diff --git a/thys/AOT/AOT_Axioms.thy b/thys/AOT/AOT_Axioms.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_Axioms.thy
@@ -0,0 +1,263 @@
+(*<*)
+theory AOT_Axioms
+  imports AOT_Definitions
+begin
+(*>*)
+
+section\<open>Axioms of PLM\<close>
+
+AOT_axiom "pl:1": \<open>\<phi> \<rightarrow> (\<psi> \<rightarrow> \<phi>)\<close>
+  by (auto simp: AOT_sem_imp AOT_model_axiomI)
+AOT_axiom "pl:2": \<open>(\<phi> \<rightarrow> (\<psi> \<rightarrow> \<chi>)) \<rightarrow> ((\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<phi> \<rightarrow> \<chi>))\<close>
+  by (auto simp: AOT_sem_imp AOT_model_axiomI)
+AOT_axiom "pl:3": \<open>(\<not>\<phi> \<rightarrow> \<not>\<psi>) \<rightarrow> ((\<not>\<phi> \<rightarrow> \<psi>) \<rightarrow> \<phi>)\<close>
+  by (auto simp: AOT_sem_imp AOT_sem_not AOT_model_axiomI)
+
+AOT_axiom "cqt:1": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> (\<tau>\<down> \<rightarrow> \<phi>{\<tau>})\<close>
+  by (auto simp: AOT_sem_denotes AOT_sem_forall AOT_sem_imp AOT_model_axiomI)
+
+AOT_axiom "cqt:2[const_var]": \<open>\<alpha>\<down>\<close>
+  using AOT_sem_vars_denote by (rule AOT_model_axiomI)
+AOT_axiom "cqt:2[lambda]":
+  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
+  shows \<open>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>\<close>
+  by (auto intro!: AOT_model_axiomI AOT_sem_cqt_2[OF assms])
+AOT_axiom "cqt:2[lambda0]":
+  shows \<open>[\<lambda> \<phi>]\<down>\<close>
+  by (auto intro!: AOT_model_axiomI
+           simp: AOT_sem_lambda_denotes "existence:3"[unfolded AOT_model_equiv_def])
+
+AOT_axiom "cqt:3": \<open>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) \<rightarrow> (\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<psi>{\<alpha>})\<close>
+  by (simp add: AOT_sem_forall AOT_sem_imp AOT_model_axiomI)
+AOT_axiom "cqt:4": \<open>\<phi> \<rightarrow> \<forall>\<alpha> \<phi>\<close>
+  by (simp add: AOT_sem_forall AOT_sem_imp AOT_model_axiomI)
+AOT_axiom "cqt:5:a": \<open>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>)\<close>
+  by (simp add: AOT_sem_conj AOT_sem_denotes AOT_sem_exe
+                AOT_sem_imp AOT_model_axiomI)
+AOT_axiom "cqt:5:a[1]": \<open>[\<Pi>]\<kappa> \<rightarrow> (\<Pi>\<down> & \<kappa>\<down>)\<close>
+  using "cqt:5:a" AOT_model_axiomI by blast
+AOT_axiom "cqt:5:a[2]": \<open>[\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2 \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down>)\<close>
+  by (rule AOT_model_axiomI)
+     (metis AOT_model_denotes_prod_def AOT_sem_conj AOT_sem_denotes AOT_sem_exe
+            AOT_sem_imp case_prodD)
+AOT_axiom "cqt:5:a[3]": \<open>[\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3 \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down> & \<kappa>\<^sub>3\<down>)\<close>
+  by (rule AOT_model_axiomI)
+     (metis AOT_model_denotes_prod_def AOT_sem_conj AOT_sem_denotes AOT_sem_exe
+            AOT_sem_imp case_prodD)
+AOT_axiom "cqt:5:a[4]": \<open>[\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4 \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down> & \<kappa>\<^sub>3\<down> & \<kappa>\<^sub>4\<down>)\<close>
+  by (rule AOT_model_axiomI)
+     (metis AOT_model_denotes_prod_def AOT_sem_conj AOT_sem_denotes AOT_sem_exe
+            AOT_sem_imp case_prodD)
+AOT_axiom "cqt:5:b": \<open>\<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>] \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>)\<close>
+  using AOT_sem_enc_denotes
+  by (auto intro!: AOT_model_axiomI simp: AOT_sem_conj AOT_sem_denotes AOT_sem_imp)+
+AOT_axiom "cqt:5:b[1]": \<open>\<kappa>[\<Pi>] \<rightarrow> (\<Pi>\<down> & \<kappa>\<down>)\<close>
+  using "cqt:5:b" AOT_model_axiomI by blast
+AOT_axiom "cqt:5:b[2]": \<open>\<kappa>\<^sub>1\<kappa>\<^sub>2[\<Pi>] \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down>)\<close>
+  by (rule AOT_model_axiomI)
+     (metis AOT_model_denotes_prod_def AOT_sem_conj AOT_sem_denotes
+            AOT_sem_enc_denotes AOT_sem_imp case_prodD)
+AOT_axiom "cqt:5:b[3]": \<open>\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3[\<Pi>] \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down> & \<kappa>\<^sub>3\<down>)\<close>
+  by (rule AOT_model_axiomI)
+     (metis AOT_model_denotes_prod_def AOT_sem_conj AOT_sem_denotes
+            AOT_sem_enc_denotes AOT_sem_imp case_prodD)
+AOT_axiom "cqt:5:b[4]": \<open>\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4[\<Pi>] \<rightarrow> (\<Pi>\<down> & \<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down> & \<kappa>\<^sub>3\<down> & \<kappa>\<^sub>4\<down>)\<close>
+  by (rule AOT_model_axiomI)
+     (metis AOT_model_denotes_prod_def AOT_sem_conj AOT_sem_denotes
+            AOT_sem_enc_denotes AOT_sem_imp case_prodD)
+
+AOT_axiom "l-identity": \<open>\<alpha> = \<beta> \<rightarrow> (\<phi>{\<alpha>} \<rightarrow> \<phi>{\<beta>})\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_eq AOT_sem_imp)
+
+AOT_act_axiom "logic-actual": \<open>\<^bold>\<A>\<phi> \<rightarrow> \<phi>\<close>
+  by (rule AOT_model_act_axiomI)
+     (simp add: AOT_sem_act AOT_sem_imp)
+
+AOT_axiom "logic-actual-nec:1": \<open>\<^bold>\<A>\<not>\<phi> \<equiv> \<not>\<^bold>\<A>\<phi>\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_act AOT_sem_equiv AOT_sem_not)
+AOT_axiom "logic-actual-nec:2": \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) \<equiv> (\<^bold>\<A>\<phi> \<rightarrow> \<^bold>\<A>\<psi>)\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_act AOT_sem_equiv AOT_sem_imp)
+
+AOT_axiom "logic-actual-nec:3": \<open>\<^bold>\<A>(\<forall>\<alpha> \<phi>{\<alpha>}) \<equiv> \<forall>\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_act AOT_sem_equiv AOT_sem_forall AOT_sem_denotes)
+AOT_axiom "logic-actual-nec:4": \<open>\<^bold>\<A>\<phi> \<equiv> \<^bold>\<A>\<^bold>\<A>\<phi>\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_act AOT_sem_equiv)
+
+AOT_axiom "qml:1": \<open>\<box>(\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<box>\<phi> \<rightarrow> \<box>\<psi>)\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_box AOT_sem_imp)
+AOT_axiom "qml:2": \<open>\<box>\<phi> \<rightarrow> \<phi>\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_box AOT_sem_imp)
+AOT_axiom "qml:3": \<open>\<diamond>\<phi> \<rightarrow> \<box>\<diamond>\<phi>\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_box AOT_sem_dia AOT_sem_imp)
+
+AOT_axiom "qml:4": \<open>\<diamond>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+  using AOT_sem_concrete AOT_model_contingent
+  by (auto intro!: AOT_model_axiomI
+             simp: AOT_sem_box AOT_sem_dia AOT_sem_imp AOT_sem_exists
+                   AOT_sem_denotes AOT_sem_conj AOT_sem_not AOT_sem_act
+                   AOT_sem_exe)+
+
+AOT_axiom "qml-act:1": \<open>\<^bold>\<A>\<phi> \<rightarrow> \<box>\<^bold>\<A>\<phi>\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_act AOT_sem_box AOT_sem_imp)
+AOT_axiom "qml-act:2": \<open>\<box>\<phi> \<equiv> \<^bold>\<A>\<box>\<phi>\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_act AOT_sem_box AOT_sem_equiv)
+
+AOT_axiom descriptions: \<open>x = \<^bold>\<iota>x(\<phi>{x}) \<equiv> \<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+proof (rule AOT_model_axiomI)
+  AOT_modally_strict {
+    AOT_show \<open>x = \<^bold>\<iota>x(\<phi>{x}) \<equiv> \<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+      by (induct; simp add: AOT_sem_equiv AOT_sem_forall AOT_sem_act AOT_sem_eq)
+         (metis (no_types, opaque_lifting) AOT_sem_desc_denotes AOT_sem_desc_prop
+                                           AOT_sem_denotes)
+  }
+qed
+
+AOT_axiom "lambda-predicates:1":
+  \<open>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down> \<rightarrow> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_denotes AOT_sem_eq AOT_sem_imp)
+AOT_axiom "lambda-predicates:1[zero]": \<open>[\<lambda> p]\<down> \<rightarrow> [\<lambda> p] = [\<lambda> p]\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_denotes AOT_sem_eq AOT_sem_imp)
+AOT_axiom "lambda-predicates:2":
+  \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down> \<rightarrow> ([\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]x\<^sub>1...x\<^sub>n \<equiv> \<phi>{x\<^sub>1...x\<^sub>n})\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_equiv AOT_sem_imp AOT_sem_lambda_beta AOT_sem_vars_denote)
+AOT_axiom "lambda-predicates:3": \<open>[\<lambda>x\<^sub>1...x\<^sub>n [F]x\<^sub>1...x\<^sub>n] = F\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_lambda_eta AOT_sem_vars_denote)
+AOT_axiom "lambda-predicates:3[zero]": \<open>[\<lambda> p] = p\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_eq AOT_sem_lambda0 AOT_sem_vars_denote)
+
+AOT_axiom "safe-ext":
+  \<open>([\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down> & \<box>\<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n (\<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n} \<equiv> \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n})) \<rightarrow>
+   [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>\<close>
+  using AOT_sem_lambda_coex
+  by (auto intro!: AOT_model_axiomI simp: AOT_sem_imp AOT_sem_denotes AOT_sem_conj
+                   AOT_sem_equiv AOT_sem_box AOT_sem_forall)
+AOT_axiom "safe-ext[2]":
+  \<open>([\<lambda>\<nu>\<^sub>1\<nu>\<^sub>2 \<phi>{\<nu>\<^sub>1,\<nu>\<^sub>2}]\<down> & \<box>\<forall>\<nu>\<^sub>1\<forall>\<nu>\<^sub>2 (\<phi>{\<nu>\<^sub>1, \<nu>\<^sub>2} \<equiv> \<psi>{\<nu>\<^sub>1, \<nu>\<^sub>2})) \<rightarrow>
+   [\<lambda>\<nu>\<^sub>1\<nu>\<^sub>2 \<psi>{\<nu>\<^sub>1,\<nu>\<^sub>2}]\<down>\<close>
+  using "safe-ext"[where \<phi>="\<lambda>(x,y). \<phi> x y"]
+  by (simp add: AOT_model_axiom_def AOT_sem_denotes AOT_model_denotes_prod_def
+                AOT_sem_forall AOT_sem_imp AOT_sem_conj AOT_sem_equiv AOT_sem_box)
+AOT_axiom "safe-ext[3]":
+  \<open>([\<lambda>\<nu>\<^sub>1\<nu>\<^sub>2\<nu>\<^sub>3 \<phi>{\<nu>\<^sub>1,\<nu>\<^sub>2,\<nu>\<^sub>3}]\<down> & \<box>\<forall>\<nu>\<^sub>1\<forall>\<nu>\<^sub>2\<forall>\<nu>\<^sub>3 (\<phi>{\<nu>\<^sub>1, \<nu>\<^sub>2, \<nu>\<^sub>3} \<equiv> \<psi>{\<nu>\<^sub>1, \<nu>\<^sub>2, \<nu>\<^sub>3})) \<rightarrow>
+   [\<lambda>\<nu>\<^sub>1\<nu>\<^sub>2\<nu>\<^sub>3 \<psi>{\<nu>\<^sub>1,\<nu>\<^sub>2,\<nu>\<^sub>3}]\<down>\<close>
+  using "safe-ext"[where \<phi>="\<lambda>(x,y,z). \<phi> x y z"]
+  by (simp add: AOT_model_axiom_def AOT_model_denotes_prod_def AOT_sem_forall
+                AOT_sem_denotes AOT_sem_imp AOT_sem_conj AOT_sem_equiv AOT_sem_box)
+AOT_axiom "safe-ext[4]":
+  \<open>([\<lambda>\<nu>\<^sub>1\<nu>\<^sub>2\<nu>\<^sub>3\<nu>\<^sub>4 \<phi>{\<nu>\<^sub>1,\<nu>\<^sub>2,\<nu>\<^sub>3,\<nu>\<^sub>4}]\<down> &
+    \<box>\<forall>\<nu>\<^sub>1\<forall>\<nu>\<^sub>2\<forall>\<nu>\<^sub>3\<forall>\<nu>\<^sub>4 (\<phi>{\<nu>\<^sub>1, \<nu>\<^sub>2, \<nu>\<^sub>3, \<nu>\<^sub>4} \<equiv> \<psi>{\<nu>\<^sub>1, \<nu>\<^sub>2, \<nu>\<^sub>3, \<nu>\<^sub>4})) \<rightarrow>
+   [\<lambda>\<nu>\<^sub>1\<nu>\<^sub>2\<nu>\<^sub>3\<nu>\<^sub>4 \<psi>{\<nu>\<^sub>1,\<nu>\<^sub>2,\<nu>\<^sub>3,\<nu>\<^sub>4}]\<down>\<close>
+  using "safe-ext"[where \<phi>="\<lambda>(x,y,z,w). \<phi> x y z w"]
+  by (simp add: AOT_model_axiom_def AOT_model_denotes_prod_def AOT_sem_forall
+                AOT_sem_denotes AOT_sem_imp AOT_sem_conj AOT_sem_equiv AOT_sem_box)
+
+AOT_axiom "nary-encoding[2]":
+  \<open>x\<^sub>1x\<^sub>2[F] \<equiv> x\<^sub>1[\<lambda>y [F]yx\<^sub>2] & x\<^sub>2[\<lambda>y [F]x\<^sub>1y]\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_conj AOT_sem_equiv AOT_enc_prod_def AOT_proj_enc_prod_def
+                AOT_sem_unary_proj_enc AOT_sem_vars_denote)
+AOT_axiom "nary-encoding[3]":
+  \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3] & x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3] & x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_conj AOT_sem_equiv AOT_enc_prod_def AOT_proj_enc_prod_def
+                AOT_sem_unary_proj_enc AOT_sem_vars_denote)
+AOT_axiom "nary-encoding[4]":
+  \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4] &
+                 x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4] &
+                 x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4] &
+                 x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<close>
+  by (rule AOT_model_axiomI)
+     (simp add: AOT_sem_conj AOT_sem_equiv AOT_enc_prod_def AOT_proj_enc_prod_def
+                AOT_sem_unary_proj_enc AOT_sem_vars_denote)
+
+AOT_axiom encoding: \<open>x[F] \<rightarrow> \<box>x[F]\<close>
+  using AOT_sem_enc_nec 
+  by (auto intro!: AOT_model_axiomI simp: AOT_sem_imp AOT_sem_box)
+
+AOT_axiom nocoder: \<open>O!x \<rightarrow> \<not>\<exists>F x[F]\<close>
+  by (auto intro!: AOT_model_axiomI
+           simp: AOT_sem_imp AOT_sem_not AOT_sem_exists AOT_sem_ordinary
+                 AOT_sem_dia
+                AOT_sem_lambda_beta[OF AOT_sem_ordinary_def_denotes,
+                                    OF AOT_sem_vars_denote])
+     (metis AOT_sem_nocoder)
+
+AOT_axiom "A-objects": \<open>\<exists>x (A!x & \<forall>F(x[F] \<equiv> \<phi>{F}))\<close>
+proof(rule AOT_model_axiomI)
+  AOT_modally_strict {
+    AOT_obtain \<kappa> where \<open>\<kappa>\<down> & \<box>\<not>E!\<kappa> & \<forall>F (\<kappa>[F] \<equiv> \<phi>{F})\<close>
+      using AOT_sem_A_objects[of _ \<phi>]
+      by (auto simp: AOT_sem_imp AOT_sem_box AOT_sem_forall AOT_sem_exists
+                     AOT_sem_conj AOT_sem_not AOT_sem_dia AOT_sem_denotes
+                     AOT_sem_equiv) blast
+    AOT_thus \<open>\<exists>x (A!x & \<forall>F(x[F] \<equiv> \<phi>{F}))\<close>
+      unfolding AOT_sem_exists
+      by (auto intro!: exI[where x=\<kappa>]
+               simp: AOT_sem_lambda_beta[OF AOT_sem_abstract_def_denotes]
+                     AOT_sem_box AOT_sem_dia AOT_sem_not AOT_sem_denotes
+                     AOT_var_of_term_inverse AOT_sem_conj
+                     AOT_sem_equiv AOT_sem_forall AOT_sem_abstract)
+  }
+qed
+
+AOT_theorem universal_closure:
+  assumes \<open>for arbitrary \<alpha>: \<phi>{\<alpha>} \<in> \<Lambda>\<^sub>\<box>\<close>
+  shows \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<in> \<Lambda>\<^sub>\<box>\<close>
+  using assms
+  by (metis AOT_term_of_var_cases AOT_model_axiom_def AOT_sem_denotes AOT_sem_forall)
+
+AOT_theorem act_closure:
+  assumes \<open>\<phi> \<in> \<Lambda>\<^sub>\<box>\<close>
+  shows \<open>\<^bold>\<A>\<phi> \<in> \<Lambda>\<^sub>\<box>\<close>
+  using assms by (simp add: AOT_model_axiom_def AOT_sem_act)
+
+AOT_theorem nec_closure:
+  assumes \<open>\<phi> \<in> \<Lambda>\<^sub>\<box>\<close>
+  shows \<open>\<box>\<phi> \<in> \<Lambda>\<^sub>\<box>\<close>
+  using assms by (simp add: AOT_model_axiom_def AOT_sem_box)
+
+AOT_theorem universal_closure_act:
+  assumes \<open>for arbitrary \<alpha>: \<phi>{\<alpha>} \<in> \<Lambda>\<close>
+  shows \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<in> \<Lambda>\<close>
+  using assms
+  by (metis AOT_term_of_var_cases AOT_model_act_axiom_def AOT_sem_denotes
+            AOT_sem_forall)
+
+text\<open>The following are not part of PLM and only hold in the extended models.
+     They are a generalization of the predecessor axiom.\<close>
+context AOT_ExtendedModel
+begin
+AOT_axiom indistinguishable_ord_enc_all:
+  \<open>\<Pi>\<down> & A!x & A!y & \<forall>F \<box>([F]x \<equiv> [F]y) \<rightarrow>
+  ((\<forall>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> x[G])) \<equiv>
+    \<forall>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> y[G]))\<close>
+  by (rule AOT_model_axiomI)
+     (auto simp: AOT_sem_equiv AOT_sem_imp AOT_sem_conj
+                 AOT_sem_indistinguishable_ord_enc_all)
+AOT_axiom indistinguishable_ord_enc_ex:
+  \<open>\<Pi>\<down> & A!x & A!y & \<forall>F \<box>([F]x \<equiv> [F]y) \<rightarrow>
+  ((\<exists>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & x[G])) \<equiv>
+    \<exists>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & y[G]))\<close>
+  by (rule AOT_model_axiomI)
+     (auto simp: AOT_sem_equiv AOT_sem_imp AOT_sem_conj 
+                 AOT_sem_indistinguishable_ord_enc_ex)
+end
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/AOT/AOT_BasicLogicalObjects.thy b/thys/AOT/AOT_BasicLogicalObjects.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_BasicLogicalObjects.thy
@@ -0,0 +1,628 @@
+(*<*)
+theory AOT_BasicLogicalObjects
+  imports AOT_PLM
+begin
+(*>*)
+
+section\<open>Basic Logical Objects\<close>
+(* Note: so far only the parts required for possible world theory are implemented *)
+
+AOT_define TruthValueOf :: \<open>\<tau> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>TruthValueOf'(_,_')\<close>)
+  "tv-p": \<open>TruthValueOf(x,p) \<equiv>\<^sub>d\<^sub>f A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+
+AOT_theorem "p-has-!tv:1": \<open>\<exists>x TruthValueOf(x,p)\<close>
+  using  "tv-p"[THEN "\<equiv>Df"]
+  by (AOT_subst \<open>TruthValueOf(x,p)\<close>
+                \<open>A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close> for: x)
+     (simp add: "A-objects"[axiom_inst])
+
+
+AOT_theorem "p-has-!tv:2": \<open>\<exists>!x TruthValueOf(x,p)\<close>
+  using  "tv-p"[THEN "\<equiv>Df"]
+  by (AOT_subst \<open>TruthValueOf(x,p)\<close>
+                \<open>A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close> for: x)
+     (simp add: "A-objects!")
+
+
+AOT_theorem "uni-tv": \<open>\<^bold>\<iota>x TruthValueOf(x,p)\<down>\<close>
+  using "A-Exists:2" "RA[2]" "\<equiv>E"(2) "p-has-!tv:2" by blast
+
+AOT_define TheTruthValueOf :: \<open>\<phi> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>\<circ>_\<close> [100] 100)
+  "the-tv-p": \<open>\<circ>p =\<^sub>d\<^sub>f \<^bold>\<iota>x TruthValueOf(x,p)\<close>
+
+AOT_define PropEnc :: \<open>\<tau> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (infixl \<open>\<^bold>\<Sigma>\<close> 40)
+  "prop-enc": \<open>x\<^bold>\<Sigma>p \<equiv>\<^sub>d\<^sub>f x\<down> & x[\<lambda>y p]\<close>
+
+AOT_theorem "tv-id:1": \<open>\<circ>p = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q])))\<close>
+proof -
+  AOT_have \<open>\<box>\<forall>x(TruthValueOf(x,p)  \<equiv> A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q])))\<close>
+    by (rule RN; rule GEN; rule "tv-p"[THEN "\<equiv>Df"])
+  AOT_hence \<open>\<^bold>\<iota>x TruthValueOf(x,p) = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q])))\<close>
+    using "equiv-desc-eq:3"[THEN "\<rightarrow>E", OF "&I", OF "uni-tv"] by simp
+  thus ?thesis
+    using "=\<^sub>d\<^sub>fI"(1)[OF "the-tv-p", OF "uni-tv"] by fast
+qed
+
+AOT_theorem "tv-id:2": \<open>\<circ>p\<^bold>\<Sigma>p\<close>
+proof -
+  AOT_modally_strict {
+    AOT_have \<open>(p \<equiv> p) & [\<lambda>y p] = [\<lambda>y p]\<close>
+      by (auto simp: "prop-prop2:2" "rule=I:1" intro!: "\<equiv>I" "\<rightarrow>I" "&I")
+    AOT_hence \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y p] = [\<lambda>y q])\<close>
+      using "\<exists>I" by fast
+  }
+  AOT_hence \<open>\<^bold>\<A>\<exists>q ((q \<equiv> p) & [\<lambda>y p] = [\<lambda>y q])\<close>
+    using "RA[2]" by blast
+  AOT_hence \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q])))[\<lambda>y p]\<close>
+    by (safe intro!: "desc-nec-encode:1"[unvarify F, THEN "\<equiv>E"(2)] "cqt:2")
+  AOT_hence \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q])))\<^bold>\<Sigma>p\<close>
+    by (safe intro!: "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "A-descriptions")
+  AOT_thus \<open>\<circ>p\<^bold>\<Sigma>p\<close>
+    by (rule "rule=E"[rotated, OF "tv-id:1"[symmetric]])
+qed
+
+(* TODO more theorems *)
+
+AOT_theorem "TV-lem1:1":
+  \<open>p \<equiv> \<forall>F(\<exists>q (q & F = [\<lambda>y q]) \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  fix F
+  AOT_assume \<open>\<exists>q (q & F = [\<lambda>y q])\<close>
+  then AOT_obtain q where \<open>q & F = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  moreover AOT_assume p
+  ultimately AOT_have \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close>
+    by (metis "&I" "&E"(1) "&E"(2) "deduction-theorem" "\<equiv>I")
+  AOT_thus \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close> by (rule "\<exists>I")
+next
+  fix F
+  AOT_assume \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close>
+  then AOT_obtain q where \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  moreover AOT_assume p
+  ultimately AOT_have \<open>q & F = [\<lambda>y q]\<close>
+    by (metis "&I" "&E"(1) "&E"(2) "\<equiv>E"(2))
+  AOT_thus \<open>\<exists>q (q & F = [\<lambda>y q])\<close> by (rule "\<exists>I")
+next
+  AOT_assume \<open>\<forall>F (\<exists>q (q & F = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  AOT_hence \<open>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & [\<lambda>y p] = [\<lambda>y q])\<close>
+    using "\<forall>E"(1)[rotated, OF "prop-prop2:2"] by blast
+  moreover AOT_have \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y p] = [\<lambda>y q])\<close>
+    by (rule "\<exists>I"(2)[where \<beta>=p])
+       (simp add: "rule=I:1" "&I" "oth-class-taut:3:a" "prop-prop2:2")
+  ultimately AOT_have \<open>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q])\<close> using "\<equiv>E"(2) by blast
+  then AOT_obtain q where \<open>q & [\<lambda>y p] = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>p\<close>
+    using "rule=E" "&E"(1) "&E"(2) id_sym "\<equiv>E"(2) "p-identity-thm2:3" by fast
+qed
+
+AOT_theorem "TV-lem1:2":
+  \<open>\<not>p \<equiv> \<forall>F(\<exists>q (\<not>q & F = [\<lambda>y q]) \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  fix F
+  AOT_assume \<open>\<exists>q (\<not>q & F = [\<lambda>y q])\<close>
+  then AOT_obtain q where \<open>\<not>q & F = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  moreover AOT_assume \<open>\<not>p\<close>
+  ultimately AOT_have \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close>
+    by (metis "&I" "&E"(1) "&E"(2) "deduction-theorem" "\<equiv>I" "raa-cor:3")
+  AOT_thus \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close> by (rule "\<exists>I")
+next
+  fix F
+  AOT_assume \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close>
+  then AOT_obtain q where \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  moreover AOT_assume \<open>\<not>p\<close>
+  ultimately AOT_have \<open>\<not>q & F = [\<lambda>y q]\<close>
+    by (metis "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "raa-cor:3")
+  AOT_thus \<open>\<exists>q (\<not>q & F = [\<lambda>y q])\<close> by (rule "\<exists>I")
+next
+  AOT_assume \<open>\<forall>F (\<exists>q (\<not>q & F = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  AOT_hence \<open>\<exists>q (\<not>q & [\<lambda>y p] = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & [\<lambda>y p] = [\<lambda>y q])\<close>
+    using "\<forall>E"(1)[rotated, OF "prop-prop2:2"] by blast
+  moreover AOT_have \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y p] = [\<lambda>y q])\<close>
+    by (rule "\<exists>I"(2)[where \<beta>=p])
+       (simp add: "rule=I:1" "&I" "oth-class-taut:3:a" "prop-prop2:2")
+  ultimately AOT_have \<open>\<exists>q (\<not>q & [\<lambda>y p] = [\<lambda>y q])\<close> using "\<equiv>E"(2) by blast
+  then AOT_obtain q where \<open>\<not>q & [\<lambda>y p] = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>\<not>p\<close>
+    using "rule=E" "&E"(1) "&E"(2) id_sym "\<equiv>E"(2) "p-identity-thm2:3" by fast
+qed
+
+
+AOT_define TruthValue :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>TruthValue'(_')\<close>)
+  "T-value": \<open>TruthValue(x) \<equiv>\<^sub>d\<^sub>f \<exists>p (TruthValueOf(x,p))\<close>
+
+(* TODO more theorems *)
+
+AOT_act_theorem "T-lem:1": \<open>TruthValueOf(\<circ>p, p)\<close>
+proof -
+  AOT_have \<theta>: \<open>\<circ>p = \<^bold>\<iota>x TruthValueOf(x, p)\<close>
+    using "rule-id-df:1" "the-tv-p" "uni-tv" by blast
+  moreover AOT_have \<open>\<circ>p\<down>\<close>
+    using "t=t-proper:1" calculation "vdash-properties:10" by blast
+  ultimately show ?thesis by (metis "rule=E" id_sym "vdash-properties:10" "y-in:3")
+qed
+
+AOT_act_theorem "T-lem:2": \<open>\<forall>F (\<circ>p[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  using "T-lem:1"[THEN "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)].
+
+AOT_act_theorem "T-lem:3": \<open>\<circ>p\<^bold>\<Sigma>r \<equiv> (r \<equiv> p)\<close>
+proof -
+  AOT_have \<theta>: \<open>\<circ>p[\<lambda>y r] \<equiv> \<exists>q ((q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q])\<close>
+    using "T-lem:2"[THEN "\<forall>E"(1), OF "prop-prop2:2"].
+  show ?thesis
+  proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume \<open>\<circ>p\<^bold>\<Sigma>r\<close>
+    AOT_hence \<open>\<circ>p[\<lambda>y r]\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc")
+    AOT_hence \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q])\<close> using \<theta> "\<equiv>E"(1) by blast
+    then AOT_obtain q where \<open>(q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>r = q\<close> using calculation
+      using "&E"(2) "\<equiv>E"(2) "p-identity-thm2:3" by blast
+    ultimately AOT_show \<open>r \<equiv> p\<close>
+      by (metis "rule=E" "&E"(1) "\<equiv>E"(6) "oth-class-taut:3:a")
+  next
+    AOT_assume \<open>r \<equiv> p\<close>
+    moreover AOT_have \<open>[\<lambda>y r] = [\<lambda>y r]\<close>
+      by (simp add: "rule=I:1" "prop-prop2:2")
+    ultimately AOT_have \<open>(r \<equiv> p) & [\<lambda>y r] = [\<lambda>y r]\<close> using "&I" by blast
+    AOT_hence \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q])\<close> by (rule "\<exists>I"(2)[where \<beta>=r])
+    AOT_hence \<open>\<circ>p[\<lambda>y r]\<close> using \<theta> "\<equiv>E"(2) by blast
+    AOT_thus \<open>\<circ>p\<^bold>\<Sigma>r\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" "prop-enc" "russell-axiom[enc,1].\<psi>_denotes_asm")
+  qed
+qed
+
+AOT_act_theorem "T-lem:4": \<open>TruthValueOf(x, p) \<equiv> x = \<circ>p\<close>
+proof -
+  AOT_have \<open>\<forall>x (x = \<^bold>\<iota>x TruthValueOf(x, p) \<equiv> \<forall>z (TruthValueOf(z, p) \<equiv> z = x))\<close>
+    by (simp add: "fund-cont-desc" GEN)
+  moreover AOT_have \<open>\<circ>p\<down>\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "tv-id:2" "&E"(1) "prop-enc" by blast
+  ultimately AOT_have
+    \<open>(\<circ>p = \<^bold>\<iota>x TruthValueOf(x, p)) \<equiv> \<forall>z (TruthValueOf(z, p) \<equiv> z = \<circ>p)\<close>
+    using "\<forall>E"(1) by blast
+  AOT_hence \<open>\<forall>z (TruthValueOf(z, p) \<equiv> z = \<circ>p)\<close>
+    using "\<equiv>E"(1) "rule-id-df:1" "the-tv-p" "uni-tv" by blast
+  AOT_thus \<open>TruthValueOf(x, p) \<equiv> x = \<circ>p\<close> using "\<forall>E"(2) by blast
+qed
+
+
+(* TODO more theorems *)
+
+AOT_theorem "TV-lem2:1":
+  \<open>(A!x & \<forall>F (x[F] \<equiv> \<exists>q (q & F = [\<lambda>y q]))) \<rightarrow> TruthValue(x)\<close>
+proof(safe intro!: "\<rightarrow>I" "T-value"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                   "\<exists>I"(1)[rotated, OF "log-prop-prop:2"])
+  AOT_assume \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q (q & F = [\<lambda>y q]))\<close>
+  AOT_thus \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> (\<forall>p (p \<rightarrow> p))) & F = [\<lambda>y q]))\<close>
+    apply (AOT_subst \<open>\<exists>q ((q \<equiv> (\<forall>p (p \<rightarrow> p))) & F = [\<lambda>y q])\<close>
+                     \<open>\<exists>q (q & F = [\<lambda>y q])\<close> for: F :: \<open><\<kappa>>\<close>)
+     apply (AOT_subst \<open>q \<equiv> \<forall>p (p \<rightarrow>p)\<close> \<open>q\<close> for: q)
+    apply (metis (no_types, lifting) "\<rightarrow>I" "\<equiv>I" "\<equiv>E"(2) GEN)
+    by (auto simp: "cqt-further:7")
+qed
+
+AOT_theorem "TV-lem2:2":
+  \<open>(A!x & \<forall>F (x[F] \<equiv> \<exists>q (\<not>q & F = [\<lambda>y q]))) \<rightarrow> TruthValue(x)\<close>
+proof(safe intro!: "\<rightarrow>I" "T-value"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                   "\<exists>I"(1)[rotated, OF "log-prop-prop:2"])
+  AOT_assume \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q (\<not>q & F = [\<lambda>y q]))\<close>
+  AOT_thus \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> (\<exists>p (p & \<not>p))) & F = [\<lambda>y q]))\<close>
+    apply (AOT_subst \<open>\<exists>q ((q \<equiv> (\<exists>p (p & \<not>p))) & F = [\<lambda>y q])\<close>
+                     \<open>\<exists>q (\<not>q & F = [\<lambda>y q])\<close> for: F :: \<open><\<kappa>>\<close>)
+     apply (AOT_subst \<open>q \<equiv> \<exists>p (p & \<not>p)\<close> \<open>\<not>q\<close> for: q)
+      apply (metis (no_types, lifting)
+        "\<rightarrow>I" "\<exists>E" "\<equiv>E"(1) "\<equiv>I" "raa-cor:1" "raa-cor:3")
+    by (auto simp add: "cqt-further:7")
+qed
+
+AOT_define TheTrue :: \<kappa>\<^sub>s (\<open>\<top>\<close>)
+  "the-true:1": \<open>\<top> =\<^sub>d\<^sub>f \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+AOT_define TheFalse :: \<kappa>\<^sub>s (\<open>\<bottom>\<close>)
+  "the-true:2": \<open>\<bottom> =\<^sub>d\<^sub>f \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+
+
+AOT_theorem "the-true:3": \<open>\<top> \<noteq> \<bottom>\<close>
+proof(safe intro!: "ab-obey:2"[unvarify x y, THEN "\<rightarrow>E", rotated 2, OF "\<or>I"(1)]
+                   "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x \<forall>q(q \<rightarrow> q)]\<guillemotright>\<close>] "&I" "prop-prop2:2")
+  AOT_have false_def: \<open>\<bottom> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:2")
+  moreover AOT_show false_den: \<open>\<bottom>\<down>\<close>
+    by (meson "\<rightarrow>E" "t=t-proper:1" "A-descriptions"
+              "rule-id-df:1[zero]" "the-true:2")
+  ultimately AOT_have false_prop: \<open>\<^bold>\<A>(A!\<bottom> & \<forall>F (\<bottom>[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+    using "nec-hintikka-scheme"[unvarify x, THEN "\<equiv>E"(1), THEN "&E"(1)] by blast
+  AOT_hence \<open>\<^bold>\<A>\<forall>F (\<bottom>[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p]))\<close>
+    using "Act-Basic:2" "&E"(2) "\<equiv>E"(1) by blast
+  AOT_hence \<open>\<forall>F \<^bold>\<A>(\<bottom>[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p]))\<close>
+    using "\<equiv>E"(1) "logic-actual-nec:3"[axiom_inst] by blast
+  AOT_hence false_enc_cond:
+    \<open>\<^bold>\<A>(\<bottom>[\<lambda>x \<forall>q(q \<rightarrow> q)] \<equiv> \<exists>p(\<not>p & [\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p]))\<close>
+    using "\<forall>E"(1)[rotated, OF "prop-prop2:2"] by blast
+
+  AOT_have true_def: \<open>\<top> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:1")
+  moreover AOT_show true_den: \<open>\<top>\<down>\<close>
+    by (meson "t=t-proper:1" "A-descriptions" "rule-id-df:1[zero]" "the-true:1" "\<rightarrow>E")
+  ultimately AOT_have true_prop: \<open>\<^bold>\<A>(A!\<top> & \<forall>F (\<top>[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    using "nec-hintikka-scheme"[unvarify x, THEN "\<equiv>E"(1), THEN "&E"(1)]  by blast
+  AOT_hence \<open>\<^bold>\<A>\<forall>F (\<top>[F] \<equiv> \<exists>p(p & F = [\<lambda>y p]))\<close>
+    using "Act-Basic:2" "&E"(2) "\<equiv>E"(1) by blast
+  AOT_hence \<open>\<forall>F \<^bold>\<A>(\<top>[F] \<equiv> \<exists>p(p & F = [\<lambda>y p]))\<close>
+    using "\<equiv>E"(1) "logic-actual-nec:3"[axiom_inst] by blast
+  AOT_hence \<open>\<^bold>\<A>(\<top>[\<lambda>x \<forall>q(q \<rightarrow> q)] \<equiv> \<exists>p(p & [\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p]))\<close>
+    using "\<forall>E"(1)[rotated, OF "prop-prop2:2"] by blast
+  moreover AOT_have \<open>\<^bold>\<A>\<exists>p(p & [\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p])\<close>
+    by (safe intro!: "nec-imp-act"[THEN "\<rightarrow>E"] RN "\<exists>I"(1)[where \<tau>="\<guillemotleft>\<forall>q(q \<rightarrow> q)\<guillemotright>"] "&I"
+                     GEN "\<rightarrow>I" "log-prop-prop:2" "rule=I:1" "prop-prop2:2")
+  ultimately AOT_have \<open>\<^bold>\<A>(\<top>[\<lambda>x \<forall>q(q \<rightarrow> q)])\<close>
+    using "Act-Basic:5" "\<equiv>E"(1,2) by blast
+  AOT_thus \<open>\<top>[\<lambda>x \<forall>q(q \<rightarrow> q)]\<close>
+    using "en-eq:10[1]"[unvarify x\<^sub>1 F, THEN "\<equiv>E"(1)] true_den "prop-prop2:2" by blast
+
+  AOT_show \<open>\<not>\<bottom>[\<lambda>x \<forall>q(q \<rightarrow> q)]\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>\<bottom>[\<lambda>x \<forall>q(q \<rightarrow> q)]\<close>
+    AOT_hence \<open>\<^bold>\<A>\<bottom>[\<lambda>x \<forall>q(q \<rightarrow> q)]\<close>
+      using "en-eq:10[1]"[unvarify x\<^sub>1 F, THEN "\<equiv>E"(2)]
+            false_den "prop-prop2:2" by blast
+    AOT_hence \<open>\<^bold>\<A>\<exists>p(\<not>p & [\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p])\<close>
+      using false_enc_cond "Act-Basic:5" "\<equiv>E"(1) by blast
+    AOT_hence \<open>\<exists>p \<^bold>\<A>(\<not>p & [\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p])\<close>
+      using "Act-Basic:10" "\<equiv>E"(1) by blast
+    then AOT_obtain p where p_prop: \<open>\<^bold>\<A>(\<not>p & [\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p])\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<^bold>\<A>[\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p]\<close>
+      by (metis "Act-Basic:2" "&E"(2) "\<equiv>E"(1))
+    AOT_hence \<open>[\<lambda>x \<forall>q(q \<rightarrow> q)] = [\<lambda>y p]\<close>
+      using "id-act:1"[unvarify \<alpha> \<beta>, THEN "\<equiv>E"(2)] "prop-prop2:2" by blast
+    AOT_hence \<open>(\<forall>q(q \<rightarrow> q)) = p\<close>
+      using "p-identity-thm2:3"[unvarify p, THEN "\<equiv>E"(2)]
+            "log-prop-prop:2" by blast
+    moreover AOT_have \<open>\<^bold>\<A>\<not>p\<close> using p_prop
+      using "Act-Basic:2" "&E"(1) "\<equiv>E"(1) by blast
+    ultimately AOT_have \<open>\<^bold>\<A>\<not>\<forall>q(q \<rightarrow> q)\<close>
+      by (metis "Act-Sub:1" "\<equiv>E"(1,2) "raa-cor:3" "rule=E")
+    moreover AOT_have \<open>\<not>\<^bold>\<A>\<not>\<forall>q(q \<rightarrow> q)\<close>
+      by (meson "Act-Sub:1" "RA[2]" "if-p-then-p" "\<equiv>E"(1) "universal-cor")
+    ultimately AOT_show \<open>\<^bold>\<A>\<not>\<forall>q(q \<rightarrow> q) & \<not>\<^bold>\<A>\<not>\<forall>q(q \<rightarrow> q)\<close>
+      using "&I" by blast
+  qed
+qed
+
+AOT_act_theorem "T-T-value:1": \<open>TruthValue(\<top>)\<close>
+proof -
+  AOT_have true_def: \<open>\<top> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:1")
+  AOT_hence true_den: \<open>\<top>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_show \<open>TruthValue(\<top>)\<close>
+    using "y-in:2"[unvarify z, OF true_den, THEN "\<rightarrow>E", OF true_def]
+          "TV-lem2:1"[unvarify x, OF true_den, THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_act_theorem "T-T-value:2": \<open>TruthValue(\<bottom>)\<close>
+proof -
+  AOT_have false_def: \<open>\<bottom> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:2")
+  AOT_hence false_den: \<open>\<bottom>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_show \<open>TruthValue(\<bottom>)\<close>
+    using "y-in:2"[unvarify z, OF false_den, THEN "\<rightarrow>E", OF false_def]
+          "TV-lem2:2"[unvarify x, OF false_den, THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "two-T": \<open>\<exists>x\<exists>y(TruthValue(x) & TruthValue(y) & x \<noteq> y &
+                           \<forall>z (TruthValue(z) \<rightarrow> z = x \<or> z = y))\<close>
+proof -
+  AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>p (p & F = [\<lambda>y p]))\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_obtain b where b_prop: \<open>A!b & \<forall>F (b[F] \<equiv> \<exists>p (\<not>p & F = [\<lambda>y p]))\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_obtain p where p: p
+    by (metis "log-prop-prop:2" "raa-cor:3" "rule-ui:1" "universal-cor")
+  show ?thesis
+  proof(rule "\<exists>I"(2)[where \<beta>=a]; rule "\<exists>I"(2)[where \<beta>=b];
+        safe intro!: "&I" GEN "\<rightarrow>I")
+    AOT_show \<open>TruthValue(a)\<close>
+      using "TV-lem2:1" a_prop "vdash-properties:10" by blast
+  next
+    AOT_show \<open>TruthValue(b)\<close>
+      using "TV-lem2:2" b_prop "vdash-properties:10" by blast
+  next
+    AOT_show \<open>a \<noteq> b\<close>
+    proof(rule "ab-obey:2"[THEN "\<rightarrow>E", OF "\<or>I"(1)])
+      AOT_show \<open>\<exists>F (a[F] & \<not>b[F])\<close>
+      proof(rule "\<exists>I"(1)[where \<tau>="\<guillemotleft>[\<lambda>y p]\<guillemotright>"]; rule "&I" "prop-prop2:2")
+        AOT_show \<open>a[\<lambda>y p]\<close>
+          by(safe intro!: "\<exists>I"(2)[where \<beta>=p] "&I" p "rule=I:1"[OF "prop-prop2:2"]
+              a_prop[THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<equiv>E"(2), OF "prop-prop2:2"])
+      next
+        AOT_show \<open>\<not>b[\<lambda>y p]\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>b[\<lambda>y p]\<close>
+          AOT_hence \<open>\<exists>q (\<not>q & [\<lambda>y p] = [\<lambda>y q])\<close>
+            using "\<forall>E"(1)[rotated, OF "prop-prop2:2", THEN "\<equiv>E"(1)]
+                  b_prop[THEN "&E"(2)] by fast
+          then AOT_obtain q where \<open>\<not>q & [\<lambda>y p] = [\<lambda>y q]\<close>
+            using "\<exists>E"[rotated] by blast
+          AOT_hence \<open>\<not>p\<close>
+            by (metis "rule=E" "&E"(1) "&E"(2) "deduction-theorem" "\<equiv>I"
+                      "\<equiv>E"(2) "p-identity-thm2:3" "raa-cor:3")
+          AOT_thus \<open>p & \<not>p\<close> using p "&I" by blast
+        qed
+      qed
+    qed
+  next
+    fix z
+    AOT_assume \<open>TruthValue(z)\<close>
+    AOT_hence \<open>\<exists>p (TruthValueOf(z, p))\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "T-value")
+    then AOT_obtain p where \<open>TruthValueOf(z, p)\<close> using "\<exists>E"[rotated] by blast
+    AOT_hence z_prop: \<open>A!z & \<forall>F (z[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE" "tv-p" by blast
+    {
+      AOT_assume p: \<open>p\<close>
+      AOT_have \<open>z = a\<close>
+      proof(rule "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "&I",
+                             OF z_prop[THEN "&E"(1)], OF a_prop[THEN "&E"(1)]];
+            rule GEN)
+        fix G
+        AOT_have \<open>z[G] \<equiv> \<exists>q ((q \<equiv> p) & G = [\<lambda>y q])\<close>
+          using z_prop[THEN "&E"(2)] "\<forall>E"(2) by blast
+        also AOT_have \<open>\<exists>q ((q \<equiv> p) & G = [\<lambda>y q]) \<equiv> \<exists>q (q & G = [\<lambda>y q])\<close>
+          using "TV-lem1:1"[THEN "\<equiv>E"(1), OF p, THEN "\<forall>E"(2)[where \<beta>=G], symmetric].
+        also AOT_have \<open>\<dots> \<equiv> a[G]\<close>
+          using a_prop[THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=G], symmetric].
+        finally AOT_show \<open>z[G] \<equiv> a[G]\<close>.
+      qed
+      AOT_hence \<open>z = a \<or> z = b\<close> by (rule "\<or>I")
+    }
+    moreover {
+      AOT_assume notp: \<open>\<not>p\<close>
+      AOT_have \<open>z = b\<close>
+      proof(rule "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "&I",
+                             OF z_prop[THEN "&E"(1)], OF b_prop[THEN "&E"(1)]];
+            rule GEN)
+        fix G
+        AOT_have \<open>z[G] \<equiv> \<exists>q ((q \<equiv> p) & G = [\<lambda>y q])\<close>
+          using z_prop[THEN "&E"(2)] "\<forall>E"(2) by blast
+        also AOT_have \<open>\<exists>q ((q \<equiv> p) & G = [\<lambda>y q]) \<equiv> \<exists>q (\<not>q & G = [\<lambda>y q])\<close>
+          using "TV-lem1:2"[THEN "\<equiv>E"(1), OF notp, THEN "\<forall>E"(2), symmetric].
+        also AOT_have \<open>\<dots> \<equiv> b[G]\<close>
+          using b_prop[THEN "&E"(2), THEN "\<forall>E"(2), symmetric].
+        finally AOT_show \<open>z[G] \<equiv> b[G]\<close>.
+      qed
+      AOT_hence \<open>z = a \<or> z = b\<close> by (rule "\<or>I")
+    }
+    ultimately AOT_show \<open>z = a \<or> z = b\<close>
+      by (metis "reductio-aa:1")
+  qed
+qed
+
+AOT_act_theorem "valueof-facts:1": \<open>TruthValueOf(x, p) \<rightarrow> (p \<equiv> x = \<top>)\<close>
+proof(safe intro!: "\<rightarrow>I" dest!: "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  AOT_assume \<theta>: \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  AOT_have a: \<open>A!\<top>\<close>
+    using "\<exists>E" "T-T-value:1" "T-value" "&E"(1) "\<equiv>\<^sub>d\<^sub>fE" "tv-p" by blast
+  AOT_have true_def: \<open>\<top> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:1")
+  AOT_hence true_den: \<open>\<top>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_have b: \<open>\<forall>F (\<top>[F] \<equiv> \<exists>q (q & F = [\<lambda>y q]))\<close>
+    using "y-in:2"[unvarify z, OF true_den, THEN "\<rightarrow>E", OF true_def] "&E" by blast
+  AOT_show \<open>p \<equiv> x = \<top>\<close>
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume p
+    AOT_hence \<open>\<forall>F (\<exists>q (q & F = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "TV-lem1:1"[THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<forall>F(\<top>[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using b "cqt-basic:10"[THEN "\<rightarrow>E", OF "&I", OF b] by fast
+    AOT_hence c: \<open>\<forall>F(\<exists>q((q \<equiv> p) & F = [\<lambda>y q]) \<equiv> \<top>[F])\<close>
+      using "cqt-basic:11"[THEN "\<equiv>E"(1)] by fast
+    AOT_hence \<open>\<forall>F (x[F] \<equiv> \<top>[F])\<close>
+      using "cqt-basic:10"[THEN "\<rightarrow>E", OF "&I", OF \<theta>[THEN "&E"(2)]] by fast
+    AOT_thus \<open>x = \<top>\<close>
+      by (rule "ab-obey:1"[unvarify y, OF true_den, THEN "\<rightarrow>E", THEN "\<rightarrow>E",
+                           OF "&I", OF \<theta>[THEN "&E"(1)], OF a])
+  next
+    AOT_assume \<open>x = \<top>\<close>
+    AOT_hence d: \<open>\<forall>F (\<top>[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "rule=E" \<theta>[THEN "&E"(2)] by fast
+    AOT_have \<open>\<forall>F (\<exists>q (q & F = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "cqt-basic:10"[THEN "\<rightarrow>E", OF "&I",
+              OF b[THEN "cqt-basic:11"[THEN "\<equiv>E"(1)]], OF d].
+    AOT_thus p using "TV-lem1:1"[THEN "\<equiv>E"(2)] by blast
+  qed
+qed
+
+AOT_act_theorem "valueof-facts:2": \<open>TruthValueOf(x, p) \<rightarrow> (\<not>p \<equiv> x = \<bottom>)\<close>
+proof(safe intro!: "\<rightarrow>I" dest!: "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  AOT_assume \<theta>: \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  AOT_have a: \<open>A!\<bottom>\<close>
+    using "\<exists>E" "T-T-value:2" "T-value" "&E"(1) "\<equiv>\<^sub>d\<^sub>fE" "tv-p" by blast
+  AOT_have false_def: \<open>\<bottom> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:2")
+  AOT_hence false_den: \<open>\<bottom>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_have b: \<open>\<forall>F (\<bottom>[F] \<equiv> \<exists>q (\<not>q & F = [\<lambda>y q]))\<close>
+    using "y-in:2"[unvarify z, OF false_den, THEN "\<rightarrow>E", OF false_def] "&E" by blast
+  AOT_show \<open>\<not>p \<equiv> x = \<bottom>\<close>
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>\<not>p\<close>
+    AOT_hence \<open>\<forall>F (\<exists>q (\<not>q & F = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "TV-lem1:2"[THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<forall>F(\<bottom>[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using b "cqt-basic:10"[THEN "\<rightarrow>E", OF "&I", OF b] by fast
+    AOT_hence c: \<open>\<forall>F(\<exists>q((q \<equiv> p) & F = [\<lambda>y q]) \<equiv> \<bottom>[F])\<close>
+      using "cqt-basic:11"[THEN "\<equiv>E"(1)] by fast
+    AOT_hence \<open>\<forall>F (x[F] \<equiv> \<bottom>[F])\<close>
+      using "cqt-basic:10"[THEN "\<rightarrow>E", OF "&I", OF \<theta>[THEN "&E"(2)]] by fast
+    AOT_thus \<open>x = \<bottom>\<close>
+      by (rule "ab-obey:1"[unvarify y, OF false_den, THEN "\<rightarrow>E", THEN "\<rightarrow>E",
+                           OF "&I", OF \<theta>[THEN "&E"(1)], OF a])
+  next
+    AOT_assume \<open>x = \<bottom>\<close>
+    AOT_hence d: \<open>\<forall>F (\<bottom>[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "rule=E" \<theta>[THEN "&E"(2)] by fast
+    AOT_have \<open>\<forall>F (\<exists>q (\<not>q & F = [\<lambda>y q]) \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+      using "cqt-basic:10"[THEN "\<rightarrow>E", OF "&I",
+                OF b[THEN "cqt-basic:11"[THEN "\<equiv>E"(1)]], OF d].
+    AOT_thus \<open>\<not>p\<close> using "TV-lem1:2"[THEN "\<equiv>E"(2)] by blast
+  qed
+qed
+
+AOT_act_theorem "q-True:1": \<open>p \<equiv> (\<circ>p = \<top>)\<close>
+  apply (rule "valueof-facts:1"[unvarify x, THEN "\<rightarrow>E", rotated, OF "T-lem:1"])
+  using "\<equiv>\<^sub>d\<^sub>fE" "tv-id:2" "&E"(1) "prop-enc" by blast
+
+AOT_act_theorem "q-True:2": \<open>\<not>p \<equiv> (\<circ>p = \<bottom>)\<close>
+  apply (rule "valueof-facts:2"[unvarify x, THEN "\<rightarrow>E", rotated, OF "T-lem:1"])
+  using "\<equiv>\<^sub>d\<^sub>fE" "tv-id:2" "&E"(1) "prop-enc" by blast
+
+AOT_act_theorem "q-True:3": \<open>p \<equiv> \<top>\<^bold>\<Sigma>p\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume p
+  AOT_hence \<open>\<circ>p = \<top>\<close> by (metis "\<equiv>E"(1) "q-True:1")
+  moreover AOT_have \<open>\<circ>p\<^bold>\<Sigma>p\<close>
+    by (simp add: "tv-id:2")
+  ultimately AOT_show \<open>\<top>\<^bold>\<Sigma>p\<close>
+    using "rule=E" "T-lem:4" by fast
+next
+  AOT_have true_def: \<open>\<top> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:1")
+  AOT_hence true_den: \<open>\<top>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_have b: \<open>\<forall>F (\<top>[F] \<equiv> \<exists>q (q & F = [\<lambda>y q]))\<close>
+    using "y-in:2"[unvarify z, OF true_den, THEN "\<rightarrow>E", OF true_def] "&E" by blast
+
+  AOT_assume \<open>\<top>\<^bold>\<Sigma>p\<close>
+  AOT_hence \<open>\<top>[\<lambda>y p]\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc")
+  AOT_hence \<open>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q])\<close>
+    using b[THEN "\<forall>E"(1), OF "prop-prop2:2", THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain q where \<open>q & [\<lambda>y p] = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>p\<close>
+    using "rule=E" "&E"(1) "&E"(2) id_sym "\<equiv>E"(2) "p-identity-thm2:3" by fast
+qed
+
+
+AOT_act_theorem "q-True:5": \<open>\<not>p \<equiv> \<bottom>\<^bold>\<Sigma>p\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>\<not>p\<close>
+  AOT_hence \<open>\<circ>p = \<bottom>\<close> by (metis "\<equiv>E"(1) "q-True:2")
+  moreover AOT_have \<open>\<circ>p\<^bold>\<Sigma>p\<close>
+    by (simp add: "tv-id:2")
+  ultimately AOT_show \<open>\<bottom>\<^bold>\<Sigma>p\<close>
+    using "rule=E" "T-lem:4" by fast
+next
+  AOT_have false_def: \<open>\<bottom> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:2")
+  AOT_hence false_den: \<open>\<bottom>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_have b: \<open>\<forall>F (\<bottom>[F] \<equiv> \<exists>q (\<not>q & F = [\<lambda>y q]))\<close>
+    using "y-in:2"[unvarify z, OF false_den, THEN "\<rightarrow>E", OF false_def] "&E" by blast
+
+  AOT_assume \<open>\<bottom>\<^bold>\<Sigma>p\<close>
+  AOT_hence \<open>\<bottom>[\<lambda>y p]\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc")
+  AOT_hence \<open>\<exists>q (\<not>q & [\<lambda>y p] = [\<lambda>y q])\<close>
+    using b[THEN "\<forall>E"(1), OF "prop-prop2:2", THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain q where \<open>\<not>q & [\<lambda>y p] = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>\<not>p\<close>
+    using "rule=E" "&E"(1) "&E"(2) id_sym "\<equiv>E"(2) "p-identity-thm2:3" by fast
+qed
+
+AOT_act_theorem "q-True:4": \<open>p \<equiv> \<not>(\<bottom>\<^bold>\<Sigma>p)\<close>
+  using "q-True:5"
+  by (metis "deduction-theorem" "\<equiv>I" "\<equiv>E"(2) "\<equiv>E"(4) "raa-cor:3")
+
+AOT_act_theorem "q-True:6": \<open>\<not>p \<equiv> \<not>(\<top>\<^bold>\<Sigma>p)\<close>
+  using "\<equiv>E"(1) "oth-class-taut:4:b" "q-True:3" by blast
+
+AOT_define ExtensionOf :: \<open>\<tau> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>ExtensionOf'(_,_')\<close>)
+  "exten-p": \<open>ExtensionOf(x,p) \<equiv>\<^sub>d\<^sub>f A!x &
+                                   \<forall>F (x[F] \<rightarrow> Propositional([F])) &
+                                   \<forall>q ((x\<^bold>\<Sigma>q) \<equiv> (q \<equiv> p))\<close>
+
+AOT_theorem "extof-e": \<open>ExtensionOf(x, p) \<equiv> TruthValueOf(x, p)\<close>
+proof (safe intro!: "\<equiv>I" "\<rightarrow>I" "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "exten-p"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+            dest!: "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "exten-p"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  AOT_assume 1: \<open>[A!]x & \<forall>F (x[F] \<rightarrow> Propositional([F])) & \<forall>q (x \<^bold>\<Sigma> q \<equiv> (q \<equiv> p))\<close>
+  AOT_hence \<theta>: \<open>[A!]x & \<forall>F (x[F] \<rightarrow> \<exists>q(F = [\<lambda>y q])) & \<forall>q (x \<^bold>\<Sigma> q \<equiv> (q \<equiv> p))\<close>
+    by (AOT_subst \<open>\<exists>q(F = [\<lambda>y q])\<close> \<open>Propositional([F])\<close> for: F :: \<open><\<kappa>>\<close>)
+       (auto simp add: "df-rules-formulas[3]" "df-rules-formulas[4]"
+                       "\<equiv>I" "prop-prop1")
+  AOT_show \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  proof(safe intro!: "&I" GEN 1[THEN "&E"(1), THEN "&E"(1)] "\<equiv>I" "\<rightarrow>I")
+    fix F
+    AOT_assume 0: \<open>x[F]\<close>
+    AOT_hence \<open>\<exists>q (F = [\<lambda>y q])\<close>
+      using \<theta>[THEN "&E"(1), THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" by blast
+    then AOT_obtain q where q_prop: \<open>F = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>x[\<lambda>y q]\<close> using 0 "rule=E" by blast
+    AOT_hence \<open>x\<^bold>\<Sigma>q\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" "ex:1:a" "prop-enc" "rule-ui:3")
+    AOT_hence \<open>q \<equiv> p\<close> using \<theta>[THEN "&E"(2)] "\<forall>E"(2) "\<equiv>E"(1) by blast
+    AOT_hence \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close> using q_prop "&I" by blast
+    AOT_thus \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close> by (rule "\<exists>I")
+  next
+    fix F
+    AOT_assume \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close>
+    then AOT_obtain q where q_prop: \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>x\<^bold>\<Sigma>q\<close> using \<theta>[THEN "&E"(2)] "\<forall>E"(2) "&E" "\<equiv>E"(2) by blast
+    AOT_hence \<open>x[\<lambda>y q]\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc")
+    AOT_thus \<open>x[F]\<close> using q_prop[THEN "&E"(2), symmetric] "rule=E" by blast
+  qed
+next
+  AOT_assume 0: \<open>[A!]x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+  AOT_show \<open>[A!]x & \<forall>F (x[F] \<rightarrow> Propositional([F])) & \<forall>q (x \<^bold>\<Sigma> q \<equiv> (q \<equiv> p))\<close>
+  proof(safe intro!: "&I" 0[THEN "&E"(1)] GEN "\<rightarrow>I")
+    fix F
+    AOT_assume \<open>x[F]\<close>
+    AOT_hence \<open>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close>
+      using 0[THEN "&E"(2)] "\<forall>E"(2) "\<equiv>E"(1) by blast
+    then AOT_obtain q where \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>F = [\<lambda>y q]\<close> using "&E"(2) by blast
+    AOT_hence \<open>\<exists>q F = [\<lambda>y q]\<close> by (rule "\<exists>I")
+    AOT_thus \<open>Propositional([F])\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "prop-prop1")
+  next
+    AOT_show \<open>x\<^bold>\<Sigma>r \<equiv> (r \<equiv> p)\<close> for r
+    proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+      AOT_assume \<open>x\<^bold>\<Sigma>r\<close>
+      AOT_hence \<open>x[\<lambda>y r]\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc")
+      AOT_hence \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q])\<close> 
+        using 0[THEN "&E"(2), THEN "\<forall>E"(1), OF "prop-prop2:2", THEN "\<equiv>E"(1)] by blast
+      then AOT_obtain q where \<open>(q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q]\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_thus \<open>r \<equiv> p\<close>
+        by (metis "rule=E" "&E"(1,2) id_sym "\<equiv>E"(2) "Commutativity of \<equiv>"
+                  "p-identity-thm2:3")
+    next
+      AOT_assume \<open>r \<equiv> p\<close>
+      AOT_hence \<open>(r \<equiv> p) & [\<lambda>y r] = [\<lambda>y r]\<close>
+        by (metis "rule=I:1" "\<equiv>S"(1) "\<equiv>E"(2) "Commutativity of &" "prop-prop2:2")
+      AOT_hence \<open>\<exists>q ((q \<equiv> p) & [\<lambda>y r] = [\<lambda>y q])\<close> by (rule "\<exists>I")
+      AOT_hence \<open>x[\<lambda>y r]\<close>
+        using 0[THEN "&E"(2), THEN "\<forall>E"(1), OF "prop-prop2:2", THEN "\<equiv>E"(2)] by blast
+      AOT_thus \<open>x\<^bold>\<Sigma>r\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" "ex:1:a" "prop-enc" "rule-ui:3")
+    qed
+  qed
+qed
+
+AOT_theorem "ext-p-tv:1": \<open>\<exists>!x ExtensionOf(x, p)\<close>
+  by (AOT_subst \<open>ExtensionOf(x, p)\<close> \<open>TruthValueOf(x, p)\<close> for: x)
+     (auto simp: "extof-e" "p-has-!tv:2")
+
+AOT_theorem "ext-p-tv:2": \<open>\<^bold>\<iota>x(ExtensionOf(x, p))\<down>\<close>
+  using "A-Exists:2" "RA[2]" "ext-p-tv:1" "\<equiv>E"(2) by blast
+
+AOT_theorem "ext-p-tv:3": \<open>\<^bold>\<iota>x(ExtensionOf(x, p)) = \<circ>p\<close>
+proof -
+  AOT_have 0: \<open>\<^bold>\<A>\<forall>x(ExtensionOf(x, p) \<equiv> TruthValueOf(x,p))\<close>
+    by (rule "RA[2]"; rule GEN; rule "extof-e")
+  AOT_have 1: \<open>\<circ>p = \<^bold>\<iota>x TruthValueOf(x,p)\<close>
+    using "rule-id-df:1" "the-tv-p" "uni-tv" by blast
+  show ?thesis
+    apply (rule "equiv-desc-eq:1"[THEN "\<rightarrow>E", OF 0, THEN "\<forall>E"(1)[where \<tau>=\<open>\<guillemotleft>\<circ>p\<guillemotright>\<close>],
+                                  THEN "\<equiv>E"(2), symmetric])
+    using "1" "t=t-proper:1" "vdash-properties:10" apply blast
+    by (fact 1)
+qed
+(*<*)end(*>*)
diff --git a/thys/AOT/AOT_Definitions.thy b/thys/AOT/AOT_Definitions.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_Definitions.thy
@@ -0,0 +1,153 @@
+theory AOT_Definitions
+  imports AOT_semantics
+begin
+
+section\<open>Definitions of AOT\<close>
+
+AOT_theorem "conventions:1": \<open>\<phi> & \<psi> \<equiv>\<^sub>d\<^sub>f \<not>(\<phi> \<rightarrow> \<not>\<psi>)\<close>
+  using AOT_conj.
+AOT_theorem "conventions:2": \<open>\<phi> \<or> \<psi> \<equiv>\<^sub>d\<^sub>f \<not>\<phi> \<rightarrow> \<psi>\<close>
+  using AOT_disj.
+AOT_theorem "conventions:3": \<open>\<phi> \<equiv> \<psi> \<equiv>\<^sub>d\<^sub>f (\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>)\<close>
+  using AOT_equiv.
+AOT_theorem "conventions:4": \<open>\<exists>\<alpha> \<phi>{\<alpha>} \<equiv>\<^sub>d\<^sub>f \<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+  using AOT_exists.
+AOT_theorem "conventions:5": \<open>\<diamond>\<phi> \<equiv>\<^sub>d\<^sub>f \<not>\<box>\<not>\<phi>\<close>
+  using AOT_dia.
+
+declare "conventions:1"[AOT_defs] "conventions:2"[AOT_defs]
+        "conventions:3"[AOT_defs] "conventions:4"[AOT_defs]
+        "conventions:5"[AOT_defs]
+
+notepad
+begin
+  fix \<phi> \<psi> \<chi>
+  text\<open>\linelabel{precedence}\<close>
+  have "conventions3[1]": \<open>\<guillemotleft>\<phi> \<rightarrow> \<psi> \<equiv> \<not>\<psi> \<rightarrow> \<not>\<phi>\<guillemotright> = \<guillemotleft>(\<phi> \<rightarrow> \<psi>) \<equiv> (\<not>\<psi> \<rightarrow> \<not>\<phi>)\<guillemotright>\<close>
+    by blast
+  have "conventions3[2]": \<open>\<guillemotleft>\<phi> & \<psi> \<rightarrow> \<chi>\<guillemotright> = \<guillemotleft>(\<phi> & \<psi>) \<rightarrow> \<chi>\<guillemotright>\<close>
+                   and \<open>\<guillemotleft>\<phi> \<or> \<psi> \<rightarrow> \<chi>\<guillemotright> = \<guillemotleft>(\<phi> \<or> \<psi>) \<rightarrow> \<chi>\<guillemotright>\<close>
+    by blast+
+  have "conventions3[3]": \<open>\<guillemotleft>\<phi> \<or> \<psi> & \<chi>\<guillemotright> = \<guillemotleft>(\<phi> \<or> \<psi>) & \<chi>\<guillemotright>\<close>
+                   and \<open>\<guillemotleft>\<phi> & \<psi> \<or> \<chi>\<guillemotright> = \<guillemotleft>(\<phi> & \<psi>) \<or> \<chi>\<guillemotright>\<close>
+     by blast+ \<comment> \<open>Note that PLM instead generally uses parenthesis in these cases.\<close>
+end
+
+
+AOT_theorem "existence:1": \<open>\<kappa>\<down> \<equiv>\<^sub>d\<^sub>f \<exists>F [F]\<kappa>\<close>
+  by (simp add: AOT_sem_denotes AOT_sem_exists AOT_model_equiv_def)
+     (metis AOT_sem_denotes AOT_sem_exe AOT_sem_lambda_beta AOT_sem_lambda_denotes)
+AOT_theorem "existence:2": \<open>\<Pi>\<down> \<equiv>\<^sub>d\<^sub>f \<exists>x\<^sub>1...\<exists>x\<^sub>n x\<^sub>1...x\<^sub>n[\<Pi>]\<close>
+  using AOT_sem_denotes AOT_sem_enc_denotes AOT_sem_universal_encoder
+  by (simp add: AOT_sem_denotes AOT_sem_exists AOT_model_equiv_def) blast
+AOT_theorem "existence:2[1]": \<open>\<Pi>\<down> \<equiv>\<^sub>d\<^sub>f \<exists>x x[\<Pi>]\<close>
+  using "existence:2"[of \<Pi>] by simp
+AOT_theorem "existence:2[2]": \<open>\<Pi>\<down> \<equiv>\<^sub>d\<^sub>f \<exists>x\<exists>y xy[\<Pi>]\<close>
+  using "existence:2"[of \<Pi>]
+  by (simp add: AOT_sem_denotes AOT_sem_exists AOT_model_equiv_def
+                AOT_model_denotes_prod_def)
+AOT_theorem "existence:2[3]": \<open>\<Pi>\<down> \<equiv>\<^sub>d\<^sub>f \<exists>x\<exists>y\<exists>z xyz[\<Pi>]\<close>
+  using "existence:2"[of \<Pi>]
+  by (simp add: AOT_sem_denotes AOT_sem_exists AOT_model_equiv_def
+                AOT_model_denotes_prod_def)
+AOT_theorem "existence:2[4]": \<open>\<Pi>\<down> \<equiv>\<^sub>d\<^sub>f \<exists>x\<^sub>1\<exists>x\<^sub>2\<exists>x\<^sub>3\<exists>x\<^sub>4 x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[\<Pi>]\<close>
+  using "existence:2"[of \<Pi>]
+  by (simp add: AOT_sem_denotes AOT_sem_exists AOT_model_equiv_def
+                AOT_model_denotes_prod_def)
+
+AOT_theorem "existence:3": \<open>\<phi>\<down> \<equiv>\<^sub>d\<^sub>f [\<lambda>x \<phi>]\<down>\<close>
+  by (simp add: AOT_sem_denotes AOT_model_denotes_\<o>_def AOT_model_equiv_def
+                AOT_model_lambda_denotes)
+
+declare "existence:1"[AOT_defs] "existence:2"[AOT_defs] "existence:2[1]"[AOT_defs]
+        "existence:2[2]"[AOT_defs] "existence:2[3]"[AOT_defs]
+        "existence:2[4]"[AOT_defs] "existence:3"[AOT_defs]
+
+
+AOT_theorem "oa:1": \<open>O! =\<^sub>d\<^sub>f [\<lambda>x \<diamond>E!x]\<close> using AOT_ordinary .
+AOT_theorem "oa:2": \<open>A! =\<^sub>d\<^sub>f [\<lambda>x \<not>\<diamond>E!x]\<close> using AOT_abstract .
+
+declare "oa:1"[AOT_defs] "oa:2"[AOT_defs]
+
+AOT_theorem "identity:1":
+  \<open>x = y \<equiv>\<^sub>d\<^sub>f ([O!]x & [O!]y & \<box>\<forall>F ([F]x \<equiv> [F]y)) \<or>
+             ([A!]x & [A!]y & \<box>\<forall>F (x[F] \<equiv> y[F]))\<close>
+  unfolding AOT_model_equiv_def
+  using AOT_sem_ind_eq[of _ x y]
+  by (simp add: AOT_sem_ordinary AOT_sem_abstract AOT_sem_conj
+                AOT_sem_box AOT_sem_equiv AOT_sem_forall AOT_sem_disj AOT_sem_eq
+                AOT_sem_denotes)
+
+AOT_theorem "identity:2":
+  \<open>F = G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<box>\<forall>x(x[F] \<equiv> x[G])\<close>
+  using AOT_sem_enc_eq[of _ F G]
+  by (auto simp: AOT_model_equiv_def AOT_sem_imp AOT_sem_denotes AOT_sem_eq
+                 AOT_sem_conj AOT_sem_forall AOT_sem_box AOT_sem_equiv)
+
+AOT_theorem "identity:3[2]":
+  \<open>F = G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>y([\<lambda>z [F]zy] = [\<lambda>z [G]zy] & [\<lambda>z [F]yz] = [\<lambda>z [G]yz])\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_proj_id_prop[of _ F G]
+                 AOT_sem_proj_id_prod_def AOT_sem_conj AOT_sem_denotes
+                 AOT_sem_forall AOT_sem_unary_proj_id AOT_model_denotes_prod_def)
+AOT_theorem "identity:3[3]":
+  \<open>F = G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>y\<^sub>1\<forall>y\<^sub>2([\<lambda>z [F]zy\<^sub>1y\<^sub>2] = [\<lambda>z [G]zy\<^sub>1y\<^sub>2] &
+                              [\<lambda>z [F]y\<^sub>1zy\<^sub>2] = [\<lambda>z [G]y\<^sub>1zy\<^sub>2] &
+                              [\<lambda>z [F]y\<^sub>1y\<^sub>2z] = [\<lambda>z [G]y\<^sub>1y\<^sub>2z])\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_proj_id_prop[of _ F G]
+                 AOT_sem_proj_id_prod_def AOT_sem_conj AOT_sem_denotes
+                 AOT_sem_forall AOT_sem_unary_proj_id AOT_model_denotes_prod_def)
+AOT_theorem "identity:3[4]":
+  \<open>F = G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>y\<^sub>1\<forall>y\<^sub>2\<forall>y\<^sub>3([\<lambda>z [F]zy\<^sub>1y\<^sub>2y\<^sub>3] = [\<lambda>z [G]zy\<^sub>1y\<^sub>2y\<^sub>3] &
+                                [\<lambda>z [F]y\<^sub>1zy\<^sub>2y\<^sub>3] = [\<lambda>z [G]y\<^sub>1zy\<^sub>2y\<^sub>3] &
+                                [\<lambda>z [F]y\<^sub>1y\<^sub>2zy\<^sub>3] = [\<lambda>z [G]y\<^sub>1y\<^sub>2zy\<^sub>3] &
+                                [\<lambda>z [F]y\<^sub>1y\<^sub>2y\<^sub>3z] = [\<lambda>z [G]y\<^sub>1y\<^sub>2y\<^sub>3z])\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_proj_id_prop[of _ F G]
+                 AOT_sem_proj_id_prod_def AOT_sem_conj AOT_sem_denotes
+                 AOT_sem_forall AOT_sem_unary_proj_id AOT_model_denotes_prod_def)
+AOT_theorem "identity:3":
+  \<open>F = G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>x\<^sub>1...\<forall>x\<^sub>n \<guillemotleft>AOT_sem_proj_id x\<^sub>1x\<^sub>n (\<lambda> \<tau> . AOT_exe F \<tau>)
+                                                      (\<lambda> \<tau> . AOT_exe G \<tau>)\<guillemotright>\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_proj_id_prop[of _ F G]
+                 AOT_sem_proj_id_prod_def AOT_sem_conj AOT_sem_denotes
+                 AOT_sem_forall AOT_sem_unary_proj_id AOT_model_denotes_prod_def)
+
+AOT_theorem "identity:4":
+  \<open>p = q \<equiv>\<^sub>d\<^sub>f p\<down> & q\<down> & [\<lambda>x p] = [\<lambda>x q]\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_eq AOT_sem_denotes AOT_sem_conj
+                 AOT_model_lambda_denotes AOT_sem_lambda_eq_prop_eq)
+
+declare "identity:1"[AOT_defs] "identity:2"[AOT_defs] "identity:3[2]"[AOT_defs]
+        "identity:3[3]"[AOT_defs] "identity:3[4]"[AOT_defs] "identity:3"[AOT_defs]
+        "identity:4"[AOT_defs]
+
+AOT_define AOT_nonidentical :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "\<noteq>" 50)
+  "=-infix": \<open>\<tau> \<noteq> \<sigma> \<equiv>\<^sub>d\<^sub>f \<not>(\<tau> = \<sigma>)\<close>
+
+context AOT_meta_syntax
+begin
+notation AOT_nonidentical (infixl "\<^bold>\<noteq>" 50)
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_nonidentical (infixl "\<^bold>\<noteq>" 50)
+end
+
+
+text\<open>The following are purely technical pseudo-definitions required due to
+     our internal implementation of n-ary relations and ellipses using tuples.\<close>
+AOT_theorem tuple_denotes: \<open>\<guillemotleft>(\<tau>,\<tau>')\<guillemotright>\<down> \<equiv>\<^sub>d\<^sub>f \<tau>\<down> & \<tau>'\<down>\<close>
+  by (simp add: AOT_model_denotes_prod_def AOT_model_equiv_def
+                AOT_sem_conj AOT_sem_denotes)
+AOT_theorem tuple_identity_1: \<open>\<guillemotleft>(\<tau>,\<tau>')\<guillemotright> = \<guillemotleft>(\<sigma>, \<sigma>')\<guillemotright> \<equiv>\<^sub>d\<^sub>f (\<tau> = \<sigma>) & (\<tau>' = \<sigma>')\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_conj AOT_sem_eq
+                 AOT_model_denotes_prod_def AOT_sem_denotes)
+AOT_theorem tuple_forall: \<open>\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n \<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} \<equiv>\<^sub>d\<^sub>f \<forall>\<alpha>\<^sub>1(\<forall>\<alpha>\<^sub>2...\<forall>\<alpha>\<^sub>n \<phi>{\<guillemotleft>(\<alpha>\<^sub>1, \<alpha>\<^sub>2\<alpha>\<^sub>n)\<guillemotright>})\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_forall AOT_sem_denotes
+                 AOT_model_denotes_prod_def)
+AOT_theorem tuple_exists: \<open>\<exists>\<alpha>\<^sub>1...\<exists>\<alpha>\<^sub>n \<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} \<equiv>\<^sub>d\<^sub>f \<exists>\<alpha>\<^sub>1(\<exists>\<alpha>\<^sub>2...\<exists>\<alpha>\<^sub>n \<phi>{\<guillemotleft>(\<alpha>\<^sub>1, \<alpha>\<^sub>2\<alpha>\<^sub>n)\<guillemotright>})\<close>
+  by (auto simp: AOT_model_equiv_def AOT_sem_exists AOT_sem_denotes
+                 AOT_model_denotes_prod_def)
+declare tuple_denotes[AOT_defs] tuple_identity_1[AOT_defs] tuple_forall[AOT_defs]
+        tuple_exists[AOT_defs]
+
+end
diff --git a/thys/AOT/AOT_ExtendedRelationComprehension.thy b/thys/AOT/AOT_ExtendedRelationComprehension.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_ExtendedRelationComprehension.thy
@@ -0,0 +1,754 @@
+theory AOT_ExtendedRelationComprehension
+  imports AOT_RestrictedVariables
+begin
+
+section\<open>Extended Relation Comprehension\<close>
+
+text\<open>This theory depends on choosing extended models.\<close>
+interpretation AOT_ExtendedModel by (standard; auto)
+
+text\<open>Auxiliary lemma: negations of denoting relations denote.\<close>
+AOT_theorem negation_denotes: \<open>[\<lambda>x \<phi>{x}]\<down> \<rightarrow> [\<lambda>x \<not>\<phi>{x}]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+  AOT_show \<open>[\<lambda>x \<not>\<phi>{x}]\<down>\<close>
+  proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x \<not>[\<lambda>x \<phi>{x}]x]\<down>\<close> by "cqt:2"
+  next
+    AOT_have \<open>\<box>[\<lambda>x \<phi>{x}]\<down>\<close>
+      using 0 "exist-nec"[THEN "\<rightarrow>E"] by blast
+    moreover AOT_have \<open>\<box>[\<lambda>x \<phi>{x}]\<down> \<rightarrow> \<box>\<forall>x (\<not>[\<lambda>x \<phi>{x}]x \<equiv> \<not>\<phi>{x})\<close>
+      by(rule RM; safe intro!: GEN "\<equiv>I" "\<rightarrow>I" "\<beta>\<rightarrow>C"(2) "\<beta>\<leftarrow>C"(2) "cqt:2")
+    ultimately AOT_show \<open>\<box>\<forall>x (\<not>[\<lambda>x \<phi>{x}]x \<equiv> \<not>\<phi>{x})\<close>
+      using "\<rightarrow>E" by blast
+  qed
+qed
+
+text\<open>Auxiliary lemma: conjunctions of denoting relations denote.\<close>
+AOT_theorem conjunction_denotes: \<open>[\<lambda>x \<phi>{x}]\<down> & [\<lambda>x \<psi>{x}]\<down> \<rightarrow> [\<lambda>x \<phi>{x} & \<psi>{x}]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[\<lambda>x \<phi>{x}]\<down> & [\<lambda>x \<psi>{x}]\<down>\<close>
+  AOT_show \<open>[\<lambda>x \<phi>{x} & \<psi>{x}]\<down>\<close>
+  proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x [\<lambda>x \<phi>{x}]x & [\<lambda>x \<psi>{x}]x]\<down>\<close> by "cqt:2"
+  next
+    AOT_have \<open>\<box>([\<lambda>x \<phi>{x}]\<down> & [\<lambda>x \<psi>{x}]\<down>)\<close>
+      using 0 "exist-nec"[THEN "\<rightarrow>E"] "&E"
+            "KBasic:3" "df-simplify:2" "intro-elim:3:b" by blast
+    moreover AOT_have
+      \<open>\<box>([\<lambda>x \<phi>{x}]\<down> & [\<lambda>x \<psi>{x}]\<down>) \<rightarrow> \<box>\<forall>x ([\<lambda>x \<phi>{x}]x & [\<lambda>x \<psi>{x}]x \<equiv> \<phi>{x} & \<psi>{x})\<close>
+      by(rule RM; auto intro!: GEN "\<equiv>I" "\<rightarrow>I" "cqt:2" "&I"
+                        intro: "\<beta>\<leftarrow>C"
+                         dest: "&E" "\<beta>\<rightarrow>C")
+    ultimately AOT_show \<open>\<box>\<forall>x ([\<lambda>x \<phi>{x}]x & [\<lambda>x \<psi>{x}]x \<equiv> \<phi>{x} & \<psi>{x})\<close>
+      using "\<rightarrow>E" by blast
+  qed
+qed
+
+AOT_register_rigid_restricted_type
+  Ordinary: \<open>O!\<kappa>\<close>
+proof
+  AOT_modally_strict {
+    AOT_show \<open>\<exists>x O!x\<close>
+      by (meson "B\<diamond>" "T\<diamond>" "o-objects-exist:1" "\<rightarrow>E")
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>O!\<kappa> \<rightarrow> \<kappa>\<down>\<close> for \<kappa>
+      by (simp add: "\<rightarrow>I" "cqt:5:a[1]"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)])
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<forall>\<alpha>(O!\<alpha> \<rightarrow> \<box>O!\<alpha>)\<close>
+      by (simp add: GEN "oa-facts:1")
+  }
+qed
+
+AOT_register_variable_names
+  Ordinary: u v r t s
+
+text\<open>In PLM this is defined in the Natural Numbers chapter,
+     but since it is helpful for stating the comprehension principles,
+     we already define it here.\<close>
+AOT_define eqE :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl \<open>\<equiv>\<^sub>E\<close> 50)
+  eqE: \<open>F \<equiv>\<^sub>E G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>u ([F]u \<equiv> [G]u)\<close>
+
+text\<open>Derive existence claims about relations from the axioms.\<close>
+AOT_theorem denotes_all: \<open>[\<lambda>x \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G])]\<down>\<close>
+    and denotes_all_neg: \<open>[\<lambda>x \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G])]\<down>\<close>
+proof -
+  AOT_have Aux: \<open>\<forall>F (\<box>F \<equiv>\<^sub>E G \<rightarrow> (x[F] \<equiv> x[G])), \<not>(x[G] \<equiv> y[G])
+    \<^bold>\<turnstile>\<^sub>\<box> \<exists>F([F]x & \<not>[F]y)\<close> for x y G
+  proof -
+    AOT_modally_strict {
+    AOT_assume 0: \<open>\<forall>F (\<box>F \<equiv>\<^sub>E G \<rightarrow> (x[F] \<equiv> x[G]))\<close>
+    AOT_assume G_prop: \<open>\<not>(x[G] \<equiv> y[G])\<close>
+    {
+      AOT_assume \<open>\<not>\<exists>F([F]x & \<not>[F]y)\<close>
+      AOT_hence 0: \<open>\<forall>F \<not>([F]x & \<not>[F]y)\<close>
+        by (metis "cqt-further:4" "\<rightarrow>E")
+      AOT_have \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+      proof (rule GEN; rule "\<equiv>I"; rule "\<rightarrow>I")
+        fix F
+        AOT_assume \<open>[F]x\<close>
+        moreover AOT_have \<open>\<not>([F]x & \<not>[F]y)\<close>
+          using 0[THEN "\<forall>E"(2)] by blast
+        ultimately AOT_show \<open>[F]y\<close>
+          by (metis "&I" "raa-cor:1") 
+      next
+        fix F
+        AOT_assume \<open>[F]y\<close>
+        AOT_hence \<open>\<not>[\<lambda>x \<not>[F]x]y\<close>
+          by (metis "\<not>\<not>I" "\<beta>\<rightarrow>C"(2))
+        moreover AOT_have \<open>\<not>([\<lambda>x \<not>[F]x]x & \<not>[\<lambda>x \<not>[F]x]y)\<close>
+          apply (rule 0[THEN "\<forall>E"(1)]) by "cqt:2[lambda]"
+        ultimately AOT_have 1: \<open>\<not>[\<lambda>x \<not>[F]x]x\<close>
+          by (metis "&I" "raa-cor:3")
+        {
+          AOT_assume \<open>\<not>[F]x\<close>
+          AOT_hence \<open>[\<lambda>x \<not>[F]x]x\<close>
+            by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+          AOT_hence \<open>p & \<not>p\<close> for p
+            using 1 by (metis "raa-cor:3")
+        }
+        AOT_thus \<open>[F]x\<close> by (metis "raa-cor:1")
+      qed
+      AOT_hence \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+        using "ind-nec"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+        by (metis "CBF" "\<rightarrow>E")
+    } note indistI = this
+    {
+      AOT_assume G_prop: \<open>x[G] & \<not>y[G]\<close>
+      AOT_hence Ax: \<open>A!x\<close>
+        using "&E"(1) "\<exists>I"(2) "\<rightarrow>E" "encoders-are-abstract" by blast
+  
+      {
+        AOT_assume Ay: \<open>A!y\<close>
+        {
+          fix F
+          {
+            AOT_assume \<open>\<forall>u\<box>([F]u \<equiv> [G]u)\<close>
+            AOT_hence \<open>\<box>\<forall>u([F]u \<equiv> [G]u)\<close>
+              using "Ordinary.res-var-bound-reas[BF]"[THEN "\<rightarrow>E"] by simp
+            AOT_hence \<open>\<box>F \<equiv>\<^sub>E G\<close>
+              by (AOT_subst \<open>F \<equiv>\<^sub>E G\<close> \<open>\<forall>u ([F]u \<equiv> [G]u)\<close>)
+                 (auto intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+            AOT_hence \<open>x[F] \<equiv> x[G]\<close>
+              using 0[THEN "\<forall>E"(2)] "\<equiv>E" "\<rightarrow>E" by meson
+            AOT_hence \<open>x[F]\<close>
+              using G_prop "&E" "\<equiv>E" by blast
+          }
+          AOT_hence \<open>\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> x[F]\<close>
+            by (rule "\<rightarrow>I")
+        }
+        AOT_hence xprop: \<open>\<forall>F(\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> x[F])\<close>
+          by (rule GEN)
+        moreover AOT_have yprop: \<open>\<not>\<forall>F(\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> y[F])\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>\<forall>F(\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> y[F])\<close>
+          AOT_hence \<open>\<forall>F(\<box>\<forall>u([F]u \<equiv> [G]u) \<rightarrow> y[F])\<close>
+            apply (AOT_subst \<open>\<box>\<forall>u([F]u \<equiv> [G]u)\<close> \<open>\<forall>u\<box>([F]u \<equiv> [G]u)\<close> for: F)
+            using "Ordinary.res-var-bound-reas[BF]"
+                  "Ordinary.res-var-bound-reas[CBF]"
+                  "intro-elim:2" apply presburger
+            by simp
+          AOT_hence A: \<open>\<forall>F(\<box>F \<equiv>\<^sub>E G \<rightarrow> y[F])\<close>
+            by (AOT_subst \<open>F \<equiv>\<^sub>E G\<close> \<open>\<forall>u ([F]u \<equiv> [G]u)\<close> for: F)
+               (auto intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+          moreover AOT_have \<open>\<box>G \<equiv>\<^sub>E G\<close>
+            by (auto intro!: "eqE"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2" RN "&I" GEN "\<rightarrow>I" "\<equiv>I")
+          ultimately AOT_have \<open>y[G]\<close> using "\<forall>E"(2) "\<rightarrow>E" by blast
+          AOT_thus \<open>p & \<not>p\<close> for p using G_prop "&E" by (metis "raa-cor:3")
+        qed
+        AOT_have \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+        proof(rule "raa-cor:1")
+          AOT_assume \<open>\<not>\<exists>F([F]x & \<not>[F]y)\<close>
+          AOT_hence indist: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close> using indistI by blast
+          AOT_have \<open>\<forall>F(\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> y[F])\<close>
+            using indistinguishable_ord_enc_all[axiom_inst, THEN "\<rightarrow>E", OF "&I",
+                      OF "&I", OF "&I", OF "cqt:2[const_var]"[axiom_inst],
+                      OF Ax, OF Ay, OF indist, THEN "\<equiv>E"(1), OF xprop].
+          AOT_thus \<open>\<forall>F(\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> y[F]) & \<not>\<forall>F(\<forall>u\<box>([F]u \<equiv> [G]u) \<rightarrow> y[F])\<close>
+            using yprop "&I" by blast
+        qed
+      }
+      moreover {
+        AOT_assume notAy: \<open>\<not>A!y\<close>
+        AOT_have \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+          apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>A!\<guillemotright>\<close>])
+          using Ax notAy "&I" apply blast
+          by (simp add: "oa-exist:2")
+      }
+      ultimately AOT_have \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+        by (metis "raa-cor:1")
+    }
+    moreover {
+      AOT_assume G_prop: \<open>\<not>x[G] & y[G]\<close>
+      AOT_hence Ay: \<open>A!y\<close>
+        by (meson "&E"(2) "encoders-are-abstract" "existential:2[const_var]" "\<rightarrow>E")
+      AOT_hence notOy: \<open>\<not>O!y\<close>
+        using "\<equiv>E"(1) "oa-contingent:3" by blast
+      {
+        AOT_assume Ax: \<open>A!x\<close>
+        {
+          fix F
+          {
+            AOT_assume \<open>\<box>\<forall>u([F]u \<equiv> [G]u)\<close>
+            AOT_hence \<open>\<box>F \<equiv>\<^sub>E G\<close>
+              by (AOT_subst \<open>F \<equiv>\<^sub>E G\<close> \<open>\<forall>u([F]u \<equiv> [G]u)\<close>)
+                 (auto intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+            AOT_hence \<open>x[F] \<equiv> x[G]\<close>
+              using 0[THEN "\<forall>E"(2)] "\<equiv>E" "\<rightarrow>E" by meson
+            AOT_hence \<open>\<not>x[F]\<close>
+              using G_prop "&E" "\<equiv>E" by blast
+          }
+          AOT_hence \<open>\<box>\<forall>u([F]u \<equiv> [G]u) \<rightarrow> \<not>x[F]\<close>
+            by (rule "\<rightarrow>I")
+        }
+        AOT_hence x_prop: \<open>\<forall>F(\<box>\<forall>u([F]u \<equiv> [G]u) \<rightarrow> \<not>x[F])\<close>
+          by (rule GEN)
+        AOT_have x_prop: \<open>\<not>\<exists>F(\<forall>u\<box>([F]u \<equiv> [G]u) & x[F])\<close> 
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>\<exists>F(\<forall>u \<box>([F]u \<equiv> [G]u) & x[F])\<close>
+          then AOT_obtain F where F_prop: \<open>\<forall>u \<box>([F]u \<equiv> [G]u) & x[F]\<close>
+            using "\<exists>E"[rotated] by blast
+          AOT_have \<open>\<box>([F]u \<equiv> [G]u)\<close> for u
+            using F_prop[THEN "&E"(1), THEN "Ordinary.\<forall>E"].
+          AOT_hence \<open>\<forall>u \<box>([F]u \<equiv> [G]u)\<close>
+            by (rule Ordinary.GEN)
+          AOT_hence \<open>\<box>\<forall>u([F]u \<equiv> [G]u)\<close>
+            by (metis "Ordinary.res-var-bound-reas[BF]" "\<rightarrow>E")
+          AOT_hence \<open>\<not>x[F]\<close>
+            using x_prop[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+          AOT_thus \<open>p & \<not>p\<close> for p
+            using F_prop[THEN "&E"(2)] by (metis "raa-cor:3")
+        qed
+        AOT_have y_prop: \<open>\<exists>F(\<forall>u \<box>([F]u \<equiv> [G]u) & y[F])\<close>
+        proof (rule "raa-cor:1")
+          AOT_assume \<open>\<not>\<exists>F (\<forall>u \<box>([F]u \<equiv> [G]u) & y[F])\<close>
+          AOT_hence 0: \<open>\<forall>F \<not>(\<forall>u \<box>([F]u \<equiv> [G]u) & y[F])\<close>
+            using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+          {
+            fix F
+            {
+              AOT_assume \<open>\<forall>u \<box>([F]u \<equiv> [G]u)\<close>
+              AOT_hence \<open>\<not>y[F]\<close>
+                using 0[THEN "\<forall>E"(2)] "&I" "raa-cor:1" by meson
+            }
+            AOT_hence \<open>(\<forall>u \<box>([F]u \<equiv> [G]u) \<rightarrow> \<not>y[F])\<close>
+              by (rule "\<rightarrow>I")
+          }
+          AOT_hence A: \<open>\<forall>F(\<forall>u \<box>([F]u \<equiv> [G]u) \<rightarrow> \<not>y[F])\<close>
+            by (rule GEN)
+          moreover AOT_have \<open>\<forall>u \<box>([G]u \<equiv> [G]u)\<close>
+            by (simp add: RN "oth-class-taut:3:a" "universal-cor" "\<rightarrow>I")
+          ultimately AOT_have \<open>\<not>y[G]\<close>
+            using "\<forall>E"(2) "\<rightarrow>E" by blast
+          AOT_thus \<open>p & \<not>p\<close> for p
+            using G_prop "&E" by (metis "raa-cor:3")
+        qed
+        AOT_have \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+        proof(rule "raa-cor:1")
+          AOT_assume \<open>\<not>\<exists>F([F]x & \<not>[F]y)\<close>
+          AOT_hence indist: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+            using indistI by blast
+          AOT_thus \<open>\<exists>F(\<forall>u \<box>([F]u \<equiv> [G]u) & x[F]) & \<not>\<exists>F(\<forall>u \<box>([F]u \<equiv> [G]u) & x[F])\<close>
+            using indistinguishable_ord_enc_ex[axiom_inst, THEN "\<rightarrow>E", OF "&I",
+                    OF "&I", OF "&I", OF "cqt:2[const_var]"[axiom_inst],
+                    OF Ax, OF Ay, OF indist, THEN "\<equiv>E"(2), OF y_prop]
+                x_prop "&I" by blast
+        qed
+      }
+      moreover {
+        AOT_assume notAx: \<open>\<not>A!x\<close>
+        AOT_hence Ox: \<open>O!x\<close>
+          using "\<or>E"(3) "oa-exist:3" by blast
+        AOT_have \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+          apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>O!\<guillemotright>\<close>])
+          using Ox notOy "&I" apply blast
+          by (simp add: "oa-exist:1")
+      }
+      ultimately AOT_have \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+        by (metis "raa-cor:1")
+    }
+    ultimately AOT_show \<open>\<exists>F([F]x & \<not>[F]y)\<close>
+      using G_prop by (metis "&I" "\<rightarrow>I" "\<equiv>I" "raa-cor:1")
+  }
+  qed
+
+  AOT_modally_strict {
+    fix x y
+    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    AOT_hence nec_indist: \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close> 
+      using "ind-nec" "vdash-properties:10" by blast
+    AOT_hence indist_nec: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      using "CBF" "vdash-properties:10" by blast
+    AOT_assume 0: \<open>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G])\<close>
+    AOT_hence 1: \<open>\<forall>G (\<box>\<forall>u ([G]u \<equiv> [F]u) \<rightarrow> x[G])\<close>
+      by (AOT_subst (reverse) \<open>\<forall>u ([G]u \<equiv> [F]u)\<close> \<open>G \<equiv>\<^sub>E F\<close> for: G)
+         (auto intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+    AOT_have \<open>x[F]\<close>
+      by (safe intro!: 1[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] GEN "\<rightarrow>I" RN "\<equiv>I")
+    AOT_have \<open>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> y[G])\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume \<open>\<not>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> y[G])\<close>
+      AOT_hence \<open>\<exists>G \<not>(\<box>G \<equiv>\<^sub>E F \<rightarrow> y[G])\<close>
+        using "cqt-further:2" "\<rightarrow>E" by blast
+      then AOT_obtain G where G_prop: \<open>\<not>(\<box>G \<equiv>\<^sub>E F \<rightarrow> y[G])\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence 1: \<open>\<box>G \<equiv>\<^sub>E F & \<not>y[G]\<close>
+        by (metis "\<equiv>E"(1) "oth-class-taut:1:b")
+      AOT_have xG: \<open>x[G]\<close>
+        using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] 1[THEN "&E"(1)] by blast
+      AOT_hence \<open>x[G] & \<not>y[G]\<close>
+        using 1[THEN "&E"(2)] "&I" by blast
+      AOT_hence B: \<open>\<not>(x[G] \<equiv> y[G])\<close>
+        using "&E"(2) "\<equiv>E"(1) "reductio-aa:1" xG by blast
+      {
+        fix H
+        {
+          AOT_assume \<open>\<box>H \<equiv>\<^sub>E G\<close>
+          AOT_hence \<open>\<box>(H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F)\<close>
+            using 1 by (metis "KBasic:3" "con-dis-i-e:1" "con-dis-i-e:2:a"
+                              "intro-elim:3:b")
+          moreover AOT_have \<open>\<box>(H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F) \<rightarrow> \<box>(H \<equiv>\<^sub>E F)\<close>
+          proof(rule RM)
+            AOT_modally_strict {
+              AOT_show \<open>H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F \<rightarrow> H \<equiv>\<^sub>E F\<close>
+              proof (safe intro!: "\<rightarrow>I" "eqE"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN)
+                fix u
+                AOT_assume \<open>H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F\<close>
+                AOT_hence \<open>\<forall>u ([H]u \<equiv> [G]u)\<close> and \<open>\<forall>u ([G]u \<equiv> [F]u)\<close>
+                  using "eqE"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+                AOT_thus \<open>[H]u \<equiv> [F]u\<close>
+                  by (auto dest!: "Ordinary.\<forall>E" dest: "\<equiv>E")
+              qed
+            }
+          qed
+          ultimately AOT_have \<open>\<box>(H \<equiv>\<^sub>E F)\<close>
+            using "\<rightarrow>E" by blast
+          AOT_hence \<open>x[H]\<close>
+            using 0[THEN "\<forall>E"(2)] "\<rightarrow>E" by blast
+          AOT_hence \<open>x[H] \<equiv> x[G]\<close>
+            using xG "\<equiv>I" "\<rightarrow>I" by blast
+        }
+        AOT_hence \<open>\<box>H \<equiv>\<^sub>E G \<rightarrow> (x[H] \<equiv> x[G])\<close> by (rule "\<rightarrow>I")
+      }
+      AOT_hence A: \<open>\<forall>H(\<box>H \<equiv>\<^sub>E G \<rightarrow> (x[H] \<equiv> x[G]))\<close>
+        by (rule GEN)
+      then AOT_obtain F where F_prop: \<open>[F]x & \<not>[F]y\<close>
+        using Aux[OF A, OF B] "\<exists>E"[rotated] by blast
+      moreover AOT_have \<open>[F]y\<close>
+        using indist[THEN "\<forall>E"(2), THEN "\<equiv>E"(1), OF F_prop[THEN "&E"(1)]].
+      AOT_thus \<open>p & \<not>p\<close> for p
+        using F_prop[THEN "&E"(2)] by (metis "raa-cor:3")
+    qed
+  } note 0 = this
+  AOT_modally_strict {
+    fix x y
+    AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    moreover AOT_have \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
+      by (metis calculation "cqt-basic:11" "\<equiv>E"(2))
+    ultimately AOT_have \<open>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G]) \<equiv> \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> y[G])\<close>
+      using 0 "\<equiv>I" "\<rightarrow>I" by auto
+  } note 1 = this
+  AOT_show \<open>[\<lambda>x \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G])]\<down>\<close>
+    by (safe intro!: RN GEN "\<rightarrow>I" 1 "kirchner-thm:2"[THEN "\<equiv>E"(2)])
+
+  AOT_modally_strict {
+    fix x y
+    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    AOT_hence nec_indist: \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close> 
+      using "ind-nec" "vdash-properties:10" by blast
+    AOT_hence indist_nec: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      using "CBF" "vdash-properties:10" by blast
+    AOT_assume 0: \<open>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G])\<close>
+    AOT_hence 1: \<open>\<forall>G (\<box>\<forall>u ([G]u \<equiv> [F]u) \<rightarrow> \<not>x[G])\<close>
+      by (AOT_subst (reverse) \<open>\<forall>u ([G]u \<equiv> [F]u)\<close> \<open>G \<equiv>\<^sub>E F\<close> for: G)
+         (auto intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+    AOT_have \<open>\<not>x[F]\<close>
+      by (safe intro!: 1[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] GEN "\<rightarrow>I" RN "\<equiv>I")
+    AOT_have \<open>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>y[G])\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume \<open>\<not>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>y[G])\<close>
+      AOT_hence \<open>\<exists>G \<not>(\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>y[G])\<close>
+        using "cqt-further:2" "\<rightarrow>E" by blast
+      then AOT_obtain G where G_prop: \<open>\<not>(\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>y[G])\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence 1: \<open>\<box>G \<equiv>\<^sub>E F & \<not>\<not>y[G]\<close>
+        by (metis "\<equiv>E"(1) "oth-class-taut:1:b")
+      AOT_hence yG: \<open>y[G]\<close>
+        using G_prop "\<rightarrow>I" "raa-cor:3" by blast
+      moreover AOT_hence 12: \<open>\<not>x[G]\<close>
+        using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] 1[THEN "&E"(1)] by blast
+      ultimately AOT_have \<open>\<not>x[G] & y[G]\<close>
+        using "&I" by blast
+      AOT_hence B: \<open>\<not>(x[G] \<equiv> y[G])\<close>
+        by (metis "12" "\<equiv>E"(3) "raa-cor:3" yG)
+      {
+        fix H
+        {
+          AOT_assume 3: \<open>\<box>H \<equiv>\<^sub>E G\<close>
+          AOT_hence \<open>\<box>(H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F)\<close>
+            using 1
+            by (metis "KBasic:3" "con-dis-i-e:1" "\<rightarrow>I" "intro-elim:3:b"
+                      "reductio-aa:1" G_prop)
+          moreover AOT_have \<open>\<box>(H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F) \<rightarrow> \<box>(H \<equiv>\<^sub>E F)\<close>
+          proof (rule RM)
+            AOT_modally_strict {
+              AOT_show \<open>H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F \<rightarrow> H \<equiv>\<^sub>E F\<close>
+              proof (safe intro!: "\<rightarrow>I" "eqE"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN)
+                fix u
+                AOT_assume \<open>H \<equiv>\<^sub>E G & G \<equiv>\<^sub>E F\<close>
+                AOT_hence \<open>\<forall>u ([H]u \<equiv> [G]u)\<close> and \<open>\<forall>u ([G]u \<equiv> [F]u)\<close>
+                  using "eqE"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+                AOT_thus \<open>[H]u \<equiv> [F]u\<close>
+                  by (auto dest!: "Ordinary.\<forall>E" dest: "\<equiv>E")
+              qed
+            }
+          qed
+          ultimately AOT_have \<open>\<box>(H \<equiv>\<^sub>E F)\<close>
+            using "\<rightarrow>E" by blast
+          AOT_hence \<open>\<not>x[H]\<close>
+            using 0[THEN "\<forall>E"(2)] "\<rightarrow>E" by blast
+          AOT_hence \<open>x[H] \<equiv> x[G]\<close>
+            using 12 "\<equiv>I" "\<rightarrow>I" by (metis "raa-cor:3")
+        }
+        AOT_hence \<open>\<box>H \<equiv>\<^sub>E G \<rightarrow> (x[H] \<equiv> x[G])\<close>
+          by (rule "\<rightarrow>I")
+      }
+      AOT_hence A: \<open>\<forall>H(\<box>H \<equiv>\<^sub>E G \<rightarrow> (x[H] \<equiv> x[G]))\<close>
+        by (rule GEN)
+      then AOT_obtain F where F_prop: \<open>[F]x & \<not>[F]y\<close>
+        using Aux[OF A, OF B] "\<exists>E"[rotated] by blast
+      moreover AOT_have \<open>[F]y\<close>
+        using indist[THEN "\<forall>E"(2), THEN "\<equiv>E"(1), OF F_prop[THEN "&E"(1)]].
+      AOT_thus \<open>p & \<not>p\<close> for p
+        using F_prop[THEN "&E"(2)] by (metis "raa-cor:3")
+    qed
+  } note 0 = this
+  AOT_modally_strict {
+    fix x y
+    AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    moreover AOT_have \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
+      by (metis calculation "cqt-basic:11" "\<equiv>E"(2))
+    ultimately AOT_have \<open>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G]) \<equiv> \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>y[G])\<close>
+      using 0 "\<equiv>I" "\<rightarrow>I" by auto
+  } note 1 = this
+  AOT_show \<open>[\<lambda>x \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G])]\<down>\<close>
+    by (safe intro!: RN GEN "\<rightarrow>I" 1 "kirchner-thm:2"[THEN "\<equiv>E"(2)])
+qed
+
+text\<open>Reformulate the existence claims in terms of their negations.\<close>
+
+AOT_theorem denotes_ex: \<open>[\<lambda>x \<exists>G (\<box>G \<equiv>\<^sub>E F & x[G])]\<down>\<close>
+proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+  AOT_show \<open>[\<lambda>x \<not>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G])]\<down>\<close>
+    using denotes_all_neg[THEN negation_denotes[THEN "\<rightarrow>E"]].
+next
+  AOT_show \<open>\<box>\<forall>x (\<not>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G]) \<equiv> \<exists>G (\<box>G \<equiv>\<^sub>E F & x[G]))\<close>
+    by (AOT_subst  \<open>\<box>G \<equiv>\<^sub>E F & x[G]\<close> \<open>\<not>(\<box>G \<equiv>\<^sub>E F \<rightarrow> \<not>x[G])\<close> for: G x)
+       (auto simp: "conventions:1" "rule-eq-df:1"
+             intro: "oth-class-taut:4:b"[THEN "\<equiv>E"(2)]
+                    "intro-elim:3:f"[OF "cqt-further:3", OF "oth-class-taut:3:b"]
+             intro!: RN GEN)
+qed
+
+AOT_theorem denotes_ex_neg: \<open>[\<lambda>x \<exists>G (\<box>G \<equiv>\<^sub>E F & \<not>x[G])]\<down>\<close>
+proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+  AOT_show \<open>[\<lambda>x \<not>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G])]\<down>\<close>
+    using denotes_all[THEN negation_denotes[THEN "\<rightarrow>E"]].
+next
+  AOT_show \<open>\<box>\<forall>x (\<not>\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G]) \<equiv> \<exists>G (\<box>G \<equiv>\<^sub>E F & \<not>x[G]))\<close>
+    by (AOT_subst (reverse) \<open>\<box>G \<equiv>\<^sub>E F & \<not>x[G]\<close> \<open>\<not>(\<box>G \<equiv>\<^sub>E F \<rightarrow> x[G])\<close> for: G x)
+       (auto simp: "oth-class-taut:1:b"
+             intro: "oth-class-taut:4:b"[THEN "\<equiv>E"(2)]
+                    "intro-elim:3:f"[OF "cqt-further:3", OF "oth-class-taut:3:b"]
+             intro!: RN GEN)
+qed
+
+text\<open>Derive comprehension principles.\<close>
+
+AOT_theorem Comprehension_1:
+  shows \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> [\<lambda>x \<exists>F (\<phi>{F} & x[F])]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume assm: \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+  AOT_modally_strict {
+    fix x y
+    AOT_assume 0: \<open>\<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    AOT_assume x_prop: \<open>\<exists>F (\<phi>{F} & x[F])\<close>
+    then AOT_obtain F where F_prop: \<open>\<phi>{F} & x[F]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<box>F \<equiv>\<^sub>E F & x[F]\<close>
+      by (auto intro!: RN eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<equiv>I" "\<rightarrow>I" dest: "&E")
+    AOT_hence \<open>\<exists>G(\<box>G \<equiv>\<^sub>E F & x[G])\<close>
+      by (rule "\<exists>I")
+    AOT_hence \<open>[\<lambda>x \<exists>G(\<box>G \<equiv>\<^sub>E F & x[G])]x\<close>
+      by (safe intro!: "\<beta>\<leftarrow>C" denotes_ex "cqt:2")
+    AOT_hence \<open>[\<lambda>x \<exists>G(\<box>G \<equiv>\<^sub>E F & x[G])]y\<close>
+      using indist[THEN "\<forall>E"(1), OF denotes_ex, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<exists>G(\<box>G \<equiv>\<^sub>E F & y[G])\<close>
+      using "\<beta>\<rightarrow>C" by blast
+    then AOT_obtain G where \<open>\<box>G \<equiv>\<^sub>E F & y[G]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<phi>{G} & y[G]\<close>
+      using 0[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<equiv>E"(1)]
+            F_prop[THEN "&E"(1)] "&E" "&I" by blast
+    AOT_hence \<open>\<exists>F (\<phi>{F} & y[F])\<close>
+      by (rule "\<exists>I")
+  } note 1 = this
+  AOT_modally_strict {
+    AOT_assume 0: \<open>\<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+    {
+      fix x y
+      {
+        AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+        moreover AOT_have \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
+          by (metis calculation "cqt-basic:11" "\<equiv>E"(1))
+        ultimately AOT_have \<open>\<exists>F (\<phi>{F} & x[F]) \<equiv> \<exists>F (\<phi>{F} & y[F])\<close>
+          using 0 1[OF 0] "\<equiv>I" "\<rightarrow>I" by simp
+      }
+      AOT_hence \<open>\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & x[F]) \<equiv> \<exists>F (\<phi>{F} & y[F]))\<close>
+        using "\<rightarrow>I" by blast
+    }
+    AOT_hence \<open>\<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & x[F]) \<equiv>  \<exists>F (\<phi>{F} & y[F])))\<close>
+      by (auto intro!: GEN)
+  } note 1 = this
+  AOT_hence \<open>\<^bold>\<turnstile>\<^sub>\<box> \<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow>
+                \<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & x[F]) \<equiv> \<exists>F (\<phi>{F} & y[F])))\<close>
+    by (rule "\<rightarrow>I")
+  AOT_hence \<open>\<box>\<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow>
+             \<box>\<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & x[F]) \<equiv> \<exists>F (\<phi>{F} & y[F])))\<close>
+    by (rule RM)
+  AOT_hence \<open>\<box>\<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & x[F]) \<equiv> \<exists>F (\<phi>{F} & y[F])))\<close>
+    using "\<rightarrow>E" assm by blast
+  AOT_thus \<open>[\<lambda>x \<exists>F (\<phi>{F} & x[F])]\<down>\<close>
+    by (safe intro!: "kirchner-thm:2"[THEN "\<equiv>E"(2)])
+qed
+
+AOT_theorem Comprehension_2:
+  shows \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> [\<lambda>x \<exists>F (\<phi>{F} & \<not>x[F])]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume assm: \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+  AOT_modally_strict {
+    fix x y
+    AOT_assume 0: \<open>\<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    AOT_assume x_prop: \<open>\<exists>F (\<phi>{F} & \<not>x[F])\<close>
+    then AOT_obtain F where F_prop: \<open>\<phi>{F} & \<not>x[F]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<box>F \<equiv>\<^sub>E F & \<not>x[F]\<close>
+      by (auto intro!: RN eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<equiv>I" "\<rightarrow>I" dest: "&E")
+    AOT_hence \<open>\<exists>G(\<box>G \<equiv>\<^sub>E F & \<not>x[G])\<close>
+      by (rule "\<exists>I")
+    AOT_hence \<open>[\<lambda>x \<exists>G(\<box>G \<equiv>\<^sub>E F & \<not>x[G])]x\<close>
+      by (safe intro!: "\<beta>\<leftarrow>C" denotes_ex_neg "cqt:2")
+    AOT_hence \<open>[\<lambda>x \<exists>G(\<box>G \<equiv>\<^sub>E F & \<not>x[G])]y\<close>
+      using indist[THEN "\<forall>E"(1), OF denotes_ex_neg, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<exists>G(\<box>G \<equiv>\<^sub>E F & \<not>y[G])\<close>
+      using "\<beta>\<rightarrow>C" by blast
+    then AOT_obtain G where \<open>\<box>G \<equiv>\<^sub>E F & \<not>y[G]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<phi>{G} & \<not>y[G]\<close>
+      using 0[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<equiv>E"(1)]
+            F_prop[THEN "&E"(1)] "&E" "&I" by blast
+    AOT_hence \<open>\<exists>F (\<phi>{F} & \<not>y[F])\<close>
+      by (rule "\<exists>I")
+  } note 1 = this
+  AOT_modally_strict {
+    AOT_assume 0: \<open>\<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+    {
+      fix x y
+      {
+        AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+        moreover AOT_have \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
+          by (metis calculation "cqt-basic:11" "\<equiv>E"(1))
+        ultimately AOT_have \<open>\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv> \<exists>F (\<phi>{F} & \<not>y[F])\<close>
+          using 0 1[OF 0] "\<equiv>I" "\<rightarrow>I" by simp
+      }
+      AOT_hence \<open>\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv> \<exists>F (\<phi>{F} & \<not>y[F]))\<close>
+        using "\<rightarrow>I" by blast
+    }
+    AOT_hence \<open>\<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv>  \<exists>F (\<phi>{F} & \<not>y[F])))\<close>
+      by (auto intro!: GEN)
+  } note 1 = this
+  AOT_hence \<open>\<^bold>\<turnstile>\<^sub>\<box> \<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow>
+                \<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv> \<exists>F (\<phi>{F} & \<not>y[F])))\<close>
+    by (rule "\<rightarrow>I")
+  AOT_hence \<open>\<box>\<forall>F\<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow>
+             \<box>\<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv> \<exists>F (\<phi>{F} & \<not>y[F])))\<close>
+    by (rule RM)
+  AOT_hence \<open>\<box>\<forall>x\<forall>y(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv> \<exists>F (\<phi>{F} & \<not>y[F])))\<close>
+    using "\<rightarrow>E" assm by blast
+  AOT_thus \<open>[\<lambda>x \<exists>F (\<phi>{F} & \<not>x[F])]\<down>\<close>
+    by (safe intro!: "kirchner-thm:2"[THEN "\<equiv>E"(2)])
+qed
+
+text\<open>Derived variants of the comprehension principles above.\<close>
+
+AOT_theorem Comprehension_1':
+  shows \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> [\<lambda>x \<forall>F (x[F] \<rightarrow> \<phi>{F})]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+  AOT_hence 0: \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<not>\<phi>{F} \<equiv> \<not>\<phi>{G}))\<close>
+    by (AOT_subst (reverse) \<open>\<not>\<phi>{F} \<equiv> \<not>\<phi>{G}\<close> \<open>\<phi>{F} \<equiv> \<phi>{G}\<close> for: F G)
+       (auto simp: "oth-class-taut:4:b")
+  AOT_show \<open>[\<lambda>x \<forall>F (x[F] \<rightarrow> \<phi>{F})]\<down>\<close>
+  proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x \<not>\<exists>F(\<not>\<phi>{F} & x[F])]\<down>\<close>
+      using Comprehension_1[THEN "\<rightarrow>E", OF 0, THEN negation_denotes[THEN "\<rightarrow>E"]].
+  next
+    AOT_show \<open>\<box>\<forall>x (\<not>\<exists>F (\<not>\<phi>{F} & x[F]) \<equiv> \<forall>F (x[F] \<rightarrow> \<phi>{F}))\<close>
+      by (AOT_subst (reverse) \<open>\<not>\<phi>{F} & x[F]\<close> \<open>\<not>(x[F] \<rightarrow> \<phi>{F})\<close> for: F x)
+         (auto simp: "oth-class-taut:1:b"[THEN "intro-elim:3:e",
+                                          OF "oth-class-taut:2:a"]
+             intro: "intro-elim:3:f"[OF "cqt-further:3", OF "oth-class-taut:3:a",
+                                     symmetric]
+             intro!: RN GEN)
+  qed
+qed
+
+AOT_theorem Comprehension_2':
+  shows \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> [\<lambda>x \<forall>F (\<phi>{F} \<rightarrow> x[F])]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+  AOT_show \<open>[\<lambda>x \<forall>F (\<phi>{F} \<rightarrow> x[F])]\<down>\<close>
+  proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x \<not>\<exists>F(\<phi>{F} & \<not>x[F])]\<down>\<close>
+      using Comprehension_2[THEN "\<rightarrow>E", OF 0, THEN negation_denotes[THEN "\<rightarrow>E"]].
+  next
+    AOT_show \<open>\<box>\<forall>x (\<not>\<exists>F (\<phi>{F} & \<not>x[F]) \<equiv> \<forall>F (\<phi>{F} \<rightarrow> x[F]))\<close>
+      by (AOT_subst (reverse) \<open>\<phi>{F} & \<not>x[F]\<close> \<open>\<not>(\<phi>{F} \<rightarrow> x[F])\<close> for: F x)
+         (auto simp: "oth-class-taut:1:b"
+             intro: "intro-elim:3:f"[OF "cqt-further:3", OF "oth-class-taut:3:a",
+                                     symmetric]
+             intro!: RN GEN)
+  qed
+qed
+
+text\<open>Derive a combined comprehension principles.\<close>
+
+AOT_theorem Comprehension_3:
+  \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> [\<lambda>x \<forall>F (x[F] \<equiv> \<phi>{F})]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<box>\<forall>F\<forall>G(\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<phi>{F} \<equiv> \<phi>{G}))\<close>
+  AOT_show \<open>[\<lambda>x \<forall>F (x[F] \<equiv> \<phi>{F})]\<down>\<close>
+  proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x \<forall>F (x[F] \<rightarrow> \<phi>{F}) & \<forall>F (\<phi>{F} \<rightarrow> x[F])]\<down>\<close>
+      by (safe intro!: conjunction_denotes[THEN "\<rightarrow>E", OF "&I"]
+                       Comprehension_1'[THEN "\<rightarrow>E"]
+                       Comprehension_2'[THEN "\<rightarrow>E"] 0)
+  next
+    AOT_show \<open>\<box>\<forall>x (\<forall>F (x[F] \<rightarrow> \<phi>{F}) & \<forall>F (\<phi>{F} \<rightarrow> x[F]) \<equiv> \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+      by (auto intro!: RN GEN "\<equiv>I" "\<rightarrow>I" "&I" dest: "&E" "\<forall>E"(2) "\<rightarrow>E" "\<equiv>E"(1,2))
+  qed
+qed
+
+notepad
+begin
+text\<open>Verify that the original axioms are equivalent to @{thm denotes_ex}
+     and @{thm denotes_ex_neg}.\<close>
+AOT_modally_strict {
+  fix x y H
+  AOT_have \<open>A!x & A!y & \<forall>F \<box>([F]x \<equiv> [F]y) \<rightarrow>
+  (\<forall>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [H]z)) \<rightarrow> x[G]) \<equiv>
+   \<forall>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [H]z)) \<rightarrow> y[G]))\<close>
+  proof(rule "\<rightarrow>I")
+    {
+      fix x y
+      AOT_assume \<open>A!x\<close>
+      AOT_assume \<open>A!y\<close>
+      AOT_assume indist: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      AOT_assume \<open>\<forall>G (\<forall>u \<box>([G]u \<equiv> [H]u) \<rightarrow> x[G])\<close>
+      AOT_hence \<open>\<forall>G (\<box>\<forall>u ([G]u \<equiv> [H]u) \<rightarrow> x[G])\<close>
+        using "Ordinary.res-var-bound-reas[BF]" "Ordinary.res-var-bound-reas[CBF]"
+              "intro-elim:2"
+        by (AOT_subst \<open>\<box>\<forall>u ([G]u \<equiv> [H]u)\<close> \<open>\<forall>u \<box>([G]u \<equiv> [H]u)\<close> for: G) auto
+      AOT_hence \<open>\<forall>G (\<box>G \<equiv>\<^sub>E H \<rightarrow> x[G])\<close>
+        by (AOT_subst \<open>G \<equiv>\<^sub>E H\<close> \<open>\<forall>u ([G]u \<equiv> [H]u)\<close> for: G)
+            (safe intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+      AOT_hence \<open>\<not>\<exists>G (\<box>G \<equiv>\<^sub>E H & \<not>x[G])\<close>
+        by (AOT_subst (reverse) \<open>(\<box>G \<equiv>\<^sub>E H & \<not>x[G])\<close> \<open>\<not>(\<box>G \<equiv>\<^sub>E H \<rightarrow> x[G])\<close> for: G)
+           (auto simp: "oth-class-taut:1:b" "cqt-further:3"[THEN "\<equiv>E"(1)])
+      AOT_hence \<open>\<not>[\<lambda>x \<exists>G (\<box>G \<equiv>\<^sub>E H & \<not>x[G])]x\<close>
+        by (auto intro: "\<beta>\<rightarrow>C")
+      AOT_hence \<open>\<not>[\<lambda>x \<exists>G (\<box>G \<equiv>\<^sub>E H & \<not>x[G])]y\<close>
+        using indist[THEN "\<forall>E"(1), OF denotes_ex_neg,
+                     THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+                     THEN "\<equiv>E"(3)] by blast
+      AOT_hence \<open>\<not>\<exists>G (\<box>G \<equiv>\<^sub>E H & \<not>y[G])\<close>
+        by (safe intro!: "\<beta>\<leftarrow>C" denotes_ex_neg "cqt:2")
+      AOT_hence \<open>\<forall>G \<not>(\<box>G \<equiv>\<^sub>E H & \<not>y[G])\<close>
+        using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<forall>G(\<box>G \<equiv>\<^sub>E H \<rightarrow> y[G])\<close>
+        by (AOT_subst \<open>\<box>G \<equiv>\<^sub>E H \<rightarrow> y[G]\<close> \<open>\<not>(\<box>G \<equiv>\<^sub>E H & \<not>y[G])\<close> for: G)
+           (auto simp: "oth-class-taut:1:a")
+      AOT_hence \<open>\<forall>G (\<box>\<forall>u([G]u \<equiv> [H]u) \<rightarrow> y[G])\<close>
+        by (AOT_subst (reverse) \<open>\<forall>u ([G]u \<equiv> [H]u)\<close> \<open>G \<equiv>\<^sub>E H\<close> for: G)
+           (safe intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2") 
+      AOT_hence \<open>\<forall>G (\<forall>u \<box>([G]u \<equiv> [H]u) \<rightarrow> y[G])\<close>
+        using "Ordinary.res-var-bound-reas[BF]" "Ordinary.res-var-bound-reas[CBF]"
+              "intro-elim:2"
+        by (AOT_subst \<open>\<forall>u \<box>([G]u \<equiv> [H]u)\<close> \<open>\<box>\<forall>u ([G]u \<equiv> [H]u)\<close> for: G) auto
+    } note 0 = this
+    AOT_assume \<open>A!x & A!y & \<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+    AOT_hence \<open>A!x\<close> and \<open>A!y\<close> and \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      using "&E" by blast+
+    moreover AOT_have \<open>\<forall>F \<box>([F]y \<equiv> [F]x)\<close>
+      using calculation(3)
+      apply (safe intro!: CBF[THEN "\<rightarrow>E"] dest!: BF[THEN "\<rightarrow>E"])
+      using "RM:3" "cqt-basic:11" "intro-elim:3:b" by fast
+    ultimately AOT_show \<open>\<forall>G (\<forall>u \<box>([G]u \<equiv> [H]u) \<rightarrow> x[G]) \<equiv>
+                         \<forall>G (\<forall>u \<box>([G]u \<equiv> [H]u) \<rightarrow> y[G])\<close>
+      using 0 by (auto intro!: "\<equiv>I" "\<rightarrow>I")
+  qed
+  
+  AOT_have \<open>A!x & A!y & \<forall>F \<box>([F]x \<equiv> [F]y) \<rightarrow>
+  (\<exists>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [H]z)) & x[G]) \<equiv> \<exists>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [H]z)) & y[G]))\<close>
+  proof(rule "\<rightarrow>I")
+    {
+      fix x y
+      AOT_assume \<open>A!x\<close>
+      AOT_assume \<open>A!y\<close>
+      AOT_assume indist: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      AOT_assume x_prop: \<open>\<exists>G (\<forall>u \<box>([G]u \<equiv> [H]u) & x[G])\<close>
+      AOT_hence \<open>\<exists>G (\<box>\<forall>u ([G]u \<equiv> [H]u) & x[G])\<close>
+        using "Ordinary.res-var-bound-reas[BF]" "Ordinary.res-var-bound-reas[CBF]"
+              "intro-elim:2"
+        by (AOT_subst \<open>\<box>\<forall>u ([G]u \<equiv> [H]u)\<close> \<open>\<forall>u \<box>([G]u \<equiv> [H]u)\<close> for: G) auto
+      AOT_hence \<open>\<exists>G (\<box>G \<equiv>\<^sub>E H & x[G])\<close>
+        by (AOT_subst \<open>G \<equiv>\<^sub>E H\<close> \<open>\<forall>u ([G]u \<equiv> [H]u)\<close> for: G)
+           (safe intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2") 
+      AOT_hence \<open>[\<lambda>x \<exists>G (\<box>G \<equiv>\<^sub>E H & x[G])]x\<close>
+        by (safe intro!: "\<beta>\<leftarrow>C" denotes_ex "cqt:2")
+      AOT_hence \<open>[\<lambda>x \<exists>G (\<box>G \<equiv>\<^sub>E H & x[G])]y\<close>
+        using indist[THEN "\<forall>E"(1), OF denotes_ex,
+                     THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+                     THEN "\<equiv>E"(1)] by blast
+      AOT_hence \<open>\<exists>G (\<box>G \<equiv>\<^sub>E H & y[G])\<close>
+        by (rule "\<beta>\<rightarrow>C")
+      AOT_hence \<open>\<exists>G (\<box>\<forall>u ([G]u \<equiv> [H]u) & y[G])\<close>
+        by (AOT_subst (reverse) \<open>\<forall>u ([G]u \<equiv> [H]u)\<close> \<open>G \<equiv>\<^sub>E H\<close> for: G)
+           (safe intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2") 
+      AOT_hence \<open>\<exists>G (\<forall>u \<box>([G]u \<equiv> [H]u) & y[G])\<close>
+        using "Ordinary.res-var-bound-reas[BF]"
+              "Ordinary.res-var-bound-reas[CBF]"
+              "intro-elim:2"
+        by (AOT_subst \<open>\<forall>u \<box>([G]u \<equiv> [H]u)\<close> \<open>\<box>\<forall>u ([G]u \<equiv> [H]u)\<close> for: G) auto 
+    } note 0 = this
+    AOT_assume \<open>A!x & A!y & \<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+    AOT_hence \<open>A!x\<close> and \<open>A!y\<close> and \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      using "&E" by blast+
+    moreover AOT_have \<open>\<forall>F \<box>([F]y \<equiv> [F]x)\<close>
+      using calculation(3)
+      apply (safe intro!: CBF[THEN "\<rightarrow>E"] dest!: BF[THEN "\<rightarrow>E"])
+      using "RM:3" "cqt-basic:11" "intro-elim:3:b" by fast
+    ultimately AOT_show \<open>\<exists>G (\<forall>u \<box>([G]u \<equiv> [H]u) & x[G]) \<equiv>
+                         \<exists>G (\<forall>u \<box>([G]u \<equiv> [H]u) & y[G])\<close>
+      using 0 by (auto intro!: "\<equiv>I" "\<rightarrow>I")
+  qed
+}
+end
+end
\ No newline at end of file
diff --git a/thys/AOT/AOT_NaturalNumbers.thy b/thys/AOT/AOT_NaturalNumbers.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_NaturalNumbers.thy
@@ -0,0 +1,5508 @@
+(*<*)
+theory AOT_NaturalNumbers
+  imports AOT_PossibleWorlds AOT_ExtendedRelationComprehension
+  abbrevs one-to-one = \<open>\<^sub>1\<^sub>-\<^sub>1\<close>
+      and onto = \<open>\<^sub>o\<^sub>n\<^sub>t\<^sub>o\<close>
+begin
+(*>*)
+
+section\<open>Natural Numbers\<close>
+ 
+AOT_define CorrelatesOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> _\<close>)
+  "1-1-cor": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> &
+                                   \<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy)) &
+                                   \<forall>y ([G]y \<rightarrow> \<exists>!x([F]x & [R]xy))\<close>
+
+AOT_define MapsTo :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<longrightarrow> _\<close>)
+  "fFG:1": \<open>R |: F \<longrightarrow> G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> & \<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy))\<close>
+
+AOT_define MapsToOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> _\<close>)
+  "fFG:2": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G \<equiv>\<^sub>d\<^sub>f
+      R |: F \<longrightarrow> G & \<forall>x\<forall>y\<forall>z (([F]x & [F]y & [G]z) \<rightarrow> ([R]xz & [R]yz \<rightarrow> x = y))\<close>
+
+AOT_define MapsOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o _\<close>)
+  "fFG:3": \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G \<equiv>\<^sub>d\<^sub>f R |: F \<longrightarrow> G & \<forall>y ([G]y \<rightarrow> \<exists>x([F]x & [R]xy))\<close>
+
+AOT_define MapsOneToOneOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o _\<close>)
+  "fFG:4": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G \<equiv>\<^sub>d\<^sub>f R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
+
+AOT_theorem "eq-1-1": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G \<equiv> R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G\<close>
+  AOT_hence A: \<open>\<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy))\<close>
+        and B: \<open>\<forall>y ([G]y \<rightarrow> \<exists>!x([F]x & [R]xy))\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "1-1-cor"] "&E" by blast+
+  AOT_have C: \<open>R |: F \<longrightarrow> G\<close>
+  proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:1"]; rule "&I")
+    AOT_show \<open>R\<down> & F\<down> & G\<down>\<close>
+      using "cqt:2[const_var]"[axiom_inst] "&I" by metis
+  next
+    AOT_show \<open>\<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy))\<close> by (rule A)
+  qed
+  AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
+  proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:4"]; rule "&I")
+    AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G\<close>
+    proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:2"]; rule "&I")
+      AOT_show \<open>R |: F \<longrightarrow> G\<close> using C.
+    next
+      AOT_show \<open>\<forall>x\<forall>y\<forall>z ([F]x & [F]y & [G]z \<rightarrow> ([R]xz & [R]yz \<rightarrow> x = y))\<close>
+      proof(rule GEN; rule GEN; rule GEN; rule "\<rightarrow>I"; rule "\<rightarrow>I")
+        fix x y z
+        AOT_assume 1: \<open>[F]x & [F]y & [G]z\<close>
+        moreover AOT_assume 2: \<open>[R]xz & [R]yz\<close>
+        ultimately AOT_have 3: \<open>\<exists>!x ([F]x & [R]xz)\<close>
+          using B "&E" "\<forall>E" "\<rightarrow>E" by fast
+        AOT_show \<open>x = y\<close>
+          by (rule "uni-most"[THEN "\<rightarrow>E", OF 3, THEN "\<forall>E"(2)[where \<beta>=x],
+                              THEN "\<forall>E"(2)[where \<beta>=y], THEN "\<rightarrow>E"])
+             (metis "&I" "&E" 1 2)
+      qed
+    qed
+  next
+    AOT_show \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
+    proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:3"]; rule "&I")
+      AOT_show \<open>R |: F \<longrightarrow> G\<close> using C.
+    next
+      AOT_show \<open>\<forall>y ([G]y \<rightarrow> \<exists>x ([F]x & [R]xy))\<close>
+      proof(rule GEN; rule "\<rightarrow>I")
+        fix y
+        AOT_assume \<open>[G]y\<close>
+        AOT_hence \<open>\<exists>!x ([F]x & [R]xy)\<close>
+          using B[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+        AOT_hence \<open>\<exists>x ([F]x & [R]xy & \<forall>\<beta> (([F]\<beta> & [R]\<beta>y) \<rightarrow> \<beta> = x))\<close>
+          using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+        then AOT_obtain x where \<open>[F]x & [R]xy\<close>
+          using "\<exists>E"[rotated] "&E" by blast
+        AOT_thus \<open>\<exists>x ([F]x & [R]xy)\<close> by (rule "\<exists>I")
+      qed
+    qed
+  qed
+next
+  AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
+  AOT_hence \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G\<close> and \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:4"] "&E" by blast+
+  AOT_hence C: \<open>R |: F \<longrightarrow> G\<close>
+    and D: \<open>\<forall>x\<forall>y\<forall>z ([F]x & [F]y & [G]z \<rightarrow> ([R]xz & [R]yz \<rightarrow> x = y))\<close>
+    and E: \<open>\<forall>y ([G]y \<rightarrow> \<exists>x ([F]x & [R]xy))\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:2"] "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:3"] "&E" by blast+
+  AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G\<close>
+  proof(rule "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; safe intro!: "&I" "cqt:2[const_var]"[axiom_inst])
+    AOT_show \<open>\<forall>x ([F]x \<rightarrow> \<exists>!y ([G]y & [R]xy))\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:1", OF C] "&E" by blast
+  next
+    AOT_show \<open>\<forall>y ([G]y \<rightarrow> \<exists>!x ([F]x & [R]xy))\<close>
+    proof (rule "GEN"; rule "\<rightarrow>I")
+      fix y
+      AOT_assume 0: \<open>[G]y\<close>
+      AOT_hence \<open>\<exists>x ([F]x & [R]xy)\<close>
+        using E "\<forall>E" "\<rightarrow>E" by fast
+      then AOT_obtain a where a_prop: \<open>[F]a & [R]ay\<close>
+        using "\<exists>E"[rotated] by blast
+      moreover AOT_have \<open>\<forall>z ([F]z & [R]zy \<rightarrow> z = a)\<close>
+      proof (rule GEN; rule "\<rightarrow>I")
+        fix z
+        AOT_assume \<open>[F]z & [R]zy\<close>
+        AOT_thus \<open>z = a\<close>
+          using D[THEN "\<forall>E"(2)[where \<beta>=z], THEN "\<forall>E"(2)[where \<beta>=a],
+                  THEN "\<forall>E"(2)[where \<beta>=y], THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+                a_prop 0 "&E" "&I" by metis
+      qed
+      ultimately AOT_have \<open>\<exists>x ([F]x & [R]xy & \<forall>z ([F]z & [R]zy \<rightarrow> z = x))\<close>
+        using "&I" "\<exists>I"(2) by fast
+      AOT_thus \<open>\<exists>!x ([F]x & [R]xy)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by fast
+    qed
+  qed
+qed
+
+text\<open>We have already introduced the restricted type of Ordinary objects in the
+     Extended Relation Comprehension theory. However, make sure all variable names
+     are defined as expected (avoiding conflicts with situations
+     of possible world theory).\<close>
+AOT_register_variable_names
+  Ordinary: u v r t s
+
+AOT_theorem "equi:1": \<open>\<exists>!u \<phi>{u} \<equiv> \<exists>u (\<phi>{u} & \<forall>v (\<phi>{v} \<rightarrow> v =\<^sub>E u))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>!u \<phi>{u}\<close>
+  AOT_hence \<open>\<exists>!x (O!x & \<phi>{x})\<close>.
+  AOT_hence \<open>\<exists>x (O!x & \<phi>{x} & \<forall>\<beta> (O!\<beta> & \<phi>{\<beta>} \<rightarrow> \<beta> = x))\<close>
+    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain x where x_prop: \<open>O!x & \<phi>{x} & \<forall>\<beta> (O!\<beta> & \<phi>{\<beta>} \<rightarrow> \<beta> = x)\<close>
+    using "\<exists>E"[rotated] by blast
+  {
+    fix \<beta>
+    AOT_assume beta_ord: \<open>O!\<beta>\<close>
+    moreover AOT_assume \<open>\<phi>{\<beta>}\<close>
+    ultimately AOT_have \<open>\<beta> = x\<close>
+      using x_prop[THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=\<beta>]] "&I" "\<rightarrow>E" by blast
+    AOT_hence \<open>\<beta> =\<^sub>E x\<close>
+      using "ord-=E=:1"[THEN "\<rightarrow>E", OF "\<or>I"(1)[OF beta_ord],
+                        THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+                        THEN "\<equiv>E"(1)]
+      by blast
+  }
+  AOT_hence \<open>(O!\<beta> \<rightarrow> (\<phi>{\<beta>} \<rightarrow> \<beta> =\<^sub>E x))\<close> for \<beta>
+    using "\<rightarrow>I" by blast
+  AOT_hence \<open>\<forall>\<beta>(O!\<beta> \<rightarrow> (\<phi>{\<beta>} \<rightarrow> \<beta> =\<^sub>E x))\<close>
+    by (rule GEN)
+  AOT_hence \<open>O!x & \<phi>{x} & \<forall>y (O!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>E x))\<close>
+    using x_prop[THEN "&E"(1)] "&I" by blast
+  AOT_hence \<open>O!x & (\<phi>{x} & \<forall>y (O!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>E x)))\<close>
+    using "&E" "&I" by meson
+  AOT_thus \<open>\<exists>u (\<phi>{u} & \<forall>v (\<phi>{v} \<rightarrow> v =\<^sub>E u))\<close>
+    using "\<exists>I" by fast
+next
+  AOT_assume \<open>\<exists>u (\<phi>{u} & \<forall>v (\<phi>{v} \<rightarrow> v =\<^sub>E u))\<close>
+  AOT_hence \<open>\<exists>x (O!x & (\<phi>{x} & \<forall>y (O!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>E x))))\<close>
+    by blast
+  then AOT_obtain x where x_prop: \<open>O!x & (\<phi>{x} & \<forall>y (O!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>E x)))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<open>\<forall>y ([O!]y & \<phi>{y} \<rightarrow> y = x)\<close>
+  proof(rule GEN; rule "\<rightarrow>I")
+    fix y
+    AOT_assume \<open>O!y & \<phi>{y}\<close>
+    AOT_hence \<open>y =\<^sub>E x\<close>
+      using x_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=y]]
+            "\<rightarrow>E" "&E" by blast
+    AOT_thus \<open>y = x\<close>
+      using "ord-=E=:1"[THEN "\<rightarrow>E", OF "\<or>I"(2)[OF x_prop[THEN "&E"(1)]],
+                        THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<equiv>E"(2)] by blast
+  qed
+  AOT_hence \<open>[O!]x & \<phi>{x} & \<forall>y ([O!]y & \<phi>{y} \<rightarrow> y = x)\<close>
+    using x_prop "&E" "&I" by meson
+  AOT_hence \<open>\<exists>x ([O!]x & \<phi>{x} & \<forall>y ([O!]y & \<phi>{y} \<rightarrow> y = x))\<close>
+    by (rule "\<exists>I")
+  AOT_hence \<open>\<exists>!x (O!x & \<phi>{x})\<close>
+    by (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_thus \<open>\<exists>!u \<phi>{u}\<close>.
+qed
+
+AOT_define CorrelatesEOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E _\<close>)
+  "equi:2": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> &
+                               \<forall>u ([F]u \<rightarrow> \<exists>!v([G]v & [R]uv)) &
+                               \<forall>v ([G]v \<rightarrow> \<exists>!u([F]u & [R]uv))\<close>
+
+AOT_define EquinumerousE :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "\<approx>\<^sub>E" 50)
+  "equi:3": \<open>F \<approx>\<^sub>E G \<equiv>\<^sub>d\<^sub>f \<exists>R (R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G)\<close>
+
+text\<open>Note: not explicitly in PLM.\<close>
+AOT_theorem eq_den_1: \<open>\<Pi>\<down>\<close> if \<open>\<Pi> \<approx>\<^sub>E \<Pi>'\<close>
+proof -
+  AOT_have \<open>\<exists>R (R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E \<Pi>')\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] that by blast
+  then AOT_obtain R where \<open>R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E \<Pi>'\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>\<Pi>\<down>\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+qed
+
+text\<open>Note: not explicitly in PLM.\<close>
+AOT_theorem eq_den_2: \<open>\<Pi>'\<down>\<close> if \<open>\<Pi> \<approx>\<^sub>E \<Pi>'\<close>
+proof -
+  AOT_have \<open>\<exists>R (R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E \<Pi>')\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] that by blast
+  then AOT_obtain R where \<open>R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E \<Pi>'\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>\<Pi>'\<down>\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+qed
+
+AOT_theorem "eq-part:1": \<open>F \<approx>\<^sub>E F\<close>
+proof (safe intro!: "&I" GEN "\<rightarrow>I" "cqt:2[const_var]"[axiom_inst]
+                    "\<equiv>\<^sub>d\<^sub>fI"[OF "equi:3"] "\<equiv>\<^sub>d\<^sub>fI"[OF "equi:2"] "\<exists>I"(1))
+  fix x
+  AOT_assume 1: \<open>O!x\<close>
+  AOT_assume 2: \<open>[F]x\<close>
+  AOT_show \<open>\<exists>!v ([F]v & x =\<^sub>E v)\<close>
+  proof(rule "equi:1"[THEN "\<equiv>E"(2)];
+        rule "\<exists>I"(2)[where \<beta>=x];
+        safe dest!: "&E"(2)
+             intro!:  "&I" "\<rightarrow>I" 1 2 Ordinary.GEN "ord=Eequiv:1"[THEN "\<rightarrow>E", OF 1])
+    AOT_show \<open>v =\<^sub>E x\<close> if \<open>x =\<^sub>E v\<close> for v
+      by (metis that "ord=Eequiv:2"[THEN "\<rightarrow>E"])
+  qed
+next
+  fix y
+  AOT_assume 1: \<open>O!y\<close>
+  AOT_assume 2: \<open>[F]y\<close>
+  AOT_show \<open>\<exists>!u ([F]u & u =\<^sub>E y)\<close>
+    by(safe dest!: "&E"(2)
+            intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=y]
+                    "&I" "\<rightarrow>I" 1 2 GEN "ord=Eequiv:1"[THEN "\<rightarrow>E", OF 1])
+qed(auto simp: "=E[denotes]")
+
+
+AOT_theorem "eq-part:2": \<open>F \<approx>\<^sub>E G \<rightarrow> G \<approx>\<^sub>E F\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>F \<approx>\<^sub>E G\<close>
+  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain R where \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence 0: \<open>R\<down> & F\<down> & G\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v([G]v & [R]uv)) &
+                            \<forall>v ([G]v \<rightarrow> \<exists>!u([F]u & [R]uv))\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+
+  AOT_have \<open>[\<lambda>xy [R]yx]\<down> & G\<down> & F\<down> & \<forall>u ([G]u \<rightarrow> \<exists>!v([F]v & [\<lambda>xy [R]yx]uv)) &
+                            \<forall>v ([F]v \<rightarrow> \<exists>!u([G]u & [\<lambda>xy [R]yx]uv))\<close>
+  proof (AOT_subst \<open>[\<lambda>xy [R]yx]yx\<close> \<open>[R]xy\<close> for: x y;
+        (safe intro!: "&I" "cqt:2[const_var]"[axiom_inst] 0[THEN "&E"(2)]
+                      0[THEN "&E"(1), THEN "&E"(2)]; "cqt:2[lambda]")?)
+    AOT_modally_strict {
+      AOT_have \<open>[\<lambda>xy [R]yx]xy\<close> if \<open>[R]yx\<close> for y x
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
+                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" that)
+      moreover AOT_have \<open>[R]yx\<close> if \<open>[\<lambda>xy [R]yx]xy\<close> for y x
+        using "\<beta>\<rightarrow>C"(1)[where \<phi>="\<lambda>(x,y). _ (x,y)" and \<kappa>\<^sub>1\<kappa>\<^sub>n="(_,_)",
+                        simplified, OF that, simplified].
+      ultimately AOT_show \<open>[\<lambda>xy [R]yx]\<alpha>\<beta> \<equiv> [R]\<beta>\<alpha>\<close> for \<alpha> \<beta>
+        by (metis "deduction-theorem" "\<equiv>I")
+    }
+  qed
+  AOT_hence \<open>[\<lambda>xy [R]yx] |: G \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E F\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+  AOT_hence \<open>\<exists>R R |: G \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E F\<close>
+    by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  AOT_thus \<open>G \<approx>\<^sub>E F\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+text\<open>Note: not explicitly in PLM.\<close>
+AOT_theorem "eq-part:2[terms]": \<open>\<Pi> \<approx>\<^sub>E \<Pi>' \<rightarrow> \<Pi>' \<approx>\<^sub>E \<Pi>\<close>
+  using "eq-part:2"[unvarify F G] eq_den_1 eq_den_2 "\<rightarrow>I" by meson
+declare "eq-part:2[terms]"[THEN "\<rightarrow>E", sym]
+
+AOT_theorem "eq-part:3": \<open>(F \<approx>\<^sub>E G & G \<approx>\<^sub>E H) \<rightarrow> F \<approx>\<^sub>E H\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>F \<approx>\<^sub>E G & G \<approx>\<^sub>E H\<close>
+  then AOT_obtain R\<^sub>1 and R\<^sub>2 where
+       \<open>R\<^sub>1 |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+   and \<open>R\<^sub>2 |: G \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E H\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<exists>E"[rotated] by metis
+  AOT_hence \<theta>: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v([G]v & [R\<^sub>1]uv)) & \<forall>v ([G]v \<rightarrow> \<exists>!u([F]u & [R\<^sub>1]uv))\<close>
+        and \<xi>: \<open>\<forall>u ([G]u \<rightarrow> \<exists>!v([H]v & [R\<^sub>2]uv)) & \<forall>v ([H]v \<rightarrow> \<exists>!u([G]u & [R\<^sub>2]uv))\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
+          "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1), THEN "&E"(2)]
+          "&I" by blast+
+  AOT_have \<open>\<exists>R R = [\<lambda>xy O!x & O!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]\<close>
+    by (rule "free-thms:3[lambda]") cqt_2_lambda_inst_prover
+  then AOT_obtain R where R_def: \<open>R = [\<lambda>xy O!x & O!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have 1: \<open>\<exists>!v (([H]v & [R]uv))\<close> if a: \<open>[O!]u\<close> and b: \<open>[F]u\<close> for u
+  proof (rule "\<equiv>E"(2)[OF "equi:1"])
+    AOT_obtain b where
+      b_prop: \<open>[O!]b & ([G]b & [R\<^sub>1]ub & \<forall>v ([G]v & [R\<^sub>1]uv \<rightarrow> v =\<^sub>E b))\<close>
+      using \<theta>[THEN "&E"(1), THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E",
+              OF a b, THEN "\<equiv>E"(1)[OF "equi:1"]]
+            "\<exists>E"[rotated] by blast
+    AOT_obtain c where
+      c_prop: "[O!]c & ([H]c & [R\<^sub>2]bc & \<forall>v ([H]v & [R\<^sub>2]bv \<rightarrow> v =\<^sub>E c))"
+      using \<xi>[THEN "&E"(1), THEN "\<forall>E"(2)[where \<beta>=b], THEN "\<rightarrow>E",
+              OF b_prop[THEN "&E"(1)], THEN "\<rightarrow>E",
+              OF b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)],
+              THEN "\<equiv>E"(1)[OF "equi:1"]]
+    "\<exists>E"[rotated] by blast
+    AOT_show \<open>\<exists>v ([H]v & [R]uv & \<forall>v' ([H]v' & [R]uv' \<rightarrow> v' =\<^sub>E v))\<close>
+    proof (safe intro!: "&I" GEN "\<rightarrow>I" "\<exists>I"(2)[where \<beta>=c])
+      AOT_show \<open>O!c\<close> using c_prop "&E" by blast
+    next
+      AOT_show \<open>[H]c\<close> using c_prop "&E" by blast
+    next
+      AOT_have 0: \<open>[O!]u & [O!]c & \<exists>v ([G]v & [R\<^sub>1]uv & [R\<^sub>2]vc)\<close>
+        by (safe intro!: "&I" a c_prop[THEN "&E"(1)] "\<exists>I"(2)[where \<beta>=b]
+                         b_prop[THEN "&E"(1)] b_prop[THEN "&E"(2), THEN "&E"(1)]
+                         c_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)])
+      AOT_show \<open>[R]uc\<close>
+        by (auto intro: "rule=E"[rotated, OF R_def[symmetric]]
+                 intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
+                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" 0)
+    next
+      fix x
+      AOT_assume ordx: \<open>O!x\<close>
+      AOT_assume \<open>[H]x & [R]ux\<close>
+      AOT_hence hx: \<open>[H]x\<close> and \<open>[R]ux\<close> using "&E" by blast+
+      AOT_hence \<open>[\<lambda>xy O!x & O!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]ux\<close>
+        using "rule=E"[rotated, OF R_def] by fast
+      AOT_hence \<open>O!u & O!x & \<exists>v ([G]v & [R\<^sub>1]uv & [R\<^sub>2]vx)\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)[where \<phi>="\<lambda>(\<kappa>,\<kappa>'). _ \<kappa> \<kappa>'" and \<kappa>\<^sub>1\<kappa>\<^sub>n="(_,_)", simplified])
+      then AOT_obtain z where z_prop: \<open>O!z & ([G]z & [R\<^sub>1]uz & [R\<^sub>2]zx)\<close>
+        using "&E" "\<exists>E"[rotated] by blast
+      AOT_hence \<open>z =\<^sub>E b\<close>
+        using b_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=z]]
+        using "&E" "\<rightarrow>E" by metis
+      AOT_hence \<open>z = b\<close>
+        by (metis "=E-simple:2"[THEN "\<rightarrow>E"])
+      AOT_hence \<open>[R\<^sub>2]bx\<close>
+        using z_prop[THEN "&E"(2), THEN "&E"(2)] "rule=E" by fast
+      AOT_thus \<open>x =\<^sub>E c\<close>
+        using c_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=x],
+                     THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF ordx]
+              hx "&I" by blast
+    qed
+  qed
+  AOT_have 2: \<open>\<exists>!u (([F]u & [R]uv))\<close> if a: \<open>[O!]v\<close> and b: \<open>[H]v\<close> for v
+  proof (rule "\<equiv>E"(2)[OF "equi:1"])
+    AOT_obtain b where
+      b_prop: \<open>[O!]b & ([G]b & [R\<^sub>2]bv & \<forall>u ([G]u & [R\<^sub>2]uv \<rightarrow> u =\<^sub>E b))\<close>
+      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E",
+              OF a b, THEN "\<equiv>E"(1)[OF "equi:1"]]
+            "\<exists>E"[rotated] by blast
+    AOT_obtain c where
+      c_prop: "[O!]c & ([F]c & [R\<^sub>1]cb & \<forall>v ([F]v & [R\<^sub>1]vb \<rightarrow> v =\<^sub>E c))"
+      using \<theta>[THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=b], THEN "\<rightarrow>E",
+              OF b_prop[THEN "&E"(1)], THEN "\<rightarrow>E",
+              OF b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)],
+              THEN "\<equiv>E"(1)[OF "equi:1"]]
+    "\<exists>E"[rotated] by blast
+    AOT_show \<open>\<exists>u ([F]u & [R]uv & \<forall>v' ([F]v' & [R]v'v \<rightarrow> v' =\<^sub>E u))\<close>
+    proof (safe intro!: "&I" GEN "\<rightarrow>I" "\<exists>I"(2)[where \<beta>=c])
+      AOT_show \<open>O!c\<close> using c_prop "&E" by blast
+    next
+      AOT_show \<open>[F]c\<close> using c_prop "&E" by blast
+    next
+      AOT_have \<open>[O!]c & [O!]v & \<exists>u ([G]u & [R\<^sub>1]cu & [R\<^sub>2]uv)\<close>
+        by (safe intro!: "&I" a "\<exists>I"(2)[where \<beta>=b] 
+                     c_prop[THEN "&E"(1)] b_prop[THEN "&E"(1)]
+                     b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
+                     b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
+                     c_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)])
+      AOT_thus \<open>[R]cv\<close>
+        by (auto intro: "rule=E"[rotated, OF R_def[symmetric]]
+                 intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
+                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+    next
+      fix x
+      AOT_assume ordx: \<open>O!x\<close>
+      AOT_assume \<open>[F]x & [R]xv\<close>
+      AOT_hence hx: \<open>[F]x\<close> and \<open>[R]xv\<close> using "&E" by blast+
+      AOT_hence \<open>[\<lambda>xy O!x & O!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]xv\<close>
+        using "rule=E"[rotated, OF R_def] by fast
+      AOT_hence \<open>O!x & O!v & \<exists>u ([G]u & [R\<^sub>1]xu & [R\<^sub>2]uv)\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)[where \<phi>="\<lambda>(\<kappa>,\<kappa>'). _ \<kappa> \<kappa>'" and \<kappa>\<^sub>1\<kappa>\<^sub>n="(_,_)", simplified])
+      then AOT_obtain z where z_prop: \<open>O!z & ([G]z & [R\<^sub>1]xz & [R\<^sub>2]zv)\<close>
+        using "&E" "\<exists>E"[rotated] by blast
+      AOT_hence \<open>z =\<^sub>E b\<close>
+        using b_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=z]]
+        using "&E" "\<rightarrow>E" "&I" by metis
+      AOT_hence \<open>z = b\<close>
+        by (metis "=E-simple:2"[THEN "\<rightarrow>E"])
+      AOT_hence \<open>[R\<^sub>1]xb\<close>
+        using z_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)] "rule=E" by fast
+      AOT_thus \<open>x =\<^sub>E c\<close>
+        using c_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=x],
+                     THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF ordx]
+              hx "&I" by blast
+    qed
+  qed
+  AOT_show \<open>F \<approx>\<^sub>E H\<close>
+    apply (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    apply (rule "\<exists>I"(2)[where \<beta>=R])
+    by (auto intro!: 1 2 "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2[const_var]"[axiom_inst]
+                     Ordinary.GEN "\<rightarrow>I" Ordinary.\<psi>)
+qed
+
+text\<open>Note: not explicitly in PLM.\<close>
+AOT_theorem "eq-part:3[terms]": \<open>\<Pi> \<approx>\<^sub>E \<Pi>''\<close> if \<open>\<Pi> \<approx>\<^sub>E \<Pi>'\<close> and \<open>\<Pi>' \<approx>\<^sub>E \<Pi>''\<close>
+  using "eq-part:3"[unvarify F G H, THEN "\<rightarrow>E"] eq_den_1 eq_den_2 "\<rightarrow>I" "&I"
+  by (metis that(1) that(2))
+declare "eq-part:3[terms]"[trans]
+
+AOT_theorem "eq-part:4": \<open>F \<approx>\<^sub>E G \<equiv> \<forall>H (H \<approx>\<^sub>E F \<equiv> H \<approx>\<^sub>E G)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>F \<approx>\<^sub>E G\<close>
+  AOT_hence 1: \<open>G \<approx>\<^sub>E F\<close> using "eq-part:2"[THEN "\<rightarrow>E"] by blast
+  AOT_show \<open>\<forall>H (H \<approx>\<^sub>E F \<equiv> H \<approx>\<^sub>E G)\<close>
+  proof (rule GEN; rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_show \<open>H \<approx>\<^sub>E G\<close> if \<open>H \<approx>\<^sub>E F\<close> for H using 0
+      by (meson "&I" "eq-part:3" that "vdash-properties:6")
+  next
+    AOT_show \<open>H \<approx>\<^sub>E F\<close> if \<open>H \<approx>\<^sub>E G\<close> for H using 1
+      by (metis "&I" "eq-part:3" that "vdash-properties:6")
+  qed
+next
+  AOT_assume \<open>\<forall>H (H \<approx>\<^sub>E F \<equiv> H \<approx>\<^sub>E G)\<close>
+  AOT_hence \<open>F \<approx>\<^sub>E F \<equiv> F \<approx>\<^sub>E G\<close> using "\<forall>E" by blast
+  AOT_thus \<open>F \<approx>\<^sub>E G\<close> using "eq-part:1" "\<equiv>E" by blast
+qed
+
+AOT_define MapsE :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<longrightarrow>E _")
+  "equi-rem:1":
+  \<open>R |: F \<longrightarrow>E G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+
+AOT_define MapsEOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E _")
+  "equi-rem:2":
+  \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E G \<equiv>\<^sub>d\<^sub>f
+      R |: F \<longrightarrow>E G & \<forall>t\<forall>u\<forall>v (([F]t & [F]u & [G]v) \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>E u))\<close>
+
+AOT_define MapsEOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE _")
+  "equi-rem:3":
+  \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G \<equiv>\<^sub>d\<^sub>f R |: F \<longrightarrow>E G & \<forall>v ([G]v \<rightarrow> \<exists>u ([F]u & [R]uv))\<close>
+
+AOT_define MapsEOneToOneOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE _")
+  "equi-rem:4":
+  \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G \<equiv>\<^sub>d\<^sub>f R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+
+AOT_theorem "equi-rem-thm":
+  \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G \<equiv> R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+proof -
+  AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G \<equiv> R |: [\<lambda>x O!x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x O!x & [G]x]\<close>
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
+    AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    AOT_hence \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+          and \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
+      using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+    AOT_hence a: \<open>([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+          and b: \<open>([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> for u v
+      using "Ordinary.\<forall>E" by fast+
+    AOT_have \<open>([\<lambda>x [O!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]xy))\<close> for x
+      apply (AOT_subst \<open>[\<lambda>x [O!]x & [F]x]x\<close> \<open>[O!]x & [F]x\<close>)
+       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+       apply "cqt:2[lambda]"
+      apply (AOT_subst \<open>[\<lambda>x [O!]x & [G]x]x\<close> \<open>[O!]x & [G]x\<close> for: x)
+       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+       apply "cqt:2[lambda]"
+      apply (AOT_subst \<open>O!y & [G]y & [R]xy\<close> \<open>O!y & ([G]y & [R]xy)\<close> for: y)
+       apply (meson "\<equiv>E"(6) "Associativity of &" "oth-class-taut:3:a")
+      apply (rule "\<rightarrow>I") apply (frule "&E"(1)) apply (drule "&E"(2))
+      by (fact a[unconstrain u, THEN "\<rightarrow>E", THEN "\<rightarrow>E", of x])
+    AOT_hence A: \<open>\<forall>x ([\<lambda>x [O!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]xy))\<close>
+      by (rule GEN)
+    AOT_have \<open>([\<lambda>x [O!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xy))\<close> for y
+      apply (AOT_subst \<open>[\<lambda>x [O!]x & [G]x]y\<close> \<open>[O!]y & [G]y\<close>)
+       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+       apply "cqt:2[lambda]"
+      apply (AOT_subst \<open>[\<lambda>x [O!]x & [F]x]x\<close> \<open>[O!]x & [F]x\<close> for: x)
+       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+       apply "cqt:2[lambda]"
+      apply (AOT_subst \<open>O!x & [F]x & [R]xy\<close> \<open>O!x & ([F]x & [R]xy)\<close> for: x)
+       apply (meson "\<equiv>E"(6) "Associativity of &" "oth-class-taut:3:a")
+      apply (rule "\<rightarrow>I") apply (frule "&E"(1)) apply (drule "&E"(2))
+      by (fact b[unconstrain v, THEN "\<rightarrow>E", THEN "\<rightarrow>E", of y])
+    AOT_hence B: \<open>\<forall>y ([\<lambda>x [O!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xy))\<close>
+      by (rule GEN)
+    AOT_show \<open>R |: [\<lambda>x [O!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [O!]x & [G]x]\<close>
+      by (safe intro!: "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                       "cqt:2[const_var]"[axiom_inst] A B)
+          "cqt:2[lambda]"+
+  next
+    AOT_assume \<open>R |: [\<lambda>x [O!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [O!]x & [G]x]\<close>
+    AOT_hence a: \<open>([\<lambda>x [O!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]xy))\<close> and 
+              b: \<open>([\<lambda>x [O!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xy))\<close> for x y
+      using "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<forall>E"(2) by blast+
+    AOT_have \<open>[F]u \<rightarrow> \<exists>!v ([G]v & [R]uv)\<close> for u
+    proof (safe intro!: "\<rightarrow>I")
+      AOT_assume fu: \<open>[F]u\<close>
+      AOT_have 0: \<open>[\<lambda>x [O!]x & [F]x]u\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
+                         Ordinary.\<psi> fu "&I")
+      AOT_show \<open>\<exists>!v ([G]v & [R]uv)\<close>
+        apply (AOT_subst \<open>[O!]x & ([G]x & [R]ux)\<close>
+                         \<open>([O!]x & [G]x) & [R]ux\<close> for: x)
+         apply (simp add: "Associativity of &")
+        apply (AOT_subst (reverse) \<open>[O!]x & [G]x\<close>
+                                   \<open>[\<lambda>x [O!]x & [G]x]x\<close> for: x)
+         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+         apply "cqt:2[lambda]"
+        using a[THEN "\<rightarrow>E", OF 0] by blast
+    qed
+    AOT_hence A: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+      by (rule Ordinary.GEN)
+    AOT_have \<open>[G]v \<rightarrow> \<exists>!u ([F]u & [R]uv)\<close> for v
+    proof (safe intro!: "\<rightarrow>I")
+      AOT_assume gu: \<open>[G]v\<close>
+      AOT_have 0: \<open>[\<lambda>x [O!]x & [G]x]v\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
+                         Ordinary.\<psi> gu "&I")
+      AOT_show \<open>\<exists>!u ([F]u & [R]uv)\<close>
+        apply (AOT_subst \<open>[O!]x & ([F]x & [R]xv)\<close> \<open>([O!]x & [F]x) & [R]xv\<close> for: x)
+         apply (simp add: "Associativity of &")
+        apply (AOT_subst (reverse) \<open>[O!]x & [F]x\<close>\<open>[\<lambda>x [O!]x & [F]x]x\<close>  for: x)
+         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+         apply "cqt:2[lambda]"
+        using b[THEN "\<rightarrow>E", OF 0] by blast
+    qed
+    AOT_hence B: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> by (rule Ordinary.GEN)
+    AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+      by (safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" A B "cqt:2[const_var]"[axiom_inst])
+  qed
+  also AOT_have \<open>\<dots> \<equiv> R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
+    AOT_assume \<open>R |: [\<lambda>x [O!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [O!]x & [G]x]\<close>
+    AOT_hence a: \<open>([\<lambda>x [O!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]xy))\<close> and 
+              b: \<open>([\<lambda>x [O!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xy))\<close> for x y
+      using "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<forall>E"(2) by blast+
+    AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+    proof (safe intro!: "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "equi-rem:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                        "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "equi-rem:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                        "cqt:2[const_var]"[axiom_inst] Ordinary.GEN "\<rightarrow>I")
+      fix u
+      AOT_assume fu: \<open>[F]u\<close>
+      AOT_have 0: \<open>[\<lambda>x [O!]x & [F]x]u\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
+                         Ordinary.\<psi> fu "&I")
+      AOT_hence 1: \<open>\<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]uy)\<close>
+        using a[THEN "\<rightarrow>E"] by blast
+      AOT_show \<open>\<exists>!v ([G]v & [R]uv)\<close>
+        apply (AOT_subst \<open>[O!]x & ([G]x & [R]ux)\<close> \<open>([O!]x & [G]x) & [R]ux\<close> for: x)
+         apply (simp add: "Associativity of &")
+        apply (AOT_subst (reverse) \<open>[O!]x & [G]x\<close> \<open>[\<lambda>x [O!]x & [G]x]x\<close> for: x)
+         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+         apply "cqt:2[lambda]"
+        by (fact 1)
+    next
+      fix t u v
+      AOT_assume \<open>[F]t & [F]u & [G]v\<close> and rtv_tuv: \<open>[R]tv & [R]uv\<close>
+      AOT_hence oft: \<open>[\<lambda>x O!x & [F]x]t\<close> and
+                ofu: \<open>[\<lambda>x O!x & [F]x]u\<close> and
+                ogv: \<open>[\<lambda>x O!x & [G]x]v\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I"
+                 simp: Ordinary.\<psi> dest: "&E")
+      AOT_hence \<open>\<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xv)\<close>
+        using b[THEN "\<rightarrow>E"] by blast
+      then AOT_obtain a where
+          a_prop: \<open>[\<lambda>x [O!]x & [F]x]a & [R]av &
+                   \<forall>x (([\<lambda>x [O!]x & [F]x]x & [R]xv) \<rightarrow> x = a)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "\<exists>E"[rotated] by blast
+      AOT_hence ua: \<open>u = a\<close>
+        using ofu rtv_tuv[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" "&I" "&E"(2) by blast
+      moreover AOT_have ta: \<open>t = a\<close>
+        using a_prop oft rtv_tuv[THEN "&E"(1)] "\<forall>E"(2) "\<rightarrow>E" "&I" "&E"(2) by blast
+      ultimately AOT_have \<open>t = u\<close> by (metis "rule=E" id_sym)
+      AOT_thus \<open>t =\<^sub>E u\<close>
+        using "rule=E" id_sym "ord=Eequiv:1" Ordinary.\<psi> ta ua "\<rightarrow>E" by fast
+    next
+      fix u
+      AOT_assume \<open>[F]u\<close>
+      AOT_hence \<open>[\<lambda>x O!x & [F]x]u\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I"
+                 simp: "cqt:2[const_var]"[axiom_inst]  Ordinary.\<psi>)
+      AOT_hence \<open>\<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]uy)\<close>
+        using a[THEN "\<rightarrow>E"] by blast
+      then AOT_obtain a where
+        a_prop: \<open>[\<lambda>x [O!]x & [G]x]a & [R]ua &
+                 \<forall>x (([\<lambda>x [O!]x & [G]x]x & [R]ux) \<rightarrow> x = a)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "\<exists>E"[rotated] by blast
+      AOT_have \<open>O!a & [G]a\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: a_prop[THEN "&E"(1), THEN "&E"(1)])
+      AOT_hence \<open>O!a\<close> and \<open>[G]a\<close> using "&E" by blast+
+      moreover AOT_have \<open>\<forall>v ([G]v & [R]uv \<rightarrow> v =\<^sub>E a)\<close>
+      proof(safe intro!: Ordinary.GEN "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+        fix v
+        AOT_assume \<open>[G]v\<close> and ruv: \<open>[R]uv\<close>
+        AOT_hence \<open>[\<lambda>x [O!]x & [G]x]v\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" simp: Ordinary.\<psi>)
+        AOT_hence \<open>v = a\<close>
+          using a_prop[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF "&I"] ruv by blast
+        AOT_thus \<open>v =\<^sub>E a\<close>
+          using "rule=E" "ord=Eequiv:1" Ordinary.\<psi> "\<rightarrow>E" by fast
+      qed
+      ultimately AOT_have \<open>O!a & ([G]a & [R]ua & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>E a))\<close>
+        using "\<exists>I" "&I" a_prop[THEN "&E"(1), THEN "&E"(2)] by simp
+      AOT_hence \<open>\<exists>v ([G]v & [R]uv & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>E v))\<close>
+        by (rule "\<exists>I")
+      AOT_thus \<open>\<exists>!v ([G]v & [R]uv)\<close>
+        by (rule "equi:1"[THEN "\<equiv>E"(2)])
+    next
+      fix v
+      AOT_assume \<open>[G]v\<close>
+      AOT_hence \<open>[\<lambda>x O!x & [G]x]v\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" Ordinary.\<psi>)
+      AOT_hence \<open>\<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xv)\<close>
+        using b[THEN "\<rightarrow>E"] by blast
+      then AOT_obtain a where
+        a_prop: \<open>[\<lambda>x [O!]x & [F]x]a & [R]av &
+                 \<forall>y ([\<lambda>x [O!]x & [F]x]y & [R]yv \<rightarrow> y = a)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "\<exists>E"[rotated]] by blast
+      AOT_have \<open>O!a & [F]a\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: a_prop[THEN "&E"(1), THEN "&E"(1)])
+      AOT_hence \<open>O!a & ([F]a & [R]av)\<close>
+        using a_prop[THEN "&E"(1), THEN "&E"(2)] "&E" "&I" by metis
+      AOT_thus \<open>\<exists>u ([F]u & [R]uv)\<close>
+        by (rule "\<exists>I")
+    qed
+  next
+    AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+    AOT_hence 1: \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E G\<close>
+          and 2: \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+      using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+    AOT_hence 3: \<open>R |: F \<longrightarrow>E G\<close>
+          and A: \<open>\<forall>t \<forall>u \<forall>v ([F]t & [F]u & [G]v \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>E u))\<close>
+      using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 1] "&E" by blast+
+    AOT_hence B: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+      using "equi-rem:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+    AOT_have C: \<open>\<forall>v ([G]v \<rightarrow> \<exists>u ([F]u & [R]uv))\<close>
+      using "equi-rem:3"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 2] "&E" by blast
+    AOT_show \<open>R |: [\<lambda>x [O!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [O!]x & [G]x]\<close>
+    proof (rule "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fI"];
+           safe intro!: "&I" "cqt:2" GEN "\<rightarrow>I")
+      fix x
+      AOT_assume 1: \<open>[\<lambda>x [O!]x & [F]x]x\<close>
+      AOT_have \<open>O!x & [F]x\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1)
+      AOT_hence \<open>\<exists>!v ([G]v & [R]xv)\<close>
+        using B[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&E" by blast
+      then AOT_obtain y where
+        y_prop: \<open>O!y & ([G]y & [R]xy & \<forall>u ([G]u & [R]xu \<rightarrow> u =\<^sub>E y))\<close>
+        using "equi:1"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by fastforce
+      AOT_hence \<open>[\<lambda>x O!x & [G]x]y\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" dest: "&E")
+      moreover AOT_have \<open>\<forall>z ([\<lambda>x O!x & [G]x]z & [R]xz \<rightarrow> z = y)\<close>
+      proof(safe intro!: GEN "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+        fix z
+        AOT_assume 1: \<open>[\<lambda>x [O!]x & [G]x]z\<close>
+        AOT_have 2: \<open>O!z & [G]z\<close>
+          by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1)
+        moreover AOT_assume \<open>[R]xz\<close>
+        ultimately AOT_have \<open>z =\<^sub>E y\<close>
+          using y_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2),
+                       THEN "\<rightarrow>E", THEN "\<rightarrow>E", rotated, OF "&I"] "&E"
+          by blast
+        AOT_thus \<open>z = y\<close>
+          using 2[THEN "&E"(1)] by (metis "=E-simple:2" "\<rightarrow>E")
+      qed
+      ultimately AOT_have \<open>[\<lambda>x O!x & [G]x]y & [R]xy &
+                           \<forall>z ([\<lambda>x O!x & [G]x]z & [R]xz \<rightarrow> z = y)\<close>
+        using y_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)] "&I" by auto
+      AOT_hence \<open>\<exists>y ([\<lambda>x O!x & [G]x]y & [R]xy &
+                    \<forall>z ([\<lambda>x O!x & [G]x]z & [R]xz \<rightarrow> z = y))\<close>
+        by (rule "\<exists>I")
+      AOT_thus \<open>\<exists>!y ([\<lambda>x [O!]x & [G]x]y & [R]xy)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by fast
+    next
+      fix y
+      AOT_assume 1: \<open>[\<lambda>x [O!]x & [G]x]y\<close>
+      AOT_have oy_gy: \<open>O!y & [G]y\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1)
+      AOT_hence \<open>\<exists>u ([F]u & [R]uy)\<close>
+        using C[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&E" by blast
+      then AOT_obtain x where x_prop: \<open>O!x & ([F]x & [R]xy)\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence ofx: \<open>[\<lambda>x O!x & [F]x]x\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" dest: "&E")
+      AOT_have \<open>\<exists>\<alpha> ([\<lambda>x [O!]x & [F]x]\<alpha> & [R]\<alpha>y &
+                    \<forall>\<beta> ([\<lambda>x [O!]x & [F]x]\<beta> & [R]\<beta>y \<rightarrow> \<beta> = \<alpha>))\<close>
+      proof (safe intro!: "\<exists>I"(2)[where \<beta>=x] "&I" GEN "\<rightarrow>I")
+        AOT_show \<open>[\<lambda>x O!x & [F]x]x\<close> using ofx.
+      next
+        AOT_show \<open>[R]xy\<close> using x_prop[THEN "&E"(2), THEN "&E"(2)].
+      next
+        fix z
+        AOT_assume 1: \<open>[\<lambda>x [O!]x & [F]x]z & [R]zy\<close>
+        AOT_have oz_fz: \<open>O!z & [F]z\<close>
+          by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1[THEN "&E"(1)])
+        AOT_have \<open>z =\<^sub>E x\<close>
+          using A[THEN "\<forall>E"(2)[where \<beta>=z], THEN "\<rightarrow>E", THEN "\<forall>E"(2)[where \<beta>=x],
+                  THEN "\<rightarrow>E", THEN "\<forall>E"(2)[where \<beta>=y], THEN "\<rightarrow>E",
+                  THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF oz_fz[THEN "&E"(1)],
+                  OF x_prop[THEN "&E"(1)], OF oy_gy[THEN "&E"(1)], OF "&I", OF "&I",
+                  OF oz_fz[THEN "&E"(2)], OF x_prop[THEN "&E"(2), THEN "&E"(1)],
+                  OF oy_gy[THEN "&E"(2)], OF "&I", OF 1[THEN "&E"(2)],
+                  OF x_prop[THEN "&E"(2), THEN "&E"(2)]].
+        AOT_thus \<open>z = x\<close>
+          by (metis "=E-simple:2" "vdash-properties:10")
+      qed
+      AOT_thus \<open>\<exists>!x ([\<lambda>x [O!]x & [F]x]x & [R]xy)\<close>
+        by (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    qed
+  qed
+  finally show ?thesis.
+qed
+
+AOT_theorem "empty-approx:1": \<open>(\<not>\<exists>u [F]u & \<not>\<exists>v [H]v) \<rightarrow> F \<approx>\<^sub>E H\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>\<not>\<exists>u [F]u\<close> and 1: \<open>\<not>\<exists>v [H]v\<close>
+  AOT_have \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([H]v & [R]uv))\<close> for R
+  proof(rule Ordinary.GEN; rule "\<rightarrow>I"; rule "raa-cor:1")
+    fix u
+    AOT_assume \<open>[F]u\<close>
+    AOT_hence \<open>\<exists>u [F]u\<close> using "Ordinary.\<exists>I" "&I" by fast
+    AOT_thus \<open>\<exists>u [F]u & \<not>\<exists>u [F]u\<close> using "&I" 0 by blast
+  qed
+  moreover AOT_have \<open>\<forall>v ([H]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> for R
+  proof(rule Ordinary.GEN; rule "\<rightarrow>I"; rule "raa-cor:1")
+    fix v
+    AOT_assume \<open>[H]v\<close>
+    AOT_hence \<open>\<exists>v [H]v\<close> using "Ordinary.\<exists>I" "&I" by fast
+    AOT_thus \<open>\<exists>v [H]v & \<not>\<exists>v [H]v\<close> using 1 "&I" by blast
+  qed
+  ultimately AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E H\<close> for R
+    apply (safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" GEN "cqt:2[const_var]"[axiom_inst])
+    using "\<forall>E" by blast+
+  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E H\<close> by (rule "\<exists>I")
+  AOT_thus \<open>F \<approx>\<^sub>E H\<close>
+    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+qed
+
+AOT_theorem "empty-approx:2": \<open>(\<exists>u [F]u & \<not>\<exists>v [H]v) \<rightarrow> \<not>(F \<approx>\<^sub>E H)\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:2")
+  AOT_assume 1: \<open>\<exists>u [F]u\<close> and 2: \<open>\<not>\<exists>v [H]v\<close>
+  AOT_obtain b where b_prop: \<open>O!b & [F]b\<close>
+    using 1 "\<exists>E"[rotated] by blast
+  AOT_assume \<open>F \<approx>\<^sub>E H\<close>
+  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E H\<close>
+    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  then AOT_obtain R where \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E H\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<theta>: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([H]v & [R]uv))\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>\<exists>!v ([H]v & [R]bv)\<close> for u
+    using \<theta>[THEN "\<forall>E"(2)[where \<beta>=b], THEN "\<rightarrow>E", THEN "\<rightarrow>E",
+            OF b_prop[THEN "&E"(1)], OF b_prop[THEN "&E"(2)]].
+  AOT_hence \<open>\<exists>v ([H]v & [R]bv & \<forall>u ([H]u & [R]bu \<rightarrow> u =\<^sub>E v))\<close>
+    by (rule "equi:1"[THEN "\<equiv>E"(1)])
+  then AOT_obtain x where \<open>O!x & ([H]x & [R]bx & \<forall>u ([H]u & [R]bu \<rightarrow> u =\<^sub>E x))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>O!x & [H]x\<close> using "&E" "&I" by blast
+  AOT_hence \<open>\<exists>v [H]v\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>v [H]v & \<not>\<exists>v [H]v\<close> using 2 "&I" by blast
+qed
+
+
+AOT_define FminusU :: \<open>\<Pi> \<Rightarrow> \<tau> \<Rightarrow> \<Pi>\<close> ("_\<^sup>-\<^sup>_")
+  "F-u": \<open>[F]\<^sup>-\<^sup>x =\<^sub>d\<^sub>f [\<lambda>z [F]z & z \<noteq>\<^sub>E x]\<close>
+
+text\<open>Note: not explicitly in PLM.\<close>
+AOT_theorem "F-u[den]": \<open>[F]\<^sup>-\<^sup>x\<down>\<close>
+  by (rule "=\<^sub>d\<^sub>fI"(1)[OF "F-u", where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]; "cqt:2[lambda]")
+AOT_theorem "F-u[equiv]": \<open>[[F]\<^sup>-\<^sup>x]y \<equiv> ([F]y & y \<noteq>\<^sub>E x)\<close>
+  by (auto intro: "F-u"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
+           intro!: "cqt:2" "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)])
+
+AOT_theorem eqP': \<open>F \<approx>\<^sub>E G & [F]u & [G]v \<rightarrow> [F]\<^sup>-\<^sup>u \<approx>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(2); drule "&E"(1); frule "&E"(2); drule "&E"(1))
+  AOT_assume \<open>F \<approx>\<^sub>E G\<close>
+  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain R where R_prop: \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence A: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+        and B: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+    using "equi-rem-thm"[THEN "\<equiv>E"(1), OF R_prop].
+  AOT_hence \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+    using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence C: \<open>\<forall>t\<forall>u\<forall>v (([F]t & [F]u & [G]v) \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>E u))\<close>
+    using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_assume fu: \<open>[F]u\<close>
+  AOT_assume gv: \<open>[G]v\<close>
+  AOT_have \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>E \<kappa>]\<down>\<close> for \<Pi> \<kappa>
+    by "cqt:2[lambda]"
+  note \<Pi>_minus_\<kappa>I = "rule-id-df:2:b[2]"[
+      where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u", simplified, OF this]
+   and \<Pi>_minus_\<kappa>E = "rule-id-df:2:a[2]"[
+      where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u", simplified, OF this]
+  AOT_have \<Pi>_minus_\<kappa>_den: \<open>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<down>\<close> for \<Pi> \<kappa>
+    by (rule \<Pi>_minus_\<kappa>I) "cqt:2[lambda]"+
+  {
+    fix R
+    AOT_assume R_prop: \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    AOT_hence A: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+          and B: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
+      using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+    AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+      using "equi-rem-thm"[THEN "\<equiv>E"(1), OF R_prop].
+    AOT_hence \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+      using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+    AOT_hence C: \<open>\<forall>t\<forall>u\<forall>v (([F]t & [F]u & [G]v) \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>E u))\<close>
+      using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+
+    AOT_assume Ruv: \<open>[R]uv\<close>
+    AOT_have \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+    proof(safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2[const_var]"[axiom_inst]
+                       \<Pi>_minus_\<kappa>_den Ordinary.GEN "\<rightarrow>I")
+      fix u'
+      AOT_assume \<open>[[F]\<^sup>-\<^sup>u]u'\<close>
+      AOT_hence 0: \<open>[\<lambda>z [F]z & z \<noteq>\<^sub>E u]u'\<close>
+        using \<Pi>_minus_\<kappa>E by fast
+      AOT_have 0: \<open>[F]u' & u' \<noteq>\<^sub>E u\<close>
+        by (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Ordinary.Rep u')"]) (fact 0)
+      AOT_have \<open>\<exists>!v ([G]v & [R]u'v)\<close>
+        using A[THEN "Ordinary.\<forall>E"[where \<alpha>=u'], THEN "\<rightarrow>E", OF 0[THEN "&E"(1)]].
+      then AOT_obtain v' where
+        v'_prop: \<open>[G]v' & [R]u'v' & \<forall> t ([G]t & [R]u't \<rightarrow> t =\<^sub>E v')\<close>
+        using "equi:1"[THEN "\<equiv>E"(1)] "Ordinary.\<exists>E"[rotated] by fastforce
+
+      AOT_show \<open>\<exists>!v' ([[G]\<^sup>-\<^sup>v]v' & [R]u'v')\<close>
+      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Ordinary.\<exists>I"[where \<beta>=v']
+                          "&I" Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[[G]\<^sup>-\<^sup>v]v'\<close>
+        proof (rule \<Pi>_minus_\<kappa>I; 
+               safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" "thm-neg=E"[THEN "\<equiv>E"(2)])
+          AOT_show \<open>[G]v'\<close> using v'_prop "&E" by blast
+        next
+          AOT_show \<open>\<not>v' =\<^sub>E v\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>v' =\<^sub>E v\<close>
+            AOT_hence \<open>v' = v\<close> by (metis "=E-simple:2" "\<rightarrow>E")
+            AOT_hence Ruv': \<open>[R]uv'\<close> using "rule=E" Ruv id_sym by fast
+            AOT_have \<open>u' =\<^sub>E u\<close>
+              by (rule C[THEN "Ordinary.\<forall>E", THEN "Ordinary.\<forall>E",
+                         THEN "Ordinary.\<forall>E"[where \<alpha>=v'], THEN "\<rightarrow>E", THEN "\<rightarrow>E"])
+                 (safe intro!: "&I" 0[THEN "&E"(1)] fu
+                               v'_prop[THEN "&E"(1), THEN "&E"(1)]
+                               Ruv' v'_prop[THEN "&E"(1), THEN "&E"(2)])
+            moreover AOT_have \<open>\<not>(u' =\<^sub>E u)\<close>
+              using "0" "&E"(2) "\<equiv>E"(1) "thm-neg=E" by blast
+            ultimately AOT_show \<open>u' =\<^sub>E u & \<not>u' =\<^sub>E u\<close> using "&I" by blast
+          qed
+        qed
+      next
+        AOT_show \<open>[R]u'v'\<close> using v'_prop "&E" by blast
+      next
+        fix t
+        AOT_assume t_prop: \<open>[[G]\<^sup>-\<^sup>v]t & [R]u't\<close>
+        AOT_have gt_t_noteq_v: \<open>[G]t & t \<noteq>\<^sub>E v\<close>
+          apply (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Ordinary.Rep t)"])
+          apply (rule \<Pi>_minus_\<kappa>E)
+          by (fact t_prop[THEN "&E"(1)])
+        AOT_show \<open>t =\<^sub>E v'\<close>
+          using v'_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E",
+                        OF "&I", OF gt_t_noteq_v[THEN "&E"(1)],
+                        OF t_prop[THEN "&E"(2)]].
+      qed
+    next
+      fix v'
+      AOT_assume G_minus_v_v': \<open>[[G]\<^sup>-\<^sup>v]v'\<close>
+      AOT_have gt_t_noteq_v: \<open>[G]v' & v' \<noteq>\<^sub>E v\<close>
+        apply (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Ordinary.Rep v')"])
+        apply (rule \<Pi>_minus_\<kappa>E)
+        by (fact G_minus_v_v')
+      AOT_have \<open>\<exists>!u([F]u & [R]uv')\<close>
+        using B[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF gt_t_noteq_v[THEN "&E"(1)]].
+      then AOT_obtain u' where
+        u'_prop: \<open>[F]u' & [R]u'v' & \<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>E u')\<close>
+        using "equi:1"[THEN "\<equiv>E"(1)] "Ordinary.\<exists>E"[rotated] by fastforce
+      AOT_show \<open>\<exists>!u' ([[F]\<^sup>-\<^sup>u]u' & [R]u'v')\<close>
+      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Ordinary.\<exists>I"[where \<beta>=u'] "&I"
+                          u'_prop[THEN "&E"(1), THEN "&E"(2)] Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[[F]\<^sup>-\<^sup>u]u'\<close>
+        proof (rule \<Pi>_minus_\<kappa>I;
+               safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" "thm-neg=E"[THEN "\<equiv>E"(2)]
+               u'_prop[THEN "&E"(1), THEN "&E"(1)]; rule "raa-cor:2")
+          AOT_assume u'_eq_u: \<open>u' =\<^sub>E u\<close>
+          AOT_hence \<open>u' = u\<close>
+            using "=E-simple:2" "vdash-properties:10" by blast
+          AOT_hence Ru'v: \<open>[R]u'v\<close> using "rule=E" Ruv id_sym by fast
+          AOT_have \<open>v' \<noteq>\<^sub>E v\<close>
+            using "&E"(2) gt_t_noteq_v by blast
+          AOT_hence v'_noteq_v: \<open>\<not>(v' =\<^sub>E v)\<close> by (metis "\<equiv>E"(1) "thm-neg=E")
+          AOT_have \<open>\<exists>u ([G]u & [R]u'u & \<forall>v ([G]v & [R]u'v \<rightarrow> v =\<^sub>E u))\<close>
+            using A[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E",
+                    OF u'_prop[THEN "&E"(1), THEN "&E"(1)],
+                    THEN "equi:1"[THEN "\<equiv>E"(1)]].
+          then AOT_obtain t where
+            t_prop: \<open>[G]t & [R]u't & \<forall>v ([G]v & [R]u'v \<rightarrow> v =\<^sub>E t)\<close>
+            using "Ordinary.\<exists>E"[rotated] by meson
+          AOT_have \<open>v =\<^sub>E t\<close> if \<open>[G]v\<close> and \<open>[R]u'v\<close> for v
+            using t_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E",
+                         OF "&I", OF that].
+          AOT_hence \<open>v' =\<^sub>E t\<close> and \<open>v =\<^sub>E t\<close>
+            by (auto simp: gt_t_noteq_v[THEN "&E"(1)] Ru'v gv
+                           u'_prop[THEN "&E"(1), THEN "&E"(2)])
+          AOT_hence \<open>v' =\<^sub>E v\<close>
+            using "rule=E" "=E-simple:2" id_sym "\<rightarrow>E" by fast
+          AOT_thus \<open>v' =\<^sub>E v & \<not>v' =\<^sub>E v\<close>
+            using v'_noteq_v "&I" by blast
+        qed
+      next
+        fix t
+        AOT_assume 0: \<open>[[F]\<^sup>-\<^sup>u]t & [R]tv'\<close>
+        moreover AOT_have \<open>[F]t & t \<noteq>\<^sub>E u\<close>
+          apply (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Ordinary.Rep t)"])
+          apply (rule \<Pi>_minus_\<kappa>E)
+          by (fact 0[THEN "&E"(1)])
+        ultimately AOT_show \<open>t =\<^sub>E u'\<close>
+          using u'_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF "&I"]
+                "&E" by blast
+      qed
+    qed
+    AOT_hence \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+      by (rule "\<exists>I")
+  } note 1 = this
+  moreover {
+    AOT_assume not_Ruv: \<open>\<not>[R]uv\<close>
+    AOT_have \<open>\<exists>!v ([G]v & [R]uv)\<close>
+      using A[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF fu].
+    then AOT_obtain b where
+      b_prop: \<open>O!b & ([G]b & [R]ub & \<forall>t([G]t & [R]ut \<rightarrow> t =\<^sub>E b))\<close>
+      using "equi:1"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by fastforce
+    AOT_hence ob: \<open>O!b\<close> and gb: \<open>[G]b\<close> and Rub: \<open>[R]ub\<close>
+      using "&E" by blast+
+    AOT_have \<open>O!t \<rightarrow> ([G]t & [R]ut \<rightarrow> t =\<^sub>E b)\<close> for t
+      using b_prop "&E"(2) "\<forall>E"(2) by blast
+    AOT_hence b_unique: \<open>t =\<^sub>E b\<close> if \<open>O!t\<close> and \<open>[G]t\<close> and \<open>[R]ut\<close> for t
+      by (metis Adjunction "modus-tollens:1" "reductio-aa:1" that)
+    AOT_have not_v_eq_b: \<open>\<not>(v =\<^sub>E b)\<close>
+    proof(rule "raa-cor:2")
+      AOT_assume \<open>v =\<^sub>E b\<close>
+      AOT_hence 0: \<open>v = b\<close>
+        by (metis "=E-simple:2" "\<rightarrow>E")
+      AOT_have \<open>[R]uv\<close>
+        using b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
+              "rule=E"[rotated, OF 0[symmetric]] by fast
+      AOT_thus \<open>[R]uv & \<not>[R]uv\<close>
+        using not_Ruv "&I" by blast
+    qed
+    AOT_have not_b_eq_v: \<open>\<not>(b =\<^sub>E v)\<close>
+      using "modus-tollens:1" not_v_eq_b "ord=Eequiv:2" by blast
+    AOT_have \<open>\<exists>!u ([F]u & [R]uv)\<close>
+      using B[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF gv].
+    then AOT_obtain a where
+      a_prop: \<open>O!a & ([F]a & [R]av & \<forall>t([F]t & [R]tv \<rightarrow> t =\<^sub>E a))\<close>
+      using "equi:1"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by fastforce
+    AOT_hence Oa: \<open>O!a\<close> and fa: \<open>[F]a\<close> and Rav: \<open>[R]av\<close>
+      using "&E" by blast+
+    AOT_have \<open>O!t \<rightarrow> ([F]t & [R]tv \<rightarrow> t =\<^sub>E a)\<close> for t
+      using a_prop "&E" "\<forall>E"(2) by blast
+    AOT_hence a_unique: \<open>t =\<^sub>E a\<close> if \<open>O!t\<close> and \<open>[F]t\<close> and \<open>[R]tv\<close> for t
+      by (metis Adjunction "modus-tollens:1" "reductio-aa:1" that) 
+    AOT_have not_u_eq_a: \<open>\<not>(u =\<^sub>E a)\<close>
+    proof(rule "raa-cor:2")
+      AOT_assume \<open>u =\<^sub>E a\<close>
+      AOT_hence 0: \<open>u = a\<close>
+        by (metis "=E-simple:2" "\<rightarrow>E")
+      AOT_have \<open>[R]uv\<close>
+        using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
+              "rule=E"[rotated, OF 0[symmetric]] by fast
+      AOT_thus \<open>[R]uv & \<not>[R]uv\<close>
+        using not_Ruv "&I" by blast
+    qed
+    AOT_have not_a_eq_u: \<open>\<not>(a =\<^sub>E u)\<close>
+      using "modus-tollens:1" not_u_eq_a "ord=Eequiv:2" by blast
+    let ?R = \<open>\<guillemotleft>[\<lambda>u'v' (u' \<noteq>\<^sub>E u & v' \<noteq>\<^sub>E v & [R]u'v') \<or>
+                      (u' =\<^sub>E a & v' =\<^sub>E b) \<or>
+                      (u' =\<^sub>E u & v' =\<^sub>E v)]\<guillemotright>\<close>
+    AOT_have \<open>[\<guillemotleft>?R\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+    AOT_hence \<open>\<exists> \<beta> \<beta> = [\<guillemotleft>?R\<guillemotright>]\<close>
+      using "free-thms:1" "\<equiv>E"(1) by fast
+    then AOT_obtain R\<^sub>1 where R\<^sub>1_def: \<open>R\<^sub>1 = [\<guillemotleft>?R\<guillemotright>]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_have Rxy1: \<open>[R]xy\<close> if \<open>[R\<^sub>1]xy\<close> and \<open>x \<noteq>\<^sub>E u\<close> and \<open>x \<noteq>\<^sub>E a\<close> for x y
+    proof -
+      AOT_have 0: \<open>[\<guillemotleft>?R\<guillemotright>]xy\<close>
+        by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact that(1))
+      AOT_have \<open>(x \<noteq>\<^sub>E u & y \<noteq>\<^sub>E v & [R]xy) \<or> (x =\<^sub>E a & y =\<^sub>E b) \<or> (x =\<^sub>E u & y =\<^sub>E v)\<close>
+        using "\<beta>\<rightarrow>C"(1)[OF 0] by simp
+      AOT_hence \<open>x \<noteq>\<^sub>E u & y \<noteq>\<^sub>E v & [R]xy\<close> using that(2,3)
+        by (metis "\<or>E"(3) "Conjunction Simplification"(1) "\<equiv>E"(1)
+                  "modus-tollens:1" "thm-neg=E")
+      AOT_thus \<open>[R]xy\<close> using "&E" by blast+
+    qed
+    AOT_have Rxy2: \<open>[R]xy\<close>  if \<open>[R\<^sub>1]xy\<close> and \<open>y \<noteq>\<^sub>E v\<close> and \<open>y \<noteq>\<^sub>E b\<close> for x y
+    proof -
+      AOT_have 0: \<open>[\<guillemotleft>?R\<guillemotright>]xy\<close>
+        by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact that(1))
+      AOT_have \<open>(x \<noteq>\<^sub>E u & y \<noteq>\<^sub>E v & [R]xy) \<or> (x =\<^sub>E a & y =\<^sub>E b) \<or> (x =\<^sub>E u & y =\<^sub>E v)\<close>
+        using "\<beta>\<rightarrow>C"(1)[OF 0] by simp
+      AOT_hence \<open>x \<noteq>\<^sub>E u & y \<noteq>\<^sub>E v & [R]xy\<close>
+        using that(2,3)
+        by (metis "\<or>E"(3) "Conjunction Simplification"(2) "\<equiv>E"(1)
+                  "modus-tollens:1" "thm-neg=E")
+      AOT_thus \<open>[R]xy\<close> using "&E" by blast+
+    qed
+    AOT_have R\<^sub>1xy: \<open>[R\<^sub>1]xy\<close> if \<open>[R]xy\<close> and \<open>x \<noteq>\<^sub>E u\<close> and \<open>y \<noteq>\<^sub>E v\<close> for x y
+      by (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+         (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
+                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" that "\<or>I"(1))
+    AOT_have R\<^sub>1ab: \<open>[R\<^sub>1]ab\<close>
+      apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+      apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I")
+      by (meson a_prop b_prop "&I" "&E"(1) "\<or>I"(1) "\<or>I"(2) "ord=Eequiv:1" "\<rightarrow>E")
+    AOT_have R\<^sub>1uv: \<open>[R\<^sub>1]uv\<close>
+      apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+      apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I")
+      by (meson "&I" "\<or>I"(2) "ord=Eequiv:1" Ordinary.\<psi> "\<rightarrow>E")
+    moreover AOT_have \<open>R\<^sub>1 |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+    proof (safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN "\<rightarrow>I")
+      fix u'
+      AOT_assume fu': \<open>[F]u'\<close>
+      {
+        AOT_assume not_u'_eq_u: \<open>\<not>(u' =\<^sub>E u)\<close> and not_u'_eq_a: \<open>\<not>(u' =\<^sub>E a)\<close>
+        AOT_hence u'_noteq_u: \<open>u' \<noteq>\<^sub>E u\<close> and u'_noteq_a: \<open>u' \<noteq>\<^sub>E a\<close>
+          by (metis "\<equiv>E"(2) "thm-neg=E")+
+        AOT_have \<open>\<exists>!v ([G]v & [R]u'v)\<close>
+          using A[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF fu'].
+        AOT_hence \<open>\<exists>v ([G]v & [R]u'v & \<forall>t ([G]t & [R]u't \<rightarrow> t =\<^sub>E v))\<close>
+          using "equi:1"[THEN "\<equiv>E"(1)] by simp
+        then AOT_obtain v' where
+          v'_prop: \<open>[G]v' & [R]u'v' & \<forall>t ([G]t & [R]u't \<rightarrow> t =\<^sub>E v')\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        AOT_hence gv': \<open>[G]v'\<close> and Ru'v': \<open>[R]u'v'\<close>
+          using "&E" by blast+
+        AOT_have not_v'_eq_v: \<open>\<not>v' =\<^sub>E v\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>v' =\<^sub>E v\<close>
+          AOT_hence \<open>v' = v\<close>
+            by (metis "=E-simple:2" "\<rightarrow>E")
+          AOT_hence Ru'v: \<open>[R]u'v\<close>
+            using "rule=E" Ru'v' by fast
+          AOT_have \<open>u' =\<^sub>E a\<close>
+            using a_unique[OF Ordinary.\<psi>, OF fu', OF Ru'v].
+          AOT_thus \<open>u' =\<^sub>E a & \<not>u' =\<^sub>E a\<close>
+            using not_u'_eq_a "&I" by blast
+        qed
+        AOT_hence v'_noteq_v: \<open>v' \<noteq>\<^sub>E v\<close>
+          using "\<equiv>E"(2) "thm-neg=E" by blast
+        AOT_have \<open>\<forall>t ([G]t & [R]u't \<rightarrow> t =\<^sub>E v')\<close>
+          using v'_prop "&E" by blast
+        AOT_hence \<open>[G]t & [R]u't \<rightarrow> t =\<^sub>E v'\<close> for t
+          using "Ordinary.\<forall>E" by meson
+        AOT_hence v'_unique: \<open>t =\<^sub>E v'\<close> if \<open>[G]t\<close> and \<open>[R]u't\<close> for t
+          by (metis "&I" that "\<rightarrow>E")
+
+        AOT_have \<open>[G]v' & [R\<^sub>1]u'v' & \<forall>t ([G]t & [R\<^sub>1]u't \<rightarrow> t =\<^sub>E v')\<close>
+        proof (safe intro!: "&I" gv' R\<^sub>1xy Ru'v' u'_noteq_u u'_noteq_a "\<rightarrow>I"
+                            Ordinary.GEN "thm-neg=E"[THEN "\<equiv>E"(2)] not_v'_eq_v)
+          fix t
+          AOT_assume 1: \<open>[G]t & [R\<^sub>1]u't\<close>
+          AOT_have \<open>[R]u't\<close>
+            using Rxy1[OF 1[THEN "&E"(2)], OF u'_noteq_u, OF u'_noteq_a].
+          AOT_thus \<open>t =\<^sub>E v'\<close>
+            using v'_unique 1[THEN "&E"(1)] by blast
+        qed
+        AOT_hence \<open>\<exists>v ([G]v & [R\<^sub>1]u'v & \<forall>t ([G]t & [R\<^sub>1]u't \<rightarrow> t =\<^sub>E v))\<close>
+          by (rule "Ordinary.\<exists>I")
+        AOT_hence \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
+          by (rule "equi:1"[THEN "\<equiv>E"(2)])
+      }
+      moreover {
+        AOT_assume 0: \<open>u' =\<^sub>E u\<close>
+        AOT_hence u'_eq_u: \<open>u' = u\<close>
+          using "=E-simple:2" "\<rightarrow>E" by blast
+        AOT_have \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
+        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Ordinary.\<exists>I"[where \<beta>=v]
+                            "&I" Ordinary.GEN "\<rightarrow>I" gv)
+          AOT_show \<open>[R\<^sub>1]u'v\<close>
+            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI)
+            by (safe intro!: "\<or>I"(2) "&I" 0 "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Ordinary.\<psi>])
+        next
+          fix v'
+          AOT_assume \<open>[G]v' & [R\<^sub>1]u'v'\<close>
+          AOT_hence 0: \<open>[R\<^sub>1]uv'\<close>
+            using "rule=E"[rotated, OF u'_eq_u] "&E"(2) by fast
+          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]uv'\<close>
+            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
+          AOT_have 2: \<open>(u \<noteq>\<^sub>E u & v' \<noteq>\<^sub>E v & [R]uv') \<or>
+                       (u =\<^sub>E a & v' =\<^sub>E b) \<or>
+                       (u =\<^sub>E u & v' =\<^sub>E v)\<close>
+            using "\<beta>\<rightarrow>C"(1)[OF 1] by simp
+          AOT_have \<open>\<not>u \<noteq>\<^sub>E u\<close>
+            using "\<equiv>E"(4) "modus-tollens:1" "ord=Eequiv:1" Ordinary.\<psi>
+                  "reductio-aa:2" "thm-neg=E" by blast
+          AOT_hence \<open>\<not>((u \<noteq>\<^sub>E u & v' \<noteq>\<^sub>E v & [R]uv') \<or> (u =\<^sub>E a & v' =\<^sub>E b))\<close>
+            using not_u_eq_a
+            by (metis "\<or>E"(2) "Conjunction Simplification"(1)
+                      "modus-tollens:1" "reductio-aa:1")
+          AOT_hence \<open>(u =\<^sub>E u & v' =\<^sub>E v)\<close>
+            using 2 by (metis "\<or>E"(2))
+          AOT_thus \<open>v' =\<^sub>E v\<close>
+            using "&E" by blast
+        qed
+      }
+      moreover {
+        AOT_assume 0: \<open>u' =\<^sub>E a\<close>
+        AOT_hence u'_eq_a: \<open>u' = a\<close>
+          using "=E-simple:2" "\<rightarrow>E" by blast
+        AOT_have \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
+        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=b] "&I"
+                            Ordinary.GEN "\<rightarrow>I" b_prop[THEN "&E"(1)]
+                            b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)])
+          AOT_show \<open>[R\<^sub>1]u'b\<close>
+            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI)
+            apply (rule "\<or>I"(1); rule "\<or>I"(2); rule "&I")
+             apply (fact 0)
+            using b_prop "&E"(1) "ord=Eequiv:1" "\<rightarrow>E" by blast
+        next
+          fix v'
+          AOT_assume gv'_R1u'v': \<open>[G]v' & [R\<^sub>1]u'v'\<close>
+          AOT_hence 0: \<open>[R\<^sub>1]av'\<close>
+            using u'_eq_a by (meson "rule=E" "&E"(2))
+          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]av'\<close>
+            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
+          AOT_have \<open>(a \<noteq>\<^sub>E u & v' \<noteq>\<^sub>E v & [R]av') \<or>
+                    (a =\<^sub>E a & v' =\<^sub>E b) \<or>
+                    (a =\<^sub>E u & v' =\<^sub>E v)\<close>
+            using "\<beta>\<rightarrow>C"(1)[OF 1] by simp
+          moreover {
+            AOT_assume 0: \<open>a \<noteq>\<^sub>E u & v' \<noteq>\<^sub>E v & [R]av'\<close>
+            AOT_have \<open>\<exists>!v ([G]v & [R]u'v)\<close>
+              using A[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF fu'].
+            AOT_hence \<open>\<exists>!v ([G]v & [R]av)\<close>
+              using u'_eq_a "rule=E" by fast
+            AOT_hence \<open>\<exists>v ([G]v & [R]av & \<forall>t ([G]t & [R]at \<rightarrow> t =\<^sub>E v))\<close>
+              using "equi:1"[THEN "\<equiv>E"(1)] by fast
+            then AOT_obtain s where
+              s_prop: \<open>[G]s & [R]as & \<forall>t ([G]t & [R]at \<rightarrow> t =\<^sub>E s)\<close>
+              using "Ordinary.\<exists>E"[rotated] by meson
+            AOT_have \<open>v' =\<^sub>E s\<close>
+              using s_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E"]
+                    gv'_R1u'v'[THEN "&E"(1)] 0[THEN "&E"(2)]
+              by (metis "&I" "vdash-properties:10")
+            moreover AOT_have \<open>v =\<^sub>E s\<close>
+              using s_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E"] gv Rav
+              by (metis "&I" "\<rightarrow>E")
+            ultimately AOT_have \<open>v' =\<^sub>E v\<close>
+              by (metis "&I" "ord=Eequiv:2" "ord=Eequiv:3" "\<rightarrow>E")
+            moreover AOT_have \<open>\<not>(v' =\<^sub>E v)\<close>
+              using 0[THEN "&E"(1), THEN "&E"(2)]
+              by (metis "\<equiv>E"(1) "thm-neg=E") 
+            ultimately AOT_have \<open>v' =\<^sub>E b\<close>
+              by (metis "raa-cor:3")
+          }
+          moreover {
+            AOT_assume \<open>a =\<^sub>E u & v' =\<^sub>E v\<close>
+            AOT_hence \<open>v' =\<^sub>E b\<close>
+              by (metis "&E"(1) not_a_eq_u "reductio-aa:1")
+          }
+          ultimately AOT_show \<open>v' =\<^sub>E b\<close>
+            by (metis "&E"(2) "\<or>E"(3) "reductio-aa:1") 
+        qed
+      }
+      ultimately AOT_show \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
+        by (metis "raa-cor:1")
+    next
+      fix v'
+      AOT_assume gv': \<open>[G]v'\<close>
+      {
+        AOT_assume not_v'_eq_v: \<open>\<not>(v' =\<^sub>E v)\<close>
+               and not_v'_eq_b: \<open>\<not>(v' =\<^sub>E b)\<close>
+        AOT_hence v'_noteq_v: \<open>v' \<noteq>\<^sub>E v\<close>
+              and v'_noteq_b: \<open>v' \<noteq>\<^sub>E b\<close>
+          by (metis "\<equiv>E"(2) "thm-neg=E")+
+        AOT_have \<open>\<exists>!u ([F]u & [R]uv')\<close>
+          using B[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF gv'].
+        AOT_hence \<open>\<exists>u ([F]u & [R]uv' & \<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>E u))\<close>
+          using "equi:1"[THEN "\<equiv>E"(1)] by simp
+        then AOT_obtain u' where
+          u'_prop: \<open>[F]u' & [R]u'v' & \<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>E u')\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        AOT_hence fu': \<open>[F]u'\<close> and Ru'v': \<open>[R]u'v'\<close>
+          using "&E" by blast+
+        AOT_have not_u'_eq_u: \<open>\<not>u' =\<^sub>E u\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>u' =\<^sub>E u\<close>
+          AOT_hence \<open>u' = u\<close>
+            by (metis "=E-simple:2" "\<rightarrow>E")
+          AOT_hence Ruv': \<open>[R]uv'\<close>
+            using "rule=E" Ru'v' by fast
+          AOT_have \<open>v' =\<^sub>E b\<close>
+            using b_unique[OF Ordinary.\<psi>, OF gv', OF Ruv'].
+          AOT_thus \<open>v' =\<^sub>E b & \<not>v' =\<^sub>E b\<close>
+            using not_v'_eq_b "&I" by blast
+        qed
+        AOT_hence u'_noteq_u: \<open>u' \<noteq>\<^sub>E u\<close>
+          using "\<equiv>E"(2) "thm-neg=E" by blast
+        AOT_have \<open>\<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>E u')\<close>
+          using u'_prop "&E" by blast
+        AOT_hence \<open>[F]t & [R]tv' \<rightarrow> t =\<^sub>E u'\<close> for t
+          using "Ordinary.\<forall>E" by meson
+        AOT_hence u'_unique: \<open>t =\<^sub>E u'\<close> if \<open>[F]t\<close> and \<open>[R]tv'\<close> for t
+          by (metis "&I" that "\<rightarrow>E")
+
+        AOT_have \<open>[F]u' & [R\<^sub>1]u'v' & \<forall>t ([F]t & [R\<^sub>1]tv' \<rightarrow> t =\<^sub>E u')\<close>
+        proof (safe intro!: "&I" gv' R\<^sub>1xy Ru'v' u'_noteq_u Ordinary.GEN "\<rightarrow>I"
+                            "thm-neg=E"[THEN "\<equiv>E"(2)] not_v'_eq_v fu')
+          fix t
+          AOT_assume 1: \<open>[F]t & [R\<^sub>1]tv'\<close>
+          AOT_have \<open>[R]tv'\<close>
+            using Rxy2[OF 1[THEN "&E"(2)], OF v'_noteq_v, OF v'_noteq_b].
+          AOT_thus \<open>t =\<^sub>E u'\<close>
+            using u'_unique 1[THEN "&E"(1)] by blast
+        qed
+        AOT_hence \<open>\<exists>u ([F]u & [R\<^sub>1]uv' & \<forall>t ([F]t & [R\<^sub>1]tv' \<rightarrow> t =\<^sub>E u))\<close>
+          by (rule "Ordinary.\<exists>I")
+        AOT_hence \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
+          by (rule "equi:1"[THEN "\<equiv>E"(2)])
+      }
+      moreover {
+        AOT_assume 0: \<open>v' =\<^sub>E v\<close>
+        AOT_hence u'_eq_u: \<open>v' = v\<close>
+          using "=E-simple:2" "\<rightarrow>E" by blast
+        AOT_have \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
+        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Ordinary.\<exists>I"[where \<beta>=u]
+                            "&I" Ordinary.GEN "\<rightarrow>I" fu)
+          AOT_show \<open>[R\<^sub>1]uv'\<close>
+            by (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+               (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI Ordinary.\<psi>
+                             "\<or>I"(2) 0 "ord=Eequiv:1"[THEN "\<rightarrow>E"])
+        next
+          fix u'
+          AOT_assume \<open>[F]u' & [R\<^sub>1]u'v'\<close>
+          AOT_hence 0: \<open>[R\<^sub>1]u'v\<close>
+            using "rule=E"[rotated, OF u'_eq_u] "&E"(2) by fast
+          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]u'v\<close>
+            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
+          AOT_have 2: \<open>(u' \<noteq>\<^sub>E u & v \<noteq>\<^sub>E v & [R]u'v) \<or>
+                       (u' =\<^sub>E a & v =\<^sub>E b) \<or>
+                       (u' =\<^sub>E u & v =\<^sub>E v)\<close>
+            using "\<beta>\<rightarrow>C"(1)[OF 1, simplified] by simp
+          AOT_have \<open>\<not>v \<noteq>\<^sub>E v\<close>
+            using "\<equiv>E"(4) "modus-tollens:1" "ord=Eequiv:1" Ordinary.\<psi>
+                  "reductio-aa:2" "thm-neg=E" by blast
+          AOT_hence \<open>\<not>((u' \<noteq>\<^sub>E u & v \<noteq>\<^sub>E v & [R]u'v) \<or> (u' =\<^sub>E a & v =\<^sub>E b))\<close>
+            by (metis "&E"(1) "&E"(2) "\<or>E"(3) not_v_eq_b "raa-cor:3")
+          AOT_hence \<open>(u' =\<^sub>E u & v =\<^sub>E v)\<close>
+            using 2 by (metis "\<or>E"(2))
+          AOT_thus \<open>u' =\<^sub>E u\<close>
+            using "&E" by blast
+        qed
+      }
+      moreover {
+        AOT_assume 0: \<open>v' =\<^sub>E b\<close>
+        AOT_hence v'_eq_b: \<open>v' = b\<close>
+          using "=E-simple:2" "\<rightarrow>E" by blast
+        AOT_have \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
+        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=a] "&I"
+                            Ordinary.GEN "\<rightarrow>I" b_prop[THEN "&E"(1)] Oa fa
+                            b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)])
+          AOT_show \<open>[R\<^sub>1]av'\<close>
+            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
+            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI)
+            apply (rule "\<or>I"(1); rule "\<or>I"(2); rule "&I")
+            using Oa "ord=Eequiv:1" "\<rightarrow>E" apply blast
+            using "0" by blast
+        next
+          fix u'
+          AOT_assume fu'_R1u'v': \<open>[F]u' & [R\<^sub>1]u'v'\<close>
+          AOT_hence 0: \<open>[R\<^sub>1]u'b\<close>
+            using v'_eq_b by (meson "rule=E" "&E"(2))
+          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]u'b\<close>
+            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
+          AOT_have \<open>(u' \<noteq>\<^sub>E u & b \<noteq>\<^sub>E v & [R]u'b) \<or>
+                    (u' =\<^sub>E a & b =\<^sub>E b) \<or>
+                    (u' =\<^sub>E u & b =\<^sub>E v)\<close>
+            using "\<beta>\<rightarrow>C"(1)[OF 1, simplified] by simp
+          moreover {
+            AOT_assume 0: \<open>u' \<noteq>\<^sub>E u & b \<noteq>\<^sub>E v & [R]u'b\<close>
+            AOT_have \<open>\<exists>!u ([F]u & [R]uv')\<close>
+              using B[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF gv'].
+            AOT_hence \<open>\<exists>!u ([F]u & [R]ub)\<close>
+              using v'_eq_b "rule=E" by fast
+            AOT_hence \<open>\<exists>u ([F]u & [R]ub & \<forall>t ([F]t & [R]tb \<rightarrow> t =\<^sub>E u))\<close>
+              using "equi:1"[THEN "\<equiv>E"(1)] by fast
+            then AOT_obtain s where
+              s_prop: \<open>[F]s & [R]sb & \<forall>t ([F]t & [R]tb \<rightarrow> t =\<^sub>E s)\<close>
+              using "Ordinary.\<exists>E"[rotated] by meson
+            AOT_have \<open>u' =\<^sub>E s\<close>
+              using s_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E"]
+                    fu'_R1u'v'[THEN "&E"(1)] 0[THEN "&E"(2)]
+              by (metis "&I" "\<rightarrow>E")
+            moreover AOT_have \<open>u =\<^sub>E s\<close>
+              using s_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E"] fu Rub
+              by (metis "&I" "\<rightarrow>E")
+            ultimately AOT_have \<open>u' =\<^sub>E u\<close>
+              by (metis "&I" "ord=Eequiv:2" "ord=Eequiv:3" "\<rightarrow>E")
+            moreover AOT_have \<open>\<not>(u' =\<^sub>E u)\<close>
+              using 0[THEN "&E"(1), THEN "&E"(1)] by (metis "\<equiv>E"(1) "thm-neg=E") 
+            ultimately AOT_have \<open>u' =\<^sub>E a\<close>
+              by (metis "raa-cor:3")
+          }
+          moreover {
+            AOT_assume \<open>u' =\<^sub>E u & b =\<^sub>E v\<close>
+            AOT_hence \<open>u' =\<^sub>E a\<close>
+              by (metis "&E"(2) not_b_eq_v "reductio-aa:1")
+          }
+          ultimately AOT_show \<open>u' =\<^sub>E a\<close>
+            by (metis "&E"(1) "\<or>E"(3) "reductio-aa:1") 
+        qed
+      }
+      ultimately AOT_show \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
+        by (metis "raa-cor:1")
+    qed
+    ultimately AOT_have \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+      using 1 by blast
+  }
+  ultimately AOT_have \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+    using R_prop by (metis "reductio-aa:2") 
+  AOT_thus \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+qed
+
+
+AOT_theorem "P'-eq": \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>E [G]\<^sup>-\<^sup>v & [F]u & [G]v \<rightarrow> F \<approx>\<^sub>E G\<close>
+proof(safe intro!: "\<rightarrow>I"; frule "&E"(1); drule "&E"(2);
+      frule "&E"(1); drule "&E"(2))
+  AOT_have \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>E \<kappa>]\<down>\<close> for \<Pi> \<kappa> by "cqt:2[lambda]"
+  note \<Pi>_minus_\<kappa>I = "rule-id-df:2:b[2]"[
+      where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u", simplified, OF this]
+   and \<Pi>_minus_\<kappa>E = "rule-id-df:2:a[2]"[
+   where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u", simplified, OF this]
+  AOT_have \<Pi>_minus_\<kappa>_den: \<open>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<down>\<close> for \<Pi> \<kappa>
+    by (rule \<Pi>_minus_\<kappa>I) "cqt:2[lambda]"+
+
+  AOT_have \<Pi>_minus_\<kappa>E1: \<open>[\<Pi>]\<kappa>'\<close>
+       and \<Pi>_minus_\<kappa>E2: \<open>\<kappa>' \<noteq>\<^sub>E \<kappa>\<close> if \<open>[[\<Pi>]\<^sup>-\<^sup>\<kappa>]\<kappa>'\<close> for \<Pi> \<kappa> \<kappa>'
+  proof -
+    AOT_have \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>E \<kappa>]\<kappa>'\<close>
+      using \<Pi>_minus_\<kappa>E that by fast
+    AOT_hence \<open>[\<Pi>]\<kappa>' & \<kappa>' \<noteq>\<^sub>E \<kappa>\<close>
+      by (rule "\<beta>\<rightarrow>C"(1))
+    AOT_thus \<open>[\<Pi>]\<kappa>'\<close> and \<open>\<kappa>' \<noteq>\<^sub>E \<kappa>\<close>
+      using "&E" by blast+
+  qed
+  AOT_have \<Pi>_minus_\<kappa>I': \<open>[[\<Pi>]\<^sup>-\<^sup>\<kappa>]\<kappa>'\<close> if \<open>[\<Pi>]\<kappa>'\<close> and \<open>\<kappa>' \<noteq>\<^sub>E \<kappa>\<close> for \<Pi> \<kappa> \<kappa>'
+  proof -
+    AOT_have \<kappa>'_den: \<open>\<kappa>'\<down>\<close>
+      by (metis "russell-axiom[exe,1].\<psi>_denotes_asm" that(1))
+    AOT_have \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>E \<kappa>]\<kappa>'\<close>
+      by (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" \<kappa>'_den "&I" that)
+    AOT_thus \<open>[[\<Pi>]\<^sup>-\<^sup>\<kappa>]\<kappa>'\<close>
+      using \<Pi>_minus_\<kappa>I by fast
+  qed
+
+  AOT_assume Gv: \<open>[G]v\<close>
+  AOT_assume Fu: \<open>[F]u\<close>
+  AOT_assume \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+  AOT_hence \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain R where R_prop: \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence Fact1: \<open>\<forall>r([[F]\<^sup>-\<^sup>u]r \<rightarrow> \<exists>!s ([[G]\<^sup>-\<^sup>v]s & [R]rs))\<close>
+        and Fact1': \<open>\<forall>s([[G]\<^sup>-\<^sup>v]s \<rightarrow> \<exists>!r ([[F]\<^sup>-\<^sup>u]r & [R]rs))\<close>
+    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE [G]\<^sup>-\<^sup>v\<close>
+    using "equi-rem-thm"[unvarify F G, OF \<Pi>_minus_\<kappa>_den, OF \<Pi>_minus_\<kappa>_den,
+                         THEN "\<equiv>E"(1), OF R_prop].
+  AOT_hence \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>E [G]\<^sup>-\<^sup>v & R |: [F]\<^sup>-\<^sup>u \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE [G]\<^sup>-\<^sup>v\<close>
+    using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence Fact2:
+    \<open>\<forall>r\<forall>s\<forall>t(([[F]\<^sup>-\<^sup>u]r & [[F]\<^sup>-\<^sup>u]s & [[G]\<^sup>-\<^sup>v]t) \<rightarrow> ([R]rt & [R]st \<rightarrow> r =\<^sub>E s))\<close>
+    using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+
+  let ?R = \<open>\<guillemotleft>[\<lambda>xy ([[F]\<^sup>-\<^sup>u]x & [[G]\<^sup>-\<^sup>v]y & [R]xy) \<or> (x =\<^sub>E u & y =\<^sub>E v)]\<guillemotright>\<close>
+  AOT_have R_den: \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close> by "cqt:2[lambda]"
+
+  AOT_show \<open>F \<approx>\<^sub>E G\<close>
+  proof(safe intro!: "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<exists>I"(1)[where \<tau>="?R"] R_den
+                     "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN "\<rightarrow>I")
+    fix r
+    AOT_assume Fr: \<open>[F]r\<close>
+    {
+      AOT_assume not_r_eq_u: \<open>\<not>(r =\<^sub>E u)\<close>
+      AOT_hence r_noteq_u: \<open>r \<noteq>\<^sub>E u\<close>
+        using "\<equiv>E"(2) "thm-neg=E" by blast
+      AOT_have \<open>[[F]\<^sup>-\<^sup>u]r\<close>
+        by(rule \<Pi>_minus_\<kappa>I; safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" Fr r_noteq_u)
+      AOT_hence \<open>\<exists>!s ([[G]\<^sup>-\<^sup>v]s & [R]rs)\<close>
+        using Fact1[THEN "\<forall>E"(2)] "\<rightarrow>E" Ordinary.\<psi> by blast
+      AOT_hence \<open>\<exists>s ([[G]\<^sup>-\<^sup>v]s & [R]rs & \<forall>t ([[G]\<^sup>-\<^sup>v]t & [R]rt \<rightarrow> t =\<^sub>E s))\<close>
+        using "equi:1"[THEN "\<equiv>E"(1)] by simp
+      then AOT_obtain s where s_prop: \<open>[[G]\<^sup>-\<^sup>v]s & [R]rs & \<forall>t ([[G]\<^sup>-\<^sup>v]t & [R]rt \<rightarrow> t =\<^sub>E s)\<close>
+        using "Ordinary.\<exists>E"[rotated] by meson
+      AOT_hence G_minus_v_s: \<open>[[G]\<^sup>-\<^sup>v]s\<close> and Rrs: \<open>[R]rs\<close>
+        using "&E" by blast+
+      AOT_have s_unique: \<open>t =\<^sub>E s\<close> if \<open>[[G]\<^sup>-\<^sup>v]t\<close> and \<open>[R]rt\<close> for t
+        using s_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E", OF "&I", OF that].
+      AOT_have Gs: \<open>[G]s\<close>
+        using \<Pi>_minus_\<kappa>E1[OF G_minus_v_s].
+      AOT_have s_noteq_v: \<open>s \<noteq>\<^sub>E v\<close>
+        using \<Pi>_minus_\<kappa>E2[OF G_minus_v_s].
+      AOT_have \<open>\<exists>s ([G]s & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([G]t & [\<guillemotleft>?R\<guillemotright>]rt \<rightarrow> t =\<^sub>E s)))\<close>
+      proof(safe intro!: "Ordinary.\<exists>I"[where \<beta>=s] "&I" Gs Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]rs\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" "\<or>I"(1) \<Pi>_minus_\<kappa>I' Fr Gs
+                           s_noteq_v Rrs r_noteq_u
+                   simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+      next
+        fix t
+        AOT_assume 0: \<open>[G]t & [\<guillemotleft>?R\<guillemotright>]rt\<close>
+        AOT_hence \<open>([[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt) \<or> (r =\<^sub>E u & t =\<^sub>E v)\<close>
+          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
+        AOT_hence 1: \<open>[[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt\<close>
+          using not_r_eq_u by (metis "&E"(1) "\<or>E"(3) "reductio-aa:1")
+        AOT_show \<open>t =\<^sub>E s\<close> using s_unique 1 "&E" by blast
+      qed
+    }
+    moreover {
+      AOT_assume r_eq_u: \<open>r =\<^sub>E u\<close>
+      AOT_have \<open>\<exists>s ([G]s & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([G]t & [\<guillemotleft>?R\<guillemotright>]rt \<rightarrow> t =\<^sub>E s)))\<close>
+      proof(safe intro!: "Ordinary.\<exists>I"[where \<beta>=v] "&I" Gv Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]rv\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" "\<or>I"(2) \<Pi>_minus_\<kappa>I' Fr r_eq_u
+                           "ord=Eequiv:1"[THEN "\<rightarrow>E"] Ordinary.\<psi>
+                   simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+      next
+        fix t
+        AOT_assume 0: \<open>[G]t & [\<guillemotleft>?R\<guillemotright>]rt\<close>
+        AOT_hence \<open>([[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt) \<or> (r =\<^sub>E u & t =\<^sub>E v)\<close>
+          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
+        AOT_hence \<open>r =\<^sub>E u & t =\<^sub>E v\<close>
+          using r_eq_u \<Pi>_minus_\<kappa>E2
+          by (metis "&E"(1) "\<or>E"(2) "\<equiv>E"(1) "reductio-aa:1" "thm-neg=E")
+        AOT_thus \<open>t =\<^sub>E v\<close> using "&E" by blast
+      qed
+    }
+    ultimately AOT_show \<open>\<exists>!s ([G]s & [\<guillemotleft>?R\<guillemotright>]rs)\<close>
+      using "reductio-aa:2" "equi:1"[THEN "\<equiv>E"(2)] by fast
+  next
+    fix s
+    AOT_assume Gs: \<open>[G]s\<close>
+
+    {
+      AOT_assume not_s_eq_v: \<open>\<not>(s =\<^sub>E v)\<close>
+      AOT_hence s_noteq_v: \<open>s \<noteq>\<^sub>E v\<close>
+        using "\<equiv>E"(2) "thm-neg=E" by blast
+      AOT_have \<open>[[G]\<^sup>-\<^sup>v]s\<close>
+        by (rule \<Pi>_minus_\<kappa>I; auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" Gs s_noteq_v)
+      AOT_hence \<open>\<exists>!r ([[F]\<^sup>-\<^sup>u]r & [R]rs)\<close>
+        using Fact1'[THEN "Ordinary.\<forall>E"] "\<rightarrow>E" by blast
+      AOT_hence \<open>\<exists>r ([[F]\<^sup>-\<^sup>u]r & [R]rs & \<forall>t ([[F]\<^sup>-\<^sup>u]t & [R]ts \<rightarrow> t =\<^sub>E r))\<close>
+        using "equi:1"[THEN "\<equiv>E"(1)] by simp
+      then AOT_obtain r where
+        r_prop: \<open>[[F]\<^sup>-\<^sup>u]r & [R]rs & \<forall>t ([[F]\<^sup>-\<^sup>u]t & [R]ts \<rightarrow> t =\<^sub>E r)\<close>
+        using "Ordinary.\<exists>E"[rotated] by meson
+      AOT_hence F_minus_u_r: \<open>[[F]\<^sup>-\<^sup>u]r\<close> and Rrs: \<open>[R]rs\<close>
+        using "&E" by blast+
+      AOT_have r_unique: \<open>t =\<^sub>E r\<close> if \<open>[[F]\<^sup>-\<^sup>u]t\<close> and \<open>[R]ts\<close> for t
+        using r_prop[THEN "&E"(2), THEN "Ordinary.\<forall>E",
+                     THEN "\<rightarrow>E", OF "&I", OF that].
+      AOT_have Fr: \<open>[F]r\<close>
+        using \<Pi>_minus_\<kappa>E1[OF F_minus_u_r].
+      AOT_have r_noteq_u: \<open>r \<noteq>\<^sub>E u\<close>
+        using \<Pi>_minus_\<kappa>E2[OF F_minus_u_r].
+      AOT_have \<open>\<exists>r ([F]r & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([F]t & [\<guillemotleft>?R\<guillemotright>]ts \<rightarrow> t =\<^sub>E r)))\<close>
+      proof(safe intro!: "Ordinary.\<exists>I"[where \<beta>=r] "&I" Fr Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]rs\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" "\<or>I"(1) \<Pi>_minus_\<kappa>I' Fr
+                           Gs s_noteq_v Rrs r_noteq_u
+                   simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+      next
+        fix t
+        AOT_assume 0: \<open>[F]t & [\<guillemotleft>?R\<guillemotright>]ts\<close>
+        AOT_hence \<open>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts) \<or> (t =\<^sub>E u & s =\<^sub>E v)\<close>
+          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
+        AOT_hence 1: \<open>[[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts\<close>
+          using not_s_eq_v by (metis "&E"(2) "\<or>E"(3) "reductio-aa:1")
+        AOT_show \<open>t =\<^sub>E r\<close> using r_unique 1 "&E" by blast
+      qed
+    }
+    moreover {
+      AOT_assume s_eq_v: \<open>s =\<^sub>E v\<close>
+      AOT_have \<open>\<exists>r ([F]r & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([F]t & [\<guillemotleft>?R\<guillemotright>]ts \<rightarrow> t =\<^sub>E r)))\<close>
+      proof(safe intro!: "Ordinary.\<exists>I"[where \<beta>=u] "&I" Fu Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]us\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI "\<or>I"(2)
+                            \<Pi>_minus_\<kappa>I' Gs s_eq_v Ordinary.\<psi>
+                            "ord=Eequiv:1"[THEN "\<rightarrow>E"])
+      next
+        fix t
+        AOT_assume 0: \<open>[F]t & [\<guillemotleft>?R\<guillemotright>]ts\<close>
+        AOT_hence 1: \<open>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts) \<or> (t =\<^sub>E u & s =\<^sub>E v)\<close>
+          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
+        moreover AOT_have \<open>\<not>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts)\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts)\<close>
+          AOT_hence \<open>[[G]\<^sup>-\<^sup>v]s\<close> using "&E" by blast
+          AOT_thus \<open>s =\<^sub>E v & \<not>(s =\<^sub>E v)\<close>
+            by (metis \<Pi>_minus_\<kappa>E2 "\<equiv>E"(4) "reductio-aa:1" s_eq_v "thm-neg=E")
+        qed
+        ultimately AOT_have \<open>t =\<^sub>E u & s =\<^sub>E v\<close>
+          by (metis "\<or>E"(2))
+        AOT_thus \<open>t =\<^sub>E u\<close> using "&E" by blast
+      qed
+    }
+    ultimately AOT_show \<open>\<exists>!r ([F]r & [\<guillemotleft>?R\<guillemotright>]rs)\<close>
+      using "\<equiv>E"(2) "equi:1" "reductio-aa:2" by fast
+  qed
+qed
+
+
+AOT_theorem "approx-cont:1": \<open>\<exists>F\<exists>G \<diamond>(F \<approx>\<^sub>E G & \<diamond>\<not>F \<approx>\<^sub>E G)\<close>
+proof -
+  let ?P = \<open>\<guillemotleft>[\<lambda>x E!x & \<not>\<^bold>\<A>E!x]\<guillemotright>\<close>
+  AOT_have \<open>\<diamond>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> by (metis q\<^sub>0_prop)
+  AOT_hence 1: \<open>\<diamond>\<exists>x(E!x & \<not>\<^bold>\<A>E!x) & \<diamond>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
+    by (rule q\<^sub>0_def[THEN "=\<^sub>d\<^sub>fE"(2), rotated])
+       (simp add: "log-prop-prop:2")
+  AOT_have \<theta>: \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+    apply (AOT_subst \<open>[\<guillemotleft>?P\<guillemotright>]x\<close> \<open>E!x & \<not>\<^bold>\<A>E!x\<close> for: x)
+     apply (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2[lambda]")
+    by (fact 1)
+  show ?thesis
+  proof (rule "\<exists>I"(1))+
+    AOT_have \<open>\<diamond>[L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+    proof (rule "&I"; rule "RM\<diamond>"[THEN "\<rightarrow>E"]; (rule "\<rightarrow>I")?)
+      AOT_modally_strict {
+        AOT_assume A: \<open>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        AOT_show \<open>[L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+        proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "\<rightarrow>E"]
+                            "rel-neg-T:3" "&I")
+          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+        next
+          AOT_show \<open>\<not>\<exists>u [L\<^sup>-]u\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>\<exists>u [L\<^sup>-]u\<close>
+            then AOT_obtain u where \<open>[L\<^sup>-]u\<close>
+              using "Ordinary.\<exists>E"[rotated] by blast
+            moreover AOT_have \<open>\<not>[L\<^sup>-]u\<close>
+              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                                        THEN "&E"(2)]
+              by (metis "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E")
+            ultimately AOT_show \<open>p & \<not>p\<close> for p
+              by (metis  "raa-cor:3")
+          qed
+        next
+          AOT_show \<open>\<not>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
+            then AOT_obtain u where \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
+              using "Ordinary.\<exists>E"[rotated] by blast
+            AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
+              using "&E" by blast
+            AOT_hence \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+              by (rule "\<exists>I")
+            AOT_thus \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+              using A "&I" by blast
+          qed
+        qed
+      }
+    next
+      AOT_show \<open>\<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        using \<theta> "&E" by blast
+    next
+      AOT_modally_strict {
+        AOT_assume A: \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        AOT_have B: \<open>\<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [L]\<^sup>-\<close>
+        proof (safe intro!: "empty-approx:2"[unvarify F H, THEN "\<rightarrow>E"]
+                            "rel-neg-T:3" "&I")
+          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
+            by "cqt:2[lambda]"
+        next
+          AOT_obtain x where Px: \<open>[\<guillemotleft>?P\<guillemotright>]x\<close>
+            using A "\<exists>E" by blast
+          AOT_hence \<open>E!x & \<not>\<^bold>\<A>E!x\<close>
+            by (rule "\<beta>\<rightarrow>C"(1))
+          AOT_hence 1: \<open>\<diamond>E!x\<close>
+            by (metis "T\<diamond>" "&E"(1) "vdash-properties:10")
+          AOT_have \<open>[\<lambda>x \<diamond>E!x]x\<close>
+            by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" 1)
+          AOT_hence \<open>O!x\<close>
+            by (rule AOT_ordinary[THEN "=\<^sub>d\<^sub>fI"(2), rotated]) "cqt:2[lambda]"
+          AOT_hence \<open>O!x & [\<guillemotleft>?P\<guillemotright>]x\<close>
+            using Px "&I" by blast
+          AOT_thus \<open>\<exists>u [\<guillemotleft>?P\<guillemotright>]u\<close>
+            by (rule "\<exists>I")
+        next
+          AOT_show \<open>\<not>\<exists>u [L\<^sup>-]u\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>\<exists>u [L\<^sup>-]u\<close>
+            then AOT_obtain u where \<open>[L\<^sup>-]u\<close>
+              using "Ordinary.\<exists>E"[rotated] by blast
+            moreover AOT_have \<open>\<not>[L\<^sup>-]u\<close>
+              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]]
+              by (metis "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E" "&E"(2))
+            ultimately AOT_show \<open>p & \<not>p\<close> for p
+              by (metis "raa-cor:3")
+          qed
+        qed
+        AOT_show \<open>\<not>[L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>[L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+          AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [L]\<^sup>-\<close>
+            apply (rule "eq-part:2"[unvarify F G, THEN "\<rightarrow>E", rotated 2])
+             apply "cqt:2[lambda]"
+            by (simp add: "rel-neg-T:3")
+          AOT_thus \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [L]\<^sup>- & \<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [L]\<^sup>-\<close>
+            using B "&I" by blast
+        qed
+      }
+    next
+      AOT_show \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        using \<theta> "&E" by blast
+    qed
+    AOT_thus \<open>\<diamond>([L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[L]\<^sup>- \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>])\<close>
+      using "S5Basic:11" "\<equiv>E"(2) by blast
+  next
+    AOT_show \<open>[\<lambda>x [E!]x & \<not>\<^bold>\<A>[E!]x]\<down>\<close>
+      by "cqt:2"
+  next
+    AOT_show \<open>[L]\<^sup>-\<down>\<close>
+      by (simp add: "rel-neg-T:3")
+  qed
+qed
+
+
+AOT_theorem "approx-cont:2":
+  \<open>\<exists>F\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+proof -
+  let ?P = \<open>\<guillemotleft>[\<lambda>x E!x & \<not>\<^bold>\<A>E!x]\<guillemotright>\<close>
+  AOT_have \<open>\<diamond>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> by (metis q\<^sub>0_prop)
+  AOT_hence 1: \<open>\<diamond>\<exists>x(E!x & \<not>\<^bold>\<A>E!x) & \<diamond>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
+    by (rule q\<^sub>0_def[THEN "=\<^sub>d\<^sub>fE"(2), rotated])
+       (simp add: "log-prop-prop:2")
+  AOT_have \<theta>: \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+    apply (AOT_subst \<open>[\<guillemotleft>?P\<guillemotright>]x\<close> \<open>E!x & \<not>\<^bold>\<A>E!x\<close> for: x)
+     apply (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2")
+    by (fact 1)
+  show ?thesis
+  proof (rule "\<exists>I"(1))+
+    AOT_have \<open>\<diamond>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+    proof (rule "&I"; rule "RM\<diamond>"[THEN "\<rightarrow>E"]; (rule "\<rightarrow>I")?)
+      AOT_modally_strict {
+        AOT_assume A: \<open>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        AOT_show \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+        proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "\<rightarrow>E"]
+                            "rel-neg-T:3" "&I")
+          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close> by "cqt:2"
+        next
+          AOT_show \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
+            then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
+              using "Ordinary.\<exists>E"[rotated] by blast
+            AOT_hence \<open>\<^bold>\<A>[L\<^sup>-]u\<close>
+              using "\<beta>\<rightarrow>C"(1) "&E" by blast
+            moreover AOT_have \<open>\<box>\<not>[L\<^sup>-]u\<close>
+              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]]
+              by (metis RN "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E" "&E"(2))
+            ultimately AOT_show \<open>p & \<not>p\<close> for p
+              by (metis "Act-Sub:3" "KBasic2:1" "\<equiv>E"(1) "raa-cor:3" "\<rightarrow>E")
+          qed
+        next
+          AOT_show \<open>\<not>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
+            then AOT_obtain u where \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
+              using "Ordinary.\<exists>E"[rotated] by blast
+            AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
+              using "&E" by blast
+            AOT_hence \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+              by (rule "\<exists>I")
+            AOT_thus \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+              using A "&I" by blast
+          qed
+        next
+          AOT_show \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<down>\<close> by "cqt:2"
+        qed
+      }
+    next
+      AOT_show \<open>\<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close> using \<theta> "&E" by blast
+    next
+      AOT_modally_strict {
+        AOT_assume A: \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        AOT_have B: \<open>\<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<close>
+        proof (safe intro!: "empty-approx:2"[unvarify F H, THEN "\<rightarrow>E"]
+                            "rel-neg-T:3" "&I")
+          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close> by "cqt:2"
+        next
+          AOT_obtain x where Px: \<open>[\<guillemotleft>?P\<guillemotright>]x\<close>
+            using A "\<exists>E" by blast
+          AOT_hence \<open>E!x & \<not>\<^bold>\<A>E!x\<close>
+            by (rule "\<beta>\<rightarrow>C"(1))
+          AOT_hence \<open>\<diamond>E!x\<close>
+            by (metis "T\<diamond>" "&E"(1) "\<rightarrow>E")
+          AOT_hence \<open>[\<lambda>x \<diamond>E!x]x\<close>
+            by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+          AOT_hence \<open>O!x\<close>
+            by (rule AOT_ordinary[THEN "=\<^sub>d\<^sub>fI"(2), rotated]) "cqt:2"
+          AOT_hence \<open>O!x & [\<guillemotleft>?P\<guillemotright>]x\<close>
+            using Px "&I" by blast
+          AOT_thus \<open>\<exists>u [\<guillemotleft>?P\<guillemotright>]u\<close>
+            by (rule "\<exists>I")
+        next
+          AOT_show \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
+          proof (rule "raa-cor:2")
+            AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
+            then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
+              using "Ordinary.\<exists>E"[rotated] by blast
+            AOT_hence \<open>\<^bold>\<A>[L\<^sup>-]u\<close>
+              using "\<beta>\<rightarrow>C"(1) "&E" by blast
+            moreover AOT_have \<open>\<box>\<not>[L\<^sup>-]u\<close>
+              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]]
+              by (metis RN "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E" "&E"(2))
+            ultimately AOT_show \<open>p & \<not>p\<close> for p
+              by (metis "Act-Sub:3" "KBasic2:1" "\<equiv>E"(1) "raa-cor:3" "\<rightarrow>E")
+          qed
+        next
+          AOT_show \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<down>\<close> by "cqt:2"
+        qed
+        AOT_show \<open>\<not>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>]\<close>
+          AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<close>
+            by (rule "eq-part:2"[unvarify F G, THEN "\<rightarrow>E", rotated 2])
+               "cqt:2"+
+          AOT_thus \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[L\<^sup>-]z] & \<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<close>
+            using B "&I" by blast
+        qed
+      }
+    next
+      AOT_show \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
+        using \<theta> "&E" by blast
+    qed
+    AOT_thus \<open>\<diamond>([\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>E [\<guillemotleft>?P\<guillemotright>])\<close>
+      using "S5Basic:11" "\<equiv>E"(2) by blast
+  next
+    AOT_show \<open>[\<lambda>x [E!]x & \<not>\<^bold>\<A>[E!]x]\<down>\<close> by "cqt:2"
+  next
+    AOT_show \<open>[L]\<^sup>-\<down>\<close>
+      by (simp add: "rel-neg-T:3")
+  qed
+qed
+
+notepad
+begin
+  text\<open>We already have defined being equivalent on the ordinary objects in the
+       Extended Relation Comprehension theory.\<close>
+  AOT_have \<open>F \<equiv>\<^sub>E G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>u ([F]u \<equiv> [G]u)\<close> for F G
+    using eqE by blast
+end
+
+AOT_theorem "apE-eqE:1": \<open>F \<equiv>\<^sub>E G \<rightarrow> F \<approx>\<^sub>E G\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>F \<equiv>\<^sub>E G\<close>
+  AOT_have \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+  proof (safe intro!: "\<exists>I"(1)[where \<tau>="\<guillemotleft>(=\<^sub>E)\<guillemotright>"] "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                      "=E[denotes]" "cqt:2[const_var]"[axiom_inst] Ordinary.GEN
+                      "\<rightarrow>I" "equi:1"[THEN "\<equiv>E"(2)])
+    fix u
+    AOT_assume Fu: \<open>[F]u\<close>
+    AOT_hence Gu: \<open>[G]u\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE"[OF eqE, OF 0, THEN "&E"(2),
+                   THEN "Ordinary.\<forall>E"[where \<alpha>=u], THEN "\<equiv>E"(1)]
+            Ordinary.\<psi> Fu by blast
+    AOT_show \<open>\<exists>v ([G]v & u =\<^sub>E v & \<forall>v' ([G]v' & u =\<^sub>E v' \<rightarrow> v' =\<^sub>E v))\<close>
+      by (safe intro!: "Ordinary.\<exists>I"[where \<beta>=u] "&I" GEN "\<rightarrow>I" Ordinary.\<psi> Gu
+                       "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Ordinary.\<psi>]
+                       "ord=Eequiv:2"[THEN "\<rightarrow>E"] dest!: "&E"(2))
+  next
+    fix v
+    AOT_assume Gv: \<open>[G]v\<close>
+    AOT_hence Fv: \<open>[F]v\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE"[OF eqE, OF 0, THEN "&E"(2),
+                   THEN "Ordinary.\<forall>E"[where \<alpha>=v], THEN "\<equiv>E"(2)]
+            Ordinary.\<psi> Gv by blast
+    AOT_show \<open>\<exists>u ([F]u & u =\<^sub>E v & \<forall>v' ([F]v' & v' =\<^sub>E v \<rightarrow> v' =\<^sub>E u))\<close>
+      by (safe intro!: "Ordinary.\<exists>I"[where \<beta>=v] "&I" GEN "\<rightarrow>I" Ordinary.\<psi> Fv
+                       "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Ordinary.\<psi>]
+                       "ord=Eequiv:2"[THEN "\<rightarrow>E"] dest!: "&E"(2))
+  qed
+  AOT_thus \<open>F \<approx>\<^sub>E G\<close>
+    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+qed
+
+AOT_theorem "apE-eqE:2": \<open>(F \<approx>\<^sub>E G & G \<equiv>\<^sub>E H) \<rightarrow> F \<approx>\<^sub>E H\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>F \<approx>\<^sub>E G & G \<equiv>\<^sub>E H\<close>
+  AOT_hence \<open>F \<approx>\<^sub>E G\<close> and \<open>G \<approx>\<^sub>E H\<close>
+    using "apE-eqE:1"[THEN "\<rightarrow>E"] "&E" by blast+
+  AOT_thus \<open>F \<approx>\<^sub>E H\<close>
+    by (metis Adjunction "eq-part:3" "vdash-properties:10")
+qed
+
+
+AOT_act_theorem "eq-part-act:1": \<open>[\<lambda>z \<^bold>\<A>[F]z] \<equiv>\<^sub>E F\<close>
+proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN "\<rightarrow>I")
+  fix u
+  AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]u \<equiv> \<^bold>\<A>[F]u\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+  also AOT_have \<open>\<dots> \<equiv> [F]u\<close>
+    using "act-conj-act:4" "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"] by blast
+  finally AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]u \<equiv> [F]u\<close>.
+qed
+
+AOT_act_theorem "eq-part-act:2": \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E F\<close>
+  by (safe intro!: "apE-eqE:1"[unvarify F, THEN "\<rightarrow>E"] "eq-part-act:1") "cqt:2"
+
+
+AOT_theorem "actuallyF:1": \<open>\<^bold>\<A>(F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z])\<close>
+proof -
+  AOT_have 1: \<open>\<^bold>\<A>([F]x \<equiv> \<^bold>\<A>[F]x)\<close> for x
+    by (meson "Act-Basic:5" "act-conj-act:4" "\<equiv>E"(2) "Commutativity of \<equiv>")
+  AOT_have \<open>\<^bold>\<A>([F]x \<equiv> [\<lambda>z \<^bold>\<A>[F]z]x)\<close> for x
+    apply (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close> \<open>\<^bold>\<A>[F]x\<close>)
+     apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+     apply "cqt:2[lambda]"
+    by (fact 1)
+  AOT_hence \<open>O!x \<rightarrow> \<^bold>\<A>([F]x \<equiv> [\<lambda>z \<^bold>\<A>[F]z]x)\<close> for x
+    by (metis "\<rightarrow>I") 
+  AOT_hence \<open>\<forall>u \<^bold>\<A>([F]u \<equiv> [\<lambda>z \<^bold>\<A>[F]z]u)\<close>
+    using "\<forall>I" by fast
+  AOT_hence 1: \<open>\<^bold>\<A>\<forall>u ([F]u \<equiv> [\<lambda>z \<^bold>\<A>[F]z]u)\<close>
+    by (metis "Ordinary.res-var-bound-reas[2]" "\<rightarrow>E")
+  AOT_modally_strict {
+    AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> by "cqt:2"
+  } note 2 = this
+  AOT_have \<open>\<^bold>\<A>(F \<equiv>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z])\<close>
+    apply (AOT_subst \<open>F \<equiv>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]\<close> \<open>\<forall>u ([F]u \<equiv> [\<lambda>z \<^bold>\<A>[F]z]u)\<close>)
+    using eqE[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I",
+              OF "cqt:2[const_var]"[axiom_inst], OF 2]
+    by (auto simp: 1)
+  moreover AOT_have \<open>\<^bold>\<A>(F \<equiv>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z] \<rightarrow> F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z])\<close>
+    using "apE-eqE:1"[unvarify G, THEN "RA[2]", OF 2] by metis
+  ultimately AOT_show \<open>\<^bold>\<A>F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]\<close>
+    by (metis "act-cond" "\<rightarrow>E")
+qed
+
+AOT_theorem "actuallyF:2": \<open>Rigid([\<lambda>z \<^bold>\<A>[F]z])\<close>
+proof(safe intro!: GEN "\<rightarrow>I" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I")
+  AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> by "cqt:2"
+next
+  AOT_show \<open>\<box>\<forall>x ([\<lambda>z \<^bold>\<A>[F]z]x \<rightarrow> \<box>[\<lambda>z \<^bold>\<A>[F]z]x)\<close>
+  proof(rule RN; rule GEN; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      fix x
+      AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close>
+      AOT_hence \<open>\<^bold>\<A>[F]x\<close>
+        by (rule "\<beta>\<rightarrow>C"(1))
+      AOT_hence 1: \<open>\<box>\<^bold>\<A>[F]x\<close> by (metis "Act-Basic:6" "\<equiv>E"(1))
+      AOT_show \<open>\<box>[\<lambda>z \<^bold>\<A>[F]z]x\<close>
+        apply (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close> \<open>\<^bold>\<A>[F]x\<close>)
+         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+         apply "cqt:2[lambda]"
+        by (fact 1)
+    }
+  qed
+qed
+
+AOT_theorem "approx-nec:1": \<open>Rigid(F) \<rightarrow> F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>Rigid([F])\<close>
+  AOT_hence A: \<open>\<box>\<forall>x ([F]x \<rightarrow> \<box>[F]x)\<close>
+    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast
+  AOT_hence 0: \<open>\<forall>x \<box>([F]x \<rightarrow> \<box>[F]x)\<close>
+    using CBF[THEN "\<rightarrow>E"] by blast
+  AOT_hence 1: \<open>\<forall>x ([F]x \<rightarrow> \<box>[F]x)\<close>
+    using A "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  AOT_have act_F_den: \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close>
+    by "cqt:2"
+  AOT_show \<open>F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]\<close>
+  proof (safe intro!: "apE-eqE:1"[unvarify G, THEN "\<rightarrow>E"] eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                      "cqt:2" act_F_den Ordinary.GEN "\<rightarrow>I" "\<equiv>I")
+    fix u
+    AOT_assume \<open>[F]u\<close>
+    AOT_hence \<open>\<box>[F]u\<close>
+      using 1[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+    AOT_hence act_F_u: \<open>\<^bold>\<A>[F]u\<close>
+      by (metis "nec-imp-act" "\<rightarrow>E")
+    AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" act_F_u)
+  next
+    fix u
+    AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
+    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
+      by (rule "\<beta>\<rightarrow>C"(1))
+    AOT_thus \<open>[F]u\<close>
+      using 0[THEN "\<forall>E"(2)]
+      by (metis "\<equiv>E"(1) "sc-eq-fur:2" "\<rightarrow>E")
+  qed
+qed
+
+
+AOT_theorem "approx-nec:2":
+  \<open>F \<approx>\<^sub>E G \<equiv> \<forall>H ([\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E G)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>F \<approx>\<^sub>E G\<close>
+  AOT_assume 0: \<open>F \<approx>\<^sub>E G\<close>
+  AOT_hence \<open>\<forall>H (H \<approx>\<^sub>E F \<equiv> H \<approx>\<^sub>E G)\<close>
+    using "eq-part:4"[THEN "\<equiv>E"(1), OF 0] by blast
+  AOT_have \<open>[\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E G\<close> for H
+    by (rule "\<forall>E"(1)[OF "eq-part:4"[THEN "\<equiv>E"(1), OF 0]]) "cqt:2"
+  AOT_thus \<open>\<forall>H ([\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E G)\<close>
+    by (rule GEN)
+next
+  AOT_assume 0: \<open>\<forall>H ([\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E G)\<close>
+  AOT_obtain H where \<open>Rigidifies(H,F)\<close>
+    using "rigid-der:3" "\<exists>E" by metis
+  AOT_hence H: \<open>Rigid(H) & \<forall>x ([H]x \<equiv> [F]x)\<close>
+    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_have H_rigid: \<open>\<box>\<forall>x ([H]x \<rightarrow> \<box>[H]x)\<close>
+    using H[THEN "&E"(1), THEN "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)].
+  AOT_hence \<open>\<forall>x \<box>([H]x \<rightarrow> \<box>[H]x)\<close>
+    using "CBF" "vdash-properties:10" by blast
+  AOT_hence \<open>\<box>([H]x \<rightarrow> \<box>[H]x)\<close> for x using "\<forall>E"(2) by blast
+  AOT_hence rigid: \<open>[H]x \<equiv> \<^bold>\<A>[H]x\<close> for x
+     by (metis "\<equiv>E"(6) "oth-class-taut:3:a" "sc-eq-fur:2" "\<rightarrow>E")
+  AOT_have \<open>H \<equiv>\<^sub>E F\<close>
+  proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN "\<rightarrow>I")
+    AOT_show \<open>[H]u \<equiv> [F]u\<close> for u using H[THEN "&E"(2)] "\<forall>E"(2) by fast
+  qed
+  AOT_hence \<open>H \<approx>\<^sub>E F\<close>
+    by (rule "apE-eqE:2"[THEN "\<rightarrow>E", OF "&I", rotated])
+       (simp add: "eq-part:1")
+  AOT_hence F_approx_H: \<open>F \<approx>\<^sub>E H\<close>
+    by (metis "eq-part:2" "\<rightarrow>E")
+  moreover AOT_have H_eq_act_H: \<open>H \<equiv>\<^sub>E [\<lambda>z \<^bold>\<A>[H]z]\<close>
+  proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN "\<rightarrow>I")
+    AOT_show \<open>[H]u \<equiv> [\<lambda>z \<^bold>\<A>[H]z]u\<close> for u
+      apply (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[H]z]u\<close> \<open>\<^bold>\<A>[H]u\<close>)
+       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+       apply "cqt:2[lambda]"
+      using rigid by blast
+  qed
+  AOT_have a: \<open>F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[H]z]\<close>
+    apply (rule "apE-eqE:2"[unvarify H, THEN "\<rightarrow>E"])
+     apply "cqt:2[lambda]"
+    using F_approx_H H_eq_act_H "&I" by blast
+  AOT_hence \<open>[\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E F\<close>
+    apply (rule "eq-part:2"[unvarify G, THEN "\<rightarrow>E", rotated])
+    by "cqt:2[lambda]"
+  AOT_hence b: \<open>[\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E G\<close>
+    by (rule 0[THEN "\<forall>E"(1), THEN "\<equiv>E"(1), rotated]) "cqt:2" 
+  AOT_show \<open>F \<approx>\<^sub>E G\<close>
+    by (rule "eq-part:3"[unvarify G, THEN "\<rightarrow>E", rotated, OF "&I", OF a, OF b])
+       "cqt:2"
+qed
+
+AOT_theorem "approx-nec:3":
+  \<open>(Rigid(F) & Rigid(G)) \<rightarrow> \<box>(F \<approx>\<^sub>E G \<rightarrow> \<box>F \<approx>\<^sub>E G)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>Rigid(F) & Rigid(G)\<close>
+  AOT_hence \<open>\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x)\<close> and \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
+    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] "&E" by blast+
+  AOT_hence \<open>\<box>(\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x) & \<box>\<forall>x([G]x \<rightarrow> \<box>[G]x))\<close>
+    using "KBasic:3" "4" "&I" "\<equiv>E"(2) "vdash-properties:10" by meson
+  moreover AOT_have \<open>\<box>(\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x) & \<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)) \<rightarrow>
+                     \<box>(F \<approx>\<^sub>E G \<rightarrow> \<box>F \<approx>\<^sub>E G)\<close>
+  proof(rule RM; rule "\<rightarrow>I"; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      AOT_assume \<open>\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x) & \<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
+      AOT_hence \<open>\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x)\<close> and \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
+        using "&E" by blast+
+      AOT_hence \<open>\<forall>x\<box>([F]x \<rightarrow> \<box>[F]x)\<close> and \<open>\<forall>x\<box>([G]x \<rightarrow> \<box>[G]x)\<close>
+        using CBF[THEN "\<rightarrow>E"] by blast+
+      AOT_hence F_nec: \<open>\<box>([F]x \<rightarrow> \<box>[F]x)\<close>
+            and G_nec: \<open>\<box>([G]x \<rightarrow> \<box>[G]x)\<close> for x
+        using "\<forall>E"(2) by blast+
+      AOT_assume \<open>F \<approx>\<^sub>E G\<close>
+      AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+        by (metis "\<equiv>\<^sub>d\<^sub>fE" "equi:3")
+      then AOT_obtain R where \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence C1: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
+            and C2: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
+        using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+      AOT_obtain R' where \<open>Rigidifies(R', R)\<close>
+        using "rigid-der:3" "\<exists>E"[rotated] by blast
+      AOT_hence 1: \<open>Rigid(R') & \<forall>x\<^sub>1...\<forall>x\<^sub>n ([R']x\<^sub>1...x\<^sub>n \<equiv> [R]x\<^sub>1...x\<^sub>n)\<close>
+        using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+      AOT_hence \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R']x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R']x\<^sub>1...x\<^sub>n)\<close>
+        using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n (\<diamond>[R']x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R']x\<^sub>1...x\<^sub>n)\<close>
+        using "\<equiv>E"(1) "rigid-rel-thms:1" by blast
+      AOT_hence D: \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 (\<diamond>[R']x\<^sub>1x\<^sub>2 \<rightarrow> \<box>[R']x\<^sub>1x\<^sub>2)\<close>
+        using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+      AOT_have E: \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 ([R']x\<^sub>1x\<^sub>2 \<equiv> [R]x\<^sub>1x\<^sub>2)\<close>
+        using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 1[THEN "&E"(2)]] by blast
+      AOT_have \<open>\<forall>u \<box>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
+           and \<open>\<forall>v \<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
+      proof (safe intro!: Ordinary.GEN "\<rightarrow>I")
+        fix u
+        AOT_show \<open>\<box>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
+        proof (rule "raa-cor:1")
+          AOT_assume \<open>\<not>\<box>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
+          AOT_hence 1: \<open>\<diamond>\<not>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
+            using "KBasic:11" "\<equiv>E"(1) by blast
+          AOT_have \<open>\<diamond>([F]u & \<not>\<exists>!v ([G]v & [R']uv))\<close>
+            apply (AOT_subst \<open>[F]u & \<not>\<exists>!v ([G]v & [R']uv)\<close>
+                             \<open>\<not>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>)
+             apply (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
+            by (fact 1)
+          AOT_hence A: \<open>\<diamond>[F]u & \<diamond>\<not>\<exists>!v ([G]v & [R']uv)\<close>
+            using "KBasic2:3" "\<rightarrow>E" by blast
+          AOT_hence \<open>\<box>[F]u\<close>
+            using F_nec "&E"(1) "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E" by blast
+          AOT_hence \<open>[F]u\<close>
+            by (metis "qml:2"[axiom_inst] "\<rightarrow>E")
+          AOT_hence \<open>\<exists>!v ([G]v & [R]uv)\<close>
+            using C1[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E"] by blast
+          AOT_hence \<open>\<exists>v ([G]v & [R]uv & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>E v))\<close>
+            using "equi:1"[THEN "\<equiv>E"(1)] by auto
+          then AOT_obtain a where
+            a_prop: \<open>O!a & ([G]a & [R]ua & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>E a))\<close>
+            using "\<exists>E"[rotated] by blast
+          AOT_have \<open>\<exists>v \<box>([G]v & [R']uv & \<forall>v' ([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E v))\<close>
+          proof(safe intro!: "\<exists>I"(2)[where \<beta>=a] "&I" a_prop[THEN "&E"(1)]
+                             "KBasic:3"[THEN "\<equiv>E"(2)])
+            AOT_show \<open>\<box>[G]a\<close>
+              using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
+              by (metis G_nec "qml:2"[axiom_inst] "\<rightarrow>E")
+          next
+            AOT_show \<open>\<box>[R']ua\<close>
+              using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+                    E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2),
+                      OF a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]]
+              by (metis "T\<diamond>" "\<rightarrow>E")
+          next
+            AOT_have \<open>\<forall>v' \<box>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
+            proof (rule Ordinary.GEN; rule "raa-cor:1")
+              fix v'
+              AOT_assume \<open>\<not>\<box>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
+              AOT_hence \<open>\<diamond>\<not>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
+                by (metis "KBasic:11" "\<equiv>E"(1))
+              AOT_hence \<open>\<diamond>([G]v' & [R']uv' & \<not>v' =\<^sub>E a)\<close>
+                by (AOT_subst \<open>[G]v' & [R']uv' & \<not>v' =\<^sub>E a\<close>
+                              \<open>\<not>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>)
+                   (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
+              AOT_hence 1: \<open>\<diamond>[G]v'\<close> and 2: \<open>\<diamond>[R']uv'\<close> and 3: \<open>\<diamond>\<not>v' =\<^sub>E a\<close>
+                using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)]
+                      "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast+
+              AOT_have Gv': \<open>[G]v'\<close> using G_nec 1
+                by (meson "B\<diamond>" "KBasic:13" "\<rightarrow>E")
+              AOT_have \<open>\<box>[R']uv'\<close>
+                using 2 D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+              AOT_hence R'uv': \<open>[R']uv'\<close>
+                by (metis "B\<diamond>" "T\<diamond>" "\<rightarrow>E") 
+              AOT_hence \<open>[R]uv'\<close>
+                using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+              AOT_hence \<open>v' =\<^sub>E a\<close>
+                using a_prop[THEN "&E"(2), THEN "&E"(2), THEN "Ordinary.\<forall>E",
+                             THEN "\<rightarrow>E", OF "&I", OF Gv'] by blast
+              AOT_hence \<open>\<box>(v' =\<^sub>E a)\<close>
+                by (metis "id-nec3:1" "\<equiv>E"(4) "raa-cor:3")
+              moreover AOT_have \<open>\<not>\<box>(v' =\<^sub>E a)\<close>
+                using 3 "KBasic:11" "\<equiv>E"(2) by blast
+              ultimately AOT_show \<open>\<box>(v' =\<^sub>E a) & \<not>\<box>(v' =\<^sub>E a)\<close>
+                using "&I" by blast
+            qed
+            AOT_thus \<open>\<box>\<forall>v'([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
+              using "Ordinary.res-var-bound-reas[BF]" "\<rightarrow>E" by fast
+          qed
+          AOT_hence \<open>\<box>\<exists>v ([G]v & [R']uv & \<forall>v' ([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E v))\<close>
+            using "Ordinary.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
+          AOT_hence \<open>\<box>\<exists>!v ([G]v & [R']uv)\<close>
+            by (AOT_subst_thm "equi:1")
+          moreover AOT_have \<open>\<not>\<box>\<exists>!v ([G]v & [R']uv)\<close>
+            using A[THEN "&E"(2)] "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+          ultimately AOT_show \<open>\<box>\<exists>!v ([G]v & [R']uv) & \<not>\<box>\<exists>!v ([G]v & [R']uv)\<close>
+            by (rule "&I")
+        qed
+      next
+        fix v
+        AOT_show \<open>\<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
+        proof (rule "raa-cor:1")
+          AOT_assume \<open>\<not>\<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
+          AOT_hence 1: \<open>\<diamond>\<not>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
+            using "KBasic:11" "\<equiv>E"(1) by blast
+          AOT_hence \<open>\<diamond>([G]v & \<not>\<exists>!u ([F]u & [R']uv))\<close>
+            by (AOT_subst \<open>[G]v & \<not>\<exists>!u ([F]u & [R']uv)\<close>
+                          \<open>\<not>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>)
+               (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
+          AOT_hence A: \<open>\<diamond>[G]v & \<diamond>\<not>\<exists>!u ([F]u & [R']uv)\<close>
+            using "KBasic2:3" "\<rightarrow>E" by blast
+          AOT_hence \<open>\<box>[G]v\<close>
+            using G_nec "&E"(1) "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E" by blast
+          AOT_hence \<open>[G]v\<close> by (metis "qml:2"[axiom_inst] "\<rightarrow>E")
+          AOT_hence \<open>\<exists>!u ([F]u & [R]uv)\<close>
+            using C2[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E"] by blast
+          AOT_hence \<open>\<exists>u ([F]u & [R]uv & \<forall>u' ([F]u' & [R]u'v \<rightarrow> u' =\<^sub>E u))\<close>
+            using "equi:1"[THEN "\<equiv>E"(1)] by auto
+          then AOT_obtain a where
+              a_prop: \<open>O!a & ([F]a & [R]av & \<forall>u' ([F]u' & [R]u'v \<rightarrow> u' =\<^sub>E a))\<close>
+            using "\<exists>E"[rotated] by blast
+          AOT_have \<open>\<exists>u \<box>([F]u & [R']uv & \<forall>u' ([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E u))\<close>
+          proof(safe intro!: "\<exists>I"(2)[where \<beta>=a] "&I" a_prop[THEN "&E"(1)]
+                             "KBasic:3"[THEN "\<equiv>E"(2)])
+            AOT_show \<open>\<box>[F]a\<close>
+              using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
+              by (metis F_nec "qml:2"[axiom_inst] "\<rightarrow>E")
+          next
+            AOT_show \<open>\<box>[R']av\<close>
+              using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+                    E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2),
+                      OF a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]]
+              by (metis "T\<diamond>" "\<rightarrow>E")
+          next
+            AOT_have \<open>\<forall>u' \<box>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
+            proof (rule Ordinary.GEN; rule "raa-cor:1")
+              fix u'
+              AOT_assume \<open>\<not>\<box>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
+              AOT_hence \<open>\<diamond>\<not>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
+                by (metis "KBasic:11" "\<equiv>E"(1))
+              AOT_hence \<open>\<diamond>([F]u' & [R']u'v & \<not>u' =\<^sub>E a)\<close>
+                by (AOT_subst \<open>[F]u' & [R']u'v & \<not>u' =\<^sub>E a\<close>
+                              \<open>\<not>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>)
+                   (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
+              AOT_hence 1: \<open>\<diamond>[F]u'\<close> and 2: \<open>\<diamond>[R']u'v\<close> and 3: \<open>\<diamond>\<not>u' =\<^sub>E a\<close>
+                using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)]
+                      "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast+
+              AOT_have Fu': \<open>[F]u'\<close> using F_nec 1
+                by (meson "B\<diamond>" "KBasic:13" "\<rightarrow>E")
+              AOT_have \<open>\<box>[R']u'v\<close>
+                using 2 D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+              AOT_hence R'u'v: \<open>[R']u'v\<close>
+                by (metis "B\<diamond>" "T\<diamond>" "\<rightarrow>E") 
+              AOT_hence \<open>[R]u'v\<close>
+                using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+              AOT_hence \<open>u' =\<^sub>E a\<close>
+                using a_prop[THEN "&E"(2), THEN "&E"(2), THEN "Ordinary.\<forall>E",
+                             THEN "\<rightarrow>E", OF "&I", OF Fu'] by blast
+              AOT_hence \<open>\<box>(u' =\<^sub>E a)\<close>
+                by (metis "id-nec3:1" "\<equiv>E"(4) "raa-cor:3")
+              moreover AOT_have \<open>\<not>\<box>(u' =\<^sub>E a)\<close>
+                using 3 "KBasic:11" "\<equiv>E"(2) by blast
+              ultimately AOT_show \<open>\<box>(u' =\<^sub>E a) & \<not>\<box>(u' =\<^sub>E a)\<close>
+                using "&I" by blast
+            qed
+            AOT_thus \<open>\<box>\<forall>u'([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
+              using "Ordinary.res-var-bound-reas[BF]" "\<rightarrow>E" by fast
+          qed
+          AOT_hence 1: \<open>\<box>\<exists>u ([F]u & [R']uv & \<forall>u' ([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E u))\<close>
+            using "Ordinary.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
+          AOT_hence \<open>\<box>\<exists>!u ([F]u & [R']uv)\<close>
+            by (AOT_subst_thm "equi:1")
+          moreover AOT_have \<open>\<not>\<box>\<exists>!u ([F]u & [R']uv)\<close>
+            using A[THEN "&E"(2)] "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+          ultimately AOT_show \<open>\<box>\<exists>!u ([F]u & [R']uv) & \<not>\<box>\<exists>!u ([F]u & [R']uv)\<close>
+            by (rule "&I")
+        qed
+      qed
+      AOT_hence \<open>\<box>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
+            and \<open>\<box>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
+        using "Ordinary.res-var-bound-reas[BF]"[THEN "\<rightarrow>E"] by auto
+      moreover AOT_have \<open>\<box>[R']\<down>\<close> and \<open>\<box>[F]\<down>\<close> and \<open>\<box>[G]\<down>\<close>
+        by (simp_all add: "ex:2:a")
+      ultimately AOT_have \<open>\<box>([R']\<down> & [F]\<down> & [G]\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv)) &
+                                                   \<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv)))\<close>
+        using "KBasic:3" "&I" "\<equiv>E"(2) by meson
+      AOT_hence \<open>\<box>R' |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+        by (AOT_subst_def "equi:2")
+      AOT_hence \<open>\<exists>R \<box>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+        by (rule "\<exists>I"(2))
+      AOT_hence \<open>\<box>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
+        by (metis Buridan "\<rightarrow>E")
+      AOT_thus \<open>\<box>F \<approx>\<^sub>E G\<close>
+        by (AOT_subst_def "equi:3")
+    }
+  qed
+  ultimately AOT_show \<open>\<box>(F \<approx>\<^sub>E G \<rightarrow> \<box>F \<approx>\<^sub>E G)\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+
+AOT_define numbers :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Numbers'(_,_')\<close>)
+  \<open>Numbers(x,G) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+
+AOT_theorem "numbers[den]":
+  \<open>\<Pi>\<down> \<rightarrow> (Numbers(\<kappa>, \<Pi>) \<equiv> A!\<kappa> & \<forall>F(\<kappa>[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E \<Pi>))\<close>
+  apply (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<equiv>I" "\<rightarrow>I" "cqt:2"
+               dest!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  using "&E" by blast+
+
+AOT_theorem "num-tran:1":
+  \<open>G \<approx>\<^sub>E H \<rightarrow> (Numbers(x, G) \<equiv> Numbers(x, H))\<close>
+proof (safe intro!: "\<rightarrow>I" "\<equiv>I")
+  AOT_assume 0: \<open>G \<approx>\<^sub>E H\<close>
+  AOT_assume \<open>Numbers(x, G)\<close>
+  AOT_hence Ax: \<open>A!x\<close> and \<theta>: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_show \<open>Numbers(x, H)\<close>
+  proof(safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ax "cqt:2" GEN)
+    fix F
+    AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
+      using \<theta>[THEN "\<forall>E"(2)].
+    also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>
+      using 0 "approx-nec:2"[THEN "\<equiv>E"(1), THEN "\<forall>E"(2)] by metis
+    finally AOT_show \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>.
+  qed
+next
+  AOT_assume \<open>G \<approx>\<^sub>E H\<close>
+  AOT_hence 0: \<open>H \<approx>\<^sub>E G\<close>
+    by (metis "eq-part:2" "\<rightarrow>E")
+  AOT_assume \<open>Numbers(x, H)\<close>
+  AOT_hence Ax: \<open>A!x\<close> and \<theta>: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H)\<close>
+    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_show \<open>Numbers(x, G)\<close>
+  proof(safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ax "cqt:2"  GEN)
+    fix F
+    AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>
+      using \<theta>[THEN "\<forall>E"(2)].
+    also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
+      using 0 "approx-nec:2"[THEN "\<equiv>E"(1), THEN "\<forall>E"(2)] by metis
+    finally AOT_show \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>.
+  qed
+qed
+
+AOT_theorem "num-tran:2":
+  \<open>(Numbers(x, G) & Numbers(x,H)) \<rightarrow> G \<approx>\<^sub>E H\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>Numbers(x,G)\<close>
+  AOT_hence \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_hence 1: \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close> for F
+    using "\<forall>E"(2) by blast
+  AOT_assume \<open>Numbers(x,H)\<close>
+  AOT_hence \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H)\<close>
+    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close> for F
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close> for F
+    by (metis "1" "\<equiv>E"(6))
+  AOT_thus \<open>G \<approx>\<^sub>E H\<close>
+    using "approx-nec:2"[THEN "\<equiv>E"(2), OF GEN] by blast
+qed
+
+AOT_theorem "num-tran:3":
+  \<open>G \<equiv>\<^sub>E H \<rightarrow> (Numbers(x, G) \<equiv> Numbers(x, H))\<close>
+  using "apE-eqE:1" "Hypothetical Syllogism" "num-tran:1" by blast
+
+AOT_theorem "pre-Hume":
+  \<open>(Numbers(x,G) & Numbers(y,H)) \<rightarrow> (x = y \<equiv> G \<approx>\<^sub>E H)\<close>
+proof(safe intro!: "\<rightarrow>I" "\<equiv>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>Numbers(x, G)\<close>
+  moreover AOT_assume \<open>x = y\<close>
+  ultimately AOT_have \<open>Numbers(y, G)\<close> by (rule "rule=E")
+  moreover AOT_assume \<open>Numbers(y, H)\<close>
+  ultimately AOT_show \<open>G \<approx>\<^sub>E H\<close> using "num-tran:2" "\<rightarrow>E" "&I" by blast
+next
+  AOT_assume \<open>Numbers(x, G)\<close>
+  AOT_hence Ax: \<open>A!x\<close> and xF: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_assume \<open>Numbers(y, H)\<close>
+  AOT_hence Ay: \<open>A!y\<close> and yF: \<open>\<forall>F (y[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H)\<close>
+    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_assume G_approx_H: \<open>G \<approx>\<^sub>E H\<close>
+  AOT_show \<open>x = y\<close>
+  proof(rule "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "&I", OF Ax, OF Ay]; rule GEN)
+    fix F
+    AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
+      using xF[THEN "\<forall>E"(2)].
+    also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>
+      using "approx-nec:2"[THEN "\<equiv>E"(1), OF G_approx_H, THEN "\<forall>E"(2)].
+    also AOT_have \<open>\<dots> \<equiv> y[F]\<close>
+      using yF[THEN "\<forall>E"(2), symmetric].
+    finally AOT_show \<open>x[F] \<equiv> y[F]\<close>.
+  qed
+qed
+
+AOT_theorem "two-num-not":
+  \<open>\<exists>u\<exists>v(u \<noteq> v) \<rightarrow> \<exists>x\<exists>G\<exists>H(Numbers(x,G) & Numbers(x, H) & \<not>G \<equiv>\<^sub>E H)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_have eqE_den: \<open>[\<lambda>x x =\<^sub>E y]\<down>\<close> for y by "cqt:2"
+  AOT_assume \<open>\<exists>u\<exists>v(u \<noteq> v)\<close>
+  then AOT_obtain c where Oc: \<open>O!c\<close> and \<open>\<exists>v (c \<noteq> v)\<close>
+    using "&E" "\<exists>E"[rotated] by blast
+  then AOT_obtain d where Od: \<open>O!d\<close> and c_noteq_d: \<open>c \<noteq> d\<close>
+    using "&E" "\<exists>E"[rotated] by blast
+  AOT_hence c_noteqE_d: \<open>c \<noteq>\<^sub>E d\<close>
+    using "=E-simple:2"[THEN "\<rightarrow>E"] "=E-simple:2" "\<equiv>E"(2) "modus-tollens:1"
+          "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "thm-neg=E" by fast
+  AOT_hence not_c_eqE_d: \<open>\<not>c =\<^sub>E d\<close>
+    using "\<equiv>E"(1) "thm-neg=E" by blast
+  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E c]))\<close>
+    by (simp add: "A-objects"[axiom_inst])
+  then AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E c])\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E d]))\<close>
+    by (simp add: "A-objects" "vdash-properties:1[2]")
+  then AOT_obtain b where b_prop: \<open>A!b & \<forall>F (b[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E d])\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have num_a_eq_c: \<open>Numbers(a, [\<lambda>x x =\<^sub>E c])\<close>
+    by (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" a_prop[THEN "&E"(1)]
+                     a_prop[THEN "&E"(2)]) "cqt:2"
+  moreover AOT_have num_b_eq_d: \<open>Numbers(b, [\<lambda>x x =\<^sub>E d])\<close>
+    by (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" b_prop[THEN "&E"(1)]
+                     b_prop[THEN "&E"(2)]) "cqt:2"
+  moreover AOT_have \<open>[\<lambda>x x =\<^sub>E c] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
+  proof (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    let ?R = \<open>\<guillemotleft>[\<lambda>xy (x =\<^sub>E c & y =\<^sub>E d)]\<guillemotright>\<close>
+    AOT_have Rcd: \<open>[\<guillemotleft>?R\<guillemotright>]cd\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI
+                       "ord=Eequiv:1"[THEN "\<rightarrow>E"] Od Oc)
+    AOT_show \<open>\<exists>R R |: [\<lambda>x x =\<^sub>E c] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
+    proof (safe intro!: "\<exists>I"(1)[where \<tau>=\<open>?R\<close>] "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                        eqE_den Ordinary.GEN "\<rightarrow>I")
+      AOT_show \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close> by "cqt:2"
+    next
+      fix u
+      AOT_assume \<open>[\<lambda>x x =\<^sub>E c]u\<close>
+      AOT_hence \<open>u =\<^sub>E c\<close>
+        by (metis "\<beta>\<rightarrow>C"(1))
+      AOT_hence u_is_c: \<open>u = c\<close>
+        by (metis "=E-simple:2" "\<rightarrow>E")
+      AOT_show \<open>\<exists>!v ([\<lambda>x x =\<^sub>E d]v & [\<guillemotleft>?R\<guillemotright>]uv)\<close>
+      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=d] "&I"
+                          Od Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[\<lambda>x x =\<^sub>E d]d\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Od])
+      next
+        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]ud\<close>
+          using u_is_c[symmetric] Rcd "rule=E" by fast
+      next
+        fix v
+        AOT_assume \<open>[\<lambda>x x =\<^sub>E d]v & [\<guillemotleft>?R\<guillemotright>]uv\<close>
+        AOT_thus \<open>v =\<^sub>E d\<close>
+          by (metis "\<beta>\<rightarrow>C"(1) "&E"(1))
+      qed
+    next
+      fix v
+      AOT_assume \<open>[\<lambda>x x =\<^sub>E d]v\<close>
+      AOT_hence \<open>v =\<^sub>E d\<close>
+        by (metis "\<beta>\<rightarrow>C"(1))
+      AOT_hence v_is_d: \<open>v = d\<close>
+        by (metis "=E-simple:2" "\<rightarrow>E")
+      AOT_show \<open>\<exists>!u ([\<lambda>x x =\<^sub>E c]u & [\<guillemotleft>?R\<guillemotright>]uv)\<close>
+      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=c] "&I"
+                          Oc Ordinary.GEN "\<rightarrow>I")
+        AOT_show \<open>[\<lambda>x x =\<^sub>E c]c\<close>
+          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Oc])
+      next
+        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]cv\<close>
+          using v_is_d[symmetric] Rcd "rule=E" by fast
+      next
+        fix u
+        AOT_assume \<open>[\<lambda>x x =\<^sub>E c]u & [\<guillemotleft>?R\<guillemotright>]uv\<close>
+        AOT_thus \<open>u =\<^sub>E c\<close>
+          by (metis "\<beta>\<rightarrow>C"(1) "&E"(1))
+      qed
+    next
+      AOT_show \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close>
+        by "cqt:2"
+    qed
+  qed
+  ultimately AOT_have \<open>a = b\<close>
+    using "pre-Hume"[unvarify G H, OF eqE_den, OF eqE_den, THEN "\<rightarrow>E",
+                     OF "&I", THEN "\<equiv>E"(2)] by blast
+  AOT_hence num_a_eq_d: \<open>Numbers(a, [\<lambda>x x =\<^sub>E d])\<close>
+    using num_b_eq_d "rule=E" id_sym by fast
+  AOT_have not_equiv: \<open>\<not>[\<lambda>x x =\<^sub>E c] \<equiv>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>[\<lambda>x x =\<^sub>E c] \<equiv>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
+    AOT_hence \<open>[\<lambda>x x =\<^sub>E c]c \<equiv> [\<lambda>x x =\<^sub>E d]c\<close>
+      using eqE[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] Oc by blast
+    moreover AOT_have \<open>[\<lambda>x x =\<^sub>E c]c\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Oc])
+    ultimately AOT_have \<open>[\<lambda>x x =\<^sub>E d]c\<close>
+      using "\<equiv>E"(1) by blast
+    AOT_hence \<open>c =\<^sub>E d\<close>
+      by (rule "\<beta>\<rightarrow>C"(1))
+    AOT_thus \<open>c =\<^sub>E d & \<not>c =\<^sub>E d\<close>
+      using not_c_eqE_d "&I" by blast
+  qed
+  AOT_show \<open>\<exists>x \<exists>G \<exists>H (Numbers(x,G) & Numbers(x,H) & \<not>G \<equiv>\<^sub>E H)\<close>
+    apply (rule "\<exists>I"(2)[where \<beta>=a])
+    apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x x =\<^sub>E c]\<guillemotright>\<close>])
+     apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x x =\<^sub>E d]\<guillemotright>\<close>])
+    by (safe intro!: eqE_den "&I" num_a_eq_c num_a_eq_d not_equiv)
+qed
+
+AOT_theorem "num:1": \<open>\<exists>x Numbers(x,G)\<close>
+  by (AOT_subst \<open>Numbers(x,G)\<close> \<open>[A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for: x)
+     (auto simp: "numbers[den]"[THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst]]
+                 "A-objects"[axiom_inst])
+
+AOT_theorem "num:2": \<open>\<exists>!x Numbers(x,G)\<close>
+  by (AOT_subst \<open>Numbers(x,G)\<close> \<open>[A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for: x)
+     (auto simp: "numbers[den]"[THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst]]
+                 "A-objects!")
+
+AOT_theorem "num-cont:1":
+  \<open>\<exists>x\<exists>G(Numbers(x, G) & \<not>\<box>Numbers(x, G))\<close>
+proof -
+  AOT_have \<open>\<exists>F\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using "approx-cont:2".
+  then AOT_obtain F where \<open>\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain G where \<open>\<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<theta>: \<open>\<diamond>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close> and \<zeta>: \<open>\<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
+    using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" "4\<diamond>"[THEN "\<rightarrow>E"] by blast+
+  AOT_obtain a where \<open>Numbers(a, G)\<close>
+    using "num:1" "\<exists>E"[rotated] by blast
+  moreover AOT_have \<open>\<not>\<box>Numbers(a, G)\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<box>Numbers(a, G)\<close>
+    AOT_hence \<open>\<box>([A!]a & G\<down> & \<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
+      by (AOT_subst_def (reverse) numbers)
+    AOT_hence \<open>\<box>A!a\<close> and \<open>\<box>\<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+      using "KBasic:3"[THEN "\<equiv>E"(1)] "&E" by blast+
+    AOT_hence \<open>\<forall>F \<box>(a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+      using CBF[THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>\<box>(a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+      using "\<forall>E"(2) by blast
+    AOT_hence A: \<open>\<box>(a[F] \<rightarrow> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+          and B: \<open>\<box>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> a[F])\<close>
+      using "KBasic:4"[THEN "\<equiv>E"(1)] "&E" by blast+
+    AOT_have \<open>\<box>(\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> \<not>a[F])\<close>
+      apply (AOT_subst \<open>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> \<not>a[F]\<close> \<open>a[F] \<rightarrow> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>)
+       using "\<equiv>I" "useful-tautologies:4" "useful-tautologies:5" apply presburger
+       by (fact A)
+     AOT_hence \<open>\<diamond>\<not>a[F]\<close>
+       by (metis "KBasic:13" \<zeta> "\<rightarrow>E")
+    AOT_hence \<open>\<not>a[F]\<close>
+      by (metis "KBasic:11" "en-eq:2[1]" "\<equiv>E"(2) "\<equiv>E"(4))
+    AOT_hence \<open>\<not>\<diamond>a[F]\<close>
+      by (metis "en-eq:3[1]" "\<equiv>E"(4))
+    moreover AOT_have \<open>\<diamond>a[F]\<close>
+      by (meson B \<theta> "KBasic:13" "\<rightarrow>E")
+    ultimately AOT_show \<open>\<diamond>a[F] & \<not>\<diamond>a[F]\<close>
+      using "&I" by blast
+  qed
+
+  ultimately AOT_have \<open>Numbers(a, G) & \<not>\<box>Numbers(a, G)\<close>
+    using "&I" by blast
+  AOT_hence \<open>\<exists>G (Numbers(a, G) & \<not>\<box>Numbers(a, G))\<close>
+    by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>x\<exists>G (Numbers(x, G) & \<not>\<box>Numbers(x, G))\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_theorem "num-cont:2":
+  \<open>Rigid(G) \<rightarrow> \<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>Rigid(G)\<close>
+  AOT_hence \<open>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close>
+    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast
+  AOT_hence \<open>\<box>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close> by (metis "S5Basic:6" "\<equiv>E"(1))
+  moreover AOT_have \<open>\<box>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z) \<rightarrow> \<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
+  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      AOT_have act_den: \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F by "cqt:2[lambda]"
+      fix x
+      AOT_assume G_nec: \<open>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close>
+      AOT_hence G_rigid: \<open>Rigid(G)\<close>
+        using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I"] "cqt:2"
+        by blast
+      AOT_assume \<open>Numbers(x, G)\<close>
+      AOT_hence \<open>[A!]x & G\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+        using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+      AOT_hence Ax: \<open>[A!]x\<close> and \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+        using "&E" by blast+
+      AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close> for F
+        using "\<forall>E"(2) by blast
+      moreover AOT_have \<open>\<box>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> \<box>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for F
+        using "approx-nec:3"[unvarify F, OF act_den, THEN "\<rightarrow>E", OF "&I",
+                             OF "actuallyF:2", OF G_rigid].
+      moreover AOT_have \<open>\<box>(x[F] \<rightarrow> \<box>x[F])\<close> for F
+        by (simp add: RN "pre-en-eq:1[1]")
+      ultimately AOT_have \<open>\<box>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for F
+        using "sc-eq-box-box:5" "\<rightarrow>E" "qml:2"[axiom_inst] "&I" by meson
+      AOT_hence \<open>\<forall>F \<box>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+        by (rule "\<forall>I")
+      AOT_hence 1: \<open>\<box>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+        using BF[THEN "\<rightarrow>E"] by fast
+      AOT_have \<open>\<box>G\<down>\<close>
+        by (simp add: "ex:2:a")
+      moreover AOT_have \<open>\<box>[A!]x\<close>
+        using Ax "oa-facts:2" "\<rightarrow>E" by blast
+      ultimately AOT_have \<open>\<box>(A!x & G\<down>)\<close>
+        by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+      AOT_hence \<open>\<box>(A!x & G\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
+        using 1 "KBasic:3" "&I" "\<equiv>E"(2) by fast
+      AOT_thus \<open>\<box>Numbers(x, G)\<close>
+        by (AOT_subst_def numbers)
+    }
+  qed
+  ultimately AOT_show \<open>\<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "num-cont:3":
+  \<open>\<box>\<forall>x(Numbers(x, [\<lambda>z \<^bold>\<A>[G]z]) \<rightarrow> \<box>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z]))\<close>
+  by (rule "num-cont:2"[unvarify G, THEN "\<rightarrow>E"];
+      ("cqt:2[lambda]" | rule "actuallyF:2"))
+
+AOT_theorem "num-uniq": \<open>\<^bold>\<iota>x Numbers(x, G)\<down>\<close>
+  using "\<equiv>E"(2) "A-Exists:2" "RA[2]" "num:2" by blast
+
+AOT_define num :: \<open>\<tau> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>#_\<close> [100] 100)
+  "num-def:1": \<open>#G =\<^sub>d\<^sub>f \<^bold>\<iota>x Numbers(x, G)\<close>
+
+AOT_theorem "num-def:2": \<open>#G\<down>\<close>
+  using "num-def:1"[THEN "=\<^sub>d\<^sub>fI"(1)] "num-uniq" by simp
+
+AOT_theorem "num-can:1":
+  \<open>#G = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
+proof -
+  AOT_have \<open>\<box>\<forall>x(Numbers(x,G) \<equiv> [A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
+    by (safe intro!: RN GEN "numbers[den]"[THEN "\<rightarrow>E"] "cqt:2")
+  AOT_hence \<open>\<^bold>\<iota>x Numbers(x, G) = \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
+    using "num-uniq" "equiv-desc-eq:3"[THEN "\<rightarrow>E", OF "&I"] by auto
+  thus ?thesis
+    by (rule "=\<^sub>d\<^sub>fI"(1)[OF "num-def:1", OF "num-uniq"])
+qed
+
+AOT_theorem "num-can:2": \<open>#G = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
+proof (rule id_trans[OF "num-can:1"]; rule "equiv-desc-eq:2"[THEN "\<rightarrow>E"];
+       safe intro!: "&I" "A-descriptions" GEN "Act-Basic:5"[THEN "\<equiv>E"(2)]
+                    "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)])
+  AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F
+    by "cqt:2"
+  AOT_have "eq-part:3[terms]": \<open>\<^bold>\<turnstile>\<^sub>\<box> F \<approx>\<^sub>E G & F \<approx>\<^sub>E H \<rightarrow> G \<approx>\<^sub>E H\<close> for F G H
+    by (metis "&I" "eq-part:2" "eq-part:3" "\<rightarrow>I" "&E" "\<rightarrow>E")
+  fix x
+  {
+    fix F
+    AOT_have \<open>\<^bold>\<A>(F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z])\<close>
+      by (simp add: "actuallyF:1")
+    moreover AOT_have \<open>\<^bold>\<A>((F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]) \<rightarrow> ([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> F \<approx>\<^sub>E G))\<close>
+      by (auto intro!: "RA[2]" "\<rightarrow>I" "\<equiv>I"
+               simp: "eq-part:3"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "&I"]
+                     "eq-part:3[terms]"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "&I"])
+    ultimately AOT_have \<open>\<^bold>\<A>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> F \<approx>\<^sub>E G)\<close>
+      using "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(1), THEN "\<rightarrow>E"] by blast
+
+    AOT_hence \<open>\<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> \<^bold>\<A>F \<approx>\<^sub>E G\<close>
+      by (metis "Act-Basic:5" "\<equiv>E"(1))
+    AOT_hence 0: \<open>(\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>F \<approx>\<^sub>E G)\<close>
+      by (auto intro!: "\<equiv>I" "\<rightarrow>I" elim: "\<equiv>E")
+    AOT_have \<open>\<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+      by (simp add: "Act-Basic:5")
+    also AOT_have \<open>\<dots> \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>F \<approx>\<^sub>E G)\<close> using 0.
+    also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
+      by (meson "Act-Basic:5" "\<equiv>E"(6) "oth-class-taut:3:a")
+    finally AOT_have 0: \<open>\<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>E G))\<close>.
+  } note 0 = this
+  AOT_have \<open>\<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> \<forall>F \<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
+    using "logic-actual-nec:3" "vdash-properties:1[2]" by blast
+  also AOT_have \<open>\<dots> \<equiv>  \<forall>F \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
+    apply (safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+    using 0 "\<equiv>E"(1) "\<equiv>E"(2) "rule-ui:3" by blast+
+  also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
+    using "\<equiv>E"(6) "logic-actual-nec:3"[axiom_inst] "oth-class-taut:3:a" by fast
+  finally AOT_have 0: \<open>\<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>.
+  AOT_have \<open>\<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)) \<equiv>
+            (\<^bold>\<A>A!x & \<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
+    by (simp add: "Act-Basic:2")
+  also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>[A!]x & \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
+    using 0 "oth-class-taut:4:f" "\<rightarrow>E" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
+    using "Act-Basic:2" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
+  finally AOT_show \<open>\<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)) \<equiv>
+                    \<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>.
+qed
+
+AOT_define NaturalCardinal :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>NaturalCardinal'(_')\<close>)
+  card: \<open>NaturalCardinal(x) \<equiv>\<^sub>d\<^sub>f \<exists>G(x = #G)\<close>
+
+AOT_theorem "natcard-nec": \<open>NaturalCardinal(x) \<rightarrow> \<box>NaturalCardinal(x)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>NaturalCardinal(x)\<close>
+  AOT_hence \<open>\<exists>G(x = #G)\<close> using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain G where \<open>x = #G\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>x = #G\<close> by (metis "id-nec:2" "\<rightarrow>E")
+  AOT_hence \<open>\<exists>G \<box>x = #G\<close> by (rule "\<exists>I")
+  AOT_hence \<open>\<box>\<exists>G x = #G\<close> by (metis Buridan "\<rightarrow>E")
+  AOT_thus \<open>\<box>NaturalCardinal(x)\<close>
+    by (AOT_subst_def card)
+qed
+
+AOT_act_theorem "hume:1": \<open>Numbers(#G, G)\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "num-def:1"])
+  apply (simp add: "num-uniq")
+  using "num-uniq" "vdash-properties:10" "y-in:3" by blast
+
+AOT_act_theorem "hume:2": \<open>#F = #G \<equiv> F \<approx>\<^sub>E G\<close>
+  by (safe intro!: "pre-Hume"[unvarify x y, OF "num-def:2",
+                              OF "num-def:2", THEN "\<rightarrow>E"] "&I" "hume:1")
+
+AOT_act_theorem "hume:3": \<open>#F = #G \<equiv> \<exists>R (R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G)\<close>
+  using "equi-rem-thm"
+  apply (AOT_subst (reverse) \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
+                             \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close> for: R :: \<open><\<kappa>\<times>\<kappa>>\<close>)
+  using "equi:3" "hume:2" "\<equiv>E"(5) "\<equiv>Df" by blast
+
+AOT_act_theorem "hume:4": \<open>F \<equiv>\<^sub>E G \<rightarrow> #F = #G\<close>
+  by (metis "apE-eqE:1" "deduction-theorem" "hume:2" "\<equiv>E"(2) "\<rightarrow>E")
+
+AOT_theorem "hume-strict:1":
+  \<open>\<exists>x (Numbers(x, F) & Numbers(x, G)) \<equiv> F \<approx>\<^sub>E G\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
+  then AOT_obtain a where \<open>Numbers(a, F) & Numbers(a, G)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>F \<approx>\<^sub>E G\<close>
+    using "num-tran:2" "\<rightarrow>E" by blast
+next
+  AOT_assume 0: \<open>F \<approx>\<^sub>E G\<close>
+  moreover AOT_obtain b where num_b_F: \<open>Numbers(b, F)\<close>
+    by (metis "instantiation" "num:1")
+  moreover AOT_have num_b_G: \<open>Numbers(b, G)\<close>
+    using calculation "num-tran:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] by blast
+  ultimately AOT_have \<open>Numbers(b, F) & Numbers(b, G)\<close>
+    by (safe intro!: "&I")
+  AOT_thus \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_theorem "hume-strict:2":
+  \<open>\<exists>x\<exists>y (Numbers(x, F) &
+         \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
+         Numbers(y, G) &
+         \<forall>z (Numbers(z, G) \<rightarrow> z = y) &
+         x = y) \<equiv>
+   F \<approx>\<^sub>E G\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>\<exists>x\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
+                    Numbers(y, G) & \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
+  then AOT_obtain x where
+    \<open>\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
+         \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain y where
+    \<open>Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
+     \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>Numbers(x, F)\<close> and \<open>Numbers(y,G)\<close> and \<open>x = y\<close>
+    using "&E" by blast+
+  AOT_hence \<open>Numbers(y, F) & Numbers(y, G)\<close>
+    using "&I" "rule=E" by fast
+  AOT_hence \<open>\<exists>y (Numbers(y, F) & Numbers(y, G))\<close>
+    by (rule "\<exists>I")
+  AOT_thus \<open>F \<approx>\<^sub>E G\<close>
+    using "hume-strict:1"[THEN "\<equiv>E"(1)] by blast
+next
+  AOT_assume \<open>F \<approx>\<^sub>E G\<close>
+  AOT_hence \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
+    using "hume-strict:1"[THEN "\<equiv>E"(2)] by blast
+  then AOT_obtain x where \<open>Numbers(x, F) & Numbers(x, G)\<close>
+    using "\<exists>E"[rotated] by blast
+  moreover AOT_have \<open>\<forall>z (Numbers(z, F) \<rightarrow> z = x)\<close>
+                and \<open>\<forall>z (Numbers(z, G) \<rightarrow> z = x)\<close>
+    using calculation
+    by (auto intro!: GEN "\<rightarrow>I" "pre-Hume"[THEN "\<rightarrow>E", OF "&I", THEN "\<equiv>E"(2),
+                                         rotated 2, OF "eq-part:1"] dest: "&E")
+  ultimately AOT_have \<open>Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
+                       Numbers(x, G) & \<forall>z (Numbers(z, G) \<rightarrow> z = x) & x = x\<close>
+    by (auto intro!: "&I" "id-eq:1" dest: "&E")
+  AOT_thus \<open>\<exists>x\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
+                  \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
+    by (auto intro!: "\<exists>I")
+qed
+
+AOT_theorem unotEu: \<open>\<not>\<exists>y[\<lambda>x O!x & x \<noteq>\<^sub>E x]y\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<exists>y[\<lambda>x O!x & x \<noteq>\<^sub>E x]y\<close>
+  then AOT_obtain y where \<open>[\<lambda>x O!x & x \<noteq>\<^sub>E x]y\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence 0: \<open>O!y & y \<noteq>\<^sub>E y\<close>
+    by (rule "\<beta>\<rightarrow>C"(1))
+  AOT_hence \<open>\<not>(y =\<^sub>E y)\<close>
+    using "&E"(2) "\<equiv>E"(1) "thm-neg=E" by blast
+  moreover AOT_have \<open>y =\<^sub>E y\<close>
+    by (metis 0[THEN "&E"(1)] "ord=Eequiv:1" "\<rightarrow>E")
+  ultimately AOT_show \<open>p & \<not>p\<close> for p
+    by (metis "raa-cor:3")
+qed
+
+AOT_define zero :: \<open>\<kappa>\<^sub>s\<close> (\<open>0\<close>)
+  "zero:1": \<open>0 =\<^sub>d\<^sub>f #[\<lambda>x O!x & x \<noteq>\<^sub>E x]\<close>
+
+AOT_theorem "zero:2": \<open>0\<down>\<close>
+  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"]; rule "num-def:2"[unvarify G]; "cqt:2")
+
+AOT_theorem "zero-card": \<open>NaturalCardinal(0)\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"])
+   apply (rule "num-def:2"[unvarify G]; "cqt:2")
+  apply (rule card[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x [O!]x & x \<noteq>\<^sub>E x]\<guillemotright>\<close>])
+   apply (rule "rule=I:1"; rule "num-def:2"[unvarify G]; "cqt:2")
+  by "cqt:2"
+
+AOT_theorem "eq-num:1":
+  \<open>\<^bold>\<A>Numbers(x, G) \<equiv> Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])\<close>
+proof -
+  AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F by "cqt:2"
+  AOT_have \<open>\<box>(\<exists>x(Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])) \<equiv> G \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[G]z])\<close>
+    using "hume-strict:1"[unvarify G, OF act_den, THEN RN].
+  AOT_hence \<open>\<^bold>\<A>(\<exists>x(Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])) \<equiv> G \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[G]z])\<close>
+    using "nec-imp-act"[THEN "\<rightarrow>E"] by fast
+  AOT_hence \<open>\<^bold>\<A>(\<exists>x(Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
+    using "actuallyF:1" "Act-Basic:5" "\<equiv>E"(1) "\<equiv>E"(2) by fast
+  AOT_hence \<open>\<exists>x \<^bold>\<A>((Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
+    by (metis "Act-Basic:10" "intro-elim:3:a")
+  then AOT_obtain a where \<open>\<^bold>\<A>(Numbers(a, G) & Numbers(a,[\<lambda>z \<^bold>\<A>[G]z]))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence act_a_num_G: \<open>\<^bold>\<A>Numbers(a, G)\<close>
+     and act_a_num_actG: \<open>\<^bold>\<A>Numbers(a,[\<lambda>z \<^bold>\<A>[G]z])\<close>
+    using "Act-Basic:2" "&E" "\<equiv>E"(1) by blast+
+  AOT_hence num_a_act_g: \<open>Numbers(a, [\<lambda>z \<^bold>\<A>[G]z])\<close>
+    using "num-cont:2"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "actuallyF:2",
+                       THEN CBF[THEN "\<rightarrow>E"], THEN "\<forall>E"(2)]
+    by (metis "\<equiv>E"(1) "sc-eq-fur:2" "vdash-properties:6")
+  AOT_have 0: \<open>\<^bold>\<turnstile>\<^sub>\<box> Numbers(x, G) & Numbers(y, G) \<rightarrow> x = y\<close> for y
+    using "pre-Hume"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), rotated, OF "eq-part:1"]
+          "\<rightarrow>I" by blast
+  show ?thesis
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>\<^bold>\<A>Numbers(x, G)\<close>
+    AOT_hence \<open>\<^bold>\<A>x = a\<close>
+      using 0[THEN "RA[2]", THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E",
+              OF "Act-Basic:2"[THEN "\<equiv>E"(2)], OF "&I"]
+            act_a_num_G by blast
+    AOT_hence \<open>x = a\<close> by (metis "id-act:1" "\<equiv>E"(2))
+    AOT_hence \<open>a = x\<close> using id_sym by auto
+    AOT_thus \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
+      using "rule=E" num_a_act_g by fast
+  next
+    AOT_assume \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
+    AOT_hence \<open>a = x\<close>
+      using "pre-Hume"[unvarify G H, THEN "\<rightarrow>E", OF act_den, OF act_den, OF "&I",
+                       OF num_a_act_g, THEN "\<equiv>E"(2)]
+            "eq-part:1"[unvarify F, OF act_den] by blast
+    AOT_thus \<open>\<^bold>\<A>Numbers(x, G)\<close>
+      using act_a_num_G "rule=E" by fast
+  qed
+qed
+
+AOT_theorem "eq-num:2": \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G\<close>
+proof -
+  AOT_have 0: \<open>\<^bold>\<turnstile>\<^sub>\<box> x = \<^bold>\<iota>x Numbers(x, G) \<equiv> \<forall>y (Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]) \<equiv> y = x)\<close> for x
+    by (AOT_subst (reverse) \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close> \<open>\<^bold>\<A>Numbers(x, G)\<close> for: x)
+       (auto simp: "eq-num:1" descriptions[axiom_inst])
+  AOT_have \<open>#G = \<^bold>\<iota>x Numbers(x, G) \<equiv> \<forall>y (Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]) \<equiv> y = #G)\<close>
+    using 0[unvarify x, OF "num-def:2"].
+  moreover AOT_have \<open>#G = \<^bold>\<iota>x Numbers(x, G)\<close>
+    using "num-def:1" "num-uniq" "rule-id-df:1" by blast
+  ultimately AOT_have \<open>\<forall>y (Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]) \<equiv> y = #G)\<close>
+    using "\<equiv>E" by blast
+  thus ?thesis using "\<forall>E"(2) by blast
+qed
+
+AOT_theorem "eq-num:3": \<open>Numbers(#G, [\<lambda>y \<^bold>\<A>[G]y])\<close>
+proof -
+  AOT_have \<open>#G = #G\<close>
+    by (simp add: "rule=I:1" "num-def:2")
+  thus ?thesis
+    using "eq-num:2"[unvarify x, OF "num-def:2", THEN "\<equiv>E"(2)] by blast
+qed
+
+AOT_theorem "eq-num:4":
+  \<open>A!#G & \<forall>F (#G[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[G]z])\<close>
+  by (auto intro!: "&I" "eq-num:3"[THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                                   THEN "&E"(1), THEN "&E"(1)]
+                   "eq-num:3"[THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)])
+
+AOT_theorem "eq-num:5": \<open>#G[G]\<close>
+  by (auto intro!: "eq-num:4"[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2)]
+                   "eq-part:1"[unvarify F] simp: "cqt:2")
+
+AOT_theorem "eq-num:6": \<open>Numbers(x, G) \<rightarrow> NaturalCardinal(x)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F
+    by "cqt:2"
+  AOT_obtain F where \<open>Rigidifies(F, G)\<close>
+    by (metis "instantiation" "rigid-der:3")
+  AOT_hence \<theta>: \<open>Rigid(F)\<close> and \<open>\<forall>x([F]x \<equiv> [G]x)\<close>
+    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
+          "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)]
+    by blast+
+  AOT_hence \<open>F \<equiv>\<^sub>E G\<close>
+    by (auto intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I" elim: "\<forall>E"(2))
+  moreover AOT_assume \<open>Numbers(x, G)\<close>
+  ultimately AOT_have \<open>Numbers(x, F)\<close>
+    using "num-tran:3"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2)] by blast
+  moreover AOT_have \<open>F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]\<close>
+    using \<theta> "approx-nec:1" "\<rightarrow>E" by blast
+  ultimately AOT_have \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[F]z])\<close>
+    using "num-tran:1"[unvarify H, OF act_den, THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>x = #F\<close>
+    using "eq-num:2"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<exists>F x = #F\<close>
+    by (rule "\<exists>I")
+  AOT_thus \<open>NaturalCardinal(x)\<close>
+    using card[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+AOT_theorem "eq-df-num": \<open>\<exists>G (x = #G) \<equiv> \<exists>G (Numbers(x,G))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>\<exists>G (x = #G)\<close>
+  then AOT_obtain P where \<open>x = #P\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[P]z])\<close>
+    using "eq-num:2"[THEN "\<equiv>E"(2)] by blast
+  moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[P]z]\<down>\<close> by "cqt:2"
+  ultimately AOT_show \<open>\<exists>G(Numbers(x,G))\<close> by (rule "\<exists>I")
+next
+  AOT_assume \<open>\<exists>G (Numbers(x,G))\<close>
+  then AOT_obtain Q where \<open>Numbers(x,Q)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>NaturalCardinal(x)\<close>
+    using "eq-num:6"[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<exists>G (x = #G)\<close>
+    using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+qed
+
+AOT_theorem "card-en": \<open>NaturalCardinal(x) \<rightarrow> \<forall>F(x[F] \<equiv> x = #F)\<close>
+proof(rule "\<rightarrow>I"; rule GEN)
+  AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F by "cqt:2"
+  fix F
+  AOT_assume \<open>NaturalCardinal(x)\<close>
+  AOT_hence \<open>\<exists>F x = #F\<close>
+    using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain P where x_def: \<open>x = #P\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence num_x_act_P: \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[P]z])\<close>
+    using "eq-num:2"[THEN "\<equiv>E"(2)] by blast
+  AOT_have \<open>#P[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[P]z]\<close>
+    using "eq-num:4"[THEN "&E"(2), THEN "\<forall>E"(2)] by blast
+  AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[P]z]\<close>
+    using x_def[symmetric] "rule=E" by fast
+  also AOT_have \<open>\<dots> \<equiv> Numbers(x, [\<lambda>z \<^bold>\<A>[F]z])\<close>
+    using "num-tran:1"[unvarify G H, OF act_den, OF act_den]
+    using "num-tran:2"[unvarify G H, OF act_den, OF act_den]
+    by (metis "&I" "deduction-theorem" "\<equiv>I" "\<equiv>E"(2) num_x_act_P)
+  also AOT_have \<open>\<dots> \<equiv> x = #F\<close>
+    using "eq-num:2" by blast
+  finally AOT_show \<open>x[F] \<equiv> x = #F\<close>.
+qed
+
+AOT_theorem "0F:1": \<open>\<not>\<exists>u [F]u \<equiv> Numbers(0, F)\<close>
+proof -
+  AOT_have unotEu_act_ord: \<open>\<not>\<exists>v[\<lambda>x O!x & \<^bold>\<A>x \<noteq>\<^sub>E x]v\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>\<exists>v[\<lambda>x O!x & \<^bold>\<A>x \<noteq>\<^sub>E x]v\<close>
+    then AOT_obtain y where \<open>[\<lambda>x O!x & \<^bold>\<A>x \<noteq>\<^sub>E x]y\<close>
+      using "\<exists>E"[rotated] "&E" by blast
+    AOT_hence 0: \<open>O!y & \<^bold>\<A>y \<noteq>\<^sub>E y\<close>
+      by (rule "\<beta>\<rightarrow>C"(1))
+    AOT_have \<open>\<^bold>\<A>\<not>(y =\<^sub>E y)\<close>
+      apply (AOT_subst  \<open>\<not>(y =\<^sub>E y)\<close> \<open>y \<noteq>\<^sub>E y\<close>)
+       apply (meson "\<equiv>E"(2) "Commutativity of \<equiv>" "thm-neg=E")
+      by (fact 0[THEN "&E"(2)])
+    AOT_hence \<open>\<not>(y =\<^sub>E y)\<close>
+      by (metis "\<not>\<not>I" "Act-Sub:1" "id-act2:1" "\<equiv>E"(4))
+    moreover AOT_have \<open>y =\<^sub>E y\<close>
+      by (metis 0[THEN "&E"(1)] "ord=Eequiv:1" "\<rightarrow>E")
+    ultimately AOT_show \<open>p & \<not>p\<close> for p
+      by (metis "raa-cor:3")
+  qed
+  AOT_have \<open>Numbers(0, [\<lambda>y \<^bold>\<A>[\<lambda>x O!x & x \<noteq>\<^sub>E x]y])\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"])
+     apply (rule "num-def:2"[unvarify G]; "cqt:2")
+    apply (rule "eq-num:3"[unvarify G])
+    by "cqt:2[lambda]"
+  AOT_hence numbers0: \<open>Numbers(0, [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x])\<close>
+  proof (rule "num-tran:3"[unvarify x G H, THEN "\<rightarrow>E", THEN "\<equiv>E"(1), rotated 4])
+    AOT_show \<open>[\<lambda>y \<^bold>\<A>[\<lambda>x O!x & x \<noteq>\<^sub>E x]y] \<equiv>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]\<close>
+    proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ordinary.GEN "\<rightarrow>I" "cqt:2")
+      fix u
+      AOT_have \<open>[\<lambda>y \<^bold>\<A>[\<lambda>x O!x & x \<noteq>\<^sub>E x]y]u \<equiv> \<^bold>\<A>[\<lambda>x O!x & x \<noteq>\<^sub>E x]u\<close>
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2[lambda]")
+      also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(O!u & u \<noteq>\<^sub>E u)\<close>
+        apply (AOT_subst \<open>[\<lambda>x O!x & x \<noteq>\<^sub>E x]u\<close> \<open>O!u & u \<noteq>\<^sub>E u\<close>)
+         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2[lambda]")
+        by (simp add: "oth-class-taut:3:a")
+      also AOT_have \<open>\<dots> \<equiv> (\<^bold>\<A>O!u & \<^bold>\<A>u \<noteq>\<^sub>E u)\<close>
+        by (simp add: "Act-Basic:2")
+      also AOT_have \<open>\<dots> \<equiv> (O!u & \<^bold>\<A>u \<noteq>\<^sub>E u)\<close>
+        by (metis Ordinary.\<psi> "&I" "&E"(2) "\<rightarrow>I" "\<equiv>I" "\<equiv>E"(1) "oa-facts:7")
+      also AOT_have \<open>\<dots> \<equiv> [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]u\<close>
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E", symmetric]; "cqt:2[lambda]")
+      finally AOT_show \<open>[\<lambda>y \<^bold>\<A>[\<lambda>x O!x & x \<noteq>\<^sub>E x]y]u \<equiv> [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]u\<close>.
+    qed
+  qed(fact "zero:2" | "cqt:2")+
+  show ?thesis
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>\<not>\<exists>u [F]u\<close>
+    moreover AOT_have \<open>\<not>\<exists>v [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]v\<close>
+      using unotEu_act_ord.
+    ultimately AOT_have 0: \<open>F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]\<close>
+      by (rule "empty-approx:1"[unvarify H, THEN "\<rightarrow>E", rotated, OF "&I"]) "cqt:2"
+    AOT_thus \<open>Numbers(0, F)\<close>
+      by (rule "num-tran:1"[unvarify x H, THEN "\<rightarrow>E",
+                            THEN "\<equiv>E"(2), rotated, rotated])
+         (fact "zero:2" numbers0 | "cqt:2[lambda]")+
+  next
+    AOT_assume \<open>Numbers(0, F)\<close>
+    AOT_hence 1: \<open>F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]\<close>
+      by (rule "num-tran:2"[unvarify x H, THEN "\<rightarrow>E", rotated 2, OF "&I"])
+         (fact numbers0 "zero:2" | "cqt:2[lambda]")+
+    AOT_show \<open>\<not>\<exists>u [F]u\<close>
+    proof(rule "raa-cor:2")
+      AOT_have 0: \<open>[\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]\<down>\<close> by "cqt:2[lambda]"
+      AOT_assume \<open>\<exists>u [F]u\<close>
+      AOT_hence \<open>\<not>(F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x])\<close>
+        by (rule "empty-approx:2"[unvarify H, OF 0, THEN "\<rightarrow>E", OF "&I"])
+           (rule unotEu_act_ord)
+      AOT_thus \<open>F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x] & \<not>(F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x])\<close> 
+        using 1 "&I" by blast
+    qed
+  qed
+qed
+
+AOT_theorem "0F:2": \<open>\<not>\<exists>u \<^bold>\<A>[F]u \<equiv> #F = 0\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<not>\<exists>u \<^bold>\<A>[F]u\<close>
+  AOT_have \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+    then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
+      using "Ordinary.\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
+      by (metis "betaC:1:a")
+    AOT_hence \<open>\<exists>u \<^bold>\<A>[F]u\<close>
+      by (rule "Ordinary.\<exists>I")
+    AOT_thus \<open>\<exists>u \<^bold>\<A>[F]u & \<not>\<exists>u \<^bold>\<A>[F]u\<close>
+      using 0 "&I" by blast
+  qed
+  AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
+    by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)]) "cqt:2"
+  AOT_hence \<open>0 = #F\<close>
+    by (rule "eq-num:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)])
+  AOT_thus \<open>#F = 0\<close> using id_sym by blast
+next
+  AOT_assume \<open>#F = 0\<close>
+  AOT_hence \<open>0 = #F\<close> using id_sym by blast
+  AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
+    by (rule "eq-num:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)])
+  AOT_hence 0: \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+    by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(2)]) "cqt:2"
+  AOT_show \<open>\<not>\<exists>u \<^bold>\<A>[F]u\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>\<exists>u \<^bold>\<A>[F]u\<close>
+    then AOT_obtain u where \<open>\<^bold>\<A>[F]u\<close>
+      using "Ordinary.\<exists>E"[rotated] by meson
+    AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C" "cqt:2")
+    AOT_hence \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+      using "Ordinary.\<exists>I" by blast
+    AOT_thus \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u & \<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+      using "&I" 0 by blast
+  qed
+qed
+
+AOT_theorem "0F:3": \<open>\<box>\<not>\<exists>u [F]u \<rightarrow> #F = 0\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>\<not>\<exists>u [F]u\<close>
+  AOT_hence 0: \<open>\<not>\<diamond>\<exists>u [F]u\<close>
+    using "KBasic2:1" "\<equiv>E"(1) by blast
+  AOT_have \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
+    then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
+      using "Ordinary.\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
+      by (metis "betaC:1:a")
+    AOT_hence \<open>\<diamond>[F]u\<close>
+      by (metis "Act-Sub:3" "\<rightarrow>E")
+    AOT_hence \<open>\<exists>u \<diamond>[F]u\<close>
+      by (rule "Ordinary.\<exists>I")
+    AOT_hence \<open>\<diamond>\<exists>u [F]u\<close>
+      using "Ordinary.res-var-bound-reas[CBF\<diamond>]"[THEN "\<rightarrow>E"] by blast
+    AOT_thus \<open>\<diamond>\<exists>u [F]u & \<not>\<diamond>\<exists>u [F]u\<close>
+      using 0 "&I" by blast
+  qed
+  AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
+    by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)]) "cqt:2"
+  AOT_hence \<open>0 = #F\<close>
+    by (rule "eq-num:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)])
+  AOT_thus \<open>#F = 0\<close> using id_sym by blast
+qed
+
+AOT_theorem "0F:4": \<open>w \<Turnstile> \<not>\<exists>u [F]u \<equiv> #[F]\<^sub>w = 0\<close>
+proof (rule "rule-id-df:2:b"[OF "w-index", where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
+  AOT_show \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [F]x\<^sub>1...x\<^sub>n]\<down>\<close>
+    by (simp add: "w-rel:3")
+next
+  AOT_show \<open>w \<Turnstile> \<not>\<exists>u [F]u \<equiv> #[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
+  proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume \<open>w \<Turnstile> \<not>\<exists>u [F]u\<close>
+    AOT_hence 0: \<open>\<not>w \<Turnstile> \<exists>u [F]u\<close>
+      using "coherent:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+    AOT_have \<open>\<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
+    proof(rule "raa-cor:2")
+      AOT_assume \<open>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
+      then AOT_obtain u where \<open>\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
+        using "Ordinary.\<exists>E"[rotated] by meson
+      AOT_hence \<open>\<^bold>\<A>w \<Turnstile> [F]u\<close>
+        by (AOT_subst (reverse) \<open>w \<Turnstile> [F]u\<close> \<open>[\<lambda>x w \<Turnstile> [F]x]u\<close>;
+            safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "w-rel:1"[THEN "\<rightarrow>E"])
+           "cqt:2"
+      AOT_hence 1: \<open>w \<Turnstile> [F]u\<close>
+        using "rigid-truth-at:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
+        by blast
+      AOT_have \<open>\<box>([F]u \<rightarrow> \<exists>u [F]u)\<close>
+        using "Ordinary.\<exists>I" "\<rightarrow>I" RN by simp
+      AOT_hence \<open>w \<Turnstile> ([F]u \<rightarrow> \<exists>u [F]u)\<close>
+        using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
+              "PossibleWorld.\<forall>E" by fast
+      AOT_hence \<open>w \<Turnstile> \<exists>u [F]u\<close>
+        using 1 "conj-dist-w:2"[unvarify p q, OF "log-prop-prop:2",
+                                OF "log-prop-prop:2", THEN "\<equiv>E"(1),
+                                THEN "\<rightarrow>E"] by blast
+      AOT_thus \<open>w \<Turnstile> \<exists>u [F]u & \<not>w \<Turnstile> \<exists>u [F]u\<close>
+        using 0 "&I" by blast
+    qed
+    AOT_thus \<open>#[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
+      by (safe intro!: "0F:2"[unvarify F, THEN "\<equiv>E"(1)] "w-rel:1"[THEN "\<rightarrow>E"])
+         "cqt:2"
+  next
+    AOT_assume \<open>#[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
+    AOT_hence 0: \<open>\<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
+      by (safe intro!: "0F:2"[unvarify F, THEN "\<equiv>E"(2)] "w-rel:1"[THEN "\<rightarrow>E"])
+         "cqt:2"
+    AOT_have \<open>\<not>w \<Turnstile> \<exists>u [F]u\<close>
+    proof (rule "raa-cor:2")
+      AOT_assume \<open>w \<Turnstile> \<exists>u [F]u\<close>
+      AOT_hence \<open>\<exists>x w \<Turnstile> (O!x & [F]x)\<close>
+        using "conj-dist-w:6"[THEN "\<equiv>E"(1)] by fast
+      then AOT_obtain x where \<open>w \<Turnstile> (O!x & [F]x)\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence \<open>w \<Turnstile> O!x\<close> and Fx_in_w: \<open>w \<Turnstile> [F]x\<close>
+        using "conj-dist-w:1"[unvarify p q] "\<equiv>E"(1) "log-prop-prop:2"
+              "&E" by blast+
+      AOT_hence \<open>\<diamond>O!x\<close>
+        using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
+              "PossibleWorld.\<exists>I" by simp
+      AOT_hence ord_x: \<open>O!x\<close>
+        using "oa-facts:3"[THEN "\<rightarrow>E"] by blast
+      AOT_have \<open>\<^bold>\<A>w \<Turnstile> [F]x\<close>
+        using "rigid-truth-at:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
+              Fx_in_w by blast
+      AOT_hence \<open>\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x\<close>
+        by (AOT_subst \<open>[\<lambda>x w \<Turnstile> [F]x]x\<close> \<open>w \<Turnstile> [F]x\<close>;
+            safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "w-rel:1"[THEN "\<rightarrow>E"]) "cqt:2"
+      AOT_hence \<open>O!x & \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x\<close>
+        using ord_x "&I" by blast
+      AOT_hence \<open>\<exists>x (O!x & \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x)\<close>
+        using "\<exists>I" by fast
+      AOT_thus \<open>\<exists>u (\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u) & \<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
+        using 0 "&I" by blast
+    qed
+    AOT_thus \<open>w \<Turnstile> \<not>\<exists>u[F]u\<close>
+      using "coherent:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)] by blast
+  qed
+qed
+
+AOT_act_theorem "zero=:1":
+  \<open>NaturalCardinal(x) \<rightarrow> \<forall>F (x[F] \<equiv> Numbers(x, F))\<close>
+proof(safe intro!: "\<rightarrow>I" GEN)
+  fix F
+  AOT_assume \<open>NaturalCardinal(x)\<close>
+  AOT_hence \<open>\<forall>F (x[F] \<equiv> x = #F)\<close>
+    by (metis "card-en" "\<rightarrow>E")
+  AOT_hence 1: \<open>x[F] \<equiv> x = #F\<close>
+    using "\<forall>E"(2) by blast
+  AOT_have 2: \<open>x[F] \<equiv> x = \<^bold>\<iota>y(Numbers(y, F))\<close>
+    by (rule "num-def:1"[THEN "=\<^sub>d\<^sub>fE"(1)])
+       (auto simp: 1 "num-uniq")
+  AOT_have \<open>x = \<^bold>\<iota>y(Numbers(y, F)) \<rightarrow> Numbers(x, F)\<close>
+    using "y-in:1" by blast
+  moreover AOT_have \<open>Numbers(x, F) \<rightarrow> x = \<^bold>\<iota>y(Numbers(y, F))\<close>
+  proof(rule "\<rightarrow>I")
+    AOT_assume 1: \<open>Numbers(x, F)\<close>
+    moreover AOT_obtain z where z_prop: \<open>\<forall>y (Numbers(y, F) \<rightarrow> y = z)\<close>
+      using "num:2"[THEN "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"]] "\<exists>E"[rotated] "&E" by blast
+    ultimately AOT_have \<open>x = z\<close>
+      using "\<forall>E"(2) "\<rightarrow>E" by blast
+    AOT_hence \<open>\<forall>y (Numbers(y, F) \<rightarrow> y = x)\<close>
+      using z_prop "rule=E" id_sym by fast
+    AOT_thus \<open>x = \<^bold>\<iota>y(Numbers(y,F))\<close>
+      by (rule hintikka[THEN "\<equiv>E"(2), OF "&I", rotated])
+         (fact 1)
+  qed
+  ultimately AOT_have \<open>x = \<^bold>\<iota>y(Numbers(y, F)) \<equiv> Numbers(x, F)\<close>
+    by (metis "\<equiv>I")
+  AOT_thus \<open>x[F] \<equiv> Numbers(x, F)\<close>
+    using 2 by (metis "\<equiv>E"(5))
+qed
+
+AOT_act_theorem "zero=:2": \<open>0[F] \<equiv> \<not>\<exists>u[F]u\<close>
+proof -
+  AOT_have \<open>0[F] \<equiv> Numbers(0, F)\<close>
+    using "zero=:1"[unvarify x, OF "zero:2", THEN "\<rightarrow>E",
+                    OF "zero-card", THEN "\<forall>E"(2)].
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<exists>u[F]u\<close>
+    using "0F:1"[symmetric].
+  finally show ?thesis.
+qed
+
+AOT_act_theorem "zero=:3": \<open>\<not>\<exists>u[F]u \<equiv> #F = 0\<close>
+proof -
+  AOT_have \<open>\<not>\<exists>u[F]u \<equiv> 0[F]\<close> using "zero=:2"[symmetric].
+  also AOT_have \<open>\<dots> \<equiv> 0 = #F\<close>
+    using "card-en"[unvarify x, OF "zero:2", THEN "\<rightarrow>E",
+                    OF "zero-card", THEN "\<forall>E"(2)].
+  also AOT_have \<open>\<dots> \<equiv> #F = 0\<close>
+    by (simp add: "deduction-theorem" id_sym "\<equiv>I")
+  finally show ?thesis.
+qed
+
+AOT_define Hereditary :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Hereditary'(_,_')\<close>)
+  "hered:1":
+  \<open>Hereditary(F, R) \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & \<forall>x\<forall>y([R]xy \<rightarrow> ([F]x \<rightarrow> [F]y))\<close>
+
+AOT_theorem "hered:2":
+  \<open>[\<lambda>xy \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)]\<down>\<close>
+  by "cqt:2[lambda]"
+
+AOT_define StrongAncestral :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> (\<open>_\<^sup>*\<close>)
+  "ances-df":
+  \<open>R\<^sup>* =\<^sub>d\<^sub>f [\<lambda>xy \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)]\<close>
+
+AOT_theorem "ances":
+  \<open>[R\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "ances-df"])
+   apply "cqt:2[lambda]"
+  apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF "hered:2", unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
+                            where \<tau>=\<open>(_,_)\<close>, simplified])
+  by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+
+AOT_theorem "anc-her:1":
+  \<open>[R]xy \<rightarrow> [R\<^sup>*]xy\<close>
+proof (safe intro!: "\<rightarrow>I" ances[THEN "\<equiv>E"(2)] GEN)
+  fix F
+  AOT_assume \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F, R)\<close>
+  AOT_hence \<open>[R]xy \<rightarrow> [F]y\<close>
+    using "\<forall>E"(2) "&E" by blast
+  moreover AOT_assume \<open>[R]xy\<close>
+  ultimately AOT_show \<open>[F]y\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "anc-her:2":
+  \<open>([R\<^sup>*]xy & \<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y\<close>
+proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
+  AOT_assume \<open>[R\<^sup>*]xy\<close>
+  AOT_hence \<open>(\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y\<close>
+    using ances[THEN "\<equiv>E"(1)] "\<forall>E"(2) by blast
+  moreover AOT_assume \<open>\<forall>z([R]xz \<rightarrow> [F]z)\<close>
+  moreover AOT_assume \<open>Hereditary(F,R)\<close>
+  ultimately AOT_show \<open>[F]y\<close>
+    using "\<rightarrow>E" "&I" by blast
+qed
+
+AOT_theorem "anc-her:3":
+  \<open>([F]x & [R\<^sup>*]xy & Hereditary(F, R)) \<rightarrow> [F]y\<close>
+proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
+  AOT_assume 1: \<open>[F]x\<close>
+  AOT_assume 2: \<open>Hereditary(F, R)\<close>
+  AOT_hence 3: \<open>\<forall>x \<forall>y ([R]xy \<rightarrow> ([F]x \<rightarrow> [F]y))\<close>
+    using "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_have \<open>\<forall>z ([R]xz \<rightarrow> [F]z)\<close>
+  proof (rule GEN; rule "\<rightarrow>I")
+    fix z
+    AOT_assume \<open>[R]xz\<close>
+    moreover AOT_have \<open>[R]xz \<rightarrow> ([F]x \<rightarrow> [F]z)\<close>
+      using 3 "\<forall>E"(2) by blast
+    ultimately AOT_show \<open>[F]z\<close>
+      using 1 "\<rightarrow>E" by blast
+  qed
+  moreover AOT_assume \<open>[R\<^sup>*]xy\<close>
+  ultimately AOT_show \<open>[F]y\<close>
+    by (auto intro!: 2 "anc-her:2"[THEN "\<rightarrow>E"] "&I")
+qed
+
+AOT_theorem "anc-her:4": \<open>([R]xy & [R\<^sup>*]yz) \<rightarrow> [R\<^sup>*]xz\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>[R\<^sup>*]yz\<close> and 1: \<open>[R]xy\<close>
+  AOT_show \<open>[R\<^sup>*]xz\<close>
+  proof(safe intro!: ances[THEN "\<equiv>E"(2)] GEN "&I" "\<rightarrow>I";
+                     frule "&E"(1); drule "&E"(2))
+    fix F
+    AOT_assume \<open>\<forall>z ([R]xz \<rightarrow> [F]z)\<close>
+    AOT_hence 1: \<open>[F]y\<close>
+      using 1 "\<forall>E"(2) "\<rightarrow>E" by blast
+    AOT_assume 2: \<open>Hereditary(F,R)\<close>
+    AOT_show \<open>[F]z\<close>
+      by (rule "anc-her:3"[THEN "\<rightarrow>E"]; auto intro!: "&I" 1 2 0)
+  qed
+qed
+
+AOT_theorem "anc-her:5": \<open>[R\<^sup>*]xy \<rightarrow> \<exists>z [R]zy\<close>
+proof (rule "\<rightarrow>I")
+  AOT_have 0: \<open>[\<lambda>y \<exists>x [R]xy]\<down>\<close> by "cqt:2"
+  AOT_assume 1: \<open>[R\<^sup>*]xy\<close>
+  AOT_have \<open>[\<lambda>y\<exists>x [R]xy]y\<close>
+  proof(rule "anc-her:2"[unvarify F, OF 0, THEN "\<rightarrow>E"];
+        safe intro!: "&I" GEN "\<rightarrow>I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2" 0)
+    AOT_show \<open>[R\<^sup>*]xy\<close> using 1.
+  next
+    fix z
+    AOT_assume \<open>[R]xz\<close>
+    AOT_hence \<open>\<exists>x [R]xz\<close> by (rule "\<exists>I")
+    AOT_thus \<open>[\<lambda>y\<exists>x [R]xy]z\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+  next
+    fix x y
+    AOT_assume \<open>[R]xy\<close>
+    AOT_hence \<open>\<exists>x [R]xy\<close> by (rule "\<exists>I")
+    AOT_thus \<open>[\<lambda>y \<exists>x [R]xy]y\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+  qed
+  AOT_thus \<open>\<exists>z [R]zy\<close>
+    by (rule "\<beta>\<rightarrow>C"(1))
+qed
+
+AOT_theorem "anc-her:6": \<open>([R\<^sup>*]xy & [R\<^sup>*]yz) \<rightarrow> [R\<^sup>*]xz\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>[R\<^sup>*]xy\<close>
+  AOT_hence \<theta>: \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F,R) \<rightarrow> [F]y\<close> for F
+    using "\<forall>E"(2)  ances[THEN "\<equiv>E"(1)] by blast
+  AOT_assume \<open>[R\<^sup>*]yz\<close>
+  AOT_hence \<xi>: \<open>\<forall>z ([R]yz \<rightarrow> [F]z) & Hereditary(F,R) \<rightarrow> [F]z\<close> for F
+    using "\<forall>E"(2) ances[THEN "\<equiv>E"(1)] by blast
+  AOT_show \<open>[R\<^sup>*]xz\<close>
+  proof (rule ances[THEN "\<equiv>E"(2)]; safe intro!: GEN "\<rightarrow>I")
+    fix F
+    AOT_assume \<zeta>: \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F,R)\<close>
+    AOT_show \<open>[F]z\<close>
+    proof (rule \<xi>[THEN "\<rightarrow>E", OF "&I"])
+      AOT_show \<open>Hereditary(F,R)\<close>
+        using \<zeta>[THEN "&E"(2)].
+    next
+      AOT_show \<open>\<forall>z ([R]yz \<rightarrow> [F]z)\<close>
+      proof(rule GEN; rule "\<rightarrow>I")
+        fix z
+        AOT_assume \<open>[R]yz\<close>
+        moreover AOT_have \<open>[F]y\<close>
+          using \<theta>[THEN "\<rightarrow>E", OF \<zeta>].
+        ultimately AOT_show \<open>[F]z\<close>
+          using \<zeta>[THEN "&E"(2), THEN "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                  THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<forall>E"(2),
+                  THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+          by blast
+      qed
+    qed
+  qed
+qed
+
+AOT_define OneToOne :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>1-1'(_')\<close>)
+  "df-1-1:1": \<open>1-1(R) \<equiv>\<^sub>d\<^sub>f R\<down> & \<forall>x\<forall>y\<forall>z([R]xz & [R]yz \<rightarrow> x = y)\<close>
+
+AOT_define RigidOneToOne :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Rigid\<^sub>1\<^sub>-\<^sub>1'(_')\<close>)
+  "df-1-1:2": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<equiv>\<^sub>d\<^sub>f 1-1(R) & Rigid(R)\<close>
+
+AOT_theorem "df-1-1:3": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<rightarrow> \<box>1-1(R)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
+  AOT_hence \<open>1-1(R)\<close> and RigidR: \<open>Rigid(R)\<close>
+    using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_hence 1: \<open>[R]xz & [R]yz \<rightarrow> x = y\<close> for x y z
+    using "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2) "\<forall>E"(2) by blast
+  AOT_have 1: \<open>[R]xz & [R]yz \<rightarrow> \<box>x = y\<close> for x y z
+    by (AOT_subst (reverse) \<open>\<box>x = y\<close>  \<open>x = y\<close>)
+       (auto simp: 1 "id-nec:2" "\<equiv>I" "qml:2"[axiom_inst])
+  AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
+    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF RigidR] "&E" by blast
+  AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
+    using "CBF"[THEN "\<rightarrow>E"] by fast
+  AOT_hence \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 \<box>([R]x\<^sub>1x\<^sub>2 \<rightarrow> \<box>[R]x\<^sub>1x\<^sub>2)\<close>
+    using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence \<open>\<box>([R]xy \<rightarrow> \<box>[R]xy)\<close> for x y
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<box>(([R]xz \<rightarrow> \<box>[R]xz) & ([R]yz \<rightarrow> \<box>[R]yz))\<close> for x y z
+    by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
+  moreover AOT_have \<open>\<box>(([R]xz \<rightarrow> \<box>[R]xz) & ([R]yz \<rightarrow> \<box>[R]yz)) \<rightarrow>
+                     \<box>(([R]xz & [R]yz) \<rightarrow> \<box>([R]xz & [R]yz))\<close> for x y z
+    by (rule RM) (metis "\<rightarrow>I" "KBasic:3" "&I" "&E"(1) "&E"(2) "\<equiv>E"(2) "\<rightarrow>E")
+  ultimately AOT_have 2: \<open>\<box>(([R]xz & [R]yz) \<rightarrow> \<box>([R]xz & [R]yz))\<close> for x y z
+    using "\<rightarrow>E" by blast
+  AOT_hence 3: \<open>\<box>([R]xz & [R]yz \<rightarrow> x = y)\<close> for x y z
+    using "sc-eq-box-box:6"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF 2, OF 1] by blast
+  AOT_hence 4: \<open>\<box>\<forall>x\<forall>y\<forall>z([R]xz & [R]yz \<rightarrow> x = y)\<close>
+    by (safe intro!: GEN BF[THEN "\<rightarrow>E"] 3)
+  AOT_thus \<open>\<box>1-1(R)\<close>
+    by (AOT_subst_thm "df-1-1:1"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
+                                 OF "cqt:2[const_var]"[axiom_inst]])
+qed
+
+AOT_theorem "df-1-1:4": \<open>\<forall>R(Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<rightarrow> \<box>Rigid\<^sub>1\<^sub>-\<^sub>1(R))\<close>
+proof(rule GEN;rule "\<rightarrow>I")
+AOT_modally_strict {
+  fix R
+      AOT_assume 0: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
+      AOT_hence 1: \<open>R\<down>\<close>
+        by (meson "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "df-1-1:1" "df-1-1:2")
+      AOT_hence 2: \<open>\<box>R\<down>\<close>
+        using "exist-nec" "\<rightarrow>E" by blast
+      AOT_have 4: \<open>\<box>1-1(R)\<close>
+        using "df-1-1:3"[unvarify R, OF 1, THEN "\<rightarrow>E", OF 0].
+      AOT_have \<open>Rigid(R)\<close>
+        using 0 "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:2"] "&E" by blast
+      AOT_hence \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
+        using  "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+      AOT_hence \<open>\<box>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
+        by (metis "S5Basic:6" "\<equiv>E"(1))
+      AOT_hence \<open>\<box>Rigid(R)\<close>
+        apply (AOT_subst_def "df-rigid-rel:1")
+        using 2 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
+      AOT_thus \<open>\<box>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
+        apply (AOT_subst_def "df-1-1:2")
+        using 4 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
+}
+qed
+
+AOT_define InDomainOf :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>InDomainOf'(_,_')\<close>)
+  "df-1-1:5": \<open>InDomainOf(x, R) \<equiv>\<^sub>d\<^sub>f \<exists>y [R]xy\<close>
+
+AOT_register_rigid_restricted_type
+  RigidOneToOneRelation: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>)\<close>
+proof
+  AOT_modally_strict {
+    AOT_show \<open>\<exists>\<alpha> Rigid\<^sub>1\<^sub>-\<^sub>1(\<alpha>)\<close>
+    proof (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>(=\<^sub>E)\<guillemotright>\<close>])
+      AOT_show \<open>Rigid\<^sub>1\<^sub>-\<^sub>1((=\<^sub>E))\<close>
+      proof (safe intro!: "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                          GEN "\<rightarrow>I" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "=E[denotes]")
+        fix x y z
+        AOT_assume \<open>x =\<^sub>E z & y =\<^sub>E z\<close>
+        AOT_thus \<open>x = y\<close>
+          by (metis "rule=E" "&E"(1) "Conjunction Simplification"(2)
+                    "=E-simple:2" id_sym "\<rightarrow>E")
+      next
+        AOT_have \<open>\<forall>x\<forall>y \<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close>
+        proof(rule GEN; rule GEN)
+          AOT_show \<open>\<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close> for x y
+            by (meson RN "deduction-theorem" "id-nec3:1" "\<equiv>E"(1))
+        qed
+        AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
+          by (rule tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+        AOT_thus \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
+          using BF[THEN "\<rightarrow>E"] by fast
+      qed
+    qed(fact "=E[denotes]")
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>) \<rightarrow> \<Pi>\<down>\<close> for \<Pi>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>)\<close>
+      AOT_hence \<open>1-1(\<Pi>)\<close>
+        using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+      AOT_thus \<open>\<Pi>\<down>\<close>
+        using "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+    qed
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<forall>F(Rigid\<^sub>1\<^sub>-\<^sub>1(F) \<rightarrow> \<box>Rigid\<^sub>1\<^sub>-\<^sub>1(F))\<close>
+      by (safe intro!: GEN "df-1-1:4"[THEN "\<forall>E"(2)])
+  }
+qed
+AOT_register_variable_names
+  RigidOneToOneRelation: \<R> \<S>
+
+AOT_define IdentityRestrictedToDomain :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> (\<open>'(=\<^sub>_')\<close>)
+  "id-d-R": \<open>(=\<^sub>\<R>) =\<^sub>d\<^sub>f [\<lambda>xy \<exists>z ([\<R>]xz & [\<R>]yz)]\<close>
+
+syntax "_AOT_id_d_R_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("(_ =\<^sub>_/ _)" [50, 51, 51] 50)
+translations
+  "_AOT_id_d_R_infix \<kappa> \<Pi> \<kappa>'" ==
+  "CONST AOT_exe (CONST IdentityRestrictedToDomain \<Pi>) (\<kappa>,\<kappa>')"
+
+AOT_theorem "id-R-thm:1": \<open>x =\<^sub>\<R> y \<equiv> \<exists>z ([\<R>]xz & [\<R>]yz)\<close>
+proof -
+  AOT_have 0: \<open>[\<lambda>xy \<exists>z ([\<R>]xz & [\<R>]yz)]\<down>\<close> by "cqt:2"
+  show ?thesis
+    apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
+    apply (fact 0)
+    apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF 0, unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
+                              where \<tau>=\<open>(_,_)\<close>, simplified])
+    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+qed
+
+AOT_theorem "id-R-thm:2":
+  \<open>x =\<^sub>\<R> y \<rightarrow> (InDomainOf(x, \<R>) & InDomainOf(y, \<R>))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>x =\<^sub>\<R> y\<close>
+  AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
+    using "id-R-thm:1"[THEN "\<equiv>E"(1)] by simp
+  then AOT_obtain z where z_prop: \<open>[\<R>]xz & [\<R>]yz\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_show \<open>InDomainOf(x, \<R>) & InDomainOf(y, \<R>)\<close>
+  proof (safe intro!: "&I" "df-1-1:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    AOT_show \<open>\<exists>y [\<R>]xy\<close>
+      using z_prop[THEN "&E"(1)] "\<exists>I" by fast
+  next
+    AOT_show \<open>\<exists>z [\<R>]yz\<close>
+      using z_prop[THEN "&E"(2)] "\<exists>I" by fast
+  qed
+qed
+
+AOT_theorem "id-R-thm:3": \<open>x =\<^sub>\<R> y \<rightarrow> x = y\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>x =\<^sub>\<R> y\<close>
+  AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
+    using "id-R-thm:1"[THEN "\<equiv>E"(1)] by simp
+  then AOT_obtain z where z_prop: \<open>[\<R>]xz & [\<R>]yz\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>x = y\<close>
+    using "df-1-1:3"[THEN "\<rightarrow>E", OF RigidOneToOneRelation.\<psi>,
+                     THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+                     THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:1"], THEN "&E"(2),
+                     THEN "\<forall>E"(2), THEN "\<forall>E"(2),
+                     THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+     by blast
+qed
+
+AOT_theorem "id-R-thm:4":
+  \<open>(InDomainOf(x, \<R>) \<or> InDomainOf(y, \<R>)) \<rightarrow> (x =\<^sub>\<R> y \<equiv> x = y)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>InDomainOf(x, \<R>) \<or> InDomainOf(y, \<R>)\<close>
+  moreover {
+    AOT_assume \<open>InDomainOf(x, \<R>)\<close>
+    AOT_hence \<open>\<exists>z [\<R>]xz\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
+    then AOT_obtain z where z_prop: \<open>[\<R>]xz\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_have \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
+    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "id-R-thm:3"[THEN "\<rightarrow>E"])
+      AOT_assume \<open>x = y\<close>
+      AOT_hence \<open>[\<R>]yz\<close>
+        using z_prop "rule=E" by fast
+      AOT_hence \<open>[\<R>]xz & [\<R>]yz\<close>
+        using z_prop "&I" by blast
+      AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
+        by (rule "\<exists>I")
+      AOT_thus \<open>x =\<^sub>\<R> y\<close>
+        using "id-R-thm:1" "\<equiv>E"(2) by blast
+    qed
+  }
+  moreover {
+    AOT_assume \<open>InDomainOf(y, \<R>)\<close>
+    AOT_hence \<open>\<exists>z [\<R>]yz\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
+    then AOT_obtain z where z_prop: \<open>[\<R>]yz\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_have \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
+    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "id-R-thm:3"[THEN "\<rightarrow>E"])
+      AOT_assume \<open>x = y\<close>
+      AOT_hence \<open>[\<R>]xz\<close>
+        using z_prop "rule=E" id_sym by fast
+      AOT_hence \<open>[\<R>]xz & [\<R>]yz\<close>
+        using z_prop "&I" by blast
+      AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
+        by (rule "\<exists>I")
+      AOT_thus \<open>x =\<^sub>\<R> y\<close>
+        using "id-R-thm:1" "\<equiv>E"(2) by blast
+    qed
+  }
+  ultimately AOT_show \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
+    by (metis "\<or>E"(2) "raa-cor:1")
+qed
+
+AOT_theorem "id-R-thm:5": \<open>InDomainOf(x, \<R>) \<rightarrow> x =\<^sub>\<R> x\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>InDomainOf(x, \<R>)\<close>
+  AOT_hence \<open>\<exists>z [\<R>]xz\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
+  then AOT_obtain z where z_prop: \<open>[\<R>]xz\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>[\<R>]xz & [\<R>]xz\<close>
+    using "&I" by blast
+  AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]xz)\<close>
+    using "\<exists>I" by fast
+  AOT_thus \<open>x =\<^sub>\<R> x\<close>
+    using "id-R-thm:1" "\<equiv>E"(2) by blast
+qed
+
+AOT_theorem "id-R-thm:6": \<open>x =\<^sub>\<R> y \<rightarrow> y =\<^sub>\<R> x\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>x =\<^sub>\<R> y\<close>
+  AOT_hence 1: \<open>InDomainOf(x,\<R>) & InDomainOf(y,\<R>)\<close>
+    using "id-R-thm:2"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
+    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
+  AOT_hence \<open>x = y\<close>
+    using 0 by (metis "\<equiv>E"(1))
+  AOT_hence \<open>y = x\<close>
+    using id_sym by blast
+  moreover AOT_have \<open>y =\<^sub>\<R> x \<equiv> y = x\<close>
+    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(2)] 1 "&E" by blast
+  ultimately AOT_show \<open>y =\<^sub>\<R> x\<close>
+    by (metis "\<equiv>E"(2))
+qed
+
+AOT_theorem "id-R-thm:7": \<open>x =\<^sub>\<R> y & y =\<^sub>\<R> z \<rightarrow> x =\<^sub>\<R> z\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>x =\<^sub>\<R> y\<close>
+  AOT_hence 1: \<open>InDomainOf(x,\<R>) & InDomainOf(y,\<R>)\<close>
+    using "id-R-thm:2"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
+    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
+  AOT_hence x_eq_y: \<open>x = y\<close>
+    using 0 by (metis "\<equiv>E"(1))
+  AOT_assume 2: \<open>y =\<^sub>\<R> z\<close>
+  AOT_hence 3: \<open>InDomainOf(y,\<R>) & InDomainOf(z,\<R>)\<close>
+    using "id-R-thm:2"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>y =\<^sub>\<R> z \<equiv> y = z\<close>
+    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
+  AOT_hence \<open>y = z\<close>
+    using 2 by (metis "\<equiv>E"(1))
+  AOT_hence x_eq_z: \<open>x = z\<close>
+    using x_eq_y id_trans by blast
+  AOT_have \<open>InDomainOf(x,\<R>) & InDomainOf(z,\<R>)\<close>
+    using 1 3 "&I" "&E" by meson
+  AOT_hence \<open>x =\<^sub>\<R> z \<equiv> x = z\<close>
+    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
+  AOT_thus \<open>x =\<^sub>\<R> z\<close>
+    using x_eq_z "\<equiv>E"(2) by blast
+qed
+
+AOT_define WeakAncestral :: \<open>\<Pi> \<Rightarrow> \<Pi>\<close> (\<open>_\<^sup>+\<close>)
+  "w-ances-df": \<open>[\<R>]\<^sup>+ =\<^sub>d\<^sub>f [\<lambda>xy [\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y]\<close>
+
+AOT_theorem "w-ances-df[den1]": \<open>[\<lambda>xy [\<Pi>]\<^sup>*xy \<or> x =\<^sub>\<Pi> y]\<down>\<close>
+  by "cqt:2"
+AOT_theorem "w-ances-df[den2]": \<open>[\<Pi>]\<^sup>+\<down>\<close>
+  using "w-ances-df[den1]" "=\<^sub>d\<^sub>fI"(1)[OF "w-ances-df"] by blast
+
+AOT_theorem "w-ances": \<open>[\<R>]\<^sup>+xy \<equiv> ([\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y)\<close>
+proof -
+  AOT_have 0: \<open>[\<lambda>xy [\<R>\<^sup>*]xy \<or> x =\<^sub>\<R> y]\<down>\<close>
+    by "cqt:2"
+  AOT_have 1: \<open>\<guillemotleft>(AOT_term_of_var x,AOT_term_of_var y)\<guillemotright>\<down>\<close>
+    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+  have 2: \<open>\<guillemotleft>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n [\<R>\<^sup>*]\<mu>\<^sub>1...\<mu>\<^sub>n \<or> [(=\<^sub>\<R>)]\<mu>\<^sub>1...\<mu>\<^sub>n]xy\<guillemotright> =
+           \<guillemotleft>[\<lambda>xy [\<R>\<^sup>*]xy \<or> [(=\<^sub>\<R>)]xy]xy\<guillemotright>\<close>
+    by (simp add: cond_case_prod_eta)
+  show ?thesis
+    apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "w-ances-df"])
+     apply (fact "w-ances-df[den1]")
+    using "beta-C-meta"[THEN "\<rightarrow>E", OF 0, unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
+                        where \<tau>=\<open>(_,_)\<close>, simplified, OF 1] 2 by simp
+qed
+
+AOT_theorem "w-ances-her:1": \<open>[\<R>]xy \<rightarrow> [\<R>]\<^sup>+xy\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>[\<R>]xy\<close>
+  AOT_hence \<open>[\<R>]\<^sup>*xy\<close>
+    using "anc-her:1"[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>[\<R>]\<^sup>+xy\<close>
+    using "w-ances"[THEN "\<equiv>E"(2)] "\<or>I" by blast
+qed
+
+AOT_theorem "w-ances-her:2":
+  \<open>[F]x & [\<R>]\<^sup>+xy & Hereditary(F, \<R>) \<rightarrow> [F]y\<close>
+proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
+  AOT_assume 0: \<open>[F]x\<close>
+  AOT_assume 1: \<open>Hereditary(F, \<R>)\<close>
+  AOT_assume \<open>[\<R>]\<^sup>+xy\<close>
+  AOT_hence \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y\<close>
+    using "w-ances"[THEN "\<equiv>E"(1)] by simp
+  moreover {
+    AOT_assume \<open>[\<R>]\<^sup>*xy\<close>
+    AOT_hence \<open>[F]y\<close>
+      using "anc-her:3"[THEN "\<rightarrow>E", OF "&I", OF "&I"] 0 1 by blast
+  }
+  moreover {
+    AOT_assume \<open>x =\<^sub>\<R> y\<close>
+    AOT_hence \<open>x = y\<close>
+      using "id-R-thm:3"[THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>[F]y\<close>
+      using 0 "rule=E" by blast
+  }
+  ultimately AOT_show \<open>[F]y\<close>
+    by (metis "\<or>E"(3) "raa-cor:1")
+qed
+
+AOT_theorem "w-ances-her:3": \<open>([\<R>]\<^sup>+xy & [\<R>]yz) \<rightarrow> [\<R>]\<^sup>*xz\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>[\<R>]\<^sup>+xy\<close>
+  moreover AOT_assume Ryz: \<open>[\<R>]yz\<close>
+  ultimately AOT_have \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y\<close>
+    using "w-ances"[THEN "\<equiv>E"(1)] by metis
+  moreover {
+    AOT_assume R_star_xy: \<open>[\<R>]\<^sup>*xy\<close>
+    AOT_have \<open>[\<R>]\<^sup>*xz\<close>
+    proof (safe intro!: ances[THEN "\<equiv>E"(2)] "\<rightarrow>I" GEN)
+      fix F
+      AOT_assume 0: \<open>\<forall>z ([\<R>]xz \<rightarrow> [F]z) & Hereditary(F,\<R>)\<close>
+      AOT_hence \<open>[F]y\<close>
+        using R_star_xy ances[THEN "\<equiv>E"(1), OF R_star_xy,
+                              THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+      AOT_thus \<open>[F]z\<close>
+        using "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 0[THEN "&E"(2)], THEN "&E"(2)]
+              "\<forall>E"(2) "\<rightarrow>E" Ryz by blast
+    qed
+  }
+  moreover {
+    AOT_assume \<open>x =\<^sub>\<R> y\<close>
+    AOT_hence \<open>x = y\<close>
+      using "id-R-thm:3"[THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>[\<R>]xz\<close>
+      using Ryz "rule=E" id_sym by fast
+    AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
+      by (metis "anc-her:1"[THEN "\<rightarrow>E"])
+  }
+  ultimately AOT_show \<open>[\<R>]\<^sup>*xz\<close>
+    by (metis "\<or>E"(3) "raa-cor:1")
+qed
+
+AOT_theorem "w-ances-her:4": \<open>([\<R>]\<^sup>*xy & [\<R>]yz) \<rightarrow> [\<R>]\<^sup>+xz\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>[\<R>]\<^sup>*xy\<close>
+  AOT_hence \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y\<close>
+    using "\<or>I" by blast
+  AOT_hence \<open>[\<R>]\<^sup>+xy\<close>
+    using "w-ances"[THEN "\<equiv>E"(2)] by blast
+  moreover AOT_assume \<open>[\<R>]yz\<close>
+  ultimately AOT_have \<open>[\<R>]\<^sup>*xz\<close>
+    using "w-ances-her:3"[THEN "\<rightarrow>E", OF "&I"] by simp
+  AOT_hence \<open>[\<R>]\<^sup>*xz \<or> x =\<^sub>\<R> z\<close>
+    using "\<or>I" by blast
+  AOT_thus \<open>[\<R>]\<^sup>+xz\<close>
+    using "w-ances"[THEN "\<equiv>E"(2)] by blast
+qed
+
+AOT_theorem "w-ances-her:5": \<open>([\<R>]xy & [\<R>]\<^sup>+yz) \<rightarrow> [\<R>]\<^sup>*xz\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>[\<R>]xy\<close>
+  AOT_assume \<open>[\<R>]\<^sup>+yz\<close>
+  AOT_hence \<open>[\<R>]\<^sup>*yz \<or> y =\<^sub>\<R> z\<close>
+    by (metis "\<equiv>E"(1) "w-ances")
+  moreover {
+    AOT_assume \<open>[\<R>]\<^sup>*yz\<close>
+    AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
+      using 0 by (metis "anc-her:4" Adjunction "\<rightarrow>E")
+  }
+  moreover {
+    AOT_assume \<open>y =\<^sub>\<R> z\<close>
+    AOT_hence \<open>y = z\<close>
+      by (metis "id-R-thm:3" "\<rightarrow>E")
+    AOT_hence \<open>[\<R>]xz\<close>
+      using 0 "rule=E" by fast
+    AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
+      by (metis "anc-her:1" "\<rightarrow>E")
+  }
+  ultimately AOT_show \<open>[\<R>]\<^sup>*xz\<close> by (metis "\<or>E"(2) "reductio-aa:1")
+qed
+
+AOT_theorem "w-ances-her:6": \<open>([\<R>]\<^sup>+xy & [\<R>]\<^sup>+yz) \<rightarrow> [\<R>]\<^sup>+xz\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>[\<R>]\<^sup>+xy\<close>
+  AOT_hence 1: \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y\<close>
+    by (metis "\<equiv>E"(1) "w-ances")
+  AOT_assume 2: \<open>[\<R>]\<^sup>+yz\<close>
+  {
+    AOT_assume \<open>x =\<^sub>\<R> y\<close>
+    AOT_hence \<open>x = y\<close>
+      by (metis "id-R-thm:3" "\<rightarrow>E")
+    AOT_hence \<open>[\<R>]\<^sup>+xz\<close>
+      using 2 "rule=E" id_sym by fast
+  }
+  moreover {
+    AOT_assume \<open>\<not>(x =\<^sub>\<R> y)\<close>
+    AOT_hence 3: \<open>[\<R>]\<^sup>*xy\<close>
+      using 1 by (metis "\<or>E"(3)) 
+    AOT_have \<open>[\<R>]\<^sup>*yz \<or> y =\<^sub>\<R> z\<close>
+      using 2 by (metis "\<equiv>E"(1) "w-ances")
+    moreover {
+      AOT_assume \<open>[\<R>]\<^sup>*yz\<close>
+      AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
+        using 3 by (metis "anc-her:6" Adjunction "\<rightarrow>E")
+      AOT_hence \<open>[\<R>]\<^sup>+xz\<close>
+        by (metis "\<or>I"(1) "\<equiv>E"(2) "w-ances")
+    }
+    moreover {
+      AOT_assume \<open>y =\<^sub>\<R> z\<close>
+      AOT_hence \<open>y = z\<close>
+        by (metis "id-R-thm:3" "\<rightarrow>E")
+      AOT_hence \<open>[\<R>]\<^sup>+xz\<close>
+        using 0 "rule=E" id_sym by fast
+    }
+    ultimately AOT_have \<open>[\<R>]\<^sup>+xz\<close>
+      by (metis "\<or>E"(3) "reductio-aa:1")
+  }
+  ultimately AOT_show \<open>[\<R>]\<^sup>+xz\<close>
+    by (metis "reductio-aa:1")
+qed
+
+AOT_theorem "w-ances-her:7": \<open>[\<R>]\<^sup>*xy \<rightarrow> \<exists>z([\<R>]\<^sup>+xz & [\<R>]zy)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[\<R>]\<^sup>*xy\<close>
+  AOT_have 1: \<open>\<forall>z ([\<R>]xz \<rightarrow> [\<Pi>]z) & Hereditary(\<Pi>,\<R>) \<rightarrow> [\<Pi>]y\<close> if \<open>\<Pi>\<down>\<close> for \<Pi>
+    using ances[THEN "\<equiv>E"(1), THEN "\<forall>E"(1), OF 0] that by blast
+  AOT_have \<open>[\<lambda>y \<exists>z([\<R>]\<^sup>+xz & [\<R>]zy)]y\<close>
+  proof (rule 1[THEN "\<rightarrow>E"]; "cqt:2[lambda]"?;
+         safe intro!: "&I" GEN "\<rightarrow>I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2")
+    fix z
+    AOT_assume 0: \<open>[\<R>]xz\<close>
+    AOT_hence \<open>\<exists>z [\<R>]xz\<close> by (rule "\<exists>I")
+    AOT_hence \<open>InDomainOf(x, \<R>)\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "df-1-1:5")
+    AOT_hence \<open>x =\<^sub>\<R> x\<close> by (metis "id-R-thm:5" "\<rightarrow>E")
+    AOT_hence \<open>[\<R>]\<^sup>+xx\<close> by (metis "\<or>I"(2) "\<equiv>E"(2) "w-ances")
+    AOT_hence \<open>[\<R>]\<^sup>+xx & [\<R>]xz\<close> using 0 "&I" by blast
+    AOT_hence \<open>\<exists>y ([\<R>]\<^sup>+xy & [\<R>]yz)\<close> by (rule "\<exists>I")
+    AOT_thus \<open>[\<lambda>y \<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)]z\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+  next
+    fix x' y
+    AOT_assume Rx'y: \<open>[\<R>]x'y\<close>
+    AOT_assume \<open>[\<lambda>y \<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)]x'\<close>
+    AOT_hence \<open>\<exists>z ([\<R>]\<^sup>+xz & [\<R>]zx')\<close>
+      using "\<beta>\<rightarrow>C"(1) by blast
+    then AOT_obtain c where c_prop: \<open>[\<R>]\<^sup>+xc & [\<R>]cx'\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>[\<R>]\<^sup>*xx'\<close>
+      by (meson Rx'y "anc-her:1" "anc-her:6" Adjunction "\<rightarrow>E" "w-ances-her:3")
+    AOT_hence \<open>[\<R>]\<^sup>*xx' \<or> x =\<^sub>\<R> x'\<close> by (rule "\<or>I")
+    AOT_hence \<open>[\<R>]\<^sup>+xx'\<close> by (metis "\<equiv>E"(2) "w-ances")
+    AOT_hence \<open>[\<R>]\<^sup>+xx' & [\<R>]x'y\<close> using Rx'y by (metis "&I")
+    AOT_hence \<open>\<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)\<close> by (rule "\<exists>I")
+    AOT_thus \<open>[\<lambda>y \<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)]y\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+  qed
+  AOT_thus \<open>\<exists>z([\<R>]\<^sup>+xz & [\<R>]zy)\<close>
+    using "\<beta>\<rightarrow>C"(1) by fast
+qed
+
+AOT_theorem "1-1-R:1": \<open>([\<R>]xy & [\<R>]\<^sup>*zy) \<rightarrow> [\<R>]\<^sup>+zx\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>[\<R>]\<^sup>*zy\<close>
+  AOT_hence \<open>\<exists>x ([\<R>]\<^sup>+zx & [\<R>]xy)\<close>
+    using "w-ances-her:7"[THEN "\<rightarrow>E"] by simp
+  then AOT_obtain a where a_prop: \<open>[\<R>]\<^sup>+za & [\<R>]ay\<close>
+    using "\<exists>E"[rotated] by blast
+  moreover AOT_assume \<open>[\<R>]xy\<close>
+  ultimately AOT_have \<open>x = a\<close>
+    using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF RigidOneToOneRelation.\<psi>, THEN "&E"(1),
+                     THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:1"], THEN "&E"(2), THEN "\<forall>E"(2),
+                     THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF "&I"]
+    "&E" by blast
+  AOT_thus \<open>[\<R>]\<^sup>+zx\<close>
+    using a_prop[THEN "&E"(1)] "rule=E" id_sym by fast
+qed
+
+AOT_theorem "1-1-R:2": \<open>[\<R>]xy \<rightarrow> (\<not>[\<R>]\<^sup>*xx \<rightarrow> \<not>[\<R>]\<^sup>*yy)\<close>
+proof(rule "\<rightarrow>I"; rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[\<R>]xy\<close>
+  moreover AOT_assume \<open>[\<R>]\<^sup>*yy\<close>
+  ultimately AOT_have \<open>[\<R>]\<^sup>+yx\<close>
+    using "1-1-R:1"[THEN "\<rightarrow>E", OF "&I"] by blast
+  AOT_thus \<open>[\<R>]\<^sup>*xx\<close>
+    using 0 by (metis "&I" "\<rightarrow>E" "w-ances-her:5")
+qed
+
+AOT_theorem "1-1-R:3": \<open>\<not>[\<R>]\<^sup>*xx \<rightarrow> ([\<R>]\<^sup>+xy \<rightarrow> \<not>[\<R>]\<^sup>*yy)\<close>
+proof(safe intro!: "\<rightarrow>I")
+  AOT_have 0: \<open>[\<lambda>z \<not>[\<R>]\<^sup>*zz]\<down>\<close> by "cqt:2"
+  AOT_assume 1: \<open>\<not>[\<R>]\<^sup>*xx\<close>
+  AOT_assume 2: \<open>[\<R>]\<^sup>+xy\<close>
+  AOT_have \<open>[\<lambda>z \<not>[\<R>]\<^sup>*zz]y\<close>
+  proof(rule "w-ances-her:2"[unvarify F, OF 0, THEN "\<rightarrow>E"];
+        safe intro!: "&I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2" GEN "\<rightarrow>I")
+    AOT_show  \<open>[\<lambda>z \<not>[\<R>]\<^sup>*zz]x\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" simp: 1)
+  next
+    AOT_show \<open>[\<R>]\<^sup>+xy\<close> by (fact 2)
+  next
+    fix x y
+    AOT_assume \<open>[\<lambda>z \<not>[\<R>\<^sup>*]zz]x\<close>
+    AOT_hence \<open>\<not>[\<R>]\<^sup>*xx\<close> by (rule "\<beta>\<rightarrow>C"(1))
+    moreover AOT_assume \<open>[\<R>]xy\<close>
+    ultimately AOT_have \<open>\<not>[\<R>]\<^sup>*yy\<close>
+      using "1-1-R:2"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
+    AOT_thus \<open>[\<lambda>z \<not>[\<R>\<^sup>*]zz]y\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+  qed
+  AOT_thus \<open>\<not>[\<R>]\<^sup>*yy\<close>
+    using "\<beta>\<rightarrow>C"(1) by blast
+qed
+
+AOT_theorem "1-1-R:4": \<open>[\<R>]\<^sup>*xy \<rightarrow> InDomainOf(x,\<R>)\<close>
+proof(rule "\<rightarrow>I"; rule "df-1-1:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_assume 1: \<open>[\<R>]\<^sup>*xy\<close>
+  AOT_have \<open>[\<lambda>z [\<R>\<^sup>*]xz \<rightarrow> \<exists>y [\<R>]xy]y\<close>
+  proof (safe intro!: "anc-her:2"[unvarify F, THEN "\<rightarrow>E"];
+         safe intro!: "cqt:2" "&I" GEN "\<rightarrow>I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    AOT_show \<open>[\<R>]\<^sup>*xy\<close> by (fact 1)
+  next
+    fix z
+    AOT_assume \<open>[\<R>]xz\<close>
+    AOT_thus \<open>[\<lambda>z [\<R>\<^sup>*]xz \<rightarrow> \<exists>y [\<R>]xy]z\<close>
+      by (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+         (meson "\<rightarrow>I" "existential:2[const_var]")
+  next
+    fix x' y
+    AOT_assume Rx'y: \<open>[\<R>]x'y\<close>
+    AOT_assume \<open>[\<lambda>z [\<R>\<^sup>*]xz \<rightarrow> \<exists>y [\<R>]xy]x'\<close>
+    AOT_hence 0: \<open>[\<R>\<^sup>*]xx' \<rightarrow> \<exists>y [\<R>]xy\<close> by (rule "\<beta>\<rightarrow>C"(1))
+    AOT_have 1: \<open>[\<R>\<^sup>*]xy \<rightarrow> \<exists>y [\<R>]xy\<close>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>[\<R>]\<^sup>*xy\<close>
+      AOT_hence \<open>[\<R>]\<^sup>+xx'\<close> by (metis Rx'y "&I" "1-1-R:1" "\<rightarrow>E")
+      AOT_hence \<open>[\<R>]\<^sup>*xx' \<or> x =\<^sub>\<R> x'\<close> by (metis "\<equiv>E"(1) "w-ances")
+      moreover {
+        AOT_assume \<open>[\<R>]\<^sup>*xx'\<close>
+        AOT_hence \<open>\<exists>y [\<R>]xy\<close> using 0 by (metis "\<rightarrow>E")
+      }
+      moreover {
+        AOT_assume \<open>x =\<^sub>\<R> x'\<close>
+        AOT_hence \<open>x = x'\<close> by (metis "id-R-thm:3" "\<rightarrow>E")
+        AOT_hence \<open>[\<R>]xy\<close> using Rx'y "rule=E" id_sym by fast
+        AOT_hence \<open>\<exists>y [\<R>]xy\<close> by (rule "\<exists>I")
+      }
+      ultimately AOT_show \<open>\<exists>y [\<R>]xy\<close>
+        by (metis "\<or>E"(3) "reductio-aa:1")
+    qed
+    AOT_show \<open>[\<lambda>z [\<R>\<^sup>*]xz \<rightarrow> \<exists>y [\<R>]xy]y\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" 1)
+  qed
+  AOT_hence \<open>[\<R>\<^sup>*]xy \<rightarrow> \<exists>y [\<R>]xy\<close> by (rule "\<beta>\<rightarrow>C"(1))
+  AOT_thus \<open>\<exists>y [\<R>]xy\<close> using 1 "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "1-1-R:5": \<open>[\<R>]\<^sup>+xy \<rightarrow> InDomainOf(x,\<R>)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>[\<R>]\<^sup>+xy\<close>
+  AOT_hence \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>\<R> y\<close>
+    by (metis "\<equiv>E"(1) "w-ances")
+  moreover {
+    AOT_assume \<open>[\<R>]\<^sup>*xy\<close>
+    AOT_hence \<open>InDomainOf(x,\<R>)\<close>
+      using "1-1-R:4" "\<rightarrow>E" by blast
+  }
+  moreover {
+    AOT_assume \<open>x =\<^sub>\<R> y\<close>
+    AOT_hence \<open>InDomainOf(x,\<R>)\<close>
+      by (metis "Conjunction Simplification"(1) "id-R-thm:2" "\<rightarrow>E")
+  }
+  ultimately AOT_show \<open>InDomainOf(x,\<R>)\<close>
+    by (metis "\<or>E"(3) "reductio-aa:1")
+qed
+
+AOT_theorem "pre-ind":
+  \<open>([F]z & \<forall>x\<forall>y(([\<R>]\<^sup>+zx & [\<R>]\<^sup>+zy) \<rightarrow> ([\<R>]xy \<rightarrow> ([F]x \<rightarrow> [F]y)))) \<rightarrow>
+   \<forall>x ([\<R>]\<^sup>+zx \<rightarrow> [F]x)\<close>
+proof(safe intro!: "\<rightarrow>I" GEN)
+  AOT_have den: \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]\<down>\<close> by "cqt:2"
+  fix x
+  AOT_assume \<theta>: \<open>[F]z & \<forall>x\<forall>y(([\<R>]\<^sup>+zx & [\<R>]\<^sup>+zy) \<rightarrow> ([\<R>]xy \<rightarrow> ([F]x \<rightarrow> [F]y)))\<close>
+  AOT_assume 0: \<open>[\<R>]\<^sup>+zx\<close>
+
+  AOT_have \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]x\<close>
+  proof (rule "w-ances-her:2"[unvarify F, OF den, THEN "\<rightarrow>E"]; safe intro!: "&I")
+    AOT_show \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]z\<close>
+    proof (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I")
+      AOT_show \<open>[F]z\<close> using \<theta> "&E" by blast
+    next
+      AOT_show \<open>[\<R>]\<^sup>+zz\<close>
+        by (rule "w-ances"[THEN "\<equiv>E"(2), OF "\<or>I"(2)])
+           (meson "0" "id-R-thm:5" "1-1-R:5" "\<rightarrow>E")
+    qed
+  next
+    AOT_show \<open>[\<R>]\<^sup>+zx\<close> by (fact 0)
+  next
+    AOT_show \<open>Hereditary([\<lambda>y [F]y & [\<R>]\<^sup>+zy],\<R>)\<close>
+    proof (safe intro!: "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I")
+      fix x' y
+      AOT_assume 1: \<open>[\<R>]x'y\<close>
+      AOT_assume \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]x'\<close>
+      AOT_hence 2: \<open>[F]x' & [\<R>]\<^sup>+zx'\<close> by (rule "\<beta>\<rightarrow>C"(1))
+      AOT_have \<open>[\<R>]\<^sup>*zy\<close> using 1 2[THEN "&E"(2)]
+        by (metis Adjunction "modus-tollens:1" "reductio-aa:1" "w-ances-her:3")
+      AOT_hence 3: \<open>[\<R>]\<^sup>+zy\<close> by (metis "\<or>I"(1) "\<equiv>E"(2) "w-ances")
+      AOT_show \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]y\<close>
+      proof (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" 3)
+        AOT_show \<open>[F]y\<close>
+        proof (rule \<theta>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<forall>E"(2),
+                      THEN "\<rightarrow>E", THEN "\<rightarrow>E", THEN "\<rightarrow>E"])
+          AOT_show \<open>[\<R>]\<^sup>+zx' & [\<R>]\<^sup>+zy\<close>
+            using 2 3 "&E" "&I" by blast
+        next
+          AOT_show \<open>[\<R>]x'y\<close> by (fact 1)
+        next
+          AOT_show \<open>[F]x'\<close> using 2 "&E" by blast
+        qed
+      qed
+    qed
+  qed
+  AOT_thus \<open>[F]x\<close> using "\<beta>\<rightarrow>C"(1) "&E"(1) by fast
+qed
+
+text\<open>The following is not part of PLM, but a theorem of AOT.
+     It states that the predecessor relation coexists with numbering a property.
+     We will use this fact to derive the predecessor axiom, which asserts that the
+     predecessor relation denotes, from the fact that our models validate that
+     numbering a property denotes.\<close>
+AOT_theorem pred_coex:
+  \<open>[\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<down> \<equiv> \<forall>F ([\<lambda>x Numbers(x,F)]\<down>)\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  fix F
+  let ?P = \<open>\<guillemotleft>[\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<guillemotright>\<close>
+  AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
+  AOT_hence \<open>\<box>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
+    using "exist-nec" "\<rightarrow>E" by blast
+  moreover AOT_have
+    \<open>\<box>[\<guillemotleft>?P\<guillemotright>]\<down> \<rightarrow> \<box>(\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (Numbers(x,F) \<equiv> Numbers(y,F))))\<close>
+  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      fix x y
+      AOT_assume pred_den: \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
+      AOT_hence pred_equiv:
+        \<open>[\<guillemotleft>?P\<guillemotright>]xy \<equiv> \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close> for x y
+        by (safe intro!: "beta-C-meta"[unvarify \<nu>\<^sub>1\<nu>\<^sub>n, where \<tau>=\<open>(_,_)\<close>, THEN "\<rightarrow>E",
+                                       rotated, OF pred_den, simplified]
+                         tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2")
+      text\<open>We show as a subproof that any natural cardinal that is not zero
+           has a predecessor.\<close>
+      AOT_have CardinalPredecessor:
+        \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close> if card_x: \<open>NaturalCardinal(x)\<close> and x_nonzero: \<open>x \<noteq> 0\<close> for x
+      proof -
+        AOT_have \<open>\<exists>G x = #G\<close>
+          using card[THEN "\<equiv>\<^sub>d\<^sub>fE", OF card_x].
+        AOT_hence \<open>\<exists>G Numbers(x,G)\<close>
+          using "eq-df-num"[THEN "\<equiv>E"(1)] by blast
+        then AOT_obtain G' where numxG': \<open>Numbers(x,G')\<close>
+          using "\<exists>E"[rotated] by blast
+        AOT_obtain G where \<open>Rigidifies(G,G')\<close>
+          using "rigid-der:3" "\<exists>E"[rotated] by blast
+      
+        AOT_hence H: \<open>Rigid(G) & \<forall>x ([G]x \<equiv> [G']x)\<close>
+          using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+        AOT_have H_rigid: \<open>\<box>\<forall>x ([G]x \<rightarrow> \<box>[G]x)\<close>
+          using H[THEN "&E"(1), THEN "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)].
+        AOT_hence \<open>\<forall>x \<box>([G]x \<rightarrow> \<box>[G]x)\<close>
+          using "CBF" "\<rightarrow>E" by blast
+        AOT_hence R: \<open>\<box>([G]x \<rightarrow> \<box>[G]x)\<close> for x using "\<forall>E"(2) by blast
+        AOT_hence rigid: \<open>[G]x \<equiv> \<^bold>\<A>[G]x\<close> for x
+           by (metis "\<equiv>E"(6) "oth-class-taut:3:a" "sc-eq-fur:2" "\<rightarrow>E")
+        AOT_have \<open>G \<equiv>\<^sub>E G'\<close>
+        proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I")
+          AOT_show \<open>[G]x \<equiv> [G']x\<close> for x using H[THEN "&E"(2)] "\<forall>E"(2) by fast
+        qed
+        AOT_hence \<open>G \<approx>\<^sub>E G'\<close>
+          by (rule "apE-eqE:2"[THEN "\<rightarrow>E", OF "&I", rotated])
+             (simp add: "eq-part:1")
+        AOT_hence numxG: \<open>Numbers(x,G)\<close>
+          using "num-tran:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2)] numxG' by blast
+      
+        {
+          AOT_assume \<open>\<not>\<exists>y(y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
+          AOT_hence \<open>\<forall>y \<not>(y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
+            using "cqt-further:4" "\<rightarrow>E" by blast
+          AOT_hence \<open>\<not>(y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close> for y
+            using "\<forall>E"(2) by blast
+          AOT_hence 0: \<open>\<not>y \<noteq> x \<or> \<not>[\<guillemotleft>?P\<guillemotright>]yx\<close> for y
+            using "\<not>\<not>E" "intro-elim:3:c" "oth-class-taut:5:a" by blast
+          {
+            fix y
+            AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]yx\<close>
+            AOT_hence \<open>\<not>y \<noteq> x\<close>
+              using 0 "\<not>\<not>I" "con-dis-i-e:4:c" by blast
+            AOT_hence \<open>y = x\<close>
+              using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "raa-cor:4" by blast
+          } note Pxy_imp_eq = this
+          AOT_have \<open>[\<guillemotleft>?P\<guillemotright>]xx\<close>
+          proof(rule "raa-cor:1")
+            AOT_assume notPxx: \<open>\<not>[\<guillemotleft>?P\<guillemotright>]xx\<close>
+            AOT_hence \<open>\<not>\<exists>F\<exists>u([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+              using pred_equiv "intro-elim:3:c" by blast
+            AOT_hence \<open>\<forall>F \<not>\<exists>u([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+              using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+            AOT_hence \<open>\<not>\<exists>u([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close> for F
+              using "\<forall>E"(2) by blast
+            AOT_hence \<open>\<forall>y \<not>(O!y & ([F]y & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>y)))\<close> for F
+              using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+            AOT_hence 0: \<open>\<not>(O!u & ([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u)))\<close> for F u
+              using "\<forall>E"(2) by blast
+            AOT_have \<open>\<box>\<not>\<exists>u [G]u\<close>
+            proof(rule "raa-cor:1")
+              AOT_assume \<open>\<not>\<box>\<not>\<exists>u [G]u\<close>
+              AOT_hence \<open>\<diamond>\<exists>u [G]u\<close>
+                using "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" by blast
+              AOT_hence \<open>\<exists>u \<diamond>[G]u\<close>
+                by (metis "Ordinary.res-var-bound-reas[BF\<diamond>]"[THEN "\<rightarrow>E"])
+              then AOT_obtain u where posGu: \<open>\<diamond>[G]u\<close>
+                using "Ordinary.\<exists>E"[rotated] by meson
+              AOT_hence Gu: \<open>[G]u\<close>
+                by (meson "B\<diamond>" "K\<diamond>" "\<rightarrow>E" R)
+              AOT_have \<open>\<not>([G]u & Numbers(x,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
+                using 0 Ordinary.\<psi>
+                by (metis "con-dis-i-e:1" "raa-cor:1")
+              AOT_hence notnumx: \<open>\<not>Numbers(x,[G]\<^sup>-\<^sup>u)\<close>
+                using Gu numxG "con-dis-i-e:1" "raa-cor:5" by metis
+              AOT_obtain y where numy: \<open>Numbers(y,[G]\<^sup>-\<^sup>u)\<close>
+                using "num:1"[unvarify G, OF "F-u[den]"] "\<exists>E"[rotated] by blast
+              AOT_hence \<open>[G]u & Numbers(x,G) & Numbers(y,[G]\<^sup>-\<^sup>u)\<close>
+                using Gu numxG "&I" by blast
+              AOT_hence \<open>\<exists>u ([G]u & Numbers(x,G) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
+                by (rule "Ordinary.\<exists>I")
+              AOT_hence \<open>\<exists>G\<exists>u ([G]u & Numbers(x,G) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
+                by (rule "\<exists>I")
+              AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]yx\<close>
+                using pred_equiv[THEN "\<equiv>E"(2)] by blast
+              AOT_hence \<open>y = x\<close> using Pxy_imp_eq by blast
+              AOT_hence \<open>Numbers(x,[G]\<^sup>-\<^sup>u)\<close>
+                using numy "rule=E" by fast
+              AOT_thus \<open>p & \<not>p\<close> for p using notnumx "reductio-aa:1" by blast
+            qed
+            AOT_hence \<open>\<not>\<exists>u [G]u\<close>
+              using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+            AOT_hence num0G: \<open>Numbers(0, G)\<close>
+              using "0F:1"[THEN "\<equiv>E"(1)] by blast
+            AOT_hence \<open>x = 0\<close>
+              using "pre-Hume"[unvarify x, THEN "\<rightarrow>E", OF "zero:2", OF "&I",
+                               THEN "\<equiv>E"(2), OF num0G, OF numxG, OF "eq-part:1"]
+                id_sym by blast
+            moreover AOT_have \<open>\<not>x = 0\<close>
+              using x_nonzero
+              using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" by blast
+            ultimately AOT_show \<open>p & \<not>p\<close> for p using "reductio-aa:1" by blast
+          qed
+        }
+        AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]xx \<or> \<exists>y (y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
+          using "con-dis-i-e:3:a" "con-dis-i-e:3:b" "raa-cor:1" by blast
+        moreover {
+          AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]xx\<close>
+          AOT_hence \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
+            by (rule "\<exists>I")
+        }
+        moreover {
+          AOT_assume \<open>\<exists>y (y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
+          then AOT_obtain y where \<open>y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx\<close>
+            using "\<exists>E"[rotated] by blast
+          AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]yx\<close>
+            using "&E" by blast
+          AOT_hence \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
+            by (rule "\<exists>I")
+        }
+        ultimately AOT_show \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
+          using "\<or>E"(1) "\<rightarrow>I" by blast
+      qed
+
+      text\<open>Given above lemma, we can show that if one of two indistinguishable objects
+           numbers a property, the other one numbers this property as well.\<close>
+      AOT_assume indist: \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
+      AOT_assume numxF: \<open>Numbers(x,F)\<close> 
+      AOT_hence 0: \<open>NaturalCardinal(x)\<close>
+        by (metis "eq-num:6" "vdash-properties:10")
+      text\<open>We show by case distinction that x equals y.
+           As first case we consider x to be non-zero.\<close>
+      {
+        AOT_assume \<open>\<not>(x = 0)\<close>
+        AOT_hence \<open>x \<noteq> 0\<close>
+          by (metis "=-infix" "\<equiv>\<^sub>d\<^sub>fI")
+        AOT_hence \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
+          using CardinalPredecessor 0 by blast
+        then AOT_obtain z where Pxz: \<open>[\<guillemotleft>?P\<guillemotright>]zx\<close>
+          using "\<exists>E"[rotated] by blast
+        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]zy]x\<close>
+          by (safe intro!: "\<beta>\<leftarrow>C" "cqt:2")
+        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]zy]y\<close>
+          by (safe intro!: indist[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] "cqt:2")
+        AOT_hence Pyz: \<open>[\<guillemotleft>?P\<guillemotright>]zy\<close>
+          using "\<beta>\<rightarrow>C"(1) by blast
+        AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(z,[F]\<^sup>-\<^sup>u))\<close>
+          using Pyz pred_equiv[THEN "\<equiv>E"(1)] by blast
+        then AOT_obtain F\<^sub>1 where \<open>\<exists>u ([F\<^sub>1]u & Numbers(y,F\<^sub>1) & Numbers(z,[F\<^sub>1]\<^sup>-\<^sup>u))\<close>
+          using "\<exists>E"[rotated] by blast
+        then AOT_obtain u where u_prop: \<open>[F\<^sub>1]u & Numbers(y,F\<^sub>1) & Numbers(z,[F\<^sub>1]\<^sup>-\<^sup>u)\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        AOT_have \<open>\<exists>F\<exists>u ([F]u & Numbers(x,F) & Numbers(z,[F]\<^sup>-\<^sup>u))\<close>
+          using Pxz pred_equiv[THEN "\<equiv>E"(1)] by blast
+        then AOT_obtain F\<^sub>2 where \<open>\<exists>u ([F\<^sub>2]u & Numbers(x,F\<^sub>2) & Numbers(z,[F\<^sub>2]\<^sup>-\<^sup>u))\<close>
+          using "\<exists>E"[rotated] by blast
+        then AOT_obtain v where v_prop: \<open>[F\<^sub>2]v & Numbers(x,F\<^sub>2) & Numbers(z,[F\<^sub>2]\<^sup>-\<^sup>v)\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        AOT_have \<open>[F\<^sub>2]\<^sup>-\<^sup>v \<approx>\<^sub>E [F\<^sub>1]\<^sup>-\<^sup>u\<close>
+          using "hume-strict:1"[unvarify F G, THEN "\<equiv>E"(1), OF "F-u[den]",
+                                OF "F-u[den]", OF "\<exists>I"(2)[where \<beta>=z], OF "&I"]
+                  v_prop u_prop "&E" by blast
+        AOT_hence \<open>F\<^sub>2 \<approx>\<^sub>E F\<^sub>1\<close>
+          using "P'-eq"[THEN "\<rightarrow>E", OF "&I", OF "&I"] 
+                 u_prop v_prop "&E" by meson
+        AOT_hence \<open>x = y\<close>
+          using "pre-Hume"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), OF "&I"]
+                v_prop u_prop "&E" by blast
+      }
+      text\<open>The second case handles x being equal to zero.\<close>
+      moreover {
+        fix u
+        AOT_assume x_is_zero: \<open>x = 0\<close>
+        moreover AOT_have \<open>Numbers(0,[\<lambda>z z =\<^sub>E u]\<^sup>-\<^sup>u)\<close>
+        proof (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)] "cqt:2" "raa-cor:2"
+                            "F-u[den]"[unvarify F])
+          AOT_assume \<open>\<exists>v [[\<lambda>z z =\<^sub>E u]\<^sup>-\<^sup>u]v\<close>
+          then AOT_obtain v where \<open>[[\<lambda>z z =\<^sub>E u]\<^sup>-\<^sup>u]v\<close>
+            using "Ordinary.\<exists>E"[rotated] by meson
+          AOT_hence \<open>[\<lambda>z z =\<^sub>E u]v & v \<noteq>\<^sub>E u\<close>
+            by (auto intro: "F-u"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
+                     intro!: "cqt:2" "F-u[equiv]"[unvarify F, THEN "\<equiv>E"(1)]
+                             "F-u[den]"[unvarify F])
+          AOT_thus \<open>p & \<not>p\<close> for p
+            using "\<beta>\<rightarrow>C" "thm-neg=E"[THEN "\<equiv>E"(1)] "&E" "&I"
+                  "raa-cor:3" by fast
+        qed
+        ultimately AOT_have 0: \<open>Numbers(x,[\<lambda>z z =\<^sub>E u]\<^sup>-\<^sup>u)\<close>
+          using "rule=E" id_sym by fast
+        AOT_have \<open>\<exists>y Numbers(y,[\<lambda>z z =\<^sub>E u])\<close>
+          by (safe intro!: "num:1"[unvarify G] "cqt:2")
+        then AOT_obtain z where \<open>Numbers(z,[\<lambda>z z =\<^sub>E u])\<close>
+          using "\<exists>E" by metis
+        moreover AOT_have \<open>[\<lambda>z z=\<^sub>E u]u\<close>
+          by (safe intro!: "\<beta>\<leftarrow>C" "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E"] Ordinary.\<psi>)
+        ultimately AOT_have
+          1: \<open>[\<lambda>z z=\<^sub>E u]u & Numbers(z,[\<lambda>z z=\<^sub>E u]) & Numbers(x,[\<lambda>z z=\<^sub>E u]\<^sup>-\<^sup>u)\<close>
+          using 0 "&I" by auto
+        AOT_hence \<open>\<exists>v([\<lambda>z z=\<^sub>E u]v & Numbers(z,[\<lambda>z z =\<^sub>E u]) & Numbers(x,[\<lambda>z z=\<^sub>E u]\<^sup>-\<^sup>v))\<close>
+          by (rule "Ordinary.\<exists>I")
+        AOT_hence \<open>\<exists>F\<exists>u([F]u & Numbers(z,[F]) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+          by (rule "\<exists>I"; "cqt:2")
+        AOT_hence Px1: \<open>[\<guillemotleft>?P\<guillemotright>]xz\<close>
+          using "beta-C-cor:2"[THEN "\<rightarrow>E", OF pred_den,
+                  THEN tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "\<forall>E"(2),
+                  THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by simp
+        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]yz]x\<close>
+          by (safe intro!: "\<beta>\<leftarrow>C" "cqt:2")
+        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]yz]y\<close>
+          by (safe intro!: indist[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] "cqt:2")
+        AOT_hence Py1: \<open>[\<guillemotleft>?P\<guillemotright>]yz\<close>
+          using "\<beta>\<rightarrow>C" by blast
+        AOT_hence \<open>\<exists>F\<exists>u([F]u & Numbers(z,[F]) & Numbers(y,[F]\<^sup>-\<^sup>u))\<close>
+          using "\<beta>\<rightarrow>C" by fast
+        then AOT_obtain G where \<open>\<exists>u([G]u & Numbers(z,[G]) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
+          using "\<exists>E"[rotated] by blast
+        then AOT_obtain v where 2: \<open>[G]v & Numbers(z,[G]) & Numbers(y,[G]\<^sup>-\<^sup>v)\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        with 1 2 AOT_have \<open>[\<lambda>z z =\<^sub>E u] \<approx>\<^sub>E G\<close>
+          by (auto intro!: "hume-strict:1"[unvarify F, THEN "\<equiv>E"(1), rotated,
+                                OF "\<exists>I"(2)[where \<beta>=z], OF "&I"] "cqt:2"
+                   dest: "&E")
+        AOT_hence 3: \<open>[\<lambda>z z =\<^sub>E u]\<^sup>-\<^sup>u \<approx>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+          using 1 2
+          by (safe_step intro!: "eqP'"[unvarify F, THEN "\<rightarrow>E"])
+             (auto dest: "&E" intro!: "cqt:2" "&I")
+        with 1 2 AOT_have \<open>x = y\<close>
+          by (auto intro!: "pre-Hume"[unvarify G H, THEN "\<rightarrow>E",
+                                      THEN "\<equiv>E"(2), rotated 3, OF 3]
+                           "F-u[den]"[unvarify F] "cqt:2" "&I"
+                   dest: "&E")
+      }
+      ultimately AOT_have \<open>x = y\<close>
+        using "\<or>E"(1) "\<rightarrow>I" "reductio-aa:1" by blast
+      text\<open>Now since x numbers F, so does y.\<close>
+      AOT_hence \<open>Numbers(y,F)\<close>
+          using numxF "rule=E" by fast
+    } note 0 = this
+    text\<open>The only thing left is to generalize this result to a biconditional.\<close>
+    AOT_modally_strict {
+      fix x y
+      AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
+      moreover AOT_assume \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
+      moreover AOT_have \<open>\<forall>F([F]y \<equiv> [F]x)\<close>
+        by (metis "cqt-basic:11" "intro-elim:3:a" calculation(2))
+      ultimately AOT_show \<open>Numbers(x,F) \<equiv> Numbers(y,F)\<close>
+        using 0 "\<equiv>I" "\<rightarrow>I" by auto
+    }
+  qed
+  ultimately AOT_show \<open>[\<lambda>x Numbers(x,F)]\<down>\<close>
+    using "kirchner-thm:1"[THEN "\<equiv>E"(2)] "\<rightarrow>E" by fast
+next
+  text\<open>The converse can be shown by coexistence.\<close>
+  AOT_assume \<open>\<forall>F [\<lambda>x Numbers(x,F)]\<down>\<close>
+  AOT_hence \<open>[\<lambda>x Numbers(x,F)]\<down>\<close> for F
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<box>[\<lambda>x Numbers(x,F)]\<down>\<close> for F
+    using "exist-nec"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<forall>F \<box>[\<lambda>x Numbers(x,F)]\<down>\<close>
+    by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>F [\<lambda>x Numbers(x,F)]\<down>\<close>
+    using BF[THEN "\<rightarrow>E"] by fast
+  moreover AOT_have
+    \<open>\<box>\<forall>F [\<lambda>x Numbers(x,F)]\<down> \<rightarrow>
+     \<box>\<forall>x \<forall>y (\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x) \<equiv>
+              \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)))\<close>
+  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      fix x y
+      AOT_assume 0: \<open>\<forall>F [\<lambda>x Numbers(x,F)]\<down>\<close>
+      AOT_show \<open>\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x) \<equiv>
+              \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+      proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+        AOT_assume \<open>\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
+        then AOT_obtain F where
+          \<open>\<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
+          using "\<exists>E"[rotated] by blast
+        then AOT_obtain u where \<open>[F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        AOT_hence \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
+          by (auto intro!: "&I" dest: "&E" "\<beta>\<rightarrow>C")
+        AOT_thus \<open>\<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+          using "\<exists>I" "Ordinary.\<exists>I" by fast
+      next
+        AOT_assume \<open>\<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+        then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+          using "\<exists>E"[rotated] by blast
+        then AOT_obtain u where \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
+          using "Ordinary.\<exists>E"[rotated] by meson
+        AOT_hence \<open>[F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x\<close>
+          by (auto intro!: "&I" "\<beta>\<leftarrow>C" 0[THEN "\<forall>E"(1)] "F-u[den]"
+                   dest: "&E" intro: "cqt:2")
+        AOT_hence \<open>\<exists>u([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
+          by (rule "Ordinary.\<exists>I")
+        AOT_thus \<open>\<exists>F\<exists>u([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
+          by (rule "\<exists>I")
+      qed
+    }
+  qed
+  ultimately AOT_have
+    \<open>\<box>\<forall>x \<forall>y (\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x) \<equiv>
+              \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_thus \<open>[\<lambda>xy \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<down>\<close>
+    by (rule "safe-ext[2]"[axiom_inst, THEN "\<rightarrow>E", OF "&I", rotated]) "cqt:2"
+qed
+
+text\<open>The following is not part of PLM, but a consequence of extended relation
+     comprehension and can be used to @{emph \<open>derive\<close>} the predecessor axiom.\<close>
+AOT_theorem numbers_prop_den: \<open>[\<lambda>x Numbers(x,G)]\<down>\<close>
+proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+  AOT_show \<open>[\<lambda>x A!x & [\<lambda>x \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)]x]\<down>\<close>
+    by "cqt:2"
+next
+  AOT_have 0: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>x \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)]\<down>\<close>
+  proof(safe intro!: Comprehension_3[THEN "\<rightarrow>E"] "\<rightarrow>I" RN GEN)
+      AOT_modally_strict {
+        fix F H
+        AOT_assume \<open>\<box>H \<equiv>\<^sub>E F\<close>
+        AOT_hence \<open>\<box>\<forall>u ([H]u \<equiv> [F]u)\<close>
+          by (AOT_subst (reverse) \<open>\<forall>u ([H]u \<equiv> [F]u)\<close> \<open>H \<equiv>\<^sub>E F\<close>)
+              (safe intro!: "eqE"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I"] "cqt:2")
+        AOT_hence \<open>\<forall>u \<box>([H]u \<equiv> [F]u)\<close>
+          by (metis "Ordinary.res-var-bound-reas[CBF]" "\<rightarrow>E")
+        AOT_hence \<open>\<box>([H]u \<equiv> [F]u)\<close> for u
+          using "Ordinary.\<forall>E" by fast
+        AOT_hence \<open>\<^bold>\<A>([H]u \<equiv> [F]u)\<close> for u
+          by (metis "nec-imp-act" "\<rightarrow>E")
+        AOT_hence \<open>\<^bold>\<A>([F]u \<equiv> [H]u)\<close> for u
+          by (metis "Act-Basic:5" "Commutativity of \<equiv>" "intro-elim:3:b")
+        AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z] \<equiv>\<^sub>E [\<lambda>z \<^bold>\<A>[H]z]\<close>
+          by (safe intro!: "eqE"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Ordinary.GEN;
+              AOT_subst \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close> \<open>\<^bold>\<A>[F]u\<close> for: u F)
+             (auto intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2"
+                           "Act-Basic:5"[THEN "\<equiv>E"(1)])
+        AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[H]z]\<close>
+          by (safe intro!: "apE-eqE:1"[unvarify F G, THEN "\<rightarrow>E"] "cqt:2")
+        AOT_thus \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>E G\<close>
+          using "\<equiv>I" "eq-part:2[terms]" "eq-part:3[terms]" "\<rightarrow>E" "\<rightarrow>I"
+          by metis
+      }
+  qed
+  AOT_show \<open>\<box>\<forall>x (A!x & [\<lambda>x \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)]x \<equiv> Numbers(x,G))\<close>
+  proof (safe intro!: RN GEN)
+    AOT_modally_strict {
+      fix x
+      AOT_show \<open>A!x & [\<lambda>x \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)]x \<equiv> Numbers(x,G)\<close>
+        by (AOT_subst_def numbers; AOT_subst_thm "beta-C-meta"[THEN "\<rightarrow>E", OF 0])
+           (auto intro!: "beta-C-meta"[THEN "\<rightarrow>E", OF 0] "\<equiv>I" "\<rightarrow>I" "&I" "cqt:2"
+                   dest: "&E")
+    }
+  qed
+qed
+
+text\<open>The two theorems above allow us to derive
+     the predecessor axiom of PLM as theorem.\<close>
+
+AOT_theorem pred: \<open>[\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<down>\<close>
+  using pred_coex numbers_prop_den["\<forall>I" G] "\<equiv>E" by blast
+
+AOT_define Predecessor :: \<open>\<Pi>\<close> (\<open>\<bbbP>\<close>)
+  "pred-thm:1":
+  \<open>\<bbbP> =\<^sub>d\<^sub>f [\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<close>
+
+AOT_theorem "pred-thm:2": \<open>\<bbbP>\<down>\<close>
+  using pred "pred-thm:1" "rule-id-df:2:b[zero]" by blast
+
+AOT_theorem "pred-thm:3":
+  \<open>[\<bbbP>]xy \<equiv> \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    by (auto intro!: "beta-C-meta"[unvarify \<nu>\<^sub>1\<nu>\<^sub>n, where \<tau>=\<open>(_,_)\<close>, THEN "\<rightarrow>E",
+                                   rotated, OF pred, simplified]
+                     tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" pred
+             intro: "=\<^sub>d\<^sub>fI"(2)[OF "pred-thm:1"])
+
+AOT_theorem "pred-1-1:1": \<open>[\<bbbP>]xy \<rightarrow> \<box>[\<bbbP>]xy\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>[\<bbbP>]xy\<close>
+  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "\<equiv>E"(1) "pred-thm:3" by fast
+  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain u where props: \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
+    using "Ordinary.\<exists>E"[rotated] by meson
+  AOT_obtain G where Ridigifies_G_F: \<open>Rigidifies(G, F)\<close>
+    by (metis "instantiation" "rigid-der:3")
+  AOT_hence \<xi>: \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close> and \<zeta>: \<open>\<forall>x([G]x \<equiv> [F]x)\<close>
+    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1),
+                           THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-rigid-rel:1"], THEN "&E"(2)]
+          "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast+
+
+  AOT_have rigid_num_nec: \<open>Numbers(x,F) & Rigidifies(G,F) \<rightarrow> \<box>Numbers(x,G)\<close>
+    for x G F
+  proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+    fix G F x
+    AOT_assume Numbers_xF: \<open>Numbers(x,F)\<close>
+    AOT_assume \<open>Rigidifies(G,F)\<close>
+    AOT_hence \<xi>: \<open>Rigid(G)\<close> and \<zeta>: \<open>\<forall>x([G]x \<equiv> [F]x)\<close>
+      using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+    AOT_thus \<open>\<box>Numbers(x,G)\<close>
+    proof (safe intro!:
+          "num-cont:2"[THEN "\<rightarrow>E", OF \<xi>, THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+                       THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+          "num-tran:3"[THEN "\<rightarrow>E", THEN "\<equiv>E"(1), rotated, OF Numbers_xF]
+          eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+            "&I" "cqt:2[const_var]"[axiom_inst] Ordinary.GEN "\<rightarrow>I")
+      AOT_show \<open>[F]u \<equiv> [G]u\<close> for u
+        using \<zeta>[THEN "\<forall>E"(2)] by (metis "\<equiv>E"(6) "oth-class-taut:3:a") 
+    qed
+  qed
+  AOT_have \<open>\<box>Numbers(y,G)\<close>
+    using rigid_num_nec[THEN "\<rightarrow>E", OF "&I", OF props[THEN "&E"(1), THEN "&E"(2)],
+                        OF Ridigifies_G_F].
+  moreover {
+    AOT_have \<open>Rigidifies([G]\<^sup>-\<^sup>u, [F]\<^sup>-\<^sup>u)\<close>
+    proof (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                        "&I" "F-u[den]" GEN "\<equiv>I" "\<rightarrow>I")
+      AOT_have \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x) \<rightarrow> \<box>\<forall>x([[G]\<^sup>-\<^sup>u]x \<rightarrow> \<box>[[G]\<^sup>-\<^sup>u]x)\<close>
+      proof (rule RM; safe intro!: "\<rightarrow>I" GEN)
+        AOT_modally_strict {
+          fix x
+          AOT_assume 0: \<open>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
+          AOT_assume 1: \<open>[[G]\<^sup>-\<^sup>u]x\<close>
+          AOT_have \<open>[\<lambda>x [G]x & x \<noteq>\<^sub>E u]x\<close>
+            apply (rule "F-u"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
+             apply "cqt:2[lambda]"
+            by (fact 1)
+          AOT_hence \<open>[G]x & x \<noteq>\<^sub>E u\<close>
+            by (rule "\<beta>\<rightarrow>C"(1))
+          AOT_hence 2: \<open>\<box>[G]x\<close> and 3: \<open>\<box>x \<noteq>\<^sub>E u\<close>
+            using "&E" 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] "id-nec4:1" "\<equiv>E"(1) by blast+
+          AOT_show \<open>\<box>[[G]\<^sup>-\<^sup>u]x\<close>
+            apply (AOT_subst \<open>[[G]\<^sup>-\<^sup>u]x\<close> \<open>[G]x & x \<noteq>\<^sub>E u\<close>)
+             apply (rule "F-u"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
+              apply "cqt:2[lambda]"
+             apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+            apply "cqt:2[lambda]"
+            using 2 3 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
+        }
+      qed
+      AOT_thus \<open>\<box>\<forall>x([[G]\<^sup>-\<^sup>u]x \<rightarrow> \<box>[[G]\<^sup>-\<^sup>u]x)\<close> using \<xi> "\<rightarrow>E" by blast
+    next
+      fix x
+      AOT_assume \<open>[[G]\<^sup>-\<^sup>u]x\<close>
+      AOT_hence \<open>[\<lambda>x [G]x & x \<noteq>\<^sub>E u]x\<close>
+        by (auto intro: "F-u"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
+                intro!: "cqt:2")
+      AOT_hence \<open>[G]x & x \<noteq>\<^sub>E u\<close>
+        by (rule "\<beta>\<rightarrow>C"(1))
+      AOT_hence \<open>[F]x & x \<noteq>\<^sub>E u\<close>
+        using \<zeta> "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "rule-ui:3" by blast
+      AOT_hence \<open>[\<lambda>x [F]x & x \<noteq>\<^sub>E u]x\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+      AOT_thus \<open>[[F]\<^sup>-\<^sup>u]x\<close>
+        by (auto intro: "F-u"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
+                intro!: "cqt:2")
+    next
+      fix x
+      AOT_assume \<open>[[F]\<^sup>-\<^sup>u]x\<close>
+      AOT_hence \<open>[\<lambda>x [F]x & x \<noteq>\<^sub>E u]x\<close>
+        by (auto intro: "F-u"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
+                intro!: "cqt:2")
+      AOT_hence \<open>[F]x & x \<noteq>\<^sub>E u\<close>
+        by (rule "\<beta>\<rightarrow>C"(1))
+      AOT_hence \<open>[G]x & x \<noteq>\<^sub>E u\<close>
+        using \<zeta> "&I" "&E"(1) "&E"(2) "\<equiv>E"(2) "rule-ui:3" by blast
+      AOT_hence \<open>[\<lambda>x [G]x & x \<noteq>\<^sub>E u]x\<close>
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+      AOT_thus \<open>[[G]\<^sup>-\<^sup>u]x\<close>
+        by (auto intro: "F-u"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
+                intro!: "cqt:2")
+    qed
+    AOT_hence \<open>\<box>Numbers(x,[G]\<^sup>-\<^sup>u)\<close>
+      using rigid_num_nec[unvarify F G, OF "F-u[den]", OF "F-u[den]", THEN "\<rightarrow>E",
+                          OF "&I", OF props[THEN "&E"(2)]] by blast
+  }
+  moreover AOT_have \<open>\<box>[G]u\<close>
+    using props[THEN "&E"(1), THEN "&E"(1), THEN \<zeta>[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)]]
+          \<xi>[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+    by blast
+  ultimately AOT_have \<open>\<box>([G]u & Numbers(y,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
+    by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+  AOT_hence \<open>\<exists>u (\<box>([G]u & Numbers(y,G) & Numbers(x,[G]\<^sup>-\<^sup>u)))\<close>
+    by (rule "Ordinary.\<exists>I")
+  AOT_hence \<open>\<box>\<exists>u ([G]u & Numbers(y,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
+    using "Ordinary.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
+  AOT_hence \<open>\<exists>F \<box>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    by (rule "\<exists>I")
+  AOT_hence 0: \<open>\<box>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using Buridan "vdash-properties:10" by fast
+  AOT_show \<open>\<box>[\<bbbP>]xy\<close>
+    by (AOT_subst \<open>[\<bbbP>]xy\<close> \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>;
+        simp add: "pred-thm:3" 0)
+qed
+
+AOT_theorem "pred-1-1:2": \<open>Rigid(\<bbbP>)\<close>
+  by (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "pred-thm:2" "&I"
+                   RN tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"];
+      safe intro!: GEN "pred-1-1:1")
+
+AOT_theorem "pred-1-1:3": \<open>1-1(\<bbbP>)\<close>
+proof (safe intro!: "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "pred-thm:2" "&I" GEN "\<rightarrow>I";
+       frule "&E"(1); drule "&E"(2))
+  fix x y z
+  AOT_assume \<open>[\<bbbP>]xz\<close>
+  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain u where u_prop: \<open>[F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
+    using "Ordinary.\<exists>E"[rotated] by meson
+  AOT_assume \<open>[\<bbbP>]yz\<close>
+  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(z,F) & Numbers(y,[F]\<^sup>-\<^sup>u))\<close>
+    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain G where \<open>\<exists>u ([G]u & Numbers(z,G) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain v where v_prop: \<open>[G]v & Numbers(z,G) & Numbers(y,[G]\<^sup>-\<^sup>v)\<close>
+    using "Ordinary.\<exists>E"[rotated] by meson
+  AOT_show \<open>x = y\<close>
+  proof (rule "pre-Hume"[unvarify G H, OF "F-u[den]", OF "F-u[den]",
+                         THEN "\<rightarrow>E", OF "&I", THEN "\<equiv>E"(2)])
+    AOT_show \<open>Numbers(x, [F]\<^sup>-\<^sup>u)\<close>
+      using u_prop "&E" by blast
+  next
+    AOT_show \<open>Numbers(y, [G]\<^sup>-\<^sup>v)\<close>
+      using v_prop "&E" by blast
+  next
+    AOT_have \<open>F \<approx>\<^sub>E G\<close>
+      using u_prop[THEN "&E"(1), THEN "&E"(2)]
+      using v_prop[THEN "&E"(1), THEN "&E"(2)]
+      using "num-tran:2"[THEN "\<rightarrow>E", OF "&I"] by blast
+    AOT_thus \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>E [G]\<^sup>-\<^sup>v\<close>
+      using u_prop[THEN "&E"(1), THEN "&E"(1)]
+      using v_prop[THEN "&E"(1), THEN "&E"(1)]
+      using eqP'[THEN "\<rightarrow>E", OF "&I", OF "&I"]
+      by blast
+  qed
+qed
+
+AOT_theorem "pred-1-1:4": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<bbbP>)\<close>
+  by (meson "\<equiv>\<^sub>d\<^sub>fI" "&I" "df-1-1:2" "pred-1-1:2" "pred-1-1:3")
+
+AOT_theorem "assume-anc:1":
+  \<open>[\<bbbP>]\<^sup>* = [\<lambda>xy \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & Hereditary(F,\<bbbP>)) \<rightarrow> [F]y)]\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "ances-df"])
+   apply "cqt:2[lambda]"
+  apply (rule "=I"(1))
+  by "cqt:2[lambda]"
+
+AOT_theorem "assume-anc:2": \<open>\<bbbP>\<^sup>*\<down>\<close>
+  using "t=t-proper:1" "assume-anc:1" "vdash-properties:10" by blast
+
+AOT_theorem "assume-anc:3":
+  \<open>[\<bbbP>\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & \<forall>x'\<forall>y'([\<bbbP>]x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y'))) \<rightarrow> [F]y)\<close>
+proof -
+  AOT_have prod_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<guillemotleft>(AOT_term_of_var x\<^sub>1,AOT_term_of_var x\<^sub>2)\<guillemotright>\<down>\<close>
+    for x\<^sub>1 x\<^sub>2 :: \<open>\<kappa> AOT_var\<close>
+    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+  AOT_have den: \<open>[\<lambda>xy \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & Hereditary(F,\<bbbP>)) \<rightarrow> [F]y)]\<down>\<close>
+    by "cqt:2[lambda]"
+  AOT_have 1: \<open>[\<bbbP>\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & Hereditary(F,\<bbbP>)) \<rightarrow> [F]y)\<close>
+    apply (rule "rule=E"[rotated, OF "assume-anc:1"[symmetric]])
+    by (rule "beta-C-meta"[unvarify \<nu>\<^sub>1\<nu>\<^sub>n, OF prod_den, THEN "\<rightarrow>E",
+                           simplified, OF den, simplified])
+  show ?thesis
+    apply (AOT_subst (reverse) \<open>\<forall>x'\<forall>y' ([\<bbbP>]x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y'))\<close>
+                               \<open>Hereditary(F,\<bbbP>)\<close> for: F :: \<open><\<kappa>>\<close>)
+    using "hered:1"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I", OF "pred-thm:2",
+                    OF "cqt:2[const_var]"[axiom_inst]] apply blast
+    by (fact 1)
+qed
+
+AOT_theorem "no-pred-0:1": \<open>\<not>\<exists>x [\<bbbP>]x 0\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<exists>x [\<bbbP>]x 0\<close>
+  then AOT_obtain a where \<open>[\<bbbP>]a 0\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(0, F) & Numbers(a, [F]\<^sup>-\<^sup>u))\<close>
+    using "pred-thm:3"[unvarify y, OF "zero:2", THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(0, F) & Numbers(a, [F]\<^sup>-\<^sup>u))\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain u where \<open>[F]u & Numbers(0, F) & Numbers(a, [F]\<^sup>-\<^sup>u)\<close>
+    using "Ordinary.\<exists>E"[rotated] by meson
+  AOT_hence \<open>[F]u\<close> and num0_F: \<open>Numbers(0, F)\<close>
+    using "&E" "&I" by blast+
+  AOT_hence \<open>\<exists>u [F]u\<close>
+    using "Ordinary.\<exists>I" by fast
+  moreover AOT_have \<open>\<not>\<exists>u [F]u\<close>
+    using num0_F  "\<equiv>E"(2) "0F:1" by blast
+  ultimately AOT_show \<open>p & \<not>p\<close> for p
+    by (metis "raa-cor:3")
+qed
+
+AOT_theorem "no-pred-0:2": \<open>\<not>\<exists>x [\<bbbP>\<^sup>*]x 0\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<exists>x [\<bbbP>\<^sup>*]x 0\<close>
+  then AOT_obtain a where \<open>[\<bbbP>\<^sup>*]a 0\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<exists>z [\<bbbP>]z 0\<close>
+    using "anc-her:5"[unvarify R y, OF "zero:2",
+                      OF "pred-thm:2", THEN "\<rightarrow>E"] by auto
+  AOT_thus \<open>\<exists>z [\<bbbP>]z 0 & \<not>\<exists>z [\<bbbP>]z 0\<close>
+    by (metis "no-pred-0:1" "raa-cor:3")
+qed
+
+AOT_theorem "no-pred-0:3": \<open>\<not>[\<bbbP>\<^sup>*]0 0\<close>
+  by (metis "existential:1" "no-pred-0:2" "reductio-aa:1" "zero:2")
+
+AOT_theorem "assume1:1": \<open>(=\<^sub>\<bbbP>) = [\<lambda>xy \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)]\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
+   apply "cqt:2[lambda]"
+  apply (rule "=I"(1))
+  by "cqt:2[lambda]"
+
+AOT_theorem "assume1:2": \<open>x =\<^sub>\<bbbP> y \<equiv> \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)\<close>
+proof (rule "rule=E"[rotated, OF "assume1:1"[symmetric]])
+  AOT_have prod_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<guillemotleft>(AOT_term_of_var x\<^sub>1,AOT_term_of_var x\<^sub>2)\<guillemotright>\<down>\<close>
+    for x\<^sub>1 x\<^sub>2 :: \<open>\<kappa> AOT_var\<close>
+    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+  AOT_have 1: \<open>[\<lambda>xy \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)]\<down>\<close>
+    by "cqt:2"
+  AOT_show \<open>[\<lambda>xy \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)]xy \<equiv> \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)\<close>
+    using "beta-C-meta"[THEN "\<rightarrow>E", OF 1, unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
+                        OF prod_den, simplified] by blast
+qed
+
+AOT_theorem "assume1:3": \<open>[\<bbbP>]\<^sup>+ = [\<lambda>xy [\<bbbP>]\<^sup>*xy \<or> x =\<^sub>\<bbbP> y]\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "w-ances-df"])
+   apply (simp add: "w-ances-df[den1]")
+  apply (rule "rule=E"[rotated, OF "assume1:1"[symmetric]])
+  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
+   apply "cqt:2[lambda]"
+  apply (rule "=I"(1))
+  by "cqt:2[lambda]"
+
+AOT_theorem "assume1:4": \<open>[\<bbbP>]\<^sup>+\<down>\<close>
+  using "w-ances-df[den2]".
+
+AOT_theorem "assume1:5": \<open>[\<bbbP>]\<^sup>+xy \<equiv> [\<bbbP>]\<^sup>*xy \<or> x =\<^sub>\<bbbP> y\<close>
+proof -
+  AOT_have 0: \<open>[\<lambda>xy [\<bbbP>]\<^sup>*xy \<or> x =\<^sub>\<bbbP> y]\<down>\<close> by "cqt:2"
+  AOT_have prod_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<guillemotleft>(AOT_term_of_var x\<^sub>1, AOT_term_of_var x\<^sub>2)\<guillemotright>\<down>\<close>
+    for x\<^sub>1 x\<^sub>2 :: \<open>\<kappa> AOT_var\<close>
+    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
+  show ?thesis
+    apply (rule "rule=E"[rotated, OF "assume1:3"[symmetric]])
+    using "beta-C-meta"[THEN "\<rightarrow>E", OF 0, unvarify \<nu>\<^sub>1\<nu>\<^sub>n, OF prod_den, simplified]
+    by (simp add: cond_case_prod_eta)
+qed
+
+AOT_define NaturalNumber :: \<open>\<tau>\<close> (\<open>\<nat>\<close>)
+  "nnumber:1": \<open>\<nat> =\<^sub>d\<^sub>f [\<lambda>x [\<bbbP>]\<^sup>+0x]\<close>
+
+AOT_theorem "nnumber:2": \<open>\<nat>\<down>\<close>
+  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "nnumber:1"]; "cqt:2[lambda]")
+
+AOT_theorem "nnumber:3": \<open>[\<nat>]x \<equiv> [\<bbbP>]\<^sup>+0x\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "nnumber:1"])
+   apply "cqt:2[lambda]"
+  apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+  by "cqt:2[lambda]"
+
+AOT_theorem "0-n": \<open>[\<nat>]0\<close>
+proof (safe intro!: "nnumber:3"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)]
+    "assume1:5"[unvarify x y, OF "zero:2", OF "zero:2", THEN "\<equiv>E"(2)]
+    "\<or>I"(2) "assume1:2"[unvarify x y, OF "zero:2", OF "zero:2", THEN "\<equiv>E"(2)])
+  fix u
+  AOT_have den: \<open>[\<lambda>x O!x & x =\<^sub>E u]\<down>\<close> by "cqt:2[lambda]"
+  AOT_obtain a where a_prop: \<open>Numbers(a, [\<lambda>x O!x & x =\<^sub>E u])\<close>
+    using "num:1"[unvarify G, OF den] "\<exists>E"[rotated] by blast
+  AOT_have \<open>[\<bbbP>]0a\<close>
+  proof (safe intro!: "pred-thm:3"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)]
+                      "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x O!x & x =\<^sub>E u]\<guillemotright>\<close>]
+                      "Ordinary.\<exists>I"[where \<beta>=u] "&I" den
+                      "0F:1"[unvarify F, OF "F-u[den]", unvarify F,
+                             OF den, THEN "\<equiv>E"(1)])
+    AOT_show \<open>[\<lambda>x [O!]x & x =\<^sub>E u]u\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" "ord=Eequiv:1"[THEN "\<rightarrow>E"]
+                       Ordinary.\<psi>)
+  next
+    AOT_show \<open>Numbers(a,[\<lambda>x [O!]x & x =\<^sub>E u])\<close>
+      using a_prop.
+  next
+    AOT_show \<open>\<not>\<exists>v [[\<lambda>x [O!]x & x =\<^sub>E u]\<^sup>-\<^sup>u]v\<close>
+    proof(rule "raa-cor:2")
+      AOT_assume \<open>\<exists>v [[\<lambda>x [O!]x & x =\<^sub>E u]\<^sup>-\<^sup>u]v\<close>
+      then AOT_obtain v where \<open>[[\<lambda>x [O!]x & x =\<^sub>E u]\<^sup>-\<^sup>u]v\<close>
+        using "Ordinary.\<exists>E"[rotated] "&E" by blast
+      AOT_hence \<open>[\<lambda>z [\<lambda>x [O!]x & x =\<^sub>E u]z & z \<noteq>\<^sub>E u]v\<close>
+        apply (rule "F-u"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified, rotated])
+        by "cqt:2[lambda]"
+      AOT_hence \<open>[\<lambda>x [O!]x & x =\<^sub>E u]v & v \<noteq>\<^sub>E u\<close>
+        by (rule "\<beta>\<rightarrow>C"(1))
+      AOT_hence \<open>v =\<^sub>E u\<close> and \<open>v \<noteq>\<^sub>E u\<close>
+        using "\<beta>\<rightarrow>C"(1) "&E" by blast+
+      AOT_hence \<open>v =\<^sub>E u & \<not>(v =\<^sub>E u)\<close>
+        by (metis "\<equiv>E"(4) "reductio-aa:1" "thm-neg=E")
+      AOT_thus \<open>p & \<not>p\<close> for p
+        by (metis "raa-cor:1")
+    qed
+  qed
+  AOT_thus \<open>\<exists>z ([\<bbbP>]0z & [\<bbbP>]0z)\<close>
+    by (safe intro!: "&I" "\<exists>I"(2)[where \<beta>=a])
+qed
+
+AOT_theorem "mod-col-num:1": \<open>[\<nat>]x \<rightarrow> \<box>[\<nat>]x\<close>
+proof(rule "\<rightarrow>I")
+  AOT_have nec0N: \<open>[\<lambda>x \<box>[\<nat>]x]0\<close>
+    by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" simp: "zero:2" RN "0-n")
+  AOT_have 1: \<open>[\<lambda>x \<box>[\<nat>]x]0 &
+    \<forall>x\<forall>y ([[\<bbbP>]\<^sup>+]0x & [[\<bbbP>]\<^sup>+]0y \<rightarrow> ([\<bbbP>]xy \<rightarrow> ([\<lambda>x \<box>[\<nat>]x]x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]y))) \<rightarrow>
+    \<forall>x ([[\<bbbP>]\<^sup>+]0x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]x)\<close>
+    by (auto intro!: "cqt:2"
+              intro: "pre-ind"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2",
+                               THEN "\<rightarrow>E", OF "pred-1-1:4", unvarify z, OF "zero:2",
+                               unvarify F])
+  AOT_have \<open>\<forall>x ([[\<bbbP>]\<^sup>+]0x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]x)\<close>
+  proof (rule 1[THEN "\<rightarrow>E"]; safe intro!: "&I" GEN "\<rightarrow>I" nec0N;
+         frule "&E"(1); drule "&E"(2))
+    fix x y
+    AOT_assume \<open>[\<bbbP>]xy\<close>
+    AOT_hence 0: \<open>\<box>[\<bbbP>]xy\<close>
+      by (metis "pred-1-1:1" "\<rightarrow>E")
+    AOT_assume \<open>[\<lambda>x \<box>[\<nat>]x]x\<close>
+    AOT_hence \<open>\<box>[\<nat>]x\<close>
+      by (rule "\<beta>\<rightarrow>C"(1))
+    AOT_hence \<open>\<box>([\<bbbP>]xy & [\<nat>]x)\<close>
+      by (metis "0" "KBasic:3" Adjunction "\<equiv>E"(2) "\<rightarrow>E")
+    moreover AOT_have \<open>\<box>([\<bbbP>]xy & [\<nat>]x) \<rightarrow> \<box>[\<nat>]y\<close>
+    proof (rule RM; rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+      AOT_modally_strict {
+        AOT_assume 0: \<open>[\<bbbP>]xy\<close>
+        AOT_assume \<open>[\<nat>]x\<close>
+        AOT_hence 1: \<open>[[\<bbbP>]\<^sup>+]0x\<close>
+          by (metis "\<equiv>E"(1) "nnumber:3")
+        AOT_show \<open>[\<nat>]y\<close>
+          apply (rule "nnumber:3"[THEN "\<equiv>E"(2)])
+          apply (rule "assume1:5"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)])
+          apply (rule "\<or>I"(1))
+          apply (rule "w-ances-her:3"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2",
+                                      THEN "\<rightarrow>E", OF "pred-1-1:4", unvarify x,
+                                      OF "zero:2", THEN "\<rightarrow>E"])
+          apply (rule "&I")
+           apply (fact 1)
+          by (fact 0)
+      }
+    qed
+    ultimately AOT_have \<open>\<box>[\<nat>]y\<close>
+      by (metis "\<rightarrow>E") 
+    AOT_thus \<open>[\<lambda>x \<box>[\<nat>]x]y\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+  qed
+  AOT_hence 0: \<open>[[\<bbbP>]\<^sup>+]0x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]x\<close>
+    using "\<forall>E"(2) by blast
+  AOT_assume \<open>[\<nat>]x\<close>
+  AOT_hence \<open>[[\<bbbP>]\<^sup>+]0x\<close>
+    by (metis "\<equiv>E"(1) "nnumber:3")
+  AOT_hence \<open>[\<lambda>x \<box>[\<nat>]x]x\<close>
+    using 0[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<box>[\<nat>]x\<close>
+    by (rule "\<beta>\<rightarrow>C"(1))
+qed
+
+AOT_theorem "mod-col-num:2": \<open>Rigid(\<nat>)\<close>
+  by (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" RN GEN
+                   "mod-col-num:1" "nnumber:2")
+
+AOT_register_rigid_restricted_type
+  Number: \<open>[\<nat>]\<kappa>\<close>
+proof
+  AOT_modally_strict {
+    AOT_show \<open>\<exists>x [\<nat>]x\<close>
+      by (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>0\<guillemotright>\<close>]; simp add: "0-n" "zero:2")
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>[\<nat>]\<kappa> \<rightarrow> \<kappa>\<down>\<close> for \<kappa>
+      by (simp add: "\<rightarrow>I" "cqt:5:a[1]"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)])
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<forall>x([\<nat>]x \<rightarrow> \<box>[\<nat>]x)\<close>
+      by (simp add: GEN "mod-col-num:1")
+  }
+qed
+AOT_register_variable_names
+  Number: m n k i j
+
+AOT_theorem "0-pred": \<open>\<not>\<exists>n [\<bbbP>]n 0\<close>
+proof (rule "raa-cor:2")
+  AOT_assume \<open>\<exists>n [\<bbbP>]n 0\<close>
+  then AOT_obtain n where \<open>[\<bbbP>]n 0\<close>
+    using "Number.\<exists>E"[rotated] by meson
+  AOT_hence \<open>\<exists>x [\<bbbP>]x 0\<close>
+    using "&E" "\<exists>I" by fast
+  AOT_thus \<open>\<exists>x [\<bbbP>]x 0 & \<not>\<exists>x [\<bbbP>]x 0\<close>
+    using "no-pred-0:1" "&I" by auto
+qed
+
+AOT_theorem "no-same-succ":
+  \<open>\<forall>n\<forall>m\<forall>k([\<bbbP>]nk & [\<bbbP>]mk \<rightarrow> n = m)\<close>
+proof(safe intro!: Number.GEN "\<rightarrow>I")
+  fix n m k
+  AOT_assume \<open>[\<bbbP>]nk & [\<bbbP>]mk\<close>
+  AOT_thus \<open>n = m\<close>
+    by (safe intro!: "cqt:2[const_var]"[axiom_inst] "df-1-1:3"[
+          unvarify R, OF "pred-thm:2",
+          THEN "\<rightarrow>E", OF "pred-1-1:4", THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+          THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:1"], THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<forall>E"(1),
+          THEN "\<forall>E"(1)[where \<tau>=\<open>AOT_term_of_var (Number.Rep k)\<close>], THEN "\<rightarrow>E"])
+qed
+
+AOT_theorem induction:
+  \<open>\<forall>F([F]0 & \<forall>n\<forall>m([\<bbbP>]nm \<rightarrow> ([F]n \<rightarrow> [F]m)) \<rightarrow> \<forall>n[F]n)\<close>
+proof (safe intro!: GEN[where 'a=\<open><\<kappa>>\<close>] Number.GEN "&I" "\<rightarrow>I";
+       frule "&E"(1); drule "&E"(2))
+  fix F n
+  AOT_assume F0: \<open>[F]0\<close>
+  AOT_assume 0: \<open>\<forall>n\<forall>m([\<bbbP>]nm \<rightarrow> ([F]n \<rightarrow> [F]m))\<close>
+  {
+    fix x y
+    AOT_assume \<open>[[\<bbbP>]\<^sup>+]0x & [[\<bbbP>]\<^sup>+]0y\<close>
+    AOT_hence \<open>[\<nat>]x\<close> and \<open>[\<nat>]y\<close>
+      using "&E" "\<equiv>E"(2) "nnumber:3" by blast+
+    moreover AOT_assume \<open>[\<bbbP>]xy\<close>
+    moreover AOT_assume \<open>[F]x\<close>
+    ultimately AOT_have \<open>[F]y\<close>
+      using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<forall>E"(2), THEN "\<rightarrow>E",
+              THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
+  } note 1 = this
+  AOT_have 0: \<open>[[\<bbbP>]\<^sup>+]0n\<close>
+    by (metis "\<equiv>E"(1) "nnumber:3" Number.\<psi>)
+  AOT_show \<open>[F]n\<close>
+    apply (rule "pre-ind"[unconstrain \<R>, unvarify \<beta>, THEN "\<rightarrow>E", OF "pred-thm:2",
+                          OF "pred-1-1:4", unvarify z, OF "zero:2", THEN "\<rightarrow>E",
+                          THEN "\<forall>E"(2), THEN "\<rightarrow>E"];
+           safe intro!: 0 "&I" GEN "\<rightarrow>I" F0)
+    using 1 by blast
+qed
+
+AOT_theorem "suc-num:1": \<open>[\<bbbP>]nx \<rightarrow> [\<nat>]x\<close>
+proof(rule "\<rightarrow>I")
+  AOT_have \<open>[[\<bbbP>]\<^sup>+]0 n\<close>
+    by (meson Number.\<psi> "\<equiv>E"(1) "nnumber:3")
+  moreover AOT_assume \<open>[\<bbbP>]nx\<close>
+  ultimately AOT_have \<open>[[\<bbbP>]\<^sup>*]0 x\<close>
+    using "w-ances-her:3"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2", THEN "\<rightarrow>E",
+                          OF "pred-1-1:4", unvarify x, OF "zero:2",
+                          THEN "\<rightarrow>E", OF "&I"]
+    by blast
+  AOT_hence \<open>[[\<bbbP>]\<^sup>+]0 x\<close> 
+    using "assume1:5"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2), OF "\<or>I"(1)]
+    by blast
+  AOT_thus \<open>[\<nat>]x\<close>
+    by (metis "\<equiv>E"(2) "nnumber:3")
+qed
+
+AOT_theorem "suc-num:2": \<open>[[\<bbbP>]\<^sup>*]nx \<rightarrow> [\<nat>]x\<close>
+proof(rule "\<rightarrow>I")
+  AOT_have \<open>[[\<bbbP>]\<^sup>+]0 n\<close>
+    using Number.\<psi> "\<equiv>E"(1) "nnumber:3" by blast
+  AOT_assume \<open>[[\<bbbP>]\<^sup>*]n x\<close>
+  AOT_hence \<open>\<forall>F (\<forall>z ([\<bbbP>]nz \<rightarrow> [F]z) & \<forall>x'\<forall>y' ([\<bbbP>]x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]x)\<close>
+    using "assume-anc:3"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<theta>: \<open>\<forall>z ([\<bbbP>]nz \<rightarrow> [\<nat>]z) & \<forall>x'\<forall>y' ([\<bbbP>]x'y' \<rightarrow> ([\<nat>]x' \<rightarrow> [\<nat>]y')) \<rightarrow> [\<nat>]x\<close>
+    using "\<forall>E"(1) "nnumber:2" by blast
+  AOT_show \<open>[\<nat>]x\<close>
+  proof (safe intro!: \<theta>[THEN "\<rightarrow>E"] GEN "\<rightarrow>I" "&I")
+    AOT_show \<open>[\<nat>]z\<close> if \<open>[\<bbbP>]nz\<close> for z
+      using Number.\<psi> "suc-num:1" that "\<rightarrow>E" by blast
+  next
+    AOT_show \<open>[\<nat>]y\<close> if \<open>[\<bbbP>]xy\<close> and \<open>[\<nat>]x\<close> for x y
+      using "suc-num:1"[unconstrain n, THEN "\<rightarrow>E"] that "\<rightarrow>E" by blast
+  qed
+qed
+
+AOT_theorem "suc-num:3": \<open>[\<bbbP>]\<^sup>+nx \<rightarrow> [\<nat>]x\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>[\<bbbP>]\<^sup>+nx\<close>
+  AOT_hence \<open>[\<bbbP>]\<^sup>*nx \<or> n =\<^sub>\<bbbP> x\<close>
+    by (metis "assume1:5" "\<equiv>E"(1))
+  moreover {
+    AOT_assume \<open>[\<bbbP>]\<^sup>*nx\<close>
+    AOT_hence \<open>[\<nat>]x\<close>
+      by (metis "suc-num:2" "\<rightarrow>E")
+  }
+  moreover {
+    AOT_assume \<open>n =\<^sub>\<bbbP> x\<close>
+    AOT_hence \<open>n = x\<close>
+      using "id-R-thm:3"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2",
+                         THEN "\<rightarrow>E", OF "pred-1-1:4", THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>[\<nat>]x\<close>
+      by (metis "rule=E" Number.\<psi>)
+  }
+  ultimately AOT_show \<open>[\<nat>]x\<close>
+    by (metis "\<or>E"(3) "reductio-aa:1")
+qed
+
+AOT_theorem "pred-num": \<open>[\<bbbP>]xn \<rightarrow> [\<nat>]x\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[\<bbbP>]xn\<close>
+  AOT_have \<open>[[\<bbbP>]\<^sup>+]0 n\<close>
+    using Number.\<psi> "\<equiv>E"(1) "nnumber:3" by blast
+  AOT_hence \<open>[[\<bbbP>]\<^sup>*]0 n \<or> 0 =\<^sub>\<bbbP> n\<close>
+    using "assume1:5"[unvarify x, OF "zero:2"] by (metis "\<equiv>E"(1))
+  moreover {
+    AOT_assume \<open>0 =\<^sub>\<bbbP> n\<close>
+    AOT_hence \<open>\<exists>z ([\<bbbP>]0z & [\<bbbP>]nz)\<close>
+      using "assume1:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain a where \<open>[\<bbbP>]0a & [\<bbbP>]na\<close> using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>0 = n\<close>
+      using "pred-1-1:3"[THEN "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                         THEN "\<forall>E"(1), OF "zero:2", THEN "\<forall>E"(2),
+                         THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>[\<bbbP>]x 0\<close>
+      using 0 "rule=E" id_sym by fast
+    AOT_hence \<open>\<exists>x [\<bbbP>]x 0\<close>
+      by (rule "\<exists>I")
+    AOT_hence \<open>\<exists>x [\<bbbP>]x 0 & \<not>\<exists>x [\<bbbP>]x 0\<close>
+      by (metis "no-pred-0:1" "raa-cor:3")
+  }
+  ultimately AOT_have \<open>[[\<bbbP>]\<^sup>*]0n\<close>
+    by (metis "\<or>E"(3) "raa-cor:1")
+  AOT_hence \<open>\<exists>z ([[\<bbbP>]\<^sup>+]0z & [\<bbbP>]zn)\<close>
+    using "w-ances-her:7"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2",
+                          THEN "\<rightarrow>E", OF "pred-1-1:4", unvarify x,
+                          OF "zero:2", THEN "\<rightarrow>E"] by blast
+  then AOT_obtain b where b_prop: \<open>[[\<bbbP>]\<^sup>+]0b & [\<bbbP>]bn\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>[\<nat>]b\<close>
+    by (metis "&E"(1) "\<equiv>E"(2) "nnumber:3")
+  moreover AOT_have \<open>x = b\<close>
+    using "pred-1-1:3"[THEN "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                       THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E",
+                       OF "&I", OF 0, OF b_prop[THEN "&E"(2)]].
+  ultimately AOT_show \<open>[\<nat>]x\<close>
+    using "rule=E" id_sym by fast
+qed
+
+AOT_theorem "nat-card": \<open>[\<nat>]x \<rightarrow> NaturalCardinal(x)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>[\<nat>]x\<close>
+  AOT_hence \<open>[[\<bbbP>]\<^sup>+]0x\<close>
+    by (metis "\<equiv>E"(1) "nnumber:3")
+  AOT_hence \<open>[[\<bbbP>]\<^sup>*]0x \<or> 0 =\<^sub>\<bbbP> x\<close>
+    using "assume1:5"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)] by blast
+  moreover {
+    AOT_assume \<open>[[\<bbbP>]\<^sup>*]0x\<close>
+    then AOT_obtain a where \<open>[\<bbbP>]ax\<close>
+      using "anc-her:5"[unvarify R x, OF "zero:2", OF "pred-thm:2", THEN "\<rightarrow>E"]
+            "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(x,F) & Numbers(a,[F]\<^sup>-\<^sup>u))\<close>
+      using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(x,F) & Numbers(a,[F]\<^sup>-\<^sup>u))\<close>
+      using "\<exists>E"[rotated] by blast
+    then AOT_obtain u where \<open>[F]u & Numbers(x,F) & Numbers(a,[F]\<^sup>-\<^sup>u)\<close>
+      using "Ordinary.\<exists>E"[rotated] by meson
+    AOT_hence \<open>NaturalCardinal(x)\<close>
+      using "eq-num:6"[THEN "\<rightarrow>E"] "&E" by blast
+  }
+  moreover {
+    AOT_assume \<open>0 =\<^sub>\<bbbP> x\<close>
+    AOT_hence \<open>0 = x\<close>
+      using "id-R-thm:3"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2",
+                         THEN "\<rightarrow>E", OF "pred-1-1:4", unvarify x,
+                         OF "zero:2", THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>NaturalCardinal(x)\<close>
+      by (metis "rule=E" "zero-card")
+  }
+  ultimately AOT_show \<open>NaturalCardinal(x)\<close>
+    by (metis "\<or>E"(2) "raa-cor:1")
+qed
+
+AOT_theorem "pred-func:1": \<open>[\<bbbP>]xy & [\<bbbP>]xz \<rightarrow> y = z\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>[\<bbbP>]xy\<close>
+  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain a where
+            Oa: \<open>O!a\<close>
+    and a_prop: \<open>[F]a & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>a)\<close>
+    using "\<exists>E"[rotated] "&E" by blast
+  AOT_assume \<open>[\<bbbP>]xz\<close>
+  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
+    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain G where \<open>\<exists>u ([G]u & Numbers(z,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain b where Ob: \<open>O!b\<close>
+                  and b_prop: \<open>[G]b & Numbers(z,G) & Numbers(x,[G]\<^sup>-\<^sup>b)\<close>
+    using "\<exists>E"[rotated] "&E" by blast
+  AOT_have \<open>[F]\<^sup>-\<^sup>a \<approx>\<^sub>E  [G]\<^sup>-\<^sup>b\<close>
+    using "num-tran:2"[unvarify G H, OF "F-u[den]", OF "F-u[den]",
+                       THEN "\<rightarrow>E", OF "&I", OF a_prop[THEN "&E"(2)],
+                       OF b_prop[THEN "&E"(2)]].
+  AOT_hence \<open>F \<approx>\<^sub>E G\<close>
+    using "P'-eq"[unconstrain u, THEN "\<rightarrow>E", OF Oa, unconstrain v, THEN "\<rightarrow>E",
+                  OF Ob, THEN "\<rightarrow>E", OF "&I", OF "&I"]
+          a_prop[THEN "&E"(1), THEN "&E"(1)]
+          b_prop[THEN "&E"(1), THEN "&E"(1)] by blast
+  AOT_thus \<open>y = z\<close>
+    using "pre-Hume"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), OF "&I",
+                     OF a_prop[THEN "&E"(1), THEN "&E"(2)],
+                     OF b_prop[THEN "&E"(1), THEN "&E"(2)]]
+    by blast
+qed
+
+AOT_theorem "pred-func:2": \<open>[\<bbbP>]nm & [\<bbbP>]nk \<rightarrow> m = k\<close>
+  using "pred-func:1".
+
+AOT_theorem being_number_of_den: \<open>[\<lambda>x x = #G]\<down>\<close>
+proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I" GEN RN)
+  AOT_show \<open>[\<lambda>x Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])]\<down>\<close>
+    by (rule numbers_prop_den[unvarify G]) "cqt:2[lambda]"
+next
+  AOT_modally_strict {
+    AOT_show \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G\<close> for x
+      using "eq-num:2".
+  }
+qed
+
+axiomatization \<omega>_nat :: \<open>\<omega> \<Rightarrow> nat\<close> where \<omega>_nat: \<open>surj \<omega>_nat\<close>
+text\<open>Unfortunately, since the axiom requires the type @{typ \<omega>}
+     to have an infinite domain, @{command nitpick} can only find a potential model
+     and no genuine model.
+     However, since we could trivially choose @{typ \<omega>} as a copy of @{typ nat},
+     we can still be assured that above axiom is consistent.\<close>
+lemma \<open>True\<close> nitpick[satisfy, user_axioms, card nat=1, expect = potential] ..
+
+AOT_axiom "modal-axiom":
+  \<open>\<exists>x([\<nat>]x & x = #G) \<rightarrow> \<diamond>\<exists>y([E!]y & \<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+proof(rule AOT_model_axiomI) AOT_modally_strict {
+  text\<open>The actual extension on the ordinary objects of a property is the
+       set of ordinary urelements that exemplifies the property in the
+       designated actual world.\<close>
+  define act_\<omega>ext :: \<open><\<kappa>> \<Rightarrow> \<omega> set\<close> where
+    \<open>act_\<omega>ext \<equiv> \<lambda> \<Pi> . {x :: \<omega> . [w\<^sub>0 \<Turnstile> [\<Pi>]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>]}\<close>
+  text\<open>Encoding a property with infinite actual extension on the ordinary objects
+       denotes a property by extended relation comprehension.\<close>
+  AOT_have enc_finite_act_\<omega>ext_den:
+    \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>x \<exists>F(\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]\<down>\<close>
+  proof(safe intro!: Comprehension_1[THEN "\<rightarrow>E"] RN GEN "\<rightarrow>I")
+    AOT_modally_strict {
+      fix F G
+      AOT_assume \<open>\<box>G \<equiv>\<^sub>E F\<close>
+      AOT_hence \<open>\<^bold>\<A>G \<equiv>\<^sub>E F\<close>
+        using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<^bold>\<A>(G\<down> & F\<down> & \<forall>u([G]u \<equiv> [F]u))\<close>
+        by (AOT_subst_def (reverse) eqE)
+      hence \<open>[w\<^sub>0 \<Turnstile> [G]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>] = [w\<^sub>0 \<Turnstile> [F]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>]\<close> for x
+        by (auto dest!: "\<forall>E"(1) "\<rightarrow>E"
+                 simp: AOT_model_denotes_\<kappa>_def AOT_sem_denotes AOT_sem_conj
+                       AOT_model_\<omega>\<kappa>_ordinary AOT_sem_act AOT_sem_equiv)
+      AOT_thus \<open>\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var F))\<guillemotright> \<equiv>
+                \<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var G))\<guillemotright>\<close>
+        by (simp add: AOT_sem_not AOT_sem_equiv act_\<omega>ext_def
+                      AOT_model_proposition_choice_simp)
+    }
+  qed
+  text\<open>By coexistence, encoding only properties with finite actual extension
+       on the ordinary objects denotes.\<close>
+  AOT_have \<open>[\<lambda>x \<forall>F(x[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)]\<down>\<close>
+  proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I" RN GEN)
+    AOT_show \<open>[\<lambda>x \<not>[\<lambda>x \<exists>F(\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]x]\<down>\<close>
+      by "cqt:2"
+  next
+    AOT_modally_strict {
+      fix x
+      AOT_show \<open>\<not>[\<lambda>x \<exists>F (\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]x \<equiv>
+                \<forall>F(x[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
+        by (AOT_subst \<open>[\<lambda>x \<exists>F (\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]x\<close>
+                          \<open>\<exists>F (\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])\<close>;
+            (rule "beta-C-meta"[THEN "\<rightarrow>E"])?)
+           (auto simp: enc_finite_act_\<omega>ext_den AOT_sem_equiv AOT_sem_not
+                       AOT_sem_forall AOT_sem_imp AOT_sem_conj AOT_sem_exists)
+    }
+  qed
+  text\<open>We show by induction that any property encoded by a natural number
+       has a finite actual extension on the ordinary objects.\<close>
+  AOT_hence \<open>[\<lambda>x \<forall>F(x[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)]n\<close> for n
+  proof(rule induction[THEN "\<forall>E"(1), THEN "\<rightarrow>E", THEN "Number.\<forall>E"];
+        safe intro!: "&I" "Number.GEN" "\<beta>\<leftarrow>C" "zero:2" "\<rightarrow>I" "cqt:2"
+             dest!: "\<beta>\<rightarrow>C")
+    AOT_show \<open>\<forall>F(0[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
+    proof(safe intro!: GEN "\<rightarrow>I")
+      fix F
+      AOT_assume \<open>0[F]\<close>
+      AOT_actually {
+        AOT_hence \<open>\<not>\<exists>u [F]u\<close>
+          using "zero=:2" "intro-elim:3:a" AOT_sem_enc_nec by blast
+        AOT_hence \<open>\<forall>x \<not>(O!x & [F]x)\<close>
+          using "cqt-further:4" "vdash-properties:10" by blast
+        hence \<open>\<not>([w\<^sub>0 \<Turnstile> [F]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>])\<close> for x
+          by (auto dest!: "\<forall>E"(1)[where \<tau>=\<open>\<omega>\<kappa> x\<close>]
+                    simp: AOT_sem_not AOT_sem_conj AOT_model_\<omega>\<kappa>_ordinary
+                          "russell-axiom[exe,1].\<psi>_denotes_asm")
+      }
+      AOT_thus \<open>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var F))\<guillemotright>\<close>
+        by (auto simp: AOT_model_proposition_choice_simp act_\<omega>ext_def)
+    qed
+  next
+    fix n m
+    AOT_assume \<open>[\<bbbP>]nm\<close>
+    AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(m,F) & Numbers(n,[F]\<^sup>-\<^sup>u))\<close>
+      using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain G where \<open>\<exists>u ([G]u & Numbers(m,G) & Numbers(n,[G]\<^sup>-\<^sup>u))\<close>
+      using "\<exists>E"[rotated] by blast
+    then AOT_obtain u where 0: \<open>[G]u & Numbers(m,G) & Numbers(n,[G]\<^sup>-\<^sup>u)\<close>
+      using "Ordinary.\<exists>E"[rotated] by meson
+
+    AOT_assume n_prop: \<open>\<forall>F(n[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
+    AOT_show \<open>\<forall>F(m[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
+    proof(safe intro!: GEN "\<rightarrow>I")
+      fix F
+      AOT_assume \<open>m[F]\<close>
+      AOT_hence 1: \<open>[\<lambda>x \<^bold>\<A>[F]x] \<approx>\<^sub>E G\<close>
+        using 0[THEN "&E"(1), THEN "&E"(2), THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by auto
+      AOT_show \<open>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var F))\<guillemotright>\<close>
+      proof(rule "raa-cor:1")
+        AOT_assume \<open>\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var F))\<guillemotright>\<close>
+        hence inf: \<open>infinite (act_\<omega>ext (AOT_term_of_var F))\<close>
+          by (auto simp: AOT_sem_not AOT_model_proposition_choice_simp)
+        then AOT_obtain v where act_F_v: \<open>\<^bold>\<A>[F]v\<close>
+          unfolding AOT_sem_act act_\<omega>ext_def
+          by (metis AOT_term_of_var_cases AOT_model_\<omega>\<kappa>_ordinary
+                    AOT_model_denotes_\<kappa>_def Ordinary.Rep_cases \<kappa>.disc(7)
+                    mem_Collect_eq not_finite_existsD)
+        AOT_hence \<open>[\<lambda>x \<^bold>\<A>[F]x]v\<close>
+          by (safe intro!: "\<beta>\<leftarrow>C" "cqt:2")
+        AOT_hence \<open>[\<lambda>x \<^bold>\<A>[F]x]\<^sup>-\<^sup>v \<approx>\<^sub>E [G]\<^sup>-\<^sup>u\<close>
+          by (safe intro!: eqP'[unvarify F, THEN "\<rightarrow>E"] "&I" "cqt:2" 1
+                           0[THEN "&E"(1), THEN "&E"(1)])
+        moreover AOT_have \<open>[\<lambda>x \<^bold>\<A>[F]x]\<^sup>-\<^sup>v \<approx>\<^sub>E [\<lambda>x \<^bold>\<A>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]x]\<close>
+        proof(safe intro!: "apE-eqE:1"[unvarify F G, THEN "\<rightarrow>E"] "cqt:2"
+                           "F-u[den]"[unvarify F] eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                           Ordinary.GEN)
+          fix u
+          AOT_have \<open>[\<lambda>x [\<lambda>x \<^bold>\<A>[F]x]x & x \<noteq>\<^sub>E v]u \<equiv> [\<lambda>x \<^bold>\<A>[F]x]u & u \<noteq>\<^sub>E v\<close>
+            by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2")
+          also AOT_have \<open>[\<lambda>x \<^bold>\<A>[F]x]u & u \<noteq>\<^sub>E v \<equiv> \<^bold>\<A>[F]u & u \<noteq>\<^sub>E v\<close>
+            by (AOT_subst \<open>[\<lambda>x \<^bold>\<A>[F]x]u\<close> \<open>\<^bold>\<A>[F]u\<close>)
+               (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2"
+                             "oth-class-taut:3:a")
+          also AOT_have \<open>\<^bold>\<A>[F]u & u \<noteq>\<^sub>E v \<equiv> \<^bold>\<A>([F]u & u \<noteq>\<^sub>E v)\<close>
+            using "id-act2:2" AOT_sem_conj AOT_sem_equiv AOT_sem_act by auto
+          also AOT_have \<open>\<^bold>\<A>([F]u & u \<noteq>\<^sub>E v) \<equiv> \<^bold>\<A>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]u\<close>
+            by (AOT_subst \<open>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]u\<close> \<open>[F]u & u \<noteq>\<^sub>E v\<close>)
+               (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2"
+                             "oth-class-taut:3:a")
+          also AOT_have \<open>\<^bold>\<A>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]u \<equiv> [\<lambda>x \<^bold>\<A>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]x]u\<close>
+            by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E", symmetric] "cqt:2")
+          finally AOT_show \<open>[[\<lambda>x \<^bold>\<A>[F]x]\<^sup>-\<^sup>v]u \<equiv> [\<lambda>x \<^bold>\<A>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]x]u\<close>
+            by (auto intro!: "cqt:2"
+                     intro: "rule-id-df:2:b"[OF "F-u", where \<tau>\<^sub>1\<tau>\<^sub>n=\<open>(_,_)\<close>, simplified])
+        qed
+        ultimately AOT_have \<open>[\<lambda>x \<^bold>\<A>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]x] \<approx>\<^sub>E [G]\<^sup>-\<^sup>u\<close>
+          using "eq-part:2[terms]" "eq-part:3[terms]" "\<rightarrow>E" by blast
+        AOT_hence \<open>n[\<lambda>y [F]y & y \<noteq>\<^sub>E v]\<close>
+          by (safe intro!: 0[THEN "&E"(2), THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<equiv>E"(2)] "cqt:2")
+        hence finite: \<open>finite (act_\<omega>ext \<guillemotleft>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]\<guillemotright>)\<close>
+          by (safe intro!: n_prop[THEN "\<forall>E"(1), THEN "\<rightarrow>E",
+                                  simplified AOT_model_proposition_choice_simp]
+                           "cqt:2")
+        obtain y where y_def: \<open>\<omega>\<kappa> y = AOT_term_of_var (Ordinary.Rep v)\<close>
+          by (metis AOT_model_ordinary_\<omega>\<kappa> Ordinary.restricted_var_condition)
+        AOT_actually {
+          fix x
+          AOT_assume \<open>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>\<close>
+          AOT_hence \<open>[F]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>\<close>
+            by (auto dest!: "\<beta>\<rightarrow>C" "&E"(1))
+        }
+        moreover AOT_actually {
+          AOT_have \<open>[F]\<guillemotleft>\<omega>\<kappa> y\<guillemotright>\<close>
+            unfolding y_def using act_F_v AOT_sem_act by blast
+        }
+        moreover AOT_actually {
+          fix x
+          assume noteq: \<open>x \<noteq> y\<close>
+          AOT_assume \<open>[F]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>\<close>
+          moreover AOT_have \<omega>\<kappa>_x_den: \<open>\<guillemotleft>\<omega>\<kappa> x\<guillemotright>\<down>\<close>
+            using AOT_sem_exe calculation by blast
+          moreover {
+            AOT_have \<open>\<not>(\<guillemotleft>\<omega>\<kappa> x\<guillemotright> =\<^sub>E v)\<close>
+            proof(rule "raa-cor:2")
+              AOT_assume \<open>\<guillemotleft>\<omega>\<kappa> x\<guillemotright> =\<^sub>E v\<close>
+              AOT_hence \<open>\<guillemotleft>\<omega>\<kappa> x\<guillemotright> = v\<close>
+                using "=E-simple:2"[unvarify x, THEN "\<rightarrow>E", OF \<omega>\<kappa>_x_den]
+                by blast
+              hence \<open>\<omega>\<kappa> x = \<omega>\<kappa> y\<close>
+                unfolding y_def AOT_sem_eq
+                by meson
+              hence \<open>x = y\<close>
+                by blast
+              AOT_thus \<open>p & \<not>p\<close> for p using noteq by blast
+            qed
+            AOT_hence \<open>\<guillemotleft>\<omega>\<kappa> x\<guillemotright> \<noteq>\<^sub>E v\<close>
+              by (safe intro!: "thm-neg=E"[unvarify x, THEN "\<equiv>E"(2)] \<omega>\<kappa>_x_den)
+          }
+          ultimately AOT_have \<open>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>\<close>
+            by (auto intro!: "\<beta>\<leftarrow>C" "cqt:2" "&I")
+        }
+        ultimately have \<open>(insert y (act_\<omega>ext \<guillemotleft>[\<lambda>y [F]y & y \<noteq>\<^sub>E v]\<guillemotright>)) =
+                         (act_\<omega>ext (AOT_term_of_var F))\<close>
+          unfolding act_\<omega>ext_def
+          by auto
+        hence \<open>finite (act_\<omega>ext (AOT_term_of_var F))\<close>
+          using finite finite.insertI by metis
+        AOT_thus \<open>p & \<not>p\<close> for p
+          using inf by blast
+      qed
+    qed
+  qed
+  AOT_hence nat_enc_finite: \<open>\<forall>F(n[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close> for n
+    using "\<beta>\<rightarrow>C"(1) by blast
+
+  text\<open>The main proof can now generate a witness, since we required
+       the domain of ordinary objects to be infinite.\<close>
+  AOT_show \<open>\<exists>x ([\<nat>]x & x = #G) \<rightarrow> \<diamond>\<exists>y (E!y & \<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+  proof(safe intro!: "\<rightarrow>I")
+    AOT_assume \<open>\<exists>x ([\<nat>]x & x = #G)\<close>
+    then AOT_obtain n where \<open>n = #G\<close>
+      using "Number.\<exists>E"[rotated] by meson
+    AOT_hence \<open>Numbers(n,[\<lambda>x \<^bold>\<A>[G]x])\<close>
+      using "eq-num:3" "rule=E" id_sym by fast
+    AOT_hence \<open>n[G]\<close>
+      by (auto intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2),
+                               THEN "\<forall>E"(2), THEN "\<equiv>E"(2)]
+                       "eq-part:1"[unvarify F] "cqt:2")
+    AOT_hence \<open>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var G))\<guillemotright>\<close>
+      using nat_enc_finite[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+    hence finite: \<open>finite (act_\<omega>ext (AOT_term_of_var G))\<close>
+      by (auto simp: AOT_model_proposition_choice_simp)
+    AOT_have \<open>\<exists>u \<not>\<^bold>\<A>[G]u\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume \<open>\<not>\<exists>u \<not>\<^bold>\<A>[G]u\<close>
+      AOT_hence \<open>\<forall>x \<not>(O!x & \<not>\<^bold>\<A>[G]x)\<close>
+        by (metis "cqt-further:4" "\<rightarrow>E")
+      AOT_hence \<open>\<^bold>\<A>[G]x\<close> if \<open>O!x\<close> for x
+        using "\<forall>E"(2) AOT_sem_conj AOT_sem_not that by blast
+      hence \<open>[w\<^sub>0 \<Turnstile> [G]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>]\<close> for x
+        by (metis AOT_term_of_var_cases AOT_model_\<omega>\<kappa>_ordinary
+                  AOT_model_denotes_\<kappa>_def AOT_sem_act \<kappa>.disc(7)) 
+      hence \<open>(act_\<omega>ext (AOT_term_of_var G)) = UNIV\<close>
+        unfolding act_\<omega>ext_def by auto
+      moreover have \<open>infinite (UNIV::\<omega> set)\<close>
+        by (metis \<omega>_nat finite_imageI infinite_UNIV_char_0)
+      ultimately have \<open>infinite (act_\<omega>ext (AOT_term_of_var G))\<close>
+        by simp
+      AOT_thus \<open>p & \<not>p\<close> for p using finite by blast
+    qed
+    then AOT_obtain x where x_prop: \<open>O!x & \<not>\<^bold>\<A>[G]x\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<diamond>E!x\<close>
+      by (metis "betaC:1:a" "con-dis-i-e:2:a" AOT_sem_ordinary)
+    moreover AOT_have \<open>\<box>\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E x)\<close>
+    proof(safe intro!: RN GEN "\<rightarrow>I")
+      AOT_modally_strict {
+        fix y
+        AOT_assume \<open>O!y\<close>
+        AOT_assume 0: \<open>\<^bold>\<A>[G]y\<close>
+        AOT_show \<open>y \<noteq>\<^sub>E x\<close>
+        proof (safe intro!: "thm-neg=E"[THEN "\<equiv>E"(2)] "raa-cor:2")
+          AOT_assume \<open>y =\<^sub>E x\<close>
+          AOT_hence \<open>y = x\<close>
+            by (metis "=E-simple:2" "vdash-properties:10")
+          hence \<open>y = x\<close>
+            by (simp add: AOT_sem_eq AOT_term_of_var_inject)
+          AOT_hence \<open>\<not>\<^bold>\<A>[G]y\<close>
+            using x_prop "&E" AOT_sem_not AOT_sem_act by metis
+          AOT_thus \<open>\<^bold>\<A>[G]y & \<not>\<^bold>\<A>[G]y\<close>
+            using 0 "&I" by blast
+        qed
+      }
+    qed
+    ultimately AOT_have \<open>\<diamond>(\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E x) & E!x)\<close>
+      using "KBasic:16"[THEN "\<rightarrow>E", OF "&I"] by blast
+    AOT_hence \<open>\<diamond>(E!x & \<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E x))\<close>
+      by (AOT_subst \<open>E!x & \<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E x)\<close> \<open>\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E x) & E!x\<close>)
+         (auto simp: "oth-class-taut:2:a")
+    AOT_hence \<open>\<exists>y \<diamond>(E!y & \<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+      using "\<exists>I" by fast
+    AOT_thus \<open>\<diamond>\<exists>y (E!y & \<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+      using "CBF\<diamond>"[THEN "\<rightarrow>E"] by fast
+  qed
+} qed
+
+AOT_theorem "modal-lemma":
+  \<open>\<diamond>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v) \<rightarrow> \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v)\<close>
+proof(safe intro!: "\<rightarrow>I" Ordinary.GEN)
+  AOT_modally_strict {
+    fix u
+    AOT_assume act_Gu: \<open>\<^bold>\<A>[G]u\<close>
+    AOT_have \<open>\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v) \<rightarrow> u \<noteq>\<^sub>E v\<close>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v)\<close>
+      AOT_hence \<open>\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v\<close>
+        using "Ordinary.\<forall>E" by fast
+      AOT_thus \<open>u \<noteq>\<^sub>E v\<close>
+        using act_Gu "\<rightarrow>E" by blast
+    qed
+  } note 0 = this
+  AOT_have \<theta>: \<open>\<box>(\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v) \<rightarrow> u \<noteq>\<^sub>E v)\<close> if \<open>\<box>\<^bold>\<A>[G]u\<close> for u
+  proof -
+    AOT_have \<open>\<box>\<^bold>\<A>[G]u \<rightarrow> \<box>(\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v) \<rightarrow> u \<noteq>\<^sub>E v)\<close>
+      apply (rule RM) using 0 "&E" "\<rightarrow>I" by blast
+    thus ?thesis using that "\<rightarrow>E" by blast
+  qed
+  fix u
+  AOT_assume 1: \<open>\<diamond>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v)\<close>
+  AOT_assume \<open>\<^bold>\<A>[G]u\<close>
+  AOT_hence \<open>\<box>\<^bold>\<A>[G]u\<close>
+    by (metis "Act-Basic:6" "\<equiv>E"(1))
+  AOT_hence \<open>\<box>(\<forall>u (\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E v) \<rightarrow> u \<noteq>\<^sub>E v)\<close>
+    using Ordinary.\<psi> \<theta> by blast
+  AOT_hence \<open>\<diamond>u \<noteq>\<^sub>E v\<close>
+    using 1 "K\<diamond>"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>u \<noteq>\<^sub>E v\<close>
+    by (metis "id-nec4:2" "\<equiv>E"(1)) 
+qed
+
+AOT_theorem "th-succ": \<open>\<forall>n\<exists>!m [\<bbbP>]nm\<close>
+proof(safe intro!: Number.GEN "\<rightarrow>I" "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  fix n
+  AOT_have \<open>NaturalCardinal(n)\<close>
+    by (metis "nat-card" Number.\<psi> "\<rightarrow>E")
+  AOT_hence \<open>\<exists>G(n = #G)\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" card)
+  then AOT_obtain G where n_num_G: \<open>n = #G\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<exists>n (n = #G)\<close>
+    by (rule "Number.\<exists>I")
+  AOT_hence \<open>\<diamond>\<exists>y ([E!]y & \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+    using "modal-axiom"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<exists>y \<diamond>([E!]y & \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+    using "BF\<diamond>"[THEN "\<rightarrow>E"] by auto
+  then AOT_obtain y where \<open>\<diamond>([E!]y & \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<diamond>E!y\<close> and 2: \<open>\<diamond>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y)\<close>
+    using "KBasic2:3" "&E" "\<rightarrow>E" by blast+
+  AOT_hence Oy: \<open>O!y\<close>
+    by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" intro: AOT_ordinary[THEN "=\<^sub>d\<^sub>fI"(2)])
+  AOT_have 0: \<open>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y)\<close>
+    using 2 "modal-lemma"[unconstrain v, THEN "\<rightarrow>E", OF Oy, THEN "\<rightarrow>E"] by simp
+  AOT_have 1: \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<down>\<close>
+    by "cqt:2"
+  AOT_obtain b where b_prop: \<open>Numbers(b, [\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y])\<close>
+    using "num:1"[unvarify G, OF 1] "\<exists>E"[rotated] by blast
+  AOT_have Pnb: \<open>[\<bbbP>]nb\<close>
+  proof(safe intro!: "pred-thm:3"[THEN "\<equiv>E"(2)]
+                     "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<guillemotright>\<close>]
+                     1 "\<exists>I"(2)[where \<beta>=y] "&I" Oy b_prop)
+    AOT_show \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]y\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "\<or>I"(2)
+                       "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Oy])
+  next
+    AOT_have equinum: \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<^sup>-\<^sup>y \<approx>\<^sub>E [\<lambda>x \<^bold>\<A>[G]x]\<close>
+    proof(rule "apE-eqE:1"[unvarify F G, THEN "\<rightarrow>E"];
+          ("cqt:2[lambda]" | rule "F-u[den]"[unvarify F]; "cqt:2[lambda]")?)
+      AOT_show \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<^sup>-\<^sup>y \<equiv>\<^sub>E [\<lambda>x \<^bold>\<A>[G]x]\<close>
+      proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "F-u[den]"[unvarify F]
+                          Ordinary.GEN "\<rightarrow>I"; "cqt:2"?)
+        fix u
+        AOT_have \<open>[[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]\<^sup>-\<^sup>y]u \<equiv> ([\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]u) & u \<noteq>\<^sub>E y\<close>
+          apply (rule "F-u"[THEN "=\<^sub>d\<^sub>fI"(1)[where \<tau>\<^sub>1\<tau>\<^sub>n=\<open>(_,_)\<close>], simplified]; "cqt:2"?)
+          by (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)]; "cqt:2")
+        also AOT_have \<open>\<dots> \<equiv>  (\<^bold>\<A>[G]u \<or> u =\<^sub>E y) & u \<noteq>\<^sub>E y\<close>
+          apply (AOT_subst \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]u\<close> \<open>\<^bold>\<A>[G]u \<or> u =\<^sub>E y\<close>)
+           apply (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)]; "cqt:2")
+          using "oth-class-taut:3:a" by blast
+        also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>[G]u\<close>
+        proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+          AOT_assume \<open>(\<^bold>\<A>[G]u \<or> u =\<^sub>E y) & u \<noteq>\<^sub>E y\<close>
+          AOT_thus \<open>\<^bold>\<A>[G]u\<close>
+            by (metis "&E"(1) "&E"(2) "\<or>E"(3) "\<equiv>E"(1) "thm-neg=E")
+        next
+          AOT_assume \<open>\<^bold>\<A>[G]u\<close>
+          AOT_hence \<open>u \<noteq>\<^sub>E y\<close> and \<open>\<^bold>\<A>[G]u \<or> u =\<^sub>E y\<close>
+            using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF Ordinary.\<psi>, THEN "\<rightarrow>E"]
+                  "\<or>I" by blast+
+          AOT_thus \<open>(\<^bold>\<A>[G]u \<or> u =\<^sub>E y) & u \<noteq>\<^sub>E y\<close>
+            using "&I" by simp
+        qed
+        also AOT_have \<open>\<dots> \<equiv> [\<lambda>x \<^bold>\<A>[G]x]u\<close>
+          by (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2), symmetric]; "cqt:2")
+        finally AOT_show \<open>[[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]\<^sup>-\<^sup>y]u \<equiv> [\<lambda>x \<^bold>\<A>[G]x]u\<close>.
+      qed
+    qed
+    AOT_have 2: \<open>[\<lambda>x \<^bold>\<A>[G]x]\<down>\<close> by "cqt:2[lambda]"
+    AOT_show \<open>Numbers(n,[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<^sup>-\<^sup>y)\<close>
+      using "num-tran:1"[unvarify G H, OF 2, OF "F-u[den]"[unvarify F, OF 1],
+                       THEN "\<rightarrow>E", OF equinum, THEN "\<equiv>E"(2),
+                       OF "eq-num:2"[THEN "\<equiv>E"(2), OF n_num_G]].
+  qed
+  AOT_show \<open>\<exists>\<alpha> ([\<nat>]\<alpha> & [\<bbbP>]n\<alpha> & \<forall>\<beta> ([\<nat>]\<beta> & [\<bbbP>]n\<beta> \<rightarrow> \<beta> = \<alpha>))\<close>
+  proof(safe intro!: "\<exists>I"(2)[where \<beta>=b] "&I" Pnb "\<rightarrow>I" GEN)
+    AOT_show \<open>[\<nat>]b\<close> using "suc-num:1"[THEN "\<rightarrow>E", OF Pnb].
+  next
+    fix y
+    AOT_assume 0: \<open>[\<nat>]y & [\<bbbP>]ny\<close>
+    AOT_show \<open>y = b\<close>
+      apply (rule "pred-func:1"[THEN "\<rightarrow>E"])
+      using 0[THEN "&E"(2)] Pnb "&I" by blast
+  qed
+qed
+
+(* Note the use of a bold '. *)
+AOT_define Successor :: \<open>\<tau> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>_\<^bold>''\<close> [100] 100)
+  "def-suc": \<open>n\<^bold>' =\<^sub>d\<^sub>f \<^bold>\<iota>m([\<bbbP>]nm)\<close>
+
+text\<open>Note: not explicitly in PLM\<close>
+AOT_theorem "def-suc[den1]": \<open>\<^bold>\<iota>m([\<bbbP>]nm)\<down>\<close>
+  using "A-Exists:2" "RA[2]" "\<equiv>E"(2) "th-succ"[THEN "Number.\<forall>E"] by blast
+text\<open>Note: not explicitly in PLM\<close>
+AOT_theorem "def-suc[den2]": shows \<open>n\<^bold>'\<down>\<close>
+  by (rule "def-suc"[THEN "=\<^sub>d\<^sub>fI"(1)])
+     (auto simp: "def-suc[den1]")
+
+(* TODO: not in PLM *)
+AOT_theorem suc_eq_desc: \<open>n\<^bold>' = \<^bold>\<iota>m([\<bbbP>]nm)\<close>
+  by (rule "def-suc"[THEN "=\<^sub>d\<^sub>fI"(1)])
+     (auto simp: "def-suc[den1]" "rule=I:1")
+
+AOT_theorem "suc-fact": \<open>n = m \<rightarrow> n\<^bold>' = m\<^bold>'\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume 0: \<open>n = m\<close>
+  AOT_show \<open>n\<^bold>' = m\<^bold>'\<close>
+    apply (rule "rule=E"[rotated, OF 0])
+    by (rule "=I"(1)[OF "def-suc[den2]"])
+qed
+
+AOT_theorem "ind-gnd": \<open>m = 0 \<or> \<exists>n(m = n\<^bold>')\<close>
+proof -
+  AOT_have \<open>[[\<bbbP>]\<^sup>+]0m\<close>
+    using Number.\<psi> "\<equiv>E"(1) "nnumber:3" by blast
+  AOT_hence \<open>[[\<bbbP>]\<^sup>*]0m \<or> 0 =\<^sub>\<bbbP> m\<close>
+    using "assume1:5"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)] by blast
+  moreover {
+    AOT_assume \<open>[[\<bbbP>]\<^sup>*]0m\<close>
+    AOT_hence \<open>\<exists>z ([[\<bbbP>]\<^sup>+]0z & [\<bbbP>]zm)\<close>
+      using "w-ances-her:7"[unconstrain \<R>, unvarify \<beta> x, OF "zero:2",
+                            OF "pred-thm:2", THEN "\<rightarrow>E", OF "pred-1-1:4",
+                            THEN "\<rightarrow>E"]
+      by blast
+    then AOT_obtain z where \<theta>: \<open>[[\<bbbP>]\<^sup>+]0z\<close> and \<xi>: \<open>[\<bbbP>]zm\<close>
+      using "&E" "\<exists>E"[rotated] by blast
+    AOT_have Nz: \<open>[\<nat>]z\<close>
+      using \<theta> "\<equiv>E"(2) "nnumber:3" by blast
+    moreover AOT_have \<open>m = z\<^bold>'\<close>
+    proof (rule "def-suc"[THEN "=\<^sub>d\<^sub>fI"(1)];
+           safe intro!: "def-suc[den1]"[unconstrain n, THEN "\<rightarrow>E", OF Nz]
+                        "nec-hintikka-scheme"[THEN "\<equiv>E"(2)] "&I"
+                        GEN "\<rightarrow>I" "Act-Basic:2"[THEN "\<equiv>E"(2)])
+      AOT_show \<open>\<^bold>\<A>[\<nat>]m\<close> using Number.\<psi>
+        by (meson "mod-col-num:1" "nec-imp-act" "\<rightarrow>E")
+    next
+      AOT_show \<open>\<^bold>\<A>[\<bbbP>]zm\<close> using \<xi>
+        by (meson "nec-imp-act" "pred-1-1:1" "\<rightarrow>E")
+    next
+      fix y
+      AOT_assume \<open>\<^bold>\<A>([\<nat>]y & [\<bbbP>]zy)\<close>
+      AOT_hence \<open>\<^bold>\<A>[\<nat>]y\<close> and \<open>\<^bold>\<A>[\<bbbP>]zy\<close>
+        using "Act-Basic:2" "&E" "\<equiv>E"(1) by blast+
+      AOT_hence 0: \<open>[\<bbbP>]zy\<close>
+        by (metis RN "\<equiv>E"(1) "pred-1-1:1" "sc-eq-fur:2" "\<rightarrow>E")
+      AOT_thus \<open>y = m\<close>
+        using "pred-func:1"[THEN "\<rightarrow>E", OF "&I"] \<xi> by metis
+    qed
+    ultimately AOT_have \<open>[\<nat>]z & m = z\<^bold>'\<close>
+      by (rule "&I")
+    AOT_hence \<open>\<exists>n m = n\<^bold>'\<close>
+      by (rule "\<exists>I")
+    hence ?thesis
+      by (rule "\<or>I")
+  }
+  moreover {
+    AOT_assume \<open>0 =\<^sub>\<bbbP> m\<close>
+    AOT_hence \<open>0 = m\<close>
+      using "id-R-thm:3"[unconstrain \<R>, unvarify \<beta> x, OF "zero:2", OF "pred-thm:2",
+                         THEN "\<rightarrow>E", OF "pred-1-1:4", THEN "\<rightarrow>E"]
+      by auto
+    hence ?thesis using id_sym "\<or>I" by blast
+  }
+  ultimately show ?thesis
+    by (metis "\<or>E"(2) "raa-cor:1")
+qed
+
+AOT_theorem "suc-thm": \<open>[\<bbbP>]n n\<^bold>'\<close>
+proof -
+  AOT_obtain x where m_is_n: \<open>x = n\<^bold>'\<close>
+    using "free-thms:1"[THEN "\<equiv>E"(1), OF "def-suc[den2]"]
+    using "\<exists>E" by metis
+  AOT_have \<open>\<^bold>\<A>([\<nat>]n\<^bold>' & [\<bbbP>]n n\<^bold>')\<close>
+    apply (rule "rule=E"[rotated, OF suc_eq_desc[symmetric]])
+    apply (rule "actual-desc:4"[THEN "\<rightarrow>E"])
+    by (simp add:  "def-suc[den1]")
+  AOT_hence \<open>\<^bold>\<A>[\<nat>]n\<^bold>'\<close> and \<open>\<^bold>\<A>[\<bbbP>]n n\<^bold>'\<close>
+    using "Act-Basic:2" "\<equiv>E"(1) "&E" by blast+
+  AOT_hence \<open>\<^bold>\<A>[\<bbbP>]nx\<close>
+    using m_is_n[symmetric] "rule=E" by fast+
+  AOT_hence \<open>[\<bbbP>]nx\<close>
+    by (metis RN "\<equiv>E"(1) "pred-1-1:1" "sc-eq-fur:2" "\<rightarrow>E")
+  thus ?thesis
+    using m_is_n "rule=E" by fast
+qed
+
+AOT_define Numeral1 :: \<open>\<kappa>\<^sub>s\<close> ("1")
+  "numerals:1": \<open>1 =\<^sub>d\<^sub>f 0\<^bold>'\<close>
+
+AOT_theorem "prec-facts:1": \<open>[\<bbbP>]0 1\<close>
+  by (auto intro: "numerals:1"[THEN "rule-id-df:2:b[zero]",
+                               OF "def-suc[den2]"[unconstrain n, unvarify \<beta>,
+                                                  OF "zero:2", THEN "\<rightarrow>E", OF "0-n"]]
+                  "suc-thm"[unconstrain n, unvarify \<beta>, OF "zero:2",
+                            THEN "\<rightarrow>E", OF "0-n"])
+
+(* TODO: more theorems *)
+
+(* Note: we forgo restricted variables for natural cardinals. *)
+AOT_define Finite :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Finite'(_')\<close>)
+  "inf-card:1": \<open>Finite(x) \<equiv>\<^sub>d\<^sub>f NaturalCardinal(x) & [\<nat>]x\<close>
+AOT_define Infinite :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Infinite'(_')\<close>)
+  "inf-card:2": \<open>Infinite(x) \<equiv>\<^sub>d\<^sub>f NaturalCardinal(x) & \<not>Finite(x)\<close>
+
+AOT_theorem "inf-card-exist:1": \<open>NaturalCardinal(#O!)\<close>
+  by (safe intro!: card[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>O!\<guillemotright>\<close>] "=I"
+                   "num-def:2"[unvarify G] "oa-exist:1")
+
+AOT_theorem "inf-card-exist:2": \<open>Infinite(#O!)\<close>
+proof (safe intro!: "inf-card:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "inf-card-exist:1")
+  AOT_show \<open>\<not>Finite(#O!)\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>Finite(#O!)\<close>
+    AOT_hence 0: \<open>[\<nat>]#O!\<close>
+      using "inf-card:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2) by blast
+    AOT_have \<open>Numbers(#O!, [\<lambda>z \<^bold>\<A>O!z])\<close>
+      using "eq-num:3"[unvarify G, OF "oa-exist:1"].
+    AOT_hence \<open>#O! = #O!\<close>
+      using "eq-num:2"[unvarify x G, THEN "\<equiv>E"(1), OF "oa-exist:1",
+                       OF "num-def:2"[unvarify G], OF "oa-exist:1"]
+      by blast
+    AOT_hence \<open>[\<nat>]#O! & #O! = #O!\<close>
+      using 0 "&I" by blast
+    AOT_hence \<open>\<exists>x ([\<nat>]x & x = #O!)\<close>
+      using "num-def:2"[unvarify G, OF "oa-exist:1"] "\<exists>I"(1) by fast
+    AOT_hence \<open>\<diamond>\<exists>y ([E!]y & \<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+      using "modal-axiom"[axiom_inst, unvarify G, THEN "\<rightarrow>E", OF "oa-exist:1"] by blast
+    AOT_hence \<open>\<exists>y \<diamond>([E!]y & \<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
+      using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
+    then AOT_obtain b where \<open>\<diamond>([E!]b & \<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E b))\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<diamond>[E!]b\<close> and 2: \<open>\<diamond>\<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E b)\<close>
+      using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" by blast+
+    AOT_hence \<open>[\<lambda>x \<diamond>[E!]x]b\<close>
+      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+    moreover AOT_have \<open>O! = [\<lambda>x \<diamond>[E!]x]\<close>
+      by (rule "rule-id-df:1[zero]"[OF "oa:1"]) "cqt:2"
+    ultimately AOT_have b_ord: \<open>O!b\<close>
+      using "rule=E" id_sym by fast
+    AOT_hence \<open>\<^bold>\<A>O!b\<close>
+      by (meson "\<equiv>E"(1) "oa-facts:7")
+    moreover AOT_have 2: \<open>\<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E b)\<close>
+      using "modal-lemma"[unvarify G, unconstrain v, OF "oa-exist:1",
+                          THEN "\<rightarrow>E", OF b_ord, THEN "\<rightarrow>E", OF 2].
+    ultimately AOT_have \<open>b \<noteq>\<^sub>E b\<close>
+      using "Ordinary.\<forall>E"[OF 2, unconstrain \<alpha>, THEN "\<rightarrow>E",
+                          OF b_ord, THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>\<not>(b =\<^sub>E b)\<close>
+      by (metis "\<equiv>E"(1) "thm-neg=E")
+    moreover AOT_have \<open>b =\<^sub>E b\<close>
+      using "ord=Eequiv:1"[THEN "\<rightarrow>E", OF b_ord].
+    ultimately AOT_show \<open>p & \<not>p\<close> for p
+      by (metis "raa-cor:3")
+  qed
+qed
+
+
+
+(*<*)
+end
+(*>*)
diff --git a/thys/AOT/AOT_PLM.thy b/thys/AOT/AOT_PLM.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_PLM.thy
@@ -0,0 +1,9080 @@
+(*<*)
+theory AOT_PLM
+  imports AOT_Axioms
+begin
+(*>*)
+
+section\<open>The Deductive System PLM\<close>
+text\<open>\label{PLM: 9}\<close>
+
+(* constrain sledgehammer to the abstraction layer *)
+unbundle AOT_no_atp
+
+subsection\<open>Primitive Rule of PLM: Modus Ponens\<close>
+text\<open>\label{PLM: 9.1}\<close>
+
+AOT_theorem "modus-ponens":
+  assumes \<open>\<phi>\<close> and \<open>\<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<psi>\<close>
+  (* NOTE: semantics needed *)
+  using assms by (simp add: AOT_sem_imp)
+lemmas MP = "modus-ponens"
+
+subsection\<open>(Modally Strict) Proofs and Derivations\<close>
+text\<open>\label{PLM: 9.2}\<close>
+
+AOT_theorem "non-con-thm-thm":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  shows \<open>\<^bold>\<turnstile> \<phi>\<close>
+  using assms by simp
+
+AOT_theorem "vdash-properties:1[1]":
+  assumes \<open>\<phi> \<in> \<Lambda>\<close>
+  shows \<open>\<^bold>\<turnstile> \<phi>\<close>
+  (* NOTE: semantics needed *)
+  using assms unfolding AOT_model_act_axiom_def by blast
+
+text\<open>Convenience attribute for instantiating modally-fragile axioms.\<close>
+attribute_setup act_axiom_inst =
+  \<open>Scan.succeed (Thm.rule_attribute []
+    (K (fn thm => thm RS @{thm "vdash-properties:1[1]"})))\<close>
+  "Instantiate modally fragile axiom as modally fragile theorem."
+
+AOT_theorem "vdash-properties:1[2]":
+  assumes \<open>\<phi> \<in> \<Lambda>\<^sub>\<box>\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  (* NOTE: semantics needed *)
+  using assms unfolding AOT_model_axiom_def by blast
+
+text\<open>Convenience attribute for instantiating modally-strict axioms.\<close>
+attribute_setup axiom_inst =
+  \<open>Scan.succeed (Thm.rule_attribute []
+    (K (fn thm => thm RS @{thm "vdash-properties:1[2]"})))\<close>
+  "Instantiate axiom as theorem."
+
+text\<open>Convenience methods and theorem sets for applying "cqt:2".\<close>
+method cqt_2_lambda_inst_prover =
+  (fast intro: AOT_instance_of_cqt_2_intro)
+method "cqt:2[lambda]" =
+  (rule "cqt:2[lambda]"[axiom_inst]; cqt_2_lambda_inst_prover)
+lemmas "cqt:2" =
+  "cqt:2[const_var]"[axiom_inst] "cqt:2[lambda]"[axiom_inst]
+  AOT_instance_of_cqt_2_intro
+method "cqt:2" = (safe intro!: "cqt:2")
+
+AOT_theorem "vdash-properties:3":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  shows \<open>\<Gamma> \<^bold>\<turnstile> \<phi>\<close>
+  using assms by blast
+
+AOT_theorem "vdash-properties:5":
+  assumes \<open>\<Gamma>\<^sub>1 \<^bold>\<turnstile> \<phi>\<close> and \<open>\<Gamma>\<^sub>2 \<^bold>\<turnstile> \<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<Gamma>\<^sub>1, \<Gamma>\<^sub>2 \<^bold>\<turnstile> \<psi>\<close>
+  using MP assms by blast
+
+AOT_theorem "vdash-properties:6":
+  assumes \<open>\<phi>\<close> and \<open>\<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<psi>\<close>
+  using MP assms by blast
+
+AOT_theorem "vdash-properties:8":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile> \<phi>\<close> and \<open>\<phi> \<^bold>\<turnstile> \<psi>\<close>
+  shows \<open>\<Gamma> \<^bold>\<turnstile> \<psi>\<close>
+  using assms by argo
+
+AOT_theorem "vdash-properties:9":
+  assumes \<open>\<phi>\<close>
+  shows \<open>\<psi> \<rightarrow> \<phi>\<close>
+  using MP "pl:1"[axiom_inst] assms by blast
+
+AOT_theorem "vdash-properties:10":
+  assumes \<open>\<phi> \<rightarrow> \<psi>\<close> and \<open>\<phi>\<close>
+  shows \<open>\<psi>\<close>
+  using MP assms by blast
+lemmas "\<rightarrow>E" = "vdash-properties:10"
+
+subsection\<open>Two Fundamental Metarules: GEN and RN\<close>
+text\<open>\label{PLM: 9.3}\<close>
+
+AOT_theorem "rule-gen":
+  assumes \<open>for arbitrary \<alpha>: \<phi>{\<alpha>}\<close>
+  shows \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+  (* NOTE: semantics needed *)
+  using assms by (metis AOT_var_of_term_inverse AOT_sem_denotes AOT_sem_forall)
+lemmas GEN = "rule-gen"
+
+AOT_theorem "RN[prem]":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi>\<close>
+  by (meson AOT_sem_box assms image_iff) (* NOTE: semantics needed *)
+AOT_theorem RN:
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  shows \<open>\<box>\<phi>\<close>
+  using "RN[prem]" assms by blast
+
+subsection\<open>The Inferential Role of Definitions\<close>
+text\<open>\label{PLM: 9.4}\<close>
+
+AOT_axiom "df-rules-formulas[1]":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close>
+  shows \<open>\<phi> \<rightarrow> \<psi>\<close>
+  (* NOTE: semantics needed *)
+  using assms
+  by (auto simp: assms AOT_model_axiomI AOT_model_equiv_def AOT_sem_imp)
+AOT_axiom "df-rules-formulas[2]":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close>
+  shows \<open>\<psi> \<rightarrow> \<phi>\<close>
+  (* NOTE: semantics needed *)
+  using assms
+  by (auto simp: AOT_model_axiomI AOT_model_equiv_def AOT_sem_imp)
+(* NOTE: for convenience also state the above as regular theorems *)
+AOT_theorem "df-rules-formulas[3]":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close>
+  shows \<open>\<phi> \<rightarrow> \<psi>\<close>
+  using "df-rules-formulas[1]"[axiom_inst, OF assms].
+AOT_theorem "df-rules-formulas[4]":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close>
+  shows \<open>\<psi> \<rightarrow> \<phi>\<close>
+  using "df-rules-formulas[2]"[axiom_inst, OF assms].
+
+
+AOT_axiom "df-rules-terms[1]":
+  assumes \<open>\<tau>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} =\<^sub>d\<^sub>f \<sigma>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}\<close>
+  shows \<open>(\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down> \<rightarrow> \<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}) &
+         (\<not>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down> \<rightarrow> \<not>\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down>)\<close>
+  (* NOTE: semantics needed *)
+  using assms
+  by (simp add: AOT_model_axiomI AOT_sem_conj AOT_sem_imp AOT_sem_eq
+                AOT_sem_not AOT_sem_denotes AOT_model_id_def)
+AOT_axiom "df-rules-terms[2]":
+  assumes \<open>\<tau> =\<^sub>d\<^sub>f \<sigma>\<close>
+  shows \<open>(\<sigma>\<down> \<rightarrow> \<tau> = \<sigma>) & (\<not>\<sigma>\<down> \<rightarrow> \<not>\<tau>\<down>)\<close>
+  by (metis "df-rules-terms[1]" case_unit_Unity assms)
+(* NOTE: for convenience also state the above as regular theorems *)
+AOT_theorem "df-rules-terms[3]":
+  assumes \<open>\<tau>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} =\<^sub>d\<^sub>f \<sigma>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}\<close>
+  shows \<open>(\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down> \<rightarrow> \<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}) &
+         (\<not>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down> \<rightarrow> \<not>\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down>)\<close>
+  using "df-rules-terms[1]"[axiom_inst, OF assms].
+AOT_theorem "df-rules-terms[4]":
+  assumes \<open>\<tau> =\<^sub>d\<^sub>f \<sigma>\<close>
+  shows \<open>(\<sigma>\<down> \<rightarrow> \<tau> = \<sigma>) & (\<not>\<sigma>\<down> \<rightarrow> \<not>\<tau>\<down>)\<close>
+  using "df-rules-terms[2]"[axiom_inst, OF assms].
+
+subsection\<open>The Theory of Negations and Conditionals\<close>
+text\<open>\label{PLM: 9.5}\<close>
+
+AOT_theorem "if-p-then-p": \<open>\<phi> \<rightarrow> \<phi>\<close>
+  by (meson "pl:1"[axiom_inst] "pl:2"[axiom_inst] MP)
+
+AOT_theorem "deduction-theorem":
+  assumes \<open>\<phi> \<^bold>\<turnstile> \<psi>\<close>
+  shows \<open>\<phi> \<rightarrow> \<psi>\<close>
+  (* NOTE: semantics needed *)
+  using assms by (simp add: AOT_sem_imp)
+lemmas CP = "deduction-theorem"
+lemmas "\<rightarrow>I" = "deduction-theorem"
+
+AOT_theorem "ded-thm-cor:1":
+  assumes \<open>\<Gamma>\<^sub>1 \<^bold>\<turnstile> \<phi> \<rightarrow> \<psi>\<close> and \<open>\<Gamma>\<^sub>2 \<^bold>\<turnstile> \<psi> \<rightarrow> \<chi>\<close>
+  shows \<open>\<Gamma>\<^sub>1, \<Gamma>\<^sub>2 \<^bold>\<turnstile> \<phi> \<rightarrow> \<chi>\<close>
+  using "\<rightarrow>E" "\<rightarrow>I" assms by blast
+AOT_theorem "ded-thm-cor:2":
+  assumes \<open>\<Gamma>\<^sub>1 \<^bold>\<turnstile> \<phi> \<rightarrow> (\<psi> \<rightarrow> \<chi>)\<close> and \<open>\<Gamma>\<^sub>2 \<^bold>\<turnstile> \<psi>\<close>
+  shows \<open>\<Gamma>\<^sub>1, \<Gamma>\<^sub>2 \<^bold>\<turnstile> \<phi> \<rightarrow> \<chi>\<close>
+  using "\<rightarrow>E" "\<rightarrow>I" assms by blast
+
+AOT_theorem "ded-thm-cor:3":
+  assumes \<open>\<phi> \<rightarrow> \<psi>\<close> and \<open>\<psi> \<rightarrow> \<chi>\<close>
+  shows \<open>\<phi> \<rightarrow> \<chi>\<close>
+  using "\<rightarrow>E" "\<rightarrow>I" assms by blast
+declare "ded-thm-cor:3"[trans]
+AOT_theorem "ded-thm-cor:4":
+  assumes \<open>\<phi> \<rightarrow> (\<psi> \<rightarrow> \<chi>)\<close> and \<open>\<psi>\<close>
+  shows \<open>\<phi> \<rightarrow> \<chi>\<close>
+  using "\<rightarrow>E" "\<rightarrow>I" assms by blast
+
+lemmas "Hypothetical Syllogism" = "ded-thm-cor:3"
+
+AOT_theorem "useful-tautologies:1": \<open>\<not>\<not>\<phi> \<rightarrow> \<phi>\<close>
+  by (metis "pl:3"[axiom_inst] "\<rightarrow>I" "Hypothetical Syllogism")
+AOT_theorem "useful-tautologies:2": \<open>\<phi> \<rightarrow> \<not>\<not>\<phi>\<close>
+  by (metis "pl:3"[axiom_inst] "\<rightarrow>I" "ded-thm-cor:4")
+AOT_theorem "useful-tautologies:3": \<open>\<not>\<phi> \<rightarrow> (\<phi> \<rightarrow> \<psi>)\<close>
+  by (meson "ded-thm-cor:4" "pl:3"[axiom_inst] "\<rightarrow>I")
+AOT_theorem "useful-tautologies:4": \<open>(\<not>\<psi> \<rightarrow> \<not>\<phi>) \<rightarrow> (\<phi> \<rightarrow> \<psi>)\<close>
+  by (meson "pl:3"[axiom_inst] "Hypothetical Syllogism" "\<rightarrow>I")
+AOT_theorem "useful-tautologies:5": \<open>(\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close>
+  by (metis "useful-tautologies:4" "Hypothetical Syllogism" "\<rightarrow>I")
+
+AOT_theorem "useful-tautologies:6": \<open>(\<phi> \<rightarrow> \<not>\<psi>) \<rightarrow> (\<psi> \<rightarrow> \<not>\<phi>)\<close>
+  by (metis "\<rightarrow>I" MP "useful-tautologies:4")
+
+AOT_theorem "useful-tautologies:7": \<open>(\<not>\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<not>\<psi> \<rightarrow> \<phi>)\<close>
+  by (metis "\<rightarrow>I" MP "useful-tautologies:3" "useful-tautologies:5")
+
+AOT_theorem "useful-tautologies:8": \<open>\<phi> \<rightarrow> (\<not>\<psi> \<rightarrow> \<not>(\<phi> \<rightarrow> \<psi>))\<close>
+  by (metis "\<rightarrow>I" MP "useful-tautologies:5")
+
+AOT_theorem "useful-tautologies:9": \<open>(\<phi> \<rightarrow> \<psi>) \<rightarrow> ((\<not>\<phi> \<rightarrow> \<psi>) \<rightarrow> \<psi>)\<close>
+  by (metis "\<rightarrow>I" MP "useful-tautologies:6")
+
+AOT_theorem "useful-tautologies:10": \<open>(\<phi> \<rightarrow> \<not>\<psi>) \<rightarrow> ((\<phi> \<rightarrow> \<psi>) \<rightarrow> \<not>\<phi>)\<close>
+  by (metis "\<rightarrow>I" MP "pl:3"[axiom_inst])
+
+AOT_theorem "dn-i-e:1":
+  assumes \<open>\<phi>\<close>
+  shows \<open>\<not>\<not>\<phi>\<close>
+  using MP "useful-tautologies:2" assms by blast
+lemmas "\<not>\<not>I" = "dn-i-e:1"
+AOT_theorem "dn-i-e:2":
+  assumes \<open>\<not>\<not>\<phi>\<close>
+  shows \<open>\<phi>\<close>
+  using MP "useful-tautologies:1" assms by blast
+lemmas "\<not>\<not>E" = "dn-i-e:2"
+
+AOT_theorem "modus-tollens:1":
+  assumes \<open>\<phi> \<rightarrow> \<psi>\<close> and \<open>\<not>\<psi>\<close>
+  shows \<open>\<not>\<phi>\<close>
+  using MP "useful-tautologies:5" assms by blast
+AOT_theorem "modus-tollens:2":
+  assumes \<open>\<phi> \<rightarrow> \<not>\<psi>\<close> and \<open>\<psi>\<close>
+  shows \<open>\<not>\<phi>\<close>
+  using "\<not>\<not>I" "modus-tollens:1" assms by blast
+lemmas MT = "modus-tollens:1" "modus-tollens:2"
+
+AOT_theorem "contraposition:1[1]":
+  assumes \<open>\<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<not>\<psi> \<rightarrow> \<not>\<phi>\<close>
+  using "\<rightarrow>I" MT(1) assms by blast
+AOT_theorem "contraposition:1[2]":
+  assumes \<open>\<not>\<psi> \<rightarrow> \<not>\<phi>\<close>
+  shows \<open>\<phi> \<rightarrow> \<psi>\<close>
+  using "\<rightarrow>I" "\<not>\<not>E" MT(2) assms by blast
+
+AOT_theorem "contraposition:2":
+  assumes \<open>\<phi> \<rightarrow> \<not>\<psi>\<close>
+  shows \<open>\<psi> \<rightarrow> \<not>\<phi>\<close>
+  using "\<rightarrow>I" MT(2) assms by blast
+
+AOT_theorem "reductio-aa:1":
+  assumes \<open>\<not>\<phi> \<^bold>\<turnstile> \<not>\<psi>\<close> and \<open>\<not>\<phi> \<^bold>\<turnstile> \<psi>\<close>
+  shows \<open>\<phi>\<close>
+  using "\<rightarrow>I" "\<not>\<not>E" MT(2) assms by blast
+AOT_theorem "reductio-aa:2":
+  assumes \<open>\<phi> \<^bold>\<turnstile> \<not>\<psi>\<close> and \<open>\<phi> \<^bold>\<turnstile> \<psi>\<close>
+  shows \<open>\<not>\<phi>\<close>
+  using "reductio-aa:1" assms by blast
+lemmas "RAA" = "reductio-aa:1" "reductio-aa:2"
+
+AOT_theorem "exc-mid": \<open>\<phi> \<or> \<not>\<phi>\<close>
+  using "df-rules-formulas[4]" "if-p-then-p" MP
+        "conventions:2" by blast
+
+AOT_theorem "non-contradiction": \<open>\<not>(\<phi> & \<not>\<phi>)\<close>
+  using "df-rules-formulas[3]" MT(2) "useful-tautologies:2"
+        "conventions:1" by blast
+
+AOT_theorem "con-dis-taut:1": \<open>(\<phi> & \<psi>) \<rightarrow> \<phi>\<close>
+  by (meson "\<rightarrow>I" "df-rules-formulas[3]" MP RAA(1) "conventions:1")
+AOT_theorem "con-dis-taut:2": \<open>(\<phi> & \<psi>) \<rightarrow> \<psi>\<close>
+  by (metis "\<rightarrow>I" "df-rules-formulas[3]" MT(2) RAA(2)
+            "\<not>\<not>E" "conventions:1")
+lemmas "Conjunction Simplification" = "con-dis-taut:1" "con-dis-taut:2"
+
+AOT_theorem "con-dis-taut:3": \<open>\<phi> \<rightarrow> (\<phi> \<or> \<psi>)\<close>
+  by (meson "contraposition:1[2]" "df-rules-formulas[4]"
+            MP "\<rightarrow>I" "conventions:2")
+AOT_theorem "con-dis-taut:4": \<open>\<psi> \<rightarrow> (\<phi> \<or> \<psi>)\<close>
+  using "Hypothetical Syllogism" "df-rules-formulas[4]"
+        "pl:1"[axiom_inst] "conventions:2" by blast
+lemmas "Disjunction Addition" = "con-dis-taut:3" "con-dis-taut:4"
+
+AOT_theorem "con-dis-taut:5": \<open>\<phi> \<rightarrow> (\<psi> \<rightarrow> (\<phi> & \<psi>))\<close>
+  by (metis "contraposition:2" "Hypothetical Syllogism" "\<rightarrow>I"
+            "df-rules-formulas[4]" "conventions:1")
+lemmas Adjunction = "con-dis-taut:5"
+
+AOT_theorem "con-dis-taut:6": \<open>(\<phi> & \<phi>) \<equiv> \<phi>\<close>
+  by (metis Adjunction "\<rightarrow>I" "df-rules-formulas[4]" MP
+            "Conjunction Simplification"(1) "conventions:3")
+lemmas "Idempotence of &" = "con-dis-taut:6"
+
+AOT_theorem "con-dis-taut:7": \<open>(\<phi> \<or> \<phi>) \<equiv> \<phi>\<close>
+proof -
+  {
+    AOT_assume \<open>\<phi> \<or> \<phi>\<close>
+    AOT_hence \<open>\<not>\<phi> \<rightarrow> \<phi>\<close>
+      using "conventions:2"[THEN "df-rules-formulas[3]"] MP by blast
+    AOT_hence \<open>\<phi>\<close> using "if-p-then-p" RAA(1) MP by blast
+  }
+  moreover {
+    AOT_assume \<open>\<phi>\<close>
+    AOT_hence \<open>\<phi> \<or> \<phi>\<close> using "Disjunction Addition"(1) MP by blast
+  }
+  ultimately AOT_show \<open>(\<phi> \<or> \<phi>) \<equiv> \<phi>\<close>
+    using "conventions:3"[THEN "df-rules-formulas[4]"] MP
+    by (metis Adjunction "\<rightarrow>I")
+qed
+lemmas "Idempotence of \<or>" = "con-dis-taut:7"
+
+
+AOT_theorem "con-dis-i-e:1":
+  assumes \<open>\<phi>\<close> and \<open>\<psi>\<close>
+  shows \<open>\<phi> & \<psi>\<close>
+  using Adjunction MP assms by blast
+lemmas "&I" = "con-dis-i-e:1"
+
+AOT_theorem "con-dis-i-e:2:a":
+  assumes \<open>\<phi> & \<psi>\<close>
+  shows \<open>\<phi>\<close>
+  using "Conjunction Simplification"(1) MP assms by blast
+AOT_theorem "con-dis-i-e:2:b":
+  assumes \<open>\<phi> & \<psi>\<close>
+  shows \<open>\<psi>\<close>
+  using "Conjunction Simplification"(2) MP assms by blast
+lemmas "&E" = "con-dis-i-e:2:a" "con-dis-i-e:2:b"
+
+AOT_theorem "con-dis-i-e:3:a":
+  assumes \<open>\<phi>\<close>
+  shows \<open>\<phi> \<or> \<psi>\<close>
+  using "Disjunction Addition"(1) MP assms by blast
+AOT_theorem "con-dis-i-e:3:b":
+  assumes \<open>\<psi>\<close>
+  shows \<open>\<phi> \<or> \<psi>\<close>
+  using "Disjunction Addition"(2) MP assms by blast
+AOT_theorem "con-dis-i-e:3:c":
+  assumes \<open>\<phi> \<or> \<psi>\<close> and \<open>\<phi> \<rightarrow> \<chi>\<close> and \<open>\<psi> \<rightarrow> \<Theta>\<close>
+  shows \<open>\<chi> \<or> \<Theta>\<close>
+  by (metis "con-dis-i-e:3:a" "Disjunction Addition"(2)
+            "df-rules-formulas[3]" MT(1) RAA(1)
+            "conventions:2" assms)
+lemmas "\<or>I" = "con-dis-i-e:3:a" "con-dis-i-e:3:b" "con-dis-i-e:3:c"
+
+AOT_theorem "con-dis-i-e:4:a":
+  assumes \<open>\<phi> \<or> \<psi>\<close> and \<open>\<phi> \<rightarrow> \<chi>\<close> and \<open>\<psi> \<rightarrow> \<chi>\<close>
+  shows \<open>\<chi>\<close>
+  by (metis MP RAA(2) "df-rules-formulas[3]" "conventions:2" assms)
+AOT_theorem "con-dis-i-e:4:b":
+  assumes \<open>\<phi> \<or> \<psi>\<close> and \<open>\<not>\<phi>\<close>
+  shows \<open>\<psi>\<close>
+  using "con-dis-i-e:4:a" RAA(1) "\<rightarrow>I" assms by blast
+AOT_theorem "con-dis-i-e:4:c":
+  assumes \<open>\<phi> \<or> \<psi>\<close> and \<open>\<not>\<psi>\<close>
+  shows \<open>\<phi>\<close>
+  using "con-dis-i-e:4:a" RAA(1) "\<rightarrow>I" assms by blast
+lemmas "\<or>E" = "con-dis-i-e:4:a" "con-dis-i-e:4:b" "con-dis-i-e:4:c"
+
+AOT_theorem "raa-cor:1":
+  assumes \<open>\<not>\<phi> \<^bold>\<turnstile> \<psi> & \<not>\<psi>\<close>
+  shows \<open>\<phi>\<close>
+  using "&E" "\<or>E"(3) "\<or>I"(2) RAA(2) assms by blast
+AOT_theorem "raa-cor:2":
+  assumes \<open>\<phi> \<^bold>\<turnstile> \<psi> & \<not>\<psi>\<close>
+  shows \<open>\<not>\<phi>\<close>
+  using "raa-cor:1" assms by blast
+AOT_theorem "raa-cor:3":
+  assumes \<open>\<phi>\<close> and \<open>\<not>\<psi> \<^bold>\<turnstile> \<not>\<phi>\<close>
+  shows \<open>\<psi>\<close>
+  using RAA assms by blast
+AOT_theorem "raa-cor:4":
+  assumes \<open>\<not>\<phi>\<close> and \<open>\<not>\<psi> \<^bold>\<turnstile> \<phi>\<close>
+  shows \<open>\<psi>\<close>
+  using RAA assms by blast
+AOT_theorem "raa-cor:5":
+  assumes \<open>\<phi>\<close> and \<open>\<psi> \<^bold>\<turnstile> \<not>\<phi>\<close>
+  shows \<open>\<not>\<psi>\<close>
+  using RAA assms by blast
+AOT_theorem "raa-cor:6":
+  assumes \<open>\<not>\<phi>\<close> and \<open>\<psi> \<^bold>\<turnstile> \<phi>\<close>
+  shows \<open>\<not>\<psi>\<close>
+  using RAA assms by blast
+
+AOT_theorem "oth-class-taut:1:a": \<open>(\<phi> \<rightarrow> \<psi>) \<equiv> \<not>(\<phi> & \<not>\<psi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (metis "&E" "&I" "raa-cor:3" "\<rightarrow>I" MP)
+AOT_theorem "oth-class-taut:1:b": \<open>\<not>(\<phi> \<rightarrow> \<psi>) \<equiv> (\<phi> & \<not>\<psi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (metis "&E" "&I" "raa-cor:3" "\<rightarrow>I" MP)
+AOT_theorem "oth-class-taut:1:c": \<open>(\<phi> \<rightarrow> \<psi>) \<equiv> (\<not>\<phi> \<or> \<psi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (metis "&I" "\<or>I"(1, 2) "\<or>E"(3) "\<rightarrow>I" MP "raa-cor:1")
+
+AOT_theorem "oth-class-taut:2:a": \<open>(\<phi> & \<psi>) \<equiv> (\<psi> & \<phi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (meson "&I" "&E" "\<rightarrow>I")
+lemmas "Commutativity of &" = "oth-class-taut:2:a"
+AOT_theorem "oth-class-taut:2:b": \<open>(\<phi> & (\<psi> & \<chi>)) \<equiv> ((\<phi> & \<psi>) & \<chi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (metis "&I" "&E" "\<rightarrow>I")
+lemmas "Associativity of &" = "oth-class-taut:2:b"
+AOT_theorem "oth-class-taut:2:c": \<open>(\<phi> \<or> \<psi>) \<equiv> (\<psi> \<or> \<phi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (metis "&I" "\<or>I"(1, 2) "\<or>E"(1) "\<rightarrow>I")
+lemmas "Commutativity of \<or>" = "oth-class-taut:2:c"
+AOT_theorem "oth-class-taut:2:d": \<open>(\<phi> \<or> (\<psi> \<or> \<chi>)) \<equiv> ((\<phi> \<or> \<psi>) \<or> \<chi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"])
+     (metis "&I" "\<or>I"(1, 2) "\<or>E"(1) "\<rightarrow>I")
+lemmas "Associativity of \<or>" = "oth-class-taut:2:d"
+AOT_theorem "oth-class-taut:2:e": \<open>(\<phi> \<equiv> \<psi>) \<equiv> (\<psi> \<equiv> \<phi>)\<close>
+  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"]; rule "&I";
+      metis "&I" "df-rules-formulas[4]" "conventions:3" "&E"
+            "Hypothetical Syllogism" "\<rightarrow>I" "df-rules-formulas[3]")
+lemmas "Commutativity of \<equiv>" = "oth-class-taut:2:e"
+AOT_theorem "oth-class-taut:2:f": \<open>(\<phi> \<equiv> (\<psi> \<equiv> \<chi>)) \<equiv> ((\<phi> \<equiv> \<psi>) \<equiv> \<chi>)\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "conventions:3"[THEN "df-rules-formulas[3]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I"
+  by metis
+lemmas "Associativity of \<equiv>" = "oth-class-taut:2:f"
+
+AOT_theorem "oth-class-taut:3:a": \<open>\<phi> \<equiv> \<phi>\<close>
+  using "&I" "vdash-properties:6" "if-p-then-p"
+        "df-rules-formulas[4]" "conventions:3" by blast
+AOT_theorem "oth-class-taut:3:b": \<open>\<phi> \<equiv> \<not>\<not>\<phi>\<close>
+  using "&I" "useful-tautologies:1" "useful-tautologies:2" "\<rightarrow>E"
+        "df-rules-formulas[4]" "conventions:3" by blast
+AOT_theorem "oth-class-taut:3:c": \<open>\<not>(\<phi> \<equiv> \<not>\<phi>)\<close>
+  by (metis "&E" "\<rightarrow>E" RAA "df-rules-formulas[3]" "conventions:3")
+
+AOT_theorem "oth-class-taut:4:a": \<open>(\<phi> \<rightarrow> \<psi>) \<rightarrow> ((\<psi> \<rightarrow> \<chi>) \<rightarrow> (\<phi> \<rightarrow> \<chi>))\<close>
+  by (metis "\<rightarrow>E" "\<rightarrow>I")
+AOT_theorem "oth-class-taut:4:b": \<open>(\<phi> \<equiv> \<psi>) \<equiv> (\<not>\<phi> \<equiv> \<not>\<psi>)\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "conventions:3"[THEN "df-rules-formulas[3]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" RAA by metis
+AOT_theorem "oth-class-taut:4:c": \<open>(\<phi> \<equiv> \<psi>) \<rightarrow> ((\<phi> \<rightarrow> \<chi>) \<equiv> (\<psi> \<rightarrow> \<chi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "conventions:3"[THEN "df-rules-formulas[3]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" by metis
+AOT_theorem "oth-class-taut:4:d": \<open>(\<phi> \<equiv> \<psi>) \<rightarrow> ((\<chi> \<rightarrow> \<phi>) \<equiv> (\<chi> \<rightarrow> \<psi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "conventions:3"[THEN "df-rules-formulas[3]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" by metis
+AOT_theorem "oth-class-taut:4:e": \<open>(\<phi> \<equiv> \<psi>) \<rightarrow> ((\<phi> & \<chi>) \<equiv> (\<psi> & \<chi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "conventions:3"[THEN "df-rules-formulas[3]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" by metis
+AOT_theorem "oth-class-taut:4:f": \<open>(\<phi> \<equiv> \<psi>) \<rightarrow> ((\<chi> & \<phi>) \<equiv> (\<chi> & \<psi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "conventions:3"[THEN "df-rules-formulas[3]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" by metis
+AOT_theorem "oth-class-taut:4:g": \<open>(\<phi> \<equiv> \<psi>) \<equiv> ((\<phi> & \<psi>) \<or> (\<not>\<phi> & \<not>\<psi>))\<close>
+proof(safe intro!: "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"]
+                   "&I" "\<rightarrow>I"
+           dest!: "conventions:3"[THEN "df-rules-formulas[3]", THEN "\<rightarrow>E"])
+  AOT_show \<open>\<phi> & \<psi> \<or> (\<not>\<phi> & \<not>\<psi>)\<close> if \<open>(\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>)\<close>
+    using "&E" "\<or>I" "\<rightarrow>E" "&I" "raa-cor:1" "\<rightarrow>I" "\<or>E" that by metis
+next
+  AOT_show \<open>\<psi>\<close> if \<open>\<phi> & \<psi> \<or> (\<not>\<phi> & \<not>\<psi>)\<close> and \<open>\<phi>\<close>
+    using that "\<or>E" "&E" "raa-cor:3" by blast
+next
+  AOT_show \<open>\<phi>\<close> if \<open>\<phi> & \<psi> \<or> (\<not>\<phi> & \<not>\<psi>)\<close> and \<open>\<psi>\<close>
+    using that "\<or>E" "&E" "raa-cor:3" by blast
+qed
+AOT_theorem "oth-class-taut:4:h": \<open>\<not>(\<phi> \<equiv> \<psi>) \<equiv> ((\<phi> & \<not>\<psi>) \<or> (\<not>\<phi> & \<psi>))\<close>
+proof (safe intro!: "conventions:3"[THEN "df-rules-formulas[4]", THEN "\<rightarrow>E"]
+                    "&I" "\<rightarrow>I")
+  AOT_show \<open>\<phi> & \<not>\<psi> \<or> (\<not>\<phi> & \<psi>)\<close> if \<open>\<not>(\<phi> \<equiv> \<psi>)\<close>
+    by (metis that "&I" "\<or>I"(1, 2) "\<rightarrow>I" MT(1) "df-rules-formulas[4]"
+              "raa-cor:3" "conventions:3")
+next
+  AOT_show \<open>\<not>(\<phi> \<equiv> \<psi>)\<close> if \<open>\<phi> & \<not>\<psi> \<or> (\<not>\<phi> & \<psi>)\<close>
+    by (metis that "&E" "\<or>E"(2) "\<rightarrow>E" "df-rules-formulas[3]"
+              "raa-cor:3" "conventions:3")
+qed
+AOT_theorem "oth-class-taut:5:a": \<open>(\<phi> & \<psi>) \<equiv> \<not>(\<not>\<phi> \<or> \<not>\<psi>)\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E" RAA by metis
+AOT_theorem "oth-class-taut:5:b": \<open>(\<phi> \<or> \<psi>) \<equiv> \<not>(\<not>\<phi> & \<not>\<psi>)\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E" RAA by metis
+AOT_theorem "oth-class-taut:5:c": \<open>\<not>(\<phi> & \<psi>) \<equiv> (\<not>\<phi> \<or> \<not>\<psi>)\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E" RAA by metis
+AOT_theorem "oth-class-taut:5:d": \<open>\<not>(\<phi> \<or> \<psi>) \<equiv> (\<not>\<phi> & \<not>\<psi>)\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E" RAA by metis
+
+lemmas DeMorgan = "oth-class-taut:5:c" "oth-class-taut:5:d"
+
+AOT_theorem "oth-class-taut:6:a":
+  \<open>(\<phi> & (\<psi> \<or> \<chi>)) \<equiv> ((\<phi> & \<psi>) \<or> (\<phi> & \<chi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E" RAA by metis
+AOT_theorem "oth-class-taut:6:b":
+  \<open>(\<phi> \<or> (\<psi> & \<chi>)) \<equiv> ((\<phi> \<or> \<psi>) & (\<phi> \<or> \<chi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"]
+        "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E" RAA by metis
+
+AOT_theorem "oth-class-taut:7:a": \<open>((\<phi> & \<psi>) \<rightarrow> \<chi>) \<rightarrow> (\<phi> \<rightarrow> (\<psi> \<rightarrow> \<chi>))\<close>
+  by (metis "&I" "\<rightarrow>E" "\<rightarrow>I")
+lemmas Exportation = "oth-class-taut:7:a"
+AOT_theorem "oth-class-taut:7:b": \<open>(\<phi> \<rightarrow> (\<psi> \<rightarrow>\<chi>)) \<rightarrow> ((\<phi> & \<psi>) \<rightarrow> \<chi>)\<close>
+  by (metis "&E" "\<rightarrow>E" "\<rightarrow>I")
+lemmas Importation = "oth-class-taut:7:b"
+
+AOT_theorem "oth-class-taut:8:a":
+  \<open>(\<phi> \<rightarrow> (\<psi> \<rightarrow> \<chi>)) \<equiv> (\<psi> \<rightarrow> (\<phi> \<rightarrow> \<chi>))\<close>
+  using "conventions:3"[THEN "df-rules-formulas[4]"] "\<rightarrow>I" "\<rightarrow>E" "&E" "&I"
+  by metis
+lemmas Permutation = "oth-class-taut:8:a"
+AOT_theorem "oth-class-taut:8:b":
+  \<open>(\<phi> \<rightarrow> \<psi>) \<rightarrow> ((\<phi> \<rightarrow> \<chi>) \<rightarrow> (\<phi> \<rightarrow> (\<psi> & \<chi>)))\<close>
+  by (metis "&I" "\<rightarrow>E" "\<rightarrow>I")
+lemmas Composition = "oth-class-taut:8:b"
+AOT_theorem "oth-class-taut:8:c":
+  \<open>(\<phi> \<rightarrow> \<chi>) \<rightarrow> ((\<psi> \<rightarrow> \<chi>) \<rightarrow> ((\<phi> \<or> \<psi>) \<rightarrow> \<chi>))\<close>
+  by (metis "\<or>E"(2) "\<rightarrow>E" "\<rightarrow>I" RAA(1))
+AOT_theorem "oth-class-taut:8:d":
+  \<open>((\<phi> \<rightarrow> \<psi>) & (\<chi> \<rightarrow> \<Theta>)) \<rightarrow> ((\<phi> & \<chi>) \<rightarrow> (\<psi> & \<Theta>))\<close>
+  by (metis "&E" "&I" "\<rightarrow>E" "\<rightarrow>I")
+lemmas "Double Composition" = "oth-class-taut:8:d"
+AOT_theorem "oth-class-taut:8:e":
+  \<open>((\<phi> & \<psi>) \<equiv> (\<phi> & \<chi>)) \<equiv> (\<phi> \<rightarrow> (\<psi> \<equiv> \<chi>))\<close>
+  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
+            "conventions:3"[THEN "df-rules-formulas[3]"]
+            "\<rightarrow>I" "\<rightarrow>E" "&E" "&I")
+AOT_theorem "oth-class-taut:8:f":
+  \<open>((\<phi> & \<psi>) \<equiv> (\<chi> & \<psi>)) \<equiv> (\<psi> \<rightarrow> (\<phi> \<equiv> \<chi>))\<close>
+  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
+            "conventions:3"[THEN "df-rules-formulas[3]"]
+            "\<rightarrow>I" "\<rightarrow>E" "&E" "&I")
+AOT_theorem "oth-class-taut:8:g":
+  \<open>(\<psi> \<equiv> \<chi>) \<rightarrow> ((\<phi> \<or> \<psi>) \<equiv> (\<phi> \<or> \<chi>))\<close>
+  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
+            "conventions:3"[THEN "df-rules-formulas[3]"]
+            "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E"(1))
+AOT_theorem "oth-class-taut:8:h":
+  \<open>(\<psi> \<equiv> \<chi>) \<rightarrow> ((\<psi> \<or> \<phi>) \<equiv> (\<chi> \<or> \<phi>))\<close>
+  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
+            "conventions:3"[THEN "df-rules-formulas[3]"]
+            "\<rightarrow>I" "\<rightarrow>E" "&E" "&I" "\<or>I" "\<or>E"(1))
+AOT_theorem "oth-class-taut:8:i":
+  \<open>(\<phi> \<equiv> (\<psi> & \<chi>)) \<rightarrow> (\<psi> \<rightarrow> (\<phi> \<equiv> \<chi>))\<close>
+  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
+            "conventions:3"[THEN "df-rules-formulas[3]"]
+            "\<rightarrow>I" "\<rightarrow>E" "&E" "&I")
+
+AOT_theorem "intro-elim:1":
+  assumes \<open>\<phi> \<or> \<psi>\<close> and \<open>\<phi> \<equiv> \<chi>\<close> and \<open>\<psi> \<equiv> \<Theta>\<close>
+  shows \<open>\<chi> \<or> \<Theta>\<close>
+  by (metis assms "\<or>I"(1, 2) "\<or>E"(1) "\<rightarrow>I" "\<rightarrow>E" "&E"(1)
+            "conventions:3"[THEN "df-rules-formulas[3]"])
+
+AOT_theorem "intro-elim:2":
+  assumes \<open>\<phi> \<rightarrow> \<psi>\<close> and \<open>\<psi> \<rightarrow> \<phi>\<close>
+  shows \<open>\<phi> \<equiv> \<psi>\<close>
+  by (meson "&I" "conventions:3" "df-rules-formulas[4]" MP assms)
+lemmas "\<equiv>I" = "intro-elim:2"
+
+AOT_theorem "intro-elim:3:a":
+  assumes \<open>\<phi> \<equiv> \<psi>\<close> and \<open>\<phi>\<close>
+  shows \<open>\<psi>\<close>
+  by (metis "\<or>I"(1) "\<rightarrow>I" "\<or>E"(1) "intro-elim:1" assms)
+AOT_theorem "intro-elim:3:b":
+  assumes \<open>\<phi> \<equiv> \<psi>\<close> and \<open>\<psi>\<close>
+  shows \<open>\<phi>\<close>
+  using "intro-elim:3:a" "Commutativity of \<equiv>" assms by blast
+AOT_theorem "intro-elim:3:c":
+  assumes \<open>\<phi> \<equiv> \<psi>\<close> and \<open>\<not>\<phi>\<close>
+  shows \<open>\<not>\<psi>\<close>
+  using "intro-elim:3:b" "raa-cor:3" assms by blast
+AOT_theorem "intro-elim:3:d":
+  assumes \<open>\<phi> \<equiv> \<psi>\<close> and \<open>\<not>\<psi>\<close>
+  shows \<open>\<not>\<phi>\<close>
+  using "intro-elim:3:a" "raa-cor:3" assms by blast
+AOT_theorem "intro-elim:3:e":
+  assumes \<open>\<phi> \<equiv> \<psi>\<close> and \<open>\<psi> \<equiv> \<chi>\<close>
+  shows \<open>\<phi> \<equiv> \<chi>\<close>
+  by (metis "\<equiv>I" "\<rightarrow>I" "intro-elim:3:a" "intro-elim:3:b" assms)
+declare "intro-elim:3:e"[trans]
+AOT_theorem "intro-elim:3:f":
+  assumes \<open>\<phi> \<equiv> \<psi>\<close> and \<open>\<phi> \<equiv> \<chi>\<close>
+  shows \<open>\<chi> \<equiv> \<psi>\<close>
+  by (metis "\<equiv>I" "\<rightarrow>I" "intro-elim:3:a" "intro-elim:3:b" assms)
+lemmas "\<equiv>E" = "intro-elim:3:a" "intro-elim:3:b" "intro-elim:3:c"
+              "intro-elim:3:d" "intro-elim:3:e" "intro-elim:3:f"
+
+declare "Commutativity of \<equiv>"[THEN "\<equiv>E"(1), sym]
+
+AOT_theorem "rule-eq-df:1":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close>
+  shows \<open>\<phi> \<equiv> \<psi>\<close>
+  by (simp add: "\<equiv>I" "df-rules-formulas[3]" "df-rules-formulas[4]" assms)
+lemmas "\<equiv>Df" = "rule-eq-df:1"
+AOT_theorem "rule-eq-df:2":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close> and \<open>\<phi>\<close>
+  shows \<open>\<psi>\<close>
+  using "\<equiv>Df" "\<equiv>E"(1) assms by blast
+lemmas "\<equiv>\<^sub>d\<^sub>fE" = "rule-eq-df:2"
+AOT_theorem "rule-eq-df:3":
+  assumes \<open>\<phi> \<equiv>\<^sub>d\<^sub>f \<psi>\<close> and \<open>\<psi>\<close>
+  shows \<open>\<phi>\<close>
+  using "\<equiv>Df" "\<equiv>E"(2) assms by blast
+lemmas "\<equiv>\<^sub>d\<^sub>fI" = "rule-eq-df:3"
+
+AOT_theorem  "df-simplify:1":
+  assumes \<open>\<phi> \<equiv> (\<psi> & \<chi>)\<close> and \<open>\<psi>\<close>
+  shows \<open>\<phi> \<equiv> \<chi>\<close>
+  by (metis "&E"(2) "&I" "\<equiv>E"(1, 2) "\<equiv>I" "\<rightarrow>I" assms)
+(* Note: this is a slight variation from PLM *)
+AOT_theorem  "df-simplify:2":
+  assumes \<open>\<phi> \<equiv> (\<psi> & \<chi>)\<close> and \<open>\<chi>\<close>
+  shows \<open>\<phi> \<equiv> \<psi>\<close>
+  by (metis "&E"(1) "&I" "\<equiv>E"(1, 2) "\<equiv>I" "\<rightarrow>I" assms)
+lemmas "\<equiv>S" = "df-simplify:1"  "df-simplify:2"
+
+subsection\<open>The Theory of Quantification\<close>
+text\<open>\label{PLM: 9.6}\<close>
+
+AOT_theorem "rule-ui:1":
+  assumes \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close> and \<open>\<tau>\<down>\<close>
+  shows \<open>\<phi>{\<tau>}\<close>
+  using "\<rightarrow>E" "cqt:1"[axiom_inst] assms by blast
+AOT_theorem "rule-ui:2[const_var]":
+  assumes \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+  shows \<open>\<phi>{\<beta>}\<close>
+  by (simp add: "rule-ui:1" "cqt:2[const_var]"[axiom_inst] assms)
+AOT_theorem "rule-ui:2[lambda]":
+  assumes \<open>\<forall>F \<phi>{F}\<close> and \<open>INSTANCE_OF_CQT_2(\<psi>)\<close>
+  shows \<open>\<phi>{[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]}\<close>
+  by (simp add: "rule-ui:1" "cqt:2[lambda]"[axiom_inst] assms)
+AOT_theorem "rule-ui:3":
+  assumes \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+  shows \<open>\<phi>{\<alpha>}\<close>
+  by (simp add: "rule-ui:2[const_var]" assms)
+lemmas "\<forall>E" = "rule-ui:1" "rule-ui:2[const_var]"
+              "rule-ui:2[lambda]" "rule-ui:3"
+
+AOT_theorem "cqt-orig:1[const_var]": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<phi>{\<beta>}\<close>
+  by (simp add: "\<forall>E"(2) "\<rightarrow>I")
+AOT_theorem "cqt-orig:1[lambda]":
+  assumes \<open>INSTANCE_OF_CQT_2(\<psi>)\<close>
+  shows \<open>\<forall>F \<phi>{F} \<rightarrow> \<phi>{[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]}\<close>
+  by (simp add: "\<forall>E"(3) "\<rightarrow>I" assms)
+AOT_theorem "cqt-orig:2": \<open>\<forall>\<alpha> (\<phi> \<rightarrow> \<psi>{\<alpha>}) \<rightarrow> (\<phi> \<rightarrow> \<forall>\<alpha> \<psi>{\<alpha>})\<close>
+  by (metis "\<rightarrow>I" GEN "vdash-properties:6" "\<forall>E"(4))
+AOT_theorem "cqt-orig:3": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>}\<close>
+  using "cqt-orig:1[const_var]".
+
+AOT_theorem universal:
+  assumes \<open>for arbitrary \<beta>: \<phi>{\<beta>}\<close>
+  shows \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+  using GEN assms .
+lemmas "\<forall>I" = universal
+
+(* Generalized mechanism for \<forall>I followed by \<forall>E *)
+ML\<open>
+fun get_instantiated_allI ctxt varname thm = let
+val trm = Thm.concl_of thm
+val trm =
+  case trm of (@{const Trueprop} $ (@{const AOT_model_valid_in} $ _ $ x)) => x
+  | _ => raise Term.TERM ("Expected simple theorem.", [trm])
+fun extractVars (Const (\<^const_name>\<open>AOT_term_of_var\<close>, _) $ Var v) =
+    (if fst (fst v) = fst varname then [Var v] else [])
+  | extractVars (t1 $ t2) = extractVars t1 @ extractVars t2
+  | extractVars (Abs (_, _, t)) = extractVars t
+  | extractVars _ = []
+val vars = extractVars trm
+val vars = fold Term.add_vars vars []
+val var = hd vars
+val trmty =
+  case (snd var) of (Type (\<^type_name>\<open>AOT_var\<close>, [t])) => (t)
+  | _ => raise Term.TYPE ("Expected variable type.", [snd var], [Var var])
+val trm = Abs (Term.string_of_vname (fst var), trmty, Term.abstract_over (
+      Const (\<^const_name>\<open>AOT_term_of_var\<close>, Type ("fun", [snd var, trmty]))
+       $ Var var, trm))
+val trm = Thm.cterm_of (Context.proof_of ctxt) trm
+val ty = hd (Term.add_tvars (Thm.prop_of @{thm "\<forall>I"}) [])
+val typ = Thm.ctyp_of (Context.proof_of ctxt) trmty
+val allthm = Drule.instantiate_normalize (TVars.make [(ty, typ)], Vars.empty) @{thm "\<forall>I"}
+val phi = hd (Term.add_vars (Thm.prop_of allthm) [])
+val allthm = Drule.instantiate_normalize (TVars.empty, Vars.make [(phi,trm)]) allthm
+in
+allthm
+end
+\<close>
+
+attribute_setup "\<forall>I" =
+  \<open>Scan.lift (Scan.repeat1 Args.var) >> (fn args => Thm.rule_attribute []
+  (fn ctxt => fn thm => fold (fn arg => fn thm =>
+    thm RS get_instantiated_allI ctxt arg thm) args thm))\<close>
+  "Quantify over a variable in a theorem using GEN."
+
+attribute_setup "unvarify" =
+  \<open>Scan.lift (Scan.repeat1 Args.var) >> (fn args => Thm.rule_attribute []
+  (fn ctxt => fn thm =>
+    let
+      fun get_inst_allI arg thm = thm RS get_instantiated_allI ctxt arg thm
+      val thm = fold get_inst_allI args thm
+      val thm = fold (K (fn thm => thm RS @{thm "\<forall>E"(1)})) args thm
+    in
+     thm
+    end))\<close>
+  "Generalize a statement about variables to a statement about denoting terms."
+
+(* Note: rereplace-lem does not apply to the embedding *)
+
+AOT_theorem "cqt-basic:1": \<open>\<forall>\<alpha>\<forall>\<beta> \<phi>{\<alpha>,\<beta>} \<equiv> \<forall>\<beta>\<forall>\<alpha> \<phi>{\<alpha>,\<beta>}\<close>
+  by (metis "\<equiv>I" "\<forall>E"(2) "\<forall>I" "\<rightarrow>I")
+
+AOT_theorem "cqt-basic:2":
+  \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) \<equiv> (\<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) & \<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>}))\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  AOT_hence \<open>\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}\<close> for \<alpha> using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}\<close> and \<open>\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>}\<close> for \<alpha>
+    using "\<equiv>E"(1,2) "\<rightarrow>I" by blast+
+  AOT_thus \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) & \<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (auto intro: "&I" "\<forall>I")
+next
+  AOT_assume \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) & \<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}\<close> and \<open>\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>}\<close> for \<alpha>
+    using "\<forall>E"(2) "&E" by blast+
+  AOT_hence \<open>\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}\<close> for \<alpha>
+    using "\<equiv>I" by blast
+  AOT_thus \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close> by (auto intro: "\<forall>I")
+qed
+
+AOT_theorem "cqt-basic:3": \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) \<rightarrow> (\<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<forall>\<alpha> \<psi>{\<alpha>})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  AOT_hence 1: \<open>\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}\<close> for \<alpha> using "\<forall>E"(2) by blast
+  {
+    AOT_assume \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+    AOT_hence \<open>\<forall>\<alpha> \<psi>{\<alpha>}\<close> using 1 "\<forall>I" "\<forall>E"(4) "\<equiv>E" by metis
+  }
+  moreover {
+    AOT_assume \<open>\<forall>\<alpha> \<psi>{\<alpha>}\<close>
+    AOT_hence \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close> using 1 "\<forall>I" "\<forall>E"(4) "\<equiv>E" by metis
+  }
+  ultimately AOT_show \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<forall>\<alpha> \<psi>{\<alpha>}\<close>
+    using "\<equiv>I" "\<rightarrow>I" by auto
+qed
+
+AOT_theorem "cqt-basic:4": \<open>\<forall>\<alpha>(\<phi>{\<alpha>} & \<psi>{\<alpha>}) \<rightarrow> (\<forall>\<alpha> \<phi>{\<alpha>} & \<forall>\<alpha> \<psi>{\<alpha>})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<forall>\<alpha>(\<phi>{\<alpha>} & \<psi>{\<alpha>})\<close>
+  AOT_have \<open>\<phi>{\<alpha>}\<close> and \<open>\<psi>{\<alpha>}\<close> for \<alpha> using "\<forall>E"(2) 0 "&E" by blast+
+  AOT_thus \<open>\<forall>\<alpha> \<phi>{\<alpha>} & \<forall>\<alpha> \<psi>{\<alpha>}\<close>
+    by (auto intro: "\<forall>I" "&I")
+qed
+
+AOT_theorem "cqt-basic:5": \<open>(\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n(\<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n})) \<rightarrow> \<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}\<close>
+  using "cqt-orig:3" by blast
+
+AOT_theorem "cqt-basic:6": \<open>\<forall>\<alpha>\<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<forall>\<alpha> \<phi>{\<alpha>}\<close>
+  by (meson "\<equiv>I" "\<rightarrow>I" GEN "cqt-orig:1[const_var]")
+
+AOT_theorem "cqt-basic:7": \<open>(\<phi> \<rightarrow> \<forall>\<alpha> \<psi>{\<alpha>}) \<equiv> \<forall>\<alpha>(\<phi> \<rightarrow> \<psi>{\<alpha>})\<close>
+  by (metis "\<rightarrow>I" "vdash-properties:6" "rule-ui:3" "\<equiv>I" GEN)
+
+AOT_theorem "cqt-basic:8": \<open>(\<forall>\<alpha> \<phi>{\<alpha>} \<or> \<forall>\<alpha> \<psi>{\<alpha>}) \<rightarrow> \<forall>\<alpha> (\<phi>{\<alpha>} \<or> \<psi>{\<alpha>})\<close>
+  by (simp add: "\<or>I"(3) "\<rightarrow>I" GEN "cqt-orig:1[const_var]")
+
+AOT_theorem "cqt-basic:9":
+  \<open>(\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) & \<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})) \<rightarrow> \<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})\<close>
+proof -
+  {
+    AOT_assume \<open>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>})\<close>
+    moreover AOT_assume \<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})\<close>
+    ultimately AOT_have \<open>\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}\<close> and \<open>\<psi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>}\<close> for \<alpha>
+      using "\<forall>E" by blast+
+    AOT_hence \<open>\<phi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>}\<close> for \<alpha> by (metis "\<rightarrow>E" "\<rightarrow>I")
+    AOT_hence \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})\<close> using "\<forall>I" by fast
+  }
+  thus ?thesis using "&I" "\<rightarrow>I" "&E" by meson
+qed
+
+AOT_theorem "cqt-basic:10":
+  \<open>(\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) & \<forall>\<alpha>(\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>})) \<rightarrow> \<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<chi>{\<alpha>})\<close>
+proof(rule "\<rightarrow>I"; rule "\<forall>I")
+  fix \<beta>
+  AOT_assume \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) & \<forall>\<alpha>(\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>})\<close>
+  AOT_hence \<open>\<phi>{\<beta>} \<equiv> \<psi>{\<beta>}\<close> and \<open>\<psi>{\<beta>} \<equiv> \<chi>{\<beta>}\<close> using "&E" "\<forall>E" by blast+
+  AOT_thus \<open>\<phi>{\<beta>} \<equiv> \<chi>{\<beta>}\<close> using "\<equiv>I" "\<equiv>E" by blast
+qed
+
+AOT_theorem "cqt-basic:11": \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) \<equiv> \<forall>\<alpha> (\<psi>{\<alpha>} \<equiv> \<phi>{\<alpha>})\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  {
+    fix \<alpha>
+    AOT_have \<open>\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}\<close> using 0 "\<forall>E" by blast
+    AOT_hence \<open>\<psi>{\<alpha>} \<equiv> \<phi>{\<alpha>}\<close> using "\<equiv>I" "\<equiv>E" "\<rightarrow>I" "\<rightarrow>E" by metis
+  }
+  AOT_thus \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<equiv> \<phi>{\<alpha>})\<close> using "\<forall>I" by fast
+next
+  AOT_assume 0: \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<equiv> \<phi>{\<alpha>})\<close>
+  {
+    fix \<alpha>
+    AOT_have \<open>\<psi>{\<alpha>} \<equiv> \<phi>{\<alpha>}\<close> using 0 "\<forall>E" by blast
+    AOT_hence \<open>\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}\<close> using "\<equiv>I" "\<equiv>E" "\<rightarrow>I" "\<rightarrow>E" by metis
+  }
+  AOT_thus \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close> using "\<forall>I" by fast
+qed
+
+AOT_theorem "cqt-basic:12": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+  by (simp add: "\<forall>E"(2) "\<rightarrow>I" GEN)
+
+AOT_theorem "cqt-basic:13": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<forall>\<beta> \<phi>{\<beta>}\<close>
+  using "\<equiv>I" "\<rightarrow>I" by blast
+
+AOT_theorem "cqt-basic:14":
+  \<open>(\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n (\<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} \<rightarrow> \<psi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n})) \<rightarrow>
+   ((\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n \<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}) \<rightarrow> (\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n \<psi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}))\<close>
+  using "cqt:3"[axiom_inst] by auto
+
+AOT_theorem "cqt-basic:15":
+  \<open>(\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n (\<phi> \<rightarrow> \<psi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n})) \<rightarrow> (\<phi> \<rightarrow> (\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n \<psi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}))\<close>
+  using "cqt-orig:2" by auto
+
+AOT_theorem "universal-cor":
+  assumes \<open>for arbitrary \<beta>: \<phi>{\<beta>}\<close>
+  shows \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+  using GEN assms .
+
+AOT_theorem "existential:1":
+  assumes \<open>\<phi>{\<tau>}\<close> and \<open>\<tau>\<down>\<close>
+  shows \<open>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+proof(rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  AOT_hence \<open>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+    using "\<equiv>\<^sub>d\<^sub>fI" "conventions:4" RAA "&I" by blast
+  AOT_hence \<open>\<not>\<phi>{\<tau>}\<close> using assms(2) "\<forall>E"(1) "\<rightarrow>E" by blast
+  AOT_thus \<open>\<phi>{\<tau>} & \<not>\<phi>{\<tau>}\<close> using assms(1) "&I" by blast
+qed
+
+AOT_theorem "existential:2[const_var]":
+  assumes \<open>\<phi>{\<beta>}\<close>
+  shows \<open>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  using "existential:1" "cqt:2[const_var]"[axiom_inst] assms by blast
+
+AOT_theorem "existential:2[lambda]":
+  assumes \<open>\<phi>{[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]}\<close> and \<open>INSTANCE_OF_CQT_2(\<psi>)\<close>
+  shows \<open>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  using "existential:1" "cqt:2[lambda]"[axiom_inst] assms by blast
+lemmas "\<exists>I" = "existential:1" "existential:2[const_var]"
+              "existential:2[lambda]" 
+
+AOT_theorem "instantiation":
+  assumes \<open>for arbitrary \<beta>: \<phi>{\<beta>} \<^bold>\<turnstile> \<psi>\<close> and \<open>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  shows \<open>\<psi>\<close>
+  by (metis (no_types, lifting) "\<equiv>\<^sub>d\<^sub>fE" GEN "raa-cor:3" "conventions:4" assms)
+lemmas "\<exists>E" = "instantiation"
+
+AOT_theorem "cqt-further:1": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  using "\<forall>E"(4) "\<exists>I"(2) "\<rightarrow>I" by metis
+
+AOT_theorem "cqt-further:2": \<open>\<not>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<exists>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+  using "\<forall>I" "\<exists>I"(2) "\<rightarrow>I" RAA by metis
+
+AOT_theorem "cqt-further:3": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<not>\<exists>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+  using "\<forall>E"(4) "\<exists>E" "\<rightarrow>I" RAA
+  by (metis "cqt-further:2" "\<equiv>I" "modus-tollens:1")
+
+AOT_theorem "cqt-further:4": \<open>\<not>\<exists>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+  using "\<forall>I" "\<exists>I"(2)"\<rightarrow>I" RAA by metis
+
+AOT_theorem "cqt-further:5": \<open>\<exists>\<alpha> (\<phi>{\<alpha>} & \<psi>{\<alpha>}) \<rightarrow> (\<exists>\<alpha> \<phi>{\<alpha>} & \<exists>\<alpha> \<psi>{\<alpha>})\<close>
+  by (metis (no_types, lifting) "&E" "&I" "\<exists>E" "\<exists>I"(2) "\<rightarrow>I")
+
+AOT_theorem "cqt-further:6": \<open>\<exists>\<alpha> (\<phi>{\<alpha>} \<or> \<psi>{\<alpha>}) \<rightarrow> (\<exists>\<alpha> \<phi>{\<alpha>} \<or> \<exists>\<alpha> \<psi>{\<alpha>})\<close>
+  by (metis (mono_tags, lifting) "\<exists>E" "\<exists>I"(2) "\<or>E"(3) "\<or>I"(1, 2) "\<rightarrow>I" RAA(2))
+
+(* NOTE: vacuous in the embedding *)
+AOT_theorem "cqt-further:7": \<open>\<exists>\<alpha> \<phi>{\<alpha>} \<equiv> \<exists>\<beta> \<phi>{\<beta>}\<close>
+  by (simp add: "oth-class-taut:3:a")
+
+AOT_theorem "cqt-further:8":
+  \<open>(\<forall>\<alpha> \<phi>{\<alpha>} & \<forall>\<alpha> \<psi>{\<alpha>}) \<rightarrow> \<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  by (metis (mono_tags, lifting) "&E" "\<equiv>I" "\<forall>E"(2) "\<rightarrow>I" GEN)
+
+AOT_theorem "cqt-further:9":
+  \<open>(\<not>\<exists>\<alpha> \<phi>{\<alpha>} & \<not>\<exists>\<alpha> \<psi>{\<alpha>}) \<rightarrow> \<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  by (metis (mono_tags, lifting) "&E" "\<equiv>I" "\<exists>I"(2) "\<rightarrow>I" GEN "raa-cor:4")
+
+AOT_theorem "cqt-further:10":
+  \<open>(\<exists>\<alpha> \<phi>{\<alpha>} & \<not>\<exists>\<alpha> \<psi>{\<alpha>}) \<rightarrow> \<not>\<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume 0: \<open>\<exists>\<alpha> \<phi>{\<alpha>} & \<not>\<exists>\<alpha> \<psi>{\<alpha>}\<close>
+  then AOT_obtain \<alpha> where \<open>\<phi>{\<alpha>}\<close> using "\<exists>E" "&E"(1) by metis
+  moreover AOT_assume \<open>\<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  ultimately AOT_have \<open>\<psi>{\<alpha>}\<close> using "\<forall>E"(4) "\<equiv>E"(1) by blast
+  AOT_hence \<open>\<exists>\<alpha> \<psi>{\<alpha>}\<close> using "\<exists>I" by blast
+  AOT_thus \<open>\<exists>\<alpha> \<psi>{\<alpha>} & \<not>\<exists>\<alpha> \<psi>{\<alpha>}\<close> using 0 "&E"(2) "&I" by blast
+qed
+
+AOT_theorem "cqt-further:11": \<open>\<exists>\<alpha>\<exists>\<beta> \<phi>{\<alpha>,\<beta>} \<equiv> \<exists>\<beta>\<exists>\<alpha> \<phi>{\<alpha>,\<beta>}\<close>
+  using "\<equiv>I" "\<rightarrow>I" "\<exists>I"(2) "\<exists>E" by metis
+
+subsection\<open>Logical Existence, Identity, and Truth\<close>
+text\<open>\label{PLM: 9.7}\<close>
+
+AOT_theorem "log-prop-prop:1": \<open>[\<lambda> \<phi>]\<down>\<close>
+  using "cqt:2[lambda0]"[axiom_inst] by auto
+
+AOT_theorem "log-prop-prop:2": \<open>\<phi>\<down>\<close>
+  by (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "existence:3"]) "cqt:2[lambda]"
+
+AOT_theorem "exist-nec": \<open>\<tau>\<down> \<rightarrow> \<box>\<tau>\<down>\<close>
+proof -
+  AOT_have \<open>\<forall>\<beta> \<box>\<beta>\<down>\<close>
+    by (simp add: GEN RN "cqt:2[const_var]"[axiom_inst])
+  AOT_thus \<open>\<tau>\<down> \<rightarrow> \<box>\<tau>\<down>\<close>
+    using "cqt:1"[axiom_inst] "\<rightarrow>E" by blast
+qed
+
+(* TODO: replace this mechanism by a "proof by types" command *)
+class AOT_Term_id = AOT_Term +
+  assumes "t=t-proper:1"[AOT]: \<open>[v \<Turnstile> \<tau> = \<tau>' \<rightarrow> \<tau>\<down>]\<close>
+      and "t=t-proper:2"[AOT]: \<open>[v \<Turnstile> \<tau> = \<tau>' \<rightarrow> \<tau>'\<down>]\<close>
+
+instance \<kappa> :: AOT_Term_id
+proof
+  AOT_modally_strict {
+    AOT_show \<open>\<kappa> = \<kappa>' \<rightarrow> \<kappa>\<down>\<close> for \<kappa> \<kappa>'
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<kappa> = \<kappa>'\<close>
+      AOT_hence \<open>O!\<kappa> \<or> A!\<kappa>\<close>
+        by (rule "\<or>I"(3)[OF "\<equiv>\<^sub>d\<^sub>fE"[OF "identity:1"]])
+           (meson "\<rightarrow>I" "\<or>I"(1) "&E"(1))+
+      AOT_thus \<open>\<kappa>\<down>\<close>
+        by (rule "\<or>E"(1))
+           (metis "cqt:5:a"[axiom_inst] "\<rightarrow>I" "\<rightarrow>E" "&E"(2))+
+    qed
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<kappa> = \<kappa>' \<rightarrow> \<kappa>'\<down>\<close> for \<kappa> \<kappa>'
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<kappa> = \<kappa>'\<close>
+      AOT_hence \<open>O!\<kappa>' \<or> A!\<kappa>'\<close>
+        by (rule "\<or>I"(3)[OF "\<equiv>\<^sub>d\<^sub>fE"[OF "identity:1"]])
+           (meson "\<rightarrow>I" "\<or>I" "&E")+
+      AOT_thus \<open>\<kappa>'\<down>\<close>
+        by (rule "\<or>E"(1))
+           (metis "cqt:5:a"[axiom_inst] "\<rightarrow>I" "\<rightarrow>E" "&E"(2))+
+    qed
+  }
+qed
+
+instance rel :: (AOT_\<kappa>s) AOT_Term_id
+proof
+  AOT_modally_strict {
+    AOT_show \<open>\<Pi> = \<Pi>' \<rightarrow> \<Pi>\<down>\<close> for \<Pi> \<Pi>' :: \<open><'a>\<close>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<Pi> = \<Pi>'\<close>
+      AOT_thus \<open>\<Pi>\<down>\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "identity:3"[of \<Pi> \<Pi>']] "&E" by blast
+    qed
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<Pi> = \<Pi>' \<rightarrow> \<Pi>'\<down>\<close> for \<Pi> \<Pi>' :: \<open><'a>\<close>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<Pi> = \<Pi>'\<close>
+      AOT_thus \<open>\<Pi>'\<down>\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "identity:3"[of \<Pi> \<Pi>']] "&E" by blast
+    qed
+  }
+qed
+
+instance \<o> :: AOT_Term_id
+proof
+  AOT_modally_strict {
+    fix \<phi> \<psi>
+    AOT_show \<open>\<phi> = \<psi> \<rightarrow> \<phi>\<down>\<close>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<phi> = \<psi>\<close>
+      AOT_thus \<open>\<phi>\<down>\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "identity:4"[of \<phi> \<psi>]] "&E" by blast
+    qed
+  }
+next
+  AOT_modally_strict {
+    fix \<phi> \<psi>
+    AOT_show \<open>\<phi> = \<psi> \<rightarrow> \<psi>\<down>\<close>
+    proof(rule "\<rightarrow>I")
+      AOT_assume \<open>\<phi> = \<psi>\<close>
+      AOT_thus \<open>\<psi>\<down>\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "identity:4"[of \<phi> \<psi>]] "&E" by blast
+    qed
+  }
+qed
+
+instance prod :: (AOT_Term_id, AOT_Term_id) AOT_Term_id
+proof
+  AOT_modally_strict {
+    fix \<tau> \<tau>' :: \<open>'a\<times>'b\<close>
+    AOT_show \<open>\<tau> = \<tau>' \<rightarrow> \<tau>\<down>\<close>
+    proof (induct \<tau>; induct \<tau>'; rule "\<rightarrow>I")
+      fix \<tau>\<^sub>1 \<tau>\<^sub>1' :: 'a and \<tau>\<^sub>2  \<tau>\<^sub>2' :: 'b
+      AOT_assume \<open>\<guillemotleft>(\<tau>\<^sub>1, \<tau>\<^sub>2)\<guillemotright> = \<guillemotleft>(\<tau>\<^sub>1', \<tau>\<^sub>2')\<guillemotright>\<close>
+      AOT_hence \<open>(\<tau>\<^sub>1 = \<tau>\<^sub>1') & (\<tau>\<^sub>2 = \<tau>\<^sub>2')\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" tuple_identity_1)
+      AOT_hence \<open>\<tau>\<^sub>1\<down>\<close> and \<open>\<tau>\<^sub>2\<down>\<close>
+        using "t=t-proper:1" "&E" "vdash-properties:10" by blast+
+      AOT_thus \<open>\<guillemotleft>(\<tau>\<^sub>1, \<tau>\<^sub>2)\<guillemotright>\<down>\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" tuple_denotes)
+    qed
+  }
+next
+  AOT_modally_strict {
+    fix \<tau> \<tau>' :: \<open>'a\<times>'b\<close>
+    AOT_show \<open>\<tau> = \<tau>' \<rightarrow> \<tau>'\<down>\<close>
+    proof (induct \<tau>; induct \<tau>'; rule "\<rightarrow>I")
+      fix \<tau>\<^sub>1 \<tau>\<^sub>1' :: 'a and \<tau>\<^sub>2  \<tau>\<^sub>2' :: 'b
+      AOT_assume \<open>\<guillemotleft>(\<tau>\<^sub>1, \<tau>\<^sub>2)\<guillemotright> = \<guillemotleft>(\<tau>\<^sub>1', \<tau>\<^sub>2')\<guillemotright>\<close>
+      AOT_hence \<open>(\<tau>\<^sub>1 = \<tau>\<^sub>1') & (\<tau>\<^sub>2 = \<tau>\<^sub>2')\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" tuple_identity_1)
+      AOT_hence \<open>\<tau>\<^sub>1'\<down>\<close> and \<open>\<tau>\<^sub>2'\<down>\<close>
+        using "t=t-proper:2" "&E" "vdash-properties:10" by blast+
+      AOT_thus \<open>\<guillemotleft>(\<tau>\<^sub>1', \<tau>\<^sub>2')\<guillemotright>\<down>\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" tuple_denotes)
+    qed
+  }
+qed
+
+(* This is the end of the "proof by types" and
+   makes the results available on new theorems *)
+AOT_register_type_constraints
+  Term: \<open>_::AOT_Term_id\<close> \<open>_::AOT_Term_id\<close>
+AOT_register_type_constraints
+  Individual: \<open>\<kappa>\<close> \<open>_::{AOT_\<kappa>s, AOT_Term_id}\<close>
+AOT_register_type_constraints
+  Relation: \<open><_::{AOT_\<kappa>s, AOT_Term_id}>\<close>
+
+AOT_theorem "id-rel-nec-equiv:1":
+  \<open>\<Pi> = \<Pi>' \<rightarrow> \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>']x\<^sub>1...x\<^sub>n)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume assumption: \<open>\<Pi> = \<Pi>'\<close>
+  AOT_hence \<open>\<Pi>\<down>\<close> and \<open>\<Pi>'\<down>\<close>
+    using "t=t-proper:1" "t=t-proper:2" MP by blast+
+  moreover AOT_have \<open>\<forall>F\<forall>G (F = G \<rightarrow> ((\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]x\<^sub>1...x\<^sub>n)) \<rightarrow>
+                                     \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)))\<close>
+    apply (rule GEN)+ using "l-identity"[axiom_inst] by force
+  ultimately AOT_have \<open>\<Pi> = \<Pi>' \<rightarrow> ((\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>]x\<^sub>1...x\<^sub>n)) \<rightarrow>
+                                   \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>']x\<^sub>1...x\<^sub>n))\<close>
+    using "\<forall>E"(1) by blast
+  AOT_hence \<open>(\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>]x\<^sub>1...x\<^sub>n)) \<rightarrow>
+             \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>']x\<^sub>1...x\<^sub>n)\<close>
+    using assumption "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>]x\<^sub>1...x\<^sub>n)\<close>
+    by (simp add: RN "oth-class-taut:3:a" "universal-cor")
+  ultimately AOT_show \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([\<Pi>]x\<^sub>1...x\<^sub>n \<equiv> [\<Pi>']x\<^sub>1...x\<^sub>n)\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "id-rel-nec-equiv:2": \<open>\<phi> = \<psi> \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume assumption: \<open>\<phi> = \<psi>\<close>
+  AOT_hence \<open>\<phi>\<down>\<close> and \<open>\<psi>\<down>\<close>
+    using "t=t-proper:1" "t=t-proper:2" MP by blast+
+  moreover AOT_have \<open>\<forall>p\<forall>q (p = q \<rightarrow> ((\<box>(p \<equiv> p) \<rightarrow> \<box>(p \<equiv> q))))\<close>
+    apply (rule GEN)+ using "l-identity"[axiom_inst] by force
+  ultimately AOT_have \<open>\<phi> = \<psi> \<rightarrow> (\<box>(\<phi> \<equiv> \<phi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
+    using "\<forall>E"(1) by blast
+  AOT_hence \<open>\<box>(\<phi> \<equiv> \<phi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+    using assumption "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<box>(\<phi> \<equiv> \<phi>)\<close>
+    by (simp add: RN "oth-class-taut:3:a" "universal-cor")
+  ultimately AOT_show \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "rule=E":
+  assumes \<open>\<phi>{\<tau>}\<close> and \<open>\<tau> = \<sigma>\<close>
+  shows \<open>\<phi>{\<sigma>}\<close>
+proof -
+  AOT_have \<open>\<tau>\<down>\<close> and \<open>\<sigma>\<down>\<close>
+    using assms(2) "t=t-proper:1" "t=t-proper:2" "\<rightarrow>E" by blast+
+  moreover AOT_have \<open>\<forall>\<alpha>\<forall>\<beta>(\<alpha> = \<beta> \<rightarrow> (\<phi>{\<alpha>} \<rightarrow> \<phi>{\<beta>}))\<close>
+    apply (rule GEN)+ using "l-identity"[axiom_inst] by blast
+  ultimately AOT_have \<open>\<tau> = \<sigma> \<rightarrow> (\<phi>{\<tau>} \<rightarrow> \<phi>{\<sigma>})\<close>
+    using "\<forall>E"(1) by blast
+  AOT_thus \<open>\<phi>{\<sigma>}\<close> using assms "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "propositions-lemma:1": \<open>[\<lambda> \<phi>] = \<phi>\<close>
+proof -
+  AOT_have \<open>\<phi>\<down>\<close> by (simp add: "log-prop-prop:2")
+  moreover AOT_have \<open>\<forall>p [\<lambda> p] = p\<close>
+    using "lambda-predicates:3[zero]"[axiom_inst] "\<forall>I" by fast
+  ultimately AOT_show \<open>[\<lambda> \<phi>] = \<phi>\<close>
+    using "\<forall>E" by blast
+qed
+
+AOT_theorem "propositions-lemma:2": \<open>[\<lambda> \<phi>] \<equiv> \<phi>\<close>
+proof -
+  AOT_have \<open>[\<lambda> \<phi>] \<equiv> [\<lambda> \<phi>]\<close> by (simp add: "oth-class-taut:3:a")
+  AOT_thus \<open>[\<lambda> \<phi>] \<equiv> \<phi>\<close> using "propositions-lemma:1" "rule=E" by blast
+qed
+
+text\<open>propositions-lemma:3 through propositions-lemma:5 hold implicitly\<close>
+
+AOT_theorem "propositions-lemma:6": \<open>(\<phi> \<equiv> \<psi>) \<equiv> ([\<lambda> \<phi>] \<equiv> [\<lambda> \<psi>])\<close>
+  by (metis "\<equiv>E"(1) "\<equiv>E"(5) "Associativity of \<equiv>" "propositions-lemma:2")
+
+text\<open>dr-alphabetic-rules holds implicitly\<close>
+
+AOT_theorem "oa-exist:1": \<open>O!\<down>\<close>
+proof -
+  AOT_have \<open>[\<lambda>x \<diamond>[E!]x]\<down>\<close> by "cqt:2[lambda]"
+  AOT_hence 1: \<open>O! = [\<lambda>x \<diamond>[E!]x]\<close>
+    using "df-rules-terms[4]"[OF "oa:1", THEN "&E"(1)] "\<rightarrow>E" by blast
+  AOT_show \<open>O!\<down>\<close> using "t=t-proper:1"[THEN "\<rightarrow>E", OF 1] by simp
+qed
+
+AOT_theorem "oa-exist:2": \<open>A!\<down>\<close>
+proof -
+  AOT_have \<open>[\<lambda>x \<not>\<diamond>[E!]x]\<down>\<close> by "cqt:2[lambda]"
+  AOT_hence 1: \<open>A! = [\<lambda>x \<not>\<diamond>[E!]x]\<close>
+    using "df-rules-terms[4]"[OF "oa:2", THEN "&E"(1)] "\<rightarrow>E" by blast
+  AOT_show \<open>A!\<down>\<close> using "t=t-proper:1"[THEN "\<rightarrow>E", OF 1] by simp
+qed
+
+AOT_theorem "oa-exist:3": \<open>O!x \<or> A!x\<close>
+proof(rule "raa-cor:1")
+  AOT_assume \<open>\<not>(O!x \<or> A!x)\<close>
+  AOT_hence A: \<open>\<not>O!x\<close> and B: \<open>\<not>A!x\<close>
+    using "Disjunction Addition"(1) "modus-tollens:1"
+          "\<or>I"(2) "raa-cor:5" by blast+
+  AOT_have C: \<open>O! = [\<lambda>x \<diamond>[E!]x]\<close>
+    by (rule "df-rules-terms[4]"[OF "oa:1", THEN "&E"(1), THEN "\<rightarrow>E"]) "cqt:2"
+  AOT_have D: \<open>A! = [\<lambda>x \<not>\<diamond>[E!]x]\<close>
+    by (rule "df-rules-terms[4]"[OF "oa:2", THEN "&E"(1), THEN "\<rightarrow>E"]) "cqt:2"
+  AOT_have E: \<open>\<not>[\<lambda>x \<diamond>[E!]x]x\<close>
+    using A C "rule=E" by fast
+  AOT_have F: \<open>\<not>[\<lambda>x \<not>\<diamond>[E!]x]x\<close>
+    using B D "rule=E" by fast
+  AOT_have G: \<open>[\<lambda>x \<diamond>[E!]x]x \<equiv> \<diamond>[E!]x\<close>
+    by (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E"]) "cqt:2"
+  AOT_have H: \<open>[\<lambda>x \<not>\<diamond>[E!]x]x \<equiv> \<not>\<diamond>[E!]x\<close>
+    by (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E"]) "cqt:2"
+  AOT_show \<open>\<not>\<diamond>[E!]x & \<not>\<not>\<diamond>[E!]x\<close> using G E "\<equiv>E" H F "\<equiv>E" "&I" by metis
+qed
+
+AOT_theorem "p-identity-thm2:1": \<open>F = G \<equiv> \<box>\<forall>x(x[F] \<equiv> x[G])\<close>
+proof -
+  AOT_have \<open>F = G \<equiv> F\<down> & G\<down> & \<box>\<forall>x(x[F] \<equiv> x[G])\<close>
+    using "identity:2" "df-rules-formulas[3]" "df-rules-formulas[4]"
+          "\<rightarrow>E" "&E" "\<equiv>I" "\<rightarrow>I" by blast
+  moreover AOT_have \<open>F\<down>\<close> and \<open>G\<down>\<close>
+    by (auto simp: "cqt:2[const_var]"[axiom_inst])
+  ultimately AOT_show \<open>F = G \<equiv> \<box>\<forall>x(x[F] \<equiv> x[G])\<close>
+    using "\<equiv>S"(1) "&I" by blast
+qed
+
+AOT_theorem "p-identity-thm2:2[2]":
+  \<open>F = G \<equiv> \<forall>y\<^sub>1([\<lambda>x [F]xy\<^sub>1] = [\<lambda>x [G]xy\<^sub>1] & [\<lambda>x [F]y\<^sub>1x] = [\<lambda>x [G]y\<^sub>1x])\<close>
+proof -
+  AOT_have \<open>F = G \<equiv> F\<down> & G\<down> &
+              \<forall>y\<^sub>1([\<lambda>x [F]xy\<^sub>1] = [\<lambda>x [G]xy\<^sub>1] & [\<lambda>x [F]y\<^sub>1x] = [\<lambda>x [G]y\<^sub>1x])\<close>
+    using "identity:3[2]" "df-rules-formulas[3]" "df-rules-formulas[4]"
+          "\<rightarrow>E" "&E" "\<equiv>I" "\<rightarrow>I" by blast
+  moreover AOT_have \<open>F\<down>\<close> and \<open>G\<down>\<close>
+    by (auto simp: "cqt:2[const_var]"[axiom_inst])
+  ultimately show ?thesis
+    using "\<equiv>S"(1) "&I" by blast
+qed
+    
+AOT_theorem "p-identity-thm2:2[3]":
+  \<open>F = G \<equiv> \<forall>y\<^sub>1\<forall>y\<^sub>2([\<lambda>x [F]xy\<^sub>1y\<^sub>2] = [\<lambda>x [G]xy\<^sub>1y\<^sub>2] &
+                  [\<lambda>x [F]y\<^sub>1xy\<^sub>2] = [\<lambda>x [G]y\<^sub>1xy\<^sub>2] &
+                  [\<lambda>x [F]y\<^sub>1y\<^sub>2x] = [\<lambda>x [G]y\<^sub>1y\<^sub>2x])\<close>
+proof -
+  AOT_have \<open>F = G \<equiv> F\<down> & G\<down> & \<forall>y\<^sub>1\<forall>y\<^sub>2([\<lambda>x [F]xy\<^sub>1y\<^sub>2] = [\<lambda>x [G]xy\<^sub>1y\<^sub>2] &
+                                     [\<lambda>x [F]y\<^sub>1xy\<^sub>2] = [\<lambda>x [G]y\<^sub>1xy\<^sub>2] &
+                                     [\<lambda>x [F]y\<^sub>1y\<^sub>2x] = [\<lambda>x [G]y\<^sub>1y\<^sub>2x])\<close>
+    using "identity:3[3]" "df-rules-formulas[3]" "df-rules-formulas[4]"
+          "\<rightarrow>E" "&E" "\<equiv>I" "\<rightarrow>I" by blast
+  moreover AOT_have \<open>F\<down>\<close> and \<open>G\<down>\<close>
+    by (auto simp: "cqt:2[const_var]"[axiom_inst])
+  ultimately show ?thesis
+    using "\<equiv>S"(1) "&I" by blast
+qed
+
+AOT_theorem "p-identity-thm2:2[4]":
+  \<open>F = G \<equiv> \<forall>y\<^sub>1\<forall>y\<^sub>2\<forall>y\<^sub>3([\<lambda>x [F]xy\<^sub>1y\<^sub>2y\<^sub>3] = [\<lambda>x [G]xy\<^sub>1y\<^sub>2y\<^sub>3] &
+                     [\<lambda>x [F]y\<^sub>1xy\<^sub>2y\<^sub>3] = [\<lambda>x [G]y\<^sub>1xy\<^sub>2y\<^sub>3] &
+                     [\<lambda>x [F]y\<^sub>1y\<^sub>2xy\<^sub>3] = [\<lambda>x [G]y\<^sub>1y\<^sub>2xy\<^sub>3] &
+                     [\<lambda>x [F]y\<^sub>1y\<^sub>2y\<^sub>3x] = [\<lambda>x [G]y\<^sub>1y\<^sub>2y\<^sub>3x])\<close>
+proof -
+  AOT_have \<open>F = G \<equiv> F\<down> & G\<down> & \<forall>y\<^sub>1\<forall>y\<^sub>2\<forall>y\<^sub>3([\<lambda>x [F]xy\<^sub>1y\<^sub>2y\<^sub>3] = [\<lambda>x [G]xy\<^sub>1y\<^sub>2y\<^sub>3] &
+                                        [\<lambda>x [F]y\<^sub>1xy\<^sub>2y\<^sub>3] = [\<lambda>x [G]y\<^sub>1xy\<^sub>2y\<^sub>3] &
+                                        [\<lambda>x [F]y\<^sub>1y\<^sub>2xy\<^sub>3] = [\<lambda>x [G]y\<^sub>1y\<^sub>2xy\<^sub>3] &
+                                        [\<lambda>x [F]y\<^sub>1y\<^sub>2y\<^sub>3x] = [\<lambda>x [G]y\<^sub>1y\<^sub>2y\<^sub>3x])\<close>
+    using "identity:3[4]" "df-rules-formulas[3]" "df-rules-formulas[4]"
+          "\<rightarrow>E" "&E" "\<equiv>I" "\<rightarrow>I" by blast
+  moreover AOT_have \<open>F\<down>\<close> and \<open>G\<down>\<close>
+    by (auto simp: "cqt:2[const_var]"[axiom_inst])
+  ultimately show ?thesis
+    using "\<equiv>S"(1) "&I" by blast
+qed
+
+AOT_theorem "p-identity-thm2:2":
+  \<open>F = G \<equiv> \<forall>x\<^sub>1...\<forall>x\<^sub>n \<guillemotleft>AOT_sem_proj_id x\<^sub>1x\<^sub>n (\<lambda> \<tau> . \<guillemotleft>[F]\<tau>\<guillemotright>) (\<lambda> \<tau> . \<guillemotleft>[G]\<tau>\<guillemotright>)\<guillemotright>\<close>
+proof -
+  AOT_have \<open>F = G \<equiv> F\<down> & G\<down> &
+              \<forall>x\<^sub>1...\<forall>x\<^sub>n \<guillemotleft>AOT_sem_proj_id x\<^sub>1x\<^sub>n (\<lambda> \<tau> . \<guillemotleft>[F]\<tau>\<guillemotright>) (\<lambda> \<tau> . \<guillemotleft>[G]\<tau>\<guillemotright>)\<guillemotright>\<close>
+    using "identity:3" "df-rules-formulas[3]" "df-rules-formulas[4]"
+          "\<rightarrow>E" "&E" "\<equiv>I" "\<rightarrow>I" by blast
+  moreover AOT_have \<open>F\<down>\<close> and \<open>G\<down>\<close>
+    by (auto simp: "cqt:2[const_var]"[axiom_inst])
+  ultimately show ?thesis
+    using "\<equiv>S"(1) "&I" by blast
+qed
+
+AOT_theorem "p-identity-thm2:3":
+  \<open>p = q \<equiv> [\<lambda>x p] = [\<lambda>x q]\<close>
+proof -
+  AOT_have \<open>p = q \<equiv> p\<down> & q\<down> & [\<lambda>x p] = [\<lambda>x q]\<close>
+    using "identity:4" "df-rules-formulas[3]" "df-rules-formulas[4]"
+          "\<rightarrow>E" "&E" "\<equiv>I" "\<rightarrow>I" by blast
+  moreover AOT_have \<open>p\<down>\<close> and \<open>q\<down>\<close>
+    by (auto simp: "cqt:2[const_var]"[axiom_inst])
+  ultimately show ?thesis
+    using "\<equiv>S"(1) "&I" by blast
+qed
+
+class AOT_Term_id_2 = AOT_Term_id + assumes "id-eq:1": \<open>[v \<Turnstile> \<alpha> = \<alpha>]\<close>
+
+instance \<kappa> :: AOT_Term_id_2
+proof
+  AOT_modally_strict {
+    fix x
+    {
+      AOT_assume \<open>O!x\<close>
+      moreover AOT_have \<open>\<box>\<forall>F([F]x \<equiv> [F]x)\<close>
+        using RN GEN "oth-class-taut:3:a" by fast
+      ultimately AOT_have \<open>O!x & O!x & \<box>\<forall>F([F]x \<equiv> [F]x)\<close> using "&I" by simp
+    }
+    moreover {
+      AOT_assume \<open>A!x\<close>
+      moreover AOT_have \<open>\<box>\<forall>F(x[F] \<equiv> x[F])\<close>
+        using RN GEN "oth-class-taut:3:a" by fast
+      ultimately AOT_have \<open>A!x & A!x & \<box>\<forall>F(x[F] \<equiv> x[F])\<close> using "&I" by simp
+    }
+    ultimately AOT_have \<open>(O!x & O!x & \<box>\<forall>F([F]x \<equiv> [F]x)) \<or>
+                         (A!x & A!x & \<box>\<forall>F(x[F] \<equiv> x[F]))\<close>
+      using "oa-exist:3" "\<or>I"(1) "\<or>I"(2) "\<or>E"(3) "raa-cor:1" by blast
+    AOT_thus \<open>x = x\<close>
+      using "identity:1"[THEN "df-rules-formulas[4]"] "\<rightarrow>E" by blast
+  }
+qed
+
+instance rel :: ("{AOT_\<kappa>s,AOT_Term_id_2}") AOT_Term_id_2
+proof
+  AOT_modally_strict {
+    fix F :: "<'a> AOT_var"
+    AOT_have 0: \<open>[\<lambda>x\<^sub>1...x\<^sub>n [F]x\<^sub>1...x\<^sub>n] = F\<close>
+      by (simp add: "lambda-predicates:3"[axiom_inst])
+    AOT_have \<open>[\<lambda>x\<^sub>1...x\<^sub>n [F]x\<^sub>1...x\<^sub>n]\<down>\<close>
+      by "cqt:2[lambda]"
+    AOT_hence \<open>[\<lambda>x\<^sub>1...x\<^sub>n [F]x\<^sub>1...x\<^sub>n] = [\<lambda>x\<^sub>1...x\<^sub>n [F]x\<^sub>1...x\<^sub>n]\<close>
+      using "lambda-predicates:1"[axiom_inst] "\<rightarrow>E" by blast
+    AOT_show \<open>F = F\<close> using "rule=E" 0 by force 
+  }
+qed
+
+instance \<o> :: AOT_Term_id_2
+proof
+  AOT_modally_strict {
+    fix p
+    AOT_have 0: \<open>[\<lambda> p] = p\<close>
+      by (simp add: "lambda-predicates:3[zero]"[axiom_inst])
+    AOT_have \<open>[\<lambda> p]\<down>\<close>
+      by (rule "cqt:2[lambda0]"[axiom_inst])
+    AOT_hence \<open>[\<lambda> p] = [\<lambda> p]\<close>
+      using "lambda-predicates:1[zero]"[axiom_inst] "\<rightarrow>E" by blast
+    AOT_show \<open>p = p\<close> using "rule=E" 0 by force
+  }
+qed
+
+instance prod :: (AOT_Term_id_2, AOT_Term_id_2) AOT_Term_id_2
+proof
+  AOT_modally_strict {
+    fix \<alpha> :: \<open>('a\<times>'b) AOT_var\<close>
+    AOT_show \<open>\<alpha> = \<alpha>\<close>
+    proof (induct)
+      AOT_show \<open>\<tau> = \<tau>\<close> if \<open>\<tau>\<down>\<close> for \<tau> :: \<open>'a\<times>'b\<close>
+        using that
+      proof (induct \<tau>)
+        fix \<tau>\<^sub>1 :: 'a and \<tau>\<^sub>2 :: 'b
+        AOT_assume \<open>\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>\<down>\<close>
+        AOT_hence \<open>\<tau>\<^sub>1\<down>\<close> and \<open>\<tau>\<^sub>2\<down>\<close>
+          using "\<equiv>\<^sub>d\<^sub>fE" "&E" tuple_denotes by blast+
+        AOT_hence \<open>\<tau>\<^sub>1 = \<tau>\<^sub>1\<close> and \<open>\<tau>\<^sub>2 = \<tau>\<^sub>2\<close>
+          using "id-eq:1"[unvarify \<alpha>] by blast+
+        AOT_thus \<open>\<guillemotleft>(\<tau>\<^sub>1, \<tau>\<^sub>2)\<guillemotright> = \<guillemotleft>(\<tau>\<^sub>1, \<tau>\<^sub>2)\<guillemotright>\<close>
+          by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" tuple_identity_1)
+      qed
+    qed
+  }
+qed
+
+AOT_register_type_constraints
+  Term: \<open>_::AOT_Term_id_2\<close> \<open>_::AOT_Term_id_2\<close>
+AOT_register_type_constraints
+  Individual: \<open>\<kappa>\<close> \<open>_::{AOT_\<kappa>s, AOT_Term_id_2}\<close>
+AOT_register_type_constraints
+  Relation: \<open><_::{AOT_\<kappa>s, AOT_Term_id_2}>\<close>
+
+AOT_theorem "id-eq:2": \<open>\<alpha> = \<beta> \<rightarrow> \<beta> = \<alpha>\<close>
+  by (meson "rule=E" "deduction-theorem")
+
+AOT_theorem "id-eq:3": \<open>\<alpha> = \<beta> & \<beta> = \<gamma> \<rightarrow> \<alpha> = \<gamma>\<close>
+  using "rule=E" "\<rightarrow>I" "&E" by blast
+
+AOT_theorem "id-eq:4": \<open>\<alpha> = \<beta> \<equiv> \<forall>\<gamma> (\<alpha> = \<gamma> \<equiv> \<beta> = \<gamma>)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<alpha> = \<beta>\<close>
+  AOT_hence 1: \<open>\<beta> = \<alpha>\<close> using "id-eq:2" "\<rightarrow>E" by blast
+  AOT_show \<open>\<forall>\<gamma> (\<alpha> = \<gamma> \<equiv> \<beta> = \<gamma>)\<close>
+    by (rule GEN) (metis "\<equiv>I" "\<rightarrow>I" 0 "1" "rule=E")
+next
+  AOT_assume \<open>\<forall>\<gamma> (\<alpha> = \<gamma> \<equiv> \<beta> = \<gamma>)\<close>
+  AOT_hence \<open>\<alpha> = \<alpha> \<equiv> \<beta> = \<alpha>\<close> using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<alpha> = \<alpha> \<rightarrow> \<beta> = \<alpha>\<close> using "\<equiv>E"(1) "\<rightarrow>I" by blast
+  AOT_hence \<open>\<beta> = \<alpha>\<close> using "id-eq:1" "\<rightarrow>E" by blast
+  AOT_thus \<open>\<alpha> = \<beta>\<close> using "id-eq:2" "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "rule=I:1":
+  assumes \<open>\<tau>\<down>\<close>
+  shows \<open>\<tau> = \<tau>\<close>
+proof -
+  AOT_have \<open>\<forall>\<alpha> (\<alpha> = \<alpha>)\<close>
+    by (rule GEN) (metis "id-eq:1")
+  AOT_thus \<open>\<tau> = \<tau>\<close> using assms "\<forall>E" by blast
+qed
+
+AOT_theorem "rule=I:2[const_var]": "\<alpha> = \<alpha>"
+  using "id-eq:1".
+
+AOT_theorem "rule=I:2[lambda]":
+  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
+  shows "[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]"
+proof -
+  AOT_have \<open>\<forall>\<alpha> (\<alpha> = \<alpha>)\<close>
+    by (rule GEN) (metis "id-eq:1")
+  moreover AOT_have \<open>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>\<close>
+    using assms by (rule "cqt:2[lambda]"[axiom_inst])
+  ultimately AOT_show \<open>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<close>
+    using assms "\<forall>E" by blast
+qed
+
+lemmas "=I" = "rule=I:1" "rule=I:2[const_var]" "rule=I:2[lambda]"
+
+AOT_theorem "rule-id-df:1":
+  assumes \<open>\<tau>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} =\<^sub>d\<^sub>f \<sigma>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}\<close> and \<open>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down>\<close>
+  shows \<open>\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<close>
+proof -
+  AOT_have \<open>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down> \<rightarrow> \<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<close>
+    using "df-rules-terms[3]" assms(1) "&E" by blast
+  AOT_thus \<open>\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<close>
+    using assms(2) "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "rule-id-df:1[zero]":
+  assumes \<open>\<tau> =\<^sub>d\<^sub>f \<sigma>\<close> and \<open>\<sigma>\<down>\<close>
+  shows \<open>\<tau> = \<sigma>\<close>
+proof -
+  AOT_have \<open>\<sigma>\<down> \<rightarrow> \<tau> = \<sigma>\<close>
+    using "df-rules-terms[4]" assms(1) "&E" by blast
+  AOT_thus \<open>\<tau> = \<sigma>\<close>
+    using assms(2) "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "rule-id-df:2:a":
+  assumes \<open>\<tau>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} =\<^sub>d\<^sub>f \<sigma>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}\<close> and \<open>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down>\<close> and \<open>\<phi>{\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n}}\<close>
+  shows \<open>\<phi>{\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}}\<close>
+proof -
+  AOT_have \<open>\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<close> using "rule-id-df:1" assms(1,2) by blast
+  AOT_thus \<open>\<phi>{\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}}\<close> using assms(3) "rule=E" by blast
+qed
+
+AOT_theorem "rule-id-df:2:a[2]":
+  assumes \<open>\<tau>{\<guillemotleft>(\<alpha>\<^sub>1,\<alpha>\<^sub>2)\<guillemotright>} =\<^sub>d\<^sub>f \<sigma>{\<guillemotleft>(\<alpha>\<^sub>1,\<alpha>\<^sub>2)\<guillemotright>}\<close>
+    and \<open>\<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}\<down>\<close>
+      and \<open>\<phi>{\<tau>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}}\<close>
+  shows \<open>\<phi>{\<sigma>{\<guillemotleft>(\<tau>\<^sub>1::'a::AOT_Term_id_2,\<tau>\<^sub>2::'b::AOT_Term_id_2)\<guillemotright>}}\<close>
+proof -
+  AOT_have \<open>\<tau>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>} = \<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}\<close>
+    using "rule-id-df:1" assms(1,2) by auto
+  AOT_thus \<open>\<phi>{\<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}}\<close> using assms(3) "rule=E" by blast
+qed
+
+AOT_theorem "rule-id-df:2:a[zero]":
+  assumes \<open>\<tau> =\<^sub>d\<^sub>f \<sigma>\<close> and \<open>\<sigma>\<down>\<close> and \<open>\<phi>{\<tau>}\<close>
+  shows \<open>\<phi>{\<sigma>}\<close>
+proof -
+  AOT_have \<open>\<tau> = \<sigma>\<close> using "rule-id-df:1[zero]" assms(1,2) by blast
+  AOT_thus \<open>\<phi>{\<sigma>}\<close> using assms(3) "rule=E" by blast
+qed
+
+lemmas "=\<^sub>d\<^sub>fE" = "rule-id-df:2:a" "rule-id-df:2:a[zero]"
+
+AOT_theorem "rule-id-df:2:b":
+  assumes \<open>\<tau>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} =\<^sub>d\<^sub>f \<sigma>{\<alpha>\<^sub>1...\<alpha>\<^sub>n}\<close> and \<open>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<down>\<close> and \<open>\<phi>{\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}}\<close>
+  shows \<open>\<phi>{\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n}}\<close>
+proof -
+  AOT_have \<open>\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<close>
+    using "rule-id-df:1" assms(1,2) by blast
+  AOT_hence \<open>\<sigma>{\<tau>\<^sub>1...\<tau>\<^sub>n} = \<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n}\<close>
+    using "rule=E" "=I"(1) "t=t-proper:1" "\<rightarrow>E" by fast
+  AOT_thus \<open>\<phi>{\<tau>{\<tau>\<^sub>1...\<tau>\<^sub>n}}\<close> using assms(3) "rule=E" by blast
+qed
+
+AOT_theorem "rule-id-df:2:b[2]":
+  assumes \<open>\<tau>{\<guillemotleft>(\<alpha>\<^sub>1,\<alpha>\<^sub>2)\<guillemotright>} =\<^sub>d\<^sub>f \<sigma>{\<guillemotleft>(\<alpha>\<^sub>1,\<alpha>\<^sub>2)\<guillemotright>}\<close>
+      and \<open>\<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}\<down>\<close>
+      and \<open>\<phi>{\<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}}\<close>
+  shows \<open>\<phi>{\<tau>{\<guillemotleft>(\<tau>\<^sub>1::'a::AOT_Term_id_2,\<tau>\<^sub>2::'b::AOT_Term_id_2)\<guillemotright>}}\<close>
+proof -
+  AOT_have \<open>\<tau>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>} = \<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}\<close>
+    using "=I"(1) "rule-id-df:2:a[2]" RAA(1) assms(1,2) "\<rightarrow>I" by metis
+  AOT_hence \<open>\<sigma>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>} = \<tau>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}\<close>
+    using "rule=E" "=I"(1) "t=t-proper:1" "\<rightarrow>E" by fast
+  AOT_thus \<open>\<phi>{\<tau>{\<guillemotleft>(\<tau>\<^sub>1,\<tau>\<^sub>2)\<guillemotright>}}\<close> using assms(3) "rule=E" by blast
+qed
+
+AOT_theorem "rule-id-df:2:b[zero]":
+  assumes \<open>\<tau> =\<^sub>d\<^sub>f \<sigma>\<close> and \<open>\<sigma>\<down>\<close> and \<open>\<phi>{\<sigma>}\<close>
+  shows \<open>\<phi>{\<tau>}\<close>
+proof -
+  AOT_have \<open>\<tau> = \<sigma>\<close> using "rule-id-df:1[zero]" assms(1,2) by blast
+  AOT_hence \<open>\<sigma> = \<tau>\<close>
+    using "rule=E" "=I"(1) "t=t-proper:1" "\<rightarrow>E" by fast
+  AOT_thus \<open>\<phi>{\<tau>}\<close> using assms(3) "rule=E" by blast
+qed
+
+lemmas "=\<^sub>d\<^sub>fI" = "rule-id-df:2:b" "rule-id-df:2:b[zero]"
+
+AOT_theorem "free-thms:1": \<open>\<tau>\<down> \<equiv> \<exists>\<beta> (\<beta> = \<tau>)\<close>
+  by (metis "\<exists>E" "rule=I:1" "t=t-proper:2" "\<rightarrow>I" "\<exists>I"(1) "\<equiv>I" "\<rightarrow>E")
+
+AOT_theorem "free-thms:2": \<open>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> (\<exists>\<beta> (\<beta> = \<tau>) \<rightarrow> \<phi>{\<tau>})\<close>
+  by (metis "\<exists>E" "rule=E" "cqt:2[const_var]"[axiom_inst] "\<rightarrow>I" "\<forall>E"(1))
+
+AOT_theorem "free-thms:3[const_var]": \<open>\<exists>\<beta> (\<beta> = \<alpha>)\<close>
+  by (meson "\<exists>I"(2) "id-eq:1")
+
+AOT_theorem "free-thms:3[lambda]":
+  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
+  shows \<open>\<exists>\<beta> (\<beta> = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}])\<close>
+  by (meson "=I"(3) assms "cqt:2[lambda]"[axiom_inst] "existential:1")
+
+AOT_theorem "free-thms:4[rel]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<or> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<Pi>)\<close>
+  by (metis "rule=I:1" "&E"(1) "\<or>E"(1) "cqt:5:a"[axiom_inst]
+            "cqt:5:b"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+
+AOT_theorem "free-thms:4[vars]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<or> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]) \<rightarrow> \<exists>\<beta>\<^sub>1...\<exists>\<beta>\<^sub>n (\<beta>\<^sub>1...\<beta>\<^sub>n = \<kappa>\<^sub>1...\<kappa>\<^sub>n)\<close>
+  by (metis "rule=I:1" "&E"(2) "\<or>E"(1) "cqt:5:a"[axiom_inst]
+            "cqt:5:b"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+
+AOT_theorem "free-thms:4[1,rel]":
+  \<open>([\<Pi>]\<kappa> \<or> \<kappa>[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<Pi>)\<close>
+  by (metis "rule=I:1" "&E"(1) "\<or>E"(1) "cqt:5:a"[axiom_inst]
+            "cqt:5:b"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[1,1]":
+  \<open>([\<Pi>]\<kappa> \<or> \<kappa>[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>)\<close>
+  by (metis "rule=I:1" "&E"(2) "\<or>E"(1) "cqt:5:a"[axiom_inst]
+            "cqt:5:b"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+
+AOT_theorem "free-thms:4[2,rel]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<Pi>)\<close>
+  by (metis "rule=I:1" "&E"(1) "\<or>E"(1) "cqt:5:a[2]"[axiom_inst]
+            "cqt:5:b[2]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[2,1]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>1)\<close>
+  by (metis "rule=I:1" "&E" "\<or>E"(1) "cqt:5:a[2]"[axiom_inst]
+            "cqt:5:b[2]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[2,2]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>2)\<close>
+  by (metis "rule=I:1" "&E"(2) "\<or>E"(1) "cqt:5:a[2]"[axiom_inst]
+            "cqt:5:b[2]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[3,rel]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<Pi>)\<close>
+  by (metis "rule=I:1" "&E"(1) "\<or>E"(1) "cqt:5:a[3]"[axiom_inst]
+            "cqt:5:b[3]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[3,1]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>1)\<close>
+  by (metis "rule=I:1" "&E" "\<or>E"(1) "cqt:5:a[3]"[axiom_inst]
+            "cqt:5:b[3]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[3,2]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>2)\<close>
+  by (metis "rule=I:1" "&E" "\<or>E"(1) "cqt:5:a[3]"[axiom_inst]
+            "cqt:5:b[3]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[3,3]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>3)\<close>
+  by (metis "rule=I:1" "&E"(2) "\<or>E"(1) "cqt:5:a[3]"[axiom_inst]
+            "cqt:5:b[3]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[4,rel]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<Pi>)\<close>
+  by (metis "rule=I:1" "&E"(1) "\<or>E"(1) "cqt:5:a[4]"[axiom_inst]
+            "cqt:5:b[4]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[4,1]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>1)\<close>
+  by (metis "rule=I:1" "&E" "\<or>E"(1) "cqt:5:a[4]"[axiom_inst]
+            "cqt:5:b[4]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[4,2]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>2)\<close>
+  by (metis "rule=I:1" "&E" "\<or>E"(1) "cqt:5:a[4]"[axiom_inst]
+            "cqt:5:b[4]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[4,3]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>3)\<close>
+  by (metis "rule=I:1" "&E" "\<or>E"(1) "cqt:5:a[4]"[axiom_inst]
+            "cqt:5:b[4]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+AOT_theorem "free-thms:4[4,4]":
+  \<open>([\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4 \<or> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3\<kappa>\<^sub>4[\<Pi>]) \<rightarrow> \<exists>\<beta> (\<beta> = \<kappa>\<^sub>4)\<close>
+  by (metis "rule=I:1" "&E"(2) "\<or>E"(1) "cqt:5:a[4]"[axiom_inst]
+            "cqt:5:b[4]"[axiom_inst] "\<rightarrow>I" "\<exists>I"(1))
+
+AOT_theorem "ex:1:a": \<open>\<forall>\<alpha> \<alpha>\<down>\<close>
+  by (rule GEN) (fact "cqt:2[const_var]"[axiom_inst])
+AOT_theorem "ex:1:b": \<open>\<forall>\<alpha>\<exists>\<beta>(\<beta> = \<alpha>)\<close>
+  by (rule GEN) (fact "free-thms:3[const_var]")
+
+AOT_theorem "ex:2:a": \<open>\<box>\<alpha>\<down>\<close>
+  by (rule RN) (fact "cqt:2[const_var]"[axiom_inst])
+AOT_theorem "ex:2:b": \<open>\<box>\<exists>\<beta>(\<beta> = \<alpha>)\<close>
+  by (rule RN) (fact "free-thms:3[const_var]")
+
+AOT_theorem "ex:3:a": \<open>\<box>\<forall>\<alpha> \<alpha>\<down>\<close>
+  by (rule RN) (fact "ex:1:a")
+AOT_theorem "ex:3:b": \<open>\<box>\<forall>\<alpha>\<exists>\<beta>(\<beta> = \<alpha>)\<close>
+  by (rule RN) (fact "ex:1:b")
+
+AOT_theorem "ex:4:a": \<open>\<forall>\<alpha> \<box>\<alpha>\<down>\<close>
+  by (rule GEN; rule RN) (fact "cqt:2[const_var]"[axiom_inst])
+AOT_theorem "ex:4:b": \<open>\<forall>\<alpha>\<box>\<exists>\<beta>(\<beta> = \<alpha>)\<close>
+  by (rule GEN; rule RN) (fact "free-thms:3[const_var]")
+
+AOT_theorem "ex:5:a": \<open>\<box>\<forall>\<alpha> \<box>\<alpha>\<down>\<close>
+  by (rule RN) (simp add: "ex:4:a")
+AOT_theorem "ex:5:b": \<open>\<box>\<forall>\<alpha>\<box>\<exists>\<beta>(\<beta> = \<alpha>)\<close>
+  by (rule RN) (simp add: "ex:4:b")
+
+AOT_theorem "all-self=:1": \<open>\<box>\<forall>\<alpha>(\<alpha> = \<alpha>)\<close>
+  by (rule RN; rule GEN) (fact "id-eq:1")
+AOT_theorem "all-self=:2": \<open>\<forall>\<alpha>\<box>(\<alpha> = \<alpha>)\<close>
+  by (rule GEN; rule RN) (fact "id-eq:1")
+
+AOT_theorem "id-nec:1": \<open>\<alpha> = \<beta> \<rightarrow> \<box>(\<alpha> = \<beta>)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<alpha> = \<beta>\<close>
+  moreover AOT_have \<open>\<box>(\<alpha> = \<alpha>)\<close>
+    by (rule RN) (fact "id-eq:1")
+  ultimately AOT_show \<open>\<box>(\<alpha> = \<beta>)\<close> using "rule=E" by fast
+qed
+
+AOT_theorem "id-nec:2": \<open>\<tau> = \<sigma> \<rightarrow> \<box>(\<tau> = \<sigma>)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume asm: \<open>\<tau> = \<sigma>\<close>
+  moreover AOT_have \<open>\<tau>\<down>\<close>
+    using calculation "t=t-proper:1" "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<box>(\<tau> = \<tau>)\<close>
+    using calculation "all-self=:2" "\<forall>E"(1) by blast
+  ultimately AOT_show \<open>\<box>(\<tau> = \<sigma>)\<close> using "rule=E" by fast
+qed
+
+AOT_theorem "term-out:1": \<open>\<phi>{\<alpha>} \<equiv> \<exists>\<beta> (\<beta> = \<alpha> & \<phi>{\<beta>})\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume asm: \<open>\<phi>{\<alpha>}\<close>
+  AOT_show \<open>\<exists>\<beta> (\<beta> = \<alpha> & \<phi>{\<beta>})\<close>
+    by (rule "\<exists>I"(2)[where \<beta>=\<alpha>]; rule "&I")
+       (auto simp: "id-eq:1" asm)
+next
+  AOT_assume 0: \<open>\<exists>\<beta> (\<beta> = \<alpha> & \<phi>{\<beta>})\<close>
+  AOT_obtain \<beta> where \<open>\<beta> = \<alpha> & \<phi>{\<beta>}\<close>
+    using "\<exists>E"[rotated, OF 0] by blast
+  AOT_thus \<open>\<phi>{\<alpha>}\<close> using "&E" "rule=E" by blast
+qed
+
+AOT_theorem "term-out:2": \<open>\<tau>\<down> \<rightarrow> (\<phi>{\<tau>} \<equiv> \<exists>\<alpha>(\<alpha> = \<tau> & \<phi>{\<alpha>}))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<tau>\<down>\<close>
+  moreover AOT_have \<open>\<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<exists>\<beta> (\<beta> = \<alpha> & \<phi>{\<beta>}))\<close>
+    by (rule GEN) (fact "term-out:1")
+  ultimately AOT_show \<open>\<phi>{\<tau>} \<equiv> \<exists>\<alpha>(\<alpha> = \<tau> & \<phi>{\<alpha>})\<close>
+    using "\<forall>E" by blast
+qed
+
+AOT_theorem "term-out:3":
+  \<open>(\<phi>{\<alpha>} & \<forall>\<beta>(\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>)) \<equiv> \<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+   apply (frule "&E"(1))
+   apply (drule "&E"(2))
+   apply (rule GEN; rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "rule-ui:2[const_var]" "vdash-properties:5"
+    apply blast
+   apply (meson "rule=E" "id-eq:1")
+  apply (rule "&I")
+  using "id-eq:1" "\<equiv>E"(2) "rule-ui:3"
+   apply blast
+  apply (rule GEN; rule "\<rightarrow>I")
+  using "\<equiv>E"(1) "rule-ui:2[const_var]"
+  by blast
+
+(* Note: generalized alphabetic variant of the last theorem. *)
+AOT_theorem "term-out:4":
+  \<open>(\<phi>{\<beta>} & \<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<alpha> = \<beta>)) \<equiv> \<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<alpha> = \<beta>)\<close>
+  using "term-out:3" .
+
+(* TODO: Provide a nicer mechanism for introducing custom binders. *)
+AOT_define AOT_exists_unique :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> "uniqueness:1":
+  \<open>\<guillemotleft>AOT_exists_unique \<phi>\<guillemotright> \<equiv>\<^sub>d\<^sub>f \<exists>\<alpha> (\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>))\<close>
+syntax (input) "_AOT_exists_unique" :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> ("\<exists>!_ _" [1,40])
+syntax (output) "_AOT_exists_unique" :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> ("\<exists>!_'(_')" [1,40])
+AOT_syntax_print_translations
+  "_AOT_exists_unique \<tau> \<phi>" <= "CONST AOT_exists_unique (_abs \<tau> \<phi>)"
+syntax
+   "_AOT_exists_unique_ellipse" :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close>
+   (\<open>\<exists>!_...\<exists>!_ _\<close> [1,40])
+parse_ast_translation\<open>
+[(\<^syntax_const>\<open>_AOT_exists_unique_ellipse\<close>,
+  fn ctx => fn [a,b,c] => Ast.mk_appl (Ast.Constant "AOT_exists_unique")
+  [parseEllipseList "_AOT_vars" ctx [a,b],c]),
+ (\<^syntax_const>\<open>_AOT_exists_unique\<close>,
+  AOT_restricted_binder
+    \<^const_name>\<open>AOT_exists_unique\<close>
+    \<^const_syntax>\<open>AOT_conj\<close>)]\<close>
+print_translation\<open>AOT_syntax_print_translations [
+  AOT_preserve_binder_abs_tr'
+    \<^const_syntax>\<open>AOT_exists_unique\<close>
+    \<^syntax_const>\<open>_AOT_exists_unique\<close>
+    (\<^syntax_const>\<open>_AOT_exists_unique_ellipse\<close>, true)
+    \<^const_name>\<open>AOT_conj\<close>,
+  AOT_binder_trans
+    @{theory}
+    @{binding "AOT_exists_unique_binder"}
+    \<^syntax_const>\<open>_AOT_exists_unique\<close>
+]\<close>
+
+
+context AOT_meta_syntax
+begin
+notation AOT_exists_unique (binder "\<^bold>\<exists>\<^bold>!" 20)
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_exists_unique (binder "\<^bold>\<exists>\<^bold>!" 20)
+end
+
+AOT_theorem "uniqueness:2": \<open>\<exists>!\<alpha> \<phi>{\<alpha>} \<equiv> \<exists>\<alpha>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume \<open>\<exists>!\<alpha> \<phi>{\<alpha>}\<close>
+    AOT_hence \<open>\<exists>\<alpha> (\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>))\<close>
+      using "uniqueness:1" "\<equiv>\<^sub>d\<^sub>fE" by blast
+    then AOT_obtain \<alpha> where \<open>\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>)\<close>
+      using "instantiation"[rotated] by blast
+    AOT_hence \<open>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+      using "term-out:3" "\<equiv>E" by blast
+    AOT_thus \<open>\<exists>\<alpha>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+      using "\<exists>I" by fast
+next
+    AOT_assume \<open>\<exists>\<alpha>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    then AOT_obtain \<alpha> where \<open>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+      using "instantiation"[rotated] by blast
+    AOT_hence \<open>\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>)\<close>
+      using "term-out:3" "\<equiv>E" by blast
+    AOT_hence \<open>\<exists>\<alpha> (\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>))\<close>
+      using "\<exists>I" by fast
+    AOT_thus \<open>\<exists>!\<alpha> \<phi>{\<alpha>}\<close>
+      using "uniqueness:1" "\<equiv>\<^sub>d\<^sub>fI" by blast
+qed
+
+AOT_theorem "uni-most": \<open>\<exists>!\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<beta>\<forall>\<gamma>((\<phi>{\<beta>} & \<phi>{\<gamma>}) \<rightarrow> \<beta> = \<gamma>)\<close>
+proof(rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+  fix \<beta> \<gamma>
+  AOT_assume \<open>\<exists>!\<alpha> \<phi>{\<alpha>}\<close>
+  AOT_hence \<open>\<exists>\<alpha>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    using "uniqueness:2" "\<equiv>E" by blast
+  then AOT_obtain \<alpha> where \<open>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    using "instantiation"[rotated] by blast
+  moreover AOT_assume \<open>\<phi>{\<beta>} & \<phi>{\<gamma>}\<close>
+  ultimately AOT_have \<open>\<beta> = \<alpha>\<close> and \<open>\<gamma> = \<alpha>\<close>
+    using "\<forall>E"(2) "&E" "\<equiv>E"(1,2) by blast+
+  AOT_thus \<open>\<beta> = \<gamma>\<close>
+    by (metis "rule=E" "id-eq:2" "\<rightarrow>E")
+qed
+
+AOT_theorem "nec-exist-!": \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>}) \<rightarrow> (\<exists>!\<alpha> \<phi>{\<alpha>} \<rightarrow> \<exists>!\<alpha> \<box>\<phi>{\<alpha>})\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume a: \<open>\<forall>\<alpha>(\<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>})\<close>
+  AOT_assume \<open>\<exists>!\<alpha> \<phi>{\<alpha>}\<close>
+  AOT_hence \<open>\<exists>\<alpha> (\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>))\<close>
+    using "uniqueness:1" "\<equiv>\<^sub>d\<^sub>fE" by blast
+  then AOT_obtain \<alpha> where \<xi>: \<open>\<phi>{\<alpha>} & \<forall>\<beta> (\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>)\<close>
+    using "instantiation"[rotated] by blast
+  AOT_have \<open>\<box>\<phi>{\<alpha>}\<close>
+    using \<xi> a "&E" "\<forall>E" "\<rightarrow>E" by fast
+  moreover AOT_have \<open>\<forall>\<beta> (\<box>\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>)\<close>
+    apply (rule GEN; rule "\<rightarrow>I")
+    using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+          "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  ultimately AOT_have \<open>(\<box>\<phi>{\<alpha>} & \<forall>\<beta> (\<box>\<phi>{\<beta>} \<rightarrow> \<beta> = \<alpha>))\<close>
+    using "&I" by blast
+  AOT_thus \<open>\<exists>!\<alpha> \<box>\<phi>{\<alpha>}\<close>
+    using "uniqueness:1" "\<equiv>\<^sub>d\<^sub>fI" "\<exists>I" by fast
+qed
+
+subsection\<open>The Theory of Actuality and Descriptions\<close>
+text\<open>\label{PLM: 9.8}\<close>
+
+AOT_theorem "act-cond": \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<^bold>\<A>\<phi> \<rightarrow> \<^bold>\<A>\<psi>)\<close>
+  using "\<rightarrow>I" "\<equiv>E"(1) "logic-actual-nec:2"[axiom_inst] by blast
+
+AOT_theorem "nec-imp-act": \<open>\<box>\<phi> \<rightarrow> \<^bold>\<A>\<phi>\<close>
+  by (metis "act-cond" "contraposition:1[2]" "\<equiv>E"(4)
+            "qml:2"[THEN act_closure, axiom_inst]
+            "qml-act:2"[axiom_inst] RAA(1) "\<rightarrow>E" "\<rightarrow>I")
+
+AOT_theorem "act-conj-act:1": \<open>\<^bold>\<A>(\<^bold>\<A>\<phi> \<rightarrow> \<phi>)\<close>
+  using "\<rightarrow>I" "\<equiv>E"(2) "logic-actual-nec:2"[axiom_inst]
+        "logic-actual-nec:4"[axiom_inst] by blast
+
+AOT_theorem "act-conj-act:2": \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<^bold>\<A>\<phi>)\<close>
+  by (metis "\<rightarrow>I" "\<equiv>E"(2, 4) "logic-actual-nec:2"[axiom_inst]
+            "logic-actual-nec:4"[axiom_inst] RAA(1))
+
+AOT_theorem "act-conj-act:3": \<open>(\<^bold>\<A>\<phi> & \<^bold>\<A>\<psi>) \<rightarrow> \<^bold>\<A>(\<phi> & \<psi>)\<close>
+proof -
+  AOT_have \<open>\<box>(\<phi> \<rightarrow> (\<psi> \<rightarrow> (\<phi> & \<psi>)))\<close>
+    by (rule RN) (fact Adjunction)
+  AOT_hence \<open>\<^bold>\<A>(\<phi> \<rightarrow> (\<psi> \<rightarrow> (\<phi> & \<psi>)))\<close>
+    using "nec-imp-act" "\<rightarrow>E" by blast
+  AOT_hence \<open>\<^bold>\<A>\<phi> \<rightarrow> \<^bold>\<A>(\<psi> \<rightarrow> (\<phi> & \<psi>))\<close>
+    using "act-cond" "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<^bold>\<A>(\<psi> \<rightarrow> (\<phi> & \<psi>)) \<rightarrow> (\<^bold>\<A>\<psi> \<rightarrow> \<^bold>\<A>(\<phi> & \<psi>))\<close>
+    by (fact "act-cond")
+  ultimately AOT_have \<open>\<^bold>\<A>\<phi> \<rightarrow> (\<^bold>\<A>\<psi> \<rightarrow> \<^bold>\<A>(\<phi> & \<psi>))\<close>
+    using "\<rightarrow>I" "\<rightarrow>E" by metis
+  AOT_thus \<open>(\<^bold>\<A>\<phi> & \<^bold>\<A>\<psi>) \<rightarrow> \<^bold>\<A>(\<phi> & \<psi>)\<close>
+    by (metis Importation "\<rightarrow>E")
+qed
+
+AOT_theorem "act-conj-act:4": \<open>\<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>)\<close>
+proof -
+  AOT_have \<open>(\<^bold>\<A>(\<^bold>\<A>\<phi> \<rightarrow> \<phi>) & \<^bold>\<A>(\<phi> \<rightarrow> \<^bold>\<A>\<phi>)) \<rightarrow> \<^bold>\<A>((\<^bold>\<A>\<phi> \<rightarrow> \<phi>) & (\<phi> \<rightarrow> \<^bold>\<A>\<phi>))\<close>
+    by (fact "act-conj-act:3")
+  moreover AOT_have \<open>\<^bold>\<A>(\<^bold>\<A>\<phi> \<rightarrow> \<phi>) & \<^bold>\<A>(\<phi> \<rightarrow> \<^bold>\<A>\<phi>)\<close>
+    using "&I" "act-conj-act:1" "act-conj-act:2" by simp
+  ultimately AOT_have \<zeta>: \<open>\<^bold>\<A>((\<^bold>\<A>\<phi> \<rightarrow> \<phi>) & (\<phi> \<rightarrow> \<^bold>\<A>\<phi>))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_have \<open>\<^bold>\<A>(((\<^bold>\<A>\<phi> \<rightarrow> \<phi>) & (\<phi> \<rightarrow> \<^bold>\<A>\<phi>)) \<rightarrow> (\<^bold>\<A>\<phi> \<equiv> \<phi>))\<close>
+    using "conventions:3"[THEN "df-rules-formulas[2]",
+                          THEN act_closure, axiom_inst] by blast
+  AOT_hence \<open>\<^bold>\<A>((\<^bold>\<A>\<phi> \<rightarrow> \<phi>) & (\<phi> \<rightarrow> \<^bold>\<A>\<phi>)) \<rightarrow> \<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>)\<close>
+    using "act-cond" "\<rightarrow>E" by blast
+  AOT_thus \<open>\<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>)\<close> using \<zeta> "\<rightarrow>E" by blast
+qed
+
+(* TODO: Consider introducing AOT_inductive. *)
+inductive arbitrary_actualization for \<phi> where
+  \<open>arbitrary_actualization \<phi> \<guillemotleft>\<^bold>\<A>\<phi>\<guillemotright>\<close>
+| \<open>arbitrary_actualization \<phi> \<guillemotleft>\<^bold>\<A>\<psi>\<guillemotright>\<close> if \<open>arbitrary_actualization \<phi> \<psi>\<close>
+declare arbitrary_actualization.cases[AOT]
+        arbitrary_actualization.induct[AOT]
+        arbitrary_actualization.simps[AOT]
+        arbitrary_actualization.intros[AOT]
+syntax arbitrary_actualization :: \<open>\<phi>' \<Rightarrow> \<phi>' \<Rightarrow> AOT_prop\<close>
+  ("ARBITRARY'_ACTUALIZATION'(_,_')")
+
+notepad
+begin
+  AOT_modally_strict {
+    fix \<phi>
+    AOT_have \<open>ARBITRARY_ACTUALIZATION(\<^bold>\<A>\<phi> \<equiv> \<phi>, \<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>))\<close>
+      using AOT_PLM.arbitrary_actualization.intros by metis
+    AOT_have \<open>ARBITRARY_ACTUALIZATION(\<^bold>\<A>\<phi> \<equiv> \<phi>, \<^bold>\<A>\<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>))\<close>
+      using AOT_PLM.arbitrary_actualization.intros by metis
+    AOT_have \<open>ARBITRARY_ACTUALIZATION(\<^bold>\<A>\<phi> \<equiv> \<phi>, \<^bold>\<A>\<^bold>\<A>\<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>))\<close>
+      using AOT_PLM.arbitrary_actualization.intros by metis
+  }
+end
+
+
+AOT_theorem "closure-act:1":
+  assumes \<open>ARBITRARY_ACTUALIZATION(\<^bold>\<A>\<phi> \<equiv> \<phi>, \<psi>)\<close>
+  shows \<open>\<psi>\<close>
+using assms proof(induct)
+  case 1
+  AOT_show \<open>\<^bold>\<A>(\<^bold>\<A>\<phi> \<equiv> \<phi>)\<close>
+    by (simp add: "act-conj-act:4")
+next
+  case (2 \<psi>)
+  AOT_thus \<open>\<^bold>\<A>\<psi>\<close>
+    by (metis arbitrary_actualization.simps "\<equiv>E"(1)
+              "logic-actual-nec:4"[axiom_inst])
+qed
+
+AOT_theorem "closure-act:2": \<open>\<forall>\<alpha> \<^bold>\<A>(\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<phi>{\<alpha>})\<close>
+  by (simp add: "act-conj-act:4" "\<forall>I")
+
+AOT_theorem "closure-act:3": \<open>\<^bold>\<A>\<forall>\<alpha> \<^bold>\<A>(\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<phi>{\<alpha>})\<close>
+  by (metis (no_types, lifting) "act-conj-act:4" "\<equiv>E"(1,2) "\<forall>I"
+            "logic-actual-nec:3"[axiom_inst]
+            "logic-actual-nec:4"[axiom_inst])
+
+AOT_theorem "closure-act:4": \<open>\<^bold>\<A>\<forall>\<alpha>\<^sub>1...\<forall>\<alpha>\<^sub>n \<^bold>\<A>(\<^bold>\<A>\<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n} \<equiv> \<phi>{\<alpha>\<^sub>1...\<alpha>\<^sub>n})\<close>
+  using "closure-act:3" .
+
+AOT_act_theorem "RA[1]":
+  assumes \<open>\<^bold>\<turnstile> \<phi>\<close>
+  shows \<open>\<^bold>\<turnstile> \<^bold>\<A>\<phi>\<close>
+  \<comment> \<open>While this proof is rejected in PLM,
+      we merely state it as modally-fragile rule,
+      which addresses the concern in PLM.\<close>
+  using "\<not>\<not>E" assms "\<equiv>E"(3) "logic-actual"[act_axiom_inst]
+        "logic-actual-nec:1"[axiom_inst] "modus-tollens:2" by blast
+AOT_theorem "RA[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<^bold>\<A>\<phi>\<close>
+  \<comment> \<open>This rule is in fact a consequence of RN and
+      does not require an appeal to the semantics itself.\<close>
+  using RN assms "nec-imp-act" "vdash-properties:5" by blast
+AOT_theorem "RA[3]":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi>\<close>
+  shows \<open>\<^bold>\<A>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<^bold>\<A>\<phi>\<close>
+  text\<open>This rule is only derivable from the semantics,
+       but apparently no proof actually relies on it.
+       If this turns out to be required, it is valid to derive it from the
+       semantics just like RN, but we refrain from doing so, unless necessary.\<close>
+  (*  using assms by (meson AOT_sem_act imageI) *)
+  oops \<comment> \<open>discard the rule\<close>
+
+AOT_act_theorem "ANeg:1": \<open>\<not>\<^bold>\<A>\<phi> \<equiv> \<not>\<phi>\<close>
+  by (simp add: "RA[1]" "contraposition:1[1]" "deduction-theorem"
+                "\<equiv>I" "logic-actual"[act_axiom_inst])
+
+AOT_act_theorem "ANeg:2": \<open>\<not>\<^bold>\<A>\<not>\<phi> \<equiv> \<phi>\<close>
+  using "ANeg:1" "\<equiv>I" "\<equiv>E"(5) "useful-tautologies:1"
+        "useful-tautologies:2" by blast
+
+AOT_theorem "Act-Basic:1": \<open>\<^bold>\<A>\<phi> \<or> \<^bold>\<A>\<not>\<phi>\<close>
+  by (meson "\<or>I"(1,2) "\<equiv>E"(2) "logic-actual-nec:1"[axiom_inst] "raa-cor:1")
+
+AOT_theorem "Act-Basic:2": \<open>\<^bold>\<A>(\<phi> & \<psi>) \<equiv> (\<^bold>\<A>\<phi> & \<^bold>\<A>\<psi>)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<A>(\<phi> & \<psi>)\<close>
+  moreover AOT_have \<open>\<^bold>\<A>((\<phi> & \<psi>) \<rightarrow> \<phi>)\<close>
+    by (simp add: "RA[2]" "Conjunction Simplification"(1))
+  moreover AOT_have \<open>\<^bold>\<A>((\<phi> & \<psi>) \<rightarrow> \<psi>)\<close>
+    by (simp add: "RA[2]" "Conjunction Simplification"(2))
+  ultimately AOT_show \<open>\<^bold>\<A>\<phi> & \<^bold>\<A>\<psi>\<close>
+    using "act-cond"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&I" by metis
+next
+  AOT_assume \<open>\<^bold>\<A>\<phi> & \<^bold>\<A>\<psi>\<close>
+  AOT_thus \<open>\<^bold>\<A>(\<phi> & \<psi>)\<close>
+    using "act-conj-act:3" "vdash-properties:6" by blast
+qed
+
+AOT_theorem "Act-Basic:3": \<open>\<^bold>\<A>(\<phi> \<equiv> \<psi>) \<equiv> (\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) & \<^bold>\<A>(\<psi> \<rightarrow> \<phi>))\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<A>(\<phi> \<equiv> \<psi>)\<close>
+  moreover AOT_have \<open>\<^bold>\<A>((\<phi> \<equiv> \<psi>) \<rightarrow> (\<phi> \<rightarrow> \<psi>))\<close>
+    by (simp add: "RA[2]" "deduction-theorem" "\<equiv>E"(1))
+  moreover AOT_have \<open>\<^bold>\<A>((\<phi> \<equiv> \<psi>) \<rightarrow> (\<psi> \<rightarrow> \<phi>))\<close>
+    by (simp add: "RA[2]" "deduction-theorem" "\<equiv>E"(2))
+  ultimately AOT_show \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) & \<^bold>\<A>(\<psi> \<rightarrow> \<phi>)\<close>
+    using "act-cond"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&I" by metis
+next
+  AOT_assume \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) & \<^bold>\<A>(\<psi> \<rightarrow> \<phi>)\<close>
+  AOT_hence \<open>\<^bold>\<A>((\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>))\<close>
+    by (metis "act-conj-act:3" "vdash-properties:10")
+  moreover AOT_have \<open>\<^bold>\<A>(((\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>)) \<rightarrow> (\<phi> \<equiv> \<psi>))\<close>
+    by (simp add: "conventions:3" "RA[2]" "df-rules-formulas[2]"
+                  "vdash-properties:1[2]")
+  ultimately AOT_show \<open>\<^bold>\<A>(\<phi> \<equiv> \<psi>)\<close>
+    using "act-cond"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by metis
+qed
+
+AOT_theorem "Act-Basic:4": \<open>(\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) & \<^bold>\<A>(\<psi> \<rightarrow> \<phi>)) \<equiv> (\<^bold>\<A>\<phi> \<equiv> \<^bold>\<A>\<psi>)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) & \<^bold>\<A>(\<psi> \<rightarrow> \<phi>)\<close>
+  AOT_show \<open>\<^bold>\<A>\<phi> \<equiv> \<^bold>\<A>\<psi>\<close>
+    using 0 "&E" "act-cond"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "\<equiv>I" "\<rightarrow>I" by metis
+next
+  AOT_assume \<open>\<^bold>\<A>\<phi> \<equiv> \<^bold>\<A>\<psi>\<close>
+  AOT_thus \<open>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>) & \<^bold>\<A>(\<psi> \<rightarrow> \<phi>)\<close>
+    by (metis "\<rightarrow>I" "logic-actual-nec:2"[axiom_inst] "\<equiv>E"(1,2) "&I")
+qed
+
+AOT_theorem "Act-Basic:5": \<open>\<^bold>\<A>(\<phi> \<equiv> \<psi>) \<equiv> (\<^bold>\<A>\<phi> \<equiv> \<^bold>\<A>\<psi>)\<close>
+  using "Act-Basic:3" "Act-Basic:4" "\<equiv>E"(5) by blast
+
+AOT_theorem "Act-Basic:6": \<open>\<^bold>\<A>\<phi> \<equiv> \<box>\<^bold>\<A>\<phi>\<close>
+  by (simp add: "\<equiv>I" "qml:2"[axiom_inst] "qml-act:1"[axiom_inst])
+
+AOT_theorem "Act-Basic:7": \<open>\<^bold>\<A>\<box>\<phi> \<rightarrow> \<box>\<^bold>\<A>\<phi>\<close>
+  by (metis "Act-Basic:6" "\<rightarrow>I" "\<rightarrow>E" "\<equiv>E"(1,2) "nec-imp-act"
+            "qml-act:2"[axiom_inst])
+
+AOT_theorem "Act-Basic:8": \<open>\<box>\<phi> \<rightarrow> \<box>\<^bold>\<A>\<phi>\<close>
+  using "Hypothetical Syllogism" "nec-imp-act" "qml-act:1"[axiom_inst] by blast
+
+AOT_theorem "Act-Basic:9": \<open>\<^bold>\<A>(\<phi> \<or> \<psi>) \<equiv> (\<^bold>\<A>\<phi> \<or> \<^bold>\<A>\<psi>)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<A>(\<phi> \<or> \<psi>)\<close>
+  AOT_thus \<open>\<^bold>\<A>\<phi> \<or> \<^bold>\<A>\<psi>\<close>
+  proof (rule "raa-cor:3")
+    AOT_assume \<open>\<not>(\<^bold>\<A>\<phi> \<or> \<^bold>\<A>\<psi>)\<close>
+    AOT_hence \<open>\<not>\<^bold>\<A>\<phi> & \<not>\<^bold>\<A>\<psi>\<close>
+      by (metis "\<equiv>E"(1) "oth-class-taut:5:d")
+    AOT_hence \<open>\<^bold>\<A>\<not>\<phi> & \<^bold>\<A>\<not>\<psi>\<close>
+      using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] "&E" "&I" by metis
+    AOT_hence \<open>\<^bold>\<A>(\<not>\<phi> & \<not>\<psi>)\<close>
+      using "\<equiv>E" "Act-Basic:2" by metis
+    moreover AOT_have \<open>\<^bold>\<A>((\<not>\<phi> & \<not>\<psi>) \<equiv> \<not>(\<phi> \<or> \<psi>))\<close>
+      using "RA[2]" "\<equiv>E"(6) "oth-class-taut:3:a" "oth-class-taut:5:d" by blast
+    moreover AOT_have \<open>\<^bold>\<A>(\<not>\<phi> & \<not>\<psi>) \<equiv> \<^bold>\<A>(\<not>(\<phi> \<or> \<psi>))\<close>
+      using calculation(2) by (metis "Act-Basic:5" "\<equiv>E"(1))
+    ultimately AOT_have \<open>\<^bold>\<A>(\<not>(\<phi> \<or> \<psi>))\<close> using "\<equiv>E" by blast
+    AOT_thus \<open>\<not>\<^bold>\<A>(\<phi> \<or> \<psi>)\<close>
+      using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(1)] by auto
+  qed
+next
+  AOT_assume \<open>\<^bold>\<A>\<phi> \<or> \<^bold>\<A>\<psi>\<close>
+  AOT_thus \<open>\<^bold>\<A>(\<phi> \<or> \<psi>)\<close>
+    by (meson "RA[2]" "act-cond" "\<or>I"(1) "\<or>E"(1) "Disjunction Addition"(1,2))
+qed
+
+AOT_theorem "Act-Basic:10": \<open>\<^bold>\<A>\<exists>\<alpha> \<phi>{\<alpha>} \<equiv> \<exists>\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close>
+proof -
+  AOT_have \<theta>: \<open>\<not>\<^bold>\<A>\<forall>\<alpha> \<not>\<phi>{\<alpha>} \<equiv> \<not>\<forall>\<alpha> \<^bold>\<A>\<not>\<phi>{\<alpha>}\<close>
+    by (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
+       (metis "logic-actual-nec:3"[axiom_inst])
+  AOT_have \<xi>: \<open>\<not>\<forall>\<alpha> \<^bold>\<A>\<not>\<phi>{\<alpha>} \<equiv> \<not>\<forall>\<alpha> \<not>\<^bold>\<A>\<phi>{\<alpha>}\<close>
+    by (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
+       (rule "logic-actual-nec:1"[THEN universal_closure,
+               axiom_inst, THEN "cqt-basic:3"[THEN "\<rightarrow>E"]])
+  AOT_have \<open>\<^bold>\<A>(\<exists>\<alpha> \<phi>{\<alpha>}) \<equiv> \<^bold>\<A>(\<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>})\<close>
+    using "conventions:4"[THEN "df-rules-formulas[1]",
+                          THEN act_closure, axiom_inst]
+          "conventions:4"[THEN "df-rules-formulas[2]",
+                          THEN act_closure, axiom_inst]
+    "Act-Basic:4"[THEN "\<equiv>E"(1)] "&I" "Act-Basic:5"[THEN "\<equiv>E"(2)] by metis
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<^bold>\<A>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+    by (simp add: "logic-actual-nec:1" "vdash-properties:1[2]")
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<forall>\<alpha> \<^bold>\<A> \<not>\<phi>{\<alpha>}\<close> using \<theta> by blast
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<forall>\<alpha> \<not>\<^bold>\<A> \<phi>{\<alpha>}\<close> using \<xi> by blast
+  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha> \<^bold>\<A> \<phi>{\<alpha>}\<close>
+    using "conventions:4"[THEN "\<equiv>Df"] by (metis "\<equiv>E"(6) "oth-class-taut:3:a")
+  finally AOT_show \<open>\<^bold>\<A>\<exists>\<alpha> \<phi>{\<alpha>} \<equiv> \<exists>\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close> .
+qed
+
+
+AOT_theorem "Act-Basic:11":
+  \<open>\<^bold>\<A>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) \<equiv> \<forall>\<alpha>(\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<psi>{\<alpha>})\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<A>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+  AOT_hence \<open>\<forall>\<alpha>\<^bold>\<A>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+    using "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<^bold>\<A>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close> for \<alpha> using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<psi>{\<alpha>}\<close> for \<alpha> by (metis "Act-Basic:5" "\<equiv>E"(1))
+  AOT_thus \<open>\<forall>\<alpha>(\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<psi>{\<alpha>})\<close> by (rule "\<forall>I")
+next
+  AOT_assume \<open>\<forall>\<alpha>(\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<psi>{\<alpha>})\<close>
+  AOT_hence \<open>\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<psi>{\<alpha>}\<close> for \<alpha> using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close> for \<alpha> by (metis "Act-Basic:5" "\<equiv>E"(2))
+  AOT_hence \<open>\<forall>\<alpha> \<^bold>\<A>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close> by (rule "\<forall>I")
+  AOT_thus \<open>\<^bold>\<A>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>})\<close>
+    using "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)] by fast
+qed
+
+AOT_act_theorem "act-quant-uniq":
+  \<open>\<forall>\<beta>(\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>) \<equiv> \<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>\<beta>(\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+  AOT_hence \<open>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta> using "\<forall>E" by blast
+  AOT_hence \<open>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta>
+    using "\<equiv>I" "\<rightarrow>I" "RA[1]" "\<equiv>E"(1,2) "logic-actual"[act_axiom_inst] "\<rightarrow>E"
+    by metis
+  AOT_thus \<open>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> by (rule "\<forall>I")
+next
+  AOT_assume \<open>\<forall>\<beta>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+  AOT_hence \<open>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta> using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta>
+    using "\<equiv>I" "\<rightarrow>I" "RA[1]" "\<equiv>E"(1,2) "logic-actual"[act_axiom_inst] "\<rightarrow>E"
+    by metis
+  AOT_thus \<open>\<forall>\<beta>(\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> by (rule "\<forall>I")
+qed
+
+AOT_act_theorem "fund-cont-desc": \<open>x = \<^bold>\<iota>x(\<phi>{x}) \<equiv> \<forall>z(\<phi>{z} \<equiv> z = x)\<close>
+  using descriptions[axiom_inst] "act-quant-uniq" "\<equiv>E"(5) by fast
+
+AOT_act_theorem hintikka: \<open>x = \<^bold>\<iota>x(\<phi>{x}) \<equiv> (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x))\<close>
+  using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "term-out:3"
+        "fund-cont-desc" "\<equiv>E"(5) by blast
+
+
+locale russell_axiom =
+  fixes \<psi>
+  assumes \<psi>_denotes_asm: "[v \<Turnstile> \<psi>{\<kappa>}] \<Longrightarrow> [v \<Turnstile> \<kappa>\<down>]"
+begin
+AOT_act_theorem "russell-axiom":
+  \<open>\<psi>{\<^bold>\<iota>x \<phi>{x}} \<equiv> \<exists>x(\<phi>{x} & \<forall>z(\<phi>{z} \<rightarrow> z = x) & \<psi>{x})\<close>
+proof -
+  AOT_have b: \<open>\<forall>x (x = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{x} & \<forall>z(\<phi>{z} \<rightarrow> z = x)))\<close>
+    using hintikka "\<forall>I" by fast
+  show ?thesis
+  proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume c: \<open>\<psi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+    AOT_hence d: \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+      using \<psi>_denotes_asm by blast
+    AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+      by (metis "rule=I:1" "existential:1")
+    then AOT_obtain a where a_def: \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+      using "instantiation"[rotated] by blast
+    moreover AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{a} & \<forall>z(\<phi>{z} \<rightarrow> z = a))\<close>
+      using b "\<forall>E" by blast
+    ultimately AOT_have \<open>\<phi>{a} & \<forall>z(\<phi>{z} \<rightarrow> z = a)\<close>
+      using "\<equiv>E" by blast
+    moreover AOT_have \<open>\<psi>{a}\<close>
+    proof - 
+      AOT_have 1: \<open>\<forall>x\<forall>y(x = y \<rightarrow> y = x)\<close>
+        by (simp add: "id-eq:2" "universal-cor")
+      AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x} \<rightarrow>  \<^bold>\<iota>x \<phi>{x} = a\<close>
+        by (rule "\<forall>E"(1)[where \<tau>="\<guillemotleft>\<^bold>\<iota>x \<phi>{x}\<guillemotright>"]; rule "\<forall>E"(2)[where \<beta>=a])
+           (auto simp: 1 d "universal-cor")
+      AOT_thus \<open>\<psi>{a}\<close>
+        using a_def c "rule=E" "\<rightarrow>E" by blast
+    qed
+    ultimately AOT_have \<open>\<phi>{a} & \<forall>z(\<phi>{z} \<rightarrow> z = a) & \<psi>{a}\<close> by (rule "&I")
+    AOT_thus \<open>\<exists>x(\<phi>{x} & \<forall>z(\<phi>{z} \<rightarrow> z = x) & \<psi>{x})\<close> by (rule "\<exists>I")
+  next
+    AOT_assume \<open>\<exists>x(\<phi>{x} & \<forall>z(\<phi>{z} \<rightarrow> z = x) & \<psi>{x})\<close>
+    then AOT_obtain b where g: \<open>\<phi>{b} & \<forall>z(\<phi>{z} \<rightarrow> z = b) & \<psi>{b}\<close>
+      using "instantiation"[rotated] by blast
+    AOT_hence h: \<open>b = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{b} & \<forall>z(\<phi>{z} \<rightarrow> z = b))\<close>
+      using b "\<forall>E" by blast
+    AOT_have \<open>\<phi>{b} & \<forall>z(\<phi>{z} \<rightarrow> z = b)\<close> and j: \<open>\<psi>{b}\<close>
+      using g "&E" by blast+
+    AOT_hence \<open>b = \<^bold>\<iota>x \<phi>{x}\<close> using h "\<equiv>E" by blast
+    AOT_thus \<open>\<psi>{\<^bold>\<iota>x \<phi>{x}}\<close> using j "rule=E" by blast
+  qed
+qed
+end
+
+interpretation "russell-axiom[exe,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[1]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[exe,2,1,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<kappa>'\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[2]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[exe,2,1,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>'\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[2]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[exe,2,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[2]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[exe,3,1,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<kappa>'\<kappa>''\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[exe,3,1,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>'\<kappa>\<kappa>''\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[exe,3,1,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>'\<kappa>''\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[exe,3,2,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<kappa>\<kappa>'\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[exe,3,2,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<kappa>'\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[exe,3,2,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>'\<kappa>\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[exe,3,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>[\<Pi>]\<kappa>\<kappa>\<kappa>\<guillemotright>\<close>
+  by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+
+interpretation "russell-axiom[enc,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[1]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[enc,2,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>\<kappa>'[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[2]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[enc,2,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>'\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[2]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[enc,2,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[2]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[enc,3,1,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>\<kappa>'\<kappa>''[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[enc,3,1,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>'\<kappa>\<kappa>''[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[enc,3,1,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>'\<kappa>''\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[enc,3,2,1]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>\<kappa>\<kappa>'[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E")
+interpretation "russell-axiom[enc,3,2,2]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>\<kappa>'\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[enc,3,2,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>'\<kappa>\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+interpretation "russell-axiom[enc,3,3]": russell_axiom \<open>\<lambda> \<kappa> . \<guillemotleft>\<kappa>\<kappa>\<kappa>[\<Pi>]\<guillemotright>\<close>
+  by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "\<rightarrow>E"] "&E"(2))
+
+AOT_act_theorem "!-exists:1": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<equiv> \<exists>!x \<phi>{x}\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close> by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  AOT_hence \<open>\<phi>{a} & \<forall>z (\<phi>{z} \<rightarrow> z = a)\<close>
+    using hintikka "\<equiv>E" by blast
+  AOT_hence \<open>\<exists>x (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x))\<close>
+    by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>!x \<phi>{x}\<close>
+    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+next
+  AOT_assume \<open>\<exists>!x \<phi>{x}\<close>
+  AOT_hence \<open>\<exists>x (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x))\<close>
+    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain b where \<open>\<phi>{b} & \<forall>z (\<phi>{z} \<rightarrow> z = b)\<close>
+    using "instantiation"[rotated] by blast
+  AOT_hence \<open>b = \<^bold>\<iota>x \<phi>{x}\<close>
+    using hintikka "\<equiv>E" by blast
+  AOT_thus \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+    by (metis "t=t-proper:2" "vdash-properties:6")
+qed
+
+AOT_act_theorem "!-exists:2": \<open>\<exists>y(y=\<^bold>\<iota>x \<phi>{x}) \<equiv> \<exists>!x \<phi>{x}\<close>
+  using "!-exists:1" "free-thms:1" "\<equiv>E"(6) by blast
+
+AOT_act_theorem "y-in:1": \<open>x = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<phi>{x}\<close>
+  using "&E"(1) "\<rightarrow>I" hintikka "\<equiv>E"(1) by blast
+
+(* Note: generalized alphabetic variant of the last theorem *)
+AOT_act_theorem "y-in:2": \<open>z = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<phi>{z}\<close> using "y-in:1".
+
+AOT_act_theorem "y-in:3": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<rightarrow> \<phi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  moreover AOT_have \<open>\<phi>{a}\<close>
+    using calculation hintikka "\<equiv>E"(1) "&E" by blast
+  ultimately AOT_show \<open>\<phi>{\<^bold>\<iota>x \<phi>{x}}\<close> using "rule=E" by blast
+qed
+
+AOT_act_theorem "y-in:4": \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x}) \<rightarrow> \<phi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+  using "y-in:3"[THEN "\<rightarrow>E"] "free-thms:1"[THEN "\<equiv>E"(2)] "\<rightarrow>I" by blast
+
+
+AOT_theorem "act-quant-nec":
+  \<open>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>) \<equiv> \<forall>\<beta>(\<^bold>\<A>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+  AOT_hence \<open>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta> using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta> 
+    by (metis "Act-Basic:5" "act-conj-act:4" "\<equiv>E"(1) "\<equiv>E"(5))
+  AOT_thus \<open>\<forall>\<beta>(\<^bold>\<A>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    by (rule "\<forall>I")
+next
+  AOT_assume \<open>\<forall>\<beta>(\<^bold>\<A>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+  AOT_hence \<open>\<^bold>\<A>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta> using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>\<close> for \<beta>
+    by (metis "Act-Basic:5" "act-conj-act:4" "\<equiv>E"(1) "\<equiv>E"(6))
+  AOT_thus \<open>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    by (rule "\<forall>I")
+qed
+
+AOT_theorem "equi-desc-descA:1": \<open>x = \<^bold>\<iota>x \<phi>{x} \<equiv> x = \<^bold>\<iota>x(\<^bold>\<A>\<phi>{x})\<close>
+proof -
+  AOT_have \<open>x = \<^bold>\<iota>x \<phi>{x} \<equiv> \<forall>z (\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+    using descriptions[axiom_inst] by blast
+  also AOT_have \<open>... \<equiv> \<forall>z (\<^bold>\<A>\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+  proof(rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<forall>I")
+    AOT_assume \<open>\<forall>z (\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+    AOT_hence \<open>\<^bold>\<A>\<phi>{a} \<equiv> a = x\<close> for a
+      using "\<forall>E" by blast
+    AOT_thus \<open>\<^bold>\<A>\<^bold>\<A>\<phi>{a} \<equiv> a = x\<close> for a
+      by (metis "Act-Basic:5" "act-conj-act:4" "\<equiv>E"(1) "\<equiv>E"(5))
+  next
+    AOT_assume \<open>\<forall>z (\<^bold>\<A>\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+    AOT_hence \<open>\<^bold>\<A>\<^bold>\<A>\<phi>{a} \<equiv> a = x\<close> for a
+      using "\<forall>E" by blast
+    AOT_thus \<open>\<^bold>\<A>\<phi>{a} \<equiv> a = x\<close> for a
+      by (metis "Act-Basic:5" "act-conj-act:4" "\<equiv>E"(1) "\<equiv>E"(6))
+  qed
+  also AOT_have \<open>... \<equiv> x = \<^bold>\<iota>x(\<^bold>\<A>\<phi>{x})\<close>
+    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] descriptions[axiom_inst] by fast
+  finally show ?thesis .
+qed
+
+AOT_theorem "equi-desc-descA:2": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<rightarrow> \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x(\<^bold>\<A>\<phi>{x})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  moreover AOT_have \<open>a = \<^bold>\<iota>x(\<^bold>\<A>\<phi>{x})\<close>
+    using calculation "equi-desc-descA:1"[THEN "\<equiv>E"(1)] by blast
+  ultimately AOT_show \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x(\<^bold>\<A>\<phi>{x})\<close>
+    using "rule=E" by fast
+qed
+
+AOT_theorem "nec-hintikka-scheme":
+  \<open>x = \<^bold>\<iota>x \<phi>{x} \<equiv> \<^bold>\<A>\<phi>{x} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = x)\<close>
+proof -
+  AOT_have \<open>x = \<^bold>\<iota>x \<phi>{x} \<equiv> \<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+    using descriptions[axiom_inst] by blast
+  also AOT_have \<open>\<dots> \<equiv> (\<^bold>\<A>\<phi>{x} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = x))\<close>
+    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "term-out:3" by fast
+  finally show ?thesis.
+qed
+
+AOT_theorem "equiv-desc-eq:1":
+  \<open>\<^bold>\<A>\<forall>x(\<phi>{x} \<equiv> \<psi>{x}) \<rightarrow> \<forall>x (x = \<^bold>\<iota>x \<phi>{x} \<equiv> x = \<^bold>\<iota>x \<psi>{x})\<close>
+proof(rule "\<rightarrow>I"; rule "\<forall>I")
+  fix \<beta>
+  AOT_assume \<open>\<^bold>\<A>\<forall>x(\<phi>{x} \<equiv> \<psi>{x})\<close>
+  AOT_hence \<open>\<^bold>\<A>(\<phi>{x} \<equiv> \<psi>{x})\<close> for x
+    using "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(1)] "\<forall>E"(2) by blast
+  AOT_hence 0: \<open>\<^bold>\<A>\<phi>{x} \<equiv> \<^bold>\<A>\<psi>{x}\<close> for x
+    by (metis "Act-Basic:5" "\<equiv>E"(1))
+  AOT_have \<open>\<beta> = \<^bold>\<iota>x \<phi>{x} \<equiv> \<^bold>\<A>\<phi>{\<beta>} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = \<beta>)\<close>
+    using "nec-hintikka-scheme" by blast
+  also AOT_have \<open>... \<equiv> \<^bold>\<A>\<psi>{\<beta>} & \<forall>z(\<^bold>\<A>\<psi>{z} \<rightarrow> z = \<beta>)\<close>
+  proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume 1: \<open>\<^bold>\<A>\<phi>{\<beta>} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = \<beta>)\<close>
+    AOT_hence \<open>\<^bold>\<A>\<phi>{z} \<rightarrow> z = \<beta>\<close> for z
+      using "&E" "\<forall>E" by blast
+    AOT_hence \<open>\<^bold>\<A>\<psi>{z} \<rightarrow> z = \<beta>\<close> for z
+      using 0 "\<equiv>E" "\<rightarrow>I" "\<rightarrow>E" by metis
+    AOT_hence \<open>\<forall>z(\<^bold>\<A>\<psi>{z} \<rightarrow> z = \<beta>)\<close>
+      using "\<forall>I" by fast
+    moreover AOT_have \<open>\<^bold>\<A>\<psi>{\<beta>}\<close>
+      using "&E" 0[THEN "\<equiv>E"(1)] 1 by blast
+    ultimately AOT_show \<open>\<^bold>\<A>\<psi>{\<beta>} & \<forall>z(\<^bold>\<A>\<psi>{z} \<rightarrow> z = \<beta>)\<close>
+      using "&I" by blast
+  next
+    AOT_assume 1: \<open>\<^bold>\<A>\<psi>{\<beta>} & \<forall>z(\<^bold>\<A>\<psi>{z} \<rightarrow> z = \<beta>)\<close>
+    AOT_hence \<open>\<^bold>\<A>\<psi>{z} \<rightarrow> z = \<beta>\<close> for z
+      using "&E" "\<forall>E" by blast
+    AOT_hence \<open>\<^bold>\<A>\<phi>{z} \<rightarrow> z = \<beta>\<close> for z
+      using 0 "\<equiv>E" "\<rightarrow>I" "\<rightarrow>E" by metis
+    AOT_hence \<open>\<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = \<beta>)\<close>
+      using "\<forall>I" by fast
+    moreover AOT_have \<open>\<^bold>\<A>\<phi>{\<beta>}\<close>
+      using "&E" 0[THEN "\<equiv>E"(2)] 1 by blast
+    ultimately AOT_show \<open>\<^bold>\<A>\<phi>{\<beta>} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = \<beta>)\<close>
+      using "&I" by blast
+  qed
+  also AOT_have \<open>... \<equiv> \<beta> = \<^bold>\<iota>x \<psi>{x}\<close>
+    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "nec-hintikka-scheme" by blast
+  finally AOT_show \<open>\<beta> = \<^bold>\<iota>x \<phi>{x} \<equiv> \<beta> = \<^bold>\<iota>x \<psi>{x}\<close> .
+qed
+
+AOT_theorem "equiv-desc-eq:2":
+  \<open>\<^bold>\<iota>x \<phi>{x}\<down> & \<^bold>\<A>\<forall>x(\<phi>{x} \<equiv> \<psi>{x}) \<rightarrow> \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down> & \<^bold>\<A>\<forall>x(\<phi>{x} \<equiv> \<psi>{x})\<close>
+  AOT_hence 0: \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close> and
+            1: \<open>\<forall>x (x = \<^bold>\<iota>x \<phi>{x} \<equiv> x = \<^bold>\<iota>x \<psi>{x})\<close>
+    using "&E" "free-thms:1"[THEN "\<equiv>E"(1)] "equiv-desc-eq:1" "\<rightarrow>E" by blast+
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  moreover AOT_have \<open>a = \<^bold>\<iota>x \<psi>{x}\<close>
+    using calculation 1 "\<forall>E" "\<equiv>E"(1) by fast
+  ultimately AOT_show \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
+    using "rule=E" by fast
+qed
+
+AOT_theorem "equiv-desc-eq:3":
+  \<open>\<^bold>\<iota>x \<phi>{x}\<down> & \<box>\<forall>x(\<phi>{x} \<equiv> \<psi>{x}) \<rightarrow> \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
+  using "\<rightarrow>I" "equiv-desc-eq:2"[THEN "\<rightarrow>E", OF "&I"] "&E"
+        "nec-imp-act"[THEN "\<rightarrow>E"] by metis
+
+(* Note: this is a special case of "exist-nec" *)
+AOT_theorem "equiv-desc-eq:4": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<rightarrow> \<box>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  AOT_thus \<open>\<box>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+    using "ex:2:a" "rule=E" by fast
+qed
+
+AOT_theorem "equiv-desc-eq:5": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<rightarrow> \<exists>y \<box>(y = \<^bold>\<iota>x \<phi>{x})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  AOT_hence \<open>\<box>(a = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (metis "id-nec:2" "vdash-properties:10")
+  AOT_thus \<open>\<exists>y \<box>(y = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_act_theorem "equiv-desc-eq2:1":
+  \<open>\<forall>x (\<phi>{x} \<equiv> \<psi>{x}) \<rightarrow> \<forall>x (x = \<^bold>\<iota>x \<phi>{x} \<equiv> x = \<^bold>\<iota>x \<psi>{x})\<close>
+  using "\<rightarrow>I" "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"]
+        "equiv-desc-eq:1"[THEN "\<rightarrow>E"]
+        "RA[1]" "deduction-theorem" by blast
+
+AOT_act_theorem "equiv-desc-eq2:2":
+  \<open>\<^bold>\<iota>x \<phi>{x}\<down> & \<forall>x (\<phi>{x} \<equiv> \<psi>{x}) \<rightarrow> \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
+  using "\<rightarrow>I" "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"]
+        "equiv-desc-eq:2"[THEN "\<rightarrow>E", OF "&I"]
+        "RA[1]" "deduction-theorem" "&E" by metis
+
+context russell_axiom
+begin
+AOT_theorem "nec-russell-axiom":
+  \<open>\<psi>{\<^bold>\<iota>x \<phi>{x}} \<equiv> \<exists>x(\<^bold>\<A>\<phi>{x} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = x) & \<psi>{x})\<close>
+proof -
+  AOT_have b: \<open>\<forall>x (x = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<^bold>\<A>\<phi>{x} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = x)))\<close>
+    using "nec-hintikka-scheme" "\<forall>I" by fast
+  show ?thesis
+  proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume c: \<open>\<psi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+    AOT_hence d: \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+      using \<psi>_denotes_asm by blast
+    AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+      by (metis "rule=I:1" "existential:1")
+    then AOT_obtain a where a_def: \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+      using "instantiation"[rotated] by blast
+    moreover AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<^bold>\<A>\<phi>{a} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = a))\<close>
+      using b "\<forall>E" by blast
+    ultimately AOT_have \<open>\<^bold>\<A>\<phi>{a} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = a)\<close>
+      using "\<equiv>E" by blast
+    moreover AOT_have \<open>\<psi>{a}\<close>
+    proof - 
+      AOT_have 1: \<open>\<forall>x\<forall>y(x = y \<rightarrow> y = x)\<close>
+        by (simp add: "id-eq:2" "universal-cor")
+      AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x} \<rightarrow>  \<^bold>\<iota>x \<phi>{x} = a\<close>
+        by (rule "\<forall>E"(1)[where \<tau>="\<guillemotleft>\<^bold>\<iota>x \<phi>{x}\<guillemotright>"]; rule "\<forall>E"(2)[where \<beta>=a])
+           (auto simp: d "universal-cor" 1)
+      AOT_thus \<open>\<psi>{a}\<close>
+        using a_def c "rule=E" "\<rightarrow>E" by metis
+    qed
+    ultimately AOT_have \<open>\<^bold>\<A>\<phi>{a} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = a) & \<psi>{a}\<close>
+      by (rule "&I")
+    AOT_thus \<open>\<exists>x(\<^bold>\<A>\<phi>{x} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = x) & \<psi>{x})\<close>
+      by (rule "\<exists>I")
+  next
+    AOT_assume \<open>\<exists>x(\<^bold>\<A>\<phi>{x} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = x) & \<psi>{x})\<close>
+    then AOT_obtain b where g: \<open>\<^bold>\<A>\<phi>{b} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = b) & \<psi>{b}\<close>
+      using "instantiation"[rotated] by blast
+    AOT_hence h: \<open>b = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<^bold>\<A>\<phi>{b} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = b))\<close>
+      using b "\<forall>E" by blast
+    AOT_have \<open>\<^bold>\<A>\<phi>{b} & \<forall>z(\<^bold>\<A>\<phi>{z} \<rightarrow> z = b)\<close> and j: \<open>\<psi>{b}\<close>
+      using g "&E" by blast+
+    AOT_hence \<open>b = \<^bold>\<iota>x \<phi>{x}\<close>
+      using h "\<equiv>E" by blast
+    AOT_thus \<open>\<psi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+      using j "rule=E" by blast
+  qed
+qed
+end
+
+AOT_theorem "actual-desc:1": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<equiv> \<exists>!x \<^bold>\<A>\<phi>{x}\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close>
+    by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "instantiation"[rotated] by blast
+  moreover AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x} \<equiv> \<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = a)\<close>
+    using descriptions[axiom_inst] by blast
+  ultimately AOT_have \<open>\<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = a)\<close>
+    using "\<equiv>E" by blast
+  AOT_hence \<open>\<exists>x\<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>!x \<^bold>\<A>\<phi>{x}\<close>
+    using "uniqueness:2"[THEN "\<equiv>E"(2)] by fast
+next
+  AOT_assume \<open>\<exists>!x \<^bold>\<A>\<phi>{x}\<close>
+  AOT_hence \<open>\<exists>x\<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = x)\<close>
+    using "uniqueness:2"[THEN "\<equiv>E"(1)] by fast
+  then AOT_obtain a where \<open>\<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = a)\<close>
+    using "instantiation"[rotated] by blast
+  moreover AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x} \<equiv> \<forall>z(\<^bold>\<A>\<phi>{z} \<equiv> z = a)\<close>
+    using descriptions[axiom_inst] by blast
+  ultimately AOT_have \<open>a = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "\<equiv>E" by blast
+  AOT_thus \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+    by (metis "t=t-proper:2" "vdash-properties:6")
+qed
+
+AOT_theorem "actual-desc:2": \<open>x = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<^bold>\<A>\<phi>{x}\<close>
+  using "&E"(1) "contraposition:1[2]" "\<equiv>E"(1) "nec-hintikka-scheme"
+        "reductio-aa:2" "vdash-properties:9" by blast
+
+(* Note: generalized alphabetic variant of the last theorem *)
+AOT_theorem "actual-desc:3": \<open>z = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<^bold>\<A>\<phi>{z}\<close>
+  using "actual-desc:2".
+
+AOT_theorem "actual-desc:4": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<rightarrow> \<^bold>\<A>\<phi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close> by (metis "rule=I:1" "existential:1")
+  then AOT_obtain a where \<open>a = \<^bold>\<iota>x \<phi>{x}\<close> using "instantiation"[rotated] by blast
+  AOT_thus \<open>\<^bold>\<A>\<phi>{\<^bold>\<iota>x \<phi>{x}}\<close>
+    using "actual-desc:2" "rule=E" "\<rightarrow>E" by fast
+qed
+
+AOT_theorem "actual-desc:5": \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x} \<rightarrow> \<^bold>\<A>\<forall>x(\<phi>{x} \<equiv> \<psi>{x})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
+  AOT_hence \<phi>_down: \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close> and \<psi>_down: \<open>\<^bold>\<iota>x \<psi>{x}\<down>\<close>
+    using "t=t-proper:1" "t=t-proper:2" "vdash-properties:6" by blast+
+  AOT_hence \<open>\<exists>y (y = \<^bold>\<iota>x \<phi>{x})\<close> and \<open>\<exists>y (y = \<^bold>\<iota>x \<psi>{x})\<close>
+    by (metis "rule=I:1" "existential:1")+
+  then AOT_obtain a and b where a_eq: \<open>a = \<^bold>\<iota>x \<phi>{x}\<close> and b_eq: \<open>b = \<^bold>\<iota>x \<psi>{x}\<close>
+    using "instantiation"[rotated] by metis
+
+  AOT_have \<open>\<forall>\<alpha>\<forall>\<beta> (\<alpha> = \<beta> \<rightarrow> \<beta> = \<alpha>)\<close>
+    by (rule "\<forall>I"; rule "\<forall>I"; rule "id-eq:2")
+  AOT_hence \<open>\<forall>\<beta> (\<^bold>\<iota>x \<phi>{x} = \<beta> \<rightarrow> \<beta> = \<^bold>\<iota>x \<phi>{x})\<close>
+    using "\<forall>E" \<phi>_down by blast
+  AOT_hence \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x} \<rightarrow> \<^bold>\<iota>x \<psi>{x} = \<^bold>\<iota>x \<phi>{x}\<close>
+    using "\<forall>E" \<psi>_down by blast
+  AOT_hence 1: \<open>\<^bold>\<iota>x \<psi>{x} = \<^bold>\<iota>x \<phi>{x}\<close> using 0
+    "\<rightarrow>E" by blast
+
+  AOT_have \<open>\<^bold>\<A>\<phi>{x} \<equiv> \<^bold>\<A>\<psi>{x}\<close> for x
+  proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume \<open>\<^bold>\<A>\<phi>{x}\<close>
+    moreover AOT_have \<open>\<^bold>\<A>\<phi>{x} \<rightarrow> x = a\<close> for x
+      using "nec-hintikka-scheme"[THEN "\<equiv>E"(1), OF a_eq, THEN "&E"(2)]
+            "\<forall>E" by blast
+    ultimately AOT_have \<open>x = a\<close>
+      using "\<rightarrow>E" by blast
+    AOT_hence \<open>x = \<^bold>\<iota>x \<phi>{x}\<close>
+      using a_eq "rule=E" by blast
+    AOT_hence \<open>x = \<^bold>\<iota>x \<psi>{x}\<close>
+      using 0 "rule=E" by blast
+    AOT_thus \<open>\<^bold>\<A>\<psi>{x}\<close>
+      by (metis "actual-desc:3" "vdash-properties:6")
+  next
+    AOT_assume \<open>\<^bold>\<A>\<psi>{x}\<close>
+    moreover AOT_have \<open>\<^bold>\<A>\<psi>{x} \<rightarrow> x = b\<close> for x
+      using "nec-hintikka-scheme"[THEN "\<equiv>E"(1), OF b_eq, THEN "&E"(2)]
+            "\<forall>E" by blast
+    ultimately AOT_have \<open>x = b\<close>
+      using "\<rightarrow>E" by blast
+    AOT_hence \<open>x = \<^bold>\<iota>x \<psi>{x}\<close>
+      using b_eq "rule=E" by blast
+    AOT_hence \<open>x = \<^bold>\<iota>x \<phi>{x}\<close>
+      using 1 "rule=E" by blast
+    AOT_thus \<open>\<^bold>\<A>\<phi>{x}\<close>
+      by (metis "actual-desc:3" "vdash-properties:6")
+  qed
+  AOT_hence \<open>\<^bold>\<A>(\<phi>{x} \<equiv> \<psi>{x})\<close> for x
+    by (metis "Act-Basic:5" "\<equiv>E"(2))
+  AOT_hence \<open>\<forall>x \<^bold>\<A>(\<phi>{x} \<equiv> \<psi>{x})\<close>
+    by (rule "\<forall>I")
+  AOT_thus \<open>\<^bold>\<A>\<forall>x (\<phi>{x} \<equiv> \<psi>{x})\<close>
+    using "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)] by fast
+qed    
+
+AOT_theorem "!box-desc:1": \<open>\<exists>!x \<box>\<phi>{x} \<rightarrow> \<forall>y (y = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<phi>{y})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>!x \<box>\<phi>{x}\<close>
+  AOT_hence \<zeta>: \<open>\<exists>x (\<box>\<phi>{x} & \<forall>z (\<box>\<phi>{z} \<rightarrow> z = x))\<close>
+    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain b where \<theta>: \<open>\<box>\<phi>{b} & \<forall>z (\<box>\<phi>{z} \<rightarrow> z = b)\<close>
+    using "instantiation"[rotated] by blast
+  AOT_show \<open>\<forall>y (y = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<phi>{y})\<close>
+  proof(rule GEN; rule "\<rightarrow>I")
+    fix y
+    AOT_assume \<open>y = \<^bold>\<iota>x \<phi>{x}\<close>
+    AOT_hence \<open>\<^bold>\<A>\<phi>{y} & \<forall>z (\<^bold>\<A>\<phi>{z} \<rightarrow> z = y)\<close>
+      using "nec-hintikka-scheme"[THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<^bold>\<A>\<phi>{b} \<rightarrow> b = y\<close>
+      using "&E" "\<forall>E" by blast
+    moreover AOT_have \<open>\<^bold>\<A>\<phi>{b}\<close>
+      using \<theta>[THEN "&E"(1)]  by (metis "nec-imp-act" "\<rightarrow>E")
+    ultimately AOT_have \<open>b = y\<close>
+      using "\<rightarrow>E" by blast
+    moreover AOT_have \<open>\<phi>{b}\<close>
+      using \<theta>[THEN "&E"(1)]  by (metis "qml:2"[axiom_inst] "\<rightarrow>E") 
+    ultimately AOT_show \<open>\<phi>{y}\<close>
+      using "rule=E" by blast
+  qed
+qed
+
+AOT_theorem "!box-desc:2":
+  \<open>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x}) \<rightarrow> (\<exists>!x \<phi>{x} \<rightarrow> \<forall>y (y = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<phi>{y}))\<close>
+proof(rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
+  moreover AOT_assume \<open>\<exists>!x \<phi>{x}\<close>
+  ultimately AOT_have \<open>\<exists>!x \<box>\<phi>{x}\<close>
+    using "nec-exist-!"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<forall>y (y = \<^bold>\<iota>x \<phi>{x} \<rightarrow> \<phi>{y})\<close>
+    using "!box-desc:1" "\<rightarrow>E" by blast
+qed
+
+(* Note: vacuous in the embedding. *)
+AOT_theorem "dr-alphabetic-thm": \<open>\<^bold>\<iota>\<nu> \<phi>{\<nu>}\<down> \<rightarrow> \<^bold>\<iota>\<nu> \<phi>{\<nu>} = \<^bold>\<iota>\<mu> \<phi>{\<mu>}\<close>
+  by (simp add: "rule=I:1" "\<rightarrow>I")
+
+subsection\<open>The Theory of Necessity\<close>
+text\<open>\label{PLM: 9.9}\<close>
+
+AOT_theorem "RM:1[prem]":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<rightarrow> \<box>\<psi>\<close>
+proof -
+  AOT_have \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>(\<phi> \<rightarrow> \<psi>)\<close>
+    using "RN[prem]" assms by blast
+  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<rightarrow> \<box>\<psi>\<close>
+    by (metis "qml:1"[axiom_inst] "\<rightarrow>E")
+qed
+
+AOT_theorem "RM:1":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<rightarrow> \<box>\<psi>\<close>
+  using "RM:1[prem]" assms by blast
+
+lemmas RM = "RM:1"
+
+AOT_theorem "RM:2[prem]":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
+proof -
+  AOT_have \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<not>\<psi> \<rightarrow> \<not>\<phi>\<close>
+    using assms 
+    by (simp add: "contraposition:1[1]")
+  AOT_hence \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<not>\<psi> \<rightarrow> \<box>\<not>\<phi>\<close>
+    using "RM:1[prem]" by blast
+  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
+    by (meson "\<equiv>\<^sub>d\<^sub>fE" "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" "\<rightarrow>I" "modus-tollens:1")
+qed
+
+AOT_theorem "RM:2":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
+  using "RM:2[prem]" assms by blast
+
+lemmas "RM\<diamond>" = "RM:2"
+
+AOT_theorem "RM:3[prem]":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<psi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<equiv> \<box>\<psi>\<close>
+proof -
+  AOT_have \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close> and \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<psi> \<rightarrow> \<phi>\<close>
+    using assms "\<equiv>E" "\<rightarrow>I" by metis+
+  AOT_hence \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<rightarrow> \<box>\<psi>\<close> and \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<psi> \<rightarrow> \<box>\<phi>\<close>
+    using "RM:1[prem]" by metis+
+  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<equiv> \<box>\<psi>\<close>
+    by (simp add: "\<equiv>I")
+qed
+
+AOT_theorem "RM:3":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<psi>\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>\<phi> \<equiv> \<box>\<psi>\<close>
+  using "RM:3[prem]" assms by blast
+
+lemmas RE = "RM:3"
+
+AOT_theorem "RM:4[prem]":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<psi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<equiv> \<diamond>\<psi>\<close>
+proof -
+  AOT_have \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close> and \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<psi> \<rightarrow> \<phi>\<close>
+    using assms "\<equiv>E" "\<rightarrow>I" by metis+
+  AOT_hence \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<psi>\<close> and \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<phi>\<close>
+    using "RM:2[prem]" by metis+
+  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<equiv> \<diamond>\<psi>\<close>
+    by (simp add: "\<equiv>I")
+qed
+
+AOT_theorem "RM:4":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<psi>\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<equiv> \<diamond>\<psi>\<close>
+  using "RM:4[prem]" assms by blast
+
+lemmas "RE\<diamond>" = "RM:4"
+
+AOT_theorem "KBasic:1": \<open>\<box>\<phi> \<rightarrow> \<box>(\<psi> \<rightarrow> \<phi>)\<close>
+  by (simp add: RM "pl:1"[axiom_inst])
+
+AOT_theorem "KBasic:2": \<open>\<box>\<not>\<phi> \<rightarrow> \<box>(\<phi> \<rightarrow> \<psi>)\<close>
+  by (simp add: RM "useful-tautologies:3")
+
+AOT_theorem "KBasic:3": \<open>\<box>(\<phi> & \<psi>) \<equiv> (\<box>\<phi> & \<box>\<psi>)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>(\<phi> & \<psi>)\<close>
+  AOT_thus \<open>\<box>\<phi> & \<box>\<psi>\<close>
+    by (meson RM "&I" "Conjunction Simplification"(1, 2) "\<rightarrow>E")
+next
+  AOT_have \<open>\<box>\<phi> \<rightarrow> \<box>(\<psi> \<rightarrow> (\<phi> & \<psi>))\<close>
+    by (simp add: "RM:1" Adjunction)
+  AOT_hence \<open>\<box>\<phi> \<rightarrow> (\<box>\<psi> \<rightarrow> \<box>(\<phi> & \<psi>))\<close>
+    by (metis "Hypothetical Syllogism" "qml:1"[axiom_inst])
+  moreover AOT_assume \<open>\<box>\<phi> & \<box>\<psi>\<close>
+  ultimately AOT_show \<open>\<box>(\<phi> & \<psi>)\<close>
+    using "\<rightarrow>E" "&E" by blast
+qed
+
+AOT_theorem "KBasic:4": \<open>\<box>(\<phi> \<equiv> \<psi>) \<equiv> (\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>))\<close>
+proof -
+  AOT_have \<theta>: \<open>\<box>((\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>)) \<equiv> (\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>))\<close>
+    by (fact "KBasic:3")
+  AOT_modally_strict {
+    AOT_have \<open>(\<phi> \<equiv> \<psi>) \<equiv> ((\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>))\<close>
+      by (fact "conventions:3"[THEN "\<equiv>Df"])
+  }
+  AOT_hence \<xi>: \<open>\<box>(\<phi> \<equiv> \<psi>) \<equiv> \<box>((\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>))\<close>
+    by (rule RE)
+  with \<xi> and \<theta> AOT_show \<open>\<box>(\<phi> \<equiv> \<psi>) \<equiv> (\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>))\<close>
+    using "\<equiv>E"(5) by blast
+qed
+
+AOT_theorem "KBasic:5": \<open>(\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>)) \<rightarrow> (\<box>\<phi> \<equiv> \<box>\<psi>)\<close>
+proof -
+  AOT_have \<open>\<box>(\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<box>\<phi> \<rightarrow> \<box>\<psi>)\<close>
+    by (fact "qml:1"[axiom_inst])
+  moreover AOT_have \<open>\<box>(\<psi> \<rightarrow> \<phi>) \<rightarrow> (\<box>\<psi> \<rightarrow> \<box>\<phi>)\<close>
+    by (fact "qml:1"[axiom_inst])
+  ultimately AOT_have \<open>(\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>)) \<rightarrow> ((\<box>\<phi> \<rightarrow> \<box>\<psi>) & (\<box>\<psi> \<rightarrow> \<box>\<phi>))\<close>
+    by (metis "&I" MP "Double Composition")
+  moreover AOT_have \<open>((\<box>\<phi> \<rightarrow> \<box>\<psi>) & (\<box>\<psi> \<rightarrow> \<box>\<phi>)) \<rightarrow> (\<box>\<phi> \<equiv> \<box>\<psi>)\<close>
+    using "conventions:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<rightarrow>I" by blast
+  ultimately AOT_show \<open>(\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>)) \<rightarrow> (\<box>\<phi> \<equiv> \<box>\<psi>)\<close>
+    by (metis "Hypothetical Syllogism")
+qed
+
+AOT_theorem "KBasic:6": \<open>\<box>(\<phi> \<equiv> \<psi>) \<rightarrow> (\<box>\<phi> \<equiv> \<box>\<psi>)\<close>
+  using "KBasic:4" "KBasic:5" "deduction-theorem" "\<equiv>E"(1) "\<rightarrow>E" by blast
+AOT_theorem "KBasic:7": \<open>((\<box>\<phi> & \<box>\<psi>) \<or> (\<box>\<not>\<phi> & \<box>\<not>\<psi>)) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+proof (rule "\<rightarrow>I"; drule "\<or>E"(1); (rule "\<rightarrow>I")?)
+  AOT_assume \<open>\<box>\<phi> & \<box>\<psi>\<close>
+  AOT_hence \<open>\<box>\<phi>\<close> and \<open>\<box>\<psi>\<close> using "&E" by blast+
+  AOT_hence \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close> and \<open>\<box>(\<psi> \<rightarrow> \<phi>)\<close> using "KBasic:1" "\<rightarrow>E" by blast+
+  AOT_hence \<open>\<box>(\<phi> \<rightarrow> \<psi>) & \<box>(\<psi> \<rightarrow> \<phi>)\<close> using "&I" by blast
+  AOT_thus \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>  by (metis "KBasic:4" "\<equiv>E"(2))
+next
+  AOT_assume \<open>\<box>\<not>\<phi> & \<box>\<not>\<psi>\<close>
+  AOT_hence 0: \<open>\<box>(\<not>\<phi> & \<not>\<psi>)\<close> using "KBasic:3"[THEN "\<equiv>E"(2)] by blast
+  AOT_modally_strict {
+    AOT_have \<open>(\<not>\<phi> & \<not>\<psi>) \<rightarrow> (\<phi> \<equiv> \<psi>)\<close>
+      by (metis "&E"(1) "&E"(2) "deduction-theorem" "\<equiv>I" "reductio-aa:1")
+  }
+  AOT_hence \<open>\<box>(\<not>\<phi> & \<not>\<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+    by (rule RM)
+  AOT_thus \<open>\<box>(\<phi> \<equiv> \<psi>)\<close> using 0 "\<rightarrow>E" by blast
+qed(auto)
+
+AOT_theorem "KBasic:8": \<open>\<box>(\<phi> & \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+  by (meson "RM:1" "&E"(1) "&E"(2) "deduction-theorem" "\<equiv>I")
+AOT_theorem "KBasic:9": \<open>\<box>(\<not>\<phi> & \<not>\<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+  by (metis "RM:1" "&E"(1) "&E"(2) "deduction-theorem" "\<equiv>I" "raa-cor:4")
+AOT_theorem "KBasic:10": \<open>\<box>\<phi> \<equiv> \<box>\<not>\<not>\<phi>\<close>
+  by (simp add: "RM:3" "oth-class-taut:3:b")
+AOT_theorem "KBasic:11": \<open>\<not>\<box>\<phi> \<equiv> \<diamond>\<not>\<phi>\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_show \<open>\<diamond>\<not>\<phi>\<close> if \<open>\<not>\<box>\<phi>\<close>
+    using that "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" "KBasic:10" "\<equiv>E"(3) by blast
+next
+  AOT_show \<open>\<not>\<box>\<phi>\<close> if \<open>\<diamond>\<not>\<phi>\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "KBasic:10" "\<equiv>E"(4) that by blast
+qed
+AOT_theorem "KBasic:12": \<open>\<box>\<phi> \<equiv> \<not>\<diamond>\<not>\<phi>\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_show \<open>\<not>\<diamond>\<not>\<phi>\<close> if \<open>\<box>\<phi>\<close>
+    using "\<not>\<not>I" "KBasic:11" "\<equiv>E"(3) that by blast
+next
+  AOT_show \<open>\<box>\<phi>\<close> if \<open>\<not>\<diamond>\<not>\<phi>\<close>
+  using "KBasic:11" "\<equiv>E"(1) "reductio-aa:1" that by blast
+qed
+AOT_theorem "KBasic:13": \<open>\<box>(\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<diamond>\<phi> \<rightarrow> \<diamond>\<psi>)\<close>
+proof -
+  AOT_have \<open>\<phi> \<rightarrow> \<psi> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<psi>\<close> by blast
+  AOT_hence \<open>\<box>(\<phi> \<rightarrow> \<psi>) \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
+    using "RM:2[prem]" by blast
+  AOT_thus \<open>\<box>(\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<diamond>\<phi> \<rightarrow> \<diamond>\<psi>)\<close> using "\<rightarrow>I" by blast
+qed
+lemmas "K\<diamond>" = "KBasic:13"
+AOT_theorem "KBasic:14": \<open>\<diamond>\<box>\<phi> \<equiv> \<not>\<box>\<diamond>\<not>\<phi>\<close>
+  by (meson "RE\<diamond>" "KBasic:11" "KBasic:12" "\<equiv>E"(6) "oth-class-taut:3:a")
+AOT_theorem "KBasic:15": \<open>(\<box>\<phi> \<or> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<or> \<psi>)\<close>
+proof -
+  AOT_modally_strict {
+    AOT_have \<open>\<phi> \<rightarrow> (\<phi> \<or> \<psi>)\<close> and \<open>\<psi> \<rightarrow> (\<phi> \<or> \<psi>)\<close>
+      by (auto simp: "Disjunction Addition"(1) "Disjunction Addition"(2))
+  }
+  AOT_hence \<open>\<box>\<phi> \<rightarrow> \<box>(\<phi> \<or> \<psi>)\<close> and \<open>\<box>\<psi> \<rightarrow> \<box>(\<phi> \<or> \<psi>)\<close>
+    using RM by blast+
+  AOT_thus \<open>(\<box>\<phi> \<or> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<or> \<psi>)\<close>
+    by (metis "\<or>E"(1) "deduction-theorem")
+qed
+
+AOT_theorem "KBasic:16": \<open>(\<box>\<phi> & \<diamond>\<psi>) \<rightarrow> \<diamond>(\<phi> & \<psi>)\<close>
+  by (meson "KBasic:13" "RM:1" Adjunction "Hypothetical Syllogism"
+            Importation "\<rightarrow>E")
+
+AOT_theorem "rule-sub-lem:1:a":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi> \<equiv> \<chi>)\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<psi> \<equiv> \<not>\<chi>\<close>
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF assms]
+        "\<equiv>E"(1) "oth-class-taut:4:b" by blast
+
+AOT_theorem "rule-sub-lem:1:b":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi> \<equiv> \<chi>)\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> (\<psi> \<rightarrow> \<Theta>) \<equiv> (\<chi> \<rightarrow> \<Theta>)\<close>
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF assms]
+  using "oth-class-taut:4:c" "vdash-properties:6" by blast
+
+AOT_theorem "rule-sub-lem:1:c":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi> \<equiv> \<chi>)\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> (\<Theta> \<rightarrow> \<psi>) \<equiv> (\<Theta> \<rightarrow> \<chi>)\<close>
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF assms]
+  using "oth-class-taut:4:d" "vdash-properties:6" by blast
+
+AOT_theorem "rule-sub-lem:1:d":
+  assumes \<open>for arbitrary \<alpha>: \<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>})\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<forall>\<alpha> \<psi>{\<alpha>} \<equiv> \<forall>\<alpha> \<chi>{\<alpha>}\<close>
+proof -
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>})\<close>
+      using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF assms] "\<forall>I" by fast
+    AOT_hence 0: \<open>\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>}\<close> for \<alpha> using "\<forall>E" by blast
+    AOT_show \<open>\<forall>\<alpha> \<psi>{\<alpha>} \<equiv> \<forall>\<alpha> \<chi>{\<alpha>}\<close>
+    proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+      AOT_assume \<open>\<forall>\<alpha> \<psi>{\<alpha>}\<close>
+      AOT_hence \<open>\<psi>{\<alpha>}\<close> for \<alpha> using "\<forall>E" by blast
+      AOT_hence \<open>\<chi>{\<alpha>}\<close> for \<alpha> using 0 "\<equiv>E" by blast
+      AOT_thus \<open>\<forall>\<alpha> \<chi>{\<alpha>}\<close> by (rule "\<forall>I")
+    next
+      AOT_assume \<open>\<forall>\<alpha> \<chi>{\<alpha>}\<close>
+      AOT_hence \<open>\<chi>{\<alpha>}\<close> for \<alpha> using "\<forall>E" by blast
+      AOT_hence \<open>\<psi>{\<alpha>}\<close> for \<alpha> using 0 "\<equiv>E" by blast
+      AOT_thus \<open>\<forall>\<alpha> \<psi>{\<alpha>}\<close> by (rule "\<forall>I")
+    qed
+  }
+qed
+
+AOT_theorem "rule-sub-lem:1:e":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi> \<equiv> \<chi>)\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda> \<psi>] \<equiv> [\<lambda> \<chi>]\<close>
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF assms]
+  using "\<equiv>E"(1) "propositions-lemma:6" by blast
+
+AOT_theorem "rule-sub-lem:1:f":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi> \<equiv> \<chi>)\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<^bold>\<A>\<psi> \<equiv> \<^bold>\<A>\<chi>\<close>
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF assms, THEN "RA[2]"]
+  by (metis "Act-Basic:5" "\<equiv>E"(1))
+
+AOT_theorem "rule-sub-lem:1:g":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<psi> \<equiv> \<chi>)\<close>
+  shows \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>\<psi> \<equiv> \<box>\<chi>\<close>
+  using "KBasic:6" assms "vdash-properties:6" by blast
+
+text\<open>Note that instead of deriving @{text "rule-sub-lem:2"},
+     @{text "rule-sub-lem:3"}, @{text "rule-sub-lem:4"},
+     and @{text "rule-sub-nec"}, we construct substitution methods instead.\<close>
+
+class AOT_subst =
+  fixes AOT_subst :: "('a \<Rightarrow> \<o>) \<Rightarrow> bool"
+    and AOT_subst_cond :: "'a \<Rightarrow> 'a \<Rightarrow> bool"
+  assumes AOT_subst:
+    "AOT_subst \<phi> \<Longrightarrow> AOT_subst_cond \<psi> \<chi> \<Longrightarrow> [v \<Turnstile> \<guillemotleft>\<phi> \<psi>\<guillemotright> \<equiv> \<guillemotleft>\<phi> \<chi>\<guillemotright>]"
+
+named_theorems AOT_substI
+
+instantiation \<o> :: AOT_subst
+begin
+
+inductive AOT_subst_\<o> where
+  AOT_subst_\<o>_id[AOT_substI]:
+    \<open>AOT_subst_\<o> (\<lambda>\<phi>. \<phi>)\<close>
+  | AOT_subst_\<o>_const[AOT_substI]:
+    \<open>AOT_subst_\<o> (\<lambda>\<phi>. \<psi>)\<close>
+  | AOT_subst_\<o>_not[AOT_substI]:
+    \<open>AOT_subst_\<o> \<Theta> \<Longrightarrow> AOT_subst_\<o> (\<lambda> \<phi>. \<guillemotleft>\<not>\<Theta>{\<phi>}\<guillemotright>)\<close>
+  | AOT_subst_\<o>_imp[AOT_substI]:
+    \<open>AOT_subst_\<o> \<Theta> \<Longrightarrow> AOT_subst_\<o> \<Xi> \<Longrightarrow> AOT_subst_\<o> (\<lambda> \<phi>. \<guillemotleft>\<Theta>{\<phi>} \<rightarrow> \<Xi>{\<phi>}\<guillemotright>)\<close>
+  | AOT_subst_\<o>_lambda0[AOT_substI]:
+    \<open>AOT_subst_\<o> \<Theta> \<Longrightarrow> AOT_subst_\<o> (\<lambda> \<phi>. (AOT_lambda0 (\<Theta> \<phi>)))\<close>
+  | AOT_subst_\<o>_act[AOT_substI]:
+    \<open>AOT_subst_\<o> \<Theta> \<Longrightarrow> AOT_subst_\<o> (\<lambda> \<phi>. \<guillemotleft>\<^bold>\<A>\<Theta>{\<phi>}\<guillemotright>)\<close>
+  | AOT_subst_\<o>_box[AOT_substI]:
+    \<open>AOT_subst_\<o> \<Theta> \<Longrightarrow> AOT_subst_\<o> (\<lambda> \<phi>. \<guillemotleft>\<box>\<Theta>{\<phi>}\<guillemotright>)\<close>
+  | AOT_subst_\<o>_by_def[AOT_substI]:
+    \<open>(\<And> \<psi> . AOT_model_equiv_def (\<Theta> \<psi>) (\<Xi> \<psi>)) \<Longrightarrow>
+      AOT_subst_\<o> \<Xi> \<Longrightarrow> AOT_subst_\<o> \<Theta>\<close>
+
+
+definition AOT_subst_cond_\<o> where
+  \<open>AOT_subst_cond_\<o> \<equiv> \<lambda> \<psi> \<chi> . \<forall> v . [v \<Turnstile> \<psi> \<equiv> \<chi>]\<close>
+
+instance
+proof
+  fix \<psi> \<chi> :: \<o> and \<phi> :: \<open>\<o> \<Rightarrow> \<o>\<close>
+  assume cond: \<open>AOT_subst_cond \<psi> \<chi>\<close>
+  assume \<open>AOT_subst \<phi>\<close>
+  moreover AOT_have \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<equiv> \<chi>\<close>
+    using cond unfolding AOT_subst_cond_\<o>_def by blast
+  ultimately AOT_show \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>{\<psi>} \<equiv> \<phi>{\<chi>}\<close>
+  proof (induct arbitrary: \<psi> \<chi>)
+    case AOT_subst_\<o>_id
+    thus ?case
+      using "\<equiv>E"(2) "oth-class-taut:4:b" "rule-sub-lem:1:a" by blast
+  next
+    case (AOT_subst_\<o>_const \<psi>)
+    thus ?case
+      by (simp add: "oth-class-taut:3:a")
+  next
+    case (AOT_subst_\<o>_not \<Theta>)
+    thus ?case
+      by (simp add: RN "rule-sub-lem:1:a")
+  next
+    case (AOT_subst_\<o>_imp \<Theta> \<Xi>)
+    thus ?case
+      by (meson RN "\<equiv>E"(5) "rule-sub-lem:1:b" "rule-sub-lem:1:c")
+  next
+    case (AOT_subst_\<o>_lambda0 \<Theta>)
+    thus ?case
+      by (simp add: RN "rule-sub-lem:1:e")
+  next
+    case (AOT_subst_\<o>_act \<Theta>)
+    thus ?case
+      by (simp add: RN "rule-sub-lem:1:f")
+  next
+    case (AOT_subst_\<o>_box \<Theta>)
+    thus ?case
+      by (simp add: RN "rule-sub-lem:1:g")
+  next
+    case (AOT_subst_\<o>_by_def \<Theta> \<Xi>)
+    AOT_modally_strict {
+      AOT_have \<open>\<Xi>{\<psi>} \<equiv> \<Xi>{\<chi>}\<close>
+        using AOT_subst_\<o>_by_def by simp
+      AOT_thus \<open>\<Theta>{\<psi>} \<equiv> \<Theta>{\<chi>}\<close>
+        using "\<equiv>Df"[OF AOT_subst_\<o>_by_def(1), of _ \<psi>]
+              "\<equiv>Df"[OF AOT_subst_\<o>_by_def(1), of _ \<chi>]
+        by (metis "\<equiv>E"(6) "oth-class-taut:3:a")
+    }
+  qed
+qed
+end
+
+instantiation "fun" :: (AOT_Term_id_2, AOT_subst) AOT_subst
+begin
+
+definition AOT_subst_cond_fun :: \<open>('a \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> bool\<close> where
+  \<open>AOT_subst_cond_fun \<equiv> \<lambda> \<phi> \<psi> . \<forall> \<alpha> . AOT_subst_cond (\<phi> (AOT_term_of_var \<alpha>))
+                                                      (\<psi> (AOT_term_of_var \<alpha>))\<close>
+
+inductive AOT_subst_fun :: \<open>(('a \<Rightarrow> 'b) \<Rightarrow> \<o>) \<Rightarrow> bool\<close> where
+  AOT_subst_fun_const[AOT_substI]:
+    \<open>AOT_subst_fun (\<lambda>\<phi>. \<psi>)\<close>
+  | AOT_subst_fun_id[AOT_substI]:
+    \<open>AOT_subst \<Psi> \<Longrightarrow> AOT_subst_fun (\<lambda>\<phi>. \<Psi> (\<phi> (AOT_term_of_var \<alpha>)))\<close>
+  | AOT_subst_fun_all[AOT_substI]:
+    \<open>AOT_subst \<Psi> \<Longrightarrow> (\<And> \<alpha> . AOT_subst_fun (\<Theta> (AOT_term_of_var \<alpha>))) \<Longrightarrow>
+     AOT_subst_fun (\<lambda>\<phi> :: 'a \<Rightarrow> 'b. \<Psi> \<guillemotleft>\<forall>\<alpha> \<guillemotleft>\<Theta> (\<alpha>::'a) \<phi>\<guillemotright>\<guillemotright>)\<close>
+  | AOT_subst_fun_not[AOT_substI]:
+    \<open>AOT_subst \<Psi> \<Longrightarrow> AOT_subst_fun (\<lambda>\<phi>. \<guillemotleft>\<not>\<guillemotleft>\<Psi> \<phi>\<guillemotright>\<guillemotright>)\<close>
+  | AOT_subst_fun_imp[AOT_substI]:
+    \<open>AOT_subst \<Psi> \<Longrightarrow> AOT_subst \<Theta> \<Longrightarrow> AOT_subst_fun (\<lambda>\<phi>. \<guillemotleft>\<guillemotleft>\<Psi> \<phi>\<guillemotright> \<rightarrow> \<guillemotleft>\<Theta> \<phi>\<guillemotright>\<guillemotright>)\<close>
+  | AOT_subst_fun_lambda0[AOT_substI]:
+    \<open>AOT_subst \<Theta> \<Longrightarrow> AOT_subst_fun (\<lambda> \<phi>. (AOT_lambda0 (\<Theta> \<phi>)))\<close>
+  | AOT_subst_fun_act[AOT_substI]:
+    \<open>AOT_subst \<Theta> \<Longrightarrow> AOT_subst_fun (\<lambda> \<phi>. \<guillemotleft>\<^bold>\<A>\<guillemotleft>\<Theta> \<phi>\<guillemotright>\<guillemotright>)\<close>
+  | AOT_subst_fun_box[AOT_substI]:
+    \<open>AOT_subst \<Theta> \<Longrightarrow> AOT_subst_fun (\<lambda> \<phi>. \<guillemotleft>\<box>\<guillemotleft>\<Theta> \<phi>\<guillemotright>\<guillemotright>)\<close>
+  | AOT_subst_fun_def[AOT_substI]:
+    \<open>(\<And> \<phi> . AOT_model_equiv_def (\<Theta> \<phi>) (\<Psi> \<phi>)) \<Longrightarrow>
+     AOT_subst_fun \<Psi> \<Longrightarrow> AOT_subst_fun \<Theta>\<close>
+
+instance proof
+  fix \<psi> \<chi> :: \<open>'a \<Rightarrow> 'b\<close> and \<phi> :: \<open>('a \<Rightarrow> 'b) \<Rightarrow> \<o>\<close>
+  assume \<open>AOT_subst \<phi>\<close>
+  moreover assume cond: \<open>AOT_subst_cond \<psi> \<chi>\<close>
+  ultimately AOT_show \<open>\<^bold>\<turnstile>\<^sub>\<box> \<guillemotleft>\<phi> \<psi>\<guillemotright> \<equiv> \<guillemotleft>\<phi> \<chi>\<guillemotright>\<close>
+  proof(induct)
+    case (AOT_subst_fun_const \<psi>)
+    then show ?case by (simp add: "oth-class-taut:3:a")
+  next
+  case (AOT_subst_fun_id \<Psi> x)
+  then show ?case by (simp add: AOT_subst AOT_subst_cond_fun_def) 
+  next
+  next
+  case (AOT_subst_fun_all \<Psi> \<Theta>)
+  AOT_have \<open>\<^bold>\<turnstile>\<^sub>\<box> \<box>(\<Theta>{\<alpha>, \<guillemotleft>\<psi>\<guillemotright>} \<equiv> \<Theta>{\<alpha>, \<guillemotleft>\<chi>\<guillemotright>})\<close> for \<alpha>
+    using AOT_subst_fun_all.hyps(3) AOT_subst_fun_all.prems RN by presburger
+  thus ?case using AOT_subst[OF AOT_subst_fun_all(1)]
+    by (simp add: RN "rule-sub-lem:1:d"
+                  AOT_subst_cond_fun_def AOT_subst_cond_\<o>_def)
+  next
+  case (AOT_subst_fun_not \<Psi>)
+  then show ?case by (simp add: RN "rule-sub-lem:1:a")
+  next
+  case (AOT_subst_fun_imp \<Psi> \<Theta>)
+  then show ?case 
+    unfolding AOT_subst_cond_fun_def AOT_subst_cond_\<o>_def
+    by (meson "\<equiv>E"(5) "oth-class-taut:4:c" "oth-class-taut:4:d" "\<rightarrow>E")
+  next
+  case (AOT_subst_fun_lambda0 \<Theta>)
+  then show ?case by (simp add: RN "rule-sub-lem:1:e")
+  next
+  case (AOT_subst_fun_act \<Theta>)
+  then show ?case by (simp add: RN "rule-sub-lem:1:f")
+  next
+  case (AOT_subst_fun_box \<Theta>)
+  then show ?case by (simp add: RN "rule-sub-lem:1:g")
+  next
+  case (AOT_subst_fun_def \<Theta> \<Psi>)
+  then show ?case
+    by (meson "df-rules-formulas[3]" "df-rules-formulas[4]" "\<equiv>I" "\<equiv>E"(5))
+  qed
+qed
+end
+
+ML\<open>
+fun prove_AOT_subst_tac ctxt = REPEAT (SUBGOAL (fn (trm,_) => let
+  fun findHeadConst (Const x) = SOME x
+    | findHeadConst (A $ _) = findHeadConst A
+    | findHeadConst _ = NONE
+  fun findDef (Const (\<^const_name>\<open>AOT_model_equiv_def\<close>, _) $ lhs $ _)
+      = findHeadConst lhs
+    | findDef (A $ B) = (case findDef A of SOME x => SOME x | _ => findDef B)
+    | findDef (Abs (_,_,c)) = findDef c
+    | findDef _ = NONE
+  val const_opt = (findDef trm)
+  val defs = case const_opt of SOME const => List.filter (fn thm => let
+      val concl = Thm.concl_of thm
+      val thmconst = (findDef concl)
+      in case thmconst of SOME (c,_) => fst const = c | _ => false end)
+      (AOT_Definitions.get ctxt)
+      | _ => []
+  val tac = case defs of
+            [] => safe_step_tac (ctxt addSIs @{thms AOT_substI}) 1
+            | _ => resolve_tac ctxt defs 1
+  in tac end) 1)
+fun getSubstThm ctxt reversed phi p q = let
+val p_ty = Term.type_of p
+val abs = HOLogic.mk_Trueprop (@{const AOT_subst(_)} $ phi)
+val abs = Syntax.check_term ctxt abs
+val substThm = Goal.prove ctxt [] [] abs
+  (fn {context=ctxt, prems=_} => prove_AOT_subst_tac ctxt)
+val substThm = substThm RS @{thm AOT_subst}
+in if reversed then let
+  val substThm = Drule.instantiate_normalize
+          (TVars.empty, Vars.make [((("\<chi>", 0), p_ty), Thm.cterm_of ctxt p),
+          ((("\<psi>", 0), p_ty), Thm.cterm_of ctxt q)]) substThm
+  val substThm = substThm RS @{thm "\<equiv>E"(1)}
+  in substThm end
+else
+  let
+  val substThm = Drule.instantiate_normalize
+          (TVars.empty, Vars.make [((("\<psi>", 0), p_ty), Thm.cterm_of ctxt p),
+          ((("\<chi>", 0), p_ty), Thm.cterm_of ctxt q)]) substThm
+  val substThm = substThm RS @{thm "\<equiv>E"(2)}
+  in substThm end end
+\<close>
+
+method_setup AOT_subst = \<open>
+Scan.option (Scan.lift (Args.parens (Args.$$$ "reverse"))) --
+Scan.lift (Parse.embedded_inner_syntax -- Parse.embedded_inner_syntax) --
+Scan.option (Scan.lift (Args.$$$ "for" -- Args.colon) |--
+Scan.repeat1 (Scan.lift (Parse.embedded_inner_syntax) --
+Scan.option (Scan.lift (Args.$$$ "::" |-- Parse.embedded_inner_syntax))))
+>> (fn ((reversed,(raw_p,raw_q)),raw_bounds) => (fn ctxt =>
+(Method.SIMPLE_METHOD (Subgoal.FOCUS (fn {context = ctxt, params = _,
+  prems = prems, asms = asms, concl = concl, schematics = _} =>
+let
+val thms = prems
+val ctxt' = ctxt
+val ctxt = Context_Position.set_visible false ctxt
+val raw_bounds = case raw_bounds of SOME bounds => bounds | _ => []
+
+val ctxt = (fold (fn (bound, ty) => fn ctxt =>
+  let
+    val bound = AOT_read_term @{nonterminal \<tau>'} ctxt bound
+    val ty = Option.map (Syntax.read_typ ctxt) ty
+    val ctxt = case ty of SOME ty => let
+        val bound = Const ("_type_constraint_", Type ("fun", [ty,ty])) $ bound
+        val bound = Syntax.check_term ctxt bound
+      in Variable.declare_term bound ctxt end | _ => ctxt
+  in ctxt end)) raw_bounds ctxt
+
+val p = AOT_read_term @{nonterminal \<phi>'} ctxt raw_p
+val p = Syntax.check_term ctxt p
+val ctxt = Variable.declare_term p ctxt
+val q = AOT_read_term @{nonterminal \<phi>'} ctxt raw_q
+val q = Syntax.check_term ctxt q
+val ctxt = Variable.declare_term q ctxt
+
+val bounds = (map (fn (bound, _) =>
+  Syntax.check_term ctxt (AOT_read_term @{nonterminal \<tau>'} ctxt bound)
+)) raw_bounds
+val p = fold (fn bound => fn p =>
+  Term.abs ("\<alpha>", Term.type_of bound) (Term.abstract_over (bound,p)))
+  bounds p
+val p = Syntax.check_term ctxt p
+val p_ty = Term.type_of p
+
+val pat = @{const Trueprop} $
+  (@{const AOT_model_valid_in} $ Var (("w",0), @{typ w}) $
+   (Var (("\<phi>",0), Type (\<^type_name>\<open>fun\<close>, [p_ty, @{typ \<o>}])) $ p))
+val univ = Unify.matchers (Context.Proof ctxt) [(pat, Thm.term_of concl)]
+val univ = hd (Seq.list_of univ) (* TODO: consider all matches *)
+val phi = the (Envir.lookup univ
+  (("\<phi>",0), Type (\<^type_name>\<open>fun\<close>, [p_ty, @{typ \<o>}])))
+
+val q = fold (fn bound => fn q =>
+  Term.abs ("\<alpha>", Term.type_of bound) (Term.abstract_over (bound,q))) bounds q
+val q = Syntax.check_term ctxt q
+
+(* Reparse to report bounds as fixes. *)
+val ctxt = Context_Position.restore_visible ctxt' ctxt
+val ctxt' = ctxt
+fun unsource str = fst (Input.source_content (Syntax.read_input str))
+val (_,ctxt') = Proof_Context.add_fixes (map (fn (str,_) =>
+  (Binding.make (unsource str, Position.none), NONE, Mixfix.NoSyn)) raw_bounds)
+  ctxt'
+val _ = (map (fn (x,_) =>
+  Syntax.check_term ctxt (AOT_read_term @{nonterminal \<tau>'} ctxt' x)))
+  raw_bounds
+val _ = AOT_read_term @{nonterminal \<phi>'} ctxt' raw_p
+val _ = AOT_read_term @{nonterminal \<phi>'} ctxt' raw_q
+val reversed = case reversed of SOME _ => true | _ => false
+val simpThms = [@{thm AOT_subst_cond_\<o>_def}, @{thm AOT_subst_cond_fun_def}]
+in
+resolve_tac ctxt [getSubstThm ctxt reversed phi p q] 1
+THEN simp_tac (ctxt addsimps simpThms) 1
+THEN (REPEAT (resolve_tac ctxt [@{thm allI}] 1))
+THEN (TRY (resolve_tac ctxt thms 1))
+end
+) ctxt 1))))
+\<close>
+
+method_setup AOT_subst_def = \<open>
+Scan.option (Scan.lift (Args.parens (Args.$$$ "reverse"))) --
+Attrib.thm
+>> (fn (reversed,fact) => (fn ctxt =>
+(Method.SIMPLE_METHOD (Subgoal.FOCUS (fn {context = ctxt, params = _,
+  prems = prems, asms = asms, concl = concl, schematics = _} =>
+let
+val c = Thm.concl_of fact
+val (lhs, rhs) = case c of (\<^const>\<open>Trueprop\<close> $
+    (\<^const>\<open>AOT_model_equiv_def\<close> $ lhs $ rhs)) => (lhs, rhs)
+  | _ => raise Fail "Definition expected."
+val substCond = HOLogic.mk_Trueprop
+  (Const (\<^const_name>\<open>AOT_subst_cond\<close>, dummyT) $ lhs $ rhs)
+val substCond = Syntax.check_term
+  (Proof_Context.set_mode Proof_Context.mode_schematic ctxt)
+  substCond
+val simpThms = [@{thm AOT_subst_cond_\<o>_def},
+  @{thm AOT_subst_cond_fun_def},
+  fact RS @{thm "\<equiv>Df"}]
+val substCondThm = Goal.prove ctxt [] [] substCond
+  (fn {context=ctxt, prems=prems} =>
+      (SUBGOAL (fn (trm,int) =>
+        auto_tac (ctxt addsimps simpThms)) 1))
+val substThm = substCondThm RSN (2,@{thm AOT_subst})
+in
+resolve_tac ctxt [substThm RS
+  (case reversed of NONE => @{thm "\<equiv>E"(2)} | _ => @{thm "\<equiv>E"(1)})] 1
+THEN prove_AOT_subst_tac ctxt
+THEN (TRY (resolve_tac ctxt prems 1))
+end
+) ctxt 1))))
+\<close>
+
+method_setup AOT_subst_thm = \<open>
+Scan.option (Scan.lift (Args.parens (Args.$$$ "reverse"))) --
+Attrib.thm
+>> (fn (reversed,fact) => (fn ctxt =>
+(Method.SIMPLE_METHOD (Subgoal.FOCUS (fn {context = ctxt, params = _,
+  prems = prems, asms = asms, concl = concl, schematics = _} =>
+let
+val c = Thm.concl_of fact
+val (lhs, rhs) = case c of
+  (\<^const>\<open>Trueprop\<close> $
+   (\<^const>\<open>AOT_model_valid_in\<close> $ _ $
+    (\<^const>\<open>AOT_equiv\<close> $ lhs $ rhs))) => (lhs, rhs)
+  | _ => raise Fail "Equivalence expected."
+
+val substCond = HOLogic.mk_Trueprop
+  (Const (\<^const_name>\<open>AOT_subst_cond\<close>, dummyT) $ lhs $ rhs)
+val substCond = Syntax.check_term
+  (Proof_Context.set_mode Proof_Context.mode_schematic ctxt)
+  substCond
+val simpThms = [@{thm AOT_subst_cond_\<o>_def},
+  @{thm AOT_subst_cond_fun_def},
+  fact]
+val substCondThm = Goal.prove ctxt [] [] substCond
+  (fn {context=ctxt, prems=prems} =>
+      (SUBGOAL (fn (trm,int) => auto_tac (ctxt addsimps simpThms)) 1))
+val substThm = substCondThm RSN (2,@{thm AOT_subst})
+in
+resolve_tac ctxt [substThm RS
+  (case reversed of NONE => @{thm "\<equiv>E"(2)} | _ => @{thm "\<equiv>E"(1)})] 1
+THEN prove_AOT_subst_tac ctxt
+THEN (TRY (resolve_tac ctxt prems 1))
+end
+) ctxt 1))))
+\<close>
+
+AOT_theorem "rule-sub-remark:1[1]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close> and \<open>\<not>A!x\<close>
+  shows \<open>\<not>\<not>\<diamond>E!x\<close>
+  by (AOT_subst (reverse) \<open>\<not>\<diamond>E!x\<close> \<open>A!x\<close>)
+     (auto simp: assms) 
+
+AOT_theorem "rule-sub-remark:1[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close> and  \<open>\<not>\<not>\<diamond>E!x\<close>
+  shows \<open>\<not>A!x\<close>
+  by (AOT_subst \<open>A!x\<close> \<open>\<not>\<diamond>E!x\<close>)
+     (auto simp: assms)
+
+AOT_theorem "rule-sub-remark:2[1]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> [R]xy \<equiv> ([R]xy & ([Q]a \<or> \<not>[Q]a))\<close>
+      and \<open>p \<rightarrow> [R]xy\<close>
+  shows \<open>p \<rightarrow> [R]xy & ([Q]a \<or> \<not>[Q]a)\<close>
+  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:2[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> [R]xy \<equiv> ([R]xy & ([Q]a \<or> \<not>[Q]a))\<close>
+      and \<open>p \<rightarrow> [R]xy & ([Q]a \<or> \<not>[Q]a)\<close>
+  shows \<open>p \<rightarrow> [R]xy\<close>
+  by (AOT_subst_thm assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:3[1]":
+  assumes \<open>for arbitrary x: \<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close>
+      and \<open>\<exists>x A!x\<close>
+    shows \<open>\<exists>x \<not>\<diamond>E!x\<close>
+  by (AOT_subst (reverse) \<open>\<not>\<diamond>E!x\<close> \<open>A!x\<close> for: x)
+     (auto simp: assms)
+
+AOT_theorem "rule-sub-remark:3[2]":
+  assumes \<open>for arbitrary x: \<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close>
+      and \<open>\<exists>x \<not>\<diamond>E!x\<close>
+    shows \<open>\<exists>x A!x\<close>
+  by (AOT_subst \<open>A!x\<close> \<open>\<not>\<diamond>E!x\<close> for: x)
+     (auto simp: assms)
+
+AOT_theorem "rule-sub-remark:4[1]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<not>[P]x \<equiv> [P]x\<close> and \<open>\<^bold>\<A>\<not>\<not>[P]x\<close>
+  shows \<open>\<^bold>\<A>[P]x\<close>
+  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:4[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<not>[P]x \<equiv> [P]x\<close> and \<open>\<^bold>\<A>[P]x\<close>
+  shows \<open>\<^bold>\<A>\<not>\<not>[P]x\<close>
+  by (AOT_subst_thm assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:5[1]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> (\<phi> \<rightarrow> \<psi>) \<equiv> (\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close> and \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
+  shows \<open>\<box>(\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close>
+  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:5[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> (\<phi> \<rightarrow> \<psi>) \<equiv> (\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close> and \<open>\<box>(\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close>
+  shows \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close> 
+  by (AOT_subst_thm assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:6[1]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<equiv> \<chi>\<close> and \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
+  shows \<open>\<box>(\<phi> \<rightarrow> \<chi>)\<close> 
+  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:6[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<equiv> \<chi>\<close> and \<open>\<box>(\<phi> \<rightarrow> \<chi>)\<close>
+  shows \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
+  by (AOT_subst_thm assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:7[1]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<not>\<not>\<phi>\<close> and \<open>\<box>(\<phi> \<rightarrow> \<phi>)\<close>
+  shows \<open>\<box>(\<not>\<not>\<phi> \<rightarrow> \<phi>)\<close> 
+  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))
+
+AOT_theorem "rule-sub-remark:7[2]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<not>\<not>\<phi>\<close> and \<open>\<box>(\<not>\<not>\<phi> \<rightarrow> \<phi>)\<close>
+  shows \<open>\<box>(\<phi> \<rightarrow> \<phi>)\<close>
+  by (AOT_subst_thm assms(1)) (simp add: assms(2))
+
+AOT_theorem "KBasic2:1": \<open>\<box>\<not>\<phi> \<equiv> \<not>\<diamond>\<phi>\<close>
+  by (meson "conventions:5" "contraposition:2"
+            "Hypothetical Syllogism" "df-rules-formulas[3]"
+            "df-rules-formulas[4]" "\<equiv>I" "useful-tautologies:1")
+
+AOT_theorem "KBasic2:2": \<open>\<diamond>(\<phi> \<or> \<psi>) \<equiv> (\<diamond>\<phi> \<or> \<diamond>\<psi>)\<close>
+proof -
+  AOT_have \<open>\<diamond>(\<phi> \<or> \<psi>) \<equiv> \<diamond>\<not>(\<not>\<phi> & \<not>\<psi>)\<close>
+    by (simp add: "RE\<diamond>" "oth-class-taut:5:b")
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<box>(\<not>\<phi> & \<not>\<psi>)\<close>
+    using "KBasic:11" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<not>(\<box>\<not>\<phi> & \<box>\<not>\<psi>)\<close>
+    using "KBasic:3" "\<equiv>E"(1) "oth-class-taut:4:b" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<not>(\<not>\<diamond>\<phi> & \<not>\<diamond>\<psi>)\<close>
+    using "KBasic2:1"
+    by (AOT_subst \<open>\<box>\<not>\<phi>\<close> \<open>\<not>\<diamond>\<phi>\<close>; AOT_subst \<open>\<box>\<not>\<psi>\<close> \<open>\<not>\<diamond>\<psi>\<close>;
+        auto simp: "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<not>(\<diamond>\<phi> \<or> \<diamond>\<psi>)\<close>
+    using "\<equiv>E"(6) "oth-class-taut:3:b" "oth-class-taut:5:b" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<phi> \<or> \<diamond>\<psi>\<close>
+    by (simp add: "\<equiv>I" "useful-tautologies:1" "useful-tautologies:2")
+  finally show ?thesis .
+qed
+
+AOT_theorem "KBasic2:3": \<open>\<diamond>(\<phi> & \<psi>) \<rightarrow> (\<diamond>\<phi> & \<diamond>\<psi>)\<close>
+  by (metis "RM\<diamond>" "&I" "Conjunction Simplification"(1,2)
+            "\<rightarrow>I" "modus-tollens:1" "reductio-aa:1")
+
+AOT_theorem "KBasic2:4": \<open>\<diamond>(\<phi> \<rightarrow> \<psi>) \<equiv> (\<box>\<phi> \<rightarrow> \<diamond>\<psi>)\<close>
+proof -
+  AOT_have \<open>\<diamond>(\<phi> \<rightarrow> \<psi>) \<equiv> \<diamond>(\<not>\<phi> \<or> \<psi>)\<close>
+    by (AOT_subst \<open>\<phi> \<rightarrow> \<psi>\<close> \<open>\<not>\<phi> \<or> \<psi>\<close>)
+       (auto simp: "oth-class-taut:1:c" "oth-class-taut:3:a")
+  also AOT_have \<open>... \<equiv> \<diamond>\<not>\<phi> \<or> \<diamond>\<psi>\<close>
+    by (simp add: "KBasic2:2")
+  also AOT_have \<open>... \<equiv> \<not>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
+    by (AOT_subst \<open>\<not>\<box>\<phi>\<close> \<open>\<diamond>\<not>\<phi>\<close>)
+       (auto simp: "KBasic:11" "oth-class-taut:3:a")
+  also AOT_have \<open>... \<equiv> \<box>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
+    using "\<equiv>E"(6) "oth-class-taut:1:c" "oth-class-taut:3:a" by blast
+  finally show ?thesis .
+qed
+
+AOT_theorem "KBasic2:5": \<open>\<diamond>\<diamond>\<phi> \<equiv> \<not>\<box>\<box>\<not>\<phi>\<close>
+  using "conventions:5"[THEN "\<equiv>Df"]
+  by (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>;
+      AOT_subst \<open>\<diamond>\<not>\<box>\<not>\<phi>\<close> \<open>\<not>\<box>\<not>\<not>\<box>\<not>\<phi>\<close>;
+      AOT_subst (reverse) \<open>\<not>\<not>\<box>\<not>\<phi>\<close> \<open>\<box>\<not>\<phi>\<close>)
+     (auto simp: "oth-class-taut:3:b" "oth-class-taut:3:a")
+
+
+AOT_theorem "KBasic2:6": \<open>\<box>(\<phi> \<or> \<psi>) \<rightarrow> (\<box>\<phi> \<or> \<diamond>\<psi>)\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<box>(\<phi> \<or> \<psi>)\<close>
+  AOT_hence \<open>\<box>(\<not>\<phi> \<rightarrow> \<psi>)\<close>
+    using "conventions:2"[THEN "\<equiv>Df"]
+    by (AOT_subst (reverse) \<open>\<not>\<phi> \<rightarrow> \<psi>\<close> \<open>\<phi> \<or> \<psi>\<close>) simp
+  AOT_hence 1: \<open>\<diamond>\<not>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
+    using "KBasic:13" "vdash-properties:10" by blast
+  AOT_assume \<open>\<not>(\<box>\<phi> \<or> \<diamond>\<psi>)\<close>
+  AOT_hence \<open>\<not>\<box>\<phi>\<close> and \<open>\<not>\<diamond>\<psi>\<close>
+    using "&E" "\<equiv>E"(1) "oth-class-taut:5:d" by blast+
+  AOT_thus \<open>\<diamond>\<psi> & \<not>\<diamond>\<psi>\<close>
+    using "&I"(1) 1[THEN "\<rightarrow>E"] "KBasic:11" "\<equiv>E"(4) "raa-cor:3" by blast
+qed
+
+AOT_theorem "KBasic2:7": \<open>(\<box>(\<phi> \<or> \<psi>) & \<diamond>\<not>\<phi>) \<rightarrow> \<diamond>\<psi>\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume \<open>\<box>(\<phi> \<or> \<psi>)\<close>
+  AOT_hence 1: \<open>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
+    using "KBasic2:6" "\<or>I"(2) "\<or>E"(1) by blast
+  AOT_assume \<open>\<diamond>\<not>\<phi>\<close>
+  AOT_hence \<open>\<not>\<box>\<phi>\<close> using "KBasic:11" "\<equiv>E"(2) by blast
+  AOT_thus \<open>\<diamond>\<psi>\<close> using 1 "\<or>E"(2) by blast
+qed
+
+AOT_theorem "T-S5-fund:1": \<open>\<phi> \<rightarrow> \<diamond>\<phi>\<close>
+  by (meson "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" "contraposition:2"
+            "Hypothetical Syllogism" "\<rightarrow>I" "qml:2"[axiom_inst])
+lemmas "T\<diamond>" = "T-S5-fund:1"
+
+AOT_theorem "T-S5-fund:2": \<open>\<diamond>\<box>\<phi> \<rightarrow> \<box>\<phi>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>\<box>\<phi>\<close>
+  AOT_hence \<open>\<not>\<box>\<diamond>\<not>\<phi>\<close>
+    using "KBasic:14" "\<equiv>E"(4) "raa-cor:3" by blast
+  moreover AOT_have \<open>\<diamond>\<not>\<phi> \<rightarrow> \<box>\<diamond>\<not>\<phi>\<close>
+    by (fact "qml:3"[axiom_inst])
+  ultimately AOT_have \<open>\<not>\<diamond>\<not>\<phi>\<close>
+    using "modus-tollens:1" by blast
+  AOT_thus \<open>\<box>\<phi>\<close> using "KBasic:12" "\<equiv>E"(2) by blast
+qed
+lemmas "5\<diamond>" = "T-S5-fund:2"
+
+AOT_theorem "Act-Sub:1": \<open>\<^bold>\<A>\<phi> \<equiv> \<not>\<^bold>\<A>\<not>\<phi>\<close>
+  by (AOT_subst \<open>\<^bold>\<A>\<not>\<phi>\<close> \<open>\<not>\<^bold>\<A>\<phi>\<close>)
+     (auto simp: "logic-actual-nec:1"[axiom_inst] "oth-class-taut:3:b")
+
+AOT_theorem "Act-Sub:2": \<open>\<diamond>\<phi> \<equiv> \<^bold>\<A>\<diamond>\<phi>\<close>
+  using "conventions:5"[THEN "\<equiv>Df"]
+  by (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>)
+     (metis "deduction-theorem" "\<equiv>I" "\<equiv>E"(1) "\<equiv>E"(2) "\<equiv>E"(3)
+            "logic-actual-nec:1"[axiom_inst] "qml-act:2"[axiom_inst])
+
+AOT_theorem "Act-Sub:3": \<open>\<^bold>\<A>\<phi> \<rightarrow> \<diamond>\<phi>\<close>
+  using "conventions:5"[THEN "\<equiv>Df"]
+  by (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>)
+     (metis "Act-Sub:1" "\<rightarrow>I" "\<equiv>E"(4) "nec-imp-act" "reductio-aa:2" "\<rightarrow>E")
+
+AOT_theorem "Act-Sub:4": \<open>\<^bold>\<A>\<phi> \<equiv> \<diamond>\<^bold>\<A>\<phi>\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<A>\<phi>\<close>
+  AOT_thus \<open>\<diamond>\<^bold>\<A>\<phi>\<close> using "T\<diamond>" "vdash-properties:10" by blast
+next
+  AOT_assume \<open>\<diamond>\<^bold>\<A>\<phi>\<close>
+  AOT_hence \<open>\<not>\<box>\<not>\<^bold>\<A>\<phi>\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" by blast
+  AOT_hence \<open>\<not>\<box>\<^bold>\<A>\<not>\<phi>\<close>
+    by (AOT_subst \<open>\<^bold>\<A>\<not>\<phi>\<close> \<open>\<not>\<^bold>\<A>\<phi>\<close>)
+       (simp add: "logic-actual-nec:1"[axiom_inst])
+  AOT_thus \<open>\<^bold>\<A>\<phi>\<close>
+    using "Act-Basic:1" "Act-Basic:6" "\<or>E"(3) "\<equiv>E"(4)
+          "reductio-aa:1" by blast
+qed
+
+AOT_theorem "Act-Sub:5": \<open>\<diamond>\<^bold>\<A>\<phi> \<rightarrow> \<^bold>\<A>\<diamond>\<phi>\<close>
+  by (metis "Act-Sub:2" "Act-Sub:3" "Act-Sub:4" "\<rightarrow>I" "\<equiv>E"(1) "\<equiv>E"(2) "\<rightarrow>E")
+
+AOT_theorem "S5Basic:1": \<open>\<diamond>\<phi> \<equiv> \<box>\<diamond>\<phi>\<close>
+  by (simp add: "\<equiv>I" "qml:2"[axiom_inst] "qml:3"[axiom_inst])
+
+AOT_theorem "S5Basic:2": \<open>\<box>\<phi> \<equiv> \<diamond>\<box>\<phi>\<close>
+  by (simp add: "T\<diamond>" "5\<diamond>" "\<equiv>I")
+
+AOT_theorem "S5Basic:3": \<open>\<phi> \<rightarrow> \<box>\<diamond>\<phi>\<close>
+  using "T\<diamond>" "Hypothetical Syllogism" "qml:3"[axiom_inst] by blast
+lemmas "B" = "S5Basic:3"
+
+AOT_theorem "S5Basic:4": \<open>\<diamond>\<box>\<phi> \<rightarrow> \<phi>\<close>
+  using "5\<diamond>" "Hypothetical Syllogism" "qml:2"[axiom_inst] by blast
+lemmas "B\<diamond>" = "S5Basic:4"
+
+AOT_theorem "S5Basic:5": \<open>\<box>\<phi> \<rightarrow> \<box>\<box>\<phi>\<close>
+  using "RM:1" "B" "5\<diamond>" "Hypothetical Syllogism" by blast
+lemmas "4" = "S5Basic:5"
+
+AOT_theorem "S5Basic:6": \<open>\<box>\<phi> \<equiv> \<box>\<box>\<phi>\<close>
+  by (simp add: "4" "\<equiv>I" "qml:2"[axiom_inst])
+
+AOT_theorem "S5Basic:7": \<open>\<diamond>\<diamond>\<phi> \<rightarrow> \<diamond>\<phi>\<close>
+  using "conventions:5"[THEN "\<equiv>Df"] "oth-class-taut:3:b"
+  by (AOT_subst \<open>\<diamond>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<diamond>\<phi>\<close>;
+      AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>;
+      AOT_subst (reverse) \<open>\<not>\<not>\<box>\<not>\<phi>\<close> \<open>\<box>\<not>\<phi>\<close>;
+      AOT_subst (reverse) \<open>\<box>\<box>\<not>\<phi>\<close> \<open>\<box>\<not>\<phi>\<close>)
+     (auto simp: "S5Basic:6" "if-p-then-p")
+
+lemmas "4\<diamond>" = "S5Basic:7"
+
+AOT_theorem "S5Basic:8": \<open>\<diamond>\<diamond>\<phi> \<equiv> \<diamond>\<phi>\<close>
+  by (simp add: "4\<diamond>" "T\<diamond>" "\<equiv>I")
+
+AOT_theorem "S5Basic:9": \<open>\<box>(\<phi> \<or> \<box>\<psi>) \<equiv> (\<box>\<phi> \<or> \<box>\<psi>)\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "KBasic2:6" "5\<diamond>" "\<or>I"(3) "if-p-then-p" "vdash-properties:10"
+   apply blast
+  by (meson "KBasic:15" "4" "\<or>I"(3) "\<or>E"(1) "Disjunction Addition"(1)
+            "con-dis-taut:7" "intro-elim:1" "Commutativity of \<or>")
+
+AOT_theorem "S5Basic:10": \<open>\<box>(\<phi> \<or> \<diamond>\<psi>) \<equiv> (\<box>\<phi> \<or> \<diamond>\<psi>)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>(\<phi> \<or> \<diamond>\<psi>)\<close>
+  AOT_hence \<open>\<box>\<phi> \<or> \<diamond>\<diamond>\<psi>\<close>
+    by (meson "KBasic2:6" "\<or>I"(2) "\<or>E"(1))
+  AOT_thus \<open>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
+    by (meson "B\<diamond>" "4" "4\<diamond>" "T\<diamond>" "\<or>I"(3))
+next
+  AOT_assume \<open>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
+  AOT_hence \<open>\<box>\<phi> \<or> \<box>\<diamond>\<psi>\<close>
+    by (meson "S5Basic:1" "B\<diamond>" "S5Basic:6" "T\<diamond>" "5\<diamond>" "\<or>I"(3) "intro-elim:1")
+  AOT_thus \<open>\<box>(\<phi> \<or> \<diamond>\<psi>)\<close>
+    by (meson "KBasic:15" "\<or>I"(3) "\<or>E"(1) "Disjunction Addition"(1,2))
+qed
+
+AOT_theorem "S5Basic:11": \<open>\<diamond>(\<phi> & \<diamond>\<psi>) \<equiv> (\<diamond>\<phi> & \<diamond>\<psi>)\<close>
+proof -
+  AOT_have \<open>\<diamond>(\<phi> & \<diamond>\<psi>) \<equiv> \<diamond>\<not>(\<not>\<phi> \<or> \<not>\<diamond>\<psi>)\<close>
+    by (AOT_subst \<open>\<phi> & \<diamond>\<psi>\<close> \<open>\<not>(\<not>\<phi> \<or> \<not>\<diamond>\<psi>)\<close>)
+       (auto simp: "oth-class-taut:5:a" "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<not>(\<not>\<phi> \<or> \<box>\<not>\<psi>)\<close>
+    by (AOT_subst \<open>\<box>\<not>\<psi>\<close> \<open>\<not>\<diamond>\<psi>\<close>)
+       (auto simp: "KBasic2:1" "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<box>(\<not>\<phi> \<or> \<box>\<not>\<psi>)\<close>
+    using "KBasic:11" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<not>(\<box>\<not>\<phi> \<or> \<box>\<not>\<psi>)\<close>
+    using "S5Basic:9" "\<equiv>E"(1) "oth-class-taut:4:b" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<not>(\<not>\<diamond>\<phi> \<or> \<not>\<diamond>\<psi>)\<close>
+    using "KBasic2:1"
+    by (AOT_subst \<open>\<box>\<not>\<phi>\<close> \<open>\<not>\<diamond>\<phi>\<close>; AOT_subst \<open>\<box>\<not>\<psi>\<close> \<open>\<not>\<diamond>\<psi>\<close>)
+       (auto simp:  "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<phi> & \<diamond>\<psi>\<close>
+    using "\<equiv>E"(6) "oth-class-taut:3:a" "oth-class-taut:5:a" by blast
+  finally show ?thesis .
+qed
+
+AOT_theorem "S5Basic:12": \<open>\<diamond>(\<phi> & \<box>\<psi>) \<equiv> (\<diamond>\<phi> & \<box>\<psi>)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>(\<phi> & \<box>\<psi>)\<close>
+  AOT_hence \<open>\<diamond>\<phi> & \<diamond>\<box>\<psi>\<close>
+    using "KBasic2:3" "vdash-properties:6" by blast
+  AOT_thus \<open>\<diamond>\<phi> & \<box>\<psi>\<close>
+    using "5\<diamond>" "&I" "&E"(1) "&E"(2) "vdash-properties:6" by blast
+next
+  AOT_assume \<open>\<diamond>\<phi> & \<box>\<psi>\<close>
+  moreover AOT_have \<open>(\<box>\<box>\<psi> & \<diamond>\<phi>) \<rightarrow> \<diamond>(\<phi> & \<box>\<psi>)\<close>
+    by (AOT_subst \<open>\<phi> & \<box>\<psi>\<close> \<open>\<box>\<psi> & \<phi>\<close>)
+       (auto simp: "Commutativity of &" "KBasic:16")
+  ultimately AOT_show \<open>\<diamond>(\<phi> & \<box>\<psi>)\<close>
+    by (metis "4" "&I" "Conjunction Simplification"(1,2) "\<rightarrow>E")
+qed
+
+AOT_theorem "S5Basic:13": \<open>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<equiv> \<box>(\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
+proof (rule "\<equiv>I")
+  AOT_modally_strict {
+    AOT_have \<open>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> (\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
+      by (meson "KBasic:13" "B\<diamond>" "Hypothetical Syllogism" "\<rightarrow>I")
+  }
+  AOT_hence \<open>\<box>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> \<box>(\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
+    by (rule RM)
+  AOT_thus  \<open>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> \<box>(\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
+    using "4" "Hypothetical Syllogism" by blast
+next
+  AOT_modally_strict {
+    AOT_have \<open>\<box>(\<diamond>\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<phi> \<rightarrow> \<box>\<psi>)\<close>
+      by (meson "B" "Hypothetical Syllogism" "\<rightarrow>I" "qml:1"[axiom_inst])
+  }
+  AOT_hence  \<open>\<box>\<box>(\<diamond>\<phi> \<rightarrow> \<psi>) \<rightarrow> \<box>(\<phi> \<rightarrow> \<box>\<psi>)\<close>
+    by (rule RM)
+  AOT_thus \<open>\<box>(\<diamond>\<phi> \<rightarrow> \<psi>) \<rightarrow> \<box>(\<phi> \<rightarrow> \<box>\<psi>)\<close>
+    using "4" "Hypothetical Syllogism" by blast
+qed
+
+AOT_theorem "derived-S5-rules:1":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<psi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<box>\<psi>\<close>
+proof -
+  AOT_have \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<diamond>\<phi> \<rightarrow> \<box>\<psi>\<close>
+    using assms by (rule "RM:1[prem]")
+  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<box>\<psi>\<close>
+    using "B" "Hypothetical Syllogism" by blast
+qed
+
+AOT_theorem "derived-S5-rules:2":
+  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<box>\<psi>\<close>
+  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<psi>\<close>
+proof -
+  AOT_have \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<box>\<psi>\<close>
+    using assms by (rule "RM:2[prem]")
+  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<psi>\<close>
+    using "B\<diamond>" "Hypothetical Syllogism" by blast
+qed
+
+AOT_theorem "BFs:1": \<open>\<forall>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<box>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
+proof -
+  AOT_modally_strict {
+    AOT_have \<open>\<diamond>\<forall>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<diamond>\<box>\<phi>{\<alpha>}\<close> for \<alpha>
+      using "cqt-orig:3" by (rule "RM\<diamond>")
+    AOT_hence \<open>\<diamond>\<forall>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<phi>{\<alpha>}\<close>
+      using "B\<diamond>" "\<forall>I" "\<rightarrow>E" "\<rightarrow>I" by metis
+  }
+  thus ?thesis
+    using "derived-S5-rules:1" by blast
+qed
+lemmas "BF" = "BFs:1"
+
+AOT_theorem "BFs:2": \<open>\<box>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<box>\<phi>{\<alpha>}\<close>
+proof -
+  AOT_have \<open>\<box>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>}\<close> for \<alpha>
+    using RM "cqt-orig:3" by metis
+  thus ?thesis
+    using "cqt-orig:2"[THEN "\<rightarrow>E"] "\<forall>I" by metis
+qed
+lemmas "CBF" = "BFs:2"
+
+AOT_theorem "BFs:3": \<open>\<diamond>\<exists>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<exists>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
+proof(rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_have \<open>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>} \<equiv> \<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close>
+      using BF CBF "\<equiv>I" by blast
+  } note \<theta> = this
+
+  AOT_assume \<open>\<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  AOT_hence \<open>\<not>\<box>\<not>(\<exists>\<alpha> \<phi>{\<alpha>})\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" by blast
+  AOT_hence \<open>\<not>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+    apply (AOT_subst \<open>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close> \<open>\<not>(\<exists>\<alpha> \<phi>{\<alpha>})\<close>)
+    using "\<equiv>\<^sub>d\<^sub>fI" "conventions:3" "conventions:4" "&I"
+          "contraposition:2" "cqt-further:4"
+          "df-rules-formulas[3]" by blast
+  AOT_hence \<open>\<not>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close>
+    apply (AOT_subst (reverse) \<open>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close> \<open>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>)
+    using \<theta> by blast
+  AOT_hence \<open>\<not>\<forall>\<alpha> \<not>\<not>\<box>\<not>\<phi>{\<alpha>}\<close>
+    by (AOT_subst (reverse) \<open>\<not>\<not>\<box>\<not>\<phi>{\<alpha>}\<close> \<open>\<box>\<not>\<phi>{\<alpha>}\<close> for: \<alpha>)
+       (simp add: "oth-class-taut:3:b")
+  AOT_hence \<open>\<exists>\<alpha> \<not>\<box>\<not>\<phi>{\<alpha>}\<close>
+    by (rule "conventions:4"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_thus \<open>\<exists>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
+    using "conventions:5"[THEN "\<equiv>Df"]
+    by (AOT_subst \<open>\<diamond>\<phi>{\<alpha>}\<close> \<open>\<not>\<box>\<not>\<phi>{\<alpha>}\<close> for: \<alpha>)
+qed
+lemmas "BF\<diamond>" = "BFs:3"
+
+AOT_theorem "BFs:4": \<open>\<exists>\<alpha> \<diamond>\<phi>{\<alpha>} \<rightarrow> \<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
+  AOT_hence \<open>\<not>\<forall>\<alpha> \<not>\<diamond>\<phi>{\<alpha>}\<close>
+    using "conventions:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence \<open>\<not>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close>
+    using "KBasic2:1"
+    by (AOT_subst \<open>\<box>\<not>\<phi>{\<alpha>}\<close> \<open>\<not>\<diamond>\<phi>{\<alpha>}\<close> for: \<alpha>)
+  moreover AOT_have \<open>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>} \<equiv> \<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+    using "\<equiv>I" "BF" "CBF" by metis
+  ultimately AOT_have 1: \<open>\<not>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+    using "\<equiv>E"(3) by blast
+  AOT_show \<open>\<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+    apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    apply (AOT_subst \<open>\<exists>\<alpha> \<phi>{\<alpha>}\<close> \<open>\<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>)
+     apply (simp add: "conventions:4" "\<equiv>Df")
+    apply (AOT_subst \<open>\<not>\<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close> \<open>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>)
+    by (auto simp: 1 "\<equiv>I" "useful-tautologies:1" "useful-tautologies:2")
+qed
+lemmas "CBF\<diamond>" = "BFs:4"
+
+AOT_theorem "sign-S5-thm:1": \<open>\<exists>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>\<alpha> \<box>\<phi>{\<alpha>}\<close>
+  then AOT_obtain \<alpha> where \<open>\<box>\<phi>{\<alpha>}\<close> using "\<exists>E" by metis
+  moreover AOT_have \<open>\<box>\<alpha>\<down>\<close>
+    by (simp add: "ex:1:a" "rule-ui:2[const_var]" RN)
+  moreover AOT_have \<open>\<box>\<phi>{\<tau>}, \<box>\<tau>\<down> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close> for \<tau>
+  proof -
+    AOT_have \<open>\<phi>{\<tau>}, \<tau>\<down> \<^bold>\<turnstile>\<^sub>\<box> \<exists>\<alpha> \<phi>{\<alpha>}\<close> using "existential:1" by blast
+    AOT_thus \<open>\<box>\<phi>{\<tau>}, \<box>\<tau>\<down> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+      using "RN[prem]"[where \<Gamma>="{\<phi> \<tau>, \<guillemotleft>\<tau>\<down>\<guillemotright>}", simplified] by blast
+  qed
+  ultimately AOT_show \<open>\<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close> by blast
+qed
+lemmas Buridan = "sign-S5-thm:1"
+
+AOT_theorem "sign-S5-thm:2": \<open>\<diamond>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
+proof -
+  AOT_have \<open>\<forall>\<alpha> (\<diamond>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<diamond>\<phi>{\<alpha>})\<close>
+    by (simp add: "RM\<diamond>" "cqt-orig:3" "\<forall>I")
+  AOT_thus \<open>\<diamond>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
+    using "\<forall>E"(4) "\<forall>I" "\<rightarrow>E" "\<rightarrow>I" by metis
+qed
+lemmas "Buridan\<diamond>" = "sign-S5-thm:2"
+
+AOT_theorem "sign-S5-thm:3":
+  \<open>\<diamond>\<exists>\<alpha> (\<phi>{\<alpha>} & \<psi>{\<alpha>}) \<rightarrow> \<diamond>(\<exists>\<alpha> \<phi>{\<alpha>} & \<exists>\<alpha> \<psi>{\<alpha>})\<close>
+  apply (rule "RM:2")
+  by (metis (no_types, lifting) "\<exists>E" "&I" "&E"(1) "&E"(2) "\<rightarrow>I" "\<exists>I"(2))
+
+AOT_theorem "sign-S5-thm:4": \<open>\<diamond>\<exists>\<alpha> (\<phi>{\<alpha>} & \<psi>{\<alpha>}) \<rightarrow> \<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
+  apply (rule "RM:2")
+  by (meson "instantiation" "&E"(1) "\<rightarrow>I" "\<exists>I"(2))
+
+AOT_theorem "sign-S5-thm:5":
+  \<open>(\<box>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) & \<box>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})) \<rightarrow> \<box>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})\<close>
+proof -
+  {
+    fix \<phi>' \<psi>' \<chi>'
+    AOT_assume \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>' & \<psi>' \<rightarrow> \<chi>'\<close>
+    AOT_hence \<open>\<box>\<phi>' & \<box>\<psi>' \<rightarrow> \<box>\<chi>'\<close>
+      using "RN[prem]"[where \<Gamma>="{\<phi>', \<psi>'}"] apply simp
+      using "&E" "&I" "\<rightarrow>E" "\<rightarrow>I" by metis
+  } note R = this
+  show ?thesis by (rule R; fact AOT)
+qed
+
+AOT_theorem "sign-S5-thm:6":
+  \<open>(\<box>\<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) & \<box>\<forall>\<alpha>(\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>})) \<rightarrow> \<box>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<chi>{\<alpha>})\<close>
+proof -
+  {
+    fix \<phi>' \<psi>' \<chi>'
+    AOT_assume \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>' & \<psi>' \<rightarrow> \<chi>'\<close>
+    AOT_hence \<open>\<box>\<phi>' & \<box>\<psi>' \<rightarrow> \<box>\<chi>'\<close>
+      using "RN[prem]"[where \<Gamma>="{\<phi>', \<psi>'}"] apply simp
+      using "&E" "&I" "\<rightarrow>E" "\<rightarrow>I" by metis
+  } note R = this
+  show ?thesis by (rule R; fact AOT)
+qed
+
+AOT_theorem "exist-nec2:1": \<open>\<diamond>\<tau>\<down> \<rightarrow> \<tau>\<down>\<close>
+  using "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" "exist-nec" by blast
+
+AOT_theorem "exists-nec2:2": \<open>\<diamond>\<tau>\<down> \<equiv> \<box>\<tau>\<down>\<close>
+  by (meson "Act-Sub:3" "Hypothetical Syllogism" "exist-nec"
+            "exist-nec2:1" "\<equiv>I" "nec-imp-act")
+
+AOT_theorem "exists-nec2:3": \<open>\<not>\<tau>\<down> \<rightarrow> \<box>\<not>\<tau>\<down>\<close>
+  using "KBasic2:1" "\<rightarrow>I" "exist-nec2:1" "\<equiv>E"(2) "modus-tollens:1" by blast
+
+AOT_theorem "exists-nec2:4": \<open>\<diamond>\<not>\<tau>\<down> \<equiv> \<box>\<not>\<tau>\<down>\<close>
+  by (metis "Act-Sub:3" "KBasic:12" "\<rightarrow>I" "exist-nec" "exists-nec2:3"
+            "\<equiv>I" "\<equiv>E"(4) "nec-imp-act" "reductio-aa:1")
+
+AOT_theorem "id-nec2:1": \<open>\<diamond>\<alpha> = \<beta> \<rightarrow> \<alpha> = \<beta>\<close>
+  using "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" "id-nec:1" by blast
+
+AOT_theorem "id-nec2:2": \<open>\<alpha> \<noteq> \<beta> \<rightarrow> \<box>\<alpha> \<noteq> \<beta>\<close>
+  apply (AOT_subst \<open>\<alpha> \<noteq> \<beta>\<close> \<open>\<not>(\<alpha> = \<beta>)\<close>)
+  using "=-infix"[THEN "\<equiv>Df"] apply blast
+  using "KBasic2:1" "\<rightarrow>I" "id-nec2:1" "\<equiv>E"(2) "modus-tollens:1" by blast
+
+AOT_theorem "id-nec2:3": \<open>\<diamond>\<alpha> \<noteq> \<beta> \<rightarrow> \<alpha> \<noteq> \<beta>\<close>
+  apply (AOT_subst \<open>\<alpha> \<noteq> \<beta>\<close> \<open>\<not>(\<alpha> = \<beta>)\<close>)
+  using "=-infix"[THEN "\<equiv>Df"] apply blast
+  by (metis "KBasic:11" "\<rightarrow>I" "id-nec:2" "\<equiv>E"(3) "reductio-aa:2" "\<rightarrow>E")
+
+AOT_theorem "id-nec2:4": \<open>\<diamond>\<alpha> = \<beta> \<rightarrow> \<box>\<alpha> = \<beta>\<close>
+  using "Hypothetical Syllogism" "id-nec2:1" "id-nec:1" by blast
+
+AOT_theorem "id-nec2:5": \<open>\<diamond>\<alpha> \<noteq> \<beta> \<rightarrow> \<box>\<alpha> \<noteq> \<beta>\<close>
+  using "id-nec2:3" "id-nec2:2" "\<rightarrow>I" "\<rightarrow>E" by metis
+
+AOT_theorem "sc-eq-box-box:1": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<equiv> (\<diamond>\<phi> \<rightarrow> \<box>\<phi>)\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "KBasic:13" "5\<diamond>" "Hypothetical Syllogism" "\<rightarrow>E" apply blast
+  by (metis "KBasic2:1" "KBasic:1" "KBasic:2" "S5Basic:13" "\<equiv>E"(2)
+            "raa-cor:5" "\<rightarrow>E")
+
+AOT_theorem "sc-eq-box-box:2": \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<or> (\<diamond>\<phi> \<rightarrow> \<box>\<phi>)) \<rightarrow> (\<diamond>\<phi> \<equiv> \<box>\<phi>)\<close>
+  by (metis "Act-Sub:3" "KBasic:13" "5\<diamond>" "\<or>E"(2) "\<rightarrow>I" "\<equiv>I"
+            "nec-imp-act" "raa-cor:2" "\<rightarrow>E")
+
+AOT_theorem "sc-eq-box-box:3": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> (\<not>\<box>\<phi> \<equiv> \<box>\<not>\<phi>)\<close>
+proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
+  AOT_hence \<open>\<diamond>\<phi> \<rightarrow> \<box>\<phi>\<close> using "sc-eq-box-box:1" "\<equiv>E" by blast
+  moreover AOT_assume \<open>\<not>\<box>\<phi>\<close>
+  ultimately AOT_have \<open>\<not>\<diamond>\<phi>\<close>
+    using "modus-tollens:1" by blast
+  AOT_thus \<open>\<box>\<not>\<phi>\<close>
+    using "KBasic2:1" "\<equiv>E"(2) by blast
+next
+  AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
+  moreover AOT_assume \<open>\<box>\<not>\<phi>\<close>
+  ultimately AOT_show \<open>\<not>\<box>\<phi>\<close>
+    using "modus-tollens:1" "qml:2"[axiom_inst] "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "sc-eq-box-box:4":
+  \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)) \<rightarrow> ((\<box>\<phi> \<equiv> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
+proof(rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume \<theta>: \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)\<close>
+  AOT_assume \<xi>: \<open>\<box>\<phi> \<equiv> \<box>\<psi>\<close>
+  AOT_hence \<open>(\<box>\<phi> & \<box>\<psi>) \<or> (\<not>\<box>\<phi> & \<not>\<box>\<psi>)\<close>
+    using "\<equiv>E"(4) "oth-class-taut:4:g" "raa-cor:3" by blast
+  moreover {
+    AOT_assume \<open>\<box>\<phi> & \<box>\<psi>\<close>
+    AOT_hence \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
+      using "KBasic:3" "KBasic:8" "\<equiv>E"(2) "vdash-properties:10" by blast
+  }
+  moreover {
+    AOT_assume \<open>\<not>\<box>\<phi> & \<not>\<box>\<psi>\<close>
+    moreover AOT_have \<open>\<not>\<box>\<phi> \<equiv> \<box>\<not>\<phi>\<close> and \<open>\<not>\<box>\<psi> \<equiv> \<box>\<not>\<psi>\<close>
+      using \<theta> "Conjunction Simplification"(1,2)
+            "sc-eq-box-box:3" "\<rightarrow>E" by metis+
+    ultimately AOT_have \<open>\<box>\<not>\<phi> & \<box>\<not>\<psi>\<close>
+      by (metis "&I" "Conjunction Simplification"(1,2)
+                "\<equiv>E"(4) "modus-tollens:1" "raa-cor:3")
+    AOT_hence \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
+      using "KBasic:3" "KBasic:9" "\<equiv>E"(2) "\<rightarrow>E" by blast
+  }
+  ultimately AOT_show \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
+    using "\<or>E"(2) "reductio-aa:1" by blast
+qed
+
+AOT_theorem "sc-eq-box-box:5":
+  \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)) \<rightarrow> \<box>((\<phi> \<equiv> \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>))\<close>
+  AOT_hence \<open>\<box>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>))\<close>
+    using 4[THEN "\<rightarrow>E"] "&E" "&I" "KBasic:3" "\<equiv>E"(2) by metis
+  moreover AOT_have \<open>\<box>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)) \<rightarrow> \<box>((\<phi> \<equiv> \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
+  proof (rule RM; rule "\<rightarrow>I"; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      AOT_assume A: \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>))\<close>
+      AOT_hence \<open>\<phi> \<rightarrow> \<box>\<phi>\<close> and \<open>\<psi> \<rightarrow> \<box>\<psi>\<close>
+        using "&E" "qml:2"[axiom_inst] "\<rightarrow>E" by blast+
+      moreover AOT_assume \<open>\<phi> \<equiv> \<psi>\<close>
+      ultimately AOT_have \<open>\<box>\<phi> \<equiv> \<box>\<psi>\<close>
+        using "\<rightarrow>E" "qml:2"[axiom_inst] "\<equiv>E" "\<equiv>I" by meson
+      moreover AOT_have \<open>(\<box>\<phi> \<equiv> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
+        using A "sc-eq-box-box:4" "\<rightarrow>E" by blast
+      ultimately AOT_show \<open>\<box>(\<phi> \<equiv> \<psi>)\<close> using "\<rightarrow>E" by blast
+    }
+  qed
+  ultimately AOT_show \<open>\<box>((\<phi> \<equiv> \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close> using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "sc-eq-box-box:6": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> ((\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<rightarrow> \<psi>))\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
+  AOT_hence \<open>\<diamond>\<not>(\<phi> \<rightarrow> \<psi>)\<close>
+    by (metis "KBasic:11" "\<equiv>E"(1))
+  AOT_hence \<open>\<diamond>(\<phi> & \<not>\<psi>)\<close>
+    by (AOT_subst \<open>\<phi> & \<not>\<psi>\<close> \<open>\<not>(\<phi> \<rightarrow> \<psi>)\<close>)
+       (meson "Commutativity of \<equiv>" "\<equiv>E"(1) "oth-class-taut:1:b")
+  AOT_hence \<open>\<diamond>\<phi>\<close> and 2: \<open>\<diamond>\<not>\<psi>\<close>
+    using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" by blast+
+  moreover AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
+  ultimately AOT_have \<open>\<box>\<phi>\<close>
+    by (metis "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E")
+  AOT_hence \<phi>
+    using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  moreover AOT_assume \<open>\<phi> \<rightarrow> \<box>\<psi>\<close>
+  ultimately AOT_have \<open>\<box>\<psi>\<close>
+    using "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<not>\<box>\<psi>\<close>
+    using 2 "KBasic:12" "\<not>\<not>I" "intro-elim:3:d" by blast
+  ultimately AOT_show \<open>\<box>\<psi> & \<not>\<box>\<psi>\<close>
+    using "&I" by blast
+qed
+
+AOT_theorem "sc-eq-box-box:7": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> ((\<phi> \<rightarrow> \<^bold>\<A>\<psi>) \<rightarrow> \<^bold>\<A>(\<phi> \<rightarrow> \<psi>))\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>)\<close>
+  AOT_hence \<open>\<^bold>\<A>\<not>(\<phi> \<rightarrow> \<psi>)\<close>
+    by (metis "Act-Basic:1" "\<or>E"(2))
+  AOT_hence \<open>\<^bold>\<A>(\<phi> & \<not>\<psi>)\<close>
+    by (AOT_subst \<open>\<phi> & \<not>\<psi>\<close> \<open>\<not>(\<phi> \<rightarrow> \<psi>)\<close>)
+       (meson "Commutativity of \<equiv>" "\<equiv>E"(1) "oth-class-taut:1:b")
+  AOT_hence \<open>\<^bold>\<A>\<phi>\<close> and 2: \<open>\<^bold>\<A>\<not>\<psi>\<close>
+    using "Act-Basic:2"[THEN "\<equiv>E"(1)] "&E" by blast+
+  AOT_hence \<open>\<diamond>\<phi>\<close>
+    by (metis "Act-Sub:3" "\<rightarrow>E")
+  moreover AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
+  ultimately AOT_have \<open>\<box>\<phi>\<close>
+    by (metis "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E")
+  AOT_hence \<phi>
+    using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  moreover AOT_assume \<open>\<phi> \<rightarrow> \<^bold>\<A>\<psi>\<close>
+  ultimately AOT_have \<open>\<^bold>\<A>\<psi>\<close>
+    using "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<not>\<^bold>\<A>\<psi>\<close>
+    using 2 by (meson "Act-Sub:1" "\<equiv>E"(4) "raa-cor:3")
+  ultimately AOT_show \<open>\<^bold>\<A>\<psi> & \<not>\<^bold>\<A>\<psi>\<close>
+    using "&I" by blast
+qed
+
+AOT_theorem "sc-eq-fur:1": \<open>\<diamond>\<^bold>\<A>\<phi> \<equiv> \<box>\<^bold>\<A>\<phi>\<close>
+  using "Act-Basic:6" "Act-Sub:4" "\<equiv>E"(6) by blast
+
+AOT_theorem "sc-eq-fur:2": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> (\<^bold>\<A>\<phi> \<equiv> \<phi>)\<close>
+  by (metis "B\<diamond>" "Act-Sub:3" "KBasic:13" "T\<diamond>" "Hypothetical Syllogism"
+            "\<rightarrow>I" "\<equiv>I" "nec-imp-act")
+
+AOT_theorem "sc-eq-fur:3":
+  \<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x}) \<rightarrow> (\<exists>!x \<phi>{x} \<rightarrow> \<^bold>\<iota>x \<phi>{x}\<down>)\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
+  AOT_hence A: \<open>\<forall>x \<box>(\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
+    using CBF "\<rightarrow>E" by blast
+  AOT_assume \<open>\<exists>!x \<phi>{x}\<close>
+  then AOT_obtain a where a_def: \<open>\<phi>{a} & \<forall>y (\<phi>{y} \<rightarrow> y = a)\<close>
+    using "\<exists>E"[rotated 1, OF "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"]] by blast
+  moreover AOT_have \<open>\<box>\<phi>{a}\<close>
+    using calculation A "\<forall>E"(2) "qml:2"[axiom_inst] "\<rightarrow>E" "&E"(1) by blast
+  AOT_hence \<open>\<^bold>\<A>\<phi>{a}\<close>
+    using "nec-imp-act" "\<rightarrow>E" by blast
+  moreover AOT_have \<open>\<forall>y (\<^bold>\<A>\<phi>{y} \<rightarrow> y = a)\<close>
+  proof (rule "\<forall>I"; rule "\<rightarrow>I")
+    fix b
+    AOT_assume \<open>\<^bold>\<A>\<phi>{b}\<close>
+    AOT_hence \<open>\<diamond>\<phi>{b}\<close>
+      using "Act-Sub:3" "\<rightarrow>E" by blast
+    moreover {
+      AOT_have \<open>\<box>(\<phi>{b} \<rightarrow> \<box>\<phi>{b})\<close>
+        using A "\<forall>E"(2) by blast
+      AOT_hence \<open>\<diamond>\<phi>{b} \<rightarrow> \<box>\<phi>{b}\<close>
+        using "KBasic:13" "5\<diamond>" "Hypothetical Syllogism" "\<rightarrow>E" by blast
+    }
+    ultimately AOT_have \<open>\<box>\<phi>{b}\<close>
+      using "\<rightarrow>E" by blast
+    AOT_hence \<open>\<phi>{b}\<close>
+      using "qml:2"[axiom_inst] "\<rightarrow>E" by blast
+    AOT_thus \<open>b = a\<close>
+      using a_def[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" by blast
+  qed
+  ultimately AOT_have \<open>\<^bold>\<A>\<phi>{a} & \<forall>y (\<^bold>\<A>\<phi>{y} \<rightarrow> y = a)\<close>
+    using "&I" by blast
+  AOT_hence \<open>\<exists>x (\<^bold>\<A>\<phi>{x} & \<forall>y (\<^bold>\<A>\<phi>{y} \<rightarrow> y = x))\<close>
+    using "\<exists>I" by fast
+  AOT_hence \<open>\<exists>!x \<^bold>\<A>\<phi>{x}\<close>
+    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by fast
+  AOT_thus \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
+    using "actual-desc:1"[THEN "\<equiv>E"(2)] by blast
+qed
+
+AOT_theorem "sc-eq-fur:4":
+\<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x}) \<rightarrow> (x = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x)))\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
+  AOT_hence \<open>\<forall>x \<box>(\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
+    using CBF "\<rightarrow>E" by blast
+  AOT_hence A: \<open>\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<phi>{\<alpha>}\<close> for \<alpha>
+    using "sc-eq-fur:2" "\<forall>E" "\<rightarrow>E" by fast
+  AOT_show \<open>x = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x))\<close>
+  proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume \<open>x = \<^bold>\<iota>x \<phi>{x}\<close>
+    AOT_hence B: \<open>\<^bold>\<A>\<phi>{x} & \<forall>z (\<^bold>\<A>\<phi>{z} \<rightarrow> z = x)\<close>
+      using "nec-hintikka-scheme"[THEN "\<equiv>E"(1)] by blast
+    AOT_show \<open>\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x)\<close>
+    proof (rule "&I"; (rule "\<forall>I"; rule "\<rightarrow>I")?)
+      AOT_show \<open>\<phi>{x}\<close>
+        using A B[THEN "&E"(1)] "\<equiv>E"(1) by blast
+    next
+      AOT_show \<open>z = x\<close> if \<open>\<phi>{z}\<close> for z
+        using that B[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" A[THEN "\<equiv>E"(2)] by blast
+    qed
+  next
+    AOT_assume B: \<open>\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x)\<close>
+    AOT_have \<open>\<^bold>\<A>\<phi>{x} & \<forall>z (\<^bold>\<A>\<phi>{z} \<rightarrow> z = x)\<close>
+    proof(rule "&I"; (rule "\<forall>I"; rule "\<rightarrow>I")?)
+      AOT_show \<open>\<^bold>\<A>\<phi>{x}\<close>
+        using B[THEN "&E"(1)] A[THEN "\<equiv>E"(2)] by blast
+    next
+      AOT_show \<open>b = x\<close> if \<open>\<^bold>\<A>\<phi>{b}\<close> for b
+        using A[THEN "\<equiv>E"(1)] that
+              B[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+    qed
+    AOT_thus \<open>x = \<^bold>\<iota>x \<phi>{x}\<close>
+      using "nec-hintikka-scheme"[THEN "\<equiv>E"(2)] by blast
+  qed
+qed
+
+AOT_theorem "id-act:1": \<open>\<alpha> = \<beta> \<equiv> \<^bold>\<A>\<alpha> = \<beta>\<close>
+  by (meson "Act-Sub:3" "Hypothetical Syllogism"
+            "id-nec2:1" "id-nec:2" "\<equiv>I" "nec-imp-act")
+
+AOT_theorem "id-act:2": \<open>\<alpha> \<noteq> \<beta> \<equiv> \<^bold>\<A>\<alpha> \<noteq> \<beta>\<close>
+proof (AOT_subst \<open>\<alpha> \<noteq> \<beta>\<close> \<open>\<not>(\<alpha> = \<beta>)\<close>)
+  AOT_modally_strict {
+    AOT_show \<open>\<alpha> \<noteq> \<beta> \<equiv> \<not>(\<alpha> = \<beta>)\<close>
+      by (simp add: "=-infix" "\<equiv>Df")
+  }
+next
+  AOT_show \<open>\<not>(\<alpha> = \<beta>) \<equiv> \<^bold>\<A>\<not>(\<alpha> = \<beta>)\<close>
+  proof (safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>\<not>\<alpha> = \<beta>\<close>
+    AOT_hence \<open>\<not>\<^bold>\<A>\<alpha> = \<beta>\<close> using "id-act:1" "\<equiv>E"(3) by blast
+    AOT_thus \<open>\<^bold>\<A>\<not>\<alpha> = \<beta>\<close>
+      using "\<not>\<not>E" "Act-Sub:1" "\<equiv>E"(3) by blast
+  next
+    AOT_assume \<open>\<^bold>\<A>\<not>\<alpha> = \<beta>\<close>
+    AOT_hence \<open>\<not>\<^bold>\<A>\<alpha> = \<beta>\<close>
+      using "\<not>\<not>I" "Act-Sub:1" "\<equiv>E"(4) by blast
+    AOT_thus \<open>\<not>\<alpha> = \<beta>\<close>
+      using "id-act:1" "\<equiv>E"(4) by blast
+  qed
+qed
+
+AOT_theorem "A-Exists:1": \<open>\<^bold>\<A>\<exists>!\<alpha> \<phi>{\<alpha>} \<equiv> \<exists>!\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close>
+proof -
+  AOT_have \<open>\<^bold>\<A>\<exists>!\<alpha> \<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<exists>\<alpha>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    by (AOT_subst \<open>\<exists>!\<alpha> \<phi>{\<alpha>}\<close> \<open>\<exists>\<alpha>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>)
+       (auto simp add: "oth-class-taut:3:a" "uniqueness:2")
+  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha> \<^bold>\<A>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    by (simp add: "Act-Basic:10")
+  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha>\<forall>\<beta> \<^bold>\<A>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    by (AOT_subst \<open>\<^bold>\<A>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> \<open>\<forall>\<beta> \<^bold>\<A>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> for: \<alpha>)
+       (auto simp: "logic-actual-nec:3"[axiom_inst] "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<^bold>\<A>\<beta> = \<alpha>)\<close>
+    by (AOT_subst (reverse) \<open>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<^bold>\<A>\<beta> = \<alpha>\<close>
+                            \<open>\<^bold>\<A>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> for: \<alpha> \<beta> :: 'a)
+       (auto simp: "Act-Basic:5" "cqt-further:7")
+  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
+    by (AOT_subst (reverse) \<open>\<^bold>\<A>\<beta> = \<alpha>\<close> \<open>\<beta> = \<alpha>\<close> for: \<alpha> \<beta> :: 'a)
+       (auto simp: "id-act:1" "cqt-further:7")
+  also AOT_have \<open>... \<equiv> \<exists>!\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close>
+    using "uniqueness:2" "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by fast
+  finally show ?thesis.
+qed
+
+AOT_theorem "A-Exists:2": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<equiv> \<^bold>\<A>\<exists>!x \<phi>{x}\<close>
+  by (AOT_subst \<open>\<^bold>\<A>\<exists>!x \<phi>{x}\<close> \<open>\<exists>!x \<^bold>\<A>\<phi>{x}\<close>)
+     (auto simp: "actual-desc:1" "A-Exists:1")
+
+AOT_theorem "id-act-desc:1": \<open>\<^bold>\<iota>x (x = y)\<down>\<close>
+proof(rule "existence:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "\<exists>I")
+  AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]\<^bold>\<iota>x (x = y)\<close>
+  proof (rule "russell-axiom[exe,1].nec-russell-axiom"[THEN "\<equiv>E"(2)];
+         rule "\<exists>I"; (rule "&I")+)
+    AOT_show \<open>\<^bold>\<A>y = y\<close> by (simp add: "RA[2]" "id-eq:1")
+  next
+    AOT_show \<open>\<forall>z (\<^bold>\<A>z = y \<rightarrow> z = y)\<close>
+      apply (rule "\<forall>I")
+      using "id-act:1"[THEN "\<equiv>E"(2)] "\<rightarrow>I" by blast
+  next
+    AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]y\<close>
+    proof (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E", THEN "\<equiv>E"(2)])
+      AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close>
+        by "cqt:2[lambda]"
+    next
+      AOT_show \<open>E!y \<rightarrow> E!y\<close> 
+        by (simp add: "if-p-then-p")
+    qed
+  qed
+next
+  AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close>
+    by "cqt:2[lambda]"
+qed
+
+AOT_theorem "id-act-desc:2": \<open>y = \<^bold>\<iota>x (x = y)\<close>
+  by (rule descriptions[axiom_inst, THEN "\<equiv>E"(2)];
+      rule "\<forall>I"; rule "id-act:1"[symmetric])
+
+AOT_theorem "pre-en-eq:1[1]": \<open>x\<^sub>1[F] \<rightarrow> \<box>x\<^sub>1[F]\<close>
+  by (simp add: encoding "vdash-properties:1[2]")
+
+AOT_theorem "pre-en-eq:1[2]": \<open>x\<^sub>1x\<^sub>2[F] \<rightarrow> \<box>x\<^sub>1x\<^sub>2[F]\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>x\<^sub>1x\<^sub>2[F]\<close>
+  AOT_hence \<open>x\<^sub>1[\<lambda>y [F]yx\<^sub>2]\<close> and \<open>x\<^sub>2[\<lambda>y [F]x\<^sub>1y]\<close>
+    using "nary-encoding[2]"[axiom_inst, THEN "\<equiv>E"(1)] "&E" by blast+
+  moreover AOT_have \<open>[\<lambda>y [F]yx\<^sub>2]\<down>\<close> by "cqt:2"
+  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1y]\<down>\<close> by "cqt:2"
+  ultimately AOT_have \<open>\<box>x\<^sub>1[\<lambda>y [F]yx\<^sub>2]\<close> and \<open>\<box>x\<^sub>2[\<lambda>y [F]x\<^sub>1y]\<close>
+    using encoding[axiom_inst, unvarify F] "\<rightarrow>E" "&I" by blast+
+  note A = this
+  AOT_hence \<open>\<box>(x\<^sub>1[\<lambda>y [F]yx\<^sub>2] & x\<^sub>2[\<lambda>y [F]x\<^sub>1y])\<close>
+    using "KBasic:3"[THEN "\<equiv>E"(2)] "&I" by blast
+  AOT_thus \<open>\<box>x\<^sub>1x\<^sub>2[F]\<close>
+    by (rule "nary-encoding[2]"[axiom_inst, THEN RN,
+                                THEN "KBasic:6"[THEN "\<rightarrow>E"],
+                                THEN "\<equiv>E"(2)])
+qed
+
+AOT_theorem "pre-en-eq:1[3]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<rightarrow> \<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  AOT_hence \<open>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3]\<close>
+        and \<open>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3]\<close>
+        and \<open>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<close>
+    using "nary-encoding[3]"[axiom_inst, THEN "\<equiv>E"(1)] "&E" by blast+
+  moreover AOT_have \<open>[\<lambda>y [F]yx\<^sub>2x\<^sub>3]\<down>\<close> by "cqt:2"
+  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1yx\<^sub>3]\<down>\<close> by "cqt:2"
+  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<down>\<close> by "cqt:2"
+  ultimately AOT_have \<open>\<box>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3]\<close>
+                  and \<open>\<box>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3]\<close>
+                  and \<open>\<box>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<close>
+    using encoding[axiom_inst, unvarify F] "\<rightarrow>E" by blast+
+  note A = this
+  AOT_have B: \<open>\<box>(x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3] & x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3] & x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y])\<close>
+    by (rule "KBasic:3"[THEN "\<equiv>E"(2)] "&I" A)+
+  AOT_thus \<open>\<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+    by (rule "nary-encoding[3]"[axiom_inst, THEN RN,
+                THEN "KBasic:6"[THEN "\<rightarrow>E"], THEN "\<equiv>E"(2)])
+qed
+
+AOT_theorem "pre-en-eq:1[4]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<rightarrow> \<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  AOT_hence \<open>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4]\<close>
+        and \<open>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4]\<close>
+        and \<open>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4]\<close>
+        and \<open>x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<close>
+    using "nary-encoding[4]"[axiom_inst, THEN "\<equiv>E"(1)] "&E" by metis+
+  moreover AOT_have \<open>[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4]\<down>\<close> by "cqt:2"
+  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4]\<down>\<close> by "cqt:2"
+  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4]\<down>\<close> by "cqt:2"
+  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<down>\<close> by "cqt:2"
+  ultimately AOT_have \<open>\<box>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4]\<close>
+                  and \<open>\<box>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4]\<close>
+                  and \<open>\<box>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4]\<close>
+                  and \<open>\<box>x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<close>
+    using "\<rightarrow>E" encoding[axiom_inst, unvarify F] by blast+
+  note A = this
+  AOT_have B: \<open>\<box>(x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4] &
+                  x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4] &
+                  x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4] &
+                  x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y])\<close>
+    by (rule "KBasic:3"[THEN "\<equiv>E"(2)] "&I" A)+
+  AOT_thus \<open>\<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+    by (rule "nary-encoding[4]"[axiom_inst, THEN RN,
+              THEN "KBasic:6"[THEN "\<rightarrow>E"], THEN "\<equiv>E"(2)])
+qed
+
+AOT_theorem "pre-en-eq:2[1]": \<open>\<not>x\<^sub>1[F] \<rightarrow> \<box>\<not>x\<^sub>1[F]\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1[F]\<close>
+  AOT_hence \<open>\<diamond>x\<^sub>1[F]\<close>
+    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_hence \<open>x\<^sub>1[F]\<close>
+    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[1]"[THEN RN],
+              THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
+  moreover AOT_assume \<open>\<not>x\<^sub>1[F]\<close>
+  ultimately AOT_show \<open>x\<^sub>1[F] & \<not>x\<^sub>1[F]\<close> by (rule "&I")
+qed
+AOT_theorem "pre-en-eq:2[2]": \<open>\<not>x\<^sub>1x\<^sub>2[F] \<rightarrow> \<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
+  AOT_hence \<open>\<diamond>x\<^sub>1x\<^sub>2[F]\<close>
+    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_hence \<open>x\<^sub>1x\<^sub>2[F]\<close>
+    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[2]"[THEN RN],
+              THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
+  moreover AOT_assume \<open>\<not>x\<^sub>1x\<^sub>2[F]\<close>
+  ultimately AOT_show \<open>x\<^sub>1x\<^sub>2[F] & \<not>x\<^sub>1x\<^sub>2[F]\<close> by (rule "&I")
+qed
+
+AOT_theorem "pre-en-eq:2[3]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<rightarrow> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  AOT_hence \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_hence \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[3]"[THEN RN],
+              THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
+  moreover AOT_assume \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  ultimately AOT_show \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] & \<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close> by (rule "&I")
+qed
+
+AOT_theorem "pre-en-eq:2[4]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<rightarrow> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  AOT_hence \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_hence \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[4]"[THEN RN],
+                         THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
+  moreover AOT_assume \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  ultimately AOT_show \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] & \<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close> by (rule "&I")
+qed
+
+AOT_theorem "en-eq:1[1]": \<open>\<diamond>x\<^sub>1[F] \<equiv> \<box>x\<^sub>1[F]\<close>
+  using "pre-en-eq:1[1]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by metis
+AOT_theorem "en-eq:1[2]": \<open>\<diamond>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>x\<^sub>1x\<^sub>2[F]\<close>
+  using "pre-en-eq:1[2]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by metis
+AOT_theorem "en-eq:1[3]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  using "pre-en-eq:1[3]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by fast
+AOT_theorem "en-eq:1[4]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  using "pre-en-eq:1[4]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by fast
+
+AOT_theorem "en-eq:2[1]": \<open>x\<^sub>1[F] \<equiv> \<box>x\<^sub>1[F]\<close>
+  by (simp add: "\<equiv>I" "pre-en-eq:1[1]" "qml:2"[axiom_inst])
+AOT_theorem "en-eq:2[2]": \<open>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>x\<^sub>1x\<^sub>2[F]\<close>
+  by (simp add: "\<equiv>I" "pre-en-eq:1[2]" "qml:2"[axiom_inst])
+AOT_theorem "en-eq:2[3]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  by (simp add: "\<equiv>I" "pre-en-eq:1[3]" "qml:2"[axiom_inst])
+AOT_theorem "en-eq:2[4]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  by (simp add: "\<equiv>I" "pre-en-eq:1[4]" "qml:2"[axiom_inst])
+
+AOT_theorem "en-eq:3[1]": \<open>\<diamond>x\<^sub>1[F] \<equiv> x\<^sub>1[F]\<close>
+  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[1]"] "\<equiv>I" by blast
+AOT_theorem "en-eq:3[2]": \<open>\<diamond>x\<^sub>1x\<^sub>2[F] \<equiv> x\<^sub>1x\<^sub>2[F]\<close>
+  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[2]"] "\<equiv>I" by blast
+AOT_theorem "en-eq:3[3]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[3]"] "\<equiv>I" by blast
+AOT_theorem "en-eq:3[4]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[4]"] "\<equiv>I" by blast
+
+AOT_theorem "en-eq:4[1]":
+  \<open>(x\<^sub>1[F] \<equiv> y\<^sub>1[G]) \<equiv> (\<box>x\<^sub>1[F] \<equiv> \<box>y\<^sub>1[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[1]" by blast+
+AOT_theorem "en-eq:4[2]":
+  \<open>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>y\<^sub>1y\<^sub>2[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[2]" by blast+
+AOT_theorem "en-eq:4[3]":
+  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>y\<^sub>1y\<^sub>2y\<^sub>3[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[3]" by blast+
+AOT_theorem "en-eq:4[4]":
+  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[4]" by blast+
+
+AOT_theorem "en-eq:5[1]":
+  \<open>\<box>(x\<^sub>1[F] \<equiv> y\<^sub>1[G]) \<equiv> (\<box>x\<^sub>1[F] \<equiv> \<box>y\<^sub>1[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "en-eq:4[1]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
+   apply blast
+  using "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+        "&I"[OF "pre-en-eq:1[1]"[THEN RN], OF "pre-en-eq:1[1]"[THEN RN]]
+  by blast
+AOT_theorem "en-eq:5[2]":
+  \<open>\<box>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>y\<^sub>1y\<^sub>2[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "en-eq:4[2]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
+   apply blast
+  using "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+        "&I"[OF "pre-en-eq:1[2]"[THEN RN], OF "pre-en-eq:1[2]"[THEN RN]]
+  by blast
+AOT_theorem "en-eq:5[3]":
+  \<open>\<box>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>y\<^sub>1y\<^sub>2y\<^sub>3[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "en-eq:4[3]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
+   apply blast
+  using "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+        "&I"[OF "pre-en-eq:1[3]"[THEN RN], OF "pre-en-eq:1[3]"[THEN RN]]
+  by blast
+AOT_theorem "en-eq:5[4]":
+  \<open>\<box>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G])\<close>
+  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+  using "en-eq:4[4]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
+   apply blast
+  using "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+        "&I"[OF "pre-en-eq:1[4]"[THEN RN], OF "pre-en-eq:1[4]"[THEN RN]]
+  by blast
+
+AOT_theorem "en-eq:6[1]":
+  \<open>(x\<^sub>1[F] \<equiv> y\<^sub>1[G]) \<equiv> \<box>(x\<^sub>1[F] \<equiv> y\<^sub>1[G])\<close>
+  using "en-eq:5[1]"[symmetric] "en-eq:4[1]" "\<equiv>E"(5) by fast
+AOT_theorem "en-eq:6[2]":
+  \<open>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G]) \<equiv> \<box>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G])\<close>
+  using "en-eq:5[2]"[symmetric] "en-eq:4[2]" "\<equiv>E"(5) by fast
+AOT_theorem "en-eq:6[3]":
+  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G]) \<equiv> \<box>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G])\<close>
+  using "en-eq:5[3]"[symmetric] "en-eq:4[3]" "\<equiv>E"(5) by fast
+AOT_theorem "en-eq:6[4]":
+  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G]) \<equiv> \<box>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G])\<close>
+  using "en-eq:5[4]"[symmetric] "en-eq:4[4]" "\<equiv>E"(5) by fast
+
+AOT_theorem "en-eq:7[1]": \<open>\<not>x\<^sub>1[F] \<equiv> \<box>\<not>x\<^sub>1[F]\<close>
+  using "pre-en-eq:2[1]" "qml:2"[axiom_inst] "\<equiv>I" by blast
+AOT_theorem "en-eq:7[2]": \<open>\<not>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
+  using "pre-en-eq:2[2]" "qml:2"[axiom_inst] "\<equiv>I" by blast
+AOT_theorem "en-eq:7[3]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  using "pre-en-eq:2[3]" "qml:2"[axiom_inst] "\<equiv>I" by blast
+AOT_theorem "en-eq:7[4]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  using "pre-en-eq:2[4]" "qml:2"[axiom_inst] "\<equiv>I" by blast
+
+AOT_theorem "en-eq:8[1]": \<open>\<diamond>\<not>x\<^sub>1[F] \<equiv> \<not>x\<^sub>1[F]\<close>
+  using "en-eq:2[1]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
+        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
+AOT_theorem "en-eq:8[2]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2[F] \<equiv> \<not>x\<^sub>1x\<^sub>2[F]\<close>
+  using "en-eq:2[2]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
+        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
+AOT_theorem "en-eq:8[3]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  using "en-eq:2[3]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
+        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
+AOT_theorem "en-eq:8[4]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  using "en-eq:2[4]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
+        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
+
+AOT_theorem "en-eq:9[1]": \<open>\<diamond>\<not>x\<^sub>1[F] \<equiv> \<box>\<not>x\<^sub>1[F]\<close>
+  using "en-eq:7[1]" "en-eq:8[1]" "\<equiv>E"(5) by blast
+AOT_theorem "en-eq:9[2]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
+  using "en-eq:7[2]" "en-eq:8[2]" "\<equiv>E"(5) by blast
+AOT_theorem "en-eq:9[3]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  using "en-eq:7[3]" "en-eq:8[3]" "\<equiv>E"(5) by blast
+AOT_theorem "en-eq:9[4]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  using "en-eq:7[4]" "en-eq:8[4]" "\<equiv>E"(5) by blast
+
+AOT_theorem "en-eq:10[1]": \<open>\<^bold>\<A>x\<^sub>1[F] \<equiv> x\<^sub>1[F]\<close>
+  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
+            "nec-imp-act" "en-eq:3[1]" "pre-en-eq:1[1]")
+AOT_theorem "en-eq:10[2]": \<open>\<^bold>\<A>x\<^sub>1x\<^sub>2[F] \<equiv> x\<^sub>1x\<^sub>2[F]\<close>
+  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
+            "nec-imp-act" "en-eq:3[2]" "pre-en-eq:1[2]")
+AOT_theorem "en-eq:10[3]": \<open>\<^bold>\<A>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
+  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
+            "nec-imp-act" "en-eq:3[3]" "pre-en-eq:1[3]")
+AOT_theorem "en-eq:10[4]": \<open>\<^bold>\<A>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
+  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
+            "nec-imp-act" "en-eq:3[4]" "pre-en-eq:1[4]")
+
+AOT_theorem "oa-facts:1": \<open>O!x \<rightarrow> \<box>O!x\<close>
+proof(rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_have \<open>[\<lambda>x \<diamond>E!x]x \<equiv> \<diamond>E!x\<close>
+      by (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E"]) "cqt:2"
+  } note \<theta> = this
+  AOT_assume \<open>O!x\<close>
+  AOT_hence \<open>[\<lambda>x \<diamond>E!x]x\<close>
+    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_ordinary, rotated 1]) "cqt:2"
+  AOT_hence \<open>\<diamond>E!x\<close> using \<theta>[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<box>\<diamond>E!x\<close> using "qml:3"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<box>[\<lambda>x \<diamond>E!x]x\<close>
+    by (AOT_subst \<open>[\<lambda>x \<diamond>E!x]x\<close> \<open>\<diamond>E!x\<close>)
+       (auto simp: \<theta>)
+  AOT_thus \<open>\<box>O!x\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated 1]) "cqt:2"
+qed
+
+AOT_theorem "oa-facts:2": \<open>A!x \<rightarrow> \<box>A!x\<close>
+proof(rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_have \<open>[\<lambda>x \<not>\<diamond>E!x]x \<equiv> \<not>\<diamond>E!x\<close>
+      by (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E"]) "cqt:2"
+  } note \<theta> = this
+  AOT_assume \<open>A!x\<close>
+  AOT_hence \<open>[\<lambda>x \<not>\<diamond>E!x]x\<close>
+    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract, rotated 1]) "cqt:2"
+  AOT_hence \<open>\<not>\<diamond>E!x\<close> using \<theta>[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<box>\<not>E!x\<close> using "KBasic2:1"[THEN "\<equiv>E"(2)] by blast
+  AOT_hence \<open>\<box>\<box>\<not>E!x\<close> using "4"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<box>\<not>\<diamond>E!x\<close>
+    using "KBasic2:1"
+    by (AOT_subst (reverse) \<open>\<not>\<diamond>E!x\<close> \<open>\<box>\<not>E!x\<close>) blast
+  AOT_hence \<open>\<box>[\<lambda>x \<not>\<diamond>E!x]x\<close>
+    by (AOT_subst \<open>[\<lambda>x \<not>\<diamond>E!x]x\<close> \<open>\<not>\<diamond>E!x\<close>)
+       (auto simp: \<theta>)
+  AOT_thus \<open>\<box>A!x\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_abstract, rotated 1]) "cqt:2[lambda]"
+qed
+
+AOT_theorem "oa-facts:3": \<open>\<diamond>O!x \<rightarrow> O!x\<close>
+  using "oa-facts:1" "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" by blast
+AOT_theorem "oa-facts:4": \<open>\<diamond>A!x \<rightarrow> A!x\<close>
+  using "oa-facts:2" "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" by blast
+
+AOT_theorem "oa-facts:5": \<open>\<diamond>O!x \<equiv> \<box>O!x\<close>
+  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
+            "oa-facts:1" "oa-facts:3")
+
+AOT_theorem "oa-facts:6": \<open>\<diamond>A!x \<equiv> \<box>A!x\<close>
+  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
+            "oa-facts:2" "oa-facts:4")
+
+AOT_theorem "oa-facts:7": \<open>O!x \<equiv> \<^bold>\<A>O!x\<close>
+  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
+            "oa-facts:1" "oa-facts:3")
+
+AOT_theorem "oa-facts:8": \<open>A!x \<equiv> \<^bold>\<A>A!x\<close>
+  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
+            "oa-facts:2" "oa-facts:4")
+
+subsection\<open>The Theory of Relations\<close>
+text\<open>\label{PLM: 9.10}\<close>
+
+AOT_theorem "beta-C-meta":
+  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<down> \<rightarrow>
+   ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv> \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n})\<close>
+  using "lambda-predicates:2"[axiom_inst] by blast
+
+AOT_theorem "beta-C-cor:1":
+  \<open>(\<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>)) \<rightarrow>
+   \<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv> \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n})\<close>
+  apply (rule "cqt-basic:14"[where 'a='a, THEN "\<rightarrow>E"])
+  using "beta-C-meta" "\<forall>I" by fast
+
+AOT_theorem "beta-C-cor:2":
+  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down> \<rightarrow>
+   \<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv> \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n})\<close>
+  apply (rule "\<rightarrow>I"; rule "\<forall>I")
+  using "beta-C-meta"[THEN "\<rightarrow>E"] by fast
+
+(* TODO: add better syntax parsing for INSTANCE_OF_CQT_2 *)
+theorem "beta-C-cor:3":
+  assumes \<open>\<And>\<nu>\<^sub>1\<nu>\<^sub>n. AOT_instance_of_cqt_2 (\<phi> (AOT_term_of_var \<nu>\<^sub>1\<nu>\<^sub>n))\<close>
+  shows \<open>[v \<Turnstile> \<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<mu>\<^sub>1...\<mu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv>
+                         \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n})]\<close>
+  using "cqt:2[lambda]"[axiom_inst, OF assms]
+        "beta-C-cor:1"[THEN "\<rightarrow>E"] "\<forall>I" by fast
+
+AOT_theorem "betaC:1:a": \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<^bold>\<turnstile>\<^sub>\<box> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
+proof -
+  AOT_modally_strict {
+    AOT_assume \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
+    moreover AOT_have \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>\<close> and \<open>\<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>\<close>
+      using calculation "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E"] "&E" by blast+
+    ultimately AOT_show \<open>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
+      using "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] by blast
+  }
+qed
+
+AOT_theorem "betaC:1:b": \<open>\<not>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n} \<^bold>\<turnstile>\<^sub>\<box> \<not>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
+  using "betaC:1:a" "raa-cor:3" by blast
+
+lemmas "\<beta>\<rightarrow>C" = "betaC:1:a" "betaC:1:b"
+
+AOT_theorem "betaC:2:a":
+  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>, \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>, \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n} \<^bold>\<turnstile>\<^sub>\<box>
+   [\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
+proof -
+  AOT_modally_strict {
+    AOT_assume 1: \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>\<close>
+           and 2: \<open>\<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>\<close>
+           and 3: \<open>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
+    AOT_hence \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
+      using "beta-C-cor:2"[THEN "\<rightarrow>E", OF 1, THEN "\<forall>E"(1), THEN "\<equiv>E"(2)]
+      by blast
+  }
+  AOT_thus \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>, \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>, \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n} \<^bold>\<turnstile>\<^sub>\<box>
+            [\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
+    by blast
+qed
+
+AOT_theorem "betaC:2:b":
+  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>, \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>, \<not>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<^bold>\<turnstile>\<^sub>\<box>
+   \<not>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
+  using "betaC:2:a" "raa-cor:3" by blast
+
+lemmas "\<beta>\<leftarrow>C" = "betaC:2:a" "betaC:2:b"
+
+AOT_theorem "eta-conversion-lemma1:1": \<open>\<Pi>\<down> \<rightarrow> [\<lambda>x\<^sub>1...x\<^sub>n [\<Pi>]x\<^sub>1...x\<^sub>n] = \<Pi>\<close>
+  using "lambda-predicates:3"[axiom_inst] "\<forall>I" "\<forall>E"(1) "\<rightarrow>I" by fast
+
+(* Note: generalized alphabetic variant of the last theorem *)
+AOT_theorem "eta-conversion-lemma1:2": \<open>\<Pi>\<down> \<rightarrow> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n [\<Pi>]\<nu>\<^sub>1...\<nu>\<^sub>n] = \<Pi>\<close>
+  using "eta-conversion-lemma1:1".
+
+text\<open>Note: not explicitly part of PLM.\<close>
+AOT_theorem id_sym:
+  assumes \<open>\<tau> = \<tau>'\<close>
+  shows \<open>\<tau>' = \<tau>\<close>
+  using "rule=E"[where \<phi>="\<lambda> \<tau>' . \<guillemotleft>\<tau>' = \<tau>\<guillemotright>", rotated 1, OF assms]
+        "=I"(1)[OF "t=t-proper:1"[THEN "\<rightarrow>E", OF assms]] by auto
+declare id_sym[sym]
+
+text\<open>Note: not explicitly part of PLM.\<close>
+AOT_theorem id_trans:
+  assumes \<open>\<tau> = \<tau>'\<close> and \<open>\<tau>' = \<tau>''\<close>
+  shows \<open>\<tau> = \<tau>''\<close>
+  using "rule=E" assms by blast
+declare id_trans[trans]
+
+method "\<eta>C" for \<Pi> :: \<open><'a::{AOT_Term_id_2,AOT_\<kappa>s}>\<close> =
+  (match conclusion in "[v \<Turnstile> \<tau>{\<Pi>} = \<tau>'{\<Pi>}]" for v \<tau> \<tau>' \<Rightarrow> \<open>
+   rule "rule=E"[rotated 1, OF "eta-conversion-lemma1:2"
+    [THEN "\<rightarrow>E", of v "\<guillemotleft>[\<Pi>]\<guillemotright>", symmetric]]\<close>)
+
+AOT_theorem "sub-des-lam:1":
+  \<open>[\<lambda>z\<^sub>1...z\<^sub>n  \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}]\<down> & \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x} \<rightarrow>
+   [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}] = [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<psi>{x}}]\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume A: \<open>[\<lambda>z\<^sub>1...z\<^sub>n  \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}]\<down> & \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
+  AOT_show \<open>[\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}] = [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<psi>{x}}]\<close>
+    using "rule=E"[where \<phi>="\<lambda> \<tau> . \<guillemotleft>[\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}] =
+                                   [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<tau>}]\<guillemotright>",
+               OF "=I"(1)[OF A[THEN "&E"(1)]], OF A[THEN "&E"(2)]]
+    by blast
+qed
+
+AOT_theorem "sub-des-lam:2":
+  \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x} \<rightarrow> \<chi>{\<^bold>\<iota>x \<phi>{x}} = \<chi>{\<^bold>\<iota>x \<psi>{x}}\<close> for \<chi> :: \<open>\<kappa> \<Rightarrow> \<o>\<close>
+  using "rule=E"[where \<phi>="\<lambda> \<tau> . \<guillemotleft>\<chi>{\<^bold>\<iota>x \<phi>{x}} = \<chi>{\<tau>}\<guillemotright>",
+                 OF "=I"(1)[OF "log-prop-prop:2"]] "\<rightarrow>I" by blast
+
+AOT_theorem "prop-equiv": \<open>F = G \<equiv> \<forall>x (x[F] \<equiv> x[G])\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>F = G\<close>
+  AOT_thus \<open>\<forall>x (x[F] \<equiv> x[G])\<close>
+    by (rule "rule=E"[rotated]) (fact "oth-class-taut:3:a"[THEN GEN])
+next
+  AOT_assume \<open>\<forall>x (x[F] \<equiv> x[G])\<close>
+  AOT_hence \<open>x[F] \<equiv> x[G]\<close> for x
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<box>(x[F] \<equiv> x[G])\<close> for x
+    using "en-eq:6[1]"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<forall>x \<box>(x[F] \<equiv> x[G])\<close>
+    by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>x (x[F] \<equiv> x[G])\<close>
+    using BF[THEN "\<rightarrow>E"] by fast
+  AOT_thus "F = G"
+    using "p-identity-thm2:1"[THEN "\<equiv>E"(2)] by blast
+qed
+
+AOT_theorem "relations:1":
+  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
+  shows \<open>\<exists>F \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> \<phi>{x\<^sub>1...x\<^sub>n})\<close>
+  apply (rule "\<exists>I"(1)[where \<tau>="\<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<guillemotright>"])
+  using "cqt:2[lambda]"[OF assms, axiom_inst]
+        "beta-C-cor:2"[THEN "\<rightarrow>E", THEN RN] by blast+
+
+AOT_theorem "relations:2":
+  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
+  shows \<open>\<exists>F \<box>\<forall>x ([F]x \<equiv> \<phi>{x})\<close>
+  using "relations:1" assms by blast
+
+AOT_theorem "block-paradox:1": \<open>\<not>[\<lambda>x \<exists>G (x[G] & \<not>[G]x)]\<down>\<close>
+proof(rule "raa-cor:2")
+  let ?K="\<guillemotleft>[\<lambda>x \<exists>G (x[G] & \<not>[G]x)]\<guillemotright>"
+  AOT_assume A: \<open>\<guillemotleft>?K\<guillemotright>\<down>\<close>
+  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> F = \<guillemotleft>?K\<guillemotright>))\<close>
+    using "A-objects"[axiom_inst] by fast
+  then AOT_obtain a where \<xi>: \<open>A!a & \<forall>F (a[F] \<equiv> F = \<guillemotleft>?K\<guillemotright>)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_show \<open>p & \<not>p\<close> for p
+  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
+    AOT_assume B: \<open>[\<guillemotleft>?K\<guillemotright>]a\<close>
+    AOT_hence \<open>\<exists>G (a[G] & \<not>[G]a)\<close>
+      using "\<beta>\<rightarrow>C" A by blast
+    then AOT_obtain P where \<open>a[P] & \<not>[P]a\<close>
+      using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>P = [\<guillemotleft>?K\<guillemotright>]\<close>
+      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)]
+            calculation[THEN "&E"(1)] by blast
+    ultimately AOT_have \<open>\<not>[\<guillemotleft>?K\<guillemotright>]a\<close>
+      using "rule=E" "&E"(2) by fast
+    AOT_thus \<open>p & \<not>p\<close>
+      using B RAA by blast
+  next
+    AOT_assume B: \<open>\<not>[\<guillemotleft>?K\<guillemotright>]a\<close>
+    AOT_hence \<open>\<not>\<exists>G (a[G] & \<not>[G]a)\<close>
+      using "\<beta>\<leftarrow>C" "cqt:2[const_var]"[of a, axiom_inst] A by blast
+    AOT_hence C: \<open>\<forall>G \<not>(a[G] & \<not>[G]a)\<close>
+      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+    AOT_have \<open>\<forall>G (a[G] \<rightarrow> [G]a)\<close>
+      by (AOT_subst \<open>a[G] \<rightarrow> [G]a\<close> \<open>\<not>(a[G] & \<not>[G]a)\<close> for: G)
+         (auto simp: "oth-class-taut:1:a" C)
+    AOT_hence \<open>a[\<guillemotleft>?K\<guillemotright>] \<rightarrow> [\<guillemotleft>?K\<guillemotright>]a\<close>
+      using "\<forall>E" A by blast
+    moreover AOT_have \<open>a[\<guillemotleft>?K\<guillemotright>]\<close>
+      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(1), OF A, THEN "\<equiv>E"(2)]
+      using "=I"(1)[OF A] by blast
+    ultimately AOT_show \<open>p & \<not>p\<close>
+      using B "\<rightarrow>E" RAA by blast
+  qed
+qed
+
+AOT_theorem "block-paradox:2": \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
+proof(rule RAA(2))
+  AOT_assume \<open>\<exists>F \<forall>x ([F]x \<equiv> \<exists>G (x[G] & \<not>[G]x))\<close>
+  then AOT_obtain F where F_prop: \<open>\<forall>x ([F]x \<equiv> \<exists>G (x[G] & \<not>[G]x))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<open>\<exists>x (A!x & \<forall>G (x[G] \<equiv> G = F))\<close>
+    using "A-objects"[axiom_inst] by fast
+  then AOT_obtain a where \<xi>: \<open>A!a & \<forall>G (a[G] \<equiv> G = F)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_show \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
+  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
+    AOT_assume B: \<open>[F]a\<close>
+    AOT_hence \<open>\<exists>G (a[G] & \<not>[G]a)\<close>
+      using F_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain P where \<open>a[P] & \<not>[P]a\<close>
+      using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>P = F\<close>
+      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)]
+            calculation[THEN "&E"(1)] by blast
+    ultimately AOT_have \<open>\<not>[F]a\<close>
+      using "rule=E" "&E"(2) by fast
+    AOT_thus \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
+      using B RAA by blast
+  next
+    AOT_assume B: \<open>\<not>[F]a\<close>
+    AOT_hence \<open>\<not>\<exists>G (a[G] & \<not>[G]a)\<close>
+      using "oth-class-taut:4:b"[THEN "\<equiv>E"(1),
+              OF F_prop[THEN "\<forall>E"(2)[of _ _ a]], THEN "\<equiv>E"(1)]
+      by simp
+    AOT_hence C: \<open>\<forall>G \<not>(a[G] & \<not>[G]a)\<close>
+      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+    AOT_have \<open>\<forall>G (a[G] \<rightarrow> [G]a)\<close>
+      by (AOT_subst \<open>a[G] \<rightarrow> [G]a\<close> \<open>\<not>(a[G] & \<not>[G]a)\<close> for: G)
+         (auto simp: "oth-class-taut:1:a" C)
+    AOT_hence \<open>a[F] \<rightarrow> [F]a\<close>
+      using "\<forall>E" by blast
+    moreover AOT_have \<open>a[F]\<close>
+      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), of F, THEN "\<equiv>E"(2)]
+      using "=I"(2) by blast
+    ultimately AOT_show \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
+      using B "\<rightarrow>E" RAA by blast
+  qed
+qed(simp)
+
+AOT_theorem "block-paradox:3": \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close>
+proof(rule RAA(2))
+  AOT_assume \<theta>: \<open>\<forall>y [\<lambda>z z = y]\<down>\<close>
+  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> \<exists>y(F = [\<lambda>z z = y] & \<not>y[F])))\<close>
+    using "A-objects"[axiom_inst] by force
+  then AOT_obtain a where
+    a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>y (F = [\<lambda>z z = y] & \<not>y[F]))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<zeta>: \<open>a[\<lambda>z z = a] \<equiv> \<exists>y ([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
+    using \<theta>[THEN "\<forall>E"(2)] a_prop[THEN "&E"(2), THEN "\<forall>E"(1)] by blast
+  AOT_show \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close>
+  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
+    AOT_assume A: \<open>a[\<lambda>z z = a]\<close>
+    AOT_hence \<open>\<exists>y ([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
+      using \<zeta>[THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain b where b_prop: \<open>[\<lambda>z z = a] = [\<lambda>z z = b] & \<not>b[\<lambda>z z = a]\<close>
+      using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>a = a\<close> by (rule "=I")
+    moreover AOT_have \<open>[\<lambda>z z = a]\<down>\<close> using \<theta> "\<forall>E" by blast
+    moreover AOT_have \<open>a\<down>\<close> using "cqt:2[const_var]"[axiom_inst] .
+    ultimately AOT_have \<open>[\<lambda>z z = a]a\<close> using "\<beta>\<leftarrow>C" by blast
+    AOT_hence \<open>[\<lambda>z z = b]a\<close> using "rule=E" b_prop[THEN "&E"(1)] by fast
+    AOT_hence \<open>a = b\<close> using "\<beta>\<rightarrow>C" by blast
+    AOT_hence \<open>b[\<lambda>z z = a]\<close> using A "rule=E" by fast
+    AOT_thus \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close> using b_prop[THEN "&E"(2)] RAA by blast
+  next
+    AOT_assume A: \<open>\<not>a[\<lambda>z z = a]\<close>
+    AOT_hence \<open>\<not>\<exists>y ([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
+      using \<zeta> "oth-class-taut:4:b"[THEN "\<equiv>E"(1), THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<forall>y \<not>([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
+      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>\<not>([\<lambda>z z = a] = [\<lambda>z z = a] & \<not>a[\<lambda>z z = a])\<close>
+      using "\<forall>E" by blast
+    AOT_hence \<open>[\<lambda>z z = a] = [\<lambda>z z = a] \<rightarrow> a[\<lambda>z z = a]\<close>
+      by (metis "&I" "deduction-theorem" "raa-cor:4")
+    AOT_hence \<open>a[\<lambda>z z = a]\<close> using "=I"(1) \<theta>[THEN "\<forall>E"(2)] "\<rightarrow>E" by blast
+    AOT_thus \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close> using A RAA by blast
+  qed
+qed(simp)
+
+AOT_theorem "block-paradox:4": \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
+proof(rule RAA(2))
+  AOT_assume \<theta>: \<open>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
+  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> \<exists>z (\<forall>y([F]y \<equiv> y = z) & \<not>z[F])))\<close>
+    using "A-objects"[axiom_inst] by force
+  then AOT_obtain a where
+    a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>z (\<forall>y([F]y \<equiv> y = z) & \<not>z[F]))\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_obtain F where F_prop: \<open>\<forall>x ([F]x \<equiv> x = a)\<close>
+    using \<theta>[THEN "\<forall>E"(2)] "\<exists>E"[rotated] by blast
+  AOT_have \<zeta>: \<open>a[F] \<equiv> \<exists>z (\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
+    using a_prop[THEN "&E"(2), THEN "\<forall>E"(2)] by blast
+  AOT_show \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
+  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
+    AOT_assume A: \<open>a[F]\<close>
+    AOT_hence \<open>\<exists>z (\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
+      using \<zeta>[THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain b where b_prop: \<open>\<forall>y ([F]y \<equiv> y = b) & \<not>b[F]\<close>
+      using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>[F]a\<close>
+      using F_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] "=I"(2) by blast
+    ultimately AOT_have \<open>a = b\<close>
+      using "\<forall>E"(2) "\<equiv>E"(1) "&E" by fast
+    AOT_hence \<open>a = b\<close>
+      using "\<beta>\<rightarrow>C" by blast
+    AOT_hence \<open>b[F]\<close>
+      using A "rule=E" by fast
+    AOT_thus \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
+      using b_prop[THEN "&E"(2)] RAA by blast
+  next
+    AOT_assume A: \<open>\<not>a[F]\<close>
+    AOT_hence \<open>\<not>\<exists>z (\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
+      using \<zeta> "oth-class-taut:4:b"[THEN "\<equiv>E"(1), THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<forall>z \<not>(\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
+      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>\<not>(\<forall>y ([F]y \<equiv> y = a) & \<not>a[F])\<close>
+      using "\<forall>E" by blast
+    AOT_hence \<open>\<forall>y ([F]y \<equiv> y = a) \<rightarrow> a[F]\<close>
+      by (metis "&I" "deduction-theorem" "raa-cor:4")
+    AOT_hence \<open>a[F]\<close> using F_prop "\<rightarrow>E" by blast
+    AOT_thus \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
+      using A RAA by blast
+  qed
+qed(simp)
+
+AOT_theorem "block-paradox:5": \<open>\<not>\<exists>F\<forall>x\<forall>y([F]xy \<equiv> y = x)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<exists>F\<forall>x\<forall>y([F]xy \<equiv> y = x)\<close>
+  then AOT_obtain F where F_prop: \<open>\<forall>x\<forall>y([F]xy \<equiv> y = x)\<close>
+    using "\<exists>E"[rotated] by blast
+  {
+    fix x
+    AOT_have 1: \<open>\<forall>y([F]xy \<equiv> y = x)\<close>
+      using F_prop "\<forall>E" by blast
+    AOT_have 2: \<open>[\<lambda>z [F]xz]\<down>\<close> by "cqt:2"
+    moreover AOT_have \<open>\<forall>y([\<lambda>z [F]xz]y \<equiv> y = x)\<close>
+    proof(rule "\<forall>I")
+      fix y
+      AOT_have \<open>[\<lambda>z [F]xz]y \<equiv> [F]xy\<close>
+        using "beta-C-meta"[THEN "\<rightarrow>E"] 2 by fast
+      also AOT_have \<open>... \<equiv> y = x\<close>
+        using 1 "\<forall>E" by fast
+      finally AOT_show \<open>[\<lambda>z [F]xz]y \<equiv> y = x\<close>.
+    qed
+    ultimately AOT_have \<open>\<exists>F\<forall>y([F]y \<equiv> y = x)\<close>
+      using "\<exists>I" by fast
+  }
+  AOT_hence \<open>\<forall>x\<exists>F\<forall>y([F]y \<equiv> y = x)\<close>
+    by (rule GEN)
+  AOT_thus \<open>\<forall>x\<exists>F\<forall>y([F]y \<equiv> y = x) & \<not>\<forall>x\<exists>F\<forall>y([F]y \<equiv> y = x)\<close>
+    using "&I" "block-paradox:4" by blast
+qed
+
+AOT_act_theorem "block-paradox2:1":
+  \<open>\<forall>x [G]x \<rightarrow> \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume antecedant: \<open>\<forall>x [G]x\<close>
+  AOT_have Lemma: \<open>\<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
+  proof(rule GEN)
+    fix x
+    AOT_have A: \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv>
+                 \<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+    proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+      AOT_assume \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+      AOT_hence \<open>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
+        using "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)] by blast
+      AOT_thus \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "!-exists:1"[THEN "\<equiv>E"(1)] by blast
+    next
+      AOT_assume A: \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+      AOT_obtain a where a_1: \<open>a = x & \<exists>H (x[H] & \<not>[H]x)\<close>
+                     and a_2: \<open>\<forall>z (z = x & \<exists>H (x[H] & \<not>[H]x) \<rightarrow> z = a)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
+      AOT_have a_3: \<open>[G]a\<close>
+        using antecedant "\<forall>E" by blast
+      AOT_show \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        apply (rule "russell-axiom[exe,1].russell-axiom"[THEN "\<equiv>E"(2)])
+        apply (rule "\<exists>I"(2))
+        using a_1 a_2 a_3 "&I" by blast
+    qed
+    also AOT_have B: \<open>... \<equiv> \<exists>H (x[H] & \<not>[H]x)\<close>
+    proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+      AOT_assume A: \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+      AOT_obtain a where \<open>a = x & \<exists>H (x[H] & \<not>[H]x)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
+      AOT_thus \<open>\<exists>H (x[H] & \<not>[H]x)\<close> using "&E" by blast
+    next
+      AOT_assume \<open>\<exists>H (x[H] & \<not>[H]x)\<close>
+      AOT_hence \<open>x = x & \<exists>H (x[H] & \<not>[H]x)\<close>
+        using "id-eq:1" "&I" by blast
+      moreover AOT_have \<open>\<forall>z (z = x & \<exists>H (x[H] & \<not>[H]x) \<rightarrow> z = x)\<close>
+        by (simp add: "Conjunction Simplification"(1) "universal-cor")
+      ultimately AOT_show \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<exists>I"(2) by fast
+    qed
+    finally AOT_show \<open>([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close> .
+  qed
+
+  AOT_assume A: \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+  AOT_have \<theta>: \<open>\<forall>x ([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]x \<equiv>
+                   [G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)))\<close>
+    using "beta-C-meta"[THEN "\<rightarrow>E", OF A] "\<forall>I" by fast
+  AOT_have \<open>\<forall>x ([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]x \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
+    using \<theta> Lemma "cqt-basic:10"[THEN "\<rightarrow>E"] "&I" by fast
+  AOT_hence \<open>\<exists>F \<forall>x ([F]x \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
+    using "\<exists>I"(1) A by fast
+  AOT_thus \<open>(\<exists>F \<forall>x ([F]x \<equiv> \<exists>H (x[H] & \<not>[H]x))) &
+            (\<not>\<exists>F \<forall>x ([F]x \<equiv> \<exists>H (x[H] & \<not>[H]x)))\<close>
+    using "block-paradox:2" "&I" by blast
+qed
+
+text\<open>Note: Strengthens the above to a modally-strict theorem.
+           Not explicitly part of PLM.\<close>
+AOT_theorem "block-paradox2:1[strict]":
+  \<open>\<forall>x \<^bold>\<A>[G]x \<rightarrow> \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume antecedant: \<open>\<forall>x \<^bold>\<A>[G]x\<close>
+  AOT_have Lemma: \<open>\<^bold>\<A>\<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
+  proof(safe intro!: GEN "Act-Basic:5"[THEN "\<equiv>E"(2)]
+                     "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)])
+    fix x
+    AOT_have A: \<open>\<^bold>\<A>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv>
+                 \<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+    proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+      AOT_assume \<open>\<^bold>\<A>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+      moreover AOT_have \<open>\<box>([G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x)) \<rightarrow>
+                                  \<box>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>)\<close>
+      proof(rule RN; rule "\<rightarrow>I")
+        AOT_modally_strict {
+          AOT_assume \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+          AOT_hence \<open>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
+            using "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)] by blast
+          AOT_thus \<open>\<box>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
+            using "exist-nec"[THEN "\<rightarrow>E"] by blast
+        }
+      qed
+      ultimately AOT_have \<open>\<^bold>\<A>\<box>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
+        using "act-cond"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "nec-imp-act"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
+        using "Act-Sub:3" "B\<diamond>" "vdash-properties:10" by blast
+      AOT_thus \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "actual-desc:1"[THEN "\<equiv>E"(1)] by blast
+    next
+      AOT_assume A: \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+      AOT_obtain a where a_1: \<open>\<^bold>\<A>(a = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+                     and a_2: \<open>\<forall>z (\<^bold>\<A>(z = x & \<exists>H (x[H] & \<not>[H]x)) \<rightarrow> z = a)\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
+      AOT_have a_3: \<open>\<^bold>\<A>[G]a\<close>
+        using antecedant "\<forall>E" by blast
+      moreover AOT_have \<open>a = \<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "nec-hintikka-scheme"[THEN "\<equiv>E"(2), OF "&I"] a_1 a_2 by auto
+      ultimately AOT_show \<open>\<^bold>\<A>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "rule=E" by fast
+    qed
+    also AOT_have B: \<open>... \<equiv> \<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
+    proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+      AOT_assume A: \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+      AOT_obtain a where \<open>\<^bold>\<A>(a = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
+      AOT_thus \<open>\<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
+        using "Act-Basic:2"[THEN "\<equiv>E"(1), THEN "&E"(2)] by blast
+    next
+      AOT_assume \<open>\<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
+      AOT_hence \<open>\<^bold>\<A>x = x & \<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
+        using "id-eq:1" "&I" "RA[2]" by blast
+      AOT_hence \<open>\<^bold>\<A>(x = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "act-conj-act:3" "Act-Basic:2" "\<equiv>E" by blast
+      moreover AOT_have \<open>\<forall>z (\<^bold>\<A>(z = x & \<exists>H (x[H] & \<not>[H]x)) \<rightarrow> z = x)\<close>
+      proof(safe intro!: GEN "\<rightarrow>I")
+        fix z
+        AOT_assume \<open>\<^bold>\<A>(z = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        AOT_hence \<open>\<^bold>\<A>(z = x)\<close>
+          using "Act-Basic:2"[THEN "\<equiv>E"(1), THEN "&E"(1)] by blast
+        AOT_thus \<open>z = x\<close>
+           by (metis "id-act:1" "intro-elim:3:b")
+      qed
+      ultimately AOT_show \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<exists>I"(2) by fast
+    qed
+    finally AOT_show \<open>(\<^bold>\<A>[G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<^bold>\<A>\<exists>H (x[H] & \<not>[H]x))\<close>.
+  qed
+
+  AOT_assume A: \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+  AOT_hence \<open>\<^bold>\<A>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+    using "exist-nec" "\<rightarrow>E" "nec-imp-act"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<^bold>\<A>([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down> &
+                \<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x)))\<close>
+    using Lemma "Act-Basic:2"[THEN "\<equiv>E"(2)] "&I" by blast
+  moreover AOT_have \<open>\<^bold>\<A>([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down> &
+                \<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x)))
+      \<rightarrow> \<^bold>\<A>\<exists>p (p & \<not>p)\<close>
+  proof (rule "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(1)];
+         rule "RA[2]"; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      AOT_assume 0: \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down> &
+                \<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
+      AOT_have \<open>\<exists>F \<forall>x ([F]x \<equiv> \<exists>G (x[G] & \<not>[G]x))\<close>
+      proof(rule "\<exists>I"(1))
+        AOT_show \<open>\<forall>x ([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]x \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
+        proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I" "\<beta>\<leftarrow>C" dest!: "\<beta>\<rightarrow>C")
+          fix x
+          AOT_assume \<open>[G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+          AOT_thus \<open>\<exists>H (x[H] & \<not>[H]x)\<close>
+            using 0 "&E" "\<forall>E"(2) "\<equiv>E"(1) by blast
+        next
+          fix x
+          AOT_assume \<open>\<exists>H (x[H] & \<not>[H]x)\<close>
+          AOT_thus \<open>[G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
+            using 0 "&E" "\<forall>E"(2) "\<equiv>E"(2) by blast
+        qed(auto intro!: 0[THEN "&E"(1)] "cqt:2")
+      next
+        AOT_show \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+          using 0 "&E"(1) by blast
+      qed
+      AOT_thus \<open>\<exists>p (p & \<not>p)\<close>
+        using "block-paradox:2" "reductio-aa:1" by blast
+    }
+  qed
+  ultimately AOT_have \<open>\<^bold>\<A>\<exists>p (p & \<not>p)\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<exists>p \<^bold>\<A>(p & \<not>p)\<close>
+    by (metis "Act-Basic:10" "intro-elim:3:a")
+  then AOT_obtain p where \<open>\<^bold>\<A>(p & \<not>p)\<close>
+    using "\<exists>E"[rotated] by blast
+  moreover AOT_have \<open>\<not>\<^bold>\<A>(p & \<not>p)\<close>
+    using "non-contradiction"[THEN "RA[2]"]
+    by (meson "Act-Sub:1" "\<not>\<not>I" "intro-elim:3:d")
+  ultimately AOT_show \<open>p & \<not>p\<close> for p
+    by (metis "raa-cor:3")
+qed
+
+AOT_act_theorem "block-paradox2:2":
+  \<open>\<exists>G \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+proof(rule "\<exists>I"(1))
+  AOT_have 0: \<open>[\<lambda>x \<forall>p (p \<rightarrow>p)]\<down>\<close>
+    by "cqt:2[lambda]"
+  moreover AOT_have \<open>\<forall>x [\<lambda>x \<forall>p (p \<rightarrow>p)]x\<close>
+    apply (rule GEN)
+    apply (rule "beta-C-cor:2"[THEN "\<rightarrow>E", OF 0, THEN "\<forall>E"(2), THEN "\<equiv>E"(2)])
+    using "if-p-then-p" GEN by fast
+  moreover AOT_have \<open>\<forall>G (\<forall>x [G]x \<rightarrow> \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>)\<close>
+      using "block-paradox2:1" "\<forall>I" by fast
+  ultimately AOT_show \<open>\<not>[\<lambda>x [\<lambda>x \<forall>p (p \<rightarrow>p)]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
+    using "\<forall>E"(1) "\<rightarrow>E" by blast
+qed("cqt:2[lambda]")
+
+AOT_theorem propositions: \<open>\<exists>p \<box>(p \<equiv> \<phi>)\<close>
+proof(rule "\<exists>I"(1))
+  AOT_show \<open>\<box>(\<phi> \<equiv> \<phi>)\<close>
+    by (simp add: RN "oth-class-taut:3:a")
+next
+  AOT_show \<open>\<phi>\<down>\<close>
+    by (simp add: "log-prop-prop:2")
+qed
+
+AOT_theorem "pos-not-equiv-ne:1":
+  \<open>(\<diamond>\<not>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)) \<rightarrow> F \<noteq> G\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>\<not>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)\<close>
+  AOT_hence \<open>\<not>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)\<close>
+    using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+  AOT_hence \<open>\<not>(F = G)\<close>
+    using "id-rel-nec-equiv:1" "modus-tollens:1" by blast
+  AOT_thus \<open>F \<noteq> G\<close>
+    using "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+AOT_theorem "pos-not-equiv-ne:2": \<open>(\<diamond>\<not>(\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> F \<noteq> G\<close>
+proof (rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_have \<open>\<not>(\<phi>{F} \<equiv> \<phi>{G}) \<rightarrow> \<not>(F = G)\<close>
+    proof (rule "\<rightarrow>I"; rule "raa-cor:2")
+      AOT_assume 1: \<open>F = G\<close>
+      AOT_hence \<open>\<phi>{F} \<rightarrow> \<phi>{G}\<close>
+        using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
+      moreover {
+        AOT_have \<open>G = F\<close>
+          using 1 id_sym by blast
+        AOT_hence \<open>\<phi>{G} \<rightarrow> \<phi>{F}\<close>
+          using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
+      }
+      ultimately AOT_have \<open>\<phi>{F} \<equiv> \<phi>{G}\<close>
+        using "\<equiv>I" by blast
+      moreover AOT_assume \<open>\<not>(\<phi>{F} \<equiv> \<phi>{G})\<close>
+      ultimately AOT_show \<open>(\<phi>{F} \<equiv> \<phi>{G}) & \<not>(\<phi>{F} \<equiv> \<phi>{G})\<close>
+        using "&I" by blast
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<not>(\<phi>{F} \<equiv> \<phi>{G}) \<rightarrow> \<diamond>\<not>(F = G)\<close>
+    using "RM:2[prem]" by blast
+  moreover AOT_assume \<open>\<diamond>\<not>(\<phi>{F} \<equiv> \<phi>{G})\<close>
+  ultimately AOT_have 0: \<open>\<diamond>\<not>(F = G)\<close> using "\<rightarrow>E" by blast
+  AOT_have \<open>\<diamond>(F \<noteq> G)\<close>
+    by (AOT_subst \<open>F \<noteq> G\<close> \<open>\<not>(F = G)\<close>)
+       (auto simp: "=-infix" "\<equiv>Df" 0)
+  AOT_thus \<open>F \<noteq> G\<close>
+    using "id-nec2:3"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "pos-not-equiv-ne:2[zero]": \<open>(\<diamond>\<not>(\<phi>{p} \<equiv> \<phi>{q})) \<rightarrow> p \<noteq> q\<close>
+proof (rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_have \<open>\<not>(\<phi>{p} \<equiv> \<phi>{q}) \<rightarrow> \<not>(p = q)\<close>
+    proof (rule "\<rightarrow>I"; rule "raa-cor:2")
+      AOT_assume 1: \<open>p = q\<close>
+      AOT_hence \<open>\<phi>{p} \<rightarrow> \<phi>{q}\<close>
+        using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
+      moreover {
+        AOT_have \<open>q = p\<close>
+          using 1 id_sym by blast
+        AOT_hence \<open>\<phi>{q} \<rightarrow> \<phi>{p}\<close>
+          using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
+      }
+      ultimately AOT_have \<open>\<phi>{p} \<equiv> \<phi>{q}\<close>
+        using "\<equiv>I" by blast
+      moreover AOT_assume \<open>\<not>(\<phi>{p} \<equiv> \<phi>{q})\<close>
+      ultimately AOT_show \<open>(\<phi>{p} \<equiv> \<phi>{q}) & \<not>(\<phi>{p} \<equiv> \<phi>{q})\<close>
+        using "&I" by blast
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<not>(\<phi>{p} \<equiv> \<phi>{q}) \<rightarrow> \<diamond>\<not>(p = q)\<close>
+    using "RM:2[prem]" by blast
+  moreover AOT_assume \<open>\<diamond>\<not>(\<phi>{p} \<equiv> \<phi>{q})\<close>
+  ultimately AOT_have 0: \<open>\<diamond>\<not>(p = q)\<close> using "\<rightarrow>E" by blast
+  AOT_have \<open>\<diamond>(p \<noteq> q)\<close>
+    by (AOT_subst \<open>p \<noteq> q\<close> \<open>\<not>(p = q)\<close>)
+       (auto simp: 0 "=-infix" "\<equiv>Df")
+  AOT_thus \<open>p \<noteq> q\<close>
+    using "id-nec2:3"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "pos-not-equiv-ne:3":
+  \<open>(\<not>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)) \<rightarrow> F \<noteq> G\<close>
+  using "\<rightarrow>I" "pos-not-equiv-ne:1"[THEN "\<rightarrow>E"] "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+
+AOT_theorem "pos-not-equiv-ne:4": \<open>(\<not>(\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> F \<noteq> G\<close>
+  using "\<rightarrow>I" "pos-not-equiv-ne:2"[THEN "\<rightarrow>E"] "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+
+AOT_theorem "pos-not-equiv-ne:4[zero]": \<open>(\<not>(\<phi>{p} \<equiv> \<phi>{q})) \<rightarrow> p \<noteq> q\<close>
+  using "\<rightarrow>I" "pos-not-equiv-ne:2[zero]"[THEN "\<rightarrow>E"]
+        "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+
+AOT_define relation_negation :: "\<Pi> \<Rightarrow> \<Pi>" ("_\<^sup>-")
+  "df-relation-negation": "[F]\<^sup>- =\<^sub>d\<^sub>f [\<lambda>x\<^sub>1...x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n]"
+
+nonterminal \<phi>neg
+syntax "" :: "\<phi>neg \<Rightarrow> \<tau>" ("_")
+syntax "" :: "\<phi>neg \<Rightarrow> \<phi>" ("'(_')")
+
+AOT_define relation_negation_0 :: \<open>\<phi> \<Rightarrow> \<phi>neg\<close> ("'(_')\<^sup>-")
+  "df-relation-negation[zero]": "(p)\<^sup>- =\<^sub>d\<^sub>f [\<lambda> \<not>p]"
+
+AOT_theorem "rel-neg-T:1": \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<not>[\<Pi>]x\<^sub>1...x\<^sub>n]\<down>\<close>
+  by "cqt:2[lambda]"
+
+AOT_theorem "rel-neg-T:1[zero]": \<open>[\<lambda> \<not>\<phi>]\<down>\<close>
+  using "cqt:2[lambda0]"[axiom_inst] by blast
+
+AOT_theorem "rel-neg-T:2": \<open>[\<Pi>]\<^sup>- = [\<lambda>x\<^sub>1...x\<^sub>n \<not>[\<Pi>]x\<^sub>1...x\<^sub>n]\<close>
+  using "=I"(1)[OF "rel-neg-T:1"]
+  by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF "rel-neg-T:1"])
+
+AOT_theorem "rel-neg-T:2[zero]": \<open>(\<phi>)\<^sup>- = [\<lambda> \<not>\<phi>]\<close>
+  using "=I"(1)[OF "rel-neg-T:1[zero]"]
+  by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation[zero]", OF "rel-neg-T:1[zero]"])
+
+AOT_theorem "rel-neg-T:3": \<open>[\<Pi>]\<^sup>-\<down>\<close>
+  using "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF "rel-neg-T:1"]
+        "rel-neg-T:1" by blast
+
+AOT_theorem "rel-neg-T:3[zero]": \<open>(\<phi>)\<^sup>-\<down>\<close>
+  using "log-prop-prop:2" by blast
+
+AOT_theorem "thm-relation-negation:1": \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n \<equiv> \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+proof -
+  AOT_have \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n \<equiv> [\<lambda>x\<^sub>1...x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+    using "rule=E"[rotated, OF "rel-neg-T:2"]
+          "rule=E"[rotated, OF "rel-neg-T:2"[THEN id_sym]]
+          "\<rightarrow>I" "\<equiv>I" by fast
+  also AOT_have \<open>... \<equiv> \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+    using "beta-C-meta"[THEN "\<rightarrow>E", OF "rel-neg-T:1"] by fast
+  finally show ?thesis.
+qed
+
+AOT_theorem "thm-relation-negation:2": \<open>\<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n \<equiv> [F]x\<^sub>1...x\<^sub>n\<close>
+  apply (AOT_subst \<open>[F]x\<^sub>1...x\<^sub>n\<close> \<open>\<not>\<not>[F]x\<^sub>1...x\<^sub>n\<close>)
+   apply (simp add: "oth-class-taut:3:b")
+  apply (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
+  using "thm-relation-negation:1".
+
+AOT_theorem "thm-relation-negation:3": \<open>((p)\<^sup>-) \<equiv> \<not>p\<close>
+proof -
+  AOT_have \<open>(p)\<^sup>- = [\<lambda> \<not>p]\<close> using "rel-neg-T:2[zero]" by blast
+  AOT_hence \<open>((p)\<^sup>-) \<equiv> [\<lambda> \<not>p]\<close>
+    using "df-relation-negation[zero]" "log-prop-prop:2"
+          "oth-class-taut:3:a" "rule-id-df:2:a" by blast
+  also AOT_have \<open>[\<lambda> \<not>p] \<equiv> \<not>p\<close>
+    by (simp add: "propositions-lemma:2")
+  finally show ?thesis.
+qed
+
+AOT_theorem "thm-relation-negation:4": \<open>(\<not>((p)\<^sup>-)) \<equiv> p\<close>
+  using "thm-relation-negation:3"[THEN "\<equiv>E"(1)]
+        "thm-relation-negation:3"[THEN "\<equiv>E"(2)]
+        "\<equiv>I" "\<rightarrow>I" RAA by metis
+
+AOT_theorem "thm-relation-negation:5": \<open>[F] \<noteq> [F]\<^sup>-\<close>
+proof -
+  AOT_have \<open>\<not>([F] = [F]\<^sup>-)\<close>
+  proof (rule RAA(2))
+    AOT_show \<open>[F]x\<^sub>1...x\<^sub>n \<rightarrow> [F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
+      using "if-p-then-p".
+  next
+    AOT_assume \<open>[F] = [F]\<^sup>-\<close>
+    AOT_hence \<open>[F]\<^sup>- = [F]\<close> using id_sym by blast
+    AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n \<equiv> \<not>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
+      using "rule=E" "thm-relation-negation:1" by fast
+    AOT_thus \<open>\<not>([F]x\<^sub>1...x\<^sub>n \<rightarrow> [F]x\<^sub>1...x\<^sub>n)\<close> for x\<^sub>1x\<^sub>n
+      using "\<equiv>E" RAA by metis
+  qed
+  thus ?thesis
+    using "\<equiv>\<^sub>d\<^sub>fI" "=-infix" by blast
+qed
+
+AOT_theorem "thm-relation-negation:6": \<open>p \<noteq> (p)\<^sup>-\<close>
+proof -
+  AOT_have \<open>\<not>(p = (p)\<^sup>-)\<close>
+  proof (rule RAA(2))
+    AOT_show \<open>p \<rightarrow> p\<close>
+      using "if-p-then-p".
+  next
+    AOT_assume \<open>p = (p)\<^sup>-\<close>
+    AOT_hence \<open>(p)\<^sup>- = p\<close> using id_sym by blast
+    AOT_hence \<open>p \<equiv> \<not>p\<close>
+      using "rule=E" "thm-relation-negation:3" by fast
+    AOT_thus \<open>\<not>(p \<rightarrow> p)\<close>
+      using "\<equiv>E" RAA by metis
+  qed
+  thus ?thesis
+    using "\<equiv>\<^sub>d\<^sub>fI" "=-infix" by blast
+qed
+
+AOT_theorem "thm-relation-negation:7": \<open>(p)\<^sup>- = (\<not>p)\<close>
+  apply (rule "df-relation-negation[zero]"[THEN "=\<^sub>d\<^sub>fE"(1)])
+  using "cqt:2[lambda0]"[axiom_inst] "rel-neg-T:2[zero]"
+        "propositions-lemma:1" id_trans by blast+
+
+AOT_theorem "thm-relation-negation:8": \<open>p = q \<rightarrow> (\<not>p) = (\<not>q)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>p = q\<close>
+  moreover AOT_have \<open>(\<not>p)\<down>\<close> using "log-prop-prop:2".
+  moreover AOT_have \<open>(\<not>p) = (\<not>p)\<close> using calculation(2) "=I" by blast
+  ultimately AOT_show \<open>(\<not>p) = (\<not>q)\<close>
+    using "rule=E" by fast
+qed
+
+AOT_theorem "thm-relation-negation:9": \<open>p = q \<rightarrow> (p)\<^sup>- = (q)\<^sup>-\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>p = q\<close>
+  AOT_hence \<open>(\<not>p) = (\<not>q)\<close> using "thm-relation-negation:8" "\<rightarrow>E" by blast
+  AOT_thus \<open>(p)\<^sup>- = (q)\<^sup>-\<close>
+    using "thm-relation-negation:7" id_sym id_trans by metis
+qed
+
+AOT_define Necessary :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> ("Necessary'(_')")
+  "contingent-properties:1":
+  \<open>Necessary([F]) \<equiv>\<^sub>d\<^sub>f \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close>
+
+AOT_define Necessary0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("Necessary0'(_')")
+  "contingent-properties:1[zero]":
+  \<open>Necessary0(p) \<equiv>\<^sub>d\<^sub>f \<box>p\<close>
+
+AOT_define Impossible :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> ("Impossible'(_')")
+  "contingent-properties:2":
+  \<open>Impossible([F]) \<equiv>\<^sub>d\<^sub>f F\<down> & \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+
+AOT_define Impossible0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("Impossible0'(_')")
+  "contingent-properties:2[zero]":
+  \<open>Impossible0(p) \<equiv>\<^sub>d\<^sub>f \<box>\<not>p\<close>
+
+AOT_define NonContingent :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> ("NonContingent'(_')")
+  "contingent-properties:3":
+  \<open>NonContingent([F]) \<equiv>\<^sub>d\<^sub>f Necessary([F]) \<or> Impossible([F])\<close>
+
+AOT_define NonContingent0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("NonContingent0'(_')")
+  "contingent-properties:3[zero]":
+  \<open>NonContingent0(p) \<equiv>\<^sub>d\<^sub>f Necessary0(p) \<or> Impossible0(p)\<close>
+
+AOT_define Contingent :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> ("Contingent'(_')")
+  "contingent-properties:4":
+  \<open>Contingent([F]) \<equiv>\<^sub>d\<^sub>f F\<down> & \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
+
+AOT_define Contingent0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("Contingent0'(_')")
+  "contingent-properties:4[zero]":
+  \<open>Contingent0(p) \<equiv>\<^sub>d\<^sub>f \<not>(Necessary0(p) \<or> Impossible0(p))\<close>
+
+
+AOT_theorem "thm-cont-prop:1": \<open>NonContingent([F]) \<equiv> NonContingent([F]\<^sup>-)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>NonContingent([F])\<close>
+  AOT_hence \<open>Necessary([F]) \<or> Impossible([F])\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:3"] by blast
+  moreover {
+    AOT_assume \<open>Necessary([F])\<close>
+    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n)\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:1"] by blast
+    moreover AOT_modally_strict {
+      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
+      AOT_hence \<open>\<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
+        by (meson "\<equiv>E"(6) "oth-class-taut:3:a"
+                  "thm-relation-negation:2" "\<equiv>E"(1))
+      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
+    }
+    ultimately AOT_have \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
+      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<guillemotright>}", simplified] by blast
+    AOT_hence \<open>Impossible([F]\<^sup>-)\<close>
+      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
+                  OF "rel-neg-T:3", THEN "\<equiv>E"(2)]
+      by blast
+  }
+  moreover {
+    AOT_assume \<open>Impossible([F])\<close>
+    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n)\<close>
+      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
+                  OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(1)]
+      by blast
+    moreover AOT_modally_strict {
+      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>\<not>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
+      AOT_hence \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
+        by (meson "\<equiv>E"(6) "oth-class-taut:3:a"
+                  "thm-relation-negation:1" "\<equiv>E"(1))
+      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
+    }
+    ultimately AOT_have \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
+      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<guillemotright>}"] by blast
+    AOT_hence \<open>Necessary([F]\<^sup>-)\<close>
+      using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:1"] by blast
+  }
+  ultimately AOT_have \<open>Necessary([F]\<^sup>-) \<or> Impossible([F]\<^sup>-)\<close>
+    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
+  AOT_thus \<open>NonContingent([F]\<^sup>-)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:3"] by blast
+next
+  AOT_assume \<open>NonContingent([F]\<^sup>-)\<close>
+  AOT_hence \<open>Necessary([F]\<^sup>-) \<or> Impossible([F]\<^sup>-)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:3"] by blast
+  moreover {
+    AOT_assume \<open>Necessary([F]\<^sup>-)\<close>
+    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:1"] by blast
+    moreover AOT_modally_strict {
+      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
+      AOT_hence \<open>\<not>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
+        by (meson "\<equiv>E"(6) "oth-class-taut:3:a"
+                  "thm-relation-negation:1" "\<equiv>E"(2))
+      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
+    }
+    ultimately AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n\<guillemotright>}"] by blast
+    AOT_hence \<open>Impossible([F])\<close>
+      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
+                  OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(2)]
+      by blast
+  }
+  moreover {
+    AOT_assume \<open>Impossible([F]\<^sup>-)\<close>
+    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
+      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
+                  OF "rel-neg-T:3", THEN "\<equiv>E"(1)]
+      by blast
+    moreover AOT_modally_strict {
+      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>\<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
+      AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n 
+        using "thm-relation-negation:1"[THEN
+                "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(1)]
+              "useful-tautologies:1"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
+    }
+    ultimately AOT_have \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n)\<close>
+      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<guillemotright>}"] by blast
+    AOT_hence \<open>Necessary([F])\<close>
+      using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:1"] by blast
+  }
+  ultimately AOT_have \<open>Necessary([F]) \<or> Impossible([F])\<close>
+    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
+  AOT_thus \<open>NonContingent([F])\<close>
+    using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:3"] by blast
+qed
+
+AOT_theorem "thm-cont-prop:2": \<open>Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x\<close>
+proof -
+  AOT_have \<open>Contingent([F]) \<equiv> \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
+    using "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
+                                    OF "cqt:2[const_var]"[axiom_inst]]
+    by blast
+  also AOT_have \<open>... \<equiv> \<not>Necessary([F]) & \<not>Impossible([F])\<close>
+    using "oth-class-taut:5:d" by fastforce
+  also AOT_have \<open>... \<equiv> \<not>Impossible([F]) & \<not>Necessary([F])\<close>
+    by (simp add: "Commutativity of &")
+  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]x & \<not>Necessary([F])\<close>
+  proof (rule "oth-class-taut:4:e"[THEN "\<rightarrow>E"])
+    AOT_have \<open>\<not>Impossible([F]) \<equiv> \<not>\<box>\<not> \<exists>x [F]x\<close>
+      apply (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
+      apply (AOT_subst \<open>\<exists>x [F]x\<close> \<open>\<not> \<forall>x \<not>[F]x\<close>)
+       apply (simp add: "conventions:4" "\<equiv>Df")
+      apply (AOT_subst (reverse) \<open>\<not>\<not>\<forall>x \<not>[F]x\<close> \<open>\<forall>x \<not>[F]x\<close>)
+       apply (simp add: "oth-class-taut:3:b")
+      using "contingent-properties:2"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
+                                      OF "cqt:2[const_var]"[axiom_inst]]
+      by blast
+    also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]x\<close>
+      using "conventions:5"[THEN "\<equiv>Df", symmetric] by blast
+    finally AOT_show \<open>\<not>Impossible([F]) \<equiv> \<diamond>\<exists>x [F]x\<close> .
+  qed
+  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x\<close>
+  proof (rule "oth-class-taut:4:f"[THEN "\<rightarrow>E"])
+    AOT_have \<open>\<not>Necessary([F]) \<equiv> \<not>\<box>\<not>\<exists>x \<not>[F]x\<close>
+      apply (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
+      apply (AOT_subst \<open>\<exists>x \<not>[F]x\<close> \<open>\<not> \<forall>x \<not>\<not>[F]x\<close>)
+       apply (simp add: "conventions:4" "\<equiv>Df")
+      apply (AOT_subst (reverse) \<open>\<not>\<not>[F]x\<close> \<open>[F]x\<close> for: x)
+       apply (simp add: "oth-class-taut:3:b")
+      apply (AOT_subst (reverse) \<open>\<not>\<not>\<forall>x [F]x\<close> \<open>\<forall>x [F]x\<close>)
+      by (auto simp: "oth-class-taut:3:b" "contingent-properties:1" "\<equiv>Df")
+    also AOT_have \<open>... \<equiv> \<diamond>\<exists>x \<not>[F]x\<close>
+      using "conventions:5"[THEN "\<equiv>Df", symmetric] by blast
+    finally AOT_show \<open>\<not>Necessary([F]) \<equiv> \<diamond>\<exists>x \<not>[F]x\<close>.
+  qed
+  finally show ?thesis.
+qed
+
+AOT_theorem "thm-cont-prop:3":
+  \<open>Contingent([F]) \<equiv> Contingent([F]\<^sup>-)\<close> for F::\<open><\<kappa>> AOT_var\<close>
+proof -
+  {
+    fix \<Pi> :: \<open><\<kappa>>\<close>
+    AOT_assume \<open>\<Pi>\<down>\<close>
+    moreover AOT_have \<open>\<forall>F (Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x)\<close>
+      using "thm-cont-prop:2" GEN by fast
+    ultimately  AOT_have \<open>Contingent([\<Pi>]) \<equiv> \<diamond>\<exists>x [\<Pi>]x & \<diamond>\<exists>x \<not>[\<Pi>]x\<close>
+      using "thm-cont-prop:2" "\<forall>E" by fast
+  } note 1 = this
+  AOT_have \<open>Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x\<close>
+    using "thm-cont-prop:2" by blast
+  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x \<not>[F]x & \<diamond>\<exists>x [F]x\<close>
+    by (simp add: "Commutativity of &")
+  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]\<^sup>-x & \<diamond>\<exists>x [F]x\<close>
+    by (AOT_subst \<open>[F]\<^sup>-x\<close> \<open>\<not>[F]x\<close> for: x)
+       (auto simp: "thm-relation-negation:1" "oth-class-taut:3:a")
+  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]\<^sup>-x & \<diamond>\<exists>x \<not>[F]\<^sup>-x\<close>
+    by (AOT_subst (reverse) \<open>[F]x\<close> \<open>\<not>[F]\<^sup>-x\<close> for: x)
+       (auto simp: "thm-relation-negation:2" "oth-class-taut:3:a")
+  also AOT_have \<open>... \<equiv> Contingent([F]\<^sup>-)\<close>
+    using 1[OF "rel-neg-T:3", symmetric] by blast
+  finally show ?thesis.
+qed
+
+AOT_define concrete_if_concrete :: \<open>\<Pi>\<close> ("L")
+  L_def: \<open>L =\<^sub>d\<^sub>f [\<lambda>x E!x \<rightarrow> E!x]\<close>
+
+AOT_theorem "thm-noncont-e-e:1": \<open>Necessary(L)\<close>
+proof -
+  AOT_modally_strict {
+    fix x
+    AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close> by "cqt:2[lambda]"
+    moreover AOT_have \<open>x\<down>\<close> using "cqt:2[const_var]"[axiom_inst] by blast
+    moreover AOT_have \<open>E!x \<rightarrow> E!x\<close> using "if-p-then-p" by blast
+    ultimately AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]x\<close>
+      using "\<beta>\<leftarrow>C" by blast
+  }
+  AOT_hence 0: \<open>\<box>\<forall>x [\<lambda>x E!x \<rightarrow> E!x]x\<close>
+    using RN GEN by blast
+  show ?thesis
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
+     apply "cqt:2[lambda]"
+    by (rule "contingent-properties:1"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF 0])
+qed
+
+AOT_theorem "thm-noncont-e-e:2": \<open>Impossible([L]\<^sup>-)\<close>
+proof -
+  AOT_modally_strict {
+    fix x
+
+    AOT_have 0: \<open>\<forall>F (\<not>[F]\<^sup>-x \<equiv> [F]x)\<close>
+      using "thm-relation-negation:2" GEN by fast
+    AOT_have \<open>\<not>[\<lambda>x E!x \<rightarrow> E!x]\<^sup>-x \<equiv> [\<lambda>x E!x \<rightarrow> E!x]x\<close>
+      by (rule 0[THEN "\<forall>E"(1)]) "cqt:2[lambda]"
+    moreover {
+      AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close> by "cqt:2[lambda]"
+      moreover AOT_have \<open>x\<down>\<close> using "cqt:2[const_var]"[axiom_inst] by blast
+      moreover AOT_have \<open>E!x \<rightarrow> E!x\<close> using "if-p-then-p" by blast
+      ultimately AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]x\<close>
+        using "\<beta>\<leftarrow>C" by blast
+    }
+    ultimately AOT_have \<open>\<not>[\<lambda>x E!x \<rightarrow> E!x]\<^sup>-x\<close>
+      using "\<equiv>E" by blast
+  }
+  AOT_hence 0: \<open>\<box>\<forall>x \<not>[\<lambda>x E!x \<rightarrow> E!x]\<^sup>-x\<close>
+    using RN GEN by fast
+  show ?thesis
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
+     apply "cqt:2[lambda]"
+    apply (rule "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "&I")
+     using "rel-neg-T:3"
+     apply blast
+    using 0
+    by blast
+qed
+
+AOT_theorem "thm-noncont-e-e:3": \<open>NonContingent(L)\<close>
+  using "thm-noncont-e-e:1"
+  by (rule "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "\<or>I"(1)])
+
+AOT_theorem "thm-noncont-e-e:4": \<open>NonContingent([L]\<^sup>-)\<close>
+proof -
+  AOT_have 0: \<open>\<forall>F (NonContingent([F]) \<equiv> NonContingent([F]\<^sup>-))\<close>
+    using "thm-cont-prop:1" "\<forall>I" by fast
+  moreover AOT_have 1: \<open>L\<down>\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+  AOT_show \<open>NonContingent([L]\<^sup>-)\<close>
+    using "\<forall>E"(1)[OF 0, OF 1, THEN "\<equiv>E"(1), OF "thm-noncont-e-e:3"] by blast
+qed
+
+AOT_theorem "thm-noncont-e-e:5":
+  \<open>\<exists>F \<exists>G (F \<noteq> \<guillemotleft>G::<\<kappa>>\<guillemotright> & NonContingent([F]) & NonContingent([G]))\<close>
+proof (rule "\<exists>I")+
+  {
+    AOT_have \<open>\<forall>F [F] \<noteq> [F]\<^sup>-\<close>
+      using "thm-relation-negation:5" GEN by fast
+    moreover AOT_have \<open>L\<down>\<close>
+      by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+    ultimately AOT_have \<open>L \<noteq> [L]\<^sup>-\<close>
+      using "\<forall>E" by blast
+  }
+  AOT_thus \<open>L \<noteq> [L]\<^sup>- & NonContingent(L) & NonContingent([L]\<^sup>-)\<close>
+    using "thm-noncont-e-e:3" "thm-noncont-e-e:4" "&I" by metis
+next
+  AOT_show \<open>[L]\<^sup>-\<down>\<close>
+    using "rel-neg-T:3" by blast
+next
+  AOT_show \<open>L\<down>\<close>
+      by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+qed
+
+AOT_theorem "lem-cont-e:1": \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
+proof -
+  AOT_have \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<exists>x \<diamond>([F]x & \<diamond>\<not>[F]x)\<close>
+    using "BF\<diamond>" "CBF\<diamond>" "\<equiv>I" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<exists>x (\<diamond>[F]x &  \<diamond>\<not>[F]x)\<close>
+    by (AOT_subst \<open>\<diamond>([F]x & \<diamond>\<not>[F]x)\<close> \<open>\<diamond>[F]x &  \<diamond>\<not>[F]x\<close> for: x)
+       (auto simp: "S5Basic:11" "cqt-further:7")
+  also AOT_have \<open>\<dots> \<equiv> \<exists>x (\<diamond>\<not>[F]x & \<diamond>[F]x)\<close>
+    by (AOT_subst \<open>\<diamond>\<not>[F]x & \<diamond>[F]x\<close>  \<open>\<diamond>[F]x & \<diamond>\<not>[F]x\<close> for: x)
+       (auto simp: "Commutativity of &" "cqt-further:7")
+  also AOT_have \<open>\<dots> \<equiv> \<exists>x \<diamond>(\<not>[F]x & \<diamond>[F]x)\<close>
+    by (AOT_subst \<open>\<diamond>(\<not>[F]x & \<diamond>[F]x)\<close> \<open>\<diamond>\<not>[F]x & \<diamond>[F]x\<close> for: x)
+       (auto simp: "S5Basic:11" "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
+    using "BF\<diamond>" "CBF\<diamond>" "\<equiv>I" by fast
+  finally show ?thesis.
+qed
+
+AOT_theorem "lem-cont-e:2":
+  \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x ([F]\<^sup>-x & \<diamond>\<not>[F]\<^sup>-x)\<close>
+proof -
+  AOT_have \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
+    using "lem-cont-e:1".
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<exists>x ([F]\<^sup>-x & \<diamond>\<not>[F]\<^sup>-x)\<close>
+    apply (AOT_subst \<open>\<not>[F]\<^sup>-x\<close> \<open>[F]x\<close> for: x)
+     apply (simp add: "thm-relation-negation:2")
+    apply (AOT_subst \<open>[F]\<^sup>-x\<close> \<open>\<not>[F]x\<close> for: x)
+     apply (simp add: "thm-relation-negation:1")
+    by (simp add: "oth-class-taut:3:a")
+  finally show ?thesis.
+qed
+
+AOT_theorem "thm-cont-e:1": \<open>\<diamond>\<exists>x (E!x & \<diamond>\<not>E!x)\<close>
+proof (rule "CBF\<diamond>"[THEN "\<rightarrow>E"])
+  AOT_have \<open>\<exists>x \<diamond>(E!x & \<not>\<^bold>\<A>E!x)\<close>
+    using "qml:4"[axiom_inst] "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
+  then AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>E!a)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<theta>: \<open>\<diamond>E!a & \<diamond>\<not>\<^bold>\<A>E!a\<close>
+    using "KBasic2:3"[THEN "\<rightarrow>E"] by blast
+  AOT_have \<xi>: \<open>\<diamond>E!a & \<diamond>\<^bold>\<A>\<not>E!a\<close>
+    by (AOT_subst  \<open>\<^bold>\<A>\<not>E!a\<close> \<open>\<not>\<^bold>\<A>E!a\<close>)
+       (auto simp: "logic-actual-nec:1"[axiom_inst] \<theta>)
+  AOT_have \<zeta>: \<open>\<diamond>E!a & \<^bold>\<A>\<not>E!a\<close>
+    by (AOT_subst \<open>\<^bold>\<A>\<not>E!a\<close> \<open>\<diamond>\<^bold>\<A>\<not>E!a\<close>)
+       (auto simp add: "Act-Sub:4" \<xi>)
+  AOT_hence \<open>\<diamond>E!a & \<diamond>\<not>E!a\<close>
+    using "&E" "&I" "Act-Sub:3"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<diamond>(E!a & \<diamond>\<not>E!a)\<close>
+    using "S5Basic:11"[THEN "\<equiv>E"(2)] by simp
+  AOT_thus \<open>\<exists>x \<diamond>(E!x & \<diamond>\<not>E!x)\<close>
+    using "\<exists>I"(2) by fast
+qed
+
+AOT_theorem "thm-cont-e:2": \<open>\<diamond>\<exists>x (\<not>E!x & \<diamond>E!x)\<close>
+proof -
+  AOT_have \<open>\<forall>F (\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x))\<close>
+    using "lem-cont-e:1" GEN by fast
+  AOT_hence \<open>(\<diamond>\<exists>x (E!x & \<diamond>\<not>E!x) \<equiv> \<diamond>\<exists>x (\<not>E!x & \<diamond>E!x))\<close>
+    using "\<forall>E"(2) by blast
+  thus ?thesis using "thm-cont-e:1" "\<equiv>E" by blast
+qed
+
+AOT_theorem "thm-cont-e:3": \<open>\<diamond>\<exists>x E!x\<close>
+proof (rule "CBF\<diamond>"[THEN "\<rightarrow>E"])
+  AOT_obtain a where \<open>\<diamond>(E!a & \<diamond>\<not>E!a)\<close>
+    using "\<exists>E"[rotated, OF "thm-cont-e:1"[THEN "BF\<diamond>"[THEN "\<rightarrow>E"]]] by blast
+  AOT_hence \<open>\<diamond>E!a\<close>
+    using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)] by blast
+  AOT_thus \<open>\<exists>x \<diamond>E!x\<close> using "\<exists>I" by fast
+qed
+
+AOT_theorem "thm-cont-e:4": \<open>\<diamond>\<exists>x \<not>E!x\<close>
+proof (rule "CBF\<diamond>"[THEN "\<rightarrow>E"])
+  AOT_obtain a where \<open>\<diamond>(E!a & \<diamond>\<not>E!a)\<close>
+    using "\<exists>E"[rotated, OF "thm-cont-e:1"[THEN "BF\<diamond>"[THEN "\<rightarrow>E"]]] by blast
+  AOT_hence \<open>\<diamond>\<diamond>\<not>E!a\<close>
+    using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast
+  AOT_hence \<open>\<diamond>\<not>E!a\<close>
+    using "4\<diamond>"[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<exists>x \<diamond>\<not>E!x\<close> using "\<exists>I" by fast
+qed
+
+AOT_theorem "thm-cont-e:5": \<open>Contingent([E!])\<close>
+proof -
+  AOT_have \<open>\<forall>F (Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x)\<close>
+    using "thm-cont-prop:2" GEN by fast
+  AOT_hence \<open>Contingent([E!]) \<equiv> \<diamond>\<exists>x E!x & \<diamond>\<exists>x \<not>E!x\<close>
+    using "\<forall>E"(2) by blast
+  thus ?thesis
+    using "thm-cont-e:3" "thm-cont-e:4" "\<equiv>E"(2) "&I" by blast
+qed
+
+AOT_theorem "thm-cont-e:6": \<open>Contingent([E!]\<^sup>-)\<close>
+proof -
+  AOT_have \<open>\<forall>F (Contingent([\<guillemotleft>F::<\<kappa>>\<guillemotright>]) \<equiv> Contingent([F]\<^sup>-))\<close>
+    using "thm-cont-prop:3" GEN by fast
+  AOT_hence \<open>Contingent([E!]) \<equiv> Contingent([E!]\<^sup>-)\<close>
+    using "\<forall>E"(2) by fast
+  thus ?thesis using "thm-cont-e:5" "\<equiv>E" by blast
+qed
+
+AOT_theorem "thm-cont-e:7":
+  \<open>\<exists>F\<exists>G (Contingent([\<guillemotleft>F::<\<kappa>>\<guillemotright>]) & Contingent([G]) & F \<noteq> G)\<close>
+proof (rule "\<exists>I")+
+  AOT_have \<open>\<forall>F [\<guillemotleft>F::<\<kappa>>\<guillemotright>] \<noteq> [F]\<^sup>-\<close>
+    using "thm-relation-negation:5" GEN by fast
+  AOT_hence \<open>[E!] \<noteq> [E!]\<^sup>-\<close>
+    using "\<forall>E" by fast
+  AOT_thus \<open>Contingent([E!]) & Contingent([E!]\<^sup>-) & [E!] \<noteq> [E!]\<^sup>-\<close>
+    using "thm-cont-e:5" "thm-cont-e:6" "&I" by metis
+next
+  AOT_show \<open>E!\<^sup>-\<down>\<close>
+    by (fact AOT)
+qed("cqt:2")
+
+AOT_theorem "property-facts:1":
+  \<open>NonContingent([F]) \<rightarrow> \<not>\<exists>G (Contingent([G]) & G = F)\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume \<open>NonContingent([F])\<close>
+  AOT_hence 1: \<open>Necessary([F]) \<or> Impossible([F])\<close>
+    using "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_assume \<open>\<exists>G (Contingent([G]) & G = F)\<close>
+  then AOT_obtain G where \<open>Contingent([G]) & G = F\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>Contingent([F])\<close> using "rule=E" "&E" by blast
+  AOT_hence \<open>\<not>(Necessary([F]) \<or> Impossible([F]))\<close>
+    using "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
+            OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(1)] by blast
+  AOT_thus \<open>(Necessary([F]) \<or> Impossible([F])) &
+            \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
+    using 1 "&I" by blast
+qed
+
+AOT_theorem "property-facts:2":
+  \<open>Contingent([F]) \<rightarrow> \<not>\<exists>G (NonContingent([G]) & G = F)\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume \<open>Contingent([F])\<close>
+  AOT_hence 1: \<open>\<not>(Necessary([F]) \<or> Impossible([F]))\<close>
+    using "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
+            OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(1)] by blast
+  AOT_assume \<open>\<exists>G (NonContingent([G]) & G = F)\<close>
+  then AOT_obtain G where \<open>NonContingent([G]) & G = F\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>NonContingent([F])\<close>
+    using "rule=E" "&E" by blast
+  AOT_hence \<open>Necessary([F]) \<or> Impossible([F])\<close>
+    using "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_thus \<open>(Necessary([F]) \<or> Impossible([F])) &
+            \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
+    using 1 "&I" by blast
+qed
+
+AOT_theorem "property-facts:3":
+  \<open>L \<noteq> [L]\<^sup>- & L \<noteq> E! & L \<noteq> E!\<^sup>- & [L]\<^sup>- \<noteq> [E!]\<^sup>- & E! \<noteq> [E!]\<^sup>-\<close>
+proof -
+  AOT_have noneqI: \<open>\<Pi> \<noteq> \<Pi>'\<close> if \<open>\<phi>{\<Pi>}\<close> and \<open>\<not>\<phi>{\<Pi>'}\<close> for \<phi> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+    apply (rule "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "raa-cor:2")
+    using "rule=E"[where \<phi>=\<phi> and \<tau>=\<Pi> and \<sigma> = \<Pi>'] that "&I" by blast
+  AOT_have contingent_denotes: \<open>\<Pi>\<down>\<close> if \<open>Contingent([\<Pi>])\<close> for \<Pi> :: \<open><\<kappa>>\<close>
+    using that "contingent-properties:4"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)] by blast
+  AOT_have not_noncontingent_if_contingent:
+    \<open>\<not>NonContingent([\<Pi>])\<close> if \<open>Contingent([\<Pi>])\<close> for \<Pi> :: \<open><\<kappa>>\<close>
+  proof(rule RAA(2))
+    AOT_show \<open>\<not>(Necessary([\<Pi>]) \<or> Impossible([\<Pi>]))\<close>
+      using that "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
+                    OF contingent_denotes[OF that], THEN "\<equiv>E"(1)]
+      by blast
+  next
+    AOT_assume \<open>NonContingent([\<Pi>])\<close>
+    AOT_thus \<open>Necessary([\<Pi>]) \<or> Impossible([\<Pi>])\<close>
+      using "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  qed
+
+  show ?thesis
+  proof (safe intro!: "&I")
+    AOT_show \<open>L \<noteq> [L]\<^sup>-\<close>
+      apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
+       apply "cqt:2[lambda]"
+      apply (rule "\<forall>E"(1)[where \<phi>="\<lambda> \<Pi> . \<guillemotleft>\<Pi> \<noteq> [\<Pi>]\<^sup>-\<guillemotright>"])
+       apply (rule GEN) apply (fact AOT)
+      by "cqt:2[lambda]"
+  next
+    AOT_show \<open>L \<noteq> E!\<close>
+      apply (rule noneqI)
+      using "thm-noncont-e-e:3"
+            not_noncontingent_if_contingent[OF "thm-cont-e:5"]
+      by auto
+  next
+    AOT_show \<open>L \<noteq> E!\<^sup>-\<close>
+      apply (rule noneqI)
+      using "thm-noncont-e-e:3" apply fast
+      apply (rule not_noncontingent_if_contingent)
+      apply (rule "\<forall>E"(1)[
+            where \<phi>="\<lambda> \<Pi> . \<guillemotleft>Contingent([\<Pi>]) \<equiv> Contingent([\<Pi>]\<^sup>-)\<guillemotright>",
+            rotated, OF contingent_denotes, THEN "\<equiv>E"(1), rotated])
+      using "thm-cont-prop:3" GEN apply fast
+      using "thm-cont-e:5" by fast+
+  next
+    AOT_show \<open>[L]\<^sup>- \<noteq> E!\<^sup>-\<close>
+      apply (rule noneqI)
+      using "thm-noncont-e-e:4" apply fast
+      apply (rule not_noncontingent_if_contingent)
+      apply (rule "\<forall>E"(1)[
+            where \<phi>="\<lambda> \<Pi> . \<guillemotleft>Contingent([\<Pi>]) \<equiv> Contingent([\<Pi>]\<^sup>-)\<guillemotright>",
+            rotated, OF contingent_denotes, THEN "\<equiv>E"(1), rotated])
+      using "thm-cont-prop:3" GEN apply fast
+      using "thm-cont-e:5" by fast+
+  next
+    AOT_show \<open>E! \<noteq> E!\<^sup>-\<close>
+      apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
+       apply "cqt:2[lambda]"
+      apply (rule "\<forall>E"(1)[where \<phi>="\<lambda> \<Pi> . \<guillemotleft>\<Pi> \<noteq> [\<Pi>]\<^sup>-\<guillemotright>"])
+       apply (rule GEN) apply (fact AOT)
+      by "cqt:2"
+  qed
+qed
+
+AOT_theorem "thm-cont-propos:1":
+  \<open>NonContingent0(p) \<equiv> NonContingent0(((p)\<^sup>-))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>NonContingent0(p)\<close>
+  AOT_hence \<open>Necessary0(p) \<or> Impossible0(p)\<close>
+    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  moreover {
+    AOT_assume \<open>Necessary0(p)\<close>
+    AOT_hence 1: \<open>\<box>p\<close>
+      using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+    AOT_have \<open>\<box>\<not>((p)\<^sup>-)\<close>
+      by (AOT_subst \<open>\<not>((p)\<^sup>-)\<close> \<open>p\<close>)
+         (auto simp add: 1 "thm-relation-negation:4")
+    AOT_hence \<open>Impossible0(((p)\<^sup>-))\<close>
+      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  }
+  moreover {
+    AOT_assume \<open>Impossible0(p)\<close>
+    AOT_hence 1: \<open>\<box>\<not>p\<close>
+      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+    AOT_have \<open>\<box>((p)\<^sup>-)\<close>
+      by (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>) 
+         (auto simp: 1 "thm-relation-negation:3")
+    AOT_hence \<open>Necessary0(((p)\<^sup>-))\<close>
+      by (rule "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  }
+  ultimately AOT_have \<open>Necessary0(((p)\<^sup>-)) \<or> Impossible0(((p)\<^sup>-))\<close>
+    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
+  AOT_thus \<open>NonContingent0(((p)\<^sup>-))\<close>
+    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+next
+  AOT_assume \<open>NonContingent0(((p)\<^sup>-))\<close>
+  AOT_hence \<open>Necessary0(((p)\<^sup>-)) \<or> Impossible0(((p)\<^sup>-))\<close>
+    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  moreover {
+    AOT_assume \<open>Impossible0(((p)\<^sup>-))\<close>
+    AOT_hence 1: \<open>\<box>\<not>((p)\<^sup>-)\<close>
+      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+    AOT_have \<open>\<box>p\<close>
+      by (AOT_subst (reverse) \<open>p\<close> \<open>\<not>((p)\<^sup>-)\<close>)
+         (auto simp: 1 "thm-relation-negation:4")
+    AOT_hence \<open>Necessary0(p)\<close>
+      using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+  }
+  moreover {
+    AOT_assume \<open>Necessary0(((p)\<^sup>-))\<close>
+    AOT_hence 1: \<open>\<box>((p)\<^sup>-)\<close>
+      by (rule "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+    AOT_have \<open>\<box>\<not>p\<close>
+      by (AOT_subst (reverse) \<open>\<not>p\<close> \<open>((p)\<^sup>-)\<close>)
+         (auto simp: 1 "thm-relation-negation:3")
+    AOT_hence \<open>Impossible0(p)\<close>
+      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  }
+  ultimately AOT_have \<open>Necessary0(p) \<or> Impossible0(p)\<close>
+    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
+  AOT_thus \<open>NonContingent0(p)\<close>
+    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+AOT_theorem "thm-cont-propos:2": \<open>Contingent0(\<phi>) \<equiv> \<diamond>\<phi> & \<diamond>\<not>\<phi>\<close>
+proof -
+  AOT_have \<open>Contingent0(\<phi>) \<equiv> \<not>(Necessary0(\<phi>) \<or> Impossible0(\<phi>))\<close>
+    using "contingent-properties:4[zero]"[THEN "\<equiv>Df"] by simp
+  also AOT_have \<open>\<dots> \<equiv> \<not>Necessary0(\<phi>) & \<not>Impossible0(\<phi>)\<close>
+    by (fact AOT)
+  also AOT_have \<open>\<dots> \<equiv> \<not>Impossible0(\<phi>) & \<not>Necessary0(\<phi>)\<close>
+    by (fact AOT)
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<phi> & \<diamond>\<not>\<phi>\<close>
+    apply (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>)
+     apply (simp add: "conventions:5" "\<equiv>Df")
+    apply (AOT_subst \<open>Impossible0(\<phi>)\<close> \<open>\<box>\<not>\<phi>\<close>)
+     apply (simp add: "contingent-properties:2[zero]" "\<equiv>Df")
+    apply (AOT_subst (reverse) \<open>\<diamond>\<not>\<phi>\<close> \<open>\<not>\<box>\<phi>\<close>)
+     apply (simp add: "KBasic:11")
+    apply (AOT_subst \<open>Necessary0(\<phi>)\<close> \<open>\<box>\<phi>\<close>)
+     apply (simp add: "contingent-properties:1[zero]" "\<equiv>Df")
+    by (simp add: "oth-class-taut:3:a")
+  finally show ?thesis.
+qed
+
+AOT_theorem "thm-cont-propos:3": \<open>Contingent0(p) \<equiv> Contingent0(((p)\<^sup>-))\<close>
+proof -
+  AOT_have \<open>Contingent0(p) \<equiv> \<diamond>p & \<diamond>\<not>p\<close> using "thm-cont-propos:2".
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<not>p & \<diamond>p\<close> by (fact AOT)
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>((p)\<^sup>-) & \<diamond>p\<close>
+    by (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>)
+       (auto simp: "thm-relation-negation:3" "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>((p)\<^sup>-) & \<diamond>\<not>((p)\<^sup>-)\<close>
+    by (AOT_subst \<open>\<not>((p)\<^sup>-)\<close> \<open>p\<close>)
+       (auto simp: "thm-relation-negation:4" "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> Contingent0(((p)\<^sup>-))\<close>
+    using "thm-cont-propos:2"[symmetric] by blast
+  finally show ?thesis.
+qed
+
+AOT_define noncontingent_prop :: \<open>\<phi>\<close> ("p\<^sub>0")
+  p\<^sub>0_def: "(p\<^sub>0) =\<^sub>d\<^sub>f (\<forall>x (E!x \<rightarrow> E!x))"
+
+AOT_theorem "thm-noncont-propos:1":  \<open>Necessary0((p\<^sub>0))\<close>
+proof(rule "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_show \<open>\<box>(p\<^sub>0)\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF p\<^sub>0_def])
+    using "log-prop-prop:2" apply simp
+    using "if-p-then-p" RN GEN by fast
+qed
+
+AOT_theorem "thm-noncont-propos:2": \<open>Impossible0(((p\<^sub>0)\<^sup>-))\<close>
+proof(rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_show \<open>\<box>\<not>((p\<^sub>0)\<^sup>-)\<close>
+    apply (AOT_subst \<open>((p\<^sub>0)\<^sup>-)\<close> \<open>\<not>p\<^sub>0\<close>)
+    using "thm-relation-negation:3" GEN "\<forall>E"(1)[rotated, OF "log-prop-prop:2"]
+     apply fast
+    apply (AOT_subst (reverse) \<open>\<not>\<not>p\<^sub>0\<close> \<open>p\<^sub>0\<close>)
+     apply (simp add: "oth-class-taut:3:b")
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF p\<^sub>0_def])
+    using "log-prop-prop:2" apply simp
+    using "if-p-then-p" RN GEN by fast
+qed
+
+AOT_theorem "thm-noncont-propos:3": \<open>NonContingent0((p\<^sub>0))\<close>
+  apply(rule "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  using "thm-noncont-propos:1" "\<or>I" by blast
+
+AOT_theorem "thm-noncont-propos:4": \<open>NonContingent0(((p\<^sub>0)\<^sup>-))\<close>
+  apply(rule "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  using "thm-noncont-propos:2" "\<or>I" by blast
+
+AOT_theorem "thm-noncont-propos:5":
+  \<open>\<exists>p\<exists>q (NonContingent0((p)) & NonContingent0((q)) & p \<noteq> q)\<close>
+proof(rule "\<exists>I")+
+  AOT_have 0: \<open>\<phi> \<noteq> (\<phi>)\<^sup>-\<close> for \<phi>
+    using "thm-relation-negation:6" "\<forall>I"
+          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
+  AOT_thus \<open>NonContingent0((p\<^sub>0)) & NonContingent0(((p\<^sub>0)\<^sup>-)) & (p\<^sub>0) \<noteq> (p\<^sub>0)\<^sup>-\<close>
+    using "thm-noncont-propos:3" "thm-noncont-propos:4" "&I" by auto
+qed(auto simp: "log-prop-prop:2")
+
+AOT_act_theorem "no-cnac": \<open>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
+  then AOT_obtain a where a: \<open>E!a & \<not>\<^bold>\<A>E!a\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<^bold>\<A>\<not>E!a\<close>
+    using "&E" "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
+  AOT_hence \<open>\<not>E!a\<close>
+    using "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>E!a & \<not>E!a\<close>
+    using a "&E" "&I" by blast
+  AOT_thus \<open>p & \<not>p\<close> for p using "raa-cor:1" by blast
+qed
+
+AOT_theorem "pos-not-pna:1": \<open>\<not>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+  AOT_hence \<open>\<exists>x \<^bold>\<A>(E!x & \<not>\<^bold>\<A>E!x)\<close>
+    using "Act-Basic:10"[THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain a where \<open>\<^bold>\<A>(E!a & \<not>\<^bold>\<A>E!a)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence 1: \<open>\<^bold>\<A>E!a & \<^bold>\<A>\<not>\<^bold>\<A>E!a\<close>
+    using "Act-Basic:2"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<not>\<^bold>\<A>\<^bold>\<A>E!a\<close>
+    using "&E"(2) "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<not>\<^bold>\<A>E!a\<close>
+    using "logic-actual-nec:4"[axiom_inst, THEN "\<equiv>E"(1)] RAA by blast
+  AOT_thus \<open>p & \<not>p\<close> for p using 1[THEN "&E"(1)] "&I" "raa-cor:1" by blast
+qed
+
+AOT_theorem "pos-not-pna:2": \<open>\<diamond>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
+proof (rule RAA(1))
+  AOT_show \<open>\<not>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+    using "pos-not-pna:1" by blast
+next
+  AOT_assume \<open>\<not>\<diamond>\<not>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+  AOT_hence \<open>\<box>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+    using "KBasic:12"[THEN "\<equiv>E"(2)] by blast
+  AOT_thus \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+    using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "pos-not-pna:3": \<open>\<exists>x (\<diamond>E!x & \<not>\<^bold>\<A>E!x)\<close>
+proof -
+  AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>E!a)\<close>
+    using "qml:4"[axiom_inst] "BF\<diamond>"[THEN "\<rightarrow>E"] "\<exists>E"[rotated] by blast
+  AOT_hence \<theta>: \<open>\<diamond>E!a\<close> and \<xi>: \<open>\<diamond>\<not>\<^bold>\<A>E!a\<close>
+    using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" by blast+
+  AOT_have \<open>\<not>\<box>\<^bold>\<A>E!a\<close>
+    using \<xi> "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+  AOT_hence \<open>\<not>\<^bold>\<A>E!a\<close>
+    using "Act-Basic:6"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                        THEN "\<equiv>E"(2)] by blast
+  AOT_hence \<open>\<diamond>E!a & \<not>\<^bold>\<A>E!a\<close> using \<theta> "&I" by blast
+  thus ?thesis using "\<exists>I" by fast
+qed
+
+AOT_define contingent_prop :: \<phi> ("q\<^sub>0")
+  q\<^sub>0_def: \<open>(q\<^sub>0) =\<^sub>d\<^sub>f (\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
+
+AOT_theorem q\<^sub>0_prop: \<open>\<diamond>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
+  apply (fact "log-prop-prop:2")
+  apply (rule "&I")
+   apply (fact "qml:4"[axiom_inst])
+  by (fact "pos-not-pna:2")
+
+AOT_theorem "basic-prop:1": \<open>Contingent0((q\<^sub>0))\<close>
+proof(rule "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_have \<open>\<not>Necessary0((q\<^sub>0)) & \<not>Impossible0((q\<^sub>0))\<close>
+  proof (rule "&I";
+         rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def];
+         (rule "log-prop-prop:2" | rule "raa-cor:2"))
+    AOT_assume \<open>Necessary0(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
+    AOT_hence \<open>\<box>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+      using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+    AOT_hence \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+      using "Act-Basic:8"[THEN "\<rightarrow>E"] "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+    AOT_thus \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x) & \<not>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
+      using "pos-not-pna:1" "&I" by blast
+  next
+    AOT_assume \<open>Impossible0(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
+    AOT_hence \<open>\<box>\<not>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
+      using "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+    AOT_hence \<open>\<not>\<diamond>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
+      using "KBasic2:1"[THEN "\<equiv>E"(1)] by blast
+    AOT_thus \<open>\<diamond>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x)) & \<not>\<diamond>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
+      using "qml:4"[axiom_inst] "&I" by blast
+  qed
+  AOT_thus \<open>\<not>(Necessary0((q\<^sub>0)) \<or> Impossible0((q\<^sub>0)))\<close>
+    using "oth-class-taut:5:d" "\<equiv>E"(2) by blast
+qed
+
+AOT_theorem "basic-prop:2": \<open>\<exists>p Contingent0((p))\<close>
+  using "\<exists>I"(1)[rotated, OF "log-prop-prop:2"] "basic-prop:1" by blast
+
+AOT_theorem "basic-prop:3": \<open>Contingent0(((q\<^sub>0)\<^sup>-))\<close>
+  apply (AOT_subst \<open>((q\<^sub>0)\<^sup>-)\<close> \<open>\<not>q\<^sub>0\<close>)
+   apply (insert "thm-relation-negation:3" "\<forall>I"
+                "\<forall>E"(1)[rotated, OF "log-prop-prop:2"]; fast)
+  apply (rule "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  apply (rule "oth-class-taut:5:d"[THEN "\<equiv>E"(2)])
+  apply (rule "&I")
+   apply (rule "contingent-properties:1[zero]"[THEN "df-rules-formulas[3]",
+                  THEN "useful-tautologies:5"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
+   apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+   apply (rule "=\<^sub>d\<^sub>fE"(2)[OF q\<^sub>0_def])
+    apply (rule "log-prop-prop:2")
+   apply (rule q\<^sub>0_prop[THEN "&E"(1)])
+  apply (rule "contingent-properties:2[zero]"[THEN "df-rules-formulas[3]",
+                THEN "useful-tautologies:5"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
+  apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  by (rule q\<^sub>0_prop[THEN "&E"(2)])
+
+AOT_theorem "basic-prop:4":
+  \<open>\<exists>p\<exists>q (p \<noteq> q & Contingent0(p) & Contingent0(q))\<close>
+proof(rule "\<exists>I")+
+  AOT_have 0: \<open>\<phi> \<noteq> (\<phi>)\<^sup>-\<close> for \<phi>
+    using "thm-relation-negation:6" "\<forall>I"
+          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
+  AOT_show \<open>(q\<^sub>0) \<noteq> (q\<^sub>0)\<^sup>- & Contingent0(q\<^sub>0) & Contingent0(((q\<^sub>0)\<^sup>-))\<close>
+    using "basic-prop:1" "basic-prop:3" "&I" 0 by presburger
+qed(auto simp: "log-prop-prop:2")
+
+AOT_theorem "proposition-facts:1":
+  \<open>NonContingent0(p) \<rightarrow> \<not>\<exists>q (Contingent0(q) & q = p)\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume \<open>NonContingent0(p)\<close>
+  AOT_hence 1: \<open>Necessary0(p) \<or> Impossible0(p)\<close>
+    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_assume \<open>\<exists>q (Contingent0(q) & q = p)\<close>
+  then AOT_obtain q where \<open>Contingent0(q) & q = p\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>Contingent0(p)\<close>
+    using "rule=E" "&E" by fast
+  AOT_thus \<open>(Necessary0(p) \<or> Impossible0(p)) &
+            \<not>(Necessary0(p) \<or> Impossible0(p))\<close>
+    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] 1 "&I" by blast
+qed
+
+AOT_theorem "proposition-facts:2":
+  \<open>Contingent0(p) \<rightarrow> \<not>\<exists>q (NonContingent0(q) & q = p)\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume \<open>Contingent0(p)\<close>
+  AOT_hence 1: \<open>\<not>(Necessary0(p) \<or> Impossible0(p))\<close>
+    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_assume \<open>\<exists>q (NonContingent0(q) & q = p)\<close>
+  then AOT_obtain q where \<open>NonContingent0(q) & q = p\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>NonContingent0(p)\<close>
+    using "rule=E" "&E" by fast
+  AOT_thus \<open>(Necessary0(p) \<or> Impossible0(p)) &
+            \<not>(Necessary0(p) \<or> Impossible0(p))\<close>
+    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] 1 "&I" by blast
+qed
+
+AOT_theorem "proposition-facts:3":
+  \<open>(p\<^sub>0) \<noteq> (p\<^sub>0)\<^sup>- & (p\<^sub>0) \<noteq> (q\<^sub>0) & (p\<^sub>0) \<noteq> (q\<^sub>0)\<^sup>- & (p\<^sub>0)\<^sup>- \<noteq> (q\<^sub>0)\<^sup>- & (q\<^sub>0) \<noteq> (q\<^sub>0)\<^sup>-\<close>
+proof -
+  {
+    fix \<chi> \<phi> \<psi>
+    AOT_assume \<open>\<chi>{\<phi>}\<close>
+    moreover AOT_assume \<open>\<not>\<chi>{\<psi>}\<close>
+    ultimately AOT_have \<open>\<not>(\<chi>{\<phi>} \<equiv> \<chi>{\<psi>})\<close>
+      using RAA "\<equiv>E" by metis
+    moreover {
+      AOT_have \<open>\<forall>p\<forall>q ((\<not>(\<chi>{p} \<equiv> \<chi>{q})) \<rightarrow> p \<noteq> q)\<close>
+        by (rule "\<forall>I"; rule "\<forall>I"; rule "pos-not-equiv-ne:4[zero]")
+      AOT_hence \<open>((\<not>(\<chi>{\<phi>} \<equiv> \<chi>{\<psi>})) \<rightarrow> \<phi> \<noteq> \<psi>)\<close>
+        using "\<forall>E" "log-prop-prop:2" by blast
+    }
+    ultimately AOT_have \<open>\<phi> \<noteq> \<psi>\<close>
+      using "\<rightarrow>E" by blast
+  } note 0 = this
+  AOT_have contingent_neg: \<open>Contingent0(\<phi>) \<equiv> Contingent0(((\<phi>)\<^sup>-))\<close> for \<phi>
+    using "thm-cont-propos:3" "\<forall>I"
+          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
+  AOT_have not_noncontingent_if_contingent:
+    \<open>\<not>NonContingent0(\<phi>)\<close> if \<open>Contingent0(\<phi>)\<close> for \<phi>
+    apply (rule "contingent-properties:3[zero]"[THEN "\<equiv>Df",
+                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
+    using that "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  show ?thesis
+    apply (rule "&I")+
+    using "thm-relation-negation:6" "\<forall>I"
+          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"]
+        apply fast
+       apply (rule 0)
+    using "thm-noncont-propos:3" apply fast
+       apply (rule not_noncontingent_if_contingent)
+       apply (fact AOT)
+      apply (rule 0)
+    apply (rule "thm-noncont-propos:3")
+      apply (rule not_noncontingent_if_contingent)
+      apply (rule contingent_neg[THEN "\<equiv>E"(1)])
+      apply (fact AOT)
+     apply (rule 0)
+    apply (rule "thm-noncont-propos:4")
+      apply (rule not_noncontingent_if_contingent)
+      apply (rule contingent_neg[THEN "\<equiv>E"(1)])
+     apply (fact AOT)
+    using "thm-relation-negation:6" "\<forall>I"
+          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
+qed
+
+AOT_define ContingentlyTrue :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("ContingentlyTrue'(_')")
+  "cont-tf:1": \<open>ContingentlyTrue(p) \<equiv>\<^sub>d\<^sub>f p & \<diamond>\<not>p\<close>
+
+AOT_define ContingentlyFalse :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("ContingentlyFalse'(_')")
+  "cont-tf:2": \<open>ContingentlyFalse(p) \<equiv>\<^sub>d\<^sub>f \<not>p & \<diamond>p\<close>
+
+AOT_theorem "cont-true-cont:1":
+  \<open>ContingentlyTrue((p)) \<rightarrow> Contingent0((p))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>ContingentlyTrue((p))\<close>
+  AOT_hence 1: \<open>p\<close> and 2: \<open>\<diamond>\<not>p\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>\<not>Necessary0((p))\<close>
+    apply (rule "contingent-properties:1[zero]"[THEN "\<equiv>Df",
+                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
+    using 2 "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+  moreover AOT_have \<open>\<not>Impossible0((p))\<close>
+    apply (rule "contingent-properties:2[zero]"[THEN "\<equiv>Df",
+                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
+    apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+    using "T\<diamond>"[THEN "\<rightarrow>E", OF 1].
+  ultimately AOT_have \<open>\<not>(Necessary0((p)) \<or> Impossible0((p)))\<close>
+    using DeMorgan(2)[THEN "\<equiv>E"(2)] "&I" by blast
+  AOT_thus \<open>Contingent0((p))\<close>
+    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+AOT_theorem "cont-true-cont:2":
+  \<open>ContingentlyFalse((p)) \<rightarrow> Contingent0((p))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>ContingentlyFalse((p))\<close>
+  AOT_hence 1: \<open>\<not>p\<close> and 2: \<open>\<diamond>p\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>\<not>Necessary0((p))\<close>
+    apply (rule "contingent-properties:1[zero]"[THEN "\<equiv>Df",
+                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
+    using "KBasic:11"[THEN "\<equiv>E"(2)] "T\<diamond>"[THEN "\<rightarrow>E", OF 1] by blast
+  moreover AOT_have \<open>\<not>Impossible0((p))\<close>
+    apply (rule "contingent-properties:2[zero]"[THEN "\<equiv>Df",
+                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
+    apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+    using 2.
+  ultimately AOT_have \<open>\<not>(Necessary0((p)) \<or> Impossible0((p)))\<close>
+    using DeMorgan(2)[THEN "\<equiv>E"(2)] "&I" by blast
+  AOT_thus \<open>Contingent0((p))\<close>
+    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+AOT_theorem "cont-true-cont:3":
+  \<open>ContingentlyTrue((p)) \<equiv> ContingentlyFalse(((p)\<^sup>-))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>ContingentlyTrue((p))\<close>
+  AOT_hence 0: \<open>p & \<diamond>\<not>p\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_have 1: \<open>ContingentlyFalse(\<not>p)\<close>
+    apply (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    apply (AOT_subst (reverse) \<open>\<not>\<not>p\<close> p)
+    by (auto simp: "oth-class-taut:3:b" 0)
+  AOT_show \<open>ContingentlyFalse(((p)\<^sup>-))\<close>
+    apply (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>)
+    by (auto simp: "thm-relation-negation:3" 1)
+next
+  AOT_assume 1: \<open>ContingentlyFalse(((p)\<^sup>-))\<close>
+  AOT_have \<open>ContingentlyFalse(\<not>p)\<close>
+    by (AOT_subst (reverse) \<open>\<not>p\<close> \<open>((p)\<^sup>-)\<close>)
+       (auto simp: "thm-relation-negation:3" 1)
+  AOT_hence \<open>\<not>\<not>p & \<diamond>\<not>p\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence \<open>p & \<diamond>\<not>p\<close>
+    using "&I" "&E" "useful-tautologies:1"[THEN "\<rightarrow>E"] by metis
+  AOT_thus \<open>ContingentlyTrue((p))\<close>
+    using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
+qed
+
+AOT_theorem "cont-true-cont:4":
+  \<open>ContingentlyFalse((p)) \<equiv> ContingentlyTrue(((p)\<^sup>-))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>ContingentlyFalse(p)\<close>
+  AOT_hence 0: \<open>\<not>p & \<diamond>p\<close>
+    using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_have \<open>\<not>p & \<diamond>\<not>\<not>p\<close>
+    by (AOT_subst (reverse) \<open>\<not>\<not>p\<close> p)
+       (auto simp: "oth-class-taut:3:b" 0)
+  AOT_hence 1: \<open>ContingentlyTrue(\<not>p)\<close>
+    by (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_show \<open>ContingentlyTrue(((p)\<^sup>-))\<close>
+    by (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>)
+       (auto simp: "thm-relation-negation:3" 1)
+next
+  AOT_assume 1: \<open>ContingentlyTrue(((p)\<^sup>-))\<close>
+  AOT_have \<open>ContingentlyTrue(\<not>p)\<close>
+    by (AOT_subst (reverse) \<open>\<not>p\<close> \<open>((p)\<^sup>-)\<close>)
+       (auto simp add: "thm-relation-negation:3" 1)
+  AOT_hence 2: \<open>\<not>p & \<diamond>\<not>\<not>p\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_have \<open>\<diamond>p\<close>
+    by (AOT_subst p \<open>\<not>\<not>p\<close>)
+       (auto simp add: "oth-class-taut:3:b" 2[THEN "&E"(2)])
+  AOT_hence \<open>\<not>p & \<diamond>p\<close> using 2[THEN "&E"(1)] "&I" by blast
+  AOT_thus \<open>ContingentlyFalse(p)\<close>
+    by (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+qed
+
+AOT_theorem "cont-true-cont:5":
+  \<open>(ContingentlyTrue((p)) & Necessary0((q))) \<rightarrow> p \<noteq> q\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:1")
+  AOT_assume \<open>ContingentlyTrue((p))\<close>
+  AOT_hence \<open>\<diamond>\<not>p\<close>
+    using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_hence 0: \<open>\<not>\<box>p\<close> using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+  AOT_assume \<open>Necessary0((q))\<close>
+  moreover AOT_assume \<open>\<not>(p \<noteq> q)\<close>
+  AOT_hence \<open>p = q\<close>
+    using "=-infix"[THEN "\<equiv>Df",
+                    THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                    THEN "\<equiv>E"(1)]
+          "useful-tautologies:1"[THEN "\<rightarrow>E"] by blast
+  ultimately AOT_have \<open>Necessary0((p))\<close> using "rule=E" id_sym by blast
+  AOT_hence \<open>\<box>p\<close>
+    using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_thus \<open>\<box>p & \<not>\<box>p\<close> using 0 "&I" by blast
+qed
+
+AOT_theorem "cont-true-cont:6":
+  \<open>(ContingentlyFalse((p)) & Impossible0((q))) \<rightarrow> p \<noteq> q\<close>
+proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:1")
+  AOT_assume \<open>ContingentlyFalse((p))\<close>
+  AOT_hence \<open>\<diamond>p\<close>
+    using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_hence 1: \<open>\<not>\<box>\<not>p\<close>
+    using "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_assume \<open>Impossible0((q))\<close>
+  moreover AOT_assume \<open>\<not>(p \<noteq> q)\<close>
+  AOT_hence \<open>p = q\<close>
+    using "=-infix"[THEN "\<equiv>Df",
+                    THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                    THEN "\<equiv>E"(1)]
+          "useful-tautologies:1"[THEN "\<rightarrow>E"] by blast
+  ultimately AOT_have \<open>Impossible0((p))\<close> using "rule=E" id_sym by blast
+  AOT_hence \<open>\<box>\<not>p\<close>
+    using "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_thus \<open>\<box>\<not>p & \<not>\<box>\<not>p\<close> using 1 "&I" by blast
+qed
+
+AOT_act_theorem "q0cf:1": \<open>ContingentlyFalse(q\<^sub>0)\<close>
+  apply (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
+   apply (fact "log-prop-prop:2")
+  apply (rule "&I")
+   apply (fact "no-cnac")
+  by (fact "qml:4"[axiom_inst])
+
+AOT_act_theorem "q0cf:2": \<open>ContingentlyTrue(((q\<^sub>0)\<^sup>-))\<close>
+  apply (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
+   apply (fact "log-prop-prop:2")
+  apply (rule "&I")
+   apply (rule "thm-relation-negation:3"
+                [unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)])
+     apply (fact "no-cnac")
+  apply (rule "rule=E"[rotated,
+                OF "thm-relation-negation:7"
+                   [unvarify p, OF "log-prop-prop:2", THEN id_sym]])
+  apply (AOT_subst (reverse) \<open>\<not>\<not>(\<exists>x  (E!x & \<not>\<^bold>\<A>E!x))\<close> \<open>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>)
+  by (auto simp: "oth-class-taut:3:b" "qml:4"[axiom_inst])
+
+AOT_theorem "cont-tf-thm:1": \<open>\<exists>p ContingentlyTrue((p))\<close>
+proof(rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I"; rule "\<exists>I")
+  AOT_assume \<open>q\<^sub>0\<close>
+  AOT_hence \<open>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(2)] "&I" by blast
+  AOT_thus \<open>ContingentlyTrue(q\<^sub>0)\<close>
+    by (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+next
+  AOT_assume \<open>\<not>q\<^sub>0\<close>
+  AOT_hence \<open>\<not>q\<^sub>0 & \<diamond>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(1)] "&I" by blast
+  AOT_hence \<open>ContingentlyFalse(q\<^sub>0)\<close>
+    by (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_thus \<open>ContingentlyTrue(((q\<^sub>0)\<^sup>-))\<close>
+    by (rule "cont-true-cont:4"[unvarify p,
+                OF "log-prop-prop:2", THEN "\<equiv>E"(1)])
+qed(auto simp: "log-prop-prop:2")
+
+
+AOT_theorem "cont-tf-thm:2": \<open>\<exists>p ContingentlyFalse((p))\<close>
+proof(rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I"; rule "\<exists>I")
+  AOT_assume \<open>q\<^sub>0\<close>
+  AOT_hence \<open>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(2)] "&I" by blast
+  AOT_hence \<open>ContingentlyTrue(q\<^sub>0)\<close>
+    by (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_thus \<open>ContingentlyFalse(((q\<^sub>0)\<^sup>-))\<close>
+    by (rule "cont-true-cont:3"[unvarify p,
+                OF "log-prop-prop:2", THEN "\<equiv>E"(1)])
+next
+  AOT_assume \<open>\<not>q\<^sub>0\<close>
+  AOT_hence \<open>\<not>q\<^sub>0 & \<diamond>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(1)] "&I" by blast
+  AOT_thus \<open>ContingentlyFalse(q\<^sub>0)\<close>
+    by (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+qed(auto simp: "log-prop-prop:2")
+
+AOT_theorem "property-facts1:1": \<open>\<exists>F\<exists>x ([F]x & \<diamond>\<not>[F]x)\<close>
+proof -
+  fix x
+  AOT_obtain p\<^sub>1 where \<open>ContingentlyTrue((p\<^sub>1))\<close>
+    using "cont-tf-thm:1" "\<exists>E"[rotated] by blast
+  AOT_hence 1: \<open>p\<^sub>1 & \<diamond>\<not>p\<^sub>1\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_modally_strict {
+    AOT_have \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> ([\<lambda>z p]x \<equiv> p)\<close>
+      by (rule "beta-C-cor:3"[THEN "\<forall>E"(2)]) cqt_2_lambda_inst_prover
+    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> \<box> ([\<lambda>z p]x \<equiv> p)\<close>
+      by (rule RN)
+    AOT_hence \<open>\<forall>p \<box>([\<lambda>z p]x \<equiv> p)\<close> using GEN by fast
+    AOT_hence \<open>\<box>([\<lambda>z p\<^sub>1]x \<equiv> p\<^sub>1)\<close> using "\<forall>E" by fast
+  } note 2 = this
+  AOT_hence \<open>\<box>([\<lambda>z p\<^sub>1]x \<equiv> p\<^sub>1)\<close> using "\<forall>E" by blast
+  AOT_hence \<open>[\<lambda>z p\<^sub>1]x\<close>
+    using 1[THEN "&E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(2) by blast
+  moreover AOT_have \<open>\<diamond>\<not>[\<lambda>z p\<^sub>1]x\<close>
+    using 2[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]]
+    apply (AOT_subst \<open>[\<lambda>z p\<^sub>1]x\<close> \<open>p\<^sub>1\<close>)
+    using 1[THEN "&E"(2)] by blast
+  ultimately AOT_have \<open>[\<lambda>z p\<^sub>1]x & \<diamond>\<not>[\<lambda>z p\<^sub>1]x\<close> using "&I" by blast
+  AOT_hence \<open>\<exists>x ([\<lambda>z p\<^sub>1]x & \<diamond>\<not>[\<lambda>z p\<^sub>1]x)\<close> using "\<exists>I"(2) by fast
+  moreover AOT_have \<open>[\<lambda>z p\<^sub>1]\<down>\<close> by "cqt:2[lambda]"
+  ultimately AOT_show \<open>\<exists>F\<exists>x ([F]x & \<diamond>\<not>[F]x)\<close> by (rule "\<exists>I"(1))
+qed
+
+AOT_theorem "property-facts1:2": \<open>\<exists>F\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
+proof -
+  fix x
+  AOT_obtain p\<^sub>1 where \<open>ContingentlyFalse((p\<^sub>1))\<close>
+    using "cont-tf-thm:2" "\<exists>E"[rotated] by blast
+  AOT_hence 1: \<open>\<not>p\<^sub>1 & \<diamond>p\<^sub>1\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_modally_strict {
+    AOT_have \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> ([\<lambda>z p]x \<equiv> p)\<close>
+      by (rule "beta-C-cor:3"[THEN "\<forall>E"(2)]) cqt_2_lambda_inst_prover
+    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> (\<not>[\<lambda>z p]x \<equiv> \<not>p)\<close>
+      using "oth-class-taut:4:b" "\<equiv>E" by blast
+    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> \<box>(\<not>[\<lambda>z p]x \<equiv> \<not>p)\<close>
+      by (rule RN)
+    AOT_hence \<open>\<forall>p \<box>(\<not>[\<lambda>z p]x \<equiv> \<not>p)\<close> using GEN by fast
+    AOT_hence \<open>\<box>(\<not>[\<lambda>z p\<^sub>1]x \<equiv> \<not>p\<^sub>1)\<close> using "\<forall>E" by fast
+  } note 2 = this
+  AOT_hence \<open>\<box>(\<not>[\<lambda>z p\<^sub>1]x \<equiv> \<not>p\<^sub>1)\<close> using "\<forall>E" by blast
+  AOT_hence 3: \<open>\<not>[\<lambda>z p\<^sub>1]x\<close>
+    using 1[THEN "&E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(2) by blast
+  AOT_modally_strict {
+    AOT_have \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> ([\<lambda>z p]x \<equiv> p)\<close>
+      by (rule "beta-C-cor:3"[THEN "\<forall>E"(2)]) cqt_2_lambda_inst_prover
+    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> \<box>([\<lambda>z p]x \<equiv> p)\<close>
+      by (rule RN)
+    AOT_hence \<open>\<forall>p \<box>([\<lambda>z p]x \<equiv> p)\<close> using GEN by fast
+    AOT_hence \<open>\<box>([\<lambda>z p\<^sub>1]x \<equiv> p\<^sub>1)\<close> using "\<forall>E" by fast
+  } note 4 = this
+  AOT_have \<open>\<diamond>[\<lambda>z p\<^sub>1]x\<close>
+    using 4[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]]
+    apply (AOT_subst \<open>[\<lambda>z p\<^sub>1]x\<close> \<open>p\<^sub>1\<close>)
+    using 1[THEN "&E"(2)] by blast
+  AOT_hence \<open>\<not>[\<lambda>z p\<^sub>1]x & \<diamond>[\<lambda>z p\<^sub>1]x\<close> using 3 "&I" by blast
+  AOT_hence \<open>\<exists>x (\<not>[\<lambda>z p\<^sub>1]x & \<diamond>[\<lambda>z p\<^sub>1]x)\<close> using "\<exists>I"(2) by fast
+  moreover AOT_have \<open>[\<lambda>z p\<^sub>1]\<down>\<close> by "cqt:2[lambda]"
+  ultimately AOT_show \<open>\<exists>F\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close> by (rule "\<exists>I"(1))
+qed
+
+context
+begin
+
+private AOT_lemma eqnotnec_123_Aux_\<zeta>: \<open>[L]x \<equiv> (E!x \<rightarrow> E!x)\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
+     apply "cqt:2[lambda]"
+    apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+  by "cqt:2[lambda]"
+
+private AOT_lemma eqnotnec_123_Aux_\<omega>: \<open>[\<lambda>z \<phi>]x \<equiv> \<phi>\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+
+private AOT_lemma eqnotnec_123_Aux_\<theta>: \<open>\<phi> \<equiv> \<forall>x([L]x \<equiv> [\<lambda>z \<phi>]x)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I"; (rule "\<forall>I")?)
+  fix x
+  AOT_assume 1: \<open>\<phi>\<close>
+  AOT_have \<open>[L]x \<equiv> (E!x \<rightarrow> E!x)\<close> using eqnotnec_123_Aux_\<zeta>.
+  also AOT_have \<open>\<dots> \<equiv> \<phi>\<close>
+    using "if-p-then-p" 1 "\<equiv>I" "\<rightarrow>I" by simp
+  also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<phi>]x\<close>
+    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] eqnotnec_123_Aux_\<omega> by blast
+  finally AOT_show \<open>[L]x \<equiv> [\<lambda>z \<phi>]x\<close>.
+next
+  fix x
+  AOT_assume \<open>\<forall>x([L]x \<equiv> [\<lambda>z \<phi>]x)\<close>
+  AOT_hence \<open>[L]x \<equiv> [\<lambda>z \<phi>]x\<close> using "\<forall>E" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<phi>\<close> using eqnotnec_123_Aux_\<omega>.
+  finally AOT_have \<open>\<phi> \<equiv> [L]x\<close>
+    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+  also AOT_have \<open>\<dots> \<equiv> E!x \<rightarrow> E!x\<close> using eqnotnec_123_Aux_\<zeta>.
+  finally AOT_show \<open>\<phi>\<close> using "\<equiv>E" "if-p-then-p" by fast
+qed
+private lemmas eqnotnec_123_Aux_\<xi> =
+  eqnotnec_123_Aux_\<theta>[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+    THEN "conventions:3"[THEN "\<equiv>Df", THEN "\<equiv>E"(1), THEN "&E"(1)],
+    THEN "RM\<diamond>"]
+private lemmas eqnotnec_123_Aux_\<xi>' =
+  eqnotnec_123_Aux_\<theta>[
+    THEN "conventions:3"[THEN "\<equiv>Df", THEN "\<equiv>E"(1), THEN "&E"(1)],
+    THEN "RM\<diamond>"]
+
+AOT_theorem "eqnotnec:1": \<open>\<exists>F\<exists>G(\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
+proof-
+  AOT_obtain p\<^sub>1 where \<open>ContingentlyTrue(p\<^sub>1)\<close>
+    using "cont-tf-thm:1" "\<exists>E"[rotated] by blast
+  AOT_hence \<open>p\<^sub>1 & \<diamond>\<not>p\<^sub>1\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence \<open>\<forall>x ([L]x \<equiv> [\<lambda>z p\<^sub>1]x) & \<diamond>\<not>\<forall>x([L]x \<equiv> [\<lambda>z p\<^sub>1]x)\<close>
+    apply - apply (rule "&I")
+    using "&E" eqnotnec_123_Aux_\<theta>[THEN "\<equiv>E"(1)]
+          eqnotnec_123_Aux_\<xi> "\<rightarrow>E" by fast+
+  AOT_hence \<open>\<exists>G (\<forall>x([L]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([L]x \<equiv> [G]x))\<close>
+    by (rule "\<exists>I") "cqt:2[lambda]"
+  AOT_thus \<open>\<exists>F\<exists>G (\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
+    apply (rule "\<exists>I")
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+qed
+
+AOT_theorem "eqnotnec:2": \<open>\<exists>F\<exists>G(\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+proof-
+  AOT_obtain p\<^sub>1 where \<open>ContingentlyFalse(p\<^sub>1)\<close>
+    using "cont-tf-thm:2" "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<not>p\<^sub>1 & \<diamond>p\<^sub>1\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence \<open>\<not>\<forall>x ([L]x \<equiv> [\<lambda>z p\<^sub>1]x) & \<diamond>\<forall>x([L]x \<equiv> [\<lambda>z p\<^sub>1]x)\<close>
+    apply - apply (rule "&I")
+    using eqnotnec_123_Aux_\<theta>[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                             THEN "\<equiv>E"(1)]
+          "&E" eqnotnec_123_Aux_\<xi>' "\<rightarrow>E" by fast+
+  AOT_hence \<open>\<exists>G (\<not>\<forall>x([L]x \<equiv> [G]x) & \<diamond>\<forall>x([L]x \<equiv> [G]x))\<close>
+    by (rule "\<exists>I") "cqt:2[lambda]"
+  AOT_thus \<open>\<exists>F\<exists>G (\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+    apply (rule "\<exists>I")
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+qed
+
+AOT_theorem "eqnotnec:3": \<open>\<exists>F\<exists>G(\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+proof-
+  AOT_have \<open>\<not>\<^bold>\<A>q\<^sub>0\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
+     apply (fact "log-prop-prop:2")
+    by (fact AOT)
+  AOT_hence \<open>\<^bold>\<A>\<not>q\<^sub>0\<close>
+    using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
+  AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x)\<close>
+    using eqnotnec_123_Aux_\<theta>[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+            THEN "conventions:3"[THEN "\<equiv>Df", THEN "\<equiv>E"(1), THEN "&E"(1)],
+            THEN "RA[2]", THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"] by blast
+  moreover AOT_have \<open>\<diamond>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x)\<close>
+    using eqnotnec_123_Aux_\<xi>'[THEN "\<rightarrow>E"] q\<^sub>0_prop[THEN "&E"(1)] by blast
+  ultimately AOT_have \<open>\<^bold>\<A>\<not>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x) & \<diamond>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x)\<close>
+    using "&I" by blast
+  AOT_hence \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x([L]x \<equiv> [G]x) & \<diamond>\<forall>x([L]x \<equiv> [G]x))\<close>
+    by (rule "\<exists>I") "cqt:2[lambda]"
+  AOT_thus \<open>\<exists>F\<exists>G (\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+    apply (rule "\<exists>I")
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+qed
+
+end
+
+AOT_theorem "eqnotnec:4": \<open>\<forall>F\<exists>G(\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
+proof(rule GEN)
+  fix F
+  AOT_have Aux_A: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<rightarrow> \<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi>]x)\<close> for \<psi>
+  proof(rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+    fix x
+    AOT_assume 0: \<open>\<psi>\<close>
+    AOT_have \<open>[\<lambda>z [F]z & \<psi>]x \<equiv> [F]x & \<psi>\<close>
+      by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+    also AOT_have \<open>... \<equiv> [F]x\<close>
+      apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+      using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
+      apply blast
+      using 0 "&I" by blast
+    finally AOT_show \<open>[F]x \<equiv> [\<lambda>z [F]z & \<psi>]x\<close>
+      using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+
+  AOT_have Aux_B: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<rightarrow> \<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close> for \<psi>
+  proof (rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+      fix x
+      AOT_assume 0: \<open>\<psi>\<close>
+      AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x \<equiv> (([F]x & \<psi>) \<or> \<not>\<psi>)\<close>
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      also AOT_have \<open>... \<equiv> [F]x\<close>
+        apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+        using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0]
+              "&E"
+         apply blast
+        apply (rule "\<or>I"(1)) using 0 "&I" by blast
+      finally AOT_show \<open>[F]x \<equiv> [\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x\<close>
+        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+
+  AOT_have Aux_C:
+    \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<not>\<psi> \<rightarrow> \<diamond>\<not>\<forall>z([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close> for \<psi>
+  proof(rule "RM\<diamond>"; rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_modally_strict {
+      AOT_assume 0: \<open>\<not>\<psi>\<close>
+      AOT_assume \<open>\<forall>z ([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close>
+      AOT_hence \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      moreover AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [F]z & \<psi>\<close> for z
+          by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      moreover AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]z \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      ultimately AOT_have \<open>[F]z & \<psi> \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "\<equiv>E"(5) by meson
+      moreover AOT_have \<open>(([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z using 0 "\<or>I" by blast
+      ultimately AOT_have \<open>\<psi>\<close> using "\<equiv>E" "&E" by metis
+      AOT_thus \<open>\<psi> & \<not>\<psi>\<close> using 0 "&I" by blast
+    }
+  qed
+
+  AOT_have Aux_D: \<open>\<box>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
+      (\<diamond>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+       \<diamond>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
+  proof (rule "\<rightarrow>I")
+    AOT_assume A: \<open>\<box>\<forall>z([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+    AOT_show \<open>\<diamond>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+              \<diamond>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+    proof(rule "\<equiv>I"; rule "KBasic:13"[THEN "\<rightarrow>E"];
+          rule "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>z([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<guillemotright>}", simplified];
+          (rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")?)
+      AOT_modally_strict {
+        AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+        AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
+          using "\<forall>E" by blast
+        AOT_assume \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+        AOT_hence 2: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+          using "\<forall>E" by blast
+        AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+          using "\<equiv>E" 1 2 by meson
+        AOT_thus \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+          by (rule GEN)
+      }
+    next
+      AOT_modally_strict {
+        AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+        AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
+          using "\<forall>E" by blast
+        AOT_assume \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+        AOT_hence 2: \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+          using "\<forall>E" by blast
+        AOT_have \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+          using 1 2 "\<equiv>E" by meson
+        AOT_thus \<open> \<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+          by (rule GEN)
+      }
+    qed(auto simp: A)
+  qed
+
+  AOT_obtain p\<^sub>1 where p\<^sub>1_prop: \<open>p\<^sub>1 & \<diamond>\<not>p\<^sub>1\<close>
+    using "cont-tf-thm:1" "\<exists>E"[rotated]
+          "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  {
+    AOT_assume 1: \<open>\<box>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+    AOT_have 2: \<open>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using Aux_B[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(1)]].
+    AOT_have \<open>\<diamond>\<not>\<forall>x([\<lambda>z [F]z & p\<^sub>1]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using Aux_C[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(2)]].
+    AOT_hence 3: \<open>\<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using Aux_D[THEN "\<rightarrow>E", OF 1, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x) &
+               \<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using 2 "&I" by blast
+    AOT_hence \<open>\<exists>G (\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
+      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  }
+  moreover {
+    AOT_assume 2: \<open>\<not>\<box>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+    AOT_hence \<open>\<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+      using "KBasic:11"[THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+      using Aux_A[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(1)]] "&I" by blast
+    AOT_hence \<open>\<exists>G (\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
+      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  }
+  ultimately AOT_show \<open>\<exists>G (\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
+    using "\<or>E"(1)[OF "exc-mid"] "\<rightarrow>I" by blast
+qed
+
+AOT_theorem "eqnotnec:5": \<open>\<forall>F\<exists>G(\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+proof(rule GEN)
+  fix F
+  AOT_have Aux_A: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi>]x)\<close> for \<psi>
+  proof(rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+    fix x
+    AOT_assume 0: \<open>\<psi>\<close>
+    AOT_have \<open>[\<lambda>z [F]z & \<psi>]x \<equiv> [F]x & \<psi>\<close>
+      by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+    also AOT_have \<open>... \<equiv> [F]x\<close>
+      apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+      using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
+       apply blast
+      using 0 "&I" by blast
+    finally AOT_show \<open>[F]x \<equiv> [\<lambda>z [F]z & \<psi>]x\<close>
+      using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+
+  AOT_have Aux_B: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close> for \<psi>
+  proof (rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+      fix x
+      AOT_assume 0: \<open>\<psi>\<close>
+      AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x \<equiv> (([F]x & \<psi>) \<or> \<not>\<psi>)\<close>
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      also AOT_have \<open>... \<equiv> [F]x\<close>
+        apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+        using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
+         apply blast
+        apply (rule "\<or>I"(1)) using 0 "&I" by blast
+      finally AOT_show \<open>[F]x \<equiv> [\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x\<close>
+        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+
+  AOT_have Aux_C: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<psi> \<rightarrow> \<not>\<forall>z([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close> for \<psi>
+  proof(rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_modally_strict {
+      AOT_assume 0: \<open>\<not>\<psi>\<close>
+      AOT_assume \<open>\<forall>z ([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close>
+      AOT_hence \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      moreover AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [F]z & \<psi>\<close> for z
+          by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      moreover AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]z \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      ultimately AOT_have \<open>[F]z & \<psi> \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "\<equiv>E"(5) by meson
+      moreover AOT_have \<open>(([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        using 0 "\<or>I" by blast
+      ultimately AOT_have \<open>\<psi>\<close> using "\<equiv>E" "&E" by metis
+      AOT_thus \<open>\<psi> & \<not>\<psi>\<close> using 0 "&I" by blast
+    }
+  qed
+
+  AOT_have Aux_D: \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
+    (\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+     \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
+  proof (rule "\<rightarrow>I"; rule "\<equiv>I";
+         (rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")?)
+    AOT_modally_strict {
+      AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+      AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      AOT_assume \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+      AOT_hence 2: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using "\<equiv>E" 1 2 by meson
+      AOT_thus \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+        by (rule GEN)
+    }
+  next
+    AOT_modally_strict {
+      AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+      AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      AOT_assume \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+      AOT_hence 2: \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      AOT_have \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using 1 2 "\<equiv>E" by meson
+      AOT_thus \<open> \<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+        by (rule GEN)
+    }
+  qed
+
+  AOT_obtain p\<^sub>1 where p\<^sub>1_prop: \<open>\<not>p\<^sub>1 & \<diamond>p\<^sub>1\<close>
+    using "cont-tf-thm:2" "\<exists>E"[rotated] "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  {
+    AOT_assume 1: \<open>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+    AOT_have 2: \<open>\<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using Aux_B[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(2)]].
+    AOT_have \<open>\<not>\<forall>x([\<lambda>z [F]z & p\<^sub>1]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using Aux_C[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(1)]].
+    AOT_hence 3: \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using Aux_D[THEN "\<rightarrow>E", OF 1, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x) &
+               \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
+      using 2 "&I" by blast
+    AOT_hence \<open>\<exists>G (\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  }
+  moreover {
+    AOT_assume 2: \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+    AOT_hence \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+      using "KBasic:11"[THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x) &
+               \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
+      using Aux_A[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(2)]] "&I" by blast
+    AOT_hence \<open>\<exists>G (\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  }
+  ultimately AOT_show \<open>\<exists>G (\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+    using "\<or>E"(1)[OF "exc-mid"] "\<rightarrow>I" by blast
+qed
+
+AOT_theorem "eqnotnec:6": \<open>\<forall>F\<exists>G(\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+proof(rule GEN)
+  fix F
+  AOT_have Aux_A: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi>]x)\<close> for \<psi>
+  proof(rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+    fix x
+    AOT_assume 0: \<open>\<psi>\<close>
+    AOT_have \<open>[\<lambda>z [F]z & \<psi>]x \<equiv> [F]x & \<psi>\<close>
+      by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+    also AOT_have \<open>... \<equiv> [F]x\<close>
+      apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+      using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0]
+            "&E"
+       apply blast
+      using 0 "&I" by blast
+    finally AOT_show \<open>[F]x \<equiv> [\<lambda>z [F]z & \<psi>]x\<close>
+      using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+
+  AOT_have Aux_B: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close> for \<psi>
+  proof (rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+      fix x
+      AOT_assume 0: \<open>\<psi>\<close>
+      AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x \<equiv> (([F]x & \<psi>) \<or> \<not>\<psi>)\<close>
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      also AOT_have \<open>... \<equiv> [F]x\<close>
+        apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+        using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
+         apply blast
+        apply (rule "\<or>I"(1)) using 0 "&I" by blast
+      finally AOT_show \<open>[F]x \<equiv> [\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x\<close>
+        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+
+  AOT_have Aux_C:
+    \<open>\<^bold>\<turnstile>\<^sub>\<box> \<^bold>\<A>\<not>\<psi> \<rightarrow> \<^bold>\<A>\<not>\<forall>z([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close> for \<psi>
+  proof(rule "act-cond"[THEN "\<rightarrow>E"]; rule "RA[2]"; rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_modally_strict {
+      AOT_assume 0: \<open>\<not>\<psi>\<close>
+      AOT_assume \<open>\<forall>z ([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close>
+      AOT_hence \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+        using "\<forall>E" by blast
+      moreover AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [F]z & \<psi>\<close> for z
+          by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      moreover AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]z \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+      ultimately AOT_have \<open>[F]z & \<psi> \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "\<equiv>E"(5) by meson
+      moreover AOT_have \<open>(([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
+        using 0 "\<or>I" by blast
+      ultimately AOT_have \<open>\<psi>\<close> using "\<equiv>E" "&E" by metis
+      AOT_thus \<open>\<psi> & \<not>\<psi>\<close> using 0 "&I" by blast
+    }
+  qed
+
+  AOT_have \<open>\<box>(\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
+    (\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+     \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)))\<close> for \<psi>
+  proof (rule RN; rule "\<rightarrow>I")
+    AOT_modally_strict {
+        AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+        AOT_thus \<open>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+                  \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+          apply -
+        proof(rule "\<equiv>I"; (rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")?)
+          AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+          AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
+            using "\<forall>E" by blast
+          AOT_assume \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+          AOT_hence 2: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+            using "\<forall>E" by blast
+          AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+            using "\<equiv>E" 1 2 by meson
+          AOT_thus \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+            by (rule GEN)
+        next
+            AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
+            AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
+              using "\<forall>E" by blast
+            AOT_assume \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+            AOT_hence 2: \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+              using "\<forall>E" by blast
+            AOT_have \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
+              using 1 2 "\<equiv>E" by meson
+            AOT_thus \<open> \<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
+              by (rule GEN)
+        qed
+    }
+  qed
+  AOT_hence \<open>\<^bold>\<A>(\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
+    (\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+     \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)))\<close> for \<psi>
+    using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<^bold>\<A>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
+    \<^bold>\<A>(\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+    \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
+    using "act-cond"[THEN "\<rightarrow>E"] by blast
+  AOT_hence Aux_D: \<open>\<^bold>\<A>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
+    (\<^bold>\<A>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
+     \<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
+    by (auto intro!: "\<rightarrow>I" "Act-Basic:5"[THEN "\<equiv>E"(1)] dest!: "\<rightarrow>E")
+
+  AOT_have \<open>\<not>\<^bold>\<A>q\<^sub>0\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
+     apply (fact "log-prop-prop:2")
+    by (fact AOT)
+  AOT_hence q\<^sub>0_prop_1: \<open>\<^bold>\<A>\<not>q\<^sub>0\<close>
+    using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
+  {
+    AOT_assume 1: \<open>\<^bold>\<A>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
+    AOT_have 2: \<open>\<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
+      using Aux_B[THEN "\<rightarrow>E", OF q\<^sub>0_prop[THEN "&E"(1)]].
+    AOT_have \<open>\<^bold>\<A>\<not>\<forall>x([\<lambda>z [F]z & q\<^sub>0]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
+      using Aux_C[THEN "\<rightarrow>E", OF q\<^sub>0_prop_1].
+    AOT_hence 3: \<open>\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
+      using Aux_D[THEN "\<rightarrow>E", OF 1, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x) &
+               \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
+      using 2 "&I" by blast
+    AOT_hence \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  }
+  moreover {
+    AOT_assume 2: \<open>\<not>\<^bold>\<A>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
+    AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
+      using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
+    AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x) & \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
+      using Aux_A[THEN "\<rightarrow>E", OF q\<^sub>0_prop[THEN "&E"(1)]] "&I" by blast
+    AOT_hence \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
+  }
+  ultimately AOT_show \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
+    using "\<or>E"(1)[OF "exc-mid"] "\<rightarrow>I" by blast
+qed
+
+AOT_theorem "oa-contingent:1": \<open>O! \<noteq> A!\<close>
+proof(rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"]; rule "raa-cor:2")
+  fix x
+  AOT_assume 1: \<open>O! = A!\<close>
+  AOT_hence \<open>[\<lambda>x \<diamond>E!x] = A!\<close>
+    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_ordinary, rotated]) "cqt:2[lambda]"
+  AOT_hence \<open>[\<lambda>x \<diamond>E!x] = [\<lambda>x \<not>\<diamond>E!x]\<close>
+    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract, rotated]) "cqt:2[lambda]"
+  moreover AOT_have \<open>[\<lambda>x \<diamond>E!x]x \<equiv> \<diamond>E!x\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+  ultimately AOT_have \<open>[\<lambda>x \<not>\<diamond>E!x]x \<equiv> \<diamond>E!x\<close>
+    using "rule=E" by fast
+  moreover AOT_have \<open>[\<lambda>x \<not>\<diamond>E!x]x \<equiv> \<not>\<diamond>E!x\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+  ultimately AOT_have \<open>\<diamond>E!x \<equiv> \<not>\<diamond>E!x\<close>
+    using "\<equiv>E"(6) "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
+  AOT_thus "(\<diamond>E!x \<equiv> \<not>\<diamond>E!x) & \<not>(\<diamond>E!x \<equiv> \<not>\<diamond>E!x)"
+    using "oth-class-taut:3:c" "&I" by blast
+qed
+
+AOT_theorem "oa-contingent:2": \<open>O!x \<equiv> \<not>A!x\<close>
+proof -
+  AOT_have \<open>O!x \<equiv> [\<lambda>x \<diamond>E!x]x\<close>
+    apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+     apply (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_ordinary])
+      apply "cqt:2[lambda]"
+     apply argo
+    apply (rule  "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary])
+     apply "cqt:2[lambda]"
+    by argo
+  also AOT_have \<open>\<dots> \<equiv> \<diamond>E!x\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<not>\<diamond>E!x\<close>
+    using "oth-class-taut:3:b".
+  also AOT_have \<open>\<dots> \<equiv> \<not>[\<lambda>x \<not>\<diamond>E!x]x\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E",
+              THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], symmetric])
+       "cqt:2"
+  also AOT_have \<open>\<dots> \<equiv> \<not>A!x\<close>
+    apply (rule "\<equiv>I"; rule "\<rightarrow>I")
+     apply (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_abstract])
+      apply "cqt:2[lambda]"
+     apply argo
+    apply (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract])
+     apply "cqt:2[lambda]"
+    by argo
+  finally show ?thesis.
+qed
+
+AOT_theorem "oa-contingent:3": \<open>A!x \<equiv> \<not>O!x\<close>
+  by (AOT_subst \<open>A!x\<close> \<open>\<not>\<not>A!x\<close>)
+     (auto simp add: "oth-class-taut:3:b" "oa-contingent:2"[THEN
+         "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], symmetric])
+
+AOT_theorem "oa-contingent:4": \<open>Contingent(O!)\<close>
+proof (rule "thm-cont-prop:2"[unvarify F, OF "oa-exist:1", THEN "\<equiv>E"(2)];
+       rule "&I")
+  AOT_have \<open>\<diamond>\<exists>x E!x\<close> using "thm-cont-e:3" .
+  AOT_hence \<open>\<exists>x \<diamond>E!x\<close> using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
+  then AOT_obtain a where \<open>\<diamond>E!a\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>[\<lambda>x \<diamond>E!x]a\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), rotated]) "cqt:2"
+  AOT_hence \<open>O!a\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2"
+  AOT_hence \<open>\<exists>x O!x\<close> using "\<exists>I" by blast
+  AOT_thus \<open>\<diamond>\<exists>x O!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+next
+  AOT_obtain a where \<open>A!a\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
+  AOT_hence \<open>\<not>O!a\<close> using "oa-contingent:3"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<exists>x \<not>O!x\<close> using "\<exists>I" by fast
+  AOT_thus \<open>\<diamond>\<exists>x \<not>O!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "oa-contingent:5": \<open>Contingent(A!)\<close>
+proof (rule "thm-cont-prop:2"[unvarify F, OF "oa-exist:2", THEN "\<equiv>E"(2)];
+       rule "&I")
+  AOT_obtain a where \<open>A!a\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
+  AOT_hence \<open>\<exists>x A!x\<close> using "\<exists>I" by fast
+  AOT_thus \<open>\<diamond>\<exists>x A!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+next
+  AOT_have \<open>\<diamond>\<exists>x E!x\<close> using "thm-cont-e:3" .
+  AOT_hence \<open>\<exists>x \<diamond>E!x\<close> using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
+  then AOT_obtain a where \<open>\<diamond>E!a\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>[\<lambda>x \<diamond>E!x]a\<close>
+    by (rule "beta-C-meta"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), rotated]) "cqt:2[lambda]"
+  AOT_hence \<open>O!a\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2[lambda]"
+  AOT_hence \<open>\<not>A!a\<close> using "oa-contingent:2"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<exists>x \<not>A!x\<close> using "\<exists>I" by fast
+  AOT_thus \<open>\<diamond>\<exists>x \<not>A!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "oa-contingent:7": \<open>O!\<^sup>-x \<equiv> \<not>A!\<^sup>-x\<close>
+proof -
+  AOT_have \<open>O!x \<equiv> \<not>A!x\<close>
+    using "oa-contingent:2" by blast
+  also AOT_have \<open>\<dots> \<equiv> A!\<^sup>-x\<close>
+    using "thm-relation-negation:1"[symmetric, unvarify F, OF "oa-exist:2"].
+  finally AOT_have 1: \<open>O!x \<equiv> A!\<^sup>-x\<close>.
+
+  AOT_have \<open>A!x \<equiv> \<not>O!x\<close>
+    using "oa-contingent:3" by blast
+  also AOT_have \<open>\<dots> \<equiv> O!\<^sup>-x\<close>
+    using "thm-relation-negation:1"[symmetric, unvarify F, OF "oa-exist:1"].
+  finally AOT_have 2: \<open>A!x \<equiv> O!\<^sup>-x\<close>.
+
+  AOT_show \<open>O!\<^sup>-x \<equiv> \<not>A!\<^sup>-x\<close>
+    using 1[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
+          "oa-contingent:3"[of _ x] 2[symmetric]
+          "\<equiv>E"(5) by blast
+qed
+
+AOT_theorem "oa-contingent:6": \<open>O!\<^sup>- \<noteq> A!\<^sup>-\<close>
+proof (rule "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "raa-cor:2")
+  AOT_assume 1: \<open>O!\<^sup>- = A!\<^sup>-\<close>
+  fix x
+  AOT_have \<open>A!\<^sup>-x \<equiv> O!\<^sup>-x\<close>
+    apply (rule "rule=E"[rotated, OF 1])
+    by (fact "oth-class-taut:3:a")
+  AOT_hence \<open>A!\<^sup>-x \<equiv> \<not>A!\<^sup>-x\<close>
+    using "oa-contingent:7" "\<equiv>E" by fast
+  AOT_thus \<open>(A!\<^sup>-x \<equiv> \<not>A!\<^sup>-x) & \<not>(A!\<^sup>-x \<equiv> \<not>A!\<^sup>-x)\<close>
+    using "oth-class-taut:3:c" "&I" by blast
+qed
+
+AOT_theorem "oa-contingent:8": \<open>Contingent(O!\<^sup>-)\<close>
+  using "thm-cont-prop:3"[unvarify F, OF "oa-exist:1", THEN "\<equiv>E"(1),
+          OF "oa-contingent:4"].
+
+AOT_theorem "oa-contingent:9": \<open>Contingent(A!\<^sup>-)\<close>
+  using "thm-cont-prop:3"[unvarify F, OF "oa-exist:2", THEN "\<equiv>E"(1),
+          OF "oa-contingent:5"].
+
+AOT_define WeaklyContingent :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>WeaklyContingent'(_')\<close>)
+  "df-cont-nec":
+  \<open>WeaklyContingent([F]) \<equiv>\<^sub>d\<^sub>f Contingent([F]) & \<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
+
+AOT_theorem "cont-nec-fact1:1":
+  \<open>WeaklyContingent([F]) \<equiv> WeaklyContingent([F]\<^sup>-)\<close>
+proof -
+  AOT_have \<open>WeaklyContingent([F]) \<equiv> Contingent([F]) & \<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
+    using "df-cont-nec"[THEN "\<equiv>Df"] by blast
+  also AOT_have \<open>... \<equiv> Contingent([F]\<^sup>-) & \<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
+    apply (rule "oth-class-taut:8:f"[THEN "\<equiv>E"(2)]; rule "\<rightarrow>I")
+    using "thm-cont-prop:3".
+  also AOT_have \<open>\<dots> \<equiv> Contingent([F]\<^sup>-) & \<forall>x (\<diamond>[F]\<^sup>-x \<rightarrow> \<box>[F]\<^sup>-x)\<close>
+  proof (rule "oth-class-taut:8:e"[THEN "\<equiv>E"(2)];
+         rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I"; rule GEN; rule "\<rightarrow>I")
+    fix x
+    AOT_assume 0: \<open>\<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
+    AOT_assume 1: \<open>\<diamond>[F]\<^sup>-x\<close>
+    AOT_have \<open>\<diamond>\<not>[F]x\<close>
+      by (AOT_subst (reverse) \<open>\<not>[F]x\<close> \<open>[F]\<^sup>-x\<close>)
+         (auto simp add: "thm-relation-negation:1" 1)
+    AOT_hence 2: \<open>\<not>\<box>[F]x\<close>
+      using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+    AOT_show \<open>\<box>[F]\<^sup>-x\<close>
+    proof (rule "raa-cor:1")
+      AOT_assume 3: \<open>\<not>\<box>[F]\<^sup>-x\<close>
+      AOT_have \<open>\<not>\<box>\<not>[F]x\<close>
+        by (AOT_subst (reverse) \<open>\<not>[F]x\<close> \<open>[F]\<^sup>-x\<close>)
+           (auto simp add: "thm-relation-negation:1" 3)
+      AOT_hence \<open>\<diamond>[F]x\<close>
+        using "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by simp
+      AOT_hence \<open>\<box>[F]x\<close> using 0 "\<forall>E" "\<rightarrow>E" by fast
+      AOT_thus \<open>\<box>[F]x & \<not>\<box>[F]x\<close> using "&I" 2 by blast
+    qed
+  next
+    fix x
+    AOT_assume 0: \<open>\<forall>x (\<diamond>[F]\<^sup>-x \<rightarrow> \<box>[F]\<^sup>-x)\<close>
+    AOT_assume 1: \<open>\<diamond>[F]x\<close>
+    AOT_have \<open>\<diamond>\<not>[F]\<^sup>-x\<close>
+      by (AOT_subst \<open>\<not>[F]\<^sup>-x\<close> \<open>[F]x\<close>)
+         (auto simp: "thm-relation-negation:2" 1)
+    AOT_hence 2: \<open>\<not>\<box>[F]\<^sup>-x\<close>
+      using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
+    AOT_show \<open>\<box>[F]x\<close>
+    proof (rule "raa-cor:1")
+      AOT_assume 3: \<open>\<not>\<box>[F]x\<close>
+      AOT_have \<open>\<not>\<box>\<not>[F]\<^sup>-x\<close>
+        by (AOT_subst \<open>\<not>[F]\<^sup>-x\<close> \<open>[F]x\<close>)
+           (auto simp add: "thm-relation-negation:2" 3)
+      AOT_hence \<open>\<diamond>[F]\<^sup>-x\<close>
+        using "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by simp
+      AOT_hence \<open>\<box>[F]\<^sup>-x\<close> using 0 "\<forall>E" "\<rightarrow>E" by fast
+      AOT_thus \<open>\<box>[F]\<^sup>-x & \<not>\<box>[F]\<^sup>-x\<close> using "&I" 2 by blast
+    qed
+  qed
+  also AOT_have \<open>\<dots> \<equiv> WeaklyContingent([F]\<^sup>-)\<close>
+    using "df-cont-nec"[THEN "\<equiv>Df", symmetric] by blast
+  finally show ?thesis.
+qed
+
+AOT_theorem "cont-nec-fact1:2":
+  \<open>(WeaklyContingent([F]) & \<not>WeaklyContingent([G])) \<rightarrow> F \<noteq> G\<close>
+proof (rule "\<rightarrow>I"; rule "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "raa-cor:2")
+  AOT_assume 1: \<open>WeaklyContingent([F]) & \<not>WeaklyContingent([G])\<close>
+  AOT_hence \<open>WeaklyContingent([F])\<close> using "&E" by blast
+  moreover AOT_assume \<open>F = G\<close>
+  ultimately AOT_have \<open>WeaklyContingent([G])\<close>
+    using "rule=E" by blast
+  AOT_thus \<open>WeaklyContingent([G]) & \<not>WeaklyContingent([G])\<close>
+    using 1 "&I" "&E" by blast
+qed
+
+AOT_theorem "cont-nec-fact2:1": \<open>WeaklyContingent(O!)\<close>
+proof (rule "df-cont-nec"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "&I")
+  AOT_show \<open>Contingent(O!)\<close>
+    using "oa-contingent:4".
+next
+  AOT_show \<open>\<forall>x (\<diamond>[O!]x \<rightarrow> \<box>[O!]x)\<close>
+    apply (rule GEN; rule "\<rightarrow>I")
+    using "oa-facts:5"[THEN "\<equiv>E"(1)] by blast
+qed
+
+
+AOT_theorem "cont-nec-fact2:2": \<open>WeaklyContingent(A!)\<close>
+proof (rule "df-cont-nec"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "&I")
+  AOT_show \<open>Contingent(A!)\<close>
+    using "oa-contingent:5".
+next
+  AOT_show \<open>\<forall>x (\<diamond>[A!]x \<rightarrow> \<box>[A!]x)\<close>
+    apply (rule GEN; rule "\<rightarrow>I")
+    using "oa-facts:6"[THEN "\<equiv>E"(1)] by blast
+qed
+
+AOT_theorem "cont-nec-fact2:3": \<open>\<not>WeaklyContingent(E!)\<close>
+proof (rule "df-cont-nec"[THEN "\<equiv>Df",
+                          THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                          THEN "\<equiv>E"(2)];
+       rule DeMorgan(1)[THEN "\<equiv>E"(2)]; rule "\<or>I"(2); rule "raa-cor:2")
+  AOT_have \<open>\<diamond>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close> using "qml:4"[axiom_inst].
+  AOT_hence \<open>\<exists>x \<diamond>(E!x & \<not>\<^bold>\<A>E!x)\<close> using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
+  then AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>E!a)\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence 1: \<open>\<diamond>E!a & \<diamond>\<not>\<^bold>\<A>E!a\<close> using "KBasic2:3"[THEN "\<rightarrow>E"] by simp
+  moreover AOT_assume \<open>\<forall>x (\<diamond>[E!]x \<rightarrow> \<box>[E!]x)\<close>
+  ultimately AOT_have \<open>\<box>E!a\<close> using "&E" "\<forall>E" "\<rightarrow>E" by fast
+  AOT_hence \<open>\<^bold>\<A>E!a\<close> using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<box>\<^bold>\<A>E!a\<close> using "qml-act:1"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  moreover AOT_have \<open>\<not>\<box>\<^bold>\<A>E!a\<close>
+    using "KBasic:11"[THEN "\<equiv>E"(2)] 1[THEN "&E"(2)] by meson
+  ultimately AOT_have \<open>\<box>\<^bold>\<A>E!a & \<not>\<box>\<^bold>\<A>E!a\<close> using "&I" by blast
+  AOT_thus \<open>p & \<not>p\<close> for p using "raa-cor:1" by blast
+qed
+
+AOT_theorem "cont-nec-fact2:4": \<open>\<not>WeaklyContingent(L)\<close>
+  apply (rule "df-cont-nec"[THEN "\<equiv>Df",
+                            THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                            THEN "\<equiv>E"(2)];
+       rule DeMorgan(1)[THEN "\<equiv>E"(2)]; rule "\<or>I"(1))
+  apply (rule "contingent-properties:4"
+                [THEN "\<equiv>Df",
+                 THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                 THEN "\<equiv>E"(2)])
+  apply (rule DeMorgan(1)[THEN "\<equiv>E"(2)];
+         rule "\<or>I"(2);
+         rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+  using "thm-noncont-e-e:3"[THEN "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"]].
+
+AOT_theorem "cont-nec-fact2:5": \<open>O! \<noteq> E! & O! \<noteq> E!\<^sup>- & O! \<noteq> L & O! \<noteq> L\<^sup>-\<close>
+proof -
+  AOT_have 1: \<open>L\<down>\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+  {
+    fix \<phi> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+    AOT_have A: \<open>\<not>(\<phi>{\<Pi>'} \<equiv> \<phi>{\<Pi>})\<close> if  \<open>\<phi>{\<Pi>}\<close> and \<open>\<not>\<phi>{\<Pi>'}\<close>
+    proof (rule "raa-cor:2")
+      AOT_assume \<open>\<phi>{\<Pi>'} \<equiv> \<phi>{\<Pi>}\<close>
+      AOT_hence \<open>\<phi>{\<Pi>'}\<close> using that(1) "\<equiv>E" by blast
+      AOT_thus \<open>\<phi>{\<Pi>'} & \<not>\<phi>{\<Pi>'}\<close> using that(2) "&I" by blast
+    qed
+    AOT_have \<open>\<Pi>' \<noteq> \<Pi>\<close> if \<open>\<Pi>\<down>\<close> and \<open>\<Pi>'\<down>\<close> and \<open>\<phi>{\<Pi>}\<close> and \<open>\<not>\<phi>{\<Pi>'}\<close>
+      using "pos-not-equiv-ne:4"[unvarify F G, THEN "\<rightarrow>E",
+                                 OF that(1,2), OF A[OF that(3, 4)]].
+  } note 0 = this
+  show ?thesis
+    apply(safe intro!: "&I"; rule 0)
+    apply "cqt:2"
+    using "oa-exist:1" apply blast
+    using "cont-nec-fact2:3" apply fast
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:1" apply fast
+    using "rel-neg-T:3" apply fast
+    using "oa-exist:1" apply blast
+    using "cont-nec-fact1:1"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+            THEN "\<equiv>E"(1), rotated, OF "cont-nec-fact2:3"] apply fast
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:1" apply blast
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]; "cqt:2[lambda]")
+    using "oa-exist:1" apply fast
+    using "cont-nec-fact2:4" apply fast
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:1" apply fast
+    using "rel-neg-T:3" apply fast
+    using "oa-exist:1" apply fast
+     apply (rule "cont-nec-fact1:1"[unvarify F,
+                    THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                    THEN "\<equiv>E"(1), rotated, OF "cont-nec-fact2:4"])
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]; "cqt:2[lambda]")
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:1" by blast
+qed
+
+AOT_theorem "cont-nec-fact2:6": \<open>A! \<noteq> E! & A! \<noteq> E!\<^sup>- & A! \<noteq> L & A! \<noteq> L\<^sup>-\<close>
+proof -
+  AOT_have 1: \<open>L\<down>\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+  {
+    fix \<phi> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+    AOT_have A: \<open>\<not>(\<phi>{\<Pi>'} \<equiv> \<phi>{\<Pi>})\<close> if  \<open>\<phi>{\<Pi>}\<close> and \<open>\<not>\<phi>{\<Pi>'}\<close>
+    proof (rule "raa-cor:2")
+      AOT_assume \<open>\<phi>{\<Pi>'} \<equiv> \<phi>{\<Pi>}\<close>
+      AOT_hence \<open>\<phi>{\<Pi>'}\<close> using that(1) "\<equiv>E" by blast
+      AOT_thus \<open>\<phi>{\<Pi>'} & \<not>\<phi>{\<Pi>'}\<close> using that(2) "&I" by blast
+    qed
+    AOT_have \<open>\<Pi>' \<noteq> \<Pi>\<close> if \<open>\<Pi>\<down>\<close> and \<open>\<Pi>'\<down>\<close> and \<open>\<phi>{\<Pi>}\<close> and \<open>\<not>\<phi>{\<Pi>'}\<close>
+      using "pos-not-equiv-ne:4"[unvarify F G, THEN "\<rightarrow>E",
+              OF that(1,2), OF A[OF that(3, 4)]].
+  } note 0 = this
+  show ?thesis
+    apply(safe intro!: "&I"; rule 0)
+    apply "cqt:2"
+    using "oa-exist:2" apply blast
+    using "cont-nec-fact2:3" apply fast
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:2" apply fast
+    using "rel-neg-T:3" apply fast
+    using "oa-exist:2" apply blast
+    using "cont-nec-fact1:1"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+            THEN "\<equiv>E"(1), rotated, OF "cont-nec-fact2:3"] apply fast
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:2" apply blast
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]; "cqt:2[lambda]")
+    using "oa-exist:2" apply fast
+    using "cont-nec-fact2:4" apply fast
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:2" apply fast
+    using "rel-neg-T:3" apply fast
+    using "oa-exist:2" apply fast
+     apply (rule "cont-nec-fact1:1"[unvarify F,
+              THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+              THEN "\<equiv>E"(1), rotated, OF "cont-nec-fact2:4"])
+     apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]; "cqt:2[lambda]")
+    apply (rule "useful-tautologies:2"[THEN "\<rightarrow>E"])
+    using "cont-nec-fact2:2" by blast
+qed
+
+AOT_define necessary_or_contingently_false :: \<open>\<phi> \<Rightarrow> \<phi>\<close> ("\<^bold>\<Delta>_" [49] 54)
+  \<open>\<^bold>\<Delta>p \<equiv>\<^sub>d\<^sub>f \<box>p \<or> (\<not>\<^bold>\<A>p & \<diamond>p)\<close>
+
+AOT_theorem sixteen:
+ shows \<open>\<exists>F\<^sub>1\<exists>F\<^sub>2\<exists>F\<^sub>3\<exists>F\<^sub>4\<exists>F\<^sub>5\<exists>F\<^sub>6\<exists>F\<^sub>7\<exists>F\<^sub>8\<exists>F\<^sub>9\<exists>F\<^sub>1\<^sub>0\<exists>F\<^sub>1\<^sub>1\<exists>F\<^sub>1\<^sub>2\<exists>F\<^sub>1\<^sub>3\<exists>F\<^sub>1\<^sub>4\<exists>F\<^sub>1\<^sub>5\<exists>F\<^sub>1\<^sub>6 (
+  \<guillemotleft>F\<^sub>1::<\<kappa>>\<guillemotright> \<noteq> F\<^sub>2 & F\<^sub>1 \<noteq> F\<^sub>3 & F\<^sub>1 \<noteq> F\<^sub>4 & F\<^sub>1 \<noteq> F\<^sub>5 & F\<^sub>1 \<noteq> F\<^sub>6 & F\<^sub>1 \<noteq> F\<^sub>7 &
+    F\<^sub>1 \<noteq> F\<^sub>8 & F\<^sub>1 \<noteq> F\<^sub>9 & F\<^sub>1 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>1 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>1 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>1 \<noteq> F\<^sub>1\<^sub>3 &
+    F\<^sub>1 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>1 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>1 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>2 \<noteq> F\<^sub>3 & F\<^sub>2 \<noteq> F\<^sub>4 & F\<^sub>2 \<noteq> F\<^sub>5 & F\<^sub>2 \<noteq> F\<^sub>6 & F\<^sub>2 \<noteq> F\<^sub>7 & F\<^sub>2 \<noteq> F\<^sub>8 &
+    F\<^sub>2 \<noteq> F\<^sub>9 & F\<^sub>2 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>2 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>2 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>2 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>2 \<noteq> F\<^sub>1\<^sub>4 &
+    F\<^sub>2 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>2 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>3 \<noteq> F\<^sub>4 & F\<^sub>3 \<noteq> F\<^sub>5 & F\<^sub>3 \<noteq> F\<^sub>6 & F\<^sub>3 \<noteq> F\<^sub>7 & F\<^sub>3 \<noteq> F\<^sub>8 & F\<^sub>3 \<noteq> F\<^sub>9 & F\<^sub>3 \<noteq> F\<^sub>1\<^sub>0 &
+    F\<^sub>3 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>3 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>3 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>3 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>3 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>3 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>4 \<noteq> F\<^sub>5 & F\<^sub>4 \<noteq> F\<^sub>6 & F\<^sub>4 \<noteq> F\<^sub>7 & F\<^sub>4 \<noteq> F\<^sub>8 & F\<^sub>4 \<noteq> F\<^sub>9 & F\<^sub>4 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>4 \<noteq> F\<^sub>1\<^sub>1 &
+    F\<^sub>4 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>4 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>4 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>4 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>4 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>5 \<noteq> F\<^sub>6 & F\<^sub>5 \<noteq> F\<^sub>7 & F\<^sub>5 \<noteq> F\<^sub>8 & F\<^sub>5 \<noteq> F\<^sub>9 & F\<^sub>5 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>5 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>5 \<noteq> F\<^sub>1\<^sub>2 &
+    F\<^sub>5 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>5 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>5 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>5 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>6 \<noteq> F\<^sub>7 & F\<^sub>6 \<noteq> F\<^sub>8 & F\<^sub>6 \<noteq> F\<^sub>9 & F\<^sub>6 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>6 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>6 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>6 \<noteq> F\<^sub>1\<^sub>3 &
+    F\<^sub>6 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>6 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>6 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>7 \<noteq> F\<^sub>8 & F\<^sub>7 \<noteq> F\<^sub>9 & F\<^sub>7 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>7 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>7 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>7 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>7 \<noteq> F\<^sub>1\<^sub>4 &
+    F\<^sub>7 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>7 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>8 \<noteq> F\<^sub>9 & F\<^sub>8 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>8 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>8 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>8 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>8 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>8 \<noteq> F\<^sub>1\<^sub>5 &
+    F\<^sub>8 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>9 \<noteq> F\<^sub>1\<^sub>0 & F\<^sub>9 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>9 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>9 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>9 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>9 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>9 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>1\<^sub>0 \<noteq> F\<^sub>1\<^sub>1 & F\<^sub>1\<^sub>0 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>1\<^sub>0 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>1\<^sub>0 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>1\<^sub>0 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>1\<^sub>0 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>1\<^sub>1 \<noteq> F\<^sub>1\<^sub>2 & F\<^sub>1\<^sub>1 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>1\<^sub>1 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>1\<^sub>1 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>1\<^sub>1 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>1\<^sub>2 \<noteq> F\<^sub>1\<^sub>3 & F\<^sub>1\<^sub>2 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>1\<^sub>2 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>1\<^sub>2 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>1\<^sub>3 \<noteq> F\<^sub>1\<^sub>4 & F\<^sub>1\<^sub>3 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>1\<^sub>3 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>1\<^sub>4 \<noteq> F\<^sub>1\<^sub>5 & F\<^sub>1\<^sub>4 \<noteq> F\<^sub>1\<^sub>6 &
+  F\<^sub>1\<^sub>5 \<noteq> F\<^sub>1\<^sub>6)\<close> 
+proof -
+  AOT_have Delta_pos: \<open>\<^bold>\<Delta>\<phi> \<rightarrow> \<diamond>\<phi>\<close> for \<phi>
+  proof(rule "\<rightarrow>I")
+    AOT_assume \<open>\<^bold>\<Delta>\<phi>\<close>
+    AOT_hence \<open>\<box>\<phi> \<or> (\<not>\<^bold>\<A>\<phi> & \<diamond>\<phi>)\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE"[OF necessary_or_contingently_false] by blast
+    moreover {
+      AOT_assume \<open>\<box>\<phi>\<close>
+      AOT_hence \<open>\<diamond>\<phi>\<close>
+        by (metis "B\<diamond>" "T\<diamond>" "vdash-properties:10")
+    }
+    moreover {
+      AOT_assume \<open>\<not>\<^bold>\<A>\<phi> & \<diamond>\<phi>\<close>
+      AOT_hence \<open>\<diamond>\<phi>\<close>
+        using "&E" by blast
+    }
+    ultimately AOT_show \<open>\<diamond>\<phi>\<close>
+      by (metis "\<or>E"(2) "raa-cor:1") 
+  qed
+
+  AOT_have act_and_not_nec_not_delta: \<open>\<not>\<^bold>\<Delta>\<phi>\<close> if \<open>\<^bold>\<A>\<phi>\<close> and \<open>\<not>\<box>\<phi>\<close> for \<phi>
+    using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<or>E"(2) necessary_or_contingently_false
+          "raa-cor:3" that(1,2) by blast
+  AOT_have act_and_pos_not_not_delta: \<open>\<not>\<^bold>\<Delta>\<phi>\<close> if \<open>\<^bold>\<A>\<phi>\<close> and \<open>\<diamond>\<not>\<phi>\<close> for \<phi>
+    using "KBasic:11" act_and_not_nec_not_delta "\<equiv>E"(2) that(1,2) by blast
+  AOT_have impossible_delta: \<open>\<not>\<^bold>\<Delta>\<phi>\<close> if \<open>\<not>\<diamond>\<phi>\<close> for \<phi>
+    using Delta_pos "modus-tollens:1" that by blast
+  AOT_have not_act_and_pos_delta: \<open>\<^bold>\<Delta>\<phi>\<close> if \<open>\<not>\<^bold>\<A>\<phi>\<close> and \<open>\<diamond>\<phi>\<close> for \<phi>
+    by (meson "\<equiv>\<^sub>d\<^sub>fI" "&I" "\<or>I"(2) necessary_or_contingently_false that(1,2))
+  AOT_have nec_delta: \<open>\<^bold>\<Delta>\<phi>\<close> if \<open>\<box>\<phi>\<close> for \<phi>
+    using "\<equiv>\<^sub>d\<^sub>fI" "\<or>I"(1) necessary_or_contingently_false that by blast
+
+  AOT_obtain a where a_prop: \<open>A!a\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
+  AOT_obtain b where b_prop: \<open>\<diamond>[E!]b & \<not>\<^bold>\<A>[E!]b\<close>
+    using "pos-not-pna:3" using "\<exists>E"[rotated] by blast
+
+  AOT_have b_ord: \<open>[O!]b\<close>
+  proof(rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary])
+    AOT_show \<open>[\<lambda>x \<diamond>[E!]x]\<down>\<close> by "cqt:2[lambda]"
+  next
+    AOT_show \<open>[\<lambda>x \<diamond>[E!]x]b\<close>
+    proof (rule "\<beta>\<leftarrow>C"(1); ("cqt:2[lambda]")?)
+      AOT_show \<open>b\<down>\<close> by (rule "cqt:2[const_var]"[axiom_inst])
+      AOT_show \<open>\<diamond>[E!]b\<close> by (fact b_prop[THEN "&E"(1)])
+    qed
+  qed
+
+  AOT_have nec_not_L_neg: \<open>\<box>\<not>[L\<^sup>-]x\<close> for x
+    using "thm-noncont-e-e:2" "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"
+          CBF[THEN "\<rightarrow>E"] "\<forall>E" by blast
+  AOT_have nec_L: \<open>\<box>[L]x\<close> for x
+    using "thm-noncont-e-e:1" "contingent-properties:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"]
+      CBF[THEN "\<rightarrow>E"] "\<forall>E" by blast
+
+  AOT_have act_ord_b: \<open>\<^bold>\<A>[O!]b\<close>
+    using b_ord "\<equiv>E"(1) "oa-facts:7" by blast
+  AOT_have delta_ord_b: \<open>\<^bold>\<Delta>[O!]b\<close>
+    by (meson "\<equiv>\<^sub>d\<^sub>fI" b_ord "\<or>I"(1) necessary_or_contingently_false
+              "oa-facts:1" "\<rightarrow>E")
+  AOT_have not_act_ord_a: \<open>\<not>\<^bold>\<A>[O!]a\<close>
+    by (meson a_prop "\<equiv>E"(1) "\<equiv>E"(3) "oa-contingent:3" "oa-facts:7")
+  AOT_have not_delta_ord_a: \<open>\<not>\<^bold>\<Delta>[O!]a\<close>
+    by (metis Delta_pos "\<equiv>E"(4) not_act_ord_a "oa-facts:3" "oa-facts:7"
+              "reductio-aa:1" "\<rightarrow>E")
+
+  AOT_have not_act_abs_b: \<open>\<not>\<^bold>\<A>[A!]b\<close>
+    by (meson b_ord "\<equiv>E"(1) "\<equiv>E"(3) "oa-contingent:2" "oa-facts:8")
+  AOT_have not_delta_abs_b: \<open>\<not>\<^bold>\<Delta>[A!]b\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>\<^bold>\<Delta>[A!]b\<close>
+    AOT_hence \<open>\<diamond>[A!]b\<close>
+      by (metis Delta_pos "vdash-properties:10")
+    AOT_thus \<open>[A!]b & \<not>[A!]b\<close>
+      by (metis b_ord "&I" "\<equiv>E"(1) "oa-contingent:2"
+                "oa-facts:4" "\<rightarrow>E")
+  qed
+  AOT_have act_abs_a: \<open>\<^bold>\<A>[A!]a\<close>
+    using a_prop "\<equiv>E"(1) "oa-facts:8" by blast
+  AOT_have delta_abs_a: \<open>\<^bold>\<Delta>[A!]a\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fI" a_prop "oa-facts:2" "\<rightarrow>E" "\<or>I"(1)
+              necessary_or_contingently_false)
+
+  AOT_have not_act_concrete_b: \<open>\<not>\<^bold>\<A>[E!]b\<close>
+    using b_prop "&E"(2) by blast
+  AOT_have delta_concrete_b: \<open>\<^bold>\<Delta>[E!]b\<close>
+  proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF necessary_or_contingently_false];
+         rule "\<or>I"(2); rule "&I")
+    AOT_show \<open>\<not>\<^bold>\<A>[E!]b\<close> using b_prop "&E"(2) by blast
+  next
+    AOT_show \<open>\<diamond>[E!]b\<close> using b_prop "&E"(1) by blast
+  qed
+  AOT_have not_act_concrete_a: \<open>\<not>\<^bold>\<A>[E!]a\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<^bold>\<A>[E!]a\<close>
+    AOT_hence 1: \<open>\<diamond>[E!]a\<close> by (metis "Act-Sub:3" "\<rightarrow>E")
+    AOT_have \<open>[A!]a\<close> by (simp add: a_prop)
+    AOT_hence \<open>[\<lambda>x \<not>\<diamond>[E!]x]a\<close>
+      by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract, rotated]) "cqt:2"
+    AOT_hence \<open>\<not>\<diamond>[E!]a\<close> using "\<beta>\<rightarrow>C"(1) by blast
+    AOT_thus \<open>\<diamond>[E!]a & \<not>\<diamond>[E!]a\<close> using 1 "&I" by blast
+  qed
+  AOT_have not_delta_concrete_a: \<open>\<not>\<^bold>\<Delta>[E!]a\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<^bold>\<Delta>[E!]a\<close>
+    AOT_hence 1: \<open>\<diamond>[E!]a\<close> by (metis Delta_pos "vdash-properties:10")
+    AOT_have \<open>[A!]a\<close> by (simp add: a_prop)
+    AOT_hence \<open>[\<lambda>x \<not>\<diamond>[E!]x]a\<close>
+      by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract, rotated]) "cqt:2[lambda]"
+    AOT_hence \<open>\<not>\<diamond>[E!]a\<close> using "\<beta>\<rightarrow>C"(1) by blast
+    AOT_thus \<open>\<diamond>[E!]a & \<not>\<diamond>[E!]a\<close> using 1 "&I" by blast
+  qed
+
+  AOT_have not_act_q_zero: \<open>\<not>\<^bold>\<A>q\<^sub>0\<close>
+    by (meson "log-prop-prop:2" "pos-not-pna:1"
+              q\<^sub>0_def "reductio-aa:1" "rule-id-df:2:a[zero]")
+  AOT_have delta_q_zero: \<open>\<^bold>\<Delta>q\<^sub>0\<close>
+  proof(rule "\<equiv>\<^sub>d\<^sub>fI"[OF necessary_or_contingently_false];
+        rule "\<or>I"(2); rule "&I")
+    AOT_show \<open>\<not>\<^bold>\<A>q\<^sub>0\<close> using not_act_q_zero.
+    AOT_show \<open>\<diamond>q\<^sub>0\<close> by (meson "&E"(1) q\<^sub>0_prop)
+  qed
+  AOT_have act_not_q_zero: \<open>\<^bold>\<A>\<not>q\<^sub>0\<close>
+    using "Act-Basic:1" "\<or>E"(2) not_act_q_zero by blast
+  AOT_have not_delta_not_q_zero: \<open>\<not>\<^bold>\<Delta>\<not>q\<^sub>0\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "Act-Basic:1" act_and_not_nec_not_delta
+          "&E"(1) "\<or>E"(2) not_act_q_zero q\<^sub>0_prop by blast
+
+  AOT_have \<open>[L\<^sup>-]\<down>\<close> by (simp add: "rel-neg-T:3")
+  moreover AOT_have \<open>\<not>\<^bold>\<A>[L\<^sup>-]b & \<not>\<^bold>\<Delta>[L\<^sup>-]b & \<not>\<^bold>\<A>[L\<^sup>-]a & \<not>\<^bold>\<Delta>[L\<^sup>-]a\<close>
+  proof (safe intro!: "&I")
+    AOT_show \<open>\<not>\<^bold>\<A>[L\<^sup>-]b\<close>
+      by (meson "\<equiv>E"(1) "logic-actual-nec:1"[axiom_inst] "nec-imp-act"
+                nec_not_L_neg "\<rightarrow>E")
+    AOT_show \<open>\<not>\<^bold>\<Delta>[L\<^sup>-]b\<close>
+      by (meson Delta_pos "KBasic2:1" "\<equiv>E"(1)
+                "modus-tollens:1" nec_not_L_neg)
+    AOT_show \<open>\<not>\<^bold>\<A>[L\<^sup>-]a\<close>
+      by (meson "\<equiv>E"(1) "logic-actual-nec:1"[axiom_inst]
+                "nec-imp-act" nec_not_L_neg "\<rightarrow>E")
+    AOT_show \<open>\<not>\<^bold>\<Delta>[L\<^sup>-]a\<close>
+      using Delta_pos "KBasic2:1" "\<equiv>E"(1) "modus-tollens:1"
+            nec_not_L_neg by blast
+  qed
+  ultimately AOT_obtain F\<^sub>0 where \<open>\<not>\<^bold>\<A>[F\<^sub>0]b & \<not>\<^bold>\<Delta>[F\<^sub>0]b & \<not>\<^bold>\<A>[F\<^sub>0]a & \<not>\<^bold>\<Delta>[F\<^sub>0]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>0]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>0]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>0]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>0]a\<close>
+    using "&E" by blast+
+  note props = this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [A!]y & q\<^sub>0]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y A!y & q\<^sub>0]x\<close> \<open>A!x & q\<^sub>0\<close> for: x)
+    AOT_show \<open>\<not>\<^bold>\<A>([A!]b & q\<^sub>0)\<close>
+      using "Act-Basic:2" "&E"(1) "\<equiv>E"(1) not_act_abs_b "raa-cor:3" by blast
+  next AOT_show \<open>\<not>\<^bold>\<Delta>([A!]b & q\<^sub>0)\<close>
+      by (metis Delta_pos "KBasic2:3" "&E"(1) "\<equiv>E"(4) not_act_abs_b
+                "oa-facts:4" "oa-facts:8" "raa-cor:3" "\<rightarrow>E")
+  next AOT_show \<open>\<not>\<^bold>\<A>([A!]a & q\<^sub>0)\<close>
+      using "Act-Basic:2" "&E"(2) "\<equiv>E"(1) not_act_q_zero
+            "raa-cor:3" by blast
+  next AOT_show \<open>\<^bold>\<Delta>([A!]a & q\<^sub>0)\<close>
+    proof (rule not_act_and_pos_delta)
+      AOT_show \<open>\<not>\<^bold>\<A>([A!]a & q\<^sub>0)\<close>
+        using "Act-Basic:2" "&E"(2) "\<equiv>E"(4) not_act_q_zero
+              "raa-cor:3" by blast
+    next AOT_show \<open>\<diamond>([A!]a & q\<^sub>0)\<close>
+        by (metis "&I" "\<rightarrow>E" Delta_pos "KBasic:16" "&E"(1) delta_abs_a
+                  "\<equiv>E"(1) "oa-facts:6" q\<^sub>0_prop)
+    qed
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>1 where \<open>\<not>\<^bold>\<A>[F\<^sub>1]b & \<not>\<^bold>\<Delta>[F\<^sub>1]b & \<not>\<^bold>\<A>[F\<^sub>1]a & \<^bold>\<Delta>[F\<^sub>1]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>1]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>1]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [A!]y & \<not>q\<^sub>0]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y A!y & \<not>q\<^sub>0]x\<close> \<open>A!x & \<not>q\<^sub>0\<close> for: x)
+    AOT_show \<open>\<not>\<^bold>\<A>([A!]b & \<not>q\<^sub>0)\<close>
+      using "Act-Basic:2" "&E"(1) "\<equiv>E"(1) not_act_abs_b "raa-cor:3" by blast
+  next AOT_show \<open>\<not>\<^bold>\<Delta>([A!]b & \<not>q\<^sub>0)\<close>
+      by (meson "RM\<diamond>" Delta_pos "Conjunction Simplification"(1) "\<equiv>E"(4)
+                "modus-tollens:1" not_act_abs_b "oa-facts:4" "oa-facts:8")
+  next AOT_show \<open>\<^bold>\<A>([A!]a & \<not>q\<^sub>0)\<close>
+      by (metis "Act-Basic:1" "Act-Basic:2" act_abs_a "&I" "\<or>E"(2)
+                "\<equiv>E"(3) not_act_q_zero "raa-cor:3")
+  next AOT_show \<open>\<not>\<^bold>\<Delta>([A!]a & \<not>q\<^sub>0)\<close>
+    proof (rule act_and_not_nec_not_delta)
+      AOT_show \<open>\<^bold>\<A>([A!]a & \<not>q\<^sub>0)\<close>
+        by (metis "Act-Basic:1" "Act-Basic:2" act_abs_a "&I" "\<or>E"(2)
+                  "\<equiv>E"(3) not_act_q_zero "raa-cor:3")
+    next
+      AOT_show \<open>\<not>\<box>([A!]a & \<not>q\<^sub>0)\<close>
+        by (metis "KBasic2:1" "KBasic:3" "&E"(1) "&E"(2) "\<equiv>E"(4)
+                  q\<^sub>0_prop "raa-cor:3")
+    qed
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>2 where \<open>\<not>\<^bold>\<A>[F\<^sub>2]b & \<not>\<^bold>\<Delta>[F\<^sub>2]b & \<^bold>\<A>[F\<^sub>2]a & \<not>\<^bold>\<Delta>[F\<^sub>2]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>2]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>2]b\<close> and \<open>\<^bold>\<A>[F\<^sub>2]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>2]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_have abstract_prop: \<open>\<not>\<^bold>\<A>[A!]b & \<not>\<^bold>\<Delta>[A!]b & \<^bold>\<A>[A!]a & \<^bold>\<Delta>[A!]a\<close>
+    using act_abs_a "&I" delta_abs_a not_act_abs_b not_delta_abs_b
+    by presburger
+  then AOT_obtain F\<^sub>3 where \<open>\<not>\<^bold>\<A>[F\<^sub>3]b & \<not>\<^bold>\<Delta>[F\<^sub>3]b & \<^bold>\<A>[F\<^sub>3]a & \<^bold>\<Delta>[F\<^sub>3]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] "oa-exist:2" by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>3]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>3]b\<close> and \<open>\<^bold>\<A>[F\<^sub>3]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>3]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_have \<open>\<not>\<^bold>\<A>[E!]b & \<^bold>\<Delta>[E!]b & \<not>\<^bold>\<A>[E!]a & \<not>\<^bold>\<Delta>[E!]a\<close>
+    by (meson "&I" delta_concrete_b not_act_concrete_a
+              not_act_concrete_b not_delta_concrete_a)
+  then AOT_obtain F\<^sub>4 where \<open>\<not>\<^bold>\<A>[F\<^sub>4]b & \<^bold>\<Delta>[F\<^sub>4]b & \<not>\<^bold>\<A>[F\<^sub>4]a & \<not>\<^bold>\<Delta>[F\<^sub>4]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]]
+    by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>4]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>4]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>4]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>4]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_modally_strict {
+    AOT_have \<open>[\<lambda>y q\<^sub>0]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<lambda>y q\<^sub>0]b & \<^bold>\<Delta>[\<lambda>y q\<^sub>0]b & \<not>\<^bold>\<A>[\<lambda>y q\<^sub>0]a & \<^bold>\<Delta>[\<lambda>y q\<^sub>0]a\<close>
+    by (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y q\<^sub>0]b\<close> \<open>q\<^sub>0\<close> for: b)
+       (auto simp: not_act_q_zero delta_q_zero  "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>5 where \<open>\<not>\<^bold>\<A>[F\<^sub>5]b & \<^bold>\<Delta>[F\<^sub>5]b & \<not>\<^bold>\<A>[F\<^sub>5]a & \<^bold>\<Delta>[F\<^sub>5]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]]
+    by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>5]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>5]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>5]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>5]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [E!]y \<or> ([A!]y & \<not>q\<^sub>0)]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof(safe intro!: "&I";
+        AOT_subst \<open>[\<lambda>y E!y \<or> (A!y & \<not>q\<^sub>0)]x\<close> \<open>E!x \<or> (A!x & \<not>q\<^sub>0)\<close> for: x)
+    AOT_have \<open>\<^bold>\<A>\<not>([A!]b & \<not>q\<^sub>0)\<close>
+      by (metis "Act-Basic:1" "Act-Basic:2" abstract_prop "&E"(1) "\<or>E"(2)
+                "\<equiv>E"(1) "raa-cor:3")
+    moreover AOT_have \<open>\<not>\<^bold>\<A>[E!]b\<close>
+      using b_prop "&E"(2) by blast
+    ultimately AOT_have 2: \<open>\<^bold>\<A>(\<not>[E!]b & \<not>([A!]b & \<not>q\<^sub>0))\<close>
+      by (metis "Act-Basic:2" "Act-Sub:1" "&I" "\<equiv>E"(3) "raa-cor:1")
+    AOT_have \<open>\<^bold>\<A>\<not>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
+      by (AOT_subst \<open>\<not>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close> \<open>\<not>[E!]b & \<not>([A!]b & \<not>q\<^sub>0)\<close>)
+         (auto simp: "oth-class-taut:5:d" 2)
+    AOT_thus \<open>\<not>\<^bold>\<A>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
+      by (metis "\<not>\<not>I" "Act-Sub:1" "\<equiv>E"(4))
+  next
+    AOT_show \<open>\<^bold>\<Delta>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
+    proof (rule not_act_and_pos_delta)
+      AOT_show \<open>\<not>\<^bold>\<A>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
+        by (metis "Act-Basic:2" "Act-Basic:9" "\<or>E"(2) "raa-cor:3"
+                  "Conjunction Simplification"(1) "\<equiv>E"(4)
+                  "modus-tollens:1" not_act_abs_b not_act_concrete_b)
+    next
+      AOT_show \<open>\<diamond>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
+        using "KBasic2:2" b_prop "&E"(1) "\<or>I"(1) "\<equiv>E"(3) "raa-cor:3" by blast
+    qed
+  next AOT_show \<open>\<^bold>\<A>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
+      by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_abs_a "&I"
+                "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(3) not_act_q_zero "raa-cor:1")
+  next AOT_show \<open>\<not>\<^bold>\<Delta>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
+    proof (rule act_and_not_nec_not_delta)
+      AOT_show \<open>\<^bold>\<A>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
+        by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_abs_a "&I"
+                  "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(3) not_act_q_zero "raa-cor:1")
+    next
+      AOT_have \<open>\<box>\<not>[E!]a\<close>
+        by (metis "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" "&I" "\<or>I"(2)
+                  necessary_or_contingently_false
+                  not_act_concrete_a not_delta_concrete_a "raa-cor:3")
+      moreover AOT_have \<open>\<diamond>\<not>([A!]a & \<not>q\<^sub>0)\<close>
+        by (metis "KBasic2:1" "KBasic:11" "KBasic:3"
+                  "&E"(1,2) "\<equiv>E"(1) q\<^sub>0_prop "raa-cor:3")
+      ultimately AOT_have \<open>\<diamond>(\<not>[E!]a & \<not>([A!]a & \<not>q\<^sub>0))\<close>
+        by (metis "KBasic:16" "&I" "vdash-properties:10")
+      AOT_hence \<open>\<diamond>\<not>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
+        by (metis "RE\<diamond>" "\<equiv>E"(2) "oth-class-taut:5:d")
+      AOT_thus \<open>\<not>\<box>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
+        by (metis "KBasic:12" "\<equiv>E"(1) "raa-cor:3")
+    qed
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>6 where \<open>\<not>\<^bold>\<A>[F\<^sub>6]b & \<^bold>\<Delta>[F\<^sub>6]b & \<^bold>\<A>[F\<^sub>6]a & \<not>\<^bold>\<Delta>[F\<^sub>6]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>6]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>6]b\<close> and \<open>\<^bold>\<A>[F\<^sub>6]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>6]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [A!]y \<or> [E!]y]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof(safe intro!: "&I"; AOT_subst \<open>[\<lambda>y A!y \<or> E!y]x\<close> \<open>A!x \<or> E!x\<close> for: x)
+    AOT_show \<open>\<not>\<^bold>\<A>([A!]b \<or> [E!]b)\<close>
+      using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_abs_b
+            not_act_concrete_b "raa-cor:3" by blast
+  next AOT_show \<open>\<^bold>\<Delta>([A!]b \<or> [E!]b)\<close>
+    proof (rule not_act_and_pos_delta)
+      AOT_show \<open>\<not>\<^bold>\<A>([A!]b \<or> [E!]b)\<close>
+        using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_abs_b
+              not_act_concrete_b "raa-cor:3" by blast
+    next AOT_show \<open>\<diamond>([A!]b \<or> [E!]b)\<close>
+        using "KBasic2:2" b_prop "&E"(1) "\<or>I"(2) "\<equiv>E"(2) by blast
+    qed
+  next AOT_show \<open>\<^bold>\<A>([A!]a \<or> [E!]a)\<close>
+      by (meson "Act-Basic:9" act_abs_a "\<or>I"(1) "\<equiv>E"(2))
+  next AOT_show \<open>\<^bold>\<Delta>([A!]a \<or> [E!]a) \<close>
+    proof (rule nec_delta)
+      AOT_show \<open>\<box>([A!]a \<or> [E!]a)\<close>
+        by (metis "KBasic:15" act_abs_a act_and_not_nec_not_delta
+                  "Disjunction Addition"(1) delta_abs_a "raa-cor:3" "\<rightarrow>E")
+    qed
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>7 where \<open>\<not>\<^bold>\<A>[F\<^sub>7]b & \<^bold>\<Delta>[F\<^sub>7]b & \<^bold>\<A>[F\<^sub>7]a & \<^bold>\<Delta>[F\<^sub>7]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>7]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>7]b\<close> and \<open>\<^bold>\<A>[F\<^sub>7]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>7]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [O!]y & \<not>[E!]y]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof(safe intro!: "&I"; AOT_subst \<open>[\<lambda>y O!y & \<not>E!y]x\<close> \<open>O!x & \<not>E!x\<close> for: x)
+    AOT_show \<open>\<^bold>\<A>([O!]b & \<not>[E!]b)\<close>
+      by (metis "Act-Basic:1" "Act-Basic:2" act_ord_b "&I" "\<or>E"(2)
+                "\<equiv>E"(3) not_act_concrete_b "raa-cor:3")
+  next AOT_show \<open>\<not>\<^bold>\<Delta>([O!]b & \<not>[E!]b)\<close>
+      by (metis (no_types, opaque_lifting) "conventions:5" "Act-Sub:1" "RM:1"
+                act_and_not_nec_not_delta "act-conj-act:3"
+                act_ord_b b_prop "&I" "&E"(1) "Conjunction Simplification"(2)
+                "df-rules-formulas[3]"
+                "\<equiv>E"(3) "raa-cor:1" "\<rightarrow>E")
+  next AOT_show \<open>\<not>\<^bold>\<A>([O!]a & \<not>[E!]a)\<close>
+      using "Act-Basic:2" "&E"(1) "\<equiv>E"(1) not_act_ord_a "raa-cor:3" by blast
+  next AOT_have \<open>\<not>\<diamond>([O!]a & \<not>[E!]a)\<close>
+      by (metis "KBasic2:3" "&E"(1) "\<equiv>E"(4) not_act_ord_a "oa-facts:3"
+                "oa-facts:7" "raa-cor:3" "vdash-properties:10")
+    AOT_thus \<open>\<not>\<^bold>\<Delta>([O!]a & \<not>[E!]a)\<close>
+      by (rule impossible_delta)
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>8 where \<open>\<^bold>\<A>[F\<^sub>8]b & \<not>\<^bold>\<Delta>[F\<^sub>8]b & \<not>\<^bold>\<A>[F\<^sub>8]a & \<not>\<^bold>\<Delta>[F\<^sub>8]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>8]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>8]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>8]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>8]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y \<not>[E!]y & ([O!]y \<or> q\<^sub>0)]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof(safe intro!: "&I";
+        AOT_subst \<open>[\<lambda>y \<not>E!y & (O!y \<or> q\<^sub>0)]x\<close> \<open>\<not>E!x & (O!x \<or> q\<^sub>0)\<close> for: x)
+    AOT_show \<open>\<^bold>\<A>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
+      by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_ord_b "&I"
+                "\<or>I"(1) "\<or>E"(2) "\<equiv>E"(3) not_act_concrete_b "raa-cor:1")
+  next AOT_show \<open>\<not>\<^bold>\<Delta>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
+    proof (rule act_and_pos_not_not_delta)
+      AOT_show \<open>\<^bold>\<A>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
+        by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_ord_b "&I"
+                  "\<or>I"(1) "\<or>E"(2) "\<equiv>E"(3) not_act_concrete_b "raa-cor:1")
+    next
+      AOT_show \<open>\<diamond>\<not>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
+      proof (AOT_subst \<open>\<not>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close> \<open>[E!]b \<or> \<not>([O!]b \<or> q\<^sub>0)\<close>)
+        AOT_modally_strict {
+          AOT_show \<open>\<not>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0)) \<equiv> [E!]b \<or> \<not>([O!]b \<or> q\<^sub>0)\<close>
+            by (metis "&I" "&E"(1,2) "\<or>I"(1,2) "\<or>E"(2)
+                      "\<rightarrow>I" "\<equiv>I" "reductio-aa:1")
+        }
+      next
+        AOT_show \<open>\<diamond>([E!]b \<or> \<not>([O!]b \<or> q\<^sub>0))\<close>
+          using "KBasic2:2" b_prop "&E"(1) "\<or>I"(1) "\<equiv>E"(3)
+                "raa-cor:3" by blast
+       qed
+     qed
+   next
+     AOT_show \<open>\<not>\<^bold>\<A>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
+       using "Act-Basic:2" "Act-Basic:9" "&E"(2) "\<or>E"(3) "\<equiv>E"(1)
+             not_act_ord_a not_act_q_zero "reductio-aa:2" by blast
+   next
+     AOT_show \<open>\<^bold>\<Delta>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
+     proof (rule not_act_and_pos_delta)
+       AOT_show \<open>\<not>\<^bold>\<A>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
+         by (metis "Act-Basic:2" "Act-Basic:9" "&E"(2) "\<or>E"(3) "\<equiv>E"(1)
+                   not_act_ord_a not_act_q_zero "reductio-aa:2")
+     next
+       AOT_have \<open>\<box>\<not>[E!]a\<close>
+         using "KBasic2:1" "\<equiv>E"(2) not_act_and_pos_delta not_act_concrete_a
+               not_delta_concrete_a "raa-cor:5" by blast
+       moreover AOT_have \<open>\<diamond>([O!]a \<or> q\<^sub>0)\<close>
+         by (metis "KBasic2:2" "&E"(1) "\<or>I"(2) "\<equiv>E"(3) q\<^sub>0_prop "raa-cor:3")
+       ultimately AOT_show \<open>\<diamond>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
+         by (metis "KBasic:16" "&I" "vdash-properties:10")
+     qed
+   qed(auto simp:  "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>9 where \<open>\<^bold>\<A>[F\<^sub>9]b & \<not>\<^bold>\<Delta>[F\<^sub>9]b & \<not>\<^bold>\<A>[F\<^sub>9]a & \<^bold>\<Delta>[F\<^sub>9]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>9]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>9]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>9]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>9]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_modally_strict {
+    AOT_have \<open>[\<lambda>y \<not>q\<^sub>0]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<^bold>\<A>[\<lambda>y \<not>q\<^sub>0]b & \<not>\<^bold>\<Delta>[\<lambda>y \<not>q\<^sub>0]b & \<^bold>\<A>[\<lambda>y \<not>q\<^sub>0]a & \<not>\<^bold>\<Delta>[\<lambda>y \<not>q\<^sub>0]a\<close>
+    by (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y \<not>q\<^sub>0]x\<close> \<open>\<not>q\<^sub>0\<close> for: x)
+       (auto simp: act_not_q_zero not_delta_not_q_zero
+                   "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>1\<^sub>0 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>0]b & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]b & \<^bold>\<A>[F\<^sub>1\<^sub>0]a & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>0]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>0]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_modally_strict {
+    AOT_have \<open>[\<lambda>y \<not>[E!]y]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<^bold>\<A>[\<lambda>y \<not>[E!]y]b & \<not>\<^bold>\<Delta>[\<lambda>y \<not>[E!]y]b &
+                     \<^bold>\<A>[\<lambda>y \<not>[E!]y]a & \<^bold>\<Delta>[\<lambda>y \<not>[E!]y]a\<close>
+  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y \<not>[E!]y]x\<close> \<open>\<not>[E!]x\<close> for: x)
+    AOT_show \<open>\<^bold>\<A>\<not>[E!]b\<close>
+      using "Act-Basic:1" "\<or>E"(2) not_act_concrete_b by blast
+  next AOT_show \<open>\<not>\<^bold>\<Delta>\<not>[E!]b\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "Act-Basic:1" act_and_not_nec_not_delta
+            b_prop "&E"(1) "\<or>E"(2) not_act_concrete_b by blast
+  next AOT_show \<open>\<^bold>\<A>\<not>[E!]a\<close>
+      using "Act-Basic:1" "\<or>E"(2) not_act_concrete_a by blast
+  next AOT_show \<open>\<^bold>\<Delta>\<not>[E!]a\<close>
+      using "KBasic2:1" "\<equiv>E"(2) nec_delta not_act_and_pos_delta
+            not_act_concrete_a not_delta_concrete_a "reductio-aa:1"
+      by blast
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>1\<^sub>1 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>1]b & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>1]b & \<^bold>\<A>[F\<^sub>1\<^sub>1]a & \<^bold>\<Delta>[F\<^sub>1\<^sub>1]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>1]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>1]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>1]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>1]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_have \<open>\<^bold>\<A>[O!]b & \<^bold>\<Delta>[O!]b & \<not>\<^bold>\<A>[O!]a & \<not>\<^bold>\<Delta>[O!]a\<close>
+    by (simp add: act_ord_b "&I" delta_ord_b not_act_ord_a not_delta_ord_a)
+  then AOT_obtain F\<^sub>1\<^sub>2 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>2]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>2]b & \<not>\<^bold>\<A>[F\<^sub>1\<^sub>2]a & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>2]a\<close>
+    using "oa-exist:1" "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>2]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>2]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>1\<^sub>2]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>2]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [O!]y \<or> q\<^sub>0]\<guillemotright>"
+  AOT_modally_strict {
+    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y O!y \<or> q\<^sub>0]x\<close> \<open>O!x \<or> q\<^sub>0\<close> for: x)
+    AOT_show \<open>\<^bold>\<A>([O!]b \<or> q\<^sub>0)\<close>
+      by (meson "Act-Basic:9" act_ord_b "\<or>I"(1) "\<equiv>E"(2))
+  next AOT_show \<open>\<^bold>\<Delta>([O!]b \<or> q\<^sub>0)\<close>
+      by (meson "KBasic:15" b_ord "\<or>I"(1) nec_delta "oa-facts:1" "\<rightarrow>E")
+  next AOT_show \<open>\<not>\<^bold>\<A>([O!]a \<or> q\<^sub>0)\<close>
+      using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_ord_a
+            not_act_q_zero "raa-cor:3" by blast
+  next AOT_show \<open>\<^bold>\<Delta>([O!]a \<or> q\<^sub>0)\<close>
+    proof (rule not_act_and_pos_delta)
+      AOT_show \<open>\<not>\<^bold>\<A>([O!]a \<or> q\<^sub>0)\<close>
+        using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_ord_a
+              not_act_q_zero "raa-cor:3" by blast
+    next AOT_show \<open>\<diamond>([O!]a \<or> q\<^sub>0)\<close>
+        using "KBasic2:2" "&E"(1) "\<or>I"(2) "\<equiv>E"(2) q\<^sub>0_prop by blast
+    qed
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>1\<^sub>3 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>3]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>3]b & \<not>\<^bold>\<A>[F\<^sub>1\<^sub>3]a & \<^bold>\<Delta>[F\<^sub>1\<^sub>3]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>3]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>3]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>1\<^sub>3]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>3]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [O!]y \<or> \<not>q\<^sub>0]\<guillemotright>"
+  AOT_modally_strict {
+     AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
+  } note 1 = this
+  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
+  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y O!y \<or> \<not>q\<^sub>0]x\<close> \<open>O!x \<or> \<not>q\<^sub>0\<close> for: x)
+    AOT_show \<open>\<^bold>\<A>([O!]b \<or> \<not>q\<^sub>0)\<close>
+      by (meson "Act-Basic:9" act_not_q_zero "\<or>I"(2) "\<equiv>E"(2))
+  next AOT_show \<open>\<^bold>\<Delta>([O!]b \<or> \<not>q\<^sub>0)\<close>
+      by (meson "KBasic:15" b_ord "\<or>I"(1) nec_delta "oa-facts:1" "\<rightarrow>E")
+  next AOT_show \<open>\<^bold>\<A>([O!]a \<or> \<not>q\<^sub>0)\<close>
+      by (meson "Act-Basic:9" act_not_q_zero "\<or>I"(2) "\<equiv>E"(2))
+  next AOT_show \<open>\<not>\<^bold>\<Delta>([O!]a \<or> \<not>q\<^sub>0)\<close>
+    proof(rule act_and_pos_not_not_delta)
+      AOT_show \<open>\<^bold>\<A>([O!]a \<or> \<not>q\<^sub>0)\<close>
+        by (meson "Act-Basic:9" act_not_q_zero "\<or>I"(2) "\<equiv>E"(2))
+    next
+      AOT_have \<open>\<box>\<not>[O!]a\<close>
+        using "KBasic2:1" "\<equiv>E"(2) not_act_and_pos_delta
+              not_act_ord_a not_delta_ord_a "raa-cor:6" by blast
+      moreover AOT_have \<open>\<diamond>q\<^sub>0\<close>
+        by (meson "&E"(1) q\<^sub>0_prop)
+      ultimately AOT_have 2: \<open>\<diamond>(\<not>[O!]a & q\<^sub>0)\<close>
+         by (metis "KBasic:16" "&I" "vdash-properties:10")
+      AOT_show \<open>\<diamond>\<not>([O!]a \<or> \<not>q\<^sub>0)\<close>
+      proof (AOT_subst (reverse) \<open>\<not>([O!]a \<or> \<not>q\<^sub>0)\<close> \<open>\<not>[O!]a & q\<^sub>0\<close>)
+        AOT_modally_strict {
+          AOT_show \<open>\<not>[O!]a & q\<^sub>0 \<equiv> \<not>([O!]a \<or> \<not>q\<^sub>0)\<close>
+            by (metis "&I" "&E"(1) "&E"(2) "\<or>I"(1) "\<or>I"(2)
+                      "\<or>E"(3) "deduction-theorem" "\<equiv>I" "raa-cor:3")
+        }
+      next
+        AOT_show \<open>\<diamond>(\<not>[O!]a & q\<^sub>0)\<close>
+          using "2" by blast
+      qed
+    qed
+  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
+  ultimately AOT_obtain F\<^sub>1\<^sub>4 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>4]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>4]b & \<^bold>\<A>[F\<^sub>1\<^sub>4]a & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>4]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>4]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>4]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>4]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>4]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  AOT_have \<open>[L]\<down>\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
+  moreover AOT_have \<open>\<^bold>\<A>[L]b & \<^bold>\<Delta>[L]b & \<^bold>\<A>[L]a & \<^bold>\<Delta>[L]a\<close>
+  proof (safe intro!: "&I")
+    AOT_show \<open>\<^bold>\<A>[L]b\<close>
+      by (meson nec_L "nec-imp-act" "vdash-properties:10")
+    next AOT_show \<open>\<^bold>\<Delta>[L]b\<close> using nec_L nec_delta by blast
+    next AOT_show \<open>\<^bold>\<A>[L]a\<close> by (meson nec_L "nec-imp-act" "\<rightarrow>E")
+    next AOT_show \<open>\<^bold>\<Delta>[L]a\<close> using nec_L nec_delta by blast
+  qed
+  ultimately AOT_obtain F\<^sub>1\<^sub>5 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>5]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>5]b & \<^bold>\<A>[F\<^sub>1\<^sub>5]a & \<^bold>\<Delta>[F\<^sub>1\<^sub>5]a\<close>
+    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
+  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>5]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>5]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>5]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>5]a\<close>
+    using "&E" by blast+
+  note props = props this
+
+  show ?thesis
+    by (rule "\<exists>I"(2)[where \<beta>=F\<^sub>0]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>2]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>3];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>4]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>5];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>6]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>7];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>8]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>9];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>0]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>1];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>2]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>3];
+        rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>4]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>5];
+        safe intro!: "&I")
+       (match conclusion in "[?v \<Turnstile> [F] \<noteq> [G]]" for F G \<Rightarrow> \<open>
+        match props in A: "[?v \<Turnstile> \<not>\<phi>{F}]" for \<phi> \<Rightarrow> \<open>
+        match (\<phi>) in "\<lambda>a . ?p" \<Rightarrow> \<open>fail\<close> \<bar> "\<lambda>a . a" \<Rightarrow> \<open>fail\<close> \<bar> _ \<Rightarrow> \<open>
+        match props in B: "[?v \<Turnstile> \<phi>{G}]" \<Rightarrow> \<open>
+        fact "pos-not-equiv-ne:4"[where F=F and G=G and \<phi>=\<phi>, THEN "\<rightarrow>E",
+                                OF "oth-class-taut:4:h"[THEN "\<equiv>E"(2)],
+                                OF "Disjunction Addition"(2)[THEN "\<rightarrow>E"],
+                                OF "&I", OF A, OF B]\<close>\<close>\<close>\<close>)+
+qed
+
+subsection\<open>The Theory of Objects\<close>
+text\<open>\label{PLM: 9.11}\<close>
+
+AOT_theorem "o-objects-exist:1": \<open>\<box>\<exists>x O!x\<close>
+proof(rule RN)
+  AOT_modally_strict {
+    AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>[E!]a)\<close>
+      using "\<exists>E"[rotated, OF "qml:4"[axiom_inst, THEN "BF\<diamond>"[THEN "\<rightarrow>E"]]]
+      by blast
+    AOT_hence 1: \<open>\<diamond>E!a\<close> by (metis "KBasic2:3" "&E"(1) "\<rightarrow>E")
+    AOT_have \<open>[\<lambda>x \<diamond>[E!]x]a\<close>
+    proof (rule "\<beta>\<leftarrow>C"(1); "cqt:2[lambda]"?)
+      AOT_show \<open>a\<down>\<close> using "cqt:2[const_var]"[axiom_inst] by blast
+    next
+      AOT_show \<open>\<diamond>E!a\<close> by (fact 1)
+    qed
+    AOT_hence \<open>O!a\<close> by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2"
+    AOT_thus \<open>\<exists>x [O!]x\<close> by (rule "\<exists>I")
+  }
+qed
+
+AOT_theorem "o-objects-exist:2": \<open>\<box>\<exists>x A!x\<close>
+proof (rule RN)
+  AOT_modally_strict {
+    AOT_obtain a where \<open>[A!]a\<close>
+      using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
+    AOT_thus \<open>\<exists>x A!x\<close> using "\<exists>I" by blast
+  }
+qed
+
+AOT_theorem "o-objects-exist:3": \<open>\<box>\<not>\<forall>x O!x\<close>
+  by (rule RN)
+     (metis (no_types, opaque_lifting) "\<exists>E" "cqt-orig:1[const_var]"
+        "\<equiv>E"(4) "modus-tollens:1" "o-objects-exist:2" "oa-contingent:2"
+        "qml:2"[axiom_inst] "reductio-aa:2")
+
+AOT_theorem "o-objects-exist:4": \<open>\<box>\<not>\<forall>x A!x\<close>
+  by (rule RN)
+     (metis (mono_tags, opaque_lifting) "\<exists>E" "cqt-orig:1[const_var]"
+        "\<equiv>E"(1) "modus-tollens:1" "o-objects-exist:1" "oa-contingent:2"
+        "qml:2"[axiom_inst] "\<rightarrow>E")
+
+AOT_theorem "o-objects-exist:5": \<open>\<box>\<not>\<forall>x E!x\<close>
+proof (rule RN; rule "raa-cor:2")
+  AOT_modally_strict {
+    AOT_assume \<open>\<forall>x E!x\<close>
+    moreover AOT_obtain a where abs: \<open>A!a\<close>
+      using "o-objects-exist:2"[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]]
+            "\<exists>E"[rotated] by blast
+    ultimately AOT_have \<open>E!a\<close> using "\<forall>E" by blast
+    AOT_hence 1: \<open>\<diamond>E!a\<close> by (metis "T\<diamond>" "\<rightarrow>E")
+    AOT_have \<open>[\<lambda>y \<diamond>E!y]a\<close>
+    proof (rule "\<beta>\<leftarrow>C"(1); "cqt:2[lambda]"?)
+      AOT_show \<open>a\<down>\<close> using "cqt:2[const_var]"[axiom_inst].
+    next
+      AOT_show \<open>\<diamond>E!a\<close> by (fact 1)
+    qed
+    AOT_hence \<open>O!a\<close>
+      by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2[lambda]"
+    AOT_hence \<open>\<not>A!a\<close> by (metis "\<equiv>E"(1) "oa-contingent:2") 
+    AOT_thus \<open>p & \<not>p\<close> for p using abs by (metis "raa-cor:3")
+  }
+qed
+
+AOT_theorem partition: \<open>\<not>\<exists>x (O!x & A!x)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>\<exists>x (O!x & A!x)\<close>
+  then AOT_obtain a where \<open>O!a & A!a\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>p & \<not>p\<close> for p
+    by (metis "&E"(1) "Conjunction Simplification"(2) "\<equiv>E"(1)
+              "modus-tollens:1" "oa-contingent:2" "raa-cor:3")
+qed
+
+AOT_define eq_E :: \<open>\<Pi>\<close> ("'(=\<^sub>E')")
+  "=E": \<open>(=\<^sub>E) =\<^sub>d\<^sub>f [\<lambda>xy O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)]\<close>
+
+syntax "_AOT_eq_E_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "=\<^sub>E" 50)
+translations
+  "_AOT_eq_E_infix \<kappa> \<kappa>'" == "CONST AOT_exe (CONST eq_E) (CONST Pair \<kappa> \<kappa>')"
+print_translation\<open>
+AOT_syntax_print_translations
+[(\<^const_syntax>\<open>AOT_exe\<close>, fn ctxt => fn [
+  Const (\<^const_name>\<open>eq_E\<close>, _),
+  Const (\<^const_syntax>\<open>Pair\<close>, _) $ lhs $ rhs
+] => Const (\<^syntax_const>\<open>_AOT_eq_E_infix\<close>, dummyT) $ lhs $ rhs)]\<close>
+
+text\<open>Note: Not explicitly mentioned as theorem in PLM.\<close>
+AOT_theorem "=E[denotes]": \<open>[(=\<^sub>E)]\<down>\<close>
+  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "=E"]) "cqt:2[lambda]"+
+
+AOT_theorem "=E-simple:1": \<open>x =\<^sub>E y \<equiv> (O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y))\<close>
+proof -
+  AOT_have 1: \<open>[\<lambda>xy [O!]x & [O!]y & \<box>\<forall>F ([F]x \<equiv> [F]y)]\<down>\<close> by "cqt:2"
+  show ?thesis
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "=E"]; "cqt:2[lambda]"?)
+    using "beta-C-meta"[THEN "\<rightarrow>E", OF 1, unvarify \<nu>\<^sub>1\<nu>\<^sub>n, of "(_,_)",
+                        OF tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"], OF "&I",
+                        OF "cqt:2[const_var]"[axiom_inst],
+                        OF "cqt:2[const_var]"[axiom_inst]]
+    by fast
+qed
+
+AOT_theorem "=E-simple:2": \<open>x =\<^sub>E y \<rightarrow> x = y\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>x =\<^sub>E y\<close>
+  AOT_hence \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    using "=E-simple:1"[THEN "\<equiv>E"(1)] by blast
+  AOT_thus \<open>x = y\<close>
+    using "\<equiv>\<^sub>d\<^sub>fI"[OF "identity:1"] "\<or>I" by blast
+qed
+
+AOT_theorem "id-nec3:1": \<open>x =\<^sub>E y \<equiv> \<box>(x =\<^sub>E y)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>x =\<^sub>E y\<close>
+  AOT_hence \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    using "=E-simple:1" "\<equiv>E" by blast
+  AOT_hence \<open>\<box>O!x & \<box>O!y & \<box>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    by (metis "S5Basic:6" "&I" "&E"(1) "&E"(2) "\<equiv>E"(4)
+              "oa-facts:1" "raa-cor:3" "vdash-properties:10")
+  AOT_hence \<open>\<box>(O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y))\<close>
+    by (metis "&E"(1) "&E"(2) "\<equiv>E"(2) "KBasic:3" "&I")
+  AOT_thus \<open>\<box>(x =\<^sub>E y)\<close>
+    using "=E-simple:1"
+    by (AOT_subst \<open>x =\<^sub>E y\<close> \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>) auto
+next
+  AOT_assume \<open>\<box>(x =\<^sub>E y)\<close>
+  AOT_thus \<open>x =\<^sub>E y\<close> using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "id-nec3:2": \<open>\<diamond>(x =\<^sub>E y) \<equiv> x =\<^sub>E y\<close>
+  by (meson "RE\<diamond>" "S5Basic:2" "id-nec3:1" "\<equiv>E"(1,5) "Commutativity of \<equiv>")
+
+AOT_theorem "id-nec3:3": \<open>\<diamond>(x =\<^sub>E y) \<equiv> \<box>(x =\<^sub>E y)\<close>
+  by (meson "id-nec3:1" "id-nec3:2" "\<equiv>E"(5))
+
+syntax "_AOT_non_eq_E" :: \<open>\<Pi>\<close> ("'(\<noteq>\<^sub>E')")
+translations
+  (\<Pi>) "(\<noteq>\<^sub>E)" == (\<Pi>) "(=\<^sub>E)\<^sup>-"
+syntax "_AOT_non_eq_E_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "\<noteq>\<^sub>E" 50)
+translations
+ "_AOT_non_eq_E_infix \<kappa> \<kappa>'" ==
+ "CONST AOT_exe (CONST relation_negation (CONST eq_E)) (CONST Pair \<kappa> \<kappa>')"
+print_translation\<open>
+AOT_syntax_print_translations
+[(\<^const_syntax>\<open>AOT_exe\<close>, fn ctxt => fn [
+  Const (\<^const_syntax>\<open>relation_negation\<close>, _) $ Const (\<^const_name>\<open>eq_E\<close>, _),
+  Const (\<^const_syntax>\<open>Pair\<close>, _) $ lhs $ rhs
+] => Const (\<^syntax_const>\<open>_AOT_non_eq_E_infix\<close>, dummyT) $ lhs $ rhs)]\<close>
+AOT_theorem "thm-neg=E": \<open>x \<noteq>\<^sub>E y \<equiv> \<not>(x =\<^sub>E y)\<close>
+proof -
+  AOT_have \<theta>: \<open>[\<lambda>x\<^sub>1...x\<^sub>2 \<not>(=\<^sub>E)x\<^sub>1...x\<^sub>2]\<down>\<close> by "cqt:2"
+  AOT_have \<open>x \<noteq>\<^sub>E y \<equiv> [\<lambda>x\<^sub>1...x\<^sub>2 \<not>(=\<^sub>E)x\<^sub>1...x\<^sub>2]xy\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF \<theta>])
+       (meson "oth-class-taut:3:a")
+  also AOT_have \<open>\<dots> \<equiv> \<not>(=\<^sub>E)xy\<close>
+    by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E", unvarify \<nu>\<^sub>1\<nu>\<^sub>n] "cqt:2"
+                     tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I")
+  finally show ?thesis.
+qed
+
+AOT_theorem "id-nec4:1": \<open>x \<noteq>\<^sub>E y \<equiv> \<box>(x \<noteq>\<^sub>E y)\<close>
+proof -
+  AOT_have \<open>x \<noteq>\<^sub>E y \<equiv> \<not>(x =\<^sub>E y)\<close> using "thm-neg=E".
+  also AOT_have \<open>\<dots> \<equiv> \<not>\<diamond>(x =\<^sub>E y)\<close>
+    by (meson "id-nec3:2" "\<equiv>E"(1) "Commutativity of \<equiv>" "oth-class-taut:4:b")
+  also AOT_have \<open>\<dots> \<equiv> \<box>\<not>(x =\<^sub>E y)\<close>
+    by (meson "KBasic2:1" "\<equiv>E"(2) "Commutativity of \<equiv>")
+  also AOT_have \<open>\<dots> \<equiv> \<box>(x \<noteq>\<^sub>E y)\<close>
+    by (AOT_subst (reverse) \<open>\<not>(x =\<^sub>E y)\<close> \<open>x \<noteq>\<^sub>E y\<close>)
+       (auto simp: "thm-neg=E" "oth-class-taut:3:a")
+  finally show ?thesis.
+qed
+
+AOT_theorem "id-nec4:2": \<open>\<diamond>(x \<noteq>\<^sub>E y) \<equiv> (x \<noteq>\<^sub>E y)\<close>
+  by (meson "RE\<diamond>" "S5Basic:2" "id-nec4:1" "\<equiv>E"(2,5) "Commutativity of \<equiv>")
+
+AOT_theorem "id-nec4:3": \<open>\<diamond>(x \<noteq>\<^sub>E y) \<equiv> \<box>(x \<noteq>\<^sub>E y)\<close>
+  by (meson "id-nec4:1" "id-nec4:2" "\<equiv>E"(5))
+
+AOT_theorem "id-act2:1": \<open>x =\<^sub>E y \<equiv> \<^bold>\<A>x =\<^sub>E y\<close>
+  by (meson "Act-Basic:5" "Act-Sub:2" "RA[2]" "id-nec3:2" "\<equiv>E"(1,6))
+AOT_theorem "id-act2:2": \<open>x \<noteq>\<^sub>E y \<equiv> \<^bold>\<A>x \<noteq>\<^sub>E y\<close>
+  by (meson "Act-Basic:5" "Act-Sub:2" "RA[2]" "id-nec4:2" "\<equiv>E"(1,6))
+
+AOT_theorem "ord=Eequiv:1": \<open>O!x \<rightarrow> x =\<^sub>E x\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume 1: \<open>O!x\<close>
+  AOT_show \<open>x =\<^sub>E x\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "=E"]) apply "cqt:2[lambda]"
+    apply (rule "\<beta>\<leftarrow>C"(1))
+      apply "cqt:2[lambda]"
+     apply (simp add: "&I" "cqt:2[const_var]"[axiom_inst] prod_denotesI)
+    by (simp add: "1" RN "&I" "oth-class-taut:3:a" "universal-cor")
+qed
+
+AOT_theorem "ord=Eequiv:2": \<open>x =\<^sub>E y \<rightarrow> y =\<^sub>E x\<close>
+proof(rule CP)
+  AOT_assume 1: \<open>x =\<^sub>E y\<close>
+  AOT_hence 2: \<open>x = y\<close> by (metis "=E-simple:2" "vdash-properties:10") 
+  AOT_have \<open>O!x\<close> using 1 by (meson "&E"(1) "=E-simple:1" "\<equiv>E"(1))
+  AOT_hence \<open>x =\<^sub>E x\<close> using "ord=Eequiv:1" "\<rightarrow>E" by blast
+  AOT_thus \<open>y =\<^sub>E x\<close> using "rule=E"[rotated, OF 2] by fast
+qed
+
+AOT_theorem "ord=Eequiv:3": \<open>(x =\<^sub>E y & y =\<^sub>E z) \<rightarrow> x =\<^sub>E z\<close>
+proof (rule CP)
+  AOT_assume 1: \<open>x =\<^sub>E y & y =\<^sub>E z\<close>
+  AOT_hence \<open>x = y & y = z\<close>
+    by (metis "&I" "&E"(1) "&E"(2) "=E-simple:2" "vdash-properties:6")
+  AOT_hence \<open>x = z\<close> by (metis "id-eq:3" "vdash-properties:6")
+  moreover AOT_have \<open>x =\<^sub>E x\<close>
+    using 1[THEN "&E"(1)] "&E"(1) "=E-simple:1" "\<equiv>E"(1)
+          "ord=Eequiv:1" "\<rightarrow>E" by blast
+  ultimately AOT_show \<open>x =\<^sub>E z\<close>
+    using "rule=E" by fast
+qed
+
+AOT_theorem "ord-=E=:1": \<open>(O!x \<or> O!y) \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>E y)\<close>
+proof(rule CP)
+  AOT_assume \<open>O!x \<or> O!y\<close>
+  moreover {
+    AOT_assume \<open>O!x\<close>
+    AOT_hence \<open>\<box>O!x\<close> by (metis "oa-facts:1" "vdash-properties:10")
+    moreover {
+      AOT_modally_strict {
+        AOT_have \<open>O!x \<rightarrow> (x = y \<equiv> x =\<^sub>E y)\<close>
+        proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+          AOT_assume \<open>O!x\<close>
+          AOT_hence \<open>x =\<^sub>E x\<close> by (metis "ord=Eequiv:1" "\<rightarrow>E")
+          moreover AOT_assume \<open>x = y\<close>
+          ultimately AOT_show \<open>x =\<^sub>E y\<close> using "rule=E" by fast
+        next
+          AOT_assume \<open>x =\<^sub>E y\<close>
+          AOT_thus \<open>x = y\<close> by (metis "=E-simple:2" "\<rightarrow>E")
+        qed
+      }
+      AOT_hence \<open>\<box>O!x \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>E y)\<close> by (metis "RM:1")
+    }
+    ultimately AOT_have \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> using "\<rightarrow>E" by blast
+  }
+  moreover {
+    AOT_assume \<open>O!y\<close>
+    AOT_hence \<open>\<box>O!y\<close> by (metis "oa-facts:1" "vdash-properties:10")
+    moreover {
+      AOT_modally_strict {
+        AOT_have \<open>O!y \<rightarrow> (x = y \<equiv> x =\<^sub>E y)\<close>
+        proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+          AOT_assume \<open>O!y\<close>
+          AOT_hence \<open>y =\<^sub>E y\<close> by (metis "ord=Eequiv:1" "\<rightarrow>E")
+          moreover AOT_assume \<open>x = y\<close>
+          ultimately AOT_show \<open>x =\<^sub>E y\<close> using "rule=E" id_sym by fast
+        next
+          AOT_assume \<open>x =\<^sub>E y\<close>
+          AOT_thus \<open>x = y\<close> by (metis "=E-simple:2" "\<rightarrow>E")
+        qed
+      }
+      AOT_hence \<open>\<box>O!y \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>E y)\<close> by (metis "RM:1")
+    }
+    ultimately AOT_have \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> using "\<rightarrow>E" by blast
+  }
+  ultimately AOT_show \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> by (metis "\<or>E"(3) "raa-cor:1")
+qed
+
+AOT_theorem "ord-=E=:2": \<open>O!y \<rightarrow> [\<lambda>x x = y]\<down>\<close>
+proof (rule "\<rightarrow>I"; rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; rule "&I")
+  AOT_show \<open>[\<lambda>x x =\<^sub>E y]\<down>\<close> by "cqt:2[lambda]"
+next
+  AOT_assume \<open>O!y\<close>
+  AOT_hence 1: \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> for x
+    using "ord-=E=:1" "\<rightarrow>E" "\<or>I" by blast
+  AOT_have \<open>\<box>(x =\<^sub>E y \<equiv> x = y)\<close> for x
+    by (AOT_subst \<open>x =\<^sub>E y \<equiv> x = y\<close> \<open>x = y \<equiv> x =\<^sub>E y\<close>)
+       (auto simp add: "Commutativity of \<equiv>" 1)
+  AOT_hence \<open>\<forall>x \<box>(x =\<^sub>E y \<equiv> x = y)\<close> by (rule GEN)
+  AOT_thus \<open>\<box>\<forall>x (x =\<^sub>E y \<equiv> x = y)\<close> by (rule BF[THEN "\<rightarrow>E"])
+qed
+
+
+AOT_theorem "ord-=E=:3": \<open>[\<lambda>xy O!x & O!y & x = y]\<down>\<close>
+proof (rule "safe-ext[2]"[axiom_inst, THEN "\<rightarrow>E"]; rule "&I")
+  AOT_show \<open>[\<lambda>xy O!x & O!y & x =\<^sub>E y]\<down>\<close> by "cqt:2[lambda]"
+next
+  AOT_show \<open>\<box>\<forall>x\<forall>y ([O!]x & [O!]y & x =\<^sub>E y \<equiv> [O!]x & [O!]y & x = y)\<close>
+  proof (rule RN; rule GEN; rule GEN; rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      AOT_show \<open>[O!]x & [O!]y & x = y\<close> if \<open>[O!]x & [O!]y & x =\<^sub>E y\<close> for x y
+        by (metis "&I" "&E"(1) "Conjunction Simplification"(2) "=E-simple:2"
+                  "modus-tollens:1" "raa-cor:1" that)
+    }
+  next
+    AOT_modally_strict {
+      AOT_show \<open>[O!]x & [O!]y & x =\<^sub>E y\<close> if \<open>[O!]x & [O!]y & x = y\<close> for x y
+        apply(safe intro!: "&I")
+          apply (metis that[THEN "&E"(1), THEN "&E"(1)])
+         apply (metis that[THEN "&E"(1), THEN "&E"(2)])
+        using "rule=E"[rotated, OF that[THEN "&E"(2)]]
+              "ord=Eequiv:1"[THEN "\<rightarrow>E", OF that[THEN "&E"(1), THEN "&E"(1)]]
+        by fast
+    }
+  qed
+qed
+
+AOT_theorem "ind-nec": \<open>\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+  moreover AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]\<down>\<close> by "cqt:2[lambda]"
+  ultimately AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]x \<equiv> [\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]y\<close>
+    using "\<forall>E" by blast
+  moreover AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]y\<close>
+    apply (rule "\<beta>\<leftarrow>C"(1))
+      apply "cqt:2[lambda]"
+     apply (fact "cqt:2[const_var]"[axiom_inst])
+    by (simp add: RN GEN "oth-class-taut:3:a")
+  ultimately AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]x\<close> using "\<equiv>E" by blast
+  AOT_thus \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    using "\<beta>\<rightarrow>C"(1) by blast
+qed
+
+AOT_theorem "ord=E:1": \<open>(O!x & O!y) \<rightarrow> (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> x =\<^sub>E y)\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+  AOT_hence \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    using "ind-nec"[THEN "\<rightarrow>E"] by blast
+  moreover AOT_assume \<open>O!x & O!y\<close>
+  ultimately AOT_have \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    using "&I" by blast
+  AOT_thus \<open>x =\<^sub>E y\<close> using "=E-simple:1"[THEN "\<equiv>E"(2)] by blast
+qed
+
+AOT_theorem "ord=E:2": \<open>(O!x & O!y) \<rightarrow> (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> x = y)\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>O!x & O!y\<close>
+  moreover AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+  ultimately AOT_have \<open>x =\<^sub>E y\<close>
+    using "ord=E:1" "\<rightarrow>E" by blast
+  AOT_thus \<open>x = y\<close> using "=E-simple:2"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "ord=E2:1":
+  \<open>(O!x & O!y) \<rightarrow> (x \<noteq> y \<equiv> [\<lambda>z z =\<^sub>E x] \<noteq> [\<lambda>z z =\<^sub>E y])\<close>
+proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I";
+       rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"]; rule "raa-cor:2")
+  AOT_assume 0: \<open>O!x & O!y\<close>
+  AOT_assume \<open>x \<noteq> y\<close>
+  AOT_hence 1: \<open>\<not>(x = y)\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "=-infix"] by blast
+  AOT_assume \<open>[\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y]\<close>
+  moreover AOT_have \<open>[\<lambda>z z =\<^sub>E x]x\<close>
+    apply (rule "\<beta>\<leftarrow>C"(1))
+      apply "cqt:2[lambda]"
+     apply (fact "cqt:2[const_var]"[axiom_inst])
+    using "ord=Eequiv:1"[THEN "\<rightarrow>E", OF 0[THEN "&E"(1)]].
+  ultimately AOT_have \<open>[\<lambda>z z =\<^sub>E y]x\<close> using "rule=E" by fast
+  AOT_hence \<open>x =\<^sub>E y\<close> using "\<beta>\<rightarrow>C"(1) by blast
+  AOT_hence \<open>x = y\<close> by (metis "=E-simple:2" "vdash-properties:6")
+  AOT_thus \<open>x = y & \<not>(x = y)\<close> using 1 "&I" by blast
+next
+  AOT_assume \<open>[\<lambda>z z =\<^sub>E x] \<noteq> [\<lambda>z z =\<^sub>E y]\<close>
+  AOT_hence 0: \<open>\<not>([\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y])\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "=-infix"] by blast
+  AOT_have \<open>[\<lambda>z z =\<^sub>E x]\<down>\<close> by "cqt:2[lambda]"
+  AOT_hence \<open>[\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E x]\<close>
+    by (metis "rule=I:1")
+  moreover AOT_assume \<open>x = y\<close>
+  ultimately AOT_have \<open>[\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y]\<close>
+    using "rule=E" by fast
+  AOT_thus \<open>[\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y] & \<not>([\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y])\<close>
+    using 0 "&I" by blast
+qed
+
+AOT_theorem "ord=E2:2":
+  \<open>(O!x & O!y) \<rightarrow> (x \<noteq> y \<equiv> [\<lambda>z z = x] \<noteq> [\<lambda>z z = y])\<close>
+proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I";
+       rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"]; rule "raa-cor:2")
+  AOT_assume 0: \<open>O!x & O!y\<close>
+  AOT_assume \<open>x \<noteq> y\<close>
+  AOT_hence 1: \<open>\<not>(x = y)\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "=-infix"] by blast
+  AOT_assume \<open>[\<lambda>z z = x] = [\<lambda>z z = y]\<close>
+  moreover AOT_have \<open>[\<lambda>z z = x]x\<close>
+    apply (rule "\<beta>\<leftarrow>C"(1))
+    apply (fact "ord-=E=:2"[THEN "\<rightarrow>E", OF 0[THEN "&E"(1)]])
+     apply (fact "cqt:2[const_var]"[axiom_inst])
+    by (simp add: "id-eq:1")
+  ultimately AOT_have \<open>[\<lambda>z z = y]x\<close> using "rule=E" by fast
+  AOT_hence \<open>x = y\<close> using "\<beta>\<rightarrow>C"(1) by blast
+  AOT_thus \<open>x = y & \<not>(x = y)\<close> using 1 "&I" by blast
+next
+  AOT_assume 0: \<open>O!x & O!y\<close>
+  AOT_assume \<open>[\<lambda>z z = x] \<noteq> [\<lambda>z z = y]\<close>
+  AOT_hence 1: \<open>\<not>([\<lambda>z z = x] = [\<lambda>z z = y])\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "=-infix"] by blast
+  AOT_have \<open>[\<lambda>z z = x]\<down>\<close>
+    by (fact "ord-=E=:2"[THEN "\<rightarrow>E", OF 0[THEN "&E"(1)]])
+  AOT_hence \<open>[\<lambda>z z = x] = [\<lambda>z z = x]\<close>
+    by (metis "rule=I:1")
+  moreover AOT_assume \<open>x = y\<close>
+  ultimately AOT_have \<open>[\<lambda>z z = x] = [\<lambda>z z = y]\<close>
+    using "rule=E" by fast
+  AOT_thus \<open>[\<lambda>z z = x] = [\<lambda>z z = y] & \<not>([\<lambda>z z = x] = [\<lambda>z z = y])\<close>
+    using 1 "&I" by blast
+qed
+
+AOT_theorem ordnecfail: \<open>O!x \<rightarrow> \<box>\<not>\<exists>F x[F]\<close>
+  by (meson "RM:1" "\<rightarrow>I" nocoder[axiom_inst] "oa-facts:1" "\<rightarrow>E")
+
+AOT_theorem "ab-obey:1": \<open>(A!x & A!y) \<rightarrow> (\<forall>F (x[F] \<equiv> y[F]) \<rightarrow> x = y)\<close>
+proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
+  AOT_assume 1: \<open>A!x & A!y\<close>
+  AOT_assume \<open>\<forall>F (x[F] \<equiv> y[F])\<close>
+  AOT_hence \<open>x[F] \<equiv> y[F]\<close> for F using "\<forall>E" by blast
+  AOT_hence \<open>\<box>(x[F] \<equiv> y[F])\<close> for F by (metis "en-eq:6[1]" "\<equiv>E"(1))
+  AOT_hence \<open>\<forall>F \<box>(x[F] \<equiv> y[F])\<close> by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>F (x[F] \<equiv> y[F])\<close> by (rule BF[THEN "\<rightarrow>E"])
+  AOT_thus \<open>x = y\<close>
+    using "\<equiv>\<^sub>d\<^sub>fI"[OF "identity:1", OF "\<or>I"(2)] 1 "&I" by blast
+qed
+
+AOT_theorem "ab-obey:2":
+  \<open>(\<exists>F (x[F] & \<not>y[F]) \<or> \<exists>F (y[F] & \<not>x[F])) \<rightarrow> x \<noteq> y\<close>
+proof (rule "\<rightarrow>I"; rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"]; rule "raa-cor:2")
+  AOT_assume 1: \<open>x = y\<close>
+  AOT_assume \<open>\<exists>F (x[F] & \<not>y[F]) \<or> \<exists>F (y[F] & \<not>x[F])\<close>
+  moreover {
+    AOT_assume \<open>\<exists>F (x[F] & \<not>y[F])\<close>
+    then AOT_obtain F where \<open>x[F] & \<not>y[F]\<close>
+      using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>y[F]\<close>
+      using calculation[THEN "&E"(1)] 1 "rule=E" by fast
+    ultimately AOT_have \<open>p & \<not>p\<close> for p
+      by (metis "Conjunction Simplification"(2) "modus-tollens:2" "raa-cor:3")
+  }
+  moreover {
+    AOT_assume \<open>\<exists>F (y[F] & \<not>x[F])\<close>
+    then AOT_obtain F where \<open>y[F] & \<not>x[F]\<close>
+      using "\<exists>E"[rotated] by blast
+    moreover AOT_have \<open>\<not>y[F]\<close>
+      using calculation[THEN "&E"(2)] 1 "rule=E" by fast
+    ultimately AOT_have \<open>p & \<not>p\<close> for p
+      by (metis "Conjunction Simplification"(1) "modus-tollens:1" "raa-cor:3")
+  }
+  ultimately AOT_show \<open>p & \<not>p\<close> for p
+    by (metis "\<or>E"(3) "raa-cor:1")
+qed
+
+AOT_theorem "encoders-are-abstract": \<open>\<exists>F x[F] \<rightarrow> A!x\<close>
+  by (meson "deduction-theorem" "\<equiv>E"(2) "modus-tollens:2" nocoder
+            "oa-contingent:3" "vdash-properties:1[2]")
+
+AOT_theorem "denote=:1": \<open>\<forall>H\<exists>x x[H]\<close>
+  by (rule GEN; rule "existence:2[1]"[THEN "\<equiv>\<^sub>d\<^sub>fE"]; "cqt:2")
+
+AOT_theorem "denote=:2": \<open>\<forall>G\<exists>x\<^sub>1...\<exists>x\<^sub>n x\<^sub>1...x\<^sub>n[H]\<close>
+  by (rule GEN; rule "existence:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]; "cqt:2")
+
+AOT_theorem "denote=:2[2]": \<open>\<forall>G\<exists>x\<^sub>1\<exists>x\<^sub>2 x\<^sub>1x\<^sub>2[H]\<close>
+  by (rule GEN; rule "existence:2[2]"[THEN "\<equiv>\<^sub>d\<^sub>fE"]; "cqt:2")
+
+AOT_theorem "denote=:2[3]": \<open>\<forall>G\<exists>x\<^sub>1\<exists>x\<^sub>2\<exists>x\<^sub>3 x\<^sub>1x\<^sub>2x\<^sub>3[H]\<close>
+  by (rule GEN; rule "existence:2[3]"[THEN "\<equiv>\<^sub>d\<^sub>fE"]; "cqt:2")
+
+AOT_theorem "denote=:2[4]": \<open>\<forall>G\<exists>x\<^sub>1\<exists>x\<^sub>2\<exists>x\<^sub>3\<exists>x\<^sub>4 x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[H]\<close>
+  by (rule GEN; rule "existence:2[4]"[THEN "\<equiv>\<^sub>d\<^sub>fE"]; "cqt:2")
+
+AOT_theorem "denote=:3": \<open>\<exists>x x[\<Pi>] \<equiv> \<exists>H (H = \<Pi>)\<close>
+  using "existence:2[1]" "free-thms:1" "\<equiv>E"(2,5)
+        "Commutativity of \<equiv>" "\<equiv>Df" by blast
+
+AOT_theorem "denote=:4": \<open>(\<exists>x\<^sub>1...\<exists>x\<^sub>n x\<^sub>1...x\<^sub>n[\<Pi>]) \<equiv> \<exists>H (H = \<Pi>)\<close>
+  using "existence:2" "free-thms:1" "\<equiv>E"(6) "\<equiv>Df" by blast
+
+AOT_theorem "denote=:4[2]": \<open>(\<exists>x\<^sub>1\<exists>x\<^sub>2 x\<^sub>1x\<^sub>2[\<Pi>]) \<equiv> \<exists>H (H = \<Pi>)\<close>
+  using "existence:2[2]" "free-thms:1" "\<equiv>E"(6) "\<equiv>Df" by blast
+
+AOT_theorem "denote=:4[3]": \<open>(\<exists>x\<^sub>1\<exists>x\<^sub>2\<exists>x\<^sub>3 x\<^sub>1x\<^sub>2x\<^sub>3[\<Pi>]) \<equiv> \<exists>H (H = \<Pi>)\<close>
+  using "existence:2[3]" "free-thms:1" "\<equiv>E"(6) "\<equiv>Df" by blast
+
+AOT_theorem "denote=:4[4]": \<open>(\<exists>x\<^sub>1\<exists>x\<^sub>2\<exists>x\<^sub>3\<exists>x\<^sub>4 x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[\<Pi>]) \<equiv> \<exists>H (H = \<Pi>)\<close>
+  using "existence:2[4]" "free-thms:1" "\<equiv>E"(6) "\<equiv>Df" by blast
+
+AOT_theorem "A-objects!": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+proof (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<phi>{F})\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by blast
+  AOT_have \<open>(A!\<beta> & \<forall>F (\<beta>[F] \<equiv> \<phi>{F})) \<rightarrow> \<beta> = a\<close> for \<beta>
+  proof (rule "\<rightarrow>I")
+    AOT_assume \<beta>_prop: \<open>[A!]\<beta> & \<forall>F (\<beta>[F] \<equiv> \<phi>{F})\<close>
+    AOT_hence \<open>\<beta>[F] \<equiv> \<phi>{F}\<close> for F
+      using "\<forall>E" "&E" by blast
+    AOT_hence \<open>\<beta>[F] \<equiv> a[F]\<close> for F
+      using a_prop[THEN "&E"(2)] "\<forall>E" "\<equiv>E"(2,5)
+            "Commutativity of \<equiv>" by fast
+    AOT_hence \<open>\<forall>F (\<beta>[F] \<equiv> a[F])\<close> by (rule GEN)
+    AOT_thus \<open>\<beta> = a\<close>
+      using "ab-obey:1"[THEN "\<rightarrow>E",
+                OF "&I"[OF \<beta>_prop[THEN "&E"(1)], OF a_prop[THEN "&E"(1)]],
+                THEN "\<rightarrow>E"] by blast
+  qed
+  AOT_hence \<open>\<forall>\<beta> ((A!\<beta> & \<forall>F (\<beta>[F] \<equiv> \<phi>{F})) \<rightarrow> \<beta> = a)\<close> by (rule GEN)
+  AOT_thus \<open>\<exists>\<alpha> ([A!]\<alpha> & \<forall>F (\<alpha>[F] \<equiv> \<phi>{F}) &
+                \<forall>\<beta> ([A!]\<beta> & \<forall>F (\<beta>[F] \<equiv> \<phi>{F}) \<rightarrow> \<beta> = \<alpha>))\<close>
+    using "\<exists>I" using a_prop "&I" by fast
+qed
+
+AOT_theorem "obj-oth:1": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> [F]y))\<close>
+  using "A-objects!" by fast
+
+AOT_theorem "obj-oth:2": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> [F]y & [F]z))\<close>
+  using "A-objects!" by fast
+
+AOT_theorem "obj-oth:3": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> [F]y \<or> [F]z))\<close>
+  using "A-objects!" by fast
+
+AOT_theorem "obj-oth:4": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> \<box>[F]y))\<close>
+  using "A-objects!" by fast
+
+AOT_theorem "obj-oth:5": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> F = G))\<close>
+  using "A-objects!" by fast
+
+AOT_theorem "obj-oth:6": \<open>\<exists>!x (A!x & \<forall>F (x[F] \<equiv> \<box>\<forall>y([G]y \<rightarrow> [F]y)))\<close>
+  using "A-objects!" by fast
+
+AOT_theorem "A-descriptions": \<open>\<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<down>\<close>
+  by (rule "A-Exists:2"[THEN "\<equiv>E"(2)]; rule "RA[2]"; rule "A-objects!")
+
+AOT_act_theorem "thm-can-terms2":
+  \<open>y = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F})) \<rightarrow> (A!y & \<forall>F (y[F] \<equiv> \<phi>{F}))\<close>
+  using "y-in:2" by blast
+
+AOT_theorem "can-ab2": \<open>y = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F})) \<rightarrow>  A!y\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>y = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+  AOT_hence \<open>\<^bold>\<A>(A!y & \<forall>F (y[F] \<equiv> \<phi>{F}))\<close>
+    using "actual-desc:2"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<^bold>\<A>A!y\<close> by (metis "Act-Basic:2" "&E"(1) "\<equiv>E"(1))
+  AOT_thus \<open>A!y\<close> by (metis "\<equiv>E"(2) "oa-facts:8")
+qed
+
+AOT_act_theorem "desc-encode:1": \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F}\<close>
+proof -
+  AOT_have \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<down>\<close>
+    by (simp add: "A-descriptions")
+  AOT_hence \<open>A!\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F})) &
+             \<forall>F(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F})\<close>
+    using "y-in:3"[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F}\<close>
+    using "&E" "\<forall>E" by blast
+qed
+
+AOT_act_theorem "desc-encode:2": \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[G] \<equiv> \<phi>{G}\<close>
+  using "desc-encode:1".
+
+AOT_theorem "desc-nec-encode:1":
+  \<open>\<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<^bold>\<A>\<phi>{F}\<close>
+proof -
+  AOT_have 0: \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<down>\<close>
+    by (simp add: "A-descriptions")
+  AOT_hence \<open>\<^bold>\<A>(A!\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F})) &
+             \<forall>F(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F}))\<close>
+    using "actual-desc:4"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<^bold>\<A>\<forall>F (\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F})\<close>
+    using "Act-Basic:2" "&E"(2) "\<equiv>E"(1) by blast
+  AOT_hence \<open>\<forall>F \<^bold>\<A>(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F})\<close>
+    using "\<equiv>E"(1) "logic-actual-nec:3" "vdash-properties:1[2]" by blast
+  AOT_hence \<open>\<^bold>\<A>(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F})\<close>
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<^bold>\<A>\<phi>{F}\<close>
+    using "Act-Basic:5" "\<equiv>E"(1) by blast
+  AOT_thus \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<^bold>\<A>\<phi>{F}\<close>
+    using "en-eq:10[1]"[unvarify x\<^sub>1, OF 0] "\<equiv>E"(6) by blast
+qed
+
+AOT_theorem "desc-nec-encode:2":
+  \<open>\<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[G] \<equiv> \<^bold>\<A>\<phi>{G}\<close>
+  using "desc-nec-encode:1".
+
+AOT_theorem "Box-desc-encode:1": \<open>\<box>\<phi>{G} \<rightarrow> \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{G}))[G]\<close>
+  by (rule "\<rightarrow>I"; rule "desc-nec-encode:2"[THEN "\<equiv>E"(2)])
+     (meson "nec-imp-act" "vdash-properties:10")
+
+AOT_theorem "Box-desc-encode:2":
+\<open>\<box>\<phi>{G} \<rightarrow> \<box>(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{G}))[G] \<equiv> \<phi>{G})\<close>
+proof(rule CP)
+  AOT_assume \<open>\<box>\<phi>{G}\<close>
+  AOT_hence \<open>\<box>\<box>\<phi>{G}\<close> by (metis "S5Basic:6" "\<equiv>E"(1))
+  moreover AOT_have \<open>\<box>\<box>\<phi>{G} \<rightarrow> \<box>(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{G}))[G] \<equiv> \<phi>{G})\<close>
+  proof (rule RM; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      AOT_assume 1: \<open>\<box>\<phi>{G}\<close>
+      AOT_hence \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{G}))[G]\<close>
+        using "Box-desc-encode:1" "\<rightarrow>E" by blast
+      moreover AOT_have \<open>\<phi>{G}\<close>
+        using 1 by (meson "qml:2"[axiom_inst] "\<rightarrow>E")
+      ultimately AOT_show \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{G}))[G] \<equiv> \<phi>{G}\<close>
+        using "\<rightarrow>I" "\<equiv>I" by simp
+    }
+  qed
+  ultimately AOT_show \<open>\<box>(\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{G}))[G] \<equiv> \<phi>{G})\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+definition rigid_condition where
+  \<open>rigid_condition \<phi> \<equiv> \<forall>v . [v \<Turnstile> \<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>})]\<close>
+syntax rigid_condition :: \<open>id_position \<Rightarrow> AOT_prop\<close> ("RIGID'_CONDITION'(_')")
+
+AOT_theorem "strict-can:1[E]":
+  assumes \<open>RIGID_CONDITION(\<phi>)\<close>
+  shows \<open>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>})\<close>
+  using assms[unfolded rigid_condition_def] by auto
+
+AOT_theorem "strict-can:1[I]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>})\<close>
+  shows \<open>RIGID_CONDITION(\<phi>)\<close>
+  using assms rigid_condition_def by auto
+
+AOT_theorem "box-phi-a:1":
+  assumes \<open>RIGID_CONDITION(\<phi>)\<close>
+  shows \<open>(A!x  & \<forall>F (x[F] \<equiv> \<phi>{F})) \<rightarrow> \<box>(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume a: \<open>A!x & \<forall>F (x[F] \<equiv> \<phi>{F})\<close>
+  AOT_hence b: \<open>\<box>A!x\<close>
+    by (metis "Conjunction Simplification"(1) "oa-facts:2" "\<rightarrow>E")
+  AOT_have \<open>x[F] \<equiv> \<phi>{F}\<close> for F
+    using a[THEN "&E"(2)] "\<forall>E" by blast
+  moreover AOT_have \<open>\<box>(x[F] \<rightarrow> \<box>x[F])\<close> for F
+    by (meson "pre-en-eq:1[1]" RN)
+  moreover AOT_have \<open>\<box>(\<phi>{F} \<rightarrow> \<box>\<phi>{F})\<close> for F
+    using RN "strict-can:1[E]"[OF assms] "\<forall>E" by blast
+  ultimately AOT_have \<open>\<box>(x[F] \<equiv> \<phi>{F})\<close> for F
+    using "sc-eq-box-box:5" "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<rightarrow>E" "&I" by metis
+  AOT_hence \<open>\<forall>F \<box>(x[F] \<equiv> \<phi>{F})\<close> by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>F (x[F] \<equiv> \<phi>{F})\<close> by (rule BF[THEN "\<rightarrow>E"])
+  AOT_thus \<open>\<box>([A!]x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+    using b "KBasic:3" "\<equiv>S"(1) "\<equiv>E"(2) by blast
+qed
+
+AOT_theorem "box-phi-a:2":
+  assumes \<open>RIGID_CONDITION(\<phi>)\<close>
+  shows \<open>y = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F})) \<rightarrow> (A!y & \<forall>F (y[F] \<equiv> \<phi>{F}))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>y = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+  AOT_hence \<open>\<^bold>\<A>(A!y & \<forall>F (y[F] \<equiv> \<phi>{F}))\<close>
+    using "actual-desc:2"[THEN "\<rightarrow>E"] by fast
+  AOT_hence abs: \<open>\<^bold>\<A>A!y\<close> and \<open>\<^bold>\<A>\<forall>F (y[F] \<equiv> \<phi>{F})\<close>
+    using "Act-Basic:2" "&E" "\<equiv>E"(1) by blast+
+  AOT_hence \<open>\<forall>F \<^bold>\<A>(y[F] \<equiv> \<phi>{F})\<close>
+    by (metis "\<equiv>E"(1) "logic-actual-nec:3" "vdash-properties:1[2]")
+  AOT_hence \<open>\<^bold>\<A>(y[F] \<equiv> \<phi>{F})\<close> for F
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<^bold>\<A>y[F] \<equiv> \<^bold>\<A>\<phi>{F}\<close> for F
+    by (metis "Act-Basic:5" "\<equiv>E"(1)) 
+  AOT_hence \<open>y[F] \<equiv> \<phi>{F}\<close> for F
+    using "sc-eq-fur:2"[THEN "\<rightarrow>E",
+            OF "strict-can:1[E]"[OF assms,
+                THEN "\<forall>E"(2)[where \<beta>=F], THEN RN]]
+    by (metis "en-eq:10[1]" "\<equiv>E"(6))
+  AOT_hence \<open>\<forall>F (y[F] \<equiv> \<phi>{F})\<close> by (rule GEN)
+  AOT_thus \<open>[A!]y & \<forall>F (y[F] \<equiv> \<phi>{F})\<close>
+    using abs "&I" "\<equiv>E"(2) "oa-facts:8" by blast
+qed
+
+AOT_theorem "box-phi-a:3":
+  assumes \<open>RIGID_CONDITION(\<phi>)\<close>
+  shows \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))[F] \<equiv> \<phi>{F}\<close>
+  using "desc-nec-encode:2"
+    "sc-eq-fur:2"[THEN "\<rightarrow>E",
+        OF "strict-can:1[E]"[OF assms,
+          THEN "\<forall>E"(2)[where \<beta>=F], THEN RN]]
+    "\<equiv>E"(5) by blast
+
+AOT_define Null :: \<open>\<tau> \<Rightarrow> \<phi>\<close> ("Null'(_')") 
+  "df-null-uni:1": \<open>Null(x) \<equiv>\<^sub>d\<^sub>f A!x & \<not>\<exists>F x[F]\<close>
+
+AOT_define Universal :: \<open>\<tau> \<Rightarrow> \<phi>\<close> ("Universal'(_')")
+  "df-null-uni:2": \<open>Universal(x) \<equiv>\<^sub>d\<^sub>f A!x & \<forall>F x[F]\<close>
+
+AOT_theorem "null-uni-uniq:1": \<open>\<exists>!x Null(x)\<close>
+proof (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<not>(F = F))\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_have a_null: \<open>\<not>a[F]\<close> for F
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>a[F]\<close>
+    AOT_hence \<open>\<not>(F = F)\<close> using a_prop[THEN "&E"(2)] "\<forall>E" "\<equiv>E" by blast
+    AOT_hence \<open>F = F & \<not>(F = F)\<close> by (metis "id-eq:1" "raa-cor:3")
+    AOT_thus \<open>p & \<not>p\<close> for p  by (metis "raa-cor:1")
+  qed
+  AOT_have \<open>Null(a) & \<forall>\<beta> (Null(\<beta>) \<rightarrow> \<beta> = a)\<close>
+  proof (rule "&I")
+    AOT_have \<open>\<not>\<exists>F a[F]\<close>
+      using a_null by (metis "instantiation" "reductio-aa:1")
+    AOT_thus \<open>Null(a)\<close>
+      using "df-null-uni:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] a_prop[THEN "&E"(1)] "&I" by metis
+  next
+    AOT_show \<open>\<forall>\<beta> (Null(\<beta>) \<rightarrow> \<beta> = a)\<close>
+    proof (rule GEN; rule "\<rightarrow>I")
+      fix \<beta>
+      AOT_assume a: \<open>Null(\<beta>)\<close>
+      AOT_hence \<open>\<not>\<exists>F \<beta>[F]\<close>
+        using "df-null-uni:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+      AOT_hence \<beta>_null: \<open>\<not>\<beta>[F]\<close> for F
+        by (metis "existential:2[const_var]" "reductio-aa:1")
+      AOT_have \<open>\<forall>F (\<beta>[F] \<equiv> a[F])\<close>
+        apply (rule GEN; rule "\<equiv>I"; rule CP)
+        using "raa-cor:3" \<beta>_null a_null by blast+
+      moreover AOT_have \<open>A!\<beta>\<close>
+        using a "df-null-uni:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+      ultimately AOT_show \<open>\<beta> = a\<close>
+        using a_prop[THEN "&E"(1)] "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+              "&I" by blast
+    qed
+  qed
+  AOT_thus \<open>\<exists>\<alpha> (Null(\<alpha>) & \<forall>\<beta> (Null(\<beta>) \<rightarrow> \<beta> = \<alpha>))\<close>
+    using "\<exists>I"(2) by fast
+qed
+
+AOT_theorem "null-uni-uniq:2": \<open>\<exists>!x Universal(x)\<close>
+proof (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> F = F)\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_hence aF: \<open>a[F]\<close> for F using "&E" "\<forall>E" "\<equiv>E" "id-eq:1" by fast
+  AOT_hence \<open>Universal(a)\<close>
+    using "df-null-uni:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" a_prop[THEN "&E"(1)] GEN by blast
+  moreover AOT_have \<open>\<forall>\<beta> (Universal(\<beta>) \<rightarrow> \<beta> = a)\<close>
+  proof (rule GEN; rule "\<rightarrow>I")
+    fix \<beta>
+    AOT_assume \<open>Universal(\<beta>)\<close>
+    AOT_hence abs_\<beta>: \<open>A!\<beta>\<close> and \<open>\<beta>[F]\<close> for F
+      using "df-null-uni:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<forall>E" by blast+
+    AOT_hence \<open>\<beta>[F] \<equiv> a[F]\<close> for F
+      using aF by (metis "deduction-theorem" "\<equiv>I")
+    AOT_hence \<open>\<forall>F (\<beta>[F] \<equiv> a[F])\<close> by (rule GEN)
+    AOT_thus \<open>\<beta> = a\<close>
+      using a_prop[THEN "&E"(1)] "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+            "&I" abs_\<beta> by blast
+  qed
+  ultimately AOT_show \<open>\<exists>\<alpha> (Universal(\<alpha>) & \<forall>\<beta> (Universal(\<beta>) \<rightarrow> \<beta> = \<alpha>))\<close>
+    using "&I" "\<exists>I" by fast
+qed
+
+AOT_theorem "null-uni-uniq:3": \<open>\<^bold>\<iota>x Null(x)\<down>\<close>
+  using "A-Exists:2" "RA[2]" "\<equiv>E"(2) "null-uni-uniq:1" by blast
+
+AOT_theorem "null-uni-uniq:4": \<open>\<^bold>\<iota>x Universal(x)\<down>\<close>
+  using "A-Exists:2" "RA[2]" "\<equiv>E"(2) "null-uni-uniq:2" by blast
+
+AOT_define Null_object :: \<open>\<kappa>\<^sub>s\<close> (\<open>a\<^sub>\<emptyset>\<close>)
+  "df-null-uni-terms:1": \<open>a\<^sub>\<emptyset> =\<^sub>d\<^sub>f \<^bold>\<iota>x Null(x)\<close>
+
+AOT_define Universal_object :: \<open>\<kappa>\<^sub>s\<close> (\<open>a\<^sub>V\<close>)
+  "df-null-uni-terms:2": \<open>a\<^sub>V =\<^sub>d\<^sub>f \<^bold>\<iota>x Universal(x)\<close>
+
+AOT_theorem "null-uni-facts:1": \<open>Null(x) \<rightarrow> \<box>Null(x)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>Null(x)\<close>
+  AOT_hence x_abs: \<open>A!x\<close> and x_null: \<open>\<not>\<exists>F x[F]\<close>
+    using "df-null-uni:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>\<not>x[F]\<close> for F using x_null
+    using "existential:2[const_var]" "reductio-aa:1"
+    by metis
+  AOT_hence \<open>\<box>\<not>x[F]\<close> for F by (metis "en-eq:7[1]" "\<equiv>E"(1))
+  AOT_hence \<open>\<forall>F \<box>\<not>x[F]\<close> by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>F \<not>x[F]\<close> by (rule BF[THEN "\<rightarrow>E"])
+  moreover AOT_have \<open>\<box>\<forall>F \<not>x[F] \<rightarrow> \<box>\<not>\<exists>F x[F]\<close>
+    apply (rule RM)
+    by (metis (full_types) "instantiation" "cqt:2[const_var]"[axiom_inst]
+                           "\<rightarrow>I" "reductio-aa:1" "rule-ui:1")
+  ultimately AOT_have \<open>\<box>\<not>\<exists>F x[F]\<close>
+    by (metis "\<rightarrow>E")
+  moreover AOT_have \<open>\<box>A!x\<close> using x_abs
+    using "oa-facts:2" "vdash-properties:10" by blast
+  ultimately AOT_have r: \<open>\<box>(A!x & \<not>\<exists>F x[F])\<close>
+    by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
+  AOT_show \<open>\<box>Null(x)\<close>
+    by (AOT_subst \<open>Null(x)\<close> \<open>A!x & \<not>\<exists>F x[F]\<close>)
+       (auto simp: "df-null-uni:1" "\<equiv>Df" r)
+qed  
+
+AOT_theorem "null-uni-facts:2": \<open>Universal(x) \<rightarrow> \<box>Universal(x)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>Universal(x)\<close>
+  AOT_hence x_abs: \<open>A!x\<close> and x_univ: \<open>\<forall>F x[F]\<close>
+    using "df-null-uni:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_have \<open>x[F]\<close> for F using x_univ "\<forall>E" by blast
+  AOT_hence \<open>\<box>x[F]\<close> for F by (metis "en-eq:2[1]" "\<equiv>E"(1))
+  AOT_hence \<open>\<forall>F \<box>x[F]\<close> by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>F x[F]\<close> by (rule BF[THEN "\<rightarrow>E"])
+  moreover AOT_have \<open>\<box>A!x\<close> using x_abs
+    using "oa-facts:2" "vdash-properties:10" by blast
+  ultimately AOT_have r: \<open>\<box>(A!x & \<forall>F x[F])\<close>
+    by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
+  AOT_show \<open>\<box>Universal(x)\<close>
+    by (AOT_subst \<open>Universal(x)\<close> \<open>A!x & \<forall>F x[F]\<close>)
+       (auto simp add: "df-null-uni:2" "\<equiv>Df" r)
+qed
+
+AOT_theorem "null-uni-facts:3": \<open>Null(a\<^sub>\<emptyset>)\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:1"])
+   apply (simp add: "null-uni-uniq:3")
+  using "actual-desc:4"[THEN "\<rightarrow>E", OF "null-uni-uniq:3"]
+    "sc-eq-fur:2"[THEN "\<rightarrow>E",
+        OF "null-uni-facts:1"[unvarify x, THEN RN, OF "null-uni-uniq:3"],
+        THEN "\<equiv>E"(1)]
+  by blast
+
+AOT_theorem "null-uni-facts:4": \<open>Universal(a\<^sub>V)\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:2"])
+   apply (simp add: "null-uni-uniq:4")
+  using "actual-desc:4"[THEN "\<rightarrow>E", OF "null-uni-uniq:4"]
+    "sc-eq-fur:2"[THEN "\<rightarrow>E",
+        OF "null-uni-facts:2"[unvarify x, THEN RN, OF "null-uni-uniq:4"],
+        THEN "\<equiv>E"(1)]
+  by blast
+
+AOT_theorem "null-uni-facts:5": \<open>a\<^sub>\<emptyset> \<noteq> a\<^sub>V\<close>
+proof (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"];
+    rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"];
+    rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"];
+    rule "raa-cor:2")
+  AOT_obtain x where nullx: \<open>Null(x)\<close>
+    by (metis "instantiation" "df-null-uni-terms:1" "existential:1"
+              "null-uni-facts:3" "null-uni-uniq:3" "rule-id-df:2:b[zero]")
+  AOT_hence act_null: \<open>\<^bold>\<A>Null(x)\<close>
+    by (metis "nec-imp-act" "null-uni-facts:1" "\<rightarrow>E")
+  AOT_assume \<open>\<^bold>\<iota>x Null(x) = \<^bold>\<iota>x Universal(x)\<close>
+  AOT_hence \<open>\<^bold>\<A>\<forall>x(Null(x) \<equiv> Universal(x))\<close>
+    using "actual-desc:5"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<forall>x \<^bold>\<A>(Null(x) \<equiv> Universal(x))\<close>
+    by (metis "\<equiv>E"(1) "logic-actual-nec:3" "vdash-properties:1[2]")
+  AOT_hence \<open>\<^bold>\<A>Null(x) \<equiv> \<^bold>\<A>Universal(x)\<close>
+    using "Act-Basic:5" "\<equiv>E"(1) "rule-ui:3" by blast
+  AOT_hence \<open>\<^bold>\<A>Universal(x)\<close> using act_null "\<equiv>E" by blast
+  AOT_hence \<open>Universal(x)\<close>
+    by (metis RN "\<equiv>E"(1) "null-uni-facts:2" "sc-eq-fur:2" "\<rightarrow>E")
+  AOT_hence \<open>\<forall>F x[F]\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "df-null-uni:2"] "&E" by metis
+  moreover AOT_have \<open>\<not>\<exists>F x[F]\<close>
+    using nullx "\<equiv>\<^sub>d\<^sub>fE"[OF "df-null-uni:1"] "&E" by metis
+  ultimately AOT_show \<open>p & \<not>p\<close> for p
+    by (metis "cqt-further:1" "raa-cor:3" "\<rightarrow>E")
+qed
+
+AOT_theorem "null-uni-facts:6": \<open>a\<^sub>\<emptyset> = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> F \<noteq> F))\<close>
+proof (rule "ab-obey:1"[unvarify x y, THEN "\<rightarrow>E", THEN "\<rightarrow>E"])
+  AOT_show \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))\<down>\<close>
+    by (simp add: "A-descriptions")
+next
+  AOT_show \<open>a\<^sub>\<emptyset>\<down>\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"])
+       (simp add: "null-uni-uniq:3")
+next
+  AOT_have \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))\<down>\<close>
+    by (simp add: "A-descriptions")
+  AOT_hence 1: \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F)) = \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))\<close>
+    using "rule=I:1" by blast
+  AOT_show \<open>[A!]a\<^sub>\<emptyset> & [A!]\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"];
+           rule "&I")
+     apply (meson "\<equiv>\<^sub>d\<^sub>fE" "Conjunction Simplification"(1)
+                  "df-null-uni:1" "df-null-uni-terms:1" "null-uni-facts:3"
+                  "null-uni-uniq:3" "rule-id-df:2:a[zero]" "\<rightarrow>E")
+    using "can-ab2"[unvarify y, OF "A-descriptions", THEN "\<rightarrow>E", OF 1].
+next
+  AOT_show \<open>\<forall>F (a\<^sub>\<emptyset>[F] \<equiv> \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))[F])\<close>
+  proof (rule GEN)
+    fix F
+    AOT_have \<open>\<not>a\<^sub>\<emptyset>[F]\<close>
+      by (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"])
+         (metis (no_types, lifting) "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "\<or>I"(2) "\<or>E"(3) "\<exists>I"(2)
+                "df-null-uni:1" "df-null-uni-terms:1" "null-uni-facts:3"
+                "raa-cor:2" "rule-id-df:2:a[zero]"
+                "russell-axiom[enc,1].\<psi>_denotes_asm")
+    moreover AOT_have \<open>\<not>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))[F]\<close>
+    proof(rule "raa-cor:2")
+      AOT_assume 0: \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))[F]\<close>
+      AOT_hence \<open>\<^bold>\<A>(F \<noteq> F)\<close>
+        using "desc-nec-encode:2"[THEN "\<equiv>E"(1), OF 0] by blast
+      moreover AOT_have \<open>\<not>\<^bold>\<A>(F \<noteq> F)\<close>
+        using "\<equiv>\<^sub>d\<^sub>fE" "id-act:2" "id-eq:1" "\<equiv>E"(2)
+              "=-infix" "raa-cor:3" by blast
+      ultimately AOT_show \<open>\<^bold>\<A>(F \<noteq> F) & \<not>\<^bold>\<A>(F \<noteq> F)\<close> by (rule "&I")
+    qed
+    ultimately AOT_show \<open>a\<^sub>\<emptyset>[F] \<equiv> \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))[F]\<close>
+      using "deduction-theorem" "\<equiv>I" "raa-cor:4" by blast
+  qed
+qed
+
+AOT_theorem "null-uni-facts:7": \<open>a\<^sub>V = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> F = F))\<close>
+proof (rule "ab-obey:1"[unvarify x y, THEN "\<rightarrow>E", THEN "\<rightarrow>E"])
+  AOT_show \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))\<down>\<close>
+    by (simp add: "A-descriptions")
+next
+  AOT_show \<open>a\<^sub>V\<down>\<close>
+    by (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"])
+       (simp add: "null-uni-uniq:4")
+next
+  AOT_have \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))\<down>\<close>
+    by (simp add: "A-descriptions")
+  AOT_hence 1: \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F)) = \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))\<close>
+    using "rule=I:1" by blast
+  AOT_show \<open>[A!]a\<^sub>V & [A!]\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"];
+           rule "&I")
+     apply (meson "\<equiv>\<^sub>d\<^sub>fE" "Conjunction Simplification"(1) "df-null-uni:2"
+                  "df-null-uni-terms:2" "null-uni-facts:4" "null-uni-uniq:4"
+                  "rule-id-df:2:a[zero]" "\<rightarrow>E")
+    using "can-ab2"[unvarify y, OF "A-descriptions", THEN "\<rightarrow>E", OF 1].
+next
+  AOT_show \<open>\<forall>F (a\<^sub>V[F] \<equiv> \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))[F])\<close>
+  proof (rule GEN)
+    fix F
+    AOT_have \<open>a\<^sub>V[F]\<close>
+      apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"])
+      using "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "df-null-uni:2" "df-null-uni-terms:2"
+            "null-uni-facts:4" "null-uni-uniq:4" "rule-id-df:2:a[zero]"
+            "rule-ui:3" by blast
+    moreover AOT_have \<open>\<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))[F]\<close>
+      using "RA[2]" "desc-nec-encode:2" "id-eq:1" "\<equiv>E"(2) by fastforce
+    ultimately AOT_show \<open>a\<^sub>V[F] \<equiv> \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> F = F))[F]\<close>
+      using "deduction-theorem" "\<equiv>I" by simp
+  qed
+qed
+
+AOT_theorem "aclassical:1":
+\<open>\<forall>R\<exists>x\<exists>y(A!x & A!y & x \<noteq> y & [\<lambda>z [R]zx] = [\<lambda>z [R]zy])\<close>
+proof(rule GEN)
+  fix R
+  AOT_obtain a where a_prop:
+    \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>y(A!y & F = [\<lambda>z [R]zy] & \<not>y[F]))\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_have a_enc: \<open>a[\<lambda>z [R]za]\<close>
+  proof (rule "raa-cor:1")
+    AOT_assume 0: \<open>\<not>a[\<lambda>z [R]za]\<close>
+    AOT_hence \<open>\<not>\<exists>y(A!y & [\<lambda>z [R]za] = [\<lambda>z [R]zy] & \<not>y[\<lambda>z [R]za])\<close>
+      by (rule a_prop[THEN "&E"(2), THEN "\<forall>E"(1)[where \<tau>="\<guillemotleft>[\<lambda>z [R]za]\<guillemotright>"],
+                THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                THEN "\<equiv>E"(1), rotated])
+         "cqt:2[lambda]"
+    AOT_hence \<open>\<forall>y \<not>(A!y & [\<lambda>z [R]za] = [\<lambda>z [R]zy] & \<not>y[\<lambda>z [R]za])\<close>
+      using "cqt-further:4" "vdash-properties:10" by blast
+    AOT_hence \<open>\<not>(A!a & [\<lambda>z [R]za] = [\<lambda>z [R]za] & \<not>a[\<lambda>z [R]za])\<close>
+      using "\<forall>E" by blast
+    AOT_hence \<open>(A!a & [\<lambda>z [R]za] = [\<lambda>z [R]za]) \<rightarrow> a[\<lambda>z [R]za]\<close>
+      by (metis "&I" "deduction-theorem" "raa-cor:3")
+    moreover AOT_have \<open>[\<lambda>z [R]za] = [\<lambda>z [R]za]\<close>
+      by (rule "=I") "cqt:2[lambda]"
+    ultimately AOT_have \<open>a[\<lambda>z [R]za]\<close>
+      using a_prop[THEN "&E"(1)] "\<rightarrow>E" "&I" by blast
+    AOT_thus \<open>a[\<lambda>z [R]za] & \<not>a[\<lambda>z [R]za]\<close>
+      using 0 "&I" by blast
+  qed
+  AOT_hence \<open>\<exists>y(A!y & [\<lambda>z [R]za] = [\<lambda>z [R]zy] & \<not>y[\<lambda>z [R]za])\<close>
+    by (rule a_prop[THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<equiv>E"(1), rotated])
+       "cqt:2"
+  then AOT_obtain b where b_prop:
+    \<open>A!b & [\<lambda>z [R]za] = [\<lambda>z [R]zb] & \<not>b[\<lambda>z [R]za]\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<open>a \<noteq> b\<close>
+    apply (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"])
+    using a_enc b_prop[THEN "&E"(2)]
+    using "\<not>\<not>I" "rule=E" id_sym "\<equiv>E"(4) "oth-class-taut:3:a"
+          "raa-cor:3" "reductio-aa:1" by fast
+  AOT_hence \<open>A!a & A!b & a \<noteq> b & [\<lambda>z [R]za] = [\<lambda>z [R]zb]\<close>
+    using b_prop "&E" a_prop "&I" by meson
+  AOT_hence \<open>\<exists>y (A!a & A!y & a \<noteq> y & [\<lambda>z [R]za] = [\<lambda>z [R]zy])\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>x\<exists>y (A!x & A!y & x \<noteq> y & [\<lambda>z [R]zx] = [\<lambda>z [R]zy])\<close> by (rule "\<exists>I")
+qed
+
+AOT_theorem "aclassical:2":
+  \<open>\<forall>R\<exists>x\<exists>y(A!x & A!y & x \<noteq> y & [\<lambda>z [R]xz] = [\<lambda>z [R]yz])\<close>
+proof(rule GEN)
+  fix R
+  AOT_obtain a where a_prop:
+    \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>y(A!y & F = [\<lambda>z [R]yz] & \<not>y[F]))\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_have a_enc: \<open>a[\<lambda>z [R]az]\<close>
+  proof (rule "raa-cor:1")
+    AOT_assume 0: \<open>\<not>a[\<lambda>z [R]az]\<close>
+    AOT_hence \<open>\<not>\<exists>y(A!y & [\<lambda>z [R]az] = [\<lambda>z [R]yz] & \<not>y[\<lambda>z [R]az])\<close>
+      by (rule a_prop[THEN "&E"(2), THEN "\<forall>E"(1)[where \<tau>="\<guillemotleft>[\<lambda>z [R]az]\<guillemotright>"],
+                THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                THEN "\<equiv>E"(1), rotated])
+         "cqt:2[lambda]"
+    AOT_hence \<open>\<forall>y \<not>(A!y & [\<lambda>z [R]az] = [\<lambda>z [R]yz] & \<not>y[\<lambda>z [R]az])\<close>
+      using "cqt-further:4" "vdash-properties:10" by blast
+    AOT_hence \<open>\<not>(A!a & [\<lambda>z [R]az] = [\<lambda>z [R]az] & \<not>a[\<lambda>z [R]az])\<close>
+      using "\<forall>E" by blast
+    AOT_hence \<open>(A!a & [\<lambda>z [R]az] = [\<lambda>z [R]az]) \<rightarrow> a[\<lambda>z [R]az]\<close>
+      by (metis "&I" "deduction-theorem" "raa-cor:3")
+    moreover AOT_have \<open>[\<lambda>z [R]az] = [\<lambda>z [R]az]\<close>
+      by (rule "=I") "cqt:2[lambda]"
+    ultimately AOT_have \<open>a[\<lambda>z [R]az]\<close>
+      using a_prop[THEN "&E"(1)] "\<rightarrow>E" "&I" by blast
+    AOT_thus \<open>a[\<lambda>z [R]az] & \<not>a[\<lambda>z [R]az]\<close>
+      using 0 "&I" by blast
+  qed
+  AOT_hence \<open>\<exists>y(A!y & [\<lambda>z [R]az] = [\<lambda>z [R]yz] & \<not>y[\<lambda>z [R]az])\<close>
+    by (rule a_prop[THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<equiv>E"(1), rotated])
+       "cqt:2"
+  then AOT_obtain b where b_prop:
+    \<open>A!b & [\<lambda>z [R]az] = [\<lambda>z [R]bz] & \<not>b[\<lambda>z [R]az]\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<open>a \<noteq> b\<close>
+    apply (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"])
+    using a_enc b_prop[THEN "&E"(2)]
+    using "\<not>\<not>I" "rule=E" id_sym "\<equiv>E"(4) "oth-class-taut:3:a"
+          "raa-cor:3" "reductio-aa:1" by fast
+  AOT_hence \<open>A!a & A!b & a \<noteq> b & [\<lambda>z [R]az] = [\<lambda>z [R]bz]\<close>
+    using b_prop "&E" a_prop "&I" by meson
+  AOT_hence \<open>\<exists>y (A!a & A!y & a \<noteq> y & [\<lambda>z [R]az] = [\<lambda>z [R]yz])\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>x\<exists>y (A!x & A!y & x \<noteq> y & [\<lambda>z [R]xz] = [\<lambda>z [R]yz])\<close> by (rule "\<exists>I")
+qed
+
+AOT_theorem "aclassical:3":
+  \<open>\<forall>F\<exists>x\<exists>y(A!x & A!y & x \<noteq> y & [\<lambda> [F]x] = [\<lambda> [F]y])\<close>
+proof(rule GEN)
+  fix R
+  AOT_obtain a where a_prop:
+    \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>y(A!y & F = [\<lambda>z [R]y] & \<not>y[F]))\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  AOT_have den: \<open>[\<lambda>z [R]a]\<down>\<close> by "cqt:2[lambda]"
+  AOT_have a_enc: \<open>a[\<lambda>z [R]a]\<close>
+  proof (rule "raa-cor:1")
+    AOT_assume 0: \<open>\<not>a[\<lambda>z [R]a]\<close>
+    AOT_hence \<open>\<not>\<exists>y(A!y & [\<lambda>z [R]a] = [\<lambda>z [R]y] & \<not>y[\<lambda>z [R]a])\<close>
+      by (safe intro!: a_prop[THEN "&E"(2), THEN "\<forall>E"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>z [R]a]\<guillemotright>\<close>],
+                THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
+                THEN "\<equiv>E"(1), rotated] "cqt:2") 
+    AOT_hence \<open>\<forall>y \<not>(A!y & [\<lambda>z [R]a] = [\<lambda>z [R]y] & \<not>y[\<lambda>z [R]a])\<close>
+      using "cqt-further:4" "\<rightarrow>E" by blast
+    AOT_hence \<open>\<not>(A!a & [\<lambda>z [R]a] = [\<lambda>z [R]a] & \<not>a[\<lambda>z [R]a])\<close> using "\<forall>E" by blast
+    AOT_hence \<open>(A!a & [\<lambda>z [R]a] = [\<lambda>z [R]a]) \<rightarrow> a[\<lambda>z [R]a]\<close>
+      by (metis "&I" "deduction-theorem" "raa-cor:3")
+    AOT_hence \<open>a[\<lambda>z [R]a]\<close>
+      using a_prop[THEN "&E"(1)] "\<rightarrow>E" "&I"
+      by (metis "rule=I:1" den)
+    AOT_thus \<open>a[\<lambda>z [R]a] & \<not>a[\<lambda>z [R]a]\<close>  by (metis "0" "raa-cor:3") 
+  qed
+  AOT_hence \<open>\<exists>y(A!y & [\<lambda>z [R]a] = [\<lambda>z [R]y] & \<not>y[\<lambda>z [R]a])\<close>
+    by (rule a_prop[THEN "&E"(2), THEN "\<forall>E"(1), OF den, THEN "\<equiv>E"(1), rotated])
+  then AOT_obtain b where b_prop: \<open>A!b & [\<lambda>z [R]a] = [\<lambda>z [R]b] & \<not>b[\<lambda>z [R]a]\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have 1: \<open>a \<noteq> b\<close>
+    apply (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"])
+    using a_enc b_prop[THEN "&E"(2)]
+    using "\<not>\<not>I" "rule=E" id_sym "\<equiv>E"(4) "oth-class-taut:3:a"
+          "raa-cor:3" "reductio-aa:1" by fast
+  AOT_have a: \<open>[\<lambda> [R]a] = ([R]a)\<close>
+    apply (rule "lambda-predicates:3[zero]"[axiom_inst, unvarify p])
+    by (meson "log-prop-prop:2")
+  AOT_have b: \<open>[\<lambda> [R]b] = ([R]b)\<close>
+    apply (rule "lambda-predicates:3[zero]"[axiom_inst, unvarify p])
+    by (meson "log-prop-prop:2")
+  AOT_have \<open>[\<lambda> [R]a] = [\<lambda> [R]b]\<close>
+    apply (rule "rule=E"[rotated, OF a[THEN id_sym]])
+    apply (rule "rule=E"[rotated, OF b[THEN id_sym]])
+    apply (rule "identity:4"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I", rotated])
+    using b_prop "&E" apply blast
+    apply (safe intro!: "&I")
+    by (simp add: "log-prop-prop:2")+
+  AOT_hence \<open>A!a & A!b & a \<noteq> b & [\<lambda> [R]a] = [\<lambda> [R]b]\<close>
+    using 1 a_prop[THEN "&E"(1)] b_prop[THEN "&E"(1), THEN "&E"(1)]
+          "&I" by auto
+  AOT_hence \<open>\<exists>y (A!a & A!y & a \<noteq> y & [\<lambda> [R]a] = [\<lambda> [R]y])\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>x\<exists>y (A!x & A!y & x \<noteq> y & [\<lambda> [R]x] = [\<lambda> [R]y])\<close> by (rule "\<exists>I")
+qed
+
+AOT_theorem aclassical2: \<open>\<exists>x\<exists>y (A!x & A!y & x \<noteq> y & \<forall>F ([F]x \<equiv> [F]y))\<close>
+proof -
+  AOT_have \<open>\<exists>x \<exists>y ([A!]x & [A!]y & x \<noteq> y &
+               [\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zx] =
+               [\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zy])\<close>
+    by (rule "aclassical:1"[THEN "\<forall>E"(1)[where \<tau>="\<guillemotleft>[\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]\<guillemotright>"]])
+       "cqt:2"
+  then AOT_obtain x where \<open>\<exists>y ([A!]x & [A!]y & x \<noteq> y &
+               [\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zx] =
+               [\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zy])\<close>
+    using "\<exists>E"[rotated] by blast
+  then AOT_obtain y where 0: \<open>([A!]x & [A!]y & x \<noteq> y &
+               [\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zx] =
+               [\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zy])\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_have \<open>[\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zx]x\<close>
+    by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
+             simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3"
+                   "oth-class-taut:3:a" "universal-cor")
+  AOT_hence \<open>[\<lambda>z [\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]zy]x\<close>
+    by (rule "rule=E"[rotated, OF 0[THEN "&E"(2)]])
+  AOT_hence \<open>[\<lambda>xy \<forall>F ([F]x \<equiv> [F]y)]xy\<close>
+    by (rule "\<beta>\<rightarrow>C"(1))
+  AOT_hence \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+    using "\<beta>\<rightarrow>C"(1) old.prod.case by fast
+  AOT_hence \<open>[A!]x & [A!]y & x \<noteq> y & \<forall>F ([F]x \<equiv> [F]y)\<close>
+    using 0 "&E" "&I" by blast
+  AOT_hence \<open>\<exists>y ([A!]x & [A!]y & x \<noteq> y & \<forall>F ([F]x \<equiv> [F]y))\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<exists>x\<exists>y ([A!]x & [A!]y & x \<noteq> y & \<forall>F ([F]x \<equiv> [F]y))\<close> by (rule "\<exists>I"(2))
+qed
+
+AOT_theorem "kirchner-thm:1":
+  \<open>[\<lambda>x \<phi>{x}]\<down> \<equiv> \<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+  AOT_hence \<open>\<box>[\<lambda>x \<phi>{x}]\<down>\<close> by (metis "exist-nec" "vdash-properties:10")
+  moreover AOT_have \<open>\<box>[\<lambda>x \<phi>{x}]\<down> \<rightarrow> \<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+  proof (rule "RM:1"; rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      fix x y
+      AOT_assume 0: \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+      moreover AOT_assume \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
+      ultimately AOT_have \<open>[\<lambda>x \<phi>{x}]x \<equiv> [\<lambda>x \<phi>{x}]y\<close>
+        using "\<forall>E" by blast
+      AOT_thus \<open>(\<phi>{x} \<equiv> \<phi>{y})\<close>
+        using "beta-C-meta"[THEN "\<rightarrow>E", OF 0] "\<equiv>E"(6) by meson
+    }
+  qed
+  ultimately AOT_show \<open>\<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+    using "\<rightarrow>E" by blast
+next
+  AOT_have \<open>\<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y})) \<rightarrow>
+            \<box>\<forall>y(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x}) \<equiv> \<phi>{y})\<close>
+  proof(rule "RM:1"; rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+      AOT_assume \<open>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+      AOT_hence indisc: \<open>\<phi>{x} \<equiv> \<phi>{y}\<close> if \<open>\<forall>F([F]x \<equiv> [F]y)\<close> for x y
+        using "\<forall>E"(2) "\<rightarrow>E" that by blast
+      AOT_show \<open>(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x}) \<equiv> \<phi>{y})\<close> for y
+      proof (rule "raa-cor:1")
+        AOT_assume \<open>\<not>(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x}) \<equiv> \<phi>{y})\<close>
+        AOT_hence \<open>(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x}) & \<not>\<phi>{y}) \<or>
+                   (\<not>(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x})) & \<phi>{y})\<close>
+          using "\<equiv>E"(1) "oth-class-taut:4:h" by blast
+        moreover {
+          AOT_assume 0: \<open>\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x}) & \<not>\<phi>{y}\<close>
+          AOT_obtain a where \<open>\<forall>F([F]a \<equiv> [F]y) & \<phi>{a}\<close>
+            using "\<exists>E"[rotated, OF 0[THEN "&E"(1)]]  by blast
+          AOT_hence \<open>\<phi>{y}\<close>
+            using indisc[THEN "\<equiv>E"(1)] "&E" by blast
+          AOT_hence \<open>p & \<not>p\<close> for p
+            using 0[THEN "&E"(2)] "&I" "raa-cor:3" by blast
+        }
+        moreover {
+          AOT_assume 0: \<open>(\<not>(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x})) & \<phi>{y})\<close>
+          AOT_hence \<open>\<forall>x \<not>(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x})\<close>
+            using "&E"(1) "cqt-further:4" "\<rightarrow>E" by blast
+          AOT_hence \<open>\<not>(\<forall>F([F]y \<equiv> [F]y) & \<phi>{y})\<close>
+            using "\<forall>E" by blast
+          AOT_hence \<open>\<not>\<forall>F([F]y \<equiv> [F]y) \<or> \<not>\<phi>{y}\<close>
+            using "\<equiv>E"(1) "oth-class-taut:5:c" by blast
+          moreover AOT_have \<open>\<forall>F([F]y \<equiv> [F]y)\<close>
+            by (simp add: "oth-class-taut:3:a" "universal-cor")
+          ultimately AOT_have \<open>\<not>\<phi>{y}\<close> by (metis "\<not>\<not>I" "\<or>E"(2))
+          AOT_hence \<open>p & \<not>p\<close> for p
+            using 0[THEN "&E"(2)] "&I" "raa-cor:3" by blast
+        }
+        ultimately AOT_show \<open>p & \<not>p\<close> for p
+          using "\<or>E"(3) "raa-cor:1" by blast
+      qed
+    }
+  qed
+  moreover AOT_assume \<open>\<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+  ultimately AOT_have \<open>\<box>\<forall>y(\<exists>x(\<forall>F([F]x \<equiv> [F]y) & \<phi>{x}) \<equiv> \<phi>{y})\<close>
+    using "\<rightarrow>E" by blast
+  AOT_thus \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+    by (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I", rotated]) "cqt:2"
+qed
+
+AOT_theorem "kirchner-thm:2":
+  \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down> \<equiv> \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    (\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+  AOT_hence \<open>\<box>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close> by (metis "exist-nec" "\<rightarrow>E")
+  moreover AOT_have \<open>\<box>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down> \<rightarrow> \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    (\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+  proof (rule "RM:1"; rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      fix x\<^sub>1x\<^sub>n y\<^sub>1y\<^sub>n :: \<open>'a AOT_var\<close>
+      AOT_assume 0: \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+      moreover AOT_assume \<open>\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)\<close>
+      ultimately AOT_have \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]x\<^sub>1...x\<^sub>n \<equiv>
+                           [\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]y\<^sub>1...y\<^sub>n\<close>
+        using "\<forall>E" by blast
+      AOT_thus \<open>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+        using "beta-C-meta"[THEN "\<rightarrow>E", OF 0] "\<equiv>E"(6) by meson
+    }
+  qed
+  ultimately AOT_show \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n(
+    \<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})
+  )\<close>
+    using "\<rightarrow>E" by blast
+next
+  AOT_have \<open>
+    \<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+      (\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})))
+    \<rightarrow> \<box>\<forall>y\<^sub>1...\<forall>y\<^sub>n
+        ((\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n})) \<equiv>
+         \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+  proof(rule "RM:1"; rule "\<rightarrow>I"; rule GEN)
+    AOT_modally_strict {
+      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+        (\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+      AOT_hence indisc: \<open>\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}\<close>
+        if \<open>\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)\<close> for x\<^sub>1x\<^sub>n y\<^sub>1y\<^sub>n
+        using "\<forall>E"(2) "\<rightarrow>E" that by blast
+      AOT_show \<open>(\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n})) \<equiv>
+                \<phi>{y\<^sub>1...y\<^sub>n}\<close> for y\<^sub>1y\<^sub>n
+      proof (rule "raa-cor:1")
+        AOT_assume \<open>\<not>((\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n})) \<equiv>
+                    \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+        AOT_hence \<open>((\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)
+                    & \<phi>{x\<^sub>1...x\<^sub>n}))
+                    & \<not>\<phi>{y\<^sub>1...y\<^sub>n}) \<or>
+                  (\<not>(\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n}))
+                   & \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+          using "\<equiv>E"(1) "oth-class-taut:4:h" by blast
+        moreover {
+          AOT_assume 0: \<open>(\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n}))
+                         & \<not>\<phi>{y\<^sub>1...y\<^sub>n}\<close>
+          AOT_obtain a\<^sub>1a\<^sub>n where \<open>\<forall>F([F]a\<^sub>1...a\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{a\<^sub>1...a\<^sub>n}\<close>
+            using "\<exists>E"[rotated, OF 0[THEN "&E"(1)]]  by blast
+          AOT_hence \<open>\<phi>{y\<^sub>1...y\<^sub>n}\<close>
+            using indisc[THEN "\<equiv>E"(1)] "&E" by blast
+          AOT_hence \<open>p & \<not>p\<close> for p
+            using 0[THEN "&E"(2)] "&I" "raa-cor:3" by blast
+        }
+        moreover {
+          AOT_assume 0: \<open>\<not>(\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n}))
+                         & \<phi>{y\<^sub>1...y\<^sub>n}\<close>
+          AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n})\<close>
+            using "&E"(1) "cqt-further:4" "\<rightarrow>E" by blast
+          AOT_hence \<open>\<not>(\<forall>F([F]y\<^sub>1...y\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+            using "\<forall>E" by blast
+          AOT_hence \<open>\<not>\<forall>F([F]y\<^sub>1...y\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<or> \<not>\<phi>{y\<^sub>1...y\<^sub>n}\<close>
+            using "\<equiv>E"(1) "oth-class-taut:5:c" by blast
+          moreover AOT_have \<open>\<forall>F([F]y\<^sub>1...y\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)\<close>
+            by (simp add: "oth-class-taut:3:a" "universal-cor")
+          ultimately AOT_have \<open>\<not>\<phi>{y\<^sub>1...y\<^sub>n}\<close>
+            by (metis "\<not>\<not>I" "\<or>E"(2))
+          AOT_hence \<open>p & \<not>p\<close> for p
+            using 0[THEN "&E"(2)] "&I" "raa-cor:3" by blast
+        }
+        ultimately AOT_show \<open>p & \<not>p\<close> for p
+          using "\<or>E"(3) "raa-cor:1" by blast
+      qed
+    }
+  qed
+  moreover AOT_assume \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    (\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+  ultimately AOT_have \<open>\<box>\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    ((\<exists>x\<^sub>1...\<exists>x\<^sub>n(\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) & \<phi>{x\<^sub>1...x\<^sub>n})) \<equiv>
+     \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+    using "\<rightarrow>E" by blast
+  AOT_thus \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+    by (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I", rotated]) "cqt:2"
+qed
+
+AOT_theorem "kirchner-thm-cor:1":
+  \<open>[\<lambda>x \<phi>{x}]\<down> \<rightarrow> \<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> \<box>(\<phi>{x} \<equiv> \<phi>{y}))\<close>
+proof(rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+  fix x y
+  AOT_assume \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+  AOT_hence \<open>\<box>\<forall>x\<forall>y (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+    by (rule "kirchner-thm:1"[THEN "\<equiv>E"(1)])
+  AOT_hence \<open>\<forall>x\<box>\<forall>y (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+    using CBF[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<box>\<forall>y (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<forall>y \<box>(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+    using CBF[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<box>(\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<box>\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>(\<phi>{x} \<equiv> \<phi>{y})\<close>
+    using "qml:1"[axiom_inst] "vdash-properties:6" by blast
+  moreover AOT_assume \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
+  ultimately AOT_show \<open>\<box>(\<phi>{x} \<equiv> \<phi>{y})\<close> using "\<rightarrow>E" "ind-nec" by blast
+qed
+
+AOT_theorem "kirchner-thm-cor:2":
+  \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down> \<rightarrow> \<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    (\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> \<box>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+proof(rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+  fix x\<^sub>1x\<^sub>n y\<^sub>1y\<^sub>n
+  AOT_assume \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+  AOT_hence 0: \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    (\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+    by (rule "kirchner-thm:2"[THEN "\<equiv>E"(1)])
+  AOT_have \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n
+    \<box>(\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+  proof(rule GEN; rule GEN)
+    fix x\<^sub>1x\<^sub>n y\<^sub>1y\<^sub>n
+    AOT_show \<open>\<box>(\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+      apply (rule "RM:1"[THEN "\<rightarrow>E", rotated, OF 0]; rule "\<rightarrow>I")
+      using "\<forall>E" by blast
+  qed
+  AOT_hence \<open>\<forall>y\<^sub>1...\<forall>y\<^sub>n \<box>(\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow>
+                         (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<box>(\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<box>(\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+    using "\<forall>E" by blast
+  AOT_hence 0: \<open>\<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> \<box>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+    using "qml:1"[axiom_inst] "vdash-properties:6" by blast
+  moreover AOT_assume \<open>\<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)\<close>
+  moreover AOT_have \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)]\<down>\<close> by "cqt:2"
+  ultimately AOT_have \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)]x\<^sub>1...x\<^sub>n \<equiv>
+                       [\<lambda>x\<^sub>1...x\<^sub>n \<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)]y\<^sub>1...y\<^sub>n\<close>
+    using "\<forall>E" by blast
+  moreover AOT_have \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)]y\<^sub>1...y\<^sub>n\<close>
+    apply (rule "\<beta>\<leftarrow>C"(1))
+      apply "cqt:2[lambda]"
+     apply (fact "cqt:2[const_var]"[axiom_inst])
+    by (simp add: RN GEN "oth-class-taut:3:a")
+  ultimately AOT_have \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)]x\<^sub>1...x\<^sub>n\<close>
+    using "\<equiv>E"(2) by blast
+  AOT_hence \<open>\<box>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)\<close>
+    using "\<beta>\<rightarrow>C"(1) by blast
+  AOT_thus \<open>\<box>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})\<close> using "\<rightarrow>E" 0 by blast
+qed
+
+subsection\<open>Propositional Properties\<close>
+text\<open>\label{PLM: 9.12}\<close>
+
+AOT_define propositional :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>Propositional'(_')\<close>)
+  "prop-prop1": \<open>Propositional([F]) \<equiv>\<^sub>d\<^sub>f \<exists>p(F = [\<lambda>y p])\<close>
+
+AOT_theorem "prop-prop2:1": \<open>\<forall>p [\<lambda>y p]\<down>\<close>
+  by (rule GEN) "cqt:2[lambda]"
+
+AOT_theorem "prop-prop2:2": \<open>[\<lambda>\<nu> \<phi>]\<down>\<close>
+  by "cqt:2[lambda]"
+
+AOT_theorem "prop-prop2:3": \<open>F = [\<lambda>y p] \<rightarrow> \<box>\<forall>x([F]x \<equiv> p)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume 0: \<open>F = [\<lambda>y p]\<close>
+  AOT_show \<open>\<box>\<forall>x([F]x \<equiv> p)\<close>
+    by (rule "rule=E"[rotated, OF 0[symmetric]];
+        rule RN; rule GEN; rule "beta-C-meta"[THEN "\<rightarrow>E"])
+      "cqt:2[lambda]"
+qed
+
+AOT_theorem "prop-prop2:4": \<open>Propositional([F]) \<rightarrow> \<box>Propositional([F])\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>Propositional([F])\<close>
+  AOT_hence \<open>\<exists>p(F = [\<lambda>y p])\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "prop-prop1"] by blast
+  then AOT_obtain p where \<open>F = [\<lambda>y p]\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>(F = [\<lambda>y p])\<close>
+    using "id-nec:2" "modus-tollens:1" "raa-cor:3" by blast
+  AOT_hence \<open>\<exists>p \<box>(F = [\<lambda>y p])\<close>
+    using "\<exists>I" by fast
+  AOT_hence 0: \<open>\<box>\<exists>p (F = [\<lambda>y p])\<close>
+    by (metis Buridan "vdash-properties:10")
+  AOT_thus \<open>\<box>Propositional([F])\<close>
+    using "prop-prop1"[THEN "\<equiv>Df"]
+    by (AOT_subst \<open>Propositional([F])\<close> \<open>\<exists>p (F = [\<lambda>y p])\<close>) auto
+qed
+
+AOT_define indicriminate :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> ("Indiscriminate'(_')")
+  "prop-indis": \<open>Indiscriminate([F]) \<equiv>\<^sub>d\<^sub>f F\<down> & \<box>(\<exists>x [F]x \<rightarrow> \<forall>x [F]x)\<close>
+
+AOT_theorem "prop-in-thm": \<open>Propositional([\<Pi>]) \<rightarrow> Indiscriminate([\<Pi>])\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>Propositional([\<Pi>])\<close>
+  AOT_hence \<open>\<exists>p \<Pi> = [\<lambda>y p]\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "prop-prop1"] by blast
+  then AOT_obtain p where \<Pi>_def: \<open>\<Pi> = [\<lambda>y p]\<close> using "\<exists>E"[rotated] by blast
+  AOT_show \<open>Indiscriminate([\<Pi>])\<close>
+  proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "prop-indis"]; rule "&I")
+    AOT_show \<open>\<Pi>\<down>\<close>
+      using \<Pi>_def by (meson "t=t-proper:1" "vdash-properties:6")
+  next
+    AOT_show \<open>\<box>(\<exists>x [\<Pi>]x \<rightarrow> \<forall>x [\<Pi>]x)\<close>
+    proof (rule "rule=E"[rotated, OF \<Pi>_def[symmetric]];
+           rule RN; rule "\<rightarrow>I"; rule GEN)
+      AOT_modally_strict {
+        AOT_assume \<open>\<exists>x [\<lambda>y p]x\<close>
+        then AOT_obtain a where \<open>[\<lambda>y p]a\<close> using "\<exists>E"[rotated] by blast
+        AOT_hence 0: \<open>p\<close> by (metis "\<beta>\<rightarrow>C"(1))
+        AOT_show \<open>[\<lambda>y p]x\<close> for x
+          apply (rule "\<beta>\<leftarrow>C"(1))
+            apply "cqt:2[lambda]"
+           apply (fact "cqt:2[const_var]"[axiom_inst])
+          by (fact 0)
+      }
+    qed
+  qed
+qed
+
+AOT_theorem "prop-in-f:1": \<open>Necessary([F]) \<rightarrow> Indiscriminate([F])\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>Necessary([F])\<close>
+  AOT_hence 0: \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:1"] by blast
+  AOT_show \<open>Indiscriminate([F])\<close>
+    by (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "prop-indis"])
+       (metis "0" "KBasic:1" "&I" "ex:1:a" "rule-ui:2[const_var]" "\<rightarrow>E") 
+qed
+
+AOT_theorem "prop-in-f:2": \<open>Impossible([F]) \<rightarrow> Indiscriminate([F])\<close>
+proof (rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>x \<not>[F]x \<rightarrow> (\<exists>x [F]x \<rightarrow> \<forall>x [F]x)\<close>
+      by (metis "\<exists>E" "cqt-orig:3" "Hypothetical Syllogism" "\<rightarrow>I" "raa-cor:3")
+  }
+  AOT_hence 0: \<open>\<box>\<forall>x \<not>[F]x \<rightarrow> \<box>(\<exists>x [F]x \<rightarrow> \<forall>x [F]x)\<close>
+    by (rule "RM:1")
+  AOT_assume \<open>Impossible([F])\<close>
+  AOT_hence \<open>\<box>\<forall>x \<not>[F]x\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:2"] "&E" by blast
+  AOT_hence 1: \<open>\<box>(\<exists>x [F]x \<rightarrow> \<forall>x [F]x)\<close>
+    using 0 "\<rightarrow>E" by blast
+  AOT_show \<open>Indiscriminate([F])\<close>
+    by (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "prop-indis"]; rule "&I")
+       (simp add: "ex:1:a" "rule-ui:2[const_var]" 1)+
+qed
+
+AOT_theorem "prop-in-f:3:a": \<open>\<not>Indiscriminate([E!])\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>Indiscriminate([E!])\<close>
+  AOT_hence 0: \<open>\<box>(\<exists>x [E!]x \<rightarrow> \<forall>x [E!]x)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "prop-indis"] "&E" by blast
+  AOT_hence \<open>\<diamond>\<exists>x [E!]x \<rightarrow> \<diamond>\<forall>x [E!]x\<close>
+    using "KBasic:13" "vdash-properties:10" by blast
+  moreover AOT_have \<open>\<diamond>\<exists>x [E!]x\<close>
+    by (simp add: "thm-cont-e:3")
+  ultimately AOT_have \<open>\<diamond>\<forall>x [E!]x\<close>
+    by (metis "vdash-properties:6")
+  AOT_thus \<open>p & \<not>p\<close> for p
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "o-objects-exist:5" "reductio-aa:1")
+qed
+
+AOT_theorem "prop-in-f:3:b": \<open>\<not>Indiscriminate([E!]\<^sup>-)\<close>
+proof (rule "rule=E"[rotated, OF "rel-neg-T:2"[symmetric]];
+       rule "raa-cor:2")
+  AOT_assume \<open>Indiscriminate([\<lambda>x \<not>[E!]x])\<close>
+  AOT_hence 0: \<open>\<box>(\<exists>x [\<lambda>x \<not>[E!]x]x \<rightarrow> \<forall>x [\<lambda>x \<not>[E!]x]x)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "prop-indis"] "&E" by blast
+  AOT_hence \<open>\<box>\<exists>x [\<lambda>x \<not>[E!]x]x \<rightarrow> \<box>\<forall>x [\<lambda>x \<not>[E!]x]x\<close>
+    using "\<rightarrow>E" "qml:1" "vdash-properties:1[2]" by blast
+  moreover AOT_have \<open>\<box>\<exists>x [\<lambda>x \<not>[E!]x]x\<close>
+    apply (AOT_subst \<open>[\<lambda>x \<not>E!x]x\<close> \<open>\<not>E!x\<close> for: x)
+    apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+     apply "cqt:2"
+    by (metis (full_types) "B\<diamond>" RN "T\<diamond>" "cqt-further:2"
+                           "o-objects-exist:5" "\<rightarrow>E")
+  ultimately AOT_have 1: \<open>\<box>\<forall>x [\<lambda>x \<not>[E!]x]x\<close>
+    by (metis "vdash-properties:6")
+  AOT_hence \<open>\<box>\<forall>x \<not>[E!]x\<close>
+    by (AOT_subst (reverse) \<open>\<not>[E!]x\<close>  \<open>[\<lambda>x \<not>[E!]x]x\<close> for: x)
+       (auto intro!: "cqt:2" "beta-C-meta"[THEN "\<rightarrow>E"])
+  AOT_hence \<open>\<forall>x \<box>\<not>[E!]x\<close> by (metis "CBF" "vdash-properties:10")
+  moreover AOT_obtain a where abs_a: \<open>O!a\<close>
+    using "\<exists>E" "o-objects-exist:1" "qml:2"[axiom_inst] "\<rightarrow>E" by blast
+  ultimately AOT_have \<open>\<box>\<not>[E!]a\<close> using "\<forall>E" by blast
+  AOT_hence 2: \<open>\<not>\<diamond>[E!]a\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "reductio-aa:1")
+  AOT_have \<open>A!a\<close>
+    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_abstract])
+     apply "cqt:2[lambda]"
+    apply (rule "\<beta>\<leftarrow>C"(1))
+      apply "cqt:2[lambda]"
+    using "cqt:2[const_var]"[axiom_inst] apply blast
+    by (fact 2)
+  AOT_thus \<open>p & \<not>p\<close> for p using abs_a
+    by (metis "\<equiv>E"(1) "oa-contingent:2" "reductio-aa:1")
+qed
+
+AOT_theorem "prop-in-f:3:c": \<open>\<not>Indiscriminate(O!)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>Indiscriminate(O!)\<close>
+  AOT_hence 0: \<open>\<box>(\<exists>x O!x \<rightarrow> \<forall>x O!x)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "prop-indis"] "&E" by blast
+  AOT_hence \<open>\<box>\<exists>x O!x \<rightarrow> \<box>\<forall>x O!x\<close>
+    using "qml:1"[axiom_inst] "vdash-properties:6" by blast
+  moreover AOT_have \<open>\<box>\<exists>x O!x\<close>
+    using "o-objects-exist:1" by blast
+  ultimately AOT_have \<open>\<box>\<forall>x O!x\<close>
+    by (metis "vdash-properties:6")
+  AOT_thus \<open>p & \<not>p\<close> for p
+    by (metis "o-objects-exist:3" "qml:2"[axiom_inst] "raa-cor:3" "\<rightarrow>E")
+qed
+
+AOT_theorem "prop-in-f:3:d": \<open>\<not>Indiscriminate(A!)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>Indiscriminate(A!)\<close>
+  AOT_hence 0: \<open>\<box>(\<exists>x A!x \<rightarrow> \<forall>x A!x)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE"[OF "prop-indis"] "&E" by blast
+  AOT_hence \<open>\<box>\<exists>x A!x \<rightarrow> \<box>\<forall>x A!x\<close>
+    using "qml:1"[axiom_inst] "vdash-properties:6" by blast
+  moreover AOT_have \<open>\<box>\<exists>x A!x\<close>
+    using "o-objects-exist:2" by blast
+  ultimately AOT_have \<open>\<box>\<forall>x A!x\<close>
+    by (metis "vdash-properties:6")
+  AOT_thus \<open>p & \<not>p\<close> for p
+    by (metis "o-objects-exist:4" "qml:2"[axiom_inst] "raa-cor:3" "\<rightarrow>E")
+qed
+
+AOT_theorem "prop-in-f:4:a": \<open>\<not>Propositional(E!)\<close>
+  using "modus-tollens:1" "prop-in-f:3:a" "prop-in-thm" by blast
+
+AOT_theorem "prop-in-f:4:b": \<open>\<not>Propositional(E!\<^sup>-)\<close>
+  using "modus-tollens:1" "prop-in-f:3:b" "prop-in-thm" by blast
+
+AOT_theorem "prop-in-f:4:c": \<open>\<not>Propositional(O!)\<close>
+  using "modus-tollens:1" "prop-in-f:3:c" "prop-in-thm" by blast
+
+AOT_theorem "prop-in-f:4:d": \<open>\<not>Propositional(A!)\<close>
+  using "modus-tollens:1" "prop-in-f:3:d" "prop-in-thm" by blast
+
+AOT_theorem "prop-prop-nec:1": \<open>\<diamond>\<exists>p (F = [\<lambda>y p]) \<rightarrow> \<exists>p(F = [\<lambda>y p])\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>\<exists>p (F = [\<lambda>y p])\<close>
+  AOT_hence \<open>\<exists>p \<diamond>(F = [\<lambda>y p])\<close>
+    by (metis "BF\<diamond>" "\<rightarrow>E")
+  then AOT_obtain p where \<open>\<diamond>(F = [\<lambda>y p])\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>F = [\<lambda>y p]\<close>
+    by (metis "derived-S5-rules:2" emptyE "id-nec:2" "\<rightarrow>E")
+  AOT_thus \<open>\<exists>p(F = [\<lambda>y p])\<close> by (rule "\<exists>I")
+qed
+
+AOT_theorem "prop-prop-nec:2": \<open>\<forall>p (F \<noteq> [\<lambda>y p]) \<rightarrow> \<box>\<forall>p(F \<noteq> [\<lambda>y p])\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>p (F \<noteq> [\<lambda>y p])\<close>
+  AOT_hence \<open>(F \<noteq> [\<lambda>y p])\<close> for p
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<box>(F \<noteq> [\<lambda>y p])\<close> for p
+    by (rule "id-nec2:2"[unvarify \<beta>, THEN "\<rightarrow>E", rotated]) "cqt:2"
+  AOT_hence \<open>\<forall>p \<box>(F \<noteq> [\<lambda>y p])\<close> by (rule GEN)
+  AOT_thus \<open>\<box>\<forall>p (F \<noteq> [\<lambda>y p])\<close> using BF[THEN "\<rightarrow>E"] by fast
+qed
+
+AOT_theorem "prop-prop-nec:3": \<open>\<exists>p (F = [\<lambda>y p]) \<rightarrow> \<box>\<exists>p(F = [\<lambda>y p])\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>p (F = [\<lambda>y p])\<close>
+  then AOT_obtain p where \<open>(F = [\<lambda>y p])\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>(F = [\<lambda>y p])\<close> by (metis "id-nec:2" "\<rightarrow>E")
+  AOT_hence \<open>\<exists>p\<box>(F = [\<lambda>y p])\<close> by (rule "\<exists>I")
+  AOT_thus \<open>\<box>\<exists>p(F = [\<lambda>y p])\<close> by (metis Buridan "\<rightarrow>E")
+qed
+
+AOT_theorem "prop-prop-nec:4": \<open>\<diamond>\<forall>p (F \<noteq> [\<lambda>y p]) \<rightarrow> \<forall>p(F \<noteq> [\<lambda>y p])\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>\<forall>p (F \<noteq> [\<lambda>y p])\<close>
+  AOT_hence \<open>\<forall>p \<diamond>(F \<noteq> [\<lambda>y p])\<close> by (metis "Buridan\<diamond>" "\<rightarrow>E")
+  AOT_hence \<open>\<diamond>(F \<noteq> [\<lambda>y p])\<close> for p
+    using "\<forall>E" by blast
+  AOT_hence \<open>F \<noteq> [\<lambda>y p]\<close> for p
+    by (rule "id-nec2:3"[unvarify \<beta>, THEN "\<rightarrow>E", rotated]) "cqt:2"
+  AOT_thus \<open>\<forall>p (F \<noteq> [\<lambda>y p])\<close> by (rule GEN)
+qed
+
+AOT_theorem "enc-prop-nec:1":
+  \<open>\<diamond>\<forall>F (x[F] \<rightarrow> \<exists>p(F = [\<lambda>y p])) \<rightarrow> \<forall>F(x[F] \<rightarrow> \<exists>p (F = [\<lambda>y p]))\<close>
+proof(rule "\<rightarrow>I"; rule GEN; rule "\<rightarrow>I")
+  fix F
+  AOT_assume \<open>\<diamond>\<forall>F (x[F] \<rightarrow> \<exists>p(F = [\<lambda>y p]))\<close>
+  AOT_hence \<open>\<forall>F \<diamond>(x[F] \<rightarrow> \<exists>p(F = [\<lambda>y p]))\<close>
+    using "Buridan\<diamond>" "vdash-properties:10" by blast
+  AOT_hence 0: \<open>\<diamond>(x[F] \<rightarrow> \<exists>p(F = [\<lambda>y p]))\<close> using "\<forall>E" by blast
+  AOT_assume \<open>x[F]\<close>
+  AOT_hence \<open>\<box>x[F]\<close> by (metis "en-eq:2[1]" "\<equiv>E"(1))
+  AOT_hence \<open>\<diamond>\<exists>p(F = [\<lambda>y p])\<close>
+    using 0 by (metis "KBasic2:4" "\<equiv>E"(1) "vdash-properties:10")
+  AOT_thus \<open>\<exists>p(F = [\<lambda>y p])\<close>
+    using "prop-prop-nec:1"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "enc-prop-nec:2":
+  \<open>\<forall>F (x[F] \<rightarrow> \<exists>p(F = [\<lambda>y p])) \<rightarrow> \<box>\<forall>F(x[F] \<rightarrow> \<exists>p (F = [\<lambda>y p]))\<close>
+  using "derived-S5-rules:1"[where \<Gamma>="{}", simplified, OF "enc-prop-nec:1"]
+  by blast
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/AOT/AOT_PossibleWorlds.thy b/thys/AOT/AOT_PossibleWorlds.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_PossibleWorlds.thy
@@ -0,0 +1,3195 @@
+(*<*)
+theory AOT_PossibleWorlds
+  imports AOT_PLM AOT_BasicLogicalObjects AOT_RestrictedVariables
+begin
+(*>*)
+
+section\<open>Possible Worlds\<close>
+
+AOT_define Situation :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Situation'(_')\<close>)
+  situations: \<open>Situation(x) \<equiv>\<^sub>d\<^sub>f A!x & \<forall>F (x[F] \<rightarrow> Propositional([F]))\<close>
+
+AOT_theorem "T-sit": \<open>TruthValue(x) \<rightarrow> Situation(x)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>TruthValue(x)\<close>
+  AOT_hence \<open>\<exists>p TruthValueOf(x,p)\<close>
+    using "T-value"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  then AOT_obtain p where \<open>TruthValueOf(x,p)\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<theta>: \<open>A!x & \<forall>F (x[F] \<equiv> \<exists>q((q \<equiv> p) & F = [\<lambda>y q]))\<close>
+    using "tv-p"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_show \<open>Situation(x)\<close>
+  proof(rule situations[THEN "\<equiv>\<^sub>d\<^sub>fI"]; safe intro!: "&I" GEN "\<rightarrow>I" \<theta>[THEN "&E"(1)])
+    fix F
+    AOT_assume \<open>x[F]\<close>
+    AOT_hence \<open>\<exists>q((q \<equiv> p) & F = [\<lambda>y q])\<close>
+      using \<theta>[THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=F], THEN "\<equiv>E"(1)] by argo
+    then AOT_obtain q where \<open>(q \<equiv> p) & F = [\<lambda>y q]\<close> using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<exists>p F = [\<lambda>y p]\<close> using "&E"(2) "\<exists>I"(2) by metis
+    AOT_thus \<open>Propositional([F])\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fI" "prop-prop1")
+  qed
+qed
+
+AOT_theorem "possit-sit:1": \<open>Situation(x) \<equiv> \<box>Situation(x)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>Situation(x)\<close>
+  AOT_hence 0: \<open>A!x & \<forall>F (x[F] \<rightarrow> Propositional([F]))\<close>
+    using situations[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_have 1: \<open>\<box>(A!x & \<forall>F (x[F] \<rightarrow> Propositional([F])))\<close>
+  proof(rule "KBasic:3"[THEN "\<equiv>E"(2)]; rule "&I")
+    AOT_show \<open>\<box>A!x\<close> using 0[THEN "&E"(1)] by (metis "oa-facts:2"[THEN "\<rightarrow>E"])
+  next
+    AOT_have \<open>\<forall>F (x[F] \<rightarrow> Propositional([F])) \<rightarrow> \<box>\<forall>F (x[F] \<rightarrow> Propositional([F]))\<close>
+      by (AOT_subst \<open>Propositional([F])\<close> \<open>\<exists>p (F = [\<lambda>y p])\<close> for: F :: \<open><\<kappa>>\<close>)
+         (auto simp: "prop-prop1" "\<equiv>Df" "enc-prop-nec:2")
+    AOT_thus \<open>\<box>\<forall>F (x[F] \<rightarrow> Propositional([F]))\<close>
+      using 0[THEN "&E"(2)] "\<rightarrow>E" by blast
+  qed
+  AOT_show \<open>\<box>Situation(x)\<close>
+    by (AOT_subst \<open>Situation(x)\<close> \<open>A!x & \<forall>F (x[F] \<rightarrow> Propositional([F]))\<close>)
+       (auto simp: 1 "\<equiv>Df" situations)
+next
+  AOT_show \<open>Situation(x)\<close> if \<open>\<box>Situation(x)\<close>
+    using "qml:2"[axiom_inst, THEN "\<rightarrow>E", OF that].
+qed
+
+AOT_theorem "possit-sit:2": \<open>\<diamond>Situation(x) \<equiv> Situation(x)\<close>
+  using "possit-sit:1"
+  by (metis "RE\<diamond>" "S5Basic:2" "\<equiv>E"(1) "\<equiv>E"(5) "Commutativity of \<equiv>")
+
+AOT_theorem "possit-sit:3": \<open>\<diamond>Situation(x) \<equiv> \<box>Situation(x)\<close>
+  using "possit-sit:1" "possit-sit:2" by (meson "\<equiv>E"(5))
+
+AOT_theorem "possit-sit:4": \<open>\<^bold>\<A>Situation(x) \<equiv> Situation(x)\<close>
+  by (meson "Act-Basic:5" "Act-Sub:2" "RA[2]" "\<equiv>E"(1) "\<equiv>E"(6) "possit-sit:2")
+
+AOT_theorem "possit-sit:5": \<open>Situation(\<circ>p)\<close>
+proof (safe intro!: situations[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" GEN "\<rightarrow>I" "prop-prop1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_have \<open>\<exists>F \<circ>p[F]\<close>
+    using "tv-id:2"[THEN "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)]
+          "existential:1" "prop-prop2:2" by blast
+  AOT_thus \<open>A!\<circ>p\<close>
+    by (safe intro!: "encoders-are-abstract"[unvarify x, THEN "\<rightarrow>E"]
+                     "t=t-proper:2"[THEN "\<rightarrow>E", OF "ext-p-tv:3"])
+next
+  fix F
+  AOT_assume \<open>\<circ>p[F]\<close>
+  AOT_hence \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<exists>q ((q \<equiv> p) & F = [\<lambda>y q])))[F]\<close>
+    using "tv-id:1" "rule=E" by fast
+  AOT_hence \<open>\<^bold>\<A>\<exists>q ((q \<equiv> p) & F = [\<lambda>y q])\<close>
+    using "\<equiv>E"(1) "desc-nec-encode:1" by fast
+  AOT_hence \<open>\<exists>q \<^bold>\<A>((q \<equiv> p) & F = [\<lambda>y q])\<close>
+    by (metis "Act-Basic:10" "\<equiv>E"(1))
+  then AOT_obtain q where \<open>\<^bold>\<A>((q \<equiv> p) & F = [\<lambda>y q])\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<^bold>\<A>F = [\<lambda>y q]\<close> by (metis "Act-Basic:2" "con-dis-i-e:2:b" "intro-elim:3:a")
+  AOT_hence \<open>F = [\<lambda>y q]\<close>
+    using "id-act:1"[unvarify \<beta>, THEN "\<equiv>E"(2)] by (metis "prop-prop2:2")
+  AOT_thus \<open>\<exists>p F = [\<lambda>y p]\<close>
+    using "\<exists>I" by fast
+qed
+
+AOT_theorem "possit-sit:6": \<open>Situation(\<top>)\<close>
+proof -
+  AOT_have true_def: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<top> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:1")
+  AOT_hence true_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<top>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_have \<open>\<^bold>\<A>TruthValue(\<top>)\<close>
+    using "actual-desc:2"[unvarify x, OF true_den, THEN "\<rightarrow>E", OF true_def]
+    using "TV-lem2:1"[unvarify x, OF true_den, THEN "RA[2]",
+                      THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"]
+    by blast
+  AOT_hence \<open>\<^bold>\<A>Situation(\<top>)\<close>
+    using "T-sit"[unvarify x, OF true_den, THEN "RA[2]",
+                  THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>Situation(\<top>)\<close>
+    using "possit-sit:4"[unvarify x, OF true_den, THEN "\<equiv>E"(1)] by blast
+qed
+
+AOT_theorem "possit-sit:7": \<open>Situation(\<bottom>)\<close>
+proof -
+  AOT_have true_def: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<bottom> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(\<not>p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:2")
+  AOT_hence true_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<bottom>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  AOT_have \<open>\<^bold>\<A>TruthValue(\<bottom>)\<close>
+    using "actual-desc:2"[unvarify x, OF true_den, THEN "\<rightarrow>E", OF true_def]
+    using "TV-lem2:2"[unvarify x, OF true_den, THEN "RA[2]",
+                      THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"]
+    by blast
+  AOT_hence \<open>\<^bold>\<A>Situation(\<bottom>)\<close>
+    using "T-sit"[unvarify x, OF true_den, THEN "RA[2]",
+                  THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>Situation(\<bottom>)\<close>
+    using "possit-sit:4"[unvarify x, OF true_den, THEN "\<equiv>E"(1)] by blast
+qed
+
+AOT_register_rigid_restricted_type
+  Situation: \<open>Situation(\<kappa>)\<close>
+proof
+  AOT_modally_strict {
+    fix p
+    AOT_obtain x where \<open>TruthValueOf(x,p)\<close>
+      by (metis "instantiation" "p-has-!tv:1")
+    AOT_hence \<open>\<exists>p TruthValueOf(x,p)\<close> by (rule "\<exists>I")
+    AOT_hence \<open>TruthValue(x)\<close> by (metis "\<equiv>\<^sub>d\<^sub>fI" "T-value")
+    AOT_hence \<open>Situation(x)\<close> using "T-sit"[THEN "\<rightarrow>E"] by blast
+    AOT_thus \<open>\<exists>x Situation(x)\<close> by (rule "\<exists>I")
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>Situation(\<kappa>) \<rightarrow> \<kappa>\<down>\<close> for \<kappa>
+    proof (rule "\<rightarrow>I")
+      AOT_assume \<open>Situation(\<kappa>)\<close>
+      AOT_hence \<open>A!\<kappa>\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) situations)
+      AOT_thus \<open>\<kappa>\<down>\<close> by (metis "russell-axiom[exe,1].\<psi>_denotes_asm")
+    qed
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<forall>\<alpha>(Situation(\<alpha>) \<rightarrow> \<box>Situation(\<alpha>))\<close>
+      using "possit-sit:1"[THEN "conventions:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                           THEN "&E"(1)] GEN by fast
+  }
+qed
+
+AOT_register_variable_names
+  Situation: s
+
+AOT_define TruthInSituation :: \<open>\<tau> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> ("(_ \<Turnstile>/ _)" [100, 40] 100)
+  "true-in-s": \<open>s \<Turnstile> p \<equiv>\<^sub>d\<^sub>f s\<^bold>\<Sigma>p\<close>
+
+notepad
+begin
+  (* Verify precedence. *)
+  fix x p q
+  have \<open>\<guillemotleft>x \<Turnstile> p \<rightarrow> q\<guillemotright> = \<guillemotleft>(x \<Turnstile> p) \<rightarrow> q\<guillemotright>\<close>
+    by simp
+  have \<open>\<guillemotleft>x \<Turnstile> p & q\<guillemotright> = \<guillemotleft>(x \<Turnstile> p) & q\<guillemotright>\<close>
+    by simp
+  have \<open>\<guillemotleft>x \<Turnstile> \<not>p\<guillemotright> = \<guillemotleft>x \<Turnstile> (\<not>p)\<guillemotright>\<close>
+    by simp
+  have \<open>\<guillemotleft>x \<Turnstile> \<box>p\<guillemotright> = \<guillemotleft>x \<Turnstile> (\<box>p)\<guillemotright>\<close>
+    by simp
+  have \<open>\<guillemotleft>x \<Turnstile> \<^bold>\<A>p\<guillemotright> = \<guillemotleft>x \<Turnstile> (\<^bold>\<A>p)\<guillemotright>\<close>
+    by simp
+  have \<open>\<guillemotleft>\<box>x \<Turnstile> p\<guillemotright> = \<guillemotleft>\<box>(x \<Turnstile> p)\<guillemotright>\<close>
+    by simp
+  have \<open>\<guillemotleft>\<not>x \<Turnstile> p\<guillemotright> = \<guillemotleft>\<not>(x \<Turnstile> p)\<guillemotright>\<close>
+    by simp
+end
+
+
+AOT_theorem lem1: \<open>Situation(x) \<rightarrow> (x \<Turnstile> p \<equiv> x[\<lambda>y p])\<close>
+proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>Situation(x)\<close>
+  AOT_assume \<open>x \<Turnstile> p\<close>
+  AOT_hence \<open>x\<^bold>\<Sigma>p\<close>
+    using "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_thus \<open>x[\<lambda>y p]\<close> using "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+next
+  AOT_assume 1: \<open>Situation(x)\<close>
+  AOT_assume \<open>x[\<lambda>y p]\<close>
+  AOT_hence \<open>x\<^bold>\<Sigma>p\<close>
+    using "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I", OF "cqt:2"(1)] by blast
+  AOT_thus \<open>x \<Turnstile> p\<close>
+    using "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fI"] 1 "&I" by blast
+qed
+
+AOT_theorem "lem2:1": \<open>s \<Turnstile> p \<equiv> \<box>s \<Turnstile> p\<close>
+proof -
+  AOT_have sit: \<open>Situation(s)\<close>
+    by (simp add: Situation.\<psi>)
+  AOT_have \<open>s \<Turnstile> p \<equiv> s[\<lambda>y p]\<close>
+    using lem1[THEN "\<rightarrow>E", OF sit] by blast
+  also AOT_have \<open>\<dots> \<equiv> \<box>s[\<lambda>y p]\<close>
+    by (rule "en-eq:2[1]"[unvarify F]) "cqt:2[lambda]"
+  also AOT_have \<open>\<dots> \<equiv> \<box>s \<Turnstile> p\<close>
+    using lem1[THEN RM, THEN "\<rightarrow>E", OF "possit-sit:1"[THEN "\<equiv>E"(1), OF sit]]
+    by (metis "KBasic:6" "\<equiv>E"(2) "Commutativity of \<equiv>" "\<rightarrow>E")
+  finally show ?thesis.
+qed
+
+AOT_theorem "lem2:2": \<open>\<diamond>s \<Turnstile> p \<equiv> s \<Turnstile> p\<close>
+proof -
+  AOT_have \<open>\<box>(s \<Turnstile> p \<rightarrow> \<box>s \<Turnstile> p)\<close>
+    using "possit-sit:1"[THEN "\<equiv>E"(1), OF Situation.\<psi>]
+          "lem2:1"[THEN "conventions:3"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)]]
+          RM[OF "\<rightarrow>I", THEN "\<rightarrow>E"] by blast
+  thus ?thesis by (metis "B\<diamond>" "S5Basic:13" "T\<diamond>" "\<equiv>I" "\<equiv>E"(1) "\<rightarrow>E")
+qed
+
+AOT_theorem "lem2:3": \<open>\<diamond>s \<Turnstile> p \<equiv> \<box>s \<Turnstile> p\<close>
+  using "lem2:1" "lem2:2" by (metis "\<equiv>E"(5))
+
+AOT_theorem "lem2:4": \<open>\<^bold>\<A>(s \<Turnstile> p) \<equiv> s \<Turnstile> p\<close>
+proof -
+  AOT_have \<open>\<box>(s \<Turnstile> p \<rightarrow> \<box>s \<Turnstile> p)\<close>
+    using "possit-sit:1"[THEN "\<equiv>E"(1), OF Situation.\<psi>]
+      "lem2:1"[THEN "conventions:3"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)]]
+      RM[OF "\<rightarrow>I", THEN "\<rightarrow>E"] by blast
+  thus ?thesis
+    using "sc-eq-fur:2"[THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "lem2:5": \<open>\<not>s \<Turnstile> p \<equiv> \<box>\<not>s \<Turnstile> p\<close>
+  by (metis "KBasic2:1" "contraposition:1[2]" "\<rightarrow>I" "\<equiv>I" "\<equiv>E"(3) "\<equiv>E"(4) "lem2:2")
+
+AOT_theorem "sit-identity": \<open>s = s' \<equiv> \<forall>p(s \<Turnstile> p \<equiv> s' \<Turnstile> p)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>s = s'\<close>
+  moreover AOT_have \<open>\<forall>p(s \<Turnstile> p \<equiv> s \<Turnstile> p)\<close>
+    by (simp add: "oth-class-taut:3:a" "universal-cor")
+  ultimately AOT_show \<open>\<forall>p(s \<Turnstile> p \<equiv> s' \<Turnstile> p)\<close>
+    using "rule=E" by fast
+next
+  AOT_assume a: \<open>\<forall>p (s \<Turnstile> p \<equiv> s' \<Turnstile> p)\<close>
+  AOT_show \<open>s = s'\<close>
+  proof(safe intro!: "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&I" GEN "\<equiv>I" "\<rightarrow>I")
+    AOT_show \<open>A!s\<close> using Situation.\<psi> "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) situations by blast
+  next
+    AOT_show \<open>A!s'\<close> using Situation.\<psi> "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) situations by blast
+  next
+    fix F
+    AOT_assume 0: \<open>s[F]\<close>
+    AOT_hence \<open>\<exists>p (F = [\<lambda>y p])\<close>
+      using Situation.\<psi>[THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                        THEN "\<forall>E"(2)[where \<beta>=F], THEN "\<rightarrow>E"]
+            "prop-prop1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+    then AOT_obtain p where F_def: \<open>F = [\<lambda>y p]\<close>
+      using "\<exists>E" by metis
+    AOT_hence \<open>s[\<lambda>y p]\<close>
+      using 0 "rule=E" by blast
+    AOT_hence \<open>s \<Turnstile> p\<close>
+      using lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(2)] by blast
+    AOT_hence \<open>s' \<Turnstile> p\<close>
+      using a[THEN "\<forall>E"(2)[where \<beta>=p], THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>s'[\<lambda>y p]\<close>
+      using lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(1)] by blast
+    AOT_thus \<open>s'[F]\<close>
+      using F_def[symmetric] "rule=E" by blast
+  next
+    fix F
+    AOT_assume 0: \<open>s'[F]\<close>
+    AOT_hence \<open>\<exists>p (F = [\<lambda>y p])\<close>
+      using Situation.\<psi>[THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                        THEN "\<forall>E"(2)[where \<beta>=F], THEN "\<rightarrow>E"]
+            "prop-prop1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+    then AOT_obtain p where F_def: \<open>F = [\<lambda>y p]\<close>
+      using "\<exists>E" by metis
+    AOT_hence \<open>s'[\<lambda>y p]\<close>
+      using 0 "rule=E" by blast
+    AOT_hence \<open>s' \<Turnstile> p\<close>
+      using lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(2)] by blast
+    AOT_hence \<open>s \<Turnstile> p\<close>
+      using a[THEN "\<forall>E"(2)[where \<beta>=p], THEN "\<equiv>E"(2)] by blast
+    AOT_hence \<open>s[\<lambda>y p]\<close>
+      using lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(1)] by blast
+    AOT_thus \<open>s[F]\<close>
+      using F_def[symmetric] "rule=E" by blast
+  qed
+qed
+
+AOT_define PartOfSituation :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl \<open>\<unlhd>\<close> 80)
+  "sit-part-whole": \<open>s \<unlhd> s' \<equiv>\<^sub>d\<^sub>f \<forall>p (s \<Turnstile> p \<rightarrow> s' \<Turnstile> p)\<close>
+
+AOT_theorem "part:1": \<open>s \<unlhd> s\<close>
+  by (rule "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+     (safe intro!: "&I" Situation.\<psi> GEN "\<rightarrow>I")
+
+AOT_theorem "part:2": \<open>s \<unlhd> s' & s \<noteq> s' \<rightarrow> \<not>(s' \<unlhd> s)\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:2")
+  AOT_assume 0: \<open>s \<unlhd> s'\<close>
+  AOT_hence a: \<open>s \<Turnstile> p \<rightarrow> s' \<Turnstile> p\<close> for p
+    using "\<forall>E"(2) "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_assume \<open>s' \<unlhd> s\<close>
+  AOT_hence b: \<open>s' \<Turnstile> p \<rightarrow> s \<Turnstile> p\<close> for p
+    using "\<forall>E"(2) "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_have \<open>\<forall>p (s \<Turnstile> p \<equiv> s' \<Turnstile> p)\<close>
+    using a b by (simp add: "\<equiv>I" "universal-cor")
+  AOT_hence 1: \<open>s = s'\<close>
+    using "sit-identity"[THEN "\<equiv>E"(2)] by metis
+  AOT_assume \<open>s \<noteq> s'\<close>
+  AOT_hence \<open>\<not>(s = s')\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "=-infix")
+  AOT_thus \<open>s = s' & \<not>(s = s')\<close>
+    using 1 "&I" by blast
+qed
+
+AOT_theorem "part:3": \<open>s \<unlhd> s' & s' \<unlhd> s'' \<rightarrow> s \<unlhd> s''\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2);
+      safe intro!: "&I" GEN "\<rightarrow>I" "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fI"] Situation.\<psi>)
+  fix p
+  AOT_assume \<open>s \<Turnstile> p\<close>
+  moreover AOT_assume \<open>s \<unlhd> s'\<close>
+  ultimately AOT_have \<open>s' \<Turnstile> p\<close>
+    using "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2),
+                           THEN "\<forall>E"(2)[where \<beta>=p], THEN "\<rightarrow>E"] by blast
+  moreover AOT_assume \<open>s' \<unlhd> s''\<close>
+  ultimately AOT_show \<open>s'' \<Turnstile> p\<close>
+    using "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2),
+                           THEN "\<forall>E"(2)[where \<beta>=p], THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "sit-identity2:1": \<open>s = s' \<equiv> s \<unlhd> s' & s' \<unlhd> s\<close>
+proof (safe intro!: "\<equiv>I" "&I" "\<rightarrow>I")
+  AOT_show \<open>s \<unlhd> s'\<close> if \<open>s = s'\<close>
+    using "rule=E" "part:1" that by blast
+next
+  AOT_show \<open>s' \<unlhd> s\<close> if \<open>s = s'\<close>
+    using "rule=E" "part:1" that[symmetric] by blast
+next
+  AOT_assume \<open>s \<unlhd> s' & s' \<unlhd> s\<close>
+  AOT_thus \<open>s = s'\<close> using "part:2"[THEN "\<rightarrow>E", OF "&I"]
+    by (metis "\<equiv>\<^sub>d\<^sub>fI" "&E"(1) "&E"(2) "=-infix" "raa-cor:3")
+qed
+
+AOT_theorem "sit-identity2:2": \<open>s = s' \<equiv> \<forall>s'' (s'' \<unlhd> s \<equiv> s'' \<unlhd> s')\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" Situation.GEN "sit-identity"[THEN "\<equiv>E"(2)]
+                   GEN[where 'a=\<o>])
+  AOT_show \<open>s'' \<unlhd> s'\<close> if \<open>s'' \<unlhd> s\<close> and \<open>s = s'\<close> for s''
+    using "rule=E" that by blast
+next
+  AOT_show \<open>s'' \<unlhd> s\<close> if \<open>s'' \<unlhd> s'\<close> and \<open>s = s'\<close> for s''
+    using "rule=E" id_sym that by blast
+next
+  AOT_show \<open>s' \<Turnstile> p\<close> if \<open>s \<Turnstile> p\<close> and \<open>\<forall>s'' (s'' \<unlhd> s \<equiv> s'' \<unlhd> s')\<close> for p
+    using "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2),
+              OF that(2)[THEN "Situation.\<forall>E", THEN "\<equiv>E"(1), OF "part:1"],
+              THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF that(1)].
+next
+  AOT_show \<open>s \<Turnstile> p\<close> if \<open>s' \<Turnstile> p\<close> and \<open>\<forall>s'' (s'' \<unlhd> s \<equiv> s'' \<unlhd> s')\<close> for p
+    using "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2),
+          OF that(2)[THEN "Situation.\<forall>E", THEN "\<equiv>E"(2), OF "part:1"],
+          THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF that(1)].
+qed
+
+AOT_define Persistent :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>Persistent'(_')\<close>)
+  persistent: \<open>Persistent(p) \<equiv>\<^sub>d\<^sub>f \<forall>s (s \<Turnstile> p \<rightarrow> \<forall>s' (s \<unlhd> s' \<rightarrow> s' \<Turnstile> p))\<close>
+
+AOT_theorem "pers-prop": \<open>\<forall>p Persistent(p)\<close>
+  by (safe intro!: GEN[where 'a=\<o>] Situation.GEN persistent[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<rightarrow>I")
+     (simp add: "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"])
+
+AOT_define NullSituation :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>NullSituation'(_')\<close>)
+  "df-null-trivial:1": \<open>NullSituation(s) \<equiv>\<^sub>d\<^sub>f \<not>\<exists>p s \<Turnstile> p\<close>
+
+AOT_define TrivialSituation :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>TrivialSituation'(_')\<close>)
+  "df-null-trivial:2": \<open>TrivialSituation(s) \<equiv>\<^sub>d\<^sub>f \<forall>p s \<Turnstile> p\<close>
+
+AOT_theorem "thm-null-trivial:1": \<open>\<exists>!x NullSituation(x)\<close>
+proof (AOT_subst \<open>NullSituation(x)\<close> \<open>A!x & \<forall>F (x[F] \<equiv> F \<noteq> F)\<close> for: x)
+  AOT_modally_strict {
+    AOT_show \<open>NullSituation(x) \<equiv> A!x & \<forall>F (x[F] \<equiv> F \<noteq> F)\<close> for x
+    proof (safe intro!: "\<equiv>I" "\<rightarrow>I" "df-null-trivial:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                dest!: "df-null-trivial:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+      AOT_assume 0: \<open>Situation(x) & \<not>\<exists>p x \<Turnstile> p\<close>
+      AOT_have 1: \<open>A!x\<close>
+        using 0[THEN "&E"(1), THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)].
+      AOT_have 2: \<open>x[F] \<rightarrow> \<exists>p F = [\<lambda>y p]\<close> for F
+        using 0[THEN "&E"(1), THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                THEN "&E"(2), THEN "\<forall>E"(2)]
+        by (metis "\<equiv>\<^sub>d\<^sub>fE" "\<rightarrow>I" "prop-prop1" "\<rightarrow>E")
+      AOT_show \<open>A!x & \<forall>F (x[F] \<equiv> F \<noteq> F)\<close>
+      proof (safe intro!: "&I" 1 GEN "\<equiv>I" "\<rightarrow>I")
+        fix F
+        AOT_assume \<open>x[F]\<close>
+        moreover AOT_obtain p where \<open>F = [\<lambda>y p]\<close>
+          using calculation 2[THEN "\<rightarrow>E"] "\<exists>E"[rotated] by blast
+        ultimately AOT_have \<open>x[\<lambda>y p]\<close>
+          by (metis "rule=E")
+        AOT_hence \<open>x \<Turnstile> p\<close>
+          using lem1[THEN "\<rightarrow>E", OF 0[THEN "&E"(1)], THEN "\<equiv>E"(2)] by blast
+        AOT_hence \<open>\<exists>p (x \<Turnstile> p)\<close>
+          by (rule "\<exists>I")
+        AOT_thus \<open>F \<noteq> F\<close>
+          using 0[THEN "&E"(2)] "raa-cor:1" "&I" by blast
+      next
+        fix F :: \<open><\<kappa>> AOT_var\<close>
+        AOT_assume \<open>F \<noteq> F\<close>
+        AOT_hence \<open>\<not>(F = F)\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "=-infix")
+        moreover AOT_have \<open>F = F\<close>
+          by (simp add: "id-eq:1")
+        ultimately AOT_show \<open>x[F]\<close> using "&I" "raa-cor:1" by blast
+      qed
+    next
+      AOT_assume 0: \<open>A!x & \<forall>F (x[F] \<equiv> F \<noteq> F)\<close>
+      AOT_hence \<open>x[F] \<equiv> F \<noteq> F\<close> for F
+        using "\<forall>E" "&E" by blast
+      AOT_hence 1: \<open>\<not>x[F]\<close> for F
+        using "\<equiv>\<^sub>d\<^sub>fE" "id-eq:1" "=-infix" "reductio-aa:1" "\<equiv>E"(1) by blast
+      AOT_show \<open>Situation(x) & \<not>\<exists>p x \<Turnstile> p\<close>
+      proof (safe intro!: "&I" situations[THEN "\<equiv>\<^sub>d\<^sub>fI"] 0[THEN "&E"(1)] GEN "\<rightarrow>I")
+        AOT_show \<open>Propositional([F])\<close> if \<open>x[F]\<close> for F
+          using that 1 "&I" "raa-cor:1" by fast
+      next
+        AOT_show \<open>\<not>\<exists>p x \<Turnstile> p\<close>
+        proof(rule "raa-cor:2")
+          AOT_assume \<open>\<exists>p x \<Turnstile> p\<close>
+          then AOT_obtain p where \<open>x \<Turnstile> p\<close> using "\<exists>E"[rotated] by blast
+          AOT_hence \<open>x[\<lambda>y p]\<close>
+            using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<equiv>E"(1) lem1 "modus-tollens:1"
+                  "raa-cor:3" "true-in-s" by fast
+          moreover AOT_have \<open>\<not>x[\<lambda>y p]\<close>
+            by (rule 1[unvarify F]) "cqt:2[lambda]"
+          ultimately AOT_show \<open>p & \<not>p\<close> for p using "&I" "raa-cor:1" by blast
+        qed
+      qed
+    qed
+  }
+next
+  AOT_show \<open>\<exists>!x ([A!]x & \<forall>F (x[F] \<equiv> F \<noteq> F))\<close>
+    by (simp add: "A-objects!")
+qed
+
+
+AOT_theorem "thm-null-trivial:2": \<open>\<exists>!x TrivialSituation(x)\<close>
+proof (AOT_subst \<open>TrivialSituation(x)\<close> \<open>A!x & \<forall>F (x[F] \<equiv> \<exists>p F = [\<lambda>y p])\<close> for: x)
+  AOT_modally_strict {
+    AOT_show \<open>TrivialSituation(x) \<equiv> A!x & \<forall>F (x[F] \<equiv> \<exists>p F = [\<lambda>y p])\<close> for x
+    proof (safe intro!: "\<equiv>I" "\<rightarrow>I" "df-null-trivial:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                 dest!: "df-null-trivial:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+      AOT_assume 0: \<open>Situation(x) & \<forall>p x \<Turnstile> p\<close>
+      AOT_have 1: \<open>A!x\<close>
+        using 0[THEN "&E"(1), THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)].
+      AOT_have 2: \<open>x[F] \<rightarrow> \<exists>p F = [\<lambda>y p]\<close> for F
+        using 0[THEN "&E"(1), THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                THEN "&E"(2), THEN "\<forall>E"(2)]
+        by (metis "\<equiv>\<^sub>d\<^sub>fE" "deduction-theorem" "prop-prop1" "\<rightarrow>E")
+      AOT_show \<open>A!x & \<forall>F (x[F] \<equiv> \<exists>p F = [\<lambda>y p])\<close>
+      proof (safe intro!: "&I" 1 GEN "\<equiv>I" "\<rightarrow>I" 2)
+        fix F
+        AOT_assume \<open>\<exists>p F = [\<lambda>y p]\<close>
+        then AOT_obtain p where \<open>F = [\<lambda>y p]\<close>
+          using "\<exists>E"[rotated] by blast
+        moreover AOT_have \<open>x \<Turnstile> p\<close>
+          using 0[THEN "&E"(2)] "\<forall>E" by blast
+        ultimately AOT_show \<open>x[F]\<close>
+          by (metis 0 "rule=E" "&E"(1) id_sym "\<equiv>E"(2) lem1
+                    "Commutativity of \<equiv>" "\<rightarrow>E")
+      qed
+    next
+      AOT_assume 0: \<open>A!x & \<forall>F (x[F] \<equiv> \<exists>p F = [\<lambda>y p])\<close>
+      AOT_hence 1: \<open>x[F] \<equiv> \<exists>p F = [\<lambda>y p]\<close> for F
+        using "\<forall>E" "&E" by blast
+      AOT_have 2: \<open>Situation(x)\<close>
+      proof (safe intro!: "&I" situations[THEN "\<equiv>\<^sub>d\<^sub>fI"] 0[THEN "&E"(1)] GEN "\<rightarrow>I")
+        AOT_show \<open>Propositional([F])\<close> if \<open>x[F]\<close> for F
+          using 1[THEN "\<equiv>E"(1), OF that]
+          by (metis "\<equiv>\<^sub>d\<^sub>fI" "prop-prop1")
+      qed
+      AOT_show \<open>Situation(x) & \<forall>p (x \<Turnstile> p)\<close>
+      proof (safe intro!: "&I" 2 0[THEN "&E"(1)] GEN "\<rightarrow>I")
+        AOT_have \<open>x[\<lambda>y p] \<equiv> \<exists>q [\<lambda>y p] = [\<lambda>y q]\<close> for p
+          by (rule 1[unvarify F, where \<tau>="\<guillemotleft>[\<lambda>y p]\<guillemotright>"]) "cqt:2[lambda]"
+        moreover AOT_have \<open>\<exists>q [\<lambda>y p] = [\<lambda>y q]\<close> for p
+          by (rule "\<exists>I"(2)[where \<beta>=p])
+             (simp add: "rule=I:1" "prop-prop2:2")
+        ultimately AOT_have \<open>x[\<lambda>y p]\<close> for p by (metis "\<equiv>E"(2))
+        AOT_thus \<open>x \<Turnstile> p\<close> for p
+          by (metis "2" "\<equiv>E"(2) lem1 "\<rightarrow>E")
+      qed
+    qed
+  }
+next
+  AOT_show \<open>\<exists>!x ([A!]x & \<forall>F (x[F] \<equiv> \<exists>p F = [\<lambda>y p]))\<close>
+    by (simp add: "A-objects!")
+qed
+
+AOT_theorem "thm-null-trivial:3": \<open>\<^bold>\<iota>x NullSituation(x)\<down>\<close>
+  by (meson "A-Exists:2" "RA[2]" "\<equiv>E"(2) "thm-null-trivial:1")
+
+AOT_theorem "thm-null-trivial:4": \<open>\<^bold>\<iota>x TrivialSituation(x)\<down>\<close>
+  using "A-Exists:2" "RA[2]" "\<equiv>E"(2) "thm-null-trivial:2" by blast
+
+AOT_define TheNullSituation :: \<open>\<kappa>\<^sub>s\<close> (\<open>\<^bold>s\<^sub>\<emptyset>\<close>)
+  "df-the-null-sit:1": \<open>\<^bold>s\<^sub>\<emptyset> =\<^sub>d\<^sub>f \<^bold>\<iota>x NullSituation(x)\<close>
+
+AOT_define TheTrivialSituation :: \<open>\<kappa>\<^sub>s\<close> (\<open>\<^bold>s\<^sub>V\<close>)
+  "df-the-null-sit:2": \<open>\<^bold>s\<^sub>V =\<^sub>d\<^sub>f \<^bold>\<iota>x TrivialSituation(x)\<close>
+
+AOT_theorem "null-triv-sc:1": \<open>NullSituation(x) \<rightarrow> \<box>NullSituation(x)\<close>
+proof(safe intro!: "\<rightarrow>I" dest!: "df-null-trivial:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"];
+      frule "&E"(1); drule "&E"(2))
+  AOT_assume 1: \<open>\<not>\<exists>p (x \<Turnstile> p)\<close>
+  AOT_assume 0: \<open>Situation(x)\<close>
+  AOT_hence \<open>\<box>Situation(x)\<close> by (metis "\<equiv>E"(1) "possit-sit:1")
+  moreover AOT_have \<open>\<box>\<not>\<exists>p (x \<Turnstile> p)\<close>
+  proof(rule "raa-cor:1")
+    AOT_assume \<open>\<not>\<box>\<not>\<exists>p (x \<Turnstile> p)\<close>
+    AOT_hence \<open>\<diamond>\<exists>p (x \<Turnstile> p)\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fI" "conventions:5")
+    AOT_hence \<open>\<exists>p \<diamond>(x \<Turnstile> p)\<close> by (metis "BF\<diamond>" "\<rightarrow>E")
+    then AOT_obtain p where \<open>\<diamond>(x \<Turnstile> p)\<close> using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>x \<Turnstile> p\<close>
+      by (metis "\<equiv>E"(1) "lem2:2"[unconstrain s, THEN "\<rightarrow>E", OF 0])
+    AOT_hence \<open>\<exists>p x \<Turnstile> p\<close> using "\<exists>I" by fast
+    AOT_thus \<open>\<exists>p x \<Turnstile> p & \<not>\<exists>p x \<Turnstile> p\<close> using 1 "&I" by blast
+  qed
+  ultimately AOT_have 2: \<open>\<box>(Situation(x) & \<not>\<exists>p x \<Turnstile> p)\<close>
+    by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+  AOT_show \<open>\<box>NullSituation(x)\<close>
+    by (AOT_subst \<open>NullSituation(x)\<close> \<open>Situation(x) & \<not>\<exists>p x \<Turnstile> p\<close>)
+       (auto simp: "df-null-trivial:1" "\<equiv>Df" 2)
+qed
+
+
+AOT_theorem "null-triv-sc:2": \<open>TrivialSituation(x) \<rightarrow> \<box>TrivialSituation(x)\<close>
+proof(safe intro!: "\<rightarrow>I" dest!: "df-null-trivial:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"];
+      frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>Situation(x)\<close>
+  AOT_hence 1: \<open>\<box>Situation(x)\<close> by (metis "\<equiv>E"(1) "possit-sit:1")
+  AOT_assume \<open>\<forall>p x \<Turnstile> p\<close>
+  AOT_hence \<open>x \<Turnstile> p\<close> for p
+    using "\<forall>E" by blast
+  AOT_hence \<open>\<box>x \<Turnstile> p\<close> for p
+    using  0 "\<equiv>E"(1) "lem2:1"[unconstrain s, THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<forall>p \<box>x \<Turnstile> p\<close>
+    by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>p x \<Turnstile> p\<close>
+    by (rule BF[THEN "\<rightarrow>E"])
+  AOT_hence 2: \<open>\<box>(Situation(x) & \<forall>p x \<Turnstile> p)\<close>
+    using 1 by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+  AOT_show \<open>\<box>TrivialSituation(x)\<close>
+    by (AOT_subst \<open>TrivialSituation(x)\<close> \<open>Situation(x) & \<forall>p x \<Turnstile> p\<close>)
+       (auto simp: "df-null-trivial:2" "\<equiv>Df" 2)
+qed
+
+AOT_theorem "null-triv-sc:3": \<open>NullSituation(\<^bold>s\<^sub>\<emptyset>)\<close>
+  by (safe intro!: "df-the-null-sit:1"[THEN "=\<^sub>d\<^sub>fI"(2)] "thm-null-trivial:3"
+       "rule=I:1"[OF "thm-null-trivial:3"]
+       "!box-desc:2"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", rotated, OF "thm-null-trivial:1",
+                     OF "\<forall>I", OF "null-triv-sc:1", THEN "\<forall>E"(1), THEN "\<rightarrow>E"])
+
+AOT_theorem "null-triv-sc:4": \<open>TrivialSituation(\<^bold>s\<^sub>V)\<close>
+  by (safe intro!: "df-the-null-sit:2"[THEN "=\<^sub>d\<^sub>fI"(2)] "thm-null-trivial:4"
+       "rule=I:1"[OF "thm-null-trivial:4"]
+       "!box-desc:2"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", rotated, OF "thm-null-trivial:2",
+                     OF "\<forall>I", OF "null-triv-sc:2", THEN "\<forall>E"(1), THEN "\<rightarrow>E"])
+
+AOT_theorem "null-triv-facts:1": \<open>NullSituation(x) \<equiv> Null(x)\<close>
+proof (safe intro!: "\<equiv>I" "\<rightarrow>I" "df-null-uni:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                    "df-null-trivial:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+            dest!: "df-null-uni:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "df-null-trivial:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  AOT_assume 0: \<open>Situation(x) & \<not>\<exists>p x \<Turnstile> p\<close>
+  AOT_have 1: \<open>x[F] \<rightarrow> \<exists>p F = [\<lambda>y p]\<close> for F
+    using 0[THEN "&E"(1), THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2), THEN "\<forall>E"(2)]
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "deduction-theorem" "prop-prop1" "\<rightarrow>E")
+  AOT_show \<open>A!x & \<not>\<exists>F x[F]\<close>
+  proof (safe intro!: "&I" 0[THEN "&E"(1), THEN situations[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                             THEN "&E"(1)];
+         rule "raa-cor:2")
+    AOT_assume \<open>\<exists>F x[F]\<close>
+    then AOT_obtain F where F_prop: \<open>x[F]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>\<exists>p F = [\<lambda>y p]\<close>
+      using 1[THEN "\<rightarrow>E"] by blast
+    then AOT_obtain p where \<open>F = [\<lambda>y p]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>x[\<lambda>y p]\<close>
+      by (metis "rule=E" F_prop)
+    AOT_hence \<open>x \<Turnstile> p\<close>
+      using lem1[THEN "\<rightarrow>E", OF 0[THEN "&E"(1)], THEN "\<equiv>E"(2)] by blast
+    AOT_hence \<open>\<exists>p x \<Turnstile> p\<close>
+      by (rule "\<exists>I")
+    AOT_thus \<open>\<exists>p x \<Turnstile> p & \<not>\<exists>p x \<Turnstile> p\<close>
+      using 0[THEN "&E"(2)] "&I" by blast
+  qed
+next
+  AOT_assume 0: \<open>A!x & \<not>\<exists>F x[F]\<close>
+  AOT_have \<open>Situation(x)\<close>
+    apply (rule situations[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I", OF 0[THEN "&E"(1)]]; rule GEN)
+    using 0[THEN "&E"(2)] by (metis "\<rightarrow>I" "existential:2[const_var]" "raa-cor:3") 
+  moreover AOT_have \<open>\<not>\<exists>p x \<Turnstile> p\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<exists>p x \<Turnstile> p\<close>
+    then AOT_obtain p where \<open>x \<Turnstile> p\<close> by (metis "instantiation")
+    AOT_hence \<open>x[\<lambda>y p]\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc" "true-in-s")
+    AOT_hence \<open>\<exists>F x[F]\<close> by (rule "\<exists>I") "cqt:2[lambda]"
+    AOT_thus \<open>\<exists>F x[F] & \<not>\<exists>F x[F]\<close> using 0[THEN "&E"(2)] "&I" by blast
+  qed
+  ultimately AOT_show \<open>Situation(x) & \<not>\<exists>p x \<Turnstile> p\<close> using "&I" by blast
+qed
+
+AOT_theorem "null-triv-facts:2": \<open>\<^bold>s\<^sub>\<emptyset> = a\<^sub>\<emptyset>\<close>
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-the-null-sit:1"])
+   apply (fact "thm-null-trivial:3")
+  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "df-null-uni-terms:1"])
+   apply (fact "null-uni-uniq:3")
+  apply (rule "equiv-desc-eq:3"[THEN "\<rightarrow>E"])
+  apply (rule "&I")
+   apply (fact "thm-null-trivial:3")
+  by (rule RN; rule GEN; rule "null-triv-facts:1")
+
+AOT_theorem "null-triv-facts:3": \<open>\<^bold>s\<^sub>V \<noteq> a\<^sub>V\<close>
+proof(rule "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_have \<open>Universal(a\<^sub>V)\<close>
+    by (simp add: "null-uni-facts:4")
+  AOT_hence 0: \<open>a\<^sub>V[A!]\<close>
+    using "df-null-uni:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<forall>E"(1)
+    by (metis "cqt:5:a" "vdash-properties:10" "vdash-properties:1[2]")
+  moreover AOT_have 1: \<open>\<not>\<^bold>s\<^sub>V[A!]\<close>
+  proof(rule "raa-cor:2")
+    AOT_have \<open>Situation(\<^bold>s\<^sub>V)\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "df-null-trivial:2" "null-triv-sc:4" by blast
+    AOT_hence \<open>\<forall>F (\<^bold>s\<^sub>V[F] \<rightarrow> Propositional([F]))\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) situations)
+    moreover AOT_assume \<open>\<^bold>s\<^sub>V[A!]\<close>
+    ultimately AOT_have \<open>Propositional(A!)\<close>
+      using "\<forall>E"(1)[rotated, OF "oa-exist:2"] "\<rightarrow>E" by blast
+    AOT_thus \<open>Propositional(A!) & \<not>Propositional(A!)\<close>
+      using "prop-in-f:4:d" "&I" by blast
+  qed
+  AOT_show \<open>\<not>(\<^bold>s\<^sub>V = a\<^sub>V)\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<^bold>s\<^sub>V = a\<^sub>V\<close>
+    AOT_hence \<open>\<^bold>s\<^sub>V[A!]\<close> using 0 "rule=E" id_sym by fast
+    AOT_thus \<open>\<^bold>s\<^sub>V[A!] & \<not>\<^bold>s\<^sub>V[A!]\<close> using 1 "&I" by blast
+  qed
+qed
+
+definition ConditionOnPropositionalProperties :: \<open>(<\<kappa>> \<Rightarrow> \<o>) \<Rightarrow> bool\<close> where
+  "cond-prop": \<open>ConditionOnPropositionalProperties \<equiv> \<lambda> \<phi> . \<forall> v .
+                        [v \<Turnstile> \<forall>F (\<phi>{F} \<rightarrow> Propositional([F]))]\<close>
+
+syntax ConditionOnPropositionalProperties :: \<open>id_position \<Rightarrow> AOT_prop\<close>
+  ("CONDITION'_ON'_PROPOSITIONAL'_PROPERTIES'(_')")
+
+AOT_theorem "cond-prop[E]":
+  assumes \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  shows \<open>\<forall>F (\<phi>{F} \<rightarrow> Propositional([F]))\<close>
+  using assms[unfolded "cond-prop"] by auto
+
+AOT_theorem "cond-prop[I]":
+  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<forall>F (\<phi>{F} \<rightarrow> Propositional([F]))\<close>
+  shows \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  using assms "cond-prop" by metis
+
+AOT_theorem "pre-comp-sit":
+  assumes \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  shows \<open>(Situation(x) & \<forall>F (x[F] \<equiv> \<phi>{F})) \<equiv> (A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>Situation(x) & \<forall>F (x[F] \<equiv> \<phi>{F})\<close>
+  AOT_thus \<open>A!x & \<forall>F (x[F] \<equiv> \<phi>{F})\<close>
+    using "&E" situations[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&I" by blast
+next
+  AOT_assume 0: \<open>A!x & \<forall>F (x[F] \<equiv> \<phi>{F})\<close>
+  AOT_show \<open>Situation(x) & \<forall>F (x[F] \<equiv> \<phi>{F})\<close>
+  proof (safe intro!: situations[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I")
+    AOT_show \<open>A!x\<close> using 0[THEN "&E"(1)].
+  next
+    AOT_show \<open>\<forall>F (x[F] \<rightarrow> Propositional([F]))\<close>
+    proof(rule GEN; rule "\<rightarrow>I")
+      fix F
+      AOT_assume \<open>x[F]\<close>
+      AOT_hence \<open>\<phi>{F}\<close>
+        using 0[THEN "&E"(2)] "\<forall>E" "\<equiv>E" by blast
+      AOT_thus \<open>Propositional([F])\<close>
+        using "cond-prop[E]"[OF assms] "\<forall>E" "\<rightarrow>E" by blast
+    qed
+  next
+    AOT_show \<open>\<forall>F (x[F] \<equiv> \<phi>{F})\<close> using 0 "&E" by blast
+  qed
+qed
+
+AOT_theorem "comp-sit:1":
+  assumes \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  shows \<open>\<exists>s \<forall>F(s[F] \<equiv> \<phi>{F})\<close>
+  by (AOT_subst \<open>Situation(x) & \<forall>F(x[F] \<equiv> \<phi>{F})\<close> \<open>A!x & \<forall>F (x[F] \<equiv> \<phi>{F})\<close> for: x)
+     (auto simp: "pre-comp-sit"[OF assms] "A-objects"[where \<phi>=\<phi>, axiom_inst])
+
+AOT_theorem "comp-sit:2":
+  assumes \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  shows \<open>\<exists>!s \<forall>F(s[F] \<equiv> \<phi>{F})\<close>
+  by (AOT_subst \<open>Situation(x) & \<forall>F(x[F] \<equiv> \<phi>{F})\<close> \<open>A!x & \<forall>F (x[F] \<equiv> \<phi>{F})\<close> for: x)
+     (auto simp: assms "pre-comp-sit"  "pre-comp-sit"[OF assms] "A-objects!")
+
+AOT_theorem "can-sit-desc:1":
+  assumes \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  shows \<open>\<^bold>\<iota>s(\<forall>F (s[F] \<equiv> \<phi>{F}))\<down>\<close>
+  using "comp-sit:2"[OF assms] "A-Exists:2" "RA[2]" "\<equiv>E"(2) by blast
+
+AOT_theorem "can-sit-desc:2":
+  assumes \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+  shows \<open>\<^bold>\<iota>s(\<forall>F (s[F] \<equiv> \<phi>{F})) = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<phi>{F}))\<close>
+  by (auto intro!: "equiv-desc-eq:2"[THEN "\<rightarrow>E", OF "&I",
+                                     OF "can-sit-desc:1"[OF assms]]
+                   "RA[2]" GEN "pre-comp-sit"[OF assms])
+
+AOT_theorem "strict-sit":
+  assumes \<open>RIGID_CONDITION(\<phi>)\<close>
+      and \<open>CONDITION_ON_PROPOSITIONAL_PROPERTIES(\<phi>)\<close>
+    shows \<open>y = \<^bold>\<iota>s(\<forall>F (s[F] \<equiv> \<phi>{F})) \<rightarrow> \<forall>F (y[F] \<equiv> \<phi>{F})\<close>
+  using "rule=E"[rotated, OF "can-sit-desc:2"[OF assms(2), symmetric]]
+        "box-phi-a:2"[OF assms(1)] "\<rightarrow>E" "\<rightarrow>I" "&E" by fast
+
+(* TODO: exercise (479) sit-lit *)
+
+AOT_define actual :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Actual'(_')\<close>)
+  \<open>Actual(s) \<equiv>\<^sub>d\<^sub>f \<forall>p (s \<Turnstile> p \<rightarrow> p)\<close>
+
+AOT_theorem "act-and-not-pos": \<open>\<exists>s (Actual(s) & \<diamond>\<not>Actual(s))\<close>
+proof -
+  AOT_obtain q\<^sub>1 where q\<^sub>1_prop: \<open>q\<^sub>1 & \<diamond>\<not>q\<^sub>1\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "instantiation" "cont-tf:1" "cont-tf-thm:1")
+  AOT_have \<open>\<exists>s (\<forall>F (s[F] \<equiv> F = [\<lambda>y q\<^sub>1]))\<close>
+  proof (safe intro!: "comp-sit:1" "cond-prop[I]" GEN "\<rightarrow>I")
+    AOT_modally_strict {
+      AOT_show \<open>Propositional([F])\<close> if \<open>F = [\<lambda>y q\<^sub>1]\<close> for F
+        using "\<equiv>\<^sub>d\<^sub>fI" "existential:2[const_var]" "prop-prop1" that by fastforce
+    }
+  qed
+  then AOT_obtain s\<^sub>1 where s_prop: \<open>\<forall>F (s\<^sub>1[F] \<equiv> F = [\<lambda>y q\<^sub>1])\<close>
+    using "Situation.\<exists>E"[rotated] by meson
+  AOT_have \<open>Actual(s\<^sub>1)\<close>
+  proof(safe intro!: actual[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" GEN "\<rightarrow>I" s_prop Situation.\<psi>)
+    fix p
+    AOT_assume \<open>s\<^sub>1 \<Turnstile> p\<close>
+    AOT_hence \<open>s\<^sub>1[\<lambda>y p]\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) "prop-enc" "true-in-s")
+    AOT_hence \<open>[\<lambda>y p] = [\<lambda>y q\<^sub>1]\<close>
+      by (rule s_prop[THEN "\<forall>E"(1), THEN "\<equiv>E"(1), rotated]) "cqt:2[lambda]"
+    AOT_hence \<open>p = q\<^sub>1\<close> by (metis "\<equiv>E"(2) "p-identity-thm2:3")
+    AOT_thus \<open>p\<close> using q\<^sub>1_prop[THEN "&E"(1)] "rule=E" id_sym by fast
+  qed
+  moreover AOT_have \<open>\<diamond>\<not>Actual(s\<^sub>1)\<close>
+  proof(rule "raa-cor:1"; drule "KBasic:12"[THEN "\<equiv>E"(2)])
+    AOT_assume \<open>\<box>Actual(s\<^sub>1)\<close>
+    AOT_hence \<open>\<box>(Situation(s\<^sub>1) & \<forall>p (s\<^sub>1 \<Turnstile> p \<rightarrow> p))\<close>
+      using actual[THEN "\<equiv>Df", THEN "conventions:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                   THEN "&E"(1), THEN RM, THEN "\<rightarrow>E"] by blast
+    AOT_hence \<open>\<box>\<forall>p (s\<^sub>1 \<Turnstile> p \<rightarrow> p)\<close>
+      by (metis "RM:1" "Conjunction Simplification"(2) "\<rightarrow>E")
+    AOT_hence \<open>\<forall>p \<box>(s\<^sub>1 \<Turnstile> p \<rightarrow> p)\<close>
+      by (metis "CBF" "vdash-properties:10")
+    AOT_hence \<open>\<box>(s\<^sub>1 \<Turnstile> q\<^sub>1 \<rightarrow> q\<^sub>1)\<close>
+      using "\<forall>E" by blast
+    AOT_hence \<open>\<box>s\<^sub>1 \<Turnstile> q\<^sub>1 \<rightarrow> \<box>q\<^sub>1\<close>
+      by (metis "\<rightarrow>E" "qml:1" "vdash-properties:1[2]")
+    moreover AOT_have \<open>s\<^sub>1 \<Turnstile> q\<^sub>1\<close>
+      using s_prop[THEN "\<forall>E"(1), THEN "\<equiv>E"(2),
+                   THEN lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(2)]]
+            "rule=I:1" "prop-prop2:2" by blast
+    ultimately AOT_have \<open>\<box>q\<^sub>1\<close>
+      using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<equiv>E"(1) "lem2:1" "true-in-s" "\<rightarrow>E" by fast
+    AOT_thus \<open>\<diamond>\<not>q\<^sub>1 & \<not>\<diamond>\<not>q\<^sub>1\<close>
+      using "KBasic:12"[THEN "\<equiv>E"(1)] q\<^sub>1_prop[THEN "&E"(2)] "&I" by blast
+  qed
+  ultimately AOT_have \<open>(Actual(s\<^sub>1) & \<diamond>\<not>Actual(s\<^sub>1))\<close>
+    using s_prop "&I" by blast
+  thus ?thesis
+    by (rule "Situation.\<exists>I")
+qed
+
+AOT_theorem "actual-s:1": \<open>\<exists>s Actual(s)\<close>
+proof -
+  AOT_obtain s where \<open>(Actual(s) & \<diamond>\<not>Actual(s))\<close>
+    using "act-and-not-pos" "Situation.\<exists>E"[rotated] by meson
+  AOT_hence \<open>Actual(s)\<close> using "&E" "&I" by metis
+  thus ?thesis by (rule "Situation.\<exists>I")
+qed
+
+AOT_theorem "actual-s:2": \<open>\<exists>s \<not>Actual(s)\<close>
+proof(rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>\<^bold>s\<^sub>V\<guillemotright>\<close>]; (rule "&I")?)
+  AOT_show \<open>Situation(\<^bold>s\<^sub>V)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "df-null-trivial:2" "null-triv-sc:4" by blast
+next
+  AOT_show \<open>\<not>Actual(\<^bold>s\<^sub>V)\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume 0: \<open>Actual(\<^bold>s\<^sub>V)\<close>
+    AOT_obtain p\<^sub>1 where notp\<^sub>1: \<open>\<not>p\<^sub>1\<close>
+      by (metis "\<exists>E" "\<exists>I"(1) "log-prop-prop:2" "non-contradiction")
+    AOT_have \<open>\<^bold>s\<^sub>V \<Turnstile> p\<^sub>1\<close>
+      using "null-triv-sc:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-null-trivial:2"], THEN "&E"(2)]
+            "\<forall>E" by blast
+    AOT_hence \<open>p\<^sub>1\<close>
+      using 0[THEN actual[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+      by blast
+    AOT_thus \<open>p & \<not>p\<close> for p using notp\<^sub>1 by (metis "raa-cor:3")
+  qed
+next
+  AOT_show \<open>\<^bold>s\<^sub>V\<down>\<close>
+    using "df-the-null-sit:2" "rule-id-df:2:b[zero]" "thm-null-trivial:4" by blast
+qed
+
+AOT_theorem "actual-s:3": \<open>\<exists>p\<forall>s(Actual(s) \<rightarrow> \<not>s \<Turnstile> p)\<close>
+proof -
+  AOT_obtain p\<^sub>1 where notp\<^sub>1: \<open>\<not>p\<^sub>1\<close>
+    by (metis "\<exists>E" "\<exists>I"(1) "log-prop-prop:2" "non-contradiction")
+  AOT_have \<open>\<forall>s (Actual(s) \<rightarrow> \<not>(s \<Turnstile> p\<^sub>1))\<close>
+  proof (rule Situation.GEN; rule "\<rightarrow>I"; rule "raa-cor:2")
+    fix s
+    AOT_assume \<open>Actual(s)\<close>
+    moreover AOT_assume \<open>s \<Turnstile> p\<^sub>1\<close>
+    ultimately AOT_have \<open>p\<^sub>1\<close>
+      using actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+    AOT_thus \<open>p\<^sub>1 & \<not>p\<^sub>1\<close>
+      using notp\<^sub>1 "&I" by simp
+  qed
+  thus ?thesis by (rule "\<exists>I")
+qed
+
+AOT_theorem comp:
+  \<open>\<exists>s (s' \<unlhd> s & s'' \<unlhd> s & \<forall>s''' (s' \<unlhd> s''' & s'' \<unlhd> s''' \<rightarrow> s \<unlhd> s'''))\<close>
+proof -
+  have cond_prop: \<open>ConditionOnPropositionalProperties (\<lambda> \<Pi> . \<guillemotleft>s'[\<Pi>] \<or> s''[\<Pi>]\<guillemotright>)\<close>
+  proof(safe intro!: "cond-prop[I]" GEN "oth-class-taut:8:c"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"];
+        rule "\<rightarrow>I")
+    AOT_modally_strict {
+      fix F
+      AOT_have \<open>Situation(s')\<close>
+        by (simp add: Situation.restricted_var_condition)
+      AOT_hence \<open>s'[F] \<rightarrow> Propositional([F])\<close>
+        using "situations"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2)] by blast
+      moreover AOT_assume \<open>s'[F]\<close>
+      ultimately AOT_show \<open>Propositional([F])\<close>
+        using "\<rightarrow>E" by blast
+    }
+  next
+    AOT_modally_strict {
+      fix F
+      AOT_have \<open>Situation(s'')\<close>
+        by (simp add: Situation.restricted_var_condition)
+      AOT_hence \<open>s''[F] \<rightarrow> Propositional([F])\<close>
+        using "situations"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2)] by blast
+      moreover AOT_assume \<open>s''[F]\<close>
+      ultimately AOT_show \<open>Propositional([F])\<close>
+        using "\<rightarrow>E" by blast
+    }
+  qed
+  AOT_obtain s\<^sub>3 where \<theta>: \<open>\<forall>F (s\<^sub>3[F] \<equiv> s'[F] \<or> s''[F])\<close>
+    using "comp-sit:1"[OF cond_prop] "Situation.\<exists>E"[rotated] by meson
+  AOT_have \<open>s' \<unlhd> s\<^sub>3 & s'' \<unlhd> s\<^sub>3 & \<forall>s''' (s' \<unlhd> s''' & s'' \<unlhd> s''' \<rightarrow> s\<^sub>3 \<unlhd> s''')\<close>
+  proof(safe intro!: "&I" "\<equiv>\<^sub>d\<^sub>fI"[OF "true-in-s"] "\<equiv>\<^sub>d\<^sub>fI"[OF "prop-enc"]
+                     "Situation.GEN" "GEN"[where 'a=\<o>] "\<rightarrow>I"
+                     "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                     Situation.\<psi> "cqt:2[const_var]"[axiom_inst])
+    fix p
+    AOT_assume \<open>s' \<Turnstile> p\<close>
+    AOT_hence \<open>s'[\<lambda>x p]\<close>
+      by (metis "&E"(2) "prop-enc" "\<equiv>\<^sub>d\<^sub>fE" "true-in-s")
+    AOT_thus \<open>s\<^sub>3[\<lambda>x p]\<close>
+      using \<theta>[THEN "\<forall>E"(1),OF "prop-prop2:2", THEN "\<equiv>E"(2), OF "\<or>I"(1)] by blast
+  next
+    fix p
+    AOT_assume \<open>s'' \<Turnstile> p\<close>
+    AOT_hence \<open>s''[\<lambda>x p]\<close>
+      by (metis "&E"(2) "prop-enc" "\<equiv>\<^sub>d\<^sub>fE" "true-in-s")
+    AOT_thus \<open>s\<^sub>3[\<lambda>x p]\<close>
+      using \<theta>[THEN "\<forall>E"(1),OF "prop-prop2:2", THEN "\<equiv>E"(2), OF "\<or>I"(2)] by blast
+  next
+    fix s p
+    AOT_assume 0: \<open>s' \<unlhd> s & s'' \<unlhd> s\<close>
+    AOT_assume \<open>s\<^sub>3 \<Turnstile> p\<close>
+    AOT_hence \<open>s\<^sub>3[\<lambda>x p]\<close>
+      by (metis "&E"(2) "prop-enc" "\<equiv>\<^sub>d\<^sub>fE" "true-in-s")
+    AOT_hence \<open>s'[\<lambda>x p] \<or> s''[\<lambda>x p]\<close>
+      using \<theta>[THEN "\<forall>E"(1),OF "prop-prop2:2", THEN "\<equiv>E"(1)] by blast
+    moreover {
+      AOT_assume \<open>s'[\<lambda>x p]\<close>
+      AOT_hence \<open>s' \<Turnstile> p\<close>
+        by (safe intro!: "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                         Situation.\<psi> "cqt:2[const_var]"[axiom_inst])
+      moreover AOT_have \<open>s' \<Turnstile> p \<rightarrow> s \<Turnstile> p\<close>
+        using "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] 0[THEN "&E"(1)]
+              "\<forall>E"(2) by blast
+      ultimately AOT_have \<open>s \<Turnstile> p\<close>
+        using "\<rightarrow>E" by blast
+      AOT_hence \<open>s[\<lambda>x p]\<close>
+        using "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+    }
+    moreover {
+      AOT_assume \<open>s''[\<lambda>x p]\<close>
+      AOT_hence \<open>s'' \<Turnstile> p\<close>
+        by (safe intro!: "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
+                         Situation.\<psi> "cqt:2[const_var]"[axiom_inst])
+      moreover AOT_have \<open>s'' \<Turnstile> p \<rightarrow> s \<Turnstile> p\<close>
+        using "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] 0[THEN "&E"(2)]
+              "\<forall>E"(2) by blast
+      ultimately AOT_have \<open>s \<Turnstile> p\<close>
+        using "\<rightarrow>E" by blast
+      AOT_hence \<open>s[\<lambda>x p]\<close>
+        using "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+    }
+    ultimately AOT_show \<open>s[\<lambda>x p]\<close>
+      by (metis "\<or>E"(1) "\<rightarrow>I")
+  qed
+  thus ?thesis
+    using "Situation.\<exists>I" by fast
+qed
+
+AOT_theorem "act-sit:1": \<open>Actual(s) \<rightarrow> (s \<Turnstile> p \<rightarrow> [\<lambda>y p]s)\<close>
+proof (safe intro!: "\<rightarrow>I")
+  AOT_assume \<open>Actual(s)\<close>
+  AOT_hence p if \<open>s \<Turnstile> p\<close>
+    using actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] that by blast
+  moreover AOT_assume \<open>s \<Turnstile> p\<close>
+  ultimately AOT_have p by blast
+  AOT_thus \<open>[\<lambda>y p]s\<close>
+    by (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
+qed
+
+AOT_theorem "act-sit:2":
+  \<open>(Actual(s') & Actual(s'')) \<rightarrow> \<exists>x (Actual(x) & s' \<unlhd> x & s'' \<unlhd> x)\<close>
+proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume act_s': \<open>Actual(s')\<close>
+  AOT_assume act_s'': \<open>Actual(s'')\<close>
+  have "cond-prop": \<open>ConditionOnPropositionalProperties
+                     (\<lambda> \<Pi> . \<guillemotleft>\<exists>p (\<Pi> = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))\<guillemotright>)\<close>
+  proof (safe intro!: "cond-prop[I]"  "\<forall>I" "\<rightarrow>I" "prop-prop1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    AOT_modally_strict {
+      fix \<beta>
+      AOT_assume \<open>\<exists>p (\<beta> = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))\<close>
+      then AOT_obtain p where \<open>\<beta> = [\<lambda>y p]\<close> using "\<exists>E"[rotated] "&E" by blast
+      AOT_thus \<open>\<exists>p \<beta> = [\<lambda>y p]\<close> by (rule "\<exists>I")
+    }
+  qed
+  have rigid: \<open>rigid_condition (\<lambda> \<Pi> . \<guillemotleft>\<exists>p (\<Pi> = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))\<guillemotright>)\<close>
+  proof(safe intro!: "strict-can:1[I]" "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      fix F
+      AOT_assume \<open>\<exists>p (F = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))\<close>
+      then AOT_obtain p\<^sub>1 where p\<^sub>1_prop: \<open>F = [\<lambda>y p\<^sub>1] & (s' \<Turnstile> p\<^sub>1 \<or> s'' \<Turnstile> p\<^sub>1)\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence \<open>\<box>(F = [\<lambda>y p\<^sub>1])\<close>
+        using "&E"(1) "id-nec:2" "vdash-properties:10" by blast
+      moreover AOT_have \<open>\<box>(s' \<Turnstile> p\<^sub>1 \<or> s'' \<Turnstile> p\<^sub>1)\<close>
+      proof(rule "\<or>E"; (rule "\<rightarrow>I"; rule "KBasic:15"[THEN "\<rightarrow>E"])?)
+        AOT_show \<open>s' \<Turnstile> p\<^sub>1 \<or> s'' \<Turnstile> p\<^sub>1\<close> using p\<^sub>1_prop "&E" by blast
+      next
+        AOT_show \<open>\<box>s' \<Turnstile> p\<^sub>1 \<or> \<box>s'' \<Turnstile> p\<^sub>1\<close> if \<open>s' \<Turnstile> p\<^sub>1\<close>
+          apply (rule "\<or>I"(1))
+          using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<equiv>E"(1) "lem2:1" that "true-in-s" by blast
+      next
+        AOT_show \<open>\<box>s' \<Turnstile> p\<^sub>1 \<or> \<box>s'' \<Turnstile> p\<^sub>1\<close> if \<open>s'' \<Turnstile> p\<^sub>1\<close>
+          apply (rule "\<or>I"(2))
+          using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<equiv>E"(1) "lem2:1" that "true-in-s" by blast
+      qed
+      ultimately AOT_have \<open>\<box>(F = [\<lambda>y p\<^sub>1] & (s' \<Turnstile> p\<^sub>1 \<or> s'' \<Turnstile> p\<^sub>1))\<close>
+        by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+      AOT_hence \<open>\<exists>p \<box>(F = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))\<close> by (rule "\<exists>I")
+      AOT_thus \<open>\<box>\<exists>p (F = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))\<close>
+        using Buridan[THEN "\<rightarrow>E"] by fast
+    }
+  qed
+
+  AOT_have desc_den: \<open>\<^bold>\<iota>s(\<forall>F (s[F] \<equiv> \<exists>p (F = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))))\<down>\<close>
+    by (rule "can-sit-desc:1"[OF "cond-prop"])
+  AOT_obtain x\<^sub>0
+    where x\<^sub>0_prop1: \<open>x\<^sub>0 = \<^bold>\<iota>s(\<forall>F (s[F] \<equiv> \<exists>p (F = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p))))\<close>
+    by (metis (no_types, lifting) "\<exists>E" "rule=I:1" desc_den "\<exists>I"(1) id_sym)
+  AOT_hence x\<^sub>0_sit: \<open>Situation(x\<^sub>0)\<close>
+    using "actual-desc:3"[THEN "\<rightarrow>E"] "Act-Basic:2" "&E"(1) "\<equiv>E"(1)
+          "possit-sit:4" by blast
+
+  AOT_have 1: \<open>\<forall>F (x\<^sub>0[F] \<equiv> \<exists>p (F = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p)))\<close>
+    using "strict-sit"[OF rigid, OF "cond-prop", THEN "\<rightarrow>E", OF x\<^sub>0_prop1].
+  AOT_have 2: \<open>(x\<^sub>0 \<Turnstile> p) \<equiv> (s' \<Turnstile> p \<or> s'' \<Turnstile> p)\<close> for p
+  proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+    AOT_assume \<open>x\<^sub>0 \<Turnstile> p\<close>
+    AOT_hence \<open>x\<^sub>0[\<lambda>y p]\<close> using lem1[THEN "\<rightarrow>E", OF x\<^sub>0_sit, THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain q where \<open>[\<lambda>y p] = [\<lambda>y q] & (s' \<Turnstile> q \<or> s'' \<Turnstile> q)\<close>
+      using 1[THEN "\<forall>E"(1)[where \<tau>="\<guillemotleft>[\<lambda>y p]\<guillemotright>"], OF "prop-prop2:2", THEN "\<equiv>E"(1)]
+            "\<exists>E"[rotated] by blast
+    AOT_thus \<open>s' \<Turnstile> p \<or> s'' \<Turnstile> p\<close>
+      by (metis "rule=E" "&E"(1) "&E"(2) "\<or>I"(1) "\<or>I"(2)
+                "\<or>E"(1) "deduction-theorem" id_sym "\<equiv>E"(2) "p-identity-thm2:3")
+  next
+    AOT_assume \<open>s' \<Turnstile> p \<or> s'' \<Turnstile> p\<close>
+    AOT_hence \<open>[\<lambda>y p] = [\<lambda>y p] & (s' \<Turnstile> p \<or> s'' \<Turnstile> p)\<close>
+      by (metis "rule=I:1" "&I" "prop-prop2:2") 
+    AOT_hence \<open>\<exists>q ([\<lambda>y p] = [\<lambda>y q] & (s' \<Turnstile> q \<or> s'' \<Turnstile> q))\<close>
+      by (rule "\<exists>I")
+    AOT_hence \<open>x\<^sub>0[\<lambda>y p]\<close>
+      using 1[THEN "\<forall>E"(1), OF "prop-prop2:2", THEN "\<equiv>E"(2)] by blast
+    AOT_thus \<open>x\<^sub>0 \<Turnstile> p\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fI" "&I" "ex:1:a" "prop-enc" "rule-ui:2[const_var]"
+                x\<^sub>0_sit "true-in-s")
+  qed
+
+  AOT_have \<open>Actual(x\<^sub>0) & s' \<unlhd> x\<^sub>0 & s'' \<unlhd> x\<^sub>0\<close>
+  proof(safe intro!: "\<rightarrow>I" "&I" "\<exists>I"(1) actual[THEN "\<equiv>\<^sub>d\<^sub>fI"] x\<^sub>0_sit GEN
+                     "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+    fix p
+    AOT_assume \<open>x\<^sub>0 \<Turnstile> p\<close>
+    AOT_hence \<open>s' \<Turnstile> p \<or> s'' \<Turnstile> p\<close>
+      using 2 "\<equiv>E"(1) by metis
+    AOT_thus \<open>p\<close>
+      using act_s' act_s''
+            actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+      by (metis "\<or>E"(3) "reductio-aa:1")
+  next
+    AOT_show \<open>x\<^sub>0 \<Turnstile> p\<close> if \<open>s' \<Turnstile> p\<close> for p
+      using 2[THEN "\<equiv>E"(2), OF "\<or>I"(1), OF that].
+  next
+    AOT_show \<open>x\<^sub>0 \<Turnstile> p\<close> if \<open>s'' \<Turnstile> p\<close> for p
+      using 2[THEN "\<equiv>E"(2), OF "\<or>I"(2), OF that].
+  next
+    AOT_show \<open>Situation(s')\<close>
+      using act_s'[THEN actual[THEN "\<equiv>\<^sub>d\<^sub>fE"]] "&E" by blast
+  next
+    AOT_show \<open>Situation(s'')\<close>
+      using act_s''[THEN actual[THEN "\<equiv>\<^sub>d\<^sub>fE"]] "&E" by blast
+  qed
+  AOT_thus \<open>\<exists>x (Actual(x) & s' \<unlhd> x & s'' \<unlhd> x)\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_define Consistent :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Consistent'(_')\<close>)
+  cons: \<open>Consistent(s) \<equiv>\<^sub>d\<^sub>f \<not>\<exists>p (s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+
+AOT_theorem "sit-cons": \<open>Actual(s) \<rightarrow> Consistent(s)\<close>
+proof(safe intro!: "\<rightarrow>I" cons[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Situation.\<psi>
+            dest!: actual[THEN "\<equiv>\<^sub>d\<^sub>fE"]; frule "&E"(1); drule "&E"(2))
+  AOT_assume 0: \<open>\<forall>p (s \<Turnstile> p \<rightarrow> p)\<close>
+  AOT_show \<open>\<not>\<exists>p (s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<exists>p (s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+    then AOT_obtain p where \<open>s \<Turnstile> p & s \<Turnstile> \<not>p\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>p & \<not>p\<close>
+      using 0[THEN "\<forall>E"(1)[where \<tau>=\<open>\<guillemotleft>\<not>p\<guillemotright>\<close>, THEN "\<rightarrow>E"], OF "log-prop-prop:2"]
+            0[THEN "\<forall>E"(2)[where \<beta>=p], THEN "\<rightarrow>E"] "&E" "&I" by blast
+    AOT_thus \<open>p & \<not>p\<close> for p by (metis "raa-cor:1") 
+  qed
+qed
+
+AOT_theorem "cons-rigid:1": \<open>\<not>Consistent(s) \<equiv> \<box>\<not>Consistent(s)\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<not>Consistent(s)\<close>
+  AOT_hence \<open>\<exists>p (s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+    using cons[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I", OF Situation.\<psi>]
+    by (metis "raa-cor:3")
+  then AOT_obtain p where p_prop: \<open>s \<Turnstile> p & s \<Turnstile> \<not>p\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>s \<Turnstile> p\<close>
+    using "&E"(1) "\<equiv>E"(1) "lem2:1" by blast
+  moreover AOT_have \<open>\<box>s \<Turnstile> \<not>p\<close>
+    using p_prop "T\<diamond>" "&E" "\<equiv>E"(1)
+      "modus-tollens:1" "raa-cor:3" "lem2:3"[unvarify p]
+      "log-prop-prop:2" by metis
+  ultimately AOT_have \<open>\<box>(s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+    by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+  AOT_hence \<open>\<exists>p \<box>(s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+    by (rule "\<exists>I")
+  AOT_hence \<open>\<box>\<exists>p(s \<Turnstile> p & s \<Turnstile> \<not>p)\<close>
+    by (metis Buridan "vdash-properties:10") 
+  AOT_thus \<open>\<box>\<not>Consistent(s)\<close>
+    apply (rule "qml:1"[axiom_inst, THEN "\<rightarrow>E", THEN "\<rightarrow>E", rotated])
+    apply (rule RN)
+    using "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) cons "deduction-theorem" "raa-cor:3" by blast
+next
+  AOT_assume \<open>\<box>\<not>Consistent(s)\<close>
+  AOT_thus \<open>\<not>Consistent(s)\<close> using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by auto
+qed
+
+AOT_theorem "cons-rigid:2": \<open>\<diamond>Consistent(x) \<equiv> Consistent(x)\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<diamond>Consistent(x)\<close>
+  AOT_have \<open>\<diamond>(Situation(x) & \<not>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p))\<close>
+    apply (AOT_subst \<open>Situation(x) & \<not>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close> \<open>Consistent(x)\<close>)
+     using cons "\<equiv>E"(2) "Commutativity of \<equiv>" "\<equiv>Df" apply blast
+    by (simp add: 0)
+  AOT_hence \<open>\<diamond>Situation(x)\<close> and 1: \<open>\<diamond>\<not>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+    using "RM\<diamond>" "Conjunction Simplification"(1) "Conjunction Simplification"(2)
+          "modus-tollens:1" "raa-cor:3" by blast+
+  AOT_hence 2: \<open>Situation(x)\<close> by (metis "\<equiv>E"(1) "possit-sit:2")
+  AOT_have 3: \<open>\<not>\<box>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+    using 2 using 1 "KBasic:11" "\<equiv>E"(2) by blast
+  AOT_show \<open>Consistent(x)\<close>
+  proof (rule "raa-cor:1")
+    AOT_assume \<open>\<not>Consistent(x)\<close>
+    AOT_hence \<open>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+      using 0 "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" 2 "cons-rigid:1"[unconstrain s, THEN "\<rightarrow>E"]
+            "modus-tollens:1" "raa-cor:3" "\<equiv>E"(4) by meson
+    then AOT_obtain p where \<open>x \<Turnstile> p\<close> and 4: \<open>x \<Turnstile> \<not>p\<close>
+      using "\<exists>E"[rotated] "&E" by blast
+    AOT_hence \<open>\<box>x \<Turnstile> p\<close>
+      by (metis "2" "\<equiv>E"(1) "lem2:1"[unconstrain s, THEN "\<rightarrow>E"])
+    moreover AOT_have \<open>\<box>x \<Turnstile> \<not>p\<close>
+      using 4 "lem2:1"[unconstrain s, unvarify p, THEN "\<rightarrow>E"]
+      by (metis 2 "\<equiv>E"(1) "log-prop-prop:2")
+    ultimately AOT_have \<open>\<box>(x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+      by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
+    AOT_hence \<open>\<exists>p \<box>(x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+      by (metis "existential:1" "log-prop-prop:2")
+    AOT_hence \<open>\<box>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+      by (metis Buridan "vdash-properties:10")
+    AOT_thus \<open>p & \<not>p\<close> for p
+      using 3 "&I"  by (metis "raa-cor:3")
+  qed
+next
+  AOT_show \<open>\<diamond>Consistent(x)\<close> if \<open>Consistent(x)\<close>
+    using "T\<diamond>" that "vdash-properties:10" by blast
+qed
+
+AOT_define possible :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Possible'(_')\<close>)
+  pos: \<open>Possible(s) \<equiv>\<^sub>d\<^sub>f \<diamond>Actual(s)\<close>
+
+AOT_theorem "sit-pos:1": \<open>Actual(s) \<rightarrow> Possible(s)\<close>
+  apply(rule "\<rightarrow>I"; rule pos[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "&I")
+  apply (meson "\<equiv>\<^sub>d\<^sub>fE" actual "&E"(1))
+  using "T\<diamond>" "vdash-properties:10" by blast
+
+AOT_theorem "sit-pos:2": \<open>\<exists>p ((s \<Turnstile> p) & \<not>\<diamond>p) \<rightarrow> \<not>Possible(s)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>p ((s \<Turnstile> p) & \<not>\<diamond>p)\<close>
+  then AOT_obtain p where a: \<open>(s \<Turnstile> p) & \<not>\<diamond>p\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>(s \<Turnstile> p)\<close>
+    using "&E" by (metis "T\<diamond>" "\<equiv>E"(1) "lem2:3" "vdash-properties:10")
+  moreover AOT_have \<open>\<box>\<not>p\<close>
+    using a[THEN "&E"(2)] by (metis "KBasic2:1" "\<equiv>E"(2))
+  ultimately AOT_have \<open>\<box>(s \<Turnstile> p & \<not>p)\<close>
+    by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
+  AOT_hence \<open>\<exists>p \<box>(s \<Turnstile> p & \<not>p)\<close>
+    by (rule "\<exists>I")
+  AOT_hence 1: \<open>\<box>\<exists>q (s \<Turnstile> q & \<not>q)\<close>
+    by (metis Buridan "vdash-properties:10")
+  AOT_have \<open>\<box>\<not>\<forall>q (s \<Turnstile> q \<rightarrow> q)\<close>
+    apply (AOT_subst \<open>s \<Turnstile> q \<rightarrow> q\<close> \<open>\<not>(s \<Turnstile> q & \<not>q)\<close> for: q)
+     apply (simp add: "oth-class-taut:1:a")
+    apply (AOT_subst \<open>\<not>\<forall>q \<not>(s \<Turnstile> q & \<not>q)\<close> \<open>\<exists>q (s \<Turnstile> q & \<not>q)\<close>)
+    by (auto simp: "conventions:4" "df-rules-formulas[3]" "df-rules-formulas[4]" "\<equiv>I" 1)
+  AOT_hence 0: \<open>\<not>\<diamond>\<forall>q (s \<Turnstile> q \<rightarrow> q)\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "raa-cor:3")
+  AOT_show \<open>\<not>Possible(s)\<close>
+    apply (AOT_subst \<open>Possible(s)\<close> \<open>Situation(s) & \<diamond>Actual(s)\<close>)
+     apply (simp add: pos "\<equiv>Df")
+    apply (AOT_subst \<open>Actual(s)\<close> \<open>Situation(s) & \<forall>q (s \<Turnstile> q \<rightarrow> q)\<close>)
+     using actual "\<equiv>Df" apply presburger
+    by (metis "0" "KBasic2:3" "&E"(2) "raa-cor:3" "vdash-properties:10")
+qed
+
+AOT_theorem "pos-cons-sit:1": \<open>Possible(s) \<rightarrow> Consistent(s)\<close>
+  by (auto simp: "sit-cons"[THEN "RM\<diamond>", THEN "\<rightarrow>E",
+                            THEN "cons-rigid:2"[THEN "\<equiv>E"(1)]]
+           intro!: "\<rightarrow>I" dest!: pos[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2))
+
+AOT_theorem "pos-cons-sit:2": \<open>\<exists>s (Consistent(s) & \<not>Possible(s))\<close>
+proof -
+  AOT_obtain q\<^sub>1 where \<open>q\<^sub>1 & \<diamond>\<not>q\<^sub>1\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "instantiation" "cont-tf:1" "cont-tf-thm:1" by blast
+  have "cond-prop": \<open>ConditionOnPropositionalProperties
+                      (\<lambda> \<Pi> . \<guillemotleft>\<Pi> = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]\<guillemotright>)\<close>
+    by (auto intro!: "cond-prop[I]" GEN "\<rightarrow>I" "prop-prop1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                     "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>q\<^sub>1 & \<not>q\<^sub>1\<guillemotright>\<close>, rotated, OF "log-prop-prop:2"])
+  have rigid: \<open>rigid_condition (\<lambda> \<Pi> . \<guillemotleft>\<Pi> = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]\<guillemotright>)\<close>
+    by (auto intro!: "strict-can:1[I]" GEN "\<rightarrow>I" simp: "id-nec:2"[THEN "\<rightarrow>E"])
+
+  AOT_obtain x where x_prop: \<open>x = \<^bold>\<iota>s (\<forall>F (s[F] \<equiv> F = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]))\<close>
+    using "ex:1:b"[THEN "\<forall>E"(1), OF "can-sit-desc:1", OF "cond-prop"]
+          "\<exists>E"[rotated] by blast    
+  AOT_hence 0: \<open>\<^bold>\<A>(Situation(x) & \<forall>F (x[F] \<equiv> F = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]))\<close>
+    using "\<rightarrow>E" "actual-desc:2" by blast
+  AOT_hence \<open>\<^bold>\<A>(Situation(x))\<close> by (metis "Act-Basic:2" "&E"(1) "\<equiv>E"(1))
+  AOT_hence s_sit: \<open>Situation(x)\<close> by (metis "\<equiv>E"(1) "possit-sit:4")
+  AOT_have s_enc_prop: \<open>\<forall>F (x[F] \<equiv> F = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1])\<close>
+    using "strict-sit"[OF rigid, OF "cond-prop", THEN "\<rightarrow>E", OF x_prop].
+  AOT_hence \<open>x[\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]\<close>
+    using "\<forall>E"(1)[rotated, OF "prop-prop2:2"]
+          "rule=I:1"[OF "prop-prop2:2"] "\<equiv>E" by blast
+  AOT_hence \<open>x \<Turnstile> (q\<^sub>1 & \<not>q\<^sub>1)\<close>
+    using lem1[THEN "\<rightarrow>E", OF s_sit, unvarify p, THEN "\<equiv>E"(2), OF "log-prop-prop:2"]
+    by blast
+  AOT_hence \<open>\<box>(x \<Turnstile> (q\<^sub>1 & \<not>q\<^sub>1))\<close>
+    using "lem2:1"[unconstrain s, THEN "\<rightarrow>E", OF s_sit, unvarify p,
+                   OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+  moreover AOT_have \<open>\<box>(x \<Turnstile> (q\<^sub>1 & \<not>q\<^sub>1) \<rightarrow> \<not>Actual(x))\<close>
+  proof(rule RN; rule "\<rightarrow>I"; rule "raa-cor:2")
+    AOT_modally_strict {
+      AOT_assume \<open>Actual(x)\<close>
+      AOT_hence \<open>\<forall>p (x \<Turnstile> p \<rightarrow> p)\<close>
+        using actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast
+      moreover AOT_assume \<open>x \<Turnstile> (q\<^sub>1 & \<not>q\<^sub>1)\<close>
+      ultimately AOT_show \<open>q\<^sub>1 & \<not>q\<^sub>1\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] "\<rightarrow>E" by metis
+    }
+  qed
+  ultimately AOT_have nec_not_actual_s: \<open>\<box>\<not>Actual(x)\<close>
+    using "qml:1"[axiom_inst, THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
+  AOT_have 1: \<open>\<not>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+  proof (rule "raa-cor:2")
+    AOT_assume \<open>\<exists>p (x \<Turnstile> p & x \<Turnstile> \<not>p)\<close>
+    then AOT_obtain p where \<open>x \<Turnstile> p & x \<Turnstile> \<not>p\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>x[\<lambda>y p] & x[\<lambda>y \<not>p]\<close>
+      using lem1[unvarify p, THEN "\<rightarrow>E", OF "log-prop-prop:2",
+                 OF s_sit, THEN "\<equiv>E"(1)] "&I" "&E" by metis
+    AOT_hence \<open>[\<lambda>y p] = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]\<close> and \<open>[\<lambda>y \<not>p] = [\<lambda>y q\<^sub>1 & \<not>q\<^sub>1]\<close>
+      by (auto intro!: "prop-prop2:2" s_enc_prop[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)]
+               elim: "&E")
+    AOT_hence i: \<open>[\<lambda>y p] = [\<lambda>y \<not>p]\<close> by (metis "rule=E" id_sym)
+    {
+      AOT_assume 0: \<open>p\<close>
+      AOT_have \<open>[\<lambda>y p]x\<close> for x
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" 0)
+      AOT_hence \<open>[\<lambda>y \<not>p]x\<close> for x using i "rule=E" by fast
+      AOT_hence \<open>\<not>p\<close>
+        using "\<beta>\<rightarrow>C"(1) by auto
+    }
+    moreover {
+      AOT_assume 0: \<open>\<not>p\<close>
+      AOT_have \<open>[\<lambda>y \<not>p]x\<close> for x
+        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" 0)
+      AOT_hence \<open>[\<lambda>y p]x\<close> for x using i[symmetric] "rule=E" by fast
+      AOT_hence \<open>p\<close>
+        using "\<beta>\<rightarrow>C"(1) by auto
+    }
+    ultimately AOT_show \<open>p & \<not>p\<close> for p by (metis "raa-cor:1" "raa-cor:3")
+  qed
+  AOT_have 2: \<open>\<not>Possible(x)\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>Possible(x)\<close>
+    AOT_hence \<open>\<diamond>Actual(x)\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) pos)
+    moreover AOT_have \<open>\<not>\<diamond>Actual(x)\<close> using nec_not_actual_s
+      using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "reductio-aa:2" by blast
+    ultimately AOT_show \<open>\<diamond>Actual(x) & \<not>\<diamond>Actual(x)\<close> by (rule "&I")
+  qed
+  show ?thesis
+    by(rule "\<exists>I"(2)[where \<beta>=x]; safe intro!: "&I" 2 s_sit cons[THEN "\<equiv>\<^sub>d\<^sub>fI"] 1)
+qed
+
+AOT_theorem "sit-classical:1": \<open>\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> \<forall>q(s \<Turnstile> \<not>q \<equiv> \<not>s \<Turnstile> q)\<close>
+proof(rule "\<rightarrow>I"; rule GEN)
+  fix q
+  AOT_assume \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<open>s \<Turnstile> q \<equiv> q\<close> and \<open>s \<Turnstile> \<not>q \<equiv> \<not>q\<close>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+  AOT_thus \<open>s \<Turnstile> \<not>q \<equiv> \<not>s \<Turnstile> q\<close>
+    by (metis "deduction-theorem" "\<equiv>I" "\<equiv>E"(1) "\<equiv>E"(2) "\<equiv>E"(4))
+qed
+
+AOT_theorem "sit-classical:2":
+  \<open>\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> \<forall>q\<forall>r((s \<Turnstile> (q \<rightarrow> r)) \<equiv> (s \<Turnstile> q \<rightarrow> s \<Turnstile> r))\<close>
+proof(rule "\<rightarrow>I"; rule GEN; rule GEN)
+  fix q r
+  AOT_assume \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<theta>: \<open>s \<Turnstile> q \<equiv> q\<close> and \<xi>: \<open>s \<Turnstile> r \<equiv> r\<close> and \<zeta>: \<open>(s \<Turnstile> (q \<rightarrow> r)) \<equiv> (q \<rightarrow> r)\<close>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+  AOT_show \<open>(s \<Turnstile> (q \<rightarrow> r)) \<equiv> (s \<Turnstile> q \<rightarrow> s \<Turnstile> r)\<close>
+  proof (safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>s \<Turnstile> (q \<rightarrow> r)\<close>
+    moreover AOT_assume \<open>s \<Turnstile> q\<close>
+    ultimately AOT_show \<open>s \<Turnstile> r\<close>
+      using \<theta> \<xi> \<zeta> by (metis "\<equiv>E"(1) "\<equiv>E"(2) "vdash-properties:10")
+  next
+    AOT_assume \<open>s \<Turnstile> q \<rightarrow> s \<Turnstile> r\<close>
+    AOT_thus \<open>s \<Turnstile> (q \<rightarrow> r)\<close>
+      using \<theta> \<xi> \<zeta> by (metis "deduction-theorem" "\<equiv>E"(1) "\<equiv>E"(2) "\<rightarrow>E") 
+  qed
+qed
+
+AOT_theorem "sit-classical:3":
+  \<open>\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> ((s \<Turnstile> \<forall>\<alpha> \<phi>{\<alpha>}) \<equiv> \<forall>\<alpha> s \<Turnstile> \<phi>{\<alpha>})\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<theta>: \<open>s \<Turnstile> \<phi>{\<alpha>} \<equiv> \<phi>{\<alpha>}\<close> and \<xi>: \<open>s \<Turnstile> \<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<forall>\<alpha> \<phi>{\<alpha>}\<close> for \<alpha>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+  AOT_show \<open>s \<Turnstile> \<forall>\<alpha> \<phi>{\<alpha>} \<equiv> \<forall>\<alpha> s \<Turnstile> \<phi>{\<alpha>}\<close>
+  proof (safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+    fix \<alpha>
+    AOT_assume \<open>s \<Turnstile> \<forall>\<alpha> \<phi>{\<alpha>}\<close>
+    AOT_hence \<open>\<phi>{\<alpha>}\<close> using \<xi> "\<forall>E"(2) "\<equiv>E"(1) by blast
+    AOT_thus \<open>s \<Turnstile> \<phi>{\<alpha>}\<close> using \<theta> "\<equiv>E"(2) by blast
+  next
+    AOT_assume \<open>\<forall>\<alpha> s \<Turnstile> \<phi>{\<alpha>}\<close>
+    AOT_hence \<open>s \<Turnstile> \<phi>{\<alpha>}\<close> for \<alpha> using "\<forall>E"(2) by blast
+    AOT_hence \<open>\<phi>{\<alpha>}\<close> for \<alpha> using \<theta> "\<equiv>E"(1) by blast
+    AOT_hence \<open>\<forall>\<alpha> \<phi>{\<alpha>}\<close> by (rule GEN)
+    AOT_thus \<open>s \<Turnstile> \<forall>\<alpha> \<phi>{\<alpha>}\<close> using \<xi> "\<equiv>E"(2) by blast
+  qed
+qed
+
+AOT_theorem "sit-classical:4": \<open>\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> \<forall>q (s \<Turnstile> \<box>q \<rightarrow> \<box>s \<Turnstile> q)\<close>
+proof(rule "\<rightarrow>I"; rule GEN; rule "\<rightarrow>I")
+  fix q
+  AOT_assume \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<theta>: \<open>s \<Turnstile> q \<equiv> q\<close> and \<xi>: \<open>s \<Turnstile> \<box>q \<equiv> \<box>q\<close>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+  AOT_assume \<open>s \<Turnstile> \<box>q\<close>
+  AOT_hence \<open>\<box>q\<close> using \<xi> "\<equiv>E"(1) by blast
+  AOT_hence \<open>q\<close> using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>s \<Turnstile> q\<close> using \<theta> "\<equiv>E"(2) by blast
+  AOT_thus \<open>\<box>s \<Turnstile> q\<close> using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<equiv>E"(1) "lem2:1" "true-in-s" by blast
+qed
+
+AOT_theorem "sit-classical:5":
+  \<open>\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> \<exists>q(\<box>(s \<Turnstile> q) & \<not>(s \<Turnstile> \<box> q))\<close>
+proof (rule "\<rightarrow>I")
+  AOT_obtain r where A: \<open>r\<close> and \<open>\<diamond>\<not>r\<close>
+    by (metis "&E"(1) "&E"(2) "\<equiv>\<^sub>d\<^sub>fE" "instantiation" "cont-tf:1" "cont-tf-thm:1")
+  AOT_hence B: \<open>\<not>\<box>r\<close>
+    using "KBasic:11" "\<equiv>E"(2) by blast
+  moreover AOT_assume asm: \<open>\<forall> p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<open>s \<Turnstile> r\<close>
+    using "\<forall>E"(2) A "\<equiv>E"(2) by blast
+  AOT_hence 1: \<open>\<box>s \<Turnstile> r\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "\<equiv>E"(1) "lem2:1" "true-in-s" by blast
+  AOT_have \<open>s \<Turnstile> \<not>\<box>r\<close>
+    using asm[THEN "\<forall>E"(1)[rotated, OF "log-prop-prop:2"], THEN "\<equiv>E"(2)] B by blast
+  AOT_hence \<open>\<not>s \<Turnstile> \<box>r\<close>
+    using "sit-classical:1"[THEN "\<rightarrow>E", OF asm,
+              THEN "\<forall>E"(1)[rotated, OF "log-prop-prop:2"], THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<box>s \<Turnstile> r & \<not>s \<Turnstile> \<box>r\<close>
+    using 1 "&I" by blast
+  AOT_thus \<open>\<exists>r (\<box>s \<Turnstile> r & \<not>s \<Turnstile> \<box>r)\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_theorem "sit-classical:6":
+  \<open>\<exists>s \<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+proof -
+  have "cond-prop": \<open>ConditionOnPropositionalProperties
+                        (\<lambda> \<Pi> . \<guillemotleft>\<exists>q (q & \<Pi> = [\<lambda>y q])\<guillemotright>)\<close>
+  proof (safe intro!: "cond-prop[I]" GEN "\<rightarrow>I")
+    fix F
+    AOT_modally_strict {
+      AOT_assume \<open>\<exists>q (q & F = [\<lambda>y q])\<close>
+      then AOT_obtain q where \<open>q & F = [\<lambda>y q]\<close>
+        using "\<exists>E"[rotated] by blast
+      AOT_hence \<open>F = [\<lambda>y q]\<close>
+        using "&E" by blast
+      AOT_hence \<open>\<exists>q F = [\<lambda>y q]\<close>
+        by (rule "\<exists>I")
+      AOT_thus \<open>Propositional([F])\<close>
+        by (metis "\<equiv>\<^sub>d\<^sub>fI" "prop-prop1")
+    }
+  qed
+  AOT_have \<open>\<exists>s \<forall>F (s[F] \<equiv> \<exists>q (q & F = [\<lambda>y q]))\<close>
+    using "comp-sit:1"[OF "cond-prop"].
+  then AOT_obtain s\<^sub>0 where s\<^sub>0_prop: \<open>\<forall>F (s\<^sub>0[F] \<equiv> \<exists>q (q & F = [\<lambda>y q]))\<close>
+    using "Situation.\<exists>E"[rotated] by meson
+  AOT_have \<open>\<forall>p (s\<^sub>0 \<Turnstile> p \<equiv> p)\<close>
+  proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I")
+    fix p
+    AOT_assume \<open>s\<^sub>0 \<Turnstile> p\<close>
+    AOT_hence \<open>s\<^sub>0[\<lambda>y p]\<close>
+      using lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      using s\<^sub>0_prop[THEN "\<forall>E"(1)[rotated, OF "prop-prop2:2"], THEN "\<equiv>E"(1)] by blast
+    then AOT_obtain q\<^sub>1 where q\<^sub>1_prop: \<open>q\<^sub>1 & [\<lambda>y p] = [\<lambda>y q\<^sub>1]\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence \<open>p = q\<^sub>1\<close>
+      by (metis "&E"(2) "\<equiv>E"(2) "p-identity-thm2:3")
+    AOT_thus \<open>p\<close>
+      using q\<^sub>1_prop[THEN "&E"(1)] "rule=E" id_sym by fast
+  next
+    fix p
+    AOT_assume \<open>p\<close>
+    moreover AOT_have \<open>[\<lambda>y p] = [\<lambda>y p]\<close>
+      by (simp add: "rule=I:1"[OF "prop-prop2:2"])
+    ultimately AOT_have \<open>p & [\<lambda>y p] = [\<lambda>y p]\<close>
+      using "&I" by blast
+    AOT_hence \<open>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      by (rule "\<exists>I")
+    AOT_hence \<open>s\<^sub>0[\<lambda>y p]\<close>
+      using s\<^sub>0_prop[THEN "\<forall>E"(1)[rotated, OF "prop-prop2:2"], THEN "\<equiv>E"(2)] by blast
+    AOT_thus \<open>s\<^sub>0 \<Turnstile> p\<close>
+      using lem1[THEN "\<rightarrow>E", OF Situation.\<psi>, THEN "\<equiv>E"(2)] by blast
+  qed
+  AOT_hence \<open>\<forall>p (s\<^sub>0 \<Turnstile> p \<equiv> p)\<close>
+    using "&I" by blast
+  AOT_thus \<open>\<exists>s \<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    by (rule "Situation.\<exists>I")
+qed
+
+AOT_define PossibleWorld :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>PossibleWorld'(_')\<close>)
+  "world:1": \<open>PossibleWorld(x) \<equiv>\<^sub>d\<^sub>f Situation(x) & \<diamond>\<forall>p(x \<Turnstile> p \<equiv> p)\<close>
+
+AOT_theorem "world:2": \<open>\<exists>x PossibleWorld(x)\<close>
+proof -
+  AOT_obtain s where s_prop: \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    using "sit-classical:6" "Situation.\<exists>E"[rotated] by meson
+  AOT_have \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+  proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I")
+    fix p
+    AOT_assume \<open>s \<Turnstile> p\<close>
+    AOT_thus \<open>p\<close>
+      using s_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+  next
+    fix p
+    AOT_assume \<open>p\<close>
+    AOT_thus \<open>s \<Turnstile> p\<close>
+      using s_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by blast
+  qed
+  AOT_hence \<open>\<diamond>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    by (metis "T\<diamond>"[THEN "\<rightarrow>E"])
+  AOT_hence \<open>\<diamond>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    using s_prop "&I" by blast
+  AOT_hence \<open>PossibleWorld(s)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] Situation.\<psi> "&I" by blast
+  AOT_thus \<open>\<exists>x PossibleWorld(x)\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_theorem "world:3": \<open>PossibleWorld(\<kappa>) \<rightarrow> \<kappa>\<down>\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>PossibleWorld(\<kappa>)\<close>
+  AOT_hence \<open>Situation(\<kappa>)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_hence \<open>A!\<kappa>\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) situations)
+  AOT_thus \<open>\<kappa>\<down>\<close>
+    by (metis "russell-axiom[exe,1].\<psi>_denotes_asm")
+qed
+
+AOT_theorem "rigid-pw:1": \<open>PossibleWorld(x) \<equiv> \<box>PossibleWorld(x)\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>PossibleWorld(x)\<close>
+  AOT_hence \<open>Situation(x) & \<diamond>\<forall>p(x \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence \<open>\<box>Situation(x) & \<box>\<diamond>\<forall>p(x \<Turnstile> p \<equiv> p)\<close>
+    by (metis "S5Basic:1" "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "possit-sit:1")
+  AOT_hence 0: \<open>\<box>(Situation(x) & \<diamond>\<forall>p(x \<Turnstile> p \<equiv> p))\<close>
+    by (metis "KBasic:3" "\<equiv>E"(2))
+  AOT_show \<open>\<box>PossibleWorld(x)\<close>
+    by (AOT_subst \<open>PossibleWorld(x)\<close> \<open>Situation(x) & \<diamond>\<forall>p(x \<Turnstile> p \<equiv> p)\<close>)
+       (auto simp: "\<equiv>Df" "world:1" 0)
+next
+  AOT_show \<open>PossibleWorld(x)\<close> if \<open>\<box>PossibleWorld(x)\<close>
+    using that "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "rigid-pw:2": \<open>\<diamond>PossibleWorld(x) \<equiv> PossibleWorld(x)\<close>
+  using "rigid-pw:1"
+  by (meson "RE\<diamond>" "S5Basic:2" "\<equiv>E"(2) "\<equiv>E"(6) "Commutativity of \<equiv>")
+
+AOT_theorem "rigid-pw:3": \<open>\<diamond>PossibleWorld(x) \<equiv> \<box>PossibleWorld(x)\<close>
+  using "rigid-pw:1" "rigid-pw:2" by (meson "\<equiv>E"(5))
+
+AOT_theorem "rigid-pw:4": \<open>\<^bold>\<A>PossibleWorld(x) \<equiv> PossibleWorld(x)\<close>
+  by (metis "Act-Sub:3" "\<rightarrow>I" "\<equiv>I" "\<equiv>E"(6) "nec-imp-act" "rigid-pw:1" "rigid-pw:2")
+
+AOT_register_rigid_restricted_type
+  PossibleWorld: \<open>PossibleWorld(\<kappa>)\<close>
+proof
+  AOT_modally_strict {
+    AOT_show \<open>\<exists>x PossibleWorld(x)\<close> using "world:2".
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>PossibleWorld(\<kappa>) \<rightarrow> \<kappa>\<down>\<close> for \<kappa> using "world:3".
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>\<forall>\<alpha>(PossibleWorld(\<alpha>) \<rightarrow> \<box>PossibleWorld(\<alpha>))\<close>
+      by (meson GEN "\<rightarrow>I" "\<equiv>E"(1) "rigid-pw:1")
+  }
+qed
+AOT_register_variable_names
+  PossibleWorld: w
+
+AOT_theorem "world-pos": \<open>Possible(w)\<close>
+proof (safe intro!: "\<equiv>\<^sub>d\<^sub>fE"[OF "world:1", OF PossibleWorld.\<psi>, THEN "&E"(1)]
+                    pos[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" )
+  AOT_have \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>, THEN "&E"(2)].
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<rightarrow> p)\<close>
+  proof (rule "RM\<diamond>"[THEN "\<rightarrow>E", rotated]; safe intro!: "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      fix p
+      AOT_assume \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> p \<equiv> p\<close> using "\<forall>E"(2) by blast
+      moreover AOT_assume \<open>w \<Turnstile> p\<close>
+      ultimately AOT_show p using "\<equiv>E"(1) by blast
+    }
+  qed
+  AOT_hence 0: \<open>\<diamond>(Situation(w) & \<forall>p (w \<Turnstile> p \<rightarrow> p))\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>, THEN "&E"(1),
+                    THEN "possit-sit:1"[THEN "\<equiv>E"(1)]]
+    by (metis "KBasic:16" "&I" "vdash-properties:10")
+  AOT_show \<open>\<diamond>Actual(w)\<close>
+    by (AOT_subst \<open>Actual(w)\<close> \<open>Situation(w) & \<forall>p (w \<Turnstile> p \<rightarrow> p)\<close>)
+       (auto simp: actual "\<equiv>Df" 0)
+qed
+
+AOT_theorem "world-cons:1": \<open>Consistent(w)\<close>
+  using "world-pos"
+  using "pos-cons-sit:1"[unconstrain s, THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
+  by (meson "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) pos)
+
+AOT_theorem "world-cons:2": \<open>\<not>TrivialSituation(w)\<close>
+proof(rule "raa-cor:2")
+  AOT_assume \<open>TrivialSituation(w)\<close>
+  AOT_hence \<open>Situation(w) & \<forall>p w \<Turnstile> p\<close>
+    using "df-null-trivial:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (\<exists>p (p & \<not>p))\<close>
+    using "&E"
+    by (metis "Buridan\<diamond>" "T\<diamond>" "&E"(2) "\<equiv>E"(1) "lem2:3"[unconstrain s, THEN "\<rightarrow>E"]
+              "log-prop-prop:2" "rule-ui:1" "universal-cor" "\<rightarrow>E")
+  AOT_have \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using PossibleWorld.\<psi> "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by metis
+  AOT_hence \<open>\<forall>p \<diamond>(w \<Turnstile> p \<equiv> p)\<close>
+    using "Buridan\<diamond>"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (\<exists>p (p & \<not>p)) \<equiv> (\<exists>p (p & \<not>p)))\<close>
+    by (metis "log-prop-prop:2" "rule-ui:1")
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (\<exists>p (p & \<not>p)) \<rightarrow> (\<exists>p (p & \<not>p)))\<close>
+    using "RM\<diamond>"[THEN "\<rightarrow>E"] "\<rightarrow>I" "\<equiv>E"(1) by meson
+  AOT_hence \<open>\<diamond>(\<exists>p (p & \<not>p))\<close> using 0
+    by (metis "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  moreover AOT_have \<open>\<not>\<diamond>(\<exists>p (p & \<not>p))\<close>
+    by (metis "instantiation" "KBasic2:1" RN "\<equiv>E"(1) "raa-cor:2")
+  ultimately AOT_show \<open>\<diamond>(\<exists>p (p & \<not>p)) & \<not>\<diamond>(\<exists>p (p & \<not>p))\<close>
+    using "&I" by blast
+qed
+
+AOT_theorem "rigid-truth-at:1": \<open>w \<Turnstile> p \<equiv> \<box>w \<Turnstile> p\<close>
+  using "lem2:1"[unconstrain s, THEN "\<rightarrow>E",
+                 OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)]].
+
+AOT_theorem "rigid-truth-at:2": \<open>\<diamond>w \<Turnstile> p \<equiv> w \<Turnstile> p\<close>
+  using "lem2:2"[unconstrain s, THEN "\<rightarrow>E",
+                 OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)]].
+
+AOT_theorem "rigid-truth-at:3": \<open>\<diamond>w \<Turnstile> p \<equiv> \<box>w \<Turnstile> p\<close>
+  using "lem2:3"[unconstrain s, THEN "\<rightarrow>E",
+                 OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)]].
+
+AOT_theorem "rigid-truth-at:4": \<open>\<^bold>\<A>w \<Turnstile> p \<equiv> w \<Turnstile> p\<close>
+  using "lem2:4"[unconstrain s, THEN "\<rightarrow>E",
+                 OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)]].
+
+AOT_theorem "rigid-truth-at:5": \<open>\<not>w \<Turnstile> p \<equiv> \<box>\<not>w \<Turnstile> p\<close>
+  using "lem2:5"[unconstrain s, THEN "\<rightarrow>E",
+                 OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)]].
+
+AOT_define Maximal :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Maximal'(_')\<close>)
+  max: \<open>Maximal(s) \<equiv>\<^sub>d\<^sub>f \<forall>p (s \<Turnstile> p \<or> s \<Turnstile> \<not>p)\<close>
+
+AOT_theorem "world-max": \<open>Maximal(w)\<close>
+proof(safe intro!: PossibleWorld.\<psi>[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "world:1"], THEN "&E"(1)]
+                   GEN "\<equiv>\<^sub>d\<^sub>fI"[OF max] "&I" )
+  fix q
+  AOT_have \<open>\<diamond>(w \<Turnstile> q \<or> w \<Turnstile> \<not>q)\<close>
+  proof(rule "RM\<diamond>"[THEN "\<rightarrow>E"]; (rule "\<rightarrow>I")?)
+    AOT_modally_strict {
+      AOT_assume \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> q \<equiv> q\<close> and \<open>w \<Turnstile> \<not>q \<equiv> \<not>q\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+      AOT_thus \<open>w \<Turnstile> q \<or> w \<Turnstile> \<not>q\<close>
+        by (metis "\<or>I"(1) "\<or>I"(2) "\<equiv>E"(3) "reductio-aa:1")
+    }
+  next
+    AOT_show \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+      using PossibleWorld.\<psi>[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "world:1"], THEN "&E"(2)].
+  qed
+  AOT_hence \<open>\<diamond>w \<Turnstile> q \<or> \<diamond>w \<Turnstile> \<not>q\<close>
+    using "KBasic2:2"[THEN "\<equiv>E"(1)] by blast
+  AOT_thus \<open>w \<Turnstile> q \<or> w \<Turnstile> \<not>q\<close>
+    using "lem2:2"[unconstrain s, THEN "\<rightarrow>E", unvarify p,
+                   OF PossibleWorld.\<psi>[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "world:1"], THEN "&E"(1)],
+                   THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by (metis "\<or>I"(1) "\<or>I"(2) "\<or>E"(3) "raa-cor:2")
+qed
+
+AOT_theorem "world=maxpos:1": \<open>Maximal(x) \<rightarrow> \<box>Maximal(x)\<close>
+proof (AOT_subst \<open>Maximal(x)\<close> \<open>Situation(x) & \<forall>p (x \<Turnstile> p \<or> x \<Turnstile> \<not>p)\<close>;
+       safe intro!: max "\<equiv>Df" "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
+  AOT_assume sit_x: \<open>Situation(x)\<close>
+  AOT_hence nec_sit_x: \<open>\<box>Situation(x)\<close>
+    by (metis "\<equiv>E"(1) "possit-sit:1")
+  AOT_assume \<open>\<forall>p (x \<Turnstile> p \<or> x \<Turnstile> \<not>p)\<close>
+  AOT_hence \<open>x \<Turnstile> p \<or> x \<Turnstile> \<not>p\<close> for p
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast
+  AOT_hence \<open>\<box>x \<Turnstile> p \<or> \<box>x \<Turnstile> \<not>p\<close> for p
+    using "lem2:1"[unconstrain s, THEN "\<rightarrow>E", OF sit_x, unvarify p,
+                   OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
+    by (metis "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "raa-cor:1")
+  AOT_hence \<open>\<box>(x \<Turnstile> p \<or> x \<Turnstile> \<not>p)\<close> for p
+    by (metis "KBasic:15" "\<rightarrow>E")
+  AOT_hence \<open>\<forall>p \<box>(x \<Turnstile> p \<or> x \<Turnstile> \<not>p)\<close>
+    by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>p (x \<Turnstile> p \<or> x \<Turnstile> \<not>p)\<close>
+    by (rule BF[THEN "\<rightarrow>E"])
+  AOT_thus \<open>\<box>(Situation(x) & \<forall>p (x \<Turnstile> p \<or> x \<Turnstile> \<not>p))\<close>
+    using nec_sit_x by (metis "KBasic:3" "&I" "\<equiv>E"(2))
+qed
+
+AOT_theorem "world=maxpos:2": \<open>PossibleWorld(x) \<equiv> Maximal(x) & Possible(x)\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I" "world-pos"[unconstrain w, THEN "\<rightarrow>E"]
+                   "world-max"[unconstrain w, THEN "\<rightarrow>E"];
+      frule "&E"(2); drule "&E"(1))
+  AOT_assume pos_x: \<open>Possible(x)\<close>
+  AOT_have \<open>\<diamond>(Situation(x) & \<forall>p(x \<Turnstile> p \<rightarrow> p))\<close>
+    apply (AOT_subst (reverse) \<open>Situation(x) & \<forall>p(x \<Turnstile> p \<rightarrow> p)\<close> \<open>Actual(x)\<close>)
+     using actual "\<equiv>Df" apply presburger
+    using "\<equiv>\<^sub>d\<^sub>fE" "&E"(2) pos pos_x by blast
+  AOT_hence 0: \<open>\<diamond>\<forall>p(x \<Turnstile> p \<rightarrow> p)\<close>
+    by (metis "KBasic2:3" "&E"(2) "vdash-properties:6")
+  AOT_assume max_x: \<open>Maximal(x)\<close>
+  AOT_hence sit_x: \<open>Situation(x)\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" max_x "&E"(1) max)
+  AOT_have \<open>\<box>Maximal(x)\<close> using "world=maxpos:1"[THEN "\<rightarrow>E", OF max_x] by simp
+  moreover AOT_have \<open>\<box>Maximal(x) \<rightarrow> \<box>(\<forall>p(x \<Turnstile> p \<rightarrow> p) \<rightarrow> \<forall>p (x \<Turnstile> p \<equiv> p))\<close>
+  proof(safe intro!: "\<rightarrow>I" RM GEN)
+    AOT_modally_strict {
+      fix p
+      AOT_assume 0: \<open>Maximal(x)\<close>
+      AOT_assume 1: \<open>\<forall>p (x \<Turnstile> p \<rightarrow> p)\<close>
+      AOT_show \<open>x \<Turnstile> p \<equiv> p\<close>
+      proof(safe intro!: "\<equiv>I" "\<rightarrow>I" 1[THEN "\<forall>E"(2), THEN "\<rightarrow>E"]; rule "raa-cor:1")
+        AOT_assume \<open>\<not>x \<Turnstile> p\<close>
+        AOT_hence \<open>x \<Turnstile> \<not>p\<close>
+          using 0[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF max], THEN "&E"(2), THEN "\<forall>E"(2)]
+                1 by (metis "\<or>E"(2))
+        AOT_hence \<open>\<not>p\<close>
+          using 1[THEN "\<forall>E"(1), OF "log-prop-prop:2", THEN "\<rightarrow>E"] by blast
+        moreover AOT_assume p
+        ultimately AOT_show \<open>p & \<not>p\<close> using "&I" by blast
+      qed
+    }
+  qed
+  ultimately AOT_have \<open>\<box>(\<forall>p(x \<Turnstile> p \<rightarrow> p) \<rightarrow> \<forall>p (x \<Turnstile> p \<equiv> p))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>\<forall>p(x \<Turnstile> p \<rightarrow> p) \<rightarrow> \<diamond>\<forall>p(x \<Turnstile> p \<equiv> p)\<close>
+    by (metis "KBasic:13"[THEN "\<rightarrow>E"])
+  AOT_hence \<open>\<diamond>\<forall>p(x \<Turnstile> p \<equiv> p)\<close>
+    using 0 "\<rightarrow>E" by blast
+  AOT_thus \<open>PossibleWorld(x)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fI"[OF "world:1", OF "&I", OF sit_x] by blast
+qed
+
+AOT_define NecImpl :: \<open>\<phi> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (infixl \<open>\<Rightarrow>\<close> 26)
+  "nec-impl-p:1": \<open>p \<Rightarrow> q \<equiv>\<^sub>d\<^sub>f \<box>(p \<rightarrow> q)\<close>
+AOT_define NecEquiv :: \<open>\<phi> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (infixl \<open>\<Leftrightarrow>\<close> 21)
+  "nec-impl-p:2": \<open>p \<Leftrightarrow> q \<equiv>\<^sub>d\<^sub>f (p \<Rightarrow> q) & (q \<Rightarrow> p)\<close>
+
+AOT_theorem "nec-equiv-nec-im": \<open>p \<Leftrightarrow> q \<equiv> \<box>(p \<equiv> q)\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>p \<Leftrightarrow> q\<close>
+  AOT_hence \<open>(p \<Rightarrow> q)\<close> and \<open>(q \<Rightarrow> p)\<close>
+    using "nec-impl-p:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
+  AOT_hence \<open>\<box>(p \<rightarrow> q)\<close> and \<open>\<box>(q \<rightarrow> p)\<close>
+    using "nec-impl-p:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast+
+  AOT_thus \<open>\<box>(p \<equiv> q)\<close> by (metis "KBasic:4" "&I" "\<equiv>E"(2))
+next
+  AOT_assume \<open>\<box>(p \<equiv> q)\<close>
+  AOT_hence \<open>\<box>(p \<rightarrow> q)\<close> and \<open>\<box>(q \<rightarrow> p)\<close>
+    using "KBasic:4" "&E" "\<equiv>E"(1) by blast+
+  AOT_hence \<open>(p \<Rightarrow> q)\<close> and \<open>(q \<Rightarrow> p)\<close>
+    using "nec-impl-p:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast+
+  AOT_thus \<open>p \<Leftrightarrow> q\<close>
+    using "nec-impl-p:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" by blast
+qed
+
+(* TODO: PLM: discuss these; still not in PLM *)
+AOT_theorem world_closed_lem_1_a:
+  \<open>(s \<Turnstile> (\<phi> & \<psi>)) \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> (s \<Turnstile> \<phi> & s \<Turnstile> \<psi>))\<close>
+proof(safe intro!: "\<rightarrow>I")
+  AOT_assume \<open>\<forall> p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<open>s \<Turnstile> (\<phi> & \<psi>) \<equiv> (\<phi> & \<psi>)\<close> and \<open>s \<Turnstile> \<phi> \<equiv> \<phi>\<close> and \<open>s \<Turnstile> \<psi> \<equiv> \<psi>\<close>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+  moreover AOT_assume \<open>s \<Turnstile> (\<phi> & \<psi>)\<close>
+  ultimately AOT_show \<open>s \<Turnstile> \<phi> & s \<Turnstile> \<psi>\<close>
+    by (metis "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "\<equiv>E"(2))
+qed
+
+AOT_theorem world_closed_lem_1_b:
+  \<open>(s \<Turnstile> \<phi> & (\<phi> \<rightarrow> q)) \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> q)\<close>
+proof(safe intro!: "\<rightarrow>I")
+  AOT_assume \<open>\<forall> p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<open>s \<Turnstile> \<phi> \<equiv> \<phi>\<close> for \<phi>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast
+  moreover AOT_assume \<open>s \<Turnstile> \<phi> & (\<phi> \<rightarrow> q)\<close>
+  ultimately AOT_show \<open>s \<Turnstile> q\<close>
+    by (metis "&E"(1) "&E"(2) "\<equiv>E"(1) "\<equiv>E"(2) "\<rightarrow>E")
+qed
+
+AOT_theorem world_closed_lem_1_c:
+  \<open>(s \<Turnstile> \<phi> & s \<Turnstile> (\<phi> \<rightarrow> \<psi>)) \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> \<psi>)\<close>
+proof(safe intro!: "\<rightarrow>I")
+  AOT_assume \<open>\<forall> p (s \<Turnstile> p \<equiv> p)\<close>
+  AOT_hence \<open>s \<Turnstile> \<phi> \<equiv> \<phi>\<close> for \<phi>
+    using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast
+  moreover AOT_assume \<open>s \<Turnstile> \<phi> & s \<Turnstile> (\<phi> \<rightarrow> \<psi>)\<close>
+  ultimately AOT_show \<open>s \<Turnstile> \<psi>\<close>
+    by (metis "&E"(1) "&E"(2) "\<equiv>E"(1) "\<equiv>E"(2) "\<rightarrow>E")
+qed
+
+AOT_theorem "world-closed-lem:1[0]":
+  \<open>q \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> q)\<close>
+  by (meson "\<rightarrow>I" "\<equiv>E"(2) "log-prop-prop:2" "rule-ui:1")
+
+AOT_theorem "world-closed-lem:1[1]":
+  \<open>s \<Turnstile> p\<^sub>1 & (p\<^sub>1 \<rightarrow> q) \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> q)\<close>
+  using world_closed_lem_1_b.
+
+AOT_theorem "world-closed-lem:1[2]":
+  \<open>s \<Turnstile> p\<^sub>1 & s \<Turnstile> p\<^sub>2 & ((p\<^sub>1 & p\<^sub>2) \<rightarrow> q) \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> q)\<close>
+  using world_closed_lem_1_b world_closed_lem_1_a
+  by (metis (full_types) "&I" "&E" "\<rightarrow>I" "\<rightarrow>E")
+
+AOT_theorem "world-closed-lem:1[3]":
+  \<open>s \<Turnstile> p\<^sub>1 & s \<Turnstile> p\<^sub>2 & s \<Turnstile> p\<^sub>3 & ((p\<^sub>1 & p\<^sub>2 & p\<^sub>3) \<rightarrow> q) \<rightarrow> (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> q)\<close>
+  using world_closed_lem_1_b world_closed_lem_1_a
+  by (metis (full_types) "&I" "&E" "\<rightarrow>I" "\<rightarrow>E")
+
+AOT_theorem "world-closed-lem:1[4]":
+  \<open>s \<Turnstile> p\<^sub>1 & s \<Turnstile> p\<^sub>2 & s \<Turnstile> p\<^sub>3 & s \<Turnstile> p\<^sub>4 & ((p\<^sub>1 & p\<^sub>2 & p\<^sub>3 & p\<^sub>4) \<rightarrow> q) \<rightarrow>
+   (\<forall>p (s \<Turnstile> p \<equiv> p) \<rightarrow> s \<Turnstile> q)\<close>
+  using world_closed_lem_1_b world_closed_lem_1_a
+  by (metis (full_types) "&I" "&E" "\<rightarrow>I" "\<rightarrow>E")
+
+AOT_theorem "coherent:1": \<open>w \<Turnstile> \<not>p \<equiv> \<not>w \<Turnstile> p\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume 1: \<open>w \<Turnstile> \<not>p\<close>
+  AOT_show \<open>\<not>w \<Turnstile> p\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>w \<Turnstile> p\<close>
+    AOT_hence \<open>w \<Turnstile> p & w \<Turnstile> \<not>p\<close> using 1 "&I" by blast
+    AOT_hence \<open>\<exists>q (w \<Turnstile> q & w \<Turnstile> \<not>q)\<close> by (rule "\<exists>I")
+    moreover AOT_have \<open>\<not>\<exists>q (w \<Turnstile> q & w \<Turnstile> \<not>q)\<close>
+      using "world-cons:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF cons], THEN "&E"(2)].
+    ultimately AOT_show \<open>\<exists>q (w \<Turnstile> q & w \<Turnstile> \<not>q) & \<not>\<exists>q (w \<Turnstile> q & w \<Turnstile> \<not>q)\<close>
+      using "&I" by blast
+  qed
+next
+  AOT_assume \<open>\<not>w \<Turnstile> p\<close>
+  AOT_thus \<open>w \<Turnstile> \<not>p\<close>
+    using "world-max"[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF max], THEN "&E"(2)]
+    by (metis "\<or>E"(2) "log-prop-prop:2" "rule-ui:1")
+qed
+
+AOT_theorem "coherent:2": \<open>w \<Turnstile> p \<equiv> \<not>w \<Turnstile> \<not>p\<close>
+  by (metis "coherent:1" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1) "\<equiv>E"(2) "raa-cor:3")
+
+AOT_theorem "act-world:1": \<open>\<exists>w \<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+proof -
+  AOT_obtain s where s_prop: \<open>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    using "sit-classical:6" "Situation.\<exists>E"[rotated] by meson
+  AOT_hence \<open>\<diamond>\<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    by (metis "T\<diamond>" "vdash-properties:10")
+  AOT_hence \<open>PossibleWorld(s)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] Situation.\<psi> "&I" by blast
+  AOT_hence \<open>PossibleWorld(s) & \<forall>p (s \<Turnstile> p \<equiv> p)\<close>
+    using "&I" s_prop by blast
+  thus ?thesis by (rule "\<exists>I")
+qed
+
+AOT_theorem "act-world:2": \<open>\<exists>!w Actual(w)\<close>
+proof -
+  AOT_obtain w where w_prop: \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "act-world:1" "PossibleWorld.\<exists>E"[rotated] by meson
+  AOT_have sit_s: \<open>Situation(w)\<close>
+    using PossibleWorld.\<psi> "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)] by blast
+  show ?thesis
+  proof (safe intro!: "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<exists>I"(2) "&I" GEN "\<rightarrow>I"
+                      PossibleWorld.\<psi> actual[THEN "\<equiv>\<^sub>d\<^sub>fI"] sit_s
+                      "sit-identity"[unconstrain s, unconstrain s', THEN "\<rightarrow>E",
+                                     THEN "\<rightarrow>E", THEN "\<equiv>E"(2)] "\<equiv>I"
+                      w_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)])
+    AOT_show \<open>PossibleWorld(w)\<close> using PossibleWorld.\<psi>.
+  next
+    AOT_show \<open>Situation(w)\<close>
+      by (simp add: sit_s)
+  next
+    fix y p
+    AOT_assume w_asm: \<open>PossibleWorld(y) & Actual(y)\<close>
+    AOT_assume \<open>w \<Turnstile> p\<close>
+    AOT_hence p: \<open>p\<close>
+      using w_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+    AOT_show \<open>y \<Turnstile> p\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume \<open>\<not>y \<Turnstile> p\<close>
+      AOT_hence \<open>y \<Turnstile> \<not>p\<close>
+        by (metis "coherent:1"[unconstrain w, THEN "\<rightarrow>E"] "&E"(1) "\<equiv>E"(2) w_asm)
+      AOT_hence \<open>\<not>p\<close>
+        using w_asm[THEN "&E"(2), THEN actual[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                    THEN "\<forall>E"(1), rotated, OF "log-prop-prop:2"]
+              "\<rightarrow>E" by blast
+      AOT_thus \<open>p & \<not>p\<close> using p "&I" by blast
+    qed
+  next
+    AOT_show \<open>w \<Turnstile> p\<close> if \<open>y \<Turnstile> p\<close> and \<open>PossibleWorld(y) & Actual(y)\<close> for p y
+      using that(2)[THEN "&E"(2), THEN actual[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                    THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF that(1)]
+            w_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by blast
+  next
+    AOT_show \<open>Situation(y)\<close> if \<open>PossibleWorld(y) & Actual(y)\<close> for y
+      using that[THEN "&E"(1)] "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)] by blast
+  next
+    AOT_show \<open>Situation(w)\<close>
+      using sit_s by blast
+  qed(simp)
+qed
+
+AOT_theorem "pre-walpha": \<open>\<^bold>\<iota>w Actual(w)\<down>\<close>
+  using "A-Exists:2" "RA[2]" "act-world:2" "\<equiv>E"(2) by blast
+
+AOT_define TheActualWorld :: \<open>\<kappa>\<^sub>s\<close> (\<open>\<^bold>w\<^sub>\<alpha>\<close>)
+  "w-alpha": \<open>\<^bold>w\<^sub>\<alpha> =\<^sub>d\<^sub>f \<^bold>\<iota>w Actual(w)\<close>
+
+(* TODO: not in PLM *)
+AOT_theorem true_in_truth_act_true: \<open>\<top> \<Turnstile> p \<equiv> \<^bold>\<A>p\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_have true_def: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<top> = \<^bold>\<iota>x (A!x & \<forall>F (x[F] \<equiv> \<exists>p(p & F = [\<lambda>y p])))\<close>
+    by (simp add: "A-descriptions" "rule-id-df:1[zero]" "the-true:1")
+  AOT_hence true_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<top>\<down>\<close>
+    using "t=t-proper:1" "vdash-properties:6" by blast
+  {
+    AOT_assume \<open>\<top> \<Turnstile> p\<close>
+    AOT_hence \<open>\<top>[\<lambda>y p]\<close>
+      by (metis "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:b" "prop-enc" "true-in-s")
+    AOT_hence \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<exists>q (q & F = [\<lambda>y q])))[\<lambda>y p]\<close>
+      using "rule=E" true_def true_den by fast
+    AOT_hence \<open>\<^bold>\<A>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      using "\<equiv>E"(1) "desc-nec-encode:1"[unvarify F] "prop-prop2:2" by fast
+    AOT_hence \<open>\<exists>q \<^bold>\<A>(q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      by (metis "Act-Basic:10" "\<equiv>E"(1))
+    then AOT_obtain q where \<open>\<^bold>\<A>(q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_hence actq: \<open>\<^bold>\<A>q\<close> and \<open>\<^bold>\<A>[\<lambda>y p] = [\<lambda>y q]\<close>
+      using "Act-Basic:2" "intro-elim:3:a" "&E" by blast+
+    AOT_hence \<open>[\<lambda>y p] = [\<lambda>y q]\<close>
+      using "id-act:1"[unvarify \<alpha> \<beta>, THEN "\<equiv>E"(2)] "prop-prop2:2" by blast
+    AOT_hence \<open>p = q\<close>
+      by (metis "intro-elim:3:b" "p-identity-thm2:3")
+    AOT_thus \<open>\<^bold>\<A>p\<close>
+      using actq "rule=E" id_sym by blast
+  }
+  {
+    AOT_assume \<open>\<^bold>\<A>p\<close>
+    AOT_hence \<open>\<^bold>\<A>(p & [\<lambda>y p] = [\<lambda>y p])\<close>
+      by (auto intro!: "Act-Basic:2"[THEN "\<equiv>E"(2)] "&I"
+               intro: "RA[2]" "=I"(1)[OF "prop-prop2:2"])
+    AOT_hence \<open>\<exists>q \<^bold>\<A>(q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      using "\<exists>I" by fast
+    AOT_hence \<open>\<^bold>\<A>\<exists>q (q & [\<lambda>y p] = [\<lambda>y q])\<close>
+      by (metis "Act-Basic:10" "\<equiv>E"(2))
+    AOT_hence \<open>\<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> \<exists>q (q & F = [\<lambda>y q])))[\<lambda>y p]\<close>
+      using "\<equiv>E"(2) "desc-nec-encode:1"[unvarify F] "prop-prop2:2" by fast
+    AOT_hence \<open>\<top>[\<lambda>y p]\<close>
+      using "rule=E" true_def true_den id_sym by fast
+    AOT_thus \<open>\<top> \<Turnstile> p\<close>
+      by (safe intro!: "true-in-s"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "possit-sit:6"
+                       "prop-enc"[THEN "\<equiv>\<^sub>d\<^sub>fI"] true_den)
+  }
+qed
+
+AOT_theorem "T-world": \<open>\<top> = \<^bold>w\<^sub>\<alpha>\<close>
+proof -
+  AOT_have true_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<top>\<down>\<close>
+    using "Situation.res-var:3" "possit-sit:6" "\<rightarrow>E" by blast
+  AOT_have \<open>\<^bold>\<A>\<forall>p (\<top> \<Turnstile> p \<rightarrow> p)\<close>
+  proof (safe intro!: "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)] GEN
+                      "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(2)] "\<rightarrow>I")
+    fix p
+    AOT_assume \<open>\<^bold>\<A>\<top> \<Turnstile> p\<close>
+    AOT_hence \<open>\<top> \<Turnstile> p\<close>
+      using "lem2:4"[unconstrain s, unvarify \<beta>, OF true_den,
+                     THEN "\<rightarrow>E", OF "possit-sit:6"] "\<equiv>E"(1) by blast
+    AOT_thus \<open>\<^bold>\<A>p\<close> using true_in_truth_act_true "\<equiv>E"(1) by blast
+  qed
+  moreover AOT_have \<open>\<^bold>\<A>(Situation(\<kappa>) & \<forall>p (\<kappa> \<Turnstile> p \<rightarrow> p)) \<rightarrow> \<^bold>\<A>Actual(\<kappa>)\<close> for \<kappa>
+    using actual[THEN "\<equiv>Df", THEN "conventions:3"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)],
+                 THEN "RA[2]", THEN "act-cond"[THEN "\<rightarrow>E"]].
+  ultimately AOT_have act_act_true: \<open>\<^bold>\<A>Actual(\<top>)\<close>
+    using "possit-sit:4"[unvarify x, OF true_den, THEN "\<equiv>E"(2), OF "possit-sit:6"]
+          "Act-Basic:2"[THEN "\<equiv>E"(2), OF "&I"] "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>Actual(\<top>)\<close> by (metis "Act-Sub:3" "vdash-properties:10")
+  AOT_hence \<open>Possible(\<top>)\<close>
+    by (safe intro!: pos[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "possit-sit:6")
+  moreover AOT_have \<open>Maximal(\<top>)\<close>
+  proof (safe intro!: max[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "possit-sit:6" GEN)
+    fix p
+    AOT_have \<open>\<^bold>\<A>p \<or> \<^bold>\<A>\<not>p\<close>
+      by (simp add: "Act-Basic:1")
+    moreover AOT_have \<open>\<top> \<Turnstile> p\<close> if \<open>\<^bold>\<A>p\<close>
+        using that true_in_truth_act_true[THEN "\<equiv>E"(2)] by blast
+    moreover AOT_have \<open>\<top> \<Turnstile> \<not>p\<close> if \<open>\<^bold>\<A>\<not>p\<close>
+      using that true_in_truth_act_true[unvarify p, THEN "\<equiv>E"(2)]
+            "log-prop-prop:2" by blast
+    ultimately AOT_show \<open>\<top> \<Turnstile> p \<or> \<top> \<Turnstile> \<not>p\<close>
+      using "\<or>I"(3) "\<rightarrow>I" by blast
+  qed
+  ultimately AOT_have \<open>PossibleWorld(\<top>)\<close>
+    by (safe intro!: "world=maxpos:2"[unvarify x, OF true_den, THEN "\<equiv>E"(2)] "&I")
+  AOT_hence \<open>\<^bold>\<A>PossibleWorld(\<top>)\<close>
+    using "rigid-pw:4"[unvarify x, OF true_den, THEN "\<equiv>E"(2)] by blast
+  AOT_hence 1: \<open>\<^bold>\<A>(PossibleWorld(\<top>) & Actual(\<top>))\<close>
+    using act_act_true "Act-Basic:2" "df-simplify:2" "intro-elim:3:b" by blast
+  AOT_have \<open>\<^bold>w\<^sub>\<alpha> = \<^bold>\<iota>w(Actual(w))\<close>
+    using "rule-id-df:1[zero]"[OF "w-alpha", OF "pre-walpha"] by simp
+  moreover AOT_have w_act_den: \<open>\<^bold>w\<^sub>\<alpha>\<down>\<close>
+    using calculation "t=t-proper:1" "\<rightarrow>E" by blast
+  ultimately AOT_have \<open>\<forall>z (\<^bold>\<A>(PossibleWorld(z) & Actual(z)) \<rightarrow> z = \<^bold>w\<^sub>\<alpha>)\<close>
+    using "nec-hintikka-scheme"[unvarify x] "\<equiv>E"(1) "&E" by blast
+  AOT_thus \<open>\<top> = \<^bold>w\<^sub>\<alpha>\<close>
+    using "\<forall>E"(1)[rotated, OF true_den] 1 "\<rightarrow>E" by blast
+qed
+
+AOT_act_theorem "truth-at-alpha:1": \<open>p \<equiv> \<^bold>w\<^sub>\<alpha> = \<^bold>\<iota>x (ExtensionOf(x, p))\<close>
+  by (metis "rule=E" "T-world" "deduction-theorem" "ext-p-tv:3" id_sym "\<equiv>I"
+            "\<equiv>E"(1) "\<equiv>E"(2) "q-True:1")
+
+AOT_act_theorem "truth-at-alpha:2": \<open>p \<equiv> \<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+proof -
+  AOT_have \<open>PossibleWorld(\<^bold>w\<^sub>\<alpha>)\<close>
+    using "&E"(1) "pre-walpha" "rule-id-df:2:b[zero]" "\<rightarrow>E"
+          "w-alpha" "y-in:3" by blast
+  AOT_hence sit_w_alpha: \<open>Situation(\<^bold>w\<^sub>\<alpha>)\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "world:1")
+  AOT_have w_alpha_den: \<open>\<^bold>w\<^sub>\<alpha>\<down>\<close>
+    using "pre-walpha" "rule-id-df:2:b[zero]" "w-alpha" by blast
+  AOT_have \<open>p \<equiv> \<top>\<^bold>\<Sigma>p\<close>
+    using "q-True:3" by force
+  moreover AOT_have \<open>\<top> = \<^bold>w\<^sub>\<alpha>\<close>
+    using "T-world" by auto
+  ultimately AOT_have \<open>p \<equiv> \<^bold>w\<^sub>\<alpha>\<^bold>\<Sigma>p\<close>
+    using "rule=E" by fast
+  moreover AOT_have \<open>\<^bold>w\<^sub>\<alpha> \<^bold>\<Sigma> p \<equiv> \<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+    using lem1[unvarify x, OF w_alpha_den, THEN "\<rightarrow>E", OF sit_w_alpha]
+    using "\<equiv>S"(1) "\<equiv>E"(1) "Commutativity of \<equiv>" "\<equiv>Df" sit_w_alpha "true-in-s" by blast
+  ultimately AOT_show \<open>p \<equiv> \<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+    by (metis "\<equiv>E"(5))
+qed
+
+AOT_theorem "alpha-world:1": \<open>PossibleWorld(\<^bold>w\<^sub>\<alpha>)\<close>
+proof -
+  AOT_have 0: \<open>\<^bold>w\<^sub>\<alpha> = \<^bold>\<iota>w Actual(w)\<close>
+    using "pre-walpha" "rule-id-df:1[zero]" "w-alpha" by blast
+  AOT_hence walpha_den: \<open>\<^bold>w\<^sub>\<alpha>\<down>\<close>
+    by (metis "t=t-proper:1" "vdash-properties:6")
+  AOT_have \<open>\<^bold>\<A>(PossibleWorld(\<^bold>w\<^sub>\<alpha>) & Actual(\<^bold>w\<^sub>\<alpha>))\<close>
+    by (rule "actual-desc:2"[unvarify x, OF walpha_den, THEN "\<rightarrow>E"]) (fact 0)
+  AOT_hence \<open>\<^bold>\<A>PossibleWorld(\<^bold>w\<^sub>\<alpha>)\<close>
+    by (metis "Act-Basic:2" "&E"(1) "\<equiv>E"(1))
+  AOT_thus \<open>PossibleWorld(\<^bold>w\<^sub>\<alpha>)\<close>
+    using "rigid-pw:4"[unvarify x, OF walpha_den, THEN "\<equiv>E"(1)]
+    by blast
+qed
+
+AOT_theorem "alpha-world:2": \<open>Maximal(\<^bold>w\<^sub>\<alpha>)\<close>
+proof -
+  AOT_have \<open>\<^bold>w\<^sub>\<alpha>\<down>\<close>
+    using "pre-walpha" "rule-id-df:2:b[zero]" "w-alpha" by blast
+  then AOT_obtain x where x_def: \<open>x = \<^bold>w\<^sub>\<alpha>\<close>
+    by (metis "instantiation" "rule=I:1" "existential:1" id_sym)
+  AOT_hence \<open>PossibleWorld(x)\<close> using "alpha-world:1" "rule=E" id_sym by fast
+  AOT_hence \<open>Maximal(x)\<close> by (metis "world-max"[unconstrain w, THEN "\<rightarrow>E"]) 
+  AOT_thus \<open>Maximal(\<^bold>w\<^sub>\<alpha>)\<close> using x_def "rule=E" by blast
+qed
+
+AOT_theorem "t-at-alpha-strict": \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p \<equiv> \<^bold>\<A>p\<close>
+proof -
+  AOT_have 0: \<open>\<^bold>w\<^sub>\<alpha> = \<^bold>\<iota>w Actual(w)\<close>
+    using "pre-walpha" "rule-id-df:1[zero]" "w-alpha" by blast
+  AOT_hence walpha_den: \<open>\<^bold>w\<^sub>\<alpha>\<down>\<close>
+    by (metis "t=t-proper:1" "vdash-properties:6")
+  AOT_have 1: \<open>\<^bold>\<A>(PossibleWorld(\<^bold>w\<^sub>\<alpha>) & Actual(\<^bold>w\<^sub>\<alpha>))\<close>
+    by (rule "actual-desc:2"[unvarify x, OF walpha_den, THEN "\<rightarrow>E"]) (fact 0)
+  AOT_have walpha_sit: \<open>Situation(\<^bold>w\<^sub>\<alpha>)\<close>
+    by (meson "\<equiv>\<^sub>d\<^sub>fE" "alpha-world:2" "&E"(1) max)
+  {
+    fix p
+    AOT_have 2: \<open>Situation(x) \<rightarrow> (\<^bold>\<A>x \<Turnstile> p \<equiv> x \<Turnstile> p)\<close> for x
+      using "lem2:4"[unconstrain s] by blast
+    AOT_assume \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+    AOT_hence \<theta>: \<open>\<^bold>\<A>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+      using 2[unvarify x, OF walpha_den, THEN "\<rightarrow>E", OF walpha_sit, THEN "\<equiv>E"(2)]
+      by argo
+    AOT_have 3: \<open>\<^bold>\<A>Actual(\<^bold>w\<^sub>\<alpha>)\<close>
+      using "1" "Act-Basic:2" "&E"(2) "\<equiv>E"(1) by blast
+    AOT_have \<open>\<^bold>\<A>(Situation(\<^bold>w\<^sub>\<alpha>) & \<forall>q(\<^bold>w\<^sub>\<alpha> \<Turnstile> q \<rightarrow> q))\<close>
+      apply (AOT_subst (reverse) \<open>Situation(\<^bold>w\<^sub>\<alpha>) & \<forall>q(\<^bold>w\<^sub>\<alpha> \<Turnstile> q \<rightarrow> q)\<close> \<open>Actual(\<^bold>w\<^sub>\<alpha>)\<close>)
+       using actual "\<equiv>Df" apply blast
+      by (fact 3)
+    AOT_hence \<open>\<^bold>\<A>\<forall>q(\<^bold>w\<^sub>\<alpha> \<Turnstile> q \<rightarrow> q)\<close> by (metis "Act-Basic:2" "&E"(2) "\<equiv>E"(1))
+    AOT_hence \<open>\<forall>q \<^bold>\<A>(\<^bold>w\<^sub>\<alpha> \<Turnstile> q \<rightarrow> q)\<close>
+      using "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<^bold>\<A>(\<^bold>w\<^sub>\<alpha> \<Turnstile> p \<rightarrow> p)\<close> using "\<forall>E"(2) by blast
+    AOT_hence \<open>\<^bold>\<A>(\<^bold>w\<^sub>\<alpha> \<Turnstile> p) \<rightarrow> \<^bold>\<A>p\<close> by (metis "act-cond" "vdash-properties:10")
+    AOT_hence \<open>\<^bold>\<A>p\<close> using \<theta> "\<rightarrow>E" by blast
+  }
+  AOT_hence 2: \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p \<rightarrow> \<^bold>\<A>p\<close> for p by (rule "\<rightarrow>I")
+  AOT_have walpha_sit: \<open>Situation(\<^bold>w\<^sub>\<alpha>)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "alpha-world:2" "&E"(1) max by blast
+  show ?thesis
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I" 2)
+    AOT_assume actp: \<open>\<^bold>\<A>p\<close>
+    AOT_show \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume \<open>\<not>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+      AOT_hence \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> \<not>p\<close>
+        using "alpha-world:2"[THEN max[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2),
+                              THEN "\<forall>E"(1), OF "log-prop-prop:2"]
+        by (metis "\<or>E"(2))
+      AOT_hence \<open>\<^bold>\<A>\<not>p\<close>
+        using 2[unvarify p, OF "log-prop-prop:2", THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<not>\<^bold>\<A>p\<close> by (metis "\<not>\<not>I" "Act-Sub:1" "\<equiv>E"(4))
+      AOT_thus \<open>\<^bold>\<A>p & \<not>\<^bold>\<A>p\<close> using actp "&I" by blast
+    qed
+  qed
+qed
+
+AOT_act_theorem "not-act": \<open>w \<noteq> \<^bold>w\<^sub>\<alpha> \<rightarrow> \<not>Actual(w)\<close>
+proof (rule "\<rightarrow>I"; rule "raa-cor:2")
+  AOT_assume \<open>w \<noteq> \<^bold>w\<^sub>\<alpha>\<close>
+  AOT_hence 0: \<open>\<not>(w = \<^bold>w\<^sub>\<alpha>)\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" "=-infix")
+  AOT_have walpha_den: \<open>\<^bold>w\<^sub>\<alpha>\<down>\<close>
+    using "pre-walpha" "rule-id-df:2:b[zero]" "w-alpha" by blast
+  AOT_have walpha_sit: \<open>Situation(\<^bold>w\<^sub>\<alpha>)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "alpha-world:2" "&E"(1) max by blast
+  AOT_assume act_w: \<open>Actual(w)\<close>
+  AOT_hence w_sit: \<open>Situation(w)\<close> by (metis "\<equiv>\<^sub>d\<^sub>fE" actual "&E"(1))
+  AOT_have sid: \<open>Situation(x') \<rightarrow> (w = x' \<equiv> \<forall>p (w \<Turnstile> p \<equiv> x' \<Turnstile> p))\<close> for x'
+    using "sit-identity"[unconstrain s', unconstrain s, THEN "\<rightarrow>E", OF w_sit]
+    by blast
+  AOT_have \<open>w = \<^bold>w\<^sub>\<alpha>\<close>
+  proof(safe intro!: GEN sid[unvarify x', OF walpha_den, THEN "\<rightarrow>E",
+                             OF walpha_sit, THEN "\<equiv>E"(2)] "\<equiv>I" "\<rightarrow>I")
+    fix p
+    AOT_assume \<open>w \<Turnstile> p\<close>
+    AOT_hence \<open>p\<close>
+      using actual[THEN "\<equiv>\<^sub>d\<^sub>fE", OF act_w, THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
+      by blast
+    AOT_hence \<open>\<^bold>\<A>p\<close>
+      by (metis "RA[1]")
+    AOT_thus \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+      using "t-at-alpha-strict"[THEN "\<equiv>E"(2)] by blast
+  next
+    fix p
+    AOT_assume \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+    AOT_hence \<open>\<^bold>\<A>p\<close>
+      using "t-at-alpha-strict"[THEN "\<equiv>E"(1)] by blast
+    AOT_hence p: \<open>p\<close>
+      using "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"] by blast
+    AOT_show \<open>w \<Turnstile> p\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume \<open>\<not>w \<Turnstile> p\<close>
+      AOT_hence \<open>w \<Turnstile> \<not>p\<close>
+        by (metis "coherent:1" "\<equiv>E"(2))
+      AOT_hence \<open>\<not>p\<close>
+        using actual[THEN "\<equiv>\<^sub>d\<^sub>fE", OF act_w, THEN "&E"(2), THEN "\<forall>E"(1),
+                     OF "log-prop-prop:2", THEN "\<rightarrow>E"] by blast
+      AOT_thus \<open>p & \<not>p\<close> using p "&I" by blast
+    qed
+  qed
+  AOT_thus \<open>w = \<^bold>w\<^sub>\<alpha> & \<not>(w = \<^bold>w\<^sub>\<alpha>)\<close> using 0 "&I" by blast
+qed
+
+AOT_act_theorem "w-alpha-part": \<open>Actual(s) \<equiv> s \<unlhd> \<^bold>w\<^sub>\<alpha>\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" GEN
+           dest!:  "sit-part-whole"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  AOT_show \<open>Situation(s)\<close> if \<open>Actual(s)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" actual "&E"(1) that by blast
+next
+  AOT_show \<open>Situation(\<^bold>w\<^sub>\<alpha>)\<close>
+    using "\<equiv>\<^sub>d\<^sub>fE" "alpha-world:2" "&E"(1) max by blast
+next
+  fix p
+  AOT_assume \<open>Actual(s)\<close>
+  moreover AOT_assume \<open>s \<Turnstile> p\<close>
+  ultimately AOT_have \<open>p\<close>
+    using actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close>
+     by (metis "\<equiv>E"(1) "truth-at-alpha:2")
+next
+  AOT_assume 0: \<open>Situation(s) & Situation(\<^bold>w\<^sub>\<alpha>) & \<forall>p (s \<Turnstile> p \<rightarrow> \<^bold>w\<^sub>\<alpha> \<Turnstile> p)\<close>
+  AOT_hence \<open>s \<Turnstile> p \<rightarrow> \<^bold>w\<^sub>\<alpha> \<Turnstile> p\<close> for p
+    using "&E" "\<forall>E"(2) by blast
+  AOT_hence \<open>s \<Turnstile> p \<rightarrow> p\<close> for p
+    by (metis "\<rightarrow>I" "\<equiv>E"(2) "truth-at-alpha:2" "\<rightarrow>E")
+  AOT_hence \<open>\<forall>p (s \<Turnstile> p \<rightarrow> p)\<close> by (rule GEN)
+  AOT_thus \<open>Actual(s)\<close>
+    using actual[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I", OF 0[THEN "&E"(1), THEN "&E"(1)]] by blast
+qed
+
+AOT_act_theorem "act-world2:1": \<open>\<^bold>w\<^sub>\<alpha> \<Turnstile> p \<equiv> [\<lambda>y p]\<^bold>w\<^sub>\<alpha>\<close>
+  apply (AOT_subst \<open>[\<lambda>y p]\<^bold>w\<^sub>\<alpha>\<close> p)
+   apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF "prop-prop2:2", unvarify \<nu>\<^sub>1\<nu>\<^sub>n])
+  using "pre-walpha" "rule-id-df:2:b[zero]" "w-alpha" apply blast
+  using "\<equiv>E"(2) "Commutativity of \<equiv>" "truth-at-alpha:2" by blast
+
+AOT_act_theorem "act-world2:2": \<open>p \<equiv> \<^bold>w\<^sub>\<alpha> \<Turnstile> [\<lambda>y p]\<^bold>w\<^sub>\<alpha>\<close>
+proof -
+  AOT_have \<open>p \<equiv> [\<lambda>y p]\<^bold>w\<^sub>\<alpha>\<close>
+    apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF "prop-prop2:2",
+                              unvarify \<nu>\<^sub>1\<nu>\<^sub>n, symmetric])
+    using "pre-walpha" "rule-id-df:2:b[zero]" "w-alpha" by blast
+  also AOT_have \<open>\<dots> \<equiv> \<^bold>w\<^sub>\<alpha> \<Turnstile> [\<lambda>y p]\<^bold>w\<^sub>\<alpha>\<close>
+    by (meson "log-prop-prop:2" "rule-ui:1" "truth-at-alpha:2" "universal-cor")
+  finally show ?thesis.
+qed
+
+AOT_theorem "fund-lem:1": \<open>\<diamond>p \<rightarrow> \<diamond>\<exists>w (w \<Turnstile> p)\<close>
+proof (rule "RM\<diamond>"; rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_modally_strict {
+    AOT_obtain w where w_prop: \<open>\<forall>q (w \<Turnstile> q \<equiv> q)\<close>
+      using "act-world:1" "PossibleWorld.\<exists>E"[rotated] by meson
+    AOT_assume p: \<open>p\<close>
+    AOT_assume 0: \<open>\<not>\<exists>w (w \<Turnstile> p)\<close>
+    AOT_have \<open>\<forall>w \<not>(w \<Turnstile> p)\<close>
+      apply (AOT_subst \<open>PossibleWorld(x) \<rightarrow> \<not>x \<Turnstile> p\<close>
+                       \<open>\<not>(PossibleWorld(x) & x \<Turnstile> p)\<close> for: x)
+      apply (metis "&I" "&E"(1) "&E"(2) "\<rightarrow>I" "\<equiv>I" "modus-tollens:2")
+      using "0" "cqt-further:4" "vdash-properties:10" by blast
+    AOT_hence \<open>\<not>(w \<Turnstile> p)\<close>
+      using PossibleWorld.\<psi> "rule-ui:3" "\<rightarrow>E" by blast
+    AOT_hence \<open>\<not>p\<close>
+      using w_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] 
+      by (metis "raa-cor:3")
+    AOT_thus \<open>p & \<not>p\<close>
+      using p "&I" by blast
+  }
+qed
+
+AOT_theorem "fund-lem:2": \<open>\<diamond>\<exists>w (w \<Turnstile> p) \<rightarrow> \<exists>w (w \<Turnstile> p)\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>\<exists>w (w \<Turnstile> p)\<close>
+  AOT_hence \<open>\<exists>w \<diamond>(w \<Turnstile> p)\<close>
+    using "PossibleWorld.res-var-bound-reas[BF\<diamond>]"[THEN "\<rightarrow>E"] by auto
+  then AOT_obtain w where \<open>\<diamond>(w \<Turnstile> p)\<close>
+    using "PossibleWorld.\<exists>E"[rotated] by meson
+  moreover AOT_have \<open>Situation(w)\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) pos "world-pos")
+  ultimately AOT_have \<open>w \<Turnstile> p\<close>
+    using "lem2:2"[unconstrain s, THEN "\<rightarrow>E"]  "\<equiv>E" by blast
+  AOT_thus \<open>\<exists>w w \<Turnstile> p\<close>
+    by (rule "PossibleWorld.\<exists>I")
+qed
+
+AOT_theorem "fund-lem:3": \<open>p \<rightarrow> \<forall>s(\<forall>q (s \<Turnstile> q \<equiv> q) \<rightarrow> s \<Turnstile> p)\<close>
+proof(safe intro!: "\<rightarrow>I" Situation.GEN)
+  fix s
+  AOT_assume \<open>p\<close>
+  moreover AOT_assume \<open>\<forall>q (s \<Turnstile> q \<equiv> q)\<close>
+  ultimately AOT_show \<open>s \<Turnstile> p\<close>
+    using "\<forall>E"(2) "\<equiv>E"(2) by blast
+qed
+
+AOT_theorem "fund-lem:4": \<open>\<box>p \<rightarrow> \<box>\<forall>s(\<forall>q (s \<Turnstile> q \<equiv> q) \<rightarrow> s \<Turnstile> p)\<close>
+  using "fund-lem:3" by (rule RM)
+
+AOT_theorem "fund-lem:5": \<open>\<box>\<forall>s \<phi>{s} \<rightarrow> \<forall>s \<box>\<phi>{s}\<close>
+proof(safe intro!: "\<rightarrow>I" Situation.GEN)
+  fix s
+  AOT_assume \<open>\<box>\<forall>s \<phi>{s}\<close>
+  AOT_hence \<open>\<forall>s \<box>\<phi>{s}\<close>
+    using "Situation.res-var-bound-reas[CBF]"[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<box>\<phi>{s}\<close>
+    using "Situation.\<forall>E" by fast
+qed
+
+text\<open>Note: not explicit in PLM.\<close>
+AOT_theorem "fund-lem:5[world]": \<open>\<box>\<forall>w \<phi>{w} \<rightarrow> \<forall>w \<box>\<phi>{w}\<close>
+proof(safe intro!: "\<rightarrow>I" PossibleWorld.GEN)
+  fix w
+  AOT_assume \<open>\<box>\<forall>w \<phi>{w}\<close>
+  AOT_hence \<open>\<forall>w \<box>\<phi>{w}\<close>
+    using "PossibleWorld.res-var-bound-reas[CBF]"[THEN "\<rightarrow>E"] by blast
+  AOT_thus \<open>\<box>\<phi>{w}\<close>
+    using "PossibleWorld.\<forall>E" by fast
+qed
+
+AOT_theorem "fund-lem:6": \<open>\<forall>w w \<Turnstile> p \<rightarrow> \<box>\<forall>w w \<Turnstile> p\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<forall>w (w \<Turnstile> p)\<close>
+  AOT_hence 1: \<open>PossibleWorld(w) \<rightarrow> (w \<Turnstile> p)\<close> for w
+    using "\<forall>E"(2) by blast
+  AOT_show \<open>\<box>\<forall>w w \<Turnstile> p\<close>
+  proof(rule "raa-cor:1")
+    AOT_assume \<open>\<not>\<box>\<forall>w w \<Turnstile> p\<close>
+    AOT_hence \<open>\<diamond>\<not>\<forall>w w \<Turnstile> p\<close>
+      by (metis "KBasic:11" "\<equiv>E"(1))
+    AOT_hence \<open>\<diamond>\<exists>x (\<not>(PossibleWorld(x) \<rightarrow> x \<Turnstile> p))\<close>
+      apply (rule "RM\<diamond>"[THEN "\<rightarrow>E", rotated])
+      by (simp add: "cqt-further:2")
+    AOT_hence \<open>\<exists>x \<diamond>(\<not>(PossibleWorld(x) \<rightarrow> x \<Turnstile> p))\<close>
+      by (metis "BF\<diamond>" "vdash-properties:10")
+    then AOT_obtain x where x_prop: \<open>\<diamond>\<not>(PossibleWorld(x) \<rightarrow> x \<Turnstile> p)\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_have \<open>\<diamond>(PossibleWorld(x) & \<not>x \<Turnstile> p)\<close>
+      apply (AOT_subst \<open>PossibleWorld(x) & \<not>x \<Turnstile> p\<close>
+                       \<open>\<not>(PossibleWorld(x) \<rightarrow> x \<Turnstile> p)\<close>)
+       apply (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
+      by(fact x_prop)
+    AOT_hence 2: \<open>\<diamond>PossibleWorld(x) & \<diamond>\<not>x \<Turnstile> p\<close>
+      by (metis "KBasic2:3" "vdash-properties:10")
+    AOT_hence \<open>PossibleWorld(x)\<close>
+      using "&E"(1) "\<equiv>E"(1) "rigid-pw:2" by blast
+    AOT_hence \<open>\<box>(x \<Turnstile> p)\<close>
+      using 2[THEN "&E"(2)]  1[unconstrain w, THEN "\<rightarrow>E"] "\<rightarrow>E"
+            "rigid-truth-at:1"[unconstrain w, THEN "\<rightarrow>E"]
+      by (metis "\<equiv>E"(1))
+    moreover AOT_have \<open>\<not>\<box>(x \<Turnstile> p)\<close>
+      using 2[THEN "&E"(2)] by (metis "\<not>\<not>I" "KBasic:12" "\<equiv>E"(4))
+    ultimately AOT_show \<open>p & \<not>p\<close> for p
+      by (metis "raa-cor:3")
+  qed
+qed
+
+AOT_theorem "fund-lem:7": \<open>\<box>\<forall>w(w \<Turnstile> p) \<rightarrow> \<box>p\<close>
+proof(rule RM; rule "\<rightarrow>I")
+  AOT_modally_strict {
+    AOT_obtain w where w_prop: \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+      using "act-world:1" "PossibleWorld.\<exists>E"[rotated] by meson
+    AOT_assume \<open>\<forall>w (w \<Turnstile> p)\<close>
+    AOT_hence \<open>w \<Turnstile> p\<close>
+      using "PossibleWorld.\<forall>E" by fast
+    AOT_thus \<open>p\<close>
+      using w_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+  }
+qed
+
+AOT_theorem "fund:1": \<open>\<diamond>p \<equiv> \<exists>w w \<Turnstile> p\<close>
+proof (rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>p\<close>
+  AOT_thus \<open>\<exists>w w \<Turnstile> p\<close>
+    by (metis "fund-lem:1" "fund-lem:2" "\<rightarrow>E")
+next
+  AOT_assume \<open>\<exists>w w \<Turnstile> p\<close>
+  then AOT_obtain w where w_prop: \<open>w \<Turnstile> p\<close>
+    using "PossibleWorld.\<exists>E"[rotated] by meson
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] PossibleWorld.\<psi> "&E" by blast
+  AOT_hence \<open>\<forall>p \<diamond>(w \<Turnstile> p \<equiv> p)\<close>
+    by (metis "Buridan\<diamond>" "\<rightarrow>E")
+  AOT_hence 1: \<open>\<diamond>(w \<Turnstile> p \<equiv> p)\<close>
+    by (metis "log-prop-prop:2" "rule-ui:1")
+  AOT_have \<open>\<diamond>((w \<Turnstile> p \<rightarrow> p) & (p \<rightarrow> w \<Turnstile> p))\<close>
+    apply (AOT_subst \<open>(w \<Turnstile> p \<rightarrow> p) & (p \<rightarrow> w \<Turnstile> p)\<close> \<open>w \<Turnstile> p \<equiv> p\<close>)
+     apply (meson "conventions:3" "\<equiv>E"(6) "oth-class-taut:3:a" "\<equiv>Df")
+    by (fact 1)
+  AOT_hence \<open>\<diamond>(w \<Turnstile> p \<rightarrow> p)\<close>
+    by (metis "RM\<diamond>" "Conjunction Simplification"(1) "\<rightarrow>E")
+  moreover AOT_have \<open>\<box>(w \<Turnstile> p)\<close>
+    using w_prop by (metis "\<equiv>E"(1) "rigid-truth-at:1")
+  ultimately AOT_show \<open>\<diamond>p\<close>
+    by (metis "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+qed
+
+AOT_theorem "fund:2": \<open>\<box>p \<equiv> \<forall>w (w \<Turnstile> p)\<close>
+proof -
+  AOT_have 0: \<open>\<forall>w (w \<Turnstile> \<not>p \<equiv> \<not>w \<Turnstile> p)\<close>
+    apply (rule PossibleWorld.GEN)
+    using "coherent:1" by blast
+  AOT_have \<open>\<diamond>\<not>p \<equiv> \<exists>w (w \<Turnstile> \<not>p)\<close>
+    using "fund:1"[unvarify p, OF "log-prop-prop:2"] by blast
+  also AOT_have \<open>\<dots> \<equiv> \<exists>w \<not>(w \<Turnstile> p)\<close>
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>\<exists>w w \<Turnstile> \<not>p\<close>
+    then AOT_obtain w where w_prop: \<open>w \<Turnstile> \<not>p\<close>
+      using "PossibleWorld.\<exists>E"[rotated] by meson
+    AOT_hence \<open>\<not>w \<Turnstile> p\<close>
+      using 0[THEN "PossibleWorld.\<forall>E", THEN "\<equiv>E"(1)] "&E" by blast
+    AOT_thus \<open>\<exists>w \<not>w \<Turnstile> p\<close>
+      by (rule "PossibleWorld.\<exists>I")
+  next
+    AOT_assume \<open>\<exists>w \<not>w \<Turnstile> p\<close>
+    then AOT_obtain w where w_prop: \<open>\<not>w \<Turnstile> p\<close>
+      using "PossibleWorld.\<exists>E"[rotated] by meson
+    AOT_hence \<open>w \<Turnstile> \<not>p\<close>
+      using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] "&E"
+      by (metis "coherent:1" "\<equiv>E"(2))
+    AOT_thus \<open>\<exists>w w \<Turnstile> \<not>p\<close>
+      by (rule "PossibleWorld.\<exists>I")
+  qed
+  finally AOT_have \<open>\<not>\<diamond>\<not>p \<equiv> \<not>\<exists>w \<not>w \<Turnstile> p\<close>
+    by (meson "\<equiv>E"(1) "oth-class-taut:4:b")
+  AOT_hence \<open>\<box>p \<equiv> \<not>\<exists>w \<not>w \<Turnstile> p\<close>
+    by (metis "KBasic:12" "\<equiv>E"(5))
+  also AOT_have \<open>\<dots> \<equiv> \<forall>w w \<Turnstile> p\<close>
+  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+    AOT_assume \<open>\<not>\<exists>w \<not>w \<Turnstile> p\<close>
+    AOT_hence 0: \<open>\<forall>x (\<not>(PossibleWorld(x) & \<not>x \<Turnstile> p))\<close>
+      by (metis "cqt-further:4" "\<rightarrow>E")
+    AOT_show \<open>\<forall>w w \<Turnstile> p\<close>
+      apply (AOT_subst \<open>PossibleWorld(x) \<rightarrow> x \<Turnstile> p\<close>
+                       \<open>\<not>(PossibleWorld(x) & \<not>x \<Turnstile> p)\<close> for: x)
+       using "oth-class-taut:1:a" apply presburger
+      by (fact 0)
+  next
+    AOT_assume 0: \<open>\<forall>w w \<Turnstile> p\<close>
+    AOT_have \<open>\<forall>x (\<not>(PossibleWorld(x) & \<not>x \<Turnstile> p))\<close>
+      by (AOT_subst (reverse) \<open>\<not>(PossibleWorld(x) & \<not>x \<Turnstile> p)\<close>
+                              \<open>PossibleWorld(x) \<rightarrow> x \<Turnstile> p\<close> for: x)
+         (auto simp: "oth-class-taut:1:a" 0)
+    AOT_thus \<open>\<not>\<exists>w \<not>w \<Turnstile> p\<close>
+      by (metis "\<exists>E" "raa-cor:3" "rule-ui:3")
+  qed
+  finally AOT_show \<open>\<box>p \<equiv> \<forall>w w \<Turnstile> p\<close>.
+qed
+
+AOT_theorem "fund:3": \<open>\<not>\<diamond>p \<equiv> \<not>\<exists>w w \<Turnstile> p\<close>
+  by (metis (full_types) "contraposition:1[1]" "\<rightarrow>I" "fund:1" "\<equiv>I" "\<equiv>E"(1,2))
+
+AOT_theorem "fund:4": \<open>\<not>\<box>p \<equiv> \<exists>w \<not>w \<Turnstile>p\<close>
+  apply (AOT_subst \<open>\<exists>w \<not>w \<Turnstile> p\<close> \<open>\<not> \<forall>w w \<Turnstile> p\<close>)
+   apply (AOT_subst \<open>PossibleWorld(x) \<rightarrow> x \<Turnstile> p\<close>
+                    \<open>\<not>(PossibleWorld(x) & \<not>x \<Turnstile> p)\<close> for: x)
+  by (auto simp add: "oth-class-taut:1:a" "conventions:4" "\<equiv>Df" RN
+                     "fund:2" "rule-sub-lem:1:a")
+
+AOT_theorem "nec-dia-w:1": \<open>\<box>p \<equiv> \<exists>w w \<Turnstile> \<box>p\<close>
+proof -
+  AOT_have \<open>\<box>p \<equiv> \<diamond>\<box>p\<close>
+    using "S5Basic:2" by blast
+  also AOT_have \<open>... \<equiv> \<exists>w w \<Turnstile> \<box>p\<close>
+    using "fund:1"[unvarify p, OF "log-prop-prop:2"] by blast
+  finally show ?thesis.
+qed
+
+AOT_theorem "nec-dia-w:2": \<open>\<box>p \<equiv> \<forall>w w \<Turnstile> \<box>p\<close>
+proof -
+  AOT_have \<open>\<box>p \<equiv> \<box>\<box>p\<close>
+    using 4 "qml:2"[axiom_inst] "\<equiv>I" by blast
+  also AOT_have \<open>... \<equiv> \<forall>w w \<Turnstile> \<box>p\<close>
+    using "fund:2"[unvarify p, OF "log-prop-prop:2"] by blast
+  finally show ?thesis.
+qed
+
+AOT_theorem "nec-dia-w:3": \<open>\<diamond>p \<equiv> \<exists>w w \<Turnstile> \<diamond>p\<close>
+proof -
+  AOT_have \<open>\<diamond>p \<equiv> \<diamond>\<diamond>p\<close>
+    by (simp add: "4\<diamond>" "T\<diamond>" "\<equiv>I")
+  also AOT_have \<open>... \<equiv> \<exists>w w \<Turnstile> \<diamond>p\<close>
+    using "fund:1"[unvarify p, OF "log-prop-prop:2"] by blast
+  finally show ?thesis.
+qed
+
+AOT_theorem "nec-dia-w:4": \<open>\<diamond>p \<equiv> \<forall>w w \<Turnstile> \<diamond>p\<close>
+proof -
+  AOT_have \<open>\<diamond>p \<equiv> \<box>\<diamond>p\<close>
+    by (simp add: "S5Basic:1")
+  also AOT_have \<open>... \<equiv> \<forall>w w \<Turnstile> \<diamond>p\<close>
+    using "fund:2"[unvarify p, OF "log-prop-prop:2"] by blast
+  finally show ?thesis.
+qed
+
+AOT_theorem "conj-dist-w:1": \<open>w \<Turnstile> (p & q) \<equiv> ((w \<Turnstile> p) & (w \<Turnstile> q))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>w \<Turnstile> (p & q)\<close>
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (p & q)\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> (\<phi> & \<psi>)) \<rightarrow> (w \<Turnstile> \<phi> & w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> (\<phi> & \<psi>) \<equiv> (\<phi> & \<psi>)\<close> and \<open>w \<Turnstile> \<phi> \<equiv> \<phi>\<close> and \<open>w \<Turnstile> \<psi> \<equiv> \<psi>\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+      moreover AOT_assume \<open>w \<Turnstile> (\<phi> & \<psi>)\<close>
+      ultimately AOT_show \<open>w \<Turnstile> \<phi> & w \<Turnstile> \<psi>\<close>
+        by (metis "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "\<equiv>E"(2))
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>(w \<Turnstile> (\<phi> & \<psi>) \<rightarrow> w \<Turnstile> \<phi> & w \<Turnstile> \<psi>)\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>(w \<Turnstile> (p & q) \<rightarrow> w \<Turnstile> p & w \<Turnstile> q)\<close> using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> p) & \<diamond>(w \<Turnstile> q)\<close>
+    by (metis 0 "KBasic2:3" "KBasic2:4" "\<equiv>E"(1) "vdash-properties:10")
+  AOT_thus \<open>w \<Turnstile> p & w \<Turnstile> q\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+          "&E" "&I" by meson
+next
+  AOT_assume \<open>w \<Turnstile> p & w \<Turnstile> q\<close>
+  AOT_hence \<open>\<box>w \<Turnstile> p & \<box>w \<Turnstile> q\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+          "&E" "&I" by blast
+  AOT_hence 0: \<open>\<box>(w \<Turnstile> p & w \<Turnstile> q)\<close>
+    by (metis "KBasic:3" "\<equiv>E"(2))
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> \<phi> & w \<Turnstile> \<psi>) \<rightarrow> (w \<Turnstile> (\<phi> & \<psi>)))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> (\<phi> & \<psi>) \<equiv> (\<phi> & \<psi>)\<close> and \<open>w \<Turnstile> \<phi> \<equiv> \<phi>\<close> and \<open>w \<Turnstile> \<psi> \<equiv> \<psi>\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+      moreover AOT_assume \<open>w \<Turnstile> \<phi> & w \<Turnstile> \<psi>\<close>
+      ultimately AOT_show \<open>w \<Turnstile> (\<phi> & \<psi>)\<close>
+        by (metis "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "\<equiv>E"(2))
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>((w \<Turnstile> \<phi> & w \<Turnstile> \<psi>) \<rightarrow> w \<Turnstile> (\<phi> & \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>((w \<Turnstile> p & w \<Turnstile> q) \<rightarrow> w \<Turnstile> (p & q))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (p & q))\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "vdash-properties:10")
+  AOT_thus \<open>w \<Turnstile> (p & q)\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+qed
+
+AOT_theorem "conj-dist-w:2": \<open>w \<Turnstile> (p \<rightarrow> q) \<equiv> ((w \<Turnstile> p) \<rightarrow> (w \<Turnstile> q))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>w \<Turnstile> (p \<rightarrow> q)\<close>
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (p \<rightarrow> q)\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+  AOT_assume \<open>w \<Turnstile> p\<close>
+  AOT_hence 1: \<open>\<box>w \<Turnstile> p\<close>
+    by (metis "T\<diamond>" "\<equiv>E"(1) "rigid-truth-at:3" "\<rightarrow>E")
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> (\<phi> \<rightarrow> \<psi>)) \<rightarrow> (w \<Turnstile> \<phi> \<rightarrow> w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> (\<phi> \<rightarrow> \<psi>) \<equiv> (\<phi> \<rightarrow> \<psi>)\<close> and \<open>w \<Turnstile> \<phi> \<equiv> \<phi>\<close> and \<open>w \<Turnstile> \<psi> \<equiv> \<psi>\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+      moreover AOT_assume \<open>w \<Turnstile> (\<phi> \<rightarrow> \<psi>)\<close>
+      moreover AOT_assume \<open>w \<Turnstile> \<phi>\<close>
+      ultimately AOT_show \<open>w \<Turnstile> \<psi>\<close>
+        by (metis "\<equiv>E"(1) "\<equiv>E"(2) "\<rightarrow>E")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>(w \<Turnstile> (\<phi> \<rightarrow> \<psi>) \<rightarrow> (w \<Turnstile> \<phi> \<rightarrow> w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>(w \<Turnstile> (p \<rightarrow> q) \<rightarrow> (w \<Turnstile> p \<rightarrow> w \<Turnstile> q))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> p \<rightarrow> w \<Turnstile> q)\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_hence \<open>\<diamond>w \<Turnstile> q\<close> 
+    by (metis 1 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> q\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+          "&E" "&I" by meson
+next
+  AOT_assume \<open>w \<Turnstile> p \<rightarrow> w \<Turnstile> q\<close>
+  AOT_hence \<open>\<not>(w \<Turnstile> p) \<or> w \<Turnstile> q\<close>
+    by (metis "\<or>I"(1) "\<or>I"(2) "reductio-aa:1" "\<rightarrow>E")
+  AOT_hence \<open>w \<Turnstile> \<not>p \<or> w \<Turnstile> q\<close>
+    by (metis "coherent:1" "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(2) "reductio-aa:1")
+  AOT_hence 0: \<open>\<box>(w \<Turnstile> \<not>p \<or> w \<Turnstile> q)\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by (metis "KBasic:15" "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "reductio-aa:1" "\<rightarrow>E")
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> \<not>\<phi> \<or> w \<Turnstile> \<psi>) \<rightarrow> (w \<Turnstile> (\<phi> \<rightarrow> \<psi>)))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>w \<Turnstile> \<not>\<phi> \<or> w \<Turnstile> \<psi>\<close>
+      ultimately AOT_show \<open>w \<Turnstile> (\<phi> \<rightarrow> \<psi>)\<close>
+        by (metis "\<or>E"(2) "\<rightarrow>I" "\<equiv>E"(1) "\<equiv>E"(2) "log-prop-prop:2"
+                  "reductio-aa:1" "rule-ui:1")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>((w \<Turnstile> \<not>\<phi> \<or> w \<Turnstile> \<psi>) \<rightarrow> w \<Turnstile> (\<phi> \<rightarrow> \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>((w \<Turnstile> \<not>p \<or> w \<Turnstile> q) \<rightarrow> w \<Turnstile> (p \<rightarrow> q))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (p \<rightarrow> q))\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> (p \<rightarrow> q)\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+qed
+
+AOT_theorem "conj-dist-w:3": \<open>w \<Turnstile> (p \<or> q) \<equiv> ((w \<Turnstile> p) \<or> (w \<Turnstile> q))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>w \<Turnstile> (p \<or> q)\<close>
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (p \<or> q)\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> (\<phi> \<or> \<psi>)) \<rightarrow> (w \<Turnstile> \<phi> \<or> w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> (\<phi> \<or> \<psi>) \<equiv> (\<phi> \<or> \<psi>)\<close> and \<open>w \<Turnstile> \<phi> \<equiv> \<phi>\<close> and \<open>w \<Turnstile> \<psi> \<equiv> \<psi>\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+      moreover AOT_assume \<open>w \<Turnstile> (\<phi> \<or> \<psi>)\<close>
+      ultimately AOT_show \<open>w \<Turnstile> \<phi> \<or> w \<Turnstile> \<psi>\<close>
+        by (metis "\<or>I"(1) "\<or>I"(2) "\<or>E"(3) "\<equiv>E"(1) "\<equiv>E"(2) "reductio-aa:1")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>(w \<Turnstile> (\<phi> \<or> \<psi>) \<rightarrow> (w \<Turnstile> \<phi> \<or> w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>(w \<Turnstile> (p \<or> q) \<rightarrow> (w \<Turnstile> p \<or> w \<Turnstile> q))\<close> using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> p \<or> w \<Turnstile> q)\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "vdash-properties:10")
+  AOT_hence \<open>\<diamond>w \<Turnstile> p \<or> \<diamond>w \<Turnstile> q\<close>
+    using "KBasic2:2"[THEN "\<equiv>E"(1)] by blast
+  AOT_thus \<open>w \<Turnstile> p \<or> w \<Turnstile> q\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by (metis "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "reductio-aa:1")
+next
+  AOT_assume \<open>w \<Turnstile> p \<or> w \<Turnstile> q\<close>
+  AOT_hence 0: \<open>\<box>(w \<Turnstile> p \<or> w \<Turnstile> q)\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by (metis "KBasic:15" "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "reductio-aa:1" "\<rightarrow>E")
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> \<phi> \<or> w \<Turnstile> \<psi>) \<rightarrow> (w \<Turnstile> (\<phi> \<or> \<psi>)))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>w \<Turnstile> \<phi> \<or> w \<Turnstile> \<psi>\<close>
+      ultimately AOT_show \<open>w \<Turnstile> (\<phi> \<or> \<psi>)\<close>
+        by (metis "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(1) "\<equiv>E"(2)
+                  "log-prop-prop:2" "reductio-aa:1" "rule-ui:1")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>((w \<Turnstile> \<phi> \<or> w \<Turnstile> \<psi>) \<rightarrow> w \<Turnstile> (\<phi> \<or> \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>((w \<Turnstile> p \<or> w \<Turnstile> q) \<rightarrow> w \<Turnstile> (p \<or> q))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (p \<or> q))\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> (p \<or> q)\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+qed
+
+AOT_theorem "conj-dist-w:4": \<open>w \<Turnstile> (p \<equiv> q) \<equiv> ((w \<Turnstile> p) \<equiv> (w \<Turnstile> q))\<close>
+proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+  AOT_assume \<open>w \<Turnstile> (p \<equiv> q)\<close>
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (p \<equiv> q)\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> (\<phi> \<equiv> \<psi>)) \<rightarrow> (w \<Turnstile> \<phi> \<equiv> w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      AOT_hence \<open>w \<Turnstile> (\<phi> \<equiv> \<psi>) \<equiv> (\<phi> \<equiv> \<psi>)\<close> and \<open>w \<Turnstile> \<phi> \<equiv> \<phi>\<close> and \<open>w \<Turnstile> \<psi> \<equiv> \<psi>\<close>
+        using "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by blast+
+      moreover AOT_assume \<open>w \<Turnstile> (\<phi> \<equiv> \<psi>)\<close>
+      ultimately AOT_show \<open>w \<Turnstile> \<phi> \<equiv> w \<Turnstile> \<psi>\<close>
+        by (metis "\<equiv>E"(2) "\<equiv>E"(5) "Commutativity of \<equiv>")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>(w \<Turnstile> (\<phi> \<equiv> \<psi>) \<rightarrow> (w \<Turnstile> \<phi> \<equiv> w \<Turnstile> \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>(w \<Turnstile> (p \<equiv> q) \<rightarrow> (w \<Turnstile> p \<equiv> w \<Turnstile> q))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence 1: \<open>\<diamond>(w \<Turnstile> p \<equiv> w \<Turnstile> q)\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "vdash-properties:10")
+  AOT_have \<open>\<diamond>((w \<Turnstile> p \<rightarrow> w \<Turnstile> q) & (w \<Turnstile> q \<rightarrow> w \<Turnstile> p))\<close>
+    apply (AOT_subst \<open>(w \<Turnstile> p \<rightarrow> w \<Turnstile> q) & (w \<Turnstile> q \<rightarrow> w \<Turnstile> p)\<close> \<open>w \<Turnstile> p \<equiv> w \<Turnstile> q\<close>)
+     apply (meson "\<equiv>\<^sub>d\<^sub>fE" "conventions:3" "\<rightarrow>I" "df-rules-formulas[4]" "\<equiv>I")
+    by (fact 1)
+  AOT_hence 2: \<open>\<diamond>(w \<Turnstile> p \<rightarrow> w \<Turnstile> q) & \<diamond>(w \<Turnstile> q \<rightarrow> w \<Turnstile> p)\<close>
+    by (metis "KBasic2:3" "vdash-properties:10")
+  AOT_have \<open>\<diamond>(\<not>w \<Turnstile> p \<or> w \<Turnstile> q)\<close> and \<open>\<diamond>(\<not>w \<Turnstile> q \<or> w \<Turnstile> p)\<close>
+     apply (AOT_subst (reverse) \<open>\<not>w \<Turnstile> p \<or> w \<Turnstile> q\<close> \<open>w \<Turnstile> p \<rightarrow> w \<Turnstile> q\<close>)
+      apply (simp add: "oth-class-taut:1:c")
+     apply (fact 2[THEN "&E"(1)])
+    apply (AOT_subst (reverse) \<open>\<not>w \<Turnstile> q \<or> w \<Turnstile> p\<close> \<open>w \<Turnstile> q \<rightarrow> w \<Turnstile> p\<close>)
+     apply (simp add: "oth-class-taut:1:c")
+    by (fact 2[THEN "&E"(2)])
+  AOT_hence \<open>\<diamond>(\<not>w \<Turnstile> p) \<or> \<diamond>w \<Turnstile> q\<close> and \<open>\<diamond>\<not>w \<Turnstile> q \<or> \<diamond>w \<Turnstile> p\<close>
+    using "KBasic2:2" "\<equiv>E"(1) by blast+
+  AOT_hence \<open>\<not>\<box>w \<Turnstile> p \<or> \<diamond>w \<Turnstile> q\<close> and \<open>\<not>\<box>w \<Turnstile> q \<or> \<diamond>w \<Turnstile> p\<close>
+    by (metis "KBasic:11" "\<or>I"(1) "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(2) "raa-cor:1")+
+  AOT_thus \<open>w \<Turnstile> p \<equiv> w \<Turnstile> q\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by (metis "\<not>\<not>I" "T\<diamond>" "\<or>E"(2) "\<rightarrow>I" "\<equiv>I" "\<equiv>E"(1) "rigid-truth-at:3")
+next
+  AOT_have \<open>\<box>PossibleWorld(w)\<close>
+    using "\<equiv>E"(1) "rigid-pw:1" PossibleWorld.\<psi> by blast
+  moreover {
+    fix p
+    AOT_modally_strict {
+      AOT_have \<open>PossibleWorld(w) \<rightarrow> (w \<Turnstile> p \<rightarrow> \<box>w \<Turnstile> p)\<close>
+        using "rigid-truth-at:1" "\<rightarrow>I"
+        by (metis "\<equiv>E"(1))
+    }
+    AOT_hence \<open>\<box>PossibleWorld(w) \<rightarrow> \<box>(w \<Turnstile> p \<rightarrow> \<box>w \<Turnstile> p)\<close>
+      by (rule RM)
+  }
+  ultimately AOT_have 1: \<open>\<box>(w \<Turnstile> p \<rightarrow> \<box>w \<Turnstile> p)\<close> for p
+    by (metis "\<rightarrow>E")
+  AOT_assume \<open>w \<Turnstile> p \<equiv> w \<Turnstile> q\<close>
+  AOT_hence 0: \<open>\<box>(w \<Turnstile> p \<equiv> w \<Turnstile> q)\<close>
+    using "sc-eq-box-box:5"[THEN "\<rightarrow>E", THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
+                            THEN "\<rightarrow>E", OF "&I"]
+          by (metis "1")
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> \<phi> \<equiv> w \<Turnstile> \<psi>) \<rightarrow> (w \<Turnstile> (\<phi> \<equiv> \<psi>)))\<close> for w \<phi> \<psi>
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>w \<Turnstile> \<phi> \<equiv> w \<Turnstile> \<psi>\<close>
+      ultimately AOT_show \<open>w \<Turnstile> (\<phi> \<equiv> \<psi>)\<close>
+        by (metis "\<equiv>E"(2) "\<equiv>E"(6) "log-prop-prop:2" "rule-ui:1")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>((w \<Turnstile> \<phi> \<equiv> w \<Turnstile> \<psi>) \<rightarrow> w \<Turnstile> (\<phi> \<equiv> \<psi>))\<close> for w \<phi> \<psi>
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>((w \<Turnstile> p \<equiv>  w \<Turnstile> q) \<rightarrow> w \<Turnstile> (p \<equiv> q))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (p \<equiv> q))\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> (p \<equiv> q)\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+qed
+
+AOT_theorem "conj-dist-w:5": \<open>w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>}) \<equiv> (\<forall> \<alpha> (w \<Turnstile> \<phi>{\<alpha>}))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  AOT_assume \<open>w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})\<close>
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})) \<rightarrow> (\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}))\<close> for w
+    proof(safe intro!: "\<rightarrow>I" GEN)
+      AOT_assume \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})\<close>
+      ultimately AOT_show \<open>w \<Turnstile> \<phi>{\<alpha>}\<close> for \<alpha>
+        by (metis "\<equiv>E"(1) "\<equiv>E"(2) "log-prop-prop:2" "rule-ui:1" "rule-ui:3")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>(w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>}) \<rightarrow> (\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}))\<close> for w
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>(w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>}) \<rightarrow> (\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}))\<close> using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>})\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_hence \<open>\<forall>\<alpha> \<diamond>w \<Turnstile> \<phi>{\<alpha>}\<close>
+    by (metis "Buridan\<diamond>" "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> \<phi>{\<alpha>}\<close> for \<alpha>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+          "\<forall>E"(2) by blast
+next
+  AOT_assume \<open>\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close>
+  AOT_hence \<open>w \<Turnstile> \<phi>{\<alpha>}\<close> for \<alpha> using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<box>w \<Turnstile> \<phi>{\<alpha>}\<close> for \<alpha>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+          "&E" "&I" by blast
+  AOT_hence \<open>\<forall>\<alpha> \<box>w \<Turnstile> \<phi>{\<alpha>}\<close> by (rule GEN)
+  AOT_hence 0: \<open>\<box>\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close> by (rule BF[THEN "\<rightarrow>E"])
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}) \<rightarrow> (w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})))\<close> for w
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close>
+      ultimately AOT_show \<open>w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})\<close>
+        by (metis "\<equiv>E"(1) "\<equiv>E"(2) "log-prop-prop:2" "rule-ui:1"
+                  "rule-ui:3" "universal-cor")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>((\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}) \<rightarrow> w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>}))\<close> for w
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>((\<forall>\<alpha> w \<Turnstile> \<phi>{\<alpha>}) \<rightarrow> w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>}))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>}))\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> (\<forall>\<alpha> \<phi>{\<alpha>})\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+qed
+
+AOT_theorem "conj-dist-w:6": \<open>w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>}) \<equiv> (\<exists> \<alpha> (w \<Turnstile> \<phi>{\<alpha>}))\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  AOT_assume \<open>w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})\<close>
+  AOT_hence 0: \<open>\<box>w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})) \<rightarrow> (\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}))\<close> for w
+    proof(safe intro!: "\<rightarrow>I" GEN)
+      AOT_assume \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})\<close>
+      ultimately AOT_show \<open>\<exists> \<alpha> (w \<Turnstile> \<phi>{\<alpha>})\<close>
+        by (metis "\<exists>E" "\<exists>I"(2) "\<equiv>E"(1,2) "log-prop-prop:2" "rule-ui:1") 
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>(w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>}) \<rightarrow> (\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}))\<close> for w
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>(w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>}) \<rightarrow> (\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}))\<close> using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>})\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_hence \<open>\<exists>\<alpha> \<diamond>w \<Turnstile> \<phi>{\<alpha>}\<close>
+    by (metis "BF\<diamond>" "\<rightarrow>E")
+  then AOT_obtain \<alpha> where \<open>\<diamond>w \<Turnstile> \<phi>{\<alpha>}\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>w \<Turnstile> \<phi>{\<alpha>}\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"] by blast
+  AOT_thus \<open>\<exists> \<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close> by (rule "\<exists>I")
+next
+  AOT_assume \<open>\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close>
+  then AOT_obtain \<alpha> where \<open>w \<Turnstile> \<phi>{\<alpha>}\<close> using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>w \<Turnstile> \<phi>{\<alpha>}\<close>
+    using "rigid-truth-at:1"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+          "&E" "&I" by blast
+  AOT_hence \<open>\<exists>\<alpha> \<box>w \<Turnstile> \<phi>{\<alpha>}\<close>
+    by (rule "\<exists>I")
+  AOT_hence 0: \<open>\<box>\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close>
+    by (metis Buridan "\<rightarrow>E")
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> ((\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}) \<rightarrow> (w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})))\<close> for w
+    proof(safe intro!: "\<rightarrow>I")
+      AOT_assume \<open>\<forall> p (w \<Turnstile> p \<equiv> p)\<close>
+      moreover AOT_assume \<open>\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}\<close>
+      then AOT_obtain \<alpha> where \<open>w \<Turnstile> \<phi>{\<alpha>}\<close>
+        using "\<exists>E"[rotated] by blast
+      ultimately AOT_show \<open>w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})\<close>
+        by (metis "\<exists>I"(2) "\<equiv>E"(1,2) "log-prop-prop:2" "rule-ui:1")
+    qed
+  }
+  AOT_hence \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p) \<rightarrow> \<diamond>((\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}) \<rightarrow> w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>}))\<close> for w
+    by (rule "RM\<diamond>")
+  moreover AOT_have pos: \<open>\<diamond>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF PossibleWorld.\<psi>] "&E" by blast
+  ultimately AOT_have \<open>\<diamond>((\<exists>\<alpha> w \<Turnstile> \<phi>{\<alpha>}) \<rightarrow> w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>}))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence \<open>\<diamond>(w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>}))\<close>
+    by (metis 0 "KBasic2:4" "\<equiv>E"(1) "\<rightarrow>E")
+  AOT_thus \<open>w \<Turnstile> (\<exists>\<alpha> \<phi>{\<alpha>})\<close>
+    using "rigid-truth-at:2"[unvarify p, THEN "\<equiv>E"(1), OF "log-prop-prop:2"]
+    by blast
+qed
+
+AOT_theorem "conj-dist-w:7": \<open>(w \<Turnstile> \<box>p) \<rightarrow> \<box>w \<Turnstile> p\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>w \<Turnstile> \<box>p\<close>
+  AOT_hence \<open>\<exists>w w \<Turnstile> \<box>p\<close> by (rule "PossibleWorld.\<exists>I")
+  AOT_hence \<open>\<diamond>\<box>p\<close> using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
+    by blast
+  AOT_hence \<open>\<box>p\<close>
+    by (metis "5\<diamond>" "\<rightarrow>E")
+  AOT_hence 1: \<open>\<box>\<box>p\<close>
+    by (metis "S5Basic:6" "\<equiv>E"(1))
+  AOT_have \<open>\<box>\<forall>w w \<Turnstile> p\<close>
+    by (AOT_subst (reverse) \<open>\<forall>w w \<Turnstile> p\<close> \<open>\<box>p\<close>)
+       (auto simp add: "fund:2" 1)
+  AOT_hence \<open>\<forall>w \<box>w \<Turnstile> p\<close>
+    using "fund-lem:5[world]"[THEN "\<rightarrow>E"] by simp
+  AOT_thus \<open>\<box>w \<Turnstile> p\<close>
+    using "\<rightarrow>E" "PossibleWorld.\<forall>E" by fast
+qed
+
+AOT_theorem "conj-dist-w:8": \<open>\<exists>w\<exists>p((\<box>w \<Turnstile> p) & \<not>w \<Turnstile> \<box>p)\<close>
+proof -
+  AOT_obtain r where A: r and \<open>\<diamond>\<not>r\<close>
+    by (metis "&E"(1) "&E"(2) "\<equiv>\<^sub>d\<^sub>fE" "\<exists>E" "cont-tf:1" "cont-tf-thm:1")
+  AOT_hence B: \<open>\<not>\<box>r\<close>
+    by (metis "KBasic:11" "\<equiv>E"(2))
+  AOT_have \<open>\<diamond>r\<close>
+    using A "T\<diamond>"[THEN "\<rightarrow>E"] by simp
+  AOT_hence \<open>\<exists>w w \<Turnstile> r\<close>
+    using "fund:1"[THEN "\<equiv>E"(1)] by blast
+  then AOT_obtain w where w: \<open>w \<Turnstile> r\<close>
+    using "PossibleWorld.\<exists>E"[rotated] by meson
+  AOT_hence \<open>\<box>w \<Turnstile> r\<close>
+    by (metis "T\<diamond>" "\<equiv>E"(1) "rigid-truth-at:3" "vdash-properties:10")
+  moreover AOT_have \<open>\<not>w \<Turnstile> \<box>r\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>w \<Turnstile> \<box>r\<close>
+    AOT_hence \<open>\<exists>w w \<Turnstile> \<box>r\<close>
+      by (rule "PossibleWorld.\<exists>I")
+    AOT_hence \<open>\<box>r\<close>
+      by (metis "\<equiv>E"(2) "nec-dia-w:1")
+    AOT_thus \<open>\<box>r & \<not>\<box>r\<close>
+      using B "&I" by blast
+  qed
+  ultimately AOT_have \<open>\<box>w \<Turnstile> r & \<not>w \<Turnstile> \<box>r\<close>
+    by (rule "&I")
+  AOT_hence \<open>\<exists>p (\<box>w \<Turnstile> p & \<not>w \<Turnstile> \<box>p)\<close>
+    by (rule "\<exists>I")
+  thus ?thesis
+    by (rule "PossibleWorld.\<exists>I")
+qed
+
+AOT_theorem "conj-dist-w:9": \<open>(\<diamond>w \<Turnstile> p) \<rightarrow> w \<Turnstile> \<diamond>p\<close>
+proof(rule "\<rightarrow>I"; rule "raa-cor:1")
+  AOT_assume \<open>\<diamond>w \<Turnstile> p\<close>
+  AOT_hence 0: \<open>w \<Turnstile> p\<close>
+    by (metis "\<equiv>E"(1) "rigid-truth-at:2")
+  AOT_assume \<open>\<not>w \<Turnstile> \<diamond>p\<close>
+  AOT_hence 1: \<open>w \<Turnstile> \<not>\<diamond>p\<close>
+    using "coherent:1"[unvarify p, THEN "\<equiv>E"(2), OF "log-prop-prop:2"] by blast
+  moreover AOT_have \<open>w \<Turnstile> (\<not>\<diamond>p \<rightarrow> \<not>p)\<close>
+    using "T\<diamond>"[THEN "contraposition:1[1]", THEN RN]
+          "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1), THEN "\<forall>E"(2),
+                   THEN "\<rightarrow>E", rotated, OF PossibleWorld.\<psi>]
+          by blast
+  ultimately AOT_have \<open>w \<Turnstile> \<not>p\<close>
+    using "conj-dist-w:2"[unvarify p q, OF "log-prop-prop:2", OF "log-prop-prop:2",
+                          THEN "\<equiv>E"(1), THEN "\<rightarrow>E"]
+    by blast
+  AOT_hence \<open>w \<Turnstile> p & w \<Turnstile> \<not>p\<close> using 0 "&I" by blast
+  AOT_thus \<open>p & \<not>p\<close>
+    by (metis "coherent:1" "Conjunction Simplification"(1,2) "\<equiv>E"(4)
+              "modus-tollens:1" "raa-cor:3")
+qed
+
+AOT_theorem "conj-dist-w:10": \<open>\<exists>w\<exists>p((w \<Turnstile> \<diamond>p) & \<not>\<diamond>w \<Turnstile> p)\<close>
+proof -
+  AOT_obtain w where w: \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "act-world:1" "PossibleWorld.\<exists>E"[rotated] by meson
+  AOT_obtain r where \<open>\<not>r\<close> and \<open>\<diamond>r\<close>
+    using "cont-tf-thm:2" "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<exists>E"[rotated] by metis
+  AOT_hence \<open>w \<Turnstile> \<not>r\<close> and 0: \<open>w \<Turnstile> \<diamond>r\<close>
+    using w[THEN "\<forall>E"(1), OF "log-prop-prop:2", THEN "\<equiv>E"(2)] by blast+
+  AOT_hence \<open>\<not>w \<Turnstile> r\<close> using "coherent:1"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<not>\<diamond>w \<Turnstile> r\<close> by (metis "\<equiv>E"(4) "rigid-truth-at:2")
+  AOT_hence \<open>w \<Turnstile> \<diamond>r & \<not>\<diamond>w \<Turnstile> r\<close> using 0 "&I" by blast
+  AOT_hence \<open>\<exists>p (w \<Turnstile> \<diamond>p & \<not>\<diamond>w \<Turnstile> p)\<close> by (rule "\<exists>I")
+  thus ?thesis by (rule "PossibleWorld.\<exists>I")
+qed
+
+AOT_theorem "two-worlds-exist:1": \<open>\<exists>p(ContingentlyTrue(p)) \<rightarrow> \<exists>w (\<not>Actual(w))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>p ContingentlyTrue(p)\<close>
+  then AOT_obtain p where \<open>ContingentlyTrue(p)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence p: \<open>p & \<diamond>\<not>p\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "cont-tf:1")
+  AOT_hence \<open>\<exists>w w \<Turnstile> \<not>p\<close>
+    using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] "&E" by blast
+  then AOT_obtain w where w: \<open>w \<Turnstile> \<not>p\<close>
+    using "PossibleWorld.\<exists>E"[rotated] by meson
+  AOT_have \<open>\<not>Actual(w)\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>Actual(w)\<close>
+    AOT_hence \<open>w \<Turnstile> p\<close>
+      using p[THEN "&E"(1)] actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
+      by (metis "log-prop-prop:2" "raa-cor:3" "rule-ui:1" "\<rightarrow>E" w)
+    moreover AOT_have \<open>\<not>(w \<Turnstile> p)\<close>
+      by (metis "coherent:1" "\<equiv>E"(4) "reductio-aa:2" w) 
+    ultimately AOT_show \<open>w \<Turnstile> p & \<not>(w \<Turnstile> p)\<close>
+      using "&I" by blast
+  qed
+  AOT_thus \<open>\<exists>w \<not>Actual(w)\<close>
+    by (rule "PossibleWorld.\<exists>I")
+qed
+
+
+AOT_theorem "two-worlds-exist:2": \<open>\<exists>p(ContingentlyFalse(p)) \<rightarrow> \<exists>w (\<not>Actual(w))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>p ContingentlyFalse(p)\<close>
+  then AOT_obtain p where \<open>ContingentlyFalse(p)\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence p: \<open>\<not>p & \<diamond>p\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "cont-tf:2")
+  AOT_hence \<open>\<exists>w w \<Turnstile> p\<close>
+    using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] "&E" by blast
+  then AOT_obtain w where w: \<open>w \<Turnstile> p\<close>
+    using "PossibleWorld.\<exists>E"[rotated] by meson
+  moreover AOT_have \<open>\<not>Actual(w)\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>Actual(w)\<close>
+    AOT_hence \<open>w \<Turnstile> \<not>p\<close>
+      using p[THEN "&E"(1)] actual[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
+      by (metis "log-prop-prop:2" "raa-cor:3" "rule-ui:1" "\<rightarrow>E" w)
+    moreover AOT_have \<open>\<not>(w \<Turnstile> p)\<close>
+      using calculation by (metis "coherent:1" "\<equiv>E"(4) "reductio-aa:2") 
+    AOT_thus \<open>w \<Turnstile> p & \<not>(w \<Turnstile> p)\<close>
+      using "&I" w by metis
+  qed
+  AOT_thus \<open>\<exists>w \<not>Actual(w)\<close>
+    by (rule "PossibleWorld.\<exists>I")
+qed
+
+AOT_theorem "two-worlds-exist:3": \<open>\<exists>w \<not>Actual(w)\<close>
+  using "cont-tf-thm:1" "two-worlds-exist:1" "\<rightarrow>E" by blast
+
+AOT_theorem "two-worlds-exist:4": \<open>\<exists>w\<exists>w'(w \<noteq> w')\<close>
+proof -
+  AOT_obtain w where w: \<open>Actual(w)\<close>
+    using "act-world:2"[THEN "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
+                        THEN "cqt-further:5"[THEN "\<rightarrow>E"]]
+          "PossibleWorld.\<exists>E"[rotated] "&E"
+    by blast
+  moreover AOT_obtain w' where w': \<open>\<not>Actual(w')\<close>
+    using "two-worlds-exist:3" "PossibleWorld.\<exists>E"[rotated] by meson
+  AOT_have \<open>\<not>(w = w')\<close>
+  proof(rule "raa-cor:2")
+    AOT_assume \<open>w = w'\<close>
+    AOT_thus \<open>p & \<not>p\<close> for p
+      using w w' "&E" by (metis "rule=E" "raa-cor:3")
+  qed
+  AOT_hence \<open>w \<noteq> w'\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fI" "=-infix")
+  AOT_hence \<open>\<exists>w' w \<noteq> w'\<close>
+    by (rule "PossibleWorld.\<exists>I")
+  thus ?thesis
+    by (rule "PossibleWorld.\<exists>I")
+qed
+
+(* TODO: more theorems *)
+
+AOT_theorem "w-rel:1": \<open>[\<lambda>x \<phi>{x}]\<down> \<rightarrow> [\<lambda>x w \<Turnstile> \<phi>{x}]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+  AOT_hence \<open>\<box>[\<lambda>x \<phi>{x}]\<down>\<close>
+    by (metis "exist-nec" "\<rightarrow>E")
+  moreover AOT_have
+    \<open>\<box>[\<lambda>x \<phi>{x}]\<down> \<rightarrow> \<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> ((w \<Turnstile> \<phi>{x}) \<equiv> ( w \<Turnstile> \<phi>{y})))\<close>
+  proof (rule RM; rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      fix x y
+      AOT_assume \<open>[\<lambda>x \<phi>{x}]\<down>\<close>
+      AOT_hence \<open>\<forall>x\<forall>y (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>(\<phi>{x} \<equiv> \<phi>{y}))\<close>
+        using "&E" "kirchner-thm-cor:1"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>(\<phi>{x} \<equiv> \<phi>{y})\<close>
+        using "\<forall>E"(2) by blast
+      moreover AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
+      ultimately AOT_have \<open>\<box>(\<phi>{x} \<equiv> \<phi>{y})\<close>
+        using "\<rightarrow>E" by blast
+      AOT_hence \<open>\<forall>w (w \<Turnstile> (\<phi>{x} \<equiv> \<phi>{y}))\<close>
+        using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+      AOT_hence \<open>w \<Turnstile> (\<phi>{x} \<equiv> \<phi>{y})\<close>
+        using "\<forall>E"(2) using PossibleWorld.\<psi> "\<rightarrow>E" by blast
+      AOT_thus \<open>(w \<Turnstile> \<phi>{x}) \<equiv> (w \<Turnstile> \<phi>{y})\<close>
+        using "conj-dist-w:4"[unvarify p q, OF "log-prop-prop:2",
+                              OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+  ultimately AOT_have \<open>\<box>\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> ((w \<Turnstile> \<phi>{x}) \<equiv> ( w \<Turnstile> \<phi>{y})))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_thus \<open>[\<lambda>x w \<Turnstile> \<phi>{x}]\<down>\<close>
+    using "kirchner-thm:1"[THEN "\<equiv>E"(2)] by fast
+qed
+
+AOT_theorem "w-rel:2": \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down> \<rightarrow> [\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+  AOT_hence \<open>\<box>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+    by (metis "exist-nec" "\<rightarrow>E")
+  moreover AOT_have \<open>\<box>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down> \<rightarrow> \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n(
+    \<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> ((w \<Turnstile> \<phi>{x\<^sub>1...x\<^sub>n}) \<equiv> ( w \<Turnstile> \<phi>{y\<^sub>1...y\<^sub>n})))\<close>
+  proof (rule RM; rule "\<rightarrow>I"; rule GEN; rule GEN; rule "\<rightarrow>I")
+    AOT_modally_strict {
+      fix x\<^sub>1x\<^sub>n y\<^sub>1y\<^sub>n
+      AOT_assume \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n (
+        \<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> \<box>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+        using "&E" "kirchner-thm-cor:2"[THEN "\<rightarrow>E"] by blast
+      AOT_hence \<open>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> \<box>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+        using "\<forall>E"(2) by blast
+      moreover AOT_assume \<open>\<forall>F ([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n)\<close>
+      ultimately AOT_have \<open>\<box>(\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+        using "\<rightarrow>E" by blast
+      AOT_hence \<open>\<forall>w (w \<Turnstile> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n}))\<close>
+        using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+      AOT_hence \<open>w \<Turnstile> (\<phi>{x\<^sub>1...x\<^sub>n} \<equiv> \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+        using "\<forall>E"(2) using PossibleWorld.\<psi> "\<rightarrow>E" by blast
+      AOT_thus \<open>(w \<Turnstile> \<phi>{x\<^sub>1...x\<^sub>n}) \<equiv> (w \<Turnstile> \<phi>{y\<^sub>1...y\<^sub>n})\<close>
+        using "conj-dist-w:4"[unvarify p q, OF "log-prop-prop:2",
+                              OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+    }
+  qed
+  ultimately AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n\<forall>y\<^sub>1...\<forall>y\<^sub>n(
+      \<forall>F([F]x\<^sub>1...x\<^sub>n \<equiv> [F]y\<^sub>1...y\<^sub>n) \<rightarrow> ((w \<Turnstile> \<phi>{x\<^sub>1...x\<^sub>n}) \<equiv> ( w \<Turnstile> \<phi>{y\<^sub>1...y\<^sub>n})))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_thus \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> \<phi>{x\<^sub>1...x\<^sub>n}]\<down>\<close>
+    using "kirchner-thm:2"[THEN "\<equiv>E"(2)] by fast
+qed
+
+AOT_theorem "w-rel:3": \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [F]x\<^sub>1...x\<^sub>n]\<down>\<close>
+  by (rule "w-rel:2"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
+
+AOT_define WorldIndexedRelation :: \<open>\<Pi> \<Rightarrow> \<tau> \<Rightarrow> \<Pi>\<close> (\<open>_\<^sub>_\<close>)
+  "w-index": \<open>[F]\<^sub>w =\<^sub>d\<^sub>f [\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [F]x\<^sub>1...x\<^sub>n]\<close>
+
+AOT_define Rigid :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Rigid'(_')\<close>)
+  "df-rigid-rel:1":
+\<open>Rigid(F) \<equiv>\<^sub>d\<^sub>f F\<down> & \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+
+AOT_define Rigidifies :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Rigidifies'(_,_')\<close>)
+  "df-rigid-rel:2":
+\<open>Rigidifies(F, G) \<equiv>\<^sub>d\<^sub>f Rigid(F) & \<forall>x\<^sub>1...\<forall>x\<^sub>n([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)\<close>
+
+AOT_theorem "rigid-der:1": \<open>[[F]\<^sub>w]x\<^sub>1...x\<^sub>n \<equiv> w \<Turnstile> [F]x\<^sub>1...x\<^sub>n\<close>
+  apply (rule "rule-id-df:2:b[2]"[where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>" and
+                                        \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                                  simplified, OF "w-index"])
+   apply (fact "w-rel:3")
+  apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+  by (fact "w-rel:3")
+
+AOT_theorem "rigid-der:2": \<open>Rigid([G]\<^sub>w)\<close>
+proof(safe intro!: "\<equiv>\<^sub>d\<^sub>fI"[OF "df-rigid-rel:1"] "&I")
+  AOT_show \<open>[G]\<^sub>w\<down>\<close>
+    by (rule "rule-id-df:2:b[2]"[where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>" and
+                                       \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                                 simplified, OF "w-index"])
+       (fact "w-rel:3")+
+next
+  AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([[G]\<^sub>w]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n)\<close>
+  proof(rule RN; safe intro!: "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      AOT_have assms: \<open>PossibleWorld(w)\<close> using PossibleWorld.\<psi>.
+      AOT_hence nec_pw_w: \<open>\<box>PossibleWorld(w)\<close>
+        using "\<equiv>E"(1) "rigid-pw:1" by blast
+      fix x\<^sub>1x\<^sub>n
+      AOT_assume \<open>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+        using "rule-id-df:2:a[2]"[where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>" and
+                                        \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                                        simplified, OF "w-index", OF "w-rel:3"]
+        by fast
+      AOT_hence \<open>w \<Turnstile> [G]x\<^sub>1...x\<^sub>n\<close>
+        by (metis "\<beta>\<rightarrow>C"(1))
+      AOT_hence \<open>\<box>w \<Turnstile> [G]x\<^sub>1...x\<^sub>n\<close>
+        using "rigid-truth-at:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
+        by blast
+      moreover AOT_have \<open>\<box>w \<Turnstile> [G]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+      proof (rule RM; rule "\<rightarrow>I")
+        AOT_modally_strict {
+          AOT_assume \<open>w \<Turnstile> [G]x\<^sub>1...x\<^sub>n\<close>
+          AOT_thus \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+            by (auto intro!: "\<beta>\<leftarrow>C"(1) simp: "w-rel:3" "cqt:2")
+        }
+      qed
+      ultimately AOT_have 1: \<open>\<box>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+        using "\<rightarrow>E" by blast
+      AOT_show \<open>\<box>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n\<close>
+        by (rule "rule-id-df:2:b[2]"[where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>" and
+                                           \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                                     simplified, OF "w-index"])
+           (auto simp: 1 "w-rel:3")
+    }
+  qed
+  AOT_thus \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([[G]\<^sub>w]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n)\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "rigid-der:3": \<open>\<exists>F Rigidifies(F, G)\<close>
+proof -
+  AOT_obtain w where w: \<open>\<forall>p (w \<Turnstile> p \<equiv> p)\<close>
+    using "act-world:1" "PossibleWorld.\<exists>E"[rotated] by meson
+  show ?thesis
+  proof (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[G]\<^sub>w\<guillemotright>\<close>])
+    AOT_show \<open>Rigidifies([G]\<^sub>w, [G])\<close>
+    proof(safe intro!: "\<equiv>\<^sub>d\<^sub>fI"[OF "df-rigid-rel:2"] "&I" GEN)
+      AOT_show \<open>Rigid([G]\<^sub>w)\<close>
+        using "rigid-der:2" by blast
+    next
+      fix x\<^sub>1x\<^sub>n
+      AOT_have \<open>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n \<equiv> [\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+      proof(rule "\<equiv>I"; rule "\<rightarrow>I")
+        AOT_assume \<open>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n\<close>
+        AOT_thus \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+          by (rule "rule-id-df:2:a[2]"
+                      [where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>" and
+                             \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                       simplified, OF "w-index", OF "w-rel:3"])
+      next
+        AOT_assume \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [G]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
+        AOT_thus \<open>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n\<close>
+          by (rule "rule-id-df:2:b[2]"
+                      [where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>" and
+                             \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                       simplified, OF "w-index", OF "w-rel:3"])
+      qed
+      also AOT_have \<open>\<dots> \<equiv> w \<Turnstile> [G]x\<^sub>1...x\<^sub>n\<close>
+        by (rule "beta-C-meta"[THEN "\<rightarrow>E"])
+           (fact "w-rel:3")
+      also AOT_have \<open>\<dots> \<equiv> [G]x\<^sub>1...x\<^sub>n\<close>
+        using w[THEN "\<forall>E"(1), OF "log-prop-prop:2"] by blast
+      finally AOT_show \<open>[[G]\<^sub>w]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n\<close>.
+    qed
+  next
+    AOT_show \<open>[G]\<^sub>w\<down>\<close>
+      by (rule "rule-id-df:2:b[2]"[where \<tau>="\<lambda> (\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sub>\<kappa>\<guillemotright>"
+                                     and \<sigma>="\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<kappa> \<Turnstile> [\<Pi>]x\<^sub>1...x\<^sub>n]\<guillemotright>",
+                                   simplified, OF "w-index"])
+         (auto simp: "w-rel:3")
+  qed
+qed
+
+AOT_theorem "rigid-rel-thms:1":
+  \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)) \<equiv> \<forall>x\<^sub>1...\<forall>x\<^sub>n(\<diamond>[F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  fix x\<^sub>1x\<^sub>n
+  AOT_assume \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+  AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+    by (metis "\<rightarrow>E" GEN RM "cqt-orig:3")
+  AOT_hence \<open>\<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<diamond>[F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n\<close>
+    by (metis "\<equiv>E"(1) "sc-eq-box-box:1")
+  moreover AOT_assume \<open>\<diamond>[F]x\<^sub>1...x\<^sub>n\<close>
+  ultimately AOT_show \<open>\<box>[F]x\<^sub>1...x\<^sub>n\<close>
+    using "\<rightarrow>E" by blast
+next
+  AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n (\<diamond>[F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+  AOT_hence \<open>\<diamond>[F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close> for x\<^sub>1x\<^sub>n
+    by (metis "\<equiv>E"(2) "sc-eq-box-box:1")
+  AOT_hence 0: \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+    by (rule GEN)
+  AOT_thus \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n))\<close>
+    using "BF" "vdash-properties:10" by blast
+qed
+
+AOT_theorem "rigid-rel-thms:2":
+  \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)) \<equiv> \<forall>x\<^sub>1...\<forall>x\<^sub>n(\<box>[F]x\<^sub>1...x\<^sub>n \<or> \<box>\<not>[F]x\<^sub>1...x\<^sub>n)\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n))\<close>
+  AOT_hence 0: \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+    using CBF[THEN "\<rightarrow>E"] by blast
+  AOT_show \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n(\<box>[F]x\<^sub>1...x\<^sub>n \<or> \<box>\<not>[F]x\<^sub>1...x\<^sub>n)\<close>
+  proof(rule GEN)
+    fix x\<^sub>1x\<^sub>n
+    AOT_have 1: \<open>\<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+      using 0[THEN "\<forall>E"(2)].
+    AOT_hence 2: \<open>\<diamond>[F]x\<^sub>1...x\<^sub>n \<rightarrow> [F]x\<^sub>1...x\<^sub>n\<close>
+      using "B\<diamond>" "Hypothetical Syllogism" "K\<diamond>" "vdash-properties:10" by blast
+    AOT_have \<open>[F]x\<^sub>1...x\<^sub>n \<or> \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      using "exc-mid".
+    moreover {
+      AOT_assume \<open>[F]x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>\<box>[F]x\<^sub>1...x\<^sub>n\<close>
+        using 1[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"] by blast
+    }
+    moreover {
+      AOT_assume 3: \<open>\<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      AOT_have \<open>\<box>\<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      proof(rule "raa-cor:1")
+        AOT_assume \<open>\<not>\<box>\<not>[F]x\<^sub>1...x\<^sub>n\<close>
+        AOT_hence \<open>\<diamond>[F]x\<^sub>1...x\<^sub>n\<close>
+          by (AOT_subst_def "conventions:5")
+        AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n\<close> using 2[THEN "\<rightarrow>E"] by blast
+        AOT_thus \<open>[F]x\<^sub>1...x\<^sub>n & \<not>[F]x\<^sub>1...x\<^sub>n\<close>
+          using 3 "&I" by blast
+      qed
+    }
+    ultimately AOT_show \<open>\<box>[F]x\<^sub>1...x\<^sub>n \<or> \<box>\<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      by (metis "\<or>I"(1,2) "raa-cor:1")
+  qed
+next
+  AOT_assume 0: \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n(\<box>[F]x\<^sub>1...x\<^sub>n \<or> \<box>\<not>[F]x\<^sub>1...x\<^sub>n)\<close>
+  {
+    fix x\<^sub>1x\<^sub>n
+    AOT_have \<open>\<box>[F]x\<^sub>1...x\<^sub>n \<or> \<box>\<not>[F]x\<^sub>1...x\<^sub>n\<close> using 0[THEN "\<forall>E"(2)] by blast
+    moreover {
+      AOT_assume \<open>\<box>[F]x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>\<box>\<box>[F]x\<^sub>1...x\<^sub>n\<close>
+        using "S5Basic:6"[THEN "\<equiv>E"(1)] by blast
+      AOT_hence \<open>\<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+        using "KBasic:1"[THEN "\<rightarrow>E"] by blast
+    }
+    moreover {
+      AOT_assume \<open>\<box>\<not>[F]x\<^sub>1...x\<^sub>n\<close>
+      AOT_hence \<open>\<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+        using "KBasic:2"[THEN "\<rightarrow>E"] by blast
+    }
+    ultimately AOT_have \<open>\<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+      using "con-dis-i-e:4:b" "raa-cor:1" by blast
+  }
+  AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n)\<close>
+    by (rule GEN)
+  AOT_thus \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[F]x\<^sub>1...x\<^sub>n))\<close>
+    using BF[THEN "\<rightarrow>E"] by fast
+qed
+
+AOT_theorem "rigid-rel-thms:3": \<open>Rigid(F) \<equiv> \<forall>x\<^sub>1...\<forall>x\<^sub>n (\<box>[F]x\<^sub>1...x\<^sub>n \<or> \<box>\<not>[F]x\<^sub>1...x\<^sub>n)\<close>
+  by (AOT_subst_thm "df-rigid-rel:1"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "cqt:2"(1)];
+      AOT_subst_thm "rigid-rel-thms:2")
+     (simp add: "oth-class-taut:3:a")
+
+(*<*)
+end
+(*>*)
diff --git a/thys/AOT/AOT_RestrictedVariables.thy b/thys/AOT/AOT_RestrictedVariables.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_RestrictedVariables.thy
@@ -0,0 +1,437 @@
+(*<*)
+theory AOT_RestrictedVariables
+  imports AOT_PLM
+  keywords "AOT_register_rigid_restricted_type" :: thy_goal
+       and "AOT_register_restricted_type" :: thy_goal
+begin
+(*>*)
+
+section\<open>Restricted Variables\<close>
+
+locale AOT_restriction_condition =
+  fixes \<psi> :: \<open>'a::AOT_Term_id_2 \<Rightarrow> \<o>\<close>
+  assumes "res-var:2"[AOT]: \<open>[v \<Turnstile> \<exists>\<alpha> \<psi>{\<alpha>}]\<close>
+  assumes "res-var:3"[AOT]: \<open>[v \<Turnstile> \<psi>{\<tau>} \<rightarrow> \<tau>\<down>]\<close>
+
+ML\<open>
+fun register_restricted_type (name:string, restriction:string) thy =
+let
+val ctxt = thy
+val ctxt = setupStrictWorld ctxt
+val trm = Syntax.check_term ctxt (AOT_read_term @{nonterminal \<phi>'} ctxt restriction)
+val free = case (Term.add_frees trm []) of [f] => f |
+    _ => raise Term.TERM ("Expected single free variable.", [trm])
+val trm = Term.absfree free trm
+val localeTerm = Const (\<^const_name>\<open>AOT_restriction_condition\<close>, dummyT) $ trm
+val localeTerm = Syntax.check_term ctxt localeTerm
+fun after_qed thms thy = let
+val st = Interpretation.global_interpretation
+  (([(@{locale AOT_restriction_condition}, ((name, true),
+           (Expression.Named [("\<psi>", trm)], [])))], [])) [] thy
+val st = Proof.refine_insert (flat thms) st
+val thy = Proof.global_immediate_proof st
+
+val thy = Local_Theory.background_theory
+  (AOT_Constraints.map (Symtab.update
+    (name, (term_of (snd free), term_of (snd free))))) thy
+val thy = Local_Theory.background_theory
+  (AOT_Restriction.map (Symtab.update
+    (name, (trm, Const (\<^const_name>\<open>AOT_term_of_var\<close>, dummyT))))) thy
+
+in thy end
+in
+Proof.theorem NONE after_qed [[(HOLogic.mk_Trueprop localeTerm, [])]] ctxt
+end
+
+val _ =
+  Outer_Syntax.command
+    \<^command_keyword>\<open>AOT_register_restricted_type\<close>
+    "Register a restricted type."
+    (((Parse.short_ident --| Parse.$$$ ":") -- Parse.term) >>
+    (Toplevel.local_theory_to_proof NONE NONE o register_restricted_type));
+\<close>
+
+locale AOT_rigid_restriction_condition = AOT_restriction_condition +
+  assumes rigid[AOT]: \<open>[v \<Turnstile> \<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<box>\<psi>{\<alpha>})]\<close>
+begin
+lemma rigid_condition[AOT]: \<open>[v \<Turnstile> \<box>(\<psi>{\<alpha>} \<rightarrow> \<box>\<psi>{\<alpha>})]\<close>
+  using rigid[THEN "\<forall>E"(2)] RN by simp
+lemma type_set_nonempty[AOT_no_atp, no_atp]: \<open>\<exists>x . x \<in> { \<alpha> . [w\<^sub>0 \<Turnstile> \<psi>{\<alpha>}]}\<close>
+  by (metis "instantiation" mem_Collect_eq "res-var:2")
+end
+
+locale AOT_restricted_type = AOT_rigid_restriction_condition +
+  fixes Rep and Abs
+  assumes AOT_restricted_type_definition[AOT_no_atp]:
+    \<open>type_definition Rep Abs { \<alpha> . [w\<^sub>0 \<Turnstile> \<psi>{\<alpha>}]}\<close>
+begin
+
+AOT_theorem restricted_var_condition: \<open>\<psi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>}\<close>
+proof -
+  interpret type_definition Rep Abs "{ \<alpha> . [w\<^sub>0 \<Turnstile> \<psi>{\<alpha>}]}"
+    using AOT_restricted_type_definition.
+  AOT_actually {
+    AOT_have \<open>\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>\<down>\<close> and \<open>\<psi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>}\<close>
+      using AOT_sem_imp Rep "res-var:3" by auto
+  }
+  moreover AOT_actually {
+    AOT_have \<open>\<psi>{\<alpha>} \<rightarrow> \<box>\<psi>{\<alpha>}\<close> for \<alpha>
+      using AOT_sem_box rigid_condition by presburger
+    AOT_hence \<open>\<psi>{\<tau>} \<rightarrow> \<box>\<psi>{\<tau>}\<close> if \<open>\<tau>\<down>\<close> for \<tau>
+      by (metis AOT_model.AOT_term_of_var_cases AOT_sem_denotes that)
+  }
+  ultimately AOT_show \<open>\<psi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>}\<close>
+    using AOT_sem_box AOT_sem_imp by blast
+qed
+lemmas "\<psi>" = restricted_var_condition
+
+AOT_theorem GEN: assumes \<open>for arbitrary \<alpha>: \<phi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>}\<close>
+  shows \<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+proof(rule GEN; rule "\<rightarrow>I")
+  interpret type_definition Rep Abs "{ \<alpha> . [w\<^sub>0 \<Turnstile> \<psi>{\<alpha>}]}"
+    using AOT_restricted_type_definition.
+  fix \<alpha>
+  AOT_assume \<open>\<psi>{\<alpha>}\<close>
+  AOT_hence \<open>\<^bold>\<A>\<psi>{\<alpha>}\<close>
+    by (metis AOT_model_axiom_def AOT_sem_box AOT_sem_imp act_closure rigid_condition)
+  hence 0: \<open>[w\<^sub>0 \<Turnstile> \<psi>{\<alpha>}]\<close> by (metis AOT_sem_act)
+  {
+    fix \<tau>
+    assume \<alpha>_def: \<open>\<alpha> = Rep \<tau>\<close>
+    AOT_have \<open>\<phi>{\<alpha>}\<close>
+      unfolding \<alpha>_def
+      using assms by blast
+  }
+  AOT_thus \<open>\<phi>{\<alpha>}\<close>
+    using Rep_cases[simplified, OF 0]
+    by blast
+qed
+lemmas "\<forall>I" = GEN
+
+end
+
+
+lemma AOT_restricted_type_intro[AOT_no_atp, no_atp]:
+  assumes \<open>type_definition Rep Abs { \<alpha> . [w\<^sub>0 \<Turnstile> \<psi>{\<alpha>}]}\<close>
+      and \<open>AOT_rigid_restriction_condition \<psi>\<close>
+  shows \<open>AOT_restricted_type \<psi> Rep Abs\<close>
+  by (auto intro!: assms AOT_restricted_type_axioms.intro AOT_restricted_type.intro)
+
+
+
+ML\<open>
+fun register_rigid_restricted_type (name:string, restriction:string) thy =
+let
+val ctxt = thy
+val ctxt = setupStrictWorld ctxt
+val trm = Syntax.check_term ctxt (AOT_read_term @{nonterminal \<phi>'} ctxt restriction)
+val free = case (Term.add_frees trm []) of [f] => f
+  | _ => raise Term.TERM ("Expected single free variable.", [trm])
+val trm = Term.absfree free trm
+val localeTerm = HOLogic.mk_Trueprop
+  (Const (\<^const_name>\<open>AOT_rigid_restriction_condition\<close>, dummyT) $ trm)
+val localeTerm = Syntax.check_prop ctxt localeTerm
+val int_bnd = Binding.concealed (Binding.qualify true "internal" (Binding.name name))
+val bnds = {Rep_name = Binding.qualify true name (Binding.name "Rep"),
+            Abs_name = Binding.qualify true "Abs" int_bnd,
+            type_definition_name = Binding.qualify true "type_definition" int_bnd}
+
+fun after_qed witts thy = let
+  val thms = (map (Element.conclude_witness ctxt) (flat witts))
+  
+  val typeset = HOLogic.mk_Collect ("\<alpha>", dummyT,
+    \<^const>\<open>AOT_model_valid_in\<close> $ \<^const>\<open>w\<^sub>0\<close> $
+    (trm $ (Const (\<^const_name>\<open>AOT_term_of_var\<close>, dummyT) $ Bound 0)))
+  val typeset = Syntax.check_term thy typeset
+  val nonempty_thm = Drule.OF
+    (@{thm AOT_rigid_restriction_condition.type_set_nonempty}, thms)
+
+  val ((_,st),thy) = Typedef.add_typedef {overloaded=true}
+    (Binding.name name, [], Mixfix.NoSyn) typeset (SOME bnds)
+    (fn ctxt => (Tactic.resolve_tac ctxt ([nonempty_thm]) 1)) thy
+  val ({rep_type = _, abs_type = _, Rep_name = Rep_name, Abs_name = Abs_name,
+        axiom_name = _},
+     {inhabited = _, type_definition = type_definition, Rep = _,
+      Rep_inverse = _, Abs_inverse = _, Rep_inject = _, Abs_inject = _,
+      Rep_cases = _, Abs_cases = _, Rep_induct = _, Abs_induct = _}) = st
+
+  val locale_thm = Drule.OF (@{thm AOT_restricted_type_intro}, type_definition::thms)
+
+  val st = Interpretation.global_interpretation (([(@{locale AOT_restricted_type},
+    ((name, true), (Expression.Named [
+      ("\<psi>", trm),
+      ("Rep", Const (Rep_name, dummyT)),
+      ("Abs", Const (Abs_name, dummyT))], [])))
+    ], [])) [] thy
+
+  val st = Proof.refine_insert [locale_thm] st
+  val thy = Proof.global_immediate_proof st
+
+  val thy = Local_Theory.background_theory (AOT_Constraints.map (
+    Symtab.update (name, (term_of (snd free), term_of (snd free))))) thy
+  val thy = Local_Theory.background_theory (AOT_Restriction.map (
+    Symtab.update (name, (trm, Const (Rep_name, dummyT))))) thy
+  
+  in thy end
+in
+Element.witness_proof after_qed [[localeTerm]] thy
+end
+
+val _ =
+  Outer_Syntax.command
+    \<^command_keyword>\<open>AOT_register_rigid_restricted_type\<close>
+    "Register a restricted type."
+    (((Parse.short_ident --| Parse.$$$ ":") -- Parse.term) >>
+    (Toplevel.local_theory_to_proof NONE NONE o register_rigid_restricted_type)); 
+\<close>
+
+(* Generalized mechanism for "AOT_restricted_type.\<forall>I" followed by \<forall>E *)
+ML\<open>
+fun get_instantiated_allI ctxt varname thm = let
+val trm = Thm.concl_of thm
+val trm = case trm of (@{const Trueprop} $ (@{const AOT_model_valid_in} $ _ $ x)) => x
+                      | _ => raise Term.TERM ("Expected simple theorem.", [trm])
+fun extractVars (Const (\<^const_name>\<open>AOT_term_of_var\<close>, t) $ (Const rep $ Var v)) =
+    (if fst (fst v) = fst varname
+     then [Const (\<^const_name>\<open>AOT_term_of_var\<close>, t) $ (Const rep $ Var v)]
+     else []) (* TODO: care about the index *)
+  | extractVars (t1 $ t2) = extractVars t1 @ extractVars t2
+  | extractVars (Abs (_, _, t)) = extractVars t
+  | extractVars _ = []
+val vars = extractVars trm
+val vartrm = hd vars
+val vars = fold Term.add_vars vars []
+val var = hd vars
+val trmty = (case vartrm of (Const (_, Type ("fun", [_, ty])) $ _) => ty
+                       | _ => raise Match)
+val varty = snd var
+val tyname = fst (Term.dest_Type varty)
+val b = tyname^".\<forall>I" (* TODO: better way to find the theorem *)
+val thms = fst (Context.map_proof_result (fn ctxt => (Attrib.eval_thms ctxt
+    [(Facts.Named ((b,Position.none),NONE),[])], ctxt)) ctxt)
+val allthm = (case thms of (thm::_) => thm
+    | _ => raise Fail "Unknown restricted type.")
+val trm = Abs (Term.string_of_vname (fst var), trmty, Term.abstract_over (vartrm, trm))
+val trm = Thm.cterm_of (Context.proof_of ctxt) trm
+val phi = hd (Term.add_vars (Thm.prop_of allthm) [])
+val allthm = Drule.instantiate_normalize (TVars.empty, Vars.make [(phi,trm)]) allthm
+in
+allthm
+end
+\<close>
+
+(* TODO: unconstraining multiple variables does not work yet *)
+attribute_setup "unconstrain" =
+  \<open>Scan.lift (Scan.repeat1 Args.var) >> (fn args => Thm.rule_attribute []
+  (fn ctxt => fn thm =>
+    let
+    val thm = fold (fn arg => fn thm => thm RS get_instantiated_allI ctxt arg thm)
+                   args thm
+    val thm = fold (fn _ => fn thm => thm RS @{thm "\<forall>E"(2)}) args thm
+    in
+     thm
+    end))\<close>
+  "Generalize a statement about restricted variables to a statement about
+   unrestricted variables with explicit restriction condition."
+
+
+
+context AOT_restricted_type
+begin
+
+AOT_theorem "rule-ui":
+  assumes \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+  shows \<open>\<phi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>}\<close>
+proof -
+  AOT_have \<open>\<phi>{\<alpha>}\<close> if \<open>\<psi>{\<alpha>}\<close> for \<alpha> using assms[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] that by blast
+  moreover AOT_have \<open>\<psi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>}\<close>
+    by (auto simp:  \<psi>)
+  ultimately show ?thesis by blast
+qed
+lemmas "\<forall>E" = "rule-ui"
+
+AOT_theorem "instantiation":
+  assumes \<open>for arbitrary \<beta>: \<phi>{\<guillemotleft>AOT_term_of_var (Rep \<beta>)\<guillemotright>} \<^bold>\<turnstile> \<chi>\<close> and \<open>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+  shows \<open>\<chi>\<close>
+proof -
+  AOT_have \<open>\<phi>{\<guillemotleft>AOT_term_of_var (Rep \<alpha>)\<guillemotright>} \<rightarrow> \<chi>\<close> for \<alpha>
+    using assms(1)
+    by (simp add: "deduction-theorem")
+  AOT_hence 0: \<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> (\<phi>{\<alpha>} \<rightarrow> \<chi>))\<close>
+    using GEN by simp
+  moreover AOT_obtain \<alpha> where \<open>\<psi>{\<alpha>} & \<phi>{\<alpha>}\<close> using assms(2) "\<exists>E"[rotated] by blast
+  ultimately AOT_show \<open>\<chi>\<close> using "AOT_PLM.\<forall>E"(2)[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&E" by fast
+qed
+lemmas "\<exists>E" = "instantiation"
+
+AOT_theorem existential: assumes \<open>\<phi>{\<guillemotleft>AOT_term_of_var (Rep \<beta>)\<guillemotright>}\<close>
+  shows \<open>\<exists> \<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+  by (meson AOT_restricted_type.\<psi> AOT_restricted_type_axioms assms
+            "&I" "existential:2[const_var]")
+lemmas "\<exists>I" = existential
+end
+
+
+context AOT_rigid_restriction_condition
+begin
+
+AOT_theorem "res-var-bound-reas[1]":
+  \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<forall>\<beta> \<phi>{\<alpha>, \<beta>}) \<equiv> \<forall>\<beta>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>, \<beta>})\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
+  fix \<beta> \<alpha>
+  AOT_assume \<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<forall>\<beta> \<phi>{\<alpha>, \<beta>})\<close>
+  AOT_hence \<open>\<psi>{\<alpha>} \<rightarrow> \<forall>\<beta> \<phi>{\<alpha>, \<beta>}\<close> using "\<forall>E"(2) by blast
+  moreover AOT_assume \<open>\<psi>{\<alpha>}\<close>
+  ultimately AOT_have \<open>\<forall>\<beta> \<phi>{\<alpha>, \<beta>}\<close> using "\<rightarrow>E" by blast
+  AOT_thus \<open>\<phi>{\<alpha>, \<beta>}\<close> using "\<forall>E"(2) by blast
+next
+  fix \<alpha> \<beta>
+  AOT_assume \<open>\<forall>\<beta>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>, \<beta>})\<close>
+  AOT_hence \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>, \<beta>})\<close> using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>, \<beta>}\<close> using "\<forall>E"(2) by blast
+  moreover AOT_assume \<open>\<psi>{\<alpha>}\<close>
+  ultimately AOT_show \<open>\<phi>{\<alpha>, \<beta>}\<close> using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem "res-var-bound-reas[BF]":
+  \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>}) \<rightarrow> \<box>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+proof(safe intro!: "\<rightarrow>I")
+  AOT_assume \<open>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<psi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>}\<close> for \<alpha>
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<box>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close> for \<alpha>
+    by (metis "sc-eq-box-box:6" rigid_condition "vdash-properties:6")
+  AOT_hence \<open>\<forall>\<alpha> \<box>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (rule GEN)
+  AOT_thus \<open>\<box>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (metis "BF" "vdash-properties:6")
+qed
+
+AOT_theorem "res-var-bound-reas[CBF]":
+\<open>\<box>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>}) \<rightarrow> \<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>})\<close>
+proof(safe intro!: "\<rightarrow>I" GEN)
+  fix \<alpha>
+  AOT_assume \<open>\<box>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<forall>\<alpha> \<box>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (metis "CBF" "vdash-properties:6")
+  AOT_hence 1: \<open>\<box>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    using "\<forall>E"(2) by blast
+  AOT_assume \<open>\<psi>{\<alpha>}\<close>
+  AOT_hence \<open>\<box>\<psi>{\<alpha>}\<close>
+    by (metis "B\<diamond>" "T\<diamond>" rigid_condition "vdash-properties:6")
+  AOT_thus \<open>\<box>\<phi>{\<alpha>}\<close>
+    using 1 "qml:1"[axiom_inst, THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
+qed
+
+AOT_theorem "res-var-bound-reas[2]":
+\<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<^bold>\<A>\<phi>{\<alpha>}) \<rightarrow> \<^bold>\<A>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+proof(safe intro!: "\<rightarrow>I")
+  AOT_assume \<open>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<^bold>\<A>\<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<psi>{\<alpha>} \<rightarrow> \<^bold>\<A>\<phi>{\<alpha>}\<close> for \<alpha>
+    using "\<forall>E"(2) by blast
+  AOT_hence \<open>\<^bold>\<A>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close> for \<alpha>
+    by (metis "sc-eq-box-box:7" rigid_condition "vdash-properties:6")
+  AOT_hence \<open>\<forall>\<alpha> \<^bold>\<A>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (rule GEN)
+  AOT_thus \<open>\<^bold>\<A>\<forall>\<alpha>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (metis "\<equiv>E"(2) "logic-actual-nec:3"[axiom_inst])
+qed
+
+
+AOT_theorem "res-var-bound-reas[3]":
+  \<open>\<^bold>\<A>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>}) \<rightarrow> \<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<^bold>\<A>\<phi>{\<alpha>})\<close>
+proof(safe intro!: "\<rightarrow>I" GEN)
+  fix \<alpha>
+  AOT_assume \<open>\<^bold>\<A>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<forall>\<alpha> \<^bold>\<A>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close>
+    by (metis "\<equiv>E"(1) "logic-actual-nec:3"[axiom_inst])
+  AOT_hence 1: \<open>\<^bold>\<A>(\<psi>{\<alpha>} \<rightarrow> \<phi>{\<alpha>})\<close> by (metis "rule-ui:3")
+  AOT_assume \<open>\<psi>{\<alpha>}\<close>
+  AOT_hence \<open>\<^bold>\<A>\<psi>{\<alpha>}\<close>
+    by (metis "nec-imp-act" "qml:2"[axiom_inst] rigid_condition "\<rightarrow>E")
+  AOT_thus \<open>\<^bold>\<A>\<phi>{\<alpha>}\<close>
+    using 1 by (metis "act-cond" "\<rightarrow>E")
+qed
+
+AOT_theorem "res-var-bound-reas[Buridan]":
+  \<open>\<exists>\<alpha> (\<psi>{\<alpha>} & \<box>\<phi>{\<alpha>}) \<rightarrow> \<box>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+proof (rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>\<alpha> (\<psi>{\<alpha>} & \<box>\<phi>{\<alpha>})\<close>
+  then AOT_obtain \<alpha> where \<open>\<psi>{\<alpha>} & \<box>\<phi>{\<alpha>}\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close> 
+    by (metis "KBasic:11" "KBasic:3" "T\<diamond>" "&I" "&E"(1) "&E"(2)
+              "\<equiv>E"(2) "reductio-aa:1" rigid_condition "vdash-properties:6")
+  AOT_hence \<open>\<exists>\<alpha> \<box>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    by (rule "\<exists>I")
+  AOT_thus \<open>\<box>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    by (rule Buridan[THEN "\<rightarrow>E"])
+qed
+
+AOT_theorem "res-var-bound-reas[BF\<diamond>]":
+  \<open>\<diamond>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>}) \<rightarrow> \<exists>\<alpha> (\<psi>{\<alpha>} & \<diamond>\<phi>{\<alpha>})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<diamond>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<exists>\<alpha> \<diamond>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
+  then AOT_obtain \<alpha> where \<open>\<diamond>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<diamond>\<psi>{\<alpha>}\<close> and \<open>\<diamond>\<phi>{\<alpha>}\<close>
+    using "KBasic2:3" "&E" "\<rightarrow>E" by blast+
+  moreover AOT_have \<open>\<psi>{\<alpha>}\<close>
+    using calculation rigid_condition by (metis "B\<diamond>" "K\<diamond>" "\<rightarrow>E")
+  ultimately AOT_have \<open>\<psi>{\<alpha>} & \<diamond>\<phi>{\<alpha>}\<close>
+    using "&I" by blast
+  AOT_thus \<open>\<exists>\<alpha> (\<psi>{\<alpha>} & \<diamond>\<phi>{\<alpha>})\<close>
+    by (rule "\<exists>I")
+qed
+
+AOT_theorem "res-var-bound-reas[CBF\<diamond>]":
+  \<open>\<exists>\<alpha> (\<psi>{\<alpha>} & \<diamond>\<phi>{\<alpha>}) \<rightarrow> \<diamond>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>\<exists>\<alpha> (\<psi>{\<alpha>} & \<diamond>\<phi>{\<alpha>})\<close>
+  then AOT_obtain \<alpha> where \<open>\<psi>{\<alpha>} & \<diamond>\<phi>{\<alpha>}\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_hence \<open>\<box>\<psi>{\<alpha>}\<close> and \<open>\<diamond>\<phi>{\<alpha>}\<close>
+    using rigid_condition[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"] "&E" by blast+
+  AOT_hence \<open>\<diamond>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    by (metis "KBasic:16" "con-dis-taut:5" "\<rightarrow>E")
+  AOT_hence \<open>\<exists>\<alpha> \<diamond>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    by (rule "\<exists>I")
+  AOT_thus \<open>\<diamond>\<exists>\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    using "CBF\<diamond>"[THEN "\<rightarrow>E"] by fast
+qed
+
+AOT_theorem "res-var-bound-reas[A-Exists:1]":
+  \<open>\<^bold>\<A>\<exists>!\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>}) \<equiv> \<exists>!\<alpha> (\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>})\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>\<^bold>\<A>\<exists>!\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<exists>!\<alpha> \<^bold>\<A>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    using "A-Exists:1"[THEN "\<equiv>E"(1)] by blast
+  AOT_hence \<open>\<exists>!\<alpha> (\<^bold>\<A>\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>})\<close>
+    apply(AOT_subst \<open>\<^bold>\<A>\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>}\<close> \<open>\<^bold>\<A>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close> for: \<alpha>)
+     apply (meson "Act-Basic:2" "intro-elim:3:f" "oth-class-taut:3:a")
+    by simp
+  AOT_thus \<open>\<exists>!\<alpha> (\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>})\<close>
+    apply (AOT_subst \<open>\<psi>{\<alpha>}\<close> \<open>\<^bold>\<A>\<psi>{\<alpha>}\<close> for: \<alpha>)
+    using "Commutativity of \<equiv>" "intro-elim:3:b" "sc-eq-fur:2"
+          "\<rightarrow>E" rigid_condition by blast
+next
+  AOT_assume \<open>\<exists>!\<alpha> (\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>})\<close>
+  AOT_hence \<open>\<exists>!\<alpha> (\<^bold>\<A>\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>})\<close>
+    apply (AOT_subst \<open>\<^bold>\<A>\<psi>{\<alpha>}\<close> \<open>\<psi>{\<alpha>}\<close> for: \<alpha>)
+     apply (meson "sc-eq-fur:2" "\<rightarrow>E" rigid_condition)
+    by simp
+  AOT_hence \<open>\<exists>!\<alpha> \<^bold>\<A>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+    apply (AOT_subst \<open>\<^bold>\<A>(\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close> \<open>\<^bold>\<A>\<psi>{\<alpha>} & \<^bold>\<A>\<phi>{\<alpha>}\<close> for: \<alpha>)
+     using "Act-Basic:2" apply presburger
+     by simp
+  AOT_thus \<open>\<^bold>\<A>\<exists>!\<alpha> (\<psi>{\<alpha>} & \<phi>{\<alpha>})\<close>
+     by (metis "A-Exists:1" "intro-elim:3:b")
+qed
+
+end
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/AOT/AOT_commands.ML b/thys/AOT/AOT_commands.ML
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_commands.ML
@@ -0,0 +1,893 @@
+(*
+This file contains modified parts of the Isabelle ML sources
+which are distributed with Isabelle under the following conditions:
+
+ISABELLE COPYRIGHT NOTICE, LICENCE AND DISCLAIMER.
+
+Copyright (c) 1986-2021,
+  University of Cambridge,
+  Technische Universitaet Muenchen,
+  and contributors.
+
+  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+* Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+* Neither the name of the University of Cambridge or the Technische
+Universitaet Muenchen nor the names of their contributors may be used
+to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*)
+
+fun AOT_item_by_name name = Option.map fst (List.find (fn (_,n) => n = name) AOT_items)
+fun AOT_name_of_item id = Option.map snd (List.find (fn (i,_) => id = i) AOT_items)
+
+val print_AOT_syntax = Attrib.setup_config_bool @{binding "show_AOT_syntax"} (K false)
+local
+    fun AOT_map_translation b (name:string, f) = (name, fn ctxt =>
+      if Config.get ctxt print_AOT_syntax = b
+      then f ctxt
+      else raise Match)
+in
+val AOT_syntax_print_translations =
+  map (fn (n,f:Proof.context -> term list -> term) =>
+       AOT_map_translation true (n,f))
+val AOT_syntax_typed_print_translations
+  = map (fn (n,f:Proof.context -> typ -> term list -> term) =>
+         AOT_map_translation true (n,f))
+val AOT_syntax_print_ast_translations
+  = map (fn (n,f:Proof.context -> Ast.ast list -> Ast.ast) =>
+         AOT_map_translation true (n,f))
+end
+
+fun AOT_get_item_number name = let
+val name = hd (String.fields (equal #"[") name)
+val name = String.fields (equal #":") name
+in case (AOT_item_by_name (hd name)) of (SOME id) => SOME (
+fold (fn sub => fn str => str ^ "." ^ sub) (tl name) (Int.toString id)
+) | _ => NONE end
+
+fun AOT_print_item_number (name:string) = case (AOT_get_item_number name)
+  of SOME str => Pretty.writeln (Pretty.str ("PLM item number (" ^ str ^ ")"))
+  | _ => ()
+
+fun add_AOT_print_rule AOTsyntax raw_rules thy = let
+  val rules = map (fn (r, s) => let
+    val head = Ast.head_of_rule (s,r)
+  in (head, fn ctxt => fn asts =>
+    if Config.get ctxt print_AOT_syntax = AOTsyntax then 
+      let
+        val orig = (Ast.mk_appl (Ast.Constant head) asts)
+        val normalized = Ast.normalize ctxt
+          (fn head' => if head = head' then [(s,r)] else []) orig
+      in
+        if orig = normalized then raise Match else normalized
+      end
+    else raise Match)
+  end) raw_rules
+in Sign.print_ast_translation rules thy end
+
+local
+         
+val trans_pat =
+  Scan.optional
+    (\<^keyword>\<open>(\<close>
+      |-- Parse.!!! (Parse.inner_syntax Parse.name --|
+     \<^keyword>\<open>)\<close>)) "logic"
+    -- Parse.inner_syntax Parse.string;
+
+fun trans_arrow toks =
+  ((\<^keyword>\<open>\<leftharpoondown>\<close> || \<^keyword>\<open><=\<close>)
+    >> K Syntax.Print_Rule) toks;
+
+val trans_line =
+  trans_pat -- Parse.!!! (trans_arrow |-- trans_pat)
+    >> (fn (left, right) => (left, right));
+
+fun add_trans_rule AOTsyntax raw_rules thy =
+let
+  fun mapPair f (x, y) = (f x, f y)
+  val ctxt = Proof_Context.init_global thy;
+  val read_root = #1 o dest_Type o
+    Proof_Context.read_type_name {proper = true, strict = false} ctxt;
+  val raw_rules = map (mapPair (fn (r, s) =>
+    (Syntax_Phases.parse_ast_pattern ctxt (read_root r, s)))) raw_rules
+in add_AOT_print_rule AOTsyntax raw_rules thy end
+
+val _ =
+  Outer_Syntax.command
+    \<^command_keyword>\<open>AOT_syntax_print_translations\<close>
+    "add print translation rules for AOT syntax"
+    (Scan.repeat1 trans_line >> (Toplevel.theory o add_trans_rule true));
+
+val _ =
+  Outer_Syntax.command
+    \<^command_keyword>\<open>AOT_no_syntax_print_translations\<close>
+    "add AOT print translation rules for non-AOT syntax"
+    (Scan.repeat1 trans_line >> (Toplevel.theory o add_trans_rule false));
+in end
+
+
+
+structure AOT_Theorems = Named_Thms(
+  val name = @{binding "AOT"}
+  val description = "AOT Theorems"
+)
+structure AOT_Definitions = Named_Thms(
+  val name = @{binding "AOT_defs"}
+  val description = "AOT Definitions"
+)
+structure AOT_ProofData = Proof_Data
+(type T = term option
+ fun init _ = NONE)
+fun AOT_note_theorems thms = Local_Theory.background_theory
+  (Context.theory_map (fold AOT_Theorems.add_thm
+    (map Drule.export_without_context (flat thms))))
+fun AOT_note_definitions thms = Local_Theory.background_theory
+  (Context.theory_map (fold AOT_Definitions.add_thm
+    (map Drule.export_without_context (flat thms))))
+
+structure AOT_DefinedConstants = Theory_Data (
+  type T = Termtab.set
+  val empty = Termtab.empty
+  val extend = I
+  val merge = Termtab.merge (K true)
+);
+fun AOT_note_defined_constant const =
+  Local_Theory.background_theory (AOT_DefinedConstants.map (Termtab.insert_set const))
+
+fun AOT_read_prop nonterminal ctxt prop = (let
+    val ctxt' = Config.put Syntax.root nonterminal ctxt
+    val trm = Syntax.parse_term ctxt' prop
+    val typ = Term.fastype_of (Syntax.check_term ctxt' trm)
+    val trm = if typ = @{typ prop} then trm else HOLogic.mk_Trueprop trm
+  in trm end)
+fun AOT_read_term nonterminal ctxt prop = (let
+    val ctxt' = Config.put Syntax.root nonterminal ctxt
+    val trm = Syntax.parse_term ctxt' prop
+  in trm end)
+fun AOT_check_prop nonterminal ctxt prop =
+  AOT_read_prop nonterminal ctxt prop |> Syntax.check_prop ctxt;
+
+let
+fun close_form t =
+  fold_rev (fn (s, T) => fn t => HOLogic.mk_all (s, T, t)) (Term.add_frees t []) t
+fun remove_case_prod (Const (\<^const_name>\<open>case_prod\<close>, _) $ x) = remove_case_prod x
+  | remove_case_prod (Const (\<^const_name>\<open>case_unit\<close>, _) $ x) = remove_case_prod x
+  | remove_case_prod (Abs (a,b,c)) = Abs (a,b,remove_case_prod c)
+  | remove_case_prod x = x
+
+fun AOT_define_id (bnd,str,mx) (lhs,rhs,trm) ctxt =
+let
+  val bnd_str = Binding.name_of bnd
+  val syn_typ = Syntax.parse_typ ctxt str
+
+  val lhs = remove_case_prod lhs
+  val rhs = remove_case_prod rhs
+
+  fun filter (name,_) = not (name = \<^const_name>\<open>case_prod\<close>
+      orelse name = \<^const_name>\<open>case_unit\<close>)
+  val (const_name, const_typ) = case (List.filter filter (Term.add_consts lhs []))
+    of [const] => const
+    | _ => raise Term.TERM
+      ("Expected a single constant on the LHS of the definition.", [lhs])
+
+  val _ = Long_Name.base_name const_name = Long_Name.base_name bnd_str
+    orelse raise Term.TERM ("Left-hand side does not contain the definiens.", [lhs])
+
+  val (lhs_abs_vars, _) = Term.strip_abs lhs
+  val (rhs_abs_vars, rhs_abs_body) = Term.strip_abs rhs
+  val _ = lhs_abs_vars = rhs_abs_vars orelse raise Term.TERM
+    ("Expected the LHS and RHS to abstract over the same free variables.", [lhs, rhs])
+  val body = rhs_abs_body
+
+  val witness = fold_rev (fn (s, T) => fn t => Term.absfree (s, T) t)
+    lhs_abs_vars body
+  val witness = Syntax.check_term ctxt witness
+
+  (* Construct the choice specification theorem. *)
+  val thm =
+    let
+      val cname = Long_Name.base_name const_name
+      val vname = if Symbol_Pos.is_identifier cname then cname else "x"
+      val trm = @{const Trueprop} $ HOLogic.mk_exists (vname, const_typ,
+          Term.abstract_over (Const (const_name, const_typ), trm))
+      val cwitness = Thm.cterm_of ctxt witness
+      val witness_exI = Thm.instantiate'
+        [SOME (Thm.ctyp_of_cterm cwitness)]
+        [NONE,SOME cwitness] exI
+      val simps = [
+        @{thm AOT_model_id_def},
+        @{thm AOT_model_nondenoing},
+        @{thm AOT_model_denotes_prod_def},
+        @{thm AOT_model_denotes_unit_def},
+        @{thm case_unit_Unity}
+      ]
+      val thm = (Goal.prove ctxt [] [] trm (fn _ =>
+        resolve_tac ctxt [witness_exI] 1
+        THEN simp_tac (ctxt addsimps simps) 1))
+      val match = Thm.match (Thm.cprop_of thm, Thm.cterm_of ctxt trm)
+    in Drule.instantiate_normalize match thm end
+
+  (* Add the choice specification and cleanup and export the resulting theorem. *)
+  val oldctxt = ctxt
+  val (thm, ctxt) = Local_Theory.background_theory_result (fn lthy => let
+     val lthy = lthy |> Sign.add_consts [(bnd,const_typ,Mixfix.NoSyn)] |>
+        Sign.syntax true Syntax.mode_default [(bnd_str,syn_typ,mx)] |>
+        add_AOT_print_rule true [
+          (Ast.Constant bnd_str, Ast.Constant (Lexicon.mark_const const_name))
+        ]
+     in
+      Choice_Specification.add_specification [("",bnd_str,false)] (lthy, thm)
+      |> apsnd Drule.export_without_context |> swap
+     end) (Proof_Context.concealed ctxt)
+in
+  (ctxt |> Proof_Context.restore_naming oldctxt, thm)
+end
+
+fun AOT_define_equiv (bnd,str,mx) (lhs,rhs,trm) ctxt =
+let
+  val bnd_str = Binding.name_of bnd
+  val syn_typ = Syntax.parse_typ ctxt str
+  val (const_name, const_typ) = case (Term.add_consts lhs []) of [const] => const
+    | _ => raise Term.TERM
+      ("Expected a single constant on the LHS of the definition.", [lhs])
+  
+  (* TODO: figure out how to properly compare the constant name with the binding *)
+  val _ = Long_Name.base_name const_name = Long_Name.base_name bnd_str
+    orelse raise Term.TERM ("Left-hand side does not contain the definiens.", [lhs])
+  
+  (* Construct a witness for the choice specification theorem. *)
+  val frees = Term.add_frees trm []
+  val witness = let
+    val w = case Term.variant_frees trm [("w", @{typ w})] of [w] => w
+                | _ => raise Fail "Unexpected."
+  in
+    \<^const>\<open>AOT_model_proposition_choice\<close> $
+    Term.absfree w (\<^const>\<open>AOT_model_valid_in\<close> $ Free w $ rhs)
+  end
+  val witness = fold_rev (fn (s, T) => fn t => Term.absfree (s, T) t)
+    (List.rev frees) witness
+  
+  (* Construct the choice specification theorem. *)
+  val thm =
+  let
+    val cname = Long_Name.base_name const_name
+    val vname = if Symbol_Pos.is_identifier cname then cname else "x"
+    val trm = @{const Trueprop} $ HOLogic.mk_exists (vname, const_typ,
+        Term.abstract_over (Const (const_name, const_typ), close_form trm))
+    val cwitness = Thm.cterm_of ctxt witness
+    val witness_exI = Thm.instantiate'
+      [SOME (Thm.ctyp_of_cterm cwitness)]
+      [NONE,SOME cwitness] exI
+    val simps = [
+      @{thm AOT_model_equiv_def},
+      @{thm AOT_model_proposition_choice_simp}
+    ]
+    val thm = (Goal.prove ctxt [] [] trm (fn _ =>
+      resolve_tac ctxt [witness_exI] 1
+      THEN simp_tac (ctxt addsimps simps) 1))
+    val match = Thm.match (Thm.cprop_of thm, Thm.cterm_of ctxt trm)
+  in
+    Drule.instantiate_normalize match thm
+  end
+  
+  (* Add the choice specification and cleanup and export the resulting theorem. *)
+  val oldctxt = ctxt
+  val (thm, ctxt) = Proof_Context.concealed ctxt |>
+    Local_Theory.background_theory_result (fn lthy => let
+     fun inst_all thy (name,typ) thm =
+       let
+         val cv = Thm.global_cterm_of thy (Free (name,typ))
+         val cT = Thm.global_ctyp_of thy typ
+         val spec' = Thm.instantiate' [SOME cT] [NONE, SOME cv] spec
+       in thm RS spec' end
+     fun remove_alls frees (thy, thm) = (thy, fold (inst_all thy) frees thm)
+     val lthy = lthy |> Sign.add_consts [(bnd,const_typ,Mixfix.NoSyn)] |>
+        Sign.syntax true Syntax.mode_default [(bnd_str,syn_typ,mx)] |>
+        add_AOT_print_rule true [
+          (Ast.Constant bnd_str, Ast.Constant (Lexicon.mark_const const_name))
+        ]
+     in
+      Choice_Specification.add_specification [("",bnd_str,false)] (lthy, thm)
+      |> remove_alls frees |> apsnd Drule.export_without_context |> swap
+     end)
+in
+  (ctxt |> Proof_Context.restore_naming oldctxt, thm)
+end
+
+fun AOT_define (((bnd,str,mx),(thmbind,thmattrs)),defprop) ctxt =
+  let
+    val bnd_str = Binding.name_of bnd
+    val syn_typ = Syntax.parse_typ ctxt str
+
+    (* Add a generic constant and the requested syntax to a temporary context. *)
+    val thy = Proof_Context.theory_of ctxt
+    val thy' = Sign.add_consts [(bnd, @{typ 'a}, Mixfix.NoSyn)] thy
+    val thy' = Sign.syntax true Syntax.mode_default [(bnd_str,syn_typ,mx)] thy'
+    (* Try to parse the definition using the temporary context. *)
+    val trm = AOT_check_prop @{nonterminal AOT_prop}
+      (Proof_Context.init_global thy') defprop
+    (* Extract lhs, rhs and the full definition from the parsed proposition
+       and delegate. *)
+    val (ctxt, thm) = case trm of (Const (\<^const_name>\<open>HOL.Trueprop\<close>, _) $ 
+      (trm as Const (n, _) $ lhs $ rhs)) => 
+          if n = \<^const_name>\<open>AOT_model_equiv_def\<close> then
+            AOT_define_equiv (bnd,str,mx) (lhs,rhs,trm) ctxt
+          else if n = \<^const_name>\<open>AOT_model_id_def\<close> then
+            AOT_define_id (bnd,str,mx) (lhs,rhs,trm) ctxt
+          else
+            raise Term.TERM ("Expected AOT definition.", [trm])
+      | _ => raise Term.TERM ("Expected AOT definition.", [trm])
+    val thmbind = if Binding.is_empty thmbind then bnd else thmbind
+    val _ = AOT_print_item_number (Binding.name_of thmbind)
+  in
+    ctxt |> Local_Theory.note ((thmbind, thmattrs), [thm]) |> snd |>
+    AOT_note_theorems [[thm]] |> AOT_note_definitions [[thm]] |>
+    AOT_note_defined_constant
+      (Proof_Context.read_const {proper=true,strict=true} ctxt (Binding.name_of bnd))
+  end
+in
+Outer_Syntax.local_theory
+@{command_keyword AOT_define}
+"AOT definition by equivalence."
+(Parse.const_binding -- Parse_Spec.opt_thm_name ":" -- Parse.prop >> AOT_define)
+end;
+
+(* this is a stripped down version of Expression.read_statement
+   that mainly replaces Syntax.parse_prop with AOT_read_prop
+   and drops locale includes *)
+local
+
+fun mk_type T = (Logic.mk_type T, []);
+fun mk_propp (p, pats) = (Type.constraint propT p, pats);
+
+fun dest_type (T, []) = Logic.dest_type T
+  | dest_type _ = raise Fail "Unexpected."
+fun dest_propp (p, pats) = (p, pats);
+
+fun finish_fixes (parms: (string * typ) list) = map (fn (binding, _, mx) =>
+  let val x = Binding.name_of binding
+  in (binding, AList.lookup (op =) parms x, mx) end);
+
+fun finish_elem parms (Element.Fixes fixes) = Element.Fixes (finish_fixes parms fixes)
+  | finish_elem _ (Element.Constrains _) = Element.Constrains []
+  | finish_elem _ (Element.Assumes asms) = Element.Assumes asms
+  | finish_elem _ (Element.Defines defs) = Element.Defines defs
+  | finish_elem _ (elem as Element.Notes _) = elem
+  | finish_elem _ (elem as Element.Lazy_Notes _) = elem;
+
+fun extract_elem (Element.Fixes fixes) = map (#2 #> the_list #> map mk_type) fixes
+  | extract_elem (Element.Constrains csts) = map (#2 #> single #> map mk_type) csts
+  | extract_elem (Element.Assumes asms) = map (#2 #> map mk_propp) asms
+  | extract_elem (Element.Defines defs) =
+      map (fn (_, (t, ps)) => [mk_propp (t, ps)]) defs
+  | extract_elem (Element.Notes _) = []
+  | extract_elem (Element.Lazy_Notes _) = [];
+
+fun restore_elem (Element.Fixes fixes, css) =
+      (fixes ~~ css) |> map (fn ((x, _, mx), cs) =>
+        (x, cs |> map dest_type |> try hd, mx)) |> Element.Fixes
+  | restore_elem (Element.Constrains csts, css) =
+      (csts ~~ css) |> map (fn ((x, _), cs) =>
+        (x, cs |> map dest_type |> hd)) |> Element.Constrains
+  | restore_elem (Element.Assumes asms, css) =
+      (asms ~~ css) |> map (fn ((b, _), cs) =>
+         (b, map dest_propp cs)) |> Element.Assumes
+  | restore_elem (Element.Defines defs, css) =
+      (defs ~~ css) |> map (fn ((b, _), [c]) =>
+          (b, dest_propp c) | _ => raise Fail "Unexpected") |> Element.Defines
+  | restore_elem (elem as Element.Notes _, _) = elem
+  | restore_elem (elem as Element.Lazy_Notes _, _) = elem;
+
+fun prep (_, pats) (ctxt, t :: ts) =
+  let
+    val ctxt' = Proof_Context.augment t ctxt
+  in
+    ((t, Syntax.check_props
+            (Proof_Context.set_mode Proof_Context.mode_pattern ctxt') pats),
+      (ctxt', ts))
+  end
+  | prep _ _ = raise Fail "Unexpected"
+
+fun check cs ctxt =
+  let
+    val (cs', (ctxt', _)) = fold_map prep cs
+      (ctxt, Syntax.check_terms
+        (Proof_Context.set_mode Proof_Context.mode_schematic ctxt) (map fst cs));
+  in (cs', ctxt') end;
+
+fun check_autofix elems concl ctxt =
+  let
+    val elem_css = map extract_elem elems;
+    val concl_cs = (map o map) mk_propp (map snd concl);
+    (* Type inference *)
+    val (css', ctxt') =
+      (fold_burrow o fold_burrow) check (elem_css @ [concl_cs]) ctxt;
+    val (elem_css', concl_cs') = chop (length elem_css) css' |> apsnd the_single;
+  in
+    ((map restore_elem (elems ~~ elem_css'),
+      map fst concl ~~ concl_cs'), ctxt')
+  end;
+
+fun prepare_stmt prep_prop ctxt stmt =
+  (case stmt of
+    Element.Shows raw_shows =>
+      raw_shows |> (map o apsnd o map) (fn (t, ps) =>
+        (prep_prop (Proof_Context.set_mode Proof_Context.mode_schematic ctxt) t,
+          map (prep_prop (Proof_Context.set_mode Proof_Context.mode_pattern ctxt)) ps))
+  | Element.Obtains _ => raise Fail "unsupported");
+
+fun parse_elem prep_typ prep_term ctxt =
+  Element.map_ctxt
+   {binding = I,
+    typ = prep_typ ctxt,
+    term = prep_term (Proof_Context.set_mode Proof_Context.mode_schematic ctxt),
+    pattern = prep_term (Proof_Context.set_mode Proof_Context.mode_pattern ctxt),
+    fact = I,
+    attrib = I};
+
+fun declare_elem prep_var (Element.Fixes fixes) ctxt =
+      let val (vars, _) = fold_map prep_var fixes ctxt
+      in ctxt |> Proof_Context.add_fixes vars |> snd end
+  | declare_elem prep_var (Element.Constrains csts) ctxt =
+      ctxt |> fold_map (fn (x, T) =>
+        prep_var (Binding.name x, SOME T, NoSyn)) csts |> snd
+  | declare_elem _ (Element.Assumes _) ctxt = ctxt
+  | declare_elem _ (Element.Defines _) ctxt = ctxt
+  | declare_elem _ (Element.Notes _) ctxt = ctxt
+  | declare_elem _ (Element.Lazy_Notes _) ctxt = ctxt;
+
+fun prep_full_context_statement
+  parse_prop prop_root elem_root raw_elems raw_stmt ctxt1 =
+  let
+
+    fun prep_elem raw_elem ctxt =
+      let
+        val ctxt' = ctxt
+          |> Context_Position.set_visible false
+          |> declare_elem Proof_Context.read_var raw_elem
+          |> Context_Position.restore_visible ctxt;
+        val elems' = parse_elem Syntax.parse_typ (parse_prop elem_root) ctxt' raw_elem;
+      in (elems', ctxt') end;
+
+    val fors = fold_map Proof_Context.read_var [] ctxt1 |> fst;
+    val ctxt2 = ctxt1 |> Proof_Context.add_fixes fors |> snd;
+    val ctxt3 = ctxt2
+
+    fun prep_stmt elems ctxt = check_autofix elems
+      (prepare_stmt (parse_prop prop_root) ctxt raw_stmt) ctxt;
+
+    val ((elems', concl), ctxt4) = ctxt3
+      |> fold_map prep_elem raw_elems
+      |-> prep_stmt;
+
+    (* parameters from expression and elements *)
+
+    val xs = maps (fn Element.Fixes fixes =>
+      map (Variable.check_name o #1) fixes | _ => [])
+      (Element.Fixes fors :: elems');
+    val (parms, _) = fold_map Proof_Context.inferred_param xs ctxt4;
+
+    val elems'' = map (finish_elem parms) elems';
+
+  in (elems'', concl) end;
+in
+
+fun read_statement prop_root elem_root raw_elems raw_stmt ctxt =
+  let
+    val (elems, concl) = prep_full_context_statement
+      AOT_read_prop prop_root elem_root raw_elems raw_stmt ctxt;
+    val ctxt' = Proof_Context.set_stmt true ctxt
+    val (elems, ctxt') = fold_map Element.activate elems ctxt'
+    val _ = Proof_Context.restore_stmt ctxt ctxt'
+  in (concl, elems, ctxt) end;
+
+end
+
+(* End of Expression.read_statement variant. *)
+
+val long_keyword =
+  Parse_Spec.includes >> K "" ||
+  Parse_Spec.long_statement_keyword;
+
+val long_statement =
+  Scan.optional (Parse_Spec.opt_thm_name ":" --| Scan.ahead long_keyword)
+    Binding.empty_atts --
+  Scan.optional Parse_Spec.includes [] --Parse_Spec.long_statement
+    >> (fn ((binding, includes), (elems, concl)) =>
+          (true, binding, includes, elems, concl))
+val short_statement =
+  Parse_Spec.statement -- Parse_Spec.if_statement -- Parse.for_fixes
+    >> (fn ((shows, assumes), fixes) =>
+      (false, Binding.empty_atts, [], [Element.Fixes fixes, Element.Assumes assumes],
+        Element.Shows shows))
+
+fun setupStrictWorld ctxt = let
+(* TODO: ideally not just a fixed name, but a variant name... *)
+val (v,ctxt) = Proof_Context.add_fixes
+  [(Binding.make ("ws", Position.none), SOME @{typ w}, Mixfix.NoSyn)] ctxt |>
+  apfst the_single
+in AOT_ProofData.put (SOME (Free (v, @{typ w}))) ctxt end
+fun setupWeakWorld ctxt = AOT_ProofData.put (SOME @{const w\<^sub>0}) ctxt
+
+fun mapStmt mapTerm _ (Element.Shows x) =
+    Element.Shows (map (map (fn (trm, trms) =>
+      (mapTerm trm, map mapTerm trms)) |> apsnd) x)
+  | mapStmt mapTerm mapTyp (Element.Obtains x) =
+    Element.Obtains (map ((fn (x, y) =>
+      (map (fn (a,b,c) => (a, Option.map mapTyp b, c)) x, map mapTerm y)) |> apsnd) x)
+fun mapCtxt mapTerm mapTyp ctxtElem = Element.map_ctxt
+  {attrib = I, binding = I, fact = I, pattern = mapTerm, term = mapTerm, typ = mapTyp}
+  ctxtElem
+
+fun AOT_theorem_cmd axiom modallyStrict long afterQed thmBinding
+  includes assumptions shows int ctxt =
+  let
+    val ctxt = Bundle.includes_cmd includes ctxt
+    val ctxt = if modallyStrict then setupStrictWorld ctxt else setupWeakWorld ctxt
+    val root = if axiom
+      then (if modallyStrict
+            then @{nonterminal "AOT_axiom"}
+            else @{nonterminal "AOT_act_axiom"})
+      else @{nonterminal AOT_prop}
+    val (stmts,assumptions,ctxt) = read_statement
+      root @{nonterminal AOT_prop} assumptions shows ctxt
+    val _ = AOT_print_item_number (Binding.name_of (fst thmBinding))
+    val _ = fold (fn ((bnd,_),_) => fn _ =>
+      AOT_print_item_number (Binding.name_of bnd)) stmts ()
+  in
+    Specification.theorem long "AOT_theorem" NONE afterQed thmBinding []
+      assumptions (Element.Shows stmts) int ctxt
+  end
+
+fun AOT_theorem spec note axiom modallyStrict descr =
+  Outer_Syntax.local_theory_to_proof' spec ("state " ^ descr)
+    ((long_statement || short_statement) >>
+      (fn (long, binding, includes, elems, concl) =>
+        (AOT_theorem_cmd axiom modallyStrict long
+          (if note then AOT_note_theorems else K I) binding includes elems concl)));
+
+val _ = AOT_theorem \<^command_keyword>\<open>AOT_lemma\<close> false false true
+  "AOT modally-strict lemma";
+val _ = AOT_theorem \<^command_keyword>\<open>AOT_theorem\<close> true false true
+  "AOT modally-strict theorem";
+val _ = AOT_theorem \<^command_keyword>\<open>AOT_act_lemma\<close> false false false
+  "AOT modally-weak lemma";
+val _ = AOT_theorem \<^command_keyword>\<open>AOT_act_theorem\<close> true false false
+  "AOT modally-weak theorem"
+val _ = AOT_theorem \<^command_keyword>\<open>AOT_axiom\<close> true true true
+  "AOT modally-strict axiom";
+val _ = AOT_theorem \<^command_keyword>\<open>AOT_act_axiom\<close> true true false
+  "AOT modally-weak axiom"
+
+local
+val structured_statement =
+  Parse_Spec.statement -- Parse_Spec.if_statement -- Parse.for_fixes
+    >> (fn ((shows, assumes), fixes) => (fixes, assumes, shows));
+
+fun prep_stmt (fixes, assumes, shows) ctxt = let
+  val (concl, elems, _) = read_statement
+    @{nonterminal AOT_prop} @{nonterminal AOT_prop}
+    [Element.Fixes fixes, Element.Assumes assumes] (Element.Shows shows) ctxt
+  val (fixes, assumes) =
+    (fn ([Element.Fixes fixes, Element.Assumes assumes]) => (fixes, assumes)
+      | _ => raise Fail "Unexpected.") elems
+  fun mapAttr (a,[]) = (a,[])
+    | mapAttr _ = raise Match (* Unimplemented *)
+  val assumes = map (mapAttr |> apfst) assumes
+  val concl = map (mapAttr |> apfst) concl
+in (fixes, assumes, concl) end
+
+fun gen_cmd kind stmt int state = let
+    val (fixes, assumes, shows) = prep_stmt stmt (Proof.context_of state)
+  in (kind true NONE (K I) fixes assumes shows int) state end
+in
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_show\<close>
+    "state local AOT goal, to refine pending subgoals"
+    (structured_statement >> (fn stmt =>
+      Toplevel.proof' (fn int => (gen_cmd Proof.show stmt int #> #2))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_thus\<close> "alias of  \"then AOT_show\""
+    (structured_statement >> (fn stmt =>
+      Toplevel.proof' (fn int => Proof.chain #> (gen_cmd Proof.show stmt int #> #2))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_have\<close> "state local AOT goal"
+    (structured_statement >> (fn stmt =>
+      Toplevel.proof' (fn int => (gen_cmd Proof.have stmt int #> #2))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_hence\<close> "alias of  \"then AOT_have\""
+    (structured_statement >> (fn stmt =>
+      Toplevel.proof' (fn int => Proof.chain #> (gen_cmd Proof.have stmt int #> #2))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_modally_strict {\<close>
+    "begin explicit AOT modally-strict proof block"
+    (Scan.succeed (Toplevel.proof (fn state => (Proof.map_context (fn ctxt => let
+        val v = singleton (Variable.variant_frees ctxt []) ("ws", @{typ w}) |> fst
+        val (_,ctxt) = Proof_Context.add_fixes
+          [(Binding.make (v, Position.none), SOME @{typ w}, Mixfix.NoSyn)] ctxt
+        val ctxt = AOT_ProofData.put (SOME (Free (v, @{typ w}))) ctxt
+        in ctxt end) (Proof.begin_block state)))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_actually {\<close>
+    "begin explicit AOT modally-fragile proof block"
+    (Scan.succeed (Toplevel.proof (fn state => (Proof.map_context (fn ctxt => let
+        val ctxt = AOT_ProofData.put (SOME (@{const w\<^sub>0})) ctxt
+        in ctxt end) (Proof.begin_block state)))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_assume\<close> "assume AOT propositions"
+    (structured_statement >> (fn stmt =>
+      Toplevel.proof' (fn _ => fn state => (let
+            val (fixes, assumes, shows) = prep_stmt stmt (Proof.context_of state)
+        in Proof.assume fixes (map snd assumes) shows state end))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_obtain\<close> "generalized AOT elimination"
+    (Parse.parbinding -- Scan.optional (Parse.vars --| Parse.where_) [] --
+      structured_statement >> (fn ((a, b), stmt) => Toplevel.proof'
+        (fn int => fn state => (let
+          val ctxt = Proof.context_of state
+          val b = map (fn (a,b,c) => (a,Option.map (Syntax.read_typ ctxt) b, c)) b
+          val bnds = map (fn (a,_,_) => a) b
+          val (_,ctxt) = Variable.add_fixes_binding bnds ctxt
+          val (fixes, assumes, shows) = prep_stmt stmt ctxt
+  in Obtain.obtain a b fixes (map snd assumes) shows int state end))));
+
+end
+
+structure AOT_no_atp = Named_Thms(
+  val name = @{binding "AOT_no_atp"}
+  val description = "AOT Theorem Blacklist"
+)
+
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_sledgehammer\<close>
+    "sledgehammer restricted to AOT abstraction layer"
+    (Scan.succeed (Toplevel.keep_proof (fn state => let
+val params = Sledgehammer_Commands.default_params (Toplevel.theory_of state) []
+val ctxt = Toplevel.context_of state
+fun all_facts_of ctxt =
+  let
+    val thy = Proof_Context.theory_of ctxt;
+    val transfer = Global_Theory.transfer_theories thy;
+    val global_facts = Global_Theory.facts_of thy;
+  in
+   (Facts.dest_all (Context.Proof ctxt) false [] global_facts
+   |> maps Facts.selections
+   |> map (apsnd transfer))
+  end
+val facts = all_facts_of ctxt
+val add_facts = filter
+  (fn fact => AOT_Theorems.member ctxt (snd fact)) facts |> map (fn (x,_) => (x,[]))
+val del_facts = filter
+  (fn fact => AOT_no_atp.member ctxt (snd fact)) facts |> map (fn (x,_) => (x,[]))
+val ctxt = Toplevel.proof_of state
+val _ = Sledgehammer.run_sledgehammer params Sledgehammer_Prover.Normal NONE 1
+  {add = add_facts, del = del_facts, only = false} ctxt
+in () end)))
+
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_sledgehammer_only\<close>
+    "sledgehammer restricted to AOT abstraction layer"
+    (Scan.succeed (Toplevel.keep_proof (fn state => let
+val params = Sledgehammer_Commands.default_params (Toplevel.theory_of state) []
+val ctxt = Toplevel.context_of state
+fun all_facts_of ctxt =
+  let
+    val thy = Proof_Context.theory_of ctxt;
+    val transfer = Global_Theory.transfer_theories thy;
+    val local_facts = Proof_Context.facts_of ctxt;
+    val global_facts = Global_Theory.facts_of thy;
+  in
+   (Facts.dest_all (Context.Proof ctxt) false [global_facts] local_facts 
+   |> maps Facts.selections
+   |> map (apsnd transfer) |> map fst) @
+   (Facts.dest_all (Context.Proof ctxt) false [] global_facts
+   |> maps Facts.selections
+   |> map (apsnd transfer)
+   |> filter (AOT_Theorems.member ctxt o snd) |> map fst)
+  end
+val facts = all_facts_of ctxt
+val result = map (fn x => (x,[])) facts
+val ctxt = Toplevel.proof_of state
+val _ = Sledgehammer.run_sledgehammer params Sledgehammer_Prover.Normal NONE 1
+  {add = result, del = [], only = true} ctxt
+in () end)))
+
+local
+
+fun readTermPattern ctxt str = (let
+  val trm = case try (AOT_read_term @{nonterminal \<tau>'} ctxt) str of SOME x => x
+            | NONE =>
+              (case try (AOT_read_term @{nonterminal \<phi>'} ctxt) str of SOME x => x
+               | NONE => (AOT_read_term @{nonterminal AOT_prop} ctxt) str)
+  val trm = Syntax.check_term ctxt trm
+  fun varifyTerm (Const (\<^const_name>\<open>AOT_term_of_var\<close>, Type ("fun", [_, t])) $
+                  Free (x, _)) = Var ((x, 0), t)
+    | varifyTerm (Free (x,t)) = Var ((x, 0), t)
+    | varifyTerm (x $ y) = varifyTerm x $ varifyTerm y
+    | varifyTerm (Abs (a, b, c)) = Abs(a, b, varifyTerm c)
+    | varifyTerm z = z
+  val trm = Term.map_types
+    (Term.map_type_tfree (fn (str,sort) => TVar ((str, 0), sort))) trm
+  val trm = varifyTerm trm
+in trm end)
+
+fun parseCriterion ctxt (Find_Theorems.Simp crit) =
+    (Find_Theorems.Simp (readTermPattern ctxt crit))
+  | parseCriterion ctxt (Find_Theorems.Pattern crit) =
+    (Find_Theorems.Pattern (readTermPattern ctxt crit))
+  | parseCriterion _ (Find_Theorems.Name x) = (Find_Theorems.Name x)
+  | parseCriterion _ Find_Theorems.Intro = Find_Theorems.Intro
+  | parseCriterion _ Find_Theorems.Elim = Find_Theorems.Elim
+  | parseCriterion _ Find_Theorems.Dest = Find_Theorems.Dest
+  | parseCriterion _ Find_Theorems.Solves = Find_Theorems.Solves
+
+
+fun pretty_criterion ctxt (b, c) =
+  let
+    fun prfx s = if b then s else "-" ^ s;
+  in
+    (case c of
+      Find_Theorems.Name name => Pretty.str (prfx "name: " ^ quote name)
+    | Find_Theorems.Intro => Pretty.str (prfx "intro")
+    | Find_Theorems.Elim => Pretty.str (prfx "elim")
+    | Find_Theorems.Dest => Pretty.str (prfx "dest")
+    | Find_Theorems.Solves => Pretty.str (prfx "solves")
+    | Find_Theorems.Simp pat => Pretty.block [Pretty.str (prfx "simp:"), Pretty.brk 1,
+        Pretty.quote (Syntax.pretty_term ctxt (Term.show_dummy_patterns pat))]
+    | Find_Theorems.Pattern pat => Pretty.enclose (prfx "\"") "\""
+        [Syntax.pretty_term ctxt (Term.show_dummy_patterns pat)])
+  end;
+
+datatype query = Criterion of (bool*string Find_Theorems.criterion) list |
+                 Item of (int*string list)
+
+fun pretty_theorems ctxt opt_lim rem_dups raw_spec =
+let
+  fun pretty_ref ctxt thmref =
+    let
+      val (name, sel) =
+        (case thmref of
+          Facts.Named ((name, _), sel) => (name, sel)
+        | Facts.Fact _ => raise Fail "Illegal literal fact");
+      val item = case
+        AOT_get_item_number (Binding.name_of (Binding.qualified_name name))
+        of SOME str => [Pretty.str ("("^str^")"), Pretty.str ":", Pretty.brk 1]
+        | _ => []
+    in
+      item @ [Pretty.marks_str (#1 (Proof_Context.markup_extern_fact ctxt name), name),
+        Pretty.str (Facts.string_of_selection sel), Pretty.str ":", Pretty.brk 1]
+    end;
+  fun tailToStr delim tail = (fold (fn field => fn str => str^delim^field) tail "")
+  fun pretty_item (id, sub) = Pretty.str (
+    "item: "^quote (Int.toString id^tailToStr "." sub)^
+    " (name: "^quote ((the (AOT_name_of_item id))^tailToStr ":" sub)^")")
+  fun pretty_thm ctxt (thmref, thm) =
+    Pretty.block (pretty_ref ctxt thmref @ [Thm.pretty_thm ctxt thm])
+  val (spec, prefix) = (case raw_spec of Item (item, tail) =>
+      (case AOT_name_of_item item of SOME name =>
+          let val fullName = name^tailToStr ":" tail
+          in ([(true, Find_Theorems.Name fullName)], SOME fullName) end
+          | _ => raise Fail "Unknown PLM item number.")
+      | Criterion spec => (spec, NONE))
+  val criteria = map (apsnd (parseCriterion ctxt)) spec
+  val (opt_found, _) = Find_Theorems.find_theorems ctxt NONE (SOME 0) rem_dups criteria
+  val (_, theorems) = Find_Theorems.find_theorems ctxt NONE opt_found rem_dups criteria
+  val lim = the_default
+    (Options.default_int \<^system_option>\<open>find_theorems_limit\<close>) opt_lim;
+  val theorems = filter (fn (_,thm) => AOT_Theorems.member ctxt thm) theorems
+  val theorems = case prefix of SOME prefix =>
+    filter (fn (Facts.Named ((name, _), _), _) =>
+      let val unqualified = (Binding.name_of (Binding.qualified_name name))
+      in
+      String.isPrefix prefix unqualified
+      andalso (String.size unqualified <= String.size prefix orelse
+        let
+          val delim = String.sub (unqualified, String.size prefix)
+        in delim = #":" orelse delim = #"[" end)
+      end
+      | _ => false) theorems
+    | _ => theorems
+  val found = length theorems
+  val theorems = drop (Int.max (found - lim, 0)) theorems
+  val returned = length theorems
+    val tally_msg =
+      (if found <= lim then "displaying " ^ string_of_int returned ^ " theorem(s)"
+      else "found " ^ string_of_int found ^ " theorem(s)" ^
+            (if returned < found
+             then " (" ^ string_of_int returned ^ " displayed)"
+             else ""));
+    val position_markup = Position.markup (Position.thread_data ()) Markup.position;
+  val pretty = Pretty.block
+        (Pretty.fbreaks
+          (Pretty.mark position_markup (Pretty.keyword1 "AOT_find_theorems") ::
+            ((case raw_spec of Item (id, sub) =>
+              [pretty_item (id, sub)] | _ => map (pretty_criterion ctxt) criteria)))) ::
+    Pretty.str "" ::
+    (if null theorems then [Pretty.str "found nothing"]
+     else
+       Pretty.str (tally_msg ^ ":") ::
+       grouped 10 Par_List.map (Pretty.item o single o pretty_thm ctxt) (rev theorems))
+in
+  pretty |> Pretty.fbreaks |> curry Pretty.blk 0
+end
+
+val options =
+  Scan.optional
+    (Parse.$$$ "(" |--
+      Parse.!!! (Scan.option Parse.nat --
+        Scan.optional (Parse.reserved "with_dups" >> K false) true --| Parse.$$$ ")"))
+    (NONE, true);
+
+val item_parser = (Parse.nat >> (fn n => (n,[]))  || (Parse.string >> (
+  fn str => let
+    val fields = String.fields (equal #".") str
+    val n = case (Int.fromString (hd fields)) of (SOME n) => n | _ => 0
+    in (n, tl fields) end )))
+
+val query_parser =
+  ((Parse.reserved "item" |-- Parse.!!! (Parse.$$$ ":" |-- item_parser) >> Item) ||
+  (Find_Theorems.query_parser >> Criterion))
+  fun find_theorems ((opt_lim, rem_dups), spec) st =
+     (Pretty.writeln
+            (pretty_theorems (AOT_ProofData.put (SOME (Var (("ws", 0), @{typ w})))
+                              (Proof.context_of (Find_Theorems.proof_state st)))
+                             opt_lim rem_dups spec))
+in
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_find_theorems\<close>
+    "find theorems meeting specified criteria"
+    (options -- query_parser >> (fn query =>
+      Toplevel.keep (fn st => find_theorems query st)));
+
+end
+
+fun setup_AOT_no_atp thy = let
+val all_facts_with_AOT_semantics =
+  let
+    val transfer = Global_Theory.transfer_theories thy;
+    val global_facts = Global_Theory.facts_of thy;
+  in
+   (Facts.dest_all (Context.Theory thy) false [] global_facts
+   |> maps Facts.selections
+   |> map (apsnd transfer)
+   |> filter (not o AOT_Theorems.member (Proof_Context.init_global thy) o snd))
+  end
+val all_facts_Main =
+  let
+    val transfer = Global_Theory.transfer_theories @{theory Main};
+    val global_facts = Global_Theory.facts_of @{theory Main};
+  in
+   (Facts.dest_all (Context.Theory @{theory Main}) false [] global_facts
+   |> maps Facts.selections
+   |> map (apsnd transfer))
+  end
+val facts = filter
+  (fn (elem,_) => not (List.exists (fn (elem',_) => elem = elem') all_facts_Main))
+  all_facts_with_AOT_semantics
+val thy = fold
+  (fn fact => Context.theory_map (AOT_no_atp.add_thm fact))
+  (map snd facts) thy
+in thy end
diff --git a/thys/AOT/AOT_commands.thy b/thys/AOT/AOT_commands.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_commands.thy
@@ -0,0 +1,47 @@
+(*<*)
+theory AOT_commands
+  imports AOT_model "HOL-Eisbach.Eisbach_Tools"
+  keywords "AOT_define" :: thy_decl
+       and "AOT_theorem" :: thy_goal
+       and "AOT_lemma" :: thy_goal
+       and "AOT_act_theorem" :: thy_goal
+       and "AOT_act_lemma" :: thy_goal
+
+       and "AOT_axiom" :: thy_goal
+       and "AOT_act_axiom" :: thy_goal
+
+       and "AOT_assume" :: prf_asm % "proof"
+       and "AOT_have" :: prf_goal % "proof"
+       and "AOT_hence" :: prf_goal % "proof"
+       and "AOT_modally_strict {" :: prf_open % "proof"
+       and "AOT_actually {" :: prf_open % "proof"
+       and "AOT_obtain" :: prf_asm_goal % "proof"
+       and "AOT_show" :: prf_asm_goal % "proof"
+       and "AOT_thus" :: prf_asm_goal % "proof"
+
+       and "AOT_find_theorems" :: diag
+       and "AOT_sledgehammer" :: diag
+       and "AOT_sledgehammer_only" :: diag
+       and "AOT_syntax_print_translations" :: thy_decl
+       and "AOT_no_syntax_print_translations" :: thy_decl
+begin
+(*>*)
+
+section\<open>Outer Syntax Commands\<close>
+
+nonterminal AOT_prop
+nonterminal \<phi>
+nonterminal \<phi>'
+nonterminal \<tau>
+nonterminal \<tau>'
+nonterminal "AOT_axiom"
+nonterminal "AOT_act_axiom"
+ML_file AOT_keys.ML
+ML_file AOT_commands.ML
+setup\<open>AOT_Theorems.setup\<close>
+setup\<open>AOT_Definitions.setup\<close>
+setup\<open>AOT_no_atp.setup\<close>
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/AOT/AOT_keys.ML b/thys/AOT/AOT_keys.ML
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_keys.ML
@@ -0,0 +1,909 @@
+val AOT_items = [
+    (1, "simple-terms"),
+    (2, "primitive-expressions"),
+    (3, "syntax"),
+    (4, "bnf"),
+    (5, "conventions2"),
+    (6, "df-subformula"),
+    (7, "df-subterm"),
+    (8, "enc-form-sub"),
+    (9, "free-in"),
+    (10, "open-formulas-terms"),
+    (11, "closures"),
+    (12, "term-same-type"),
+    (13, "identity-remark"),
+    (14, "substitutions"),
+    (15, "substitutable"),
+    (16, "alphabetic-variants"),
+    (17, "two-defs"),
+    (18, "conventions"),
+    (19, "conventions3"),
+    (20, "existence"),
+    (21, "studied-amb"),
+    (22, "oa"),
+    (23, "identity"),
+    (24, "=-infix"),
+    (25, "lang-conc-rem"),
+    (26, "alpha-bet-rem"),
+    (27, "identity-pre"),
+    (28, "identity-pre2"),
+    (29, "convention-rem"),
+    (30, "pre-exists"),
+    (31, "exp-sub"),
+    (32, "exp-sub2"),
+    (33, "exist-just"),
+    (34, "no-rel-prop"),
+    (35, "identity-rem"),
+    (36, "p-identity-rem"),
+    (37, "p-identity2-rem"),
+    (38, "pl"),
+    (39, "cqt"),
+    (40, "cqt-just"),
+    (41, "l-identity"),
+    (42, "m-fragile"),
+    (43, "logic-actual"),
+    (44, "logic-actual-nec"),
+    (45, "qml"),
+    (46, "qml-act"),
+    (47, "descriptions"),
+    (48, "lambda-predicates"),
+    (49, "safe-ext"),
+    (50, "nary-encoding"),
+    (51, "encoding"),
+    (52, "nocoder"),
+    (53, "A-objects"),
+    (54, "no-immediate-contra"),
+    (55, "cqt-expl"),
+    (56, "qml4-remark"),
+    (57, "coexist-rm"),
+    (58, "modus-ponens"),
+    (59, "theoremhood"),
+    (60, "Box-theoremhood"),
+    (61, "metarules"),
+    (62, "non-con-thm-thm"),
+    (63, "vdash-properties"),
+    (64, "df-noncon-thm"),
+    (65, "dependence"),
+    (66, "rule-gen"),
+    (67, "rule-convention"),
+    (68, "RN"),
+    (69, "preserve-GEN-RN"),
+    (70, "RN-w-cont"),
+    (71, "RN-converse-rem"),
+    (72, "df-rules-formulas"),
+    (73, "df-rules-terms"),
+    (74, "if-p-then-p"),
+    (75, "deduction-theorem"),
+    (76, "ded-thm-cor"),
+    (77, "useful-tautologies"),
+    (78, "dn-i-e"),
+    (79, "modus-tollens"),
+    (80, "contraposition"),
+    (81, "reductio-aa"),
+    (82, "in-el-i-e"),
+    (83, "exc-mid"),
+    (84, "non-contradiction"),
+    (85, "con-dis-taut"),
+    (86, "con-dis-i-e"),
+    (87, "raa-cor"),
+    (88, "oth-class-taut"),
+    (89, "intro-elim"),
+    (90, "rule-eq-df"),
+    (91, "df-simplify"),
+    (92, "remark-taut"),
+    (93, "rule-ui"),
+    (94, "misuse-substitution"),
+    (95, "cqt-orig"),
+    (96, "universal"),
+    (97, "rereplace-lem"),
+    (98, "rereplace-rmk"),
+    (99, "cqt-basic"),
+    (100, "universal-cor"),
+    (101, "existential"),
+    (102, "instantiation"),
+    (103, "cqt-further"),
+    (104, "log-prop-prop"),
+    (105, "safe-ext-rem"),
+    (106, "exist-nec"),
+    (107, "t=t-proper"),
+    (108, "id-rel-nec-equiv"),
+    (109, "df-equiv-id"),
+    (110, "rule=E"),
+    (111, "propositions-lemma"),
+    (112, "rem-truth"),
+    (113, "remark-on-tautologies"),
+    (114, "dr-alphabetic-rules"),
+    (115, "oa-exist"),
+    (116, "p-identity-thm2"),
+    (117, "id-eq"),
+    (118, "rule=I"),
+    (119, "rule-id-df-rem"),
+    (120, "rule-id-df"),
+    (121, "free-thms"),
+    (122, "free-thms-rem"),
+    (123, "ex"),
+    (124, "all-self="),
+    (125, "id-nec"),
+    (126, "term-out"),
+    (127, "uniqueness"),
+    (128, "uni-most"),
+    (129, "nec-exist-!"),
+    (130, "act-cond"),
+    (131, "nec-imp-act"),
+    (132, "act-conj-act"),
+    (133, "closure-act"),
+    (134, "RA"),
+    (135, "meta-rule"),
+    (136, "logic-actual-rem"),
+    (137, "ANeg"),
+    (138, "Act-Basic"),
+    (139, "act-quant-uniq"),
+    (140, "fund-cont-desc"),
+    (141, "hintikka"),
+    (142, "russell-axiom"),
+    (143, "!-exists"),
+    (144, "y-in"),
+    (145, "act-quant-nec"),
+    (146, "equi-desc-descA"),
+    (147, "nec-hintikka-scheme"),
+    (148, "equiv-desc-eq"),
+    (149, "equiv-desc-eq2"),
+    (150, "nec-russell-axiom"),
+    (151, "actual-desc"),
+    (152, "!box-desc"),
+    (153, "dr-alphabetic-thm"),
+    (154, "cqt-remark"),
+    (155, "taut-nec"),
+    (156, "RM"),
+    (157, "KBasic"),
+    (158, "rule-sub-lem"),
+    (159, "rule-sub-nec"),
+    (160, "rule-sub-remark"),
+    (161, "KBasic2"),
+    (162, "T-S5-fund"),
+    (163, "Act-Sub"),
+    (164, "S5Basic"),
+    (165, "derived-S5-rules"),
+    (166, "BFs"),
+    (167, "sign-S5-thm"),
+    (168, "exist-nec2"),
+    (169, "id-nec2"),
+    (170, "sc-eq-box-box"),
+    (171, "west-mmrule"),
+    (172, "sc-eq-fur"),
+    (173, "id-act"),
+    (174, "A-Exists"),
+    (175, "id-act-desc"),
+    (176, "pre-en-eq"),
+    (177, "en-eq"),
+    (178, "oa-facts"),
+    (179, "beta-C-meta"),
+    (180, "beta-free-rem"),
+    (181, "beta-C-cor"),
+    (182, "betaC"),
+    (183, "eta-variants"),
+    (184, "eta-conversion-lemma1"),
+    (185, "eta-conversion-lemma2"),
+    (186, "sub-des-lam"),
+    (187, "prop-equiv"),
+    (188, "prop-rem"),
+    (189, "relations"),
+    (190, "block-paradox"),
+    (191, "block-paradox2"),
+    (192, "propositions"),
+    (193, "pos-not-equiv-ne"),
+    (194, "df-relation-negation"),
+    (195, "rel-neg-T"),
+    (196, "df-rel-neg-rem"),
+    (197, "thm-relation-negation"),
+    (198, "contingent-properties"),
+    (199, "cont-prop-rem"),
+    (200, "thm-cont-prop"),
+    (201, "thm-noncont-e-e"),
+    (202, "lem-cont-e"),
+    (203, "thm-cont-e"),
+    (204, "property-facts"),
+    (205, "thm-cont-propos"),
+    (206, "thm-noncont-propos"),
+    (207, "no-cnac"),
+    (208, "pos-not-pna"),
+    (209, "basic-prop"),
+    (210, "proposition-facts"),
+    (211, "cont-tf"),
+    (212, "cont-true-cont"),
+    (213, "q0cf"),
+    (214, "q0cf-rem"),
+    (215, "cont-tf-thm"),
+    (216, "rem-conting"),
+    (217, "property-facts1"),
+    (218, "eq-not-nec"),
+    (219, "eqnotnec"),
+    (220, "oa-contingent"),
+    (221, "df-cont-nec"),
+    (222, "cont-nec-fact1"),
+    (223, "cont-nec-fact2"),
+    (224, "sixteen"),
+    (225, "o-objects-exist"),
+    (226, "partition"),
+    (227, "=E"),
+    (228, "=E-infix"),
+    (229, "haecceity-expanded"),
+    (230, "=E-simple"),
+    (231, "id-nec3"),
+    (232, "non-=E"),
+    (233, "thm-neg=E"),
+    (234, "id-nec4"),
+    (235, "id-act2"),
+    (236, "ord=Eequiv"),
+    (237, "ord-=E="),
+    (238, "ind-nec"),
+    (239, "ord=E"),
+    (240, "ord=E2"),
+    (241, "ordnecfail"),
+    (242, "ab-obey"),
+    (243, "encoders-are-abstract"),
+    (244, "denote="),
+    (245, "denote=rem"),
+    (246, "A-obj-ex"),
+    (247, "A-objects!"),
+    (248, "obj-oth"),
+    (249, "A-descriptions"),
+    (250, "can-ind"),
+    (251, "thm-can-terms2"),
+    (252, "can-ab2"),
+    (253, "desc-encode"),
+    (254, "abstraction-contingent"),
+    (255, "desc-nec-encode"),
+    (256, "Box-desc-encode"),
+    (257, "strict-can"),
+    (258, "box-phi-a"),
+    (259, "strict-can-rem2"),
+    (260, "df-null-uni"),
+    (261, "null-uni-uniq"),
+    (262, "df-null-uni-terms"),
+    (263, "null-uni-facts"),
+    (264, "null-uni-rmk2"),
+    (265, "aclassical"),
+    (266, "aclassical2"),
+    (267, "kirchner-thm-rem"),
+    (268, "kirchner-thm"),
+    (269, "kirchner-thm-cor"),
+    (270, "prop-prop1"),
+    (271, "prop-prop2"),
+    (272, "prop-indis"),
+    (273, "prop-in-thm"),
+    (274, "prop-in-f"),
+    (275, "prop-prop-nec"),
+    (276, "enc-prop-nec"),
+    (277, "def-omit"),
+    (278, "t-dfs"),
+    (279, "df-fragile-axiom"),
+    (280, "tvalues-remark"),
+    (281, "tv-p"),
+    (282, "tv-p-rem"),
+    (283, "p-has-!tv"),
+    (284, "uni-tv"),
+    (285, "the-tv-p"),
+    (286, "prop-enc"),
+    (287, "tv-id"),
+    (288, "not-can-thm"),
+    (289, "t-prov-can"),
+    (290, "T-lem"),
+    (291, "ab-T"),
+    (292, "TV-lem1"),
+    (293, "T-value"),
+    (294, "TVp-TV"),
+    (295, "TV-lem2"),
+    (296, "the-true"),
+    (297, "T-T-value"),
+    (298, "two-T"),
+    (299, "valueof-facts"),
+    (300, "q-True"),
+    (301, "exten-p"),
+    (302, "extof-e"),
+    (303, "ext-p-tv"),
+    (304, "set-remark"),
+    (305, "tv-v-class"),
+    (306, "naive-logical"),
+    (307, "exten-property"),
+    (308, "exten-remark"),
+    (309, "pre-LawV"),
+    (310, "unique-ext-of"),
+    (311, "mat-eq-cont1"),
+    (312, "membership"),
+    (313, "in-no-col"),
+    (314, "mem-exem"),
+    (315, "fund-thm-class"),
+    (316, "the-extG"),
+    (317, "no-imprac"),
+    (318, "extG-id"),
+    (319, "mat-eq-cont2"),
+    (320, "eG-not-sc"),
+    (321, "ext-features"),
+    (322, "lawV"),
+    (323, "Frege-notation"),
+    (324, "Frege-lawV"),
+    (325, "no-lawV-pred"),
+    (326, "frege-members"),
+    (327, "mem-exem-cor"),
+    (328, "extG-class"),
+    (329, "eG-not-sc-rem"),
+    (330, "res-var"),
+    (331, "res-var-bound"),
+    (332, "res-var-df"),
+    (333, "res-var-term"),
+    (334, "res-var-bound-reas"),
+    (335, "res-var-free"),
+    (336, "res-var-empty"),
+    (337, "extensionality"),
+    (338, "df-null"),
+    (339, "null"),
+    (340, "null-symbol"),
+    (341, "null-exists"),
+    (342, "df-universall"),
+    (343, "universal-class"),
+    (344, "df-unions"),
+    (345, "unions"),
+    (346, "unions2"),
+    (347, "unions3"),
+    (348, "unions-df"),
+    (349, "unions-prin"),
+    (350, "df-complements"),
+    (351, "complements"),
+    (352, "complements2"),
+    (353, "df-intersections"),
+    (354, "intersections"),
+    (355, "intersections2"),
+    (356, "intersect-df"),
+    (357, "int-mem"),
+    (358, "cond-set-comprehension"),
+    (359, "res-meta"),
+    (360, "set-comp-df"),
+    (361, "t-defs4"),
+    (362, "class-ab-prin"),
+    (363, "class-ab-id"),
+    (364, "separation"),
+    (365, "separation2"),
+    (366, "separation-ab"),
+    (367, "sep-ab-prin"),
+    (368, "ab-inter"),
+    (369, "collection"),
+    (370, "pre-singletons"),
+    (371, "singletons"),
+    (372, "single-df"),
+    (373, "singleton-facts"),
+    (374, "singleton-facts2"),
+    (375, "pairs"),
+    (376, "adjunction"),
+    (377, "ex-anti-ext"),
+    (378, "log-obj"),
+    (379, "df-equiv-cond"),
+    (380, "thm-equiv-cond"),
+    (381, "notate-ab"),
+    (382, "Frege-p"),
+    (383, "axiom-lines"),
+    (384, "lem-lines"),
+    (385, "df-direction"),
+    (386, "direct-line"),
+    (387, "direct-line2"),
+    (388, "direction-df"),
+    (389, "para-dir"),
+    (390, "directions"),
+    (391, "exist-dir"),
+    (392, "remark-shapes"),
+    (393, "lem-shapes"),
+    (394, "df-shape"),
+    (395, "shape-figure"),
+    (396, "shape-figure2"),
+    (397, "shape-df"),
+    (398, "shape-thm"),
+    (399, "shapes2"),
+    (400, "exist-shape"),
+    (401, "equiv-rel"),
+    (402, "R1"),
+    (403, "equiv-rest"),
+    (404, "lem-Rab"),
+    (405, "df-ab"),
+    (406, "ab-exists"),
+    (407, "ab-exists2"),
+    (408, "df-by-ab"),
+    (409, "R-ab"),
+    (410, "form-remark"),
+    (411, "form-of"),
+    (412, "forms-exist"),
+    (413, "phi-G"),
+    (414, "phiG-id"),
+    (415, "phiG-sc"),
+    (416, "TheFormGFormG"),
+    (417, "pre-sp"),
+    (418, "participation"),
+    (419, "pre-OM-weak"),
+    (420, "part=ex"),
+    (421, "om"),
+    (422, "counter-sp"),
+    (423, "forms-encode"),
+    (424, "sp-remark"),
+    (425, "forms"),
+    (426, "TheFormGForm"),
+    (427, "rem-no-par"),
+    (428, "platonic-being"),
+    (429, "form-part"),
+    (430, "third-man"),
+    (431, "tforms-remark"),
+    (432, "F-imp-G"),
+    (433, "imp-facts"),
+    (434, "tform-of"),
+    (435, "tforms-exist"),
+    (436, "tphi-G"),
+    (437, "tphiG-id"),
+    (438, "tphiG-sc"),
+    (439, "tTheFormGFormG"),
+    (440, "geach"),
+    (441, "tparticipation"),
+    (442, "tpre-OM-weak"),
+    (443, "counter-tpre-rl"),
+    (444, "tpart=ex"),
+    (445, "tpta-ex"),
+    (446, "tom"),
+    (447, "tcounter-sp"),
+    (448, "tforms-encode"),
+    (449, "tforms"),
+    (450, "tTheFormGForm"),
+    (451, "SPa-b"),
+    (452, "tpart-con"),
+    (453, "tform-syl"),
+    (454, "tforms-NI"),
+    (455, "sit-remark"),
+    (456, "situations"),
+    (457, "T-sit"),
+    (458, "possit-sit"),
+    (459, "true-in-s"),
+    (460, "lem1"),
+    (461, "lem1-rem"),
+    (462, "lem2"),
+    (463, "sit-identity"),
+    (464, "sit-part-whole"),
+    (465, "part"),
+    (466, "sit-identity2"),
+    (467, "persistent"),
+    (468, "pers-prop"),
+    (469, "df-null-trivial"),
+    (470, "thm-null-trivial"),
+    (471, "df-the-null-sit"),
+    (472, "null-triv-sc"),
+    (473, "null-triv-facts"),
+    (474, "cond-prop"),
+    (475, "pre-comp-sit"),
+    (476, "comp-sit"),
+    (477, "can-sit-desc"),
+    (478, "strict-sit"),
+    (479, "strict-can-sit"),
+    (480, "sit-lat"),
+    (481, "actual"),
+    (482, "act-and-not-pos"),
+    (483, "actual-rem"),
+    (484, "actual-s"),
+    (485, "comp"),
+    (486, "act-sit"),
+    (487, "cons"),
+    (488, "cons-remark"),
+    (489, "sit-cons"),
+    (490, "cons-rigid"),
+    (491, "pos"),
+    (492, "sit-pos"),
+    (493, "pos-cons-sit"),
+    (494, "sit-classical"),
+    (495, "rem-pos-world"),
+    (496, "world"),
+    (497, "rigid-pw"),
+    (498, "double-res"),
+    (499, "true-w"),
+    (500, "world-pos"),
+    (501, "world-cons"),
+    (502, "rigid-truth-at"),
+    (503, "max"),
+    (504, "world-max"),
+    (505, "world=maxpos"),
+    (506, "maxcon-rem"),
+    (507, "nec-impl-p"),
+    (508, "nec-equiv-nec-im"),
+    (509, "world-closed-lem"),
+    (510, "world-clo"),
+    (511, "world-closed"),
+    (512, "coherent"),
+    (513, "coh-rem"),
+    (514, "act-world"),
+    (515, "remark-w-alpha"),
+    (516, "pre-walpha"),
+    (517, "w-alpha"),
+    (518, "T-world"),
+    (519, "truth-at-alpha"),
+    (520, "alpha-world"),
+    (521, "t-at-alpha-strict"),
+    (522, "not-act"),
+    (523, "w-alpha-part"),
+    (524, "act-world2"),
+    (525, "fund-lem"),
+    (526, "fund"),
+    (527, "nec-dia-w"),
+    (528, "conj-dist-w"),
+    (529, "Lew-world-con"),
+    (530, "two-worlds-exist"),
+    (531, "non-aw"),
+    (532, "iterated-modalities"),
+    (533, "world-equiv"),
+    (534, "no-contradictions"),
+    (535, "disj-dist-models"),
+    (536, "world-skeptic"),
+    (537, "tv-of-p-at-w"),
+    (538, "unique-TV-w"),
+    (539, "T-value-at-w"),
+    (540, "TW-strict"),
+    (541, "TheTrueAtW"),
+    (542, "TW-rigid"),
+    (543, "TW-Sigma"),
+    (544, "cor-T-TV"),
+    (545, "Boxp-TwT"),
+    (546, "ext-at-w-F"),
+    (547, "unique-ext-w"),
+    (548, "ep-w-G"),
+    (549, "eG-strict"),
+    (550, "LawV-w"),
+    (551, "rem-ext-w"),
+    (552, "w-rel"),
+    (553, "w-index"),
+    (554, "df-rigid-rel"),
+    (555, "rem-on-rigid"),
+    (556, "rigid-der"),
+    (557, "rigid-rel-thms"),
+    (558, "w-ind-equiv"),
+    (559, "rem-imp-w"),
+    (560, "impwor"),
+    (561, "iw-rigid"),
+    (562, "iw-truth-at"),
+    (563, "iw-id"),
+    (564, "false-iw"),
+    (565, "iw-notmc"),
+    (566, "iw-p-ext"),
+    (567, "iw-pext-lem"),
+    (568, "iw-fund"),
+    (569, "iw-ecq-no"),
+    (570, "iw-ds"),
+    (571, "rem-times"),
+    (572, "fic-data"),
+    (573, "fic-meth"),
+    (574, "story"),
+    (575, "story-exist"),
+    (576, "story-remark"),
+    (577, "stories-truth"),
+    (578, "strict-char"),
+    (579, "strict-pre"),
+    (580, "s-en"),
+    (581, "char"),
+    (582, "nat-char"),
+    (583, "nat-id"),
+    (584, "fictional"),
+    (585, "fictional-f"),
+    (586, "tf-stories"),
+    (587, "stories-apply1"),
+    (588, "stories-apply2"),
+    (589, "stories-apply3"),
+    (590, "fur-con"),
+    (591, "pos-fic"),
+    (592, "leibniz-strands"),
+    (593, "concepts"),
+    (594, "con=ab"),
+    (595, "concept-comp"),
+    (596, "con-res-x"),
+    (597, "c-id"),
+    (598, "sum-pre-def"),
+    (599, "sum-exists"),
+    (600, "sum-def"),
+    (601, "sum-lemma"),
+    (602, "oplus"),
+    (603, "sum-property"),
+    (604, "cid-add"),
+    (605, "con"),
+    (606, "con-part"),
+    (607, "con-id"),
+    (608, "ic-add"),
+    (609, "def-ded"),
+    (610, "fund-leib"),
+    (611, "leib-23"),
+    (612, "prod-pre-def"),
+    (613, "product-exists"),
+    (614, "prod-def"),
+    (615, "prod-lemma"),
+    (616, "otimes"),
+    (617, "absorption"),
+    (618, "bd-lattice"),
+    (619, "boolean-rem1"),
+    (620, "distrib"),
+    (621, "comple-df"),
+    (622, "comple-exist"),
+    (623, "comple-def"),
+    (624, "comple-lemma"),
+    (625, "comple-laws"),
+    (626, "post-boole"),
+    (627, "concept-sub"),
+    (628, "ex-mereology"),
+    (629, "part-of-c"),
+    (630, "ppart-of-c"),
+    (631, "ppart-ax"),
+    (632, "null-concept"),
+    (633, "null-facts"),
+    (634, "mereo-overlap"),
+    (635, "overlap-thms"),
+    (636, "mer-sup"),
+    (637, "underlap"),
+    (638, "a-underlap"),
+    (639, "dodge"),
+    (640, "nnc"),
+    (641, "nnc-rigid"),
+    (642, "df-bottom+"),
+    (643, "no-bottom"),
+    (644, "df-atom+"),
+    (645, "atom-part"),
+    (646, "o-o"),
+    (647, "nover-rem"),
+    (648, "noverlap-facts"),
+    (649, "newsup"),
+    (650, "ndf-ex"),
+    (651, "concept-of-G"),
+    (652, "con-exists"),
+    (653, "concept-G"),
+    (654, "conG-strict"),
+    (655, "conG-lemma"),
+    (656, "sum3"),
+    (657, "gen-inc"),
+    (658, "concepts-not-properties"),
+    (659, "form=con"),
+    (660, "con-of-u"),
+    (661, "con-u-exist"),
+    (662, "concept-u"),
+    (663, "Fu-cont"),
+    (664, "con-u-not-strict"),
+    (665, "c-uF-Fu"),
+    (666, "c-uF-Fu2"),
+    (667, "complete"),
+    (668, "con-of-u-com"),
+    (669, "restrict-concepts"),
+    (670, "con-gen"),
+    (671, "c-allGF-allGisF"),
+    (672, "c-allGF-allGisF2"),
+    (673, "fa-c-af"),
+    (674, "contain-truth"),
+    (675, "montague-gq"),
+    (676, "con-nec"),
+    (677, "no-counterpart-theory"),
+    (678, "cor"),
+    (679, "cor-rem"),
+    (680, "real-at-facts"),
+    (681, "appears-at"),
+    (682, "appear-fact"),
+    (683, "appear-co"),
+    (684, "mirror"),
+    (685, "appear-mir"),
+    (686, "new-appear-fact"),
+    (687, "box-appears"),
+    (688, "new-real-at-fact"),
+    (689, "lem-con-u"),
+    (690, "ind-con"),
+    (691, "concept-u-ind-con"),
+    (692, "concept-u-ind-con-a"),
+    (693, "ind-con-rigid"),
+    (694, "ind-con-appear"),
+    (695, "w-c"),
+    (696, "w-c-applies"),
+    (697, "ind-con-cont-c-F"),
+    (698, "con-non-G"),
+    (699, "con-comp"),
+    (700, "compos"),
+    (701, "comp-w-c"),
+    (702, "compos-eq"),
+    (703, "df-con-u-at-w"),
+    (704, "con-u-w-exist"),
+    (705, "con-u-at-w"),
+    (706, "con-u-strict"),
+    (707, "lem-con-u-at"),
+    (708, "ind-con-iff-c-w-u"),
+    (709, "lem-con-u-alpha"),
+    (710, "lem-con-u-at-w"),
+    (711, "con-u-at-comp"),
+    (712, "rem-con-u-at-w"),
+    (713, "concepts-not-properties2"),
+    (714, "counterparts"),
+    (715, "count-part-con"),
+    (716, "count-cor"),
+    (717, "con-u-at-w-count"),
+    (718, "fund-thm-modal-meta"),
+    (719, "fund-thm-modal-bi"),
+    (720, "fund-thm-modal-strict"),
+    (721, "fund-thm-mod-rem"),
+    (722, "Dedekind-Peano"),
+    (723, "1-1-cor"),
+    (724, "1-1-cor-rem"),
+    (725, "fFG"),
+    (726, "eq-1-1"),
+    (727, "frege-theorem"),
+    (728, "why-EqE"),
+    (729, "equi"),
+    (730, "eq-part"),
+    (731, "equi-rem"),
+    (732, "equi-rem-thm"),
+    (733, "empty-approx"),
+    (734, "F-u"),
+    (735, "eqP'"),
+    (736, "P'-eq"),
+    (737, "approx-cont"),
+    (738, "eqE"),
+    (739, "apE-eqE"),
+    (740, "eq-part-act"),
+    (741, "actuallyF"),
+    (742, "approx-nec"),
+    (743, "pre-number"),
+    (744, "numbers"),
+    (745, "num-tran"),
+    (746, "pre-Hume"),
+    (747, "num-tran-rem"),
+    (748, "two-num-not"),
+    (749, "num"),
+    (750, "num-cont"),
+    (751, "num-uniq"),
+    (752, "num-def"),
+    (753, "num-can"),
+    (754, "numG-not-strict"),
+    (755, "card"),
+    (756, "natcard-nec"),
+    (757, "hume"),
+    (758, "hume-strict"),
+    (759, "unotEu"),
+    (760, "zero"),
+    (761, "zero-card"),
+    (762, "eq-num"),
+    (763, "eq-df-num"),
+    (764, "card-en"),
+    (765, "0F"),
+    (766, "zero="),
+    (767, "hered"),
+    (768, "ances-df"),
+    (769, "ances"),
+    (770, "anc-her"),
+    (771, "rem-pre-wances"),
+    (772, "df-1-1"),
+    (773, "id-d-R"),
+    (774, "id-R-thm"),
+    (775, "w-ances-df"),
+    (776, "w-ances"),
+    (777, "wances-her"),
+    (778, "1-1-R"),
+    (779, "pre-ind"),
+    (780, "pre-ind-rem"),
+    (781, "pred-rem"),
+    (782, "pred"),
+    (783, "pred-thm"),
+    (784, "pred-1-1"),
+    (785, "assume-anc"),
+    (786, "no-pred-0"),
+    (787, "assume1"),
+    (788, "nnumber"),
+    (789, "0-n"),
+    (790, "mod-col-num"),
+    (791, "0-pred"),
+    (792, "no-same-succ"),
+    (793, "induction"),
+    (794, "suc-num"),
+    (795, "pred-num"),
+    (796, "nat-card"),
+    (797, "pred-func"),
+    (798, "modal-axiom"),
+    (799, "modal-just"),
+    (800, "modal-lemma"),
+    (801, "th-succ"),
+    (802, "Frege's-proof"),
+    (803, "non-classical"),
+    (804, "def-suc"),
+    (805, "suc-fact"),
+    (806, "ind-gnd"),
+    (807, "suc-thm"),
+    (808, "numerals"),
+    (809, "prec-facts"),
+    (810, "num-num"),
+    (811, "dig-alt"),
+    (812, "rigid-restrict"),
+    (813, "lt-gt"),
+    (814, "lt-basic"),
+    (815, "lt-conv"),
+    (816, "lt-trans"),
+    (817, "0lt1"),
+    (818, "num-ord-lt"),
+    (819, "remQuine"),
+    (820, "no-num-pred"),
+    (821, "dot-id-lem"),
+    (822, "dot-id"),
+    (823, "dot=eq="),
+    (824, "integer"),
+    (825, "1-pi"),
+    (826, "i-prec"),
+    (827, "n-n-lemma"),
+    (828, "num-quant"),
+    (829, "n-n"),
+    (830, "num-quant-gen"),
+    (831, "Functions"),
+    (832, "total-D"),
+    (833, "I-thm"),
+    (834, "func-ex-pre"),
+    (835, "func-ex"),
+    (836, "func-nec"),
+    (837, "fun-not-nec"),
+    (838, "fcn-res-rem"),
+    (839, "df-fa"),
+    (840, "func-thm"),
+    (841, "eq-func-nec"),
+    (842, "func-rem"),
+    (843, "func-obs"),
+    (844, "function-rem"),
+    (845, "fmaps-r"),
+    (846, "fcn-from-ex"),
+    (847, "fcn-from-ex2"),
+    (848, "Rmap-res"),
+    (849, "fcnal-from"),
+    (850, "fcnl-from-ex"),
+    (851, "fcnl-from-ex2"),
+    (852, "fcnl-on"),
+    (853, "fcnl-on-thm"),
+    (854, "dom-ra"),
+    (855, "df-dom"),
+    (856, "fcn-from-re"),
+    (857, "fcn-from"),
+    (858, "fcn-sum"),
+    (859, "mapping-ex"),
+    (860, "dom-thm"),
+    (861, "codom-thm"),
+    (862, "range-thm"),
+    (863, "allf-do"),
+    (864, "R-gen-1-o"),
+    (865, "ra-onto"),
+    (866, "carProd"),
+    (867, "restricted-f"),
+    (868, "rf-fact"),
+    (869, "rfun-exist"),
+    (870, "res-fn-ex"),
+    (871, "null-fn-fact"),
+    (872, "res-fn-df"),
+    (873, "res-fn-fact"),
+    (874, "func-rest-var"),
+    (875, "fcn-app-pre"),
+    (876, "fcn-app-redef"),
+    (877, "n-ary-op"),
+    (878, "n-ary-op-rigid"),
+    (879, "op-lem0"),
+    (880, "con-fun"),
+    (881, "proj-fun"),
+    (882, "op-lem1"),
+    (883, "pre-comp"),
+    (884, "op-comp"),
+    (885, "op-rest-var"),
+    (886, "recursive"),
+    (887, "recur-dig"),
+    (888, "def-rel-add"),
+    (889, "rec-df-add"),
+    (890, "gen-recur-df"),
+    (891, "gen-rec-R"),
+    (892, "base-rec-thm"),
+    (893, "gen-gen-rec"),
+    (894, "gen-rec-thm"),
+    (895, "trad-recurs-dfs"),
+    (896, "prim-gen-recur"),
+    (897, "minimize"),
+    (898, "2ndPA-inter"),
+    (899, "2ndPA-der"),
+    (900, "multi-ord"),
+    (901, "inf-card"),
+    (902, "inf-card-exist"),
+    (903, "df-infty"),
+    (904, "infty-thms"),
+    (905, "inf-just"),
+    (906, "inf-set"),
+    (907, "inf-set-exist")
+]
diff --git a/thys/AOT/AOT_misc.thy b/thys/AOT/AOT_misc.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_misc.thy
@@ -0,0 +1,873 @@
+theory AOT_misc
+  imports AOT_NaturalNumbers
+begin
+
+section\<open>Miscellaneous Theorems\<close>
+
+AOT_theorem PossiblyNumbersEmptyPropertyImpliesZero:
+  \<open>\<diamond>Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) \<rightarrow> x = 0\<close>
+proof(rule "\<rightarrow>I")
+  AOT_have \<open>Rigid([\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+  proof (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2";
+         rule RN; safe intro!: GEN "\<rightarrow>I")
+    AOT_modally_strict {
+      fix x
+      AOT_assume \<open>[\<lambda>z O!z & z \<noteq>\<^sub>E z]x\<close>
+      AOT_hence \<open>O!x & x \<noteq>\<^sub>E x\<close> by (rule "\<beta>\<rightarrow>C")
+      moreover AOT_have \<open>x =\<^sub>E x\<close> using calculation[THEN "&E"(1)] 
+        by (metis "ord=Eequiv:1" "vdash-properties:10")
+      ultimately AOT_have \<open>x =\<^sub>E x & \<not>x =\<^sub>E x\<close>
+        by (metis "con-dis-i-e:1" "con-dis-i-e:2:b" "intro-elim:3:a" "thm-neg=E")
+      AOT_thus \<open>\<box>[\<lambda>z O!z & z \<noteq>\<^sub>E z]x\<close> using "raa-cor:1" by blast
+    }
+  qed
+  AOT_hence \<open>\<box>\<forall>x (Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) \<rightarrow> \<box>Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]))\<close>
+    by (safe intro!: "num-cont:2"[unvarify G, THEN "\<rightarrow>E"] "cqt:2")
+  AOT_hence \<open>\<forall>x \<box>(Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) \<rightarrow> \<box>Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]))\<close>
+    using "BFs:2"[THEN "\<rightarrow>E"] by blast
+  AOT_hence \<open>\<box>(Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) \<rightarrow> \<box>Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]))\<close>
+    using "\<forall>E"(2) by auto
+  moreover AOT_assume \<open>\<diamond>Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+  ultimately AOT_have \<open>\<^bold>\<A>Numbers(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+    using "sc-eq-box-box:1"[THEN "\<equiv>E"(1), THEN "\<rightarrow>E", THEN "nec-imp-act"[THEN "\<rightarrow>E"]]
+    by blast
+  AOT_hence \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[\<lambda>z O!z & z \<noteq>\<^sub>E z]z])\<close>
+    by (safe intro!: "eq-num:1"[unvarify G, THEN "\<equiv>E"(1)] "cqt:2")
+  AOT_hence \<open>x = #[\<lambda>z O!z & z \<noteq>\<^sub>E z]\<close>
+    by (safe intro!: "eq-num:2"[unvarify G, THEN "\<equiv>E"(1)] "cqt:2")
+  AOT_thus \<open>x = 0\<close>
+    using "cqt:2"(1) "rule-id-df:2:b[zero]" "rule=E" "zero:1" by blast
+qed
+
+AOT_define Numbers' :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Numbers'''(_,_')\<close>)
+  \<open>Numbers'(x, G) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G)\<close>
+AOT_theorem Numbers'equiv: \<open>Numbers'(x,G) \<equiv> A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G)\<close>
+  by (AOT_subst_def Numbers')
+     (auto intro!: "\<equiv>I" "\<rightarrow>I" "&I" "cqt:2" dest: "&E")
+
+AOT_theorem Numbers'DistinctZeroes:
+  \<open>\<exists>x\<exists>y (\<diamond>Numbers'(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) & \<diamond>Numbers'(y,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) & x \<noteq> y)\<close>
+proof -
+  AOT_obtain w\<^sub>1 where \<open>\<exists>w w\<^sub>1 \<noteq> w\<close>
+    using "two-worlds-exist:4" "PossibleWorld.\<exists>E"[rotated] by fast
+  then AOT_obtain w\<^sub>2 where distinct_worlds: \<open>w\<^sub>1 \<noteq> w\<^sub>2\<close>
+    using "PossibleWorld.\<exists>E"[rotated] by blast
+  AOT_obtain x where x_prop:
+    \<open>A!x & \<forall>F (x[F] \<equiv> w\<^sub>1 \<Turnstile> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  moreover AOT_obtain y where y_prop:
+    \<open>A!y & \<forall>F (y[F] \<equiv> w\<^sub>2 \<Turnstile> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+    using "A-objects"[axiom_inst] "\<exists>E"[rotated] by fast
+  moreover {
+    fix x w
+    AOT_assume x_prop: \<open>A!x & \<forall>F (x[F] \<equiv> w \<Turnstile> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+    AOT_have \<open>\<forall>F w \<Turnstile> (x[F] \<equiv> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+    proof(safe intro!: GEN "conj-dist-w:4"[unvarify p q, OF "log-prop-prop:2",
+                              OF "log-prop-prop:2",THEN "\<equiv>E"(2)] "\<equiv>I" "\<rightarrow>I")
+      fix F
+      AOT_assume \<open>w \<Turnstile> x[F]\<close>
+      AOT_hence \<open>\<diamond>x[F]\<close>
+        using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2),
+                       OF "PossibleWorld.\<exists>I"] by blast
+      AOT_hence \<open>x[F]\<close>
+        by (metis "en-eq:3[1]" "intro-elim:3:a")
+      AOT_thus \<open>w \<Turnstile> (F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+        using x_prop[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
+    next
+      fix F
+      AOT_assume \<open>w \<Turnstile> (F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+      AOT_hence \<open>x[F]\<close>
+        using x_prop[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by blast
+      AOT_hence \<open>\<box>x[F]\<close>
+        using "pre-en-eq:1[1]"[THEN "\<rightarrow>E"] by blast
+      AOT_thus \<open>w \<Turnstile> x[F]\<close>
+        using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
+              "PossibleWorld.\<forall>E" by fast
+    qed
+    AOT_hence \<open>w \<Turnstile> \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+      using "conj-dist-w:5"[THEN "\<equiv>E"(2)] by fast
+    moreover {
+      AOT_have \<open>\<box>[\<lambda>z O!z & z \<noteq>\<^sub>E z]\<down>\<close>
+        by (safe intro!: RN "cqt:2")
+      AOT_hence \<open>w \<Turnstile> [\<lambda>z O!z & z \<noteq>\<^sub>E z]\<down>\<close>
+        using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1),
+                       THEN "PossibleWorld.\<forall>E"] by blast
+    }
+    moreover {
+      AOT_have \<open>\<box>A!x\<close>
+        using x_prop[THEN "&E"(1)] by (metis "oa-facts:2" "\<rightarrow>E")
+      AOT_hence \<open>w \<Turnstile> A!x\<close>
+        using "fund:2"[unvarify p, OF "log-prop-prop:2",
+                       THEN "\<equiv>E"(1), THEN "PossibleWorld.\<forall>E"] by blast
+    }
+    ultimately AOT_have \<open>w \<Turnstile> (A!x & [\<lambda>z O!z & z \<noteq>\<^sub>E z]\<down> &
+                               \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z]))\<close>
+      using "conj-dist-w:1"[unvarify p q, OF "log-prop-prop:2",
+              OF "log-prop-prop:2", THEN "\<equiv>E"(2), OF "&I"] by auto
+    AOT_hence \<open>\<exists>w w \<Turnstile> (A!x & [\<lambda>z O!z & z \<noteq>\<^sub>E z]\<down> &
+                        \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z]))\<close>
+      using "PossibleWorld.\<exists>I" by auto
+    AOT_hence \<open>\<diamond>(A!x & [\<lambda>z O!z & z \<noteq>\<^sub>E z]\<down> & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z]))\<close>
+      using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)] by blast
+    AOT_hence \<open>\<diamond>Numbers'(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+      by (AOT_subst_def Numbers')
+  }
+  ultimately AOT_have \<open>\<diamond>Numbers'(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+                  and \<open>\<diamond>Numbers'(y,[\<lambda>z O!z & z \<noteq>\<^sub>E z])\<close>
+    by auto
+  moreover AOT_have \<open>x \<noteq> y\<close>
+  proof (rule "ab-obey:2"[THEN "\<rightarrow>E"])
+    AOT_have \<open>\<box>\<not>\<exists>u [\<lambda>z O!z & z \<noteq>\<^sub>E z]u\<close>
+    proof (safe intro!: RN "raa-cor:2")
+      AOT_modally_strict {
+        AOT_assume \<open>\<exists>u [\<lambda>z O!z & z \<noteq>\<^sub>E z]u\<close>
+        then AOT_obtain u where \<open>[\<lambda>z O!z & z \<noteq>\<^sub>E z]u\<close>
+          using "Ordinary.\<exists>E"[rotated] by blast
+        AOT_hence \<open>O!u & u \<noteq>\<^sub>E u\<close>
+          by (rule "\<beta>\<rightarrow>C")
+        AOT_hence \<open>\<not>(u =\<^sub>E u)\<close>
+          by (metis "con-dis-taut:2" "intro-elim:3:d" "modus-tollens:1"
+                    "raa-cor:3" "thm-neg=E")
+        AOT_hence \<open>u =\<^sub>E u & \<not>u =\<^sub>E u\<close>
+          by (metis "modus-tollens:1" "ord=Eequiv:1" "raa-cor:3" Ordinary.\<psi>)
+        AOT_thus \<open>p & \<not>p\<close> for p
+          by (metis "raa-cor:1")
+      }
+    qed
+    AOT_hence nec_not_ex: \<open>\<forall>w w \<Turnstile> \<not>\<exists>u [\<lambda>z O!z & z \<noteq>\<^sub>E z]u\<close>
+      using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+    AOT_have \<open>\<box>([\<lambda>y p]x \<equiv> p)\<close> for x p
+      by (safe intro!: RN "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2")
+    AOT_hence \<open>\<forall>w w \<Turnstile> ([\<lambda>y p]x \<equiv> p)\<close> for x p
+      using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+    AOT_hence world_prop_beta: \<open>\<forall>w (w \<Turnstile> [\<lambda>y p]x \<equiv> w \<Turnstile> p)\<close> for x p
+      using "conj-dist-w:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
+            "PossibleWorld.\<forall>E" "PossibleWorld.\<forall>I" by meson
+
+    AOT_have \<open>\<exists>p (w\<^sub>1 \<Turnstile> p & \<not>w\<^sub>2 \<Turnstile> p)\<close>
+    proof(rule "raa-cor:1")
+      AOT_assume 0: \<open>\<not>\<exists>p (w\<^sub>1 \<Turnstile> p & \<not>w\<^sub>2 \<Turnstile> p)\<close>
+      AOT_have 1: \<open>w\<^sub>1 \<Turnstile> p \<rightarrow> w\<^sub>2 \<Turnstile> p\<close> for p
+      proof(safe intro!: GEN "\<rightarrow>I")
+        AOT_assume \<open>w\<^sub>1 \<Turnstile> p\<close>
+        AOT_thus \<open>w\<^sub>2 \<Turnstile> p\<close>
+          using 0 "con-dis-i-e:1" "\<exists>I"(2) "raa-cor:4" by fast
+      qed
+      moreover AOT_have \<open>w\<^sub>2 \<Turnstile> p \<rightarrow> w\<^sub>1 \<Turnstile> p\<close> for p
+      proof(safe intro!: GEN "\<rightarrow>I")
+        AOT_assume \<open>w\<^sub>2 \<Turnstile> p\<close>
+        AOT_hence \<open>\<not>w\<^sub>2 \<Turnstile> \<not>p\<close>
+          using "coherent:2" "intro-elim:3:a" by blast
+        AOT_hence \<open>\<not>w\<^sub>1 \<Turnstile> \<not>p\<close>
+          using 1["\<forall>I" p, THEN "\<forall>E"(1), OF "log-prop-prop:2"]
+          by (metis "modus-tollens:1")
+        AOT_thus \<open>w\<^sub>1 \<Turnstile> p\<close>
+          using "coherent:1" "intro-elim:3:b" "reductio-aa:1" by blast
+      qed
+      ultimately AOT_have \<open>w\<^sub>1 \<Turnstile> p \<equiv> w\<^sub>2 \<Turnstile> p\<close> for p
+        by (metis "intro-elim:2")
+      AOT_hence \<open>w\<^sub>1 = w\<^sub>2\<close>
+        using "sit-identity"[unconstrain s, THEN "\<rightarrow>E",
+            OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)],
+            unconstrain s', THEN "\<rightarrow>E",
+            OF PossibleWorld.\<psi>[THEN "world:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(1)],
+            THEN "\<equiv>E"(2)] GEN by fast
+      AOT_thus \<open>w\<^sub>1 = w\<^sub>2 & \<not>w\<^sub>1 = w\<^sub>2\<close>
+        using  "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:1" distinct_worlds by blast
+    qed
+    then AOT_obtain p where 0: \<open>w\<^sub>1 \<Turnstile> p & \<not>w\<^sub>2 \<Turnstile> p\<close>
+      using "\<exists>E"[rotated] by blast
+    AOT_have \<open>y[\<lambda>y p]\<close>
+    proof (safe intro!: y_prop[THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<equiv>E"(2)] "cqt:2")
+      AOT_show \<open>w\<^sub>2 \<Turnstile> [\<lambda>y p] \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z]\<close>
+      proof (safe intro!:  "cqt:2" "empty-approx:1"[unvarify F H, THEN RN,
+                  THEN "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)],
+                  THEN "PossibleWorld.\<forall>E",
+                  THEN "conj-dist-w:2"[unvarify p q, OF "log-prop-prop:2",
+                                       OF "log-prop-prop:2", THEN "\<equiv>E"(1)],
+                                       THEN "\<rightarrow>E"]
+                  "conj-dist-w:1"[unvarify p q, OF "log-prop-prop:2",
+                                  OF "log-prop-prop:2", THEN "\<equiv>E"(2)] "&I")
+        AOT_have \<open>\<not>w\<^sub>2 \<Turnstile> \<exists>u [\<lambda>y p]u\<close>
+        proof (rule "raa-cor:2")
+          AOT_assume \<open>w\<^sub>2 \<Turnstile> \<exists>u [\<lambda>y p]u\<close>
+          AOT_hence \<open>\<exists>x w\<^sub>2 \<Turnstile> (O!x & [\<lambda>y p]x)\<close>
+            by (metis "conj-dist-w:6" "intro-elim:3:a")
+          then AOT_obtain x where \<open>w\<^sub>2 \<Turnstile> (O!x & [\<lambda>y p]x)\<close>
+            using "\<exists>E"[rotated] by blast
+          AOT_hence \<open>w\<^sub>2 \<Turnstile> [\<lambda>y p]x\<close>
+            using "conj-dist-w:1"[unvarify p q, OF "log-prop-prop:2",
+                    OF "log-prop-prop:2", THEN "\<equiv>E"(1), THEN "&E"(2)] by blast
+          AOT_hence \<open>w\<^sub>2 \<Turnstile> p\<close>
+            using world_prop_beta[THEN "PossibleWorld.\<forall>E", THEN "\<equiv>E"(1)] by blast
+          AOT_thus \<open>w\<^sub>2 \<Turnstile> p & \<not>w\<^sub>2 \<Turnstile> p\<close>
+            using 0[THEN "&E"(2)] "&I" by blast
+        qed
+        AOT_thus \<open>w\<^sub>2 \<Turnstile> \<not>\<exists>u [\<lambda>y p]u\<close>
+          by (safe intro!: "coherent:1"[unvarify p, OF "log-prop-prop:2",
+                                        THEN "\<equiv>E"(2)])
+      next
+        AOT_show \<open>w\<^sub>2 \<Turnstile> \<not>\<exists>v [\<lambda>z O!z & z \<noteq>\<^sub>E z]v\<close>
+          using nec_not_ex[THEN "PossibleWorld.\<forall>E"] by blast
+      qed
+    qed
+    moreover AOT_have \<open>\<not>x[\<lambda>y p]\<close>
+    proof(rule "raa-cor:2")
+      AOT_assume \<open>x[\<lambda>y p]\<close>
+      AOT_hence "w\<^sub>1 \<Turnstile> [\<lambda>y p] \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z]"
+        using x_prop[THEN "&E"(2), THEN "\<forall>E"(1), THEN "\<equiv>E"(1)]
+              "prop-prop2:2" by blast
+      AOT_hence "\<not>w\<^sub>1 \<Turnstile> \<not>[\<lambda>y p] \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z]"
+        using "coherent:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
+      moreover AOT_have "w\<^sub>1 \<Turnstile> \<not>([\<lambda>y p] \<approx>\<^sub>E [\<lambda>z O!z & z \<noteq>\<^sub>E z])"
+      proof (safe intro!: "cqt:2" "empty-approx:2"[unvarify F H, THEN RN,
+                    THEN "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)],
+                    THEN "PossibleWorld.\<forall>E",
+                    THEN "conj-dist-w:2"[unvarify p q, OF "log-prop-prop:2",
+                        OF "log-prop-prop:2", THEN "\<equiv>E"(1)], THEN "\<rightarrow>E"]
+                    "conj-dist-w:1"[unvarify p q, OF "log-prop-prop:2",
+                                    OF "log-prop-prop:2", THEN "\<equiv>E"(2)] "&I")
+        fix u
+        AOT_have \<open>w\<^sub>1 \<Turnstile> O!u\<close>
+          using Ordinary.\<psi>[THEN RN,
+                  THEN "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)],
+                  THEN "PossibleWorld.\<forall>E"] by simp
+        moreover AOT_have \<open>w\<^sub>1 \<Turnstile> [\<lambda>y p]u\<close>
+          by (safe intro!: world_prop_beta[THEN "PossibleWorld.\<forall>E", THEN "\<equiv>E"(2)]
+                           0[THEN "&E"(1)])
+        ultimately AOT_have \<open>w\<^sub>1 \<Turnstile> (O!u & [\<lambda>y p]u)\<close>
+          using "conj-dist-w:1"[unvarify p q, OF "log-prop-prop:2",
+                                OF "log-prop-prop:2", THEN "\<equiv>E"(2),
+                                OF "&I"] by blast
+        AOT_hence \<open>\<exists>x w\<^sub>1 \<Turnstile> (O!x & [\<lambda>y p]x)\<close>
+          by (rule "\<exists>I")
+        AOT_thus \<open>w\<^sub>1 \<Turnstile> \<exists>u [\<lambda>y p]u\<close>
+          by (metis "conj-dist-w:6" "intro-elim:3:b")
+      next
+        AOT_show \<open>w\<^sub>1 \<Turnstile> \<not>\<exists>v [\<lambda>z O!z & z \<noteq>\<^sub>E z]v\<close>
+          using "PossibleWorld.\<forall>E" nec_not_ex by fastforce
+      qed
+      ultimately AOT_show \<open>p & \<not>p\<close> for p
+        using "raa-cor:3" by blast
+    qed
+    ultimately AOT_have \<open>y[\<lambda>y p] & \<not>x[\<lambda>y p]\<close>
+      using "&I" by blast
+    AOT_hence \<open>\<exists>F (y[F] & \<not>x[F])\<close>
+      by (metis "existential:1" "prop-prop2:2")
+    AOT_thus \<open>\<exists>F (x[F] & \<not>y[F]) \<or> \<exists>F (y[F] & \<not>x[F])\<close>
+      by (rule "\<or>I")
+  qed
+  ultimately AOT_have \<open>\<diamond>Numbers'(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) &
+                       \<diamond>Numbers'(y,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) & x \<noteq> y\<close>
+    using "&I" by blast
+  AOT_thus \<open>\<exists>x\<exists>y (\<diamond>Numbers'(x,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) &
+                  \<diamond>Numbers'(y,[\<lambda>z O!z & z \<noteq>\<^sub>E z]) & x \<noteq> y)\<close>
+    using "\<exists>I"(2)[where \<beta>=x] "\<exists>I"(2)[where \<beta>=y] by auto
+qed
+
+AOT_theorem restricted_identity:
+  \<open>x =\<^sub>\<R> y \<equiv> (InDomainOf(x,\<R>) & InDomainOf(y,\<R>) & x = y)\<close>
+  by (auto intro!: "\<equiv>I" "\<rightarrow>I" "&I"
+             dest: "id-R-thm:2"[THEN "\<rightarrow>E"] "&E"
+                   "id-R-thm:3"[THEN "\<rightarrow>E"]
+                   "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1), THEN "\<equiv>E"(2)])
+
+AOT_theorem induction': \<open>\<forall>F ([F]0 & \<forall>n([F]n \<rightarrow> [F]n\<^bold>') \<rightarrow> \<forall>n [F]n)\<close>
+proof(rule GEN; rule "\<rightarrow>I")
+  fix F n
+  AOT_assume A: \<open>[F]0 & \<forall>n([F]n \<rightarrow> [F]n\<^bold>')\<close>
+  AOT_have \<open>\<forall>n\<forall>m([\<bbbP>]nm \<rightarrow> ([F]n \<rightarrow> [F]m))\<close>
+  proof(safe intro!: "Number.GEN" "\<rightarrow>I")
+    fix n m
+    AOT_assume \<open>[\<bbbP>]nm\<close>
+    moreover AOT_have \<open>[\<bbbP>]n n\<^bold>'\<close>
+      using "suc-thm".
+    ultimately AOT_have m_eq_suc_n: \<open>m = n\<^bold>'\<close>
+      using "pred-func:1"[unvarify z, OF "def-suc[den2]", THEN "\<rightarrow>E", OF "&I"]
+      by blast
+    AOT_assume \<open>[F]n\<close>
+    AOT_hence \<open>[F]n\<^bold>'\<close>
+      using A[THEN "&E"(2), THEN "Number.\<forall>E", THEN "\<rightarrow>E"] by blast
+    AOT_thus \<open>[F]m\<close>
+      using m_eq_suc_n[symmetric] "rule=E" by fast
+  qed
+  AOT_thus \<open>\<forall>n[F]n\<close>
+    using induction[THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF "&I", OF A[THEN "&E"(1)]]
+    by simp
+qed
+
+AOT_define ExtensionOf :: \<open>\<tau> \<Rightarrow> \<Pi> \<Rightarrow> \<phi>\<close> (\<open>ExtensionOf'(_,_')\<close>)
+  "exten-property:1": \<open>ExtensionOf(x,[G]) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F(x[F] \<equiv> \<forall>z([F]z \<equiv> [G]z))\<close>
+
+AOT_define OrdinaryExtensionOf :: \<open>\<tau> \<Rightarrow> \<Pi> \<Rightarrow> \<phi>\<close> (\<open>OrdinaryExtensionOf'(_,_')\<close>)
+   \<open>OrdinaryExtensionOf(x,[G]) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F(x[F] \<equiv> \<forall>z(O!z \<rightarrow> ([F]z \<equiv> [G]z)))\<close>
+
+AOT_theorem BeingOrdinaryExtensionOfDenotes:
+  \<open>[\<lambda>x OrdinaryExtensionOf(x,[G])]\<down>\<close>
+proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+  AOT_show \<open>[\<lambda>x A!x & G\<down> & [\<lambda>x \<forall>F(x[F] \<equiv> \<forall>z(O!z \<rightarrow> ([F]z \<equiv> [G]z)))]x]\<down>\<close>
+    by "cqt:2"
+next
+  AOT_show \<open>\<box>\<forall>x (A!x & G\<down> & [\<lambda>x \<forall>F (x[F] \<equiv> \<forall>z (O!z \<rightarrow> ([F]z \<equiv> [G]z)))]x \<equiv>
+            OrdinaryExtensionOf(x,[G]))\<close>
+  proof(safe intro!: RN GEN)
+    AOT_modally_strict {
+      fix x
+      AOT_modally_strict {
+        AOT_have \<open>[\<lambda>x \<forall>F (x[F] \<equiv> \<forall>z (O!z \<rightarrow> ([F]z \<equiv> [G]z)))]\<down>\<close>
+        proof (safe intro!: "Comprehension_3"[THEN "\<rightarrow>E"] RN GEN
+                            "\<rightarrow>I" "\<equiv>I" Ordinary.GEN)
+          AOT_modally_strict {
+            fix F H u
+            AOT_assume \<open>\<box>H \<equiv>\<^sub>E F\<close>
+            AOT_hence \<open>\<forall>u([H]u \<equiv> [F]u)\<close>
+              using eqE[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
+              by blast
+            AOT_hence 0: \<open>[H]u \<equiv> [F]u\<close> using "Ordinary.\<forall>E" by fast
+            {
+              AOT_assume \<open>\<forall>u([F]u \<equiv> [G]u)\<close>
+              AOT_hence 1: \<open>[F]u \<equiv> [G]u\<close> using "Ordinary.\<forall>E" by fast
+              AOT_show \<open>[G]u\<close> if \<open>[H]u\<close> using 0 1 "\<equiv>E"(1) that by blast
+              AOT_show \<open>[H]u\<close> if \<open>[G]u\<close> using 0 1 "\<equiv>E"(2) that by blast
+            }
+            {
+              AOT_assume \<open>\<forall>u([H]u \<equiv> [G]u)\<close>
+              AOT_hence 1: \<open>[H]u \<equiv> [G]u\<close> using "Ordinary.\<forall>E" by fast
+              AOT_show \<open>[G]u\<close> if \<open>[F]u\<close> using 0 1 "\<equiv>E"(1,2) that by blast 
+              AOT_show \<open>[F]u\<close> if \<open>[G]u\<close> using 0 1 "\<equiv>E"(1,2) that by blast 
+            }
+          }
+        qed
+      }
+      AOT_thus \<open>(A!x & G\<down> & [\<lambda>x \<forall>F (x[F] \<equiv> \<forall>z (O!z \<rightarrow> ([F]z \<equiv> [G]z)))]x) \<equiv>
+                OrdinaryExtensionOf(x,[G])\<close>
+        apply (AOT_subst_def OrdinaryExtensionOf)
+        apply (AOT_subst \<open>[\<lambda>x \<forall>F (x[F] \<equiv> \<forall>z (O!z \<rightarrow> ([F]z \<equiv> [G]z)))]x\<close>
+                         \<open>\<forall>F (x[F] \<equiv> \<forall>z (O!z \<rightarrow> ([F]z \<equiv> [G]z)))\<close>)
+        by (auto intro!: "beta-C-meta"[THEN "\<rightarrow>E"] simp: "oth-class-taut:3:a")
+    }
+  qed
+qed
+
+text\<open>Fragments of PLM's theory of Concepts.\<close>
+
+AOT_define FimpG :: \<open>\<Pi> \<Rightarrow> \<Pi> \<Rightarrow> \<phi>\<close> (infixl \<open>\<Rightarrow>\<close> 50)
+  "F-imp-G": \<open>[G] \<Rightarrow> [F] \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<box>\<forall>x ([G]x \<rightarrow> [F]x)\<close>
+
+AOT_define concept :: \<open>\<Pi>\<close> (\<open>C!\<close>)
+  concepts: \<open>C! =\<^sub>d\<^sub>f A!\<close>
+
+AOT_register_rigid_restricted_type
+  Concept: \<open>C!\<kappa>\<close>
+proof
+  AOT_modally_strict {
+    AOT_have \<open>\<exists>x A!x\<close>
+      using "o-objects-exist:2" "qml:2"[axiom_inst] "\<rightarrow>E" by blast
+    AOT_thus \<open>\<exists>x C!x\<close>
+      using "rule-id-df:1[zero]"[OF concepts, OF "oa-exist:2"] "rule=E" id_sym
+      by fast
+  }
+next
+  AOT_modally_strict {
+    AOT_show \<open>C!\<kappa> \<rightarrow> \<kappa>\<down>\<close> for \<kappa>
+      using "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)] "\<rightarrow>I"
+      by blast
+  }
+next
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>x(A!x \<rightarrow> \<box>A!x)\<close>
+      by (simp add: "oa-facts:2" GEN)
+    AOT_thus \<open>\<forall>x(C!x \<rightarrow> \<box>C!x)\<close>
+      using "rule-id-df:1[zero]"[OF concepts, OF "oa-exist:2"] "rule=E" id_sym
+      by fast
+  }
+qed
+
+AOT_register_variable_names
+  Concept: c d e
+
+AOT_theorem "concept-comp:1": \<open>\<exists>x(C!x & \<forall>F(x[F] \<equiv> \<phi>{F}))\<close>
+    using concepts[THEN "rule-id-df:1[zero]", OF "oa-exist:2", symmetric]
+          "A-objects"[axiom_inst]
+          "rule=E" by fast
+
+AOT_theorem "concept-comp:2": \<open>\<exists>!x(C!x & \<forall>F(x[F] \<equiv> \<phi>{F}))\<close>
+    using concepts[THEN "rule-id-df:1[zero]", OF "oa-exist:2", symmetric]
+          "A-objects!"
+          "rule=E" by fast
+
+AOT_theorem "concept-comp:3": \<open>\<^bold>\<iota>x(C!x & \<forall>F(x[F] \<equiv> \<phi>{F}))\<down>\<close>
+  using "concept-comp:2" "A-Exists:2"[THEN "\<equiv>E"(2)] "RA[2]" by blast
+
+AOT_theorem "concept-comp:4":
+  \<open>\<^bold>\<iota>x(C!x & \<forall>F(x[F] \<equiv> \<phi>{F})) = \<^bold>\<iota>x(A!x & \<forall>F(x[F] \<equiv> \<phi>{F}))\<close>
+    using "=I"(1)[OF "concept-comp:3"]
+          "rule=E"[rotated]
+          concepts[THEN "rule-id-df:1[zero]", OF "oa-exist:2"]
+          by fast
+
+AOT_define conceptInclusion :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl \<open>\<preceq>\<close> 100)
+  "con:1": \<open>c \<preceq> d \<equiv>\<^sub>d\<^sub>f \<forall>F(c[F] \<rightarrow> d[F])\<close>
+
+
+AOT_define conceptOf :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>ConceptOf'(_,_')\<close>)
+  "concept-of-G": \<open>ConceptOf(c,G) \<equiv>\<^sub>d\<^sub>f G\<down> & \<forall>F (c[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+
+AOT_theorem ConceptOfOrdinaryProperty: \<open>([H] \<Rightarrow> O!) \<rightarrow> [\<lambda>x ConceptOf(x,H)]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume \<open>[H] \<Rightarrow> O!\<close>
+  AOT_hence \<open>\<box>\<forall>x([H]x \<rightarrow> O!x)\<close>
+    using "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+  AOT_hence \<open>\<box>\<box>\<forall>x([H]x \<rightarrow> O!x)\<close>
+    using "S5Basic:6"[THEN "\<equiv>E"(1)] by blast
+  moreover AOT_have \<open>\<box>\<box>\<forall>x([H]x \<rightarrow> O!x) \<rightarrow>
+                     \<box>\<forall>F\<forall>G(\<box>(G \<equiv>\<^sub>E F) \<rightarrow> ([H] \<Rightarrow> [F] \<equiv> [H] \<Rightarrow> [G]))\<close>
+  proof(rule RM; safe intro!: "\<rightarrow>I" GEN "\<equiv>I")
+    AOT_modally_strict {
+      fix F G
+      AOT_assume 0: \<open>\<box>\<forall>x([H]x \<rightarrow> O!x)\<close>
+      AOT_assume \<open>\<box>G \<equiv>\<^sub>E F\<close>
+      AOT_hence 1: \<open>\<box>\<forall>u([G]u \<equiv> [F]u)\<close>
+        by (AOT_subst_thm eqE[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I",
+              OF "cqt:2[const_var]"[axiom_inst],
+              OF "cqt:2[const_var]"[axiom_inst], symmetric])
+      {
+        AOT_assume \<open>[H] \<Rightarrow> [F]\<close>
+        AOT_hence \<open>\<box>\<forall>x([H]x \<rightarrow> [F]x)\<close>
+          using "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+        moreover AOT_modally_strict {
+          AOT_assume \<open>\<forall>x([H]x \<rightarrow> O!x)\<close>
+          moreover AOT_assume \<open>\<forall>u([G]u \<equiv> [F]u)\<close>
+          moreover AOT_assume \<open>\<forall>x([H]x \<rightarrow> [F]x)\<close>
+          ultimately AOT_have \<open>[H]x \<rightarrow> [G]x\<close> for x
+            by (auto intro!: "\<rightarrow>I" dest!: "\<forall>E"(2) dest: "\<rightarrow>E" "\<equiv>E")
+          AOT_hence \<open>\<forall>x([H]x \<rightarrow> [G]x)\<close>
+            by (rule GEN)
+        }
+        ultimately AOT_have \<open>\<box>\<forall>x([H]x \<rightarrow> [G]x)\<close>
+          using "RN[prem]"[where
+              \<Gamma>="{\<guillemotleft>\<forall>x([H]x \<rightarrow> O!x)\<guillemotright>, \<guillemotleft>\<forall>u([G]u \<equiv> [F]u)\<guillemotright>, \<guillemotleft>\<forall>x([H]x \<rightarrow> [F]x)\<guillemotright>}"]
+          using 0 1 by fast
+        AOT_thus \<open>[H] \<Rightarrow> [G]\<close>
+          by (AOT_subst_def "F-imp-G")
+             (safe intro!: "cqt:2" "&I")
+      }
+      {
+        AOT_assume \<open>[H] \<Rightarrow> [G]\<close>
+        AOT_hence \<open>\<box>\<forall>x([H]x \<rightarrow> [G]x)\<close>
+          using "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
+        moreover AOT_modally_strict {
+          AOT_assume \<open>\<forall>x([H]x \<rightarrow> O!x)\<close>
+          moreover AOT_assume \<open>\<forall>u([G]u \<equiv> [F]u)\<close>
+          moreover AOT_assume \<open>\<forall>x([H]x \<rightarrow> [G]x)\<close>
+          ultimately AOT_have \<open>[H]x \<rightarrow> [F]x\<close> for x
+            by (auto intro!: "\<rightarrow>I" dest!: "\<forall>E"(2) dest: "\<rightarrow>E" "\<equiv>E")
+          AOT_hence \<open>\<forall>x([H]x \<rightarrow> [F]x)\<close>
+            by (rule GEN)
+        }
+        ultimately AOT_have \<open>\<box>\<forall>x([H]x \<rightarrow> [F]x)\<close>
+          using "RN[prem]"[where
+              \<Gamma>="{\<guillemotleft>\<forall>x([H]x \<rightarrow> O!x)\<guillemotright>, \<guillemotleft>\<forall>u([G]u \<equiv> [F]u)\<guillemotright>, \<guillemotleft>\<forall>x([H]x \<rightarrow> [G]x)\<guillemotright>}"]
+          using 0 1 by fast
+        AOT_thus \<open>[H] \<Rightarrow> [F]\<close>
+          by (AOT_subst_def "F-imp-G")
+             (safe intro!: "cqt:2" "&I")
+      }
+    }
+  qed
+  ultimately AOT_have \<open>\<box>\<forall>F\<forall>G(\<box>(G \<equiv>\<^sub>E F) \<rightarrow> ([H] \<Rightarrow> [F] \<equiv> [H] \<Rightarrow> [G]))\<close>
+    using "\<rightarrow>E" by blast
+  AOT_hence 0: \<open>[\<lambda>x \<forall>F(x[F] \<equiv> ([H] \<Rightarrow> [F]))]\<down>\<close>
+    using Comprehension_3[THEN "\<rightarrow>E"] by blast
+  AOT_show \<open>[\<lambda>x ConceptOf(x,H)]\<down>\<close>
+  proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x C!x & [\<lambda>x \<forall>F(x[F] \<equiv> ([H] \<Rightarrow> [F]))]x]\<down>\<close> by "cqt:2"
+  next
+    AOT_show \<open>\<box>\<forall>x (C!x & [\<lambda>x \<forall>F (x[F] \<equiv> [H] \<Rightarrow> [F])]x \<equiv> ConceptOf(x,H))\<close>
+    proof (rule "RN[prem]"[where \<Gamma>=\<open>{\<guillemotleft>[\<lambda>x \<forall>F(x[F] \<equiv> ([H] \<Rightarrow> [F]))]\<down>\<guillemotright>}\<close>, simplified])
+      AOT_modally_strict {
+        AOT_assume 0: \<open>[\<lambda>x \<forall>F (x[F] \<equiv> [H] \<Rightarrow> [F])]\<down>\<close>
+        AOT_show \<open>\<forall>x (C!x & [\<lambda>x \<forall>F (x[F] \<equiv> [H] \<Rightarrow> [F])]x \<equiv> ConceptOf(x,H))\<close>
+        proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I" "&I")
+          fix x
+          AOT_assume \<open>C!x & [\<lambda>x \<forall>F (x[F] \<equiv> [H] \<Rightarrow> [F])]x\<close>
+          AOT_thus \<open>ConceptOf(x,H)\<close>
+            by (AOT_subst_def "concept-of-G")
+               (auto intro!: "&I" "cqt:2" dest: "&E" "\<beta>\<rightarrow>C")
+        next
+          fix x
+          AOT_assume \<open>ConceptOf(x,H)\<close>
+          AOT_hence \<open>C!x & (H\<down> & \<forall>F(x[F] \<equiv> [H] \<Rightarrow> [F]))\<close>
+            by (AOT_subst_def (reverse) "concept-of-G")
+          AOT_thus \<open>C!x\<close> and \<open>[\<lambda>x \<forall>F(x[F] \<equiv> [H] \<Rightarrow> [F])]x\<close>
+            by (auto intro!: "\<beta>\<leftarrow>C" 0 "cqt:2" dest: "&E")
+        qed
+      }
+    next
+      AOT_show \<open>\<box>[\<lambda>x \<forall>F(x[F] \<equiv> ([H] \<Rightarrow> [F]))]\<down>\<close>
+        using "exist-nec"[THEN "\<rightarrow>E"] 0 by blast
+    qed
+  qed
+qed
+
+AOT_theorem "con-exists:1": \<open>\<exists>c ConceptOf(c,G)\<close>
+proof -
+  AOT_obtain c where \<open>\<forall>F (c[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+    using "concept-comp:1" "Concept.\<exists>E"[rotated] by meson
+  AOT_hence \<open>ConceptOf(c,G)\<close>
+    by (auto intro!: "concept-of-G"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Concept.\<psi>)
+  thus ?thesis by (rule "Concept.\<exists>I")
+qed
+
+AOT_theorem "con-exists:2": \<open>\<exists>!c ConceptOf(c,G)\<close>
+proof -
+  AOT_have \<open>\<exists>!c \<forall>F (c[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+    using "concept-comp:2" by simp
+  moreover {
+    AOT_modally_strict {
+      fix x
+      AOT_assume \<open>\<forall>F (x[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+      moreover AOT_have \<open>[G] \<Rightarrow> [G]\<close>
+        by (safe intro!: "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" RN GEN "\<rightarrow>I")
+      ultimately AOT_have \<open>x[G]\<close>
+        using "\<forall>E"(2) "\<equiv>E" by blast
+      AOT_hence \<open>A!x\<close>
+        using "encoders-are-abstract"[THEN "\<rightarrow>E", OF "\<exists>I"(2)] by simp
+      AOT_hence \<open>C!x\<close>
+        using concepts[THEN "rule-id-df:1[zero]", OF "oa-exist:2", symmetric]
+              "rule=E"[rotated]
+        by fast
+    }
+  }
+  ultimately show ?thesis
+    by (AOT_subst \<open>ConceptOf(c,G)\<close> \<open>\<forall>F (c[F] \<equiv> [G] \<Rightarrow> [F])\<close> for: c;
+           AOT_subst_def "concept-of-G")
+       (auto intro!: "\<equiv>I" "\<rightarrow>I" "&I" "cqt:2" Concept.\<psi> dest: "&E")
+qed
+
+AOT_theorem "con-exists:3": \<open>\<^bold>\<iota>c ConceptOf(c,G)\<down>\<close>
+  by (safe intro!: "A-Exists:2"[THEN "\<equiv>E"(2)] "con-exists:2"[THEN "RA[2]"])
+
+
+AOT_define theConceptOfG :: \<open>\<tau> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>\<^bold>c\<^sub>_\<close>)
+  "concept-G": \<open>\<^bold>c\<^sub>G =\<^sub>d\<^sub>f \<^bold>\<iota>c ConceptOf(c, G)\<close>
+
+AOT_theorem "concept-G[den]": \<open>\<^bold>c\<^sub>G\<down>\<close>
+  by (auto intro!: "rule-id-df:1"[OF "concept-G"]
+                   "t=t-proper:1"[THEN "\<rightarrow>E"]
+                   "con-exists:3")
+
+
+AOT_theorem "concept-G[concept]": \<open>C!\<^bold>c\<^sub>G\<close>
+proof -
+  AOT_have \<open>\<^bold>\<A>(C!\<^bold>c\<^sub>G & ConceptOf(\<^bold>c\<^sub>G, G))\<close>
+    by (auto intro!: "actual-desc:2"[unvarify x, THEN "\<rightarrow>E"]
+                     "rule-id-df:1"[OF "concept-G"]
+                     "concept-G[den]"
+                     "con-exists:3")
+  AOT_hence \<open>\<^bold>\<A>C!\<^bold>c\<^sub>G\<close>
+    by (metis "Act-Basic:2" "con-dis-i-e:2:a" "intro-elim:3:a")
+  AOT_hence \<open>\<^bold>\<A>A!\<^bold>c\<^sub>G\<close>
+    using "rule-id-df:1[zero]"[OF concepts, OF "oa-exist:2"]
+          "rule=E" by fast
+  AOT_hence \<open>A!\<^bold>c\<^sub>G\<close>
+    using "oa-facts:8"[unvarify x, THEN "\<equiv>E"(2)] "concept-G[den]" by blast
+  thus ?thesis
+    using "rule-id-df:1[zero]"[OF concepts, OF "oa-exist:2", symmetric]
+          "rule=E" by fast
+qed
+
+AOT_theorem "conG-strict": \<open>\<^bold>c\<^sub>G = \<^bold>\<iota>c \<forall>F(c[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+proof (rule "id-eq:3"[unvarify \<alpha> \<beta> \<gamma>, THEN "\<rightarrow>E"])
+  AOT_have \<open>\<box>\<forall>x (C!x & ConceptOf(x,G) \<equiv> C!x & \<forall>F (x[F] \<equiv> [G] \<Rightarrow> [F]))\<close>
+    by (auto intro!: "concept-of-G"[THEN "\<equiv>\<^sub>d\<^sub>fI"] RN GEN "\<equiv>I" "\<rightarrow>I" "&I" "cqt:2"
+               dest: "&E";
+        auto dest: "\<forall>E"(2) "\<equiv>E"(1,2) dest!: "&E"(2) "concept-of-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
+  AOT_thus \<open>\<^bold>c\<^sub>G = \<^bold>\<iota>c ConceptOf(c, G) & \<^bold>\<iota>c ConceptOf(c, G) = \<^bold>\<iota>c \<forall>F(c[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+    by (auto intro!: "&I" "rule-id-df:1"[OF "concept-G"] "con-exists:3"
+                      "equiv-desc-eq:3"[THEN "\<rightarrow>E"])
+qed(auto simp: "concept-G[den]" "con-exists:3" "concept-comp:3")
+
+
+AOT_theorem "conG-lemma:1": \<open>\<forall>F(\<^bold>c\<^sub>G[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I")
+  fix F
+  AOT_have \<open>\<^bold>\<A>\<forall>F(\<^bold>c\<^sub>G[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+    using "actual-desc:4"[THEN "\<rightarrow>E", OF "concept-comp:3",
+                          THEN "Act-Basic:2"[THEN "\<equiv>E"(1)],
+                          THEN "&E"(2)]
+          "conG-strict"[symmetric] "rule=E" by fast
+  AOT_hence \<open>\<^bold>\<A>(\<^bold>c\<^sub>G[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+    using "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(1)] "\<forall>E"(2)
+    by blast
+  AOT_hence 0: \<open>\<^bold>\<A>\<^bold>c\<^sub>G[F] \<equiv> \<^bold>\<A>[G] \<Rightarrow> [F]\<close>
+    using "Act-Basic:5"[THEN "\<equiv>E"(1)] by blast
+  {
+    AOT_assume \<open>\<^bold>c\<^sub>G[F]\<close>
+    AOT_hence \<open>\<^bold>\<A>\<^bold>c\<^sub>G[F]\<close>
+      by(safe intro!: "en-eq:10[1]"[unvarify x\<^sub>1, THEN "\<equiv>E"(2)]
+                      "concept-G[den]")
+    AOT_hence \<open>\<^bold>\<A>[G] \<Rightarrow> [F]\<close>
+      using 0[THEN "\<equiv>E"(1)] by blast
+    AOT_hence \<open>\<^bold>\<A>(F\<down> & G\<down> & \<box>\<forall>x([G]x \<rightarrow> [F]x))\<close>
+      by (AOT_subst_def (reverse) "F-imp-G")
+    AOT_hence \<open>\<^bold>\<A>\<box>\<forall>x([G]x \<rightarrow> [F]x)\<close>
+      using "Act-Basic:2"[THEN "\<equiv>E"(1)] "&E" by blast
+    AOT_hence \<open>\<box>\<forall>x([G]x \<rightarrow> [F]x)\<close>
+      using "qml-act:2"[axiom_inst, THEN "\<equiv>E"(2)] by simp
+    AOT_thus \<open>[G] \<Rightarrow> [F]\<close>
+      by (AOT_subst_def "F-imp-G"; auto intro!: "&I" "cqt:2")
+  }
+  {
+    AOT_assume \<open>[G] \<Rightarrow> [F]\<close>
+    AOT_hence \<open>\<box>\<forall>x([G]x \<rightarrow> [F]x)\<close>
+      by (safe dest!: "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2))
+    AOT_hence \<open>\<^bold>\<A>\<box>\<forall>x([G]x \<rightarrow> [F]x)\<close>
+      using "qml-act:2"[axiom_inst, THEN "\<equiv>E"(1)] by simp
+    AOT_hence \<open>\<^bold>\<A>(F\<down> & G\<down> & \<box>\<forall>x([G]x \<rightarrow> [F]x))\<close>
+      by (auto intro!: "Act-Basic:2"[THEN "\<equiv>E"(2)] "&I" "cqt:2"
+               intro: "RA[2]")
+    AOT_hence \<open>\<^bold>\<A>([G] \<Rightarrow> [F])\<close>
+      by (AOT_subst_def "F-imp-G")
+    AOT_hence \<open>\<^bold>\<A>\<^bold>c\<^sub>G[F]\<close>
+      using 0[THEN "\<equiv>E"(2)] by blast
+    AOT_thus \<open>\<^bold>c\<^sub>G[F]\<close>
+      by(safe intro!: "en-eq:10[1]"[unvarify x\<^sub>1, THEN "\<equiv>E"(1)]
+                      "concept-G[den]")
+  }
+qed
+
+AOT_theorem conH_enc_ord:
+  \<open>([H] \<Rightarrow> O!) \<rightarrow> \<box>\<forall>F \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<^bold>c\<^sub>H[F] \<equiv> \<^bold>c\<^sub>H[G]))\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[H] \<Rightarrow> O!\<close>
+  AOT_have 0: \<open>\<box>([H] \<Rightarrow> O!)\<close>
+    apply (AOT_subst_def "F-imp-G")
+    using 0[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "F-imp-G"]]
+    by (auto intro!: "KBasic:3"[THEN "\<equiv>E"(2)] "&I" "exist-nec"[THEN "\<rightarrow>E"]
+               dest: "&E" 4[THEN "\<rightarrow>E"])
+  moreover AOT_have \<open>\<box>([H] \<Rightarrow> O!) \<rightarrow> \<box>\<forall>F \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<^bold>c\<^sub>H[F] \<equiv> \<^bold>c\<^sub>H[G]))\<close>
+  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
+    AOT_modally_strict {
+      fix F G
+      AOT_assume \<open>[H] \<Rightarrow> O!\<close>
+      AOT_hence 0: \<open>\<box>\<forall>x ([H]x \<rightarrow> O!x)\<close>
+        by (safe dest!: "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2))
+      AOT_assume 1: \<open>\<box>G \<equiv>\<^sub>E F\<close>
+      AOT_assume \<open>\<^bold>c\<^sub>H[F]\<close>
+      AOT_hence \<open>[H] \<Rightarrow> [F]\<close>
+        using "conG-lemma:1"[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by simp
+      AOT_hence 2: \<open>\<box>\<forall>x ([H]x \<rightarrow> [F]x)\<close>
+        by (safe dest!: "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2))
+      AOT_modally_strict {
+        AOT_assume 0: \<open>\<forall>x ([H]x \<rightarrow> O!x)\<close>
+        AOT_assume 1: \<open>\<forall>x ([H]x \<rightarrow> [F]x)\<close>
+        AOT_assume 2: \<open>G \<equiv>\<^sub>E F\<close>
+        AOT_have \<open>\<forall>x ([H]x \<rightarrow> [G]x)\<close>
+        proof(safe intro!: GEN "\<rightarrow>I")
+          fix x
+          AOT_assume \<open>[H]x\<close>
+          AOT_hence \<open>O!x\<close> and \<open>[F]x\<close>
+            using 0 1 "\<forall>E"(2) "\<rightarrow>E" by blast+
+          AOT_thus \<open>[G]x\<close>
+            using 2[THEN eqE[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)]
+                  "\<forall>E"(2) "\<rightarrow>E" "\<equiv>E"(2) calculation by blast
+        qed
+      }
+      AOT_hence \<open>\<box>\<forall>x ([H]x \<rightarrow> [G]x)\<close>
+        using "RN[prem]"[where \<Gamma>=\<open>{\<guillemotleft>\<forall>x ([H]x \<rightarrow> O!x)\<guillemotright>,
+                               \<guillemotleft>\<forall>x ([H]x \<rightarrow> [F]x)\<guillemotright>,
+                               \<guillemotleft>G \<equiv>\<^sub>E F\<guillemotright>}\<close>, simplified] 0 1 2 by fast
+      AOT_hence \<open>[H] \<Rightarrow> [G]\<close>
+        by (safe intro!: "F-imp-G"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2")
+      AOT_hence \<open>\<^bold>c\<^sub>H[G]\<close>
+        using "conG-lemma:1"[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by simp
+    } note 0 = this
+    AOT_modally_strict {
+      fix F G
+      AOT_assume \<open>[H] \<Rightarrow> O!\<close>
+      moreover AOT_assume \<open>\<box>G \<equiv>\<^sub>E F\<close>
+      moreover AOT_have \<open>\<box>F \<equiv>\<^sub>E G\<close>
+        by (AOT_subst \<open>F \<equiv>\<^sub>E G\<close> \<open>G \<equiv>\<^sub>E F\<close>)
+            (auto intro!: calculation(2)
+                          eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                          "\<equiv>I" "\<rightarrow>I" "&I" "cqt:2" Ordinary.GEN
+                  dest!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2)
+                  dest: "\<equiv>E"(1,2) "Ordinary.\<forall>E")
+      ultimately AOT_show \<open>(\<^bold>c\<^sub>H[F] \<equiv> \<^bold>c\<^sub>H[G])\<close>
+        using 0 "\<equiv>I" "\<rightarrow>I" by auto
+    }
+  qed
+  ultimately AOT_show \<open>\<box>\<forall>F \<forall>G (\<box>G \<equiv>\<^sub>E F \<rightarrow> (\<^bold>c\<^sub>H[F] \<equiv> \<^bold>c\<^sub>H[G]))\<close>
+    using "\<rightarrow>E" by blast
+qed
+
+AOT_theorem concept_inclusion_denotes_1:
+  \<open>([H] \<Rightarrow> O!) \<rightarrow> [\<lambda>x \<^bold>c\<^sub>H \<preceq> x]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[H] \<Rightarrow> O!\<close>
+  AOT_show \<open>[\<lambda>x \<^bold>c\<^sub>H \<preceq> x]\<down>\<close>
+  proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x C!x & \<forall>F(\<^bold>c\<^sub>H[F] \<rightarrow> x[F])]\<down>\<close>
+      by (safe intro!: conjunction_denotes[THEN "\<rightarrow>E", OF "&I"]
+                       Comprehension_2'[THEN "\<rightarrow>E"]
+                       conH_enc_ord[THEN "\<rightarrow>E", OF 0]) "cqt:2"
+  next
+    AOT_show \<open>\<box>\<forall>x (C!x & \<forall>F (\<^bold>c\<^sub>H[F] \<rightarrow> x[F]) \<equiv> \<^bold>c\<^sub>H \<preceq> x)\<close>
+      by (safe intro!: RN GEN; AOT_subst_def "con:1")
+         (auto intro!: "\<equiv>I" "\<rightarrow>I" "&I" "concept-G[concept]" dest: "&E")
+  qed
+qed
+
+AOT_theorem concept_inclusion_denotes_2:
+  \<open>([H] \<Rightarrow> O!) \<rightarrow> [\<lambda>x x \<preceq> \<^bold>c\<^sub>H]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[H] \<Rightarrow> O!\<close>
+  AOT_show \<open>[\<lambda>x x \<preceq> \<^bold>c\<^sub>H]\<down>\<close>
+  proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x C!x & \<forall>F(x[F] \<rightarrow> \<^bold>c\<^sub>H[F])]\<down>\<close>
+      by (safe intro!: conjunction_denotes[THEN "\<rightarrow>E", OF "&I"]
+                       Comprehension_1'[THEN "\<rightarrow>E"]
+                       conH_enc_ord[THEN "\<rightarrow>E", OF 0]) "cqt:2"
+  next
+    AOT_show \<open>\<box>\<forall>x (C!x & \<forall>F (x[F] \<rightarrow> \<^bold>c\<^sub>H[F]) \<equiv> x \<preceq> \<^bold>c\<^sub>H)\<close>
+      by (safe intro!: RN GEN; AOT_subst_def "con:1")
+         (auto intro!: "\<equiv>I" "\<rightarrow>I" "&I" "concept-G[concept]" dest: "&E")
+  qed
+qed
+
+AOT_define ThickForm :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>FormOf'(_,_')\<close>)
+  "tform-of": \<open>FormOf(x,G) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F(x[F] \<equiv> [G] \<Rightarrow> [F])\<close>
+
+AOT_theorem FormOfOrdinaryProperty: \<open>([H] \<Rightarrow> O!) \<rightarrow> [\<lambda>x FormOf(x,H)]\<down>\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>[H] \<Rightarrow> [O!]\<close>
+  AOT_show \<open>[\<lambda>x FormOf(x,H)]\<down>\<close>
+  proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E", OF "&I"])
+    AOT_show \<open>[\<lambda>x ConceptOf(x,H)]\<down>\<close>
+      using 0 ConceptOfOrdinaryProperty[THEN "\<rightarrow>E"] by blast
+    AOT_show \<open>\<box>\<forall>x (ConceptOf(x,H) \<equiv> FormOf(x,H))\<close>
+    proof(safe intro!: RN GEN)
+      AOT_modally_strict {
+        fix x
+        AOT_modally_strict {
+          AOT_have \<open>A!x \<equiv> A!x\<close>
+            by (simp add: "oth-class-taut:3:a")
+          AOT_hence \<open>C!x \<equiv> A!x\<close>
+            using "rule-id-df:1[zero]"[OF concepts, OF "oa-exist:2"]
+                  "rule=E" id_sym by fast
+        }
+        AOT_thus \<open>ConceptOf(x,H) \<equiv> FormOf(x,H)\<close>
+          by (AOT_subst_def "tform-of";
+              AOT_subst_def "concept-of-G";
+              AOT_subst \<open>C!x\<close> \<open>A!x\<close>)
+             (auto intro!: "\<equiv>I" "\<rightarrow>I" "&I" dest: "&E")
+      }
+    qed
+  qed
+qed
+
+AOT_theorem equal_E_rigid_one_to_one: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1((=\<^sub>E))\<close>
+proof (safe intro!: "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
+                    GEN "\<rightarrow>I" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "=E[denotes]")
+  fix x y z
+  AOT_assume \<open>x =\<^sub>E z & y =\<^sub>E z\<close>
+  AOT_thus \<open>x = y\<close>
+    by (metis "rule=E" "&E"(1) "Conjunction Simplification"(2)
+              "=E-simple:2" id_sym "\<rightarrow>E")
+next
+  AOT_have \<open>\<forall>x\<forall>y \<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close>
+  proof(rule GEN; rule GEN)
+    AOT_show \<open>\<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close> for x y
+      by (meson RN "deduction-theorem" "id-nec3:1" "\<equiv>E"(1))
+  qed
+  AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
+    by (rule tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"])
+  AOT_thus \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
+    using BF[THEN "\<rightarrow>E"] by fast
+qed
+
+AOT_theorem equal_E_domain: \<open>InDomainOf(x,(=\<^sub>E)) \<equiv> O!x\<close>
+proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
+  AOT_assume \<open>InDomainOf(x,(=\<^sub>E))\<close>
+  AOT_hence \<open>\<exists>y x =\<^sub>E y\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
+  then AOT_obtain y where \<open>x =\<^sub>E y\<close>
+    using "\<exists>E"[rotated] by blast
+  AOT_thus \<open>O!x\<close>
+    using "=E-simple:1"[THEN "\<equiv>E"(1)] "&E" by blast
+next
+  AOT_assume \<open>O!x\<close>
+  AOT_hence \<open>x =\<^sub>E x\<close>   
+    by (metis "ord=Eequiv:1"[THEN "\<rightarrow>E"])
+  AOT_hence \<open>\<exists>y x =\<^sub>E y\<close>
+    using "\<exists>I"(2) by fast
+  AOT_thus \<open>InDomainOf(x,(=\<^sub>E))\<close>
+    by (metis "\<equiv>\<^sub>d\<^sub>fI" "df-1-1:5")
+qed
+
+AOT_theorem shared_urelement_projection_identity:
+  assumes \<open>\<forall>y [\<lambda>x (y[\<lambda>z [R]zx])]\<down>\<close>
+  shows \<open>\<forall>F([F]a \<equiv> [F]b) \<rightarrow> [\<lambda>z [R]za] = [\<lambda>z [R]zb]\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<forall>F([F]a \<equiv> [F]b)\<close>
+  {
+    fix z
+    AOT_have \<open>[\<lambda>x (z[\<lambda>z [R]zx])]\<down>\<close>
+      using assms[THEN "\<forall>E"(2)].
+    AOT_hence 1: \<open>\<forall>x \<forall>y (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>(z[\<lambda>z [R]zx] \<equiv> z[\<lambda>z [R]zy]))\<close>
+      using "kirchner-thm-cor:1"[THEN "\<rightarrow>E"]
+      by blast
+    AOT_have \<open>\<box>(z[\<lambda>z [R]za] \<equiv> z[\<lambda>z [R]zb])\<close>
+      using 1[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF 0] by blast
+  }
+  AOT_hence \<open>\<forall>z \<box>(z[\<lambda>z [R]za] \<equiv> z[\<lambda>z [R]zb])\<close>
+    by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>z(z[\<lambda>z [R]za] \<equiv> z[\<lambda>z [R]zb])\<close>
+    by (rule BF[THEN "\<rightarrow>E"])
+  AOT_thus \<open>[\<lambda>z [R]za] = [\<lambda>z [R]zb]\<close>
+    by (AOT_subst_def "identity:2")
+       (auto intro!: "&I" "cqt:2")
+qed
+
+AOT_theorem shared_urelement_exemplification_identity:
+  assumes \<open>\<forall>y [\<lambda>x (y[\<lambda>z [G]x])]\<down>\<close>
+  shows \<open>\<forall>F([F]a \<equiv> [F]b) \<rightarrow> ([G]a) = ([G]b)\<close>
+proof(rule "\<rightarrow>I")
+  AOT_assume 0: \<open>\<forall>F([F]a \<equiv> [F]b)\<close>
+  {
+    fix z
+    AOT_have \<open>[\<lambda>x (z[\<lambda>z [G]x])]\<down>\<close>
+      using assms[THEN "\<forall>E"(2)].
+    AOT_hence 1: \<open>\<forall>x \<forall>y (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>(z[\<lambda>z [G]x] \<equiv> z[\<lambda>z [G]y]))\<close>
+      using "kirchner-thm-cor:1"[THEN "\<rightarrow>E"]
+      by blast
+    AOT_have \<open>\<box>(z[\<lambda>z [G]a] \<equiv> z[\<lambda>z [G]b])\<close>
+      using 1[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF 0] by blast
+  }
+  AOT_hence \<open>\<forall>z \<box>(z[\<lambda>z [G]a] \<equiv> z[\<lambda>z [G]b])\<close>
+    by (rule GEN)
+  AOT_hence \<open>\<box>\<forall>z(z[\<lambda>z [G]a] \<equiv> z[\<lambda>z [G]b])\<close>
+    by (rule BF[THEN "\<rightarrow>E"])
+  AOT_hence \<open>[\<lambda>z [G]a] = [\<lambda>z [G]b]\<close>
+    by (AOT_subst_def "identity:2")
+       (auto intro!: "&I" "cqt:2")
+  AOT_thus \<open>([G]a) = ([G]b)\<close>
+    by (safe intro!: "identity:4"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "log-prop-prop:2")
+qed
+
+text\<open>The assumptions of the theorems above are derivable, if the additional
+     introduction rules for the upcoming extension of @{thm "cqt:2[lambda]"}
+     are explicitly allowed (while they are currently not part of the
+     abstraction layer).\<close>
+notepad
+begin
+  AOT_modally_strict {
+    AOT_have \<open>\<forall>R\<forall>y [\<lambda>x (y[\<lambda>z [R]zx])]\<down>\<close>
+      by (safe intro!: GEN "cqt:2" AOT_instance_of_cqt_2_intro_next)
+    AOT_have \<open>\<forall>G\<forall>y [\<lambda>x (y[\<lambda>z [G]x])]\<down>\<close>
+      by (safe intro!: GEN "cqt:2" AOT_instance_of_cqt_2_intro_next)
+  }
+end
+
+end
diff --git a/thys/AOT/AOT_model.thy b/thys/AOT/AOT_model.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_model.thy
@@ -0,0 +1,1324 @@
+(*<*)
+theory AOT_model
+  imports Main "HOL-Cardinals.Cardinals"
+begin
+
+declare[[typedef_overloaded]]
+(*>*)
+
+section\<open>References\<close>
+
+text\<open>
+A full description of this formalization including references can be found
+at @{url \<open>http://dx.doi.org/10.17169/refubium-35141\<close>}.
+
+The version of Principia Logico-Metaphysica (PLM) implemented in this formalization
+can be found at @{url \<open>http://mally.stanford.edu/principia-2021-10-13.pdf\<close>}, while
+the latest version of PLM is available at @{url \<open>http://mally.stanford.edu/principia.pdf\<close>}.
+
+\<close>
+
+section\<open>Model for the Logic of AOT\<close>
+
+text\<open>We introduce a primitive type for hyperintensional propositions.\<close>
+typedecl \<o>
+
+text\<open>To be able to model modal operators following Kripke semantics,
+     we introduce a primitive type for possible worlds and assert, by axiom,
+     that there is a surjective function mapping propositions to the
+     boolean-valued functions acting on possible worlds. We call the result
+     of applying this function to a proposition the Montague intension
+     of the proposition.\<close>
+typedecl w \<comment>\<open>The primtive type of possible worlds.\<close>
+axiomatization AOT_model_d\<o> :: \<open>\<o>\<Rightarrow>(w\<Rightarrow>bool)\<close> where
+  d\<o>_surj: \<open>surj AOT_model_d\<o>\<close>
+
+text\<open>The axioms of PLM require the existence of a non-actual world.\<close>
+consts w\<^sub>0 :: w \<comment>\<open>The designated actual world.\<close>
+axiomatization where AOT_model_nonactual_world: \<open>\<exists>w . w \<noteq> w\<^sub>0\<close>
+
+text\<open>Validity of a proposition in a given world can now be modelled as the result
+     of applying that world to the Montague intension of the proposition.\<close>
+definition AOT_model_valid_in :: \<open>w\<Rightarrow>\<o>\<Rightarrow>bool\<close> where
+  \<open>AOT_model_valid_in w \<phi> \<equiv> AOT_model_d\<o> \<phi> w\<close>
+
+text\<open>By construction, we can choose a proposition for any given Montague intension,
+     s.t. the proposition is valid in a possible world iff the Montague intension
+     evaluates to true at that world.\<close>
+definition AOT_model_proposition_choice :: \<open>(w\<Rightarrow>bool) \<Rightarrow> \<o>\<close> (binder \<open>\<epsilon>\<^sub>\<o> \<close> 8)
+  where \<open>\<epsilon>\<^sub>\<o> w. \<phi> w \<equiv> (inv AOT_model_d\<o>) \<phi>\<close>
+lemma AOT_model_proposition_choice_simp: \<open>AOT_model_valid_in w (\<epsilon>\<^sub>\<o> w. \<phi> w) = \<phi> w\<close>
+  by (simp add: surj_f_inv_f[OF d\<o>_surj] AOT_model_valid_in_def
+                AOT_model_proposition_choice_def)
+
+text\<open>Nitpick can trivially show that there are models for the axioms above.\<close>
+lemma \<open>True\<close> nitpick[satisfy, user_axioms, expect = genuine] ..
+
+typedecl \<omega> \<comment>\<open>The primtive type of ordinary objects/urelements.\<close>
+
+text\<open>Validating extended relation comprehension requires a large set of
+     special urelements. For simple models that do not validate extended
+     relation comprehension (and consequently the predecessor axiom in the
+     theory of natural numbers), it suffices to use a primitive type as @{text \<sigma>},
+     i.e. @{theory_text \<open>typedecl \<sigma>\<close>}.\<close>
+typedecl \<sigma>'
+typedef \<sigma> = \<open>UNIV::((\<omega> \<Rightarrow> w \<Rightarrow> bool) set \<times> (\<omega> \<Rightarrow> w \<Rightarrow> bool) set \<times> \<sigma>') set\<close> ..
+
+typedecl null \<comment> \<open>Null-urelements representing non-denoting terms.\<close>
+
+datatype \<upsilon> = \<omega>\<upsilon> \<omega> | \<sigma>\<upsilon> \<sigma> | is_null\<upsilon>: null\<upsilon> null \<comment> \<open>Type of urelements\<close>
+
+text\<open>Urrelations are proposition-valued functions on urelements.
+     Urrelations are required to evaluate to necessarily false propositions for
+     null-urelements (note that there may be several distinct necessarily false
+     propositions).\<close>
+typedef urrel = \<open>{ \<phi> . \<forall> x w . \<not>AOT_model_valid_in w (\<phi> (null\<upsilon> x)) }\<close>
+  by (rule exI[where x=\<open>\<lambda> x . (\<epsilon>\<^sub>\<o> w . \<not>is_null\<upsilon> x)\<close>])
+     (auto simp: AOT_model_proposition_choice_simp)
+
+text\<open>Abstract objects will be modelled as sets of urrelations and will
+     have to be mapped surjectively into the set of special urelements.
+     We show that any mapping from abstract objects to special urelements
+     has to involve at least one large set of collapsed abstract objects.
+     We will use this fact to extend arbitrary mappings from abstract objects
+     to special urelements to surjective mappings.\<close>
+lemma \<alpha>\<sigma>_pigeonhole:
+  \<comment> \<open>For any arbitrary mapping @{term \<alpha>\<sigma>} from sets of urrelations to special
+     urelements, there exists an abstract object x, s.t. the cardinal of the set
+     of special urelements is strictly smaller than the cardinal of the set of
+     abstract objects that are mapped to the same urelement as x under @{term \<alpha>\<sigma>}.\<close>
+  \<open>\<exists>x . |UNIV::\<sigma> set| <o |{y . \<alpha>\<sigma> x = \<alpha>\<sigma> y}|\<close>
+  for \<alpha>\<sigma> :: \<open>urrel set \<Rightarrow> \<sigma>\<close>
+proof(rule ccontr)
+  have card_\<sigma>_set_set_bound: \<open>|UNIV::\<sigma> set set| \<le>o |UNIV::urrel set|\<close>
+  proof -
+    let ?pick = \<open>\<lambda>u s . \<epsilon>\<^sub>\<o> w . case u of (\<sigma>\<upsilon> s') \<Rightarrow> s' \<in> s | _ \<Rightarrow> False\<close>
+    have \<open>\<exists>f :: \<sigma> set \<Rightarrow> urrel . inj f\<close>
+    proof
+      show \<open>inj (\<lambda>s . Abs_urrel (\<lambda>u . ?pick u s))\<close>
+      proof(rule injI)
+        fix x y
+        assume \<open>Abs_urrel (\<lambda>u. ?pick u x) = Abs_urrel (\<lambda>u. ?pick u y)\<close>
+        hence \<open>(\<lambda>u. ?pick u x) = (\<lambda>u. ?pick u y)\<close>
+          by (auto intro!: Abs_urrel_inject[THEN iffD1]
+                     simp: AOT_model_proposition_choice_simp)
+        hence \<open>AOT_model_valid_in w\<^sub>0 (?pick (\<sigma>\<upsilon> s) x) =
+               AOT_model_valid_in w\<^sub>0 (?pick (\<sigma>\<upsilon> s) y)\<close>
+          for s by metis
+        hence \<open>(s \<in> x) = (s \<in> y)\<close> for s
+          by (auto simp: AOT_model_proposition_choice_simp)
+        thus \<open>x = y\<close>
+          by blast
+      qed
+    qed
+    thus ?thesis
+      by (metis card_of_image inj_imp_surj_inv)
+  qed
+
+  text\<open>Assume, for a proof by contradiction, that there is no large collapsed set.\<close>
+  assume \<open>\<nexists>x . |UNIV::\<sigma> set| <o |{y . \<alpha>\<sigma> x = \<alpha>\<sigma> y}|\<close>
+  hence A: \<open>\<forall>x . |{y . \<alpha>\<sigma> x = \<alpha>\<sigma> y}| \<le>o |UNIV::\<sigma> set|\<close>
+    by auto
+  have union_univ: \<open>(\<Union>x \<in> range(inv \<alpha>\<sigma>) . {y . \<alpha>\<sigma> x = \<alpha>\<sigma> y}) = UNIV\<close>
+    by auto (meson f_inv_into_f range_eqI)
+
+  text\<open>We refute by case distinction: there is either finitely many or
+       infinitely many special urelements and in both cases we can derive
+       a contradiction from the assumption above.\<close>
+  {
+    text\<open>Finite case.\<close>
+    assume finite_\<sigma>_set: \<open>finite (UNIV::\<sigma> set)\<close>
+    hence finite_collapsed: \<open>finite {y . \<alpha>\<sigma> x = \<alpha>\<sigma> y}\<close> for x
+      using A card_of_ordLeq_infinite by blast
+    hence 0: \<open>\<forall>x . card {y . \<alpha>\<sigma> x = \<alpha>\<sigma> y} \<le> card (UNIV::\<sigma> set)\<close>
+      by (metis A finite_\<sigma>_set card_of_ordLeq inj_on_iff_card_le)
+    have 1: \<open>card (range (inv \<alpha>\<sigma>)) \<le> card (UNIV::\<sigma> set)\<close>
+      using finite_\<sigma>_set card_image_le by blast
+    hence 2: \<open>finite (range (inv \<alpha>\<sigma>))\<close>
+      using finite_\<sigma>_set by blast
+
+    define n where \<open>n = card (UNIV::urrel set set)\<close>
+    define m where \<open>m = card (UNIV::\<sigma> set)\<close>
+
+    have \<open>n = card (\<Union>x \<in> range(inv \<alpha>\<sigma>) . {y . \<alpha>\<sigma> x = \<alpha>\<sigma> y})\<close>
+      unfolding n_def using union_univ by argo
+    also have \<open>\<dots> \<le> (\<Sum>i\<in>range (inv \<alpha>\<sigma>). card {y. \<alpha>\<sigma> i = \<alpha>\<sigma> y})\<close>
+      using card_UN_le 2 by blast
+    also have \<open>\<dots> \<le> (\<Sum>i\<in>range (inv \<alpha>\<sigma>). card (UNIV::\<sigma> set))\<close>
+      by (metis (no_types, lifting) 0 sum_mono)
+    also have \<open>\<dots> \<le> card (range (inv \<alpha>\<sigma>)) * card (UNIV::\<sigma> set)\<close>
+      using sum_bounded_above by auto
+    also have \<open>\<dots> \<le> card (UNIV::\<sigma> set) * card (UNIV::\<sigma> set)\<close>
+      using 1 by force
+    also have \<open>\<dots> = m*m\<close>
+      unfolding m_def by blast
+    finally have n_upper: \<open>n \<le> m*m\<close>.
+
+    have \<open>finite (\<Union>x \<in> range(inv \<alpha>\<sigma>) . {y . \<alpha>\<sigma> x = \<alpha>\<sigma> y})\<close>
+      using 2 finite_collapsed by blast
+    hence finite_\<alpha>set: \<open>finite (UNIV::urrel set set)\<close>
+      using union_univ by argo
+
+    have \<open>2^2^m = (2::nat)^(card (UNIV::\<sigma> set set))\<close>
+      by (metis Pow_UNIV card_Pow finite_\<sigma>_set m_def)
+    moreover have \<open>card (UNIV::\<sigma> set set) \<le> (card (UNIV::urrel set))\<close>
+      using card_\<sigma>_set_set_bound
+      by (meson Finite_Set.finite_set card_of_ordLeq finite_\<alpha>set
+                finite_\<sigma>_set inj_on_iff_card_le)
+    ultimately have \<open>2^2^m \<le> (2::nat)^(card (UNIV:: urrel set))\<close>
+      by simp
+    also have \<open>\<dots> = n\<close>
+      unfolding n_def
+      by (metis Finite_Set.finite_set Pow_UNIV card_Pow finite_\<alpha>set)
+    finally have \<open>2^2^m \<le> n\<close> by blast
+    hence \<open>2^2^m \<le> m*m\<close> using n_upper by linarith
+    moreover {
+      have \<open>(2::nat)^(2^m) \<ge> (2^(m + 1))\<close>
+        by (metis Suc_eq_plus1 Suc_leI less_exp one_le_numeral power_increasing)
+      also have \<open>(2^(m + 1)) = (2::nat) * 2^m\<close>
+        by auto
+      have \<open>m < 2^m\<close>
+        by (simp add: less_exp)
+      hence \<open>m*m < (2^m)*(2^m)\<close>
+        by (simp add: mult_strict_mono)
+      moreover have \<open>\<dots> = 2^(m+m)\<close>
+        by (simp add: power_add)
+      ultimately have \<open>m*m < 2 ^ (m + m)\<close> by presburger
+      moreover have \<open>m+m \<le> 2^m\<close>
+      proof (induct m)
+        case 0
+        thus ?case by auto
+      next
+        case (Suc m)
+        thus ?case
+          by (metis Suc_leI less_exp mult_2 mult_le_mono2 power_Suc)
+      qed
+      ultimately have \<open>m*m < 2^2^m\<close>
+        by (meson less_le_trans one_le_numeral power_increasing)
+    }
+    ultimately have False by auto
+  }
+  moreover {
+    text\<open>Infinite case.\<close>
+    assume \<open>infinite (UNIV::\<sigma> set)\<close>
+    hence Cinf\<sigma>: \<open>Cinfinite |UNIV::\<sigma> set|\<close>
+      by (simp add: cinfinite_def)
+    have 1: \<open>|range (inv \<alpha>\<sigma>)| \<le>o |UNIV::\<sigma> set|\<close>
+      by auto
+    have 2: \<open>\<forall>i\<in>range (inv \<alpha>\<sigma>). |{y . \<alpha>\<sigma> i = \<alpha>\<sigma> y}| \<le>o |UNIV::\<sigma> set|\<close>
+    proof
+      fix i :: \<open>urrel set\<close>
+      assume \<open>i \<in> range (inv \<alpha>\<sigma>)\<close>
+      show \<open>|{y . \<alpha>\<sigma> i = \<alpha>\<sigma> y}| \<le>o |UNIV::\<sigma> set|\<close>
+        using A by blast
+    qed
+    have \<open>|\<Union> ((\<lambda>i. {y. \<alpha>\<sigma> i = \<alpha>\<sigma> y}) ` (range (inv \<alpha>\<sigma>)))| \<le>o
+                   |Sigma (range (inv \<alpha>\<sigma>)) (\<lambda>i. {y. \<alpha>\<sigma> i = \<alpha>\<sigma> y})|\<close>
+      using card_of_UNION_Sigma by blast
+    hence \<open>|UNIV::urrel set set| \<le>o
+           |Sigma (range (inv \<alpha>\<sigma>)) (\<lambda>i. {y. \<alpha>\<sigma> i = \<alpha>\<sigma> y})|\<close>
+      using union_univ by argo
+    moreover have \<open>|Sigma (range (inv \<alpha>\<sigma>)) (\<lambda>i. {y. \<alpha>\<sigma> i = \<alpha>\<sigma> y})| \<le>o |UNIV::\<sigma> set|\<close>
+      using card_of_Sigma_ordLeq_Cinfinite[OF Cinf\<sigma>, OF 1, OF 2] by blast
+    ultimately have \<open>|UNIV::urrel set set| \<le>o |UNIV::\<sigma> set|\<close>
+      using ordLeq_transitive by blast
+    moreover {
+      have \<open>|UNIV::\<sigma> set| <o |UNIV::\<sigma> set set|\<close>
+        by auto
+      moreover have \<open>|UNIV::\<sigma> set set| \<le>o |UNIV::urrel set|\<close>
+        using card_\<sigma>_set_set_bound by blast
+      moreover have \<open>|UNIV::urrel set| <o |UNIV::urrel set set|\<close>
+        by auto
+      ultimately have \<open>|UNIV::\<sigma> set| <o |UNIV::urrel set set|\<close>
+        by (metis ordLess_imp_ordLeq ordLess_ordLeq_trans)
+    }
+    ultimately have False
+      using not_ordLeq_ordLess by blast
+  }
+  ultimately show False by blast
+qed
+
+text\<open>We introduce a mapping from abstract objects (i.e. sets of urrelations) to
+     special urelements @{text \<open>\<alpha>\<sigma>\<close>} that is surjective and distinguishes all
+     abstract objects that are distinguished by a (not necessarily surjective)
+     mapping @{text \<open>\<alpha>\<sigma>'\<close>}. @{text \<open>\<alpha>\<sigma>'\<close>} will be used to model extended relation
+     comprehension.\<close>
+consts \<alpha>\<sigma>' :: \<open>urrel set \<Rightarrow> \<sigma>\<close>
+consts \<alpha>\<sigma> :: \<open>urrel set \<Rightarrow> \<sigma>\<close>
+
+specification(\<alpha>\<sigma>)
+  \<alpha>\<sigma>_surj: \<open>surj \<alpha>\<sigma>\<close>
+  \<alpha>\<sigma>_\<alpha>\<sigma>': \<open>\<alpha>\<sigma> x = \<alpha>\<sigma> y \<Longrightarrow> \<alpha>\<sigma>' x = \<alpha>\<sigma>' y\<close>
+proof -
+  obtain x where x_prop: \<open>|UNIV::\<sigma> set| <o |{y. \<alpha>\<sigma>' x = \<alpha>\<sigma>' y}|\<close>
+    using \<alpha>\<sigma>_pigeonhole by blast
+  have \<open>\<exists>f :: urrel set \<Rightarrow> \<sigma> . f ` {y. \<alpha>\<sigma>' x = \<alpha>\<sigma>' y} = UNIV \<and> f x = \<alpha>\<sigma>' x\<close>
+  proof -
+    have \<open>\<exists>f :: urrel set \<Rightarrow> \<sigma> . f ` {y. \<alpha>\<sigma>' x = \<alpha>\<sigma>' y} = UNIV\<close>
+      by (simp add: x_prop card_of_ordLeq2 ordLess_imp_ordLeq)
+    then obtain f :: \<open>urrel set \<Rightarrow> \<sigma>\<close> where \<open>f ` {y. \<alpha>\<sigma>' x = \<alpha>\<sigma>' y} = UNIV\<close>
+      by presburger
+    moreover obtain a where \<open>f a = \<alpha>\<sigma>' x\<close> and \<open>\<alpha>\<sigma>' a = \<alpha>\<sigma>' x\<close>
+      by (smt (verit, best) calculation UNIV_I image_iff mem_Collect_eq)
+    ultimately have \<open>(f (a := f x, x := f a)) ` {y. \<alpha>\<sigma>' x = \<alpha>\<sigma>' y} = UNIV \<and>
+                      (f (a := f x, x := f a)) x = \<alpha>\<sigma>' x\<close>
+      by (auto simp: image_def)
+    thus ?thesis by blast
+  qed
+  then obtain f where fimage: \<open>f ` {y. \<alpha>\<sigma>' x = \<alpha>\<sigma>' y} = UNIV\<close>
+                  and fx: \<open>f x = \<alpha>\<sigma>' x\<close>
+    by blast
+
+  define \<alpha>\<sigma> :: \<open>urrel set \<Rightarrow> \<sigma>\<close> where
+    \<open>\<alpha>\<sigma> \<equiv> \<lambda> urrels . if \<alpha>\<sigma>' urrels = \<alpha>\<sigma>' x \<and> f urrels \<notin> range \<alpha>\<sigma>'
+                      then f urrels
+                      else \<alpha>\<sigma>' urrels\<close>
+  have \<open>surj \<alpha>\<sigma>\<close>
+  proof -
+    {
+    fix s :: \<sigma>
+    {
+      assume \<open>s \<in> range \<alpha>\<sigma>'\<close>
+      hence 0: \<open>\<alpha>\<sigma>' (inv \<alpha>\<sigma>' s) = s\<close>
+        by (meson f_inv_into_f)
+      {
+        assume \<open>s = \<alpha>\<sigma>' x\<close>
+        hence \<open>\<alpha>\<sigma> x = s\<close>
+          using \<alpha>\<sigma>_def fx by presburger
+        hence \<open>\<exists>f . \<alpha>\<sigma> (f s) = s\<close>
+          by auto
+      }
+      moreover {
+        assume \<open>s \<noteq> \<alpha>\<sigma>' x\<close>
+        hence \<open>\<alpha>\<sigma> (inv \<alpha>\<sigma>' s) = s\<close>
+          unfolding \<alpha>\<sigma>_def 0 by presburger
+        hence \<open>\<exists>f . \<alpha>\<sigma> (f s) = s\<close>
+          by blast
+      }
+      ultimately have \<open>\<exists>f . \<alpha>\<sigma> (f s) = s\<close>
+        by blast
+    }
+    moreover {
+      assume \<open>s \<notin> range \<alpha>\<sigma>'\<close>
+      moreover obtain urrels where \<open>f urrels = s\<close> and \<open>\<alpha>\<sigma>' x = \<alpha>\<sigma>' urrels\<close>
+        by (smt (verit, best) UNIV_I fimage image_iff mem_Collect_eq)
+      ultimately have \<open>\<alpha>\<sigma> urrels = s\<close>
+        using \<alpha>\<sigma>_def by presburger
+      hence \<open>\<exists>f . \<alpha>\<sigma> (f s) = s\<close>
+        by (meson f_inv_into_f range_eqI)
+    }
+    ultimately have \<open>\<exists>f . \<alpha>\<sigma> (f s) = s\<close>
+      by blast
+    }
+    thus ?thesis
+      by (metis surj_def)
+  qed
+  moreover have \<open>\<forall>x y. \<alpha>\<sigma> x = \<alpha>\<sigma> y \<longrightarrow> \<alpha>\<sigma>' x = \<alpha>\<sigma>' y\<close>
+    by (metis \<alpha>\<sigma>_def rangeI)
+  ultimately show ?thesis
+    by blast
+qed
+
+text\<open>For extended models that validate extended relation comprehension
+     (and consequently the predecessor axiom), we specify which
+     abstract objects are distinguished by @{const \<alpha>\<sigma>'}.\<close>
+
+definition urrel_to_\<omega>rel :: \<open>urrel \<Rightarrow> (\<omega> \<Rightarrow> w \<Rightarrow> bool)\<close> where
+  \<open>urrel_to_\<omega>rel \<equiv> \<lambda> r u w . AOT_model_valid_in w (Rep_urrel r (\<omega>\<upsilon> u))\<close>
+definition \<omega>rel_to_urrel :: \<open>(\<omega> \<Rightarrow> w \<Rightarrow> bool) \<Rightarrow> urrel\<close> where
+  \<open>\<omega>rel_to_urrel \<equiv> \<lambda> \<phi> . Abs_urrel
+    (\<lambda> u . \<epsilon>\<^sub>\<o> w . case u of \<omega>\<upsilon> x \<Rightarrow> \<phi> x w | _ \<Rightarrow> False)\<close>
+
+definition AOT_urrel_\<omega>equiv :: \<open>urrel \<Rightarrow> urrel \<Rightarrow> bool\<close> where
+  \<open>AOT_urrel_\<omega>equiv \<equiv> \<lambda> r s . \<forall> u v . AOT_model_valid_in v (Rep_urrel r (\<omega>\<upsilon> u)) =
+                                       AOT_model_valid_in v (Rep_urrel s (\<omega>\<upsilon> u))\<close>
+
+lemma urrel_\<omega>rel_quot: \<open>Quotient3 AOT_urrel_\<omega>equiv urrel_to_\<omega>rel \<omega>rel_to_urrel\<close>
+proof(rule Quotient3I)
+  show \<open>urrel_to_\<omega>rel (\<omega>rel_to_urrel a) = a\<close> for a
+    unfolding \<omega>rel_to_urrel_def urrel_to_\<omega>rel_def
+    apply (rule ext)
+    apply (subst Abs_urrel_inverse)
+    by (auto simp: AOT_model_proposition_choice_simp)
+next
+  show \<open>AOT_urrel_\<omega>equiv (\<omega>rel_to_urrel a) (\<omega>rel_to_urrel a)\<close> for a
+    unfolding \<omega>rel_to_urrel_def AOT_urrel_\<omega>equiv_def
+    apply (subst (1 2) Abs_urrel_inverse)
+    by (auto simp: AOT_model_proposition_choice_simp)
+next
+  show \<open>AOT_urrel_\<omega>equiv r s = (AOT_urrel_\<omega>equiv r r \<and> AOT_urrel_\<omega>equiv s s \<and>
+                                urrel_to_\<omega>rel r = urrel_to_\<omega>rel s)\<close> for r s
+  proof
+    assume \<open>AOT_urrel_\<omega>equiv r s\<close>
+    hence \<open>AOT_model_valid_in v (Rep_urrel r (\<omega>\<upsilon> u)) =
+           AOT_model_valid_in v (Rep_urrel s (\<omega>\<upsilon> u))\<close> for u v
+      using AOT_urrel_\<omega>equiv_def by metis
+    hence \<open>urrel_to_\<omega>rel r = urrel_to_\<omega>rel s\<close>
+      unfolding urrel_to_\<omega>rel_def
+      by simp
+    thus \<open>AOT_urrel_\<omega>equiv r r \<and> AOT_urrel_\<omega>equiv s s \<and>
+          urrel_to_\<omega>rel r = urrel_to_\<omega>rel s\<close>
+      unfolding AOT_urrel_\<omega>equiv_def
+      by auto
+  next
+    assume \<open>AOT_urrel_\<omega>equiv r r \<and> AOT_urrel_\<omega>equiv s s \<and>
+            urrel_to_\<omega>rel r = urrel_to_\<omega>rel s\<close>
+    hence \<open>AOT_model_valid_in v (Rep_urrel r (\<omega>\<upsilon> u)) =
+           AOT_model_valid_in v (Rep_urrel s (\<omega>\<upsilon> u))\<close> for u v
+      by (metis urrel_to_\<omega>rel_def)
+    thus \<open>AOT_urrel_\<omega>equiv r s\<close>
+      using AOT_urrel_\<omega>equiv_def by presburger
+  qed
+qed
+
+specification (\<alpha>\<sigma>')
+  \<alpha>\<sigma>_eq_ord_exts_all:
+    \<open>\<alpha>\<sigma>' a = \<alpha>\<sigma>' b \<Longrightarrow> (\<And>s . urrel_to_\<omega>rel s = urrel_to_\<omega>rel r \<Longrightarrow> s \<in> a)
+      \<Longrightarrow> (\<And> s . urrel_to_\<omega>rel s = urrel_to_\<omega>rel r \<Longrightarrow> s \<in> b)\<close>
+  \<alpha>\<sigma>_eq_ord_exts_ex:
+    \<open>\<alpha>\<sigma>' a = \<alpha>\<sigma>' b \<Longrightarrow> (\<exists> s . s \<in> a \<and> urrel_to_\<omega>rel s = urrel_to_\<omega>rel r)
+      \<Longrightarrow> (\<exists>s . s \<in> b \<and> urrel_to_\<omega>rel s = urrel_to_\<omega>rel r)\<close>
+proof -
+  define \<alpha>\<sigma>_wit_intersection where
+      \<open>\<alpha>\<sigma>_wit_intersection \<equiv> \<lambda> urrels .
+        {ordext . \<forall>urrel . urrel_to_\<omega>rel urrel = ordext \<longrightarrow> urrel \<in> urrels}\<close>
+  define \<alpha>\<sigma>_wit_union where
+      \<open>\<alpha>\<sigma>_wit_union \<equiv> \<lambda> urrels .
+        {ordext . \<exists>urrel\<in>urrels . urrel_to_\<omega>rel urrel = ordext}\<close>
+
+  let ?\<alpha>\<sigma>_wit = \<open>\<lambda> urrels . 
+    let ordexts = \<alpha>\<sigma>_wit_intersection urrels in
+    let ordexts' = \<alpha>\<sigma>_wit_union urrels in
+    (ordexts, ordexts', undefined)\<close>
+  define \<alpha>\<sigma>_wit :: \<open>urrel set \<Rightarrow> \<sigma>\<close> where
+    \<open>\<alpha>\<sigma>_wit \<equiv> \<lambda> urrels . Abs_\<sigma> (?\<alpha>\<sigma>_wit urrels)\<close>
+  {
+    fix a b :: \<open>urrel set\<close> and r s
+    assume \<open>\<alpha>\<sigma>_wit a = \<alpha>\<sigma>_wit b\<close>
+    hence 0: \<open>{ordext. \<forall>urrel. urrel_to_\<omega>rel urrel = ordext \<longrightarrow> urrel \<in> a} =
+              {ordext. \<forall>urrel. urrel_to_\<omega>rel urrel = ordext \<longrightarrow> urrel \<in> b}\<close>
+      unfolding \<alpha>\<sigma>_wit_def Let_def
+      apply (subst (asm) Abs_\<sigma>_inject)
+      by (auto simp: \<alpha>\<sigma>_wit_intersection_def \<alpha>\<sigma>_wit_union_def)
+    assume \<open>urrel_to_\<omega>rel s = urrel_to_\<omega>rel r \<Longrightarrow> s \<in> a\<close> for s
+    hence \<open>urrel_to_\<omega>rel r \<in>
+           {ordext. \<forall>urrel. urrel_to_\<omega>rel urrel = ordext \<longrightarrow> urrel \<in> a}\<close>
+      by auto
+    hence \<open>urrel_to_\<omega>rel r \<in>
+           {ordext. \<forall>urrel. urrel_to_\<omega>rel urrel = ordext \<longrightarrow> urrel \<in> b}\<close>
+      using 0 by blast
+    moreover assume \<open>urrel_to_\<omega>rel s = urrel_to_\<omega>rel r\<close>
+    ultimately have \<open>s \<in> b\<close>
+      by blast
+  }
+  moreover {
+    fix a b :: \<open>urrel set\<close> and s r
+    assume \<open>\<alpha>\<sigma>_wit a = \<alpha>\<sigma>_wit b\<close>
+    hence 0: \<open>{ordext. \<exists>urrel \<in> a. urrel_to_\<omega>rel urrel = ordext} =
+              {ordext. \<exists>urrel \<in> b. urrel_to_\<omega>rel urrel = ordext}\<close>
+      unfolding \<alpha>\<sigma>_wit_def
+      using Abs_\<sigma>_inject \<alpha>\<sigma>_wit_union_def by auto
+    assume \<open>s \<in> a\<close>
+    hence \<open>urrel_to_\<omega>rel s \<in> {ordext. \<exists>urrel \<in> a. urrel_to_\<omega>rel urrel = ordext}\<close>
+      by blast
+    moreover assume \<open>urrel_to_\<omega>rel s = urrel_to_\<omega>rel r\<close>
+    ultimately have \<open>urrel_to_\<omega>rel r \<in>
+                     {ordext. \<exists>urrel \<in> b. urrel_to_\<omega>rel urrel = ordext}\<close>
+      using "0" by argo
+    hence \<open>\<exists>s. s \<in> b \<and> urrel_to_\<omega>rel s = urrel_to_\<omega>rel r\<close>
+      by blast
+  }
+  ultimately show ?thesis
+    by (safe intro!: exI[where x=\<alpha>\<sigma>_wit]; metis)
+qed
+
+text\<open>We enable the extended model version.\<close>
+abbreviation (input) AOT_ExtendedModel where \<open>AOT_ExtendedModel \<equiv> True\<close>
+
+text\<open>Individual terms are either ordinary objects, represented by ordinary urelements,
+     abstract objects, modelled as sets of urrelations, or null objects, used to
+     represent non-denoting definite descriptions.\<close>
+datatype \<kappa> = \<omega>\<kappa> \<omega> | \<alpha>\<kappa> \<open>urrel set\<close> | is_null\<kappa>: null\<kappa> null
+
+text\<open>The mapping from abstract objects to urelements can be naturally
+     lifted to a surjective mapping from individual terms to urelements.\<close>
+primrec \<kappa>\<upsilon> :: \<open>\<kappa>\<Rightarrow>\<upsilon>\<close> where
+  \<open>\<kappa>\<upsilon> (\<omega>\<kappa> x) = \<omega>\<upsilon> x\<close>
+| \<open>\<kappa>\<upsilon> (\<alpha>\<kappa> x) = \<sigma>\<upsilon> (\<alpha>\<sigma> x)\<close>
+| \<open>\<kappa>\<upsilon> (null\<kappa> x) = null\<upsilon> x\<close>
+
+lemma \<kappa>\<upsilon>_surj: \<open>surj \<kappa>\<upsilon>\<close>
+  using \<alpha>\<sigma>_surj by (metis \<kappa>\<upsilon>.simps(1) \<kappa>\<upsilon>.simps(2) \<kappa>\<upsilon>.simps(3) \<upsilon>.exhaust surj_def)
+
+text\<open>By construction if the urelement of an individual term is exemplified by
+     an urrelation, it cannot be a null-object.\<close>
+lemma urrel_null_false:
+  assumes \<open>AOT_model_valid_in w (Rep_urrel f (\<kappa>\<upsilon> x))\<close>
+  shows \<open>\<not>is_null\<kappa> x\<close>
+  by (metis (mono_tags, lifting) assms Rep_urrel \<kappa>.collapse(3) \<kappa>\<upsilon>.simps(3)
+        mem_Collect_eq)
+
+text\<open>AOT requires any ordinary object to be @{emph \<open>possibly concrete\<close>} and that
+     there is an object that is not actually, but possibly concrete.\<close>
+consts AOT_model_concrete\<omega> :: \<open>\<omega> \<Rightarrow> w \<Rightarrow>  bool\<close>
+specification (AOT_model_concrete\<omega>)
+  AOT_model_\<omega>_concrete_in_some_world:
+  \<open>\<exists> w . AOT_model_concrete\<omega> x w\<close>
+  AOT_model_contingent_object:
+  \<open>\<exists> x w . AOT_model_concrete\<omega> x w \<and> \<not>AOT_model_concrete\<omega> x w\<^sub>0\<close>
+  by (rule exI[where x=\<open>\<lambda>_ w. w \<noteq> w\<^sub>0\<close>]) (auto simp: AOT_model_nonactual_world)
+
+text\<open>We define a type class for AOT's terms specifying the conditions under which
+     objects of that type denote and require the set of denoting terms to be
+     non-empty.\<close>
+class AOT_Term =
+  fixes AOT_model_denotes :: \<open>'a \<Rightarrow> bool\<close>
+  assumes AOT_model_denoting_ex: \<open>\<exists> x . AOT_model_denotes x\<close>
+
+text\<open>All types except the type of propositions involve non-denoting terms. We
+     define a refined type class for those.\<close>
+class AOT_IncompleteTerm = AOT_Term +
+  assumes AOT_model_nondenoting_ex: \<open>\<exists> x . \<not>AOT_model_denotes x\<close>
+
+text\<open>Generic non-denoting term.\<close>
+definition AOT_model_nondenoting :: \<open>'a::AOT_IncompleteTerm\<close> where
+  \<open>AOT_model_nondenoting \<equiv> SOME \<tau> . \<not>AOT_model_denotes \<tau>\<close>
+lemma AOT_model_nondenoing: \<open>\<not>AOT_model_denotes (AOT_model_nondenoting)\<close>
+  using someI_ex[OF AOT_model_nondenoting_ex]
+  unfolding AOT_model_nondenoting_def by blast
+
+text\<open>@{const AOT_model_denotes} can trivially be extended to products of types.\<close>
+instantiation prod :: (AOT_Term, AOT_Term) AOT_Term
+begin
+definition AOT_model_denotes_prod :: \<open>'a\<times>'b \<Rightarrow> bool\<close> where
+  \<open>AOT_model_denotes_prod \<equiv> \<lambda>(x,y) . AOT_model_denotes x \<and> AOT_model_denotes y\<close>
+instance proof
+  show \<open>\<exists>x::'a\<times>'b. AOT_model_denotes x\<close>
+    by (simp add: AOT_model_denotes_prod_def AOT_model_denoting_ex)
+qed
+end
+
+text\<open>We specify a transformation of proposition-valued functions on terms, s.t.
+     the result is fully determined by @{emph \<open>regular\<close>} terms. This will be required
+     for modelling n-ary relations as functions on tuples while preserving AOT's
+     definition of n-ary relation identity.\<close>
+locale AOT_model_irregular_spec =
+  fixes AOT_model_irregular :: \<open>('a \<Rightarrow> \<o>) \<Rightarrow> 'a \<Rightarrow> \<o>\<close>
+    and AOT_model_regular :: \<open>'a \<Rightarrow> bool\<close>
+    and AOT_model_term_equiv :: \<open>'a \<Rightarrow> 'a \<Rightarrow> bool\<close>
+  assumes AOT_model_irregular_false:
+    \<open>\<not>AOT_model_valid_in w (AOT_model_irregular \<phi> x)\<close>
+  assumes AOT_model_irregular_equiv:
+    \<open>AOT_model_term_equiv x y \<Longrightarrow>
+     AOT_model_irregular \<phi> x = AOT_model_irregular \<phi> y\<close>
+  assumes AOT_model_irregular_eqI:
+    \<open>(\<And> x . AOT_model_regular x \<Longrightarrow> \<phi> x = \<psi> x) \<Longrightarrow>
+     AOT_model_irregular \<phi> x = AOT_model_irregular \<psi> x\<close>
+
+text\<open>We introduce a type class for individual terms that specifies being regular,
+     being equivalent (i.e. conceptually @{emph \<open>sharing urelements\<close>}) and the
+     transformation on proposition-valued functions as specified above.\<close>
+class AOT_IndividualTerm = AOT_IncompleteTerm +
+  fixes AOT_model_regular :: \<open>'a \<Rightarrow> bool\<close>
+  fixes AOT_model_term_equiv :: \<open>'a \<Rightarrow> 'a \<Rightarrow> bool\<close>
+  fixes AOT_model_irregular :: \<open>('a \<Rightarrow> \<o>) \<Rightarrow> 'a \<Rightarrow> \<o>\<close>
+  assumes AOT_model_irregular_nondenoting:
+    \<open>\<not>AOT_model_regular x \<Longrightarrow> \<not>AOT_model_denotes x\<close>
+  assumes AOT_model_term_equiv_part_equivp:
+    \<open>equivp AOT_model_term_equiv\<close>
+  assumes AOT_model_term_equiv_denotes:
+    \<open>AOT_model_term_equiv x y \<Longrightarrow> (AOT_model_denotes x = AOT_model_denotes y)\<close>
+  assumes AOT_model_term_equiv_regular:
+    \<open>AOT_model_term_equiv x y \<Longrightarrow> (AOT_model_regular x = AOT_model_regular y)\<close>
+  assumes AOT_model_irregular:
+    \<open>AOT_model_irregular_spec AOT_model_irregular AOT_model_regular
+                              AOT_model_term_equiv\<close>
+
+interpretation AOT_model_irregular_spec AOT_model_irregular AOT_model_regular
+                                        AOT_model_term_equiv
+  using AOT_model_irregular .
+
+text\<open>Our concrete type for individual terms satisfies the type class of
+     individual terms.
+     Note that all unary individuals are regular. In general, an individual term
+     may be a tuple and is regular, if at most one tuple element does not denote.\<close>
+instantiation \<kappa> :: AOT_IndividualTerm
+begin
+definition AOT_model_term_equiv_\<kappa> :: \<open>\<kappa> \<Rightarrow> \<kappa> \<Rightarrow> bool\<close> where
+  \<open>AOT_model_term_equiv_\<kappa> \<equiv> \<lambda> x y . \<kappa>\<upsilon> x = \<kappa>\<upsilon> y\<close>
+definition AOT_model_denotes_\<kappa> :: \<open>\<kappa> \<Rightarrow> bool\<close> where
+  \<open>AOT_model_denotes_\<kappa> \<equiv> \<lambda> x . \<not>is_null\<kappa> x\<close>
+definition AOT_model_regular_\<kappa> :: \<open>\<kappa> \<Rightarrow> bool\<close> where
+  \<open>AOT_model_regular_\<kappa> \<equiv> \<lambda> x . True\<close>
+definition AOT_model_irregular_\<kappa> :: \<open>(\<kappa> \<Rightarrow> \<o>) \<Rightarrow> \<kappa> \<Rightarrow> \<o>\<close> where
+  \<open>AOT_model_irregular_\<kappa> \<equiv> SOME \<phi> . AOT_model_irregular_spec \<phi>
+                                        AOT_model_regular AOT_model_term_equiv\<close>
+instance proof
+  show \<open>\<exists>x :: \<kappa>. AOT_model_denotes x\<close>
+    by (rule exI[where x=\<open>\<omega>\<kappa> undefined\<close>])
+       (simp add: AOT_model_denotes_\<kappa>_def)
+next
+  show \<open>\<exists>x :: \<kappa>. \<not>AOT_model_denotes x\<close>
+    by (rule exI[where x=\<open>null\<kappa> undefined\<close>])
+       (simp add: AOT_model_denotes_\<kappa>_def AOT_model_regular_\<kappa>_def)
+next
+  show "\<not>AOT_model_regular x \<Longrightarrow> \<not> AOT_model_denotes x" for x :: \<kappa>
+    by (simp add: AOT_model_regular_\<kappa>_def)
+next
+  show \<open>equivp (AOT_model_term_equiv :: \<kappa> \<Rightarrow> \<kappa> \<Rightarrow> bool)\<close>
+    by (rule equivpI; rule reflpI exI sympI transpI)
+       (simp_all add: AOT_model_term_equiv_\<kappa>_def)
+next
+  fix x y :: \<kappa>
+  show \<open>AOT_model_term_equiv x y \<Longrightarrow> AOT_model_denotes x = AOT_model_denotes y\<close>
+    by (metis AOT_model_denotes_\<kappa>_def AOT_model_term_equiv_\<kappa>_def \<kappa>.exhaust_disc
+              \<kappa>\<upsilon>.simps \<upsilon>.disc(1,3,5,6) is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def is_null\<kappa>_def)
+next
+  fix x y :: \<kappa>
+  show \<open>AOT_model_term_equiv x y \<Longrightarrow> AOT_model_regular x = AOT_model_regular y\<close>
+    by (simp add: AOT_model_regular_\<kappa>_def)
+next
+  have "AOT_model_irregular_spec (\<lambda> \<phi> (x::\<kappa>) .  \<epsilon>\<^sub>\<o> w . False)
+          AOT_model_regular AOT_model_term_equiv"
+    by standard (auto simp: AOT_model_proposition_choice_simp)
+  thus \<open>AOT_model_irregular_spec (AOT_model_irregular::(\<kappa>\<Rightarrow>\<o>) \<Rightarrow> \<kappa> \<Rightarrow> \<o>)
+          AOT_model_regular AOT_model_term_equiv\<close>
+    unfolding AOT_model_irregular_\<kappa>_def by (metis (no_types, lifting) someI_ex)
+qed
+end
+
+text\<open>We define relations among individuals as proposition valued functions.
+     @{emph \<open>Denoting\<close>} unary relations (among @{typ \<kappa>}) will match the
+     urrelations introduced above.\<close>
+typedef 'a rel (\<open><_>\<close>) = \<open>UNIV::('a::AOT_IndividualTerm \<Rightarrow> \<o>) set\<close> ..
+setup_lifting type_definition_rel
+
+text\<open>We will use the transformation specified above to "fix" the behaviour of
+     functions on irregular terms when defining @{text \<open>\<lambda>\<close>}-expressions.\<close>
+definition fix_irregular :: \<open>('a::AOT_IndividualTerm \<Rightarrow> \<o>) \<Rightarrow> ('a \<Rightarrow> \<o>)\<close> where
+  \<open>fix_irregular \<equiv> \<lambda> \<phi> x . if AOT_model_regular x
+                            then \<phi> x else AOT_model_irregular \<phi> x\<close>
+lemma fix_irregular_denoting:
+  \<open>AOT_model_denotes x \<Longrightarrow> fix_irregular \<phi> x = \<phi> x\<close>
+  by (meson AOT_model_irregular_nondenoting fix_irregular_def)
+lemma fix_irregular_regular:
+  \<open>AOT_model_regular x \<Longrightarrow> fix_irregular \<phi> x = \<phi> x\<close>
+  by (meson AOT_model_irregular_nondenoting fix_irregular_def)
+lemma fix_irregular_irregular:
+  \<open>\<not>AOT_model_regular x \<Longrightarrow> fix_irregular \<phi> x = AOT_model_irregular \<phi> x\<close>
+  by (simp add: fix_irregular_def)
+
+text\<open>Relations among individual terms are (potentially non-denoting) terms.
+     A relation denotes, if it agrees on all equivalent terms (i.e. terms sharing
+     urelements), is necessarily false on all non-denoting terms and is
+     well-behaved on irregular terms.\<close>
+instantiation rel :: (AOT_IndividualTerm) AOT_IncompleteTerm
+begin
+text\<open>\linelabel{AOT_model_denotes_rel}\<close>
+lift_definition AOT_model_denotes_rel :: \<open><'a> \<Rightarrow> bool\<close> is
+  \<open>\<lambda> \<phi> . (\<forall> x y . AOT_model_term_equiv x y \<longrightarrow> \<phi> x = \<phi> y) \<and>
+         (\<forall> w x . AOT_model_valid_in w (\<phi> x) \<longrightarrow> AOT_model_denotes x) \<and>
+         (\<forall> x . \<not>AOT_model_regular x \<longrightarrow> \<phi> x = AOT_model_irregular \<phi> x)\<close> .
+instance proof
+  have \<open>AOT_model_irregular (fix_irregular \<phi>) x = AOT_model_irregular \<phi> x\<close>
+    for \<phi> and x :: 'a
+    by (rule AOT_model_irregular_eqI) (simp add: fix_irregular_def)
+  thus \<open>\<exists> x :: <'a> . AOT_model_denotes x\<close>
+    by (safe intro!: exI[where x=\<open>Abs_rel (fix_irregular (\<lambda>x. \<epsilon>\<^sub>\<o> w . False))\<close>])
+       (transfer; auto simp: AOT_model_proposition_choice_simp fix_irregular_def
+                             AOT_model_irregular_equiv AOT_model_term_equiv_regular
+                             AOT_model_irregular_false)
+next
+  show \<open>\<exists>f :: <'a> . \<not>AOT_model_denotes f\<close>
+    by (rule exI[where x=\<open>Abs_rel (\<lambda>x. \<epsilon>\<^sub>\<o> w . True)\<close>];
+        auto simp: AOT_model_denotes_rel.abs_eq AOT_model_nondenoting_ex
+                   AOT_model_proposition_choice_simp)
+qed
+end
+
+text\<open>Auxiliary lemmata.\<close>
+
+lemma AOT_model_term_equiv_eps:
+  shows \<open>AOT_model_term_equiv (Eps (AOT_model_term_equiv \<kappa>)) \<kappa>\<close>
+    and \<open>AOT_model_term_equiv \<kappa> (Eps (AOT_model_term_equiv \<kappa>))\<close>
+    and \<open>AOT_model_term_equiv \<kappa> \<kappa>' \<Longrightarrow>
+         (Eps (AOT_model_term_equiv \<kappa>)) = (Eps (AOT_model_term_equiv \<kappa>'))\<close>
+  apply (metis AOT_model_term_equiv_part_equivp equivp_def someI_ex)
+  apply (metis AOT_model_term_equiv_part_equivp equivp_def someI_ex)
+  by (metis AOT_model_term_equiv_part_equivp equivp_def)
+
+lemma AOT_model_denotes_Abs_rel_fix_irregularI:
+  assumes \<open>\<And> x y . AOT_model_term_equiv x y \<Longrightarrow> \<phi> x = \<phi> y\<close>
+      and \<open>\<And> w x . AOT_model_valid_in w (\<phi> x) \<Longrightarrow> AOT_model_denotes x\<close>
+    shows \<open>AOT_model_denotes (Abs_rel (fix_irregular \<phi>))\<close>
+proof -
+  have \<open>AOT_model_irregular \<phi> x = AOT_model_irregular
+          (\<lambda>x. if AOT_model_regular x then \<phi> x else AOT_model_irregular \<phi> x) x\<close>
+    if \<open>\<not> AOT_model_regular x\<close>
+    for x
+    by (rule AOT_model_irregular_eqI) auto
+  thus ?thesis
+  unfolding AOT_model_denotes_rel.rep_eq
+  using assms by (auto simp: AOT_model_irregular_false Abs_rel_inverse
+                             AOT_model_irregular_equiv fix_irregular_def
+                             AOT_model_term_equiv_regular)
+qed
+
+lemma AOT_model_term_equiv_rel_equiv:
+  assumes \<open>AOT_model_denotes x\<close>
+      and \<open>AOT_model_denotes y\<close>
+    shows \<open>AOT_model_term_equiv x y = (\<forall> \<Pi> w . AOT_model_denotes \<Pi> \<longrightarrow>
+            AOT_model_valid_in w (Rep_rel \<Pi> x) = AOT_model_valid_in w (Rep_rel \<Pi> y))\<close>
+proof
+  assume \<open>AOT_model_term_equiv x y\<close>
+  thus \<open>\<forall> \<Pi> w . AOT_model_denotes \<Pi> \<longrightarrow> AOT_model_valid_in w (Rep_rel \<Pi> x) =
+                                         AOT_model_valid_in w (Rep_rel \<Pi> y)\<close>
+    by (simp add: AOT_model_denotes_rel.rep_eq)
+next
+  have 0: \<open>(AOT_model_denotes x' \<and> AOT_model_term_equiv x' y) =
+           (AOT_model_denotes y' \<and> AOT_model_term_equiv y' y)\<close>
+    if \<open>AOT_model_term_equiv x' y'\<close> for x' y'
+    by (metis that AOT_model_term_equiv_denotes AOT_model_term_equiv_part_equivp
+              equivp_def)
+  assume \<open>\<forall> \<Pi> w . AOT_model_denotes \<Pi> \<longrightarrow> AOT_model_valid_in w (Rep_rel \<Pi> x) =
+                                           AOT_model_valid_in w (Rep_rel \<Pi> y)\<close>
+  moreover have \<open>AOT_model_denotes (Abs_rel (fix_irregular
+    (\<lambda> x . \<epsilon>\<^sub>\<o> w . AOT_model_denotes x \<and> AOT_model_term_equiv x y)))\<close>
+    (is "AOT_model_denotes ?r")
+    by (rule AOT_model_denotes_Abs_rel_fix_irregularI)
+       (auto simp: 0 AOT_model_denotes_rel.rep_eq Abs_rel_inverse fix_irregular_def
+                   AOT_model_proposition_choice_simp AOT_model_irregular_false)
+  ultimately have \<open>AOT_model_valid_in w (Rep_rel ?r x) =
+                   AOT_model_valid_in w (Rep_rel ?r y)\<close> for w
+    by blast
+  thus \<open>AOT_model_term_equiv x y\<close>
+    by (simp add: Abs_rel_inverse AOT_model_proposition_choice_simp
+                  fix_irregular_denoting[OF assms(1)] AOT_model_term_equiv_part_equivp
+                  fix_irregular_denoting[OF assms(2)] assms equivp_reflp)
+qed
+
+text\<open>Denoting relations among terms of type @{typ \<kappa>} correspond to urrelations.\<close>
+
+definition rel_to_urrel :: \<open><\<kappa>> \<Rightarrow> urrel\<close> where
+  \<open>rel_to_urrel \<equiv> \<lambda> \<Pi> . Abs_urrel (\<lambda> u . Rep_rel \<Pi> (SOME x . \<kappa>\<upsilon> x = u))\<close>
+definition urrel_to_rel :: \<open>urrel \<Rightarrow> <\<kappa>>\<close> where
+  \<open>urrel_to_rel \<equiv> \<lambda> \<phi> . Abs_rel (\<lambda> x . Rep_urrel \<phi> (\<kappa>\<upsilon> x))\<close>
+definition AOT_rel_equiv :: \<open><'a::AOT_IndividualTerm> \<Rightarrow> <'a> \<Rightarrow> bool\<close> where
+  \<open>AOT_rel_equiv \<equiv> \<lambda> f g . AOT_model_denotes f \<and> AOT_model_denotes g \<and> f = g\<close>
+
+lemma urrel_quotient3: \<open>Quotient3 AOT_rel_equiv rel_to_urrel urrel_to_rel\<close>
+proof (rule Quotient3I)
+  have \<open>(\<lambda>u. Rep_urrel a (\<kappa>\<upsilon> (SOME x. \<kappa>\<upsilon> x = u))) = (\<lambda>u. Rep_urrel a u)\<close> for a
+    by (rule ext) (metis (mono_tags, lifting) \<kappa>\<upsilon>_surj surj_f_inv_f verit_sko_ex')
+  thus \<open>rel_to_urrel (urrel_to_rel a) = a\<close> for a
+    by (simp add: Abs_rel_inverse rel_to_urrel_def urrel_to_rel_def
+                  Rep_urrel_inverse)
+next
+  show \<open>AOT_rel_equiv (urrel_to_rel a) (urrel_to_rel a)\<close> for a
+    unfolding AOT_rel_equiv_def urrel_to_rel_def
+    by transfer (simp add: AOT_model_regular_\<kappa>_def AOT_model_denotes_\<kappa>_def
+                           AOT_model_term_equiv_\<kappa>_def urrel_null_false)
+next
+  {
+    fix a
+    assume \<open>\<forall>w x. AOT_model_valid_in w (a x) \<longrightarrow> \<not> is_null\<kappa> x\<close>
+    hence \<open>(\<lambda>u. a (SOME x. \<kappa>\<upsilon> x = u)) \<in>
+           {\<phi>. \<forall>x w. \<not> AOT_model_valid_in w (\<phi> (null\<upsilon> x))}\<close>
+      by (simp; metis (mono_tags, lifting) \<kappa>.exhaust_disc \<kappa>\<upsilon>.simps \<upsilon>.disc(1,3,5)
+                                           \<upsilon>.disc(6) is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def someI_ex)
+  } note 1 = this
+  {
+    fix r s :: \<open>\<kappa> \<Rightarrow> \<o>\<close>
+    assume A: \<open>\<forall>x y. AOT_model_term_equiv x y \<longrightarrow> r x = r y\<close>
+    assume \<open>\<forall>w x. AOT_model_valid_in w (r x) \<longrightarrow> AOT_model_denotes x\<close>
+    hence 2: \<open>(\<lambda>u. r (SOME x. \<kappa>\<upsilon> x = u)) \<in>
+              {\<phi>. \<forall>x w. \<not> AOT_model_valid_in w (\<phi> (null\<upsilon> x))}\<close>
+      using 1 AOT_model_denotes_\<kappa>_def by meson
+    assume B: \<open>\<forall>x y. AOT_model_term_equiv x y \<longrightarrow> s x = s y\<close>
+    assume \<open>\<forall>w x. AOT_model_valid_in w (s x) \<longrightarrow> AOT_model_denotes x\<close>
+    hence 3: \<open>(\<lambda>u. s (SOME x. \<kappa>\<upsilon> x = u)) \<in>
+              {\<phi>. \<forall>x w. \<not> AOT_model_valid_in w (\<phi> (null\<upsilon> x))}\<close>
+      using 1 AOT_model_denotes_\<kappa>_def by meson
+    assume \<open>Abs_urrel (\<lambda>u. r (SOME x. \<kappa>\<upsilon> x = u)) =
+            Abs_urrel (\<lambda>u. s (SOME x. \<kappa>\<upsilon> x = u))\<close>
+    hence 4: \<open>r (SOME x. \<kappa>\<upsilon> x = u) = s (SOME x::\<kappa>. \<kappa>\<upsilon> x = u)\<close> for u
+      unfolding Abs_urrel_inject[OF 2 3] by metis
+    have \<open>r x = s x\<close> for x
+      using 4[of \<open>\<kappa>\<upsilon> x\<close>]
+      by (metis (mono_tags, lifting) A B AOT_model_term_equiv_\<kappa>_def someI_ex)
+    hence \<open>r = s\<close> by auto
+  } 
+  thus \<open>AOT_rel_equiv r s = (AOT_rel_equiv r r \<and> AOT_rel_equiv s s \<and>
+                             rel_to_urrel r = rel_to_urrel s)\<close> for r s
+    unfolding AOT_rel_equiv_def rel_to_urrel_def
+    by transfer auto
+qed
+
+lemma urrel_quotient:
+  \<open>Quotient AOT_rel_equiv rel_to_urrel urrel_to_rel
+            (\<lambda>x y. AOT_rel_equiv x x \<and> rel_to_urrel x = y)\<close>
+  using Quotient3_to_Quotient[OF urrel_quotient3] by auto
+
+text\<open>Unary individual terms are always regular and equipped with encoding and
+     concreteness. The specification of the type class anticipates the required
+     properties for deriving the axiom system.\<close>
+class AOT_UnaryIndividualTerm =
+  fixes AOT_model_enc :: \<open>'a \<Rightarrow> <'a::AOT_IndividualTerm> \<Rightarrow> bool\<close>
+    and AOT_model_concrete :: \<open>w \<Rightarrow> 'a \<Rightarrow> bool\<close>
+  assumes AOT_model_unary_regular:
+      \<open>AOT_model_regular x\<close> \<comment> \<open>All unary individual terms are regular.\<close>
+      and AOT_model_enc_relid:
+        \<open>AOT_model_denotes F \<Longrightarrow>
+         AOT_model_denotes G \<Longrightarrow>
+         (\<And> x . AOT_model_enc x F \<longleftrightarrow> AOT_model_enc x G)
+         \<Longrightarrow> F = G\<close>
+      and AOT_model_A_objects:
+        \<open>\<exists>x . AOT_model_denotes x \<and>
+              (\<forall>w. \<not> AOT_model_concrete w x) \<and>
+              (\<forall>F. AOT_model_denotes F \<longrightarrow> AOT_model_enc x F = \<phi> F)\<close>
+      and AOT_model_contingent:
+        \<open>\<exists> x w. AOT_model_concrete w x \<and> \<not> AOT_model_concrete w\<^sub>0 x\<close>
+      and AOT_model_nocoder:
+        \<open>AOT_model_concrete w x \<Longrightarrow> \<not>AOT_model_enc x F\<close>
+      and AOT_model_concrete_equiv:
+        \<open>AOT_model_term_equiv x y \<Longrightarrow>
+          AOT_model_concrete w x = AOT_model_concrete w y\<close>
+      and AOT_model_concrete_denotes:
+        \<open>AOT_model_concrete w x \<Longrightarrow> AOT_model_denotes x\<close>
+      \<comment> \<open>The following are properties that will only hold in the extended models.\<close>
+      and AOT_model_enc_indistinguishable_all:
+       \<open>AOT_ExtendedModel \<Longrightarrow>
+        AOT_model_denotes a \<Longrightarrow> \<not>(\<exists> w . AOT_model_concrete w a) \<Longrightarrow>
+        AOT_model_denotes b \<Longrightarrow> \<not>(\<exists> w . AOT_model_concrete w b) \<Longrightarrow>
+        AOT_model_denotes \<Pi> \<Longrightarrow>
+        (\<And> \<Pi>' . AOT_model_denotes \<Pi>' \<Longrightarrow>
+          (\<And> v . AOT_model_valid_in v (Rep_rel \<Pi>' a) =
+                 AOT_model_valid_in v (Rep_rel \<Pi>' b))) \<Longrightarrow>
+        (\<And> \<Pi>' . AOT_model_denotes \<Pi>' \<Longrightarrow>
+            (\<And> v x . \<exists> w . AOT_model_concrete w x \<Longrightarrow>
+                AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                AOT_model_valid_in v (Rep_rel \<Pi> x)) \<Longrightarrow>
+            AOT_model_enc a \<Pi>') \<Longrightarrow>
+        (\<And> \<Pi>' . AOT_model_denotes \<Pi>' \<Longrightarrow>
+            (\<And> v x . \<exists> w . AOT_model_concrete w x \<Longrightarrow>
+                AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                AOT_model_valid_in v (Rep_rel \<Pi> x)) \<Longrightarrow>
+            AOT_model_enc b \<Pi>')\<close>
+      and AOT_model_enc_indistinguishable_ex:
+       \<open>AOT_ExtendedModel \<Longrightarrow>
+        AOT_model_denotes a \<Longrightarrow> \<not>(\<exists> w . AOT_model_concrete w a) \<Longrightarrow>
+        AOT_model_denotes b \<Longrightarrow> \<not>(\<exists> w . AOT_model_concrete w b) \<Longrightarrow>
+        AOT_model_denotes \<Pi> \<Longrightarrow>
+        (\<And> \<Pi>' . AOT_model_denotes \<Pi>' \<Longrightarrow>
+          (\<And> v . AOT_model_valid_in v (Rep_rel \<Pi>' a) =
+                 AOT_model_valid_in v (Rep_rel \<Pi>' b))) \<Longrightarrow>
+        (\<exists> \<Pi>' . AOT_model_denotes \<Pi>' \<and> AOT_model_enc a \<Pi>' \<and>
+            (\<forall> v x . (\<exists> w . AOT_model_concrete w x) \<longrightarrow>
+                AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                AOT_model_valid_in v (Rep_rel \<Pi> x))) \<Longrightarrow>
+        (\<exists> \<Pi>' . AOT_model_denotes \<Pi>' \<and> AOT_model_enc b \<Pi>' \<and>
+            (\<forall> v x . (\<exists> w . AOT_model_concrete w x) \<longrightarrow>
+                AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                AOT_model_valid_in v (Rep_rel \<Pi> x)))\<close>
+
+text\<open>Instantiate the class of unary individual terms for our concrete type of
+     individual terms @{typ \<kappa>}.\<close>
+instantiation \<kappa> :: AOT_UnaryIndividualTerm
+begin                          
+
+definition AOT_model_enc_\<kappa> :: \<open>\<kappa> \<Rightarrow> <\<kappa>> \<Rightarrow> bool\<close> where
+  \<open>AOT_model_enc_\<kappa> \<equiv> \<lambda> x F .
+      case x of \<alpha>\<kappa> a \<Rightarrow> AOT_model_denotes F \<and> rel_to_urrel F \<in> a
+              | _ \<Rightarrow> False\<close>
+primrec AOT_model_concrete_\<kappa> :: \<open>w \<Rightarrow> \<kappa> \<Rightarrow> bool\<close> where
+  \<open>AOT_model_concrete_\<kappa> w (\<omega>\<kappa> x) = AOT_model_concrete\<omega> x w\<close>
+| \<open>AOT_model_concrete_\<kappa> w (\<alpha>\<kappa> x) = False\<close>
+| \<open>AOT_model_concrete_\<kappa> w (null\<kappa> x) = False\<close>
+
+lemma AOT_meta_A_objects_\<kappa>:
+  \<open>\<exists>x :: \<kappa>. AOT_model_denotes x \<and>
+            (\<forall>w. \<not> AOT_model_concrete w x) \<and>
+            (\<forall>F. AOT_model_denotes F \<longrightarrow> AOT_model_enc x F = \<phi> F)\<close> for \<phi>
+  apply (rule exI[where x=\<open>\<alpha>\<kappa> {f . \<phi> (urrel_to_rel f)}\<close>])
+  apply (simp add: AOT_model_enc_\<kappa>_def AOT_model_denotes_\<kappa>_def)
+  by (metis (no_types, lifting) AOT_rel_equiv_def urrel_quotient
+                                Quotient_rep_abs_fold_unmap)
+
+instance proof
+  show \<open>AOT_model_regular x\<close> for x :: \<kappa>
+    by (simp add: AOT_model_regular_\<kappa>_def)
+next
+  fix F G :: \<open><\<kappa>>\<close>
+  assume \<open>AOT_model_denotes F\<close>
+  moreover assume \<open>AOT_model_denotes G\<close>
+  moreover assume \<open>\<And>x. AOT_model_enc x F = AOT_model_enc x G\<close>
+  moreover obtain x where \<open>\<forall>G. AOT_model_denotes G \<longrightarrow> AOT_model_enc x G = (F = G)\<close>
+    using AOT_meta_A_objects_\<kappa> by blast
+  ultimately show \<open>F = G\<close> by blast
+next
+  show \<open>\<exists>x :: \<kappa>. AOT_model_denotes x \<and>
+                 (\<forall>w. \<not> AOT_model_concrete w x) \<and>
+                 (\<forall>F. AOT_model_denotes F \<longrightarrow> AOT_model_enc x F = \<phi> F)\<close> for \<phi>
+    using AOT_meta_A_objects_\<kappa> .
+next
+  show \<open>\<exists> (x::\<kappa>) w. AOT_model_concrete w x \<and> \<not> AOT_model_concrete w\<^sub>0 x\<close>
+    using AOT_model_concrete_\<kappa>.simps(1) AOT_model_contingent_object by blast
+next
+  show \<open>AOT_model_concrete w x \<Longrightarrow> \<not> AOT_model_enc x F\<close> for w and x :: \<kappa> and F
+    by (metis AOT_model_concrete_\<kappa>.simps(2) AOT_model_enc_\<kappa>_def \<kappa>.case_eq_if
+              \<kappa>.collapse(2))
+next
+  show \<open>AOT_model_concrete w x = AOT_model_concrete w y\<close>
+    if \<open>AOT_model_term_equiv x y\<close>
+    for x y :: \<kappa> and w
+    using that by (induct x; induct y; auto simp: AOT_model_term_equiv_\<kappa>_def)
+next
+  show \<open>AOT_model_concrete w x \<Longrightarrow> AOT_model_denotes x\<close> for w and x :: \<kappa>
+    by (metis AOT_model_concrete_\<kappa>.simps(3) AOT_model_denotes_\<kappa>_def \<kappa>.collapse(3))
+(* Extended models only *)
+next
+  fix \<kappa> \<kappa>' :: \<kappa> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close> and w :: w
+  assume ext: \<open>AOT_ExtendedModel\<close>
+  assume \<open>AOT_model_denotes \<kappa>\<close>
+  moreover assume \<open>\<nexists>w. AOT_model_concrete w \<kappa>\<close>
+  ultimately obtain a where a_def: \<open>\<alpha>\<kappa> a = \<kappa>\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def \<kappa>.discI(3) \<kappa>.exhaust_sel)
+  assume \<open>AOT_model_denotes \<kappa>'\<close>
+  moreover assume \<open>\<nexists>w. AOT_model_concrete w \<kappa>'\<close>
+  ultimately obtain b where b_def: \<open>\<alpha>\<kappa> b = \<kappa>'\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def \<kappa>.discI(3) \<kappa>.exhaust_sel)
+  assume \<open>AOT_model_denotes \<Pi>' \<Longrightarrow> AOT_model_valid_in w (Rep_rel \<Pi>' \<kappa>) =
+                                   AOT_model_valid_in w (Rep_rel \<Pi>' \<kappa>')\<close> for \<Pi>' w
+  hence \<open>AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>)) =
+         AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>'))\<close> for r
+    by (metis AOT_rel_equiv_def Abs_rel_inverse Quotient3_rel_rep
+              iso_tuple_UNIV_I urrel_quotient3 urrel_to_rel_def)
+  hence \<open>let r = (Abs_urrel (\<lambda> u . \<epsilon>\<^sub>\<o> w . u = \<kappa>\<upsilon> \<kappa>)) in
+         AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>)) =
+         AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>'))\<close>
+    by presburger
+  hence \<alpha>\<sigma>_eq: \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
+    unfolding Let_def
+    apply (subst (asm) (1 2) Abs_urrel_inverse)
+    using AOT_model_proposition_choice_simp a_def b_def by force+
+  assume \<Pi>_den: \<open>AOT_model_denotes \<Pi>\<close>
+  have \<open>\<not>AOT_model_valid_in w (Rep_rel \<Pi> (SOME xa. \<kappa>\<upsilon> xa = null\<upsilon> x))\<close> for x w
+    by (metis (mono_tags, lifting) AOT_model_denotes_\<kappa>_def
+              AOT_model_denotes_rel.rep_eq \<kappa>.exhaust_disc \<kappa>\<upsilon>.simps(1,2,3)
+              \<open>AOT_model_denotes \<Pi>\<close> \<upsilon>.disc(8,9) \<upsilon>.distinct(3)
+              is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def verit_sko_ex')
+  moreover have \<open>Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_rel \<Pi> (SOME y. \<kappa>\<upsilon> y = \<omega>\<upsilon> x)\<close> for x
+    by (metis (mono_tags, lifting) AOT_model_denotes_rel.rep_eq
+          AOT_model_term_equiv_\<kappa>_def \<kappa>\<upsilon>.simps(1) \<Pi>_den verit_sko_ex')
+  ultimately have \<open>Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_urrel (rel_to_urrel \<Pi>) (\<omega>\<upsilon> x)\<close> for x
+    unfolding rel_to_urrel_def
+    by (subst Abs_urrel_inverse) auto
+  hence \<open>\<exists>r . \<forall> x . Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_urrel r (\<omega>\<upsilon> x)\<close>
+    by (auto intro!: exI[where x=\<open>rel_to_urrel \<Pi>\<close>])
+  then obtain r where r_prop: \<open>Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_urrel r (\<omega>\<upsilon> x)\<close> for x
+    by blast
+  assume \<open>AOT_model_denotes \<Pi>' \<Longrightarrow>
+    (\<And>v x. \<exists>w. AOT_model_concrete w x \<Longrightarrow>
+        AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+        AOT_model_valid_in v (Rep_rel \<Pi> x)) \<Longrightarrow> AOT_model_enc \<kappa> \<Pi>'\<close> for \<Pi>'
+  hence \<open>AOT_model_denotes \<Pi>' \<Longrightarrow>
+    (\<And>v x. AOT_model_valid_in v (Rep_rel \<Pi>' (\<omega>\<kappa> x)) =
+            AOT_model_valid_in v (Rep_rel \<Pi> (\<omega>\<kappa> x))) \<Longrightarrow> AOT_model_enc \<kappa> \<Pi>'\<close> for \<Pi>'
+    by (metis AOT_model_concrete_\<kappa>.simps(2) AOT_model_concrete_\<kappa>.simps(3)
+              \<kappa>.exhaust_disc is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def is_null\<kappa>_def)
+  hence \<open>(\<And>v x. AOT_model_valid_in v (Rep_urrel r (\<omega>\<upsilon> x)) =
+                 AOT_model_valid_in v (Rep_rel \<Pi> (\<omega>\<kappa> x))) \<Longrightarrow> r \<in> a\<close> for r
+    unfolding a_def[symmetric] AOT_model_enc_\<kappa>_def apply simp
+    by (smt (verit, best) AOT_rel_equiv_def Abs_rel_inverse Quotient3_def
+            \<kappa>\<upsilon>.simps(1) iso_tuple_UNIV_I urrel_quotient3 urrel_to_rel_def)
+  hence \<open>(\<And>v x. AOT_model_valid_in v (Rep_urrel r' (\<omega>\<upsilon> x)) =
+                 AOT_model_valid_in v (Rep_urrel r (\<omega>\<upsilon> x))) \<Longrightarrow> r' \<in> a\<close> for r'
+    unfolding r_prop.
+  hence \<open>\<And>s. urrel_to_\<omega>rel s = urrel_to_\<omega>rel r \<Longrightarrow> s \<in> a\<close>
+    by (metis urrel_to_\<omega>rel_def)
+  hence 0: \<open>\<And>s. urrel_to_\<omega>rel s = urrel_to_\<omega>rel r \<Longrightarrow> s \<in> b\<close>
+    using \<alpha>\<sigma>_eq_ord_exts_all \<alpha>\<sigma>_eq ext \<alpha>\<sigma>_\<alpha>\<sigma>' by blast
+
+  assume \<Pi>'_den: \<open>AOT_model_denotes \<Pi>'\<close>
+  assume \<open>\<exists>w. AOT_model_concrete w x \<Longrightarrow> AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                                         AOT_model_valid_in v (Rep_rel \<Pi> x)\<close> for v x
+  hence \<open>AOT_model_valid_in v (Rep_rel \<Pi>' (\<omega>\<kappa> x)) =
+         AOT_model_valid_in v (Rep_rel \<Pi> (\<omega>\<kappa> x))\<close> for v x
+    using AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+    by presburger
+  hence \<open>AOT_model_valid_in v (Rep_urrel (rel_to_urrel \<Pi>') (\<omega>\<upsilon> x)) =
+         AOT_model_valid_in v (Rep_urrel r (\<omega>\<upsilon> x))\<close> for v x
+    by (smt (verit, best) AOT_rel_equiv_def Abs_rel_inverse Quotient3_def
+          \<kappa>\<upsilon>.simps(1) iso_tuple_UNIV_I r_prop urrel_quotient3 urrel_to_rel_def \<Pi>'_den)
+  hence \<open>urrel_to_\<omega>rel (rel_to_urrel \<Pi>') = urrel_to_\<omega>rel r\<close>
+    by (metis (full_types) AOT_urrel_\<omega>equiv_def Quotient3_def urrel_\<omega>rel_quot)
+  hence \<open>rel_to_urrel \<Pi>' \<in> b\<close> using 0 by blast
+  thus \<open>AOT_model_enc \<kappa>' \<Pi>'\<close>
+    unfolding b_def[symmetric] AOT_model_enc_\<kappa>_def by (auto simp: \<Pi>'_den)
+next
+  fix \<kappa> \<kappa>' :: \<kappa> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close> and w :: w
+  assume ext: \<open>AOT_ExtendedModel\<close>
+  assume \<open>AOT_model_denotes \<kappa>\<close>
+  moreover assume \<open>\<nexists>w. AOT_model_concrete w \<kappa>\<close>
+  ultimately obtain a where a_def: \<open>\<alpha>\<kappa> a = \<kappa>\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+          AOT_model_denotes_\<kappa>_def \<kappa>.discI(3) \<kappa>.exhaust_sel)
+  assume \<open>AOT_model_denotes \<kappa>'\<close>
+  moreover assume \<open>\<nexists>w. AOT_model_concrete w \<kappa>'\<close>
+  ultimately obtain b where b_def: \<open>\<alpha>\<kappa> b = \<kappa>'\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def \<kappa>.discI(3) \<kappa>.exhaust_sel)
+  assume \<open>AOT_model_denotes \<Pi>' \<Longrightarrow> AOT_model_valid_in w (Rep_rel \<Pi>' \<kappa>) =
+                                   AOT_model_valid_in w (Rep_rel \<Pi>' \<kappa>')\<close> for \<Pi>' w
+  hence \<open>AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>)) =
+         AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>'))\<close> for r
+    by (metis AOT_rel_equiv_def Abs_rel_inverse Quotient3_rel_rep
+              iso_tuple_UNIV_I urrel_quotient3 urrel_to_rel_def)
+  hence \<open>let r = (Abs_urrel (\<lambda> u . \<epsilon>\<^sub>\<o> w . u = \<kappa>\<upsilon> \<kappa>)) in
+         AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>)) =
+         AOT_model_valid_in w (Rep_urrel r (\<kappa>\<upsilon> \<kappa>'))\<close>
+    by presburger
+  hence \<alpha>\<sigma>_eq: \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
+    unfolding Let_def
+    apply (subst (asm) (1 2) Abs_urrel_inverse)
+    using AOT_model_proposition_choice_simp a_def b_def by force+
+  assume \<Pi>_den: \<open>AOT_model_denotes \<Pi>\<close>
+  have \<open>\<not>AOT_model_valid_in w (Rep_rel \<Pi> (SOME xa. \<kappa>\<upsilon> xa = null\<upsilon> x))\<close> for x w
+    by (metis (mono_tags, lifting) AOT_model_denotes_\<kappa>_def
+          AOT_model_denotes_rel.rep_eq \<kappa>.exhaust_disc \<kappa>\<upsilon>.simps(1,2,3)
+          \<open>AOT_model_denotes \<Pi>\<close> \<upsilon>.disc(8) \<upsilon>.disc(9) \<upsilon>.distinct(3)
+          is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def verit_sko_ex')
+  moreover have \<open>Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_rel \<Pi> (SOME xa. \<kappa>\<upsilon> xa = \<omega>\<upsilon> x)\<close> for x
+    by (metis (mono_tags, lifting) AOT_model_denotes_rel.rep_eq
+          AOT_model_term_equiv_\<kappa>_def \<kappa>\<upsilon>.simps(1) \<Pi>_den verit_sko_ex')
+  ultimately have \<open>Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_urrel (rel_to_urrel \<Pi>) (\<omega>\<upsilon> x)\<close> for x
+    unfolding rel_to_urrel_def
+    by (subst Abs_urrel_inverse) auto
+  hence \<open>\<exists>r . \<forall> x . Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_urrel r (\<omega>\<upsilon> x)\<close>
+    by (auto intro!: exI[where x=\<open>rel_to_urrel \<Pi>\<close>])
+  then obtain r where r_prop: \<open>Rep_rel \<Pi> (\<omega>\<kappa> x) = Rep_urrel r (\<omega>\<upsilon> x)\<close> for x
+    by blast
+
+  assume \<open>\<exists>\<Pi>'. AOT_model_denotes \<Pi>' \<and>
+    AOT_model_enc \<kappa> \<Pi>' \<and>
+    (\<forall>v x. (\<exists>w. AOT_model_concrete w x) \<longrightarrow> AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                                            AOT_model_valid_in v (Rep_rel \<Pi> x))\<close>
+  then obtain \<Pi>' where
+      \<Pi>'_den: \<open>AOT_model_denotes \<Pi>'\<close> and
+      \<kappa>_enc_\<Pi>': \<open>AOT_model_enc \<kappa> \<Pi>'\<close> and
+      \<Pi>'_prop: \<open>\<exists>w. AOT_model_concrete w x \<Longrightarrow>
+                    AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                    AOT_model_valid_in v (Rep_rel \<Pi> x)\<close> for v x
+    by blast
+  have \<open>AOT_model_valid_in v (Rep_rel \<Pi>' (\<omega>\<kappa> x)) =
+        AOT_model_valid_in v (Rep_rel \<Pi> (\<omega>\<kappa> x))\<close> for x v
+    by (simp add: AOT_model_\<omega>_concrete_in_some_world \<Pi>'_prop)
+  hence 0: \<open>AOT_urrel_\<omega>equiv (rel_to_urrel \<Pi>') (rel_to_urrel \<Pi>)\<close>
+    unfolding AOT_urrel_\<omega>equiv_def
+    by (smt (verit) AOT_rel_equiv_def Abs_rel_inverse Quotient3_def
+                    \<kappa>\<upsilon>.simps(1) iso_tuple_UNIV_I urrel_quotient3 urrel_to_rel_def
+                    \<Pi>_den \<Pi>'_den)
+  have \<open>rel_to_urrel \<Pi>' \<in> a\<close>
+   and \<open>urrel_to_\<omega>rel (rel_to_urrel \<Pi>') = urrel_to_\<omega>rel (rel_to_urrel \<Pi>)\<close>
+    apply (metis AOT_model_enc_\<kappa>_def \<kappa>.simps(11) \<kappa>_enc_\<Pi>' a_def)
+    by (metis Quotient3_rel 0 urrel_\<omega>rel_quot)
+  hence \<open>\<exists>s. s \<in> b \<and> urrel_to_\<omega>rel s = urrel_to_\<omega>rel (rel_to_urrel \<Pi>)\<close>
+    using \<alpha>\<sigma>_eq_ord_exts_ex \<alpha>\<sigma>_eq ext \<alpha>\<sigma>_\<alpha>\<sigma>' by blast
+  then obtain s where
+    s_prop: \<open>s \<in> b \<and> urrel_to_\<omega>rel s = urrel_to_\<omega>rel (rel_to_urrel \<Pi>)\<close>
+    by blast
+  then obtain \<Pi>'' where
+    \<Pi>''_prop: \<open>rel_to_urrel \<Pi>'' = s\<close> and \<Pi>''_den: \<open>AOT_model_denotes \<Pi>''\<close>
+    by (metis AOT_rel_equiv_def Quotient3_def urrel_quotient3)
+  moreover have \<open>AOT_model_enc \<kappa>' \<Pi>''\<close>
+    by (metis AOT_model_enc_\<kappa>_def \<Pi>''_den \<Pi>''_prop \<kappa>.simps(11) b_def s_prop)
+  moreover have \<open>AOT_model_valid_in v (Rep_rel \<Pi>'' x) =
+                 AOT_model_valid_in v (Rep_rel \<Pi> x)\<close>
+             if \<open>\<exists>w. AOT_model_concrete w x\<close> for v x
+  proof(insert that)
+    assume \<open>\<exists>w. AOT_model_concrete w x\<close>
+    then obtain u where x_def: \<open>x = \<omega>\<kappa> u\<close>
+      by (metis AOT_model_concrete_\<kappa>.simps(2,3) \<kappa>.exhaust)
+    show \<open>AOT_model_valid_in v (Rep_rel \<Pi>'' x) =
+          AOT_model_valid_in v (Rep_rel \<Pi> x)\<close>
+      unfolding x_def
+      by (smt (verit, best) AOT_rel_equiv_def Abs_rel_inverse Quotient3_def
+            \<Pi>''_den \<Pi>''_prop \<Pi>_den \<kappa>\<upsilon>.simps(1) iso_tuple_UNIV_I s_prop
+            urrel_quotient3 urrel_to_\<omega>rel_def urrel_to_rel_def)
+  qed
+  ultimately show \<open>\<exists>\<Pi>'. AOT_model_denotes \<Pi>' \<and> AOT_model_enc \<kappa>' \<Pi>' \<and>
+     (\<forall>v x. (\<exists>w. AOT_model_concrete w x) \<longrightarrow> AOT_model_valid_in v (Rep_rel \<Pi>' x) =
+                                             AOT_model_valid_in v (Rep_rel \<Pi> x))\<close>
+    apply (safe intro!: exI[where x=\<Pi>''])
+    by auto
+qed
+end
+
+text\<open>Products of unary individual terms and individual terms are individual terms.
+     A tuple is regular, if at most one element does not denote. I.e. a pair is
+     regular, if the first (unary) element denotes and the second is regular (i.e.
+     at most one of its recursive tuple elements does not denote), or the first does
+     not denote, but the second denotes (i.e. all its recursive tuple elements
+     denote).\<close>
+instantiation prod :: (AOT_UnaryIndividualTerm, AOT_IndividualTerm) AOT_IndividualTerm
+begin
+definition AOT_model_regular_prod :: \<open>'a\<times>'b \<Rightarrow> bool\<close> where
+  \<open>AOT_model_regular_prod \<equiv> \<lambda> (x,y) . AOT_model_denotes x \<and> AOT_model_regular y \<or>
+                                      \<not>AOT_model_denotes x \<and> AOT_model_denotes y\<close>
+definition AOT_model_term_equiv_prod :: \<open>'a\<times>'b \<Rightarrow> 'a\<times>'b \<Rightarrow> bool\<close> where
+  \<open>AOT_model_term_equiv_prod \<equiv>  \<lambda> (x\<^sub>1,y\<^sub>1) (x\<^sub>2,y\<^sub>2) .
+    AOT_model_term_equiv x\<^sub>1 x\<^sub>2 \<and> AOT_model_term_equiv y\<^sub>1 y\<^sub>2\<close>
+function AOT_model_irregular_prod :: \<open>('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> 'a\<times>'b \<Rightarrow> \<o>\<close> where
+  AOT_model_irregular_proj2: \<open>AOT_model_denotes x \<Longrightarrow>
+    AOT_model_irregular \<phi> (x,y) =
+    AOT_model_irregular (\<lambda>y. \<phi> (SOME x' . AOT_model_term_equiv x x', y)) y\<close>
+| AOT_model_irregular_proj1: \<open>\<not>AOT_model_denotes x \<and> AOT_model_denotes y \<Longrightarrow>
+    AOT_model_irregular \<phi> (x,y) =
+    AOT_model_irregular (\<lambda>x. \<phi> (x, SOME y' . AOT_model_term_equiv y y')) x\<close>
+| AOT_model_irregular_prod_generic: \<open>\<not>AOT_model_denotes x \<and> \<not>AOT_model_denotes y \<Longrightarrow>
+    AOT_model_irregular \<phi> (x,y) =
+    (SOME \<Phi> . AOT_model_irregular_spec \<Phi> AOT_model_regular AOT_model_term_equiv)
+      \<phi> (x,y)\<close>
+  by auto blast
+termination using "termination" by blast
+
+instance proof
+  obtain x :: 'a and y :: 'b where
+    \<open>\<not>AOT_model_denotes x\<close> and \<open>\<not>AOT_model_denotes y\<close>
+    by (meson AOT_model_nondenoting_ex AOT_model_denoting_ex)
+  thus \<open>\<exists>x::'a\<times>'b. \<not>AOT_model_denotes x\<close>
+    by (auto simp: AOT_model_denotes_prod_def AOT_model_regular_prod_def)
+next
+  show \<open>equivp (AOT_model_term_equiv :: 'a\<times>'b \<Rightarrow> 'a\<times>'b \<Rightarrow> bool)\<close>
+    by (rule equivpI; rule reflpI sympI transpI;
+        simp add: AOT_model_term_equiv_prod_def AOT_model_term_equiv_part_equivp
+                  equivp_reflp prod.case_eq_if case_prod_unfold equivp_symp)
+       (metis equivp_transp[OF AOT_model_term_equiv_part_equivp])
+next
+  show \<open>\<not>AOT_model_regular x \<Longrightarrow> \<not> AOT_model_denotes x\<close> for x :: \<open>'a\<times>'b\<close>
+    by (metis (mono_tags, lifting) AOT_model_denotes_prod_def case_prod_unfold
+          AOT_model_irregular_nondenoting AOT_model_regular_prod_def)
+next
+  fix x y :: \<open>'a\<times>'b\<close>
+  show \<open>AOT_model_term_equiv x y \<Longrightarrow> AOT_model_denotes x = AOT_model_denotes y\<close>
+    by (metis (mono_tags, lifting) AOT_model_denotes_prod_def case_prod_beta
+        AOT_model_term_equiv_denotes AOT_model_term_equiv_prod_def )
+next
+  fix x y :: \<open>'a\<times>'b\<close>
+  show \<open>AOT_model_term_equiv x y \<Longrightarrow> AOT_model_regular x = AOT_model_regular y\<close>
+    by (induct x; induct y;
+        simp add: AOT_model_term_equiv_prod_def AOT_model_regular_prod_def)
+       (meson AOT_model_term_equiv_denotes AOT_model_term_equiv_regular)
+next
+  interpret sp: AOT_model_irregular_spec \<open>\<lambda>\<phi> (x::'a\<times>'b) . \<epsilon>\<^sub>\<o> w . False\<close>
+                    AOT_model_regular AOT_model_term_equiv
+    by (simp add: AOT_model_irregular_spec_def AOT_model_proposition_choice_simp)
+  have ex_spec: \<open>\<exists> \<phi> :: ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> 'a\<times>'b \<Rightarrow> \<o> .
+    AOT_model_irregular_spec \<phi> AOT_model_regular AOT_model_term_equiv\<close>
+    using sp.AOT_model_irregular_spec_axioms by blast
+  have some_spec: \<open>AOT_model_irregular_spec
+    (SOME \<phi> :: ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> 'a\<times>'b \<Rightarrow> \<o> .
+        AOT_model_irregular_spec \<phi> AOT_model_regular AOT_model_term_equiv)
+    AOT_model_regular AOT_model_term_equiv\<close>
+    using someI_ex[OF ex_spec] by argo
+  interpret sp_some: AOT_model_irregular_spec
+    \<open>SOME \<phi> :: ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> 'a\<times>'b \<Rightarrow> \<o> .
+        AOT_model_irregular_spec \<phi> AOT_model_regular AOT_model_term_equiv\<close>
+    AOT_model_regular AOT_model_term_equiv
+    using some_spec by blast
+  show \<open>AOT_model_irregular_spec (AOT_model_irregular :: ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> 'a\<times>'b \<Rightarrow> \<o>)
+          AOT_model_regular AOT_model_term_equiv\<close>
+  proof
+    have \<open>\<not>AOT_model_valid_in w (AOT_model_irregular \<phi> (a, b))\<close>
+      for w \<phi> and a :: 'a and b :: 'b
+      by (induct arbitrary: \<phi> rule: AOT_model_irregular_prod.induct)
+         (auto simp: AOT_model_irregular_false sp_some.AOT_model_irregular_false)
+    thus "\<not>AOT_model_valid_in w (AOT_model_irregular \<phi> x)" for w \<phi> and x :: \<open>'a\<times>'b\<close>
+      by (induct x)
+  next
+    {
+      fix x\<^sub>1 y\<^sub>1 :: 'a and x\<^sub>2 y\<^sub>2 :: 'b and \<phi> :: \<open>'a\<times>'b\<Rightarrow>\<o>\<close>
+      assume x\<^sub>1y\<^sub>1_equiv: \<open>AOT_model_term_equiv x\<^sub>1 y\<^sub>1\<close>
+      moreover assume x\<^sub>2y\<^sub>2_equiv: \<open>AOT_model_term_equiv x\<^sub>2 y\<^sub>2\<close>
+      ultimately have xy_equiv: \<open>AOT_model_term_equiv (x\<^sub>1,x\<^sub>2) (y\<^sub>1,y\<^sub>2)\<close>
+        by (simp add: AOT_model_term_equiv_prod_def)
+      {
+        assume \<open>AOT_model_denotes x\<^sub>1\<close>
+        moreover hence \<open>AOT_model_denotes y\<^sub>1\<close>
+          using AOT_model_term_equiv_denotes AOT_model_term_equiv_regular
+                x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv by blast
+        ultimately have \<open>AOT_model_irregular \<phi> (x\<^sub>1,x\<^sub>2) =
+                         AOT_model_irregular \<phi> (y\<^sub>1,y\<^sub>2)\<close>
+          using AOT_model_irregular_equiv AOT_model_term_equiv_eps(3)
+                x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv by fastforce
+      }
+      moreover {
+        assume \<open>~AOT_model_denotes x\<^sub>1 \<and> AOT_model_denotes x\<^sub>2\<close>
+        moreover hence \<open>~AOT_model_denotes y\<^sub>1 \<and> AOT_model_denotes y\<^sub>2\<close>
+          by (meson AOT_model_term_equiv_denotes x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv)
+        ultimately have \<open>AOT_model_irregular \<phi> (x\<^sub>1,x\<^sub>2) =
+                         AOT_model_irregular \<phi> (y\<^sub>1,y\<^sub>2)\<close>
+          using AOT_model_irregular_equiv AOT_model_term_equiv_eps(3)
+                x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv by fastforce
+      }
+      moreover {
+        assume denotes_x: \<open>(\<not>AOT_model_denotes x\<^sub>1 \<and> \<not>AOT_model_denotes x\<^sub>2)\<close>
+        hence denotes_y: \<open>(\<not>AOT_model_denotes y\<^sub>1 \<and> \<not>AOT_model_denotes y\<^sub>2)\<close>
+          by (meson AOT_model_term_equiv_denotes AOT_model_term_equiv_regular
+                    x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv)
+        have eps_eq: \<open>Eps (AOT_model_term_equiv x\<^sub>1) = Eps (AOT_model_term_equiv y\<^sub>1)\<close>
+          by (simp add: AOT_model_term_equiv_eps(3) x\<^sub>1y\<^sub>1_equiv)
+        have \<open>AOT_model_irregular \<phi> (x\<^sub>1,x\<^sub>2) = AOT_model_irregular \<phi> (y\<^sub>1,y\<^sub>2)\<close>
+          using denotes_x denotes_y
+          using sp_some.AOT_model_irregular_equiv xy_equiv by auto
+      }
+      moreover {
+        assume denotes_x: \<open>\<not>AOT_model_denotes x\<^sub>1 \<and> AOT_model_denotes x\<^sub>2\<close>
+        hence denotes_y: \<open>\<not>AOT_model_denotes y\<^sub>1 \<and> AOT_model_denotes y\<^sub>2\<close>
+          by (meson AOT_model_term_equiv_denotes x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv)
+        have eps_eq: \<open>Eps (AOT_model_term_equiv x\<^sub>2) = Eps (AOT_model_term_equiv y\<^sub>2)\<close>
+          by (simp add: AOT_model_term_equiv_eps(3) x\<^sub>2y\<^sub>2_equiv)
+        have \<open>AOT_model_irregular \<phi> (x\<^sub>1,x\<^sub>2) = AOT_model_irregular \<phi> (y\<^sub>1,y\<^sub>2)\<close>
+          using denotes_x denotes_y
+          using AOT_model_irregular_nondenoting calculation(2) by blast
+      }
+      ultimately have \<open>AOT_model_irregular \<phi> (x\<^sub>1,x\<^sub>2) = AOT_model_irregular \<phi> (y\<^sub>1,y\<^sub>2)\<close>
+        using AOT_model_term_equiv_denotes AOT_model_term_equiv_regular
+              sp_some.AOT_model_irregular_equiv x\<^sub>1y\<^sub>1_equiv x\<^sub>2y\<^sub>2_equiv xy_equiv
+        by blast
+    } note 0 = this
+    show \<open>AOT_model_term_equiv x y \<Longrightarrow>
+          AOT_model_irregular \<phi> x = AOT_model_irregular \<phi> y\<close>
+      for x y :: \<open>'a\<times>'b\<close> and \<phi>
+      by (induct x; induct y; simp add: AOT_model_term_equiv_prod_def 0)
+  next
+    fix \<phi> \<psi> :: \<open>'a\<times>'b \<Rightarrow> \<o>\<close>
+    assume \<open>AOT_model_regular x \<Longrightarrow> \<phi> x = \<psi> x\<close> for x
+    hence \<open>\<phi> (x, y) = \<psi> (x, y)\<close>
+      if \<open>AOT_model_denotes x \<and> AOT_model_regular y \<or>
+          \<not>AOT_model_denotes x \<and> AOT_model_denotes y\<close> for x y
+      using that unfolding AOT_model_regular_prod_def by simp
+    hence \<open>AOT_model_irregular \<phi> (x,y) = AOT_model_irregular \<psi> (x,y)\<close>
+      for x :: 'a and y :: 'b
+    proof (induct arbitrary: \<psi> \<phi> rule: AOT_model_irregular_prod.induct)
+      case (1 x y \<phi>)
+      thus ?case
+        apply simp
+        by (meson AOT_model_irregular_eqI AOT_model_irregular_nondenoting
+                  AOT_model_term_equiv_denotes AOT_model_term_equiv_eps(1))
+    next
+      case (2 x y \<phi>)
+      thus ?case
+        apply simp
+        by (meson AOT_model_irregular_nondenoting AOT_model_term_equiv_denotes
+                  AOT_model_term_equiv_eps(1))
+    next
+      case (3 x y \<phi>)
+      thus ?case
+        apply simp
+        by (metis (mono_tags, lifting) AOT_model_regular_prod_def case_prod_conv
+                                       sp_some.AOT_model_irregular_eqI surj_pair)
+    qed
+    thus \<open>AOT_model_irregular \<phi> x = AOT_model_irregular \<psi> x\<close> for  x :: \<open>'a\<times>'b\<close>
+      by (metis surjective_pairing)
+  qed
+qed
+end
+
+text\<open>Introduction rules for term equivalence on tuple terms.\<close>
+lemma AOT_meta_prod_equivI:
+  shows "\<And> (a::'a::AOT_UnaryIndividualTerm) x (y :: 'b::AOT_IndividualTerm) .
+            AOT_model_term_equiv x y \<Longrightarrow> AOT_model_term_equiv (a,x) (a,y)"
+    and "\<And> (x::'a::AOT_UnaryIndividualTerm) y (b :: 'b::AOT_IndividualTerm) .
+            AOT_model_term_equiv x y \<Longrightarrow> AOT_model_term_equiv (x,b) (y,b)"
+    unfolding AOT_model_term_equiv_prod_def
+    by (simp add: AOT_model_term_equiv_part_equivp equivp_reflp)+
+
+text\<open>The type of propositions are trivial instances of terms.\<close>
+
+instantiation \<o> :: AOT_Term
+begin
+definition AOT_model_denotes_\<o> :: \<open>\<o> \<Rightarrow> bool\<close> where
+  \<open>AOT_model_denotes_\<o> \<equiv> \<lambda>_. True\<close>
+instance proof
+  show \<open>\<exists>x::\<o>. AOT_model_denotes x\<close>
+    by (simp add: AOT_model_denotes_\<o>_def)
+qed
+end
+
+text\<open>AOT's variables are modelled by restricting the type of terms to those terms
+     that denote.\<close>
+typedef 'a AOT_var = \<open>{ x :: 'a::AOT_Term . AOT_model_denotes x }\<close>
+  morphisms AOT_term_of_var AOT_var_of_term
+  by (simp add: AOT_model_denoting_ex)
+
+text\<open>Simplify automatically generated theorems and rules.\<close>
+declare AOT_var_of_term_induct[induct del]
+        AOT_var_of_term_cases[cases del]
+        AOT_term_of_var_induct[induct del]
+        AOT_term_of_var_cases[cases del]
+lemmas AOT_var_of_term_inverse = AOT_var_of_term_inverse[simplified]
+   and AOT_var_of_term_inject = AOT_var_of_term_inject[simplified]
+   and AOT_var_of_term_induct =
+          AOT_var_of_term_induct[simplified, induct type: AOT_var]
+   and AOT_var_of_term_cases =
+          AOT_var_of_term_cases[simplified, cases type: AOT_var]
+   and AOT_term_of_var = AOT_term_of_var[simplified]
+   and AOT_term_of_var_cases =
+          AOT_term_of_var_cases[simplified, induct pred: AOT_term_of_var]
+   and AOT_term_of_var_induct =
+          AOT_term_of_var_induct[simplified, induct pred: AOT_term_of_var]
+   and AOT_term_of_var_inverse = AOT_term_of_var_inverse[simplified]
+   and AOT_term_of_var_inject = AOT_term_of_var_inject[simplified]
+
+text\<open>Equivalence by definition is modelled as necessary equivalence.\<close>
+consts AOT_model_equiv_def :: \<open>\<o> \<Rightarrow> \<o> \<Rightarrow> bool\<close>
+specification(AOT_model_equiv_def)
+  AOT_model_equiv_def: \<open>AOT_model_equiv_def \<phi> \<psi> = (\<forall> v . AOT_model_valid_in v \<phi> =
+                                                         AOT_model_valid_in v \<psi>)\<close>
+  by (rule exI[where x=\<open>\<lambda> \<phi> \<psi> . \<forall> v . AOT_model_valid_in v \<phi> =
+                                       AOT_model_valid_in v \<psi>\<close>]) simp
+
+text\<open>Identity by definition is modelled as identity for denoting terms plus
+     co-denoting.\<close>
+consts AOT_model_id_def :: \<open>('b \<Rightarrow> 'a::AOT_Term) \<Rightarrow> ('b \<Rightarrow> 'a) \<Rightarrow> bool\<close>
+specification(AOT_model_id_def)
+  AOT_model_id_def: \<open>(AOT_model_id_def \<tau> \<sigma>) = (\<forall> \<alpha> . if AOT_model_denotes (\<sigma> \<alpha>)
+                                                     then \<tau> \<alpha> = \<sigma> \<alpha>
+                                                     else \<not>AOT_model_denotes (\<tau> \<alpha>))\<close>
+  by (rule exI[where x="\<lambda> \<tau> \<sigma> . \<forall> \<alpha> . if AOT_model_denotes (\<sigma> \<alpha>)
+                                      then \<tau> \<alpha> = \<sigma> \<alpha>
+                                      else \<not>AOT_model_denotes (\<tau> \<alpha>)"])
+     blast
+text\<open>To reduce definitions by identity without free variables to definitions
+     by identity with free variables acting on the unit type, we give the unit type
+     a trivial instantiation to @{class AOT_Term}.\<close>
+instantiation unit :: AOT_Term
+begin
+definition AOT_model_denotes_unit :: \<open>unit \<Rightarrow> bool\<close> where
+  \<open>AOT_model_denotes_unit \<equiv> \<lambda>_. True\<close>
+instance proof qed(simp add: AOT_model_denotes_unit_def)
+end
+
+text\<open>Modally-strict and modally-fragile axioms are as necessary,
+     resp. actually valid propositions.\<close>
+definition AOT_model_axiom where
+  \<open>AOT_model_axiom \<equiv> \<lambda> \<phi> . \<forall> v . AOT_model_valid_in v \<phi>\<close>
+definition AOT_model_act_axiom where
+  \<open>AOT_model_act_axiom \<equiv> \<lambda> \<phi> . AOT_model_valid_in w\<^sub>0 \<phi>\<close>
+
+lemma AOT_model_axiomI:
+  assumes \<open>\<And>v . AOT_model_valid_in v \<phi>\<close>
+  shows \<open>AOT_model_axiom \<phi>\<close>
+  unfolding AOT_model_axiom_def using assms ..
+
+lemma AOT_model_act_axiomI:
+  assumes \<open>AOT_model_valid_in w\<^sub>0 \<phi>\<close>
+  shows \<open>AOT_model_act_axiom \<phi>\<close>
+  unfolding AOT_model_act_axiom_def using assms .
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/AOT/AOT_semantics.thy b/thys/AOT/AOT_semantics.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_semantics.thy
@@ -0,0 +1,1801 @@
+(*<*)
+theory AOT_semantics
+  imports AOT_syntax
+begin
+(*>*)
+
+section\<open>Abstract Semantics for AOT\<close>
+
+specification(AOT_denotes)
+  \<comment> \<open>Relate object level denoting to meta-denoting. AOT's definitions of
+      denoting will become derivable at each type.\<close>
+  AOT_sem_denotes: \<open>[w \<Turnstile> \<tau>\<down>] = AOT_model_denotes \<tau>\<close>
+  by (rule exI[where x=\<open>\<lambda> \<tau> . \<epsilon>\<^sub>\<o> w . AOT_model_denotes \<tau>\<close>])
+     (simp add: AOT_model_proposition_choice_simp)
+
+lemma AOT_sem_var_induct[induct type: AOT_var]:
+  assumes AOT_denoting_term_case: \<open>\<And> \<tau> . [v \<Turnstile> \<tau>\<down>] \<Longrightarrow> [v \<Turnstile> \<phi>{\<tau>}]\<close>
+  shows \<open>[v \<Turnstile> \<phi>{\<alpha>}]\<close>
+  by (simp add: AOT_denoting_term_case AOT_sem_denotes AOT_term_of_var)
+
+text\<open>\linelabel{AOT_imp_spec}\<close>
+specification(AOT_imp)
+  AOT_sem_imp: \<open>[w \<Turnstile> \<phi> \<rightarrow> \<psi>] = ([w \<Turnstile> \<phi>] \<longrightarrow> [w \<Turnstile> \<psi>])\<close>
+  by (rule exI[where x=\<open>\<lambda> \<phi> \<psi> . \<epsilon>\<^sub>\<o> w . ([w \<Turnstile> \<phi>] \<longrightarrow> [w \<Turnstile> \<psi>])\<close>])
+    (simp add: AOT_model_proposition_choice_simp)
+
+specification(AOT_not)
+  AOT_sem_not: \<open>[w \<Turnstile> \<not>\<phi>] = (\<not>[w \<Turnstile> \<phi>])\<close>
+  by (rule exI[where x=\<open>\<lambda> \<phi> . \<epsilon>\<^sub>\<o> w . \<not>[w \<Turnstile> \<phi>]\<close>])
+     (simp add: AOT_model_proposition_choice_simp)
+
+text\<open>\linelabel{AOT_box_spec}\<close>
+specification(AOT_box)
+  AOT_sem_box: \<open>[w \<Turnstile> \<box>\<phi>] = (\<forall> w . [w \<Turnstile> \<phi>])\<close>
+  by (rule exI[where x=\<open>\<lambda> \<phi> . \<epsilon>\<^sub>\<o> w . \<forall> w . [w \<Turnstile> \<phi>]\<close>])
+     (simp add: AOT_model_proposition_choice_simp)
+
+text\<open>\linelabel{AOT_act_spec}\<close>
+specification(AOT_act)
+  AOT_sem_act: \<open>[w \<Turnstile> \<^bold>\<A>\<phi>] = [w\<^sub>0 \<Turnstile> \<phi>]\<close>
+  by (rule exI[where x=\<open>\<lambda> \<phi> . \<epsilon>\<^sub>\<o> w . [w\<^sub>0 \<Turnstile> \<phi>]\<close>])
+     (simp add: AOT_model_proposition_choice_simp)
+
+text\<open>Derived semantics for basic defined connectives.\<close>
+lemma AOT_sem_conj: \<open>[w \<Turnstile> \<phi> & \<psi>] = ([w \<Turnstile> \<phi>] \<and> [w \<Turnstile> \<psi>])\<close>
+  using AOT_conj AOT_model_equiv_def AOT_sem_imp AOT_sem_not by auto
+lemma AOT_sem_equiv: \<open>[w \<Turnstile> \<phi> \<equiv> \<psi>] = ([w \<Turnstile> \<phi>] = [w \<Turnstile> \<psi>])\<close>
+  using AOT_equiv AOT_sem_conj AOT_model_equiv_def AOT_sem_imp by auto
+lemma AOT_sem_disj: \<open>[w \<Turnstile> \<phi> \<or> \<psi>] = ([w \<Turnstile> \<phi>] \<or> [w \<Turnstile> \<psi>])\<close>
+  using AOT_disj AOT_model_equiv_def AOT_sem_imp AOT_sem_not by auto
+lemma AOT_sem_dia: \<open>[w \<Turnstile> \<diamond>\<phi>] = (\<exists> w . [w \<Turnstile> \<phi>])\<close>
+  using AOT_dia AOT_sem_box AOT_model_equiv_def AOT_sem_not by auto
+
+specification(AOT_forall)
+  AOT_sem_forall: \<open>[w \<Turnstile> \<forall>\<alpha> \<phi>{\<alpha>}] = (\<forall> \<tau> . [w \<Turnstile> \<tau>\<down>] \<longrightarrow> [w \<Turnstile> \<phi>{\<tau>}])\<close>
+  by (rule exI[where x=\<open>\<lambda> op . \<epsilon>\<^sub>\<o> w . \<forall> \<tau> . [w \<Turnstile> \<tau>\<down>] \<longrightarrow> [w \<Turnstile> \<guillemotleft>op \<tau>\<guillemotright>]\<close>])
+     (simp add: AOT_model_proposition_choice_simp)
+
+lemma AOT_sem_exists: \<open>[w \<Turnstile> \<exists>\<alpha> \<phi>{\<alpha>}] = (\<exists> \<tau> . [w \<Turnstile> \<tau>\<down>] \<and> [w \<Turnstile> \<phi>{\<tau>}])\<close>
+  unfolding AOT_exists[unfolded AOT_model_equiv_def, THEN spec]
+  by (simp add: AOT_sem_forall AOT_sem_not)
+
+text\<open>\linelabel{AOT_eq_spec}\<close>
+specification(AOT_eq)
+  \<comment> \<open>Relate identity to denoting identity in the meta-logic. AOT's definitions
+      of identity will become derivable at each type.\<close>
+  AOT_sem_eq: \<open>[w \<Turnstile> \<tau> = \<tau>'] = ([w \<Turnstile> \<tau>\<down>] \<and> [w \<Turnstile> \<tau>'\<down>] \<and> \<tau> = \<tau>')\<close>
+  by (rule exI[where x=\<open>\<lambda> \<tau> \<tau>' . \<epsilon>\<^sub>\<o> w . [w \<Turnstile> \<tau>\<down>] \<and> [w \<Turnstile> \<tau>'\<down>] \<and> \<tau> = \<tau>'\<close>])
+     (simp add: AOT_model_proposition_choice_simp)
+
+text\<open>\linelabel{AOT_desc_spec}\<close>
+specification(AOT_desc)
+  \<comment> \<open>Descriptions denote, if there is a unique denoting object satisfying the
+      matrix in the actual world.\<close>
+  AOT_sem_desc_denotes: \<open>[w \<Turnstile> \<^bold>\<iota>x(\<phi>{x})\<down>] = (\<exists>! \<kappa> . [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}])\<close>
+  \<comment> \<open>Denoting descriptions satisfy their matrix in the actual world.\<close>
+  AOT_sem_desc_prop: \<open>[w \<Turnstile> \<^bold>\<iota>x(\<phi>{x})\<down>] \<Longrightarrow> [w\<^sub>0 \<Turnstile> \<phi>{\<^bold>\<iota>x(\<phi>{x})}]\<close>
+  \<comment> \<open>Uniqueness of denoting descriptions.\<close>
+  AOT_sem_desc_unique: \<open>[w \<Turnstile> \<^bold>\<iota>x(\<phi>{x})\<down>] \<Longrightarrow> [w \<Turnstile> \<kappa>\<down>] \<Longrightarrow> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}] \<Longrightarrow>
+                        [w \<Turnstile> \<^bold>\<iota>x(\<phi>{x}) = \<kappa>]\<close>
+proof -
+  have \<open>\<exists>x::'a . \<not>AOT_model_denotes x\<close>
+    using AOT_model_nondenoting_ex
+    by blast
+  text\<open>Note that we may choose a distinct non-denoting object for each matrix.
+       We do this explicitly merely to convince ourselves that our specification
+       can still be satisfied.\<close>
+  then obtain nondenoting :: \<open>('a \<Rightarrow> \<o>) \<Rightarrow> 'a\<close> where
+    nondenoting: \<open>\<forall> \<phi> . \<not>AOT_model_denotes (nondenoting \<phi>)\<close>
+    by fast
+  define desc where
+    \<open>desc = (\<lambda> \<phi> . if (\<exists>! \<kappa> . [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}])
+                   then (THE \<kappa> . [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}])
+                   else nondenoting \<phi>)\<close>
+  {
+    fix \<phi> :: \<open>'a \<Rightarrow> \<o>\<close>
+    assume ex1: \<open>\<exists>! \<kappa> . [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}]\<close>
+    then obtain \<kappa> where x_prop: "[w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}]"
+      unfolding AOT_sem_denotes by blast
+    moreover have "(desc \<phi>) = \<kappa>"
+      unfolding desc_def using x_prop ex1 by fastforce
+    ultimately have "[w\<^sub>0 \<Turnstile> \<guillemotleft>desc \<phi>\<guillemotright>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<guillemotleft>\<phi> (desc \<phi>)\<guillemotright>]"
+      by blast
+  } note 1 = this
+  moreover {
+    fix \<phi> :: \<open>'a \<Rightarrow> \<o>\<close>
+    assume nex1: \<open>\<nexists>! \<kappa> . [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}]\<close>
+    hence "(desc \<phi>) = nondenoting \<phi>" by (simp add: desc_def AOT_sem_denotes)
+    hence "[w \<Turnstile> \<not>\<guillemotleft>desc \<phi>\<guillemotright>\<down>]" for w
+      by (simp add: AOT_sem_denotes nondenoting AOT_sem_not)
+  }
+  ultimately have desc_denotes_simp:
+    \<open>[w \<Turnstile> \<guillemotleft>desc \<phi>\<guillemotright>\<down>] = (\<exists>! \<kappa> . [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}])\<close> for \<phi> w
+    by (simp add: AOT_sem_denotes desc_def nondenoting)
+  have \<open>(\<forall>\<phi> w. [w \<Turnstile> \<guillemotleft>desc \<phi>\<guillemotright>\<down>] = (\<exists>!\<kappa>. [w\<^sub>0 \<Turnstile> \<kappa>\<down>] \<and> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}])) \<and>
+    (\<forall>\<phi> w. [w \<Turnstile> \<guillemotleft>desc \<phi>\<guillemotright>\<down>] \<longrightarrow> [w\<^sub>0 \<Turnstile> \<guillemotleft>\<phi> (desc \<phi>)\<guillemotright>]) \<and>
+    (\<forall>\<phi> w \<kappa>. [w \<Turnstile> \<guillemotleft>desc \<phi>\<guillemotright>\<down>] \<longrightarrow> [w \<Turnstile> \<kappa>\<down>] \<longrightarrow> [w\<^sub>0 \<Turnstile> \<phi>{\<kappa>}] \<longrightarrow>
+             [w \<Turnstile> \<guillemotleft>desc \<phi>\<guillemotright> = \<kappa>])\<close>
+    by (insert 1; auto simp: desc_denotes_simp AOT_sem_eq AOT_sem_denotes
+                             desc_def nondenoting)
+  thus ?thesis
+    by (safe intro!: exI[where x=desc]; presburger)
+qed
+
+text\<open>\linelabel{AOT_exe_lambda_spec}\<close>
+specification(AOT_exe AOT_lambda)
+  \<comment> \<open>Truth conditions of exemplification formulas.\<close>
+  AOT_sem_exe: \<open>[w \<Turnstile> [\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n] = ([w \<Turnstile> \<Pi>\<down>] \<and> [w \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and>
+                                     [w \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>])\<close>
+  \<comment> \<open>\eta-conversion for denoting terms; equivalent to AOT's axiom\<close>
+  AOT_sem_lambda_eta: \<open>[w \<Turnstile> \<Pi>\<down>] \<Longrightarrow> [w \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n [\<Pi>]\<nu>\<^sub>1...\<nu>\<^sub>n] = \<Pi>]\<close>
+  \<comment> \<open>\beta-conversion; equivalent to AOT's axiom\<close>
+  AOT_sem_lambda_beta: \<open>[w \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>] \<Longrightarrow> [w \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<Longrightarrow>
+                        [w \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n] = [w \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}]\<close>
+  \<comment> \<open>Necessary and sufficient conditions for relations to denote. Equivalent
+      to a theorem of AOT and used to derive the base cases of denoting relations
+      (cqt.2).\<close>
+  AOT_sem_lambda_denotes: \<open>[w \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>] =
+    (\<forall> v \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' . [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> [v \<Turnstile> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<down>] \<and>
+        (\<forall> \<Pi> v . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> [\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n] = [v \<Turnstile> [\<Pi>]\<kappa>\<^sub>1'...\<kappa>\<^sub>n']) \<longrightarrow>
+                 [v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}])\<close>
+  \<comment> \<open>Equivalent to AOT's coexistence axiom.\<close>
+  AOT_sem_lambda_coex: \<open>[w \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>] \<Longrightarrow>
+    (\<forall> w \<kappa>\<^sub>1\<kappa>\<^sub>n . [w \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<longrightarrow> [w \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [w \<Turnstile> \<psi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}]) \<Longrightarrow>
+    [w \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>]\<close>
+  \<comment> \<open>Only the unary case of the following should hold, but our specification
+      has to range over all types. We might move @{const AOT_exe} and
+      @{const AOT_lambda} to type classes in the future to solve this.\<close>
+  AOT_sem_lambda_eq_prop_eq: \<open>\<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>]\<guillemotright> = \<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>]\<guillemotright> \<Longrightarrow> \<phi> = \<psi>\<close>
+  \<comment> \<open>The following is solely required for validating n-ary relation identity
+      and has the danger of implying artifactual theorems. Possibly avoidable
+      by moving @{const AOT_exe} and @{const AOT_lambda} to type classes.\<close>
+  AOT_sem_exe_denoting: \<open>[w \<Turnstile> \<Pi>\<down>] \<Longrightarrow> AOT_exe \<Pi> \<kappa>s = Rep_rel \<Pi> \<kappa>s\<close>
+  \<comment> \<open>The following is required for validating the base cases of denoting
+      relations (cqt.2). A version of this meta-logical identity will
+      become derivable in future versions of AOT, so this will ultimately not
+      result in artifactual theorems.\<close>
+  AOT_sem_exe_equiv: \<open>AOT_model_term_equiv x y \<Longrightarrow> AOT_exe \<Pi> x = AOT_exe \<Pi> y\<close>
+proof -
+  have \<open>\<exists> x :: <'a> . \<not>AOT_model_denotes x\<close>
+    by (rule exI[where x=\<open>Abs_rel (\<lambda> x . \<epsilon>\<^sub>\<o> w. True)\<close>])
+       (meson AOT_model_denotes_rel.abs_eq AOT_model_nondenoting_ex
+              AOT_model_proposition_choice_simp)
+  define exe :: \<open><'a> \<Rightarrow> 'a \<Rightarrow> \<o>\<close> where
+    \<open>exe \<equiv> \<lambda> \<Pi> \<kappa>s . if AOT_model_denotes \<Pi>
+                     then Rep_rel \<Pi> \<kappa>s
+                     else (\<epsilon>\<^sub>\<o> w . False)\<close>
+  define lambda :: \<open>('a\<Rightarrow>\<o>) \<Rightarrow> <'a>\<close> where
+    \<open>lambda \<equiv> \<lambda> \<phi> . if AOT_model_denotes (Abs_rel \<phi>)
+      then (Abs_rel \<phi>)
+      else
+        if (\<forall> \<kappa> \<kappa>' w . (AOT_model_denotes \<kappa> \<and> AOT_model_term_equiv \<kappa> \<kappa>') \<longrightarrow>
+                       [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] = [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>])
+        then
+          Abs_rel (fix_irregular (\<lambda> x . if AOT_model_denotes x
+                                        then \<phi> (SOME y . AOT_model_term_equiv x y)
+                                        else  (\<epsilon>\<^sub>\<o> w . False)))
+        else 
+          Abs_rel \<phi>\<close>
+  have fix_irregular_denoting_simp[simp]:
+    \<open>fix_irregular (\<lambda>x. if AOT_model_denotes x then \<phi> x else \<psi> x) \<kappa> = \<phi> \<kappa>\<close>
+    if \<open>AOT_model_denotes \<kappa>\<close>
+    for \<kappa> :: 'a and \<phi> \<psi>
+    by (simp add: that fix_irregular_denoting)
+  have denoting_eps_cong[cong]:
+    \<open>[w \<Turnstile> \<guillemotleft>\<phi> (Eps (AOT_model_term_equiv \<kappa>))\<guillemotright>] = [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>]\<close>
+    if \<open>AOT_model_denotes \<kappa>\<close>
+    and \<open>\<forall> \<kappa> \<kappa>'. AOT_model_denotes \<kappa> \<and> AOT_model_term_equiv \<kappa> \<kappa>' \<longrightarrow>
+                 (\<forall>w. [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] = [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>])\<close>
+    for w :: w and \<kappa> :: 'a and \<phi> :: \<open>'a\<Rightarrow>\<o>\<close>
+    using that AOT_model_term_equiv_eps(2) by blast
+  have exe_rep_rel: \<open>[w \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>] = ([w \<Turnstile> \<Pi>\<down>] \<and> [w \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and>
+                                            [w \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>])\<close> for w \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n
+    by (metis AOT_model_denotes_rel.rep_eq exe_def AOT_sem_denotes
+              AOT_model_proposition_choice_simp)
+  moreover have \<open>[w \<Turnstile> \<guillemotleft>\<Pi>\<guillemotright>\<down>] \<Longrightarrow> [w \<Turnstile> \<guillemotleft>lambda (exe \<Pi>)\<guillemotright> = \<guillemotleft>\<Pi>\<guillemotright>]\<close> for \<Pi> w
+    by (auto simp: Rep_rel_inverse lambda_def AOT_sem_denotes AOT_sem_eq
+                   AOT_model_denotes_rel_def Abs_rel_inverse exe_def)
+  moreover have lambda_denotes_beta:
+    \<open>[w \<Turnstile> \<guillemotleft>exe (lambda \<phi>) \<kappa> \<guillemotright>] = [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>]\<close>
+    if \<open>[w \<Turnstile> \<guillemotleft>lambda \<phi>\<guillemotright>\<down>]\<close> and \<open>[w \<Turnstile> \<guillemotleft>\<kappa>\<guillemotright>\<down>]\<close>
+    for \<phi> \<kappa> w
+    using that unfolding exe_def AOT_sem_denotes
+    by (auto simp: lambda_def Abs_rel_inverse split: if_split_asm)
+  moreover have lambda_denotes_simp:
+    \<open>[w \<Turnstile> \<guillemotleft>lambda \<phi>\<guillemotright>\<down>] = (\<forall> v \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' . [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> [v \<Turnstile> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<down>] \<and>
+        (\<forall> \<Pi> v . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>] = [v \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<guillemotright>]) \<longrightarrow>
+        [v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}])\<close> for \<phi> w
+  proof
+    assume \<open>[w \<Turnstile> \<guillemotleft>lambda \<phi>\<guillemotright>\<down>]\<close>
+    hence \<open>AOT_model_denotes (lambda \<phi>)\<close>
+      unfolding AOT_sem_denotes by simp
+    moreover have \<open>[w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] \<Longrightarrow> [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>]\<close>
+      and \<open>[w \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>] \<Longrightarrow> [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>]\<close>
+      if \<open>AOT_model_denotes \<kappa>\<close> and \<open>AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+      for w \<kappa> \<kappa>'
+      by (metis (no_types, lifting) AOT_model_denotes_rel.abs_eq lambda_def
+                                    that calculation)+
+    ultimately show \<open>\<forall> v \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' . [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> [v \<Turnstile> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<down>] \<and>
+        (\<forall> \<Pi> v . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>] = [v \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<guillemotright>]) \<longrightarrow>
+        [v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}]\<close>
+      unfolding AOT_sem_denotes
+      by (metis (no_types) AOT_sem_denotes lambda_denotes_beta)
+  next
+    assume \<open>\<forall> v \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' . [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> [v \<Turnstile> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<down>] \<and>
+      (\<forall> \<Pi> v . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>] = [v \<Turnstile> \<guillemotleft>exe \<Pi> \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<guillemotright>]) \<longrightarrow>
+      [v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}]\<close>
+    hence \<open>[w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] = [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>]\<close>
+      if \<open>AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and> AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+      for w \<kappa> \<kappa>'
+      using that
+      by (auto simp: AOT_sem_denotes)
+         (meson AOT_model_term_equiv_rel_equiv AOT_sem_denotes exe_rep_rel)+
+    hence \<open>[w \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] = [w \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>]\<close>
+      if \<open>AOT_model_denotes \<kappa> \<and> AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+      for w \<kappa> \<kappa>'
+      using that AOT_model_term_equiv_denotes by blast
+    hence \<open>AOT_model_denotes (lambda \<phi>)\<close>
+      by (auto simp: lambda_def Abs_rel_inverse AOT_model_denotes_rel.abs_eq
+                     AOT_model_irregular_equiv AOT_model_term_equiv_eps(3)
+                     AOT_model_term_equiv_regular fix_irregular_def AOT_sem_denotes
+                     AOT_model_term_equiv_denotes AOT_model_proposition_choice_simp
+                     AOT_model_irregular_false
+               split: if_split_asm
+               intro: AOT_model_irregular_eqI)
+    thus \<open>[w \<Turnstile> \<guillemotleft>lambda \<phi>\<guillemotright>\<down>]\<close>
+      by (simp add: AOT_sem_denotes)
+  qed
+  moreover have \<open>[w \<Turnstile> \<guillemotleft>lambda \<psi>\<guillemotright>\<down>]\<close>
+    if \<open>[w \<Turnstile> \<guillemotleft>lambda \<phi>\<guillemotright>\<down>]\<close>
+    and \<open>\<forall> w \<kappa>\<^sub>1\<kappa>\<^sub>n . [w \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<longrightarrow> [w \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [w \<Turnstile> \<psi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}]\<close>
+    for \<phi> \<psi> w using that unfolding lambda_denotes_simp by auto
+  moreover have \<open>[w \<Turnstile> \<Pi>\<down>] \<Longrightarrow> exe \<Pi> \<kappa>s = Rep_rel \<Pi> \<kappa>s\<close> for \<Pi> \<kappa>s w
+    by (simp add: exe_def AOT_sem_denotes)
+  moreover have \<open>lambda (\<lambda>x. p) = lambda (\<lambda>x. q) \<Longrightarrow> p = q\<close> for p q
+    unfolding lambda_def
+    by (auto split: if_split_asm simp: Abs_rel_inject fix_irregular_def)
+       (meson AOT_model_irregular_nondenoting AOT_model_denoting_ex)+
+  moreover have \<open>AOT_model_term_equiv x y \<Longrightarrow> exe \<Pi> x = exe \<Pi> y\<close> for x y \<Pi>
+    unfolding exe_def
+    by (meson AOT_model_denotes_rel.rep_eq)
+  note calculation = calculation this
+  show ?thesis
+    apply (safe intro!: exI[where x=exe] exI[where x=lambda])
+    using calculation apply simp_all
+    using lambda_denotes_simp by blast+
+qed
+
+lemma AOT_model_lambda_denotes:
+  \<open>AOT_model_denotes (AOT_lambda \<phi>) = (\<forall> v \<kappa> \<kappa>' .
+    AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and> AOT_model_term_equiv \<kappa> \<kappa>' \<longrightarrow>
+    [v \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] = [v \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>])\<close>
+proof(safe)
+  fix v and \<kappa> \<kappa>' :: 'a
+  assume \<open>AOT_model_denotes (AOT_lambda \<phi>)\<close>
+  hence 1: \<open>AOT_model_denotes \<kappa>\<^sub>1\<kappa>\<^sub>n \<and>
+        AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n' \<and>
+        (\<forall>\<Pi> v. AOT_model_denotes \<Pi> \<longrightarrow> [v \<Turnstile> [\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n] = [v \<Turnstile> [\<Pi>]\<kappa>\<^sub>1'...\<kappa>\<^sub>n']) \<longrightarrow>
+        [v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}]\<close> for \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' v
+    using AOT_sem_lambda_denotes[simplified AOT_sem_denotes] by blast
+  {
+    fix v and \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' :: 'a
+    assume d: \<open>AOT_model_denotes \<kappa>\<^sub>1\<kappa>\<^sub>n \<and> AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n' \<and>
+               AOT_model_term_equiv \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close>
+    hence \<open>\<forall>\<Pi> w. AOT_model_denotes \<Pi> \<longrightarrow> [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<close>
+      by (metis AOT_sem_exe_equiv)
+    hence \<open>[v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}]\<close> using d 1 by auto
+  }
+  moreover assume \<open>AOT_model_denotes \<kappa>\<close>
+  moreover assume \<open>AOT_model_denotes \<kappa>'\<close>
+  moreover assume \<open>AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+  ultimately show \<open>[v \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>]\<close>
+              and \<open>[v \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>]\<close>
+    by auto
+next
+  assume 0: \<open>\<forall> v \<kappa> \<kappa>' . AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and>
+                        AOT_model_term_equiv \<kappa> \<kappa>' \<longrightarrow> [v \<Turnstile> \<guillemotleft>\<phi> \<kappa>\<guillemotright>] = [v \<Turnstile> \<guillemotleft>\<phi> \<kappa>'\<guillemotright>]\<close>
+  {
+    fix \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n' :: 'a
+    assume den: \<open>AOT_model_denotes \<kappa>\<^sub>1\<kappa>\<^sub>n\<close>
+    moreover assume den': \<open>AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close>
+    assume \<open>\<forall>\<Pi> v . AOT_model_denotes \<Pi> \<longrightarrow>
+                   [v \<Turnstile> [\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n] = [v \<Turnstile> [\<Pi>]\<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<close>
+    hence \<open>\<forall>\<Pi> v . AOT_model_denotes \<Pi> \<longrightarrow>
+                   [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<guillemotright>]\<close>
+      by (simp add: AOT_sem_denotes AOT_sem_exe den den')
+    hence "AOT_model_term_equiv \<kappa>\<^sub>1\<kappa>\<^sub>n \<kappa>\<^sub>1'\<kappa>\<^sub>n'"
+      unfolding AOT_model_term_equiv_rel_equiv[OF den, OF den']
+      by argo
+    hence \<open>[v \<Turnstile> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}] = [v \<Turnstile> \<phi>{\<kappa>\<^sub>1'...\<kappa>\<^sub>n'}]\<close> for v
+      using den den' 0 by blast
+  }
+  thus \<open>AOT_model_denotes (AOT_lambda \<phi>)\<close>
+    unfolding AOT_sem_lambda_denotes[simplified AOT_sem_denotes]
+    by blast
+qed
+
+specification (AOT_lambda0)
+  AOT_sem_lambda0: "AOT_lambda0 \<phi> = \<phi>"
+  by (rule exI[where x=\<open>\<lambda>x. x\<close>]) simp
+
+specification(AOT_concrete)
+  AOT_sem_concrete: \<open>[w \<Turnstile> [E!]\<kappa>] =
+                     AOT_model_concrete w \<kappa>\<close>
+  by (rule exI[where x=\<open>AOT_var_of_term (Abs_rel
+                          (\<lambda> x . \<epsilon>\<^sub>\<o> w . AOT_model_concrete w x))\<close>];
+      subst AOT_var_of_term_inverse)
+     (auto simp: AOT_model_unary_regular AOT_model_concrete_denotes
+                 AOT_model_concrete_equiv AOT_model_regular_\<kappa>_def
+                 AOT_model_proposition_choice_simp AOT_sem_exe Abs_rel_inverse
+                 AOT_model_denotes_rel_def AOT_sem_denotes)
+
+lemma AOT_sem_equiv_defI:
+  assumes \<open>\<And> v . [v \<Turnstile> \<phi>] \<Longrightarrow> [v \<Turnstile> \<psi>]\<close>
+      and \<open>\<And> v . [v \<Turnstile> \<psi>] \<Longrightarrow> [v \<Turnstile> \<phi>]\<close>
+    shows \<open>AOT_model_equiv_def \<phi> \<psi>\<close>
+  using AOT_model_equiv_def assms by blast
+
+lemma AOT_sem_id_defI:
+  assumes \<open>\<And> \<alpha> v . [v \<Turnstile> \<guillemotleft>\<sigma> \<alpha>\<guillemotright>\<down>] \<Longrightarrow> [v \<Turnstile> \<guillemotleft>\<tau> \<alpha>\<guillemotright> = \<guillemotleft>\<sigma> \<alpha>\<guillemotright>]\<close>
+  assumes \<open>\<And> \<alpha> v . \<not>[v \<Turnstile> \<guillemotleft>\<sigma> \<alpha>\<guillemotright>\<down>] \<Longrightarrow> [v \<Turnstile> \<not>\<guillemotleft>\<tau> \<alpha>\<guillemotright>\<down>]\<close>
+  shows \<open>AOT_model_id_def \<tau> \<sigma>\<close>
+  using assms
+  unfolding AOT_sem_denotes AOT_sem_eq AOT_sem_not
+  using AOT_model_id_def[THEN iffD2]
+  by metis
+
+lemma AOT_sem_id_def2I:
+  assumes \<open>\<And> \<alpha> \<beta> v . [v \<Turnstile> \<guillemotleft>\<sigma> \<alpha> \<beta>\<guillemotright>\<down>] \<Longrightarrow> [v \<Turnstile> \<guillemotleft>\<tau> \<alpha> \<beta>\<guillemotright> = \<guillemotleft>\<sigma> \<alpha> \<beta>\<guillemotright>]\<close>
+  assumes \<open>\<And> \<alpha> \<beta> v . \<not>[v \<Turnstile> \<guillemotleft>\<sigma> \<alpha> \<beta>\<guillemotright>\<down>] \<Longrightarrow> [v \<Turnstile> \<not>\<guillemotleft>\<tau> \<alpha> \<beta>\<guillemotright>\<down>]\<close>
+  shows \<open>AOT_model_id_def (case_prod \<tau>) (case_prod \<sigma>)\<close>
+  apply (rule AOT_sem_id_defI)
+  using assms by (auto simp: AOT_sem_conj AOT_sem_not AOT_sem_eq AOT_sem_denotes
+      AOT_model_denotes_prod_def)
+
+lemma AOT_sem_id_defE1:
+  assumes \<open>AOT_model_id_def \<tau> \<sigma>\<close>
+      and \<open>[v \<Turnstile> \<guillemotleft>\<sigma> \<alpha>\<guillemotright>\<down>]\<close>
+    shows \<open>[v \<Turnstile> \<guillemotleft>\<tau> \<alpha>\<guillemotright> = \<guillemotleft>\<sigma> \<alpha>\<guillemotright>]\<close>
+  using assms by (simp add: AOT_model_id_def AOT_sem_denotes AOT_sem_eq)
+
+lemma AOT_sem_id_defE2:
+  assumes \<open>AOT_model_id_def \<tau> \<sigma>\<close>
+      and \<open>\<not>[v \<Turnstile> \<guillemotleft>\<sigma> \<alpha>\<guillemotright>\<down>]\<close>
+    shows \<open>\<not>[v \<Turnstile> \<guillemotleft>\<tau> \<alpha>\<guillemotright>\<down>]\<close>
+  using assms by (simp add: AOT_model_id_def AOT_sem_denotes AOT_sem_eq)
+
+lemma AOT_sem_id_def0I:
+  assumes \<open>\<And> v . [v \<Turnstile> \<sigma>\<down>] \<Longrightarrow> [v \<Turnstile> \<tau> = \<sigma>]\<close>
+      and \<open>\<And> v . \<not>[v \<Turnstile> \<sigma>\<down>] \<Longrightarrow> [v \<Turnstile> \<not>\<tau>\<down>]\<close>
+  shows \<open>AOT_model_id_def (case_unit \<tau>) (case_unit \<sigma>)\<close>
+  apply (rule AOT_sem_id_defI)
+  using assms
+  by (simp_all add: AOT_sem_conj AOT_sem_eq AOT_sem_not AOT_sem_denotes
+                    AOT_model_denotes_unit_def case_unit_Unity)
+
+lemma AOT_sem_id_def0E1:
+  assumes \<open>AOT_model_id_def (case_unit \<tau>) (case_unit \<sigma>)\<close>
+      and \<open>[v \<Turnstile> \<sigma>\<down>]\<close>
+    shows \<open>[v \<Turnstile> \<tau> = \<sigma>]\<close>
+  by (metis (full_types) AOT_sem_id_defE1 assms(1) assms(2) case_unit_Unity)
+
+lemma AOT_sem_id_def0E2:
+  assumes \<open>AOT_model_id_def (case_unit \<tau>) (case_unit \<sigma>)\<close>
+      and \<open>\<not>[v \<Turnstile> \<sigma>\<down>]\<close>
+    shows \<open>\<not>[v \<Turnstile> \<tau>\<down>]\<close>
+  by (metis AOT_sem_id_defE2 assms(1) assms(2) case_unit_Unity)
+
+lemma AOT_sem_id_def0E3:
+  assumes \<open>AOT_model_id_def (case_unit \<tau>) (case_unit \<sigma>)\<close>
+      and \<open>[v \<Turnstile> \<sigma>\<down>]\<close>
+    shows \<open>[v \<Turnstile> \<tau>\<down>]\<close>
+  using AOT_sem_id_def0E1[OF assms]
+  by (simp add: AOT_sem_eq AOT_sem_denotes)
+
+lemma AOT_sem_ordinary_def_denotes: \<open>[w \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<down>]\<close>
+  unfolding AOT_sem_denotes AOT_model_lambda_denotes
+  by (auto simp: AOT_sem_dia AOT_model_concrete_equiv
+                 AOT_sem_concrete AOT_sem_denotes)
+lemma AOT_sem_abstract_def_denotes: \<open>[w \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<down>]\<close>
+  unfolding AOT_sem_denotes AOT_model_lambda_denotes
+  by (auto simp: AOT_sem_dia AOT_model_concrete_equiv
+                 AOT_sem_concrete AOT_sem_denotes AOT_sem_not)
+
+text\<open>Relation identity is constructed using an auxiliary abstract projection
+     mechanism with suitable instantiations for @{typ \<kappa>} and products.\<close>
+class AOT_RelationProjection = 
+  fixes AOT_sem_proj_id :: \<open>'a::AOT_IndividualTerm \<Rightarrow> ('a \<Rightarrow> \<o>) \<Rightarrow> ('a \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close>
+  assumes AOT_sem_proj_id_prop:
+    \<open>[v \<Turnstile> \<Pi> = \<Pi>'] =
+     [v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<forall>\<alpha> (\<guillemotleft>AOT_sem_proj_id \<alpha> (\<lambda> \<tau> . \<guillemotleft>[\<Pi>]\<tau>\<guillemotright>) (\<lambda> \<tau> . \<guillemotleft>[\<Pi>']\<tau>\<guillemotright>)\<guillemotright>)]\<close>
+      and AOT_sem_proj_id_refl:
+    \<open>[v \<Turnstile> \<tau>\<down>] \<Longrightarrow> [v \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]] \<Longrightarrow>
+     [v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<tau> \<phi> \<phi>\<guillemotright>]\<close>
+
+class AOT_UnaryRelationProjection = AOT_RelationProjection +
+  assumes AOT_sem_unary_proj_id:
+    \<open>AOT_sem_proj_id \<kappa> \<phi> \<psi> = \<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<guillemotright>\<close>
+
+instantiation \<kappa> :: AOT_UnaryRelationProjection
+begin
+definition AOT_sem_proj_id_\<kappa> :: \<open>\<kappa> \<Rightarrow> (\<kappa> \<Rightarrow> \<o>) \<Rightarrow> (\<kappa> \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close> where
+  \<open>AOT_sem_proj_id_\<kappa> \<kappa> \<phi> \<psi> = \<guillemotleft>[\<lambda>z \<phi>{z}] = [\<lambda>z \<psi>{z}]\<guillemotright>\<close>
+instance proof
+  show \<open>[v \<Turnstile> \<Pi> = \<Pi>'] =
+        [v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<forall>\<alpha> (\<guillemotleft>AOT_sem_proj_id \<alpha> (\<lambda> \<tau> . \<guillemotleft>[\<Pi>]\<tau>\<guillemotright>) (\<lambda> \<tau> . \<guillemotleft>[\<Pi>']\<tau>\<guillemotright>)\<guillemotright>)]\<close>
+    for v and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+    unfolding AOT_sem_proj_id_\<kappa>_def
+    by (simp add: AOT_sem_eq AOT_sem_conj AOT_sem_denotes AOT_sem_forall)
+       (metis AOT_sem_denotes AOT_model_denoting_ex AOT_sem_eq AOT_sem_lambda_eta)
+next
+  show \<open>AOT_sem_proj_id \<kappa> \<phi> \<psi> = \<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<psi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<guillemotright>\<close>
+    for \<kappa> :: \<kappa> and \<phi> \<psi>
+    unfolding AOT_sem_proj_id_\<kappa>_def ..
+next
+  show \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<tau> \<phi> \<phi>\<guillemotright>]\<close>
+    if \<open>[v \<Turnstile> \<tau>\<down>]\<close> and \<open>[v \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}] = [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]]\<close>
+    for \<tau> :: \<kappa> and v \<phi>
+    using that by (simp add: AOT_sem_proj_id_\<kappa>_def AOT_sem_eq)
+qed
+end
+
+instantiation prod ::
+  ("{AOT_UnaryRelationProjection, AOT_UnaryIndividualTerm}", AOT_RelationProjection)
+  AOT_RelationProjection
+begin
+definition AOT_sem_proj_id_prod :: \<open>'a\<times>'b \<Rightarrow> ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close> where
+  \<open>AOT_sem_proj_id_prod \<equiv> \<lambda> (x,y) \<phi> \<psi> . \<guillemotleft>[\<lambda>z \<guillemotleft>\<phi> (z,y)\<guillemotright>] = [\<lambda>z \<guillemotleft>\<psi> (z,y)\<guillemotright>] &
+    \<guillemotleft>AOT_sem_proj_id y (\<lambda> a . \<phi> (x,a)) (\<lambda> a . \<psi> (x,a))\<guillemotright>\<guillemotright>\<close>
+instance proof
+  text\<open>This is the main proof that allows to derive the definition of n-ary
+       relation identity. We need to show that our defined projection identity
+       implies relation identity for relations on pairs of individual terms.\<close>
+  fix v and \<Pi> \<Pi>' :: \<open><'a\<times>'b>\<close>
+  have AOT_meta_proj_denotes1: \<open>AOT_model_denotes (Abs_rel (\<lambda>z. AOT_exe \<Pi> (z, \<beta>)))\<close>
+    if \<open>AOT_model_denotes \<Pi>\<close> for \<Pi> :: \<open><'a\<times>'b>\<close> and \<beta>
+    using that unfolding AOT_model_denotes_rel.rep_eq
+    apply (simp add: Abs_rel_inverse AOT_meta_prod_equivI(2) AOT_sem_denotes
+                      that)
+    by (metis (no_types, lifting) AOT_meta_prod_equivI(2) AOT_model_denotes_prod_def
+              AOT_model_unary_regular AOT_sem_exe AOT_sem_exe_equiv case_prodD)
+  {
+    fix \<kappa> :: 'a and \<Pi> :: \<open><'a\<times>'b>\<close>
+    assume \<Pi>_denotes: \<open>AOT_model_denotes \<Pi>\<close>
+    assume \<alpha>_denotes: \<open>AOT_model_denotes \<kappa>\<close>
+    hence \<open>AOT_exe \<Pi> (\<kappa>, x) = AOT_exe \<Pi> (\<kappa>, y)\<close>
+      if \<open>AOT_model_term_equiv x y\<close> for x y :: 'b
+      by (simp add: AOT_meta_prod_equivI(1) AOT_sem_exe_equiv that)
+    moreover have \<open>AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close>
+               if \<open>[w \<Turnstile> [\<Pi>]\<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<close> for w \<kappa>\<^sub>1'\<kappa>\<^sub>n'
+      by (metis that AOT_model_denotes_prod_def AOT_sem_exe
+                AOT_sem_denotes case_prodD)
+    moreover {
+      fix x :: 'b
+      assume x_irregular: \<open>\<not>AOT_model_regular x\<close>
+      hence prod_irregular: \<open>\<not>AOT_model_regular (\<kappa>, x)\<close>
+        by (metis (no_types, lifting) AOT_model_irregular_nondenoting
+                                      AOT_model_regular_prod_def case_prodD)
+      hence \<open>(\<not>AOT_model_denotes \<kappa> \<or> \<not>AOT_model_regular x) \<and>
+             (AOT_model_denotes \<kappa> \<or> \<not>AOT_model_denotes x)\<close>
+        unfolding AOT_model_regular_prod_def by blast
+      hence x_nonden: \<open>\<not>AOT_model_regular x\<close>
+        by (simp add: \<alpha>_denotes)
+      have \<open>Rep_rel \<Pi> (\<kappa>, x) = AOT_model_irregular (Rep_rel \<Pi>) (\<kappa>, x)\<close>
+        using AOT_model_denotes_rel.rep_eq \<Pi>_denotes prod_irregular by blast
+      moreover have \<open>AOT_model_irregular (Rep_rel \<Pi>) (\<kappa>, x) =
+                     AOT_model_irregular (\<lambda>z. Rep_rel \<Pi> (\<kappa>, z)) x\<close>
+        using \<Pi>_denotes x_irregular prod_irregular x_nonden
+        using AOT_model_irregular_prod_generic
+        apply (induct arbitrary: \<Pi> x rule: AOT_model_irregular_prod.induct)
+        by (auto simp: \<alpha>_denotes AOT_model_irregular_nondenoting
+                       AOT_model_regular_prod_def AOT_meta_prod_equivI(2)
+                       AOT_model_denotes_rel.rep_eq AOT_model_term_equiv_eps(1)
+                 intro!: AOT_model_irregular_eqI)
+      ultimately have
+        \<open>AOT_exe \<Pi> (\<kappa>, x) = AOT_model_irregular (\<lambda>z. AOT_exe \<Pi> (\<kappa>, z)) x\<close>
+        unfolding AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>_denotes]
+        by auto
+    }
+    ultimately have \<open>AOT_model_denotes (Abs_rel (\<lambda>z. AOT_exe \<Pi> (\<kappa>, z)))\<close>
+      by (simp add: Abs_rel_inverse AOT_model_denotes_rel.rep_eq)
+  } note AOT_meta_proj_denotes2 = this
+  {
+    fix \<kappa>\<^sub>1'\<kappa>\<^sub>n' :: 'b and \<Pi> :: \<open><'a\<times>'b>\<close>
+    assume \<Pi>_denotes: \<open>AOT_model_denotes \<Pi>\<close>
+    assume \<beta>_denotes: \<open>AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close>
+    hence \<open>AOT_exe \<Pi> (x, \<kappa>\<^sub>1'\<kappa>\<^sub>n') = AOT_exe \<Pi> (y, \<kappa>\<^sub>1'\<kappa>\<^sub>n')\<close>
+      if \<open>AOT_model_term_equiv x y\<close> for x y :: 'a
+      by (simp add: AOT_meta_prod_equivI(2) AOT_sem_exe_equiv that)
+    moreover have \<open>AOT_model_denotes \<kappa>\<close>
+               if \<open>[w \<Turnstile> [\<Pi>]\<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<close> for w \<kappa>
+      by (metis that AOT_model_denotes_prod_def AOT_sem_exe
+                AOT_sem_denotes case_prodD)
+    moreover {
+      fix x :: 'a
+      assume \<open>\<not>AOT_model_regular x\<close>
+      hence \<open>False\<close>
+        using AOT_model_unary_regular by blast
+      hence
+        \<open>AOT_exe \<Pi> (x,\<kappa>\<^sub>1'\<kappa>\<^sub>n') = AOT_model_irregular (\<lambda>z. AOT_exe \<Pi> (z,\<kappa>\<^sub>1'\<kappa>\<^sub>n')) x\<close>
+        unfolding AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>_denotes]
+        by auto
+    }
+    ultimately have \<open>AOT_model_denotes (Abs_rel (\<lambda>z. AOT_exe \<Pi> (z,\<kappa>\<^sub>1'\<kappa>\<^sub>n')))\<close>
+      by (simp add: Abs_rel_inverse AOT_model_denotes_rel.rep_eq)
+  } note AOT_meta_proj_denotes1 = this
+  {
+    assume \<Pi>_denotes: \<open>AOT_model_denotes \<Pi>\<close>
+    assume \<Pi>'_denotes: \<open>AOT_model_denotes \<Pi>'\<close>
+    have \<Pi>_proj2_den: \<open>AOT_model_denotes (Abs_rel (\<lambda>z. Rep_rel \<Pi> (\<alpha>, z)))\<close>
+      if \<open>AOT_model_denotes \<alpha>\<close> for \<alpha>
+      using that AOT_meta_proj_denotes2[OF \<Pi>_denotes]
+            AOT_sem_exe_denoting[simplified AOT_sem_denotes,OF \<Pi>_denotes] by simp
+    have \<Pi>'_proj2_den: \<open>AOT_model_denotes (Abs_rel (\<lambda>z. Rep_rel \<Pi>' (\<alpha>, z)))\<close>
+      if \<open>AOT_model_denotes \<alpha>\<close> for \<alpha>
+      using that AOT_meta_proj_denotes2[OF \<Pi>'_denotes]
+            AOT_sem_exe_denoting[simplified AOT_sem_denotes,OF \<Pi>'_denotes] by simp
+    have \<Pi>_proj1_den: \<open>AOT_model_denotes (Abs_rel (\<lambda>z. Rep_rel \<Pi> (z, \<alpha>)))\<close>
+      if \<open>AOT_model_denotes \<alpha>\<close> for \<alpha>
+      using that AOT_meta_proj_denotes1[OF \<Pi>_denotes]
+            AOT_sem_exe_denoting[simplified AOT_sem_denotes,OF \<Pi>_denotes] by simp
+    have \<Pi>'_proj1_den: \<open>AOT_model_denotes (Abs_rel (\<lambda>z. Rep_rel \<Pi>' (z, \<alpha>)))\<close>
+      if \<open>AOT_model_denotes \<alpha>\<close> for \<alpha>
+      using that AOT_meta_proj_denotes1[OF \<Pi>'_denotes]
+            AOT_sem_exe_denoting[simplified AOT_sem_denotes,OF \<Pi>'_denotes] by simp
+    {
+      fix \<kappa> :: 'a and \<kappa>\<^sub>1'\<kappa>\<^sub>n' :: 'b
+      assume \<open>\<Pi> = \<Pi>'\<close>
+      assume \<open>AOT_model_denotes (\<kappa>,\<kappa>\<^sub>1'\<kappa>\<^sub>n')\<close>
+      hence \<open>AOT_model_denotes \<kappa>\<close> and beta_denotes: \<open>AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close>
+        by (auto simp: AOT_model_denotes_prod_def)
+      have \<open>AOT_model_denotes \<guillemotleft>[\<lambda>z [\<Pi>]z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright>\<close>
+        by (rule AOT_model_lambda_denotes[THEN iffD2])
+           (metis AOT_sem_exe_denoting AOT_meta_prod_equivI(2)
+                  AOT_model_denotes_rel.rep_eq AOT_sem_denotes
+                  AOT_sem_exe_denoting \<Pi>_denotes)
+      moreover have \<open>\<guillemotleft>[\<lambda>z [\<Pi>]z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright> = \<guillemotleft>[\<lambda>z [\<Pi>']z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright>\<close>
+        by (simp add: \<open>\<Pi> = \<Pi>'\<close>)
+      moreover have \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<kappa>\<^sub>1'\<kappa>\<^sub>n' (\<lambda>\<kappa>\<^sub>1'\<kappa>\<^sub>n'. \<guillemotleft>[\<Pi>]\<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<guillemotright>)
+                                                  (\<lambda>\<kappa>\<^sub>1'\<kappa>\<^sub>n'. \<guillemotleft>[\<Pi>']\<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<guillemotright>)\<guillemotright>]\<close>
+        unfolding \<open>\<Pi> = \<Pi>'\<close> using beta_denotes
+        by (rule AOT_sem_proj_id_refl[unfolded AOT_sem_denotes];
+            simp add: AOT_sem_denotes AOT_sem_eq AOT_model_lambda_denotes)
+           (metis AOT_meta_prod_equivI(1) AOT_model_denotes_rel.rep_eq
+                  AOT_sem_exe AOT_sem_exe_denoting \<Pi>'_denotes)
+      ultimately have \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_proj_id (\<kappa>,\<kappa>\<^sub>1'\<kappa>\<^sub>n') (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)
+                                                         (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>']\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>]\<close>
+        unfolding AOT_sem_proj_id_prod_def
+        by (simp add: AOT_sem_denotes AOT_sem_conj AOT_sem_eq)
+    }
+    moreover {
+      assume \<open>\<And> \<alpha> . AOT_model_denotes \<alpha> \<Longrightarrow>
+        [v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<alpha> (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>) (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>']\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>]\<close>
+      hence 0: \<open>AOT_model_denotes \<kappa> \<Longrightarrow> AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n' \<Longrightarrow>
+             AOT_model_denotes \<guillemotleft>[\<lambda>z [\<Pi>]z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright> \<and>
+             AOT_model_denotes \<guillemotleft>[\<lambda>z [\<Pi>']z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright> \<and>
+             \<guillemotleft>[\<lambda>z [\<Pi>]z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright> = \<guillemotleft>[\<lambda>z [\<Pi>']z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright> \<and>
+             [v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<kappa>\<^sub>1'\<kappa>\<^sub>n' (\<lambda>\<kappa>\<^sub>1\<kappa>\<^sub>n. \<guillemotleft>[\<Pi>]\<kappa> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)
+                                          (\<lambda>\<kappa>\<^sub>1\<kappa>\<^sub>n. \<guillemotleft>[\<Pi>']\<kappa> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>]\<close> for \<kappa> \<kappa>\<^sub>1'\<kappa>\<^sub>n'
+        unfolding AOT_sem_proj_id_prod_def
+        by (auto simp: AOT_sem_denotes AOT_sem_conj AOT_sem_eq
+                       AOT_model_denotes_prod_def)
+      obtain \<alpha>den :: 'a and \<beta>den :: 'b where
+        \<alpha>den: \<open>AOT_model_denotes \<alpha>den\<close> and \<beta>den: \<open>AOT_model_denotes \<beta>den\<close>
+        using AOT_model_denoting_ex by metis
+      {
+        fix \<kappa> :: 'a
+        assume \<alpha>denotes: \<open>AOT_model_denotes \<kappa>\<close>
+        have 1: \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<kappa>\<^sub>1'\<kappa>\<^sub>n' (\<lambda>\<kappa>\<^sub>1'\<kappa>\<^sub>n'. \<guillemotleft>[\<Pi>]\<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<guillemotright>)
+                                              (\<lambda>\<kappa>\<^sub>1'\<kappa>\<^sub>n'. \<guillemotleft>[\<Pi>']\<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<guillemotright>)\<guillemotright>]\<close>
+          if \<open>AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close> for \<kappa>\<^sub>1'\<kappa>\<^sub>n'
+          using that 0 using \<alpha>denotes by blast
+        hence \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<beta> (\<lambda>z. Rep_rel \<Pi> (\<kappa>, z))
+                                        (\<lambda>z. Rep_rel \<Pi>' (\<kappa>, z))\<guillemotright>]\<close>
+          if \<open>AOT_model_denotes \<beta>\<close> for \<beta>
+          using that
+          unfolding AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>_denotes]
+                    AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>'_denotes]
+          by blast
+        hence \<open>Abs_rel (\<lambda>z. Rep_rel \<Pi> (\<kappa>, z)) = Abs_rel (\<lambda>z. Rep_rel \<Pi>' (\<kappa>, z))\<close>
+          using AOT_sem_proj_id_prop[of v \<open>Abs_rel (\<lambda>z. Rep_rel \<Pi> (\<kappa>, z))\<close>
+                                          \<open>Abs_rel (\<lambda>z. Rep_rel \<Pi>' (\<kappa>, z))\<close>,
+                  simplified AOT_sem_eq AOT_sem_conj AOT_sem_forall
+                             AOT_sem_denotes, THEN iffD2]
+                \<Pi>_proj2_den[OF \<alpha>denotes] \<Pi>'_proj2_den[OF \<alpha>denotes]
+          unfolding AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>_denotes]
+                    AOT_sem_exe_denoting[simplified AOT_sem_denotes,
+                                         OF \<Pi>_proj2_den[OF \<alpha>denotes]]
+                    AOT_sem_exe_denoting[simplified AOT_sem_denotes,
+                                         OF \<Pi>'_proj2_den[OF \<alpha>denotes]]
+          by (metis Abs_rel_inverse UNIV_I)
+        hence "Rep_rel \<Pi> (\<kappa>,\<beta>) = Rep_rel \<Pi>' (\<kappa>,\<beta>)" for \<beta>
+          by (simp add: Abs_rel_inject[simplified]) meson
+      } note \<alpha>denotes = this
+      {
+        fix \<kappa>\<^sub>1'\<kappa>\<^sub>n' :: 'b
+        assume \<beta>den: \<open>AOT_model_denotes \<kappa>\<^sub>1'\<kappa>\<^sub>n'\<close>
+        have 1: \<open>\<guillemotleft>[\<lambda>z [\<Pi>]z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright> = \<guillemotleft>[\<lambda>z [\<Pi>']z \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright>\<close>
+          using 0 \<beta>den AOT_model_denoting_ex by blast
+        hence \<open>Abs_rel (\<lambda>z. Rep_rel \<Pi> (z, \<kappa>\<^sub>1'\<kappa>\<^sub>n')) =
+               Abs_rel (\<lambda>z. Rep_rel \<Pi>' (z, \<kappa>\<^sub>1'\<kappa>\<^sub>n'))\<close> (is \<open>?a = ?b\<close>)
+          apply (safe intro!: AOT_sem_proj_id_prop[of v \<open>?a\<close> \<open>?b\<close>,
+                  simplified AOT_sem_eq AOT_sem_conj AOT_sem_forall
+                  AOT_sem_denotes, THEN iffD2, THEN conjunct2, THEN conjunct2]
+                  \<Pi>_proj1_den[OF \<beta>den] \<Pi>'_proj1_den[OF \<beta>den])
+          unfolding AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>_denotes]
+                    AOT_sem_exe_denoting[simplified AOT_sem_denotes, OF \<Pi>'_denotes]
+                    AOT_sem_exe_denoting[simplified AOT_sem_denotes,
+                                         OF \<Pi>_proj1_den[OF \<beta>den]]
+                    AOT_sem_exe_denoting[simplified AOT_sem_denotes,
+                                         OF \<Pi>'_proj1_den[OF \<beta>den]]
+          by (subst (0 1) Abs_rel_inverse; simp?)
+             (metis (no_types, lifting) AOT_model_denotes_rel.abs_eq
+                            AOT_model_lambda_denotes AOT_sem_denotes AOT_sem_eq
+                            AOT_sem_unary_proj_id \<Pi>_proj1_den[OF \<beta>den])
+        hence \<open>Rep_rel \<Pi> (x,\<kappa>\<^sub>1'\<kappa>\<^sub>n') = Rep_rel \<Pi>' (x,\<kappa>\<^sub>1'\<kappa>\<^sub>n')\<close> for x
+          by (simp add: Abs_rel_inject)
+             metis
+      } note \<beta>denotes = this
+      {
+        fix \<alpha> :: 'a and \<beta> :: 'b
+        assume \<open>AOT_model_regular (\<alpha>, \<beta>)\<close>
+        moreover {
+          assume \<open>AOT_model_denotes \<alpha> \<and> AOT_model_regular \<beta>\<close>
+          hence \<open>Rep_rel \<Pi> (\<alpha>,\<beta>) = Rep_rel \<Pi>' (\<alpha>,\<beta>)\<close>
+            using \<alpha>denotes by presburger
+        }
+        moreover {
+          assume \<open>\<not>AOT_model_denotes \<alpha> \<and> AOT_model_denotes \<beta>\<close>
+          hence \<open>Rep_rel \<Pi> (\<alpha>,\<beta>) = Rep_rel \<Pi>' (\<alpha>,\<beta>)\<close>
+            by (simp add: \<beta>denotes)
+        }
+        ultimately have \<open>Rep_rel \<Pi> (\<alpha>,\<beta>) = Rep_rel \<Pi>' (\<alpha>,\<beta>)\<close>
+          by (metis (no_types, lifting) AOT_model_regular_prod_def case_prodD)
+      }
+      hence \<open>Rep_rel \<Pi> = Rep_rel \<Pi>'\<close>
+        using \<Pi>_denotes[unfolded AOT_model_denotes_rel.rep_eq,
+                        THEN conjunct2, THEN conjunct2, THEN spec, THEN mp]
+        using \<Pi>'_denotes[unfolded AOT_model_denotes_rel.rep_eq,
+                         THEN conjunct2, THEN conjunct2, THEN spec, THEN mp]
+        using AOT_model_irregular_eqI[of \<open>Rep_rel \<Pi>\<close> \<open>Rep_rel \<Pi>'\<close> \<open>(_,_)\<close>]
+        using AOT_model_irregular_nondenoting by fastforce
+      hence \<open>\<Pi> = \<Pi>'\<close>
+        by (rule Rep_rel_inject[THEN iffD1])
+    }
+    ultimately have \<open>\<Pi> = \<Pi>' = (\<forall> \<kappa> . AOT_model_denotes \<kappa> \<longrightarrow>
+        [v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<kappa> (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)
+                                (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>']\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>])\<close>
+      by auto
+  }
+  thus \<open>[v \<Turnstile> \<Pi> = \<Pi>'] = [v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> &
+      \<forall>\<alpha> (\<guillemotleft>AOT_sem_proj_id \<alpha> (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>) (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n . \<guillemotleft>[\<Pi>']\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>)]\<close>
+    by (auto simp: AOT_sem_eq AOT_sem_denotes AOT_sem_forall AOT_sem_conj)
+next
+  fix v and \<phi> :: \<open>'a\<times>'b\<Rightarrow>\<o>\<close> and \<tau> :: \<open>'a\<times>'b\<close>
+  assume \<open>[v \<Turnstile> \<tau>\<down>]\<close>
+  moreover assume \<open>[v \<Turnstile> [\<lambda>z\<^sub>1...z\<^sub>n \<guillemotleft>\<phi> z\<^sub>1z\<^sub>n\<guillemotright>] = [\<lambda>z\<^sub>1...z\<^sub>n \<guillemotleft>\<phi> z\<^sub>1z\<^sub>n\<guillemotright>]]\<close>
+  ultimately show \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_proj_id \<tau> \<phi> \<phi>\<guillemotright>]\<close>
+    unfolding AOT_sem_proj_id_prod_def
+    using AOT_sem_proj_id_refl[of v "snd \<tau>" "\<lambda>b. \<phi> (fst \<tau>, b)"]
+    by (auto simp: AOT_sem_eq AOT_sem_conj AOT_sem_denotes
+                   AOT_model_denotes_prod_def AOT_model_lambda_denotes
+                   AOT_meta_prod_equivI)
+qed
+end
+
+text\<open>Sanity-check to verify that n-ary relation identity follows.\<close>
+lemma \<open>[v \<Turnstile> \<Pi> = \<Pi>'] = [v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<forall>x\<forall>y([\<lambda>z [\<Pi>]z y] = [\<lambda>z [\<Pi>']z y] &
+                                              [\<lambda>z [\<Pi>]x z] = [\<lambda>z [\<Pi>']x z])]\<close>
+  for \<Pi> :: \<open><\<kappa>\<times>\<kappa>>\<close>
+  by (auto simp: AOT_sem_proj_id_prop[of v \<Pi> \<Pi>'] AOT_sem_proj_id_prod_def
+                 AOT_sem_conj AOT_sem_denotes AOT_sem_forall AOT_sem_unary_proj_id
+                 AOT_model_denotes_prod_def)
+lemma \<open>[v \<Turnstile> \<Pi> = \<Pi>'] = [v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<forall>x\<^sub>1\<forall>x\<^sub>2\<forall>x\<^sub>3 (
+  [\<lambda>z [\<Pi>]z x\<^sub>2 x\<^sub>3] = [\<lambda>z [\<Pi>']z x\<^sub>2 x\<^sub>3] &
+  [\<lambda>z [\<Pi>]x\<^sub>1 z x\<^sub>3] = [\<lambda>z [\<Pi>']x\<^sub>1 z x\<^sub>3] &
+  [\<lambda>z [\<Pi>]x\<^sub>1 x\<^sub>2 z] = [\<lambda>z [\<Pi>']x\<^sub>1 x\<^sub>2 z])]\<close>
+  for \<Pi> :: \<open><\<kappa>\<times>\<kappa>\<times>\<kappa>>\<close>
+  by (auto simp: AOT_sem_proj_id_prop[of v \<Pi> \<Pi>'] AOT_sem_proj_id_prod_def
+                 AOT_sem_conj AOT_sem_denotes AOT_sem_forall AOT_sem_unary_proj_id
+                 AOT_model_denotes_prod_def)
+lemma \<open>[v \<Turnstile> \<Pi> = \<Pi>'] = [v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<forall>x\<^sub>1\<forall>x\<^sub>2\<forall>x\<^sub>3\<forall>x\<^sub>4 (
+    [\<lambda>z [\<Pi>]z x\<^sub>2 x\<^sub>3 x\<^sub>4] = [\<lambda>z [\<Pi>']z x\<^sub>2 x\<^sub>3 x\<^sub>4] &
+    [\<lambda>z [\<Pi>]x\<^sub>1 z x\<^sub>3 x\<^sub>4] = [\<lambda>z [\<Pi>']x\<^sub>1 z x\<^sub>3 x\<^sub>4] &
+    [\<lambda>z [\<Pi>]x\<^sub>1 x\<^sub>2 z x\<^sub>4] = [\<lambda>z [\<Pi>']x\<^sub>1 x\<^sub>2 z x\<^sub>4] &
+    [\<lambda>z [\<Pi>]x\<^sub>1 x\<^sub>2 x\<^sub>3 z] = [\<lambda>z [\<Pi>']x\<^sub>1 x\<^sub>2 x\<^sub>3 z])]\<close>
+  for \<Pi> :: \<open><\<kappa>\<times>\<kappa>\<times>\<kappa>\<times>\<kappa>>\<close>
+  by (auto simp: AOT_sem_proj_id_prop[of v \<Pi> \<Pi>'] AOT_sem_proj_id_prod_def
+                 AOT_sem_conj AOT_sem_denotes AOT_sem_forall AOT_sem_unary_proj_id
+                 AOT_model_denotes_prod_def)
+
+text\<open>n-ary Encoding is constructed using a similar mechanism as n-ary relation
+     identity using an auxiliary notion of projection-encoding.\<close>
+class AOT_Enc =
+  fixes AOT_enc :: \<open>'a \<Rightarrow> <'a::AOT_IndividualTerm> \<Rightarrow> \<o>\<close>
+    and AOT_proj_enc :: \<open>'a \<Rightarrow> ('a \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close>
+  assumes AOT_sem_enc_denotes:
+    \<open>[v \<Turnstile> \<guillemotleft>AOT_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<Pi>\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> [v \<Turnstile> \<Pi>\<down>]\<close>
+  assumes AOT_sem_enc_proj_enc:
+    \<open>[v \<Turnstile> \<guillemotleft>AOT_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<Pi>\<guillemotright>] =
+     [v \<Turnstile> \<Pi>\<down> & \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n.  \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>]\<close>
+  assumes AOT_sem_proj_enc_denotes:
+    \<open>[v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>]\<close>
+  assumes AOT_sem_enc_nec:
+    \<open>[v \<Turnstile> \<guillemotleft>AOT_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<Pi>\<guillemotright>] \<Longrightarrow> [w \<Turnstile> \<guillemotleft>AOT_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<Pi>\<guillemotright>]\<close>
+  assumes AOT_sem_proj_enc_nec:
+    \<open>[v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>] \<Longrightarrow> [w \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>]\<close>
+  assumes AOT_sem_universal_encoder:
+    \<open>\<exists> \<kappa>\<^sub>1\<kappa>\<^sub>n. [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> (\<forall> \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<guillemotleft>AOT_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<Pi>\<guillemotright>]) \<and>
+             (\<forall> \<phi> . [v \<Turnstile> [\<lambda>z\<^sub>1...z\<^sub>n \<phi>{z\<^sub>1...z\<^sub>n}]\<down>] \<longrightarrow> [v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>])\<close>
+
+AOT_syntax_print_translations
+  "_AOT_enc (_AOT_individual_term \<kappa>) (_AOT_relation_term \<Pi>)" <= "CONST AOT_enc \<kappa> \<Pi>"
+
+context AOT_meta_syntax
+begin
+notation AOT_enc ("\<^bold>\<lbrace>_,_\<^bold>\<rbrace>")
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_enc ("\<^bold>\<lbrace>_,_\<^bold>\<rbrace>")
+end
+
+text\<open>Unary encoding additionally has to satisfy the axioms of unary encoding and
+     the definition of property identity.\<close>
+class AOT_UnaryEnc = AOT_UnaryIndividualTerm +
+  assumes AOT_sem_enc_eq: \<open>[v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<box>\<forall>\<nu> (\<nu>[\<Pi>] \<equiv> \<nu>[\<Pi>']) \<rightarrow> \<Pi> = \<Pi>']\<close>
+      and AOT_sem_A_objects: \<open>[v \<Turnstile> \<exists>x (\<not>\<diamond>[E!]x & \<forall>F (x[F] \<equiv> \<phi>{F}))]\<close>
+      and AOT_sem_unary_proj_enc: \<open>AOT_proj_enc x \<psi> = AOT_enc x \<guillemotleft>[\<lambda>z \<psi>{z}]\<guillemotright>\<close>
+      and AOT_sem_nocoder: \<open>[v \<Turnstile> [E!]\<kappa>] \<Longrightarrow> \<not>[w \<Turnstile> \<guillemotleft>AOT_enc \<kappa> \<Pi>\<guillemotright>]\<close>
+      and AOT_sem_ind_eq: \<open>([v \<Turnstile> \<kappa>\<down>] \<and> [v \<Turnstile> \<kappa>'\<down>] \<and> \<kappa> = (\<kappa>')) =
+       (([v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>] \<and>
+         [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>'] \<and>
+         (\<forall> v \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> [\<Pi>]\<kappa>] = [v \<Turnstile> [\<Pi>]\<kappa>']))
+        \<or> ([v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>] \<and>
+           [v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>'] \<and>
+           (\<forall> v \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<kappa>[\<Pi>]] = [v \<Turnstile> \<kappa>'[\<Pi>]])))\<close>
+
+      (* only extended models *)
+      and AOT_sem_enc_indistinguishable_all:
+          \<open>AOT_ExtendedModel \<Longrightarrow>
+           [v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>] \<Longrightarrow>
+           [v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>'] \<Longrightarrow>
+           (\<And> \<Pi>' . [v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow> (\<And> w . [w \<Turnstile> [\<Pi>']\<kappa>] = [w \<Turnstile> [\<Pi>']\<kappa>'])) \<Longrightarrow>
+           [v \<Turnstile> \<Pi>\<down>] \<Longrightarrow>
+           (\<And> \<Pi>' . [v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow> (\<And> \<kappa>\<^sub>0 . [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<Longrightarrow>
+              (\<And> w . [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0])) \<Longrightarrow> [v \<Turnstile> \<kappa>[\<Pi>']]) \<Longrightarrow>
+           (\<And> \<Pi>' . [v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow> (\<And> \<kappa>\<^sub>0 . [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<Longrightarrow>
+              (\<And> w . [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0])) \<Longrightarrow> [v \<Turnstile> \<kappa>'[\<Pi>']])\<close>
+      and AOT_sem_enc_indistinguishable_ex:
+          \<open>AOT_ExtendedModel \<Longrightarrow>
+           [v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>] \<Longrightarrow>
+           [v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>'] \<Longrightarrow>
+           (\<And> \<Pi>' . [v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow> (\<And> w . [w \<Turnstile> [\<Pi>']\<kappa>] = [w \<Turnstile> [\<Pi>']\<kappa>'])) \<Longrightarrow>
+           [v \<Turnstile> \<Pi>\<down>] \<Longrightarrow>
+           \<exists> \<Pi>' . [v \<Turnstile> \<Pi>'\<down>] \<and> [v \<Turnstile> \<kappa>[\<Pi>']] \<and>
+                  (\<forall> \<kappa>\<^sub>0 . [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<longrightarrow>
+                          (\<forall> w . [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0])) \<Longrightarrow>
+           \<exists> \<Pi>' . [v \<Turnstile> \<Pi>'\<down>] \<and> [v \<Turnstile> \<kappa>'[\<Pi>']] \<and>
+                  (\<forall> \<kappa>\<^sub>0 . [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<longrightarrow>
+                          (\<forall> w . [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]))\<close>
+
+text\<open>We specify encoding to align with the model-construction of encoding.\<close>
+consts AOT_sem_enc_\<kappa> :: \<open>\<kappa> \<Rightarrow> <\<kappa>> \<Rightarrow> \<o>\<close>
+specification(AOT_sem_enc_\<kappa>)
+  AOT_sem_enc_\<kappa>:
+  \<open>[v \<Turnstile> \<guillemotleft>AOT_sem_enc_\<kappa> \<kappa> \<Pi>\<guillemotright>] =
+   (AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<Pi> \<and> AOT_model_enc \<kappa> \<Pi>)\<close>
+  by (rule exI[where x=\<open>\<lambda> \<kappa> \<Pi> . \<epsilon>\<^sub>\<o> w . AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<Pi> \<and>
+                                       AOT_model_enc \<kappa> \<Pi>\<close>])
+     (simp add: AOT_model_proposition_choice_simp AOT_model_enc_\<kappa>_def \<kappa>.case_eq_if)
+
+text\<open>We show that @{typ \<kappa>} satisfies the generic properties of n-ary encoding.\<close>
+instantiation \<kappa> :: AOT_Enc
+begin
+definition AOT_enc_\<kappa> :: \<open>\<kappa> \<Rightarrow> <\<kappa>> \<Rightarrow> \<o>\<close> where
+  \<open>AOT_enc_\<kappa> \<equiv> AOT_sem_enc_\<kappa>\<close>
+definition AOT_proj_enc_\<kappa> :: \<open>\<kappa> \<Rightarrow> (\<kappa> \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close> where
+  \<open>AOT_proj_enc_\<kappa> \<equiv> \<lambda> \<kappa> \<phi> . AOT_enc \<kappa> \<guillemotleft>[\<lambda>z \<guillemotleft>\<phi> z\<guillemotright>]\<guillemotright>\<close>
+lemma AOT_enc_\<kappa>_meta:
+  \<open>[v \<Turnstile> \<kappa>[\<Pi>]] = (AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<Pi> \<and> AOT_model_enc \<kappa> \<Pi>)\<close>
+  for \<kappa>::\<kappa>
+  using AOT_sem_enc_\<kappa> unfolding AOT_enc_\<kappa>_def by auto
+instance proof
+  fix v and \<kappa> :: \<kappa> and \<Pi>
+  show \<open>[v \<Turnstile> \<guillemotleft>AOT_enc \<kappa> \<Pi>\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<kappa>\<down>] \<and> [v \<Turnstile> \<Pi>\<down>]\<close>
+    unfolding AOT_sem_denotes
+    using AOT_enc_\<kappa>_meta by blast
+next
+  fix v and \<kappa> :: \<kappa> and \<Pi>
+  show \<open>[v \<Turnstile> \<kappa>[\<Pi>]] = [v \<Turnstile> \<Pi>\<down> & \<guillemotleft>AOT_proj_enc \<kappa> (\<lambda> \<kappa>'.  \<guillemotleft>[\<Pi>]\<kappa>'\<guillemotright>)\<guillemotright>]\<close>
+  proof
+    assume enc: \<open>[v \<Turnstile> \<kappa>[\<Pi>]]\<close>
+    hence \<Pi>_denotes: \<open>AOT_model_denotes \<Pi>\<close>
+      by (simp add: AOT_enc_\<kappa>_meta)
+    hence \<Pi>_eta_denotes: \<open>AOT_model_denotes \<guillemotleft>[\<lambda>z [\<Pi>]z]\<guillemotright>\<close>
+      using AOT_sem_denotes AOT_sem_eq AOT_sem_lambda_eta by metis
+    show \<open>[v \<Turnstile> \<Pi>\<down> & \<guillemotleft>AOT_proj_enc \<kappa> (\<lambda> \<kappa>.  \<guillemotleft>[\<Pi>]\<kappa>\<guillemotright>)\<guillemotright>]\<close>
+      using AOT_sem_lambda_eta[simplified AOT_sem_denotes AOT_sem_eq, OF \<Pi>_denotes]
+      using \<Pi>_eta_denotes \<Pi>_denotes
+      by (simp add: AOT_sem_conj AOT_sem_denotes AOT_proj_enc_\<kappa>_def enc)
+  next
+    assume \<open>[v \<Turnstile> \<Pi>\<down> & \<guillemotleft>AOT_proj_enc \<kappa> (\<lambda> \<kappa>.  \<guillemotleft>[\<Pi>]\<kappa>\<guillemotright>)\<guillemotright>]\<close>
+    hence \<Pi>_denotes: "AOT_model_denotes \<Pi>" and eta_enc: "[v \<Turnstile> \<kappa>[\<lambda>z [\<Pi>]z]]" 
+      by (auto simp: AOT_sem_conj AOT_sem_denotes AOT_proj_enc_\<kappa>_def)
+    thus \<open>[v \<Turnstile> \<kappa>[\<Pi>]]\<close>
+      using AOT_sem_lambda_eta[simplified AOT_sem_denotes AOT_sem_eq, OF \<Pi>_denotes]
+      by auto
+  qed
+next
+  show \<open>[v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa> \<phi>\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<kappa>\<down>]\<close> for v and \<kappa> :: \<kappa> and \<phi>
+    by (simp add: AOT_enc_\<kappa>_meta AOT_sem_denotes AOT_proj_enc_\<kappa>_def)
+next
+  fix v w and \<kappa> :: \<kappa> and \<Pi>
+  assume \<open>[v \<Turnstile> \<kappa>[\<Pi>]]\<close>
+  thus \<open>[w \<Turnstile> \<kappa>[\<Pi>]]\<close>
+    by (simp add: AOT_enc_\<kappa>_meta)
+next
+  fix v w and \<kappa> :: \<kappa> and \<phi>
+  assume \<open>[v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa> \<phi>\<guillemotright>]\<close>
+  thus \<open>[w \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa> \<phi>\<guillemotright>]\<close>
+    by (simp add: AOT_enc_\<kappa>_meta AOT_proj_enc_\<kappa>_def)
+next
+  show \<open>\<exists>\<kappa>::\<kappa>. [v \<Turnstile> \<kappa>\<down>] \<and> (\<forall> \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow>  [v \<Turnstile> \<kappa>[\<Pi>]]) \<and>
+               (\<forall> \<phi> . [v \<Turnstile> [\<lambda>z \<phi>{z}]\<down>] \<longrightarrow>  [v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa> \<phi>\<guillemotright>])\<close> for v
+    by (rule exI[where x=\<open>\<alpha>\<kappa> UNIV\<close>])
+       (simp add: AOT_sem_denotes AOT_enc_\<kappa>_meta AOT_model_enc_\<kappa>_def
+                  AOT_model_denotes_\<kappa>_def  AOT_proj_enc_\<kappa>_def)
+qed
+end
+
+text\<open>We show that @{typ \<kappa>} satisfies the properties of unary encoding.\<close>
+instantiation \<kappa> :: AOT_UnaryEnc
+begin
+instance proof
+  fix v and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+  show \<open>[v \<Turnstile> \<Pi>\<down> & \<Pi>'\<down> & \<box>\<forall>\<nu> (\<nu>[\<Pi>] \<equiv> \<nu>[\<Pi>']) \<rightarrow> \<Pi> = \<Pi>']\<close>
+    apply (simp add: AOT_sem_forall AOT_sem_eq AOT_sem_imp AOT_sem_equiv
+                     AOT_enc_\<kappa>_meta AOT_sem_conj AOT_sem_denotes AOT_sem_box)
+    using AOT_meta_A_objects_\<kappa> by fastforce
+next
+  fix v and \<phi>:: \<open><\<kappa>> \<Rightarrow> \<o>\<close>
+  show \<open>[v \<Turnstile> \<exists>x (\<not>\<diamond>[E!]x & \<forall>F (x[F] \<equiv> \<phi>{F}))]\<close>
+    using AOT_model_A_objects[of "\<lambda> \<Pi> . [v \<Turnstile> \<phi>{\<Pi>}]"]
+    by (auto simp: AOT_sem_denotes AOT_sem_exists AOT_sem_conj AOT_sem_not
+                   AOT_sem_dia AOT_sem_concrete AOT_enc_\<kappa>_meta AOT_sem_equiv
+                   AOT_sem_forall)
+next
+  show \<open>AOT_proj_enc x \<psi> = AOT_enc x (AOT_lambda \<psi>)\<close> for x :: \<kappa> and \<psi>
+    by (simp add: AOT_proj_enc_\<kappa>_def)
+next
+  show \<open>[v \<Turnstile> [E!]\<kappa>] \<Longrightarrow> \<not> [w \<Turnstile> \<kappa>[\<Pi>]]\<close> for v w and \<kappa> :: \<kappa> and \<Pi>
+    by (simp add: AOT_enc_\<kappa>_meta AOT_sem_concrete AOT_model_nocoder)
+next
+  fix v and \<kappa> \<kappa>' :: \<kappa>
+  show \<open>([v \<Turnstile> \<kappa>\<down>] \<and> [v \<Turnstile> \<kappa>'\<down>] \<and> \<kappa> = \<kappa>') =
+         (([v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>] \<and>
+           [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>'] \<and>
+           (\<forall> v \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> [\<Pi>]\<kappa>] = [v \<Turnstile> [\<Pi>]\<kappa>']))
+          \<or> ([v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>] \<and>
+             [v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>'] \<and>
+             (\<forall> v \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<kappa>[\<Pi>]] = [v \<Turnstile> \<kappa>'[\<Pi>]])))\<close>
+    (is \<open>?lhs = (?ordeq \<or> ?abseq)\<close>)
+  proof -
+  {
+    assume 0: \<open>[v \<Turnstile> \<kappa>\<down>] \<and> [v \<Turnstile> \<kappa>'\<down>] \<and> \<kappa> = \<kappa>'\<close>
+    {
+      assume \<open>is_\<omega>\<kappa> \<kappa>'\<close>
+      hence \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>']\<close>
+        apply (subst AOT_sem_lambda_beta[OF AOT_sem_ordinary_def_denotes, of v \<kappa>'])
+         apply (simp add: "0")
+        apply (simp add: AOT_sem_dia)
+        using AOT_sem_concrete AOT_model_\<omega>_concrete_in_some_world is_\<omega>\<kappa>_def by force
+      hence \<open>?ordeq\<close> unfolding 0[THEN conjunct2, THEN conjunct2] by auto
+    }
+    moreover {
+      assume \<open>is_\<alpha>\<kappa> \<kappa>'\<close>
+      hence \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>']\<close>
+        apply (subst AOT_sem_lambda_beta[OF AOT_sem_abstract_def_denotes, of v \<kappa>'])
+         apply (simp add: "0")
+        apply (simp add: AOT_sem_not AOT_sem_dia)
+        using AOT_sem_concrete is_\<alpha>\<kappa>_def by force
+      hence \<open>?abseq\<close> unfolding 0[THEN conjunct2, THEN conjunct2] by auto
+    }
+    ultimately have \<open>?ordeq \<or> ?abseq\<close>
+      by (meson "0" AOT_sem_denotes AOT_model_denotes_\<kappa>_def \<kappa>.exhaust_disc)
+  }
+  moreover {
+    assume ordeq: \<open>?ordeq\<close>
+    hence \<kappa>_denotes: \<open>[v \<Turnstile> \<kappa>\<down>]\<close> and \<kappa>'_denotes: \<open>[v \<Turnstile> \<kappa>'\<down>]\<close> 
+      by (simp add: AOT_sem_denotes AOT_sem_exe)+
+    hence \<open>is_\<omega>\<kappa> \<kappa>\<close> and \<open>is_\<omega>\<kappa> \<kappa>'\<close>
+      by (metis AOT_model_concrete_\<kappa>.simps(2) AOT_model_denotes_\<kappa>_def
+                AOT_sem_concrete AOT_sem_denotes AOT_sem_dia AOT_sem_lambda_beta
+                AOT_sem_ordinary_def_denotes \<kappa>.collapse(2) \<kappa>.exhaust_disc ordeq)+
+    have denotes: \<open>[v \<Turnstile> [\<lambda>z \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> z = \<kappa>\<upsilon> \<kappa>\<guillemotright>]\<down>]\<close>
+      unfolding AOT_sem_denotes AOT_model_lambda_denotes
+      by (simp add: AOT_model_term_equiv_\<kappa>_def)
+    hence "[v \<Turnstile> [\<lambda>z \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> z = \<kappa>\<upsilon> \<kappa>\<guillemotright>]\<kappa>] = [v \<Turnstile> [\<lambda>z \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> z = \<kappa>\<upsilon> \<kappa>\<guillemotright>]\<kappa>']"
+      using ordeq by (simp add: AOT_sem_denotes)
+    hence \<open>[v \<Turnstile> \<guillemotleft>\<kappa>\<guillemotright>\<down>] \<and> [v \<Turnstile> \<guillemotleft>\<kappa>'\<guillemotright>\<down>] \<and> \<kappa> = \<kappa>'\<close>
+      unfolding AOT_sem_lambda_beta[OF denotes, OF \<kappa>_denotes]
+                AOT_sem_lambda_beta[OF denotes, OF \<kappa>'_denotes]
+      using \<kappa>'_denotes \<open>is_\<omega>\<kappa> \<kappa>'\<close> \<open>is_\<omega>\<kappa> \<kappa>\<close> is_\<omega>\<kappa>_def
+            AOT_model_proposition_choice_simp by force
+  }
+  moreover {
+    assume 0: \<open>?abseq\<close>
+    hence \<kappa>_denotes: \<open>[v \<Turnstile> \<kappa>\<down>]\<close> and \<kappa>'_denotes: \<open>[v \<Turnstile> \<kappa>'\<down>]\<close> 
+      by (simp add: AOT_sem_denotes AOT_sem_exe)+
+    hence \<open>\<not>is_\<omega>\<kappa> \<kappa>\<close> and \<open>\<not>is_\<omega>\<kappa> \<kappa>'\<close>
+      by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+                AOT_sem_concrete AOT_sem_dia AOT_sem_exe AOT_sem_lambda_beta
+                AOT_sem_not \<kappa>.collapse(1) 0)+
+    hence \<open>is_\<alpha>\<kappa> \<kappa>\<close> and \<open>is_\<alpha>\<kappa> \<kappa>'\<close>
+      by (meson AOT_sem_denotes AOT_model_denotes_\<kappa>_def \<kappa>.exhaust_disc
+                \<kappa>_denotes \<kappa>'_denotes)+
+    then obtain x y where \<kappa>_def: \<open>\<kappa> = \<alpha>\<kappa> x\<close> and \<kappa>'_def: \<open>\<kappa>' = \<alpha>\<kappa> y\<close>
+      using is_\<alpha>\<kappa>_def by auto
+    {
+      fix r
+      assume \<open>r \<in> x\<close>
+      hence \<open>[v \<Turnstile> \<kappa>[\<guillemotleft>urrel_to_rel r\<guillemotright>]]\<close>
+        unfolding \<kappa>_def
+        unfolding AOT_enc_\<kappa>_meta
+        unfolding AOT_model_enc_\<kappa>_def
+        apply (simp add: AOT_model_denotes_\<kappa>_def)
+        by (metis (mono_tags) AOT_rel_equiv_def Quotient_def urrel_quotient)
+      hence \<open>[v \<Turnstile> \<kappa>'[\<guillemotleft>urrel_to_rel r\<guillemotright>]]\<close>
+        using AOT_enc_\<kappa>_meta 0 by (metis AOT_sem_enc_denotes)
+      hence \<open>r \<in> y\<close>
+        unfolding \<kappa>'_def
+        unfolding AOT_enc_\<kappa>_meta
+        unfolding AOT_model_enc_\<kappa>_def
+        apply (simp add: AOT_model_denotes_\<kappa>_def)
+        using Quotient_abs_rep urrel_quotient by fastforce
+    }
+    moreover {
+      fix r
+      assume \<open>r \<in> y\<close>
+      hence \<open>[v \<Turnstile> \<kappa>'[\<guillemotleft>urrel_to_rel r\<guillemotright>]]\<close>
+        unfolding \<kappa>'_def
+        unfolding AOT_enc_\<kappa>_meta
+        unfolding AOT_model_enc_\<kappa>_def
+        apply (simp add: AOT_model_denotes_\<kappa>_def)
+        by (metis (mono_tags) AOT_rel_equiv_def Quotient_def urrel_quotient)
+      hence \<open>[v \<Turnstile> \<kappa>[\<guillemotleft>urrel_to_rel r\<guillemotright>]]\<close>
+        using AOT_enc_\<kappa>_meta 0 by (metis AOT_sem_enc_denotes)
+      hence \<open>r \<in> x\<close>
+        unfolding \<kappa>_def
+        unfolding AOT_enc_\<kappa>_meta
+        unfolding AOT_model_enc_\<kappa>_def
+        apply (simp add: AOT_model_denotes_\<kappa>_def)
+        using Quotient_abs_rep urrel_quotient by fastforce
+    }
+    ultimately have "x = y" by blast
+    hence \<open>[v \<Turnstile> \<kappa>\<down>] \<and> [v \<Turnstile> \<kappa>'\<down>] \<and> \<kappa> = \<kappa>'\<close>
+      using \<kappa>'_def \<kappa>'_denotes \<kappa>_def by blast
+  }
+  ultimately show ?thesis
+    unfolding AOT_sem_denotes
+    by auto
+  qed
+(* Only extended model *)
+next
+  fix v and \<kappa> \<kappa>' :: \<kappa> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+  assume ext: \<open>AOT_ExtendedModel\<close>
+  assume \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>]\<close>
+  hence \<open>is_\<alpha>\<kappa> \<kappa>\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def AOT_sem_concrete AOT_sem_denotes AOT_sem_dia
+              AOT_sem_exe AOT_sem_lambda_beta AOT_sem_not \<kappa>.collapse(1) \<kappa>.exhaust_disc)
+  hence \<kappa>_abs: \<open>\<not>(\<exists> w . AOT_model_concrete w \<kappa>)\<close>
+    using is_\<alpha>\<kappa>_def by fastforce
+  have \<kappa>_den: \<open>AOT_model_denotes \<kappa>\<close>
+    by (simp add: AOT_model_denotes_\<kappa>_def \<kappa>.distinct_disc(5) \<open>is_\<alpha>\<kappa> \<kappa>\<close>)
+  assume \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>']\<close>
+  hence \<open>is_\<alpha>\<kappa> \<kappa>'\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def AOT_sem_concrete AOT_sem_denotes AOT_sem_dia
+              AOT_sem_exe AOT_sem_lambda_beta AOT_sem_not \<kappa>.collapse(1)
+              \<kappa>.exhaust_disc)
+  hence \<kappa>'_abs: \<open>\<not>(\<exists> w . AOT_model_concrete w \<kappa>')\<close>
+    using is_\<alpha>\<kappa>_def by fastforce
+  have \<kappa>'_den: \<open>AOT_model_denotes \<kappa>'\<close>
+    by (meson AOT_model_denotes_\<kappa>_def \<kappa>.distinct_disc(6) \<open>is_\<alpha>\<kappa> \<kappa>'\<close>)
+  assume \<open>[v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow> [w \<Turnstile> [\<Pi>']\<kappa>] = [w \<Turnstile> [\<Pi>']\<kappa>']\<close> for \<Pi>' w
+  hence indist: \<open>[v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>'\<guillemotright>]\<close>
+    if \<open>AOT_model_denotes \<Pi>'\<close> for \<Pi>' v
+    by (metis AOT_sem_denotes AOT_sem_exe \<kappa>'_den \<kappa>_den that)
+  assume \<kappa>_enc_cond: \<open>[v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow>
+    (\<And> \<kappa>\<^sub>0 w. [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<Longrightarrow>
+             [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]) \<Longrightarrow>
+    [v \<Turnstile> \<kappa>[\<Pi>']]\<close> for \<Pi>'
+  assume \<Pi>_den': \<open>[v \<Turnstile> \<Pi>\<down>]\<close>
+  hence \<Pi>_den: \<open>AOT_model_denotes \<Pi>\<close>
+    using AOT_sem_denotes by blast
+  {
+    fix \<Pi>' :: \<open><\<kappa>>\<close>
+    assume \<Pi>'_den: \<open>AOT_model_denotes \<Pi>'\<close>
+    hence \<Pi>'_den': \<open>[v \<Turnstile> \<Pi>'\<down>]\<close>
+      by (simp add: AOT_sem_denotes)
+    assume 1: \<open>\<exists>w. AOT_model_concrete w x \<Longrightarrow>
+               [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' x\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> x\<guillemotright>]\<close> for v x
+    {
+      fix \<kappa>\<^sub>0 :: \<kappa> and w
+      assume \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0]\<close>
+      hence \<open>is_\<omega>\<kappa> \<kappa>\<^sub>0\<close>
+        by (smt (z3) AOT_model_concrete_\<kappa>.simps(2) AOT_model_denotes_\<kappa>_def
+                     AOT_sem_concrete AOT_sem_denotes AOT_sem_dia AOT_sem_exe
+                     AOT_sem_lambda_beta \<kappa>.exhaust_disc is_\<alpha>\<kappa>_def)
+      then obtain x where x_prop: \<open>\<kappa>\<^sub>0 = \<omega>\<kappa> x\<close>
+        using is_\<omega>\<kappa>_def by blast
+      have \<open>\<exists>w . AOT_model_concrete w (\<omega>\<kappa> x)\<close>
+        by (simp add: AOT_model_\<omega>_concrete_in_some_world)
+      hence \<open>[v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' (\<omega>\<kappa> x)\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> (\<omega>\<kappa> x)\<guillemotright>]\<close> for v
+        using 1 by blast
+      hence \<open>[w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]\<close> unfolding x_prop
+        by (simp add: AOT_sem_exe AOT_sem_denotes AOT_model_denotes_\<kappa>_def
+                      \<Pi>'_den \<Pi>_den)
+    } note 2 = this
+    have \<open>[v \<Turnstile> \<kappa>[\<Pi>']]\<close>
+      using \<kappa>_enc_cond[OF \<Pi>'_den', OF 2]
+      by metis
+    hence \<open>AOT_model_enc \<kappa> \<Pi>'\<close>
+      using AOT_enc_\<kappa>_meta by blast
+  } note \<kappa>_enc_cond = this
+  hence \<open>AOT_model_denotes \<Pi>' \<Longrightarrow>
+       (\<And>v x. \<exists>w. AOT_model_concrete w x \<Longrightarrow>
+              [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' x\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> x\<guillemotright>]) \<Longrightarrow>
+       AOT_model_enc \<kappa> \<Pi>'\<close> for \<Pi>'
+    by blast
+  assume \<Pi>'_den': \<open>[v \<Turnstile> \<Pi>'\<down>]\<close>
+  hence \<Pi>'_den: \<open>AOT_model_denotes \<Pi>'\<close>
+    using AOT_sem_denotes by blast
+  assume ord_indist: \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<Longrightarrow>
+                      [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]\<close> for \<kappa>\<^sub>0 w
+  {
+    fix w and \<kappa>\<^sub>0 :: \<kappa>
+    assume 0: \<open>\<exists>w. AOT_model_concrete w \<kappa>\<^sub>0\<close>
+    hence \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0]\<close>
+      using AOT_model_concrete_denotes AOT_sem_concrete AOT_sem_denotes AOT_sem_dia
+            AOT_sem_lambda_beta AOT_sem_ordinary_def_denotes by blast
+    hence \<open>[w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]\<close>
+      using ord_indist by metis 
+    hence \<open>[w \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>\<^sub>0\<guillemotright>] = [w \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>0\<guillemotright>]\<close>
+      by (metis AOT_model_concrete_denotes AOT_sem_denotes AOT_sem_exe \<Pi>'_den \<Pi>_den 0)
+  } note ord_indist = this
+  have \<open>AOT_model_enc \<kappa>' \<Pi>'\<close>
+    using AOT_model_enc_indistinguishable_all
+            [OF ext, OF \<kappa>_den, OF \<kappa>_abs, OF \<kappa>'_den, OF \<kappa>'_abs, OF \<Pi>_den]
+          indist \<kappa>_enc_cond \<Pi>'_den ord_indist by blast
+  thus \<open>[v \<Turnstile> \<kappa>'[\<Pi>']]\<close>
+    using AOT_enc_\<kappa>_meta \<Pi>'_den \<kappa>'_den by blast
+next
+  fix v and \<kappa> \<kappa>' :: \<kappa> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
+  assume ext: \<open>AOT_ExtendedModel\<close>
+  assume \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>]\<close>
+  hence \<open>is_\<alpha>\<kappa> \<kappa>\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def AOT_sem_concrete AOT_sem_denotes AOT_sem_dia
+              AOT_sem_exe AOT_sem_lambda_beta AOT_sem_not \<kappa>.collapse(1)
+              \<kappa>.exhaust_disc)
+  hence \<kappa>_abs: \<open>\<not>(\<exists> w . AOT_model_concrete w \<kappa>)\<close>
+    using is_\<alpha>\<kappa>_def by fastforce
+  have \<kappa>_den: \<open>AOT_model_denotes \<kappa>\<close>
+    by (simp add: AOT_model_denotes_\<kappa>_def \<kappa>.distinct_disc(5) \<open>is_\<alpha>\<kappa> \<kappa>\<close>)
+  assume \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]\<kappa>']\<close>
+  hence \<open>is_\<alpha>\<kappa> \<kappa>'\<close>
+    by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+              AOT_model_denotes_\<kappa>_def AOT_sem_concrete AOT_sem_denotes AOT_sem_dia
+              AOT_sem_exe AOT_sem_lambda_beta AOT_sem_not \<kappa>.collapse(1)
+              \<kappa>.exhaust_disc)
+  hence \<kappa>'_abs: \<open>\<not>(\<exists> w . AOT_model_concrete w \<kappa>')\<close>
+    using is_\<alpha>\<kappa>_def by fastforce
+  have \<kappa>'_den: \<open>AOT_model_denotes \<kappa>'\<close>
+    by (meson AOT_model_denotes_\<kappa>_def \<kappa>.distinct_disc(6) \<open>is_\<alpha>\<kappa> \<kappa>'\<close>)
+  assume \<open>[v \<Turnstile> \<Pi>'\<down>] \<Longrightarrow> [w \<Turnstile> [\<Pi>']\<kappa>] = [w \<Turnstile> [\<Pi>']\<kappa>']\<close> for \<Pi>' w
+  hence indist: \<open>[v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>'\<guillemotright>]\<close>
+    if \<open>AOT_model_denotes \<Pi>'\<close> for \<Pi>' v
+    by (metis AOT_sem_denotes AOT_sem_exe \<kappa>'_den \<kappa>_den that)
+  assume \<Pi>_den': \<open>[v \<Turnstile> \<Pi>\<down>]\<close>
+  hence \<Pi>_den: \<open>AOT_model_denotes \<Pi>\<close>
+    using AOT_sem_denotes by blast
+  assume \<open>\<exists>\<Pi>'. [v \<Turnstile> \<Pi>'\<down>] \<and> [v \<Turnstile> \<kappa>[\<Pi>']] \<and>
+               (\<forall>\<kappa>\<^sub>0. [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<longrightarrow>
+                     (\<forall>w. [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]))\<close>
+  then obtain \<Pi>' where
+      \<Pi>'_den: \<open>[v \<Turnstile> \<Pi>'\<down>]\<close> and
+      \<Pi>'_enc: \<open>[v \<Turnstile> \<kappa>[\<Pi>']]\<close> and
+      \<Pi>'_prop: \<open>\<forall>\<kappa>\<^sub>0. [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<longrightarrow>
+                     (\<forall>w. [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0])\<close>
+    by blast
+  have \<open>AOT_model_denotes \<Pi>'\<close>
+    using AOT_enc_\<kappa>_meta \<Pi>'_enc by force
+  moreover have \<open>AOT_model_enc \<kappa> \<Pi>'\<close>
+    using AOT_enc_\<kappa>_meta \<Pi>'_enc by blast
+  moreover have \<open>(\<exists>w. AOT_model_concrete w \<kappa>\<^sub>0) \<Longrightarrow>
+                 [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>\<^sub>0\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>0\<guillemotright>]\<close> for \<kappa>\<^sub>0 v
+  proof -
+    assume 0: \<open>\<exists>w. AOT_model_concrete w \<kappa>\<^sub>0\<close>
+    hence \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0]\<close> for v
+      using AOT_model_concrete_denotes AOT_sem_concrete AOT_sem_denotes AOT_sem_dia
+            AOT_sem_lambda_beta AOT_sem_ordinary_def_denotes by blast
+    hence \<open>\<forall>w. [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]\<close> using \<Pi>'_prop by blast
+    thus \<open>[v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' \<kappa>\<^sub>0\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> \<kappa>\<^sub>0\<guillemotright>]\<close>
+      by (meson "0" AOT_model_concrete_denotes AOT_sem_denotes AOT_sem_exe \<Pi>_den
+                calculation(1))
+  qed
+  ultimately have \<open>\<exists>\<Pi>'. AOT_model_denotes \<Pi>' \<and> AOT_model_enc \<kappa> \<Pi>' \<and>
+                        (\<forall>v x. (\<exists>w. AOT_model_concrete w x) \<longrightarrow>
+                         [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' x\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> x\<guillemotright>])\<close>
+    by blast
+  hence \<open>\<exists>\<Pi>'. AOT_model_denotes \<Pi>' \<and> AOT_model_enc \<kappa>' \<Pi>' \<and>
+              (\<forall>v x. (\<exists>w. AOT_model_concrete w x) \<longrightarrow>
+               [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>' x\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> x\<guillemotright>])\<close>
+    using AOT_model_enc_indistinguishable_ex
+            [OF ext, OF \<kappa>_den, OF \<kappa>_abs, OF \<kappa>'_den, OF \<kappa>'_abs, OF \<Pi>_den]
+          indist by blast
+  then obtain \<Pi>'' where
+      \<Pi>''_den: \<open>AOT_model_denotes \<Pi>''\<close>
+      and \<Pi>''_enc: \<open>AOT_model_enc \<kappa>' \<Pi>''\<close>
+      and \<Pi>''_prop: \<open>(\<exists>w. AOT_model_concrete w x) \<Longrightarrow>
+                      [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi>'' x\<guillemotright>] = [v \<Turnstile> \<guillemotleft>Rep_rel \<Pi> x\<guillemotright>]\<close> for v x
+    by blast
+  have \<open>[v \<Turnstile> \<Pi>''\<down>]\<close>
+    by (simp add: AOT_sem_denotes \<Pi>''_den)
+  moreover have \<open>[v \<Turnstile> \<kappa>'[\<Pi>'']]\<close>
+    by (simp add: AOT_enc_\<kappa>_meta \<Pi>''_den \<Pi>''_enc \<kappa>'_den)
+  moreover have \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<Longrightarrow>
+                 (\<forall>w. [w \<Turnstile> [\<Pi>'']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0])\<close> for \<kappa>\<^sub>0
+  proof -
+    assume \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0]\<close>
+    hence \<open>\<exists>w. AOT_model_concrete w \<kappa>\<^sub>0\<close>
+      by (metis AOT_sem_concrete AOT_sem_dia AOT_sem_exe AOT_sem_lambda_beta)
+    thus \<open>\<forall>w. [w \<Turnstile> [\<Pi>'']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]\<close>
+      using \<Pi>''_prop
+      by (metis AOT_sem_denotes AOT_sem_exe \<Pi>''_den \<Pi>_den)
+  qed
+  ultimately show \<open>\<exists>\<Pi>'. [v \<Turnstile> \<Pi>'\<down>] \<and> [v \<Turnstile> \<kappa>'[\<Pi>']] \<and>
+                         (\<forall>\<kappa>\<^sub>0. [v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0] \<longrightarrow>
+                               (\<forall>w. [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>]\<kappa>\<^sub>0]))\<close>
+    by (safe intro!: exI[where x=\<Pi>'']) blast+
+qed
+end
+
+text\<open>Define encoding for products using projection-encoding.\<close>
+instantiation prod :: (AOT_UnaryEnc, AOT_Enc) AOT_Enc
+begin
+definition AOT_proj_enc_prod :: \<open>'a\<times>'b \<Rightarrow> ('a\<times>'b \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close> where
+  \<open>AOT_proj_enc_prod \<equiv> \<lambda> (\<kappa>,\<kappa>') \<phi> . \<guillemotleft>\<kappa>[\<lambda>\<nu> \<guillemotleft>\<phi> (\<nu>,\<kappa>')\<guillemotright>] &
+                                     \<guillemotleft>AOT_proj_enc \<kappa>' (\<lambda>\<nu>. \<phi> (\<kappa>,\<nu>))\<guillemotright>\<guillemotright>\<close>
+definition AOT_enc_prod :: \<open>'a\<times>'b \<Rightarrow> <'a\<times>'b> \<Rightarrow> \<o>\<close> where
+  \<open>AOT_enc_prod \<equiv> \<lambda> \<kappa> \<Pi> . \<guillemotleft>\<Pi>\<down> & \<guillemotleft>AOT_proj_enc \<kappa> (\<lambda> \<kappa>\<^sub>1'\<kappa>\<^sub>n'.  \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<guillemotright>)\<guillemotright>\<guillemotright>\<close>
+instance proof
+  show \<open>[v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]] \<Longrightarrow> [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> [v \<Turnstile> \<Pi>\<down>]\<close>
+    for v and \<kappa>\<^sub>1\<kappa>\<^sub>n :: \<open>'a\<times>'b\<close> and \<Pi>
+    unfolding AOT_enc_prod_def
+    apply (induct \<kappa>\<^sub>1\<kappa>\<^sub>n; simp add: AOT_sem_conj AOT_sem_denotes AOT_proj_enc_prod_def)
+    by (metis AOT_sem_denotes AOT_model_denotes_prod_def AOT_sem_enc_denotes
+              AOT_sem_proj_enc_denotes case_prodI)
+next
+  show \<open>[v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]] =
+        [v \<Turnstile> \<guillemotleft>\<Pi>\<guillemotright>\<down> & \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n (\<lambda> \<kappa>\<^sub>1\<kappa>\<^sub>n.  \<guillemotleft>[\<Pi>]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<guillemotright>)\<guillemotright>]\<close>
+    for v and \<kappa>\<^sub>1\<kappa>\<^sub>n :: \<open>'a\<times>'b\<close> and \<Pi>
+    unfolding AOT_enc_prod_def ..
+next
+  show \<open>[v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>s \<phi>\<guillemotright>] \<Longrightarrow> [v \<Turnstile> \<guillemotleft>\<kappa>s\<guillemotright>\<down>]\<close>
+    for v and \<kappa>s :: \<open>'a\<times>'b\<close> and \<phi>
+    by (metis (mono_tags, lifting)
+          AOT_sem_conj AOT_sem_denotes AOT_model_denotes_prod_def
+          AOT_sem_enc_denotes AOT_sem_proj_enc_denotes
+          AOT_proj_enc_prod_def case_prod_unfold)
+next
+  fix v w \<Pi> and \<kappa>\<^sub>1\<kappa>\<^sub>n :: \<open>'a\<times>'b\<close>
+  show \<open>[w \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]]\<close> if \<open>[v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]]\<close> for v w \<Pi> and \<kappa>\<^sub>1\<kappa>\<^sub>n :: \<open>'a\<times>'b\<close>
+    by (metis (mono_tags, lifting)
+          AOT_enc_prod_def AOT_sem_enc_proj_enc AOT_sem_conj AOT_sem_denotes
+          AOT_sem_proj_enc_nec AOT_proj_enc_prod_def case_prod_unfold that)
+next
+  show \<open>[w \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>]\<close> if \<open>[v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>]\<close>
+    for v w \<phi> and \<kappa>\<^sub>1\<kappa>\<^sub>n :: \<open>'a\<times>'b\<close>
+    by (metis (mono_tags, lifting)
+          that AOT_sem_enc_proj_enc AOT_sem_conj AOT_sem_denotes
+          AOT_sem_proj_enc_nec AOT_proj_enc_prod_def case_prod_unfold)
+next
+  fix v
+  obtain \<kappa> :: 'a where a_prop: \<open>[v \<Turnstile> \<kappa>\<down>] \<and> (\<forall> \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow>  [v \<Turnstile> \<kappa>[\<Pi>]])\<close>
+    using AOT_sem_universal_encoder by blast
+  obtain \<kappa>\<^sub>1'\<kappa>\<^sub>n' :: 'b where b_prop:
+    \<open>[v \<Turnstile> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'\<down>] \<and> (\<forall> \<phi> . [v \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<guillemotleft>\<phi> \<nu>\<^sub>1\<nu>\<^sub>n\<guillemotright>]\<down>] \<longrightarrow>
+                                [v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1'\<kappa>\<^sub>n' \<phi>\<guillemotright>])\<close>
+    using AOT_sem_universal_encoder by blast
+  have \<open>AOT_model_denotes \<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n [\<guillemotleft>\<Pi>\<guillemotright>]\<nu>\<^sub>1...\<nu>\<^sub>n \<kappa>\<^sub>1'...\<kappa>\<^sub>n']\<guillemotright>\<close>
+    if \<open>AOT_model_denotes \<Pi>\<close> for \<Pi> :: \<open><'a\<times>'b>\<close>
+    unfolding AOT_model_lambda_denotes
+    by (metis AOT_meta_prod_equivI(2) AOT_sem_exe_equiv)
+  moreover have \<open>AOT_model_denotes  \<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n [\<guillemotleft>\<Pi>\<guillemotright>]\<kappa> \<nu>\<^sub>1...\<nu>\<^sub>n]\<guillemotright>\<close>
+    if \<open>AOT_model_denotes \<Pi>\<close> for \<Pi> :: \<open><'a\<times>'b>\<close>
+    unfolding AOT_model_lambda_denotes
+    by (metis AOT_meta_prod_equivI(1) AOT_sem_exe_equiv)
+  ultimately have 1: \<open>[v \<Turnstile> \<guillemotleft>(\<kappa>,\<kappa>\<^sub>1'\<kappa>\<^sub>n')\<guillemotright>\<down>]\<close>
+              and 2: \<open>(\<forall> \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow>  [v \<Turnstile> \<kappa> \<kappa>\<^sub>1'...\<kappa>\<^sub>n'[\<Pi>]])\<close>
+    using a_prop b_prop
+    by (auto simp: AOT_sem_denotes AOT_enc_\<kappa>_meta AOT_model_enc_\<kappa>_def
+                   AOT_model_denotes_\<kappa>_def AOT_model_denotes_prod_def
+                   AOT_enc_prod_def AOT_proj_enc_prod_def AOT_sem_conj)
+  have \<open>AOT_model_denotes \<guillemotleft>[\<lambda>z\<^sub>1...z\<^sub>n \<guillemotleft>\<phi> (z\<^sub>1z\<^sub>n, \<kappa>\<^sub>1'\<kappa>\<^sub>n')\<guillemotright>]\<guillemotright>\<close>
+    if \<open>AOT_model_denotes \<guillemotleft>[\<lambda>z\<^sub>1...z\<^sub>m \<phi>{z\<^sub>1...z\<^sub>m}]\<guillemotright>\<close> for \<phi> :: \<open>'a\<times>'b \<Rightarrow> \<o>\<close>
+    using that
+    unfolding AOT_model_lambda_denotes
+    by (metis (no_types, lifting) AOT_sem_denotes AOT_model_denotes_prod_def
+                                  AOT_meta_prod_equivI(2) b_prop case_prodI)
+  moreover have \<open>AOT_model_denotes \<guillemotleft>[\<lambda>z\<^sub>1...z\<^sub>n \<guillemotleft>\<phi> (\<kappa>, z\<^sub>1z\<^sub>n)\<guillemotright>]\<guillemotright>\<close>
+    if \<open>AOT_model_denotes \<guillemotleft>[\<lambda>z\<^sub>1...z\<^sub>m \<phi>{z\<^sub>1...z\<^sub>m}]\<guillemotright>\<close> for \<phi> :: \<open>'a\<times>'b \<Rightarrow> \<o>\<close>
+    using that
+    unfolding AOT_model_lambda_denotes
+    by (metis (no_types, lifting) AOT_sem_denotes AOT_model_denotes_prod_def
+                                  AOT_meta_prod_equivI(1) a_prop case_prodI)
+  ultimately have 3:
+    \<open>[v \<Turnstile> \<guillemotleft>(\<kappa>,\<kappa>\<^sub>1'\<kappa>\<^sub>n')\<guillemotright>\<down>] \<and> (\<forall> \<phi> . [v \<Turnstile> [\<lambda>z\<^sub>1...z\<^sub>n \<phi>{z\<^sub>1...z\<^sub>n}]\<down>] \<longrightarrow>
+                                   [v \<Turnstile> \<guillemotleft>AOT_proj_enc (\<kappa>,\<kappa>\<^sub>1'\<kappa>\<^sub>n') \<phi>\<guillemotright>])\<close>
+    using a_prop b_prop
+    by (auto simp: AOT_sem_denotes AOT_enc_\<kappa>_meta AOT_model_enc_\<kappa>_def
+                   AOT_model_denotes_\<kappa>_def AOT_enc_prod_def AOT_proj_enc_prod_def
+                   AOT_sem_conj AOT_model_denotes_prod_def)
+  show \<open>\<exists>\<kappa>\<^sub>1\<kappa>\<^sub>n::'a\<times>'b. [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>] \<and> (\<forall> \<Pi> . [v \<Turnstile> \<Pi>\<down>] \<longrightarrow> [v \<Turnstile> \<kappa>\<^sub>1...\<kappa>\<^sub>n[\<Pi>]]) \<and>
+                      (\<forall> \<phi> . [v \<Turnstile> [\<lambda>z\<^sub>1...z\<^sub>n \<guillemotleft>\<phi> z\<^sub>1z\<^sub>n\<guillemotright>]\<down>] \<longrightarrow>
+                             [v \<Turnstile> \<guillemotleft>AOT_proj_enc \<kappa>\<^sub>1\<kappa>\<^sub>n \<phi>\<guillemotright>])\<close>
+    apply (rule exI[where x=\<open>(\<kappa>,\<kappa>\<^sub>1'\<kappa>\<^sub>n')\<close>]) using 1 2 3 by blast
+qed
+end
+
+text\<open>Sanity-check to verify that n-ary encoding follows.\<close>
+lemma \<open>[v \<Turnstile> \<kappa>\<^sub>1\<kappa>\<^sub>2[\<Pi>]] = [v \<Turnstile> \<Pi>\<down> & \<kappa>\<^sub>1[\<lambda>\<nu> [\<Pi>]\<nu>\<kappa>\<^sub>2] & \<kappa>\<^sub>2[\<lambda>\<nu> [\<Pi>]\<kappa>\<^sub>1\<nu>]]\<close>
+  for \<kappa>\<^sub>1 :: "'a::AOT_UnaryEnc" and \<kappa>\<^sub>2 :: "'b::AOT_UnaryEnc"
+  by (simp add: AOT_sem_conj AOT_enc_prod_def AOT_proj_enc_prod_def
+                AOT_sem_unary_proj_enc)
+lemma \<open>[v \<Turnstile> \<kappa>\<^sub>1\<kappa>\<^sub>2\<kappa>\<^sub>3[\<Pi>]] =
+       [v \<Turnstile> \<Pi>\<down> & \<kappa>\<^sub>1[\<lambda>\<nu> [\<Pi>]\<nu>\<kappa>\<^sub>2\<kappa>\<^sub>3] & \<kappa>\<^sub>2[\<lambda>\<nu> [\<Pi>]\<kappa>\<^sub>1\<nu>\<kappa>\<^sub>3] & \<kappa>\<^sub>3[\<lambda>\<nu> [\<Pi>]\<kappa>\<^sub>1\<kappa>\<^sub>2\<nu>]]\<close>
+  for \<kappa>\<^sub>1 \<kappa>\<^sub>2 \<kappa>\<^sub>3 :: "'a::AOT_UnaryEnc"
+  by (simp add: AOT_sem_conj AOT_enc_prod_def AOT_proj_enc_prod_def
+                AOT_sem_unary_proj_enc)
+
+lemma AOT_sem_vars_denote: \<open>[v \<Turnstile> \<alpha>\<^sub>1...\<alpha>\<^sub>n\<down>]\<close>
+  by induct simp
+
+text\<open>Combine the introduced type classes and register them as
+     type constraints for individual terms.\<close>
+class AOT_\<kappa>s = AOT_IndividualTerm + AOT_RelationProjection + AOT_Enc
+class AOT_\<kappa> = AOT_\<kappa>s + AOT_UnaryIndividualTerm +
+  AOT_UnaryRelationProjection + AOT_UnaryEnc
+
+instance \<kappa> :: AOT_\<kappa> by standard
+instance prod :: (AOT_\<kappa>, AOT_\<kappa>s) AOT_\<kappa>s by standard
+
+AOT_register_type_constraints
+  Individual: \<open>_::AOT_\<kappa>\<close> \<open>_::AOT_\<kappa>s\<close> and
+  Relation: \<open><_::AOT_\<kappa>s>\<close>
+
+text\<open>We define semantic predicates to capture the conditions of cqt.2 (i.e.
+     the base cases of denoting terms) on matrices of @{text \<lambda>}-expressions.\<close>
+definition AOT_instance_of_cqt_2 :: \<open>('a::AOT_\<kappa>s \<Rightarrow> \<o>) \<Rightarrow> bool\<close> where
+  \<open>AOT_instance_of_cqt_2 \<equiv> \<lambda> \<phi> . \<forall> x y . AOT_model_denotes x \<and> AOT_model_denotes y \<and>
+                                          AOT_model_term_equiv x y \<longrightarrow> \<phi> x = \<phi> y\<close>
+definition AOT_instance_of_cqt_2_exe_arg :: \<open>('a::AOT_\<kappa>s \<Rightarrow> 'b::AOT_\<kappa>s) \<Rightarrow> bool\<close> where
+  \<open>AOT_instance_of_cqt_2_exe_arg \<equiv> \<lambda> \<phi> . \<forall> x y .
+      AOT_model_denotes x \<and> AOT_model_denotes y \<and> AOT_model_term_equiv x y \<longrightarrow>
+      AOT_model_term_equiv (\<phi> x) (\<phi> y)\<close>
+
+text\<open>@{text \<lambda>}-expressions with a matrix that satisfies our predicate denote.\<close>
+lemma AOT_sem_cqt_2:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close>
+  shows \<open>[v \<Turnstile> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>]\<close>
+  using assms
+  by (metis AOT_instance_of_cqt_2_def AOT_model_lambda_denotes AOT_sem_denotes)
+
+syntax AOT_instance_of_cqt_2 :: \<open>id_position \<Rightarrow> AOT_prop\<close>
+  ("INSTANCE'_OF'_CQT'_2'(_')")
+
+text\<open>Prove introduction rules for the predicates that match the natural language
+     restrictions of the axiom.\<close>
+named_theorems AOT_instance_of_cqt_2_intro
+lemma AOT_instance_of_cqt_2_intros_const[AOT_instance_of_cqt_2_intro]:
+  \<open>AOT_instance_of_cqt_2 (\<lambda>\<alpha>. \<phi>)\<close>
+  by (simp add: AOT_instance_of_cqt_2_def AOT_sem_denotes AOT_model_lambda_denotes)
+lemma AOT_instance_of_cqt_2_intros_not[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<not>\<phi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (metis (no_types, lifting) AOT_instance_of_cqt_2_def)
+lemma AOT_instance_of_cqt_2_intros_imp[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close> and \<open>AOT_instance_of_cqt_2 \<psi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<phi>{\<tau>} \<rightarrow> \<psi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_imp)
+lemma AOT_instance_of_cqt_2_intros_box[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<box>\<phi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_box)
+lemma AOT_instance_of_cqt_2_intros_act[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<^bold>\<A>\<phi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_act)
+lemma AOT_instance_of_cqt_2_intros_diamond[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<diamond>\<phi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_dia)
+lemma AOT_instance_of_cqt_2_intros_conj[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close> and \<open>AOT_instance_of_cqt_2 \<psi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<phi>{\<tau>} & \<psi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_conj)
+lemma AOT_instance_of_cqt_2_intros_disj[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close> and \<open>AOT_instance_of_cqt_2 \<psi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<phi>{\<tau>} \<or> \<psi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_disj)
+lemma AOT_instance_of_cqt_2_intros_equib[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2 \<phi>\<close> and \<open>AOT_instance_of_cqt_2 \<psi>\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<phi>{\<tau>} \<equiv> \<psi>{\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_equiv)
+lemma AOT_instance_of_cqt_2_intros_forall[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>\<And> \<alpha> . AOT_instance_of_cqt_2 (\<Phi> \<alpha>)\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<forall>\<alpha> \<Phi>{\<alpha>,\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_forall)
+lemma AOT_instance_of_cqt_2_intros_exists[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>\<And> \<alpha> . AOT_instance_of_cqt_2 (\<Phi> \<alpha>)\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<tau>. \<guillemotleft>\<exists>\<alpha> \<Phi>{\<alpha>,\<tau>}\<guillemotright>)\<close>
+  using assms
+  by (auto simp: AOT_instance_of_cqt_2_def AOT_sem_denotes
+                 AOT_model_lambda_denotes AOT_sem_exists)
+lemma AOT_instance_of_cqt_2_intros_exe_arg_self[AOT_instance_of_cqt_2_intro]:
+   \<open>AOT_instance_of_cqt_2_exe_arg (\<lambda>x. x)\<close>
+  unfolding AOT_instance_of_cqt_2_exe_arg_def AOT_instance_of_cqt_2_def
+            AOT_sem_lambda_denotes
+  by (auto simp: AOT_model_term_equiv_part_equivp equivp_reflp AOT_sem_denotes)
+lemma AOT_instance_of_cqt_2_intros_exe_arg_const[AOT_instance_of_cqt_2_intro]:
+     \<open>AOT_instance_of_cqt_2_exe_arg (\<lambda>x. \<kappa>)\<close>
+  unfolding AOT_instance_of_cqt_2_exe_arg_def AOT_instance_of_cqt_2_def
+  by (auto simp: AOT_model_term_equiv_part_equivp equivp_reflp
+                 AOT_sem_denotes AOT_sem_lambda_denotes)
+lemma AOT_instance_of_cqt_2_intros_exe_arg_fst[AOT_instance_of_cqt_2_intro]:
+   \<open>AOT_instance_of_cqt_2_exe_arg fst\<close>
+  unfolding AOT_instance_of_cqt_2_exe_arg_def AOT_instance_of_cqt_2_def
+  by (simp add: AOT_model_term_equiv_prod_def case_prod_beta)
+lemma AOT_instance_of_cqt_2_intros_exe_arg_snd[AOT_instance_of_cqt_2_intro]:
+   \<open>AOT_instance_of_cqt_2_exe_arg snd\<close>
+  unfolding AOT_instance_of_cqt_2_exe_arg_def AOT_instance_of_cqt_2_def
+  by (simp add: AOT_model_term_equiv_prod_def AOT_sem_denotes AOT_sem_lambda_denotes)
+lemma AOT_instance_of_cqt_2_intros_exe_arg_Pair[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2_exe_arg \<phi>\<close> and \<open>AOT_instance_of_cqt_2_exe_arg \<psi>\<close>
+  shows \<open>AOT_instance_of_cqt_2_exe_arg (\<lambda>\<tau>. Pair (\<phi> \<tau>) (\<psi> \<tau>))\<close>
+  using assms
+  unfolding AOT_instance_of_cqt_2_exe_arg_def AOT_instance_of_cqt_2_def
+            AOT_sem_denotes AOT_sem_lambda_denotes AOT_model_term_equiv_prod_def
+            AOT_model_denotes_prod_def
+  by auto
+lemma AOT_instance_of_cqt_2_intros_desc[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>\<And>z :: 'a::AOT_\<kappa>. AOT_instance_of_cqt_2 (\<Phi> z)\<close>
+  shows \<open>AOT_instance_of_cqt_2_exe_arg (\<lambda> \<kappa> :: 'b::AOT_\<kappa> . \<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>})\<guillemotright>)\<close>
+proof -
+  have 0: \<open>\<And> \<kappa> \<kappa>'. AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and>
+                   AOT_model_term_equiv \<kappa> \<kappa>' \<Longrightarrow>
+                   \<Phi> z \<kappa> = \<Phi> z \<kappa>'\<close> for z
+    using assms
+    unfolding AOT_instance_of_cqt_2_def
+              AOT_sem_denotes AOT_model_lambda_denotes by force
+  {
+    fix \<kappa> \<kappa>'
+    have \<open>\<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>})\<guillemotright> = \<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>'})\<guillemotright>\<close>
+      if \<open>AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and> AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+      using 0[OF that]
+      by auto
+    moreover have \<open>AOT_model_term_equiv x x\<close> for x :: \<open>'a::AOT_\<kappa>\<close>
+      by (metis AOT_instance_of_cqt_2_exe_arg_def
+                AOT_instance_of_cqt_2_intros_exe_arg_const
+                AOT_model_A_objects AOT_model_term_equiv_denotes
+                AOT_model_term_equiv_eps(1))
+    ultimately have \<open>AOT_model_term_equiv \<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>})\<guillemotright> \<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>'})\<guillemotright>\<close>
+      if \<open>AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and> AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+      using that by simp
+  }
+  thus ?thesis using 0
+    unfolding AOT_instance_of_cqt_2_exe_arg_def
+    by simp
+qed
+
+lemma AOT_instance_of_cqt_2_intros_exe_const[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>AOT_instance_of_cqt_2_exe_arg \<kappa>s\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>x :: 'b::AOT_\<kappa>s. AOT_exe \<Pi> (\<kappa>s x))\<close>
+  using assms
+  unfolding AOT_instance_of_cqt_2_def AOT_sem_denotes AOT_model_lambda_denotes
+            AOT_sem_disj AOT_sem_conj
+            AOT_sem_not AOT_sem_box AOT_sem_act AOT_instance_of_cqt_2_exe_arg_def
+            AOT_sem_equiv AOT_sem_imp AOT_sem_forall AOT_sem_exists AOT_sem_dia
+  by (auto intro!: AOT_sem_exe_equiv)
+lemma AOT_instance_of_cqt_2_intros_exe_lam[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>\<And> y . AOT_instance_of_cqt_2 (\<lambda>x. \<phi> x y)\<close>
+      and \<open>AOT_instance_of_cqt_2_exe_arg \<kappa>s\<close>
+    shows \<open>AOT_instance_of_cqt_2 (\<lambda>\<kappa>\<^sub>1\<kappa>\<^sub>n :: 'b::AOT_\<kappa>s.
+              \<guillemotleft>[\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n,\<nu>\<^sub>1...\<nu>\<^sub>n}]\<guillemotleft>\<kappa>s \<kappa>\<^sub>1\<kappa>\<^sub>n\<guillemotright>\<guillemotright>)\<close>
+proof -
+  {
+    fix x y :: 'b
+    assume \<open>AOT_model_denotes x\<close>
+    moreover assume \<open>AOT_model_denotes y\<close>
+    moreover assume \<open>AOT_model_term_equiv x y\<close>
+    moreover have 1: \<open>\<phi> x = \<phi> y\<close>
+      using assms calculation unfolding AOT_instance_of_cqt_2_def by blast
+    ultimately have \<open>AOT_exe (AOT_lambda (\<phi> x)) (\<kappa>s x) =
+                     AOT_exe (AOT_lambda (\<phi> y)) (\<kappa>s y)\<close>
+      unfolding 1
+      apply (safe intro!: AOT_sem_exe_equiv)
+      by (metis AOT_instance_of_cqt_2_exe_arg_def assms(2))
+  }
+  thus ?thesis
+  unfolding AOT_instance_of_cqt_2_def
+            AOT_instance_of_cqt_2_exe_arg_def
+  by blast
+qed
+lemma AOT_instance_of_cqt_2_intro_prod[AOT_instance_of_cqt_2_intro]:
+  assumes \<open>\<And> x . AOT_instance_of_cqt_2 (\<phi> x)\<close>
+      and \<open>\<And> x . AOT_instance_of_cqt_2 (\<lambda> z . \<phi> z x)\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>(x,y) . \<phi> x y)\<close>
+  using assms unfolding AOT_instance_of_cqt_2_def
+  by (auto simp add: AOT_model_lambda_denotes AOT_sem_denotes
+                AOT_model_denotes_prod_def
+                AOT_model_term_equiv_prod_def)
+
+text\<open>The following are already derivable semantically, but not yet added
+     to @{attribute AOT_instance_of_cqt_2_intro}. They will be added with the
+     next planned extension of axiom cqt:2.\<close>
+named_theorems AOT_instance_of_cqt_2_intro_next
+definition AOT_instance_of_cqt_2_enc_arg :: \<open>('a::AOT_\<kappa>s \<Rightarrow> 'b::AOT_\<kappa>s) \<Rightarrow> bool\<close> where
+  \<open>AOT_instance_of_cqt_2_enc_arg \<equiv> \<lambda> \<phi> . \<forall> x y z .
+      AOT_model_denotes x \<and> AOT_model_denotes y \<and> AOT_model_term_equiv x y \<longrightarrow>
+      AOT_enc (\<phi> x) z = AOT_enc (\<phi> y) z\<close>
+definition AOT_instance_of_cqt_2_enc_rel :: \<open>('a::AOT_\<kappa>s \<Rightarrow> <'b::AOT_\<kappa>s>) \<Rightarrow> bool\<close> where
+  \<open>AOT_instance_of_cqt_2_enc_rel \<equiv> \<lambda> \<phi> . \<forall> x y z .
+      AOT_model_denotes x \<and> AOT_model_denotes y \<and> AOT_model_term_equiv x y \<longrightarrow>
+      AOT_enc z (\<phi> x) = AOT_enc z (\<phi> y)\<close>
+lemma AOT_instance_of_cqt_2_intros_enc[AOT_instance_of_cqt_2_intro_next]:
+  assumes \<open>AOT_instance_of_cqt_2_enc_rel \<Pi>\<close> and \<open>AOT_instance_of_cqt_2_enc_arg \<kappa>s\<close>
+  shows \<open>AOT_instance_of_cqt_2 (\<lambda>x . AOT_enc (\<kappa>s x) \<guillemotleft>[\<guillemotleft>\<Pi> x\<guillemotright>]\<guillemotright>)\<close>
+  using assms
+  unfolding AOT_instance_of_cqt_2_def AOT_sem_denotes AOT_model_lambda_denotes
+            AOT_instance_of_cqt_2_enc_rel_def AOT_sem_not AOT_sem_box AOT_sem_act
+            AOT_sem_dia AOT_sem_conj AOT_sem_disj AOT_sem_equiv AOT_sem_imp
+            AOT_sem_forall AOT_sem_exists AOT_instance_of_cqt_2_enc_arg_def
+  by fastforce+
+lemma AOT_instance_of_cqt_2_enc_arg_intro_const[AOT_instance_of_cqt_2_intro_next]:
+  \<open>AOT_instance_of_cqt_2_enc_arg (\<lambda>x. c)\<close>
+  unfolding AOT_instance_of_cqt_2_enc_arg_def by simp
+lemma AOT_instance_of_cqt_2_enc_arg_intro_desc[AOT_instance_of_cqt_2_intro_next]:
+  assumes \<open>\<And>z :: 'a::AOT_\<kappa>. AOT_instance_of_cqt_2 (\<Phi> z)\<close>
+  shows \<open>AOT_instance_of_cqt_2_enc_arg (\<lambda> \<kappa> :: 'b::AOT_\<kappa> . \<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>})\<guillemotright>)\<close>
+proof -
+  have 0: \<open>\<And> \<kappa> \<kappa>'. AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and>
+                   AOT_model_term_equiv \<kappa> \<kappa>' \<Longrightarrow>
+                   \<Phi> z \<kappa> = \<Phi> z \<kappa>'\<close> for z
+    using assms
+    unfolding AOT_instance_of_cqt_2_def
+              AOT_sem_denotes AOT_model_lambda_denotes by force
+  {
+    fix \<kappa> \<kappa>'
+    have \<open>\<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>})\<guillemotright> = \<guillemotleft>\<^bold>\<iota>z(\<Phi>{z,\<kappa>'})\<guillemotright>\<close>
+      if \<open>AOT_model_denotes \<kappa> \<and> AOT_model_denotes \<kappa>' \<and> AOT_model_term_equiv \<kappa> \<kappa>'\<close>
+      using 0[OF that]
+      by auto
+  }
+  thus ?thesis using 0
+    unfolding AOT_instance_of_cqt_2_enc_arg_def by meson
+qed
+lemma AOT_instance_of_cqt_2_enc_rel_intro[AOT_instance_of_cqt_2_intro_next]:
+  assumes \<open>\<And> \<kappa> . AOT_instance_of_cqt_2 (\<lambda>\<kappa>' :: 'b::AOT_\<kappa>s . \<phi> \<kappa> \<kappa>')\<close>
+  assumes \<open>\<And> \<kappa>' . AOT_instance_of_cqt_2 (\<lambda>\<kappa> :: 'a::AOT_\<kappa>s . \<phi> \<kappa> \<kappa>')\<close>
+  shows \<open>AOT_instance_of_cqt_2_enc_rel (\<lambda>\<kappa> :: 'a::AOT_\<kappa>s. AOT_lambda (\<lambda>\<kappa>'. \<phi> \<kappa> \<kappa>'))\<close>
+proof -
+  {
+    fix x y :: 'a and z ::'b
+    assume \<open>AOT_model_term_equiv x y\<close>
+    moreover assume \<open>AOT_model_denotes x\<close>
+    moreover assume \<open>AOT_model_denotes y\<close>
+    ultimately have \<open>\<phi> x = \<phi> y\<close>
+      using assms unfolding AOT_instance_of_cqt_2_def by blast
+    hence \<open>AOT_enc z (AOT_lambda (\<phi> x)) = AOT_enc z (AOT_lambda (\<phi> y))\<close>
+      by simp
+  }
+  thus ?thesis
+    unfolding AOT_instance_of_cqt_2_enc_rel_def by auto
+qed
+
+text\<open>Further restrict unary individual variables to type @{typ \<kappa>} (rather
+     than class @{class AOT_\<kappa>} only) and define being ordinary and being abstract.\<close>
+AOT_register_type_constraints
+  Individual: \<open>\<kappa>\<close> \<open>_::AOT_\<kappa>s\<close>
+
+AOT_define AOT_ordinary :: \<open>\<Pi>\<close> (\<open>O!\<close>) \<open>O! =\<^sub>d\<^sub>f [\<lambda>x \<diamond>E!x]\<close>
+declare AOT_ordinary[AOT del, AOT_defs del]
+AOT_define AOT_abstract :: \<open>\<Pi>\<close> (\<open>A!\<close>) \<open>A! =\<^sub>d\<^sub>f [\<lambda>x \<not>\<diamond>E!x]\<close>
+declare AOT_abstract[AOT del, AOT_defs del]
+
+context AOT_meta_syntax
+begin
+notation AOT_ordinary ("\<^bold>O\<^bold>!")
+notation AOT_abstract ("\<^bold>A\<^bold>!")
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_ordinary ("\<^bold>O\<^bold>!")
+no_notation AOT_abstract ("\<^bold>A\<^bold>!")
+end
+
+no_translations
+  "_AOT_concrete" => "CONST AOT_term_of_var (CONST AOT_concrete)"
+parse_translation\<open>
+[(\<^syntax_const>\<open>_AOT_concrete\<close>, fn _ => fn [] =>
+  Const (\<^const_name>\<open>AOT_term_of_var\<close>, dummyT)
+  $ Const (\<^const_name>\<open>AOT_concrete\<close>, \<^typ>\<open><\<kappa>> AOT_var\<close>))]
+\<close>
+
+text\<open>Auxiliary lemmata.\<close>
+lemma AOT_sem_ordinary: "\<guillemotleft>O!\<guillemotright> = \<guillemotleft>[\<lambda>x \<diamond>E!x]\<guillemotright>"
+  using AOT_ordinary[THEN AOT_sem_id_def0E1] AOT_sem_ordinary_def_denotes
+  by (auto simp: AOT_sem_eq)
+lemma AOT_sem_abstract: "\<guillemotleft>A!\<guillemotright> = \<guillemotleft>[\<lambda>x \<not>\<diamond>E!x]\<guillemotright>"
+  using AOT_abstract[THEN AOT_sem_id_def0E1]  AOT_sem_abstract_def_denotes
+  by (auto simp: AOT_sem_eq)
+lemma AOT_sem_ordinary_denotes: \<open>[w \<Turnstile> O!\<down>]\<close>
+  by (simp add: AOT_sem_ordinary AOT_sem_ordinary_def_denotes)
+lemma AOT_meta_abstract_denotes: \<open>[w \<Turnstile> A!\<down>]\<close>
+  by (simp add: AOT_sem_abstract AOT_sem_abstract_def_denotes)
+lemma AOT_model_abstract_\<alpha>\<kappa>: \<open>\<exists> a . \<kappa> = \<alpha>\<kappa> a\<close> if \<open>[v \<Turnstile> A!\<kappa>]\<close>
+  using that[unfolded AOT_sem_abstract, simplified
+      AOT_meta_abstract_denotes[unfolded AOT_sem_abstract, THEN AOT_sem_lambda_beta,
+          OF that[simplified AOT_sem_exe, THEN conjunct2, THEN conjunct1]]]
+  apply (simp add: AOT_sem_not AOT_sem_dia AOT_sem_concrete)
+  by (metis AOT_model_\<omega>_concrete_in_some_world AOT_model_concrete_\<kappa>.simps(1)
+            AOT_model_denotes_\<kappa>_def AOT_sem_denotes AOT_sem_exe \<kappa>.exhaust_disc
+            is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def that)
+lemma AOT_model_ordinary_\<omega>\<kappa>: \<open>\<exists> a . \<kappa> = \<omega>\<kappa> a\<close> if \<open>[v \<Turnstile> O!\<kappa>]\<close>
+  using that[unfolded AOT_sem_ordinary, simplified
+      AOT_sem_ordinary_denotes[unfolded AOT_sem_ordinary, THEN AOT_sem_lambda_beta,
+        OF that[simplified AOT_sem_exe, THEN conjunct2, THEN conjunct1]]]
+  apply (simp add: AOT_sem_dia AOT_sem_concrete)
+  by (metis AOT_model_concrete_\<kappa>.simps(2) AOT_model_concrete_\<kappa>.simps(3)
+            \<kappa>.exhaust_disc is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def is_null\<kappa>_def)
+lemma AOT_model_\<omega>\<kappa>_ordinary: \<open>[v \<Turnstile> O!\<guillemotleft>\<omega>\<kappa> x\<guillemotright>]\<close>
+  by (metis AOT_model_abstract_\<alpha>\<kappa> AOT_model_denotes_\<kappa>_def AOT_sem_abstract
+            AOT_sem_denotes AOT_sem_ind_eq AOT_sem_ordinary \<kappa>.disc(7) \<kappa>.distinct(1))
+lemma AOT_model_\<alpha>\<kappa>_ordinary: \<open>[v \<Turnstile> A!\<guillemotleft>\<alpha>\<kappa> x\<guillemotright>]\<close>
+  by (metis AOT_model_denotes_\<kappa>_def AOT_model_ordinary_\<omega>\<kappa> AOT_sem_abstract
+            AOT_sem_denotes AOT_sem_ind_eq AOT_sem_ordinary \<kappa>.disc(8) \<kappa>.distinct(1))
+AOT_theorem prod_denotesE: assumes \<open>\<guillemotleft>(\<kappa>\<^sub>1,\<kappa>\<^sub>2)\<guillemotright>\<down>\<close> shows \<open>\<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down>\<close>
+  using assms by (simp add: AOT_sem_denotes AOT_sem_conj AOT_model_denotes_prod_def)
+declare prod_denotesE[AOT del]
+AOT_theorem prod_denotesI: assumes \<open>\<kappa>\<^sub>1\<down> & \<kappa>\<^sub>2\<down>\<close> shows \<open>\<guillemotleft>(\<kappa>\<^sub>1,\<kappa>\<^sub>2)\<guillemotright>\<down>\<close>
+  using assms by (simp add: AOT_sem_denotes AOT_sem_conj AOT_model_denotes_prod_def)
+declare prod_denotesI[AOT del]
+
+
+text\<open>Prepare the derivation of the additional axioms that are validated by
+     our extended models.\<close>
+locale AOT_ExtendedModel =
+  assumes AOT_ExtendedModel: \<open>AOT_ExtendedModel\<close>
+begin
+lemma AOT_sem_indistinguishable_ord_enc_all:
+  assumes \<Pi>_den: \<open>[v \<Turnstile> \<Pi>\<down>]\<close>
+  assumes Ax: \<open>[v \<Turnstile> A!x]\<close>
+  assumes Ay: \<open>[v \<Turnstile> A!y]\<close>
+  assumes indist: \<open>[v \<Turnstile> \<forall>F \<box>([F]x \<equiv> [F]y)]\<close>
+  shows
+  \<open>[v \<Turnstile> \<forall>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> x[G])] =
+   [v \<Turnstile> \<forall>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> y[G])]\<close>
+proof -
+    have 0: \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]x]\<close>
+      using Ax by (simp add: AOT_sem_abstract)
+    have 1: \<open>[v \<Turnstile> [\<lambda>x \<not>\<diamond>[E!]x]y]\<close>
+      using Ay by (simp add: AOT_sem_abstract)
+    {
+      assume \<open>[v \<Turnstile> \<forall>G(\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> x[G])]\<close>
+      hence 3: \<open>[v \<Turnstile> \<forall>G(\<forall>z([\<lambda>x \<diamond>[E!]x]z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> x[G])]\<close>
+        by (simp add: AOT_sem_ordinary)
+      {
+        fix \<Pi>' :: \<open><\<kappa>>\<close>
+        assume 1: \<open>[v \<Turnstile> \<Pi>'\<down>]\<close>
+        assume 2: \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]z \<rightarrow> \<box>([\<Pi>']z \<equiv> [\<Pi>]z)]\<close> for z
+        have \<open>[v \<Turnstile> x[\<Pi>']]\<close>
+          using 3
+          by (auto simp: AOT_sem_forall AOT_sem_imp AOT_sem_box AOT_sem_denotes)
+             (metis (no_types, lifting) 1 2 AOT_term_of_var_cases AOT_sem_box
+                                        AOT_sem_denotes AOT_sem_imp)
+      } note 3 = this
+      fix \<Pi>' :: \<open><\<kappa>>\<close>
+      assume \<Pi>_den: \<open>[v \<Turnstile> \<Pi>'\<down>]\<close>
+      assume 4: \<open>[v \<Turnstile> \<forall>z (O!z \<rightarrow> \<box>([\<Pi>']z \<equiv> [\<Pi>]z))]\<close>
+      {
+        fix \<kappa>\<^sub>0
+        assume \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0]\<close>
+        hence \<open>[v \<Turnstile> O!\<kappa>\<^sub>0]\<close>
+          using AOT_sem_ordinary by metis
+        moreover have \<open>[v \<Turnstile> \<kappa>\<^sub>0\<down>]\<close>
+          using calculation by (simp add: AOT_sem_exe)
+        ultimately have \<open>[v \<Turnstile> \<box>([\<Pi>']\<kappa>\<^sub>0 \<equiv> [\<Pi>]\<kappa>\<^sub>0)]\<close>
+          using 4 by (auto simp: AOT_sem_forall AOT_sem_imp)
+      } note 4 = this
+      {
+        fix \<Pi>'' :: \<open><\<kappa>>\<close>
+        assume \<open>[v \<Turnstile> \<Pi>''\<down>]\<close>
+        moreover assume \<open>[w \<Turnstile> [\<Pi>'']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0]\<close> if \<open>[v \<Turnstile> [\<lambda>x \<diamond>E!x]\<kappa>\<^sub>0]\<close> for \<kappa>\<^sub>0 w
+        ultimately have 5: \<open>[v \<Turnstile> x[\<Pi>'']]\<close>
+          using 4 3
+          by (auto simp: AOT_sem_imp AOT_sem_equiv AOT_sem_box)
+      } note 5 = this
+      have \<open>[v \<Turnstile> y[\<Pi>']]\<close>
+        apply (rule AOT_sem_enc_indistinguishable_all[OF AOT_ExtendedModel])
+        apply (fact 0)
+        by (auto simp: 5 0 1 \<Pi>_den indist[simplified AOT_sem_forall
+                       AOT_sem_box AOT_sem_equiv])
+    }
+    moreover {
+    {
+      assume \<open>[v \<Turnstile> \<forall>G(\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> y[G])]\<close>
+      hence 3: \<open>[v \<Turnstile> \<forall>G(\<forall>z ([\<lambda>x \<diamond>[E!]x]z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> y[G])]\<close>
+        by (simp add: AOT_sem_ordinary)
+      {
+        fix \<Pi>' :: \<open><\<kappa>>\<close>
+        assume 1: \<open>[v \<Turnstile> \<Pi>'\<down>]\<close>
+        assume 2: \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]z \<rightarrow> \<box>([\<Pi>']z \<equiv> [\<Pi>]z)]\<close> for z
+        have \<open>[v \<Turnstile> y[\<Pi>']]\<close>
+          using 3
+          apply (simp add: AOT_sem_forall AOT_sem_imp AOT_sem_box AOT_sem_denotes)
+          by (metis (no_types, lifting) 1 2 AOT_model.AOT_term_of_var_cases
+                                        AOT_sem_box AOT_sem_denotes AOT_sem_imp)
+      } note 3 = this
+      fix \<Pi>' :: \<open><\<kappa>>\<close>
+      assume \<Pi>_den: \<open>[v \<Turnstile> \<Pi>'\<down>]\<close>
+      assume 4: \<open>[v \<Turnstile> \<forall>z (O!z \<rightarrow> \<box>([\<Pi>']z \<equiv> [\<Pi>]z))]\<close>
+      {
+        fix \<kappa>\<^sub>0
+        assume \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0]\<close>
+        hence \<open>[v \<Turnstile> O!\<kappa>\<^sub>0]\<close>
+          using AOT_sem_ordinary by metis
+        moreover have \<open>[v \<Turnstile> \<kappa>\<^sub>0\<down>]\<close>
+          using calculation by (simp add: AOT_sem_exe)
+        ultimately have \<open>[v \<Turnstile> \<box>([\<Pi>']\<kappa>\<^sub>0 \<equiv> [\<Pi>]\<kappa>\<^sub>0)]\<close>
+          using 4 by (auto simp: AOT_sem_forall AOT_sem_imp)
+      } note 4 = this
+      {
+        fix \<Pi>'' :: \<open><\<kappa>>\<close>
+        assume \<open>[v \<Turnstile> \<Pi>''\<down>]\<close>
+        moreover assume \<open>[w \<Turnstile> [\<Pi>'']\<kappa>\<^sub>0] = [w \<Turnstile> [\<Pi>']\<kappa>\<^sub>0]\<close> if \<open>[v \<Turnstile> [\<lambda>x \<diamond>E!x]\<kappa>\<^sub>0]\<close> for w \<kappa>\<^sub>0
+        ultimately have \<open>[v \<Turnstile> y[\<Pi>'']]\<close>
+          using 3 4 by (auto simp: AOT_sem_imp AOT_sem_equiv AOT_sem_box)
+      } note 5 = this
+      have \<open>[v \<Turnstile> x[\<Pi>']]\<close>
+        apply (rule AOT_sem_enc_indistinguishable_all[OF AOT_ExtendedModel])
+              apply (fact 1)
+        by (auto simp: 5 0 1 \<Pi>_den indist[simplified AOT_sem_forall
+                       AOT_sem_box AOT_sem_equiv])
+    }
+  }
+  ultimately show \<open>[v \<Turnstile> \<forall>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> x[G])] =
+        [v \<Turnstile> \<forall>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) \<rightarrow> y[G])]\<close>
+    by (auto simp: AOT_sem_forall AOT_sem_imp)
+qed
+
+lemma AOT_sem_indistinguishable_ord_enc_ex:
+  assumes \<Pi>_den: \<open>[v \<Turnstile> \<Pi>\<down>]\<close>
+  assumes Ax: \<open>[v \<Turnstile> A!x]\<close>
+  assumes Ay: \<open>[v \<Turnstile> A!y]\<close>
+  assumes indist: \<open>[v \<Turnstile> \<forall>F \<box>([F]x \<equiv> [F]y)]\<close>
+  shows \<open>[v \<Turnstile> \<exists>G(\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & x[G])] =
+         [v \<Turnstile> \<exists>G(\<forall>z(O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & y[G])]\<close>
+proof -
+  have Aux: \<open>[v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>] = ([v \<Turnstile> [\<lambda>x \<diamond>[E!]x]\<kappa>] \<and> [v \<Turnstile> \<kappa>\<down>])\<close> for v \<kappa>
+    using AOT_sem_exe by blast
+  AOT_modally_strict {
+    fix x y
+    AOT_assume \<Pi>_den: \<open>[\<Pi>]\<down>\<close>
+    AOT_assume 2: \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+    AOT_assume \<open>A!x\<close>
+    AOT_hence 0: \<open>[\<lambda>x \<not>\<diamond>[E!]x]x\<close>
+      by (simp add: AOT_sem_abstract)
+    AOT_assume \<open>A!y\<close>
+    AOT_hence 1: \<open>[\<lambda>x \<not>\<diamond>[E!]x]y\<close>
+      by (simp add: AOT_sem_abstract)
+    {
+      AOT_assume \<open>\<exists>G(\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & x[G])\<close>
+      then AOT_obtain \<Pi>'
+        where \<Pi>'_den: \<open>\<Pi>'\<down>\<close>
+          and \<Pi>'_indist: \<open>\<forall>z (O!z \<rightarrow> \<box>([\<Pi>']z \<equiv> [\<Pi>]z))\<close>
+          and x_enc_\<Pi>': \<open>x[\<Pi>']\<close>
+        by (meson AOT_sem_conj AOT_sem_exists)
+      {
+        fix \<kappa>\<^sub>0
+        AOT_assume \<open>[\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0\<close>
+        AOT_hence \<open>\<box>([\<Pi>']\<kappa>\<^sub>0 \<equiv> [\<Pi>]\<kappa>\<^sub>0)\<close>
+          using \<Pi>'_indist
+          by (auto simp: AOT_sem_exe AOT_sem_imp AOT_sem_exists AOT_sem_conj
+                         AOT_sem_ordinary AOT_sem_forall)
+      } note 3 = this
+      AOT_have \<open>\<forall>z ([\<lambda>x \<diamond>[E!]x]z \<rightarrow> \<box>([\<Pi>']z \<equiv> [\<Pi>]z))\<close>
+        using \<Pi>'_indist by (simp add: AOT_sem_ordinary)
+      AOT_obtain \<Pi>'' where
+          \<Pi>''_den: \<open>\<Pi>''\<down>\<close> and
+          \<Pi>''_indist: \<open>[\<lambda>x \<diamond>[E!]x]\<kappa>\<^sub>0 \<rightarrow> \<box>([\<Pi>'']\<kappa>\<^sub>0 \<equiv> [\<Pi>]\<kappa>\<^sub>0)\<close> and
+          y_enc_\<Pi>'': \<open>y[\<Pi>'']\<close> for \<kappa>\<^sub>0
+        using AOT_sem_enc_indistinguishable_ex[OF AOT_ExtendedModel,
+                OF 0, OF 1, rotated, OF \<Pi>_den,
+                OF exI[where x=\<Pi>'], OF conjI, OF \<Pi>'_den, OF conjI,
+                OF x_enc_\<Pi>', OF allI, OF impI,
+                OF 3[simplified AOT_sem_box AOT_sem_equiv], simplified, OF
+                2[simplified AOT_sem_forall AOT_sem_equiv AOT_sem_box,
+                  THEN spec, THEN mp, THEN spec], simplified]
+        unfolding AOT_sem_imp AOT_sem_box AOT_sem_equiv by blast
+      {
+        AOT_have \<open>\<Pi>''\<down>\<close>
+            and \<open>\<forall>x ([\<lambda>x \<diamond>[E!]x]x \<rightarrow> \<box>([\<Pi>'']x \<equiv> [\<Pi>]x))\<close>
+            and \<open>y[\<Pi>'']\<close>
+          apply (simp add: \<Pi>''_den)
+          apply (simp add: AOT_sem_forall \<Pi>''_indist)
+          by (simp add: y_enc_\<Pi>'')
+      } note 2 = this
+      AOT_have \<open>\<exists>G(\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & y[G])\<close>
+        apply (simp add: AOT_sem_exists AOT_sem_ordinary
+            AOT_sem_imp AOT_sem_box AOT_sem_forall AOT_sem_equiv AOT_sem_conj)
+        using 2[simplified AOT_sem_box AOT_sem_equiv AOT_sem_imp AOT_sem_forall]
+        by blast
+    }
+  } note 0 = this
+  AOT_modally_strict {
+    {
+      fix x y
+      AOT_assume \<Pi>_den: \<open>[\<Pi>]\<down>\<close>
+      moreover AOT_assume \<open>\<forall>F \<box>([F]x \<equiv> [F]y)\<close>
+      moreover AOT_have \<open>\<forall>F \<box>([F]y \<equiv> [F]x)\<close>
+        using calculation(2)
+        by (auto simp: AOT_sem_forall AOT_sem_box AOT_sem_equiv)
+      moreover AOT_assume \<open>A!x\<close>
+      moreover AOT_assume \<open>A!y\<close>
+      ultimately AOT_have \<open>\<exists>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & x[G]) \<equiv>
+                           \<exists>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & y[G])\<close>
+        using 0 by (auto simp: AOT_sem_equiv)
+    }
+    have 1: \<open>[v \<Turnstile> \<forall>F \<box>([F]y \<equiv> [F]x)]\<close>
+      using indist
+      by (auto simp: AOT_sem_forall AOT_sem_box AOT_sem_equiv)
+    thus \<open>[v \<Turnstile> \<exists>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & x[G])] =
+        [v \<Turnstile> \<exists>G (\<forall>z (O!z \<rightarrow> \<box>([G]z \<equiv> [\<Pi>]z)) & y[G])]\<close>
+      using assms
+      by (auto simp: AOT_sem_imp AOT_sem_conj AOT_sem_equiv 0)
+  }
+qed
+end
+
+
+(* Collect all theorems that are not in Main and not declared [AOT]
+   and store them in a blacklist. *)
+setup\<open>setup_AOT_no_atp\<close>
+bundle AOT_no_atp begin declare AOT_no_atp[no_atp] end
+(* Can be used as: "including AOT_no_atp sledgehammer" or
+   "sledgehammer(del: AOT_no_atp) *)
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/AOT/AOT_syntax.ML b/thys/AOT/AOT_syntax.ML
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_syntax.ML
@@ -0,0 +1,537 @@
+fun AOT_binder_trans thy bnd syntaxConst =
+  (Lexicon.mark_const (Sign.full_name thy bnd),
+   K (fn trms => Term.list_comb (Const (syntaxConst, dummyT),trms)))
+
+datatype AOT_VariableKind = AOT_Variable of (term*term) option | AOT_MetaVariable
+structure AOT_VariablePrefix = Theory_Data (
+  type T = (AOT_VariableKind*string) Symtab.table
+  val empty = Symtab.empty
+  val extend = I
+  (* TODO: probably better to remove conflicts than to ignore them *)
+  val merge = Symtab.merge (K true)
+);
+structure AOT_PremiseSetPrefix = Theory_Data (
+  type T = unit Symtab.table
+  val empty = Symtab.empty
+  val extend = I
+  val merge = Symtab.merge (K true)
+);
+structure AOT_Constraints = Theory_Data (
+  type T = (term*term) Symtab.table
+  val empty = Symtab.empty
+  val extend = I
+  val merge = Symtab.merge (fn ((x,y),(x',y')) => x = x' andalso y = y')
+)
+structure AOT_Restriction = Theory_Data (
+  type T = (term*term) Symtab.table
+  val empty = Symtab.empty
+  val extend = I
+  val merge = Symtab.merge (fn ((x,y),(x',y')) => x = x' andalso y = y')
+)
+
+fun AOT_IsPremiseSetPrefix ctxt = Local_Theory.raw_theory_result
+  (fn thy => (AOT_PremiseSetPrefix.get thy, thy)) ctxt
+  |> fst |> Symtab.lookup #> Option.isSome
+
+fun term_of_sort S =
+  let
+    val class = Syntax.const o Lexicon.mark_class;
+    fun classes [c] = class c
+      | classes (c :: cs) = Syntax.const "_classes" $ class c $ classes cs
+      | classes _ = raise Fail "Unexpected.";
+  in
+    if S = dummyS then Syntax.const "_dummy_sort"
+    else
+      (case S of
+        [] => Syntax.const "_topsort"
+      | [c] => class c
+      | cs => Syntax.const "_sort" $ classes cs)
+  end
+fun term_of (Type (a, Ts)) = 
+      Term.list_comb (Syntax.const (Lexicon.mark_type a), map term_of Ts)
+  | term_of (TFree ("'_dummy_",sort)) =
+      (Const ("_dummy_ofsort", dummyT) $ term_of_sort sort)
+  | term_of (t as TFree _) = (@{print} t; raise Term.TYPE ("", [t], []))
+  | term_of (TVar _) = raise Fail "";
+
+fun fetchTermCategory ctxt = Local_Theory.raw_theory_result (fn thy =>
+  (Symtab.lookup (AOT_VariablePrefix.get thy), thy)) ctxt |> fst
+fun maybeGetConstraint ctxt unary name = Local_Theory.raw_theory_result (fn thy => 
+   ((if unary then Option.map fst else Option.map snd)
+    (Symtab.lookup (AOT_Constraints.get thy) name), thy)) ctxt |> fst
+fun getConstraint ctxt unary name =
+  (case maybeGetConstraint ctxt unary name of SOME c => c |
+   _ => raise Fail ("Unknown type category: " ^ name))
+
+fun fetchTermConstraint ctxt name unary =
+  Local_Theory.raw_theory_result (fn thy =>
+    (Option.map (fn (meta, category) => (meta, getConstraint ctxt unary category))
+    ((Symtab.lookup o AOT_VariablePrefix.get) thy (hd (Symbol.explode name))), thy)
+) ctxt |> fst
+
+fun register_constraint (name:string, (unaryConstraint,naryConstraint)) thy = (
+let
+fun trmOf constr = term_of (Syntax.parse_typ (Proof_Context.init_global thy) constr)
+val unaryConstraint = trmOf unaryConstraint
+val naryConstraint = (case naryConstraint of
+  (SOME constraint) => trmOf constraint
+  | _ => unaryConstraint
+)
+in 
+AOT_Constraints.map (Symtab.update (name, (unaryConstraint, naryConstraint))) thy
+end
+)
+
+fun register_variable_name meta (category, prefices) thy =
+let
+val restr = (Symtab.lookup (AOT_Restriction.get thy) category)
+val kind = if meta then AOT_MetaVariable else AOT_Variable restr
+in
+   fold (fn prefix => AOT_VariablePrefix.map
+      (Symtab.update (prefix, (kind, category)))) prefices thy
+end
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_register_variable_names\<close>
+  "Register variable names for type categories."
+  (Parse.and_list1 ((Parse.short_ident --| Parse.$$$ ":" )
+                    -- Scan.repeat1 Parse.short_ident)
+   >> (Toplevel.theory o (fold (register_variable_name false))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_register_metavariable_names\<close>
+  "Register meta-variable names for type categories."
+    (Parse.and_list1 ((Parse.short_ident --| Parse.$$$ ":")
+                      -- Scan.repeat1 Parse.short_ident)
+     >> (Toplevel.theory o (fold (register_variable_name true))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_register_premise_set_names\<close>
+  "Register names for premise sets."
+  (Scan.repeat1 Parse.short_ident
+   >> (Toplevel.theory o fold
+          (fn prefix => AOT_PremiseSetPrefix.map (Symtab.update (prefix,())))));
+val _ =
+  Outer_Syntax.command \<^command_keyword>\<open>AOT_register_type_constraints\<close>
+  "Register constraints for term types."
+  (Parse.and_list1 ((Parse.short_ident --| Parse.$$$ ":")
+                    -- (Parse.typ -- Scan.option Parse.typ))
+  >> (Toplevel.theory o fold register_constraint));
+
+
+fun decode_pos str =
+  case (Term_Position.decode str) of SOME pos => pos
+  | _ => raise Fail "expected position"
+fun unconstrain_var
+  (Ast.Appl [Ast.Constant "_constrain", Ast.Variable name, Ast.Variable pos]) =
+    (name, decode_pos pos)
+  | unconstrain_var ast = raise Ast.AST
+      ("Expected position constrained variable.", [ast])
+fun make_constrained_var sx =
+  (Ast.Appl [Ast.Constant "_constrain", Ast.Variable (Symbol_Pos.implode sx),
+             Ast.Variable (Term_Position.encode
+                (Position.range_position (Symbol_Pos.range sx)))])
+fun implode_pos x = (Symbol_Pos.implode_range (Symbol_Pos.range x) x) |>
+  (fn (x,y) => (x,Position.range_position y))
+fun splitFormulaParts x = x |> unconstrain_var |> Symbol_Pos.explode |>
+   Scan.finite Symbol_Pos.stopper (Scan.repeat (
+  (Scan.one (Symbol_Pos.symbol #> Symbol.is_letter) --
+  (((Scan.repeat (Symbol_Pos.$$ "\<^sub>" --
+     (Scan.one (Symbol_Pos.symbol #> Symbol.is_digit)) >>
+     (fn (x,y) => [x,y])) >> List.concat)
+  -- (Scan.repeat (Symbol_Pos.$$ "'"))) >> (fn (x,y) => x@y)))))
+fun parseFormulaParts x = (case splitFormulaParts x of
+    (parts,[]) => parts |> map (fn (x,y) => implode_pos (x::y))
+    | _ => raise Ast.AST ("Expected one or more variable or term names.", [x]))
+fun foldAppl const = List.rev #> (fn list => fold (fn a => fn b =>
+  (Ast.mk_appl (Ast.Constant const) [a,b])) (tl list) (hd list))
+fun dropConstraints (Const ("_constrain", _) $ x $ _) = dropConstraints x
+  | dropConstraints (Const ("_constrainAbs", _) $ x $ _) = dropConstraints x
+  | dropConstraints (Abs (a, b, x)) = Abs (a, b, dropConstraints x)
+  | dropConstraints (x$y) = dropConstraints x $ dropConstraints y
+  | dropConstraints x = x
+
+local
+fun constrain (name, pos) = Ast.mk_appl (Ast.Constant "_constrain")
+  [Ast.Variable name, Ast.Variable (Term_Position.encode pos)]
+in
+fun AOT_split_exe_vars [x] = x |> parseFormulaParts |> map constrain |> 
+  map (fn x => Ast.mk_appl (Ast.Constant "_AOT_term_var") [x]) |>
+  foldAppl "_AOT_exe_args"
+fun AOT_split_lambda_args [x] = x |> parseFormulaParts |> map constrain |> 
+  map (fn x => Ast.mk_appl (Ast.Constant "_AOT_var") [x]) |>
+  foldAppl \<^const_syntax>\<open>Pair\<close>
+fun AOT_check_var [x] = x |> parseFormulaParts |> map constrain |>
+  (fn [x] => Ast.mk_appl (Ast.Constant "_AOT_var") [x]
+    | _ => raise Ast.AST ("Expected single variable.", [x]))
+end
+
+fun parseVar unary ctxt [var as Const ("_constrain", _) $ Free (x,_) $ Free _] =
+        Const ("_constrain", dummyT) $ var $ (case fetchTermConstraint ctxt x unary of
+            SOME (AOT_MetaVariable,_) => raise Term.TERM
+              ("Expected variable prefix, but got metavariable prefix.", [var])
+          | SOME (AOT_Variable _, constraint) => constraint
+          | _ => raise Term.TERM ("Unknown variable prefix.", [var]))
+  | parseVar _ _ var = raise Term.TERM ("Expected constrained free variable.", var)
+
+fun constrainTrm ctxt forceMeta unary (Free (var, _)) = (fn trm =>
+      case fetchTermConstraint ctxt var unary of
+        SOME (AOT_MetaVariable,constraint) =>
+          Const ("_constrain", dummyT) $ trm $ constraint
+      | SOME (AOT_Variable restr, constraint) =>
+          if forceMeta then Const ("_constrain", dummyT) $ trm $ constraint
+          else Const ("_constrain", dummyT) $
+               (Const (\<^const_name>\<open>AOT_term_of_var\<close>, dummyT) $
+                (case restr of SOME (_,r) => r $ trm | _ => trm)) $
+               constraint
+      | _ => raise Term.TERM ("Unknown variable or metavariable prefix.", [trm]))
+  | constrainTrm _ _ _ (Bound _) = (fn var => var)
+  | constrainTrm _ _ _ trm = raise Term.TERM
+    ("Expected free or bound variable.", [trm])
+fun isPremiseVar ctxt (Free (var, _)) =
+    AOT_IsPremiseSetPrefix ctxt (hd (Symbol.explode var))
+  | isPremiseVar _ _ = false
+fun getVarConstraint ctxt unary (Free (var, _)) =
+  (case fetchTermConstraint ctxt var unary of
+        SOME (AOT_MetaVariable,_) => NONE
+      | SOME (AOT_Variable Rep_term,_) => Option.map fst Rep_term
+      | _ => NONE)
+  | getVarConstraint _ _ _ = NONE
+fun getVarConstraints ctxt (Const (\<^syntax_const>\<open>_AOT_term_var\<close>, _) $ v) =
+    (case (getVarConstraint ctxt true (dropConstraints v)) of SOME c => [(c,v)]
+        | _ => [])
+  | getVarConstraints ctxt (Const ("_AOT_term_vars", _) $ v) =
+    (case (getVarConstraint ctxt true (dropConstraints v)) of SOME c => [(c,v)]
+      | _ => [])
+  | getVarConstraints _ (Const (\<^syntax_const>\<open>_AOT_verbatim\<close>, _) $ _) = []
+  | getVarConstraints ctxt (x $ y) =
+    getVarConstraints ctxt x @ getVarConstraints ctxt y
+  | getVarConstraints ctxt (Abs (_,_,z)) = getVarConstraints ctxt z
+  | getVarConstraints _ _ = []
+fun processFreesForceMeta forceMeta premiseVars ctxt
+  (Const (\<^syntax_const>\<open>_AOT_term_var\<close>, _) $ v) = (
+    if isPremiseVar ctxt (dropConstraints v)
+    then (dropConstraints v, if List.find (fn x => x = v) premiseVars = NONE
+                             then v::premiseVars else premiseVars)
+    else (constrainTrm ctxt forceMeta true (dropConstraints v) v, premiseVars))
+  | processFreesForceMeta forceMeta premiseVars ctxt
+    (Const ("_AOT_term_vars", _) $ v) = (if isPremiseVar ctxt (dropConstraints v)
+     then (v, if List.find (fn x => x = v) premiseVars = NONE
+              then v::premiseVars else premiseVars)
+     else (constrainTrm ctxt forceMeta false (dropConstraints v) v, premiseVars)
+  )
+  | processFreesForceMeta _ premiseVars _
+    (Const (\<^syntax_const>\<open>_AOT_verbatim\<close>, _) $ v) = (v, premiseVars)
+  | processFreesForceMeta forceMeta premiseVars ctxt (x $ y)  = let
+          val (x, premiseVars) = processFreesForceMeta forceMeta premiseVars ctxt x
+          val (y, premiseVars) = processFreesForceMeta forceMeta premiseVars ctxt y
+      in (x $ y, premiseVars) end
+  | processFreesForceMeta forceMeta premiseVars ctxt (Abs (x,y,z)) = let
+      val (z, premiseVars) = processFreesForceMeta forceMeta premiseVars ctxt z
+      in (Abs (x,y,z), premiseVars) end
+  | processFreesForceMeta _ premiseVars _ x = (x, premiseVars)
+fun processFrees ctxt trm =
+  (case processFreesForceMeta false [] ctxt trm of (r,[]) => r
+    | _ => raise Term.TERM ("No premise set expected in term.", [trm]))
+fun processFreesAlwaysMeta ctxt trm =
+  (case processFreesForceMeta true [] ctxt trm of (r,[]) => r
+    | _ => raise Term.TERM ("No premise set expected in term.", [trm]))
+val processFreesAndPremises = processFreesForceMeta false []
+
+local
+fun makeArgList (Const (\<^syntax_const>\<open>_AOT_exe_args\<close>, _) $ y $ z) =
+    makeArgList y @ makeArgList z
+  | makeArgList t = [t]
+fun makePairs (x::[]) = x
+  | makePairs (x::xs) = Const (\<^const_syntax>\<open>Pair\<close>, dummyT) $ x $ makePairs xs
+fun makeExeArgs y = makePairs (makeArgList y)
+in
+fun foldPremises world (Const (\<^syntax_const>\<open>_AOT_premises\<close>, _) $ p1 $ p2) y =
+  @{const "Pure.imp"} $ (p1 $ world) $ foldPremises world p2 y
+| foldPremises world x y =
+  @{const "Pure.imp"} $ (x $ world) $
+  HOLogic.mk_Trueprop (@{const AOT_model_valid_in} $ world $ y)
+fun parseExe ctxt [x,y] = (Const (\<^const_syntax>\<open>AOT_exe\<close>, dummyT) $ x $ makeExeArgs y)
+fun parseEnc ctxt [x,y] = (Const ("AOT_enc", dummyT) $ makeExeArgs x $ y)
+fun parseEquivDef ctxt [lhs,rhs] =
+  let
+    val constraints = getVarConstraints ctxt lhs
+    fun collectConstraints c [] = c
+     | collectConstraints NONE ((x,y)::xs) = collectConstraints (SOME (x $ y)) xs
+     | collectConstraints (SOME c) ((x,y)::xs) =
+          collectConstraints (SOME (Const ("AOT_conj", dummyT) $  c $ (x $ y))) xs
+    val rhs = (case collectConstraints NONE constraints
+               of SOME c => Const ("AOT_conj", dummyT) $ c $ rhs
+               | _ => rhs)
+  in
+  HOLogic.mk_Trueprop (\<^const>\<open>AOT_model_equiv_def\<close> $ processFreesAlwaysMeta ctxt lhs $
+      processFreesAlwaysMeta ctxt rhs)
+  end
+  | parseEquivDef _ terms = raise Term.TERM ("Expected definition arguments.", terms)
+fun parseIdDef ctxt [lhs, rhs] =
+  let
+    val lhs = processFreesAlwaysMeta ctxt lhs
+    val rhs = processFreesAlwaysMeta ctxt rhs
+    fun add_frees (Free _) frees = frees
+      | add_frees (Const _) frees = frees
+      | add_frees (Free _ $ args) frees = Term.add_frees args frees
+      | add_frees (Const _ $ args) frees = Term.add_frees args frees
+      | add_frees (args $ args') frees =
+        Term.add_frees args' (Term.add_frees args frees)
+      | add_frees trm _ = raise Term.TERM ("Expected definition term.", [trm])
+    val lhs' = dropConstraints lhs
+    val rhs' = dropConstraints rhs
+    val frees = add_frees lhs' []
+    val _ = frees = add_frees rhs' frees orelse
+            raise Term.TERM ("Invalid free variables on RHS.", [lhs,rhs])
+    fun mkabs trm = if frees = []
+      then Const (\<^const_name>\<open>case_unit\<close>, dummyT) $ trm
+      else fold_rev
+        (fn (s, T) => fn t => Const (\<^const_name>\<open>case_prod\<close>, dummyT) $
+                              Term.absfree (s, T) t)
+        (List.rev (tl frees)) (Term.absfree (hd frees) trm)
+    val lhs_abs = mkabs lhs
+    val rhs_abs = mkabs rhs
+  in
+    (Const ("_constrain", dummyT) $
+     Const (\<^const_name>\<open>AOT_model_id_def\<close>, dummyT) $
+     (Const (\<^type_syntax>\<open>fun\<close>, dummyT) $
+        (Const (\<^type_syntax>\<open>fun\<close>, dummyT) $ Const (\<^type_syntax>\<open>dummy\<close>, dummyT) $
+         (getConstraint ctxt false "Term")) $
+        (Const (\<^type_syntax>\<open>dummy\<close>, dummyT)))
+    )
+    $ lhs_abs $ rhs_abs
+  end
+  | parseIdDef _ terms = raise Term.TERM ("Expected definition arguments.", terms)
+end
+
+fun parseEllipseList constName _ [s,e] =
+  let
+    val (start_name, start_pos) = unconstrain_var s
+    val (end_name, end_pos) = unconstrain_var e
+    val _ = let val h = hd (Symbol.explode start_name) in
+        if (h = hd (Symbol.explode end_name))
+        then h else raise Ast.AST ("Invalid ellipses.", [s,e])
+      end
+    val name = (Symbol_Pos.explode (start_name, start_pos)) @
+      (Symbol_Pos.explode (end_name, end_pos))
+  in
+    Ast.mk_appl (Ast.Constant constName) [make_constrained_var name]
+  end
+  | parseEllipseList _ _ _ = raise Fail "Invalid ellipse parsing."
+
+datatype PrintVarKind = SingleVariable of string |
+  Ellipses of string*string | Verbatim of string
+
+fun printVarKind name = let
+fun splitFormulaParts x = x |> Symbol.explode |>
+   Scan.finite Symbol.stopper (Scan.repeat (
+  (Scan.one (Symbol.is_letter) --
+  (((Scan.repeat ($$ "\<^sub>" -- (Scan.one (Symbol.is_char)) >>
+    (fn (x,y) => [x,y])) >> List.concat )
+  -- (Scan.repeat ($$ "'"))) >> (fn (x,y) => x@y)))))
+val parts = splitFormulaParts (Name.clean name)
+val isSingleVariableName = case parts of
+        ([_],[]) => true | _ => false
+(* TODO: ellipses handling is very fragile *)
+val (isEllipses,s,e) = case parts
+  of ([(n,s),(m,e)],[]) => (n = m, n^String.concat s, m^String.concat e)
+  | _ => (false,"","")
+in
+if isSingleVariableName then SingleVariable name else
+if isEllipses then Ellipses (s,e)
+else Verbatim name
+end
+
+local
+fun addFunct (x,f) g = (x, fn y => g (f y))
+fun unconstrain (Ast.Appl (Ast.Constant "_constrain"::x::tl)) =
+      addFunct (unconstrain x) (fn x => Ast.Appl (Ast.Constant "_constrain"::x::tl))
+  | unconstrain (Ast.Appl (Ast.Constant "_free"::[x])) =
+      addFunct (unconstrain x) (fn x => Ast.Appl (Ast.Constant "_free"::[x]))
+  | unconstrain (Ast.Appl (Ast.Constant "_bound"::[x])) =
+      addFunct (unconstrain x) (fn x => Ast.Appl (Ast.Constant "_bound"::[x]))
+  | unconstrain (Ast.Appl (Ast.Constant "_var"::[x])) =
+      addFunct (unconstrain x) (fn x => Ast.Appl (Ast.Constant "_var"::[x]))
+  | unconstrain trm = (trm, fn x => x)
+fun isDefinedConst ctxt name = let
+  val unmarkedName = Lexicon.unmark {case_class = fn str => NONE,
+      case_type = fn name => NONE,
+      case_const = fn name => SOME name,
+      case_fixed = fn name => NONE,
+      case_default = fn name => SOME name} name
+  val cons = Option.mapPartial (fn name => try (Proof_Context.read_const
+    {proper = true, strict = true} ctxt) name) unmarkedName
+  val defined = case cons of
+    SOME cons =>
+      Termtab.defined (AOT_DefinedConstants.get (Proof_Context.theory_of ctxt)) cons
+      orelse (case cons of Const (name,_) => name = \<^const_name>\<open>AOT_concrete\<close>
+                                      | _ => false)
+    | _ => false
+  in defined end
+in
+val AOT_print_individual_term = (fn ctxt =>
+    (fn [trm as Ast.Appl (Ast.Constant \<^const_syntax>\<open>AOT_term_of_var\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant \<^syntax_const>\<open>_AOT_desc\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant \<^syntax_const>\<open>_AOT_free_var_ellipse\<close>::_)] => trm
+    | [trm as Ast.Constant _] => trm
+    | [trm] => (case unconstrain trm
+      of (Ast.Variable name,c) => (case printVarKind name
+        of SingleVariable x => c (Ast.Variable name)
+         | Ellipses (x,y) =>
+            (Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_exe_arg_ellipse\<close>)
+              [c (Ast.Variable x), c (Ast.Variable y)])
+         | _ => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm])
+        | (Ast.Constant name,c) =>
+            if isDefinedConst ctxt name
+            then c (Ast.Constant name)
+            else Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm]
+        |  (trm' as Ast.Appl (Ast.Constant name::_),c) =>
+            if isDefinedConst ctxt name
+            then c trm'
+            else Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm]
+        |  _ => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm])
+    | trms => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) trms))
+val AOT_print_relation_term = (fn ctxt =>
+    (fn [Ast.Appl [Ast.Constant \<^const_syntax>\<open>AOT_term_of_var\<close>,
+                   Ast.Constant \<^const_syntax>\<open>AOT_concrete\<close>]] => 
+        Ast.Constant \<^syntax_const>\<open>_AOT_concrete\<close>
+    | [trm as Ast.Appl (Ast.Constant \<^const_syntax>\<open>AOT_term_of_var\<close>::_)] =>
+      Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_explicitRelation\<close>) [trm]
+    | [trm as Ast.Appl (Ast.Constant \<^syntax_const>\<open>_AOT_lambda\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant \<^const_syntax>\<open>AOT_lambda\<close>::_)] => trm
+    | [trm] => (case unconstrain trm
+        of (Ast.Variable name,c) => 
+          (case printVarKind name
+           of SingleVariable _ =>
+            (Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_explicitRelation\<close>)
+            [c (Ast.Variable name)])
+           | _ => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm])
+        | (Ast.Constant name,c) =>
+          if isDefinedConst ctxt name
+          then c (Ast.Constant name)
+          else Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm]
+        |  (trm' as Ast.Appl (Ast.Constant name::_),c) =>
+            if isDefinedConst ctxt name
+            then (Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_explicitRelation\<close>) [c trm'])
+            else Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm]
+        |  _ => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm])
+    | trms => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) trms))
+val AOT_print_generic_term = (fn ctxt =>
+    (fn [Ast.Appl [Ast.Constant \<^const_syntax>\<open>AOT_term_of_var\<close>,
+                   Ast.Constant \<^const_syntax>\<open>AOT_concrete\<close>]] => 
+        Ast.Constant \<^syntax_const>\<open>_AOT_concrete\<close>
+    | [trm as Ast.Appl (Ast.Constant \<^const_syntax>\<open>AOT_term_of_var\<close>::_)] =>
+(*        Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_explicitRelation\<close>) [trm] *)
+      trm
+    | [trm as Ast.Appl (Ast.Constant \<^syntax_const>\<open>_AOT_desc\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant \<^syntax_const>\<open>_AOT_free_var_ellipse\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant \<^syntax_const>\<open>_AOT_lambda\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant \<^const_syntax>\<open>AOT_lambda\<close>::_)] => trm
+    | [trm as Ast.Appl (Ast.Constant "_AOT_raw_appl"::_)] => trm
+    | [trm] => (case unconstrain trm
+      of (Ast.Variable name,c) => 
+        (case printVarKind name
+         of SingleVariable x => c (Ast.Variable name)
+          | Ellipses (x,y) =>
+            (Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_exe_arg_ellipse\<close>)
+             [c (Ast.Variable x), c (Ast.Variable y)])
+          | _ => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm]
+        ) 
+        | (Ast.Constant name,c) =>
+          if isDefinedConst ctxt name
+          then c (Ast.Constant name)
+          else Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm]
+        |  (trm' as Ast.Appl (Ast.Constant name::_),c) =>
+            (if isDefinedConst ctxt name
+             then c trm'
+             else Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm])
+        |  _ => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) [trm])
+    | trms => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_quoted\<close>) trms))
+end
+
+fun AOT_preserve_binder_abs_tr' constName syntaxConst
+  (ellipseConst,includesSyntaxConst) restrConnect = (constName, fn ctxt => fn terms =>
+let
+val term_opt = case terms of Abs (name, T, trm)::trms => 
+let
+val trm = case printVarKind name of SingleVariable name =>
+    let
+      val optBody = case fetchTermCategory ctxt (hd (Symbol.explode (name)))
+      of SOME (AOT_Variable _, category) =>
+        let
+          val (restr, _) = Local_Theory.raw_theory_result
+            (fn thy => (Symtab.lookup (AOT_Restriction.get thy) category, thy)) ctxt
+        in
+          case restr of SOME restr =>
+            (case trm of (Const (c,_) $ x $ trm) =>
+              if (c = restrConnect orelse Lexicon.unmark_const c = restrConnect)
+              then
+                if Term.could_unify (Abs ("x", dummyT, x),
+                      Abs ("x", dummyT,  Term.betapply (fst restr,(Bound 0)))) then
+                  SOME trm
+                else
+                  NONE
+              else NONE | _ => NONE)
+          | _ => NONE
+        end
+        | _ => NONE
+      val terms = case optBody of SOME trm => Abs (name, T, trm)::trms | _ => trms
+    in
+        snd (Syntax_Trans.preserve_binder_abs_tr' constName syntaxConst) ctxt terms
+    end
+  | Ellipses (s,e) =>
+    let
+    val body = Term.subst_bound (Const (\<^syntax_const>\<open>_AOT_free_var_ellipse\<close>, dummyT) $
+      Syntax_Trans.mark_bound_body (s,dummyT) $
+      Syntax_Trans.mark_bound_body (e,dummyT),
+    trm)
+    in
+      if includesSyntaxConst then
+        list_comb (Syntax.const ellipseConst $ Syntax_Trans.mark_bound_abs (s,dummyT) $ 
+        Syntax_Trans.mark_bound_abs (e,dummyT) $ body, trms)
+      else
+        list_comb (Syntax.const syntaxConst $
+          (Syntax.const ellipseConst $ Syntax_Trans.mark_bound_abs (s,dummyT) $ 
+           Syntax_Trans.mark_bound_abs (e,dummyT)) $ body, trms)
+    end
+  | Verbatim _ => (* TODO *)
+    snd (Syntax_Trans.preserve_binder_abs_tr' constName syntaxConst) ctxt terms
+in SOME trm end
+| _ => NONE
+in
+case term_opt of SOME trm => trm | _ =>
+snd (Syntax_Trans.preserve_binder_abs_tr' constName syntaxConst) ctxt terms
+end
+)
+
+fun AOT_restricted_binder const connect =
+  fn ctxt => (fn [a, b] => Ast.mk_appl (Ast.Constant const) [
+let
+val b = case a of (Ast.Appl [Ast.Constant "_AOT_var", var]) => (
+case fetchTermCategory ctxt (hd (Symbol.explode (fst (unconstrain_var var))))
+of SOME (AOT_Variable _, category) =>
+  let
+    val (restr, _) = Local_Theory.raw_theory_result
+      (fn thy => (Symtab.lookup (AOT_Restriction.get thy) category, thy)) ctxt
+  in
+    case restr of SOME _ => Ast.mk_appl (Ast.Constant connect)
+      [Ast.mk_appl (Ast.mk_appl (Ast.Constant "_AOT_restriction")
+          [Ast.Constant category]) [a], b] | _ => b end | _ => b) | _ => b
+in
+  Ast.mk_appl (Ast.Constant "_abs")  [a,b]
+end] | _ => raise Match)
+
+fun parseDDOT ctxt _ =
+  let
+    val trm = Proof_Context.get_fact_single ctxt
+      (Facts.named (Long_Name.localN ^ Long_Name.separator ^ Auto_Bind.thisN))
+    val trm = Thm.concl_of trm
+    fun mapTerms (Free (x,typ)) =
+      (case List.rev (String.explode x) of #"_" :: #"_" :: tl =>
+        Free (String.implode (List.rev tl), typ) | _ => Free (x,typ))
+      | mapTerms x = x
+    val trm = Term.map_aterms mapTerms trm
+    fun readThisRHS (Const ("HOL.Trueprop", _) $
+        (Const ("AOT_model.AOT_model_valid_in", _) $ _ $ (Const _ $ _ $ rhs))) = rhs
+      | readThisRHS _ = raise Term.TERM ("Could not expand ... from term.", [trm])
+  in
+    readThisRHS trm
+  end
\ No newline at end of file
diff --git a/thys/AOT/AOT_syntax.thy b/thys/AOT/AOT_syntax.thy
new file mode 100644
--- /dev/null
+++ b/thys/AOT/AOT_syntax.thy
@@ -0,0 +1,648 @@
+(*<*)
+theory AOT_syntax
+  imports AOT_commands
+  keywords "AOT_register_variable_names" :: thy_decl
+       and "AOT_register_metavariable_names" :: thy_decl
+       and "AOT_register_premise_set_names" :: thy_decl
+       and "AOT_register_type_constraints" :: thy_decl
+     abbrevs "actually" = "\<^bold>\<A>"
+         and "neccessarily" = "\<box>"
+         and "possibly" = "\<diamond>"
+         and "the" = "\<^bold>\<iota>"
+         and "lambda" = "[\<lambda>]"
+         and "being such that" = "[\<lambda> ]"
+         and "forall" = "\<forall>"
+         and "exists" = "\<exists>"
+         and "equivalent" = "\<equiv>"
+         and "not" = "\<not>"
+         and "implies" = "\<rightarrow>"
+         and "equal" = "="
+         and "by definition" = "\<^sub>d\<^sub>f"
+         and "df" = "\<^sub>d\<^sub>f"
+         and "denotes" = "\<down>"
+begin
+(*>*)
+
+section\<open>Approximation of the Syntax of PLM\<close>
+
+locale AOT_meta_syntax
+begin
+notation AOT_model_valid_in ("\<^bold>[_ \<^bold>\<Turnstile> _\<^bold>]")
+notation AOT_model_axiom ("\<^bold>\<box>\<^bold>[_\<^bold>]")
+notation AOT_model_act_axiom ("\<^bold>\<A>\<^bold>[_\<^bold>]")
+end
+locale AOT_no_meta_syntax
+begin
+no_notation AOT_model_valid_in ("\<^bold>[_ \<^bold>\<Turnstile> _\<^bold>]")
+no_notation AOT_model_axiom ("\<^bold>\<box>\<^bold>[_\<^bold>]")
+no_notation AOT_model_act_axiom ("\<^bold>\<A>\<^bold>[_\<^bold>]")
+end
+
+consts AOT_denotes :: \<open>'a::AOT_Term \<Rightarrow> \<o>\<close>
+       AOT_imp :: \<open>[\<o>, \<o>] \<Rightarrow> \<o>\<close>
+       AOT_not :: \<open>\<o> \<Rightarrow> \<o>\<close>
+       AOT_box :: \<open>\<o> \<Rightarrow> \<o>\<close>
+       AOT_act :: \<open>\<o> \<Rightarrow> \<o>\<close>
+       AOT_forall :: \<open>('a::AOT_Term \<Rightarrow> \<o>) \<Rightarrow> \<o>\<close>
+       AOT_eq :: \<open>'a::AOT_Term \<Rightarrow> 'a::AOT_Term \<Rightarrow> \<o>\<close>
+       AOT_desc :: \<open>('a::AOT_UnaryIndividualTerm \<Rightarrow> \<o>) \<Rightarrow> 'a\<close>
+       AOT_exe :: \<open><'a::AOT_IndividualTerm> \<Rightarrow> 'a \<Rightarrow> \<o>\<close>
+       AOT_lambda :: \<open>('a::AOT_IndividualTerm \<Rightarrow> \<o>) \<Rightarrow> <'a>\<close>
+       AOT_lambda0 :: \<open>\<o> \<Rightarrow> \<o>\<close>
+       AOT_concrete :: \<open><'a::AOT_UnaryIndividualTerm> AOT_var\<close>
+
+nonterminal \<kappa>\<^sub>s and \<Pi> and \<Pi>0 and \<alpha> and exe_arg and exe_args
+        and lambda_args and desc and free_var and free_vars
+        and AOT_props and AOT_premises and AOT_world_relative_prop
+
+syntax "_AOT_process_frees" :: \<open>\<phi> \<Rightarrow> \<phi>'\<close> ("_")
+       "_AOT_verbatim" :: \<open>any \<Rightarrow> \<phi>\<close> (\<open>\<guillemotleft>_\<guillemotright>\<close>)
+       "_AOT_verbatim" :: \<open>any \<Rightarrow> \<tau>\<close> (\<open>\<guillemotleft>_\<guillemotright>\<close>)
+       "_AOT_quoted" :: \<open>\<phi>' \<Rightarrow> any\<close> (\<open>\<guillemotleft>_\<guillemotright>\<close>)
+       "_AOT_quoted" :: \<open>\<tau>' \<Rightarrow> any\<close> (\<open>\<guillemotleft>_\<guillemotright>\<close>)
+       "" :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>'(_')\<close>)
+       "_AOT_process_frees" :: \<open>\<tau> \<Rightarrow> \<tau>'\<close> ("_")
+       "" :: \<open>\<kappa>\<^sub>s \<Rightarrow> \<tau>\<close> ("_")
+       "" :: \<open>\<Pi> \<Rightarrow> \<tau>\<close> ("_")
+       "" :: \<open>\<phi> \<Rightarrow> \<tau>\<close> ("'(_')")
+       "_AOT_term_var" :: \<open>id_position \<Rightarrow> \<tau>\<close> ("_")
+       "_AOT_term_var" :: \<open>id_position \<Rightarrow> \<phi>\<close> ("_")
+       "_AOT_exe_vars" :: \<open>id_position \<Rightarrow> exe_arg\<close> ("_")
+       "_AOT_lambda_vars" :: \<open>id_position \<Rightarrow> lambda_args\<close> ("_")
+       "_AOT_var" :: \<open>id_position \<Rightarrow> \<alpha>\<close> ("_")
+       "_AOT_vars" :: \<open>id_position \<Rightarrow> any\<close>
+       "_AOT_verbatim" :: \<open>any \<Rightarrow> \<alpha>\<close> (\<open>\<guillemotleft>_\<guillemotright>\<close>)
+       "_AOT_valid" :: \<open>w \<Rightarrow> \<phi>' \<Rightarrow> bool\<close> (\<open>[_ \<Turnstile> _]\<close>)
+       "_AOT_denotes" :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>_\<down>\<close>)
+       "_AOT_imp" :: \<open>[\<phi>, \<phi>] \<Rightarrow> \<phi>\<close> (infixl \<open>\<rightarrow>\<close> 25)
+       "_AOT_not" :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>~_\<close> [50] 50)
+       "_AOT_not" :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>\<not>_\<close> [50] 50)
+       "_AOT_box" :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>\<box>_\<close> [49] 54)
+       "_AOT_act" :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>\<^bold>\<A>_\<close> [49] 54)
+       "_AOT_all" :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>\<forall>_ _\<close> [1,40])
+syntax (input)
+       "_AOT_all_ellipse"
+            :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>\<forall>_...\<forall>_ _\<close> [1,40])
+syntax (output)
+       "_AOT_all_ellipse"
+            :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>\<forall>_...\<forall>_'(_')\<close> [1,40])
+syntax
+       "_AOT_eq" :: \<open>[\<tau>, \<tau>] \<Rightarrow> \<phi>\<close> (infixl \<open>=\<close> 50)
+       "_AOT_desc" :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> desc\<close> ("\<^bold>\<iota>__" [1,1000])
+       "" :: \<open>desc \<Rightarrow> \<kappa>\<^sub>s\<close> ("_")
+       "_AOT_lambda" :: \<open>lambda_args \<Rightarrow> \<phi> \<Rightarrow> \<Pi>\<close> (\<open>[\<lambda>_ _]\<close>)
+       "_explicitRelation" :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> ("[_]")
+       "" :: \<open>\<kappa>\<^sub>s \<Rightarrow> exe_arg\<close> ("_")
+       "" :: \<open>exe_arg \<Rightarrow> exe_args\<close> ("_")
+       "_AOT_exe_args" :: \<open>exe_arg \<Rightarrow> exe_args \<Rightarrow> exe_args\<close> ("__")
+       "_AOT_exe_arg_ellipse" :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> exe_arg\<close> ("_..._")
+       "_AOT_lambda_arg_ellipse"
+            :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> lambda_args\<close> ("_..._")
+       "_AOT_term_ellipse" :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> \<tau>\<close> ("_..._")
+       "_AOT_exe" :: \<open>\<Pi> \<Rightarrow> exe_args \<Rightarrow> \<phi>\<close> (\<open>__\<close>)
+       "_AOT_enc" :: \<open>exe_args \<Rightarrow> \<Pi> \<Rightarrow> \<phi>\<close> (\<open>__\<close>)
+       "_AOT_lambda0" :: \<open>\<phi> \<Rightarrow> \<Pi>0\<close> (\<open>[\<lambda> _]\<close>)
+       "" :: \<open>\<Pi>0 \<Rightarrow> \<phi>\<close> ("_")
+       "" :: \<open>\<Pi>0 \<Rightarrow> \<tau>\<close> ("_")
+       "_AOT_concrete" :: \<open>\<Pi>\<close> (\<open>E!\<close>)
+       "" :: \<open>any \<Rightarrow> exe_arg\<close> ("\<guillemotleft>_\<guillemotright>")
+       "" :: \<open>desc \<Rightarrow> free_var\<close> ("_")
+       "" :: \<open>\<Pi> \<Rightarrow> free_var\<close> ("_")
+       "_AOT_appl" :: \<open>id_position \<Rightarrow> free_vars \<Rightarrow> \<phi>\<close> ("_'{_'}")
+       "_AOT_appl" :: \<open>id_position \<Rightarrow> free_vars \<Rightarrow> \<tau>\<close> ("_'{_'}")
+       "_AOT_appl" :: \<open>id_position \<Rightarrow> free_vars \<Rightarrow> free_vars\<close> ("_'{_'}")
+       "_AOT_appl" :: \<open>id_position \<Rightarrow> free_vars \<Rightarrow> free_vars\<close> ("_'{_'}")
+       "_AOT_term_var" :: \<open>id_position \<Rightarrow> free_var\<close> ("_")
+       "" :: \<open>any \<Rightarrow> free_var\<close> ("\<guillemotleft>_\<guillemotright>")
+       "" :: \<open>free_var \<Rightarrow> free_vars\<close> ("_")
+       "_AOT_args" :: \<open>free_var \<Rightarrow> free_vars \<Rightarrow> free_vars\<close> ("_,_")
+       "_AOT_free_var_ellipse" :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> free_var\<close> ("_..._")
+syntax "_AOT_premises"
+            :: \<open>AOT_world_relative_prop \<Rightarrow> AOT_premises \<Rightarrow> AOT_premises\<close> (infixr \<open>,\<close> 3)
+       "_AOT_world_relative_prop" :: "\<phi> \<Rightarrow> AOT_world_relative_prop" ("_")
+       "" :: "AOT_world_relative_prop \<Rightarrow> AOT_premises" ("_")
+       "_AOT_prop" :: \<open>AOT_world_relative_prop \<Rightarrow> AOT_prop\<close> (\<open>_\<close>)
+       "" :: \<open>AOT_prop \<Rightarrow> AOT_props\<close> (\<open>_\<close>)
+       "_AOT_derivable" :: "AOT_premises \<Rightarrow> \<phi>' \<Rightarrow> AOT_prop" (infixl \<open>\<^bold>\<turnstile>\<close> 2)
+       "_AOT_nec_derivable" :: "AOT_premises \<Rightarrow> \<phi>' \<Rightarrow> AOT_prop" (infixl \<open>\<^bold>\<turnstile>\<^sub>\<box>\<close> 2)
+       "_AOT_theorem" :: "\<phi>' \<Rightarrow> AOT_prop" (\<open>\<^bold>\<turnstile> _\<close>)
+       "_AOT_nec_theorem" :: "\<phi>' \<Rightarrow> AOT_prop" (\<open>\<^bold>\<turnstile>\<^sub>\<box> _\<close>)
+       "_AOT_equiv_def" :: \<open>\<phi> \<Rightarrow> \<phi> \<Rightarrow> AOT_prop\<close> (infixl \<open>\<equiv>\<^sub>d\<^sub>f\<close> 3)
+       "_AOT_axiom" :: "\<phi>' \<Rightarrow> AOT_axiom" (\<open>_\<close>)
+       "_AOT_act_axiom" :: "\<phi>' \<Rightarrow> AOT_act_axiom" (\<open>_\<close>)
+       "_AOT_axiom" :: "\<phi>' \<Rightarrow> AOT_prop" (\<open>_ \<in> \<Lambda>\<^sub>\<box>\<close>)
+       "_AOT_act_axiom" :: "\<phi>' \<Rightarrow> AOT_prop" (\<open>_ \<in> \<Lambda>\<close>)
+       "_AOT_id_def" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> AOT_prop\<close> (infixl \<open>=\<^sub>d\<^sub>f\<close> 3)
+       "_AOT_for_arbitrary"
+            :: \<open>id_position \<Rightarrow> AOT_prop \<Rightarrow> AOT_prop\<close> (\<open>for arbitrary _: _\<close> [1000,1] 1)
+syntax (output) "_lambda_args" :: \<open>any \<Rightarrow> patterns \<Rightarrow> patterns\<close> ("__")
+
+translations
+  "[w \<Turnstile> \<phi>]" => "CONST AOT_model_valid_in w \<phi>"
+
+AOT_syntax_print_translations
+  "[w \<Turnstile> \<phi>]" <= "CONST AOT_model_valid_in w \<phi>"
+
+ML_file AOT_syntax.ML
+
+AOT_register_type_constraints
+  Individual: \<open>_::AOT_UnaryIndividualTerm\<close> \<open>_::AOT_IndividualTerm\<close> and
+  Proposition: \<o> and
+  Relation: \<open><_::AOT_IndividualTerm>\<close> and
+  Term: \<open>_::AOT_Term\<close>
+
+AOT_register_variable_names
+  Individual: x y z \<nu> \<mu> a b c d and
+  Proposition: p q r s and
+  Relation: F G H P Q R S and
+  Term: \<alpha> \<beta> \<gamma> \<delta>
+
+AOT_register_metavariable_names
+  Individual: \<kappa> and
+  Proposition: \<phi> \<psi> \<chi> \<theta> \<zeta> \<xi> \<Theta> and
+  Relation: \<Pi> and
+  Term: \<tau> \<sigma>
+
+AOT_register_premise_set_names \<Gamma> \<Delta> \<Lambda>
+
+parse_ast_translation\<open>[
+  (\<^syntax_const>\<open>_AOT_var\<close>, K AOT_check_var),
+  (\<^syntax_const>\<open>_AOT_exe_vars\<close>, K AOT_split_exe_vars),
+  (\<^syntax_const>\<open>_AOT_lambda_vars\<close>, K AOT_split_lambda_args)
+]\<close>
+
+translations
+  "_AOT_denotes \<tau>" => "CONST AOT_denotes \<tau>"
+  "_AOT_imp \<phi> \<psi>" => "CONST AOT_imp \<phi> \<psi>"
+  "_AOT_not \<phi>" => "CONST AOT_not \<phi>"
+  "_AOT_box \<phi>" => "CONST AOT_box \<phi>"
+  "_AOT_act \<phi>" => "CONST AOT_act \<phi>"
+  "_AOT_eq \<tau> \<tau>'" => "CONST AOT_eq \<tau> \<tau>'"
+  "_AOT_lambda0 \<phi>" => "CONST AOT_lambda0 \<phi>"
+  "_AOT_concrete" => "CONST AOT_term_of_var (CONST AOT_concrete)"
+  "_AOT_lambda \<alpha> \<phi>" => "CONST AOT_lambda (_abs \<alpha> \<phi>)"
+  "_explicitRelation \<Pi>" => "\<Pi>"
+
+AOT_syntax_print_translations
+  "_AOT_lambda (_lambda_args x y) \<phi>" <= "CONST AOT_lambda (_abs (_pattern x y) \<phi>)"
+  "_AOT_lambda (_lambda_args x y) \<phi>" <= "CONST AOT_lambda (_abs (_patterns x y) \<phi>)"
+  "_AOT_lambda x \<phi>" <= "CONST AOT_lambda (_abs x \<phi>)"
+  "_lambda_args x (_lambda_args y z)" <= "_lambda_args x (_patterns y z)"
+  "_lambda_args (x y z)" <= "_lambda_args (_tuple x (_tuple_arg (_tuple y z)))"
+
+
+AOT_syntax_print_translations
+  "_AOT_imp \<phi> \<psi>" <= "CONST AOT_imp \<phi> \<psi>"
+  "_AOT_not \<phi>" <= "CONST AOT_not \<phi>"
+  "_AOT_box \<phi>" <= "CONST AOT_box \<phi>"
+  "_AOT_act \<phi>" <= "CONST AOT_act \<phi>"
+  "_AOT_all \<alpha> \<phi>" <= "CONST AOT_forall (_abs \<alpha> \<phi>)"
+  "_AOT_all \<alpha> \<phi>" <= "CONST AOT_forall (\<lambda>\<alpha>. \<phi>)"
+  "_AOT_eq \<tau> \<tau>'" <= "CONST AOT_eq \<tau> \<tau>'"
+  "_AOT_desc x \<phi>" <= "CONST AOT_desc (_abs x \<phi>)"
+  "_AOT_desc x \<phi>" <= "CONST AOT_desc (\<lambda>x. \<phi>)"
+  "_AOT_lambda0 \<phi>" <= "CONST AOT_lambda0 \<phi>"
+  "_AOT_concrete" <= "CONST AOT_term_of_var (CONST AOT_concrete)"
+
+translations
+  "_AOT_appl \<phi> (_AOT_args a b)" => "_AOT_appl (\<phi> a) b"
+  "_AOT_appl \<phi> a" => "\<phi> a"
+
+
+parse_translation\<open>
+[
+  (\<^syntax_const>\<open>_AOT_var\<close>, parseVar true),
+  (\<^syntax_const>\<open>_AOT_vars\<close>, parseVar false),
+  (\<^syntax_const>\<open>_AOT_valid\<close>, fn ctxt => fn [w,x] =>
+    \<^const>\<open>AOT_model_valid_in\<close> $ w $ x),
+  (\<^syntax_const>\<open>_AOT_quoted\<close>, fn ctxt => fn [x] => x),
+  (\<^syntax_const>\<open>_AOT_process_frees\<close>, fn ctxt => fn [x] => processFrees ctxt x),
+  (\<^syntax_const>\<open>_AOT_world_relative_prop\<close>, fn ctxt => fn [x] => let
+    val (x, premises) = processFreesAndPremises ctxt x
+    val (world::formulas) = Variable.variant_frees ctxt [x]
+        (("v", dummyT)::(map (fn _ => ("\<phi>", dummyT)) premises))
+    val term = HOLogic.mk_Trueprop
+        (@{const AOT_model_valid_in} $ Free world $ processFrees ctxt x)
+    val term = fold (fn (premise,form) => fn trm =>
+         @{const "Pure.imp"} $
+        HOLogic.mk_Trueprop
+          (Const (\<^const_name>\<open>Set.member\<close>, dummyT) $ Free form $ premise) $
+          (Term.absfree (Term.dest_Free (dropConstraints premise)) trm $ Free form)
+    ) (ListPair.zipEq (premises,formulas)) term
+    val term = fold (fn (form) => fn trm =>
+         Const (\<^const_name>\<open>Pure.all\<close>, dummyT) $
+        (Term.absfree form trm)
+    ) formulas term
+    val term = Term.absfree world term
+    in term end),
+  (\<^syntax_const>\<open>_AOT_prop\<close>, fn ctxt => fn [x] => let
+    val world = case (AOT_ProofData.get ctxt) of SOME w => w
+        | _ => raise Fail "Expected world to be stored in the proof state."
+    in x $ world end),
+  (\<^syntax_const>\<open>_AOT_theorem\<close>, fn ctxt => fn [x] =>
+      HOLogic.mk_Trueprop (@{const AOT_model_valid_in} $ @{const w\<^sub>0} $ x)),
+  (\<^syntax_const>\<open>_AOT_axiom\<close>, fn ctxt => fn [x] =>
+      HOLogic.mk_Trueprop (@{const AOT_model_axiom} $ x)),
+  (\<^syntax_const>\<open>_AOT_act_axiom\<close>, fn ctxt => fn [x] =>
+      HOLogic.mk_Trueprop (@{const AOT_model_act_axiom} $ x)),
+  (\<^syntax_const>\<open>_AOT_nec_theorem\<close>, fn ctxt => fn [trm] => let
+    val world = singleton (Variable.variant_frees ctxt [trm]) ("v", @{typ w})
+    val trm = HOLogic.mk_Trueprop (@{const AOT_model_valid_in} $ Free world $ trm)
+    val trm = Term.absfree world trm
+    val trm = Const (\<^const_name>\<open>Pure.all\<close>, dummyT) $ trm
+    in trm end),
+  (\<^syntax_const>\<open>_AOT_derivable\<close>, fn ctxt => fn [x,y] => let
+    val world = case (AOT_ProofData.get ctxt) of SOME w => w
+      | _ => raise Fail "Expected world to be stored in the proof state."
+    in foldPremises world x y end),
+  (\<^syntax_const>\<open>_AOT_nec_derivable\<close>, fn ctxt => fn [x,y] => let
+    in Const (\<^const_name>\<open>Pure.all\<close>, dummyT) $
+       Abs ("v", dummyT, foldPremises (Bound 0) x y) end),
+  (\<^syntax_const>\<open>_AOT_for_arbitrary\<close>, fn ctxt => fn [_ $ var $ pos,trm] => let
+    val trm = Const (\<^const_name>\<open>Pure.all\<close>, dummyT) $
+        (Const ("_constrainAbs", dummyT) $ Term.absfree (Term.dest_Free var) trm $ pos)
+    in trm end),
+  (\<^syntax_const>\<open>_AOT_equiv_def\<close>, parseEquivDef),
+  (\<^syntax_const>\<open>_AOT_exe\<close>, parseExe),
+  (\<^syntax_const>\<open>_AOT_enc\<close>, parseEnc)
+]
+\<close>
+
+parse_ast_translation\<open>
+[
+  (\<^syntax_const>\<open>_AOT_exe_arg_ellipse\<close>, parseEllipseList "_AOT_term_vars"),
+  (\<^syntax_const>\<open>_AOT_lambda_arg_ellipse\<close>, parseEllipseList "_AOT_vars"),
+  (\<^syntax_const>\<open>_AOT_free_var_ellipse\<close>, parseEllipseList "_AOT_term_vars"),
+  (\<^syntax_const>\<open>_AOT_term_ellipse\<close>, parseEllipseList "_AOT_term_vars"),
+  (\<^syntax_const>\<open>_AOT_all_ellipse\<close>, fn ctx => fn [a,b,c] =>
+      Ast.mk_appl (Ast.Constant \<^const_name>\<open>AOT_forall\<close>) [
+        Ast.mk_appl (Ast.Constant "_abs") [parseEllipseList "_AOT_vars" ctx [a,b],c]
+      ])
+]
+\<close>
+
+syntax (output)
+  "_AOT_individual_term" :: \<open>'a \<Rightarrow> tuple_args\<close> ("_")
+  "_AOT_individual_terms" :: \<open>tuple_args \<Rightarrow> tuple_args \<Rightarrow> tuple_args\<close> ("__")
+  "_AOT_relation_term" :: \<open>'a \<Rightarrow> \<Pi>\<close>
+  "_AOT_any_term" :: \<open>'a \<Rightarrow> \<tau>\<close>
+
+
+print_ast_translation\<open>AOT_syntax_print_ast_translations[
+ (\<^syntax_const>\<open>_AOT_individual_term\<close>, AOT_print_individual_term),
+ (\<^syntax_const>\<open>_AOT_relation_term\<close>, AOT_print_relation_term),
+ (\<^syntax_const>\<open>_AOT_any_term\<close>, AOT_print_generic_term)
+]\<close>
+
+AOT_syntax_print_translations
+  "_AOT_individual_terms (_AOT_individual_term x) (_AOT_individual_terms (_tuple y z))"
+  <= "_AOT_individual_terms (_tuple x (_tuple_args y z))"
+  "_AOT_individual_terms (_AOT_individual_term x) (_AOT_individual_term y)"
+  <= "_AOT_individual_terms (_tuple x (_tuple_arg y))"
+  "_AOT_individual_terms (_tuple x y)" <= "_AOT_individual_term (_tuple x y)"
+  "_AOT_exe (_AOT_relation_term \<Pi>) (_AOT_individual_term \<kappa>)" <= "CONST AOT_exe \<Pi> \<kappa>"
+  "_AOT_denotes (_AOT_any_term \<kappa>)" <= "CONST AOT_denotes \<kappa>"
+
+AOT_define AOT_conj :: \<open>[\<phi>, \<phi>] \<Rightarrow> \<phi>\<close> (infixl \<open>&\<close> 35) \<open>\<phi> & \<psi> \<equiv>\<^sub>d\<^sub>f \<not>(\<phi> \<rightarrow> \<not>\<psi>)\<close>
+declare "AOT_conj"[AOT del, AOT_defs del]
+AOT_define AOT_disj :: \<open>[\<phi>, \<phi>] \<Rightarrow> \<phi>\<close> (infixl \<open>\<or>\<close> 35) \<open>\<phi> \<or> \<psi> \<equiv>\<^sub>d\<^sub>f \<not>\<phi> \<rightarrow> \<psi>\<close>
+declare "AOT_disj"[AOT del, AOT_defs del]
+AOT_define AOT_equiv :: \<open>[\<phi>, \<phi>] \<Rightarrow> \<phi>\<close> (infix \<open>\<equiv>\<close> 20) \<open>\<phi> \<equiv> \<psi> \<equiv>\<^sub>d\<^sub>f (\<phi> \<rightarrow> \<psi>) & (\<psi> \<rightarrow> \<phi>)\<close>
+declare "AOT_equiv"[AOT del, AOT_defs del]
+AOT_define AOT_dia :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>\<diamond>_\<close> [49] 54) \<open>\<diamond>\<phi> \<equiv>\<^sub>d\<^sub>f \<not>\<box>\<not>\<phi>\<close>
+declare "AOT_dia"[AOT del, AOT_defs del]
+
+context AOT_meta_syntax
+begin
+notation AOT_dia ("\<^bold>\<diamond>_" [49] 54)
+notation AOT_conj (infixl \<open>\<^bold>&\<close> 35)
+notation AOT_disj (infixl \<open>\<^bold>\<or>\<close> 35)
+notation AOT_equiv (infixl \<open>\<^bold>\<equiv>\<close> 20)
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_dia ("\<^bold>\<diamond>_" [49] 54)
+no_notation AOT_conj (infixl \<open>\<^bold>&\<close> 35)
+no_notation AOT_disj (infixl \<open>\<^bold>\<or>\<close> 35)
+no_notation AOT_equiv (infixl \<open>\<^bold>\<equiv>\<close> 20)
+end
+
+
+print_translation \<open>
+AOT_syntax_print_translations
+ [
+  AOT_preserve_binder_abs_tr'
+    \<^const_syntax>\<open>AOT_forall\<close>
+    \<^syntax_const>\<open>_AOT_all\<close>
+    (\<^syntax_const>\<open>_AOT_all_ellipse\<close>, true)
+    \<^const_name>\<open>AOT_imp\<close>,
+  AOT_binder_trans @{theory} @{binding "AOT_forall_binder"} \<^syntax_const>\<open>_AOT_all\<close>,
+  Syntax_Trans.preserve_binder_abs_tr'
+    \<^const_syntax>\<open>AOT_desc\<close>
+    \<^syntax_const>\<open>_AOT_desc\<close>,
+  AOT_binder_trans @{theory} @{binding "AOT_desc_binder"} \<^syntax_const>\<open>_AOT_desc\<close>,
+  AOT_preserve_binder_abs_tr'
+    \<^const_syntax>\<open>AOT_lambda\<close>
+    \<^syntax_const>\<open>_AOT_lambda\<close>
+    (\<^syntax_const>\<open>_AOT_lambda_arg_ellipse\<close>, false)
+    \<^const_name>\<open>undefined\<close>,
+  AOT_binder_trans
+    @{theory}
+    @{binding "AOT_lambda_binder"}
+    \<^syntax_const>\<open>_AOT_lambda\<close>
+ ]
+\<close>
+
+parse_translation\<open>
+[(\<^syntax_const>\<open>_AOT_id_def\<close>, parseIdDef)]
+\<close>
+
+parse_ast_translation\<open>[
+ (\<^syntax_const>\<open>_AOT_all\<close>,
+  AOT_restricted_binder \<^const_name>\<open>AOT_forall\<close> \<^const_name>\<open>AOT_imp\<close>),
+ (\<^syntax_const>\<open>_AOT_desc\<close>,
+  AOT_restricted_binder \<^const_name>\<open>AOT_desc\<close> \<^const_name>\<open>AOT_conj\<close>)
+]\<close>
+
+AOT_define AOT_exists :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> \<open>\<guillemotleft>AOT_exists \<phi>\<guillemotright> \<equiv>\<^sub>d\<^sub>f \<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
+declare AOT_exists[AOT del, AOT_defs del]
+syntax "_AOT_exists" :: \<open>\<alpha> \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> ("\<exists>_ _" [1,40])
+
+AOT_syntax_print_translations
+  "_AOT_exists \<alpha> \<phi>" <= "CONST AOT_exists (_abs \<alpha> \<phi>)"
+  "_AOT_exists \<alpha> \<phi>" <= "CONST AOT_exists (\<lambda>\<alpha>. \<phi>)"
+
+parse_ast_translation\<open>                              
+[(\<^syntax_const>\<open>_AOT_exists\<close>,
+  AOT_restricted_binder \<^const_name>\<open>AOT_exists\<close> \<^const_name>\<open>AOT_conj\<close>)]
+\<close>
+
+context AOT_meta_syntax
+begin
+notation AOT_exists (binder "\<^bold>\<exists>" 8)
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_exists (binder "\<^bold>\<exists>" 8)
+end
+
+
+syntax (input)
+   "_AOT_exists_ellipse" :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>\<exists>_...\<exists>_ _\<close> [1,40])
+syntax (output)
+   "_AOT_exists_ellipse" :: \<open>id_position \<Rightarrow> id_position \<Rightarrow> \<phi> \<Rightarrow> \<phi>\<close> (\<open>\<exists>_...\<exists>_ '(_')\<close> [1,40])
+parse_ast_translation\<open>[(\<^syntax_const>\<open>_AOT_exists_ellipse\<close>, fn ctx => fn [a,b,c] =>
+  Ast.mk_appl (Ast.Constant "AOT_exists")
+    [Ast.mk_appl (Ast.Constant "_abs") [parseEllipseList "_AOT_vars" ctx [a,b],c]])]\<close>
+print_translation\<open>AOT_syntax_print_translations [
+  AOT_preserve_binder_abs_tr'
+    \<^const_syntax>\<open>AOT_exists\<close>
+    \<^syntax_const>\<open>_AOT_exists\<close>
+    (\<^syntax_const>\<open>_AOT_exists_ellipse\<close>,true) \<^const_name>\<open>AOT_conj\<close>,
+  AOT_binder_trans
+    @{theory}
+    @{binding "AOT_exists_binder"}
+    \<^syntax_const>\<open>_AOT_exists\<close>
+]\<close>
+
+
+
+syntax "_AOT_DDDOT" :: "\<phi>" ("...")
+syntax "_AOT_DDDOT" :: "\<phi>" ("\<dots>")
+parse_translation\<open>[(\<^syntax_const>\<open>_AOT_DDDOT\<close>, parseDDOT)]\<close>
+
+print_translation\<open>AOT_syntax_print_translations
+[(\<^const_syntax>\<open>Pure.all\<close>, fn ctxt => fn [Abs (_, _,
+  Const (\<^const_syntax>\<open>HOL.Trueprop\<close>, _) $
+  (Const (\<^const_syntax>\<open>AOT_model_valid_in\<close>, _) $ Bound 0 $ y))] => let
+    val y = (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ y)
+    in (Const (\<^syntax_const>\<open>_AOT_nec_theorem\<close>, dummyT) $ y) end
+| [p as Abs (name, _,
+  Const (\<^const_syntax>\<open>HOL.Trueprop\<close>, _) $
+  (Const (\<^const_syntax>\<open>AOT_model_valid_in\<close>, _) $ w $ y))]
+=> (Const (\<^syntax_const>\<open>_AOT_for_arbitrary\<close>, dummyT) $
+    (Const ("_bound", dummyT) $ Free (name, dummyT)) $
+    (Term.betapply (p, (Const ("_bound", dummyT) $ Free (name, dummyT)))))
+),
+
+ (\<^const_syntax>\<open>AOT_model_valid_in\<close>, fn ctxt =>
+  fn [w as (Const ("_free", _) $ Free (v, _)), y] => let
+    val is_world = (case (AOT_ProofData.get ctxt)
+        of SOME (Free (w, _)) => Name.clean w = Name.clean v | _ => false)
+    val y = (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ y)
+    in if is_world then y else Const (\<^syntax_const>\<open>_AOT_valid\<close>, dummyT) $ w $ y end
+  | [Const (\<^const_syntax>\<open>w\<^sub>0\<close>, _), y] => let
+    val y = (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ y)
+    in case (AOT_ProofData.get ctxt) of SOME (Const (\<^const_name>\<open>w\<^sub>0\<close>, _)) => y |
+            _ => Const (\<^syntax_const>\<open>_AOT_theorem\<close>, dummyT) $ y end
+  | [Const ("_var", _) $ _, y] => let
+    val y = (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ y)
+    in Const (\<^syntax_const>\<open>_AOT_nec_theorem\<close>, dummyT) $ y end
+  ),
+ (\<^const_syntax>\<open>AOT_model_axiom\<close>, fn ctxt => fn [trm] =>
+    Const (\<^syntax_const>\<open>_AOT_axiom\<close>, dummyT) $
+    (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ trm)),
+ (\<^const_syntax>\<open>AOT_model_act_axiom\<close>, fn ctxt => fn [trm] =>
+    Const (\<^syntax_const>\<open>_AOT_axiom\<close>, dummyT) $
+    (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ trm)),
+(\<^syntax_const>\<open>_AOT_process_frees\<close>, fn _ =>  fn [t] => let
+  fun mapAppls (x as Const ("_free", _) $
+                     Free (_, Type ("_ignore_type", [Type ("fun", _)])))
+        = (Const ("_AOT_raw_appl", dummyT) $ x)
+    | mapAppls (x as Const ("_free", _) $ Free (_, Type ("fun", _)))
+        = (Const ("_AOT_raw_appl", dummyT) $ x)
+    | mapAppls (x as Const ("_var", _) $
+                     Var (_, Type ("_ignore_type", [Type ("fun", _)])))
+        = (Const ("_AOT_raw_appl", dummyT) $ x)
+    | mapAppls (x as Const ("_var", _) $ Var (_, Type ("fun", _)))
+        = (Const ("_AOT_raw_appl", dummyT) $ x)
+    | mapAppls (x $ y) = mapAppls x $ mapAppls y
+    | mapAppls (Abs (x,y,z)) = Abs (x,y, mapAppls z)
+    | mapAppls x = x
+  in mapAppls t end
+)
+]
+\<close>
+
+print_ast_translation\<open>AOT_syntax_print_ast_translations
+let
+fun handleTermOfVar x kind name = (
+let
+val _ = case kind of "_free" => () | "_var" => () | "_bound" => () | _ => raise Match
+in
+  case printVarKind name
+    of (SingleVariable name) => Ast.Appl [Ast.Constant kind, Ast.Variable name]
+    | (Ellipses (s, e)) =>  Ast.Appl [Ast.Constant "_AOT_free_var_ellipse",
+    Ast.Appl [Ast.Constant kind, Ast.Variable s],
+    Ast.Appl [Ast.Constant kind, Ast.Variable e]
+      ]
+  | Verbatim name => Ast.mk_appl (Ast.Constant "_AOT_quoted")
+                        [Ast.mk_appl (Ast.Constant "_AOT_term_of_var") [x]]
+end
+)
+fun termOfVar ctxt (Ast.Appl [Ast.Constant "_constrain",
+      x as Ast.Appl [Ast.Constant kind, Ast.Variable name], _]) = termOfVar ctxt x
+  | termOfVar ctxt (x as Ast.Appl [Ast.Constant kind, Ast.Variable name])
+      = handleTermOfVar x kind name
+  | termOfVar ctxt (x as Ast.Appl [Ast.Constant rep, y]) = (
+let
+val (restr,_) = Local_Theory.raw_theory_result (fn thy => (
+let
+val restrs = Symtab.dest (AOT_Restriction.get thy)
+val restr = List.find (fn (n,(_,Const (c,t))) => (
+  c = rep orelse c = Lexicon.unmark_const rep) | _ => false) restrs
+in
+(restr,thy)
+end
+)) ctxt
+in
+  case restr of SOME r => Ast.Appl [Ast.Constant (\<^const_syntax>\<open>AOT_term_of_var\<close>), y]
+  | _ => raise Match
+end)
+
+in
+[(\<^const_syntax>\<open>AOT_term_of_var\<close>, fn ctxt => fn [x] => termOfVar ctxt x),
+("_AOT_raw_appl", fn ctxt => fn t::a::args => let
+fun applyTermOfVar (t as Ast.Appl (Ast.Constant \<^const_syntax>\<open>AOT_term_of_var\<close>::[x]))
+    = (case try (termOfVar ctxt) x of SOME y => y | _ => t)
+  | applyTermOfVar y = (case try (termOfVar ctxt) y of SOME x => x | _ => y)
+val ts = fold (fn a => fn b => Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_args\<close>)
+              [b,applyTermOfVar a]) args (applyTermOfVar a)
+in Ast.mk_appl (Ast.Constant \<^syntax_const>\<open>_AOT_appl\<close>) [t,ts] end)]
+end
+\<close>
+
+context AOT_meta_syntax
+begin
+notation AOT_denotes ("_\<^bold>\<down>")
+notation AOT_imp (infixl "\<^bold>\<rightarrow>" 25)
+notation AOT_not ("\<^bold>\<not>_" [50] 50)
+notation AOT_box ("\<^bold>\<box>_" [49] 54)
+notation AOT_act ("\<^bold>\<A>_" [49] 54)
+notation AOT_forall (binder "\<^bold>\<forall>" 8)
+notation AOT_eq (infixl "\<^bold>=" 50)
+notation AOT_desc (binder "\<^bold>\<iota>" 100)
+notation AOT_lambda (binder "\<^bold>\<lambda>" 100)
+notation AOT_lambda0 ("\<^bold>[\<^bold>\<lambda> _\<^bold>]")
+notation AOT_exe ("\<^bold>\<lparr>_,_\<^bold>\<rparr>")
+notation AOT_model_equiv_def (infixl "\<^bold>\<equiv>\<^sub>d\<^sub>f" 10)
+notation AOT_model_id_def (infixl "\<^bold>=\<^sub>d\<^sub>f" 10)
+notation AOT_term_of_var ("\<^bold>\<langle>_\<^bold>\<rangle>")
+notation AOT_concrete ("\<^bold>E\<^bold>!")
+end
+context AOT_no_meta_syntax
+begin
+no_notation AOT_denotes ("_\<^bold>\<down>")
+no_notation AOT_imp (infixl "\<^bold>\<rightarrow>" 25)
+no_notation AOT_not ("\<^bold>\<not>_" [50] 50)
+no_notation AOT_box ("\<^bold>\<box>_" [49] 54)
+no_notation AOT_act ("\<^bold>\<A>_" [49] 54)
+no_notation AOT_forall (binder "\<^bold>\<forall>" 8)
+no_notation AOT_eq (infixl "\<^bold>=" 50)
+no_notation AOT_desc (binder "\<^bold>\<iota>" 100)
+no_notation AOT_lambda (binder "\<^bold>\<lambda>" 100)
+no_notation AOT_lambda0 ("\<^bold>[\<^bold>\<lambda> _\<^bold>]")
+no_notation AOT_exe ("\<^bold>\<lparr>_,_\<^bold>\<rparr>")
+no_notation AOT_model_equiv_def (infixl "\<^bold>\<equiv>\<^sub>d\<^sub>f" 10)
+no_notation AOT_model_id_def (infixl "\<^bold>=\<^sub>d\<^sub>f" 10)
+no_notation AOT_term_of_var ("\<^bold>\<langle>_\<^bold>\<rangle>")
+no_notation AOT_concrete ("\<^bold>E\<^bold>!")
+end
+
+bundle AOT_syntax
+begin
+declare[[show_AOT_syntax=true, show_question_marks=false, eta_contract=false]]
+end
+
+bundle AOT_no_syntax
+begin
+declare[[show_AOT_syntax=false, show_question_marks=true]]
+end
+
+parse_translation\<open>
+[("_AOT_restriction", fn ctxt => fn [Const (name,_)] =>
+let
+val (restr, ctxt) = ctxt |> Local_Theory.raw_theory_result
+  (fn thy => (Option.map fst (Symtab.lookup (AOT_Restriction.get thy) name), thy))
+val restr = case restr of SOME x => x
+  | _ => raise Fail ("Unknown restricted type: " ^ name)
+in restr end
+)]
+\<close>
+
+print_translation\<open>
+AOT_syntax_print_translations
+[
+  (\<^const_syntax>\<open>AOT_model_equiv_def\<close>, fn ctxt => fn [x,y] =>
+    Const (\<^syntax_const>\<open>_AOT_equiv_def\<close>, dummyT) $
+    (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ x) $
+    (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ y))
+]
+\<close>
+
+print_translation\<open>
+AOT_syntax_print_translations [
+(\<^const_syntax>\<open>AOT_model_id_def\<close>, fn ctxt =>
+  fn [lhs as Abs (lhsName, lhsTy, lhsTrm), rhs as Abs (rhsName, rhsTy, rhsTrm)] =>
+    let
+      val (name,_) = Name.variant lhsName
+        (Term.declare_term_names rhsTrm (Term.declare_term_names lhsTrm Name.context));
+      val lhs = Term.betapply (lhs, Const ("_bound", dummyT) $ Free (name, lhsTy))
+      val rhs = Term.betapply (rhs, Const ("_bound", dummyT) $ Free (name, rhsTy))
+    in
+      Const (\<^const_syntax>\<open>AOT_model_id_def\<close>, dummyT) $ lhs $ rhs
+    end
+  | [Const (\<^const_syntax>\<open>case_prod\<close>, _) $ lhs,
+     Const (\<^const_syntax>\<open>case_prod\<close>, _) $ rhs] =>
+    Const (\<^const_syntax>\<open>AOT_model_id_def\<close>, dummyT) $ lhs $ rhs
+  | [Const (\<^const_syntax>\<open>case_unit\<close>, _) $ lhs,
+      Const (\<^const_syntax>\<open>case_unit\<close>, _) $ rhs] =>
+    Const (\<^const_syntax>\<open>AOT_model_id_def\<close>, dummyT) $ lhs $ rhs
+  | [x, y] =>
+       Const (\<^syntax_const>\<open>_AOT_id_def\<close>, dummyT) $
+         (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ x) $
+         (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ y)
+)]\<close>
+
+text\<open>Special marker for printing propositions as theorems
+     and for pretty-printing AOT terms.\<close>
+definition print_as_theorem :: \<open>\<o> \<Rightarrow> bool\<close> where
+  \<open>print_as_theorem \<equiv> \<lambda> \<phi> . \<forall>v . [v \<Turnstile> \<phi>]\<close>
+lemma print_as_theoremI:
+  assumes \<open>\<And> v . [v \<Turnstile> \<phi>]\<close>
+  shows \<open>print_as_theorem \<phi>\<close>
+  using assms by (simp add: print_as_theorem_def)
+attribute_setup print_as_theorem =
+  \<open>Scan.succeed (Thm.rule_attribute []
+      (K (fn thm => thm RS @{thm print_as_theoremI})))\<close>
+  "Print as theorem."
+print_translation\<open>AOT_syntax_print_translations [
+  (\<^const_syntax>\<open>print_as_theorem\<close>, fn ctxt => fn [x] => 
+   (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ x))
+]\<close>
+
+definition print_term :: \<open>'a \<Rightarrow> 'a\<close> where \<open>print_term \<equiv> \<lambda> x . x\<close>
+syntax "_AOT_print_term" :: \<open>\<tau> \<Rightarrow> 'a\<close> (\<open>AOT'_TERM[_]\<close>)
+translations
+  "_AOT_print_term \<phi>" => "CONST print_term (_AOT_process_frees \<phi>)"
+print_translation\<open>AOT_syntax_print_translations [
+  (\<^const_syntax>\<open>print_term\<close>, fn ctxt => fn [x] => 
+    (Const (\<^syntax_const>\<open>_AOT_process_frees\<close>, dummyT) $ x))
+]\<close>
+
+
+(* To enable meta syntax: *)
+(* interpretation AOT_meta_syntax. *)
+(* To disable meta syntax: *)
+interpretation AOT_no_meta_syntax.
+
+(* To enable AOT syntax (takes precedence over meta syntax;
+                         can be done locally using "including" or "include"): *)
+unbundle AOT_syntax
+(* To disable AOT syntax (restoring meta syntax or no syntax;
+                          can be done locally using "including" or "include"): *)
+(* unbundle AOT_no_syntax *)
+
+(*<*)
+end
+(*>*)
diff --git a/thys/AOT/ROOT b/thys/AOT/ROOT
new file mode 100644
--- /dev/null
+++ b/thys/AOT/ROOT
@@ -0,0 +1,23 @@
+chapter AFP
+
+session "AOT" (AFP) = "HOL-Cardinals" +
+  options [show_question_marks = false, timeout = 600, names_short = true]
+  sessions
+    "HOL-Cardinals"
+    "HOL-Eisbach"
+  theories
+    AOT_model
+    AOT_commands
+    AOT_syntax
+    AOT_semantics
+    AOT_Definitions
+    AOT_Axioms
+    AOT_PLM
+    AOT_BasicLogicalObjects
+    AOT_RestrictedVariables
+    AOT_ExtendedRelationComprehension
+    AOT_PossibleWorlds
+    AOT_NaturalNumbers
+    AOT_misc
+  document_files
+    "root.tex"
diff --git a/thys/AOT/document/root.tex b/thys/AOT/document/root.tex
new file mode 100644
--- /dev/null
+++ b/thys/AOT/document/root.tex
@@ -0,0 +1,105 @@
+\documentclass[a4paper,enabledeprecatedfontcommands,abstract=on,twoside=true]{article}
+\usepackage{isabelle,isabellesym}
+\usepackage{url}
+\usepackage{xr}
+\usepackage[usenames]{color}
+\usepackage{csquotes}
+\usepackage{graphicx}
+\usepackage{geometry}
+\usepackage{epigraph}
+\usepackage{tabularx}
+\usepackage{array}
+\usepackage[all]{nowidow}
+\usepackage[stable]{footmisc}
+\usepackage[ngerman,english]{babel}
+\newcommand{\embeddedstyle}[1]{{\color{blue}#1}}
+\newcommand{\bigbox}{}
+\newcommand{\linelabel}[1]{}
+
+\setcounter{secnumdepth}{2}
+\setcounter{tocdepth}{1}
+
+% further packages required for unusual symbols (see also
+% isabellesym.sty), use only when needed
+
+\usepackage{amssymb}
+  %for \<leadsto>, \<box>, \<diamond>, \<sqsupset>, \<mho>, \<Join>,
+  %\<lhd>, \<lesssim>, \<greatersim>, \<lessapprox>, \<greaterapprox>,
+  %\<triangleq>, \<yen>, \<lozenge>
+\usepackage{amsthm}
+
+\usepackage{amsmath}
+
+%\usepackage{eurosym}
+  %for \<euro>
+
+%\usepackage[only,bigsqcap]{stmaryrd}
+  %for \<Sqinter>
+
+%\usepackage{eufrak}
+  %for \<AA> ... \<ZZ>, \<aa> ... \<zz> (also included in amssymb)
+
+%\usepackage{textcomp}
+  %for \<onequarter>, \<onehalf>, \<threequarters>, \<degree>, \<cent>,
+  %\<currency>
+
+% this should be the last package used
+\usepackage{pdfsetup}
+\definecolor{linkcolor}{rgb}{0,0,0}
+\definecolor{citecolor}{rgb}{0,0,0}
+% urls in roman style, theory text in math-similar italics
+\urlstyle{rm}
+\isabellestyle{it}
+
+% for uniform font size
+\renewcommand{\isastyleminor}{\isastyle}
+
+\begin{document}
+
+% sane default for proof documents
+\parindent 0pt\parskip 0.5ex
+
+
+\begin{abstract}
+We utilize and extend the method of \emph{shallow semantic embeddings} (SSEs) in classical higher-order logic (HOL) to construct a custom theorem proving environment
+for \emph{abstract objects theory} (AOT) on the basis of Isabelle/HOL.
+
+SSEs are a means for universal logical reasoning by translating a target logic to HOL using a representation of its semantics.
+AOT is a foundational metaphysical theory, developed by Edward Zalta, that explains the objects presupposed by the sciences as \emph{abstract objects} that reify property patterns. In particular, AOT aspires to provide a philosphically grounded basis for the construction and analysis of the objects of mathematics.
+
+We can support this claim by verifying Uri Nodelman's and Edward Zalta's reconstruction of Frege's theorem: we can confirm that the Dedekind-Peano postulates for natural numbers are consistently derivable in AOT using Frege's method. Furthermore, we can suggest and discuss generalizations and variants of the construction and can thereby provide theoretical insights into, and contribute to the philosophical justification of, the construction.
+
+In the process, we can demonstrate that our method allows for a nearly transparent exchange of results between traditional pen-and-paper-based reasoning and the computerized implementation, which in turn can retain the automation mechanisms available for Isabelle/HOL.
+
+During our work, we could significantly contribute to the evolution of our target theory itself, while simultaneously solving the technical challenge of using an SSE to implement a theory that is based on
+logical foundations that significantly differ from the meta-logic HOL.
+
+In general, our results demonstrate the fruitfulness of the practice of Computational Metaphysics, i.e. the application of computational methods to metaphysical questions and theories.
+
+A full description of this formalization including references can be found at \url{http://dx.doi.org/10.17169/refubium-35141}.
+
+The version of Principia Logico-Metaphysica (PLM) implemented in this formalization
+can be found at \url{http://mally.stanford.edu/principia-2021-10-13.pdf}, while
+the latest version of PLM is available at \url{http://mally.stanford.edu/principia.pdf}.
+\end{abstract}
+
+\cleardoublepage
+
+\tableofcontents
+
+\cleardoublepage
+
+% generated text of all theories
+
+\newgeometry{margin=1in}
+
+\input{session}
+
+\restoregeometry
+
+\end{document}
+
+%%% Local Variables:
+%%% mode: latex
+%%% TeX-master: t
+%%% End:
diff --git a/thys/ROOTS b/thys/ROOTS
--- a/thys/ROOTS
+++ b/thys/ROOTS
@@ -1,724 +1,725 @@
 ADS_Functor
 AI_Planning_Languages_Semantics
 AODV
 AVL-Trees
 AWN
 Abortable_Linearizable_Modules
 Abs_Int_ITP2012
 Abstract-Hoare-Logics
 Abstract-Rewriting
 Abstract_Completeness
 Abstract_Soundness
 Ackermanns_not_PR
 Actuarial_Mathematics
 Adaptive_State_Counting
 Affine_Arithmetic
 Aggregation_Algebras
 Akra_Bazzi
 Algebraic_Numbers
 Algebraic_VCs
 Allen_Calculus
 Amicable_Numbers
 Amortized_Complexity
 AnselmGod
+AOT
 Applicative_Lifting
 Approximation_Algorithms
 Architectural_Design_Patterns
 Aristotles_Assertoric_Syllogistic
 Arith_Prog_Rel_Primes
 ArrowImpossibilityGS
 Attack_Trees
 Auto2_HOL
 Auto2_Imperative_HOL
 AutoFocus-Stream
 Automated_Stateful_Protocol_Verification
 Automatic_Refinement
 AxiomaticCategoryTheory
 Balog_Szemeredi_Gowers
 BDD
 BD_Security_Compositional
 BNF_CC
 BNF_Operations
 BTree
 Banach_Steinhaus
 Belief_Revision
 Bell_Numbers_Spivey
 BenOr_Kozen_Reif
 Berlekamp_Zassenhaus
 Bernoulli
 Bertrands_Postulate
 Bicategory
 BinarySearchTree
 Binding_Syntax_Theory
 Binomial-Heaps
 Binomial-Queues
 BirdKMP
 Birkhoff_Finite_Distributive_Lattices
 Blue_Eyes
 Bondy
 Boolean_Expression_Checkers
 Boolos_Curious_Inference
 Boolos_Curious_Inference_Automated
 Bounded_Deducibility_Security
 Buchi_Complementation
 Budan_Fourier
 Buffons_Needle
 Buildings
 BytecodeLogicJmlTypes
 C2KA_DistributedSystems
 CAVA_Automata
 CAVA_LTL_Modelchecker
 CCS
 CISC-Kernel
 Cook_Levin
 CRYSTALS-Kyber
 CRDT
 CSP_RefTK
 CYK
 CZH_Elementary_Categories
 CZH_Foundations
 CZH_Universal_Constructions
 CakeML
 CakeML_Codegen
 Call_Arity
 Card_Equiv_Relations
 Card_Multisets
 Card_Number_Partitions
 Card_Partitions
 Cartan_FP
 Case_Labeling
 Catalan_Numbers
 Category
 Category2
 Category3
 Cauchy
 Cayley_Hamilton
 Certification_Monads
 Chandy_Lamport
 CHERI-C_Memory_Model
 Chord_Segments
 Circus
 Clean
 Clique_and_Monotone_Circuits
 ClockSynchInst
 Closest_Pair_Points
 CoCon
 CoSMeDis
 CoSMed
 CofGroups
 Coinductive
 Coinductive_Languages
 Collections
 Combinable_Wands
 Combinatorial_Enumeration_Algorithms
 Combinatorics_Words
 Combinatorics_Words_Graph_Lemma
 Combinatorics_Words_Lyndon
 Commuting_Hermitian
 Comparison_Sort_Lower_Bound
 Compiling-Exceptions-Correctly
 Complete_Non_Orders
 Completeness
 Complex_Bounded_Operators
 Complex_Geometry
 Complx
 ComponentDependencies
 ConcurrentGC
 ConcurrentIMP
 Concurrent_Ref_Alg
 Concurrent_Revisions
 Conditional_Simplification
 Conditional_Transfer_Rule
 Consensus_Refined
 Constructive_Cryptography
 Constructive_Cryptography_CM
 Constructor_Funs
 Containers
 CoreC++
 Core_DOM
 Core_SC_DOM
 Correctness_Algebras
 Cotangent_PFD_Formula
 Count_Complex_Roots
 CryptHOL
 CryptoBasedCompositionalProperties
 Cubic_Quartic_Equations
 DFS_Framework
 DOM_Components
 DPT-SAT-Solver
 DataRefinementIBP
 Datatype_Order_Generator
 Decl_Sem_Fun_PL
 Decreasing-Diagrams
 Decreasing-Diagrams-II
 Dedekind_Real
 Deep_Learning
 Delta_System_Lemma
 Density_Compiler
 Dependent_SIFUM_Refinement
 Dependent_SIFUM_Type_Systems
 Depth-First-Search
 Derangements
 Deriving
 Descartes_Sign_Rule
 Design_Theory
 Dict_Construction
 Differential_Dynamic_Logic
 Differential_Game_Logic
 Digit_Expansions
 Dijkstra_Shortest_Path
 Diophantine_Eqns_Lin_Hom
 Dirichlet_L
 Dirichlet_Series
 DiscretePricing
 Discrete_Summation
 DiskPaxos
 Dominance_CHK
 DPRM_Theorem
 DynamicArchitectures
 Dynamic_Tables
 E_Transcendental
 Echelon_Form
 EdmondsKarp_Maxflow
 Efficient-Mergesort
 Elliptic_Curves_Group_Law
 Encodability_Process_Calculi
 Epistemic_Logic
 Equivalence_Relation_Enumeration
 Ergodic_Theory
 Error_Function
 Euler_MacLaurin
 Euler_Partition
 Eval_FO
 Example-Submission
 Extended_Finite_State_Machine_Inference
 Extended_Finite_State_Machines
 FFT
 FLP
 FOL-Fitting
 FOL_Axiomatic
 FOL_Harrison
 FOL_Seq_Calc1
 FOL_Seq_Calc2
 FOL_Seq_Calc3
 FSM_Tests
 Factor_Algebraic_Polynomial
 Factored_Transition_System_Bounding
 Falling_Factorial_Sum
 Farkas
 FeatherweightJava
 Featherweight_OCL
 Fermat3_4
 FileRefinement
 FinFun
 Finger-Trees
 Finite-Map-Extras
 Finite_Automata_HF
 Finite_Fields
 Finitely_Generated_Abelian_Groups
 First_Order_Terms
 First_Welfare_Theorem
 Fishburn_Impossibility
 Fisher_Yates
 Fishers_Inequality
 Flow_Networks
 Floyd_Warshall
 Flyspeck-Tame
 FocusStreamsCaseStudies
 Forcing
 Formal_Puiseux_Series
 Formal_SSA
 Formula_Derivatives
 Foundation_of_geometry
 Fourier
 FO_Theory_Rewriting
 Free-Boolean-Algebra
 Free-Groups
 Frequency_Moments
 Fresh_Identifiers
 FunWithFunctions
 FunWithTilings
 Functional-Automata
 Functional_Ordered_Resolution_Prover
 Furstenberg_Topology
 GPU_Kernel_PL
 Gabow_SCC
 GaleStewart_Games
 Gale_Shapley
 Game_Based_Crypto
 Gauss-Jordan-Elim-Fun
 Gauss_Jordan
 Gauss_Sums
 Gaussian_Integers
 GenClock
 General-Triangle
 Generalized_Counting_Sort
 Generic_Deriving
 Generic_Join
 GewirthPGCProof
 Girth_Chromatic
 GoedelGod
 Goedel_HFSet_Semantic
 Goedel_HFSet_Semanticless
 Goedel_Incompleteness
 Goodstein_Lambda
 GraphMarkingIBP
 Graph_Saturation
 Graph_Theory
 Green
 Groebner_Bases
 Groebner_Macaulay
 Gromov_Hyperbolicity
 Grothendieck_Schemes
 Group-Ring-Module
 HOL-CSP
 HOLCF-Prelude
 HRB-Slicing
 Hahn_Jordan_Decomposition
 Hales_Jewett
 Heard_Of
 Hello_World
 HereditarilyFinite
 Hermite
 Hermite_Lindemann
 Hidden_Markov_Models
 Higher_Order_Terms
 Hoare_Time
 Hood_Melville_Queue
 HotelKeyCards
 Huffman
 Hybrid_Logic
 Hybrid_Multi_Lane_Spatial_Logic
 Hybrid_Systems_VCs
 HyperCTL
 Hyperdual
 IEEE_Floating_Point
 IFC_Tracking
 IMAP-CRDT
 IMO2019
 IMP2
 IMP2_Binary_Heap
 IMP_Compiler
 IMP_Compiler_Reuse
 IP_Addresses
 Imperative_Insertion_Sort
 Implicational_Logic
 Impossible_Geometry
 Incompleteness
 Incredible_Proof_Machine
 Independence_CH
 Inductive_Confidentiality
 Inductive_Inference
 InfPathElimination
 InformationFlowSlicing
 InformationFlowSlicing_Inter
 Integration
 Interpolation_Polynomials_HOL_Algebra
 Interpreter_Optimizations
 Interval_Arithmetic_Word32
 Intro_Dest_Elim
 Involutions2Squares
 Iptables_Semantics
 Irrational_Series_Erdos_Straus
 Irrationality_J_Hancl
 Irrationals_From_THEBOOK
 IsaGeoCoq
 Isabelle_C
 Isabelle_Marries_Dirac
 Isabelle_Meta_Model
 IsaNet
 Jacobson_Basic_Algebra
 Jinja
 JinjaDCI
 JinjaThreads
 JiveDataStoreModel
 Jordan_Hoelder
 Jordan_Normal_Form
 KAD
 KAT_and_DRA
 KBPs
 KD_Tree
 Key_Agreement_Strong_Adversaries
 Khovanskii_Theorem
 Kleene_Algebra
 Kneser_Cauchy_Davenport
 Knights_Tour
 Knot_Theory
 Knuth_Bendix_Order
 Knuth_Morris_Pratt
 Koenigsberg_Friendship
 Kruskal
 Kuratowski_Closure_Complement
 LLL_Basis_Reduction
 LLL_Factorization
 LOFT
 LTL
 LTL_Master_Theorem
 LTL_Normal_Form
 LTL_to_DRA
 LTL_to_GBA
 Lam-ml-Normalization
 LambdaAuth
 LambdaMu
 Lambda_Free_EPO
 Lambda_Free_KBOs
 Lambda_Free_RPOs
 Lambert_W
 Landau_Symbols
 Laplace_Transform
 Latin_Square
 LatticeProperties
 Launchbury
 Laws_of_Large_Numbers
 Lazy-Lists-II
 Lazy_Case
 Lehmer
 Lifting_Definition_Option
 Lifting_the_Exponent
 LightweightJava
 LinearQuantifierElim
 Linear_Inequalities
 Linear_Programming
 Linear_Recurrences
 Liouville_Numbers
 List-Index
 List-Infinite
 List_Interleaving
 List_Inversions
 List_Update
 LocalLexing
 Localization_Ring
 Locally-Nameless-Sigma
 Logging_Independent_Anonymity
 Lowe_Ontological_Argument
 Lower_Semicontinuous
 Lp
 LP_Duality
 Lucas_Theorem
 MDP-Algorithms
 MDP-Rewards
 MFMC_Countable
 MFODL_Monitor_Optimized
 MFOTL_Monitor
 MSO_Regex_Equivalence
 Markov_Models
 Marriage
 Mason_Stothers
 Matrices_for_ODEs
 Matrix
 Matrix_Tensor
 Matroids
 Maximum_Segment_Sum
 Max-Card-Matching
 Median_Method
 Median_Of_Medians_Selection
 Menger
 Mereology
 Mersenne_Primes
 Metalogic_ProofChecker
 MiniML
 MiniSail
 Minimal_SSA
 Minkowskis_Theorem
 Minsky_Machines
 Modal_Logics_for_NTS
 Modular_Assembly_Kit_Security
 Modular_arithmetic_LLL_and_HNF_algorithms
 Monad_Memo_DP
 Monad_Normalisation
 MonoBoolTranAlgebra
 MonoidalCategory
 Monomorphic_Monad
 MuchAdoAboutTwo
 Multiset_Ordering_NPC
 Multi_Party_Computation
 Multirelations
 Multitape_To_Singletape_TM
 Myhill-Nerode
 Name_Carrying_Type_Inference
 Nano_JSON
 Nash_Williams
 Nat-Interval-Logic
 Native_Word
 Nested_Multisets_Ordinals
 Network_Security_Policy_Verification
 Neumann_Morgenstern_Utility
 No_FTL_observers
 Nominal2
 Noninterference_CSP
 Noninterference_Concurrent_Composition
 Noninterference_Generic_Unwinding
 Noninterference_Inductive_Unwinding
 Noninterference_Ipurge_Unwinding
 Noninterference_Sequential_Composition
 NormByEval
 Nullstellensatz
 Number_Theoretic_Transform
 Octonions
 OpSets
 Open_Induction
 Optics
 Optimal_BST
 Orbit_Stabiliser
 Order_Lattice_Props
 Ordered_Resolution_Prover
 Ordinal
 Ordinal_Partitions
 Ordinals_and_Cardinals
 Ordinary_Differential_Equations
 PAC_Checker
 Package_logic
 PAL
 PAPP_Impossibility
 PCF
 PLM
 POPLmark-deBruijn
 PSemigroupsConvolution
 Padic_Ints
 Padic_Field
 Pairing_Heap
 Paraconsistency
 Parity_Game
 Partial_Function_MR
 Partial_Order_Reduction
 Password_Authentication_Protocol
 Pell
 Perfect-Number-Thm
 Perron_Frobenius
 Physical_Quantities
 Pi_Calculus
 Pi_Transcendental
 Planarity_Certificates
 Pluennecke_Ruzsa_Inequality
 Poincare_Bendixson
 Poincare_Disc
 Polynomial_Factorization
 Polynomial_Interpolation
 Polynomials
 Pop_Refinement
 Posix-Lexing
 Possibilistic_Noninterference
 Power_Sum_Polynomials
 Pratt_Certificate
 Prefix_Free_Code_Combinators
 Presburger-Automata
 Prim_Dijkstra_Simple
 Prime_Distribution_Elementary
 Prime_Harmonic_Series
 Prime_Number_Theorem
 Priority_Queue_Braun
 Priority_Search_Trees
 Probabilistic_Noninterference
 Probabilistic_Prime_Tests
 Probabilistic_System_Zoo
 Probabilistic_Timed_Automata
 Probabilistic_While
 Program-Conflict-Analysis
 Progress_Tracking
 Projective_Geometry
 Projective_Measurements
 Promela
 Proof_Strategy_Language
 PropResPI
 Propositional_Logic_Class
 Propositional_Proof_Systems
 Prpu_Maxflow
 PseudoHoops
 Psi_Calculi
 Ptolemys_Theorem
 Public_Announcement_Logic
 QHLProver
 QR_Decomposition
 Quantales
 Quantifier_Elimination_Hybrid
 Quasi_Borel_Spaces
 Quaternions
 Query_Optimization
 Quick_Sort_Cost
 RIPEMD-160-SPARK
 ROBDD
 RSAPSS
 Ramsey-Infinite
 Random_BSTs
 Random_Graph_Subgraph_Threshold
 Randomised_BSTs
 Randomised_Social_Choice
 Rank_Nullity_Theorem
 Real_Impl
 Real_Power
 Real_Time_Deque
 Recursion-Addition
 Recursion-Theory-I
 Refine_Imperative_HOL
 Refine_Monadic
 RefinementReactive
 Regex_Equivalence
 Registers
 Regression_Test_Selection
 Regular-Sets
 Regular_Algebras
 Regular_Tree_Relations
 Relation_Algebra
 Relational-Incorrectness-Logic
 Relational_Disjoint_Set_Forests
 Relational_Forests
 Relational_Method
 Relational_Minimum_Spanning_Trees
 Relational_Paths
 Rep_Fin_Groups
 ResiduatedTransitionSystem
 Residuated_Lattices
 Resolution_FOL
 Rewrite_Properties_Reduction
 Rewriting_Z
 Ribbon_Proofs
 Risk_Free_Lending
 Robbins-Conjecture
 Robinson_Arithmetic
 Root_Balanced_Tree
 Roth_Arithmetic_Progressions
 Routing
 Roy_Floyd_Warshall
 SATSolverVerification
 SC_DOM_Components
 SDS_Impossibility
 SIFPL
 SIFUM_Type_Systems
 SPARCv8
 Safe_Distance
 Safe_OCL
 Safe_Range_RC
 Saturation_Framework
 Saturation_Framework_Extensions
 Sauer_Shelah_Lemma
 SCC_Bloemen_Sequential
 Schutz_Spacetime
 Secondary_Sylow
 Security_Protocol_Refinement
 Selection_Heap_Sort
 SenSocialChoice
 Separata
 Separation_Algebra
 Separation_Logic_Imperative_HOL
 Separation_Logic_Unbounded
 SequentInvertibility
 Shadow_DOM
 Shadow_SC_DOM
 Shivers-CFA
 ShortestPath
 Show
 Sigma_Commit_Crypto
 Signature_Groebner
 Simpl
 Simple_Firewall
 Simplex
 Simplicial_complexes_and_boolean_functions
 SimplifiedOntologicalArgument
 Skew_Heap
 Skip_Lists
 Slicing
 Sliding_Window_Algorithm
 Smith_Normal_Form
 Smooth_Manifolds
 Sophomores_Dream
 Solidity
 Sort_Encodings
 Source_Coding_Theorem
 SpecCheck
 Special_Function_Bounds
 Splay_Tree
 Sqrt_Babylonian
 Stable_Matching
 Stalnaker_Logic
 Statecharts
 Stateful_Protocol_Composition_and_Typing
 Stellar_Quorums
 Stern_Brocot
 Stewart_Apollonius
 Stirling_Formula
 Stochastic_Matrices
 Stone_Algebras
 Stone_Kleene_Relation_Algebras
 Stone_Relation_Algebras
 Store_Buffer_Reduction
 Stream-Fusion
 Stream_Fusion_Code
 Strong_Security
 Sturm_Sequences
 Sturm_Tarski
 Stuttering_Equivalence
 Subresultants
 Subset_Boolean_Algebras
 SumSquares
 Sunflowers
 SuperCalc
 Surprise_Paradox
 Symmetric_Polynomials
 Syntax_Independent_Logic
 Synthetic_Completeness
 Szemeredi_Regularity
 Szpilrajn
 TESL_Language
 TLA
 Tail_Recursive_Functions
 Tarskis_Geometry
 Taylor_Models
 Three_Circles
 Timed_Automata
 Topological_Semantics
 Topology
 TortoiseHare
 Transcendence_Series_Hancl_Rucki
 Transformer_Semantics
 Transition_Systems_and_Automata
 Transitive-Closure
 Transitive-Closure-II
 Transitive_Models
 Treaps
 Tree-Automata
 Tree_Decomposition
 Triangle
 Trie
 Turans_Graph_Theorem
 Twelvefold_Way
 Tycon
 Types_Tableaus_and_Goedels_God
 Types_To_Sets_Extension
 UPF
 UPF_Firewall
 UTP
 Undirected_Graph_Theory
 Universal_Hash_Families
 Universal_Turing_Machine
 UpDown_Scheme
 Valuation
 Van_Emde_Boas_Trees
 Van_der_Waerden
 VectorSpace
 VeriComp
 Verified-Prover
 Verified_SAT_Based_AI_Planning
 VerifyThis2018
 VerifyThis2019
 Vickrey_Clarke_Groves
 Virtual_Substitution
 VolpanoSmith
 VYDRA_MDL
 WHATandWHERE_Security
 WOOT_Strong_Eventual_Consistency
 WebAssembly
 Weight_Balanced_Trees
 Weighted_Arithmetic_Geometric_Mean
 Weighted_Path_Order
 Well_Quasi_Orders
 Wetzels_Problem
 Winding_Number_Eval
 Word_Lib
 WorkerWrapper
 X86_Semantics
 XML
 Youngs_Inequality
 ZFC_in_HOL
 Zeta_3_Irrational
 Zeta_Function
 pGCL