (\<Theta>,\<Gamma>[x::=v]\<^sub>\<Gamma>\<^sub>v,v'[x::=v]\<^sub>v\<^sub>v,w, V_pair v v, V_consp tyid dc b v) " 
+    by (fresh_mth add: as)
+
+end
+
+
+
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/Syntax.thy b/thys/MiniSail/Syntax.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Syntax.thy
@@ -0,0 +1,1174 @@
+(*<*)
+theory Syntax
+  imports "Nominal2.Nominal2" "Nominal-Utils"
+begin
+  (*>*)
+
+chapter \<open>Syntax\<close>
+
+text \<open>Syntax of MiniSail programs and the contexts we use in judgements.\<close>
+
+section \<open>Program Syntax\<close>
+
+subsection \<open>AST Datatypes\<close>
+
+type_synonym num_nat = nat
+
+atom_decl x  (* Immutable variables*)
+atom_decl u  (* Mutable variables *)
+atom_decl bv  (* Basic-type variables *)
+
+type_synonym f = string  (* Function name *)
+type_synonym dc = string (* Data constructor *)
+type_synonym tyid = string
+
+text \<open>Basic types. Types without refinement constraints\<close>
+nominal_datatype "b" =  
+  B_int | B_bool | B_id tyid 
+| B_pair b b  ("[ _ , _ ]\<^sup>b")
+| B_unit | B_bitvec | B_var bv
+| B_app tyid b
+
+nominal_datatype bit = BitOne | BitZero
+
+text  \<open> Literals \<close>
+nominal_datatype "l" = 
+  L_num "int" | L_true | L_false | L_unit  | L_bitvec "bit list"
+
+text  \<open> Values. We include a type identifier, tyid, in the literal for constructors 
+to make typing and well-formedness checking easier \<close>
+
+nominal_datatype "v" = 
+  V_lit "l"        ( "[ _ ]\<^sup>v")
+  | V_var "x"        ( "[ _ ]\<^sup>v")
+  | V_pair "v" "v"   ( "[ _ , _ ]\<^sup>v")
+  | V_cons tyid dc "v" 
+  | V_consp tyid dc b "v" 
+
+text \<open> Binary Operations \<close>
+nominal_datatype "opp" = Plus ( "plus") | LEq ("leq") | Eq ("eq")
+
+text \<open> Expressions \<close>
+nominal_datatype "e" = 
+  AE_val "v"           ( "[ _ ]\<^sup>e"       )
+  | AE_app "f" "v"       ( "[ _ ( _ ) ]\<^sup>e" )
+  | AE_appP  "f" "b" "v" ( "[_ [ _ ] ( _ )]\<^sup>e" )
+  | AE_op "opp" "v" "v"  ( "[ _ _ _ ]\<^sup>e"  )
+  | AE_concat v v        ( "[ _ @@ _ ]\<^sup>e" )
+  | AE_fst "v"           ( "[#1_ ]\<^sup>e"    )
+  | AE_snd "v"           ( "[#2_ ]\<^sup>e"     )
+  | AE_mvar "u"          ( "[ _ ]\<^sup>e"      )
+  | AE_len "v"           ( "[| _ |]\<^sup>e"    )
+  | AE_split "v" "v"     ( "[ _ / _ ]\<^sup>e"  )
+
+text \<open> Expressions for constraints\<close>
+nominal_datatype "ce" = 
+  CE_val "v"           ( "[ _ ]\<^sup>c\<^sup>e"      )
+  | CE_op "opp" "ce" "ce"  ( "[ _ _ _ ]\<^sup>c\<^sup>e"  )
+  | CE_concat ce ce        ( "[ _ @@ _ ]\<^sup>c\<^sup>e" )
+  | CE_fst "ce"           ( "[#1_]\<^sup>c\<^sup>e"      )
+  | CE_snd "ce"           ( "[#2_]\<^sup>c\<^sup>e"      )
+  | CE_len "ce"           ( "[| _ |]\<^sup>c\<^sup>e"    )
+
+text  \<open> Constraints \<close>
+nominal_datatype "c" = 
+  C_true          ( "TRUE" [] 50 )
+  | C_false         ( "FALSE" [] 50 )
+  | C_conj "c" "c"  ("_  AND  _ " [50, 50] 50) 
+  | C_disj "c" "c"  ("_ OR _ " [50,50] 50)
+  | C_not "c"       ( "\<not> _ " [] 50 )
+  | C_imp "c" "c"   ("_  IMP  _ " [50, 50] 50) 
+  | C_eq "ce" "ce"  ("_  ==  _ " [50, 50] 50) 
+
+text  \<open> Refined types \<close>
+nominal_datatype "\<tau>" = 
+  T_refined_type  x::x b c::c   binds x in c   ("\<lbrace> _ : _  | _ \<rbrace>" [50, 50] 1000)
+
+text \<open> Statements \<close>
+
+nominal_datatype 
+  s = 
+  AS_val v                             ( "[_]\<^sup>s")                  
+  | AS_let x::x  e s::s binds x in s     ( "(LET _ = _ IN _)")
+  | AS_let2 x::x \<tau>  s s::s binds x in s  ( "(LET _ : _ = _ IN _)")
+  | AS_if v s s                          ( "(IF _ THEN _ ELSE _)" [0, 61, 0] 61)
+  | AS_var u::u \<tau> v s::s  binds u in s   ( "(VAR _ : _ = _ IN _)")
+  | AS_assign u  v                       ( "(_ ::= _)")
+  | AS_match v branch_list               ( "(MATCH _ WITH { _ })")
+  | AS_while s s                         ( "(WHILE _ DO { _ } )" [0, 0] 61)     
+  | AS_seq s s                           ( "( _ ;; _ )"  [1000, 61] 61)
+  | AS_assert c s                        ( "(ASSERT _ IN _ )" )
+    and branch_s = 
+    AS_branch dc x::x s::s binds x in s  ( "( _ _ \<Rightarrow> _ )")   
+    and branch_list = 
+    AS_final  branch_s                   ( "{ _ }" )
+  | AS_cons  branch_s branch_list        ( "( _ | _  )")
+
+text \<open> Function and union type definitions \<close>
+
+nominal_datatype "fun_typ"  =
+  AF_fun_typ x::x "b" c::c \<tau>::\<tau> s::s binds x in c \<tau> s
+
+nominal_datatype "fun_typ_q" = 
+  AF_fun_typ_some bv::bv ft::fun_typ binds bv in ft
+  | AF_fun_typ_none fun_typ
+
+nominal_datatype "fun_def" =  AF_fundef f fun_typ_q 
+
+nominal_datatype "type_def" = 
+  AF_typedef string "(string * \<tau>) list"
+  |  AF_typedef_poly string bv::bv dclist::"(string * \<tau>) list"  binds bv in dclist
+
+lemma check_typedef_poly:
+  "AF_typedef_poly ''option'' bv [ (''None'', \<lbrace> zz : B_unit | TRUE \<rbrace>), (''Some'', \<lbrace> zz : B_var bv | TRUE \<rbrace>) ] = 
+    AF_typedef_poly ''option'' bv2 [ (''None'', \<lbrace> zz : B_unit | TRUE \<rbrace>), (''Some'', \<lbrace> zz : B_var bv2 | TRUE \<rbrace>) ]"
+  by auto
+
+nominal_datatype "var_def" =  AV_def u \<tau> v
+
+text  \<open> Programs \<close> 
+nominal_datatype "p" = 
+  AP_prog "type_def list" "fun_def list" "var_def list" "s" ("PROG _ _ _ _")
+
+declare l.supp [simp] v.supp [simp]  e.supp [simp] s_branch_s_branch_list.supp [simp]  \<tau>.supp [simp] c.supp [simp] b.supp[simp]
+
+subsection \<open>Lemmas\<close>
+
+text \<open>These lemmas deal primarily with freshness and alpha-equivalence\<close>
+
+subsubsection \<open>Atoms\<close>
+
+lemma x_not_in_u_atoms[simp]:
+  fixes u::u and x::x and us::"u set"
+  shows "atom x \<notin> atom`us"
+  by (simp add: image_iff)
+
+lemma x_fresh_u[simp]:
+  fixes u::u and x::x
+  shows "atom x \<sharp> u"
+  by auto
+
+lemma x_not_in_b_set[simp]:
+  fixes  x::x and bs::"bv fset"
+  shows "atom x \<notin> supp bs"
+  by(induct bs,auto, simp add: supp_finsert supp_at_base)
+
+lemma x_fresh_b[simp]:
+  fixes  x::x and b::b
+  shows "atom x \<sharp> b"
+  apply (induct b rule: b.induct, auto simp: pure_supp)
+  using pure_supp fresh_def by blast+
+
+lemma x_fresh_bv[simp]:
+  fixes  x::x and bv::bv
+  shows "atom x \<sharp> bv"
+  using fresh_def supp_at_base by auto
+
+lemma u_not_in_x_atoms[simp]:
+  fixes u::u and x::x and xs::"x set"
+  shows "atom u \<notin> atom`xs"
+  by (simp add: image_iff)
+
+lemma bv_not_in_x_atoms[simp]:
+  fixes bv::bv and x::x and xs::"x set"
+  shows "atom bv \<notin> atom`xs"
+  by (simp add: image_iff)
+
+lemma u_not_in_b_atoms[simp]:
+  fixes b :: b and u::u
+  shows "atom u \<notin> supp b"
+  by (induct b rule: b.induct,auto simp: pure_supp supp_at_base)
+
+lemma u_not_in_b_set[simp]:
+  fixes  u::u and bs::"bv fset"
+  shows "atom u \<notin> supp bs"
+  by(induct bs, auto simp add: supp_at_base supp_finsert)
+
+lemma u_fresh_b[simp]:
+  fixes  x::u and b::b
+  shows "atom x \<sharp> b"
+  by(induct b rule: b.induct, auto simp: pure_fresh )
+
+lemma supp_b_v_disjoint:
+  fixes x::x and bv::bv
+  shows "supp (V_var x) \<inter> supp (B_var bv) = {}" 
+  by (simp add: supp_at_base)
+
+lemma supp_b_u_disjoint[simp]:
+  fixes b::b and u::u
+  shows "supp u \<inter> supp b = {}" 
+  by(nominal_induct b rule:b.strong_induct,(auto simp add: pure_supp b.supp supp_at_base)+)
+
+lemma u_fresh_bv[simp]:
+  fixes  u::u and b::bv
+  shows "atom u \<sharp> b"
+  using fresh_at_base by simp
+
+subsubsection \<open>Basic Types\<close>
+
+nominal_function b_of :: "\<tau> \<Rightarrow> b" where
+  "b_of \<lbrace> z : b | c \<rbrace> = b"
+     apply(auto,simp add: eqvt_def b_of_graph_aux_def )
+  by (meson \<tau>.exhaust)
+nominal_termination (eqvt)  by lexicographic_order
+
+lemma supp_b_empty[simp]:
+  fixes b :: b and x::x
+  shows "atom x \<notin> supp b"
+  by (induct b rule: b.induct, auto simp: pure_supp supp_at_base x_not_in_b_set)
+
+lemma flip_b_id[simp]:
+  fixes x::x and b::b
+  shows "(x \<leftrightarrow> x') \<bullet> b = b"
+  by(rule flip_fresh_fresh, auto simp add: fresh_def)
+
+lemma flip_x_b_cancel[simp]:
+  fixes x::x and y::x  and b::b and bv::bv
+  shows "(x \<leftrightarrow> y) \<bullet> b = b" and "(x \<leftrightarrow> y) \<bullet> bv = bv"
+  using flip_b_id  apply simp
+  by (metis b.eq_iff(7) b.perm_simps(7) flip_b_id)
+
+lemma flip_bv_x_cancel[simp]:
+  fixes bv::bv and z::bv and x::x
+  shows "(bv \<leftrightarrow> z) \<bullet> x = x" using flip_fresh_fresh[of bv x z] fresh_at_base by auto
+
+lemma flip_bv_u_cancel[simp]:
+  fixes bv::bv and z::bv and x::u
+  shows "(bv \<leftrightarrow> z) \<bullet> x = x" using flip_fresh_fresh[of bv x z] fresh_at_base by auto
+
+subsubsection \<open>Literals\<close>
+
+lemma supp_bitvec_empty:
+  fixes bv::"bit list"
+  shows "supp bv = {}"
+proof(induct bv)
+  case Nil
+  then show ?case using supp_Nil by auto
+next
+  case (Cons a bv)
+  then show ?case using supp_Cons  bit.supp
+    by (metis (mono_tags, hide_lams) bit.strong_exhaust l.supp(5) sup_bot.right_neutral)
+qed
+
+lemma bitvec_pure[simp]:
+  fixes bv::"bit list" and x::x
+  shows "atom x \<sharp> bv" using fresh_def supp_bitvec_empty by auto
+
+lemma supp_l_empty[simp]:
+  fixes l:: l
+  shows "supp (V_lit l) = {}"
+  by(nominal_induct l rule: l.strong_induct,
+      auto simp add: l.strong_exhaust pure_supp v.fv_defs supp_bitvec_empty)
+
+lemma type_l_nosupp[simp]:
+  fixes x::x and l::l
+  shows "atom x \<notin> supp (\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e ==  [[l]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>)"
+  using supp_at_base supp_l_empty ce.supp(1) c.supp \<tau>.supp by force
+
+lemma flip_bitvec0:
+  fixes x::"bit list"
+  assumes "atom c \<sharp> (z, x, z')"
+  shows "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x"
+proof - 
+  have "atom z \<sharp> x" and "atom z' \<sharp> x"
+    using flip_fresh_fresh assms supp_bitvec_empty fresh_def by blast+
+  moreover have "atom c \<sharp> x" using  supp_bitvec_empty fresh_def by auto
+  ultimately show ?thesis  using assms flip_fresh_fresh by metis
+qed
+
+lemma flip_bitvec:
+  assumes "atom c \<sharp> (z, L_bitvec x, z')"
+  shows "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x"
+proof - 
+  have "atom z \<sharp> x" and "atom z' \<sharp> x"
+    using flip_fresh_fresh assms supp_bitvec_empty fresh_def by blast+
+  moreover have "atom c \<sharp> x" using  supp_bitvec_empty fresh_def by auto
+  ultimately show ?thesis  using assms flip_fresh_fresh by metis
+qed
+
+lemma type_l_eq:
+  shows "\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit l]\<^sup>c\<^sup>e \<rbrace> = (\<lbrace> z' : b  |  [[z']\<^sup>v]\<^sup>c\<^sup>e == [V_lit l]\<^sup>c\<^sup>e \<rbrace>)"
+  by(auto,nominal_induct l rule: l.strong_induct,auto, metis permute_pure, auto simp add: flip_bitvec)
+
+lemma flip_l_eq:
+  fixes x::l
+  shows "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x"
+proof - 
+  have "atom z \<sharp> x" and "atom c \<sharp> x" and "atom z' \<sharp> x"
+    using flip_fresh_fresh fresh_def supp_l_empty by fastforce+
+  thus ?thesis using flip_fresh_fresh by metis
+qed
+
+lemma flip_l_eq1:
+  fixes x::l
+  assumes  "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x'"
+  shows "x' = x"
+proof - 
+  have "atom z \<sharp> x" and "atom c \<sharp> x'" and "atom c \<sharp> x" and "atom z' \<sharp> x'"
+    using flip_fresh_fresh fresh_def supp_l_empty by fastforce+
+  thus ?thesis using flip_fresh_fresh assms by metis
+qed
+
+subsubsection \<open>Types\<close>
+
+lemma flip_base_eq:
+  fixes b::b and x::x and y::x                      
+  shows "(x \<leftrightarrow> y) \<bullet> b = b"
+  using b.fresh  by (simp add: flip_fresh_fresh fresh_def)
+
+text \<open> Obtain an alpha-equivalent type where the bound variable is fresh in some term t \<close>
+lemma has_fresh_z0:
+  fixes t::"'b::fs"
+  shows "\<exists>z. atom z \<sharp> (c',t) \<and> (\<lbrace>z' : b | c' \<rbrace>) = (\<lbrace> z : b | (z \<leftrightarrow> z' ) \<bullet> c' \<rbrace>)"
+proof -
+  obtain z::x where fr: "atom z \<sharp> (c',t)" using obtain_fresh by blast
+  moreover hence "(\<lbrace> z' : b | c' \<rbrace>) = (\<lbrace> z : b | (z \<leftrightarrow> z') \<bullet> c' \<rbrace>)"  
+    using \<tau>.eq_iff Abs1_eq_iff
+    by (metis flip_commute flip_fresh_fresh fresh_PairD(1))
+  ultimately show ?thesis by fastforce
+qed
+
+lemma has_fresh_z:
+  fixes t::"'b::fs"
+  shows "\<exists>z b c. atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b | c \<rbrace>"
+proof -
+  obtain z' and b and c' where teq: "\<tau> =  (\<lbrace> z' : b | c' \<rbrace>)" using \<tau>.exhaust by blast
+  obtain z::x where fr: "atom z \<sharp> (t,c')" using obtain_fresh by blast
+  hence "(\<lbrace> z' : b | c' \<rbrace>) = (\<lbrace> z : b | (z \<leftrightarrow> z') \<bullet> c' \<rbrace>)"  using \<tau>.eq_iff Abs1_eq_iff
+      flip_commute flip_fresh_fresh fresh_PairD(1)  by (metis fresh_PairD(2))
+  hence "atom z \<sharp> t \<and> \<tau> = (\<lbrace> z : b | (z \<leftrightarrow> z') \<bullet> c' \<rbrace>)" using fr teq by force
+  thus ?thesis using teq fr by fast
+qed
+
+lemma obtain_fresh_z:
+  fixes t::"'b::fs"
+  obtains z and b and c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b | c \<rbrace>"
+  using has_fresh_z by blast
+
+lemma has_fresh_z2:
+  fixes t::"'b::fs"
+  shows "\<exists>z c. atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b_of \<tau> | c \<rbrace>" 
+proof -
+  obtain z and b and c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b | c \<rbrace>" using obtain_fresh_z by metis
+  moreover then have "b_of \<tau> = b" using \<tau>.eq_iff by simp
+  ultimately show ?thesis using obtain_fresh_z \<tau>.eq_iff by auto
+qed
+
+lemma obtain_fresh_z2:
+  fixes t::"'b::fs"
+  obtains z and  c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b_of \<tau> | c \<rbrace>"
+  using has_fresh_z2 by blast
+
+subsubsection \<open>Values\<close>
+
+lemma u_notin_supp_v[simp]:
+  fixes u::u and v::v
+  shows "atom u \<notin> supp v" 
+proof(nominal_induct v rule: v.strong_induct)
+  case (V_lit l)
+  then show ?case  using supp_l_empty by auto
+next
+  case (V_var x)
+  then show ?case 
+    by (simp add: supp_at_base)
+next
+  case (V_pair v1 v2)
+  then show ?case by auto
+next
+  case (V_cons tyid list v)
+  then show ?case using pure_supp by auto
+next
+  case (V_consp tyid list b v)
+  then show ?case using pure_supp by auto
+qed
+
+lemma u_fresh_xv[simp]:
+  fixes u::u and x::x and v::v
+  shows "atom u \<sharp>  (x,v)"
+proof - 
+  have "atom u \<sharp> x" using fresh_def by fastforce
+  moreover have "atom u \<sharp> v" using fresh_def u_notin_supp_v by metis
+  ultimately show ?thesis using fresh_prod2 by auto
+qed
+
+text \<open> Part of an effort to make the proofs across inductive cases more uniform by distilling 
+the non-uniform parts into lemmas like this\<close>
+lemma v_flip_eq:
+  fixes v::v and va::v and x::x and c::x
+  assumes "atom c \<sharp> (v, va)" and "atom c \<sharp> (x, xa, v, va)" and "(x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> va" 
+  shows "((v = V_lit l \<longrightarrow> (\<exists>l'. va = V_lit l' \<and>  (x \<leftrightarrow> c) \<bullet> l = (xa \<leftrightarrow> c) \<bullet> l'))) \<and>
+         ((v = V_var y \<longrightarrow> (\<exists>y'. va = V_var y' \<and>  (x \<leftrightarrow> c) \<bullet> y = (xa \<leftrightarrow> c) \<bullet> y'))) \<and>
+         ((v = V_pair vone vtwo \<longrightarrow> (\<exists>v1' v2'. va = V_pair v1' v2' \<and>  (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1' \<and>  (x \<leftrightarrow> c) \<bullet> vtwo = (xa \<leftrightarrow> c) \<bullet> v2'))) \<and>
+         ((v = V_cons tyid dc vone \<longrightarrow> (\<exists>v1'. va = V_cons tyid dc v1'\<and>  (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1'))) \<and>
+         ((v = V_consp tyid dc b vone \<longrightarrow> (\<exists>v1'. va = V_consp tyid dc b v1'\<and>  (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1')))" 
+  using assms proof(nominal_induct v rule:v.strong_induct)
+  case (V_lit l)
+  then show ?case  using assms v.perm_simps 
+      empty_iff flip_def fresh_def fresh_permute_iff supp_l_empty swap_fresh_fresh v.fresh 
+    by (metis permute_swap_cancel2 v.distinct)
+next
+  case (V_var x)
+  then show ?case  using assms v.perm_simps 
+      empty_iff flip_def fresh_def fresh_permute_iff supp_l_empty swap_fresh_fresh v.fresh 
+    by (metis permute_swap_cancel2 v.distinct)
+next
+  case (V_pair v1 v2)
+  have " (V_pair v1 v2 = V_pair vone vtwo \<longrightarrow> (\<exists>v1' v2'. va = V_pair v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1' \<and> (x \<leftrightarrow> c) \<bullet> vtwo = (xa \<leftrightarrow> c) \<bullet> v2'))" proof
+    assume "V_pair v1 v2= V_pair vone vtwo"    
+    thus  "(\<exists>v1' v2'. va = V_pair v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1' \<and> (x \<leftrightarrow> c) \<bullet> vtwo = (xa \<leftrightarrow> c) \<bullet> v2')"
+      using V_pair assms 
+      by (metis (no_types, hide_lams) flip_def permute_swap_cancel v.perm_simps(3)) 
+  qed
+  thus ?case using V_pair by auto
+next
+  case (V_cons tyid dc v1)
+  have " (V_cons tyid dc v1 = V_cons tyid dc vone \<longrightarrow> (\<exists> v1'. va = V_cons tyid dc  v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1'))" proof
+    assume as: "V_cons tyid dc v1 = V_cons tyid dc  vone"    
+    hence "(x \<leftrightarrow> c) \<bullet>  (V_cons tyid dc  vone) =  V_cons tyid dc ((x \<leftrightarrow> c) \<bullet> vone)" proof -
+      have "(x \<leftrightarrow> c)  \<bullet> dc = dc" using pure_permute_id  by metis
+      moreover have "(x \<leftrightarrow> c)  \<bullet> tyid = tyid" using pure_permute_id  by metis
+      ultimately show ?thesis using v.perm_simps(4) by simp
+    qed
+    then obtain v1' where "(xa \<leftrightarrow> c) \<bullet> va = V_cons tyid dc v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using assms V_cons
+      using as by fastforce
+    hence " va = V_cons tyid dc ((xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using permute_flip_cancel empty_iff flip_def fresh_def supp_b_empty swap_fresh_fresh
+      by (metis pure_fresh v.perm_simps(4))
+
+    thus  "(\<exists>v1'. va = V_cons tyid dc  v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1')"
+      using V_cons assms by simp     
+  qed
+  thus ?case using V_cons by auto
+next
+  case (V_consp tyid dc b v1)
+  have " (V_consp tyid dc b v1 = V_consp tyid dc b vone \<longrightarrow> (\<exists> v1'. va = V_consp tyid dc  b v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1'))" proof
+    assume as: "V_consp tyid dc b v1 = V_consp tyid dc b vone"    
+    hence "(x \<leftrightarrow> c) \<bullet>  (V_consp tyid dc  b vone) =  V_consp tyid dc b ((x \<leftrightarrow> c) \<bullet> vone)" proof -
+      have "(x \<leftrightarrow> c)  \<bullet> dc = dc" using pure_permute_id  by metis
+      moreover have "(x \<leftrightarrow> c)  \<bullet> tyid = tyid" using pure_permute_id  by metis
+      ultimately show ?thesis using v.perm_simps(4) by simp
+    qed
+    then obtain v1' where "(xa \<leftrightarrow> c) \<bullet> va = V_consp tyid dc b v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using assms V_consp
+      using as by fastforce
+    hence " va = V_consp tyid dc b ((xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using permute_flip_cancel empty_iff flip_def fresh_def supp_b_empty swap_fresh_fresh
+        pure_fresh v.perm_simps 
+      by (metis (mono_tags, hide_lams))   
+    thus   "(\<exists>v1'. va = V_consp tyid dc  b v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1')"
+      using V_consp assms by simp     
+  qed
+  thus ?case using V_consp by auto
+qed
+
+lemma flip_eq:
+  fixes x::x and xa::x and s::"'a::fs" and sa::"'a::fs"
+  assumes "(\<forall>c. atom c \<sharp> (s, sa) \<longrightarrow> atom c \<sharp> (x, xa, s, sa) \<longrightarrow> (x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa)" and "x \<noteq> xa"
+  shows "(x \<leftrightarrow> xa) \<bullet> s = sa" 
+proof - 
+  have  " ([[atom x]]lst. s = [[atom xa]]lst. sa)" using assms Abs1_eq_iff_all by simp
+  hence  "(xa = x \<and> sa = s \<or> xa \<noteq> x \<and> sa = (xa \<leftrightarrow> x) \<bullet> s \<and> atom xa \<sharp> s)" using assms Abs1_eq_iff[of xa sa x s] by simp
+  thus ?thesis using assms
+    by (metis flip_commute)
+qed
+
+lemma  swap_v_supp:
+  fixes v::v and d::x and z::x
+  assumes "atom d \<sharp> v"
+  shows "supp ((z \<leftrightarrow> d ) \<bullet> v) \<subseteq> supp v - { atom z } \<union> { atom d}"
+  using assms
+proof(nominal_induct v rule:v.strong_induct)
+  case (V_lit l)
+  then show ?case using l.supp by (metis supp_l_empty empty_subsetI l.strong_exhaust pure_supp supp_eqvt v.supp)
+next
+  case (V_var x)
+  hence "d \<noteq> x" using fresh_def by fastforce
+  thus ?case apply(cases "z = x")  using   supp_at_base V_var \<open>d\<noteq>x\<close> by fastforce+
+next
+  case (V_cons tyid dc v)
+  show ?case using v.supp(4) pure_supp 
+    using V_cons.hyps V_cons.prems fresh_def by auto
+next
+  case (V_consp tyid dc b v)
+  show ?case using v.supp(4) pure_supp 
+    using V_consp.hyps V_consp.prems fresh_def by auto
+qed(force+)
+
+subsubsection \<open>Expressions\<close>
+
+lemma  swap_e_supp:
+  fixes e::e and d::x and z::x
+  assumes "atom d \<sharp> e"
+  shows "supp ((z \<leftrightarrow> d ) \<bullet> e) \<subseteq> supp e - { atom z } \<union> { atom d}"
+  using assms
+proof(nominal_induct e rule:e.strong_induct)
+  case (AE_val v)
+  then show ?case using swap_v_supp by simp
+next
+  case (AE_app f v)
+  then show ?case using swap_v_supp  by (simp add: pure_supp)
+next
+  case (AE_appP b f v)
+  hence df: "atom d \<sharp> v" using fresh_def e.supp by force
+  have  "supp ((z \<leftrightarrow> d ) \<bullet> (AE_appP b f v)) =  supp (AE_appP b f ((z \<leftrightarrow> d ) \<bullet> v))" using  e.supp 
+    by (metis b.eq_iff(3) b.perm_simps(3) e.perm_simps(3) flip_b_id)
+  also have "... = supp b \<union> supp f \<union> supp ((z \<leftrightarrow> d ) \<bullet> v)" using e.supp by auto
+  also have "... \<subseteq>  supp b \<union> supp f \<union> supp v  - { atom z } \<union> { atom d}" using swap_v_supp[OF df] pure_supp  by auto
+  finally show ?case using e.supp by auto
+next
+  case (AE_op opp v1 v2)
+  hence df: "atom d \<sharp> v1 \<and> atom d \<sharp> v2" using fresh_def e.supp by force
+  have "((z \<leftrightarrow> d ) \<bullet> (AE_op opp v1 v2)) = AE_op opp ((z \<leftrightarrow> d ) \<bullet> v1) ((z \<leftrightarrow> d ) \<bullet> v2)" using
+      e.perm_simps flip_commute opp.perm_simps AE_op opp.strong_exhaust  pure_supp
+    by (metis (full_types))
+
+  hence "supp ((z \<leftrightarrow> d) \<bullet> AE_op opp v1 v2) = supp (AE_op opp ((z \<leftrightarrow> d) \<bullet>v1)  ((z \<leftrightarrow> d) \<bullet>v2))" by simp
+  also have "... = supp  ((z \<leftrightarrow> d) \<bullet>v1) \<union> supp  ((z \<leftrightarrow> d) \<bullet>v2)" using e.supp 
+    by (metis (mono_tags, hide_lams) opp.strong_exhaust opp.supp sup_bot.left_neutral)
+  also have "... \<subseteq> (supp v1 -  { atom z } \<union> { atom d}) \<union>  (supp v2 - { atom z } \<union> { atom d})" using swap_v_supp AE_op df by blast
+  finally show ?case using e.supp opp.supp by blast
+next
+  case (AE_fst v)
+  then show ?case   using swap_v_supp by auto
+next
+  case (AE_snd v)
+  then show ?case   using swap_v_supp by auto
+next
+  case (AE_mvar u)
+  then show ?case using 
+      Diff_empty Diff_insert0 Un_upper1 atom_x_sort flip_def flip_fresh_fresh fresh_def set_eq_subset supp_eqvt swap_set_in_eq 
+    by (metis sort_of_atom_eq)
+next 
+  case (AE_len v)
+  then show ?case   using swap_v_supp by auto
+next
+  case (AE_concat v1 v2)
+  then show ?case   using swap_v_supp by auto
+next
+  case (AE_split v1 v2)
+  then show ?case   using swap_v_supp by auto
+qed
+
+lemma  swap_ce_supp:
+  fixes e::ce and d::x and z::x
+  assumes "atom d \<sharp> e"
+  shows "supp ((z \<leftrightarrow> d ) \<bullet> e) \<subseteq> supp e - { atom z } \<union> { atom d}"
+  using assms
+proof(nominal_induct e rule:ce.strong_induct)
+  case (CE_val v)
+  then show ?case using swap_v_supp ce.fresh ce.supp by simp
+next
+  case (CE_op opp v1 v2)
+  hence df: "atom d \<sharp> v1 \<and> atom d \<sharp> v2" using fresh_def e.supp by force
+  have "((z \<leftrightarrow> d ) \<bullet> (CE_op opp v1 v2)) = CE_op opp ((z \<leftrightarrow> d ) \<bullet> v1) ((z \<leftrightarrow> d ) \<bullet> v2)" using
+      ce.perm_simps flip_commute opp.perm_simps CE_op opp.strong_exhaust x_fresh_b pure_supp 
+    by (metis (full_types))
+
+  hence "supp ((z \<leftrightarrow> d) \<bullet> CE_op opp v1 v2) = supp (CE_op opp ((z \<leftrightarrow> d) \<bullet>v1)  ((z \<leftrightarrow> d) \<bullet>v2))" by simp
+  also have "... = supp  ((z \<leftrightarrow> d) \<bullet>v1) \<union> supp  ((z \<leftrightarrow> d) \<bullet>v2)" using ce.supp 
+    by (metis (mono_tags, hide_lams) opp.strong_exhaust opp.supp sup_bot.left_neutral)
+  also have "... \<subseteq> (supp v1 -  { atom z } \<union> { atom d}) \<union>  (supp v2 - { atom z } \<union> { atom d})" using swap_v_supp CE_op df by blast
+  finally show ?case using ce.supp opp.supp by blast
+next
+  case (CE_fst v)
+  then show ?case   using ce.supp ce.fresh swap_v_supp by auto
+next
+  case (CE_snd v)
+  then show ?case   using ce.supp ce.fresh swap_v_supp by auto
+next
+  case (CE_len v)
+  then show ?case   using ce.supp ce.fresh swap_v_supp by auto
+next
+  case (CE_concat v1 v2)
+  then show ?case using ce.supp ce.fresh swap_v_supp ce.perm_simps 
+  proof -
+    have "\<forall>x v xa. \<not> atom (x::x) \<sharp> (v::v) \<or> supp ((xa \<leftrightarrow> x) \<bullet> v) \<subseteq> supp v - {atom xa} \<union> {atom x}"
+      by (meson swap_v_supp) (* 0.0 ms *)
+    then show ?thesis
+      using CE_concat ce.supp by auto
+  qed
+qed
+
+lemma  swap_c_supp:
+  fixes c::c and d::x and z::x
+  assumes "atom d \<sharp> c"
+  shows "supp ((z \<leftrightarrow> d ) \<bullet> c) \<subseteq> supp c - { atom z } \<union> { atom d}"
+  using assms
+proof(nominal_induct c rule:c.strong_induct)
+  case (C_eq e1 e2)
+  then show ?case using swap_ce_supp by auto
+qed(auto+)
+
+lemma type_e_eq:
+  assumes "atom z \<sharp> e" and "atom z' \<sharp> e"
+  shows "\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e == e \<rbrace> = (\<lbrace> z' : b  |  [[z']\<^sup>v]\<^sup>c\<^sup>e ==  e \<rbrace>)"
+  by (auto,metis (full_types) assms(1) assms(2) flip_fresh_fresh fresh_PairD(1) fresh_PairD(2))
+
+lemma type_e_eq2:
+  assumes "atom z \<sharp> e" and "atom z' \<sharp> e" and "b=b'"
+  shows "\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e == e \<rbrace> = (\<lbrace> z' : b'  |  [[z']\<^sup>v]\<^sup>c\<^sup>e == e \<rbrace>)"
+  using assms type_e_eq by fast
+
+lemma e_flip_eq:
+  fixes e::e and ea::e
+  assumes "atom c \<sharp> (e, ea)" and "atom c \<sharp> (x, xa, e, ea)" and "(x \<leftrightarrow> c) \<bullet> e = (xa \<leftrightarrow> c) \<bullet> ea" 
+  shows "(e = AE_val w \<longrightarrow> (\<exists>w'. ea = AE_val w' \<and> (x \<leftrightarrow> c) \<bullet> w = (xa \<leftrightarrow> c) \<bullet> w')) \<or> 
+         (e = AE_op opp v1 v2 \<longrightarrow> (\<exists>v1' v2'. ea = AS_op opp v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> v1 = (xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> v2 = (xa \<leftrightarrow> c) \<bullet> v2') \<or> 
+         (e = AE_fst v \<longrightarrow> (\<exists>v'. ea = AE_fst v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v')) \<or> 
+         (e = AE_snd v \<longrightarrow> (\<exists>v'. ea = AE_snd v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v')) \<or> 
+         (e = AE_len v \<longrightarrow> (\<exists>v'. ea = AE_len v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v')) \<or> 
+         (e = AE_concat v1 v2 \<longrightarrow> (\<exists>v1' v2'. ea = AS_concat v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> v1 = (xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> v2 = (xa \<leftrightarrow> c) \<bullet> v2') \<or> 
+         (e = AE_app f v \<longrightarrow> (\<exists>v'. ea = AE_app f  v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v'))"
+  by (metis assms e.perm_simps permute_flip_cancel2)
+
+lemma fresh_opp_all:
+  fixes opp::opp
+  shows "z \<sharp> opp"
+  using e.fresh opp.exhaust opp.fresh  by metis
+
+lemma fresh_e_opp_all:
+  shows "(z \<sharp> v1 \<and> z \<sharp> v2) = z \<sharp> AE_op opp v1 v2"
+  using e.fresh opp.exhaust opp.fresh fresh_opp_all by simp
+
+lemma fresh_e_opp:
+  fixes z::x
+  assumes "atom z \<sharp> v1 \<and> atom z \<sharp> v2"
+  shows "atom z \<sharp> AE_op opp v1 v2"
+  using e.fresh opp.exhaust opp.fresh opp.supp  by (metis assms)
+
+subsubsection \<open>Statements\<close>
+
+lemma branch_s_flip_eq:
+  fixes v::v and va::v
+  assumes "atom c \<sharp> (v, va)" and "atom c \<sharp> (x, xa, v, va)" and "(x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa" 
+  shows "(s = AS_val w \<longrightarrow> (\<exists>w'. sa = AS_val w' \<and> (x \<leftrightarrow> c) \<bullet> w = (xa \<leftrightarrow> c) \<bullet> w')) \<or> 
+         (s = AS_seq s1 s2 \<longrightarrow> (\<exists>s1' s2'. sa = AS_seq s1' s2' \<and> (x \<leftrightarrow> c) \<bullet> s1 = (xa \<leftrightarrow> c) \<bullet> s1') \<and> (x \<leftrightarrow> c) \<bullet> s2 = (xa \<leftrightarrow> c) \<bullet> s2') \<or> 
+         (s = AS_if v s1 s2 \<longrightarrow> (\<exists>v' s1' s2'. sa = AS_if seq s1' s2' \<and> (x \<leftrightarrow> c) \<bullet> s1 = (xa \<leftrightarrow> c) \<bullet> s1') \<and> (x \<leftrightarrow> c) \<bullet> s2 = (xa \<leftrightarrow> c) \<bullet> s2' \<and> (x \<leftrightarrow> c) \<bullet> c = (xa \<leftrightarrow> c) \<bullet> v')"
+  by (metis assms s_branch_s_branch_list.perm_simps permute_flip_cancel2)
+
+section \<open>Context Syntax\<close>
+
+subsection \<open>Datatypes\<close>
+
+text \<open>Type and function/type definition contexts\<close>
+type_synonym \<Phi> = "fun_def list"
+type_synonym \<Theta> = "type_def list"
+type_synonym \<B> = "bv fset"
+
+datatype \<Gamma> = 
+  GNil
+  | GCons "x*b*c" \<Gamma>  (infixr "#\<^sub>\<Gamma>" 65)
+
+datatype \<Delta> = 
+  DNil  ("[]\<^sub>\<Delta>")
+  | DCons "u*\<tau>" \<Delta>  (infixr "#\<^sub>\<Delta>" 65)
+
+subsection \<open>Functions and Lemmas\<close>
+
+lemma \<Gamma>_induct [case_names GNil GCons] : "P GNil \<Longrightarrow> (\<And>x b c \<Gamma>'. P \<Gamma>' \<Longrightarrow> P ((x,b,c) #\<^sub>\<Gamma> \<Gamma>')) \<Longrightarrow> P \<Gamma>"
+proof(induct \<Gamma> rule:\<Gamma>.induct)
+  case GNil
+  then show ?case by auto 
+next
+  case (GCons x1 x2)
+  then obtain x and b and c where "x1=(x,b,c)"  using prod_cases3 by blast
+  then show ?case using GCons by presburger
+qed
+
+instantiation \<Delta> ::  pt
+begin
+
+primrec permute_\<Delta>
+  where
+    DNil_eqvt:  "p \<bullet> DNil = DNil"
+  | DCons_eqvt: "p \<bullet> (x #\<^sub>\<Delta> xs) = p \<bullet> x #\<^sub>\<Delta> p \<bullet> (xs::\<Delta>)"
+
+instance  by standard (induct_tac [!] x, simp_all)
+end
+
+lemmas [eqvt] =  permute_\<Delta>.simps 
+
+lemma \<Delta>_induct [case_names DNil DCons] : "P DNil \<Longrightarrow> (\<And>u t \<Delta>'. P \<Delta>' \<Longrightarrow> P ((u,t) #\<^sub>\<Delta> \<Delta>')) \<Longrightarrow> P \<Delta>"
+proof(induct \<Delta> rule: \<Delta>.induct)
+  case DNil
+  then show ?case by auto 
+next
+  case (DCons x1 x2)
+  then obtain u and t  where "x1=(u,t)"  by fastforce
+  then show ?case using DCons by presburger
+qed
+
+lemma \<Phi>_induct [case_names PNil PConsNone PConsSome] : "P [] \<Longrightarrow> (\<And>f x b c \<tau> s' \<Phi>'. P \<Phi>' \<Longrightarrow> P ((AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s'))) # \<Phi>')) \<Longrightarrow>
+                                                                  (\<And>f bv x b c \<tau> s' \<Phi>'. P \<Phi>' \<Longrightarrow> P ((AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s'))) # \<Phi>'))  \<Longrightarrow> P \<Phi>"
+proof(induct \<Phi> rule: list.induct)
+  case Nil
+  then show ?case by auto 
+next
+  case (Cons x1 x2)
+  then obtain f and t where ft: "x1 = (AF_fundef f t)" 
+    by (meson fun_def.exhaust)
+  then show ?case proof(nominal_induct t rule:fun_typ_q.strong_induct)
+    case (AF_fun_typ_some bv ft)
+    then show ?case using Cons ft 
+      by (metis fun_typ.exhaust)
+  next
+    case (AF_fun_typ_none ft)
+    then show ?case using Cons ft 
+      by (metis fun_typ.exhaust)
+  qed
+qed
+
+lemma \<Theta>_induct [case_names TNil AF_typedef AF_typedef_poly] : "P [] \<Longrightarrow> (\<And>tid dclist \<Theta>'. P \<Theta>' \<Longrightarrow> P ((AF_typedef tid dclist) # \<Theta>')) \<Longrightarrow>
+                                                                  (\<And>tid bv dclist \<Theta>'. P \<Theta>' \<Longrightarrow> P ((AF_typedef_poly tid bv dclist ) # \<Theta>'))  \<Longrightarrow> P \<Theta>"
+proof(induct \<Theta> rule: list.induct)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons td T)
+  show ?case by(cases td rule: type_def.exhaust, (simp add: Cons)+)
+qed
+
+instantiation \<Gamma> ::  pt
+begin
+
+primrec permute_\<Gamma>
+  where
+    GNil_eqvt:  "p \<bullet> GNil = GNil"
+  | GCons_eqvt: "p \<bullet> (x #\<^sub>\<Gamma> xs) = p \<bullet> x #\<^sub>\<Gamma> p \<bullet> (xs::\<Gamma>)"
+
+instance by standard (induct_tac [!] x, simp_all)
+end
+
+lemmas [eqvt] =  permute_\<Gamma>.simps 
+
+lemma G_cons_eqvt[simp]:
+  fixes \<Gamma>::\<Gamma>
+  shows "p \<bullet> ((x,b,c) #\<^sub>\<Gamma> \<Gamma>) = ((p \<bullet> x,  p \<bullet> b , p \<bullet> c) #\<^sub>\<Gamma> (p \<bullet> \<Gamma> ))" (is "?A = ?B" )
+  using Cons_eqvt triple_eqvt  supp_b_empty by simp
+
+lemma G_cons_flip[simp]:
+  fixes  x::x and \<Gamma>::\<Gamma>
+  shows  "(x\<leftrightarrow>x') \<bullet> ((x'',b,c) #\<^sub>\<Gamma> \<Gamma>) = (((x\<leftrightarrow>x') \<bullet> x'',  b , (x\<leftrightarrow>x') \<bullet> c) #\<^sub>\<Gamma> ((x\<leftrightarrow>x') \<bullet> \<Gamma> ))" 
+  using Cons_eqvt triple_eqvt  supp_b_empty by auto
+
+lemma G_cons_flip_fresh[simp]:
+  fixes  x::x and \<Gamma>::\<Gamma> 
+  assumes  "atom x \<sharp> (c,\<Gamma>)" and "atom x' \<sharp> (c,\<Gamma>)" 
+  shows  "(x\<leftrightarrow>x') \<bullet> ((x',b,c) #\<^sub>\<Gamma> \<Gamma>) = ((x,  b , c) #\<^sub>\<Gamma> \<Gamma> )" 
+  using G_cons_flip flip_fresh_fresh assms by force
+
+lemma G_cons_flip_fresh2[simp]:
+  fixes  x::x and \<Gamma>::\<Gamma> 
+  assumes  "atom x \<sharp> (c,\<Gamma>)" and "atom x' \<sharp> (c,\<Gamma>)" 
+  shows  "(x\<leftrightarrow>x') \<bullet> ((x,b,c) #\<^sub>\<Gamma> \<Gamma>) = ((x',  b , c) #\<^sub>\<Gamma> \<Gamma> )" 
+  using G_cons_flip flip_fresh_fresh assms by force
+
+lemma G_cons_flip_fresh3[simp]:
+  fixes  x::x and \<Gamma>::\<Gamma> 
+  assumes  "atom x \<sharp> \<Gamma>" and "atom x' \<sharp> \<Gamma>" 
+  shows  "(x\<leftrightarrow>x') \<bullet> ((x',b,c) #\<^sub>\<Gamma> \<Gamma>) = ((x,  b , (x\<leftrightarrow>x') \<bullet> c) #\<^sub>\<Gamma> \<Gamma> )" 
+  using G_cons_flip flip_fresh_fresh assms by force
+
+lemma neq_GNil_conv: "(xs \<noteq> GNil) = (\<exists>y ys. xs = y #\<^sub>\<Gamma> ys)"
+  by (induct xs) auto
+
+nominal_function toList :: "\<Gamma> \<Rightarrow> (x*b*c) list" where
+  "toList GNil = []"
+| "toList (GCons xbc G) = xbc#(toList G)"
+       apply (auto, simp add: eqvt_def toList_graph_aux_def )
+  using neq_GNil_conv surj_pair by metis
+nominal_termination (eqvt)
+  by lexicographic_order
+
+nominal_function toSet :: "\<Gamma> \<Rightarrow> (x*b*c) set" where
+  "toSet GNil = {}"
+| "toSet (GCons xbc G) = {xbc} \<union> (toSet G)"
+       apply (auto,simp add: eqvt_def toSet_graph_aux_def )
+  using neq_GNil_conv surj_pair by metis
+nominal_termination (eqvt)
+  by lexicographic_order
+
+nominal_function append_g :: "\<Gamma> \<Rightarrow> \<Gamma> \<Rightarrow> \<Gamma>" (infixr "@" 65) where
+  "append_g GNil g = g"
+| "append_g (xbc #\<^sub>\<Gamma> g1) g2 = (xbc #\<^sub>\<Gamma> (g1@g2))"
+       apply (auto,simp add: eqvt_def append_g_graph_aux_def )
+  using neq_GNil_conv surj_pair by metis
+nominal_termination (eqvt) by lexicographic_order
+
+nominal_function dom  ::  "\<Gamma> \<Rightarrow> x set"  where
+  "dom \<Gamma> = (fst` (toSet \<Gamma>))"
+     apply auto
+  unfolding  eqvt_def dom_graph_aux_def lfp_eqvt toSet.eqvt by simp
+nominal_termination (eqvt) by lexicographic_order
+
+text \<open> Use of this is sometimes mixed in with use of freshness and support for the context however it makes it clear
+that for immutable variables, the context is `self-supporting'\<close>
+
+nominal_function atom_dom  ::  "\<Gamma> \<Rightarrow> atom set"  where
+  "atom_dom \<Gamma>  = atom`(dom  \<Gamma>)"
+     apply auto
+  unfolding  eqvt_def atom_dom_graph_aux_def lfp_eqvt toSet.eqvt by simp
+nominal_termination (eqvt) by lexicographic_order
+
+subsection \<open>Immutable Variable Context Lemmas\<close>
+
+lemma append_GNil[simp]:
+  "GNil @ G = G"
+  by simp
+
+lemma append_g_toSetU [simp]: "toSet (G1@G2) = toSet G1 \<union> toSet G2"
+  by(induct G1, auto+)
+
+lemma supp_GNil: 
+  shows "supp GNil = {}"
+  by (simp add: supp_def)
+
+lemma supp_GCons: 
+  fixes xs::\<Gamma>
+  shows "supp (x #\<^sub>\<Gamma> xs) = supp x \<union> supp xs"
+  by (simp add: supp_def Collect_imp_eq Collect_neg_eq)
+
+lemma atom_dom_eq[simp]: 
+  fixes G::\<Gamma>
+  shows  "atom_dom ((x, b, c) #\<^sub>\<Gamma> G) = atom_dom ((x, b, c') #\<^sub>\<Gamma> G)" 
+  using atom_dom.simps toSet.simps by simp
+
+lemma dom_append[simp]:
+  "atom_dom (\<Gamma>@\<Gamma>') = atom_dom \<Gamma> \<union> atom_dom \<Gamma>'"
+  using image_Un append_g_toSetU atom_dom.simps dom.simps by metis
+
+lemma dom_cons[simp]:
+  "atom_dom ((x,b,c) #\<^sub>\<Gamma> G) = { atom x } \<union> atom_dom G"
+  using image_Un append_g_toSetU atom_dom.simps by auto
+
+lemma fresh_GNil[ms_fresh]: 
+  shows "a \<sharp> GNil"
+  by (simp add: fresh_def supp_GNil)
+
+lemma fresh_GCons[ms_fresh]: 
+  fixes xs::\<Gamma>
+  shows "a \<sharp> (x #\<^sub>\<Gamma> xs) \<longleftrightarrow> a \<sharp> x \<and> a \<sharp> xs"
+  by (simp add: fresh_def supp_GCons)
+
+lemma dom_supp_g[simp]:
+  "atom_dom G \<subseteq> supp G"
+  apply(induct G rule: \<Gamma>_induct,simp)
+  using supp_at_base supp_Pair atom_dom.simps supp_GCons by fastforce
+
+lemma fresh_append_g[ms_fresh]:
+  fixes xs::\<Gamma>
+  shows "a \<sharp> (xs @ ys) \<longleftrightarrow> a \<sharp> xs \<and> a \<sharp> ys"
+  by (induct xs) (simp_all add: fresh_GNil fresh_GCons)
+
+lemma append_g_assoc:
+  fixes xs::\<Gamma> 
+  shows  "(xs @ ys) @ zs = xs @ (ys @ zs)"
+  by (induct xs) simp_all
+
+lemma append_g_inside:
+  fixes xs::\<Gamma> 
+  shows "xs @ (x #\<^sub>\<Gamma> ys) = (xs @ (x #\<^sub>\<Gamma> GNil)) @ ys"
+  by(induct xs,auto+)
+
+lemma finite_\<Gamma>:
+  "finite (toSet \<Gamma>)" 
+  by(induct \<Gamma> rule: \<Gamma>_induct,auto)
+
+lemma supp_\<Gamma>:
+  "supp \<Gamma> = supp (toSet \<Gamma>)"
+proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using supp_GNil toSet.simps
+    by (simp add: supp_set_empty)
+next
+  case (GCons x b c \<Gamma>')
+  then show ?case using  supp_GCons toSet.simps finite_\<Gamma> supp_of_finite_union 
+    using supp_of_finite_insert by fastforce
+qed
+
+lemma supp_of_subset:
+  fixes G::"('a::fs set)"
+  assumes "finite G" and "finite G'" and "G \<subseteq> G'" 
+  shows "supp G \<subseteq> supp G'"
+  using supp_of_finite_sets assms  by (metis subset_Un_eq supp_of_finite_union)
+
+lemma supp_weakening:
+  assumes "toSet G \<subseteq> toSet G'"
+  shows "supp G \<subseteq> supp G'"
+  using supp_\<Gamma> finite_\<Gamma> by (simp add: supp_of_subset assms)
+
+lemma fresh_weakening[ms_fresh]:
+  assumes "toSet G \<subseteq> toSet G'" and "x \<sharp> G'" 
+  shows "x \<sharp> G"
+proof(rule ccontr)
+  assume "\<not> x \<sharp> G"
+  hence "x \<in> supp G" using fresh_def by auto
+  hence "x \<in> supp G'" using supp_weakening assms by auto
+  thus False using fresh_def assms by auto
+qed
+
+instance \<Gamma> :: fs
+  by (standard, induct_tac x, simp_all add: supp_GNil supp_GCons  finite_supp)
+
+lemma fresh_gamma_elem:
+  fixes \<Gamma>::\<Gamma>
+  assumes "a \<sharp> \<Gamma>"
+    and "e \<in> toSet \<Gamma>"
+  shows "a \<sharp> e"
+  using assms by(induct \<Gamma>,auto simp add: fresh_GCons)
+
+lemma fresh_gamma_append:
+  fixes xs::\<Gamma>
+  shows "a \<sharp> (xs @ ys) \<longleftrightarrow> a \<sharp> xs \<and> a \<sharp> ys"
+  by (induct xs, simp_all add: fresh_GNil fresh_GCons)
+
+lemma supp_triple[simp]:
+  shows "supp (x, y, z) = supp x \<union> supp y \<union> supp z"
+proof -
+  have "supp (x,y,z) = supp (x,(y,z))"  by auto
+  hence "supp (x,y,z) = supp x \<union> (supp y  \<union> supp z)" using supp_Pair by metis
+  thus ?thesis by auto
+qed
+
+lemma supp_append_g:
+  fixes xs::\<Gamma>
+  shows "supp (xs @ ys) = supp xs \<union> supp ys"
+  by(induct xs,auto simp add: supp_GNil supp_GCons )
+
+lemma fresh_in_g[simp]:
+  fixes \<Gamma>::\<Gamma> and x'::x
+  shows "atom x' \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> = (atom x' \<notin> supp \<Gamma>' \<union> supp x \<union> supp b0 \<union> supp c0 \<union> supp \<Gamma>)"
+proof - 
+  have  "atom x' \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> = (atom x' \<notin> supp (\<Gamma>' @((x,b0,c0) #\<^sub>\<Gamma> \<Gamma>)))"
+    using fresh_def by auto
+  also have "... = (atom x' \<notin> supp \<Gamma>' \<union> supp ((x,b0,c0) #\<^sub>\<Gamma> \<Gamma>))" using supp_append_g by fast
+  also have "... = (atom x' \<notin> supp \<Gamma>' \<union> supp x \<union> supp b0 \<union> supp c0 \<union> supp \<Gamma>)" using supp_GCons supp_append_g supp_triple  by auto
+  finally show ?thesis by fast
+qed
+
+lemma fresh_suffix[ms_fresh]:
+  fixes \<Gamma>::\<Gamma>
+  assumes "atom x \<sharp> \<Gamma>'@\<Gamma>"
+  shows "atom x \<sharp> \<Gamma>"
+  using assms by(induct  \<Gamma>' rule: \<Gamma>_induct, auto simp add: append_g.simps fresh_GCons)
+
+lemma not_GCons_self [simp]:
+  fixes xs::\<Gamma>
+  shows "xs \<noteq> x #\<^sub>\<Gamma> xs"
+  by (induct xs) auto
+
+lemma not_GCons_self2 [simp]: 
+  fixes xs::\<Gamma>
+  shows "x #\<^sub>\<Gamma> xs \<noteq> xs"
+  by (rule not_GCons_self [symmetric])
+
+lemma fresh_restrict:
+  fixes y::x and \<Gamma>::\<Gamma>
+  assumes  "atom y \<sharp>  (\<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma>)"
+  shows "atom y \<sharp> (\<Gamma>'@\<Gamma>)"
+  using assms by(induct \<Gamma>' rule: \<Gamma>_induct, auto simp add:fresh_GCons fresh_GNil  )
+
+lemma fresh_dom_free:
+  assumes "atom x \<sharp> \<Gamma>" 
+  shows "(x,b,c) \<notin> toSet \<Gamma>"
+  using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  hence "x\<noteq>x'" using fresh_def fresh_GCons fresh_Pair supp_at_base by blast
+  moreover have "atom x \<sharp> \<Gamma>'" using fresh_GCons GCons by auto
+  ultimately show ?case using toSet.simps GCons by auto
+qed
+
+lemma \<Gamma>_set_intros: "x \<in> toSet ( x #\<^sub>\<Gamma> xs)" and "y \<in> toSet xs \<Longrightarrow> y \<in> toSet (x #\<^sub>\<Gamma> xs)"
+  by simp+
+
+lemma fresh_dom_free2:
+  assumes "atom x \<notin> atom_dom \<Gamma>" 
+  shows "(x,b,c) \<notin> toSet \<Gamma>"
+  using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  hence "x\<noteq>x'" using fresh_def fresh_GCons fresh_Pair supp_at_base by auto
+  moreover have "atom x \<notin> atom_dom \<Gamma>'" using fresh_GCons GCons by auto
+  ultimately show ?case using toSet.simps GCons by auto
+qed
+
+subsection \<open>Mutable Variable Context Lemmas\<close>
+
+lemma supp_DNil: 
+  shows "supp DNil = {}"
+  by (simp add: supp_def)
+
+lemma supp_DCons: 
+  fixes xs::\<Delta>
+  shows "supp (x #\<^sub>\<Delta> xs) = supp x \<union> supp xs"
+  by (simp add: supp_def Collect_imp_eq Collect_neg_eq)
+
+lemma fresh_DNil[ms_fresh]:
+  shows "a \<sharp> DNil"
+  by (simp add: fresh_def supp_DNil)
+
+lemma fresh_DCons[ms_fresh]: 
+  fixes xs::\<Delta>
+  shows "a \<sharp> (x #\<^sub>\<Delta> xs) \<longleftrightarrow> a \<sharp> x \<and> a \<sharp> xs"
+  by (simp add: fresh_def supp_DCons)
+
+instance \<Delta> :: fs
+  by (standard, induct_tac x, simp_all add: supp_DNil supp_DCons  finite_supp)
+
+subsection \<open>Lookup Functions\<close>
+
+nominal_function lookup :: "\<Gamma> \<Rightarrow> x \<Rightarrow> (b*c) option" where
+  "lookup GNil x = None"
+| "lookup ((x,b,c)#\<^sub>\<Gamma>G) y = (if x=y then Some (b,c) else lookup G y)"
+  by (auto,simp add: eqvt_def lookup_graph_aux_def, metis neq_GNil_conv surj_pair)
+nominal_termination (eqvt) by lexicographic_order
+
+nominal_function replace_in_g :: "\<Gamma> \<Rightarrow> x \<Rightarrow> c \<Rightarrow> \<Gamma>"  ("_[_\<longmapsto>_]" [1000,0,0] 200) where
+  "replace_in_g GNil _ _ = GNil"
+| "replace_in_g ((x,b,c)#\<^sub>\<Gamma>G) x' c' = (if x=x' then ((x,b,c')#\<^sub>\<Gamma>G) else (x,b,c)#\<^sub>\<Gamma>(replace_in_g G x' c'))"
+       apply(auto,simp add: eqvt_def replace_in_g_graph_aux_def)
+  using surj_pair \<Gamma>.exhaust by metis
+nominal_termination (eqvt) by lexicographic_order
+
+text \<open> Functions for looking up data-constructors in the Pi context \<close> 
+
+nominal_function lookup_fun :: "\<Phi> \<Rightarrow> f  \<Rightarrow> fun_def option" where
+  "lookup_fun [] g = None"
+|  "lookup_fun ((AF_fundef f ft)#\<Pi>) g = (if (f=g) then Some (AF_fundef f ft) else lookup_fun \<Pi> g)"
+       apply(auto,simp add: eqvt_def lookup_fun_graph_aux_def )
+  by (metis fun_def.exhaust neq_Nil_conv)
+nominal_termination (eqvt)  by lexicographic_order
+
+nominal_function lookup_td :: "\<Theta> \<Rightarrow> string  \<Rightarrow> type_def option" where
+  "lookup_td [] g = None"
+|  "lookup_td ((AF_typedef s lst ) # (\<Theta>::\<Theta>)) g = (if (s = g) then Some (AF_typedef s lst ) else lookup_td \<Theta> g)"
+|  "lookup_td ((AF_typedef_poly s bv lst ) # (\<Theta>::\<Theta>)) g = (if (s = g) then Some (AF_typedef_poly s bv lst ) else lookup_td \<Theta> g)"
+          apply(auto,simp add: eqvt_def lookup_td_graph_aux_def )
+  by (metis type_def.exhaust neq_Nil_conv)
+nominal_termination (eqvt)  by lexicographic_order
+
+nominal_function name_of_type  ::"type_def \<Rightarrow> f "  where
+  "name_of_type (AF_typedef f _ ) = f"
+| "name_of_type (AF_typedef_poly f _ _) = f"
+       apply(auto,simp add: eqvt_def name_of_type_graph_aux_def )
+  using type_def.exhaust by blast
+nominal_termination (eqvt)  by lexicographic_order
+
+nominal_function name_of_fun  ::"fun_def \<Rightarrow> f "  where
+  "name_of_fun  (AF_fundef f ft) = f"
+     apply(auto,simp add: eqvt_def name_of_fun_graph_aux_def )
+  using fun_def.exhaust by blast
+nominal_termination (eqvt)  by lexicographic_order
+
+nominal_function remove2 :: "'a::pt \<Rightarrow> 'a list \<Rightarrow> 'a list" where
+  "remove2 x [] = []" |
+  "remove2 x (y # xs) = (if x = y then xs else y # remove2 x xs)"
+  by (simp add: eqvt_def remove2_graph_aux_def,auto+,meson list.exhaust)
+nominal_termination (eqvt)  by lexicographic_order
+
+nominal_function base_for_lit :: "l \<Rightarrow> b" where
+  "base_for_lit (L_true) = B_bool "
+| "base_for_lit (L_false) = B_bool "
+| "base_for_lit (L_num n) = B_int "
+| "base_for_lit (L_unit) = B_unit " 
+| "base_for_lit (L_bitvec v) = B_bitvec"
+                   apply (auto simp: eqvt_def base_for_lit_graph_aux_def )
+  using l.strong_exhaust by blast
+nominal_termination (eqvt) by lexicographic_order
+
+lemma neq_DNil_conv: "(xs \<noteq> DNil) = (\<exists>y ys. xs = y #\<^sub>\<Delta> ys)"
+  by (induct xs) auto
+
+nominal_function setD :: "\<Delta> \<Rightarrow> (u*\<tau>) set" where
+  "setD DNil = {}"
+| "setD (DCons xbc G) = {xbc} \<union> (setD G)"
+       apply (auto,simp add: eqvt_def setD_graph_aux_def )
+  using neq_DNil_conv surj_pair by metis
+nominal_termination (eqvt) by lexicographic_order
+
+lemma eqvt_triple:
+  fixes y::"'a::at" and ya::"'a::at" and xa::"'c::at" and va::"'d::fs" and s::s and sa::s and f::"s*'c*'d \<Rightarrow> s"
+  assumes "atom y \<sharp> (xa, va)" and "atom ya \<sharp> (xa, va)" and 
+    "\<forall>c. atom c \<sharp> (s, sa) \<longrightarrow> atom c \<sharp> (y, ya, s, sa) \<longrightarrow> (y \<leftrightarrow> c) \<bullet> s = (ya \<leftrightarrow> c) \<bullet> sa"
+    and "eqvt_at f (s,xa,va)" and "eqvt_at f (sa,xa,va)" and
+    "atom c \<sharp> (s, va, xa, sa)" and "atom c \<sharp> (y, ya, f (s, xa, va), f (sa, xa, va))"
+  shows "(y \<leftrightarrow> c) \<bullet> f (s, xa, va) =  (ya \<leftrightarrow> c) \<bullet> f (sa, xa, va)"
+proof -
+  have " (y \<leftrightarrow> c) \<bullet> f (s, xa, va) = f ( (y \<leftrightarrow> c) \<bullet> (s,xa,va))" using assms eqvt_at_def by metis
+  also have "... = f ( (y \<leftrightarrow> c) \<bullet> s, (y \<leftrightarrow> c) \<bullet> xa ,(y \<leftrightarrow> c) \<bullet> va)" by auto
+  also have "... = f ( (ya \<leftrightarrow> c) \<bullet> sa, (ya \<leftrightarrow> c) \<bullet> xa ,(ya \<leftrightarrow> c) \<bullet> va)" proof - 
+    have " (y \<leftrightarrow> c) \<bullet> s = (ya \<leftrightarrow> c) \<bullet> sa" using assms Abs1_eq_iff_all by auto
+    moreover have  "((y \<leftrightarrow> c) \<bullet> xa) =  ((ya \<leftrightarrow> c) \<bullet> xa)" using assms flip_fresh_fresh fresh_prodN by metis
+    moreover have  "((y \<leftrightarrow> c) \<bullet> va) =  ((ya \<leftrightarrow> c) \<bullet> va)" using assms flip_fresh_fresh fresh_prodN by metis
+    ultimately show ?thesis by auto
+  qed
+  also have "... =  f ( (ya \<leftrightarrow> c) \<bullet> (sa,xa,va))" by auto
+  finally show ?thesis using assms eqvt_at_def by metis
+qed
+
+section \<open>Functions for bit list/vectors\<close>
+
+inductive split :: "int \<Rightarrow> bit list \<Rightarrow> bit list * bit list \<Rightarrow> bool" where
+  "split 0 xs ([], xs)"
+| "split m xs (ys,zs) \<Longrightarrow> split (m+1) (x#xs) ((x # ys), zs)"
+equivariance split
+nominal_inductive split .
+
+lemma split_concat:
+  assumes "split n v (v1,v2)"
+  shows "v = append v1 v2"
+  using assms proof(induct "(v1,v2)" arbitrary: v1 v2 rule: split.inducts)
+  case 1
+  then show ?case by auto
+next
+  case (2 m xs ys zs x)
+  then show ?case by auto
+qed
+
+lemma split_n:
+  assumes "split n v (v1,v2)"
+  shows "0 \<le> n \<and> n \<le> int (length v)"
+  using assms proof(induct rule: split.inducts)
+  case (1 xs)
+  then show ?case by auto
+next
+  case (2 m xs ys zs x)
+  then show ?case by auto
+qed
+
+lemma split_length:
+  assumes "split n v (v1,v2)"
+  shows "n = int (length v1)"
+  using assms proof(induct  "(v1,v2)" arbitrary: v1 v2 rule: split.inducts)
+  case (1 xs)
+  then show ?case by auto
+next
+  case (2 m xs ys zs x)
+  then show ?case by auto
+qed
+
+lemma obtain_split:
+  assumes "0 \<le> n" and "n \<le> int (length bv)" 
+  shows "\<exists> bv1 bv2. split n bv (bv1 , bv2)" 
+  using assms proof(induct bv arbitrary: n)
+  case Nil
+  then show ?case using split.intros by auto
+next
+  case (Cons b bv)
+  show ?case proof(cases "n = 0")
+    case True
+    then show ?thesis using split.intros by auto
+  next
+    case False
+    then obtain m where m:"n=m+1" using Cons 
+      by (metis add.commute add_minus_cancel)
+    moreover have "0 \<le> m" using False m Cons by linarith
+    then obtain bv1 and bv2 where "split m bv (bv1 , bv2)" using Cons m by force
+    hence "split n (b # bv) ((b#bv1), bv2)" using m split.intros by auto
+    then show ?thesis by auto
+  qed
+qed
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/SyntaxL.thy b/thys/MiniSail/SyntaxL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/SyntaxL.thy
@@ -0,0 +1,383 @@
+(*<*)
+theory SyntaxL
+  imports Syntax IVSubst
+begin
+  (*>*)
+
+chapter \<open>Syntax Lemmas\<close>
+
+section \<open>Support, lookup and contexts\<close>
+
+lemma supp_v_tau [simp]:
+  assumes "atom z \<sharp> v"
+  shows "supp (\<lbrace> z : b | CE_val (V_var z)  ==  CE_val v  \<rbrace>) = supp v \<union> supp b" 
+  using assms \<tau>.supp c.supp ce.supp 
+  by (simp add: fresh_def supp_at_base)
+
+lemma supp_v_var_tau [simp]:
+  assumes "z \<noteq> x"
+  shows  "supp (\<lbrace> z : b | CE_val (V_var z)  ==  CE_val (V_var x)  \<rbrace>) = { atom x } \<union> supp b"
+  using supp_v_tau assms
+  using supp_at_base by fastforce
+
+text \<open> Sometimes we need to work with a version of a binder where the variable is fresh 
+in something else, such as  a bigger context. I think these could be generated automatically \<close>
+
+lemma obtain_fresh_fun_def:
+  fixes t::"'b::fs" 
+  shows  "\<exists>y::x. atom y \<sharp> (s,c,\<tau>,t) \<and> (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))  = AF_fundef f (AF_fun_typ_none (AF_fun_typ y b ((y \<leftrightarrow> x) \<bullet> c ) ((y \<leftrightarrow> x) \<bullet> \<tau>) ((y \<leftrightarrow> x) \<bullet> s))))"
+proof -
+  obtain y::x where y: "atom y \<sharp> (s,c,\<tau>,t)" using obtain_fresh by blast
+  moreover have "AF_fundef f (AF_fun_typ_none (AF_fun_typ y b ((y \<leftrightarrow> x) \<bullet> c ) ((y \<leftrightarrow> x) \<bullet> \<tau>) ((y \<leftrightarrow> x) \<bullet> s))) =  (AF_fundef f (AF_fun_typ_none (AF_fun_typ  x b c \<tau> s)))" 
+  proof(cases "x=y")
+    case True
+    then show ?thesis  using fun_def.eq_iff Abs1_eq_iff(3)  flip_commute flip_fresh_fresh fresh_PairD by auto
+  next
+    case False
+
+    have  "(AF_fun_typ y b ((y \<leftrightarrow> x) \<bullet> c) ((y \<leftrightarrow> x) \<bullet> \<tau>) ((y \<leftrightarrow> x) \<bullet> s)) =(AF_fun_typ x b c \<tau> s)" proof(subst fun_typ.eq_iff, subst Abs1_eq_iff(3))
+      show  \<open>(y = x \<and> (((y \<leftrightarrow> x) \<bullet> c, (y \<leftrightarrow> x) \<bullet> \<tau>), (y \<leftrightarrow> x) \<bullet> s) = ((c, \<tau>), s) \<or>
+         y \<noteq> x \<and> (((y \<leftrightarrow> x) \<bullet> c, (y \<leftrightarrow> x) \<bullet> \<tau>), (y \<leftrightarrow> x) \<bullet> s) = (y \<leftrightarrow> x) \<bullet> ((c, \<tau>), s) \<and> atom y \<sharp> ((c, \<tau>), s)) \<and>
+         b = b\<close> using False flip_commute flip_fresh_fresh fresh_PairD y by auto
+    qed
+    thus ?thesis by metis
+  qed
+  ultimately show  ?thesis using y fresh_Pair by metis
+qed
+
+lemma lookup_fun_member:
+  assumes "Some (AF_fundef f ft) = lookup_fun \<Phi> f"
+  shows "AF_fundef f ft \<in> set \<Phi>"
+  using assms proof (induct \<Phi>)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons a \<Phi>)
+  then show ?case using lookup_fun.simps
+    by (metis fun_def.exhaust insert_iff list.simps(15) option.inject)
+qed
+
+lemma rig_dom_eq:
+  "dom (G[x \<longmapsto> c]) = dom G"
+proof(induct G rule: \<Gamma>.induct)
+  case GNil
+  then show ?case using replace_in_g.simps by presburger
+next
+  case (GCons xbc \<Gamma>')
+  obtain x' and b' and c' where xbc: "xbc=(x',b',c')" using prod_cases3 by blast
+  then show ?case using replace_in_g.simps GCons by simp
+qed
+
+lemma lookup_in_rig_eq:
+  assumes "Some (b,c) = lookup \<Gamma> x" 
+  shows "Some (b,c') = lookup (\<Gamma>[x\<longmapsto>c']) x"
+  using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x b c \<Gamma>')
+  then show ?case using replace_in_g.simps lookup.simps by auto
+qed
+
+lemma lookup_in_rig_neq:
+  assumes "Some (b,c) = lookup \<Gamma> y" and "x\<noteq>y"
+  shows "Some (b,c) = lookup (\<Gamma>[x\<longmapsto>c']) y"
+  using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  then show ?case using replace_in_g.simps lookup.simps by auto
+qed
+
+lemma lookup_in_rig:
+  assumes "Some (b,c) = lookup \<Gamma> y" 
+  shows "\<exists>c''. Some (b,c'') = lookup (\<Gamma>[x\<longmapsto>c']) y"
+proof(cases "x=y")
+  case True
+  then show ?thesis using lookup_in_rig_eq using assms by blast
+next
+  case False
+  then show ?thesis using lookup_in_rig_neq using assms by blast
+qed
+
+lemma lookup_inside[simp]:
+  assumes "x \<notin> fst ` toSet \<Gamma>'"
+  shows "Some (b1,c1) = lookup (\<Gamma>'@(x,b1,c1)#\<^sub>\<Gamma>\<Gamma>) x"
+  using assms by(induct \<Gamma>',auto)
+
+lemma lookup_inside2:
+  assumes "Some (b1,c1) = lookup (\<Gamma>'@((x,b0,c0)#\<^sub>\<Gamma>\<Gamma>)) y" and "x\<noteq>y"
+  shows "Some (b1,c1) = lookup (\<Gamma>'@((x,b0,c0')#\<^sub>\<Gamma>\<Gamma>)) y" 
+  using assms by(induct \<Gamma>' rule: \<Gamma>.induct,auto+)
+
+fun tail:: "'a list \<Rightarrow> 'a list" where
+  "tail [] = []"
+| "tail (x#xs) = xs"
+
+lemma lookup_options:
+  assumes "Some (b,c) = lookup (xt#\<^sub>\<Gamma>G) x"
+  shows  "((x,b,c) = xt) \<or> (Some (b,c) = lookup G x)"
+  by (metis assms lookup.simps(2) option.inject surj_pair)
+
+lemma lookup_x:
+  assumes "Some (b,c) = lookup G x"
+  shows "x \<in> fst ` toSet G"
+  using assms
+  by(induct "G" rule: \<Gamma>.induct ,auto+)
+
+lemma GCons_eq_appendI:
+  fixes xs1::\<Gamma>
+  shows "[| x #\<^sub>\<Gamma> xs1 = ys; xs = xs1 @ zs |] ==> x #\<^sub>\<Gamma> xs = ys @ zs"
+  by (drule sym) simp
+
+lemma split_G: "x : toSet xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x #\<^sub>\<Gamma> zs"
+proof (induct xs)
+  case GNil thus ?case by simp
+next
+  case GCons thus ?case using  GCons_eq_appendI 
+    by (metis Un_iff append_g.simps(1) singletonD toSet.simps(2))
+qed
+
+lemma lookup_not_empty:
+  assumes "Some \<tau> = lookup G x"
+  shows "G \<noteq> GNil"
+  using assms by auto
+
+lemma lookup_in_g:
+  assumes "Some (b,c) = lookup \<Gamma> x"
+  shows "(x,b,c) \<in> toSet \<Gamma>"
+  using assms apply(induct \<Gamma>, simp)
+  using lookup_options by fastforce
+
+lemma lookup_split:
+  fixes \<Gamma>::\<Gamma>
+  assumes "Some (b,c) = lookup \<Gamma> x"
+  shows "\<exists>G G' . \<Gamma> =  G'@(x,b,c)#\<^sub>\<Gamma>G"
+  by (meson assms(1) lookup_in_g split_G)
+
+lemma toSet_splitU[simp]:
+  "(x',b',c') \<in> toSet (\<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma>) \<longleftrightarrow> (x',b',c') \<in> (toSet \<Gamma>' \<union> {(x, b, c)} \<union> toSet \<Gamma>)"
+  using append_g_toSetU toSet.simps by auto
+
+lemma toSet_splitP[simp]:
+  "(\<forall>(x', b', c')\<in>toSet (\<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma>). P x' b' c') \<longleftrightarrow> (\<forall> (x', b', c')\<in>toSet \<Gamma>'. P x' b' c') \<and> P x b c \<and> (\<forall> (x', b', c')\<in>toSet \<Gamma>. P x' b' c')"  (is "?A \<longleftrightarrow> ?B")
+  using toSet_splitU by force
+
+lemma lookup_restrict:
+  assumes "Some (b',c') = lookup (\<Gamma>'@(x,b,c)#\<^sub>\<Gamma>\<Gamma>) y" and "x \<noteq> y" 
+  shows "Some (b',c') = lookup (\<Gamma>'@\<Gamma>) y"
+  using assms  proof(induct \<Gamma>' rule:\<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x1 b1 c1 \<Gamma>')
+  then show ?case by auto
+qed
+
+lemma supp_list_member:
+  fixes x::"'a::fs" and l::"'a list"
+  assumes "x \<in> set l"
+  shows "supp x \<subseteq> supp l"
+  using assms apply(induct l, auto)
+  using supp_Cons by auto
+
+lemma GNil_append:
+  assumes "GNil = G1@G2"
+  shows "G1 = GNil \<and> G2 = GNil"
+proof(rule ccontr)
+  assume "\<not> (G1 = GNil \<and> G2 = GNil)"
+  hence "G1@G2 \<noteq> GNil" using append_g.simps   by (metis \<Gamma>.distinct(1) \<Gamma>.exhaust)
+  thus False using assms by auto
+qed
+
+lemma GCons_eq_append_conv:
+  fixes xs::\<Gamma>
+  shows "x#\<^sub>\<Gamma>xs = ys@zs = (ys = GNil \<and> x#\<^sub>\<Gamma>xs = zs \<or> (\<exists>ys'. x#\<^sub>\<Gamma>ys' = ys \<and> xs = ys'@zs))"
+  by(cases ys) auto
+
+lemma dclist_distinct_unique:
+  assumes  "(dc, const) \<in> set dclist2" and  "(cons, const1) \<in> set dclist2" and "dc=cons" and  "distinct (List.map fst dclist2)"
+  shows "(const) = const1"
+proof -
+  have  "(cons, const) = (dc, const1)" 
+    using assms     by (metis (no_types, lifting) assms(3) assms(4) distinct.simps(1) distinct.simps(2) empty_iff insert_iff list.set(1) list.simps(15) list.simps(8) list.simps(9) map_of_eq_Some_iff)
+  thus ?thesis by auto
+qed
+
+lemma fresh_d_fst_d:
+  assumes "atom u \<sharp> \<delta>"
+  shows  "u \<notin> fst ` set \<delta>"
+  using assms proof(induct \<delta>)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons ut \<delta>')
+  obtain u' and t' where *:"ut = (u',t') " by fastforce
+  hence "atom u \<sharp> ut \<and> atom u \<sharp> \<delta>'" using fresh_Cons Cons by auto
+  moreover hence "atom u \<sharp> fst ut" using * fresh_Pair[of "atom u" u' t'] Cons by auto
+  ultimately show ?case using Cons by auto
+qed
+
+lemma bv_not_in_bset_supp:
+  fixes bv::bv
+  assumes "bv |\<notin>| B"
+  shows "atom bv \<notin> supp B"
+proof - 
+  have *:"supp B = fset (fimage atom B)"
+    by (metis fimage.rep_eq finite_fset supp_finite_set_at_base supp_fset)
+  thus ?thesis using assms 
+    using notin_fset by fastforce
+qed
+
+lemma u_fresh_d:
+  assumes "atom u \<sharp> D"
+  shows "u \<notin> fst ` setD D"
+  using assms proof(induct D rule: \<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u' t' \<Delta>')
+  then show ?case unfolding setD.simps 
+    using fresh_DCons fresh_Pair  by (simp add: fresh_Pair fresh_at_base(2))
+qed
+
+section \<open>Type Definitions\<close>
+
+lemma exist_fresh_bv:
+  fixes tm::"'a::fs"
+  shows  "\<exists>bva2 dclist2. AF_typedef_poly tyid bva dclist = AF_typedef_poly tyid bva2 dclist2 \<and> 
+             atom bva2 \<sharp> tm" 
+proof -
+  obtain bva2::bv where *:"atom bva2 \<sharp> (bva, dclist,tyid,tm)" using obtain_fresh by metis
+  moreover hence "bva2 \<noteq> bva" using fresh_at_base by auto
+  moreover have " dclist = (bva \<leftrightarrow> bva2) \<bullet> (bva2 \<leftrightarrow> bva) \<bullet> dclist" by simp
+  moreover have "atom bva \<sharp> (bva2 \<leftrightarrow> bva) \<bullet> dclist" proof -
+    have "atom bva2 \<sharp> dclist" using * fresh_prodN by auto
+    hence "atom ((bva2 \<leftrightarrow> bva) \<bullet> bva2) \<sharp> (bva2 \<leftrightarrow> bva) \<bullet> dclist" using fresh_eqvt True_eqvt 
+    proof -
+      have "(bva2 \<leftrightarrow> bva) \<bullet> atom bva2 \<sharp> (bva2 \<leftrightarrow> bva) \<bullet> dclist"
+        by (metis True_eqvt \<open>atom bva2 \<sharp> dclist\<close> fresh_eqvt) (* 62 ms *)
+      then show ?thesis
+        by simp (* 125 ms *)
+    qed
+    thus ?thesis by auto
+  qed
+  ultimately have "AF_typedef_poly tyid bva dclist = AF_typedef_poly tyid bva2 ((bva2 \<leftrightarrow> bva ) \<bullet> dclist)"    
+    unfolding type_def.eq_iff   Abs1_eq_iff by metis
+  thus ?thesis using * fresh_prodN by metis
+qed
+
+lemma obtain_fresh_bv:
+  fixes tm::"'a::fs"
+  obtains bva2::bv and  dclist2 where "AF_typedef_poly tyid bva dclist = AF_typedef_poly tyid bva2 dclist2 \<and> 
+             atom bva2 \<sharp> tm" 
+  using exist_fresh_bv by metis
+
+section \<open>Function Definitions\<close>
+
+lemma fun_typ_flip:
+  fixes bv1::bv and c::bv
+  shows   "(bv1 \<leftrightarrow> c) \<bullet> AF_fun_typ x1 b1 c1 \<tau>1 s1 = AF_fun_typ x1 ((bv1 \<leftrightarrow> c) \<bullet> b1) ((bv1 \<leftrightarrow> c) \<bullet> c1) ((bv1 \<leftrightarrow> c) \<bullet> \<tau>1) ((bv1 \<leftrightarrow> c) \<bullet> s1)"
+  using fun_typ.perm_simps flip_fresh_fresh supp_at_base  fresh_def
+    flip_fresh_fresh fresh_def supp_at_base 
+  by (simp add: flip_fresh_fresh)
+
+lemma fun_def_eq:
+  assumes  "AF_fundef fa (AF_fun_typ_none (AF_fun_typ xa ba ca \<tau>a sa)) = AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))"
+  shows "f = fa" and "b = ba" and "[[atom xa]]lst. sa = [[atom x]]lst. s" and "[[atom xa]]lst. \<tau>a = [[atom x]]lst. \<tau>" and
+    " [[atom xa]]lst. ca = [[atom x]]lst. c"
+  using fun_def.eq_iff fun_typ_q.eq_iff fun_typ.eq_iff lst_snd lst_fst  using assms apply metis
+  using fun_def.eq_iff fun_typ_q.eq_iff fun_typ.eq_iff lst_snd lst_fst  using assms apply metis
+proof - 
+  have "([[atom xa]]lst. ((ca, \<tau>a), sa) = [[atom x]]lst. ((c, \<tau>), s))" using assms  fun_def.eq_iff fun_typ_q.eq_iff  fun_typ.eq_iff by auto
+  thus "[[atom xa]]lst. sa = [[atom x]]lst. s" and "[[atom xa]]lst. \<tau>a = [[atom x]]lst. \<tau>" and
+    " [[atom xa]]lst. ca = [[atom x]]lst. c" using lst_snd lst_fst by metis+
+qed
+
+lemma fun_arg_unique_aux: 
+  assumes "AF_fun_typ x1 b1 c1 \<tau>1' s1' = AF_fun_typ x2 b2 c2 \<tau>2' s2'"
+  shows "\<lbrace> x1 : b1 | c1 \<rbrace> = \<lbrace> x2 : b2 | c2\<rbrace>"
+proof - 
+  have " ([[atom x1]]lst. c1 = [[atom x2]]lst. c2)" using fun_def_eq assms by metis
+  moreover have "b1 = b2" using fun_typ.eq_iff assms  by metis
+  ultimately show ?thesis using \<tau>.eq_iff by fast
+qed
+
+lemma fresh_x_neq:
+  fixes x::x and y::x
+  shows "atom x \<sharp> y = (x \<noteq> y)"
+  using fresh_at_base  fresh_def by auto
+
+lemma obtain_fresh_z3:
+  fixes tm::"'b::fs"
+  obtains z::x where "\<lbrace> x : b  | c \<rbrace> =  \<lbrace> z : b  | c[x::=V_var z]\<^sub>c\<^sub>v \<rbrace> \<and>  atom z \<sharp> tm \<and> atom z \<sharp> (x,c)" 
+proof -
+  obtain z::x and c'::c where z:"\<lbrace> x : b  | c \<rbrace> =  \<lbrace> z : b | c' \<rbrace> \<and>  atom z \<sharp> (tm,x,c)" using obtain_fresh_z2 b_of.simps by metis
+  hence "c' = c[x::=V_var z]\<^sub>c\<^sub>v" proof - 
+    have "([[atom z]]lst. c' = [[atom x]]lst. c)" using z \<tau>.eq_iff by metis
+    hence "c' = (z \<leftrightarrow> x) \<bullet> c" using Abs1_eq_iff[of z c' x c]  fresh_x_neq  fresh_prodN by fastforce
+    also have "... = c[x::=V_var z]\<^sub>c\<^sub>v"
+      using subst_v_c_def  flip_subst_v[of z c x] z fresh_prod3 by metis
+    finally show ?thesis by auto
+  qed
+  thus ?thesis using z fresh_prodN that by metis
+qed
+
+lemma u_fresh_v:
+  fixes u::u and t::v
+  shows "atom u \<sharp> t" 
+  by(nominal_induct t rule:v.strong_induct,auto)
+
+lemma u_fresh_ce:
+  fixes u::u and t::ce
+  shows "atom u \<sharp> t" 
+  apply(nominal_induct t rule:ce.strong_induct)
+  using  u_fresh_v pure_fresh 
+       apply (auto simp add:  opp.fresh ce.fresh opp.fresh opp.exhaust)
+  unfolding ce.fresh opp.fresh opp.exhaust  by (simp add: fresh_opp_all)
+
+lemma u_fresh_c:
+  fixes u::u and t::c
+  shows "atom u \<sharp> t" 
+  by(nominal_induct t rule:c.strong_induct,auto simp add: c.fresh u_fresh_ce)
+
+lemma u_fresh_g:
+  fixes u::u and t::\<Gamma>
+  shows "atom u \<sharp> t" 
+  by(induct t rule:\<Gamma>_induct, auto simp add: u_fresh_b u_fresh_c  fresh_GCons fresh_GNil)
+
+lemma u_fresh_t:
+  fixes u::u and t::\<tau>
+  shows "atom u \<sharp> t" 
+  by(nominal_induct t rule:\<tau>.strong_induct,auto simp add: \<tau>.fresh u_fresh_c u_fresh_b)
+
+lemma b_of_c_of_eq:
+  assumes "atom z \<sharp> \<tau>" 
+  shows "\<lbrace> z : b_of \<tau> |  c_of \<tau> z \<rbrace> = \<tau>" 
+  using assms proof(nominal_induct \<tau> avoiding: z rule: \<tau>.strong_induct)
+  case (T_refined_type x1a x2a x3a)
+
+  hence " \<lbrace> z : b_of \<lbrace> x1a : x2a  | x3a \<rbrace>  | c_of \<lbrace> x1a : x2a  | x3a \<rbrace> z \<rbrace> = \<lbrace> z : x2a | x3a[x1a::=V_var z]\<^sub>c\<^sub>v \<rbrace>" 
+    using b_of.simps c_of.simps c_of_eq by auto
+  moreover have "\<lbrace> z : x2a | x3a[x1a::=V_var z]\<^sub>c\<^sub>v \<rbrace> = \<lbrace> x1a : x2a  | x3a \<rbrace>" using T_refined_type \<tau>.fresh by auto
+  ultimately show  ?case by auto
+qed
+
+lemma fresh_d_not_in:
+  assumes "atom u2 \<sharp> \<Delta>'" 
+  shows   "u2 \<notin> fst ` setD \<Delta>'" 
+  using assms proof(induct \<Delta>' rule: \<Delta>_induct)
+  case DNil
+  then show ?case by simp
+next
+  case (DCons u t \<Delta>')
+  hence *: "atom u2 \<sharp> \<Delta>' \<and> atom u2 \<sharp> (u,t)" 
+    by (simp add: fresh_def supp_DCons)
+  hence "u2 \<notin> fst ` setD \<Delta>'" using DCons by auto
+  moreover have "u2 \<noteq> u" using * fresh_Pair 
+    by (metis eq_fst_iff not_self_fresh)
+  ultimately  show ?case by simp
+qed
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/Typing.thy b/thys/MiniSail/Typing.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Typing.thy
@@ -0,0 +1,586 @@
+(*<*)
+theory Typing
+  imports  RCLogic WellformedL
+begin
+  (*>*)
+
+chapter \<open>Type System\<close>
+
+text \<open>The MiniSail type system. We define subtyping judgement first and then typing judgement
+for the term forms\<close>
+
+section \<open>Subtyping\<close>
+
+text \<open> Subtyping is defined on top of refinement constraint logic (RCL). 
+A subtyping check is converted into an RCL validity check. \<close>
+
+inductive subtype :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> bool"  ("_ ; _ ; _  \<turnstile> _ \<lesssim> _" [50, 50, 50] 50) where
+  subtype_baseI: "\<lbrakk>  
+   atom x \<sharp> (\<Theta>, \<B>, \<Gamma>, z,c,z',c') ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b | c \<rbrace>;  
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z' : b | c' \<rbrace>;                    
+   \<Theta>; \<B> ; (x,b, c[z::=[x]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<Turnstile> c'[z'::=[x]\<^sup>v]\<^sub>v  
+\<rbrakk> \<Longrightarrow>  
+   \<Theta>; \<B>; \<Gamma> \<turnstile>  \<lbrace> z : b | c \<rbrace> \<lesssim>  \<lbrace> z' : b | c' \<rbrace>"
+
+equivariance subtype
+nominal_inductive subtype 
+  avoids subtype_baseI: x
+proof(goal_cases)
+  case (1 \<Theta> \<B> \<Gamma> z b c z' c' x)
+  then show ?case using  fresh_star_def 1 by force
+next
+  case (2 \<Theta> \<B> \<Gamma> z b c z' c' x)
+  then show ?case by auto
+qed
+
+inductive_cases subtype_elims: 
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> \<lbrace> z : b | c \<rbrace> \<lesssim>  \<lbrace> z' : b | c' \<rbrace>"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>\<^sub>1 \<lesssim>  \<tau>\<^sub>2"
+
+section \<open>Literals\<close>
+
+text \<open>The type synthesised has the constraint that z equates to the literal\<close>
+
+inductive infer_l  :: "l \<Rightarrow> \<tau> \<Rightarrow> bool" (" \<turnstile> _ \<Rightarrow> _" [50, 50] 50) where
+  infer_trueI:   " \<turnstile> L_true  \<Rightarrow> \<lbrace> z : B_bool | [[z]\<^sup>v]\<^sup>c\<^sup>e ==  [[L_true]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>"
+| infer_falseI: " \<turnstile> L_false \<Rightarrow> \<lbrace> z : B_bool | [[z]\<^sup>v]\<^sup>c\<^sup>e == [[L_false]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>"
+| infer_natI:   " \<turnstile> L_num n \<Rightarrow> \<lbrace> z : B_int  | [[z]\<^sup>v]\<^sup>c\<^sup>e == [[L_num n]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>"
+| infer_unitI:  " \<turnstile> L_unit  \<Rightarrow> \<lbrace> z : B_unit | [[z]\<^sup>v]\<^sup>c\<^sup>e == [[L_unit]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>"
+| infer_bitvecI:  " \<turnstile> L_bitvec bv \<Rightarrow> \<lbrace> z : B_bitvec | [[z]\<^sup>v]\<^sup>c\<^sup>e ==  [[L_bitvec bv]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>"
+
+nominal_inductive infer_l  .
+equivariance infer_l 
+
+inductive_cases infer_l_elims[elim!]:
+  "\<turnstile> L_true \<Rightarrow> \<tau>"
+  "\<turnstile> L_false \<Rightarrow> \<tau>"
+  "\<turnstile> L_num n \<Rightarrow> \<tau>"
+  "\<turnstile> L_unit \<Rightarrow> \<tau>"
+  "\<turnstile> L_bitvec x \<Rightarrow> \<tau>"
+  "\<turnstile> l \<Rightarrow> \<tau>"
+
+lemma infer_l_form2[simp]:
+  shows "\<exists>z. \<turnstile> l \<Rightarrow> (\<lbrace> z : base_for_lit l | [[z]\<^sup>v]\<^sup>c\<^sup>e == [[l]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>)"
+proof (nominal_induct l rule: l.strong_induct)
+  case (L_num x)
+  then show ?case using infer_l.intros base_for_lit.simps has_fresh_z by metis
+next
+  case L_true
+  then show ?case using infer_l.intros base_for_lit.simps has_fresh_z by metis
+next
+  case L_false
+  then show ?case using infer_l.intros base_for_lit.simps has_fresh_z by metis
+next
+  case L_unit
+  then show ?case using infer_l.intros base_for_lit.simps has_fresh_z by metis
+next
+  case (L_bitvec x)
+  then show ?case using infer_l.intros base_for_lit.simps has_fresh_z by metis
+qed
+
+section \<open>Values\<close>
+
+inductive infer_v :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> v \<Rightarrow> \<tau> \<Rightarrow> bool" (" _ ; _ ; _ \<turnstile> _ \<Rightarrow> _" [50, 50, 50] 50) where
+
+infer_v_varI: "\<lbrakk>
+      \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> ; 
+      Some (b,c) = lookup \<Gamma> x; 
+      atom z \<sharp> x ; atom z \<sharp>  (\<Theta>, \<B>, \<Gamma>) 
+\<rbrakk> \<Longrightarrow> 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> [x]\<^sup>v \<Rightarrow> \<lbrace> z : b | [[z]\<^sup>v]\<^sup>c\<^sup>e == [[x]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>"
+
+| infer_v_litI: "\<lbrakk>
+      \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> ; 
+      \<turnstile> l \<Rightarrow> \<tau> 
+\<rbrakk> \<Longrightarrow> 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> [l]\<^sup>v \<Rightarrow> \<tau>"
+
+| infer_v_pairI: "\<lbrakk> 
+      atom z \<sharp> (v1, v2); atom z \<sharp>  (\<Theta>, \<B>, \<Gamma>) ;
+      \<Theta>; \<B>; \<Gamma> \<turnstile> (v1::v) \<Rightarrow> t1 ; 
+      \<Theta>; \<B> ;  \<Gamma> \<turnstile> (v2::v) \<Rightarrow> t2
+\<rbrakk> \<Longrightarrow> 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v1 v2 \<Rightarrow> (\<lbrace> z : B_pair (b_of t1) (b_of t2)  | [[z]\<^sup>v]\<^sup>c\<^sup>e == [[v1,v2]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>) "
+
+| infer_v_consI: "\<lbrakk> 
+      AF_typedef s dclist \<in> set \<Theta>;
+      (dc, tc) \<in> set dclist ; 
+      \<Theta>;  \<B>; \<Gamma> \<turnstile> v \<Rightarrow> tv ; 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> tv \<lesssim> tc ;
+      atom z \<sharp> v ;  atom z \<sharp> (\<Theta>, \<B>, \<Gamma>) 
+\<rbrakk> \<Longrightarrow> 
+      \<Theta>;  \<B>; \<Gamma>  \<turnstile> V_cons s dc v \<Rightarrow> (\<lbrace> z : B_id s |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [ V_cons s dc v ]\<^sup>c\<^sup>e \<rbrace>)"
+
+| infer_v_conspI: "\<lbrakk> 
+      AF_typedef_poly s bv dclist \<in> set \<Theta>;
+      (dc, tc) \<in> set dclist ; 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> tv; 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> tv \<lesssim> tc[bv::=b]\<^sub>\<tau>\<^sub>b ;
+      atom z \<sharp> (\<Theta>, \<B>, \<Gamma>, v, b);
+      atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>, v, b);
+      \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b
+\<rbrakk> \<Longrightarrow> 
+      \<Theta>; \<B>; \<Gamma> \<turnstile> V_consp s dc b v \<Rightarrow> (\<lbrace> z : B_app s b |  [[z]\<^sup>v]\<^sup>c\<^sup>e == (CE_val (V_consp s dc b v)) \<rbrace>)"
+
+equivariance infer_v
+nominal_inductive infer_v
+  avoids infer_v_conspI: bv and z | infer_v_varI: z | infer_v_pairI: z | infer_v_consI:  z 
+proof(goal_cases)
+  case (1 \<Theta> \<B> \<Gamma> b c x z)
+  hence "atom z \<sharp> \<lbrace> z : b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" using \<tau>.fresh by simp
+  then show ?case unfolding fresh_star_def using 1 by simp
+next
+  case (2 \<Theta> \<B> \<Gamma> b c x z)
+  then show ?case by auto
+next
+  case (3 z v1 v2 \<Theta> \<B> \<Gamma> t1 t2)
+  hence "atom z \<sharp> \<lbrace> z : [ b_of t1 , b_of t2 ]\<^sup>b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ v1 , v2 ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" using \<tau>.fresh by simp
+  then show ?case unfolding fresh_star_def using 3 by simp
+next
+  case (4 z v1 v2 \<Theta> \<B> \<Gamma> t1 t2)
+  then show ?case by auto
+next
+  case (5 s dclist \<Theta> dc tc \<B> \<Gamma> v tv z)
+  hence "atom z \<sharp> \<lbrace> z : B_id s  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_cons s dc v ]\<^sup>c\<^sup>e  \<rbrace>" using \<tau>.fresh b.fresh pure_fresh by auto
+  moreover have "atom z \<sharp> V_cons s dc v" using v.fresh 5 using v.fresh fresh_prodN pure_fresh  by metis
+  then show ?case unfolding fresh_star_def using 5 by simp
+next
+  case (6 s dclist \<Theta> dc tc \<B> \<Gamma> v tv z)
+  then show ?case by auto
+next
+  case (7 s bv dclist \<Theta> dc tc \<B> \<Gamma> v tv b z)
+  hence "atom bv \<sharp> V_consp s dc b v" using v.fresh fresh_prodN pure_fresh by metis
+  moreover then have "atom bv \<sharp> \<lbrace> z : B_id s  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc b v ]\<^sup>c\<^sup>e  \<rbrace>" 
+    using \<tau>.fresh ce.fresh v.fresh by auto
+  moreover have "atom z \<sharp> V_consp s dc b v" using v.fresh fresh_prodN pure_fresh 7 by metis
+  moreover then have "atom z \<sharp> \<lbrace> z : B_id s  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc b v ]\<^sup>c\<^sup>e  \<rbrace>" 
+    using \<tau>.fresh ce.fresh v.fresh by auto
+  ultimately show ?case using fresh_star_def 7 by force
+next
+  case (8 s bv dclist \<Theta> dc tc \<B> \<Gamma> v tv b z)
+  then show ?case by auto
+qed
+
+inductive_cases infer_v_elims[elim!]:
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_var x \<Rightarrow> \<tau>"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_lit l \<Rightarrow> \<tau>"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v1 v2 \<Rightarrow> \<tau>"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_cons s dc v \<Rightarrow> \<tau>"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v1 v2 \<Rightarrow> (\<lbrace> z : b |  c  \<rbrace>) "
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v1 v2 \<Rightarrow> (\<lbrace> z : [ b1 , b2 ]\<^sup>b |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [[v1,v2]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>) "
+  "\<Theta>; \<B>; \<Gamma> \<turnstile> V_consp s dc b v  \<Rightarrow> \<tau> "
+
+inductive check_v :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> v \<Rightarrow> \<tau> \<Rightarrow> bool"  ("_ ; _ ; _  \<turnstile> _ \<Leftarrow> _" [50, 50, 50] 50) where
+  check_v_subtypeI:  "\<lbrakk>  \<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>1 \<lesssim> \<tau>2; \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>1 \<rbrakk> \<Longrightarrow> \<Theta>; \<B> ;  \<Gamma> \<turnstile>  v \<Leftarrow> \<tau>2"
+equivariance check_v
+nominal_inductive check_v  .
+
+inductive_cases check_v_elims[elim!]:
+  "\<Theta>; \<B> ; \<Gamma> \<turnstile> v \<Leftarrow> \<tau>"
+
+section \<open>Expressions\<close>
+
+text \<open> Type synthesis for expressions \<close>
+
+inductive infer_e :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow> e \<Rightarrow> \<tau> \<Rightarrow> bool"  ("_ ; _ ; _ ; _ ; _  \<turnstile> _ \<Rightarrow> _" [50, 50, 50,50] 50) where
+
+infer_e_valI:  "\<lbrakk>
+         (\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>) ; 
+         (\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>)) ; 
+         (\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>) \<rbrakk> \<Longrightarrow> 
+         \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_val v) \<Rightarrow> \<tau>"
+
+| infer_e_plusI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_int | c1 \<rbrace> ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>  v2 \<Rightarrow> \<lbrace> z2 : B_int | c2 \<rbrace>;
+        atom z3 \<sharp> (AE_op Plus v1 v2); atom z3 \<sharp> \<Gamma> \<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<lbrace> z3 : B_int | [[z3]\<^sup>v]\<^sup>c\<^sup>e == (CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace>"
+
+| infer_e_leqI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_int | c1 \<rbrace> ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_int | c2 \<rbrace>;
+        atom z3 \<sharp> (AE_op LEq v1 v2); atom z3 \<sharp> \<Gamma>  
+\<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_op LEq v1 v2 \<Rightarrow>  \<lbrace> z3 : B_bool | [[z3]\<^sup>v]\<^sup>c\<^sup>e == (CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace>"
+
+| infer_e_eqI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : b | c1 \<rbrace> ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : b | c2 \<rbrace>;     
+        atom z3 \<sharp> (AE_op Eq v1 v2); atom z3 \<sharp> \<Gamma>  ;
+        b \<in> { B_bool, B_int, B_unit }
+\<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_op Eq v1 v2 \<Rightarrow>  \<lbrace> z3 : B_bool | [[z3]\<^sup>v]\<^sup>c\<^sup>e == (CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace>"
+
+| infer_e_appI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau>' s'))) = lookup_fun \<Phi> f;        
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace>  x : b | c \<rbrace>; 
+        atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>,v , \<tau>);
+        \<tau>'[x::=v]\<^sub>v = \<tau> 
+\<rbrakk> \<Longrightarrow>
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_app f v \<Rightarrow> \<tau>"
+
+| infer_e_appPI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b' ; 
+        Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau>' s'))) = lookup_fun \<Phi> f;       
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace>  x : b[bv::=b']\<^sub>b | c[bv::=b']\<^sub>b \<rbrace>; atom x \<sharp> \<Gamma>;
+        (\<tau>'[bv::=b']\<^sub>b[x::=v]\<^sub>v) = \<tau> ;
+        atom bv \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, b', v, \<tau>)
+\<rbrakk> \<Longrightarrow>
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_appP f b' v \<Rightarrow> \<tau>"
+
+| infer_e_fstI:  "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ; 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z' : [b1,b2]\<^sup>b | c \<rbrace>;
+        atom z \<sharp> AE_fst v ; atom z \<sharp> \<Gamma> \<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_fst v \<Rightarrow> \<lbrace> z : b1 | [[z]\<^sup>v]\<^sup>c\<^sup>e == ((CE_fst [v]\<^sup>c\<^sup>e)) \<rbrace>"
+
+| infer_e_sndI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ; 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z' : [ b1, b2]\<^sup>b | c \<rbrace>;
+        atom z \<sharp> AE_snd v ; atom z \<sharp> \<Gamma> \<rbrakk> \<Longrightarrow>  
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_snd v \<Rightarrow> \<lbrace> z : b2 | [[z]\<^sup>v]\<^sup>c\<^sup>e == ((CE_snd [v]\<^sup>c\<^sup>e))  \<rbrace>"
+
+| infer_e_lenI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ; 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z' : B_bitvec | c \<rbrace>;
+        atom z \<sharp> AE_len v ; atom z \<sharp> \<Gamma>\<rbrakk> \<Longrightarrow>  
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_len v \<Rightarrow> \<lbrace> z : B_int | [[z]\<^sup>v]\<^sup>c\<^sup>e == ((CE_len [v]\<^sup>c\<^sup>e))  \<rbrace>"
+
+| infer_e_mvarI: "\<lbrakk>  
+        \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> ; 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>;
+        (u,\<tau>) \<in> setD \<Delta> \<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>  AE_mvar u \<Rightarrow> \<tau>"
+
+| infer_e_concatI: "\<lbrakk> 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_bitvec | c1 \<rbrace> ; 
+        \<Theta>; \<B>; \<Gamma> \<turnstile>  v2 \<Rightarrow> \<lbrace> z2 : B_bitvec | c2 \<rbrace>;
+        atom z3 \<sharp> (AE_concat v1 v2); atom z3 \<sharp> \<Gamma> \<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_concat  v1 v2 \<Rightarrow> \<lbrace> z3 : B_bitvec | [[z3]\<^sup>v]\<^sup>c\<^sup>e == (CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace>"
+
+| infer_e_splitI: "\<lbrakk>
+        \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>);
+        \<Theta> ; \<B> ; \<Gamma> \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_bitvec | c1 \<rbrace> ;
+        \<Theta> ; \<B> ; \<Gamma> \<turnstile> v2 \<Leftarrow> \<lbrace> z2 : B_int | (CE_op LEq (CE_val (V_lit (L_num 0))) (CE_val (V_var z2))) == (CE_val (V_lit L_true)) AND 
+                                         (CE_op LEq (CE_val (V_var z2)) (CE_len (CE_val (v1)))) == (CE_val (V_lit L_true)) \<rbrace>;
+        atom z1 \<sharp> (AE_split v1 v2); atom z1 \<sharp> \<Gamma>;
+        atom z2 \<sharp> (AE_split v1 v2); atom z2 \<sharp> \<Gamma>;
+        atom z3 \<sharp> (AE_split v1 v2); atom z3 \<sharp> \<Gamma>
+\<rbrakk> \<Longrightarrow> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_split  v1 v2) \<Rightarrow> \<lbrace> z3 : B_pair B_bitvec B_bitvec  | 
+                      ((CE_val v1) == (CE_concat (CE_fst (CE_val (V_var z3))) (CE_snd (CE_val (V_var z3)))))
+                  AND (((CE_len (CE_fst (CE_val (V_var z3))))) == (CE_val ( v2))) \<rbrace>"
+
+equivariance infer_e
+nominal_inductive infer_e 
+  avoids  infer_e_appI: x |infer_e_appPI: bv |  infer_e_splitI: z3 and z1 and z2 
+proof(goal_cases)
+  case (1 \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau>' s' v \<tau>)
+  moreover hence "atom x \<sharp> [ f  v  ]\<^sup>e" using fresh_prodN pure_fresh e.fresh by force
+  ultimately show ?case unfolding fresh_star_def using fresh_prodN e.fresh pure_fresh by simp
+next
+  case (2 \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau>' s' v \<tau>)
+  then show ?case by auto
+next
+  case (3 \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>' s' v \<tau>)
+  moreover hence "atom bv \<sharp> AE_appP f b' v"  using fresh_prodN pure_fresh e.fresh by force
+  ultimately show ?case unfolding fresh_star_def using fresh_prodN  e.fresh pure_fresh fresh_Pair by auto
+next
+  case (4 \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>' s' v \<tau>)
+  then show ?case by auto
+next
+  case (5 \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  have "atom z3 \<sharp> \<lbrace> z3 : [ B_bitvec , B_bitvec ]\<^sup>b  | [ v1 ]\<^sup>c\<^sup>e  ==  [ [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   AND  [| [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  ==  [ v2 ]\<^sup>c\<^sup>e   \<rbrace>"
+    using \<tau>.fresh by simp
+  then show ?case unfolding fresh_star_def fresh_prod7 using wfG_fresh_x2 5 by auto
+next
+  case (6 \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  then show ?case by auto
+qed
+
+inductive_cases infer_e_elims[elim!]:
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Plus v1 v2) \<Rightarrow> \<lbrace> z3 : B_int | [[z3]\<^sup>v]\<^sup>c\<^sup>e == (CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op LEq v1 v2) \<Rightarrow> \<lbrace> z3 : B_bool | [[z3]\<^sup>v]\<^sup>c\<^sup>e == (CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Plus v1 v2) \<Rightarrow> \<lbrace> z3 : B_int | c \<rbrace>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Plus v1 v2) \<Rightarrow> \<lbrace> z3 : b | c \<rbrace>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op LEq v1 v2) \<Rightarrow> \<lbrace> z3 : b | c \<rbrace>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_app f v ) \<Rightarrow> \<tau>"     
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_val v) \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_fst v) \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_snd v) \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_mvar u) \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Plus v1 v2) \<Rightarrow> \<tau>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op LEq v1 v2) \<Rightarrow> \<tau>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op LEq v1 v2) \<Rightarrow> \<lbrace> z3 : B_bool | c \<rbrace>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_app f v )  \<Rightarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"  
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op opp v1 v2) \<Rightarrow>  \<tau>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_len v) \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_len v) \<Rightarrow> \<lbrace> z : B_int | [[z]\<^sup>v]\<^sup>c\<^sup>e == ((CE_len [v]\<^sup>c\<^sup>e))\<rbrace> "
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_concat v1 v2 \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_concat v1 v2 \<Rightarrow> (\<lbrace> z : b |  c  \<rbrace>) "
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_concat v1 v2 \<Rightarrow> (\<lbrace> z : B_bitvec |  [[z]\<^sup>v]\<^sup>c\<^sup>e == (CE_concat [v1]\<^sup>c\<^sup>e [v1]\<^sup>c\<^sup>e) \<rbrace>) "
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_appP f b v )  \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AE_split v1 v2 \<Rightarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Eq v1 v2) \<Rightarrow> \<lbrace> z3 : b | c \<rbrace>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Eq v1 v2) \<Rightarrow> \<lbrace> z3 : B_bool | c \<rbrace>" 
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AE_op Eq v1 v2) \<Rightarrow> \<tau>" 
+nominal_termination (eqvt)  by lexicographic_order
+
+section \<open>Statements\<close>
+
+inductive check_s ::  "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow> s \<Rightarrow> \<tau> \<Rightarrow> bool" (" _ ; _ ; _ ; _ ; _  \<turnstile> _ \<Leftarrow> _" [50, 50, 50,50,50] 50) and
+  check_branch_s ::  "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta>  \<Rightarrow> tyid \<Rightarrow> string \<Rightarrow> \<tau> \<Rightarrow> v \<Rightarrow> branch_s \<Rightarrow> \<tau> \<Rightarrow> bool" (" _ ;  _ ; _ ; _ ; _ ; _ ; _ ; _ ; _ \<turnstile> _ \<Leftarrow> _" [50, 50, 50,50,50] 50) and
+  check_branch_list ::  "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta>  \<Rightarrow> tyid \<Rightarrow> (string * \<tau>) list \<Rightarrow> v \<Rightarrow> branch_list \<Rightarrow> \<tau> \<Rightarrow> bool" (" _ ;  _ ; _ ; _ ; _ ; _ ; _ ; _ \<turnstile> _ \<Leftarrow> _" [50, 50, 50,50,50] 50) where 
+  check_valI:  "\<lbrakk> 
+       \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;   
+       \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+       \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>'; 
+       \<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>' \<lesssim> \<tau> \<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AS_val v) \<Leftarrow> \<tau>"
+
+| check_letI: "\<lbrakk>
+       atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, e, \<tau>);  
+       atom z \<sharp> (x, \<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, e, \<tau>, s);  
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> e \<Rightarrow> \<lbrace> z : b | c \<rbrace> ; 
+       \<Theta>; \<Phi> ; \<B> ; ((x,b,c[z::=V_var x]\<^sub>v)#\<^sub>\<Gamma>\<Gamma>) ; \<Delta> \<turnstile> s \<Leftarrow> \<tau> 
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AS_let x e s) \<Leftarrow> \<tau>"
+
+| check_assertI: "\<lbrakk>
+       atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, c, \<tau>, s);  
+       \<Theta>; \<Phi> ; \<B> ; ((x,B_bool,c)#\<^sub>\<Gamma>\<Gamma>) ; \<Delta> \<turnstile> s \<Leftarrow> \<tau> ;
+       \<Theta>; \<B>; \<Gamma>  \<Turnstile> c;
+       \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> 
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (AS_assert c s) \<Leftarrow> \<tau>"
+
+|check_branch_s_branchI: "\<lbrakk> 
+       \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ; 
+        \<turnstile>\<^sub>w\<^sub>f \<Theta> ; 
+       \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> ;
+       \<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f const;
+       atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, tid, cons , const, v, \<tau>);
+       \<Theta>; \<Phi>; \<B>; ((x,b_of const,  ([v]\<^sup>c\<^sup>e == [ V_cons tid cons [x]\<^sup>v]\<^sup>c\<^sup>e ) AND (c_of const x))#\<^sub>\<Gamma>\<Gamma>) ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>  
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; cons ; const ; v \<turnstile> (AS_branch cons x s) \<Leftarrow> \<tau>"
+
+|check_branch_list_consI: "\<lbrakk> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid; cons; const; v \<turnstile> cs \<Leftarrow> \<tau> ; 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid; dclist; v \<turnstile> css \<Leftarrow> \<tau>  
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; (cons,const)#dclist ; v \<turnstile> AS_cons cs css \<Leftarrow> \<tau>"
+
+|check_branch_list_finalI: "\<lbrakk> 
+       \<Theta>; \<Phi>;\<B>; \<Gamma>; \<Delta>; tid ; cons ; const ; v \<turnstile> cs \<Leftarrow> \<tau>  
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; [(cons,const)] ; v \<turnstile> AS_final cs  \<Leftarrow> \<tau>"
+
+| check_ifI: "\<lbrakk> 
+       atom z \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, v , s1 , s2 , \<tau> ); 
+       (\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> (\<lbrace> z : B_bool | TRUE \<rbrace>)) ; 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s1 \<Leftarrow> (\<lbrace> z : b_of \<tau> | ([v]\<^sup>c\<^sup>e == [[L_true]\<^sup>v]\<^sup>c\<^sup>e) IMP (c_of \<tau> z) \<rbrace>) ;
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s2 \<Leftarrow> (\<lbrace> z : b_of \<tau> | ([v]\<^sup>c\<^sup>e == [[L_false]\<^sup>v]\<^sup>c\<^sup>e) IMP (c_of \<tau> z) \<rbrace>) 
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> IF v THEN s1 ELSE s2 \<Leftarrow> \<tau>"
+
+| check_let2I: "\<lbrakk>    
+       atom x \<sharp> (\<Theta>, \<Phi>, \<B>, G, \<Delta>, t, s1, \<tau>) ;     
+       \<Theta>; \<Phi> ; \<B> ; G; \<Delta> \<turnstile> s1 \<Leftarrow> t; 
+       \<Theta>; \<Phi> ; \<B> ; ((x,b_of t,c_of t x)#\<^sub>\<Gamma>G) ; \<Delta> \<turnstile> s2 \<Leftarrow> \<tau> 
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi> ; \<B> ; G ; \<Delta> \<turnstile> (LET x : t  = s1 IN s2) \<Leftarrow> \<tau>"
+
+| check_varI: "\<lbrakk> 
+       atom u \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, \<tau>', v, \<tau>) ; 
+       \<Theta>; \<B>; \<Gamma> \<turnstile>  v \<Leftarrow> \<tau>'; 
+       \<Theta>; \<Phi>; \<B>; \<Gamma> ; ((u,\<tau>') #\<^sub>\<Delta> \<Delta>)  \<turnstile> s \<Leftarrow> \<tau> 
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> (VAR u : \<tau>' = v  IN s) \<Leftarrow> \<tau>"
+
+| check_assignI: "\<lbrakk> 
+       \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+       \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ; 
+       (u,\<tau>) \<in> setD \<Delta> ; 
+       \<Theta>; \<B>; \<Gamma> \<turnstile>  v \<Leftarrow> \<tau>;
+       \<Theta>; \<B>; \<Gamma> \<turnstile> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<lesssim> \<tau>'  
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>  (u ::= v) \<Leftarrow> \<tau>'" 
+
+| check_whileI: "\<lbrakk> 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s1 \<Leftarrow> \<lbrace> z : B_bool | TRUE \<rbrace>; 
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s2 \<Leftarrow> \<lbrace> z : B_unit | TRUE \<rbrace>;
+        \<Theta>; \<B>; \<Gamma> \<turnstile> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<lesssim> \<tau>' 
+\<rbrakk> \<Longrightarrow>  
+        \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> WHILE s1 DO { s2 } \<Leftarrow> \<tau>'"
+
+| check_seqI: "\<lbrakk> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s1 \<Leftarrow> \<lbrace> z : B_unit | TRUE \<rbrace>; 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s2 \<Leftarrow> \<tau> 
+\<rbrakk> \<Longrightarrow> 
+       \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s1 ;; s2 \<Leftarrow> \<tau>"
+
+| check_caseI: "\<lbrakk> 
+      \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid ; dclist ; v \<turnstile>  cs \<Leftarrow> \<tau> ;  
+       (AF_typedef tid dclist ) \<in> set \<Theta> ;                 
+       \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> z : B_id tid | TRUE \<rbrace>;
+       \<turnstile>\<^sub>w\<^sub>f \<Theta>  
+\<rbrakk> \<Longrightarrow>
+      \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_match v cs \<Leftarrow> \<tau>"
+
+equivariance check_s
+
+text \<open>We only need avoidance for cases where a variable is added to a context\<close>
+nominal_inductive check_s 
+  avoids check_letI: x and z  |  check_branch_s_branchI: x | check_let2I: x  | check_varI: u | check_ifI: z | check_assertI: x
+proof(goal_cases)
+  case (1 x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  hence "atom x \<sharp> AS_let x e s" using s_branch_s_branch_list.fresh(2) by auto 
+  moreover have "atom z \<sharp> AS_let x e s" using s_branch_s_branch_list.fresh(2) 1 fresh_prod8 by auto
+  then show ?case using fresh_star_def 1 by force
+next
+  case (3 x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  hence "atom x \<sharp> AS_assert c s" using fresh_prodN s_branch_s_branch_list.fresh pure_fresh  by auto 
+  then show ?case using fresh_star_def 3 by force
+next
+  case (5 \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
+  hence "atom x \<sharp> AS_branch cons x s" using fresh_prodN s_branch_s_branch_list.fresh pure_fresh  by auto 
+  then show ?case using fresh_star_def 5 by force
+next
+  case (7 z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  hence "atom z \<sharp> AS_if v s1 s2 " using s_branch_s_branch_list.fresh by auto
+  then show ?case using 7 fresh_prodN fresh_star_def by fastforce
+next
+  case (9 x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2)
+  hence "atom x \<sharp> AS_let2 x t s1 s2" using s_branch_s_branch_list.fresh by auto
+  thus ?case  using fresh_star_def 9 by force
+next
+  case (11 u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  hence "atom u \<sharp> AS_var u \<tau>' v s" using s_branch_s_branch_list.fresh by auto
+  then show ?case  using fresh_star_def 11 by force
+
+qed(auto+)
+
+inductive_cases check_s_elims[elim!]:
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_val v \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_let x e s \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_if v s1 s2 \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_let2 x t s1 s2 \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_while s1 s2 \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_var u t v s \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_seq s1 s2 \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_assign u v \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_match v cs \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> AS_assert c s \<Leftarrow> \<tau>"
+
+inductive_cases check_branch_s_elims[elim!]:
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid ; dclist ; v \<turnstile> (AS_final cs) \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid ; dclist ; v \<turnstile> (AS_cons cs css) \<Leftarrow> \<tau>"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid ; cons ; const ; v \<turnstile> (AS_branch dc x s ) \<Leftarrow> \<tau>"
+
+section \<open>Programs\<close>
+
+text \<open>Type check function bodies\<close>
+
+inductive check_funtyp :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow>  \<B> \<Rightarrow> fun_typ \<Rightarrow> bool" ( " _ ; _ ; _ \<turnstile> _ " ) where
+  check_funtypI: "\<lbrakk>
+  atom x \<sharp> (\<Theta>, \<Phi>, B , b );
+  \<Theta>; \<Phi> ;  B ; ((x,b,c) #\<^sub>\<Gamma> GNil) ; []\<^sub>\<Delta> \<turnstile> s \<Leftarrow> \<tau>
+\<rbrakk>  \<Longrightarrow> 
+  \<Theta>; \<Phi> ; B \<turnstile> (AF_fun_typ x b c \<tau> s)"
+
+equivariance check_funtyp
+nominal_inductive check_funtyp
+  avoids check_funtypI: x
+proof(goal_cases)
+  case (1 x \<Theta> \<Phi> B b c s \<tau>  )
+  hence "atom x \<sharp> (AF_fun_typ x b c \<tau> s)"  using fun_def.fresh fun_typ_q.fresh fun_typ.fresh by simp
+  then show ?case using fresh_star_def 1 fresh_prodN by fastforce
+next
+  case (2 \<Theta> \<Phi> x b c s \<tau> f)
+  then show ?case by auto
+qed
+
+inductive check_funtypq :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> fun_typ_q \<Rightarrow> bool"  ( " _ ; _ \<turnstile> _ " ) where 
+  check_fundefq_simpleI: "\<lbrakk>
+  \<Theta>; \<Phi> ; {||} \<turnstile> (AF_fun_typ x b c t s)
+\<rbrakk>  \<Longrightarrow> 
+  \<Theta>; \<Phi> \<turnstile> ((AF_fun_typ_none (AF_fun_typ x b c t s)))"
+
+|check_funtypq_polyI: "\<lbrakk>
+  atom bv \<sharp> (\<Theta>, \<Phi>, (AF_fun_typ x b c t s));
+  \<Theta>; \<Phi>; {|bv|} \<turnstile> (AF_fun_typ x b c t s)
+\<rbrakk>  \<Longrightarrow> 
+  \<Theta>; \<Phi> \<turnstile> (AF_fun_typ_some bv (AF_fun_typ x b c t s))"
+
+equivariance check_funtypq
+nominal_inductive check_funtypq
+  avoids check_funtypq_polyI: bv
+proof(goal_cases)
+  case (1 bv \<Theta> \<Phi> x b c t s )
+  hence "atom bv \<sharp> (AF_fun_typ_some bv (AF_fun_typ x b c t s))"  using fun_def.fresh fun_typ_q.fresh fun_typ.fresh by simp
+  thus ?case using fresh_star_def 1 fresh_prodN by fastforce
+next
+  case (2 bv \<Theta> \<Phi> ft )
+  then show ?case by auto
+qed
+
+inductive check_fundef :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> fun_def \<Rightarrow> bool" ( " _ ; _ \<turnstile> _ " ) where
+  check_fundefI: "\<lbrakk>
+  \<Theta>; \<Phi> \<turnstile> ft 
+\<rbrakk>  \<Longrightarrow> 
+  \<Theta>; \<Phi> \<turnstile> (AF_fundef f ft)"
+
+equivariance check_fundef
+nominal_inductive check_fundef .
+
+text \<open>Temporarily remove this simproc as it produces untidy eliminations\<close>
+declare[[ simproc del: alpha_lst]]
+
+inductive_cases check_funtyp_elims[elim!]:
+  "check_funtyp \<Theta> \<Phi> B ft"
+
+inductive_cases check_funtypq_elims[elim!]:
+  "check_funtypq \<Theta> \<Phi> (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))"
+  "check_funtypq \<Theta> \<Phi> (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))"
+
+inductive_cases check_fundef_elims[elim!]:
+  "check_fundef \<Theta> \<Phi> (AF_fundef f ftq)"
+
+declare[[ simproc add: alpha_lst]]
+
+nominal_function \<Delta>_of :: "var_def list \<Rightarrow> \<Delta>" where
+  "\<Delta>_of [] = DNil"
+| "\<Delta>_of ((AV_def u t v)#vs) = (u,t) #\<^sub>\<Delta>  (\<Delta>_of vs)" 
+  apply auto
+  using  eqvt_def \<Delta>_of_graph_aux_def neq_Nil_conv old.prod.exhaust apply force
+  using  eqvt_def \<Delta>_of_graph_aux_def neq_Nil_conv old.prod.exhaust 
+  by (metis var_def.strong_exhaust)
+nominal_termination (eqvt) by lexicographic_order
+
+inductive check_prog :: "p \<Rightarrow> \<tau> \<Rightarrow> bool" ( "\<turnstile> _ \<Leftarrow> _")  where 
+  "\<lbrakk>
+   \<Theta>; \<Phi>; {||}; GNil ; \<Delta>_of \<G> \<turnstile> s \<Leftarrow> \<tau>
+\<rbrakk> \<Longrightarrow>  \<turnstile> (AP_prog \<Theta> \<Phi> \<G> s) \<Leftarrow> \<tau>"
+
+inductive_cases check_prog_elims[elim!]:
+  "\<turnstile> (AP_prog \<Theta> \<Phi> \<G> s) \<Leftarrow> \<tau>"
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/TypingL.thy b/thys/MiniSail/TypingL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/TypingL.thy
@@ -0,0 +1,2800 @@
+(*<*)
+theory TypingL
+  imports Typing RCLogicL "HOL-Eisbach.Eisbach"
+begin
+  (*>*)
+
+chapter  \<open>Typing Lemmas\<close>
+
+section \<open>Prelude\<close>
+
+text \<open>Needed as the typing elimination rules give us facts for an alpha-equivalent version of a term
+      and so need to be able to 'jump back' to a typing judgement for the orginal term\<close>
+
+lemma \<tau>_fresh_c[simp]:
+  assumes "atom x \<sharp> \<lbrace> z : b | c \<rbrace>" and "atom z \<sharp> x"
+  shows "atom x \<sharp> c"
+  using \<tau>.fresh assms fresh_at_base 
+  by (simp add: fresh_at_base(2))
+
+lemmas subst_defs = subst_b_b_def subst_b_c_def subst_b_\<tau>_def subst_v_v_def subst_v_c_def subst_v_\<tau>_def
+
+lemma wfT_wfT_if1:
+  assumes "wfT \<Theta> \<B> \<Gamma> (\<lbrace> z : b_of t  | CE_val v  ==  CE_val (V_lit L_false) IMP  c_of t z  \<rbrace>)" and "atom z \<sharp> (\<Gamma>,t)"
+  shows "wfT \<Theta> \<B> \<Gamma> t" 
+  using assms proof(nominal_induct t avoiding: \<Gamma> z rule: \<tau>.strong_induct)
+  case (T_refined_type z' b' c')
+  show ?case proof(rule wfT_wfT_if)
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b'  | [ v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c'[z'::=[ z]\<^sup>v]\<^sub>c\<^sub>v  \<rbrace> \<close> 
+      using T_refined_type b_of.simps c_of.simps subst_defs by metis
+    show \<open>atom z \<sharp> (c', \<Gamma>)\<close> using T_refined_type fresh_prodN \<tau>_fresh_c by metis
+  qed
+qed
+
+lemma fresh_u_replace_true:
+  fixes bv::bv and \<Gamma>::\<Gamma>
+  assumes "atom bv \<sharp> \<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma>"
+  shows "atom bv \<sharp> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>"
+  using fresh_append_g fresh_GCons assms fresh_Pair c.fresh(1) by auto
+
+lemma wf_replace_true1:
+  fixes \<Gamma>::\<Gamma> and \<Phi>::\<Phi> and \<Theta>::\<Theta> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b'::b and b::b and s::s  
+    and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list
+
+shows  "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f v : b' \<Longrightarrow> G =  \<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow> \<Theta> ;  \<B> ;  \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f v : b'" and
+  "\<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f c'' \<Longrightarrow>  G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow>  \<Theta> ;  \<B> ; \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  c''" and
+  "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f G \<Longrightarrow>  G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow>    \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f   \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) " and
+  "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow>  \<Theta> ;  \<B> ;  \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
+  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  True" and 
+  "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True" and
+  "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True" and
+  "\<Theta> ;  \<B> ; G  \<turnstile>\<^sub>w\<^sub>f ce : b' \<Longrightarrow>  G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow>  \<Theta> ;  \<B> ;  \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f ce : b'" and
+  "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
+proof(nominal_induct   
+    b' and c'' and G and \<tau> and ts and P and b and b' and td 
+    arbitrary: \<Gamma> \<Gamma>'  and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>'
+    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfB_intI \<Theta> \<B>)
+  then show ?case using wf_intros by metis
+next
+  case (wfB_boolI \<Theta> \<B>)
+  then show ?case using wf_intros by metis
+next
+  case (wfB_unitI \<Theta> \<B>)
+  then show ?case using wf_intros by metis
+next
+  case (wfB_bitvecI \<Theta> \<B>)
+  then show ?case using wf_intros by metis
+next
+  case (wfB_pairI \<Theta> \<B> b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfB_consI \<Theta> s dclist \<B>)
+  then show ?case using wf_intros by metis
+next
+  case (wfB_appI \<Theta> b s bv dclist \<B>)
+  then show ?case using wf_intros by metis
+next
+  case (wfV_varI \<Theta> \<B> \<Gamma>'' b' c x')
+  hence wfg: \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<close> by auto
+  show ?case proof(cases "x=x'")
+    case True
+    hence "Some (b, TRUE) = lookup (\<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) x'" using lookup.simps lookup_inside_wf wfg by simp
+    thus ?thesis using Wellformed.wfV_varI[OF wfg] 
+      by (metis True lookup_inside_wf old.prod.inject option.inject wfV_varI.hyps(1) wfV_varI.hyps(3) wfV_varI.prems)        
+  next
+    case False
+    hence "Some (b', c) = lookup (\<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) x'" using  lookup_inside2  wfV_varI by metis
+    then show ?thesis using Wellformed.wfV_varI[OF wfg]                                     
+      by (metis wfG_elim2 wfG_suffix wfV_varI.hyps(1) wfV_varI.hyps(2) wfV_varI.hyps(3) 
+          wfV_varI.prems Wellformed.wfV_varI wf_replace_inside(1))
+  qed
+next
+  case (wfV_litI \<Theta> \<B> \<Gamma> l)
+  then show ?case using wf_intros using wf_intros by metis
+next
+  case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfV_consI s dclist \<Theta> dc x b' c \<B> \<Gamma> v)
+  then show ?case using wf_intros by metis
+next
+  case (wfV_conspI s bv dclist \<Theta> dc xc bc cc \<B> b' \<Gamma>'' v)
+  show ?case proof 
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by metis
+    show \<open>(dc, \<lbrace> xc : bc  | cc \<rbrace>) \<in> set dclist\<close>  using wfV_conspI by metis
+    show \<open> \<Theta> ;\<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close>  using wfV_conspI by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : bc[bv::=b']\<^sub>b\<^sub>b \<close>  using wfV_conspI by metis
+    have "atom bv \<sharp> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>" using fresh_u_replace_true wfV_conspI by metis
+    thus  \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, b', v)\<close>  using wfV_conspI fresh_prodN by metis
+  qed
+next
+  case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
+  then show ?case using wf_intros by metis
+next
+  case (wfTI z \<Theta> \<B> \<Gamma>''  b' c')
+  show ?case proof
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>)\<close>  using wfTI fresh_append_g fresh_GCons fresh_prodN  by auto
+    show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfTI by metis
+    show \<open> \<Theta>; \<B>; (z, b', TRUE) #\<^sub>\<Gamma> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c' \<close>  using wfTI append_g.simps by metis
+  qed
+next
+  case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
+  then show ?case using wf_intros by metis
+next
+  case (wfC_trueI \<Theta> \<B> \<Gamma>)
+  then show ?case using wf_intros by metis
+next
+  case (wfC_falseI \<Theta> \<B> \<Gamma>)
+  then show ?case using wf_intros by metis
+next
+  case (wfC_conjI \<Theta> \<B> \<Gamma> c1 c2)
+  then show ?case using wf_intros by metis
+next
+  case (wfC_disjI \<Theta> \<B> \<Gamma> c1 c2)
+  then show ?case using wf_intros by metis
+next
+  case (wfC_notI \<Theta> \<B> \<Gamma> c1)
+  then show ?case using wf_intros by metis
+next
+  case (wfC_impI \<Theta> \<B> \<Gamma> c1 c2)
+  then show ?case using wf_intros by metis
+next
+  case (wfG_nilI \<Theta> \<B>)
+  then show ?case  using GNil_append by blast
+next
+  case (wfG_cons1I c \<Theta> \<B> \<Gamma>'' x b)
+  then show ?case using wf_intros wfG_cons_TRUE2 wfG_elims(2) wfG_replace_inside wfG_suffix
+    by (metis (no_types, lifting))
+next
+  case (wfG_cons2I c \<Theta> \<B> \<Gamma>'' x' b)
+  then show ?case using wf_intros 
+    by (metis wfG_cons_TRUE2 wfG_elims(2) wfG_replace_inside wfG_suffix)
+next
+  case wfTh_emptyI
+  then show ?case  using wf_intros by metis
+next
+  case (wfTh_consI tdef \<Theta>)
+  then show ?case  using wf_intros by metis
+next
+  case (wfTD_simpleI \<Theta> lst s)
+  then show ?case  using wf_intros by metis
+next
+  case (wfTD_poly \<Theta> bv lst s)
+  then show ?case  using wf_intros by metis
+next
+  case (wfTs_nil \<Theta> \<B> \<Gamma>)
+  then show ?case  using wf_intros by metis
+next
+  case (wfTs_cons \<Theta> \<B> \<Gamma> \<tau> dc ts)
+  then show ?case  using wf_intros by metis
+qed
+
+lemma wf_replace_true2:
+  fixes \<Gamma>::\<Gamma> and \<Phi>::\<Phi> and \<Theta>::\<Theta> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b'::b and b::b and s::s  
+    and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list
+
+shows   "\<Theta> ; \<Phi> ;  \<B> ; G ; D  \<turnstile>\<^sub>w\<^sub>f e : b' \<Longrightarrow> G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow>  \<Theta> ; \<Phi> ;  \<B> ;  \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>); D \<turnstile>\<^sub>w\<^sub>f e : b'" and
+  "\<Theta> ; \<Phi> ; \<B> ; G ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b' \<Longrightarrow>  G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow> \<Theta> ; \<Phi> ; \<B> ;   \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b'" and
+  "\<Theta> ; \<Phi> ; \<B> ; G ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b' \<Longrightarrow>   G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow> \<Theta> ; \<Phi> ; \<B> ;  \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b'" and
+  "\<Theta> ; \<Phi> ; \<B> ; G ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b' \<Longrightarrow>   G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow> \<Theta> ; \<Phi> ; \<B> ;   \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b'" and
+
+"\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<Longrightarrow> True" and
+"\<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow>  G =   \<Gamma>' @(x, b, c) #\<^sub>\<Gamma> \<Gamma> \<Longrightarrow>  \<Theta> ;  \<B> ;  \<Gamma>' @ ((x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f \<Delta>" and
+
+"\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+"\<Theta> ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
+proof(nominal_induct   
+    b' and b' and b' and b' and \<Phi> and \<Delta> and ftq and ft 
+    arbitrary: \<Gamma> \<Gamma>'  and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>' and \<Gamma> \<Gamma>'
+    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+
+  case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  then show ?case using wf_intros using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma>'' \<Delta> b' bv v \<tau> f x1 b1 c1 s)
+  show ?case proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI wf_replace_true1 by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by metis
+    show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by metis
+    have "atom bv \<sharp> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>" using fresh_u_replace_true wfE_appPI fresh_prodN by metis
+    thus  \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> 
+      using wfE_appPI fresh_prodN by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x1 b1 c1 \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b1[bv::=b']\<^sub>b  \<close> using wfE_appPI wf_replace_true1 by metis
+  qed
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+
+  case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfS_letI  \<Theta> \<Phi> \<B> \<Gamma>'' \<Delta> e b' x1 s b1)
+  show ?case proof 
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI wf_replace_true1 by metis
+    have  \<open> \<Theta> ; \<Phi> ; \<B> ; ((x1, b', TRUE) #\<^sub>\<Gamma> \<Gamma>') @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b1 \<close> apply(rule  wfS_letI(4))
+      using wfS_letI  append_g.simps by simp
+    thus  \<open> \<Theta> ; \<Phi> ; \<B> ; (x1, b', TRUE) #\<^sub>\<Gamma> \<Gamma>'@ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b1 \<close> using append_g.simps by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_letI by metis
+    show "atom x1 \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, e, b1)" using fresh_append_g fresh_GCons fresh_prodN wfS_letI by auto
+  qed
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x' c \<Gamma>'' \<Delta> s b')
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x', B_bool, c) #\<^sub>\<Gamma> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b' \<close> 
+      using wfS_assertI (2)[of "(x', B_bool, c) #\<^sub>\<Gamma> \<Gamma>'" \<Gamma>] wfS_assertI by simp
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI wf_replace_true1 by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_assertI by metis    
+    show  \<open>atom x' \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, c, b', s)\<close> using wfS_assertI fresh_prodN by simp
+  qed
+next
+  case (wfS_let2I  \<Theta> \<Phi> \<B> \<Gamma>'' \<Delta> s1 \<tau>  x' s2 ba')
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I wf_replace_true1 by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close>  using wfS_let2I wf_replace_true1 by metis
+    have  \<open> \<Theta> ; \<Phi> ; \<B> ; ((x', b_of \<tau>, TRUE) #\<^sub>\<Gamma> \<Gamma>') @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : ba' \<close>  
+      apply(rule wfS_let2I(5))
+      using wfS_let2I append_g.simps by auto
+    thus \<open> \<Theta> ; \<Phi> ; \<B> ; (x', b_of \<tau>, TRUE) #\<^sub>\<Gamma> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : ba' \<close>  using wfS_let2I append_g.simps by auto
+    show \<open>atom x' \<sharp>  (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, s1, ba', \<tau>)\<close>   using fresh_append_g fresh_GCons fresh_prodN wfS_let2I by auto
+  qed
+next
+  case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma>'' \<tau> v u \<Phi> \<Delta>  b' s)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI wf_replace_true1 by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close>  using wfS_varI wf_replace_true1 by metis
+    show \<open>atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, \<tau>, v, b')\<close>  using wfS_varI u_fresh_g fresh_prodN by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; (u, \<tau>) #\<^sub>\<Delta> \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b' \<close>  using wfS_varI by metis
+  qed
+
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wf_intros wf_replace_true1 by metis
+next
+  case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma>'' v tid dclist \<Delta> \<Phi> cs b')
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_id tid \<close> using wfS_matchI wf_replace_true1 by auto
+    show \<open>AF_typedef tid dclist \<in> set \<Theta>\<close> using wfS_matchI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_matchI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfS_matchI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f cs : b' \<close> using wfS_matchI by auto
+  qed
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x' \<tau> \<Gamma>'' \<Delta> s b' tid dc)
+  show ?case proof
+    have \<open> \<Theta> ; \<Phi> ; \<B> ; ((x', b_of \<tau>, TRUE) #\<^sub>\<Gamma> \<Gamma>') @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b' \<close> using wfS_branchI append_g.simps by metis
+    thus  \<open> \<Theta> ; \<Phi> ; \<B> ; (x', b_of \<tau>, TRUE) #\<^sub>\<Gamma> \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b' \<close> using wfS_branchI append_g.simps append_g.simps by metis
+    show \<open>atom x' \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<Delta>, \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>, \<tau>)\<close> using wfS_branchI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_branchI by auto
+  qed
+next
+  case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dc t cs b)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dc t cs b dclist css)
+  then show ?case using wf_intros by metis
+next
+  case (wfD_emptyI \<Theta> \<B> \<Gamma>)
+  then show ?case  using wf_intros wf_replace_true1 by metis
+next
+  case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  then show ?case  using wf_intros wf_replace_true1 by metis
+next
+  case (wfPhi_emptyI \<Theta>)
+  then show ?case  using wf_intros by metis
+next
+  case (wfPhi_consI f \<Theta> \<Phi> ft)
+  then show ?case  using wf_intros by metis
+next
+  case (wfFTNone \<Theta> \<Phi> ft)
+  then show ?case  using wf_intros by metis
+next
+  case (wfFTSome \<Theta> \<Phi> bv ft)
+  then show ?case  using wf_intros by metis
+next
+  case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
+  then show ?case  using wf_intros by metis
+qed
+
+lemmas wf_replace_true = wf_replace_true1 wf_replace_true2
+
+section \<open>Subtyping\<close>
+
+lemma subtype_reflI2:
+  fixes \<tau>::\<tau>
+  assumes  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<tau>"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau> \<lesssim> \<tau>"
+proof -
+  obtain z b c where *:"\<tau> = \<lbrace> z : b  | c \<rbrace> \<and> atom z \<sharp> (\<Theta>,\<B>,\<Gamma>) \<and>  \<Theta>; \<B>; (z, b, TRUE) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c" 
+    using  wfT_elims(1)[OF assms] by metis
+  obtain x::x where **: "atom x \<sharp> (\<Theta>, \<B>, \<Gamma>, c,  z ,c, z , c )" using obtain_fresh by metis
+  have "\<Theta>; \<B>; \<Gamma> \<turnstile> \<lbrace> z : b  | c \<rbrace> \<lesssim> \<lbrace> z : b  | c \<rbrace>" proof
+    show "\<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace>" using * assms by auto
+    show "\<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace>" using * assms by auto
+    show "atom x \<sharp> (\<Theta>, \<B>, \<Gamma>, z , c , z , c )" using fresh_prod6 fresh_prod5 ** by metis
+    thus  "\<Theta>; \<B>; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=V_var x]\<^sub>v  " using wfT_wfC_cons assms * ** subst_v_c_def  by simp
+  qed
+  thus ?thesis using * by auto
+qed
+
+lemma subtype_reflI:  
+  assumes "\<lbrace> z1 : b | c1 \<rbrace>  =  \<lbrace> z2 : b | c2 \<rbrace>" and wf1: "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f (\<lbrace> z1 : b | c1 \<rbrace>)"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile>  (\<lbrace> z1 : b | c1 \<rbrace>)  \<lesssim>  (\<lbrace> z2 : b | c2 \<rbrace>)"
+  using assms subtype_reflI2 by metis
+
+nominal_function base_eq :: "\<Gamma> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> bool" where
+  "base_eq _ \<lbrace> z1 : b1| c1 \<rbrace>  \<lbrace> z2 : b2 | c2 \<rbrace> = (b1 = b2)" 
+  apply(auto,simp add: eqvt_def base_eq_graph_aux_def )
+  by (meson \<tau>.exhaust)
+nominal_termination (eqvt)  by lexicographic_order
+
+lemma subtype_wfT:
+  fixes t1::\<tau> and t2::\<tau>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> t1 \<lesssim> t2" 
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f t1 \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f t2"
+  using assms subtype_elims by metis
+
+lemma  subtype_eq_base:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>  (\<lbrace> z1 : b1| c1 \<rbrace>)  \<lesssim> (\<lbrace> z2 : b2 | c2 \<rbrace>)"
+  shows "b1=b2"
+  using subtype.simps  assms by auto
+
+lemma subtype_eq_base2: 
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> t1  \<lesssim> t2"
+  shows "b_of t1 = b_of t2"
+  using assms proof(rule  subtype.induct[of \<Theta>  \<B> \<Gamma> t1 t2],goal_cases)
+  case (1 \<Theta>  \<Gamma> z1 b c1 z2 c2 x)
+  then show ?case using subtype_eq_base by auto
+qed
+
+lemma  subtype_wf: 
+  fixes \<tau>1::\<tau> and \<tau>2::\<tau>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>  \<tau>1  \<lesssim>  \<tau>2" 
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>1 \<and>\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>2"
+  using assms
+proof(rule  subtype.induct[of \<Theta> \<B> \<Gamma> \<tau>1 \<tau>2],goal_cases)
+  case (1 \<Theta>  \<Gamma>G z1 b c1 z2 c2 x)
+  then show ?case by blast
+qed
+
+lemma  subtype_g_wf: 
+  fixes \<tau>1::\<tau> and \<tau>2::\<tau> and \<Gamma>::\<Gamma>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>  \<tau>1  \<lesssim>  \<tau>2" 
+  shows "\<Theta> ; \<B>\<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  using assms
+proof(rule  subtype.induct[of \<Theta> \<B> \<Gamma> \<tau>1 \<tau>2],goal_cases)
+  case (1 \<Theta> \<B> \<Gamma> z1 b c1 z2 c2 x)
+  then show ?case using wfX_wfY by auto
+qed
+
+text \<open> For when we have a particular y that satisfies  the freshness conditions that we want the validity check to use \<close>
+
+lemma valid_flip_simple: 
+  assumes "\<Theta>; \<B>; (z, b, c) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'" and  "atom z \<sharp> \<Gamma>" and "atom x \<sharp> (z, c, z, c', \<Gamma>)"
+  shows "\<Theta>; \<B>; (x, b, (z \<leftrightarrow> x ) \<bullet> c) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> (z \<leftrightarrow> x ) \<bullet> c'"
+proof -
+  have "(z \<leftrightarrow> x ) \<bullet> \<Theta>; \<B>; (z \<leftrightarrow> x ) \<bullet> ((z, b,  c) #\<^sub>\<Gamma> \<Gamma>)  \<Turnstile> (z \<leftrightarrow> x ) \<bullet> c'"
+    using True_eqvt valid.eqvt assms beta_flip_eq wfX_wfY by metis
+  moreover have " \<turnstile>\<^sub>w\<^sub>f \<Theta>" using valid.simps wfC_wf wfG_wf assms by metis
+  ultimately show ?thesis 
+    using theta_flip_eq G_cons_flip_fresh3[of x \<Gamma> z b c]  assms fresh_Pair flip_commute by metis
+qed
+
+lemma valid_wf_all:
+  assumes " \<Theta>; \<B>; (z0,b,c0)#\<^sub>\<Gamma>G \<Turnstile> c"   
+  shows "wfG \<Theta> \<B> G" and "wfC \<Theta> \<B> ((z0,b,c0)#\<^sub>\<Gamma>G) c" and "atom z0 \<sharp> G"
+  using valid.simps wfC_wf wfG_cons assms by metis+
+
+lemma valid_wfT: 
+  fixes z::x
+  assumes " \<Theta>; \<B>; (z0,b,c0[z::=V_var z0]\<^sub>v)#\<^sub>\<Gamma>G \<Turnstile> c[z::=V_var z0]\<^sub>v" and "atom z0 \<sharp> (\<Theta>, \<B>, G,c,c0)"
+  shows "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c0 \<rbrace>"    and  "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>"
+proof -
+  have "atom z0 \<sharp> c0" using assms fresh_Pair by auto
+  moreover have *:" \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f (z0,b,c0[z::=V_var z0]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>G" using valid_wf_all wfX_wfY assms subst_v_c_def by metis
+  ultimately show wft: "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c0 \<rbrace>"  using wfG_wfT[OF *] by auto
+
+  have "atom z0 \<sharp> c" using assms fresh_Pair by auto
+  moreover have wfc: "\<Theta>; \<B>; (z0,b,c0[z::=V_var z0]\<^sub>v)#\<^sub>\<Gamma>G  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var z0]\<^sub>v" using valid_wf_all assms by metis
+  have  "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z0 : b | c[z::=V_var z0]\<^sub>v \<rbrace>" proof
+    show \<open>atom z0 \<sharp> (\<Theta>, \<B>, G)\<close> using assms fresh_prodN by simp
+    show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wft wfT_wfB by force
+    show \<open> \<Theta>; \<B>; (z0, b, TRUE) #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c[z::=[ z0 ]\<^sup>v]\<^sub>v \<close> using wfc wfC_replace_inside[OF wfc, of GNil z0 b "c0[z::=[ z0 ]\<^sup>v]\<^sub>v" G C_true] wfC_trueI 
+        append_g.simps 
+      by (metis "local.*" wfG_elim2 wf_trans(2))
+  qed
+  moreover have "\<lbrace> z0 : b | c[z::=V_var z0]\<^sub>v \<rbrace> =  \<lbrace> z : b | c \<rbrace>" using \<open>atom z0 \<sharp> c0\<close> \<tau>.eq_iff  Abs1_eq_iff(3) 
+    using calculation(1) subst_v_c_def by auto
+  ultimately show   "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" by auto
+qed
+
+lemma valid_flip: 
+  fixes c::c and z::x and z0::x and xx2::x
+  assumes " \<Theta>; \<B>; (xx2, b, c0[z0::=V_var xx2]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=V_var xx2]\<^sub>v" and 
+    "atom xx2 \<sharp> (c0,\<Gamma>,c,z) " and "atom z0 \<sharp> (\<Gamma>,c,z)"
+  shows " \<Theta>; \<B>; (z0, b, c0) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[z::=V_var z0]\<^sub>v"
+proof -
+
+  have " \<turnstile>\<^sub>w\<^sub>f \<Theta>" using assms valid_wf_all wfX_wfY by metis
+  hence " \<Theta> ;  \<B> ; (xx2 \<leftrightarrow> z0 ) \<bullet> ((xx2, b, c0[z0::=V_var xx2]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)  \<Turnstile> ((xx2 \<leftrightarrow> z0 ) \<bullet> c[z::=V_var xx2]\<^sub>v)"
+    using valid.eqvt True_eqvt assms beta_flip_eq theta_flip_eq by metis
+  hence " \<Theta>; \<B>; (((xx2 \<leftrightarrow> z0 ) \<bullet> xx2, b, (xx2 \<leftrightarrow> z0 ) \<bullet> c0[z0::=V_var xx2]\<^sub>v) #\<^sub>\<Gamma> (xx2 \<leftrightarrow> z0 ) \<bullet> \<Gamma>)  \<Turnstile> ((xx2 \<leftrightarrow> z0 ) \<bullet>(c[z::=V_var xx2]\<^sub>v))"
+    using G_cons_flip[of xx2 z0 xx2 b "c0[z0::=V_var xx2]\<^sub>v" \<Gamma>] by auto
+  moreover have "(xx2 \<leftrightarrow> z0 ) \<bullet> xx2 = z0" by simp
+  moreover have "(xx2 \<leftrightarrow> z0 ) \<bullet> c0[z0::=V_var xx2]\<^sub>v = c0" 
+    using assms subst_cv_v_flip[of xx2 c0 z0 "V_var z0"] assms fresh_prod4 by auto
+  moreover have "(xx2 \<leftrightarrow> z0 ) \<bullet> \<Gamma> = \<Gamma>" proof -  
+    have "atom xx2 \<sharp> \<Gamma>" using assms by auto
+    moreover have "atom z0 \<sharp> \<Gamma>" using assms by auto
+    ultimately show ?thesis using flip_fresh_fresh by auto
+  qed
+  moreover have "(xx2 \<leftrightarrow> z0 ) \<bullet> (c[z::=V_var xx2]\<^sub>v) =c[z::=V_var z0]\<^sub>v" 
+    using subst_cv_v_flip3 assms by simp
+  ultimately show ?thesis by auto
+qed
+
+lemma subtype_valid:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> t1  \<lesssim> t2" and "atom y \<sharp> \<Gamma>" and "t1 = \<lbrace> z1 : b  | c1 \<rbrace>" and "t2 =  \<lbrace> z2 : b  | c2 \<rbrace>"
+  shows  "\<Theta>; \<B>; ((y, b, c1[z1::=V_var y]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile> c2[z2::=V_var y]\<^sub>v"
+  using assms proof(nominal_induct t2 avoiding: y rule: subtype.strong_induct)
+  case (subtype_baseI x \<Theta> \<B> \<Gamma> z c z' c' ba)
+
+  hence "(x \<leftrightarrow> y) \<bullet> \<Theta> ; (x \<leftrightarrow> y) \<bullet> \<B> ; (x \<leftrightarrow> y) \<bullet> ((x, ba, c[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)  \<Turnstile> (x \<leftrightarrow> y) \<bullet> c'[z'::=[ x ]\<^sup>v]\<^sub>v" using valid.eqvt 
+    using permute_boolI by blast
+  moreover have  " \<turnstile>\<^sub>w\<^sub>f \<Theta>" using valid.simps wfC_wf wfG_wf subtype_baseI by metis
+  ultimately have  "\<Theta>; \<B>;  ((y, ba, (x \<leftrightarrow> y) \<bullet> c[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)  \<Turnstile> (x \<leftrightarrow> y) \<bullet> c'[z'::=[ x ]\<^sup>v]\<^sub>v" 
+    using subtype_baseI theta_flip_eq beta_flip_eq \<tau>.eq_iff  G_cons_flip_fresh3[of y \<Gamma> x ba]  by (metis flip_commute)
+  moreover have "(x \<leftrightarrow> y) \<bullet> c[z::=[ x ]\<^sup>v]\<^sub>v = c1[z1::=[ y ]\<^sup>v]\<^sub>v" 
+    by (metis subtype_baseI permute_flip_cancel subst_cv_id subst_cv_v_flip3 subst_cv_var_flip type_eq_subst_eq wfT_fresh_c subst_v_c_def)
+  moreover have  "(x \<leftrightarrow> y) \<bullet> c'[z'::=[ x ]\<^sup>v]\<^sub>v = c2[z2::=[ y ]\<^sup>v]\<^sub>v" 
+    by (metis subtype_baseI permute_flip_cancel subst_cv_id subst_cv_v_flip3 subst_cv_var_flip type_eq_subst_eq wfT_fresh_c subst_v_c_def)
+
+  ultimately show ?case using subtype_baseI \<tau>.eq_iff by metis
+qed
+
+lemma subtype_valid_simple:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> t1  \<lesssim> t2" and "atom z \<sharp> \<Gamma>" and "t1 = \<lbrace> z : b  | c1 \<rbrace>" and "t2 =  \<lbrace> z : b  | c2 \<rbrace>"
+  shows  "\<Theta>; \<B>; ((z, b, c1) #\<^sub>\<Gamma> \<Gamma>) \<Turnstile> c2"
+  using subst_v_c_def subst_v_id assms subtype_valid[OF assms] by simp
+
+lemma obtain_for_t_with_fresh:
+  assumes "atom x \<sharp> t"
+  shows "\<exists>b c. t = \<lbrace> x : b | c \<rbrace>"
+proof -
+  obtain z1 b1 c1 where *:" t =  \<lbrace> z1 : b1 | c1 \<rbrace> \<and> atom z1 \<sharp> t" using obtain_fresh_z by metis
+  then have "t = (x \<leftrightarrow> z1) \<bullet> t" using flip_fresh_fresh assms by metis
+  also have "... = \<lbrace> (x \<leftrightarrow> z1) \<bullet> z1 : (x \<leftrightarrow> z1) \<bullet> b1 | (x \<leftrightarrow> z1) \<bullet> c1 \<rbrace>" using * assms by simp
+  also have "... = \<lbrace> x : b1 | (x \<leftrightarrow> z1) \<bullet> c1 \<rbrace>" using * assms by auto
+  finally show ?thesis by auto
+qed
+
+lemma subtype_trans: 
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>1 \<lesssim> \<tau>2" and "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>2 \<lesssim> \<tau>3"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>1 \<lesssim> \<tau>3"
+  using assms proof(nominal_induct  avoiding: \<tau>3 rule: subtype.strong_induct)
+  case (subtype_baseI x \<Theta> \<B> \<Gamma> z c z' c' b)
+  hence "b_of \<tau>3 = b" using  subtype_eq_base2 b_of.simps by metis
+  then obtain z'' c'' where t3: "\<tau>3 = \<lbrace> z'' : b | c''\<rbrace> \<and> atom z'' \<sharp> x" 
+    using obtain_fresh_z2 by metis
+  hence xf: "atom x \<sharp> (z'', c'')" using fresh_prodN subtype_baseI \<tau>.fresh by auto
+  have "\<Theta>; \<B>; \<Gamma> \<turnstile> \<lbrace> z : b  | c \<rbrace> \<lesssim> \<lbrace> z'' : b | c''\<rbrace>" 
+  proof(rule Typing.subtype_baseI)
+    show \<open>atom x \<sharp> (\<Theta>, \<B>, \<Gamma>, z, c, z'', c'')\<close> using t3 fresh_prodN subtype_baseI xf by simp
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace> \<close> using subtype_baseI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z'' : b  | c'' \<rbrace> \<close> using subtype_baseI t3 subtype_elims by metis
+    have " \<Theta>; \<B>; (x, b, c'[z'::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c''[z''::=[ x ]\<^sup>v]\<^sub>v "
+      using subtype_valid[OF \<open>\<Theta>; \<B>; \<Gamma>  \<turnstile> \<lbrace> z' : b  | c' \<rbrace> \<lesssim> \<tau>3\<close> , of x z' b c' z'' c''] subtype_baseI 
+        t3 by simp
+    thus \<open>\<Theta>; \<B>; (x, b, c[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c''[z''::=[ x ]\<^sup>v]\<^sub>v \<close>
+      using  valid_trans_full[of \<Theta> \<B> x b c z \<Gamma> c' z' c'' z'' ] subtype_baseI  t3 by simp
+  qed
+  thus ?case using t3 by simp
+qed
+
+lemma subtype_eq_e:
+  assumes "\<forall>i s1 s2 G. wfG P \<B> G \<and> wfI P G i \<and> eval_e i e1 s1 \<and> eval_e i e2 s2 \<longrightarrow> s1 = s2"   and "atom z1 \<sharp> e1" and "atom z2 \<sharp> e2" and "atom z1 \<sharp> \<Gamma>" and "atom z2 \<sharp> \<Gamma>"
+    and "wfCE P  \<B> \<Gamma>  e1 b" and "wfCE P  \<B> \<Gamma>  e2 b" 
+  shows "P; \<B>; \<Gamma> \<turnstile> \<lbrace> z1 : b  | CE_val (V_var z1)  ==  e1 \<rbrace> \<lesssim> (\<lbrace> z2 : b  | CE_val (V_var z2)  ==  e2  \<rbrace>)"
+proof -
+
+  have "wfCE P  \<B> \<Gamma> e1 b" and "wfCE P  \<B> \<Gamma>  e2 b" using  assms by auto
+
+  have wst1: "wfT P \<B> \<Gamma> (\<lbrace> z1 : b  | CE_val (V_var z1)  ==  e1  \<rbrace>)" 
+    using wfC_e_eq  wfTI assms wfX_wfB wfG_fresh_x 
+    by (simp add: wfT_e_eq)
+
+  moreover have wst2:"wfT P \<B> \<Gamma> (\<lbrace> z2 : b  | CE_val (V_var z2)  ==  e2  \<rbrace>)" 
+    using wfC_e_eq wfX_wfB wfTI assms wfG_fresh_x 
+    by (simp add: wfT_e_eq)
+
+  moreover obtain x::x where xf: "atom x \<sharp> (P,  \<B> , z1, CE_val (V_var z1)  ==  e1 , z2, CE_val (V_var z2)  ==  e2 , \<Gamma>)" using obtain_fresh by blast
+  moreover have vld: "P; \<B> ; (x, b, (CE_val (V_var z1)  ==  e1 )[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> (CE_val (V_var z2)  ==  e2 )[z2::=V_var x]\<^sub>v "  (is "P; \<B> ; ?G \<Turnstile> ?c")
+  proof -
+
+    have wbg: "P; \<B> \<turnstile>\<^sub>w\<^sub>f ?G  \<and> P ;  \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  toSet \<Gamma> \<subseteq> toSet ?G"  proof -        
+      have "P; \<B> \<turnstile>\<^sub>w\<^sub>f ?G"  proof(rule wfG_consI) 
+        show "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using assms wfX_wfY by metis
+        show "atom x \<sharp> \<Gamma>" using xf by auto
+        show "P; \<B>  \<turnstile>\<^sub>w\<^sub>f b " using assms(6) wfX_wfB by auto
+        show "P; \<B> ; (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f (CE_val (V_var z1)  ==  e1 )[z1::=V_var x]\<^sub>v " 
+          using wfC_e_eq[OF assms(6)] wf_subst(2)
+          by (simp add: \<open>atom x \<sharp> \<Gamma>\<close> assms(2) subst_v_c_def)
+      qed
+      moreover hence  "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using wfG_elims by metis
+      ultimately show ?thesis using toSet.simps by auto 
+    qed
+
+    have wsc: "wfC P \<B> ?G ?c" proof -
+      have "wfCE P \<B> ?G  (CE_val (V_var x)) b" proof      
+        show \<open> P; \<B> ; (x, b, (CE_val (V_var z1)  ==  e1 )[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_var x : b \<close> using wfV_varI lookup.simps wbg by auto
+      qed
+      moreover have "wfCE P \<B> ?G e2 b" using wf_weakening assms wbg by metis
+      ultimately have "wfC P \<B> ?G  (CE_val (V_var x)  ==  e2 )" using wfC_eqI by simp
+      thus ?thesis using subst_cv.simps(6) \<open>atom z2 \<sharp> e2\<close> subst_v_c_def by simp
+    qed
+
+    moreover have "\<forall>i. wfI P ?G i \<and> is_satis_g i ?G \<longrightarrow> is_satis i ?c" proof(rule allI , rule impI)
+      fix i
+      assume as: "wfI P ?G i \<and> is_satis_g i ?G" 
+      hence "is_satis i  ((CE_val (V_var z1)  ==  e1 )[z1::=V_var x]\<^sub>v)" 
+        by (simp add: is_satis_g.simps(2))
+      hence "is_satis i  (CE_val (V_var x)  ==  e1 )" using subst_cv.simps assms subst_v_c_def by auto
+      then obtain s1 and s2 where *:"eval_e i (CE_val (V_var x)) s1 \<and> eval_e i e1 s2 \<and> s1=s2" using is_satis.simps eval_c_elims by metis
+      moreover hence "eval_e i e2 s1" proof -
+        have **:"wfI P ?G i" using as by auto
+        moreover have "wfCE  P \<B> ?G e1 b \<and> wfCE  P \<B> ?G  e2 b" using assms xf wf_weakening wbg by metis
+        moreover then  obtain s2' where "eval_e i e2 s2'" using assms wfI_wfCE_eval_e ** by metis
+        ultimately show ?thesis using * assms(1) wfX_wfY by metis
+      qed
+      ultimately have  "is_satis i  (CE_val (V_var x)  ==  e2 )" using is_satis.simps eval_c_eqI by force
+      thus "is_satis i  ((CE_val (V_var z2)  ==  e2 )[z2::=V_var x]\<^sub>v)"  using is_satis.simps eval_c_eqI assms subst_cv.simps subst_v_c_def by auto
+    qed
+    ultimately show ?thesis using valid.simps by simp
+  qed
+  moreover have "atom x \<sharp> (P, \<B>, \<Gamma>,  z1 ,  CE_val (V_var z1)  ==  e1, z2,  CE_val (V_var z2)  ==  e2 ) " 
+    unfolding fresh_prodN using  xf fresh_prod7 \<tau>.fresh by fast
+  ultimately show ?thesis using subtype_baseI[OF _ wst1 wst2  vld] xf by simp
+qed
+
+lemma subtype_eq_e_nil:
+  assumes  "\<forall>i s1 s2 G. wfG P \<B> G \<and> wfI P G i \<and> eval_e i e1 s1 \<and> eval_e i e2 s2 \<longrightarrow> s1 = s2" and "supp e1 = {}" and "supp e2 = {}" and "wfTh P" 
+    and "wfCE  P  \<B> GNil  e1 b" and "wfCE  P  \<B> GNil  e2 b"  and "atom z1 \<sharp> GNil" and "atom z2 \<sharp> GNil"
+  shows "P; \<B> ; GNil  \<turnstile> \<lbrace> z1 : b  | CE_val (V_var z1)  ==  e1 \<rbrace> \<lesssim> (\<lbrace> z2 : b  | CE_val (V_var z2)  ==  e2  \<rbrace>)"
+  apply(rule subtype_eq_e,auto simp add: assms e.fresh)
+  using  assms fresh_def e.fresh  supp_GNil by metis+
+
+lemma subtype_gnil_fst_aux:
+  assumes "supp v\<^sub>1 = {}" and "supp (V_pair v\<^sub>1 v\<^sub>2) = {}" and "wfTh P" and "wfCE  P \<B> GNil (CE_val v\<^sub>1) b" and "wfCE  P \<B> GNil  (CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e) b" and 
+    "wfCE  P \<B> GNil  (CE_val v\<^sub>2) b2"  and "atom z1 \<sharp> GNil" and "atom z2 \<sharp> GNil"
+  shows "P; \<B> ; GNil  \<turnstile> (\<lbrace> z1 : b | CE_val (V_var z1)  ==  CE_val v\<^sub>1  \<rbrace>) \<lesssim> (\<lbrace> z2 : b | CE_val (V_var z2)  ==  CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e \<rbrace>)"
+proof - 
+  have "\<forall>i s1 s2 G . wfG P \<B> G \<and> wfI P G i \<and> eval_e i ( CE_val v\<^sub>1) s1 \<and> eval_e i  (CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e) s2 \<longrightarrow> s1 = s2" proof(rule+) 
+    fix i s1 s2 G
+    assume as: "wfG P \<B> G \<and> wfI P G i \<and> eval_e i (CE_val v\<^sub>1) s1 \<and> eval_e i (CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e) s2"
+    hence "wfCE  P \<B> G  (CE_val v\<^sub>2) b2" using assms wf_weakening 
+      by (metis empty_subsetI toSet.simps(1))
+    then obtain s3 where "eval_e i (CE_val v\<^sub>2) s3" using wfI_wfCE_eval_e as by metis
+    hence "eval_v i ((V_pair  v\<^sub>1 v\<^sub>2)) (SPair s1 s3)"
+      by (meson as eval_e_elims(1) eval_v_pairI)
+    hence "eval_e i (CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e) s1" using eval_e_fstI eval_e_valI by metis
+    show "s1 = s2" using as eval_e_uniqueness
+      using \<open>eval_e i (CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e) s1\<close> by auto
+  qed
+  thus ?thesis using subtype_eq_e_nil  ce.supp assms by auto
+qed
+
+lemma subtype_gnil_snd_aux:
+  assumes "supp v\<^sub>2 = {}" and "supp (V_pair v\<^sub>1 v\<^sub>2) = {}" and "wfTh P" and "wfCE  P \<B> GNil  (CE_val v\<^sub>2) b" and 
+    "wfCE  P \<B> GNil  (CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e) b" and 
+    "wfCE  P \<B> GNil  (CE_val v\<^sub>1) b2"  and "atom z1 \<sharp> GNil" and "atom z2 \<sharp> GNil"
+  shows "P; \<B> ; GNil  \<turnstile> (\<lbrace> z1 : b | CE_val (V_var z1)  ==  CE_val v\<^sub>2  \<rbrace>) \<lesssim> (\<lbrace> z2 : b | CE_val (V_var z2)  ==  CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e \<rbrace>)"
+proof - 
+  have "\<forall>i s1 s2 G. wfG P \<B> G \<and> wfI P G i \<and> eval_e i ( CE_val v\<^sub>2) s1 \<and> eval_e i  (CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e) s2 \<longrightarrow> s1 = s2" proof(rule+) 
+    fix i s1 s2 G
+    assume as: " wfG P \<B> G \<and> wfI P G i \<and> eval_e i (CE_val v\<^sub>2) s1 \<and> eval_e i (CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e) s2"
+    hence "wfCE  P \<B> G  (CE_val v\<^sub>1) b2" using assms wf_weakening 
+      by (metis empty_subsetI toSet.simps(1))
+    then obtain s3 where "eval_e i (CE_val v\<^sub>1) s3" using wfI_wfCE_eval_e as by metis
+    hence "eval_v i ((V_pair  v\<^sub>1 v\<^sub>2)) (SPair s3 s1)"
+      by (meson as eval_e_elims eval_v_pairI)
+    hence "eval_e i (CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e) s1" using eval_e_sndI eval_e_valI by metis
+    show "s1 = s2" using as eval_e_uniqueness
+      using \<open>eval_e i (CE_snd [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e) s1\<close> by auto
+  qed
+  thus ?thesis using assms subtype_eq_e_nil  by (simp add: ce.supp ce.supp)
+qed
+
+lemma subtype_gnil_fst:
+  assumes "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f  [#1[[v\<^sub>1,v\<^sub>2]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e : b" 
+  shows "\<Theta> ;  {||} ; GNil  \<turnstile> (\<lbrace> z\<^sub>1 : b | [[z\<^sub>1]\<^sup>v]\<^sup>c\<^sup>e ==  [v\<^sub>1]\<^sup>c\<^sup>e  \<rbrace>) \<lesssim> 
+        (\<lbrace> z\<^sub>2 : b | [[z\<^sub>2]\<^sup>v]\<^sup>c\<^sup>e ==   [#1[[v\<^sub>1, v\<^sub>2]\<^sup>v]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e \<rbrace>)"
+proof  -
+  obtain b2 where **:" \<Theta> ;   {||} ; GNil \<turnstile>\<^sub>w\<^sub>f V_pair v\<^sub>1 v\<^sub>2 : B_pair b b2" using wfCE_elims(4)[OF assms ] wfCE_elims by metis
+  obtain b1' b2' where *:"B_pair b b2 = B_pair b1' b2' \<and>  \<Theta> ;   {||} ; GNil \<turnstile>\<^sub>w\<^sub>f v\<^sub>1 : b1'  \<and>  \<Theta> ;   {||} ; GNil \<turnstile>\<^sub>w\<^sub>f v\<^sub>2 : b2'" 
+    using wfV_elims(3)[OF **] by metis
+
+  show ?thesis proof(rule subtype_gnil_fst_aux)
+    show \<open>supp v\<^sub>1 = {}\<close> using * wfV_supp_nil by auto
+    show \<open>supp (V_pair v\<^sub>1 v\<^sub>2) = {}\<close> using ** wfV_supp_nil e.supp by metis
+    show \<open>\<turnstile>\<^sub>w\<^sub>f \<Theta>\<close> using assms wfX_wfY   by metis
+    show \<open>\<Theta>; {||}; GNil  \<turnstile>\<^sub>w\<^sub>f CE_val v\<^sub>1 : b \<close> using  wfCE_valI  "*" by auto
+    show \<open>\<Theta>; {||}; GNil  \<turnstile>\<^sub>w\<^sub>f CE_fst [V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e : b \<close> using assms by auto
+    show \<open>\<Theta>; {||}; GNil  \<turnstile>\<^sub>w\<^sub>f CE_val v\<^sub>2 : b2 \<close>using  wfCE_valI  "*" by auto
+    show \<open>atom z\<^sub>1 \<sharp> GNil\<close> using fresh_GNil by metis
+    show \<open>atom z\<^sub>2 \<sharp> GNil\<close> using fresh_GNil by metis
+  qed
+qed
+
+lemma subtype_gnil_snd:
+  assumes "wfCE  P  {||} GNil  (CE_snd ([V_pair v\<^sub>1 v\<^sub>2]\<^sup>c\<^sup>e)) b" 
+  shows "P ;  {||} ; GNil  \<turnstile> (\<lbrace> z1 : b | CE_val (V_var z1)  ==  CE_val v\<^sub>2  \<rbrace>) \<lesssim> (\<lbrace> z2 : b | CE_val (V_var z2)  ==  CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e \<rbrace>)"
+proof  -
+  obtain b1 where **:" P ;   {||} ; GNil \<turnstile>\<^sub>w\<^sub>f V_pair v\<^sub>1 v\<^sub>2 : B_pair b1 b " using wfCE_elims assms by metis
+  obtain b1' b2' where *:"B_pair b1 b = B_pair b1' b2' \<and>  P ;   {||} ; GNil \<turnstile>\<^sub>w\<^sub>f v\<^sub>1 : b1'  \<and>  P ;   {||} ; GNil \<turnstile>\<^sub>w\<^sub>f v\<^sub>2 : b2'" using wfV_elims(3)[OF **] by metis
+
+  show ?thesis proof(rule subtype_gnil_snd_aux)
+    show \<open>supp v\<^sub>2 = {}\<close> using * wfV_supp_nil by auto
+    show \<open>supp (V_pair v\<^sub>1 v\<^sub>2) = {}\<close> using ** wfV_supp_nil e.supp by metis
+    show \<open>\<turnstile>\<^sub>w\<^sub>f P\<close> using assms wfX_wfY  by metis
+    show \<open>P; {||}; GNil  \<turnstile>\<^sub>w\<^sub>f CE_val v\<^sub>1 : b1 \<close> using wfCE_valI   "*" by simp
+    show \<open>P; {||}; GNil  \<turnstile>\<^sub>w\<^sub>f CE_snd [(V_pair v\<^sub>1 v\<^sub>2)]\<^sup>c\<^sup>e : b \<close> using assms by auto
+    show \<open>P; {||}; GNil  \<turnstile>\<^sub>w\<^sub>f CE_val v\<^sub>2 : b \<close>using  wfCE_valI  "*" by simp
+    show \<open>atom z1 \<sharp> GNil\<close> using fresh_GNil by metis
+    show \<open>atom z2 \<sharp> GNil\<close> using fresh_GNil by metis
+  qed
+qed
+
+lemma subtype_fresh_tau:
+  fixes x::x
+  assumes "atom x \<sharp> t1" and "atom x \<sharp>  \<Gamma>" and "P; \<B>; \<Gamma> \<turnstile> t1 \<lesssim> t2"
+  shows "atom x \<sharp> t2"
+proof -
+  have wfg: "P; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma>" using subtype_wf wfX_wfY  assms by metis
+  have wft: "wfT P \<B> \<Gamma> t2" using subtype_wf wfX_wfY assms by blast
+  hence "supp t2 \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" using wf_supp 
+    using atom_dom.simps by auto
+  moreover have "atom x \<notin> atom_dom \<Gamma>" using \<open>atom x \<sharp> \<Gamma>\<close> wfG_atoms_supp_eq wfg fresh_def by blast 
+  ultimately show "atom x \<sharp> t2" using fresh_def
+    by (metis Un_iff contra_subsetD x_not_in_b_set)
+qed
+
+lemma subtype_if_simp:
+  assumes "wfT P \<B> GNil (\<lbrace> z1 : b  | CE_val (V_lit l )  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v  \<rbrace>)" and
+    "wfT P \<B> GNil (\<lbrace> z : b  | c \<rbrace>)" and "atom z1 \<sharp> c"
+  shows  "P; \<B> ; GNil \<turnstile> (\<lbrace> z1 : b  | CE_val (V_lit l)  ==  CE_val (V_lit l)  IMP  c[z::=V_var z1]\<^sub>v  \<rbrace>) \<lesssim>  (\<lbrace> z : b | c \<rbrace>)" 
+proof -
+  obtain x::x where xx: "atom x \<sharp> ( P , \<B> , z1, CE_val (V_lit l)  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v , z, c, GNil)" using obtain_fresh_z by blast
+  hence xx2: " atom x \<sharp> (CE_val (V_lit l)  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v , c, GNil)" using fresh_prod7 fresh_prod3 by fast
+  have *:"P; \<B> ; (x, b, (CE_val (V_lit l)  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> c[z::=V_var x]\<^sub>v " (is "P; \<B> ; ?G \<Turnstile> ?c" ) proof -
+    have "wfC P \<B> ?G ?c"  using wfT_wfC_cons[OF assms(1) assms(2),of x] xx fresh_prod5 fresh_prod3 subst_v_c_def by metis
+    moreover have "(\<forall>i. wfI P ?G i \<and> is_satis_g i ?G \<longrightarrow> is_satis i ?c)" proof(rule allI, rule impI)
+      fix i
+      assume as1: "wfI P ?G i \<and> is_satis_g i ?G" 
+      have "((CE_val (V_lit l)  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v) =  ((CE_val (V_lit l)  ==  CE_val (V_lit l) IMP  c[z::=V_var x]\<^sub>v ))" 
+        using assms subst_v_c_def by auto
+      hence "is_satis i ((CE_val (V_lit l)  ==  CE_val (V_lit l) IMP  c[z::=V_var x]\<^sub>v ))" using is_satis_g.simps as1 by presburger
+      moreover have "is_satis i ((CE_val (V_lit l)  ==  CE_val (V_lit l)))" using is_satis.simps eval_c_eqI[of i "(CE_val (V_lit l))" "eval_l l"] eval_e_uniqueness 
+          eval_e_valI eval_v_litI by metis
+      ultimately show  "is_satis i ?c" using  is_satis_mp[of i] by metis
+    qed
+    ultimately show ?thesis using valid.simps by simp
+  qed
+  moreover have "atom x \<sharp> (P, \<B>, GNil,  z1 ,  CE_val (V_lit l)  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v  ,  z, c )" 
+    unfolding fresh_prod5 \<tau>.fresh using xx fresh_prodN x_fresh_b by metis
+  ultimately show ?thesis using subtype_baseI assms xx xx2  by metis
+qed
+
+lemma subtype_if:
+  assumes "P; \<B>; \<Gamma> \<turnstile> \<lbrace> z : b  | c \<rbrace> \<lesssim> \<lbrace> z' : b  | c' \<rbrace>" and 
+    "wfT P \<B> \<Gamma> (\<lbrace> z1 : b  | CE_val v  ==  CE_val (V_lit l) IMP  c[z::=V_var z1]\<^sub>v  \<rbrace>)"  and
+    "wfT P \<B> \<Gamma> (\<lbrace> z2 : b  | CE_val v  ==  CE_val (V_lit l) IMP  c'[z'::=V_var z2]\<^sub>v  \<rbrace>)" and 
+    "atom z1 \<sharp> v" and  "atom z \<sharp> \<Gamma>" and "atom z1 \<sharp> c" and "atom z2 \<sharp> c'" and "atom z2 \<sharp> v"
+  shows   "P; \<B> ; \<Gamma> \<turnstile> \<lbrace> z1 : b  | CE_val v  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v  \<rbrace> \<lesssim> \<lbrace> z2 : b  | CE_val v  ==  CE_val (V_lit l) IMP  c'[z'::=V_var z2]\<^sub>v  \<rbrace>"
+proof -
+  obtain x::x where xx: "atom x \<sharp> (P,\<B>,z,c,z', c', z1, CE_val v  ==  CE_val (V_lit l) IMP  c[z::=V_var z1]\<^sub>v , z2, CE_val v  ==  CE_val (V_lit l) IMP  c'[z'::=V_var z2]\<^sub>v , \<Gamma>)" 
+    using obtain_fresh_z by blast
+  hence xf: "atom x \<sharp> (z, c, z', c', \<Gamma>)" by simp
+  have xf2: "atom x \<sharp> (z1, CE_val v  ==  CE_val (V_lit l) IMP c[z::=V_var z1]\<^sub>v , z2, CE_val v  ==  CE_val (V_lit l)   IMP  c'[z'::=V_var z2]\<^sub>v , \<Gamma>)" 
+    using xx fresh_prod4 fresh_prodN by metis
+
+  moreover have "P; \<B> ; (x, b, (CE_val v  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> (CE_val v  ==  CE_val (V_lit l)   IMP  c'[z'::=V_var z2]\<^sub>v )[z2::=V_var x]\<^sub>v" 
+    (is "P; \<B> ; ?G \<Turnstile> ?c" )
+  proof -
+    have wbc: "wfC P \<B> ?G ?c" using  assms xx fresh_prod4 fresh_prod2 wfT_wfC_cons assms subst_v_c_def by metis
+
+    moreover have "\<forall>i. wfI P ?G i \<and> is_satis_g i ?G \<longrightarrow> is_satis i ?c" proof(rule allI, rule impI)
+      fix i
+      assume a1: "wfI P ?G i \<and> is_satis_g i ?G"
+
+      have *: " is_satis i ((CE_val v  ==  CE_val (V_lit l))) \<longrightarrow> is_satis i ((c'[z'::=V_var z2]\<^sub>v )[z2::=V_var x]\<^sub>v)" 
+      proof 
+        assume a2: "is_satis i ((CE_val v  ==  CE_val (V_lit l)))" 
+
+        have "is_satis i ((CE_val v  ==  CE_val (V_lit l)   IMP  (c[z::=V_var z1]\<^sub>v ))[z1::=V_var x]\<^sub>v)" 
+          using a1 is_satis_g.simps  by simp
+        moreover have "((CE_val v  ==  CE_val (V_lit l)  IMP  (c[z::=V_var z1]\<^sub>v ))[z1::=V_var x]\<^sub>v) =  (CE_val v  ==  CE_val (V_lit l)   IMP  ((c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v))" 
+          using  assms subst_v_c_def by simp
+        ultimately have "is_satis i (CE_val v  ==  CE_val (V_lit l) IMP  ((c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v))" by argo
+
+        hence  "is_satis i  ((c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v)" using a2 is_satis_mp by auto
+        moreover have "((c[z::=V_var z1]\<^sub>v )[z1::=V_var x]\<^sub>v) =  ((c[z::=V_var x]\<^sub>v ))" using assms by auto
+        ultimately have  "is_satis i ((c[z::=V_var x]\<^sub>v ))"  using a2 is_satis.simps by auto
+
+        hence "is_satis_g i ((x,b,(c[z::=V_var x]\<^sub>v )) #\<^sub>\<Gamma> \<Gamma>)" using a1 is_satis_g.simps by meson
+        moreover have "wfI P ((x,b,(c[z::=V_var x]\<^sub>v )) #\<^sub>\<Gamma> \<Gamma>) i" proof -
+          obtain s where "Some s = i x \<and> wfRCV P s b \<and> wfI P \<Gamma> i" using wfI_def a1 by auto
+          thus ?thesis using wfI_def by auto
+        qed
+        ultimately have  "is_satis i ((c'[z'::=V_var x]\<^sub>v))" using subtype_valid assms(1) xf valid.simps by simp
+
+        moreover have "(c'[z'::=V_var x]\<^sub>v) = ((c'[z'::=V_var z2]\<^sub>v )[z2::=V_var x]\<^sub>v)" using assms by auto
+        ultimately show "is_satis i ((c'[z'::=V_var z2]\<^sub>v )[z2::=V_var x]\<^sub>v)" by auto
+      qed
+
+      moreover have "?c =  ((CE_val v  ==  CE_val (V_lit l))  IMP  ((c'[z'::=V_var z2]\<^sub>v )[z2::=V_var x]\<^sub>v))" 
+        using  assms subst_v_c_def by simp
+
+      moreover have "\<exists>b1 b2. eval_c i (CE_val v  ==  CE_val (V_lit l) ) b1 \<and> 
+                     eval_c i c'[z'::=V_var z2]\<^sub>v[z2::=V_var x]\<^sub>v b2" proof -
+
+        have "wfC P \<B> ?G (CE_val v  ==  CE_val (V_lit l))"  using wbc wfC_elims(7) assms subst_cv.simps subst_v_c_def by fastforce
+
+        moreover have "wfC P \<B> ?G (c'[z'::=V_var z2]\<^sub>v[z2::=V_var x]\<^sub>v)" proof(rule wfT_wfC_cons)
+          show \<open> P; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z1 : b  | CE_val v  ==  CE_val (V_lit l)   IMP  (c[z::=V_var z1]\<^sub>v)  \<rbrace> \<close> using assms subst_v_c_def by auto
+          have " \<lbrace> z2 : b  | c'[z'::=V_var z2]\<^sub>v \<rbrace> =  \<lbrace> z' : b  | c' \<rbrace>" using assms subst_v_c_def by auto
+          thus  \<open> P; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z2 : b  | c'[z'::=V_var z2]\<^sub>v \<rbrace> \<close> using assms subtype_elims by metis
+          show \<open>atom x \<sharp> (CE_val v  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v , c'[z'::=V_var z2]\<^sub>v, \<Gamma>)\<close> using xx fresh_Pair c.fresh by metis
+        qed
+
+        ultimately show ?thesis using wfI_wfC_eval_c a1 subst_v_c_def by simp
+      qed
+
+      ultimately show "is_satis i ?c" using is_satis_imp[OF *] by auto
+    qed
+    ultimately show  ?thesis using valid.simps by simp
+  qed
+  moreover have "atom x \<sharp> (P, \<B>, \<Gamma>, z1 ,  CE_val v  ==  CE_val (V_lit l)   IMP  c[z::=V_var z1]\<^sub>v  ,  z2 , CE_val v  ==  CE_val (V_lit l)   IMP  c'[z'::=V_var z2]\<^sub>v )" 
+    unfolding fresh_prod5 \<tau>.fresh using xx xf2 fresh_prodN x_fresh_b by metis
+  ultimately show ?thesis using subtype_baseI assms  xf2 by metis 
+qed
+
+lemma eval_e_concat_eq:
+  assumes  "wfI \<Theta> \<Gamma> i" 
+  shows "\<exists>s. eval_e i (CE_val (V_lit (L_bitvec (v1 @ v2))) ) s \<and> eval_e i (CE_concat [(V_lit (L_bitvec v1))]\<^sup>c\<^sup>e [(V_lit (L_bitvec v2))]\<^sup>c\<^sup>e) s"
+  using eval_e_valI eval_e_concatI eval_v_litI eval_l.simps by metis
+
+lemma is_satis_eval_e_eq_imp:
+  assumes "wfI \<Theta> \<Gamma> i" and "eval_e i e1 s" and "eval_e i e2 s"
+    and  "is_satis i (CE_val (V_var x) == e1)"  (is "is_satis i ?c1")
+  shows "is_satis i (CE_val (V_var x) == e2)"
+proof -
+  have *:"eval_c i ?c1 True" using assms is_satis.simps by blast
+  hence "eval_e i (CE_val (V_var x)) s" using assms is_satis.simps eval_c_elims
+    by (metis (full_types) eval_e_uniqueness)
+  thus ?thesis using is_satis.simps eval_c.intros assms by fastforce
+qed
+
+lemma valid_eval_e_eq:
+  fixes e1::ce and e2::ce
+  assumes "\<forall>\<Gamma> i. wfI \<Theta> \<Gamma> i \<longrightarrow> (\<exists>s. eval_e i e1 s \<and> eval_e i e2 s)" and "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f e1 : b " and  "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f e2 : b"
+  shows    "\<Theta>; \<B>; (x, b, (CE_val (V_var x)  ==  e1 )) #\<^sub>\<Gamma>  GNil  \<Turnstile> (CE_val (V_var x)  ==  e2) "
+proof(rule validI)
+  show "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x)  ==  e2" 
+  proof
+    have " \<Theta> ;  \<B> ; (x, b, TRUE )#\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x)  ==  e1" using assms wfC_eqI wfE_valI wfV_varI wfX_wfY 
+      by (simp add: fresh_GNil wfC_e_eq)    
+    hence "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil" using wfG_consI fresh_GNil wfX_wfY assms wfX_wfB by metis
+    thus "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x) : b " using  wfCE_valI wfV_varI wfX_wfY 
+        lookup.simps  assms wfX_wfY by simp
+    show "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f e2 : b " using assms wf_weakening wfX_wfY 
+      by (metis (full_types) \<open>\<Theta>; \<B>; (x, b, CE_val (V_var x) == e1 ) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x) : b\<close> empty_iff subsetI toSet.simps(1))
+  qed
+  show " \<forall>i. wfI \<Theta> ((x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil) i \<and> is_satis_g i ((x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil) \<longrightarrow> is_satis i (CE_val (V_var x)  ==  e2 )"
+  proof(rule,rule)
+    fix i
+    assume "wfI \<Theta> ((x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil) i \<and> is_satis_g i ((x, b, CE_val (V_var x)  ==  e1 ) #\<^sub>\<Gamma> GNil)"
+    moreover then obtain s where "eval_e i e1 s \<and> eval_e i e2 s" using assms by auto
+    ultimately show "is_satis i (CE_val (V_var x)  ==  e2 )" using assms  is_satis_eval_e_eq_imp is_satis_g.simps by meson
+  qed
+qed
+
+lemma subtype_concat:
+  assumes " \<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta>; \<B>; GNil  \<turnstile> \<lbrace> z : B_bitvec  | CE_val (V_var z)  ==  CE_val (V_lit (L_bitvec (v1 @ v2)))  \<rbrace> \<lesssim> 
+            \<lbrace> z : B_bitvec  | CE_val (V_var z)  ==  CE_concat [(V_lit (L_bitvec v1))]\<^sup>c\<^sup>e [(V_lit (L_bitvec v2))]\<^sup>c\<^sup>e  \<rbrace>" (is "\<Theta>; \<B>; GNil  \<turnstile> ?t1 \<lesssim> ?t2")
+proof -
+  obtain x::x where x: "atom x \<sharp> (\<Theta>, \<B>, GNil,  z , CE_val (V_var z)  ==  CE_val (V_lit (L_bitvec (v1 @ v2))),
+            z , CE_val (V_var z)  ==  CE_concat [V_lit (L_bitvec v1)]\<^sup>c\<^sup>e [V_lit (L_bitvec v2)]\<^sup>c\<^sup>e )" 
+    (is "?xfree" )
+    using obtain_fresh by auto
+
+  have wb1: "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit (L_bitvec (v1 @ v2))) : B_bitvec" using wfX_wfY wfCE_valI wfV_litI assms base_for_lit.simps wfG_nilI by metis
+  hence wb2: "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f CE_concat [(V_lit (L_bitvec v1))]\<^sup>c\<^sup>e [(V_lit (L_bitvec v2))]\<^sup>c\<^sup>e : B_bitvec" 
+    using wfCE_concatI wfX_wfY wfV_litI base_for_lit.simps wfCE_valI by metis
+
+  show ?thesis proof
+    show " \<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f ?t1" using wfT_e_eq fresh_GNil wb1 wb2 by metis
+    show " \<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f ?t2" using wfT_e_eq fresh_GNil wb1 wb2 by metis
+    show ?xfree using x by auto
+    show "\<Theta>; \<B>; (x, B_bitvec, (CE_val (V_var z)  ==  CE_val (V_lit (L_bitvec (v1 @ v2))) )[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma>
+           GNil  \<Turnstile> (CE_val (V_var z)  ==  CE_concat [(V_lit (L_bitvec v1))]\<^sup>c\<^sup>e [(V_lit (L_bitvec v2))]\<^sup>c\<^sup>e )[z::=V_var x]\<^sub>v " 
+      using valid_eval_e_eq eval_e_concat_eq wb1 wb2 subst_v_c_def by fastforce
+  qed
+qed
+
+lemma subtype_len:
+  assumes " \<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta>; \<B>; GNil  \<turnstile>   \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_val (V_lit (L_num (int (length v))))  \<rbrace> \<lesssim> 
+                           \<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e  \<rbrace>" (is "\<Theta>; \<B>; GNil  \<turnstile> ?t1 \<lesssim> ?t2")
+proof -
+
+  have *: "\<Theta>  \<turnstile>\<^sub>w\<^sub>f []  \<and>  \<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta> " using assms wfG_nilI wfD_emptyI wfPhi_emptyI by auto
+  obtain x::x where x: "atom x \<sharp>  (\<Theta>, \<B>, GNil,  z' ,  CE_val (V_var z')  ==  
+          CE_val (V_lit (L_num (int (length v)))) ,  z, CE_val (V_var z)  ==  CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e )"
+    (is "atom x \<sharp> ?F")
+    using obtain_fresh by metis
+  then show ?thesis proof
+    have "\<Theta>  ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit (L_num (int (length v)))) : B_int" 
+      using wfCE_valI * wfV_litI base_for_lit.simps 
+      by (metis wfE_valI wfX_wfY)
+
+    thus  "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f  ?t1" using wfT_e_eq fresh_GNil by auto
+
+    have "\<Theta>  ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e : B_int"       
+      using wfE_valI * wfV_litI base_for_lit.simps  wfE_valI wfX_wfY 
+      by (metis wfCE_lenI wfCE_valI)
+
+    thus "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f  ?t2" using wfT_e_eq fresh_GNil  by auto
+
+    show  "\<Theta>; \<B>; (x, B_int, (CE_val (V_var z')  ==  CE_val (V_lit (L_num (int (length v)))) )[z'::=V_var x]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> (CE_val (V_var z)  ==  CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e )[z::=V_var x]\<^sub>v"
+      (is "\<Theta>; \<B>; ?G \<Turnstile> ?c" ) using valid_len assms subst_v_c_def by auto      
+  qed
+qed
+
+lemma subtype_base_fresh:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace>" and "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c' \<rbrace> " and
+    "atom z \<sharp> \<Gamma>" and "\<Theta>; \<B>; (z, b, c) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> \<lbrace> z : b  | c \<rbrace> \<lesssim> \<lbrace> z : b  | c' \<rbrace>"
+proof  -
+  obtain x::x where *:"atom x \<sharp> ((\<Theta> , \<B> , z, c, z, c', \<Gamma>) , (\<Theta>, \<B>, \<Gamma>, \<lbrace> z : b  | c \<rbrace>, \<lbrace> z : b  | c' \<rbrace>))" using obtain_fresh by metis
+  moreover hence "atom x \<sharp> \<Gamma>" using fresh_Pair by auto
+  moreover hence "\<Theta>; \<B>; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c'[z::=V_var x]\<^sub>v" using assms valid_flip_simple  * subst_v_c_def  by auto
+  ultimately show ?thesis using subtype_baseI assms \<tau>.fresh fresh_Pair by metis
+qed
+
+lemma subtype_bop_arith:
+  assumes "wfG \<Theta> \<B>  \<Gamma>" and "(opp = Plus \<and> ll = (L_num (n1+n2))) \<or> (opp = LEq \<and> ll = ( if n1\<le>n2 then L_true else L_false))"  
+    and "(opp = Plus \<longrightarrow> b = B_int) \<and> (opp = LEq \<longrightarrow> b = B_bool)"
+  shows "\<Theta>; \<B>; \<Gamma>  \<turnstile> (\<lbrace> z : b | C_eq (CE_val (V_var z))  (CE_val (V_lit (ll))) \<rbrace>) \<lesssim>  
+                           \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_op opp [(V_lit (L_num n1))]\<^sup>c\<^sup>e [(V_lit (L_num n2))]\<^sup>c\<^sup>e) \<rbrace>" (is "\<Theta>; \<B>; \<Gamma>  \<turnstile> ?T1 \<lesssim> ?T2")   
+proof -  
+  obtain x::x where  xf: "atom x \<sharp> (z, CE_val (V_var z)  ==  CE_val (V_lit (ll)) , z, CE_val (V_var z)  ==  CE_op opp [(V_lit (L_num n1))]\<^sup>c\<^sup>e [(V_lit (L_num n2))]\<^sup>c\<^sup>e , \<Gamma>)" 
+    using obtain_fresh by blast
+
+  have "\<Theta>; \<B>; \<Gamma>  \<turnstile> (\<lbrace> x : b | C_eq (CE_val (V_var x))  (CE_val (V_lit (ll))) \<rbrace>) \<lesssim>  
+                           \<lbrace> x : b | C_eq (CE_val (V_var x)) (CE_op opp [(V_lit (L_num n1))]\<^sup>c\<^sup>e [(V_lit (L_num n2))]\<^sup>c\<^sup>e) \<rbrace>" (is "\<Theta>; \<B>; \<Gamma>  \<turnstile> ?S1 \<lesssim> ?S2") 
+  proof(rule  subtype_base_fresh)
+
+    show "atom x \<sharp> \<Gamma>" using xf fresh_Pair by auto
+
+    show  "wfT \<Theta> \<B> \<Gamma> (\<lbrace> x : b | CE_val (V_var x)  ==  CE_val (V_lit ll)  \<rbrace>)" (is "wfT \<Theta> \<B> ?A ?B") 
+    proof(rule wfT_e_eq)
+      have   " \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f (V_lit ll) : b" using wfV_litI base_for_lit.simps assms by metis
+      thus " \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit ll) : b" using wfCE_valI by auto
+      show "atom x \<sharp> \<Gamma>" using xf fresh_Pair by auto
+    qed
+
+    consider "opp = Plus" | "opp = LEq" using opp.exhaust assms by blast
+    then show  "wfT \<Theta>  \<B>  \<Gamma> (\<lbrace> x : b  | CE_val (V_var x)  ==  CE_op opp [(V_lit (L_num n1))]\<^sup>c\<^sup>e [(V_lit (L_num n2))]\<^sup>c\<^sup>e  \<rbrace>)" (is "wfT \<Theta> \<B>  ?A ?C")
+    proof(cases)
+      case 1
+      then show "\<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> x : b  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ opp [ [ L_num n1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ L_num n2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrace>"   
+        using wfCE_valI  wfCE_plusI  assms wfV_litI base_for_lit.simps assms 
+        by (metis \<open>atom x \<sharp> \<Gamma>\<close> wfT_e_eq)
+    next
+      case 2
+      then show "\<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> x : b  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ opp [ [ L_num n1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ L_num n2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrace>  "  
+        using wfCE_valI  wfCE_plusI  assms wfV_litI base_for_lit.simps assms 
+
+        by (metis \<open>atom x \<sharp> \<Gamma>\<close> wfCE_leqI wfT_e_eq)
+    qed    
+
+    show   "\<Theta>; \<B> ; (x, b, (CE_val (V_var x)  ==  CE_val (V_lit (ll)) )) #\<^sub>\<Gamma> \<Gamma>  
+                          \<Turnstile> (CE_val (V_var x)  ==  CE_op opp [V_lit (L_num n1)]\<^sup>c\<^sup>e [V_lit (L_num n2)]\<^sup>c\<^sup>e)" (is "\<Theta>; \<B>; ?G \<Turnstile> ?c")
+      using valid_arith_bop assms xf by simp
+
+  qed
+  moreover have "?S1 = ?T1 " using type_l_eq by auto
+  moreover have "?S2 = ?T2" using type_e_eq ce.fresh v.fresh supp_l_empty fresh_def empty_iff fresh_e_opp 
+    by (metis ms_fresh_all(4))
+  ultimately show ?thesis by auto 
+
+qed
+
+lemma subtype_bop_eq:
+  assumes "wfG \<Theta> \<B>  \<Gamma>" and "base_for_lit l1 = base_for_lit l2"
+  shows "\<Theta>; \<B>; \<Gamma>  \<turnstile> (\<lbrace> z : B_bool | C_eq (CE_val (V_var z)) (CE_val (V_lit (if l1 = l2 then L_true else L_false))) \<rbrace>) \<lesssim>  
+                      \<lbrace> z : B_bool | C_eq (CE_val (V_var z)) (CE_op Eq [(V_lit l1)]\<^sup>c\<^sup>e [(V_lit l2)]\<^sup>c\<^sup>e) \<rbrace>" (is "\<Theta>; \<B>; \<Gamma>  \<turnstile> ?T1 \<lesssim> ?T2")   
+proof -
+  let ?ll = "if l1 = l2 then L_true else L_false"
+  obtain x::x where  xf: "atom x \<sharp> (z, CE_val (V_var z)  ==  CE_val (V_lit (if l1 = l2 then L_true else L_false)) , z, CE_val (V_var z)  ==  CE_op Eq  [(V_lit l1)]\<^sup>c\<^sup>e [(V_lit l2)]\<^sup>c\<^sup>e , \<Gamma>, (\<Theta>, \<B>, \<Gamma>))" 
+    using obtain_fresh by blast
+
+  have "\<Theta>; \<B>; \<Gamma>  \<turnstile> (\<lbrace> x : B_bool | C_eq (CE_val (V_var x))  (CE_val (V_lit (?ll))) \<rbrace>) \<lesssim>  
+                           \<lbrace> x : B_bool | C_eq (CE_val (V_var x)) (CE_op Eq [(V_lit (l1))]\<^sup>c\<^sup>e [(V_lit (l2))]\<^sup>c\<^sup>e) \<rbrace>" (is "\<Theta>; \<B>; \<Gamma>  \<turnstile> ?S1 \<lesssim> ?S2") 
+  proof(rule  subtype_base_fresh)
+
+    show "atom x \<sharp> \<Gamma>" using xf fresh_Pair by auto
+
+    show  "wfT \<Theta> \<B> \<Gamma> (\<lbrace> x : B_bool | CE_val (V_var x)  ==  CE_val (V_lit ?ll)  \<rbrace>)" (is "wfT \<Theta> \<B> ?A ?B") 
+    proof(rule wfT_e_eq)
+      have   " \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f (V_lit ?ll) : B_bool" using wfV_litI base_for_lit.simps assms by metis
+      thus " \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val (V_lit ?ll) : B_bool" using wfCE_valI by auto
+      show "atom x \<sharp> \<Gamma>" using xf fresh_Pair by auto
+    qed
+
+    show " \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> x : B_bool  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ eq [ [ l1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ l2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrace> "   
+    proof(rule wfT_e_eq)
+      show "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ eq [ [ l1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ l2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e : B_bool" 
+        apply(rule wfCE_eqI, rule wfCE_valI)
+        apply(rule wfV_litI, simp add: assms)
+        using wfV_litI assms wfCE_valI by auto   
+      show "atom x \<sharp> \<Gamma>"  using xf fresh_Pair by auto
+    qed
+
+    show   "\<Theta>; \<B> ; (x, B_bool, (CE_val (V_var x)  ==  CE_val (V_lit (?ll)) )) #\<^sub>\<Gamma> \<Gamma>  
+                          \<Turnstile> (CE_val (V_var x)  ==  CE_op Eq [V_lit (l1)]\<^sup>c\<^sup>e [V_lit (l2)]\<^sup>c\<^sup>e)" (is "\<Theta>; \<B>; ?G \<Turnstile> ?c")
+      using valid_eq_bop assms xf by auto
+
+  qed
+  moreover have "?S1 = ?T1 " using type_l_eq by auto
+  moreover have "?S2 = ?T2" using type_e_eq ce.fresh v.fresh supp_l_empty fresh_def empty_iff fresh_e_opp 
+    by (metis ms_fresh_all(4))
+  ultimately show ?thesis by auto 
+
+qed
+
+lemma subtype_top:
+  assumes "wfT \<Theta> \<B> G  (\<lbrace> z : b | c  \<rbrace>)"
+  shows  "\<Theta>; \<B>; G  \<turnstile>  (\<lbrace> z : b | c  \<rbrace>) \<lesssim> (\<lbrace> z : b | TRUE  \<rbrace>)"
+proof - 
+  obtain x::x where *: "atom x \<sharp> (\<Theta>, \<B>, G,  z ,  c,  z , TRUE)" using obtain_fresh by blast
+  then show ?thesis proof(rule subtype_baseI)
+    show \<open> \<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace> \<close> using assms by auto
+    show \<open> \<Theta>; \<B>;G  \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | TRUE \<rbrace> \<close> using wfT_TRUE assms wfX_wfY b_of.simps wfT_wf
+      by (metis wfX_wfB(8))
+    hence "\<Theta>  ; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> G" using wfT_wf_cons3 assms fresh_Pair * subst_v_c_def by auto
+    thus  \<open>\<Theta>; \<B>; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> G  \<Turnstile> (TRUE)[z::=V_var x]\<^sub>v \<close> using valid_trueI subst_cv.simps subst_v_c_def by metis
+  qed
+qed
+
+lemma if_simp:
+  "(if x = x then e1 else e2) = e1"
+  by auto
+
+lemma subtype_split:
+  assumes "split n v (v1,v2)" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z : [ B_bitvec , B_bitvec ]\<^sup>b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ [ L_bitvec
+           v1 ]\<^sup>v , [ L_bitvec
+                       v2 ]\<^sup>v ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> \<lesssim> \<lbrace> z : [ B_bitvec , B_bitvec ]\<^sup>b  | [ [ L_bitvec
+          v ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   AND  [| [#1[ [ z ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  ==  [ [ L_num
+                                                             n ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>" 
+    (is "\<Theta> ;?B ; GNil  \<turnstile> \<lbrace> z : [ B_bitvec , B_bitvec ]\<^sup>b  | ?c1 \<rbrace>  \<lesssim> \<lbrace> z : [ B_bitvec , B_bitvec ]\<^sup>b  | ?c2 \<rbrace>")
+proof -
+  obtain x::x where xf:"atom x \<sharp> (\<Theta>, ?B, GNil, z, ?c1,z, ?c2 )"  using obtain_fresh by auto
+  then show ?thesis proof(rule subtype_baseI)
+    show *: \<open>\<Theta> ; ?B ; (x, [ B_bitvec , B_bitvec ]\<^sup>b, (?c1)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma>
+                    GNil  \<Turnstile> (?c2)[z::=[ x ]\<^sup>v]\<^sub>v \<close> 
+      unfolding subst_v_c_def subst_cv.simps subst_cev.simps subst_vv.simps if_simp      
+      using valid_split[OF assms, of x] by simp
+    show \<open> \<Theta> ; ?B ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : [ B_bitvec , B_bitvec ]\<^sup>b| ?c1 \<rbrace> \<close> using valid_wfT[OF *] xf fresh_prodN by metis
+    show \<open> \<Theta> ; ?B ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : [ B_bitvec , B_bitvec ]\<^sup>b| ?c2 \<rbrace> \<close>  using valid_wfT[OF *] xf fresh_prodN by metis
+  qed
+qed
+
+lemma subtype_range:
+  fixes n::int and \<Gamma>::\<Gamma>
+  assumes "0 \<le> n \<and> n \<le> int (length v)" and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f \<Gamma>" 
+  shows "\<Theta> ; {||} ; \<Gamma>  \<turnstile> \<lbrace>   z : B_int  |  [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e == [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrace> \<lesssim>
+                           \<lbrace> z : B_int  | ([ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )  AND  (
+                                   [ leq [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)   \<rbrace>"
+    (is  "\<Theta> ; ?B ; \<Gamma>  \<turnstile> \<lbrace>   z : B_int | ?c1 \<rbrace> \<lesssim>  \<lbrace> z : B_int  | ?c2 AND ?c3 \<rbrace>")
+proof -
+  obtain x::x where *:\<open>atom x \<sharp> (\<Theta>, ?B, \<Gamma>, z, ?c1 , z, ?c2 AND ?c3)\<close> using obtain_fresh by auto
+  moreover have **:\<open>\<Theta> ; ?B ; (x, B_int, (?c1)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> (?c2 AND ?c3)[z::=[ x ]\<^sup>v]\<^sub>v\<close> 
+    unfolding subst_v_c_def subst_cv.simps subst_cev.simps subst_vv.simps if_simp using valid_range_length[OF assms(1)] assms fresh_prodN * by simp
+
+  moreover hence \<open> \<Theta> ; ?B ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : B_int  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> \<close> using 
+      valid_wfT * fresh_prodN by metis
+  moreover have \<open> \<Theta> ; ?B ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : B_int  | ?c2 AND ?c3  \<rbrace> \<close> 
+    using valid_wfT[OF **]  * fresh_prodN by metis
+  ultimately show ?thesis using subtype_baseI by auto
+qed
+
+lemma check_num_range:
+  assumes "0 \<le> n \<and> n \<le> int (length v)" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta> ; {||} ; GNil  \<turnstile> ([ L_num n ]\<^sup>v) \<Leftarrow> \<lbrace> z : B_int  | ([ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)   AND
+      [ leq [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e [| [ [ L_bitvec v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>"
+  using assms subtype_range check_v.intros infer_v_litI wfG_nilI 
+  by (meson infer_natI)
+
+section \<open>Literals\<close>
+
+nominal_function type_for_lit :: "l \<Rightarrow> \<tau>" where
+  "type_for_lit (L_true) = (\<lbrace> z : B_bool | [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit L_true]\<^sup>c\<^sup>e \<rbrace>)"
+| "type_for_lit (L_false) = (\<lbrace> z : B_bool | [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit L_false]\<^sup>c\<^sup>e \<rbrace>)"
+| "type_for_lit (L_num n) = (\<lbrace> z : B_int |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit (L_num n)]\<^sup>c\<^sup>e \<rbrace>)"
+| "type_for_lit (L_unit) = (\<lbrace> z : B_unit |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit (L_unit )]\<^sup>c\<^sup>e \<rbrace>)" (* could have done { z : unit | True } but want the uniformity *)
+| "type_for_lit (L_bitvec v) = (\<lbrace> z : B_bitvec |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit (L_bitvec v)]\<^sup>c\<^sup>e \<rbrace>)"
+  by (auto simp: eqvt_def type_for_lit_graph_aux_def, metis l.strong_exhaust,(simp add: permute_int_def flip_bitvec0)+ )
+nominal_termination (eqvt) by lexicographic_order
+
+
+nominal_function type_for_var :: "\<Gamma> \<Rightarrow> \<tau> \<Rightarrow> x \<Rightarrow> \<tau>" where
+  "type_for_var G \<tau> x = (case lookup G x of 
+                       None \<Rightarrow> \<tau>
+                  | Some (b,c) \<Rightarrow> (\<lbrace> x : b | c \<rbrace>)) "  
+  apply auto  unfolding eqvt_def apply(rule allI)  unfolding type_for_var_graph_aux_def eqvt_def by simp
+nominal_termination (eqvt) by lexicographic_order
+
+lemma infer_l_form:
+  fixes l::l and tm::"'a::fs"
+  assumes "\<turnstile> l \<Rightarrow> \<tau>" 
+  shows "\<exists>z b. \<tau> = (\<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val (V_lit l)) \<rbrace>) \<and> atom z \<sharp> tm"
+proof -
+  obtain z' and b where t:"\<tau> = (\<lbrace> z' : b | C_eq (CE_val (V_var z')) (CE_val (V_lit l)) \<rbrace>)" using infer_l_elims  assms  using infer_l.simps type_for_lit.simps 
+      type_for_lit.cases by blast
+  obtain z::x where zf: "atom z \<sharp> tm" using obtain_fresh by metis
+  have "\<tau> = \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val (V_lit l)) \<rbrace>" using type_e_eq ce.fresh v.fresh l.fresh 
+    by (metis t type_l_eq)
+  thus ?thesis using zf by auto
+qed
+
+lemma infer_l_form3:
+  fixes l::l
+  assumes "\<turnstile> l \<Rightarrow> \<tau>" 
+  shows "\<exists>z. \<tau> = (\<lbrace> z : base_for_lit l | C_eq (CE_val (V_var z)) (CE_val (V_lit l)) \<rbrace>)"
+  using infer_l_elims using assms  using infer_l.simps type_for_lit.simps base_for_lit.simps by auto
+
+lemma infer_l_form4[simp]:
+  fixes \<Gamma>::\<Gamma>
+  assumes "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> "   
+  shows "\<exists>z. \<turnstile> l \<Rightarrow> (\<lbrace> z : base_for_lit l | C_eq (CE_val (V_var z)) (CE_val (V_lit l)) \<rbrace>)"
+  using assms  infer_l_form2 infer_l_form3 by metis
+
+lemma infer_v_unit_form:
+  fixes v::v
+  assumes "P ;  \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> (\<lbrace> z1 : B_unit | c1 \<rbrace>)" and "supp v = {}"
+  shows "v = V_lit L_unit"
+  using assms proof(nominal_induct \<Gamma> v "\<lbrace> z1 : B_unit | c1 \<rbrace>" rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> c x z)
+  then show ?case using supp_at_base by auto
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l)
+  from \<open>\<turnstile> l \<Rightarrow> \<lbrace> z1 : B_unit  | c1 \<rbrace>\<close>  show ?case by(nominal_induct "\<lbrace> z1 : B_unit  | c1 \<rbrace>" rule: infer_l.strong_induct,auto)
+qed
+
+lemma base_for_lit_wf:
+  assumes "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows   "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f base_for_lit l"
+  using base_for_lit.simps using  wfV_elims wf_intros  assms l.exhaust by metis
+
+lemma infer_l_t_wf:
+  fixes \<Gamma>::\<Gamma>
+  assumes "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> atom z \<sharp> \<Gamma>"
+  shows  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : base_for_lit l |  C_eq (CE_val (V_var z)) (CE_val (V_lit l)) \<rbrace>"
+proof 
+  show "atom z \<sharp>  (\<Theta>, \<B>, \<Gamma>)" using  wfG_fresh_x assms by auto
+  show "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f base_for_lit l" using base_for_lit_wf assms wfX_wfY by metis
+  thus "\<Theta>; \<B>; (z, base_for_lit l, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f CE_val (V_var z)  ==  CE_val (V_lit l)" using wfC_v_eq wfV_litI assms wfX_wfY by metis
+qed
+
+lemma infer_l_wf:
+  fixes l::l and \<Gamma>::\<Gamma> and \<tau>::\<tau> and \<Theta>::\<Theta>
+  assumes "\<turnstile> l \<Rightarrow> \<tau>" and "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "\<turnstile>\<^sub>w\<^sub>f \<Theta>" and  "\<Theta> ; \<B>   \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>"
+proof -
+  show *:"\<Theta> ;  \<B>   \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using assms infer_l_elims by auto
+  thus  "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using wfX_wfY by auto
+  show *:"\<Theta> ;  \<B>  ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau>" using infer_l_t_wf assms infer_l_form3 * 
+    by (metis \<open>\<turnstile>\<^sub>w\<^sub>f \<Theta>\<close> fresh_GNil wfG_nilI wfT_weakening_nil)
+qed
+
+lemma infer_l_uniqueness: 
+  fixes l::l
+  assumes "\<turnstile> l \<Rightarrow> \<tau>" and "\<turnstile> l \<Rightarrow> \<tau>'" 
+  shows "\<tau> = \<tau>'"
+  using assms
+proof -
+  obtain z and b where zt: "\<tau> = (\<lbrace> z : b  | C_eq (CE_val (V_var z)) (CE_val (V_lit l)) \<rbrace>)" using infer_l_form assms by blast
+  obtain z' and b where z't: "\<tau>' = (\<lbrace> z' : b  | C_eq (CE_val (V_var z')) (CE_val (V_lit l)) \<rbrace>)" using infer_l_form assms   by blast
+  thus ?thesis using type_l_eq zt z't   assms infer_l.simps infer_l_elims l.distinct    
+    by (metis infer_l_form3)
+qed
+
+section \<open>Values\<close>
+
+lemma type_v_eq:
+  assumes "\<lbrace> z1 : b1 | c1 \<rbrace> = \<lbrace> z : b  | C_eq (CE_val (V_var z)) (CE_val (V_var x)) \<rbrace>" and "atom z \<sharp> x"
+  shows "b = b1" and "c1 =  C_eq (CE_val (V_var z1)) (CE_val (V_var x))"
+  using assms  by (auto,metis Abs1_eq_iff \<tau>.eq_iff assms c.fresh ce.fresh type_e_eq v.fresh)
+
+lemma infer_var2 [elim]:
+  assumes "P; \<B> ; G \<turnstile> V_var x \<Rightarrow> \<tau>"
+  shows "\<exists>b c. Some (b,c) = lookup G x"
+  using assms infer_v_elims lookup_iff   by (metis (no_types, lifting))
+
+lemma infer_var3 [elim]:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> V_var x \<Rightarrow> \<tau>"
+  shows "\<exists>z b c. Some (b,c) = lookup \<Gamma> x \<and> \<tau> = (\<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val (V_var x)) \<rbrace>) \<and> atom z \<sharp> x \<and> atom z \<sharp> (\<Theta>, \<B>, \<Gamma>)"
+  using infer_v_elims(1)[OF assms(1)] by metis
+
+lemma infer_bool_options2:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z : b | c \<rbrace>" and "supp v = {} \<and> b = B_bool"
+  shows  "v = V_lit L_true \<or> (v = (V_lit L_false))"
+  using assms
+proof(nominal_induct "\<lbrace> z : b | c \<rbrace>"  rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> \<Gamma> c x z)
+  then show ?case using v.supp supp_at_base by auto
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l)
+  from \<open> \<turnstile> l \<Rightarrow> \<lbrace> z : b  | c \<rbrace>\<close> show ?case proof(nominal_induct "\<lbrace> z : b  | c \<rbrace>"  rule: infer_l.strong_induct)
+    case (infer_trueI z)
+    then show ?case by auto
+  next
+    case (infer_falseI z)
+    then show ?case by auto
+  next
+    case (infer_natI n z)
+    then show ?case using infer_v_litI by simp
+  next
+    case (infer_unitI z)
+    then show ?case using infer_v_litI by simp
+  next
+    case (infer_bitvecI bv z)
+    then show ?case using infer_v_litI by simp
+  qed
+qed(auto+)
+
+lemma infer_bool_options:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile> v \<Rightarrow> \<lbrace> z : B_bool  | c \<rbrace>" and "supp v = {}"
+  shows "v = V_lit L_true \<or> (v = (V_lit L_false))"
+  using infer_bool_options2  assms by blast
+
+lemma infer_int2:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z : b | c \<rbrace>"
+  shows "supp v = {}  \<and> b = B_int \<longrightarrow> (\<exists>n. v = V_lit (L_num n))"
+  using assms
+proof(nominal_induct "\<lbrace> z : b | c \<rbrace>"  rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> \<Gamma> c x z)
+  then show ?case using v.supp supp_at_base by auto
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l)
+  from \<open> \<turnstile> l \<Rightarrow> \<lbrace> z : b  | c \<rbrace>\<close> show ?case proof(nominal_induct "\<lbrace> z : b  | c \<rbrace>"  rule: infer_l.strong_induct)
+    case (infer_trueI z)
+    then show ?case by auto
+  next
+    case (infer_falseI z)
+    then show ?case by auto
+  next
+    case (infer_natI n z)
+    then show ?case using infer_v_litI by simp
+  next
+    case (infer_unitI z)
+    then show ?case using infer_v_litI by simp
+  next
+    case (infer_bitvecI bv z)
+    then show ?case using infer_v_litI by simp
+  qed
+qed(auto+)
+
+lemma infer_bitvec:
+  fixes \<Theta>::\<Theta> and v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z' : B_bitvec | c' \<rbrace>" and "supp v = {}"
+  shows "\<exists>bv. v = V_lit (L_bitvec bv)"
+  using assms proof(nominal_induct v rule: v.strong_induct)
+  case (V_lit l)
+  then show ?case by(nominal_induct l rule: l.strong_induct,force+)
+next
+  case (V_consp s dc b v)
+  then show ?case using  infer_v_elims(7)[OF V_consp(2)] \<tau>.eq_iff by auto
+next
+  case (V_var x)
+  then show ?case using supp_at_base by auto
+qed(force+)
+
+lemma infer_int:
+  assumes "infer_v \<Theta> \<B> \<Gamma> v  (\<lbrace> z : B_int | c \<rbrace>)" and "supp v= {}"
+  shows "\<exists>n. V_lit (L_num n) = v"
+  using assms infer_int2  by (metis (no_types, lifting))
+
+lemma infer_lit:
+  assumes "infer_v \<Theta> \<B> \<Gamma> v  (\<lbrace> z : b | c \<rbrace>)" and "supp v= {}" and "b \<in> { B_bool , B_int , B_unit }"
+  shows "\<exists>l. V_lit l = v"
+  using assms proof(nominal_induct v rule: v.strong_induct)
+  case (V_lit x)
+  then show ?case   by (simp add: supp_at_base)
+next
+  case (V_var x)
+  then show ?case 
+    by (simp add: supp_at_base)
+next
+  case (V_pair x1a x2a)
+  then show ?case  using supp_at_base by auto
+next
+  case (V_cons x1a x2a x3)
+  then show ?case   using supp_at_base by auto
+next
+  case (V_consp x1a x2a x3 x4)
+  then show ?case    using supp_at_base by auto
+qed
+
+lemma infer_v_form[simp]:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" 
+  shows "\<exists>z b. \<tau> = (\<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>) \<and> atom z \<sharp> v \<and> atom z \<sharp> (\<Theta>, \<B>, \<Gamma>)"
+  using assms
+proof(nominal_induct   rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> \<Gamma> b c x z)
+  then show ?case by force
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l \<tau>)
+  then obtain z and b where "\<tau> = \<lbrace> z : b  | CE_val (V_var z)  ==  CE_val (V_lit l)  \<rbrace> \<and>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>) "
+    using infer_l_form by metis
+  moreover hence  "atom z \<sharp> (V_lit l)" using supp_l_empty v.fresh(1) fresh_prod2 fresh_def by blast
+  ultimately show ?case by metis
+next
+  case (infer_v_pairI z v1 v2 \<Theta> \<B> \<Gamma> t1 t2)
+  then show ?case by force
+next
+  case (infer_v_consI s dclist \<Theta> dc tc \<B> \<Gamma> v tv z)
+  moreover hence "atom z \<sharp> (V_cons s dc v)" using
+      Un_commute b.supp(3) fresh_def sup_bot.right_neutral supp_b_empty v.supp(4) pure_supp by metis
+  ultimately show ?case using fresh_prodN by metis
+next
+  case (infer_v_conspI s bv dclist \<Theta> dc tc \<B> \<Gamma> v tv b z)
+  moreover hence "atom z \<sharp> (V_consp s dc b v)" unfolding v.fresh using pure_fresh fresh_prodN * by metis
+  ultimately show ?case using fresh_prodN by metis
+qed
+
+lemma infer_v_form2:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> (\<lbrace> z : b | c \<rbrace>)" and "atom z \<sharp> v" 
+  shows "c = C_eq (CE_val (V_var z)) (CE_val v)"
+  using assms 
+proof -
+  obtain z' and b' where "(\<lbrace> z : b | c \<rbrace>)  = (\<lbrace> z' : b'  | CE_val (V_var z')  ==  CE_val v  \<rbrace>) \<and> atom z' \<sharp> v"
+    using infer_v_form assms by meson
+  thus ?thesis using Abs1_eq_iff(3) \<tau>.eq_iff  type_e_eq
+    by (metis assms(2) ce.fresh(1))
+qed
+
+lemma infer_v_form3:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>"  and "atom z \<sharp> (v,\<Gamma>)"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z : b_of \<tau> | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>"
+proof -
+  obtain z' and b' where "\<tau> = \<lbrace> z' : b' | C_eq (CE_val (V_var z')) (CE_val v)\<rbrace> \<and> atom z' \<sharp> v \<and> atom z' \<sharp> (\<Theta>, \<B>, \<Gamma>)" 
+    using infer_v_form assms by metis
+  moreover hence "\<lbrace> z' : b' | C_eq (CE_val (V_var z')) (CE_val v)\<rbrace> = \<lbrace> z : b' | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>" 
+    using assms type_e_eq fresh_Pair ce.fresh by auto
+  ultimately show  ?thesis using  b_of.simps assms by auto
+qed
+
+lemma infer_v_form4:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>"  and "atom z \<sharp> (v,\<Gamma>)" and "b = b_of \<tau>"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>"
+  using assms infer_v_form3 by simp
+
+lemma infer_v_v_wf:
+  fixes v::v
+  shows "\<Theta>; \<B> ; G \<turnstile> v \<Rightarrow> \<tau> \<Longrightarrow>  \<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f v : (b_of \<tau>)"
+proof(induct rule: infer_v.induct)
+  case (infer_v_varI \<Theta> \<B> \<Gamma> b c x z)
+  then show ?case using  wfC_elims  wf_intros by auto
+next
+  case (infer_v_pairI z v1 v2 \<Theta> \<B> \<Gamma> t1 t2)
+  then show ?case using  wfC_elims  wf_intros by auto
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l \<tau>)
+  hence "b_of \<tau> = base_for_lit l" using infer_l_form3 b_of.simps by metis
+  then show ?case using wfV_litI infer_l_wf infer_v_litI wfG_b_weakening
+    by (metis fempty_fsubsetI)
+next
+  case (infer_v_consI s dclist \<Theta> dc tc \<B> \<Gamma> v tv z)
+  then show ?case using  wfC_elims  wf_intros 
+    by (metis (no_types, lifting) b_of.simps has_fresh_z2 subtype_eq_base2)
+next
+  case (infer_v_conspI s bv dclist \<Theta> dc tc \<B> \<Gamma> v tv b z)
+  obtain z1 b1 c1 where t:"tc = \<lbrace> z1 : b1 | c1 \<rbrace>" using obtain_fresh_z by metis
+  show ?case unfolding b_of.simps proof(rule wfV_conspI)
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using infer_v_conspI by auto
+    show \<open>(dc,  \<lbrace> z1 : b1 | c1 \<rbrace> ) \<in> set dclist\<close> using infer_v_conspI t by auto
+    show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using infer_v_conspI by auto
+    show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>, b, v)\<close> using infer_v_conspI by auto
+    have " b1[bv::=b]\<^sub>b\<^sub>b = b_of tv" using subtype_eq_base2[OF infer_v_conspI(5)] b_of.simps t subst_tb.simps by auto
+    thus \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b1[bv::=b]\<^sub>b\<^sub>b \<close> using infer_v_conspI by auto
+  qed
+qed
+
+lemma infer_v_t_form_wf:
+  assumes " wfB \<Theta> \<B> b" and "wfV  \<Theta> \<B> \<Gamma> v b" and "atom z \<sharp> \<Gamma>"
+  shows "wfT \<Theta> \<B> \<Gamma> \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>"
+  using wfT_v_eq assms by auto
+
+lemma infer_v_t_wf:
+  fixes v::v
+  assumes "\<Theta>; \<B>; G \<turnstile> v \<Rightarrow> \<tau>"
+  shows "wfT \<Theta> \<B> G \<tau> \<and>  wfB  \<Theta> \<B> (b_of \<tau>) "
+proof -
+  obtain z and b where "\<tau> = \<lbrace> z : b  | CE_val (V_var z)  ==  CE_val v  \<rbrace> \<and> atom z \<sharp> v \<and> atom z \<sharp> (\<Theta>, \<B>, G)" using infer_v_form assms by metis
+  moreover have  "wfB  \<Theta> \<B> b" using infer_v_v_wf b_of.simps wfX_wfB(1) assms 
+    using calculation by fastforce
+  ultimately show "wfT \<Theta> \<B> G \<tau> \<and>   wfB  \<Theta> \<B> (b_of \<tau>)" using infer_v_v_wf  infer_v_t_form_wf assms by fastforce
+qed
+
+lemma infer_v_wf: 
+  fixes  v::v
+  assumes "\<Theta>; \<B>; G \<turnstile> v \<Rightarrow> \<tau>"
+  shows  "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f v : (b_of \<tau>)" and "wfT \<Theta> \<B> G \<tau>"  and "wfTh \<Theta>" and "wfG \<Theta> \<B> G"
+proof -
+  show "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> " using infer_v_v_wf assms by auto
+  show "\<Theta>; \<B>; G   \<turnstile>\<^sub>w\<^sub>f \<tau>" using infer_v_t_wf assms by auto
+  thus  "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f G" using wfX_wfY by auto
+  thus  "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using  wfX_wfY by auto
+qed
+
+lemma check_bool_options:
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile> v \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>" and "supp v = {}"
+  shows "v = V_lit L_true \<or> v = V_lit L_false"
+proof -
+  obtain t1 where  " \<Theta>; \<B>; \<Gamma>  \<turnstile> t1 \<lesssim>  \<lbrace> z : B_bool  | TRUE \<rbrace> \<and> \<Theta>; \<B>; \<Gamma>  \<turnstile> v \<Rightarrow> t1" using check_v_elims 
+    using assms by blast
+  thus ?thesis using infer_bool_options assms
+    by (metis \<tau>.exhaust b_of.simps subtype_eq_base2)
+qed
+
+lemma check_v_wf:
+  fixes v::v and \<Gamma>::\<Gamma> and \<tau>::\<tau>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<tau>"
+  shows " \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau>" and "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>"
+proof -
+  obtain \<tau>' where *: "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>' \<lesssim> \<tau> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>'" using check_v_elims assms by auto
+  thus "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> " and "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau>" and "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>"  
+    using infer_v_wf infer_v_v_wf  subtype_eq_base2   *  subtype_wf  by metis+
+qed
+
+lemma infer_v_form_fresh:
+  fixes v::v and t::"'a::fs" 
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" 
+  shows "\<exists>z b. \<tau> = \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace> \<and> atom z \<sharp> (t,v)"
+proof -
+  obtain z' and b' where "\<tau> = \<lbrace> z' : b' | C_eq (CE_val (V_var z')) (CE_val v)\<rbrace>" using infer_v_form assms by blast
+  moreover then obtain z and b and c where "\<tau> = \<lbrace> z : b | c \<rbrace> \<and> atom z \<sharp> (t,v)" using obtain_fresh_z by metis
+  ultimately have "\<tau> = \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace> \<and>  atom z \<sharp> (t,v) "
+    using assms infer_v_form2  by auto
+  thus ?thesis by blast
+qed
+
+text \<open> More generally, if support of a term is empty then any G will do \<close>
+
+lemma infer_v_form_consp:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> V_consp s dc b v \<Rightarrow> \<tau>"
+  shows "b_of \<tau> = B_app s b"
+  using assms proof(nominal_induct "V_consp s dc b v" \<tau>   rule: infer_v.strong_induct)
+  case (infer_v_conspI bv dclist \<Theta> tc \<B> \<Gamma> tv z)
+  then show ?case using b_of.simps by metis
+qed
+
+lemma lookup_in_rig_b:
+  assumes "Some (b2, c2) = lookup (\<Gamma>[x\<longmapsto>c']) x'" and
+    "Some (b1, c1) = lookup \<Gamma> x'"
+  shows "b1 = b2"
+  using assms lookup_in_rig[OF assms(2)] 
+  by (metis option.inject prod.inject)
+
+lemma infer_v_uniqueness_rig:
+  fixes x::x and c::c
+  assumes "infer_v P B G v \<tau>" and "infer_v P B (replace_in_g G x c') v \<tau>'"
+  shows "\<tau> = \<tau>'"
+  using assms
+proof(nominal_induct "v"  arbitrary: \<tau>' \<tau> rule: v.strong_induct)
+  case (V_lit l)
+  hence "infer_l l \<tau>" and "infer_l l \<tau>'" using assms(1) infer_v_elims(2) by auto
+  then show ?case using infer_l_uniqueness  by presburger
+next
+  case (V_var y)
+
+  obtain b and c where bc: "Some (b,c) = lookup G y"  
+    using assms(1) infer_v_elims(2)  using V_var.prems(1) lookup_iff by force
+  then obtain  c'' where bc':"Some (b,c'') = lookup  (replace_in_g G x c') y" 
+    using lookup_in_rig by blast
+
+  obtain z  where "\<tau> = (\<lbrace> z : b |  C_eq (CE_val (V_var z)) (CE_val (V_var y)) \<rbrace>)" using infer_v_elims(1)[of P B G y \<tau>] V_var
+      bc option.inject prod.inject lookup_in_g by metis
+  moreover obtain z' where "\<tau>' = (\<lbrace> z' : b |  C_eq (CE_val (V_var z')) (CE_val (V_var y)) \<rbrace>)" using infer_v_elims(1)[of P B _ y \<tau>']  V_var
+      option.inject prod.inject  lookup_in_rig  by (metis bc')
+  ultimately show ?case using type_e_eq 
+    by (metis V_var.prems(1) V_var.prems(2) \<tau>.eq_iff ce.fresh(1) finite.emptyI fresh_atom_at_base 
+        fresh_finite_insert infer_v_elims(1) v.fresh(2))
+next 
+  case (V_pair v1 v2)
+  obtain  z and z1 and z2 and t1 and t2 and c1 and c2 where
+    t1: "\<tau> = (\<lbrace> z :  [ b_of t1 , b_of t2 ]\<^sup>b   | CE_val (V_var z)  ==  CE_val (V_pair v1 v2)  \<rbrace>) \<and> 
+           atom z \<sharp> (v1, v2) \<and>  P ; B ; G  \<turnstile> v1 \<Rightarrow> t1 \<and>  P ; B ; G  \<turnstile> v2 \<Rightarrow> t2"
+    using infer_v_elims(3)[OF V_pair(3)] by metis
+  moreover obtain  z' and z1' and z2' and t1' and t2' and c1' and c2' where
+    t2: "\<tau>' = (\<lbrace> z' :  [ b_of t1' , b_of t2' ]\<^sup>b  | CE_val (V_var z')  ==  CE_val (V_pair v1 v2)  \<rbrace>) \<and> 
+             atom z' \<sharp> (v1, v2) \<and>  P ;  B ; (replace_in_g G x c')  \<turnstile> v1 \<Rightarrow> t1' \<and>  
+             P ;  B ; (replace_in_g G x c')  \<turnstile> v2 \<Rightarrow> t2'"
+    using infer_v_elims(3)[OF V_pair(4)] by metis
+  ultimately have "t1 = t1' \<and> t2 = t2'" using V_pair.hyps(1) V_pair.hyps(2) \<tau>.eq_iff by blast
+  then show ?case using t1 t2 by simp
+next
+  case (V_cons s dc v)
+  obtain x and z and tc and dclist where  t1: "\<tau> = (\<lbrace> z : B_id s  | CE_val (V_var z)  ==  CE_val (V_cons s dc v) \<rbrace>) \<and>  
+          AF_typedef s dclist \<in> set P \<and>
+        (dc, tc) \<in> set dclist \<and> atom z \<sharp> v" 
+    using infer_v_elims(4)[OF V_cons(2)] by metis
+  moreover obtain x' and z' and tc' and dclist' where  t2: "\<tau>' = (\<lbrace> z' : B_id s  | CE_val (V_var z')  ==  CE_val (V_cons s dc v) \<rbrace>)
+  \<and>  AF_typedef s dclist' \<in> set P \<and> (dc, tc') \<in> set dclist' \<and> atom z' \<sharp> v" 
+    using infer_v_elims(4)[OF V_cons(3)] by metis
+  moreover have a: "AF_typedef s dclist' \<in> set P" and b:"(dc,tc') \<in> set dclist'" and c:"AF_typedef s dclist \<in> set P" and
+    d:"(dc, tc) \<in> set dclist" using t1 t2 by auto
+  ultimately have "tc =  tc'" using wfTh_dc_t_unique2   infer_v_wf(3)[OF V_cons(2)] by metis
+
+  moreover have "atom z \<sharp> CE_val (V_cons s dc v) \<and> atom z' \<sharp> CE_val (V_cons s dc v)" 
+    using e.fresh(1)  v.fresh(4) t1 t2 pure_fresh by auto
+  ultimately have "(\<lbrace> z : B_id s  | CE_val (V_var z)  ==  CE_val (V_cons s dc v) \<rbrace>) = (\<lbrace> z' : B_id s  | CE_val (V_var z')  ==  CE_val (V_cons s dc v) \<rbrace>)" 
+    using type_e_eq by metis
+  thus ?case using t1 t2 by simp
+next
+  case (V_consp s dc b v)
+  from V_consp(2) V_consp show ?case proof(nominal_induct  "V_consp s dc b v" \<tau> arbitrary: v rule:infer_v.strong_induct)
+
+    case (infer_v_conspI bv dclist \<Theta> tc \<B> \<Gamma> v tv z)
+
+    obtain z3 and b3 where *:"\<tau>' = \<lbrace> z3 : b3 | [ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc b v ]\<^sup>c\<^sup>e  \<rbrace> \<and> atom z3 \<sharp>  V_consp s dc b v"
+      using infer_v_form[OF \<open>\<Theta>; \<B>; \<Gamma>[x\<longmapsto>c'] \<turnstile> V_consp s dc b v \<Rightarrow> \<tau>'\<close> ] by metis
+    moreover then have "b3 = B_app s b" using  infer_v_form_consp b_of.simps * infer_v_conspI by metis
+
+    moreover have "\<lbrace> z3 : B_app s b  | [ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc b v ]\<^sup>c\<^sup>e  \<rbrace> =  \<lbrace> z : B_app s b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ V_consp s dc b v ]\<^sup>c\<^sup>e  \<rbrace>"
+    proof - 
+      have "atom z3 \<sharp> [V_consp s dc b v]\<^sup>c\<^sup>e" using * ce.fresh by auto
+      moreover have "atom z \<sharp> [V_consp s dc b v]\<^sup>c\<^sup>e" using * infer_v_conspI ce.fresh v.fresh pure_fresh by metis
+      ultimately show ?thesis  using type_e_eq  infer_v_conspI v.fresh ce.fresh by metis
+    qed
+    ultimately  show ?case using * by auto
+  qed
+qed
+
+lemma infer_v_uniqueness: 
+  assumes "infer_v P B G v \<tau>" and "infer_v P B G v \<tau>'"
+  shows "\<tau> = \<tau>'"
+proof - 
+  obtain x::x where "atom x \<sharp> G" using obtain_fresh by metis
+  hence "G [ x \<longmapsto> C_true ] = G" using replace_in_g_forget assms infer_v_wf by fast
+  thus ?thesis using infer_v_uniqueness_rig assms by metis
+qed
+
+lemma infer_v_tid_form:
+  fixes v::v
+  assumes "\<Theta> ; B ; \<Gamma>  \<turnstile> v \<Rightarrow> \<lbrace> z : B_id tid  | c \<rbrace>" and  "AF_typedef tid dclist \<in> set \<Theta>" and "supp v = {}"
+  shows "\<exists>dc v' t. v = V_cons tid dc v' \<and> (dc , t ) \<in> set dclist"
+  using assms proof(nominal_induct  v "\<lbrace> z : B_id tid  | c \<rbrace>" rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> c x z)
+  then show ?case using v.supp supp_at_base  by auto
+next
+  case (infer_v_litI \<Theta> \<B> l)
+  then show ?case by auto
+next
+  case (infer_v_consI dclist1 \<Theta> dc tc \<B> \<Gamma> v tv z)
+  hence "supp v = {}" using v.supp by simp
+  then obtain dca and v' where *:"V_cons tid dc v = V_cons tid dca v'" using infer_v_consI by auto
+  hence "dca = dc" using v.eq_iff(4)  by auto
+  hence  "V_cons tid dc v = V_cons tid dca v' \<and>  (dca, tc) \<in> set dclist1" using infer_v_consI * by auto
+  moreover have "dclist = dclist1" using wfTh_dclist_unique infer_v_consI wfX_wfY \<open>dca=dc\<close> 
+  proof -
+    show ?thesis
+      by (meson \<open>AF_typedef tid dclist1 \<in> set \<Theta>\<close> \<open>\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> tv\<close> infer_v_consI.prems infer_v_wf(4) wfTh_dclist_unique wfX_wfY) 
+  qed
+  ultimately show ?case by auto
+qed
+
+lemma check_v_tid_form:  
+  assumes "\<Theta> ; B ; \<Gamma>  \<turnstile> v \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>"  and "AF_typedef tid dclist \<in> set \<Theta>"  and "supp v = {}"
+  shows "\<exists>dc v' t. v = V_cons tid dc v' \<and> (dc , t ) \<in> set dclist"
+  using assms proof(nominal_induct  v "\<lbrace> z : B_id tid  | TRUE \<rbrace>" rule: check_v.strong_induct)
+  case (check_v_subtypeI \<Theta> \<B> \<Gamma> \<tau>1 v)
+  then obtain z and c where "\<tau>1 = \<lbrace> z : B_id tid | c \<rbrace>" using subtype_eq_base2 b_of.simps 
+    by (metis obtain_fresh_z2)
+  then show ?case  using infer_v_tid_form check_v_subtypeI by simp
+qed
+
+lemma check_v_num_leq:
+  fixes n::int and \<Gamma>::\<Gamma>
+  assumes "0 \<le> n \<and> n \<le> int (length v)" and " \<turnstile>\<^sub>w\<^sub>f \<Theta> " and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "\<Theta> ; {||} ; \<Gamma>  \<turnstile> [ L_num n ]\<^sup>v \<Leftarrow> \<lbrace> z : B_int  | ([ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e)   
+       AND  ([ leq [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e [| [ [ L_bitvec  v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )  \<rbrace>" 
+proof - 
+  have "\<Theta> ; {||} ; \<Gamma>  \<turnstile> [ L_num n ]\<^sup>v \<Rightarrow>  \<lbrace> z : B_int  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" 
+    using infer_v_litI infer_natI wfG_nilI assms by auto
+  thus ?thesis using subtype_range[OF assms(1) ] assms check_v_subtypeI by metis
+qed
+
+lemma check_int:
+  assumes "check_v \<Theta> \<B> \<Gamma> v  (\<lbrace> z : B_int | c \<rbrace>)" and "supp v = {}"
+  shows "\<exists>n. V_lit (L_num n) = v"
+  using assms infer_int check_v_elims  by (metis b_of.simps infer_v_form subtype_eq_base2)
+
+definition sble :: "\<Theta> \<Rightarrow> \<Gamma> \<Rightarrow> bool" where
+  "sble \<Theta> \<Gamma> = (\<exists>i. i \<Turnstile> \<Gamma> \<and> \<Theta> ; \<Gamma> \<turnstile> i)"
+
+lemma check_v_range:
+  assumes "\<Theta> ; B ; \<Gamma> \<turnstile> v2 \<Leftarrow> \<lbrace> z : B_int  | [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   AND  
+            [ leq [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1 ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>  "
+    (is "\<Theta> ; ?B ; \<Gamma> \<turnstile> v2 \<Leftarrow> \<lbrace> z : B_int | ?c1 \<rbrace>") 
+    and "v1 = V_lit (L_bitvec bv) \<and> v2 = V_lit (L_num n) " and "atom z \<sharp> \<Gamma>" and "sble \<Theta> \<Gamma>"
+  shows "0 \<le> n \<and> n \<le> int (length bv)"
+proof - 
+  have  "\<Theta> ; ?B ; \<Gamma> \<turnstile>  \<lbrace>   z : B_int  |  [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e == [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrace> \<lesssim> \<lbrace> z : B_int | ?c1 \<rbrace>" 
+    using check_v_elims assms 
+    by (metis infer_l_uniqueness infer_natI infer_v_elims(2))
+  moreover have "atom z \<sharp> \<Gamma>" using fresh_GNil assms by simp
+  ultimately have  "\<Theta> ; ?B ; ((z, B_int, [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_num n ]\<^sup>v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> \<Gamma>)  \<Turnstile> ?c1" 
+    using subtype_valid_simple by auto
+  thus ?thesis using assms valid_range_length_inv check_v_wf wfX_wfY sble_def by metis
+qed
+
+section \<open>Expressions\<close>
+
+lemma infer_e_plus[elim]:
+  fixes v1::v and v2::v
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<tau>"
+  shows "\<exists>z . (\<lbrace> z : B_int |  C_eq (CE_val (V_var z)) (CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace> = \<tau>)"
+  using infer_e_elims assms by metis
+
+lemma infer_e_leq[elim]:
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AE_op LEq v1 v2 \<Rightarrow> \<tau>"
+  shows "\<exists>z . (\<lbrace> z : B_bool |  C_eq (CE_val (V_var z)) (CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace> = \<tau>)"
+  using infer_e_elims assms by metis
+
+lemma infer_e_eq[elim]:
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AE_op Eq v1 v2 \<Rightarrow> \<tau>"
+  shows "\<exists>z . (\<lbrace> z : B_bool |  C_eq (CE_val (V_var z)) (CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e) \<rbrace> = \<tau>)"
+  using infer_e_elims(25)[OF assms] by metis
+
+lemma infer_e_e_wf: 
+  fixes e::e
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>" 
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b_of \<tau>" 
+  using assms proof(nominal_induct \<tau> avoiding: \<tau> rule: infer_e.strong_induct)
+  case (infer_e_valI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v \<tau>)
+  then show ?case using  infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_plusI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_leqI \<Theta> \<B> \<Gamma> \<Delta>' v1 z1 c1 v2 z2 c2 z3)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_eqI \<Theta> \<B> \<Gamma> \<Delta>' v1 z1 c1 v2 z2 c2 z3)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_appI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau>' s' v \<tau>'')
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_app f v : b_of \<tau>' " proof 
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_appI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using infer_e_appI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau>' s'))) = lookup_fun \<Phi> f\<close> using infer_e_appI by auto
+    show "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" using infer_e_appI check_v_wf b_of.simps by metis
+  qed
+  moreover have "b_of \<tau>' = b_of (\<tau>'[x::=v]\<^sub>v)" using subst_tbase_eq subst_v_\<tau>_def by auto
+  ultimately show ?case using infer_e_appI subst_v_c_def subst_b_\<tau>_def by auto
+next
+  case (infer_e_appPI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>'' s' v \<tau>')
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_appP f b' v : (b_of \<tau>'')[bv::=b']\<^sub>b " proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using infer_e_appPI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau>'' s'))) = lookup_fun \<Phi> f\<close> using * infer_e_appPI by metis
+    show "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b'" using infer_e_appPI by auto
+    show "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f v : (b[bv::=b']\<^sub>b)" using infer_e_appPI check_v_wf b_of.simps subst_b_b_def by metis
+    have "atom bv \<sharp> (b_of \<tau>'')[bv::=b']\<^sub>b\<^sub>b" using fresh_subst_if subst_b_b_def infer_e_appPI by metis
+    thus  "atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, b', v, (b_of \<tau>'')[bv::=b']\<^sub>b)" using infer_e_appPI fresh_prodN subst_b_b_def by metis
+  qed
+  moreover have "b_of \<tau>' = (b_of \<tau>'')[bv::=b']\<^sub>b" 
+    using \<open>\<tau>''[bv::=b']\<^sub>b[x::=v]\<^sub>v = \<tau>'\<close> b_of_subst_bb_commute subst_tbase_eq  subst_b_b_def subst_v_\<tau>_def subst_b_\<tau>_def by auto
+  ultimately show ?case using infer_e_appI by auto
+next
+  case (infer_e_fstI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v z' b1 b2 c z)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_sndI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v z' b1 b2 c z)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_lenI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v z' c z)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_mvarI \<Theta> \<Gamma> \<Phi> \<Delta> u \<tau>)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_concatI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  then show ?case using  b_of.simps infer_v_v_wf wf_intros by metis
+next
+  case (infer_e_splitI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  have " \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_split v1 v2  : B_pair B_bitvec B_bitvec"
+  proof
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using infer_e_splitI by auto
+    show "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" using infer_e_splitI by auto 
+    show "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_bitvec" using infer_e_splitI b_of.simps infer_v_wf by metis
+    show "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int" using infer_e_splitI b_of.simps check_v_wf by metis
+  qed  
+  then show ?case using  b_of.simps by auto
+qed
+
+lemma infer_e_t_wf:
+  fixes e::e and \<Gamma>::\<Gamma> and \<tau>::\<tau> and \<Delta>::\<Delta> and \<Phi>::\<Phi>
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>"
+  shows "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" 
+  using assms proof(induct  rule: infer_e.induct)
+  case (infer_e_valI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v \<tau>)
+  then show ?case using infer_v_t_wf by auto
+next
+  case (infer_e_plusI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  hence "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e : B_int" using wfCE_plusI wfD_emptyI wfPhi_emptyI infer_v_v_wf  wfCE_valI
+    by (metis b_of.simps infer_v_wf)
+  then show ?case  using wfT_e_eq infer_e_plusI by auto
+next
+  case (infer_e_leqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  hence " \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_op LEq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e : B_bool" using wfCE_leqI wfD_emptyI wfPhi_emptyI infer_v_v_wf wfCE_valI
+    by (metis b_of.simps infer_v_wf)
+  then show ?case  using wfT_e_eq infer_e_leqI by auto
+next
+  case (infer_e_eqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 b c1 v2 z2 c2 z3)
+  hence " \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_op Eq [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e : B_bool" using wfCE_eqI wfD_emptyI wfPhi_emptyI infer_v_v_wf wfCE_valI
+    by (metis b_of.simps infer_v_wf)
+  then show ?case  using wfT_e_eq infer_e_eqI by auto
+next
+  case (infer_e_appI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau> s' v \<tau>')
+  show ?case proof
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using infer_e_appI by auto
+    show "\<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau>'" proof -
+      have *:" \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b " using infer_e_appI check_v_wf(2) b_of.simps by metis
+      moreover have *:"\<Theta>; \<B>; (x, b, c) #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>" proof(rule  wf_weakening1(4))
+        show \<open> \<Theta>; \<B>; (x,b,c)#\<^sub>\<Gamma>GNil  \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using  wfPhi_f_simple_wfT wfD_wf infer_e_appI wb_b_weakening by fastforce
+        have "\<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> x : b | c \<rbrace>" using infer_e_appI check_v_wf(3) by auto
+        thus  \<open> \<Theta> ;  \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c) #\<^sub>\<Gamma> \<Gamma> \<close> using infer_e_appI 
+            wfT_wfC[THEN wfG_consI[rotated 3] ]  *  wfT_wf_cons fresh_prodN by simp
+        show \<open>toSet ((x,b,c)#\<^sub>\<Gamma>GNil) \<subseteq> toSet ((x, b, c) #\<^sub>\<Gamma> \<Gamma>)\<close> using toSet.simps by auto
+      qed
+      moreover have "((x, b, c) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>" using subst_gv.simps by auto
+
+      ultimately show ?thesis using infer_e_appI wf_subst1(4)[OF *, of GNil x b c \<Gamma> v] subst_v_\<tau>_def by auto
+    qed
+  qed
+next
+  case (infer_e_appPI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>' s' v \<tau>)
+
+  have "\<Theta>; \<B>; ((x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f (\<tau>'[bv::=b']\<^sub>b)[x::=v]\<^sub>\<tau>\<^sub>v" 
+  proof(rule wf_subst(4))
+    show \<open> \<Theta>; \<B>; (x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau>'[bv::=b']\<^sub>b \<close>  
+    proof(rule  wf_weakening1(4))
+      have  \<open> \<Theta> ; {|bv|} ; (x,b,c)#\<^sub>\<Gamma>GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> using  wfPhi_f_poly_wfT  infer_e_appI infer_e_appPI by simp
+      thus  \<open> \<Theta>; \<B>; (x,b[bv::=b']\<^sub>b\<^sub>b,c[bv::=b']\<^sub>c\<^sub>b)#\<^sub>\<Gamma>GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>'[bv::=b']\<^sub>b \<close> 
+        using wfT_subst_wfT infer_e_appPI wb_b_weakening subst_b_\<tau>_def subst_v_\<tau>_def by presburger
+      have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> x :  b[bv::=b']\<^sub>b\<^sub>b | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>" 
+        using infer_e_appPI check_v_wf(3) subst_b_b_def subst_b_c_def by metis
+      thus  \<open> \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma> \<close> 
+        using infer_e_appPI wfT_wfC[THEN wfG_consI[rotated 3] ]  * wfX_wfY wfT_wf_cons wb_b_weakening by metis
+      show \<open>toSet ((x,b[bv::=b']\<^sub>b\<^sub>b,c[bv::=b']\<^sub>c\<^sub>b)#\<^sub>\<Gamma>GNil) \<subseteq> toSet ((x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>)\<close> using toSet.simps by auto
+    qed
+    show \<open>(x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>\<close> using append_g.simps by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v :b[bv::=b']\<^sub>b\<^sub>b  \<close> using infer_e_appPI check_v_wf(2) b_of.simps subst_b_b_def by metis
+  qed
+  moreover have "((x, b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>" using subst_gv.simps by auto
+  ultimately show ?case using infer_e_appPI subst_v_\<tau>_def by simp
+next
+  case (infer_e_fstI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b1 b2 c z)
+  hence "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_fst [v]\<^sup>c\<^sup>e: b1" using wfCE_fstI wfD_emptyI wfPhi_emptyI infer_v_v_wf 
+      b_of.simps  using wfCE_valI by fastforce
+  then show ?case  using wfT_e_eq infer_e_fstI by auto
+next
+  case (infer_e_sndI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b1 b2 c z)
+  hence "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_snd  [v]\<^sup>c\<^sup>e: b2" using wfCE_sndI wfD_emptyI wfPhi_emptyI infer_v_v_wf wfCE_valI
+    by (metis b_of.simps infer_v_wf)
+  then show ?case  using wfT_e_eq infer_e_sndI by auto
+next
+  case (infer_e_lenI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' c z)
+  hence "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_len [v]\<^sup>c\<^sup>e: B_int" using wfCE_lenI wfD_emptyI wfPhi_emptyI infer_v_v_wf wfCE_valI
+    by (metis b_of.simps infer_v_wf)
+  then show ?case  using wfT_e_eq infer_e_lenI by auto
+next
+  case (infer_e_mvarI \<Theta> \<Gamma> \<Phi> \<Delta> u \<tau>)
+  then show ?case using wfD_wfT by blast
+next
+  case (infer_e_concatI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  hence "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e: B_bitvec" using wfCE_concatI wfD_emptyI wfPhi_emptyI infer_v_v_wf  wfCE_valI
+    by (metis b_of.simps infer_v_wf)
+  then show ?case  using wfT_e_eq infer_e_concatI by auto
+next
+  case (infer_e_splitI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+
+  hence wfg: " \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f (z3, [ B_bitvec , B_bitvec ]\<^sup>b, TRUE) #\<^sub>\<Gamma> \<Gamma>" 
+    using infer_v_wf wfG_cons2I wfB_pairI wfB_bitvecI by simp
+  have wfz: "\<Theta>; \<B>; (z3, [ B_bitvec , B_bitvec ]\<^sup>b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e : [ B_bitvec , B_bitvec ]\<^sup>b "
+    apply(rule wfCE_valI , rule wfV_varI)
+    using wfg  apply simp
+    using lookup.simps(2)[of z3 "[ B_bitvec , B_bitvec ]\<^sup>b" TRUE \<Gamma> z3] by simp
+  have 1: "\<Theta>; \<B>; (z3, [ B_bitvec , B_bitvec ]\<^sup>b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ v2 ]\<^sup>c\<^sup>e : B_int " 
+    using check_v_wf[OF infer_e_splitI(4)]  wf_weakening(1)[OF _ wfg] b_of.simps   toSet.simps wfCE_valI by fastforce
+  have 2: "\<Theta>; \<B>; (z3, [ B_bitvec , B_bitvec ]\<^sup>b, TRUE) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ v1 ]\<^sup>c\<^sup>e : B_bitvec" 
+    using infer_v_wf[OF infer_e_splitI(3)]  wf_weakening(1)[OF _ wfg] b_of.simps   toSet.simps wfCE_valI by fastforce
+
+  have "\<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z3 : [ B_bitvec , B_bitvec ]\<^sup>b  | [ v1 ]\<^sup>c\<^sup>e  ==  [ [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   AND  [| [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  ==  [ v2 ]\<^sup>c\<^sup>e   \<rbrace>"
+  proof
+    show "atom z3 \<sharp> (\<Theta>, \<B>, \<Gamma>)" using infer_e_splitI wfTh_x_fresh wfX_wfY fresh_prod3 wfG_fresh_x by metis
+    show "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f [ B_bitvec , B_bitvec ]\<^sup>b " using wfB_pairI wfB_bitvecI infer_e_splitI wfX_wfY by metis
+    show "\<Theta>; \<B>; (z3, [ B_bitvec , B_bitvec ]\<^sup>b, TRUE) #\<^sub>\<Gamma>
+              \<Gamma>   \<turnstile>\<^sub>w\<^sub>f [ v1 ]\<^sup>c\<^sup>e  ==  [ [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e @@ [#2[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e   AND  [| [#1[ [ z3 ]\<^sup>v ]\<^sup>c\<^sup>e]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e  ==  [ v2 ]\<^sup>c\<^sup>e" 
+      using wfg wfz 1 2 wf_intros by meson
+  qed
+  thus ?case using infer_e_splitI by auto
+qed
+
+lemma infer_e_wf:
+  fixes e::e and \<Gamma>::\<Gamma> and \<tau>::\<tau> and \<Delta>::\<Delta> and \<Phi>::\<Phi>
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" and "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : (b_of \<tau>)"
+  using infer_e_t_wf infer_e_e_wf wfE_wf  assms by metis+
+
+lemma infer_e_fresh:
+  fixes x::x
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> (e,\<tau>)"
+proof - 
+  have "atom x \<sharp> e" using infer_e_e_wf[THEN wfE_x_fresh,OF assms(1)] assms(2) by auto
+  moreover have "atom x \<sharp> \<tau>" using assms infer_e_wf  wfT_x_fresh by metis
+  ultimately show ?thesis using fresh_Pair by auto
+qed
+
+inductive check_e :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow> e \<Rightarrow> \<tau> \<Rightarrow> bool"  (" _ ; _ ; _ ; _ ; _  \<turnstile> _ \<Leftarrow> _" [50, 50, 50] 50) where
+  check_e_subtypeI: "\<lbrakk> infer_e T P B G D e \<tau>' ; subtype T B G \<tau>' \<tau> \<rbrakk> \<Longrightarrow> check_e T P B G D e \<tau>"
+equivariance check_e
+nominal_inductive check_e  .
+
+inductive_cases check_e_elims[elim!]:
+  "check_e F D B G \<Theta> (AE_val v) \<tau>"
+  "check_e F D B G \<Theta> e \<tau>"
+
+lemma infer_e_fst_pair:
+  fixes v1::v
+  assumes "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> [#1[ v1 , v2 ]\<^sup>v]\<^sup>e \<Rightarrow> \<tau>"
+  shows "\<exists>\<tau>'. \<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> [v1]\<^sup>e \<Rightarrow> \<tau>' \<and> 
+        \<Theta> ; {||} ; GNil \<turnstile> \<tau>' \<lesssim> \<tau>"
+proof -
+  obtain z' and b1 and b2 and c and z where ** : "\<tau> = (\<lbrace> z : b1  | C_eq (CE_val (V_var z))  (CE_fst [(V_pair v1 v2)]\<^sup>c\<^sup>e)  \<rbrace>) \<and> 
+          wfD \<Theta> {||} GNil \<Delta> \<and> wfPhi \<Theta> \<Phi> \<and>
+              (\<Theta> ; {||} ; GNil  \<turnstile> V_pair v1 v2 \<Rightarrow> \<lbrace> z' : B_pair b1 b2  | c \<rbrace>) \<and> atom z \<sharp> V_pair v1 v2 "
+    using infer_e_elims assms  by metis
+  hence *:" \<Theta> ; {||} ; GNil  \<turnstile> V_pair v1 v2 \<Rightarrow> \<lbrace> z' : B_pair b1 b2  | c \<rbrace>" by auto
+
+  obtain  t1a  and t2a  where
+    *: "\<Theta> ; {||} ; GNil  \<turnstile> v1 \<Rightarrow> t1a \<and>   \<Theta> ; {||} ; GNil  \<turnstile> v2 \<Rightarrow> t2a \<and>  B_pair b1 b2 = B_pair (b_of t1a) (b_of t2a)"
+    using infer_v_elims(5)[OF *] by metis
+
+  hence  suppv: "supp v1 = {}  \<and> supp v2 = {} \<and> supp (V_pair v1 v2) = {}" using ** infer_v_v_wf wfV_supp atom_dom.simps toSet.simps supp_GNil  
+    by (meson wfV_supp_nil)
+
+  obtain z1 and b1' where "t1a = \<lbrace> z1 : b1'  | [ [ z1 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v1 ]\<^sup>c\<^sup>e  \<rbrace> " 
+    using infer_v_form[of \<Theta> "{||}" GNil v1 t1a] * by auto
+  moreover hence "b1' = b1" using * b_of.simps by simp
+  ultimately have  "\<Theta> ; {||} ; GNil  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : b1  | CE_val (V_var z1)  ==  CE_val v1 \<rbrace>" using * by auto
+  moreover have "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f CE_fst [V_pair v1 v2]\<^sup>c\<^sup>e : b1" using wfCE_fstI infer_v_wf(1) ** b_of.simps wfCE_valI by metis
+  moreover hence st: "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z1 : b1  | CE_val (V_var z1)  ==  CE_val v1 \<rbrace> \<lesssim> (\<lbrace> z : b1  | CE_val (V_var z)  ==  CE_fst [V_pair v1 v2]\<^sup>c\<^sup>e  \<rbrace>)" 
+    using subtype_gnil_fst infer_v_v_wf by auto
+  moreover have "wfD \<Theta> {||} GNil \<Delta> \<and>  wfPhi \<Theta> \<Phi>" using **  by auto
+  ultimately show ?thesis  using wfX_wfY  ** infer_e_valI by metis
+qed
+
+lemma infer_e_snd_pair:
+  assumes  "\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_snd (V_pair v1 v2) \<Rightarrow> \<tau>"
+  shows  "\<exists>\<tau>'. \<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> AE_val v2 \<Rightarrow> \<tau>' \<and> \<Theta> ; {||} ; GNil \<turnstile> \<tau>' \<lesssim> \<tau>"
+proof -
+  obtain z' and b1 and b2 and c and z where ** : "(\<tau> = (\<lbrace> z : b2  | C_eq (CE_val (V_var z)) (CE_snd [(V_pair v1 v2)]\<^sup>c\<^sup>e)  \<rbrace>)) \<and> 
+           (wfD \<Theta> {||} GNil \<Delta>) \<and> (wfPhi \<Theta> \<Phi>) \<and>
+              \<Theta> ; {||} ; GNil  \<turnstile> V_pair v1 v2 \<Rightarrow> \<lbrace> z' : B_pair b1 b2  | c \<rbrace> \<and> atom z \<sharp> V_pair v1 v2 "
+    using infer_e_elims(9)[OF assms(1)]  by metis
+  hence *:" \<Theta> ; {||} ; GNil  \<turnstile> V_pair v1 v2 \<Rightarrow> \<lbrace> z' : B_pair b1 b2  | c \<rbrace>" by auto
+
+  obtain  t1a  and t2a  where
+    *: "\<Theta> ; {||} ; GNil  \<turnstile> v1 \<Rightarrow> t1a \<and>   \<Theta> ; {||} ; GNil  \<turnstile> v2 \<Rightarrow> t2a \<and>  B_pair b1 b2 = B_pair (b_of t1a) (b_of t2a)"
+    using infer_v_elims(5)[OF *] by metis
+
+  hence  suppv: "supp v1 = {} \<and> supp v2 = {} \<and> supp (V_pair v1 v2) = {}" using infer_v_v_wf wfV.simps v.supp  by (meson "**" wfV_supp_nil)
+
+  obtain z2 and b2' where "t2a = \<lbrace> z2 : b2'  | [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v2 ]\<^sup>c\<^sup>e  \<rbrace> " 
+    using infer_v_form[of \<Theta> "{||}" GNil v2 t2a] * by auto
+  moreover hence "b2' = b2" using * b_of.simps by simp
+
+  ultimately have  "\<Theta> ; {||} ; GNil  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : b2  | CE_val (V_var z2)  ==  CE_val v2 \<rbrace>" using * by auto
+  moreover have "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f CE_snd [V_pair v1 v2]\<^sup>c\<^sup>e : b2" using wfCE_sndI infer_v_wf(1) ** b_of.simps wfCE_valI by metis
+  moreover hence st: "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z2 : b2  | CE_val (V_var z2)  ==  CE_val v2 \<rbrace> \<lesssim> (\<lbrace> z : b2  | CE_val (V_var z)  ==  CE_snd [V_pair v1 v2]\<^sup>c\<^sup>e  \<rbrace>)" 
+    using subtype_gnil_snd infer_v_v_wf by auto
+  moreover have "wfD \<Theta> {||} GNil \<Delta> \<and>  wfPhi \<Theta> \<Phi>" using ** by metis
+  ultimately show ?thesis  using wfX_wfY  ** infer_e_valI by metis
+qed
+
+section \<open>Statements\<close>
+
+lemma check_s_v_unit:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<lesssim> \<tau>"  and "wfD \<Theta> \<B> \<Gamma> \<Delta>" and "wfPhi \<Theta> \<Phi>"
+  shows  "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AS_val (V_lit L_unit ) \<Leftarrow> \<tau>" 
+proof - 
+  have "wfG \<Theta> \<B> \<Gamma>" using assms subtype_g_wf by meson
+  moreover hence "wfTh \<Theta>" using wfG_wf by simp
+  moreover obtain z'::x where "atom z' \<sharp> \<Gamma>" using obtain_fresh by auto
+  ultimately have *:"\<Theta>; \<B>; \<Gamma> \<turnstile> V_lit L_unit \<Rightarrow> \<lbrace> z' : B_unit | CE_val (V_var z')  ==  CE_val (V_lit L_unit)  \<rbrace>" 
+    using infer_v_litI infer_unitI by simp
+  moreover have "wfT \<Theta> \<B> \<Gamma> (\<lbrace> z' : B_unit | CE_val (V_var z')  ==  CE_val (V_lit L_unit)  \<rbrace>)" using infer_v_t_wf
+    by (meson calculation)
+  moreover then have  "\<Theta>; \<B>; \<Gamma> \<turnstile> (\<lbrace> z' : B_unit | CE_val (V_var z')  ==  CE_val (V_lit L_unit)  \<rbrace>)  \<lesssim> \<tau>" using subtype_trans subtype_top assms 
+      type_for_lit.simps(4) wfX_wfY by metis
+  ultimately show  ?thesis using  check_valI assms * by auto
+qed
+
+lemma check_s_check_branch_s_wf:
+  fixes s::s and cs::branch_s and \<Theta>::\<Theta> and \<Phi>::\<Phi> and \<Gamma>::\<Gamma> and \<Delta>::\<Delta> and v::v and \<tau>::\<tau> and css::branch_list
+  shows "\<Theta> ; \<Phi> ; B ; \<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>        \<Longrightarrow> \<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  wfTh \<Theta> \<and> wfD \<Theta> B \<Gamma> \<Delta> \<and> wfT \<Theta> B \<Gamma> \<tau> \<and> wfPhi \<Theta> \<Phi> " and 
+    "check_branch_s \<Theta> \<Phi> B \<Gamma> \<Delta>  tid cons const v cs  \<tau> \<Longrightarrow> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  wfTh \<Theta> \<and> wfD \<Theta> B \<Gamma> \<Delta> \<and> wfT \<Theta> B \<Gamma> \<tau> \<and> wfPhi \<Theta> \<Phi> "
+    "check_branch_list \<Theta> \<Phi> B \<Gamma> \<Delta>  tid dclist v css  \<tau> \<Longrightarrow> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  wfTh \<Theta> \<and> wfD \<Theta> B \<Gamma> \<Delta> \<and> wfT \<Theta> B \<Gamma> \<tau> \<and> wfPhi \<Theta> \<Phi> " 
+proof(induct rule: check_s_check_branch_s_check_branch_list.inducts)
+  case (check_valI \<Theta> B \<Gamma> \<Delta> \<Phi> v \<tau>' \<tau>)
+  then show ?case using infer_v_wf  infer_v_wf subtype_wf wfX_wfY wfS_valI 
+    by (metis subtype_eq_base2)
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  then have *:"wfT \<Theta> \<B> ((x, b , c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<tau>" by force
+  moreover have "atom x \<sharp> \<tau>" using check_letI fresh_prodN by force
+  ultimately have "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfT_restrict2 by force
+  then show ?case  using check_letI  infer_e_wf wfS_letI wfX_wfY wfG_elims by metis
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  then have *:"wfT \<Theta> \<B> ((x, B_bool , c) #\<^sub>\<Gamma> \<Gamma>) \<tau>" by force
+  moreover have "atom x \<sharp> \<tau>" using check_assertI fresh_prodN by force
+  ultimately have "\<Theta>; \<B>;\<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfT_restrict2 by force
+  then show ?case  using check_assertI   wfS_assertI wfX_wfY wfG_elims by metis
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> cons const x v \<Phi> s tid)
+  then show ?case using wfX_wfY by metis
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' v cs \<tau> css )
+  then show ?case using wfX_wfY by metis
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' v cs \<tau> )
+  then show ?case using wfX_wfY by metis
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  hence *:"wfT \<Theta>  \<B> \<Gamma> (\<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_false) IMP  c_of \<tau> z  \<rbrace>)" (is "wfT \<Theta>  \<B> \<Gamma> ?tau") by auto
+  hence "wfT \<Theta> \<B> \<Gamma> \<tau>" using wfT_wfT_if1 check_ifI  fresh_prodN by metis
+  hence " \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> " using check_ifI b_of_c_of_eq fresh_prodN by auto
+  thus ?case using check_ifI by metis
+next
+  case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2)
+  then have "wfT \<Theta> \<B> ((x, b_of t, (c_of t x)) #\<^sub>\<Gamma> G) \<tau>" by fastforce
+  moreover have "atom x \<sharp> \<tau>" using check_let2I by force
+  ultimately have "wfT \<Theta> \<B>  G \<tau>" using wfT_restrict2 by metis
+  then show ?case using check_let2I by argo
+next
+  case (check_varI u \<Delta> P G v \<tau>' \<Phi> s \<tau>)
+  then show ?case using wfG_elims wfD_elims 
+      list.distinct list.inject by metis
+next
+  case (check_assignI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau> v z \<tau>')
+  obtain z'::x where *:"atom z' \<sharp> \<Gamma>" using obtain_fresh by metis
+  moreover have "\<lbrace> z : B_unit | TRUE \<rbrace> = \<lbrace> z' : B_unit | TRUE \<rbrace>" by auto
+  moreover hence "wfT \<Theta> \<B> \<Gamma> \<lbrace> z' : B_unit |TRUE \<rbrace>" using wfT_TRUE check_assignI check_v_wf * wfB_unitI wfG_wf by metis
+  ultimately show ?case  using check_v.cases infer_v_wf  subtype_wf check_assignI wfT_wf check_v_wf wfG_wf
+    by (meson subtype_wf)
+next
+  case (check_whileI \<Phi> \<Delta> G P s1 z s2 \<tau>')
+  then show ?case using subtype_wf subtype_wf by auto
+next
+  case (check_seqI \<Delta> G P s1 z s2 \<tau>)
+  then show ?case by fast
+next
+  case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta>  dclist cs \<tau> tid v z)
+  then show ?case by fast
+qed
+
+lemma check_s_check_branch_s_wfS:
+  fixes s::s and cs::branch_s and \<Theta>::\<Theta> and \<Phi>::\<Phi> and \<Gamma>::\<Gamma> and \<Delta>::\<Delta> and v::v and \<tau>::\<tau> and css::branch_list
+  shows "\<Theta> ; \<Phi> ; B ; \<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>        \<Longrightarrow>   \<Theta> ; \<Phi> ; B ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau>  " and 
+    "check_branch_s \<Theta> \<Phi> B \<Gamma> \<Delta>  tid cons const v cs  \<tau> \<Longrightarrow>  wfCS \<Theta> \<Phi> B \<Gamma> \<Delta> tid cons const cs (b_of \<tau>)"
+    "check_branch_list \<Theta> \<Phi> B \<Gamma> \<Delta>  tid dclist v css  \<tau> \<Longrightarrow>  wfCSS \<Theta> \<Phi> B \<Gamma> \<Delta> tid dclist css (b_of \<tau>)" 
+proof(induct rule: check_s_check_branch_s_check_branch_list.inducts)
+  case (check_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v \<tau>' \<tau>)
+  then show ?case using infer_v_wf  infer_v_wf subtype_wf wfX_wfY wfS_valI 
+    by (metis subtype_eq_base2)
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<close> using infer_e_wf check_letI b_of.simps by metis
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau> \<close>  
+      using check_letI b_of.simps wf_replace_true2(2)[OF check_letI(5)]   append_g.simps by metis
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using infer_e_wf check_letI b_of.simps by metis
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, e, b_of \<tau>)\<close> 
+      apply(simp add: fresh_prodN, intro conjI)
+      using  check_letI(1) fresh_prod7 by simp+ 
+  qed
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  show ?case proof
+
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau> \<close> using check_assertI by auto
+  next
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using check_assertI by auto
+  next
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_assertI by auto
+  next
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, c, b_of \<tau>, s)\<close> using check_assertI by auto
+  qed
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, b_of const, TRUE) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau> \<close> 
+      using wf_replace_true append_g.simps check_branch_s_branchI by metis
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, \<Gamma>, const)\<close> 
+      using wf_replace_true append_g.simps check_branch_s_branchI fresh_prodN by metis
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_replace_true append_g.simps check_branch_s_branchI by metis
+  qed
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau> dclist css)
+  then show ?case using wf_intros by metis
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau>)
+  then show ?case using wf_intros by metis
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  show ?case using wfS_ifI check_v_wf check_ifI b_of.simps by metis
+next
+  case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; G ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of t \<close>  using check_let2I  b_of.simps by metis 
+    show \<open> \<Theta>; \<B>; G   \<turnstile>\<^sub>w\<^sub>f t \<close>  using  check_let2I check_s_check_branch_s_wf  by metis
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, b_of t, TRUE) #\<^sub>\<Gamma> G ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b_of \<tau> \<close>  
+      using check_let2I(5) wf_replace_true2(2) append_g.simps check_let2I by metis 
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, G, \<Delta>, s1, b_of \<tau>, t)\<close>  
+      apply(simp add: fresh_prodN, intro conjI)
+      using  check_let2I(1) fresh_prod7 by simp+ 
+  qed
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> using check_v_wf check_varI by metis
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau>' \<close>  using check_v_wf check_varI by metis
+    show \<open>atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, \<tau>', v, b_of \<tau>)\<close>  using check_varI fresh_prodN u_fresh_b by metis
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; (u, \<tau>') #\<^sub>\<Delta>\<Delta> \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau> \<close>  using check_varI by metis
+  qed   
+next
+  case (check_assignI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau> v z \<tau>')
+  then show ?case using wf_intros check_v_wf subtype_eq_base2 b_of.simps by metis
+next
+  case (check_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>')
+  thus ?case using wf_intros  b_of.simps  check_v_wf subtype_eq_base2 b_of.simps by metis
+next
+  case (check_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>)
+  thus ?case using wf_intros  b_of.simps  by metis
+next
+  case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> z)
+  show  ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_id tid \<close> using check_caseI check_v_wf b_of.simps  by metis
+    show \<open>AF_typedef tid dclist \<in> set \<Theta>\<close>  using check_caseI by metis
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using check_caseI check_s_check_branch_s_wf by metis
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close>  using check_caseI check_s_check_branch_s_wf  by metis
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f cs : b_of \<tau> \<close>  using check_caseI by metis
+  qed
+qed
+
+lemma check_s_wf:
+  fixes s::s
+  assumes "\<Theta> ; \<Phi> ; B ; \<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>"
+  shows "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> wfT \<Theta> B \<Gamma> \<tau> \<and> wfPhi \<Theta> \<Phi> \<and> wfTh \<Theta> \<and> wfD \<Theta> B \<Gamma> \<Delta> \<and> wfS  \<Theta> \<Phi> B \<Gamma> \<Delta> s (b_of \<tau>)"  
+  using check_s_check_branch_s_wf check_s_check_branch_s_wfS assms  by meson
+
+lemma check_s_flip_u1:
+  fixes s::s and u::u and u'::u
+  assumes  "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>"
+  shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; ( u \<leftrightarrow> u') \<bullet> \<Delta>  \<turnstile> (u \<leftrightarrow> u') \<bullet> s \<Leftarrow>  \<tau>" 
+proof - 
+  have  "(u \<leftrightarrow> u') \<bullet> \<Theta> ; (u \<leftrightarrow> u') \<bullet> \<Phi> ;  (u \<leftrightarrow> u') \<bullet>  \<B> ; (u \<leftrightarrow> u') \<bullet>  \<Gamma> ;  (u \<leftrightarrow> u') \<bullet> \<Delta>    \<turnstile> (u \<leftrightarrow> u') \<bullet> s \<Leftarrow> (u \<leftrightarrow> u') \<bullet> \<tau>" 
+    using check_s.eqvt assms  by blast
+  thus  ?thesis using check_s_wf[OF assms] flip_u_eq phi_flip_eq  by metis
+qed
+
+lemma check_s_flip_u2: 
+  fixes s::s and u::u and u'::u
+  assumes "\<Theta> ; \<Phi> ;  B ; \<Gamma> ; ( u \<leftrightarrow> u') \<bullet> \<Delta>   \<turnstile> (u \<leftrightarrow> u') \<bullet> s \<Leftarrow>  \<tau>" 
+  shows "\<Theta> ; \<Phi> ;  B ; \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>"
+proof - 
+  have "\<Theta> ; \<Phi> ; B ; \<Gamma> ; ( u \<leftrightarrow> u') \<bullet> ( u \<leftrightarrow> u') \<bullet> \<Delta>   \<turnstile> ( u \<leftrightarrow> u') \<bullet> (u \<leftrightarrow> u') \<bullet> s \<Leftarrow>  \<tau>" 
+    using check_s_flip_u1 assms by blast
+  thus ?thesis using  permute_flip_cancel by force
+qed
+
+lemma check_s_flip_u:
+  fixes s::s and u::u and u'::u
+  shows "\<Theta> ; \<Phi> ; B ; \<Gamma> ; ( u \<leftrightarrow> u') \<bullet> \<Delta>  \<turnstile> (u \<leftrightarrow> u') \<bullet> s \<Leftarrow>  \<tau> = (\<Theta> ; \<Phi> ; B ; \<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau>)"
+  using check_s_flip_u1  check_s_flip_u2 by metis
+
+lemma check_s_abs_u:
+  fixes s::s and s'::s and u::u and u'::u and \<tau>'::\<tau>
+  assumes "[[atom u]]lst. s = [[atom u']]lst. s'" and "atom u \<sharp> \<Delta>" and "atom u' \<sharp> \<Delta>"
+    and "\<Theta> ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>'" 
+    and "\<Theta> ; \<Phi> ; B ; \<Gamma> ; ( u , \<tau>') #\<^sub>\<Delta>\<Delta>  \<turnstile> s \<Leftarrow>  \<tau>"
+  shows "\<Theta> ; \<Phi> ; B ; \<Gamma> ; ( u', \<tau>' ) #\<^sub>\<Delta>\<Delta> \<turnstile> s' \<Leftarrow> \<tau>"
+proof -
+  have "\<Theta> ; \<Phi> ; B ; \<Gamma> ; ( u' \<leftrightarrow> u) \<bullet> (( u , \<tau>') #\<^sub>\<Delta>\<Delta>)  \<turnstile> ( u' \<leftrightarrow> u) \<bullet> s \<Leftarrow>  \<tau>"
+    using assms check_s_flip_u by metis
+  moreover have " ( u' \<leftrightarrow> u) \<bullet> (( u , \<tau>') #\<^sub>\<Delta> \<Delta>) = ( u' , \<tau>') #\<^sub>\<Delta>\<Delta>" proof -
+    have " ( u' \<leftrightarrow> u) \<bullet> (( u , \<tau>') #\<^sub>\<Delta> \<Delta>) = ((u' \<leftrightarrow> u) \<bullet> u, (u' \<leftrightarrow> u) \<bullet> \<tau>') #\<^sub>\<Delta> (u' \<leftrightarrow> u) \<bullet> \<Delta>"  
+      using  DCons_eqvt  Pair_eqvt by auto
+    also have "... = ( u' , (u' \<leftrightarrow> u) \<bullet> \<tau>') #\<^sub>\<Delta> \<Delta>" 
+      using assms flip_fresh_fresh by auto
+    also have "... = ( u' , \<tau>') #\<^sub>\<Delta> \<Delta>" using
+        u_not_in_t fresh_def flip_fresh_fresh assms by metis
+    finally show ?thesis by auto
+  qed
+  moreover have "( u' \<leftrightarrow> u) \<bullet> s = s'" using assms Abs1_eq_iff(3)[of u' s' u s] by auto
+  ultimately show ?thesis by auto
+qed
+
+section \<open>Additional Elimination and Intros\<close>
+
+subsection  \<open>Values\<close> 
+
+nominal_function b_for :: "opp \<Rightarrow> b" where
+  "b_for Plus = B_int"
+| "b_for LEq = B_bool" | "b_for Eq = B_bool"
+  apply(auto,simp add: eqvt_def b_for_graph_aux_def )
+  by (meson opp.exhaust)
+nominal_termination (eqvt)  by lexicographic_order
+
+
+lemma infer_v_pair2I:
+  fixes  v\<^sub>1::v and  v\<^sub>2::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>1 \<Rightarrow> \<tau>\<^sub>1" and "\<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>2 \<Rightarrow> \<tau>\<^sub>2"
+  shows "\<exists>\<tau>. \<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v\<^sub>1 v\<^sub>2 \<Rightarrow> \<tau> \<and> b_of \<tau> = B_pair (b_of \<tau>\<^sub>1) (b_of \<tau>\<^sub>2)"
+proof - 
+  obtain z1 and b1 and c1 and z2 and b2 and c2 where zbc: "\<tau>\<^sub>1 = (\<lbrace> z1 : b1 | c1 \<rbrace>) \<and> \<tau>\<^sub>2 = (\<lbrace> z2 : b2 | c2 \<rbrace>)"
+    using \<tau>.exhaust by meson
+  obtain z::x where "atom z \<sharp> ( v\<^sub>1, v\<^sub>2,\<Theta>, \<B>,\<Gamma>)" using obtain_fresh
+    by blast
+  hence "atom z \<sharp> ( v\<^sub>1, v\<^sub>2) \<and> atom z \<sharp> (\<Theta>, \<B>,\<Gamma>)" using fresh_prodN by metis
+  hence " \<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v\<^sub>1 v\<^sub>2 \<Rightarrow> \<lbrace> z : [ b_of \<tau>\<^sub>1 , b_of \<tau>\<^sub>2 ]\<^sup>b  | CE_val (V_var z)  ==  CE_val (V_pair v\<^sub>1 v\<^sub>2)  \<rbrace>"  
+    using assms infer_v_pairI zbc by metis
+  moreover obtain \<tau> where "\<tau> = (\<lbrace> z : B_pair b1 b2  | CE_val (V_var z)  ==  CE_val (V_pair v\<^sub>1 v\<^sub>2)  \<rbrace>)" by blast
+  moreover hence "b_of \<tau> = B_pair (b_of \<tau>\<^sub>1) (b_of \<tau>\<^sub>2)" using b_of.simps zbc by presburger
+  ultimately show ?thesis using b_of.simps by metis
+qed
+
+lemma infer_v_pair2I_zbc:
+  fixes  v\<^sub>1::v and  v\<^sub>2::v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>1 \<Rightarrow> \<tau>\<^sub>1" and "\<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>2 \<Rightarrow> \<tau>\<^sub>2"
+  shows "\<exists>z \<tau>. \<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v\<^sub>1 v\<^sub>2 \<Rightarrow> \<tau> \<and> \<tau> = (\<lbrace> z : B_pair (b_of \<tau>\<^sub>1) (b_of \<tau>\<^sub>2) | C_eq (CE_val (V_var z)) (CE_val (V_pair v\<^sub>1 v\<^sub>2)) \<rbrace>) \<and> atom z \<sharp> (v\<^sub>1,v\<^sub>2) \<and> atom z \<sharp> \<Gamma>"
+proof - 
+  obtain z1 and b1 and c1 and z2 and b2 and c2 where zbc: "\<tau>\<^sub>1 = (\<lbrace> z1 : b1 | c1 \<rbrace>) \<and> \<tau>\<^sub>2 = (\<lbrace> z2 : b2 | c2 \<rbrace>)"
+    using \<tau>.exhaust by meson
+  obtain z::x where * : "atom z \<sharp> ( v\<^sub>1, v\<^sub>2,\<Gamma>,\<Theta> , \<B> )"  using obtain_fresh
+    by blast
+  hence vinf: " \<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v\<^sub>1 v\<^sub>2 \<Rightarrow> \<lbrace> z :[ b_of \<tau>\<^sub>1 , b_of \<tau>\<^sub>2 ]\<^sup>b  | CE_val (V_var z)  ==  CE_val (V_pair v\<^sub>1 v\<^sub>2)  \<rbrace>"  
+    using assms infer_v_pairI by simp
+  moreover obtain \<tau> where "\<tau> = (\<lbrace> z : B_pair b1 b2  | CE_val (V_var z)  ==  CE_val (V_pair v\<^sub>1 v\<^sub>2)  \<rbrace>)" by blast
+  moreover have "b_of \<tau>\<^sub>1 = b1 \<and> b_of \<tau>\<^sub>2 = b2" using zbc b_of.simps by auto
+  ultimately have "\<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v\<^sub>1 v\<^sub>2 \<Rightarrow> \<tau> \<and> \<tau> = (\<lbrace> z : B_pair (b_of \<tau>\<^sub>1) (b_of \<tau>\<^sub>2) | CE_val (V_var z)  ==  CE_val (V_pair v\<^sub>1 v\<^sub>2)  \<rbrace>)" by auto
+  thus ?thesis using * fresh_prod2 fresh_prod3 by metis
+qed
+
+lemma infer_v_pair2E:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> V_pair v\<^sub>1 v\<^sub>2 \<Rightarrow> \<tau>"
+  shows "\<exists>\<tau>\<^sub>1 \<tau>\<^sub>2 z . \<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>1 \<Rightarrow> \<tau>\<^sub>1 \<and> \<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>2 \<Rightarrow> \<tau>\<^sub>2 \<and> 
+           \<tau> = (\<lbrace> z : B_pair (b_of \<tau>\<^sub>1) (b_of \<tau>\<^sub>2) | C_eq (CE_val (V_var z)) (CE_val (V_pair v\<^sub>1 v\<^sub>2)) \<rbrace>) \<and> atom z \<sharp>  (v\<^sub>1, v\<^sub>2)" 
+proof - 
+  obtain z and t1 and t2 where 
+    "\<tau> = (\<lbrace> z : B_pair (b_of t1) (b_of t2)  | CE_val (V_var z)  ==  CE_val (V_pair v\<^sub>1 v\<^sub>2)  \<rbrace>) \<and>
+        atom z \<sharp> (v\<^sub>1, v\<^sub>2) \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>1 \<Rightarrow> t1 \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile> v\<^sub>2 \<Rightarrow> t2 " using infer_v_elims(3)[OF assms ] by metis 
+  thus ?thesis using b_of.simps  by metis
+qed
+
+subsection  \<open>Expressions\<close>
+
+lemma infer_e_app2E:
+  fixes \<Phi>::\<Phi> and \<Theta>::\<Theta>
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AE_app f v \<Rightarrow> \<tau>"
+  shows "\<exists>x b c s' \<tau>'.  wfD  \<Theta> \<B> \<Gamma> \<Delta> \<and> Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau>' s'))) = lookup_fun \<Phi> f \<and>  \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>
+       \<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> x : b  | c \<rbrace> \<and> \<tau> = \<tau>'[x::=v]\<^sub>\<tau>\<^sub>v \<and> atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, v, \<tau>)"
+  using infer_e_elims(6)[OF assms] b_of.simps subst_defs by metis
+
+lemma infer_e_appP2E:
+  fixes \<Phi>::\<Phi> and \<Theta>::\<Theta>
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AE_appP f b v \<Rightarrow> \<tau>"
+  shows "\<exists>bv x ba c s' \<tau>'.  wfD  \<Theta> \<B> \<Gamma> \<Delta> \<and> Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x ba c \<tau>' s'))) = lookup_fun \<Phi> f \<and>  \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b   \<and>
+      (\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> x : ba[bv::=b]\<^sub>b\<^sub>b  | c[bv::=b]\<^sub>c\<^sub>b \<rbrace>) \<and> (\<tau> = \<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v) \<and> atom x \<sharp> \<Gamma> \<and> atom bv \<sharp> v"
+proof -
+  obtain bv x ba c s' \<tau>' where *:"wfD  \<Theta> \<B> \<Gamma> \<Delta> \<and> Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x ba c \<tau>' s'))) = lookup_fun \<Phi> f \<and>  \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b   \<and>
+      (\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> x : ba[bv::=b]\<^sub>b\<^sub>b  | c[bv::=b]\<^sub>c\<^sub>b \<rbrace>) \<and> (\<tau> = \<tau>'[bv::=b]\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v) \<and> atom x \<sharp> \<Gamma> \<and> atom bv \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, b, v, \<tau>)" 
+    using infer_e_elims(21)[OF assms] subst_defs by metis
+  moreover then have "atom bv \<sharp> v" using fresh_prodN by metis
+  ultimately show ?thesis by metis
+qed
+
+section \<open>Weakening\<close>
+
+text \<open> Lemmas showing that typing judgements hold when a context is extended \<close>
+
+lemma subtype_weakening:
+  fixes \<Gamma>'::\<Gamma>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> \<tau>1 \<lesssim> \<tau>2" and  "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" 
+  shows  "\<Theta>; \<B>; \<Gamma>' \<turnstile> \<tau>1 \<lesssim> \<tau>2"
+  using assms proof(nominal_induct \<tau>2 avoiding: \<Gamma>' rule: subtype.strong_induct)
+
+  case (subtype_baseI x \<Theta> \<B> \<Gamma> z c z' c' b)
+  show ?case proof
+    show *:"\<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c \<rbrace>" using wfT_weakening subtype_baseI by metis
+    show "\<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z' : b  | c' \<rbrace>" using wfT_weakening subtype_baseI by metis
+    show "atom x \<sharp> (\<Theta>, \<B>, \<Gamma>',  z ,  c ,  z' ,  c' )" using subtype_baseI fresh_Pair by metis
+    have "toSet ((x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<subseteq>  toSet ((x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>')" using subtype_baseI toSet.simps by blast
+    moreover have "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>'" using wfT_wf_cons3[OF *, of x] subtype_baseI fresh_Pair subst_defs by metis
+    ultimately show "\<Theta>; \<B>; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>'  \<Turnstile> c'[z'::=V_var x]\<^sub>v" using valid_weakening subtype_baseI by metis
+  qed
+qed
+
+method many_rules uses add = ( (rule+),((simp add: add)+)?)
+
+lemma infer_v_g_weakening:
+  fixes e::e and \<Gamma>'::\<Gamma> and v::v
+  assumes "\<Theta>;  \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<Theta>  ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'"
+  shows   "\<Theta>;  \<B> ; \<Gamma>' \<turnstile> v \<Rightarrow> \<tau>"
+  using assms proof(nominal_induct   avoiding: \<Gamma>'  rule: infer_v.strong_induct)
+  case (infer_v_varI \<Theta> \<B> \<Gamma> b c x' z)  
+  show ?case proof
+    show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<close> using infer_v_varI by auto
+    show \<open>Some (b, c) = lookup \<Gamma>' x'\<close> using infer_v_varI lookup_weakening by metis
+    show \<open>atom z \<sharp> x'\<close> using infer_v_varI by auto
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>')\<close> using infer_v_varI by auto
+  qed
+next
+  case (infer_v_litI \<Theta> \<B> \<Gamma> l \<tau>)
+  then show ?case using infer_v.intros by simp
+next
+  case (infer_v_pairI z v1 v2 \<Theta> \<B> \<Gamma> t1 t2)
+  then show ?case using infer_v.intros by simp
+next
+  case (infer_v_consI s dclist \<Theta> dc tc \<B> \<Gamma> v tv z)
+  show ?case proof 
+    show \<open>AF_typedef s dclist \<in> set \<Theta>\<close> using infer_v_consI by auto
+    show \<open>(dc, tc) \<in> set dclist\<close> using infer_v_consI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile> v \<Rightarrow> tv\<close> using infer_v_consI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>'  \<turnstile> tv \<lesssim> tc\<close> using infer_v_consI subtype_weakening by auto
+    show \<open>atom z \<sharp> v\<close> using infer_v_consI by auto
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>')\<close> using infer_v_consI by auto
+  qed
+next
+  case (infer_v_conspI s bv dclist \<Theta> dc tc \<B> \<Gamma> v tv b z)
+  show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using infer_v_conspI by auto
+    show \<open>(dc, tc) \<in> set dclist\<close> using infer_v_conspI by auto 
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile> v \<Rightarrow> tv\<close> using infer_v_conspI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>'  \<turnstile> tv \<lesssim> tc[bv::=b]\<^sub>\<tau>\<^sub>b\<close> using infer_v_conspI subtype_weakening by auto
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>', v, b)\<close> using infer_v_conspI by auto
+    show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>', v, b)\<close> using infer_v_conspI by auto
+    show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using infer_v_conspI by auto
+  qed
+qed
+
+lemma check_v_g_weakening:
+  fixes e::e and \<Gamma>'::\<Gamma>
+  assumes "\<Theta>;  \<B> ; \<Gamma> \<turnstile> v \<Leftarrow> \<tau>" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" 
+  shows   "\<Theta>;  \<B> ; \<Gamma>' \<turnstile> v \<Leftarrow> \<tau>"
+  using subtype_weakening infer_v_g_weakening check_v_elims  check_v_subtypeI assms by metis
+
+lemma infer_e_g_weakening:
+  fixes e::e and \<Gamma>'::\<Gamma>
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<Theta> ;  \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'"
+  shows   "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>'; \<Delta> \<turnstile> e \<Rightarrow> \<tau>"
+  using assms proof(nominal_induct \<tau> avoiding: \<Gamma>'  rule: infer_e.strong_induct)
+  case (infer_e_valI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v \<tau>)
+  then show ?case using infer_v_g_weakening wf_weakening infer_e.intros by metis
+next
+  case (infer_e_plusI \<Theta>  \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+
+  obtain z'::x where z': "atom z' \<sharp> v1 \<and> atom z' \<sharp> v2 \<and> atom z' \<sharp> \<Gamma>'" using obtain_fresh fresh_prod3 by metis
+  moreover hence  *:"\<lbrace> z3 : B_int  | CE_val (V_var z3)  ==  CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace> = (\<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_op Plus [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>)" 
+    using infer_e_plusI type_e_eq ce.fresh fresh_e_opp by auto
+
+  have "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_op Plus v1 v2 \<Rightarrow> \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_op Plus  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_plusI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_plusI by auto
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_int  | c1 \<rbrace>\<close> using infer_v_g_weakening infer_e_plusI by auto
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_int  | c2 \<rbrace>\<close> using infer_v_g_weakening infer_e_plusI by auto
+    show \<open>atom z' \<sharp> AE_op Plus v1 v2\<close> using z'  by auto
+    show \<open>atom z' \<sharp> \<Gamma>'\<close> using z' by auto
+  qed
+  thus ?case using * by metis
+
+next
+  case (infer_e_leqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+  obtain z'::x where z': "atom z' \<sharp> v1 \<and> atom z' \<sharp> v2 \<and> atom z' \<sharp> \<Gamma>'" using obtain_fresh fresh_prod3 by metis
+
+  moreover hence  *:"\<lbrace> z3 : B_bool  | CE_val (V_var z3)  ==  CE_op LEq  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace> = (\<lbrace> z' : B_bool  | CE_val (V_var z')  ==  CE_op LEq  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>)" 
+    using infer_e_leqI type_e_eq ce.fresh fresh_e_opp by auto
+
+  have "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_op LEq v1 v2 \<Rightarrow> \<lbrace> z' : B_bool  | CE_val (V_var z')  ==  CE_op LEq  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_leqI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_leqI by auto
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_int  | c1 \<rbrace>\<close> using infer_v_g_weakening infer_e_leqI by auto
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_int  | c2 \<rbrace>\<close> using infer_v_g_weakening infer_e_leqI by auto
+    show \<open>atom z' \<sharp> AE_op LEq v1 v2\<close> using z'  by auto
+    show \<open>atom z' \<sharp> \<Gamma>'\<close> using z' by auto
+  qed
+  thus ?case using * by metis
+next
+  case (infer_e_eqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 bb c1 v2 z2 c2 z3)
+  obtain z'::x where z': "atom z' \<sharp> v1 \<and> atom z' \<sharp> v2 \<and> atom z' \<sharp> \<Gamma>'" using obtain_fresh fresh_prod3 by metis
+
+  moreover hence  *:"\<lbrace> z3 : B_bool  | CE_val (V_var z3)  ==  CE_op Eq  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace> = (\<lbrace> z' : B_bool  | CE_val (V_var z')  ==  CE_op Eq  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>)" 
+    using infer_e_eqI type_e_eq ce.fresh fresh_e_opp by auto
+
+  have "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_op Eq v1 v2 \<Rightarrow> \<lbrace> z' : B_bool  | CE_val (V_var z')  ==  CE_op Eq  [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_eqI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using infer_e_eqI by auto
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : bb  | c1 \<rbrace>\<close> using infer_v_g_weakening infer_e_eqI by auto
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : bb  | c2 \<rbrace>\<close> using infer_v_g_weakening infer_e_eqI by auto
+    show \<open>atom z' \<sharp> AE_op Eq v1 v2\<close> using z'  by auto
+    show \<open>atom z' \<sharp> \<Gamma>'\<close> using z' by auto
+    show "bb \<in> {B_bool, B_int, B_unit}" using infer_e_eqI by auto
+  qed
+  thus ?case using * by metis
+next
+  case (infer_e_appI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau>' s' v \<tau>)
+  show ?case proof 
+    show "\<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> "  using wf_weakening infer_e_appI by auto
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>"   using wf_weakening infer_e_appI by auto
+    show "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau>' s'))) = lookup_fun \<Phi> f"  using wf_weakening infer_e_appI by auto
+    show "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Leftarrow> \<lbrace> x : b  | c \<rbrace>"  using wf_weakening infer_e_appI check_v_g_weakening by auto
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, v, \<tau>)"  using wf_weakening infer_e_appI by auto
+    show "\<tau>'[x::=v]\<^sub>v = \<tau>"  using wf_weakening infer_e_appI by auto
+  qed
+
+next
+  case (infer_e_appPI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>' s' v \<tau>)
+
+  hence *:"\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> AE_appP f b' v \<Rightarrow> \<tau>" using Typing.infer_e_appPI by auto
+
+  obtain x'::x where x':"atom x' \<sharp> (s', c, \<tau>', (\<Gamma>',v,\<tau>)) \<and> (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau>' s'))) =  (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x' b ((x' \<leftrightarrow> x) \<bullet> c) ((x' \<leftrightarrow> x) \<bullet> \<tau>') ((x' \<leftrightarrow> x) \<bullet> s'))))" 
+    using obtain_fresh_fun_def[of s' c \<tau>' "(\<Gamma>',v,\<tau>)" f x b]
+    by (metis fun_def.eq_iff fun_typ_q.eq_iff(2))
+
+  hence **: " \<lbrace> x : b  | c \<rbrace> = \<lbrace> x' : b  | (x' \<leftrightarrow> x) \<bullet> c \<rbrace>" 
+    using fresh_PairD(1) fresh_PairD(2) type_eq_flip by blast
+  have "atom x' \<sharp> \<Gamma>" using x' infer_e_appPI fresh_weakening fresh_Pair by metis
+
+  show ?case proof(rule Typing.infer_e_appPI[where x=x' and bv=bv and b=b and c="(x' \<leftrightarrow> x) \<bullet> c" and \<tau>'="(x' \<leftrightarrow> x) \<bullet> \<tau>'"and s'="((x' \<leftrightarrow> x) \<bullet> s')"])
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_appPI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wf_weakening infer_e_appPI by auto
+    show "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b'" using infer_e_appPI by auto
+    show "Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x' b ((x' \<leftrightarrow> x) \<bullet> c) ((x' \<leftrightarrow> x) \<bullet> \<tau>') ((x' \<leftrightarrow> x) \<bullet> s')))) = lookup_fun \<Phi> f" using x' infer_e_appPI by argo
+    show "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Leftarrow> \<lbrace> x' : b[bv::=b']\<^sub>b  | ((x' \<leftrightarrow> x) \<bullet> c)[bv::=b']\<^sub>b \<rbrace>" using **
+        \<tau>.eq_iff check_v_g_weakening infer_e_appPI.hyps infer_e_appPI.prems(1) infer_e_appPI.prems subst_defs
+        subst_tb.simps by metis
+    show "atom x' \<sharp> \<Gamma>'" using x' fresh_prodN by metis
+
+    have "atom x \<sharp> (v, \<tau>) \<and> atom x' \<sharp> (v, \<tau>)" using x' infer_e_fresh[OF *] e.fresh(2) fresh_Pair infer_e_appPI \<open>atom x' \<sharp> \<Gamma>\<close> e.fresh by metis
+    moreover then have "((x' \<leftrightarrow> x) \<bullet> \<tau>')[bv::=b']\<^sub>\<tau>\<^sub>b = (x' \<leftrightarrow> x) \<bullet> (\<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b)" using  subst_b_x_flip 
+      by (metis subst_b_\<tau>_def)
+    ultimately show "((x' \<leftrightarrow> x) \<bullet> \<tau>')[bv::=b']\<^sub>b[x'::=v]\<^sub>v = \<tau>" 
+      using infer_e_appPI subst_tv_flip subst_defs by metis
+
+    show "atom bv \<sharp>  (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, b', v, \<tau>)" using infer_e_appPI fresh_prodN by metis
+  qed
+
+next
+  case (infer_e_fstI \<Theta>  \<B> \<Gamma> \<Delta> \<Phi> v z'' b1 b2 c z)
+
+  obtain z'::x where  *: "atom z' \<sharp> \<Gamma>' \<and> atom z' \<sharp> v \<and> atom z' \<sharp> c" using obtain_fresh_z fresh_Pair by metis 
+  hence **:"\<lbrace> z : b1  | CE_val (V_var z)  ==  CE_fst [v]\<^sup>c\<^sup>e  \<rbrace> =  \<lbrace> z' : b1  | CE_val (V_var z')  ==  CE_fst [v]\<^sup>c\<^sup>e  \<rbrace>"
+    using  type_e_eq infer_e_fstI v.fresh e.fresh ce.fresh obtain_fresh_z fresh_Pair by metis
+
+  have "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_fst v \<Rightarrow> \<lbrace> z' : b1  | CE_val (V_var z')  ==  CE_fst [v]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta> ;  \<B> ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_fstI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wf_weakening infer_e_fstI by auto
+    show "\<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v \<Rightarrow> \<lbrace> z'' : B_pair b1 b2  |  c \<rbrace>" using infer_v_g_weakening infer_e_fstI  by metis
+    show "atom z' \<sharp> AE_fst v" using * ** e.supp by auto
+    show "atom z' \<sharp> \<Gamma>'" using * by auto
+  qed
+  thus ?case using * ** by metis
+next
+  case (infer_e_sndI \<Theta>  \<B> \<Gamma> \<Delta> \<Phi> v z'' b1 b2 c z)
+
+  obtain z'::x where  *: "atom z' \<sharp> \<Gamma>' \<and> atom z' \<sharp> v \<and> atom z' \<sharp> c"  using obtain_fresh_z fresh_Pair by metis 
+  hence **:"\<lbrace> z : b2  | CE_val (V_var z)  ==  CE_snd [v]\<^sup>c\<^sup>e  \<rbrace> =  \<lbrace> z' : b2  | CE_val (V_var z')  ==  CE_snd [v]\<^sup>c\<^sup>e  \<rbrace>"
+    using  type_e_eq infer_e_sndI e.fresh ce.fresh obtain_fresh_z fresh_Pair by metis
+
+  have "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_snd v \<Rightarrow> \<lbrace> z' : b2  | CE_val (V_var z')  ==  CE_snd [v]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta> ;  \<B> ;\<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_sndI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wf_weakening infer_e_sndI by auto
+    show "\<Theta> ;  \<B> ; \<Gamma>'  \<turnstile> v \<Rightarrow> \<lbrace> z'' : B_pair b1 b2  |  c \<rbrace>" using infer_v_g_weakening infer_e_sndI    by metis
+    show "atom z' \<sharp> AE_snd v" using * e.supp by auto
+    show "atom z' \<sharp> \<Gamma>'" using * by auto
+  qed
+  thus ?case using ** by metis
+next
+  case (infer_e_lenI \<Theta>  \<B> \<Gamma> \<Delta> \<Phi> v z'' c z)
+
+  obtain z'::x where  *: "atom z' \<sharp> \<Gamma>' \<and> atom z' \<sharp> v \<and> atom z' \<sharp> c"  using obtain_fresh_z fresh_Pair by metis 
+  hence **:"\<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len [v]\<^sup>c\<^sup>e  \<rbrace> =  \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_len [v]\<^sup>c\<^sup>e  \<rbrace>"
+    using  type_e_eq infer_e_lenI e.fresh ce.fresh obtain_fresh_z fresh_Pair by metis
+
+  have "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_len v \<Rightarrow> \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_len [v]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_lenI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wf_weakening infer_e_lenI by auto
+    show "\<Theta> ;  \<B> ; \<Gamma>' \<turnstile> v \<Rightarrow> \<lbrace> z'' : B_bitvec  | c \<rbrace>" using infer_v_g_weakening infer_e_lenI    by metis
+    show "atom z' \<sharp> AE_len v" using * e.supp by auto
+    show "atom z' \<sharp> \<Gamma>'" using * by auto
+  qed
+  thus ?case using * ** by metis
+next
+  case (infer_e_mvarI \<Theta> \<Gamma> \<Phi> \<Delta> u \<tau>)
+  then show ?case using  wf_weakening infer_e.intros by metis
+next
+  case (infer_e_concatI \<Theta>  \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
+
+  obtain z'::x where  *: "atom z' \<sharp> \<Gamma>' \<and> atom z' \<sharp> v1 \<and> atom z' \<sharp> v2" using obtain_fresh_z fresh_Pair by metis 
+  hence **:"\<lbrace> z3 : B_bitvec  | CE_val (V_var z3)  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e \<rbrace> =  \<lbrace> z' : B_bitvec  | CE_val (V_var z')  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e \<rbrace>"
+    using  type_e_eq infer_e_concatI e.fresh ce.fresh obtain_fresh_z fresh_Pair by metis
+
+  have "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> AE_concat v1 v2 \<Rightarrow> \<lbrace> z' : B_bitvec  | CE_val (V_var z')  ==  CE_concat [v1]\<^sup>c\<^sup>e [v2]\<^sup>c\<^sup>e  \<rbrace>" proof
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wf_weakening infer_e_concatI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wf_weakening infer_e_concatI by auto
+    show "\<Theta> ;  \<B> ; \<Gamma>' \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_bitvec  |  c1 \<rbrace>" using infer_v_g_weakening infer_e_concatI    by metis
+    show "\<Theta> ;  \<B> ; \<Gamma>' \<turnstile> v2 \<Rightarrow> \<lbrace> z2 : B_bitvec  |  c2 \<rbrace>" using infer_v_g_weakening infer_e_concatI    by metis
+    show "atom z' \<sharp> AE_concat v1 v2" using * e.supp by auto
+    show "atom z' \<sharp> \<Gamma>'" using * by auto
+  qed
+  thus ?case using * ** by metis
+next
+  case (infer_e_splitI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
+  show ?case proof
+    show "\<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta>" using infer_e_splitI wf_weakening by auto
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using infer_e_splitI wf_weakening by auto
+    show "\<Theta>; \<B>; \<Gamma>' \<turnstile> v1 \<Rightarrow> \<lbrace> z1 : B_bitvec  | c1 \<rbrace>" using infer_v_g_weakening infer_e_splitI by metis
+    show "\<Theta>; \<B>; \<Gamma>'  \<turnstile> v2 \<Leftarrow> \<lbrace> z2 : B_int  | [ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e 
+                  AND  [ leq [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e [| [ v1 ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>" 
+      using check_v_g_weakening infer_e_splitI by metis
+    show "atom z1 \<sharp> AE_split v1 v2" using infer_e_splitI by auto
+    show "atom z1 \<sharp> \<Gamma>'" using infer_e_splitI by auto
+    show "atom z2 \<sharp> AE_split v1 v2" using infer_e_splitI by auto
+    show "atom z2 \<sharp> \<Gamma>'" using infer_e_splitI by auto
+    show "atom z3 \<sharp> AE_split v1 v2" using infer_e_splitI by auto
+    show "atom z3 \<sharp> \<Gamma>'" using infer_e_splitI by auto
+  qed
+qed
+
+text \<open> Special cases proved explicitly, other cases at the end with method + \<close>
+
+lemma infer_e_d_weakening:
+  fixes e::e
+  assumes "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> e \<Rightarrow> \<tau>" and "setD \<Delta> \<subseteq> setD \<Delta>'" and "wfD \<Theta>  \<B> \<Gamma> \<Delta>'" 
+  shows   "\<Theta>; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta>' \<turnstile> e \<Rightarrow> \<tau>"
+  using assms by(nominal_induct \<tau> avoiding: \<Delta>' rule: infer_e.strong_induct,auto simp add:infer_e.intros)
+
+lemma  wfG_x_fresh_in_v_simple:
+  fixes x::x and v :: v
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" and "atom x \<sharp> \<Gamma>" 
+  shows "atom x \<sharp> v"
+  using wfV_x_fresh infer_v_wf assms by metis
+
+lemma check_s_g_weakening:
+  fixes v::v and s::s and cs::branch_s and x::x and c::c and b::b and \<Gamma>'::\<Gamma> and \<Theta>::\<Theta> and css::branch_list
+  shows  "check_s \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s  t \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> check_s \<Theta> \<Phi> \<B> \<Gamma>' \<Delta>  s   t"  and 
+    "check_branch_s \<Theta> \<Phi> \<B> \<Gamma> \<Delta>  tid cons const v cs t \<Longrightarrow>  toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'  \<Longrightarrow> check_branch_s \<Theta> \<Phi> \<B> \<Gamma>' \<Delta> tid cons const v cs t" and
+    "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta>  tid dclist v css t \<Longrightarrow>  toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'  \<Longrightarrow> check_branch_list \<Theta> \<Phi> \<B> \<Gamma>' \<Delta> tid dclist v css t"
+proof(nominal_induct t and t and t avoiding: \<Gamma>'   rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_valI \<Theta> \<B> \<Gamma> \<Delta>' \<Phi> v \<tau>' \<tau>)
+  then show ?case using Typing.check_valI infer_v_g_weakening wf_weakening subtype_weakening  by metis
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  hence xf:"atom x \<sharp> \<Gamma>'"  by metis
+  show ?case proof
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, e, \<tau>)" using check_letI using fresh_prod4 xf by metis
+    show "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> e \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" using infer_e_g_weakening check_letI by metis
+    show "atom z \<sharp> (x, \<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, e, \<tau>, s)" 
+      by(unfold fresh_prodN,auto simp add: check_letI fresh_prodN) 
+    have "toSet ((x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet ((x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>')" using check_letI toSet.simps 
+      by (metis Un_commute Un_empty_right Un_insert_right insert_mono)
+    moreover hence "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f ((x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>')" using check_letI wfG_cons_weakening check_s_wf by metis
+    ultimately show "\<Theta> ; \<Phi> ; \<B> ; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>' ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" using check_letI by metis
+  qed
+next
+  case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2)
+  show ?case proof
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, t, s1, \<tau>)" using check_let2I using fresh_prod4 by auto
+    show "\<Theta> ; \<Phi> ; \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> s1 \<Leftarrow> t" using check_let2I by metis
+    have "toSet ((x, b_of t, c_of t x) #\<^sub>\<Gamma> G) \<subseteq> toSet ((x, b_of t, c_of t x ) #\<^sub>\<Gamma> \<Gamma>')" using check_let2I by auto
+    moreover hence "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f ((x, b_of t, c_of t x) #\<^sub>\<Gamma> \<Gamma>')" using check_let2I wfG_cons_weakening check_s_wf by metis
+    ultimately show "\<Theta> ; \<Phi> ; \<B> ; (x, b_of t, c_of t x) #\<^sub>\<Gamma> \<Gamma>' ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>" using check_let2I by metis
+  qed
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' v cs \<tau> css dclist)
+  thus ?case using Typing.check_branch_list_consI by metis
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' v cs \<tau> dclist)
+  thus ?case using Typing.check_branch_list_finalI by metis
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v  s)
+  show ?case proof
+    show "\<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> " using  wf_weakening2(6) check_branch_s_branchI by metis
+    show "\<turnstile>\<^sub>w\<^sub>f \<Theta>" using check_branch_s_branchI by auto
+    show "\<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f \<tau> "  using check_branch_s_branchI wfT_weakening \<open>wfG  \<Theta> \<B> \<Gamma>'\<close> by presburger
+
+    show "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f const " using check_branch_s_branchI by auto
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, tid, cons, const, v, \<tau>)" using check_branch_s_branchI by auto
+    have "toSet ((x, b_of const, CE_val v  ==  CE_val(V_cons tid cons (V_var x))   AND  c_of const x) #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet ((x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x)) AND  c_of const x) #\<^sub>\<Gamma> \<Gamma>')" 
+      using check_branch_s_branchI by auto
+    moreover hence "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f ((x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x))   AND  c_of const x ) #\<^sub>\<Gamma> \<Gamma>')" 
+      using check_branch_s_branchI wfG_cons_weakening check_s_wf by metis
+    ultimately show "\<Theta> ; \<Phi> ; \<B> ; (x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x))   AND  c_of const x ) #\<^sub>\<Gamma> \<Gamma>' ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" 
+      using check_branch_s_branchI  using fresh_dom_free by auto
+  qed
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  show ?case proof
+    show \<open>atom z \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, v, s1, s2, \<tau>)\<close> using fresh_prodN check_ifI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>\<close> using check_v_g_weakening check_ifI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_true)   IMP  c_of \<tau> z  \<rbrace>\<close> using  check_ifI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma>' ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_false)   IMP  c_of \<tau> z  \<rbrace>\<close> using  check_ifI by auto
+  qed
+next 
+  case (check_whileI \<Delta> G P s1 z s2 \<tau>')
+  then show ?case using check_s_check_branch_s_check_branch_list.intros check_v_g_weakening subtype_weakening wf_weakening  
+    by (meson infer_v_g_weakening)
+next
+  case (check_seqI \<Delta> G P s1 z s2 \<tau>)
+  then show ?case using check_s_check_branch_s_check_branch_list.intros check_v_g_weakening subtype_weakening wf_weakening 
+    by (meson infer_v_g_weakening)
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  thus ?case  using check_v_g_weakening check_s_check_branch_s_check_branch_list.intros by auto
+next
+  case (check_assignI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau> v z \<tau>')
+  show ?case proof 
+    show \<open>\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_assignI by auto
+    show \<open>\<Theta>; \<B>;  \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta>\<close> using check_assignI  wf_weakening by auto
+    show \<open>(u, \<tau>) \<in> setD \<Delta>\<close> using check_assignI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>'  \<turnstile> v \<Leftarrow> \<tau>\<close> using check_assignI  check_v_g_weakening by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>'  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'\<close> using  subtype_weakening check_assignI by auto
+  qed
+next
+  case (check_caseI \<Delta> \<Gamma> \<Theta> dclist cs \<tau> tid v z)
+
+  then show ?case using check_s_check_branch_s_check_branch_list.intros check_v_g_weakening subtype_weakening wf_weakening
+    by (meson infer_v_g_weakening)
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  show ?case proof
+    show \<open>atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>', \<Delta>, c, \<tau>, s)\<close> using check_assertI by auto
+
+    have " \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>" using check_assertI check_s_wf by metis
+    hence *:" \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>'"   using wfG_cons_weakening check_assertI by metis
+    moreover have "toSet ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>')" using check_assertI by auto
+    thus  \<open> \<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>' ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> using check_assertI(11) [OF _ *] by auto
+
+    show \<open>\<Theta>; \<B>; \<Gamma>'  \<Turnstile> c \<close> using check_assertI valid_weakening by metis
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_assertI wf_weakening by metis
+  qed
+qed
+
+lemma  wfG_xa_fresh_in_v:
+  fixes c::c and \<Gamma>::\<Gamma> and G::\<Gamma> and v::v and xa::x
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" and "G=( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" and "atom xa \<sharp> G" and "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f G"
+  shows "atom xa \<sharp> v"
+proof -
+  have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau>"  using infer_v_wf assms by metis
+  hence "supp v \<subseteq> atom_dom \<Gamma>  \<union> supp \<B>" using wfV_supp by simp
+  moreover have  "atom xa \<notin> atom_dom G"  
+    using assms wfG_atoms_supp_eq[OF assms(4)] fresh_def by metis
+  ultimately show ?thesis using fresh_def
+    using assms infer_v_wf wfG_atoms_supp_eq
+      fresh_GCons  fresh_append_g subsetCE
+    by (metis wfG_x_fresh_in_v_simple)
+qed
+
+lemma fresh_z_subst_g:
+  fixes G::\<Gamma>
+  assumes "atom z' \<sharp> (x,v)" and \<open>atom z' \<sharp> G\<close>
+  shows "atom z' \<sharp> G[x::=v]\<^sub>\<Gamma>\<^sub>v"
+proof - 
+  have "atom z' \<sharp> v" using assms fresh_prod2 by auto
+  thus ?thesis  using fresh_subst_gv assms by metis
+qed
+
+lemma  wfG_xa_fresh_in_subst_v:
+  fixes c::c and v::v and x::x  and \<Gamma>::\<Gamma> and G::\<Gamma> and xa::x
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile> v \<Rightarrow> \<tau>" and "G=( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>)" and "atom xa \<sharp> G" and "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f G"
+  shows "atom xa \<sharp> (subst_gv G x v)"
+proof -
+  have "atom xa \<sharp> v" using wfG_xa_fresh_in_v assms by metis
+  thus ?thesis using fresh_subst_gv assms by metis
+qed
+
+subsection \<open>Weakening Immutable Variable Context\<close>
+
+declare check_s_check_branch_s_check_branch_list.intros[simp]
+declare check_s_check_branch_s_check_branch_list.intros[intro]
+
+lemma check_s_d_weakening:
+  fixes s::s and v::v and cs::branch_s and css::branch_list
+  shows  " \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile> s \<Leftarrow> \<tau> \<Longrightarrow>  setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>  wfD  \<Theta> \<B> \<Gamma> \<Delta>' \<Longrightarrow> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta>' \<turnstile> s \<Leftarrow> \<tau>" and 
+    "check_branch_s \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau> \<Longrightarrow>  setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>  wfD  \<Theta> \<B> \<Gamma> \<Delta>' \<Longrightarrow> check_branch_s \<Theta> \<Phi> \<B> \<Gamma> \<Delta>' tid cons const v cs \<tau>" and 
+    "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow>  setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>  wfD  \<Theta> \<B> \<Gamma> \<Delta>' \<Longrightarrow> check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta>' tid dclist v css \<tau>"
+proof(nominal_induct \<tau> and \<tau> and \<tau> avoiding: \<Delta>'   arbitrary: v rule: check_s_check_branch_s_check_branch_list.strong_induct)
+  case (check_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v \<tau>' \<tau>)
+  then show ?case using check_s_check_branch_s_check_branch_list.intros by blast
+next
+  case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
+  show ?case proof
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>', e, \<tau>)"  using check_letI by auto
+    show "atom z \<sharp> (x, \<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>', e, \<tau>, s)" using check_letI by auto
+    show "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta>'  \<turnstile> e \<Rightarrow> \<lbrace> z : b  | c \<rbrace>"  using check_letI infer_e_d_weakening by auto
+    have "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" using check_letI check_s_wf by metis
+    moreover have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using check_letI check_s_wf by metis
+    ultimately have "\<Theta>; \<B>; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'"  using wf_weakening2(6)  toSet.simps by fast
+    thus  "\<Theta> ; \<Phi> ; \<B> ; (x, b, c[z::=V_var x]\<^sub>v) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>'  \<turnstile> s \<Leftarrow> \<tau>"   using check_letI by simp
+  qed
+next
+  case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v  s)
+  moreover have "\<Theta> ;\<B> \<turnstile>\<^sub>w\<^sub>f (x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x))   AND  c_of const x ) #\<^sub>\<Gamma> \<Gamma>" 
+    using check_s_wf[OF check_branch_s_branchI(16) ] by metis
+  moreover hence " \<Theta> ;\<B> ; (x, b_of const, CE_val v  ==  CE_val (V_cons tid cons (V_var x))   AND  c_of const x ) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" 
+    using wf_weakening2(6) check_branch_s_branchI by fastforce
+  ultimately show ?case 
+    using  check_s_check_branch_s_check_branch_list.intros by simp
+next
+  case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> css)
+  then show ?case using check_s_check_branch_s_check_branch_list.intros  by meson
+next
+  case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
+  then show ?case using check_s_check_branch_s_check_branch_list.intros  by meson
+next
+  case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
+  show ?case proof
+    show \<open>atom z \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>', v, s1, s2, \<tau>)\<close> using fresh_prodN check_ifI by auto
+    show \<open>\<Theta>; \<B>; \<Gamma>  \<turnstile> v \<Leftarrow> \<lbrace> z : B_bool  | TRUE \<rbrace>\<close> using  check_ifI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta>'  \<turnstile> s1 \<Leftarrow> \<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_true)   IMP  c_of \<tau> z  \<rbrace>\<close> using  check_ifI by auto
+    show \<open> \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta>'  \<turnstile> s2 \<Leftarrow> \<lbrace> z : b_of \<tau>  | CE_val v  ==  CE_val (V_lit L_false)   IMP  c_of \<tau> z  \<rbrace>\<close> using  check_ifI by auto
+  qed
+next
+  case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
+  show ?case proof
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>', c, \<tau>,s)" using fresh_prodN check_assertI by auto
+    show *:" \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' " using check_assertI by auto
+    hence  "\<Theta>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' " using wf_weakening2(6)[OF *, of " (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>"] check_assertI check_s_wf toSet.simps by auto
+    thus  "\<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>'  \<turnstile> s \<Leftarrow> \<tau>" 
+      using check_assertI(11)[OF \<open>setD \<Delta> \<subseteq> setD \<Delta>'\<close>] by simp
+        (* wf_weakening2(6) check_s_wf check_assertI *)
+    show "\<Theta>; \<B>; \<Gamma>  \<Turnstile> c " using fresh_prodN check_assertI by auto
+
+  qed
+next
+  case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2)
+  show ?case proof
+    show "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, G, \<Delta>', t , s1, \<tau>)"  using check_let2I by auto
+
+    show "\<Theta> ; \<Phi> ; \<B> ; G ; \<Delta>'  \<turnstile> s1 \<Leftarrow> t"  using check_let2I infer_e_d_weakening by auto
+    have "\<Theta>; \<B>; (x, b_of t, c_of t x ) #\<^sub>\<Gamma> G \<turnstile>\<^sub>w\<^sub>f \<Delta>'"  using check_let2I wf_weakening2(6) check_s_wf by fastforce 
+    thus  "\<Theta> ; \<Phi> ; \<B> ; (x, b_of t, c_of t x) #\<^sub>\<Gamma> G ; \<Delta>'  \<turnstile> s2 \<Leftarrow> \<tau>"   using check_let2I by simp
+  qed
+next
+  case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
+  show ?case proof
+    show "atom u \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>', \<tau>', v, \<tau>)" using check_varI by auto
+    show "\<Theta>; \<B>; \<Gamma>  \<turnstile> v \<Leftarrow> \<tau>'" using check_varI by auto
+    have "setD ((u, \<tau>') #\<^sub>\<Delta>\<Delta>) \<subseteq> setD ((u, \<tau>') #\<^sub>\<Delta>\<Delta>')" using setD.simps check_varI by auto
+    moreover have "u \<notin> fst ` setD \<Delta>'" using check_varI(1) setD.simps fresh_DCons   by (simp add: fresh_d_not_in)
+    moreover hence "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f (u, \<tau>') #\<^sub>\<Delta>\<Delta>' " using wfD_cons  fresh_DCons setD.simps check_varI check_v_wf  by metis
+    ultimately show   "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; (u, \<tau>') #\<^sub>\<Delta>\<Delta>'  \<turnstile> s \<Leftarrow> \<tau>" using check_varI by auto
+  qed
+next
+  case (check_assignI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau> v z \<tau>')
+  moreover hence "(u, \<tau>) \<in> setD \<Delta>'" by auto
+  ultimately show ?case using Typing.check_assignI by simp
+next
+  case (check_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>')
+  then show ?case using check_s_check_branch_s_check_branch_list.intros  by meson
+next
+  case (check_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>)
+  then show ?case using check_s_check_branch_s_check_branch_list.intros  by meson
+next
+  case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> z)
+  then show ?case using check_s_check_branch_s_check_branch_list.intros  by meson
+
+qed
+
+lemma valid_ce_eq:
+  fixes v::v and ce2::ce
+  assumes "ce1 = ce2[x::=v]\<^sub>c\<^sub>e\<^sub>v" and "wfV \<Theta>  \<B> GNil v b" and  "wfCE \<Theta>  \<B>  ((x, b, TRUE) #\<^sub>\<Gamma> GNil) ce2 b'" and "wfCE \<Theta>  \<B> GNil ce1 b'"
+  shows \<open>\<Theta>; \<B>; (x, b, ([[x ]\<^sup>v]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e )) #\<^sub>\<Gamma> GNil  \<Turnstile> ce1  ==  ce2 \<close>
+  unfolding valid.simps proof
+  have wfg: "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil" 
+    using wfG_cons1I wfG_nilI wfX_wfY assms wf_intros 
+    by (meson fresh_GNil wfC_e_eq wfG_intros2)
+
+  show wf: \<open>\<Theta>; \<B>; (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f ce1  ==  ce2  \<close> 
+    apply(rule wfC_eqI[where b=b'])
+    using wfg toSet.simps assms wfCE_weakening apply simp
+
+    using wfg assms wf_replace_inside1(8) assms 
+    using wfC_trueI wf_trans(8)  by auto
+
+  show \<open>\<forall>i. ((\<Theta> ; (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil \<turnstile> i) \<and>  (i \<Turnstile> (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil)  \<longrightarrow>
+             (i \<Turnstile> (ce1  ==  ce2 )))\<close> proof(rule+,goal_cases)
+    fix i
+    assume as:"\<Theta> ; (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil \<turnstile> i \<and>  i \<Turnstile> (x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil"
+    have 1:"wfV \<Theta>  \<B> ((x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil) v b" 
+      using wf_weakening assms append_g.simps toSet.simps wf wfX_wfY 
+      by (metis empty_subsetI)
+    hence "\<exists>s. i \<lbrakk> v \<rbrakk> ~ s"  using eval_v_exist[OF _ 1] as by auto
+    then obtain s where iv:"i\<lbrakk> v \<rbrakk> ~ s" ..
+
+    hence ix:"i x = Some s" proof -
+      have "i \<Turnstile> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e" using is_satis_g.simps as by auto
+      hence "i \<lbrakk> [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e \<rbrakk> ~ True" using is_satis.simps by auto
+      hence "i \<lbrakk>  [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e \<rbrakk> ~ s"  using  
+          iv eval_e_elims
+        by (metis eval_c_elims(7) eval_e_uniqueness eval_e_valI) 
+      thus ?thesis using eval_v_elims(2) eval_e_elims(1) by metis
+    qed
+
+    have 1:"wfCE \<Theta>  \<B> ((x, b, [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil) ce1 b'" 
+      using wfCE_weakening assms append_g.simps toSet.simps wf wfX_wfY 
+      by (metis empty_subsetI)
+    hence "\<exists>s1. i \<lbrakk> ce1 \<rbrakk> ~ s1"  using eval_e_exist assms as by auto
+    then obtain s1 where s1: "i\<lbrakk>ce1\<rbrakk> ~ s1" ..
+
+    moreover have "i\<lbrakk> ce2 \<rbrakk> ~ s1" proof -
+      have "i\<lbrakk> ce2[x::=v]\<^sub>c\<^sub>e\<^sub>v \<rbrakk> ~ s1" using assms s1 by auto
+      moreover have "ce1 = ce2[x::=v]\<^sub>c\<^sub>e\<^sub>v" using subst_v_ce_def assms subst_v_simple_commute by auto
+      ultimately have "i(x \<mapsto> s) \<lbrakk> ce2 \<rbrakk> ~ s1" 
+        using ix subst_e_eval_v[of i ce1 s1 "ce2[z::=[ x ]\<^sup>v]\<^sub>v" x v s] iv s1 by auto
+      moreover have "i(x \<mapsto> s) = i" using ix by auto
+      ultimately show ?thesis by auto
+    qed
+    ultimately show "i \<lbrakk> ce1  ==  ce2 \<rbrakk> ~ True " using eval_c_eqI by metis
+  qed
+qed
+
+
+lemma check_v_top:
+  fixes v::v
+  assumes  "\<Theta>; \<B>; GNil  \<turnstile> v \<Leftarrow> \<tau>" and "ce1 = ce2[z::=v]\<^sub>c\<^sub>e\<^sub>v" and  "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b_of \<tau>  | ce1 == ce2  \<rbrace>"    
+    and "supp ce1 \<subseteq> supp  \<B>"
+  shows "\<Theta>; \<B>; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of \<tau>  | ce1 == ce2  \<rbrace>"      
+proof -
+  obtain t where t: "\<Theta>; \<B>; GNil  \<turnstile> v \<Rightarrow> t \<and> \<Theta>; \<B>; GNil  \<turnstile> t \<lesssim> \<tau>" 
+    using assms check_v_elims by metis
+
+  then obtain z' and b' where *:"t = \<lbrace> z' : b'  | [ [ z' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e  \<rbrace> \<and> atom z' \<sharp> v \<and> atom z' \<sharp> (\<Theta>, \<B>,GNil)"
+    using assms  infer_v_form by metis
+  have beq: "b_of t = b_of \<tau>" using subtype_eq_base2 b_of.simps t by auto 
+  obtain x::x where xf: \<open>atom x \<sharp> (\<Theta>, \<B>, GNil, z', [ [ z' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e , z, ce1  ==  ce2 )\<close> 
+    using obtain_fresh by metis
+
+  have "\<Theta>; \<B>; (x, b_of \<tau>, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f (ce1[z::=[ x ]\<^sup>v]\<^sub>v  ==  ce2[z::=[ x ]\<^sup>v]\<^sub>v )"
+    using wfT_wfC2[OF assms(3), of x] subst_cv.simps(6) subst_v_c_def subst_v_ce_def fresh_GNil by simp
+
+  then obtain b2 where b2: "\<Theta>; \<B>; (x, b_of t, TRUE) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f ce1[z::=[ x ]\<^sup>v]\<^sub>v : b2 \<and> 
+            \<Theta>; \<B>; (x, b_of t, TRUE) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f ce2[z::=[ x ]\<^sup>v]\<^sub>v : b2" using wfC_elims(3)
+    beq by metis
+
+  from xf have "\<Theta>; \<B>; GNil  \<turnstile> \<lbrace> z' : b_of t  | [ [ z' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e  \<rbrace> \<lesssim>  \<lbrace> z : b_of t  | ce1 == ce2  \<rbrace>" 
+  proof  
+    show \<open> \<Theta>; \<B>; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z' : b_of t  | [ [ z' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e  \<rbrace> \<close> using b_of.simps assms infer_v_wf t * by auto
+    show \<open> \<Theta>; \<B>; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of t  | ce1  ==  ce2  \<rbrace> \<close> using beq assms by auto
+    have \<open>\<Theta>; \<B>; (x, b_of t, ([ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e )) #\<^sub>\<Gamma> GNil  \<Turnstile> (ce1[z::=[ x ]\<^sup>v]\<^sub>v  ==  ce2[z::=[ x ]\<^sup>v]\<^sub>v ) \<close>  
+    proof(rule valid_ce_eq)
+      show \<open>ce1[z::=[ x ]\<^sup>v]\<^sub>v = ce2[z::=[ x ]\<^sup>v]\<^sub>v[x::=v]\<^sub>c\<^sub>e\<^sub>v\<close> proof -
+        have "atom z \<sharp> ce1" using assms fresh_def x_not_in_b_set by fast 
+        hence "ce1[z::=[ x ]\<^sup>v]\<^sub>v = ce1" 
+          using forget_subst_v by auto
+        also have "... = ce2[z::=v]\<^sub>c\<^sub>e\<^sub>v" using assms by auto
+        also have "... = ce2[z::=[ x ]\<^sup>v]\<^sub>v[x::=v]\<^sub>c\<^sub>e\<^sub>v" proof -
+          have "atom x \<sharp> ce2" using  xf fresh_prodN c.fresh by metis
+          thus ?thesis using subst_v_simple_commute subst_v_ce_def by simp
+        qed
+        finally show ?thesis by auto
+      qed
+      show \<open> \<Theta>; \<B>; GNil \<turnstile>\<^sub>w\<^sub>f v : b_of t \<close> using infer_v_wf t by simp
+      show  \<open>  \<Theta>; \<B>; (x, b_of t, TRUE) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f ce2[z::=[ x ]\<^sup>v]\<^sub>v : b2 \<close>  using b2 by auto
+
+      have " \<Theta>; \<B>; (x, b_of t, TRUE) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f ce1[z::=[ x ]\<^sup>v]\<^sub>v : b2" using b2 by auto
+      moreover have "atom x \<sharp> ce1[z::=[ x ]\<^sup>v]\<^sub>v" 
+        using fresh_subst_v_if assms fresh_def 
+        using \<open>\<Theta>; \<B>; GNil \<turnstile>\<^sub>w\<^sub>f v : b_of t\<close> \<open>ce1[z::=[ x ]\<^sup>v]\<^sub>v = ce2[z::=[ x ]\<^sup>v]\<^sub>v[x::=v]\<^sub>c\<^sub>e\<^sub>v\<close> 
+          fresh_GNil subst_v_ce_def wfV_x_fresh by auto
+      ultimately show  \<open>  \<Theta>; \<B>; GNil \<turnstile>\<^sub>w\<^sub>f ce1[z::=[ x ]\<^sup>v]\<^sub>v : b2 \<close> using
+          wf_restrict(8) by force
+    qed
+    moreover have v: "v[z'::=[ x ]\<^sup>v]\<^sub>v\<^sub>v  = v" 
+      using forget_subst assms infer_v_wf wfV_supp x_not_in_b_set 
+      by (simp add: "local.*")
+    ultimately show "\<Theta>; \<B>; (x, b_of t, ([ [ z' ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ v ]\<^sup>c\<^sup>e )[z'::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> (ce1  ==  ce2 )[z::=[ x ]\<^sup>v]\<^sub>v" 
+      unfolding subst_cv.simps subst_v_c_def subst_cev.simps subst_vv.simps
+      using subst_v_ce_def by simp
+  qed
+  thus ?thesis using b_of.simps assms * check_v_subtypeI t b_of.simps subtype_eq_base2 by metis
+qed
+
+end
+
diff --git a/thys/MiniSail/Wellformed.thy b/thys/MiniSail/Wellformed.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/Wellformed.thy
@@ -0,0 +1,581 @@
+(*<*)
+theory Wellformed
+  imports  IVSubst BTVSubst
+begin
+  (*>*)
+
+chapter \<open>Wellformed Terms\<close>
+
+text \<open>We require that expressions and values are well-formed. This includes a notion
+of well-sortedness. We identify a sort with a basic type and
+define the judgement as two clusters of mutually recursive
+inductive predicates. Some of the proofs are across all of the predicates and
+although they seemed at first to be daunting, they have all
+worked out well.\<close>
+
+named_theorems ms_wb "Facts for helping with well-sortedness"
+
+section \<open>Definitions\<close>
+
+inductive wfV :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> v \<Rightarrow> b \<Rightarrow> bool" (" _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ : _ " [50,50,50] 50)  and
+  wfC :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> c \<Rightarrow> bool" (" _ ; _ ; _   \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50)  and         
+  wfG :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> bool" (" _ ; _  \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50) and
+  wfT :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<tau> \<Rightarrow> bool" (" _ ; _ ; _   \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50)  and
+  wfTs :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> (string*\<tau>) list \<Rightarrow> bool" (" _ ; _  ; _ \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50)  and 
+  wfTh :: "\<Theta> \<Rightarrow> bool" ("   \<turnstile>\<^sub>w\<^sub>f _ " [50] 50)  and
+  wfB :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> b \<Rightarrow> bool" (" _ ; _  \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50) and
+  wfCE :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> ce \<Rightarrow> b \<Rightarrow> bool" ("  _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ : _ " [50,50,50] 50) and
+  wfTD :: "\<Theta> \<Rightarrow> type_def \<Rightarrow> bool" (" _ \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50)          
+  where
+
+wfB_intI:  "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_int" 
+| wfB_boolI:  "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_bool" 
+| wfB_unitI:  "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_unit" 
+| wfB_bitvecI:  "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_bitvec" 
+| wfB_pairI:  "\<lbrakk> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b1 ; \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b2 \<rbrakk> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_pair b1 b2" 
+
+| wfB_consI:  "\<lbrakk>
+   \<turnstile>\<^sub>w\<^sub>f \<Theta>; 
+   (AF_typedef s dclist) \<in> set \<Theta> 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_id s"
+
+| wfB_appI:  "\<lbrakk> 
+   \<turnstile>\<^sub>w\<^sub>f \<Theta>; 
+   \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b;
+   (AF_typedef_poly s bv dclist) \<in> set \<Theta> 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_app s b"
+
+| wfV_varI: "\<lbrakk> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> ; Some (b,c) = lookup \<Gamma> x \<rbrakk> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_var x : b"
+| wfV_litI: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_lit l : base_for_lit l"
+
+| wfV_pairI: "\<lbrakk>
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b1 ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : b2 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f (V_pair v1 v2) : B_pair b1 b2"
+
+| wfV_consI: "\<lbrakk>   
+   AF_typedef s dclist \<in> set \<Theta>;
+   (dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist ;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b' 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_cons s dc v : B_id s"
+
+| wfV_conspI: "\<lbrakk>   
+    AF_typedef_poly s bv dclist \<in> set \<Theta>;
+    (dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist ;
+    \<Theta> ;  \<B>  \<turnstile>\<^sub>w\<^sub>f b;
+    atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>, b , v);
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b 
+\<rbrakk> \<Longrightarrow>
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_consp s dc b v : B_app s b"
+
+| wfCE_valI : "\<lbrakk>             
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v  : b 
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val v  : b"
+
+| wfCE_plusI: "\<lbrakk>               
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_int; 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int 
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_op Plus v1 v2 : B_int"
+
+| wfCE_leqI:"\<lbrakk>
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_int; 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int 
+\<rbrakk> \<Longrightarrow>
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op LEq v1 v2 : B_bool"
+
+| wfCE_eqI:"\<lbrakk>
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b; 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : b 
+\<rbrakk> \<Longrightarrow>
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op Eq v1 v2 : B_bool"
+
+| wfCE_fstI: "\<lbrakk>               
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_pair b1 b2  
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_fst v1 : b1"
+
+| wfCE_sndI: "\<lbrakk>             
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_pair b1 b2  
+\<rbrakk> \<Longrightarrow>  
+    \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_snd v1 : b2"
+
+| wfCE_concatI: "\<lbrakk> 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_bitvec ; 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_bitvec 
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_concat v1 v2 : B_bitvec"
+
+| wfCE_lenI: "\<lbrakk>                
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_bitvec 
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_len v1 : B_int"
+
+| wfTI : "\<lbrakk> 
+    atom z \<sharp>  (\<Theta>, \<B>, \<Gamma>) ; 
+    \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b;
+    \<Theta>; \<B> ; (z,b,C_true) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f c 
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>"
+
+| wfC_eqI: "\<lbrakk>  
+                \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f e1  : b ; 
+                 \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f e2  : b  \<rbrakk> \<Longrightarrow> 
+                \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_eq e1 e2" 
+| wfC_trueI: " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow> \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f C_true "
+| wfC_falseI: " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_false "
+
+| wfC_conjI: "\<lbrakk> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c1 ; \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c2 \<rbrakk> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_conj c1 c2"
+| wfC_disjI: "\<lbrakk> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c1 ; \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c2 \<rbrakk> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_disj c1 c2"
+| wfC_notI: "\<lbrakk>  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c1  \<rbrakk> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_not c1"
+| wfC_impI: "\<lbrakk>  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c1 ; 
+                \<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c2 \<rbrakk> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_imp c1 c2"
+
+| wfG_nilI: " \<turnstile>\<^sub>w\<^sub>f \<Theta>  \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f GNil"
+| wfG_cons1I: "\<lbrakk>  c \<notin> { TRUE, FALSE } ; 
+                  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> ; 
+                  atom x \<sharp> \<Gamma> ; 
+                  \<Theta>  ; \<B> ; (x,b,C_true)#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c ; wfB \<Theta> \<B> b  
+               \<rbrakk> \<Longrightarrow>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f ((x,b,c)#\<^sub>\<Gamma>\<Gamma>)"
+| wfG_cons2I: "\<lbrakk>  c \<in> { TRUE, FALSE } ; 
+                  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> ; 
+                  atom x \<sharp> \<Gamma> ;  
+                  wfB \<Theta> \<B> b   
+                \<rbrakk> \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,c)#\<^sub>\<Gamma>\<Gamma>)"
+
+| wfTh_emptyI: " \<turnstile>\<^sub>w\<^sub>f []"
+
+| wfTh_consI: "\<lbrakk>      
+        (name_of_type tdef) \<notin> name_of_type ` set \<Theta> ;
+        \<turnstile>\<^sub>w\<^sub>f \<Theta> ; 
+       \<Theta> \<turnstile>\<^sub>w\<^sub>f  tdef \<rbrakk>  \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f tdef#\<Theta>"
+
+| wfTD_simpleI: "\<lbrakk>
+        \<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f lst
+      \<rbrakk> \<Longrightarrow> 
+        \<Theta> \<turnstile>\<^sub>w\<^sub>f (AF_typedef s lst )"
+
+| wfTD_poly: "\<lbrakk> 
+        \<Theta> ; {|bv|} ; GNil \<turnstile>\<^sub>w\<^sub>f lst 
+       \<rbrakk> \<Longrightarrow>
+      \<Theta> \<turnstile>\<^sub>w\<^sub>f (AF_typedef_poly s bv lst)"
+
+| wfTs_nil: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f []::(string*\<tau>) list"
+| wfTs_cons: "\<lbrakk> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> ; 
+                dc \<notin> fst ` set ts;
+                \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts::(string*\<tau>) list \<rbrakk> \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ((dc,\<tau>)#ts)"
+
+inductive_cases wfC_elims:
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_true"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_false"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_eq e1 e2"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_conj c1 c2"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_disj c1 c2"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_not c1"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f C_imp c1 c2"
+
+inductive_cases wfV_elims:
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_var x : b"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_lit l : b"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_pair v1 v2 : b"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_cons tyid dc v : b"
+  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_consp tyid dc b v : b'"
+
+inductive_cases wfCE_elims:
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val v : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op Plus v1 v2 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op LEq v1 v2 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_fst v1 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_snd v1 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_concat v1 v2 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_len v1 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op opp v1 v2 : b"
+  " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_op Eq v1 v2 : b"
+
+inductive_cases wfT_elims:
+  "\<Theta>; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>::\<tau>"
+  "\<Theta>; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>"
+
+inductive_cases wfG_elims:
+  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f GNil"
+  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x,b,c)#\<^sub>\<Gamma>\<Gamma>"
+  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x,b,TRUE)#\<^sub>\<Gamma>\<Gamma>"
+  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x,b,FALSE)#\<^sub>\<Gamma>\<Gamma>"
+
+inductive_cases wfTh_elims:
+  " \<turnstile>\<^sub>w\<^sub>f []"
+  " \<turnstile>\<^sub>w\<^sub>f td#\<Pi>"  
+
+inductive_cases wfTD_elims:
+  "\<Theta> \<turnstile>\<^sub>w\<^sub>f (AF_typedef s lst )"  
+  "\<Theta> \<turnstile>\<^sub>w\<^sub>f (AF_typedef_poly s bv lst )" 
+
+inductive_cases wfTs_elims:
+  "\<Theta>; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f ([]::((string*\<tau>) list))"
+  "\<Theta>; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f ((t#ts)::((string*\<tau>) list))"
+
+inductive_cases wfB_elims:
+  " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_pair b1 b2" 
+  " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_id s"
+  " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f B_app s b"
+
+equivariance wfV 
+
+text \<open>This setup of 'avoiding' is not complete and for some of lemmas, such as weakening,
+do it the hard way\<close>
+nominal_inductive wfV 
+  avoids   wfV_conspI: bv | wfTI: z
+proof(goal_cases)
+  case (1 s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+
+  moreover hence "atom bv \<sharp>  V_consp s dc b v" using v.fresh fresh_prodN pure_fresh by metis
+  moreover have "atom bv \<sharp> B_app s b" using b.fresh fresh_prodN pure_fresh 1 by metis
+  ultimately show ?case using b.fresh v.fresh pure_fresh  fresh_star_def fresh_prodN by fastforce
+next
+  case (2 s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+  then show ?case by auto
+next
+  case (3 z \<Gamma> \<Theta> \<B> b c)
+  then show ?case using \<tau>.fresh fresh_star_def fresh_prodN by fastforce
+next
+  case (4 z \<Gamma> \<Theta> \<B> b c)
+  then show ?case by auto
+qed
+
+inductive 
+  wfE :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow> e \<Rightarrow> b \<Rightarrow> bool" (" _ ; _ ; _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ : _ " [50,50,50] 50)  and
+  wfS :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow> s \<Rightarrow> b \<Rightarrow> bool" (" _ ; _ ; _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ : _ " [50,50,50] 50)  and
+  wfCS :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow>  tyid \<Rightarrow> string \<Rightarrow> \<tau> \<Rightarrow> branch_s \<Rightarrow> b \<Rightarrow> bool" (" _ ; _ ; _ ; _ ; _ ; _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ : _ " [50,50,50,50,50] 50)  and
+  wfCSS :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow>  tyid \<Rightarrow> (string * \<tau>) list \<Rightarrow> branch_list \<Rightarrow> b \<Rightarrow> bool" (" _ ; _ ; _ ; _ ; _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ : _ " [50,50,50,50,50] 50)  and       
+  wfPhi :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> bool" (" _  \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50)  and
+  wfD :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Delta> \<Rightarrow> bool" (" _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ " [50,50] 50) and       
+  wfFTQ :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> fun_typ_q \<Rightarrow> bool"  (" _  ; _ \<turnstile>\<^sub>w\<^sub>f _ " [50] 50) and
+  wfFT :: "\<Theta> \<Rightarrow> \<Phi> \<Rightarrow> \<B> \<Rightarrow> fun_typ \<Rightarrow> bool"  (" _ ; _ ; _ \<turnstile>\<^sub>w\<^sub>f _ " [50] 50)  where
+
+wfE_valI : "\<lbrakk>
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v  : b 
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_val v  : b"
+
+| wfE_plusI: "\<lbrakk> 
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_int; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_op Plus v1 v2 : B_int"
+
+| wfE_leqI:"\<lbrakk>   
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_int; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_op LEq v1 v2 : B_bool"
+
+| wfE_eqI:"\<lbrakk>   
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : b;
+   b \<in> { B_bool, B_int, B_unit }
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_op Eq v1 v2 : B_bool"
+
+| wfE_fstI: "\<lbrakk>  
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_pair b1 b2 
+ \<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_fst v1 : b1"
+
+| wfE_sndI: "\<lbrakk>  
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_pair b1 b2  
+\<rbrakk> \<Longrightarrow>  
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_snd v1 : b2"
+
+| wfE_concatI: "\<lbrakk>
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_bitvec; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_bitvec 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta> ; \<Phi> ; \<B> ; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_concat v1 v2 : B_bitvec"
+
+| wfE_splitI: "\<lbrakk>
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_bitvec; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v2 : B_int 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta> ; \<Phi> ; \<B> ; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_split v1 v2 : B_pair B_bitvec B_bitvec"
+
+| wfE_lenI: "\<lbrakk>
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : B_bitvec 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f AE_len v1 : B_int"
+
+| wfE_appI:  "\<lbrakk>
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f ;  
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b
+\<rbrakk> \<Longrightarrow>   
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_app f v : b_of \<tau>"
+
+| wfE_appPI:  "\<lbrakk>
+    \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ; 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+    \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b'; 
+    atom bv \<sharp>  (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b);
+    Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f;  
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : (b[bv::=b']\<^sub>b)
+\<rbrakk> \<Longrightarrow>   
+    \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f (AE_appP f b' v) : ((b_of \<tau>)[bv::=b']\<^sub>b)"
+
+| wfE_mvarI: "\<lbrakk>  
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>; 
+   (u,\<tau>) \<in> setD \<Delta> 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_mvar u : b_of \<tau>" 
+
+| wfS_valI: "\<lbrakk> 
+    \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;  
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b ; 
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> 
+\<rbrakk>  \<Longrightarrow> 
+    \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f (AS_val v) : b"
+
+| wfS_letI: "\<lbrakk> 
+    wfE \<Theta> \<Phi> \<B> \<Gamma> \<Delta>  e b'  ;
+    \<Theta> ; \<Phi> ; \<B> ; (x,b',C_true) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b;
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+    atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, e, b)
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f LET x = e IN s : b"
+
+| wfS_assertI: "\<lbrakk> 
+    \<Theta> ; \<Phi> ; \<B> ; (x,B_bool,c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b;
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c ;
+    \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;
+    atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, c, b, s)
+\<rbrakk> \<Longrightarrow> 
+    \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f ASSERT c IN  s : b"
+
+| wfS_let2I: "\<lbrakk> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau>  ; 
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>;
+   \<Theta> ; \<Phi> ; \<B> ; (x,b_of \<tau>,C_true) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b ;
+   atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, s1, b,\<tau>)            
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f LET x : \<tau> = s1 IN s2 : b"
+
+| wfS_ifI: "\<lbrakk>  
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v  : B_bool; 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b ; 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b 
+\<rbrakk> \<Longrightarrow>
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f IF v THEN s1 ELSE s2 : b"
+
+| wfS_varI : "\<lbrakk> 
+   wfT \<Theta> \<B> \<Gamma>  \<tau> ;  
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v  : b_of \<tau>; 
+   atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, \<tau>, v, b);
+   \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ;  (u,\<tau>)#\<^sub>\<Delta>\<Delta> \<turnstile>\<^sub>w\<^sub>f s : b 
+\<rbrakk> \<Longrightarrow> 
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f VAR u : \<tau> = v IN s : b "
+
+| wfS_assignI: "\<lbrakk> 
+   (u,\<tau>) \<in> setD \<Delta> ;   
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> ;  
+   \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+   \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v  : b_of \<tau> 
+\<rbrakk> \<Longrightarrow>
+   \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f u ::= v : B_unit"
+
+| wfS_whileI: "\<lbrakk> 
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : B_bool ; 
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b
+\<rbrakk> \<Longrightarrow>  
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f WHILE s1 DO { s2 } : b"
+
+| wfS_seqI: "\<lbrakk>
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : B_unit ; 
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b 
+\<rbrakk> \<Longrightarrow> 
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 ;; s2 : b"
+
+| wfS_matchI: "\<lbrakk> 
+  wfV \<Theta>  \<B> \<Gamma>  v  (B_id tid) ;
+  (AF_typedef tid dclist ) \<in> set \<Theta>;
+  wfD \<Theta>  \<B> \<Gamma>  \<Delta> ;  
+  \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> ;
+  \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ;  \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f cs : b 
+\<rbrakk> \<Longrightarrow> 
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AS_match v cs : b "
+
+| wfS_branchI: "\<lbrakk> 
+  \<Theta> ; \<Phi> ; \<B> ; (x,b_of \<tau>,C_true) #\<^sub>\<Gamma> \<Gamma> ;  \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b ;
+  atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>, \<Gamma>,\<tau>);
+  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> 
+\<rbrakk>  \<Longrightarrow> 
+  \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ;  \<Delta> ; tid ; dc ;  \<tau>  \<turnstile>\<^sub>w\<^sub>f  dc x \<Rightarrow> s : b"
+
+| wfS_finalI: "\<lbrakk>       
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b    
+ \<rbrakk> \<Longrightarrow>  
+  \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ;  \<Delta> ; tid ; [(dc,t)] \<turnstile>\<^sub>w\<^sub>f AS_final cs  : b "
+
+| wfS_cons: "\<lbrakk>           
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b;
+  \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b
+ \<rbrakk> \<Longrightarrow>  
+  \<Theta> ; \<Phi> ; \<B> ; \<Gamma> ;  \<Delta> ; tid ; (dc,t)#dclist \<turnstile>\<^sub>w\<^sub>f AS_cons cs css : b "
+
+| wfD_emptyI: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow> \<Theta>  ; \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta>"
+
+| wfD_cons: "\<lbrakk> 
+  \<Theta>  ; \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>::\<Delta> ; 
+  \<Theta>  ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>; 
+  u \<notin> fst ` setD \<Delta> 
+\<rbrakk> \<Longrightarrow> 
+  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ((u,\<tau>) #\<^sub>\<Delta> \<Delta>)"
+
+| wfPhi_emptyI: " \<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> \<Theta> \<turnstile>\<^sub>w\<^sub>f []"
+
+| wfPhi_consI: "\<lbrakk> 
+  f \<notin> name_of_fun ` set \<Phi>; 
+  \<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ft;
+  \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>
+\<rbrakk> \<Longrightarrow>  
+  \<Theta>  \<turnstile>\<^sub>w\<^sub>f ((AF_fundef f ft)#\<Phi>)"  
+
+| wfFTNone: " \<Theta> ; \<Phi> ; {||} \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>  \<Theta> ; \<Phi> \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_none ft"
+| wfFTSome: " \<Theta> ; \<Phi> ; {| bv |} \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>  \<Theta> ; \<Phi> \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_some bv ft"
+
+| wfFTI: "\<lbrakk>
+  \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b; 
+  supp s \<subseteq> {atom x} \<union> supp B ;
+  supp c \<subseteq> { atom x } ;
+  \<Theta> ; B ; (x,b,c) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f \<tau>;
+  \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>        
+\<rbrakk> \<Longrightarrow> 
+  \<Theta> ; \<Phi> ; B \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)"
+
+inductive_cases wfE_elims:
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_val v : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_op Plus v1 v2 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_op LEq v1 v2 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_fst v1 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_snd v1 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_concat v1 v2 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_len v1 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_op opp v1 v2 : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_app f v: b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_appP f b' v: b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_mvar u : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_op Eq v1 v2 : b"
+
+inductive_cases wfCS_elims:
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f (cs::branch_s) : b"
+  "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc  \<turnstile>\<^sub>w\<^sub>f (cs::branch_list) : b"
+
+inductive_cases wfPhi_elims:
+  " \<Theta>  \<turnstile>\<^sub>w\<^sub>f []"
+  " \<Theta>  \<turnstile>\<^sub>w\<^sub>f ((AF_fundef f ft)#\<Pi>)"  
+  " \<Theta>  \<turnstile>\<^sub>w\<^sub>f (fd#\<Phi>::\<Phi>)"  
+
+declare[[ simproc del: alpha_lst]]
+
+inductive_cases wfFTQ_elims:
+  "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_none ft"
+  "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_some bv ft"
+  "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)"
+
+inductive_cases wfFT_elims:
+  "\<Theta> ; \<Phi> ; \<B>  \<turnstile>\<^sub>w\<^sub>f AF_fun_typ x b c \<tau> s"
+
+declare[[ simproc add: alpha_lst]]
+
+inductive_cases wfD_elims:
+  "\<Pi> ; \<B> ; (\<Gamma>::\<Gamma>) \<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta>"
+  "\<Pi> ; \<B> ; (\<Gamma>::\<Gamma>) \<turnstile>\<^sub>w\<^sub>f (u,\<tau>) #\<^sub>\<Delta> \<Delta>::\<Delta>"
+
+equivariance wfE 
+
+nominal_inductive wfE 
+  avoids   wfE_appPI: bv |  wfS_varI: u |  wfS_letI: x | wfS_let2I: x  | wfS_branchI: x | wfS_assertI: x
+
+proof(goal_cases)
+  case (1 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  moreover hence "atom bv \<sharp>  AE_appP f b' v" using pure_fresh fresh_prodN e.fresh  by auto
+  ultimately show ?case using fresh_star_def by fastforce
+next
+  case (2 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  then show ?case by auto
+next
+  case (3 \<Phi> \<Theta> \<B> \<Gamma> \<Delta> e b' x s b)
+  moreover hence "atom x \<sharp> LET x = e IN s" using  fresh_prodN by auto
+  ultimately show ?case using fresh_prodN fresh_star_def by fastforce 
+next
+  case (4 \<Phi> \<Theta> \<B> \<Gamma> \<Delta> e b' x s b)
+  then show ?case by auto
+next
+  case (5 \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  hence "atom x \<sharp> ASSERT c IN s" using  s_branch_s_branch_list.fresh by auto
+  then show ?case using fresh_prodN fresh_star_def 5 by fastforce 
+next
+  case (6 \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  then show ?case by auto
+next
+  case (7 \<Phi> \<Theta> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  hence "atom x \<sharp> \<tau> \<and> atom x \<sharp> s1" using fresh_prodN by metis
+  moreover hence "atom x \<sharp> LET x : \<tau> = s1 IN s2" 
+    using  s_branch_s_branch_list.fresh(3)[of "atom x" x "\<tau>" s1 s2 ] fresh_prodN by simp
+  ultimately show ?case using fresh_prodN fresh_star_def 7 by fastforce 
+next
+  case (8 \<Phi> \<Theta> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  then show ?case by auto
+next
+  case (9 \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  moreover hence " atom u \<sharp> AS_var u \<tau> v s" using fresh_prodN s_branch_s_branch_list.fresh by simp
+  ultimately show ?case using fresh_star_def fresh_prodN s_branch_s_branch_list.fresh by fastforce
+next
+  case (10 \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  then show ?case by auto
+next
+  case (11 \<Phi> \<Theta> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  moreover have "atom x \<sharp> (dc x \<Rightarrow> s)" using pure_fresh  s_branch_s_branch_list.fresh by auto
+  ultimately show ?case using fresh_prodN fresh_star_def pure_fresh by fastforce 
+next
+  case (12 \<Phi> \<Theta> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  then show ?case by auto
+qed
+
+inductive  wfVDs :: "var_def list \<Rightarrow> bool" where
+
+wfVDs_nilI: "wfVDs []"
+
+| wfVDs_consI: "\<lbrakk>
+   atom u \<sharp> ts;
+   wfV ([]::\<Theta>) {||}  GNil  v  (b_of \<tau>);
+   wfT ([]::\<Theta>)  {||}  GNil  \<tau>;
+   wfVDs ts
+\<rbrakk> \<Longrightarrow> wfVDs  ((AV_def u \<tau> v)#ts)"
+
+equivariance wfVDs 
+nominal_inductive wfVDs .  
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/WellformedL.thy b/thys/MiniSail/WellformedL.thy
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/WellformedL.thy
@@ -0,0 +1,4755 @@
+(*<*)
+theory WellformedL
+  imports Wellformed "SyntaxL"
+begin                                                                                                                                                                                   
+(*>*)
+
+chapter \<open>Wellformedness Lemmas\<close>
+
+section \<open>Prelude\<close>
+
+lemma b_of_subst_bb_commute:
+   "(b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)) =  (b_of \<tau>)[bv::=b]\<^sub>b\<^sub>b"
+proof -
+  obtain z' and b' and c' where "\<tau> = \<lbrace> z' : b' | c' \<rbrace> " using obtain_fresh_z by metis
+  moreover hence "(b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)) = b_of \<lbrace> z' : b'[bv::=b]\<^sub>b\<^sub>b | c' \<rbrace>" using subst_tb.simps by simp
+  ultimately show ?thesis using subst_tv.simps subst_tb.simps by simp
+qed
+
+lemmas wf_intros = wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.intros wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.intros
+
+lemmas freshers = fresh_prodN b.fresh c.fresh v.fresh ce.fresh fresh_GCons fresh_GNil fresh_at_base 
+
+section \<open>Strong Elimination\<close>
+
+text \<open>Inversion/elimination for well-formed polymorphic constructors \<close>
+lemma wf_strong_elim:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" 
+           and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and s::s and tm::"'a::fs" 
+          and cs::branch_s and css::branch_list and \<Theta>::\<Theta>
+   shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f (V_consp tyid dc b v) : b'' \<Longrightarrow> (\<exists> bv dclist x b' c. b'' = B_app tyid b \<and>
+             AF_typedef_poly tyid bv dclist \<in> set \<Theta> \<and>
+            (dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist \<and>
+               \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b  \<and> atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>, b, v) \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b \<and> atom bv \<sharp> tm)" and           
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> True" and
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and       
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True " and      
+         "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b'    \<Longrightarrow> True" and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
+proof(nominal_induct
+      "V_consp tyid dc b v" b'' and c and \<Gamma> and \<tau> and ts and \<Theta> and b and b' and td 
+     avoiding: tm
+  
+rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfV_conspI bv dclist \<Theta> x b' c \<B> \<Gamma>)
+  then show ?case by force
+qed(auto+)
+
+section \<open>Context Extension\<close>
+
+definition wfExt :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Gamma> \<Rightarrow> bool" (" _ ; _  \<turnstile>\<^sub>w\<^sub>f _ < _ " [50,50,50] 50)   where
+  "wfExt T B G1 G2 = (wfG T B G2 \<and> wfG T B G1 \<and> toSet G1 \<subseteq> toSet G2)" 
+
+section \<open>Context\<close>
+
+lemma wfG_cons[ms_wb]:
+  fixes \<Gamma>::\<Gamma>
+  assumes "P; \<B>  \<turnstile>\<^sub>w\<^sub>f (z,b,c)  #\<^sub>\<Gamma>\<Gamma>"
+  shows "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> atom z \<sharp> \<Gamma> \<and> wfB P \<B> b" 
+  using wfG_elims(2)[OF assms] by metis
+
+lemma wfG_cons2[ms_wb]:
+  fixes \<Gamma>::\<Gamma>
+  assumes "P; \<B>  \<turnstile>\<^sub>w\<^sub>f zbc  #\<^sub>\<Gamma>\<Gamma>"
+  shows "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" 
+proof -
+  obtain z and b and c where zbc: "zbc=(z,b,c)" using prod_cases3 by blast
+  hence  "P; \<B>  \<turnstile>\<^sub>w\<^sub>f (z,b,c)  #\<^sub>\<Gamma>\<Gamma>" using assms by auto
+  thus ?thesis using zbc wfG_cons assms by simp
+qed
+
+lemma wf_g_unique: 
+  fixes \<Gamma>::\<Gamma>
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma>" and "(x,b,c) \<in> toSet \<Gamma>" and "(x,b',c') \<in> toSet \<Gamma>"
+  shows "b=b' \<and> c=c'"
+using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
+  case GNil
+  then show ?case by simp
+next
+  case (GCons a \<Gamma>)
+  consider "(x,b,c)=a \<and> (x,b',c')=a" | "(x,b,c)=a \<and> (x,b',c')\<noteq>a" | "(x,b,c)\<noteq>a \<and> (x,b',c')=a" | "(x,b,c)\<noteq> a \<and> (x,b',c')\<noteq>a" by blast
+  then show ?case proof(cases)
+    case 1
+    then show ?thesis  by auto
+  next
+    case 2
+    hence "atom x \<sharp> \<Gamma>"  using wfG_elims(2) GCons by blast
+    moreover have "(x,b',c') \<in> toSet \<Gamma>" using GCons 2 by force
+    ultimately show ?thesis    using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \<Gamma>.distinct subst_gv.simps 2 GCons by metis
+  next
+    case 3
+    hence "atom x \<sharp> \<Gamma>"  using wfG_elims(2) GCons by blast
+    moreover have "(x,b,c) \<in> toSet \<Gamma>" using GCons 3 by force
+    ultimately show ?thesis
+           using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \<Gamma>.distinct subst_gv.simps 3 GCons by metis
+  next
+    case 4
+    then obtain x'' and b'' and c''::c where xbc: "a=(x'',b'',c'')" 
+      using prod_cases3 by blast
+    hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x'',b'',c'')  #\<^sub>\<Gamma>\<Gamma>)" using GCons wfG_elims by blast
+    hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> (x, b, c) \<in> toSet \<Gamma> \<and> (x, b', c') \<in> toSet \<Gamma>"  using  GCons wfG_elims 4 xbc
+          prod_cases3 set_GConsD   using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \<Gamma>.distinct subst_gv.simps 4 GCons by meson
+    thus ?thesis using GCons by auto    
+  qed
+qed
+
+lemma lookup_if1:
+  fixes \<Gamma>::\<Gamma>
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and  "Some (b,c) = lookup \<Gamma> x"
+  shows "(x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)"
+using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons xbc \<Gamma>)
+  then obtain x' and b' and c'::c where xbc: "xbc=(x',b',c')" 
+    using prod_cases3 by blast
+  then show ?case using wf_g_unique GCons lookup_in_g xbc
+     lookup.simps set_GConsD wfG.cases 
+     insertE insert_is_Un toSet.simps wfG_elims by metis
+qed
+
+lemma lookup_if2:
+  assumes "wfG P \<B> \<Gamma>" and   "(x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)"
+  shows "Some (b,c) = lookup \<Gamma> x" 
+using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons xbc \<Gamma>)
+  then obtain x' and b' and c'::c where xbc: "xbc=(x',b',c')" 
+    using prod_cases3 by blast
+  then show ?case proof(cases "x=x'")
+    case True
+    then show ?thesis using lookup.simps GCons xbc by simp
+  next
+    case False
+    then show ?thesis using lookup.simps GCons xbc toSet.simps Un_iff set_GConsD wfG_cons2 
+      by (metis (full_types) Un_iff set_GConsD toSet.simps(2) wfG_cons2)
+  qed
+qed
+    
+lemma lookup_iff:
+  fixes \<Theta>::\<Theta> and \<Gamma>::\<Gamma>
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "Some (b,c) = lookup \<Gamma> x \<longleftrightarrow> (x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)"
+  using assms lookup_if1 lookup_if2 by meson
+
+lemma wfG_lookup_wf:
+  fixes \<Theta>::\<Theta> and \<Gamma>::\<Gamma> and b::b and \<B>::\<B>
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "Some (b,c) = lookup \<Gamma> x"
+  shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b"
+using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  then show ?case proof(cases "x=x'")
+    case True
+    then show ?thesis using lookup.simps wfG_elims(2) GCons by fastforce 
+  next
+    case False
+    then show ?thesis using lookup.simps wfG_elims(2) GCons by fastforce 
+  qed
+qed    
+
+lemma wfG_unique:
+  fixes \<Gamma>::\<Gamma>
+  assumes "wfG B \<Theta> ((x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "(x1,b1,c1) \<in> toSet ((x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "x1=x"
+  shows "b1 = b \<and> c1 = c"
+proof - 
+  have "(x, b, c) \<in> toSet ((x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" by simp
+  thus ?thesis using wf_g_unique assms by blast
+qed
+
+lemma wfG_unique_full:
+  fixes \<Gamma>::\<Gamma>
+  assumes "wfG \<Theta> B (\<Gamma>'@(x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "(x1,b1,c1) \<in> toSet (\<Gamma>'@(x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "x1=x"
+  shows "b1 = b \<and> c1 = c"
+proof - 
+  have "(x, b, c) \<in> toSet (\<Gamma>'@(x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" by simp
+  thus ?thesis using wf_g_unique assms by blast
+qed
+
+section \<open>Converting between wb forms\<close>
+
+text \<open> We cannot prove wfB properties here for expressions and statements as need some more facts about @{term \<Phi>}
+   context which we can prove without this lemma. Trying to cram everything into a single large
+   mutually recursive lemma is not a good idea \<close>
+
+lemma wfX_wfY1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s
+           and css::branch_list
+  shows  wfV_wf: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<turnstile>\<^sub>w\<^sub>f \<Theta>  " and              
+         wfC_wf: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<turnstile>\<^sub>w\<^sub>f \<Theta> " and
+         wfG_wf :"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>"  and
+         wfT_wf: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b_of \<tau>" and
+         wfTs_wf:"\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta>" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> True" and       
+         wfB_wf: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow>   \<turnstile>\<^sub>w\<^sub>f \<Theta>" and      
+         wfCE_wf: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> "  and
+         wfTD_wf: "\<Theta> \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>"
+proof(induct    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
+
+  case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
+  hence "(x,b,c) \<in> toSet \<Gamma>" using lookup_iff lookup_in_g by presburger
+  hence "b \<in> fst`snd`toSet \<Gamma>" by force
+  hence "wfB \<Theta> \<B> b" using wfV_varI using wfG_lookup_wf by auto
+  then show ?case using wfV_varI wfV_elims wf_intros by metis
+next
+  case (wfV_litI \<Theta> \<B> \<Gamma> l)
+  moreover have "wfTh \<Theta>" using wfV_litI by metis
+  ultimately  show ?case using   wf_intros base_for_lit.simps l.exhaust by metis
+next
+  case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
+  then show ?case using wfB_pairI by simp
+next
+  case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
+  then show ?case using   wf_intros  by metis
+next
+  case (wfTI z \<Gamma> \<Theta> \<B> b c)
+  then show ?case using wf_intros b_of.simps wfG_cons2 by metis
+qed(auto)
+
+lemma wfX_wfY2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s
+           and css::branch_list
+  shows 
+         wfE_wf: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>  " and
+         wfS_wf: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>   " and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " and       
+         wfPhi_wf: "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>" and
+         wfD_wf:   "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> " and       
+         wfFTQ_wf: "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>  \<and> \<turnstile>\<^sub>w\<^sub>f \<Theta>" and
+         wfFT_wf:  "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta>"           
+proof(induct    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Delta> \<Phi> s b)
+  then show ?case using wfD_elims by auto
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  then show ?case using wf_intros by metis
+next
+  case (wfD_emptyI \<Theta> \<B> \<Gamma>)
+  then show ?case using wfX_wfY1 by auto
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  then have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using wfX_wfY1 by auto
+  moreover have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" using wfS_assertI by auto
+  moreover have "\<turnstile>\<^sub>w\<^sub>f \<Theta>  \<and>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfS_assertI by auto
+  ultimately  show ?case by auto
+qed(auto)
+
+lemmas wfX_wfY=wfX_wfY1 wfX_wfY2
+
+lemma setD_ConsD:
+  "ut \<in> setD (ut' #\<^sub>\<Delta> D) = (ut = ut' \<or> ut \<in> setD D)"
+proof(induct D rule: \<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u' t' x2)
+  then show ?case using setD.simps by auto
+qed
+
+lemma wfD_wfT:
+  fixes \<Delta>::\<Delta> and \<tau>::\<tau>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>"
+  shows "\<forall>(u,\<tau>) \<in> setD \<Delta>. \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>"
+using assms proof(induct \<Delta> rule: \<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u' t' x2)
+  then show ?case using wfD_elims DCons setD_ConsD
+    by (metis case_prodI2 set_ConsD)
+qed
+
+lemma subst_b_lookup_d:
+  assumes "u \<notin> fst ` setD \<Delta>"
+  shows  "u \<notin> fst ` setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" 
+using assms proof(induct \<Delta> rule: \<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u' t'  x2) 
+  hence "u\<noteq>u'" using DCons by simp
+  show ?case using DCons subst_db.simps by simp
+qed
+
+lemma wfG_cons_splitI:
+  fixes  \<Phi>::\<Phi> and \<Gamma>::\<Gamma>
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom x \<sharp> \<Gamma>" and "wfB \<Theta> \<B> b" and
+      "c \<in> { TRUE, FALSE } \<longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> " and
+      "c \<notin> { TRUE, FALSE } \<longrightarrow> \<Theta>  ;\<B> ;  (x,b,C_true)  #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
+    shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
+  using wfG_cons1I wfG_cons2I assms by metis
+
+lemma wfG_consI:
+  fixes  \<Phi>::\<Phi> and \<Gamma>::\<Gamma> and c::c
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom x \<sharp> \<Gamma>" and "wfB \<Theta> \<B> b" and
+   "\<Theta>  ; \<B> ; (x,b,C_true)  #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
+  shows "\<Theta>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
+  using wfG_cons1I wfG_cons2I wfG_cons_splitI wfC_trueI assms by metis
+
+lemma wfG_elim2:
+  fixes c::c
+  assumes  "wfG P \<B>  ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)" 
+  shows "P; \<B> ; (x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<and> wfB P \<B> b" 
+proof(cases "c \<in> {TRUE,FALSE}")
+  case True
+  have "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<and> atom x \<sharp> \<Gamma> \<and> wfB P \<B> b"  using wfG_elims(2)[OF assms] by auto
+  hence "P; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>) \<and> wfB P \<B> b" using wfG_cons2I by auto
+  thus ?thesis using wfC_trueI wfC_falseI True by auto
+next
+  case False
+  then show ?thesis using wfG_elims(2)[OF assms] by auto
+qed
+
+lemma wfG_cons_wfC:
+  fixes \<Gamma>::\<Gamma> and c::c
+  assumes "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f (x, b, c)   #\<^sub>\<Gamma> \<Gamma>"
+  shows "\<Theta> ; B ; ((x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f c"
+  using assms wfG_elim2 by auto
+
+lemma wfG_wfB:
+  assumes "wfG P \<B> \<Gamma>" and "b \<in> fst`snd`toSet \<Gamma>"
+  shows "wfB P \<B> b"
+using assms proof(induct \<Gamma> rule:\<Gamma>_induct)
+case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  show ?case proof(cases "b=b'")
+    case True
+    then show ?thesis using wfG_elim2  GCons by auto
+  next
+    case False
+    hence "b \<in> fst`snd`toSet \<Gamma>'" using GCons by auto
+    moreover have "wfG P \<B> \<Gamma>'" using wfG_cons GCons by auto
+    ultimately show ?thesis using GCons by auto
+  qed
+qed
+
+lemma wfG_cons_TRUE:
+  fixes \<Gamma>::\<Gamma> and b::b
+  assumes "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom z \<sharp> \<Gamma>" and "P; \<B> \<turnstile>\<^sub>w\<^sub>f b"
+  shows "P  ; \<B> \<turnstile>\<^sub>w\<^sub>f (z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>" 
+  using wfG_cons2I wfG_wfB assms by simp
+
+lemma wfG_cons_TRUE2:
+  assumes "P; \<B> \<turnstile>\<^sub>w\<^sub>f (z,b,c)  #\<^sub>\<Gamma>\<Gamma>" and "atom z \<sharp> \<Gamma>"
+  shows "P; \<B> \<turnstile>\<^sub>w\<^sub>f (z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>" 
+  using  wfG_cons wfG_cons2I assms by simp
+
+lemma wfG_suffix:
+  fixes \<Gamma>::\<Gamma>
+  assumes "wfG P \<B> (\<Gamma>'@\<Gamma>)"
+  shows "wfG P \<B> \<Gamma>"
+using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x b c \<Gamma>')
+  hence " P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ \<Gamma>" using wfG_elims by auto
+  then show ?case using GCons  wfG_elims by auto
+qed
+
+lemma wfV_wfCE:
+  fixes v::v
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b" 
+  shows " \<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val v : b"
+proof -
+  have  "\<Theta> \<turnstile>\<^sub>w\<^sub>f ([]::\<Phi>) "  using wfPhi_emptyI wfV_wf wfG_wf assms by metis
+  moreover have "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta>" using wfD_emptyI wfV_wf wfG_wf assms by metis
+  ultimately show ?thesis using wfCE_valI assms by auto
+qed
+  
+section \<open>Support\<close>
+
+lemma wf_supp1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css ::branch_list
+
+  shows  wfV_supp: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow>  supp v \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" and       
+         wfC_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> supp c \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" and
+         wfG_supp: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow>  atom_dom \<Gamma> \<subseteq> supp \<Gamma>" and
+         wfT_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  supp \<tau> \<subseteq> atom_dom \<Gamma> \<union> supp \<B> " and
+         wfTs_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  supp ts \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" and 
+         wfTh_supp: "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> supp \<Theta> = {}" and       
+         wfB_supp: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> supp b \<subseteq> supp \<B>" and      
+         wfCE_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> supp ce \<subseteq>  atom_dom \<Gamma> \<union> supp \<B>" and
+         wfTD_supp: "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> supp td \<subseteq>  {}" 
+proof(induct    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
+  case (wfB_consI \<Theta> s dclist \<B>)
+  then show ?case by(auto simp add: b.supp pure_supp)
+next
+  case (wfB_appI \<Theta> \<B> b s bv dclist)
+  then show ?case by(auto simp add: b.supp pure_supp)
+next
+  case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
+  then show ?case using v.supp wfV_elims  
+     empty_subsetI insert_subset supp_at_base 
+     fresh_dom_free2 lookup_if1 
+    by (metis sup.coboundedI1)
+next
+  case (wfV_litI \<Theta> \<B> \<Gamma> l)
+  then show ?case using supp_l_empty v.supp by simp
+next
+  case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
+   then show ?case using v.supp wfV_elims  by (metis Un_subset_iff)
+next
+  case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
+  then show ?case using v.supp wfV_elims  
+    Un_commute b.supp sup_bot.right_neutral supp_b_empty pure_supp by metis
+next
+  case (wfV_conspI typid bv dclist \<Theta> dc x b' c \<B> \<Gamma> v b)
+  then show ?case  unfolding v.supp 
+    using wfV_elims  
+    Un_commute b.supp sup_bot.right_neutral supp_b_empty pure_supp 
+    by (simp add: Un_commute pure_supp sup.coboundedI1)
+next
+  case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
+  hence "supp e1 \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using   c.supp wfC_elims 
+    image_empty list.set(1) sup_bot.right_neutral  by (metis IntI UnE empty_iff subsetCE subsetI)
+  moreover have "supp e2 \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using   c.supp wfC_elims 
+    image_empty list.set(1) sup_bot.right_neutral IntI UnE empty_iff subsetCE subsetI
+    by (metis wfC_eqI.hyps(4))
+  ultimately show ?case using c.supp by auto
+next
+  case (wfG_cons1I c \<Theta> \<B> \<Gamma> x b)
+  then show ?case using atom_dom.simps  dom_supp_g supp_GCons by metis
+next
+  case (wfG_cons2I c \<Theta> \<B> \<Gamma> x b)
+  then show ?case using atom_dom.simps  dom_supp_g supp_GCons by metis
+next
+  case wfTh_emptyI
+  then show ?case  by (simp add: supp_Nil)
+next
+  case (wfTh_consI \<Theta> lst)
+  then show ?case using supp_Cons by fast
+next
+  case (wfTD_simpleI \<Theta> lst s)
+  then have "supp (AF_typedef s lst ) = supp lst \<union> supp s" using type_def.supp  by auto
+  then show ?case using wfTD_simpleI pure_supp 
+    by (simp add: pure_supp supp_Cons supp_at_base)
+next
+  case (wfTD_poly \<Theta> bv lst s)
+  then have "supp (AF_typedef_poly s bv lst ) = supp lst - { atom bv } \<union> supp s" using type_def.supp  by auto
+  then show ?case using wfTD_poly pure_supp 
+    by (simp add: pure_supp supp_Cons supp_at_base)
+next
+  case (wfTs_nil \<Theta> \<B> \<Gamma>)
+  then show ?case using supp_Nil by auto
+next
+  case (wfTs_cons \<Theta> \<B> \<Gamma> \<tau> dc ts)
+  then show ?case using supp_Cons supp_Pair pure_supp[of dc] by blast
+next
+  case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
+  thus ?case using ce.supp wfCE_elims by simp
+next
+  case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
+  hence "supp (CE_op Plus v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using ce.supp pure_supp 
+    by (simp add: wfCE_plusI opp.supp)  
+  then show ?case using  ce.supp wfCE_elims UnCI subsetCE subsetI x_not_in_b_set by auto
+next
+  case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
+  hence "supp (CE_op LEq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using ce.supp pure_supp 
+    by (simp add: wfCE_plusI opp.supp)  
+  then show ?case using  ce.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by auto
+next
+  case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2 )
+  hence "supp (CE_op Eq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using ce.supp pure_supp 
+    by (simp add: wfCE_eqI opp.supp)  
+  then show ?case using  ce.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by auto
+next
+  case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  thus ?case using ce.supp wfCE_elims by simp
+next
+  case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
+ thus ?case using ce.supp wfCE_elims by simp
+next
+  case (wfCE_concatI \<Theta>  \<B> \<Gamma> v1 v2)
+  thus ?case using ce.supp wfCE_elims by simp
+next
+  case (wfCE_lenI \<Theta>  \<B> \<Gamma>  v1)
+  thus ?case using ce.supp wfCE_elims by simp
+next
+   case (wfTI z \<Theta> \<B> \<Gamma> b c)
+  hence "supp c \<subseteq> supp z \<union> atom_dom \<Gamma> \<union> supp \<B>" using  supp_at_base dom_cons  by metis
+  moreover have "supp b \<subseteq> supp \<B>"  using wfTI by auto
+  ultimately have " supp  \<lbrace> z : b  | c \<rbrace> \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using \<tau>.supp supp_at_base by force
+  thus ?case by auto
+qed(auto)
+
+lemma wf_supp2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and 
+        ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and 
+        ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css ::branch_list
+  shows
+         wfE_supp: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> (supp e \<subseteq>  atom_dom \<Gamma> \<union> supp \<B> \<union> atom ` fst ` setD \<Delta>)" and (* \<and> ( \<Phi> = [] \<longrightarrow> supp e \<inter> supp \<B> = {})" and*)
+         wfS_supp: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> supp s \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow>  supp cs \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow>  supp css \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" and      
+         wfPhi_supp: "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow>  supp \<Phi> = {}" and
+         wfD_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> supp \<Delta> \<subseteq> atom`fst`(setD \<Delta>) \<union> atom_dom \<Gamma> \<union> supp \<B> " and      
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> supp ftq = {}" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> supp ft \<subseteq> supp \<B>"      
+proof(induct    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)
+  case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  hence "supp (AE_val v) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp wf_supp1 by simp
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  hence "supp (AE_op Plus v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  
+    using  wfE_plusI opp.supp wf_supp1 e.supp pure_supp Un_least 
+    by (metis sup_bot.left_neutral)
+
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  hence "supp (AE_op LEq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp Un_least 
+    sup_bot.left_neutral  using opp.supp wf_supp1 by auto
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  hence "supp (AE_op Eq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp Un_least 
+    sup_bot.left_neutral  using opp.supp wf_supp1 by auto
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+ hence "supp (AE_fst  v1 ) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp   sup_bot.left_neutral  using opp.supp wf_supp1 by auto
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+ hence "supp (AE_snd  v1 ) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp     wfE_plusI opp.supp wf_supp1  by (metis Un_least)
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  hence "supp (AE_concat v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp 
+    wfE_plusI opp.supp wf_supp1  by (metis Un_least)
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  hence "supp (AE_split v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp 
+    wfE_plusI opp.supp wf_supp1  by (metis Un_least)
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  hence "supp (AE_len v1 ) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp 
+    using e.supp pure_supp   sup_bot.left_neutral  using opp.supp wf_supp1 by auto
+  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
+  then obtain b where "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" using wfE_elims by metis          
+  hence  "supp v \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using wfE_appI wf_supp1 by metis
+  hence "supp (AE_app f v) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" using e.supp pure_supp by fast
+  then show ?case using  e.supp(2)  UnCI subsetCE subsetI wfE_appI  using b.supp(3) pure_supp x_not_in_b_set by metis
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f xa ba ca s)
+  then obtain b where "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : ( b[bv::=b']\<^sub>b)" using wfE_elims by metis          
+  hence  "supp v \<subseteq> atom_dom \<Gamma> \<union> supp \<B> "  using wfE_appPI wf_supp1 by auto
+  moreover have "supp b' \<subseteq> supp  \<B>" using wf_supp1(7) wfE_appPI by simp
+  ultimately show ?case unfolding  e.supp using  wfE_appPI pure_supp by fast
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+     then  obtain \<tau> where "(u,\<tau>) \<in> setD \<Delta>" using wfE_elims(10) by metis
+  hence "atom u \<in> atom`fst`setD \<Delta>" by force
+  hence "supp (AE_mvar u ) \<subseteq> atom`fst`setD \<Delta>" using e.supp
+    by (simp add: supp_at_base)
+  thus ?case using UnCI subsetCE subsetI e.supp wfE_mvarI supp_at_base subsetCE supp_at_base u_not_in_b_set 
+    by (simp add: supp_at_base)
+next
+  case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
+  then show ?case using wf_supp1 
+    by (metis s_branch_s_branch_list.supp(1) sup.coboundedI2 sup_assoc sup_commute) 
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  then show ?case  by auto
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  then show ?case unfolding  s_branch_s_branch_list.supp (3) using wf_supp1(4)[OF wfS_let2I(3)] by auto
+next
+  case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
+  then show ?case  using wf_supp1(1)[OF wfS_ifI(1)]  by auto
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Delta> \<Phi> s b)
+  then show ?case  using  wf_supp1(1)[OF wfS_varI(2)]  wf_supp1(4)[OF wfS_varI(1)]  by auto
+next
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  hence "supp u \<subseteq> atom ` fst ` setD \<Delta>" proof(induct \<Delta> rule:\<Delta>_induct)
+    case DNil
+    then show ?case by auto
+  next
+    case (DCons u' t' \<Delta>')
+    show ?case proof(cases "u=u'")
+      case True
+      then show ?thesis using toSet.simps DCons supp_at_base by fastforce
+    next
+      case False
+      then show ?thesis  using toSet.simps DCons supp_at_base wfS_assignI 
+        by (metis empty_subsetI fstI image_eqI insert_subset)
+    qed
+  qed
+  then show ?case using s_branch_s_branch_list.supp(8) wfS_assignI wf_supp1(1)[OF wfS_assignI(6)] by auto
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
+  then show ?case using wf_supp1(1)[OF wfS_matchI(1)] by auto
+next
+ case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  moreover have "supp s \<subseteq> supp x \<union> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" 
+    using dom_cons supp_at_base wfS_branchI by auto
+  moreover hence "supp s - set [atom x] \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using supp_at_base by force
+  ultimately have
+     "(supp s - set [atom x]) \<union> (supp dc ) \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>"
+     by (simp add: pure_supp)
+  thus ?case using s_branch_s_branch_list.supp(2) by auto
+next
+  case (wfD_emptyI \<Theta> \<B> \<Gamma>)
+  then show ?case using supp_DNil by auto
+next
+  case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  have "supp ((u, \<tau>)  #\<^sub>\<Delta> \<Delta>) = supp u \<union> supp \<tau> \<union> supp \<Delta>" using supp_DCons supp_Pair by metis
+  also have "... \<subseteq>  supp u \<union> atom ` fst ` setD \<Delta> \<union> atom_dom \<Gamma> \<union> supp \<B>" 
+    using wfD_cons wf_supp1(4)[OF wfD_cons(3)] by auto
+  also have "... \<subseteq> atom ` fst ` setD ((u, \<tau>)  #\<^sub>\<Delta> \<Delta>) \<union> atom_dom \<Gamma> \<union> supp \<B>" using supp_at_base by auto
+  finally show ?case by auto
+next
+  case (wfPhi_emptyI \<Theta>)
+  then show ?case using supp_Nil by auto
+next
+  case (wfPhi_consI f \<Theta> \<Phi> ft)
+  then show ?case using fun_def.supp
+    by (simp add: pure_supp supp_Cons)
+next
+  case (wfFTI \<Theta> B' b s x c \<tau> \<Phi>)
+  have " supp (AF_fun_typ x b c \<tau> s) = supp c \<union> (supp \<tau> \<union> supp s) - set [atom x] \<union> supp b" using fun_typ.supp by auto
+  thus ?case using wfFTI wf_supp1 
+  proof -
+    have f1: "supp \<tau> \<subseteq> {atom x} \<union> atom_dom GNil \<union> supp B'"
+      using dom_cons wfFTI.hyps wf_supp1(4) by blast (* 0.0 ms *)
+    have "supp b \<subseteq> supp B'"
+      using wfFTI.hyps(1) wf_supp1(7) by blast (* 0.0 ms *)
+    then show ?thesis
+      using f1 \<open>supp (AF_fun_typ x b c \<tau> s) = supp c \<union> (supp \<tau> \<union> supp s) - set [atom x] \<union> supp b\<close> 
+             wfFTI.hyps(4) wfFTI.hyps by auto (* 234 ms *)
+  qed 
+next
+  case (wfFTNone \<Theta> \<Phi> ft)
+  then show ?case by (simp add: fun_typ_q.supp(2))
+next
+  case (wfFTSome \<Theta> \<Phi> bv ft)
+  then show ?case using fun_typ_q.supp
+    by (simp add: supp_at_base)
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  then have "supp c \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using wf_supp1 
+    by (metis Un_assoc Un_commute le_supI2)
+  moreover have "supp s  \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" proof 
+    fix z
+    assume *:"z \<in> supp s"
+    have **:"atom x \<notin> supp s" using wfS_assertI fresh_prodN fresh_def by metis
+    have "z \<in> atom_dom ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using wfS_assertI * by blast
+    have "z \<in>  atom_dom ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> z \<in> atom_dom \<Gamma>" using * ** by auto 
+    thus  "z \<in> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using * ** 
+      using \<open>z \<in> atom_dom ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>\<close> by blast
+  qed 
+  ultimately show ?case by auto
+qed(auto)
+
+lemmas wf_supp = wf_supp1 wf_supp2
+
+lemma wfV_supp_nil:
+  fixes v::v
+  assumes "P ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f v : b" 
+  shows "supp v = {}"
+  using wfV_supp[of P " {||}"  GNil v b] dom.simps toSet.simps
+  using assms by auto
+
+lemma wfT_TRUE_aux:
+  assumes "wfG P \<B> \<Gamma>" and "atom z \<sharp> (P, \<B>, \<Gamma>)" and "wfB P \<B> b"
+  shows "wfT P \<B> \<Gamma> (\<lbrace> z : b  | TRUE \<rbrace>)"  
+proof (rule)
+  show \<open> atom z \<sharp> (P, \<B>, \<Gamma>)\<close> using assms by auto
+  show \<open> P; \<B> \<turnstile>\<^sub>w\<^sub>f b \<close> using assms by auto
+  show \<open> P ;\<B> ;  (z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f TRUE \<close> using wfG_cons2I wfC_trueI assms by auto
+qed
+
+lemma wfT_TRUE:
+  assumes "wfG P \<B> \<Gamma>" and "wfB P \<B> b"
+  shows "wfT P \<B> \<Gamma> (\<lbrace> z : b  | TRUE \<rbrace>)" 
+proof -
+  obtain z'::x where *:"atom z' \<sharp> (P, \<B>, \<Gamma>)" using obtain_fresh by metis
+  hence "\<lbrace> z : b  | TRUE \<rbrace> = \<lbrace> z' : b  | TRUE \<rbrace>" by auto
+  thus ?thesis using wfT_TRUE_aux assms * by metis
+qed
+
+lemma phi_flip_eq:
+  assumes "wfPhi T P"
+  shows  "(x \<leftrightarrow> xa) \<bullet> P = P"
+  using wfPhi_supp[OF assms] flip_fresh_fresh fresh_def by blast
+
+lemma wfC_supp_cons:
+  fixes c'::c and G::\<Gamma>
+  assumes "P; \<B> ; (x', b' , TRUE)  #\<^sub>\<Gamma>G \<turnstile>\<^sub>w\<^sub>f c'" 
+  shows "supp c' \<subseteq> atom_dom G \<union> supp x' \<union> supp \<B>" and "supp c' \<subseteq> supp G \<union> supp x' \<union> supp \<B>"
+proof -
+  show "supp c' \<subseteq> atom_dom G \<union> supp x' \<union> supp \<B>"
+    using  wfC_supp[OF assms] dom_cons supp_at_base by blast
+  moreover have "atom_dom G \<subseteq> supp G"
+    by (meson assms wfC_wf wfG_cons wfG_supp)
+  ultimately show "supp c' \<subseteq> supp G \<union> supp x' \<union> supp \<B>" using wfG_supp assms wfG_cons wfC_wf by fast
+qed
+
+lemma wfG_dom_supp:
+  fixes x::x
+  assumes "wfG P \<B> G"
+  shows "atom x \<in> atom_dom G \<longleftrightarrow> atom x \<in> supp G"
+using assms proof(induct G rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using dom.simps  supp_of_atom_list
+    using supp_GNil by auto
+next
+  case (GCons x' b' c' G)
+
+  show ?case proof(cases "x' = x")
+    case True
+    then show ?thesis using dom.simps supp_of_atom_list supp_at_base 
+      using supp_GCons by auto
+  next
+    case False
+    have "(atom x \<in> atom_dom ((x', b', c')   #\<^sub>\<Gamma> G)) = (atom x \<in> atom_dom G)" using atom_dom.simps False by simp
+    also have "... = (atom x \<in> supp  G)" using GCons wfG_elims by metis
+    also have "... = (atom x \<in> (supp (x', b', c') \<union> supp G))" proof
+      show "atom x \<in> supp G \<Longrightarrow> atom x \<in> supp (x', b', c') \<union> supp G" by auto
+      assume "atom x \<in> supp (x', b', c') \<union> supp G"
+      then consider "atom x \<in> supp (x', b', c')" | "atom x \<in> supp G" by auto
+      then show "atom x \<in> supp G" proof(cases)
+        case 1
+        assume " atom x \<in> supp (x', b', c') "
+        hence "atom x \<in>  supp c'" using supp_triple False supp_b_empty supp_at_base by force
+
+        moreover have "P; \<B> ; (x', b' , TRUE)  #\<^sub>\<Gamma>G \<turnstile>\<^sub>w\<^sub>f c'" using wfG_elim2 GCons by simp
+        moreover hence "supp c' \<subseteq> supp G \<union> supp x' \<union> supp \<B>" using wfC_supp_cons by auto
+        ultimately have  "atom x \<in> supp G \<union> supp x' "   using x_not_in_b_set by auto
+        then show ?thesis using False supp_at_base  by (simp add: supp_at_base)
+      next
+        case 2
+        then show ?thesis by simp
+      qed
+    qed
+    also have "... = (atom x \<in> supp ((x', b', c')   #\<^sub>\<Gamma> G))"  using supp_at_base False supp_GCons by simp
+    finally show ?thesis by simp
+  qed
+qed
+
+lemma wfG_atoms_supp_eq : 
+  fixes x::x
+  assumes "wfG P \<B> G"
+  shows "atom x \<in> atom_dom G \<longleftrightarrow> atom x \<in> supp G"
+  using wfG_dom_supp assms by auto
+
+lemma beta_flip_eq:
+  fixes x::x and xa::x and \<B>::\<B>
+  shows  "(x \<leftrightarrow> xa) \<bullet> \<B> = \<B>"
+proof - 
+  have "atom x \<sharp> \<B> \<and> atom xa \<sharp> \<B>" using x_not_in_b_set fresh_def supp_set by metis
+  thus ?thesis  by (simp add: flip_fresh_fresh fresh_def)
+qed
+
+lemma theta_flip_eq2:
+  assumes "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows  " (z \<leftrightarrow> za ) \<bullet> \<Theta> = \<Theta>"
+proof -
+  have "supp \<Theta> = {}" using wfTh_supp assms by simp
+  thus ?thesis 
+      by (simp add: flip_fresh_fresh fresh_def)
+  qed
+
+lemma theta_flip_eq:
+  assumes "wfTh \<Theta>"
+  shows  "(x \<leftrightarrow> xa) \<bullet> \<Theta> = \<Theta>"
+  using wfTh_supp flip_fresh_fresh fresh_def 
+  by (simp add: assms theta_flip_eq2)
+
+lemma wfT_wfC:
+  fixes c::c 
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom z \<sharp> \<Gamma>"
+  shows "\<Theta>; \<B>; (z,b,TRUE)  #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
+proof -
+  obtain za ba ca where *:"\<lbrace> z : b  | c \<rbrace> = \<lbrace> za : ba  | ca \<rbrace> \<and> atom za \<sharp> (\<Theta>,\<B>,\<Gamma>) \<and>  \<Theta>; \<B>; (za, ba, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ca"
+    using wfT_elims[OF assms(1)] by metis
+  hence c1: "[[atom z]]lst. c = [[atom za]]lst. ca" using \<tau>.eq_iff by meson
+  show ?thesis proof(cases "z=za")
+    case True
+    hence "ca = c" using  c1  by (simp add: Abs1_eq_iff(3))
+    then show ?thesis using * True by simp
+  next
+    case False
+    have " \<turnstile>\<^sub>w\<^sub>f \<Theta>" using wfT_wf wfG_wf assms by metis
+    moreover have "atom za \<sharp> \<Gamma>" using * fresh_prodN by auto
+    ultimately have  "\<Theta>; \<B>; (z \<leftrightarrow> za ) \<bullet> (za, ba, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f (z \<leftrightarrow> za ) \<bullet> ca" 
+      using wfC.eqvt theta_flip_eq2  beta_flip_eq * GCons_eqvt assms flip_fresh_fresh  by metis
+    moreover have "atom z \<sharp> ca"     
+    proof -
+      have "supp ca \<subseteq> atom_dom \<Gamma> \<union> { atom za } \<union> supp \<B>" using  * wfC_supp atom_dom.simps toSet.simps by fastforce
+      moreover have "atom z \<notin> atom_dom \<Gamma> " using assms fresh_def wfT_wf  wfG_dom_supp wfC_supp by metis
+      moreover hence  "atom z \<notin> atom_dom \<Gamma> \<union> { atom za }" using False by simp
+      moreover have "atom z \<notin> supp \<B>" using x_not_in_b_set by simp
+      ultimately show ?thesis using fresh_def False by fast
+    qed
+    moreover hence  "(z \<leftrightarrow> za ) \<bullet> ca = c" using type_eq_subst_eq1(3)  * by metis 
+    ultimately show  ?thesis using assms G_cons_flip_fresh * by auto
+  qed
+qed
+
+lemma u_not_in_dom_g:
+  fixes u::u
+  shows  "atom u \<notin> atom_dom  G"
+  using toSet.simps atom_dom.simps u_not_in_x_atoms by auto
+
+lemma bv_not_in_dom_g:
+  fixes bv::bv
+  shows  "atom bv \<notin> atom_dom  G"
+  using toSet.simps atom_dom.simps u_not_in_x_atoms by auto
+  
+text \<open>An important lemma that confirms that @{term \<Gamma>} does not rely on mutable variables\<close>
+lemma u_not_in_g:
+  fixes u::u
+  assumes "wfG \<Theta> B G"
+  shows  "atom u \<notin> supp G"
+using assms proof(induct G rule: \<Gamma>_induct)
+case GNil
+  then show ?case using supp_GNil fresh_def 
+    using fresh_set_empty by fastforce
+next
+  case (GCons x b c \<Gamma>')
+   moreover hence "atom u \<notin> supp b"  using 
+    wfB_supp wfC_supp u_not_in_x_atoms wfG_elims wfX_wfY by auto
+   moreover hence "atom u \<notin> supp x"  using u_not_in_x_atoms supp_at_base by blast
+   moreover hence "atom u \<notin> supp c" proof -
+     have "\<Theta> ; B ; (x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c" using wfG_cons_wfC GCons by simp
+     hence "supp c \<subseteq> atom_dom ((x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>') \<union> supp B" using wfC_supp by blast
+     thus ?thesis using u_not_in_dom_g u_not_in_b_atoms 
+       using u_not_in_b_set by auto
+   qed
+   ultimately have "atom u \<notin> supp (x,b,c)" using supp_Pair by simp
+   thus  ?case using supp_GCons GCons wfG_elims by blast
+qed
+
+text \<open>An important lemma that confirms that types only depend on immutable variables\<close>
+lemma u_not_in_t:
+  fixes u::u
+  assumes "wfT \<Theta> B G \<tau>"
+  shows  "atom u \<notin> supp \<tau>"
+proof -
+  have "supp \<tau> \<subseteq> atom_dom G \<union> supp B" using  wfT_supp assms by auto
+  thus ?thesis using u_not_in_dom_g u_not_in_b_set  by blast 
+qed  
+
+lemma wfT_supp_c:
+  fixes \<B>::\<B> and z::x
+  assumes "wfT P \<B> \<Gamma> (\<lbrace> z : b  | c \<rbrace>)" 
+  shows "supp c - { atom z } \<subseteq> atom_dom \<Gamma> \<union> supp  \<B>"
+  using wf_supp \<tau>.supp assms 
+  by (metis Un_subset_iff empty_set list.simps(15)) 
+
+lemma wfG_wfC[ms_wb]:
+  assumes "wfG P \<B> ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
+  shows "wfC P \<B> ((x,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>) c"
+using assms proof(cases "c \<in> {TRUE,FALSE}")
+  case True
+  have "atom x \<sharp> \<Gamma> \<and> wfG P \<B> \<Gamma> \<and> wfB P \<B> b" using wfG_cons assms by auto
+  hence "wfG P \<B>  ((x,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>)" using wfG_cons2I by auto
+  then show ?thesis using wfC_trueI wfC_falseI True by auto
+next
+  case False
+  then show ?thesis using wfG_elims assms by blast
+qed
+
+lemma wfT_wf_cons: 
+  assumes "wfT P \<B> \<Gamma> \<lbrace> z : b  | c \<rbrace>" and "atom z \<sharp> \<Gamma>"
+  shows "wfG P \<B> ((z,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
+using assms proof(cases "c \<in> { TRUE,FALSE }")
+  case True
+  then show ?thesis using wfT_wfC wfC_wf wfG_wfB  wfG_cons2I assms wfT_wf by fastforce
+next
+  case False
+  then show ?thesis using wfT_wfC wfC_wf wfG_wfB  wfG_cons1I wfT_wf wfT_wfC assms by fastforce
+qed
+
+lemma wfV_b_fresh:
+  fixes b::b and v::v and bv::bv 
+  assumes  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v: b" and "bv |\<notin>| \<B>"
+  shows "atom bv \<sharp> v"
+using wfV_supp  bv_not_in_dom_g fresh_def assms bv_not_in_bset_supp by blast
+
+lemma wfCE_b_fresh:
+  fixes b::b and ce::ce and bv::bv 
+  assumes  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce: b" and "bv |\<notin>| \<B>"
+  shows "atom bv \<sharp> ce"
+using bv_not_in_dom_g fresh_def assms bv_not_in_bset_supp wf_supp1(8) by fast
+ 
+section \<open>Freshness\<close>
+
+lemma wfG_fresh_x:
+  fixes \<Gamma>::\<Gamma> and z::x
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom z \<sharp> \<Gamma>" 
+  shows "atom z \<sharp> (\<Theta>,\<B>, \<Gamma>)"
+unfolding fresh_prodN apply(intro conjI)
+  using wf_supp1 wfX_wfY assms fresh_def x_not_in_b_set by(metis empty_iff)+
+
+lemma wfG_wfT:
+  assumes "wfG P \<B> ((x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> G)" and "atom x \<sharp> c"
+  shows "P; \<B> ; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" 
+proof - 
+  have " P; \<B> ; (x, b, TRUE)   #\<^sub>\<Gamma> G  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var x]\<^sub>c\<^sub>v \<and> wfB P \<B> b" using  assms 
+    using wfG_elim2 by auto
+  moreover have "atom x \<sharp>  (P ,\<B>,G)" using wfG_elims assms wfG_fresh_x by metis
+  ultimately have  "wfT P \<B> G \<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using wfTI assms by metis
+  moreover have "\<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace> = \<lbrace> z : b | c \<rbrace>" using type_eq_subst \<open>atom x \<sharp> c\<close> by auto
+  ultimately show  ?thesis by auto
+qed
+
+lemma wfT_wfT_if:
+  assumes "wfT \<Theta> \<B> \<Gamma> (\<lbrace> z2 : b  | CE_val v  ==  CE_val (V_lit L_false) IMP  c[z::=V_var z2]\<^sub>c\<^sub>v  \<rbrace>)" and "atom z2 \<sharp> (c,\<Gamma>)"
+  shows "wfT \<Theta> \<B> \<Gamma> \<lbrace> z : b |  c \<rbrace>" 
+proof -
+  have *: "atom z2 \<sharp> (\<Theta>, \<B>, \<Gamma>)" using wfG_fresh_x wfX_wfY assms fresh_Pair by metis
+  have "wfB \<Theta> \<B>  b" using assms wfT_elims by metis
+  have "\<Theta>; \<B>; (GCons (z2,b,TRUE) \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  (CE_val v  ==  CE_val (V_lit L_false) IMP  c[z::=V_var z2]\<^sub>c\<^sub>v)"  using wfT_wfC assms fresh_Pair by auto
+  hence "\<Theta>; \<B>; ((z2,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c[z::=V_var z2]\<^sub>c\<^sub>v"  using wfC_elims by metis
+  hence "wfT \<Theta> \<B> \<Gamma>  (\<lbrace> z2 : b  | c[z::=V_var z2]\<^sub>c\<^sub>v\<rbrace>)" using assms fresh_Pair wfTI \<open>wfB \<Theta> \<B> b\<close> * by auto
+  moreover have "\<lbrace> z : b |  c \<rbrace> = \<lbrace> z2 : b | c[z::=V_var z2]\<^sub>c\<^sub>v \<rbrace>"  using type_eq_subst assms fresh_Pair by auto
+  ultimately show ?thesis using wfTI assms by argo
+qed
+
+lemma wfT_fresh_c:
+  fixes x::x
+  assumes "wfT P \<B> \<Gamma> \<lbrace> z : b | c \<rbrace>" and "atom x \<sharp> \<Gamma>" and "x \<noteq> z"
+  shows "atom x \<sharp> c"
+proof(rule ccontr)
+  assume "\<not> atom x \<sharp> c"
+  hence *:"atom x \<in> supp c" using fresh_def by auto
+  moreover have "supp c - set [atom z] \<union> supp b \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"
+    using assms  wfT_supp \<tau>.supp by blast
+  moreover hence "atom x \<in> supp c - set [atom z]" using assms  * by auto
+  ultimately have "atom x \<in> atom_dom \<Gamma>" using x_not_in_b_set by auto
+  thus False using assms wfG_atoms_supp_eq wfT_wf fresh_def by metis
+qed
+
+lemma wfG_x_fresh [simp]: 
+  fixes x::x
+  assumes "wfG P \<B> G"
+  shows "atom x \<notin> atom_dom G \<longleftrightarrow> atom x \<sharp> G"
+  using wfG_atoms_supp_eq assms fresh_def  by metis
+
+lemma wfD_x_fresh:
+  fixes x::x
+  assumes "atom x \<sharp> \<Gamma>" and "wfD P B \<Gamma> \<Delta>"
+  shows "atom x \<sharp> \<Delta>"
+using assms proof(induct \<Delta> rule: \<Delta>_induct)
+  case DNil
+  then show ?case using supp_DNil fresh_def by auto
+next
+  case (DCons u' t'  \<Delta>')
+  have wfg: "wfG P B \<Gamma>" using wfD_wf DCons by blast
+  hence wfd: "wfD P B \<Gamma> \<Delta>'" using wfD_elims DCons by blast
+  have "supp t' \<subseteq> atom_dom \<Gamma> \<union> supp B" using wfT_supp DCons wfD_elims  by metis
+  moreover have "atom x \<notin> atom_dom \<Gamma>" using DCons(2) fresh_def wfG_supp wfg by blast
+  ultimately have  "atom x \<sharp> t'" using fresh_def DCons wfG_supp wfg x_not_in_b_set by blast
+  moreover have "atom x \<sharp> u'" using supp_at_base fresh_def by fastforce
+  ultimately have "atom x \<sharp> (u',t')" using supp_Pair by fastforce
+  thus ?case using DCons fresh_DCons wfd by fast
+qed
+
+lemma wfG_fresh_x2:
+  fixes \<Gamma>::\<Gamma> and z::x and \<Delta>::\<Delta> and \<Phi>::\<Phi>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" and "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "atom z \<sharp> \<Gamma>" 
+  shows "atom z \<sharp> (\<Theta>,\<Phi>,\<B>, \<Gamma>,\<Delta>)"
+  unfolding fresh_prodN apply(intro conjI)
+  using wfG_fresh_x assms fresh_prod3 wfX_wfY apply metis
+  using wf_supp2(5)  assms fresh_def apply blast
+  using assms wfG_fresh_x wfX_wfY fresh_prod3 apply metis
+  using assms wfG_fresh_x wfX_wfY fresh_prod3 apply metis
+  using wf_supp2(6)  assms fresh_def wfD_x_fresh by metis
+
+lemma wfV_x_fresh:
+  fixes v::v and b::b and \<Gamma>::\<Gamma> and x::x
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> v"
+proof -
+  have "supp v \<subseteq> atom_dom \<Gamma> \<union> supp  \<B> " using assms wfV_supp by auto
+  moreover have "atom x \<notin> atom_dom \<Gamma>" using fresh_def assms
+     dom.simps subsetCE  wfG_elims wfG_supp  by (metis dom_supp_g)
+  moreover have "atom x \<notin> supp \<B>" using x_not_in_b_set by auto
+  ultimately show ?thesis using fresh_def by fast
+qed
+
+lemma wfE_x_fresh:
+  fixes e::e and b::b and \<Gamma>::\<Gamma> and \<Delta>::\<Delta> and \<Phi>::\<Phi>  and x::x
+  assumes "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> e"
+proof -
+  have "wfG \<Theta> \<B> \<Gamma>" using assms wfE_wf by auto
+  hence "supp e \<subseteq> atom_dom \<Gamma> \<union> supp \<B> \<union> atom`fst`setD \<Delta>" using wfE_supp dom.simps assms by auto
+  moreover have "atom x \<notin> atom_dom \<Gamma>" using fresh_def assms
+     dom.simps subsetCE  \<open>wfG \<Theta> \<B> \<Gamma>\<close>  wfG_supp  by (metis dom_supp_g)
+  moreover have "atom x \<notin> atom`fst`setD \<Delta>" by auto
+  ultimately show ?thesis using fresh_def x_not_in_b_set by fast 
+qed
+
+lemma wfT_x_fresh:
+  fixes \<tau>::\<tau> and \<Gamma>::\<Gamma> and  x::x
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> \<tau>"
+proof -
+  have "wfG \<Theta> \<B> \<Gamma>" using assms wfX_wfY by auto
+  hence "supp \<tau> \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" using wfT_supp dom.simps assms by auto
+  moreover have "atom x \<notin> atom_dom \<Gamma>" using fresh_def assms
+     dom.simps subsetCE  \<open>wfG \<Theta> \<B> \<Gamma>\<close>  wfG_supp  by (metis dom_supp_g)
+  moreover have "atom x \<notin> supp \<B>" using x_not_in_b_set by simp
+  ultimately show ?thesis using fresh_def by fast 
+qed
+
+lemma wfS_x_fresh:
+  fixes s::s  and \<Delta>::\<Delta> and x::x
+  assumes "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f s : b" and "atom x \<sharp> \<Gamma>"
+  shows "atom x \<sharp> s"
+proof - 
+  have "supp s \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>"  using  wf_supp assms by metis
+  moreover have "atom x \<notin> atom ` fst ` setD \<Delta>" by auto
+  moreover have "atom x \<notin> atom_dom \<Gamma>" using assms fresh_def wfG_dom_supp wfX_wfY by metis
+  moreover have "atom x \<notin> supp \<B>" using supp_b_empty supp_fset 
+    by (simp add: x_not_in_b_set)
+  ultimately show ?thesis using fresh_def by fast 
+qed
+
+lemma wfTh_fresh:
+  fixes x
+  assumes "wfTh T"
+  shows "atom x \<sharp> T"
+  using wf_supp1 assms fresh_def by fastforce
+
+lemmas wfTh_x_fresh = wfTh_fresh
+
+lemma wfPhi_fresh:
+  fixes x
+  assumes "wfPhi T P"
+  shows "atom x \<sharp> P"
+  using wf_supp assms fresh_def by fastforce
+
+lemmas wfPhi_x_fresh = wfPhi_fresh
+lemmas wb_x_fresh = wfTh_x_fresh wfPhi_x_fresh wfD_x_fresh wfT_x_fresh wfV_x_fresh
+
+lemma wfG_inside_fresh[ms_fresh]:
+  fixes \<Gamma>::\<Gamma> and x::x
+  assumes "wfG P \<B> (\<Gamma>'@((x,b,c)  #\<^sub>\<Gamma>\<Gamma>))"
+  shows "atom x \<notin> atom_dom \<Gamma>'"
+using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x1 b1 c1 \<Gamma>1)
+  moreover hence "atom x \<notin> atom ` fst `({(x1,b1,c1)})" proof -
+    have *: "P; \<B>  \<turnstile>\<^sub>w\<^sub>f (\<Gamma>1 @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using wfG_elims append_g.simps GCons by metis
+    have "atom x1 \<sharp>  (\<Gamma>1 @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using GCons wfG_elims append_g.simps by metis
+    hence "atom x1 \<notin> atom_dom  (\<Gamma>1 @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using wfG_dom_supp fresh_def * by metis
+    thus ?thesis by auto
+  qed
+  ultimately show ?case using append_g.simps atom_dom.simps toSet.simps wfG_elims dom.simps
+    by (metis image_insert insert_iff insert_is_Un)
+qed
+
+lemma wfG_inside_x_in_atom_dom:
+  fixes c::c and x::x  and \<Gamma>::\<Gamma> 
+  shows "atom x \<in> atom_dom ( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>)"
+  by(induct \<Gamma>'  rule: \<Gamma>_induct, (simp add: toSet.simps atom_dom.simps)+)
+
+lemma wfG_inside_x_neq:
+  fixes c::c and x::x  and \<Gamma>::\<Gamma> and G::\<Gamma> and xa::x
+  assumes "G=( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>)" and "atom xa \<sharp> G" and " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G"
+  shows "xa \<noteq> x"
+proof - 
+  have "atom xa \<notin> atom_dom G"  using fresh_def wfG_atoms_supp_eq assms by metis
+  moreover have "atom x \<in> atom_dom G" using wfG_inside_x_in_atom_dom assms by simp
+  ultimately show ?thesis by auto
+qed
+
+lemma wfG_inside_x_fresh:
+  fixes c::c and x::x  and \<Gamma>::\<Gamma> and G::\<Gamma> and xa::x
+  assumes "G=( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>)" and "atom xa \<sharp> G" and " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G"
+  shows "atom xa \<sharp> x"
+  using fresh_def supp_at_base wfG_inside_x_neq assms by auto
+
+lemma wfT_nil_supp:
+  fixes t::\<tau>
+  assumes "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f t" 
+  shows "supp t = {}"
+  using wfT_supp atom_dom.simps assms toSet.simps by force
+
+section \<open>Misc\<close>
+
+lemma wfG_cons_append:
+  fixes b'::b
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x', b', c')   #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>"
+  shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)  \<and> atom x' \<sharp> (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>) \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b' \<and> x' \<noteq> x"
+proof - 
+  have "((x', b', c')   #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma> = (x', b', c')   #\<^sub>\<Gamma> (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using append_g.simps by auto
+  hence *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)  \<and> atom x' \<sharp> (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>) \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b'" using assms wfG_cons by metis
+  moreover have "atom x' \<sharp> x" proof(rule wfG_inside_x_fresh[of "(\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)"])
+    show "\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma> = \<Gamma>' @ (x, b, c[x::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>" by simp
+      show "  atom x' \<sharp> \<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>" using * by auto
+      show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>  " using * by auto
+    qed
+  ultimately show  ?thesis by auto
+qed
+
+lemma flip_u_eq:
+  fixes  u::u and u'::u and \<Theta>::\<Theta> and \<tau>::\<tau>
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" 
+  shows "(u \<leftrightarrow> u') \<bullet> \<tau> = \<tau>" and  "(u \<leftrightarrow> u') \<bullet> \<Gamma> = \<Gamma>"  and "(u \<leftrightarrow> u') \<bullet> \<Theta> = \<Theta>" and "(u \<leftrightarrow> u') \<bullet> \<B> = \<B>"
+proof -
+  show "(u \<leftrightarrow> u') \<bullet> \<tau> = \<tau>" using wfT_supp flip_fresh_fresh
+    by (metis assms(1) fresh_def u_not_in_t)
+  show "(u \<leftrightarrow> u') \<bullet> \<Gamma> = \<Gamma>" using u_not_in_g wfX_wfY assms flip_fresh_fresh fresh_def by metis
+  show  "(u \<leftrightarrow> u') \<bullet> \<Theta> = \<Theta>" using theta_flip_eq assms wfX_wfY by metis
+  show  "(u \<leftrightarrow> u') \<bullet> \<B> = \<B>" using u_not_in_b_set flip_fresh_fresh fresh_def by metis
+qed
+
+lemma wfT_wf_cons_flip: 
+  fixes c::c and x::x
+  assumes "wfT P \<B> \<Gamma> \<lbrace> z : b  | c \<rbrace>" and "atom x \<sharp> (c,\<Gamma>)"
+  shows "wfG P \<B> ((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma>\<Gamma>)"
+proof -
+  have "\<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace> = \<lbrace> z : b  | c \<rbrace>" using assms freshers type_eq_subst by metis
+  hence *:"wfT P \<B> \<Gamma>  \<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using assms by metis
+  show ?thesis proof(rule wfG_consI)
+    show \<open> P; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<close> using assms wfT_wf by auto
+    show \<open>atom x \<sharp> \<Gamma>\<close> using assms   by auto
+    show \<open> P; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using assms wfX_wfY b_of.simps  by metis
+    show \<open> P; \<B> ; (x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var x]\<^sub>c\<^sub>v \<close> using wfT_wfC * assms fresh_Pair by metis
+  qed
+qed
+
+section \<open>Context Strengthening\<close>
+
+text \<open>We can remove an entry for a variable from the context if the variable doesn't appear in the 
+term and the variable is not used later in the context or any other context\<close>
+
+lemma fresh_restrict:
+  fixes y::"'a::at_base" and \<Gamma>::\<Gamma>
+  assumes  "atom y \<sharp>  (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)"
+  shows "atom y \<sharp> (\<Gamma>'@\<Gamma>)"
+using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using fresh_GCons fresh_GNil by auto
+next
+  case (GCons x' b' c' \<Gamma>'')
+  then show ?case using fresh_GCons fresh_GNil by auto
+qed
+
+lemma wf_restrict1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+        and cs::branch_s and css::branch_list
+  shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b        \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> v \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1  \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f  v : b" and
+       
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> c\<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> \<Theta> ;  \<B> ; \<Gamma>\<^sub>1@\<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f  c" and
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow>  atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>\<^sub>1@\<Gamma>\<^sub>2" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> \<tau>\<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow>  \<Theta>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and
+       
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True" and
+        
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> ce  \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f  ce : b"  and 
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
+proof(induct   arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 
+               rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
+  case (wfV_varI \<Theta> \<B> \<Gamma> b c y)
+  hence "y\<noteq>x" using v.fresh by auto
+  hence "Some (b, c) = lookup (\<Gamma>\<^sub>1@\<Gamma>\<^sub>2) y" using lookup_restrict wfV_varI by metis
+  then show ?case using wfV_varI wf_intros by metis
+next
+  case (wfV_litI \<Theta> \<Gamma> l)
+  then show ?case using e.fresh wf_intros by metis
+next
+  case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
+  show ?case proof
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v1 : b1" using wfV_pairI by auto
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v2 : b2" using wfV_pairI by auto
+  qed
+next
+  case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
+  show ?case proof
+    show "AF_typedef s dclist \<in> set \<Theta>" using wfV_consI by auto
+    show "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist" using wfV_consI by auto
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v : b" using wfV_consI by auto
+  qed
+next
+   case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+    show ?case proof
+    show "AF_typedef_poly s bv dclist \<in> set \<Theta>" using wfV_conspI by auto
+    show "(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist" using wfV_conspI by auto
+    show "\<Theta>; \<B>    \<turnstile>\<^sub>w\<^sub>f  b" using wfV_conspI by auto
+    show " \<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b" using wfV_conspI by auto
+    show "atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2, b, v)" unfolding fresh_prodN fresh_append_g  using wfV_conspI fresh_prodN fresh_GCons fresh_append_g by metis
+  qed
+next 
+  case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
+  then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
+   then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
+   then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
+ then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
+  then show ?case using ce.fresh wf_intros by metis
+next
+  case (wfTI z \<Theta> \<B> \<Gamma> b c)
+  hence "x \<noteq> z" using wfTI
+   fresh_GCons fresh_prodN fresh_PairD(1) fresh_gamma_append not_self_fresh by metis
+  show ?case proof
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2)\<close> using wfTI fresh_restrict[of z] using wfG_fresh_x wfX_wfY wfTI fresh_prodN by metis
+    show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<close> using wfTI by auto
+    have "\<Theta>; \<B>; ((z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>\<^sub>1) @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f c " proof(rule  wfTI(5)[of "(z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>\<^sub>1" ])
+      show \<open>(z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma> = ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1) @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2\<close> using wfTI by auto
+      show \<open>atom x \<sharp> c\<close> using wfTI \<tau>.fresh \<open>x \<noteq> z\<close> by auto
+      show \<open>atom x \<sharp> (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1\<close> using wfTI \<open>x \<noteq> z\<close> fresh_GCons by simp
+    qed
+    thus  \<open> \<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f c \<close>  by auto
+  qed
+next
+  case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
+  show ?case proof
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f e1 : b " using wfC_eqI c.fresh fresh_Nil by auto
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f e2 : b " using wfC_eqI c.fresh fresh_Nil by auto
+  qed
+next
+  case (wfC_trueI \<Theta> \<Gamma>)
+  then show ?case using c.fresh wf_intros by metis
+next
+  case (wfC_falseI \<Theta> \<Gamma>)
+  then show ?case using c.fresh wf_intros by metis
+next
+  case (wfC_conjI \<Theta> \<Gamma> c1 c2)
+  then show ?case using c.fresh wf_intros by metis
+next
+  case (wfC_disjI \<Theta> \<Gamma> c1 c2)
+  then show ?case using c.fresh wf_intros by metis
+next
+case (wfC_notI \<Theta> \<Gamma> c1)
+  then show ?case using c.fresh wf_intros by metis
+next
+  case (wfC_impI \<Theta> \<Gamma> c1 c2)
+  then show ?case using c.fresh wf_intros by metis
+next
+  case (wfG_nilI \<Theta>)
+  then show ?case using wfV_varI wf_intros 
+    by (meson GNil_append \<Gamma>.simps(3))
+next
+  case (wfG_cons1I c1 \<Theta> \<B> G x1 b1)
+  show  ?case proof(cases "\<Gamma>\<^sub>1=GNil")
+    case True
+    then show ?thesis using wfG_cons1I wfG_consI by auto
+  next
+    case False
+    then obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>\<^sub>1" using  GCons_eq_append_conv wfG_cons1I by auto
+    hence **:"G=G' @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons1I by auto
+
+    have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x1, b1, c1)  #\<^sub>\<Gamma> (G' @ \<Gamma>\<^sub>2)" proof(rule Wellformed.wfG_cons1I)
+      show \<open>c1 \<notin> {TRUE, FALSE}\<close> using wfG_cons1I by auto
+      show \<open>atom x1 \<sharp> G' @ \<Gamma>\<^sub>2\<close> using wfG_cons1I(4) ** fresh_restrict by metis
+      have " atom x \<sharp> G'" using wfG_cons1I *  using fresh_GCons by blast
+      thus  \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G' @ \<Gamma>\<^sub>2 \<close> using wfG_cons1I(3)[of G'] **  by auto
+      have "atom x \<sharp> c1 \<and> atom x \<sharp> (x1, b1, TRUE)  #\<^sub>\<Gamma> G'" using fresh_GCons \<open>atom x \<sharp> \<Gamma>\<^sub>1\<close> * by auto
+      thus  \<open> \<Theta>; \<B>; (x1, b1, TRUE)  #\<^sub>\<Gamma> G' @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f c1 \<close> using wfG_cons1I(6)[of "(x1, b1, TRUE)  #\<^sub>\<Gamma> G'"]  ** * wfG_cons1I by auto
+      show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfG_cons1I by auto
+    qed
+    thus ?thesis using * by auto
+  qed
+next
+  case (wfG_cons2I c1 \<Theta> \<B> G x1 b1)
+  show  ?case proof(cases "\<Gamma>\<^sub>1=GNil")
+    case True
+    then show ?thesis using wfG_cons2I wfG_consI by auto
+  next
+    case False
+    then obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>\<^sub>1" using  GCons_eq_append_conv wfG_cons2I by auto
+    hence **:"G=G' @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons2I by auto
+
+    have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x1, b1, c1)  #\<^sub>\<Gamma> (G' @ \<Gamma>\<^sub>2)" proof(rule Wellformed.wfG_cons2I)
+      show \<open>c1 \<in> {TRUE, FALSE}\<close> using wfG_cons2I by auto
+      show \<open>atom x1 \<sharp> G' @ \<Gamma>\<^sub>2\<close> using wfG_cons2I ** fresh_restrict by metis
+      have " atom x \<sharp> G'" using wfG_cons2I *  using fresh_GCons by blast
+      thus  \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G' @ \<Gamma>\<^sub>2 \<close> using wfG_cons2I **  by auto     
+      show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfG_cons2I by auto
+    qed
+    thus ?thesis using * by auto
+  qed
+qed(auto)+
+
+lemma wf_restrict2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+        and cs::branch_s and css::branch_list
+  shows          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> e  \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> atom x \<sharp> \<Delta> \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 ;  \<Delta> \<turnstile>\<^sub>w\<^sub>f  e : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b   \<Longrightarrow> True" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> True" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> True" and     
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True " and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> atom x \<sharp> \<Delta> \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and       
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> True" 
+    
+proof(induct   arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 
+               rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)
+  case (wfE_valI \<Theta> \<Phi> \<Gamma> \<Delta> v b)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_leqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b v2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_lenI \<Theta> \<Phi> \<Gamma> \<Delta> v1)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<Gamma> \<Delta> f x b c \<tau> s' v)
+  then show ?case using e.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  show ?case proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close>  using wfE_appPI by auto
+
+    have "atom bv \<sharp>  \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2" using  wfE_appPI fresh_prodN fresh_restrict  by metis
+    thus  \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close>  
+      using wfE_appPI fresh_prodN by auto
+
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close>  using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close>  using wfE_appPI wf_restrict1 by auto
+  qed
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<Gamma> \<Delta> u \<tau>)
+  then show ?case using e.fresh wf_intros by metis
+next
+  case (wfD_emptyI \<Theta> \<Gamma>)
+  then show ?case using c.fresh wf_intros wf_restrict1 by metis
+next
+  case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  show ?case proof
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f \<Delta>" using wfD_cons fresh_DCons by metis
+    show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f \<tau> " using wfD_cons fresh_DCons fresh_Pair wf_restrict1 by metis
+    show "u \<notin> fst ` setD \<Delta>" using wfD_cons by auto
+  qed
+next
+  case (wfFTNone \<Theta> ft)
+  then show ?case by auto
+next
+  case (wfFTSome \<Theta> bv ft)
+  then show ?case by auto
+next
+  case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
+  then show ?case by auto
+qed(auto)+
+
+lemmas wf_restrict=wf_restrict1 wf_restrict2
+
+lemma wfT_restrict2:
+  fixes \<tau>::\<tau>
+  assumes "wfT \<Theta> \<B> ((x, b, c) #\<^sub>\<Gamma> \<Gamma>) \<tau>" and "atom x \<sharp> \<tau>" 
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>"
+  using wf_restrict1(4)[of \<Theta> \<B> "((x, b, c) #\<^sub>\<Gamma> \<Gamma>)"  \<tau> GNil x "b" "c" \<Gamma>] assms fresh_GNil append_g.simps by auto
+
+lemma wfG_intros2:
+  assumes "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c"
+  shows  "wfG P \<B>  ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)"
+proof - 
+  have "wfG P \<B>   ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>)" using wfC_wf  assms by auto
+  hence *:"wfG P \<B> \<Gamma> \<and> atom x \<sharp> \<Gamma> \<and> wfB P \<B> b" using wfG_elims by metis
+  show ?thesis using assms proof(cases "c \<in> {TRUE,FALSE}")
+    case True 
+    then show ?thesis using wfG_cons2I * by auto
+  next
+    case False
+    then show ?thesis using wfG_cons1I * assms by auto
+  qed
+qed
+
+section \<open>Type Definitions\<close>
+
+lemma wf_theta_weakening1: 
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B> :: \<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+         and cs::branch_s and css::branch_list and t::\<tau>
+
+  shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  c" and
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B>   \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow>  \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ;  \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts" and 
+         "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True " and
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b  \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B>  \<turnstile>\<^sub>w\<^sub>f b"  and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>'  \<turnstile>\<^sub>w\<^sub>f td"
+proof(nominal_induct b and c and \<Gamma> and \<tau> and ts and P and b and b and td 
+      avoiding: \<Theta>'     
+      rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
+  show ?case proof
+    show \<open>AF_typedef s dclist \<in> set \<Theta>'\<close> using wfV_consI by auto
+    show \<open>(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist\<close> using wfV_consI by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b \<close> using wfV_consI by auto
+  qed
+next
+  case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+    show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>'\<close> using wfV_conspI by auto
+    show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
+    show \<open>\<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b  \<close> using wfV_conspI by auto
+    show "\<Theta>' ;  \<B>  \<turnstile>\<^sub>w\<^sub>f b "  using wfV_conspI by auto
+    show "atom bv \<sharp> (\<Theta>', \<B>, \<Gamma>, b, v)" using wfV_conspI fresh_prodN by auto
+  qed
+next
+  case (wfTI z \<Theta> \<B> \<Gamma> b c)
+  thus ?case using Wellformed.wfTI by auto
+next
+  case (wfB_consI \<Theta> s dclist)
+  show ?case proof 
+    show \<open>   \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<close> using wfB_consI by auto
+    show \<open>AF_typedef s dclist \<in> set \<Theta>'\<close>  using wfB_consI by auto
+  qed
+next   
+  case (wfB_appI \<Theta> \<B> b s bv dclist)
+  show ?case proof 
+    show \<open>   \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<close> using wfB_appI by auto
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>'\<close>  using wfB_appI by auto
+    show "\<Theta>' ;   \<B>  \<turnstile>\<^sub>w\<^sub>f b" using wfB_appI by simp
+  qed
+qed(metis wf_intros)+
+
+lemma wf_theta_weakening2: 
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B> :: \<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+         and cs::branch_s and css::branch_list and t::\<tau>
+  shows 
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and     
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>)" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and
+         "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq" and
+         "\<Theta> ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft" 
+ 
+proof(nominal_induct b and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
+      avoiding: \<Theta>'     
+rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  show ?case proof
+    show \<open> \<Theta>'  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>' ; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI wf_theta_weakening1 by auto
+    show \<open>atom bv \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> using wfE_appPI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close> using wfE_appPI wf_theta_weakening1 by auto
+  qed
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid  dclist \<Delta> \<Phi> cs b)
+  show ?case proof
+    show \<open> \<Theta>' ; \<B> ;  \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_id tid \<close> using wfS_matchI wf_theta_weakening1 by auto
+    show \<open>AF_typedef tid dclist \<in> set \<Theta>'\<close> using wfS_matchI by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_matchI by auto
+    show \<open> \<Theta>'  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfS_matchI by auto
+    show \<open>\<Theta>'; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid; dclist \<turnstile>\<^sub>w\<^sub>f cs : b \<close> using wfS_matchI by auto
+  qed
+next
+   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  show ?case proof
+    show \<open> \<Theta>' ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI wf_theta_weakening1 by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close> using wfS_varI wf_theta_weakening1 by auto
+    show \<open>atom u \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, \<tau>, v, b)\<close> using wfS_varI by auto
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_varI by auto
+  qed
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  show ?case proof
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_letI by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_letI by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, e, b)\<close> using wfS_letI by auto
+  qed
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  show ?case proof
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_let2I wf_theta_weakening1 by auto
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b \<close> using wfS_let2I by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, s1, b, \<tau>)\<close> using wfS_let2I by auto
+  qed
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  show ?case proof
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_branchI by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, \<Gamma>, \<tau>)\<close> using wfS_branchI by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_branchI by auto
+  qed
+next
+   case (wfPhi_consI f \<Phi> \<Theta> ft)
+  show ?case proof
+    show "f \<notin> name_of_fun ` set \<Phi>" using wfPhi_consI by auto
+    show "\<Theta>' ; \<Phi> \<turnstile>\<^sub>w\<^sub>f ft"  using wfPhi_consI by auto
+    show "\<Theta>' \<turnstile>\<^sub>w\<^sub>f \<Phi>"  using wfPhi_consI by auto
+  qed
+next
+  case (wfFTNone \<Theta> ft)
+  then show ?case using  wf_intros by metis
+next
+  case (wfFTSome \<Theta> bv ft)
+  then show ?case using wf_intros by metis
+next
+  case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
+  thus ?case using Wellformed.wfFTI wf_theta_weakening1 by simp
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  show ?case proof  
+    show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_assertI wf_theta_weakening1 by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI wf_theta_weakening1 by auto
+    show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_assertI wf_theta_weakening1 by auto
+    have "atom x \<sharp> \<Theta>'" using wf_supp(6)[OF \<open>\<turnstile>\<^sub>w\<^sub>f \<Theta>' \<close>] fresh_def by auto
+    thus  \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, c, b, s)\<close> using wfS_assertI fresh_prodN fresh_def by simp
+  qed
+qed(metis wf_intros wf_theta_weakening1 )+
+
+lemmas wf_theta_weakening = wf_theta_weakening1 wf_theta_weakening2
+
+lemma lookup_wfTD:
+  fixes td::type_def
+  assumes  "td \<in> set \<Theta>" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "\<Theta> \<turnstile>\<^sub>w\<^sub>f td"
+ using assms  proof(induct \<Theta> )
+  case Nil
+  then show ?case by auto
+next
+  case (Cons td'  \<Theta>')
+  then consider "td = td'" | "td \<in> set \<Theta>'" by auto
+  then have "\<Theta>' \<turnstile>\<^sub>w\<^sub>f td" proof(cases)
+    case 1
+    then show ?thesis using Cons using wfTh_elims by auto
+  next
+    case 2
+    then show ?thesis using Cons using wfTh_elims by auto
+  qed
+  then show ?case using wf_theta_weakening Cons  by (meson set_subset_Cons)
+qed
+
+subsection \<open>Simple\<close>
+
+lemma wfTh_dclist_unique:
+  assumes   "wfTh \<Theta>" and "AF_typedef tid dclist1 \<in> set \<Theta>" and  "AF_typedef tid dclist2 \<in> set \<Theta>" 
+  shows "dclist1 = dclist2"
+using assms proof(induct \<Theta> rule: \<Theta>_induct)
+  case TNil
+  then show ?case by auto
+next
+  case (AF_typedef tid' dclist' \<Theta>')
+  then show ?case using wfTh_elims
+    by (metis image_eqI name_of_type.simps(1) set_ConsD type_def.eq_iff(1))
+next
+  case (AF_typedef_poly tid bv dclist \<Theta>')
+  then show ?case using wfTh_elims by auto
+qed
+
+lemma wfTs_ctor_unique:
+  fixes dclist::"(string*\<tau>) list"
+  assumes  "\<Theta> ; {||}  ; GNil \<turnstile>\<^sub>w\<^sub>f  dclist" and "(c, t1) \<in> set dclist"  and "(c,t2) \<in> set dclist"  
+  shows "t1 = t2" 
+  using assms proof(induct dclist rule: list.inducts)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons x1 x2)
+  consider "x1 = (c,t1)" | "x1 = (c,t2)" | "x1 \<noteq> (c,t1) \<and> x1 \<noteq> (c,t2)" by auto
+  thus ?case proof(cases)
+    case 1
+    then show ?thesis using Cons wfTs_elims set_ConsD
+      by (metis fst_conv image_eqI prod.inject)
+  next
+    case 2
+      then show ?thesis using Cons wfTs_elims set_ConsD
+      by (metis fst_conv image_eqI prod.inject)
+  next
+    case 3
+    then show ?thesis using Cons wfTs_elims by (metis set_ConsD)
+  qed
+qed
+
+lemma wfTD_ctor_unique:
+  assumes  "\<Theta> \<turnstile>\<^sub>w\<^sub>f (AF_typedef tid dclist)" and "(c, t1) \<in> set dclist"  and "(c,t2) \<in> set dclist"  
+  shows "t1 = t2" 
+  using wfTD_elims wfTs_elims assms  wfTs_ctor_unique by metis
+
+lemma wfTh_ctor_unique:
+  assumes   "wfTh \<Theta>" and "AF_typedef tid dclist \<in> set \<Theta>" and "(c, t1) \<in> set dclist"  and "(c,t2) \<in> set dclist"  
+  shows "t1 = t2" 
+  using lookup_wfTD wfTD_ctor_unique assms by metis
+
+lemma wfTs_supp_t:
+  fixes dclist::"(string*\<tau>) list"
+  assumes "(c,t) \<in> set dclist" and "\<Theta> ; B ; GNil \<turnstile>\<^sub>w\<^sub>f dclist" 
+  shows "supp t \<subseteq> supp B"
+using assms proof(induct dclist arbitrary: c t rule:list.induct)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons ct dclist')
+  then consider "ct = (c,t)" | "(c,t) \<in> set dclist'" by auto
+  then show ?case proof(cases)
+    case 1
+    then have "\<Theta> ; B ; GNil \<turnstile>\<^sub>w\<^sub>f t" using Cons wfTs_elims by blast
+    thus ?thesis using wfT_supp atom_dom.simps by force
+  next
+    case 2
+    then show ?thesis using Cons wfTs_elims by metis
+  qed
+qed
+
+lemma wfTh_lookup_supp_empty:
+  fixes t::\<tau>
+  assumes  "AF_typedef tid dclist \<in> set \<Theta>" and "(c,t) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "supp t = {}" 
+proof - 
+  have "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f dclist" using assms lookup_wfTD  wfTD_elims by metis
+  thus ?thesis using wfTs_supp_t assms by force
+qed
+
+lemma wfTh_supp_b:
+  assumes  "AF_typedef tid dclist \<in> set \<Theta>" and "(dc,\<lbrace> z : b | c \<rbrace> ) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "supp b = {}" 
+  using assms wfTh_lookup_supp_empty \<tau>.supp by blast
+
+lemma wfTh_b_eq_iff:
+  fixes bva1::bv and bva2::bv and dc::string 
+  assumes "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1" and "(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" and
+   "wfTs P {|bva1|} GNil dclist1" and  "wfTs P {|bva2|} GNil dclist2" 
+  "[[atom bva1]]lst.dclist1 = [[atom bva2]]lst.dclist2"
+ shows  "[[atom bva1]]lst. (dc,\<lbrace> x1 : b1  | c1 \<rbrace>) = [[atom bva2]]lst. (dc,\<lbrace> x2 : b2  | c2 \<rbrace>)"
+using assms proof(induct dclist1 arbitrary: dclist2)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons dct1' dclist1')
+  show ?case proof(cases "dclist2 = []")
+    case True
+    then show ?thesis using Cons by auto
+  next
+    case False
+    then obtain dct2' and dclist2' where cons:"dct2' # dclist2' = dclist2" using list.exhaust by metis
+    hence *:"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'" 
+      using Cons lst_head_cons Cons cons by metis
+    hence **: "fst dct1' = fst dct2'" using lst_fst[THEN lst_pure] 
+      by (metis (no_types) \<open>[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'\<close> 
+            \<open>\<And>x2 x1 t2' t2a t2 t1. [[atom x1]]lst. (t1, t2a) = [[atom x2]]lst. (t2, t2') \<Longrightarrow> t1 = t2\<close> fst_conv surj_pair)    
+    show ?thesis proof(cases "fst dct1' = dc")
+      case True
+      have "dc \<notin> fst ` set dclist1'" using  wfTs_elims Cons by (metis True fstI)
+      hence 1:"(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) = dct1'" using Cons by (metis fstI image_iff set_ConsD)
+      have "dc \<notin> fst ` set dclist2'" using  wfTs_elims Cons cons 
+        by (metis "**" True fstI)
+      hence 2:"(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) = dct2' " using Cons cons  by (metis  fst_conv image_eqI set_ConsD)
+      then show ?thesis using Cons *  1 2   by blast
+    next
+      case False
+      hence "fst dct2' \<noteq> dc" using **  by auto
+      hence "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1' \<and> (dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2' " using Cons cons False 
+        by (metis fstI set_ConsD)
+      moreover have "[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2'" using * False  by metis
+      ultimately  show ?thesis using Cons ** *  
+        using cons wfTs_elims(2) by blast
+    qed
+  qed
+qed
+
+
+subsection \<open>Polymorphic\<close>
+
+lemma wfTh_wfTs_poly:
+  fixes dclist::"(string * \<tau>) list"
+  assumes "AF_typedef_poly tyid bva dclist \<in> set P" and "\<turnstile>\<^sub>w\<^sub>f P"
+  shows  "P ; {|bva|}  ; GNil \<turnstile>\<^sub>w\<^sub>f  dclist"
+proof -
+  have *:"P \<turnstile>\<^sub>w\<^sub>f AF_typedef_poly tyid bva dclist" using lookup_wfTD assms by simp
+
+  obtain bv lst where *:"P ; {|bv|}  ; GNil \<turnstile>\<^sub>w\<^sub>f lst  \<and> 
+       (\<forall>c. atom c \<sharp> (dclist, lst) \<longrightarrow> atom c \<sharp> (bva, bv, dclist, lst) \<longrightarrow> (bva \<leftrightarrow> c) \<bullet> dclist = (bv \<leftrightarrow> c) \<bullet> lst)"  
+    using wfTD_elims(2)[OF *] by metis
+
+  obtain c::bv where  **:"atom c \<sharp> ((dclist, lst),(bva, bv, dclist, lst))" using obtain_fresh by metis
+  have "P ; {|bv|}  ; GNil \<turnstile>\<^sub>w\<^sub>f lst" using * by metis
+  hence "wfTs ((bv \<leftrightarrow> c) \<bullet> P)  ((bv \<leftrightarrow> c) \<bullet> {|bv|})  ((bv \<leftrightarrow> c) \<bullet> GNil) ((bv \<leftrightarrow> c) \<bullet> lst)" using ** wfTs.eqvt by metis
+  hence "wfTs P  {|c|}  GNil ((bva \<leftrightarrow> c) \<bullet> dclist)" using * theta_flip_eq fresh_GNil assms 
+  proof -
+    have "\<forall>b ba. (ba::bv \<leftrightarrow> b) \<bullet> P = P"  by (metis \<open>\<turnstile>\<^sub>w\<^sub>f P\<close> theta_flip_eq)
+    then show ?thesis
+      using "*" "**" \<open>(bv \<leftrightarrow> c) \<bullet> P ; (bv \<leftrightarrow> c) \<bullet> {|bv|} ; (bv \<leftrightarrow> c) \<bullet> GNil \<turnstile>\<^sub>w\<^sub>f (bv \<leftrightarrow> c) \<bullet> lst\<close> by fastforce
+  qed
+  hence "wfTs ((bva \<leftrightarrow> c) \<bullet> P)  ((bva \<leftrightarrow> c) \<bullet> {|bva|})  ((bva \<leftrightarrow> c) \<bullet> GNil) ((bva \<leftrightarrow> c) \<bullet> dclist)" 
+         using wfTs.eqvt fresh_GNil 
+         by (simp add: assms(2) theta_flip_eq2)
+
+  thus ?thesis using wfTs.eqvt permute_flip_cancel by metis
+qed
+
+lemma wfTh_dclist_poly_unique:
+  assumes   "wfTh \<Theta>" and "AF_typedef_poly tid bva dclist1 \<in> set \<Theta>" and  "AF_typedef_poly tid bva2 dclist2 \<in> set \<Theta>" 
+  shows "[[atom bva]]lst. dclist1 = [[atom bva2]]lst.dclist2"
+using assms proof(induct \<Theta> rule: \<Theta>_induct)
+  case TNil
+  then show ?case by auto
+next
+  case (AF_typedef tid' dclist' \<Theta>')
+  then show ?case using wfTh_elims by auto
+next
+  case (AF_typedef_poly tid bv dclist \<Theta>')
+  then show ?case using wfTh_elims  image_eqI name_of_type.simps set_ConsD type_def.eq_iff 
+    by (metis Abs1_eq(3))
+qed
+
+lemma wfTh_poly_lookup_supp:
+  fixes t::\<tau>
+  assumes  "AF_typedef_poly tid bv dclist \<in> set \<Theta>" and "(c,t) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "supp t \<subseteq> {atom bv}" 
+proof - 
+  have "supp dclist  \<subseteq> {atom bv}"   using assms lookup_wfTD  wf_supp1 type_def.supp 
+    by (metis Diff_single_insert Un_subset_iff list.simps(15) supp_Nil supp_of_atom_list)
+  then show ?thesis using assms(2) proof(induct dclist)
+    case Nil
+    then show ?case by auto
+  next
+    case (Cons a dclist)
+    then show ?case using supp_Pair supp_Cons 
+      by (metis (mono_tags, hide_lams) Un_empty_left Un_empty_right pure_supp subset_Un_eq subset_singletonD supp_list_member)
+  qed
+qed
+  
+lemma wfTh_poly_supp_b:
+  assumes  "AF_typedef_poly tid  bv dclist \<in> set \<Theta>" and "(dc,\<lbrace> z : b | c \<rbrace> ) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
+  shows "supp b \<subseteq> {atom bv}" 
+  using assms wfTh_poly_lookup_supp \<tau>.supp by force
+
+lemma subst_g_inside:  
+  fixes x::x and c::c and \<Gamma>::\<Gamma>  and \<Gamma>'::\<Gamma>
+  assumes "wfG P \<B> (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>)" 
+  shows  "(\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v =  (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  
+using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using subst_gb.simps by simp
+next
+  case (GCons x' b' c' G) 
+  hence wfg:"wfG P \<B> (G @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>) \<and> atom x' \<sharp> (G @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>)" using wfG_elims(2) 
+    using GCons.prems append_g.simps by metis 
+  hence "atom x \<notin> atom_dom ((x', b', c')  #\<^sub>\<Gamma> G)"  using  GCons wfG_inside_fresh by fast
+  hence "x\<noteq>x'" 
+    using  GCons append_Cons  wfG_inside_fresh atom_dom.simps toSet.simps by simp
+  hence "((GCons (x', b', c') G) @ (GCons (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) \<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v  =  
+         (GCons (x', b', c') (G @ (GCons (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) \<Gamma>)))[x::=v]\<^sub>\<Gamma>\<^sub>v" by auto
+  also have "... =  GCons (x', b', c'[x::=v]\<^sub>c\<^sub>v) ((G @ (GCons (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) \<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v)"  
+      using subst_gv.simps \<open>x\<noteq>x'\<close> by simp
+  also have "... = (x', b', c'[x::=v]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> (G[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)" using GCons  wfg by blast
+  also have "... = ((x', b', c')  #\<^sub>\<Gamma> G)[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>"  using subst_gv.simps \<open>x\<noteq>x'\<close>  by simp
+  finally show ?case by auto
+qed
+
+lemma wfTh_td_eq: 
+  assumes "td1 \<in> set (td2 # P)" and "wfTh (td2 # P)" and "name_of_type td1 = name_of_type td2"
+  shows "td1 = td2"
+proof(rule ccontr)
+  assume as: "td1 \<noteq> td2"
+  have "name_of_type td2 \<notin> name_of_type ` set P" using wfTh_elims(2)[OF assms(2)] by metis
+  moreover have "td1 \<in> set P" using assms as by simp
+  ultimately have "name_of_type td1 \<noteq> name_of_type td2"
+    by (metis rev_image_eqI)
+  thus False using assms by auto
+qed
+
+lemma wfTh_td_unique:
+  assumes "td1 \<in> set P" and "td2  \<in> set P" and "wfTh P" and "name_of_type td1 = name_of_type td2"
+  shows "td1 = td2"
+using assms proof(induct P rule: list.induct)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons td \<Theta>')
+  consider "td = td1" | "td = td2" | "td \<noteq> td1 \<and> td \<noteq> td2" by auto
+  then  show ?case proof(cases)
+    case 1
+    then show ?thesis using Cons wfTh_elims wfTh_td_eq by metis
+  next
+    case 2
+    then show ?thesis using Cons wfTh_elims wfTh_td_eq by metis
+  next
+    case 3
+    then show ?thesis using Cons wfTh_elims by auto
+  qed
+qed
+
+lemma wfTs_distinct:
+ fixes dclist::"(string * \<tau>) list"
+ assumes "\<Theta> ; B  ; GNil \<turnstile>\<^sub>w\<^sub>f  dclist"
+ shows "distinct (map fst dclist)"
+using assms proof(induct dclist rule: list.induct)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons x1 x2)
+  then show ?case
+      by (metis Cons.hyps Cons.prems distinct.simps(2) fst_conv list.set_map list.simps(9) wfTs_elims(2)) 
+qed 
+
+lemma wfTh_dclist_distinct:
+  assumes "AF_typedef s dclist \<in> set P" and "wfTh P"
+  shows "distinct (map fst  dclist)"
+proof - 
+  have "wfTD P (AF_typedef s dclist)" using assms lookup_wfTD by auto
+  hence "wfTs P {||} GNil dclist" using wfTD_elims by metis
+  thus ?thesis using wfTs_distinct by metis
+qed
+
+lemma wfTh_dc_t_unique2:
+  assumes "AF_typedef s dclist' \<in> set P" and "(dc,tc' ) \<in> set dclist'" and "AF_typedef s dclist \<in> set P" and "wfTh P" and
+        "(dc,  tc) \<in> set dclist"
+      shows "tc= tc'"
+proof - 
+  have "dclist = dclist'" using assms wfTh_td_unique name_of_type.simps by force
+  moreover have "distinct (map fst  dclist)"  using wfTh_dclist_distinct assms by auto
+  ultimately show ?thesis using assms 
+    by (meson eq_key_imp_eq_value)
+qed
+
+lemma wfTh_dc_t_unique:
+  assumes "AF_typedef s dclist' \<in> set P" and "(dc, \<lbrace> x' : b'  | c' \<rbrace> ) \<in> set dclist'" and "AF_typedef s dclist \<in> set P" and "wfTh P" and
+        "(dc,  \<lbrace> x : b  | c \<rbrace>) \<in> set dclist"
+      shows "\<lbrace> x' : b'  | c' \<rbrace>= \<lbrace> x : b  | c \<rbrace>"
+  using assms wfTh_dc_t_unique2 by metis
+
+lemma wfTs_wfT:
+  fixes dclist::"(string *\<tau>) list" and t::\<tau>
+  assumes "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f dclist"  and "(dc,t) \<in> set dclist" 
+  shows "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f t"
+using assms proof(induct dclist rule:list.induct)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons x1 x2)
+  thus ?case using  wfTs_elims(2)[OF Cons(2)] by auto
+qed
+
+lemma wfTh_wfT:
+  fixes t::\<tau>
+  assumes "wfTh P"  and "AF_typedef tid dclist \<in> set P" and "(dc,t) \<in> set dclist" 
+  shows "P ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f t"
+proof - 
+  have "P  \<turnstile>\<^sub>w\<^sub>f AF_typedef tid dclist" using lookup_wfTD assms by auto
+  hence "P ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f dclist" using wfTD_elims by auto
+  thus ?thesis using wfTs_wfT assms by auto
+qed
+
+lemma td_lookup_eq_iff:
+  fixes dc :: string and bva1::bv and bva2::bv
+  assumes "[[atom bva1]]lst. dclist1 = [[atom bva2]]lst. dclist2" and "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist1" 
+  shows "\<exists>x2 b2 c2. (dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" 
+using assms proof(induct dclist1 arbitrary: dclist2)
+  case Nil
+  then show ?case by auto
+next
+  case (Cons dct1' dclist1')
+  then obtain dct2' and dclist2' where cons:"dct2' # dclist2' = dclist2"   using  lst_head_cons_neq_nil[OF Cons(2)] list.exhaust by metis
+  hence *:"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'" 
+    using Cons lst_head_cons Cons cons by metis
+  show ?case proof(cases "dc=fst dct1'")
+    case True
+    hence "dc = fst dct2'" using * lst_fst[ THEN lst_pure ] 
+    proof -
+      show ?thesis
+        by (metis (no_types) "local.*" True \<open>\<And>x2 x1 t2' t2a t2 t1. [[atom x1]]lst. (t1, t2a) = [[atom x2]]lst. (t2, t2') \<Longrightarrow> t1 = t2\<close> prod.exhaust_sel) (* 31 ms *)
+    qed    
+    obtain x2 b2 and c2 where "snd dct2' = \<lbrace> x2 : b2  | c2 \<rbrace>" using obtain_fresh_z by metis
+    hence "(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) = dct2'" using  \<open>dc = fst dct2'\<close> 
+      by (metis prod.exhaust_sel)
+    then show ?thesis using cons by force
+  next
+    case False
+    hence "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist1'" using Cons by auto
+    then show ?thesis using Cons 
+      by (metis "local.*" cons list.set_intros(2))
+  qed
+qed
+
+lemma lst_t_b_eq_iff:
+  fixes bva1::bv and bva2::bv
+  assumes "[[atom bva1]]lst. \<lbrace> x1 : b1  | c1 \<rbrace> = [[atom bva2]]lst. \<lbrace> x2 : b2  | c2 \<rbrace>" 
+  shows "[[atom bva1]]lst. b1 = [[atom bva2]]lst.b2" 
+proof(subst  Abs1_eq_iff_all(3)[of bva1 b1  bva2 b2],rule,rule,rule)
+  fix c::bv
+  assume "atom c \<sharp> ( \<lbrace> x1 : b1  | c1 \<rbrace> ,  \<lbrace> x2 : b2  | c2 \<rbrace>)" and "atom c \<sharp> (bva1, bva2, b1, b2)"
+
+  show "(bva1 \<leftrightarrow> c) \<bullet> b1 = (bva2 \<leftrightarrow> c) \<bullet> b2" using assms Abs1_eq_iff(3) assms 
+    by (metis Abs1_eq_iff_fresh(3) \<open>atom c \<sharp> (bva1, bva2, b1, b2)\<close> \<tau>.fresh \<tau>.perm_simps type_eq_subst_eq2(2))
+qed
+
+lemma wfTh_typedef_poly_b_eq_iff:  
+  assumes "AF_typedef_poly tyid bva1 dclist1 \<in> set P" and "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1"
+  and "AF_typedef_poly tyid bva2 dclist2 \<in> set P" and "(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" and "\<turnstile>\<^sub>w\<^sub>f P"
+shows "b1[bva1::=b]\<^sub>b\<^sub>b = b2[bva2::=b]\<^sub>b\<^sub>b"
+proof - 
+  have "[[atom bva1]]lst. dclist1 = [[atom bva2]]lst.dclist2" using assms wfTh_dclist_poly_unique by metis
+  hence "[[atom bva1]]lst. (dc,\<lbrace> x1 : b1  | c1 \<rbrace>) = [[atom bva2]]lst. (dc,\<lbrace> x2 : b2  | c2 \<rbrace>)" using wfTh_b_eq_iff assms wfTh_wfTs_poly by metis
+  hence "[[atom bva1]]lst. \<lbrace> x1 : b1  | c1 \<rbrace> = [[atom bva2]]lst. \<lbrace> x2 : b2  | c2 \<rbrace>" using lst_snd by metis
+  hence "[[atom bva1]]lst. b1 = [[atom bva2]]lst.b2" using lst_t_b_eq_iff by metis
+  thus ?thesis using subst_b_flip_eq_two subst_b_b_def by metis
+qed
+
+section \<open>Equivariance Lemmas\<close>
+
+lemma x_not_in_u_set[simp]:
+  fixes  x::x and us::"u fset"
+  shows "atom x \<notin> supp us"
+  by(induct us,auto, simp add: supp_finsert supp_at_base)
+
+lemma wfS_flip_eq:
+  fixes s1::s and x1::x and s2::s and x2::x  and \<Delta>::\<Delta>
+  assumes "[[atom x1]]lst. s1 = [[atom x2]]lst. s2" and "[[atom x1]]lst. t1 = [[atom x2]]lst. t2"  and "[[atom x1]]lst. c1 = [[atom x2]]lst. c2" and "atom x2 \<sharp> \<Gamma>" and
+           " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>"  and
+        "\<Theta> ; \<Phi>  ; \<B> ; (x1, b, c1)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of t1"
+       shows  "\<Theta> ; \<Phi>  ; \<B> ; (x2, b, c2)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile>\<^sub>w\<^sub>f s2 : b_of t2"
+proof(cases "x1=x2")
+  case True
+  hence "s1 = s2 \<and> t1 = t2 \<and> c1 = c2" using assms Abs1_eq_iff by metis
+  then show ?thesis using assms True by simp
+next
+  case False
+  have "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" using wfX_wfY assms by metis
+  moreover have "atom x1 \<sharp> \<Gamma>" using wfX_wfY wfG_elims assms by metis
+  moreover hence "atom x1 \<sharp> \<Delta> \<and> atom x2 \<sharp> \<Delta> " using wfD_x_fresh assms by auto
+  ultimately have " \<Theta> ; \<Phi>  ; \<B> ; (x2 \<leftrightarrow> x1) \<bullet> ((x1, b, c1)  #\<^sub>\<Gamma>  \<Gamma>) ; \<Delta>  \<turnstile>\<^sub>w\<^sub>f (x2 \<leftrightarrow> x1) \<bullet> s1 :  (x2 \<leftrightarrow> x1) \<bullet> b_of t1"
+    using wfS.eqvt theta_flip_eq phi_flip_eq assms  flip_base_eq beta_flip_eq flip_fresh_fresh supp_b_empty by metis
+  hence   " \<Theta> ; \<Phi>  ; \<B> ;  ((x2, b, (x2 \<leftrightarrow> x1) \<bullet> c1)  #\<^sub>\<Gamma>  ((x2 \<leftrightarrow> x1) \<bullet> \<Gamma>)) ; \<Delta>  \<turnstile>\<^sub>w\<^sub>f (x2 \<leftrightarrow> x1) \<bullet> s1 :   b_of ((x2 \<leftrightarrow> x2) \<bullet> t1)"  by fastforce
+  thus ?thesis using assms Abs1_eq_iff 
+  proof -
+   have f1: "x2 = x1 \<and> t2 = t1 \<or> x2 \<noteq> x1 \<and> t2 = (x2 \<leftrightarrow> x1) \<bullet> t1 \<and> atom x2 \<sharp> t1"
+     by (metis (full_types) Abs1_eq_iff(3) \<open>[[atom x1]]lst. t1 = [[atom x2]]lst. t2\<close>) (* 125 ms *)
+   then have "x2 \<noteq> x1 \<and> s2 = (x2 \<leftrightarrow> x1) \<bullet> s1 \<and> atom x2 \<sharp> s1 \<longrightarrow> b_of t2 = (x2 \<leftrightarrow> x1) \<bullet> b_of t1"
+     by (metis b_of.eqvt) (* 0.0 ms *)
+   then show ?thesis
+    using f1 by (metis (no_types) Abs1_eq_iff(3) G_cons_flip_fresh3 \<open>[[atom x1]]lst. c1 = [[atom x2]]lst. c2\<close> \<open>[[atom x1]]lst. s1 = [[atom x2]]lst. s2\<close> \<open>\<Theta> ; \<Phi>  ; \<B> ; (x1, b, c1)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of t1\<close> \<open>\<Theta> ; \<Phi>  ; \<B> ; (x2 \<leftrightarrow> x1) \<bullet> ((x1, b, c1)  #\<^sub>\<Gamma> \<Gamma>) ; \<Delta> \<turnstile>\<^sub>w\<^sub>f (x2 \<leftrightarrow> x1) \<bullet> s1 : (x2 \<leftrightarrow> x1) \<bullet> b_of t1\<close> \<open>atom x1 \<sharp> \<Gamma>\<close> \<open>atom x2 \<sharp> \<Gamma>\<close>) (* 593 ms *)
+  qed
+qed
+
+section \<open>Lookup\<close>
+
+lemma wf_not_in_prefix:
+  assumes "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)"
+  shows "x \<notin> fst ` toSet \<Gamma>'"
+using assms proof(induct \<Gamma>' rule: \<Gamma>.induct)
+  case GNil
+  then show ?case by simp
+next
+  case (GCons xbc \<Gamma>')
+  then obtain x' and b' and c'::c where xbc: "xbc=(x',b',c')" 
+    using prod_cases3 by blast
+  hence *:"(xbc  #\<^sub>\<Gamma> \<Gamma>') @ (x, b1, c1)  #\<^sub>\<Gamma> \<Gamma> = ((x',b',c') #\<^sub>\<Gamma>(\<Gamma>'@ ((x, b1, c1)  #\<^sub>\<Gamma> \<Gamma>)))" by simp
+  hence "atom x' \<sharp> (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)" using wfG_elims(2) GCons by metis
+    
+  moreover have "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>' @ (x, b1, c1)  #\<^sub>\<Gamma> \<Gamma>)" using GCons wfG_elims * by metis
+  ultimately have  "atom x' \<notin> atom_dom (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)" using wfG_dom_supp GCons append_g.simps xbc fresh_def by fast
+  hence "x' \<noteq> x" using GCons fresh_GCons xbc by fastforce
+  then show ?case using GCons xbc toSet.simps
+    using Un_commute \<open>\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b1, c1)  #\<^sub>\<Gamma> \<Gamma>\<close> atom_dom.simps by auto
+qed
+
+lemma lookup_inside_wf[simp]:
+  assumes "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)"
+  shows "Some (b1,c1) = lookup (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>) x"
+  using wf_not_in_prefix lookup_inside assms by fast
+
+lemma lookup_weakening:
+  fixes \<Theta>::\<Theta> and \<Gamma>::\<Gamma> and \<Gamma>'::\<Gamma>
+  assumes "Some (b,c) = lookup \<Gamma> x" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "Some (b,c) = lookup \<Gamma>' x"
+proof -
+  have "(x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)" using assms lookup_iff toSet.simps by force
+  hence "(x,b,c) \<in> toSet \<Gamma>'" using assms by auto
+  moreover have "(\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma>' \<longrightarrow> b'=b \<and> c'=c)" using assms wf_g_unique 
+    using calculation by auto
+  ultimately show ?thesis using lookup_iff 
+    using assms(3) by blast
+qed
+
+lemma wfPhi_lookup_fun_unique:
+  fixes \<Phi>::\<Phi>
+  assumes "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "AF_fundef f fd \<in> set \<Phi>" 
+  shows "Some (AF_fundef f fd) = lookup_fun \<Phi> f"
+using assms proof(induct \<Phi> rule: list.induct )
+  case Nil
+  then show ?case using lookup_fun.simps by simp
+next
+  case (Cons  a  \<Phi>')
+  then obtain f' and fd' where a:"a = AF_fundef f' fd'" using fun_def.exhaust by auto  
+  have wf: "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<and> f' \<notin> name_of_fun ` set \<Phi>' " using wfPhi_elims Cons a by metis
+  then show ?case  using Cons lookup_fun.simps using Cons  lookup_fun.simps wf a 
+      by (metis image_eqI name_of_fun.simps set_ConsD)
+qed
+
+lemma lookup_fun_weakening:
+  fixes \<Phi>'::\<Phi>
+  assumes "Some fd = lookup_fun \<Phi> f" and "set \<Phi> \<subseteq> set \<Phi>'" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>'"
+  shows "Some fd = lookup_fun \<Phi>' f"
+using assms proof(induct \<Phi> )
+  case Nil
+  then show ?case using lookup_fun.simps by simp
+next
+  case (Cons  a  \<Phi>'')
+  then obtain f' and fd' where a: "a = AF_fundef f' fd'" using fun_def.exhaust by auto
+  then show ?case proof(cases "f=f'")
+    case True
+    then show ?thesis using lookup_fun.simps Cons wfPhi_lookup_fun_unique a 
+      by (metis lookup_fun_member subset_iff)
+  next
+    case False
+    then show ?thesis  using lookup_fun.simps Cons 
+      using \<open>a = AF_fundef f' fd'\<close> by auto
+  qed
+qed
+
+lemma  fundef_poly_fresh_bv:
+  assumes "atom bv2 \<sharp> (bv1,b1,c1,\<tau>1,s1)"
+  shows  * : "(AF_fun_typ_some bv2 (AF_fun_typ x1 ((bv1\<leftrightarrow>bv2) \<bullet> b1) ((bv1\<leftrightarrow>bv2) \<bullet>c1) ((bv1\<leftrightarrow>bv2) \<bullet> \<tau>1) ((bv1\<leftrightarrow>bv2) \<bullet> s1)) = (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1)))" 
+        (is "(AF_fun_typ_some ?bv ?fun_typ = AF_fun_typ_some ?bva ?fun_typa)")
+proof -
+  have 1:"atom bv2 \<notin> set [atom x1]" using bv_not_in_x_atoms by simp
+  have 2:"bv1 \<noteq> bv2" using assms by auto
+  have 3:"(bv2 \<leftrightarrow> bv1) \<bullet> x1 = x1" using pure_fresh flip_fresh_fresh 
+    by (simp add: flip_fresh_fresh)
+  have "  AF_fun_typ x1 ((bv1 \<leftrightarrow> bv2) \<bullet> b1) ((bv1 \<leftrightarrow> bv2) \<bullet> c1) ((bv1 \<leftrightarrow> bv2) \<bullet> \<tau>1) ((bv1 \<leftrightarrow> bv2) \<bullet> s1) = (bv2 \<leftrightarrow> bv1) \<bullet> AF_fun_typ x1 b1 c1 \<tau>1 s1"
+    using 1 2 3 assms   by (simp add: flip_commute)
+  moreover have "(atom bv2 \<sharp> c1 \<and> atom bv2 \<sharp> \<tau>1 \<and> atom bv2 \<sharp> s1 \<or> atom bv2 \<in> set [atom x1])  \<and> atom bv2 \<sharp> b1" 
+     using 1 2 3 assms  fresh_prod5 by metis
+  ultimately show ?thesis unfolding  fun_typ_q.eq_iff  Abs1_eq_iff(3) fun_typ.fresh 1 2 by fastforce
+qed
+
+
+text \<open>It is possible to collapse some of the easy to prove inductive cases into a single proof at the qed line
+   but this makes it fragile under change. For example, changing the lemma statement might make one of the previously
+   trivial cases non-trivial and so the collapsing needs to be unpacked. Is there a way to find which case
+   has failed in the qed line?\<close>
+
+lemma wb_b_weakening1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+          and cs::branch_s and css::branch_list
+
+  shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow>\<B> |\<subseteq>| \<B>'  \<Longrightarrow> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  c" and
+         "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>   \<Longrightarrow>\<B> |\<subseteq>| \<B>'  \<Longrightarrow> \<Theta>; \<B>' \<turnstile>\<^sub>w\<^sub>f \<Gamma> " and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts  \<Longrightarrow>  \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta>; \<B>' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts" and 
+         "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True " and     
+         "wfB \<Theta> \<B> b \<Longrightarrow>  \<B> |\<subseteq>| \<B>' \<Longrightarrow> wfB \<Theta> \<B>' b" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta>; \<B>' ;  \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
+proof(nominal_induct b and c and \<Gamma> and \<tau> and ts and P and b and b and td 
+     avoiding:  \<B>'
+rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+  show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by metis
+    show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI  by auto
+    show \<open> \<Theta> ;  \<B>'  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfV_conspI by auto
+    show \<open>atom bv \<sharp>  (\<Theta>, \<B>', \<Gamma>, b, v)\<close>  using fresh_prodN wfV_conspI by auto
+    thus \<open> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by simp
+  qed
+next
+ case (wfTI z \<Theta> \<B> \<Gamma> b c)
+  show ?case proof 
+    show "atom z \<sharp>  (\<Theta>, \<B>', \<Gamma>)" using wfTI by auto
+    show "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f b " using wfTI by auto
+    show "\<Theta>; \<B>' ; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c " using wfTI by auto
+  qed
+qed( (auto simp add: wf_intros | metis wf_intros)+ )
+
+lemma wb_b_weakening2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+          and cs::branch_s and css::branch_list
+
+  shows 
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi> ; \<B>' ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi> ; \<B>' ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta> ; \<Phi> ; \<B>' ; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta> ; \<Phi> ; \<B>' ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and       
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi>  ; \<B>' \<turnstile>\<^sub>w\<^sub>f ft"
+proof(nominal_induct b and b and b and b and \<Phi> and \<Delta> and ftq and ft  
+   avoiding:  \<B>'
+   rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+  case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros  wb_b_weakening1 by metis
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros  wb_b_weakening1 by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  then show ?case  using wf_intros  wb_b_weakening1 
+    by meson
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using Wellformed.wfE_fstI  wb_b_weakening1 by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros  wb_b_weakening1 by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1) 
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f ft v)
+  then show ?case using wf_intros using wb_b_weakening1  by meson
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B>1 \<Gamma> \<Delta> b' bv1 v1 \<tau>1 f1 x1 b1 c1 s1)
+
+  have "\<Theta> ; \<Phi>  ; \<B>' ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_appP f1 b' v1 : (b_of \<tau>1)[bv1::=b']\<^sub>b" 
+  proof
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using wfE_appPI by auto
+    show "\<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> "  using wfE_appPI by auto
+    show "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f b' "  using wfE_appPI wb_b_weakening1 by auto
+    thus " atom bv1 \<sharp> (\<Phi>, \<Theta>, \<B>', \<Gamma>, \<Delta>, b', v1, (b_of \<tau>1)[bv1::=b']\<^sub>b)"  
+      using  wfE_appPI fresh_prodN by auto
+
+    show "Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1))) = lookup_fun \<Phi> f1"  using wfE_appPI by auto
+    show "\<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b1[bv1::=b']\<^sub>b "  using wfE_appPI wb_b_weakening1 by auto
+  qed
+  then show ?case by auto
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi>  ; \<B>' ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
+    show \<open> \<Theta> ; \<Phi>  ; \<B>' ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_letI by auto
+    show \<open> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_letI by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>', \<Gamma>, \<Delta>, e, b)\<close> using wfS_letI by auto
+  qed
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  then show ?case using wb_b_weakening1 Wellformed.wfS_let2I by simp
+next
+  case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
+  then show ?case using  wb_b_weakening1 Wellformed.wfS_ifI by simp
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Delta> \<Phi> s b)
+  then show ?case using wb_b_weakening1 Wellformed.wfS_varI by simp
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  then show ?case using wb_b_weakening1 Wellformed.wfS_assignI by simp
+next
+case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wb_b_weakening1 Wellformed.wfS_whileI by simp
+next
+  case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using Wellformed.wfS_seqI   by metis
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
+  then show ?case using  wb_b_weakening1 Wellformed.wfS_matchI by metis
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  then show ?case  using Wellformed.wfS_branchI by auto
+next
+  case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
+  then show ?case  using wf_intros by metis
+next
+  case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
+  then show ?case  using wf_intros by metis
+next
+  case (wfD_emptyI \<Theta> \<B> \<Gamma>)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfPhi_emptyI \<Theta>)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfPhi_consI f \<Theta> \<Phi> ft)
+  then show ?case using wf_intros wb_b_weakening1 by metis
+next
+  case (wfFTSome \<Theta> bv ft)
+  then show ?case  using wf_intros wb_b_weakening1 by metis
+next
+  case (wfFTI \<Theta> B b s x c \<tau> \<Phi>)
+  show ?case proof
+    show "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f b"   using wfFTI wb_b_weakening1 by auto
+    
+    show "supp c \<subseteq> {atom x}" using wfFTI wb_b_weakening1 by auto
+    show "\<Theta>; \<B>' ; (x, b, c) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau> " using wfFTI wb_b_weakening1 by auto
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfFTI wb_b_weakening1 by auto
+    from \<open> B |\<subseteq>| \<B>'\<close> have "supp B \<subseteq> supp \<B>'" proof(induct B)
+      case empty
+      then show ?case by auto
+    next
+      case (insert x B)
+      then show ?case 
+        by (metis fsubset_funion_eq subset_Un_eq supp_union_fset)
+    qed
+    thus  "supp s \<subseteq> {atom x} \<union> supp \<B>'" using wfFTI by auto
+  qed  
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi> ; \<B>' ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wb_b_weakening1 wfS_assertI by simp
+    show \<open> \<Theta>; \<B>' ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close>  using wb_b_weakening1 wfS_assertI by simp
+    show \<open> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wb_b_weakening1 wfS_assertI by simp
+    have "atom x \<sharp>  \<B>'" using x_not_in_b_set fresh_def by metis
+    thus  \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>', \<Gamma>, \<Delta>, c, b, s)\<close> using wfS_assertI fresh_prodN by simp
+  qed   
+qed(auto)
+
+lemmas wb_b_weakening = wb_b_weakening1 wb_b_weakening2
+
+lemma wfG_b_weakening:
+  fixes \<Gamma>::\<Gamma>
+  assumes "\<B> |\<subseteq>| \<B>'" and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
+  shows "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f \<Gamma> "
+  using wb_b_weakening assms by auto
+
+lemma wfT_b_weakening:
+  fixes \<Gamma>::\<Gamma> and \<Theta>::\<Theta> and \<tau>::\<tau>
+  assumes "\<B> |\<subseteq>| \<B>'" and "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>"
+  shows "\<Theta>; \<B>' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> "
+  using wb_b_weakening assms by auto
+
+lemma wfB_subst_wfB:
+  fixes \<tau>::\<tau> and b'::b and b::b
+  assumes "\<Theta> ; {|bv|}  \<turnstile>\<^sub>w\<^sub>f b" and "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b'"
+  shows "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b[bv::=b']\<^sub>b\<^sub>b "
+using assms proof(nominal_induct b rule:b.strong_induct)
+  case B_int
+  hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_int" using wfB_intI wfX_wfY by fast
+  then show ?case using subst_bb.simps wb_b_weakening by fastforce
+next
+  case B_bool
+  hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_bool" using wfB_boolI wfX_wfY by fast
+  then show ?case using subst_bb.simps wb_b_weakening by fastforce
+next
+  case (B_id x )
+  hence " \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (B_id x)" using wfB_consI wfB_elims wfX_wfY by metis
+  then show ?case using  subst_bb.simps(4) by auto
+next
+  case (B_pair x1 x2)
+  then show ?case using subst_bb.simps 
+    by (metis wfB_elims(1) wfB_pairI)
+next
+  case B_unit
+  hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_unit" using wfB_unitI wfX_wfY by fast
+  then show ?case using subst_bb.simps wb_b_weakening by fastforce
+next
+  case B_bitvec
+  hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_bitvec" using wfB_bitvecI wfX_wfY by fast
+  then show ?case using subst_bb.simps wb_b_weakening by fastforce
+next
+  case (B_var x)
+  then show ?case 
+  proof -
+    have False
+      using B_var.prems(1) wfB.cases by fastforce (* 781 ms *)
+    then show ?thesis  by metis 
+  qed
+next
+  case (B_app s b)
+  then obtain bv' dclist where *:"AF_typedef_poly s bv' dclist \<in> set \<Theta> \<and> \<Theta> ; {|bv|}   \<turnstile>\<^sub>w\<^sub>f b" using wfB_elims by metis
+  show ?case unfolding subst_b_simps proof
+    show "\<turnstile>\<^sub>w\<^sub>f \<Theta> " using B_app wfX_wfY by metis
+    show "\<Theta> ;   \<B>  \<turnstile>\<^sub>w\<^sub>f b[bv::=b']\<^sub>b\<^sub>b " using * B_app forget_subst wfB_supp fresh_def 
+      by (metis ex_in_conv subset_empty subst_b_b_def supp_empty_fset)
+    show "AF_typedef_poly s bv' dclist \<in> set \<Theta>" using * by auto
+  qed
+qed
+
+lemma wfT_subst_wfB:
+  fixes \<tau>::\<tau> and b'::b
+  assumes "\<Theta> ; {|bv|} ; (x, b, c)  #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>" and "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b'"
+  shows "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (b_of \<tau>)[bv::=b']\<^sub>b\<^sub>b "
+proof -
+  obtain b where  "\<Theta> ; {|bv|} \<turnstile>\<^sub>w\<^sub>f b \<and> b_of \<tau> = b" using wfT_elims b_of.simps assms by metis
+  thus ?thesis using wfB_subst_wfB assms by auto
+qed
+
+lemma wfG_cons_unique:
+  assumes "(x1,b1,c1) \<in> toSet (((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "wfG \<Theta> \<B> (((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x = x1"
+  shows "b1 = b \<and> c1 = c" 
+proof -
+  have "x1 \<notin> fst ` toSet \<Gamma>" 
+  proof -
+    have "atom x1 \<sharp> \<Gamma>" using assms wfG_cons by metis
+    then show ?thesis
+      using fresh_gamma_elem 
+      by (metis assms(2) atom_dom.simps dom.simps rev_image_eqI wfG_cons2 wfG_x_fresh)
+  qed
+  thus ?thesis using assms by force
+qed
+
+lemma wfG_member_unique:
+  assumes "(x1,b1,c1) \<in> toSet (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x = x1"
+  shows "b1 = b \<and> c1 = c" 
+  using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using wfG_suffix wfG_cons_unique append_g.simps by metis
+next
+  case (GCons x' b' c' \<Gamma>')
+  moreover hence "(x1, b1, c1) \<in> toSet (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" using wf_not_in_prefix by fastforce
+  ultimately show ?case using wfG_cons by fastforce
+qed
+
+section \<open>Function Definitions\<close>
+
+lemma wb_phi_weakening:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+         and cs::branch_s and css::branch_list and \<Phi>::\<Phi>
+  shows
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>' ; \<B> ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b  \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>' ; \<B> ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow>   \<Theta> ; \<Phi>' ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow>  \<Theta> ; \<Phi>' ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and      
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
+          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> True" and       
+          "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>'  \<turnstile>\<^sub>w\<^sub>f ftq" and
+         "\<Theta> ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>' ; \<B> \<turnstile>\<^sub>w\<^sub>f ft"      
+proof(nominal_induct
+          b and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
+          avoiding:  \<Phi>'         
+       rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+  case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
+  then show ?case using wf_intros lookup_fun_weakening by metis
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  show ?case proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by auto
+    show \<open>atom bv \<sharp> (\<Phi>', \<Theta>, \<B>, \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> using wfE_appPI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi>' f\<close> 
+      using wfE_appPI lookup_fun_weakening by metis
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close> using wfE_appPI by auto
+  qed
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  then show ?case using Wellformed.wfS_letI by fastforce
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 b' x s2 b)
+  then show ?case   using Wellformed.wfS_let2I by fastforce
+next
+  case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
+  then show ?case  using wf_intros by metis
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI by simp
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close> using wfS_varI by simp
+    show \<open>atom u \<sharp> (\<Phi>', \<Theta>, \<B>, \<Gamma>, \<Delta>, \<tau>, v, b)\<close> using wfS_varI by simp
+    show \<open> \<Theta> ; \<Phi>' ; \<B> ; \<Gamma> ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_varI by simp
+  qed
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  then show ?case  using wf_intros by metis
+next
+  case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case  using wf_intros by metis
+next
+  case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case  using wf_intros by metis
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
+  then show ?case  using wf_intros by metis
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  then show ?case using Wellformed.wfS_branchI by fastforce
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi>' ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close>  using wfS_assertI by auto
+  next
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI by auto
+  next
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using wfS_assertI by auto
+    have "atom x \<sharp> \<Phi>'" using wfS_assertI wfPhi_supp fresh_def by blast
+    thus  \<open>atom x \<sharp> (\<Phi>', \<Theta>, \<B>, \<Gamma>, \<Delta>, c, b, s)\<close>  using fresh_prodN wfS_assertI wfPhi_supp fresh_def by auto
+  qed
+next
+  case (wfFTI \<Theta> B b s x c \<tau> \<Phi>)
+  show ?case proof
+    show \<open> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b \<close>  using wfFTI by auto
+  next
+    show \<open>supp c \<subseteq> {atom x}\<close> using wfFTI by auto
+  next
+    show \<open> \<Theta> ; B ; (x, b, c) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfFTI by auto
+  next
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<close> using wfFTI by auto
+  next
+    show \<open>supp s \<subseteq> {atom x} \<union> supp B\<close> using wfFTI by auto
+  qed
+qed(auto|metis wf_intros)+
+
+
+lemma wfT_fun_return_t:
+  fixes \<tau>a'::\<tau> and \<tau>'::\<tau>
+  assumes "\<Theta>; \<B>; (xa, b, ca)  #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>a'" and "(AF_fun_typ x b c \<tau>' s') = (AF_fun_typ xa b ca \<tau>a' sa')"
+  shows  "\<Theta>; \<B>; (x, b, c)  #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>'"
+proof - 
+  obtain cb::x where xf: "atom cb  \<sharp> (c, \<tau>', s', sa', \<tau>a', ca, x , xa)" using obtain_fresh by blast
+  hence  "atom cb \<sharp> (c, \<tau>', s', sa', \<tau>a', ca) \<and>  atom cb \<sharp> (x, xa, ((c, \<tau>'), s'), (ca, \<tau>a'), sa')" using  fresh_prod6 fresh_prod4 fresh_prod8 by auto
+  hence *:"c[x::=V_var cb]\<^sub>c\<^sub>v = ca[xa::=V_var cb]\<^sub>c\<^sub>v \<and> \<tau>'[x::=V_var cb]\<^sub>\<tau>\<^sub>v = \<tau>a'[xa::=V_var cb]\<^sub>\<tau>\<^sub>v" using assms \<tau>.eq_iff Abs1_eq_iff_all by auto
+
+  have **: "\<Theta>; \<B>; (xa \<leftrightarrow> cb ) \<bullet> ((xa, b, ca)  #\<^sub>\<Gamma> GNil)  \<turnstile>\<^sub>w\<^sub>f (xa \<leftrightarrow> cb ) \<bullet> \<tau>a'" using assms True_eqvt beta_flip_eq theta_flip_eq wfG_wf 
+    by (metis GCons_eqvt GNil_eqvt wfT.eqvt wfT_wf)
+
+  have "\<Theta>; \<B>; (x \<leftrightarrow> cb ) \<bullet> ((x, b, c)  #\<^sub>\<Gamma> GNil)  \<turnstile>\<^sub>w\<^sub>f (x \<leftrightarrow> cb ) \<bullet> \<tau>'" proof -
+    have "(xa \<leftrightarrow> cb ) \<bullet> xa = (x \<leftrightarrow> cb ) \<bullet> x"  using xf by auto
+    hence "(x \<leftrightarrow> cb ) \<bullet> ((x, b, c)  #\<^sub>\<Gamma> GNil) = (xa \<leftrightarrow> cb ) \<bullet> ((xa, b, ca)  #\<^sub>\<Gamma> GNil)"  using * ** xf G_cons_flip fresh_GNil by simp
+    thus ?thesis using ** * xf by simp
+  qed
+  thus ?thesis  using  beta_flip_eq theta_flip_eq  wfT_wf wfG_wf  * ** True_eqvt wfT.eqvt permute_flip_cancel by metis
+qed
+
+lemma wfFT_wf_aux:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Delta>::\<Delta>
+  assumes "\<Theta> ; \<Phi>  ; B \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" 
+  shows "\<Theta> ; B ; (x,b,c) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f  \<Phi> \<and> supp s \<subseteq> { atom x } \<union> supp B"
+proof -
+  obtain xa and ca and sa and \<tau>' where *:"\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b  \<and>  (\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>  )  \<and>
+    supp sa \<subseteq> {atom xa} \<union> supp B \<and>  (\<Theta> ; B ; (xa, b, ca)  #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>')  \<and>  
+  AF_fun_typ x b c \<tau> s = AF_fun_typ xa b ca \<tau>' sa " 
+    using wfFT.simps[of \<Theta> \<Phi> B "AF_fun_typ x b c \<tau> s"] assms by auto
+ 
+  moreover hence **: "(AF_fun_typ x b c \<tau> s) = (AF_fun_typ xa b ca \<tau>' sa)" by simp
+  ultimately have "\<Theta> ; B ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"  using wfT_fun_return_t by metis
+  moreover have " (\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>  ) "  using * by auto
+  moreover have "supp s \<subseteq> { atom x } \<union> supp B" proof -
+    have "[[atom x]]lst.s = [[atom xa]]lst.sa" using ** fun_typ.eq_iff lst_fst lst_snd by metis
+    thus ?thesis using lst_supp_subset * by metis
+  qed
+  ultimately show ?thesis by auto
+qed
+
+lemma wfFT_simple_wf:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Delta>::\<Delta>
+  assumes "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))" 
+  shows "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and> supp s \<subseteq> { atom x } "
+proof -
+  have  *:"\<Theta> ; \<Phi>  ; {||} \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" using wfFTQ_elims assms by auto
+  thus ?thesis using wfFT_wf_aux by force
+qed
+
+lemma wfFT_poly_wf:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ftq :: fun_typ_q and s::s and \<Delta>::\<Delta>
+  assumes "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))" 
+  shows "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and> \<Theta> ; \<Phi>  ; {|bv|}  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)"
+proof -
+  obtain bv1 ft1 where  *:"\<Theta> ; \<Phi>  ; {|bv1|} \<turnstile>\<^sub>w\<^sub>f ft1 \<and> [[atom bv1]]lst. ft1 = [[atom bv]]lst. AF_fun_typ x b c \<tau> s" 
+    using wfFTQ_elims(3)[OF assms]  by metis
+
+  show ?thesis proof(cases "bv1 = bv")
+    case True
+    then show ?thesis using *  fun_typ_q.eq_iff  Abs1_eq_iff   by (metis (no_types, hide_lams) wfFT_wf_aux)
+  next
+    case False
+    obtain x1 b1 c1 t1 s1 where **: "ft1 = AF_fun_typ x1 b1 c1 t1 s1" using fun_typ.eq_iff 
+      by (meson fun_typ.exhaust)
+
+    hence eqv: "(bv \<leftrightarrow> bv1) \<bullet>  AF_fun_typ x1 b1 c1 t1 s1 = AF_fun_typ x b c \<tau> s \<and> atom bv1 \<sharp> AF_fun_typ x b c \<tau> s" using 
+         Abs1_eq_iff(3) * False by metis
+
+    have "(bv \<leftrightarrow> bv1) \<bullet> \<Theta> ; (bv \<leftrightarrow> bv1) \<bullet> \<Phi> ; (bv \<leftrightarrow> bv1) \<bullet> {|bv1|} \<turnstile>\<^sub>w\<^sub>f (bv \<leftrightarrow> bv1) \<bullet> ft1" using wfFT.eqvt * by metis   
+    moreover have "(bv \<leftrightarrow> bv1) \<bullet> \<Phi> = \<Phi>" using phi_flip_eq wfX_wfY * by metis
+    moreover have "(bv \<leftrightarrow> bv1) \<bullet> \<Theta> =\<Theta>" using wfX_wfY *  theta_flip_eq2 by metis
+    moreover have "(bv \<leftrightarrow> bv1) \<bullet> ft1 = AF_fun_typ x b c \<tau> s" using eqv ** by metis
+    ultimately have  "\<Theta> ; \<Phi>  ; {|bv|} \<turnstile>\<^sub>w\<^sub>f AF_fun_typ x b c \<tau> s"  by auto
+    thus ?thesis using wfFT_wf_aux by auto
+  qed
+qed
+
+lemma wfFT_poly_wfT:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))"
+  shows "\<Theta> ; {| bv |} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"
+  using wfFT_poly_wf assms by simp
+
+lemma b_of_supp:
+  "supp (b_of t) \<subseteq> supp t"
+proof(nominal_induct t rule:\<tau>.strong_induct)
+  case (T_refined_type x b c)
+  then show ?case by auto
+qed
+
+lemma wfPhi_f_simple_wf:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Phi>'::\<Phi>
+   assumes "AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi> " and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "set \<Phi> \<subseteq> set \<Phi>'" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>'"
+  shows "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and> supp s \<subseteq> { atom x }"
+using assms proof(induct \<Phi> rule: \<Phi>_induct)
+  case PNil
+  then show ?case by auto
+next
+  case (PConsSome f1 bv x1 b1 c1 \<tau>1 s' \<Phi>'')
+  hence "AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>''" by auto
+  moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsSome by auto
+  ultimately show  ?case using PConsSome wfPhi_elims wfFT_simple_wf by auto
+next
+  case (PConsNone f' x' b' c' \<tau>' s' \<Phi>'')
+  show ?case proof(cases "f=f'")
+    case True
+    have "AF_fun_typ_none (AF_fun_typ x' b' c' \<tau>' s') = AF_fun_typ_none (AF_fun_typ x b c \<tau> s)" 
+      by (metis PConsNone.prems(1) PConsNone.prems(2) True fun_def.eq_iff image_eqI name_of_fun.simps set_ConsD wfPhi_elims(2))
+    hence *:"\<Theta> ; \<Phi>'' \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_none (AF_fun_typ x b c \<tau> s) " using wfPhi_elims(2)[OF PConsNone(3)] by metis
+    hence "\<Theta> ; \<Phi>'' ; {||} \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" using wfFTQ_elims(1) by metis
+    thus ?thesis using wfFT_simple_wf[OF *] wb_phi_weakening PConsNone by force
+  next
+    case False
+    hence "AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>''" using PConsNone by simp
+    moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsNone by auto
+    ultimately show  ?thesis using PConsNone wfPhi_elims wfFT_simple_wf by auto
+  qed
+qed
+
+lemma wfPhi_f_simple_wfT:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"
+  using wfPhi_f_simple_wf assms  using lookup_fun_member by blast
+
+lemma  wfPhi_f_simple_supp_b:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp b = {}"
+proof -
+  have "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_simple_wfT assms by auto
+  thus ?thesis using wfT_wf wfG_cons wfB_supp by fastforce
+qed
+
+lemma wfPhi_f_simple_supp_t:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp \<tau> \<subseteq> { atom x }"
+  using wfPhi_f_simple_wfT wfT_supp assms by fastforce
+
+lemma  wfPhi_f_simple_supp_c:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp c \<subseteq> { atom x }"
+proof -
+  have "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_simple_wfT assms by auto
+  thus ?thesis using wfG_wfC wfC_supp wfT_wf by fastforce
+qed
+
+lemma  wfPhi_f_simple_supp_s:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp s \<subseteq> {atom x}"
+proof -
+  have "AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>" using lookup_fun_member assms by auto
+  hence "supp s \<subseteq> { atom x }" using wfPhi_f_simple_wf assms by blast
+  thus ?thesis using wf_supp(3)  atom_dom.simps toSet.simps  x_not_in_u_set x_not_in_b_set setD.simps 
+    using wf_supp2(2) by fastforce
+qed
+
+lemma wfPhi_f_poly_wf:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Phi>'::\<Phi>
+   assumes "AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi> " and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "set \<Phi> \<subseteq> set \<Phi>'" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>'"
+  shows "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<and> \<Theta> ; \<Phi>' ;  {|bv|} \<turnstile>\<^sub>w\<^sub>f  (AF_fun_typ x b c \<tau> s)"
+using assms proof(induct \<Phi> rule: \<Phi>_induct)
+  case PNil
+  then show ?case by auto
+next
+  case (PConsNone f x b c \<tau> s' \<Phi>'')
+  moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsNone by auto
+  ultimately show  ?case using PConsNone wfPhi_elims wfFT_poly_wf by auto
+next
+  case (PConsSome f1 bv1 x1 b1 c1 \<tau>1 s1 \<Phi>'')
+  show ?case proof(cases "f=f1")
+  case True
+    have "AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1) = AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)"       
+      by (metis PConsSome.prems(1) PConsSome.prems(2) True fun_def.eq_iff list.set_intros(1) option.inject wfPhi_lookup_fun_unique)
+    hence *:"\<Theta> ; \<Phi>''  \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s) " using wfPhi_elims PConsSome by metis  
+    thus ?thesis using wfFT_poly_wf * wb_phi_weakening PConsSome 
+      by (meson set_subset_Cons)
+  next
+    case False
+    hence "AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>''" using PConsSome 
+      by (meson fun_def.eq_iff set_ConsD)
+    moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsSome 
+      by (meson dual_order.trans set_subset_Cons)
+    ultimately show  ?thesis using PConsSome wfPhi_elims wfFT_poly_wf 
+      by blast
+  qed
+qed
+
+lemma wfPhi_f_poly_wfT:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "\<Theta> ; {| bv |} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"
+using assms proof(induct \<Phi> rule: \<Phi>_induct)
+  case PNil
+  then show ?case by auto
+next
+  case (PConsSome f1 bv1 x1 b1 c1 \<tau>1 s' \<Phi>')
+  then show ?case proof(cases "f1=f")
+    case True
+    hence "lookup_fun (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s'))  # \<Phi>') f = Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s')))" using 
+       lookup_fun.simps  using PConsSome.prems by simp
+    then show ?thesis using PConsSome.prems wfPhi_elims wfFT_poly_wfT
+      by (metis option.inject)
+  next
+    case False
+    then show ?thesis using PConsSome using lookup_fun.simps 
+      using wfPhi_elims(3) by auto
+  qed
+next
+  case (PConsNone f' x' b' c' \<tau>' s' \<Phi>')
+  then show ?case proof(cases "f'=f")
+    case True
+    then have *:"\<Theta> ; \<Phi>' \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_none (AF_fun_typ x' b' c' \<tau>' s') " using lookup_fun.simps PConsNone wfPhi_elims by metis
+    thus ?thesis using PConsNone wfFT_poly_wfT wfPhi_elims lookup_fun.simps 
+      by (metis fun_def.eq_iff fun_typ_q.distinct(1) option.inject)
+  next
+    case False  
+    thus ?thesis using PConsNone wfPhi_elims 
+      by (metis False lookup_fun.simps(2))
+  qed
+qed
+
+lemma  wfPhi_f_poly_supp_b:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp b \<subseteq> supp bv"
+proof -
+  have "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_poly_wfT assms by auto
+  thus ?thesis using wfT_wf wfG_cons wfB_supp by fastforce
+qed
+
+lemma wfPhi_f_poly_supp_t:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp \<tau> \<subseteq> { atom x , atom bv }"
+ using wfPhi_f_poly_wfT[OF assms, THEN wfT_supp]  atom_dom.simps  supp_at_base by auto
+
+
+lemma wfPhi_f_poly_supp_b_of_t:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp (b_of \<tau>) \<subseteq> { atom bv }"
+proof - 
+  have "atom x \<notin> supp (b_of \<tau>)" using x_fresh_b  by auto
+  moreover have "supp (b_of \<tau>) \<subseteq> { atom x , atom bv }" using wfPhi_f_poly_supp_t  
+    using   supp_at_base b_of.simps wfPhi_f_poly_supp_t \<tau>.supp b_of_supp assms by fast
+  ultimately show ?thesis by blast
+qed
+
+lemma wfPhi_f_poly_supp_c:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp c \<subseteq> { atom x, atom bv }"
+proof - 
+  have "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_poly_wfT assms by auto
+  thus ?thesis using wfG_wfC wfC_supp wfT_wf 
+    using supp_at_base by fastforce
+qed
+
+lemma  wfPhi_f_poly_supp_s:
+  fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
+  assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
+  shows "supp s \<subseteq> {atom x, atom bv}"
+proof -
+
+  have "AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>" using lookup_fun_member assms by auto
+  hence *:"\<Theta> ; \<Phi>  ; {|bv|} \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" using assms wfPhi_f_poly_wf by simp
+  
+  thus ?thesis using wfFT_wf_aux[OF *]  using supp_at_base by auto
+qed
+
+lemmas wfPhi_f_supp = wfPhi_f_poly_supp_b wfPhi_f_simple_supp_b wfPhi_f_poly_supp_c 
+    wfPhi_f_simple_supp_t wfPhi_f_poly_supp_t wfPhi_f_simple_supp_t wfPhi_f_poly_wfT wfPhi_f_simple_wfT 
+    wfPhi_f_poly_supp_s wfPhi_f_simple_supp_s
+
+lemma fun_typ_eq_ret_unique: 
+  assumes "(AF_fun_typ x1 b1 c1 \<tau>1' s1') =  (AF_fun_typ x2 b2 c2 \<tau>2' s2')"
+  shows  "\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[x2::=v]\<^sub>\<tau>\<^sub>v"
+proof -
+  have "[[atom x1]]lst. \<tau>1' = [[atom x2]]lst. \<tau>2'" using assms lst_fst fun_typ.eq_iff lst_snd by metis
+  thus ?thesis using subst_v_flip_eq_two[of x1 \<tau>1' x2 \<tau>2' v] subst_v_\<tau>_def by metis
+qed
+
+lemma fun_typ_eq_body_unique: 
+  fixes v::v and x1::x and x2::x and s1'::s and s2'::s
+  assumes "(AF_fun_typ x1 b1 c1 \<tau>1' s1') =  (AF_fun_typ x2 b2 c2 \<tau>2' s2')"
+  shows  "s1'[x1::=v]\<^sub>s\<^sub>v = s2'[x2::=v]\<^sub>s\<^sub>v"
+proof -
+  have "[[atom x1]]lst. s1' = [[atom x2]]lst. s2'" using assms lst_fst fun_typ.eq_iff lst_snd by metis
+  thus ?thesis using subst_v_flip_eq_two[of x1 s1' x2 s2' v] subst_v_s_def by metis
+qed
+
+lemma fun_ret_unique:
+  assumes "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f"
+  shows "\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[x2::=v]\<^sub>\<tau>\<^sub>v"
+proof -
+  have *: " (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \<tau>2' s2')))" using option.inject assms by metis
+  thus ?thesis using fun_typ_eq_ret_unique fun_def.eq_iff fun_typ_q.eq_iff by metis
+qed
+
+lemma fun_poly_arg_unique:
+  fixes bv1::bv and bv2::bv and b::b and \<tau>1::\<tau> and \<tau>2::\<tau>
+  assumes "[[atom bv1]]lst. (AF_fun_typ x1 b1 c1 \<tau>1 s1) = [[atom bv2]]lst. (AF_fun_typ x2 b2 c2 \<tau>2 s2)" (is "[[atom ?x]]lst. ?a = [[atom ?y]]lst. ?b")
+  shows "\<lbrace> x1 : b1[bv1::=b]\<^sub>b\<^sub>b | c1[bv1::=b]\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x2 : b2[bv2::=b]\<^sub>b\<^sub>b | c2[bv2::=b]\<^sub>c\<^sub>b \<rbrace>" 
+proof -
+  obtain c::bv where *:"atom c \<sharp> (b,b1,b2,c1,c2) \<and> atom c \<sharp> (bv1, bv2, AF_fun_typ x1 b1 c1 \<tau>1 s1, AF_fun_typ x2 b2 c2 \<tau>2 s2)" using obtain_fresh fresh_Pair by metis
+  hence "(bv1 \<leftrightarrow> c) \<bullet> AF_fun_typ x1 b1 c1 \<tau>1 s1 = (bv2 \<leftrightarrow> c) \<bullet> AF_fun_typ x2 b2 c2 \<tau>2 s2" using  Abs1_eq_iff_all(3)[of ?x ?a ?y ?b] assms by metis
+  hence "AF_fun_typ x1 ((bv1 \<leftrightarrow> c) \<bullet> b1) ((bv1 \<leftrightarrow> c) \<bullet> c1) ((bv1 \<leftrightarrow> c) \<bullet> \<tau>1) ((bv1 \<leftrightarrow> c) \<bullet> s1) = AF_fun_typ x2 ((bv2 \<leftrightarrow> c) \<bullet> b2) ((bv2 \<leftrightarrow> c) \<bullet> c2) ((bv2 \<leftrightarrow> c) \<bullet> \<tau>2) ((bv2 \<leftrightarrow> c) \<bullet> s2)" 
+    using fun_typ_flip by metis    
+  hence **:"\<lbrace> x1 :((bv1 \<leftrightarrow> c) \<bullet> b1) | ((bv1 \<leftrightarrow> c) \<bullet> c1) \<rbrace> = \<lbrace> x2 : ((bv2 \<leftrightarrow> c) \<bullet> b2) | ((bv2 \<leftrightarrow> c) \<bullet> c2) \<rbrace>" (is "\<lbrace> x1 : ?b1 | ?c1 \<rbrace> = \<lbrace> x2 : ?b2 | ?c2 \<rbrace>") using fun_arg_unique_aux by metis
+  hence "\<lbrace> x1 :((bv1 \<leftrightarrow> c) \<bullet> b1) | ((bv1 \<leftrightarrow> c) \<bullet> c1) \<rbrace>[c::=b]\<^sub>\<tau>\<^sub>b = \<lbrace> x2 : ((bv2 \<leftrightarrow> c) \<bullet> b2) | ((bv2 \<leftrightarrow> c) \<bullet> c2) \<rbrace>[c::=b]\<^sub>\<tau>\<^sub>b" by metis
+  hence "\<lbrace> x1 :((bv1 \<leftrightarrow> c) \<bullet> b1)[c::=b]\<^sub>b\<^sub>b | ((bv1 \<leftrightarrow> c) \<bullet> c1)[c::=b]\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x2 : ((bv2 \<leftrightarrow> c) \<bullet> b2)[c::=b]\<^sub>b\<^sub>b | ((bv2 \<leftrightarrow> c) \<bullet> c2)[c::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_tb.simps by metis  
+  thus ?thesis using *  flip_subst_subst subst_b_c_def subst_b_b_def fresh_prodN flip_commute by metis
+qed
+
+lemma fun_poly_ret_unique:
+  assumes "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and "Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f"
+  shows "\<tau>1'[bv1::=b]\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[bv2::=b]\<^sub>\<tau>\<^sub>b[x2::=v]\<^sub>\<tau>\<^sub>v"
+proof -
+  have *: " (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')))" using option.inject assms by metis
+  hence "AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1') = AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')" 
+      (is "AF_fun_typ_some bv1 ?ft1 = AF_fun_typ_some bv2 ?ft2") using fun_def.eq_iff by metis
+  hence **:"[[atom bv1]]lst. ?ft1 = [[atom bv2]]lst. ?ft2" using fun_typ_q.eq_iff(1) by metis
+
+  hence *:"subst_ft_b ?ft1 bv1 b = subst_ft_b ?ft2 bv2 b" using subst_b_flip_eq_two subst_b_fun_typ_def by metis
+  have "[[atom x1]]lst. \<tau>1'[bv1::=b]\<^sub>\<tau>\<^sub>b = [[atom x2]]lst. \<tau>2'[bv2::=b]\<^sub>\<tau>\<^sub>b" 
+    apply(rule lst_snd[of _ "c1[bv1::=b]\<^sub>c\<^sub>b" _ _ "c2[bv2::=b]\<^sub>c\<^sub>b"])
+    apply(rule lst_fst[of _ _ "s1'[bv1::=b]\<^sub>s\<^sub>b" _ _ "s2'[bv2::=b]\<^sub>s\<^sub>b"])
+    using *  subst_ft_b.simps fun_typ.eq_iff by metis
+  thus ?thesis using subst_v_flip_eq_two subst_v_\<tau>_def by metis
+qed
+
+lemma fun_poly_body_unique:
+  assumes "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and "Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f"
+  shows "s1'[bv1::=b]\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v = s2'[bv2::=b]\<^sub>s\<^sub>b[x2::=v]\<^sub>s\<^sub>v"
+proof - 
+  have *: " (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')))" 
+    using option.inject assms by metis
+  hence "AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1') = AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')" 
+      (is "AF_fun_typ_some bv1 ?ft1 = AF_fun_typ_some bv2 ?ft2") using fun_def.eq_iff by metis
+  hence **:"[[atom bv1]]lst. ?ft1 = [[atom bv2]]lst. ?ft2" using fun_typ_q.eq_iff(1) by metis
+
+  hence *:"subst_ft_b ?ft1 bv1 b = subst_ft_b ?ft2 bv2 b" using subst_b_flip_eq_two subst_b_fun_typ_def by metis
+  have "[[atom x1]]lst. s1'[bv1::=b]\<^sub>s\<^sub>b = [[atom x2]]lst. s2'[bv2::=b]\<^sub>s\<^sub>b" 
+    using lst_snd lst_fst subst_ft_b.simps fun_typ.eq_iff 
+    by (metis "local.*")
+
+  thus ?thesis using subst_v_flip_eq_two subst_v_s_def by metis
+qed
+
+lemma funtyp_eq_iff_equalities:
+  fixes s'::s and s::s
+  assumes " [[atom x']]lst. ((c', \<tau>'), s') = [[atom x]]lst. ((c, \<tau>), s)" 
+  shows "\<lbrace> x' : b  | c' \<rbrace> = \<lbrace> x : b  | c \<rbrace> \<and>  s'[x'::=v]\<^sub>s\<^sub>v = s[x::=v]\<^sub>s\<^sub>v \<and> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
+proof - 
+  have  "[[atom x']]lst. s' = [[atom x]]lst. s" and "[[atom x']]lst. \<tau>' = [[atom x]]lst. \<tau>" and
+           " [[atom x']]lst. c' = [[atom x]]lst. c" using lst_snd lst_fst assms by metis+
+  thus ?thesis using   subst_v_flip_eq_two  \<tau>.eq_iff 
+    by (metis assms fun_typ.eq_iff fun_typ_eq_body_unique fun_typ_eq_ret_unique)
+qed
+
+section \<open>Weakening\<close>
+
+lemma wfX_wfB1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B>::\<B> and \<Phi>::\<Phi> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+           and cs::branch_s and css::branch_list
+  shows  wfV_wfB: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" and     
+         "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> True" and
+         "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow>   True" and
+         wfT_wfB: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b_of \<tau> " and
+         "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  True" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> True" and     
+         "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow>  True" and       
+         wfCE_wfB: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
+proof(induct   rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
+ case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
+  hence "(x,b,c) \<in> toSet \<Gamma>" using lookup_iff wfV_wf  using lookup_in_g by presburger
+  hence "b \<in> fst`snd`toSet \<Gamma>" by force
+  hence "wfB \<Theta> \<B> b" using wfG_wfB wfV_varI by metis
+  then show ?case using wfV_elims wfG_wf  wf_intros by metis
+next
+  case (wfV_litI \<Theta> \<Gamma> l)
+  moreover have "wfTh \<Theta>" using wfV_wf wfG_wf wfV_litI by metis
+  ultimately  show ?case using wfV_wf wfG_wf  wf_intros base_for_lit.simps l.exhaust by metis
+next
+  case (wfV_pairI \<Theta> \<Gamma> v1 b1 v2 b2)
+   then show ?case using  wfG_wf  wf_intros by metis
+next
+  case (wfV_consI s dclist \<Theta> dc x b c B \<Gamma> v)
+  then show ?case
+    using wfV_wf wfG_wf   wfB_consI by metis  
+next
+  case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+  then show ?case
+    using wfV_wf wfG_wf  using wfB_appI by metis
+next
+  case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
+  then show ?case using wfB_elims by auto
+next
+  case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using wfB_elims by auto
+next
+  case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis
+next
+  case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2)
+  then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis
+next
+  case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  then show ?case using  wfB_elims by metis
+next
+  case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  then show ?case using wfB_elims by metis
+next
+  case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using wfB_elims by auto
+next
+  case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
+  then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis
+qed(auto | metis wfV_wf wfG_wf  wf_intros )+
+
+lemma wfX_wfB2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B>::\<B> and \<Phi>::\<Phi> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+           and cs::branch_s and css::branch_list
+  shows
+         wfE_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b"  and
+         wfS_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and
+         wfCS_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and
+         wfCSS_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and     
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow>  True" and   
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi>  ; \<B>' \<turnstile>\<^sub>w\<^sub>f ft" 
+proof(induct   rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts) 
+  case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  then show ?case using wfB_elims wfX_wfB1 by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wfB_elims wfX_wfB1 by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  then show ?case using wfB_boolI  wfX_wfY by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wfB_elims wfX_wfB1 by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wfB_elims wfX_wfB1 by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wfB_elims wfX_wfB1 by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wfB_elims wfX_wfB1 
+    using wfB_pairI by auto
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  then show ?case using wfB_elims wfX_wfB1 
+    using wfB_intI wfX_wfY1(1) by auto
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
+  hence "\<Theta>; \<B>;(x,b,c) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>"  using wfPhi_f_simple_wfT wfT_b_weakening by fast
+  then show ?case using b_of.simps using wfT_b_weakening
+     by (metis b_of.cases bot.extremum wfT_elims(2))
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  hence "\<Theta> ; {| bv |} ;(x,b,c) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>"  using wfPhi_f_poly_wfT wfX_wfY by blast
+  then show ?case using wfE_appPI b_of.simps using wfT_b_weakening wfT_elims  wfT_subst_wfB subst_b_b_def  by metis
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  hence "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfD_wfT by fast
+  then show ?case using wfT_elims b_of.simps by metis
+next
+  case (wfFTNone \<Theta> ft)
+  then show ?case by auto
+next
+  case (wfFTSome \<Theta> bv ft)
+  then show ?case by auto
+next
+  case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  then show ?case using wfX_wfB1 
+    using wfB_unitI wfX_wfY2(5) by auto
+next
+  case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dc t cs b)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dc t cs b dclist css)
+  then show ?case using wfX_wfB1 by auto      
+next
+  case (wfD_emptyI \<Theta> \<B> \<Gamma>)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfPhi_emptyI \<Theta>)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfPhi_consI f \<Theta> \<Phi> ft)
+  then show ?case using wfX_wfB1 by auto
+next
+  case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
+  then show ?case using wfX_wfB1 
+    by (meson Wellformed.wfFTI wb_b_weakening2(8))
+qed(metis wfV_wf wfG_wf  wf_intros wfX_wfB1)
+
+lemmas wfX_wfB = wfX_wfB1 wfX_wfB2
+
+lemma wf_weakening1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+         and cs::branch_s and css::branch_list
+
+  shows  wfV_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b" and
+         wfC_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>'  \<Longrightarrow> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f  c" and
+         "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow>  True" and
+         wfT_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts  \<Longrightarrow>  True" and 
+         "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True " and
+         wfB_weakening: "wfB \<Theta> \<B> b \<Longrightarrow>  \<B> |\<subseteq>| \<B>' \<Longrightarrow> wfB \<Theta> \<B> b" and 
+         wfCE_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>' \<turnstile>\<^sub>w\<^sub>f ce : b"  and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
+proof(nominal_induct
+          b and c and \<Gamma> and \<tau> and ts and P and b and b and td 
+          avoiding:  \<Gamma>'          
+          rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+ case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
+  hence "Some (b, c) = lookup \<Gamma>' x" using  lookup_weakening  by metis
+  then show ?case using Wellformed.wfV_varI wfV_varI by metis
+next
+  case (wfTI z \<Theta> \<B>  \<Gamma>  b c)  (* This proof pattern is used elsewhere when proving weakening for typing predicates *)
+  show ?case proof
+    show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>')\<close> using wfTI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfTI by auto
+    have *:"toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>')" using toSet.simps wfTI by auto
+    thus  \<open> \<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfTI(8)[OF _ *] wfTI wfX_wfY
+      by (simp add: wfG_cons_TRUE)
+  qed
+next
+  case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
+  show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
+    show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfV_conspI by auto
+    show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>', b, v)\<close> using wfV_conspI by simp
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by auto
+  qed
+qed(metis wf_intros)+
+
+lemma wf_weakening2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+         and cs::branch_s and css::branch_list
+  shows 
+         wfE_weakening: "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
+         wfS_weakening: "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<Phi>; \<B>; \<Gamma>' ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<Phi>; \<B>; \<Gamma>' ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and       
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
+         wfD_weakning: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and       
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True" 
+proof(nominal_induct
+          b and b and b and b and \<Phi> and \<Delta> and ftq and ft
+          avoiding:  \<Gamma>'          
+          rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+  show ?case proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by auto
+    show \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> using wfE_appPI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close> using wfE_appPI wf_weakening1 by auto
+  qed
+next                          
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  show ?case proof(rule)
+    show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
+    have "toSet ((x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet  ((x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>')"  using wfS_letI by auto
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close>  using wfS_letI by (meson wfG_cons wfG_cons_TRUE wfS_wf)
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using wfS_letI by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, e, b)\<close>  using wfS_letI by auto
+  qed
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  show ?case proof
+    show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close>  using wfS_let2I wf_weakening1 by auto
+    have "toSet ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet  ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>')"  using wfS_let2I by auto
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b \<close>  using wfS_let2I    by (meson wfG_cons wfG_cons_TRUE wfS_wf)
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, s1, b, \<tau>)\<close>  using wfS_let2I by auto
+  qed
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  show ?case proof
+    show "\<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<tau> " using wfS_varI wf_weakening1 by auto
+    show "\<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> "  using wfS_varI wf_weakening1 by auto
+    show "atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, \<tau>, v, b)"  using wfS_varI by auto
+    show "\<Theta> ; \<Phi>  ; \<B> ; \<Gamma>' ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta>  \<turnstile>\<^sub>w\<^sub>f s : b "  using wfS_varI by auto
+  qed
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau>  \<Gamma> \<Delta> s b tid dc)
+  show ?case proof
+    have "toSet ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet  ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>')"  using wfS_branchI by auto
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_branchI  by (meson wfG_cons wfG_cons_TRUE wfS_wf)
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, \<Gamma>', \<tau>)\<close> using wfS_branchI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_branchI by auto
+  qed
+next
+  case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  show ?case proof(rule)
+    show \<open> \<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI wf_weakening1 by auto
+    have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>'" proof(rule wfG_consI)
+      show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<close> using wfS_assertI by auto
+      show \<open>atom x \<sharp> \<Gamma>'\<close> using wfS_assertI by auto
+      show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f B_bool \<close> using wfS_assertI wfB_boolI wfX_wfY by metis
+      have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, TRUE) #\<^sub>\<Gamma> \<Gamma>'" proof
+        show "(TRUE) \<in> {TRUE, FALSE}" by auto
+        show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<close> using wfS_assertI by auto
+        show \<open>atom x \<sharp> \<Gamma>'\<close> using wfS_assertI by auto
+        show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f B_bool \<close> using wfS_assertI wfB_boolI wfX_wfY by metis
+      qed
+      thus  \<open> \<Theta>; \<B>; (x, B_bool, TRUE) #\<^sub>\<Gamma> \<Gamma>' \<turnstile>\<^sub>w\<^sub>f c \<close> 
+       using  wf_weakening1(2)[OF \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f c \<close>  \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, TRUE) #\<^sub>\<Gamma> \<Gamma>' \<close>] by force
+    qed  
+    thus  \<open> \<Theta>; \<Phi>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_assertI by fastforce   
+    show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_assertI by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, c, b, s)\<close> using wfS_assertI by auto
+  qed
+qed(metis wf_intros wf_weakening1)+
+
+lemmas wf_weakening = wf_weakening1 wf_weakening2
+
+lemma wfV_weakening_cons:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and c::c
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b"  and "atom y \<sharp> \<Gamma>" and "\<Theta>; \<B>; ((y,b',TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f c" 
+  shows "\<Theta>; \<B>; (y,b',c) #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f  v : b"
+proof -
+  have "wfG \<Theta> \<B> ((y,b',c) #\<^sub>\<Gamma>\<Gamma>)" using wfG_intros2 assms by auto
+  moreover have "toSet \<Gamma> \<subseteq> toSet ((y,b',c) #\<^sub>\<Gamma>\<Gamma>)" using toSet.simps by auto
+  ultimately show ?thesis using wf_weakening  using assms(1) by blast
+qed
+
+lemma wfG_cons_weakening:
+  fixes \<Gamma>'::\<Gamma>
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" and  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "atom x \<sharp> \<Gamma>'"
+  shows  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x, b, c)  #\<^sub>\<Gamma> \<Gamma>')"
+proof(cases "c \<in> {TRUE,FALSE}")
+  case True
+  then show ?thesis using wfG_wfB  wfG_cons2I assms by auto
+next
+  case False
+  hence *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<and> atom x \<sharp> \<Gamma> \<and>  \<Theta>; \<B>; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c" 
+    using  wfG_elims(2)[OF assms(1)] by auto
+  have a1:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'" using wfG_wfB wfG_cons2I assms by simp
+  moreover have a2:"toSet ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> ) \<subseteq> toSet ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>')" using toSet.simps assms by blast
+  moreover have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'" proof
+    show "(TRUE) \<in> {TRUE, FALSE}" by auto
+    show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" using assms by auto
+    show "atom x \<sharp> \<Gamma>'" using assms by auto
+    show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using assms wfG_elims by metis
+  qed  
+  hence " \<Theta>; \<B>;  (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f c" using wf_weakening  a1 a2 * by auto
+  then show ?thesis using wfG_cons1I[of c \<Theta> \<B> \<Gamma>' x b, OF False ] wfG_wfB assms by simp
+qed
+
+lemma wfT_weakening_aux:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and c::c
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>"  and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma>'" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "atom z \<sharp> \<Gamma>'"
+  shows "\<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b | c \<rbrace>" 
+proof 
+  show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>')\<close> 
+    using wf_supp wfX_wfY assms fresh_prodN fresh_def x_not_in_b_set wfG_fresh_x by metis
+  show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using assms wfT_elims by metis
+  show \<open> \<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c \<close> proof - 
+    have *:"\<Theta>; \<B>; (z,b,TRUE) #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c" using wfT_wfC fresh_weakening assms by auto
+    moreover have a1:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'" using wfG_cons2I assms \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  b\<close> by simp
+    moreover have a2:"toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> ) \<subseteq> toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>')" using toSet.simps assms by blast
+    moreover have " \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>' " proof
+      show "(TRUE) \<in> {TRUE, FALSE}" by auto
+      show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" using assms by auto
+      show "atom z \<sharp> \<Gamma>'" using assms by auto
+      show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using assms wfT_elims by metis
+    qed  
+    thus ?thesis  using wf_weakening a1 a2 * by auto
+  qed    
+qed
+
+lemma wfT_weakening_all:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and \<tau>::\<tau>
+  assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>"  and "\<Theta>; \<B>' \<turnstile>\<^sub>w\<^sub>f  \<Gamma>'" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<B> |\<subseteq>| \<B>'" 
+  shows "\<Theta>; \<B>' ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f  \<tau>" 
+  using wb_b_weakening assms wfT_weakening by metis
+
+lemma wfT_weakening_nil:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and \<tau>::\<tau>
+  assumes "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>"  and "\<Theta>; \<B>' \<turnstile>\<^sub>w\<^sub>f  \<Gamma>'" 
+  shows "\<Theta>; \<B>' ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f  \<tau>" 
+  using wfT_weakening_all
+  using assms(1) assms(2) toSet.simps(1) by blast
+
+lemma wfTh_wfT2: 
+  fixes x::x and v::v and \<tau>::\<tau> and G::\<Gamma>
+  assumes "wfTh \<Theta>" and "AF_typedef s dclist \<in> set \<Theta>" and 
+      "(dc, \<tau>) \<in> set dclist"  and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f G"
+  shows "supp \<tau> = {}" and "\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>" and "wfT \<Theta> B G \<tau>"
+proof -
+  show  "supp \<tau> = {}" proof(rule ccontr)
+    assume a1: "supp \<tau> \<noteq> {}"
+    have  "supp \<Theta> \<noteq> {}" proof -
+      obtain dclist where dc: "AF_typedef s dclist \<in> set \<Theta> \<and> (dc, \<tau>) \<in> set dclist" 
+        using assms  by auto
+      hence "supp (dc,\<tau>)  \<noteq> {}" 
+        using a1  by (simp add: supp_Pair)
+      hence "supp dclist  \<noteq> {}" using dc supp_list_member by auto
+      hence "supp (AF_typedef s dclist) \<noteq> {}"  using type_def.supp by auto
+      thus ?thesis using supp_list_member dc by auto
+    qed
+    thus False using assms wfTh_supp by simp
+  qed
+  thus "\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>"  by (simp add: fresh_def)
+  have "wfT \<Theta> {||} GNil \<tau>" using assms wfTh_wfT by auto
+  thus "wfT \<Theta> B G \<tau>" using assms wfT_weakening_nil by simp
+qed
+
+lemma wf_d_weakening:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+         and cs::branch_s and css::branch_list
+  shows 
+         "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f e : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>  \<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta>' ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b" and
+         "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>   \<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta>' ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and       
+         "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> True" and        
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
+proof(nominal_induct
+          b and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
+          avoiding:  \<Delta>'         
+       rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+  case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  then show ?case using wf_intros by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
+  then show ?case using wf_intros by metis
+next
+   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
+   show ?case proof(rule, (rule wfE_appPI)+)
+    show \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close>  using wfE_appPI by auto
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close>  using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close>  using wfE_appPI by auto
+  qed
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  show ?case proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_mvarI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfE_mvarI by auto
+    show \<open>(u, \<tau>) \<in> setD \<Delta>'\<close> using wfE_mvarI by auto
+  qed
+next
+  case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
+  show ?case proof(rule)
+    show \<open> \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>' \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
+    have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons2I wfX_wfY wfS_letI by metis
+    hence "\<Theta>; \<B>; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening2(6) wfS_letI by force
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_letI by metis
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_letI by auto
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', e, b)\<close> using wfS_letI by auto
+  qed
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  show ?case proof
+    have "\<Theta>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" proof(rule  wf_weakening2(6))
+      show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_assertI by auto
+    next
+      show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<close> using wfS_assertI wfX_wfY by metis
+    next
+      show \<open>toSet \<Gamma> \<subseteq> toSet ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>)\<close> using wfS_assertI by auto
+    qed
+    thus  \<open> \<Theta>; \<Phi>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_assertI wfX_wfY by metis
+  next
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI by auto
+  next
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_assertI by auto
+  next
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', c, b, s)\<close> using wfS_assertI by auto
+  qed
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
+  show ?case proof
+    show \<open> \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_let2I by auto
+    have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons2I wfX_wfY wfS_let2I by metis
+    hence "\<Theta>; \<B>; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening2(6) wfS_let2I by force
+    thus  \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s2 : b \<close> using  wfS_let2I by metis
+    show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', s1, b,\<tau>)\<close> using wfS_let2I by auto
+  qed
+next
+  case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  show ?case proof
+    show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close>  using wfS_varI by auto
+    show \<open>atom u \<sharp>  (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', \<tau>, v, b)\<close>  using wfS_varI setD.simps by auto
+    have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f (u, \<tau>)  #\<^sub>\<Delta> \<Delta>'" using wfS_varI wfD_cons setD.simps u_fresh_d by metis 
+    thus  \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma> ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close>  using wfS_varI setD.simps by blast
+  qed
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  show ?case proof
+    show \<open>(u, \<tau>) \<in> setD \<Delta>'\<close> using wfS_assignI setD.simps by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_assignI by auto
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfS_assignI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close> using wfS_assignI by auto
+  qed
+next
+  case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
+  show ?case proof
+    have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons2I wfX_wfY wfS_branchI by metis
+    hence "\<Theta>; \<B>; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening2(6) wfS_branchI by force
+    thus  \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_branchI by simp
+    show \<open> atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', \<Gamma>, \<tau>)\<close> using wfS_branchI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_branchI by auto
+  qed
+next
+  case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
+  then show ?case using wf_intros by metis
+next
+  case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
+  then show ?case using wf_intros by metis
+qed(auto+)
+
+section \<open>Useful well-formedness instances\<close>
+
+text \<open>Well-formedness for particular constructs that we will need later\<close>
+
+lemma wfC_e_eq:
+  fixes ce::ce and \<Gamma>::\<Gamma>
+  assumes "\<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and "atom x \<sharp> \<Gamma> "
+  shows "\<Theta> ;  \<B> ; ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)  \<turnstile>\<^sub>w\<^sub>f (CE_val (V_var x)  ==  ce )"
+proof - 
+  have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using assms wfX_wfB by auto
+  hence wbg: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using wfX_wfY assms by auto
+  show ?thesis proof
+    show *:"\<Theta> ;  \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x) : b"
+    proof(rule)     
+      show "\<Theta> ;  \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_var x : b " proof
+        show "\<Theta>  ;  \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> " using wfG_cons2I wfX_wfY assms \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b\<close> by auto
+        show "Some (b, TRUE) = lookup ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>) x" using lookup.simps by auto
+      qed
+    qed
+    show "\<Theta> ;  \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f ce : b"
+      using assms wf_weakening1(8)[OF assms(1), of "(x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> "] * toSet.simps wfX_wfY
+      by (metis Un_subset_iff equalityE)
+  qed
+qed
+
+lemma wfC_e_eq2:
+  fixes e1::ce and e2::ce
+  assumes  "\<Theta>  ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f e1 : b"  and  "\<Theta>  ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f e2 : b"  and " \<turnstile>\<^sub>w\<^sub>f \<Theta>" and "atom x \<sharp> \<Gamma>"
+  shows "\<Theta>; \<B>; (x, b, (CE_val (V_var x)) == e1)   #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f  (CE_val (V_var x)) == e2 "
+proof(rule wfC_eqI)
+  have *: "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma>" proof(rule wfG_cons1I )
+    show "(CE_val (V_var x)  ==  e1 ) \<notin> {TRUE, FALSE}" by auto
+    show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using assms wfX_wfY by metis
+    show *:"atom x \<sharp> \<Gamma>" using assms by auto
+    show "\<Theta>; \<B>; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x)  ==  e1" using wfC_e_eq assms * by auto
+    show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using assms wfX_wfB by auto
+  qed
+  show "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x) : b" using assms * wfCE_valI wfV_varI by auto
+  show "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f e2 : b" proof(rule wf_weakening1(8))
+    show "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f e2 : b " using assms by auto
+    show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma>" using * by auto
+    show "toSet \<Gamma> \<subseteq> toSet ((x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma>)" by auto
+  qed
+qed
+
+lemma wfT_wfT_if_rev:
+  assumes "wfV P \<B> \<Gamma> v  (base_for_lit l)" and "wfT P \<B> \<Gamma> t" and \<open>atom z1 \<sharp> \<Gamma>\<close>
+  shows "wfT P \<B> \<Gamma> (\<lbrace> z1 : b_of t  | CE_val v  ==  CE_val (V_lit l) IMP  (c_of t z1)  \<rbrace>)"
+proof
+  show \<open> P; \<B>  \<turnstile>\<^sub>w\<^sub>f b_of t \<close> using wfX_wfY assms by meson
+  have wfg: " P; \<B>  \<turnstile>\<^sub>w\<^sub>f  (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>" using assms wfV_wf  wfG_cons2I wfX_wfY 
+    by (meson wfG_cons_TRUE)
+  show \<open> P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of t z1  \<close> proof
+    show *: \<open> P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e  \<close> 
+    proof(rule wfC_eqI[where b="base_for_lit l"])
+      show "P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ v ]\<^sup>c\<^sup>e : base_for_lit l" 
+        using assms wf_intros wf_weakening wfg   by (meson wfV_weakening_cons)
+      show "P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e : base_for_lit l" using wfg assms wf_intros wf_weakening wfV_weakening_cons by meson
+    qed    
+    have " t = \<lbrace> z1 : b_of t | c_of t z1 \<rbrace>" using c_of_eq 
+      using assms(2) assms(3) b_of_c_of_eq wfT_x_fresh by auto
+    thus  \<open> P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c_of t z1 \<close> using wfT_wfC assms wfG_elims * by simp
+  qed
+  show \<open>atom z1 \<sharp>  (P, \<B>, \<Gamma>)\<close> using assms wfG_fresh_x wfX_wfY by metis
+qed
+
+lemma wfT_eq_imp:
+  fixes zz::x and ll::l and \<tau>'::\<tau>
+  assumes "base_for_lit ll = B_bool" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<tau>'" and
+          "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil" and "atom zz \<sharp> x"
+  shows "\<Theta> ; {||} ; (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma>
+                 GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ ll ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>"
+proof(rule wfT_wfT_if_rev)
+  show \<open> \<Theta> ; {||} ; (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f [ x ]\<^sup>v : base_for_lit ll \<close> 
+    using wfV_varI lookup.simps base_for_lit.simps assms by simp
+  show \<open> \<Theta> ; {||} ; (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> 
+    using wf_weakening assms toSet.simps by auto
+  show \<open>atom zz \<sharp> (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil\<close> 
+    unfolding fresh_GCons fresh_prod3 b_of.simps c_of_true 
+    using x_fresh_b fresh_GNil   c_of_true c.fresh assms by metis
+qed
+
+lemma wfC_v_eq:
+  fixes ce::ce and \<Gamma>::\<Gamma> and v::v
+  assumes "\<Theta> ;  \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b" and "atom x \<sharp> \<Gamma> "
+  shows "\<Theta> ;  \<B> ; ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)  \<turnstile>\<^sub>w\<^sub>f (CE_val (V_var x)  ==  CE_val v )"
+  using wfC_e_eq wfCE_valI assms wfX_wfY  by auto
+
+lemma wfT_e_eq:
+  fixes ce::ce
+  assumes "\<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and "atom z \<sharp> \<Gamma>"
+  shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | CE_val (V_var z) == ce \<rbrace>"
+proof
+  show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using wfX_wfB assms by auto
+  show " atom z \<sharp> (\<Theta>, \<B>, \<Gamma>)" using assms wfG_fresh_x wfX_wfY by metis
+  show "\<Theta> ;  \<B> ; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var z)  ==  ce "
+    using wfTI wfC_e_eq assms wfTI by auto
+qed
+
+lemma wfT_v_eq:
+  assumes " wfB \<Theta> \<B> b" and "wfV  \<Theta> \<B> \<Gamma> v b" and "atom z \<sharp> \<Gamma>"
+  shows "wfT \<Theta> \<B> \<Gamma> \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>"
+  using wfT_e_eq wfE_valI assms wfX_wfY 
+  by (simp add: wfCE_valI)
+
+lemma wfC_wfG:
+  fixes \<Gamma>::\<Gamma> and c::c and b::b
+  assumes "\<Theta> ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c" and "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b" and "atom x \<sharp> \<Gamma>" 
+  shows "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (x,b,c)#\<^sub>\<Gamma> \<Gamma>" 
+proof - 
+  have " \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I assms wfX_wfY by fast
+  hence " \<Theta> ; B ; (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c " using wfC_weakening assms by force
+  thus ?thesis using wfG_consI assms wfX_wfY by metis
+qed
+
+section \<open>Replacing the constraint on a variable in a context\<close>
+
+lemma wfG_cons_fresh2:
+  fixes \<Gamma>'::\<Gamma>
+  assumes "wfG P \<B> (( (x',b',c')  #\<^sub>\<Gamma> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>))"
+  shows "x'\<noteq>x" 
+proof - 
+  have "atom x' \<sharp> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" 
+    using assms wfG_elims(2) by blast
+  thus ?thesis 
+    using  fresh_gamma_append[of "atom x'" \<Gamma>' "(x, b, c)  #\<^sub>\<Gamma> \<Gamma>"] fresh_GCons fresh_prod3[of "atom x'" x b c] by auto
+qed
+
+lemma replace_in_g_inside:
+  fixes \<Gamma>::\<Gamma>
+  assumes "wfG P \<B> (\<Gamma>'@((x,b0,c0') #\<^sub>\<Gamma>\<Gamma>))" 
+  shows "replace_in_g (\<Gamma>'@((x,b0,c0') #\<^sub>\<Gamma>\<Gamma>)) x c0 = (\<Gamma>'@((x,b0,c0) #\<^sub>\<Gamma>\<Gamma>))"
+using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using replace_in_g.simps by auto
+next
+  case (GCons x' b' c' \<Gamma>'')
+  hence "P; \<B> \<turnstile>\<^sub>w\<^sub>f ((x', b', c')  #\<^sub>\<Gamma> (\<Gamma>''@ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma> ))" by simp
+  hence "x \<noteq> x'" using  wfG_cons_fresh2 by metis
+  then show ?case using replace_in_g.simps GCons  by (simp add: wfG_cons)
+qed
+
+lemma wfG_supp_rig_eq:
+  fixes \<Gamma>::\<Gamma>
+  assumes  "wfG P \<B> (\<Gamma>'' @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> (\<Gamma>'' @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>)"
+  shows "supp (\<Gamma>'' @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B> = supp (\<Gamma>'' @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>"
+using assms proof(induct \<Gamma>'')
+  case GNil
+  have "supp (GNil @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>  = supp ((x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>" using supp_Cons supp_GNil by auto
+  also have "... = supp x \<union> supp b0 \<union> supp c0' \<union> supp \<Gamma> \<union> supp \<B> " using supp_GCons by auto
+  also have "... = supp x \<union> supp b0 \<union> supp c0 \<union> supp \<Gamma> \<union> supp \<B> " using GNil wfG_wfC[THEN wfC_supp_cons(2) ] by fastforce
+  also have "... =  (supp ((x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>)) \<union> supp \<B> " using supp_GCons by auto
+  finally have "supp (GNil @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B> = supp (GNil @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>" using supp_Cons supp_GNil by auto
+  then show ?case using supp_GCons wfG_cons2 by auto
+next
+  case (GCons xbc \<Gamma>1)
+  moreover have " (xbc  #\<^sub>\<Gamma> \<Gamma>1) @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>  =  (xbc  #\<^sub>\<Gamma> (\<Gamma>1 @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>))"  by simp
+  moreover have " (xbc  #\<^sub>\<Gamma> \<Gamma>1) @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>  =  (xbc  #\<^sub>\<Gamma> (\<Gamma>1 @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>))"  by simp
+  ultimately have  "(P; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>1 @ ((x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>))  \<and>  P; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>1 @ ((x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>)" using wfG_cons2 by metis
+  thus ?case using GCons supp_GCons by auto
+qed
+
+lemma fresh_replace_inside[ms_fresh]:
+  fixes y::x and \<Gamma>::\<Gamma>
+  assumes  "wfG P \<B> (\<Gamma>'' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> (\<Gamma>'' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)"
+  shows "atom y \<sharp> (\<Gamma>'' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) = atom y \<sharp> (\<Gamma>'' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)"
+  unfolding fresh_def  using wfG_supp_rig_eq assms x_not_in_b_set by fast
+
+lemma wf_replace_inside1:
+  fixes \<Gamma>::\<Gamma> and \<Phi>::\<Phi> and \<Theta>::\<Theta> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b'::b and b::b and s::s  
+           and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list
+
+shows  wfV_replace_inside: "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f v : b' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f v : b'" and
+       wfC_replace_inside: "\<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f c'' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  c''" and
+       wfG_replace_inside: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow>   \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) " and
+       wfT_replace_inside: "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow>  \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
+       "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  True" and 
+       "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True" and
+        "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True" and  
+       wfCE_replace_inside: "\<Theta> ;  \<B> ; G  \<turnstile>\<^sub>w\<^sub>f ce : b' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f ce : b'" and
+       "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
+proof(nominal_induct   
+          b' and  c'' and G and \<tau> and ts and P and b and b' and td 
+      avoiding: \<Gamma>' c'
+rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfV_varI \<Theta> \<B> \<Gamma>2 b2 c2 x2)
+  then show ?case using wf_intros by (metis lookup_in_rig_eq lookup_in_rig_neq replace_in_g_inside)
+next
+  case (wfV_conspI s bv dclist \<Theta> dc x1 b' c1 \<B> b1 \<Gamma>1 v)
+  show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
+    show \<open>(dc, \<lbrace> x1 : b'  | c1 \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
+    show \<open> \<Theta> ;  \<B>   \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfV_conspI by auto
+    show *: \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b1]\<^sub>b\<^sub>b \<close> using wfV_conspI by auto
+    moreover have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfV_wf wfV_conspI by simp
+    ultimately have "atom bv \<sharp> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" unfolding fresh_def using wfV_wf  wfG_supp_rig_eq  wfV_conspI 
+      by (metis Un_iff fresh_def)
+    thus \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>, b1, v)\<close>  
+      unfolding fresh_prodN using fresh_prodN wfV_conspI by metis    
+  qed
+next
+  case (wfTI z \<Theta> \<B> G  b1 c1)
+  show ?case proof
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfTI by auto
+
+    have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfG_consI  wfTI  wfG_cons  wfX_wfY by metis
+    moreover hence *:"wfG \<Theta> \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)"  using wfX_wfY 
+       by (metis append_g.simps(2) wfG_cons2 wfTI.hyps wfTI.prems(1) wfTI.prems(2))
+    hence \<open>atom z \<sharp> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>\<close> 
+      using fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b c \<Gamma> c' z,OF *] wfTI wfX_wfY wfG_elims by metis
+    thus \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)\<close> using wfG_fresh_x[OF *] by auto 
+
+    have "(z, b1, TRUE)  #\<^sub>\<Gamma> G = ((z, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" 
+      using wfTI append_g.simps by metis
+    thus \<open> \<Theta>; \<B>; (z, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c1 \<close> 
+      using wfTI(9)[OF _ wfTI(11)] by fastforce
+  qed
+next
+  case (wfG_nilI \<Theta>)
+  hence "GNil = (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using append_g.simps \<Gamma>.distinct GNil_append by auto
+  hence "False" using \<Gamma>.distinct by auto
+  then show ?case by auto
+next
+  case (wfG_cons1I c1 \<Theta> \<B> G x1 b1)
+  show  ?case proof(cases "\<Gamma>'=GNil")
+    case True
+    then show ?thesis using wfG_cons1I wfG_consI by auto
+  next
+    case False
+    then  obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>'" using wfG_cons1I wfG_cons1I(7) GCons_eq_append_conv by auto
+    hence **:" G = G' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons1I by auto
+    hence " \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using  wfG_cons1I by auto
+    have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x1, b1, c1)  #\<^sub>\<Gamma> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" proof(rule Wellformed.wfG_cons1I)
+      show "c1 \<notin> {TRUE, FALSE}" using wfG_cons1I by auto
+      show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> " using wfG_cons1I(3)[of G',OF **] wfG_cons1I by auto
+      show "atom x1 \<sharp> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons1I * ** fresh_replace_inside  by metis
+      show "\<Theta>; \<B>; (x1, b1, TRUE)  #\<^sub>\<Gamma> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c1" using wfG_cons1I(6)[of " (x1, b1, TRUE)  #\<^sub>\<Gamma> G'"] wfG_cons1I ** by auto
+      show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b1" using wfG_cons1I by auto
+    qed
+    thus ?thesis using * by auto
+  qed
+next
+  case (wfG_cons2I c1 \<Theta> \<B> G x1 b1)
+   show  ?case proof(cases "\<Gamma>'=GNil")
+    case True
+    then show ?thesis using wfG_cons2I wfG_consI by auto
+  next
+    case False
+    then  obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>'" using wfG_cons2I GCons_eq_append_conv by auto
+    hence **:" G = G' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I by auto
+    moreover have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I * ** by auto
+    moreover hence "atom x1 \<sharp> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I * ** fresh_replace_inside  by metis
+    ultimately show  ?thesis using Wellformed.wfG_cons2I[OF wfG_cons2I(1), of \<Theta> \<B> "G'@ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>"  x1 b1] wfG_cons2I * ** by auto
+  qed
+qed(metis  wf_intros )+
+
+lemma wf_replace_inside2:
+  fixes \<Gamma>::\<Gamma> and \<Phi>::\<Phi> and \<Theta>::\<Theta> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b'::b and b::b and s::s  
+           and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list
+shows 
+       "\<Theta> ; \<Phi> ;  \<B> ; G ; D  \<turnstile>\<^sub>w\<^sub>f e : b' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ; \<Phi> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>); D \<turnstile>\<^sub>w\<^sub>f e : b'" and
+       "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> True" and
+       "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> True" and
+       "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> True" and
+       "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<Longrightarrow> True" and
+       "\<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow>  G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f \<Delta>" and     
+       "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+       "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
+proof(nominal_induct   
+          b' and b and b and b and  \<Phi> and \<Delta> and  ftq and ft 
+      avoiding: \<Gamma>' c'
+      rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_valI by auto
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_plusI by auto
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_leqI by auto
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_eqI by metis
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_fstI by metis
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_sndI by metis
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_concatI by auto
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_splitI by auto
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_lenI by metis
+next
+  case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_appI by metis
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma>'' \<Delta> b' bv v \<tau> f x1 b1 c1 s)
+  show ?case proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
+    show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by auto
+    show *:\<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b1[bv::=b']\<^sub>b \<close> using wfE_appPI wf_replace_inside1 by auto
+
+    moreover have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfV_wf wfE_appPI by metis
+    ultimately have "atom bv \<sharp>  \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>"  
+      unfolding fresh_def using wfV_wf wfG_supp_rig_eq wfE_appPI Un_iff fresh_def  by metis 
+
+    thus  \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close>
+      using wfE_appPI  fresh_prodN by metis
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x1 b1 c1 \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
+  qed
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  then show ?case using wf_replace_inside1 Wellformed.wfE_mvarI by metis
+next
+  case (wfD_emptyI \<Theta> \<B> \<Gamma>)
+  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis
+next
+  case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI 
+    by (simp add: wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfD_cons)
+next
+  case (wfFTNone \<Theta> \<Phi> ft)
+  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis
+next
+  case (wfFTSome \<Theta> \<Phi> bv ft)
+  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis
+qed(auto)
+
+lemmas wf_replace_inside = wf_replace_inside1 wf_replace_inside2
+
+lemma wfC_replace_cons:
+  assumes "wfG P \<B> ((x,b,c1) #\<^sub>\<Gamma>\<Gamma>)" and "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c2" 
+  shows "wfC P \<B> ((x,b,c1) #\<^sub>\<Gamma>\<Gamma>) c2" 
+proof -
+  have "wfC P \<B> (GNil@((x,b,c1) #\<^sub>\<Gamma>\<Gamma>)) c2" proof(rule wf_replace_inside1(2))
+    show " P; \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c2 " using wfG_elim2 assms by auto
+    show \<open>(x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> = GNil @ (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<close> using append_g.simps by auto
+    show \<open>P; \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c1  \<close>  using wfG_elim2 assms by auto
+  qed
+  thus ?thesis using append_g.simps by auto
+qed
+
+lemma wfC_refl:
+  assumes "wfG \<Theta> \<B> ((x, b', c') #\<^sub>\<Gamma>\<Gamma>)" 
+  shows   "wfC \<Theta> \<B> ((x, b', c') #\<^sub>\<Gamma>\<Gamma>) c'"
+  using wfG_wfC assms wfC_replace_cons by auto
+
+lemma wfG_wfC_inside:
+  assumes " (x, b, c)  \<in> toSet G" and "wfG \<Theta> B G" 
+  shows  "wfC \<Theta> B G c"
+  using assms proof(induct G rule: \<Gamma>_induct)
+  case GNil
+  then show ?case by auto
+next
+  case (GCons x' b' c' \<Gamma>')
+  then consider (hd) "(x, b, c) = (x',b',c')" | (tail) "(x, b, c) \<in> toSet \<Gamma>'" using toSet.simps by auto
+  then show ?case proof(cases)
+    case hd
+    then show ?thesis using GCons wf_weakening
+      by (metis wfC_replace_cons wfG_cons_wfC)
+  next
+    case tail
+    then show ?thesis using GCons wf_weakening 
+      by (metis insert_iff insert_is_Un subsetI toSet.simps(2) wfG_cons2)
+  qed
+qed
+
+lemma wfT_wf_cons3:
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom y \<sharp> (c,\<Gamma>)"
+  shows  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (y, b, c[z::=V_var y]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma>  \<Gamma>"
+proof -
+  have "\<lbrace> z : b | c \<rbrace> = \<lbrace> y : b |  (y \<leftrightarrow> z) \<bullet> c \<rbrace>" using type_eq_flip assms by auto
+  moreover hence " (y \<leftrightarrow> z) \<bullet> c = c[z::=V_var y]\<^sub>c\<^sub>v" using  assms subst_v_c_def by auto
+  ultimately have "\<lbrace> z : b | c \<rbrace> = \<lbrace> y : b |  c[z::=V_var y]\<^sub>c\<^sub>v \<rbrace>" by metis
+  thus  ?thesis using assms wfT_wf_cons[of \<Theta> \<B> \<Gamma> y b] fresh_Pair by metis
+qed
+
+lemma wfT_wfC_cons:
+  assumes "wfT P \<B> \<Gamma> \<lbrace> z1 : b  | c1 \<rbrace>" and "wfT P \<B> \<Gamma> \<lbrace> z2 : b  | c2 \<rbrace>"  and "atom x \<sharp> (c1,c2,\<Gamma>)"
+  shows "wfC P \<B> ((x,b,c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma>\<Gamma>) (c2[z2::=V_var x]\<^sub>v)" (is "wfC P \<B> ?G ?c")
+proof -
+  have eq: "\<lbrace> z2 : b  | c2 \<rbrace> = \<lbrace> x : b | c2[z2::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using type_eq_subst assms fresh_prod3 by simp
+  have eq2: "\<lbrace> z1 : b  | c1 \<rbrace> = \<lbrace> x : b | c1[z1::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using type_eq_subst assms fresh_prod3 by simp
+  moreover have "wfT P \<B> \<Gamma> \<lbrace> x : b  | c1[z1::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using assms eq2 by auto
+  moreover hence "wfG P \<B> ((x,b,c1[z1::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>)" using wfT_wf_cons fresh_prod3 assms by auto
+  moreover have "wfT P \<B> \<Gamma> \<lbrace> x : b  | c2[z2::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using assms eq by auto
+  moreover hence "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>)  (c2[z2::=V_var x]\<^sub>c\<^sub>v)" using wfT_wfC assms fresh_prod3 by simp
+  ultimately show ?thesis using wfC_replace_cons subst_v_c_def by simp
+qed
+
+lemma wfT_wfC2:
+  fixes c::c  and x::x
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom x \<sharp> \<Gamma>"
+  shows "\<Theta>; \<B>; (x,b,TRUE)#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c[z::=[x]\<^sup>v]\<^sub>v"
+proof(cases "x=z")
+  case True
+  then show ?thesis using wfT_wfC assms by auto
+next
+  case False
+  hence "atom x \<sharp> c" using wfT_fresh_c assms by metis
+  hence "\<lbrace> x : b  | c[z::=[ x ]\<^sup>v]\<^sub>v \<rbrace> = \<lbrace> z : b | c \<rbrace>" 
+    using \<tau>.eq_iff Abs1_eq_iff(3)[of x "c[z::=[ x ]\<^sup>v]\<^sub>v" z c] 
+    by (metis flip_subst_v type_eq_flip)
+  hence " \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> x : b  | c[z::=[ x ]\<^sup>v]\<^sub>v \<rbrace>" using assms by metis
+  thus ?thesis using wfT_wfC assms by auto
+qed
+
+lemma wfT_wfG: 
+  fixes x::x and \<Gamma>::\<Gamma> and z::x and c::c and b::b
+  assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom x \<sharp> \<Gamma>" 
+  shows "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x,b, c[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>"
+proof - 
+  have "\<Theta>; \<B>; (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c[z::=[ x ]\<^sup>v]\<^sub>v" using wfT_wfC2 assms by metis
+  thus ?thesis using wfG_consI assms wfT_wfB b_of.simps wfX_wfY by metis
+qed
+
+lemma wfG_replace_inside2:
+  fixes \<Gamma>::\<Gamma> 
+  assumes "wfG P \<B> (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)"
+  shows "wfG P \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)"
+proof - 
+  have "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c" using wfG_wfC assms by auto
+  thus ?thesis using wf_replace_inside1(3)[OF assms(1)] by auto
+qed
+
+lemma wfG_replace_inside_full:
+  fixes \<Gamma>::\<Gamma> 
+  assumes "wfG P \<B> (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))"
+  shows "wfG P \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)"
+proof - 
+  have "wfG P \<B> ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)" using wfG_suffix assms by auto
+  thus ?thesis using wfG_replace_inside assms by auto
+qed
+
+lemma wfT_replace_inside2:
+  assumes "wfT \<Theta> \<B> (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) t" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))"
+  shows "wfT \<Theta> \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) t"
+proof -
+  have "wfG \<Theta> \<B> (((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" using wfG_suffix assms by auto
+  hence "wfC \<Theta> \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c" using wfG_wfC by auto
+  thus ?thesis   using wf_replace_inside assms by metis
+qed
+
+lemma wfD_unique:
+  assumes "wfD P  \<B> \<Gamma> \<Delta>" and " (u,\<tau>') \<in> setD \<Delta>" and "(u,\<tau>) \<in> setD \<Delta>"
+  shows "\<tau>'=\<tau>"
+using assms  proof(induct \<Delta> rule: \<Delta>_induct)
+  case DNil
+  then show ?case by auto
+next
+  case (DCons u' t' D)
+  hence *: "wfD P \<B> \<Gamma> ((u',t') #\<^sub>\<Delta> D)" using Cons by auto
+  show ?case proof(cases "u=u'")
+    case True
+    then have "u \<notin> fst ` setD D" using wfD_elims *  by blast
+    then show ?thesis using DCons by force
+  next
+    case False
+    then show ?thesis using DCons wfD_elims *  by (metis fst_conv setD_ConsD)
+  qed
+qed
+
+lemma replace_in_g_forget:
+  fixes x::x
+  assumes "wfG P B G"
+  shows "atom x \<notin> atom_dom G \<Longrightarrow> (G[x\<longmapsto>c]) = G" and
+  "atom x \<sharp> G \<Longrightarrow>  (G[x\<longmapsto>c]) = G"
+proof -
+  show "atom x \<notin> atom_dom G \<Longrightarrow> G[x\<longmapsto>c] = G" by (induct G rule: \<Gamma>_induct,auto)
+  thus  "atom x \<sharp> G \<Longrightarrow>  (G[x\<longmapsto>c]) = G" using wfG_x_fresh assms by simp
+qed
+
+lemma replace_in_g_fresh_single:
+  fixes G::\<Gamma> and x::x
+  assumes  \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G[x'\<longmapsto>c'']\<close> and "atom x \<sharp> G" and \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G \<close>
+  shows "atom x \<sharp> G[x'\<longmapsto>c'']" 
+  using rig_dom_eq wfG_dom_supp assms fresh_def atom_dom.simps dom.simps by metis
+
+section \<open>Preservation of well-formedness under substitution\<close>
+
+lemma wfC_cons_switch:
+  fixes c::c and c'::c
+  assumes "\<Theta>; \<B>; (x, b, c)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c'"
+  shows "\<Theta>; \<B>; (x, b, c')  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c"
+proof -
+  have *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfC_wf assms by auto
+  hence "atom x \<sharp> \<Gamma> \<and> wfG \<Theta> \<B> \<Gamma> \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using wfG_cons by auto
+  hence " \<Theta>; \<B>; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f TRUE " using wfC_trueI wfG_cons2I by simp
+  hence "\<Theta>; \<B>;(x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c'" 
+    using wf_replace_inside1(2)[of \<Theta> \<B> "(x, b, c)  #\<^sub>\<Gamma> \<Gamma>" c' GNil x b c \<Gamma> TRUE] assms by auto
+  hence "wfG \<Theta> \<B> ((x,b,c') #\<^sub>\<Gamma>\<Gamma>)" using wf_replace_inside1(3)[OF *, of GNil x b c \<Gamma> c'] by auto
+  moreover have "wfC \<Theta> \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c" proof(cases "c \<in> { TRUE, FALSE }")
+    case True
+    have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma> \<and> atom x \<sharp> \<Gamma> \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using wfG_elims(2)[OF *] by auto
+    hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (x,b,TRUE) #\<^sub>\<Gamma> \<Gamma>" using wfG_cons_TRUE by auto
+    then show ?thesis using wfC_trueI wfC_falseI True by auto
+  next
+    case False
+    then show ?thesis using wfG_elims(2)[OF *] by auto
+  qed
+  ultimately show  ?thesis using wfC_replace_cons by auto
+qed
+
+lemma subst_g_inside_simple:
+  fixes \<Gamma>\<^sub>1::\<Gamma> and \<Gamma>\<^sub>2::\<Gamma> 
+  assumes "wfG P \<B> (\<Gamma>\<^sub>1@((x,b,c) #\<^sub>\<Gamma>\<Gamma>\<^sub>2))"
+  shows "(\<Gamma>\<^sub>1@((x,b,c) #\<^sub>\<Gamma>\<Gamma>\<^sub>2))[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>1[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>2" 
+using assms proof(induct \<Gamma>\<^sub>1 rule: \<Gamma>_induct)
+  case GNil
+  then show ?case using subst_gv.simps by simp
+next
+  case (GCons x' b' c' G)
+  hence *:"P; \<B>  \<turnstile>\<^sub>w\<^sub>f (x', b', c')  #\<^sub>\<Gamma> (G @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>\<^sub>2)" by auto
+  hence "x\<noteq>x'" 
+    using  GCons append_Cons  wfG_cons_fresh2[OF *] by auto
+  hence "((GCons (x', b', c') G) @ (GCons (x, b, c)  \<Gamma>\<^sub>2))[x::=v]\<^sub>\<Gamma>\<^sub>v  =  
+         (GCons (x', b', c') (G @ (GCons (x, b, c)  \<Gamma>\<^sub>2)))[x::=v]\<^sub>\<Gamma>\<^sub>v" by auto
+  also have "... =  GCons (x', b', c'[x::=v]\<^sub>c\<^sub>v) ((G @ (GCons (x, b, c)  \<Gamma>\<^sub>2))[x::=v]\<^sub>\<Gamma>\<^sub>v)"  
+      using subst_gv.simps \<open>x\<noteq>x'\<close> by simp
+  also have "... = (x', b', c'[x::=v]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> (G[x::=v]\<^sub>\<Gamma>\<^sub>v @  \<Gamma>\<^sub>2)" using GCons * wfG_elims by metis
+  also have "... = ((x', b', c')  #\<^sub>\<Gamma> G)[x::=v]\<^sub>\<Gamma>\<^sub>v @  \<Gamma>\<^sub>2"  using subst_gv.simps \<open>x\<noteq>x'\<close>  by simp
+  finally show ?case by blast
+qed
+
+lemma subst_c_TRUE_FALSE:
+  fixes c::c
+  assumes "c \<notin> {TRUE,FALSE}" 
+  shows "c[x::=v']\<^sub>c\<^sub>v \<notin> {TRUE, FALSE}"
+using assms by(nominal_induct c rule:c.strong_induct,auto simp add: subst_cv.simps)
+
+lemma lookup_subst:
+  assumes "Some (b, c) = lookup \<Gamma> x" and "x \<noteq> x'" 
+  shows "\<exists>c'. Some (b,c') = lookup \<Gamma>[x'::=v']\<^sub>\<Gamma>\<^sub>v x"
+using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
+case GNil
+  then show ?case by auto
+next
+  case (GCons x1 b1 c1 \<Gamma>1)
+  then show ?case proof(cases "x1=x'")
+    case True
+    then show ?thesis using subst_gv.simps GCons by auto
+  next
+    case False
+    hence  *:"((x1, b1, c1)  #\<^sub>\<Gamma> \<Gamma>1)[x'::=v']\<^sub>\<Gamma>\<^sub>v =  ((x1, b1, c1[x'::=v']\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>1[x'::=v']\<^sub>\<Gamma>\<^sub>v)" using subst_gv.simps by auto
+    then show ?thesis proof(cases "x1=x")
+      case True
+      then show ?thesis using lookup.simps *
+        using GCons.prems(1) by auto
+    next
+      case False
+      then show ?thesis using lookup.simps *
+        using GCons.prems(1)  by (simp add: GCons.hyps assms(2))
+    qed
+  qed
+qed
+
+lemma lookup_subst2:
+  assumes "Some (b, c) = lookup (\<Gamma>'@((x',b\<^sub>1,c0[z0::=[x']\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)) x" and "x \<noteq> x'" and
+          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@((x',b\<^sub>1,c0[z0::=[x']\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>))" 
+  shows "\<exists>c'. Some (b,c') = lookup (\<Gamma>'[x'::=v']\<^sub>\<Gamma>\<^sub>v@\<Gamma>) x"
+  using assms lookup_subst subst_g_inside by metis
+
+lemma wf_subst1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+  shows  wfV_subst: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b        \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>;\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : b" and
+         wfC_subst: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v" and
+          wfG_subst: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" and
+          wfT_subst: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v']\<^sub>\<tau>\<^sub>v" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True " and
+          wfCE_subst: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f  ce[x::=v']\<^sub>c\<^sub>e\<^sub>v : b" and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
+proof(nominal_induct 
+      b and c and \<Gamma> and \<tau> and ts and \<Theta> and b and  b and td 
+      avoiding: x v' 
+      arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1
+      rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+ case (wfV_varI \<Theta> \<B> \<Gamma> b1 c1 x1)
+  
+  show ?case proof(cases "x1=x")
+    case True
+    hence "(V_var x1)[x::=v']\<^sub>v\<^sub>v = v' " using subst_vv.simps by auto
+    moreover have "b' = b1" using wfV_varI True  lookup_inside_wf
+      by (metis option.inject prod.inject)
+    moreover have " \<Theta>; \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v' : b'" using  wfV_varI subst_g_inside_simple wf_weakening 
+      append_g_toSetU sup_ge2  wfV_wf by metis
+    ultimately show ?thesis by auto
+  next
+    case False
+    hence "(V_var x1)[x::=v']\<^sub>v\<^sub>v = (V_var x1) " using subst_vv.simps by auto
+    moreover have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using wfV_varI by simp
+    moreover obtain c1' where "Some (b1, c1') = lookup \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v x1"  using    wfV_varI  False  lookup_subst by metis
+    ultimately show ?thesis using  Wellformed.wfV_varI[of \<Theta>  \<B> "\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" b1 c1' x1] by metis
+  qed  
+next
+  case (wfV_litI \<Theta> \<Gamma> l)
+  then show ?case using  subst_vv.simps  wf_intros by auto
+next
+  case (wfV_pairI \<Theta> \<Gamma> v1 b1 v2 b2)
+  then show ?case using subst_vv.simps  wf_intros by auto
+next
+  case (wfV_consI s dclist \<Theta> dc x b c \<Gamma> v)
+  then show ?case using subst_vv.simps  wf_intros by auto
+next
+  case (wfV_conspI s bv dclist \<Theta> dc x' b' c \<B> b \<Gamma> va)
+  show ?case unfolding subst_vv.simps proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> and \<open>(dc, \<lbrace> x' : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
+    show \<open> \<Theta> ;\<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfV_conspI by auto
+    have "atom bv \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using fresh_subst_gv_if wfV_conspI by metis
+    moreover have "atom bv \<sharp> va[x::=v']\<^sub>v\<^sub>v" using wfV_conspI fresh_subst_if  by simp
+    ultimately show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, b, va[x::=v']\<^sub>v\<^sub>v)\<close> unfolding fresh_prodN  using wfV_conspI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f va[x::=v']\<^sub>v\<^sub>v : b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by auto
+  qed
+next
+  case (wfTI z \<Theta> \<B> \<Gamma>  b c)
+  have "  \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c[x::=v']\<^sub>c\<^sub>v  \<rbrace>" proof
+    have  \<open>\<Theta>; \<B>; ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v  \<close> 
+    proof(rule  wfTI(9))
+      show \<open>(z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> = ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1) @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2\<close> using wfTI append_g.simps by simp
+      show \<open> \<Theta>; \<B>; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<close> using wfTI by auto
+    qed
+    thus *:\<open>\<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v  \<close> 
+      using subst_gv.simps subst_cv.simps wfTI fresh_x_neq by auto
+
+    have "atom z \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using fresh_subst_gv_if wfTI by metis
+    moreover have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using wfTI wfX_wfY wfG_elims subst_gv.simps * by metis
+    ultimately show  \<open>atom z \<sharp>  (\<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v)\<close> using wfG_fresh_x  by metis
+    show \<open>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b  \<close> using wfTI by auto   
+  qed
+  thus ?case using subst_tv.simps wfTI by auto
+next
+  case (wfC_trueI \<Theta> \<Gamma>)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfC_falseI \<Theta> \<Gamma>)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
+  show ?case proof(subst subst_cv.simps,rule)
+    show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f e1[x::=v']\<^sub>c\<^sub>e\<^sub>v : b " using wfC_eqI subst_dv.simps by auto
+    show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f e2[x::=v']\<^sub>c\<^sub>e\<^sub>v : b " using wfC_eqI by auto
+  qed
+next
+  case (wfC_conjI \<Theta> \<Gamma> c1 c2)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfC_disjI \<Theta> \<Gamma> c1 c2)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfC_notI \<Theta> \<Gamma> c1)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfC_impI \<Theta> \<Gamma> c1 c2)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfG_nilI \<Theta>)
+  then show ?case using subst_cv.simps  wf_intros by auto
+next
+  case (wfG_cons1I c \<Theta> \<B> \<Gamma> y b)
+
+  show ?case proof(cases "x=y")
+    case True
+    hence "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  = \<Gamma>" using subst_gv.simps by auto
+    moreover have  "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>"  using  wfG_cons1I by auto
+    ultimately show ?thesis by auto
+  next
+    case False
+    have "\<Gamma>\<^sub>1 \<noteq> GNil" using wfG_cons1I False by auto
+    then obtain G where "\<Gamma>\<^sub>1 = (y, b, c)  #\<^sub>\<Gamma> G" using GCons_eq_append_conv wfG_cons1I by auto
+    hence *:"\<Gamma> = G @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons1I by auto
+    hence  "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  =(y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using subst_gv.simps False by auto
+    moreover have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" proof(rule  Wellformed.wfG_cons1I)
+      show \<open>c[x::=v']\<^sub>c\<^sub>v \<notin> {TRUE, FALSE}\<close> using wfG_cons1I subst_c_TRUE_FALSE by auto
+      show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<close> using wfG_cons1I * by auto
+      have "\<Gamma> = (G @ ((x, b', c') #\<^sub>\<Gamma>GNil)) @ \<Gamma>\<^sub>2" using * append_g_assoc by auto
+      hence "atom y \<sharp> \<Gamma>\<^sub>2" using fresh_suffix  \<open>atom y \<sharp> \<Gamma>\<close>  by auto
+      hence "atom y \<sharp> v'" using wfG_cons1I wfV_x_fresh by metis
+      thus \<open>atom y \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v\<close> using fresh_subst_gv wfG_cons1I by auto
+      have "((y, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v = (y, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using subst_gv.simps subst_cv.simps False by auto
+      thus  \<open> \<Theta>; \<B>; (y, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v \<close> using wfG_cons1I(6)[of "(y,b,TRUE) #\<^sub>\<Gamma>G"] * subst_gv.simps 
+        wfG_cons1I by fastforce
+      show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b " using wfG_cons1I by auto
+    qed
+    ultimately show ?thesis by auto   
+  qed
+next
+  case (wfG_cons2I c \<Theta> \<B> \<Gamma> y b)
+  show ?case proof(cases "x=y")
+    case True
+    hence "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  = \<Gamma>" using subst_gv.simps by auto
+    moreover have  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"  using  wfG_cons2I by auto
+    ultimately show ?thesis by auto
+  next
+    case False
+    have "\<Gamma>\<^sub>1 \<noteq> GNil" using wfG_cons2I False by auto
+    then obtain G where "\<Gamma>\<^sub>1 = (y, b, c)  #\<^sub>\<Gamma> G"  using GCons_eq_append_conv wfG_cons2I by auto
+    hence *:"\<Gamma> = G @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons2I by auto
+    hence  "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  =(y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using subst_gv.simps False by auto
+    moreover have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" proof(rule  Wellformed.wfG_cons2I)
+      show \<open>c[x::=v']\<^sub>c\<^sub>v \<in> {TRUE, FALSE}\<close> using subst_cv.simps wfG_cons2I by auto
+      show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<close> using wfG_cons2I * by auto
+      have "\<Gamma> = (G @ ((x, b', c') #\<^sub>\<Gamma>GNil)) @ \<Gamma>\<^sub>2" using * append_g_assoc by auto
+      hence "atom y \<sharp> \<Gamma>\<^sub>2" using fresh_suffix wfG_cons2I by metis
+      hence "atom y \<sharp> v'" using wfG_cons2I  wfV_x_fresh by metis
+      thus \<open>atom y \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v\<close> using fresh_subst_gv wfG_cons2I by auto
+      show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b " using wfG_cons2I by auto
+    qed
+    ultimately show ?thesis by auto  
+  qed
+next
+  case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
+   then show ?case using subst_vv.simps  wf_intros by auto
+next
+  case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using subst_vv.simps  wf_intros by auto
+next
+  case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using subst_vv.simps  wf_intros by auto
+next
+  case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2)
+  then show ?case unfolding subst_cev.simps
+    using  Wellformed.wfCE_eqI by metis
+next
+  case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  then show ?case using Wellformed.wfCE_fstI subst_cev.simps by metis
+next
+  case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
+ then show ?case using subst_cev.simps  wf_intros by metis
+next
+  case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
+ then show ?case using subst_vv.simps  wf_intros by auto
+next
+  case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
+  then show ?case using subst_vv.simps  wf_intros by auto
+qed(metis subst_sv.simps wf_intros)+
+
+lemma wf_subst2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
+  shows    "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ; \<Phi> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ;  \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f  e[x::=v']\<^sub>e\<^sub>v : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b   \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta> ;\<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ; \<Phi> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f  s[x::=v']\<^sub>s\<^sub>v : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta>; \<Phi>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f  subst_branchv cs x v' : b" and
+         "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta>; \<Phi>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f  subst_branchlv css x v' : b" and        
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True " and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2   \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta> ;  \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f  \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" and    
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
+proof(nominal_induct 
+      b and b and b and b and  \<Phi> and \<Delta> and ftq and ft 
+      avoiding: x v' 
+      arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1
+      rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct) 
+  case (wfE_valI \<Theta> \<Gamma> v b)
+  then show ?case using subst_vv.simps  wf_intros wf_subst1 
+    by (metis subst_ev.simps(1))
+next
+  case (wfE_plusI \<Theta> \<Gamma> v1 v2)
+  then show ?case using subst_vv.simps  wf_intros wf_subst1 by auto
+next
+  case (wfE_leqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case 
+    using subst_vv.simps  subst_ev.simps subst_ev.simps wf_subst1 Wellformed.wfE_leqI 
+    by auto
+next
+  case (wfE_eqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b v2)
+  then show ?case 
+    using subst_vv.simps  subst_ev.simps subst_ev.simps wf_subst1 Wellformed.wfE_eqI     
+  proof -
+    show ?thesis
+      by (metis (no_types) subst_ev.simps(4) wfE_eqI.hyps(1) wfE_eqI.hyps(4) wfE_eqI.hyps(5) wfE_eqI.hyps(6) wfE_eqI.hyps(7) wfE_eqI.prems(1) wfE_eqI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_eqI wfV_subst) (* 31 ms *)
+  qed
+next
+  case (wfE_fstI \<Theta> \<Gamma> v1 b1 b2)
+  then show ?case using subst_vv.simps subst_ev.simps wf_subst1 Wellformed.wfE_fstI 
+  proof -
+    show ?thesis
+      by (metis (full_types) subst_ev.simps(5) wfE_fstI.hyps(1) wfE_fstI.hyps(4) wfE_fstI.hyps(5) wfE_fstI.prems(1) wfE_fstI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_fstI wf_subst1(1)) (* 78 ms *)
+  qed
+next
+  case (wfE_sndI \<Theta> \<Gamma> v1 b1 b2)
+  then show ?case 
+      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_sndI wf_subst1(1)) 
+next
+  case (wfE_concatI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case 
+    by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_concatI wf_subst1(1)) 
+next
+  case (wfE_splitI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
+  then show ?case 
+      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_splitI wf_subst1(1)) 
+next
+  case (wfE_lenI \<Theta> \<Phi> \<Gamma> \<Delta> v1)
+then show ?case 
+      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_lenI wf_subst1(1))
+next
+  case (wfE_appI \<Theta> \<Phi> \<Gamma> \<Delta> f x b c \<tau> s' v)
+then show ?case 
+      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_appI wf_subst1(1))
+next
+   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv1 v1 \<tau>1 f1 x1 b1 c1 s1)
+  show ?case proof(subst subst_ev.simps, rule)
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using wfE_appPI wfX_wfY by metis
+    show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v " using wfE_appPI by auto
+    show "Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1))) = lookup_fun \<Phi> f1" using wfE_appPI by auto
+    show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v1[x::=v']\<^sub>v\<^sub>v : b1[bv1::=b']\<^sub>b " using wfE_appPI wf_subst1 by auto
+    show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' " using wfE_appPI by auto
+    have "atom bv1 \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using fresh_subst_gv_if wfE_appPI by metis
+    moreover have "atom bv1 \<sharp> v1[x::=v']\<^sub>v\<^sub>v" using wfE_appPI fresh_subst_if  by simp
+    moreover have "atom bv1 \<sharp> \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" using wfE_appPI fresh_subst_dv_if by simp
+    ultimately show "atom bv1 \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, b', v1[x::=v']\<^sub>v\<^sub>v, (b_of \<tau>1)[bv1::=b']\<^sub>b)" 
+      using wfE_appPI fresh_prodN by metis
+  qed
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
+  have " \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f (AE_mvar u) : b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v" proof
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfE_mvarI by auto
+    show "\<Theta>; \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v " using wfE_mvarI by auto
+    show "(u, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v) \<in> setD \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" using wfE_mvarI subst_dv_member by auto
+  qed
+  thus ?case using subst_ev.simps b_of_subst by auto
+next
+  case (wfD_emptyI \<Theta> \<Gamma>)
+  then show ?case using subst_dv.simps  wf_intros wf_subst1 by auto
+next
+   case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
+  moreover hence "u \<notin> fst ` setD \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" using subst_dv.simps subst_dv_iff  using subst_dv_fst_eq by presburger
+  ultimately show ?case using subst_dv.simps Wellformed.wfD_cons wf_subst1 by auto
+next
+  case (wfPhi_emptyI \<Theta>)
+  then show ?case by auto
+next
+  case (wfPhi_consI f \<Theta> \<Phi> ft)
+  then show ?case by auto
+next
+   case (wfS_assertI \<Theta> \<Phi> \<B> x2 c \<Gamma> \<Delta> s b)
+   show ?case unfolding subst_sv.simps proof
+     show \<open> \<Theta>; \<Phi>; \<B>; (x2, B_bool, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> 
+       using wfS_assertI(4)[of "(x2, B_bool, c) #\<^sub>\<Gamma> \<Gamma>\<^sub>1" x ]  wfS_assertI by auto
+
+     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v \<close> using wfS_assertI wf_subst1 by auto
+     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close>  using wfS_assertI wf_subst1 by auto
+     show \<open>atom x2 \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, c[x::=v']\<^sub>c\<^sub>v, b, s[x::=v']\<^sub>s\<^sub>v)\<close>  
+      apply(unfold fresh_prodN,intro conjI) 
+      apply(simp add: wfS_assertI )+
+      apply(metis fresh_subst_gv_if wfS_assertI)
+      apply(simp add: fresh_prodN fresh_subst_dv_if wfS_assertI)
+      apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_assertI)        
+      apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\<tau>_def wfS_assertI)  
+      by(simp add: fresh_prodN fresh_subst_v_if subst_v_s_def wfS_assertI)  
+  qed
+next
+  case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b1 y s b2)
+  have "\<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f LET y = (e[x::=v']\<^sub>e\<^sub>v) IN (s[x::=v']\<^sub>s\<^sub>v) : b2"  
+  proof
+    show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f e[x::=v']\<^sub>e\<^sub>v : b1 \<close> using wfS_letI by auto
+    have  \<open> \<Theta> ; \<Phi>  ; \<B> ; ((y, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b2 \<close> 
+      using wfS_letI(6) wfS_letI append_g.simps by metis 
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (y, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b2 \<close> 
+      using wfS_letI subst_gv.simps by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close> using wfS_letI by auto
+    show \<open>atom y \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, e[x::=v']\<^sub>e\<^sub>v, b2)\<close> 
+      apply(unfold fresh_prodN,intro conjI) 
+       apply(simp add: wfS_letI )+
+       apply(metis fresh_subst_gv_if wfS_letI)
+       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_letI)
+       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_letI)
+       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\<tau>_def wfS_letI)      
+   done
+  qed
+  thus ?case using subst_sv.simps wfS_letI by auto
+next
+  case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> y s2 b)
+  have "\<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f LET y : \<tau>[x::=v']\<^sub>\<tau>\<^sub>v = (s1[x::=v']\<^sub>s\<^sub>v) IN (s2[x::=v']\<^sub>s\<^sub>v) : b"  
+  proof
+    show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s1[x::=v']\<^sub>s\<^sub>v :  b_of (\<tau>[x::=v']\<^sub>\<tau>\<^sub>v) \<close> using wfS_let2I b_of_subst by simp
+    have \<open> \<Theta> ; \<Phi>  ; \<B> ; ((y, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s2[x::=v']\<^sub>s\<^sub>v : b \<close>  
+      using wfS_let2I append_g.simps by metis
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (y, b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s2[x::=v']\<^sub>s\<^sub>v : b \<close> 
+      using wfS_let2I subst_gv.simps append_g.simps using b_of_subst by simp
+    show \<open>   \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v']\<^sub>\<tau>\<^sub>v  \<close> using wfS_let2I wf_subst1 by metis
+    show \<open>atom y \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, s1[x::=v']\<^sub>s\<^sub>v, b, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v)\<close> 
+      apply(unfold fresh_prodN,intro conjI) 
+       apply(simp add: wfS_let2I )+
+       apply(metis fresh_subst_gv_if wfS_let2I)
+       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_let2I)
+       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_let2I)
+       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\<tau>_def wfS_let2I)+
+      done
+  qed
+  thus ?case using subst_sv.simps(3) subst_tv.simps wfS_let2I by auto
+next
+  case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
+  show ?case proof(subst subst_sv.simps, auto simp add: u_fresh_xv,rule) 
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v']\<^sub>\<tau>\<^sub>v \<close> using wfS_varI wf_subst1 by auto
+    have "b_of (\<tau>[x::=v']\<^sub>\<tau>\<^sub>v) = b_of \<tau>" using b_of_subst by auto
+    thus \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v \<close> using wfS_varI wf_subst1 by auto
+    have *:"atom u \<sharp> v'" using wfV_supp wfS_varI fresh_def by metis
+    show   \<open>atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v, v[x::=v']\<^sub>v\<^sub>v,  b)\<close> 
+      unfolding fresh_prodN apply(auto simp add: wfS_varI)
+      using wfS_varI fresh_subst_gv * fresh_subst_dv by metis+
+    show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; (u, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v)  #\<^sub>\<Delta> \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> using wfS_varI by auto
+  qed
+next
+  case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
+  show ?case proof(subst subst_sv.simps, rule wf_intros)
+    show \<open>(u, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v) \<in> setD \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v\<close> using subst_dv_iff wfS_assignI  using subst_dv_fst_eq 
+      using subst_dv_member by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close> using wfS_assignI by auto
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v \<close> using wfS_assignI b_of_subst wf_subst1 by auto
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> "  using wfS_assignI by auto
+  qed
+next
+  case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
+  show ?case  proof(subst subst_sv.simps, rule wf_intros)
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : B_id tid \<close> using wfS_matchI wf_subst1  by auto
+    show \<open>AF_typedef tid dclist \<in> set \<Theta>\<close> using wfS_matchI by auto
+    show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dclist  \<turnstile>\<^sub>w\<^sub>f subst_branchlv cs x v'  : b \<close> using wfS_matchI by simp
+    show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v " using wfS_matchI by auto
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfS_matchI by auto
+  qed
+next
+  case (wfS_branchI \<Theta> \<Phi> \<B> y \<tau> \<Gamma> \<Delta> s b tid dc)
+  have " \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dc ; \<tau> \<turnstile>\<^sub>w\<^sub>f  dc y \<Rightarrow> (s[x::=v']\<^sub>s\<^sub>v) : b" 
+  proof 
+    have \<open> \<Theta> ; \<Phi>  ; \<B> ; ((y, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> 
+      using wfS_branchI append_g.simps by metis
+    thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (y, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> 
+      using subst_gv.simps b_of_subst wfS_branchI by simp
+    show \<open>atom y \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<tau>)\<close> 
+       apply(unfold fresh_prodN,intro conjI) 
+       apply(simp add: wfS_branchI )+
+       apply(metis fresh_subst_gv_if wfS_branchI)
+       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_branchI)
+       apply(metis fresh_subst_gv_if wfS_branchI)+      
+      done
+    show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close> using wfS_branchI by auto
+  qed
+  thus ?case using subst_branchv.simps wfS_branchI by auto
+next
+  case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
+  then show ?case using subst_branchlv.simps wf_intros by metis
+next
+  case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
+  then show ?case using subst_branchlv.simps wf_intros by metis
+
+qed(metis subst_sv.simps wf_subst1 wf_intros)+
+
+lemmas wf_subst = wf_subst1 wf_subst2
+
+lemma wfG_subst_wfV:
+  assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c0[z0::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>" and "wfV \<Theta> \<B> \<Gamma> v b"
+  shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> "
+  using assms wf_subst subst_g_inside_simple by auto
+
+lemma wfG_member_subst:
+  assumes "(x1,b1,c1) \<in> toSet (\<Gamma>'@\<Gamma>)" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x \<noteq> x1"
+  shows "\<exists>c1'. (x1,b1,c1') \<in> toSet ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" 
+proof -
+  consider (lhs) "(x1,b1,c1) \<in> toSet \<Gamma>'"  |  (rhs) "(x1,b1,c1) \<in> toSet \<Gamma>" using  append_g_toSetU assms by auto
+  thus ?thesis  proof(cases)
+    case lhs
+    hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)" using   wfG_inside_fresh[THEN subst_gv_member_iff[OF lhs]] assms by metis
+    hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
+    then show ?thesis by auto
+  next
+    case rhs
+    hence "(x1,b1,c1) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
+    then show ?thesis by auto
+  qed 
+qed
+
+lemma wfG_member_subst2:
+  assumes "(x1,b1,c1) \<in> toSet (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x \<noteq> x1"
+  shows "\<exists>c1'. (x1,b1,c1') \<in> toSet ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" 
+proof -
+  consider (lhs) "(x1,b1,c1) \<in> toSet \<Gamma>'"  |  (rhs) "(x1,b1,c1) \<in> toSet \<Gamma>" using  append_g_toSetU assms by auto
+  thus ?thesis  proof(cases)
+    case lhs
+    hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)" using   wfG_inside_fresh[THEN subst_gv_member_iff[OF lhs]] assms by metis
+    hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
+    then show ?thesis by auto
+  next
+    case rhs
+    hence "(x1,b1,c1) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
+    then show ?thesis by auto
+  qed 
+qed
+
+lemma wbc_subst:
+  fixes \<Gamma>::\<Gamma> and \<Gamma>'::\<Gamma> and v::v
+  assumes "wfC \<Theta> \<B> (\<Gamma>'@((x,b,c') #\<^sub>\<Gamma>\<Gamma>)) c"  and  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b"
+  shows "\<Theta>; \<B>; ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c[x::=v]\<^sub>c\<^sub>v" 
+proof - 
+  have "(\<Gamma>'@((x,b,c') #\<^sub>\<Gamma>\<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v = ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" using assms subst_g_inside_simple wfC_wf by metis
+  thus ?thesis  using wf_subst1(2)[OF assms(1) _ assms(2)] by metis
+qed
+
+lemma wfG_inside_fresh_suffix:
+  assumes "wfG P B (\<Gamma>'@(x,b,c) #\<^sub>\<Gamma>\<Gamma>)"
+  shows "atom x \<sharp> \<Gamma>"
+proof -
+  have "wfG P B ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)"  using wfG_suffix assms by auto
+  thus ?thesis  using wfG_elims by metis
+qed
+
+lemmas wf_b_subst_lemmas = subst_eb.simps wf_intros 
+    forget_subst subst_b_b_def subst_b_v_def subst_b_ce_def fresh_e_opp_all subst_bb.simps wfV_b_fresh ms_fresh_all(6)
+
+lemma wf_b_subst1:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and s::s and b'::b and ce::ce and td::type_def
+            and cs::branch_s and css::branch_list
+  shows  "\<Theta> ; B'  ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b'  \<Longrightarrow> {|bv|} = B'   \<Longrightarrow> \<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b  \<Longrightarrow> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile>\<^sub>w\<^sub>f  v[bv::=b]\<^sub>v\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b" and
+         "\<Theta> ; B' ;  \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow>  {|bv|} = B' \<Longrightarrow> \<Theta> ;  B \<turnstile>\<^sub>w\<^sub>f  b \<Longrightarrow> \<Theta> ; B ;  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  c[bv::=b]\<^sub>c\<^sub>b" and
+         "\<Theta> ;  B' \<turnstile>\<^sub>w\<^sub>f \<Gamma>           \<Longrightarrow> {|bv|} = B'      \<Longrightarrow>  \<Theta> ; B \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> \<Theta> ; B \<turnstile>\<^sub>w\<^sub>f  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" and
+         "\<Theta> ;  B' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>        \<Longrightarrow> {|bv|} = B'  \<Longrightarrow> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f  b \<Longrightarrow> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and        
+         "\<Theta> ;  B'  \<turnstile>\<^sub>w\<^sub>f b' \<Longrightarrow>  {|bv|} = B' \<Longrightarrow>  \<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f  b \<Longrightarrow>  \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b " and        
+         "\<Theta> ;  B' ;  \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b'    \<Longrightarrow> {|bv|} = B' \<Longrightarrow> \<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f  b  \<Longrightarrow> \<Theta> ;  B  ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile>\<^sub>w\<^sub>f  ce[bv::=b]\<^sub>c\<^sub>e\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b"  and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
+proof(nominal_induct 
+      b' and c and \<Gamma> and \<tau> and ts and \<Theta> and b' and  b' and td 
+      avoiding: bv b B
+     rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfB_intI \<Theta> \<B>)
+  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
+next
+  case (wfB_boolI \<Theta> \<B>)
+ then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
+next
+  case (wfB_unitI \<Theta> \<B>)
+  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
+next
+  case (wfB_bitvecI \<Theta> \<B>)
+  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
+next
+  case (wfB_pairI \<Theta> \<B> b1 b2)
+  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
+next
+  case (wfB_consI \<Theta> s dclist \<B>)
+  then show ?case using subst_bb.simps Wellformed.wfB_consI by simp
+next
+  case (wfB_appI \<Theta> ba s bva dclist \<B>)
+  then show ?case using subst_bb.simps Wellformed.wfB_appI forget_subst wfB_supp 
+    by (metis bot.extremum_uniqueI ex_in_conv fresh_def subst_b_b_def supp_empty_fset)
+next
+  case (wfV_varI \<Theta> \<B>1 \<Gamma> b1 c x)
+  show ?case unfolding subst_vb.simps proof
+    show "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b " using wfV_varI by auto
+    show "Some (b1[bv::=b]\<^sub>b\<^sub>b, c[bv::=b]\<^sub>c\<^sub>b) = lookup \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b x" using subst_b_lookup wfV_varI by simp
+  qed
+next
+  case (wfV_litI \<Theta> \<B> \<Gamma> l)
+  then show ?case using Wellformed.wfV_litI subst_b_base_for_lit by simp
+next
+  case (wfV_pairI \<Theta> \<B>1 \<Gamma> v1 b1 v2 b2)
+  show ?case unfolding subst_vb.simps proof(subst subst_bb.simps,rule)
+    show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : b1[bv::=b]\<^sub>b\<^sub>b" using wfV_pairI by simp
+    show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v2[bv::=b]\<^sub>v\<^sub>b : b2[bv::=b]\<^sub>b\<^sub>b " using wfV_pairI by simp
+  qed
+next
+  case (wfV_consI s dclist \<Theta> dc x b' c \<B>' \<Gamma> v) 
+  show ?case unfolding subst_vb.simps proof(subst subst_bb.simps, rule  Wellformed.wfV_consI) 
+    show 1:"AF_typedef s dclist \<in> set \<Theta>" using wfV_consI by auto
+    show 2:"(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist"  using wfV_consI by auto
+    have "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b"  using wfV_consI by auto
+    moreover hence "supp b' = {}" using 1 2 wfTh_lookup_supp_empty \<tau>.supp wfX_wfY by blast
+    moreover hence  "b'[bv::=b]\<^sub>b\<^sub>b = b'" using  forget_subst subst_bb_def fresh_def       by (metis empty_iff subst_b_b_def)
+    ultimately show  "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'" using wfV_consI by simp
+  qed
+next
+  case (wfV_conspI s bva dclist \<Theta> dc x b' c \<B>' ba \<Gamma> v)
+  have *:"atom bv \<sharp> b'" using  wfTh_poly_supp_b[of s bva dclist \<Theta> dc x b' c] fresh_def wfX_wfY \<open>atom bva \<sharp> bv\<close> 
+    by (metis insert_iff not_self_fresh singleton_insert_inj_eq' subsetI subset_antisym wfV_conspI wfV_conspI.hyps(4) wfV_conspI.prems(2))
+  show ?case unfolding subst_vb.simps subst_bb.simps proof
+    show \<open>AF_typedef_poly s bva dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
+    show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
+    thus \<open> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f ba[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by metis
+    have "atom bva \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using fresh_subst_if subst_b_\<Gamma>_def wfV_conspI by metis
+    moreover have "atom bva \<sharp> ba[bv::=b]\<^sub>b\<^sub>b"  using fresh_subst_if subst_b_b_def wfV_conspI by metis
+    moreover have "atom bva \<sharp> v[bv::=b]\<^sub>v\<^sub>b"  using fresh_subst_if subst_b_v_def wfV_conspI by metis 
+    ultimately show \<open>atom bva \<sharp> (\<Theta>, B, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, ba[bv::=b]\<^sub>b\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b)\<close> 
+      unfolding fresh_prodN using wfV_conspI fresh_def supp_fset by auto 
+    show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'[bva::=ba[bv::=b]\<^sub>b\<^sub>b]\<^sub>b\<^sub>b \<close> 
+      using wfV_conspI  subst_bb_commute[of bv b' bva ba b] * wfV_conspI by metis
+  qed
+next
+  case (wfTI z \<Theta> \<B>' \<Gamma>'  b' c)
+  show ?case proof(subst subst_tb.simps, rule Wellformed.wfTI)
+    show "atom z \<sharp>  (\<Theta>, B, \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b)" using wfTI   subst_g_b_x_fresh by simp
+    show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b " using wfTI by auto
+    show "\<Theta> ;  B ; (z, b'[bv::=b]\<^sub>b\<^sub>b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f c[bv::=b]\<^sub>c\<^sub>b " using wfTI by simp
+  qed
+next
+  case (wfC_eqI \<Theta> \<B>' \<Gamma> e1 b' e2)
+  thus ?case using Wellformed.wfC_eqI subst_db.simps  subst_cb.simps wfC_eqI by metis
+next
+  case (wfG_nilI \<Theta> \<B>')
+  then show ?case using Wellformed.wfG_nilI subst_gb.simps by simp
+next
+  case (wfG_cons1I c' \<Theta> \<B>' \<Gamma>' x b')
+  show ?case proof(subst subst_gb.simps, rule Wellformed.wfG_cons1I)
+    show "c'[bv::=b]\<^sub>c\<^sub>b \<notin> {TRUE, FALSE}" using wfG_cons1I(1)
+      by(nominal_induct c' rule: c.strong_induct,auto+) 
+    show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b "  using wfG_cons1I by auto
+    show "atom x \<sharp> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b"  using wfG_cons1I subst_g_b_x_fresh by auto
+    show "\<Theta> ;  B ; (x, b'[bv::=b]\<^sub>b\<^sub>b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f c'[bv::=b]\<^sub>c\<^sub>b"  using wfG_cons1I by auto
+    show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b "  using wfG_cons1I by auto
+  qed   
+next
+  case (wfG_cons2I c' \<Theta> \<B>' \<Gamma>' x b')
+  show ?case proof(subst subst_gb.simps, rule Wellformed.wfG_cons2I)
+    show "c'[bv::=b]\<^sub>c\<^sub>b \<in> {TRUE, FALSE}" using wfG_cons2I by auto
+    show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b "  using wfG_cons2I by auto
+    show "atom x \<sharp> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b"  using wfG_cons2I subst_g_b_x_fresh by auto
+    show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b "  using wfG_cons2I by auto
+  qed
+next
+  case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
+  then show ?case using subst_ceb.simps wf_intros wfX_wfY   
+    by (metis wf_b_subst_lemmas wfCE_b_fresh)
+next
+  case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   
+    by metis
+next
+  case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
+  then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   
+    by metis
+next
+  case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2)
+  then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   
+    by metis
+next
+  case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
+   then show ?case 
+     by (metis (no_types) subst_bb.simps(5) subst_ceb.simps(3) wfCE_fstI.hyps(2) 
+        wfCE_fstI.prems(1) wfCE_fstI.prems(2) Wellformed.wfCE_fstI) 
+next
+  case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
+  then show ?case 
+     by (metis (no_types) subst_bb.simps(5) subst_ceb.simps wfCE_sndI.hyps(2) 
+        wfCE_sndI wfCE_sndI.prems(2) Wellformed.wfCE_sndI) 
+next
+  case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
+   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY wf_b_subst_lemmas wfCE_b_fresh  
+   proof -
+     show ?thesis
+       using wfCE_concatI.hyps(2) wfCE_concatI.hyps(4) wfCE_concatI.prems(1) wfCE_concatI.prems(2) 
+           Wellformed.wfCE_concatI by auto (* 46 ms *)
+   qed
+next
+  case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
+   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY wf_b_subst_lemmas wfCE_b_fresh  by metis
+qed(auto simp add: wf_intros)
+
+lemma wf_b_subst2:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and s::s and b'::b and ce::ce and td::type_def
+            and cs::branch_s and css::branch_list
+  shows  "\<Theta> ; \<Phi> ;  B' ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b'    \<Longrightarrow> {|bv|} = B' \<Longrightarrow> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f  b  \<Longrightarrow> \<Theta> ; \<Phi> ;  B  ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ;  \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  e[bv::=b]\<^sub>e\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b" and
+         "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b   \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> True" and      
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True " and
+         "\<Theta> ;  B' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>   \<Longrightarrow> {|bv|} = B' \<Longrightarrow> \<Theta> ; B   \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> \<Theta> ;  B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" and      
+         "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
+         "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
+proof(nominal_induct 
+      b' and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
+      avoiding: bv b B
+rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
+  case (wfE_valI \<Theta>' \<Phi>' \<B>' \<Gamma>' \<Delta>' v' b')
+  then show ?case unfolding subst_vb.simps subst_eb.simps using wf_b_subst1(1) Wellformed.wfE_valI  by auto    
+next
+  case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case unfolding subst_eb.simps  
+      using wf_b_subst_lemmas wf_b_subst1(1)  Wellformed.wfE_plusI 
+    proof -
+      have "\<forall>b ba v g f ts. (( ts ; f ; g[bv::=ba]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=ba]\<^sub>v\<^sub>b : b[bv::=ba]\<^sub>b\<^sub>b) \<or> \<not> ts ; \<B> ; g \<turnstile>\<^sub>w\<^sub>f v : b ) \<or> \<not> ts ; f \<turnstile>\<^sub>w\<^sub>f ba"
+        using wfE_plusI.prems(1) wf_b_subst1(1) by force (* 0.0 ms *)
+      then show "\<Theta> ; \<Phi> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f [ plus v1[bv::=b]\<^sub>v\<^sub>b v2[bv::=b]\<^sub>v\<^sub>b ]\<^sup>e : B_int[bv::=b]\<^sub>b\<^sub>b"
+   
+        by (metis wfE_plusI.hyps(1) wfE_plusI.hyps(4) wfE_plusI.hyps(5) wfE_plusI.hyps(6) wfE_plusI.prems(1) wfE_plusI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_plusI wf_b_subst_lemmas(86))
+    qed
+next
+  case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+   then show ?case unfolding subst_eb.simps  
+     using wf_b_subst_lemmas wf_b_subst1  Wellformed.wfE_leqI       
+   proof -
+     have "\<And>ts f b ba g v. \<not> (ts ; f \<turnstile>\<^sub>w\<^sub>f b) \<or> \<not> (ts ; {|ba|} ; g \<turnstile>\<^sub>w\<^sub>f v : B_int) \<or> (ts ; f ; g[ba::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[ba::=b]\<^sub>v\<^sub>b : B_int)"
+       by (metis wf_b_subst1(1) wf_b_subst_lemmas(86)) (* 46 ms *)
+     then show "\<Theta> ; \<Phi> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f [ leq v1[bv::=b]\<^sub>v\<^sub>b v2[bv::=b]\<^sub>v\<^sub>b ]\<^sup>e : B_bool[bv::=b]\<^sub>b\<^sub>b"
+       by (metis (no_types) wfE_leqI.hyps(1) wfE_leqI.hyps(4) wfE_leqI.hyps(5) wfE_leqI.hyps(6) wfE_leqI.prems(1) wfE_leqI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_leqI wf_b_subst_lemmas(87)) (* 46 ms *)
+   qed   
+next
+  case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 bb v2)
+  show ?case unfolding subst_eb.simps subst_bb.simps proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfX_wfY wfE_eqI by metis
+    show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<close> using wfX_wfY wfE_eqI by metis
+    show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : bb \<close> using subst_bb.simps wfE_eqI 
+      by (metis (no_types, hide_lams) empty_iff insert_iff wf_b_subst1(1))
+    show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v2[bv::=b]\<^sub>v\<^sub>b : bb \<close> using wfX_wfY wfE_eqI       
+      by (metis insert_iff singleton_iff wf_b_subst1(1) wf_b_subst_lemmas(86) wf_b_subst_lemmas(87) wf_b_subst_lemmas(90))
+    show \<open>bb \<in> {B_bool, B_int, B_unit}\<close> using wfE_eqI by auto
+  qed     
+next
+  case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(84) wf_b_subst1(1)  Wellformed.wfE_fstI         
+    by (metis wf_b_subst_lemmas(89))
+next
+  case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
+  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_sndI 
+  by (metis wf_b_subst_lemmas(89))
+next
+  case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_concatI  
+  by (metis wf_b_subst_lemmas(91))
+next
+  case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
+  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_splitI    
+    by (metis wf_b_subst_lemmas(89) wf_b_subst_lemmas(91))
+next
+  case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
+  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_lenI  
+    by (metis wf_b_subst_lemmas(91) wf_b_subst_lemmas(89))
+next
+  case (wfE_appI \<Theta> \<Phi> \<B>' \<Gamma> \<Delta> f x b' c \<tau> s v)
+  hence bf: "atom bv \<sharp> b'" using wfPhi_f_simple_wfT wfT_supp bv_not_in_dom_g  wfPhi_f_simple_supp_b fresh_def by fast
+  hence bseq: "b'[bv::=b]\<^sub>b\<^sub>b = b'" using subst_bb.simps wf_b_subst_lemmas by metis
+  have "\<Theta> ; \<Phi>  ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f (AE_app f (v[bv::=b]\<^sub>v\<^sub>b)) : (b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b))" 
+  proof
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using wfE_appI by auto
+    show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wfE_appI by simp 
+    have "atom bv \<sharp> \<tau>" using wfPhi_f_simple_wfT[OF wfE_appI(5) wfE_appI(1),THEN wfT_supp]  bv_not_in_dom_g fresh_def by force
+    hence " \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b = \<tau>"  using forget_subst subst_b_\<tau>_def by metis
+    thus  "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b' c \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b s))) = lookup_fun \<Phi> f" using wfE_appI by simp
+    show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'" using wfE_appI bseq wf_b_subst1 by metis
+  qed
+  then show ?case using subst_eb.simps b_of_subst_bb_commute by simp
+next
+  case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv1 v1 \<tau>1 f x1 b1 c1 s1)
+  then have *: "atom bv \<sharp> b1" using wfPhi_f_supp(1)  wfE_appPI(7,11) 
+      by (metis fresh_def fresh_finsert singleton_iff subsetD fresh_def supp_at_base wfE_appPI.hyps(1))
+  have "\<Theta> ; \<Phi>  ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f AE_appP f b'[bv::=b]\<^sub>b\<^sub>b (v1[bv::=b]\<^sub>v\<^sub>b) : (b_of \<tau>1)[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b"
+  proof
+    show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
+    show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<close> using wfE_appPI by auto
+    show \<open> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfE_appPI wf_b_subst1 by auto
+    have "atom bv1 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using fresh_subst_if subst_b_\<Gamma>_def wfE_appPI by metis
+    moreover have "atom bv1 \<sharp> b'[bv::=b]\<^sub>b\<^sub>b"  using fresh_subst_if subst_b_b_def wfE_appPI by metis
+    moreover have "atom bv1 \<sharp> v1[bv::=b]\<^sub>v\<^sub>b"  using fresh_subst_if subst_b_v_def wfE_appPI by metis 
+    moreover have "atom bv1 \<sharp> \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" using fresh_subst_if subst_b_\<Delta>_def wfE_appPI by metis 
+    moreover have "atom bv1 \<sharp> (b_of \<tau>1)[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b\<^sub>b" using fresh_subst_if subst_b_b_def wfE_appPI by metis 
+    ultimately show "atom bv1 \<sharp> (\<Phi>, \<Theta>, B, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, b'[bv::=b]\<^sub>b\<^sub>b, v1[bv::=b]\<^sub>v\<^sub>b, (b_of \<tau>1)[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b)"
+      using wfE_appPI using fresh_def fresh_prodN subst_b_b_def by metis
+    show \<open>Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
+
+    have  \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : b1[bv1::=b']\<^sub>b[bv::=b]\<^sub>b\<^sub>b \<close>  
+      using wfE_appPI  subst_b_b_def * wf_b_subst1 by metis
+    thus  \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : b1[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b \<close> 
+       using  subst_bb_commute subst_b_b_def *  by auto
+  qed
+  moreover have "atom bv \<sharp> b_of \<tau>1" proof -
+    have "supp  (b_of \<tau>1) \<subseteq> { atom bv1 }" using wfPhi_f_poly_supp_b_of_t
+      using b_of.simps  wfE_appPI  wfPhi_f_supp(5) by simp
+    thus ?thesis using  wfE_appPI 
+      fresh_def fresh_finsert singleton_iff subsetD fresh_def supp_at_base wfE_appPI.hyps by metis
+  qed
+  ultimately show ?case using subst_eb.simps(3) subst_bb_commute subst_b_b_def * by simp
+next
+  case (wfE_mvarI \<Theta> \<Phi> \<B>' \<Gamma> \<Delta> u \<tau>)
+
+  have "\<Theta> ; \<Phi>  ;  B ; subst_gb  \<Gamma> bv b ; subst_db  \<Delta> bv b \<turnstile>\<^sub>w\<^sub>f (AE_mvar u)[bv::=b]\<^sub>e\<^sub>b : (b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b))" 
+  proof(subst subst_eb.simps,rule Wellformed.wfE_mvarI)
+    show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> "  using wfE_mvarI by simp
+    show "\<Theta> ;  B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b"  using wfE_mvarI by metis
+    show "(u, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) \<in> setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" 
+      using wfE_mvarI subst_db.simps set_insert subst_d_b_member by simp
+  qed
+  thus  ?case using  b_of_subst_bb_commute by auto
+
+next
+  case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
+  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
+next
+  case (wfD_emptyI \<Theta> \<B>' \<Gamma>)
+  then show ?case using subst_db.simps Wellformed.wfD_emptyI wf_b_subst1 by simp
+next
+  case (wfD_cons \<Theta> \<B>' \<Gamma>' \<Delta> \<tau> u)
+  show ?case proof(subst subst_db.simps, rule Wellformed.wfD_cons )
+    show "\<Theta> ;  B ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wfD_cons by auto
+    show "\<Theta> ;  B ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b  "  using wfD_cons wf_b_subst1 by auto
+    show "u \<notin> fst ` setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" using wfD_cons subst_b_lookup_d by metis
+  qed    
+next
+  case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
+  show ?case by auto
+qed(auto)
+
+lemmas wf_b_subst = wf_b_subst1 wf_b_subst2
+
+lemma wfT_subst_wfT:
+  fixes \<tau>::\<tau> and b'::b and bv::bv 
+  assumes "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>" and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f b'"
+  shows "\<Theta> ;  B ; (x,b[bv::=b']\<^sub>b\<^sub>b,c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma>GNil  \<turnstile>\<^sub>w\<^sub>f  (\<tau>[bv::=b']\<^sub>\<tau>\<^sub>b)"
+proof - 
+  have  "\<Theta> ;  B ; ((x,b,c) #\<^sub>\<Gamma>GNil)[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<turnstile>\<^sub>w\<^sub>f  (\<tau>[bv::=b']\<^sub>\<tau>\<^sub>b)"
+    using wf_b_subst assms by metis
+  thus ?thesis using subst_gb.simps wf_b_subst_lemmas wfCE_b_fresh  by metis
+qed
+
+lemma wf_trans:
+  fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and s::s
+          and cs::branch_s and css::branch_list and \<Theta>::\<Theta>
+  shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b'        \<Longrightarrow> \<Gamma> = (x, b, c2)  #\<^sub>\<Gamma> G  \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c2  \<Longrightarrow>  \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f v : b'" and
+          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> \<Gamma> = (x, b, c2)  #\<^sub>\<Gamma> G \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c2 \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c" and
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> True" and
+         "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
+         "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and      
+         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True " and       
+         "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b'    \<Longrightarrow> \<Gamma> = (x, b, c2)  #\<^sub>\<Gamma> G \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c2  \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f ce : b' " and
+         "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
+proof(nominal_induct
+     b' and c and \<Gamma> and \<tau> and ts and \<Theta> and  b and  b' and td 
+     avoiding: c1
+   arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 
+   rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
+  case (wfV_varI \<Theta> \<B> \<Gamma> b' c' x')
+  have wbg: "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c1)  #\<^sub>\<Gamma> G " using wfC_wf wfV_varI by simp
+  show ?case proof(cases "x=x'")
+    case True
+    have "Some (b', c1) = lookup ((x, b, c1)  #\<^sub>\<Gamma> G) x'" using lookup.simps wfV_varI  using True by auto
+    then show ?thesis using Wellformed.wfV_varI wbg by simp
+  next
+    case False
+    then have "Some (b', c') = lookup ((x, b, c1)  #\<^sub>\<Gamma> G) x'" using lookup.simps wfV_varI 
+      by simp
+    then show ?thesis using Wellformed.wfV_varI wbg by simp
+  qed 
+next
+ case (wfV_conspI s bv dclist \<Theta> dc x1 b' c \<B> b1 \<Gamma> v)
+  show ?case proof
+    show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
+    show \<open>(dc, \<lbrace> x1 : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
+    show \<open>\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfV_conspI by auto
+    show \<open>atom bv \<sharp> (\<Theta>, \<B>, (x, b, c1)  #\<^sub>\<Gamma> G, b1, v)\<close> unfolding fresh_prodN fresh_GCons using wfV_conspI  fresh_prodN fresh_GCons by simp
+    show \<open>\<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b1]\<^sub>b\<^sub>b\<close> using wfV_conspI by auto
+  qed
+qed( (auto | metis wfC_wf wf_intros) +)
+
+
+end
\ No newline at end of file
diff --git a/thys/MiniSail/document/root.bib b/thys/MiniSail/document/root.bib
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/document/root.bib
@@ -0,0 +1,29 @@
+@article{Armstrong2019,
+abstract = {Architecture specifications notionally define the fundamental interface between hardware and software: the envelope of allowed behaviour for processor implementations, and the basic assumptions for software development and verification. But in practice, they are typically prose and pseudocode documents, not rigorous or executable artifacts, leaving software and verification on shaky ground. In this paper, we present rigorous semantic models for the sequential behaviour of large parts of the mainstream ARMv8-A, RISC-V, and MIPS architectures, and the research CHERI-MIPS architecture, that are complete enough to boot operating systems, variously Linux, FreeBSD, or seL4. Our ARMv8-A models are automatically translated from authoritative ARM-internal definitions, and (in one variant) tested against the ARM Architecture Validation Suite. We do this using a custom language for ISA semantics, Sail, with a lightweight dependent type system, that supports automatic generation of emulator code in C and OCaml, and automatic generation of proof-assistant definitions for Isabelle, HOL4, and (currently only for MIPS) Coq. We use the former for validation, and to assess specification coverage. To demonstrate the usability of the latter, we prove (in Isabelle) correctness of a purely functional characterisation of ARMv8-A address translation. We moreover integrate the RISC-V model into the RMEM tool for (user-mode) relaxed-memory concurrency exploration. We prove (on paper) the soundness of the core Sail type system. We thereby take a big step towards making the architectural abstraction actually well-defined, establishing foundations for verification and reasoning.},
+author = {Armstrong, Alasdair and Pulte, Christopher and Flur, Shaked and Stark, Ian and Krishnaswami, Neel and Sewell, Peter and Bauereiss, Thomas and Campbell, Brian and Reid, Alastair and Gray, Kathryn E. and Norton, Robert M. and Mundkur, Prashanth and Wassell, Mark and French, Jon},
+doi = {10.1145/3290384},
+file = {:E$\backslash$:/Mark/PhD/ReadingMaterial/SAIL/sail-popl2019.pdf:pdf},
+issn = {2475-1421},
+journal = {Proceedings of the ACM on Programming Languages},
+number = {POPL},
+pages = {1--31},
+title = {{ISA semantics for ARMv8-A, RISC-V, and CHERI-MIPS}},
+volume = {3},
+year = {2019}
+}
+@article{Vazou2014,
+abstract = {SMT-based checking of refinement types for call-by-value languages is a well-studied subject. Unfortunately, the classical translation of refinement types to verification conditions is unsound under lazy evaluation. When checking an expression, such systems implicitly assume that all the free variables in the expression are bound to values. This property is trivially guaranteed by eager, but does not hold under lazy, evaluation. Thus, to be sound and precise, a refinement type system for Haskell and the corresponding verification conditions must take into account which subset of binders actually reduces to values. We present a stratified type system that labels binders as potentially diverging or not, and that (circularly) uses refinement types to verify the labeling. We have implemented our system in LIQUIDHASKELL and present an experimental evaluation of our approach on more than 10,000 lines of widely used Haskell libraries. We show that LIQUIDHASKELL is able to prove 96{\%} of all recursive functions terminating, while requiring a modest 1.7 lines of termination-annotations per 100 lines of code.},
+annote = {ICFP Video - https://www.youtube.com/watch?v=vqvNQixKr6w},
+archivePrefix = {arXiv},
+arxivId = {arXiv:1604.02480v1},
+author = {Vazou, Niki and Seidel, Eric L and Peyton-jones, Simon},
+doi = {10.1145/2628136.2628161},
+eprint = {arXiv:1604.02480v1},
+file = {:C$\backslash$:/Users/User/AppData/Local/Mendeley Ltd./Mendeley Desktop/Downloaded/Merz, Vanzetto - 2014 - Refinement types for Haskell.pdf:pdf},
+isbn = {9781450328739},
+issn = {15232867},
+journal = {ICFP '14 Proceedings of the 19th ACM SIGPLAN international conference on Functional programming},
+mendeley-groups = {Semantic Tools/RefinementTypes},
+title = {{Refinement Types For Haskell}},
+year = {2014}
+}
diff --git a/thys/MiniSail/document/root.tex b/thys/MiniSail/document/root.tex
new file mode 100644
--- /dev/null
+++ b/thys/MiniSail/document/root.tex
@@ -0,0 +1,71 @@
+\documentclass[11pt,a4paper]{report}
+\usepackage{graphicx,isabelle,isabellesym}
+
+\usepackage[a4paper,includeheadfoot,margin=2.54cm]{geometry}
+
+% further packages required for unusual symbols (see also
+% isabellesym.sty), use only when needed
+
+\usepackage{amssymb}
+  %for \<leadsto>, \<box>, \<diamond>, \<sqsupset>, \<mho>, \<Join>,
+  %\<lhd>, \<lesssim>, \<greatersim>, \<lessapprox>, \<greaterapprox>,
+  %\<triangleq>, \<yen>, \<lozenge>
+
+%\usepackage{eurosym}
+  %for \<euro>
+
+%\usepackage[only,bigsqcap]{stmaryrd}
+  %for \<Sqinter>
+
+%\usepackage{eufrak}
+  %for \<AA> ... \<ZZ>, \<aa> ... \<zz> (also included in amssymb)
+
+%\usepackage{textcomp}
+  %for \<onequarter>, \<onehalf>, \<threequarters>, \<degree>, \<cent>,
+  %\<currency>
+
+% this should be the last package used
+\usepackage{pdfsetup}
+
+% urls in roman style, theory text in math-similar italics
+\urlstyle{rm}
+\isabellestyle{it}
+
+% for uniform font size
+%\renewcommand{\isastyle}{\isastyleminor}
+
+\begin{document}
+
+\title{MiniSail}
+\author{Mark P. Wassell}
+\maketitle
+
+\begin{abstract}
+MiniSail is a kernel language for Sail~\cite{Armstrong2019}, 
+an instruction set architecture (ISA) specification language. 
+Sail is an imperative language with a light-weight dependent type system similar to refinement type systems such as~\cite{Vazou2014}.
+From an ISA specification, the Sail compiler can generate theorem prover code and C (or OCaml) to give an executable 
+emulator for an architecture.
+The idea behind MiniSail is to capture the key and novel features of Sail in terms of their syntax, 
+typing rules and operational semantics,
+and to confirm that they work together by proving progress and preservation lemmas. 
+We use the Nominal2 library to handle binding.
+\end{abstract}
+
+\tableofcontents
+
+% sane default for proof documents
+\parindent 0pt\parskip 0.5ex
+
+% generated text of all theories
+\input{session}
+
+\begin{center}
+  \includegraphics[width=\textwidth,height=\textheight,keepaspectratio]{session_graph}
+\end{center}
+
+\bibliographystyle{abbrv}
+\bibliography{root}
+
+\end{document}
+
diff --git a/thys/ROOTS b/thys/ROOTS
--- a/thys/ROOTS
+++ b/thys/ROOTS
@@ -1,606 +1,607 @@
 ADS_Functor
 AI_Planning_Languages_Semantics
 AODV
 AVL-Trees
 AWN
 Abortable_Linearizable_Modules
 Abs_Int_ITP2012
 Abstract-Hoare-Logics
 Abstract-Rewriting
 Abstract_Completeness
 Abstract_Soundness
 Adaptive_State_Counting
 Affine_Arithmetic
 Aggregation_Algebras
 Akra_Bazzi
 Algebraic_Numbers
 Algebraic_VCs
 Allen_Calculus
 Amicable_Numbers
 Amortized_Complexity
 AnselmGod
 Applicative_Lifting
 Approximation_Algorithms
 Architectural_Design_Patterns
 Aristotles_Assertoric_Syllogistic
 Arith_Prog_Rel_Primes
 ArrowImpossibilityGS
 Attack_Trees
 Auto2_HOL
 Auto2_Imperative_HOL
 AutoFocus-Stream
 Automated_Stateful_Protocol_Verification
 Automatic_Refinement
 AxiomaticCategoryTheory
 BDD
 BNF_CC
 BNF_Operations
 BTree
 Banach_Steinhaus
 Bell_Numbers_Spivey
 BenOr_Kozen_Reif
 Berlekamp_Zassenhaus
 Bernoulli
 Bertrands_Postulate
 Bicategory
 BinarySearchTree
 Binding_Syntax_Theory
 Binomial-Heaps
 Binomial-Queues
 BirdKMP
 Blue_Eyes
 Bondy
 Boolean_Expression_Checkers
 Bounded_Deducibility_Security
 Buchi_Complementation
 Budan_Fourier
 Buffons_Needle
 Buildings
 BytecodeLogicJmlTypes
 C2KA_DistributedSystems
 CAVA_Automata
 CAVA_LTL_Modelchecker
 CCS
 CISC-Kernel
 CRDT
 CSP_RefTK
 CYK
 CakeML
 CakeML_Codegen
 Call_Arity
 Card_Equiv_Relations
 Card_Multisets
 Card_Number_Partitions
 Card_Partitions
 Cartan_FP
 Case_Labeling
 Catalan_Numbers
 Category
 Category2
 Category3
 Cauchy
 Cayley_Hamilton
 Certification_Monads
 Chandy_Lamport
 Chord_Segments
 Circus
 Clean
 ClockSynchInst
 Closest_Pair_Points
 CofGroups
 Coinductive
 Coinductive_Languages
 Collections
 Combinatorics_Words
 Combinatorics_Words_Graph_Lemma
 Combinatorics_Words_Lyndon
 Comparison_Sort_Lower_Bound
 Compiling-Exceptions-Correctly
 Complete_Non_Orders
 Completeness
 Complex_Geometry
 Complx
 ComponentDependencies
 ConcurrentGC
 ConcurrentIMP
 Concurrent_Ref_Alg
 Concurrent_Revisions
 Consensus_Refined
 Constructive_Cryptography
 Constructive_Cryptography_CM
 Constructor_Funs
 Containers
 CoreC++
 Core_DOM
 Core_SC_DOM
 Count_Complex_Roots
 CryptHOL
 CryptoBasedCompositionalProperties
 DFS_Framework
 DOM_Components
 DPT-SAT-Solver
 DataRefinementIBP
 Datatype_Order_Generator
 Decl_Sem_Fun_PL
 Decreasing-Diagrams
 Decreasing-Diagrams-II
 Deep_Learning
 Delta_System_Lemma
 Density_Compiler
 Dependent_SIFUM_Refinement
 Dependent_SIFUM_Type_Systems
 Depth-First-Search
 Derangements
 Deriving
 Descartes_Sign_Rule
 Dict_Construction
 Differential_Dynamic_Logic
 Differential_Game_Logic
 Dijkstra_Shortest_Path
 Diophantine_Eqns_Lin_Hom
 Dirichlet_L
 Dirichlet_Series
 DiscretePricing
 Discrete_Summation
 DiskPaxos
 DynamicArchitectures
 Dynamic_Tables
 E_Transcendental
 Echelon_Form
 EdmondsKarp_Maxflow
 Efficient-Mergesort
 Elliptic_Curves_Group_Law
 Encodability_Process_Calculi
 Epistemic_Logic
 Ergodic_Theory
 Error_Function
 Euler_MacLaurin
 Euler_Partition
 Example-Submission
 Extended_Finite_State_Machine_Inference
 Extended_Finite_State_Machines
 FFT
 FLP
 FOL-Fitting
 FOL_Harrison
 FOL_Seq_Calc1
 Factored_Transition_System_Bounding
 Falling_Factorial_Sum
 Farkas
 FeatherweightJava
 Featherweight_OCL
 Fermat3_4
 FileRefinement
 FinFun
 Finger-Trees
 Finite-Map-Extras
 Finite_Automata_HF
 First_Order_Terms
 First_Welfare_Theorem
 Fishburn_Impossibility
 Fisher_Yates
 Flow_Networks
 Floyd_Warshall
 Flyspeck-Tame
 FocusStreamsCaseStudies
 Forcing
 Formal_Puiseux_Series
 Formal_SSA
 Formula_Derivatives
 Fourier
 Free-Boolean-Algebra
 Free-Groups
 FunWithFunctions
 FunWithTilings
 Functional-Automata
 Functional_Ordered_Resolution_Prover
 Furstenberg_Topology
 GPU_Kernel_PL
 Gabow_SCC
 GaleStewart_Games
 Game_Based_Crypto
 Gauss-Jordan-Elim-Fun
 Gauss_Jordan
 Gauss_Sums
 Gaussian_Integers
 GenClock
 General-Triangle
 Generalized_Counting_Sort
 Generic_Deriving
 Generic_Join
 GewirthPGCProof
 Girth_Chromatic
 GoedelGod
 Goedel_HFSet_Semantic
 Goedel_HFSet_Semanticless
 Goedel_Incompleteness
 Goodstein_Lambda
 GraphMarkingIBP
 Graph_Saturation
 Graph_Theory
 Green
 Groebner_Bases
 Groebner_Macaulay
 Gromov_Hyperbolicity
 Grothendieck_Schemes
 Group-Ring-Module
 HOL-CSP
 HOLCF-Prelude
 HRB-Slicing
 Heard_Of
 Hello_World
 HereditarilyFinite
 Hermite
 Hermite_Lindemann
 Hidden_Markov_Models
 Higher_Order_Terms
 Hoare_Time
 Hood_Melville_Queue
 HotelKeyCards
 Huffman
 Hybrid_Logic
 Hybrid_Multi_Lane_Spatial_Logic
 Hybrid_Systems_VCs
 HyperCTL
 IEEE_Floating_Point
 IFC_Tracking
 IMAP-CRDT
 IMO2019
 IMP2
 IMP2_Binary_Heap
 IMP_Compiler
 IP_Addresses
 Imperative_Insertion_Sort
 Impossible_Geometry
 Incompleteness
 Incredible_Proof_Machine
 Inductive_Confidentiality
 Inductive_Inference
 InfPathElimination
 InformationFlowSlicing
 InformationFlowSlicing_Inter
 Integration
 Interpreter_Optimizations
 Interval_Arithmetic_Word32
 Iptables_Semantics
 Irrational_Series_Erdos_Straus
 Irrationality_J_Hancl
 IsaGeoCoq
 Isabelle_C
 Isabelle_Marries_Dirac
 Isabelle_Meta_Model
 Jacobson_Basic_Algebra
 Jinja
 JinjaDCI
 JinjaThreads
 JiveDataStoreModel
 Jordan_Hoelder
 Jordan_Normal_Form
 KAD
 KAT_and_DRA
 KBPs
 KD_Tree
 Key_Agreement_Strong_Adversaries
 Kleene_Algebra
 Knot_Theory
 Knuth_Bendix_Order
 Knuth_Morris_Pratt
 Koenigsberg_Friendship
 Kruskal
 Kuratowski_Closure_Complement
 LLL_Basis_Reduction
 LLL_Factorization
 LOFT
 LTL
 LTL_Master_Theorem
 LTL_Normal_Form
 LTL_to_DRA
 LTL_to_GBA
 Lam-ml-Normalization
 LambdaAuth
 LambdaMu
 Lambda_Free_EPO
 Lambda_Free_KBOs
 Lambda_Free_RPOs
 Lambert_W
 Landau_Symbols
 Laplace_Transform
 Latin_Square
 LatticeProperties
 Launchbury
 Laws_of_Large_Numbers
 Lazy-Lists-II
 Lazy_Case
 Lehmer
 Lifting_Definition_Option
 Lifting_the_Exponent
 LightweightJava
 LinearQuantifierElim
 Linear_Inequalities
 Linear_Programming
 Linear_Recurrences
 Liouville_Numbers
 List-Index
 List-Infinite
 List_Interleaving
 List_Inversions
 List_Update
 LocalLexing
 Localization_Ring
 Locally-Nameless-Sigma
 Lowe_Ontological_Argument
 Lower_Semicontinuous
 Lp
 Lucas_Theorem
 MFMC_Countable
 MFODL_Monitor_Optimized
 MFOTL_Monitor
 MSO_Regex_Equivalence
 Markov_Models
 Marriage
 Mason_Stothers
 Matrices_for_ODEs
 Matrix
 Matrix_Tensor
 Matroids
 Max-Card-Matching
 Median_Of_Medians_Selection
 Menger
 Mereology
 Mersenne_Primes
 Metalogic_ProofChecker
 MiniML
+MiniSail
 Minimal_SSA
 Minkowskis_Theorem
 Minsky_Machines
 Modal_Logics_for_NTS
 Modular_Assembly_Kit_Security
 Modular_arithmetic_LLL_and_HNF_algorithms
 Monad_Memo_DP
 Monad_Normalisation
 MonoBoolTranAlgebra
 MonoidalCategory
 Monomorphic_Monad
 MuchAdoAboutTwo
 Multi_Party_Computation
 Multirelations
 Myhill-Nerode
 Name_Carrying_Type_Inference
 Nash_Williams
 Nat-Interval-Logic
 Native_Word
 Nested_Multisets_Ordinals
 Network_Security_Policy_Verification
 Neumann_Morgenstern_Utility
 No_FTL_observers
 Nominal2
 Noninterference_CSP
 Noninterference_Concurrent_Composition
 Noninterference_Generic_Unwinding
 Noninterference_Inductive_Unwinding
 Noninterference_Ipurge_Unwinding
 Noninterference_Sequential_Composition
 NormByEval
 Nullstellensatz
 Octonions
 OpSets
 Open_Induction
 Optics
 Optimal_BST
 Orbit_Stabiliser
 Order_Lattice_Props
 Ordered_Resolution_Prover
 Ordinal
 Ordinal_Partitions
 Ordinals_and_Cardinals
 Ordinary_Differential_Equations
 PAC_Checker
 PCF
 PLM
 POPLmark-deBruijn
 PSemigroupsConvolution
 Padic_Ints
 Pairing_Heap
 Paraconsistency
 Parity_Game
 Partial_Function_MR
 Partial_Order_Reduction
 Password_Authentication_Protocol
 Pell
 Perfect-Number-Thm
 Perron_Frobenius
 Physical_Quantities
 Pi_Calculus
 Pi_Transcendental
 Planarity_Certificates
 Poincare_Bendixson
 Poincare_Disc
 Polynomial_Factorization
 Polynomial_Interpolation
 Polynomials
 Pop_Refinement
 Posix-Lexing
 Possibilistic_Noninterference
 Power_Sum_Polynomials
 Pratt_Certificate
 Presburger-Automata
 Prim_Dijkstra_Simple
 Prime_Distribution_Elementary
 Prime_Harmonic_Series
 Prime_Number_Theorem
 Priority_Queue_Braun
 Priority_Search_Trees
 Probabilistic_Noninterference
 Probabilistic_Prime_Tests
 Probabilistic_System_Zoo
 Probabilistic_Timed_Automata
 Probabilistic_While
 Program-Conflict-Analysis
 Progress_Tracking
 Projective_Geometry
 Projective_Measurements
 Promela
 Proof_Strategy_Language
 PropResPI
 Propositional_Proof_Systems
 Prpu_Maxflow
 PseudoHoops
 Psi_Calculi
 Ptolemys_Theorem
 Public_Announcement_Logic
 QHLProver
 QR_Decomposition
 Quantales
 Quaternions
 Quick_Sort_Cost
 RIPEMD-160-SPARK
 ROBDD
 RSAPSS
 Ramsey-Infinite
 Random_BSTs
 Random_Graph_Subgraph_Threshold
 Randomised_BSTs
 Randomised_Social_Choice
 Rank_Nullity_Theorem
 Real_Impl
 Recursion-Addition
 Recursion-Theory-I
 Refine_Imperative_HOL
 Refine_Monadic
 RefinementReactive
 Regex_Equivalence
 Regression_Test_Selection
 Regular-Sets
 Regular_Algebras
 Relation_Algebra
 Relational-Incorrectness-Logic
 Relational_Disjoint_Set_Forests
 Relational_Method
 Relational_Minimum_Spanning_Trees
 Relational_Paths
 Rep_Fin_Groups
 Residuated_Lattices
 Resolution_FOL
 Rewriting_Z
 Ribbon_Proofs
 Robbins-Conjecture
 Robinson_Arithmetic
 Root_Balanced_Tree
 Routing
 Roy_Floyd_Warshall
 SATSolverVerification
 SC_DOM_Components
 SDS_Impossibility
 SIFPL
 SIFUM_Type_Systems
 SPARCv8
 Safe_Distance
 Safe_OCL
 Saturation_Framework
 Saturation_Framework_Extensions
 Secondary_Sylow
 Security_Protocol_Refinement
 Selection_Heap_Sort
 SenSocialChoice
 Separata
 Separation_Algebra
 Separation_Logic_Imperative_HOL
 SequentInvertibility
 Shadow_DOM
 Shadow_SC_DOM
 Shivers-CFA
 ShortestPath
 Show
 Sigma_Commit_Crypto
 Signature_Groebner
 Simpl
 Simple_Firewall
 Simplex
 Skew_Heap
 Skip_Lists
 Slicing
 Sliding_Window_Algorithm
 Smith_Normal_Form
 Smooth_Manifolds
 Sort_Encodings
 Source_Coding_Theorem
 Special_Function_Bounds
 Splay_Tree
 Sqrt_Babylonian
 Stable_Matching
 Statecharts
 Stateful_Protocol_Composition_and_Typing
 Stellar_Quorums
 Stern_Brocot
 Stewart_Apollonius
 Stirling_Formula
 Stochastic_Matrices
 Stone_Algebras
 Stone_Kleene_Relation_Algebras
 Stone_Relation_Algebras
 Store_Buffer_Reduction
 Stream-Fusion
 Stream_Fusion_Code
 Strong_Security
 Sturm_Sequences
 Sturm_Tarski
 Stuttering_Equivalence
 Subresultants
 Subset_Boolean_Algebras
 SumSquares
 Sunflowers
 SuperCalc
 Surprise_Paradox
 Symmetric_Polynomials
 Syntax_Independent_Logic
 Szpilrajn
 TESL_Language
 TLA
 Tail_Recursive_Functions
 Tarskis_Geometry
 Taylor_Models
 Timed_Automata
 Topological_Semantics
 Topology
 TortoiseHare
 Transcendence_Series_Hancl_Rucki
 Transformer_Semantics
 Transition_Systems_and_Automata
 Transitive-Closure
 Transitive-Closure-II
 Treaps
 Tree-Automata
 Tree_Decomposition
 Triangle
 Trie
 Twelvefold_Way
 Tycon
 Types_Tableaus_and_Goedels_God
 UPF
 UPF_Firewall
 UTP
 Universal_Turing_Machine
 UpDown_Scheme
 Valuation
 Van_der_Waerden
 VectorSpace
 VeriComp
 Verified-Prover
 Verified_SAT_Based_AI_Planning
 VerifyThis2018
 VerifyThis2019
 Vickrey_Clarke_Groves
 VolpanoSmith
 WHATandWHERE_Security
 WOOT_Strong_Eventual_Consistency
 WebAssembly
 Weight_Balanced_Trees
 Well_Quasi_Orders
 Winding_Number_Eval
 Word_Lib
 WorkerWrapper
 XML
 ZFC_in_HOL
 Zeta_3_Irrational
 Zeta_Function
 pGCL