diff --git a/thys/MFODL_Monitor_Optimized/Abstract_Monitor.thy b/thys/MFODL_Monitor_Optimized/Abstract_Monitor.thy
deleted file mode 100644
--- a/thys/MFODL_Monitor_Optimized/Abstract_Monitor.thy
+++ /dev/null
@@ -1,224 +0,0 @@
-(*<*)
-theory Abstract_Monitor
-  imports Formula
-begin
-(*>*)
-
-section \<open>Abstract monitor specification\<close>
-
-locale monitorable =
-  fixes monitorable :: "Formula.formula \<Rightarrow> bool"
-
-text \<open>The following locale specifies the desired behavior ouf a monitor abstractly.\<close>
-
-locale monitor = monitorable +
-  fixes
-    M :: "Formula.formula \<Rightarrow> Formula.prefix \<Rightarrow> (nat \<times> event_data tuple) set"
-  assumes
-    mono_monitor: "monitorable \<phi> \<Longrightarrow> \<pi> \<le> \<pi>' \<Longrightarrow> M \<phi> \<pi> \<subseteq> M \<phi> \<pi>'"
-    and sound_monitor: "monitorable \<phi> \<Longrightarrow> (i, v) \<in> M \<phi> \<pi> \<Longrightarrow>
-      i < plen \<pi> \<and> wf_tuple (Formula.nfv \<phi>) (Formula.fv \<phi>) v \<and> (\<forall>\<sigma>. prefix_of \<pi> \<sigma> \<longrightarrow> Formula.sat \<sigma> Map.empty (map the v) i \<phi>)"
-    and complete_monitor: "monitorable \<phi> \<Longrightarrow> prefix_of \<pi> \<sigma> \<Longrightarrow>
-      i < plen \<pi> \<Longrightarrow> wf_tuple (Formula.nfv \<phi>) (Formula.fv \<phi>) v \<Longrightarrow>
-      (\<forall>\<sigma>. prefix_of \<pi> \<sigma> \<longrightarrow> Formula.sat \<sigma> Map.empty (map the v) i \<phi>) \<Longrightarrow> \<exists>\<pi>'. prefix_of \<pi>' \<sigma> \<and> (i, v) \<in> M \<phi> \<pi>'"
-
-locale slicable_monitor = monitor +
-  assumes monitor_slice: "mem_restr S v \<Longrightarrow> (i, v) \<in> M \<phi> (Formula.pslice \<phi> S \<pi>) \<longleftrightarrow> (i, v) \<in> M \<phi> \<pi>"
-
-locale monitor_pre_progress = monitorable +
-  fixes progress :: "Formula.trace \<Rightarrow> Formula.formula \<Rightarrow> nat \<Rightarrow> nat"
-  assumes
-    progress_mono: "j \<le> j' \<Longrightarrow> progress \<sigma> \<phi> j \<le> progress \<sigma> \<phi> j'"
-    and progress_le: "progress \<sigma> \<phi> j \<le> j"
-    and progress_ge: "monitorable \<phi> \<Longrightarrow> \<exists>j. i \<le> progress \<sigma> \<phi> j"
-
-locale monitor_progress = monitor_pre_progress +
-  assumes progress_prefix_conv: "prefix_of \<pi> \<sigma> \<Longrightarrow> prefix_of \<pi> \<sigma>' \<Longrightarrow>
-    progress \<sigma> \<phi> (plen \<pi>) = progress \<sigma>' \<phi> (plen \<pi>)"
-begin
-
-definition verdicts :: "Formula.formula \<Rightarrow> Formula.prefix \<Rightarrow> (nat \<times> event_data tuple) set" where
-  "verdicts \<phi> \<pi> = {(i, v). wf_tuple (Formula.nfv \<phi>) (Formula.fv \<phi>) v \<and>
-    (\<forall>\<sigma>. prefix_of \<pi> \<sigma> \<longrightarrow> i < progress \<sigma> \<phi> (plen \<pi>) \<and> Formula.sat \<sigma>  Map.empty (map the v) i \<phi>)}"
-
-lemma verdicts_mono: "\<pi> \<le> \<pi>' \<Longrightarrow> verdicts \<phi> \<pi> \<subseteq> verdicts \<phi> \<pi>'"
-  unfolding verdicts_def
-  by (auto dest: prefix_of_antimono elim!: order.strict_trans2 intro!: progress_mono plen_mono)
-
-end
-
-lemma stake_eq_mono: "stake b x = stake b y \<Longrightarrow> a \<le> b \<Longrightarrow> stake a x = stake a y"
-proof (induction a arbitrary: b x y)
-  case 0
-  then show ?case by simp
-next
-  case Suca: (Suc a)
-  show ?case proof (cases b)
-    case 0
-    with Suca show ?thesis by (simp del: stake.simps)
-  next
-    case (Suc b')
-    with Suca show ?thesis by (auto simp only: stake.simps list.inject)
-  qed
-qed
-
-sublocale monitor_progress \<subseteq> monitor monitorable verdicts
-proof (standard, goal_cases)
-  case (1 \<phi> \<pi> \<pi>')
-  from 1(2) show ?case by (rule verdicts_mono)
-next
-  case (2 \<phi> i v \<pi>)
-  from \<open>(i, v) \<in> verdicts \<phi> \<pi>\<close> show ?case
-    unfolding verdicts_def
-    using ex_prefix_of[of \<pi>]
-    by (auto elim!: order.strict_trans2 intro!: progress_le)
-next
-  case complete: (3 \<phi> \<pi> \<sigma> i v)
-  from \<open>monitorable \<phi>\<close> obtain j where eval: "i < progress \<sigma> \<phi> j"
-    unfolding less_eq_Suc_le
-    using progress_ge by blast
-  define j' where "j' = max (plen \<pi>) j"
-  then have "plen \<pi> \<le> j'" by simp
-  from eval have eval': "i < progress \<sigma> \<phi> j'"
-    unfolding j'_def
-    by (auto elim: order.strict_trans2 intro!: progress_mono)
-  from complete(2) \<open>plen \<pi> \<le> j'\<close> have "\<pi> \<le> take_prefix j' \<sigma>"
-  proof (transfer fixing: j', goal_cases prefix)
-    case (prefix \<pi> \<sigma>)
-    then have "stake j' \<sigma> = stake (length \<pi>) \<sigma> @ stake (j' - length \<pi>) (sdrop (length \<pi>) \<sigma>)"
-      by (unfold stake_add) auto
-    with \<open>stake (length \<pi>) \<sigma> = \<pi>\<close> show ?case 
-      by auto
-  qed
-  with complete(4) eval' show ?case using progress_prefix_conv[of "take_prefix j' \<sigma>" \<sigma> \<sigma>' \<phi> for \<sigma>']
-    unfolding verdicts_def
-    by (auto intro!: exI[where x="take_prefix j' \<sigma>"] complete(5)[rule_format] elim: prefix_of_antimono)
-qed
-
-locale monitor_timed_progress = monitor_pre_progress +
-  assumes progress_time_conv: "\<forall>i<j. \<tau> \<sigma> i = \<tau> \<sigma>' i \<Longrightarrow> progress \<sigma> \<phi> j = progress \<sigma>' \<phi> j"
-    and progress_sat_cong: "prefix_of \<pi> \<sigma> \<Longrightarrow> prefix_of \<pi> \<sigma>' \<Longrightarrow> i < progress \<sigma> \<phi> (plen \<pi>) \<Longrightarrow>
-      Formula.sat \<sigma>  Map.empty v i \<phi> \<longleftrightarrow> Formula.sat \<sigma>' Map.empty v i \<phi>"
-begin
-
-lemma progress_map_conv: "progress (map_\<Gamma> f \<sigma>) \<phi> j = progress (map_\<Gamma> g \<sigma>) \<phi> j"
-  by (auto intro: progress_time_conv)
-
-lemma progress_slice_conv: "progress (Formula.slice \<phi>' R \<sigma>) \<phi> j = progress (Formula.slice \<phi>' R' \<sigma>) \<phi> j"
-  unfolding Formula.slice_def using progress_map_conv .
-
-lemma progress_slice: "progress (Formula.slice \<phi> R \<sigma>) \<phi> j = progress \<sigma> \<phi> j"
-  using progress_map_conv[where g=id] by (simp add: Formula.slice_def)
-
-end
-
-sublocale monitor_timed_progress \<subseteq> monitor_progress
-  by (unfold_locales, auto intro: progress_time_conv \<tau>_prefix_conv)
-
-lemma (in monitor_timed_progress) verdicts_alt:
-  "verdicts \<phi> \<pi> = {(i, v). wf_tuple (Formula.nfv \<phi>) (Formula.fv \<phi>) v \<and>
-    (\<exists>\<sigma>. prefix_of \<pi> \<sigma> \<and> i < progress \<sigma> \<phi> (plen \<pi>) \<and> Formula.sat \<sigma> Map.empty (map the v) i \<phi>)}"
-  unfolding verdicts_def
-  using ex_prefix_of[of \<pi>]
-  by (auto dest: progress_prefix_conv[of \<pi> _ _ \<phi>] elim!: progress_sat_cong[THEN iffD1, rotated -1])
-
-sublocale monitor_timed_progress \<subseteq> slicable_monitor monitorable verdicts
-proof
-  fix S :: "event_data list set" and v i \<phi> \<pi>
-  assume *: "mem_restr S v"
-  show "((i, v) \<in> verdicts \<phi> (Formula.pslice \<phi> S \<pi>)) = ((i, v) \<in> verdicts \<phi> \<pi>)" (is "?L = ?R")
-  proof
-    assume ?L
-    with * show ?R unfolding verdicts_def
-      by (auto simp: progress_slice fvi_less_nfv wf_tuple_def elim!: mem_restrE
-        box_equals[OF sat_slice_iff sat_fv_cong sat_fv_cong, symmetric, THEN iffD1, rotated -1]
-        dest: spec[of _ "Formula.slice \<phi> S _"] prefix_of_pslice_slice)
-  next
-    assume ?R
-    with * show ?L unfolding verdicts_alt
-      by (auto simp: progress_slice fvi_less_nfv wf_tuple_def elim!: mem_restrE
-        box_equals[OF sat_slice_iff sat_fv_cong sat_fv_cong, symmetric, THEN iffD2, rotated -1]
-        intro: exI[of _ "Formula.slice \<phi> S _"] prefix_of_pslice_slice)
-  qed
-qed
-
-text \<open>Past-only Formulas.\<close>
-
-fun past_only :: "Formula.formula \<Rightarrow> bool" where
-  "past_only (Formula.Pred _ _) = True"
-| "past_only (Formula.Eq _ _) = True"
-| "past_only (Formula.Less _ _) = True"
-| "past_only (Formula.LessEq _ _) = True"
-| "past_only (Formula.Let _ \<alpha> \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
-| "past_only (Formula.Neg \<psi>) = past_only \<psi>"
-| "past_only (Formula.Or \<alpha> \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
-| "past_only (Formula.And \<alpha> \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
-| "past_only (Formula.Ands l) = (\<forall>\<alpha>\<in>set l. past_only \<alpha>)"
-| "past_only (Formula.Exists \<psi>) = past_only \<psi>"
-| "past_only (Formula.Agg _ _ _ _ \<psi>) = past_only \<psi>"
-| "past_only (Formula.Prev _ \<psi>) = past_only \<psi>"
-| "past_only (Formula.Next _ _) = False"
-| "past_only (Formula.Since \<alpha> _ \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
-| "past_only (Formula.Until \<alpha> _ \<beta>) = False"
-| "past_only (Formula.MatchP _ r) = Regex.pred_regex past_only r"
-| "past_only (Formula.MatchF _ _) = False"
-
-lemma past_only_sat:
-  assumes "prefix_of \<pi> \<sigma>" "prefix_of \<pi> \<sigma>'"
-  shows "i < plen \<pi> \<Longrightarrow> dom V = dom V' \<Longrightarrow>
-     (\<And>p i. p \<in> dom V \<Longrightarrow> i < plen \<pi> \<Longrightarrow> the (V p) i = the (V' p) i) \<Longrightarrow>
-     past_only \<phi> \<Longrightarrow> Formula.sat \<sigma> V v i \<phi> = Formula.sat \<sigma>' V' v i \<phi>"
-proof (induction \<phi> arbitrary: V V' v i)
-  case (Pred e ts)
-  show ?case proof (cases "V e")
-    case None
-    then have "V' e = None" using \<open>dom V = dom V'\<close> by auto
-    with None \<Gamma>_prefix_conv[OF assms(1,2) Pred(1)] show ?thesis by simp
-  next
-    case (Some a)
-    moreover obtain a' where "V' e = Some a'" using Some \<open>dom V = dom V'\<close> by auto
-    moreover have "the (V e) i = the (V' e) i"
-      using Some Pred(1,3) by (fastforce intro: domI)
-    ultimately show ?thesis by simp
-  qed
-next
-  case (Let p \<phi> \<psi>)
-  let ?V = "\<lambda>V \<sigma>. (V(p \<mapsto> \<lambda>i. {v. length v = Formula.nfv \<phi> \<and> Formula.sat \<sigma> V v i \<phi>}))"
-  show ?case unfolding sat.simps proof (rule Let.IH(2))
-    show "i < plen \<pi>" by fact
-    from Let.prems show "past_only \<psi>" by simp
-    from Let.prems show "dom (?V V \<sigma>) = dom (?V V' \<sigma>')"
-      by (simp del: fun_upd_apply)
-  next
-    fix p' i
-    assume *: "p' \<in> dom (?V V \<sigma>)" "i < plen \<pi>"
-    show "the (?V V \<sigma> p') i = the (?V V' \<sigma>' p') i" proof (cases "p' = p")
-      case True
-      with Let \<open>i < plen \<pi>\<close> show ?thesis by auto
-    next
-      case False
-      with * show ?thesis by (auto intro!: Let.prems(3))
-    qed
-  qed
-next
-  case (Ands l)
-  with \<Gamma>_prefix_conv[OF assms] show ?case by simp
-next
-  case (Prev I \<phi>)
-  with \<tau>_prefix_conv[OF assms] show ?case by (simp split: nat.split)
-next
-  case (Since \<phi>1 I \<phi>2)
-  with \<tau>_prefix_conv[OF assms] show ?case by auto
-next
-  case (MatchP I r)
-  then have "Regex.match (Formula.sat \<sigma> V v) r a b = Regex.match (Formula.sat \<sigma>' V' v) r a b" if "b < plen \<pi>" for a b
-    using that by (intro Regex.match_cong_strong) (auto simp: regex.pred_set)
-  with \<tau>_prefix_conv[OF assms] MatchP(2) show ?case by auto
-qed auto
-
-interpretation past_only_monitor: monitor_timed_progress past_only "\<lambda>\<sigma> \<phi> j. if past_only \<phi> then j else 0"
-  by unfold_locales (auto dest: past_only_sat(1) split: if_splits)
-
-(*<*)
-end
-(*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Event_Data.thy b/thys/MFODL_Monitor_Optimized/Event_Data.thy
--- a/thys/MFODL_Monitor_Optimized/Event_Data.thy
+++ b/thys/MFODL_Monitor_Optimized/Event_Data.thy
@@ -1,99 +1,99 @@
 (*<*)
 theory Event_Data
   imports
     "HOL-Library.Char_ord"
     Code_Double
     Deriving.Derive
 begin
 (*>*)
 
 section \<open>Event parameters\<close>
 
 definition div_to_zero :: "integer \<Rightarrow> integer \<Rightarrow> integer" where
   "div_to_zero x y = (let z = fst (Code_Numeral.divmod_abs x y) in
     if (x < 0) \<noteq> (y < 0) then - z else z)"
 
 definition mod_to_zero :: "integer \<Rightarrow> integer \<Rightarrow> integer" where
   "mod_to_zero x y = (let z = snd (Code_Numeral.divmod_abs x y) in
     if x < 0 then - z else z)"
 
 lemma "b \<noteq> 0 \<Longrightarrow> div_to_zero a b * b + mod_to_zero a b = a"
   unfolding div_to_zero_def mod_to_zero_def Let_def
   by (auto simp: minus_mod_eq_mult_div[symmetric] div_minus_right mod_minus_right ac_simps)
 
 
-datatype event_data = EInt integer | EFloat double | EString string
+datatype event_data = EInt integer | EFloat double | EString String.literal
 
 derive (eq) ceq event_data
 derive ccompare event_data
 
 instantiation event_data :: "{ord, plus, minus, uminus, times, divide, modulo}"
 begin
 
 fun less_eq_event_data where
   "EInt x \<le> EInt y \<longleftrightarrow> x \<le> y"
 | "EInt x \<le> EFloat y \<longleftrightarrow> double_of_integer x \<le> y"
 | "EInt _ \<le> EString _ \<longleftrightarrow> False"
 | "EFloat x \<le> EInt y \<longleftrightarrow> x \<le> double_of_integer y"
 | "EFloat x \<le> EFloat y \<longleftrightarrow> x \<le> y"
 | "EFloat _ \<le> EString _ \<longleftrightarrow> False"
-| "EString x \<le> EString y \<longleftrightarrow> lexordp_eq x y"
+| "EString x \<le> EString y \<longleftrightarrow> lexordp_eq (String.explode x) (String.explode y)"
 | "EString _ \<le> _ \<longleftrightarrow> False"
 
 definition less_event_data :: "event_data \<Rightarrow> event_data \<Rightarrow> bool"  where
   "less_event_data x y \<longleftrightarrow> x \<le> y \<and> \<not> y \<le> x"
 
 fun plus_event_data where
   "EInt x + EInt y = EInt (x + y)"
 | "EInt x + EFloat y = EFloat (double_of_integer x + y)"
 | "EFloat x + EInt y = EFloat (x + double_of_integer y)"
 | "EFloat x + EFloat y = EFloat (x + y)"
 | "(_::event_data) + _ = EFloat nan"
 
 fun minus_event_data where
   "EInt x - EInt y = EInt (x - y)"
 | "EInt x - EFloat y = EFloat (double_of_integer x - y)"
 | "EFloat x - EInt y = EFloat (x - double_of_integer y)"
 | "EFloat x - EFloat y = EFloat (x - y)"
 | "(_::event_data) - _ = EFloat nan"
 
 fun uminus_event_data where
   "- EInt x = EInt (- x)"
 | "- EFloat x = EFloat (- x)"
 | "- (_::event_data) = EFloat nan"
 
 fun times_event_data where
   "EInt x * EInt y = EInt (x * y)"
 | "EInt x * EFloat y = EFloat (double_of_integer x * y)"
 | "EFloat x * EInt y = EFloat (x * double_of_integer y)"
 | "EFloat x * EFloat y = EFloat (x * y)"
 | "(_::event_data) * _ = EFloat nan"
 
 fun divide_event_data where
   "EInt x div EInt y = EInt (div_to_zero x y)"
 | "EInt x div EFloat y = EFloat (double_of_integer x div y)"
 | "EFloat x div EInt y = EFloat (x div double_of_integer y)"
 | "EFloat x div EFloat y = EFloat (x div y)"
 | "(_::event_data) div _ = EFloat nan"
 
 fun modulo_event_data where
   "EInt x mod EInt y = EInt (mod_to_zero x y)"
 | "(_::event_data) mod _ = EFloat nan"
 
 instance ..
 
 end
 
 primrec integer_of_event_data :: "event_data \<Rightarrow> integer" where
   "integer_of_event_data (EInt x) = x"
 | "integer_of_event_data (EFloat x) = integer_of_double x"
 | "integer_of_event_data (EString _) = 0"
 
 primrec double_of_event_data :: "event_data \<Rightarrow> double" where
   "double_of_event_data (EInt x) = double_of_integer x"
 | "double_of_event_data (EFloat x) = x"
 | "double_of_event_data (EString _) = nan"
 
 (*<*)
 end
 (*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Formula.thy b/thys/MFODL_Monitor_Optimized/Formula.thy
--- a/thys/MFODL_Monitor_Optimized/Formula.thy
+++ b/thys/MFODL_Monitor_Optimized/Formula.thy
@@ -1,1291 +1,1308 @@
 (*<*)
 theory Formula
-  imports Interval Trace Regex Event_Data
-    "MFOTL_Monitor.Table"
+  imports
+    Event_Data
+    Regex
+    "MFOTL_Monitor.Interval"
+    "MFOTL_Monitor.Trace"
+    "MFOTL_Monitor.Abstract_Monitor"
     "HOL-Library.Mapping"
     Containers.Set_Impl
 begin
 (*>*)
 
-section \<open>Metric first-order temporal logic\<close>
+section \<open>Metric first-order dynamic logic\<close>
 
 derive (eq) ceq enat
 
 instantiation enat :: ccompare begin
 definition ccompare_enat :: "enat comparator option" where
   "ccompare_enat = Some (\<lambda>x y. if x = y then order.Eq else if x < y then order.Lt else order.Gt)"
 
 instance by intro_classes
     (auto simp: ccompare_enat_def split: if_splits intro!: comparator.intro)
 end
 
 context begin
 
 subsection \<open>Formulas and satisfiability\<close>
 
-qualified type_synonym name = string
+qualified type_synonym name = String.literal
 qualified type_synonym event = "(name \<times> event_data list)"
 qualified type_synonym database = "(name, event_data list set list) mapping"
 qualified type_synonym prefix = "(name \<times> event_data list) prefix"
 qualified type_synonym trace = "(name \<times> event_data list) trace"
 
 qualified type_synonym env = "event_data list"
 
 subsubsection \<open>Syntax\<close>
 
 qualified datatype trm = is_Var: Var nat | is_Const: Const event_data
   | Plus trm trm | Minus trm trm | UMinus trm | Mult trm trm | Div trm trm | Mod trm trm
   | F2i trm | I2f trm
 
 qualified primrec fvi_trm :: "nat \<Rightarrow> trm \<Rightarrow> nat set" where
   "fvi_trm b (Var x) = (if b \<le> x then {x - b} else {})"
 | "fvi_trm b (Const _) = {}"
 | "fvi_trm b (Plus x y) = fvi_trm b x \<union> fvi_trm b y"
 | "fvi_trm b (Minus x y) = fvi_trm b x \<union> fvi_trm b y"
 | "fvi_trm b (UMinus x) = fvi_trm b x"
 | "fvi_trm b (Mult x y) = fvi_trm b x \<union> fvi_trm b y"
 | "fvi_trm b (Div x y) = fvi_trm b x \<union> fvi_trm b y"
 | "fvi_trm b (Mod x y) = fvi_trm b x \<union> fvi_trm b y"
 | "fvi_trm b (F2i x) = fvi_trm b x"
 | "fvi_trm b (I2f x) = fvi_trm b x"
 
 abbreviation "fv_trm \<equiv> fvi_trm 0"
 
 qualified primrec eval_trm :: "env \<Rightarrow> trm \<Rightarrow> event_data" where
   "eval_trm v (Var x) = v ! x"
 | "eval_trm v (Const x) = x"
 | "eval_trm v (Plus x y) = eval_trm v x + eval_trm v y"
 | "eval_trm v (Minus x y) = eval_trm v x - eval_trm v y"
 | "eval_trm v (UMinus x) = - eval_trm v x"
 | "eval_trm v (Mult x y) = eval_trm v x * eval_trm v y"
 | "eval_trm v (Div x y) = eval_trm v x div eval_trm v y"
 | "eval_trm v (Mod x y) = eval_trm v x mod eval_trm v y"
 | "eval_trm v (F2i x) = EInt (integer_of_event_data (eval_trm v x))"
 | "eval_trm v (I2f x) = EFloat (double_of_event_data (eval_trm v x))"
 
 lemma eval_trm_fv_cong: "\<forall>x\<in>fv_trm t. v ! x = v' ! x \<Longrightarrow> eval_trm v t = eval_trm v' t"
   by (induction t) simp_all
 
 
 qualified datatype agg_type = Agg_Cnt | Agg_Min | Agg_Max | Agg_Sum | Agg_Avg | Agg_Med
 qualified type_synonym agg_op = "agg_type \<times> event_data"
 
 definition flatten_multiset :: "(event_data \<times> enat) set \<Rightarrow> event_data list" where
   "flatten_multiset M = concat (map (\<lambda>(x, c). replicate (the_enat c) x) (csorted_list_of_set M))"
 
 fun eval_agg_op :: "agg_op \<Rightarrow> (event_data \<times> enat) set \<Rightarrow> event_data" where
   "eval_agg_op (Agg_Cnt, y0) M = EInt (integer_of_int (length (flatten_multiset M)))"
 | "eval_agg_op (Agg_Min, y0) M = (case flatten_multiset M of
       [] \<Rightarrow> y0
     | x # xs \<Rightarrow> foldl min x xs)"
 | "eval_agg_op (Agg_Max, y0) M = (case flatten_multiset M of
       [] \<Rightarrow> y0
     | x # xs \<Rightarrow> foldl max x xs)"
 | "eval_agg_op (Agg_Sum, y0) M = foldl plus y0 (flatten_multiset M)"
 | "eval_agg_op (Agg_Avg, y0) M = EFloat (let xs = flatten_multiset M in case xs of
       [] \<Rightarrow> 0
     | _ \<Rightarrow> double_of_event_data (foldl plus (EInt 0) xs) / double_of_int (length xs))"
 | "eval_agg_op (Agg_Med, y0) M = EFloat (let xs = flatten_multiset M; u = length xs in
     if u = 0 then 0 else
       let u' = u div 2 in
       if even u then
         (double_of_event_data (xs ! (u'-1)) + double_of_event_data (xs ! u') / double_of_int 2)
       else double_of_event_data (xs ! u'))"
 
 qualified datatype (discs_sels) formula = Pred name "trm list"
   | Let name formula formula
   | Eq trm trm | Less trm trm | LessEq trm trm
   | Neg formula | Or formula formula | And formula formula | Ands "formula list" | Exists formula
   | Agg nat agg_op nat trm formula
   | Prev \<I> formula | Next \<I> formula
   | Since formula \<I> formula | Until formula \<I> formula
   | MatchF \<I> "formula Regex.regex" | MatchP \<I> "formula Regex.regex"
 
 qualified definition "FF = Exists (Neg (Eq (Var 0) (Var 0)))"
 qualified definition "TT \<equiv> Neg FF"
 
 qualified fun fvi :: "nat \<Rightarrow> formula \<Rightarrow> nat set" where
   "fvi b (Pred r ts) = (\<Union>t\<in>set ts. fvi_trm b t)"
 | "fvi b (Let p \<phi> \<psi>) = fvi b \<psi>"
 | "fvi b (Eq t1 t2) = fvi_trm b t1 \<union> fvi_trm b t2"
 | "fvi b (Less t1 t2) = fvi_trm b t1 \<union> fvi_trm b t2"
 | "fvi b (LessEq t1 t2) = fvi_trm b t1 \<union> fvi_trm b t2"
 | "fvi b (Neg \<phi>) = fvi b \<phi>"
 | "fvi b (Or \<phi> \<psi>) = fvi b \<phi> \<union> fvi b \<psi>"
 | "fvi b (And \<phi> \<psi>) = fvi b \<phi> \<union> fvi b \<psi>"
 | "fvi b (Ands \<phi>s) = (let xs = map (fvi b) \<phi>s in \<Union>x\<in>set xs. x)"
 | "fvi b (Exists \<phi>) = fvi (Suc b) \<phi>"
 | "fvi b (Agg y \<omega> b' f \<phi>) = fvi (b + b') \<phi> \<union> fvi_trm (b + b') f \<union> (if b \<le> y then {y - b} else {})"
 | "fvi b (Prev I \<phi>) = fvi b \<phi>"
 | "fvi b (Next I \<phi>) = fvi b \<phi>"
 | "fvi b (Since \<phi> I \<psi>) = fvi b \<phi> \<union> fvi b \<psi>"
 | "fvi b (Until \<phi> I \<psi>) = fvi b \<phi> \<union> fvi b \<psi>"
 | "fvi b (MatchF I r) = Regex.fv_regex (fvi b) r"
 | "fvi b (MatchP I r) = Regex.fv_regex (fvi b) r"
 
 abbreviation "fv \<equiv> fvi 0"
 abbreviation "fv_regex \<equiv> Regex.fv_regex fv"
 
 lemma fv_abbrevs[simp]: "fv TT = {}" "fv FF = {}"
   unfolding TT_def FF_def by auto
 
 lemma fv_subset_Ands: "\<phi> \<in> set \<phi>s \<Longrightarrow> fv \<phi> \<subseteq> fv (Ands \<phi>s)"
   by auto
 
 lemma finite_fvi_trm[simp]: "finite (fvi_trm b t)"
   by (induction t) simp_all
 
 lemma finite_fvi[simp]: "finite (fvi b \<phi>)"
   by (induction \<phi> arbitrary: b) simp_all
 
 lemma fvi_trm_plus: "x \<in> fvi_trm (b + c) t \<longleftrightarrow> x + c \<in> fvi_trm b t"
   by (induction t) auto
 
 lemma fvi_trm_iff_fv_trm: "x \<in> fvi_trm b t \<longleftrightarrow> x + b \<in> fv_trm t"
   using fvi_trm_plus[where b=0 and c=b] by simp_all
 
 lemma fvi_plus: "x \<in> fvi (b + c) \<phi> \<longleftrightarrow> x + c \<in> fvi b \<phi>"
 proof (induction \<phi> arbitrary: b rule: formula.induct)
   case (Exists \<phi>)
   then show ?case by force
 next
   case (Agg y \<omega> b' f \<phi>)
   have *: "b + c + b' = b + b' + c" by simp
   from Agg show ?case by (force simp: * fvi_trm_plus)
 qed (auto simp add: fvi_trm_plus fv_regex_commute[where g = "\<lambda>x. x + c"])
 
 lemma fvi_Suc: "x \<in> fvi (Suc b) \<phi> \<longleftrightarrow> Suc x \<in> fvi b \<phi>"
   using fvi_plus[where c=1] by simp
 
 lemma fvi_plus_bound:
   assumes "\<forall>i\<in>fvi (b + c) \<phi>. i < n"
   shows "\<forall>i\<in>fvi b \<phi>. i < c + n"
 proof
   fix i
   assume "i \<in> fvi b \<phi>"
   show "i < c + n"
   proof (cases "i < c")
     case True
     then show ?thesis by simp
   next
     case False
     then obtain i' where "i = i' + c"
       using nat_le_iff_add by (auto simp: not_less)
     with assms \<open>i \<in> fvi b \<phi>\<close> show ?thesis by (simp add: fvi_plus)
   qed
 qed
 
 lemma fvi_Suc_bound:
   assumes "\<forall>i\<in>fvi (Suc b) \<phi>. i < n"
   shows "\<forall>i\<in>fvi b \<phi>. i < Suc n"
   using assms fvi_plus_bound[where c=1] by simp
 
 lemma fvi_iff_fv: "x \<in> fvi b \<phi> \<longleftrightarrow> x + b \<in> fv \<phi>"
   using fvi_plus[where b=0 and c=b] by simp_all
 
 qualified definition nfv :: "formula \<Rightarrow> nat" where
   "nfv \<phi> = Max (insert 0 (Suc ` fv \<phi>))"
 
 qualified abbreviation nfv_regex where
   "nfv_regex \<equiv> Regex.nfv_regex fv"
 
 qualified definition envs :: "formula \<Rightarrow> env set" where
   "envs \<phi> = {v. length v = nfv \<phi>}"
 
 lemma nfv_simps[simp]:
   "nfv (Let p \<phi> \<psi>) = nfv \<psi>"
   "nfv (Neg \<phi>) = nfv \<phi>"
   "nfv (Or \<phi> \<psi>) = max (nfv \<phi>) (nfv \<psi>)"
   "nfv (And \<phi> \<psi>) = max (nfv \<phi>) (nfv \<psi>)"
   "nfv (Prev I \<phi>) = nfv \<phi>"
   "nfv (Next I \<phi>) = nfv \<phi>"
   "nfv (Since \<phi> I \<psi>) = max (nfv \<phi>) (nfv \<psi>)"
   "nfv (Until \<phi> I \<psi>) = max (nfv \<phi>) (nfv \<psi>)"
   "nfv (MatchP I r) = Regex.nfv_regex fv r"
   "nfv (MatchF I r) = Regex.nfv_regex fv r"
   "nfv_regex (Regex.Skip n) = 0"
   "nfv_regex (Regex.Test \<phi>) = Max (insert 0 (Suc ` fv \<phi>))"
   "nfv_regex (Regex.Plus r s) = max (nfv_regex r) (nfv_regex s)"
   "nfv_regex (Regex.Times r s) = max (nfv_regex r) (nfv_regex s)"
   "nfv_regex (Regex.Star r) = nfv_regex r"
   unfolding nfv_def Regex.nfv_regex_def by (simp_all add: image_Un Max_Un[symmetric])
 
 lemma nfv_Ands[simp]: "nfv (Ands l) = Max (insert 0 (nfv ` set l))"
 proof (induction l)
   case Nil
   then show ?case unfolding nfv_def by simp
 next
   case (Cons a l)
   have "fv (Ands (a # l)) = fv a \<union> fv (Ands l)" by simp
   then have "nfv (Ands (a # l)) = max (nfv a) (nfv (Ands l))"
     unfolding nfv_def
     by (auto simp: image_Un Max.union[symmetric])
   with Cons.IH show ?case
     by (cases l) auto
 qed
 
 lemma fvi_less_nfv: "\<forall>i\<in>fv \<phi>. i < nfv \<phi>"
   unfolding nfv_def
   by (auto simp add: Max_gr_iff intro: max.strict_coboundedI2)
 
 lemma fvi_less_nfv_regex: "\<forall>i\<in>fv_regex \<phi>. i < nfv_regex \<phi>"
   unfolding Regex.nfv_regex_def
   by (auto simp add: Max_gr_iff intro: max.strict_coboundedI2)
 
 subsubsection \<open>Future reach\<close>
 
 qualified fun future_bounded :: "formula \<Rightarrow> bool" where
   "future_bounded (Pred _ _) = True"
 | "future_bounded (Let p \<phi> \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
 | "future_bounded (Eq _ _) = True"
 | "future_bounded (Less _ _) = True"
 | "future_bounded (LessEq _ _) = True"
 | "future_bounded (Neg \<phi>) = future_bounded \<phi>"
 | "future_bounded (Or \<phi> \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
 | "future_bounded (And \<phi> \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
 | "future_bounded (Ands l) = list_all future_bounded l"
 | "future_bounded (Exists \<phi>) = future_bounded \<phi>"
 | "future_bounded (Agg y \<omega> b f \<phi>) = future_bounded \<phi>"
 | "future_bounded (Prev I \<phi>) = future_bounded \<phi>"
 | "future_bounded (Next I \<phi>) = future_bounded \<phi>"
 | "future_bounded (Since \<phi> I \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
 | "future_bounded (Until \<phi> I \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi> \<and> right I \<noteq> \<infinity>)"
 | "future_bounded (MatchP I r) = Regex.pred_regex future_bounded r"
 | "future_bounded (MatchF I r) = (Regex.pred_regex future_bounded r \<and> right I \<noteq> \<infinity>)"
 
 
 subsubsection \<open>Semantics\<close>
 
 definition "ecard A = (if finite A then card A else \<infinity>)"
 
 qualified fun sat :: "trace \<Rightarrow> (name \<rightharpoonup> nat \<Rightarrow> event_data list set) \<Rightarrow> env \<Rightarrow> nat \<Rightarrow> formula \<Rightarrow> bool" where
   "sat \<sigma> V v i (Pred r ts) = (case V r of
        None \<Rightarrow> (r, map (eval_trm v) ts) \<in> \<Gamma> \<sigma> i
      | Some X \<Rightarrow> map (eval_trm v) ts \<in> X i)"
 | "sat \<sigma> V v i (Let p \<phi> \<psi>) =
     sat \<sigma> (V(p \<mapsto> \<lambda>i. {v. length v = nfv \<phi> \<and> sat \<sigma> V v i \<phi>})) v i \<psi>"
 | "sat \<sigma> V v i (Eq t1 t2) = (eval_trm v t1 = eval_trm v t2)"
 | "sat \<sigma> V v i (Less t1 t2) = (eval_trm v t1 < eval_trm v t2)"
 | "sat \<sigma> V v i (LessEq t1 t2) = (eval_trm v t1 \<le> eval_trm v t2)"
 | "sat \<sigma> V v i (Neg \<phi>) = (\<not> sat \<sigma> V v i \<phi>)"
 | "sat \<sigma> V v i (Or \<phi> \<psi>) = (sat \<sigma> V v i \<phi> \<or> sat \<sigma> V v i \<psi>)"
 | "sat \<sigma> V v i (And \<phi> \<psi>) = (sat \<sigma> V v i \<phi> \<and> sat \<sigma> V v i \<psi>)"
 | "sat \<sigma> V v i (Ands l) = (\<forall>\<phi> \<in> set l. sat \<sigma> V v i \<phi>)"
 | "sat \<sigma> V v i (Exists \<phi>) = (\<exists>z. sat \<sigma> V (z # v) i \<phi>)"
 | "sat \<sigma> V v i (Agg y \<omega> b f \<phi>) =
     (let M = {(x, ecard Zs) | x Zs. Zs = {zs. length zs = b \<and> sat \<sigma> V (zs @ v) i \<phi> \<and> eval_trm (zs @ v) f = x} \<and> Zs \<noteq> {}}
     in (M = {} \<longrightarrow> fv \<phi> \<subseteq> {0..<b}) \<and> v ! y = eval_agg_op \<omega> M)"
 | "sat \<sigma> V v i (Prev I \<phi>) = (case i of 0 \<Rightarrow> False | Suc j \<Rightarrow> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> sat \<sigma> V v j \<phi>)"
 | "sat \<sigma> V v i (Next I \<phi>) = (mem (\<tau> \<sigma> (Suc i) - \<tau> \<sigma> i) I \<and> sat \<sigma> V v (Suc i) \<phi>)"
 | "sat \<sigma> V v i (Since \<phi> I \<psi>) = (\<exists>j\<le>i. mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> sat \<sigma> V v j \<psi> \<and> (\<forall>k \<in> {j <.. i}. sat \<sigma> V v k \<phi>))"
 | "sat \<sigma> V v i (Until \<phi> I \<psi>) = (\<exists>j\<ge>i. mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> sat \<sigma> V v j \<psi> \<and> (\<forall>k \<in> {i ..< j}. sat \<sigma> V v k \<phi>))"
 | "sat \<sigma> V v i (MatchP I r) = (\<exists>j\<le>i. mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> Regex.match (sat \<sigma> V v) r j i)"
 | "sat \<sigma> V v i (MatchF I r) = (\<exists>j\<ge>i. mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> Regex.match (sat \<sigma> V v) r i j)"
 
 lemma sat_abbrevs[simp]:
   "sat \<sigma> V v i TT" "\<not> sat \<sigma> V v i FF"
   unfolding TT_def FF_def by auto
 
 lemma sat_Ands: "sat \<sigma> V v i (Ands l) \<longleftrightarrow> (\<forall>\<phi>\<in>set l. sat \<sigma> V v i \<phi>)"
   by (simp add: list_all_iff)
 
 lemma sat_Until_rec: "sat \<sigma> V v i (Until \<phi> I \<psi>) \<longleftrightarrow>
   mem 0 I \<and> sat \<sigma> V v i \<psi> \<or>
   (\<Delta> \<sigma> (i + 1) \<le> right I \<and> sat \<sigma> V v i \<phi> \<and> sat \<sigma> V v (i + 1) (Until \<phi> (subtract (\<Delta> \<sigma> (i + 1)) I) \<psi>))"
   (is "?L \<longleftrightarrow> ?R")
 proof (rule iffI; (elim disjE conjE)?)
   assume ?L
   then obtain j where j: "i \<le> j" "mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I" "sat \<sigma> V v j \<psi>" "\<forall>k \<in> {i ..< j}. sat \<sigma> V v k \<phi>"
     by auto
   then show ?R
   proof (cases "i = j")
     case False
     with j(1,2) have "\<Delta> \<sigma> (i + 1) \<le> right I"
       by (auto elim: order_trans[rotated] simp: diff_le_mono)
     moreover from False j(1,4) have "sat \<sigma> V v i \<phi>" by auto
     moreover from False j have "sat \<sigma> V v (i + 1) (Until \<phi> (subtract (\<Delta> \<sigma> (i + 1)) I) \<psi>)"
       by (cases "right I") (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j])
     ultimately show ?thesis by blast
   qed simp
 next
   assume \<Delta>: "\<Delta> \<sigma> (i + 1) \<le> right I" and now: "sat \<sigma> V v i \<phi>" and
    "next": "sat \<sigma> V v (i + 1) (Until \<phi> (subtract (\<Delta> \<sigma> (i + 1)) I) \<psi>)"
   from "next" obtain j where j: "i + 1 \<le> j" "mem (\<tau> \<sigma> j - \<tau> \<sigma> (i + 1)) ((subtract (\<Delta> \<sigma> (i + 1)) I))"
       "sat \<sigma> V v j \<psi>" "\<forall>k \<in> {i + 1 ..< j}. sat \<sigma> V v k \<phi>"
     by auto
   from \<Delta> j(1,2) have "mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I"
     by (cases "right I") (auto simp: le_diff_conv2)
   with now j(1,3,4) show ?L by (auto simp: le_eq_less_or_eq[of i] intro!: exI[of _ j])
 qed auto
 
 lemma sat_Since_rec: "sat \<sigma> V v i (Since \<phi> I \<psi>) \<longleftrightarrow>
   mem 0 I \<and> sat \<sigma> V v i \<psi> \<or>
   (i > 0 \<and> \<Delta> \<sigma> i \<le> right I \<and> sat \<sigma> V v i \<phi> \<and> sat \<sigma> V v (i - 1) (Since \<phi> (subtract (\<Delta> \<sigma> i) I) \<psi>))"
   (is "?L \<longleftrightarrow> ?R")
 proof (rule iffI; (elim disjE conjE)?)
   assume ?L
   then obtain j where j: "j \<le> i" "mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I" "sat \<sigma> V v j \<psi>" "\<forall>k \<in> {j <.. i}. sat \<sigma> V v k \<phi>"
     by auto
   then show ?R
   proof (cases "i = j")
     case False
     with j(1) obtain k where [simp]: "i = k + 1"
       by (cases i) auto
     with j(1,2) False have "\<Delta> \<sigma> i \<le> right I"
       by (auto elim: order_trans[rotated] simp: diff_le_mono2 le_Suc_eq)
     moreover from False j(1,4) have "sat \<sigma> V v i \<phi>" by auto
     moreover from False j have "sat \<sigma> V v (i - 1) (Since \<phi> (subtract (\<Delta> \<sigma> i) I) \<psi>)"
       by (cases "right I") (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j])
     ultimately show ?thesis by auto
   qed simp
 next
   assume i: "0 < i" and \<Delta>: "\<Delta> \<sigma> i \<le> right I" and now: "sat \<sigma> V v i \<phi>" and
    "prev": "sat \<sigma> V v (i - 1) (Since \<phi> (subtract (\<Delta> \<sigma> i) I) \<psi>)"
   from "prev" obtain j where j: "j \<le> i - 1" "mem (\<tau> \<sigma> (i - 1) - \<tau> \<sigma> j) ((subtract (\<Delta> \<sigma> i) I))"
       "sat \<sigma> V v j \<psi>" "\<forall>k \<in> {j <.. i - 1}. sat \<sigma> V v k \<phi>"
     by auto
   from \<Delta> i j(1,2) have "mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I"
     by (cases "right I") (auto simp: le_diff_conv2)
   with now i j(1,3,4) show ?L by (auto simp: le_Suc_eq gr0_conv_Suc intro!: exI[of _ j])
 qed auto
 
 lemma sat_MatchF_rec: "sat \<sigma> V v i (MatchF I r) \<longleftrightarrow> mem 0 I \<and> Regex.eps (sat \<sigma> V v) i r \<or>
   \<Delta> \<sigma> (i + 1) \<le> right I \<and> (\<exists>s \<in> Regex.lpd (sat \<sigma> V v) i r. sat \<sigma> V v (i + 1) (MatchF (subtract (\<Delta> \<sigma> (i + 1)) I) s))"
   (is "?L \<longleftrightarrow> ?R1 \<or> ?R2")
 proof (rule iffI; (elim disjE conjE bexE)?)
   assume ?L
   then obtain j where j: "j \<ge> i" "mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I" and "Regex.match (sat \<sigma> V v) r i j" by auto
   then show "?R1 \<or> ?R2"
   proof (cases "i < j")
     case True
     with \<open>Regex.match (sat \<sigma> V v) r i j\<close> lpd_match[of i j "sat \<sigma> V v" r]
     obtain s where "s \<in> Regex.lpd (sat \<sigma> V v) i r" "Regex.match (sat \<sigma> V v) s (i + 1) j" by auto
     with True j have ?R2
       by (cases "right I")
         (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j] elim: le_trans[rotated])
     then show ?thesis by blast
   qed (auto simp: eps_match)
 next
   assume "enat (\<Delta> \<sigma> (i + 1)) \<le> right I"
   moreover
   fix s
   assume [simp]: "s \<in> Regex.lpd (sat \<sigma> V v) i r" and "sat \<sigma> V v (i + 1) (MatchF (subtract (\<Delta> \<sigma> (i + 1)) I) s)"
   then obtain j where "j > i" "Regex.match (sat \<sigma> V v) s (i + 1) j"
     "mem (\<tau> \<sigma> j - \<tau> \<sigma> (Suc i)) (subtract (\<Delta> \<sigma> (i + 1)) I)" by (auto simp: Suc_le_eq)
   ultimately show ?L
     by (cases "right I")
       (auto simp: le_diff_conv lpd_match intro!: exI[of _ j] bexI[of _ s])
 qed (auto simp: eps_match intro!: exI[of _ i])
 
 lemma sat_MatchP_rec: "sat \<sigma> V v i (MatchP I r) \<longleftrightarrow> mem 0 I \<and> Regex.eps (sat \<sigma> V v) i r \<or>
   i > 0 \<and> \<Delta> \<sigma> i \<le> right I \<and> (\<exists>s \<in> Regex.rpd (sat \<sigma> V v) i r. sat \<sigma> V v (i - 1) (MatchP (subtract (\<Delta> \<sigma> i) I) s))"
   (is "?L \<longleftrightarrow> ?R1 \<or> ?R2")
 proof (rule iffI; (elim disjE conjE bexE)?)
   assume ?L
   then obtain j where j: "j \<le> i" "mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I" and "Regex.match (sat \<sigma> V v) r j i" by auto
   then show "?R1 \<or> ?R2"
   proof (cases "j < i")
     case True
     with \<open>Regex.match (sat \<sigma> V v) r j i\<close> rpd_match[of j i "sat \<sigma> V v" r]
     obtain s where "s \<in> Regex.rpd (sat \<sigma> V v) i r" "Regex.match (sat \<sigma> V v) s j (i - 1)" by auto
     with True j have ?R2
       by (cases "right I")
         (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j] elim: le_trans)
     then show ?thesis by blast
   qed (auto simp: eps_match)
 next
   assume "enat (\<Delta> \<sigma> i) \<le> right I"
   moreover
   fix s
   assume [simp]: "s \<in> Regex.rpd (sat \<sigma> V v) i r" and "sat \<sigma> V v (i - 1) (MatchP (subtract (\<Delta> \<sigma> i) I) s)" "i > 0"
   then obtain j where "j < i" "Regex.match (sat \<sigma> V v) s j (i - 1)"
     "mem (\<tau> \<sigma> (i - 1) - \<tau> \<sigma> j) (subtract (\<Delta> \<sigma> i) I)" by (auto simp: gr0_conv_Suc less_Suc_eq_le)
   ultimately show ?L
     by (cases "right I")
       (auto simp: le_diff_conv rpd_match intro!: exI[of _ j] bexI[of _ s])
 qed (auto simp: eps_match intro!: exI[of _ i])
 
 lemma sat_Since_0: "sat \<sigma> V v 0 (Since \<phi> I \<psi>) \<longleftrightarrow> mem 0 I \<and> sat \<sigma> V v 0 \<psi>"
   by auto
 
 lemma sat_MatchP_0: "sat \<sigma> V v 0 (MatchP I r) \<longleftrightarrow> mem 0 I \<and> Regex.eps (sat \<sigma> V v) 0 r"
   by (auto simp: eps_match)
 
 lemma sat_Since_point: "sat \<sigma> V v i (Since \<phi> I \<psi>) \<Longrightarrow>
     (\<And>j. j \<le> i \<Longrightarrow> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<Longrightarrow> sat \<sigma> V v i (Since \<phi> (point (\<tau> \<sigma> i - \<tau> \<sigma> j)) \<psi>) \<Longrightarrow> P) \<Longrightarrow> P"
   by (auto intro: diff_le_self)
 
 lemma sat_MatchP_point: "sat \<sigma> V v i (MatchP I r) \<Longrightarrow>
     (\<And>j. j \<le> i \<Longrightarrow> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<Longrightarrow> sat \<sigma> V v i (MatchP (point (\<tau> \<sigma> i - \<tau> \<sigma> j)) r) \<Longrightarrow> P) \<Longrightarrow> P"
   by (auto intro: diff_le_self)
 
 lemma sat_Since_pointD: "sat \<sigma> V v i (Since \<phi> (point t) \<psi>) \<Longrightarrow> mem t I \<Longrightarrow> sat \<sigma> V v i (Since \<phi> I \<psi>)"
   by auto
 
 lemma sat_MatchP_pointD: "sat \<sigma> V v i (MatchP (point t) r) \<Longrightarrow> mem t I \<Longrightarrow> sat \<sigma> V v i (MatchP I r)"
   by auto
 
 lemma sat_fv_cong: "\<forall>x\<in>fv \<phi>. v!x = v'!x \<Longrightarrow> sat \<sigma> V v i \<phi> = sat \<sigma> V v' i \<phi>"
 proof (induct \<phi> arbitrary: V v v' i rule: formula.induct)
   case (Pred n ts)
   show ?case by (simp cong: map_cong eval_trm_fv_cong[OF Pred[simplified, THEN bspec]] split: option.splits)
 next
   case (Let p b \<phi> \<psi>)
   then show ?case
     by auto
 next
   case (Eq x1 x2)
   then show ?case unfolding fvi.simps sat.simps by (metis UnCI eval_trm_fv_cong)
 next
   case (Less x1 x2)
   then show ?case unfolding fvi.simps sat.simps by (metis UnCI eval_trm_fv_cong)
 next
   case (LessEq x1 x2)
   then show ?case unfolding fvi.simps sat.simps by (metis UnCI eval_trm_fv_cong)
 next
   case (Ands l)
   have "\<And>\<phi>. \<phi> \<in> set l \<Longrightarrow> sat \<sigma> V v i \<phi> = sat \<sigma> V v' i \<phi>"
   proof -
     fix \<phi> assume "\<phi> \<in> set l"
     then have "fv \<phi> \<subseteq> fv (Ands l)" using fv_subset_Ands by blast
     then have "\<forall>x\<in>fv \<phi>. v!x = v'!x" using Ands.prems by blast
     then show "sat \<sigma> V v i \<phi> = sat \<sigma> V v' i \<phi>" using Ands.hyps \<open>\<phi> \<in> set l\<close> by blast
   qed
   then show ?case using sat_Ands by blast
 next
   case (Exists \<phi>)
   then show ?case unfolding sat.simps by (intro iff_exI) (simp add: fvi_Suc nth_Cons')
 next
   case (Agg y \<omega> b f \<phi>)
   have "v ! y = v' ! y"
     using Agg.prems by simp
   moreover have "sat \<sigma> V (zs @ v) i \<phi> = sat \<sigma> V (zs @ v') i \<phi>" if "length zs = b" for zs
     using that Agg.prems by (simp add: Agg.hyps[where v="zs @ v" and v'="zs @ v'"]
         nth_append fvi_iff_fv(1)[where b=b])
   moreover have "eval_trm (zs @ v) f = eval_trm (zs @ v') f" if "length zs = b" for zs
     using that Agg.prems by (auto intro!: eval_trm_fv_cong[where v="zs @ v" and v'="zs @ v'"]
         simp: nth_append fvi_iff_fv(1)[where b=b] fvi_trm_iff_fv_trm[where b="length zs"])
   ultimately show ?case
     by (simp cong: conj_cong)
 next
   case (MatchF I r)
   then have "Regex.match (sat \<sigma> V v) r = Regex.match (sat \<sigma> V v') r"
     by (intro match_fv_cong) (auto simp: fv_regex_alt)
   then show ?case
     by auto
 next
   case (MatchP I r)
   then have "Regex.match (sat \<sigma> V v) r = Regex.match (sat \<sigma> V v') r"
     by (intro match_fv_cong) (auto simp: fv_regex_alt)
   then show ?case
     by auto
 qed (auto 10 0 split: nat.splits intro!: iff_exI)
 
 lemma match_fv_cong:
   "\<forall>x\<in>fv_regex r. v!x = v'!x \<Longrightarrow> Regex.match (sat \<sigma> V v) r = Regex.match (sat \<sigma> V v') r"
   by (rule match_fv_cong, rule sat_fv_cong) (auto simp: fv_regex_alt)
 
 lemma eps_fv_cong:
   "\<forall>x\<in>fv_regex r. v!x = v'!x \<Longrightarrow> Regex.eps (sat \<sigma> V v) i r = Regex.eps (sat \<sigma> V v') i r"
   unfolding eps_match by (erule match_fv_cong[THEN fun_cong, THEN fun_cong])
 
 
+subsection \<open>Past-only formulas\<close>
+
+fun past_only :: "formula \<Rightarrow> bool" where
+  "past_only (Pred _ _) = True"
+| "past_only (Eq _ _) = True"
+| "past_only (Less _ _) = True"
+| "past_only (LessEq _ _) = True"
+| "past_only (Let _ \<alpha> \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
+| "past_only (Neg \<psi>) = past_only \<psi>"
+| "past_only (Or \<alpha> \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
+| "past_only (And \<alpha> \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
+| "past_only (Ands l) = (\<forall>\<alpha>\<in>set l. past_only \<alpha>)"
+| "past_only (Exists \<psi>) = past_only \<psi>"
+| "past_only (Agg _ _ _ _ \<psi>) = past_only \<psi>"
+| "past_only (Prev _ \<psi>) = past_only \<psi>"
+| "past_only (Next _ _) = False"
+| "past_only (Since \<alpha> _ \<beta>) = (past_only \<alpha> \<and> past_only \<beta>)"
+| "past_only (Until \<alpha> _ \<beta>) = False"
+| "past_only (MatchP _ r) = Regex.pred_regex past_only r"
+| "past_only (MatchF _ _) = False"
+
+lemma past_only_sat:
+  assumes "prefix_of \<pi> \<sigma>" "prefix_of \<pi> \<sigma>'"
+  shows "i < plen \<pi> \<Longrightarrow> dom V = dom V' \<Longrightarrow>
+     (\<And>p i. p \<in> dom V \<Longrightarrow> i < plen \<pi> \<Longrightarrow> the (V p) i = the (V' p) i) \<Longrightarrow>
+     past_only \<phi> \<Longrightarrow> sat \<sigma> V v i \<phi> = sat \<sigma>' V' v i \<phi>"
+proof (induction \<phi> arbitrary: V V' v i)
+  case (Pred e ts)
+  show ?case proof (cases "V e")
+    case None
+    then have "V' e = None" using \<open>dom V = dom V'\<close> by auto
+    with None \<Gamma>_prefix_conv[OF assms(1,2) Pred(1)] show ?thesis by simp
+  next
+    case (Some a)
+    moreover obtain a' where "V' e = Some a'" using Some \<open>dom V = dom V'\<close> by auto
+    moreover have "the (V e) i = the (V' e) i"
+      using Some Pred(1,3) by (fastforce intro: domI)
+    ultimately show ?thesis by simp
+  qed
+next
+  case (Let p \<phi> \<psi>)
+  let ?V = "\<lambda>V \<sigma>. (V(p \<mapsto> \<lambda>i. {v. length v = nfv \<phi> \<and> sat \<sigma> V v i \<phi>}))"
+  show ?case unfolding sat.simps proof (rule Let.IH(2))
+    show "i < plen \<pi>" by fact
+    from Let.prems show "past_only \<psi>" by simp
+    from Let.prems show "dom (?V V \<sigma>) = dom (?V V' \<sigma>')"
+      by (simp del: fun_upd_apply)
+  next
+    fix p' i
+    assume *: "p' \<in> dom (?V V \<sigma>)" "i < plen \<pi>"
+    show "the (?V V \<sigma> p') i = the (?V V' \<sigma>' p') i" proof (cases "p' = p")
+      case True
+      with Let \<open>i < plen \<pi>\<close> show ?thesis by auto
+    next
+      case False
+      with * show ?thesis by (auto intro!: Let.prems(3))
+    qed
+  qed
+next
+  case (Ands l)
+  with \<Gamma>_prefix_conv[OF assms] show ?case by simp
+next
+  case (Prev I \<phi>)
+  with \<tau>_prefix_conv[OF assms] show ?case by (simp split: nat.split)
+next
+  case (Since \<phi>1 I \<phi>2)
+  with \<tau>_prefix_conv[OF assms] show ?case by auto
+next
+  case (MatchP I r)
+  then have "Regex.match (sat \<sigma> V v) r a b = Regex.match (sat \<sigma>' V' v) r a b" if "b < plen \<pi>" for a b
+    using that by (intro Regex.match_cong_strong) (auto simp: regex.pred_set)
+  with \<tau>_prefix_conv[OF assms] MatchP(2) show ?case by auto
+qed auto
+
+
 subsection \<open>Safe formulas\<close>
 
 fun remove_neg :: "formula \<Rightarrow> formula" where
   "remove_neg (Neg \<phi>) = \<phi>"
 | "remove_neg \<phi> = \<phi>"
 
 lemma fvi_remove_neg[simp]: "fvi b (remove_neg \<phi>) = fvi b \<phi>"
   by (cases \<phi>) simp_all
 
 lemma partition_cong[fundef_cong]:
   "xs = ys \<Longrightarrow> (\<And>x. x\<in>set xs \<Longrightarrow> f x = g x) \<Longrightarrow> partition f xs = partition g ys"
   by (induction xs arbitrary: ys) auto
 
 lemma size_remove_neg[termination_simp]: "size (remove_neg \<phi>) \<le> size \<phi>"
   by (cases \<phi>) simp_all
 
 fun is_constraint :: "formula \<Rightarrow> bool" where
   "is_constraint (Eq t1 t2) = True"
 | "is_constraint (Less t1 t2) = True"
 | "is_constraint (LessEq t1 t2) = True"
 | "is_constraint (Neg (Eq t1 t2)) = True"
 | "is_constraint (Neg (Less t1 t2)) = True"
 | "is_constraint (Neg (LessEq t1 t2)) = True"
 | "is_constraint _ = False"
 
 definition safe_assignment :: "nat set \<Rightarrow> formula \<Rightarrow> bool" where
   "safe_assignment X \<phi> = (case \<phi> of
        Eq (Var x) (Var y) \<Rightarrow> (x \<notin> X \<longleftrightarrow> y \<in> X)
      | Eq (Var x) t \<Rightarrow> (x \<notin> X \<and> fv_trm t \<subseteq> X)
      | Eq t (Var x) \<Rightarrow> (x \<notin> X \<and> fv_trm t \<subseteq> X)
      | _ \<Rightarrow> False)"
 
 fun safe_formula :: "formula \<Rightarrow> bool" where
   "safe_formula (Eq t1 t2) = (is_Const t1 \<and> (is_Const t2 \<or> is_Var t2) \<or> is_Var t1 \<and> is_Const t2)"
 | "safe_formula (Neg (Eq (Var x) (Var y))) = (x = y)"
 | "safe_formula (Less t1 t2) = False"
 | "safe_formula (LessEq t1 t2) = False"
 | "safe_formula (Pred e ts) = (\<forall>t\<in>set ts. is_Var t \<or> is_Const t)"
 | "safe_formula (Let p \<phi> \<psi>) = ({0..<nfv \<phi>} \<subseteq> fv \<phi> \<and> safe_formula \<phi> \<and> safe_formula \<psi>)"
 | "safe_formula (Neg \<phi>) = (fv \<phi> = {} \<and> safe_formula \<phi>)"
 | "safe_formula (Or \<phi> \<psi>) = (fv \<psi> = fv \<phi> \<and> safe_formula \<phi> \<and> safe_formula \<psi>)"
 | "safe_formula (And \<phi> \<psi>) = (safe_formula \<phi> \<and>
     (safe_assignment (fv \<phi>) \<psi> \<or> safe_formula \<psi> \<or>
       fv \<psi> \<subseteq> fv \<phi> \<and> (is_constraint \<psi> \<or> (case \<psi> of Neg \<psi>' \<Rightarrow> safe_formula \<psi>' | _ \<Rightarrow> False))))"
 | "safe_formula (Ands l) = (let (pos, neg) = partition safe_formula l in pos \<noteq> [] \<and>
     list_all safe_formula (map remove_neg neg) \<and> \<Union>(set (map fv neg)) \<subseteq> \<Union>(set (map fv pos)))"
 | "safe_formula (Exists \<phi>) = (safe_formula \<phi>)"
 | "safe_formula (Agg y \<omega> b f \<phi>) = (safe_formula \<phi> \<and> y + b \<notin> fv \<phi> \<and> {0..<b} \<subseteq> fv \<phi> \<and> fv_trm f \<subseteq> fv \<phi>)"
 | "safe_formula (Prev I \<phi>) = (safe_formula \<phi>)"
 | "safe_formula (Next I \<phi>) = (safe_formula \<phi>)"
 | "safe_formula (Since \<phi> I \<psi>) = (fv \<phi> \<subseteq> fv \<psi> \<and>
     (safe_formula \<phi> \<or> (case \<phi> of Neg \<phi>' \<Rightarrow> safe_formula \<phi>' | _ \<Rightarrow> False)) \<and> safe_formula \<psi>)"
 | "safe_formula (Until \<phi> I \<psi>) = (fv \<phi> \<subseteq> fv \<psi> \<and>
     (safe_formula \<phi> \<or> (case \<phi> of Neg \<phi>' \<Rightarrow> safe_formula \<phi>' | _ \<Rightarrow> False)) \<and> safe_formula \<psi>)"
 | "safe_formula (MatchP I r) = Regex.safe_regex fv (\<lambda>g \<phi>. safe_formula \<phi> \<or>
      (g = Lax \<and> (case \<phi> of Neg \<phi>' \<Rightarrow> safe_formula \<phi>' | _ \<Rightarrow> False))) Past Strict r"
 | "safe_formula (MatchF I r) = Regex.safe_regex fv (\<lambda>g \<phi>. safe_formula \<phi> \<or>
      (g = Lax \<and> (case \<phi> of Neg \<phi>' \<Rightarrow> safe_formula \<phi>' | _ \<Rightarrow> False))) Futu Strict r"
 
 abbreviation "safe_regex \<equiv> Regex.safe_regex fv (\<lambda>g \<phi>. safe_formula \<phi> \<or>
   (g = Lax \<and> (case \<phi> of Neg \<phi>' \<Rightarrow> safe_formula \<phi>' | _ \<Rightarrow> False)))"
 
 lemma safe_regex_safe_formula:
   "safe_regex m g r \<Longrightarrow> \<phi> \<in> Regex.atms r \<Longrightarrow> safe_formula \<phi> \<or>
   (\<exists>\<psi>. \<phi> = Neg \<psi> \<and> safe_formula \<psi>)"
   by (cases g) (auto dest!: safe_regex_safe[rotated] split: formula.splits[where formula=\<phi>])
 
 lemma safe_abbrevs[simp]: "safe_formula TT" "safe_formula FF"
   unfolding TT_def FF_def by auto
 
 definition safe_neg :: "formula \<Rightarrow> bool" where
   "safe_neg \<phi> \<longleftrightarrow> (\<not> safe_formula \<phi> \<longrightarrow> safe_formula (remove_neg \<phi>))"
 
 definition atms :: "formula Regex.regex \<Rightarrow> formula set" where
   "atms r = (\<Union>\<phi> \<in> Regex.atms r.
      if safe_formula \<phi> then {\<phi>} else case \<phi> of Neg \<phi>' \<Rightarrow> {\<phi>'} | _ \<Rightarrow> {})"
 
 lemma atms_simps[simp]:
   "atms (Regex.Skip n) = {}"
   "atms (Regex.Test \<phi>) = (if safe_formula \<phi> then {\<phi>} else case \<phi> of Neg \<phi>' \<Rightarrow> {\<phi>'} | _ \<Rightarrow> {})"
   "atms (Regex.Plus r s) = atms r \<union> atms s"
   "atms (Regex.Times r s) = atms r \<union> atms s"
   "atms (Regex.Star r) = atms r"
   unfolding atms_def by auto
 
 lemma finite_atms[simp]: "finite (atms r)"
   by (induct r) (auto split: formula.splits)
 
 lemma disjE_Not2: "P \<or> Q \<Longrightarrow> (P \<Longrightarrow> R) \<Longrightarrow> (\<not>P \<Longrightarrow> Q \<Longrightarrow> R) \<Longrightarrow> R"
   by blast
 
 lemma safe_formula_induct[consumes 1, case_names Eq_Const Eq_Var1 Eq_Var2 neq_Var Pred Let
     And_assign And_safe And_constraint And_Not Ands Neg Or Exists Agg
     Prev Next Since Not_Since Until Not_Until MatchP MatchF]:
   assumes "safe_formula \<phi>"
     and Eq_Const: "\<And>c d. P (Eq (Const c) (Const d))"
     and Eq_Var1: "\<And>c x. P (Eq (Const c) (Var x))"
     and Eq_Var2: "\<And>c x. P (Eq (Var x) (Const c))"
     and neq_Var: "\<And>x. P (Neg (Eq (Var x) (Var x)))"
     and Pred: "\<And>e ts. \<forall>t\<in>set ts. is_Var t \<or> is_Const t \<Longrightarrow> P (Pred e ts)"
     and Let: "\<And>p \<phi> \<psi>. {0..<nfv \<phi>} \<subseteq> fv \<phi> \<Longrightarrow> safe_formula \<phi> \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (Let p \<phi> \<psi>)"
     and And_assign: "\<And>\<phi> \<psi>. safe_formula \<phi> \<Longrightarrow> safe_assignment (fv \<phi>) \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (And \<phi> \<psi>)"
     and And_safe: "\<And>\<phi> \<psi>. safe_formula \<phi> \<Longrightarrow> \<not> safe_assignment (fv \<phi>) \<psi> \<Longrightarrow> safe_formula \<psi> \<Longrightarrow>
       P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (And \<phi> \<psi>)"
     and And_constraint: "\<And>\<phi> \<psi>. safe_formula \<phi> \<Longrightarrow> \<not> safe_assignment (fv \<phi>) \<psi> \<Longrightarrow> \<not> safe_formula \<psi> \<Longrightarrow>
       fv \<psi> \<subseteq> fv \<phi> \<Longrightarrow> is_constraint \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (And \<phi> \<psi>)"
     and And_Not: "\<And>\<phi> \<psi>. safe_formula \<phi> \<Longrightarrow> \<not> safe_assignment (fv \<phi>) (Neg \<psi>) \<Longrightarrow> \<not> safe_formula (Neg \<psi>) \<Longrightarrow>
       fv (Neg \<psi>) \<subseteq> fv \<phi> \<Longrightarrow> \<not> is_constraint (Neg \<psi>) \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (And \<phi> (Neg \<psi>))"
     and Ands: "\<And>l pos neg. (pos, neg) = partition safe_formula l \<Longrightarrow> pos \<noteq> [] \<Longrightarrow>
       list_all safe_formula pos \<Longrightarrow> list_all safe_formula (map remove_neg neg) \<Longrightarrow>
       (\<Union>\<phi>\<in>set neg. fv \<phi>) \<subseteq> (\<Union>\<phi>\<in>set pos. fv \<phi>) \<Longrightarrow>
       list_all P pos \<Longrightarrow> list_all P (map remove_neg neg) \<Longrightarrow> P (Ands l)"
     and Neg: "\<And>\<phi>. fv \<phi> = {} \<Longrightarrow> safe_formula \<phi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (Neg \<phi>)"
     and Or: "\<And>\<phi> \<psi>. fv \<psi> = fv \<phi> \<Longrightarrow> safe_formula \<phi> \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (Or \<phi> \<psi>)"
     and Exists: "\<And>\<phi>. safe_formula \<phi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (Exists \<phi>)"
     and Agg: "\<And>y \<omega> b f \<phi>. y + b \<notin> fv \<phi> \<Longrightarrow> {0..<b} \<subseteq> fv \<phi> \<Longrightarrow> fv_trm f \<subseteq> fv \<phi> \<Longrightarrow>
       safe_formula \<phi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (Agg y \<omega> b f \<phi>)"
     and Prev: "\<And>I \<phi>. safe_formula \<phi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (Prev I \<phi>)"
     and Next: "\<And>I \<phi>. safe_formula \<phi> \<Longrightarrow> P \<phi> \<Longrightarrow> P (Next I \<phi>)"
     and Since: "\<And>\<phi> I \<psi>. fv \<phi> \<subseteq> fv \<psi> \<Longrightarrow> safe_formula \<phi> \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (Since \<phi> I \<psi>)"
     and Not_Since: "\<And>\<phi> I \<psi>. fv (Neg \<phi>) \<subseteq> fv \<psi> \<Longrightarrow> safe_formula \<phi> \<Longrightarrow>
       \<not> safe_formula (Neg \<phi>) \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (Since (Neg \<phi>) I \<psi> )"
     and Until: "\<And>\<phi> I \<psi>. fv \<phi> \<subseteq> fv \<psi> \<Longrightarrow> safe_formula \<phi> \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (Until \<phi> I \<psi>)"
     and Not_Until: "\<And>\<phi> I \<psi>. fv (Neg \<phi>) \<subseteq> fv \<psi> \<Longrightarrow> safe_formula \<phi> \<Longrightarrow>
       \<not> safe_formula (Neg \<phi>) \<Longrightarrow> safe_formula \<psi> \<Longrightarrow> P \<phi> \<Longrightarrow> P \<psi> \<Longrightarrow> P (Until (Neg \<phi>) I \<psi>)"
     and MatchP: "\<And>I r. safe_regex Past Strict r \<Longrightarrow> \<forall>\<phi> \<in> atms r. P \<phi> \<Longrightarrow> P (MatchP I r)"
     and MatchF: "\<And>I r. safe_regex Futu Strict r \<Longrightarrow> \<forall>\<phi> \<in> atms r. P \<phi> \<Longrightarrow> P (MatchF I r)"
   shows "P \<phi>"
 using assms(1) proof (induction \<phi> rule: safe_formula.induct)
   case (1 t1 t2)
   then show ?case using Eq_Const Eq_Var1 Eq_Var2 by (auto simp: trm.is_Const_def trm.is_Var_def)
 next
   case (9 \<phi> \<psi>)
   from \<open>safe_formula (And \<phi> \<psi>)\<close> have "safe_formula \<phi>" by simp
   from \<open>safe_formula (And \<phi> \<psi>)\<close> consider
     (a) "safe_assignment (fv \<phi>) \<psi>"
     | (b) "\<not> safe_assignment (fv \<phi>) \<psi>" "safe_formula \<psi>"
     | (c) "fv \<psi> \<subseteq> fv \<phi>" "\<not> safe_assignment (fv \<phi>) \<psi>" "\<not> safe_formula \<psi>" "is_constraint \<psi>"
     | (d) \<psi>' where "fv \<psi> \<subseteq> fv \<phi>" "\<not> safe_assignment (fv \<phi>) \<psi>" "\<not> safe_formula \<psi>" "\<not> is_constraint \<psi>"
         "\<psi> = Neg \<psi>'" "safe_formula \<psi>'"
     by (cases \<psi>) auto
   then show ?case proof cases
     case a
     then show ?thesis using "9.IH" \<open>safe_formula \<phi>\<close> by (intro And_assign)
   next
     case b
     then show ?thesis using "9.IH" \<open>safe_formula \<phi>\<close> by (intro And_safe)
   next
     case c
     then show ?thesis using "9.IH" \<open>safe_formula \<phi>\<close> by (intro And_constraint)
   next
     case d
     then show ?thesis using "9.IH" \<open>safe_formula \<phi>\<close> by (blast intro!: And_Not)
   qed
 next
   case (10 l)
   obtain pos neg where posneg: "(pos, neg) = partition safe_formula l" by simp
   have "pos \<noteq> []" using "10.prems" posneg by simp
   moreover have "list_all safe_formula pos" using posneg by (simp add: list.pred_set)
   moreover have safe_remove_neg: "list_all safe_formula (map remove_neg neg)" using "10.prems" posneg by auto
   moreover have "list_all P pos"
     using posneg "10.IH"(1) by (simp add: list_all_iff)
   moreover have "list_all P (map remove_neg neg)"
     using "10.IH"(2)[OF posneg] safe_remove_neg by (simp add: list_all_iff)
   ultimately show ?case using "10.IH"(1) "10.prems" Ands posneg by simp
 next
   case (15 \<phi> I \<psi>)
   then show ?case
   proof (cases \<phi>)
     case (Ands l)
     then show ?thesis using "15.IH"(1) "15.IH"(3) "15.prems" Since by auto
   qed (auto 0 3 elim!: disjE_Not2 intro: Since Not_Since) (*SLOW*)
 next
   case (16 \<phi> I \<psi>)
   then show ?case
   proof (cases \<phi>)
     case (Ands l)
     then show ?thesis using "16.IH"(1) "16.IH"(3) "16.prems" Until by auto
   qed (auto 0 3 elim!: disjE_Not2 intro: Until Not_Until) (*SLOW*)
 next
   case (17 I r)
   then show ?case
     by (intro MatchP) (auto simp: atms_def dest: safe_regex_safe_formula split: if_splits)
 next
   case (18 I r)
   then show ?case
     by (intro MatchF) (auto simp: atms_def dest: safe_regex_safe_formula split: if_splits)
 qed (auto simp: assms)
 
 lemma safe_formula_NegD:
   "safe_formula (Formula.Neg \<phi>) \<Longrightarrow> fv \<phi> = {} \<or> (\<exists>x. \<phi> = Formula.Eq (Formula.Var x) (Formula.Var x))"
   by (induct "Formula.Neg \<phi>" rule: safe_formula_induct) auto
 
 
 subsection \<open>Slicing traces\<close>
 
 qualified fun matches ::
   "env \<Rightarrow> formula \<Rightarrow> name \<times> event_data list \<Rightarrow> bool" where
   "matches v (Pred r ts) e = (fst e = r \<and> map (eval_trm v) ts = snd e)"
 | "matches v (Let p \<phi> \<psi>) e =
     ((\<exists>v'. matches v' \<phi> e \<and> matches v \<psi> (p, v')) \<or>
     fst e \<noteq> p \<and> matches v \<psi> e)"
 | "matches v (Eq _ _) e = False"
 | "matches v (Less _ _) e = False"
 | "matches v (LessEq _ _) e = False"
 | "matches v (Neg \<phi>) e = matches v \<phi> e"
 | "matches v (Or \<phi> \<psi>) e = (matches v \<phi> e \<or> matches v \<psi> e)"
 | "matches v (And \<phi> \<psi>) e = (matches v \<phi> e \<or> matches v \<psi> e)"
 | "matches v (Ands l) e = (\<exists>\<phi>\<in>set l. matches v \<phi> e)"
 | "matches v (Exists \<phi>) e = (\<exists>z. matches (z # v) \<phi> e)"
 | "matches v (Agg y \<omega> b f \<phi>) e = (\<exists>zs. length zs = b \<and> matches (zs @ v) \<phi> e)"
 | "matches v (Prev I \<phi>) e = matches v \<phi> e"
 | "matches v (Next I \<phi>) e = matches v \<phi> e"
 | "matches v (Since \<phi> I \<psi>) e = (matches v \<phi> e \<or> matches v \<psi> e)"
 | "matches v (Until \<phi> I \<psi>) e = (matches v \<phi> e \<or> matches v \<psi> e)"
 | "matches v (MatchP I r) e = (\<exists>\<phi> \<in> Regex.atms r. matches v \<phi> e)"
 | "matches v (MatchF I r) e = (\<exists>\<phi> \<in> Regex.atms r. matches v \<phi> e)"
 
 lemma matches_cong:
   "\<forall>x\<in>fv \<phi>. v!x = v'!x \<Longrightarrow> matches v \<phi> e = matches v' \<phi> e"
 proof (induct \<phi> arbitrary: v v' e)
   case (Pred n ts)
   show ?case
     by (simp cong: map_cong eval_trm_fv_cong[OF Pred(1)[simplified, THEN bspec]])
 next
   case (Let p b \<phi> \<psi>)
   then show ?case
     by (cases e) (auto 11 0)
 next
   case (Ands l)
   have "\<And>\<phi>. \<phi> \<in> (set l) \<Longrightarrow> matches v \<phi> e = matches v' \<phi> e"
   proof -
     fix \<phi> assume "\<phi> \<in> (set l)"
     then have "fv \<phi> \<subseteq> fv (Ands l)" using fv_subset_Ands by blast
     then have "\<forall>x\<in>fv \<phi>. v!x = v'!x" using Ands.prems by blast
     then show "matches v \<phi> e = matches v' \<phi> e" using Ands.hyps \<open>\<phi> \<in> set l\<close> by blast
   qed
   then show ?case by simp
 next
   case (Exists \<phi>)
   then show ?case unfolding matches.simps by (intro iff_exI) (simp add: fvi_Suc nth_Cons')
 next
   case (Agg y \<omega> b f \<phi>)
   have "matches (zs @ v) \<phi> e = matches (zs @ v') \<phi> e" if "length zs = b" for zs
     using that Agg.prems by (simp add: Agg.hyps[where v="zs @ v" and v'="zs @ v'"]
         nth_append fvi_iff_fv(1)[where b=b])
   then show ?case by auto
 qed (auto 9 0 simp add: nth_Cons' fv_regex_alt)
 
-abbreviation relevant_events where
-  "relevant_events \<phi> S \<equiv> {e. S \<inter> {v. matches v \<phi> e} \<noteq> {}}"
-
-qualified definition slice :: "formula \<Rightarrow> env set \<Rightarrow> trace \<Rightarrow> trace" where
-  "slice \<phi> S \<sigma> = map_\<Gamma> (\<lambda>D. D \<inter> relevant_events \<phi> S) \<sigma>"
-
-lemma \<tau>_slice[simp]: "\<tau> (slice \<phi> S \<sigma>) = \<tau> \<sigma>"
-  unfolding slice_def by (simp add: fun_eq_iff)
+abbreviation relevant_events where "relevant_events \<phi> S \<equiv> {e. S \<inter> {v. matches v \<phi> e} \<noteq> {}}"
 
 lemma sat_slice_strong:
   assumes "v \<in> S" "dom V = dom V'"
     "\<And>p v i. p \<in> dom V \<Longrightarrow> (p, v) \<in> relevant_events \<phi> S \<Longrightarrow> v \<in> the (V p) i \<longleftrightarrow> v \<in> the (V' p) i"
   shows "relevant_events \<phi> S - {e. fst e \<in> dom V} \<subseteq> E \<Longrightarrow>
     sat \<sigma> V v i \<phi> \<longleftrightarrow> sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' v i \<phi>"
   using assms
 proof (induction \<phi> arbitrary: V V' v S i)
   case (Pred r ts)
   show ?case proof (cases "V r")
     case None
     then have "V' r = None" using \<open>dom V = dom V'\<close> by auto
     with None Pred(1,2) show ?thesis by (auto simp: domIff dest!: subsetD)
   next
     case (Some a)
     moreover obtain a' where "V' r = Some a'" using Some \<open>dom V = dom V'\<close> by auto
     moreover have "(map (eval_trm v) ts \<in> the (V r) i) = (map (eval_trm v) ts \<in> the (V' r) i)"
       using Some Pred(2,4) by (fastforce intro: domI)
     ultimately show ?thesis by simp
   qed
 next
   case (Let p \<phi> \<psi>)
   from Let.prems show ?case unfolding sat.simps
   proof (intro Let(2)[of S], goal_cases relevant v dom V)
     case (V p' v' i)
     then show ?case
     proof (cases "p' = p")
       case [simp]: True
       with V show ?thesis
         unfolding fun_upd_apply eqTrueI[OF True] if_True option.sel mem_Collect_eq
       proof (intro ex_cong conj_cong refl Let(1)[where
         S="{v'. (\<exists>v \<in> S. matches v \<psi> (p, v'))}" and V=V],
         goal_cases relevant' v' dom' V')
-        case (relevant')
+        case relevant'
         then show ?case
           by (elim subset_trans[rotated]) (auto simp: set_eq_iff)
       next
         case (V' p' v' i)
         then show ?case
           by (intro V(4)) (auto simp: set_eq_iff)
       qed auto
     next
       case False
       with V(2,3,5,6) show ?thesis
         unfolding fun_upd_apply eq_False[THEN iffD2, OF False] if_False
         by (intro V(4)) (auto simp: False)
     qed
   qed (auto simp: dom_def)
 next
   case (Or \<phi> \<psi>)
   show ?case using Or.IH[of S V v V'] Or.prems
     by (auto simp: Collect_disj_eq Int_Un_distrib subset_iff)
 next
   case (And \<phi> \<psi>)
   show ?case using And.IH[of S V v V'] And.prems
     by (auto simp: Collect_disj_eq Int_Un_distrib subset_iff)
 next
   case (Ands l)
   obtain "relevant_events (Ands l) S - {e. fst e \<in> dom V} \<subseteq> E" "v \<in> S" using Ands.prems(1) Ands.prems(2) by blast
   then have "{e. S \<inter> {v. matches v (Ands l) e} \<noteq> {}} - {e. fst e \<in> dom V} \<subseteq> E" by simp
   have "\<And>\<phi>. \<phi> \<in> set l \<Longrightarrow> sat \<sigma> V v i \<phi> \<longleftrightarrow> sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' v i \<phi>"
   proof -
     fix \<phi> assume "\<phi> \<in> set l"
     have "relevant_events \<phi> S = {e. S \<inter> {v. matches v \<phi> e} \<noteq> {}}" by simp
     have "{e. S \<inter> {v. matches v \<phi> e} \<noteq> {}} \<subseteq> {e. S \<inter> {v. matches v (Ands l) e} \<noteq> {}}" (is "?A \<subseteq> ?B")
     proof (rule subsetI)
       fix e assume "e \<in> ?A"
       then have "S \<inter> {v. matches v \<phi> e} \<noteq> {}" by blast
       moreover have "S \<inter> {v. matches v (Ands l) e} \<noteq> {}"
       proof -
         obtain v where "v \<in> S" "matches v \<phi> e" using calculation by blast
         then show ?thesis using \<open>\<phi> \<in> set l\<close> by auto
       qed
       then show "e \<in> ?B" by blast
     qed
     then have "relevant_events \<phi> S - {e. fst e \<in> dom V} \<subseteq> E" using Ands.prems(1) by auto
     then show "sat \<sigma> V v i \<phi> \<longleftrightarrow> sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' v i \<phi>"
       using Ands.prems(2,3) \<open>\<phi> \<in> set l\<close>
       by (intro Ands.IH[of \<phi> S V v V' i] Ands.prems(4)) auto
   qed
   show ?case using \<open>\<And>\<phi>. \<phi> \<in> set l \<Longrightarrow> sat \<sigma> V v i \<phi> = sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' v i \<phi>\<close> sat_Ands by blast
 next
   case (Exists \<phi>)
   have "sat \<sigma> V (z # v) i \<phi> = sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' (z # v) i \<phi>" for z
     using Exists.prems(1-3) by (intro Exists.IH[where S="{z # v | v. v \<in> S}"] Exists.prems(4)) auto
   then show ?case by simp
 next
   case (Agg y \<omega> b f \<phi>)
   have "sat \<sigma> V (zs @ v) i \<phi> = sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' (zs @ v) i \<phi>" if "length zs = b" for zs
     using that Agg.prems(1-3) by (intro Agg.IH[where S="{zs @ v | v. v \<in> S}"] Agg.prems(4)) auto
   then show ?case by (simp cong: conj_cong)
 next
   case (Prev I \<phi>)
   then show ?case by (auto cong: nat.case_cong)
 next
   case (Next I \<phi>)
   then show ?case by simp
 next
   case (Since \<phi> I \<psi>)
   show ?case using Since.IH[of S V] Since.prems
    by (auto simp: Collect_disj_eq Int_Un_distrib subset_iff)
 next
   case (Until \<phi> I \<psi>)
   show ?case using Until.IH[of S V] Until.prems
     by (auto simp: Collect_disj_eq Int_Un_distrib subset_iff)
 next
   case (MatchP I r)
   from MatchP.prems(1-3) have "Regex.match (sat \<sigma> V v) r = Regex.match (sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' v) r"
     by (intro Regex.match_fv_cong MatchP(1)[of _ S V v] MatchP.prems(4)) auto
   then show ?case
     by auto
 next
   case (MatchF I r)
   from MatchF.prems(1-3) have "Regex.match (sat \<sigma> V v) r = Regex.match (sat (map_\<Gamma> (\<lambda>D. D \<inter> E) \<sigma>) V' v) r"
     by (intro Regex.match_fv_cong MatchF(1)[of _ S V v] MatchF.prems(4)) auto
   then show ?case
     by auto
 qed simp_all
 
-lemma sat_slice_iff:
-  assumes "v \<in> S"
-  shows "sat \<sigma> V v i \<phi> \<longleftrightarrow> sat (slice \<phi> S \<sigma>) V v i \<phi>"
-  unfolding slice_def
-  by (rule sat_slice_strong[OF assms]) auto
-
-qualified lift_definition pslice :: "formula \<Rightarrow> env set \<Rightarrow> prefix \<Rightarrow> prefix" is
-  "\<lambda>\<phi> S \<pi>. map (\<lambda>(D, t). (D \<inter> relevant_events \<phi> S, t)) \<pi>"
-  by (auto simp: o_def split_beta)
-
-lemma prefix_of_pslice_slice: "prefix_of \<pi> \<sigma> \<Longrightarrow> prefix_of (pslice \<phi> R \<pi>) (slice \<phi> R \<sigma>)"
-  unfolding slice_def
-  by transfer simp
-
-lemma plen_pslice[simp]: "plen (pslice \<phi> R \<pi>) = plen \<pi>"
-  by transfer simp
-
-lemma pslice_pnil[simp]: "pslice \<phi> R pnil = pnil"
-  by transfer simp
-
-lemma last_ts_pslice[simp]: "last_ts (pslice \<phi> R \<pi>) = last_ts \<pi>"
-  by transfer (simp add: last_map case_prod_beta split: list.split)
-
-lemma prefix_of_replace_prefix:
-  "prefix_of (pslice \<phi> R \<pi>) \<sigma> \<Longrightarrow> prefix_of \<pi> (replace_prefix \<pi> \<sigma>)"
-proof (transfer; safe; goal_cases)
-  case (1 \<phi> R \<pi> \<sigma>)
-  then show ?case
-    by (subst (asm) (2) stake_sdrop[symmetric, of _ "length \<pi>"])
-      (auto 0 3 simp: ssorted_shift split_beta o_def stake_shift sdrop_smap[symmetric]
-        ssorted_sdrop not_le pslice_def simp del: sdrop_smap)
-qed
-
-lemma slice_replace_prefix:
-  "prefix_of (pslice \<phi> R \<pi>) \<sigma> \<Longrightarrow> slice \<phi> R (replace_prefix \<pi> \<sigma>) = slice \<phi> R \<sigma>"
-unfolding slice_def proof (transfer; safe; goal_cases)
-  case (1 \<phi> R \<pi> \<sigma>)
-  then show ?case
-    by (subst (asm) (2) stake_sdrop[symmetric, of \<sigma> "length \<pi>"],
-        subst (3) stake_sdrop[symmetric, of \<sigma> "length \<pi>"])
-      (auto simp: ssorted_shift split_beta o_def stake_shift sdrop_smap[symmetric] ssorted_sdrop
-        not_le pslice_def simp del: sdrop_smap cong: map_cong)
-qed
-
-lemma prefix_of_psliceD:
-  assumes "prefix_of (pslice \<phi> R \<pi>) \<sigma>"
-  shows "\<exists>\<sigma>'. prefix_of \<pi> \<sigma>' \<and> prefix_of (pslice \<phi> R \<pi>) (slice \<phi> R \<sigma>')"
-proof -
-  from assms(1) obtain \<sigma>' where 1: "prefix_of \<pi> \<sigma>'"
-    using ex_prefix_of by blast
-  then have "prefix_of (pslice \<phi> R \<pi>) (slice \<phi> R \<sigma>')"
-    unfolding slice_def
-    by transfer simp
-  with 1 show ?thesis by blast
-qed
-
-lemma prefix_of_sliceD:
-  assumes "prefix_of \<pi>' (slice \<phi> R \<sigma>)"
-  shows "\<exists>\<pi>''. \<pi>' = pslice \<phi> R \<pi>'' \<and> prefix_of \<pi>'' \<sigma>"
-  using assms unfolding slice_def
-  by transfer (auto intro!: exI[of _ "stake (length _) _"] elim: sym dest: sorted_stake)
-
 
 subsection \<open>Translation to n-ary conjunction\<close>
 
 fun get_and_list :: "formula \<Rightarrow> formula list" where
   "get_and_list (Ands l) = l"
 | "get_and_list \<phi> = [\<phi>]"
 
 lemma fv_get_and: "(\<Union>x\<in>(set (get_and_list \<phi>)). fvi b x) = fvi b \<phi>"
   by (induction \<phi> rule: get_and_list.induct) simp_all
 
 lemma safe_get_and: "safe_formula \<phi> \<Longrightarrow> list_all safe_neg (get_and_list \<phi>)"
   by (induction \<phi> rule: get_and_list.induct) (simp_all add: safe_neg_def list_all_iff)
 
 lemma sat_get_and: "sat \<sigma> V v i \<phi> \<longleftrightarrow> list_all (sat \<sigma> V v i) (get_and_list \<phi>)"
   by (induction \<phi> rule: get_and_list.induct) (simp_all add: list_all_iff)
 
 fun convert_multiway :: "formula \<Rightarrow> formula" where
   "convert_multiway (Neg \<phi>) = Neg (convert_multiway \<phi>)"
 | "convert_multiway (Or \<phi> \<psi>) = Or (convert_multiway \<phi>) (convert_multiway \<psi>)"
 | "convert_multiway (And \<phi> \<psi>) = (if safe_assignment (fv \<phi>) \<psi> then
       And (convert_multiway \<phi>) \<psi>
     else if safe_formula \<psi> then
       Ands (get_and_list (convert_multiway \<phi>) @ get_and_list (convert_multiway \<psi>))
     else if is_constraint \<psi> then
       And (convert_multiway \<phi>) \<psi>
     else Ands (convert_multiway \<psi> # get_and_list (convert_multiway \<phi>)))"
 | "convert_multiway (Exists \<phi>) = Exists (convert_multiway \<phi>)"
 | "convert_multiway (Agg y \<omega> b f \<phi>) = Agg y \<omega> b f (convert_multiway \<phi>)"
 | "convert_multiway (Prev I \<phi>) = Prev I (convert_multiway \<phi>)"
 | "convert_multiway (Next I \<phi>) = Next I (convert_multiway \<phi>)"
 | "convert_multiway (Since \<phi> I \<psi>) = Since (convert_multiway \<phi>) I (convert_multiway \<psi>)"
 | "convert_multiway (Until \<phi> I \<psi>) = Until (convert_multiway \<phi>) I (convert_multiway \<psi>)"
 | "convert_multiway (MatchP I r) = MatchP I (Regex.map_regex convert_multiway r)"
 | "convert_multiway (MatchF I r) = MatchF I (Regex.map_regex convert_multiway r)"
 | "convert_multiway \<phi> = \<phi>"
 
 abbreviation "convert_multiway_regex \<equiv> Regex.map_regex convert_multiway"
 
 lemma fv_safe_get_and:
   "safe_formula \<phi> \<Longrightarrow> fv \<phi> \<subseteq> (\<Union>x\<in>(set (filter safe_formula (get_and_list \<phi>))). fv x)"
 proof (induction \<phi> rule: get_and_list.induct)
   case (1 l)
   obtain pos neg where posneg: "(pos, neg) = partition safe_formula l" by simp
   have "get_and_list (Ands l) = l" by simp
   have sub: "(\<Union>x\<in>set neg. fv x) \<subseteq> (\<Union>x\<in>set pos. fv x)" using "1.prems" posneg by simp
   then have "fv (Ands l) \<subseteq> (\<Union>x\<in>set pos. fv x)"
   proof -
     have "fv (Ands l) = (\<Union>x\<in>set pos. fv x) \<union> (\<Union>x\<in>set neg. fv x)" using posneg by auto
     then show ?thesis using sub by simp
   qed
   then show ?case using posneg by auto
 qed auto
 
 lemma ex_safe_get_and:
   "safe_formula \<phi> \<Longrightarrow> list_ex safe_formula (get_and_list \<phi>)"
 proof (induction \<phi> rule: get_and_list.induct)
   case (1 l)
   have "get_and_list (Ands l) = l" by simp
   obtain pos neg where posneg: "(pos, neg) = partition safe_formula l" by simp
   then have "pos \<noteq> []" using "1.prems" by simp
   then obtain x where "x \<in> set pos" by fastforce
   then show ?case using posneg using Bex_set_list_ex by fastforce
 qed simp_all
 
 lemma case_NegE: "(case \<phi> of Neg \<phi>' \<Rightarrow> P \<phi>' | _ \<Rightarrow> False) \<Longrightarrow> (\<And>\<phi>'. \<phi> = Neg \<phi>' \<Longrightarrow> P \<phi>' \<Longrightarrow> Q) \<Longrightarrow> Q"
   by (cases \<phi>) simp_all
 
 lemma convert_multiway_remove_neg: "safe_formula (remove_neg \<phi>) \<Longrightarrow> convert_multiway (remove_neg \<phi>) = remove_neg (convert_multiway \<phi>)"
   by (cases \<phi>) (auto elim: case_NegE)
 
 lemma fv_convert_multiway: "safe_formula \<phi> \<Longrightarrow> fvi b (convert_multiway \<phi>) = fvi b \<phi>"
 proof (induction \<phi> arbitrary: b rule: safe_formula.induct)
   case (9 \<phi> \<psi>)
   then show ?case by (cases \<psi>) (auto simp: fv_get_and Un_commute)
 next
   case (15 \<phi> I \<psi>)
   show ?case proof (cases "safe_formula \<phi>")
     case True
     with 15 show ?thesis by simp
   next
     case False
     with "15.prems" obtain \<phi>' where "\<phi> = Neg \<phi>'" by (simp split: formula.splits)
     with False 15 show ?thesis by simp
   qed
 next
   case (16 \<phi> I \<psi>)
   show ?case proof (cases "safe_formula \<phi>")
     case True
     with 16 show ?thesis by simp
   next
     case False
     with "16.prems" obtain \<phi>' where "\<phi> = Neg \<phi>'" by (simp split: formula.splits)
     with False 16 show ?thesis by simp
   qed
 next
   case (17 I r)
   then show ?case
     unfolding convert_multiway.simps fvi.simps fv_regex_alt regex.set_map image_image
     by (intro arg_cong[where f=Union, OF image_cong[OF refl]])
       (auto dest!: safe_regex_safe_formula)
 next
   case (18 I r)
   then show ?case
     unfolding convert_multiway.simps fvi.simps fv_regex_alt regex.set_map image_image
     by (intro arg_cong[where f=Union, OF image_cong[OF refl]])
       (auto dest!: safe_regex_safe_formula)
 qed (auto simp del: convert_multiway.simps(3))
 
 lemma get_and_nonempty:
   assumes "safe_formula \<phi>"
   shows "get_and_list \<phi> \<noteq> []"
   using assms by (induction \<phi>) auto
 
 lemma future_bounded_get_and:
   "list_all future_bounded (get_and_list \<phi>) = future_bounded \<phi>"
   by (induction \<phi>) simp_all
 
 lemma safe_convert_multiway: "safe_formula \<phi> \<Longrightarrow> safe_formula (convert_multiway \<phi>)"
 proof (induction \<phi> rule: safe_formula_induct)
   case (And_safe \<phi> \<psi>)
   let ?a = "And \<phi> \<psi>"
   let ?b = "convert_multiway ?a"
   let ?c\<phi> = "convert_multiway \<phi>"
   let ?c\<psi> = "convert_multiway \<psi>"
   have b_def: "?b = Ands (get_and_list ?c\<phi> @ get_and_list ?c\<psi>)"
     using And_safe by simp
   show ?case proof -
     let ?l = "get_and_list ?c\<phi> @ get_and_list ?c\<psi>"
     obtain pos neg where posneg: "(pos, neg) = partition safe_formula ?l" by simp
     then have "list_all safe_formula pos" by (auto simp: list_all_iff)
     have lsafe_neg: "list_all safe_neg ?l"
       using And_safe \<open>safe_formula \<phi>\<close> \<open>safe_formula \<psi>\<close>
       by (simp add: safe_get_and)
     then have "list_all safe_formula (map remove_neg neg)"
     proof -
       have "\<And>x. x \<in> set neg \<Longrightarrow> safe_formula (remove_neg x)"
       proof -
         fix x assume "x \<in> set neg"
         then have "\<not> safe_formula x" using posneg by auto
         moreover have "safe_neg x" using lsafe_neg \<open>x \<in> set neg\<close>
           unfolding safe_neg_def list_all_iff partition_set[OF posneg[symmetric], symmetric]
           by simp
         ultimately show "safe_formula (remove_neg x)" using safe_neg_def by blast
       qed
       then show ?thesis by (auto simp: list_all_iff)
     qed
 
     have pos_filter: "pos = filter safe_formula (get_and_list ?c\<phi> @ get_and_list ?c\<psi>)"
       using posneg by simp
     have "(\<Union>x\<in>set neg. fv x) \<subseteq> (\<Union>x\<in>set pos. fv x)"
     proof -
       have 1: "fv ?c\<phi> \<subseteq> (\<Union>x\<in>(set (filter safe_formula (get_and_list ?c\<phi>))). fv x)" (is "_ \<subseteq> ?fv\<phi>")
         using And_safe \<open>safe_formula \<phi>\<close> by (blast intro!: fv_safe_get_and)
       have 2: "fv ?c\<psi> \<subseteq> (\<Union>x\<in>(set (filter safe_formula (get_and_list ?c\<psi>))). fv x)" (is "_ \<subseteq> ?fv\<psi>")
         using And_safe \<open>safe_formula \<psi>\<close> by (blast intro!: fv_safe_get_and)
       have "(\<Union>x\<in>set neg. fv x) \<subseteq> fv ?c\<phi> \<union> fv ?c\<psi>" proof -
         have "\<Union> (fv ` set neg) \<subseteq> \<Union> (fv ` (set pos \<union> set neg))"
           by simp
         also have "... \<subseteq> fv (convert_multiway \<phi>) \<union> fv (convert_multiway \<psi>)"
           unfolding partition_set[OF posneg[symmetric], simplified]
           by (simp add: fv_get_and)
         finally show ?thesis .
       qed
       then have "(\<Union>x\<in>set neg. fv x) \<subseteq> ?fv\<phi> \<union> ?fv\<psi>" using 1 2 by blast
       then show ?thesis unfolding pos_filter by simp
     qed
     have "pos \<noteq> []"
     proof -
       obtain x where "x \<in> set (get_and_list ?c\<phi>)" "safe_formula x"
         using And_safe \<open>safe_formula \<phi>\<close> ex_safe_get_and by (auto simp: list_ex_iff)
       then show ?thesis
         unfolding pos_filter by (auto simp: filter_empty_conv)
     qed
     then show ?thesis unfolding b_def
       using \<open>\<Union> (fv ` set neg) \<subseteq> \<Union> (fv ` set pos)\<close> \<open>list_all safe_formula (map remove_neg neg)\<close>
         \<open>list_all safe_formula pos\<close> posneg
       by simp
   qed
 next
   case (And_Not \<phi> \<psi>)
   let ?a = "And \<phi> (Neg \<psi>)"
   let ?b = "convert_multiway ?a"
   let ?c\<phi> = "convert_multiway \<phi>"
   let ?c\<psi> = "convert_multiway \<psi>"
   have b_def: "?b = Ands (Neg ?c\<psi> # get_and_list ?c\<phi>)"
     using And_Not by simp
   show ?case proof -
     let ?l = "Neg ?c\<psi> # get_and_list ?c\<phi>"
     note \<open>safe_formula ?c\<phi>\<close>
     then have "list_all safe_neg (get_and_list ?c\<phi>)" by (simp add: safe_get_and)
     moreover have "safe_neg (Neg ?c\<psi>)"
       using \<open>safe_formula ?c\<psi>\<close> by (simp add: safe_neg_def)
     then have lsafe_neg: "list_all safe_neg ?l" using calculation by simp
     obtain pos neg where posneg: "(pos, neg) = partition safe_formula ?l" by simp
     then have "list_all safe_formula pos" by (auto simp: list_all_iff)
     then have "list_all safe_formula (map remove_neg neg)"
     proof -
       have "\<And>x. x \<in> (set neg) \<Longrightarrow> safe_formula (remove_neg x)"
       proof -
         fix x assume "x \<in> set neg"
         then have "\<not> safe_formula x" using posneg by (auto simp del: filter.simps)
         moreover have "safe_neg x" using lsafe_neg \<open>x \<in> set neg\<close>
           unfolding safe_neg_def list_all_iff partition_set[OF posneg[symmetric], symmetric]
           by simp
         ultimately show "safe_formula (remove_neg x)" using safe_neg_def by blast
       qed
       then show ?thesis using Ball_set_list_all by force
     qed
 
     have pos_filter: "pos = filter safe_formula ?l"
       using posneg by simp
     have neg_filter: "neg = filter (Not \<circ> safe_formula) ?l"
       using posneg by simp
     have "(\<Union>x\<in>(set neg). fv x) \<subseteq> (\<Union>x\<in>(set pos). fv x)"
     proof -
       have fv_neg: "(\<Union>x\<in>(set neg). fv x) \<subseteq> (\<Union>x\<in>(set ?l). fv x)" using posneg by auto
       have "(\<Union>x\<in>(set ?l). fv x) \<subseteq> fv ?c\<phi> \<union> fv ?c\<psi>"
         using \<open>safe_formula \<phi>\<close> \<open>safe_formula \<psi>\<close>
         by (simp add: fv_get_and fv_convert_multiway)
       also have "fv ?c\<phi> \<union> fv ?c\<psi> \<subseteq> fv ?c\<phi>"
         using \<open>safe_formula \<phi>\<close> \<open>safe_formula \<psi>\<close> \<open>fv (Neg \<psi>) \<subseteq> fv \<phi>\<close>
         by (simp add: fv_convert_multiway[symmetric])
       finally have "(\<Union>x\<in>(set neg). fv x) \<subseteq> fv ?c\<phi>"
         using fv_neg unfolding neg_filter by blast
       then show ?thesis
         unfolding pos_filter
         using fv_safe_get_and[OF And_Not.IH(1)]
         by auto
     qed
     have "pos \<noteq> []"
     proof -
       obtain x where "x \<in> set (get_and_list ?c\<phi>)" "safe_formula x"
         using And_Not.IH \<open>safe_formula \<phi>\<close> ex_safe_get_and by (auto simp: list_ex_iff)
       then show ?thesis
         unfolding pos_filter by (auto simp: filter_empty_conv)
     qed
     then show ?thesis unfolding b_def
       using \<open>\<Union> (fv ` set neg) \<subseteq> \<Union> (fv ` set pos)\<close> \<open>list_all safe_formula (map remove_neg neg)\<close>
         \<open>list_all safe_formula pos\<close> posneg
       by simp
   qed
 next
   case (Neg \<phi>)
   have "safe_formula (Neg \<phi>') \<longleftrightarrow> safe_formula \<phi>'" if "fv \<phi>' = {}" for \<phi>'
     using that by (cases "Neg \<phi>'" rule: safe_formula.cases) simp_all
   with Neg show ?case by (simp add: fv_convert_multiway)
 next
   case (MatchP I r)
   then show ?case
     by (auto 0 3 simp: atms_def fv_convert_multiway intro!: safe_regex_map_regex
       elim!: disjE_Not2 case_NegE
       dest: safe_regex_safe_formula split: if_splits)
 next
   case (MatchF I r)
   then show ?case
     by (auto 0 3 simp: atms_def fv_convert_multiway intro!: safe_regex_map_regex
       elim!: disjE_Not2 case_NegE
       dest: safe_regex_safe_formula split: if_splits)
 qed (auto simp: fv_convert_multiway)
 
 lemma future_bounded_convert_multiway: "safe_formula \<phi> \<Longrightarrow> future_bounded (convert_multiway \<phi>) = future_bounded \<phi>"
 proof (induction \<phi> rule: safe_formula_induct)
   case (And_safe \<phi> \<psi>)
   let ?a = "And \<phi> \<psi>"
   let ?b = "convert_multiway ?a"
   let ?c\<phi> = "convert_multiway \<phi>"
   let ?c\<psi> = "convert_multiway \<psi>"
   have b_def: "?b = Ands (get_and_list ?c\<phi> @ get_and_list ?c\<psi>)"
     using And_safe by simp
   have "future_bounded ?a = (future_bounded ?c\<phi> \<and> future_bounded ?c\<psi>)"
     using And_safe by simp
   moreover have "future_bounded ?c\<phi> = list_all future_bounded (get_and_list ?c\<phi>)"
     using \<open>safe_formula \<phi>\<close> by (simp add: future_bounded_get_and safe_convert_multiway)
   moreover have "future_bounded ?c\<psi> = list_all future_bounded (get_and_list ?c\<psi>)"
     using \<open>safe_formula \<psi>\<close> by (simp add: future_bounded_get_and safe_convert_multiway)
   moreover have "future_bounded ?b = list_all future_bounded (get_and_list ?c\<phi> @ get_and_list ?c\<psi>)"
     unfolding b_def by simp
   ultimately show ?case by simp
 next
   case (And_Not \<phi> \<psi>)
   let ?a = "And \<phi> (Neg \<psi>)"
   let ?b = "convert_multiway ?a"
   let ?c\<phi> = "convert_multiway \<phi>"
   let ?c\<psi> = "convert_multiway \<psi>"
   have b_def: "?b = Ands (Neg ?c\<psi> # get_and_list ?c\<phi>)"
     using And_Not by simp
   have "future_bounded ?a = (future_bounded ?c\<phi> \<and> future_bounded ?c\<psi>)"
     using And_Not by simp
   moreover have "future_bounded ?c\<phi> = list_all future_bounded (get_and_list ?c\<phi>)"
     using \<open>safe_formula \<phi>\<close> by (simp add: future_bounded_get_and safe_convert_multiway)
   moreover have "future_bounded ?b = list_all future_bounded (Neg ?c\<psi> # get_and_list ?c\<phi>)"
     unfolding b_def by (simp add: list.pred_map o_def)
   ultimately show ?case by auto
 next
   case (MatchP I r)
   then show ?case
     by (fastforce simp: atms_def regex.pred_set regex.set_map ball_Un
         elim: safe_regex_safe_formula[THEN disjE_Not2])
 next
   case (MatchF I r)
   then show ?case
     by (fastforce simp: atms_def regex.pred_set regex.set_map ball_Un
         elim: safe_regex_safe_formula[THEN disjE_Not2])
 qed auto
 
 lemma sat_convert_multiway: "safe_formula \<phi> \<Longrightarrow> sat \<sigma> V v i (convert_multiway \<phi>) \<longleftrightarrow> sat \<sigma> V v i \<phi>"
 proof (induction \<phi> arbitrary: v i rule: safe_formula_induct)
   case (And_safe \<phi> \<psi>)
   let ?a = "And \<phi> \<psi>"
   let ?b = "convert_multiway ?a"
   let ?la = "get_and_list (convert_multiway \<phi>)"
   let ?lb = "get_and_list (convert_multiway \<psi>)"
   let ?sat = "sat \<sigma> V v i"
   have b_def: "?b = Ands (?la @ ?lb)" using And_safe by simp
   have "list_all ?sat ?la \<longleftrightarrow> ?sat \<phi>" using And_safe sat_get_and by blast
   moreover have "list_all ?sat ?lb \<longleftrightarrow> ?sat \<psi>" using And_safe sat_get_and by blast
   ultimately show ?case using And_safe by (auto simp: list.pred_set)
 next
   case (And_Not \<phi> \<psi>)
   let ?a = "And \<phi> (Neg \<psi>)"
   let ?b = "convert_multiway ?a"
   let ?la = "get_and_list (convert_multiway \<phi>)"
   let ?lb = "convert_multiway \<psi>"
   let ?sat = "sat \<sigma> V v i"
   have b_def: "?b = Ands (Neg ?lb # ?la)" using And_Not by simp
   have "list_all ?sat ?la \<longleftrightarrow> ?sat \<phi>" using And_Not sat_get_and by blast
   then show ?case using And_Not by (auto simp: list.pred_set)
 next
   case (Agg y \<omega> b f \<phi>)
   then show ?case
     by (simp add: nfv_def fv_convert_multiway cong: conj_cong)
 next
   case (MatchP I r)
   then have "Regex.match (sat \<sigma> V v) (convert_multiway_regex r) = Regex.match (sat \<sigma> V v) r"
     unfolding match_map_regex
     by (intro Regex.match_fv_cong)
       (auto 0 4 simp: atms_def elim!: disjE_Not2 dest!: safe_regex_safe_formula)
   then show ?case
     by auto
 next
   case (MatchF I r)
   then have "Regex.match (sat \<sigma> V v) (convert_multiway_regex r) = Regex.match (sat \<sigma> V v) r"
     unfolding match_map_regex
     by (intro Regex.match_fv_cong)
       (auto 0 4 simp: atms_def elim!: disjE_Not2 dest!: safe_regex_safe_formula)
   then show ?case
     by auto
 qed (auto cong: nat.case_cong)
 
 end (*context*)
 
+interpretation Formula_slicer: abstract_slicer "relevant_events \<phi>" for \<phi> .
+
+lemma sat_slice_iff:
+  assumes "v \<in> S"
+  shows "Formula.sat \<sigma> V v i \<phi> \<longleftrightarrow> Formula.sat (Formula_slicer.slice \<phi> S \<sigma>) V v i \<phi>"
+  by (rule sat_slice_strong[OF assms]) auto
+
 lemma Neg_splits:
   "P (case \<phi> of formula.Neg \<psi> \<Rightarrow> f \<psi> | \<phi> \<Rightarrow> g \<phi>) =
    ((\<forall>\<psi>. \<phi> = formula.Neg \<psi> \<longrightarrow> P (f \<psi>)) \<and> ((\<not> Formula.is_Neg \<phi>) \<longrightarrow> P (g \<phi>)))"
   "P (case \<phi> of formula.Neg \<psi> \<Rightarrow> f \<psi> | _ \<Rightarrow> g \<phi>) =
    (\<not> ((\<exists>\<psi>. \<phi> = formula.Neg \<psi> \<and> \<not> P (f \<psi>)) \<or> ((\<not> Formula.is_Neg \<phi>) \<and> \<not> P (g \<phi>))))"
   by (cases \<phi>; auto simp: Formula.is_Neg_def)+
 
 (*<*)
 end
 (*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Interval.thy b/thys/MFODL_Monitor_Optimized/Interval.thy
deleted file mode 100644
--- a/thys/MFODL_Monitor_Optimized/Interval.thy
+++ /dev/null
@@ -1,79 +0,0 @@
-(*<*)
-theory Interval
-  imports "HOL-Library.Extended_Nat" "HOL-Library.Product_Lexorder"
-begin
-(*>*)
-
-section \<open>Intervals\<close>
-
-typedef \<I> = "{(i :: nat, j :: enat). i \<le> j}"
-  by (intro exI[of _ "(0, \<infinity>)"]) auto
-
-setup_lifting type_definition_\<I>
-
-instantiation \<I> :: equal begin
-lift_definition equal_\<I> :: "\<I> \<Rightarrow> \<I> \<Rightarrow> bool" is "(=)" .
-instance by standard (transfer, auto)
-end
-
-instantiation \<I> :: linorder begin
-lift_definition less_eq_\<I> :: "\<I> \<Rightarrow> \<I> \<Rightarrow> bool" is "(\<le>)" .
-lift_definition less_\<I> :: "\<I> \<Rightarrow> \<I> \<Rightarrow> bool" is "(<)" .
-instance by standard (transfer, auto)+
-end
-
-
-lift_definition all :: \<I> is "(0, \<infinity>)" by simp
-lift_definition left :: "\<I> \<Rightarrow> nat" is fst .
-lift_definition right :: "\<I> \<Rightarrow> enat" is snd .
-lift_definition point :: "nat \<Rightarrow> \<I>" is "\<lambda>n. (n, enat n)" by simp
-lift_definition init :: "nat \<Rightarrow> \<I>" is "\<lambda>n. (0, enat n)" by auto
-abbreviation mem where "mem n I \<equiv> (left I \<le> n \<and> n \<le> right I)"
-lift_definition subtract :: "nat \<Rightarrow> \<I> \<Rightarrow> \<I>" is
-  "\<lambda>n (i, j). (i - n, j - enat n)" by (auto simp: diff_enat_def split: enat.splits)
-lift_definition add :: "nat \<Rightarrow> \<I> \<Rightarrow> \<I>" is
-  "\<lambda>n (a, b). (a, b + enat n)" by (auto simp add: add_increasing2)
-
-lemma left_right: "left I \<le> right I"
-  by transfer auto
-
-lemma point_simps[simp]:
-  "left (point n) = n"
-  "right (point n) = n"
-  by (transfer; auto)+
-
-lemma init_simps[simp]:
-  "left (init n) = 0"
-  "right (init n) = n"
-  by (transfer; auto)+
-
-lemma subtract_simps[simp]:
-  "left (subtract n I) = left I - n"
-  "right (subtract n I) = right I - n"
-  "subtract 0 I = I"
-  "subtract x (point y) = point (y - x)"
-  by (transfer; auto)+
-
-definition shifted :: "\<I> \<Rightarrow> \<I> set" where
-  "shifted I = (\<lambda>n. subtract n I) ` {0 .. (case right I of \<infinity> \<Rightarrow> left I | enat n \<Rightarrow> n)}"
-
-lemma subtract_too_much: "i > (case right I of \<infinity> \<Rightarrow> left I | enat n \<Rightarrow> n) \<Longrightarrow>
-  subtract i I = subtract (case right I of \<infinity> \<Rightarrow> left I | enat n \<Rightarrow> n) I"
-  by transfer (auto split: enat.splits)
-
-lemma subtract_shifted: "subtract n I \<in> shifted I"
-  by (cases "n \<le> (case right I of \<infinity> \<Rightarrow> left I | enat n \<Rightarrow> n)")
-    (auto simp: shifted_def subtract_too_much)
-
-lemma finite_shifted: "finite (shifted I)"
-  unfolding shifted_def by auto
-
-definition interval :: "nat \<Rightarrow> enat \<Rightarrow> \<I>" where
-  "interval l r = (if l \<le> r then Abs_\<I> (l, r) else undefined)"
-
-lemma [code abstract]: "Rep_\<I> (interval l r) = (if l \<le> r then (l, r) else Rep_\<I> undefined)"
-  unfolding interval_def using Abs_\<I>_inverse by simp
-
-(*<*)
-end
-(*>*)
\ No newline at end of file
diff --git a/thys/MFODL_Monitor_Optimized/Monitor.thy b/thys/MFODL_Monitor_Optimized/Monitor.thy
--- a/thys/MFODL_Monitor_Optimized/Monitor.thy
+++ b/thys/MFODL_Monitor_Optimized/Monitor.thy
@@ -1,5526 +1,5600 @@
 (*<*)
 theory Monitor
-  imports Abstract_Monitor
+  imports
+    Formula
     Optimized_Join
+    "MFOTL_Monitor.Abstract_Monitor"
     "HOL-Library.While_Combinator"
     "HOL-Library.Mapping"
     "Deriving.Derive"
     "Generic_Join.Generic_Join_Correctness"
 begin
 (*>*)
 
 section \<open>Generic monitoring algorithm\<close>
 
 text \<open>The algorithm defined here abstracts over the implementation of the temporal operators.\<close>
 
 subsection \<open>Monitorable formulas\<close>
 
 definition "mmonitorable \<phi> \<longleftrightarrow> safe_formula \<phi> \<and> Formula.future_bounded \<phi>"
 definition "mmonitorable_regex b g r \<longleftrightarrow> safe_regex b g r \<and> Regex.pred_regex Formula.future_bounded r"
 
 definition is_simple_eq :: "Formula.trm \<Rightarrow> Formula.trm \<Rightarrow> bool" where
   "is_simple_eq t1 t2 = (Formula.is_Const t1 \<and> (Formula.is_Const t2 \<or> Formula.is_Var t2) \<or>
     Formula.is_Var t1 \<and> Formula.is_Const t2)"
 
 fun mmonitorable_exec :: "Formula.formula \<Rightarrow> bool" where
   "mmonitorable_exec (Formula.Eq t1 t2) = is_simple_eq t1 t2"
 | "mmonitorable_exec (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var y))) = (x = y)"
 | "mmonitorable_exec (Formula.Pred e ts) = list_all (\<lambda>t. Formula.is_Var t \<or> Formula.is_Const t) ts"
 | "mmonitorable_exec (Formula.Let p \<phi> \<psi>) = ({0..<Formula.nfv \<phi>} \<subseteq> Formula.fv \<phi> \<and> mmonitorable_exec \<phi> \<and> mmonitorable_exec \<psi>)"
 | "mmonitorable_exec (Formula.Neg \<phi>) = (fv \<phi> = {} \<and> mmonitorable_exec \<phi>)"
 | "mmonitorable_exec (Formula.Or \<phi> \<psi>) = (fv \<phi> = fv \<psi> \<and> mmonitorable_exec \<phi> \<and> mmonitorable_exec \<psi>)"
 | "mmonitorable_exec (Formula.And \<phi> \<psi>) = (mmonitorable_exec \<phi> \<and>
     (safe_assignment (fv \<phi>) \<psi> \<or> mmonitorable_exec \<psi> \<or>
       fv \<psi> \<subseteq> fv \<phi> \<and> (is_constraint \<psi> \<or> (case \<psi> of Formula.Neg \<psi>' \<Rightarrow> mmonitorable_exec \<psi>' | _ \<Rightarrow> False))))"
 | "mmonitorable_exec (Formula.Ands l) = (let (pos, neg) = partition mmonitorable_exec l in
     pos \<noteq> [] \<and> list_all mmonitorable_exec (map remove_neg neg) \<and>
     \<Union>(set (map fv neg)) \<subseteq> \<Union>(set (map fv pos)))"
 | "mmonitorable_exec (Formula.Exists \<phi>) = (mmonitorable_exec \<phi>)"
 | "mmonitorable_exec (Formula.Agg y \<omega> b f \<phi>) = (mmonitorable_exec \<phi> \<and>
     y + b \<notin> Formula.fv \<phi> \<and> {0..<b} \<subseteq> Formula.fv \<phi> \<and> Formula.fv_trm f \<subseteq> Formula.fv \<phi>)"
 | "mmonitorable_exec (Formula.Prev I \<phi>) = (mmonitorable_exec \<phi>)"
 | "mmonitorable_exec (Formula.Next I \<phi>) = (mmonitorable_exec \<phi>)"
 | "mmonitorable_exec (Formula.Since \<phi> I \<psi>) = (Formula.fv \<phi> \<subseteq> Formula.fv \<psi> \<and>
     (mmonitorable_exec \<phi> \<or> (case \<phi> of Formula.Neg \<phi>' \<Rightarrow> mmonitorable_exec \<phi>' | _ \<Rightarrow> False)) \<and> mmonitorable_exec \<psi>)"
 | "mmonitorable_exec (Formula.Until \<phi> I \<psi>) = (Formula.fv \<phi> \<subseteq> Formula.fv \<psi> \<and> right I \<noteq> \<infinity> \<and>
     (mmonitorable_exec \<phi> \<or> (case \<phi> of Formula.Neg \<phi>' \<Rightarrow> mmonitorable_exec \<phi>' | _ \<Rightarrow> False)) \<and> mmonitorable_exec \<psi>)"
 | "mmonitorable_exec (Formula.MatchP I r) = Regex.safe_regex Formula.fv (\<lambda>g \<phi>. mmonitorable_exec \<phi> \<or> (g = Lax \<and> (case \<phi> of Formula.Neg \<phi>' \<Rightarrow> mmonitorable_exec \<phi>' | _ \<Rightarrow> False))) Past Strict r"
 | "mmonitorable_exec (Formula.MatchF I r) = (Regex.safe_regex Formula.fv (\<lambda>g \<phi>. mmonitorable_exec \<phi> \<or> (g = Lax \<and> (case \<phi> of Formula.Neg \<phi>' \<Rightarrow> mmonitorable_exec \<phi>' | _ \<Rightarrow> False))) Futu Strict r \<and> right I \<noteq> \<infinity>)"
 | "mmonitorable_exec _ = False"
 
 lemma cases_Neg_iff:
   "(case \<phi> of formula.Neg \<psi> \<Rightarrow> P \<psi> | _ \<Rightarrow> False) \<longleftrightarrow> (\<exists>\<psi>. \<phi> = formula.Neg \<psi> \<and> P \<psi>)"
   by (cases \<phi>) auto
 
 lemma safe_formula_mmonitorable_exec: "safe_formula \<phi> \<Longrightarrow> Formula.future_bounded \<phi> \<Longrightarrow> mmonitorable_exec \<phi>"
 proof (induct \<phi> rule: safe_formula.induct)
   case (8 \<phi> \<psi>)
   then show ?case
     unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps
     by (auto simp: cases_Neg_iff)
 next
   case (9 \<phi> \<psi>)
   then show ?case
     unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps
     by (auto simp: cases_Neg_iff)
 next
   case (10 l)
   from "10.prems"(2) have bounded: "Formula.future_bounded \<phi>" if "\<phi> \<in> set l" for \<phi>
     using that by (auto simp: list.pred_set)
   obtain poss negs where posnegs: "(poss, negs) = partition safe_formula l" by simp
   obtain posm negm where posnegm: "(posm, negm) = partition mmonitorable_exec l" by simp
   have "set poss \<subseteq> set posm"
   proof (rule subsetI)
     fix x assume "x \<in> set poss"
     then have "x \<in> set l" "safe_formula x" using posnegs by simp_all
     then have "mmonitorable_exec x" using "10.hyps"(1) bounded by blast
     then show "x \<in> set posm" using \<open>x \<in> set poss\<close> posnegm posnegs by simp
   qed
   then have "set negm \<subseteq> set negs" using posnegm posnegs by auto
   obtain "poss \<noteq> []" "list_all safe_formula (map remove_neg negs)"
     "(\<Union>x\<in>set negs. fv x) \<subseteq> (\<Union>x\<in>set poss. fv x)"
     using "10.prems"(1) posnegs by simp
   then have "posm \<noteq> []" using \<open>set poss \<subseteq> set posm\<close> by auto
   moreover have "list_all mmonitorable_exec (map remove_neg negm)"
   proof -
     let ?l = "map remove_neg negm"
     have "\<And>x. x \<in> set ?l \<Longrightarrow> mmonitorable_exec x"
     proof -
       fix x assume "x \<in> set ?l"
       then obtain y where "y \<in> set negm" "x = remove_neg y" by auto
       then have "y \<in> set negs" using \<open>set negm \<subseteq> set negs\<close> by blast
       then have "safe_formula x"
         unfolding \<open>x = remove_neg y\<close> using \<open>list_all safe_formula (map remove_neg negs)\<close>
         by (simp add: list_all_def)
       show "mmonitorable_exec x"
       proof (cases "\<exists>z. y = Formula.Neg z")
         case True
         then obtain z where "y = Formula.Neg z" by blast
         then show ?thesis
           using "10.hyps"(2)[OF posnegs refl] \<open>x = remove_neg y\<close> \<open>y \<in> set negs\<close> posnegs bounded
             \<open>safe_formula x\<close> by fastforce
       next
         case False
         then have "remove_neg y = y" by (cases y) simp_all
         then have "y = x" unfolding \<open>x = remove_neg y\<close> by simp
         show ?thesis
           using "10.hyps"(1) \<open>y \<in> set negs\<close> posnegs \<open>safe_formula x\<close> unfolding \<open>y = x\<close>
           by auto
       qed
     qed
     then show ?thesis by (simp add: list_all_iff)
   qed
   moreover have "(\<Union>x\<in>set negm. fv x) \<subseteq> (\<Union>x\<in>set posm. fv x)"
     using \<open>\<Union> (fv ` set negs) \<subseteq> \<Union> (fv ` set poss)\<close> \<open>set poss \<subseteq> set posm\<close> \<open>set negm \<subseteq> set negs\<close>
     by fastforce
   ultimately show ?case using posnegm by simp
 next
   case (15 \<phi> I \<psi>)
   then show ?case
     unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps
     by (auto simp: cases_Neg_iff)
 next
   case (16 \<phi> I \<psi>)
   then show ?case
     unfolding safe_formula.simps future_bounded.simps mmonitorable_exec.simps
     by (auto simp: cases_Neg_iff)
 next
   case (17 I r)
   then show ?case
     by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)
 next
   case (18 I r)
   then show ?case
     by (auto elim!: safe_regex_mono[rotated] simp: cases_Neg_iff regex.pred_set)
 qed (auto simp add: is_simple_eq_def list.pred_set)
 
 lemma safe_assignment_future_bounded: "safe_assignment X \<phi> \<Longrightarrow> Formula.future_bounded \<phi>"
   unfolding safe_assignment_def by (auto split: formula.splits)
 
 lemma is_constraint_future_bounded: "is_constraint \<phi> \<Longrightarrow> Formula.future_bounded \<phi>"
   by (induction rule: is_constraint.induct) simp_all
 
 lemma mmonitorable_exec_mmonitorable: "mmonitorable_exec \<phi> \<Longrightarrow> mmonitorable \<phi>"
 proof (induct \<phi> rule: mmonitorable_exec.induct)
   case (7 \<phi> \<psi>)
   then show ?case
     unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps
     by (auto simp: cases_Neg_iff intro: safe_assignment_future_bounded is_constraint_future_bounded)
 next
   case (8 l)
   obtain poss negs where posnegs: "(poss, negs) = partition safe_formula l" by simp
   obtain posm negm where posnegm: "(posm, negm) = partition mmonitorable_exec l" by simp
   have pos_monitorable: "list_all mmonitorable_exec posm" using posnegm by (simp add: list_all_iff)
   have neg_monitorable: "list_all mmonitorable_exec (map remove_neg negm)"
     using "8.prems" posnegm by (simp add: list_all_iff)
   have "set posm \<subseteq> set poss"
     using "8.hyps"(1) posnegs posnegm unfolding mmonitorable_def by auto
   then have "set negs \<subseteq> set negm"
     using posnegs posnegm by auto
 
   have "poss \<noteq> []" using "8.prems" posnegm \<open>set posm \<subseteq> set poss\<close> by auto
   moreover have "list_all safe_formula (map remove_neg negs)"
     using neg_monitorable "8.hyps"(2)[OF posnegm refl] \<open>set negs \<subseteq> set negm\<close>
     unfolding mmonitorable_def by (auto simp: list_all_iff)
   moreover have "\<Union> (fv ` set negm) \<subseteq> \<Union> (fv ` set posm)"
     using "8.prems" posnegm by simp
   then have "\<Union> (fv ` set negs) \<subseteq> \<Union> (fv ` set poss)"
     using \<open>set posm \<subseteq> set poss\<close> \<open>set negs \<subseteq> set negm\<close> by fastforce
   ultimately have "safe_formula (Formula.Ands l)" using posnegs by simp
   moreover have "Formula.future_bounded (Formula.Ands l)"
   proof -
     have "list_all Formula.future_bounded posm"
       using pos_monitorable "8.hyps"(1) posnegm unfolding mmonitorable_def
       by (auto elim!: list.pred_mono_strong)
     moreover have fnegm: "list_all Formula.future_bounded (map remove_neg negm)"
       using neg_monitorable "8.hyps"(2) posnegm unfolding mmonitorable_def
       by (auto elim!: list.pred_mono_strong)
     then have "list_all Formula.future_bounded negm"
     proof -
       have "\<And>x. x \<in> set negm \<Longrightarrow> Formula.future_bounded x"
       proof -
         fix x assume "x \<in> set negm"
         have "Formula.future_bounded (remove_neg x)" using fnegm \<open>x \<in> set negm\<close> by (simp add: list_all_iff)
         then show "Formula.future_bounded x" by (cases x) auto
       qed
       then show ?thesis by (simp add: list_all_iff)
     qed
     ultimately have "list_all Formula.future_bounded l" using posnegm by (auto simp: list_all_iff)
     then show ?thesis by (auto simp: list_all_iff)
   qed
   ultimately show ?case unfolding mmonitorable_def ..
 next
   case (13 \<phi> I \<psi>)
   then show ?case
     unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps
     by (fastforce simp: cases_Neg_iff)
 next
   case (14 \<phi> I \<psi>)
   then show ?case
     unfolding mmonitorable_def mmonitorable_exec.simps safe_formula.simps
     by (fastforce simp: one_enat_def cases_Neg_iff)
 next
   case (15 I r)
   then show ?case
     by (auto elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]
         simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)
 next
   case (16 I r)
   then show ?case
     by (auto 0 3 elim!: safe_regex_mono[rotated] dest: safe_regex_safe[rotated]
         simp: mmonitorable_regex_def mmonitorable_def cases_Neg_iff regex.pred_set)
 qed (auto simp add: mmonitorable_def mmonitorable_regex_def is_simple_eq_def one_enat_def list.pred_set)
 
 lemma monitorable_formula_code[code]: "mmonitorable \<phi> = mmonitorable_exec \<phi>"
   using mmonitorable_exec_mmonitorable safe_formula_mmonitorable_exec mmonitorable_def
   by blast
 
 subsection \<open>Handling regular expressions\<close>
 
 datatype mregex =
   MSkip nat
   | MTestPos nat
   | MTestNeg nat
   | MPlus mregex mregex
   | MTimes mregex mregex
   | MStar mregex
 
 primrec ok where
   "ok _ (MSkip n) = True"
 | "ok m (MTestPos n) = (n < m)"
 | "ok m (MTestNeg n) = (n < m)"
 | "ok m (MPlus r s) = (ok m r \<and> ok m s)"
 | "ok m (MTimes r s) = (ok m r \<and> ok m s)"
 | "ok m (MStar r) = ok m r"
 
 primrec from_mregex where
   "from_mregex (MSkip n) _ = Regex.Skip n"
 | "from_mregex (MTestPos n) \<phi>s = Regex.Test (\<phi>s ! n)"
 | "from_mregex (MTestNeg n) \<phi>s = (if safe_formula (Formula.Neg (\<phi>s ! n))
     then Regex.Test (Formula.Neg (Formula.Neg (Formula.Neg (\<phi>s ! n))))
     else Regex.Test (Formula.Neg (\<phi>s ! n)))"
 | "from_mregex (MPlus r s) \<phi>s = Regex.Plus (from_mregex r \<phi>s) (from_mregex s \<phi>s)"
 | "from_mregex (MTimes r s) \<phi>s = Regex.Times (from_mregex r \<phi>s) (from_mregex s \<phi>s)"
 | "from_mregex (MStar r) \<phi>s = Regex.Star (from_mregex r \<phi>s)"
 
 primrec to_mregex_exec where
   "to_mregex_exec (Regex.Skip n) xs = (MSkip n, xs)"
 | "to_mregex_exec (Regex.Test \<phi>) xs = (if safe_formula \<phi> then (MTestPos (length xs), xs @ [\<phi>])
      else case \<phi> of Formula.Neg \<phi>' \<Rightarrow> (MTestNeg (length xs), xs @ [\<phi>']) | _ \<Rightarrow> (MSkip 0, xs))"
 | "to_mregex_exec (Regex.Plus r s) xs =
      (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys
      in (MPlus mr ms, zs))"
 | "to_mregex_exec (Regex.Times r s) xs =
      (let (mr, ys) = to_mregex_exec r xs; (ms, zs) = to_mregex_exec s ys
      in (MTimes mr ms, zs))"
 | "to_mregex_exec (Regex.Star r) xs =
      (let (mr, ys) = to_mregex_exec r xs in (MStar mr, ys))"
 
 primrec shift where
   "shift (MSkip n) k = MSkip n"
 | "shift (MTestPos i) k = MTestPos (i + k)"
 | "shift (MTestNeg i) k = MTestNeg (i + k)"
 | "shift (MPlus r s) k = MPlus (shift r k) (shift s k)"
 | "shift (MTimes r s) k = MTimes (shift r k) (shift s k)"
 | "shift (MStar r) k = MStar (shift r k)"
 
 primrec to_mregex where
   "to_mregex (Regex.Skip n) = (MSkip n, [])"
 | "to_mregex (Regex.Test \<phi>) = (if safe_formula \<phi> then (MTestPos 0, [\<phi>])
      else case \<phi> of Formula.Neg \<phi>' \<Rightarrow> (MTestNeg 0, [\<phi>']) | _ \<Rightarrow> (MSkip 0, []))"
 | "to_mregex (Regex.Plus r s) =
      (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s
      in (MPlus mr (shift ms (length ys)), ys @ zs))"
 | "to_mregex (Regex.Times r s) =
      (let (mr, ys) = to_mregex r; (ms, zs) = to_mregex s
      in (MTimes mr (shift ms (length ys)), ys @ zs))"
 | "to_mregex (Regex.Star r) =
      (let (mr, ys) = to_mregex r in (MStar mr, ys))"
 
 lemma shift_0: "shift r 0 = r"
   by (induct r) auto
 
 lemma shift_shift: "shift (shift r k) j = shift r (k + j)"
   by (induct r) auto
 
 lemma to_mregex_to_mregex_exec:
   "case to_mregex r of (mr, \<phi>s) \<Rightarrow> to_mregex_exec r xs = (shift mr (length xs), xs @ \<phi>s)"
   by (induct r arbitrary: xs)
     (auto simp: shift_shift ac_simps split: formula.splits prod.splits)
 
 lemma to_mregex_to_mregex_exec_Nil[code]: "to_mregex r = to_mregex_exec r []"
   using to_mregex_to_mregex_exec[where xs="[]" and r = r] by (auto simp: shift_0)
 
 lemma ok_mono: "ok m mr \<Longrightarrow> m \<le> n \<Longrightarrow> ok n mr"
   by (induct mr) auto
 
 lemma from_mregex_cong: "ok m mr \<Longrightarrow> (\<forall>i < m. xs ! i = ys ! i) \<Longrightarrow> from_mregex mr xs = from_mregex mr ys"
   by (induct mr) auto
 
 lemma not_Neg_cases:
   "(\<forall>\<psi>. \<phi> \<noteq> Formula.Neg \<psi>) \<Longrightarrow> (case \<phi> of formula.Neg \<psi> \<Rightarrow> f \<psi> | _ \<Rightarrow> x) = x"
   by (cases \<phi>) auto
 
 lemma to_mregex_exec_ok:
   "to_mregex_exec r xs = (mr, ys) \<Longrightarrow> \<exists>zs. ys = xs @ zs \<and> set zs = atms r \<and> ok (length ys) mr"
 proof (induct r arbitrary: xs mr ys)
   case (Skip x)
   then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)
 next
   case (Test x)
   show ?case proof (cases "\<exists>x'. x = Formula.Neg x'")
     case True
     with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)
   next
     case False
     with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)
   qed
 next
   case (Plus r1 r2)
   then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)
 next
   case (Times r1 r2)
   then show ?case by (fastforce split: if_splits prod.splits formula.splits simp: atms_def elim: ok_mono)
 next
   case (Star r)
   then show ?case by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)
 qed
 
 lemma ok_shift: "ok (i + m) (Monitor.shift r i) \<longleftrightarrow> ok m r"
   by (induct r) auto
 
 lemma to_mregex_ok: "to_mregex r = (mr, ys) \<Longrightarrow> set ys = atms r \<and> ok (length ys) mr"
 proof (induct r arbitrary: mr ys)
   case (Skip x)
   then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)
 next
   case (Test x)
   show ?case proof (cases "\<exists>x'. x = Formula.Neg x'")
     case True
     with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def elim: ok_mono)
   next
     case False
     with Test show ?thesis by (auto split: if_splits prod.splits simp: atms_def not_Neg_cases elim: ok_mono)
   qed
 next
   case (Plus r1 r2)
   then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)
 next
   case (Times r1 r2)
   then show ?case by (fastforce simp: ok_shift atms_def elim: ok_mono split: if_splits prod.splits)
 next
   case (Star r)
   then show ?case by (auto simp: atms_def elim: ok_mono split: if_splits prod.splits)
 qed
 
 lemma from_mregex_shift: "from_mregex (shift r (length xs)) (xs @ ys) = from_mregex r ys"
   by (induct r) (auto simp: nth_append)
 
 lemma from_mregex_to_mregex: "safe_regex m g r \<Longrightarrow> case_prod from_mregex (to_mregex r) = r"
   by (induct r rule: safe_regex.induct)
     (auto dest: to_mregex_ok intro!: from_mregex_cong simp: nth_append from_mregex_shift cases_Neg_iff
       split: prod.splits modality.splits)
 
 lemma from_mregex_eq: "safe_regex m g r \<Longrightarrow> to_mregex r = (mr, \<phi>s) \<Longrightarrow> from_mregex mr \<phi>s = r"
   using from_mregex_to_mregex[of m g r] by auto
 
 lemma from_mregex_to_mregex_exec: "safe_regex m g r \<Longrightarrow> case_prod from_mregex (to_mregex_exec r xs) = r"
 proof (induct r arbitrary: xs rule: safe_regex_induct)
   case (Plus b g r s)
   from Plus(3) Plus(1)[of xs] Plus(2)[of "snd (to_mregex_exec r xs)"] show ?case
     by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok
         intro!: from_mregex_cong[where m = "length (snd (to_mregex_exec r xs))"])
 next
   case (TimesF g r s)
   from TimesF(3) TimesF(2)[of xs] TimesF(1)[of "snd (to_mregex_exec r xs)"] show ?case
     by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok
         intro!: from_mregex_cong[where m = "length (snd (to_mregex_exec r xs))"])
 next
   case (TimesP g r s)
   from TimesP(3) TimesP(1)[of xs] TimesP(2)[of "snd (to_mregex_exec r xs)"] show ?case
     by (auto split: prod.splits simp: nth_append dest: to_mregex_exec_ok
         intro!: from_mregex_cong[where m = "length (snd (to_mregex_exec r xs))"])
 next
   case (Star b g r)
   from Star(2) Star(1)[of xs] show ?case
     by (auto split: prod.splits)
 qed (auto split: prod.splits simp: cases_Neg_iff)
 
 
 derive linorder mregex
 
 subsubsection \<open>LPD\<close>
 
 definition saturate where
   "saturate f = while (\<lambda>S. f S \<noteq> S) f"
 
 lemma saturate_code[code]:
   "saturate f S = (let S' = f S in if S' = S then S else saturate f S')"
   unfolding saturate_def Let_def
   by (subst while_unfold) auto
 
 definition "MTimesL r S = MTimes r ` S"
 definition "MTimesR R s = (\<lambda>r. MTimes r s) ` R"
 
 primrec LPD where
   "LPD (MSkip n) = (case n of 0 \<Rightarrow> {} | Suc m \<Rightarrow> {MSkip m})"
 | "LPD (MTestPos \<phi>) = {}"
 | "LPD (MTestNeg \<phi>) = {}"
 | "LPD (MPlus r s) = (LPD r \<union> LPD s)"
 | "LPD (MTimes r s) = MTimesR (LPD r) s \<union> LPD s"
 | "LPD (MStar r) = MTimesR (LPD r) (MStar r)"
 
 primrec LPDi where
   "LPDi 0 r = {r}"
 | "LPDi (Suc i) r = (\<Union>s \<in> LPD r. LPDi i s)"
 
 lemma LPDi_Suc_alt: "LPDi (Suc i) r = (\<Union>s \<in> LPDi i r. LPD s)"
   by (induct i arbitrary: r) fastforce+
 
 definition "LPDs r = (\<Union>i. LPDi i r)"
 
 lemma LPDs_refl: "r \<in> LPDs r"
   by (auto simp: LPDs_def intro: exI[of _ 0])
 lemma LPDs_trans: "r \<in> LPD s \<Longrightarrow> s \<in> LPDs t \<Longrightarrow> r \<in> LPDs t"
   by (force simp: LPDs_def LPDi_Suc_alt simp del: LPDi.simps intro: exI[of _ "Suc _"])
 
 lemma LPDi_Test:
   "LPDi i (MSkip 0) \<subseteq> {MSkip 0}"
   "LPDi i (MTestPos \<phi>) \<subseteq> {MTestPos \<phi>}"
   "LPDi i (MTestNeg \<phi>) \<subseteq> {MTestNeg \<phi>}"
   by (induct i) auto
 
 lemma LPDs_Test:
   "LPDs (MSkip 0) \<subseteq> {MSkip 0}"
   "LPDs (MTestPos \<phi>) \<subseteq> {MTestPos \<phi>}"
   "LPDs (MTestNeg \<phi>) \<subseteq> {MTestNeg \<phi>}"
   unfolding LPDs_def using LPDi_Test by blast+
 
 lemma LPDi_MSkip: "LPDi i (MSkip n) \<subseteq> MSkip ` {i. i \<le> n}"
   by (induct i arbitrary: n) (auto dest: set_mp[OF LPDi_Test(1)] simp: le_Suc_eq split: nat.splits)
 
 lemma LPDs_MSkip: "LPDs (MSkip n) \<subseteq> MSkip ` {i. i \<le> n}"
   unfolding LPDs_def using LPDi_MSkip by auto
 
 lemma LPDi_Plus: "LPDi i (MPlus r s) \<subseteq> {MPlus r s} \<union> LPDi i r \<union> LPDi i s"
   by (induct i arbitrary: r s) auto
 
 lemma LPDs_Plus: "LPDs (MPlus r s) \<subseteq> {MPlus r s} \<union> LPDs r \<union> LPDs s"
   unfolding LPDs_def using LPDi_Plus[of _ r s] by auto
 
 lemma LPDi_Times:
   "LPDi i (MTimes r s) \<subseteq> {MTimes r s} \<union> MTimesR (\<Union>j \<le> i. LPDi j r) s \<union> (\<Union>j \<le> i. LPDi j s)"
 proof (induct i arbitrary: r s)
   case (Suc i)
   show ?case
     by (fastforce simp: MTimesR_def dest: bspec[of _ _ "Suc _"] dest!: set_mp[OF Suc])
 qed simp
 
 lemma LPDs_Times: "LPDs (MTimes r s) \<subseteq> {MTimes r s} \<union> MTimesR (LPDs r) s \<union> LPDs s"
   unfolding LPDs_def using LPDi_Times[of _ r s] by (force simp: MTimesR_def)
 
 lemma LPDi_Star: "j \<le> i \<Longrightarrow> LPDi j (MStar r) \<subseteq> {MStar r} \<union> MTimesR (\<Union>j \<le> i. LPDi j r) (MStar r)"
 proof (induct i arbitrary: j r)
   case (Suc i)
   from Suc(2) show ?case
     by (auto 0 5 simp: MTimesR_def image_iff le_Suc_eq
         dest: bspec[of _ _ "Suc 0"] bspec[of _ _ "Suc _"] set_mp[OF Suc(1)] dest!: set_mp[OF LPDi_Times])
 qed simp
 
 lemma LPDs_Star: "LPDs (MStar r) \<subseteq> {MStar r} \<union> MTimesR (LPDs r) (MStar r)"
   unfolding LPDs_def using LPDi_Star[OF order_refl, of _ r] by (force simp: MTimesR_def)
 
 lemma finite_LPDs: "finite (LPDs r)"
 proof (induct r)
   case (MSkip n)
   then show ?case by (intro finite_subset[OF LPDs_MSkip]) simp
 next
   case (MTestPos \<phi>)
   then show ?case by (intro finite_subset[OF LPDs_Test(2)]) simp
 next
   case (MTestNeg \<phi>)
   then show ?case by (intro finite_subset[OF LPDs_Test(3)]) simp
 next
   case (MPlus r s)
   then show ?case by (intro finite_subset[OF LPDs_Plus]) simp
 next
   case (MTimes r s)
   then show ?case by (intro finite_subset[OF LPDs_Times]) (simp add: MTimesR_def)
 next
   case (MStar r)
   then show ?case by (intro finite_subset[OF LPDs_Star]) (simp add: MTimesR_def)
 qed
 
 context begin
 
 private abbreviation (input) "addLPD r \<equiv> \<lambda>S. insert r S \<union> Set.bind (insert r S) LPD"
 
 private lemma mono_addLPD: "mono (addLPD r)"
   unfolding mono_def Set.bind_def by auto
 
 private lemma LPDs_aux1: "lfp (addLPD r) \<subseteq> LPDs r"
   by (rule lfp_induct[OF mono_addLPD], auto intro: LPDs_refl LPDs_trans simp: Set.bind_def)
 
 private lemma LPDs_aux2: "LPDi i r \<subseteq> lfp (addLPD r)"
 proof (induct i)
   case 0
   then show ?case
     by (subst lfp_unfold[OF mono_addLPD]) auto
 next
   case (Suc i)
   then show ?case
     by (subst lfp_unfold[OF mono_addLPD]) (auto simp: LPDi_Suc_alt simp del: LPDi.simps)
 qed
 
 lemma LPDs_alt: "LPDs r = lfp (addLPD r)"
   using LPDs_aux1 LPDs_aux2 by (force simp: LPDs_def)
 
 lemma LPDs_code[code]:
   "LPDs r = saturate (addLPD r) {}"
   unfolding LPDs_alt saturate_def
   by (rule lfp_while[OF mono_addLPD _ finite_LPDs, of r]) (auto simp: LPDs_refl LPDs_trans Set.bind_def)
 
 end
 
 subsubsection \<open>RPD\<close>
 
 primrec RPD where
   "RPD (MSkip n) = (case n of 0 \<Rightarrow> {} | Suc m \<Rightarrow> {MSkip m})"
 | "RPD (MTestPos \<phi>) = {}"
 | "RPD (MTestNeg \<phi>) = {}"
 | "RPD (MPlus r s) = (RPD r \<union> RPD s)"
 | "RPD (MTimes r s) = MTimesL r (RPD s) \<union> RPD r"
 | "RPD (MStar r) = MTimesL (MStar r) (RPD r)"
 
 primrec RPDi where
   "RPDi 0 r = {r}"
 | "RPDi (Suc i) r = (\<Union>s \<in> RPD r. RPDi i s)"
 
 lemma RPDi_Suc_alt: "RPDi (Suc i) r = (\<Union>s \<in> RPDi i r. RPD s)"
   by (induct i arbitrary: r) fastforce+
 
 definition "RPDs r = (\<Union>i. RPDi i r)"
 
 lemma RPDs_refl: "r \<in> RPDs r"
   by (auto simp: RPDs_def intro: exI[of _ 0])
 lemma RPDs_trans: "r \<in> RPD s \<Longrightarrow> s \<in> RPDs t \<Longrightarrow> r \<in> RPDs t"
   by (force simp: RPDs_def RPDi_Suc_alt simp del: RPDi.simps intro: exI[of _ "Suc _"])
 
 lemma RPDi_Test:
   "RPDi i (MSkip 0) \<subseteq> {MSkip 0}"
   "RPDi i (MTestPos \<phi>) \<subseteq> {MTestPos \<phi>}"
   "RPDi i (MTestNeg \<phi>) \<subseteq> {MTestNeg \<phi>}"
   by (induct i) auto
 
 lemma RPDs_Test:
   "RPDs (MSkip 0) \<subseteq> {MSkip 0}"
   "RPDs (MTestPos \<phi>) \<subseteq> {MTestPos \<phi>}"
   "RPDs (MTestNeg \<phi>) \<subseteq> {MTestNeg \<phi>}"
   unfolding RPDs_def using RPDi_Test by blast+
 
 lemma RPDi_MSkip: "RPDi i (MSkip n) \<subseteq> MSkip ` {i. i \<le> n}"
   by (induct i arbitrary: n) (auto dest: set_mp[OF RPDi_Test(1)] simp: le_Suc_eq split: nat.splits)
 
 lemma RPDs_MSkip: "RPDs (MSkip n) \<subseteq> MSkip ` {i. i \<le> n}"
   unfolding RPDs_def using RPDi_MSkip by auto
 
 lemma RPDi_Plus: "RPDi i (MPlus r s) \<subseteq> {MPlus r s} \<union> RPDi i r \<union> RPDi i s"
   by (induct i arbitrary: r s) auto
 
 lemma RPDi_Suc_RPD_Plus:
   "RPDi (Suc i) r \<subseteq> RPDs (MPlus r s)"
   "RPDi (Suc i) s \<subseteq> RPDs (MPlus r s)"
   unfolding RPDs_def by (force intro!: exI[of _ "Suc i"])+
 
 lemma RPDs_Plus: "RPDs (MPlus r s) \<subseteq> {MPlus r s} \<union> RPDs r \<union> RPDs s"
   unfolding RPDs_def using RPDi_Plus[of _ r s] by auto
 
 lemma RPDi_Times:
   "RPDi i (MTimes r s) \<subseteq> {MTimes r s} \<union> MTimesL r (\<Union>j \<le> i. RPDi j s) \<union> (\<Union>j \<le> i. RPDi j r)"
 proof (induct i arbitrary: r s)
   case (Suc i)
   show ?case
     by (fastforce simp: MTimesL_def dest: bspec[of _ _ "Suc _"] dest!: set_mp[OF Suc])
 qed simp
 
 lemma RPDs_Times: "RPDs (MTimes r s) \<subseteq> {MTimes r s} \<union> MTimesL r (RPDs s) \<union> RPDs r"
   unfolding RPDs_def using RPDi_Times[of _ r s] by (force simp: MTimesL_def)
 
 lemma RPDi_Star: "j \<le> i \<Longrightarrow> RPDi j (MStar r) \<subseteq> {MStar r} \<union> MTimesL (MStar r) (\<Union>j \<le> i. RPDi j r)"
 proof (induct i arbitrary: j r)
   case (Suc i)
   from Suc(2) show ?case
     by (auto 0 5 simp: MTimesL_def image_iff le_Suc_eq
         dest: bspec[of _ _ "Suc 0"] bspec[of _ _ "Suc _"] set_mp[OF Suc(1)] dest!: set_mp[OF RPDi_Times])
 qed simp
 
 lemma RPDs_Star: "RPDs (MStar r) \<subseteq> {MStar r} \<union> MTimesL (MStar r) (RPDs r)"
   unfolding RPDs_def using RPDi_Star[OF order_refl, of _ r] by (force simp: MTimesL_def)
 
 lemma finite_RPDs: "finite (RPDs r)"
 proof (induct r)
   case MSkip
   then show ?case by (intro finite_subset[OF RPDs_MSkip]) simp
 next
   case (MTestPos \<phi>)
   then show ?case by (intro finite_subset[OF RPDs_Test(2)]) simp
 next
   case (MTestNeg \<phi>)
   then show ?case by (intro finite_subset[OF RPDs_Test(3)]) simp
 next
   case (MPlus r s)
   then show ?case by (intro finite_subset[OF RPDs_Plus]) simp
 next
   case (MTimes r s)
   then show ?case by (intro finite_subset[OF RPDs_Times]) (simp add: MTimesL_def)
 next
   case (MStar r)
   then show ?case by (intro finite_subset[OF RPDs_Star]) (simp add: MTimesL_def)
 qed
 
 context begin
 
 private abbreviation (input) "addRPD r \<equiv> \<lambda>S. insert r S \<union> Set.bind (insert r S) RPD"
 
 private lemma mono_addRPD: "mono (addRPD r)"
   unfolding mono_def Set.bind_def by auto
 
 private lemma RPDs_aux1: "lfp (addRPD r) \<subseteq> RPDs r"
   by (rule lfp_induct[OF mono_addRPD], auto intro: RPDs_refl RPDs_trans simp: Set.bind_def)
 
 private lemma RPDs_aux2: "RPDi i r \<subseteq> lfp (addRPD r)"
 proof (induct i)
   case 0
   then show ?case
     by (subst lfp_unfold[OF mono_addRPD]) auto
 next
   case (Suc i)
   then show ?case
     by (subst lfp_unfold[OF mono_addRPD]) (auto simp: RPDi_Suc_alt simp del: RPDi.simps)
 qed
 
 lemma RPDs_alt: "RPDs r = lfp (addRPD r)"
   using RPDs_aux1 RPDs_aux2 by (force simp: RPDs_def)
 
 lemma RPDs_code[code]:
   "RPDs r = saturate (addRPD r) {}"
   unfolding RPDs_alt saturate_def
   by (rule lfp_while[OF mono_addRPD _ finite_RPDs, of r]) (auto simp: RPDs_refl RPDs_trans Set.bind_def)
 
 end
 
 subsection \<open>The executable monitor\<close>
 
 type_synonym ts = nat
 
 type_synonym 'a mbuf2 = "'a table list \<times> 'a table list"
 type_synonym 'a mbufn = "'a table list list"
 type_synonym 'a msaux = "(ts \<times> 'a table) list"
 type_synonym 'a muaux = "(ts \<times> 'a table \<times> 'a table) list"
 type_synonym 'a mr\<delta>aux = "(ts \<times> (mregex, 'a table) mapping) list"
 type_synonym 'a ml\<delta>aux = "(ts \<times> 'a table list \<times> 'a table) list"
 
 datatype mconstraint = MEq | MLess | MLessEq
 
 record args =
   args_ivl :: \<I>
   args_n :: nat
   args_L :: "nat set"
   args_R :: "nat set"
   args_pos :: bool
 
 datatype (dead 'msaux, dead 'muaux) mformula =
   MRel "event_data table"
   | MPred Formula.name "Formula.trm list"
   | MLet Formula.name nat "('msaux, 'muaux) mformula" "('msaux, 'muaux) mformula"
   | MAnd "nat set" "('msaux, 'muaux) mformula" bool "nat set" "('msaux, 'muaux) mformula" "event_data mbuf2"
   | MAndAssign "('msaux, 'muaux) mformula" "nat \<times> Formula.trm"
   | MAndRel "('msaux, 'muaux) mformula" "Formula.trm \<times> bool \<times> mconstraint \<times> Formula.trm"
   | MAnds "nat set list" "nat set list" "('msaux, 'muaux) mformula list" "event_data mbufn"
   | MOr "('msaux, 'muaux) mformula" "('msaux, 'muaux) mformula" "event_data mbuf2"
   | MNeg "('msaux, 'muaux) mformula"
   | MExists "('msaux, 'muaux) mformula"
   | MAgg bool nat Formula.agg_op nat "Formula.trm" "('msaux, 'muaux) mformula"
   | MPrev \<I> "('msaux, 'muaux) mformula" bool "event_data table list" "ts list"
   | MNext \<I> "('msaux, 'muaux) mformula" bool "ts list"
   | MSince args "('msaux, 'muaux) mformula" "('msaux, 'muaux) mformula" "event_data mbuf2" "ts list" "'msaux"
   | MUntil args "('msaux, 'muaux) mformula" "('msaux, 'muaux) mformula" "event_data mbuf2" "ts list" "'muaux"
   | MMatchP \<I> "mregex" "mregex list" "('msaux, 'muaux) mformula list" "event_data mbufn" "ts list" "event_data mr\<delta>aux"
   | MMatchF \<I> "mregex" "mregex list" "('msaux, 'muaux) mformula list" "event_data mbufn" "ts list" "event_data ml\<delta>aux"
 
 record ('msaux, 'muaux) mstate =
   mstate_i :: nat
   mstate_m :: "('msaux, 'muaux) mformula"
   mstate_n :: nat
 
 fun eq_rel :: "nat \<Rightarrow> Formula.trm \<Rightarrow> Formula.trm \<Rightarrow> event_data table" where
   "eq_rel n (Formula.Const x) (Formula.Const y) = (if x = y then unit_table n else empty_table)"
 | "eq_rel n (Formula.Var x) (Formula.Const y) = singleton_table n x y"
 | "eq_rel n (Formula.Const x) (Formula.Var y) = singleton_table n y x"
 | "eq_rel n _ _ = undefined"
 
 lemma regex_atms_size: "x \<in> regex.atms r \<Longrightarrow> size x < regex.size_regex size r"
   by (induct r) auto
 
 lemma atms_size:
   assumes "x \<in> atms r"
   shows "size x < Regex.size_regex size r"
 proof -
   { fix y assume "y \<in> regex.atms r" "case y of formula.Neg z \<Rightarrow> x = z | _ \<Rightarrow> False"
     then have "size x < Regex.size_regex size r"
       by (cases y rule: formula.exhaust) (auto dest: regex_atms_size)
   }
   with assms show ?thesis
     unfolding atms_def
     by (auto split: formula.splits dest: regex_atms_size)
 qed
 
 definition init_args :: "\<I> \<Rightarrow> nat \<Rightarrow> nat set \<Rightarrow> nat set \<Rightarrow> bool \<Rightarrow> args" where
   "init_args I n L R pos = \<lparr>args_ivl = I, args_n = n, args_L = L, args_R = R, args_pos = pos\<rparr>"
 
 locale msaux =
   fixes valid_msaux :: "args \<Rightarrow> ts \<Rightarrow> 'msaux \<Rightarrow> event_data msaux \<Rightarrow> bool"
     and init_msaux :: "args \<Rightarrow> 'msaux"
     and add_new_ts_msaux :: "args \<Rightarrow> ts \<Rightarrow> 'msaux \<Rightarrow> 'msaux"
     and join_msaux :: "args \<Rightarrow> event_data table \<Rightarrow> 'msaux \<Rightarrow> 'msaux"
     and add_new_table_msaux :: "args \<Rightarrow> event_data table \<Rightarrow> 'msaux \<Rightarrow> 'msaux"
     and result_msaux :: "args \<Rightarrow> 'msaux \<Rightarrow> event_data table"
   assumes valid_init_msaux: "L \<subseteq> R \<Longrightarrow>
     valid_msaux (init_args I n L R pos) 0 (init_msaux (init_args I n L R pos)) []"
   assumes valid_add_new_ts_msaux: "valid_msaux args cur aux auxlist \<Longrightarrow> nt \<ge> cur \<Longrightarrow>
     valid_msaux args nt (add_new_ts_msaux args nt aux)
     (filter (\<lambda>(t, rel). enat (nt - t) \<le> right (args_ivl args)) auxlist)"
   assumes valid_join_msaux: "valid_msaux args cur aux auxlist \<Longrightarrow>
     table (args_n args) (args_L args) rel1 \<Longrightarrow>
     valid_msaux args cur (join_msaux args rel1 aux)
     (map (\<lambda>(t, rel). (t, join rel (args_pos args) rel1)) auxlist)"
   assumes valid_add_new_table_msaux: "valid_msaux args cur aux auxlist \<Longrightarrow>
     table (args_n args) (args_R args) rel2 \<Longrightarrow>
     valid_msaux args cur (add_new_table_msaux args rel2 aux)
     (case auxlist of
       [] => [(cur, rel2)]
     | ((t, y) # ts) \<Rightarrow> if t = cur then (t, y \<union> rel2) # ts else (cur, rel2) # auxlist)"
     and valid_result_msaux: "valid_msaux args cur aux auxlist \<Longrightarrow> result_msaux args aux =
     foldr (\<union>) [rel. (t, rel) \<leftarrow> auxlist, left (args_ivl args) \<le> cur - t] {}"
 
 fun check_before :: "\<I> \<Rightarrow> ts \<Rightarrow> (ts \<times> 'a \<times> 'b) \<Rightarrow> bool" where
   "check_before I dt (t, a, b) \<longleftrightarrow> enat t + right I < enat dt"
 
 fun proj_thd :: "('a \<times> 'b \<times> 'c) \<Rightarrow> 'c" where
   "proj_thd (t, a1, a2) = a2"
 
 definition update_until :: "args \<Rightarrow> event_data table \<Rightarrow> event_data table \<Rightarrow> ts \<Rightarrow> event_data muaux \<Rightarrow> event_data muaux" where
   "update_until args rel1 rel2 nt aux =
     (map (\<lambda>x. case x of (t, a1, a2) \<Rightarrow> (t, if (args_pos args) then join a1 True rel1 else a1 \<union> rel1,
       if mem (nt - t) (args_ivl args) then a2 \<union> join rel2 (args_pos args) a1 else a2)) aux) @
     [(nt, rel1, if left (args_ivl args) = 0 then rel2 else empty_table)]"
 
 lemma map_proj_thd_update_until: "map proj_thd (takeWhile (check_before (args_ivl args) nt) auxlist) =
   map proj_thd (takeWhile (check_before (args_ivl args) nt) (update_until args rel1 rel2 nt auxlist))"
 proof (induction auxlist)
   case Nil
   then show ?case by (simp add: update_until_def)
 next
   case (Cons a auxlist)
   then show ?case
     by (cases "right (args_ivl args)") (auto simp add: update_until_def split: if_splits prod.splits)
 qed
 
 fun eval_until :: "\<I> \<Rightarrow> ts \<Rightarrow> event_data muaux \<Rightarrow> event_data table list \<times> event_data muaux" where
   "eval_until I nt [] = ([], [])"
 | "eval_until I nt ((t, a1, a2) # aux) = (if t + right I < nt then
     (let (xs, aux) = eval_until I nt aux in (a2 # xs, aux)) else ([], (t, a1, a2) # aux))"
 
 lemma eval_until_length:
   "eval_until I nt auxlist = (res, auxlist') \<Longrightarrow> length auxlist = length res + length auxlist'"
   by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)
     (auto split: if_splits prod.splits)
 
 lemma eval_until_res: "eval_until I nt auxlist = (res, auxlist') \<Longrightarrow>
   res = map proj_thd (takeWhile (check_before I nt) auxlist)"
   by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)
     (auto split: prod.splits)
 
 lemma eval_until_auxlist': "eval_until I nt auxlist = (res, auxlist') \<Longrightarrow>
   auxlist' = drop (length res) auxlist"
   by (induction I nt auxlist arbitrary: res auxlist' rule: eval_until.induct)
     (auto split: if_splits prod.splits)
 
 locale muaux =
   fixes valid_muaux :: "args \<Rightarrow> ts \<Rightarrow> 'muaux \<Rightarrow> event_data muaux \<Rightarrow> bool"
     and init_muaux :: "args \<Rightarrow> 'muaux"
     and add_new_muaux :: "args \<Rightarrow> event_data table \<Rightarrow> event_data table \<Rightarrow> ts \<Rightarrow> 'muaux \<Rightarrow> 'muaux"
     and length_muaux :: "args \<Rightarrow> 'muaux \<Rightarrow> nat"
     and eval_muaux :: "args \<Rightarrow> ts \<Rightarrow> 'muaux \<Rightarrow> event_data table list \<times> 'muaux"
   assumes valid_init_muaux: "L \<subseteq> R \<Longrightarrow>
     valid_muaux (init_args I n L R pos) 0 (init_muaux (init_args I n L R pos)) []"
   assumes valid_add_new_muaux: "valid_muaux args cur aux auxlist \<Longrightarrow>
     table (args_n args) (args_L args) rel1 \<Longrightarrow>
     table (args_n args) (args_R args) rel2 \<Longrightarrow>
     nt \<ge> cur \<Longrightarrow>
     valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux)
     (update_until args rel1 rel2 nt auxlist)"
   assumes valid_length_muaux: "valid_muaux args cur aux auxlist \<Longrightarrow> length_muaux args aux = length auxlist"
   assumes valid_eval_muaux: "valid_muaux args cur aux auxlist \<Longrightarrow> nt \<ge> cur \<Longrightarrow>
     eval_muaux args nt aux = (res, aux') \<Longrightarrow> eval_until (args_ivl args) nt auxlist = (res', auxlist') \<Longrightarrow>
     res = res' \<and> valid_muaux args cur aux' auxlist'"
 
 locale maux = msaux valid_msaux init_msaux add_new_ts_msaux join_msaux add_new_table_msaux result_msaux +
   muaux valid_muaux init_muaux add_new_muaux length_muaux eval_muaux
   for valid_msaux :: "args \<Rightarrow> ts \<Rightarrow> 'msaux \<Rightarrow> event_data msaux \<Rightarrow> bool"
     and init_msaux :: "args \<Rightarrow> 'msaux"
     and add_new_ts_msaux :: "args \<Rightarrow> ts \<Rightarrow> 'msaux \<Rightarrow> 'msaux"
     and join_msaux :: "args \<Rightarrow> event_data table \<Rightarrow> 'msaux \<Rightarrow> 'msaux"
     and add_new_table_msaux :: "args \<Rightarrow> event_data table \<Rightarrow> 'msaux \<Rightarrow> 'msaux"
     and result_msaux :: "args \<Rightarrow> 'msaux \<Rightarrow> event_data table"
     and valid_muaux :: "args \<Rightarrow> ts \<Rightarrow> 'muaux \<Rightarrow> event_data muaux \<Rightarrow> bool"
     and init_muaux :: "args \<Rightarrow> 'muaux"
     and add_new_muaux :: "args \<Rightarrow> event_data table \<Rightarrow> event_data table \<Rightarrow> ts \<Rightarrow> 'muaux \<Rightarrow> 'muaux"
     and length_muaux :: "args \<Rightarrow> 'muaux \<Rightarrow> nat"
     and eval_muaux :: "args \<Rightarrow> nat \<Rightarrow> 'muaux \<Rightarrow> event_data table list \<times> 'muaux"
 
 fun split_assignment :: "nat set \<Rightarrow> Formula.formula \<Rightarrow> nat \<times> Formula.trm" where
   "split_assignment X (Formula.Eq t1 t2) = (case (t1, t2) of
       (Formula.Var x, Formula.Var y) \<Rightarrow> if x \<in> X then (y, t1) else (x, t2)
     | (Formula.Var x, _) \<Rightarrow> (x, t2)
     | (_, Formula.Var y) \<Rightarrow> (y, t1))"
 | "split_assignment _ _ = undefined"
 
 fun split_constraint :: "Formula.formula \<Rightarrow> Formula.trm \<times> bool \<times> mconstraint \<times> Formula.trm" where
   "split_constraint (Formula.Eq t1 t2) = (t1, True, MEq, t2)"
 | "split_constraint (Formula.Less t1 t2) = (t1, True, MLess, t2)"
 | "split_constraint (Formula.LessEq t1 t2) = (t1, True, MLessEq, t2)"
 | "split_constraint (Formula.Neg (Formula.Eq t1 t2)) = (t1, False, MEq, t2)"
 | "split_constraint (Formula.Neg (Formula.Less t1 t2)) = (t1, False, MLess, t2)"
 | "split_constraint (Formula.Neg (Formula.LessEq t1 t2)) = (t1, False, MLessEq, t2)"
 | "split_constraint _ = undefined"
 
 function (in maux) (sequential) minit0 :: "nat \<Rightarrow> Formula.formula \<Rightarrow> ('msaux, 'muaux) mformula" where
   "minit0 n (Formula.Neg \<phi>) = (if fv \<phi> = {} then MNeg (minit0 n \<phi>) else MRel empty_table)"
 | "minit0 n (Formula.Eq t1 t2) = MRel (eq_rel n t1 t2)"
 | "minit0 n (Formula.Pred e ts) = MPred e ts"
 | "minit0 n (Formula.Let p \<phi> \<psi>) = MLet p (Formula.nfv \<phi>) (minit0 (Formula.nfv \<phi>) \<phi>) (minit0 n \<psi>)"
 | "minit0 n (Formula.Or \<phi> \<psi>) = MOr (minit0 n \<phi>) (minit0 n \<psi>) ([], [])"
 | "minit0 n (Formula.And \<phi> \<psi>) = (if safe_assignment (fv \<phi>) \<psi> then
       MAndAssign (minit0 n \<phi>) (split_assignment (fv \<phi>) \<psi>)
     else if safe_formula \<psi> then
       MAnd (fv \<phi>) (minit0 n \<phi>) True (fv \<psi>) (minit0 n \<psi>) ([], [])
     else if is_constraint \<psi> then
       MAndRel (minit0 n \<phi>) (split_constraint \<psi>)
     else (case \<psi> of Formula.Neg \<psi> \<Rightarrow>
       MAnd (fv \<phi>) (minit0 n \<phi>) False (fv \<psi>) (minit0 n \<psi>) ([], [])))"
 | "minit0 n (Formula.Ands l) = (let (pos, neg) = partition safe_formula l in
     let mpos = map (minit0 n) pos in
     let mneg = map (minit0 n) (map remove_neg neg) in
     let vpos = map fv pos in
     let vneg = map fv neg in
     MAnds vpos vneg (mpos @ mneg) (replicate (length l) []))"
 | "minit0 n (Formula.Exists \<phi>) = MExists (minit0 (Suc n) \<phi>)"
 | "minit0 n (Formula.Agg y \<omega> b f \<phi>) = MAgg (fv \<phi> \<subseteq> {0..<b}) y \<omega> b f (minit0 (b + n) \<phi>)"
 | "minit0 n (Formula.Prev I \<phi>) = MPrev I (minit0 n \<phi>) True [] []"
 | "minit0 n (Formula.Next I \<phi>) = MNext I (minit0 n \<phi>) True []"
 | "minit0 n (Formula.Since \<phi> I \<psi>) = (if safe_formula \<phi>
     then MSince (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) True) (minit0 n \<phi>) (minit0 n \<psi>) ([], []) [] (init_msaux (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) True))
     else (case \<phi> of
       Formula.Neg \<phi> \<Rightarrow> MSince (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) False) (minit0 n \<phi>) (minit0 n \<psi>) ([], []) [] (init_msaux (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) False))
     | _ \<Rightarrow> undefined))"
 | "minit0 n (Formula.Until \<phi> I \<psi>) = (if safe_formula \<phi>
     then MUntil (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) True) (minit0 n \<phi>) (minit0 n \<psi>) ([], []) [] (init_muaux (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) True))
     else (case \<phi> of
       Formula.Neg \<phi> \<Rightarrow> MUntil (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) False) (minit0 n \<phi>) (minit0 n \<psi>) ([], []) [] (init_muaux (init_args I n (Formula.fv \<phi>) (Formula.fv \<psi>) False))
     | _ \<Rightarrow> undefined))"
 | "minit0 n (Formula.MatchP I r) =
     (let (mr, \<phi>s) = to_mregex r
     in MMatchP I mr (sorted_list_of_set (RPDs mr)) (map (minit0 n) \<phi>s) (replicate (length \<phi>s) []) [] [])"
 | "minit0 n (Formula.MatchF I r) =
     (let (mr, \<phi>s) = to_mregex r
     in MMatchF I mr (sorted_list_of_set (LPDs mr)) (map (minit0 n) \<phi>s) (replicate (length \<phi>s) []) [] [])"
 | "minit0 n _ = undefined"
   by pat_completeness auto
 termination (in maux)
   by (relation "measure (\<lambda>(_, \<phi>). size \<phi>)")
     (auto simp: less_Suc_eq_le size_list_estimation' size_remove_neg
       dest!: to_mregex_ok[OF sym] atms_size)
 
 definition (in maux) minit :: "Formula.formula \<Rightarrow> ('msaux, 'muaux) mstate" where
   "minit \<phi> = (let n = Formula.nfv \<phi> in \<lparr>mstate_i = 0, mstate_m = minit0 n \<phi>, mstate_n = n\<rparr>)"
 
+definition (in maux) minit_safe where
+  "minit_safe \<phi> = (if mmonitorable_exec \<phi> then minit \<phi> else undefined)"
+
 fun mprev_next :: "\<I> \<Rightarrow> event_data table list \<Rightarrow> ts list \<Rightarrow> event_data table list \<times> event_data table list \<times> ts list" where
   "mprev_next I [] ts = ([], [], ts)"
 | "mprev_next I xs [] = ([], xs, [])"
 | "mprev_next I xs [t] = ([], xs, [t])"
 | "mprev_next I (x # xs) (t # t' # ts) = (let (ys, zs) = mprev_next I xs (t' # ts)
     in ((if mem (t' - t) I then x else empty_table) # ys, zs))"
 
 fun mbuf2_add :: "event_data table list \<Rightarrow> event_data table list \<Rightarrow> event_data mbuf2 \<Rightarrow> event_data mbuf2" where
   "mbuf2_add xs' ys' (xs, ys) = (xs @ xs', ys @ ys')"
 
 fun mbuf2_take :: "(event_data table \<Rightarrow> event_data table \<Rightarrow> 'b) \<Rightarrow> event_data mbuf2 \<Rightarrow> 'b list \<times> event_data mbuf2" where
   "mbuf2_take f (x # xs, y # ys) = (let (zs, buf) = mbuf2_take f (xs, ys) in (f x y # zs, buf))"
 | "mbuf2_take f (xs, ys) = ([], (xs, ys))"
 
 fun mbuf2t_take :: "(event_data table \<Rightarrow> event_data table \<Rightarrow> ts \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> 'b \<Rightarrow>
     event_data mbuf2 \<Rightarrow> ts list \<Rightarrow> 'b \<times> event_data mbuf2 \<times> ts list" where
   "mbuf2t_take f z (x # xs, y # ys) (t # ts) = mbuf2t_take f (f x y t z) (xs, ys) ts"
 | "mbuf2t_take f z (xs, ys) ts = (z, (xs, ys), ts)"
 
 lemma size_list_length_diff1: "xs \<noteq> [] \<Longrightarrow> [] \<notin> set xs \<Longrightarrow>
   size_list (\<lambda>xs. length xs - Suc 0) xs < size_list length xs"
 proof (induct xs)
   case (Cons x xs)
   then show ?case
     by (cases xs) auto
 qed simp
 
 fun mbufn_add :: "event_data table list list \<Rightarrow> event_data mbufn \<Rightarrow> event_data mbufn" where
   "mbufn_add xs' xs = List.map2 (@) xs xs'"
 
 function mbufn_take :: "(event_data table list \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> 'b \<Rightarrow> event_data mbufn \<Rightarrow> 'b \<times> event_data mbufn" where
   "mbufn_take f z buf = (if buf = [] \<or> [] \<in> set buf then (z, buf)
     else mbufn_take f (f (map hd buf) z) (map tl buf))"
   by pat_completeness auto
 termination by (relation "measure (\<lambda>(_, _, buf). size_list length buf)")
     (auto simp: comp_def Suc_le_eq size_list_length_diff1)
 
 fun mbufnt_take :: "(event_data table list \<Rightarrow> ts \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow>
     'b \<Rightarrow> event_data mbufn \<Rightarrow> ts list \<Rightarrow> 'b \<times> event_data mbufn \<times> ts list" where
   "mbufnt_take f z buf ts =
     (if [] \<in> set buf \<or> ts = [] then (z, buf, ts)
     else mbufnt_take f (f (map hd buf) (hd ts) z) (map tl buf) (tl ts))"
 
 fun match :: "Formula.trm list \<Rightarrow> event_data list \<Rightarrow> (nat \<rightharpoonup> event_data) option" where
   "match [] [] = Some Map.empty"
 | "match (Formula.Const x # ts) (y # ys) = (if x = y then match ts ys else None)"
 | "match (Formula.Var x # ts) (y # ys) = (case match ts ys of
       None \<Rightarrow> None
     | Some f \<Rightarrow> (case f x of
         None \<Rightarrow> Some (f(x \<mapsto> y))
       | Some z \<Rightarrow> if y = z then Some f else None))"
 | "match _ _ = None"
 
 fun meval_trm :: "Formula.trm \<Rightarrow> event_data tuple \<Rightarrow> event_data" where
   "meval_trm (Formula.Var x) v = the (v ! x)"
 | "meval_trm (Formula.Const x) v = x"
 | "meval_trm (Formula.Plus x y) v = meval_trm x v + meval_trm y v"
 | "meval_trm (Formula.Minus x y) v = meval_trm x v - meval_trm y v"
 | "meval_trm (Formula.UMinus x) v = - meval_trm x v"
 | "meval_trm (Formula.Mult x y) v = meval_trm x v * meval_trm y v"
 | "meval_trm (Formula.Div x y) v = meval_trm x v div meval_trm y v"
 | "meval_trm (Formula.Mod x y) v = meval_trm x v mod meval_trm y v"
 | "meval_trm (Formula.F2i x) v = EInt (integer_of_event_data (meval_trm x v))"
 | "meval_trm (Formula.I2f x) v = EFloat (double_of_event_data (meval_trm x v))"
 
 definition eval_agg :: "nat \<Rightarrow> bool \<Rightarrow> nat \<Rightarrow> Formula.agg_op \<Rightarrow> nat \<Rightarrow> Formula.trm \<Rightarrow>
   event_data table \<Rightarrow> event_data table" where
   "eval_agg n g0 y \<omega> b f rel = (if g0 \<and> rel = empty_table
     then singleton_table n y (eval_agg_op \<omega> {})
     else (\<lambda>k.
       let group = Set.filter (\<lambda>x. drop b x = k) rel;
         M = (\<lambda>y. (y, ecard (Set.filter (\<lambda>x. meval_trm f x = y) group))) ` meval_trm f ` group
       in k[y:=Some (eval_agg_op \<omega> M)]) ` (drop b) ` rel)"
 
 definition (in maux) update_since :: "args \<Rightarrow> event_data table \<Rightarrow> event_data table \<Rightarrow> ts \<Rightarrow>
   'msaux \<Rightarrow> event_data table \<times> 'msaux" where
   "update_since args rel1 rel2 nt aux =
     (let aux0 = join_msaux args rel1 (add_new_ts_msaux args nt aux);
          aux' = add_new_table_msaux args rel2 aux0
     in (result_msaux args aux', aux'))"
 
 definition "lookup = Mapping.lookup_default empty_table"
 
 fun \<epsilon>_lax where
   "\<epsilon>_lax guard \<phi>s (MSkip n) = (if n = 0 then guard else empty_table)"
 | "\<epsilon>_lax guard \<phi>s (MTestPos i) = join guard True (\<phi>s ! i)"
 | "\<epsilon>_lax guard \<phi>s (MTestNeg i) = join guard False (\<phi>s ! i)"
 | "\<epsilon>_lax guard \<phi>s (MPlus r s) = \<epsilon>_lax guard \<phi>s r \<union> \<epsilon>_lax guard \<phi>s s"
 | "\<epsilon>_lax guard \<phi>s (MTimes r s) = join (\<epsilon>_lax guard \<phi>s r) True (\<epsilon>_lax guard \<phi>s s)"
 | "\<epsilon>_lax guard \<phi>s (MStar r) = guard"
 
 fun r\<epsilon>_strict where
   "r\<epsilon>_strict n \<phi>s (MSkip m) = (if m = 0 then unit_table n else empty_table)"
 | "r\<epsilon>_strict n \<phi>s (MTestPos i) = \<phi>s ! i"
 | "r\<epsilon>_strict n \<phi>s (MTestNeg i) = (if \<phi>s ! i = empty_table then unit_table n else empty_table)"
 | "r\<epsilon>_strict n \<phi>s (MPlus r s) = r\<epsilon>_strict n \<phi>s r \<union> r\<epsilon>_strict n \<phi>s s"
 | "r\<epsilon>_strict n \<phi>s (MTimes r s) = \<epsilon>_lax (r\<epsilon>_strict n \<phi>s r) \<phi>s s"
 | "r\<epsilon>_strict n \<phi>s (MStar r) = unit_table n"
 
 fun l\<epsilon>_strict where
   "l\<epsilon>_strict n \<phi>s (MSkip m) = (if m = 0 then unit_table n else empty_table)"
 | "l\<epsilon>_strict n \<phi>s (MTestPos i) = \<phi>s ! i"
 | "l\<epsilon>_strict n \<phi>s (MTestNeg i) = (if \<phi>s ! i = empty_table then unit_table n else empty_table)"
 | "l\<epsilon>_strict n \<phi>s (MPlus r s) = l\<epsilon>_strict n \<phi>s r \<union> l\<epsilon>_strict n \<phi>s s"
 | "l\<epsilon>_strict n \<phi>s (MTimes r s) = \<epsilon>_lax (l\<epsilon>_strict n \<phi>s s) \<phi>s r"
 | "l\<epsilon>_strict n \<phi>s (MStar r) = unit_table n"
 
 fun r\<delta> :: "(mregex \<Rightarrow> mregex) \<Rightarrow> (mregex, 'a table) mapping \<Rightarrow> 'a table list \<Rightarrow> mregex \<Rightarrow> 'a table"  where
   "r\<delta> \<kappa> X \<phi>s (MSkip n) = (case n of 0 \<Rightarrow> empty_table | Suc m \<Rightarrow> lookup X (\<kappa> (MSkip m)))"
 | "r\<delta> \<kappa> X \<phi>s (MTestPos i) = empty_table"
 | "r\<delta> \<kappa> X \<phi>s (MTestNeg i) = empty_table"
 | "r\<delta> \<kappa> X \<phi>s (MPlus r s) = r\<delta> \<kappa> X \<phi>s r \<union> r\<delta> \<kappa> X \<phi>s s"
 | "r\<delta> \<kappa> X \<phi>s (MTimes r s) = r\<delta> (\<lambda>t. \<kappa> (MTimes r t)) X \<phi>s s \<union> \<epsilon>_lax (r\<delta> \<kappa> X \<phi>s r) \<phi>s s"
 | "r\<delta> \<kappa> X \<phi>s (MStar r) = r\<delta> (\<lambda>t. \<kappa> (MTimes (MStar r) t)) X \<phi>s r"
 
 fun l\<delta> :: "(mregex \<Rightarrow> mregex) \<Rightarrow> (mregex, 'a table) mapping \<Rightarrow> 'a table list \<Rightarrow> mregex \<Rightarrow> 'a table" where
   "l\<delta> \<kappa> X \<phi>s (MSkip n) = (case n of 0 \<Rightarrow> empty_table | Suc m \<Rightarrow> lookup X (\<kappa> (MSkip m)))"
 | "l\<delta> \<kappa> X \<phi>s (MTestPos i) = empty_table"
 | "l\<delta> \<kappa> X \<phi>s (MTestNeg i) = empty_table"
 | "l\<delta> \<kappa> X \<phi>s (MPlus r s) = l\<delta> \<kappa> X \<phi>s r \<union> l\<delta> \<kappa> X \<phi>s s"
 | "l\<delta> \<kappa> X \<phi>s (MTimes r s) = l\<delta> (\<lambda>t. \<kappa> (MTimes t s)) X \<phi>s r \<union> \<epsilon>_lax (l\<delta> \<kappa> X \<phi>s s) \<phi>s r"
 | "l\<delta> \<kappa> X \<phi>s (MStar r) = l\<delta> (\<lambda>t. \<kappa> (MTimes t (MStar r))) X \<phi>s r"
 
 lift_definition mrtabulate :: "mregex list \<Rightarrow> (mregex \<Rightarrow> 'b table) \<Rightarrow> (mregex, 'b table) mapping"
   is "\<lambda>ks f. (map_of (List.map_filter (\<lambda>k. let fk = f k in if fk = empty_table then None else Some (k, fk)) ks))" .
 
 lemma lookup_tabulate:
   "distinct xs \<Longrightarrow> lookup (mrtabulate xs f) x = (if x \<in> set xs then f x else empty_table)"
   unfolding lookup_default_def lookup_def
   by transfer (auto simp: Let_def map_filter_def map_of_eq_None_iff o_def image_image dest!: map_of_SomeD
       split: if_splits option.splits)
 
 definition update_matchP :: "nat \<Rightarrow> \<I> \<Rightarrow> mregex \<Rightarrow> mregex list \<Rightarrow> event_data table list \<Rightarrow> ts \<Rightarrow>
   event_data mr\<delta>aux \<Rightarrow> event_data table \<times> event_data mr\<delta>aux" where
   "update_matchP n I mr mrs rels nt aux =
     (let aux = (case [(t, mrtabulate mrs (\<lambda>mr.
         r\<delta> id rel rels mr \<union> (if t = nt then r\<epsilon>_strict n rels mr else {}))).
       (t, rel) \<leftarrow> aux, enat (nt - t) \<le> right I]
       of [] \<Rightarrow> [(nt, mrtabulate mrs (r\<epsilon>_strict n rels))]
       | x # aux' \<Rightarrow> (if fst x = nt then x # aux'
                      else (nt, mrtabulate mrs (r\<epsilon>_strict n rels)) # x # aux'))
     in (foldr (\<union>) [lookup rel mr. (t, rel) \<leftarrow> aux, left I \<le> nt - t] {}, aux))"
 
 definition update_matchF_base where
   "update_matchF_base n I mr mrs rels nt =
      (let X = mrtabulate mrs (l\<epsilon>_strict n rels)
      in ([(nt, rels, if left I = 0 then lookup X mr else empty_table)], X))"
 
 definition update_matchF_step where
   "update_matchF_step I mr mrs nt = (\<lambda>(t, rels', rel) (aux', X).
      (let Y = mrtabulate mrs (l\<delta> id X rels')
      in ((t, rels', if mem (nt - t) I then rel \<union> lookup Y mr else rel) # aux', Y)))"
 
 definition update_matchF :: "nat \<Rightarrow> \<I> \<Rightarrow> mregex \<Rightarrow> mregex list \<Rightarrow> event_data table list \<Rightarrow> ts \<Rightarrow> event_data ml\<delta>aux \<Rightarrow> event_data ml\<delta>aux" where
   "update_matchF n I mr mrs rels nt aux =
      fst (foldr (update_matchF_step I mr mrs nt) aux (update_matchF_base n I mr mrs rels nt))"
 
 fun eval_matchF :: "\<I> \<Rightarrow> mregex \<Rightarrow> ts \<Rightarrow> event_data ml\<delta>aux \<Rightarrow> event_data table list \<times> event_data ml\<delta>aux" where
   "eval_matchF I mr nt [] = ([], [])"
 | "eval_matchF I mr nt ((t, rels, rel) # aux) = (if t + right I < nt then
     (let (xs, aux) = eval_matchF I mr nt aux in (rel # xs, aux)) else ([], (t, rels, rel) # aux))"
 
 primrec map_split where
   "map_split f [] = ([], [])"
 | "map_split f (x # xs) =
     (let (y, z) = f x; (ys, zs) = map_split f xs
     in (y # ys, z # zs))"
 
 fun eval_assignment :: "nat \<times> Formula.trm \<Rightarrow> event_data tuple \<Rightarrow> event_data tuple" where
   "eval_assignment (x, t) y = (y[x:=Some (meval_trm t y)])"
 
 fun eval_constraint0 :: "mconstraint \<Rightarrow> event_data \<Rightarrow> event_data \<Rightarrow> bool" where
   "eval_constraint0 MEq x y = (x = y)"
 | "eval_constraint0 MLess x y = (x < y)"
 | "eval_constraint0 MLessEq x y = (x \<le> y)"
 
 fun eval_constraint :: "Formula.trm \<times> bool \<times> mconstraint \<times> Formula.trm \<Rightarrow> event_data tuple \<Rightarrow> bool" where
   "eval_constraint (t1, p, c, t2) x = (eval_constraint0 c (meval_trm t1 x) (meval_trm t2 x) = p)"
 
 primrec (in maux) meval :: "nat \<Rightarrow> ts \<Rightarrow> Formula.database \<Rightarrow> ('msaux, 'muaux) mformula \<Rightarrow>
     event_data table list \<times> ('msaux, 'muaux) mformula" where
   "meval n t db (MRel rel) = ([rel], MRel rel)"
 | "meval n t db (MPred e ts) = (map (\<lambda>X. (\<lambda>f. Table.tabulate f 0 n) ` Option.these
     (match ts ` X)) (case Mapping.lookup db e of None \<Rightarrow> [{}] | Some xs \<Rightarrow> xs), MPred e ts)"
 | "meval n t db (MLet p m \<phi> \<psi>) =
     (let (xs, \<phi>) = meval m t db \<phi>; (ys, \<psi>) = meval n t (Mapping.update p (map (image (map the)) xs) db) \<psi>
     in (ys, MLet p m \<phi> \<psi>))"
 | "meval n t db (MAnd A_\<phi> \<phi> pos A_\<psi> \<psi> buf) =
     (let (xs, \<phi>) = meval n t db \<phi>; (ys, \<psi>) = meval n t db \<psi>;
       (zs, buf) = mbuf2_take (\<lambda>r1 r2. bin_join n A_\<phi> r1 pos A_\<psi> r2) (mbuf2_add xs ys buf)
     in (zs, MAnd A_\<phi> \<phi> pos A_\<psi> \<psi> buf))"
 | "meval n t db (MAndAssign \<phi> conf) =
     (let (xs, \<phi>) = meval n t db \<phi> in (map (\<lambda>r. eval_assignment conf ` r) xs, MAndAssign \<phi> conf))"
 | "meval n t db (MAndRel \<phi> conf) =
     (let (xs, \<phi>) = meval n t db \<phi> in (map (Set.filter (eval_constraint conf)) xs, MAndRel \<phi> conf))"
 | "meval n t db (MAnds A_pos A_neg L buf) =
     (let R = map (meval n t db) L in
     let buf = mbufn_add (map fst R) buf in
     let (zs, buf) = mbufn_take (\<lambda>xs zs. zs @ [mmulti_join n A_pos A_neg xs]) [] buf in
     (zs, MAnds A_pos A_neg (map snd R) buf))"
 | "meval n t db (MOr \<phi> \<psi> buf) =
     (let (xs, \<phi>) = meval n t db \<phi>; (ys, \<psi>) = meval n t db \<psi>;
       (zs, buf) = mbuf2_take (\<lambda>r1 r2. r1 \<union> r2) (mbuf2_add xs ys buf)
     in (zs, MOr \<phi> \<psi> buf))"
 | "meval n t db (MNeg \<phi>) =
     (let (xs, \<phi>) = meval n t db \<phi> in (map (\<lambda>r. (if r = empty_table then unit_table n else empty_table)) xs, MNeg \<phi>))"
 | "meval n t db (MExists \<phi>) =
     (let (xs, \<phi>) = meval (Suc n) t db \<phi> in (map (\<lambda>r. tl ` r) xs, MExists \<phi>))"
 | "meval n t db (MAgg g0 y \<omega> b f \<phi>) =
     (let (xs, \<phi>) = meval (b + n) t db \<phi> in (map (eval_agg n g0 y \<omega> b f) xs, MAgg g0 y \<omega> b f \<phi>))"
 | "meval n t db (MPrev I \<phi> first buf nts) =
     (let (xs, \<phi>) = meval n t db \<phi>;
       (zs, buf, nts) = mprev_next I (buf @ xs) (nts @ [t])
     in (if first then empty_table # zs else zs, MPrev I \<phi> False buf nts))"
 | "meval n t db (MNext I \<phi> first nts) =
     (let (xs, \<phi>) = meval n t db \<phi>;
       (xs, first) = (case (xs, first) of (_ # xs, True) \<Rightarrow> (xs, False) | a \<Rightarrow> a);
       (zs, _, nts) = mprev_next I xs (nts @ [t])
     in (zs, MNext I \<phi> first nts))"
 | "meval n t db (MSince args \<phi> \<psi> buf nts aux) =
     (let (xs, \<phi>) = meval n t db \<phi>; (ys, \<psi>) = meval n t db \<psi>;
       ((zs, aux), buf, nts) = mbuf2t_take (\<lambda>r1 r2 t (zs, aux).
         let (z, aux) = update_since args r1 r2 t aux
         in (zs @ [z], aux)) ([], aux) (mbuf2_add xs ys buf) (nts @ [t])
     in (zs, MSince args \<phi> \<psi> buf nts aux))"
 | "meval n t db (MUntil args \<phi> \<psi> buf nts aux) =
     (let (xs, \<phi>) = meval n t db \<phi>; (ys, \<psi>) = meval n t db \<psi>;
       (aux, buf, nts) = mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ [t]);
       (zs, aux) = eval_muaux args (case nts of [] \<Rightarrow> t | nt # _ \<Rightarrow> nt) aux
     in (zs, MUntil args \<phi> \<psi> buf nts aux))"
 | "meval n t db (MMatchP I mr mrs \<phi>s buf nts aux) =
     (let (xss, \<phi>s) = map_split id (map (meval n t db) \<phi>s);
       ((zs, aux), buf, nts) = mbufnt_take (\<lambda>rels t (zs, aux).
         let (z, aux) = update_matchP n I mr mrs rels t aux
         in (zs @ [z], aux)) ([], aux) (mbufn_add xss buf) (nts @ [t])
     in (zs, MMatchP I mr mrs \<phi>s buf nts aux))"
 | "meval n t db (MMatchF I mr mrs \<phi>s buf nts aux) =
     (let (xss, \<phi>s) = map_split id (map (meval n t db) \<phi>s);
       (aux, buf, nts) = mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ [t]);
       (zs, aux) = eval_matchF I mr (case nts of [] \<Rightarrow> t | nt # _ \<Rightarrow> nt) aux
     in (zs, MMatchF I mr mrs \<phi>s buf nts aux))"
 
 definition (in maux) mstep :: "Formula.database \<times> ts \<Rightarrow> ('msaux, 'muaux) mstate \<Rightarrow> (nat \<times> event_data table) list \<times> ('msaux, 'muaux) mstate" where
   "mstep tdb st =
      (let (xs, m) = meval (mstate_n st) (snd tdb) (fst tdb) (mstate_m st)
      in (List.enumerate (mstate_i st) xs,
       \<lparr>mstate_i = mstate_i st + length xs, mstate_m = m, mstate_n = mstate_n st\<rparr>))"
 
 subsection \<open>Verdict delay\<close>
 
 context fixes \<sigma> :: Formula.trace begin
 
 fun progress :: "(Formula.name \<rightharpoonup> nat) \<Rightarrow> Formula.formula \<Rightarrow> nat \<Rightarrow> nat" where
   "progress P (Formula.Pred e ts) j = (case P e of None \<Rightarrow> j | Some k \<Rightarrow> k)"
 | "progress P (Formula.Let p \<phi> \<psi>) j = progress (P(p \<mapsto> progress P \<phi> j)) \<psi> j"
 | "progress P (Formula.Eq t1 t2) j = j"
 | "progress P (Formula.Less t1 t2) j = j"
 | "progress P (Formula.LessEq t1 t2) j = j"
 | "progress P (Formula.Neg \<phi>) j = progress P \<phi> j"
 | "progress P (Formula.Or \<phi> \<psi>) j = min (progress P \<phi> j) (progress P \<psi> j)"
 | "progress P (Formula.And \<phi> \<psi>) j = min (progress P \<phi> j) (progress P \<psi> j)"
 | "progress P (Formula.Ands l) j = (if l = [] then j else Min (set (map (\<lambda>\<phi>. progress P \<phi> j) l)))"
 | "progress P (Formula.Exists \<phi>) j = progress P \<phi> j"
 | "progress P (Formula.Agg y \<omega> b f \<phi>) j = progress P \<phi> j"
 | "progress P (Formula.Prev I \<phi>) j = (if j = 0 then 0 else min (Suc (progress P \<phi> j)) j)"
 | "progress P (Formula.Next I \<phi>) j = progress P \<phi> j - 1"
 | "progress P (Formula.Since \<phi> I \<psi>) j = min (progress P \<phi> j) (progress P \<psi> j)"
 | "progress P (Formula.Until \<phi> I \<psi>) j =
     Inf {i. \<forall>k. k < j \<and> k \<le> min (progress P \<phi> j) (progress P \<psi> j) \<longrightarrow> \<tau> \<sigma> i + right I \<ge> \<tau> \<sigma> k}"
 | "progress P (Formula.MatchP I r) j = min_regex_default (progress P) r j"
 | "progress P (Formula.MatchF I r) j =
     Inf {i. \<forall>k. k < j \<and> k \<le> min_regex_default (progress P) r j \<longrightarrow> \<tau> \<sigma> i + right I \<ge> \<tau> \<sigma> k}"
 
 definition "progress_regex P = min_regex_default (progress P)"
 
 declare progress.simps[simp del]
 lemmas progress_simps[simp] = progress.simps[folded progress_regex_def[THEN fun_cong, THEN fun_cong]]
 
 end
 
 definition "pred_mapping Q = pred_fun (\<lambda>_. True) (pred_option Q)"
 definition "rel_mapping Q = rel_fun (=) (rel_option Q)"
 
 lemma pred_mapping_alt: "pred_mapping Q P = (\<forall>p \<in> dom P. Q (the (P p)))"
   unfolding pred_mapping_def pred_fun_def option.pred_set dom_def
   by (force split: option.splits)
 
 lemma rel_mapping_alt: "rel_mapping Q P P' = (dom P = dom P' \<and> (\<forall>p \<in> dom P. Q (the (P p)) (the (P' p))))"
   unfolding rel_mapping_def rel_fun_def rel_option_iff dom_def
   by (force split: option.splits)
 
 lemma rel_mapping_map_upd[simp]: "Q x y \<Longrightarrow> rel_mapping Q P P' \<Longrightarrow> rel_mapping Q (P(p \<mapsto> x)) (P'(p \<mapsto> y))"
   by (auto simp: rel_mapping_alt)
 
 lemma pred_mapping_map_upd[simp]: "Q x \<Longrightarrow> pred_mapping Q P \<Longrightarrow> pred_mapping Q (P(p \<mapsto> x))"
   by (auto simp: pred_mapping_alt)
 
 lemma pred_mapping_empty[simp]: "pred_mapping Q Map.empty"
   by (auto simp: pred_mapping_alt)
 
 lemma pred_mapping_mono: "pred_mapping Q P \<Longrightarrow> Q \<le> R \<Longrightarrow> pred_mapping R P"
   by (auto simp: pred_mapping_alt)
 
 lemma pred_mapping_mono_strong: "pred_mapping Q P \<Longrightarrow>
   (\<And>p. p \<in> dom P \<Longrightarrow> Q (the (P p)) \<Longrightarrow> R (the (P p))) \<Longrightarrow> pred_mapping R P"
   by (auto simp: pred_mapping_alt)
 
 lemma progress_mono_gen: "j \<le> j' \<Longrightarrow> rel_mapping (\<le>) P P' \<Longrightarrow> progress \<sigma> P \<phi> j \<le> progress \<sigma> P' \<phi> j'"
 proof (induction \<phi> arbitrary: P P')
   case (Pred e ts)
   then show ?case
     by (force simp: rel_mapping_alt dom_def split: option.splits)
 next
   case (Ands l)
   then show ?case
     by (auto simp: image_iff intro!: Min.coboundedI[THEN order_trans])
 next
   case (Until \<phi> I \<psi>)
   from Until(1,2)[of P P'] Until.prems show ?case
     by (cases "right I")
       (auto dest: trans_le_add1[OF \<tau>_mono] intro!: cInf_superset_mono)
 next
   case (MatchF I r)
   from MatchF(1)[of _ P P'] MatchF.prems show ?case
     by (cases "right I"; cases "regex.atms r = {}")
       (auto 0 3 simp: Min_le_iff progress_regex_def dest: trans_le_add1[OF \<tau>_mono]
         intro!: cInf_superset_mono elim!: less_le_trans order_trans)
 qed (force simp: Min_le_iff progress_regex_def split: option.splits)+
 
 lemma rel_mapping_reflp: "reflp Q \<Longrightarrow> rel_mapping Q P P"
   by (auto simp: rel_mapping_alt reflp_def)
 
 lemmas progress_mono = progress_mono_gen[OF _ rel_mapping_reflp[unfolded reflp_def], simplified]
 
 lemma progress_le_gen: "pred_mapping (\<lambda>x. x \<le> j) P \<Longrightarrow> progress \<sigma> P \<phi> j \<le> j"
 proof (induction \<phi> arbitrary: P)
   case (Pred e ts)
   then show ?case
     by (auto simp: pred_mapping_alt dom_def split: option.splits)
 next
   case (Ands l)
   then show ?case
     by (auto simp: image_iff intro!: Min.coboundedI[where a="progress \<sigma> P (hd l) j", THEN order_trans])
 next
   case (Until \<phi> I \<psi>)
   then show ?case
     by (cases "right I")
       (auto intro: trans_le_add1[OF \<tau>_mono] intro!: cInf_lower)
 next
   case (MatchF I r)
   then show ?case
     by (cases "right I")
       (auto intro: trans_le_add1[OF \<tau>_mono] intro!: cInf_lower)
 qed (force simp: Min_le_iff progress_regex_def split: option.splits)+
 
 lemma progress_le: "progress \<sigma> Map.empty \<phi> j \<le> j"
   using progress_le_gen[of _ Map.empty] by auto
 
 lemma progress_0_gen[simp]:
   "pred_mapping (\<lambda>x. x = 0) P \<Longrightarrow> progress \<sigma> P \<phi> 0 = 0"
   using progress_le_gen[of 0 P] by auto
 
 lemma progress_0[simp]:
   "progress \<sigma> Map.empty \<phi> 0 = 0"
   by (auto simp: pred_mapping_alt)
 
 definition max_mapping :: "('b \<Rightarrow> 'a option) \<Rightarrow> ('b \<Rightarrow> 'a option) \<Rightarrow> 'b \<Rightarrow> ('a :: linorder) option" where
   "max_mapping P P' x = (case (P x, P' x) of
     (None, None) \<Rightarrow> None
   | (Some x, None) \<Rightarrow> None
   | (None, Some x) \<Rightarrow> None
   | (Some x, Some y) \<Rightarrow> Some (max x y))"
 
 definition Max_mapping :: "('b \<Rightarrow> 'a option) set \<Rightarrow> 'b \<Rightarrow> ('a :: linorder) option" where
   "Max_mapping Ps x = (if (\<forall>P \<in> Ps. P x \<noteq> None) then Some (Max ((\<lambda>P. the (P x)) ` Ps)) else None)"
 
 lemma dom_max_mapping[simp]: "dom (max_mapping P1 P2) = dom P1 \<inter> dom P2"
   unfolding max_mapping_def by (auto split: option.splits)
 
 lemma dom_Max_mapping[simp]: "dom (Max_mapping X) = (\<Inter>P \<in> X. dom P)"
   unfolding Max_mapping_def by (auto split: if_splits)
 
 lemma Max_mapping_coboundedI:
   assumes "finite X" "\<forall>Q \<in> X. dom Q = dom P" "P \<in> X"
   shows "rel_mapping (\<le>) P (Max_mapping X)"
   unfolding rel_mapping_alt
 proof (intro conjI ballI)
   from assms(3) have "X \<noteq> {}" by auto
   then show "dom P = dom (Max_mapping X)" using assms(2) by auto
 next
   fix p
   assume "p \<in> dom P"
   with assms show "the (P p) \<le> the (Max_mapping X p)"
     by (force simp add: Max_mapping_def intro!: Max.coboundedI imageI)
 qed
 
 lemma rel_mapping_trans: "P OO Q \<le> R \<Longrightarrow>
   rel_mapping P P1 P2 \<Longrightarrow> rel_mapping Q P2 P3 \<Longrightarrow> rel_mapping R P1 P3"
   by (force simp: rel_mapping_alt dom_def set_eq_iff)
 
 abbreviation range_mapping :: "nat \<Rightarrow> nat \<Rightarrow> ('b \<Rightarrow> nat option) \<Rightarrow> bool" where
   "range_mapping i j P \<equiv> pred_mapping (\<lambda>x. i \<le> x \<and> x \<le> j) P"
 
 lemma range_mapping_relax:
   "range_mapping i j P \<Longrightarrow> i' \<le> i \<Longrightarrow> j' \<ge> j \<Longrightarrow> range_mapping i' j' P"
   by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)
 
 lemma range_mapping_max_mapping[simp]:
   "range_mapping i j1 P1 \<Longrightarrow> range_mapping i j2 P2 \<Longrightarrow> range_mapping i (max j1 j2) (max_mapping P1 P2)"
   by (auto simp: pred_mapping_alt dom_def set_eq_iff max_mapping_def split: option.splits)
 
 lemma range_mapping_Max_mapping[simp]:
   "finite X \<Longrightarrow> X \<noteq> {} \<Longrightarrow> \<forall>x\<in>X. range_mapping i (j x) (P x) \<Longrightarrow> range_mapping i (Max (j ` X)) (Max_mapping (P ` X))"
   by (force simp: pred_mapping_alt Max_mapping_def dom_def image_iff
       intro!: Max_ge_iff[THEN iffD2] split: if_splits)
 
 lemma pred_mapping_le:
   "pred_mapping ((\<le>) i) P1 \<Longrightarrow> rel_mapping (\<le>) P1 P2 \<Longrightarrow> pred_mapping ((\<le>) (i :: nat)) P2"
   by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)
 
 lemma pred_mapping_le':
   "pred_mapping ((\<le>) j) P1 \<Longrightarrow> i \<le> j \<Longrightarrow> rel_mapping (\<le>) P1 P2 \<Longrightarrow> pred_mapping ((\<le>) (i :: nat)) P2"
   by (force simp: rel_mapping_alt pred_mapping_alt dom_def set_eq_iff)
 
 lemma max_mapping_cobounded1: "dom P1 \<subseteq> dom P2 \<Longrightarrow> rel_mapping (\<le>) P1 (max_mapping P1 P2)"
   unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)
 
 lemma max_mapping_cobounded2: "dom P2 \<subseteq> dom P1 \<Longrightarrow> rel_mapping (\<le>) P2 (max_mapping P1 P2)"
   unfolding max_mapping_def rel_mapping_alt by (auto simp: dom_def split: option.splits)
 
 lemma max_mapping_fun_upd2[simp]:
   "max_mapping P1 (P2(p := y))(p \<mapsto> x) = (max_mapping P1 P2)(p \<mapsto> x)"
   by (auto simp: max_mapping_def)
 
 lemma rel_mapping_max_mapping_fun_upd: "dom P2 \<subseteq> dom P1 \<Longrightarrow> p \<in> dom P2 \<Longrightarrow> the (P2 p) \<le> y \<Longrightarrow>
   rel_mapping (\<le>) P2 (max_mapping P1 P2(p \<mapsto> y))"
   by (auto simp: rel_mapping_alt max_mapping_def split: option.splits)
 
 lemma progress_ge_gen: "Formula.future_bounded \<phi> \<Longrightarrow>
    \<exists>P j. dom P = S \<and> range_mapping i j P \<and> i \<le> progress \<sigma> P \<phi> j"
 proof (induction \<phi> arbitrary: i S)
   case (Pred e ts)
   then show ?case
     by (intro exI[of _ "\<lambda>e. if e \<in> S then Some i else None"])
       (auto split: option.splits if_splits simp: rel_mapping_alt pred_mapping_alt dom_def)
 next
   case (Let p \<phi> \<psi>)
   from Let.prems obtain P2 j2 where P2: "dom P2 = insert p S" "range_mapping i j2 P2"
     "i \<le> progress \<sigma> P2 \<psi> j2"
     by (atomize_elim, intro Let(2)) (force simp: pred_mapping_alt rel_mapping_alt dom_def)+
   from Let.prems obtain P1 j1 where P1: "dom P1 = S" "range_mapping (the (P2 p)) j1 P1"
     "the (P2 p) \<le> progress \<sigma> P1 \<phi> j1"
     by (atomize_elim, intro Let(1)) auto
   let ?P12 = "max_mapping P1 P2"
   from P1 P2 have le1: "progress \<sigma> P1 \<phi> j1 \<le> progress \<sigma> (?P12(p := P1 p)) \<phi> (max j1 j2)"
     by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)
   from P1 P2 have le2: "progress \<sigma> P2 \<psi> j2 \<le> progress \<sigma> (?P12(p \<mapsto> progress \<sigma> P1 \<phi> j1)) \<psi> (max j1 j2)"
     by (intro progress_mono_gen) (auto simp: rel_mapping_alt max_mapping_def)
   show ?case
     unfolding progress.simps
   proof (intro exI[of _ "?P12(p := P1 p)"] exI[of _ "max j1 j2"] conjI)
     show "dom (?P12(p := P1 p)) = S"
       using P1 P2 by (auto simp: dom_def max_mapping_def)
   next
     show "range_mapping i (max j1 j2) (?P12(p := P1 p))"
       using P1 P2 by (force simp add: pred_mapping_alt dom_def max_mapping_def split: option.splits)
   next
     have "i \<le> progress \<sigma> P2 \<psi> j2" by fact
     also have "... \<le> progress \<sigma> (?P12(p \<mapsto> progress \<sigma> P1 \<phi> j1)) \<psi> (max j1 j2)"
       using le2 by blast
     also have "... \<le> progress \<sigma> (?P12(p := P1 p)(p\<mapsto>progress \<sigma> (?P12(p := P1 p)) \<phi> (max j1 j2))) \<psi> (max j1 j2)"
       by (auto intro!: progress_mono_gen simp: le1 rel_mapping_alt)
     finally show "i \<le> ..." .
   qed
 next
   case (Eq _ _)
   then show ?case
     by (intro exI[of _ "\<lambda>e. if e \<in> S then Some i else None"]) (auto split: if_splits simp: pred_mapping_alt)
 next
   case (Less _ _)
   then show ?case
     by (intro exI[of _ "\<lambda>e. if e \<in> S then Some i else None"]) (auto split: if_splits simp: pred_mapping_alt)
 next
   case (LessEq _ _)
   then show ?case
     by (intro exI[of _ "\<lambda>e. if e \<in> S then Some i else None"]) (auto split: if_splits simp: pred_mapping_alt)
 next
   case (Or \<phi>1 \<phi>2)
   from Or(3) obtain P1 j1 where P1: "dom P1 = S" "range_mapping i j1 P1"  "i \<le> progress \<sigma> P1 \<phi>1 j1"
     using Or(1)[of S i] by auto
   moreover
   from Or(3) obtain P2 j2 where P2: "dom P2 = S" "range_mapping i j2 P2" "i \<le> progress \<sigma> P2 \<phi>2 j2"
     using Or(2)[of S i] by auto
   ultimately have "i \<le> progress \<sigma> (max_mapping P1 P2) (Formula.Or \<phi>1 \<phi>2) (max j1 j2)"
     by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)
   with P1 P2 show ?case by (intro exI[of _ "max_mapping P1 P2"] exI[of _ "max j1 j2"]) auto
 next
   case (And \<phi>1 \<phi>2)
   from And(3) obtain P1 j1 where P1: "dom P1 = S" "range_mapping i j1 P1"  "i \<le> progress \<sigma> P1 \<phi>1 j1"
     using And(1)[of S i] by auto
   moreover
   from And(3) obtain P2 j2 where P2: "dom P2 = S" "range_mapping i j2 P2" "i \<le> progress \<sigma> P2 \<phi>2 j2"
     using And(2)[of S i] by auto
   ultimately have "i \<le> progress \<sigma> (max_mapping P1 P2) (Formula.And \<phi>1 \<phi>2) (max j1 j2)"
     by (auto 0 3 elim!: order.trans[OF _ progress_mono_gen] intro: max_mapping_cobounded1 max_mapping_cobounded2)
   with P1 P2 show ?case by (intro exI[of _ "max_mapping P1 P2"] exI[of _ "max j1 j2"]) auto
 next
   case (Ands l)
   show ?case proof (cases "l = []")
     case True
     then show ?thesis
       by (intro exI[of _ "\<lambda>e. if e \<in> S then Some i else None"])
         (auto split: if_splits simp: pred_mapping_alt)
   next
     case False
     then obtain \<phi> where "\<phi> \<in> set l" by (cases l) auto
     from Ands.prems have "\<forall>\<phi>\<in>set l. Formula.future_bounded \<phi>"
       by (simp add: list.pred_set)
     { fix \<phi>
       assume "\<phi> \<in> set l"
       with Ands.prems obtain P j where "dom P = S" "range_mapping i j P" "i \<le> progress \<sigma> P \<phi> j"
         by (atomize_elim, intro Ands(1)[of \<phi> S i]) (auto simp: list.pred_set)
       then have "\<exists>Pj. dom (fst Pj) = S \<and> range_mapping i (snd Pj) (fst Pj) \<and> i \<le> progress \<sigma> (fst Pj) \<phi> (snd Pj)"
         (is "\<exists>Pj. ?P Pj")
         by (intro exI[of _ "(P, j)"]) auto
     }
     then have "\<forall>\<phi>\<in>set l. \<exists>Pj. dom (fst Pj) = S \<and> range_mapping i (snd Pj) (fst Pj) \<and> i \<le> progress \<sigma> (fst Pj) \<phi> (snd Pj)"
       (is "\<forall>\<phi>\<in>set l. \<exists>Pj. ?P Pj \<phi>")
       by blast
     with Ands(1) Ands.prems False have "\<exists>Pjf. \<forall>\<phi>\<in>set l. ?P (Pjf \<phi>) \<phi>"
       by (auto simp: Ball_def intro: choice)
     then obtain Pjf where Pjf: "\<forall>\<phi>\<in>set l. ?P (Pjf \<phi>) \<phi>" ..
     define Pf where "Pf = fst o Pjf"
     define jf where "jf = snd o Pjf"
     have *: "dom (Pf \<phi>) = S" "range_mapping i (jf \<phi>) (Pf \<phi>)" "i \<le> progress \<sigma> (Pf \<phi>) \<phi> (jf \<phi>)"
       if "\<phi> \<in> set l" for \<phi>
       using Pjf[THEN bspec, OF that] unfolding Pf_def jf_def by auto
     with False show ?thesis
       unfolding progress.simps eq_False[THEN iffD2, OF False] if_False
       by ((subst Min_ge_iff; simp add: False),
           intro exI[where x="MAX \<phi>\<in>set l. jf \<phi>"] exI[where x="Max_mapping (Pf ` set l)"]
           conjI ballI order.trans[OF *(3) progress_mono_gen] Max_mapping_coboundedI)
         (auto simp: False *[OF \<open>\<phi> \<in> set l\<close>] \<open>\<phi> \<in> set l\<close>)
   qed
 next
   case (Exists \<phi>)
   then show ?case by simp
 next
   case (Prev I \<phi>)
   then obtain P j where "dom P = S" "range_mapping i j P" "i \<le> progress \<sigma> P \<phi> j"
     by (atomize_elim, intro Prev(1)) (auto simp: pred_mapping_alt dom_def)
   with Prev(2) have
     "dom P = S \<and> range_mapping i (max i j) P \<and> i \<le> progress \<sigma> P (formula.Prev I \<phi>) (max i j)"
     by (auto simp: le_Suc_eq max_def pred_mapping_alt split: if_splits
         elim: order.trans[OF _ progress_mono])
   then show ?case by blast
 next
   case (Next I \<phi>)
   then obtain P j where "dom P = S" "range_mapping (Suc i) j P" "Suc i \<le> progress \<sigma> P \<phi> j"
     by (atomize_elim, intro Next(1)) (auto simp: pred_mapping_alt dom_def)
   then show ?case
     by (intro exI[of _ P] exI[of _ j]) (auto 0 3 simp: pred_mapping_alt dom_def)
 next
   case (Since \<phi>1 I \<phi>2)
   from Since(3) obtain P1 j1 where P1: "dom P1 = S" "range_mapping i j1 P1"  "i \<le> progress \<sigma> P1 \<phi>1 j1"
     using Since(1)[of S i] by auto
   moreover
   from Since(3) obtain P2 j2 where P2: "dom P2 = S" "range_mapping i j2 P2" "i \<le> progress \<sigma> P2 \<phi>2 j2"
     using Since(2)[of S i] by auto
   ultimately have "i \<le> progress \<sigma> (max_mapping P1 P2) (Formula.Since \<phi>1 I \<phi>2) (max j1 j2)"
     by (auto elim!: order.trans[OF _ progress_mono_gen] simp: max_mapping_cobounded1 max_mapping_cobounded2)
   with P1 P2 show ?case by (intro exI[of _ "max_mapping P1 P2"] exI[of _ "max j1 j2"])
       (auto elim!: pred_mapping_le intro: max_mapping_cobounded1)
 next
   case (Until \<phi>1 I \<phi>2)
   from Until.prems obtain b where [simp]: "right I = enat b"
     by (cases "right I") (auto)
   obtain i' where "i < i'" and "\<tau> \<sigma> i + b + 1 \<le> \<tau> \<sigma> i'"
     using ex_le_\<tau>[where x="\<tau> \<sigma> i + b + 1"] by (auto simp add: less_eq_Suc_le)
   then have 1: "\<tau> \<sigma> i + b < \<tau> \<sigma> i'" by simp
   from Until.prems obtain P1 j1 where P1: "dom P1 = S" "range_mapping (Suc i') j1 P1" "Suc i' \<le> progress \<sigma> P1 \<phi>1 j1"
     by (atomize_elim, intro Until(1)) (auto simp: pred_mapping_alt dom_def)
   from Until.prems obtain P2 j2 where P2: "dom P2 = S" "range_mapping (Suc i') j2 P2" "Suc i' \<le> progress \<sigma> P2 \<phi>2 j2"
     by (atomize_elim, intro Until(2)) (auto simp: pred_mapping_alt dom_def)
   let ?P12 = "max_mapping P1 P2"
   have "i \<le> progress \<sigma> ?P12 (Formula.Until \<phi>1 I \<phi>2) (max j1 j2)"
     unfolding progress.simps
   proof (intro cInf_greatest, goal_cases nonempty greatest)
     case nonempty
     then show ?case
       by (auto simp: trans_le_add1[OF \<tau>_mono] intro!: exI[of _ "max j1 j2"])
   next
     case (greatest x)
     from P1(2,3) have "i' < j1"
       by (auto simp: less_eq_Suc_le intro!: progress_le_gen elim!: order.trans pred_mapping_mono_strong)
     then have "i' < max j1 j2" by simp
     have "progress \<sigma> P1 \<phi>1 j1 \<le> progress \<sigma> ?P12 \<phi>1 (max j1 j2)"
       using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded1)
     moreover have "progress \<sigma> P2 \<phi>2 j2 \<le> progress \<sigma> ?P12 \<phi>2 (max j1 j2)"
       using P1(1) P2(1) by (auto intro!: progress_mono_gen max_mapping_cobounded2)
     ultimately have "i' \<le> min (progress \<sigma> ?P12 \<phi>1 (max j1 j2)) (progress \<sigma> ?P12 \<phi>2 (max j1 j2))"
       using P1(3) P2(3) by simp
     with greatest \<open>i' < max j1 j2\<close> have "\<tau> \<sigma> i' \<le> \<tau> \<sigma> x + b"
       by simp
     with 1 have "\<tau> \<sigma> i < \<tau> \<sigma> x" by simp
     then show ?case by (auto dest!: less_\<tau>D)
   qed
   with P1 P2 \<open>i < i'\<close> show ?case
     by (intro exI[of _ "max_mapping P1 P2"] exI[of _ "max j1 j2"]) (auto simp: range_mapping_relax)
 next
   case (MatchP I r)
   then show ?case
   proof (cases "regex.atms r = {}")
     case True
     with MatchP.prems show ?thesis
       unfolding progress.simps
       by (intro exI[of _ "\<lambda>e. if e \<in> S then Some i else None"] exI[of _ i])
         (auto split: if_splits simp: pred_mapping_alt regex.pred_set)
   next
     case False
     define pick where "pick = (\<lambda>\<phi>. SOME Pj. dom (fst Pj) = S \<and> range_mapping i (snd Pj) (fst Pj) \<and>
        i \<le> progress \<sigma> (fst Pj) \<phi> (snd Pj))"
     let ?pickP = "fst o pick" let ?pickj = "snd o pick"
     from MatchP have pick: "\<phi> \<in> regex.atms r \<Longrightarrow> dom (?pickP \<phi>) = S \<and>
       range_mapping i (?pickj \<phi>) (?pickP \<phi>) \<and> i \<le> progress \<sigma> (?pickP \<phi>) \<phi> (?pickj \<phi>)" for \<phi>
       unfolding pick_def o_def future_bounded.simps regex.pred_set
       by (intro someI_ex[where P = "\<lambda>Pj. dom (fst Pj) = S \<and> range_mapping i (snd Pj) (fst Pj) \<and>
          i \<le> progress \<sigma> (fst Pj) \<phi> (snd Pj)"]) auto
     with False show ?thesis
       unfolding progress.simps
       by (intro exI[of _ "Max_mapping (?pickP ` regex.atms r)"] exI[of _ "Max (?pickj ` regex.atms r)"])
         (auto simp: Max_mapping_coboundedI
           order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen])
   qed
 next
   case (MatchF I r)
   from MatchF.prems obtain b where [simp]: "right I = enat b"
     by auto
   obtain i' where i': "i < i'" "\<tau> \<sigma> i + b + 1 \<le> \<tau> \<sigma> i'"
     using ex_le_\<tau>[where x="\<tau> \<sigma> i + b + 1"] by (auto simp add: less_eq_Suc_le)
   then have 1: "\<tau> \<sigma> i + b < \<tau> \<sigma> i'" by simp
   have ix: "i \<le> x" if "\<tau> \<sigma> i' \<le> b + \<tau> \<sigma> x" "b + \<tau> \<sigma> i < \<tau> \<sigma> i'" for x
     using less_\<tau>D[of \<sigma> i] that less_le_trans by fastforce
   show ?case
   proof (cases "regex.atms r = {}")
     case True
     with MatchF.prems i' ix show ?thesis
       unfolding progress.simps
       by (intro exI[of _ "\<lambda>e. if e \<in> S then Some (Suc i') else None"] exI[of _ "Suc i'"])
         (auto split: if_splits simp: pred_mapping_alt regex.pred_set add.commute less_Suc_eq
           intro!: cInf_greatest dest!: spec[of _ i'] less_imp_le[THEN \<tau>_mono, of _ i' \<sigma>])
   next
     case False
     then obtain \<phi> where \<phi>: "\<phi> \<in> regex.atms r" by auto
     define pick where "pick = (\<lambda>\<phi>. SOME Pj. dom (fst Pj) = S \<and> range_mapping (Suc i') (snd Pj) (fst Pj) \<and>
       Suc i' \<le> progress \<sigma> (fst Pj) \<phi> (snd Pj))"
     define pickP where "pickP = fst o pick" define pickj where "pickj = snd o pick"
     from MatchF have pick: "\<phi> \<in> regex.atms r \<Longrightarrow> dom (pickP \<phi>) = S \<and>
     range_mapping (Suc i') (pickj \<phi>) (pickP \<phi>) \<and> Suc i' \<le> progress \<sigma> (pickP \<phi>) \<phi> (pickj \<phi>)" for \<phi>
       unfolding pick_def o_def future_bounded.simps regex.pred_set pickj_def pickP_def
       by (intro someI_ex[where P = "\<lambda>Pj. dom (fst Pj) = S \<and> range_mapping (Suc i') (snd Pj) (fst Pj) \<and>
        Suc i' \<le> progress \<sigma> (fst Pj) \<phi> (snd Pj)"]) auto
     let ?P = "Max_mapping (pickP ` regex.atms r)" let ?j = "Max (pickj ` regex.atms r)"
     from pick[OF \<phi>] False \<phi> have "Suc i' \<le> ?j"
       by (intro order_trans[OF pick[THEN conjunct2, THEN conjunct2], OF \<phi>] order_trans[OF progress_le_gen])
         (auto simp: Max_ge_iff dest: range_mapping_relax[of _ _ _ 0, OF _ _ order_refl, simplified])
     moreover
     note i' 1 ix
     moreover
     from MatchF.prems have "Regex.pred_regex Formula.future_bounded r"
       by auto
     ultimately show ?thesis using \<tau>_mono[of _ ?j \<sigma>] less_\<tau>D[of \<sigma> i] pick False
       by (intro exI[of _ "?j"]  exI[of _ "?P"])
         (auto 0 3 intro!: cInf_greatest
           order_trans[OF le_SucI[OF order_refl] order_trans[OF pick[THEN conjunct2, THEN conjunct2] progress_mono_gen]]
           range_mapping_Max_mapping[OF _ _ ballI[OF range_mapping_relax[of "Suc i'" _ _ i, OF _ _ order_refl]]]
           simp: ac_simps Suc_le_eq trans_le_add2 Max_mapping_coboundedI progress_regex_def
           dest: spec[of _ "i'"] spec[of _ ?j])
   qed
 qed (auto split: option.splits)
 
 lemma progress_ge: "Formula.future_bounded \<phi> \<Longrightarrow> \<exists>j. i \<le> progress \<sigma> Map.empty \<phi> j"
   using progress_ge_gen[of \<phi> "{}" i \<sigma>]
   by auto
 
 lemma cInf_restrict_nat:
   fixes x :: nat
   assumes "x \<in> A"
   shows "Inf A = Inf {y \<in> A. y \<le> x}"
   using assms by (auto intro!: antisym intro: cInf_greatest cInf_lower Inf_nat_def1)
 
 lemma progress_time_conv:
   assumes "\<forall>i<j. \<tau> \<sigma> i = \<tau> \<sigma>' i"
   shows "progress \<sigma> P \<phi> j = progress \<sigma>' P \<phi> j"
   using assms proof (induction \<phi> arbitrary: P)
   case (Until \<phi>1 I \<phi>2)
   have *: "i \<le> j - 1 \<longleftrightarrow> i < j" if "j \<noteq> 0" for i
     using that by auto
   with Until show ?case
   proof (cases "right I")
     case (enat b)
     then show ?thesis
     proof (cases "j")
       case (Suc n)
       with enat * Until show ?thesis
         using \<tau>_mono[THEN trans_le_add1]
         by (auto 8 0
             intro!: box_equals[OF arg_cong[where f=Inf]
               cInf_restrict_nat[symmetric, where x=n] cInf_restrict_nat[symmetric, where x=n]])
     qed simp
   qed simp
 next
   case (MatchF I r)
   have *: "i \<le> j - 1 \<longleftrightarrow> i < j" if "j \<noteq> 0" for i
     using that by auto
   with MatchF show ?case using \<tau>_mono[THEN trans_le_add1]
     by (cases "right I"; cases j)
       ((auto 6 0 simp: progress_le_gen progress_regex_def intro!: box_equals[OF arg_cong[where f=Inf]
             cInf_restrict_nat[symmetric, where x="j-1"] cInf_restrict_nat[symmetric, where x="j-1"]]) [])+
 qed (auto simp: progress_regex_def)
 
 lemma Inf_UNIV_nat: "(Inf UNIV :: nat) = 0"
   by (simp add: cInf_eq_minimum)
 
 lemma progress_prefix_conv:
   assumes "prefix_of \<pi> \<sigma>" and "prefix_of \<pi> \<sigma>'"
   shows "progress \<sigma> P \<phi> (plen \<pi>) = progress \<sigma>' P \<phi> (plen \<pi>)"
   using assms by (auto intro: progress_time_conv \<tau>_prefix_conv)
 
 lemma bounded_rtranclp_mono:
   fixes n :: "'x :: linorder"
   assumes "\<And>i j. R i j \<Longrightarrow> j < n \<Longrightarrow> S i j" "\<And>i j. R i j \<Longrightarrow> i \<le> j"
   shows "rtranclp R i j \<Longrightarrow> j < n \<Longrightarrow> rtranclp S i j"
 proof (induct rule: rtranclp_induct)
   case (step y z)
   then show ?case
     using assms(1,2)[of y z]
     by (auto elim!: rtrancl_into_rtrancl[to_pred, rotated])
 qed auto
 
 lemma sat_prefix_conv_gen:
   assumes "prefix_of \<pi> \<sigma>" and "prefix_of \<pi> \<sigma>'"
   shows "i < progress \<sigma> P \<phi> (plen \<pi>) \<Longrightarrow> dom V = dom V' \<Longrightarrow> dom P = dom V \<Longrightarrow>
     pred_mapping (\<lambda>x. x \<le> plen \<pi>) P \<Longrightarrow>
     (\<And>p i \<phi>. p \<in> dom V \<Longrightarrow> i < the (P p) \<Longrightarrow> the (V p) i = the (V' p) i) \<Longrightarrow>
     Formula.sat \<sigma> V v i \<phi> \<longleftrightarrow> Formula.sat \<sigma>' V' v i \<phi>"
 proof (induction \<phi> arbitrary: P V V' v i)
   case (Pred e ts)
   from Pred.prems(1,4) have "i < plen \<pi>"
     by (blast intro!: order.strict_trans2 progress_le_gen)
   show ?case proof (cases "V e")
     case None
     then have "V' e = None" using \<open>dom V = dom V'\<close> by auto
     with None \<Gamma>_prefix_conv[OF assms(1,2) \<open>i < plen \<pi>\<close>] show ?thesis by simp
   next
     case (Some a)
     obtain a' where "V' e = Some a'" using Some \<open>dom V = dom V'\<close> by auto
     then have "i < the (P e)"
       using Pred.prems(1-3) by (auto split: option.splits)
     then have "the (V e) i = the (V' e) i"
       using Some by (intro Pred.prems(5)) (simp_all add: domI)
     with Some \<open>V' e = Some a'\<close> show ?thesis by simp
   qed
 next
   case (Let p \<phi> \<psi>)
   let ?V = "\<lambda>V \<sigma>. (V(p \<mapsto> \<lambda>i. {v. length v = Formula.nfv \<phi> \<and> Formula.sat \<sigma> V v i \<phi>}))"
   show ?case unfolding sat.simps proof (rule Let.IH(2))
     from Let.prems show "i < progress \<sigma> (P(p \<mapsto> progress \<sigma> P \<phi> (plen \<pi>))) \<psi> (plen \<pi>)"
       by simp
     from Let.prems show "dom (?V V \<sigma>) = dom (?V V' \<sigma>')"
       by simp
     from Let.prems show "dom (P(p \<mapsto> progress \<sigma> P \<phi> (plen \<pi>))) = dom (?V V \<sigma>)"
       by simp
     from Let.prems show "pred_mapping (\<lambda>x. x \<le> plen \<pi>) (P(p \<mapsto> progress \<sigma> P \<phi> (plen \<pi>)))"
       by (auto intro!: pred_mapping_map_upd elim!: progress_le_gen)
   next
     fix p' i \<phi>'
     assume 1: "p' \<in> dom (?V V \<sigma>)" and 2: "i < the ((P(p \<mapsto> progress \<sigma> P \<phi> (plen \<pi>))) p')"
     show "the (?V V \<sigma> p') i = the (?V V' \<sigma>' p') i" proof (cases "p' = p")
       case True
       with Let 2 show ?thesis by auto
     next
       case False
       with 1 2 show ?thesis by (auto intro!: Let.prems(5))
     qed
   qed
 next
   case (Eq t1 t2)
   show ?case by simp
 next
   case (Neg \<phi>)
   then show ?case by simp
 next
   case (Or \<phi>1 \<phi>2)
   then show ?case by auto
 next
   case (Ands l)
   from Ands.prems have "\<forall>\<phi>\<in>set l. i < progress \<sigma> P \<phi> (plen \<pi>)"
     by (cases l) simp_all
   with Ands show ?case unfolding sat_Ands by blast
 next
   case (Exists \<phi>)
   then show ?case by simp
 next
   case (Prev I \<phi>)
   with \<tau>_prefix_conv[OF assms(1,2)] show ?case
     by (cases i) (auto split: if_splits)
 next
   case (Next I \<phi>)
   then have "Suc i < plen \<pi>"
     by (auto intro: order.strict_trans2[OF _ progress_le_gen[of _ P \<sigma> \<phi>]])
   with Next.prems \<tau>_prefix_conv[OF assms(1,2)] show ?case
     unfolding sat.simps
     by (intro conj_cong Next) auto
 next
   case (Since \<phi>1 I \<phi>2)
   then have "i < plen \<pi>"
     by (auto elim!: order.strict_trans2[OF _ progress_le_gen])
   with Since.prems \<tau>_prefix_conv[OF assms(1,2)] show ?case
     unfolding sat.simps
     by (intro conj_cong ex_cong ball_cong Since) auto
 next
   case (Until \<phi>1 I \<phi>2)
   from Until.prems obtain b where right[simp]: "right I = enat b"
     by (cases "right I") (auto simp add: Inf_UNIV_nat)
   from Until.prems obtain j where "\<tau> \<sigma> i + b + 1 \<le> \<tau> \<sigma> j"
     "j \<le> progress \<sigma> P \<phi>1 (plen \<pi>)" "j \<le> progress \<sigma> P \<phi>2 (plen \<pi>)"
     by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ "i"]
         dest!: le_cInf_iff[THEN iffD1, rotated -1])
   then have 1: "k < progress \<sigma> P \<phi>1 (plen \<pi>)" and 2: "k < progress \<sigma> P \<phi>2 (plen \<pi>)"
     if "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + b" for k
     using that by (fastforce elim!: order.strict_trans2[rotated] intro: less_\<tau>D[of \<sigma>])+
   have 3: "k < plen \<pi>" if "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + b" for k
     using 1[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])
 
   from Until.prems have "i < progress \<sigma>' P (Formula.Until \<phi>1 I \<phi>2) (plen \<pi>)"
     unfolding progress_prefix_conv[OF assms(1,2)] by blast
   then obtain j where "\<tau> \<sigma>' i + b + 1 \<le> \<tau> \<sigma>' j"
     "j \<le> progress \<sigma>' P \<phi>1 (plen \<pi>)" "j \<le> progress \<sigma>' P \<phi>2 (plen \<pi>)"
     by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le intro: Suc_leI dest: spec[of _ "i"]
         dest!: le_cInf_iff[THEN iffD1, rotated -1])
   then have 11: "k < progress \<sigma> P \<phi>1 (plen \<pi>)" and 21: "k < progress \<sigma> P \<phi>2 (plen \<pi>)"
     if "\<tau> \<sigma>' k \<le> \<tau> \<sigma>' i + b" for k
     unfolding progress_prefix_conv[OF assms(1,2)]
     using that by (fastforce elim!: order.strict_trans2[rotated] intro: less_\<tau>D[of \<sigma>'])+
   have 31: "k < plen \<pi>" if "\<tau> \<sigma>' k \<le> \<tau> \<sigma>' i + b" for k
     using 11[OF that] Until(6) by (auto simp only: less_eq_Suc_le order.trans[OF _ progress_le_gen])
   show ?case unfolding sat.simps
   proof ((intro ex_cong iffI; elim conjE), goal_cases LR RL)
     case (LR j)
     with Until(1)[OF 1] Until(2)[OF 2] \<tau>_prefix_conv[OF assms(1,2) 3] Until.prems show ?case
       by (auto 0 4 simp: le_diff_conv add.commute dest: less_imp_le order.trans[OF \<tau>_mono, rotated])
   next
     case (RL j)
     with Until(1)[OF 11] Until(2)[OF 21] \<tau>_prefix_conv[OF assms(1,2) 31] Until.prems show ?case
       by (auto 0 4 simp: le_diff_conv add.commute dest: less_imp_le order.trans[OF \<tau>_mono, rotated])
   qed
 next
   case (MatchP I r)
   then have "i < plen \<pi>"
     by (force simp: pred_mapping_alt elim!: order.strict_trans2[OF _ progress_le_gen])
   with MatchP.prems \<tau>_prefix_conv[OF assms(1,2)] show ?case
     unfolding sat.simps
     by (intro ex_cong conj_cong match_cong_strong MatchP) (auto simp: progress_regex_def split: if_splits)
 next
   case (MatchF I r)
   from MatchF.prems obtain b where right[simp]: "right I = enat b"
     by (cases "right I") (auto simp add: Inf_UNIV_nat)
   show ?case
   proof (cases "regex.atms r = {}")
     case True
     from MatchF.prems(1) obtain j where "\<tau> \<sigma> i + b + 1 \<le> \<tau> \<sigma> j" "j \<le> plen \<pi>"
       by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])
     then have 1: "k < plen \<pi>" if "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + b" for k
       by (meson \<tau>_mono discrete not_le order.strict_trans2 that)
     from MatchF.prems have "i < progress \<sigma>' P (Formula.MatchF I r) (plen \<pi>)"
       unfolding progress_prefix_conv[OF assms(1,2)] by blast
     then obtain j where "\<tau> \<sigma>' i + b + 1 \<le> \<tau> \<sigma>' j" "j \<le> plen \<pi>"
       by atomize_elim (auto 0 4 simp add: less_eq_Suc_le not_le dest!: le_cInf_iff[THEN iffD1, rotated -1])
     then have 2: "k < plen \<pi>" if "\<tau> \<sigma>' k \<le> \<tau> \<sigma>' i + b" for k
       by (meson \<tau>_mono discrete not_le order.strict_trans2 that)
     from MatchF.prems(1,4) True show ?thesis
       unfolding sat.simps conj_commute[of "left I \<le> _" "_ \<le> _"]
     proof (intro ex_cong conj_cong match_cong_strong, goal_cases left right sat)
       case (left j)
       then show ?case
         by (intro iffI)
           ((subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 1, symmetric]; auto elim: order.trans[OF \<tau>_mono, rotated]),
             (subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \<tau>_mono, rotated]))
     next
       case (right j)
       then show ?case
         by (intro iffI)
           ((subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \<tau>_mono, rotated]),
             (subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 2]; auto elim: order.trans[OF \<tau>_mono, rotated]))
     qed auto
   next
     case False
     from MatchF.prems(1) False obtain j where "\<tau> \<sigma> i + b + 1 \<le> \<tau> \<sigma> j" "(\<forall>x\<in>regex.atms r. j \<le> progress \<sigma> P x (plen \<pi>))"
       by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def
         dest!: le_cInf_iff[THEN iffD1, rotated -1])
     then have 1: "\<phi> \<in> regex.atms r \<Longrightarrow> k < progress \<sigma> P \<phi> (plen \<pi>)" if "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + b" for k \<phi>
       using that
       by (fastforce elim!: order.strict_trans2[rotated] intro: less_\<tau>D[of \<sigma>])
     then have 2: "k < plen \<pi>" if "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + b" "regex.atms r \<noteq> {}" for k
       using that
       by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \<sigma>], of k])
 
     from MatchF.prems have "i < progress \<sigma>' P (Formula.MatchF I r) (plen \<pi>)"
       unfolding progress_prefix_conv[OF assms(1,2)] by blast
     with False obtain j where "\<tau> \<sigma>' i + b + 1 \<le> \<tau> \<sigma>' j" "(\<forall>x\<in>regex.atms r. j \<le> progress \<sigma>' P x (plen \<pi>))"
       by atomize_elim (auto 0 6 simp add: less_eq_Suc_le not_le progress_regex_def
         dest!: le_cInf_iff[THEN iffD1, rotated -1])
     then have 11:  "\<phi> \<in> regex.atms r \<Longrightarrow> k < progress \<sigma> P \<phi> (plen \<pi>)" if "\<tau> \<sigma>' k \<le> \<tau> \<sigma>' i + b" for k \<phi>
       using that using progress_prefix_conv[OF assms(1,2)]
       by (auto 0 3 elim!: order.strict_trans2[rotated] intro: less_\<tau>D[of \<sigma>'])
     have 21: "k < plen \<pi>" if "\<tau> \<sigma>' k \<le> \<tau> \<sigma>' i + b" for k
       using 11[OF that(1)] False by (fastforce intro: order.strict_trans2[OF _ progress_le_gen[OF MatchF(5), of \<sigma>], of k])
     show ?thesis unfolding sat.simps conj_commute[of "left I \<le> _" "_ \<le> _"]
     proof ((intro ex_cong conj_cong match_cong_strong MatchF(1)[OF _ _ MatchF(3-6)]; assumption?), goal_cases right left progress)
       case (right j)
       with False show ?case
         by (intro iffI)
           ((subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 2, symmetric]; auto elim: order.trans[OF \<tau>_mono, rotated]),
             (subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \<tau>_mono, rotated]))
     next
       case (left j)
       with False show ?case unfolding right enat_ord_code le_diff_conv add.commute[of b]
         by (intro iffI)
           ((subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 21, symmetric]; auto elim: order.trans[OF \<tau>_mono, rotated]),
             (subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 21]; auto elim: order.trans[OF \<tau>_mono, rotated]))
     next
       case (progress j k z)
       with False show ?case unfolding right enat_ord_code le_diff_conv add.commute[of b]
         by (elim 1[rotated])
           (subst (1 2) \<tau>_prefix_conv[OF assms(1,2) 21]; auto elim!: order.trans[OF \<tau>_mono, rotated])
     qed
   qed
 qed auto
 
 lemma sat_prefix_conv:
   assumes "prefix_of \<pi> \<sigma>" and "prefix_of \<pi> \<sigma>'"
   shows "i < progress \<sigma> Map.empty \<phi> (plen \<pi>) \<Longrightarrow>
     Formula.sat \<sigma> Map.empty v i \<phi> \<longleftrightarrow> Formula.sat \<sigma>' Map.empty v i \<phi>"
   by (erule sat_prefix_conv_gen[OF assms]) auto
 
 lemma progress_remove_neg[simp]: "progress \<sigma> P (remove_neg \<phi>) j = progress \<sigma> P \<phi> j"
   by (cases \<phi>) simp_all
 
 lemma safe_progress_get_and: "safe_formula \<phi> \<Longrightarrow>
   Min ((\<lambda>\<phi>. progress \<sigma> P \<phi> j) ` set (get_and_list \<phi>)) = progress \<sigma> P \<phi> j"
   by (induction \<phi> rule: get_and_list.induct) auto
 
 lemma progress_convert_multiway: "safe_formula \<phi> \<Longrightarrow> progress \<sigma> P (convert_multiway \<phi>) j = progress \<sigma> P \<phi> j"
 proof (induction \<phi> arbitrary: P rule: safe_formula_induct)
   case (And_safe \<phi> \<psi>)
   let ?c = "convert_multiway (Formula.And \<phi> \<psi>)"
   let ?c\<phi> = "convert_multiway \<phi>"
   let ?c\<psi> = "convert_multiway \<psi>"
   have c_eq: "?c = Formula.Ands (get_and_list ?c\<phi> @ get_and_list ?c\<psi>)"
     using And_safe by simp
   from \<open>safe_formula \<phi>\<close> have "safe_formula ?c\<phi>" by (rule safe_convert_multiway)
   moreover from \<open>safe_formula \<psi>\<close> have "safe_formula ?c\<psi>" by (rule safe_convert_multiway)
   ultimately show ?case
     unfolding c_eq
     using And_safe.IH
     by (auto simp: get_and_nonempty Min.union safe_progress_get_and)
 next
   case (And_Not \<phi> \<psi>)
   let ?c = "convert_multiway (Formula.And \<phi> (Formula.Neg \<psi>))"
   let ?c\<phi> = "convert_multiway \<phi>"
   let ?c\<psi> = "convert_multiway \<psi>"
   have c_eq: "?c = Formula.Ands (Formula.Neg ?c\<psi> # get_and_list ?c\<phi>)"
     using And_Not by simp
   from \<open>safe_formula \<phi>\<close> have "safe_formula ?c\<phi>" by (rule safe_convert_multiway)
   moreover from \<open>safe_formula \<psi>\<close> have "safe_formula ?c\<psi>" by (rule safe_convert_multiway)
   ultimately show ?case
     unfolding c_eq
     using And_Not.IH
     by (auto simp: get_and_nonempty Min.union safe_progress_get_and)
 next
   case (MatchP I r)
   from MatchP show ?case
     unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image
     by (intro if_cong arg_cong[of _ _ Min] image_cong)
       (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)
 next
   case (MatchF I r)
   from MatchF show ?case
     unfolding progress.simps regex.map convert_multiway.simps regex.set_map image_image
     by (intro if_cong arg_cong[of _ _ Min] arg_cong[of _ _ Inf] arg_cong[of _ _ "(\<le>) _"]
       image_cong Collect_cong all_cong1 imp_cong conj_cong image_cong)
       (auto 0 4 simp: atms_def elim!: disjE_Not2 dest: safe_regex_safe_formula)
 qed auto
 
 
-interpretation verimon: monitor_timed_progress Formula.future_bounded "\<lambda>\<sigma>. progress \<sigma> Map.empty"
-  by (unfold_locales, (fact progress_mono progress_le progress_time_conv sat_prefix_conv |
-        simp add: mmonitorable_def progress_ge)+)
-
-abbreviation "mverdicts \<equiv> verimon.verdicts"
+subsection \<open>Specification\<close>
+
+definition pprogress :: "Formula.formula \<Rightarrow> Formula.prefix \<Rightarrow> nat" where
+  "pprogress \<phi> \<pi> = (THE n. \<forall>\<sigma>. prefix_of \<pi> \<sigma> \<longrightarrow> progress \<sigma> Map.empty \<phi> (plen \<pi>) = n)"
+
+lemma pprogress_eq: "prefix_of \<pi> \<sigma> \<Longrightarrow> pprogress \<phi> \<pi> = progress \<sigma> Map.empty \<phi> (plen \<pi>)"
+  unfolding pprogress_def using progress_prefix_conv
+  by blast
+
+locale future_bounded_mfodl =
+  fixes \<phi> :: Formula.formula
+  assumes future_bounded: "Formula.future_bounded \<phi>"
+
+sublocale future_bounded_mfodl \<subseteq> sliceable_timed_progress "Formula.nfv \<phi>" "Formula.fv \<phi>" "relevant_events \<phi>"
+  "\<lambda>\<sigma> v i. Formula.sat \<sigma> Map.empty v i \<phi>" "pprogress \<phi>"
+proof (unfold_locales, goal_cases)
+  case (1 x)
+  then show ?case by (simp add: fvi_less_nfv)
+next
+  case (2 v v' \<sigma> i)
+  then show ?case by (simp cong: sat_fv_cong[rule_format])
+next
+  case (3 v S \<sigma> i)
+  then show ?case
+    using sat_slice_iff[symmetric] by simp
+next
+  case (4 \<pi> \<pi>')
+  moreover obtain \<sigma> where "prefix_of \<pi>' \<sigma>"
+    using ex_prefix_of ..
+  moreover have "prefix_of \<pi> \<sigma>"
+    using prefix_of_antimono[OF \<open>\<pi> \<le> \<pi>'\<close> \<open>prefix_of \<pi>' \<sigma>\<close>] .
+  ultimately show ?case
+    by (simp add: pprogress_eq plen_mono progress_mono)
+next
+  case (5 \<sigma> x)
+  obtain j where "x \<le> progress \<sigma> Map.empty \<phi> j"
+    using future_bounded progress_ge by blast
+  then have "x \<le> pprogress \<phi> (take_prefix j \<sigma>)"
+    by (simp add: pprogress_eq[of _ \<sigma>])
+  then show ?case by force
+next
+  case (6 \<pi> \<sigma> \<sigma>' i v)
+  then have "i < progress \<sigma> Map.empty \<phi> (plen \<pi>)"
+    by (simp add: pprogress_eq)
+  with 6 show ?case
+    using sat_prefix_conv by blast
+next
+  case (7 \<pi> \<pi>')
+  then have "plen \<pi> = plen \<pi>'"
+    by transfer (simp add: list_eq_iff_nth_eq)
+  moreover obtain \<sigma> \<sigma>' where "prefix_of \<pi> \<sigma>" "prefix_of \<pi>' \<sigma>'"
+    using ex_prefix_of by blast+
+  moreover have "\<forall>i < plen \<pi>. \<tau> \<sigma> i = \<tau> \<sigma>' i"
+    using 7 calculation
+    by transfer (simp add: list_eq_iff_nth_eq)
+  ultimately show ?case
+    by (simp add: pprogress_eq progress_time_conv)
+qed
+
+locale verimon_spec =
+  fixes \<phi> :: Formula.formula
+  assumes monitorable: "mmonitorable \<phi>"
+
+sublocale verimon_spec \<subseteq> future_bounded_mfodl
+  using monitorable by unfold_locales (simp add: mmonitorable_def)
 
 
 subsection \<open>Correctness\<close>
 
 subsubsection \<open>Invariants\<close>
 
 definition wf_mbuf2 :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> (nat \<Rightarrow> event_data table \<Rightarrow> bool) \<Rightarrow> (nat \<Rightarrow> event_data table \<Rightarrow> bool) \<Rightarrow>
     event_data mbuf2 \<Rightarrow> bool" where
   "wf_mbuf2 i ja jb P Q buf \<longleftrightarrow> i \<le> ja \<and> i \<le> jb \<and> (case buf of (xs, ys) \<Rightarrow>
     list_all2 P [i..<ja] xs \<and> list_all2 Q [i..<jb] ys)"
 
 inductive list_all3 :: "('a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> bool) \<Rightarrow> 'a list \<Rightarrow> 'b list \<Rightarrow> 'c list \<Rightarrow> bool" for P :: "('a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> bool)" where
   "list_all3 P [] [] []"
 | "P a1 a2 a3 \<Longrightarrow> list_all3 P q1 q2 q3 \<Longrightarrow> list_all3 P (a1 # q1) (a2 # q2) (a3 # q3)"
 
 lemma list_all3_list_all2D: "list_all3 P xs ys zs \<Longrightarrow>
   (length xs = length ys \<and> list_all2 (case_prod P) (zip xs ys) zs)"
   by (induct xs ys zs rule: list_all3.induct) auto
 
 lemma list_all2_list_all3I: "length xs = length ys \<Longrightarrow> list_all2 (case_prod P) (zip xs ys) zs \<Longrightarrow>
   list_all3 P xs ys zs"
   by (induct xs ys arbitrary: zs rule: list_induct2)
     (auto simp: list_all2_Cons1 intro: list_all3.intros)
 
 lemma list_all3_list_all2_eq: "list_all3 P xs ys zs \<longleftrightarrow>
   (length xs = length ys \<and> list_all2 (case_prod P) (zip xs ys) zs)"
   using list_all2_list_all3I list_all3_list_all2D by blast
 
 lemma list_all3_mapD: "list_all3 P (map f xs) (map g ys) (map h zs) \<Longrightarrow>
   list_all3 (\<lambda>x y z. P (f x) (g y) (h z)) xs ys zs"
   by (induct "map f xs" "map g ys" "map h zs" arbitrary: xs ys zs rule: list_all3.induct)
     (auto intro: list_all3.intros)
 
 lemma list_all3_mapI: "list_all3 (\<lambda>x y z. P (f x) (g y) (h z)) xs ys zs \<Longrightarrow>
   list_all3 P (map f xs) (map g ys) (map h zs)"
   by (induct xs ys zs rule: list_all3.induct)
     (auto intro: list_all3.intros)
 
 lemma list_all3_map_iff: "list_all3 P (map f xs) (map g ys) (map h zs) \<longleftrightarrow>
   list_all3 (\<lambda>x y z. P (f x) (g y) (h z)) xs ys zs"
   using list_all3_mapD list_all3_mapI by blast
 
 lemmas list_all3_map =
   list_all3_map_iff[where g=id and h=id, unfolded list.map_id id_apply]
   list_all3_map_iff[where f=id and h=id, unfolded list.map_id id_apply]
   list_all3_map_iff[where f=id and g=id, unfolded list.map_id id_apply]
 
 lemma list_all3_conv_all_nth:
   "list_all3 P xs ys zs =
   (length xs = length ys \<and> length ys = length zs \<and> (\<forall>i < length xs. P (xs!i) (ys!i) (zs!i)))"
   by (auto simp add: list_all3_list_all2_eq list_all2_conv_all_nth)
 
 lemma list_all3_refl [intro?]:
   "(\<And>x. x \<in> set xs \<Longrightarrow> P x x x) \<Longrightarrow> list_all3 P xs xs xs"
   by (simp add: list_all3_conv_all_nth)
 
 definition wf_mbufn :: "nat \<Rightarrow> nat list \<Rightarrow> (nat \<Rightarrow> event_data table \<Rightarrow> bool) list \<Rightarrow> event_data mbufn \<Rightarrow> bool" where
   "wf_mbufn i js Ps buf \<longleftrightarrow> list_all3 (\<lambda>P j xs. i \<le> j \<and> list_all2 P [i..<j] xs) Ps js buf"
 
 definition wf_mbuf2' :: "Formula.trace \<Rightarrow> _ \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> event_data list set \<Rightarrow>
   Formula.formula \<Rightarrow> Formula.formula \<Rightarrow> event_data mbuf2 \<Rightarrow> bool" where
   "wf_mbuf2' \<sigma> P V j n R \<phi> \<psi> buf \<longleftrightarrow> wf_mbuf2 (min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j))
     (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)
     (\<lambda>i. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>))
     (\<lambda>i. qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>)) buf"
 
 definition wf_mbufn' :: "Formula.trace \<Rightarrow> _ \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> event_data list set \<Rightarrow>
   Formula.formula Regex.regex \<Rightarrow> event_data mbufn \<Rightarrow> bool" where
   "wf_mbufn' \<sigma>  P V j n R r buf \<longleftrightarrow> (case to_mregex r of (mr, \<phi>s) \<Rightarrow>
     wf_mbufn (progress_regex \<sigma> P r j) (map (\<lambda>\<phi>. progress \<sigma> P \<phi> j) \<phi>s)
     (map (\<lambda>\<phi> i. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>)) \<phi>s)
     buf)"
 
 lemma wf_mbuf2'_UNIV_alt: "wf_mbuf2' \<sigma> P V j n UNIV \<phi> \<psi> buf \<longleftrightarrow> (case buf of (xs, ys) \<Rightarrow>
   list_all2 (\<lambda>i. wf_table n (Formula.fv \<phi>) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>))
     [min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j) ..< (progress \<sigma> P \<phi> j)] xs \<and>
   list_all2 (\<lambda>i. wf_table n (Formula.fv \<psi>) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>))
     [min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j) ..< (progress \<sigma> P \<psi> j)] ys)"
   unfolding wf_mbuf2'_def wf_mbuf2_def
   by (simp add: mem_restr_UNIV[THEN eqTrueI, abs_def] split: prod.split)
 
 definition wf_ts :: "Formula.trace \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> Formula.formula \<Rightarrow> Formula.formula \<Rightarrow> ts list \<Rightarrow> bool" where
   "wf_ts \<sigma> P j \<phi> \<psi> ts \<longleftrightarrow> list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)..<j] ts"
 
 definition wf_ts_regex :: "Formula.trace \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> Formula.formula Regex.regex \<Rightarrow> ts list \<Rightarrow> bool" where
   "wf_ts_regex \<sigma> P j r ts \<longleftrightarrow> list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [progress_regex \<sigma> P r j..<j] ts"
 
 abbreviation "Sincep pos \<phi> I \<psi> \<equiv> Formula.Since (if pos then \<phi> else Formula.Neg \<phi>) I \<psi>"
 
 definition (in msaux) wf_since_aux :: "Formula.trace \<Rightarrow> _ \<Rightarrow> event_data list set \<Rightarrow> args \<Rightarrow>
   Formula.formula \<Rightarrow> Formula.formula \<Rightarrow> 'msaux \<Rightarrow> nat \<Rightarrow> bool" where
   "wf_since_aux \<sigma> V R args \<phi> \<psi> aux ne \<longleftrightarrow> Formula.fv \<phi> \<subseteq> Formula.fv \<psi> \<and> (\<exists>cur auxlist. valid_msaux args cur aux auxlist \<and>
     cur = (if ne = 0 then 0 else \<tau> \<sigma> (ne - 1)) \<and>
     sorted_wrt (\<lambda>x y. fst x > fst y) auxlist \<and>
     (\<forall>t X. (t, X) \<in> set auxlist \<longrightarrow> ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne - 1) \<and> \<tau> \<sigma> (ne - 1) - t \<le> right (args_ivl args) \<and> (\<exists>i. \<tau> \<sigma> i = t) \<and>
       qtable (args_n args) (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne-1) (Sincep (args_pos args) \<phi> (point (\<tau> \<sigma> (ne - 1) - t)) \<psi>)) X) \<and>
     (\<forall>t. ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne - 1) \<and> \<tau> \<sigma> (ne - 1) - t \<le> right (args_ivl args) \<and> (\<exists>i. \<tau> \<sigma> i = t) \<longrightarrow>
       (\<exists>X. (t, X) \<in> set auxlist)))"
 
 definition wf_matchP_aux :: "Formula.trace \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> event_data list set \<Rightarrow>
     \<I> \<Rightarrow> Formula.formula Regex.regex \<Rightarrow> event_data mr\<delta>aux \<Rightarrow> nat \<Rightarrow> bool" where
   "wf_matchP_aux \<sigma> V n R I r aux ne \<longleftrightarrow> sorted_wrt (\<lambda>x y. fst x > fst y) aux \<and>
     (\<forall>t X. (t, X) \<in> set aux \<longrightarrow> ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne-1) \<and> \<tau> \<sigma> (ne-1) - t \<le> right I \<and> (\<exists>i. \<tau> \<sigma> i = t) \<and>
       (case to_mregex r of (mr, \<phi>s) \<Rightarrow>
       (\<forall>ms \<in> RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne-1)
          (Formula.MatchP (point (\<tau> \<sigma> (ne-1) - t)) (from_mregex ms \<phi>s)))
          (lookup X ms)))) \<and>
     (\<forall>t. ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne-1) \<and> \<tau> \<sigma> (ne-1) - t \<le> right I \<and> (\<exists>i. \<tau> \<sigma> i = t) \<longrightarrow>
       (\<exists>X. (t, X) \<in> set aux))"
 
 lemma qtable_mem_restr_UNIV: "qtable n A(mem_restr UNIV) Q X = wf_table n A Q X"
   unfolding qtable_def by auto
 
 lemma (in msaux) wf_since_aux_UNIV_alt:
   "wf_since_aux \<sigma> V UNIV args \<phi> \<psi> aux ne \<longleftrightarrow> Formula.fv \<phi> \<subseteq> Formula.fv \<psi> \<and> (\<exists>cur auxlist. valid_msaux args cur aux auxlist \<and>
     cur = (if ne = 0 then 0 else \<tau> \<sigma> (ne - 1)) \<and>
     sorted_wrt (\<lambda>x y. fst x > fst y) auxlist \<and>
     (\<forall>t X. (t, X) \<in> set auxlist \<longrightarrow> ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne - 1) \<and> \<tau> \<sigma> (ne - 1) - t \<le> right (args_ivl args) \<and> (\<exists>i. \<tau> \<sigma> i = t) \<and>
       wf_table (args_n args) (Formula.fv \<psi>)
           (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne - 1) (Sincep (args_pos args) \<phi> (point (\<tau> \<sigma> (ne - 1) - t)) \<psi>)) X) \<and>
     (\<forall>t. ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne - 1) \<and> \<tau> \<sigma> (ne - 1) - t \<le> right (args_ivl args) \<and> (\<exists>i. \<tau> \<sigma> i = t) \<longrightarrow>
       (\<exists>X. (t, X) \<in> set auxlist)))"
   unfolding wf_since_aux_def qtable_mem_restr_UNIV ..
 
 definition wf_until_auxlist :: "Formula.trace \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> event_data list set \<Rightarrow> bool \<Rightarrow>
     Formula.formula \<Rightarrow> \<I> \<Rightarrow> Formula.formula \<Rightarrow> event_data muaux \<Rightarrow> nat \<Rightarrow> bool" where
   "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> auxlist ne \<longleftrightarrow>
     list_all2 (\<lambda>x i. case x of (t, r1, r2) \<Rightarrow> t = \<tau> \<sigma> i \<and>
       qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. if pos then (\<forall>k\<in>{i..<ne+length auxlist}. Formula.sat \<sigma> V (map the v) k \<phi>)
           else (\<exists>k\<in>{i..<ne+length auxlist}. Formula.sat \<sigma> V (map the v) k \<phi>)) r1 \<and>
       qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. (\<exists>j. i \<le> j \<and> j < ne + length auxlist \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and>
           Formula.sat \<sigma> V (map the v) j \<psi> \<and>
           (\<forall>k\<in>{i..<j}. if pos then Formula.sat \<sigma> V (map the v) k \<phi> else \<not> Formula.sat \<sigma> V (map the v) k \<phi>))) r2)
       auxlist [ne..<ne+length auxlist]"
 
 definition (in muaux) wf_until_aux :: "Formula.trace \<Rightarrow> _ \<Rightarrow> event_data list set \<Rightarrow> args \<Rightarrow>
   Formula.formula \<Rightarrow> Formula.formula \<Rightarrow> 'muaux \<Rightarrow> nat \<Rightarrow> bool" where
   "wf_until_aux \<sigma> V R args \<phi> \<psi> aux ne \<longleftrightarrow> Formula.fv \<phi> \<subseteq> Formula.fv \<psi> \<and>
     (\<exists>cur auxlist. valid_muaux args cur aux auxlist \<and>
       cur = (if ne + length auxlist = 0 then 0 else \<tau> \<sigma> (ne + length auxlist - 1)) \<and>
       wf_until_auxlist \<sigma> V (args_n args) R (args_pos args) \<phi> (args_ivl args) \<psi> auxlist ne)"
 
 lemma (in muaux) wf_until_aux_UNIV_alt:
   "wf_until_aux \<sigma> V UNIV args \<phi> \<psi> aux ne \<longleftrightarrow> Formula.fv \<phi> \<subseteq> Formula.fv \<psi> \<and>
     (\<exists>cur auxlist. valid_muaux args cur aux auxlist \<and>
       cur = (if ne + length auxlist = 0 then 0 else \<tau> \<sigma> (ne + length auxlist - 1)) \<and>
       list_all2 (\<lambda>x i. case x of (t, r1, r2) \<Rightarrow> t = \<tau> \<sigma> i \<and>
       wf_table (args_n args) (Formula.fv \<phi>) (\<lambda>v. if (args_pos args)
           then (\<forall>k\<in>{i..<ne+length auxlist}. Formula.sat \<sigma> V (map the v) k \<phi>)
           else (\<exists>k\<in>{i..<ne+length auxlist}. Formula.sat \<sigma> V (map the v) k \<phi>)) r1 \<and>
       wf_table (args_n args) (Formula.fv \<psi>) (\<lambda>v. \<exists>j. i \<le> j \<and> j < ne + length auxlist \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) (args_ivl args) \<and>
           Formula.sat \<sigma> V (map the v) j \<psi> \<and>
           (\<forall>k\<in>{i..<j}. if (args_pos args) then Formula.sat \<sigma> V (map the v) k \<phi> else \<not> Formula.sat \<sigma> V (map the v) k \<phi>)) r2)
       auxlist [ne..<ne+length auxlist])"
   unfolding wf_until_aux_def wf_until_auxlist_def qtable_mem_restr_UNIV ..
 
 definition wf_matchF_aux :: "Formula.trace \<Rightarrow> _ \<Rightarrow> nat \<Rightarrow> event_data list set \<Rightarrow>
     \<I> \<Rightarrow> Formula.formula Regex.regex \<Rightarrow> event_data ml\<delta>aux \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> bool" where
   "wf_matchF_aux \<sigma> V n R I r aux ne k \<longleftrightarrow> (case to_mregex r of (mr, \<phi>s) \<Rightarrow>
       list_all2 (\<lambda>x i. case x of (t, rels, rel) \<Rightarrow> t = \<tau> \<sigma> i \<and>
         list_all2 (\<lambda>\<phi>. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v.
           Formula.sat \<sigma> V (map the v) i \<phi>)) \<phi>s rels \<and>
         qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v. (\<exists>j. i \<le> j \<and> j < ne + length aux + k \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and>
           Regex.match (Formula.sat \<sigma> V (map the v)) r i j)) rel)
     aux [ne..<ne+length aux])"
 
 definition wf_matchF_invar where
   "wf_matchF_invar \<sigma> V n R I r st i =
      (case st of (aux, Y) \<Rightarrow> aux \<noteq> [] \<and> wf_matchF_aux \<sigma> V n R I r aux i 0 \<and>
      (case to_mregex r of (mr, \<phi>s) \<Rightarrow> \<forall>ms \<in> LPDs mr.
        qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v.
          Regex.match (Formula.sat \<sigma> V (map the v)) (from_mregex ms \<phi>s) i (i + length aux - 1)) (lookup Y ms)))"
 
 definition lift_envs' :: "nat \<Rightarrow> event_data list set \<Rightarrow> event_data list set" where
   "lift_envs' b R = (\<lambda>(xs,ys). xs @ ys) ` ({xs. length xs = b} \<times> R)"
 
 fun formula_of_constraint :: "Formula.trm \<times> bool \<times> mconstraint \<times> Formula.trm \<Rightarrow> Formula.formula" where
   "formula_of_constraint (t1, True, MEq, t2) = Formula.Eq t1 t2"
 | "formula_of_constraint (t1, True, MLess, t2) = Formula.Less t1 t2"
 | "formula_of_constraint (t1, True, MLessEq, t2) = Formula.LessEq t1 t2"
 | "formula_of_constraint (t1, False, MEq, t2) = Formula.Neg (Formula.Eq t1 t2)"
 | "formula_of_constraint (t1, False, MLess, t2) = Formula.Neg (Formula.Less t1 t2)"
 | "formula_of_constraint (t1, False, MLessEq, t2) = Formula.Neg (Formula.LessEq t1 t2)"
 
 inductive (in maux) wf_mformula :: "Formula.trace \<Rightarrow> nat \<Rightarrow> _ \<Rightarrow> _ \<Rightarrow>
   nat \<Rightarrow> event_data list set \<Rightarrow> ('msaux, 'muaux) mformula \<Rightarrow> Formula.formula \<Rightarrow> bool"
   for \<sigma> j where
     Eq: "is_simple_eq t1 t2 \<Longrightarrow>
     \<forall>x\<in>Formula.fv_trm t1. x < n \<Longrightarrow> \<forall>x\<in>Formula.fv_trm t2. x < n \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MRel (eq_rel n t1 t2)) (Formula.Eq t1 t2)"
   | neq_Var: "x < n \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MRel empty_table) (Formula.Neg (Formula.Eq (Formula.Var x) (Formula.Var x)))"
   | Pred: "\<forall>x\<in>Formula.fv (Formula.Pred e ts). x < n \<Longrightarrow>
     \<forall>t\<in>set ts. Formula.is_Var t \<or> Formula.is_Const t \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MPred e ts) (Formula.Pred e ts)"
   | Let: "wf_mformula \<sigma> j P V m UNIV \<phi> \<phi>' \<Longrightarrow>
     wf_mformula \<sigma> j (P(p \<mapsto> progress \<sigma> P \<phi>' j))
       (V(p \<mapsto> \<lambda>i. {v. length v = m \<and> Formula.sat \<sigma> V v i \<phi>'})) n R \<psi> \<psi>' \<Longrightarrow>
     {0..<m} \<subseteq> Formula.fv \<phi>' \<Longrightarrow> b \<le> m \<Longrightarrow> m = Formula.nfv \<phi>' \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MLet p m \<phi> \<psi>) (Formula.Let p \<phi>' \<psi>')"
   | And: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow> wf_mformula \<sigma> j P V n R \<psi> \<psi>' \<Longrightarrow>
     if pos then \<chi> = Formula.And \<phi>' \<psi>'
       else \<chi> = Formula.And \<phi>' (Formula.Neg \<psi>') \<and> Formula.fv \<psi>' \<subseteq> Formula.fv \<phi>' \<Longrightarrow>
     wf_mbuf2' \<sigma> P V j n R \<phi>' \<psi>' buf \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MAnd (fv \<phi>') \<phi> pos (fv \<psi>') \<psi> buf) \<chi>"
   | AndAssign: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow>
     x < n \<Longrightarrow> x \<notin> Formula.fv \<phi>' \<Longrightarrow> Formula.fv_trm t \<subseteq> Formula.fv \<phi>' \<Longrightarrow> (x, t) = conf \<Longrightarrow>
     \<psi>' = Formula.Eq (Formula.Var x) t \<or> \<psi>' = Formula.Eq t (Formula.Var x) \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MAndAssign \<phi> conf) (Formula.And \<phi>' \<psi>')"
   | AndRel: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow>
     \<psi>' = formula_of_constraint conf \<Longrightarrow>
     (let (t1, _, _, t2) = conf in Formula.fv_trm t1 \<union> Formula.fv_trm t2 \<subseteq> Formula.fv \<phi>') \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MAndRel \<phi> conf) (Formula.And \<phi>' \<psi>')"
   | Ands: "list_all2 (\<lambda>\<phi> \<phi>'. wf_mformula \<sigma> j P V n R \<phi> \<phi>') l (l_pos @ map remove_neg l_neg) \<Longrightarrow>
     wf_mbufn (progress \<sigma> P (Formula.Ands l') j) (map (\<lambda>\<psi>. progress \<sigma> P \<psi> j) (l_pos @ map remove_neg l_neg)) (map (\<lambda>\<psi> i.
       qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>)) (l_pos @ map remove_neg l_neg)) buf \<Longrightarrow>
     (l_pos, l_neg) = partition safe_formula l' \<Longrightarrow>
     l_pos \<noteq> [] \<Longrightarrow>
     list_all safe_formula (map remove_neg l_neg) \<Longrightarrow>
     A_pos = map fv l_pos \<Longrightarrow>
     A_neg = map fv l_neg \<Longrightarrow>
     \<Union>(set A_neg) \<subseteq> \<Union>(set A_pos) \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MAnds A_pos A_neg l buf) (Formula.Ands l')"
   | Or: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow> wf_mformula \<sigma> j P V n R \<psi> \<psi>' \<Longrightarrow>
     Formula.fv \<phi>' = Formula.fv \<psi>' \<Longrightarrow>
     wf_mbuf2' \<sigma> P V j n R \<phi>' \<psi>' buf \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MOr \<phi> \<psi> buf) (Formula.Or \<phi>' \<psi>')"
   | Neg: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow> Formula.fv \<phi>' = {} \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MNeg \<phi>) (Formula.Neg \<phi>')"
   | Exists: "wf_mformula \<sigma> j P V (Suc n) (lift_envs R) \<phi> \<phi>' \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MExists \<phi>) (Formula.Exists \<phi>')"
   | Agg: "wf_mformula \<sigma> j P V (b + n) (lift_envs' b R) \<phi> \<phi>' \<Longrightarrow>
     y < n \<Longrightarrow>
     y + b \<notin> Formula.fv \<phi>' \<Longrightarrow>
     {0..<b} \<subseteq> Formula.fv \<phi>' \<Longrightarrow>
     Formula.fv_trm f \<subseteq> Formula.fv \<phi>' \<Longrightarrow>
     g0 = (Formula.fv \<phi>' \<subseteq> {0..<b}) \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MAgg g0 y \<omega> b f \<phi>) (Formula.Agg y \<omega> b f \<phi>')"
   | Prev: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow>
     first \<longleftrightarrow> j = 0 \<Longrightarrow>
     list_all2 (\<lambda>i. qtable n (Formula.fv \<phi>') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>'))
       [min (progress \<sigma> P \<phi>' j) (j-1)..<progress \<sigma> P \<phi>' j] buf \<Longrightarrow>
     list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [min (progress \<sigma> P \<phi>' j) (j-1)..<j] nts \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MPrev I \<phi> first buf nts) (Formula.Prev I \<phi>')"
   | Next: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow>
     first \<longleftrightarrow> progress \<sigma> P \<phi>' j = 0 \<Longrightarrow>
     list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [progress \<sigma> P \<phi>' j - 1..<j] nts \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MNext I \<phi> first nts) (Formula.Next I \<phi>')"
   | Since: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow> wf_mformula \<sigma> j P V n R \<psi> \<psi>' \<Longrightarrow>
     if args_pos args then \<phi>'' = \<phi>' else \<phi>'' = Formula.Neg \<phi>' \<Longrightarrow>
     safe_formula \<phi>'' = args_pos args \<Longrightarrow>
     args_ivl args = I \<Longrightarrow>
     args_n args = n \<Longrightarrow>
     args_L args = Formula.fv \<phi>' \<Longrightarrow>
     args_R args = Formula.fv \<psi>' \<Longrightarrow>
     Formula.fv \<phi>' \<subseteq> Formula.fv \<psi>' \<Longrightarrow>
     wf_mbuf2' \<sigma> P V j n R \<phi>' \<psi>' buf \<Longrightarrow>
     wf_ts \<sigma> P j \<phi>' \<psi>' nts \<Longrightarrow>
     wf_since_aux \<sigma> V R args \<phi>' \<psi>' aux (progress \<sigma> P (Formula.Since \<phi>'' I \<psi>') j) \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MSince args \<phi> \<psi> buf nts aux) (Formula.Since \<phi>'' I \<psi>')"
   | Until: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow> wf_mformula \<sigma> j P V n R \<psi> \<psi>' \<Longrightarrow>
     if args_pos args then \<phi>'' = \<phi>' else \<phi>'' = Formula.Neg \<phi>' \<Longrightarrow>
     safe_formula \<phi>'' = args_pos args \<Longrightarrow>
     args_ivl args = I \<Longrightarrow>
     args_n args = n \<Longrightarrow>
     args_L args = Formula.fv \<phi>' \<Longrightarrow>
     args_R args = Formula.fv \<psi>' \<Longrightarrow>
     Formula.fv \<phi>' \<subseteq> Formula.fv \<psi>' \<Longrightarrow>
     wf_mbuf2' \<sigma> P V j n R \<phi>' \<psi>' buf \<Longrightarrow>
     wf_ts \<sigma> P j \<phi>' \<psi>' nts \<Longrightarrow>
     wf_until_aux \<sigma> V R args \<phi>' \<psi>' aux (progress \<sigma> P (Formula.Until \<phi>'' I \<psi>') j) \<Longrightarrow>
     progress \<sigma> P (Formula.Until \<phi>'' I \<psi>') j + length_muaux args aux = min (progress \<sigma> P \<phi>' j) (progress \<sigma> P \<psi>' j) \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MUntil args \<phi> \<psi> buf nts aux) (Formula.Until \<phi>'' I \<psi>')"
   | MatchP: "(case to_mregex r of (mr', \<phi>s') \<Rightarrow>
       list_all2 (wf_mformula \<sigma> j P V n R) \<phi>s \<phi>s' \<and> mr = mr') \<Longrightarrow>
     mrs = sorted_list_of_set (RPDs mr) \<Longrightarrow>
     safe_regex Past Strict r \<Longrightarrow>
     wf_mbufn' \<sigma> P V j n R r buf \<Longrightarrow>
     wf_ts_regex \<sigma> P j r nts \<Longrightarrow>
     wf_matchP_aux \<sigma> V n R I r aux (progress \<sigma> P (Formula.MatchP I r) j) \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MMatchP I mr mrs \<phi>s buf nts aux) (Formula.MatchP I r)"
   | MatchF: "(case to_mregex r of (mr', \<phi>s') \<Rightarrow>
       list_all2 (wf_mformula \<sigma> j P V n R) \<phi>s \<phi>s' \<and> mr = mr') \<Longrightarrow>
     mrs = sorted_list_of_set (LPDs mr) \<Longrightarrow>
     safe_regex Futu Strict r \<Longrightarrow>
     wf_mbufn' \<sigma> P V j n R r buf \<Longrightarrow>
     wf_ts_regex \<sigma> P j r nts \<Longrightarrow>
     wf_matchF_aux \<sigma> V n R I r aux (progress \<sigma> P (Formula.MatchF I r) j) 0 \<Longrightarrow>
     progress \<sigma> P (Formula.MatchF I r) j + length aux = progress_regex \<sigma> P r j \<Longrightarrow>
     wf_mformula \<sigma> j P V n R (MMatchF I mr mrs \<phi>s buf nts aux) (Formula.MatchF I r)"
 
 definition (in maux) wf_mstate :: "Formula.formula \<Rightarrow> Formula.prefix \<Rightarrow> event_data list set \<Rightarrow> ('msaux, 'muaux) mstate \<Rightarrow> bool" where
   "wf_mstate \<phi> \<pi> R st \<longleftrightarrow> mstate_n st = Formula.nfv \<phi> \<and> (\<forall>\<sigma>. prefix_of \<pi> \<sigma> \<longrightarrow>
     mstate_i st = progress \<sigma> Map.empty \<phi> (plen \<pi>) \<and>
     wf_mformula \<sigma> (plen \<pi>) Map.empty Map.empty (mstate_n st) R (mstate_m st) \<phi>)"
 
 
 subsubsection \<open>Initialisation\<close>
 
 
 lemma wf_mbuf2'_0: "pred_mapping (\<lambda>x. x = 0) P \<Longrightarrow> wf_mbuf2' \<sigma> P V 0 n R \<phi> \<psi> ([], [])"
   unfolding wf_mbuf2'_def wf_mbuf2_def by simp
 
 lemma wf_mbufn'_0: "to_mregex r = (mr, \<phi>s) \<Longrightarrow> pred_mapping (\<lambda>x. x = 0) P \<Longrightarrow> wf_mbufn' \<sigma> P V 0 n R r (replicate (length \<phi>s) [])"
   unfolding wf_mbufn'_def wf_mbufn_def map_replicate_const[symmetric]
   by (auto simp: list_all3_map intro: list_all3_refl simp: Min_eq_iff progress_regex_def)
 
 lemma wf_ts_0: "wf_ts \<sigma> P 0 \<phi> \<psi> []"
   unfolding wf_ts_def by simp
 
 lemma wf_ts_regex_0: "wf_ts_regex \<sigma> P 0 r []"
   unfolding wf_ts_regex_def by simp
 
 lemma (in msaux) wf_since_aux_Nil: "Formula.fv \<phi>' \<subseteq> Formula.fv \<psi>' \<Longrightarrow>
   wf_since_aux \<sigma> V R (init_args I n (Formula.fv \<phi>') (Formula.fv \<psi>') b) \<phi>' \<psi>' (init_msaux (init_args I n (Formula.fv \<phi>') (Formula.fv \<psi>') b)) 0"
   unfolding wf_since_aux_def by (auto intro!: valid_init_msaux)
 
 lemma (in muaux) wf_until_aux_Nil: "Formula.fv \<phi>' \<subseteq> Formula.fv \<psi>' \<Longrightarrow>
   wf_until_aux \<sigma> V R (init_args I n (Formula.fv \<phi>') (Formula.fv \<psi>') b) \<phi>' \<psi>' (init_muaux (init_args I n (Formula.fv \<phi>') (Formula.fv \<psi>') b)) 0"
   unfolding wf_until_aux_def wf_until_auxlist_def by (auto intro: valid_init_muaux)
 
 lemma wf_matchP_aux_Nil: "wf_matchP_aux \<sigma> V n R I r [] 0"
   unfolding wf_matchP_aux_def by simp
 
 lemma wf_matchF_aux_Nil: "wf_matchF_aux \<sigma> V n R I r [] 0 k"
   unfolding wf_matchF_aux_def by simp
 
 lemma fv_regex_alt: "safe_regex m g r \<Longrightarrow> Formula.fv_regex r = (\<Union>\<phi> \<in> atms r. Formula.fv \<phi>)"
   unfolding fv_regex_alt atms_def
   by (auto 0 3 dest: safe_regex_safe_formula)
 
 lemmas to_mregex_atms =
   to_mregex_ok[THEN conjunct1, THEN equalityD1, THEN set_mp, rotated]
 
 lemma (in maux) wf_minit0: "safe_formula \<phi> \<Longrightarrow> \<forall>x\<in>Formula.fv \<phi>. x < n \<Longrightarrow>
   pred_mapping (\<lambda>x. x = 0) P \<Longrightarrow>
   wf_mformula \<sigma> 0 P V n R (minit0 n \<phi>) \<phi>"
 proof (induction arbitrary: n R P V rule: safe_formula_induct)
   case (Eq_Const c d)
   then show ?case
     by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)
 next
   case (Eq_Var1 c x)
   then show ?case
     by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)
 next
   case (Eq_Var2 c x)
   then show ?case
     by (auto simp add: is_simple_eq_def simp del: eq_rel.simps intro!: wf_mformula.Eq)
 next
   case (neq_Var x y)
   then show ?case by (auto intro!: wf_mformula.neq_Var)
 next
   case (Pred e ts)
   then show ?case by (auto intro!: wf_mformula.Pred)
 next
   case (Let p \<phi> \<psi>)
   with fvi_less_nfv show ?case
     by (auto simp: pred_mapping_alt dom_def intro!: wf_mformula.Let Let(4,5))
 next
   case (And_assign \<phi> \<psi>)
   then have 1: "\<forall>x\<in>fv \<psi>. x < n" by simp
   from 1 \<open>safe_assignment (fv \<phi>) \<psi>\<close>
   obtain x t where
     "x < n" "x \<notin> fv \<phi>" "fv_trm t \<subseteq> fv \<phi>"
     "\<psi> = Formula.Eq (Formula.Var x) t \<or> \<psi> = Formula.Eq t (Formula.Var x)"
     unfolding safe_assignment_def by (force split: formula.splits trm.splits)
   with And_assign show ?case
     by (auto intro!: wf_mformula.AndAssign split: trm.splits)
 next
   case (And_safe \<phi> \<psi>)
   then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)
 next
   case (And_constraint \<phi> \<psi>)
   from \<open>fv \<psi> \<subseteq> fv \<phi>\<close> \<open>is_constraint \<psi>\<close>
   obtain t1 p c t2 where
     "(t1, p, c, t2) = split_constraint \<psi>"
     "formula_of_constraint (split_constraint \<psi>) = \<psi>"
     "fv_trm t1 \<union> fv_trm t2 \<subseteq> fv \<phi>"
     by (induction rule: is_constraint.induct) auto
   with And_constraint show ?case
     by (auto 0 3 intro!: wf_mformula.AndRel)
 next
   case (And_Not \<phi> \<psi>)
   then show ?case by (auto intro!: wf_mformula.And wf_mbuf2'_0)
 next
   case (Ands l pos neg)
   note posneg = "Ands.hyps"(1)
   let ?wf_minit = "\<lambda>x. wf_mformula \<sigma> 0 P V n R (minit0 n x)"
   let ?pos = "filter safe_formula l"
   let ?neg = "filter (Not \<circ> safe_formula) l"
   have "list_all2 ?wf_minit ?pos pos"
     using Ands.IH(1) Ands.prems posneg by (auto simp: list_all_iff intro!: list.rel_refl_strong)
   moreover have "list_all2 ?wf_minit (map remove_neg ?neg) (map remove_neg neg)"
     using Ands.IH(2) Ands.prems posneg by (auto simp: list.rel_map list_all_iff intro!: list.rel_refl_strong)
   moreover have "list_all3 (\<lambda>_ _ _. True) (?pos @ map remove_neg ?neg) (?pos @ map remove_neg ?neg) l"
     by (auto simp: list_all3_conv_all_nth comp_def sum_length_filter_compl)
   moreover have "l \<noteq> [] \<Longrightarrow> (MIN \<phi>\<in>set l. (0 :: nat)) = 0"
     by (cases l) (auto simp: Min_eq_iff)
   ultimately show ?case using Ands.hyps Ands.prems(2)
     by (auto simp: wf_mbufn_def list_all3_map list.rel_map map_replicate_const[symmetric] subset_eq
         map_map[symmetric] map_append[symmetric] simp del: map_map map_append
         intro!: wf_mformula.Ands list_all2_appendI)
 next
   case (Neg \<phi>)
   then show ?case by (auto intro!: wf_mformula.Neg)
 next
   case (Or \<phi> \<psi>)
   then show ?case by (auto intro!: wf_mformula.Or wf_mbuf2'_0)
 next
   case (Exists \<phi>)
   then show ?case by (auto simp: fvi_Suc_bound intro!: wf_mformula.Exists)
 next
   case (Agg y \<omega> b f \<phi>)
   then show ?case by (auto intro!: wf_mformula.Agg Agg.IH fvi_plus_bound)
 next
   case (Prev I \<phi>)
   thm wf_mformula.Prev[where P=P]
   then show ?case by (auto intro!: wf_mformula.Prev)
 next
   case (Next I \<phi>)
   then show ?case by (auto intro!: wf_mformula.Next)
 next
   case (Since \<phi> I \<psi>)
   then show ?case
     using wf_since_aux_Nil
     by (auto simp add: init_args_def intro!: wf_mformula.Since wf_mbuf2'_0 wf_ts_0)
 next
   case (Not_Since \<phi> I \<psi>)
   then show ?case
     using wf_since_aux_Nil
     by (auto simp add: init_args_def intro!: wf_mformula.Since wf_mbuf2'_0 wf_ts_0)
 next
   case (Until \<phi> I \<psi>)
   then show ?case
     using valid_length_muaux[OF valid_init_muaux[OF Until(1)]] wf_until_aux_Nil
     by (auto simp add: init_args_def simp del: progress_simps intro!: wf_mformula.Until wf_mbuf2'_0 wf_ts_0)
 next
   case (Not_Until \<phi> I \<psi>)
   then show ?case
     using valid_length_muaux[OF valid_init_muaux[OF Not_Until(1)]] wf_until_aux_Nil
     by (auto simp add: init_args_def simp del: progress_simps intro!: wf_mformula.Until wf_mbuf2'_0 wf_ts_0)
 next
   case (MatchP I r)
   then show ?case
     by (auto simp: list.rel_map fv_regex_alt simp del: progress_simps split: prod.split
         intro!: wf_mformula.MatchP list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchP_aux_Nil
         dest!: to_mregex_atms)
 next
   case (MatchF I r)
   then show ?case
     by (auto simp: list.rel_map fv_regex_alt progress_le Min_eq_iff progress_regex_def
         simp del: progress_simps split: prod.split
         intro!: wf_mformula.MatchF list.rel_refl_strong wf_mbufn'_0 wf_ts_regex_0 wf_matchF_aux_Nil
         dest!: to_mregex_atms)
 qed
 
 lemma (in maux) wf_mstate_minit: "safe_formula \<phi> \<Longrightarrow> wf_mstate \<phi> pnil R (minit \<phi>)"
   unfolding wf_mstate_def minit_def Let_def
   by (auto intro!: wf_minit0 fvi_less_nfv)
 
 
 subsubsection \<open>Evaluation\<close>
 
 lemma match_wf_tuple: "Some f = match ts xs \<Longrightarrow>
   wf_tuple n (\<Union>t\<in>set ts. Formula.fv_trm t) (Table.tabulate f 0 n)"
   by (induction ts xs arbitrary: f rule: match.induct)
     (fastforce simp: wf_tuple_def split: if_splits option.splits)+
 
 lemma match_fvi_trm_None: "Some f = match ts xs \<Longrightarrow> \<forall>t\<in>set ts. x \<notin> Formula.fv_trm t \<Longrightarrow> f x = None"
   by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)
 
 lemma match_fvi_trm_Some: "Some f = match ts xs \<Longrightarrow> t \<in> set ts \<Longrightarrow> x \<in> Formula.fv_trm t \<Longrightarrow> f x \<noteq> None"
   by (induction ts xs arbitrary: f rule: match.induct) (auto split: if_splits option.splits)
 
 lemma match_eval_trm: "\<forall>t\<in>set ts. \<forall>i\<in>Formula.fv_trm t. i < n \<Longrightarrow> Some f = match ts xs \<Longrightarrow>
     map (Formula.eval_trm (Table.tabulate (\<lambda>i. the (f i)) 0 n)) ts = xs"
 proof (induction ts xs arbitrary: f rule: match.induct)
   case (3 x ts y ys)
   from 3(1)[symmetric] 3(2,3) show ?case
     by (auto 0 3 dest: match_fvi_trm_Some sym split: option.splits if_splits intro!: eval_trm_fv_cong)
 qed (auto split: if_splits)
 
 lemma wf_tuple_tabulate_Some: "wf_tuple n A (Table.tabulate f 0 n) \<Longrightarrow> x \<in> A \<Longrightarrow> x < n \<Longrightarrow> \<exists>y. f x = Some y"
   unfolding wf_tuple_def by auto
 
 lemma ex_match: "wf_tuple n (\<Union>t\<in>set ts. Formula.fv_trm t) v \<Longrightarrow>
   \<forall>t\<in>set ts. (\<forall>x\<in>Formula.fv_trm t. x < n) \<and> (Formula.is_Var t \<or> Formula.is_Const t) \<Longrightarrow>
   \<exists>f. match ts (map (Formula.eval_trm (map the v)) ts) = Some f \<and> v = Table.tabulate f 0 n"
 proof (induction ts "map (Formula.eval_trm (map the v)) ts" arbitrary: v rule: match.induct)
   case (3 x ts y ys)
   then show ?case
   proof (cases "x \<in> (\<Union>t\<in>set ts. Formula.fv_trm t)")
     case True
     with 3 show ?thesis
       by (auto simp: insert_absorb dest!: wf_tuple_tabulate_Some meta_spec[of _ v])
   next
     case False
     with 3(3,4) have
       *: "map (Formula.eval_trm (map the v)) ts = map (Formula.eval_trm (map the (v[x := None]))) ts"
       by (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)
     from False 3(2-4) obtain f where
       "match ts (map (Formula.eval_trm (map the v)) ts) = Some f" "v[x := None] = Table.tabulate f 0 n"
       unfolding *
       by (atomize_elim, intro 3(1)[of "v[x := None]"])
         (auto simp: wf_tuple_def nth_list_update intro!: eval_trm_fv_cong)
     moreover from False this have "f x = None" "length v = n"
       by (auto dest: match_fvi_trm_None[OF sym] arg_cong[of _ _ length])
     ultimately show ?thesis using 3(3)
       by (auto simp: list_eq_iff_nth_eq wf_tuple_def)
   qed
 qed (auto simp: wf_tuple_def intro: nth_equalityI)
 
 lemma eq_rel_eval_trm: "v \<in> eq_rel n t1 t2 \<Longrightarrow> is_simple_eq t1 t2 \<Longrightarrow>
   \<forall>x\<in>Formula.fv_trm t1 \<union> Formula.fv_trm t2. x < n \<Longrightarrow>
   Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2"
   by (cases t1; cases t2) (simp_all add: is_simple_eq_def singleton_table_def split: if_splits)
 
 lemma in_eq_rel: "wf_tuple n (Formula.fv_trm t1 \<union> Formula.fv_trm t2) v \<Longrightarrow>
   is_simple_eq t1 t2 \<Longrightarrow>
   Formula.eval_trm (map the v) t1 = Formula.eval_trm (map the v) t2 \<Longrightarrow>
   v \<in> eq_rel n t1 t2"
   by (cases t1; cases t2)
     (auto simp: is_simple_eq_def singleton_table_def wf_tuple_def unit_table_def
       intro!: nth_equalityI split: if_splits)
 
 lemma table_eq_rel: "is_simple_eq t1 t2 \<Longrightarrow>
   table n (Formula.fv_trm t1 \<union> Formula.fv_trm t2) (eq_rel n t1 t2)"
   by (cases t1; cases t2; simp add: is_simple_eq_def)
 
 lemma wf_tuple_Suc_fviD: "wf_tuple (Suc n) (Formula.fvi b \<phi>) v \<Longrightarrow> wf_tuple n (Formula.fvi (Suc b) \<phi>) (tl v)"
   unfolding wf_tuple_def by (simp add: fvi_Suc nth_tl)
 
 lemma table_fvi_tl: "table (Suc n) (Formula.fvi b \<phi>) X \<Longrightarrow> table n (Formula.fvi (Suc b) \<phi>) (tl ` X)"
   unfolding table_def by (auto intro: wf_tuple_Suc_fviD)
 
 lemma wf_tuple_Suc_fvi_SomeI: "0 \<in> Formula.fvi b \<phi> \<Longrightarrow> wf_tuple n (Formula.fvi (Suc b) \<phi>) v \<Longrightarrow>
   wf_tuple (Suc n) (Formula.fvi b \<phi>) (Some x # v)"
   unfolding wf_tuple_def
   by (auto simp: fvi_Suc less_Suc_eq_0_disj)
 
 lemma wf_tuple_Suc_fvi_NoneI: "0 \<notin> Formula.fvi b \<phi> \<Longrightarrow> wf_tuple n (Formula.fvi (Suc b) \<phi>) v \<Longrightarrow>
   wf_tuple (Suc n) (Formula.fvi b \<phi>) (None # v)"
   unfolding wf_tuple_def
   by (auto simp: fvi_Suc less_Suc_eq_0_disj)
 
 lemma qtable_project_fv: "qtable (Suc n) (fv \<phi>) (mem_restr (lift_envs R)) P X \<Longrightarrow>
     qtable n (Formula.fvi (Suc 0) \<phi>) (mem_restr R)
       (\<lambda>v. \<exists>x. P ((if 0 \<in> fv \<phi> then Some x else None) # v)) (tl ` X)"
   using neq0_conv by (fastforce simp: image_iff Bex_def fvi_Suc elim!: qtable_cong dest!: qtable_project)
 
 lemma mem_restr_lift_envs'_append[simp]:
   "length xs = b \<Longrightarrow> mem_restr (lift_envs' b R) (xs @ ys) = mem_restr R ys"
   unfolding mem_restr_def lift_envs'_def
   by (auto simp: list_all2_append list.rel_map intro!: exI[where x="map the xs"] list.rel_refl)
 
 lemma nth_list_update_alt: "xs[i := x] ! j = (if i < length xs \<and> i = j then x else xs ! j)"
   by auto
 
 lemma wf_tuple_upd_None: "wf_tuple n A xs \<Longrightarrow> A - {i} = B \<Longrightarrow> wf_tuple n B (xs[i:=None])"
   unfolding wf_tuple_def
   by (auto simp: nth_list_update_alt)
 
 lemma mem_restr_upd_None: "mem_restr R xs \<Longrightarrow> mem_restr R (xs[i:=None])"
   unfolding mem_restr_def
   by (auto simp: list_all2_conv_all_nth nth_list_update_alt)
 
 lemma mem_restr_dropI: "mem_restr (lift_envs' b R) xs \<Longrightarrow> mem_restr R (drop b xs)"
   unfolding mem_restr_def lift_envs'_def
   by (auto simp: append_eq_conv_conj list_all2_append2)
 
 lemma mem_restr_dropD:
   assumes "b \<le> length xs" and "mem_restr R (drop b xs)"
   shows "mem_restr (lift_envs' b R) xs"
 proof -
   let ?R = "\<lambda>a b. a \<noteq> None \<longrightarrow> a = Some b"
   from assms(2) obtain v where "v \<in> R" and "list_all2 ?R (drop b xs) v"
     unfolding mem_restr_def ..
   show ?thesis unfolding mem_restr_def proof
     have "list_all2 ?R (take b xs) (map the (take b xs))"
       by (auto simp: list.rel_map intro!: list.rel_refl)
     moreover note \<open>list_all2 ?R (drop b xs) v\<close>
     ultimately have "list_all2 ?R (take b xs @ drop b xs) (map the (take b xs) @ v)"
       by (rule list_all2_appendI)
     then show "list_all2 ?R xs (map the (take b xs) @ v)" by simp
     show "map the (take b xs) @ v \<in> lift_envs' b R"
       unfolding lift_envs'_def using assms(1) \<open>v \<in> R\<close> by auto
   qed
 qed
 
 lemma wf_tuple_append: "wf_tuple a {x \<in> A. x < a} xs \<Longrightarrow>
   wf_tuple b {x - a | x. x \<in> A \<and> x \<ge> a} ys \<Longrightarrow>
   wf_tuple (a + b) A (xs @ ys)"
   unfolding wf_tuple_def by (auto simp: nth_append eq_diff_iff)
 
 lemma wf_tuple_map_Some: "length xs = n \<Longrightarrow> {0..<n} \<subseteq> A \<Longrightarrow> wf_tuple n A (map Some xs)"
   unfolding wf_tuple_def by auto
 
 lemma wf_tuple_drop: "wf_tuple (b + n) A xs \<Longrightarrow> {x - b | x. x \<in> A \<and> x \<ge> b} = B \<Longrightarrow>
   wf_tuple n B (drop b xs)"
   unfolding wf_tuple_def by force
 
 lemma ecard_image: "inj_on f A \<Longrightarrow> ecard (f ` A) = ecard A"
   unfolding ecard_def by (auto simp: card_image dest: finite_imageD)
 
 lemma meval_trm_eval_trm: "wf_tuple n A x \<Longrightarrow> fv_trm t \<subseteq> A \<Longrightarrow> \<forall>i\<in>A. i < n \<Longrightarrow>
     meval_trm t x = Formula.eval_trm (map the x) t"
   unfolding wf_tuple_def
   by (induction t) simp_all
 
 lemma list_update_id: "xs ! i = z \<Longrightarrow> xs[i:=z] = xs"
   by (induction xs arbitrary: i) (auto split: nat.split)
 
 lemma qtable_wf_tupleD: "qtable n A P Q X \<Longrightarrow> \<forall>x\<in>X. wf_tuple n A x"
   unfolding qtable_def table_def by blast
 
 lemma qtable_eval_agg:
   assumes inner: "qtable (b + n) (Formula.fv \<phi>) (mem_restr (lift_envs' b R))
       (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>) rel"
     and n: "\<forall>x\<in>Formula.fv (Formula.Agg y \<omega> b f \<phi>). x < n"
     and fresh: "y + b \<notin> Formula.fv \<phi>"
     and b_fv: "{0..<b} \<subseteq> Formula.fv \<phi>"
     and f_fv: "Formula.fv_trm f \<subseteq> Formula.fv \<phi>"
     and g0: "g0 = (Formula.fv \<phi> \<subseteq> {0..<b})"
   shows "qtable n (Formula.fv (Formula.Agg y \<omega> b f \<phi>)) (mem_restr R)
       (\<lambda>v. Formula.sat \<sigma> V (map the v) i (Formula.Agg y \<omega> b f \<phi>)) (eval_agg n g0 y \<omega> b f rel)"
     (is "qtable _ ?fv _ ?Q ?rel'")
 proof -
   define M where "M = (\<lambda>v. {(x, ecard Zs) | x Zs.
       Zs = {zs. length zs = b \<and> Formula.sat \<sigma> V (zs @ v) i \<phi> \<and> Formula.eval_trm (zs @ v) f = x} \<and>
       Zs \<noteq> {}})"
   have f_fvi: "Formula.fvi_trm b f \<subseteq> Formula.fvi b \<phi>"
     using f_fv by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])
   show ?thesis proof (cases "g0 \<and> rel = empty_table")
     case True
     then have [simp]: "Formula.fvi b \<phi> = {}"
       by (auto simp: g0 fvi_iff_fv(1)[where b=b])
     then have [simp]: "Formula.fvi_trm b f = {}"
       using f_fvi by auto
     show ?thesis proof (rule qtableI)
       show "table n ?fv ?rel'" by (simp add: eval_agg_def True)
     next
       fix v
       assume "wf_tuple n ?fv v" "mem_restr R v"
       have "\<not> Formula.sat \<sigma> V (zs @ map the v) i \<phi>" if [simp]: "length zs = b" for zs
       proof -
         let ?zs = "map2 (\<lambda>z i. if i \<in> Formula.fv \<phi> then Some z else None) zs [0..<b]"
         have "wf_tuple b {x \<in> fv \<phi>. x < b} ?zs"
           by (simp add: wf_tuple_def)
         then have "wf_tuple (b + n) (Formula.fv \<phi>) (?zs @ v[y:=None])"
           using \<open>wf_tuple n ?fv v\<close> True
           by (auto simp: g0 intro!: wf_tuple_append wf_tuple_upd_None)
         then have "\<not> Formula.sat \<sigma> V (map the (?zs @ v[y:=None])) i \<phi>"
           using True \<open>mem_restr R v\<close>
           by (auto simp del: map_append dest!: in_qtableI[OF inner, rotated -1]
               intro!: mem_restr_upd_None)
         also have "Formula.sat \<sigma> V (map the (?zs @ v[y:=None])) i \<phi> \<longleftrightarrow> Formula.sat \<sigma> V (zs @ map the v) i \<phi>"
           using True by (auto simp: g0 nth_append intro!: sat_fv_cong)
         finally show ?thesis .
       qed
       then have M_empty: "M (map the v) = {}"
         unfolding M_def by blast
       show "Formula.sat \<sigma> V (map the v) i (Formula.Agg y \<omega> b f \<phi>)"
         if "v \<in> eval_agg n g0 y \<omega> b f rel"
         using M_empty True that n
         by (simp add: M_def eval_agg_def g0 singleton_table_def)
       have "v \<in> singleton_table n y (the (v ! y))" "length v = n"
         using \<open>wf_tuple n ?fv v\<close> unfolding wf_tuple_def singleton_table_def
         by (auto simp add: tabulate_alt map_nth
             intro!: trans[OF map_cong[where g="(!) v", simplified nth_map, OF refl], symmetric])
       then show "v \<in> eval_agg n g0 y \<omega> b f rel"
         if "Formula.sat \<sigma> V (map the v) i (Formula.Agg y \<omega> b f \<phi>)"
         using M_empty True that n
         by (simp add: M_def eval_agg_def g0)
     qed
   next
     case non_default_case: False
     have union_fv: "{0..<b} \<union> (\<lambda>x. x + b) ` Formula.fvi b \<phi> = fv \<phi>"
       using b_fv
       by (auto simp: fvi_iff_fv(1)[where b=b] intro!: image_eqI[where b=x and x="x - b" for x])
     have b_n: "\<forall>x\<in>fv \<phi>. x < b + n"
     proof
       fix x assume "x \<in> fv \<phi>"
       show "x < b + n" proof (cases "x \<ge> b")
         case True
         with \<open>x \<in> fv \<phi>\<close> have "x - b \<in> ?fv"
           by (simp add: fvi_iff_fv(1)[where b=b])
         then show ?thesis using n f_fvi by (auto simp: Un_absorb2)
       qed simp
     qed
 
     define M' where "M' = (\<lambda>k. let group = Set.filter (\<lambda>x. drop b x = k) rel;
         images = meval_trm f ` group
       in (\<lambda>y. (y, ecard (Set.filter (\<lambda>x. meval_trm f x = y) group))) ` images)"
     have M'_M: "M' (drop b x) = M (map the (drop b x))" if "x \<in> rel" "mem_restr (lift_envs' b R) x" for x
     proof -
       from that have wf_x: "wf_tuple (b + n) (fv \<phi>) x"
         by (auto elim!: in_qtableE[OF inner])
       then have wf_zs_x: "wf_tuple (b + n) (fv \<phi>) (map Some zs @ drop b x)"
         if "length zs = b" for zs
         using that b_fv
         by (auto intro!: wf_tuple_append wf_tuple_map_Some wf_tuple_drop)
       have 1: "(length zs = b \<and> Formula.sat \<sigma> V (zs @ map the (drop b x)) i \<phi> \<and>
           Formula.eval_trm (zs @ map the (drop b x)) f = y) \<longleftrightarrow>
         (\<exists>a. a \<in> rel \<and> take b a = map Some zs \<and> drop b a = drop b x \<and> meval_trm f a = y)"
         (is "?A \<longleftrightarrow> (\<exists>a. ?B a)") for y zs
       proof (intro iffI conjI)
         assume ?A
         then have "?B (map Some zs @ drop (length zs) x)"
           using in_qtableI[OF inner wf_zs_x] \<open>mem_restr (lift_envs' b R) x\<close>
             meval_trm_eval_trm[OF wf_zs_x f_fv b_n]
           by (auto intro!: mem_restr_dropI)
         then show "\<exists>a. ?B a" ..
       next
         assume "\<exists>a. ?B a"
         then obtain a where "?B a" ..
         then have "a \<in> rel" and a_eq: "a = map Some zs @ drop b x"
           using append_take_drop_id[of b a] by auto
         then have "length a = b + n"
           using inner unfolding qtable_def table_def
           by (blast intro!: wf_tuple_length)
         then show "length zs = b"
           using wf_tuple_length[OF wf_x] unfolding a_eq by simp
         then have "mem_restr (lift_envs' b R) a"
           using \<open>mem_restr _ x\<close> unfolding a_eq by (auto intro!: mem_restr_dropI)
         then show "Formula.sat \<sigma> V (zs @ map the (drop b x)) i \<phi>"
           using in_qtableE[OF inner \<open>a \<in> rel\<close>]
           by (auto simp: a_eq sat_fv_cong[THEN iffD1, rotated -1])
         from \<open>?B a\<close> show "Formula.eval_trm (zs @ map the (drop b x)) f = y"
           using meval_trm_eval_trm[OF wf_zs_x f_fv b_n, OF \<open>length zs = b\<close>]
           unfolding a_eq by simp
       qed
       have 2: "map Some (map the (take b a)) = take b a" if "a \<in> rel" for a
         using that b_fv inner[THEN qtable_wf_tupleD]
         unfolding table_def wf_tuple_def
         by (auto simp: list_eq_iff_nth_eq)
       have 3: "ecard {zs. \<exists>a. a \<in> rel \<and> take b a = map Some zs \<and> drop b a = drop b x \<and> P a} =
         ecard {a. a \<in> rel \<and> drop b a = drop b x \<and> P a}" (is "ecard ?A = ecard ?B") for P
       proof -
         have "ecard ?A = ecard ((\<lambda>zs. map Some zs @ drop b x) ` ?A)"
           by (auto intro!: ecard_image[symmetric] inj_onI)
         also have "(\<lambda>zs. map Some zs @ drop b x) ` ?A = ?B"
           by (subst (1 2) eq_commute) (auto simp: image_iff, metis "2" append_take_drop_id)
         finally show ?thesis .
       qed
       show ?thesis
         unfolding M_def M'_def
         by (auto simp: non_default_case Let_def image_def Set.filter_def 1 3, metis "2")
     qed
     have drop_lift: "mem_restr (lift_envs' b R) x" if "x \<in> rel" "mem_restr R ((drop b x)[y:=z])" for x z
     proof -
       have "(drop b x)[y:=None] = (drop b x)[y:=drop b x ! y]" proof -
         from \<open>x \<in> rel\<close> have "drop b x ! y = None"
           using fresh n inner[THEN qtable_wf_tupleD]
           by (simp add: add.commute wf_tuple_def)
         then show ?thesis by simp
       qed
       then have "(drop b x)[y:=None] = drop b x" by simp
       moreover from \<open>x \<in> rel\<close> have "length x = b + n"
         using inner[THEN qtable_wf_tupleD]
         by (simp add: wf_tuple_def)
       moreover from that(2) have "mem_restr R ((drop b x)[y:=z, y:=None])"
         by (rule mem_restr_upd_None)
       ultimately show ?thesis
         by (auto intro!: mem_restr_dropD)
     qed
 
     {
       fix v
       assume "mem_restr R v"
       have "v \<in> (\<lambda>k. k[y:=Some (eval_agg_op \<omega> (M' k))]) ` drop b ` rel \<longleftrightarrow>
           v \<in> (\<lambda>k. k[y:=Some (eval_agg_op \<omega> (M (map the k)))]) ` drop b ` rel"
         (is "v \<in> ?A \<longleftrightarrow> v \<in> ?B")
       proof
         assume "v \<in> ?A"
         then obtain v' where *: "v' \<in> rel" "v = (drop b v')[y:=Some (eval_agg_op \<omega> (M' (drop b v')))]"
           by auto
         then have "M' (drop b v') = M (map the (drop b v'))"
           using \<open>mem_restr R v\<close> by (auto intro!: M'_M drop_lift)
         with * show "v \<in> ?B" by simp
       next
         assume "v \<in> ?B"
         then obtain v' where *: "v' \<in> rel" "v = (drop b v')[y:=Some (eval_agg_op \<omega> (M (map the (drop b v'))))]"
           by auto
         then have "M (map the (drop b v')) = M' (drop b v')"
           using \<open>mem_restr R v\<close> by (auto intro!: M'_M[symmetric] drop_lift)
         with * show "v \<in> ?A" by simp
       qed
       then have "v \<in> eval_agg n g0 y \<omega> b f rel \<longleftrightarrow> v \<in> (\<lambda>k. k[y:=Some (eval_agg_op \<omega> (M (map the k)))]) ` drop b ` rel"
         by (simp add: non_default_case eval_agg_def M'_def Let_def)
     }
     note alt = this
 
     show ?thesis proof (rule qtableI)
       show "table n ?fv ?rel'"
         using inner[THEN qtable_wf_tupleD] n f_fvi
         by (auto simp: eval_agg_def non_default_case table_def wf_tuple_def Let_def nth_list_update
             fvi_iff_fv[where b=b] add.commute)
     next
       fix v
       assume "wf_tuple n ?fv v" "mem_restr R v"
       then have length_v: "length v = n" by (simp add: wf_tuple_def)
 
       show "Formula.sat \<sigma> V (map the v) i (Formula.Agg y \<omega> b f \<phi>)"
         if "v \<in> eval_agg n g0 y \<omega> b f rel"
       proof -
         from that obtain v' where "v' \<in> rel"
           "v = (drop b v')[y:=Some (eval_agg_op \<omega> (M (map the (drop b v'))))]"
           using alt[OF \<open>mem_restr R v\<close>] by blast
         then have length_v': "length v' = b + n"
           using inner[THEN qtable_wf_tupleD]
           by (simp add: wf_tuple_def)
         have "Formula.sat \<sigma> V (map the v') i \<phi>"
           using \<open>v' \<in> rel\<close> \<open>mem_restr R v\<close>
           by (auto simp: \<open>v = _\<close> elim!: in_qtableE[OF inner] intro!: drop_lift \<open>v' \<in> rel\<close>)
         then have "Formula.sat \<sigma> V (map the (take b v') @ map the v) i \<phi>"
         proof (rule sat_fv_cong[THEN iffD1, rotated], intro ballI)
           fix x
           assume "x \<in> fv \<phi>"
           then have "x \<noteq> y + b" using fresh by blast
           moreover have "x < length v'"
             using \<open>x \<in> fv \<phi>\<close> b_n by (simp add: length_v')
           ultimately show "map the v' ! x = (map the (take b v') @ map the v) ! x"
             by (auto simp: \<open>v = _\<close> nth_append)
         qed
         then have 1: "M (map the v) \<noteq> {}" by (force simp: M_def length_v')
 
         have "y < length (drop b v')" using n by (simp add: length_v')
         moreover have "Formula.sat \<sigma> V (zs @ map the v) i \<phi> \<longleftrightarrow>
           Formula.sat \<sigma> V (zs @ map the (drop b v')) i \<phi>" if "length zs = b" for zs
         proof (intro sat_fv_cong ballI)
           fix x
           assume "x \<in> fv \<phi>"
           then have "x \<noteq> y + b" using fresh by blast
           moreover have "x < length v'"
             using \<open>x \<in> fv \<phi>\<close> b_n by (simp add: length_v')
           ultimately show "(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x"
             by (auto simp: \<open>v = _\<close> that nth_append)
         qed
         moreover have "Formula.eval_trm (zs @ map the v) f =
           Formula.eval_trm (zs @ map the (drop b v')) f" if "length zs = b" for zs
         proof (intro eval_trm_fv_cong ballI)
           fix x
           assume "x \<in> fv_trm f"
           then have "x \<noteq> y + b" using f_fv fresh by blast
           moreover have "x < length v'"
             using \<open>x \<in> fv_trm f\<close> f_fv b_n by (auto simp: length_v')
           ultimately show "(zs @ map the v) ! x = (zs @ map the (drop b v')) ! x"
             by (auto simp: \<open>v = _\<close> that nth_append)
         qed
         ultimately have "map the v ! y = eval_agg_op \<omega> (M (map the v))"
           by (simp add: M_def \<open>v = _\<close> conj_commute cong: conj_cong)
         with 1 show ?thesis by (auto simp: M_def)
       qed
 
       show "v \<in> eval_agg n g0 y \<omega> b f rel"
         if sat_Agg: "Formula.sat \<sigma> V (map the v) i (Formula.Agg y \<omega> b f \<phi>)"
       proof -
         obtain zs where "length zs = b" and "map Some zs @ v[y:=None] \<in> rel"
         proof (cases "fv \<phi> \<subseteq> {0..<b}")
           case True
           with non_default_case have "rel \<noteq> empty_table" by (simp add: g0)
           then obtain x where "x \<in> rel" by auto
           have "(\<forall>i < n. (v[y:=None]) ! i = None)"
             using True \<open>wf_tuple n ?fv v\<close> f_fv
             by (fastforce simp: wf_tuple_def fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])
           moreover have x: "(\<forall>i < n. drop b x ! i = None) \<and> length x = b + n"
             using True \<open>x \<in> rel\<close> inner[THEN qtable_wf_tupleD] f_fv
             by (auto simp: wf_tuple_def)
           ultimately have "v[y:=None] = drop b x"
             unfolding list_eq_iff_nth_eq by (auto simp: length_v)
           with \<open>x \<in> rel\<close> have "take b x @ v[y:=None] \<in> rel" by simp
           moreover have "map (Some \<circ> the) (take b x) = take b x"
             using True \<open>x \<in> rel\<close> inner[THEN qtable_wf_tupleD] b_fv
             by (subst map_cong[where g=id, OF refl]) (auto simp: wf_tuple_def in_set_conv_nth)
           ultimately have "map Some (map the (take b x)) @ v[y:=None] \<in> rel" by simp
           then show thesis using x[THEN conjunct2] by (fastforce intro!: that[rotated])
         next
           case False
           with sat_Agg obtain zs where "length zs = b" and "Formula.sat \<sigma> V (zs @ map the v) i \<phi>"
             by auto
           then have "Formula.sat \<sigma> V (zs @ map the (v[y:=None])) i \<phi>"
             using fresh
             by (auto simp: map_update not_less nth_append elim!: sat_fv_cong[THEN iffD1, rotated]
                 intro!: nth_list_update_neq[symmetric])
           then have "map Some zs @ v[y:=None] \<in> rel"
             using b_fv f_fv fresh
             by (auto intro!: in_qtableI[OF inner] wf_tuple_append wf_tuple_map_Some
                 wf_tuple_upd_None \<open>wf_tuple n ?fv v\<close> mem_restr_upd_None \<open>mem_restr R v\<close>
                 simp: \<open>length zs = b\<close> set_eq_iff fvi_iff_fv[where b=b] fvi_trm_iff_fv_trm[where b=b])
               force+
           with that \<open>length zs = b\<close> show thesis by blast
         qed
         then have 1: "v[y:=None] \<in> drop b ` rel" by (intro image_eqI) auto
 
         have y_length: "y < length v" using n by (simp add: length_v)
         moreover have "Formula.sat \<sigma> V (zs @ map the (v[y:=None])) i \<phi> \<longleftrightarrow>
           Formula.sat \<sigma> V (zs @ map the v) i \<phi>" if "length zs = b" for zs
         proof (intro sat_fv_cong ballI)
           fix x
           assume "x \<in> fv \<phi>"
           then have "x \<noteq> y + b" using fresh by blast
           moreover have "x < b + length v"
             using \<open>x \<in> fv \<phi>\<close> b_n by (simp add: length_v)
           ultimately show "(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x"
             by (auto simp: that nth_append)
         qed
         moreover have "Formula.eval_trm (zs @ map the (v[y:=None])) f =
           Formula.eval_trm (zs @ map the v) f" if "length zs = b" for zs
         proof (intro eval_trm_fv_cong ballI)
           fix x
           assume "x \<in> fv_trm f"
           then have "x \<noteq> y + b" using f_fv fresh by blast
           moreover have "x < b + length v"
             using \<open>x \<in> fv_trm f\<close> f_fv b_n by (auto simp: length_v)
           ultimately show "(zs @ map the (v[y:=None])) ! x = (zs @ map the v) ! x"
             by (auto simp: that nth_append)
         qed
         ultimately have "map the v ! y = eval_agg_op \<omega> (M (map the (v[y:=None])))"
           using sat_Agg by (simp add: M_def cong: conj_cong) (simp cong: rev_conj_cong)
         then have 2: "v ! y = Some (eval_agg_op \<omega> (M (map the (v[y:=None]))))"
           using \<open>wf_tuple n ?fv v\<close> y_length by (auto simp add: wf_tuple_def)
         show ?thesis
           unfolding alt[OF \<open>mem_restr R v\<close>]
           by (rule image_eqI[where x="v[y:=None]"]) (use 1 2 in \<open>auto simp: y_length list_update_id\<close>)
       qed
     qed
   qed
 qed
 
 lemma mprev: "mprev_next I xs ts = (ys, xs', ts') \<Longrightarrow>
   list_all2 P [i..<j'] xs \<Longrightarrow> list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [i..<j] ts \<Longrightarrow> i \<le> j' \<Longrightarrow> i < j \<Longrightarrow>
   list_all2 (\<lambda>i X. if mem (\<tau> \<sigma> (Suc i) - \<tau> \<sigma> i) I then P i X else X = empty_table)
     [i..<min j' (j-1)] ys \<and>
   list_all2 P [min j' (j-1)..<j'] xs' \<and>
   list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [min j' (j-1)..<j] ts'"
 proof (induction I xs ts arbitrary: i ys xs' ts' rule: mprev_next.induct)
   case (1 I ts)
   then have "min j' (j-1) = i" by auto
   with 1 show ?case by auto
 next
   case (3 I v v' t)
   then have "min j' (j-1) = i" by (auto simp: list_all2_Cons2 upt_eq_Cons_conv)
   with 3 show ?case by auto
 next
   case (4 I x xs t t' ts)
   from 4(1)[of "tl ys" xs' ts' "Suc i"] 4(2-6) show ?case
     by (auto simp add: list_all2_Cons2 upt_eq_Cons_conv Suc_less_eq2
         elim!: list.rel_mono_strong split: prod.splits if_splits)
 qed simp
 
 lemma mnext: "mprev_next I xs ts = (ys, xs', ts') \<Longrightarrow>
   list_all2 P [Suc i..<j'] xs \<Longrightarrow> list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [i..<j] ts \<Longrightarrow> Suc i \<le> j' \<Longrightarrow> i < j \<Longrightarrow>
   list_all2 (\<lambda>i X. if mem (\<tau> \<sigma> (Suc i) - \<tau> \<sigma> i) I then P (Suc i) X else X = empty_table)
     [i..<min (j'-1) (j-1)] ys \<and>
   list_all2 P [Suc (min (j'-1) (j-1))..<j'] xs' \<and>
   list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [min (j'-1) (j-1)..<j] ts'"
 proof (induction I xs ts arbitrary: i ys xs' ts' rule: mprev_next.induct)
   case (1 I ts)
   then have "min (j' - 1) (j-1) = i" by auto
   with 1 show ?case by auto
 next
   case (3 I v v' t)
   then have "min (j' - 1) (j-1) = i" by (auto simp: list_all2_Cons2 upt_eq_Cons_conv)
   with 3 show ?case by auto
 next
   case (4 I x xs t t' ts)
   from 4(1)[of "tl ys" xs' ts' "Suc i"] 4(2-6) show ?case
     by (auto simp add: list_all2_Cons2 upt_eq_Cons_conv Suc_less_eq2
         elim!: list.rel_mono_strong split: prod.splits if_splits) (* slow 10 sec *)
 qed simp
 
 lemma in_foldr_UnI: "x \<in> A \<Longrightarrow> A \<in> set xs \<Longrightarrow> x \<in> foldr (\<union>) xs {}"
   by (induction xs) auto
 
 lemma in_foldr_UnE: "x \<in> foldr (\<union>) xs {} \<Longrightarrow> (\<And>A. A \<in> set xs \<Longrightarrow> x \<in> A \<Longrightarrow> P) \<Longrightarrow> P"
   by (induction xs) auto
 
 lemma sat_the_restrict: "fv \<phi> \<subseteq> A \<Longrightarrow> Formula.sat \<sigma> V (map the (restrict A v)) i \<phi> = Formula.sat \<sigma> V (map the v) i \<phi>"
   by (rule sat_fv_cong) (auto intro!: map_the_restrict)
 
 lemma eps_the_restrict: "fv_regex r \<subseteq> A \<Longrightarrow> Regex.eps (Formula.sat \<sigma> V (map the (restrict A v))) i r = Regex.eps (Formula.sat \<sigma> V (map the v)) i r"
   by (rule eps_fv_cong) (auto intro!: map_the_restrict)
 
 lemma sorted_wrt_filter[simp]: "sorted_wrt R xs \<Longrightarrow> sorted_wrt R (filter P xs)"
   by (induct xs) auto
 
 lemma concat_map_filter[simp]:
   "concat (map f (filter P xs)) = concat (map (\<lambda>x. if P x then f x else []) xs)"
   by (induct xs) auto
 
 lemma map_filter_alt:
   "map f (filter P xs) = concat (map (\<lambda>x. if P x then [f x] else []) xs)"
   by (induct xs) auto
 
 lemma (in maux) update_since:
   assumes pre: "wf_since_aux \<sigma> V R args \<phi> \<psi> aux ne"
     and qtable1: "qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne \<phi>) rel1"
     and qtable2: "qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne \<psi>) rel2"
     and result_eq: "(rel, aux') = update_since args rel1 rel2 (\<tau> \<sigma> ne) aux"
     and fvi_subset: "Formula.fv \<phi> \<subseteq> Formula.fv \<psi>"
     and args_ivl: "args_ivl args = I"
     and args_n: "args_n args = n"
     and args_L: "args_L args = Formula.fv \<phi>"
     and args_R: "args_R args = Formula.fv \<psi>"
     and args_pos: "args_pos args = pos"
   shows "wf_since_aux \<sigma> V R args \<phi> \<psi> aux' (Suc ne)"
     and "qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne (Sincep pos \<phi> I \<psi>)) rel"
 proof -
   let ?wf_tuple = "\<lambda>v. wf_tuple n (Formula.fv \<psi>) v"
   note sat.simps[simp del]
   from pre[unfolded wf_since_aux_def] obtain cur auxlist where aux: "valid_msaux args cur aux auxlist"
     "sorted_wrt (\<lambda>x y. fst y < fst x) auxlist"
     "\<And>t X. (t, X) \<in> set auxlist \<Longrightarrow> ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne - 1) \<and> \<tau> \<sigma> (ne - 1) - t \<le> right I \<and>
       (\<exists>i. \<tau> \<sigma> i = t) \<and>
       qtable n (fv \<psi>) (mem_restr R)
         (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne - 1) (Sincep pos \<phi> (point (\<tau> \<sigma> (ne - 1) - t)) \<psi>)) X"
     "\<And>t. ne \<noteq> 0 \<Longrightarrow> t \<le> \<tau> \<sigma> (ne - 1) \<Longrightarrow> \<tau> \<sigma> (ne - 1) - t \<le> right I \<Longrightarrow> (\<exists>i. \<tau> \<sigma> i = t) \<Longrightarrow>
       (\<exists>X. (t, X) \<in> set auxlist)"
     and cur_def:
     "cur = (if ne = 0 then 0 else \<tau> \<sigma> (ne - 1))"
     unfolding args_ivl args_n args_pos by blast
   from pre[unfolded wf_since_aux_def] have fv_sub: "Formula.fv \<phi> \<subseteq> Formula.fv \<psi>" by simp
 
   define aux0 where "aux0 = join_msaux args rel1 (add_new_ts_msaux args (\<tau> \<sigma> ne) aux)"
   define auxlist0 where "auxlist0 = [(t, join rel pos rel1). (t, rel) \<leftarrow> auxlist, \<tau> \<sigma> ne - t \<le> right I]"
   have tabL: "table (args_n args) (args_L args) rel1"
     using qtable1[unfolded qtable_def] unfolding args_n[symmetric] args_L[symmetric] by simp
   have cur_le: "cur \<le> \<tau> \<sigma> ne"
     unfolding cur_def by auto
   have valid0: "valid_msaux args (\<tau> \<sigma> ne) aux0 auxlist0" unfolding aux0_def auxlist0_def
     using valid_join_msaux[OF valid_add_new_ts_msaux[OF aux(1)], OF cur_le tabL]
     by (auto simp: args_ivl args_pos cur_def map_filter_alt split_beta cong: map_cong)
   from aux(2) have sorted_auxlist0: "sorted_wrt (\<lambda>x y. fst x > fst y) auxlist0"
     unfolding auxlist0_def
     by (induction auxlist) (auto simp add: sorted_wrt_append)
   have in_auxlist0_1: "(t, X) \<in> set auxlist0 \<Longrightarrow> ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> (ne-1) \<and> \<tau> \<sigma> ne - t \<le> right I \<and>
       (\<exists>i. \<tau> \<sigma> i = t) \<and>
       qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. (Formula.sat \<sigma> V (map the v) (ne-1) (Sincep pos \<phi> (point (\<tau> \<sigma> (ne-1) - t)) \<psi>) \<and>
         (if pos then Formula.sat \<sigma> V (map the v) ne \<phi> else \<not> Formula.sat \<sigma> V (map the v) ne \<phi>))) X" for t X
     unfolding auxlist0_def using fvi_subset
     by (auto 0 1 elim!: qtable_join[OF _ qtable1] simp: sat_the_restrict dest!: aux(3))
   then have in_auxlist0_le_\<tau>: "(t, X) \<in> set auxlist0 \<Longrightarrow> t \<le> \<tau> \<sigma> ne" for t X
     by (meson \<tau>_mono diff_le_self le_trans)
   have in_auxlist0_2: "ne \<noteq> 0 \<Longrightarrow> t \<le> \<tau> \<sigma> (ne-1) \<Longrightarrow> \<tau> \<sigma> ne - t \<le> right I \<Longrightarrow> \<exists>i. \<tau> \<sigma> i = t \<Longrightarrow>
     \<exists>X. (t, X) \<in> set auxlist0" for t
   proof -
     fix t
     assume "ne \<noteq> 0" "t \<le> \<tau> \<sigma> (ne-1)" "\<tau> \<sigma> ne - t \<le> right I" "\<exists>i. \<tau> \<sigma> i = t"
     then obtain X where "(t, X) \<in> set auxlist"
       by (atomize_elim, intro aux(4))
         (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \<tau>_mono)
     with \<open>\<tau> \<sigma> ne - t \<le> right I\<close> have "(t, join X pos rel1) \<in> set auxlist0"
       unfolding auxlist0_def by (auto elim!: bexI[rotated] intro!: exI[of _ X])
     then show "\<exists>X. (t, X) \<in> set auxlist0"
       by blast
   qed
   have auxlist0_Nil: "auxlist0 = [] \<Longrightarrow> ne = 0 \<or> ne \<noteq> 0 \<and> (\<forall>t. t \<le> \<tau> \<sigma> (ne-1) \<and> \<tau> \<sigma> ne - t \<le> right I \<longrightarrow>
         (\<nexists>i. \<tau> \<sigma> i = t))"
     using in_auxlist0_2 by (auto)
 
   have aux'_eq: "aux' = add_new_table_msaux args rel2 aux0"
     using result_eq unfolding aux0_def update_since_def Let_def by simp
   define auxlist' where
     auxlist'_eq: "auxlist' = (case auxlist0 of
       [] \<Rightarrow> [(\<tau> \<sigma> ne, rel2)]
     | x # auxlist' \<Rightarrow> (if fst x = \<tau> \<sigma> ne then (fst x, snd x \<union> rel2) # auxlist' else (\<tau> \<sigma> ne, rel2) # x # auxlist'))"
   have tabR: "table (args_n args) (args_R args) rel2"
     using qtable2[unfolded qtable_def] unfolding args_n[symmetric] args_R[symmetric] by simp
   have valid': "valid_msaux args (\<tau> \<sigma> ne) aux' auxlist'"
     unfolding aux'_eq auxlist'_eq using valid_add_new_table_msaux[OF valid0 tabR]
     by (auto simp: not_le split: list.splits option.splits if_splits)
   have sorted_auxlist': "sorted_wrt (\<lambda>x y. fst x > fst y) auxlist'"
     unfolding auxlist'_eq
     using sorted_auxlist0 in_auxlist0_le_\<tau> by (cases auxlist0) fastforce+
   have in_auxlist'_1: "t \<le> \<tau> \<sigma> ne \<and> \<tau> \<sigma> ne - t \<le> right I \<and> (\<exists>i. \<tau> \<sigma> i = t) \<and>
       qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne (Sincep pos \<phi> (point (\<tau> \<sigma> ne - t)) \<psi>)) X"
     if auxlist': "(t, X) \<in> set auxlist'" for t X
   proof (cases auxlist0)
     case Nil
     with auxlist' show ?thesis
       unfolding auxlist'_eq using qtable2 auxlist0_Nil
       by (auto simp: zero_enat_def[symmetric] sat_Since_rec[where i=ne]
           dest: spec[of _ "\<tau> \<sigma> (ne-1)"] elim!: qtable_cong[OF _ refl])
   next
     case (Cons a as)
     show ?thesis
     proof (cases "t = \<tau> \<sigma> ne")
       case t: True
       show ?thesis
       proof (cases "fst a = \<tau> \<sigma> ne")
         case True
         with auxlist' Cons t have "X = snd a \<union> rel2"
           unfolding auxlist'_eq using sorted_auxlist0 by (auto split: if_splits)
         moreover from in_auxlist0_1[of "fst a" "snd a"] Cons have "ne \<noteq> 0"
           "fst a \<le> \<tau> \<sigma> (ne - 1)" "\<tau> \<sigma> ne - fst a \<le> right I" "\<exists>i. \<tau> \<sigma> i = fst a"
           "qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne - 1)
             (Sincep pos \<phi> (point (\<tau> \<sigma> (ne - 1) - fst a)) \<psi>) \<and> (if pos then Formula.sat \<sigma> V (map the v) ne \<phi>
               else \<not> Formula.sat \<sigma> V (map the v) ne \<phi>)) (snd a)"
           by (auto simp: True[symmetric] zero_enat_def[symmetric])
         ultimately show ?thesis using qtable2 t True
           by (auto simp: sat_Since_rec[where i=ne] sat.simps(6) elim!: qtable_union)
       next
         case False
         with auxlist' Cons t have "X = rel2"
           unfolding auxlist'_eq using sorted_auxlist0 in_auxlist0_le_\<tau>[of "fst a" "snd a"] by (auto split: if_splits)
         with auxlist' Cons t False show ?thesis
           unfolding auxlist'_eq using qtable2 in_auxlist0_2[of "\<tau> \<sigma> (ne-1)"] in_auxlist0_le_\<tau>[of "fst a" "snd a"] sorted_auxlist0
           by (auto simp: sat_Since_rec[where i=ne] sat.simps(3) zero_enat_def[symmetric] enat_0_iff not_le
               elim!: qtable_cong[OF _ refl] dest!: le_\<tau>_less meta_mp)
       qed
     next
       case False
       with auxlist' Cons have "(t, X) \<in> set auxlist0"
         unfolding auxlist'_eq by (auto split: if_splits)
       then have "ne \<noteq> 0" "t \<le> \<tau> \<sigma> (ne - 1)" "\<tau> \<sigma> ne - t \<le> right I" "\<exists>i. \<tau> \<sigma> i = t"
         "qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne - 1) (Sincep pos \<phi> (point (\<tau> \<sigma> (ne - 1) - t)) \<psi>) \<and>
            (if pos then Formula.sat \<sigma> V (map the v) ne \<phi> else \<not> Formula.sat \<sigma> V (map the v) ne \<phi>)) X"
         using in_auxlist0_1 by blast+
       with False auxlist' Cons show ?thesis
         unfolding auxlist'_eq using qtable2
         by (fastforce simp: sat_Since_rec[where i=ne] sat.simps(6)
             diff_diff_right[where i="\<tau> \<sigma> ne" and j="\<tau> \<sigma> _ + \<tau> \<sigma> ne" and k="\<tau> \<sigma> (ne - 1)",
               OF trans_le_add2, simplified] elim!: qtable_cong[OF _ refl] order_trans dest: le_\<tau>_less)
     qed
   qed
 
   have in_auxlist'_2: "\<exists>X. (t, X) \<in> set auxlist'" if "t \<le> \<tau> \<sigma> ne" "\<tau> \<sigma> ne - t \<le> right I" "\<exists>i. \<tau> \<sigma> i = t" for t
   proof (cases "t = \<tau> \<sigma> ne")
     case True
     then show ?thesis
     proof (cases auxlist0)
       case Nil
       with True show ?thesis unfolding auxlist'_eq by (simp add: zero_enat_def[symmetric])
     next
       case (Cons a as)
       with True show ?thesis unfolding auxlist'_eq
         by (cases "fst a = \<tau> \<sigma> ne") (auto simp: zero_enat_def[symmetric])
     qed
   next
     case False
     with that have "ne \<noteq> 0"
       using le_\<tau>_less neq0_conv by blast
     moreover from False that have  "t \<le> \<tau> \<sigma> (ne-1)"
       by (metis One_nat_def Suc_leI Suc_pred \<tau>_mono diff_is_0_eq' order.antisym neq0_conv not_le)
     ultimately obtain X where "(t, X) \<in> set auxlist0" using \<open>\<tau> \<sigma> ne - t \<le> right I\<close> \<open>\<exists>i. \<tau> \<sigma> i = t\<close>
       using \<tau>_mono[of "ne - 1" "ne" \<sigma>] by (atomize_elim, cases "right I") (auto intro!: in_auxlist0_2 simp del: \<tau>_mono)
     then show ?thesis unfolding auxlist'_eq using False \<open>\<tau> \<sigma> ne - t \<le> right I\<close>
       by (auto intro: exI[of _ X] split: list.split)
   qed
 
   show "wf_since_aux \<sigma> V R args \<phi> \<psi> aux' (Suc ne)"
     unfolding wf_since_aux_def args_ivl args_n args_pos
     by (auto simp add: fv_sub dest: in_auxlist'_1 intro: sorted_auxlist' in_auxlist'_2
         intro!: exI[of _ auxlist'] valid')
 
   have "rel = result_msaux args aux'"
     using result_eq by (auto simp add: update_since_def Let_def)
   with valid' have rel_eq: "rel = foldr (\<union>) [rel. (t, rel) \<leftarrow> auxlist', left I \<le> \<tau> \<sigma> ne - t] {}"
     by (auto simp add: args_ivl valid_result_msaux
         intro!: arg_cong[where f = "\<lambda>x. foldr (\<union>) (concat x) {}"] split: option.splits)
   have rel_alt: "rel = (\<Union>(t, rel) \<in> set auxlist'. if left I \<le> \<tau> \<sigma> ne - t then rel else empty_table)"
     unfolding rel_eq
     by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)
   show "qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne (Sincep pos \<phi> I \<psi>)) rel"
     unfolding rel_alt
   proof (rule qtable_Union[where Qi="\<lambda>(t, X) v.
     left I \<le> \<tau> \<sigma> ne - t \<and> Formula.sat \<sigma> V (map the v) ne (Sincep pos \<phi> (point (\<tau> \<sigma> ne - t)) \<psi>)"],
         goal_cases finite qtable equiv)
     case (equiv v)
     show ?case
     proof (rule iffI, erule sat_Since_point, goal_cases left right)
       case (left j)
       then show ?case using in_auxlist'_2[of "\<tau> \<sigma> j", OF _ _ exI, OF _ _ refl] by auto
     next
       case right
       then show ?case by (auto elim!: sat_Since_pointD dest: in_auxlist'_1)
     qed
   qed (auto dest!: in_auxlist'_1 intro!: qtable_empty)
 qed
 
 lemma fv_regex_from_mregex:
   "ok (length \<phi>s) mr \<Longrightarrow> fv_regex (from_mregex mr \<phi>s) \<subseteq> (\<Union>\<phi> \<in> set \<phi>s. fv \<phi>)"
   by (induct mr) (auto simp: Bex_def in_set_conv_nth)+
 
 lemma qtable_\<epsilon>_lax:
   assumes "ok (length \<phi>s) mr"
     and "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>) rel) \<phi>s rels"
     and "fv_regex (from_mregex mr \<phi>s) \<subseteq> A" and "qtable n A (mem_restr R) Q guard"
   shows "qtable n A (mem_restr R)
    (\<lambda>v. Regex.eps (Formula.sat \<sigma> V (map the v)) i (from_mregex mr \<phi>s) \<and> Q v) (\<epsilon>_lax guard rels mr)"
   using assms
 proof (induct mr)
   case (MPlus mr1 mr2)
   from MPlus(3-6) show ?case
     by (auto intro!: qtable_union[OF MPlus(1,2)])
 next
   case (MTimes mr1 mr2)
   then have "fv_regex (from_mregex mr1 \<phi>s) \<subseteq> A" "fv_regex (from_mregex mr2 \<phi>s) \<subseteq> A"
     using fv_regex_from_mregex[of \<phi>s mr1] fv_regex_from_mregex[of \<phi>s mr2] by (auto simp: subset_eq)
   with MTimes(3-6) show ?case
     by (auto simp: eps_the_restrict restrict_idle intro!: qtable_join[OF MTimes(1,2)])
 qed (auto split: prod.splits if_splits simp: qtable_empty_iff list_all2_conv_all_nth
     in_set_conv_nth restrict_idle sat_the_restrict
     intro: in_qtableI qtableI elim!: qtable_join[where A=A and C=A])
 
 lemma nullary_qtable_cases: "qtable n {} P Q X \<Longrightarrow> (X = empty_table \<or> X = unit_table n)"
   by (simp add: qtable_def table_empty)
 
 lemma qtable_empty_unit_table:
   "qtable n {} R P empty_table \<Longrightarrow> qtable n {} R (\<lambda>v. \<not> P v) (unit_table n)"
   by (auto intro: qtable_unit_table simp add: qtable_empty_iff)
 
 lemma qtable_unit_empty_table:
   "qtable n {} R P (unit_table n) \<Longrightarrow> qtable n {} R (\<lambda>v. \<not> P v) empty_table"
   by (auto intro!: qtable_empty elim: in_qtableE simp add: wf_tuple_empty unit_table_def)
 
 lemma qtable_nonempty_empty_table:
   "qtable n {} R P X \<Longrightarrow> x \<in> X \<Longrightarrow> qtable n {} R (\<lambda>v. \<not> P v) empty_table"
   by (frule nullary_qtable_cases) (auto dest: qtable_unit_empty_table)
 
 
 lemma qtable_r\<epsilon>_strict:
   assumes "safe_regex Past Strict (from_mregex mr \<phi>s)" "ok (length \<phi>s) mr" "A = fv_regex (from_mregex mr \<phi>s)"
     and "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>) rel) \<phi>s rels"
   shows "qtable n A (mem_restr R) (\<lambda>v. Regex.eps (Formula.sat \<sigma> V (map the v)) i (from_mregex mr \<phi>s)) (r\<epsilon>_strict n rels mr)"
   using assms
 proof (hypsubst, induct Past Strict "from_mregex mr \<phi>s" arbitrary: mr rule: safe_regex_induct)
   case (Skip n)
   then show ?case
     by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)
 next
   case (Test \<phi>)
   then show ?case
     by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table
         dest!: qtable_nonempty_empty_table split: if_splits)
 next
   case (Plus r s)
   then show ?case
     by (cases mr) (fastforce intro: qtable_union split: if_splits)+
 next
   case (TimesP r s)
   then show ?case
     by (cases mr) (auto intro: qtable_cong[OF qtable_\<epsilon>_lax] split: if_splits)+
 next
   case (Star r)
   then show ?case
     by (cases mr) (auto simp: qtable_unit_table split: if_splits)
 qed
 
 lemma qtable_l\<epsilon>_strict:
   assumes "safe_regex Futu Strict (from_mregex mr \<phi>s)" "ok (length \<phi>s) mr" "A = fv_regex (from_mregex mr \<phi>s)"
     and "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>) rel) \<phi>s rels"
   shows "qtable n A (mem_restr R) (\<lambda>v. Regex.eps (Formula.sat \<sigma> V (map the v)) i (from_mregex mr \<phi>s)) (l\<epsilon>_strict n rels mr)"
   using assms
 proof (hypsubst, induct Futu Strict "from_mregex mr \<phi>s" arbitrary: mr rule: safe_regex_induct)
   case (Skip n)
   then show ?case
     by (cases mr) (auto simp: qtable_empty_iff qtable_unit_table split: if_splits)
 next
   case (Test \<phi>)
   then show ?case
     by (cases mr) (auto simp: list_all2_conv_all_nth qtable_empty_unit_table
         dest!: qtable_nonempty_empty_table split: if_splits)
 next
   case (Plus r s)
   then show ?case
     by (cases mr) (fastforce intro: qtable_union split: if_splits)+
 next
   case (TimesF r s)
   then show ?case
     by (cases mr) (auto intro: qtable_cong[OF qtable_\<epsilon>_lax] split: if_splits)+
 next
   case (Star r)
   then show ?case
     by (cases mr) (auto simp: qtable_unit_table split: if_splits)
 qed
 
 lemma rtranclp_False: "(\<lambda>i j. False)\<^sup>*\<^sup>* = (=)"
 proof -
   have "(\<lambda>i j. False)\<^sup>*\<^sup>* i j \<Longrightarrow> i = j" for i j :: 'a
     by (induct i j rule: rtranclp.induct) auto
   then show ?thesis
     by (auto intro: exI[of _ 0])
 qed
 
 inductive ok_rctxt for \<phi>s where
   "ok_rctxt \<phi>s id id"
 | "ok_rctxt \<phi>s \<kappa> \<kappa>' \<Longrightarrow> ok_rctxt \<phi>s (\<lambda>t. \<kappa> (MTimes mr t)) (\<lambda>t. \<kappa>' (Regex.Times (from_mregex mr \<phi>s) t))"
 
 lemma ok_rctxt_swap: "ok_rctxt \<phi>s \<kappa> \<kappa>' \<Longrightarrow> from_mregex (\<kappa> mr) \<phi>s = \<kappa>' (from_mregex mr \<phi>s)"
   by (induct \<kappa> \<kappa>' arbitrary: mr rule: ok_rctxt.induct) auto
 
 lemma ok_rctxt_cong: "ok_rctxt \<phi>s \<kappa> \<kappa>' \<Longrightarrow> Regex.match (Formula.sat \<sigma> V v) r = Regex.match (Formula.sat \<sigma> V v) s \<Longrightarrow>
   Regex.match (Formula.sat \<sigma> V v) (\<kappa>' r) i j = Regex.match (Formula.sat \<sigma> V v) (\<kappa>' s) i j"
   by (induct \<kappa> \<kappa>' arbitrary: r s rule: ok_rctxt.induct) simp_all
 
 lemma qtable_r\<delta>\<kappa>:
   assumes "ok (length \<phi>s) mr" "fv_regex (from_mregex mr \<phi>s) \<subseteq> A"
     and "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) j \<phi>) rel) \<phi>s rels"
     and "ok_rctxt \<phi>s \<kappa> \<kappa>'"
     and "\<forall>ms \<in> \<kappa> ` RPD mr. qtable n A (mem_restr R) (\<lambda>v. Q (map the v) (from_mregex ms \<phi>s)) (lookup rel ms)"
   shows "qtable n A (mem_restr R)
   (\<lambda>v. \<exists>s \<in> Regex.rpd\<kappa> \<kappa>' (Formula.sat \<sigma> V (map the v)) j (from_mregex mr \<phi>s). Q (map the v) s)
   (r\<delta> \<kappa> rel rels mr)"
   using assms
 proof (induct mr arbitrary: \<kappa> \<kappa>')
   case MSkip
   then show ?case
     by (auto simp: rtranclp_False ok_rctxt_swap qtable_empty_iff
         elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \<kappa> \<kappa>']] split: nat.splits)
 next
   case (MPlus mr1 mr2)
   from MPlus(3-7) show ?case
     by (auto intro!: qtable_union[OF MPlus(1,2)])
 next
   case (MTimes mr1 mr2)
   from MTimes(3-7) show ?case
     by (auto intro!: qtable_union[OF MTimes(2) qtable_\<epsilon>_lax[OF _ _ _ MTimes(1)]]
         elim!: ok_rctxt.intros(2) simp: MTimesL_def Ball_def)
 next
   case (MStar mr)
   from MStar(2-6) show ?case
     by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_rctxt.intros simp: MTimesL_def Ball_def)
 qed (auto simp: qtable_empty_iff)
 
 lemmas qtable_r\<delta> = qtable_r\<delta>\<kappa>[OF _ _ _ ok_rctxt.intros(1), unfolded rpd\<kappa>_rpd image_id id_apply]
 
 inductive ok_lctxt for \<phi>s where
   "ok_lctxt \<phi>s id id"
 | "ok_lctxt \<phi>s \<kappa> \<kappa>' \<Longrightarrow> ok_lctxt \<phi>s (\<lambda>t. \<kappa> (MTimes t mr)) (\<lambda>t. \<kappa>' (Regex.Times t (from_mregex mr \<phi>s)))"
 
 lemma ok_lctxt_swap: "ok_lctxt \<phi>s \<kappa> \<kappa>' \<Longrightarrow> from_mregex (\<kappa> mr) \<phi>s = \<kappa>' (from_mregex mr \<phi>s)"
   by (induct \<kappa> \<kappa>' arbitrary: mr rule: ok_lctxt.induct) auto
 
 lemma ok_lctxt_cong: "ok_lctxt \<phi>s \<kappa> \<kappa>' \<Longrightarrow> Regex.match (Formula.sat \<sigma> V v) r = Regex.match (Formula.sat \<sigma> V v) s \<Longrightarrow>
   Regex.match (Formula.sat \<sigma> V v) (\<kappa>' r) i j = Regex.match (Formula.sat \<sigma> V v) (\<kappa>' s) i j"
   by (induct \<kappa> \<kappa>' arbitrary: r s rule: ok_lctxt.induct) simp_all
 
 lemma qtable_l\<delta>\<kappa>:
   assumes "ok (length \<phi>s) mr" "fv_regex (from_mregex mr \<phi>s) \<subseteq> A"
     and "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) j \<phi>) rel) \<phi>s rels"
     and "ok_lctxt \<phi>s \<kappa> \<kappa>'"
     and "\<forall>ms \<in> \<kappa> ` LPD mr. qtable n A (mem_restr R) (\<lambda>v. Q (map the v) (from_mregex ms \<phi>s)) (lookup rel ms)"
   shows "qtable n A (mem_restr R)
   (\<lambda>v. \<exists>s \<in> Regex.lpd\<kappa> \<kappa>' (Formula.sat \<sigma> V (map the v)) j (from_mregex mr \<phi>s). Q (map the v) s)
   (l\<delta> \<kappa> rel rels mr)"
   using assms
 proof (induct mr arbitrary: \<kappa> \<kappa>')
   case MSkip
   then show ?case
     by (auto simp: rtranclp_False ok_lctxt_swap qtable_empty_iff
         elim!: qtable_cong[OF _ _ ok_rctxt_cong[of _ \<kappa> \<kappa>']] split: nat.splits)
 next
   case (MPlus mr1 mr2)
   from MPlus(3-7) show ?case
     by (auto intro!: qtable_union[OF MPlus(1,2)])
 next
   case (MTimes mr1 mr2)
   from MTimes(3-7) show ?case
     by (auto intro!: qtable_union[OF MTimes(1) qtable_\<epsilon>_lax[OF _ _ _ MTimes(2)]]
         elim!: ok_lctxt.intros(2) simp: MTimesR_def Ball_def)
 next
   case (MStar mr)
   from MStar(2-6) show ?case
     by (auto intro!: qtable_cong[OF MStar(1)] intro: ok_lctxt.intros simp: MTimesR_def Ball_def)
 qed (auto simp: qtable_empty_iff)
 
 lemmas qtable_l\<delta> = qtable_l\<delta>\<kappa>[OF _ _ _ ok_lctxt.intros(1), unfolded lpd\<kappa>_lpd image_id id_apply]
 
 lemma RPD_fv_regex_le:
   "ms \<in> RPD mr \<Longrightarrow> fv_regex (from_mregex ms \<phi>s) \<subseteq> fv_regex (from_mregex mr \<phi>s)"
   by (induct mr arbitrary: ms) (auto simp: MTimesL_def split: nat.splits)+
 
 lemma RPD_safe: "safe_regex Past g (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> RPD mr \<Longrightarrow> safe_regex Past g (from_mregex ms \<phi>s)"
 proof (induct Past g "from_mregex mr \<phi>s" arbitrary: mr ms rule: safe_regex_induct)
   case Skip
   then show ?case
     by (cases mr) (auto split: nat.splits)
 next
   case (Test g \<phi>)
   then show ?case
     by (cases mr) auto
 next
   case (Plus g r s mrs)
   then show ?case
   proof (cases mrs)
     case (MPlus mr ms)
     with Plus(3-5) show ?thesis
       by (auto dest!: Plus(1,2))
   qed auto
 next
   case (TimesP g r s mrs)
   then show ?case
   proof (cases mrs)
     case (MTimes mr ms)
     with TimesP(3-5) show ?thesis
       by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le TimesP(1,2))
   qed auto
 next
   case (Star g r)
   then show ?case
   proof (cases mr)
     case (MStar x6)
     with Star(2-4) show ?thesis
       by (cases g) (auto 0 4 simp: MTimesL_def dest: RPD_fv_regex_le
           elim!: safe_cosafe[rotated] dest!: Star(1))
   qed auto
 qed
 
 lemma RPDi_safe: "safe_regex Past g (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> RPDi n mr ==> safe_regex Past g (from_mregex ms \<phi>s)"
   by (induct n arbitrary: ms mr) (auto dest: RPD_safe)
 
 lemma RPDs_safe: "safe_regex Past g (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> RPDs mr ==> safe_regex Past g (from_mregex ms \<phi>s)"
   unfolding RPDs_def by (auto dest: RPDi_safe)
 
 lemma RPD_safe_fv_regex: "safe_regex Past Strict (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> RPD mr \<Longrightarrow> fv_regex (from_mregex ms \<phi>s) = fv_regex (from_mregex mr \<phi>s)"
 proof (induct Past Strict "from_mregex mr \<phi>s" arbitrary: mr rule: safe_regex_induct)
   case (Skip n)
   then show ?case
     by (cases mr) (auto split: nat.splits)
 next
   case (Test \<phi>)
   then show ?case
     by (cases mr) auto
 next
   case (Plus r s)
   then show ?case
     by (cases mr) auto
 next
   case (TimesP r s)
   then show ?case
     by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le split: modality.splits)
 next
   case (Star r)
   then show ?case
     by (cases mr) (auto 0 3 simp: MTimesL_def dest: RPD_fv_regex_le)
 qed
 
 lemma RPDi_safe_fv_regex: "safe_regex Past Strict (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> RPDi n mr ==> fv_regex (from_mregex ms \<phi>s) = fv_regex (from_mregex mr \<phi>s)"
   by (induct n arbitrary: ms mr) (auto 5 0 dest: RPD_safe_fv_regex RPD_safe)
 
 lemma RPDs_safe_fv_regex: "safe_regex Past Strict (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> RPDs mr ==> fv_regex (from_mregex ms \<phi>s) = fv_regex (from_mregex mr \<phi>s)"
   unfolding RPDs_def by (auto dest: RPDi_safe_fv_regex)
 
 lemma RPD_ok: "ok m mr \<Longrightarrow> ms \<in> RPD mr \<Longrightarrow> ok m ms"
 proof (induct mr arbitrary: ms)
   case (MPlus mr1 mr2)
   from MPlus(3,4) show ?case
     by (auto elim: MPlus(1,2))
 next
   case (MTimes mr1 mr2)
   from MTimes(3,4) show ?case
     by (auto elim: MTimes(1,2) simp: MTimesL_def)
 next
   case (MStar mr)
   from MStar(2,3) show ?case
     by (auto elim: MStar(1) simp: MTimesL_def)
 qed (auto split: nat.splits)
 
 lemma RPDi_ok: "ok m mr \<Longrightarrow> ms \<in> RPDi n mr \<Longrightarrow> ok m ms"
   by (induct n arbitrary: ms mr) (auto intro: RPD_ok)
 
 lemma RPDs_ok: "ok m mr \<Longrightarrow> ms \<in> RPDs mr \<Longrightarrow> ok m ms"
   unfolding RPDs_def by (auto intro: RPDi_ok)
 
 lemma LPD_fv_regex_le:
   "ms \<in> LPD mr \<Longrightarrow> fv_regex (from_mregex ms \<phi>s) \<subseteq> fv_regex (from_mregex mr \<phi>s)"
   by (induct mr arbitrary: ms) (auto simp: MTimesR_def split: nat.splits)+
 
 lemma LPD_safe: "safe_regex Futu g (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> LPD mr ==> safe_regex Futu g (from_mregex ms \<phi>s)"
 proof (induct Futu g "from_mregex mr \<phi>s" arbitrary: mr ms rule: safe_regex_induct)
   case Skip
   then show ?case
     by (cases mr) (auto split: nat.splits)
 next
   case (Test g \<phi>)
   then show ?case
     by (cases mr) auto
 next
   case (Plus g r s mrs)
   then show ?case
   proof (cases mrs)
     case (MPlus mr ms)
     with Plus(3-5) show ?thesis
       by (auto dest!: Plus(1,2))
   qed auto
 next
   case (TimesF g r s mrs)
   then show ?case
   proof (cases mrs)
     case (MTimes mr ms)
     with TimesF(3-5) show ?thesis
       by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits dest: TimesF(1,2))
   qed auto
 next
   case (Star g r)
   then show ?case
   proof (cases mr)
     case (MStar x6)
     with Star(2-4) show ?thesis
       by (cases g) (auto 0 4 simp: MTimesR_def dest: LPD_fv_regex_le
           elim!: safe_cosafe[rotated] dest!: Star(1))
   qed auto
 qed
 
 lemma LPDi_safe: "safe_regex Futu g (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> LPDi n mr ==> safe_regex Futu g (from_mregex ms \<phi>s)"
   by (induct n arbitrary: ms mr) (auto dest: LPD_safe)
 
 lemma LPDs_safe: "safe_regex Futu g (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> LPDs mr ==> safe_regex Futu g (from_mregex ms \<phi>s)"
   unfolding LPDs_def by (auto dest: LPDi_safe)
 
 lemma LPD_safe_fv_regex: "safe_regex Futu Strict (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> LPD mr ==> fv_regex (from_mregex ms \<phi>s) = fv_regex (from_mregex mr \<phi>s)"
 proof (induct Futu Strict "from_mregex mr \<phi>s" arbitrary: mr rule: safe_regex_induct)
   case Skip
   then show ?case
     by (cases mr) (auto split: nat.splits)
 next
   case (Test \<phi>)
   then show ?case
     by (cases mr) auto
 next
   case (Plus r s)
   then show ?case
     by (cases mr) auto
 next
   case (TimesF r s)
   then show ?case
     by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le split: modality.splits)
 next
   case (Star r)
   then show ?case
     by (cases mr) (auto 0 3 simp: MTimesR_def dest: LPD_fv_regex_le)
 qed
 
 lemma LPDi_safe_fv_regex: "safe_regex Futu Strict (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> LPDi n mr ==> fv_regex (from_mregex ms \<phi>s) = fv_regex (from_mregex mr \<phi>s)"
   by (induct n arbitrary: ms mr) (auto 5 0 dest: LPD_safe_fv_regex LPD_safe)
 
 lemma LPDs_safe_fv_regex: "safe_regex Futu Strict (from_mregex mr \<phi>s) \<Longrightarrow>
   ms \<in> LPDs mr ==> fv_regex (from_mregex ms \<phi>s) = fv_regex (from_mregex mr \<phi>s)"
   unfolding LPDs_def by (auto dest: LPDi_safe_fv_regex)
 
 lemma LPD_ok: "ok m mr \<Longrightarrow> ms \<in> LPD mr \<Longrightarrow> ok m ms"
 proof (induct mr arbitrary: ms)
   case (MPlus mr1 mr2)
   from MPlus(3,4) show ?case
     by (auto elim: MPlus(1,2))
 next
   case (MTimes mr1 mr2)
   from MTimes(3,4) show ?case
     by (auto elim: MTimes(1,2) simp: MTimesR_def)
 next
   case (MStar mr)
   from MStar(2,3) show ?case
     by (auto elim: MStar(1) simp: MTimesR_def)
 qed (auto split: nat.splits)
 
 lemma LPDi_ok: "ok m mr \<Longrightarrow> ms \<in> LPDi n mr \<Longrightarrow> ok m ms"
   by (induct n arbitrary: ms mr) (auto intro: LPD_ok)
 
 lemma LPDs_ok: "ok m mr \<Longrightarrow> ms \<in> LPDs mr \<Longrightarrow> ok m ms"
   unfolding LPDs_def by (auto intro: LPDi_ok)
 
 lemma update_matchP:
   assumes pre: "wf_matchP_aux \<sigma> V n R I r aux ne"
     and safe: "safe_regex Past Strict r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and mrs: "mrs = sorted_list_of_set (RPDs mr)"
     and qtables: "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne \<phi>) rel) \<phi>s rels"
     and result_eq: "(rel, aux') = update_matchP n I mr mrs rels (\<tau> \<sigma> ne) aux"
   shows "wf_matchP_aux \<sigma> V n R I r aux' (Suc ne)"
     and "qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne (Formula.MatchP I r)) rel"
 proof -
   let ?wf_tuple = "\<lambda>v. wf_tuple n (Formula.fv_regex r) v"
   let ?update = "\<lambda>rel t. mrtabulate mrs (\<lambda>mr.
     r\<delta> id rel rels mr \<union> (if t = \<tau> \<sigma> ne then r\<epsilon>_strict n rels mr else {}))"
   note sat.simps[simp del]
 
   define aux0 where "aux0 = [(t, ?update rel t). (t, rel) \<leftarrow> aux, enat (\<tau> \<sigma> ne - t) \<le> right I]"
   have sorted_aux0: "sorted_wrt (\<lambda>x y. fst x > fst y) aux0"
     using pre[unfolded wf_matchP_aux_def, THEN conjunct1]
     unfolding aux0_def
     by (induction aux) (auto simp add: sorted_wrt_append)
   { fix ms
     assume "ms \<in> RPDs mr"
     then have "fv_regex (from_mregex ms \<phi>s) = fv_regex r"
       "safe_regex Past Strict (from_mregex ms \<phi>s)" "ok (length \<phi>s) ms" "RPD ms \<subseteq> RPDs mr"
       using safe RPDs_safe RPDs_safe_fv_regex mr from_mregex_to_mregex RPDs_ok to_mregex_ok RPDs_trans
       by fastforce+
   } note * = this
   have **: "\<tau> \<sigma> ne - (\<tau> \<sigma> i + \<tau> \<sigma> ne - \<tau> \<sigma> (ne - Suc 0)) = \<tau> \<sigma> (ne - Suc 0) - \<tau> \<sigma> i" for i
     by (metis (no_types, lifting) Nat.diff_diff_right \<tau>_mono add.commute add_diff_cancel_left diff_le_self le_add2 order_trans)
   have ***: "\<tau> \<sigma> i = \<tau> \<sigma> ne"
     if  "\<tau> \<sigma> ne \<le> \<tau> \<sigma> i" "\<tau> \<sigma> i \<le> \<tau> \<sigma> (ne - Suc 0)" "ne > 0" for i
     by (metis (no_types, lifting) Suc_pred \<tau>_mono diff_le_self le_\<tau>_less le_antisym not_less_eq that)
   then have in_aux0_1: "(t, X) \<in> set aux0 \<Longrightarrow> ne \<noteq> 0 \<and> t \<le> \<tau> \<sigma> ne \<and> \<tau> \<sigma> ne - t \<le> right I \<and>
       (\<exists>i. \<tau> \<sigma> i = t) \<and>
       (\<forall>ms\<in>RPDs mr. qtable n (fv_regex r) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne
          (Formula.MatchP (point (\<tau> \<sigma> ne - t)) (from_mregex ms \<phi>s))) (lookup X ms))" for t X
     unfolding aux0_def using safe mr mrs
     by (auto simp: lookup_tabulate map_of_map_restrict restrict_map_def finite_RPDs * ** RPDs_trans diff_le_mono2
         intro!: sat_MatchP_rec[of \<sigma> _ _ ne, THEN iffD2]
         qtable_union[OF qtable_r\<delta>[OF _ _ qtables] qtable_r\<epsilon>_strict[OF _ _ _ qtables],
           of ms "fv_regex r" "\<lambda>v r. Formula.sat \<sigma> V v (ne - Suc 0) (Formula.MatchP (point 0) r)" _ ms for ms]
         qtable_cong[OF qtable_r\<delta>[OF _ _ qtables],
           of ms "fv_regex r" "\<lambda>v r. Formula.sat \<sigma> V v (ne - Suc 0) (Formula.MatchP (point (\<tau> \<sigma> (ne - Suc 0) - \<tau> \<sigma> i)) r)"
           _ _  "(\<lambda>v. Formula.sat \<sigma> V (map the v) ne (Formula.MatchP (point (\<tau> \<sigma> ne - \<tau> \<sigma> i))  (from_mregex ms \<phi>s)))" for ms i]
         dest!: assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct1, rule_format]
         sat_MatchP_rec["of" \<sigma> _ _ ne, THEN iffD1]
         elim!: bspec order.trans[OF _ \<tau>_mono] bexI[rotated] split: option.splits if_splits) (* slow 7 sec *)
   then have in_aux0_le_\<tau>: "(t, X) \<in> set aux0 \<Longrightarrow> t \<le> \<tau> \<sigma> ne" for t X
     by (meson \<tau>_mono diff_le_self le_trans)
   have in_aux0_2: "ne \<noteq> 0 \<Longrightarrow> t \<le> \<tau> \<sigma> (ne-1) \<Longrightarrow> \<tau> \<sigma> ne - t \<le> right I \<Longrightarrow> \<exists>i. \<tau> \<sigma> i = t \<Longrightarrow>
     \<exists>X. (t, X) \<in> set aux0" for t
   proof -
     fix t
     assume "ne \<noteq> 0" "t \<le> \<tau> \<sigma> (ne-1)" "\<tau> \<sigma> ne - t \<le> right I" "\<exists>i. \<tau> \<sigma> i = t"
     then obtain X where "(t, X) \<in> set aux"
       by (atomize_elim, intro assms(1)[unfolded wf_matchP_aux_def, THEN conjunct2, THEN conjunct2, rule_format])
         (auto simp: gr0_conv_Suc elim!: order_trans[rotated] intro!: diff_le_mono \<tau>_mono)
     with \<open>\<tau> \<sigma> ne - t \<le> right I\<close> have "(t, ?update X t) \<in> set aux0"
       unfolding aux0_def by (auto simp: id_def elim!: bexI[rotated] intro!: exI[of _ X])
     then show "\<exists>X. (t, X) \<in> set aux0"
       by blast
   qed
   have aux0_Nil: "aux0 = [] \<Longrightarrow> ne = 0 \<or> ne \<noteq> 0 \<and> (\<forall>t. t \<le> \<tau> \<sigma> (ne-1) \<and> \<tau> \<sigma> ne - t \<le> right I \<longrightarrow>
         (\<nexists>i. \<tau> \<sigma> i = t))"
     using in_aux0_2 by (cases "ne = 0") (auto)
 
   have aux'_eq: "aux' = (case aux0 of
       [] \<Rightarrow> [(\<tau> \<sigma> ne, mrtabulate mrs (r\<epsilon>_strict n rels))]
     | x # aux' \<Rightarrow> (if fst x = \<tau> \<sigma> ne then x # aux'
        else (\<tau> \<sigma> ne, mrtabulate mrs (r\<epsilon>_strict n rels)) # x # aux'))"
     using result_eq unfolding aux0_def update_matchP_def Let_def by simp
   have sorted_aux': "sorted_wrt (\<lambda>x y. fst x > fst y) aux'"
     unfolding aux'_eq
     using sorted_aux0 in_aux0_le_\<tau> by (cases aux0) (fastforce)+
 
   have in_aux'_1: "t \<le> \<tau> \<sigma> ne \<and> \<tau> \<sigma> ne - t \<le> right I \<and> (\<exists>i. \<tau> \<sigma> i = t) \<and>
      (\<forall>ms\<in>RPDs mr. qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v.
         Formula.sat \<sigma> V (map the v) ne (Formula.MatchP (point (\<tau> \<sigma> ne - t)) (from_mregex ms \<phi>s))) (lookup X ms))"
     if aux': "(t, X) \<in> set aux'" for t X
   proof (cases aux0)
     case Nil
     with aux' show ?thesis
       unfolding aux'_eq using safe mrs qtables aux0_Nil *
       by (auto simp: zero_enat_def[symmetric] sat_MatchP_rec[where i=ne]
           lookup_tabulate finite_RPDs split: option.splits
           intro!: qtable_cong[OF qtable_r\<epsilon>_strict]
           dest: spec[of _ "\<tau> \<sigma> (ne-1)"])
   next
     case (Cons a as)
     show ?thesis
     proof (cases "t = \<tau> \<sigma> ne")
       case t: True
       show ?thesis
       proof (cases "fst a = \<tau> \<sigma> ne")
         case True
         with aux' Cons t have "X = snd a"
           unfolding aux'_eq using sorted_aux0 by auto
         moreover from in_aux0_1[of "fst a" "snd a"] Cons have "ne \<noteq> 0"
           "fst a \<le> \<tau> \<sigma> ne" "\<tau> \<sigma> ne - fst a \<le> right I" "\<exists>i. \<tau> \<sigma> i = fst a"
           "\<forall>ms \<in> RPDs mr. qtable n (fv_regex r) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne
             (Formula.MatchP (point (\<tau> \<sigma> ne - fst a)) (from_mregex ms \<phi>s))) (lookup (snd a) ms)"
           by auto
         ultimately show ?thesis using t True
           by auto
       next
         case False
         with aux' Cons t have "X = mrtabulate mrs (r\<epsilon>_strict n rels)"
           unfolding aux'_eq using sorted_aux0 in_aux0_le_\<tau>[of "fst a" "snd a"] by auto
         with aux' Cons t False show ?thesis
           unfolding aux'_eq using safe mrs qtables * in_aux0_2[of "\<tau> \<sigma> (ne-1)"] in_aux0_le_\<tau>[of "fst a" "snd a"] sorted_aux0
           by (auto simp: sat_MatchP_rec[where i=ne] zero_enat_def[symmetric] enat_0_iff not_le
               lookup_tabulate finite_RPDs split: option.splits
               intro!: qtable_cong[OF qtable_r\<epsilon>_strict] dest!: le_\<tau>_less meta_mp)
       qed
     next
       case False
       with aux' Cons have "(t, X) \<in> set aux0"
         unfolding aux'_eq by (auto split: if_splits)
       then have "ne \<noteq> 0" "t \<le> \<tau> \<sigma> ne" "\<tau> \<sigma> ne - t \<le> right I" "\<exists>i. \<tau> \<sigma> i = t"
         "\<forall>ms \<in> RPDs mr. qtable n (fv_regex r) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne
           (Formula.MatchP (point (\<tau> \<sigma> ne - t)) (from_mregex ms \<phi>s))) (lookup X ms)"
         using in_aux0_1 by blast+
       with False aux' Cons show ?thesis
         unfolding aux'_eq by auto
     qed
   qed
 
   have in_aux'_2: "\<exists>X. (t, X) \<in> set aux'" if "t \<le> \<tau> \<sigma> ne" "\<tau> \<sigma> ne - t \<le> right I" "\<exists>i. \<tau> \<sigma> i = t" for t
   proof (cases "t = \<tau> \<sigma> ne")
     case True
     then show ?thesis
     proof (cases aux0)
       case Nil
       with True show ?thesis unfolding aux'_eq by simp
     next
       case (Cons a as)
       with True show ?thesis unfolding aux'_eq using eq_fst_iff[of t a]
         by (cases "fst a = \<tau> \<sigma> ne") auto
     qed
   next
     case False
     with that have "ne \<noteq> 0"
       using le_\<tau>_less neq0_conv by blast
     moreover from False that have  "t \<le> \<tau> \<sigma> (ne-1)"
       by (metis One_nat_def Suc_leI Suc_pred \<tau>_mono diff_is_0_eq' order.antisym neq0_conv not_le)
     ultimately obtain X where "(t, X) \<in> set aux0" using \<open>\<tau> \<sigma> ne - t \<le> right I\<close> \<open>\<exists>i. \<tau> \<sigma> i = t\<close>
       by atomize_elim (auto intro!: in_aux0_2)
     then show ?thesis unfolding aux'_eq using False
       by (auto intro: exI[of _ X] split: list.split)
   qed
 
   show "wf_matchP_aux \<sigma> V n R I r aux' (Suc ne)"
     unfolding wf_matchP_aux_def using mr
     by (auto dest: in_aux'_1 intro: sorted_aux' in_aux'_2)
 
   have rel_eq: "rel = foldr (\<union>) [lookup rel mr. (t, rel) \<leftarrow> aux', left I \<le> \<tau> \<sigma> ne - t] {}"
     unfolding aux'_eq aux0_def
     using result_eq by (simp add: update_matchP_def Let_def)
   have rel_alt: "rel = (\<Union>(t, rel) \<in> set aux'. if left I \<le> \<tau> \<sigma> ne - t then lookup rel mr else empty_table)"
     unfolding rel_eq
     by (auto elim!: in_foldr_UnE bexI[rotated] intro!: in_foldr_UnI)
   show "qtable n (fv_regex r) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) ne (Formula.MatchP I r)) rel"
     unfolding rel_alt
   proof (rule qtable_Union[where Qi="\<lambda>(t, X) v.
     left I \<le> \<tau> \<sigma> ne - t \<and> Formula.sat \<sigma> V (map the v) ne (Formula.MatchP (point (\<tau> \<sigma> ne - t)) r)"],
         goal_cases finite qtable equiv)
     case (equiv v)
     show ?case
     proof (rule iffI, erule sat_MatchP_point, goal_cases left right)
       case (left j)
       then show ?case using in_aux'_2[of "\<tau> \<sigma> j", OF _ _ exI, OF _ _ refl] by auto
     next
       case right
       then show ?case by (auto elim!: sat_MatchP_pointD dest: in_aux'_1)
     qed
   qed (auto dest!: in_aux'_1 intro!: qtable_empty dest!: bspec[OF _ RPDs_refl]
       simp: from_mregex_eq[OF safe mr])
 qed
 
 lemma length_update_until: "length (update_until args rel1 rel2 nt aux) = Suc (length aux)"
   unfolding update_until_def by simp
 
 lemma wf_update_until_auxlist:
   assumes pre: "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> auxlist ne"
     and qtable1: "qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne + length auxlist) \<phi>) rel1"
     and qtable2: "qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne + length auxlist) \<psi>) rel2"
     and fvi_subset: "Formula.fv \<phi> \<subseteq> Formula.fv \<psi>"
     and args_ivl: "args_ivl args = I"
     and args_n: "args_n args = n"
     and args_pos: "args_pos args = pos"
   shows "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> (update_until args rel1 rel2 (\<tau> \<sigma> (ne + length auxlist)) auxlist) ne"
   unfolding wf_until_auxlist_def length_update_until
   unfolding update_until_def list.rel_map add_Suc_right upt.simps eqTrueI[OF le_add1] if_True
 proof (rule list_all2_appendI, unfold list.rel_map, goal_cases old new)
   case old
   show ?case
   proof (rule list.rel_mono_strong[OF assms(1)[unfolded wf_until_auxlist_def]]; safe, goal_cases mono1 mono2)
     case (mono1 i X Y v)
     then show ?case
       by (fastforce simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq
           elim!: qtable_join[OF _ qtable1] qtable_union[OF _ qtable1])
   next
     case (mono2 i X Y v)
     then show ?case using fvi_subset
       by (auto 0 3 simp: args_ivl args_n args_pos sat_the_restrict less_Suc_eq split: if_splits
           elim!: qtable_union[OF _ qtable_join_fixed[OF qtable2]]
           elim: qtable_cong[OF _ refl] intro: exI[of _ "ne + length auxlist"]) (* slow 8 sec*)
   qed
 next
   case new
   then show ?case
     by (auto intro!: qtable_empty qtable1 qtable2[THEN qtable_cong] exI[of _ "ne + length auxlist"]
         simp: args_ivl args_n args_pos less_Suc_eq zero_enat_def[symmetric])
 qed
 
 lemma (in muaux) wf_update_until:
   assumes pre: "wf_until_aux \<sigma> V R args \<phi> \<psi> aux ne"
     and qtable1: "qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne + length_muaux args aux) \<phi>) rel1"
     and qtable2: "qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne + length_muaux args aux) \<psi>) rel2"
     and fvi_subset: "Formula.fv \<phi> \<subseteq> Formula.fv \<psi>"
     and args_ivl: "args_ivl args = I"
     and args_n: "args_n args = n"
     and args_L: "args_L args = Formula.fv \<phi>"
     and args_R: "args_R args = Formula.fv \<psi>"
     and args_pos: "args_pos args = pos"
   shows "wf_until_aux \<sigma> V R args \<phi> \<psi> (add_new_muaux args rel1 rel2 (\<tau> \<sigma> (ne + length_muaux args aux)) aux) ne \<and>
       length_muaux args (add_new_muaux args rel1 rel2 (\<tau> \<sigma> (ne + length_muaux args aux)) aux) = Suc (length_muaux args aux)"
 proof -
   from pre obtain cur auxlist where valid_aux: "valid_muaux args cur aux auxlist" and
     cur: "cur = (if ne + length auxlist = 0 then 0 else \<tau> \<sigma> (ne + length auxlist - 1))" and
     pre_list: "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> auxlist ne"
     unfolding wf_until_aux_def args_ivl args_n args_pos by auto
   have length_aux: "length_muaux args aux = length auxlist"
     using valid_length_muaux[OF valid_aux] .
   define nt where "nt \<equiv> \<tau> \<sigma> (ne + length_muaux args aux)"
   have nt_mono: "cur \<le> nt"
     unfolding cur nt_def length_aux by simp
   define auxlist' where "auxlist' \<equiv> update_until args rel1 rel2 (\<tau> \<sigma> (ne + length auxlist)) auxlist"
   have length_auxlist': "length auxlist' = Suc (length auxlist)"
     unfolding auxlist'_def by (auto simp add: length_update_until)
   have tab1: "table (args_n args) (args_L args) rel1"
     using qtable1 unfolding args_n[symmetric] args_L[symmetric] by (auto simp add: qtable_def)
   have tab2: "table (args_n args) (args_R args) rel2"
     using qtable2 unfolding args_n[symmetric] args_R[symmetric] by (auto simp add: qtable_def)
   have fv_sub: "fv \<phi> \<subseteq> fv \<psi>"
     using pre unfolding wf_until_aux_def by auto
   moreover have valid_add_new_auxlist: "valid_muaux args nt (add_new_muaux args rel1 rel2 nt aux) auxlist'"
     using valid_add_new_muaux[OF valid_aux tab1 tab2 nt_mono]
     unfolding auxlist'_def nt_def length_aux .
   moreover have "length_muaux args (add_new_muaux args rel1 rel2 nt aux) = Suc (length_muaux args aux)"
     using valid_length_muaux[OF valid_add_new_auxlist] unfolding length_auxlist' length_aux[symmetric] .
   moreover have "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> auxlist' ne"
     using wf_update_until_auxlist[OF pre_list qtable1[unfolded length_aux] qtable2[unfolded length_aux] fv_sub args_ivl args_n args_pos]
     unfolding auxlist'_def .
   moreover have "\<tau> \<sigma> (ne + length auxlist) = (if ne + length auxlist' = 0 then 0 else \<tau> \<sigma> (ne + length auxlist' - 1))"
     unfolding cur length_auxlist' by auto
   ultimately show ?thesis
     unfolding wf_until_aux_def nt_def length_aux args_ivl args_n args_pos by fast
 qed
 
 lemma length_update_matchF_base:
   "length (fst (update_matchF_base I mr mrs nt entry st)) = Suc 0"
   by (auto simp: Let_def update_matchF_base_def)
 
 lemma length_update_matchF_step:
   "length (fst (update_matchF_step I mr mrs nt entry st)) = Suc (length (fst st))"
   by (auto simp: Let_def update_matchF_step_def split: prod.splits)
 
 lemma length_foldr_update_matchF_step:
   "length (fst (foldr (update_matchF_step I mr mrs nt) aux base)) = length aux + length (fst base)"
   by (induct aux arbitrary: base) (auto simp: Let_def length_update_matchF_step)
 
 lemma length_update_matchF: "length (update_matchF n I mr mrs rels nt aux) = Suc (length aux)"
   unfolding update_matchF_def update_matchF_base_def length_foldr_update_matchF_step
   by (auto simp: Let_def)
 
 lemma wf_update_matchF_base_invar:
   assumes safe: "safe_regex Futu Strict r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and mrs: "mrs = sorted_list_of_set (LPDs mr)"
     and qtables: "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) j \<phi>) rel) \<phi>s rels"
   shows "wf_matchF_invar \<sigma> V n R I r (update_matchF_base n I mr mrs rels (\<tau> \<sigma> j)) j"
 proof -
   have from_mregex: "from_mregex mr \<phi>s = r"
     using safe mr using from_mregex_eq by blast
   { fix ms
     assume "ms \<in> LPDs mr"
     then have "fv_regex (from_mregex ms \<phi>s) = fv_regex r"
       "safe_regex Futu Strict (from_mregex ms \<phi>s)" "ok (length \<phi>s) ms" "LPD ms \<subseteq> LPDs mr"
       using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans
       by fastforce+
   } note * = this
   show ?thesis
     unfolding wf_matchF_invar_def wf_matchF_aux_def update_matchF_base_def mr prod.case Let_def mrs
     using safe
     by (auto simp: * from_mregex qtables qtable_empty_iff zero_enat_def[symmetric]
         lookup_tabulate finite_LPDs eps_match less_Suc_eq LPDs_refl
         intro!: qtable_cong[OF qtable_l\<epsilon>_strict[where \<phi>s=\<phi>s]] intro: qtables exI[of _ j]
         split: option.splits)
 qed
 
 lemma Un_empty_table[simp]: "rel \<union> empty_table = rel" "empty_table \<union> rel = rel"
   unfolding empty_table_def by auto
 
 lemma wf_matchF_invar_step:
   assumes wf: "wf_matchF_invar \<sigma> V n R I r st (Suc i)"
     and safe: "safe_regex Futu Strict r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and mrs: "mrs = sorted_list_of_set (LPDs mr)"
     and qtables: "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>) rel) \<phi>s rels"
     and rel: "qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v. (\<exists>j. i \<le> j \<and> j < i + length (fst st) \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and>
           Regex.match (Formula.sat \<sigma> V (map the v)) r i j)) rel"
     and entry: "entry = (\<tau> \<sigma> i, rels, rel)"
     and nt: "nt = \<tau> \<sigma> (i + length (fst st))"
   shows "wf_matchF_invar \<sigma> V n R I r (update_matchF_step I mr mrs nt entry st) i"
 proof -
   have from_mregex: "from_mregex mr \<phi>s = r"
     using safe mr using from_mregex_eq by blast
   { fix ms
     assume "ms \<in> LPDs mr"
     then have "fv_regex (from_mregex ms \<phi>s) = fv_regex r"
       "safe_regex Futu Strict (from_mregex ms \<phi>s)" "ok (length \<phi>s) ms" "LPD ms \<subseteq> LPDs mr"
       using safe LPDs_safe LPDs_safe_fv_regex mr from_mregex_to_mregex LPDs_ok to_mregex_ok LPDs_trans
       by fastforce+
   } note * = this
   { fix aux X ms
     assume "st = (aux, X)" "ms \<in> LPDs mr"
     with wf mr have "qtable n (fv_regex r) (mem_restr R)
       (\<lambda>v. Regex.match (Formula.sat \<sigma> V (map the v)) (from_mregex ms \<phi>s) i (i + length aux))
       (l\<delta> (\<lambda>x. x) X rels ms)"
       by (intro qtable_cong[OF qtable_l\<delta>[where \<phi>s=\<phi>s and A="fv_regex r" and
               Q="\<lambda>v r. Regex.match (Formula.sat \<sigma> V v) r (Suc i) (i + length aux)", OF _ _ qtables]])
         (auto simp: wf_matchF_invar_def * LPDs_trans lpd_match[of i] elim!: bspec)
   } note l\<delta> = this
   have "lookup (mrtabulate mrs f) ms = f ms" if "ms \<in> LPDs mr" for ms and f :: "mregex \<Rightarrow> 'a table"
     using that mrs  by (fastforce simp: lookup_tabulate finite_LPDs split: option.splits)+
   then show ?thesis
     using wf mr mrs entry nt LPDs_trans
     by (auto 0 3 simp: Let_def wf_matchF_invar_def update_matchF_step_def wf_matchF_aux_def mr * LPDs_refl
         list_all2_Cons1 append_eq_Cons_conv upt_eq_Cons_conv Suc_le_eq qtables
         lookup_tabulate finite_LPDs id_def l\<delta> from_mregex less_Suc_eq
         intro!: qtable_union[OF rel l\<delta>] qtable_cong[OF rel]
         intro: exI[of _ "i + length _"]
         split: if_splits prod.splits)
 qed
 
 lemma wf_update_matchF_invar:
   assumes pre: "wf_matchF_aux \<sigma> V n R I r aux ne (length (fst st) - 1)"
     and wf: "wf_matchF_invar \<sigma> V n R I r st (ne + length aux)"
     and safe: "safe_regex Futu Strict r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and mrs: "mrs = sorted_list_of_set (LPDs mr)"
     and j: "j = ne + length aux + length (fst st) - 1"
   shows "wf_matchF_invar \<sigma> V n R I r (foldr (update_matchF_step I mr mrs (\<tau> \<sigma> j)) aux st) ne"
   using pre wf unfolding j
 proof (induct aux arbitrary: ne)
   case (Cons entry aux)
   from Cons(1)[of "Suc ne"] Cons(2,3) show ?case
     unfolding foldr.simps o_apply
     by (intro wf_matchF_invar_step[where rels = "fst (snd entry)" and rel = "snd (snd entry)"])
       (auto simp: safe mr mrs wf_matchF_aux_def wf_matchF_invar_def list_all2_Cons1 append_eq_Cons_conv
         Suc_le_eq upt_eq_Cons_conv length_foldr_update_matchF_step add.assoc split: if_splits)
 qed simp
 
 
 lemma wf_update_matchF:
   assumes pre: "wf_matchF_aux \<sigma> V n R I r aux ne 0"
     and safe: "safe_regex Futu Strict r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and mrs: "mrs = sorted_list_of_set (LPDs mr)"
     and nt: "nt = \<tau> \<sigma> (ne + length aux)"
     and qtables: "list_all2 (\<lambda>\<phi> rel. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) (ne + length aux) \<phi>) rel) \<phi>s rels"
   shows "wf_matchF_aux \<sigma> V n R I r (update_matchF n I mr mrs rels nt aux) ne 0"
   unfolding update_matchF_def using wf_update_matchF_base_invar[OF safe mr mrs qtables, of I]
   unfolding nt
   by (intro wf_update_matchF_invar[OF _ _ safe mr mrs, unfolded wf_matchF_invar_def split_beta, THEN conjunct2, THEN conjunct1])
     (auto simp: length_update_matchF_base wf_matchF_invar_def update_matchF_base_def Let_def pre)
 
 lemma wf_until_aux_Cons: "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> (a # aux) ne \<Longrightarrow>
   wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> aux (Suc ne)"
   unfolding wf_until_auxlist_def
   by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong)
 
 lemma wf_matchF_aux_Cons: "wf_matchF_aux \<sigma> V n R I r (entry # aux) ne i \<Longrightarrow>
   wf_matchF_aux \<sigma> V n R I r aux (Suc ne) i"
   unfolding wf_matchF_aux_def
   by (simp add: upt_conv_Cons del: upt_Suc cong: if_cong split: prod.splits)
 
 lemma wf_until_aux_Cons1: "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> ((t, a1, a2) # aux) ne \<Longrightarrow> t = \<tau> \<sigma> ne"
   unfolding wf_until_auxlist_def
   by (simp add: upt_conv_Cons del: upt_Suc)
 
 lemma wf_matchF_aux_Cons1: "wf_matchF_aux \<sigma> V n R I r ((t, rels, rel) # aux) ne i \<Longrightarrow> t = \<tau> \<sigma> ne"
   unfolding wf_matchF_aux_def
   by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)
 
 lemma wf_until_aux_Cons3: "wf_until_auxlist \<sigma> V n R pos \<phi> I \<psi> ((t, a1, a2) # aux) ne \<Longrightarrow>
   qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. (\<exists>j. ne \<le> j \<and> j < Suc (ne + length aux) \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> ne) I \<and>
     Formula.sat \<sigma> V (map the v) j \<psi> \<and> (\<forall>k\<in>{ne..<j}. if pos then Formula.sat \<sigma> V (map the v) k \<phi> else \<not> Formula.sat \<sigma> V (map the v) k \<phi>))) a2"
   unfolding wf_until_auxlist_def
   by (simp add: upt_conv_Cons del: upt_Suc)
 
 lemma wf_matchF_aux_Cons3: "wf_matchF_aux \<sigma> V n R I r ((t, rels, rel) # aux) ne i \<Longrightarrow>
   qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v. (\<exists>j. ne \<le> j \<and> j < Suc (ne + length aux + i) \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> ne) I \<and>
     Regex.match (Formula.sat \<sigma> V (map the v)) r ne j)) rel"
   unfolding wf_matchF_aux_def
   by (simp add: upt_conv_Cons del: upt_Suc split: prod.splits)
 
 lemma upt_append: "a \<le> b \<Longrightarrow> b \<le> c \<Longrightarrow> [a..<b] @ [b..<c] = [a..<c]"
   by (metis le_Suc_ex upt_add_eq_append)
 
 lemma wf_mbuf2_add:
   assumes "wf_mbuf2 i ja jb P Q buf"
     and "list_all2 P [ja..<ja'] xs"
     and "list_all2 Q [jb..<jb'] ys"
     and "ja \<le> ja'" "jb \<le> jb'"
   shows "wf_mbuf2 i ja' jb' P Q (mbuf2_add xs ys buf)"
   using assms unfolding wf_mbuf2_def
   by (auto 0 3 simp: list_all2_append2 upt_append dest: list_all2_lengthD
       intro: exI[where x="[i..<ja]"] exI[where x="[ja..<ja']"]
       exI[where x="[i..<jb]"] exI[where x="[jb..<jb']"] split: prod.splits)
 
 lemma wf_mbufn_add:
   assumes "wf_mbufn i js Ps buf"
     and "list_all3 list_all2 Ps (List.map2 (\<lambda>j j'. [j..<j']) js js') xss"
     and "list_all2 (\<le>) js js'"
   shows "wf_mbufn i js' Ps (mbufn_add xss buf)"
   unfolding wf_mbufn_def list_all3_conv_all_nth
 proof safe
   show "length Ps = length js'" "length js' = length (mbufn_add xss buf)"
     using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth by auto
 next
   fix k assume k: "k < length Ps"
   then show "i \<le> js' ! k"
     using assms unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth
     by (auto 0 4 dest: spec[of _ i])
   from k have " [i..<js' ! k] =  [i..<js ! k] @ [js ! k ..<js' ! k]" and
     "length [i..<js ! k] = length (buf ! k)"
     using assms(1,3) unfolding wf_mbufn_def list_all3_conv_all_nth list_all2_conv_all_nth
     by (auto simp: upt_append)
   with k show "list_all2 (Ps ! k) [i..<js' ! k] (mbufn_add xss buf ! k)"
     using assms[unfolded wf_mbufn_def list_all3_conv_all_nth]
     by (auto simp add: list_all2_append)
 qed
 
 lemma mbuf2_take_eqD:
   assumes "mbuf2_take f buf = (xs, buf')"
     and "wf_mbuf2 i ja jb P Q buf"
   shows "wf_mbuf2 (min ja jb) ja jb P Q buf'"
     and "list_all2 (\<lambda>i z. \<exists>x y. P i x \<and> Q i y \<and> z = f x y) [i..<min ja jb] xs"
   using assms unfolding wf_mbuf2_def
   by (induction f buf arbitrary: i xs buf' rule: mbuf2_take.induct)
     (fastforce simp add: list_all2_Cons2 upt_eq_Cons_conv min_absorb1 min_absorb2 split: prod.splits)+
 
 lemma list_all3_Nil[simp]:
   "list_all3 P xs ys [] \<longleftrightarrow> xs = [] \<and> ys = []"
   "list_all3 P xs [] zs \<longleftrightarrow> xs = [] \<and> zs = []"
   "list_all3 P [] ys zs \<longleftrightarrow> ys = [] \<and> zs = []"
   unfolding list_all3_conv_all_nth by auto
 
 lemma list_all3_Cons:
   "list_all3 P xs ys (z # zs) \<longleftrightarrow> (\<exists>x xs' y ys'. xs = x # xs' \<and> ys = y # ys' \<and> P x y z \<and> list_all3 P xs' ys' zs)"
   "list_all3 P xs (y # ys) zs \<longleftrightarrow> (\<exists>x xs' z zs'. xs = x # xs' \<and> zs = z # zs' \<and> P x y z \<and> list_all3 P xs' ys zs')"
   "list_all3 P (x # xs) ys zs \<longleftrightarrow> (\<exists>y ys' z zs'. ys = y # ys' \<and> zs = z # zs' \<and> P x y z \<and> list_all3 P xs ys' zs')"
   unfolding list_all3_conv_all_nth
   by (auto simp: length_Suc_conv Suc_length_conv nth_Cons split: nat.splits)
 
 lemma list_all3_mono_strong: "list_all3 P xs ys zs \<Longrightarrow>
   (\<And>x y z. x \<in> set xs \<Longrightarrow> y \<in> set ys \<Longrightarrow> z \<in> set zs \<Longrightarrow> P x y z \<Longrightarrow> Q x y z) \<Longrightarrow>
   list_all3 Q xs ys zs"
   by (induct xs ys zs rule: list_all3.induct) (auto intro: list_all3.intros)
 
 definition Mini where
   "Mini i js = (if js = [] then i else Min (set js))"
 
 lemma wf_mbufn_in_set_Mini:
   assumes "wf_mbufn i js Ps buf"
   shows "[] \<in> set buf \<Longrightarrow> Mini i js = i"
   unfolding in_set_conv_nth
 proof (elim exE conjE)
   fix k
   have "i \<le> j" if "j \<in> set js" for j
     using that assms unfolding wf_mbufn_def list_all3_conv_all_nth in_set_conv_nth by auto
   moreover assume "k < length buf" "buf ! k = []"
   ultimately show ?thesis using assms
     unfolding Mini_def wf_mbufn_def list_all3_conv_all_nth
     by (auto 0 4 dest!: spec[of _ k] intro: Min_eqI simp: in_set_conv_nth)
 qed
 
 lemma wf_mbufn_notin_set:
   assumes "wf_mbufn i js Ps buf"
   shows "[] \<notin> set buf \<Longrightarrow> j \<in> set js \<Longrightarrow> i < j"
   using assms unfolding wf_mbufn_def list_all3_conv_all_nth
   by (cases "i \<in> set js") (auto intro: le_neq_implies_less simp: in_set_conv_nth)
 
 lemma wf_mbufn_map_tl:
   "wf_mbufn i js Ps buf \<Longrightarrow> [] \<notin> set buf \<Longrightarrow> wf_mbufn (Suc i) js Ps (map tl buf)"
   by (auto simp: wf_mbufn_def list_all3_map Suc_le_eq
       dest: rel_funD[OF tl_transfer]  elim!: list_all3_mono_strong le_neq_implies_less)
 
 lemma list_all3_list_all2I: "list_all3 (\<lambda>x y z. Q x z) xs ys zs \<Longrightarrow> list_all2 Q xs zs"
   by (induct xs ys zs rule: list_all3.induct) auto
 
 lemma mbuf2t_take_eqD:
   assumes "mbuf2t_take f z buf nts = (z', buf', nts')"
     and "wf_mbuf2 i ja jb P Q buf"
     and "list_all2 R [i..<j] nts"
     and "ja \<le> j" "jb \<le> j"
   shows "wf_mbuf2 (min ja jb) ja jb P Q buf'"
     and "list_all2 R [min ja jb..<j] nts'"
   using assms unfolding wf_mbuf2_def
   by (induction f z buf nts arbitrary: i z' buf' nts' rule: mbuf2t_take.induct)
     (auto simp add: list_all2_Cons2 upt_eq_Cons_conv less_eq_Suc_le min_absorb1 min_absorb2
       split: prod.split)
 
 lemma wf_mbufn_take:
   assumes "mbufn_take f z buf = (z', buf')"
     and "wf_mbufn i js Ps buf"
   shows "wf_mbufn (Mini i js) js Ps buf'"
   using assms unfolding wf_mbufn_def
 proof (induction f z buf arbitrary: i z' buf' rule: mbufn_take.induct)
   case rec: (1 f z buf)
   show ?case proof (cases "buf = []")
     case True
     with rec.prems show ?thesis by simp
   next
     case nonempty: False
     show ?thesis proof (cases "[] \<in> set buf")
       case True
       from rec.prems(2) have "\<forall>j\<in>set js. i \<le> j"
         by (auto simp: in_set_conv_nth list_all3_conv_all_nth)
       moreover from True rec.prems(2) have "i \<in> set js"
         by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)
       ultimately have "Mini i js = i"
         unfolding Mini_def
         by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])
       with rec.prems nonempty True show ?thesis by simp
     next
       case False
       from nonempty rec.prems(2) have "Mini i js = Mini (Suc i) js"
         unfolding Mini_def by auto
       show ?thesis
         unfolding \<open>Mini i js = Mini (Suc i) js\<close>
       proof (rule rec.IH)
         show "\<not> (buf = [] \<or> [] \<in> set buf)" using nonempty False by simp
         show "list_all3 (\<lambda>P j xs. Suc i \<le> j \<and> list_all2 P [Suc i..<j] xs) Ps js (map tl buf)"
           using False rec.prems(2)
           by (auto simp: list_all3_map elim!: list_all3_mono_strong dest: list.rel_sel[THEN iffD1])
         show "mbufn_take f (f (map hd buf) z) (map tl buf) = (z', buf')"
           using nonempty False rec.prems(1) by simp
       qed
     qed
   qed
 qed
 
 lemma mbufnt_take_eqD:
   assumes "mbufnt_take f z buf nts = (z', buf', nts')"
     and "wf_mbufn i js Ps buf"
     and "list_all2 R [i..<j] nts"
     and "\<And>k. k \<in> set js \<Longrightarrow> k \<le> j"
     and "k = Mini (i + length nts) js"
   shows "wf_mbufn k js Ps buf'"
     and "list_all2 R [k..<j] nts'"
   using assms(1-4) unfolding assms(5)
 proof (induction f z buf nts arbitrary: i z' buf' nts' rule: mbufnt_take.induct)
   case IH: (1 f z buf nts)
   note mbufnt_take.simps[simp del]
   case 1
   then have *: "list_all2 R [Suc i..<j] (tl nts)"
     by (auto simp: list.rel_sel[of R "[i..<j]" nts, simplified])
   from 1 show ?case
     using wf_mbufn_in_set_Mini[OF 1(2)]
     by (subst (asm) mbufnt_take.simps)
       (force simp: Mini_def wf_mbufn_def split: if_splits prod.splits elim!: list_all3_mono_strong
         dest!: IH(1)[rotated, OF _ wf_mbufn_map_tl[OF 1(2)] *])
   case 2
   then have *: "list_all2 R [Suc i..<j] (tl nts)"
     by (auto simp: list.rel_sel[of R "[i..<j]" nts, simplified])
   have [simp]: "Suc (i + (length nts - Suc 0)) = i + length nts" if "nts \<noteq> []"
     using that by (fastforce simp flip: length_greater_0_conv)
   with 2 show ?case
     using wf_mbufn_in_set_Mini[OF 2(2)] wf_mbufn_notin_set[OF 2(2)]
     by (subst (asm) mbufnt_take.simps) (force simp: Mini_def wf_mbufn_def
         dest!: IH(2)[rotated, OF _ wf_mbufn_map_tl[OF 2(2)] *]
         split: if_splits prod.splits)
 qed
 
 lemma mbuf2t_take_induct[consumes 5, case_names base step]:
   assumes "mbuf2t_take f z buf nts = (z', buf', nts')"
     and "wf_mbuf2 i ja jb P Q buf"
     and "list_all2 R [i..<j] nts"
     and "ja \<le> j" "jb \<le> j"
     and "U i z"
     and "\<And>k x y t z. i \<le> k \<Longrightarrow> Suc k \<le> ja \<Longrightarrow> Suc k \<le> jb \<Longrightarrow>
       P k x \<Longrightarrow> Q k y \<Longrightarrow> R k t \<Longrightarrow> U k z \<Longrightarrow> U (Suc k) (f x y t z)"
   shows "U (min ja jb) z'"
   using assms unfolding wf_mbuf2_def
   by (induction f z buf nts arbitrary: i z' buf' nts' rule: mbuf2t_take.induct)
     (auto simp add: list_all2_Cons2 upt_eq_Cons_conv less_eq_Suc_le min_absorb1 min_absorb2
       elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated] split: prod.split)
 
 lemma list_all2_hdD:
   assumes "list_all2 P [i..<j] xs" "xs \<noteq> []"
   shows "P i (hd xs)" "i < j"
   using assms unfolding list_all2_conv_all_nth
   by (auto simp: hd_conv_nth intro: zero_less_diff[THEN iffD1] dest!: spec[of _ 0])
 
 lemma mbufn_take_induct[consumes 3, case_names base step]:
   assumes "mbufn_take f z buf = (z', buf')"
     and "wf_mbufn i js Ps buf"
     and "U i z"
     and "\<And>k xs z. i \<le> k \<Longrightarrow> Suc k \<le> Mini i js \<Longrightarrow>
       list_all2 (\<lambda>P x. P k x) Ps xs \<Longrightarrow> U k z \<Longrightarrow> U (Suc k) (f xs z)"
   shows "U (Mini i js) z'"
   using assms unfolding wf_mbufn_def
 proof (induction f z buf arbitrary: i z' buf' rule: mbufn_take.induct)
   case rec: (1 f z buf)
   show ?case proof (cases "buf = []")
     case True
     with rec.prems show ?thesis unfolding Mini_def by simp
   next
     case nonempty: False
     show ?thesis proof (cases "[] \<in> set buf")
       case True
       from rec.prems(2) have "\<forall>j\<in>set js. i \<le> j"
         by (auto simp: in_set_conv_nth list_all3_conv_all_nth)
       moreover from True rec.prems(2) have "i \<in> set js"
         by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)
       ultimately have "Mini i js = i"
         unfolding Mini_def
         by (auto intro!: antisym[OF Min.coboundedI Min.boundedI])
       with rec.prems nonempty True show ?thesis by simp
     next
       case False
       with nonempty rec.prems(2) have more: "Suc i \<le> Mini i js"
         using diff_is_0_eq not_le unfolding Mini_def
         by (fastforce simp: in_set_conv_nth list_all3_conv_all_nth list_all2_iff)
       then have "Mini i js = Mini (Suc i) js" unfolding Mini_def by auto
       show ?thesis
         unfolding \<open>Mini i js = Mini (Suc i) js\<close>
       proof (rule rec.IH)
         show "\<not> (buf = [] \<or> [] \<in> set buf)" using nonempty False by simp
         show "mbufn_take f (f (map hd buf) z) (map tl buf) = (z', buf')"
           using nonempty False rec.prems by simp
         show "list_all3 (\<lambda>P j xs. Suc i \<le> j \<and> list_all2 P [Suc i..<j] xs) Ps js (map tl buf)"
           using False rec.prems
           by (auto simp: list_all3_map elim!: list_all3_mono_strong dest: list.rel_sel[THEN iffD1])
         show "U (Suc i) (f (map hd buf) z)"
           using more False rec.prems
           by (auto 0 4 simp: list_all3_map intro!: rec.prems(4) list_all3_list_all2I
               elim!: list_all3_mono_strong dest: list.rel_sel[THEN iffD1])
         show "\<And>k xs z. Suc i \<le> k \<Longrightarrow> Suc k \<le> Mini (Suc i) js \<Longrightarrow>
           list_all2 (\<lambda>P. P k) Ps xs \<Longrightarrow> U k z \<Longrightarrow> U (Suc k) (f xs z)"
           by (rule rec.prems(4)) (auto simp: Mini_def)
       qed
     qed
   qed
 qed
 
 lemma mbufnt_take_induct[consumes 5, case_names base step]:
   assumes "mbufnt_take f z buf nts = (z', buf', nts')"
     and "wf_mbufn i js Ps buf"
     and "list_all2 R [i..<j] nts"
     and "\<And>k. k \<in> set js \<Longrightarrow> k \<le> j"
     and "U i z"
     and "\<And>k xs t z. i \<le> k \<Longrightarrow> Suc k \<le> Mini j js \<Longrightarrow>
       list_all2 (\<lambda>P x. P k x) Ps xs \<Longrightarrow> R k t \<Longrightarrow> U k z \<Longrightarrow> U (Suc k) (f xs t z)"
   shows "U (Mini (i + length nts) js) z'"
   using assms
 proof (induction f z buf nts arbitrary: i z' buf' nts' rule: mbufnt_take.induct)
   case (1 f z buf nts)
   then have *: "list_all2 R [Suc i..<j] (tl nts)"
     by (auto simp: list.rel_sel[of R "[i..<j]" nts, simplified])
   note mbufnt_take.simps[simp del]
   from 1(2-6) have "i = Min (set js)" if "js \<noteq> []" "nts = []"
     using that unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)]
     by (fastforce simp: Mini_def list_all3_Cons neq_Nil_conv)
   with 1(2-7) list_all2_hdD[OF 1(4)] show ?case
     unfolding wf_mbufn_def using wf_mbufn_in_set_Mini[OF 1(3)] wf_mbufn_notin_set[OF 1(3)]
     by (subst (asm) mbufnt_take.simps)
       (auto simp add: Mini_def list.rel_map Suc_le_eq
         elim!: arg_cong2[of _ _ _ _ U, OF _ refl, THEN iffD1, rotated]
         list_all3_mono_strong[THEN list_all3_list_all2I[of _ _ js]] list_all2_hdD
         dest!: 1(1)[rotated, OF _ wf_mbufn_map_tl[OF 1(3)] * _ 1(7)] split: prod.split if_splits)
 qed
 
 lemma mbuf2_take_add':
   assumes eq: "mbuf2_take f (mbuf2_add xs ys buf) = (zs, buf')"
     and pre: "wf_mbuf2' \<sigma> P V j n R \<phi> \<psi> buf"
     and rm: "rel_mapping (\<le>) P P'"
     and xs: "list_all2 (\<lambda>i. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>))
       [progress \<sigma> P \<phi> j..<progress \<sigma> P' \<phi> j'] xs"
     and ys: "list_all2 (\<lambda>i. qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>))
       [progress \<sigma> P \<psi> j..<progress \<sigma> P' \<psi> j'] ys"
     and "j \<le> j'"
   shows "wf_mbuf2' \<sigma> P' V j' n R \<phi> \<psi> buf'"
     and "list_all2 (\<lambda>i Z. \<exists>X Y.
       qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>) X \<and>
       qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>) Y \<and>
       Z = f X Y)
       [min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)..<min (progress \<sigma> P' \<phi> j') (progress \<sigma> P' \<psi> j')] zs"
   using pre rm unfolding wf_mbuf2'_def
   by (force intro!: mbuf2_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \<open>j \<le> j'\<close> rm])+
 
 lemma mbuf2t_take_add':
   assumes eq: "mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')"
     and bounded: "pred_mapping (\<lambda>x. x \<le> j) P" "pred_mapping (\<lambda>x. x \<le> j') P'"
     and rm: "rel_mapping (\<le>) P P'"
     and pre_buf: "wf_mbuf2' \<sigma> P V j n R \<phi> \<psi> buf"
     and pre_nts: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)..<j'] nts"
     and xs: "list_all2 (\<lambda>i. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>))
       [progress \<sigma> P \<phi> j..<progress \<sigma> P' \<phi> j'] xs"
     and ys: "list_all2 (\<lambda>i. qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>))
       [progress \<sigma> P \<psi> j..<progress \<sigma> P' \<psi> j'] ys"
     and "j \<le> j'"
   shows "wf_mbuf2' \<sigma> P' V j' n R \<phi> \<psi> buf'"
     and "wf_ts \<sigma> P' j' \<phi> \<psi> nts'"
   using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def wf_ts_def
   by (auto intro!: mbuf2t_take_eqD[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \<open>j \<le> j'\<close> rm]
       progress_le_gen)
 
 lemma ok_0_atms: "ok 0 mr \<Longrightarrow> regex.atms (from_mregex mr []) = {}"
   by (induct mr) auto
 
 lemma ok_0_progress: "ok 0 mr \<Longrightarrow> progress_regex \<sigma> P (from_mregex mr []) j = j"
   by (drule ok_0_atms) (auto simp: progress_regex_def)
 
 lemma atms_empty_atms: "safe_regex m g r \<Longrightarrow> atms r = {} \<longleftrightarrow> regex.atms r = {}"
   by (induct r rule: safe_regex_induct) (auto split: if_splits simp: cases_Neg_iff)
 
 lemma atms_empty_progress: "safe_regex m g r \<Longrightarrow> atms r = {} \<Longrightarrow> progress_regex \<sigma> P r j = j"
   by (drule atms_empty_atms) (auto simp: progress_regex_def)
 
 lemma to_mregex_empty_progress: "safe_regex m g r \<Longrightarrow> to_mregex r = (mr, []) \<Longrightarrow>
   progress_regex \<sigma> P r j = j"
   using from_mregex_eq ok_0_progress to_mregex_ok atms_empty_atms by fastforce
 
 lemma progress_regex_le: "pred_mapping (\<lambda>x. x \<le> j) P \<Longrightarrow> progress_regex \<sigma> P r j \<le> j"
   by (auto intro!: progress_le_gen simp: Min_le_iff progress_regex_def)
 
 lemma Neg_acyclic: "formula.Neg x = x \<Longrightarrow> P"
   by (induct x) auto
 
 lemma case_Neg_in_iff: "x \<in> (case y of formula.Neg \<phi>' \<Rightarrow> {\<phi>'} | _ \<Rightarrow> {}) \<longleftrightarrow> y = formula.Neg x"
   by (cases y) auto
 
 lemma atms_nonempty_progress:
   "safe_regex m g r \<Longrightarrow> atms r \<noteq> {} \<Longrightarrow> (\<lambda>\<phi>. progress \<sigma> P \<phi> j) ` atms r = (\<lambda>\<phi>. progress \<sigma> P \<phi> j) ` regex.atms r"
   by (frule atms_empty_atms; simp)
     (auto 0 3 simp: atms_def image_iff case_Neg_in_iff elim!: disjE_Not2 dest: safe_regex_safe_formula)
 
 lemma to_mregex_nonempty_progress: "safe_regex m g r \<Longrightarrow> to_mregex r = (mr, \<phi>s) \<Longrightarrow> \<phi>s \<noteq> [] \<Longrightarrow>
   progress_regex \<sigma> P r j = (MIN \<phi>\<in>set \<phi>s. progress \<sigma> P \<phi> j)"
   using atms_nonempty_progress to_mregex_ok unfolding progress_regex_def by fastforce
 
 lemma to_mregex_progress: "safe_regex m g r \<Longrightarrow> to_mregex r = (mr, \<phi>s) \<Longrightarrow>
   progress_regex \<sigma> P r j = (if \<phi>s = [] then j else (MIN \<phi>\<in>set \<phi>s. progress \<sigma> P \<phi> j))"
   using to_mregex_nonempty_progress to_mregex_empty_progress unfolding progress_regex_def by auto
 
 lemma mbufnt_take_add':
   assumes eq: "mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')"
     and bounded: "pred_mapping (\<lambda>x. x \<le> j) P" "pred_mapping (\<lambda>x. x \<le> j') P'"
     and rm: "rel_mapping (\<le>) P P'"
     and safe: "safe_regex m g r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and pre_buf: "wf_mbufn' \<sigma> P V j n R r buf"
     and pre_nts: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [progress_regex \<sigma> P r j..<j'] nts"
     and xss: "list_all3 list_all2
      (map (\<lambda>\<phi> i. qtable n (fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>)) \<phi>s)
      (map2 upt (map (\<lambda>\<phi>. progress \<sigma> P \<phi> j) \<phi>s) (map (\<lambda>\<phi>. progress \<sigma> P' \<phi> j') \<phi>s)) xss"
     and "j \<le> j'"
   shows "wf_mbufn' \<sigma> P' V j' n R r buf'"
     and "wf_ts_regex \<sigma> P' j' r nts'"
   using pre_buf pre_nts bounded rm mr safe xss \<open>j \<le> j'\<close>  unfolding wf_mbufn'_def wf_ts_regex_def
   using atms_empty_progress[of m g r] to_mregex_ok[OF mr]
   by (auto 0 3 simp: list.rel_map to_mregex_empty_progress to_mregex_nonempty_progress Mini_def
       intro: progress_mono_gen[OF \<open>j \<le> j'\<close> rm] list.rel_refl_strong progress_le_gen
       dest: list_all2_lengthD elim!: mbufnt_take_eqD[OF eq wf_mbufn_add])
 
 lemma mbuf2t_take_add_induct'[consumes 6, case_names base step]:
   assumes eq: "mbuf2t_take f z (mbuf2_add xs ys buf) nts = (z', buf', nts')"
     and bounded: "pred_mapping (\<lambda>x. x \<le> j) P" "pred_mapping (\<lambda>x. x \<le> j') P'"
     and rm: "rel_mapping (\<le>) P P'"
     and pre_buf: "wf_mbuf2' \<sigma> P V j n R \<phi> \<psi> buf"
     and pre_nts: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)..<j'] nts"
     and xs: "list_all2 (\<lambda>i. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>))
       [progress \<sigma> P \<phi> j..<progress \<sigma> P' \<phi> j'] xs"
     and ys: "list_all2 (\<lambda>i. qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>))
       [progress \<sigma> P \<psi> j..<progress \<sigma> P' \<psi> j'] ys"
     and "j \<le> j'"
     and base: "U (min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)) z"
     and step: "\<And>k X Y z. min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j) \<le> k \<Longrightarrow>
       Suc k \<le> progress \<sigma> P' \<phi> j' \<Longrightarrow> Suc k \<le> progress \<sigma> P' \<psi> j' \<Longrightarrow>
       qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) k \<phi>) X \<Longrightarrow>
       qtable n (Formula.fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) k \<psi>) Y \<Longrightarrow>
       U k z \<Longrightarrow> U (Suc k) (f X Y (\<tau> \<sigma> k) z)"
   shows "U (min (progress \<sigma> P' \<phi> j') (progress \<sigma> P' \<psi> j')) z'"
   using pre_buf pre_nts bounded rm unfolding wf_mbuf2'_def
   by (blast intro!: mbuf2t_take_induct[OF eq] wf_mbuf2_add[OF _ xs ys] progress_mono_gen[OF \<open>j \<le> j'\<close> rm]
       progress_le_gen base step)
 
 lemma mbufnt_take_add_induct'[consumes 6, case_names base step]:
   assumes eq: "mbufnt_take f z (mbufn_add xss buf) nts = (z', buf', nts')"
     and bounded: "pred_mapping (\<lambda>x. x \<le> j) P" "pred_mapping (\<lambda>x. x \<le> j') P'"
     and rm: "rel_mapping (\<le>) P P'"
     and safe: "safe_regex m g r"
     and mr: "to_mregex r = (mr, \<phi>s)"
     and pre_buf: "wf_mbufn' \<sigma> P V j n R r buf"
     and pre_nts: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [progress_regex \<sigma> P r j..<j'] nts"
     and xss: "list_all3 list_all2
      (map (\<lambda>\<phi> i. qtable n (fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>)) \<phi>s)
      (map2 upt (map (\<lambda>\<phi>. progress \<sigma> P \<phi> j) \<phi>s) (map (\<lambda>\<phi>. progress \<sigma> P' \<phi> j') \<phi>s)) xss"
     and "j \<le> j'"
     and base: "U (progress_regex \<sigma> P r j) z"
     and step: "\<And>k Xs z. progress_regex \<sigma> P r j \<le> k \<Longrightarrow> Suc k \<le> progress_regex \<sigma> P' r j' \<Longrightarrow>
       list_all2 (\<lambda>\<phi>. qtable n (Formula.fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) k \<phi>)) \<phi>s Xs \<Longrightarrow>
       U k z \<Longrightarrow> U (Suc k) (f Xs (\<tau> \<sigma> k) z)"
   shows "U (progress_regex \<sigma> P' r j') z'"
   using pre_buf pre_nts bounded rm \<open>j \<le> j'\<close> to_mregex_progress[OF safe mr, of \<sigma> P' j'] to_mregex_empty_progress[OF safe, of mr \<sigma> P j] base
   unfolding wf_mbufn'_def mr prod.case
   by (fastforce dest!: mbufnt_take_induct[OF eq wf_mbufn_add[OF _ xss] pre_nts, of U]
       simp: list.rel_map le_imp_diff_is_add ac_simps Mini_def
       intro: progress_mono_gen[OF \<open>j \<le> j'\<close> rm] list.rel_refl_strong progress_le_gen
       intro!: base step  dest: list_all2_lengthD split: if_splits)
 
 lemma progress_Until_le: "progress \<sigma> P (Formula.Until \<phi> I \<psi>) j \<le> min (progress \<sigma> P \<phi> j) (progress \<sigma> P \<psi> j)"
   by (cases "right I") (auto simp: trans_le_add1 intro!: cInf_lower)
 
 lemma progress_MatchF_le: "progress \<sigma> P (Formula.MatchF I r) j \<le> progress_regex \<sigma> P r j"
   by (cases "right I") (auto simp: trans_le_add1 progress_regex_def intro!: cInf_lower)
 
 lemma list_all2_upt_Cons: "P a x \<Longrightarrow> list_all2 P [Suc a..<b] xs \<Longrightarrow> Suc a \<le> b \<Longrightarrow>
   list_all2 P [a..<b] (x # xs)"
   by (simp add: list_all2_Cons2 upt_eq_Cons_conv)
 
 lemma list_all2_upt_append: "list_all2 P [a..<b] xs \<Longrightarrow> list_all2 P [b..<c] ys \<Longrightarrow>
   a \<le> b \<Longrightarrow> b \<le> c \<Longrightarrow> list_all2 P [a..<c] (xs @ ys)"
   by (induction xs arbitrary: a) (auto simp add: list_all2_Cons2 upt_eq_Cons_conv)
 
 lemma list_all3_list_all2_conv: "list_all3 R xs xs ys = list_all2 (\<lambda>x. R x x) xs ys"
   by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth)
 
 lemma map_split_map: "map_split f (map g xs) = map_split (f o g) xs"
   by (induct xs) auto
 
 lemma map_split_alt: "map_split f xs = (map (fst o f) xs, map (snd o f) xs)"
   by (induct xs) (auto split: prod.splits)
 
 lemma fv_formula_of_constraint: "fv (formula_of_constraint (t1, p, c, t2)) = fv_trm t1 \<union> fv_trm t2"
   by (induction "(t1, p, c, t2)" rule: formula_of_constraint.induct) simp_all
 
 lemma (in maux) wf_mformula_wf_set: "wf_mformula \<sigma> j P V n R \<phi> \<phi>' \<Longrightarrow> wf_set n (Formula.fv \<phi>')"
   unfolding wf_set_def
 proof (induction rule: wf_mformula.induct)
   case (AndRel P V n R \<phi> \<phi>' \<psi>' conf)
   then show ?case by (auto simp: fv_formula_of_constraint dest!: subsetD)
 next
   case (Ands P V n R l l_pos l_neg l' buf A_pos A_neg)
   from Ands.IH have "\<forall>\<phi>'\<in>set (l_pos @ map remove_neg l_neg). \<forall>x\<in>fv \<phi>'. x < n"
     by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of "_ @ _"] del: set_append)
   then have "\<forall>\<phi>'\<in>set (l_pos @ l_neg). \<forall>x\<in>fv \<phi>'. x < n"
     by (auto dest: bspec[where x="remove_neg _"])
   then show ?case using Ands.hyps(2) by auto
 next
   case (Agg P V b n R \<phi> \<phi>' y f g0 \<omega>)
   then have "Formula.fvi_trm b f \<subseteq> Formula.fvi b \<phi>'"
     by (auto simp: fvi_trm_iff_fv_trm[where b=b] fvi_iff_fv[where b=b])
   with Agg show ?case by (auto 0 3 simp: Un_absorb2 fvi_iff_fv[where b=b])
 next
   case (MatchP r P V n R \<phi>s mr mrs buf nts I aux)
   then obtain \<phi>s' where conv: "to_mregex r = (mr, \<phi>s')" by blast
   with MatchP have "\<forall>\<phi>'\<in>set \<phi>s'. \<forall>x\<in>fv \<phi>'. x < n"
     by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \<phi>s'])
   with conv show ?case
     by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \<open>safe_regex _ _ r\<close>])
 next
   case (MatchF r  P V n R \<phi>s mr mrs buf nts I aux)
   then obtain \<phi>s' where conv: "to_mregex r = (mr, \<phi>s')" by blast
   with MatchF have "\<forall>\<phi>'\<in>set \<phi>s'. \<forall>x\<in>fv \<phi>'. x < n"
     by (simp add: list_all2_conv_all_nth all_set_conv_all_nth[of \<phi>s'])
   with conv show ?case
     by (simp add: to_mregex_ok[THEN conjunct1] fv_regex_alt[OF \<open>safe_regex _ _ r\<close>])
 qed (auto simp: fvi_Suc split: if_splits)
 
 lemma qtable_mmulti_join:
   assumes pos: "list_all3 (\<lambda>A Qi X. qtable n A P Qi X \<and> wf_set n A) A_pos Q_pos L_pos"
     and neg: "list_all3 (\<lambda>A Qi X. qtable n A P Qi X \<and> wf_set n A) A_neg Q_neg L_neg"
     and C_eq: "C = \<Union>(set A_pos)" and L_eq: "L = L_pos @ L_neg"
     and "A_pos \<noteq> []" and fv_subset: "\<Union>(set A_neg) \<subseteq> \<Union>(set A_pos)"
     and restrict_pos: "\<And>x. wf_tuple n C x \<Longrightarrow> P x \<Longrightarrow> list_all (\<lambda>A. P (restrict A x)) A_pos"
     and restrict_neg: "\<And>x. wf_tuple n C x \<Longrightarrow> P x \<Longrightarrow> list_all (\<lambda>A. P (restrict A x)) A_neg"
     and Qs: "\<And>x. wf_tuple n C x \<Longrightarrow> P x \<Longrightarrow> Q x \<longleftrightarrow>
       list_all2 (\<lambda>A Qi. Qi (restrict A x)) A_pos Q_pos \<and>
       list_all2 (\<lambda>A Qi. \<not> Qi (restrict A x)) A_neg Q_neg"
   shows "qtable n C P Q (mmulti_join n A_pos A_neg L)"
 proof (rule qtableI)
   from pos have 1: "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) A_pos L_pos"
     by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)
   moreover from neg have "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) A_neg L_neg"
     by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth qtable_def)
   ultimately have L: "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) (A_pos @ A_neg) (L_pos @ L_neg)"
     by (rule list_all2_appendI)
   note in_join_iff = mmulti_join_correct[OF \<open>A_pos \<noteq> []\<close> L]
   from 1 have take_eq: "take (length A_pos) (L_pos @ L_neg) = L_pos"
     by (auto dest!: list_all2_lengthD)
   from 1 have drop_eq: "drop (length A_pos) (L_pos @ L_neg) = L_neg"
     by (auto dest!: list_all2_lengthD)
 
   note mmulti_join.simps[simp del]
   show "table n C (mmulti_join n A_pos A_neg L)"
     unfolding C_eq L_eq table_def by (simp add: in_join_iff)
   show "Q x" if "x \<in> mmulti_join n A_pos A_neg L" "wf_tuple n C x" "P x" for x
     using that(2,3)
   proof (rule Qs[THEN iffD2, OF _ _ conjI])
     have pos': "list_all2 (\<lambda>A. (\<in>) (restrict A x)) A_pos L_pos"
       and neg': "list_all2 (\<lambda>A. (\<notin>) (restrict A x)) A_neg L_neg"
       using that(1) unfolding L_eq in_join_iff take_eq drop_eq by simp_all
     show "list_all2 (\<lambda>A Qi. Qi (restrict A x)) A_pos Q_pos"
       using pos pos' restrict_pos that(2,3)
       by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)
     have fv_subset': "\<And>i. i < length A_neg \<Longrightarrow> A_neg ! i \<subseteq> C"
       using fv_subset unfolding C_eq by (auto simp: Sup_le_iff)
     show "list_all2 (\<lambda>A Qi. \<not> Qi (restrict A x)) A_neg Q_neg"
       using neg neg' restrict_neg that(2,3)
       by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def
           wf_tuple_restrict_simple[OF _ fv_subset'])
   qed
   show "x \<in> mmulti_join n A_pos A_neg L" if "wf_tuple n C x" "P x" "Q x" for x
     unfolding L_eq in_join_iff take_eq drop_eq
   proof (intro conjI)
     from that have pos': "list_all2 (\<lambda>A Qi. Qi (restrict A x)) A_pos Q_pos"
       and neg': "list_all2 (\<lambda>A Qi. \<not> Qi (restrict A x)) A_neg Q_neg"
       using Qs[THEN iffD1] by auto
     show "wf_tuple n (\<Union>A\<in>set A_pos. A) x"
       using \<open>wf_tuple n C x\<close> unfolding C_eq by simp
     show "list_all2 (\<lambda>A. (\<in>) (restrict A x)) A_pos L_pos"
       using pos pos' restrict_pos that(1,2)
       by (simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def
           C_eq wf_tuple_restrict_simple[OF _ Sup_upper])
     show "list_all2 (\<lambda>A. (\<notin>) (restrict A x)) A_neg L_neg"
       using neg neg' restrict_neg that(1,2)
       by (auto simp: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length qtable_def)
   qed
 qed
 
 lemma nth_filter: "i < length (filter P xs) \<Longrightarrow>
   (\<And>i'. i' < length xs \<Longrightarrow> P (xs ! i') \<Longrightarrow> Q (xs ! i')) \<Longrightarrow> Q (filter P xs ! i)"
   by (metis (lifting) in_set_conv_nth set_filter mem_Collect_eq)
 
 lemma nth_partition: "i < length xs \<Longrightarrow>
   (\<And>i'. i' < length (filter P xs) \<Longrightarrow> Q (filter P xs ! i')) \<Longrightarrow>
   (\<And>i'. i' < length (filter (Not \<circ> P) xs) \<Longrightarrow> Q (filter (Not \<circ> P) xs ! i')) \<Longrightarrow> Q (xs ! i)"
   by (metis (no_types, lifting) in_set_conv_nth set_filter mem_Collect_eq comp_apply)
 
 lemma qtable_bin_join:
   assumes "qtable n A P Q1 X" "qtable n B P Q2 Y" "\<not> b \<Longrightarrow> B \<subseteq> A" "C = A \<union> B"
     "\<And>x. wf_tuple n C x \<Longrightarrow> P x \<Longrightarrow> P (restrict A x) \<and> P (restrict B x)"
     "\<And>x. b \<Longrightarrow> wf_tuple n C x \<Longrightarrow> P x \<Longrightarrow> Q x \<longleftrightarrow> Q1 (restrict A x) \<and> Q2 (restrict B x)"
     "\<And>x. \<not> b \<Longrightarrow> wf_tuple n C x \<Longrightarrow> P x \<Longrightarrow> Q x \<longleftrightarrow> Q1 (restrict A x) \<and> \<not> Q2 (restrict B x)"
   shows "qtable n C P Q (bin_join n A X b B Y)"
   using qtable_join[OF assms] bin_join_table[of n A X B Y b] assms(1,2)
   by (auto simp add: qtable_def)
 
 lemma restrict_update: "y \<notin> A \<Longrightarrow> y < length x \<Longrightarrow> restrict A (x[y:=z]) = restrict A x"
   unfolding restrict_def by (auto simp add: nth_list_update)
 
 lemma qtable_assign:
   assumes "qtable n A P Q X"
     "y < n" "insert y A = A'" "y \<notin> A"
     "\<And>x'. wf_tuple n A' x' \<Longrightarrow> P x' \<Longrightarrow> P (restrict A x')"
     "\<And>x. wf_tuple n A x \<Longrightarrow> P x \<Longrightarrow> Q x \<Longrightarrow> Q' (x[y:=Some (f x)])"
     "\<And>x'. wf_tuple n A' x' \<Longrightarrow> P x' \<Longrightarrow> Q' x' \<Longrightarrow> Q (restrict A x') \<and> x' ! y = Some (f (restrict A x'))"
   shows "qtable n A' P Q' ((\<lambda>x. x[y:=Some (f x)]) ` X)" (is "qtable _ _ _ _ ?Y")
 proof (rule qtableI)
   from assms(1) have "table n A X" unfolding qtable_def by simp
   then show "table n A' ?Y"
     unfolding table_def wf_tuple_def using assms(2,3)
     by (auto simp: nth_list_update)
 next
   fix x'
   assume "x' \<in> ?Y" "wf_tuple n A' x'" "P x'"
   then obtain x where "x \<in> X" and x'_eq: "x' = x[y:=Some (f x)]" by blast
   then have "wf_tuple n A x"
     using assms(1) unfolding qtable_def table_def by blast
   then have "y < length x" using assms(2) by (simp add: wf_tuple_def)
   with \<open>wf_tuple n A x\<close> have "restrict A x' = x"
     unfolding x'_eq by (simp add: restrict_update[OF assms(4)] restrict_idle)
   with \<open>wf_tuple n A' x'\<close> \<open>P x'\<close> have "P x"
     using assms(5) by blast
   with \<open>wf_tuple n A x\<close> \<open>x \<in> X\<close> have "Q x"
     using assms(1) by (elim in_qtableE)
   with \<open>wf_tuple n A x\<close> \<open>P x\<close> show "Q' x'"
     unfolding x'_eq by (rule assms(6))
 next
   fix x'
   assume "wf_tuple n A' x'" "P x'" "Q' x'"
   then have "wf_tuple n A (restrict A x')"
     using assms(3) by (auto intro!: wf_tuple_restrict_simple)
   moreover have "P (restrict A x')"
     using \<open>wf_tuple n A' x'\<close> \<open>P x'\<close> by (rule assms(5))
   moreover have "Q (restrict A x')" and y: "x' ! y = Some (f (restrict A x'))"
     using \<open>wf_tuple n A' x'\<close> \<open>P x'\<close> \<open>Q' x'\<close> by (auto dest!: assms(7))
   ultimately have "restrict A x' \<in> X" by (intro in_qtableI[OF assms(1)])
   moreover have "x' = (restrict A x')[y:=Some (f (restrict A x'))]"
     using y assms(2,3) \<open>wf_tuple n A (restrict A x')\<close> \<open>wf_tuple n A' x'\<close>
     by (auto simp: list_eq_iff_nth_eq wf_tuple_def nth_list_update nth_restrict)
   ultimately show "x' \<in> ?Y" by simp
 qed
 
 lemma sat_the_update: "y \<notin> fv \<phi> \<Longrightarrow> Formula.sat \<sigma> V (map the (x[y:=z])) i \<phi> = Formula.sat \<sigma> V (map the x) i \<phi>"
   by (rule sat_fv_cong) (metis map_update nth_list_update_neq)
 
 lemma progress_constraint: "progress \<sigma> P (formula_of_constraint c) j = j"
   by (induction rule: formula_of_constraint.induct) simp_all
 
 lemma qtable_filter:
   assumes "qtable n A P Q X"
     "\<And>x. wf_tuple n A x \<Longrightarrow> P x \<Longrightarrow> Q x \<and> R x \<longleftrightarrow> Q' x"
   shows "qtable n A P Q' (Set.filter R X)" (is "qtable _ _ _ _ ?Y")
 proof (rule qtableI)
   from assms(1) have "table n A X"
     unfolding qtable_def by simp
   then show "table n A ?Y"
     unfolding table_def wf_tuple_def by simp
 next
   fix x
   assume "x \<in> ?Y" "wf_tuple n A x" "P x"
   with assms show "Q' x" by (auto elim!: in_qtableE)
 next
   fix x
   assume "wf_tuple n A x" "P x" "Q' x"
   with assms show "x \<in> Set.filter R X" by (auto intro!: in_qtableI)
 qed
 
 lemma eval_constraint_sat_eq: "wf_tuple n A x \<Longrightarrow> fv_trm t1 \<subseteq> A \<Longrightarrow> fv_trm t2 \<subseteq> A \<Longrightarrow>
   \<forall>i\<in>A. i < n \<Longrightarrow> eval_constraint (t1, p, c, t2) x =
     Formula.sat \<sigma> V (map the x) i (formula_of_constraint (t1, p, c, t2))"
   by (induction "(t1, p, c, t2)" rule: formula_of_constraint.induct)
     (simp_all add: meval_trm_eval_trm)
 
 declare progress_le_gen[simp]
 
 definition "wf_envs \<sigma> j P P' V db =
   (dom V = dom P \<and>
    Mapping.keys db = dom P \<union> {p. p \<in> fst ` \<Gamma> \<sigma> j} \<and>
    rel_mapping (\<le>) P P' \<and>
    pred_mapping (\<lambda>i. i \<le> j) P \<and>
    pred_mapping (\<lambda>i. i \<le> Suc j) P' \<and>
    (\<forall>p \<in> Mapping.keys db - dom P. the (Mapping.lookup db p) = [{ts. (p, ts) \<in> \<Gamma> \<sigma> j}]) \<and>
    (\<forall>p \<in> dom P. list_all2 (\<lambda>i X. X = the (V p) i) [the (P p)..<the (P' p)] (the (Mapping.lookup db p))))"
 
 
 lift_definition mk_db :: "(Formula.name \<times> event_data list) set \<Rightarrow> Formula.database" is
   "\<lambda>X p. (if p \<in> fst ` X then Some [{ts. (p, ts) \<in> X}] else None)" .
 
 lemma wf_envs_mk_db: "wf_envs \<sigma> j Map.empty Map.empty Map.empty (mk_db (\<Gamma> \<sigma> j))"
   unfolding wf_envs_def mk_db_def
   by transfer (force split: if_splits simp: image_iff rel_mapping_alt)
 
 lemma wf_envs_update:
   assumes wf_envs: "wf_envs \<sigma> j P P' V db"
     and m_eq: "m = Formula.nfv \<phi>"
     and in_fv: "{0 ..< m} \<subseteq> fv \<phi>"
     and xs: "list_all2 (\<lambda>i. qtable m (Formula.fv \<phi>) (mem_restr UNIV) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>))
       [progress \<sigma> P \<phi> j..<progress \<sigma> P' \<phi> (Suc j)] xs"
   shows "wf_envs \<sigma> j (P(p \<mapsto> progress \<sigma> P \<phi> j)) (P'(p \<mapsto> progress \<sigma> P' \<phi> (Suc j)))
     (V(p \<mapsto> \<lambda>i. {v. length v = m \<and> Formula.sat \<sigma> V v i \<phi>}))
     (Mapping.update p (map (image (map the)) xs) db)"
   unfolding wf_envs_def
 proof (intro conjI ballI, goal_cases)
   case 3
   from assms show ?case
     by (auto simp: wf_envs_def pred_mapping_alt progress_le progress_mono_gen
         intro!: rel_mapping_map_upd)
 next
   case (6 p')
   with assms show ?case by (cases "p' \<in> dom P") (auto simp: wf_envs_def lookup_update')
 next
   case (7 p')
   from xs in_fv have "list_all2 (\<lambda>x y. map the ` y = {v. length v = m \<and> Formula.sat \<sigma> V v x \<phi>})
       [progress \<sigma> P \<phi> j..<progress \<sigma> P' \<phi> (Suc j)] xs"
     by (elim list.rel_mono_strong) (auto 0 3 simp: wf_tuple_def nth_append
       elim!: in_qtableE in_qtableI intro!: image_eqI[where x="map Some _"])
   moreover have "list_all2 (\<lambda>i X. X = the (V p') i) [the (P p')..<the (P' p')] (the (Mapping.lookup db p'))"
     if "p \<noteq> p'"
   proof -
     from that 7 have "p' \<in> dom P" by simp
     with wf_envs show ?thesis by (simp add: wf_envs_def)
   qed
   ultimately show ?case
     by (simp add: list.rel_map image_iff lookup_update')
 qed (use assms in \<open>auto simp: wf_envs_def\<close>)
 
 lemma wf_envs_P_simps[simp]:
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> pred_mapping (\<lambda>i. i \<le> j) P"
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> pred_mapping (\<lambda>i. i \<le> Suc j) P'"
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> rel_mapping (\<le>) P P'"
   unfolding wf_envs_def by auto
 
 lemma wf_envs_progress_le[simp]:
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> progress \<sigma> P \<phi> j \<le> j"
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> progress \<sigma> P' \<phi> (Suc j) \<le> Suc j"
   unfolding wf_envs_def by auto
 
 lemma wf_envs_progress_regex_le[simp]:
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> progress_regex \<sigma> P r j \<le> j"
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> progress_regex \<sigma> P' r (Suc j) \<le> Suc j"
   unfolding wf_envs_def by (auto simp: progress_regex_le)
 
 lemma wf_envs_progress_mono[simp]:
    "wf_envs \<sigma> j P P' V db \<Longrightarrow> a \<le> b \<Longrightarrow> progress \<sigma> P \<phi> a \<le> progress \<sigma> P' \<phi> b"
   unfolding wf_envs_def
   by (auto simp: progress_mono_gen)
 
 lemma qtable_wf_tuple_cong: "qtable n A P Q X \<Longrightarrow> A = B \<Longrightarrow> (\<And>v. wf_tuple n A v \<Longrightarrow> P v \<Longrightarrow> Q v = Q' v) \<Longrightarrow> qtable n B P Q' X"
   unfolding qtable_def table_def by blast
 
 lemma (in maux) meval:
   assumes "wf_mformula \<sigma> j P V n R \<phi> \<phi>'" "wf_envs \<sigma> j P P' V db"
   shows "case meval n (\<tau> \<sigma> j) db \<phi> of (xs, \<phi>\<^sub>n) \<Rightarrow> wf_mformula \<sigma> (Suc j) P' V n R \<phi>\<^sub>n \<phi>' \<and>
     list_all2 (\<lambda>i. qtable n (Formula.fv \<phi>') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>'))
     [progress \<sigma> P \<phi>' j..<progress \<sigma> P' \<phi>' (Suc j)] xs"
   using assms
 proof (induction \<phi> arbitrary: db P P' V n R \<phi>')
   case (MRel rel)
   then show ?case
     by (cases rule: wf_mformula.cases)
       (auto simp add: ball_Un intro: wf_mformula.intros table_eq_rel eq_rel_eval_trm
         in_eq_rel qtable_empty qtable_unit_table intro!: qtableI)
 next
   case (MPred e ts)
   then show ?case
   proof (cases "e \<in> dom P")
     case True
     with MPred(2) have "e \<in> Mapping.keys db" "e \<in> dom P'" "e \<in> dom V"
       "list_all2 (\<lambda>i X. X = the (V e) i) [the (P e)..<the (P' e)]
          (the (Mapping.lookup db e))" unfolding wf_envs_def rel_mapping_alt by blast+
     with MPred(1) True show ?thesis
       by (cases rule: wf_mformula.cases)
         (fastforce intro!: wf_mformula.Pred qtableI bexI[where P="\<lambda>x. _ = tabulate x 0 n", OF refl]
         elim!: list.rel_mono_strong bexI[rotated] dest: ex_match
         simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff
           list.map_comp keys_dom_lookup)
   next
     note MPred(1)
     moreover
     case False
     moreover
     from False MPred(2) have "e \<notin> dom P'" "e \<notin> dom V"
       unfolding wf_envs_def rel_mapping_alt by auto
     moreover
     from False MPred(2) have *: "e \<in> fst ` \<Gamma> \<sigma> j \<longleftrightarrow> e \<in> Mapping.keys db"
       unfolding wf_envs_def by auto
     from False MPred(2) have
       "e \<in> Mapping.keys db \<Longrightarrow> Mapping.lookup db e = Some [{ts. (e, ts) \<in> \<Gamma> \<sigma> j}]"
       unfolding wf_envs_def keys_dom_lookup by (metis Diff_iff domD option.sel)
     with * have "(case Mapping.lookup db e of None \<Rightarrow> [{}] | Some xs \<Rightarrow> xs) = [{ts. (e, ts) \<in> \<Gamma> \<sigma> j}]"
       by (cases "e \<in> fst ` \<Gamma> \<sigma> j") (auto simp: image_iff keys_dom_lookup split: option.splits)
     ultimately show ?thesis
       by (cases rule: wf_mformula.cases)
         (fastforce intro!: wf_mformula.Pred qtableI bexI[where P="\<lambda>x. _ = tabulate x 0 n", OF refl]
         elim!: list.rel_mono_strong bexI[rotated] dest: ex_match
         simp: list.rel_map table_def match_wf_tuple in_these_eq match_eval_trm image_iff list.map_comp)
   qed
 next
   case (MLet p m \<phi>1 \<phi>2)
   from MLet.prems(1) obtain \<phi>1' \<phi>2' where Let: "\<phi>' = Formula.Let p \<phi>1' \<phi>2'" and
     1: "wf_mformula \<sigma> j P V m UNIV \<phi>1 \<phi>1'" and
     fv: "m = Formula.nfv \<phi>1'" "{0..<m} \<subseteq> fv \<phi>1'" and
     2: "wf_mformula \<sigma> j (P(p \<mapsto> progress \<sigma> P \<phi>1' j))
       (V(p \<mapsto> \<lambda>i. {v. length v = m \<and> Formula.sat \<sigma> V v i \<phi>1'}))
       n R \<phi>2 \<phi>2'"
     by (cases rule: wf_mformula.cases) auto
   obtain xs \<phi>1_new where e1: "meval m (\<tau> \<sigma> j) db \<phi>1 = (xs, \<phi>1_new)" and
       wf1: "wf_mformula \<sigma> (Suc j) P' V m UNIV \<phi>1_new \<phi>1'" and
       res1: "list_all2 (\<lambda>i. qtable m (fv \<phi>1') (mem_restr UNIV) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>1'))
        [progress \<sigma> P \<phi>1' j..<progress \<sigma> P' \<phi>1' (Suc j)] xs"
     using MLet(1)[OF 1(1) MLet.prems(2)] by (auto simp: eqTrueI[OF mem_restr_UNIV, abs_def])
   from MLet(2)[OF 2 wf_envs_update[OF MLet.prems(2) fv res1]] wf1 e1 fv
   show ?case unfolding Let
     by (auto simp: fun_upd_def intro!: wf_mformula.Let)
 next
   case (MAnd A_\<phi> \<phi> pos A_\<psi> \<psi> buf)
   from MAnd.prems show ?case
     by (cases rule: wf_mformula.cases)
       (auto simp: sat_the_restrict simp del: bin_join.simps
         dest!: MAnd.IH split: if_splits prod.splits intro!: wf_mformula.And qtable_bin_join
         elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])
 next
   case (MAndAssign \<phi> conf)
   from MAndAssign.prems obtain \<phi>'' x t \<psi>'' where
     wf_envs: "wf_envs \<sigma> j P P' V db" and
     \<phi>'_eq: "\<phi>' = formula.And \<phi>'' \<psi>''" and
     wf_\<phi>: "wf_mformula \<sigma> j P V n R \<phi> \<phi>''" and
     "x < n" and
     "x \<notin> fv \<phi>''" and
     fv_t_subset: "fv_trm t \<subseteq> fv \<phi>''" and
     conf: "(x, t) = conf" and
     \<psi>''_eqs: "\<psi>'' = formula.Eq (trm.Var x) t \<or> \<psi>'' = formula.Eq t (trm.Var x)"
     by (cases rule: wf_mformula.cases)
   from wf_\<phi> wf_envs obtain xs \<phi>\<^sub>n where
     meval_eq: "meval n (\<tau> \<sigma> j) db \<phi> = (xs, \<phi>\<^sub>n)" and
     wf_\<phi>\<^sub>n: "wf_mformula \<sigma> (Suc j) P' V n R \<phi>\<^sub>n \<phi>''" and
     xs: "list_all2 (\<lambda>i. qtable n (fv \<phi>'') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>''))
         [progress \<sigma> P \<phi>'' j..<progress \<sigma> P' \<phi>'' (Suc j)] xs"
     by (auto dest!: MAndAssign.IH)
   have progress_eqs:
       "progress \<sigma> P \<phi>' j = progress \<sigma> P \<phi>'' j"
       "progress \<sigma> P' \<phi>' (Suc j) = progress \<sigma> P' \<phi>'' (Suc j)"
     using \<psi>''_eqs wf_envs_progress_le[OF wf_envs] by (auto simp: \<phi>'_eq)
 
   show ?case proof (simp add: meval_eq, intro conjI)
     show "wf_mformula \<sigma> (Suc j) P' V n R (MAndAssign \<phi>\<^sub>n conf) \<phi>'"
       unfolding \<phi>'_eq
       by (rule wf_mformula.AndAssign) fact+
   next
     show "list_all2 (\<lambda>i. qtable n (fv \<phi>') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>'))
         [progress \<sigma> P \<phi>' j..<progress \<sigma> P' \<phi>' (Suc j)] (map ((`) (eval_assignment conf)) xs)"
       unfolding list.rel_map progress_eqs conf[symmetric] eval_assignment.simps
       using xs
     proof (rule list.rel_mono_strong)
       fix i X
       assume qtable: "qtable n (fv \<phi>'') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>'') X"
       then show "qtable n (fv \<phi>') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<phi>')
           ((\<lambda>y. y[x := Some (meval_trm t y)]) ` X)"
       proof (rule qtable_assign)
         show "x < n" by fact
         show "insert x (fv \<phi>'') = fv \<phi>'"
           using \<psi>''_eqs fv_t_subset by (auto simp: \<phi>'_eq)
         show "x \<notin> fv \<phi>''" by fact
       next
         fix v
         assume wf_v: "wf_tuple n (fv \<phi>') v" and "mem_restr R v"
         then show "mem_restr R (restrict (fv \<phi>'') v)" by simp
 
         assume sat: "Formula.sat \<sigma> V (map the v) i \<phi>'"
         then have A: "Formula.sat \<sigma> V (map the (restrict (fv \<phi>'') v)) i \<phi>''" (is ?A)
           by (simp add: \<phi>'_eq sat_the_restrict)
         have "map the v ! x = Formula.eval_trm (map the v) t"
           using sat \<psi>''_eqs by (auto simp: \<phi>'_eq)
         also have "... = Formula.eval_trm (map the (restrict (fv \<phi>'') v)) t"
           using fv_t_subset by (auto simp: map_the_restrict intro!: eval_trm_fv_cong)
         finally have "map the v ! x = meval_trm t (restrict (fv \<phi>'') v)"
           using meval_trm_eval_trm[of n "fv \<phi>''" "restrict (fv \<phi>'') v" t]
             fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\<phi>]
           by (fastforce simp: \<phi>'_eq intro!: wf_tuple_restrict)
         then have B: "v ! x = Some (meval_trm t (restrict (fv \<phi>'') v))" (is ?B)
           using \<psi>''_eqs wf_v \<open>x < n\<close> by (auto simp: wf_tuple_def \<phi>'_eq)
         from A B show "?A \<and> ?B" ..
       next
         fix v
         assume wf_v: "wf_tuple n (fv \<phi>'') v" and "mem_restr R v"
           and sat: "Formula.sat \<sigma> V (map the v) i \<phi>''"
         let ?v = "v[x := Some (meval_trm t v)]"
         from sat have A: "Formula.sat \<sigma> V (map the ?v) i \<phi>''"
           using \<open>x \<notin> fv \<phi>''\<close> by (simp add: sat_the_update)
         have "y \<in> fv_trm t \<Longrightarrow> x \<noteq> y" for y
           using fv_t_subset \<open>x \<notin> fv \<phi>''\<close> by auto
         then have B: "Formula.sat \<sigma> V (map the ?v) i \<psi>''"
           using \<psi>''_eqs meval_trm_eval_trm[of n "fv \<phi>''" v t] \<open>x < n\<close>
             fv_t_subset wf_v wf_mformula_wf_set[unfolded wf_set_def, OF wf_\<phi>]
           by (auto simp: wf_tuple_def map_update intro!: eval_trm_fv_cong)
         from A B show "Formula.sat \<sigma> V (map the ?v) i \<phi>'"
           by (simp add: \<phi>'_eq)
       qed
     qed
   qed
 next
   case (MAndRel \<phi> conf)
   from MAndRel.prems show ?case
     by (cases rule: wf_mformula.cases)
       (auto simp: progress_constraint progress_le list.rel_map fv_formula_of_constraint
         Un_absorb2 wf_mformula_wf_set[unfolded wf_set_def] split: prod.splits
         dest!: MAndRel.IH[where db=db and P=P and P'=P'] eval_constraint_sat_eq[THEN iffD2]
         intro!: wf_mformula.AndRel
         elim!: list.rel_mono_strong qtable_filter eval_constraint_sat_eq[THEN iffD1])
 next
   case (MAnds A_pos A_neg l buf)
   note mbufn_take.simps[simp del] mbufn_add.simps[simp del] mmulti_join.simps[simp del]
 
   from MAnds.prems obtain pos neg l' where
     wf_l: "list_all2 (wf_mformula \<sigma> j P V n R) l (pos @ map remove_neg neg)" and
     wf_buf: "wf_mbufn (progress \<sigma> P (formula.Ands l') j) (map (\<lambda>\<psi>. progress \<sigma> P \<psi> j) (pos @ map remove_neg neg))
       (map (\<lambda>\<psi> i. qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>)) (pos @ map remove_neg neg)) buf" and
     posneg: "(pos, neg) = partition safe_formula l'" and
     "pos \<noteq> []" and
     safe_neg: "list_all safe_formula (map remove_neg neg)" and
     A_eq: "A_pos = map fv pos" "A_neg = map fv neg" and
     fv_subset: "\<Union> (set A_neg) \<subseteq> \<Union> (set A_pos)" and
     "\<phi>' = Formula.Ands l'"
     by (cases rule: wf_mformula.cases) simp
   have progress_eq: "progress \<sigma> P' (formula.Ands l') (Suc j) =
       Mini (progress \<sigma> P (formula.Ands l') j) (map (\<lambda>\<psi>. progress \<sigma> P' \<psi> (Suc j)) (pos @ map remove_neg neg))"
     using \<open>pos \<noteq> []\<close> posneg
     by (auto simp: Mini_def image_Un[symmetric] Collect_disj_eq[symmetric] intro!: arg_cong[where f=Min])
 
   have join_ok: "qtable n (\<Union> (fv ` set l')) (mem_restr R)
         (\<lambda>v. list_all (Formula.sat \<sigma> V (map the v) k) l')
         (mmulti_join n A_pos A_neg L)"
     if args_ok: "list_all2 (\<lambda>x. qtable n (fv x) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) k x))
         (pos @ map remove_neg neg) L"
     for k L
   proof (rule qtable_mmulti_join)
     let ?ok = "\<lambda>A Qi X. qtable n A (mem_restr R) Qi X \<and> wf_set n A"
     let ?L_pos = "take (length A_pos) L"
     let ?L_neg = "drop (length A_pos) L"
     have 1: "length pos \<le> length L"
       using args_ok by (auto dest!: list_all2_lengthD)
     show "list_all3 ?ok A_pos (map (\<lambda>\<psi> v. Formula.sat \<sigma> V (map the v) k \<psi>) pos) ?L_pos"
       using args_ok wf_l unfolding A_eq
       by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth nth_append
           split: if_splits intro!: wf_mformula_wf_set[of \<sigma> j P V n R]
           dest: order.strict_trans2[OF _ 1])
     from args_ok have prems_neg: "list_all2 (\<lambda>\<psi>. qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) k (remove_neg \<psi>))) neg ?L_neg"
       by (auto simp: A_eq list_all2_append1 list.rel_map)
     show "list_all3 ?ok A_neg (map (\<lambda>\<psi> v. Formula.sat \<sigma> V (map the v) k (remove_neg \<psi>)) neg) ?L_neg"
       using prems_neg wf_l unfolding A_eq
       by (auto simp add: list_all3_conv_all_nth list_all2_conv_all_nth list_all_length nth_append less_diff_conv
           split: if_splits intro!: wf_mformula_wf_set[of \<sigma> j P V n R _ "remove_neg _", simplified])
     show "\<Union>(fv ` set l') = \<Union>(set A_pos)"
       using fv_subset posneg unfolding A_eq by auto
     show "L = take (length A_pos) L @ drop (length A_pos) L" by simp
     show "A_pos \<noteq> []" using \<open>pos \<noteq> []\<close> A_eq by simp
 
     fix x :: "event_data tuple"
     assume "wf_tuple n (\<Union> (fv ` set l')) x" and "mem_restr R x"
     then show "list_all (\<lambda>A. mem_restr R (restrict A x)) A_pos"
       and "list_all (\<lambda>A. mem_restr R (restrict A x)) A_neg"
       by (simp_all add: list.pred_set)
 
     have "list_all Formula.is_Neg neg"
       using posneg safe_neg
       by (auto 0 3 simp add: list.pred_map elim!: list.pred_mono_strong
           intro: formula.exhaust[of \<psi> "Formula.is_Neg \<psi>" for \<psi>])
     then have "list_all (\<lambda>\<psi>. Formula.sat \<sigma> V (map the v) i (remove_neg \<psi>) \<longleftrightarrow>
       \<not> Formula.sat \<sigma> V (map the v) i \<psi>) neg" for v i
       by (fastforce simp: Formula.is_Neg_def elim!: list.pred_mono_strong)
     then show "list_all (Formula.sat \<sigma> V (map the x) k) l' =
        (list_all2 (\<lambda>A Qi. Qi (restrict A x)) A_pos
          (map (\<lambda>\<psi> v. Formula.sat \<sigma> V (map the v) k \<psi>) pos) \<and>
         list_all2 (\<lambda>A Qi. \<not> Qi (restrict A x)) A_neg
          (map (\<lambda>\<psi> v. Formula.sat \<sigma> V (map the v) k
                        (remove_neg \<psi>))
            neg))"
       using posneg
       by (auto simp add: A_eq list_all2_conv_all_nth list_all_length sat_the_restrict
           elim: nth_filter nth_partition[where P=safe_formula and Q="Formula.sat _ _ _ _"])
   qed fact
 
   from MAnds.prems(2) show ?case
     unfolding \<open>\<phi>' = Formula.Ands l'\<close>
     by (auto 0 3 simp add: list.rel_map progress_eq map2_map_map list_all3_map
         list_all3_list_all2_conv list.pred_map
         simp del: set_append map_append progress_simps split: prod.splits
         intro!: wf_mformula.Ands[OF _ _ posneg \<open>pos \<noteq> []\<close> safe_neg A_eq fv_subset]
         list.rel_mono_strong[OF wf_l] wf_mbufn_add[OF wf_buf]
         list.rel_flip[THEN iffD1, OF list.rel_mono_strong, OF wf_l]
         list.rel_refl join_ok[unfolded list.pred_set]
         dest!: MAnds.IH[OF _ _ MAnds.prems(2), rotated]
         elim!: wf_mbufn_take list_all2_appendI
         elim: mbufn_take_induct[OF _ wf_mbufn_add[OF wf_buf]])
 next
   case (MOr \<phi> \<psi> buf)
   from MOr.prems show ?case
     by (cases rule: wf_mformula.cases)
       (auto dest!: MOr.IH split: if_splits prod.splits intro!: wf_mformula.Or qtable_union
         elim: mbuf2_take_add'(1) list.rel_mono_strong[OF mbuf2_take_add'(2)])
 next
   case (MNeg \<phi>)
   have *: "qtable n {} (mem_restr R) (\<lambda>v. P v) X \<Longrightarrow>
     \<not> qtable n {} (mem_restr R) (\<lambda>v. \<not> P v) empty_table \<Longrightarrow> x \<in> X \<Longrightarrow> False" for P x X
     using nullary_qtable_cases qtable_unit_empty_table by fastforce
   from MNeg.prems show ?case
     by (cases rule: wf_mformula.cases)
       (auto 0 4 intro!: wf_mformula.Neg dest!: MNeg.IH
         simp add: list.rel_map
         dest: nullary_qtable_cases qtable_unit_empty_table intro!: qtable_empty_unit_table
         elim!: list.rel_mono_strong elim: *)
 next
   case (MExists \<phi>)
   from MExists.prems show ?case
     by (cases rule: wf_mformula.cases)
       (force simp: list.rel_map fvi_Suc sat_fv_cong nth_Cons'
         intro!: wf_mformula.Exists dest!: MExists.IH qtable_project_fv
         elim!: list.rel_mono_strong table_fvi_tl qtable_cong sat_fv_cong[THEN iffD1, rotated -1]
         split: if_splits)+
 next
   case (MAgg g0 y \<omega> b f \<phi>)
   from MAgg.prems show ?case
     using wf_mformula_wf_set[OF MAgg.prems(1), unfolded wf_set_def]
     by (cases rule: wf_mformula.cases)
       (auto 0 3 simp add: list.rel_map simp del: sat.simps fvi.simps split: prod.split
         intro!: wf_mformula.Agg qtable_eval_agg dest!: MAgg.IH elim!: list.rel_mono_strong)
 next
   case (MPrev I \<phi> first buf nts)
   from MPrev.prems show ?case
   proof (cases rule: wf_mformula.cases)
     case (Prev \<psi>)
     let ?xs = "fst (meval n (\<tau> \<sigma> j) db \<phi>)"
     let ?\<phi> = "snd (meval n (\<tau> \<sigma> j) db \<phi>)"
     let ?ls = "fst (mprev_next I (buf @ ?xs) (nts @ [\<tau> \<sigma> j]))"
     let ?rs = "fst (snd (mprev_next I (buf @ ?xs) (nts @ [\<tau> \<sigma> j])))"
     let ?ts = "snd (snd (mprev_next I (buf @ ?xs) (nts @ [\<tau> \<sigma> j])))"
     let ?P = "\<lambda>i X. qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>) X"
     let ?min = "min (progress \<sigma> P' \<psi> (Suc j)) (Suc j - 1)"
     from Prev MPrev.IH[OF _ MPrev.prems(2), of n R \<psi>] have IH: "wf_mformula \<sigma> (Suc j) P' V n R ?\<phi> \<psi>" and
       "list_all2 ?P [progress \<sigma> P \<psi> j..<progress \<sigma> P' \<psi> (Suc j)] ?xs" by auto
     with Prev(4,5) MPrev.prems(2) have "list_all2 (\<lambda>i X. if mem (\<tau> \<sigma> (Suc i) - \<tau> \<sigma> i) I then ?P i X else X = empty_table)
         [min (progress \<sigma> P \<psi> j) (j - 1)..<?min] ?ls \<and>
        list_all2 ?P [?min..<progress \<sigma> P' \<psi> (Suc j)] ?rs \<and>
        list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [?min..<Suc j] ?ts"
       by (intro mprev) (auto intro!: list_all2_upt_append list_all2_appendI order.trans[OF min.cobounded1])
     moreover have "min (Suc (progress \<sigma> P \<psi> j)) j = Suc (min (progress \<sigma> P \<psi> j) (j-1))" if "j > 0"
       using that by auto
     ultimately show ?thesis using Prev(1,3) MPrev.prems(2) IH
       by (auto simp: map_Suc_upt[symmetric] upt_Suc[of 0] list.rel_map qtable_empty_iff
           simp del: upt_Suc elim!: wf_mformula.Prev list.rel_mono_strong
           split: prod.split if_split_asm)
   qed
 next
   case (MNext I \<phi> first nts)
   from MNext.prems show ?case
   proof (cases rule: wf_mformula.cases)
     case (Next \<psi>)
 
     have min[simp]:
       "min (progress \<sigma> P \<psi> j - Suc 0) (j - Suc 0) = progress \<sigma> P \<psi> j - Suc 0"
       "min (progress \<sigma> P' \<psi> (Suc j) - Suc 0) j = progress \<sigma> P' \<psi> (Suc j) - Suc 0"
       using wf_envs_progress_le[OF MNext.prems(2), of \<psi>] by auto
 
     let ?xs = "fst (meval n (\<tau> \<sigma> j) db \<phi>)"
     let ?ys = "case (?xs, first) of (_ # xs, True) \<Rightarrow> xs | _ \<Rightarrow> ?xs"
     let ?\<phi> = "snd (meval n (\<tau> \<sigma> j) db \<phi>)"
     let ?ls = "fst (mprev_next I ?ys (nts @ [\<tau> \<sigma> j]))"
     let ?rs = "fst (snd (mprev_next I ?ys (nts @ [\<tau> \<sigma> j])))"
     let ?ts = "snd (snd (mprev_next I ?ys (nts @ [\<tau> \<sigma> j])))"
     let ?P = "\<lambda>i X. qtable n (fv \<psi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i \<psi>) X"
     let ?min = "min (progress \<sigma> P' \<psi> (Suc j) - 1) (Suc j - 1)"
     from Next MNext.IH[OF _ MNext.prems(2), of n R \<psi>] have IH: "wf_mformula \<sigma> (Suc j) P' V  n R ?\<phi> \<psi>"
       "list_all2 ?P [progress \<sigma> P \<psi> j..<progress \<sigma> P' \<psi> (Suc j)] ?xs" by auto
     with Next have "list_all2 (\<lambda>i X. if mem (\<tau> \<sigma> (Suc i) - \<tau> \<sigma> i) I then ?P (Suc i) X else X = empty_table)
         [progress \<sigma> P \<psi> j - 1..<?min] ?ls \<and>
        list_all2 ?P [Suc ?min..<progress \<sigma> P' \<psi> (Suc j)] ?rs \<and>
        list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [?min..<Suc j] ?ts" if "progress \<sigma> P \<psi> j < progress \<sigma> P' \<psi> (Suc j)"
       using that wf_envs_progress_le[OF MNext.prems(2), of \<psi>]
       by (intro mnext) (auto simp: list_all2_Cons2 upt_eq_Cons_conv
           intro!: list_all2_upt_append list_all2_appendI split: list.splits)
     then show ?thesis using wf_envs_progress_le[OF MNext.prems(2), of \<psi>]
       wf_envs_progress_mono[OF MNext.prems(2), of j "Suc j" \<psi>, simplified] Next IH
       by (cases "progress \<sigma> P' \<psi> (Suc j) > progress \<sigma> P \<psi> j")
         (auto 0 3 simp: qtable_empty_iff le_Suc_eq le_diff_conv
           elim!: wf_mformula.Next list.rel_mono_strong list_all2_appendI
           split: prod.split list.splits if_split_asm)  (* slow 5 sec*)
   qed
 next
   case (MSince args \<phi> \<psi> buf nts aux)
   note sat.simps[simp del]
   from MSince.prems obtain \<phi>'' \<phi>''' \<psi>'' I where Since_eq: "\<phi>' = Formula.Since \<phi>''' I \<psi>''"
     and pos: "if args_pos args then \<phi>''' = \<phi>'' else \<phi>''' = Formula.Neg \<phi>''"
     and pos_eq: "safe_formula \<phi>''' = args_pos args"
     and \<phi>: "wf_mformula \<sigma> j P V n R \<phi> \<phi>''"
     and \<psi>: "wf_mformula \<sigma> j P V n R \<psi> \<psi>''"
     and fvi_subset: "Formula.fv \<phi>'' \<subseteq> Formula.fv \<psi>''"
     and buf: "wf_mbuf2' \<sigma> P V j n R \<phi>'' \<psi>'' buf"
     and nts: "wf_ts \<sigma> P j \<phi>'' \<psi>'' nts"
     and aux: "wf_since_aux \<sigma> V R args \<phi>'' \<psi>'' aux (progress \<sigma> P (Formula.Since \<phi>''' I \<psi>'') j)"
     and args_ivl: "args_ivl args = I"
     and args_n: "args_n args = n"
     and args_L: "args_L args = Formula.fv \<phi>''"
     and args_R: "args_R args = Formula.fv \<psi>''"
     by (cases rule: wf_mformula.cases) (auto)
   have \<phi>''': "Formula.fv \<phi>''' = Formula.fv \<phi>''" "progress \<sigma> P \<phi>''' j = progress \<sigma> P \<phi>'' j"
     "progress \<sigma> P' \<phi>''' j = progress \<sigma> P' \<phi>'' j" for j
     using pos by (simp_all split: if_splits)
   from MSince.prems(2) have nts_snoc: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i)
     [min (progress \<sigma> P \<phi>'' j) (progress \<sigma> P \<psi>'' j)..<Suc j] (nts @ [\<tau> \<sigma> j])"
     using nts unfolding wf_ts_def
     by (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] intro: list_all2_appendI)
   have update: "wf_since_aux \<sigma> V R args \<phi>'' \<psi>'' (snd (zs, aux')) (progress \<sigma> P' (Formula.Since \<phi>''' I \<psi>'') (Suc j)) \<and>
     list_all2 (\<lambda>i. qtable n (Formula.fv \<phi>''' \<union> Formula.fv \<psi>'') (mem_restr R)
       (\<lambda>v. Formula.sat \<sigma> V (map the v) i (Formula.Since \<phi>''' I \<psi>'')))
       [progress \<sigma> P (Formula.Since \<phi>''' I \<psi>'') j..<progress \<sigma> P' (Formula.Since \<phi>''' I \<psi>'') (Suc j)] (fst (zs, aux'))"
     if eval_\<phi>: "fst (meval n (\<tau> \<sigma> j) db \<phi>) = xs"
       and eval_\<psi>: "fst (meval n (\<tau> \<sigma> j) db \<psi>) = ys"
       and eq: "mbuf2t_take (\<lambda>r1 r2 t (zs, aux).
         case update_since args r1 r2 t aux of (z, x) \<Rightarrow> (zs @ [z], x))
         ([], aux) (mbuf2_add xs ys buf) (nts @ [\<tau> \<sigma> j]) = ((zs, aux'), buf', nts')"
     for xs ys zs aux' buf' nts'
     unfolding progress_simps \<phi>'''
   proof (rule mbuf2t_take_add_induct'[where j=j and j'="Suc j" and z'="(zs, aux')",
       OF eq wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc],
       goal_cases xs ys _ base step)
     case xs
     then show ?case
       using MSince.IH(1)[OF \<phi> MSince.prems(2)] eval_\<phi> by auto
   next
     case ys
     then show ?case
       using MSince.IH(2)[OF \<psi> MSince.prems(2)] eval_\<psi> by auto
   next
     case base
     then show ?case
       using aux by (simp add: \<phi>''')
   next
     case (step k X Y z)
     then show ?case
       using fvi_subset pos
       by (auto 0 3 simp: args_ivl args_n args_L args_R Un_absorb1
           elim!: update_since(1) list_all2_appendI dest!: update_since(2)
           split: prod.split if_splits)
   qed simp
   with MSince.IH(1)[OF \<phi> MSince.prems(2)] MSince.IH(2)[OF \<psi> MSince.prems(2)] show ?case
     by (auto 0 3 simp: Since_eq split: prod.split
         intro: wf_mformula.Since[OF _ _ pos pos_eq args_ivl args_n args_L args_R fvi_subset]
         elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc]
               mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MSince.prems(2)] buf nts_snoc])
 next
   case (MUntil args \<phi> \<psi> buf nts aux)
   note sat.simps[simp del] progress_simps[simp del]
   from MUntil.prems obtain \<phi>'' \<phi>''' \<psi>'' I where Until_eq: "\<phi>' = Formula.Until \<phi>''' I \<psi>''"
     and pos: "if args_pos args then \<phi>''' = \<phi>'' else \<phi>''' = Formula.Neg \<phi>''"
     and pos_eq: "safe_formula \<phi>''' = args_pos args"
     and \<phi>: "wf_mformula \<sigma> j P V n R \<phi> \<phi>''"
     and \<psi>: "wf_mformula \<sigma> j P V n R \<psi> \<psi>''"
     and fvi_subset: "Formula.fv \<phi>'' \<subseteq> Formula.fv \<psi>''"
     and buf: "wf_mbuf2' \<sigma> P V j n R \<phi>'' \<psi>'' buf"
     and nts: "wf_ts \<sigma> P j \<phi>'' \<psi>'' nts"
     and aux: "wf_until_aux \<sigma> V R args \<phi>'' \<psi>'' aux (progress \<sigma> P (Formula.Until \<phi>''' I \<psi>'') j)"
     and args_ivl: "args_ivl args = I"
     and args_n: "args_n args = n"
     and args_L: "args_L args = Formula.fv \<phi>''"
     and args_R: "args_R args = Formula.fv \<psi>''"
     and length_aux: "progress \<sigma> P (Formula.Until \<phi>''' I \<psi>'') j + length_muaux args aux =
       min (progress \<sigma> P \<phi>'' j) (progress \<sigma> P \<psi>'' j)"
     by (cases rule: wf_mformula.cases) (auto)
   define pos where args_pos: "pos = args_pos args"
   have \<phi>''': "progress \<sigma> P \<phi>''' j = progress \<sigma> P \<phi>'' j"  "progress \<sigma> P' \<phi>''' j = progress \<sigma> P' \<phi>'' j" for j
     using pos by (simp_all add: progress.simps split: if_splits)
   from MUntil.prems(2) have nts_snoc: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i)
     [min (progress \<sigma> P \<phi>'' j) (progress \<sigma> P \<psi>'' j)..<Suc j] (nts @ [\<tau> \<sigma> j])"
     using nts unfolding wf_ts_def
     by (auto simp add: wf_envs_progress_le[THEN min.coboundedI1] intro: list_all2_appendI)
   {
     fix xs ys zs aux' aux'' buf' nts'
     assume eval_\<phi>: "fst (meval n (\<tau> \<sigma> j) db \<phi>) = xs"
       and eval_\<psi>: "fst (meval n (\<tau> \<sigma> j) db \<psi>) = ys"
       and eq1: "mbuf2t_take (add_new_muaux args) aux (mbuf2_add xs ys buf) (nts @ [\<tau> \<sigma> j]) =
         (aux', buf', nts')"
       and eq2: "eval_muaux args (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # _ \<Rightarrow> nt) aux' = (zs, aux'')"
     define ne where "ne \<equiv> progress \<sigma> P (Formula.Until \<phi>''' I \<psi>'') j"
     have update1: "wf_until_aux \<sigma> V R args \<phi>'' \<psi>'' aux' (progress \<sigma> P (Formula.Until \<phi>''' I \<psi>'') j) \<and>
       ne + length_muaux args aux' = min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j))"
       using MUntil.IH(1)[OF \<phi> MUntil.prems(2)] eval_\<phi> MUntil.IH(2)[OF \<psi> MUntil.prems(2)]
         eval_\<psi> nts_snoc nts_snoc length_aux aux fvi_subset
       unfolding \<phi>'''
       by (elim mbuf2t_take_add_induct'[where j'="Suc j", OF eq1 wf_envs_P_simps[OF MUntil.prems(2)] buf])
         (auto simp: args_n args_L args_R ne_def wf_update_until)
     then obtain cur auxlist' where valid_aux': "valid_muaux args cur aux' auxlist'" and
       cur: "cur = (if ne + length auxlist' = 0 then 0 else \<tau> \<sigma> (ne + length auxlist' - 1))" and
       wf_auxlist': "wf_until_auxlist \<sigma> V n R pos \<phi>'' I \<psi>'' auxlist' (progress \<sigma> P (Formula.Until \<phi>''' I \<psi>'') j)"
       unfolding wf_until_aux_def ne_def args_ivl args_n args_pos by auto
     have length_aux': "length_muaux args aux' = length auxlist'"
       using valid_length_muaux[OF valid_aux'] .
     have nts': "wf_ts \<sigma> P' (Suc j) \<phi>'' \<psi>'' nts'"
       using MUntil.IH(1)[OF \<phi> MUntil.prems(2)] eval_\<phi> MUntil.IH(2)[OF \<psi> MUntil.prems(2)]
         MUntil.prems(2) eval_\<psi> nts_snoc
       unfolding wf_ts_def
       by (intro mbuf2t_take_eqD(2)[OF eq1]) (auto intro: wf_mbuf2_add buf[unfolded wf_mbuf2'_def])
     define zs'' where "zs'' = fst (eval_until I (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt) auxlist')"
     define auxlist'' where "auxlist'' = snd (eval_until I (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt) auxlist')"
     have current_w_le: "cur \<le> (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)"
     proof (cases nts')
       case Nil
       have p_le: "min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)) - 1 \<le> j"
         using wf_envs_progress_le[OF MUntil.prems(2)]
         by (auto simp: min_def le_diff_conv)
       then show ?thesis
         unfolding cur conjunct2[OF update1, unfolded length_aux']
         using Nil by auto
     next
       case (Cons nt x)
       have progress_\<phi>''': "progress \<sigma> P' \<phi>'' (Suc j) = progress \<sigma> P' \<phi>''' (Suc j)"
         using pos by (auto simp add: progress.simps split: if_splits)
       have "nt = \<tau> \<sigma> (min (progress \<sigma> P' \<phi>'' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)))"
         using nts'[unfolded wf_ts_def Cons]
         unfolding list_all2_Cons2 upt_eq_Cons_conv by auto
       then show ?thesis
         unfolding cur conjunct2[OF update1, unfolded length_aux'] Cons progress_\<phi>'''
         by (auto split: if_splits list.splits intro!: \<tau>_mono)
     qed
     have valid_aux'': "valid_muaux args cur aux'' auxlist''"
       using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']
       by (auto simp add: args_ivl zs''_def auxlist''_def)
     have length_aux'': "length_muaux args aux'' = length auxlist''"
       using valid_length_muaux[OF valid_aux''] .
     have eq2': "eval_until I (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # _ \<Rightarrow> nt) auxlist' = (zs, auxlist'')"
       using valid_eval_muaux[OF valid_aux' current_w_le eq2, of zs'' auxlist'']
       by (auto simp add: args_ivl zs''_def auxlist''_def)
     have length_aux'_aux'': "length_muaux args aux' = length zs + length_muaux args aux''"
       using eval_until_length[OF eq2'] unfolding length_aux' length_aux'' .
     have "i \<le> progress \<sigma> P' (Formula.Until \<phi>''' I \<psi>'') (Suc j) \<Longrightarrow>
       wf_until_auxlist \<sigma> V n R pos \<phi>'' I \<psi>'' auxlist' i \<Longrightarrow>
       i + length auxlist' = min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)) \<Longrightarrow>
       wf_until_auxlist \<sigma> V n R pos \<phi>'' I \<psi>'' auxlist'' (progress \<sigma> P' (Formula.Until \<phi>''' I \<psi>'') (Suc j)) \<and>
         i + length zs = progress \<sigma> P' (Formula.Until \<phi>''' I \<psi>'') (Suc j) \<and>
         i + length zs + length auxlist'' = min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)) \<and>
         list_all2 (\<lambda>i. qtable n (Formula.fv \<psi>'') (mem_restr R)
           (\<lambda>v. Formula.sat \<sigma> V (map the v) i (Formula.Until (if pos then \<phi>'' else Formula.Neg \<phi>'') I \<psi>'')))
           [i..<i + length zs] zs" for i
       using eq2'
     proof (induction auxlist' arbitrary: zs auxlist'' i)
       case Nil
       then show ?case
         by (auto dest!: antisym[OF progress_Until_le])
     next
       case (Cons a aux')
       obtain t a1 a2 where "a = (t, a1, a2)" by (cases a)
       from Cons.prems(2) have aux': "wf_until_auxlist \<sigma> V n R pos \<phi>'' I \<psi>'' aux' (Suc i)"
         by (rule wf_until_aux_Cons)
       from Cons.prems(2) have 1: "t = \<tau> \<sigma> i"
         unfolding \<open>a = (t, a1, a2)\<close> by (rule wf_until_aux_Cons1)
       from Cons.prems(2) have 3: "qtable n (Formula.fv \<psi>'') (mem_restr R) (\<lambda>v.
         (\<exists>j\<ge>i. j < Suc (i + length aux') \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> Formula.sat \<sigma> V (map the v) j \<psi>'' \<and>
         (\<forall>k\<in>{i..<j}. if pos then Formula.sat \<sigma> V (map the v) k \<phi>'' else \<not> Formula.sat \<sigma> V (map the v) k \<phi>''))) a2"
         unfolding \<open>a = (t, a1, a2)\<close> by (rule wf_until_aux_Cons3)
       from Cons.prems(3) have Suc_i_aux': "Suc i + length aux' =
           min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j))"
         by simp
       have "i \<ge> progress \<sigma> P' (Formula.Until \<phi>''' I \<psi>'') (Suc j)"
         if "enat (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt) \<le> enat t + right I"
         using that nts' unfolding wf_ts_def progress.simps
         by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv \<phi>'''
             intro!: cInf_lower \<tau>_mono elim!: order.trans[rotated] simp del: upt_Suc split: if_splits list.splits)
       moreover
       have "Suc i \<le> progress \<sigma> P' (Formula.Until \<phi>''' I \<psi>'') (Suc j)"
         if "enat t + right I < enat (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)"
       proof -
         from that obtain m where m: "right I = enat m" by (cases "right I") auto
         have \<tau>_min:  "\<tau> \<sigma> (min j k) = min (\<tau> \<sigma> j) (\<tau> \<sigma> k)" for k
           by (simp add: min_of_mono monoI)
         have le_progress_iff[simp]: "(Suc j) \<le> progress \<sigma> P' \<phi> (Suc j) \<longleftrightarrow> progress \<sigma> P' \<phi> (Suc j) = (Suc j)" for \<phi>
           using wf_envs_progress_le[OF MUntil.prems(2), of \<phi>] by auto
         have min_Suc[simp]: "min j (Suc j) = j" by auto
         let ?X = "{i. \<forall>k. k < Suc j \<and> k \<le>min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)) \<longrightarrow> enat (\<tau> \<sigma> k) \<le> enat (\<tau> \<sigma> i) + right I}"
         let ?min = "min j (min (progress \<sigma> P' \<phi>'' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)))"
         have "\<tau> \<sigma> ?min \<le> \<tau> \<sigma> j"
           by (rule \<tau>_mono) auto
         from m have "?X \<noteq> {}"
           by (auto dest!: \<tau>_mono[of _ "progress \<sigma> P' \<phi>'' (Suc j)" \<sigma>]
               simp: not_le not_less \<phi>''' intro!: exI[of _ "progress \<sigma> P' \<phi>'' (Suc j)"])
         from m show ?thesis
           using that nts' unfolding wf_ts_def progress.simps
           by (intro cInf_greatest[OF \<open>?X \<noteq> {}\<close>])
             (auto simp: 1 \<phi>''' not_le not_less list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq
               simp del: upt_Suc split: list.splits if_splits
               dest!: spec[of _ "?min"] less_le_trans[of "\<tau> \<sigma> i + m" "\<tau> \<sigma> _" "\<tau> \<sigma> _ + m"] less_\<tau>D)
       qed
       moreover have *: "k < progress \<sigma> P' \<psi> (Suc j)" if
         "enat (\<tau> \<sigma> i) + right I < enat (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)"
         "enat (\<tau> \<sigma> k - \<tau> \<sigma> i) \<le> right I" "\<psi> = \<psi>'' \<or> \<psi> = \<phi>''" for k \<psi>
       proof -
         from that(1,2) obtain m where "right I = enat m"
           "\<tau> \<sigma> i + m < (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)" "\<tau> \<sigma> k - \<tau> \<sigma> i \<le> m"
           by (cases "right I") auto
         with that(3) nts' progress_le[of \<sigma> \<psi>'' "Suc j"] progress_le[of \<sigma> \<phi>'' "Suc j"]
         show ?thesis
           unfolding wf_ts_def le_diff_conv
           by (auto simp: not_le list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq add.commute
               simp del: upt_Suc split: list.splits if_splits dest!: le_less_trans[of "\<tau> \<sigma> k"] less_\<tau>D)
       qed
       ultimately show ?case using Cons.prems Suc_i_aux'[simplified]
         unfolding \<open>a = (t, a1, a2)\<close>
         by (auto simp: \<phi>''' 1 sat.simps upt_conv_Cons dest!:  Cons.IH[OF _ aux' Suc_i_aux']
             simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])
     qed
     thm this
     note wf_aux'' = this[OF wf_envs_progress_mono[OF MUntil.prems(2) le_SucI[OF order_refl]]
       wf_auxlist' conjunct2[OF update1, unfolded ne_def length_aux']]
     have "progress \<sigma> P (formula.Until \<phi>''' I \<psi>'') j + length auxlist' =
       progress \<sigma> P' (formula.Until \<phi>''' I \<psi>'') (Suc j) + length auxlist''"
       using wf_aux'' valid_aux'' length_aux'_aux''
       by (auto simp add: ne_def length_aux' length_aux'')
     then have "cur =
       (if progress \<sigma> P' (formula.Until \<phi>''' I \<psi>'') (Suc j) + length auxlist'' = 0 then 0
       else \<tau> \<sigma> (progress \<sigma> P' (formula.Until \<phi>''' I \<psi>'') (Suc j) + length auxlist'' - 1))"
       unfolding cur ne_def by auto
     then have "wf_until_aux \<sigma> V R args \<phi>'' \<psi>'' aux'' (progress \<sigma> P' (formula.Until \<phi>''' I \<psi>'') (Suc j)) \<and>
       progress \<sigma> P (formula.Until \<phi>''' I \<psi>'') j + length zs = progress \<sigma> P' (formula.Until \<phi>''' I \<psi>'') (Suc j) \<and>
       progress \<sigma> P (formula.Until \<phi>''' I \<psi>'') j + length zs + length_muaux args aux'' = min (progress \<sigma> P' \<phi>''' (Suc j)) (progress \<sigma> P' \<psi>'' (Suc j)) \<and>
       list_all2 (\<lambda>i. qtable n (fv \<psi>'') (mem_restr R) (\<lambda>v. Formula.sat \<sigma> V (map the v) i (formula.Until (if pos then \<phi>'' else formula.Neg \<phi>'') I \<psi>'')))
       [progress \<sigma> P (formula.Until \<phi>''' I \<psi>'') j..<progress \<sigma> P (formula.Until \<phi>''' I \<psi>'') j + length zs] zs"
       using wf_aux'' valid_aux'' fvi_subset
       unfolding wf_until_aux_def length_aux'' args_ivl args_n args_pos by (auto simp only: length_aux'')
   }
   note update = this
   from MUntil.IH(1)[OF \<phi> MUntil.prems(2)] MUntil.IH(2)[OF \<psi> MUntil.prems(2)] pos pos_eq fvi_subset show ?case
     by (auto 0 4 simp: args_ivl args_n args_pos Until_eq \<phi>''' progress.simps(6) split: prod.split if_splits
         dest!: update[OF refl refl, rotated]
         intro!: wf_mformula.Until[OF _ _ _ _ args_ivl args_n args_L args_R fvi_subset]
         elim!: list.rel_mono_strong qtable_cong
         elim: mbuf2t_take_add'(1)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc]
               mbuf2t_take_add'(2)[OF _ wf_envs_P_simps[OF MUntil.prems(2)] buf nts_snoc])
 next
   case (MMatchP I mr mrs \<phi>s buf nts aux)
   note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del]
   from MMatchP.prems obtain r \<psi>s where eq: "\<phi>' = Formula.MatchP I r"
     and safe: "safe_regex Past Strict r"
     and mr: "to_mregex r = (mr, \<psi>s)"
     and mrs: "mrs = sorted_list_of_set (RPDs mr)"
     and \<psi>s: "list_all2 (wf_mformula \<sigma> j P V n R) \<phi>s \<psi>s"
     and buf: "wf_mbufn' \<sigma> P V j n R r buf"
     and nts: "wf_ts_regex \<sigma> P j r nts"
     and aux: "wf_matchP_aux \<sigma> V n R I r aux (progress \<sigma> P (Formula.MatchP I r) j)"
     by (cases rule: wf_mformula.cases) (auto)
   have nts_snoc: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i) [progress_regex \<sigma> P r j..<Suc j] (nts @ [\<tau> \<sigma> j])"
     using nts unfolding wf_ts_regex_def
     by (auto simp add: wf_envs_progress_regex_le[OF MMatchP.prems(2)] intro: list_all2_appendI)
   have update: "wf_matchP_aux \<sigma> V n R I r (snd (zs, aux')) (progress \<sigma> P' (Formula.MatchP I r) (Suc j)) \<and>
     list_all2 (\<lambda>i. qtable n (Formula.fv_regex r) (mem_restr R)
       (\<lambda>v. Formula.sat \<sigma> V (map the v) i (Formula.MatchP I r)))
       [progress \<sigma> P (Formula.MatchP I r) j..<progress \<sigma> P' (Formula.MatchP I r) (Suc j)] (fst (zs, aux'))"
     if eval: "map (fst o meval n (\<tau> \<sigma> j) db) \<phi>s = xss"
       and eq: "mbufnt_take (\<lambda>rels t (zs, aux).
         case update_matchP n I mr mrs rels t aux of (z, x) \<Rightarrow> (zs @ [z], x))
         ([], aux) (mbufn_add xss buf) (nts @ [\<tau> \<sigma> j]) = ((zs, aux'), buf', nts')"
     for xss zs aux' buf' nts'
     unfolding progress_simps
   proof (rule mbufnt_take_add_induct'[where j'="Suc j" and z'="(zs, aux')", OF eq wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc],
       goal_cases xss _ base step)
     case xss
     then show ?case
       using eval \<psi>s
       by (auto simp: list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map
           list.rel_flip[symmetric, of _ \<psi>s \<phi>s] dest!: MMatchP.IH(1)[OF _ _ MMatchP.prems(2)]
           elim!: list.rel_mono_strong split: prod.splits)
   next
     case base
     then show ?case
       using aux by auto
   next
     case (step k Xs z)
     then show ?case
       by (auto simp: Un_absorb1 mrs safe mr elim!: update_matchP(1) list_all2_appendI
           dest!: update_matchP(2) split: prod.split)
   qed simp
   then show ?case using \<psi>s
     by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \<psi>s \<phi>s]
         list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros
         elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]
         mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchP.prems(2)] safe mr buf nts_snoc]
         dest!: MMatchP.IH[OF _ _ MMatchP.prems(2)] split: prod.splits)
 next
   case (MMatchF I mr mrs \<phi>s buf nts aux)
   note sat.simps[simp del] mbufnt_take.simps[simp del] mbufn_add.simps[simp del] progress_simps[simp del]
   from MMatchF.prems obtain r \<psi>s where eq: "\<phi>' = Formula.MatchF I r"
     and safe: "safe_regex Futu Strict r"
     and mr: "to_mregex r = (mr, \<psi>s)"
     and mrs: "mrs = sorted_list_of_set (LPDs mr)"
     and \<psi>s: "list_all2 (wf_mformula \<sigma> j P V n R) \<phi>s \<psi>s"
     and buf: "wf_mbufn' \<sigma> P V j n R r buf"
     and nts: "wf_ts_regex \<sigma> P j r nts"
     and aux: "wf_matchF_aux \<sigma> V n R I r aux (progress \<sigma> P (Formula.MatchF I r) j) 0"
     and length_aux: "progress \<sigma> P (Formula.MatchF I r) j + length aux = progress_regex \<sigma> P r j"
     by (cases rule: wf_mformula.cases) (auto)
   have nts_snoc: "list_all2 (\<lambda>i t. t = \<tau> \<sigma> i)
     [progress_regex \<sigma> P r j..<Suc j] (nts @ [\<tau> \<sigma> j])"
     using nts unfolding wf_ts_regex_def
     by (auto simp add: wf_envs_progress_regex_le[OF MMatchF.prems(2)] intro: list_all2_appendI)
   {
     fix xss zs aux' aux'' buf' nts'
     assume eval: "map (fst o meval n (\<tau> \<sigma> j) db) \<phi>s = xss"
       and eq1: "mbufnt_take (update_matchF n I mr mrs) aux (mbufn_add xss buf) (nts @ [\<tau> \<sigma> j]) =
         (aux', buf', nts')"
       and eq2: "eval_matchF I mr (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # _ \<Rightarrow> nt) aux' = (zs, aux'')"
     have update1: "wf_matchF_aux \<sigma> V n R I r aux' (progress \<sigma> P (Formula.MatchF I r) j) 0 \<and>
       progress \<sigma> P (Formula.MatchF I r) j + length aux' = progress_regex \<sigma> P' r (Suc j)"
       using eval nts_snoc nts_snoc length_aux aux \<psi>s
       by (elim mbufnt_take_add_induct'[where j'="Suc j", OF eq1 wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf])
         (auto simp: length_update_matchF
           list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \<psi>s \<phi>s]
           dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)]
           elim: wf_update_matchF[OF _ safe mr mrs] elim!: list.rel_mono_strong)
     from MMatchF.prems(2) have nts': "wf_ts_regex \<sigma> P' (Suc j) r nts'"
       using eval eval nts_snoc \<psi>s
       unfolding wf_ts_regex_def
       by (intro mbufnt_take_eqD(2)[OF eq1 wf_mbufn_add[where js'="map (\<lambda>\<phi>. progress \<sigma> P' \<phi> (Suc j)) \<psi>s",
               OF buf[unfolded wf_mbufn'_def mr prod.case]]])
         (auto simp: to_mregex_progress[OF safe mr] Mini_def
           list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map list.rel_flip[symmetric, of _ \<psi>s \<phi>s]
           list_all2_Cons1 elim!: list.rel_mono_strong intro!: list.rel_refl_strong
           dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)])
     have "i \<le> progress \<sigma> P' (Formula.MatchF I r) (Suc j) \<Longrightarrow>
       wf_matchF_aux \<sigma> V n R I r aux' i 0 \<Longrightarrow>
       i + length aux' = progress_regex \<sigma> P' r (Suc j) \<Longrightarrow>
       wf_matchF_aux \<sigma> V n R I r aux'' (progress \<sigma> P' (Formula.MatchF I r) (Suc j)) 0 \<and>
         i + length zs = progress \<sigma> P' (Formula.MatchF I r) (Suc j) \<and>
         i + length zs + length aux'' = progress_regex \<sigma> P' r (Suc j) \<and>
         list_all2 (\<lambda>i. qtable n (Formula.fv_regex r) (mem_restr R)
           (\<lambda>v. Formula.sat \<sigma> V (map the v) i (Formula.MatchF I r)))
           [i..<i + length zs] zs" for i
       using eq2
     proof (induction aux' arbitrary: zs aux'' i)
       case Nil
       then show ?case by (auto dest!: antisym[OF progress_MatchF_le])
     next
       case (Cons a aux')
       obtain t rels rel where "a = (t, rels, rel)" by (cases a)
       from Cons.prems(2) have aux': "wf_matchF_aux \<sigma> V n R I r aux' (Suc i) 0"
         by (rule wf_matchF_aux_Cons)
       from Cons.prems(2) have 1: "t = \<tau> \<sigma> i"
         unfolding \<open>a = (t, rels, rel)\<close> by (rule wf_matchF_aux_Cons1)
       from Cons.prems(2) have 3: "qtable n (Formula.fv_regex r) (mem_restr R) (\<lambda>v.
         (\<exists>j\<ge>i. j < Suc (i + length aux') \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> Regex.match (Formula.sat \<sigma> V (map the v)) r i j)) rel"
         unfolding \<open>a = (t, rels, rel)\<close> using wf_matchF_aux_Cons3 by force
       from Cons.prems(3) have Suc_i_aux': "Suc i + length aux' = progress_regex \<sigma> P' r (Suc j)"
         by simp
       have "i \<ge> progress \<sigma> P' (Formula.MatchF I r) (Suc j)"
         if "enat (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt) \<le> enat t + right I"
         using that nts' unfolding wf_ts_regex_def progress_simps
         by (auto simp add: 1 list_all2_Cons2 upt_eq_Cons_conv
             intro!: cInf_lower \<tau>_mono elim!: order.trans[rotated] simp del: upt_Suc split: if_splits list.splits)
       moreover
       have "Suc i \<le> progress \<sigma> P' (Formula.MatchF I r) (Suc j)"
         if "enat t + right I < enat (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)"
       proof -
         from that obtain m where m: "right I = enat m" by (cases "right I") auto
         have \<tau>_min:  "\<tau> \<sigma> (min j k) = min (\<tau> \<sigma> j) (\<tau> \<sigma> k)" for k
           by (simp add: min_of_mono monoI)
         have le_progress_iff[simp]: "Suc j \<le> progress \<sigma> P' \<phi> (Suc j) \<longleftrightarrow> progress \<sigma> P' \<phi> (Suc j) = (Suc j)" for \<phi>
           using wf_envs_progress_le[OF MMatchF.prems(2), of \<phi>] by auto
         have min_Suc[simp]: "min j (Suc j) = j" by auto
         let ?X = "{i. \<forall>k. k < Suc j \<and> k \<le> progress_regex \<sigma> P' r (Suc j) \<longrightarrow> enat (\<tau> \<sigma> k) \<le> enat (\<tau> \<sigma> i) + right I}"
         let ?min = "min j (progress_regex \<sigma> P' r (Suc j))"
         have "\<tau> \<sigma> ?min \<le> \<tau> \<sigma> j"
           by (rule \<tau>_mono) auto
         from m have "?X \<noteq> {}"
           by (auto dest!: less_\<tau>D add_lessD1 simp: not_le not_less)
         from m show ?thesis
           using that nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]
           unfolding wf_ts_regex_def progress_simps
           by (intro cInf_greatest[OF \<open>?X \<noteq> {}\<close>])
             (auto simp: 1 not_le not_less list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq
               simp del: upt_Suc split: list.splits if_splits
               dest!: spec[of _ "?min"] less_le_trans[of "\<tau> \<sigma> i + m" "\<tau> \<sigma> _" "\<tau> \<sigma> _ + m"] less_\<tau>D)
       qed
       moreover have *: "k < progress_regex \<sigma> P' r (Suc j)" if
         "enat (\<tau> \<sigma> i) + right I < enat (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)"
         "enat (\<tau> \<sigma> k - \<tau> \<sigma> i) \<le> right I" for k
       proof -
         from that(1,2) obtain m where "right I = enat m"
           "\<tau> \<sigma> i + m < (case nts' of [] \<Rightarrow> \<tau> \<sigma> j | nt # x \<Rightarrow> nt)" "\<tau> \<sigma> k - \<tau> \<sigma> i \<le> m"
           by (cases "right I") auto
         with nts' wf_envs_progress_regex_le[OF MMatchF.prems(2), of r]
         show ?thesis
           unfolding wf_ts_regex_def le_diff_conv
           by (auto simp: not_le list_all2_Cons2 upt_eq_Cons_conv less_Suc_eq add.commute
               simp del: upt_Suc split: list.splits if_splits dest!: le_less_trans[of "\<tau> \<sigma> k"] less_\<tau>D)
       qed
       ultimately show ?case using Cons.prems Suc_i_aux'[simplified]
         unfolding \<open>a = (t, rels, rel)\<close>
         by (auto simp: 1 sat.simps upt_conv_Cons dest!:  Cons.IH[OF _ aux' Suc_i_aux']
             simp del: upt_Suc split: if_splits prod.splits intro!: iff_exI qtable_cong[OF 3 refl])
 
     qed
     note this[OF progress_mono_gen[OF le_SucI, OF order.refl] conjunct1[OF update1] conjunct2[OF update1]]
   }
   note update = this[OF refl, rotated]
   with MMatchF.prems(2) show ?case using \<psi>s
     by (auto simp: eq mr mrs safe map_split_alt list.rel_flip[symmetric, of _ \<psi>s \<phi>s]
         list_all3_map map2_map_map list_all3_list_all2_conv list.rel_map intro!: wf_mformula.intros
         elim!: list.rel_mono_strong mbufnt_take_add'(1)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]
         mbufnt_take_add'(2)[OF _ wf_envs_P_simps[OF MMatchF.prems(2)] safe mr buf nts_snoc]
         dest!: MMatchF.IH[OF _ _ MMatchF.prems(2)] update split: prod.splits)
 qed
 
 
 subsubsection \<open>Monitor step\<close>
 
 lemma (in maux) wf_mstate_mstep: "wf_mstate \<phi> \<pi> R st \<Longrightarrow> last_ts \<pi> \<le> snd tdb \<Longrightarrow>
   wf_mstate \<phi> (psnoc \<pi> tdb) R (snd (mstep (map_prod mk_db id tdb) st))"
   unfolding wf_mstate_def mstep_def Let_def
   by (fastforce simp add: progress_mono le_imp_diff_is_add split: prod.splits
       elim!: prefix_of_psnocE dest: meval[OF _ wf_envs_mk_db] list_all2_lengthD)
 
 definition "flatten_verdicts Vs = (\<Union> (set (map (\<lambda>(i, X). (\<lambda>v. (i, v)) ` X) Vs)))"
 
 lemma flatten_verdicts_append[simp]:
   "flatten_verdicts (Vs @ Us) = flatten_verdicts Vs \<union> flatten_verdicts Us"
   by (induct Vs) (auto simp: flatten_verdicts_def)
 
 lemma (in maux) mstep_output_iff:
   assumes "wf_mstate \<phi> \<pi> R st" "last_ts \<pi> \<le> snd tdb" "prefix_of (psnoc \<pi> tdb) \<sigma>" "mem_restr R v"
   shows "(i, v) \<in> flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \<longleftrightarrow>
     progress \<sigma> Map.empty \<phi> (plen \<pi>) \<le> i \<and> i < progress \<sigma> Map.empty \<phi> (Suc (plen \<pi>)) \<and>
     wf_tuple (Formula.nfv \<phi>) (Formula.fv \<phi>) v \<and> Formula.sat \<sigma> Map.empty (map the v) i \<phi>"
 proof -
   from prefix_of_psnocE[OF assms(3,2)] have "prefix_of \<pi> \<sigma>"
     "\<Gamma> \<sigma> (plen \<pi>) = fst tdb" "\<tau> \<sigma> (plen \<pi>) = snd tdb" by auto
   moreover from assms(1) \<open>prefix_of \<pi> \<sigma>\<close> have "mstate_n st = Formula.nfv \<phi>"
     "mstate_i st = progress \<sigma> Map.empty \<phi> (plen \<pi>)" "wf_mformula \<sigma> (plen \<pi>) Map.empty Map.empty (mstate_n st) R (mstate_m st) \<phi>"
     unfolding wf_mstate_def by blast+
   moreover from meval[OF \<open>wf_mformula \<sigma> (plen \<pi>) Map.empty Map.empty (mstate_n st) R (mstate_m st) \<phi>\<close> wf_envs_mk_db] obtain Vs st' where
     "meval (mstate_n st) (\<tau> \<sigma> (plen \<pi>)) (mk_db (\<Gamma> \<sigma> (plen \<pi>))) (mstate_m st) = (Vs, st')"
     "wf_mformula \<sigma> (Suc (plen \<pi>))  Map.empty Map.empty (mstate_n st) R st' \<phi>"
     "list_all2 (\<lambda>i. qtable (mstate_n st) (fv \<phi>) (mem_restr R) (\<lambda>v. Formula.sat \<sigma> Map.empty (map the v) i \<phi>))
       [progress \<sigma> Map.empty \<phi> (plen \<pi>)..<progress \<sigma> Map.empty \<phi> (Suc (plen \<pi>))] Vs" by blast
   moreover from this assms(4) have "qtable (mstate_n st) (fv \<phi>) (mem_restr R)
     (\<lambda>v. Formula.sat \<sigma> Map.empty (map the v) i \<phi>) (Vs ! (i - progress \<sigma> Map.empty \<phi> (plen \<pi>)))"
     if "progress \<sigma> Map.empty \<phi> (plen \<pi>) \<le> i" "i < progress \<sigma> Map.empty \<phi> (Suc (plen \<pi>))"
     using that by (auto simp: list_all2_conv_all_nth
         dest!: spec[of _ "(i - progress \<sigma> Map.empty \<phi> (plen \<pi>))"])
   ultimately show ?thesis
     using assms(4) unfolding mstep_def Let_def flatten_verdicts_def
     by (auto simp: in_set_enumerate_eq list_all2_conv_all_nth progress_mono le_imp_diff_is_add
         elim!: in_qtableE in_qtableI intro!: bexI[of _ "(i, Vs ! (i - progress \<sigma> Map.empty \<phi> (plen \<pi>)))"])
 qed
 
 
 subsubsection \<open>Monitor function\<close>
 
-context maux
-begin
-
-definition minit_safe where
-  "minit_safe \<phi> = (if mmonitorable_exec \<phi> then minit \<phi> else undefined)"
-
-lemma minit_safe_minit: "mmonitorable \<phi> \<Longrightarrow> minit_safe \<phi> = minit \<phi>"
-  unfolding minit_safe_def monitorable_formula_code by simp
-
-lemma mstep_mverdicts:
+locale verimon = verimon_spec + maux
+
+lemma (in verimon) mstep_mverdicts:
   assumes wf: "wf_mstate \<phi> \<pi> R st"
     and le[simp]: "last_ts \<pi> \<le> snd tdb"
     and restrict: "mem_restr R v"
   shows "(i, v) \<in> flatten_verdicts (fst (mstep (map_prod mk_db id tdb) st)) \<longleftrightarrow>
-    (i, v) \<in> mverdicts \<phi> (psnoc \<pi> tdb) - mverdicts \<phi> \<pi>"
+    (i, v) \<in> M (psnoc \<pi> tdb) - M \<pi>"
 proof -
   obtain \<sigma> where p2: "prefix_of (psnoc \<pi> tdb) \<sigma>"
     using ex_prefix_of by blast
   with le have p1: "prefix_of \<pi> \<sigma>" by (blast elim!: prefix_of_psnocE)
   show ?thesis
-    unfolding verimon.verdicts_def
+    unfolding M_def
     by (auto 0 3 simp: p2 progress_prefix_conv[OF _ p1] sat_prefix_conv[OF _ p1] not_less
-        dest:  mstep_output_iff[OF wf le p2 restrict, THEN iffD1] spec[of _ \<sigma>]
-        mstep_output_iff[OF wf le _ restrict, THEN iffD1] verimon.progress_sat_cong[OF p1]
+        pprogress_eq[OF p1] pprogress_eq[OF p2]
+        dest: mstep_output_iff[OF wf le p2 restrict, THEN iffD1] spec[of _ \<sigma>]
+        mstep_output_iff[OF wf le _ restrict, THEN iffD1] progress_sat_cong[OF p1]
         intro: mstep_output_iff[OF wf le p2 restrict, THEN iffD2] p1)
 qed
 
+context maux
+begin
+
 primrec msteps0 where
   "msteps0 [] st = ([], st)"
 | "msteps0 (tdb # \<pi>) st =
     (let (V', st') = mstep (map_prod mk_db id tdb) st; (V'', st'') = msteps0 \<pi> st' in (V' @ V'', st''))"
 
 primrec msteps0_stateless where
   "msteps0_stateless [] st = []"
 | "msteps0_stateless (tdb # \<pi>) st = (let (V', st') = mstep (map_prod mk_db id tdb) st in V' @ msteps0_stateless \<pi> st')"
 
 lemma msteps0_msteps0_stateless: "fst (msteps0 w st) = msteps0_stateless w st"
   by (induct w arbitrary: st) (auto simp: split_beta)
 
 lift_definition msteps :: "Formula.prefix \<Rightarrow> ('msaux, 'muaux) mstate \<Rightarrow> (nat \<times> event_data table) list \<times> ('msaux, 'muaux) mstate"
   is msteps0 .
 
 lift_definition msteps_stateless :: "Formula.prefix \<Rightarrow> ('msaux, 'muaux) mstate \<Rightarrow> (nat \<times> event_data table) list"
   is msteps0_stateless .
 
 lemma msteps_msteps_stateless: "fst (msteps w st) = msteps_stateless w st"
   by transfer (rule msteps0_msteps0_stateless)
 
 lemma msteps0_snoc: "msteps0 (\<pi> @ [tdb]) st =
    (let (V', st') = msteps0 \<pi> st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))"
   by (induct \<pi> arbitrary: st) (auto split: prod.splits)
 
 lemma msteps_psnoc: "last_ts \<pi> \<le> snd tdb \<Longrightarrow> msteps (psnoc \<pi> tdb) st =
    (let (V', st') = msteps \<pi> st; (V'', st'') = mstep (map_prod mk_db id tdb) st' in (V' @ V'', st''))"
   by transfer' (auto simp: msteps0_snoc split: list.splits prod.splits if_splits)
 
 definition monitor where
   "monitor \<phi> \<pi> = msteps_stateless \<pi> (minit_safe \<phi>)"
 
+end
+
 lemma Suc_length_conv_snoc: "(Suc n = length xs) = (\<exists>y ys. xs = ys @ [y] \<and> length ys = n)"
   by (cases xs rule: rev_cases) auto
 
-lemma wf_mstate_msteps: "wf_mstate \<phi> \<pi> R st \<Longrightarrow> mem_restr R v \<Longrightarrow> \<pi> \<le> \<pi>' \<Longrightarrow>
+lemma (in verimon) wf_mstate_msteps: "wf_mstate \<phi> \<pi> R st \<Longrightarrow> mem_restr R v \<Longrightarrow> \<pi> \<le> \<pi>' \<Longrightarrow>
   X = msteps (pdrop (plen \<pi>) \<pi>') st \<Longrightarrow> wf_mstate \<phi> \<pi>' R (snd X) \<and>
-  ((i, v) \<in> flatten_verdicts (fst X)) = ((i, v) \<in> mverdicts \<phi> \<pi>' - mverdicts \<phi> \<pi>)"
+  ((i, v) \<in> flatten_verdicts (fst X)) = ((i, v) \<in> M \<pi>' - M \<pi>)"
 proof (induct "plen \<pi>' - plen \<pi>" arbitrary: X st \<pi> \<pi>')
   case 0
   from 0(1,4,5) have "\<pi> = \<pi>'"  "X = ([], st)"
     by (transfer; auto)+
   with 0(2) show ?case unfolding flatten_verdicts_def by simp
 next
   case (Suc x)
   from Suc(2,5) obtain \<pi>'' tdb where "x = plen \<pi>'' - plen \<pi>"  "\<pi> \<le> \<pi>''"
     "\<pi>' = psnoc \<pi>'' tdb" "pdrop (plen \<pi>) (psnoc \<pi>'' tdb) = psnoc (pdrop (plen \<pi>) \<pi>'') tdb"
     "last_ts (pdrop (plen \<pi>) \<pi>'') \<le> snd tdb" "last_ts \<pi>'' \<le> snd tdb"
     "\<pi>'' \<le> psnoc \<pi>'' tdb"
   proof (atomize_elim, transfer, elim exE, goal_cases prefix)
     case (prefix _ _ \<pi>' _ \<pi>_tdb)
     then show ?case
     proof (cases \<pi>_tdb rule: rev_cases)
       case (snoc \<pi> tdb)
       with prefix show ?thesis
         by (intro bexI[of _ "\<pi>' @ \<pi>"] exI[of _ tdb])
           (force simp: sorted_append append_eq_Cons_conv split: list.splits if_splits)+
     qed simp
   qed
   with Suc(1)[OF this(1) Suc.prems(1,2) this(2) refl] Suc.prems show ?case
     unfolding msteps_msteps_stateless[symmetric]
     by (auto simp: msteps_psnoc split_beta mstep_mverdicts
-        dest: verimon.verdicts_mono[THEN set_mp, rotated] intro!: wf_mstate_mstep)
+        dest: mono_monitor[THEN set_mp, rotated] intro!: wf_mstate_mstep)
 qed
 
-lemma wf_mstate_msteps_stateless:
+lemma (in verimon) wf_mstate_msteps_stateless:
   assumes "wf_mstate \<phi> \<pi> R st" "mem_restr R v" "\<pi> \<le> \<pi>'"
-  shows "(i, v) \<in> flatten_verdicts (msteps_stateless (pdrop (plen \<pi>) \<pi>') st) \<longleftrightarrow> (i, v) \<in> mverdicts \<phi> \<pi>' - mverdicts \<phi> \<pi>"
+  shows "(i, v) \<in> flatten_verdicts (msteps_stateless (pdrop (plen \<pi>) \<pi>') st) \<longleftrightarrow> (i, v) \<in> M \<pi>' - M \<pi>"
   using wf_mstate_msteps[OF assms refl] unfolding msteps_msteps_stateless by simp
 
-lemma wf_mstate_msteps_stateless_UNIV: "wf_mstate \<phi> \<pi> UNIV st \<Longrightarrow> \<pi> \<le> \<pi>' \<Longrightarrow>
-  flatten_verdicts (msteps_stateless (pdrop (plen \<pi>) \<pi>') st) = mverdicts \<phi> \<pi>' - mverdicts \<phi> \<pi>"
+lemma (in verimon) wf_mstate_msteps_stateless_UNIV: "wf_mstate \<phi> \<pi> UNIV st \<Longrightarrow> \<pi> \<le> \<pi>' \<Longrightarrow>
+  flatten_verdicts (msteps_stateless (pdrop (plen \<pi>) \<pi>') st) = M \<pi>' - M \<pi>"
   by (auto dest: wf_mstate_msteps_stateless[OF _ mem_restr_UNIV])
 
-lemma mverdicts_Nil: "mverdicts \<phi> pnil = {}"
-  unfolding verimon.verdicts_def
-  by (auto intro: ex_prefix_of)
+lemma (in verimon) mverdicts_Nil: "M pnil = {}"
+  by (simp add: M_def pprogress_eq)
+
+context maux
+begin
+
+lemma minit_safe_minit: "mmonitorable \<phi> \<Longrightarrow> minit_safe \<phi> = minit \<phi>"
+  unfolding minit_safe_def monitorable_formula_code by simp
 
 lemma wf_mstate_minit_safe: "mmonitorable \<phi> \<Longrightarrow> wf_mstate \<phi> pnil R (minit_safe \<phi>)"
   using wf_mstate_minit minit_safe_minit mmonitorable_def by metis
 
-lemma monitor_mverdicts: "mmonitorable \<phi> \<Longrightarrow> flatten_verdicts (monitor \<phi> \<pi>) = mverdicts \<phi> \<pi>"
-  unfolding monitor_def
+end
+
+lemma (in verimon) monitor_mverdicts: "flatten_verdicts (monitor \<phi> \<pi>) = M \<pi>"
+  unfolding monitor_def using monitorable
   by (subst wf_mstate_msteps_stateless_UNIV[OF wf_mstate_minit_safe, simplified])
     (auto simp: mmonitorable_def mverdicts_Nil)
 
 subsection \<open>Collected correctness results\<close>
 
+context verimon
+begin
+
 text \<open>We summarize the main results proved above.
 \begin{enumerate}
-\item The term @{term mverdicts} describes semantically the monitor's expected behaviour:
+\item The term @{term M} describes semantically the monitor's expected behaviour:
 \begin{itemize}
-\item @{thm[source] verimon.mono_monitor}: @{thm verimon.mono_monitor[no_vars]}
-\item @{thm[source] verimon.sound_monitor}: @{thm verimon.sound_monitor[no_vars]}
-\item @{thm[source] verimon.complete_monitor}: @{thm verimon.complete_monitor[no_vars]}
-\item @{thm[source] verimon.monitor_slice}: @{thm verimon.monitor_slice[no_vars]}
+\item @{thm[source] mono_monitor}: @{thm mono_monitor[no_vars]}
+\item @{thm[source] sound_monitor}: @{thm sound_monitor[no_vars]}
+\item @{thm[source] complete_monitor}: @{thm complete_monitor[no_vars]}
+\item @{thm[source] sliceable_M}: @{thm sliceable_M[no_vars]}
 \end{itemize}
 \item The executable monitor's online interface @{term minit_safe} and @{term mstep}
   preserves the invariant @{term wf_mstate} and produces the the verdicts according
-  to @{term mverdicts}:
+  to @{term M}:
 \begin{itemize}
 \item @{thm[source] wf_mstate_minit_safe}: @{thm wf_mstate_minit_safe[no_vars]}
 \item @{thm[source] wf_mstate_mstep}: @{thm wf_mstate_mstep[no_vars]}
 \item @{thm[source] mstep_mverdicts}: @{thm mstep_mverdicts[no_vars]}
 \end{itemize}
-\item The executable monitor's offline interface @{term monitor} implements @{term mverdicts}:
+\item The executable monitor's offline interface @{term monitor} implements @{term M}:
 \begin{itemize}
 \item @{thm[source] monitor_mverdicts}: @{thm monitor_mverdicts[no_vars]}
 \end{itemize}
 \end{enumerate}
 \<close>
 
-end \<comment> \<open>context @{locale maux}\<close>
+end
 
 (*<*)
 end
 (*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Monitor_Code.thy b/thys/MFODL_Monitor_Optimized/Monitor_Code.thy
--- a/thys/MFODL_Monitor_Optimized/Monitor_Code.thy
+++ b/thys/MFODL_Monitor_Optimized/Monitor_Code.thy
@@ -1,23 +1,22 @@
 (*<*)
 theory Monitor_Code
   imports Monitor_Impl
 begin
 (*>*)
 
-export_code convert_multiway minit_safe mstep mmonitorable_exec
+export_code convert_multiway vminit_safe minit_safe vmstep mstep mmonitorable_exec
    checking OCaml?
 
 export_code
   (*basic types*)
   nat_of_integer integer_of_nat int_of_integer integer_of_int enat
-  String.explode String.implode interval mk_db
-  RBT_set rbt_empty rbt_insert rbt_fold
+  interval mk_db RBT_set rbt_empty rbt_insert rbt_fold
   (*term, formula, and regex constructors*)
   EInt Formula.Var Formula.Agg_Cnt Formula.Pred Regex.Skip Regex.Wild
   (*main functions*)
-  convert_multiway minit_safe mstep mmonitorable_exec
+  convert_multiway vminit_safe minit_safe vmstep mstep mmonitorable_exec
   in OCaml module_name Monitor file_prefix "verified"
 
 (*<*)
 end
 (*>*)
\ No newline at end of file
diff --git a/thys/MFODL_Monitor_Optimized/Monitor_Impl.thy b/thys/MFODL_Monitor_Optimized/Monitor_Impl.thy
--- a/thys/MFODL_Monitor_Optimized/Monitor_Impl.thy
+++ b/thys/MFODL_Monitor_Optimized/Monitor_Impl.thy
@@ -1,438 +1,489 @@
 (*<*)
 theory Monitor_Impl
   imports Monitor
     Optimized_MTL
-    Event_Data
     "HOL-Library.Code_Target_Nat"
     Containers.Containers
 begin
 (*>*)
 
 section \<open>Instantiation of the generic algorithm and code setup\<close>
 
 lemma [code_unfold del, symmetric, code_post del]: "card \<equiv> Cardinality.card'" by simp
 declare [[code drop: card]] Set_Impl.card_code[code]
 
 instantiation enat :: set_impl begin
 definition set_impl_enat :: "(enat, set_impl) phantom" where
   "set_impl_enat = phantom set_RBT"
 
 instance ..
 end
 
 derive ccompare Formula.trm
 derive (eq) ceq Formula.trm
 derive (rbt) set_impl Formula.trm
 derive (eq) ceq Monitor.mregex
 derive ccompare Monitor.mregex
 derive (rbt) set_impl Monitor.mregex
 derive (rbt) mapping_impl Monitor.mregex
 derive (no) cenum Monitor.mregex
 derive (rbt) set_impl event_data
 derive (rbt) mapping_impl event_data
 
 definition add_new_mmuaux' :: "args \<Rightarrow> event_data table \<Rightarrow> event_data table \<Rightarrow> ts \<Rightarrow> event_data mmuaux \<Rightarrow>
   event_data mmuaux" where
   "add_new_mmuaux' = add_new_mmuaux"
 
 interpretation muaux valid_mmuaux init_mmuaux add_new_mmuaux' length_mmuaux eval_mmuaux
   using valid_init_mmuaux valid_add_new_mmuaux valid_length_mmuaux valid_eval_mmuaux
   unfolding add_new_mmuaux'_def
   by unfold_locales assumption+
 
-global_interpretation verimon_maux: maux "\<lambda>_ cur (t, aux) auxlist. t = cur \<and> aux = auxlist" "\<lambda>_. (0, [])"
-  "\<lambda>args nt (t, auxlist). (nt, filter (\<lambda>(t, rel). enat (nt - t) \<le> right (args_ivl args)) auxlist)"
-  "\<lambda>args rel1 (t, auxlist). (t, map (\<lambda>(t, rel). (t, join rel (args_pos args) rel1)) auxlist)"
-  "\<lambda>args rel2 (cur, auxlist). (cur, (case auxlist of
+type_synonym 'a vmsaux = "nat \<times> (nat \<times> 'a table) list"
+
+definition valid_vmsaux :: "args \<Rightarrow> nat \<Rightarrow> event_data vmsaux \<Rightarrow>
+  (nat \<times> event_data table) list \<Rightarrow> bool" where
+  "valid_vmsaux = (\<lambda>_ cur (t, aux) auxlist. t = cur \<and> aux = auxlist)"
+
+definition init_vmsaux :: "args \<Rightarrow> event_data vmsaux" where
+  "init_vmsaux = (\<lambda>_. (0, []))"
+
+definition add_new_ts_vmsaux :: "args \<Rightarrow> nat \<Rightarrow> event_data vmsaux \<Rightarrow> event_data vmsaux" where
+  "add_new_ts_vmsaux = (\<lambda>args nt (t, auxlist). (nt, filter (\<lambda>(t, rel).
+    enat (nt - t) \<le> right (args_ivl args)) auxlist))"
+
+definition join_vmsaux :: "args \<Rightarrow> event_data table \<Rightarrow> event_data vmsaux \<Rightarrow> event_data vmsaux" where
+  "join_vmsaux = (\<lambda>args rel1 (t, auxlist). (t, map (\<lambda>(t, rel).
+    (t, join rel (args_pos args) rel1)) auxlist))"
+
+definition add_new_table_vmsaux :: "args \<Rightarrow> event_data table \<Rightarrow> event_data vmsaux \<Rightarrow>
+  event_data vmsaux" where
+  "add_new_table_vmsaux = (\<lambda>args rel2 (cur, auxlist). (cur, (case auxlist of
     [] => [(cur, rel2)]
-  | ((t, y) # ts) \<Rightarrow> if t = cur then (t, y \<union> rel2) # ts else (cur, rel2) # auxlist))"
-  "\<lambda>args (cur, auxlist). foldr (\<union>) [rel. (t, rel) \<leftarrow> auxlist, left (args_ivl args) \<le> cur - t] {}"
-  "\<lambda>_ cur (t, aux) auxlist. t = cur \<and> aux = auxlist" "\<lambda>_. (0, [])"
-  "\<lambda>args rel1 rel2 nt (t, auxlist). (nt, update_until args rel1 rel2 nt auxlist)"
-  "\<lambda>_ (_, auxlist). length auxlist"
-  "\<lambda>args nt (t, auxlist). (let (res, auxlist') = eval_until (args_ivl args) nt auxlist in (res, (t, auxlist')))"
+  | ((t, y) # ts) \<Rightarrow> if t = cur then (t, y \<union> rel2) # ts else (cur, rel2) # auxlist)))"
+
+definition result_vmsaux :: "args \<Rightarrow> event_data vmsaux \<Rightarrow> event_data table" where
+  "result_vmsaux = (\<lambda>args (cur, auxlist).
+    foldr (\<union>) [rel. (t, rel) \<leftarrow> auxlist, left (args_ivl args) \<le> cur - t] {})"
+
+type_synonym 'a vmuaux = "nat \<times> (nat \<times> 'a table \<times> 'a table) list"
+
+definition valid_vmuaux :: "args \<Rightarrow> nat \<Rightarrow> event_data vmuaux \<Rightarrow>
+  (nat \<times> event_data table \<times> event_data table) list \<Rightarrow> bool" where
+  "valid_vmuaux = (\<lambda>_ cur (t, aux) auxlist. t = cur \<and> aux = auxlist)"
+
+definition init_vmuaux :: "args \<Rightarrow> event_data vmuaux" where
+  "init_vmuaux = (\<lambda>_. (0, []))"
+
+definition add_new_vmuaux ::  "args \<Rightarrow> event_data table \<Rightarrow> event_data table \<Rightarrow> nat \<Rightarrow>
+  event_data vmuaux \<Rightarrow> event_data vmuaux" where
+  "add_new_vmuaux = (\<lambda>args rel1 rel2 nt (t, auxlist). (nt, update_until args rel1 rel2 nt auxlist))"
+
+definition length_vmuaux :: "args \<Rightarrow> event_data vmuaux \<Rightarrow> nat" where
+  "length_vmuaux = (\<lambda>_ (_, auxlist). length auxlist)"
+
+definition eval_vmuaux :: "args \<Rightarrow> nat \<Rightarrow> event_data vmuaux \<Rightarrow>
+  event_data table list \<times> event_data vmuaux" where
+  "eval_vmuaux = (\<lambda>args nt (t, auxlist).
+    (let (res, auxlist') = eval_until (args_ivl args) nt auxlist in (res, (t, auxlist'))))"
+
+global_interpretation verimon_maux: maux valid_vmsaux init_vmsaux add_new_ts_vmsaux join_vmsaux
+  add_new_table_vmsaux result_vmsaux valid_vmuaux init_vmuaux add_new_vmuaux length_vmuaux
+  eval_vmuaux
+  defines vminit0 = "maux.minit0 (init_vmsaux :: _ \<Rightarrow> event_data vmsaux) (init_vmuaux :: _ \<Rightarrow> event_data vmuaux) :: _ \<Rightarrow> Formula.formula \<Rightarrow> _"
+  and vminit = "maux.minit (init_vmsaux :: _ \<Rightarrow> event_data vmsaux) (init_vmuaux :: _ \<Rightarrow> event_data vmuaux) :: Formula.formula \<Rightarrow> _"
+  and vminit_safe = "maux.minit_safe (init_vmsaux :: _ \<Rightarrow> event_data vmsaux) (init_vmuaux :: _ \<Rightarrow> event_data vmuaux) :: Formula.formula \<Rightarrow> _"
+  and vmupdate_since = "maux.update_since add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \<Rightarrow> event_data vmsaux \<Rightarrow> event_data table)"
+  and vmeval = "maux.meval add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \<Rightarrow> event_data vmsaux \<Rightarrow> _) add_new_vmuaux (eval_vmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data vmuaux \<Rightarrow> _)"
+  and vmstep = "maux.mstep add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \<Rightarrow> event_data vmsaux \<Rightarrow> _) add_new_vmuaux (eval_vmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data vmuaux \<Rightarrow> _)"
+  and vmsteps0_stateless = "maux.msteps0_stateless add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \<Rightarrow> event_data vmsaux \<Rightarrow> _) add_new_vmuaux (eval_vmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data vmuaux \<Rightarrow> _)"
+  and vmsteps_stateless = "maux.msteps_stateless add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \<Rightarrow> event_data vmsaux \<Rightarrow> _) add_new_vmuaux (eval_vmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data vmuaux \<Rightarrow> _)"
+  and vmonitor = "maux.monitor init_vmsaux add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \<Rightarrow> event_data vmsaux \<Rightarrow> _) init_vmuaux add_new_vmuaux (eval_vmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data vmuaux \<Rightarrow> _)"
+  unfolding valid_vmsaux_def init_vmsaux_def add_new_ts_vmsaux_def join_vmsaux_def
+    add_new_table_vmsaux_def result_vmsaux_def valid_vmuaux_def init_vmuaux_def add_new_vmuaux_def
+    length_vmuaux_def eval_vmuaux_def
   by unfold_locales auto
 
 global_interpretation default_maux: maux valid_mmsaux "init_mmsaux :: _ \<Rightarrow> event_data mmsaux" add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux result_mmsaux
   valid_mmuaux "init_mmuaux :: _ \<Rightarrow> event_data mmuaux" add_new_mmuaux' length_mmuaux eval_mmuaux
   defines minit0 = "maux.minit0 (init_mmsaux :: _ \<Rightarrow> event_data mmsaux) (init_mmuaux :: _ \<Rightarrow> event_data mmuaux) :: _ \<Rightarrow> Formula.formula \<Rightarrow> _"
   and minit = "maux.minit (init_mmsaux :: _ \<Rightarrow> event_data mmsaux) (init_mmuaux :: _ \<Rightarrow> event_data mmuaux) :: Formula.formula \<Rightarrow> _"
   and minit_safe = "maux.minit_safe (init_mmsaux :: _ \<Rightarrow> event_data mmsaux) (init_mmuaux :: _ \<Rightarrow> event_data mmuaux) :: Formula.formula \<Rightarrow> _"
-  and update_since = "maux.update_since add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> event_data table)"
+  and mupdate_since = "maux.update_since add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> event_data table)"
   and meval = "maux.meval add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> _) add_new_mmuaux' (eval_mmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data mmuaux \<Rightarrow> _)"
   and mstep = "maux.mstep add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> _) add_new_mmuaux' (eval_mmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data mmuaux \<Rightarrow> _)"
   and msteps0_stateless = "maux.msteps0_stateless add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> _) add_new_mmuaux' (eval_mmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data mmuaux \<Rightarrow> _)"
   and msteps_stateless = "maux.msteps_stateless add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> _) add_new_mmuaux' (eval_mmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data mmuaux \<Rightarrow> _)"
   and monitor = "maux.monitor init_mmsaux add_new_ts_mmsaux gc_join_mmsaux add_new_table_mmsaux (result_mmsaux :: _ \<Rightarrow> event_data mmsaux \<Rightarrow> _) init_mmuaux add_new_mmuaux' (eval_mmuaux :: _ \<Rightarrow> _ \<Rightarrow> event_data mmuaux \<Rightarrow> _)"
   by unfold_locales
 
 lemma image_these: "f ` Option.these X = Option.these (map_option f ` X)"
   by (force simp: in_these_eq Bex_def image_iff map_option_case split: option.splits)
 
 thm default_maux.meval.simps(2)
 
 lemma meval_MPred: "meval n t db (MPred e ts) =
   (case Mapping.lookup db e of None \<Rightarrow> [{}] | Some Xs \<Rightarrow> map (\<lambda>X. \<Union>v \<in> X.
   (set_option (map_option (\<lambda>f. Table.tabulate f 0 n) (match ts v)))) Xs, MPred e ts)"
   by (force split: option.splits simp: Option.these_def image_iff)
 
 lemmas meval_code[code] = default_maux.meval.simps(1) meval_MPred default_maux.meval.simps(3-)
 
 definition mk_db :: "(Formula.name \<times> event_data list set) list \<Rightarrow> _" where
   "mk_db t = Monitor.mk_db (\<Union>n \<in> set (map fst t). (\<lambda>v. (n, v)) ` the (map_of t n))"
 
 definition rbt_fold :: "_ \<Rightarrow> event_data tuple set_rbt \<Rightarrow> _ \<Rightarrow> _" where
   "rbt_fold = RBT_Set2.fold"
 
 definition rbt_empty :: "event_data list set_rbt" where
   "rbt_empty = RBT_Set2.empty"
 
 definition rbt_insert :: "_ \<Rightarrow> _ \<Rightarrow> event_data list set_rbt" where
   "rbt_insert = RBT_Set2.insert"
 
 lemma saturate_commute:
   assumes "\<And>s. r \<in> g s" "\<And>s. g (insert r s) = g s" "\<And>s. r \<in> s \<Longrightarrow> h s = g s"
   and terminates: "mono g" "\<And>X. X \<subseteq> C \<Longrightarrow> g X \<subseteq> C" "finite C"
 shows "saturate g {} = saturate h {r}"
 proof (cases "g {} = {r}")
   case True
   with assms have "g {r} = {r}" "h {r} = {r}" by auto
   with True show ?thesis
     by (subst (1 2) saturate_code; subst saturate_code) (simp add: Let_def)
 next
   case False
   then show ?thesis
     unfolding saturate_def while_def
     using while_option_finite_subset_Some[OF terminates] assms(1-3)
     by (subst while_option_commute_invariant[of "\<lambda>S. S = {} \<or> r \<in> S" "\<lambda>S. g S \<noteq> S" g "\<lambda>S. h S \<noteq> S" "insert r" h "{}", symmetric])
       (auto 4 4 dest: while_option_stop[of "\<lambda>S. g S \<noteq> S" g "{}"])
 qed
 
 definition "RPDs_aux = saturate (\<lambda>S. S \<union> \<Union> (RPD ` S))"
 
 lemma RPDs_aux_code[code]:
   "RPDs_aux S = (let S' = S \<union> Set.bind S RPD in if S' \<subseteq> S then S else RPDs_aux S')"
   unfolding RPDs_aux_def bind_UNION
   by (subst saturate_code) auto
 
 declare RPDs_code[code del]
 lemma RPDs_code[code]: "RPDs r = RPDs_aux {r}"
   unfolding RPDs_aux_def RPDs_code
   by (rule saturate_commute[where C="RPDs r"])
      (auto 0 3 simp: mono_def subset_singleton_iff RPDs_refl RPDs_trans finite_RPDs)
 
 definition "LPDs_aux = saturate (\<lambda>S. S \<union> \<Union> (LPD ` S))"
 
 lemma LPDs_aux_code[code]:
   "LPDs_aux S = (let S' = S \<union> Set.bind S LPD in if S' \<subseteq> S then S else LPDs_aux S')"
   unfolding LPDs_aux_def bind_UNION
   by (subst saturate_code) auto
 
 declare LPDs_code[code del]
 lemma LPDs_code[code]: "LPDs r = LPDs_aux {r}"
   unfolding LPDs_aux_def LPDs_code
   by (rule saturate_commute[where C="LPDs r"])
      (auto 0 3 simp: mono_def subset_singleton_iff LPDs_refl LPDs_trans finite_LPDs)
 
 lemma is_empty_table_unfold [code_unfold]:
   "X = empty_table \<longleftrightarrow> Set.is_empty X"
   "empty_table = X \<longleftrightarrow> Set.is_empty X"
   "Cardinality.eq_set X empty_table \<longleftrightarrow> Set.is_empty X"
   "Cardinality.eq_set empty_table X \<longleftrightarrow> Set.is_empty X"
   "set_eq X empty_table \<longleftrightarrow> Set.is_empty X"
   "set_eq empty_table X \<longleftrightarrow> Set.is_empty X"
   "X = (set_empty impl) \<longleftrightarrow> Set.is_empty X"
   "(set_empty impl) = X \<longleftrightarrow> Set.is_empty X"
   "Cardinality.eq_set X (set_empty impl) \<longleftrightarrow> Set.is_empty X"
   "Cardinality.eq_set (set_empty impl) X \<longleftrightarrow> Set.is_empty X"
   "set_eq X (set_empty impl) \<longleftrightarrow> Set.is_empty X"
   "set_eq (set_empty impl) X \<longleftrightarrow> Set.is_empty X"
   unfolding set_eq_def set_empty_def empty_table_def Set.is_empty_def Cardinality.eq_set_def by auto
 
 lemma tabulate_rbt_code[code]: "Monitor.mrtabulate (xs :: mregex list) f =
   (case ID CCOMPARE(mregex) of None \<Rightarrow> Code.abort (STR ''tabulate RBT_Mapping: ccompare = None'') (\<lambda>_. Monitor.mrtabulate (xs :: mregex list) f)
   | _ \<Rightarrow> RBT_Mapping (RBT_Mapping2.bulkload (List.map_filter (\<lambda>k. let fk = f k in if fk = empty_table then None else Some (k, fk)) xs)))"
   unfolding mrtabulate.abs_eq RBT_Mapping_def
   by (auto split: option.splits)
 
 lemma combine_Mapping[code]:
   fixes t :: "('a :: ccompare, 'b) mapping_rbt" shows
   "Mapping.combine f (RBT_Mapping t) (RBT_Mapping u) = 
   (case ID CCOMPARE('a) of None \<Rightarrow> Code.abort (STR ''combine RBT_Mapping: ccompare = None'') (\<lambda>_. Mapping.combine f (RBT_Mapping t) (RBT_Mapping u))
                      | Some _ \<Rightarrow> RBT_Mapping (RBT_Mapping2.join (\<lambda>_. f) t u))"
   by (auto simp add: Mapping.combine.abs_eq Mapping_inject lookup_join split: option.split)
 
 lemma upd_set_empty[simp]: "upd_set m f {} = m"
   by transfer auto
 
 lemma upd_set_insert[simp]: "upd_set m f (insert x A) = Mapping.update x (f x) (upd_set m f A)"
   by (rule mapping_eqI) (auto simp: Mapping_lookup_upd_set Mapping.lookup_update')
 
 lemma upd_set_fold:
   assumes "finite A"
   shows "upd_set m f A = Finite_Set.fold (\<lambda>a. Mapping.update a (f a)) m A"
 proof -
   interpret comp_fun_idem "\<lambda>a. Mapping.update a (f a)"
     by unfold_locales (transfer; auto simp: fun_eq_iff)+
   from assms show ?thesis
     by (induct A arbitrary: m rule: finite.induct) auto
 qed
 
 lift_definition upd_cfi :: "('a \<Rightarrow> 'b) \<Rightarrow> ('a, ('a, 'b) mapping) comp_fun_idem"
   is "\<lambda>f a m. Mapping.update a (f a) m"
   by unfold_locales (transfer; auto simp: fun_eq_iff)+
 
 lemma upd_set_code[code]:
   "upd_set m f A = (if finite A then set_fold_cfi (upd_cfi f) m A else Code.abort (STR ''upd_set: infinite'') (\<lambda>_. upd_set m f A))"
   by (transfer fixing: m) (auto simp: upd_set_fold)
 
 lemma lexordp_eq_code[code]: "lexordp_eq xs ys \<longleftrightarrow> (case xs of [] \<Rightarrow> True
   | x # xs \<Rightarrow> (case ys of [] \<Rightarrow> False
     | y # ys \<Rightarrow> if x < y then True else if x > y then False else lexordp_eq xs ys))"
   by (subst lexordp_eq.simps) (auto split: list.split)
 
 definition "filter_set m X t = Mapping.filter (filter_cond X m t) m"
 
 declare [[code drop: shift_end]]
 declare shift_end.simps[folded filter_set_def, code]
 
 lemma upd_set'_empty[simp]: "upd_set' m d f {} = m"
   by (rule mapping_eqI) (auto simp add: upd_set'_lookup)
 
 lemma upd_set'_insert: "d = f d \<Longrightarrow> (\<And>x. f (f x) = f x) \<Longrightarrow> upd_set' m d f (insert x A) =
   (let m' = (upd_set' m d f A) in case Mapping.lookup m' x of None \<Rightarrow> Mapping.update x d m'
   | Some v \<Rightarrow> Mapping.update x (f v) m')"
   by (rule mapping_eqI) (auto simp: upd_set'_lookup Mapping.lookup_update' split: option.splits)
 
 lemma upd_set'_aux1: "upd_set' Mapping.empty d f {b. b = k \<or> (a, b) \<in> A} =
   Mapping.update k d (upd_set' Mapping.empty d f {b. (a, b) \<in> A})"
   by (rule mapping_eqI) (auto simp add: Let_def upd_set'_lookup Mapping.lookup_update'
       Mapping.lookup_empty split: option.splits)
 
 lemma upd_set'_aux2: "Mapping.lookup m k = None \<Longrightarrow> upd_set' m d f {b. b = k \<or> (a, b) \<in> A} =
   Mapping.update k d (upd_set' m d f {b. (a, b) \<in> A})"
   by (rule mapping_eqI) (auto simp add: upd_set'_lookup Mapping.lookup_update' split: option.splits)
 
 lemma upd_set'_aux3: "Mapping.lookup m k = Some v \<Longrightarrow> upd_set' m d f {b. b = k \<or> (a, b) \<in> A} =
   Mapping.update k (f v) (upd_set' m d f {b. (a, b) \<in> A})"
   by (rule mapping_eqI) (auto simp add: upd_set'_lookup Mapping.lookup_update' split: option.splits)
 
 lemma upd_set'_aux4: "k \<notin> fst ` A \<Longrightarrow> upd_set' Mapping.empty d f {b. (k, b) \<in> A} = Mapping.empty"
   by (rule mapping_eqI) (auto simp add: upd_set'_lookup Mapping.lookup_update' Domain.DomainI fst_eq_Domain
       split: option.splits)
 
 lemma upd_nested_empty[simp]: "upd_nested m d f {} = m"
   by (rule mapping_eqI) (auto simp add: upd_nested_lookup split: option.splits)
 
 definition upd_nested_step :: "'c \<Rightarrow> ('c \<Rightarrow> 'c) \<Rightarrow> 'a \<times> 'b \<Rightarrow> ('a, ('b, 'c) mapping) mapping \<Rightarrow>
   ('a, ('b, 'c) mapping) mapping" where
   "upd_nested_step d f x m = (case x of (k, k') \<Rightarrow>
     (case Mapping.lookup m k of Some m' \<Rightarrow>
       (case Mapping.lookup m' k' of Some v \<Rightarrow> Mapping.update k (Mapping.update k' (f v) m') m
       | None \<Rightarrow> Mapping.update k (Mapping.update k' d m') m)
     | None \<Rightarrow> Mapping.update k (Mapping.update k' d Mapping.empty) m))"
 
 lemma upd_nested_insert:
   "d = f d \<Longrightarrow> (\<And>x. f (f x) = f x) \<Longrightarrow> upd_nested m d f (insert x A) =
   upd_nested_step d f x (upd_nested m d f A)"
   unfolding upd_nested_step_def
   using upd_set'_aux1[of d f _ _ A] upd_set'_aux2[of _ _ d f _ A] upd_set'_aux3[of _ _ _ d f _ A]
     upd_set'_aux4[of _ A d f]
   by (auto simp add: Let_def upd_nested_lookup upd_set'_lookup Mapping.lookup_update'
       Mapping.lookup_empty split: option.splits prod.splits if_splits intro!: mapping_eqI)
 
 definition upd_nested_max_tstp where
   "upd_nested_max_tstp m d X = upd_nested m d (max_tstp d) X"
 
 lemma upd_nested_max_tstp_fold:
   assumes "finite X"
   shows "upd_nested_max_tstp m d X = Finite_Set.fold (upd_nested_step d (max_tstp d)) m X"
 proof -
   interpret comp_fun_idem "upd_nested_step d (max_tstp d)"
     by (unfold_locales; rule ext)
       (auto simp add: comp_def upd_nested_step_def Mapping.lookup_update' Mapping.lookup_empty
        update_update max_tstp_d_d max_tstp_idem' split: option.splits)
   note upd_nested_insert' = upd_nested_insert[of d "max_tstp d",
     OF max_tstp_d_d[symmetric] max_tstp_idem']
   show ?thesis
     using assms
     by (induct X arbitrary: m rule: finite.induct)
        (auto simp add: upd_nested_max_tstp_def upd_nested_insert')
 qed
 
 lift_definition upd_nested_max_tstp_cfi ::
   "ts + tp \<Rightarrow> ('a \<times> 'b, ('a, ('b, ts + tp) mapping) mapping) comp_fun_idem"
   is "\<lambda>d. upd_nested_step d (max_tstp d)"
   by (unfold_locales; rule ext)
     (auto simp add: comp_def upd_nested_step_def Mapping.lookup_update' Mapping.lookup_empty
       update_update max_tstp_d_d max_tstp_idem' split: option.splits)
 
 lemma upd_nested_max_tstp_code[code]:
   "upd_nested_max_tstp m d X = (if finite X then set_fold_cfi (upd_nested_max_tstp_cfi d) m X
     else Code.abort (STR ''upd_nested_max_tstp: infinite'') (\<lambda>_. upd_nested_max_tstp m d X))"
   by transfer (auto simp add: upd_nested_max_tstp_fold)
 
 declare [[code drop: add_new_mmuaux']]
 declare add_new_mmuaux'_def[unfolded add_new_mmuaux.simps, folded upd_nested_max_tstp_def, code]
 
 lemma filter_set_empty[simp]: "filter_set m {} t = m"
   unfolding filter_set_def
   by transfer (auto simp: fun_eq_iff split: option.splits)
 
 lemma filter_set_insert[simp]: "filter_set m (insert x A) t = (let m' = filter_set m A t in
   case Mapping.lookup m' x of Some u \<Rightarrow> if t = u then Mapping.delete x m' else m' | _ \<Rightarrow> m')"
   unfolding filter_set_def
   by transfer (auto simp: fun_eq_iff Let_def Map_To_Mapping.map_apply_def split: option.splits)
 
 lemma filter_set_fold:
   assumes "finite A"
   shows "filter_set m A t = Finite_Set.fold (\<lambda>a m.
     case Mapping.lookup m a of Some u \<Rightarrow> if t = u then Mapping.delete a m else m | _ \<Rightarrow> m) m A"
 proof -
   interpret comp_fun_idem "\<lambda>a m.
     case Mapping.lookup m a of Some u \<Rightarrow> if t = u then Mapping.delete a m else m | _ \<Rightarrow> m"
     by unfold_locales
       (transfer; auto simp: fun_eq_iff Map_To_Mapping.map_apply_def split: option.splits)+
   from assms show ?thesis
     by (induct A arbitrary: m rule: finite.induct) (auto simp: Let_def)
 qed
 
 lift_definition filter_cfi :: "'b \<Rightarrow> ('a, ('a, 'b) mapping) comp_fun_idem"
   is "\<lambda>t a m.
     case Mapping.lookup m a of Some u \<Rightarrow> if t = u then Mapping.delete a m else m | _ \<Rightarrow> m"
   by unfold_locales
     (transfer; auto simp: fun_eq_iff Map_To_Mapping.map_apply_def split: option.splits)+
 
 lemma filter_set_code[code]:
   "filter_set m A t = (if finite A then set_fold_cfi (filter_cfi t) m A else Code.abort (STR ''upd_set: infinite'') (\<lambda>_. filter_set m A t))"
   by (transfer fixing: m) (auto simp: filter_set_fold)
 
 lemma filter_Mapping[code]:
   fixes t :: "('a :: ccompare, 'b) mapping_rbt" shows
   "Mapping.filter P (RBT_Mapping t) = 
   (case ID CCOMPARE('a) of None \<Rightarrow> Code.abort (STR ''filter RBT_Mapping: ccompare = None'') (\<lambda>_. Mapping.filter P (RBT_Mapping t))
                      | Some _ \<Rightarrow> RBT_Mapping (RBT_Mapping2.filter (case_prod P) t))"
   by (auto simp add: Mapping.filter.abs_eq Mapping_inject split: option.split)
 
 definition "filter_join pos X m = Mapping.filter (join_filter_cond pos X) m"
 
 declare [[code drop: join_mmsaux]]
 declare join_mmsaux.simps[folded filter_join_def, code]
 
 lemma filter_join_False_empty: "filter_join False {} m = m"
   unfolding filter_join_def
   by transfer (auto split: option.splits)
 
 lemma filter_join_False_insert: "filter_join False (insert a A) m =
   filter_join False A (Mapping.delete a m)"
 proof -
   {
     fix x
     have "Mapping.lookup (filter_join False (insert a A) m) x =
       Mapping.lookup (filter_join False A (Mapping.delete a m)) x"
       by (auto simp add: filter_join_def Mapping.lookup_filter Mapping_lookup_delete
           split: option.splits)
   }
   then show ?thesis
     by (simp add: mapping_eqI)
 qed
 
 lemma filter_join_False:
   assumes "finite A"
   shows "filter_join False A m = Finite_Set.fold Mapping.delete m A"
 proof -
   interpret comp_fun_idem "Mapping.delete"
     by (unfold_locales; transfer) (fastforce simp add: comp_def)+
   from assms show ?thesis
     by (induction A arbitrary: m rule: finite.induct)
        (auto simp add: filter_join_False_empty filter_join_False_insert fold_fun_left_comm)
 qed
 
 lift_definition filter_not_in_cfi :: "('a, ('a, 'b) mapping) comp_fun_idem" is "Mapping.delete"
   by (unfold_locales; transfer) (fastforce simp add: comp_def)+
 
 lemma filter_join_code[code]:
   "filter_join pos A m =
     (if \<not>pos \<and> finite A \<and> card A < Mapping.size m then set_fold_cfi filter_not_in_cfi m A
     else Mapping.filter (join_filter_cond pos A) m)"
   unfolding filter_join_def
   by (transfer fixing: m) (use filter_join_False in \<open>auto simp add: filter_join_def\<close>)
 
 definition set_minus :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a set" where
   "set_minus X Y = X - Y"
 
 lift_definition remove_cfi :: "('a, 'a set) comp_fun_idem"
   is "\<lambda>b a. a - {b}"
   by unfold_locales auto
 
 lemma set_minus_finite:
   assumes fin: "finite Y"
   shows "set_minus X Y = Finite_Set.fold (\<lambda>a X. X - {a}) X Y"
 proof -
   interpret comp_fun_idem "\<lambda>a X. X - {a}"
     by unfold_locales auto
   from assms show ?thesis
     by (induction Y arbitrary: X rule: finite.induct) (auto simp add: set_minus_def)
 qed
 
 lemma set_minus_code[code]: "set_minus X Y =
   (if finite Y \<and> card Y < card X then set_fold_cfi remove_cfi X Y else X - Y)"
   by transfer (use set_minus_finite in \<open>auto simp add: set_minus_def\<close>)
 
 declare [[code drop: bin_join]]
 declare bin_join.simps[folded set_minus_def, code]
 
 definition remove_Union where
   "remove_Union A X B = A - (\<Union>x \<in> X. B x)"
 
 lemma remove_Union_finite: 
   assumes "finite X"
   shows "remove_Union A X B = Finite_Set.fold (\<lambda>x A. A - B x) A X"
 proof -
   interpret comp_fun_idem "\<lambda>x A. A - B x"
     by unfold_locales auto
   from assms show ?thesis
     by (induct X arbitrary: A rule: finite_induct) (auto simp: remove_Union_def)
 qed
 
 lift_definition remove_Union_cfi :: "('a \<Rightarrow> 'b set) \<Rightarrow> ('a, 'b set) comp_fun_idem" is "\<lambda>B x A. A - B x"
   by unfold_locales auto
 
 lemma remove_Union_code[code]: "remove_Union A X B =
   (if finite X then set_fold_cfi (remove_Union_cfi B) A X else A - (\<Union>x \<in> X. B x))"
   by (transfer fixing: A X B) (use remove_Union_finite[of X A B] in \<open>auto simp add: remove_Union_def\<close>)
 
 lemma tabulate_remdups: "Mapping.tabulate xs f = Mapping.tabulate (remdups xs) f"
   by (transfer fixing: xs f) (auto simp: map_of_map_restrict)
 
-lift_definition clearjunk :: "(char list \<times> event_data list set) list \<Rightarrow> (char list, event_data list set list) alist" is
+lift_definition clearjunk :: "(String.literal \<times> event_data list set) list \<Rightarrow> (String.literal, event_data list set list) alist" is
   "\<lambda>t. List.map_filter (\<lambda>(p, X). if X = {} then None else Some (p, [X])) (AList.clearjunk t)"
   unfolding map_filter_def o_def list.map_comp
   by (subst map_cong[OF refl, of _ _ fst]) (auto simp: map_filter_def distinct_map_fst_filter split: if_splits)
 
 lemma map_filter_snd_map_filter: "List.map_filter (\<lambda>(a, b). if P b then None else Some (f a b)) xs =
     map (\<lambda>(a, b). f a b) (filter (\<lambda>x. \<not> P (snd x)) xs)"
   by (simp add: map_filter_def prod.case_eq_if)
 
 lemma mk_db_code_alist:
   "mk_db t = Assoc_List_Mapping (clearjunk t)"
   unfolding mk_db_def Assoc_List_Mapping_def
   by (transfer' fixing: t)
     (auto simp: map_filter_snd_map_filter fun_eq_iff map_of_map image_iff map_of_clearjunk
       map_of_filter_apply dest: weak_map_of_SomeI intro!: bexI[rotated, OF map_of_SomeD]
       split: if_splits option.splits)
 
 lemma mk_db_code[code]:
   "mk_db t = Mapping.of_alist (List.map_filter (\<lambda>(p, X). if X = {} then None else Some (p, [X])) (AList.clearjunk t))"
   unfolding mk_db_def
   by (transfer' fixing: t) (auto simp: map_filter_snd_map_filter fun_eq_iff map_of_map image_iff
       map_of_clearjunk map_of_filter_apply dest: weak_map_of_SomeI intro!: bexI[rotated, OF map_of_SomeD]
       split: if_splits option.splits)
 
 declare [[code drop: New_max_getIJ_genericJoin New_max_getIJ_wrapperGenericJoin]]
 declare New_max.genericJoin.simps[folded remove_Union_def, code]
 declare New_max.wrapperGenericJoin.simps[folded remove_Union_def, code]
 
 (*<*)
 end
 (*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Optimized_Join.thy b/thys/MFODL_Monitor_Optimized/Optimized_Join.thy
--- a/thys/MFODL_Monitor_Optimized/Optimized_Join.thy
+++ b/thys/MFODL_Monitor_Optimized/Optimized_Join.thy
@@ -1,618 +1,620 @@
 (*<*)
 theory Optimized_Join
   imports "Generic_Join.Generic_Join_Correctness"
 begin
 (*>*)
 
 section \<open>Optimized relational join\<close>
 
 subsection \<open>Binary join\<close>
 
 definition join_mask :: "nat \<Rightarrow> nat set \<Rightarrow> bool list" where
   "join_mask n X = map (\<lambda>i. i \<in> X) [0..<n]"
 
 fun proj_tuple :: "bool list \<Rightarrow> 'a tuple \<Rightarrow> 'a tuple" where
   "proj_tuple [] [] = []"
 | "proj_tuple (True # bs) (a # as) = a # proj_tuple bs as"
 | "proj_tuple (False # bs) (a # as) = None # proj_tuple bs as"
 | "proj_tuple (b # bs) [] = []"
 | "proj_tuple [] (a # as) = []"
 
 lemma proj_tuple_replicate: "(\<And>i. i \<in> set bs \<Longrightarrow> \<not>i) \<Longrightarrow> length bs = length as \<Longrightarrow>
   proj_tuple bs as = replicate (length bs) None"
   by (induction bs as rule: proj_tuple.induct) fastforce+
 
 lemma proj_tuple_join_mask_empty: "length as = n \<Longrightarrow>
   proj_tuple (join_mask n {}) as = replicate n None"
   using proj_tuple_replicate[of "join_mask n {}"] by (auto simp add: join_mask_def)
 
 lemma proj_tuple_alt: "proj_tuple bs as = map2 (\<lambda>b a. if b then a else None) bs as"
   by (induction bs as rule: proj_tuple.induct) auto
 
 lemma map2_map: "map2 f (map g [0..<length as]) as = map (\<lambda>i. f (g i) (as ! i)) [0..<length as]"
   by (rule nth_equalityI) auto
 
 lemma proj_tuple_join_mask_restrict: "length as = n \<Longrightarrow>
   proj_tuple (join_mask n X) as = restrict X as"
   by (auto simp add: restrict_def proj_tuple_alt join_mask_def map2_map)
 
 lemma wf_tuple_proj_idle:
   assumes wf: "wf_tuple n X as"
   shows "proj_tuple (join_mask n X) as = as"
   using proj_tuple_join_mask_restrict[of as n X, unfolded restrict_idle[OF wf]] wf
   by (auto simp add: wf_tuple_def)
 
 lemma wf_tuple_change_base:
   assumes wf: "wf_tuple n X as"
   and mask: "join_mask n X = join_mask n Y"
   shows "wf_tuple n Y as"
   using wf mask by (auto simp add: wf_tuple_def join_mask_def)
 
 definition proj_tuple_in_join :: "bool \<Rightarrow> bool list \<Rightarrow> 'a tuple \<Rightarrow> 'a table \<Rightarrow> bool" where
   "proj_tuple_in_join pos bs as t = (if pos then proj_tuple bs as \<in> t else proj_tuple bs as \<notin> t)"
 
 abbreviation "join_cond pos t \<equiv> (\<lambda>as. if pos then as \<in> t else as \<notin> t)"
 
 abbreviation "join_filter_cond pos t \<equiv> (\<lambda>as _. join_cond pos t as)"
 
 lemma proj_tuple_in_join_mask_idle:
   assumes wf: "wf_tuple n X as"
   shows "proj_tuple_in_join pos (join_mask n X) as t \<longleftrightarrow> join_cond pos t as"
   using wf_tuple_proj_idle[OF wf] by (auto simp add: proj_tuple_in_join_def)
 
 lemma join_sub:
   assumes "L \<subseteq> R" "table n L t1" "table n R t2"
   shows "join t2 pos t1 = {as \<in> t2. proj_tuple_in_join pos (join_mask n L) as t1}"
   using assms proj_tuple_join_mask_restrict[of _ n L] join_restrict[of t2 n R t1 L pos]
     wf_tuple_length restrict_idle
   by (auto simp add: table_def proj_tuple_in_join_def sup.absorb1) fastforce+
 
 lemma join_sub':
   assumes "R \<subseteq> L" "table n L t1" "table n R t2"
   shows "join t2 True t1 = {as \<in> t1. proj_tuple_in_join True (join_mask n R) as t2}"
   using assms proj_tuple_join_mask_restrict[of _ n R] join_restrict[of t2 n R t1 L True]
     wf_tuple_length restrict_idle
   by (auto simp add: table_def proj_tuple_in_join_def sup.absorb1 Un_absorb1) fastforce+
 
 lemma join_eq:
   assumes tab: "table n R t1" "table n R t2"
   shows "join t2 pos t1 = (if pos then t2 \<inter> t1 else t2 - t1)"
   using join_sub[OF _ tab, of pos] tab(2) proj_tuple_in_join_mask_idle[of n R _ pos t1]
   by (auto simp add: table_def)
 
 lemma join_no_cols:
   assumes tab: "table n {} t1" "table n R t2"
   shows "join t2 pos t1 = (if (pos \<longleftrightarrow> replicate n None \<in> t1) then t2 else {})"
   using join_sub[OF _ tab, of pos] tab(2)
   by (auto simp add: table_def proj_tuple_in_join_def wf_tuple_length proj_tuple_join_mask_empty)
 
 lemma join_empty_left: "join {} pos t = {}"
   by (auto simp add: join_def)
 
 lemma join_empty_right: "join t pos {} = (if pos then {} else t)"
   by (auto simp add: join_def)
 
 fun bin_join :: "nat \<Rightarrow> nat set \<Rightarrow> 'a table \<Rightarrow> bool \<Rightarrow> nat set \<Rightarrow> 'a table \<Rightarrow> 'a table" where
   "bin_join n A t pos A' t' =
     (if t = {} then {}
     else if t' = {} then (if pos then {} else t)
     else if A' = {} then (if (pos \<longleftrightarrow> replicate n None \<in> t') then t else {})
     else if A' = A then (if pos then t \<inter> t' else t - t')
     else if A' \<subseteq> A then {as \<in> t. proj_tuple_in_join pos (join_mask n A') as t'}
     else if A \<subseteq> A' \<and> pos then {as \<in> t'. proj_tuple_in_join pos (join_mask n A) as t}
     else join t pos t')"
 
 lemma bin_join_table:
   assumes tab: "table n A t" "table n A' t'"
   shows "bin_join n A t pos A' t' = join t pos t'"
   using assms join_empty_left[of pos t'] join_empty_right[of t pos]
     join_no_cols[OF _ assms(1), of t' pos] join_eq[of n A t' t pos] join_sub[OF _ assms(2,1)]
     join_sub'[OF _ assms(2,1)]
   by auto+
 
 subsection \<open>Multi-way join\<close>
 
 fun mmulti_join' :: "(nat set list \<Rightarrow> nat set list \<Rightarrow> 'a table list \<Rightarrow> 'a table)" where
   "mmulti_join' A_pos A_neg L = (
     let Q = set (zip A_pos L) in
     let Q_neg = set (zip A_neg (drop (length A_pos) L)) in
     New_max_getIJ_wrapperGenericJoin Q Q_neg)"
 
 lemma mmulti_join'_correct:
   assumes "A_pos \<noteq> []"
       and "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) (A_pos @ A_neg) L"
   shows "z \<in> mmulti_join' A_pos A_neg L \<longleftrightarrow> wf_tuple n (\<Union>A\<in>set A_pos. A) z \<and>
     list_all2 (\<lambda>A X. restrict A z \<in> X) A_pos (take (length A_pos) L) \<and>
     list_all2 (\<lambda>A X. restrict A z \<notin> X) A_neg (drop (length A_pos) L)"
 proof -
   define Q where "Q = set (zip A_pos L)"
   have Q_alt: "Q = set (zip A_pos (take (length A_pos) L))"
     unfolding Q_def by (fastforce simp: in_set_zip)
   define Q_neg where "Q_neg = set (zip A_neg (drop (length A_pos) L))"
   let ?r = "mmulti_join' A_pos A_neg L"
   have "?r = New_max_getIJ_wrapperGenericJoin Q Q_neg"
     unfolding Q_def Q_neg_def by (simp del: New_max.wrapperGenericJoin.simps)
   moreover have "card Q \<ge> 1"
     unfolding Q_def using assms(1,2)
     by (auto simp: Suc_le_eq card_gt_0_iff zip_eq_Nil_iff)
   moreover have "\<forall>(A, X)\<in>(Q \<union> Q_neg). table n A X \<and> wf_set n A"
     unfolding Q_alt Q_neg_def using assms(2) by (simp add: zip_append1 list_all2_iff)
   ultimately have "z \<in> ?r \<longleftrightarrow> wf_tuple n (\<Union>(A, X)\<in>Q. A) z \<and>
       (\<forall>(A, X)\<in>Q. restrict A z \<in> X) \<and> (\<forall>(A, X)\<in>Q_neg. restrict A z \<notin> X)"
     using New_max.wrapper_correctness case_prod_beta' by blast
   moreover have "(\<Union>A\<in>set A_pos. A) = (\<Union>(A, X)\<in>Q. A)" proof -
     from assms(2) have "length A_pos \<le> length L" by (auto dest!: list_all2_lengthD)
     then show ?thesis
       unfolding Q_alt
       by (auto elim: in_set_impl_in_set_zip1[rotated, where ys="take (length A_pos) L"]
           dest: set_zip_leftD)
   qed
   moreover have "\<And>z. (\<forall>(A, X)\<in>Q. restrict A z \<in> X) \<longleftrightarrow>
     list_all2 (\<lambda>A X. restrict A z \<in> X) A_pos (take (length A_pos) L)"
     unfolding Q_alt using assms(2) by (auto simp add: list_all2_iff)
   moreover have "\<And>z. (\<forall>(A, X)\<in>Q_neg. restrict A z \<notin> X) \<longleftrightarrow>
     list_all2 (\<lambda>A X. restrict A z \<notin> X) A_neg (drop (length A_pos) L)"
     unfolding Q_neg_def using assms(2) by (auto simp add: list_all2_iff)
   ultimately show ?thesis
     unfolding Q_def Q_neg_def using assms(2) by simp
 qed
 
 lemmas restrict_nested = New_max.restrict_nested
 
 lemma list_all2_opt_True:
   assumes "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) ((A_zs @ A_x # A_xs @ A_y # A_ys) @ A_neg)
     ((zs @ x # xs @ y # ys) @ L_neg)"
     "length A_xs = length xs" "length A_ys = length ys" "length A_zs = length zs"
   shows "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) @ A_neg) ((zs @ join x True y # xs @ ys) @ L_neg)"
 proof -
   have assms_dest: "table n A_x x" "table n A_y y" "wf_set n A_x" "wf_set n A_y"
     using assms
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append1 dest: list_all2_lengthD)
   then have tabs: "table n (A_x \<union> A_y) (join x True y)" "wf_set n (A_x \<union> A_y)"
     using join_table[of n A_x x A_y y True "A_x \<union> A_y", OF assms_dest(1,2)] assms_dest(3,4)
     by (auto simp add: wf_set_def)
   then show "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) @ A_neg) ((zs @ join x True y # xs @ ys) @ L_neg)"
     using assms
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append1 list_all2_append2
         list_all2_Cons1 list_all2_Cons2 dest: list_all2_lengthD) fastforce
 qed
 
 lemma mmulti_join'_opt_True:
   assumes "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) ((A_zs @ A_x # A_xs @ A_y # A_ys) @ A_neg)
     ((zs @ x # xs @ y # ys) @ L_neg)"
     "length A_xs = length xs" "length A_ys = length ys" "length A_zs = length zs"
   shows "mmulti_join' (A_zs @ A_x # A_xs @ A_y # A_ys) A_neg ((zs @ x # xs @ y # ys) @ L_neg) =
     mmulti_join' (A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) A_neg
     ((zs @ join x True y # xs @ ys) @ L_neg)"
 proof -
   have assms_dest: "table n A_x x" "table n A_y y" "wf_set n A_x" "wf_set n A_y"
     using assms
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append1 dest: list_all2_lengthD)
   then have tabs: "table n (A_x \<union> A_y) (join x True y)" "wf_set n (A_x \<union> A_y)"
     using join_table[of n A_x x A_y y True "A_x \<union> A_y", OF assms_dest(1,2)] assms_dest(3,4)
     by (auto simp add: wf_set_def)
   then have list_all2': "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) @ A_neg) ((zs @ join x True y # xs @ ys) @ L_neg)"
     using assms
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append1 list_all2_append2
         list_all2_Cons1 list_all2_Cons2 dest: list_all2_lengthD) fastforce
   have res: "\<And>z Z. wf_tuple n Z z \<Longrightarrow> A_x \<union> A_y \<subseteq> Z \<Longrightarrow>
     restrict (A_x \<union> A_y) z \<in> join x True y \<longleftrightarrow> restrict A_x z \<in> x \<and> restrict A_y z \<in> y"
     using join_restrict[of x n A_x y A_y True] wf_tuple_restrict_simple[of n _ _ "A_x \<union> A_y"]
       assms_dest(1,2)
     by (auto simp add: table_def restrict_nested Int_absorb2)
   show ?thesis
   proof (rule set_eqI, rule iffI)
     fix z
     assume "z \<in> mmulti_join' (A_zs @ A_x # A_xs @ A_y # A_ys) A_neg
       ((zs @ x # xs @ y # ys) @ L_neg)"
     then have z_in_dest: "wf_tuple n (\<Union>(set (A_zs @ A_x # A_xs @ A_y # A_ys))) z"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_zs zs"
       "restrict A_x z \<in> x"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_ys ys"
       "restrict A_y z \<in> y"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_xs xs"
       "list_all2 (\<lambda>A. (\<notin>) (restrict A z)) A_neg L_neg"
       using mmulti_join'_correct[OF _ assms(1), of z]
       by (auto simp del: mmulti_join'.simps simp add: assms list_all2_append1
           dest: list_all2_lengthD)
     then show "z \<in> mmulti_join' (A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) A_neg
       ((zs @ join x True y # xs @ ys) @ L_neg)"
       using mmulti_join'_correct[OF _ list_all2', of z] res[OF z_in_dest(1)]
       by (auto simp add: assms list_all2_appendI le_supI2 Un_assoc simp del: mmulti_join'.simps
           dest: list_all2_lengthD)
   next
     fix z
     assume "z \<in> mmulti_join' (A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) A_neg
       ((zs @ join x True y # xs @ ys) @ L_neg)"
     then have z_in_dest: "wf_tuple n (\<Union>(set (A_zs @ A_x # A_xs @ A_y # A_ys))) z"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_zs zs"
       "restrict (A_x \<union> A_y) z \<in> join x True y"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_ys ys"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_xs xs"
       "list_all2 (\<lambda>A. (\<notin>) (restrict A z)) A_neg L_neg"
       using mmulti_join'_correct[OF _ list_all2', of z]
       by (auto simp del: mmulti_join'.simps simp add: assms list_all2_append Un_assoc
           dest: list_all2_lengthD)
     then show "z \<in> mmulti_join' (A_zs @ A_x # A_xs @ A_y # A_ys) A_neg
       ((zs @ x # xs @ y # ys) @ L_neg)"
       using mmulti_join'_correct[OF _ assms(1), of z] res[OF z_in_dest(1)]
       by (auto simp add: assms list_all2_appendI le_supI2 Un_assoc simp del: mmulti_join'.simps
           dest: list_all2_lengthD)
   qed
 qed
 
 lemma list_all2_opt_False:
   assumes "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ A_x # A_xs) @ (A_ws @ A_y # A_ys)) ((zs @ x # xs) @ (ws @ y # ys))"
     "length A_ws = length ws" "length A_xs = length xs"
     "length A_ys = length ys" "length A_zs = length zs"
     "A_y \<subseteq> A_x"
   shows "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ A_x # A_xs) @ (A_ws @ A_ys)) ((zs @ join x False y # xs) @ (ws @ ys))"
 proof -
   have assms_dest: "table n A_x x" "table n A_y y" "wf_set n A_x" "wf_set n A_y"
     using assms
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append dest: list_all2_lengthD)
   have tabs: "table n A_x (join x False y)"
     using join_table[of n A_x x A_y y False A_x, OF assms_dest(1,2) assms(6)] assms(6) by auto
   then show "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ A_x # A_xs) @ (A_ws @ A_ys)) ((zs @ join x False y # xs) @ (ws @ ys))"
     using assms assms_dest(3)
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append1 list_all2_append2
         list_all2_Cons1 list_all2_Cons2 dest: list_all2_lengthD) fastforce
 qed
 
 lemma mmulti_join'_opt_False:
   assumes "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ A_x # A_xs) @ (A_ws @ A_y # A_ys)) ((zs @ x # xs) @ (ws @ y # ys))"
     "length A_ws = length ws" "length A_xs = length xs"
     "length A_ys = length ys" "length A_zs = length zs"
     "A_y \<subseteq> A_x"
   shows "mmulti_join' (A_zs @ A_x # A_xs) (A_ws @ A_y # A_ys) ((zs @ x # xs) @ (ws @ y # ys)) =
     mmulti_join' (A_zs @ A_x # A_xs) (A_ws @ A_ys) ((zs @ join x False y # xs) @ (ws @ ys))"
 proof -
   have assms_dest: "table n A_x x" "table n A_y y" "wf_set n A_x" "wf_set n A_y"
     using assms
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append dest: list_all2_lengthD)
   have tabs: "table n A_x (join x False y)"
     using join_table[of n A_x x A_y y False A_x, OF assms_dest(1,2) assms(6)] assms(6) by auto
   then have list_all2': "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
     ((A_zs @ A_x # A_xs) @ (A_ws @ A_ys)) ((zs @ join x False y # xs) @ (ws @ ys))"
     using assms assms_dest(3)
     by (auto simp del: mmulti_join'.simps simp add: list_all2_append1 list_all2_append2
         list_all2_Cons1 list_all2_Cons2 dest: list_all2_lengthD) fastforce
   have res: "\<And>z. restrict A_x z \<in> join x False y \<longleftrightarrow> restrict A_x z \<in> x \<and> restrict A_y z \<notin> y"
     using join_restrict[of x n A_x y A_y False, OF _ _ assms(6)] assms_dest(1,2) assms(6)
     by (auto simp add: table_def restrict_nested Int_absorb2 Un_absorb2)
   show ?thesis
   proof (rule set_eqI, rule iffI)
     fix z
     assume "z \<in> mmulti_join' (A_zs @ A_x # A_xs) (A_ws @ A_y # A_ys)
       ((zs @ x # xs) @ ws @ y # ys)"
     then have z_in_dest: "wf_tuple n (\<Union>(set (A_zs @ A_x # A_xs))) z"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_zs zs"
       "restrict A_x z \<in> x"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_xs xs"
       "list_all2 (\<lambda>A. (\<notin>) (restrict A z)) A_ws ws"
       "restrict A_y z \<notin> y"
       "list_all2 (\<lambda>A. (\<notin>) (restrict A z)) A_ys ys"
       using mmulti_join'_correct[OF _ assms(1), of z]
       by (auto simp del: mmulti_join'.simps simp add: assms list_all2_append1
           dest: list_all2_lengthD)
     then show "z \<in> mmulti_join' (A_zs @ A_x # A_xs) (A_ws @ A_ys)
       ((zs @ join x False y # xs) @ ws @ ys)"
       using mmulti_join'_correct[OF _ list_all2', of z] res
       by (auto simp add: assms list_all2_appendI Un_assoc simp del: mmulti_join'.simps
           dest: list_all2_lengthD)
   next
     fix z
     assume "z \<in> mmulti_join' (A_zs @ A_x # A_xs) (A_ws @ A_ys)
       ((zs @ join x False y # xs) @ ws @ ys)"
     then have z_in_dest: "wf_tuple n (\<Union>(set (A_zs @ A_x # A_xs))) z"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_zs zs"
       "restrict A_x z \<in> join x False y"
       "list_all2 (\<lambda>A. (\<in>) (restrict A z)) A_xs xs"
       "list_all2 (\<lambda>A. (\<notin>) (restrict A z)) A_ws ws"
       "list_all2 (\<lambda>A. (\<notin>) (restrict A z)) A_ys ys"
       using mmulti_join'_correct[OF _ list_all2', of z]
       by (auto simp del: mmulti_join'.simps simp add: assms list_all2_append1
           dest: list_all2_lengthD)
     then show "z \<in> mmulti_join' (A_zs @ A_x # A_xs) (A_ws @ A_y # A_ys)
       ((zs @ x # xs) @ ws @ y # ys)"
       using mmulti_join'_correct[OF _ assms(1), of z] res
       by (auto simp add: assms list_all2_appendI Un_assoc simp del: mmulti_join'.simps
           dest: list_all2_lengthD)
   qed
 qed
 
 fun find_sub_in :: "'a set \<Rightarrow> 'a set list \<Rightarrow> bool \<Rightarrow>
   ('a set list \<times> 'a set \<times> 'a set list) option" where
   "find_sub_in X [] b = None"
 | "find_sub_in X (x # xs) b = (if (x \<subseteq> X \<or> (b \<and> X \<subseteq> x)) then Some ([], x, xs)
     else (case find_sub_in X xs b of None \<Rightarrow> None | Some (ys, z, zs) \<Rightarrow> Some (x # ys, z, zs)))"
 
 lemma find_sub_in_sound: "find_sub_in X xs b = Some (ys, z, zs) \<Longrightarrow>
   xs = ys @ z # zs \<and> (z \<subseteq> X \<or> (b \<and> X \<subseteq> z))"
   by (induction X xs b arbitrary: ys z zs rule: find_sub_in.induct)
      (fastforce split: if_splits option.splits)+
 
 fun find_sub_True :: "'a set list \<Rightarrow>
   ('a set list \<times> 'a set \<times> 'a set list \<times> 'a set \<times> 'a set list) option" where
   "find_sub_True [] = None"
 | "find_sub_True (x # xs) = (case find_sub_in x xs True of None \<Rightarrow>
     (case find_sub_True xs of None \<Rightarrow> None
     | Some (ys, w, ws, z, zs) \<Rightarrow> Some (x # ys, w, ws, z, zs))
   | Some (ys, z, zs) \<Rightarrow> Some ([], x, ys, z, zs))"
 
 lemma find_sub_True_sound: "find_sub_True xs = Some (ys, w, ws, z, zs) \<Longrightarrow>
   xs = ys @ w # ws @ z # zs \<and> (z \<subseteq> w \<or> w \<subseteq> z)"
   using find_sub_in_sound
   by (induction xs arbitrary: ys w ws z zs rule: find_sub_True.induct)
      (fastforce split: option.splits)+
 
 fun find_sub_False :: "'a set list \<Rightarrow> 'a set list \<Rightarrow>
   (('a set list \<times> 'a set \<times> 'a set list) \<times> ('a set list \<times> 'a set \<times> 'a set list)) option" where
   "find_sub_False [] ns = None"
 | "find_sub_False (x # xs) ns = (case find_sub_in x ns False of None \<Rightarrow>
     (case find_sub_False xs ns of None \<Rightarrow> None
     | Some ((rs, w, ws), (ys, z, zs)) \<Rightarrow> Some ((x # rs, w, ws), (ys, z, zs)))
   | Some (ys, z, zs) \<Rightarrow> Some (([], x, xs), (ys, z, zs)))"
 
 lemma find_sub_False_sound: "find_sub_False xs ns = Some ((rs, w, ws), (ys, z, zs)) \<Longrightarrow>
   xs = rs @ w # ws \<and> ns = ys @ z # zs \<and> (z \<subseteq> w)"
   using find_sub_in_sound
   by (induction xs ns arbitrary: rs w ws ys z zs rule: find_sub_False.induct)
      (fastforce split: option.splits)+
 
 fun proj_list_3 :: "'a list \<Rightarrow> ('b list \<times> 'b \<times> 'b list) \<Rightarrow> ('a list \<times> 'a \<times> 'a list)" where
   "proj_list_3 xs (ys, z, zs) = (take (length ys) xs, xs ! (length ys),
     take (length zs) (drop (length ys + 1) xs))"
 
 lemma proj_list_3_same:
   assumes "proj_list_3 xs (ys, z, zs) = (ys', z', zs')"
     "length xs = length ys + 1 + length zs"
   shows "xs = ys' @ z' # zs'"
   using assms by (auto simp add: id_take_nth_drop)
 
 lemma proj_list_3_length:
   assumes "proj_list_3 xs (ys, z, zs) = (ys', z', zs')"
     "length xs = length ys + 1 + length zs"
   shows "length ys = length ys'" "length zs = length zs'"
   using assms by auto
 
 fun proj_list_5 :: "'a list \<Rightarrow>
   ('b list \<times> 'b \<times> 'b list \<times> 'b \<times> 'b list) \<Rightarrow>
   ('a list \<times> 'a \<times> 'a list \<times> 'a \<times> 'a list)" where
   "proj_list_5 xs (ys, w, ws, z, zs) = (take (length ys) xs, xs ! (length ys),
     take (length ws) (drop (length ys + 1) xs), xs ! (length ys + 1 + length ws),
     drop (length ys + 1 + length ws + 1) xs)"
 
 lemma proj_list_5_same:
   assumes "proj_list_5 xs (ys, w, ws, z, zs) = (ys', w', ws', z', zs')"
     "length xs = length ys + 1 + length ws + 1 + length zs"
   shows "xs = ys' @ w' # ws' @ z' # zs'"
 proof -
   have "xs ! length ys # take (length ws) (drop (Suc (length ys)) xs) = take (Suc (length ws)) (drop (length ys) xs)"
     using assms(2) by (simp add: list_eq_iff_nth_eq nth_Cons split: nat.split)
   moreover have "take (Suc (length ws)) (drop (length ys) xs) @ drop (Suc (length ys + length ws)) xs =
       drop (length ys) xs"
     unfolding Suc_eq_plus1 add.assoc[of _ _ 1] add.commute[of _ "length ws + 1"]
       drop_drop[symmetric, of "length ws + 1"] append_take_drop_id ..
   ultimately show ?thesis
     using assms by (auto simp: Cons_nth_drop_Suc append_Cons[symmetric])
 qed
 
 lemma proj_list_5_length:
   assumes "proj_list_5 xs (ys, w, ws, z, zs) = (ys', w', ws', z', zs')"
     "length xs = length ys + 1 + length ws + 1 + length zs"
   shows "length ys = length ys'" "length ws = length ws'"
     "length zs = length zs'"
   using assms by auto
 
 fun dominate_True :: "nat set list \<Rightarrow> 'a table list \<Rightarrow>
   ((nat set list \<times> nat set \<times> nat set list \<times> nat set \<times> nat set list) \<times>
   ('a table list \<times> 'a table \<times> 'a table list \<times> 'a table \<times> 'a table list)) option" where
   "dominate_True A_pos L_pos = (case find_sub_True A_pos of None \<Rightarrow> None
   | Some split \<Rightarrow> Some (split, proj_list_5 L_pos split))"
 
 lemma find_sub_True_proj_list_5_same:
   assumes "find_sub_True xs = Some (ys, w, ws, z, zs)" "length xs = length xs'"
     "proj_list_5 xs' (ys, w, ws, z, zs) = (ys', w', ws', z', zs')"
   shows "xs' = ys' @ w' # ws' @ z' # zs'"
 proof -
   have len: "length xs' = length ys + 1 + length ws + 1 + length zs"
     using find_sub_True_sound[OF assms(1)] by (auto simp add: assms(2)[symmetric])
   show ?thesis
     using proj_list_5_same[OF assms(3) len] .
 qed
 
 lemma find_sub_True_proj_list_5_length:
   assumes "find_sub_True xs = Some (ys, w, ws, z, zs)" "length xs = length xs'"
     "proj_list_5 xs' (ys, w, ws, z, zs) = (ys', w', ws', z', zs')"
   shows "length ys = length ys'" "length ws = length ws'"
     "length zs = length zs'"
   using find_sub_True_sound[OF assms(1)] proj_list_5_length[OF assms(3)] assms(2) by auto
 
 lemma dominate_True_sound:
   assumes "dominate_True A_pos L_pos = Some ((A_zs, A_x, A_xs, A_y, A_ys), (zs, x, xs, y, ys))"
     "length A_pos = length L_pos"
   shows "A_pos = A_zs @ A_x # A_xs @ A_y # A_ys" "L_pos = zs @ x # xs @ y # ys"
     "length A_xs = length xs" "length A_ys = length ys" "length A_zs = length zs"
   using assms find_sub_True_sound find_sub_True_proj_list_5_same find_sub_True_proj_list_5_length
   by (auto simp del: proj_list_5.simps split: option.splits) fast+
 
 fun dominate_False :: "nat set list \<Rightarrow> 'a table list \<Rightarrow> nat set list \<Rightarrow> 'a table list \<Rightarrow>
   (((nat set list \<times> nat set \<times> nat set list) \<times> nat set list \<times> nat set \<times> nat set list) \<times>
   (('a table list \<times> 'a table \<times> 'a table list) \<times>
   'a table list \<times> 'a table \<times> 'a table list)) option" where
   "dominate_False A_pos L_pos A_neg L_neg = (case find_sub_False A_pos A_neg of None \<Rightarrow> None
   | Some (pos_split, neg_split) \<Rightarrow>
     Some ((pos_split, neg_split), (proj_list_3 L_pos pos_split, proj_list_3 L_neg neg_split)))"
 
 lemma find_sub_False_proj_list_3_same_left:
   assumes "find_sub_False xs ns = Some ((rs, w, ws), (ys, z, zs))"
     "length xs = length xs'" "proj_list_3 xs' (rs, w, ws) = (rs', w', ws')"
   shows "xs' = rs' @ w' # ws'"
 proof -
   have len: "length xs' = length rs + 1 + length ws"
     using find_sub_False_sound[OF assms(1)] by (auto simp add: assms(2)[symmetric])
   show ?thesis
     using proj_list_3_same[OF assms(3) len] .
 qed
 
 lemma find_sub_False_proj_list_3_length_left:
   assumes "find_sub_False xs ns = Some ((rs, w, ws), (ys, z, zs))"
     "length xs = length xs'" "proj_list_3 xs' (rs, w, ws) = (rs', w', ws')"
   shows "length rs = length rs'" "length ws = length ws'"
   using find_sub_False_sound[OF assms(1)] proj_list_3_length[OF assms(3)] assms(2) by auto
 
 lemma find_sub_False_proj_list_3_same_right:
   assumes "find_sub_False xs ns = Some ((rs, w, ws), (ys, z, zs))"
     "length ns = length ns'" "proj_list_3 ns' (ys, z, zs) = (ys', z', zs')"
   shows "ns' = ys' @ z' # zs'"
 proof -
   have len: "length ns' = length ys + 1 + length zs"
     using find_sub_False_sound[OF assms(1)] by (auto simp add: assms(2)[symmetric])
   show ?thesis
     using proj_list_3_same[OF assms(3) len] .
 qed
 
 lemma find_sub_False_proj_list_3_length_right:
   assumes "find_sub_False xs ns = Some ((rs, w, ws), (ys, z, zs))"
     "length ns = length ns'" "proj_list_3 ns' (ys, z, zs) = (ys', z', zs')"
   shows "length ys = length ys'" "length zs = length zs'"
   using find_sub_False_sound[OF assms(1)] proj_list_3_length[OF assms(3)] assms(2) by auto
 
 lemma dominate_False_sound:
   assumes "dominate_False A_pos L_pos A_neg L_neg =
     Some (((A_zs, A_x, A_xs), A_ws, A_y, A_ys), ((zs, x, xs), ws, y, ys))"
     "length A_pos = length L_pos" "length A_neg = length L_neg"
   shows "A_pos = (A_zs @ A_x # A_xs)" "A_neg = A_ws @ A_y # A_ys"
     "L_pos = (zs @ x # xs)" "L_neg = ws @ y # ys"
     "length A_ws = length ws" "length A_xs = length xs"
     "length A_ys = length ys" "length A_zs = length zs"
     "A_y \<subseteq> A_x"
   using assms find_sub_False_proj_list_3_same_left find_sub_False_proj_list_3_same_right
     find_sub_False_proj_list_3_length_left find_sub_False_proj_list_3_length_right
     find_sub_False_sound
   by (auto simp del: proj_list_3.simps split: option.splits) fast+
 
 function mmulti_join :: "(nat \<Rightarrow> nat set list \<Rightarrow> nat set list \<Rightarrow> 'a table list \<Rightarrow> 'a table)" where
   "mmulti_join n A_pos A_neg L = (if length A_pos + length A_neg \<noteq> length L then {} else
     let L_pos = take (length A_pos) L; L_neg = drop (length A_pos) L in
     (case dominate_True A_pos L_pos of None \<Rightarrow>
       (case dominate_False A_pos L_pos A_neg L_neg of None \<Rightarrow> mmulti_join' A_pos A_neg L
       | Some (((A_zs, A_x, A_xs), A_ws, A_y, A_ys), ((zs, x, xs), ws, y, ys)) \<Rightarrow>
         mmulti_join n (A_zs @ A_x # A_xs) (A_ws @ A_ys)
         ((zs @ bin_join n A_x x False A_y y # xs) @ (ws @ ys)))
     | Some ((A_zs, A_x, A_xs, A_y, A_ys), (zs, x, xs, y, ys)) \<Rightarrow>
       mmulti_join n (A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) A_neg
       ((zs @ bin_join n A_x x True A_y y # xs @ ys) @ L_neg)))"
   by pat_completeness auto
 termination
   by (relation "measure (\<lambda>(n, A_pos, A_neg, L). length A_pos + length A_neg)")
     (use find_sub_True_sound find_sub_False_sound in \<open>fastforce split: option.splits\<close>)+
 
 lemma mmulti_join_link:
   assumes "A_pos \<noteq> []"
       and "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) (A_pos @ A_neg) L"
     shows "mmulti_join n A_pos A_neg L = mmulti_join' A_pos A_neg L"
   using assms
 proof (induction A_pos A_neg L rule: mmulti_join.induct)
   case (1 n A_pos A_neg L)
   define L_pos where "L_pos = take (length A_pos) L"
   define L_neg where "L_neg = drop (length A_pos) L"
   have L_def: "L = L_pos @ L_neg"
     using L_pos_def L_neg_def by auto
   have lens_match: "length A_pos = length L_pos" "length A_neg = length L_neg"
     using L_pos_def L_neg_def 1(4)[unfolded L_def] by (auto dest: list_all2_lengthD)
   then have lens_sum: "length A_pos + length A_neg = length L"
     by (auto simp add: L_def)
   show ?case
   proof (cases "dominate_True A_pos L_pos")
     case None
     note dom_True = None
     show ?thesis
     proof (cases "dominate_False A_pos L_pos A_neg L_neg")
       case None
       show ?thesis
         by (subst mmulti_join.simps)
            (simp del: dominate_True.simps dominate_False.simps mmulti_join.simps
             mmulti_join'.simps add: Let_def dom_True L_pos_def[symmetric] None
             L_neg_def[symmetric] lens_sum split: option.splits)
     next
       case (Some a)
       then obtain A_zs A_x A_xs A_ws A_y A_ys zs x xs ws y ys where
         dom_False: "dominate_False A_pos L_pos A_neg L_neg =
         Some (((A_zs, A_x, A_xs), A_ws, A_y, A_ys), ((zs, x, xs), ws, y, ys))"
         by (cases a) auto
       note list_all2 = 1(4)[unfolded L_def dominate_False_sound[OF dom_False lens_match]]
       have lens: "length A_ws = length ws" "length A_xs = length xs"
         "length A_ys = length ys" "length A_zs = length zs"
         using dominate_False_sound[OF dom_False lens_match] by auto
       have sub: "A_y \<subseteq> A_x"
         using dominate_False_sound[OF dom_False lens_match] by auto
       have list_all2': "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
         ((A_zs @ A_x # A_xs) @ (A_ws @ A_ys)) ((zs @ join x False y # xs) @ (ws @ ys))"
         using list_all2_opt_False[OF list_all2 lens sub] .
       have tabs: "table n A_x x" "table n A_y y"
         using list_all2 by (auto simp add: lens list_all2_append)
       have bin_join_conv: "join x False y = bin_join n A_x x False A_y y"
         using bin_join_table[OF tabs, symmetric] .
       have mmulti: "mmulti_join n A_pos A_neg L = mmulti_join n (A_zs @ A_x # A_xs) (A_ws @ A_ys)
         ((zs @ bin_join n A_x x False A_y y # xs) @ (ws @ ys))"
         by (subst mmulti_join.simps)
            (simp del: dominate_True.simps dominate_False.simps mmulti_join.simps
             add: Let_def dom_True L_pos_def[symmetric] L_neg_def[symmetric] dom_False lens_sum)
       show ?thesis
         unfolding mmulti
         unfolding L_def dominate_False_sound[OF dom_False lens_match]
         by (rule 1(1)[OF _ L_pos_def L_neg_def dom_True dom_False,
             OF _ _ _ _ _ _ _ _ _ _ _ _ _ list_all2'[unfolded bin_join_conv],
             unfolded mmulti_join'_opt_False[OF list_all2 lens sub, symmetric,
             unfolded bin_join_conv]])
            (auto simp add: lens_sum)
     qed
   next
     case (Some a)
     then obtain A_zs A_x A_xs A_y A_ys zs x xs y ys where dom_True: "dominate_True A_pos L_pos =
       Some ((A_zs, A_x, A_xs, A_y, A_ys), (zs, x, xs, y, ys))"
       by (cases a) auto
     note list_all2 = 1(4)[unfolded L_def dominate_True_sound[OF dom_True lens_match(1)]]
     have lens: "length A_xs = length xs" "length A_ys = length ys" "length A_zs = length zs"
       using dominate_True_sound[OF dom_True lens_match(1)] by auto
     have list_all2': "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A)
       ((A_zs @ (A_x \<union> A_y) # A_xs @ A_ys) @ A_neg) ((zs @ join x True y # xs @ ys) @ L_neg)"
       using list_all2_opt_True[OF list_all2 lens] .
     have tabs: "table n A_x x" "table n A_y y"
         using list_all2 by (auto simp add: lens list_all2_append)
     have bin_join_conv: "join x True y = bin_join n A_x x True A_y y"
       using bin_join_table[OF tabs, symmetric] .
     have mmulti: "mmulti_join n A_pos A_neg L = mmulti_join n (A_zs @ (A_x \<union> A_y) # A_xs @ A_ys)
       A_neg ((zs @ bin_join n A_x x True A_y y # xs @ ys) @ L_neg)"
       by (subst mmulti_join.simps)
          (simp del: dominate_True.simps dominate_False.simps mmulti_join.simps
           add: Let_def dom_True L_pos_def[symmetric] L_neg_def lens_sum)
     show ?thesis
       unfolding mmulti
       unfolding L_def dominate_True_sound[OF dom_True lens_match(1)]
       by (rule 1(2)[OF _ L_pos_def L_neg_def dom_True,
           OF _ _ _ _ _ _ _ _ _ _ _ list_all2'[unfolded bin_join_conv],
           unfolded mmulti_join'_opt_True[OF list_all2 lens, symmetric,
           unfolded bin_join_conv]])
          (auto simp add: lens_sum)
   qed
 qed
 
 lemma mmulti_join_correct:
   assumes "A_pos \<noteq> []"
       and "list_all2 (\<lambda>A X. table n A X \<and> wf_set n A) (A_pos @ A_neg) L"
   shows "z \<in> mmulti_join n A_pos A_neg L \<longleftrightarrow> wf_tuple n (\<Union>A\<in>set A_pos. A) z \<and>
     list_all2 (\<lambda>A X. restrict A z \<in> X) A_pos (take (length A_pos) L) \<and>
     list_all2 (\<lambda>A X. restrict A z \<notin> X) A_neg (drop (length A_pos) L)"
   unfolding mmulti_join_link[OF assms] using mmulti_join'_correct[OF assms] .
 
+(*<*)
 end
+(*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Optimized_MTL.thy b/thys/MFODL_Monitor_Optimized/Optimized_MTL.thy
--- a/thys/MFODL_Monitor_Optimized/Optimized_MTL.thy
+++ b/thys/MFODL_Monitor_Optimized/Optimized_MTL.thy
@@ -1,3065 +1,3067 @@
 (*<*)
 theory Optimized_MTL
   imports Monitor
 begin
 (*>*)
 
 section \<open>Efficient implementation of temporal operators\<close>
 
 subsection \<open>Optimized queue data structure\<close>
 
 lemma less_enat_iff: "a < enat i \<longleftrightarrow> (\<exists>j. a = enat j \<and> j < i)"
   by (cases a) auto
 
 type_synonym 'a queue_t = "'a list \<times> 'a list"
 
 definition queue_invariant :: "'a queue_t \<Rightarrow> bool" where
   "queue_invariant q = (case q of ([], []) \<Rightarrow> True | (fs, l # ls) \<Rightarrow> True | _ \<Rightarrow> False)"
 
 typedef 'a queue = "{q :: 'a queue_t. queue_invariant q}"
   by (auto simp: queue_invariant_def split: list.splits)
 
 setup_lifting type_definition_queue
 
 lift_definition linearize :: "'a queue \<Rightarrow> 'a list" is "(\<lambda>q. case q of (fs, ls) \<Rightarrow> fs @ rev ls)" .
 
 lift_definition empty_queue :: "'a queue" is "([], [])"
   by (auto simp: queue_invariant_def split: list.splits)
 
 lemma empty_queue_rep: "linearize empty_queue = []"
   by transfer (simp add: empty_queue_def linearize_def)
 
 lift_definition is_empty :: "'a queue \<Rightarrow> bool" is "\<lambda>q. (case q of ([], []) \<Rightarrow> True | _ \<Rightarrow> False)" .
 
 lemma linearize_t_Nil: "(case q of (fs, ls) \<Rightarrow> fs @ rev ls) = [] \<longleftrightarrow> q = ([], [])"
   by (auto split: prod.splits)
 
 lemma is_empty_alt: "is_empty q \<longleftrightarrow> linearize q = []"
   by transfer (auto simp: linearize_t_Nil list.case_eq_if)
 
 fun prepend_queue_t :: "'a \<Rightarrow> 'a queue_t \<Rightarrow> 'a queue_t" where
   "prepend_queue_t a ([], []) = ([], [a])"
 | "prepend_queue_t a (fs, l # ls) = (a # fs, l # ls)"
 | "prepend_queue_t a (f # fs, []) = undefined"
 
 lift_definition prepend_queue :: "'a \<Rightarrow> 'a queue \<Rightarrow> 'a queue" is prepend_queue_t
   by (auto simp: queue_invariant_def split: list.splits elim: prepend_queue_t.elims)
 
 lemma prepend_queue_rep: "linearize (prepend_queue a q) = a # linearize q"
   by transfer
     (auto simp add: queue_invariant_def linearize_def elim: prepend_queue_t.elims split: prod.splits)
 
 lift_definition append_queue :: "'a \<Rightarrow> 'a queue \<Rightarrow> 'a queue" is
   "(\<lambda>a q. case q of (fs, ls) \<Rightarrow> (fs, a # ls))"
   by (auto simp: queue_invariant_def split: list.splits)
 
 lemma append_queue_rep: "linearize (append_queue a q) = linearize q @ [a]"
   by transfer (auto simp add: linearize_def split: prod.splits)
 
 fun safe_last_t :: "'a queue_t \<Rightarrow> 'a option \<times> 'a queue_t" where
   "safe_last_t ([], []) = (None, ([], []))"
 | "safe_last_t (fs, l # ls) = (Some l, (fs, l # ls))"
 | "safe_last_t (f # fs, []) = undefined"
 
 lift_definition safe_last :: "'a queue \<Rightarrow> 'a option \<times> 'a queue" is safe_last_t
   by (auto simp: queue_invariant_def split: prod.splits list.splits)
 
 lemma safe_last_rep: "safe_last q = (\<alpha>, q') \<Longrightarrow> linearize q = linearize q' \<and>
   (case \<alpha> of None \<Rightarrow> linearize q = [] | Some a \<Rightarrow> linearize q \<noteq> [] \<and> a = last (linearize q))"
   by transfer (auto simp: queue_invariant_def split: list.splits elim: safe_last_t.elims)
 
 fun safe_hd_t :: "'a queue_t \<Rightarrow> 'a option \<times> 'a queue_t" where
   "safe_hd_t ([], []) = (None, ([], []))"
 | "safe_hd_t ([], [l]) = (Some l, ([], [l]))"
 | "safe_hd_t ([], l # ls) = (let fs = rev ls in (Some (hd fs), (fs, [l])))"
 | "safe_hd_t (f # fs, l # ls) = (Some f, (f # fs, l # ls))"
 | "safe_hd_t (f # fs, []) = undefined"
 
 lift_definition(code_dt) safe_hd :: "'a queue \<Rightarrow> 'a option \<times> 'a queue" is safe_hd_t
 proof -
   fix q :: "'a queue_t"
   assume "queue_invariant q"
   then show "pred_prod \<top> queue_invariant (safe_hd_t q)"
     by (cases q rule: safe_hd_t.cases) (auto simp: queue_invariant_def Let_def split: list.split)
 qed
 
 lemma safe_hd_rep: "safe_hd q = (\<alpha>, q') \<Longrightarrow> linearize q = linearize q' \<and>
   (case \<alpha> of None \<Rightarrow> linearize q = [] | Some a \<Rightarrow> linearize q \<noteq> [] \<and> a = hd (linearize q))"
   by transfer
     (auto simp add: queue_invariant_def Let_def hd_append split: list.splits elim: safe_hd_t.elims)
 
 fun replace_hd_t :: "'a \<Rightarrow> 'a queue_t \<Rightarrow> 'a queue_t" where
   "replace_hd_t a ([], []) = ([], [])"
 | "replace_hd_t a ([], [l]) = ([], [a])"
 | "replace_hd_t a ([], l # ls) = (let fs = rev ls in (a # tl fs, [l]))"
 | "replace_hd_t a (f # fs, l # ls) = (a # fs, l # ls)"
 | "replace_hd_t a (f # fs, []) = undefined"
 
 lift_definition replace_hd :: "'a \<Rightarrow> 'a queue \<Rightarrow> 'a queue" is replace_hd_t
   by (auto simp: queue_invariant_def split: list.splits elim: replace_hd_t.elims)
 
 lemma tl_append: "xs \<noteq> [] \<Longrightarrow> tl xs @ ys = tl (xs @ ys)"
   by simp
 
 lemma replace_hd_rep: "linearize q = f # fs \<Longrightarrow> linearize (replace_hd a q) = a # fs"
 proof (transfer fixing: f fs a)
   fix q
   assume "queue_invariant q" and "(case q of (fs, ls) \<Rightarrow> fs @ rev ls) = f # fs"
   then show "(case replace_hd_t a q of (fs, ls) \<Rightarrow> fs @ rev ls) = a # fs"
     by (cases "(a, q)" rule: replace_hd_t.cases) (auto simp: queue_invariant_def tl_append)
 qed
 
 fun replace_last_t :: "'a \<Rightarrow> 'a queue_t \<Rightarrow> 'a queue_t" where
   "replace_last_t a ([], []) = ([], [])"
 | "replace_last_t a (fs, l # ls) = (fs, a # ls)"
 | "replace_last_t a (fs, []) = undefined"
 
 lift_definition replace_last :: "'a \<Rightarrow> 'a queue \<Rightarrow> 'a queue" is replace_last_t
   by (auto simp: queue_invariant_def split: list.splits elim: replace_last_t.elims)
 
 lemma replace_last_rep: "linearize q = fs @ [f] \<Longrightarrow> linearize (replace_last a q) = fs @ [a]"
   by transfer (auto simp: queue_invariant_def split: list.splits prod.splits elim!: replace_last_t.elims)
 
 fun tl_queue_t :: "'a queue_t \<Rightarrow> 'a queue_t" where
   "tl_queue_t ([], []) = ([], [])"
 | "tl_queue_t ([], [l]) = ([], [])"
 | "tl_queue_t ([], l # ls) = (tl (rev ls), [l])"
 | "tl_queue_t (a # as, fs) = (as, fs)"
 
 lift_definition tl_queue :: "'a queue \<Rightarrow> 'a queue" is tl_queue_t
   by (auto simp: queue_invariant_def split: list.splits elim!: tl_queue_t.elims)
 
 lemma tl_queue_rep: "\<not>is_empty q \<Longrightarrow> linearize (tl_queue q) = tl (linearize q)"
   by transfer (auto simp: tl_append split: prod.splits list.splits elim!: tl_queue_t.elims)
 
 lemma length_tl_queue_rep: "\<not>is_empty q \<Longrightarrow>
   length (linearize (tl_queue q)) < length (linearize q)"
   by transfer (auto split: prod.splits list.splits elim: tl_queue_t.elims)
 
 lemma length_tl_queue_safe_hd:
   assumes "safe_hd q = (Some a, q')"
   shows "length (linearize (tl_queue q')) < length (linearize q)"
   using safe_hd_rep[OF assms]
   by (auto simp add: length_tl_queue_rep is_empty_alt)
 
 function dropWhile_queue :: "('a \<Rightarrow> bool) \<Rightarrow> 'a queue \<Rightarrow> 'a queue" where
   "dropWhile_queue f q = (case safe_hd q of (None, q') \<Rightarrow> q'
   | (Some a, q') \<Rightarrow> if f a then dropWhile_queue f (tl_queue q') else q')"
   by pat_completeness auto
 termination
   using length_tl_queue_safe_hd[OF sym]
   by (relation "measure (\<lambda>(f, q). length (linearize q))") (fastforce split: prod.splits)+
 
 lemma dropWhile_hd_tl: "xs \<noteq> [] \<Longrightarrow>
   dropWhile P xs = (if P (hd xs) then dropWhile P (tl xs) else xs)"
   by (cases xs) auto
 
 lemma dropWhile_queue_rep: "linearize (dropWhile_queue f q) = dropWhile f (linearize q)"
   by (induction f q rule: dropWhile_queue.induct)
      (auto simp add: tl_queue_rep dropWhile_hd_tl is_empty_alt
       split: prod.splits option.splits dest: safe_hd_rep)
 
 function takeWhile_queue :: "('a \<Rightarrow> bool) \<Rightarrow> 'a queue \<Rightarrow> 'a queue" where
   "takeWhile_queue f q = (case safe_hd q of (None, q') \<Rightarrow> q'
   | (Some a, q') \<Rightarrow> if f a
     then prepend_queue a (takeWhile_queue f (tl_queue q'))
     else empty_queue)"
   by pat_completeness auto
 termination
   using length_tl_queue_safe_hd[OF sym]
   by (relation "measure (\<lambda>(f, q). length (linearize q))") (fastforce split: prod.splits)+
 
 lemma takeWhile_hd_tl: "xs \<noteq> [] \<Longrightarrow>
   takeWhile P xs = (if P (hd xs) then hd xs # takeWhile P (tl xs) else [])"
   by (cases xs) auto
 
 lemma takeWhile_queue_rep: "linearize (takeWhile_queue f q) = takeWhile f (linearize q)"
   by (induction f q rule: takeWhile_queue.induct)
      (auto simp add: prepend_queue_rep tl_queue_rep empty_queue_rep takeWhile_hd_tl is_empty_alt
       split: prod.splits option.splits dest: safe_hd_rep)
 
 function takedropWhile_queue :: "('a \<Rightarrow> bool) \<Rightarrow> 'a queue \<Rightarrow> 'a queue \<times> 'a list" where
   "takedropWhile_queue f q = (case safe_hd q of (None, q') \<Rightarrow> (q', [])
   | (Some a, q') \<Rightarrow> if f a
     then (case takedropWhile_queue f (tl_queue q') of (q'', as) \<Rightarrow> (q'', a # as))
     else (q', []))"
   by pat_completeness auto
 termination
   using length_tl_queue_safe_hd[OF sym]
   by (relation "measure (\<lambda>(f, q). length (linearize q))") (fastforce split: prod.splits)+
 
 lemma takedropWhile_queue_fst: "fst (takedropWhile_queue f q) = dropWhile_queue f q"
 proof (induction f q rule: takedropWhile_queue.induct)
   case (1 f q)
   then show ?case
     by (simp split: prod.splits) (auto simp add: case_prod_unfold split: option.splits)
 qed
 
 lemma takedropWhile_queue_snd: "snd (takedropWhile_queue f q) = takeWhile f (linearize q)"
 proof (induction f q rule: takedropWhile_queue.induct)
   case (1 f q)
   then show ?case
     by (simp split: prod.splits)
       (auto simp add: case_prod_unfold tl_queue_rep takeWhile_hd_tl is_empty_alt
         split: option.splits dest: safe_hd_rep)
 qed
 
 subsection \<open>Optimized data structure for Since\<close>
 
 type_synonym 'a mmsaux = "ts \<times> ts \<times> bool list \<times> bool list \<times>
   (ts \<times> 'a table) queue \<times> (ts \<times> 'a table) queue \<times>
   (('a tuple, ts) mapping) \<times> (('a tuple, ts) mapping)"
 
 fun time_mmsaux :: "'a mmsaux \<Rightarrow> ts" where
   "time_mmsaux aux = (case aux of (nt, _) \<Rightarrow> nt)"
 
 definition ts_tuple_rel :: "(ts \<times> 'a table) set \<Rightarrow> (ts \<times> 'a tuple) set" where
   "ts_tuple_rel ys = {(t, as). \<exists>X. as \<in> X \<and> (t, X) \<in> ys}"
 
 lemma finite_fst_ts_tuple_rel: "finite (fst ` {tas \<in> ts_tuple_rel (set xs). P tas})"
 proof -
   have "fst ` {tas \<in> ts_tuple_rel (set xs). P tas} \<subseteq> fst ` ts_tuple_rel (set xs)"
     by auto
   moreover have "\<dots> \<subseteq> set (map fst xs)"
     by (force simp add: ts_tuple_rel_def)
   finally show ?thesis
     using finite_subset by blast
 qed
 
 lemma ts_tuple_rel_ext_Cons: "tas \<in> ts_tuple_rel {(nt, X)} \<Longrightarrow>
   tas \<in> ts_tuple_rel (set ((nt, X) # tass))"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_ext_Cons': "tas \<in> ts_tuple_rel (set tass) \<Longrightarrow>
   tas \<in> ts_tuple_rel (set ((nt, X) # tass))"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_intro: "as \<in> X \<Longrightarrow> (t, X) \<in> ys \<Longrightarrow> (t, as) \<in> ts_tuple_rel ys"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_dest: "(t, as) \<in> ts_tuple_rel ys \<Longrightarrow> \<exists>X. (t, X) \<in> ys \<and> as \<in> X"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_Un: "ts_tuple_rel (ys \<union> zs) = ts_tuple_rel ys \<union> ts_tuple_rel zs"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_ext: "tas \<in> ts_tuple_rel {(nt, X)} \<Longrightarrow>
   tas \<in> ts_tuple_rel (set ((nt, Y \<union> X) # tass))"
 proof -
   assume assm: "tas \<in> ts_tuple_rel {(nt, X)}"
   then obtain as where tas_def: "tas = (nt, as)" "as \<in> X"
     by (cases tas) (auto simp add: ts_tuple_rel_def)
   then have "as \<in> Y \<union> X"
     by auto
   then show "tas \<in> ts_tuple_rel (set ((nt, Y \<union> X) # tass))"
     unfolding tas_def(1)
     by (rule ts_tuple_rel_intro) auto
 qed
 
 lemma ts_tuple_rel_ext': "tas \<in> ts_tuple_rel (set ((nt, X) # tass)) \<Longrightarrow>
   tas \<in> ts_tuple_rel (set ((nt, X \<union> Y) # tass))"
 proof -
   assume assm: "tas \<in> ts_tuple_rel (set ((nt, X) # tass))"
   then have "tas \<in> ts_tuple_rel {(nt, X)} \<union> ts_tuple_rel (set tass)"
     using ts_tuple_rel_Un by force
   then show "tas \<in> ts_tuple_rel (set ((nt, X \<union> Y) # tass))"
   proof
     assume "tas \<in> ts_tuple_rel {(nt, X)}"
     then show ?thesis
       by (auto simp: Un_commute dest!: ts_tuple_rel_ext)
   next
     assume "tas \<in> ts_tuple_rel (set tass)"
     then have "tas \<in> ts_tuple_rel (set ((nt, X \<union> Y) # tass))"
       by (rule ts_tuple_rel_ext_Cons')
     then show ?thesis by simp
   qed
 qed
 
 lemma ts_tuple_rel_mono: "ys \<subseteq> zs \<Longrightarrow> ts_tuple_rel ys \<subseteq> ts_tuple_rel zs"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_filter: "ts_tuple_rel (set (filter (\<lambda>(t, X). P t) xs)) =
   {(t, X) \<in> ts_tuple_rel (set xs). P t}"
   by (auto simp add: ts_tuple_rel_def)
 
 lemma ts_tuple_rel_set_filter: "x \<in> ts_tuple_rel (set (filter P xs)) \<Longrightarrow>
   x \<in> ts_tuple_rel (set xs)"
   by (auto simp add: ts_tuple_rel_def)
 
 definition valid_tuple :: "(('a tuple, ts) mapping) \<Rightarrow> (ts \<times> 'a tuple) \<Rightarrow> bool" where
   "valid_tuple tuple_since = (\<lambda>(t, as). case Mapping.lookup tuple_since as of None \<Rightarrow> False
   | Some t' \<Rightarrow> t \<ge> t')"
 
 definition safe_max :: "'a :: linorder set \<Rightarrow> 'a option" where
   "safe_max X = (if X = {} then None else Some (Max X))"
 
 lemma safe_max_empty: "safe_max X = None \<longleftrightarrow> X = {}"
   by (simp add: safe_max_def)
 
 lemma safe_max_empty_dest: "safe_max X = None \<Longrightarrow> X = {}"
   by (simp add: safe_max_def split: if_splits)
 
 lemma safe_max_Some_intro: "x \<in> X \<Longrightarrow> \<exists>y. safe_max X = Some y"
   using safe_max_empty by auto
 
 lemma safe_max_Some_dest_in: "finite X \<Longrightarrow> safe_max X = Some x \<Longrightarrow> x \<in> X"
   using Max_in by (auto simp add: safe_max_def split: if_splits)
 
 lemma safe_max_Some_dest_le: "finite X \<Longrightarrow> safe_max X = Some x \<Longrightarrow> y \<in> X \<Longrightarrow> y \<le> x"
   using Max_ge by (auto simp add: safe_max_def split: if_splits)
 
 fun valid_mmsaux :: "args \<Rightarrow> ts \<Rightarrow> 'a mmsaux \<Rightarrow> 'a Monitor.msaux \<Rightarrow> bool" where
   "valid_mmsaux args cur (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) ys \<longleftrightarrow>
     (args_L args) \<subseteq> (args_R args) \<and>
     maskL = join_mask (args_n args) (args_L args) \<and>
     maskR = join_mask (args_n args) (args_R args) \<and>
     (\<forall>(t, X) \<in> set ys. table (args_n args) (args_R args) X) \<and>
     table (args_n args) (args_R args) (Mapping.keys tuple_in) \<and>
     table (args_n args) (args_R args) (Mapping.keys tuple_since) \<and>
     (\<forall>as \<in> \<Union>(snd ` (set (linearize data_prev))). wf_tuple (args_n args) (args_R args) as) \<and>
     cur = nt \<and>
     ts_tuple_rel (set ys) =
     {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union> set (linearize data_in)).
     valid_tuple tuple_since tas} \<and>
     sorted (map fst (linearize data_prev)) \<and>
     (\<forall>t \<in> fst ` set (linearize data_prev). t \<le> nt \<and> nt - t < left (args_ivl args)) \<and>
     sorted (map fst (linearize data_in)) \<and>
     (\<forall>t \<in> fst ` set (linearize data_in). t \<le> nt \<and> nt - t \<ge> left (args_ivl args)) \<and>
     (\<forall>as. Mapping.lookup tuple_in as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in)). valid_tuple tuple_since tas \<and> as = snd tas})) \<and>
     (\<forall>as \<in> Mapping.keys tuple_since. case Mapping.lookup tuple_since as of Some t \<Rightarrow> t \<le> nt)"
 
 lemma Mapping_lookup_filter_keys: "k \<in> Mapping.keys (Mapping.filter f m) \<Longrightarrow>
   Mapping.lookup (Mapping.filter f m) k = Mapping.lookup m k"
   by (metis default_def insert_subset keys_default keys_filter lookup_default lookup_default_filter)
 
 lemma Mapping_filter_keys: "(\<forall>k \<in> Mapping.keys m. P (Mapping.lookup m k)) \<Longrightarrow>
   (\<forall>k \<in> Mapping.keys (Mapping.filter f m). P (Mapping.lookup (Mapping.filter f m) k))"
   using Mapping_lookup_filter_keys Mapping.keys_filter by fastforce
 
 lemma Mapping_filter_keys_le: "(\<And>x. P x \<Longrightarrow> P' x) \<Longrightarrow>
   (\<forall>k \<in> Mapping.keys m. P (Mapping.lookup m k)) \<Longrightarrow> (\<forall>k \<in> Mapping.keys m. P' (Mapping.lookup m k))"
   by auto
 
 lemma Mapping_keys_dest: "x \<in> Mapping.keys f \<Longrightarrow> \<exists>y. Mapping.lookup f x = Some y"
   by (simp add: domD keys_dom_lookup)
 
 lemma Mapping_keys_intro: "Mapping.lookup f x \<noteq> None \<Longrightarrow> x \<in> Mapping.keys f"
   by (simp add: domIff keys_dom_lookup)
 
 lemma valid_mmsaux_tuple_in_keys: "valid_mmsaux args cur
   (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) ys \<Longrightarrow>
   Mapping.keys tuple_in = snd ` {tas \<in> ts_tuple_rel (set (linearize data_in)).
   valid_tuple tuple_since tas}"
   by (auto intro!: Mapping_keys_intro safe_max_Some_intro
       dest!: Mapping_keys_dest safe_max_Some_dest_in[OF finite_fst_ts_tuple_rel])+
 
 fun init_mmsaux :: "args \<Rightarrow> 'a mmsaux" where
   "init_mmsaux args = (0, 0, join_mask (args_n args) (args_L args),
   join_mask (args_n args) (args_R args), empty_queue, empty_queue, Mapping.empty, Mapping.empty)"
 
 lemma valid_init_mmsaux: "L \<subseteq> R \<Longrightarrow> valid_mmsaux (init_args I n L R b) 0
   (init_mmsaux (init_args I n L R b)) []"
   by (auto simp add: init_args_def empty_queue_rep ts_tuple_rel_def join_mask_def
       Mapping.lookup_empty safe_max_def table_def)
 
 abbreviation "filter_cond X' ts t' \<equiv> (\<lambda>as _. \<not> (as \<in> X' \<and> Mapping.lookup ts as = Some t'))"
 
 lemma dropWhile_filter:
   "sorted (map fst xs) \<Longrightarrow> \<forall>t \<in> fst ` set xs. t \<le> nt \<Longrightarrow>
   dropWhile (\<lambda>(t, X). enat (nt - t) > c) xs = filter (\<lambda>(t, X). enat (nt - t) \<le> c) xs"
   by (induction xs) (auto 0 3 intro!: filter_id_conv[THEN iffD2, symmetric] elim: order.trans[rotated])
 
 lemma dropWhile_filter':
   fixes nt :: nat
   shows "sorted (map fst xs) \<Longrightarrow> \<forall>t \<in> fst ` set xs. t \<le> nt \<Longrightarrow>
   dropWhile (\<lambda>(t, X). nt - t \<ge> c) xs = filter (\<lambda>(t, X). nt - t < c) xs"
   by (induction xs) (auto 0 3 intro!: filter_id_conv[THEN iffD2, symmetric] elim: order.trans[rotated])
 
 lemma dropWhile_filter'':
   "sorted xs \<Longrightarrow> \<forall>t \<in> set xs. t \<le> nt \<Longrightarrow>
   dropWhile (\<lambda>t. enat (nt - t) > c) xs = filter (\<lambda>t. enat (nt - t) \<le> c) xs"
   by (induction xs) (auto 0 3 intro!: filter_id_conv[THEN iffD2, symmetric] elim: order.trans[rotated])
 
 lemma takeWhile_filter:
   "sorted (map fst xs) \<Longrightarrow> \<forall>t \<in> fst ` set xs. t \<le> nt \<Longrightarrow>
   takeWhile (\<lambda>(t, X). enat (nt - t) > c) xs = filter (\<lambda>(t, X). enat (nt - t) > c) xs"
   by (induction xs) (auto 0 3 simp: less_enat_iff intro!: filter_empty_conv[THEN iffD2, symmetric])
 
 lemma takeWhile_filter':
   fixes nt :: nat
   shows "sorted (map fst xs) \<Longrightarrow> \<forall>t \<in> fst ` set xs. t \<le> nt \<Longrightarrow>
   takeWhile (\<lambda>(t, X). nt - t \<ge> c) xs = filter (\<lambda>(t, X). nt - t \<ge> c) xs"
   by (induction xs) (auto 0 3 simp: less_enat_iff intro!: filter_empty_conv[THEN iffD2, symmetric])
 
 lemma takeWhile_filter'':
   "sorted xs \<Longrightarrow> \<forall>t \<in> set xs. t \<le> nt \<Longrightarrow>
   takeWhile (\<lambda>t. enat (nt - t) > c) xs = filter (\<lambda>t. enat (nt - t) > c) xs"
   by (induction xs) (auto 0 3 simp: less_enat_iff intro!: filter_empty_conv[THEN iffD2, symmetric])
 
 lemma fold_Mapping_filter_None: "Mapping.lookup ts as = None \<Longrightarrow>
   Mapping.lookup (fold (\<lambda>(t, X) ts. Mapping.filter
   (filter_cond X ts t) ts) ds ts) as = None"
   by (induction ds arbitrary: ts) (auto simp add: Mapping.lookup_filter)
 
 lemma Mapping_lookup_filter_Some_P: "Mapping.lookup (Mapping.filter P m) k = Some v \<Longrightarrow> P k v"
   by (auto simp add: Mapping.lookup_filter split: option.splits if_splits)
 
 lemma Mapping_lookup_filter_None: "(\<And>v. \<not>P k v) \<Longrightarrow>
   Mapping.lookup (Mapping.filter P m) k = None"
   by (auto simp add: Mapping.lookup_filter split: option.splits)
 
 lemma Mapping_lookup_filter_Some: "(\<And>v. P k v) \<Longrightarrow>
   Mapping.lookup (Mapping.filter P m) k = Mapping.lookup m k"
   by (auto simp add: Mapping.lookup_filter split: option.splits)
 
 lemma Mapping_lookup_filter_not_None: "Mapping.lookup (Mapping.filter P m) k \<noteq> None \<Longrightarrow>
   Mapping.lookup (Mapping.filter P m) k = Mapping.lookup m k"
   by (auto simp add: Mapping.lookup_filter split: option.splits)
 
 lemma fold_Mapping_filter_Some_None: "Mapping.lookup ts as = Some t \<Longrightarrow>
   as \<in> X \<Longrightarrow> (t, X) \<in> set ds \<Longrightarrow>
   Mapping.lookup (fold (\<lambda>(t, X) ts. Mapping.filter (filter_cond X ts t) ts) ds ts) as = None"
 proof (induction ds arbitrary: ts)
   case (Cons a ds)
   show ?case
   proof (cases a)
     case (Pair t' X')
     with Cons show ?thesis
       using fold_Mapping_filter_None[of "Mapping.filter (filter_cond X' ts t') ts" as ds]
         Mapping_lookup_filter_not_None[of "filter_cond X' ts t'" ts as]
         fold_Mapping_filter_None[OF Mapping_lookup_filter_None, of _ as ds ts]
       by (cases "Mapping.lookup (Mapping.filter (filter_cond X' ts t') ts) as = None") auto
   qed
 qed simp
 
 lemma fold_Mapping_filter_Some_Some: "Mapping.lookup ts as = Some t \<Longrightarrow>
   (\<And>X. (t, X) \<in> set ds \<Longrightarrow> as \<notin> X) \<Longrightarrow>
   Mapping.lookup (fold (\<lambda>(t, X) ts. Mapping.filter (filter_cond X ts t) ts) ds ts) as = Some t"
 proof (induction ds arbitrary: ts)
   case (Cons a ds)
   then show ?case
   proof (cases a)
     case (Pair t' X')
     with Cons show ?thesis
       using Mapping_lookup_filter_Some[of "filter_cond X' ts t'" as ts] by auto
   qed
 qed simp
 
 fun shift_end :: "args \<Rightarrow> ts \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "shift_end args nt (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (let I = args_ivl args;
     data_prev' = dropWhile_queue (\<lambda>(t, X). enat (nt - t) > right I) data_prev;
     (data_in, discard) = takedropWhile_queue (\<lambda>(t, X). enat (nt - t) > right I) data_in;
     tuple_in = fold (\<lambda>(t, X) tuple_in. Mapping.filter
       (filter_cond X tuple_in t) tuple_in) discard tuple_in in
     (t, gc, maskL, maskR, data_prev', data_in, tuple_in, tuple_since))"
 
 lemma valid_shift_end_mmsaux_unfolded:
   assumes valid_before: "valid_mmsaux args cur
     (ot, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) auxlist"
   and nt_mono: "nt \<ge> cur"
   shows "valid_mmsaux args cur (shift_end args nt
     (ot, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     (filter (\<lambda>(t, rel). enat (nt - t) \<le> right (args_ivl args)) auxlist)"
 proof -
   define I where "I = args_ivl args"
   define data_in' where "data_in' \<equiv>
     fst (takedropWhile_queue (\<lambda>(t, X). enat (nt - t) > right I) data_in)"
   define data_prev' where "data_prev' \<equiv>
     dropWhile_queue (\<lambda>(t, X). enat (nt - t) > right I) data_prev"
   define discard where "discard \<equiv>
     snd (takedropWhile_queue (\<lambda>(t, X). enat (nt - t) > right I) data_in)"
   define tuple_in' where "tuple_in' \<equiv> fold (\<lambda>(t, X) tuple_in. Mapping.filter
     (\<lambda>as _. \<not>(as \<in> X \<and> Mapping.lookup tuple_in as = Some t)) tuple_in) discard tuple_in"
   have tuple_in_Some_None: "\<And>as t X. Mapping.lookup tuple_in as = Some t \<Longrightarrow>
     as \<in> X \<Longrightarrow> (t, X) \<in> set discard \<Longrightarrow> Mapping.lookup tuple_in' as = None"
     using fold_Mapping_filter_Some_None unfolding tuple_in'_def by fastforce
   have tuple_in_Some_Some: "\<And>as t. Mapping.lookup tuple_in as = Some t \<Longrightarrow>
     (\<And>X. (t, X) \<in> set discard \<Longrightarrow> as \<notin> X) \<Longrightarrow> Mapping.lookup tuple_in' as = Some t"
     using fold_Mapping_filter_Some_Some unfolding tuple_in'_def by fastforce
   have tuple_in_None_None: "\<And>as. Mapping.lookup tuple_in as = None \<Longrightarrow>
     Mapping.lookup tuple_in' as = None"
     using fold_Mapping_filter_None unfolding tuple_in'_def by fastforce
   have tuple_in'_keys: "\<And>as. as \<in> Mapping.keys tuple_in' \<Longrightarrow> as \<in> Mapping.keys tuple_in"
     using tuple_in_Some_None tuple_in_Some_Some tuple_in_None_None
     by (fastforce intro: Mapping_keys_intro dest: Mapping_keys_dest)
   have F1: "sorted (map fst (linearize data_in))" "\<forall>t \<in> fst ` set (linearize data_in). t \<le> nt"
     using valid_before nt_mono by auto
   have F2: "sorted (map fst (linearize data_prev))" "\<forall>t \<in> fst ` set (linearize data_prev). t \<le> nt"
     using valid_before nt_mono by auto
   have lin_data_in': "linearize data_in' =
     filter (\<lambda>(t, X). enat (nt - t) \<le> right I) (linearize data_in)"
     unfolding data_in'_def[unfolded takedropWhile_queue_fst] dropWhile_queue_rep
       dropWhile_filter[OF F1] ..
   then have set_lin_data_in': "set (linearize data_in') \<subseteq> set (linearize data_in)"
     by auto
   have "sorted (map fst (linearize data_in))"
     using valid_before by auto
   then have sorted_lin_data_in': "sorted (map fst (linearize data_in'))"
     unfolding lin_data_in' using sorted_filter by auto
   have discard_alt: "discard = filter (\<lambda>(t, X). enat (nt - t) > right I) (linearize data_in)"
     unfolding discard_def[unfolded takedropWhile_queue_snd] takeWhile_filter[OF F1] ..
   have lin_data_prev': "linearize data_prev' =
     filter (\<lambda>(t, X). enat (nt - t) \<le> right I) (linearize data_prev)"
     unfolding data_prev'_def[unfolded takedropWhile_queue_fst] dropWhile_queue_rep
       dropWhile_filter[OF F2] ..
   have "sorted (map fst (linearize data_prev))"
     using valid_before by auto
   then have sorted_lin_data_prev': "sorted (map fst (linearize data_prev'))"
     unfolding lin_data_prev' using sorted_filter by auto
   have lookup_tuple_in': "\<And>as. Mapping.lookup tuple_in' as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in')). valid_tuple tuple_since tas \<and> as = snd tas})"
   proof -
     fix as
     show "Mapping.lookup tuple_in' as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in')). valid_tuple tuple_since tas \<and> as = snd tas})"
     proof (cases "Mapping.lookup tuple_in as")
       case None
       then have "{tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since tas \<and> as = snd tas} = {}"
         using valid_before by (auto dest!: safe_max_empty_dest)
       then have "{tas \<in> ts_tuple_rel (set (linearize data_in')).
         valid_tuple tuple_since tas \<and> as = snd tas} = {}"
         using ts_tuple_rel_mono[OF set_lin_data_in'] by auto
       then show ?thesis
         unfolding tuple_in_None_None[OF None] using iffD2[OF safe_max_empty, symmetric] by blast
     next
       case (Some t)
       show ?thesis
       proof (cases "\<exists>X. (t, X) \<in> set discard \<and> as \<in> X")
         case True
         then obtain X where X_def: "(t, X) \<in> set discard" "as \<in> X"
           by auto
         have "enat (nt - t) > right I"
           using X_def(1) unfolding discard_alt by simp
         moreover have "\<And>t'. (t', as) \<in> ts_tuple_rel (set (linearize data_in)) \<Longrightarrow>
           valid_tuple tuple_since (t', as) \<Longrightarrow> t' \<le> t"
           using valid_before Some safe_max_Some_dest_le[OF finite_fst_ts_tuple_rel]
           by (fastforce simp add: image_iff)
         ultimately have "{tas \<in> ts_tuple_rel (set (linearize data_in')).
           valid_tuple tuple_since tas \<and> as = snd tas} = {}"
           unfolding lin_data_in' using ts_tuple_rel_set_filter
           by (auto simp add: ts_tuple_rel_def)
              (meson diff_le_mono2 enat_ord_simps(2) leD le_less_trans)
         then show ?thesis
           unfolding tuple_in_Some_None[OF Some X_def(2,1)]
           using iffD2[OF safe_max_empty, symmetric] by blast
       next
         case False
         then have lookup_Some: "Mapping.lookup tuple_in' as = Some t"
           using tuple_in_Some_Some[OF Some] by auto
         have t_as: "(t, as) \<in> ts_tuple_rel (set (linearize data_in))"
           "valid_tuple tuple_since (t, as)"
           using valid_before Some by (auto dest: safe_max_Some_dest_in[OF finite_fst_ts_tuple_rel])
         then obtain X where X_def: "as \<in> X" "(t, X) \<in> set (linearize data_in)"
           by (auto simp add: ts_tuple_rel_def)
         have "(t, X) \<in> set (linearize data_in')"
           using X_def False unfolding discard_alt lin_data_in' by auto
         then have t_in_fst: "t \<in> fst ` {tas \<in> ts_tuple_rel (set (linearize data_in')).
           valid_tuple tuple_since tas \<and> as = snd tas}"
           using t_as(2) X_def(1) by (auto simp add: ts_tuple_rel_def image_iff)
         have "\<And>t'. (t', as) \<in> ts_tuple_rel (set (linearize data_in)) \<Longrightarrow>
           valid_tuple tuple_since (t', as) \<Longrightarrow> t' \<le> t"
           using valid_before Some safe_max_Some_dest_le[OF finite_fst_ts_tuple_rel]
           by (fastforce simp add: image_iff)
         then have "Max (fst ` {tas \<in> ts_tuple_rel (set (linearize data_in')).
           valid_tuple tuple_since tas \<and> as = snd tas}) = t"
           using Max_eqI[OF finite_fst_ts_tuple_rel, OF _ t_in_fst]
             ts_tuple_rel_mono[OF set_lin_data_in'] by fastforce
         then show ?thesis
           unfolding lookup_Some using t_in_fst by (auto simp add: safe_max_def)
       qed
     qed
   qed
   have table_in: "table (args_n args) (args_R args) (Mapping.keys tuple_in')"
     using tuple_in'_keys valid_before by (auto simp add: table_def)
   have "ts_tuple_rel (set auxlist) =
     {as \<in> ts_tuple_rel (set (linearize data_prev) \<union> set (linearize data_in)).
     valid_tuple tuple_since as}"
     using valid_before by auto
   then have "ts_tuple_rel (set (filter (\<lambda>(t, rel). enat (nt - t) \<le> right I) auxlist)) =
     {as \<in> ts_tuple_rel (set (linearize data_prev') \<union> set (linearize data_in')).
     valid_tuple tuple_since as}"
     unfolding lin_data_prev' lin_data_in' ts_tuple_rel_Un ts_tuple_rel_filter by auto
   then show ?thesis
     using data_prev'_def data_in'_def tuple_in'_def discard_def valid_before nt_mono
       sorted_lin_data_prev' sorted_lin_data_in' lin_data_prev' lin_data_in' lookup_tuple_in'
       table_in unfolding I_def
     by (auto simp only: valid_mmsaux.simps shift_end.simps Let_def split: prod.splits) auto
       (* takes long *)
 qed
 
 lemma valid_shift_end_mmsaux: "valid_mmsaux args cur aux auxlist \<Longrightarrow> nt \<ge> cur \<Longrightarrow>
   valid_mmsaux args cur (shift_end args nt aux)
   (filter (\<lambda>(t, rel). enat (nt - t) \<le> right (args_ivl args)) auxlist)"
   using valid_shift_end_mmsaux_unfolded by (cases aux) fast
 
 setup_lifting type_definition_mapping
 
 lift_definition upd_set :: "('a, 'b) mapping \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> ('a, 'b) mapping" is
   "\<lambda>m f X a. if a \<in> X then Some (f a) else m a" .
 
 lemma Mapping_lookup_upd_set: "Mapping.lookup (upd_set m f X) a =
   (if a \<in> X then Some (f a) else Mapping.lookup m a)"
   by (simp add: Mapping.lookup.rep_eq upd_set.rep_eq)
 
 lemma Mapping_upd_set_keys: "Mapping.keys (upd_set m f X) = Mapping.keys m \<union> X"
   by (auto simp add: Mapping_lookup_upd_set dest!: Mapping_keys_dest intro: Mapping_keys_intro)
 
 lift_definition upd_keys_on :: "('a, 'b) mapping \<Rightarrow> ('a \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow>
   ('a, 'b) mapping" is
   "\<lambda>m f X a. case Mapping.lookup m a of Some b \<Rightarrow> Some (if a \<in> X then f a b else b)
   | None \<Rightarrow> None" .
 
 lemma Mapping_lookup_upd_keys_on: "Mapping.lookup (upd_keys_on m f X) a =
   (case Mapping.lookup m a of Some b \<Rightarrow> Some (if a \<in> X then f a b else b) | None \<Rightarrow> None)"
   by (simp add: Mapping.lookup.rep_eq upd_keys_on.rep_eq)
 
 lemma Mapping_upd_keys_sub: "Mapping.keys (upd_keys_on m f X) = Mapping.keys m"
   by (auto simp add: Mapping_lookup_upd_keys_on dest!: Mapping_keys_dest intro: Mapping_keys_intro
       split: option.splits)
 
 lemma fold_append_queue_rep: "linearize (fold (\<lambda>x q. append_queue x q) xs q) = linearize q @ xs"
   by (induction xs arbitrary: q) (auto simp add: append_queue_rep)
 
 lemma Max_Un_absorb:
   assumes "finite X" "X \<noteq> {}" "finite Y" "(\<And>x y. y \<in> Y \<Longrightarrow> x \<in> X \<Longrightarrow> y \<le> x)"
   shows "Max (X \<union> Y) = Max X"
 proof -
   have Max_X_in_X: "Max X \<in> X"
     using Max_in[OF assms(1,2)] .
   have Max_X_in_XY: "Max X \<in> X \<union> Y"
     using Max_in[OF assms(1,2)] by auto
   have fin: "finite (X \<union> Y)"
     using assms(1,3) by auto
   have Y_le_Max_X: "\<And>y. y \<in> Y \<Longrightarrow> y \<le> Max X"
     using assms(4)[OF _ Max_X_in_X] .
   have XY_le_Max_X: "\<And>y. y \<in> X \<union> Y \<Longrightarrow> y \<le> Max X"
     using Max_ge[OF assms(1)] Y_le_Max_X by auto
   show ?thesis
     using Max_eqI[OF fin XY_le_Max_X Max_X_in_XY] by auto
 qed
 
 lemma Mapping_lookup_fold_upd_set_idle: "{(t, X) \<in> set xs. as \<in> Z X t} = {} \<Longrightarrow>
   Mapping.lookup (fold (\<lambda>(t, X) m. upd_set m (\<lambda>_. t) (Z X t)) xs m) as = Mapping.lookup m as"
 proof (induction xs arbitrary: m)
   case Nil
   then show ?case by simp
 next
   case (Cons x xs)
   obtain x1 x2 where "x = (x1, x2)" by (cases x)
   have "Mapping.lookup (fold (\<lambda>(t, X) m. upd_set m (\<lambda>_. t) (Z X t)) xs (upd_set m (\<lambda>_. x1) (Z x2 x1))) as =
     Mapping.lookup (upd_set m (\<lambda>_. x1) (Z x2 x1)) as"
     using Cons by auto
   also have "Mapping.lookup (upd_set m (\<lambda>_. x1) (Z x2 x1)) as = Mapping.lookup m as"
     using Cons.prems by (auto simp: \<open>x = (x1, x2)\<close> Mapping_lookup_upd_set)
   finally show ?case by (simp add: \<open>x = (x1, x2)\<close>)
 qed
 
 lemma Mapping_lookup_fold_upd_set_max: "{(t, X) \<in> set xs. as \<in> Z X t} \<noteq> {} \<Longrightarrow>
   sorted (map fst xs) \<Longrightarrow>
   Mapping.lookup (fold (\<lambda>(t, X) m. upd_set m (\<lambda>_. t) (Z X t)) xs m) as =
   Some (Max (fst ` {(t, X) \<in> set xs. as \<in> Z X t}))"
 proof (induction xs arbitrary: m)
   case (Cons x xs)
   obtain t X where tX_def: "x = (t, X)"
     by (cases x) auto
   have set_fst_eq: "(fst ` {(t, X). (t, X) \<in> set (x # xs) \<and> as \<in> Z X t}) =
     ((fst ` {(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t}) \<union>
     (if as \<in> Z X t then {t} else {}))"
     using image_iff by (fastforce simp add: tX_def split: if_splits)
   show ?case
   proof (cases "{(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t} \<noteq> {}")
     case True
     have "{(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t} \<subseteq> set xs"
       by auto
     then have fin: "finite (fst ` {(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t})"
       by (simp add: finite_subset)
     have "Max (insert t (fst ` {(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t})) =
       Max (fst ` {(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t})"
       using Max_Un_absorb[OF fin, of "{t}"] True Cons(3) tX_def by auto
     then show ?thesis
       using Cons True unfolding set_fst_eq by auto
   next
     case False
     then have empty: "{(t, X). (t, X) \<in> set xs \<and> as \<in> Z X t} = {}"
       by auto
     then have "as \<in> Z X t"
       using Cons(2) set_fst_eq by fastforce
     then show ?thesis
       using Mapping_lookup_fold_upd_set_idle[OF empty] unfolding set_fst_eq empty
       by (auto simp add: Mapping_lookup_upd_set tX_def)
   qed
 qed simp
 
 fun add_new_ts_mmsaux' :: "args \<Rightarrow> ts \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "add_new_ts_mmsaux' args nt (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (let I = args_ivl args;
     (data_prev, move) = takedropWhile_queue (\<lambda>(t, X). nt - t \<ge> left I) data_prev;
     data_in = fold (\<lambda>(t, X) data_in. append_queue (t, X) data_in) move data_in;
     tuple_in = fold (\<lambda>(t, X) tuple_in. upd_set tuple_in (\<lambda>_. t)
       {as \<in> X. valid_tuple tuple_since (t, as)}) move tuple_in in
     (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))"
 
 lemma Mapping_keys_fold_upd_set: "k \<in> Mapping.keys (fold (\<lambda>(t, X) m. upd_set m (\<lambda>_. t) (Z t X))
   xs m) \<Longrightarrow> k \<in> Mapping.keys m \<or> (\<exists>(t, X) \<in> set xs. k \<in> Z t X)"
   by (induction xs arbitrary: m) (fastforce simp add: Mapping_upd_set_keys)+
 
 lemma valid_add_new_ts_mmsaux'_unfolded:
   assumes valid_before: "valid_mmsaux args cur
     (ot, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) auxlist"
   and nt_mono: "nt \<ge> cur"
   shows "valid_mmsaux args nt (add_new_ts_mmsaux' args nt
     (ot, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since)) auxlist"
 proof -
   define I where "I = args_ivl args"
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   define data_prev' where "data_prev' \<equiv> dropWhile_queue (\<lambda>(t, X). nt - t \<ge> left I) data_prev"
   define move where "move \<equiv> takeWhile (\<lambda>(t, X). nt - t \<ge> left I) (linearize data_prev)"
   define data_in' where "data_in' \<equiv> fold (\<lambda>(t, X) data_in. append_queue (t, X) data_in)
     move data_in"
   define tuple_in' where "tuple_in' \<equiv> fold (\<lambda>(t, X) tuple_in. upd_set tuple_in (\<lambda>_. t)
       {as \<in> X. valid_tuple tuple_since (t, as)}) move tuple_in"
   have tuple_in'_keys: "\<And>as. as \<in> Mapping.keys tuple_in' \<Longrightarrow> as \<in> Mapping.keys tuple_in \<or>
     (\<exists>(t, X)\<in>set move. as \<in> {as \<in> X. valid_tuple tuple_since (t, as)})"
     using Mapping_keys_fold_upd_set[of _ "\<lambda>t X. {as \<in> X. valid_tuple tuple_since (t, as)}"]
     by (auto simp add: tuple_in'_def)
   have F1: "sorted (map fst (linearize data_in))" "\<forall>t \<in> fst ` set (linearize data_in). t \<le> nt"
     "\<forall>t \<in> fst ` set (linearize data_in). t \<le> ot \<and> ot - t \<ge> left I"
     using valid_before nt_mono unfolding I_def by auto
   have F2: "sorted (map fst (linearize data_prev))" "\<forall>t \<in> fst ` set (linearize data_prev). t \<le> nt"
     "\<forall>t \<in> fst ` set (linearize data_prev). t \<le> ot \<and> ot - t < left I"
     using valid_before nt_mono unfolding I_def by auto
   have lin_data_prev': "linearize data_prev' =
     filter (\<lambda>(t, X). nt - t < left I) (linearize data_prev)"
     unfolding data_prev'_def dropWhile_queue_rep dropWhile_filter'[OF F2(1,2)] ..
   have move_filter: "move = filter (\<lambda>(t, X). nt - t \<ge> left I) (linearize data_prev)"
     unfolding move_def takeWhile_filter'[OF F2(1,2)] ..
   then have sorted_move: "sorted (map fst move)"
     using sorted_filter F2 by auto
   have "\<forall>t\<in>fst ` set move. t \<le> ot \<and> ot - t < left I"
     using move_filter F2(3) set_filter by auto
   then have fst_set_before: "\<forall>t\<in>fst ` set (linearize data_in). \<forall>t'\<in>fst ` set move. t \<le> t'"
     using F1(3) by fastforce
   then have fst_ts_tuple_rel_before: "\<forall>t\<in>fst ` ts_tuple_rel (set (linearize data_in)).
     \<forall>t'\<in>fst ` ts_tuple_rel (set move). t \<le> t'"
     by (fastforce simp add: ts_tuple_rel_def)
   have sorted_lin_data_prev': "sorted (map fst (linearize data_prev'))"
     unfolding lin_data_prev' using sorted_filter F2 by auto
   have lin_data_in': "linearize data_in' = linearize data_in @ move"
     unfolding data_in'_def using fold_append_queue_rep by fastforce
   have sorted_lin_data_in': "sorted (map fst (linearize data_in'))"
     unfolding lin_data_in' using F1(1) sorted_move fst_set_before by (simp add: sorted_append)
   have set_lin_prev'_in': "set (linearize data_prev') \<union> set (linearize data_in') =
     set (linearize data_prev) \<union> set (linearize data_in)"
     using lin_data_prev' lin_data_in' move_filter by auto
   have ts_tuple_rel': "ts_tuple_rel (set auxlist) =
     {tas \<in> ts_tuple_rel (set (linearize data_prev') \<union> set (linearize data_in')).
     valid_tuple tuple_since tas}"
     unfolding set_lin_prev'_in' using valid_before by auto
   have lookup': "\<And>as. Mapping.lookup tuple_in' as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in')).
     valid_tuple tuple_since tas \<and> as = snd tas})"
   proof -
     fix as
     show "Mapping.lookup tuple_in' as = safe_max (fst `
       {tas \<in> ts_tuple_rel (set (linearize data_in')).
       valid_tuple tuple_since tas \<and> as = snd tas})"
     proof (cases "{(t, X) \<in> set move. as \<in> X \<and> valid_tuple tuple_since (t, as)} = {}")
       case True
       have move_absorb: "{tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since tas \<and> as = snd tas} =
         {tas \<in> ts_tuple_rel (set (linearize data_in @ move)).
         valid_tuple tuple_since tas \<and> as = snd tas}"
         using True by (auto simp add: ts_tuple_rel_def)
       have "Mapping.lookup tuple_in as =
         safe_max (fst ` {tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since tas \<and> as = snd tas})"
         using valid_before by auto
       then have "Mapping.lookup tuple_in as =
         safe_max (fst ` {tas \<in> ts_tuple_rel (set (linearize data_in')).
         valid_tuple tuple_since tas \<and> as = snd tas})"
         unfolding lin_data_in' move_absorb .
       then show ?thesis
         using Mapping_lookup_fold_upd_set_idle[of "move" as
           "\<lambda>X t. {as \<in> X. valid_tuple tuple_since (t, as)}"] True
         unfolding tuple_in'_def by auto
     next
       case False
       have split: "fst ` {tas \<in> ts_tuple_rel (set (linearize data_in')).
         valid_tuple tuple_since tas \<and> as = snd tas} =
         fst ` {tas \<in> ts_tuple_rel (set move). valid_tuple tuple_since tas \<and> as = snd tas} \<union>
         fst ` {tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since tas \<and> as = snd tas}"
         unfolding lin_data_in' set_append ts_tuple_rel_Un by auto
       have max_eq: "Max (fst ` {tas \<in> ts_tuple_rel (set move).
         valid_tuple tuple_since tas \<and> as = snd tas}) =
         Max (fst ` {tas \<in> ts_tuple_rel (set (linearize data_in')).
         valid_tuple tuple_since tas \<and> as = snd tas})"
         unfolding split using False fst_ts_tuple_rel_before
         by (fastforce simp add: ts_tuple_rel_def
             intro!: Max_Un_absorb[OF finite_fst_ts_tuple_rel _ finite_fst_ts_tuple_rel, symmetric])
       have "fst ` {(t, X). (t, X) \<in> set move \<and> as \<in> {as \<in> X. valid_tuple tuple_since (t, as)}} =
         fst ` {tas \<in> ts_tuple_rel (set move). valid_tuple tuple_since tas \<and> as = snd tas}"
         by (auto simp add: ts_tuple_rel_def image_iff)
       then have "Mapping.lookup tuple_in' as = Some (Max (fst ` {tas \<in> ts_tuple_rel (set move).
         valid_tuple tuple_since tas \<and> as = snd tas}))"
         using Mapping_lookup_fold_upd_set_max[of "move" as
           "\<lambda>X t. {as \<in> X. valid_tuple tuple_since (t, as)}", OF _ sorted_move] False
         unfolding tuple_in'_def by (auto simp add: ts_tuple_rel_def)
       then show ?thesis
         unfolding max_eq using False
         by (auto simp add: safe_max_def lin_data_in' ts_tuple_rel_def)
     qed
   qed
   have table_in': "table n R (Mapping.keys tuple_in')"
   proof -
     {
       fix as
       assume assm: "as \<in> Mapping.keys tuple_in'"
       have "wf_tuple n R as"
         using tuple_in'_keys[OF assm]
       proof (rule disjE)
         assume "as \<in> Mapping.keys tuple_in"
         then show "wf_tuple n R as"
           using valid_before by (auto simp add: table_def n_def R_def)
       next
         assume "\<exists>(t, X)\<in>set move. as \<in> {as \<in> X. valid_tuple tuple_since (t, as)}"
         then obtain t X where tX_def: "(t, X) \<in> set move" "as \<in> X"
           by auto
         then have "as \<in> \<Union>(snd ` set (linearize data_prev))"
           unfolding move_def using set_takeWhileD by force
         then show "wf_tuple n R as"
           using valid_before by (auto simp add: n_def R_def)
       qed
     }
     then show ?thesis
       by (auto simp add: table_def)
   qed
   have data_prev'_move: "(data_prev', move) =
     takedropWhile_queue (\<lambda>(t, X). nt - t \<ge> left I) data_prev"
     using takedropWhile_queue_fst takedropWhile_queue_snd data_prev'_def move_def
     by (metis surjective_pairing)
   moreover have "valid_mmsaux args nt (nt, gc, maskL, maskR, data_prev', data_in',
     tuple_in', tuple_since) auxlist"
     using lin_data_prev' sorted_lin_data_prev' lin_data_in' move_filter sorted_lin_data_in'
       nt_mono valid_before ts_tuple_rel' lookup' table_in' unfolding I_def
     by (auto simp only: valid_mmsaux.simps Let_def n_def R_def split: option.splits) auto
       (* takes long *)
   ultimately show ?thesis
     by (auto simp only: add_new_ts_mmsaux'.simps Let_def data_in'_def tuple_in'_def I_def
         split: prod.splits)
 qed
 
 lemma valid_add_new_ts_mmsaux': "valid_mmsaux args cur aux auxlist \<Longrightarrow> nt \<ge> cur \<Longrightarrow>
   valid_mmsaux args nt (add_new_ts_mmsaux' args nt aux) auxlist"
   using valid_add_new_ts_mmsaux'_unfolded by (cases aux) fast
 
 definition add_new_ts_mmsaux :: "args \<Rightarrow> ts \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "add_new_ts_mmsaux args nt aux = add_new_ts_mmsaux' args nt (shift_end args nt aux)"
 
 lemma valid_add_new_ts_mmsaux:
   assumes "valid_mmsaux args cur aux auxlist" "nt \<ge> cur"
   shows "valid_mmsaux args nt (add_new_ts_mmsaux args nt aux)
     (filter (\<lambda>(t, rel). enat (nt - t) \<le> right (args_ivl args)) auxlist)"
   using valid_add_new_ts_mmsaux'[OF valid_shift_end_mmsaux[OF assms] assms(2)]
   unfolding add_new_ts_mmsaux_def .
 
 fun join_mmsaux :: "args \<Rightarrow> 'a table \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "join_mmsaux args X (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (let pos = args_pos args in
     (if maskL = maskR then
       (let tuple_in = Mapping.filter (join_filter_cond pos X) tuple_in;
       tuple_since = Mapping.filter (join_filter_cond pos X) tuple_since in
       (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     else if (\<forall>i \<in> set maskL. \<not>i) then
       (let nones = replicate (length maskL) None;
       take_all = (pos \<longleftrightarrow> nones \<in> X);
       tuple_in = (if take_all then tuple_in else Mapping.empty);
       tuple_since = (if take_all then tuple_since else Mapping.empty) in
       (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     else
       (let tuple_in = Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X) tuple_in;
       tuple_since = Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X) tuple_since in
       (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))))"
 
 fun join_mmsaux_abs :: "args \<Rightarrow> 'a table \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "join_mmsaux_abs args X (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (let pos = args_pos args in
     (let tuple_in = Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X) tuple_in;
     tuple_since = Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X) tuple_since in
     (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since)))"
 
 lemma Mapping_filter_cong:
   assumes cong: "(\<And>k v. k \<in> Mapping.keys m \<Longrightarrow> f k v = f' k v)"
   shows "Mapping.filter f m = Mapping.filter f' m"
 proof -
   have "\<And>k. Mapping.lookup (Mapping.filter f m) k = Mapping.lookup (Mapping.filter f' m) k"
     using cong
     by (fastforce simp add: Mapping.lookup_filter intro: Mapping_keys_intro split: option.splits)
   then show ?thesis
     by (simp add: mapping_eqI)
 qed
 
 lemma join_mmsaux_abs_eq:
   assumes valid_before: "valid_mmsaux args cur
     (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) auxlist"
   and table_left: "table (args_n args) (args_L args) X"
   shows "join_mmsaux args X (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     join_mmsaux_abs args X (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since)"
 proof (cases "maskL = maskR")
   case True
   define n where "n = args_n args"
   define L where "L = args_L args"
   define pos where "pos = args_pos args"
   have keys_wf_in: "\<And>as. as \<in> Mapping.keys tuple_in \<Longrightarrow> wf_tuple n L as"
     using wf_tuple_change_base valid_before True by (fastforce simp add: table_def n_def L_def)
   have cong_in: "\<And>as n. as \<in> Mapping.keys tuple_in \<Longrightarrow>
     proj_tuple_in_join pos maskL as X \<longleftrightarrow> join_cond pos X as"
     using proj_tuple_in_join_mask_idle[OF keys_wf_in] valid_before
     by (auto simp only: valid_mmsaux.simps n_def L_def pos_def)
   have keys_wf_since: "\<And>as. as \<in> Mapping.keys tuple_since \<Longrightarrow> wf_tuple n L as"
     using wf_tuple_change_base valid_before True by (fastforce simp add: table_def n_def L_def)
   have cong_since: "\<And>as n. as \<in> Mapping.keys tuple_since \<Longrightarrow>
     proj_tuple_in_join pos maskL as X \<longleftrightarrow> join_cond pos X as"
     using proj_tuple_in_join_mask_idle[OF keys_wf_since] valid_before
     by (auto simp only: valid_mmsaux.simps n_def L_def pos_def)
   show ?thesis
     using True Mapping_filter_cong[OF cong_in, of tuple_in "\<lambda>k _. k"]
       Mapping_filter_cong[OF cong_since, of tuple_since "\<lambda>k _. k"]
     by (auto simp add: pos_def)
 next
   case False
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   from False show ?thesis
   proof (cases "\<forall>i \<in> set maskL. \<not>i")
     case True
     have length_maskL: "length maskL = n"
       using valid_before by (auto simp add: join_mask_def n_def)
     have proj_rep: "\<And>as. wf_tuple n R as \<Longrightarrow> proj_tuple maskL as = replicate (length maskL) None"
       using True proj_tuple_replicate by (force simp add: length_maskL wf_tuple_def)
     have keys_wf_in: "\<And>as. as \<in> Mapping.keys tuple_in \<Longrightarrow> wf_tuple n R as"
       using valid_before by (auto simp add: table_def n_def R_def)
     have keys_wf_since: "\<And>as. as \<in> Mapping.keys tuple_since \<Longrightarrow> wf_tuple n R as"
       using valid_before by (auto simp add: table_def n_def R_def)
     have "\<And>as. Mapping.lookup (Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X)
       tuple_in) as = Mapping.lookup (if (pos \<longleftrightarrow> replicate (length maskL) None \<in> X)
       then tuple_in else Mapping.empty) as"
       using proj_rep[OF keys_wf_in]
       by (auto simp add: Mapping.lookup_filter Mapping.lookup_empty proj_tuple_in_join_def
           Mapping_keys_intro split: option.splits)
     moreover have "\<And>as. Mapping.lookup (Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X)
       tuple_since) as = Mapping.lookup (if (pos \<longleftrightarrow> replicate (length maskL) None \<in> X)
       then tuple_since else Mapping.empty) as"
       using proj_rep[OF keys_wf_since]
       by (auto simp add: Mapping.lookup_filter Mapping.lookup_empty proj_tuple_in_join_def
           Mapping_keys_intro split: option.splits)
     ultimately show ?thesis
       using False True by (auto simp add: mapping_eqI Let_def pos_def)
   qed (auto simp add: Let_def)
 qed
 
 lemma valid_join_mmsaux_unfolded:
   assumes valid_before: "valid_mmsaux args cur
     (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) auxlist"
   and table_left': "table (args_n args) (args_L args) X"
   shows "valid_mmsaux args cur
     (join_mmsaux args X (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     (map (\<lambda>(t, rel). (t, join rel (args_pos args) X)) auxlist)"
 proof -
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   note table_left = table_left'[unfolded n_def[symmetric] L_def[symmetric]]
   define tuple_in' where "tuple_in' \<equiv>
     Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X) tuple_in"
   define tuple_since' where "tuple_since' \<equiv>
     Mapping.filter (\<lambda>as _. proj_tuple_in_join pos maskL as X) tuple_since"
   have tuple_in_None_None: "\<And>as. Mapping.lookup tuple_in as = None \<Longrightarrow>
     Mapping.lookup tuple_in' as = None"
     unfolding tuple_in'_def using Mapping_lookup_filter_not_None by fastforce
   have tuple_in'_keys: "\<And>as. as \<in> Mapping.keys tuple_in' \<Longrightarrow> as \<in> Mapping.keys tuple_in"
     using tuple_in_None_None
     by (fastforce intro: Mapping_keys_intro dest: Mapping_keys_dest)
   have tuple_since_None_None: "\<And>as. Mapping.lookup tuple_since as = None \<Longrightarrow>
     Mapping.lookup tuple_since' as = None"
     unfolding tuple_since'_def using Mapping_lookup_filter_not_None by fastforce
   have tuple_since'_keys: "\<And>as. as \<in> Mapping.keys tuple_since' \<Longrightarrow> as \<in> Mapping.keys tuple_since"
     using tuple_since_None_None
     by (fastforce intro: Mapping_keys_intro dest: Mapping_keys_dest)
   have ts_tuple_rel': "ts_tuple_rel (set (map (\<lambda>(t, rel). (t, join rel pos X)) auxlist)) =
     {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union> set (linearize data_in)).
     valid_tuple tuple_since' tas}"
   proof (rule set_eqI, rule iffI)
     fix tas
     assume assm: "tas \<in> ts_tuple_rel (set (map (\<lambda>(t, rel). (t, join rel pos X)) auxlist))"
     then obtain t as Z where tas_def: "tas = (t, as)" "as \<in> join Z pos X" "(t, Z) \<in> set auxlist"
       "(t, join Z pos X) \<in> set (map (\<lambda>(t, rel). (t, join rel pos X)) auxlist)"
       by (fastforce simp add: ts_tuple_rel_def)
     from tas_def(3) have table_Z: "table n R Z"
       using valid_before by (auto simp add: n_def R_def)
     have proj: "as \<in> Z" "proj_tuple_in_join pos maskL as X"
       using tas_def(2) join_sub[OF _ table_left table_Z] valid_before
       by (auto simp add: n_def L_def R_def pos_def)
     then have "(t, as) \<in> ts_tuple_rel (set (auxlist))"
       using tas_def(3) by (auto simp add: ts_tuple_rel_def)
     then have tas_in: "(t, as) \<in> ts_tuple_rel
       (set (linearize data_prev) \<union> set (linearize data_in))" "valid_tuple tuple_since (t, as)"
       using valid_before by auto
     then obtain t' where t'_def: "Mapping.lookup tuple_since as = Some t'" "t \<ge> t'"
       by (auto simp add: valid_tuple_def split: option.splits)
     then have valid_tuple_since': "valid_tuple tuple_since' (t, as)"
       using proj(2)
       by (auto simp add: tuple_since'_def Mapping_lookup_filter_Some valid_tuple_def)
     show "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union> set (linearize data_in)).
       valid_tuple tuple_since' tas}"
       using tas_in valid_tuple_since' unfolding tas_def(1)[symmetric] by auto
   next
     fix tas
     assume assm: "tas \<in> {tas \<in> ts_tuple_rel
       (set (linearize data_prev) \<union> set (linearize data_in)). valid_tuple tuple_since' tas}"
     then obtain t as where tas_def: "tas = (t, as)" "valid_tuple tuple_since' (t, as)"
       by (auto simp add: ts_tuple_rel_def)
     from tas_def(2) have "valid_tuple tuple_since (t, as)"
       unfolding tuple_since'_def using Mapping_lookup_filter_not_None
       by (force simp add: valid_tuple_def split: option.splits)
     then have "(t, as) \<in> ts_tuple_rel (set auxlist)"
       using valid_before assm tas_def(1) by auto
     then obtain Z where Z_def: "as \<in> Z" "(t, Z) \<in> set auxlist"
       by (auto simp add: ts_tuple_rel_def)
     then have table_Z: "table n R Z"
       using valid_before by (auto simp add: n_def R_def)
     from tas_def(2) have "proj_tuple_in_join pos maskL as X"
       unfolding tuple_since'_def using Mapping_lookup_filter_Some_P
       by (fastforce simp add: valid_tuple_def split: option.splits)
     then have as_in_join: "as \<in> join Z pos X"
       using join_sub[OF _ table_left table_Z] Z_def(1) valid_before
       by (auto simp add: n_def L_def R_def pos_def)
     then show "tas \<in> ts_tuple_rel (set (map (\<lambda>(t, rel). (t, join rel pos X)) auxlist))"
       using Z_def unfolding tas_def(1) by (auto simp add: ts_tuple_rel_def)
   qed
   have lookup_tuple_in': "\<And>as. Mapping.lookup tuple_in' as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in)). valid_tuple tuple_since' tas \<and> as = snd tas})"
   proof -
     fix as
     show "Mapping.lookup tuple_in' as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in)). valid_tuple tuple_since' tas \<and> as = snd tas})"
     proof (cases "Mapping.lookup tuple_in as")
       case None
       then have "{tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since tas \<and> as = snd tas} = {}"
         using valid_before by (auto dest!: safe_max_empty_dest)
       then have "{tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since' tas \<and> as = snd tas} = {}"
         using Mapping_lookup_filter_not_None
         by (fastforce simp add: valid_tuple_def tuple_since'_def split: option.splits)
       then show ?thesis
         unfolding tuple_in_None_None[OF None] using iffD2[OF safe_max_empty, symmetric] by blast
     next
       case (Some t)
       show ?thesis
       proof (cases "proj_tuple_in_join pos maskL as X")
         case True
         then have lookup_tuple_in': "Mapping.lookup tuple_in' as = Some t"
           using Some unfolding tuple_in'_def by (simp add: Mapping_lookup_filter_Some)
         have "(t, as) \<in> ts_tuple_rel (set (linearize data_in))" "valid_tuple tuple_since (t, as)"
           using valid_before Some by (auto dest: safe_max_Some_dest_in[OF finite_fst_ts_tuple_rel])
         then have t_in_fst: "t \<in> fst ` {tas \<in> ts_tuple_rel (set (linearize data_in)).
           valid_tuple tuple_since' tas \<and> as = snd tas}"
           using True by (auto simp add: image_iff valid_tuple_def tuple_since'_def
             Mapping_lookup_filter_Some split: option.splits)
         have "\<And>t'. valid_tuple tuple_since' (t', as) \<Longrightarrow> valid_tuple tuple_since (t', as)"
           using Mapping_lookup_filter_not_None
           by (fastforce simp add: valid_tuple_def tuple_since'_def split: option.splits)
         then have "\<And>t'. (t', as) \<in> ts_tuple_rel (set (linearize data_in)) \<Longrightarrow>
           valid_tuple tuple_since' (t', as) \<Longrightarrow> t' \<le> t"
           using valid_before Some safe_max_Some_dest_le[OF finite_fst_ts_tuple_rel]
           by (fastforce simp add: image_iff)
         then have "Max (fst ` {tas \<in> ts_tuple_rel (set (linearize data_in)).
           valid_tuple tuple_since' tas \<and> as = snd tas}) = t"
           using Max_eqI[OF finite_fst_ts_tuple_rel[of "linearize data_in"],
             OF _ t_in_fst] by fastforce
         then show ?thesis
           unfolding lookup_tuple_in' using t_in_fst by (auto simp add: safe_max_def)
       next
         case False
         then have lookup_tuple': "Mapping.lookup tuple_in' as = None"
           "Mapping.lookup tuple_since' as = None"
           unfolding tuple_in'_def tuple_since'_def
           by (auto simp add: Mapping_lookup_filter_None)
         then have "\<And>tas. \<not>(valid_tuple tuple_since' tas \<and> as = snd tas)"
           by (auto simp add: valid_tuple_def split: option.splits)
         then show ?thesis
           unfolding lookup_tuple' by (auto simp add: safe_max_def)
       qed
     qed
   qed
   have table_join': "\<And>t ys. (t, ys) \<in> set auxlist \<Longrightarrow> table n R (join ys pos X)"
   proof -
     fix t ys
     assume "(t, ys) \<in> set auxlist"
     then have table_ys: "table n R ys"
       using valid_before
       by (auto simp add: n_def L_def R_def pos_def)
     show "table n R (join ys pos X)"
       using join_table[OF table_ys table_left, of pos R] valid_before
       by (auto simp add: n_def L_def R_def pos_def)
   qed
   have table_in': "table n R (Mapping.keys tuple_in')"
     using tuple_in'_keys valid_before
     by (auto simp add: n_def L_def R_def pos_def table_def)
   have table_since': "table n R (Mapping.keys tuple_since')"
     using tuple_since'_keys valid_before
     by (auto simp add: n_def L_def R_def pos_def table_def)
   show ?thesis
     unfolding join_mmsaux_abs_eq[OF valid_before table_left']
     using valid_before ts_tuple_rel' lookup_tuple_in' tuple_in'_def tuple_since'_def table_join'
       Mapping_filter_keys[of tuple_since "\<lambda>as. case as of Some t \<Rightarrow> t \<le> nt"]
       table_in' table_since' by (auto simp add: n_def L_def R_def pos_def table_def Let_def)
 qed
 
 lemma valid_join_mmsaux: "valid_mmsaux args cur aux auxlist \<Longrightarrow>
   table (args_n args) (args_L args) X \<Longrightarrow> valid_mmsaux args cur
   (join_mmsaux args X aux) (map (\<lambda>(t, rel). (t, join rel (args_pos args) X)) auxlist)"
   using valid_join_mmsaux_unfolded by (cases aux) fast
 
 fun gc_mmsaux :: "'a mmsaux \<Rightarrow> 'a mmsaux" where
   "gc_mmsaux (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (let all_tuples = \<Union>(snd ` (set (linearize data_prev) \<union> set (linearize data_in)));
     tuple_since' = Mapping.filter (\<lambda>as _. as \<in> all_tuples) tuple_since in
     (nt, nt, maskL, maskR, data_prev, data_in, tuple_in, tuple_since'))"
 
 lemma valid_gc_mmsaux_unfolded:
   assumes valid_before: "valid_mmsaux args cur (nt, gc, maskL, maskR, data_prev, data_in,
     tuple_in, tuple_since) ys"
   shows "valid_mmsaux args cur (gc_mmsaux (nt, gc, maskL, maskR, data_prev, data_in,
     tuple_in, tuple_since)) ys"
 proof -
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   define all_tuples where "all_tuples \<equiv> \<Union>(snd ` (set (linearize data_prev) \<union>
     set (linearize data_in)))"
   define tuple_since' where "tuple_since' \<equiv> Mapping.filter (\<lambda>as _. as \<in> all_tuples) tuple_since"
   have tuple_since_None_None: "\<And>as. Mapping.lookup tuple_since as = None \<Longrightarrow>
     Mapping.lookup tuple_since' as = None"
     unfolding tuple_since'_def using Mapping_lookup_filter_not_None by fastforce
   have tuple_since'_keys: "\<And>as. as \<in> Mapping.keys tuple_since' \<Longrightarrow> as \<in> Mapping.keys tuple_since"
     using tuple_since_None_None
     by (fastforce intro: Mapping_keys_intro dest: Mapping_keys_dest)
   then have table_since': "table n R (Mapping.keys tuple_since')"
     using valid_before by (auto simp add: table_def n_def R_def)
   have data_cong: "\<And>tas. tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
     set (linearize data_in)) \<Longrightarrow> valid_tuple tuple_since' tas = valid_tuple tuple_since tas"
   proof -
     fix tas
     assume assm: "tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
     set (linearize data_in))"
     define t where "t \<equiv> fst tas"
     define as where "as \<equiv> snd tas"
     have "as \<in> all_tuples"
       using assm by (force simp add: as_def all_tuples_def ts_tuple_rel_def)
     then have "Mapping.lookup tuple_since' as = Mapping.lookup tuple_since as"
       by (auto simp add: tuple_since'_def Mapping.lookup_filter split: option.splits)
     then show "valid_tuple tuple_since' tas = valid_tuple tuple_since tas"
       by (auto simp add: valid_tuple_def as_def split: option.splits) metis
   qed
   then have data_in_cong: "\<And>tas. tas \<in> ts_tuple_rel (set (linearize data_in)) \<Longrightarrow>
     valid_tuple tuple_since' tas = valid_tuple tuple_since tas"
     by (auto simp add: ts_tuple_rel_Un)
   have "ts_tuple_rel (set ys) =
     {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union> set (linearize data_in)).
     valid_tuple tuple_since' tas}"
     using data_cong valid_before by auto
   moreover have "(\<forall>as. Mapping.lookup tuple_in as = safe_max (fst `
     {tas \<in> ts_tuple_rel (set (linearize data_in)). valid_tuple tuple_since' tas \<and> as = snd tas}))"
     using valid_before by auto (meson data_in_cong)
   moreover have "(\<forall>as \<in> Mapping.keys tuple_since'. case Mapping.lookup tuple_since' as of
     Some t \<Rightarrow> t \<le> nt)"
     using Mapping.keys_filter valid_before
     by (auto simp add: tuple_since'_def Mapping.lookup_filter split: option.splits
         intro!: Mapping_keys_intro dest: Mapping_keys_dest)
   ultimately show ?thesis
     using all_tuples_def tuple_since'_def valid_before table_since'
     by (auto simp add: n_def R_def)
 qed
 
 lemma valid_gc_mmsaux: "valid_mmsaux args cur aux ys \<Longrightarrow> valid_mmsaux args cur (gc_mmsaux aux) ys"
   using valid_gc_mmsaux_unfolded by (cases aux) fast
 
 fun gc_join_mmsaux :: "args \<Rightarrow> 'a table \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "gc_join_mmsaux args X (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (if enat (t - gc) > right (args_ivl args) then join_mmsaux args X (gc_mmsaux (t, gc, maskL, maskR,
       data_prev, data_in, tuple_in, tuple_since))
     else join_mmsaux args X (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))"
 
 lemma gc_join_mmsaux_alt: "gc_join_mmsaux args rel1 aux = join_mmsaux args rel1 (gc_mmsaux aux) \<or>
   gc_join_mmsaux args rel1 aux = join_mmsaux args rel1 aux"
   by (cases aux) (auto simp only: gc_join_mmsaux.simps split: if_splits)
 
 lemma valid_gc_join_mmsaux:
   assumes "valid_mmsaux args cur aux auxlist" "table (args_n args) (args_L args) rel1"
   shows "valid_mmsaux args cur (gc_join_mmsaux args rel1 aux)
     (map (\<lambda>(t, rel). (t, join rel (args_pos args) rel1)) auxlist)"
   using gc_join_mmsaux_alt[of args rel1 aux]
   using valid_join_mmsaux[OF valid_gc_mmsaux[OF assms(1)] assms(2)]
     valid_join_mmsaux[OF assms]
   by auto
 
 fun add_new_table_mmsaux :: "args \<Rightarrow> 'a table \<Rightarrow> 'a mmsaux \<Rightarrow> 'a mmsaux" where
   "add_new_table_mmsaux args X (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     (let tuple_since = upd_set tuple_since (\<lambda>_. t) (X - Mapping.keys tuple_since) in
     (if 0 \<ge> left (args_ivl args) then (t, gc, maskL, maskR, data_prev, append_queue (t, X) data_in,
       upd_set tuple_in (\<lambda>_. t) X, tuple_since)
     else (t, gc, maskL, maskR, append_queue (t, X) data_prev, data_in, tuple_in, tuple_since)))"
 
 lemma valid_add_new_table_mmsaux_unfolded:
   assumes valid_before: "valid_mmsaux args cur
     (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) auxlist"
   and table_X: "table (args_n args) (args_R args) X"
   shows "valid_mmsaux args cur (add_new_table_mmsaux args X
     (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     (case auxlist of
       [] => [(cur, X)]
     | ((t, y) # ts) \<Rightarrow> if t = cur then (t, y \<union> X) # ts else (cur, X) # auxlist)"
 proof -
   have cur_nt: "cur = nt"
     using valid_before by auto
   define I where "I = args_ivl args"
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   define tuple_in' where "tuple_in' \<equiv> upd_set tuple_in (\<lambda>_. nt) X"
   define tuple_since' where "tuple_since' \<equiv> upd_set tuple_since (\<lambda>_. nt)
     (X - Mapping.keys tuple_since)"
   define data_prev' where "data_prev' \<equiv> append_queue (nt, X) data_prev"
   define data_in' where "data_in' \<equiv> append_queue (nt, X) data_in"
   define auxlist' where "auxlist' \<equiv> (case auxlist of
     [] => [(nt, X)]
     | ((t, y) # ts) \<Rightarrow> if t = nt then (t, y \<union> X) # ts else (nt, X) # auxlist)"
   have table_in': "table n R (Mapping.keys tuple_in')"
     using table_X valid_before
     by (auto simp add: table_def tuple_in'_def Mapping_upd_set_keys n_def R_def)
   have table_since': "table n R (Mapping.keys tuple_since')"
     using table_X valid_before
     by (auto simp add: table_def tuple_since'_def Mapping_upd_set_keys n_def R_def)
   have tuple_since'_keys: "Mapping.keys tuple_since \<subseteq> Mapping.keys tuple_since'"
     using Mapping_upd_set_keys by (fastforce simp add: tuple_since'_def)
   have lin_data_prev': "linearize data_prev' = linearize data_prev @ [(nt, X)]"
     unfolding data_prev'_def append_queue_rep ..
   have wf_data_prev': "\<And>as. as \<in> \<Union>(snd ` (set (linearize data_prev'))) \<Longrightarrow> wf_tuple n R as"
     unfolding lin_data_prev' using table_X valid_before
     by (auto simp add: table_def n_def R_def)
   have lin_data_in': "linearize data_in' = linearize data_in @ [(nt, X)]"
     unfolding data_in'_def append_queue_rep ..
   have table_auxlist': "\<forall>(t, X) \<in> set auxlist'. table n R X"
     using table_X table_Un valid_before
     by (auto simp add: auxlist'_def n_def R_def split: list.splits if_splits)
   have lookup_tuple_since': "\<forall>as \<in> Mapping.keys tuple_since'.
     case Mapping.lookup tuple_since' as of Some t \<Rightarrow> t \<le> nt"
     unfolding tuple_since'_def using valid_before Mapping_lookup_upd_set[of tuple_since]
     by (auto dest: Mapping_keys_dest intro!: Mapping_keys_intro split: if_splits option.splits)
   have ts_tuple_rel_auxlist': "ts_tuple_rel (set auxlist') =
     ts_tuple_rel (set auxlist) \<union> ts_tuple_rel {(nt, X)}"
     unfolding auxlist'_def
     using ts_tuple_rel_ext ts_tuple_rel_ext' ts_tuple_rel_ext_Cons ts_tuple_rel_ext_Cons'
     by (fastforce simp: ts_tuple_rel_def split: list.splits if_splits)
   have valid_tuple_nt_X: "\<And>tas. tas \<in> ts_tuple_rel {(nt, X)} \<Longrightarrow> valid_tuple tuple_since' tas"
     using valid_before by (auto simp add: ts_tuple_rel_def valid_tuple_def tuple_since'_def
         Mapping_lookup_upd_set dest: Mapping_keys_dest split: option.splits)
   have valid_tuple_mono: "\<And>tas. valid_tuple tuple_since tas \<Longrightarrow> valid_tuple tuple_since' tas"
     by (auto simp add: valid_tuple_def tuple_since'_def Mapping_lookup_upd_set
         intro: Mapping_keys_intro split: option.splits)
   have ts_tuple_rel_auxlist': "ts_tuple_rel (set auxlist') =
     {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union> set (linearize data_in) \<union> {(nt, X)}).
     valid_tuple tuple_since' tas}"
   proof (rule set_eqI, rule iffI)
     fix tas
     assume assm: "tas \<in> ts_tuple_rel (set auxlist')"
     show "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
       set (linearize data_in) \<union> {(nt, X)}). valid_tuple tuple_since' tas}"
       using assm[unfolded ts_tuple_rel_auxlist' ts_tuple_rel_Un]
     proof (rule UnE)
       assume assm: "tas \<in> ts_tuple_rel (set auxlist)"
       then have "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
         set (linearize data_in)). valid_tuple tuple_since tas}"
         using valid_before by auto
       then show "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
         set (linearize data_in) \<union> {(nt, X)}). valid_tuple tuple_since' tas}"
         using assm by (auto simp only: ts_tuple_rel_Un intro: valid_tuple_mono)
     next
       assume assm: "tas \<in> ts_tuple_rel {(nt, X)}"
       show "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
         set (linearize data_in) \<union> {(nt, X)}). valid_tuple tuple_since' tas}"
         using assm valid_before by (auto simp add: ts_tuple_rel_Un tuple_since'_def
             valid_tuple_def Mapping_lookup_upd_set ts_tuple_rel_def dest: Mapping_keys_dest
             split: option.splits if_splits)
     qed
   next
     fix tas
     assume assm: "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
       set (linearize data_in) \<union> {(nt, X)}). valid_tuple tuple_since' tas}"
     then have "tas \<in> (ts_tuple_rel (set (linearize data_prev) \<union>
       set (linearize data_in)) - ts_tuple_rel {(nt, X)}) \<union> ts_tuple_rel {(nt, X)}"
       by (auto simp only: ts_tuple_rel_Un)
     then show "tas \<in> ts_tuple_rel (set auxlist')"
     proof (rule UnE)
       assume assm': "tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
         set (linearize data_in)) - ts_tuple_rel {(nt, X)}"
       then have tas_in: "tas \<in> ts_tuple_rel (set (linearize data_prev) \<union>
         set (linearize data_in))"
         by (auto simp only: ts_tuple_rel_def)
       obtain t as where tas_def: "tas = (t, as)"
         by (cases tas) auto
       have "t \<in> fst ` (set (linearize data_prev) \<union> set (linearize data_in))"
         using assm' unfolding tas_def by (force simp add: ts_tuple_rel_def)
       then have t_le_nt: "t \<le> nt"
         using valid_before by auto
       have valid_tas: "valid_tuple tuple_since' tas"
         using assm by auto
       have "valid_tuple tuple_since tas"
       proof (cases "as \<in> Mapping.keys tuple_since")
         case True
         then show ?thesis
           using valid_tas tas_def by (auto simp add: valid_tuple_def tuple_since'_def
               Mapping_lookup_upd_set split: option.splits if_splits)
       next
         case False
         then have "t = nt" "as \<in> X"
           using valid_tas t_le_nt unfolding tas_def
           by (auto simp add: valid_tuple_def tuple_since'_def Mapping_lookup_upd_set
               intro: Mapping_keys_intro split: option.splits if_splits)
         then have "False"
           using assm' unfolding tas_def ts_tuple_rel_def by (auto simp only: ts_tuple_rel_def)
         then show ?thesis
           by simp
       qed
       then show "tas \<in> ts_tuple_rel (set auxlist')"
         using tas_in valid_before by (auto simp add: ts_tuple_rel_auxlist')
     qed (auto simp only: ts_tuple_rel_auxlist')
   qed
   show ?thesis
   proof (cases "0 \<ge> left I")
     case True
     then have add_def: "add_new_table_mmsaux args X (nt, gc, maskL, maskR, data_prev, data_in,
       tuple_in, tuple_since) = (nt, gc, maskL, maskR, data_prev, data_in',
       tuple_in', tuple_since')"
       using data_in'_def tuple_in'_def tuple_since'_def unfolding I_def by auto
     have left_I: "left I = 0"
       using True by auto
     have "\<forall>t \<in> fst ` set (linearize data_in'). t \<le> nt \<and> nt - t \<ge> left I"
       using valid_before True by (auto simp add: lin_data_in')
     moreover have "\<And>as. Mapping.lookup tuple_in' as = safe_max (fst `
       {tas \<in> ts_tuple_rel (set (linearize data_in')).
       valid_tuple tuple_since' tas \<and> as = snd tas})"
     proof -
       fix as
       show "Mapping.lookup tuple_in' as = safe_max (fst `
         {tas \<in> ts_tuple_rel (set (linearize data_in')).
         valid_tuple tuple_since' tas \<and> as = snd tas})"
       proof (cases "as \<in> X")
         case True
         have "valid_tuple tuple_since' (nt, as)"
           using True valid_before by (auto simp add: valid_tuple_def tuple_since'_def
               Mapping_lookup_upd_set dest: Mapping_keys_dest split: option.splits)
         moreover have "(nt, as) \<in> ts_tuple_rel (insert (nt, X) (set (linearize data_in)))"
           using True by (auto simp add: ts_tuple_rel_def)
         ultimately have nt_in: "nt \<in> fst ` {tas \<in> ts_tuple_rel (insert (nt, X)
           (set (linearize data_in))). valid_tuple tuple_since' tas \<and> as = snd tas}"
         proof -
           assume a1: "valid_tuple tuple_since' (nt, as)"
           assume "(nt, as) \<in> ts_tuple_rel (insert (nt, X) (set (linearize data_in)))"
           then have "\<exists>p. nt = fst p \<and> p \<in> ts_tuple_rel (insert (nt, X)
             (set (linearize data_in))) \<and> valid_tuple tuple_since' p \<and> as = snd p"
             using a1 by simp
           then show "nt \<in> fst ` {p \<in> ts_tuple_rel (insert (nt, X) (set (linearize data_in))).
             valid_tuple tuple_since' p \<and> as = snd p}"
             by blast
         qed
         moreover have "\<And>t. t \<in> fst ` {tas \<in> ts_tuple_rel (insert (nt, X)
           (set (linearize data_in))). valid_tuple tuple_since' tas \<and> as = snd tas} \<Longrightarrow> t \<le> nt"
           using valid_before by (auto split: option.splits)
             (metis (no_types, lifting) eq_imp_le fst_conv insertE ts_tuple_rel_dest)
         ultimately have "Max (fst ` {tas \<in> ts_tuple_rel (set (linearize data_in)
           \<union> set [(nt, X)]). valid_tuple tuple_since' tas \<and> as = snd tas}) = nt"
           using Max_eqI[OF finite_fst_ts_tuple_rel[of "linearize data_in'"],
               unfolded lin_data_in' set_append] by auto
         then show ?thesis
           using nt_in True
           by (auto simp add: tuple_in'_def Mapping_lookup_upd_set safe_max_def lin_data_in')
       next
         case False
         have "{tas \<in> ts_tuple_rel (set (linearize data_in)).
           valid_tuple tuple_since tas \<and> as = snd tas} =
           {tas \<in> ts_tuple_rel (set (linearize data_in')).
           valid_tuple tuple_since' tas \<and> as = snd tas}"
           using False by (fastforce simp add: lin_data_in' ts_tuple_rel_def valid_tuple_def
               tuple_since'_def Mapping_lookup_upd_set intro: Mapping_keys_intro
               split: option.splits if_splits)
         then show ?thesis
           using valid_before False by (auto simp add: tuple_in'_def Mapping_lookup_upd_set)
       qed
     qed
     ultimately show ?thesis
       using assms table_auxlist' sorted_append[of "map fst (linearize data_in)"]
         lookup_tuple_since' ts_tuple_rel_auxlist' table_in' table_since'
       unfolding add_def auxlist'_def[symmetric] cur_nt I_def
       by (auto simp only: valid_mmsaux.simps lin_data_in' n_def R_def) auto
   next
     case False
     then have add_def: "add_new_table_mmsaux args X (nt, gc, maskL, maskR, data_prev, data_in,
       tuple_in, tuple_since) = (nt, gc, maskL, maskR, data_prev', data_in,
       tuple_in, tuple_since')"
       using data_prev'_def tuple_since'_def unfolding I_def by auto
     have left_I: "left I > 0"
       using False by auto
     have "\<forall>t \<in> fst ` set (linearize data_prev'). t \<le> nt \<and> nt - t < left I"
       using valid_before False by (auto simp add: lin_data_prev' I_def)
     moreover have "\<And>as. {tas \<in> ts_tuple_rel (set (linearize data_in)).
       valid_tuple tuple_since tas \<and> as = snd tas} =
       {tas \<in> ts_tuple_rel (set (linearize data_in)).
       valid_tuple tuple_since' tas \<and> as = snd tas}"
     proof (rule set_eqI, rule iffI)
       fix as tas
       assume assm: "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since' tas \<and> as = snd tas}"
       then obtain t Z where Z_def: "tas = (t, as)" "as \<in> Z" "(t, Z) \<in> set (linearize data_in)"
         "valid_tuple tuple_since' (t, as)"
         by (auto simp add: ts_tuple_rel_def)
       show "tas \<in> {tas \<in> ts_tuple_rel (set (linearize data_in)).
         valid_tuple tuple_since tas \<and> as = snd tas}"
       using assm
       proof (cases "as \<in> Mapping.keys tuple_since")
         case False
         then have "t \<ge> nt"
           using Z_def(4) by (auto simp add: valid_tuple_def tuple_since'_def
               Mapping_lookup_upd_set intro: Mapping_keys_intro split: option.splits if_splits)
         then show ?thesis
           using Z_def(3) valid_before left_I unfolding I_def by auto
       qed (auto simp add: valid_tuple_def tuple_since'_def Mapping_lookup_upd_set
            dest: Mapping_keys_dest split: option.splits)
     qed (auto simp add: Mapping_lookup_upd_set valid_tuple_def tuple_since'_def
          intro: Mapping_keys_intro split: option.splits)
     ultimately show ?thesis
       using assms table_auxlist' sorted_append[of "map fst (linearize data_prev)"]
         False lookup_tuple_since' ts_tuple_rel_auxlist' table_in' table_since' wf_data_prev'
         valid_before
       unfolding add_def auxlist'_def[symmetric] cur_nt I_def
       by (auto simp only: valid_mmsaux.simps lin_data_prev' n_def R_def) fastforce+
         (* takes long *)
   qed
 qed
 
 lemma valid_add_new_table_mmsaux:
   assumes valid_before: "valid_mmsaux args cur aux auxlist"
   and table_X: "table (args_n args) (args_R args) X"
   shows "valid_mmsaux args cur (add_new_table_mmsaux args X aux)
     (case auxlist of
       [] => [(cur, X)]
     | ((t, y) # ts) \<Rightarrow> if t = cur then (t, y \<union> X) # ts else (cur, X) # auxlist)"
   using valid_add_new_table_mmsaux_unfolded assms
   by (cases aux) fast
 
 lemma foldr_ts_tuple_rel:
   "as \<in> foldr (\<union>) (concat (map (\<lambda>(t, rel). if P t then [rel] else []) auxlist)) {} \<longleftrightarrow>
   (\<exists>t. (t, as) \<in> ts_tuple_rel (set auxlist) \<and> P t)"
 proof (rule iffI)
   assume assm: "as \<in> foldr (\<union>) (concat (map (\<lambda>(t, rel). if P t then [rel] else []) auxlist)) {}"
   then obtain t X where tX_def: "P t" "as \<in> X" "(t, X) \<in> set auxlist"
     by (auto elim!: in_foldr_UnE)
   then show "\<exists>t. (t, as) \<in> ts_tuple_rel (set auxlist) \<and> P t"
     by (auto simp add: ts_tuple_rel_def)
 next
   assume assm: "\<exists>t. (t, as) \<in> ts_tuple_rel (set auxlist) \<and> P t"
   then obtain t X where tX_def: "P t" "as \<in> X" "(t, X) \<in> set auxlist"
     by (auto simp add: ts_tuple_rel_def)
   show "as \<in> foldr (\<union>) (concat (map (\<lambda>(t, rel). if P t then [rel] else []) auxlist)) {}"
     using in_foldr_UnI[OF tX_def(2)] tX_def assm by (induction auxlist) force+
 qed
 
 lemma image_snd: "(a, b) \<in> X \<Longrightarrow> b \<in> snd ` X"
   by force
 
 fun result_mmsaux :: "args \<Rightarrow> 'a mmsaux \<Rightarrow> 'a table" where
   "result_mmsaux args (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     Mapping.keys tuple_in"
 
 lemma valid_result_mmsaux_unfolded:
   assumes "valid_mmsaux args cur
     (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) auxlist"
   shows "result_mmsaux args (t, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since) =
     foldr (\<union>) [rel. (t, rel) \<leftarrow> auxlist, left (args_ivl args) \<le> cur - t] {}"
   using valid_mmsaux_tuple_in_keys[OF assms] assms
   by (auto simp add: image_Un ts_tuple_rel_Un foldr_ts_tuple_rel image_snd)
      (fastforce intro: ts_tuple_rel_intro dest: ts_tuple_rel_dest)+
 
 lemma valid_result_mmsaux: "valid_mmsaux args cur aux auxlist \<Longrightarrow>
   result_mmsaux args aux = foldr (\<union>) [rel. (t, rel) \<leftarrow> auxlist, left (args_ivl args) \<le> cur - t] {}"
   using valid_result_mmsaux_unfolded by (cases aux) fast
 
 interpretation default_msaux: msaux valid_mmsaux init_mmsaux add_new_ts_mmsaux gc_join_mmsaux
   add_new_table_mmsaux result_mmsaux
   using valid_init_mmsaux valid_add_new_ts_mmsaux valid_gc_join_mmsaux valid_add_new_table_mmsaux
     valid_result_mmsaux
   by unfold_locales assumption+
 
 subsection \<open>Optimized data structure for Until\<close>
 
 type_synonym tp = nat
 
 type_synonym 'a mmuaux = "tp \<times> ts queue \<times> nat \<times> bool list \<times> bool list \<times>
   ('a tuple, tp) mapping \<times> (tp, ('a tuple, ts + tp) mapping) mapping \<times> 'a table list \<times> nat"
 
 definition tstp_lt :: "ts + tp \<Rightarrow> ts \<Rightarrow> tp \<Rightarrow> bool" where
   "tstp_lt tstp ts tp = case_sum (\<lambda>ts'. ts' \<le> ts) (\<lambda>tp'. tp' < tp) tstp"
 
 definition tstp_le :: "ts + tp \<Rightarrow> ts \<Rightarrow> tp \<Rightarrow> bool" where
   "tstp_le tstp ts tp = case_sum (\<lambda>ts'. ts' \<le> ts) (\<lambda>tp'. tp' \<le> tp) tstp"
 
 definition ts_tp_lt :: "ts \<Rightarrow> tp \<Rightarrow> ts + tp \<Rightarrow> bool" where
   "ts_tp_lt ts tp tstp = case_sum (\<lambda>ts'. ts \<le> ts') (\<lambda>tp'. tp < tp') tstp"
 
 definition ts_tp_lt' :: "ts \<Rightarrow> tp \<Rightarrow> ts + tp \<Rightarrow> bool" where
   "ts_tp_lt' ts tp tstp = case_sum (\<lambda>ts'. ts < ts') (\<lambda>tp'. tp \<le> tp') tstp"
 
 definition ts_tp_le :: "ts \<Rightarrow> tp \<Rightarrow> ts + tp \<Rightarrow> bool" where
   "ts_tp_le ts tp tstp = case_sum (\<lambda>ts'. ts \<le> ts') (\<lambda>tp'. tp \<le> tp') tstp"
 
 fun max_tstp :: "ts + tp \<Rightarrow> ts + tp \<Rightarrow> ts + tp" where
   "max_tstp (Inl ts) (Inl ts') = Inl (max ts ts')"
 | "max_tstp (Inr tp) (Inr tp') = Inr (max tp tp')"
 | "max_tstp (Inl ts) _ = Inl ts"
 | "max_tstp _ (Inl ts) = Inl ts"
 
 lemma max_tstp_idem: "max_tstp (max_tstp x y) y = max_tstp x y"
   by (cases x; cases y) auto
 
 lemma max_tstp_idem': "max_tstp x (max_tstp x y) = max_tstp x y"
   by (cases x; cases y) auto
 
 lemma max_tstp_d_d: "max_tstp d d = d"
   by (cases d) auto
 
 lemma max_cases: "(max a b = a \<Longrightarrow> P) \<Longrightarrow> (max a b = b \<Longrightarrow> P) \<Longrightarrow> P"
   by (metis max_def)
 
 lemma max_tstpE: "isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow> (max_tstp tstp tstp' = tstp \<Longrightarrow> P) \<Longrightarrow>
   (max_tstp tstp tstp' = tstp' \<Longrightarrow> P) \<Longrightarrow> P"
   by (cases tstp; cases tstp') (auto elim: max_cases)
 
 lemma max_tstp_intro: "tstp_lt tstp ts tp \<Longrightarrow> tstp_lt tstp' ts tp \<Longrightarrow> isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow>
   tstp_lt (max_tstp tstp tstp') ts tp"
   by (auto simp add: tstp_lt_def split: sum.splits)
 
 lemma max_tstp_intro': "isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow>
   ts_tp_le ts' tp' tstp \<Longrightarrow> ts_tp_le ts' tp' (max_tstp tstp tstp')"
   by (cases tstp; cases tstp') (auto simp add: ts_tp_le_def tstp_le_def split: sum.splits)
 
 lemma max_tstp_intro'': "isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow>
   ts_tp_le ts' tp' tstp' \<Longrightarrow> ts_tp_le ts' tp' (max_tstp tstp tstp')"
   by (cases tstp; cases tstp') (auto simp add: ts_tp_le_def tstp_le_def split: sum.splits)
 
 lemma max_tstp_intro''': "isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow>
   ts_tp_lt' ts' tp' tstp \<Longrightarrow> ts_tp_lt' ts' tp' (max_tstp tstp tstp')"
   by (cases tstp; cases tstp') (auto simp add: ts_tp_lt'_def tstp_le_def split: sum.splits)
 
 lemma max_tstp_intro'''': "isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow>
   ts_tp_lt' ts' tp' tstp' \<Longrightarrow> ts_tp_lt' ts' tp' (max_tstp tstp tstp')"
   by (cases tstp; cases tstp') (auto simp add: ts_tp_lt'_def tstp_le_def split: sum.splits)
 
 lemma max_tstp_isl: "isl tstp \<longleftrightarrow> isl tstp' \<Longrightarrow> isl (max_tstp tstp tstp') \<longleftrightarrow> isl tstp"
   by (cases tstp; cases tstp') auto
 
 definition filter_a1_map :: "bool \<Rightarrow> tp \<Rightarrow> ('a tuple, tp) mapping \<Rightarrow> 'a table" where
   "filter_a1_map pos tp a1_map =
     {xs \<in> Mapping.keys a1_map. case Mapping.lookup a1_map xs of Some tp' \<Rightarrow>
     (pos \<longrightarrow> tp' \<le> tp) \<and> (\<not>pos \<longrightarrow> tp \<le> tp')}"
 
 definition filter_a2_map :: "\<I> \<Rightarrow> ts \<Rightarrow> tp \<Rightarrow> (tp, ('a tuple, ts + tp) mapping) mapping \<Rightarrow>
   'a table" where
   "filter_a2_map I ts tp a2_map = {xs. \<exists>tp' \<le> tp. (case Mapping.lookup a2_map tp' of Some m \<Rightarrow>
     (case Mapping.lookup m xs of Some tstp \<Rightarrow> ts_tp_lt' ts tp tstp | _ \<Rightarrow> False)
     | _ \<Rightarrow> False)}"
 
 fun triple_eq_pair :: "('a \<times> 'b \<times> 'c) \<Rightarrow> ('a \<times> 'd) \<Rightarrow> ('d \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'd \<Rightarrow> 'c) \<Rightarrow> bool" where
   "triple_eq_pair (t, a1, a2) (ts', tp') f g \<longleftrightarrow> t = ts' \<and> a1 = f tp' \<and> a2 = g ts' tp'"
 
 fun valid_mmuaux' :: "args \<Rightarrow> ts \<Rightarrow> ts \<Rightarrow> 'a mmuaux \<Rightarrow> 'a muaux \<Rightarrow> bool" where
   "valid_mmuaux' args cur dt (tp, tss, len, maskL, maskR, a1_map, a2_map,
     done, done_length) auxlist \<longleftrightarrow>
     args_L args \<subseteq> args_R args \<and>
     maskL = join_mask (args_n args) (args_L args) \<and>
     maskR = join_mask (args_n args) (args_R args) \<and>
     len \<le> tp \<and>
     length (linearize tss) = len \<and> sorted (linearize tss) \<and>
     (\<forall>t \<in> set (linearize tss). t \<le> cur \<and> enat cur \<le> enat t + right (args_ivl args)) \<and>
     table (args_n args) (args_L args) (Mapping.keys a1_map) \<and>
     Mapping.keys a2_map = {tp - len..tp} \<and>
     (\<forall>xs \<in> Mapping.keys a1_map. case Mapping.lookup a1_map xs of Some tp' \<Rightarrow> tp' < tp) \<and>
     (\<forall>tp' \<in> Mapping.keys a2_map. case Mapping.lookup a2_map tp' of Some m \<Rightarrow>
       table (args_n args) (args_R args) (Mapping.keys m) \<and>
       (\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
       tstp_lt tstp (cur - (left (args_ivl args) - 1)) tp \<and> (isl tstp \<longleftrightarrow> left (args_ivl args) > 0))) \<and>
     length done = done_length \<and> length done + len = length auxlist \<and>
     rev done = map proj_thd (take (length done) auxlist) \<and>
     (\<forall>x \<in> set (take (length done) auxlist). check_before (args_ivl args) dt x) \<and>
     sorted (map fst auxlist) \<and>
     list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map (args_pos args) tp' a1_map)
       (\<lambda>ts' tp'. filter_a2_map (args_ivl args) ts' tp' a2_map)) (drop (length done) auxlist)
       (zip (linearize tss) [tp - len..<tp])"
 
 definition valid_mmuaux :: "args \<Rightarrow> ts \<Rightarrow> 'a mmuaux \<Rightarrow> 'a muaux \<Rightarrow>
   bool" where
   "valid_mmuaux args cur = valid_mmuaux' args cur cur"
 
 fun eval_step_mmuaux :: "'a mmuaux \<Rightarrow> 'a mmuaux" where
   "eval_step_mmuaux (tp, tss, len, maskL, maskR, a1_map, a2_map,
     done, done_length) = (case safe_hd tss of (Some ts, tss') \<Rightarrow>
       (case Mapping.lookup a2_map (tp - len) of Some m \<Rightarrow>
         let m = Mapping.filter (\<lambda>_ tstp. ts_tp_lt' ts (tp - len) tstp) m;
         T = Mapping.keys m;
         a2_map = Mapping.update (tp - len + 1)
           (case Mapping.lookup a2_map (tp - len + 1) of Some m' \<Rightarrow>
           Mapping.combine (\<lambda>tstp tstp'. max_tstp tstp tstp') m m') a2_map;
         a2_map = Mapping.delete (tp - len) a2_map in
         (tp, tl_queue tss', len - 1, maskL, maskR, a1_map, a2_map,
         T # done, done_length + 1)))"
 
 lemma Mapping_update_keys: "Mapping.keys (Mapping.update a b m) = Mapping.keys m \<union> {a}"
   by transfer auto
 
 lemma drop_is_Cons_take: "drop n xs = y # ys \<Longrightarrow> take (Suc n) xs = take n xs @ [y]"
 proof (induction xs arbitrary: n)
   case Nil
   then show ?case by simp
 next
   case (Cons x xs)
   then show ?case by (cases n) simp_all
 qed
 
 lemma list_all2_weaken: "list_all2 f xs ys \<Longrightarrow>
   (\<And>x y. (x, y) \<in> set (zip xs ys) \<Longrightarrow> f x y \<Longrightarrow> f' x y) \<Longrightarrow> list_all2 f' xs ys"
   by (induction xs ys rule: list_all2_induct) auto
 
 lemma Mapping_lookup_delete: "Mapping.lookup (Mapping.delete k m) k' =
   (if k = k' then None else Mapping.lookup m k')"
   by transfer auto
 
 lemma Mapping_lookup_update: "Mapping.lookup (Mapping.update k v m) k' =
   (if k = k' then Some v else Mapping.lookup m k')"
   by transfer auto
 
 lemma hd_le_set: "sorted xs \<Longrightarrow> xs \<noteq> [] \<Longrightarrow> x \<in> set xs \<Longrightarrow> hd xs \<le> x"
   by (metis eq_iff list.sel(1) set_ConsD sorted.elims(2))
 
 lemma Mapping_lookup_combineE: "Mapping.lookup (Mapping.combine f m m') k = Some v \<Longrightarrow>
   (Mapping.lookup m k = Some v \<Longrightarrow> P) \<Longrightarrow>
   (Mapping.lookup m' k = Some v \<Longrightarrow> P) \<Longrightarrow>
   (\<And>v' v''. Mapping.lookup m k = Some v' \<Longrightarrow> Mapping.lookup m' k = Some v'' \<Longrightarrow>
   f v' v'' = v \<Longrightarrow> P) \<Longrightarrow> P"
   unfolding Mapping.lookup_combine
   by (auto simp add: combine_options_def split: option.splits)
 
 lemma Mapping_keys_filterI: "Mapping.lookup m k = Some v \<Longrightarrow> f k v \<Longrightarrow>
   k \<in> Mapping.keys (Mapping.filter f m)"
   by transfer (auto split: option.splits if_splits)
 
 lemma Mapping_keys_filterD: "k \<in> Mapping.keys (Mapping.filter f m) \<Longrightarrow>
   \<exists>v. Mapping.lookup m k = Some v \<and> f k v"
   by transfer (auto split: option.splits if_splits)
 
 fun lin_ts_mmuaux :: "'a mmuaux \<Rightarrow> ts list" where
   "lin_ts_mmuaux (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length) =
     linearize tss"
 
 lemma valid_eval_step_mmuaux':
   assumes "valid_mmuaux' args cur dt aux auxlist"
     "lin_ts_mmuaux aux = ts # tss''" "enat ts + right (args_ivl args) < dt"
   shows "valid_mmuaux' args cur dt (eval_step_mmuaux aux) auxlist \<and>
     lin_ts_mmuaux (eval_step_mmuaux aux) = tss''"
 proof -
   define I where "I = args_ivl args"
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   obtain tp len tss maskL maskR a1_map a2_map "done" done_length where aux_def:
     "aux = (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length)"
     by (cases aux) auto
   then obtain tss' where safe_hd_eq: "safe_hd tss = (Some ts, tss')"
     using assms(2) safe_hd_rep case_optionE
     by (cases "safe_hd tss") fastforce
   note valid_before = assms(1)[unfolded aux_def]
   have lin_tss_not_Nil: "linearize tss \<noteq> []"
     using safe_hd_rep[OF safe_hd_eq] by auto
   have ts_hd: "ts = hd (linearize tss)"
     using safe_hd_rep[OF safe_hd_eq] by auto
   have lin_tss': "linearize tss' = linearize tss"
     using safe_hd_rep[OF safe_hd_eq] by auto
   have tss'_not_empty: "\<not>is_empty tss'"
     using is_empty_alt[of tss'] lin_tss_not_Nil unfolding lin_tss' by auto
   have len_pos: "len > 0"
     using lin_tss_not_Nil valid_before by auto
   have a2_map_keys: "Mapping.keys a2_map = {tp - len..tp}"
     using valid_before by auto
   have len_tp: "len \<le> tp"
     using valid_before by auto
   have tp_minus_keys: "tp - len \<in> Mapping.keys a2_map"
     using a2_map_keys by auto
   have tp_minus_keys': "tp - len + 1 \<in> Mapping.keys a2_map"
     using a2_map_keys len_pos len_tp by auto
   obtain m where m_def: "Mapping.lookup a2_map (tp - len) = Some m"
     using tp_minus_keys by (auto dest: Mapping_keys_dest)
   have "table n R (Mapping.keys m)"
     "(\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0))"
     using tp_minus_keys m_def valid_before
     unfolding valid_mmuaux'.simps n_def I_def R_def by fastforce+
   then have m_inst: "table n R (Mapping.keys m)"
     "\<And>xs tstp. Mapping.lookup m xs = Some tstp \<Longrightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0)"
     using Mapping_keys_intro by fastforce+
   have m_inst_isl: "\<And>xs tstp. Mapping.lookup m xs = Some tstp \<Longrightarrow> isl tstp \<longleftrightarrow> left I > 0"
     using m_inst(2) by fastforce
   obtain m' where m'_def: "Mapping.lookup a2_map (tp - len + 1) = Some m'"
     using tp_minus_keys' by (auto dest: Mapping_keys_dest)
   have "table n R (Mapping.keys m')"
     "(\<forall>xs \<in> Mapping.keys m'. case Mapping.lookup m' xs of Some tstp \<Rightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0))"
     using tp_minus_keys' m'_def valid_before
     unfolding valid_mmuaux'.simps I_def n_def R_def by fastforce+
   then have m'_inst: "table n R (Mapping.keys m')"
     "\<And>xs tstp. Mapping.lookup m' xs = Some tstp \<Longrightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0)"
     using Mapping_keys_intro by fastforce+
   have m'_inst_isl: "\<And>xs tstp. Mapping.lookup m' xs = Some tstp \<Longrightarrow> isl tstp \<longleftrightarrow> left I > 0"
     using m'_inst(2) by fastforce
   define m_upd where "m_upd = Mapping.filter (\<lambda>_ tstp. ts_tp_lt' ts (tp - len) tstp) m"
   define T where "T = Mapping.keys m_upd"
   define mc where "mc = Mapping.combine (\<lambda>tstp tstp'. max_tstp tstp tstp') m_upd m'"
   define a2_map' where "a2_map' = Mapping.update (tp - len + 1) mc a2_map"
   define a2_map'' where "a2_map'' = Mapping.delete (tp - len) a2_map'"
   have m_upd_lookup: "\<And>xs tstp. Mapping.lookup m_upd xs = Some tstp \<Longrightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0)"
     unfolding m_upd_def Mapping.lookup_filter
     using m_inst(2) by (auto split: option.splits if_splits)
   have mc_lookup: "\<And>xs tstp. Mapping.lookup mc xs = Some tstp \<Longrightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0)"
     unfolding mc_def Mapping.lookup_combine
     using m_upd_lookup m'_inst(2)
     by (auto simp add: combine_options_def max_tstp_isl intro: max_tstp_intro split: option.splits)
   have mc_keys: "Mapping.keys mc \<subseteq> Mapping.keys m \<union> Mapping.keys m'"
     unfolding mc_def Mapping.keys_combine m_upd_def
     using Mapping.keys_filter by fastforce
   have tp_len_assoc: "tp - len + 1 = tp - (len - 1)"
     using len_pos len_tp by auto
   have a2_map''_keys: "Mapping.keys a2_map'' = {tp - (len - 1)..tp}"
     unfolding a2_map''_def a2_map'_def Mapping.keys_delete Mapping_update_keys a2_map_keys
     using tp_len_assoc by auto
   have lin_tss_Cons: "linearize tss = ts # linearize (tl_queue tss')"
     using lin_tss_not_Nil
     by (auto simp add: tl_queue_rep[OF tss'_not_empty] lin_tss' ts_hd)
   have tp_len_tp_unfold: "[tp - len..<tp] = (tp - len) # [tp - (len - 1)..<tp]"
     unfolding tp_len_assoc[symmetric]
     using len_pos len_tp Suc_diff_le upt_conv_Cons by auto
   have id: "\<And>x. x \<in> {tp - (len - 1) + 1..tp} \<Longrightarrow>
     Mapping.lookup a2_map'' x = Mapping.lookup a2_map x"
     unfolding a2_map''_def a2_map'_def Mapping_lookup_delete Mapping_lookup_update tp_len_assoc
     using len_tp by auto
   have list_all2: "list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map pos tp' a1_map)
     (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map))
     (drop (length done) auxlist) (zip (linearize tss) [tp - len..<tp])"
     using valid_before unfolding I_def pos_def by auto
   obtain hd_aux tl_aux where aux_split: "drop (length done) auxlist = hd_aux # tl_aux"
     "case hd_aux of (t, a1, a2) \<Rightarrow> (t, a1, a2) =
     (ts, filter_a1_map pos (tp - len) a1_map, filter_a2_map I ts (tp - len) a2_map)"
     and list_all2': "list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map pos tp' a1_map)
       (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map)) tl_aux
       (zip (linearize (tl_queue tss')) [tp - (len - 1)..<tp])"
     using list_all2[unfolded lin_tss_Cons tp_len_tp_unfold zip_Cons_Cons list_all2_Cons2] by auto
   have lookup''_tp_minus: "Mapping.lookup a2_map'' (tp - (len - 1)) = Some mc"
     unfolding a2_map''_def a2_map'_def Mapping_lookup_delete Mapping_lookup_update
       tp_len_assoc[symmetric]
     using len_tp by auto
   have filter_a2_map_cong: "\<And>ts' tp'. ts' \<in> set (linearize tss) \<Longrightarrow>
     tp' \<in> {tp - (len - 1)..<tp} \<Longrightarrow> filter_a2_map I ts' tp' a2_map =
     filter_a2_map I ts' tp' a2_map''"
   proof (rule set_eqI, rule iffI)
     fix ts' tp' xs
     assume assms: "ts' \<in> set (linearize tss)"
       "tp' \<in> {tp - (len - 1)..<tp}" "xs \<in> filter_a2_map I ts' tp' a2_map"
     obtain tp_bef m_bef tstp where defs: "tp_bef \<le> tp'" "Mapping.lookup a2_map tp_bef = Some m_bef"
       "Mapping.lookup m_bef xs = Some tstp" "ts_tp_lt' ts' tp' tstp"
       using assms(3)[unfolded filter_a2_map_def]
       by (fastforce split: option.splits)
     have ts_le_ts': "ts \<le> ts'"
       using hd_le_set[OF _ lin_tss_not_Nil assms(1)] valid_before
       unfolding ts_hd by auto
     have tp_bef_in: "tp_bef \<in> {tp - len..tp}"
       using defs(2) valid_before by (auto intro!: Mapping_keys_intro)
     have tp_minus_le: "tp - (len - 1) \<le> tp'"
       using assms(2) by auto
     show "xs \<in> filter_a2_map I ts' tp' a2_map''"
     proof (cases "tp_bef \<le> tp - (len - 1)")
       case True
       show ?thesis
       proof (cases "tp_bef = tp - len")
         case True
         have m_bef_m: "m_bef = m"
           using defs(2) m_def
           unfolding True by auto
         have "Mapping.lookup m_upd xs = Some tstp"
           using defs(3,4) assms(2) ts_le_ts' unfolding m_bef_m m_upd_def
           by (auto simp add: Mapping.lookup_filter ts_tp_lt'_def intro: Mapping_keys_intro
               split: sum.splits)
         then have "case Mapping.lookup mc xs of None \<Rightarrow> False | Some tstp \<Rightarrow>
           ts_tp_lt' ts' tp' tstp"
           unfolding mc_def Mapping.lookup_combine
           using m'_inst(2) m_upd_lookup
           by (auto simp add: combine_options_def defs(4) intro!: max_tstp_intro'''
               dest: Mapping_keys_dest split: option.splits)
         then show ?thesis
           using lookup''_tp_minus tp_minus_le defs
           unfolding m_bef_m filter_a2_map_def by (auto split: option.splits)
       next
         case False
         then have "tp_bef = tp - (len - 1)"
           using True tp_bef_in by auto
         then have m_bef_m: "m_bef = m'"
           using defs(2) m'_def
           unfolding tp_len_assoc by auto
         have "case Mapping.lookup mc xs of None \<Rightarrow> False | Some tstp \<Rightarrow>
           ts_tp_lt' ts' tp' tstp"
           unfolding mc_def Mapping.lookup_combine
           using m'_inst(2) m_upd_lookup defs(3)[unfolded m_bef_m]
           by (auto simp add: combine_options_def defs(4) intro!: max_tstp_intro''''
               dest: Mapping_keys_dest split: option.splits)
         then show ?thesis
           using lookup''_tp_minus tp_minus_le defs
           unfolding m_bef_m filter_a2_map_def by (auto split: option.splits)
       qed
     next
       case False
       then have "Mapping.lookup a2_map'' tp_bef = Mapping.lookup a2_map tp_bef"
         using id tp_bef_in len_tp by auto
       then show ?thesis
         unfolding filter_a2_map_def
         using defs by auto
     qed
   next
     fix ts' tp' xs
     assume assms: "ts' \<in> set (linearize tss)" "tp' \<in> {tp - (len - 1)..<tp}"
       "xs \<in> filter_a2_map I ts' tp' a2_map''"
     obtain tp_bef m_bef tstp where defs: "tp_bef \<le> tp'"
       "Mapping.lookup a2_map'' tp_bef = Some m_bef"
       "Mapping.lookup m_bef xs = Some tstp" "ts_tp_lt' ts' tp' tstp"
       using assms(3)[unfolded filter_a2_map_def]
       by (fastforce split: option.splits)
     have ts_le_ts': "ts \<le> ts'"
       using hd_le_set[OF _ lin_tss_not_Nil assms(1)] valid_before
       unfolding ts_hd by auto
     have tp_bef_in: "tp_bef \<in> {tp - (len - 1)..tp}"
       using defs(2) a2_map''_keys by (auto intro!: Mapping_keys_intro)
     have tp_minus_le: "tp - len \<le> tp'" "tp - (len - 1) \<le> tp'"
       using assms(2) by auto
     show "xs \<in> filter_a2_map I ts' tp' a2_map"
     proof (cases "tp_bef = tp - (len - 1)")
       case True
       have m_beg_mc: "m_bef = mc"
         using defs(2)
         unfolding True a2_map''_def a2_map'_def tp_len_assoc Mapping_lookup_delete
           Mapping.lookup_update
         by (auto split: if_splits)
       show ?thesis
         using defs(3)[unfolded m_beg_mc mc_def]
       proof (rule Mapping_lookup_combineE)
         assume lassm: "Mapping.lookup m_upd xs = Some tstp"
         then show "xs \<in> filter_a2_map I ts' tp' a2_map"
           unfolding m_upd_def Mapping.lookup_filter
           using m_def tp_minus_le(1) defs
           by (auto simp add: filter_a2_map_def split: option.splits if_splits)
       next
         assume lassm: "Mapping.lookup m' xs = Some tstp"
         then show "xs \<in> filter_a2_map I ts' tp' a2_map"
           using m'_def defs(4) tp_minus_le defs
           unfolding filter_a2_map_def tp_len_assoc
           by auto
       next
         fix v' v''
         assume lassms: "Mapping.lookup m_upd xs = Some v'" "Mapping.lookup m' xs = Some v''"
           "max_tstp v' v'' = tstp"
         show "xs \<in> filter_a2_map I ts' tp' a2_map"
         proof (rule max_tstpE)
           show "isl v' = isl v''"
             using lassms(1,2) m_upd_lookup m'_inst(2)
             by auto
         next
           assume "max_tstp v' v'' = v'"
           then show "xs \<in> filter_a2_map I ts' tp' a2_map"
             using lassms(1,3) m_def defs tp_minus_le(1)
             unfolding tp_len_assoc m_upd_def Mapping.lookup_filter
             by (auto simp add: filter_a2_map_def split: option.splits if_splits)
         next
           assume "max_tstp v' v'' = v''"
           then show "xs \<in> filter_a2_map I ts' tp' a2_map"
             using lassms(2,3) m'_def defs tp_minus_le(2)
             unfolding tp_len_assoc
             by (auto simp add: filter_a2_map_def)
         qed
       qed
     next
       case False
       then have "Mapping.lookup a2_map'' tp_bef = Mapping.lookup a2_map tp_bef"
         using id tp_bef_in by auto
       then show ?thesis
         unfolding filter_a2_map_def
         using defs by auto (metis option.simps(5))
     qed
   qed
   have set_tl_tss': "set (linearize (tl_queue tss')) \<subseteq> set (linearize tss)"
     unfolding tl_queue_rep[OF tss'_not_empty] lin_tss_Cons by auto
   have list_all2'': "list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map pos tp' a1_map)
       (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map'')) tl_aux
       (zip (linearize (tl_queue tss')) [tp - (len - 1)..<tp])"
     using filter_a2_map_cong set_tl_tss'
     by (intro list_all2_weaken[OF list_all2']) (auto elim!: in_set_zipE split: prod.splits)
   have lookup'': "\<forall>tp' \<in> Mapping.keys a2_map''. case Mapping.lookup a2_map'' tp' of Some m \<Rightarrow>
     table n R (Mapping.keys m) \<and> (\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
     tstp_lt tstp (cur - (left I - 1)) tp \<and> isl tstp = (0 < left I))"
   proof (rule ballI)
     fix tp'
     assume assm: "tp' \<in> Mapping.keys a2_map''"
     then obtain f where f_def: "Mapping.lookup a2_map'' tp' = Some f"
       by (auto dest: Mapping_keys_dest)
     have tp'_in: "tp' \<in> {tp - (len - 1)..tp}"
       using assm unfolding a2_map''_keys .
     then have tp'_in_keys: "tp' \<in> Mapping.keys a2_map"
       using valid_before by auto
     have "table n R (Mapping.keys f) \<and>
       (\<forall>xs \<in> Mapping.keys f. case Mapping.lookup f xs of Some tstp \<Rightarrow>
       tstp_lt tstp (cur - (left I - 1)) tp \<and> isl tstp = (0 < left I))"
     proof (cases "tp' = tp - (len - 1)")
       case True
       then have f_mc: "f = mc"
         using f_def
         unfolding a2_map''_def a2_map'_def Mapping_lookup_delete Mapping_lookup_update tp_len_assoc
         by (auto split: if_splits)
       have "table n R (Mapping.keys f)"
         unfolding f_mc
         using mc_keys m_def m'_def m_inst m'_inst
         by (auto simp add: table_def)
       moreover have "\<forall>xs \<in> Mapping.keys f. case Mapping.lookup f xs of Some tstp \<Rightarrow>
         tstp_lt tstp (cur - (left I - 1)) tp \<and> isl tstp = (0 < left I)"
         using assm Mapping.keys_filter m_inst(2) m_inst_isl m'_inst(2) m'_inst_isl max_tstp_isl
         unfolding f_mc mc_def Mapping.lookup_combine
         by (auto simp add: combine_options_def m_upd_def Mapping.lookup_filter
             intro!: max_tstp_intro Mapping_keys_intro dest!: Mapping_keys_dest
             split: option.splits)
       ultimately show ?thesis
         by auto
     next
       case False
       have "Mapping.lookup a2_map tp' = Some f"
         using tp'_in id[of tp'] f_def False by auto
       then show ?thesis
         using tp'_in_keys valid_before
         unfolding valid_mmuaux'.simps I_def n_def R_def by fastforce
     qed
     then show "case Mapping.lookup a2_map'' tp' of Some m \<Rightarrow>
       table n R (Mapping.keys m) \<and> (\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
       tstp_lt tstp (cur - (left I - 1)) tp \<and> isl tstp = (0 < left I))"
       using f_def by auto
   qed
   have tl_aux_def: "tl_aux = drop (length done + 1) auxlist"
     using aux_split(1) by (metis Suc_eq_plus1 add_Suc drop0 drop_Suc_Cons drop_drop)
   have T_eq: "T = filter_a2_map I ts (tp - len) a2_map"
   proof (rule set_eqI, rule iffI)
     fix xs
     assume "xs \<in> filter_a2_map I ts (tp - len) a2_map"
     then obtain tp_bef m_bef tstp where defs: "tp_bef \<le> tp - len"
       "Mapping.lookup a2_map tp_bef = Some m_bef"
       "Mapping.lookup m_bef xs = Some tstp" "ts_tp_lt' ts (tp - len) tstp"
       by (fastforce simp add: filter_a2_map_def split: option.splits)
     then have tp_bef_minus: "tp_bef = tp - len"
       using valid_before Mapping_keys_intro by force
     have m_bef_m: "m_bef = m"
       using defs(2) m_def
       unfolding tp_bef_minus by auto
     show "xs \<in> T"
       using defs
       unfolding T_def m_upd_def m_bef_m
       by (auto intro: Mapping_keys_filterI Mapping_keys_intro)
   next
     fix xs
     assume "xs \<in> T"
     then show "xs \<in> filter_a2_map I ts (tp - len) a2_map"
       using m_def Mapping.keys_filter
       unfolding T_def m_upd_def filter_a2_map_def
       by (auto simp add: filter_a2_map_def dest!: Mapping_keys_filterD split: if_splits)
   qed
   have min_auxlist_done: "min (length auxlist) (length done) = length done"
     using valid_before by auto
   then have "\<forall>x \<in> set (take (length done) auxlist). check_before I dt x"
     "rev done = map proj_thd (take (length done) auxlist)"
     using valid_before unfolding I_def by auto
   then have list_all': "(\<forall>x \<in> set (take (length (T # done)) auxlist). check_before I dt x)"
     "rev (T # done) = map proj_thd (take (length (T # done)) auxlist)"
     using drop_is_Cons_take[OF aux_split(1)] aux_split(2) assms(3)
     by (auto simp add: T_eq I_def)
   have eval_step_mmuaux_eq: "eval_step_mmuaux (tp, tss, len, maskL, maskR, a1_map, a2_map,
     done, done_length) = (tp, tl_queue tss', len - 1,  maskL, maskR, a1_map, a2_map'',
     T # done, done_length + 1)"
     using safe_hd_eq m_def m'_def m_upd_def T_def mc_def a2_map'_def a2_map''_def
     by (auto simp add: Let_def)
   have "lin_ts_mmuaux (eval_step_mmuaux aux) = tss''"
     using lin_tss_Cons assms(2) unfolding aux_def eval_step_mmuaux_eq by auto
   then show ?thesis
     using valid_before a2_map''_keys sorted_tl list_all' lookup'' list_all2''
     unfolding eval_step_mmuaux_eq valid_mmuaux'.simps tl_aux_def aux_def I_def n_def R_def pos_def
     using lin_tss_not_Nil safe_hd_eq len_pos
     by (auto simp add: list.set_sel(2) lin_tss' tl_queue_rep[OF tss'_not_empty] min_auxlist_done)
 qed
 
 lemma done_empty_valid_mmuaux'_intro:
   assumes "valid_mmuaux' args cur dt
     (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length) auxlist"
   shows "valid_mmuaux' args cur dt'
     (tp, tss, len, maskL, maskR, a1_map, a2_map, [], 0)
     (drop (length done) auxlist)"
   using assms sorted_drop by (auto simp add: drop_map[symmetric])
 
 lemma valid_mmuaux'_mono:
   assumes "valid_mmuaux' args cur dt aux auxlist" "dt \<le> dt'"
   shows "valid_mmuaux' args cur dt' aux auxlist"
   using assms less_le_trans by (cases aux) fastforce
 
 lemma valid_foldl_eval_step_mmuaux':
   assumes valid_before: "valid_mmuaux' args cur dt aux auxlist"
     "lin_ts_mmuaux aux = tss @ tss'"
     "\<And>ts. ts \<in> set (take (length tss) (lin_ts_mmuaux aux)) \<Longrightarrow> enat ts + right (args_ivl args) < dt"
   shows "valid_mmuaux' args cur dt (foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss) auxlist \<and>
     lin_ts_mmuaux (foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss) = tss'"
   using assms
 proof (induction tss arbitrary: aux)
   case (Cons ts tss)
   have app_ass: "lin_ts_mmuaux aux = ts # (tss @ tss')"
     using Cons(3) by auto
   have "enat ts + right (args_ivl args) < dt"
     using Cons by auto
   then have valid_step: "valid_mmuaux' args cur dt (eval_step_mmuaux aux) auxlist"
     "lin_ts_mmuaux (eval_step_mmuaux aux) = tss @ tss'"
     using valid_eval_step_mmuaux'[OF Cons(2) app_ass] by auto
   show ?case
     using Cons(1)[OF valid_step] valid_step Cons(4) app_ass by auto
 qed auto
 
 lemma sorted_dropWhile_filter: "sorted xs \<Longrightarrow> dropWhile (\<lambda>t. enat t + right I < enat nt) xs =
   filter (\<lambda>t. \<not>enat t + right I < enat nt) xs"
 proof (induction xs)
   case (Cons x xs)
   then show ?case
   proof (cases "enat x + right I < enat nt")
     case False
     then have neg: "enat x + right I \<ge> enat nt"
       by auto
     have "\<And>z. z \<in> set xs \<Longrightarrow> \<not>enat z + right I < enat nt"
     proof -
       fix z
       assume "z \<in> set xs"
       then have "enat z + right I \<ge> enat x + right I"
         using Cons by auto
       with neg have "enat z + right I \<ge> enat nt"
         using dual_order.trans by blast
       then show "\<not>enat z + right I < enat nt"
         by auto
     qed
     with False show ?thesis
       using filter_empty_conv by auto
   qed auto
 qed auto
 
 fun shift_mmuaux :: "args \<Rightarrow> ts \<Rightarrow> 'a mmuaux \<Rightarrow> 'a mmuaux" where
   "shift_mmuaux args nt (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length) =
     (let tss_list = linearize (takeWhile_queue (\<lambda>t. enat t + right (args_ivl args) < enat nt) tss) in
     foldl (\<lambda>aux _. eval_step_mmuaux aux) (tp, tss, len, maskL, maskR,
       a1_map, a2_map, done, done_length) tss_list)"
 
 lemma valid_shift_mmuaux':
   assumes "valid_mmuaux' args cur cur aux auxlist" "nt \<ge> cur"
   shows "valid_mmuaux' args cur nt (shift_mmuaux args nt aux) auxlist \<and>
     (\<forall>ts \<in> set (lin_ts_mmuaux (shift_mmuaux args nt aux)). \<not>enat ts + right (args_ivl args) < nt)"
 proof -
   define I where "I = args_ivl args"
   define pos where "pos = args_pos args"
   have valid_folded: "valid_mmuaux' args cur nt aux auxlist"
     using assms(1,2) valid_mmuaux'_mono unfolding valid_mmuaux_def by blast
   obtain tp len tss maskL maskR a1_map a2_map "done" done_length where aux_def:
     "aux = (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length)"
     by (cases aux) auto
   note valid_before = valid_folded[unfolded aux_def]
   define tss_list where "tss_list =
     linearize (takeWhile_queue (\<lambda>t. enat t + right I < enat nt) tss)"
   have tss_list_takeWhile: "tss_list = takeWhile (\<lambda>t. enat t + right I < enat nt) (linearize tss)"
     using tss_list_def unfolding takeWhile_queue_rep .
   then obtain tss_list' where tss_list'_def: "linearize tss = tss_list @ tss_list'"
     "tss_list' = dropWhile (\<lambda>t. enat t + right I < enat nt) (linearize tss)"
     by auto
   obtain tp' len' tss' maskL' maskR' a1_map' a2_map' "done'" done_length' where
     foldl_aux_def: "(tp', tss', len', maskL', maskR', a1_map', a2_map',
       done', done_length') = foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss_list"
     by (cases "foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss_list") auto
   have lin_tss_aux: "lin_ts_mmuaux aux = linearize tss"
     unfolding aux_def by auto
   have "take (length tss_list) (lin_ts_mmuaux aux) = tss_list"
     unfolding lin_tss_aux using tss_list'_def(1) by auto
   then have valid_foldl: "valid_mmuaux' args cur nt
     (foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss_list) auxlist"
     "lin_ts_mmuaux (foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss_list) = tss_list'"
     using valid_foldl_eval_step_mmuaux'[OF valid_before[folded aux_def], unfolded lin_tss_aux,
       OF tss_list'_def(1)] tss_list_takeWhile set_takeWhileD
     unfolding lin_tss_aux I_def by fastforce+
   have shift_mmuaux_eq: "shift_mmuaux args nt aux = foldl (\<lambda>aux _. eval_step_mmuaux aux) aux tss_list"
     using tss_list_def unfolding aux_def I_def by auto
   have "\<And>ts. ts \<in> set tss_list' \<Longrightarrow> \<not>enat ts + right (args_ivl args) < nt"
     using sorted_dropWhile_filter tss_list'_def(2) valid_before unfolding I_def by auto
   then show ?thesis
     using valid_foldl(1)[unfolded shift_mmuaux_eq[symmetric]]
     unfolding valid_foldl(2)[unfolded shift_mmuaux_eq[symmetric]] by auto
 qed
 
 lift_definition upd_set' :: "('a, 'b) mapping \<Rightarrow> 'b \<Rightarrow> ('b \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> ('a, 'b) mapping" is
   "\<lambda>m d f X a. (if a \<in> X then (case Mapping.lookup m a of Some b \<Rightarrow> Some (f b) | None \<Rightarrow> Some d)
     else Mapping.lookup m a)" .
 
 lemma upd_set'_lookup: "Mapping.lookup (upd_set' m d f X) a = (if a \<in> X then
   (case Mapping.lookup m a of Some b \<Rightarrow> Some (f b) | None \<Rightarrow> Some d) else Mapping.lookup m a)"
   by (simp add: Mapping.lookup.rep_eq upd_set'.rep_eq)
 
 lemma upd_set'_keys: "Mapping.keys (upd_set' m d f X) = Mapping.keys m \<union> X"
   by (auto simp add: upd_set'_lookup intro!: Mapping_keys_intro
       dest!: Mapping_keys_dest split: option.splits)
 
 lift_definition upd_nested :: "('a, ('b, 'c) mapping) mapping \<Rightarrow>
   'c \<Rightarrow> ('c \<Rightarrow> 'c) \<Rightarrow> ('a \<times> 'b) set \<Rightarrow> ('a, ('b, 'c) mapping) mapping" is
   "\<lambda>m d f X a. case Mapping.lookup m a of Some m' \<Rightarrow> Some (upd_set' m' d f {b. (a, b) \<in> X})
   | None \<Rightarrow> if a \<in> fst ` X then Some (upd_set' Mapping.empty d f {b. (a, b) \<in> X}) else None" .
 
 lemma upd_nested_lookup: "Mapping.lookup (upd_nested m d f X) a =
   (case Mapping.lookup m a of Some m' \<Rightarrow> Some (upd_set' m' d f {b. (a, b) \<in> X})
   | None \<Rightarrow> if a \<in> fst ` X then Some (upd_set' Mapping.empty d f {b. (a, b) \<in> X}) else None)"
   by (simp add: Mapping.lookup.abs_eq upd_nested.abs_eq)
 
 lemma upd_nested_keys: "Mapping.keys (upd_nested m d f X) = Mapping.keys m \<union> fst ` X"
   by (auto simp add: upd_nested_lookup Domain.DomainI fst_eq_Domain intro!: Mapping_keys_intro
       dest!: Mapping_keys_dest split: option.splits)
 
 fun add_new_mmuaux :: "args \<Rightarrow> 'a table \<Rightarrow> 'a table \<Rightarrow> ts \<Rightarrow> 'a mmuaux \<Rightarrow> 'a mmuaux" where
   "add_new_mmuaux args rel1 rel2 nt aux =
     (let (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length) =
     shift_mmuaux args nt aux;
     I = args_ivl args; pos = args_pos args;
     new_tstp = (if left I = 0 then Inr tp else Inl (nt - (left I - 1)));
     tmp = \<Union>((\<lambda>as. case Mapping.lookup a1_map (proj_tuple maskL as) of None \<Rightarrow>
       (if \<not>pos then {(tp - len, as)} else {})
       | Some tp' \<Rightarrow> if pos then {(max (tp - len) tp', as)}
       else {(max (tp - len) (tp' + 1), as)}) ` rel2) \<union> (if left I = 0 then {tp} \<times> rel2 else {});
     a2_map = Mapping.update (tp + 1) Mapping.empty
       (upd_nested a2_map new_tstp (max_tstp new_tstp) tmp);
     a1_map = (if pos then Mapping.filter (\<lambda>as _. as \<in> rel1)
       (upd_set a1_map (\<lambda>_. tp) (rel1 - Mapping.keys a1_map)) else upd_set a1_map (\<lambda>_. tp) rel1);
     tss = append_queue nt tss in
     (tp + 1, tss, len + 1, maskL, maskR, a1_map, a2_map, done, done_length))"
 
 lemma fst_case: "(\<lambda>x. fst (case x of (t, a1, a2) \<Rightarrow> (t, y t a1 a2, z t a1 a2))) = fst"
   by auto
 
 lemma list_all2_in_setE: "list_all2 P xs ys \<Longrightarrow> x \<in> set xs \<Longrightarrow> (\<And>y. y \<in> set ys \<Longrightarrow> P x y \<Longrightarrow> Q) \<Longrightarrow> Q"
   by (fastforce simp: list_all2_iff set_zip in_set_conv_nth)
 
 lemma list_all2_zip: "list_all2 (\<lambda>x y. triple_eq_pair x y f g) xs (zip ys zs) \<Longrightarrow>
   (\<And>y. y \<in> set ys \<Longrightarrow> Q y) \<Longrightarrow> x \<in> set xs \<Longrightarrow> Q (fst x)"
   by (auto simp: in_set_zip elim!: list_all2_in_setE triple_eq_pair.elims)
 
 lemma list_appendE: "xs = ys @ zs \<Longrightarrow> x \<in> set xs \<Longrightarrow>
   (x \<in> set ys \<Longrightarrow> P) \<Longrightarrow> (x \<in> set zs \<Longrightarrow> P) \<Longrightarrow> P"
   by auto
 
 lemma take_takeWhile: "n \<le> length ys \<Longrightarrow>
   (\<And>y. y \<in> set (take n ys) \<Longrightarrow> P y) \<Longrightarrow>
   (\<And>y. y \<in> set (drop n ys) \<Longrightarrow> \<not>P y) \<Longrightarrow>
   take n ys = takeWhile P ys"
 proof (induction ys arbitrary: n)
   case Nil
   then show ?case by simp
 next
   case (Cons y ys)
   then show ?case by (cases n) simp_all
 qed
 
 lemma valid_add_new_mmuaux:
   assumes valid_before: "valid_mmuaux args cur aux auxlist"
     and tabs: "table (args_n args) (args_L args) rel1" "table (args_n args) (args_R args) rel2"
     and nt_mono: "nt \<ge> cur"
   shows "valid_mmuaux args nt (add_new_mmuaux args rel1 rel2 nt aux)
     (update_until args rel1 rel2 nt auxlist)"
 proof -
   define I where "I = args_ivl args"
   define n where "n = args_n args"
   define L where "L = args_L args"
   define R where "R = args_R args"
   define pos where "pos = args_pos args"
   have valid_folded: "valid_mmuaux' args cur nt aux auxlist"
     using assms(1,4) valid_mmuaux'_mono unfolding valid_mmuaux_def by blast
   obtain tp len tss maskL maskR a1_map a2_map "done" done_length where shift_aux_def:
     "shift_mmuaux args nt aux = (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length)"
     by (cases "shift_mmuaux args nt aux") auto
   have valid_shift_aux: "valid_mmuaux' args cur nt (tp, tss, len, maskL, maskR,
     a1_map, a2_map, done, done_length) auxlist"
     "\<And>ts. ts \<in> set (linearize tss) \<Longrightarrow> \<not>enat ts + right (args_ivl args) < enat nt"
     using valid_shift_mmuaux'[OF assms(1)[unfolded valid_mmuaux_def] assms(4)]
     unfolding shift_aux_def by auto
   define new_tstp where "new_tstp = (if left I = 0 then Inr tp else Inl (nt - (left I - 1)))"
   have new_tstp_lt_isl: "tstp_lt new_tstp (nt - (left I - 1)) (tp + 1)"
     "isl new_tstp \<longleftrightarrow> left I > 0"
     by (auto simp add: new_tstp_def tstp_lt_def)
   define tmp where "tmp = \<Union>((\<lambda>as. case Mapping.lookup a1_map (proj_tuple maskL as) of None \<Rightarrow>
     (if \<not>pos then {(tp - len, as)} else {})
     | Some tp' \<Rightarrow> if pos then {(max (tp - len) tp', as)}
     else {(max (tp - len) (tp' + 1), as)}) ` rel2) \<union> (if left I = 0 then {tp} \<times> rel2 else {})"
   have a1_map_lookup: "\<And>as tp'. Mapping.lookup a1_map as = Some tp' \<Longrightarrow> tp' < tp"
     using valid_shift_aux(1) Mapping_keys_intro by force
   then have fst_tmp: "\<And>tp'. tp' \<in> fst ` tmp \<Longrightarrow> tp - len \<le> tp' \<and> tp' < tp + 1"
     unfolding tmp_def by (auto simp add: less_SucI split: option.splits if_splits)
   have snd_tmp: "\<And>tp'. table n R (snd ` tmp)"
     using tabs(2) unfolding tmp_def n_def R_def
     by (auto simp add: table_def split: if_splits option.splits)
   define a2_map' where "a2_map' = Mapping.update (tp + 1) Mapping.empty
     (upd_nested a2_map new_tstp (max_tstp new_tstp) tmp)"
   define a1_map' where "a1_map' = (if pos then Mapping.filter (\<lambda>as _. as \<in> rel1)
     (upd_set a1_map (\<lambda>_. tp) (rel1 - Mapping.keys a1_map)) else upd_set a1_map (\<lambda>_. tp) rel1)"
   define tss' where "tss' = append_queue nt tss"
   have add_new_mmuaux_eq: "add_new_mmuaux args rel1 rel2 nt aux = (tp + 1, tss', len + 1,
     maskL, maskR, a1_map', a2_map', done, done_length)"
     using shift_aux_def new_tstp_def tmp_def a2_map'_def a1_map'_def tss'_def
     unfolding I_def pos_def
     by (auto simp only: add_new_mmuaux.simps Let_def)
   have update_until_eq: "update_until args rel1 rel2 nt auxlist =
     (map (\<lambda>x. case x of (t, a1, a2) \<Rightarrow> (t, if pos then join a1 True rel1 else a1 \<union> rel1,
       if mem (nt - t) I then a2 \<union> join rel2 pos a1 else a2)) auxlist) @
     [(nt, rel1, if left I = 0 then rel2 else empty_table)]"
     unfolding update_until_def I_def pos_def by simp
   have len_done_auxlist: "length done \<le> length auxlist"
     using valid_shift_aux by auto
   have auxlist_split: "auxlist = take (length done) auxlist @ drop (length done) auxlist"
     using len_done_auxlist by auto
   have lin_tss': "linearize tss' = linearize tss @ [nt]"
     unfolding tss'_def append_queue_rep by (rule refl)
   have len_lin_tss': "length (linearize tss') = len + 1"
     unfolding lin_tss' using valid_shift_aux by auto
   have tmp: "sorted (linearize tss)" "\<And>t. t \<in> set (linearize tss) \<Longrightarrow> t \<le> cur"
     using valid_shift_aux by auto
   have sorted_lin_tss': "sorted (linearize tss')"
     unfolding lin_tss' using tmp(1) le_trans[OF _ assms(4), OF tmp(2)]
     by (simp add: sorted_append)
   have in_lin_tss: "\<And>t. t \<in> set (linearize tss) \<Longrightarrow>
     t \<le> cur \<and> enat cur \<le> enat t + right I"
     using valid_shift_aux(1) unfolding I_def by auto
   then have set_lin_tss': "\<forall>t \<in> set (linearize tss'). t \<le> nt \<and> enat nt \<le> enat t + right I"
     unfolding lin_tss' I_def using le_trans[OF _ assms(4)] valid_shift_aux(2)
     by (auto simp add: not_less)
   have a1_map'_keys: "Mapping.keys a1_map' \<subseteq> Mapping.keys a1_map \<union> rel1"
     unfolding a1_map'_def using Mapping.keys_filter Mapping_upd_set_keys
     by (auto simp add: Mapping_upd_set_keys split: if_splits dest: Mapping_keys_filterD)
   then have tab_a1_map'_keys: "table n L (Mapping.keys a1_map')"
     using valid_shift_aux(1) tabs(1) by (auto simp add: table_def n_def L_def)
   have a2_map_keys: "Mapping.keys a2_map = {tp - len..tp}"
     using valid_shift_aux by auto
   have a2_map'_keys: "Mapping.keys a2_map' = {tp - len..tp + 1}"
     unfolding a2_map'_def Mapping.keys_update upd_nested_keys a2_map_keys using fst_tmp
     by fastforce
   then have a2_map'_keys': "Mapping.keys a2_map' = {tp + 1 - (len + 1)..tp + 1}"
     by auto
   have len_upd_until: "length done + (len + 1) = length (update_until args rel1 rel2 nt auxlist)"
     using valid_shift_aux unfolding update_until_eq by auto
   have set_take_auxlist: "\<And>x. x \<in> set (take (length done) auxlist) \<Longrightarrow> check_before I nt x"
     using valid_shift_aux unfolding I_def by auto
   have list_all2_triple: "list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map pos tp' a1_map)
     (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map)) (drop (length done) auxlist)
     (zip (linearize tss) [tp - len..<tp])"
     using valid_shift_aux unfolding I_def pos_def by auto
   have set_drop_auxlist: "\<And>x. x \<in> set (drop (length done) auxlist) \<Longrightarrow> \<not>check_before I nt x"
     using valid_shift_aux(2)[OF list_all2_zip[OF list_all2_triple,
       of "\<lambda>y. y \<in> set (linearize tss)"]]
     unfolding I_def by auto
   have length_done_auxlist: "length done \<le> length auxlist"
     using valid_shift_aux by auto
   have take_auxlist_takeWhile: "take (length done) auxlist = takeWhile (check_before I nt) auxlist"
     using take_takeWhile[OF length_done_auxlist set_take_auxlist set_drop_auxlist] .
   have "length done = length (takeWhile (check_before I nt) auxlist)"
     by (metis (no_types) add_diff_cancel_right' auxlist_split diff_diff_cancel
         length_append length_done_auxlist length_drop take_auxlist_takeWhile)
   then have set_take_auxlist': "\<And>x. x \<in> set (take (length done)
     (update_until args rel1 rel2 nt auxlist)) \<Longrightarrow> check_before I nt x"
     by (metis I_def length_map map_proj_thd_update_until set_takeWhileD takeWhile_eq_take)
   have rev_done: "rev done = map proj_thd (take (length done) auxlist)"
     using valid_shift_aux by auto
   moreover have "\<dots> = map proj_thd (takeWhile (check_before I nt)
     (update_until args rel1 rel2 nt auxlist))"
     by (simp add: take_auxlist_takeWhile map_proj_thd_update_until I_def)
   finally have rev_done': "rev done = map proj_thd (take (length done)
     (update_until args rel1 rel2 nt auxlist))"
     by (metis length_map length_rev takeWhile_eq_take)
   have map_fst_auxlist_take: "\<And>t. t \<in> set (map fst (take (length done) auxlist)) \<Longrightarrow> t \<le> nt"
     using set_take_auxlist
     by auto (meson add_increasing2 enat_ord_simps(1) le_cases not_less zero_le)
   have map_fst_auxlist_drop: "\<And>t. t \<in> set (map fst (drop (length done) auxlist)) \<Longrightarrow> t \<le> nt"
     using in_lin_tss[OF list_all2_zip[OF list_all2_triple, of "\<lambda>y. y \<in> set (linearize tss)"]]
       assms(4) dual_order.trans by auto blast
   have set_drop_auxlist_cong: "\<And>x t a1 a2. x \<in> set (drop (length done) auxlist) \<Longrightarrow>
     x = (t, a1, a2) \<Longrightarrow> mem (nt - t) I \<longleftrightarrow> left I \<le> nt - t"
   proof -
     fix x t a1 a2
     assume "x \<in> set (drop (length done) auxlist)" "x = (t, a1, a2)"
     then have "enat t + right I \<ge> enat nt"
       using set_drop_auxlist not_less
       by auto blast
     then have "right I \<ge> enat (nt - t)"
       by (cases "right I") auto
     then show "mem (nt - t) I \<longleftrightarrow> left I \<le> nt - t"
       by auto
   qed
   have sorted_fst_auxlist: "sorted (map fst auxlist)"
     using valid_shift_aux by auto
   have set_map_fst_auxlist: "\<And>t. t \<in> set (map fst auxlist) \<Longrightarrow> t \<le> nt"
     using arg_cong[OF auxlist_split, of "map fst", unfolded map_append] map_fst_auxlist_take
       map_fst_auxlist_drop by auto
   have lookup_a1_map_keys: "\<And>xs tp'. Mapping.lookup a1_map xs = Some tp' \<Longrightarrow> tp' < tp"
     using valid_shift_aux Mapping_keys_intro by force
   have lookup_a1_map_keys': "\<forall>xs \<in> Mapping.keys a1_map'.
     case Mapping.lookup a1_map' xs of Some tp' \<Rightarrow> tp' < tp + 1"
     using lookup_a1_map_keys unfolding a1_map'_def
     by (auto simp add: Mapping.lookup_filter Mapping_lookup_upd_set Mapping_upd_set_keys
         split: option.splits dest: Mapping_keys_dest) fastforce+
   have sorted_upd_until: "sorted (map fst (update_until args rel1 rel2 nt auxlist))"
     using sorted_fst_auxlist set_map_fst_auxlist
     unfolding update_until_eq
     by (auto simp add: sorted_append comp_def fst_case)
   have lookup_a2_map: "\<And>tp' m. Mapping.lookup a2_map tp' = Some m \<Longrightarrow>
     table n R (Mapping.keys m) \<and> (\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
       tstp_lt tstp (cur - (left I - 1)) tp \<and> (isl tstp \<longleftrightarrow> left I > 0))"
     using valid_shift_aux(1) Mapping_keys_intro unfolding I_def n_def R_def by force
   then have lookup_a2_map': "\<And>tp' m xs tstp. Mapping.lookup a2_map tp' = Some m \<Longrightarrow>
     Mapping.lookup m xs = Some tstp \<Longrightarrow> tstp_lt tstp (nt - (left I - 1)) tp \<and>
     isl tstp = (0 < left I)"
     using Mapping_keys_intro assms(4) by (force simp add: tstp_lt_def split: sum.splits)
   have lookup_a2_map'_keys: "\<forall>tp' \<in> Mapping.keys a2_map'.
     case Mapping.lookup a2_map' tp' of Some m \<Rightarrow> table n R (Mapping.keys m) \<and>
     (\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
     tstp_lt tstp (nt - (left I - 1)) (tp + 1) \<and> isl tstp = (0 < left I))"
   proof (rule ballI)
     fix tp'
     assume tp'_assm: "tp' \<in> Mapping.keys a2_map'"
     then obtain m' where m'_def: "Mapping.lookup a2_map' tp' = Some m'"
       by (auto dest: Mapping_keys_dest)
     have "table n R (Mapping.keys m') \<and>
       (\<forall>xs \<in> Mapping.keys m'. case Mapping.lookup m' xs of Some tstp \<Rightarrow>
       tstp_lt tstp (nt - (left I - 1)) (tp + 1) \<and> isl tstp = (0 < left I))"
     proof (cases "tp' = tp + 1")
       case True
       show ?thesis
         using m'_def unfolding a2_map'_def True Mapping.lookup_update
         by (auto simp add: table_def)
     next
       case False
       then have tp'_in: "tp' \<in> Mapping.keys a2_map"
         using tp'_assm unfolding a2_map_keys a2_map'_keys by auto
       then obtain m where m_def: "Mapping.lookup a2_map tp' = Some m"
         by (auto dest: Mapping_keys_dest)
       have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp', b) \<in> tmp}"
         using m_def m'_def unfolding a2_map'_def Mapping.lookup_update_neq[OF False[symmetric]]
           upd_nested_lookup
         by auto
       have "table n R (Mapping.keys m')"
         using lookup_a2_map[OF m_def] snd_tmp unfolding m'_alt upd_set'_keys
         by (auto simp add: table_def)
       moreover have "\<forall>xs \<in> Mapping.keys m'. case Mapping.lookup m' xs of Some tstp \<Rightarrow>
         tstp_lt tstp (nt - (left I - 1)) (tp + 1) \<and> isl tstp = (0 < left I)"
       proof (rule ballI)
         fix xs
         assume xs_assm: "xs \<in> Mapping.keys m'"
         then obtain tstp where tstp_def: "Mapping.lookup m' xs = Some tstp"
           by (auto dest: Mapping_keys_dest)
         have "tstp_lt tstp (nt - (left I - 1)) (tp + 1) \<and> isl tstp = (0 < left I)"
         proof (cases "Mapping.lookup m xs")
           case None
           then show ?thesis
             using tstp_def[unfolded m'_alt upd_set'_lookup] new_tstp_lt_isl
             by (auto split: if_splits)
         next
           case (Some tstp')
           show ?thesis
           proof (cases "xs \<in> {b. (tp', b) \<in> tmp}")
             case True
             then have tstp_eq: "tstp = max_tstp new_tstp tstp'"
               using tstp_def[unfolded m'_alt upd_set'_lookup] Some
               by auto
             show ?thesis
               using lookup_a2_map'[OF m_def Some] new_tstp_lt_isl
               by (auto simp add: tstp_lt_def tstp_eq split: sum.splits)
           next
             case False
             then show ?thesis
               using tstp_def[unfolded m'_alt upd_set'_lookup] lookup_a2_map'[OF m_def Some] Some
               by (auto simp add: tstp_lt_def split: sum.splits)
           qed
         qed
         then show "case Mapping.lookup m' xs of Some tstp \<Rightarrow>
           tstp_lt tstp (nt - (left I - 1)) (tp + 1) \<and> isl tstp = (0 < left I)"
           using tstp_def by auto
       qed
       ultimately show ?thesis
         by auto
     qed
     then show "case Mapping.lookup a2_map' tp' of Some m \<Rightarrow> table n R (Mapping.keys m) \<and>
       (\<forall>xs \<in> Mapping.keys m. case Mapping.lookup m xs of Some tstp \<Rightarrow>
       tstp_lt tstp (nt - (left I - 1)) (tp + 1) \<and> isl tstp = (0 < left I))"
       using m'_def by auto
   qed
   have tp_upt_Suc: "[tp + 1 - (len + 1)..<tp + 1] = [tp - len..<tp] @ [tp]"
     using upt_Suc by auto
   have map_eq: "map (\<lambda>x. case x of (t, a1, a2) \<Rightarrow> (t, if pos then join a1 True rel1 else a1 \<union> rel1,
       if mem (nt - t) I then a2 \<union> join rel2 pos a1 else a2)) (drop (length done) auxlist) =
     map (\<lambda>x. case x of (t, a1, a2) \<Rightarrow> (t, if pos then join a1 True rel1 else a1 \<union> rel1,
       if left I \<le> nt - t then a2 \<union> join rel2 pos a1 else a2)) (drop (length done) auxlist)"
     using set_drop_auxlist_cong by auto
   have "drop (length done) (update_until args rel1 rel2 nt auxlist) =
     map (\<lambda>x. case x of (t, a1, a2) \<Rightarrow> (t, if pos then join a1 True rel1 else a1 \<union> rel1,
       if mem (nt - t) I then a2 \<union> join rel2 pos a1 else a2)) (drop (length done) auxlist) @
     [(nt, rel1, if left I = 0 then rel2 else empty_table)]"
     unfolding update_until_eq using len_done_auxlist drop_map by auto
   note drop_update_until = this[unfolded map_eq]
   have list_all2_old: "list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map pos tp' a1_map')
     (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map'))
     (map (\<lambda>(t, a1, a2). (t, if pos then join a1 True rel1 else a1 \<union> rel1,
       if left I \<le> nt - t then a2 \<union> join rel2 pos a1 else a2)) (drop (length done) auxlist))
     (zip (linearize tss) [tp - len..<tp])"
     unfolding list_all2_map1
     using list_all2_triple
   proof (rule list.rel_mono_strong)
     fix tri pair
     assume tri_pair_in: "tri \<in> set (drop (length done) auxlist)"
       "pair \<in> set (zip (linearize tss) [tp - len..<tp])"
     obtain t a1 a2 where tri_def: "tri = (t, a1, a2)"
       by (cases tri) auto
     obtain ts' tp' where pair_def: "pair = (ts', tp')"
       by (cases pair) auto
     assume "triple_eq_pair tri pair (\<lambda>tp'. filter_a1_map pos tp' a1_map)
       (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map)"
     then have eqs: "t = ts'" "a1 = filter_a1_map pos tp' a1_map"
       "a2 = filter_a2_map I ts' tp' a2_map"
       unfolding tri_def pair_def by auto
     have tp'_ge: "tp' \<ge> tp - len"
       using tri_pair_in(2) unfolding pair_def
       by (auto elim: in_set_zipE)
     have tp'_lt_tp: "tp' < tp"
       using tri_pair_in(2) unfolding pair_def
       by (auto elim: in_set_zipE)
     have ts'_in_lin_tss: "ts' \<in> set (linearize tss)"
       using tri_pair_in(2) unfolding pair_def
       by (auto elim: in_set_zipE)
     then have ts'_nt: "ts' \<le> nt"
       using valid_shift_aux(1) assms(4) by auto
     then have t_nt: "t \<le> nt"
       unfolding eqs(1) .
     have "table n L (Mapping.keys a1_map)"
       using valid_shift_aux unfolding n_def L_def by auto
     then have a1_tab: "table n L a1"
       unfolding eqs(2) filter_a1_map_def by (auto simp add: table_def)
     note tabR = tabs(2)[unfolded n_def[symmetric] R_def[symmetric]]
     have join_rel2_assms: "L \<subseteq> R" "maskL = join_mask n L"
       using valid_shift_aux unfolding n_def L_def R_def by auto
     have join_rel2_eq: "join rel2 pos a1 = {xs \<in> rel2. proj_tuple_in_join pos maskL xs a1}"
       using join_sub[OF join_rel2_assms(1) a1_tab tabR] join_rel2_assms(2) by auto
     have filter_sub_a2: "\<And>xs m' tp'' tstp. tp'' \<le> tp' \<Longrightarrow>
       Mapping.lookup a2_map' tp'' = Some m' \<Longrightarrow> Mapping.lookup m' xs = Some tstp \<Longrightarrow>
       ts_tp_lt' ts' tp' tstp \<Longrightarrow> (tstp = new_tstp \<Longrightarrow> False) \<Longrightarrow>
       xs \<in> filter_a2_map I ts' tp' a2_map' \<Longrightarrow> xs \<in> a2"
     proof -
       fix xs m' tp'' tstp
       assume m'_def: "tp'' \<le> tp'" "Mapping.lookup a2_map' tp'' = Some m'"
         "Mapping.lookup m' xs = Some tstp" "ts_tp_lt' ts' tp' tstp"
       have tp''_neq: "tp + 1 \<noteq> tp''"
         using le_less_trans[OF m'_def(1) tp'_lt_tp] by auto
       assume new_tstp_False: "tstp = new_tstp \<Longrightarrow> False"
       show "xs \<in> a2"
       proof (cases "Mapping.lookup a2_map tp''")
         case None
         then have m'_alt: "m' = upd_set' Mapping.empty new_tstp (max_tstp new_tstp)
           {b. (tp'', b) \<in> tmp}"
           using m'_def(2)[unfolded a2_map'_def Mapping.lookup_update_neq[OF tp''_neq]
             upd_nested_lookup] by (auto split: option.splits if_splits)
         then show ?thesis
           using new_tstp_False m'_def(3)[unfolded m'_alt upd_set'_lookup Mapping.lookup_empty]
           by (auto split: if_splits)
       next
         case (Some m)
         then have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp'', b) \<in> tmp}"
           using m'_def(2)[unfolded a2_map'_def Mapping.lookup_update_neq[OF tp''_neq]
             upd_nested_lookup] by (auto split: option.splits if_splits)
         note lookup_m = Some
         show ?thesis
         proof (cases "Mapping.lookup m xs")
           case None
           then show ?thesis
             using new_tstp_False m'_def(3)[unfolded m'_alt upd_set'_lookup]
             by (auto split: if_splits)
         next
           case (Some tstp')
           have tstp_ok: "tstp = tstp' \<Longrightarrow> xs \<in> a2"
             using eqs(3) lookup_m Some m'_def unfolding filter_a2_map_def by auto
           show ?thesis
           proof (cases "xs \<in> {b. (tp'', b) \<in> tmp}")
             case True
             then have tstp_eq: "tstp = max_tstp new_tstp tstp'"
               using m'_def(3)[unfolded m'_alt upd_set'_lookup Some] by auto
             show ?thesis
               using lookup_a2_map'[OF lookup_m Some] new_tstp_lt_isl(2)
                 tstp_eq new_tstp_False tstp_ok
               by (auto intro: max_tstpE[of new_tstp tstp'])
           next
             case False
             then have "tstp = tstp'"
               using m'_def(3)[unfolded m'_alt upd_set'_lookup Some] by auto
             then show ?thesis
               using tstp_ok by auto
           qed
         qed
       qed
     qed
     have a2_sub_filter: "a2 \<subseteq> filter_a2_map I ts' tp' a2_map'"
     proof (rule subsetI)
       fix xs
       assume xs_in: "xs \<in> a2"
       then obtain tp'' m tstp where m_def: "tp'' \<le> tp'" "Mapping.lookup a2_map tp'' = Some m"
         "Mapping.lookup m xs = Some tstp" "ts_tp_lt' ts' tp' tstp"
         using eqs(3)[unfolded filter_a2_map_def] by (auto split: option.splits)
       have tp''_in: "tp'' \<in> {tp - len..tp}"
         using m_def(2) a2_map_keys by (auto intro!: Mapping_keys_intro)
       then obtain m' where m'_def: "Mapping.lookup a2_map' tp'' = Some m'"
         using a2_map'_keys
         by (metis Mapping_keys_dest One_nat_def add_Suc_right add_diff_cancel_right'
             atLeastatMost_subset_iff diff_zero le_eq_less_or_eq le_less_Suc_eq subsetD)
       have tp''_neq: "tp + 1 \<noteq> tp''"
         using m_def(1) tp'_lt_tp by auto
       have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp'', b) \<in> tmp}"
         using m'_def[unfolded a2_map'_def Mapping.lookup_update_neq[OF tp''_neq] m_def(2)
           upd_nested_lookup] by (auto split: option.splits if_splits)
       show "xs \<in> filter_a2_map I ts' tp' a2_map'"
       proof (cases "xs \<in> {b. (tp'', b) \<in> tmp}")
         case True
         then have "Mapping.lookup m' xs = Some (max_tstp new_tstp tstp)"
           unfolding m'_alt upd_set'_lookup m_def(3) by auto
         moreover have "ts_tp_lt' ts' tp' (max_tstp new_tstp tstp)"
           using new_tstp_lt_isl(2) lookup_a2_map'[OF m_def(2,3)]
           by (auto intro: max_tstp_intro''''[OF _ m_def(4)])
         ultimately show ?thesis
           unfolding filter_a2_map_def using m_def(1) m'_def m_def(4) by auto
       next
         case False
         then have "Mapping.lookup m' xs = Some tstp"
           unfolding m'_alt upd_set'_lookup m_def(3) by auto
         then show ?thesis
           unfolding filter_a2_map_def using m_def(1) m'_def m_def by auto
       qed
     qed
     have "pos \<Longrightarrow> filter_a1_map pos tp' a1_map' = join a1 True rel1"
     proof -
       assume pos: pos
       note tabL = tabs(1)[unfolded n_def[symmetric] L_def[symmetric]]
       have join_eq: "join a1 True rel1 = a1 \<inter> rel1"
         using join_eq[OF tabL a1_tab] by auto
       show "filter_a1_map pos tp' a1_map' = join a1 True rel1"
         using eqs(2) pos tp'_lt_tp unfolding filter_a1_map_def a1_map'_def join_eq
         by (auto simp add: Mapping.lookup_filter Mapping_lookup_upd_set split: if_splits option.splits
             intro: Mapping_keys_intro dest: Mapping_keys_dest Mapping_keys_filterD)
     qed
     moreover have "\<not>pos \<Longrightarrow> filter_a1_map pos tp' a1_map' = a1 \<union> rel1"
       using eqs(2) tp'_lt_tp unfolding filter_a1_map_def a1_map'_def
       by (auto simp add: Mapping.lookup_filter Mapping_lookup_upd_set intro: Mapping_keys_intro
           dest: Mapping_keys_filterD Mapping_keys_dest split: option.splits)
     moreover have "left I \<le> nt - t \<Longrightarrow> filter_a2_map I ts' tp' a2_map' = a2 \<union> join rel2 pos a1"
     proof (rule set_eqI, rule iffI)
       fix xs
       assume in_int: "left I \<le> nt - t"
       assume xs_in: "xs \<in> filter_a2_map I ts' tp' a2_map'"
       then obtain m' tp'' tstp where m'_def: "tp'' \<le> tp'" "Mapping.lookup a2_map' tp'' = Some m'"
         "Mapping.lookup m' xs = Some tstp" "ts_tp_lt' ts' tp' tstp"
         unfolding filter_a2_map_def by (fastforce split: option.splits)
       show "xs \<in> a2 \<union> join rel2 pos a1"
       proof (cases "tstp = new_tstp")
         case True
         note tstp_new_tstp = True
         have tp''_neq: "tp + 1 \<noteq> tp''"
           using m'_def(1) tp'_lt_tp by auto
         have tp''_in: "tp'' \<in> {tp - len..tp}"
           using m'_def(1,2) tp'_lt_tp a2_map'_keys
           by (auto intro!: Mapping_keys_intro)
         obtain m where m_def: "Mapping.lookup a2_map tp'' = Some m"
           "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp'', b) \<in> tmp}"
           using m'_def(2)[unfolded a2_map'_def Mapping.lookup_update_neq[OF tp''_neq]
             upd_nested_lookup] tp''_in a2_map_keys
           by (fastforce dest: Mapping_keys_dest split: option.splits if_splits)
         show ?thesis
         proof (cases "Mapping.lookup m xs = Some new_tstp")
           case True
           then show ?thesis
             using eqs(3) m'_def(1) m_def(1) m'_def tstp_new_tstp
             unfolding filter_a2_map_def by auto
         next
           case False
           then have xs_in_snd_tmp: "xs \<in> {b. (tp'', b) \<in> tmp}"
             using m'_def(3)[unfolded m_def(2) upd_set'_lookup True]
             by (auto split: if_splits)
           then have xs_in_rel2: "xs \<in> rel2"
             unfolding tmp_def
             by (auto split: if_splits option.splits)
           show ?thesis
           proof (cases pos)
             case True
             obtain tp''' where tp'''_def: "Mapping.lookup a1_map (proj_tuple maskL xs) = Some tp'''"
               "if pos then tp'' = max (tp - len) tp''' else tp'' = max (tp - len) (tp''' + 1)"
               using xs_in_snd_tmp m'_def(1) tp'_lt_tp True
               unfolding tmp_def by (auto split: option.splits if_splits)
             have "proj_tuple maskL xs \<in> a1"
               using eqs(2)[unfolded filter_a1_map_def] True m'_def(1) tp'''_def
               by (auto intro: Mapping_keys_intro)
             then show ?thesis
               using True xs_in_rel2 unfolding proj_tuple_in_join_def join_rel2_eq by auto
           next
             case False
             show ?thesis
             proof (cases "Mapping.lookup a1_map (proj_tuple maskL xs)")
               case None
               then show ?thesis
                 using xs_in_rel2 False eqs(2)[unfolded filter_a1_map_def]
                 unfolding proj_tuple_in_join_def join_rel2_eq
                 by (auto dest: Mapping_keys_dest)
             next
               case (Some tp''')
               then have "tp'' = max (tp - len) (tp''' + 1)"
                 using xs_in_snd_tmp m'_def(1) tp'_lt_tp False
                 unfolding tmp_def by (auto split: option.splits if_splits)
               then have "tp''' < tp'"
                 using m'_def(1) by auto
               then have "proj_tuple maskL xs \<notin> a1"
                 using eqs(2)[unfolded filter_a1_map_def] True m'_def(1) Some False
                 by (auto intro: Mapping_keys_intro)
               then show ?thesis
                 using xs_in_rel2 False unfolding proj_tuple_in_join_def join_rel2_eq by auto
             qed
           qed
         qed
       next
         case False
         then show ?thesis
           using filter_sub_a2[OF m'_def _ xs_in] by auto
       qed
     next
       fix xs
       assume in_int: "left I \<le> nt - t"
       assume xs_in: "xs \<in> a2 \<union> join rel2 pos a1"
       then have "xs \<in> a2 \<union> (join rel2 pos a1 - a2)"
         by auto
       then show "xs \<in> filter_a2_map I ts' tp' a2_map'"
       proof (rule UnE)
         assume "xs \<in> a2"
         then show "xs \<in> filter_a2_map I ts' tp' a2_map'"
           using a2_sub_filter by auto
       next
         assume "xs \<in> join rel2 pos a1 - a2"
         then have xs_props: "xs \<in> rel2" "xs \<notin> a2" "proj_tuple_in_join pos maskL xs a1"
           unfolding join_rel2_eq by auto
         have ts_tp_lt'_new_tstp: "ts_tp_lt' ts' tp' new_tstp"
           using tp'_lt_tp in_int t_nt eqs(1) unfolding new_tstp_def
           by (auto simp add: ts_tp_lt'_def)
         show "xs \<in> filter_a2_map I ts' tp' a2_map'"
         proof (cases pos)
           case True
           then obtain tp''' where tp'''_def: "tp''' \<le> tp'"
             "Mapping.lookup a1_map (proj_tuple maskL xs) = Some tp'''"
             using eqs(2)[unfolded filter_a1_map_def] xs_props(3)[unfolded proj_tuple_in_join_def]
             by (auto dest: Mapping_keys_dest)
           define wtp where "wtp \<equiv> max (tp - len) tp'''"
           have wtp_xs_in: "(wtp, xs) \<in> tmp"
             unfolding wtp_def using tp'''_def tmp_def xs_props(1) True by fastforce
           have wtp_le: "wtp \<le> tp'"
             using tp'''_def(1) tp'_ge unfolding wtp_def by auto
           have wtp_in: "wtp \<in> {tp - len..tp}"
             using tp'''_def(1) tp'_lt_tp unfolding wtp_def by auto
           have wtp_neq: "tp + 1 \<noteq> wtp"
             using wtp_in by auto
           obtain m where m_def: "Mapping.lookup a2_map wtp = Some m"
             using wtp_in a2_map_keys Mapping_keys_dest by fastforce
           obtain m' where m'_def: "Mapping.lookup a2_map' wtp = Some m'"
             using wtp_in a2_map'_keys Mapping_keys_dest by fastforce
           have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (wtp, b) \<in> tmp}"
             using m'_def[unfolded a2_map'_def Mapping.lookup_update_neq[OF wtp_neq]
               upd_nested_lookup m_def] by auto
           show ?thesis
           proof (cases "Mapping.lookup m xs")
             case None
             have "Mapping.lookup m' xs = Some new_tstp"
               using wtp_xs_in unfolding m'_alt upd_set'_lookup None by auto
             then show ?thesis
               unfolding filter_a2_map_def using wtp_le m'_def ts_tp_lt'_new_tstp by auto
           next
             case (Some tstp')
             have "Mapping.lookup m' xs = Some (max_tstp new_tstp tstp')"
               using wtp_xs_in unfolding m'_alt upd_set'_lookup Some by auto
             moreover have "ts_tp_lt' ts' tp' (max_tstp new_tstp tstp')"
               using max_tstp_intro''' ts_tp_lt'_new_tstp lookup_a2_map'[OF m_def Some] new_tstp_lt_isl
               by auto
             ultimately show ?thesis
               using lookup_a2_map'[OF m_def Some] wtp_le m'_def
               unfolding filter_a2_map_def by auto
           qed
         next
           case False
           show ?thesis
           proof (cases "Mapping.lookup a1_map (proj_tuple maskL xs)")
             case None
             then have in_tmp: "(tp - len, xs) \<in> tmp"
               using tmp_def False xs_props(1) by fastforce
             obtain m where m_def: "Mapping.lookup a2_map (tp - len) = Some m"
               using a2_map_keys by (fastforce dest: Mapping_keys_dest)
             obtain m' where m'_def: "Mapping.lookup a2_map' (tp - len) = Some m'"
               using a2_map'_keys by (fastforce dest: Mapping_keys_dest)
             have tp_neq: "tp + 1 \<noteq> tp - len"
               by auto
             have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp - len, b) \<in> tmp}"
               using m'_def[unfolded a2_map'_def Mapping.lookup_update_neq[OF tp_neq]
                 upd_nested_lookup m_def] by auto
             show ?thesis
             proof (cases "Mapping.lookup m xs")
               case None
               have "Mapping.lookup m' xs = Some new_tstp"
                 unfolding m'_alt upd_set'_lookup None using in_tmp by auto
               then show ?thesis
                 unfolding filter_a2_map_def using tp'_ge m'_def ts_tp_lt'_new_tstp by auto
             next
               case (Some tstp')
               have "Mapping.lookup m' xs = Some (max_tstp new_tstp tstp')"
                 unfolding m'_alt upd_set'_lookup Some using in_tmp by auto
               moreover have "ts_tp_lt' ts' tp' (max_tstp new_tstp tstp')"
                 using max_tstp_intro''' ts_tp_lt'_new_tstp lookup_a2_map'[OF m_def Some] new_tstp_lt_isl
                 by auto
               ultimately show ?thesis
                 unfolding filter_a2_map_def using tp'_ge m'_def by auto
             qed
           next
             case (Some tp''')
             then have tp'_gt: "tp' > tp'''"
               using xs_props(3)[unfolded proj_tuple_in_join_def] eqs(2)[unfolded filter_a1_map_def]
                 False by (auto intro: Mapping_keys_intro)
             define wtp where "wtp \<equiv> max (tp - len) (tp''' + 1)"
             have wtp_xs_in: "(wtp, xs) \<in> tmp"
               unfolding wtp_def tmp_def using xs_props(1) Some False by fastforce
             have wtp_le: "wtp \<le> tp'"
               using tp'_ge tp'_gt unfolding wtp_def by auto
             have wtp_in: "wtp \<in> {tp - len..tp}"
               using tp'_lt_tp tp'_gt unfolding wtp_def by auto
             have wtp_neq: "tp + 1 \<noteq> wtp"
               using wtp_in by auto
             obtain m where m_def: "Mapping.lookup a2_map wtp = Some m"
               using wtp_in a2_map_keys Mapping_keys_dest by fastforce
             obtain m' where m'_def: "Mapping.lookup a2_map' wtp = Some m'"
               using wtp_in a2_map'_keys Mapping_keys_dest by fastforce
             have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (wtp, b) \<in> tmp}"
               using m'_def[unfolded a2_map'_def Mapping.lookup_update_neq[OF wtp_neq]
                 upd_nested_lookup m_def] by auto
             show ?thesis
             proof (cases "Mapping.lookup m xs")
               case None
               have "Mapping.lookup m' xs = Some new_tstp"
                 using wtp_xs_in unfolding m'_alt upd_set'_lookup None by auto
               then show ?thesis
                 unfolding filter_a2_map_def using wtp_le m'_def ts_tp_lt'_new_tstp by auto
             next
               case (Some tstp')
               have "Mapping.lookup m' xs = Some (max_tstp new_tstp tstp')"
                 using wtp_xs_in unfolding m'_alt upd_set'_lookup Some by auto
               moreover have "ts_tp_lt' ts' tp' (max_tstp new_tstp tstp')"
                 using max_tstp_intro''' ts_tp_lt'_new_tstp lookup_a2_map'[OF m_def Some] new_tstp_lt_isl
                 by auto
               ultimately show ?thesis
                 using lookup_a2_map'[OF m_def Some] wtp_le m'_def
                 unfolding filter_a2_map_def by auto
             qed
           qed
         qed
       qed
     qed
     moreover have "nt - t < left I \<Longrightarrow> filter_a2_map I ts' tp' a2_map' = a2"
     proof (rule set_eqI, rule iffI)
       fix xs
       assume out: "nt - t < left I"
       assume xs_in: "xs \<in> filter_a2_map I ts' tp' a2_map'"
       then obtain m' tp'' tstp where m'_def: "tp'' \<le> tp'" "Mapping.lookup a2_map' tp'' = Some m'"
         "Mapping.lookup m' xs = Some tstp" "ts_tp_lt' ts' tp' tstp"
         unfolding filter_a2_map_def by (fastforce split: option.splits)
       have new_tstp_False: "tstp = new_tstp \<Longrightarrow> False"
         using m'_def t_nt out tp'_lt_tp unfolding eqs(1)
         by (auto simp add: ts_tp_lt'_def new_tstp_def)
       show "xs \<in> a2"
         using filter_sub_a2[OF m'_def new_tstp_False xs_in] .
     next
       fix xs
       assume "xs \<in> a2"
       then show "xs \<in> filter_a2_map I ts' tp' a2_map'"
         using a2_sub_filter by auto
     qed
     ultimately show "triple_eq_pair (case tri of (t, a1, a2) \<Rightarrow>
       (t, if pos then join a1 True rel1 else a1 \<union> rel1,
       if left I \<le> nt - t then a2 \<union> join rel2 pos a1 else a2))
       pair (\<lambda>tp'. filter_a1_map pos tp' a1_map') (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map')"
       using eqs unfolding tri_def pair_def by auto
   qed
   have filter_a1_map_rel1: "filter_a1_map pos tp a1_map' = rel1"
     unfolding filter_a1_map_def a1_map'_def using leD lookup_a1_map_keys
     by (force simp add: a1_map_lookup less_imp_le_nat Mapping.lookup_filter
         Mapping_lookup_upd_set keys_is_none_rep dest: Mapping_keys_filterD
         intro: Mapping_keys_intro split: option.splits)
   have filter_a1_map_rel2: "filter_a2_map I nt tp a2_map' =
     (if left I = 0 then rel2 else empty_table)"
   proof (cases "left I = 0")
     case True
     note left_I_zero = True
     have "\<And>tp' m' xs tstp. tp' \<le> tp \<Longrightarrow> Mapping.lookup a2_map' tp' = Some m' \<Longrightarrow>
       Mapping.lookup m' xs = Some tstp \<Longrightarrow> ts_tp_lt' nt tp tstp \<Longrightarrow> xs \<in> rel2"
     proof -
       fix tp' m' xs tstp
       assume lassms: "tp' \<le> tp" "Mapping.lookup a2_map' tp' = Some m'"
         "Mapping.lookup m' xs = Some tstp" "ts_tp_lt' nt tp tstp"
       have tp'_neq: "tp + 1 \<noteq> tp'"
         using lassms(1) by auto
       have tp'_in: "tp' \<in> {tp - len..tp}"
         using lassms(1,2) a2_map'_keys tp'_neq by (auto intro!: Mapping_keys_intro)
       obtain m where m_def: "Mapping.lookup a2_map tp' = Some m"
         "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp', b) \<in> tmp}"
         using lassms(2)[unfolded a2_map'_def Mapping.lookup_update_neq[OF tp'_neq]
           upd_nested_lookup] tp'_in a2_map_keys
         by (fastforce dest: Mapping_keys_dest intro: Mapping_keys_intro split: option.splits)
       have "xs \<in> {b. (tp', b) \<in> tmp}"
       proof (rule ccontr)
         assume "xs \<notin> {b. (tp', b) \<in> tmp}"
         then have Some: "Mapping.lookup m xs = Some tstp"
           using lassms(3)[unfolded m_def(2) upd_set'_lookup] by auto
         show "False"
           using lookup_a2_map'[OF m_def(1) Some] lassms(4)
           by (auto simp add: tstp_lt_def ts_tp_lt'_def split: sum.splits)
       qed
       then show "xs \<in> rel2"
         unfolding tmp_def by (auto split: option.splits if_splits)
     qed
     moreover have "\<And>xs. xs \<in> rel2 \<Longrightarrow> \<exists>m' tstp. Mapping.lookup a2_map' tp = Some m' \<and>
       Mapping.lookup m' xs = Some tstp \<and> ts_tp_lt' nt tp tstp"
     proof -
       fix xs
       assume lassms: "xs \<in> rel2"
       obtain m' where m'_def: "Mapping.lookup a2_map' tp = Some m'"
         using a2_map'_keys by (fastforce dest: Mapping_keys_dest)
       have tp_neq: "tp + 1 \<noteq> tp"
         by auto
       obtain m where m_def: "Mapping.lookup a2_map tp = Some m"
         "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp, b) \<in> tmp}"
         using m'_def a2_map_keys unfolding a2_map'_def Mapping.lookup_update_neq[OF tp_neq]
           upd_nested_lookup
         by (auto dest: Mapping_keys_dest split: option.splits if_splits)
            (metis Mapping_keys_dest atLeastAtMost_iff diff_le_self le_eq_less_or_eq
             option.simps(3))
       have xs_in_tmp: "xs \<in> {b. (tp, b) \<in> tmp}"
         using lassms left_I_zero unfolding tmp_def by auto
       show "\<exists>m' tstp. Mapping.lookup a2_map' tp = Some m' \<and>
         Mapping.lookup m' xs = Some tstp \<and> ts_tp_lt' nt tp tstp"
       proof (cases "Mapping.lookup m xs")
         case None
         moreover have "Mapping.lookup m' xs = Some new_tstp"
           using xs_in_tmp unfolding m_def(2) upd_set'_lookup None by auto
         moreover have "ts_tp_lt' nt tp new_tstp"
           using left_I_zero new_tstp_def by (auto simp add: ts_tp_lt'_def)
         ultimately show ?thesis
           using xs_in_tmp m_def
           unfolding a2_map'_def Mapping.lookup_update_neq[OF tp_neq] upd_nested_lookup by auto
       next
         case (Some tstp')
         moreover have "Mapping.lookup m' xs = Some (max_tstp new_tstp tstp')"
           using xs_in_tmp unfolding m_def(2) upd_set'_lookup Some by auto
         moreover have "ts_tp_lt' nt tp (max_tstp new_tstp tstp')"
           using max_tstpE[of new_tstp tstp'] lookup_a2_map'[OF m_def(1) Some] new_tstp_lt_isl left_I_zero
           by (auto simp add: sum.discI(1) new_tstp_def ts_tp_lt'_def tstp_lt_def split: sum.splits)
         ultimately show ?thesis
           using xs_in_tmp m_def
           unfolding a2_map'_def Mapping.lookup_update_neq[OF tp_neq] upd_nested_lookup by auto
       qed
     qed
     ultimately show ?thesis
       using True by (fastforce simp add: filter_a2_map_def split: option.splits)
   next
     case False
     note left_I_pos = False
     have "\<And>tp' m xs tstp. tp' \<le> tp \<Longrightarrow> Mapping.lookup a2_map' tp' = Some m \<Longrightarrow>
       Mapping.lookup m xs = Some tstp \<Longrightarrow> \<not>(ts_tp_lt' nt tp tstp)"
     proof -
       fix tp' m' xs tstp
       assume lassms: "tp' \<le> tp" "Mapping.lookup a2_map' tp' = Some m'"
         "Mapping.lookup m' xs = Some tstp"
       from lassms(1) have tp'_neq_Suc_tp: "tp + 1 \<noteq> tp'"
         by auto
       show "\<not>(ts_tp_lt' nt tp tstp)"
       proof (cases "Mapping.lookup a2_map tp'")
         case None
         then have tp'_in_tmp: "tp' \<in> fst ` tmp" and
           m'_alt: "m' = upd_set' Mapping.empty new_tstp (max_tstp new_tstp) {b. (tp', b) \<in> tmp}"
           using lassms(2) unfolding a2_map'_def Mapping.lookup_update_neq[OF tp'_neq_Suc_tp]
             upd_nested_lookup by (auto split: if_splits)
         then have "tstp = new_tstp"
           using lassms(3)[unfolded m'_alt upd_set'_lookup]
           by (auto simp add: Mapping.lookup_empty split: if_splits)
         then show ?thesis
           using False by (auto simp add: ts_tp_lt'_def new_tstp_def split: if_splits sum.splits)
       next
         case (Some m)
         then have m'_alt: "m' = upd_set' m new_tstp (max_tstp new_tstp) {b. (tp', b) \<in> tmp}"
           using lassms(2) unfolding a2_map'_def Mapping.lookup_update_neq[OF tp'_neq_Suc_tp]
             upd_nested_lookup by auto
         note lookup_a2_map_tp' = Some
         show ?thesis
         proof (cases "Mapping.lookup m xs")
           case None
           then have "tstp = new_tstp"
             using lassms(3) unfolding m'_alt upd_set'_lookup by (auto split: if_splits)
           then show ?thesis
             using False by (auto simp add: ts_tp_lt'_def new_tstp_def split: if_splits sum.splits)
         next
           case (Some tstp')
           show ?thesis
           proof (cases "xs \<in> {b. (tp', b) \<in> tmp}")
             case True
             then have tstp_eq: "tstp = max_tstp new_tstp tstp'"
               using lassms(3)
               unfolding m'_alt upd_set'_lookup Some by auto
             show ?thesis
               using max_tstpE[of new_tstp tstp'] lookup_a2_map'[OF lookup_a2_map_tp' Some] new_tstp_lt_isl left_I_pos
               by (auto simp add: tstp_eq tstp_lt_def ts_tp_lt'_def split: sum.splits)
           next
             case False
             then show ?thesis
               using lassms(3) lookup_a2_map'[OF lookup_a2_map_tp' Some]
               unfolding m'_alt upd_set'_lookup Some
               by (auto simp add: ts_tp_lt'_def tstp_lt_def split: sum.splits)
           qed
         qed
       qed
     qed
     then show ?thesis
       using False by (auto simp add: filter_a2_map_def empty_table_def split: option.splits)
   qed
   have zip_dist: "zip (linearize tss @ [nt]) ([tp - len..<tp] @ [tp]) =
     zip (linearize tss) [tp - len..<tp] @ [(nt, tp)]"
     using valid_shift_aux(1) by auto
   have list_all2': "list_all2 (\<lambda>x y. triple_eq_pair x y (\<lambda>tp'. filter_a1_map pos tp' a1_map')
     (\<lambda>ts' tp'. filter_a2_map I ts' tp' a2_map'))
     (drop (length done) (update_until args rel1 rel2 nt auxlist))
     (zip (linearize tss') [tp + 1 - (len + 1)..<tp + 1])"
     unfolding lin_tss' tp_upt_Suc drop_update_until zip_dist
     using filter_a1_map_rel1 filter_a1_map_rel2 list_all2_appendI[OF list_all2_old]
     by auto
   show ?thesis
     using valid_shift_aux len_lin_tss' sorted_lin_tss' set_lin_tss' tab_a1_map'_keys a2_map'_keys'
       len_upd_until sorted_upd_until lookup_a1_map_keys' rev_done' set_take_auxlist'
       lookup_a2_map'_keys list_all2'
     unfolding valid_mmuaux_def add_new_mmuaux_eq valid_mmuaux'.simps
       I_def n_def L_def R_def pos_def by auto
 qed
 
 lemma list_all2_check_before: "list_all2 (\<lambda>x y. triple_eq_pair x y f g) xs (zip ys zs) \<Longrightarrow>
   (\<And>y. y \<in> set ys \<Longrightarrow> \<not>enat y + right I < nt) \<Longrightarrow> x \<in> set xs \<Longrightarrow> \<not>check_before I nt x"
   by (auto simp: in_set_zip elim!: list_all2_in_setE triple_eq_pair.elims)
 
 fun eval_mmuaux :: "args \<Rightarrow> ts \<Rightarrow> 'a mmuaux \<Rightarrow> 'a table list \<times> 'a mmuaux" where
   "eval_mmuaux args nt aux =
     (let (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length) =
     shift_mmuaux args nt aux in
     (rev done, (tp, tss, len, maskL, maskR, a1_map, a2_map, [], 0)))"
 
 lemma valid_eval_mmuaux:
   assumes "valid_mmuaux args cur aux auxlist" "nt \<ge> cur"
     "eval_mmuaux args nt aux = (res, aux')" "eval_until (args_ivl args) nt auxlist = (res', auxlist')"
   shows "res = res' \<and> valid_mmuaux args cur aux' auxlist'"
 proof -
   define I where "I = args_ivl args"
   define pos where "pos = args_pos args"
   have valid_folded: "valid_mmuaux' args cur nt aux auxlist"
     using assms(1,2) valid_mmuaux'_mono unfolding valid_mmuaux_def by blast
   obtain tp len tss maskL maskR a1_map a2_map "done" done_length where shift_aux_def:
     "shift_mmuaux args nt aux = (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length)"
     by (cases "shift_mmuaux args nt aux") auto
   have valid_shift_aux: "valid_mmuaux' args cur nt (tp, tss, len, maskL, maskR,
     a1_map, a2_map, done, done_length) auxlist"
     "\<And>ts. ts \<in> set (linearize tss) \<Longrightarrow> \<not>enat ts + right (args_ivl args) < enat nt"
     using valid_shift_mmuaux'[OF assms(1)[unfolded valid_mmuaux_def] assms(2)]
     unfolding shift_aux_def by auto
   have len_done_auxlist: "length done \<le> length auxlist"
     using valid_shift_aux by auto
   have list_all: "\<And>x. x \<in> set (take (length done) auxlist) \<Longrightarrow> check_before I nt x"
     using valid_shift_aux unfolding I_def by auto
   have set_drop_auxlist: "\<And>x. x \<in> set (drop (length done) auxlist) \<Longrightarrow> \<not>check_before I nt x"
     using valid_shift_aux[unfolded valid_mmuaux'.simps]
       list_all2_check_before[OF _ valid_shift_aux(2)] unfolding I_def by fast
   have take_auxlist_takeWhile: "take (length done) auxlist = takeWhile (check_before I nt) auxlist"
     using len_done_auxlist list_all set_drop_auxlist
     by (rule take_takeWhile) assumption+
   have rev_done: "rev done = map proj_thd (take (length done) auxlist)"
     using valid_shift_aux by auto
   then have res'_def: "res' = rev done"
     using eval_until_res[OF assms(4)] unfolding take_auxlist_takeWhile I_def by auto
   then have auxlist'_def: "auxlist' = drop (length done) auxlist"
     using eval_until_auxlist'[OF assms(4)] by auto
   have eval_mmuaux_eq: "eval_mmuaux args nt aux = (rev done, (tp, tss, len, maskL, maskR,
     a1_map, a2_map, [], 0))"
     using shift_aux_def by auto
   show ?thesis
     using assms(3) done_empty_valid_mmuaux'_intro[OF valid_shift_aux(1)]
     unfolding shift_aux_def eval_mmuaux_eq pos_def auxlist'_def res'_def valid_mmuaux_def by auto
 qed
 
 definition init_mmuaux :: "args \<Rightarrow> 'a mmuaux" where
   "init_mmuaux args = (0, empty_queue, 0,
   join_mask (args_n args) (args_L args), join_mask (args_n args) (args_R args),
   Mapping.empty, Mapping.update 0 Mapping.empty Mapping.empty, [], 0)"
 
 lemma valid_init_mmuaux: "L \<subseteq> R \<Longrightarrow> valid_mmuaux (init_args I n L R b) 0
   (init_mmuaux (init_args I n L R b)) []"
   unfolding init_mmuaux_def valid_mmuaux_def
   by (auto simp add: init_args_def empty_queue_rep table_def Mapping.lookup_update)
 
 fun length_mmuaux :: "args \<Rightarrow> 'a mmuaux \<Rightarrow> nat" where
   "length_mmuaux args (tp, tss, len, maskL, maskR, a1_map, a2_map, done, done_length) =
     len + done_length"
 
 lemma valid_length_mmuaux:
   assumes "valid_mmuaux args cur aux auxlist"
   shows "length_mmuaux args aux = length auxlist"
   using assms by (cases aux) (auto simp add: valid_mmuaux_def dest: list_all2_lengthD)
 
-end
\ No newline at end of file
+(*<*)
+end
+(*>*)
diff --git a/thys/MFODL_Monitor_Optimized/ROOT b/thys/MFODL_Monitor_Optimized/ROOT
--- a/thys/MFODL_Monitor_Optimized/ROOT
+++ b/thys/MFODL_Monitor_Optimized/ROOT
@@ -1,26 +1,23 @@
 chapter AFP
 
-session MFODL_Monitor_Optimized (AFP) = Containers +
+session MFODL_Monitor_Optimized (AFP) = MFOTL_Monitor +
   options [timeout = 1200]
   sessions
     IEEE_Floating_Point
     Generic_Join
   theories
     Code_Double
     Event_Data
-    Trace
     Regex
-    Interval
     Formula
-    Abstract_Monitor
     Optimized_Join
     Monitor
     Optimized_MTL
     Monitor_Impl
-  theories [condition=ISABELLE_OCAMLFIND, document=false]
+  theories [document=false]
     Monitor_Code
   document_files
     "root.tex"
     "root.bib"
   export_files (in ".") [2]
     "MFODL_Monitor_Optimized.Monitor_Code:code/**"
diff --git a/thys/MFODL_Monitor_Optimized/Regex.thy b/thys/MFODL_Monitor_Optimized/Regex.thy
--- a/thys/MFODL_Monitor_Optimized/Regex.thy
+++ b/thys/MFODL_Monitor_Optimized/Regex.thy
@@ -1,369 +1,372 @@
 (*<*)
 theory Regex
-  imports Trace "HOL-Library.Lattice_Syntax" "HOL-Library.Extended_Nat"
+  imports
+    "MFOTL_Monitor.Trace"
+    "HOL-Library.Lattice_Syntax"
+    "HOL-Library.Extended_Nat"
 begin
 (*>*)
 
 section \<open>Regular expressions\<close>
 
 context begin
 
 qualified datatype (atms: 'a) regex = Skip nat | Test 'a
   | Plus "'a regex" "'a regex" | Times "'a regex" "'a regex"  | Star "'a regex"
 
 lemma finite_atms[simp]: "finite (atms r)"
   by (induct r) auto
 
 definition "Wild = Skip 1"
 
 lemma size_regex_estimation[termination_simp]: "x \<in> atms r \<Longrightarrow> y < f x \<Longrightarrow> y < size_regex f r"
   by (induct r) auto
 
 lemma size_regex_estimation'[termination_simp]: "x \<in> atms r \<Longrightarrow> y \<le> f x \<Longrightarrow> y \<le> size_regex f r"
   by (induct r) auto
 
 qualified definition "TimesL r S = Times r ` S"
 qualified definition "TimesR R s = (\<lambda>r. Times r s) ` R"
 
 qualified primrec fv_regex where
   "fv_regex fv (Skip n) = {}"
 | "fv_regex fv (Test \<phi>) = fv \<phi>"
 | "fv_regex fv (Plus r s) = fv_regex fv r \<union> fv_regex fv s"
 | "fv_regex fv (Times r s) = fv_regex fv r \<union> fv_regex fv s"
 | "fv_regex fv (Star r) = fv_regex fv r"
 
 lemma fv_regex_cong[fundef_cong]:
   "r = r' \<Longrightarrow> (\<And>z. z \<in> atms r \<Longrightarrow> fv z = fv' z) \<Longrightarrow> fv_regex fv r = fv_regex fv' r'"
   by (induct r arbitrary: r') auto
 
 lemma finite_fv_regex[simp]: "(\<And>z. z \<in> atms r \<Longrightarrow> finite (fv z)) \<Longrightarrow> finite (fv_regex fv r)"
   by (induct r) auto
 
 lemma fv_regex_commute:
   "(\<And>z. z \<in> atms r \<Longrightarrow> x \<in> fv z \<longleftrightarrow> g x \<in> fv' z) \<Longrightarrow> x \<in> fv_regex fv r \<longleftrightarrow> g x \<in> fv_regex fv' r"
   by (induct r) auto
 
 lemma fv_regex_alt: "fv_regex fv r = (\<Union>z \<in> atms r. fv z)"
   by (induct r) auto
 
 qualified definition nfv_regex where
   "nfv_regex fv r = Max (insert 0 (Suc ` fv_regex fv r))"
 
 lemma insert_Un: "insert x (A \<union> B) = insert x A \<union> insert x B"
   by auto
 
 lemma nfv_regex_simps[simp]:
   assumes [simp]: "(\<And>z. z \<in> atms r \<Longrightarrow> finite (fv z))" "(\<And>z. z \<in> atms s \<Longrightarrow> finite (fv z))"
   shows
   "nfv_regex fv (Skip n) = 0"
   "nfv_regex fv (Test \<phi>) = Max (insert 0 (Suc ` fv \<phi>))"
   "nfv_regex fv (Plus r s) = max (nfv_regex fv r) (nfv_regex fv s)"
   "nfv_regex fv (Times r s) = max (nfv_regex fv r) (nfv_regex fv s)"
   "nfv_regex fv (Star r) = nfv_regex fv r"
   unfolding nfv_regex_def
   by (auto simp add: image_Un Max_Un insert_Un simp del: Un_insert_right Un_insert_left)
 
 abbreviation "min_regex_default f r j \<equiv> (if atms r = {} then j else Min ((\<lambda>z. f z j) ` atms r))"
 
 qualified primrec match :: "(nat \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> 'a regex \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> bool" where
   "match test (Skip n) = (\<lambda>i j. j = i + n)"
 | "match test (Test \<phi>) = (\<lambda>i j. i = j \<and> test i \<phi>)"
 | "match test (Plus r s) = match test r \<squnion> match test s"
 | "match test (Times r s) = match test r OO match test s"
 | "match test (Star r) = (match test r)\<^sup>*\<^sup>*"
 
 lemma match_cong[fundef_cong]:
   "r = r' \<Longrightarrow> (\<And>i z. z \<in> atms r \<Longrightarrow> t i z = t' i z) \<Longrightarrow> match t r = match t' r'"
   by (induct r arbitrary: r') auto
 
 qualified primrec eps where
   "eps test i (Skip n) = (n = 0)"
 | "eps test i (Test \<phi>) = test i \<phi>"
 | "eps test i (Plus r s) = (eps test i r \<or> eps test i s)"
 | "eps test i (Times r s) = (eps test i r \<and> eps test i s)"
 | "eps test i (Star r) = True"
 
 qualified primrec lpd where
   "lpd test i (Skip n) = (case n of 0 \<Rightarrow> {} | Suc m \<Rightarrow> {Skip m})"
 | "lpd test i (Test \<phi>) = {}"
 | "lpd test i (Plus r s) = (lpd test i r \<union> lpd test i s)"
 | "lpd test i (Times r s) = TimesR (lpd test i r) s \<union> (if eps test i r then lpd test i s else {})"
 | "lpd test i (Star r) = TimesR (lpd test i r) (Star r)"
 
 qualified primrec lpd\<kappa> where
   "lpd\<kappa> \<kappa> test i (Skip n) = (case n of 0 \<Rightarrow> {} | Suc m \<Rightarrow> {\<kappa> (Skip m)})"
 | "lpd\<kappa> \<kappa> test i (Test \<phi>) = {}"
 | "lpd\<kappa> \<kappa> test i (Plus r s) = lpd\<kappa> \<kappa> test i r \<union> lpd\<kappa> \<kappa> test i s"
 | "lpd\<kappa> \<kappa> test i (Times r s) = lpd\<kappa> (\<lambda>t. \<kappa> (Times t s)) test i r \<union> (if eps test i r then lpd\<kappa> \<kappa> test i s else {})"
 | "lpd\<kappa> \<kappa> test i (Star r) = lpd\<kappa> (\<lambda>t. \<kappa> (Times t (Star r))) test i r"
 
 qualified primrec rpd where
   "rpd test i (Skip n) = (case n of 0 \<Rightarrow> {} | Suc m \<Rightarrow> {Skip m})"
 | "rpd test i (Test \<phi>) = {}"
 | "rpd test i (Plus r s) = (rpd test i r \<union> rpd test i s)"
 | "rpd test i (Times r s) = TimesL r (rpd test i s) \<union> (if eps test i s then rpd test i r else {})"
 | "rpd test i (Star r) = TimesL (Star r) (rpd test i r)"
 
 qualified primrec rpd\<kappa> where
   "rpd\<kappa> \<kappa> test i (Skip n) = (case n of 0 \<Rightarrow> {} | Suc m \<Rightarrow> {\<kappa> (Skip m)})"
 | "rpd\<kappa> \<kappa> test i (Test \<phi>) = {}"
 | "rpd\<kappa> \<kappa> test i (Plus r s) = rpd\<kappa> \<kappa> test i r \<union> rpd\<kappa> \<kappa> test i s"
 | "rpd\<kappa> \<kappa> test i (Times r s) = rpd\<kappa> (\<lambda>t. \<kappa> (Times r t)) test i s \<union> (if eps test i s then rpd\<kappa> \<kappa> test i r else {})"
 | "rpd\<kappa> \<kappa> test i (Star r) = rpd\<kappa> (\<lambda>t. \<kappa> (Times (Star r) t)) test i r"
 
 lemma lpd\<kappa>_lpd: "lpd\<kappa> \<kappa> test i r = \<kappa> ` lpd test i r"
   by (induct r arbitrary: \<kappa>) (auto simp: TimesR_def split: nat.splits)
 
 lemma rpd\<kappa>_rpd: "rpd\<kappa> \<kappa> test i r = \<kappa> ` rpd test i r"
   by (induct r arbitrary: \<kappa>) (auto simp: TimesL_def split: nat.splits)
 
 lemma match_le: "match test r i j \<Longrightarrow> i \<le> j"
 proof (induction r arbitrary: i j)
   case (Times r s)
   then show ?case using order.trans by fastforce
 next
   case (Star r)
   from Star.prems show ?case
     unfolding match.simps by (induct i j rule: rtranclp.induct) (force dest: Star.IH)+
 qed auto
 
 lemma match_rtranclp_le: "(match test r)\<^sup>*\<^sup>* i j \<Longrightarrow> i \<le> j"
   by (metis match.simps(5) match_le)
 
 lemma eps_match: "eps test i r \<longleftrightarrow> match test r i i"
   by (induction r) (auto dest: antisym[OF match_le match_le])
 
 lemma lpd_match: "i < j \<Longrightarrow> match test r i j \<longleftrightarrow> (\<Squnion>s \<in> lpd test i r. match test s) (i + 1) j"
 proof (induction r arbitrary: i j)
   case (Times r s)
   have "match test (Times r s) i j \<longleftrightarrow> (\<exists>k. match test r i k \<and> match test s k j)"
     by auto
   also have "\<dots> \<longleftrightarrow> match test r i i \<and> match test s i j \<or>
     (\<exists>k>i. match test r i k \<and> match test s k j)"
     using match_le[of test r i] nat_less_le by auto
   also have "\<dots> \<longleftrightarrow> match test r i i \<and> (\<Squnion>t \<in> lpd test i s. match test t) (i + 1) j \<or>
     (\<exists>k>i. (\<Squnion>t \<in> lpd test i r. match test t) (i + 1) k \<and> match test s k j)"
     using Times.IH(1) Times.IH(2)[OF Times.prems] by metis
   also have "\<dots> \<longleftrightarrow> match test r i i \<and> (\<Squnion>t \<in> lpd test i s. match test t) (i + 1) j \<or>
     (\<exists>k. (\<Squnion>t \<in> lpd test i r. match test t) (i + 1) k \<and> match test s k j)"
     using Times.prems by (intro disj_cong[OF refl] iff_exI) (auto dest: match_le)
   also have "\<dots> \<longleftrightarrow> (\<Squnion> (match test ` lpd test i (Times r s))) (i + 1) j"
     by (force simp: TimesL_def TimesR_def eps_match)
   finally show ?case .
 next
   case (Star r)
   have "\<exists>s\<in>lpd test i r. (match test s OO (match test r)\<^sup>*\<^sup>*) (i + 1) j" if "(match test r)\<^sup>*\<^sup>* i j"
     using that Star.prems match_le[of test _ "i + 1"]
   proof (induct rule: converse_rtranclp_induct)
     case (step i k)
     then show ?case
       by (cases "i < k") (auto simp: not_less Star.IH dest: match_le)
   qed simp
   with Star.prems show ?case using match_le[of test _  "i + 1"]
     by (auto simp: TimesL_def TimesR_def Suc_le_eq Star.IH[of i]
       elim!: converse_rtranclp_into_rtranclp[rotated])
 qed (auto split: nat.splits)
 
 lemma rpd_match: "i < j \<Longrightarrow> match test r i j \<longleftrightarrow> (\<Squnion>s \<in> rpd test j r. match test s) i (j - 1)"
 proof (induction r arbitrary: i j)
   case (Times r s)
   have "match test (Times r s) i j \<longleftrightarrow> (\<exists>k. match test r i k \<and> match test s k j)"
     by auto
   also have "\<dots> \<longleftrightarrow> match test r i j \<and> match test s j j \<or>
     (\<exists>k<j. match test r i k \<and> match test s k j)"
     using match_le[of test s _ j] nat_less_le by auto
   also have "\<dots> \<longleftrightarrow> (\<Squnion>t \<in> rpd test j r. match test t) i (j - 1) \<and> match test s j j  \<or>
     (\<exists>k<j. match test r i k \<and> (\<Squnion>t \<in> rpd test j s. match test t) k (j - 1))"
     using Times.IH(1)[OF Times.prems] Times.IH(2) by metis
   also have "\<dots> \<longleftrightarrow> (\<Squnion>t \<in> rpd test j r. match test t) i (j - 1) \<and> match test s j j  \<or>
     (\<exists>k. match test r i k \<and> (\<Squnion>t \<in> rpd test j s. match test t) k (j - 1))"
     using Times.prems by (intro disj_cong[OF refl] iff_exI) (auto dest: match_le)
   also have "\<dots> \<longleftrightarrow> (\<Squnion> (match test ` rpd test j (Times r s))) i (j - 1)"
     by (force simp: TimesL_def TimesR_def eps_match)
   finally show ?case .
 next
   case (Star r)
   have "\<exists>s\<in>rpd test j r. ((match test r)\<^sup>*\<^sup>* OO match test s) i (j - 1)" if "(match test r)\<^sup>*\<^sup>* i j"
     using that Star.prems match_le[of test _ _ "j - 1"]
   proof (induct rule: rtranclp_induct)
     case (step k j)
     then show ?case
       by (cases "k < j") (auto simp: not_less Star.IH dest: match_le)
   qed simp
   with Star.prems show ?case
     by (auto 0 3 simp: TimesL_def TimesR_def intro: Star.IH[of _ j, THEN iffD2]
       elim!: rtranclp.rtrancl_into_rtrancl dest: match_le[of test _ _ "j - 1", unfolded One_nat_def])
 qed (auto split: nat.splits)
 
 lemma lpd_fv_regex: "s \<in> lpd test i r \<Longrightarrow> fv_regex fv s \<subseteq> fv_regex fv r"
   by (induct r arbitrary: s) (auto simp: TimesR_def TimesL_def split: if_splits nat.splits)+
 
 lemma rpd_fv_regex: "s \<in> rpd test i r \<Longrightarrow> fv_regex fv s \<subseteq> fv_regex fv r"
   by (induct r arbitrary: s) (auto simp: TimesR_def TimesL_def split: if_splits nat.splits)+
 
 lemma match_fv_cong:
   "(\<And>i x. x \<in> atms r \<Longrightarrow> test i x = test' i x) \<Longrightarrow> match test r = match test' r"
   by (induct r) auto
 
 lemma eps_fv_cong:
   "(\<And>i x. x \<in> atms r \<Longrightarrow> test i x = test' i x) \<Longrightarrow> eps test i r = eps test' i r"
   by (induct r) auto
 
 datatype modality = Past | Futu
 datatype safety = Strict | Lax
 
 context
   fixes fv :: "'a \<Rightarrow> 'b set"
   and safe :: "safety \<Rightarrow> 'a \<Rightarrow> bool"
 begin
 
 qualified fun safe_regex :: "modality \<Rightarrow> safety \<Rightarrow> 'a regex \<Rightarrow> bool" where
   "safe_regex m _ (Skip n) = True"
 | "safe_regex m g (Test \<phi>) = safe g \<phi>"
 | "safe_regex m g (Plus r s) = ((g = Lax \<or> fv_regex fv r = fv_regex fv s) \<and> safe_regex m g r \<and> safe_regex m g s)"
 | "safe_regex Futu g (Times r s) =
     ((g = Lax \<or> fv_regex fv r \<subseteq> fv_regex fv s) \<and> safe_regex Futu g s \<and> safe_regex Futu Lax r)"
 | "safe_regex Past g (Times r s) =
     ((g = Lax \<or> fv_regex fv s \<subseteq> fv_regex fv r) \<and> safe_regex Past g r \<and> safe_regex Past Lax s)"
 | "safe_regex m g (Star r) = ((g = Lax \<or> fv_regex fv r = {}) \<and> safe_regex m g r)"
 
 lemmas safe_regex_induct = safe_regex.induct[case_names Skip Test Plus TimesF TimesP Star]
 
 lemma safe_cosafe:
   "(\<And>x. x \<in> atms r \<Longrightarrow> safe Strict x \<Longrightarrow> safe Lax x) \<Longrightarrow> safe_regex m Strict r \<Longrightarrow> safe_regex m Lax r"
   by (induct r; cases m) auto
 
 lemma safe_lpd_fv_regex_le: "safe_regex Futu Strict r \<Longrightarrow> s \<in> lpd test i r \<Longrightarrow> fv_regex fv r \<subseteq> fv_regex fv s"
   by (induct r) (auto simp: TimesR_def split: if_splits)
 
 lemma safe_lpd_fv_regex: "safe_regex Futu Strict r \<Longrightarrow> s \<in> lpd test i r \<Longrightarrow> fv_regex fv s = fv_regex fv r"
   by (simp add: eq_iff lpd_fv_regex safe_lpd_fv_regex_le)
 
 lemma cosafe_lpd: "safe_regex Futu Lax r \<Longrightarrow> s \<in> lpd test i r \<Longrightarrow> safe_regex Futu Lax s"
 proof (induct r arbitrary: s)
   case (Plus r1 r2)
   from Plus(3,4) show ?case
     by (auto elim: Plus(1,2))
 next
   case (Times r1 r2)
   from Times(3,4) show ?case
     by (auto simp: TimesR_def elim: Times(1,2) split: if_splits)
 qed (auto simp: TimesR_def split: nat.splits)
 
 lemma safe_lpd: "(\<forall>x \<in> atms r. safe Strict x \<longrightarrow> safe Lax x) \<Longrightarrow>
   safe_regex Futu Strict r \<Longrightarrow> s \<in> lpd test i r \<Longrightarrow> safe_regex Futu Strict s"
 proof (induct r arbitrary: s)
   case (Plus r1 r2)
   from Plus(3,4,5) show ?case
     by (auto elim: Plus(1,2) simp: ball_Un)
 next
   case (Times r1 r2)
   from Times(3,4,5) show ?case
     by (force simp: TimesR_def ball_Un elim: Times(1,2) cosafe_lpd dest: lpd_fv_regex split: if_splits)
 next
   case (Star r)
   from Star(2,3,4) show ?case
     by (force simp: TimesR_def elim: Star(1) cosafe_lpd
       dest: safe_cosafe[rotated] lpd_fv_regex[where fv=fv] split: if_splits)
 qed (auto split: nat.splits)
 
 lemma safe_rpd_fv_regex_le: "safe_regex Past Strict r \<Longrightarrow> s \<in> rpd test i r \<Longrightarrow> fv_regex fv r \<subseteq> fv_regex fv s"
   by (induct r) (auto simp: TimesL_def split: if_splits)
 
 lemma safe_rpd_fv_regex: "safe_regex Past Strict r \<Longrightarrow> s \<in> rpd test i r \<Longrightarrow> fv_regex fv s = fv_regex fv r"
   by (simp add: eq_iff rpd_fv_regex safe_rpd_fv_regex_le)
 
 lemma cosafe_rpd: "safe_regex Past Lax r \<Longrightarrow> s \<in> rpd test i r \<Longrightarrow> safe_regex Past Lax s"
 proof (induct r arbitrary: s)
   case (Plus r1 r2)
   from Plus(3,4) show ?case
     by (auto elim: Plus(1,2))
 next
   case (Times r1 r2)
   from Times(3,4) show ?case
     by (auto simp: TimesL_def elim: Times(1,2) split: if_splits)
 qed (auto simp: TimesL_def split: nat.splits)
 
 lemma safe_rpd: "(\<forall>x \<in> atms r. safe Strict x \<longrightarrow> safe Lax x) \<Longrightarrow>
   safe_regex Past Strict r \<Longrightarrow> s \<in> rpd test i r \<Longrightarrow> safe_regex Past Strict s"
 proof (induct r arbitrary: s)
   case (Plus r1 r2)
   from Plus(3,4,5) show ?case
     by (auto elim: Plus(1,2) simp: ball_Un)
 next
   case (Times r1 r2)
   from Times(3,4,5) show ?case
     by (force simp: TimesL_def ball_Un elim: Times(1,2) cosafe_rpd dest: rpd_fv_regex split: if_splits)
 next
   case (Star r)
   from Star(2,3,4) show ?case
     by (force simp: TimesL_def elim: Star(1) cosafe_rpd
       dest: safe_cosafe[rotated] rpd_fv_regex[where fv=fv] split: if_splits)
 qed (auto split: nat.splits)
 
 lemma safe_regex_safe: "(\<And>g r. safe g r \<Longrightarrow> safe Lax r) \<Longrightarrow>
   safe_regex m g r \<Longrightarrow> x \<in> atms r \<Longrightarrow> safe Lax x"
   by (induct m g r rule: safe_regex.induct) auto
 
 lemma safe_regex_map_regex:
   "(\<And>g x. x \<in> atms r \<Longrightarrow> safe g x \<Longrightarrow>  safe g (f x)) \<Longrightarrow> (\<And>x. x \<in> atms r \<Longrightarrow> fv (f x) = fv x) \<Longrightarrow>
    safe_regex m g r \<Longrightarrow> safe_regex m g (map_regex f r)"
   by (induct m g r rule: safe_regex.induct) (auto simp: fv_regex_alt regex.set_map)
 
 end
 
 lemma safe_regex_cong[fundef_cong]:
   "(\<And>g x. x \<in> atms r \<Longrightarrow> safe g x = safe' g x) \<Longrightarrow>
   Regex.safe_regex fv safe m g r = Regex.safe_regex fv safe' m g r"
   by (induct m g r rule: safe_regex.induct) auto
 
 lemma safe_regex_mono:
   "(\<And>g x. x \<in> atms r \<Longrightarrow> safe g x \<Longrightarrow> safe' g x) \<Longrightarrow>
   Regex.safe_regex fv safe m g r \<Longrightarrow> Regex.safe_regex fv safe' m g r"
   by (induct m g r rule: safe_regex.induct) auto
 
 lemma match_map_regex: "match t (map_regex f r) = match (\<lambda>k z. t k (f z)) r"
   by (induct r) auto
 
 lemma match_cong_strong:
   "(\<And>k z. k \<in> {i ..< j + 1} \<Longrightarrow> z \<in> atms r \<Longrightarrow> t k z = t' k z) \<Longrightarrow> match t r i j = match t' r i j"
 proof (induction r arbitrary: i j)
   case (Times r s)
   from Times.prems show ?case
     by (auto 0 4 simp: relcompp_apply intro: le_less_trans match_le less_Suc_eq_le
       dest: Times.IH[THEN iffD1, rotated -1] Times.IH[THEN iffD2, rotated -1] match_le)
 next
   case (Star r)
   show ?case unfolding match.simps
   proof (rule iffI)
     assume *: "(match t r)\<^sup>*\<^sup>* i j"
     then have "i \<le> j" unfolding match.simps(5)[symmetric]
       by (rule match_le)
     with * show "(match t' r)\<^sup>*\<^sup>* i j" using Star.prems
     proof (induction i j rule: rtranclp.induct)
       case (rtrancl_into_rtrancl a b c)
       from rtrancl_into_rtrancl(1,2,4,5) show ?case
         by (intro rtranclp.rtrancl_into_rtrancl[OF rtrancl_into_rtrancl.IH])
           (auto dest!: Star.IH[THEN iffD1, rotated -1]
             dest: match_le match_rtranclp_le simp: less_Suc_eq_le)
     qed simp
   next
     assume *: "(match t' r)\<^sup>*\<^sup>* i j"
     then have "i \<le> j" unfolding match.simps(5)[symmetric]
       by (rule match_le)
     with * show "(match t r)\<^sup>*\<^sup>* i j" using Star.prems
     proof (induction i j rule: rtranclp.induct)
       case (rtrancl_into_rtrancl a b c)
       from rtrancl_into_rtrancl(1,2,4,5) show ?case
         by (intro rtranclp.rtrancl_into_rtrancl[OF rtrancl_into_rtrancl.IH])
           (auto dest!: Star.IH[THEN iffD2, rotated -1]
             dest: match_le match_rtranclp_le simp: less_Suc_eq_le)
     qed simp
   qed
 qed auto
 
 end
 
 (*<*)
 end
 (*>*)
diff --git a/thys/MFODL_Monitor_Optimized/Trace.thy b/thys/MFODL_Monitor_Optimized/Trace.thy
deleted file mode 100644
--- a/thys/MFODL_Monitor_Optimized/Trace.thy
+++ /dev/null
@@ -1,302 +0,0 @@
-(*<*)
-theory Trace
-  imports "HOL-Library.Stream"
-begin
-(*>*)
-
-section \<open>Traces and trace prefixes\<close>
-
-subsection \<open>Infinite traces\<close>
-
-coinductive ssorted :: "'a :: linorder stream \<Rightarrow> bool" where
-  "shd s \<le> shd (stl s) \<Longrightarrow> ssorted (stl s) \<Longrightarrow> ssorted s"
-
-lemma ssorted_siterate[simp]: "(\<And>n. n \<le> f n) \<Longrightarrow> ssorted (siterate f n)"
-  by (coinduction arbitrary: n) auto
-
-lemma ssortedD: "ssorted s \<Longrightarrow> s !! i \<le> stl s !! i"
-  by (induct i arbitrary: s) (auto elim: ssorted.cases)
-
-lemma ssorted_sdrop: "ssorted s \<Longrightarrow> ssorted (sdrop i s)"
-  by (coinduction arbitrary: i s) (auto elim: ssorted.cases ssortedD)
-
-lemma ssorted_monoD: "ssorted s \<Longrightarrow> i \<le> j \<Longrightarrow> s !! i \<le> s !! j"
-proof (induct "j - i" arbitrary: j)
-  case (Suc x)
-  from Suc(1)[of "j - 1"] Suc(2-4) ssortedD[of s "j - 1"]
-    show ?case by (cases j) (auto simp: le_Suc_eq Suc_diff_le)
-qed simp
-
-lemma sorted_stake: "ssorted s \<Longrightarrow> sorted (stake i s)"
-  by (induct i arbitrary: s)
-    (auto elim: ssorted.cases simp: in_set_conv_nth
-      intro!: ssorted_monoD[of _ 0, simplified, THEN order_trans, OF _ ssortedD])
-
-lemma ssorted_monoI: "\<forall>i j. i \<le> j \<longrightarrow> s !! i \<le> s !! j \<Longrightarrow> ssorted s"
-  by (coinduction arbitrary: s)
-    (auto dest: spec2[of _ "Suc _" "Suc _"] spec2[of _ 0 "Suc 0"])
-
-lemma ssorted_iff_mono: "ssorted s \<longleftrightarrow> (\<forall>i j. i \<le> j \<longrightarrow> s !! i \<le> s !! j)"
-  using ssorted_monoI ssorted_monoD by metis
-
-definition "sincreasing s = (\<forall>i. \<exists>j>i. s !! i < s !! j)"
-
-lemma sincreasing_siterate[simp]:
-  assumes "(\<And>n. n < f n)"
-  shows "sincreasing (siterate f n)"
-unfolding sincreasing_def proof
-  fix i
-  show "\<exists>j>i. siterate f n !! i < siterate f n !! j" (is "\<exists>j. ?P n i j")
-  proof (induct i arbitrary: n)
-    case (Suc i)
-    from Suc[of "f n"] obtain j where "?P (f n) i j" by blast
-    then show ?case
-      by (intro exI[of _ "Suc j"]) auto
-  qed (auto intro!: exI[of _ "Suc 0"] assms)
-qed
-
-typedef 'a trace = "{s :: ('a set \<times> nat) stream. ssorted (smap snd s) \<and> sincreasing (smap snd s)}"
-  by (intro exI[of _ "smap (\<lambda>i. ({}, i)) nats"])
-    (auto simp: stream.map_comp stream.map_ident cong: stream.map_cong)
-
-setup_lifting type_definition_trace
-
-lift_definition \<Gamma> :: "'a trace \<Rightarrow> nat \<Rightarrow> 'a set" is
-  "\<lambda>s i. fst (s !! i)" .
-lift_definition \<tau> :: "'a trace \<Rightarrow> nat \<Rightarrow> nat" is
-  "\<lambda>s i. snd (s !! i)" .
-
-lemma \<tau>_mono[simp]: "i \<le> j \<Longrightarrow> \<tau> s i \<le> \<tau> s j"
-  by transfer (auto simp: ssorted_iff_mono)
-
-lemma ex_le_\<tau>: "\<exists>j\<ge>i. x \<le> \<tau> s j"
-proof (transfer fixing: i x)
-  fix s :: "('a set \<times> nat) stream"
-  presume sincreasing: "sincreasing (smap snd s)"
-  show "\<exists>j\<ge>i. x \<le> snd (s !! j)" proof (induction x)
-    case 0
-    show ?case by auto
-  next
-    case (Suc x)
-    then show ?case
-      using sincreasing unfolding sincreasing_def
-      by (metis Suc_le_eq le_less_trans less_imp_le_nat snth_smap)
-  qed
-qed simp
-
-lemma le_\<tau>_less: "\<tau> \<sigma> i \<le> \<tau> \<sigma> j \<Longrightarrow> j < i \<Longrightarrow> \<tau> \<sigma> i = \<tau> \<sigma> j"
-  by (simp add: antisym)
-
-lemma less_\<tau>D: "\<tau> \<sigma> i < \<tau> \<sigma> j \<Longrightarrow> i < j"
-  by (meson \<tau>_mono less_le_not_le not_le_imp_less)
-
-abbreviation "\<Delta> s i \<equiv> \<tau> s i - \<tau> s (i - 1)"
-
-lift_definition map_\<Gamma> :: "('a set \<Rightarrow> 'b set) \<Rightarrow> 'a trace \<Rightarrow> 'b trace" is
-  "\<lambda>f s. smap (\<lambda>(x, i). (f x, i)) s"
-  by (auto simp: stream.map_comp prod.case_eq_if cong: stream.map_cong)
-
-lemma \<Gamma>_map_\<Gamma>[simp]: "\<Gamma> (map_\<Gamma> f s) i = f (\<Gamma> s i)"
-  by transfer (simp add: prod.case_eq_if)
-
-lemma \<tau>_map_\<Gamma>[simp]: "\<tau> (map_\<Gamma> f s) i = \<tau> s i"
-  by transfer (simp add: prod.case_eq_if)
-
-lemma map_\<Gamma>_id[simp]: "map_\<Gamma> id s = s"
-  by transfer (simp add: stream.map_id)
-
-lemma map_\<Gamma>_comp: "map_\<Gamma> g (map_\<Gamma> f s) = map_\<Gamma> (g \<circ> f) s"
-  by transfer (simp add: stream.map_comp comp_def prod.case_eq_if case_prod_beta')
-
-lemma map_\<Gamma>_cong: "\<sigma>\<^sub>1 = \<sigma>\<^sub>2 \<Longrightarrow> (\<And>x. f\<^sub>1 x = f\<^sub>2 x) \<Longrightarrow> map_\<Gamma> f\<^sub>1 \<sigma>\<^sub>1 = map_\<Gamma> f\<^sub>2 \<sigma>\<^sub>2"
-  by transfer (auto intro!: stream.map_cong)
-
-
-subsection \<open>Finite trace prefixes\<close>
-
-typedef 'a prefix = "{p :: ('a set \<times> nat) list. sorted (map snd p)}"
-  by (auto intro!: exI[of _ "[]"])
-
-setup_lifting type_definition_prefix
-
-lift_definition last_ts :: "'a prefix \<Rightarrow> nat" is
-  "\<lambda>p. (case p of [] \<Rightarrow> 0 | _ \<Rightarrow> snd (last p))" .
-
-lift_definition first_ts :: "nat \<Rightarrow> 'a prefix \<Rightarrow> nat" is
-  "\<lambda>n p. (case p of [] \<Rightarrow> n | _ \<Rightarrow> snd (hd p))" .
-
-lift_definition pnil :: "'a prefix" is "[]" by simp
-
-lift_definition plen :: "'a prefix \<Rightarrow> nat" is "length" .
-
-lift_definition psnoc :: "'a prefix \<Rightarrow> 'a set \<times> nat \<Rightarrow> 'a prefix" is
-  "\<lambda>p x. if (case p of [] \<Rightarrow> 0 | _ \<Rightarrow> snd (last p)) \<le> snd x then p @ [x] else []"
-proof (goal_cases sorted_psnoc)
-  case (sorted_psnoc p x)
-  then show ?case
-    by (induction p) (auto split: if_splits list.splits)
-qed
-
-instantiation prefix :: (type) order begin
-
-lift_definition less_eq_prefix :: "'a prefix \<Rightarrow> 'a prefix \<Rightarrow> bool" is
-  "\<lambda>p q. \<exists>r. q = p @ r" .
-
-definition less_prefix :: "'a prefix \<Rightarrow> 'a prefix \<Rightarrow> bool" where
-  "less_prefix x y = (x \<le> y \<and> \<not> y \<le> x)"
-
-instance
-proof (standard, goal_cases less refl trans antisym)
-  case (less x y)
-  then show ?case unfolding less_prefix_def ..
-next
-  case (refl x)
-  then show ?case by transfer auto
-next
-  case (trans x y z)
-  then show ?case by transfer auto
-next
-  case (antisym x y)
-  then show ?case by transfer auto
-qed
-
-end
-
-lemma psnoc_inject[simp]:
-  "last_ts p \<le> snd x \<Longrightarrow> last_ts q \<le> snd y \<Longrightarrow> psnoc p x = psnoc q y \<longleftrightarrow> (p = q \<and> x = y)"
-  by transfer auto
-
-lift_definition prefix_of :: "'a prefix \<Rightarrow> 'a trace \<Rightarrow> bool" is "\<lambda>p s. stake (length p) s = p" .
-
-lemma prefix_of_pnil[simp]: "prefix_of pnil \<sigma>"
-  by transfer auto
-
-lemma plen_pnil[simp]: "plen pnil = 0"
-  by transfer auto
-
-lemma plen_mono: "\<pi> \<le> \<pi>' \<Longrightarrow> plen \<pi> \<le> plen \<pi>'"
-  by transfer auto
-
-lemma prefix_of_psnocE: "prefix_of (psnoc p x) s \<Longrightarrow> last_ts p \<le> snd x \<Longrightarrow>
-  (prefix_of p s \<Longrightarrow> \<Gamma> s (plen p) = fst x \<Longrightarrow> \<tau> s (plen p) = snd x \<Longrightarrow> P) \<Longrightarrow> P"
-  by transfer (simp del: stake.simps add: stake_Suc)
-
-lemma le_pnil[simp]: "pnil \<le> \<pi>"
-  by transfer auto
-
-lift_definition take_prefix :: "nat \<Rightarrow> 'a trace \<Rightarrow> 'a prefix" is stake
-  by (auto dest: sorted_stake)
-
-lemma plen_take_prefix[simp]: "plen (take_prefix i \<sigma>) = i"
-  by transfer auto
-
-lemma plen_psnoc[simp]: "last_ts \<pi> \<le> snd x \<Longrightarrow> plen (psnoc \<pi> x) = plen \<pi> + 1"
-  by transfer auto
-
-lemma prefix_of_take_prefix[simp]: "prefix_of (take_prefix i \<sigma>) \<sigma>"
-  by transfer auto
-
-lift_definition pdrop :: "nat \<Rightarrow> 'a prefix \<Rightarrow> 'a prefix" is drop
-  by (auto simp: drop_map[symmetric] sorted_drop)
-
-lemma pdrop_0[simp]: "pdrop 0 \<pi> = \<pi>"
-  by transfer auto
-
-lemma prefix_of_antimono: "\<pi> \<le> \<pi>' \<Longrightarrow> prefix_of \<pi>' s \<Longrightarrow> prefix_of \<pi> s"
-  by transfer (auto simp del: stake_add simp add: stake_add[symmetric])
-
-lemma ex_prefix_of: "\<exists>s. prefix_of p s"
-proof (transfer, intro bexI CollectI conjI)
-  fix p :: "('a set \<times> nat) list"
-  assume *: "sorted (map snd p)"
-  let ?\<sigma> = "p @- smap (Pair undefined) (fromN (snd (last p)))"
-  show "stake (length p) ?\<sigma> = p" by (simp add: stake_shift)
-  have le_last: "snd (p ! i) \<le> snd (last p)" if "i < length p" for i
-    using sorted_nth_mono[OF *, of i "length p - 1"] that
-    by (cases p) (auto simp: last_conv_nth nth_Cons')
-  with * show "ssorted (smap snd ?\<sigma>)"
-    by (force simp: ssorted_iff_mono sorted_iff_nth_mono shift_snth)
-  show "sincreasing (smap snd ?\<sigma>)" unfolding sincreasing_def
-  proof (rule allI)
-    fix i
-    show "\<exists>j > i.  smap snd ?\<sigma> !! i < smap snd ?\<sigma> !! j"
-    proof (cases "i < length p")
-      case True
-      with le_last[of i] show ?thesis
-        by (auto intro!: exI[of _ "Suc (length p)"])
-    next
-      case False
-      then show ?thesis
-        by (auto simp: neq_Nil_conv intro!: exI[of _ "Suc i"])
-    qed
-  qed
-qed
-
-lemma \<tau>_prefix_conv: "prefix_of p s \<Longrightarrow> prefix_of p s' \<Longrightarrow> i < plen p \<Longrightarrow> \<tau> s i = \<tau> s' i"
-  by transfer (simp add: stake_nth[symmetric])
-
-lemma \<Gamma>_prefix_conv: "prefix_of p s \<Longrightarrow> prefix_of p s' \<Longrightarrow> i < plen p \<Longrightarrow> \<Gamma> s i = \<Gamma> s' i"
-  by transfer (simp add: stake_nth[symmetric])
-
-lemma sincreasing_sdrop:
-  assumes "sincreasing s"
-  shows "sincreasing (sdrop n s)"
-proof (unfold sincreasing_def; safe)
-  fix i
-  from assms obtain j where "n + i < j" "s !! (n + i) < s !! j"
-    unfolding sincreasing_def by auto
-  then show "\<exists>j>i. sdrop n s !! i < sdrop n s !! j"
-    by (auto simp: sdrop_snth intro!: exI[of _ "j - n"])
-qed
-
-lemma ssorted_shift:
-  "ssorted (xs @- s) = (sorted xs \<and> ssorted s \<and> (\<forall>x\<in>set xs. \<forall>y\<in>sset s. x \<le> y))"
-proof safe
-  assume *: "ssorted (xs @- s)"
-  then show "sorted xs"
-    by (auto simp: ssorted_iff_mono shift_snth sorted_iff_nth_mono split: if_splits)
-  from ssorted_sdrop[OF *, of "length xs"] show "ssorted s"
-    by (auto simp: sdrop_shift)
-  fix x y assume "x \<in> set xs" "y \<in> sset s"
-  then obtain i j where "i < length xs" "xs ! i = x" "s !! j = y"
-    by (auto simp: set_conv_nth sset_range)
-  with ssorted_monoD[OF *, of i "j + length xs"] show "x \<le> y" by auto
-next
-  assume "sorted xs" "ssorted s" "\<forall>x\<in>set xs. \<forall>y\<in>sset s. x \<le> y"
-  then show "ssorted (xs @- s)"
-  proof (coinduction arbitrary: xs s)
-    case (ssorted xs s)
-    with \<open>ssorted s\<close> show ?case
-      by (subst (asm) ssorted.simps) (auto 0 4 simp: neq_Nil_conv shd_sset intro: exI[of _ "_ # _"])
-  qed
-qed
-
-lemma sincreasing_shift:
-  assumes "ssorted (xs @- s)" "sincreasing s"
-  shows "sincreasing (xs @- s)"
-proof (unfold sincreasing_def; safe)
-  fix i
-  show "\<exists>j>i. (xs @- s) !! i < (xs @- s) !! j"
-  proof (cases "i < length xs")
-    case True
-    with assms(1) have "xs ! i \<le> shd s" unfolding ssorted_shift by (auto simp: shd_sset)
-    also obtain j where "\<dots> < s !! j"
-      using assms(2) by (auto simp: sincreasing_def dest: spec[of _ 0])
-    finally show ?thesis using True by (auto intro!: exI[of _ "j + length xs"])
-  next
-    case False
-    then obtain j where "i - length xs < j" "s !! (i - length xs) < s !! j"
-      using assms(2) by (auto simp: sincreasing_def)
-    then show ?thesis using False by (auto simp: not_less intro!: exI[of _ "j + length xs"])
-  qed
-qed
-
-lift_definition replace_prefix :: "'a prefix \<Rightarrow> 'a trace \<Rightarrow> 'a trace" is
-   "\<lambda>\<pi> \<sigma>. if ssorted (smap snd (\<pi> @- sdrop (length \<pi>) \<sigma>)) then
-     \<pi> @- sdrop (length \<pi>) \<sigma> else smap (\<lambda>i. ({}, i)) nats"
-  by (auto split: if_splits simp: stream.map_comp stream.map_ident sdrop_smap[symmetric]
-    simp del: sdrop_smap intro!: sincreasing_shift sincreasing_sdrop cong: stream.map_cong)
-
-(*<*)
-end
-(*>*)
diff --git a/thys/MFODL_Monitor_Optimized/document/root.bib b/thys/MFODL_Monitor_Optimized/document/root.bib
--- a/thys/MFODL_Monitor_Optimized/document/root.bib
+++ b/thys/MFODL_Monitor_Optimized/document/root.bib
@@ -1,44 +1,46 @@
 @article{BasinKMZ-JACM15,
   author = {Basin, David and Klaedtke, Felix and M{\"u}ller, Samuel and Z{\u a}linescu, Eugen},
   title = {Monitoring Metric First-Order Temporal Properties},
   journal = {J.\ ACM},
   volume = {62},
   number = {2},
   year = {2015},
   pages = {15:1--15:45},
 }
 
 @inproceedings{SchneiderBKT2019RV,
   author    = {Joshua Schneider and David Basin and Sr{\dj{}}an Krsti{\'c} and Dmitriy Traytel},
   title     = {A Formally Verified Monitor for Metric First-Order Temporal Logic},
   editor    = {Bernd Finkbeiner and Leonardo Mariani},
   booktitle = {{RV} 2019},
   series    = {LNCS},
   volume    = {11757},
   pages     = {310--328},
   publisher = {Springer},
   year      = {2019},
 }
 
 @inproceedings{BasinKT-RV17,
   author    = {David Basin and Sr{\dj{}}an Krsti{\'c} and Dmitriy Traytel},
   title     = {Almost Event-Rate Independent Monitoring of Metric Dynamic Logic},
   editor    = {Shuvendu K. Lahiri and Giles Reger},
   booktitle = {{RV} 2017},
   series    = {LNCS},
   volume    = {10548},
   pages     = {85--102},
   publisher = {Springer},
   year      = {2017},
 }
 
 @inproceedings{BasinDHKRST2020IJCAR,
   author = {David Basin and Thibault Dardinier and Lukas Heimes and Sr{\dj{}}an Krsti{\'c}
     and Martin Raszyk and Joshua Schneider and Dmitriy Traytel},
   title = {A Formally Verified, Optimized Monitor for Metric First-Order Dynamic Logic},
   editor = {Nicolas Peltier and Viorica Sofronie-Stokkermans},
   booktitle = {{IJCAR} 2020},
+  series = {LNCS},
+  volume = {12166},
+  pages = {432--453},
+  publisher = {Springer},
   year = {2020},
-  note = {To appear},
-  url = {http://people.inf.ethz.ch/trayteld/papers/ijcar20-verimonplus/verimonplus.pdf},
 }
diff --git a/thys/MFODL_Monitor_Optimized/document/root.tex b/thys/MFODL_Monitor_Optimized/document/root.tex
--- a/thys/MFODL_Monitor_Optimized/document/root.tex
+++ b/thys/MFODL_Monitor_Optimized/document/root.tex
@@ -1,58 +1,58 @@
 \documentclass[10pt,a4paper]{article}
 \usepackage{isabelle,isabellesym}
 
 \usepackage{a4wide}
 \usepackage[english]{babel}
 \usepackage{eufrak}
 \usepackage{amssymb}
 
 % this should be the last package used
 \usepackage{pdfsetup}
 
 % urls in roman style, theory text in math-similar italics
 \urlstyle{rm}
 \isabellestyle{literal}
 
 
 \begin{document}
 
 \title{Formalization of an Optimized Monitoring Algorithm for\\ Metric First-Order Dynamic Logic with Aggregations}
 \author{Thibault Dardinier \and Lukas Heimes \and Martin Raszyk \and Joshua Schneider \and Dmitriy Traytel}
 
 \maketitle
 
 \begin{abstract}
 A monitor is a runtime verification tool that solves the following problem: Given a stream
 of time-stamped events and a policy formulated in a specification language, decide
 whether the policy is satisfied at every point in the stream. We verify the correctness
 of an executable monitor for specifications given as formulas in metric first-order
 dynamic logic (MFODL), which combines the features of metric first-order temporal logic
 (MFOTL)~\cite{BasinKMZ-JACM15} and metric dynamic logic~\cite{BasinKT-RV17}. Thus, MFODL
 supports real-time constraints, first-order parameters, and regular expressions.
 Additionally, the monitor supports aggregation operations such as count and sum. This
-formalization, which is described in a forthcoming paper at IJCAR
+formalization, which is described in a paper at IJCAR
 2020~\cite{BasinDHKRST2020IJCAR}, significantly extends
 \href{https://www.isa-afp.org/entries/MFOTL_Monitor.html}{previous work on a verified
 monitor} for MFOTL~\cite{SchneiderBKT2019RV}. Apart from the addition of regular
 expressions and aggregations, we implemented
 \href{https://www.isa-afp.org/entries/Generic_Join.html}{multi-way joins} and
 a specialized sliding window algorithm to further optimize the monitor.
 \end{abstract}
 
 \tableofcontents
 
 % sane default for proof documents
 \parindent 0pt\parskip 0.5ex
 
 % generated text of all theories
 \input{session}
 
 \bibliographystyle{abbrv}
 \bibliography{root}
 
 \end{document}
 
 %%% Local Variables:
 %%% mode: latex
 %%% TeX-master: t
 %%% End: