(*<*)
theory AOT_PLM
  imports AOT_Axioms
begin
(*>*)

section‹The Deductive System PLM›
text‹\label{PLM: 9}›

(* constrain sledgehammer to the abstraction layer *)
unbundle AOT_no_atp

subsection‹Primitive Rule of PLM: Modus Ponens›
text‹\label{PLM: 9.1}›

AOT_theorem "modus-ponens":
  assumes ‹φ› and ‹φ → ψ›
  shows ‹ψ›
  (* NOTE: semantics needed *)
  using assms by (simp add: AOT_sem_imp)
lemmas MP = "modus-ponens"

subsection‹(Modally Strict) Proofs and Derivations›
text‹\label{PLM: 9.2}›

AOT_theorem "non-con-thm-thm":
  assumes ‹\⊨_\◻ φ›
  shows ‹\⊨ φ›
  using assms by simp

AOT_theorem "vdash-properties:1[1]":
  assumes ‹φ ∈ Λ›
  shows ‹\⊨ φ›
  (* NOTE: semantics needed *)
  using assms unfolding AOT_model_act_axiom_def by blast

text‹Convenience attribute for instantiating modally-fragile axioms.›
attribute_setup act_axiom_inst =
  ‹Scan.succeed (Thm.rule_attribute []
 (K (fn thm => thm RS @{thm "vdash-properties:1[1]"})))›
  "Instantiate modally fragile axiom as modally fragile theorem."

AOT_theorem "vdash-properties:1[2]":
  assumes ‹φ ∈ Λ_\◻›
  shows ‹\⊨_\◻ φ›
  (* NOTE: semantics needed *)
  using assms unfolding AOT_model_axiom_def by blast

text‹Convenience attribute for instantiating modally-strict axioms.›
attribute_setup axiom_inst =
  ‹Scan.succeed (Thm.rule_attribute []
 (K (fn thm => thm RS @{thm "vdash-properties:1[2]"})))›
  "Instantiate axiom as theorem."

text‹Convenience methods and theorem sets for applying "cqt:2".›
method cqt_2_lambda_inst_prover =
  (fast intro: AOT_instance_of_cqt_2_intro)
method "cqt:2[lambda]" =
  (rule "cqt:2[lambda]"[axiom_inst]; cqt_2_lambda_inst_prover)
lemmas "cqt:2" =
  "cqt:2[const_var]"[axiom_inst] "cqt:2[lambda]"[axiom_inst]
  AOT_instance_of_cqt_2_intro
method "cqt:2" = (safe intro!: "cqt:2")

AOT_theorem "vdash-properties:3":
  assumes ‹\⊨_\◻ φ›
  shows ‹Γ \⊨ φ›
  using assms by blast

AOT_theorem "vdash-properties:5":
  assumes ‹Γ₁ \⊨ φ› and ‹Γ₂ \⊨ φ → ψ›
  shows ‹Γ₁, Γ₂ \⊨ ψ›
  using MP assms by blast

AOT_theorem "vdash-properties:6":
  assumes ‹φ› and ‹φ → ψ›
  shows ‹ψ›
  using MP assms by blast

AOT_theorem "vdash-properties:8":
  assumes ‹Γ \⊨ φ› and ‹φ \⊨ ψ›
  shows ‹Γ \⊨ ψ›
  using assms by argo

AOT_theorem "vdash-properties:9":
  assumes ‹φ›
  shows ‹ψ → φ›
  using MP "pl:1"[axiom_inst] assms by blast

AOT_theorem "vdash-properties:10":
  assumes ‹φ → ψ› and ‹φ›
  shows ‹ψ›
  using MP assms by blast
lemmas "→E" = "vdash-properties:10"

subsection‹Two Fundamental Metarules: GEN and RN›
text‹\label{PLM: 9.3}›

AOT_theorem "rule-gen":
  assumes ‹for arbitrary α: φ{α}›
  shows ‹∀α φ{α}›
  (* NOTE: semantics needed *)
  using assms by (metis AOT_var_of_term_inverse AOT_sem_denotes AOT_sem_forall)
lemmas GEN = "rule-gen"

AOT_theorem "RN[prem]":
  assumes ‹Γ \⊨_\◻ φ›
  shows ‹◻Γ \⊨_\◻ ◻φ›
  by (meson AOT_sem_box assms image_iff) (* NOTE: semantics needed *)
AOT_theorem RN:
  assumes ‹\⊨_\◻ φ›
  shows ‹◻φ›
  using "RN[prem]" assms by blast

subsection‹The Inferential Role of Definitions›
text‹\label{PLM: 9.4}›

AOT_axiom "df-rules-formulas[1]":
  assumes ‹φ ≡_df ψ›
  shows ‹φ → ψ›
  (* NOTE: semantics needed *)
  using assms
  by (auto simp: assms AOT_model_axiomI AOT_model_equiv_def AOT_sem_imp)
AOT_axiom "df-rules-formulas[2]":
  assumes ‹φ ≡_df ψ›
  shows ‹ψ → φ›
  (* NOTE: semantics needed *)
  using assms
  by (auto simp: AOT_model_axiomI AOT_model_equiv_def AOT_sem_imp)
(* NOTE: for convenience also state the above as regular theorems *)
AOT_theorem "df-rules-formulas[3]":
  assumes ‹φ ≡_df ψ›
  shows ‹φ → ψ›
  using "df-rules-formulas[1]"[axiom_inst, OF assms].
AOT_theorem "df-rules-formulas[4]":
  assumes ‹φ ≡_df ψ›
  shows ‹ψ → φ›
  using "df-rules-formulas[2]"[axiom_inst, OF assms].


AOT_axiom "df-rules-terms[1]":
  assumes ‹τ{α₁...α_n} =_df σ{α₁...α_n}›
  shows ‹(σ{τ₁...τ_n}↓ → τ{τ₁...τ_n} = σ{τ₁...τ_n}) &
 (¬σ{τ₁...τ_n}↓ → ¬τ{τ₁...τ_n}↓)›
  (* NOTE: semantics needed *)
  using assms
  by (simp add: AOT_model_axiomI AOT_sem_conj AOT_sem_imp AOT_sem_eq
                AOT_sem_not AOT_sem_denotes AOT_model_id_def)
AOT_axiom "df-rules-terms[2]":
  assumes ‹τ =_df σ›
  shows ‹(σ↓ → τ = σ) & (¬σ↓ → ¬τ↓)›
  by (metis "df-rules-terms[1]" case_unit_Unity assms)
(* NOTE: for convenience also state the above as regular theorems *)
AOT_theorem "df-rules-terms[3]":
  assumes ‹τ{α₁...α_n} =_df σ{α₁...α_n}›
  shows ‹(σ{τ₁...τ_n}↓ → τ{τ₁...τ_n} = σ{τ₁...τ_n}) &
 (¬σ{τ₁...τ_n}↓ → ¬τ{τ₁...τ_n}↓)›
  using "df-rules-terms[1]"[axiom_inst, OF assms].
AOT_theorem "df-rules-terms[4]":
  assumes ‹τ =_df σ›
  shows ‹(σ↓ → τ = σ) & (¬σ↓ → ¬τ↓)›
  using "df-rules-terms[2]"[axiom_inst, OF assms].

subsection‹The Theory of Negations and Conditionals›
text‹\label{PLM: 9.5}›

AOT_theorem "if-p-then-p": ‹φ → φ›
  by (meson "pl:1"[axiom_inst] "pl:2"[axiom_inst] MP)

AOT_theorem "deduction-theorem":
  assumes ‹φ \⊨ ψ›
  shows ‹φ → ψ›
  (* NOTE: semantics needed *)
  using assms by (simp add: AOT_sem_imp)
lemmas CP = "deduction-theorem"
lemmas "→I" = "deduction-theorem"

AOT_theorem "ded-thm-cor:1":
  assumes ‹Γ₁ \⊨ φ → ψ› and ‹Γ₂ \⊨ ψ → χ›
  shows ‹Γ₁, Γ₂ \⊨ φ → χ›
  using "→E" "→I" assms by blast
AOT_theorem "ded-thm-cor:2":
  assumes ‹Γ₁ \⊨ φ → (ψ → χ)› and ‹Γ₂ \⊨ ψ›
  shows ‹Γ₁, Γ₂ \⊨ φ → χ›
  using "→E" "→I" assms by blast

AOT_theorem "ded-thm-cor:3":
  assumes ‹φ → ψ› and ‹ψ → χ›
  shows ‹φ → χ›
  using "→E" "→I" assms by blast
declare "ded-thm-cor:3"[trans]
AOT_theorem "ded-thm-cor:4":
  assumes ‹φ → (ψ → χ)› and ‹ψ›
  shows ‹φ → χ›
  using "→E" "→I" assms by blast

lemmas "Hypothetical Syllogism" = "ded-thm-cor:3"

AOT_theorem "useful-tautologies:1": ‹¬¬φ → φ›
  by (metis "pl:3"[axiom_inst] "→I" "Hypothetical Syllogism")
AOT_theorem "useful-tautologies:2": ‹φ → ¬¬φ›
  by (metis "pl:3"[axiom_inst] "→I" "ded-thm-cor:4")
AOT_theorem "useful-tautologies:3": ‹¬φ → (φ → ψ)›
  by (meson "ded-thm-cor:4" "pl:3"[axiom_inst] "→I")
AOT_theorem "useful-tautologies:4": ‹(¬ψ → ¬φ) → (φ → ψ)›
  by (meson "pl:3"[axiom_inst] "Hypothetical Syllogism" "→I")
AOT_theorem "useful-tautologies:5": ‹(φ → ψ) → (¬ψ → ¬φ)›
  by (metis "useful-tautologies:4" "Hypothetical Syllogism" "→I")

AOT_theorem "useful-tautologies:6": ‹(φ → ¬ψ) → (ψ → ¬φ)›
  by (metis "→I" MP "useful-tautologies:4")

AOT_theorem "useful-tautologies:7": ‹(¬φ → ψ) → (¬ψ → φ)›
  by (metis "→I" MP "useful-tautologies:3" "useful-tautologies:5")

AOT_theorem "useful-tautologies:8": ‹φ → (¬ψ → ¬(φ → ψ))›
  by (metis "→I" MP "useful-tautologies:5")

AOT_theorem "useful-tautologies:9": ‹(φ → ψ) → ((¬φ → ψ) → ψ)›
  by (metis "→I" MP "useful-tautologies:6")

AOT_theorem "useful-tautologies:10": ‹(φ → ¬ψ) → ((φ → ψ) → ¬φ)›
  by (metis "→I" MP "pl:3"[axiom_inst])

AOT_theorem "dn-i-e:1":
  assumes ‹φ›
  shows ‹¬¬φ›
  using MP "useful-tautologies:2" assms by blast
lemmas "¬¬I" = "dn-i-e:1"
AOT_theorem "dn-i-e:2":
  assumes ‹¬¬φ›
  shows ‹φ›
  using MP "useful-tautologies:1" assms by blast
lemmas "¬¬E" = "dn-i-e:2"

AOT_theorem "modus-tollens:1":
  assumes ‹φ → ψ› and ‹¬ψ›
  shows ‹¬φ›
  using MP "useful-tautologies:5" assms by blast
AOT_theorem "modus-tollens:2":
  assumes ‹φ → ¬ψ› and ‹ψ›
  shows ‹¬φ›
  using "¬¬I" "modus-tollens:1" assms by blast
lemmas MT = "modus-tollens:1" "modus-tollens:2"

AOT_theorem "contraposition:1[1]":
  assumes ‹φ → ψ›
  shows ‹¬ψ → ¬φ›
  using "→I" MT(1) assms by blast
AOT_theorem "contraposition:1[2]":
  assumes ‹¬ψ → ¬φ›
  shows ‹φ → ψ›
  using "→I" "¬¬E" MT(2) assms by blast

AOT_theorem "contraposition:2":
  assumes ‹φ → ¬ψ›
  shows ‹ψ → ¬φ›
  using "→I" MT(2) assms by blast

AOT_theorem "reductio-aa:1":
  assumes ‹¬φ \⊨ ¬ψ› and ‹¬φ \⊨ ψ›
  shows ‹φ›
  using "→I" "¬¬E" MT(2) assms by blast
AOT_theorem "reductio-aa:2":
  assumes ‹φ \⊨ ¬ψ› and ‹φ \⊨ ψ›
  shows ‹¬φ›
  using "reductio-aa:1" assms by blast
lemmas "RAA" = "reductio-aa:1" "reductio-aa:2"

AOT_theorem "exc-mid": ‹φ ∨ ¬φ›
  using "df-rules-formulas[4]" "if-p-then-p" MP
        "conventions:2" by blast

AOT_theorem "non-contradiction": ‹¬(φ & ¬φ)›
  using "df-rules-formulas[3]" MT(2) "useful-tautologies:2"
        "conventions:1" by blast

AOT_theorem "con-dis-taut:1": ‹(φ & ψ) → φ›
  by (meson "→I" "df-rules-formulas[3]" MP RAA(1) "conventions:1")
AOT_theorem "con-dis-taut:2": ‹(φ & ψ) → ψ›
  by (metis "→I" "df-rules-formulas[3]" MT(2) RAA(2)
            "¬¬E" "conventions:1")
lemmas "Conjunction Simplification" = "con-dis-taut:1" "con-dis-taut:2"

AOT_theorem "con-dis-taut:3": ‹φ → (φ ∨ ψ)›
  by (meson "contraposition:1[2]" "df-rules-formulas[4]"
            MP "→I" "conventions:2")
AOT_theorem "con-dis-taut:4": ‹ψ → (φ ∨ ψ)›
  using "Hypothetical Syllogism" "df-rules-formulas[4]"
        "pl:1"[axiom_inst] "conventions:2" by blast
lemmas "Disjunction Addition" = "con-dis-taut:3" "con-dis-taut:4"

AOT_theorem "con-dis-taut:5": ‹φ → (ψ → (φ & ψ))›
  by (metis "contraposition:2" "Hypothetical Syllogism" "→I"
            "df-rules-formulas[4]" "conventions:1")
lemmas Adjunction = "con-dis-taut:5"

AOT_theorem "con-dis-taut:6": ‹(φ & φ) ≡ φ›
  by (metis Adjunction "→I" "df-rules-formulas[4]" MP
            "Conjunction Simplification"(1) "conventions:3")
lemmas "Idempotence of &" = "con-dis-taut:6"

AOT_theorem "con-dis-taut:7": ‹(φ ∨ φ) ≡ φ›
proof -
  {
    AOT_assume ‹φ ∨ φ›
    AOT_hence ‹¬φ → φ›
      using "conventions:2"[THEN "df-rules-formulas[3]"] MP by blast
    AOT_hence ‹φ› using "if-p-then-p" RAA(1) MP by blast
  }
  moreover {
    AOT_assume ‹φ›
    AOT_hence ‹φ ∨ φ› using "Disjunction Addition"(1) MP by blast
  }
  ultimately AOT_show ‹(φ ∨ φ) ≡ φ›
    using "conventions:3"[THEN "df-rules-formulas[4]"] MP
    by (metis Adjunction "→I")
qed
lemmas "Idempotence of ∨" = "con-dis-taut:7"


AOT_theorem "con-dis-i-e:1":
  assumes ‹φ› and ‹ψ›
  shows ‹φ & ψ›
  using Adjunction MP assms by blast
lemmas "&I" = "con-dis-i-e:1"

AOT_theorem "con-dis-i-e:2:a":
  assumes ‹φ & ψ›
  shows ‹φ›
  using "Conjunction Simplification"(1) MP assms by blast
AOT_theorem "con-dis-i-e:2:b":
  assumes ‹φ & ψ›
  shows ‹ψ›
  using "Conjunction Simplification"(2) MP assms by blast
lemmas "&E" = "con-dis-i-e:2:a" "con-dis-i-e:2:b"

AOT_theorem "con-dis-i-e:3:a":
  assumes ‹φ›
  shows ‹φ ∨ ψ›
  using "Disjunction Addition"(1) MP assms by blast
AOT_theorem "con-dis-i-e:3:b":
  assumes ‹ψ›
  shows ‹φ ∨ ψ›
  using "Disjunction Addition"(2) MP assms by blast
AOT_theorem "con-dis-i-e:3:c":
  assumes ‹φ ∨ ψ› and ‹φ → χ› and ‹ψ → Θ›
  shows ‹χ ∨ Θ›
  by (metis "con-dis-i-e:3:a" "Disjunction Addition"(2)
            "df-rules-formulas[3]" MT(1) RAA(1)
            "conventions:2" assms)
lemmas "∨I" = "con-dis-i-e:3:a" "con-dis-i-e:3:b" "con-dis-i-e:3:c"

AOT_theorem "con-dis-i-e:4:a":
  assumes ‹φ ∨ ψ› and ‹φ → χ› and ‹ψ → χ›
  shows ‹χ›
  by (metis MP RAA(2) "df-rules-formulas[3]" "conventions:2" assms)
AOT_theorem "con-dis-i-e:4:b":
  assumes ‹φ ∨ ψ› and ‹¬φ›
  shows ‹ψ›
  using "con-dis-i-e:4:a" RAA(1) "→I" assms by blast
AOT_theorem "con-dis-i-e:4:c":
  assumes ‹φ ∨ ψ› and ‹¬ψ›
  shows ‹φ›
  using "con-dis-i-e:4:a" RAA(1) "→I" assms by blast
lemmas "∨E" = "con-dis-i-e:4:a" "con-dis-i-e:4:b" "con-dis-i-e:4:c"

AOT_theorem "raa-cor:1":
  assumes ‹¬φ \⊨ ψ & ¬ψ›
  shows ‹φ›
  using "&E" "∨E"(3) "∨I"(2) RAA(2) assms by blast
AOT_theorem "raa-cor:2":
  assumes ‹φ \⊨ ψ & ¬ψ›
  shows ‹¬φ›
  using "raa-cor:1" assms by blast
AOT_theorem "raa-cor:3":
  assumes ‹φ› and ‹¬ψ \⊨ ¬φ›
  shows ‹ψ›
  using RAA assms by blast
AOT_theorem "raa-cor:4":
  assumes ‹¬φ› and ‹¬ψ \⊨ φ›
  shows ‹ψ›
  using RAA assms by blast
AOT_theorem "raa-cor:5":
  assumes ‹φ› and ‹ψ \⊨ ¬φ›
  shows ‹¬ψ›
  using RAA assms by blast
AOT_theorem "raa-cor:6":
  assumes ‹¬φ› and ‹ψ \⊨ φ›
  shows ‹¬ψ›
  using RAA assms by blast

AOT_theorem "oth-class-taut:1:a": ‹(φ → ψ) ≡ ¬(φ & ¬ψ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (metis "&E" "&I" "raa-cor:3" "→I" MP)
AOT_theorem "oth-class-taut:1:b": ‹¬(φ → ψ) ≡ (φ & ¬ψ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (metis "&E" "&I" "raa-cor:3" "→I" MP)
AOT_theorem "oth-class-taut:1:c": ‹(φ → ψ) ≡ (¬φ ∨ ψ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (metis "&I" "∨I"(1, 2) "∨E"(3) "→I" MP "raa-cor:1")

AOT_theorem "oth-class-taut:2:a": ‹(φ & ψ) ≡ (ψ & φ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (meson "&I" "&E" "→I")
lemmas "Commutativity of &" = "oth-class-taut:2:a"
AOT_theorem "oth-class-taut:2:b": ‹(φ & (ψ & χ)) ≡ ((φ & ψ) & χ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (metis "&I" "&E" "→I")
lemmas "Associativity of &" = "oth-class-taut:2:b"
AOT_theorem "oth-class-taut:2:c": ‹(φ ∨ ψ) ≡ (ψ ∨ φ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (metis "&I" "∨I"(1, 2) "∨E"(1) "→I")
lemmas "Commutativity of ∨" = "oth-class-taut:2:c"
AOT_theorem "oth-class-taut:2:d": ‹(φ ∨ (ψ ∨ χ)) ≡ ((φ ∨ ψ) ∨ χ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"])
     (metis "&I" "∨I"(1, 2) "∨E"(1) "→I")
lemmas "Associativity of ∨" = "oth-class-taut:2:d"
AOT_theorem "oth-class-taut:2:e": ‹(φ ≡ ψ) ≡ (ψ ≡ φ)›
  by (rule "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"]; rule "&I";
      metis "&I" "df-rules-formulas[4]" "conventions:3" "&E"
            "Hypothetical Syllogism" "→I" "df-rules-formulas[3]")
lemmas "Commutativity of ≡" = "oth-class-taut:2:e"
AOT_theorem "oth-class-taut:2:f": ‹(φ ≡ (ψ ≡ χ)) ≡ ((φ ≡ ψ) ≡ χ)›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "conventions:3"[THEN "df-rules-formulas[3]"]
        "→I" "→E" "&E" "&I"
  by metis
lemmas "Associativity of ≡" = "oth-class-taut:2:f"

AOT_theorem "oth-class-taut:3:a": ‹φ ≡ φ›
  using "&I" "vdash-properties:6" "if-p-then-p"
        "df-rules-formulas[4]" "conventions:3" by blast
AOT_theorem "oth-class-taut:3:b": ‹φ ≡ ¬¬φ›
  using "&I" "useful-tautologies:1" "useful-tautologies:2" "→E"
        "df-rules-formulas[4]" "conventions:3" by blast
AOT_theorem "oth-class-taut:3:c": ‹¬(φ ≡ ¬φ)›
  by (metis "&E" "→E" RAA "df-rules-formulas[3]" "conventions:3")

AOT_theorem "oth-class-taut:4:a": ‹(φ → ψ) → ((ψ → χ) → (φ → χ))›
  by (metis "→E" "→I")
AOT_theorem "oth-class-taut:4:b": ‹(φ ≡ ψ) ≡ (¬φ ≡ ¬ψ)›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "conventions:3"[THEN "df-rules-formulas[3]"]
        "→I" "→E" "&E" "&I" RAA by metis
AOT_theorem "oth-class-taut:4:c": ‹(φ ≡ ψ) → ((φ → χ) ≡ (ψ → χ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "conventions:3"[THEN "df-rules-formulas[3]"]
        "→I" "→E" "&E" "&I" by metis
AOT_theorem "oth-class-taut:4:d": ‹(φ ≡ ψ) → ((χ → φ) ≡ (χ → ψ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "conventions:3"[THEN "df-rules-formulas[3]"]
        "→I" "→E" "&E" "&I" by metis
AOT_theorem "oth-class-taut:4:e": ‹(φ ≡ ψ) → ((φ & χ) ≡ (ψ & χ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "conventions:3"[THEN "df-rules-formulas[3]"]
        "→I" "→E" "&E" "&I" by metis
AOT_theorem "oth-class-taut:4:f": ‹(φ ≡ ψ) → ((χ & φ) ≡ (χ & ψ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "conventions:3"[THEN "df-rules-formulas[3]"]
        "→I" "→E" "&E" "&I" by metis
AOT_theorem "oth-class-taut:4:g": ‹(φ ≡ ψ) ≡ ((φ & ψ) ∨ (¬φ & ¬ψ))›
proof(safe intro!: "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"]
                   "&I" "→I"
           dest!: "conventions:3"[THEN "df-rules-formulas[3]", THEN "→E"])
  AOT_show ‹φ & ψ ∨ (¬φ & ¬ψ)› if ‹(φ → ψ) & (ψ → φ)›
    using "&E" "∨I" "→E" "&I" "raa-cor:1" "→I" "∨E" that by metis
next
  AOT_show ‹ψ› if ‹φ & ψ ∨ (¬φ & ¬ψ)› and ‹φ›
    using that "∨E" "&E" "raa-cor:3" by blast
next
  AOT_show ‹φ› if ‹φ & ψ ∨ (¬φ & ¬ψ)› and ‹ψ›
    using that "∨E" "&E" "raa-cor:3" by blast
qed
AOT_theorem "oth-class-taut:4:h": ‹¬(φ ≡ ψ) ≡ ((φ & ¬ψ) ∨ (¬φ & ψ))›
proof (safe intro!: "conventions:3"[THEN "df-rules-formulas[4]", THEN "→E"]
                    "&I" "→I")
  AOT_show ‹φ & ¬ψ ∨ (¬φ & ψ)› if ‹¬(φ ≡ ψ)›
    by (metis that "&I" "∨I"(1, 2) "→I" MT(1) "df-rules-formulas[4]"
              "raa-cor:3" "conventions:3")
next
  AOT_show ‹¬(φ ≡ ψ)› if ‹φ & ¬ψ ∨ (¬φ & ψ)›
    by (metis that "&E" "∨E"(2) "→E" "df-rules-formulas[3]"
              "raa-cor:3" "conventions:3")
qed
AOT_theorem "oth-class-taut:5:a": ‹(φ & ψ) ≡ ¬(¬φ ∨ ¬ψ)›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "→I" "→E" "&E" "&I" "∨I" "∨E" RAA by metis
AOT_theorem "oth-class-taut:5:b": ‹(φ ∨ ψ) ≡ ¬(¬φ & ¬ψ)›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "→I" "→E" "&E" "&I" "∨I" "∨E" RAA by metis
AOT_theorem "oth-class-taut:5:c": ‹¬(φ & ψ) ≡ (¬φ ∨ ¬ψ)›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "→I" "→E" "&E" "&I" "∨I" "∨E" RAA by metis
AOT_theorem "oth-class-taut:5:d": ‹¬(φ ∨ ψ) ≡ (¬φ & ¬ψ)›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "→I" "→E" "&E" "&I" "∨I" "∨E" RAA by metis

lemmas DeMorgan = "oth-class-taut:5:c" "oth-class-taut:5:d"

AOT_theorem "oth-class-taut:6:a":
  ‹(φ & (ψ ∨ χ)) ≡ ((φ & ψ) ∨ (φ & χ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "→I" "→E" "&E" "&I" "∨I" "∨E" RAA by metis
AOT_theorem "oth-class-taut:6:b":
  ‹(φ ∨ (ψ & χ)) ≡ ((φ ∨ ψ) & (φ ∨ χ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"]
        "→I" "→E" "&E" "&I" "∨I" "∨E" RAA by metis

AOT_theorem "oth-class-taut:7:a": ‹((φ & ψ) → χ) → (φ → (ψ → χ))›
  by (metis "&I" "→E" "→I")
lemmas Exportation = "oth-class-taut:7:a"
AOT_theorem "oth-class-taut:7:b": ‹(φ → (ψ →χ)) → ((φ & ψ) → χ)›
  by (metis "&E" "→E" "→I")
lemmas Importation = "oth-class-taut:7:b"

AOT_theorem "oth-class-taut:8:a":
  ‹(φ → (ψ → χ)) ≡ (ψ → (φ → χ))›
  using "conventions:3"[THEN "df-rules-formulas[4]"] "→I" "→E" "&E" "&I"
  by metis
lemmas Permutation = "oth-class-taut:8:a"
AOT_theorem "oth-class-taut:8:b":
  ‹(φ → ψ) → ((φ → χ) → (φ → (ψ & χ)))›
  by (metis "&I" "→E" "→I")
lemmas Composition = "oth-class-taut:8:b"
AOT_theorem "oth-class-taut:8:c":
  ‹(φ → χ) → ((ψ → χ) → ((φ ∨ ψ) → χ))›
  by (metis "∨E"(2) "→E" "→I" RAA(1))
AOT_theorem "oth-class-taut:8:d":
  ‹((φ → ψ) & (χ → Θ)) → ((φ & χ) → (ψ & Θ))›
  by (metis "&E" "&I" "→E" "→I")
lemmas "Double Composition" = "oth-class-taut:8:d"
AOT_theorem "oth-class-taut:8:e":
  ‹((φ & ψ) ≡ (φ & χ)) ≡ (φ → (ψ ≡ χ))›
  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
            "conventions:3"[THEN "df-rules-formulas[3]"]
            "→I" "→E" "&E" "&I")
AOT_theorem "oth-class-taut:8:f":
  ‹((φ & ψ) ≡ (χ & ψ)) ≡ (ψ → (φ ≡ χ))›
  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
            "conventions:3"[THEN "df-rules-formulas[3]"]
            "→I" "→E" "&E" "&I")
AOT_theorem "oth-class-taut:8:g":
  ‹(ψ ≡ χ) → ((φ ∨ ψ) ≡ (φ ∨ χ))›
  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
            "conventions:3"[THEN "df-rules-formulas[3]"]
            "→I" "→E" "&E" "&I" "∨I" "∨E"(1))
AOT_theorem "oth-class-taut:8:h":
  ‹(ψ ≡ χ) → ((ψ ∨ φ) ≡ (χ ∨ φ))›
  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
            "conventions:3"[THEN "df-rules-formulas[3]"]
            "→I" "→E" "&E" "&I" "∨I" "∨E"(1))
AOT_theorem "oth-class-taut:8:i":
  ‹(φ ≡ (ψ & χ)) → (ψ → (φ ≡ χ))›
  by (metis "conventions:3"[THEN "df-rules-formulas[4]"]
            "conventions:3"[THEN "df-rules-formulas[3]"]
            "→I" "→E" "&E" "&I")

AOT_theorem "intro-elim:1":
  assumes ‹φ ∨ ψ› and ‹φ ≡ χ› and ‹ψ ≡ Θ›
  shows ‹χ ∨ Θ›
  by (metis assms "∨I"(1, 2) "∨E"(1) "→I" "→E" "&E"(1)
            "conventions:3"[THEN "df-rules-formulas[3]"])

AOT_theorem "intro-elim:2":
  assumes ‹φ → ψ› and ‹ψ → φ›
  shows ‹φ ≡ ψ›
  by (meson "&I" "conventions:3" "df-rules-formulas[4]" MP assms)
lemmas "≡I" = "intro-elim:2"

AOT_theorem "intro-elim:3:a":
  assumes ‹φ ≡ ψ› and ‹φ›
  shows ‹ψ›
  by (metis "∨I"(1) "→I" "∨E"(1) "intro-elim:1" assms)
AOT_theorem "intro-elim:3:b":
  assumes ‹φ ≡ ψ› and ‹ψ›
  shows ‹φ›
  using "intro-elim:3:a" "Commutativity of ≡" assms by blast
AOT_theorem "intro-elim:3:c":
  assumes ‹φ ≡ ψ› and ‹¬φ›
  shows ‹¬ψ›
  using "intro-elim:3:b" "raa-cor:3" assms by blast
AOT_theorem "intro-elim:3:d":
  assumes ‹φ ≡ ψ› and ‹¬ψ›
  shows ‹¬φ›
  using "intro-elim:3:a" "raa-cor:3" assms by blast
AOT_theorem "intro-elim:3:e":
  assumes ‹φ ≡ ψ› and ‹ψ ≡ χ›
  shows ‹φ ≡ χ›
  by (metis "≡I" "→I" "intro-elim:3:a" "intro-elim:3:b" assms)
declare "intro-elim:3:e"[trans]
AOT_theorem "intro-elim:3:f":
  assumes ‹φ ≡ ψ› and ‹φ ≡ χ›
  shows ‹χ ≡ ψ›
  by (metis "≡I" "→I" "intro-elim:3:a" "intro-elim:3:b" assms)
lemmas "≡E" = "intro-elim:3:a" "intro-elim:3:b" "intro-elim:3:c"
              "intro-elim:3:d" "intro-elim:3:e" "intro-elim:3:f"

declare "Commutativity of ≡"[THEN "≡E"(1), sym]

AOT_theorem "rule-eq-df:1":
  assumes ‹φ ≡_df ψ›
  shows ‹φ ≡ ψ›
  by (simp add: "≡I" "df-rules-formulas[3]" "df-rules-formulas[4]" assms)
lemmas "≡Df" = "rule-eq-df:1"
AOT_theorem "rule-eq-df:2":
  assumes ‹φ ≡_df ψ› and ‹φ›
  shows ‹ψ›
  using "≡Df" "≡E"(1) assms by blast
lemmas "≡_dfE" = "rule-eq-df:2"
AOT_theorem "rule-eq-df:3":
  assumes ‹φ ≡_df ψ› and ‹ψ›
  shows ‹φ›
  using "≡Df" "≡E"(2) assms by blast
lemmas "≡_dfI" = "rule-eq-df:3"

AOT_theorem  "df-simplify:1":
  assumes ‹φ ≡ (ψ & χ)› and ‹ψ›
  shows ‹φ ≡ χ›
  by (metis "&E"(2) "&I" "≡E"(1, 2) "≡I" "→I" assms)
(* Note: this is a slight variation from PLM *)
AOT_theorem  "df-simplify:2":
  assumes ‹φ ≡ (ψ & χ)› and ‹χ›
  shows ‹φ ≡ ψ›
  by (metis "&E"(1) "&I" "≡E"(1, 2) "≡I" "→I" assms)
lemmas "≡S" = "df-simplify:1"  "df-simplify:2"

subsection‹The Theory of Quantification›
text‹\label{PLM: 9.6}›

AOT_theorem "rule-ui:1":
  assumes ‹∀α φ{α}› and ‹τ↓›
  shows ‹φ{τ}›
  using "→E" "cqt:1"[axiom_inst] assms by blast
AOT_theorem "rule-ui:2[const_var]":
  assumes ‹∀α φ{α}›
  shows ‹φ{β}›
  by (simp add: "rule-ui:1" "cqt:2[const_var]"[axiom_inst] assms)
AOT_theorem "rule-ui:2[lambda]":
  assumes ‹∀F φ{F}› and ‹INSTANCE_OF_CQT_2(ψ)›
  shows ‹φ{[λν₁...ν_n ψ{ν₁...ν_n}]}›
  by (simp add: "rule-ui:1" "cqt:2[lambda]"[axiom_inst] assms)
AOT_theorem "rule-ui:3":
  assumes ‹∀α φ{α}›
  shows ‹φ{α}›
  by (simp add: "rule-ui:2[const_var]" assms)
lemmas "∀E" = "rule-ui:1" "rule-ui:2[const_var]"
              "rule-ui:2[lambda]" "rule-ui:3"

AOT_theorem "cqt-orig:1[const_var]": ‹∀α φ{α} → φ{β}›
  by (simp add: "∀E"(2) "→I")
AOT_theorem "cqt-orig:1[lambda]":
  assumes ‹INSTANCE_OF_CQT_2(ψ)›
  shows ‹∀F φ{F} → φ{[λν₁...ν_n ψ{ν₁...ν_n}]}›
  by (simp add: "∀E"(3) "→I" assms)
AOT_theorem "cqt-orig:2": ‹∀α (φ → ψ{α}) → (φ → ∀α ψ{α})›
  by (metis "→I" GEN "vdash-properties:6" "∀E"(4))
AOT_theorem "cqt-orig:3": ‹∀α φ{α} → φ{α}›
  using "cqt-orig:1[const_var]".

AOT_theorem universal:
  assumes ‹for arbitrary β: φ{β}›
  shows ‹∀α φ{α}›
  using GEN assms .
lemmas "∀I" = universal

(* Generalized mechanism for \<forall>I followed by \<forall>E *)
ML‹
  get_instantiated_allI ctxt varname thm = let
  trm = Thm.concl_of thm
  trm =
 case trm of (@{const Trueprop} $ (@{const AOT_model_valid_in} $ _ $ x)) => x
 | _ => raise Term.TERM ("Expected simple theorem.", [trm])
  extractVars (Const (const_name‹AOT_term_of_var›, _) $ Var v) =
 (if fst (fst v) = fst varname then [Var v] else [])
 | extractVars (t1 $ t2) = extractVars t1 @ extractVars t2
 | extractVars (Abs (_, _, t)) = extractVars t
 | extractVars _ = []
  vars = extractVars trm
  vars = fold Term.add_vars vars []
  var = hd vars
  trmty =
 case (snd var) of (Type (type_name‹AOT_var›, [t])) => (t)
 | _ => raise Term.TYPE ("Expected variable type.", [snd var], [Var var])
  trm = Abs (Term.string_of_vname (fst var), trmty, Term.abstract_over (
 Const (const_name‹AOT_term_of_var›, Type ("fun", [snd var, trmty]))
 $ Var var, trm))
  trm = Thm.cterm_of (Context.proof_of ctxt) trm
  ty = hd (Term.add_tvars (Thm.prop_of @{thm "∀I"}) [])
  typ = Thm.ctyp_of (Context.proof_of ctxt) trmty
  allthm = Drule.instantiate_normalize (TVars.make [(ty, typ)], Vars.empty) @{thm "∀I"}
  phi = hd (Term.add_vars (Thm.prop_of allthm) [])
  allthm = Drule.instantiate_normalize (TVars.empty, Vars.make [(phi,trm)]) allthm
 
 
 
 ›

attribute_setup "∀I" =
  ‹Scan.lift (Scan.repeat1 Args.var) >> (fn args => Thm.rule_attribute []
 (fn ctxt => fn thm => fold (fn arg => fn thm =>
 thm RS get_instantiated_allI ctxt arg thm) args thm))›
  "Quantify over a variable in a theorem using GEN."

attribute_setup "unvarify" =
  ‹Scan.lift (Scan.repeat1 Args.var) >> (fn args => Thm.rule_attribute []
 (fn ctxt => fn thm =>
 let
 fun get_inst_allI arg thm = thm RS get_instantiated_allI ctxt arg thm
 val thm = fold get_inst_allI args thm
 val thm = fold (K (fn thm => thm RS @{thm "∀E"(1)})) args thm
 in
 thm
 end))›
  "Generalize a statement about variables to a statement about denoting terms."

(* Note: rereplace-lem does not apply to the embedding *)

AOT_theorem "cqt-basic:1": ‹∀α∀β φ{α,β} ≡ ∀β∀α φ{α,β}›
  by (metis "≡I" "∀E"(2) "∀I" "→I")

AOT_theorem "cqt-basic:2":
  ‹∀α(φ{α} ≡ ψ{α}) ≡ (∀α(φ{α} → ψ{α}) & ∀α(ψ{α} → φ{α}))›
proof (rule "≡I"; rule "→I")
  AOT_assume ‹∀α(φ{α} ≡ ψ{α})›
  AOT_hence ‹φ{α} ≡ ψ{α}› for α using "∀E"(2) by blast
  AOT_hence ‹φ{α} → ψ{α}› and ‹ψ{α} → φ{α}› for α
    using "≡E"(1,2) "→I" by blast+
  AOT_thus ‹∀α(φ{α} → ψ{α}) & ∀α(ψ{α} → φ{α})›
    by (auto intro: "&I" "∀I")
next
  AOT_assume ‹∀α(φ{α} → ψ{α}) & ∀α(ψ{α} → φ{α})›
  AOT_hence ‹φ{α} → ψ{α}› and ‹ψ{α} → φ{α}› for α
    using "∀E"(2) "&E" by blast+
  AOT_hence ‹φ{α} ≡ ψ{α}› for α
    using "≡I" by blast
  AOT_thus ‹∀α(φ{α} ≡ ψ{α})› by (auto intro: "∀I")
qed

AOT_theorem "cqt-basic:3": ‹∀α(φ{α} ≡ ψ{α}) → (∀α φ{α} ≡ ∀α ψ{α})›
proof(rule "→I")
  AOT_assume ‹∀α(φ{α} ≡ ψ{α})›
  AOT_hence 1: ‹φ{α} ≡ ψ{α}› for α using "∀E"(2) by blast
  {
    AOT_assume ‹∀α φ{α}›
    AOT_hence ‹∀α ψ{α}› using 1 "∀I" "∀E"(4) "≡E" by metis
  }
  moreover {
    AOT_assume ‹∀α ψ{α}›
    AOT_hence ‹∀α φ{α}› using 1 "∀I" "∀E"(4) "≡E" by metis
  }
  ultimately AOT_show ‹∀α φ{α} ≡ ∀α ψ{α}›
    using "≡I" "→I" by auto
qed

AOT_theorem "cqt-basic:4": ‹∀α(φ{α} & ψ{α}) → (∀α φ{α} & ∀α ψ{α})›
proof(rule "→I")
  AOT_assume 0: ‹∀α(φ{α} & ψ{α})›
  AOT_have ‹φ{α}› and ‹ψ{α}› for α using "∀E"(2) 0 "&E" by blast+
  AOT_thus ‹∀α φ{α} & ∀α ψ{α}›
    by (auto intro: "∀I" "&I")
qed

AOT_theorem "cqt-basic:5": ‹(∀α₁...∀α_n(φ{α₁...α_n})) → φ{α₁...α_n}›
  using "cqt-orig:3" by blast

AOT_theorem "cqt-basic:6": ‹∀α∀α φ{α} ≡ ∀α φ{α}›
  by (meson "≡I" "→I" GEN "cqt-orig:1[const_var]")

AOT_theorem "cqt-basic:7": ‹(φ → ∀α ψ{α}) ≡ ∀α(φ → ψ{α})›
  by (metis "→I" "vdash-properties:6" "rule-ui:3" "≡I" GEN)

AOT_theorem "cqt-basic:8": ‹(∀α φ{α} ∨ ∀α ψ{α}) → ∀α (φ{α} ∨ ψ{α})›
  by (simp add: "∨I"(3) "→I" GEN "cqt-orig:1[const_var]")

AOT_theorem "cqt-basic:9":
  ‹(∀α (φ{α} → ψ{α}) & ∀α (ψ{α} → χ{α})) → ∀α(φ{α} → χ{α})›
proof -
  {
    AOT_assume ‹∀α (φ{α} → ψ{α})›
    moreover AOT_assume ‹∀α (ψ{α} → χ{α})›
    ultimately AOT_have ‹φ{α} → ψ{α}› and ‹ψ{α} → χ{α}› for α
      using "∀E" by blast+
    AOT_hence ‹φ{α} → χ{α}› for α by (metis "→E" "→I")
    AOT_hence ‹∀α(φ{α} → χ{α})› using "∀I" by fast
  }
  thus ?thesis using "&I" "→I" "&E" by meson
qed

AOT_theorem "cqt-basic:10":
  ‹(∀α(φ{α} ≡ ψ{α}) & ∀α(ψ{α} ≡ χ{α})) → ∀α (φ{α} ≡ χ{α})›
proof(rule "→I"; rule "∀I")
  fix β
  AOT_assume ‹∀α(φ{α} ≡ ψ{α}) & ∀α(ψ{α} ≡ χ{α})›
  AOT_hence ‹φ{β} ≡ ψ{β}› and ‹ψ{β} ≡ χ{β}› using "&E" "∀E" by blast+
  AOT_thus ‹φ{β} ≡ χ{β}› using "≡I" "≡E" by blast
qed

AOT_theorem "cqt-basic:11": ‹∀α(φ{α} ≡ ψ{α}) ≡ ∀α (ψ{α} ≡ φ{α})›
proof (rule "≡I"; rule "→I")
  AOT_assume 0: ‹∀α(φ{α} ≡ ψ{α})›
  {
    fix α
    AOT_have ‹φ{α} ≡ ψ{α}› using 0 "∀E" by blast
    AOT_hence ‹ψ{α} ≡ φ{α}› using "≡I" "≡E" "→I" "→E" by metis
  }
  AOT_thus ‹∀α(ψ{α} ≡ φ{α})› using "∀I" by fast
next
  AOT_assume 0: ‹∀α(ψ{α} ≡ φ{α})›
  {
    fix α
    AOT_have ‹ψ{α} ≡ φ{α}› using 0 "∀E" by blast
    AOT_hence ‹φ{α} ≡ ψ{α}› using "≡I" "≡E" "→I" "→E" by metis
  }
  AOT_thus ‹∀α(φ{α} ≡ ψ{α})› using "∀I" by fast
qed

AOT_theorem "cqt-basic:12": ‹∀α φ{α} → ∀α (ψ{α} → φ{α})›
  by (simp add: "∀E"(2) "→I" GEN)

AOT_theorem "cqt-basic:13": ‹∀α φ{α} ≡ ∀β φ{β}›
  using "≡I" "→I" by blast

AOT_theorem "cqt-basic:14":
  ‹(∀α₁...∀α_n (φ{α₁...α_n} → ψ{α₁...α_n})) →
 ((∀α₁...∀α_n φ{α₁...α_n}) → (∀α₁...∀α_n ψ{α₁...α_n}))›
  using "cqt:3"[axiom_inst] by auto

AOT_theorem "cqt-basic:15":
  ‹(∀α₁...∀α_n (φ → ψ{α₁...α_n})) → (φ → (∀α₁...∀α_n ψ{α₁...α_n}))›
  using "cqt-orig:2" by auto

AOT_theorem "universal-cor":
  assumes ‹for arbitrary β: φ{β}›
  shows ‹∀α φ{α}›
  using GEN assms .

AOT_theorem "existential:1":
  assumes ‹φ{τ}› and ‹τ↓›
  shows ‹∃α φ{α}›
proof(rule "raa-cor:1")
  AOT_assume ‹¬∃α φ{α}›
  AOT_hence ‹∀α ¬φ{α}›
    using "≡_dfI" "conventions:4" RAA "&I" by blast
  AOT_hence ‹¬φ{τ}› using assms(2) "∀E"(1) "→E" by blast
  AOT_thus ‹φ{τ} & ¬φ{τ}› using assms(1) "&I" by blast
qed

AOT_theorem "existential:2[const_var]":
  assumes ‹φ{β}›
  shows ‹∃α φ{α}›
  using "existential:1" "cqt:2[const_var]"[axiom_inst] assms by blast

AOT_theorem "existential:2[lambda]":
  assumes ‹φ{[λν₁...ν_n ψ{ν₁...ν_n}]}› and ‹INSTANCE_OF_CQT_2(ψ)›
  shows ‹∃α φ{α}›
  using "existential:1" "cqt:2[lambda]"[axiom_inst] assms by blast
lemmas "∃I" = "existential:1" "existential:2[const_var]"
              "existential:2[lambda]" 

AOT_theorem "instantiation":
  assumes ‹for arbitrary β: φ{β} \⊨ ψ› and ‹∃α φ{α}›
  shows ‹ψ›
  by (metis (no_types, lifting) "≡_dfE" GEN "raa-cor:3" "conventions:4" assms)
lemmas "∃E" = "instantiation"

AOT_theorem "cqt-further:1": ‹∀α φ{α} → ∃α φ{α}›
  using "∀E"(4) "∃I"(2) "→I" by metis

AOT_theorem "cqt-further:2": ‹¬∀α φ{α} → ∃α ¬φ{α}›
  using "∀I" "∃I"(2) "→I" RAA by metis

AOT_theorem "cqt-further:3": ‹∀α φ{α} ≡ ¬∃α ¬φ{α}›
  using "∀E"(4) "∃E" "→I" RAA
  by (metis "cqt-further:2" "≡I" "modus-tollens:1")

AOT_theorem "cqt-further:4": ‹¬∃α φ{α} → ∀α ¬φ{α}›
  using "∀I" "∃I"(2)"→I" RAA by metis

AOT_theorem "cqt-further:5": ‹∃α (φ{α} & ψ{α}) → (∃α φ{α} & ∃α ψ{α})›
  by (metis (no_types, lifting) "&E" "&I" "∃E" "∃I"(2) "→I")

AOT_theorem "cqt-further:6": ‹∃α (φ{α} ∨ ψ{α}) → (∃α φ{α} ∨ ∃α ψ{α})›
  by (metis (mono_tags, lifting) "∃E" "∃I"(2) "∨E"(3) "∨I"(1, 2) "→I" RAA(2))

(* NOTE: vacuous in the embedding *)
AOT_theorem "cqt-further:7": ‹∃α φ{α} ≡ ∃β φ{β}›
  by (simp add: "oth-class-taut:3:a")

AOT_theorem "cqt-further:8":
  ‹(∀α φ{α} & ∀α ψ{α}) → ∀α (φ{α} ≡ ψ{α})›
  by (metis (mono_tags, lifting) "&E" "≡I" "∀E"(2) "→I" GEN)

AOT_theorem "cqt-further:9":
  ‹(¬∃α φ{α} & ¬∃α ψ{α}) → ∀α (φ{α} ≡ ψ{α})›
  by (metis (mono_tags, lifting) "&E" "≡I" "∃I"(2) "→I" GEN "raa-cor:4")

AOT_theorem "cqt-further:10":
  ‹(∃α φ{α} & ¬∃α ψ{α}) → ¬∀α (φ{α} ≡ ψ{α})›
proof(rule "→I"; rule "raa-cor:2")
  AOT_assume 0: ‹∃α φ{α} & ¬∃α ψ{α}›
  then AOT_obtain α where ‹φ{α}› using "∃E" "&E"(1) by metis
  moreover AOT_assume ‹∀α (φ{α} ≡ ψ{α})›
  ultimately AOT_have ‹ψ{α}› using "∀E"(4) "≡E"(1) by blast
  AOT_hence ‹∃α ψ{α}› using "∃I" by blast
  AOT_thus ‹∃α ψ{α} & ¬∃α ψ{α}› using 0 "&E"(2) "&I" by blast
qed

AOT_theorem "cqt-further:11": ‹∃α∃β φ{α,β} ≡ ∃β∃α φ{α,β}›
  using "≡I" "→I" "∃I"(2) "∃E" by metis

subsection‹Logical Existence, Identity, and Truth›
text‹\label{PLM: 9.7}›

AOT_theorem "log-prop-prop:1": ‹[λ φ]↓›
  using "cqt:2[lambda0]"[axiom_inst] by auto

AOT_theorem "log-prop-prop:2": ‹φ↓›
  by (rule "≡_dfI"[OF "existence:3"]) "cqt:2[lambda]"

AOT_theorem "exist-nec": ‹τ↓ → ◻τ↓›
proof -
  AOT_have ‹∀β ◻β↓›
    by (simp add: GEN RN "cqt:2[const_var]"[axiom_inst])
  AOT_thus ‹τ↓ → ◻τ↓›
    using "cqt:1"[axiom_inst] "→E" by blast
qed

(* TODO: replace this mechanism by a "proof by types" command *)
class AOT_Term_id = AOT_Term +
  assumes "t=t-proper:1"[AOT]: ‹[v ⊨ τ = τ' → τ↓]›
      and "t=t-proper:2"[AOT]: ‹[v ⊨ τ = τ' → τ'↓]›

instance κ :: AOT_Term_id
proof
  AOT_modally_strict {
    AOT_show ‹κ = κ' → κ↓› for κ κ'
    proof(rule "→I")
      AOT_assume ‹κ = κ'›
      AOT_hence ‹O!κ ∨ A!κ›
        by (rule "∨I"(3)[OF "≡_dfE"[OF "identity:1"]])
           (meson "→I" "∨I"(1) "&E"(1))+
      AOT_thus ‹κ↓›
        by (rule "∨E"(1))
           (metis "cqt:5:a"[axiom_inst] "→I" "→E" "&E"(2))+
    qed
  }
next
  AOT_modally_strict {
    AOT_show ‹κ = κ' → κ'↓› for κ κ'
    proof(rule "→I")
      AOT_assume ‹κ = κ'›
      AOT_hence ‹O!κ' ∨ A!κ'›
        by (rule "∨I"(3)[OF "≡_dfE"[OF "identity:1"]])
           (meson "→I" "∨I" "&E")+
      AOT_thus ‹κ'↓›
        by (rule "∨E"(1))
           (metis "cqt:5:a"[axiom_inst] "→I" "→E" "&E"(2))+
    qed
  }
qed

instance rel :: (AOT_κs) AOT_Term_id
proof
  AOT_modally_strict {
    AOT_show ‹Π = Π' → Π↓› for Π Π' :: ‹<'a>›
    proof(rule "→I")
      AOT_assume ‹Π = Π'›
      AOT_thus ‹Π↓› using "≡_dfE"[OF "identity:3"[of Π Π']] "&E" by blast
    qed
  }
next
  AOT_modally_strict {
    AOT_show ‹Π = Π' → Π'↓› for Π Π' :: ‹<'a>›
    proof(rule "→I")
      AOT_assume ‹Π = Π'›
      AOT_thus ‹Π'↓› using "≡_dfE"[OF "identity:3"[of Π Π']] "&E" by blast
    qed
  }
qed

instance o :: AOT_Term_id
proof
  AOT_modally_strict {
    fix φ ψ
    AOT_show ‹φ = ψ → φ↓›
    proof(rule "→I")
      AOT_assume ‹φ = ψ›
      AOT_thus ‹φ↓› using "≡_dfE"[OF "identity:4"[of φ ψ]] "&E" by blast
    qed
  }
next
  AOT_modally_strict {
    fix φ ψ
    AOT_show ‹φ = ψ → ψ↓›
    proof(rule "→I")
      AOT_assume ‹φ = ψ›
      AOT_thus ‹ψ↓› using "≡_dfE"[OF "identity:4"[of φ ψ]] "&E" by blast
    qed
  }
qed

instance prod :: (AOT_Term_id, AOT_Term_id) AOT_Term_id
proof
  AOT_modally_strict {
    fix τ τ' :: ‹'a×'b›
    AOT_show ‹τ = τ' → τ↓›
    proof (induct τ; induct τ'; rule "→I")
      fix τ₁ τ₁' :: 'a and τ₂  τ₂' :: 'b
      AOT_assume ‹«(τ₁, τ₂)¬ = «(τ₁', τ₂')¬›
      AOT_hence ‹(τ₁ = τ₁') & (τ₂ = τ₂')› by (metis "≡_dfE" tuple_identity_1)
      AOT_hence ‹τ₁↓› and ‹τ₂↓›
        using "t=t-proper:1" "&E" "vdash-properties:10" by blast+
      AOT_thus ‹«(τ₁, τ₂)¬↓› by (metis "≡_dfI" "&I" tuple_denotes)
    qed
  }
next
  AOT_modally_strict {
    fix τ τ' :: ‹'a×'b›
    AOT_show ‹τ = τ' → τ'↓›
    proof (induct τ; induct τ'; rule "→I")
      fix τ₁ τ₁' :: 'a and τ₂  τ₂' :: 'b
      AOT_assume ‹«(τ₁, τ₂)¬ = «(τ₁', τ₂')¬›
      AOT_hence ‹(τ₁ = τ₁') & (τ₂ = τ₂')› by (metis "≡_dfE" tuple_identity_1)
      AOT_hence ‹τ₁'↓› and ‹τ₂'↓›
        using "t=t-proper:2" "&E" "vdash-properties:10" by blast+
      AOT_thus ‹«(τ₁', τ₂')¬↓› by (metis "≡_dfI" "&I" tuple_denotes)
    qed
  }
qed

(* This is the end of the "proof by types" and
   makes the results available on new theorems *)
AOT_register_type_constraints
  Term: ‹_::AOT_Term_id› ‹_::AOT_Term_id›
AOT_register_type_constraints
  Individual: ‹κ› ‹_::{AOT_κs, AOT_Term_id}›
AOT_register_type_constraints
  Relation: ‹<_::{AOT_κs, AOT_Term_id}>›

AOT_theorem "id-rel-nec-equiv:1":
  ‹Π = Π' → ◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π']x₁...x_n)›
proof(rule "→I")
  AOT_assume assumption: ‹Π = Π'›
  AOT_hence ‹Π↓› and ‹Π'↓›
    using "t=t-proper:1" "t=t-proper:2" MP by blast+
  moreover AOT_have ‹∀F∀G (F = G → ((◻∀x₁...∀x_n ([F]x₁...x_n ≡ [F]x₁...x_n)) →
 ◻∀x₁...∀x_n ([F]x₁...x_n ≡ [G]x₁...x_n)))›
    apply (rule GEN)+ using "l-identity"[axiom_inst] by force
  ultimately AOT_have ‹Π = Π' → ((◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π]x₁...x_n)) →
 ◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π']x₁...x_n))›
    using "∀E"(1) by blast
  AOT_hence ‹(◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π]x₁...x_n)) →
 ◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π']x₁...x_n)›
    using assumption "→E" by blast
  moreover AOT_have ‹◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π]x₁...x_n)›
    by (simp add: RN "oth-class-taut:3:a" "universal-cor")
  ultimately AOT_show ‹◻∀x₁...∀x_n ([Π]x₁...x_n ≡ [Π']x₁...x_n)›
    using "→E" by blast
qed

AOT_theorem "id-rel-nec-equiv:2": ‹φ = ψ → ◻(φ ≡ ψ)›
proof(rule "→I")
  AOT_assume assumption: ‹φ = ψ›
  AOT_hence ‹φ↓› and ‹ψ↓›
    using "t=t-proper:1" "t=t-proper:2" MP by blast+
  moreover AOT_have ‹∀p∀q (p = q → ((◻(p ≡ p) → ◻(p ≡ q))))›
    apply (rule GEN)+ using "l-identity"[axiom_inst] by force
  ultimately AOT_have ‹φ = ψ → (◻(φ ≡ φ) → ◻(φ ≡ ψ))›
    using "∀E"(1) by blast
  AOT_hence ‹◻(φ ≡ φ) → ◻(φ ≡ ψ)›
    using assumption "→E" by blast
  moreover AOT_have ‹◻(φ ≡ φ)›
    by (simp add: RN "oth-class-taut:3:a" "universal-cor")
  ultimately AOT_show ‹◻(φ ≡ ψ)›
    using "→E" by blast
qed

AOT_theorem "rule=E":
  assumes ‹φ{τ}› and ‹τ = σ›
  shows ‹φ{σ}›
proof -
  AOT_have ‹τ↓› and ‹σ↓›
    using assms(2) "t=t-proper:1" "t=t-proper:2" "→E" by blast+
  moreover AOT_have ‹∀α∀β(α = β → (φ{α} → φ{β}))›
    apply (rule GEN)+ using "l-identity"[axiom_inst] by blast
  ultimately AOT_have ‹τ = σ → (φ{τ} → φ{σ})›
    using "∀E"(1) by blast
  AOT_thus ‹φ{σ}› using assms "→E" by blast
qed

AOT_theorem "propositions-lemma:1": ‹[λ φ] = φ›
proof -
  AOT_have ‹φ↓› by (simp add: "log-prop-prop:2")
  moreover AOT_have ‹∀p [λ p] = p›
    using "lambda-predicates:3[zero]"[axiom_inst] "∀I" by fast
  ultimately AOT_show ‹[λ φ] = φ›
    using "∀E" by blast
qed

AOT_theorem "propositions-lemma:2": ‹[λ φ] ≡ φ›
proof -
  AOT_have ‹[λ φ] ≡ [λ φ]› by (simp add: "oth-class-taut:3:a")
  AOT_thus ‹[λ φ] ≡ φ› using "propositions-lemma:1" "rule=E" by blast
qed

text‹propositions-lemma:3 through propositions-lemma:5 hold implicitly›

AOT_theorem "propositions-lemma:6": ‹(φ ≡ ψ) ≡ ([λ φ] ≡ [λ ψ])›
  by (metis "≡E"(1) "≡E"(5) "Associativity of ≡" "propositions-lemma:2")

text‹dr-alphabetic-rules holds implicitly›

AOT_theorem "oa-exist:1": ‹O!↓›
proof -
  AOT_have ‹[λx ♢[E!]x]↓› by "cqt:2[lambda]"
  AOT_hence 1: ‹O! = [λx ♢[E!]x]›
    using "df-rules-terms[4]"[OF "oa:1", THEN "&E"(1)] "→E" by blast
  AOT_show ‹O!↓› using "t=t-proper:1"[THEN "→E", OF 1] by simp
qed

AOT_theorem "oa-exist:2": ‹A!↓›
proof -
  AOT_have ‹[λx ¬♢[E!]x]↓› by "cqt:2[lambda]"
  AOT_hence 1: ‹A! = [λx ¬♢[E!]x]›
    using "df-rules-terms[4]"[OF "oa:2", THEN "&E"(1)] "→E" by blast
  AOT_show ‹A!↓› using "t=t-proper:1"[THEN "→E", OF 1] by simp
qed

AOT_theorem "oa-exist:3": ‹O!x ∨ A!x›
proof(rule "raa-cor:1")
  AOT_assume ‹¬(O!x ∨ A!x)›
  AOT_hence A: ‹¬O!x› and B: ‹¬A!x›
    using "Disjunction Addition"(1) "modus-tollens:1"
          "∨I"(2) "raa-cor:5" by blast+
  AOT_have C: ‹O! = [λx ♢[E!]x]›
    by (rule "df-rules-terms[4]"[OF "oa:1", THEN "&E"(1), THEN "→E"]) "cqt:2"
  AOT_have D: ‹A! = [λx ¬♢[E!]x]›
    by (rule "df-rules-terms[4]"[OF "oa:2", THEN "&E"(1), THEN "→E"]) "cqt:2"
  AOT_have E: ‹¬[λx ♢[E!]x]x›
    using A C "rule=E" by fast
  AOT_have F: ‹¬[λx ¬♢[E!]x]x›
    using B D "rule=E" by fast
  AOT_have G: ‹[λx ♢[E!]x]x ≡ ♢[E!]x›
    by (rule "lambda-predicates:2"[axiom_inst, THEN "→E"]) "cqt:2"
  AOT_have H: ‹[λx ¬♢[E!]x]x ≡ ¬♢[E!]x›
    by (rule "lambda-predicates:2"[axiom_inst, THEN "→E"]) "cqt:2"
  AOT_show ‹¬♢[E!]x & ¬¬♢[E!]x› using G E "≡E" H F "≡E" "&I"> by metis
qed

AOT_theorem "p-identity-thm2:1": ‹F = G ≡ ◻∀x(x[F] ≡ x[G])›
proof -
  AOT_have ‹F = G ≡ F↓ & G↓ & ◻∀x(x[F] ≡ x[G])›
    using "identity:2" "df-rules-formulas[3]" "df-rules-formulas[4]"
          "→E" "&E" "≡I" "→I" by blast
  moreover AOT_have ‹F↓› and ‹G↓›
    by (auto simp: "cqt:2[const_var]"[axiom_inst])
  ultimately AOT_show ‹F = G ≡ ◻∀x(x[F] ≡ x[G])›
    using "≡S"(1) "&I" by blast
qed

AOT_theorem "p-identity-thm2:2[2]":
  ‹F = G ≡ ∀y₁([λx [F]xy₁] = [λx [G]xy₁] & [λx [F]y₁x] = [λx [G]y₁x])›
proof -
  AOT_have ‹F = G ≡ F↓ & G↓ &
 ∀y₁([λx [F]xy₁] = [λx [G]xy₁] & [λx [F]y₁x] = [λx [G]y₁x])›
    using "identity:3[2]" "df-rules-formulas[3]" "df-rules-formulas[4]"
          "→E" "&E" "≡I" "→I" by blast
  moreover AOT_have ‹F↓› and ‹G↓›
    by (auto simp: "cqt:2[const_var]"[axiom_inst])
  ultimately show ?thesis
    using "≡S"(1) "&I" by blast
qed
    
AOT_theorem "p-identity-thm2:2[3]":
  ‹F = G ≡ ∀y₁∀y₂([λx [F]xy₁y₂] = [λx [G]xy₁y₂] &
 [λx [F]y₁xy₂] = [λx [G]y₁xy₂] &
 [λx [F]y₁y₂x] = [λx [G]y₁y₂x])›
proof -
  AOT_have ‹F = G ≡ F↓ & G↓ & ∀y₁∀y₂([λx [F]xy₁y₂] = [λx [G]xy₁y₂] &
 [λx [F]y₁xy₂] = [λx [G]y₁xy₂] &
 [λx [F]y₁y₂x] = [λx [G]y₁y₂x])›
    using "identity:3[3]" "df-rules-formulas[3]" "df-rules-formulas[4]"
          "→E" "&E" "≡I" "→I" by blast
  moreover AOT_have ‹F↓› and ‹G↓›
    by (auto simp: "cqt:2[const_var]"[axiom_inst])
  ultimately show ?thesis
    using "≡S"(1) "&I" by blast
qed

AOT_theorem "p-identity-thm2:2[4]":
  ‹F = G ≡ ∀y₁∀y₂∀y₃([λx [F]xy₁y₂y₃] = [λx [G]xy₁y₂y₃] &
 [λx [F]y₁xy₂y₃] = [λx [G]y₁xy₂y₃] &
 [λx [F]y₁y₂xy₃] = [λx [G]y₁y₂xy₃] &
 [λx [F]y₁y₂y₃x] = [λx [G]y₁y₂y₃x])›
proof -
  AOT_have ‹F = G ≡ F↓ & G↓ & ∀y₁∀y₂∀y₃([λx [F]xy₁y₂y₃] = [λx [G]xy₁y₂y₃] &
 [λx [F]y₁xy₂y₃] = [λx [G]y₁xy₂y₃] &
 [λx [F]y₁y₂xy₃] = [λx [G]y₁y₂xy₃] &
 [λx [F]y₁y₂y₃x] = [λx [G]y₁y₂y₃x])›
    using "identity:3[4]" "df-rules-formulas[3]" "df-rules-formulas[4]"
          "→E" "&E" "≡I" "→I" by blast
  moreover AOT_have ‹F↓› and ‹G↓›
    by (auto simp: "cqt:2[const_var]"[axiom_inst])
  ultimately show ?thesis
    using "≡S"(1) "&I" by blast
qed

AOT_theorem "p-identity-thm2:2":
  ‹F = G ≡ ∀x₁...∀x_n «AOT_sem_proj_id x₁x_n (λ τ . «[F]τ¬) (λ τ . «[G]τ¬)¬›
proof -
  AOT_have ‹F = G ≡ F↓ & G↓ &
 ∀x₁...∀x_n «AOT_sem_proj_id x₁x_n (λ τ . «[F]τ¬) (λ τ . «[G]τ¬)¬›
    using "identity:3" "df-rules-formulas[3]" "df-rules-formulas[4]"
          "→E" "&E" "≡I" "→I" by blast
  moreover AOT_have ‹F↓› and ‹G↓›
    by (auto simp: "cqt:2[const_var]"[axiom_inst])
  ultimately show ?thesis
    using "≡S"(1) "&I" by blast
qed

AOT_theorem "p-identity-thm2:3":
  ‹p = q ≡ [λx p] = [λx q]›
proof -
  AOT_have ‹p = q ≡ p↓ & q↓ & [λx p] = [λx q]›
    using "identity:4" "df-rules-formulas[3]" "df-rules-formulas[4]"
          "→E" "&E" "≡I" "→I" by blast
  moreover AOT_have ‹p↓› and ‹q↓›
    by (auto simp: "cqt:2[const_var]"[axiom_inst])
  ultimately show ?thesis
    using "≡S"(1) "&I" by blast
qed

class AOT_Term_id_2 = AOT_Term_id + assumes "id-eq:1": ‹[v ⊨ α = α]›

instance κ :: AOT_Term_id_2
proof
  AOT_modally_strict {
    fix x
    {
      AOT_assume ‹O!x›
      moreover AOT_have ‹◻∀F([F]x ≡ [F]x)›
        using RN GEN "oth-class-taut:3:a" by fast
      ultimately AOT_have ‹O!x & O!x & ◻∀F([F]x ≡ [F]x)› using "&I" by simp
    }
    moreover {
      AOT_assume ‹A!x›
      moreover AOT_have ‹◻∀F(x[F] ≡ x[F])›
        using RN GEN "oth-class-taut:3:a" by fast
      ultimately AOT_have ‹A!x & A!x & ◻∀F(x[F] ≡ x[F])› using "&I" by simp
    }
    ultimately AOT_have ‹(O!x & O!x & ◻∀F([F]x ≡ [F]x)) ∨
 (A!x & A!x & ◻∀F(x[F] ≡ x[F]))›
      using "oa-exist:3" "∨I"(1) "∨I"(2) "∨E"(3) "raa-cor:1" by blast
    AOT_thus ‹x = x›
      using "identity:1"[THEN "df-rules-formulas[4]"] "→E" by blast
  }
qed

instance rel :: ("{AOT_κs,AOT_Term_id_2}") AOT_Term_id_2
proof
  AOT_modally_strict {
    fix F :: "<'a> AOT_var"
    AOT_have 0: ‹[λx₁...x_n [F]x₁...x_n] = F›
      by (simp add: "lambda-predicates:3"[axiom_inst])
    AOT_have ‹[λx₁...x_n [F]x₁...x_n]↓›
      by "cqt:2[lambda]"
    AOT_hence ‹[λx₁...x_n [F]x₁...x_n] = [λx₁...x_n [F]x₁...x_n]›
      using "lambda-predicates:1"[axiom_inst] "→E" by blast
    AOT_show ‹F = F› using "rule=E" 0 by force 
  }
qed

instance o :: AOT_Term_id_2
proof
  AOT_modally_strict {
    fix p
    AOT_have 0: ‹[λ p] = p›
      by (simp add: "lambda-predicates:3[zero]"[axiom_inst])
    AOT_have ‹[λ p]↓›
      by (rule "cqt:2[lambda0]"[axiom_inst])
    AOT_hence ‹[λ p] = [λ p]›
      using "lambda-predicates:1[zero]"[axiom_inst] "→E" by blast
    AOT_show ‹p = p› using "rule=E" 0 by force
  }
qed

instance prod :: (AOT_Term_id_2, AOT_Term_id_2) AOT_Term_id_2
proof
  AOT_modally_strict {
    fix α :: ‹('a×'b) AOT_var›
    AOT_show ‹α = α›
    proof (induct)
      AOT_show ‹τ = τ› if ‹τ↓› for τ :: ‹'a×'b›
        using that
      proof (induct τ)
        fix τ₁ :: 'a and τ₂ :: 'b
        AOT_assume ‹«(τ₁,τ₂)¬↓›
        AOT_hence ‹τ₁↓› and ‹τ₂↓›
          using "≡_dfE" "&E" tuple_denotes by blast+
        AOT_hence ‹τ₁ = τ₁› and ‹τ₂ = τ₂›
          using "id-eq:1"[unvarify α] by blast+
        AOT_thus ‹«(τ₁, τ₂)¬ = «(τ₁, τ₂)¬›
          by (metis "≡_dfI" "&I" tuple_identity_1)
      qed
    qed
  }
qed

AOT_register_type_constraints
  Term: ‹_::AOT_Term_id_2› ‹_::AOT_Term_id_2›
AOT_register_type_constraints
  Individual: ‹κ› ‹_::{AOT_κs, AOT_Term_id_2}›
AOT_register_type_constraints
  Relation: ‹<_::{AOT_κs, AOT_Term_id_2}>›

AOT_theorem "id-eq:2": ‹α = β → β = α›
  by (meson "rule=E" "deduction-theorem")

AOT_theorem "id-eq:3": ‹α = β & β = γ → α = γ›
  using "rule=E" "→I" "&E" by blast

AOT_theorem "id-eq:4": ‹α = β ≡ ∀γ (α = γ ≡ β = γ)›
proof (rule "≡I"; rule "→I")
  AOT_assume 0: ‹α = β›
  AOT_hence 1: ‹β = α› using "id-eq:2" "→E" by blast
  AOT_show ‹∀γ (α = γ ≡ β = γ)›
    by (rule GEN) (metis "≡I" "→I" 0 "1" "rule=E")
next
  AOT_assume ‹∀γ (α = γ ≡ β = γ)›
  AOT_hence ‹α = α ≡ β = α› using "∀E"(2) by blast
  AOT_hence ‹α = α → β = α› using "≡E"(1) "→I" by blast
  AOT_hence ‹β = α› using "id-eq:1" "→E" by blast
  AOT_thus ‹α = β› using "id-eq:2" "→E" by blast
qed

AOT_theorem "rule=I:1":
   java.lang.StringIndexOutOfBoundsException: Range [17, 16) out of bounds for length 38
  java.lang.StringIndexOutOfBoundsException: Range [8, 7) out of bounds for length 38
proof
  java.lang.StringIndexOutOfBoundsException: Range [12, 10) out of bounds for length 65
    by (rule GEN) (metis "id-eq:1")
  AOT_thus \openτ = τ using assms "\<ll 
qed

AOT_theorem "rule=I[java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 56
  using "id-eq:1".

AOT_theorem "l=:[aba:
  assumes ‹)<close>
  shows " \lν₁...ν_n φ{ν₁...ν_n}] = [λν₁...ν_n φ{ν₁...ν_n}]"
  -
 AOT_have ‹∀α (α = α)›
 by (rule GEN) (metis "id-eq:1")
 moreover AOT_have ‹[λν₁...ν_n φ{ν₁...ν_n}]↓›
 using assms by (rule "cqt:2[lambda]"[axiom_inst])
 ultimately AOT_show ‹[λν₁...ν_n φ{ν₁...ν_n}] = [λν₁...ν_n φ{ν₁...ν_n}]›
 using assms "∀E" by blast
 

  "=I" = "rule=I:1" "rule=I:2[const_var]" "rule=I:2[lambda]"

  "rule-id-df:1":
 assumes ‹τ{α₁...α_n} =_df σ{α₁...α_n}› and ‹σ{τ₁...τ_n}↓›
 shows ‹τ{τ₁...τ_n} = σ{τ₁...τ_n}›
  -
 AOT_have ‹σ{τ₁...τ_n}↓ → τ{τ₁...τ_n} = σ{τ₁...τ_n}›
 using "df-rules-terms[3]" assms(1) "&E" by blast
 AOT_thus ‹τ{τ₁...τ_n} = σ{τ₁...τ_n}›
 using assms(2) "→E" by blast
 

  "rule-id-df:1[zero]":
 assumes ‹τ =_df σ› and ‹σ↓›
 shows ‹τ = σ›
  -
 AOT_have ‹σ↓ → τ = σ›
 using "df-rules-terms[4]" assms(1) "&E" by blast
 AOT_thus ‹τ = σ›
 using assms(2) "→E" by blast
 

  "rule-id-df:2:a":
java.lang.NullPointerException
 lemma subst_v_flip_eq_three:
  -
  \openτ{τ1...τ_n} = σ{τ₁...τ_n}› using "rule-id-df:1" assms(1,2) by blast
 AOT_thus ‹φ{σ{τ₁...τ_n}}› using assms(3) "rule=E" by blast
 

  "rule-id-df:2:a[2]":
 assumes ‹τ{«(α₁,α₂)¬} =_df σ{«(α₁,α_proof -
 and ‹σ{«(τ₁,τ₂)¬}↓›
  \open>φ>(τ,\<\>}}🚫
 shows ‹φ{σ{«(τ₁::'a::AOT_Term_id_2,τ₂::'b::AOT_Term_id_2)¬}}›
  -
 AOT_have ‹τ{«(τ₁,τ₂)¬} = σ{«(τ₁,τ₂)¬}›
 using "rule-id-df:1" assms(1,2) by auto
 AOT_thus ‹φ{σ{«(τ₁,τ₂)¬}}› using assms(3) "rule=E" by blast
 

  "rule-id-df:2:a[zero]":
 assumes ‹τ =_dby (sim add: supp_at_base |mtis b.suppsupp_b_em )+
 shows ‹φ{σ}›
  -
 AOT_have ‹τ = σ› using "rule-id-df:1[zeroy (induct tm rule: v.induct) (simp_all add: fresh_at_base)
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 

  "=\<^lemma t:v

  "rule-id-df:2:b":
 assumes ‹τ "a"atom x 🚫
 shows ‹φ{τ{τ₁...τ_n}}›
  -
 AOT_have ‹τ{τ₁...τ_n} = σ{τ₁...τwher
 using "rule-id-df:1" assms(1,2) by blast
 AOT_hence ‹σ{τ₁...τ_n}
 using "rule=E" "=I"(1) "t=t-proper:1" "→E" by fast
java.lang.NullPointerException
 

  "rule-id-df:2:b[2]":
 assumes ‹τ{«by (auto simp: fresh_at_base)
 and ‹σ
 and ‹φ{σ{«(τ₁,τ avo: r: e.trong_indu) (auto si: fresh)
 shows ‹φ{τ{« Ai x ) =((tom i \sharpA \and j \sharp>A r>A ∨
  -
 AOT_have ‹τ{«(τ₁,τ₂)¬} = σ{«(τ₁,τ₂)¬}›
 using "=I"(1) "rule-id-df:2:a[2]" RAA(1) assms(1,2) "→I" by metis
 AOT_hence ‹apply m
 using "rule=E" "=I"(1) "t=t-proper:1" "→E" by fast
 AOT_thus ‹
 

  "rule-id-df:2:b[zero]":
 assumes ‹τ =_df σ› and ‹
 shows ‹φ{τ}›
 
 AOT_have ‹τ = σ› using "rule-id-df:1[zero]" assms(1,2) by blast
 AOT_hence ‹σ = τ›appl (sim ad subst_)
 using "rule=E" "=I"(1) "t=t-proper:1" "→E" by fast
 AOT_thus ‹φ{τ}› using assms(3) "rule=E" by blast
 

java.lang.NullPointerException

  "free-thms:1": ‹τ↓ ≡ ∃β (β = τ)› flip_dfby (si add:flip_d permute_)+
  (metis"🚫

  "free-thms:2": ‹∀α φ show ?thesis b aut
 by (metis "∃E" "rule=E" "cqt:2[const_var]"[axiom_inst] "→:

  "free-thms:3[const_var]": ‹∃β (β = α)›
 by (meson "∃I"(2) "id-eq:1")

  "free-thms:3[lambda]":
 assumes ‹
 shows ‹∃
 by (meson "=I"(3) assms "cqt:2[lambda]"[axiom_inst] "existential:1")

 -tms:4[rel]":
 ‹([Π]κ₁...κ_n ∨ κ₁...κ_n[Π]) → ∃β (β = Π)›
 by (metis "rule=I:1" "&E"(1) "∨E"(1) "cqt:5:a"[axiom_inst]
 "cqt:5:b"[axiom_inst] "→I" "∃I"(1))

  "free-thms:4[vars]":
java.lang.NullPointerException
 by (metis "rule=I:1" "&E"(2) "∨E"(1) "cqt:5:a"[axiom_inst]
 "cqt:5:b"[axiom_inst] "→I" "∃I"(1))

  "free-thms:4[1,rel]":
 ‹([Π]κ:x and tm::e
 by (metis "rule=I:1" "&E"(1) "∨E"(1) "cqt:5:a"[axiom_inst]
 cqt:5:b"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[1,1]":
 ‹([Π]κ ∨ κ[Π🚫
 by (metis "rule=I:1" "&E"(2) "∨E"(1) "cqt:5:a"[axiom_inst]
 ">I" "∃

  "free-thms:4[2,rel]":
 ‹([Π]κ₁κ₂ ∨ κ₁κ_:eqvt_def subst_,auto
 by (metis "rule=I:1" "&E"(1) "∨E"(1) "cqt:5:a[2]"[axiom_inst]
 "cqt:5:b[2]"[axiom_inst] "→I" "∃I"(1))
 -thms:4[2,1]":
 ‹([Π]κ₁κ₂ ∨ κ :: "ce \Right> x →o>_[_::=_]_cev› [1000,50,50] 500)
 by (metis "rule=I:1" "&E" "∨E"(1) "cqt:5:a[2]"[axiom_inst]
 "cqt:5:b[2]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[2,2]":
 ‹
  (metis "rule=I:1" "&E"(2) "∨E"(1) "cqt:5:a[2]"[axiom_inst]
 "cqt:5:b[2]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[3,rel]":
java.lang.NullPointerException
  (mtis "rule=I:1" "&E"(1) "∨E"(1) "cqt:5:a[3]"[axiom_inst]
 "cqt:5:b[3]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[3,1]":
 ‹([Π]κ₁κ₂κ₃ ∨
 by (metis "rule=I:1" "&E" "∨E"(1) "cqt:5:a[3]"[axiom_inst]
 →I" "∃I"(1))
  "free-thms:4[3,2]":
 ‹([Π]κ₍ubst_cev A i x ) = ((atom i ♯ A ∧ j ♯ A) ∨ (j ♯ x ∧ (j ♯ce.strong_)
 by (metis "rule=I:1" "&E" "∨E"(1) "cqt:5:a[3]"[axis e.supp pure_fresh opp.fresh
 "cqt:5:b[3]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4qed(auto)+
 ‹([Π]κ_[simp]:
 by (metis "rule=I:1" "&E"(2) "∨subst_cev A A i t ) j u) = subst_cev A i (sbst_vv t j u )"
 "cqt:5:b[3]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[4,rel]":
java.lang.NullPointerException
 by (metis "rule=I:1" "&E"(1) "∨E"(1) "cqt:5:a[4]"[axiom_inst]
 "cqt:5:b[4]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[4,1]":
 ‹([Π]κ₁κ₂κ₃κ₄ ∨ κ₁κ₂κ₃κ₄[Π]) → ∃β (β = κce.strong)
 by (metis "rule=I:1" "&E" "∨E"(1) "cqt:5:a[4]"[axiom_inst]
 "cqt:5:b[4]"[axiom_inst] "→I" "∃
java.lang.StringIndexOutOfBoundsException: Range [12, 11) out of bounds for length 31
 \open([Π>_kappa> \or> κ₁κ₂κ₃κ₄[Π]) → ∃β (β = κ₂)›
 by (metis "rule=I:1" "&E" "∨E"(1) "cqt:5:a[4]"[axiom_inst]
 "cqt:5:b[4]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[4,3]":
 ‹([Π]κ₁κ₂κ₃κ₄ ∨ κ₁κ₂κ₃κ₄[Π]) → ∃β (β = κ₃)›
 by (metis "rule=I:1" "&E" "∨E"(1) "cqt:5:a[4]"[axiom_inst]
 "cqt:5:b[4]"[axiom_inst] "→I" "∃I"(1))
  "free-thms:4[4,4]":
 ‹([Π]κ₁κ_{perm_simps} ce.perm_simps permute_pur ce.fresh oppstrong_exhau by presburger
 by (metis "rule=I:1" "&E"(2) "∨E"(1) "cqt:5:a[4]"[axiom_inst]
 cqt:5:b[4]"[axiom_inst] "→I" "∃I"(1))

  "ex:11:":  foral>🚫.= ea[xa::=v']_cev" using subst_ev_var_flip assms by simp
 by (rule GEN) (fact "cqt:2[const_var]"[axiom_inst])
  "ex:1:b": ‹∀α
 by (rule GEN) (fact "free-thms:3[const_var]")

  "ex:2:a": ‹◻and x::x
 by (rule RN) (fact "cqt:2[const_var]"[axiom_inst])
 "ex:2:b": ‹◻∃β(β = α)›
 by (rule RN) (fact "free-thms:3[const_var]")

  "ex:3:a": ‹◻∀α α↓›
 by (rule RN) (fact "ex:1:a")
  "ex:3:b": ‹
 by (rule RN) (fact "ex:1:b")

  "ex:4:a": ‹∀α ◻\Aefinition
 by (rule GEN; rule RN) (fact "cqt:2[const_var]"[axiom_inst])
  "ex:4:b": ‹∀α◻
 by (rule GEN; rule RN) (fact "free-thms:3[const_var]")

  "ex:5:a": ‹◻show "(j ♯ subst_v t i x) = ((atom i ♯ t ∧ j ♯ t) ∨ (j ♯ x ∧ (j ♯ t ∨x subst by met
  (rule RN) simp add:: "e:4:a")
  "ex:5:b show"atom a \sharp> tm \Longrightarrow subst_v tm a x = tm"
 by (rule RN) (simp add: "ex:4:b")

  "all-self=:1": ‹
 by (rule RN; rule GEN) (fact "id-eq:1")
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 by (rule GEN; rule RN) (fact "id-eq:1")

  "id-nec:1": ‹α = β → ◻(α = β)›
 (rule "→I")
 AOT_assume ‹α = β:xand c:ce and z::x
 ‹
 by (rule RN) (fact "id-eq:1")
 ultimately AOT_show ‹◻(α = β)› using "rule=E" by fast
 

  "id-nec:2": ‹τ = σ → ◻(τ = σ)›
 (rule "→I")
 AOT_assume asm: ‹τ = σ›
 moreover AOT_have ‹τ↓›
 using calculation "t=t-proper:1" "→E" by blast
 moreover AOT_have ‹◻(τ
 using calculation "all-self=:2" "∀E"(1) by blast
 ultimately AOT_show ‹
 

 out:1": \open<{>} \equiv>  β>& \ph>{\beta>}) 
  (rule "≡I"; rule "→I")
 AOT_assume asm: ‹φ{α}›
 AOT_show ‹∃z::=w]\^>c ssub>e_v) z w "
 by (rule "∃I"(2)[where β=α]; rule "&I")
 (auto simp: "id-eq:1" asm)
 
 AOT_assume 0: ‹∃β (β = α & φ{β})›
 AOT_obtain β where ‹
 using "∃E"[rotated, OF 0] by blast
 AOT_thusfi e::ce
 

  "term-out:2": shows"(z1 ↔ z1') ∙ e[z::=v]_cev = e[z::= ((z1 ↔ z1') ∙ v)]_ce(ominal_indu e ru:ce.strong_induct)
 (rule "→I")
 AOT_assume ‹τsection ‹
 moreover AOT_have ‹∀\Rig> v 🚫
 \>s A ix ) 🚫
java.lang.StringIndexOutOfBoundsException: Range [23, 22) out of bounds for length 66
 using "∀E" by blast
 

  "term-out:3":
 ‹(φ{α} & ∀β(φ{β} → β = α)) ≡ ∀β(φ{
 apply (rule "≡I"; rule "→I")
java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 24
 apply (drule "&E"(2))
 apply (rule GEN; rule "≡I"; rule "→I")
 using "rule-ui:2[const_var]" "vdash-properties:5"
 apply blast
 apply (meson "rule=E" "id-eq:1")
 apply (rule "&I")
 using "id-eq:1" "≡E"(2) "rule-ui:3"
 apply blast
 apply (rule GEN; rule "→I")
 ) "rule-ui:-ui:2[const_var]"
 by blast

(* Note: generalized alphabetic variant of the last theorem. *)
AOT_theorem "term-out:4":
  ‹(φ{β} & ∀L> c[z::=[]\^>v]\^s>v[x::v]\<^v= c[z::=v]_v"
 using "term-out:3" .

(* TODO: Provide a nicer mechanism for introducing custom binders. *)

  <\guillemotleft
syntax (input) "_AOT_exists_unique" :: ‹α →
  (output) "_AOT_exists_unique" :: ‹α → φ → φ›
 
 "_AOT_exists_unique τ φ" <= 
 
java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 129
 (‹∃!_...∃!_ _› [1,40])
 ‹
 (syntax_const‹>x \Rightarrow v 🚫
 fn ctx => fn [a,b,c] => Ast.mk_appl (Ast.Constant "AOT_exists_unique")
 [parseEllipseList "_AOT_vars" ctx [a,b],c]),
 (syntax_const
 AOT_restricted_binder
 const_name‹AOT_exists_unique›
 \<^assumes "atom 
 ‹AOT_syntax_print_translations [
 AOT_preserve_binder_abs_tr'
 const_syntax‹AOT_exists_unique›
 syntax_const y›
 (syntax_const‹_AOT_exists_unique_ellipse›, true)
 const_name‹AOT_conj›,
 AOT_binder_trans
 {theory}
 @{binding "AOT_exists_unique_binder"}
 syntax_const \sharp (x,v) ==> subst_tv { z : b | c } x v = { z : b | c[x::=v]_cv }"
 ›


  AOT_meta_syntax
 
  AOT_exists_unique (binder \    apply(rule_tac y=a and c="(aa,b)" in τ.strong_exhaust)
 
  AOT_no_meta_syntax
 
java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 72
 

  "uiquenes:2: \open\<!alpha>    \ \e>\al>\fo>\be>(🚫
 (rule "≡I"; rule "→I")
 AOT_assume ‹∃!α φ{α}›
 AOT_hence ‹∃α (φ{α} & ∀βmoreover have "c[z::=V_var cb]_cv[xa::=va]_cv = c[xa::=va]_cv[z::=V_var cb]_cv" using subst_cv_commute_full[of z va xa "V_var cb" ] assms fresh_def v.supp by fastforce
 moreover have "ca[za::=V_var cb]_cv[xa::=va]_cv = ca[xa::=va]_cv[za::=V_var cb]_cv"
 using subst_cv_commute_full[of za va xa "V_var cb" ] assms fresh_def v.supp by fastforce
 using "instantiation"[rotated] by blast
 AOT_hence ‹∀βultima show "c[xa:=va]_\^sub>v = ca[xa::=va]_cv[za::=V_var cb]_cv" by simp
 using "term-out:3" "≡E" by blast
 AOT_thus ‹∃α∀β(φ
 using "∃I" by fast
 
 AOT_assume ‹∃α∀β(φ{β} ≡ β = α)›
 AOT_obtain 🚫
 
java.lang.StringIndexOutOfBoundsException: Range [36, 35) out of bounds for length 115
 using "term-out:3" "≡E" by blast
 AOT_hence ‹
 using "∃>\t"
 AOT_thus ‹∃!α φ"(x 🚫
 using "uniqueness:1" "≡_dfI" by blast
 

  "uni-most": ‹∃!α φ{α} → ∀β∀γ((φ{β} & φ{γ}) → β = γ)›
 (ule "🚫
 fix \<  show
 AOT_assume ‹∃!α φ{α}›nominal_nduct c avoi: xv zw rul: \t.strong_ind)
 AOT_hence ‹∃α∀β(φ{β} ≡ β = α)›
 using "uniqueness:2" "≡E" by blast
 then AOT_obtain α where ‹ subst_cv_commute_full by simp
 using "instantiation"[rotated] by blast
 moreover AOT_assume ‹
 ultimately AOT_have ‹β
  "∀E"(1,2) by blast+
 AOT_thus ‹β = γ›
 by (metis "rule=E" "id-eq:2" "→E")


  "nec-exist-!": ‹∀α(φ{α} → ◻φ{α}) → (∃!αusubst_v_fli[of z1 c1 z2 c2 v] eq_i ass subst__c_def by simp
  (rule "→I"; rule "→I")
 AOT_assume a: ‹∀α(φ{α} → ◻φ{α})›
 AOT_assume ‹∃!α φ{α}›
 AOT_hence ‹∃α (φ{α} & ∀β (φ
 using "uniqueness:1" "≡_d:"τ x →
 then AOT_obtain α where ξ: ‹φ{α} & ∀β ♯T_r z b c) x = c[z::=[x]^]_cv"
 using "instantiation"[rotated] by blast
 AOT_have ‹◻φ{α}›
 using ξ a "&E" "∀E" "→E" by fast
 moreover AOT_have ‹∀β (◻φ{β} → β = α)›
 apply (rule GEN; rule "→I")
 using ξ[THEN "&E"(2), THEN "∀E"(2), THEN "→E"]
 "qml:2"[axiom_inst, THEN "→E"] by blast
 ultimately AOT_have ‹(◻φ{α} & ∀β (◻φ{β} → β = α))›
 using "&I" by blast
 AOT_thus ‹∃!α ◻φ{α}›
 using "uniqueness:1" "≡_dfI" "∃I" by fast
 

 ‹The Theory of Actuality and Descriptions›
 ‹\label{PLM: 9.8}›

  "act-cond": ‹\A(φ → ψ) → (\Aφ → \Aψ)›
 using "→I" "≡E"(1) "logic-actual-nec:2"[axiom_inst] by blast

  "nec-imp-act": ‹◻φ → \Aφ›
 by (metis "act-cond" "contraposition:1[2]" "≡E"(4)
 "qml:2"[THEN act_closure, axiom_inst]
 "qml-act:2"[axiom_inst] RAA(1) "→E" "→I")

  "act-conj-act:1": ‹\A(\Aφ → φ)›
 using "→I" "≡E"(2) "logic-actual-nec:2"[axiom_inst]
 "logic-actual-nec:4"[axiom_inst] by blast

  "act-conj-act:2": ‹\A(φ → \Aφ)›
 by (metis "→I" "≡E"(2, 4) "logic-actual-nec:2"[axiom_inst]
 "logic-actual-nec:4"[axiom_inst] RAA(1))

  "act-conj-act:3": ‹(\Aφ & \Aψ) → \A(φ & ψ)›
  -
 AOT_have ‹◻(φ → (ψ → (φ & ψ)))›
 by (rule RN) (fact Adjunction)
 AOT_hence ‹\A(φ → (ψ → (φ & ψ)))›
 using "nec-imp-act" "→E" by blast
 AOT_hence ‹\Aφ → \A(ψ → (φ & ψ))›
 using "act-cond" "→E" by blast
 moreover AOT_have ‹\A(ψ → (φ & ψ)) → (\Aψ → \A(φ & ψ))›
 by (fact "act-cond")
 ultimately AOT_have ‹\Aφ → (\Aψ → \A(φ & ψ))›
 using "→I" "→E" by metis
 AOT_thus ‹(\Aφ & \Aψ) → \A(φ & ψ)›
 by (metis Importation "→E")
 

  "act-conj-act:4": ‹\A(\Aφ ≡ φ)›
  -
 AOT_have ‹(\A(\Aφ → φ) & \A(φ → \Aφ)) → \A((\Aφ → φ) & (φ → \Aφ))›
 by (fact "act-conj-act:3")
 moreover AOT_have ‹\A(\Aφ → φ) & \A(φ → \Aφ)›
 using "&I" "act-conj-act:1" "act-conj-act:2" by simp
 ultimately AOT_have ζ: ‹\A((A>φ → φ) & (φ → \Aφ))›
 using "→E" by blast
 AOT_have ‹\A(((\Aφ → φ) & (φ → \Aφ)) → (\Aφ ≡ φ))›
 using "conventions:3"[THEN "df-rules-formulas[2]",
 THEN act_closure, axiom_inst] by blast
 AOT_hence ‹\A((\Aφ → φ) & (φ → \Aφ)) → \A(\Aφ ≡ φ)›
 using "act-cond" "→E" by blast
 AOT_thus ‹\A(\Aφ ≡ φ)› using ζ "→E" by blast
 

(* TODO: Consider introducing AOT_inductive. *)
inductive arbitrary_actualization for φ where
  ‹arbitrary_actualization φ «\Aφ¬›
| ‹arbitrary_actualization φ «\Aψ¬› if ‹arbitrary_actualization φ ψ›
declare arbitrary_actualization.cases[AOT]
        arbitrary_actualization.induct[AOT]
        arbitrary_actualization.simps[AOT]
        arbitrary_actualization.intros[AOT]
syntax arbitrary_actualization :: ‹φ' → φ' → AOT_prop›
  (‹ARBITRARY'_ACTUALIZATION'(_,_')›)

notepad
begin
  AOT_modally_strict {
    fix φ
    AOT_have ‹ARBITRARY_ACTUALIZATION(\Aφ ≡ φ, \A(\Aφ ≡ φ))›
      using AOT_PLM.arbitrary_actualization.intros by metis
    AOT_have ‹ARBITRARY_ACTUALIZATION(\Aφ ≡ φ, \A\A(\Aφ ≡ φ))›
      using AOT_PLM.arbitrary_actualization.intros by metis
    AOT_have ‹ARBITRARY_ACTUALIZATION(\Aφ ≡ φ, \A\A\A(\Aφ ≡ φ))›
      using AOT_PLM.arbitrary_actualization.intros by metis
  }
end


AOT_theorem "closure-act:1":
  assumes ‹ARBITRARY_ACTUALIZATION(\Aφ ≡ φ, ψ)›
  shows ‹ψ›
using assms proof(induct)
  case 1
  AOT_show ‹\A(\Aφ ≡ φ)›
    by (simp add: "act-conj-act:4")
next
  case (2 ψ)
  AOT_thus ‹\Aψ›
    by (metis arbitrary_actualization.simps "≡
              "logic-actual-nec:4"[axiom_inst])
qed

AOT_theorem "closure-act:2": ‹\  then obtain x1::\tau and x2:: where *:"x= (x1,x2)" by forc
  by (simp add: " -conj-act:4" "∀I")

  "closure-act:3": ‹\A∀
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
 "logic-actual-nec:3"[axiom_inst]
 "logic-actual-nec:4"[axiom_inst])

  "closure-act:4": ‹\A\<moreover have " atom z \<notin> set [atom z']" using z 
 using "closure-act:3" .

  "RA[1]":
 assumes ‹\⊨ φ›
 shows ‹using \tauAb_qifass
 ― ‹While this proof is rejected in PLM,
 we merely state it as modally-fragile rule,
 which addresses the concern in PLM.›
 using "¬¬E" assms "≡E"(3) "logic-actual"[act_axiom_inst]
 "logic-actual-nec:1"[axiom_inst] "modus-tollens:2" by blast
  "RA[2]":
 assumes ‹\⊨_\◻ φ›
 shows ‹\⊨_\◻lbrace> > z' : B_bool | TRUE } x1a : B_bool | x3a }.e_f ei
 ― \<hen show ?case usingv<>(
 does not require an appeal to the semantics itself.›
 using RN assms "nec-imp-act" "vdash-properties:5" by blast
  "RA[3]":
 assumes ‹Γ \⊨_\◻moreover have "{ za : B_id tid | TRUE } = { za : B_id tid | TRUE }[x::=v]_\τ_v"
 shows ‹\AΓ subst_cv.simps subst_tv.simps by (simp add: ‹atom za ♯ (x, v)›)
 text‹This rule is only derivable from the semantics,
 but apparently no proof actually relies on it.
 If this turns out to be required, it is valid to derive it from the
 semantics just like RN, but we refrain from doing so, unless necessary.›
  (*  using assms by (meson AOT_sem_act imageI) *)
  oops ― ‹discard the rule›

AOT_act_theorem "ANeg:1": ‹¬ atom z } = supp c1 - { atom z1 }"
 by (simp add: "RA[1]" "contraposition:1[1]" "deduction-theorem"
 "≡I" "logic-actual"[act_axiom_inst])

  "ANeg:2": ‹¬\A¬φ ≡ list.set(1) list.simps(15) sup_bot.right_neutral supp_b_empty)
 using "ANeg:1" "≡I" "≡E"(5) "useful-tautologies:1"
 "useful-tautologies:2" by blast

  "Act-Basic:1": ‹\Aφ ∨ \A¬ "atom z1 \notin>supp b1 ∧ atom z ∉ supp b" using supp_b_empty by simp
 by (meson "∨I"(1,2) "≡E"(2) "logic-actual-nec:1"[axiom_inst] "raa-cor:1")

  "Act-Basic:2": ‹.eq_iff τass b.supp(1) list.se(1) list.set(2) sup_bot.right_neutral)
  (rule "≡I"; rule "→I")
 AOT_assumeqed
 moreover AOT_have ‹\A((φ & ψ
 by (simp add: "RA[2]" "Conjunction Simplification"(1))
 moreover AOT_have ‹\A((φ & ψ) → ψ)›
 by (simp add: "RA[2]" "Conjunction Simplification"(2))
 ultimately AOT_show ‹ assumes "({ z : b | c }) = ({ zz : b | cc })" and "atom x ♯ c" and "x ≠ zz"
 using "act-cond"[THEN "→E", THEN "→E"] "&I" by metis
 
 AOT_assume ‹\Aφ & \Aψ›
 AOT_thus ‹A(φ)›
 using "act-conj-act:3" "vdash-properties:6" by blast
 

  "Act-Basic:3": ‹ supp c" using assms fresh_def by blast
  (rule "≡I"; rule "→I")
 AOT_assume ‹A(φ ψ)›
 moreover AOT_have ‹\A((φ ≡>supp cc" using assms by simp
 by (simp add: "RA[2]" "deduction-theorem" "≡E"(1))
 moreover AOT_have ‹\A((φ ≡ ψ) → (ψ → φ))›
 by (simp add: "RA[2]" "deduction-theorem" "≡E"(2))
 ultimately AOT_show ‹\A(φ → ψ) & \A(ψ → φ)›Mutable Variable Context›
 using "act-cond"[THEN "→E", THEN "→
 
java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 113
 AOT_hence ‹\A((φ → ψ) & (ψ → φ))›
 by (metis "act-conj-act:3" "vdash-properties:10")
 moreover AOT_have ‹\A(((φ → ψ) & (ψ → φ)) → (φ ≡ ψ))›
 by (simp add: "conventions:3" "RA[2]" "df-rules-formulas[2]"
 "vdash-properties:1[2]")
 ultimately AOT_show ‹\A(φ ≡ ψ)›
 using "act-cond"[THEN "→E", THEN "→E"] by metis
 

  "Act-Basic:4": ‹(\A(φ → ψ) & \A(ψ → φ)) ≡ (\Aφ ≡ \Aψ)›
  (rule "≡I"; rule "→I")
 AOT_assume 0: ‹\A(φ → ψ) & \A(ψ → φ)›
 AOT_show ‹\Aφ ≡ \Aψ›
 using 0 "&E" "act-cond"[THEN "→E", THEN "→# SPX-License-Identifier: GPL-2.0-only
 
 AOT_assume ‹\Aφ ≡ \Aψ›
 AOT_thus ‹\A(φ → ψ) & \A(ψ → φ)›
 by (metis "→I" "logic-actual-nec:2"[axiom_inst] "≡E"(1,2) "&I")
 

  "Act-Basic:5": ‹\A(φ ≡ ψ) ≡ (\Aφ ≡ \Aψ)›
 using "Act-Basic:3" "Act-Basic:4" "≡E"(5) by blast

  "Act-Basic:6": ‹\Aφ ≡ ◻\Aφ›
 by (simp add: "≡I" "qml:2"[axiom_inst] "qml-act:1"[axiom_inst])

  "Act-Basic:7": ‹\A◻φ → ◻\Aφ›
 by (metis "Act-Basic:6" "→I" "→E" "≡E"(1,2) "nec-imp-act"
 "qml-act:2"[axiom_inst])

  "Act-Basic:8": ‹◻φ → ◻\Aφ›
 using "Hypothetical Syllogism" "nec-imp-act" "qml-act:1"[axiom_inst] by blast

  "Act-Basic:9": ‹\A(φ ∨ ψ) ≡ (\Aφ ∨ \Aψ)›
  (rule "≡I"; rule "→
 AOT_assume ‹vl Nl
 AOT_thus ‹\Δ Δ x v = (,[:=]_v) # (subst_dv\D>x v ))"
 proof (rule "raa-cor:3")
 AOT_assume ‹¬(\Aφ ∨ \Aψ)›
 AOT_hence ‹¬\Aφ & ¬\Aψ›
 by (metis "≡E"(1) "oth-class-taut:5:d")
 AOT_hence ‹\A¬φ & \A¬ψ›
 using "logic-actual-nec:1"[axiom_inst, THEN "≡E"(2)] "&E" "&I" by metis
 AOT_hence ‹\A(¬φ & ¬ψ)›
 using "≡E" "Act-Basic:2" by metis
 moreover AOT_have ‹\A((¬φ & ¬ψ) ≡ ¬(φ ∨ ψ))›
 using "RA[2]" "≡E"(6) "oth-class-taut:3:a" "oth-class-taut:5:d" by blast
 moreover AOT_have ‹\A(¬φ & ¬ψ) ≡ \A(¬(φ ∨ ψ))›
 using calculation(2) by (metis "Act-Basic:5" "≡E"(1))
 ultimately AOT_have ‹\A(¬(φ ∨ ψ))› using "≡E" by blast
 AOT_thus ‹¬\A(φ ∨ ψ)›
 using "logic-actual-nec:1"[axiom_inst, THEN "≡E"(1)] by auto
 qed
 
 AOT_assume ‹\Aφ ∨ \Aψ›
 AOT_thus ‹\A(φ ∨ ψ)›
 by (meson "RA[2]" "act-cond" "∨I"(1) "∨E"(1) "Disjunction Addition"(1,2))
 

  "Act-Basic:10": ‹\A∃α φ{α} ≡ ∃α \Aφ{α}›
  -
 AOT_have θ: ‹¬\A∀α ¬φ{α} ≡ ¬∀α \A¬φ{α}›
 by (rule "oth-class-taut:4:b"[THEN "≡E"(1)])
 (metis "logic-actual-nec:3"[axiom_inst])
 AOT_have ξ: ‹¬∀α \A¬φ{α} ≡ ¬∀α ¬\Aφ{α}›
 by (rule "oth-class-taut:4:b"[THEN "≡E"(1)])
 (rule "logic-actual-nec:1"[THEN universal_closure,
 axiom_inst, THEN "cqt-basic:3"[THEN "→E"]])
 AOT_have ‹\A(∃α φ{α}) ≡ \A(¬∀α ¬φ{α})›
 using "conventions:4"[THEN "df-rules-formulas[1]",
 THEN act_closure, axiom_inst]
 "conventions:4"[THEN "df-rules-formulas[2]",
 THEN act_closure, axiom_inst]
 "Act-Basic:4"[THEN "≡E"(1)] "&I" "Act-Basic:5"[THEN "≡E"(2)] by metis
 also AOT_have ‹… ≡ ¬\A∀α ¬φ{α}›
 by (simp add: "logic-actual-nec:1" "vdash-properties:1[2]")
 also AOT_have ‹… ≡ ¬∀α \A ¬φ{α}› using θ by blast
 also AOT_have ‹… ≡ ¬∀α ¬\A φ{α}› using ξ by blast
 also AOT_have ‹… ≡ ∃α \A φ{α}›
 using "conventions:4"[THEN "≡Df"] by (metis "≡E"(6) "oth-class-taut:3:a")
 finally AOT_show ‹\A∃α φ{α} ≡ ∃α \Aφ{α}› .
 


  "Act-Basic:11":
 ‹\A∀α(φ{α} ≡ ψ{α}) ≡ ∀α(\Aφ{α} ≡ \Aψ{α})›
 (rule "≡I"; rule "→I")
 AOT_assume ‹\A∀α(φ{α} ≡ ψ{α})›
 AOT_hence ‹∀α\A(φ{α} ≡ ψ{α})›
 using "logic-actual-nec:3"[axiom_inst, THEN "≡E"(1)] by blast
 AOT_hence ‹\A(φ{α} ≡ ψ{α})› for α using "∀E" by blast
 AOT_hence ‹\Aφ{α} ≡ \Aψ{α}› for α by (metis "Act-Basic:5" "≡E"(1))
 AOT_thus ‹∀α(\Aφ{α} ≡ \Aψ{α})› by (rule "∀I")
 
 AOT_assume ‹∀α(\Aφ{α} ≡ \Aψ{α})›
 AOT_hence ‹\Aφ{α} ≡ \Aψ{α}› for α using "∀E" by blast
 AOT_hence ‹\A(φ{α} ≡ ψ{α})› for α by (metis "Act-Basic:5" "≡E"(2))
 AOT_hence ‹∀α \A(φ{α} ≡ ψ{α})› by (rule "∀I")
 AOT_thus ‹\A∀α(φ{α} ≡ ψ{α})›
 using "logic-actual-nec:3"[axiom_inst, THEN "≡E"(2)] by fast
 

  "act-quant-uniq":
 ‹∀β(\Aφ{β} ≡ β = α) ≡ ∀β(φ{β} ≡ β = α)›
 (rule "≡I"; rule "→I")
 AOT_assume ‹∀β(\Aφ{β} ≡ β = α)›
 AOT_hence ‹\Aφ{β} ≡ β = α› for β using "∀E" by blast
 AOT_hence ‹φ{β} ≡ β = α› for β
 using "≡I" "→I" "RA[1]" "≡E"(1,2) "logic-actual"[act_axiom_inst] "→E"
 by metis
 AOT_thus ‹∀β(φ{β} ≡ β = α)› by (rule "∀I")
 
 AOT_assume ‹∀β(φ{β} ≡ β = α)›
 AOT_hence ‹φ{β} ≡ β = α› for β using "∀E" by blast
 AOT_hence ‹\Aφ{β} ≡ β = α› for β
 using "≡I" "→I" "RA[1]" "≡E"(1,2) "logic-actual"[act_axiom_inst] "→E"
 by metis
java.lang.NullPointerException
 

  "fund-cont-desc": ‹x = subst_dv_abbrev🚫cas Nl
 using descriptions[axiom_inst] "act-quant-uniq" "≡E"(5) by fast

  hintikka: ‹
 using "Commutativity of ≡"[THEN "≡E"(1)] then show ?case unfolding subst_dv.simps using fresh_DCons fresh_subst_tv_if fresh_Pair by metis
 "fund-cont-desc" "≡E"(5) by blast


  russell_axiom =
 fixes ψ
 assumes ψ_denotes_asm: "[v ⊨ ψ{κ}] ==> [v ⊨ κ↓]"
 
  "russell-axiom":
 ‹ψ{\ιx φ{x}} ≡ ∃x(φ{x} & ∀z(φ{z} → z = x) & ψ{x})›pysl of. 
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
 AOT_have b: ‹x (x \^old>ιx φequiv> (φ{x} & ∀z(φ{z} → z = x)))›
 using hintikka "∀I" by fast
 show ?thesis
 proof(rule "≡I"; rule "→I")
 AOT_assume c: ‹ψ{\ιx φ{x}}›
 AOT_hence d: ‹\ιx φ{x}↓›
 using ψ_denotes_asm by blast
java.lang.StringIndexOutOfBoundsException: Range [15, 13) out of bounds for length 72
 by (metis "rule=I:1" "existential:1")
java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 80
 using "instantiation"[rotated] by blast
 moreover AOT_have ‹a = \ιx φ{x} ≡ (φ" us_v(S_thv c)xv=A_mc ('x:=\^>_v (sbs_rnhvcs "
 using b "∀E" by blast
 ultimately AOT_have ‹φ{a} & ∀z(φ{z} →_f 's12)xv=(Sf(us_vv v) suts 1x (sssv2xv))
 using "≡sharp> (x,v) ==> subst_sv (AS_var u τ v' s) x v = AS_var u (subst_tv τ x v ) (subst_vv v' x v ) (subst_sv s x v ) "
 moreover AOT_have ‹ψ{a}›
 proof -
 AOT_have 1: ‹
 by (simp add: "id-eq:2" "universal-cor")
 AOT_have ‹a = \ιx φ{x} → \ιx φ{x} = a›
 by (rule "∀E"(1)[where τ="«\ιx φ{x}¬"]; rule "∀E"(2)[where β=a])
 (auto simp: 1 d "universal-cor")
 AOT_thus ‹ψ{a}›
 using a_def c "rule=E" "→E" by blast
 qed
 ultimately AOT_have ‹φ{a} & ∀z(φ{z} → z = a) & ψ{a}›
 AOT_thus ‹∃x(φ{x} & ∀z(φ{z} → z
 next
 AOT_assume ‹∃x(φ{x} & ∀z(φ{z} → z = x) & ψ{x})›
 then AOT_obtain b where g: ‹φ{b} & ∀z(φ{z} → z = b) & &psi;{b}›
 using "instantiation"[rotated] by blast
java.lang.NullPointerException
 usingapply(subst Projl_permute)
 AOT_have ‹φ{b} & ∀z(φ{z} → z = b)› and j: ‹ψ{b}›
 using g "&E" by blast+
 AOT_hence ‹b = \ιx φ{x}› using h "≡E" by blast
 AOT_thus ‹ψ{\ιx φ{x}}›1ss_s_ustbacvsbstbrnhvgap Il(,av)))")
 qed
 
 

java.lang.StringIndexOutOfBoundsException: Range [15, 11) out of bounds for length 37
 by standard (metis "cqt:5:a[1]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[exe,2,1,1]": russell_axiom ‹λ κ . «[Π]κκ'¬›
 by standard (metis "cqt:5:a[2]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[exe,2,1,2]": russell_axiom ‹λ κ . «[Π]κ'꬛
 
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "macro" is null
 by standard (metis "cqt:5:a[2]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[exe,3,1,1]": rui case (1 P '
 by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[exe,3,1,2]": russell_axiom ‹λ κ . «[Π]κ'κκ''¬
 by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "→cassa
  "russell-axiom[exe,3,1,3]": russell_axiom ‹λ κied a c
 by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[exe,3,2,1]": russell_axiom ‹λ κ
 by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[exe,3,2,2]": russell_axiom ‹λ κ . «
 by sta proof(asesb)
  "russell-axiom[exe,3,2,3]": russell_axiom ‹λ κ . «
 by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[exe,3,3]": russell_axiom ‹λ κ . «[Π]κκ꬛
 by standard (metis "cqt:5:a[3]"[axiom_inst, THEN "→

  "russell-axiom[enc,1]": russell_axiom ‹λ κ . «κ[Π]¬ n2 Irb)thuPpofb
 by standard (metis "cqt:5:b[1]"[axiom_inst, THEN "\          s ab cc
  "russell-axiom[enc,2,1]": russell_axiom ‹λ κ uingn n s_an__bachlis.togehas rs_trisr ymets
 by standard (metis "cqt:5:b[2]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[enc,2,2]": russell_axiom ‹λ κ . «κ'κ[Π]¬›
 by standard (metis "cqt:5:b[2]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[enc,2,3]": russell_axiom ‹λ κ . «κκ[Π]¬›
 by standard (metis "cqt:5:b[2]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[enc,3,1,1]": russell_axiom ‹λ κ . «κκ'κ''[Π]¬
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[enc,3,1,2]": russell_axiom ‹λ κ . «κ'κκ''[Π]¬›
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[enc,3,1,3]": russell_axiom ‹λ κ . «κ'κ''κ[Π]¬tpob lat
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→next
  "russell-axiom[enc,3,2,1]": russell_axiom ‹λ κ . «(4 u a asuas )
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→E"] "&E")
  "russell-axiom[enc,3,2,2]": russell_axiom ‹λ κ . «κκ'κ[Π]¬›
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[enc,3,2,3]": russell_axiom ‹λ κ . «κ'κκ[Π]¬›
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→E"] "&E"(2))
  "russell-axiom[enc,3,3]": russell_axiom ‹λ κ . «κκκ[Π]¬›
 by standard (metis "cqt:5:b[3]"[axiom_inst, THEN "→E"] "&E"(2))

  "!-exists:1": ‹\ιx φ{x}↓ ≡
 (rule "≡
java.lang.NullPointerException
 AOT_hence ‹
 then AOT_obtain a where ‹a = x →Rightar> s" (\" (‹_[_::=_]_sv› [1000,50,50] 1000)
 using "instantiation"[rotated] by blast
 AOT_hence ‹φ{a} & ∀z (φ{z} → z = a)›
 using hintikka "≡E" by blast
 AOT_hence ‹∃x (φ{x} & ∀z (φ{z} → z = x))›
 by (rule "∃I")
 AOT_thus ‹∃!x φ{x}›
 using "uniqueness:1"[THEN "≡_dfI"] by blast
 
 AOT_assume ‹∃!x φ{x}›
 AOT_hence ‹∃x (φ{x} & ∀z (φ{z} → z = x))›
 using "uniqueness:1"[THEN "≡_dfE"] by blast
 then AOT_obtain b where ‹φ{b} & ∀z (φ{z} → z = b)›
 using "instantiation"[rotated] by blast
 AOT_hence ‹b = \ιx φ{x}›
 using hintikka "≡E" by blast
 AOT_thus ‹\ιx φ{x}↓›
 by (metis "t=t-proper:2" "vdash-properties:6")
 

  "!-exists:2": ‹∃y(y=\ιx φ{x}) ≡ ∃!x φ{x}›
 using "!-exists:1" "free-thms:1" "≡E"(6) by blast

  "y-in:1": ‹x = \ιx φ{x} → φ{x}›
 using "&E"(1) "→I" hintikka "≡E"(1) by blast

(* Note: generalized alphabetic variant of the last theorem *)
AOT_act_theorem "y-in:2": ‹z = \ιx φ{x} → φ{z}› using "y-in:1".

AOT_act_theorem "y-in:3": ‹\ιx φ{x}↓ → φ{\ιx φ{x}}›
proof(rule "→I")
  AOT_assume ‹\ιx φ{x}↓›
  AOT_hence ‹∃y (y = \ιx φ{x})›
    by (metis "rule=I:1" "existential:1")
  then AOT_obtain a where ‹a = \ιx φ{x}›
    using "instantiation"[rotated] by blast
  moreover AOT_have ‹φ{a}›
    using calculation hintikka "≡E"(1) "&E" by blast
  ultimately AOT_show ‹φ{\ιx φ{x}}› using "rule=E" by blast
qed

AOT_act_theorem "y-in:4": java.lang.StringIndexOutOfBoundsException: Range [106, 105) out of bounds for length 133
 using "y-in:3"[THEN "→E"] "free-thms:1"[THEN "≡E"(2)] "→I" by blast


  "act-quant-nec":
java.lang.StringIndexOutOfBoundsException: Range [49, 48) out of bounds for length 151
 (rule "≡I"; rule "→I")
 AOT_assume ‹∀β (s subst_branchv s x v"
java.lang.NullPointerException
 AOT_hence ‹\Av[ip: "ie(us_vAix) ieA nd "ie(sbt_ach ix =sz " n szesbtbacl ieC
 by (metis "Act-Basic:5" "act-conj-act:4" "≡E"(1) "≡E"(5))
 AOT_thus ‹∀β(\A\Aφ{β} ≡ β = α)›
 by (rule "∀I")
 
 AOT_assume ‹∀β(\A\<A c a nCin l s_rnh__rn_issrn_ncatsm:rhtae
 AOT_hence ‹
 AOT_hence ‹\Aφsm]:"us_vAa(_a )=A n"ustbrnh _a )=B n sbtbrnhvC Va ) C
 by (metis "Act-Basic:5" "act-conj-act:4" "≡E"(1) "≡E"(6))
 AOT_thus ‹∀β (\Aφ{β} ≡ β = α)›
 by (rule "∀I")
 

  "equi-desc-descA:1": ‹
java.lang.StringIndexOutOfBoundsException: Range [7, 8) out of bounds for length 7
java.lang.NullPointerException
 using descriptions[axiom_inst] by blast
 also AOT_have ‹... ≡
 proof(rule "≡shows
java.lang.StringIndexOutOfBoundsException: Range [42, 40) out of bounds for length 156
 AOT_hence ‹\Aamx 🚫
 using "∀Nn)
 AOT_thus ‹tei uig S_e feho rs_ubs_v_i lt.ic is.st_csssbac__rnhlitrs e_nD
 by (metis "Act-Basic:5" "act-conj-act: by ei
 next
 AOT_assume ‹∀z (\A\Aφ{z} ≡
 AOT_hence ‹\A\Aφtau> s1 s2)
 using "∀E" by blast
 AOT_thus ‹\Aφ{a} ≡ a = x› for a
 by (metis "Act-Basic:5" "act-conj-act:4" "≡E"(1) "≡E"(6))
 qed
 also AOT_have ‹... ≡ x = \ιx(\Aφhence "subst_s (Set \taus 2 xv= (Slt2y\tau s1 s2)" using forget_subst_sv by simp
 using "Commutativity of ≡ (AS_let2 y τ s1 s2)" using AS_let2 by argo
 finally show ?thesis .
 

  "equi-desc-descA:2": ‹\ιx φ{x}↓ → [x::=v]_v) (s1[x::=v]_v) (s2[x::=v]_v)" using subst_sv.simps AS_let2 y oc
 (rule "\<    then]<sv" using assms by presburger
 AOT_assume ‹\ιx φ{x}↓›
 AOT_hence ‹∃y (y = \ιx φ{x})›
 by (metis "rule=I:1" "existential:1")
 then AOT_obtain a where ‹a = \ιx φ{x}›
 using "instantiation"[rotated] by blast
 moreover AOT_have ‹a = \ιx(\Aφ{x})›
 using calculation "equi-desc-descA:1"[THEN "≡E"(1)] by blast
 ultimately AOT_show ‹\ιx φ{x} = \ιx(\Aφ{x})›
 using "rule=E" by fast
 

  "nec-hintikka-scheme":
 ‹x = \ιx φ{x} ≡ \Aφ{x} & ∀z(\Aφ{z} → z = x)›
  -
 AOT_have ‹x = \ιx φ{x} ≡ ∀z(\Aφ{z} ≡ z = x)›
 using descriptions[axiom_inst] by blast
 also AOT_have ‹… ≡ (\Aφ{x} & ∀z(\Aφ{z} → z = x))›
 using "Commutativity of ≡"[THEN "≡E"(1)] "term-out:3" by fast
 finally show ?thesis.
 

  "equiv-desc-eq:1":
 ‹\A∀x(φ{x} ≡ ψ{x}) → ∀x (x = \ιx φ{x} ≡ x = \ιx ψ{x})›
 (rule "→I"; rule "∀I")
 fix β
 AOT_assume ‹\A∀x(φ{x} ≡ ψ{x})›
 AOT_hence ‹\A(φ{x} ≡ ψ{x})› for x
 using "logic-actual-nec:3"[axiom_inst, THEN "≡E"(1)] "∀E"(2) by blast
 AOT_hence 0: ‹\Aφ{x} ≡ \Aψ{x}› for x
 by (metis "Act-Basic:5" "≡E"(1))
 AOT_have ‹β = \ιx φ{x} ≡ \Aφ{β} & ∀z(\Aφ{z} → z = β)›
 using "nec-hintikka-scheme" by blast
 also AOT_have ‹... ≡ c) ∙le> c) ∙ xa) ::= ((xa ↔ c) ∙ v') ]_sv" using assms
 proof (rule "≡I"; rule "→I")
 AOT_assume 1: ‹\Aφ{β} & ∀z(\Aφ{z} → z = β)›
 AOT_hence ‹\Aφ{z} → z = β› for z
 using "&E" "∀E" by blast
 AOT_hence ‹\Aψ{z} → z = β› for z
 using 0 "≡E" "→I" "→E" by metis
 AOT_hence ‹∀z(\Aψ{z} → z = β)›
 using "∀I" by fast
 moreover AOT_have ‹\Aψ{β}›
 using "&E" 0[THEN "≡E"(1)] 1 by blast
 ultimately AOT_show ‹\Aψ{β} & ∀z(\Aψ{z} → z = β)›
 using "&I" by blast
 next
 AOT_assume 1: ‹\Aψ{β} & ∀z(\Aψ{z} → z = β)›
 AOT_hence ‹\Aψ{z} → z = β› for z
 using "&E" "∀E" by blast
 AOT_hence ‹\Aφ{z} → z = β› for z
 using 0 "≡E" "→I" "→E" by metis
 AOT_hence ‹∀z(\Aφ{z} → z = β)›
 using "∀I" by fast
 moreover AOT_have ‹\Aφ{β}›
 using "&E" 0[THEN "≡E"(2)] 1 by blast
 ultimately AOT_show ‹\Aφ{β} & ∀z(\Aφ{z} → z = β)›
 using "&I" by blast
 qed
 also AOT_have ‹... ≡ β = \ιx ψ{x}›
 using "Commutativity of ≡"[THEN "≡E"(1)] "nec-hintikka-scheme" by blast
 finally AOT_show ‹β = \ιx φ{x} ≡ β = \ιx ψ{x}› .
 

  "equiv-desc-eq:2":
 ‹\ιx φ{x}↓ & \A∀x(φ{x} ≡ ψ{x}) → \ιx φ{x} = \ιx ψ{x}›
 (rule "→I")
 AOT_assume ‹\ιx φ{x}↓ & \A∀x(φ{x} ≡ ψ{x})›
 AOT_hence 0: ‹∃y (y = \ιx φ{x})› and
 1: ‹∀x (x = \ιx φ{x} ≡ x = \ιx ψ{x})›
 using "&E" "free-thms:1"[THEN "≡E"(1)] "equiv-desc-eq:1" "→E" by blast+
 then AOT_obtain a where ‹a = \ιx φ{x}›
 using "instantiation"[rotated] by blast
 moreover AOT_have ‹a = \ιx ψ{x}›
 using calculation 1 "∀E" "≡E"(1) by fast
 ultimately AOT_show ‹\ιx φ{x} = \ιx ψ{x}›
 using "rule=E" by fast
 

  "equiv-desc-eq:3":
 ‹\ιx φ{x}↓ & ◻∀x(φ{x} ≡ ψ{x}) → \ιx φ{x} = \ιx ψ{x}›
 using "→I" "equiv-desc-eq:2"[THEN "→E", OF "&I"] "&E"
 "nec-imp-act"[THEN "→E"] by metis

(* Note: this is a special case of "exist-nec" *)
AOT_theorem "equiv-desc-eq:4": ‹\ιx φ{x}↓ → ◻\ιx φ{x}↓›
proof(rule "→I")
  AOT_assume ‹\ιx φ{x}↓›
  AOT_hence ‹∃y (y = \ιx φ{x})›
    by (metis "rule=I:1" "existential:1")
  then AOT_obtain a where ‹a = \ιx φ{x}›
    using "instantiation"[rotated] by blast
  AOT_thus ‹by (metis flip_at_simps(1) flip_fresh_fresh fresh_PairD(1))
 using "ex:2:a" "rule=E" by fast
 

  "equiv-desc-eq:5": ‹\ιx φsub>s_shres_i)
 (rule "→I")
 AOT_assume ‹qed
 AOT_hence ‹∃y (y = \ιx φ{x})›
 by (metis "rule=I:1" "existential:1")
 then AOT_obtain a where ‹a = \ιx φ{x}\<  assumesusing \t.eq_iff Abs1_eq_iff(3)[of z1' "CE_val v == CE_val (V_lit ll) IMP ca[za::=[z1']^v]_cv"
 using "instantiation"[rotated] by blast
 AOT_hence ‹◻(a = \ιx φ{x})›
 by (metis "id-nec:2" "vdash-properties:10")
 AOT_thus ‹∃y ◻(y = \ιx φ{x})›
 by (rule "∃I")
 

  "equiv-desc-eq2:1":
 ‹∀x (φ{x} ≡ ψ{x}) → ∀x (x = \ιx φ{x} ≡ x = \ιx ψ{x})›
 using "→I" "logic-actual"[act_axiom_inst, THEN "→E"]
 "equiv-desc-eq:1"[THEN "→E"]
 "RA[1]" "deduction-theorem" by blast

  "equiv-desc-eq2:2":
 ‹\ιx φ{x}↓ & ∀x (φ{x} ≡ ψ{x}) → \ιx φ{x} = \ιx ψ{x}›
 using "→I" "logic-actual"[act_axiom_inst, THEN "→E"]
 "equiv-desc-eq:2"[THEN "→E", OF "&I"]
 "RA[1]" "deduction-theorem" "&E" by metis

  russell_axiom
 
  "nec-russell-axiom":
 ‹ψ{\ιx φ{x}} ≡ ∃x(\Aφ{x} & ∀z(\Aφ{z} → z = x) & ψ{x})›
  -
 AOT_have b: ‹∀x (x = \ιx φ{x} ≡ (\Aφ{x} & ∀z(\Aφ{z} → z = x)))›
 using "nec-hintikka-scheme" "∀I" by fast
 show ?thesis
 proof(rule "≡I"; rule "→I")
 AOT_assume c: ‹ψ{\ιx φ{x}}›
 AOT_hence d: ‹\ιx φ{x}↓›
 using ψ_denotes_asm by blast
 AOT_hence ‹∃y (y = \ιx φ{x})›
 by (metis "rule=I:1" "existential:1")
 then AOT_obtain a where a_def: ‹a = \ιx φ{x}›
 using "instantiation"[rotated] by blast
 moreover AOT_have ‹a = \ιx φ{x} ≡ (\Aφ{a} & ∀z(\Aφ{z} → z = a))›
 using b "∀E" by blast
 ultimately AOT_have ‹\Aφ{a} & ∀z(\Aφ{z} → z = a)›
 using "≡E" by blast
 moreover AOT_have ‹ψ{a}›
 proof -
 AOT_have 1: ‹∀x∀y(x = y → y = x)›
 by (simp add: "id-eq:2" "universal-cor")
 AOT_have ‹a = \ιx φ{x} → \ιx φ{x} = a›
 by (rule "∀E"(1)[where τ="«\ιx φ{x}¬"]; rule "∀E"(2)[where β=a])
 (auto simp: d "universal-cor" 1)
java.lang.NullPointerException
 using a_def c "rule=E" "→E" by metis
 qed
 ultimately AOT_have ‹\Aφ{a} & ∀z(\lemma subst_sv_var_flip:
 by (rule "&I")
java.lang.NullPointerException
java.lang.NullPointerException
 next
 AOT_assume ‹x({x} & ∀Aφ{z} →{x})›
 then AOT_obtain b where g: ‹\Aφ"aom ♯ z) ∙v"
 using "instantiation"[rotated] by blast
 AOT_hence h: ‹b = \ιx φ{x} ≡ (\Aφ{b} & ∀using [[simproc del: alpha_lst]]
 using b "∀E" by blast
 AOT_have ‹\Aφ{b} & ∀z(\Aφ{z} → z = b)› and j: ‹ subst_tv_var_flip flip_fresh_freh v.fresh s_branch_s_branch_list.fresh
 using g "&E" by blast+
 AOT_hence ‹b = \ιx φ{x}›
 using h "≡defer 11 (* Sometim defering hard goals to the end makes it easier to finish *)
 AOT_thus ‹ψ{\ιx φ{x}}›
 using j "rule=E" by blast
 qed
 
 

java.lang.NullPointerException
  (rule "≡
 AOT_assume ‹\ιx_f Abs1_eq_iff'(3) flip_fresh_fresh
 AOT_hence ‹∃flip_fresh_fresh)
 by (metis "rule=I:1" "existential:1")
 then AOT_obtain a where ‹a = \ιx φ{x}›instantiatis :: has_subst_v
 using "instantiation"[rotated] by blast
 moreover AOT_have ‹a = \ιx φ{x} ≡ ∀z(\Aφ{z} ≡ z = a)›
 using descriptions[axiom_inst] by blast
 ultimately AOT_have ‹ubst_v ubts"
 using "≡E" by blast
 AOT_hence ‹∃x∀ proof
 AOT_thus ‹∃fix j:atmad :xad :vadt:
 using "uniqueness:2"[THEN "≡E"(2) shw (j 🚫
 
java.lang.NullPointerException
 AOT_hence \<open_
 using "uniqueness:2"[THEN "≡E"(1)] by f hence "c[z::=[ b ]↑v]_cv[xa::=va]_cv = ca[za::=[ cb ]^v]_cv[xa::=va]_cv" by auto
  OT_obtain a where ‹∀z(\Aφ{z} ≡ z = a)›
 using "instantiation"[rotated] by blast
java.lang.NullPointerException
 using descriptions[axiom_inst] by blast
java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 67
 using "≡E" by blast
 AOT_thus ‹{x}↓
 by (metis "t=t-proper:2" "vdash-properties:6")
 

  "actual-desc:2": \<  then
 using "&E"(1) "contraposition:1[2]" "≡E"(1) "nec-hintikka-scheme"
 "reductio-aa:2" "vdash-properties:9" by blast

(* Note: generalized alphabetic variant of the last theorem *)
AOT_theoremactual-:3" \openz = phi{x} →bold>\A>\<{clos>
  using "actual-desc:2".

AOT_theorem "actual-desc:4": ‹\<iota>x φ{x}↓ → \<A>φ{\<iota>x φ{x}}›
proof(rule "→I")
  AOT_assume ‹\<iota>x φ{x}↓›
  AOT_hence ‹∃y (y = \<iota>x φ{x})› by (metis "rule=I:1" "existential:1")
  then AOT_obtain a where ‹a = \<iota>x φ{x}› using "instantiation"[rotated] by blast
  AOT_thus ‹\<A>φ{\<iota>x φ{x}}›
    using "actual-desc:2" "rule=E" "→E" by fast
qed

AOT_theorem "actual-desc:5": ‹\<iota>x φ{x} = \<iota>x ψ{x} → \<A>∀x(φ{x} ≡ ψ{x})›
proof(rule "→I")
  AOT_assume 0: ‹\<iota>x φ{x} = \<iota>x ψ{x}›
  AOT_hence φ_down: ‹\<iota>x φ{x}↓› and ψ_down: ‹\<iota>x ψ{x}↓›
    using "t=t-proper:1" "t=t-proper:2" "vdash-properties:6" by blast+
  AOT_hence ‹∃y (y = \<iota>x φ{x})› and ‹∃y (y = \<iota>x ψ{x})›
    by (metis "rule=I:1" "existential:1")+
  then AOT_obtain a and b where a_eq: ‹a = \<iota>x φ{x}› and b_eq: ‹b = \<iota>x ψ{x}›
    using "instantiation"[rotated] by metis

  AOT_have ‹∀α∀β (α = β → β = α)›
    by (rule "∀I"; rule "∀I"; rule "id-eq:2")
  AOT_hence ‹∀β (\<iota>x φ{x} = β → β = \<iota>x φ{x})›
    using "∀E" φ_down by blast
  AOT_hence ‹\<iota>x φ{x} = \<iota>x ψ{x} → \<iota>x ψ{x} = \<iota>x φ{x}›
    using "∀E" ψ_down by blast
  AOT_hence 1: ‹\<iota>x ψ{x} = \<iota>x φ{x}› using 0
    "→E" by blast

  AOT_have ‹\<A>φ{x} ≡ \<A>ψ{x}› for x
  proof(rule "≡I"; rule "→I")
    AOT_assume ‹\<A>φ{x}›
    moreover AOT_have ‹\<A>φ{x} → x = a› for x
      using "nec-hintikka-scheme"[THEN "≡E"(1), OF a_eq, THEN "&E>"(2)]
            "∀E" by blast
    ultimately AOT_have ‹x = a›
      using "→E" by blast
    AOT_hence ‹x = \<iota>x φ{x}›
      using a_eq "rule=E" by blast
    AOT_hence ‹x = \<iota>x ψ{x}›
      using 0 "rule=E" by blast
    AOT_thus ‹\<A>ψ{x}›
      by (metis "actual-desc:3" "vdash-properties:6")
  next
    AOT_assume ‹\<A>ψ{x}›
    moreover AOT_have ‹\<A>ψ{x} → x = b› for x
      using "nec-hintikka-scheme"[THEN "≡E"(1), OF b_eq, THEN "&E>"(2)]
            "∀E" by blast
    ultimately AOT_have ‹x = b›
      using "→E" by blast
    AOT_hence ‹x = \<iota>x ψ{x}›
      using b_eq "rule=E" by blast
    AOT_hence ‹x = \<iota>x φ{x}›
      using 1 "rule=E" by blast
    AOT_thus ‹\<A>φ{x}›
      by (metis "actual-desc:3" "vdash-properties:6")
  qed
  AOT_hence ‹\<A>(φ{x} ≡ ψ{x})› for x
    by (metis "Act-Basic:5" "≡E"(2))
  AOT_hence ‹∀x \<A>(φ{x} ≡ ψ{x})›
    by (rule "∀I")
  AOT_thus ‹\<A>∀x (φ{x} ≡ ψ{x})›
    using "logic-actual-nec:3"[axiom_inst, THEN "≡E"(2)] by fast
qed

AOT_theorem "!box-desc:1": ‹∃!x ◻φ{x} → ∀y (y = \<iota>x φ{x} → φ{y})›
proof(rule "→I")
  AOT_assume ‹∃!x ◻φ{x}›
  AOT_hence ζ: ‹∃x (◻φ{x} & ∀z (◻φ{z} → z = x))›
    using "uniqueness:1"[THEN "≡_dfE"] by blast
  then AOT_obtain b where θ: ‹◻φ{b} & ∀z (◻φ{z} → z = b)›
    using "instantiation"[rotated] by blast
  AOT_show ‹∀y (y = \<iota>x φ{x} → φ{y})›
  proof(rule GEN; rule "→applyjava.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 68
    fix y
    AOT_assume <    using
    AOT_hence java.lang.NullPointerException
 using "nec-hintikka-scheme"[THEN "≡E"(1)] by blast
 AOT_hence ‹\Aφ{b} → b = y›
 using "&E" "∀E" by blast
 moreover AOT_have ‹:fun and z::x
 using θ[THEN "&E"(1)] by (metis "nec-imp-act" "→E")
 ultimately AOT_have ‹b = y›
 using "→E" by blast
 moreover AOT_have ‹φ{b}›
 using θ[THEN "&E"(1)] by (metis "qml:2"[axiom_inst] "→E")
 ultimately AOT_show ‹φ(ominal_induct c avoidin:z x v rule:fun_t.strong_induct)
 using "rule=E" by blast
 qed
 

  "!box-desc:2":
 ‹∀
 (rule "→I"; rule "→
 AOT_assume ‹\<forall  
 moreover AOT_assume ‹ fun_typ_q : has_subst_v
 ultimately AOT_have ‹∃
 using "nec-exist-!"[THEN "→E", THEN "→E"] by blast
 AOT_thus ‹∀
 using "!box-desc:1" "→E" by blast
 

(* Note: vacuous in the embedding. *)
AOT_theorem "dr-alphabetic-thm": ‹\<  fix
 by (simp add: "rule=I:1" "→I")

 ‹The Theory of Necessity›
 ‹\label{PLM: 9.9}›

  "RM:1[prem]":
 assumes ‹x::::x nd c::un_typ_ and z::x
 shows ‹◻Γ \⊨_\◻ ◻φ → ◻ψ›
  -
 AOT_have ‹◻Γ \⊨_\◻ ◻(φ → ψ)›
 using "RN[prem]" assms by blast
 AOT_thus ‹◻Γ \⊨_\◻ ◻φ → ◻ψ›c avoidi: x z ru
 by (metis "qml:1"[axiom_inst] "→E")
 

  "RM:1":
 assumes ‹\⊨_\◻ φ → ψ›
 shows ‹\⊨_\◻ ◻φ → ◻ψ›
 using "RM:1[prem]" assms by blast

  RM = "RM:1"

  "RM:2[prem]":
 assumes ‹Γ \⊨_\◻ φ → ψ›
 shows ‹◻Γ \⊨_\◻ ♢φ →
  -
 AOT_have ‹Γ \⊨_\◻ ¬ψ →
 using assms
 by (simp add: "contraposition:1[1]")
 AOT_hence ‹◻Γ \⊨_\◻ ◻¬ψ → ◻¬φ›
 using "RM:1[prem]" by blast  subst_dv_f:
 AOT_thus ‹\<box  <v= fst ` setD Δ"
 by (meson "≡_dfE" "≡_dfI" "conventions:5" "→I" "modus-tollens:1")
 

  "RM:2":
 assumes ‹\⊨
 shows ‹x':: and x::x and v::v and c':c
 using "RM:2[prem]" assms by blast

  "RM♢" = "RM:2"

  "RM:3[prem]":
 assumes ‹Γ \⊨_\◻ φ ≡ ψ›
 shows ‹◻\proof-
  -
 AOT_have ‹Γ \⊨_\◻ φ → ψ› ?hes usi as pro(ind \Gammarul: 🚫
 using assms "≡E" "→I" by metis+
 AOT_hence ‹◻Γ \⊨x', b', c')∈False toSet.simps by auto
 using "RM:1[prem]" by metis+
 AOT_thus ‹◻Γ \⊨_\◻ ◻φ ≡ ◻ψ›
 by (simp add: "≡I")
 

 RM:3":
 assumes ‹\⊨_\◻ φ ≡ ψ›
 shows ‹\⊨_\◻ ◻φ ≡ ◻ψ›
 using "RM:3[prem]" assms by blast

  RE = "RM:3"

  "RM:4[prem]":
 assumes ‹Γ \⊨_\◻ φ ≡ ψ›
 shows ‹◻Γ \⊨_\◻ ♢φ ≡ ♢ψ›
  -
 AOT_have ‹Γ \⊨_\◻ φ → ψ› and ‹Γ \⊨_\◻ ψ → φ›
 using assms "≡E" "→I" by metis+
 AOT_hence ‹◻Γ \⊨_\◻ ♢
 using "RM:2[prem]" by metis+
java.lang.NullPointerException
 by (simp add: "≡
 

  "RM:4":
 assumes ‹\⊨_\◻ φassum "j \s t \and> j \<x
 shows ‹\⊨₍ \s> subs ti x)
 using "RM:4[prem]" assms by blast

  "RE♢" = "RM:4"

  "KBasic:1": ‹◻φ → ◻(ψ → φ)›
 by (simp add: RM "pl:1"[axiom_inst])

  "KBasic:2": ‹◻¬φ → ◻(φ → ψ)›
 by (simp add: RM "useful-tautologies:3")

  "KBasic:3": ‹◻(φ & ψ) ≡ (◻φ
  (rule "≡I"; rule "→I")
 AOT_assume ‹◻(φ & ψ)›
 AOT_thus ‹◻φ & ◻ψ›
 by (meson RM "&I" "Conjunction Simplification"(1, 2) "→E")
 
 AOT_have ‹◻φ → ◻(ψ → (φ & ψ
 by (simp add: "RM:1" Adjunction)
 AOT_hence ‹◻φ → (◻ψ → ◻(φ & ψ subst_g_ass:
 by (metis "Hypothetical Syllogism" "qml:1"[axiom_inst])
 moreover AOT_assume ‹◻φ & ◻ψ›
 ultimately AOT_show ‹◻(φ & ψ)›
 using "→E" "&E" by blast
 

  "KBasic:4": ‹◻(φ ≡ ψ) ≡ (◻(φ → ψ) & ◻(ψ → φ))›
  -
 AOT_have θ: ‹◻((φ → ψ) & (ψ → φ)) ≡ (◻(φ → ψ) & ◻(ψ → φ))›
 by (fact "KBasic:3")
 AOT_modally_strict {
 AOT_have ‹(φ ≡ ψ) ≡ ((φ → ψ) & (ψ → φ))›
 >Df"])
 }
 AOT_hence ξ: ‹◻(φ ≡ ψ) ≡ ◻((φ → ψ) & (ψ →
 by (rule RE)
 with ξ and θ AOT_show ‹◻(φ ≡ ψ) ≡ (◻(φ → ψ) & ◻(ψ → φ))›
 using "≡E"(5) by blast
 

  "KBasic:5": ‹(◻(φ → ψ) & ◻(ψ → φ)) → (◻φ ≡ ◻ψ)›
  -
 AOT_have ‹◻(φ → ψ) → (◻φ → ◻ψ)›
 by (fact "qml:1"[axiom_inst])
 moreover AOT_have ‹◻(ψ → φ) → (◻ψ → ◻φ)›
 by (fact "qml:1"[axiom_inst])
 ultimately AOT_have ‹(◻(φ → ψ) & ◻(ψ → φ)) → ((◻φ → ◻ψ) & (tyle='font-size: 18px;'>◻ψ → ◻φ))›
 by (metis "&I" MP "Double Composition")
 moreover AOT_have ‹((◻φ → ◻ψ) & (◻ψ → ◻φ)) → (◻φ ≡ ◻ψ)›
 using "conventions:3"[THEN "≡_dfI"] "→I" by blast
 ultimately AOT_show ‹(◻(φ → ψ) & ◻(ψ → φ)) → (◻φ ≡ ◻ψ)›
 by (metis "Hypothetical Syllogism")
 

  "KBasic:6": ‹◻(φ ≡ ψ) → (◻φ ≡ ◻ψ)›
 using "KBasic:4" "KBasic:5" "deduction-theorem" "≡E"(1) "→E" by blast
  "KBasic:7": ‹((◻φ & ◻ψ) ∨ (◻¬φ & ◻¬ψ)) → ◻(φ ≡ ψ)›
  (rule "→I"; drule "∨E"(1); (rule "→I")?)
 AOT_assume ‹◻φ & ◻ψ›
 AOT_hence ‹◻φ› and ‹◻ψ› using "&E" by blast+
 AOT_hence ‹◻(φ → ψ)› and ‹◻(ψ → φ)› using "KBasic:1" "→E" by blast+
 AOT_hence ‹◻(φ → ψ) & ◻(ψ → φ)› using "&I" by blast
 AOT_thus ‹◻(φ ≡ ψ)› by (metis "KBasic:4" "≡E"(2))
 
 AOT_assume ‹◻¬φ & ◻¬ψ›
 AOT_hence 0: ‹◻(¬φ & ¬ψ)› using "KBasic:3"[THEN "≡E"(2)] by blast
 AOT_modally_strict {
 AOT_have ‹(¬φ & ¬ψ) → (φ ≡ ψ)›
 by (metis "&E"(1) "&E"(2) "deduction-theorem" "≡I" "reductio-aa:1")
 }
 AOT_hence ‹◻(¬φ & ¬ψ) → ◻(φ ≡ ψ)›
 by (rule RM)
 AOT_thus ‹◻(φ ≡ ψ)› using 0 "→E" by blast
 (auto)

  "KBasic:8": ‹◻(φ & ψ) → ◻(φ ≡ ψ)›
 by (meson "RM:1" "&E"(1) "&E"(2) "deduction-theorem" "≡I")
  "KBasic:9": ‹◻(¬φ & ¬ψ) → ◻(φ ≡ ψ)›
 by (metis "RM:1" "&E"(1) "&E"(2) "deduction-theorem" "≡I" "raa-cor:4")
  "KBasic:10": ‹◻φ ≡ ◻¬¬φ›
 by (simp add: "RM:3" "oth-class-taut:3:b")
  "KBasic:11": ‹¬◻φ ≡ ♢¬φ›
  (rule "≡I"; rule "→I")
 AOT_show ‹♢¬φ› if ‹¬◻φ›
 using that "≡_dfI" "conventions:5" "KBasic:10" "≡E"(3) by blast
 
 AOT_show ‹¬◻φ› if ‹♢¬φ›
 using "≡_dfE" "conventions:5" "KBasic:10" "≡E"(4) that by blast
 
  "KBasic:12": ‹◻φ ≡ ¬♢¬φ›
  (rule "≡I"; rule "→I")
 AOT_show ‹¬♢¬φ› if ‹◻φ›
 using "¬¬I" "KBasic:11" "≡E"(3) that by blast
 
 AOT_show ‹◻φ› if ‹¬♢¬φ›
 using "KBasic:11" "≡E"(1) "reductio-aa:1" that by blast
 
  "KBasic:13": ‹◻(φ → ψ) → (♢φ → ♢ψ)›
  -
 AOT_have ‹φ → ψ \⊨_\◻ φ → ψ› by blast
 AOT_hence ‹◻(φ → ψ) \⊨_\◻ ♢φ → ♢ψ›
 using "RM:2[prem]" by blast
 AOT_thus ‹◻(φ → ψ) → (♢φ → ♢ψ)› using "→I" by blast
 
  "K♢" = "KBasic:13"
  "KBasic:14": ‹♢◻φ ≡ ¬◻♢¬φ›
 by (meson "RE♢" "KBasic:11" "KBasic:12" "≡E"(6) "oth-class-taut:3:a")
  "KBasic:15": ‹(◻φ ∨ ◻ψ) → ◻(φ ∨ ψ)›
  -
 AOT_modally_strict {
 AOT_have ‹φ → (φ ∨ ψ)› and ‹ψ → (φ ∨ ψ)›
 by (auto simp: "Disjunction Addition"(1) "Disjunction Addition"(2))
 }
 AOT_hence ‹◻φ → ◻(φ ∨ ψ)› and ‹◻ψ → ◻(φ ∨ ψ)›
 using RM by blast+
 AOT_thus ‹(◻φ ∨ ◻ψ) → ◻(φ ∨ ψ)›
 by (metis "∨E"(1) "deduction-theorem")
 

  "KBasic:16": ‹(◻φ & ♢ψ) → ♢(φ & ψ)›
 by (meson "KBasic:13" "RM:1" Adjunction "Hypothetical Syllogism"
 Importation "→E")

  "rule-sub-lem:1:a":
 assumes ‹\⊨_\◻ ◻(ψ ≡ χ)›
 shows ‹\⊨_\◻ ¬ψ ≡ ¬χ›
 using "qml:2"[axiom_inst, THEN "→E", OF assms]
 "≡E"(1) "oth-class-taut:4:b" by blast

  "rule-sub-lem:1:b":
 assumes ‹\⊨_\◻ ◻(ψ ≡ χ)›
 shows ‹\⊨_\◻ (ψ → Θ) ≡ (χ → Θ)›
 using "qml:2"[axiom_inst, THEN "→E", OF assms]
 using "oth-class-taut:4:c" "vdash-properties:6" by blast

  "rule-sub-lem:1:c":
 assumes ‹\⊨_\◻ ◻(ψ ≡ χ)›
 shows ‹\⊨_\◻ (Θ → ψ) ≡ (Θ → χ)›
 using "qml:2"[axiom_inst, THEN "→E", OF assms]
 using "oth-class-taut:4:d" "vdash-properties:6" by blast

  "rule-sub-lem:1:d":
 assumes ‹for arbitrary α: \⊨_\◻ ◻(ψ{α} ≡ χ{α})›
 shows ‹\⊨_\◻ ∀α ψ{α} ≡ ∀α χ{α}›
  -
 AOT_modally_strict {
 AOT_have ‹∀α (ψ{α} ≡ χ{α})›
 using "qml:2"[axiom_inst, THEN "→E", OF assms] "∀I" by fast
 AOT_hence 0: ‹ψ{α} ≡ χ{α}› for α using "∀E" by blast
 AOT_show ‹∀α ψ{α} ≡ ∀α χ{α}›
 proof (rule "≡I"; rule "→I")
 AOT_assume ‹∀α ψ{α}›
 AOT_hence ‹ψ{α}› for α using "∀E" by blast
 AOT_hence ‹χ{α}› for α using 0 "≡E" by blast
 AOT_thus ‹∀α χ{α}› by (rule "∀I")
 next
 AOT_assume ‹∀α χ{α}›
 AOT_hence ‹χ{α}› for α using "∀E" by blast
 AOT_hence ‹ψ{α}› for α using 0 "≡E" by blast
 AOT_thus ‹∀α ψ{α}› by (rule "∀I")
 qed
 }
 

  "rule-sub-lem:1:e":
 assumes ‹\⊨_\◻ ◻(ψ ≡ χ)›
 shows ‹\⊨_\◻ [λ ψ] ≡ [λ χ]›
 using "qml:2"[axiom_inst, THEN "→E", OF assms]
 using "≡E"(1) "propositions-lemma:6" by blast

  "rule-sub-lem:1:f":
 assumes ‹\⊨_\◻ ◻(ψ ≡ χ)›
 shows ‹\⊨_\◻ \Aψ ≡ \Aχ›
 using "qml:2"[axiom_inst, THEN "→E", OF assms, THEN "RA[2]"]
 by (metis "Act-Basic:5" "≡E"(1))

  "rule-sub-lem:1:g":
 assumes ‹\⊨_\◻ ◻(ψ ≡ χ)›
 shows ‹\⊨_\◻ ◻ψ ≡ ◻χ›
 using "KBasic:6" assms "vdash-properties:6" by blast

 ‹Note that instead of deriving @{text "rule-sub-lem:2"},
 @{text "rule-sub-lem:3"}, @{text "rule-sub-lem:4"},
 and @{text "rule-sub-nec"}, we construct substitution methods instead.›

  AOT_subst =
 fixes AOT_subst :: "('a → o) → bool"
 and AOT_subst_cond :: "'a → 'a → bool"
 assumes AOT_subst:
 "AOT_subst φ ==> AOT_subst_cond ψ χ ==> [v ⊨ «φ ψ¬ ≡ «φ χ¬]"

  AOT_substI

  o :: AOT_subst
 

  AOT_subst_o where
 AOT_subst_o_id[AOT_substI]:
 ‹AOT_subst_o (λφ. φ)›
 | AOT_subst_o_const[AOT_substI]:
 ‹AOT_subst_o (λφ. ψ)›
 | AOT_subst_o_not[AOT_substI]:
 ‹AOT_subst_o Θ ==> AOT_subst_o (λ φ. «¬Θ{φ}¬)›
 | AOT_subst_o_imp[AOT_substI]:
 ‹AOT_subst_o Θ ==> AOT_subst_o Ξ ==> AOT_subst_o (λ φ. «Θ{φ} → Ξ{φ}¬)›
 | AOT_subst_o_lambda0[AOT_substI]:
 ‹AOT_subst_o Θ ==> AOT_subst_o (λ φ. (AOT_lambda0 (Θ φ)))›
 | AOT_subst_o_act[AOT_substI]:
 ‹AOT_subst_o Θ ==> AOT_subst_o (λ φ. «\AΘ{φ}¬)›
 | AOT_subst_o_box[AOT_substI]:
 ‹AOT_subst_o Θ ==> AOT_subst_o (λ φ. «◻Θ{φ}¬)›
 | AOT_subst_o_by_def[AOT_substI]:
 ‹(∧ ψ . AOT_model_equiv_def (Θ ψ) (Ξ ψ)) ==>
 AOT_subst_o Ξ ==> AOT_subst_o Θ›


  AOT_subst_cond_o where
 ‹AOT_subst_cond_o ≡ λ ψ χ . ∀ v . [v ⊨ ψ ≡ χ]›

 
 
 fix ψ χ :: o and φ :: ‹o → o›
 assume cond: ‹AOT_subst_cond ψ χ›
 assume ‹AOT_subst φ›
 moreover AOT_have ‹\⊨_\◻ ψ ≡ χ›
 using cond unfolding AOT_subst_cond_o_def by blast
 ultimately AOT_show ‹\⊨_\◻ φ{ψ} ≡ φ{χ}›
 proof (induct arbitrary: ψ χ)
 case AOT_subst_o_id
 thus ?case
 using "≡E"(2) "oth-class-taut:4:b" "rule-sub-lem:1:a" by blast
 next
 case (AOT_subst_o_const ψ)
 thus ?case
 by (simp add: "oth-class-taut:3:a")
 next
 case (AOT_subst_o_not Θ)
 thus ?case
 by (simp add: RN "rule-sub-lem:1:a")
 next
 case (AOT_subst_o_imp Θ Ξ)
 thus ?case
 by (meson RN "≡E"(5) "rule-sub-lem:1:b" "rule-sub-lem:1:c")
 next
 case (AOT_subst_o_lambda0 Θ)
 thus ?case
 by (simp add: RN "rule-sub-lem:1:e")
 next
 case (AOT_subst_o_act Θ)
 thus ?case
 by (simp add: RN "rule-sub-lem:1:f")
 next
 case (AOT_subst_o_box Θ)
 thus ?case
 by (simp add: RN "rule-sub-lem:1:g")
 next
 case (AOT_subst_o_by_def Θ Ξ)
 AOT_modally_strict {
 AOT_have ‹Ξ{ψ} ≡ Ξ{χ}›
 using AOT_subst_o_by_def by simp
 AOT_thus ‹Θ{ψ} ≡ Θ{χ}›
 using "≡Df"[OF AOT_subst_o_by_def(1), of _ ψ]
 "≡Df"[OF AOT_subst_o_by_def(1), of _ χ]
 by (metis "≡E"(6) "oth-class-taut:3:a")
 }
 qed
 
 

  "fun" :: (AOT_Term_id_2, AOT_subst) AOT_subst
 

  AOT_subst_cond_fun :: ‹('a → 'b) → ('a → 'b) → bool› where
 ‹AOT_subst_cond_fun ≡ λ φ ψ . ∀ α . AOT_subst_cond (φ (AOT_term_of_var α))
 (ψ (AOT_term_of_var α))›

  AOT_subst_fun :: ‹(('a → 'b) → o) → bool› where
 AOT_subst_fun_const[AOT_substI]:
 ‹AOT_subst_fun (λφ. ψ)›
 | AOT_subst_fun_id[AOT_substI]:
 ‹AOT_subst Ψ ==> AOT_subst_fun (λφ. Ψ (φ (AOT_term_of_var α)))›
 | AOT_subst_fun_all[AOT_substI]:
 ‹AOT_subst Ψ ==> (∧ α . AOT_subst_fun (Θ (AOT_term_of_var α))) ==>
 AOT_subst_fun (λφ :: 'a → 'b. Ψ «∀α «Θ (α::'a) φ¬¬)›
 | AOT_subst_fun_not[AOT_substI]:
 ‹AOT_subst Ψ ==> AOT_subst_fun (λφ. «¬«Ψ φ¬¬)›
 | AOT_subst_fun_imp[AOT_substI]:
 ‹AOT_subst Ψ ==> AOT_subst Θ ==> AOT_subst_fun (λφ. ««Ψ φ¬ → «Θ φ¬¬)›
 | AOT_subst_fun_lambda0[AOT_substI]:
 ‹AOT_subst Θ ==> AOT_subst_fun (λ φ. (AOT_lambda0 (Θ φ)))›
 | AOT_subst_fun_act[AOT_substI]:
 ‹AOT_subst Θ ==> AOT_subst_fun (λ φ. «\A«Θ φ¬¬)›
 | AOT_subst_fun_box[AOT_substI]:
 ‹AOT_subst Θ ==> AOT_subst_fun (λ φ. «◻«Θ φ¬¬)›
 | AOT_subst_fun_def[AOT_substI]:
 ‹(∧ φ . AOT_model_equiv_def (Θ φ) (Ψ φ)) ==>
 AOT_subst_fun Ψ ==> AOT_subst_fun Θ›

  proof
 fix ψ χ :: ‹'a → 'b› and φ :: ‹('a → 'b) → o›
 assume ‹AOT_subst φ›
 moreover assume cond: ‹AOT_subst_cond ψ χ›
 ultimately AOT_show ‹\⊨_\◻ «φ ψ¬ ≡ «φ χ¬›
 proof(induct)
 case (AOT_subst_fun_const ψ)
 then show ?case by (simp add: "oth-class-taut:3:a")
 next
 case (AOT_subst_fun_id Ψ x)
 then show ?case by (simp add: AOT_subst AOT_subst_cond_fun_def)
 next
 next
 case (AOT_subst_fun_all Ψ Θ)
 AOT_have ‹\⊨_\◻ ◻(Θ{α, «ψ¬} ≡ Θ{α, «χ¬})› for α
 using AOT_subst_fun_all.hyps(3) AOT_subst_fun_all.prems RN by presburger
 thus ?case using AOT_subst[OF AOT_subst_fun_all(1)]
 by (simp add: RN "rule-sub-lem:1:d"
 AOT_subst_cond_fun_def AOT_subst_cond_o_def)
 next
 case (AOT_subst_fun_not Ψ)
 then show ?case by (simp add: RN "rule-sub-lem:1:a")
 next
 case (AOT_subst_fun_imp Ψ Θ)
 then show ?case
 unfolding AOT_subst_cond_fun_def AOT_subst_cond_o_def
 by (meson "≡E"(5) "oth-class-taut:4:c" "oth-class-taut:4:d" "→E")
 next
 case (AOT_subst_fun_lambda0 Θ)
 then show ?case by (simp add: RN "rule-sub-lem:1:e")
 next
 case (AOT_subst_fun_act Θ)
 then show ?case by (simp add: RN "rule-sub-lem:1:f")
 next
 case (AOT_subst_fun_box Θ)
 then show ?case by (simp add: RN "rule-sub-lem:1:g")
 next
 case (AOT_subst_fun_def Θ Ψ)
 then show ?case
 by (meson "df-rules-formulas[3]" "df-rules-formulas[4]" "≡I" "≡E"(5))
 qed
 
 

 ‹
  prove_AOT_subst_tac ctxt = REPEAT (SUBGOAL (fn (trm,_) => let
 fun findHeadConst (Const x) = SOME x
 | findHeadConst (A $ _) = findHeadConst A
 | findHeadConst _ = NONE
 fun findDef (Const (const_name‹AOT_model_equiv_def›, _) $ lhs $ _)
 = findHeadConst lhs
 | findDef (A $ B) = (case findDef A of SOME x => SOME x | _ => findDef B)
 | findDef (Abs (_,_,c)) = findDef c
 | findDef _ = NONE
 val const_opt = (findDef trm)
 val defs = case const_opt of SOME const => List.filter (fn thm => let
 val concl = Thm.concl_of thm
 val thmconst = (findDef concl)
 in case thmconst of SOME (c,_) => fst const = c | _ => false end)
 (AOT_Definitions.get ctxt)
 | _ => []
 val tac = case defs of
 [] => safe_step_tac (ctxt addSIs @{thms AOT_substI}) 1
 | _ => resolve_tac ctxt defs 1
 in tac end) 1)
  getSubstThm ctxt reversed phi p q = let
  p_ty = Term.type_of p
  abs = HOLogic.mk_Trueprop (@{const AOT_subst(_)} $ phi)
  abs = Syntax.check_term ctxt abs
  substThm = Goal.prove ctxt [] [] abs
 (fn {context=ctxt, prems=_} => prove_AOT_subst_tac ctxt)
  substThm = substThm RS @{thm AOT_subst}
  if reversed then let
 val substThm = Drule.instantiate_normalize
 (TVars.empty, Vars.make [((("χ", 0), p_ty), Thm.cterm_of ctxt p),
 ((("ψ", 0), p_ty), Thm.cterm_of ctxt q)]) substThm
 val substThm = substThm RS @{thm "≡E"(1)}
 in substThm end
 
 let
 val substThm = Drule.instantiate_normalize
 (TVars.empty, Vars.make [((("ψ", 0), p_ty), Thm.cterm_of ctxt p),
 ((("χ", 0), p_ty), Thm.cterm_of ctxt q)]) substThm
 val substThm = substThm RS @{thm "≡E"(2)}
 in substThm end end
 ›

  AOT_subst = ‹
 .option (Scan.lift (Args.parens (Args.$$$ "reverse"))) --
 .lift (Parse.embedded_inner_syntax -- Parse.embedded_inner_syntax) --
 .option (Scan.lift (Args.$$$ "for" -- Args.colon) |--
 .repeat1 (Scan.lift (Parse.embedded_inner_syntax) --
 .option (Scan.lift (Args.$$$ "::" |-- Parse.embedded_inner_syntax))))
 > (fn ((reversed,(raw_p,raw_q)),raw_bounds) => (fn ctxt =>
 Method.SIMPLE_METHOD (Subgoal.FOCUS (fn {context = ctxt, params = _,
 prems = prems, asms = asms, concl = concl, schematics = _} =>
 
  thms = prems
  ctxt' = ctxt
  ctxt = Context_Position.set_visible false ctxt
  raw_bounds = case raw_bounds of SOME bounds => bounds | _ => []

  ctxt = (fold (fn (bound, ty) => fn ctxt =>
 let
 val bound = AOT_read_term @{nonterminal τ'} ctxt bound
 val ty = Option.map (Syntax.read_typ ctxt) ty
 val ctxt = case ty of SOME ty => let
 val bound = Const ("_type_constraint_", Type ("fun", [ty,ty])) $ bound
 val bound = Syntax.check_term ctxt bound
 in Variable.declare_term bound ctxt end | _ => ctxt
 in ctxt end)) raw_bounds ctxt

  p = AOT_read_term @{nonterminal φ'} ctxt raw_p
  p = Syntax.check_term ctxt p
  ctxt = Variable.declare_term p ctxt
  q = AOT_read_term @{nonterminal φ'} ctxt raw_q
  q = Syntax.check_term ctxt q
  ctxt = Variable.declare_term q ctxt

  bounds = (map (fn (bound, _) =>
 Syntax.check_term ctxt (AOT_read_term @{nonterminal τ'} ctxt bound)
 ) raw_bounds
  p = fold (fn bound => fn p =>
 Term.abs ("α", Term.type_of bound) (Term.abstract_over (bound,p)))
 bounds p
  p = Syntax.check_term ctxt p
  p_ty = Term.type_of p

  pat = @{const Trueprop} $
 (@{const AOT_model_valid_in} $ Var (("w",0), @{typ w}) $
 (Var (("φ",0), Type (type_name‹fun›, [p_ty, @{typ o}])) $ p))
  univ = Unify.matchers (Context.Proof ctxt) [(pat, Thm.term_of concl)]
val univ = hd (Seq.list_of univ) (* TODO: consider all matches *)
val phi = the (Envir.lookup univ
  (("φ",0), Type (type_name‹fun›, [p_ty, @{typ o}])))

val q = fold (fn bound => fn q =>
  Term.abs ("α", Term.type_of bound) (Term.abstract_over (bound,q))) bounds q
val q = Syntax.check_term ctxt q

(* Reparse to report bounds as fixes. *)
val ctxt = Context_Position.restore_visible ctxt' ctxt
val ctxt' = ctxt
fun unsource str = fst (Input.source_content (Syntax.read_input str))
val (_,ctxt') = Proof_Context.add_fixes (map (fn (str,_) =>
  (Binding.make (unsource str, Position.none), NONE, Mixfix.NoSyn)) raw_bounds)
  ctxt'
val _ = (map (fn (x,_) =>
  Syntax.check_term ctxt (AOT_read_term @{nonterminal τ'} ctxt' x)))
  raw_bounds
val _ = AOT_read_term @{nonterminal φ'} ctxt' raw_p
val _ = AOT_read_term @{nonterminal \<phi>'} ctxt' raw_q
val reversed = case reversed of SOME _ => true | _ => false
val simpThms = [@{thm AOT_subst_cond_\<o>_def}, @{thm AOT_subst_cond_fun_def}]
in
resolve_tac ctxt [getSubstThm ctxt reversed phi p q] 1
THEN simp_tac (ctxt addsimps simpThms) 1
THEN (REPEAT (resolve_tac ctxt [@{thm allI}] 1))
THEN (TRY (resolve_tac ctxt thms 1))
end
) ctxt 1))))
\<close>

method_setup AOT_subst_def = \<open>
Scan.option (Scan.lift (Args.parens (Args.$$$ "reverse"))) --
Attrib.thm
>> (fn (reversed,fact) => (fn ctxt =>
(Method.SIMPLE_METHOD (Subgoal.FOCUS (fn {context = ctxt, params = _,
  prems = prems, asms = asms, concl = concl, schematics = _} =>
let
val c = Thm.concl_of fact
val (lhs, rhs) = case c of (\<^const>\<open>Trueprop\<close> $
    (\<^const>\<open>AOT_model_equiv_def\<close> $ lhs $ rhs)) => (lhs, rhs)
  | _ => raise Fail "Definition expected."
val substCond = HOLogic.mk_Trueprop
  (Const (\<^const_name>\<open>AOT_subst_cond\<close>, dummyT) $ lhs $ rhs)
val substCond = Syntax.check_term
  (Proof_Context.set_mode Proof_Context.mode_schematic ctxt)
  substCond
val simpThms = [@{thm AOT_subst_cond_\<o>_def},
  @{thm AOT_subst_cond_fun_def},
  fact RS @{thm "\<equiv>Df"}]
val substCondThm = Goal.prove ctxt [] [] substCond
  (fn {context=ctxt, prems=prems} =>
      (SUBGOAL (fn (trm,int) =>
        auto_tac (ctxt addsimps simpThms)) 1))
val substThm = substCondThm RSN (2,@{thm AOT_subst})
in
resolve_tac ctxt [substThm RS
  (case reversed of NONE => @{thm "\<equiv>E"(2)} | _ => @{thm "\<equiv>E"(1)})] 1
THEN prove_AOT_subst_tac ctxt
THEN (TRY (resolve_tac ctxt prems 1))
end
) ctxt 1))))
\<close>

method_setup AOT_subst_thm = \<open>
Scan.option (Scan.lift (Args.parens (Args.$$$ "reverse"))) --
Attrib.thm
>> (fn (reversed,fact) => (fn ctxt =>
(Method.SIMPLE_METHOD (Subgoal.FOCUS (fn {context = ctxt, params = _,
  prems = prems, asms = asms, concl = concl, schematics = _} =>
let
val c = Thm.concl_of fact
val (lhs, rhs) = case c of
  (\<^const>\<open>Trueprop\<close> $
   (\<^const>\<open>AOT_model_valid_in\<close> $ _ $
    (\<^const>\<open>AOT_equiv\<close> $ lhs $ rhs))) => (lhs, rhs)
  | _ => raise Fail "Equivalence expected."

val substCond = HOLogic.mk_Trueprop
  (Const (\<^const_name>\<open>AOT_subst_cond\<close>, dummyT) $ lhs $ rhs)
val substCond = Syntax.check_term
  (Proof_Context.set_mode Proof_Context.mode_schematic ctxt)
  substCond
val simpThms = [@{thm AOT_subst_cond_\<o>_def},
  @{thm AOT_subst_cond_fun_def},
  fact]
val substCondThm = Goal.prove ctxt [] [] substCond
  (fn {context=ctxt, prems=prems} =>
      (SUBGOAL (fn (trm,int) => auto_tac (ctxt addsimps simpThms)) 1))
val substThm = substCondThm RSN (2,@{thm AOT_subst})
in
resolve_tac ctxt [substThm RS
  (case reversed of NONE => @{thm "\<equiv>E"(2)} | _ => @{thm "\<equiv>E"(1)})] 1
THEN prove_AOT_subst_tac ctxt
THEN (TRY (resolve_tac ctxt prems 1))
end
) ctxt 1))))
\<close>

AOT_theorem "rule-sub-remark:1[1]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close> and \<open>\<not>A!x\<close>
  shows \<open>\<not>\<not>\<diamond>E!x\<close>
  by (AOT_subst (reverse) \<open>\<not>\<diamond>E!x\<close> \<open>A!x\<close>)
     (auto simp: assms) 

AOT_theorem "rule-sub-remark:1[2]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close> and  \<open>\<not>\<not>\<diamond>E!x\<close>
  shows \<open>\<not>A!x\<close>
  by (AOT_subst \<open>A!x\<close> \<open>\<not>\<diamond>E!x\<close>)
     (auto simp: assms)

AOT_theorem "rule-sub-remark:2[1]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> [R]xy \<equiv> ([R]xy & ([Q]a \<or> \<not>[Q]a))\<close>
      and \<open>p \<rightarrow> [R]xy\<close>
  shows \<open>p \<rightarrow> [R]xy & ([Q]a \<or> \<not>[Q]a)\<close>
  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:2[2]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> [R]xy \<equiv> ([R]xy & ([Q]a \<or> \<not>[Q]a))\<close>
      and \<open>p \<rightarrow> [R]xy & ([Q]a \<or> \<not>[Q]a)\<close>
  shows \<open>p \<rightarrow> [R]xy\<close>
  by (AOT_subst_thm assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:3[1]":
  assumes \<open>for arbitrary x: \<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close>
      and \<open>\<exists>x A!x\<close>
    shows \<open>\<exists>x \<not>\<diamond>E!x\<close>
  by (AOT_subst (reverse) \<open>\<not>\<diamond>E!x\<close> \<open>A!x\<close> for: x)
     (auto simp: assms)

AOT_theorem "rule-sub-remark:3[2]":
  assumes \<open>for arbitrary x: \<^bold>\<turnstile>\<^sub>\<box> A!x \<equiv> \<not>\<diamond>E!x\<close>
      and \<open>\<exists>x \<not>\<diamond>E!x\<close>
    shows \<open>\<exists>x A!x\<close>
  by (AOT_subst \<open>A!x\<close> \<open>\<not>\<diamond>E!x\<close> for: x)
     (auto simp: assms)

AOT_theorem "rule-sub-remark:4[1]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<not>[P]x \<equiv> [P]x\<close> and \<open>\<^bold>\<A>\<not>\<not>[P]x\<close>
  shows \<open>\<^bold>\<A>[P]x\<close>
  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:4[2]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<not>[P]x \<equiv> [P]x\<close> and \<open>\<^bold>\<A>[P]x\<close>
  shows \<open>\<^bold>\<A>\<not>\<not>[P]x\<close>
  by (AOT_subst_thm assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:5[1]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> (\<phi> \<rightarrow> \<psi>) \<equiv> (\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close> and \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
  shows \<open>\<box>(\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close>
  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:5[2]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> (\<phi> \<rightarrow> \<psi>) \<equiv> (\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close> and \<open>\<box>(\<not>\<psi> \<rightarrow> \<not>\<phi>)\<close>
  shows \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close> 
  by (AOT_subst_thm assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:6[1]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<equiv> \<chi>\<close> and \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
  shows \<open>\<box>(\<phi> \<rightarrow> \<chi>)\<close> 
  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:6[2]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<equiv> \<chi>\<close> and \<open>\<box>(\<phi> \<rightarrow> \<chi>)\<close>
  shows \<open>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
  by (AOT_subst_thm assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:7[1]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<not>\<not>\<phi>\<close> and \<open>\<box>(\<phi> \<rightarrow> \<phi>)\<close>
  shows \<open>\<box>(\<not>\<not>\<phi> \<rightarrow> \<phi>)\<close> 
  by (AOT_subst_thm (reverse) assms(1)) (simp add: assms(2))

AOT_theorem "rule-sub-remark:7[2]":
  assumes \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi> \<equiv> \<not>\<not>\<phi>\<close> and \<open>\<box>(\<not>\<not>\<phi> \<rightarrow> \<phi>)\<close>
  shows \<open>\<box>(\<phi> \<rightarrow> \<phi>)\<close>
  by (AOT_subst_thm assms(1)) (simp add: assms(2))

AOT_theorem "KBasic2:1": \<open>\<box>\<not>\<phi> \<equiv> \<not>\<diamond>\<phi>\<close>
  by (meson "conventions:5" "contraposition:2"
            "Hypothetical Syllogism" "df-rules-formulas[3]"
            "df-rules-formulas[4]" "\<equiv>I" "useful-tautologies:1")

AOT_theorem "KBasic2:2": \<open>\<diamond>(\<phi> \<or> \<psi>) \<equiv> (\<diamond>\<phi> \<or> \<diamond>\<psi>)\<close>
proof -
  AOT_have \<open>\<diamond>(\<phi> \<or> \<psi>) \<equiv> \<diamond>\<not>(\<not>\<phi> & \<not>\<psi>)\<close>
    by (simp add: "RE\<diamond>" "oth-class-taut:5:b")
  also AOT_have \<open>\<dots> \<equiv> \<not>\<box>(\<not>\<phi> & \<not>\<psi>)\<close>
    using "KBasic:11" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
  also AOT_have \<open>\<dots> \<equiv> \<not>(\<box>\<not>\<phi> & \<box>\<not>\<psi>)\<close>
    using "KBasic:3" "\<equiv>E"(1) "oth-class-taut:4:b" by blast
  also AOT_have \<open>\<dots> \<equiv> \<not>(\<not>\<diamond>\<phi> & \<not>\<diamond>\<psi>)\<close>
    using "KBasic2:1"
    by (AOT_subst \<open>\<box>\<not>\<phi>\<close> \<open>\<not>\<diamond>\<phi>\<close>; AOT_subst \<open>\<box>\<not>\<psi>\<close> \<open>\<not>\<diamond>\<psi>\<close>;
        auto simp: "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<not>\<not>(\<diamond>\<phi> \<or> \<diamond>\<psi>)\<close>
    using "\<equiv>E"(6) "oth-class-taut:3:b" "oth-class-taut:5:b" by blast
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<phi> \<or> \<diamond>\<psi>\<close>
    by (simp add: "\<equiv>I" "useful-tautologies:1" "useful-tautologies:2")
  finally show ?thesis .
qed

AOT_theorem "KBasic2:3": \<open>\<diamond>(\<phi> & \<psi>) \<rightarrow> (\<diamond>\<phi> & \<diamond>\<psi>)\<close>
  by (metis "RM\<diamond>" "&I" "Conjunction Simplification"(1,2)
            "\<rightarrow>I" "modus-tollens:1" "reductio-aa:1")

AOT_theorem "KBasic2:4": \<open>\<diamond>(\<phi> \<rightarrow> \<psi>) \<equiv> (\<box>\<phi> \<rightarrow> \<diamond>\<psi>)\<close>
proof -
  AOT_have \<open>\<diamond>(\<phi> \<rightarrow> \<psi>) \<equiv> \<diamond>(\<not>\<phi> \<or> \<psi>)\<close>
    by (AOT_subst \<open>\<phi> \<rightarrow> \<psi>\<close> \<open>\<not>\<phi> \<or> \<psi>\<close>)
       (auto simp: "oth-class-taut:1:c" "oth-class-taut:3:a")
  also AOT_have \<open>... \<equiv> \<diamond>\<not>\<phi> \<or> \<diamond>\<psi>\<close>
    by (simp add: "KBasic2:2")
  also AOT_have \<open>... \<equiv> \<not>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
    by (AOT_subst \<open>\<not>\<box>\<phi>\<close> \<open>\<diamond>\<not>\<phi>\<close>)
       (auto simp: "KBasic:11" "oth-class-taut:3:a")
  also AOT_have \<open>... \<equiv> \<box>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
    using "\<equiv>E"(6) "oth-class-taut:1:c" "oth-class-taut:3:a" by blast
  finally show ?thesis .
qed

AOT_theorem "KBasic2:5": \<open>\<diamond>\<diamond>\<phi> \<equiv> \<not>\<box>\<box>\<not>\<phi>\<close>
  using "conventions:5"[THEN "\<equiv>Df"]
  by (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>;
      AOT_subst \<open>\<diamond>\<not>\<box>\<not>\<phi>\<close> \<open>\<not>\<box>\<not>\<not>\<box>\<not>\<phi>\<close>;
      ()\open><ot\not\<box><><>\<close>\open><ox>\not>\phi\<>
         bch_inode_unpacked


AOT_theorem "KBasic2:6": \<open>\<box>(\<phi> \<or> \<psi>) \<rightarrow> (\<box>\<phi> \<or> \<diamond>\<psi>)\<close>
proof(rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<box>(\<phi> \<or> \<psi>)\<close>
  AOT_hence \<open>\<box>(\<not>\<phi> \<rightarrow> \<psi>)\<close>
    using "conventions:2"[THEN "\<equiv>Df"]
    by (AOT_subst (reverse) \<open>\<not>\<phi> \<rightarrow> \<psi>\<close> \<open>\<phi> \<or> \<psi>\<close>) simp
  AOT_hence 1: \<open>\<diamond>\<not>\<phi> \<rightarrow> \<diamond>\<psi>\<close>
    using "KBasic:13" "vdash-properties:10" by blast
  AOT_assume \<open>\<not>(\<box>\<phi> \<or> \<diamond>\<psi>)\<close>
  AOT_hence \<open>\<not>\<box>\<phi>\<close> and \<open>\<not>\<diamond>\<psi>\<close>
    using "&E" "\<equiv>E"(1) "oth-class-taut:5:d" by blast+
  AOT_thus \<open>\<diamond>\<psi> & \<not>\<diamond>\<psi>\<close>
    using "&I"(1) 1[THEN "\<rightarrow>E"] "KBasic:11" "\<equiv>E"(4) "raa-cor:3" by blast
qed

AOT_theorem "KBasic2:7": \<open>(\<box>(\<phi> \<or> \<psi>) & \<diamond>\<not>\<phi>) \<rightarrow> \<diamond>\<psi>\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>\<box>(\<phi> \<or> \<psi>)\<close>
  AOT_hence 1: \<open>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
    using "KBasic2:6" "\<or>I"(2) "\<or>E"(1) by blast
  AOT_assume \<open>\<diamond>\<not>\<phi>\<close>
  AOT_hence \<open>\<not>\<box>\<phi>\<close> using "KBasic:11" "\<equiv>E"(2) by blast
  AOT_thus \<open>\<diamond>\<psi>\<close> using 1 "\<or>E"(2) by blast
qed

AOT_theorem "T-S5-fund:1": \<open>\<phi> \<rightarrow> \<diamond>\<phi>\<close>
  by (meson "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" "contraposition:2"
            "Hypothetical Syllogism" "\<rightarrow>I" "qml:2"[axiom_inst])
lemmas "T\<diamond>" = "T-S5-fund:1"

AOT_theorem "T-S5-fund:2": \<open>\<diamond>\<box>\<phi> \<rightarrow> \<box>\<phi>\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>\<diamond>\<box>\<phi>\<close>
  AOT_hence \<open>\<not>\<box>\<diamond>\<not>\<phi>\<close>
    using "KBasic:14" "\<equiv>E"(4) "raa-cor:3" by blast
  moreover AOT_have \<open>\<diamond>\<not>\<phi> \<rightarrow> \<box>\<diamond>\<not>\<phi>\<close>
    by (fact "qml:3"[axiom_inst])
  ultimately AOT_have \<open>\<not>\<diamond>\<not>\<phi>\<close>
    using "modus-tollens:1" by blast
  AOT_thus \<open>\<box>\<phi>\<close> using "KBasic:12" "\<equiv>E"(2) by blast
qed
lemmas "5\<diamond>" = "T-S5-fund:2"

AOT_theorem "Act-Sub:1": \<open>\<^bold>\<A>\<phi> \<equiv> \<not>\<^bold>\<A>\<not>\<phi>\<close>
  by (AOT_subst \<open>\<^bold>\<A>\<not>\<phi>\<close> \<open>\<not>\<^bold>\<A>\<phi>\<close>)
     (auto simp: "logic-actual-nec:1"[axiom_inst] "oth-class-taut:3:b")

AOT_theorem "Act-Sub:2": \<open>\<diamond>\<phi> \<equiv> \<^bold>\<A>\<diamond>\<phi>\<close>
  using "conventions:5"[THEN "\<equiv>Df"]
  by (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>)
     (metis "deduction-theorem" "\<equiv>I" "\<equiv>E"(1) "\<equiv>E"(2) "\<equiv>E"(3)
            "logic-actual-nec:1"[axiom_inst] "qml-act:2"[axiom_inst])

AOT_theorem "Act-Sub:3": \<open>\<^bold>\<A>\<phi> \<rightarrow> \<diamond>\<phi>\<close>
  using "conventions:5"[THEN "\<equiv>Df"]
  by (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>)
     (metis "Act-Sub:1" "\<rightarrow>I" "\<equiv>E"(4) "nec-imp-act" "reductio-aa:2" "\<rightarrow>E")

AOT_theorem "Act-Sub:4": \<open>\<^bold>\<A>\<phi> \<equiv> \<diamond>\<^bold>\<A>\<phi>\<close>
proof (rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<^bold>\<A>\<phi>\<close>
  AOT_thus \<open>\<diamond>\<^bold>\<A>\<phi>\<close> using "T\<diamond>" "vdash-properties:10" by blast
next
  AOT_assume \<open>\<diamond>\<^bold>\<A>\<phi>\<close>
  AOT_hence \<open>\<not>\<box>\<not>\<^bold>\<A>\<phi>\<close>
    using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" by blast
  AOT_hence \<open>\<not>\<box>\<^bold>\<A>\<not>\<phi>\<close>
    by (AOT_subst \<open>\<^bold>\<A>\<not>\<phi>\<close> \<open>\<not>\<^bold>\<A>\<phi>\<close>)
       (simp add: "logic-actual-nec:1"[axiom_inst])
  AOT_thus \<open>\<^bold>\<A>\<phi>\<close>
    using "Act-Basic:1" "Act-Basic:6" "\<or>E"(3) "\<equiv>E"(4)
          "reductio-aa:1" by blast
qed

AOT_theorem "Act-Sub:5": \<open>\<diamond>\<^bold>\<A>\<phi> \<rightarrow> \<^bold>\<A>\<diamond>\<phi>\<close>
  by (metis "Act-Sub:2" "Act-Sub:3" "Act-Sub:4" "\<rightarrow>I" "\<equiv>E"(1) "\<equiv>E"(2) "\<rightarrow>E")

AOT_theorem "S5Basic:1": \<open>\<diamond>\<phi> \<equiv> \<box>\<diamond>\<phi>\<close>
  by (simp add: "\<equiv>I" "qml:2"[axiom_inst] "qml:3"[axiom_inst])

AOT_theorem "S5Basic:2": \<open>\<box>\<phi> \<equiv> \<diamond>\<box>\<phi>\<close>
  by (simp add: "T\<diamond>" "5\<diamond>" "\<equiv>I")

AOT_theorem "S5Basic:3": \<open>\<phi> \<rightarrow> \<box>\<diamond>\<phi>\<close>
  using "T\<diamond>" "Hypothetical Syllogism" "qml:3"[axiom_inst] by blast
lemmas "B" = "S5Basic:3"

AOT_theorem "S5Basic:4": \<open>\<diamond>\<box>\<phi> \<rightarrow> \<phi>\<close>
  using "5\<diamond>" "Hypothetical Syllogism" "qml:2"[axiom_inst] by blast
lemmas "B\<diamond>" = "S5Basic:4"

AOT_theorem "S5Basic:5": \<open>\<box>\<phi> \<rightarrow> \<box>\<box>\<phi>\<close>
  using "RM:1" "B" "5\<diamond>" "Hypothetical Syllogism" by blast
lemmas "4" = "S5Basic:5"

AOT_theorem "S5Basic:6": \<open>\<box>\<phi> \<equiv> \<box>\<box>\<phi>\<close>
  by (simp add: "4" "\<equiv>I" "qml:2"[axiom_inst])

AOT_theorem "S5Basic:7": \<open>\<diamond>\<diamond>\<phi> \<rightarrow> \<diamond>\<phi>\<close>
  using "conventions:5"[THEN "\<equiv>Df"] "oth-class-taut:3:b"
  by (AOT_subst \<open>\<diamond>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<diamond>\<phi>\<close>;
      AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>;
      AOT_subst (reverse) \<open>\<not>\<not>\<box>\<not>\<phi>\<close> \<open>\<box>\<not>\<phi>\<close>;
      AOT_subst (reverse) \<open>\<box>\<box>\<not>\<phi>\<close> \<open>\<box>\<not>\<phi>\<close>)
     (auto simp: "S5Basic:6" "if-p-then-p")

lemmas "4\<diamond>" = "S5Basic:7"

AOT_theorem "S5Basic:8": \<open>\<diamond>\<diamond>\<phi> \<equiv> \<diamond>\<phi>\<close>
  by (simp add: "4\<diamond>" "T\<diamond>" "\<equiv>I")

AOT_theorem "S5Basic:9": \<open>\<box>(\<phi> \<or> \<box>\<psi>) \<equiv> (\<box>\<phi> \<or> \<box>\<psi>)\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
  using "KBasic2:6" "5\<diamond>" "\<or>I"(3) "if-p-then-p" "vdash-properties:10"
   apply blast
  by (meson "KBasic:15" "4" "\<or>I"(3) "\<or>E"(1) "Disjunction Addition"(1)
            "con-dis-taut:7" "intro-elim:1" "Commutativity of \<or>")

AOT_theorem "S5Basic:10": \<open>\<box>(\<phi> \<or> \<diamond>\<psi>) \<equiv> (\<box>\<phi> \<or> \<diamond>\<psi>)\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<box>(\<phi> \<or> \<diamond>\<psi>)\<close>
  AOT_hence \<open>\<box>\<phi> \<or> \<diamond>\<diamond>\<psi>\<close>
    by (meson "KBasic2:6" "\<or>I"(2) "\<or>E"(1))
  AOT_thus \<open>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
    by (meson "B\<diamond>" "4" "4\<diamond>" "T\<diamond>" "\<or>I"(3))
next
  AOT_assume \<open>\<box>\<phi> \<or> \<diamond>\<psi>\<close>
  AOT_hence \<open>\<box>\<phi> \<or> \<box>\<diamond>\<psi>\<close>
    by (meson "S5Basic:1" "B\<diamond>" "S5Basic:6" "T\<diamond>" "5\<diamond>" "\<or>I"(3) "intro-elim:1")
  AOT_thus \<open>\<box>(\<phi> \<or> \<diamond>\<psi>)\<close>
    by (meson "KBasic:15" "\<or>I"(3) "\<or>E"(1) "Disjunction Addition"(1,2))
qed

AOT_theorem "S5Basic:11": \<open>\<diamond>(\<phi> & \<diamond>\<psi>) \<equiv> (\<diamond>\<phi> &&nbsp;\<diamond>\<psi>)\<close>
proof -
  AOT_have \<open>\<diamond>(\<phi> & \<diamond>\<psi>) \<equiv> \<diamond>\<not>(\<not>\<phi> \<or> \<not>\<diamond>\<psi>)\<close>
    by (AOT_subst \<open>\<phi> & \<diamond>\<psi>\<close> \<open>\<not>(\<not>\<phi> \<or> \<not>\<diamond>\<psi>)\<close>)
       (auto simp: "oth-class-taut:5:a" "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<not>(\<not>\<phi> \<or> \<box>\<not>\<psi>)\<close>
    by (AOT_subst \<open>\<box>\<not>\<psi>\<close> \<open>\<not>\<diamond>\<psi>\<close>)
       (auto simp: "KBasic2:1" "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<not>\<box>(\<not>\<phi> \<or> \<box>\<not>\<psi>)\<close>
    using "KBasic:11" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
  also AOT_have \<open>\<dots> \<equiv> \<not>(\<box>\<not>\<phi> \<or> \<box>\<not>\<psi>)\<close>
    using "S5Basic:9" "\<equiv>E"(1) "oth-class-taut:4:b" by blast
  also AOT_have \<open>\<dots> \<equiv> \<not>(\<not>\<diamond>\<phi> \<or> \<not>\<diamond>\<psi>)\<close>
    using "KBasic2:1"
    by (AOT_subst \<open>\<box>\<not>\<phi>\<close> \<open>\<not>\<diamond>\<phi>\<close>; AOT_subst \<open>\<box>\<not>\<psi>\<close> \<open>\<not>\<diamond>\<psi>\<close>)
       (auto simp:  "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<phi> & \<diamond>\<psi>\<close>
    using "\<equiv>E"(6) "oth-class-taut:3:a" "oth-class-taut:5:a" by blast
  finally show ?thesis .
qed

AOT_theorem "S5Basic:12": \<open>\<diamond>(\<phi> & \<box>\<psi>) \<equiv> (\<diamond>\<phi> & \<box>\<psi>)\<close>
proof (rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<diamond>(\<phi> & \<box>\<psi>)\<close>
  AOT_hence \<open>\<diamond>\<phi> & \<diamond>\<box>\<psi>\<close>
    using "KBasic2:3" "vdash-properties:6" by blast
  AOT_thus \<open>\<diamond>\<phi> & \<box>\<psi>\<close>
    using "5\<diamond>" "&I" "&E"(1) "&E"(2) "vdash-properties:6" by blast
next
  AOT_assume \<open>\<diamond>\<phi> & \<box>\<psi>\<close>
  moreover AOT_have \<open>(\<box>\<box>\<psi> & \<diamond>\<phi>) \<rightarrow> \<diamond>(\<phi> & ;\<box>\<psi>)\<close>
    by (AOT_subst \<open>\<phi> & \<box>\<psi>\<close> \<open>\<box>\<psi> & \<phi>\<close>)
       (auto simp: "Commutativity of &" "KBasic:16")
  ultimately AOT_show \<open>\<diamond>(\<phi> & \<box>\<psi>)\<close>
    by (metis "4" "&I" "Conjunction Simplification"(1,2) "\<rightarrow>E")
qed

AOT_theorem "S5Basic:13": \<open>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<equiv> \<box>(\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
proof (rule "\<equiv>I")
  AOT_modally_strict {
    AOT_have \<open>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> (\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
      by (meson "KBasic:13" "B\<diamond>" "Hypothetical Syllogism" "\<rightarrow>I")
  }
  AOT_hence \<open>\<box>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> \<box>(\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
    by (rule RM)
  AOT_thus  \<open>\<box>(\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> \<box>(\<diamond>\<phi> \<rightarrow> \<psi>)\<close>
    using "4" "Hypothetical Syllogism" by blast
next
  AOT_modally_strict {
    AOT_have \<open>\<box>(\<diamond>\<phi> \<rightarrow> \<psi>) \<rightarrow> (\<phi> \<rightarrow> \<box>\<psi>)\<close>
      by (meson "B" "Hypothetical Syllogism" "\<rightarrow>I" "qml:1"[axiom_inst])
  }
  AOT_hence  \<open>\<box>\<box>(\<diamond>\<phi> \<rightarrow> \<psi>) \<rightarrow> \<box>(\<phi> \<rightarrow> \<box>\<psi>)\<close>
    by (rule RM)
  AOT_thus \<open>\<box>(\<diamond>\<phi> \<rightarrow> \<psi>) \<rightarrow> \<box>(\<phi> \<rightarrow> \<box>\<psi>)\<close>
    using "4" "Hypothetical Syllogism" by blast
qed

AOT_theorem "derived-S5-rules:1":
  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<psi>\<close>
  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<box>\<psi>\<close>
proof -
  AOT_have \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<diamond>\<phi> \<rightarrow> \<box>\<psi>\<close>
    using assms by (rule "RM:1[prem]")
  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<box>\<psi>\<close>
    using "B" "Hypothetical Syllogism" by blast
qed

AOT_theorem "derived-S5-rules:2":
  assumes \<open>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<phi> \<rightarrow> \<box>\<psi>\<close>
  shows \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<psi>\<close>
proof -
  AOT_have \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<diamond>\<box>\<psi>\<close>
    using assms by (rule "RM:2[prem]")
  AOT_thus \<open>\<box>\<Gamma> \<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<phi> \<rightarrow> \<psi>\<close>
    using "B\<diamond>" "Hypothetical Syllogism" by blast
qed

AOT_theorem "BFs:1": \<open>\<forall>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<box>\<forall>\<alpha> \<phi>{\<alpha>}\<close>
proof -
  AOT_modally_strict {
    AOT_have \<open>\<diamond>\<forall>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<diamond>\<box>\<phi>{\<alpha>}\<close> for \<alpha>
      using "cqt-orig:3" by (rule "RM\<diamond>")
    AOT_hence \<open>\<diamond>\<forall>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<phi>{\<alpha>}\<close>
      using "B\<diamond>" "\<forall>I" "\<rightarrow>E" "\<rightarrow>I" by metis
  }
  thus ?thesis
    using "derived-S5-rules:1" by blast
qed
lemmas "BF" = "BFs:1"

AOT_theorem "BFs:2": \<open>\<box>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<box>\<phi>{\<alpha>}\<close>
proof -
  AOT_have \<open>\<box>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<box>\<phi>{\<alpha>}\<close> for \<alpha>
    using RM "cqt-orig:3" by metis
  thus ?thesis
    using "cqt-orig:2"[THEN "\<rightarrow>E"] "\<forall>I" by metis
qed
lemmas "CBF" = "BFs:2"

AOT_theorem "BFs:3": \<open>\<diamond>\<exists>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<exists>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
proof(rule "\<rightarrow>I")
  AOT_modally_strict {
    AOT_have \<open>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>} \<equiv> \<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close>
      using BF CBF "\<equiv>I" by blast
  } note \<theta> = this

  AOT_assume \<open>\<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
  AOT_hence \<open>\<not>\<box>\<not>(\<exists>\<alpha> \<phi>{\<alpha>})\<close>
    using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" by blast
  AOT_hence \<open>\<not>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
    apply (AOT_subst \<open>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close> \<open>\<not>(\<exists>\<alpha> \<phi>{\<alpha>})\<close>)
    using "\<equiv>\<^sub>d\<^sub>fI" "conventions:3" "conventions:4" "&I"
          "contraposition:2" "cqt-further:4"
          "df-rules-formulas[3]" by blast
  AOT_hence \<open>\<not>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close>
    apply (AOT_subst (reverse) \<open>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close> \<open>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>)
    using \<theta> by blast
  AOT_hence \<open>\<not>\<forall>\<alpha> \<not>\<not>\<box>\<not>\<phi>{\<alpha>}\<close>
    by (AOT_subst (reverse) \<open>\<not>\<not>\<box>\<not>\<phi>{\<alpha>}\<close> \<open>\<box>\<not>\<phi>{\<alpha>}\<close> for: \<alpha>)
       (simp add: "oth-class-taut:3:b")
  AOT_hence \<open>\<exists>\<alpha> \<not>\<box>\<not>\<phi>{\<alpha>}\<close>
    by (rule "conventions:4"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_thus \<open>\<exists>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
    using "conventions:5"[THEN "\<equiv>Df"]
    by (AOT_subst \<open>\<diamond>\<phi>{\<alpha>}\<close> \<open>\<not>\<box>\<not>\<phi>{\<alpha>}\<close> for: \<alpha>)
qed
lemmas "BF\<diamond>" = "BFs:3"

AOT_theorem "BFs:4": \<open>\<exists>\<alpha> \<diamond>\<phi>{\<alpha>} \<rightarrow> \<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>\<exists>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
  AOT_hence \<open>\<not>\<forall>\<alpha> \<not>\<diamond>\<phi>{\<alpha>}\<close>
    using "conventions:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence \<open>\<not>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>}\<close>
    using "KBasic2:1"
    by (AOT_subst \<open>\<box>\<not>\<phi>{\<alpha>}\<close> \<open>\<not>\<diamond>\<phi>{\<alpha>}\<close> for: \<alpha>)
  moreover AOT_have \<open>\<forall>\<alpha> \<box>\<not>\<phi>{\<alpha>} \<equiv> \<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
    using "\<equiv>I" "BF" "CBF" by metis
  ultimately AOT_have 1: \<open>\<not>\<box>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>
    using "\<equiv>E"(3) by blast
  AOT_show \<open>\<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
    apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
    apply (AOT_subst \<open>\<exists>\<alpha> \<phi>{\<alpha>}\<close> \<open>\<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>)
     apply (simp add: "conventions:4" "\<equiv>Df")
    apply (AOT_subst \<open>\<not>\<not>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close> \<open>\<forall>\<alpha> \<not>\<phi>{\<alpha>}\<close>)
    by (auto simp: 1 "\<equiv>I" "useful-tautologies:1" "useful-tautologies:2")
qed
lemmas "CBF\<diamond>" = "BFs:4"

AOT_theorem "sign-S5-thm:1": \<open>\<exists>\<alpha> \<box>\<phi>{\<alpha>} \<rightarrow> \<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>\<exists>\<alpha> \<box>\<phi>{\<alpha>}\<close>
  then AOT_obtain \<alpha> where \<open>\<box>\<phi>{\<alpha>}\<close> using "\<exists>E" by metis
  moreover AOT_have \<open>\<box>\<alpha>\<down>\<close>
    by (simp add: "ex:1:a" "rule-ui:2[const_var]" RN)
  moreover AOT_have \<open>\<box>\<phi>{\<tau>}, \<box>\<tau>\<down> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close> for \<tau>
  proof -
    AOT_have \<open>\<phi>{\<tau>}, \<tau>\<down> \<^bold>\<turnstile>\<^sub>\<box> \<exists>\<alpha> \<phi>{\<alpha>}\<close> using "existential:1" by blast
    AOT_thus \<open>\<box>\<phi>{\<tau>}, \<box>\<tau>\<down> \<^bold>\<turnstile>\<^sub>\<box> \<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
      using "RN[prem]"[where \<Gamma>="{\<phi> \<tau>, \<guillemotleft>\<tau>\<down>\<guillemotright>}", simplified] by blast
  qed
  ultimately AOT_show \<open>\<box>\<exists>\<alpha> \<phi>{\<alpha>}\<close> by blast
qed
lemmas Buridan = "sign-S5-thm:1"

AOT_theorem "sign-S5-thm:2": \<open>\<diamond>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
proof -
  AOT_have \<open>\<forall>\<alpha> (\<diamond>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<diamond>\<phi>{\<alpha>})\<close>
    by (simp add: "RM\<diamond>" "cqt-orig:3" "\<forall>I")
  AOT_thus \<open>\<diamond>\<forall>\<alpha> \<phi>{\<alpha>} \<rightarrow> \<forall>\<alpha> \<diamond>\<phi>{\<alpha>}\<close>
    using "\<forall>E"(4) "\<forall>I" "\<rightarrow>E" "\<rightarrow>I" by metis
qed
lemmas "Buridan\<diamond>" = "sign-S5-thm:2"

AOT_theorem "sign-S5-thm:3":
  \<open>\<diamond>\<exists>\<alpha> (\<phi>{\<alpha>} & \<psi>{\<alpha>}) \<rightarrow> \<diamond>(\<exists>\<alpha> \<phi>{\<alpha>} & \<exists>\<alpha> \<psi>{\<alpha>})\<close>
  apply (rule "RM:2")
  by (metis (no_types, lifting) "\<exists>E" "&I" "&E"(1) "&E"(2) "\<rightarrow>I" "\<exists>I"(2))

AOT_theorem "sign-S5-thm:4": \<open>\<diamond>\<exists>\<alpha> (\<phi>{\<alpha>} & \<psi>{\<alpha>}) \<rightarrow> \<diamond>\<exists>\<alpha> \<phi>{\<alpha>}\<close>
  apply (rule "RM:2")
  by (meson "instantiation" "&E"(1) "\<rightarrow>I" "\<exists>I"(2))

AOT_theorem "sign-S5-thm:5":
  \<open>(\<box>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<psi>{\<alpha>}) & \<box>\<forall>\<alpha> (\<psi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})) \<rightarrow> \<box>\<forall>\<alpha> (\<phi>{\<alpha>} \<rightarrow> \<chi>{\<alpha>})\<close>
proof -
  {
    fix \<phi>' \<psi>' \<chi>'
    AOT_assume \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>' & \<psi>' \<rightarrow> \<chi>'\<close>
    AOT_hence \<open>\<box>\<phi>' & \<box>\<psi>' \<rightarrow> \<box>\<chi>'\<close>
      using "RN[prem]"[where \<Gamma>="{\<phi>', \<psi>'}"] apply simp
      using "&E" "&I" "\<rightarrow>E" "\<rightarrow>I" by metis
  } note R = this
  show ?thesis by (rule R; fact AOT)
qed

AOT_theorem "sign-S5-thm:6":
  \<open>(\<box>\<forall>\<alpha> (\<phi>{\<alpha>} \<equiv> \<psi>{\<alpha>}) & \<box>\<forall>\<alpha>(\<psi>{\<alpha>} \<equiv> \<chi>{\<alpha>})) \<rightarrow> \<box>\<forall>\<alpha>(\<phi>{\<alpha>} \<equiv> \<chi>{\<alpha>})\<close>
proof -
  {
    fix \<phi>' \<psi>' \<chi>'
    AOT_assume \<open>\<^bold>\<turnstile>\<^sub>\<box> \<phi>' & \<psi>' \<rightarrow> \<chi>'\<close>
    AOT_hence \<open>\<box>\<phi>' & \<box>\<psi>' \<rightarrow> \<box>\<chi>'\<close>
      using "RN[prem]"[where \<Gamma>="{\<phi>', \<psi>'}"] apply simp
      using "&E" "&I" "\<rightarrow>E" "\<rightarrow>I" by metis
  } note R = this
  show ?thesis by (rule R; fact AOT)
qed

AOT_theorem "exist-nec2:1": \<open>\<diamond>\<tau>\<down> \<rightarrow> \<tau>\<down>\<close>
  using "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" "exist-nec" by blast

AOT_theorem "exists-nec2:2": \<open>\<diamond>\<tau>\<down> \<equiv> \<box>\<tau>\<down>\<close>
  by (meson "Act-Sub:3" "Hypothetical Syllogism" "exist-nec"
            "exist-nec2:1" "\<equiv>I" "nec-imp-act")

AOT_theorem "exists-nec2:3": \<open>\<not>\<tau>\<down> \<rightarrow> \<box>\<not>\<tau>\<down>\<close>
  using "KBasic2:1" "\<rightarrow>I" "exist-nec2:1" "\<equiv>E"(2) "modus-tollens:1" by blast

AOT_theorem "exists-nec2:4": \<open>\<diamond>\<not>\<tau>\<down> \<equiv> \<box>\<not>\<tau>\<down>\<close>
  by (metis "Act-Sub:3" "KBasic:12" "\<rightarrow>I" "exist-nec" "exists-nec2:3"
            "\<equiv>I" "\<equiv>E"(4) "nec-imp-act" "reductio-aa:1")

AOT_theorem "id-nec2:1": \<open>\<diamond>\<alpha> = \<beta> \<rightarrow> \<alpha> = \<beta>\<close>
  using "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" "id-nec:1" by blast

AOT_theorem "id-nec2:2": \<open>\<alpha> \<noteq> \<beta> \<rightarrow> \<box>\<alpha> \<noteq> \<beta>\<close>
  apply (AOT_subst \<open>\<alpha> \<noteq> \<beta>\<close> \<open>\<not>(\<alpha> = \<beta>)\<close>)
  using "=-infix"[THEN "\<equiv>Df"] apply blast
  using "KBasic2:1" "\<rightarrow>I" "id-nec2:1" "\<equiv>E"(2) "modus-tollens:1" by blast

AOT_theorem "id-nec2:3": \<open>\<diamond>\<alpha> \<noteq> \<beta> \<rightarrow> \<alpha> \<noteq> \<beta>\<close>
  apply (AOT_subst \<open>\<alpha> \<noteq> \<beta>\<close> \<open>\<not>(\<alpha> = \<beta>)\<close>)
  using "=-infix"[THEN "\<equiv>Df"] apply blast
  by (metis "KBasic:11" "\<rightarrow>I" "id-nec:2" "\<equiv>E"(3) "reductio-aa:2" "\<rightarrow>E")

AOT_theorem "id-nec2:4": \<open>\<diamond>\<alpha> = \<beta> \<rightarrow> \<box>\<alpha> = \<beta>\<close>
  using "Hypothetical Syllogism" "id-nec2:1" "id-nec:1" by blast

AOT_theorem "id-nec2:5": \<open>\<diamond>\<alpha> \<noteq> \<beta> \<rightarrow> \<box>\<alpha> \<noteq> \<beta>\<close>
  using "id-nec2:3" "id-nec2:2" "\<rightarrow>I" "\<rightarrow>E" by metis

AOT_theorem "sc-eq-box-box:1": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<equiv> (\<diamond>\<phi> \<rightarrow> \<box>\<phi>)\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
  using "KBasic:13" "5\<diamond>" "Hypothetical Syllogism" "\<rightarrow>E" apply blast
  by (metis "KBasic2:1" "KBasic:1" "KBasic:2" "S5Basic:13" "\<equiv>E"(2)
            "raa-cor:5" "\<rightarrow>E")

AOT_theorem "sc-eq-box-box:2": \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<or> (\<diamond>\<phi> \<rightarrow> \<box>\<phi>)) \<rightarrow> (\<diamond>\<phi> \<equiv> \<box>\<phi>)\<close>
  by (metis "Act-Sub:3" "KBasic:13" "5\<diamond>" "\<or>E"(2) "\<rightarrow>I" "\<equiv>I"
            "nec-imp-act" "raa-cor:2" "\<rightarrow>E")

AOT_theorem "sc-eq-box-box:3": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> (\<not>\<box>\<phi> \<equiv> \<box>\<not>\<phi>)\<close>
proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
  AOT_hence \<open>\<diamond>\<phi> \<rightarrow> \<box>\<phi>\<close> using "sc-eq-box-box:1" "\<equiv>E" by blast
  moreover AOT_assume \<open>\<not>\<box>\<phi>\<close>
  ultimately AOT_have \<open>\<not>\<diamond>\<phi>\<close>
    using "modus-tollens:1" by blast
  AOT_thus \<open>\<box>\<not>\<phi>\<close>
    using "KBasic2:1" "\<equiv>E"(2) by blast
next
  AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
  moreover AOT_assume \<open>\<box>\<not>\<phi>\<close>
  ultimately AOT_show \<open>\<not>\<box>\<phi>\<close>
    using "modus-tollens:1" "qml:2"[axiom_inst] "\<rightarrow>E" by blast
qed

AOT_theorem "sc-eq-box-box:4":
  \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)) \<rightarrow> ((\<box>\<phi> \<equiv> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
proof(rule "\<rightarrow>I"; rule "\<rightarrow>I")
  AOT_assume \<theta>: \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)\<close>
  AOT_assume \<xi>: \<open>\<box>\<phi> \<equiv> \<box>\<psi>\<close>
  AOT_hence \<open>(\<box>\<phi> & \<box>\<psi>) \<or> (\<not>\<box>\<phi> & \<not>\<box>\<psi>)\<close>
    using "\<equiv>E"(4) "oth-class-taut:4:g" "raa-cor:3" by blast
  moreover {
    AOT_assume \<open>\<box>\<phi> & \<box>\<psi>\<close>
    AOT_hence \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
      using "KBasic:3" "KBasic:8" "\<equiv>E"(2) "vdash-properties:10" by blast
  }
  moreover {
    AOT_assume \<open>\<not>\<box>\<phi> & \<not>\<box>\<psi>\<close>
    moreover AOT_have \<open>\<not>\<box>\<phi> \<equiv> \<box>\<not>\<phi>\<close> and \<open>\<not>\<box>\<psi> \<equiv> \<box>\<not>\<psi>\<close>
      using \<theta> "Conjunction Simplification"(1,2)
            "sc-eq-box-box:3" "\<rightarrow>E" by metis+
    ultimately AOT_have \<open>\<box>\<not>\<phi> & \<box>\<not>\<psi>\<close>
      by (metis "&I" "Conjunction Simplification"(1,2)
                "\<equiv>E"(4) "modus-tollens:1" "raa-cor:3")
    AOT_hence \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
      using "KBasic:3" "KBasic:9" "\<equiv>E"(2) "\<rightarrow>E" by blast
  }
  ultimately AOT_show \<open>\<box>(\<phi> \<equiv> \<psi>)\<close>
    using "\<or>E"(2) "reductio-aa:1" by blast
qed

AOT_theorem "sc-eq-box-box:5":
  \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)) \<rightarrow> \<box>((\<phi> \<equiv> \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>))\<close>
  AOT_hence \<open>\<box>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>))\<close>
    using 4[THEN "\<rightarrow>E"] "&E" "&I" "KBasic:3" "\<equiv>E"(2) by metis
  moreover AOT_have \<open>\<box>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>)) \<rightarrow> \<box>((\<phi> \<equiv> \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close>
  proof (rule RM; rule "\<rightarrow>I"; rule "\<rightarrow>I")
    AOT_modally_strict {
      AOT_assume A: \<open>(\<box>(\<phi> \<rightarrow> \<box>\<phi>) & \<box>(\<psi> \<rightarrow> \<box>\<psi>))\<close>
      AOT_hence \<open>\<phi> \<rightarrow> \<box>\<phi>\<close> and \<open>\<psi> \<rightarrow> \<box>\<psi>\<close>
        using "&E" "qml:2"[axiom_inst] "\<rightarrow>E" by blast+
      moreover AOT_assume \<open>\<phi> \<equiv> \<psi>\<close>
      ultimately AOT_have \<open>\<box>\<phi> \<equiv> \<box>\<psi>\<close>
        using "\<rightarrow>E" "qml:2"[axiom_inst] "\<equiv>E" "\<equiv>I" by meson
      moreover AOT_have \<open>(\<box>\<phi> \<equiv> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>)\<close>
        using A "sc-eq-box-box:4" "\<rightarrow>E" by blast
      ultimately AOT_show \<open>\<box>(\<phi> \<equiv> \<psi>)\<close> using "\<rightarrow>E" by blast
    }
  qed
  ultimately AOT_show \<open>\<box>((\<phi> \<equiv> \<psi>) \<rightarrow> \<box>(\<phi> \<equiv> \<psi>))\<close> using "\<rightarrow>E" by blast
qed

AOT_theorem "sc-eq-box-box:6": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> ((\<phi> \<rightarrow> \<box>\<psi>) \<rightarrow> \<box>(\<phi> \<rightarrow> \<psi>))\<close>
proof (rule "\<rightarrow>I"; rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<not>\<box>(\<phi> \<rightarrow> \<psi>)\<close>
  AOT_hence \<open>\<diamond>\<not>(\<phi> \<rightarrow> \<psi>)\<close>
    by (metis "KBasic:11" "\<equiv>E"(1))
  AOT_hence \<open>\<diamond>(\<phi> & \<not>\<psi>)\<close>
    by (AOT_subst \<open>\<phi> & \<not>\<psi>\<close> \<open>\<not>(\<phi> \<rightarrow> \<psi>)\<close>)
       (meson "Commutativity of \<equiv>" "\<equiv>E"(1) "oth-class-taut:1:b")
  AOT_hence \<open>\<diamond>\<phi>\<close> and 2: \<open>\<diamond>\<not>\<psi>\<close>
    using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" by blast+
  moreover AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
  ultimately AOT_have \<open>\<box>\<phi>\<close>
    by (metis "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E")
  AOT_hence \<phi>
    using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
  moreover AOT_assume \<open>\<phi> \<rightarrow> \<box>\<psi>\<close>
  ultimately AOT_have \<open>\<box>\<psi>\<close>
    using "\<rightarrow>E" by blast
  moreover AOT_have \<open>\<not>\<box>\<psi>\<close>
    using 2 "KBasic:12" "\<not>\<not>I" "intro-elim:3:d" by blast
  ultimately AOT_show \<open>\<box>\<psi> & \<not>\<box>\<psi>\<close>
    using "&I" by blast
qed

AOT_theorem "sc-eq-box-box:7": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> ((\<phi> \<rightarrow> \<^bold>\<A>\<psi>) \<rightarrow> \<^bold>\<A>(\<phi> \<rightarrow> \<psi>))\<close>
proof (rule "\<rightarrow>I"; rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<not>\<^bold>\<A>(\<phi> \<rightarrow> \<psi>)\<close>
  AOT_hence \<open>\<^bold>\<A>\<not>(\<phi> \<rightarrow> \<psi>)\<close>
    by (metis "Act-Basic:1" "\<or>E"(2))
  AOT_hence \<open>\<^bold>\<A>(\<phi> & \<not>\<psi>)\<close>
    by (AOT_subst \<open>\<phi> & \<not>\<psi>\<close> \<open>\<not>(\<phi> \<rightarrow> \<psi>)\<close>)
       (meson "Commutativity of \<equiv>" "\<equiv>E"(1) "oth-class-taut:1:b")
  AOT_hence \<open>\<^bold>\<A>\<phi>\<close> and 2: \<open>\<^bold>\<A>\<not>\<psi>\<close>
    using "Act-Basic:2"[THEN "\<equiv>E"(1)] "&E" by blast+
  AOT_hence \<open>\<diamond>\<phi>\<close>
    by (metis "Act-Sub:3" "\<rightarrow>E")
  moreover AOT_assume \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>)\<close>
  ultimately AOT_have \<open>\<box>\<phi>\<close>
    by (metis "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E")
  AOT_hence \<phi>
    using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
  moreover AOT_assume \<open>\<phi> \<rightarrow> \<^bold>\<A>\<psi>\<close>
  ultimately AOT_have \<open>\<^bold>\<A>\<psi>\<close>
    using "\<rightarrow>E" by blast
  moreover AOT_have \<open>\<not>\<^bold>\<A>\<psi>\<close>
    using 2 by (meson "Act-Sub:1" "\<equiv>E"(4) "raa-cor:3")
  ultimately AOT_show \<open>\<^bold>\<A>\<psi> & \<not>\<^bold>\<A>\<psi>\<close>
    using "&I" by blast
qed

AOT_theorem "sc-eq-fur:1": \<open>\<diamond>\<^bold>\<A>\<phi> \<equiv> \<box>\<^bold>\<A>\<phi>\<close>
  using "Act-Basic:6" "Act-Sub:4" "\<equiv>E"(6) by blast

AOT_theorem "sc-eq-fur:2": \<open>\<box>(\<phi> \<rightarrow> \<box>\<phi>) \<rightarrow> (\<^bold>\<A>\<phi> \<equiv> \<phi>)\<close>
  by (metis "B\<diamond>" "Act-Sub:3" "KBasic:13" "T\<diamond>" "Hypothetical Syllogism"
            "\<rightarrow>I" "\<equiv>I" "nec-imp-act")

AOT_theorem "sc-eq-fur:3":
  \<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x}) \<rightarrow> (\<exists>!x \<phi>{x} \<rightarrow> \<^bold>\<iota>x \<phi>{x}\<down>)\<close>
proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
  AOT_hence A: \<open>\<forall>x \<box>(\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
    using CBF "\<rightarrow>E" by blast
  AOT_assume \<open>\<exists>!x \<phi>{x}\<close>
  then AOT_obtain a where a_def: \<open>\<phi>{a} & \<forall>y (\<phi>{y} \<rightarrow> y = a)\<close>
    using "\<exists>E"[rotated 1, OF "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"]] by blast
  moreover AOT_have \<open>\<box>\<phi>{a}\<close>
    using calculation A "\<forall>E"(2) "qml:2"[axiom_inst] "\<rightarrow>E" "&E"(1) by blast
  AOT_hence \<open>\<^bold>\<A>\<phi>{a}\<close>
    using "nec-imp-act" "\<rightarrow>E" by blast
  moreover AOT_have \<open>\<forall>y (\<^bold>\<A>\<phi>{y} \<rightarrow> y = a)\<close>
  proof (rule "\<forall>I"; rule "\<rightarrow>I")
    fix b
    AOT_assume \<open>\<^bold>\<A>\<phi>{b}\<close>
    AOT_hence \<open>\<diamond>\<phi>{b}\<close>
      using "Act-Sub:3" "\<rightarrow>E" by blast
    moreover {
      AOT_have \<open>\<box>(\<phi>{b} \<rightarrow> \<box>\<phi>{b})\<close>
        using A "\<forall>E"(2) by blast
      AOT_hence \<open>\<diamond>\<phi>{b} \<rightarrow> \<box>\<phi>{b}\<close>
        using "KBasic:13" "5\<diamond>" "Hypothetical Syllogism" "\<rightarrow>E" by blast
    }
    ultimately AOT_have \<open>\<box>\<phi>{b}\<close>
      using "\<rightarrow>E" by blast
    AOT_hence \<open>\<phi>{b}\<close>
      using "qml:2"[axiom_inst] "\<rightarrow>E" by blast
    AOT_thus \<open>b = a\<close>
      using a_def[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" by blast
  qed
  ultimately AOT_have \<open>\<^bold>\<A>\<phi>{a} & \<forall>y (\<^bold>\<A>\<phi>{y} \<rightarrow> y = a)\<close>
    using "&I" by blast
  AOT_hence \<open>\<exists>x (\<^bold>\<A>\<phi>{x} & \<forall>y (\<^bold>\<A>\<phi>{y} \<rightarrow> y = x))\<close>
    using "\<exists>I" by fast
  AOT_hence \<open>\<exists>!x \<^bold>\<A>\<phi>{x}\<close>
    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by fast
  AOT_thus \<open>\<^bold>\<iota>x \<phi>{x}\<down>\<close>
    using "actual-desc:1"[THEN "\<equiv>E"(2)] by blast
qed

AOT_theorem "sc-eq-fur:4":
\<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x}) \<rightarrow> (x = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x)))\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>\<box>\<forall>x (\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
  AOT_hence \<open>\<forall>x \<box>(\<phi>{x} \<rightarrow> \<box>\<phi>{x})\<close>
    using CBF "\<rightarrow>E" by blast
  AOT_hence A: \<open>\<^bold>\<A>\<phi>{\<alpha>} \<equiv> \<phi>{\<alpha>}\<close> for \<alpha>
    using "sc-eq-fur:2" "\<forall>E" "\<rightarrow>E" by fast
  AOT_show \<open>x = \<^bold>\<iota>x \<phi>{x} \<equiv> (\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x))\<close>
  proof (rule "\<equiv>I"; rule "\<rightarrow>I")
    AOT_assume \<open>x = \<^bold>\<iota>x \<phi>{x}\<close>
    AOT_hence B: \<open>\<^bold>\<A>\<phi>{x} & \<forall>z (\<^bold>\<A>\<phi>{z} \<rightarrow> z = x)\<close>
      using "nec-hintikka-scheme"[THEN "\<equiv>E"(1)] by blast
    AOT_show \<open>\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x)\<close>
    proof (rule "&I"; (rule "\<forall>I"; rule "\<rightarrow>I")?)
      AOT_show \<open>\<phi>{x}\<close>
        using A B[THEN "&E"(1)] "\<equiv>E"(1) by blast
    next
      AOT_show \<open>z = x\<close> if \<open>\<phi>{z}\<close> for z
        using that B[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" A[THEN "\<equiv>E"(2)] by blast
    qed
  next
    AOT_assume B: \<open>\<phi>{x} & \<forall>z (\<phi>{z} \<rightarrow> z = x)\<close>
    AOT_have \<open>\<^bold>\<A>\<phi>{x} & \<forall>z (\<^bold>\<A>\<phi>{z} \<rightarrow> z = x)\<close>
    proof(rule "&I"; (rule "\<forall>I"; rule "\<rightarrow>I")?)
      AOT_show \<open>\<^bold>\<A>\<phi>{x}\<close>
        using B[THEN "&E"(1)] A[THEN "\<equiv>E"(2)] by blast
    next
      AOT_show \<open>b = x\<close> if \<open>\<^bold>\<A>\<phi>{b}\<close> for b
        using A[THEN "\<equiv>E"(1)] that
              B[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
    qed
    AOT_thus \<open>x = \<^bold>\<iota>x \<phi>{x}\<close>
      using "nec-hintikka-scheme"[THEN "\<equiv>E"(2)] by blast
  qed
qed

AOT_theorem "id-act:1": \<open>\<alpha> = \<beta> \<equiv> \<^bold>\<A>\<alpha> = \<beta>\<close>
  by (meson "Act-Sub:3" "Hypothetical Syllogism"
            "id-nec2:1" "id-nec:2" "\<equiv>I" "nec-imp-act")

AOT_theorem "id-act:2": \<open>\<alpha> \<noteq> \<beta> \<equiv> \<^bold>\<A>\<alpha> \<noteq> \<beta>\<close>
proof (AOT_subst \<open>\<alpha> \<noteq> \<beta>\<close> \<open>\<not>(\<alpha> = \<beta>)\<close>)
  AOT_modally_strict {
    AOT_show \<open>\<alpha> \<noteq> \<beta> \<equiv> \<not>(\<alpha> = \<beta>)\<close>
      by (simp add: "=-infix" "\<equiv>Df")
  }
next
  AOT_show \<open>\<not>(\<alpha> = \<beta>) \<equiv> \<^bold>\<A>\<not>(\<alpha> = \<beta>)\<close>
  proof (safe intro!: "\<equiv>I" "\<rightarrow>I")
    AOT_assume \<open>\<not>\<alpha> = \<beta>\<close>
    AOT_hence \<open>\<not>\<^bold>\<A>\<alpha> = \<beta>\<close> using "id-act:1" "\<equiv>E"(3) by blast
    AOT_thus \<open>\<^bold>\<A>\<not>\<alpha> = \<beta>\<close>
      using "\<not>\<not>E" "Act-Sub:1" "\<equiv>E"(3) by blast
  next
    AOT_assume \<open>\<^bold>\<A>\<not>\<alpha> = \<beta>\<close>
    AOT_hence \<open>\<not>\<^bold>\<A>\<alpha> = \<beta>\<close>
      using "\<not>\<not>I" "Act-Sub:1" "\<equiv>E"(4) by blast
    AOT_thus \<open>\<not>\<alpha> = \<beta>\<close>
      using "id-act:1" "\<equiv>E"(4) by blast
  qed
qed

AOT_theorem "A-Exists:1": \<open>\<^bold>\<A>\<exists>!\<alpha> \<phi>{\<alpha>} \<equiv> \<exists>!\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close>
proof -
  AOT_have \<open>\<^bold>\<A>\<exists>!\<alpha> \<phi>{\<alpha>} \<equiv> \<^bold>\<A>\<exists>\<alpha>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
    by (AOT_subst \<open>\<exists>!\<alpha> \<phi>{\<alpha>}\<close> \<open>\<exists>\<alpha>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>)
       (auto simp add: "oth-class-taut:3:a" "uniqueness:2")
  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha> \<^bold>\<A>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
    by (simp add: "Act-Basic:10")
  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha>\<forall>\<beta> \<^bold>\<A>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
    by (AOT_subst \<open>\<^bold>\<A>\<forall>\<beta> (\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> \<open>\<forall>\<beta> \<^bold>\<A>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> for: \<alpha>)
       (auto simp: "logic-actual-nec:3"[axiom_inst] "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<^bold>\<A>\<beta> = \<alpha>)\<close>
    by (AOT_subst (reverse) \<open>\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<^bold>\<A>\<beta> = \<alpha>\<close>
                            \<open>\<^bold>\<A>(\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close> for: \<alpha> \<beta> :: 'a)
       (auto simp: "Act-Basic:5" "cqt-further:7")
  also AOT_have \<open>\<dots> \<equiv> \<exists>\<alpha>\<forall>\<beta> (\<^bold>\<A>\<phi>{\<beta>} \<equiv> \<beta> = \<alpha>)\<close>
    by (AOT_subst (reverse) \<open>\<^bold>\<A>\<beta> = \<alpha>\<close> \<open>\<beta> = \<alpha>\<close> for: \<alpha> \<beta> :: 'a)
       (auto simp: "id-act:1" "cqt-further:7")
  also AOT_have \<open>... \<equiv> \<exists>!\<alpha> \<^bold>\<A>\<phi>{\<alpha>}\<close>
    using "uniqueness:2" "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by fast
  finally show ?thesis.
qed

AOT_theorem "A-Exists:2": \<open>\<^bold>\<iota>x \<phi>{x}\<down> \<equiv> \<^bold>\<A>\<exists>!x \<phi>{x}\<close>
  by (AOT_subst \<open>\<^bold>\<A>\<exists>!x \<phi>{x}\<close> \<open>\<exists>!x \<^bold>\<A>\<phi>{x}\<close>)
     (auto simp: "actual-desc:1" "A-Exists:1")

AOT_theorem "id-act-desc:1": \<open>\<^bold>\<iota>x (x = y)\<down>\<close>
proof(rule "existence:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "\<exists>I")
  AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]\<^bold>\<iota>x (x = y)\<close>
  proof (rule "russell-axiom[exe,1].nec-russell-axiom"[THEN "\<equiv>E"(2)];
         rule "\<exists>I"; (rule "&I")+)
    AOT_show \<open>\<^bold>\<A>y = y\<close> by (simp add: "RA[2]" "id-eq:1")
  next
    AOT_show \<open>\<forall>z (\<^bold>\<A>z = y \<rightarrow> z = y)\<close>
      apply (rule "\<forall>I")
      using "id-act:1"[THEN "\<equiv>E"(2)] "\<rightarrow>I" by blast
  next
    AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]y\<close>
    proof (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E", THEN "\<equiv>E"(2)])
      AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close>
        by "cqt:2[lambda]"
    next
      AOT_show \<open>E!y \<rightarrow> E!y\<close> 
        by (simp add: "if-p-then-p")
    qed
  qed
next
  AOT_show \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close>
    by "cqt:2[lambda]"
qed

AOT_theorem "id-act-desc:2": \<open>y = \<^bold>\<iota>x (x = y)\<close>
  by (rule descriptions[axiom_inst, THEN "\<equiv>E"(2)];
      rule "\<forall>I"; rule "id-act:1"[symmetric])

AOT_theorem "pre-en-eq:1[1]": \<open>x\<^sub>1[F] \<rightarrow> \<box>x\<^sub>1[F]\<close>
  by (simp add: encoding "vdash-properties:1[2]")

AOT_theorem "pre-en-eq:1[2]": \<open>x\<^sub>1x\<^sub>2[F] \<rightarrow> \<box>x\<^sub>1x\<^sub>2[F]\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>x\<^sub>1x\<^sub>2[F]\<close>
  AOT_hence \<open>x\<^sub>1[\<lambda>y [F]yx\<^sub>2]\<close> and \<open>x\<^sub>2[\<lambda>y [F]x\<^sub>1y]\<close>
    using "nary-encoding[2]"[axiom_inst, THEN "\<equiv>E"(1)] "&E" by blast+
  moreover AOT_have \<open>[\<lambda>y [F]yx\<^sub>2]\<down>\<close> by "cqt:2"
  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1y]\<down>\<close> by "cqt:2"
  ultimately AOT_have \<open>\<box>x\<^sub>1[\<lambda>y [F]yx\<^sub>2]\<close> and \<open>\<box>x\<^sub>2[\<lambda>y [F]x\<^sub>1y]\<close>
    using encoding[axiom_inst, unvarify F] "\<rightarrow>E" "&I" by blast+
  note A = this
  AOT_hence \<open>\<box>(x\<^sub>1[\<lambda>y [F]yx\<^sub>2] & x\<^sub>2[\<lambda>y [F]x\<^sub>1y])\<close>
    using "KBasic:3"[THEN "\<equiv>E"(2)] "&I" by blast
  AOT_thus \<open>\<box>x\<^sub>1x\<^sub>2[F]\<close>
    by (rule "nary-encoding[2]"[axiom_inst, THEN RN,
                                THEN "KBasic:6"[THEN "\<rightarrow>E"],
                                THEN "\<equiv>E"(2)])
qed

AOT_theorem "pre-en-eq:1[3]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<rightarrow> \<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  AOT_hence \<open>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3]\<close>
        and \<open>x\java.lang.ArrayIndexOutOfBoundsException
        and \<open>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<close>
    using "nary-encoding[3]"[axiom_inst, THEN "\<equiv>E"(1)] "&E" by blast+
  moreover AOT_have \<open>[\<lambda>y [F]yx\<^sub>2x\<^sub>3]\<down>\<close> by "cqt:2"
  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1yx\<^sub>3]\<down>\<close> by "cqt:2"
  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<down>\<close> by "cqt:2"
  ultimately AOT_have \<open>\<box>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3]\<close>
                  and \<open>\<box>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3]\<close>
                  and \<open>\<box>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y]\<close>
    using encoding[axiom_inst, unvarify F] "\<rightarrow>E" by blast+
  note A = this
  AOT_have B: \<open>\<box>(x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3] & x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3] & x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2y])\<close>
    by (rule "KBasic:3"[THEN "\<equiv>E"(2)] "&I" A)+
  AOT_thus \<open>\<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
    by (rule "nary-encoding[3]"[axiom_inst, THEN RN,
                THEN "KBasic:6"[THEN "\<rightarrow>E"], THEN "\<equiv>E"(2)])
qed

AOT_theorem "pre-en-eq:1[4]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<rightarrow> \<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  AOT_hence \<open>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4]\<close>
        and \<open>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4]\<close>
        and \<open>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4]\<close>
        and \<open>x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<close>
    using "nary-encoding[4]"[axiom_inst, THEN "\<equiv>E"(1)] "&E" by metis+
  moreover AOT_have \<open>[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4]\<down>\<close> by "cqt:2"
  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4]\<down>\<close> by "cqt:2"
  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4]\<down>\<close> by "cqt:2"
  moreover AOT_have \<open>[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<down>\<close> by "cqt:2"
  ultimately AOT_have \<open>\<box>x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4]\<close>
                  and \<open>\<box>x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4]\<close>
                  and \<open>\<box>x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4]\<close>
                  and \<open>\<box>x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y]\<close>
    using "\<rightarrow>E" encoding[axiom_inst, unvarify F] by blast+
  note A = this
  AOT_have B: \<open>\<box>(x\<^sub>1[\<lambda>y [F]yx\<^sub>2x\<^sub>3x\<^sub>4] &
                  x\<^sub>2[\<lambda>y [F]x\<^sub>1yx\<^sub>3x\<^sub>4] &
                  x\<^sub>3[\<lambda>y [F]x\<^sub>1x\<^sub>2yx\<^sub>4] &
                  x\<^sub>4[\<lambda>y [F]x\<^sub>1x\<^sub>2x\<^sub>3y])\<close>
    by (rule "KBasic:3"[THEN "\<equiv>E"(2)] "&I" A)+
  AOT_thus \<open>\<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
    by (rule "nary-encoding[4]"[axiom_inst, THEN RN,
              THEN "KBasic:6"[THEN "\<rightarrow>E"], THEN "\<equiv>E"(2)])
qed

AOT_theorem "pre-en-eq:2[1]": \<open>\<not>x\<^sub>1[F] \<rightarrow> \<box>\<not>x\<^sub>1[F]\<close>
proof (rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1[F]\<close>
  AOT_hence \<open>\<diamond>x\<^sub>1[F]\<close>
    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_hence \<open>x\<^sub>1[F]\<close>
    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[1]"[THEN RN],
              THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
  moreover AOT_assume \<open>\<not>x\<^sub>1[F]\<close>
  ultimately AOT_show \<open>x\<^sub>1[F] & \<not>x\<^sub>1[F]\<close> by (rule "&I")
qed
AOT_theorem "pre-en-eq:2[2]": \<open>\<not>x\<^sub>1x\<^sub>2[F] \<rightarrow> \<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
proof (rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
  AOT_hence \<open>\<diamond>x\<^sub>1x\<^sub>2[F]\<close>
    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_hence \<open>x\<^sub>1x\<^sub>2[F]\<close>
    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[2]"[THEN RN],
              THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
  moreover AOT_assume \<open>\<not>x\<^sub>1x\<^sub>2[F]\<close>
  ultimately AOT_show \<open>x\<^sub>1x\<^sub>2[F] & \<not>x\<^sub>1x\<^sub>2[F]\<close> by (rule "&I"</span>)
qed

AOT_theorem "pre-en-eq:2[3]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<rightarrow> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
proof (rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  AOT_hence \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_hence \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[3]"[THEN RN],
              THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
  moreover AOT_assume \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  ultimately AOT_show \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] & \<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close> by (rule "&I")
qed

AOT_theorem "pre-en-eq:2[4]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<rightarrow> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
proof (rule "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>\<not>\<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  AOT_hence \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
    by (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_hence \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
    by(rule "S5Basic:13"[THEN "\<equiv>E"(1), OF  "pre-en-eq:1[4]"[THEN RN],
                         THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
  moreover AOT_assume \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  ultimately AOT_show \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] & \<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close> by (rule "&I")
qed

AOT_theorem "en-eq:1[1]": \<open>\<diamond>x\<^sub>1[F] \<equiv> \<box>x\<^sub>1[F]\<close>
  using "pre-en-eq:1[1]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by metis
AOT_theorem "en-eq:1[2]": \<open>\<diamond>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>x\<^sub>1x\<^sub>2[F]\<close>
  using "pre-en-eq:1[2]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by metis
AOT_theorem "en-eq:1[3]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  using "pre-en-eq:1[3]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by fast
AOT_theorem "en-eq:1[4]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  using "pre-en-eq:1[4]"[THEN RN] "sc-eq-box-box:2" "\<or>I" "\<rightarrow>E" by fast

AOT_theorem "en-eq:2[1]": \<open>x\<^sub>1[F] \<equiv> \<box>x\<^sub>1[F]\<close>
  by (simp add: "\<equiv>I" "pre-en-eq:1[1]" "qml:2"[axiom_inst])
AOT_theorem "en-eq:2[2]": \<open>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>x\<^sub>1x\<^sub>2[F]\<close>
  by (simp add: "\<equiv>I" "pre-en-eq:1[2]" "qml:2"[axiom_inst])
AOT_theorem "en-eq:2[3]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  by (simp add: "\<equiv>I" "pre-en-eq:1[3]" "qml:2"[axiom_inst])
AOT_theorem "en-eq:2[4]": \<open>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  by (simp add: "\<equiv>I" "pre-en-eq:1[4]" "qml:2"[axiom_inst])

AOT_theorem "en-eq:3[1]": \<open>\<diamond>x\<^sub>1[F] \<equiv> x\<^sub>1[F]\<close>
  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[1]"] "\<equiv>I" by blast
AOT_theorem "en-eq:3[2]": \<open>\<diamond>x\<^sub>1x\<^sub>2[F] \<equiv> x\<^sub>1x\<^sub>2[F]\<close>
  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[2]"] "\<equiv>I" by blast
AOT_theorem "en-eq:3[3]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[3]"] "\<equiv>I" by blast
AOT_theorem "en-eq:3[4]": \<open>\<diamond>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  using "T\<diamond>" "derived-S5-rules:2"[OF "pre-en-eq:1[4]"] "\<equiv>I" by blast

AOT_theorem "en-eq:4[1]":
  \<open>(x\<^sub>1[F] \<equiv> y\<^sub>1[G]) \<equiv> (\<box>x\<^sub>1[F] \<equiv> \<box>y\<^sub>1[G])\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[1]" by blast+
AOT_theorem "en-eq:4[2]":
  \<open>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>y\<^sub>1y\<^sub>2[G])\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[2]" by blast+
AOT_theorem "en-eq:4[3]":
  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>y\<^sub>1y\<^sub>2y\<^sub>3[G])\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[3]" by blast+
AOT_theorem "en-eq:4[4]":
  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G])\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
  using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(1,2) "en-eq:2[4]" by blast+

AOT_theorem "en-eq:5[1]":
  \<open>\<box>(x\<^sub>1[F] \<equiv> y\<^sub>1[G]) \<equiv> (\<box>x\<^sub>1[F] \<equiv> \<box>y\<^sub>1[G])\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
  using "en-eq:4[1]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
   apply blast
  using "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
        "&I"[OF "pre-en-eq:1[1]"[THEN RN], OF "pre-en-eq:1[1]"[THEN RN]]
  by blast
AOT_theorem "en-eq:5[2]":
  \<open>\<box>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G]) \<equiv> (\<box>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>y\<^sub>1y\<^sub>2[G])\<close>
  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
  using "en-eq:4[2]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
   apply blast
  using "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
        "&I"[OF "pre-en-eq:1[2]"  Copyright (C)20042006RedHat,IncAllrights reserved.
  by blast
AOT_theorem"n-eq:53]:
(x<sub\^sub>x\^sub>3F \equiv y<^uby<sub>2\sub[])\<equiv>(<box>\^sub>x\<sub2\^sub>3[]\<equiv>\box>\^sub>y<^sub>2y<^sub[G)\close>
java.lang.StringIndexOutOfBoundsException: Range [7, 6) out of bounds for length 43
  *

   s-box-box:"THEN"<>E" THEN "<rightarrowE]
&[ -1]T ]OFpre-eneq13"THENRN]java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72

java.lang.StringIndexOutOfBoundsException: Range [13, 11) out of bounds for length 25
<>x<sub1x\sub2x\^3\<>F] \<equiv \^1\^>y<^ub3\^sub>4[G] <equiv \boxx<sub1\^sub>x\<^sub>x<sub4F < \<ox>y<^1y\^2y\^>y<^ub4[]\<lose
  apply (rule "\<equiv>I"; rule "\<rightarrow>I")
  using "en-eq:4[4]"[THEN "\<equiv>E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"]
   apply blast
box[ \E  "rightarrow>E"
"I[F eq14" RN  eq14"THENRN]
  by blast

AOT_theorem "en-eq:6[1]":
  \<open>(x\<^sub>1[F] \<equiv> y\<^sub>1[G]) \<equiv> \<box>(x\<^sub>1[F] \<equiv> y\<^sub>1[G])\<close>
  using "en-eq:5[1]"[symmetric] "en-eq:4[1]" "\<equiv>E"(5) by fast
AOT_theorem "en-eq:6[2]":
  \<open>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G]) \<equiv> \<box>(x\<^sub>1x\<^sub>2[F] \<equiv> y\<^sub>1y\<^sub>2[G])\<close>
  using "en-eq:5[2]"[symmetric] "en-eq:4[2]" "\<equiv>E"(5) by fast
AOT_theorem "en-eq:6[3]":
  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G]) \<equiv> \<box>(x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3[G])\<close>
  using "en-eq:5[3]"[symmetric] "en-eq:4[3]" "\<equiv>E"(5) by fast
AOT_theorem "en-eq:6[4]":
  \<open>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G]) \<equiv> \<box>(x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> y\<^sub>1y\<^sub>2y\<^sub>3y\<^sub>4[G])\<close>
  using "en-eq:5[4]"[symmetric] "en-eq:4[4]" "\<equiv>E"(5) by fast

AOT_theorem "en-eq:7[1]": \<open>\<not>x\<^sub>1[F] \<equiv> \<box>\<not>x\<^sub>1[F]\<close>
  using "pre-en-eq:2[1]" "qml:2"[axiom_inst] "\<equiv>I" by blast
AOT_theorem "en-eq:7[2]": \<open>\<not>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
  using "pre-en-eq:2[2]" "qml:2"[axiom_inst] "\<equiv>I" by blast
AOT_theorem "en-eq:7[3]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  using "pre-en-eq:2[3]" "qml:2"[axiom_inst] "\<equiv>I" by blast
AOT_theorem "en-eq:7[4]": \<open>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  using "pre-en-eq:2[4]" "qml:2"[axiom_inst] "\<equiv>I" by blast

AOT_theorem "en-eq:8[1]": \<open>\<diamond>\<not>x\<^sub>1[F] \<equiv> \<not>x\<^sub>1[F]\<close>
  using "en-eq:2[1]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
AOT_theorem "en-eq:8[2]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2[F] \<equiv> \<not>x\<^sub>1x\<^sub>2[F]\<close>
  using "en-eq:2[2]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
AOT_theorem "en-eq:8[3]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  using "en-eq:2[3]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast
AOT_theorem "en-eq:8[4]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  using "en-eq:2[4]"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
        "KBasic:11" "\<equiv>E"(5)[symmetric] by blast

AOT_theorem "en-eq:9[1]": \<open>\<diamond>\<not>x\<^sub>1[F] \<equiv> \<box>\<not>x\<^sub>1[F]\<close>
  using "en-eq:7[1]" "en-eq:8[1]" "\<equiv>E"(5) by blast
AOT_theorem "en-eq:9[2]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2[F]\<close>
  using "en-eq:7[2]" "en-eq:8[2]" "\<equiv>E"(5) by blast
AOT_theorem "en-eq:9[3]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  using "en-eq:7[3]" "en-eq:8[3]" "\<equiv>E"(5) by blast
AOT_theorem "en-eq:9[4]": \<open>\<diamond>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> \<box>\<not>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  using "en-eq:7[4]" "en-eq:8[4]" "\<equiv>E"(5) by blast

AOT_theorem "en-eq:10[1]": \<open>\<^bold>\<A>x\<^sub>1[F] \<equiv> x\<^sub>1[F]\<close>
  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
            "nec-imp-act" "en-eq:3[1]" "pre-en-eq:1[1]")
AOT_theorem "en-eq:10[2]": \<open>\<^bold>\<A>x\<^sub>1x\<^sub>2[F] \<equiv> x\<^sub>1x\<^sub>2[F]\<close>
  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
            "nec-imp-act" "en-eq:3[2]" "pre-en-eq:1[2]")
AOT_theorem "en-eq:10[3]": \<open>\<^bold>\<A>x\<^sub>1x\<^sub>2x\<^sub>3[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3[F]\<close>
  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
            "nec-imp-act" "en-eq:3[3]" "pre-en-eq:1[3]")
AOT_theorem "en-eq:10[4]": \<open>\<^bold>\<A>x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F] \<equiv> x\<^sub>1x\<^sub>2x\<^sub>3x\<^sub>4[F]\<close>
  by (metis "Act-Sub:3" "deduction-theorem" "\<equiv>I" "\<equiv>E"(1)
            "nec-imp-act" "en-eq:3[4]" "pre-en-eq:1[4]")

AOT_theorem "oa-facts:1": \<open>O!x \<rightarrow> \<box>O!x\<close>
proof(rule "\<rightarrow>I")
  AOT_modally_strict {
    AOT_have \<open>[\<lambda>x \<diamond>E!x]x \<equiv> \<diamond>E!x\<close>
      by (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E"]) "cqt:2"
  } note \<theta> = this
  AOT_assume \<open>O!x\<close>
  AOT_hence \<open>[\<lambda>x \<diamond>E!x]x\<close>
    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_ordinary, rotated 1]) "cqt:2"
  AOT_hence \<open>\<diamond>E!x\<close> using \<theta>[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<box>\<diamond>E!x\<close> using "qml:3"[axiom_inst, THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<box>[\<lambda>x \<diamond>E!x]x\<close>
    by (AOT_subst \<open>[\<lambda>x \<diamond>E!x]x\<close> \<open>\<diamond>E!x\<close>)
       (auto simp: \<theta>)
  AOT_thus \<open>\<box>O!x\<close>
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated 1]) "cqt:2"
qed

AOT_theorem "oa-facts:2": \<open>A!x \<rightarrow> \<box>A!x\<close>
proof(rule "\<rightarrow>I")
  AOT_modally_strict {
    AOT_have \<open>[\<lambda>x \<not>\<diamond>E!x]x \<equiv> \<not>\<diamond>E!x\<close>
      by (rule "lambda-predicates:2"[axiom_inst, THEN "\<rightarrow>E"]) "cqt:2"
  } note \<theta> = this
  AOT_assume \<open>A!x\<close>
  AOT_hence \<open>[\<lambda>x \<not>\<diamond>E!x]x\<close>
    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract, rotated 1]) "cqt:2"
  AOT_hence \<open>\<not>\<diamond>E!x\<close> using \<theta>[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<box>\<not>E!x\<close> using "KBasic2:1"[THEN "\<equiv>E"(2)] by blast
  AOT_hence \<open>\<box>\<box>\<not>E!x\<close> using "4"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<box>\<not>\<diamond>E!x\<close>
    using "KBasic2:1"
    by (AOT_subst (reverse) \<open>\<not>\<diamond>E!x\<close> \<open>\<box>\<not>E!x\<close>) blast
  AOT_hence \<open>\<box>[\<lambda>x \<not>\<diamond>E!x]x\<close>
    by (AOT_subst \<open>[\<lambda>x \<not>\<diamond>E!x]x\<close> \<open>\<not>\<diamond>E!x\<close>)
       (auto simp: \<theta>)
  AOT_thus \<open>\<box>A!x\<close>
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_abstract, rotated 1]) "cqt:2[lambda]"
qed

AOT_theorem "oa-facts:3": \<open>\<diamond>O!x \<rightarrow> O!x\<close>
  using "oa-facts:1" "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" by blast
AOT_theorem "oa-facts:4": \<open>\<diamond>A!x \<rightarrow> A!x\<close>
  using "oa-facts:2" "B\<diamond>" "RM\<diamond>" "Hypothetical Syllogism" by blast

AOT_theorem "oa-facts:5": \<open>\<diamond>O!x \<equiv> \<box>O!x\<close>
  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
            "oa-facts:1" "oa-facts:3")

AOT_theorem "oa-facts:6": \<open>\<diamond>A!x \<equiv> \<box>A!x\<close>
  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
            "oa-facts:2" "oa-facts:4")

AOT_theorem "oa-facts:7": \<open>O!x \<equiv> \<^bold>\<A>O!x\<close>
  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
            "oa-facts:1" "oa-facts:3")

AOT_theorem "oa-facts:8": \<open>A!x \<equiv> \<^bold>\<A>A!x\<close>
  by (meson "Act-Sub:3" "Hypothetical Syllogism" "\<equiv>I" "nec-imp-act"
            "oa-facts:2" "oa-facts:4")

subsection\<open>The Theory of Relations\<close>
text\<open>\label{PLM: 9.10}\<close>

AOT_theorem "beta-C-meta":
  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<down> \<rightarrow>
   ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv> \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n})\<close>
  using "lambda-predicates:2"[axiom_inst] by blast

AOT_theorem "beta-C-cor:1":
  \<open>(\<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<down>)) \<rightarrow>
   \<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv> \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n})\<close>
  apply (rule "cqt-basic:14"[where 'a='a, THEN "\<rightarrow>E"])
  using "beta-C-meta" "\<forall>I" by fast

AOT_theorem "beta-C-cor:2":
  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down> \<rightarrow>
   \<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv> \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n})\<close>
  apply (rule "\<rightarrow>I"; rule "\<forall>I")
  using "beta-C-meta"[THEN "\<rightarrow>E"] by fast

(* TODO: add better syntax parsing for INSTANCE_OF_CQT_2 *)
theorem "beta-C-cor:3":
  assumes \<open>\<And>\<nu>\<^sub>1\<nu>\<^sub>n. AOT_instance_of_cqt_2 (\<phi> (AOT_term_of_var \<nu>\<^sub>1\<nu>\<^sub>n))\<close>
  shows \<open>[v \<Turnstile> \<forall>\<nu>\<^sub>1...\<forall>\<nu>\<^sub>n ([\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<mu>\<^sub>1...\<mu>\<^sub>n}]\<nu>\<^sub>1...\<nu>\<^sub>n \<equiv>
                         \<phi>{\<nu>\<^sub>1...\<nu>\<^sub>n, \<nu>\<^sub>1...\<nu>\<^sub>n})]\<close>
  using "cqt:2[lambda]"[axiom_inst, OF assms]
        "beta-C-cor:1"[THEN "\<rightarrow>E"] "\<forall>I" by fast

AOT_theorem "betaC:1:a": \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<^bold>\<turnstile>\<^sub>\<box> \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
proof -
  AOT_modally_strict {
    AOT_assume \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
    moreover AOT_have \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>\<close> and \<open>\<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>\<close>
      using calculation "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E"] "&E" by blast+
    ultimately AOT_show \<open>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
      using "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] by blast
  }
qed

AOT_theorem "betaC:1:b": \<open>\<not>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n} \<^bold>\<turnstile>\<^sub>\<box> \<not>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
  using "betaC:1:a" "raa-cor:3" by blast

lemmas "\<beta>\<rightarrow>C" = "betaC:1:a" "betaC:1:b"

AOT_theorem "betaC:2:a":
  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>, \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>, \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n} \<^bold>\<turnstile>\<^sub>\<box>
   [\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
proof -
  AOT_modally_strict {
    AOT_assume 1: \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>\<close>
           and 2: \<open>\<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>\<close>
           and 3: \<open>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
    AOT_hence \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
      using "beta-C-cor:2"[THEN "\<rightarrow>E", OF 1, THEN "\<forall>E"(1), THEN "\<equiv>E"(2)]
      by blast
  }
  AOT_thus \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>, \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>, \<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n} \<^bold>\<turnstile>\<^sub>\<box>
            [\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n\<close>
    by blast
qed

AOT_theorem "betaC:2:b":
  \<open>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<down>, \<kappa>\<^sub>1...\<kappa>\<^sub>n\<down>, \<not>[\<lambda>\<mu>\<^sub>1...\<mu>\<^sub>n \<phi>{\<mu>\<^sub>1...\<mu>\<^sub>n}]\<kappa>\<^sub>1...\<kappa>\<^sub>n \<^bold>\<turnstile>\<^sub>\<box>
   \<not>\<phi>{\<kappa>\<^sub>1...\<kappa>\<^sub>n}\<close>
  using "betaC:2:a" "raa-cor:3" by blast

lemmas "\<beta>\<leftarrow>C" = "betaC:2:a" "betaC:2:b"

AOT_theorem "eta-conversion-lemma1:1": \<open>\<Pi>\<down> \<rightarrow> [\<lambda>x\<^sub>1...x\<^sub>n [\<Pi>]x\<^sub>1...x\<^sub>n] = \<Pi>\<close>
  using "lambda-predicates:3"[axiom_inst] "\<forall>I" "\<forall>E"(1) "\<rightarrow>I" by fast

(* Note: generalized alphabetic variant of the last theorem *)
AOT_theorem "eta-conversion-lemma1:2": \<open>\<Pi>\<down> \<rightarrow> [\<lambda>\<nu>\<^sub>1...\<nu>\<^sub>n [\<Pi>]\<nu>\<^sub>1...\<nu>\<^sub>n] = \<Pi>\<close>
  using "eta-conversion-lemma1:1".

text\<open>Note: not explicitly part of PLM.\<close>
AOT_theorem id_sym:
  assumes \<open>\<tau> = \<tau>'\<close>
  shows \<open>\<tau>' = \<tau>\<close>
  using "rule=E"[where \<phi>="\<lambda> \<tau>' . \<guillemotleft>\<tau>' = \<tau>\<guillemotright>", rotated 1, OF assms]
        "=I"(1)[OF "t=t-proper:1"[THEN "\<rightarrow>E", OF assms]] by auto
declare id_sym[sym]

text\<open>Note: not explicitly part of PLM.\<close>
AOT_theorem id_trans:
  assumes \<open>\<tau> = \<tau>'\<close> and \<open>\<tau>' = \<tau>''\<close>
  shows \<open>\<tau> = \<tau>''\<close>
  using "rule=E" assms by blast
declare id_trans[trans]

method "\<eta>C" for \<Pi> :: \<open><'a::{AOT_Term_id_2,AOT_\<kappa>s}>\<close> =
  (match conclusion in "[v \<Turnstile> \<tau>{\<Pi>} = \<tau>'{\<Pi>}]" for v \<tau> \<tau>' \<Rightarrow> \<open>
   rule "rule=E"[rotated 1, OF "eta-conversion-lemma1:2"
    [THEN "\<rightarrow>E", of v "\<guillemotleft>[\<Pi>]\<guillemotright>", symmetric]]\<close>)

AOT_theorem "sub-des-lam:1":
  \<open>[\<lambda>z\<^sub>1...z\<^sub>n  \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}]\<down> &&nbsp;\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x} \<rightarrow>
   [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}] = [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<psi>{x}}]\<close>
proof(rule "\<rightarrow>I")
  AOT_assume A: \<open>[\<lambda>z\<^sub>1...z\<^sub>n  \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}]\<down> & \<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x}\<close>
  AOT_show \<open>[\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}] = [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<psi>{x}}]\<close>
    using "rule=E"[where \<phi>="\<lambda> \<tau> . \<guillemotleft>[\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<^bold>\<iota>x \<phi>{x}}] =
                                   [\<lambda>z\<^sub>1...z\<^sub>n \<chi>{z\<^sub>1...z\<^sub>n, \<tau>}]\<guillemotright>",
               OF "=I"(1)[OF A[THEN "&E"(1)]], OF A[THEN "&E"(2)]]
    by blast
qed

AOT_theorem "sub-des-lam:2":
  \<open>\<^bold>\<iota>x \<phi>{x} = \<^bold>\<iota>x \<psi>{x} \<rightarrow> \<chi>{\<^bold>\<iota>x \<phi>{x}} = \<chi>{\<^bold>\<iota>x \<psi>{x}}\<close> for \<chi> :: \<open>\<kappa> \<Rightarrow> \<o>\<close>
  using "rule=E"[where \<phi>="\<lambda> \<tau> . \<guillemotleft>\<chi>{\<^bold>\<iota>x \<phi>{x}} = \<chi>{\<tau>}\<guillemotright>",
                 OF "=I"(1)[OF "log-prop-prop:2"]] "\<rightarrow>I" by blast

AOT_theorem "prop-equiv": \<open>F = G \<equiv> \<forall>x (x[F] \<equiv> x[G])\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>F = G\<close>
  AOT_thus \<open>\<forall>x (x[F] \<equiv> x[G])\<close>
    by (rule "rule=E"[rotated]) (fact "oth-class-taut:3:a"[THEN GEN])
next
  AOT_assume \<open>\<forall>x (x[F] \<equiv> x[G])\<close>
  AOT_hence \<open>x[F] \<equiv> x[G]\<close> for x
    using "\<forall>E" by blast
  AOT_hence \<open>\<box>(x[F] \<equiv> x[G])\<close> for x
    using "en-eq:6[1]"[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<forall>x \<box>(x[F] \<equiv> x[G])\<close>
    by (rule GEN)
  AOT_hence \<open>\<box>\<forall>x (x[F] \<equiv> x[G])\<close>
    using BF[THEN "\<rightarrow>E"] by fast
  AOT_thus "F = G"
    using "p-identity-thm2:1"[THEN "\<equiv>E"(2)] by blast
qed

AOT_theorem "relations:1":
  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
  shows \<open>\<exists>F \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> \<phi>{x\<^sub>1...x\<^sub>n})\<close>
  apply (rule "\<exists>I"(1)[where \<tau>="\<guillemotleft>[\<lambda>x\<^sub>1...x\<^sub>n \<phi>{x\<^sub>1...x\<^sub>n}]\<guillemotright>"])
  using "cqt:2[lambda]"[OF assms, axiom_inst]
        "beta-C-cor:2"[THEN "\<rightarrow>E", THEN RN] by blast+

AOT_theorem "relations:2":
  assumes \<open>INSTANCE_OF_CQT_2(\<phi>)\<close>
  shows \<open>\<exists>F \<box>\<forall>x ([F]x \<equiv> \<phi>{x})\<close>
  using "relations:1" assms by blast

AOT_theorem "block-paradox:1": \<open>\<not>[\<lambda>x \<exists>G (x[G] & \<not>[G]x)]\<down>\<close>
proof(rule "raa-cor:2")
  let ?K="\<guillemotleft>[\<lambda>x \<exists>G (x[G] & \<not>[G]x)]\<guillemotright>"
  AOT_assume A: \<open>\<guillemotleft>?K\<guillemotright>\<down>\<close>
  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> F = \<guillemotleft>?K\<guillemotright>))\<close>
    using "A-objects"[axiom_inst] by fast
  then AOT_obtain a where \<xi>: \<open>A!a & \<forall>F (a[F] \<equiv> F = \<guillemotleft>?K\<guillemotright>)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_show \<open>p & \<not>p\<close> for p
  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
    AOT_assume B: \<open>[\<guillemotleft>?K\<guillemotright>]a\<close>
    AOT_hence \<open>\<exists>G (a[G] & \<not>[G]a)\<close>
      using "\<beta>\<rightarrow>C" A by blast
    then AOT_obtain P where \<open>a[P] & \<not>[P]a\<close>
      using "\<exists>E"[rotated] by blast
    moreover AOT_have \<open>P = [\<guillemotleft>?K\<guillemotright>]\<close>
      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)]
            calculation[THEN "&E"(1)] by blast
    ultimately AOT_have \<open>\<not>[\<guillemotleft>?K\<guillemotright>]a\<close>
      using "rule=E" "&E"(2) by fast
    AOT_thus \<open>p & \<not>p\<close>
      using B RAA by blast
  next
    AOT_assume B: \<open>\<not>[\<guillemotleft>?K\<guillemotright>]a\<close>
    AOT_hence \<open>\<not>\<exists>G (a[G] & \<not>[G]a)\<close>
      using "\<beta>\<leftarrow>C" "cqt:2[const_var]"[of a, axiom_inst] A by blast
    AOT_hence C: \<open>\<forall>G \<not>(a[G] & \<not>[G]a)\<close>
      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
    AOT_have \<open>\<forall>G (a[G] \<rightarrow> [G]a)\<close>
      by (AOT_subst \<open>a[G] \<rightarrow> [G]a\<close> \<open>\<not>(a[G] & \<not>[G]a)\<close> for: G)
         (auto simp: "oth-class-taut:1:a" C)
    AOT_hence \<open>a[\<guillemotleft>?K\<guillemotright>] \<rightarrow> [\<guillemotleft>?K\<guillemotright>]a\<close>
      using "\<forall>E" A by blast
    moreover AOT_have \<open>a[\<guillemotleft>?K\<guillemotright>]\<close>
      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(1), OF A, THEN "\<equiv>E"(2)]
      using "=I"(1)[OF A] by blast
    ultimately AOT_show \<open>p & \<not>p\<close>
      using B "\<rightarrow>E" RAA by blast
  qed
qed

AOT_theorem "block-paradox:2": \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] &&nbsp;\<not>[G]x))\<close>
proof(rule RAA(2))
  AOT_assume \<open>\<exists>F \<forall>x ([F]x \<equiv> \<exists>G (x[G] & \<not>[G]x))\<close>
  then AOT_obtain F where F_prop: \<open>\<forall>x ([F]x \<equiv> \<exists>G (x[G] & \<not>[G]x))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<open>\<exists>x (A!x & \<forall>G (x[G] \<equiv> G = F))\<close>
    using "A-objects"[axiom_inst] by fast
  then AOT_obtain a where \<xi>: \<open>A!a & \<forall>G (a[G] \<equiv> G = F)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_show \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
    AOT_assume B: \<open>[F]a\<close>
    AOT_hence \<open>\<exists>G (a[G] & \<not>[G]a)\<close>
      using F_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
    then AOT_obtain P where \<open>a[P] & \<not>[P]a\<close>
      using "\<exists>E"[rotated] by blast
    moreover AOT_have \<open>P = F\<close>
      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)]
            calculation[THEN "&E"(1)] by blast
    ultimately AOT_have \<open>\<not>[F]a\<close>
      using "rule=E" "&E"(2) by fast
    AOT_thus \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
      using B RAA by blast
  next
    AOT_assume B: \<open>\<not>[F]a\<close>
    AOT_hence \<open>\<not>\<exists>G (a[G] & \<not>[G]a)\<close>
      using "oth-class-taut:4:b"[THEN "\<equiv>E"(1),
              OF F_prop[THEN "\<forall>E"(2)[of _ _ a]], THEN "\<equiv>E"(1)]
      by simp
    AOT_hence C: \<open>\<forall>G \<not>(a[G] & \<not>[G]a)\<close>
      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
    AOT_have \<open>\<forall>G (a[G] \<rightarrow> [G]a)\<close>
      by (AOT_subst \<open>a[G] \<rightarrow> [G]a\<close> \<open>\<not>(a[G] & \<not>[G]a)\<close> for: G)
         (auto simp: "oth-class-taut:1:a" C)
    AOT_hence \<open>a[F] \<rightarrow> [F]a\<close>
      using "\<forall>E" by blast
    moreover AOT_have \<open>a[F]\<close>
      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), of F, THEN "\<equiv>E"(2)]
      using "=I"(2) by blast
    ultimately AOT_show \<open>\<not>\<exists>F \<forall>x([F]x \<equiv> \<exists>G(x[G] & \<not>[G]x))\<close>
      using B "\<rightarrow>E" RAA by blast
  qed
qed(simp)

AOT_theorem "block-paradox:3": \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close>
proof(rule RAA(2))
  AOT_assume \<theta>: \<open>\<forall>y [\<lambda>z z = y]\<down>\<close>
  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> \<exists>y(F = [\<lambda>z z = y] & \<not>y[F])))\<close>
    using "A-objects"[axiom_inst] by force
  then AOT_obtain a where
    a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>y (F = [\<lambda>z z = y] & \<not>y[F]))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<zeta>: \<open>a[\<lambda>z z = a] \<equiv> \<exists>y ([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
    using \<theta>[THEN "\<forall>E"(2)] a_prop[THEN "&E"(2), THEN "\<forall>E"(1)] by blast
  AOT_show \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close>
  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
    AOT_assume A: \<open>a[\<lambda>z z = a]\<close>
    AOT_hence \<open>\<exists>y ([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
      using \<zeta>[THEN "\<equiv>E"(1)] by blast
    then AOT_obtain b where b_prop: \<open>[\<lambda>z z = a] = [\<lambda>z z = b] & \<not>b[\<lambda>z z = a]\<close>
      using "\<exists>E"[rotated] by blast
    moreover AOT_have \<open>a = a\<close> by (rule "=I")
    moreover AOT_have \<open>[\<lambda>z z = a]\<down>\<close> using \<theta> "\<forall>E" by blast
    moreover AOT_have \<open>a\<down>\<close> using "cqt:2[const_var]"[axiom_inst] .
    ultimately AOT_have \<open>[\<lambda>z z = a]a\<close> using "\<beta>\<leftarrow>C" by blast
    AOT_hence \<open>[\<lambda>z z = b]a\<close> using "rule=E" b_prop[THEN "&E"(1)] by fast
    AOT_hence \<open>a = b\<close> using "\<beta>\<rightarrow>C" by blast
    AOT_hence \<open>b[\<lambda>z z = a]\<close> using A "rule=E" by fast
    AOT_thus \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close> using b_prop[THEN "&E"(2)] RAA by blast
  next
    AOT_assume A: \<open>\<not>a[\<lambda>z z = a]\<close>
    AOT_hence \<open>\<not>\<exists>y ([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
      using \<zeta> "oth-class-taut:4:b"[THEN "\<equiv>E"(1), THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<forall>y \<not>([\<lambda>z z = a] = [\<lambda>z z = y] & \<not>y[\<lambda>z z = a])\<close>
      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<not>([\<lambda>z z = a] = [\<lambda>z z = a] & \<not>a[\<lambda>z z = a])\<close>
      using "\<forall>E" by blast
    AOT_hence \<open>[\<lambda>z z = a] = [\<lambda>z z = a] \<rightarrow> a[\<lambda>z z = a]\<close>
      by (metis "&I" "deduction-theorem" "raa-cor:4")
    AOT_hence \<open>a[\<lambda>z z = a]\<close> using "=I"(1) \<theta>[THEN "\<forall>E"(2)] "\<rightarrow>E" by blast
    AOT_thus \<open>\<not>\<forall>y [\<lambda>z z = y]\<down>\<close> using A RAA by blast
  qed
qed(simp)

AOT_theorem "block-paradox:4": \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
proof(rule RAA(2))
  AOT_assume \<theta>: \<open>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> \<exists>z (\<forall>y([F]y \<equiv> y = z) & \<not>z[F])))\<close>
    using "A-objects"[axiom_inst] by force
  then AOT_obtain a where
    a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> \<exists>z (\<forall>y([F]y \<equiv> y = z) & \<not>z[F]))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_obtain F where F_prop: \<open>\<forall>x ([F]x \<equiv> x = a)\<close>
    using \<theta>[THEN "\<forall>E"(2)] "\<exists>E"[rotated] by blast
  AOT_have \<zeta>: \<open>a[F] \<equiv> \<exists>z (\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
    using a_prop[THEN "&E"(2), THEN "\<forall>E"(2)] by blast
  AOT_show \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
  proof (rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I")
    AOT_assume A: \<open>a[F]\<close>
    AOT_hence \<open>\<exists>z (\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
      using \<zeta>[THEN "\<equiv>E"(1)] by blast
    then AOT_obtain b where b_prop: \<open>\<forall>y ([F]y \<equiv> y = b) & \<not>b[F]\<close>
      using "\<exists>E"[rotated] by blast
    moreover AOT_have \<open>[F]a\<close>
      using F_prop[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] "=I"(2) by blast
    ultimately AOT_have \<open>a = b\<close>
      using "\<forall>E"(2) "\<equiv>E"(1) "&E" by fast
    AOT_hence \<open>a = b\<close>
      using "\<beta>\<rightarrow>C" by blast
    AOT_hence \<open>b[F]\<close>
      using A "rule=E" by fast
    AOT_thus \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
      using b_prop[THEN "&E"(2)] RAA by blast
  next
    AOT_assume A: \<open>\<not>a[F]\<close>
    AOT_hence \<open>\<not>\<exists>z (\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
      using \<zeta> "oth-class-taut:4:b"[THEN "\<equiv>E"(1), THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<forall>z \<not>(\<forall>y ([F]y \<equiv> y = z) & \<not>z[F])\<close>
      using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<not>(\<forall>y ([F]y \<equiv> y = a) & \<not>a[F])\<close>
      using "\<forall>E" by blast
    AOT_hence \<open>\<forall>y ([F]y \<equiv> y = a) \<rightarrow> a[F]\<close>
      by (metis "&I" "deduction-theorem" "raa-cor:4")
    AOT_hence \<open>a[F]\<close> using F_prop "\<rightarrow>E" by blast
    AOT_thus \<open>\<not>\<forall>y \<exists>F \<forall>x([F]x \<equiv> x = y)\<close>
      using A RAA by blast
  qed
qed(simp)

AOT_theorem "block-paradox:5": \<open>\<not>\<exists>F\<forall>x\<forall>y([F]xy \<equiv> y = x)\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<exists>F\<forall>x\<forall>y([F]xy \<equiv> y = x)\<close>
  then AOT_obtain F where F_prop: \<open>\<forall>x\<forall>y([F]xy \<equiv> y = x)\<close>
    using "\<exists>E"[rotated] by blast
  {
    fix x
    AOT_have 1: \<open>\<forall>y([F]xy \<equiv> y = x)\<close>
      using F_prop "\<forall>E" by blast
    AOT_have 2: \<open>[\<lambda>z [F]xz]\<down>\<close> by "cqt:2"
    moreover AOT_have \<open>\<forall>y([\<lambda>z [F]xz]y \<equiv> y = x)\<close>
    proof(rule "\<forall>I")
      fix y
      AOT_have \<open>[\<lambda>z [F]xz]y \<equiv> [F]xy\<close>
        using "beta-C-meta"[THEN "\<rightarrow>E"] 2 by fast
      also AOT_have \<open>... \<equiv> y = x\<close>
        using 1 "\<forall>E" by fast
      finally AOT_show \<open>[\<lambda>z [F]xz]y \<equiv> y = x\<close>.
    qed
    ultimately AOT_have \<open>\<exists>F\<forall>y([F]y \<equiv> y = x)\<close>
      using "\<exists>I" by fast
  }
  AOT_hence \<open>\<forall>x\<exists>F\<forall>y([F]y \<equiv> y = x)\<close>
    by (rule GEN)
  AOT_thus \<open>\<forall>x\<exists>F\<forall>y([F]y \<equiv> y = x) & \<not>\<forall>x\<exists>F\<forall>y([F]y \<equiv> y = x)\<close>
    using "&I" "block-paradox:4" by blast
qed

AOT_act_theorem "block-paradox2:1":
  \<open>\<forall>x [G]x \<rightarrow> \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] &&nbsp;\<not>[H]x))]\<down>\<close>
proof(rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_assume antecedant: \<open>\<forall>x [G]x\<close>
  AOT_have Lemma: \<open>\<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
  proof(rule GEN)
    fix x
    AOT_have A: \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv>
                 \<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
    proof(rule "\<equiv>I"; rule "\<rightarrow>I")
      AOT_assume \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
      AOT_hence \<open>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
        using "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)] by blast
      AOT_thus \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "!-exists:1"[THEN "\<equiv>E"(1)] by blast
    next
      AOT_assume A: \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
      AOT_obtain a where a_1: \<open>a = x & \<exists>H (x[H] & \<not>[H]x)\<close>
                     and a_2: \<open>\<forall>z (z = x & \<exists>H (x[H] & \<not>[H]x) \<rightarrow> z = a)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
      AOT_have a_3: \<open>[G]a\<close>
        using antecedant "\<forall>E" by blast
      AOT_show \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        apply (rule "russell-axiom[exe,1].russell-axiom"[THEN "\<equiv>E"(2)])
        apply (rule "\<exists>I"(2))
        using a_1 a_2 a_3 "&I" by blast
    qed
    also AOT_have B: \<open>... \<equiv> \<exists>H (x[H] & \<not>[H]x)\<close>
    proof (rule "\<equiv>I"; rule "\<rightarrow>I")
      AOT_assume A: \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
      AOT_obtain a where \<open>a = x & \<exists>H (x[H] & \<not>[H]x)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
      AOT_thus \<open>\<exists>H (x[H] & \<not>[H]x)\<close> using "&E" by blast
    next
      AOT_assume \<open>\<exists>H (x[H] & \<not>[H]x)\<close>
      AOT_hence \<open>x = x & \<exists>H (x[H] & \<not>[H]x)\<close>
        using "id-eq:1" "&I" by blast
      moreover AOT_have \<open>\<forall>z (z = x & \<exists>H (x[H] & \<not>[H]x) \<rightarrow> z = x)\<close>
        by (simp add: "Conjunction Simplification"(1) "universal-cor")
      ultimately AOT_show \<open>\<exists>!y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<exists>I"(2) by fast
    qed
    finally AOT_show \<open>([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close> .
  qed

  AOT_assume A: \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
  AOT_have \<theta>: \<open>\<forall>x ([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]x \<equiv>
                   [G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)))\<close>
    using "beta-C-meta"[THEN "\<rightarrow>E", OF A] "\<forall>I" by fast
  AOT_have \<open>\<forall>x ([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]x \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
    using \<theta> Lemma "cqt-basic:10"[THEN "\<rightarrow>E"] "&I" by fast
  AOT_hence \<open>\<exists>F \<forall>x ([F]x \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
    using "\<exists>I"(1) A by fast
  AOT_thus \<open>(\<exists>F \<forall>x ([F]x \<equiv> \<exists>H (x[H] & \<not>[H]x))) &
            (\<not>\<exists>F \<forall>x ([F]x \<equiv> \<exists>H (x[H] & \<not>[H]x)))\<close>
    using "block-paradox:2" "&I" by blast
qed

text\<open>Note: Strengthens the above to a modally-strict theorem.
           Not explicitly part of PLM.\<close>
AOT_theorem "block-paradox2:1[strict]":
  \<open>\<forall>x \<^bold>\<A>[G]x \<rightarrow> \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
proof(rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_assume antecedant: \<open>\<forall>x \<^bold>\<A>[G]x\<close>
  AOT_have Lemma: \<open>\<^bold>\<A>\<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
  proof(safe intro!: GEN "Act-Basic:5"[THEN "\<equiv>E"(2)]
                     "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)])
    fix x
    AOT_have A: \<open>\<^bold>\<A>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv>
                 \<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
    proof(rule "\<equiv>I"; rule "\<rightarrow>I")
      AOT_assume \<open>\<^bold>\<A>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
      moreover AOT_have \<open>\<box>([G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x)) \<rightarrow>
                                  \<box>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>)\<close>
      proof(rule RN; rule "\<rightarrow>I")
        AOT_modally_strict {
          AOT_assume \<open>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
          AOT_hence \<open>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
            using "cqt:5:a"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)] by blast
          AOT_thus \<open>\<box>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
            using "exist-nec"[THEN "\<rightarrow>E"] by blast
        }
      qed
      ultimately AOT_have \<open>\<^bold>\<A>\<box>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
        using "act-cond"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "nec-imp-act"[THEN "\<rightarrow>E"] by blast
      AOT_hence \<open>\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<down>\<close>
        using "Act-Sub:3" "B\<diamond>" "vdash-properties:10" by blast
      AOT_thus \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "actual-desc:1"[THEN "\<equiv>E"(1)] by blast
    next
      AOT_assume A: \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
      AOT_obtain a where a_1: \<open>\<^bold>\<A>(a = x & \<exists>H (x[H] & \<not>[H]x))\<close>
                     and a_2: \<open>\<forall>z (\<^bold>\<A>(z = x & \<exists>H (x[H] & \<not>[H]x)) \<rightarrow> z = a)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
      AOT_have a_3: \<open>\<^bold>\<A>[G]a\<close>
        using antecedant "\<forall>E" by blast
      moreover AOT_have \<open>a = \<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "nec-hintikka-scheme"[THEN "\<equiv>E"(2), OF "&I"] a_1 a_2 by auto
      ultimately AOT_show \<open>\<^bold>\<A>[G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "rule=E" by fast
    qed
    also AOT_have B: \<open>... \<equiv> \<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
    proof (rule "\<equiv>I"; rule "\<rightarrow>I")
      AOT_assume A: \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
      AOT_obtain a where \<open>\<^bold>\<A>(a = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF A] "&E" "\<exists>E"[rotated] by blast
      AOT_thus \<open>\<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
        using "Act-Basic:2"[THEN "\<equiv>E"(1), THEN "&E"(2)] by blast
    next
      AOT_assume \<open>\<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
      AOT_hence \<open>\<^bold>\<A>x = x & \<^bold>\<A>\<exists>H (x[H] & \<not>[H]x)\<close>
        using "id-eq:1" "&I" "RA[2]" by blast
      AOT_hence \<open>\<^bold>\<A>(x = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "act-conj-act:3" "Act-Basic:2" "\<equiv>E" by blast
      moreover AOT_have \<open>\<forall>z (\<^bold>\<A>(z = x & \<exists>H (x[H] & \<not>[H]x)) \<rightarrow> z = x)\<close>
      proof(safe intro!: GEN "\<rightarrow>I")
        fix z
        AOT_assume \<open>\<^bold>\<A>(z = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        AOT_hence \<open>\<^bold>\<A>(z = x)\<close>
          using "Act-Basic:2"[THEN "\<equiv>E"(1), THEN "&E"(1)] by blast
        AOT_thus \<open>z = x\<close>
           by (metis "id-act:1" "intro-elim:3:b")
      qed
      ultimately AOT_show \<open>\<exists>!y \<^bold>\<A>(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<exists>I"(2) by fast
    qed
    finally AOT_show \<open>(\<^bold>\<A>[G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<^bold>\<A>\<exists>H (x[H] & \<not>[H]x))\<close>.
  qed

  AOT_assume A: \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
  AOT_hence \<open>\<^bold>\<A>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
    using "exist-nec" "\<rightarrow>E" "nec-imp-act"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<^bold>\<A>([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down> &
                \<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] &&nbsp;\<not>[H]x)))\<close>
    using Lemma "Act-Basic:2"[THEN "\<equiv>E"(2)] "&I" by blast
  moreover AOT_have \<open>\<^bold>\<A>([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & ;\<not>[H]x))]\<down> &
                \<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] &&nbsp;\<not>[H]x)))
      \<rightarrow> \<^bold>\<A>\<exists>p (p & \<not>p)\<close>
  proof (rule "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(1)];
         rule "RA[2]"; rule "\<rightarrow>I")
    AOT_modally_strict {
      AOT_assume 0: \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down> &
                \<forall>x ([G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x)) \<equiv> \<exists>H (x[H] &&nbsp;\<not>[H]x))\<close>
      AOT_have \<open>\<exists>F \<forall>x ([F]x \<equiv> \<exists>G (x[G] & \<not>[G]x))\<close>
      proof(rule "\<exists>I"(1))
        AOT_show \<open>\<forall>x ([\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]x \<equiv> \<exists>H (x[H] & \<not>[H]x))\<close>
        proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I" "\<beta>\<leftarrow>C" dest!: "\<beta>\<rightarrow>C")
          fix x
          AOT_assume \<open>[G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
          AOT_thus \<open>\<exists>H (x[H] & \<not>[H]x)\<close>
            using 0 "&E" "\<forall>E"(2) "\<equiv>E"(1) by blast
        next
          fix x
          AOT_assume \<open>\<exists>H (x[H] & \<not>[H]x)\<close>
          AOT_thus \<open>[G]\<^bold>\<iota>y(y = x & \<exists>H (x[H] & \<not>[H]x))\<close>
            using 0 "&E" "\<forall>E"(2) "\<equiv>E"(2) by blast
        qed(auto intro!: 0[THEN "&E"(1)] "cqt:2")
      next
        AOT_show \<open>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
          using 0 "&E"(1) by blast
      qed
      AOT_thus \<open>\<exists>p (p & \<not>p)\<close>
        using "block-paradox:2" "reductio-aa:1" by blast
    }
  qed
  ultimately AOT_have \<open>\<^bold>\<A>\<exists>p (p & \<not>p)\<close>
    using "\<rightarrow>E" by blast
  AOT_hence \<open>\<exists>p \<^bold>\<A>(p & \<not>p)\<close>
    by (metis "Act-Basic:10" "intro-elim:3:a")
  then AOT_obtain p where \<open>\<^bold>\<A>(p & \<not>p)\<close>
    using "\<exists>E"[rotated] by blast
  moreover AOT_have \<open>\<not>\<^bold>\<A>(p & \<not>p)\<close>
    using "non-contradiction"[THEN "RA[2]"]
    by (meson "Act-Sub:1" "\<not>\<not>I" "intro-elim:3:d")
  ultimately AOT_show \<open>p & \<not>p\<close> for p
    by (metis "raa-cor:3")
qed

AOT_act_theorem "block-paradox2:2":
  \<open>\<exists>G \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
proof(rule "\<exists>I"(1))
  AOT_have 0: \<open>[\<lambda>x \<forall>p (p \<rightarrow>p)]\<down>\<close>
    by "cqt:2[lambda]"
  moreover AOT_have \<open>\<forall>x [\<lambda>x \<forall>p (p \<rightarrow>p)]x\<close>
    apply (rule GEN)
    apply (rule "beta-C-cor:2"[THEN "\<rightarrow>E", OF 0, THEN "\<forall>E"(2), THEN "\<equiv>E"(2)])
    using "if-p-then-p" GEN by fast
  moreover AOT_have \<open>\<forall>G (\<forall>x [G]x \<rightarrow> \<not>[\<lambda>x [G]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>)\<close>
      using "block-paradox2:1" "\<forall>I" by fast
  ultimately AOT_show \<open>\<not>[\<lambda>x [\<lambda>x \<forall>p (p \<rightarrow>p)]\<^bold>\<iota>y (y = x & \<exists>H (x[H] & \<not>[H]x))]\<down>\<close>
    using "\<forall>E"(1) "\<rightarrow>E" by blast
qed("cqt:2[lambda]")

AOT_theorem propositions: \<open>\<exists>p \<box>(p \<equiv> \<phi>)\<close>
proof(rule "\<exists>I"(1))
  AOT_show \<open>\<box>(\<phi> \<equiv> \<phi>)\<close>
    by (simp add: RN "oth-class-taut:3:a")
next
  AOT_show \<open>\<phi>\<down>\<close>
    by (simp add: "log-prop-prop:2")
qed

AOT_theorem "pos-not-equiv-ne:1":
  \<open>(\<diamond>\<not>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)) \<rightarrow> F \<noteq> G\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>\<diamond>\<not>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)\<close>
  AOT_hence \<open>\<not>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)\<close>
    using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
  AOT_hence \<open>\<not>(F = G)\<close>
    using "id-rel-nec-equiv:1" "modus-tollens:1" by blast
  AOT_thus \<open>F \<noteq> G\<close>
    using "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed

AOT_theorem "pos-not-equiv-ne:2": \<open>(\<diamond>\<not>(\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> F \<noteq> G\<close>
proof (rule "\<rightarrow>I")
  AOT_modally_strict {
    AOT_have \<open>\<not>(\<phi>{F} \<equiv> \<phi>{G}) \<rightarrow> \<not>(F = G)\<close>
    proof (rule "\<rightarrow>I"; rule "raa-cor:2")
      AOT_assume 1: \<open>F = G\<close>
      AOT_hence \<open>\<phi>{F} \<rightarrow> \<phi>{G}\<close>
        using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
      moreover {
        AOT_have \<open>G = F\<close>
          using 1 id_sym by blast
        AOT_hence \<open>\<phi>{G} \<rightarrow> \<phi>{F}\<close>
          using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
      }
      ultimately AOT_have \<open>\<phi>{F} \<equiv> \<phi>{G}\<close>
        using "\<equiv>I" by blast
      moreover AOT_assume \<open>\<not>(\<phi>{F} \<equiv> \<phi>{G})\<close>
      ultimately AOT_show \<open>(\<phi>{F} \<equiv> \<phi>{G}) & \<not>(\<phi>{F} \<equiv> \<phi>{G})\<close>
        using "&I" by blast
    qed
  }
  AOT_hence \<open>\<diamond>\<not>(\<phi>{F} \<equiv> \<phi>{G}) \<rightarrow> \<diamond>\<not>(F = G)\<close>
    using "RM:2[prem]" by blast
  moreover AOT_assume \<open>\<diamond>\<not>(\<phi>{F} \<equiv> \<phi>{G})\<close>
  ultimately AOT_have 0: \<open>\<diamond>\<not>(F = G)\<close> using "\<rightarrow>E" by blast
  AOT_have \<open>\<diamond>(F \<noteq> G)\<close>
    by (AOT_subst \<open>F \<noteq> G\<close> \<open>\<not>(F = G)\<close>)
       (auto simp: "=-infix" "\<equiv>Df" 0)
  AOT_thus \<open>F \<noteq> G\<close>
    using "id-nec2:3"[THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "pos-not-equiv-ne:2[zero]": \<open>(\<diamond>\<not>(\<phi>{p} \<equiv> \<phi>{q})) \<rightarrow> p \<noteq> q\<close>
proof (rule "\<rightarrow>I")
  AOT_modally_strict {
    AOT_have \<open>\<not>(\<phi>{p} \<equiv> \<phi>{q}) \<rightarrow> \<not>(p = q)\<close>
    proof (rule "\<rightarrow>I"; rule "raa-cor:2")
      AOT_assume 1: \<open>p = q\<close>
      AOT_hence \<open>\<phi>{p} \<rightarrow> \<phi>{q}\<close>
        using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
      moreover {
        AOT_have \<open>q = p\<close>
          using 1 id_sym by blast
        AOT_hence \<open>\<phi>{q} \<rightarrow> \<phi>{p}\<close>
          using "l-identity"[axiom_inst, THEN "\<rightarrow>E"] by blast
      }
      ultimately AOT_have \<open>\<phi>{p} \<equiv> \<phi>{q}\<close>
        using "\<equiv>I" by blast
      moreover AOT_assume \<open>\<not>(\<phi>{p} \<equiv> \<phi>{q})\<close>
      ultimately AOT_show \<open>(\<phi>{p} \<equiv> \<phi>{q}) & \<not>(\<phi>{p} \<equiv> \<phi>{q})\<close>
        using "&I" by blast
    qed
  }
  AOT_hence \<open>\<diamond>\<not>(\<phi>{p} \<equiv> \<phi>{q}) \<rightarrow> \<diamond>\<not>(p = q)\<close>
    using "RM:2[prem]" by blast
  moreover AOT_assume \<open>\<diamond>\<not>(\<phi>{p} \<equiv> \<phi>{q})\<close>
  ultimately AOT_have 0: \<open>\<diamond>\<not>(p = q)\<close> using "\<rightarrow>E" by blast
  AOT_have \<open>\<diamond>(p \<noteq> q)\<close>
    by (AOT_subst \<open>p \<noteq> q\<close> \<open>\<not>(p = q)\<close>)
       (auto simp: 0 "=-infix" "\<equiv>Df")
  AOT_thus \<open>p \<noteq> q\<close>
    using "id-nec2:3"[THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "pos-not-equiv-ne:3":
  \<open>(\<not>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([F]x\<^sub>1...x\<^sub>n \<equiv> [G]x\<^sub>1...x\<^sub>n)) \<rightarrow> F \<noteq> G\<close>
  using "\<rightarrow>I" "pos-not-equiv-ne:1"[THEN "\<rightarrow>E"] "T\<diamond>"[THEN "\<rightarrow>E"] by blast

AOT_theorem "pos-not-equiv-ne:4": \<open>(\<not>(\<phi>{F} \<equiv> \<phi>{G})) \<rightarrow> F \<noteq> G\<close>
  using "\<rightarrow>I" "pos-not-equiv-ne:2"[THEN "\<rightarrow>E"] "T\<diamond>"[THEN "\<rightarrow>E"] by blast

AOT_theorem "pos-not-equiv-ne:4[zero]": \<open>(\<not>(\<phi>{p} \<equiv> \<phi>{q})) \<rightarrow> p \<noteq> q\<close>
  using "\<rightarrow>I" "pos-not-equiv-ne:2[zero]"[THEN "\<rightarrow>E"]
        "T\<diamond>"[THEN "\<rightarrow>E"] by blast

AOT_define relation_negation :: "\<Pi> \<Rightarrow> \<Pi>" (\<open>_\<^sup>-\<close>)
  "df-relation-negation": "[F]\<^sup>- =\<^sub>d\<^sub>f [\<lambda>x\<^sub>1...x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n]"

nonterminal \<phi>neg
syntax "" :: "\<phi>neg \<Rightarrow> \<tau>" (\<open>_\<close>)
syntax "" :: "\<phi>neg \<Rightarrow> \<phi>" (\<open>'(_')\<close>)

AOT_define relation_negation_0 :: \<open>\<phi> \<Rightarrow> \<phi>neg\<close> (\<open>'(_')\<^sup>-\<close>)
  "df-relation-negation[zero]": "(p)\<^sup>- =\<^sub>d\<^sub>f [\<lambda> \<not>p]"

AOT_theorem "rel-neg-T:1": \<open>[\<lambda>x\<^sub>1...x\<^sub>n \<not>[\<Pi>]x\<^sub>1...x\<^sub>n]\<down>\<close>
  by "cqt:2[lambda]"

AOT_theorem "rel-neg-T:1[zero]": \<open>[\<lambda> \<not>\<phi>]\<down>\<close>
  using "cqt:2[lambda0]"[axiom_inst] by blast

AOT_theorem "rel-neg-T:2": \<open>[\<Pi>]\<^sup>- = [\<lambda>x\<^sub>1...x\<^sub>n \<not>[\<Pi>]x\<^sub>1...x\<^sub>n]\<close>
  using "=I"(1)[OF "rel-neg-T:1"]
  by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF "rel-neg-T:1"])

AOT_theorem "rel-neg-T:2[zero]": \<open>(\<phi>)\<^sup>- = [\<lambda> \<not>\<phi>]\<close>
  using "=I"(1)[OF "rel-neg-T:1[zero]"]
  by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation[zero]", OF "rel-neg-T:1[zero]"])

AOT_theorem "rel-neg-T:3": \<open>[\<Pi>]\<^sup>-\<down>\<close>
  using "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF "rel-neg-T:1"]
        "rel-neg-T:1" by blast

AOT_theorem "rel-neg-T:3[zero]": \<open>(\<phi>)\<^sup>-\<down>\<close>
  using "log-prop-prop:2" by blast

AOT_theorem "thm-relation-negation:1": \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n \<equiv> \<not>[F]x\<^sub>1...x\<^sub>n\<close>
proof -
  AOT_have \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n \<equiv> [\<lambda>x\<^sub>1...x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n]x\<^sub>1...x\<^sub>n\<close>
    using "rule=E"[rotated, OF "rel-neg-T:2"]
          "rule=E"[rotated, OF "rel-neg-T:2"[THEN id_sym]]
          "\<rightarrow>I" "\<equiv>I" by fast
  also AOT_have \<open>... \<equiv> \<not>[F]x\<^sub>1...x\<^sub>n\<close>
    using "beta-C-meta"[THEN "\<rightarrow>E", OF "rel-neg-T:1"] by fast
  finally show ?thesis.
qed

AOT_theorem "thm-relation-negation:2": \<open>\<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n \<equiv> [F]x\<^sub>1...x\<^sub>n\<close>
  apply (AOT_subst \<open>[F]x\<^sub>1...x\<^sub>n\<close> \<open>\<not>\<not>[F]x\<^sub>1...x\<^sub>n\<close>)
   apply (simp add: "oth-class-taut:3:b")
  apply (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
  using "thm-relation-negation:1".

AOT_theorem "thm-relation-negation:3": \<open>((p)\<^sup>-) \<equiv> \<not>p\<close>
proof -
  AOT_have \<open>(p)\<^sup>- = [\<lambda> \<not>p]\<close> using "rel-neg-T:2[zero]" by blast
  AOT_hence \<open>((p)\<^sup>-) \<equiv> [\<lambda> \<not>p]\<close>
    using "df-relation-negation[zero]" "log-prop-prop:2"
          "oth-class-taut:3:a" "rule-id-df:2:a" by blast
  also AOT_have \<open>[\<lambda> \<not>p] \<equiv> \<not>p\<close>
    by (simp add: "propositions-lemma:2")
  finally show ?thesis.
qed

AOT_theorem "thm-relation-negation:4": \<open>(\<not>((p)\<^sup>-)) \<equiv> p\<close>
  using "thm-relation-negation:3"[THEN "\<equiv>E"(1)]
        "thm-relation-negation:3"[THEN "\<equiv>E"(2)]
        "\<equiv>I" "\<rightarrow>I" RAA by metis

AOT_theorem "thm-relation-negation:5": \<open>[F] \<noteq> [F]\<^sup>-\<close>
proof -
  AOT_have \<open>\<not>([F] = [F]\<^sup>-)\<close>
  proof (rule RAA(2))
    AOT_show \<open>[F]x\<^sub>1...x\<^sub>n \<rightarrow> [F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
      using "if-p-then-p".
  next
    AOT_assume \<open>[F] = [F]\<^sup>-\<close>
    AOT_hence \<open>[F]\<^sup>- = [F]\<close> using id_sym by blast
    AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n \<equiv> \<not>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
      using "rule=E" "thm-relation-negation:1" by fast
    AOT_thus \<open>\<not>([F]x\<^sub>1...x\<^sub>n \<rightarrow> [F]x\<^sub>1...x\<^sub>n)\<close> for x\<^sub>1x\<^sub>n
      using "\<equiv>E" RAA by metis
  qed
  thus ?thesis
    using "\<equiv>\<^sub>d\<^sub>fI" "=-infix" by blast
qed

AOT_theorem "thm-relation-negation:6": \<open>p \<noteq> (p)\<^sup>-\<close>
proof -
  AOT_have \<open>\<not>(p = (p)\<^sup>-)\<close>
  proof (rule RAA(2))
    AOT_show \<open>p \<rightarrow> p\<close>
      using "if-p-then-p".
  next
    AOT_assume \<open>p = (p)\<^sup>-\<close>
    AOT_hence \<open>(p)\<^sup>- = p\<close> using id_sym by blast
    AOT_hence \<open>p \<equiv> \<not>p\<close>
      using "rule=E" "thm-relation-negation:3" by fast
    AOT_thus \<open>\<not>(p \<rightarrow> p)\<close>
      using "\<equiv>E" RAA by metis
  qed
  thus ?thesis
    using "\<equiv>\<^sub>d\<^sub>fI" "=-infix" by blast
qed

AOT_theorem "thm-relation-negation:7": \<open>(p)\<^sup>- = (\<not>p)\<close>
  apply (rule "df-relation-negation[zero]"[THEN "=\<^sub>d\<^sub>fE"(1)])
  using "cqt:2[lambda0]"[axiom_inst] "rel-neg-T:2[zero]"
        "propositions-lemma:1" id_trans by blast+

AOT_theorem "thm-relation-negation:8": \<open>p = q \<rightarrow> (\<not>p) = (\<not>q)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>p = q\<close>
  moreover AOT_have \<open>(\<not>p)\<down>\<close> using "log-prop-prop:2".
  moreover AOT_have \<open>(\<not>p) = (\<not>p)\<close> using calculation(2) "=I" by blast
  ultimately AOT_show \<open>(\<not>p) = (\<not>q)\<close>
    using "rule=E" by fast
qed

AOT_theorem "thm-relation-negation:9": \<open>p = q \<rightarrow> (p)\<^sup>- = (q)\<^sup>-\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>p = q\<close>
  AOT_hence \<open>(\<not>p) = (\<not>q)\<close> using "thm-relation-negation:8" "\<rightarrow>E" by blast
  AOT_thus \<open>(p)\<^sup>- = (q)\<^sup>-\<close>
    using "thm-relation-negation:7" id_sym id_trans by metis
qed

AOT_define Necessary :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>Necessary'(_')\<close>)
  "contingent-properties:1":
  \<open>Necessary([F]) \<equiv>\<^sub>d\<^sub>f \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close>

AOT_define Necessary0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>Necessary0'(_')\<close>)
  "contingent-properties:1[zero]":
  \<open>Necessary0(p) \<equiv>\<^sub>d\<^sub>f \<box>p\<close>

AOT_define Impossible :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>Impossible'(_')\<close>)
  "contingent-properties:2":
  \<open>Impossible([F]) \<equiv>\<^sub>d\<^sub>f F\<down> & \<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close>

AOT_define Impossible0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>Impossible0'(_')\<close>)
  "contingent-properties:2[zero]":
  \<open>Impossible0(p) \<equiv>\<^sub>d\<^sub>f \<box>\<not>p\<close>

AOT_define NonContingent :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>NonContingent'(_')\<close>)
  "contingent-properties:3":
  \<open>NonContingent([F]) \<equiv>\<^sub>d\<^sub>f Necessary([F]) \<or> Impossible([F])\<close>

AOT_define NonContingent0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>NonContingent0'(_')\<close>)
  "contingent-properties:3[zero]":
  \<open>NonContingent0(p) \<equiv>\<^sub>d\<^sub>f Necessary0(p) \<or> Impossible0(p)\<close>

AOT_define Contingent :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>Contingent'(_')\<close>)
  "contingent-properties:4":
  \<open>Contingent([F]) \<equiv>\<^sub>d\<^sub>f F\<down> & \<not>(Necessary([F]) \<or> Impossible([F]))\<close>

AOT_define Contingent0 :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>Contingent0'(_')\<close>)
  "contingent-properties:4[zero]":
  \<open>Contingent0(p) \<equiv>\<^sub>d\<^sub>f \<not>(Necessary0(p) \<or> Impossible0(p))\<close>


AOT_theorem "thm-cont-prop:1": \<open>NonContingent([F]) \<equiv> NonContingent([F]\<^sup>-)\<close>
proof (rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>NonContingent([F])\<close>
  AOT_hence \<open>Necessary([F]) \<or> Impossible([F])\<close>
    using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:3"] by blast
  moreover {
    AOT_assume \<open>Necessary([F])\<close>
    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n)\<close>
      using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:1"] by blast
    moreover AOT_modally_strict {
      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close>
      AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
      AOT_hence \<open>\<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
        by (meson "\<equiv>E"(6) "oth-class-taut:3:a"
                  "thm-relation-negation:2" "\<equiv>E"(1))
      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
    }
    ultimately AOT_have \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<guillemotright>}", simplified] by blast
    AOT_hence \<open>Impossible([F]\<^sup>-)\<close>
      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
                  OF "rel-neg-T:3", THEN "\<equiv>E"(2)]
      by blast
  }
  moreover {
    AOT_assume \<open>Impossible([F])\<close>
    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n)\<close>
      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
                  OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(1)]
      by blast
    moreover AOT_modally_strict {
      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close>
      AOT_hence \<open>\<not>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
      AOT_hence \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
        by (meson "\<equiv>E"(6) "oth-class-taut:3:a"
                  "thm-relation-negation:1" "\<equiv>E"(1))
      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
    }
    ultimately AOT_have \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<guillemotright>}"] by blast
    AOT_hence \<open>Necessary([F]\<^sup>-)\<close>
      using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:1"] by blast
  }
  ultimately AOT_have \<open>Necessary([F]\<^sup>-) \<or> Impossible([F]\<^sup>-)\<close>
    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
  AOT_thus \<open>NonContingent([F]\<^sup>-)\<close>
    using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:3"] by blast
next
  AOT_assume \<open>NonContingent([F]\<^sup>-)\<close>
  AOT_hence \<open>Necessary([F]\<^sup>-) \<or> Impossible([F]\<^sup>-)\<close>
    using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:3"] by blast
  moreover {
    AOT_assume \<open>Necessary([F]\<^sup>-)\<close>
    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
      using "\<equiv>\<^sub>d\<^sub>fE"[OF "contingent-properties:1"] by blast
    moreover AOT_modally_strict {
      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n\<close>
      AOT_hence \<open>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
      AOT_hence \<open>\<not>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n
        by (meson "\<equiv>E"(6) "oth-class-taut:3:a"
                  "thm-relation-negation:1" "\<equiv>E"(2))
      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
    }
    ultimately AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]x\<^sub>1...x\<^sub>n\<close>
      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]\<^sup>-x\<^sub>1...x\<^sub>n\<guillemotright>}"] by blast
    AOT_hence \<open>Impossible([F])\<close>
      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
                  OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(2)]
      by blast
  }
  moreover {
    AOT_assume \<open>Impossible([F]\<^sup>-)\<close>
    AOT_hence \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n)\<close>
      using "\<equiv>Df"[OF "contingent-properties:2", THEN "\<equiv>S"(1),
                  OF "rel-neg-T:3", THEN "\<equiv>E"(1)]
      by blast
    moreover AOT_modally_strict {
      AOT_assume \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close>
      AOT_hence \<open>\<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n using "\<forall>E" by blast
      AOT_hence \<open>[F]x\<^sub>1...x\<^sub>n\<close> for x\<^sub>1x\<^sub>n 
        using "thm-relation-negation:1"[THEN
                "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(1)]
              "useful-tautologies:1"[THEN "\<rightarrow>E"] by blast
      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n\<close> using "\<forall>I" by fast
    }
    ultimately AOT_have \<open>\<box>(\<forall>x\<^sub>1...\<forall>x\<^sub>n [F]x\<^sub>1...x\<^sub>n)\<close>
      using "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<not>[F]\<^sup>-x\<^sub>1...x\<^sub>n\<guillemotright>}"] by blast
    AOT_hence \<open>Necessary([F])\<close>
      using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:1"] by blast
  }
  ultimately AOT_have \<open>Necessary([F]) \<or> Impossible([F])\<close>
    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
  AOT_thus \<open>NonContingent([F])\<close>
    using "\<equiv>\<^sub>d\<^sub>fI"[OF "contingent-properties:3"] by blast
qed

AOT_theorem "thm-cont-prop:2": \<open>Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x\<close>
proof -
  AOT_have \<open>Contingent([F]) \<equiv> \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
    using "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
                                    OF "cqt:2[const_var]"[axiom_inst]]
    by blast
  also AOT_have \<open>... \<equiv> \<not>Necessary([F]) & \<not>Impossible([F])\<close>
    using "oth-class-taut:5:d" by fastforce
  also AOT_have \<open>... \<equiv> \<not>Impossible([F]) & \<not>Necessary([F])\<close>
    by (simp add: "Commutativity of &")
  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]x & \<not>Necessary([F])\<close>
  proof (rule "oth-class-taut:4:e"[THEN "\<rightarrow>E"])
    AOT_have \<open>\<not>Impossible([F]) \<equiv> \<not>\<box>\<not> \<exists>x [F]x\<close>
      apply (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
      apply (AOT_subst \<open>\<exists>x [F]x\<close> \<open>\<not> \<forall>x \<not>[F]x\<close>)
       apply (simp add: "conventions:4" "\<equiv>Df")
      apply (AOT_subst (reverse) \<open>\<not>\<not>\<forall>x \<not>[F]x\<close> \<open>\<forall>x \<not>[F]x\<close>)
       apply (simp add: "oth-class-taut:3:b")
      using "contingent-properties:2"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
                                      OF "cqt:2[const_var]"[axiom_inst]]
      by blast
    also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]x\<close>
      using "conventions:5"[THEN "\<equiv>Df", symmetric] by blast
    finally AOT_show \<open>\<not>Impossible([F]) \<equiv> \<diamond>\<exists>x [F]x\<close> .
  qed
  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x\<close>
  proof (rule "oth-class-taut:4:f"[THEN "\<rightarrow>E"])
    AOT_have \<open>\<not>Necessary([F]) \<equiv> \<not>\<box>\<not>\<exists>x \<not>[F]x\<close>
      apply (rule "oth-class-taut:4:b"[THEN "\<equiv>E"(1)])
      apply (AOT_subst \<open>\<exists>x \<not>[F]x\<close> \<open>\<not> \<forall>x \<not>\<not>[F]x\<close>)
       apply (simp add: "conventions:4" "\<equiv>Df")
      apply (AOT_subst (reverse) \<open>\<not>\<not>[F]x\<close> \<open>[F]x\<close> for: x)
       apply (simp add: "oth-class-taut:3:b")
      apply (AOT_subst (reverse) \<open>\<not>\<not>\<forall>x [F]x\<close> \<open>\<forall>x [F]x\<close>)
      by (auto simp: "oth-class-taut:3:b" "contingent-properties:1" "\<equiv>Df")
    also AOT_have \<open>... \<equiv> \<diamond>\<exists>x \<not>[F]x\<close>
      using "conventions:5"[THEN "\<equiv>Df", symmetric] by blast
    finally AOT_show \<open>\<not>Necessary([F]) \<equiv> \<diamond>\<exists>x \<not>[F]x\<close>.
  qed
  finally show ?thesis.
qed

AOT_theorem "thm-cont-prop:3":
  \<open>Contingent([F]) \<equiv> Contingent([F]\<^sup>-)\<close> for F::\<open><\<kappa>> AOT_var\<close>
proof -
  {
    fix \<Pi> :: \<open><\<kappa>>\<close>
    AOT_assume \<open>\<Pi>\<down>\<close>
    moreover AOT_have \<open>\<forall>F (Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x)\<close>
      using "thm-cont-prop:2" GEN by fast
    ultimately  AOT_have \<open>Contingent([\<Pi>]) \<equiv> \<diamond>\<exists>x [\<Pi>]x & \<diamond>\<exists>x \<not>[\<Pi>]x\<close>
      using "thm-cont-prop:2" "\<forall>E" by fast
  } note 1 = this
  AOT_have \<open>Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x\<close>
    using "thm-cont-prop:2" by blast
  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x \<not>[F]x & \<diamond>\<exists>x [F]x\<close>
    by (simp add: "Commutativity of &")
  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]\<^sup>-x & \<diamond>\<exists>x [F]x\<close>
    by (AOT_subst \<open>[F]\<^sup>-x\<close> \<open>\<not>[F]x\<close> for: x)
       (auto simp: "thm-relation-negation:1" "oth-class-taut:3:a")
  also AOT_have \<open>... \<equiv> \<diamond>\<exists>x [F]\<^sup>-x & \<diamond>\<exists>x \<not>[F]\<^sup>-x\<close>
    by (AOT_subst (reverse) \<open>[F]x\<close> \<open>\<not>[F]\<^sup>-x\<close> for: x)
       (auto simp: "thm-relation-negation:2" "oth-class-taut:3:a")
  also AOT_have \<open>... \<equiv> Contingent([F]\<^sup>-)\<close>
    using 1[OF "rel-neg-T:3", symmetric] by blast
  finally show ?thesis.
qed

AOT_define concrete_if_concrete :: \<open>\<Pi>\<close> (\<open>L\<close>)
  L_def: \<open>L =\<^sub>d\<^sub>f [\<lambda>x E!x \<rightarrow> E!x]\<close>

AOT_theorem "thm-noncont-e-e:1": \<open>Necessary(L)\<close>
proof -
  AOT_modally_strict {
    fix x
    AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close> by "cqt:2[lambda]"
    moreover AOT_have \<open>x\<down>\<close> using "cqt:2[const_var]"[axiom_inst] by blast
    moreover AOT_have \<open>E!x \<rightarrow> E!x\<close> using "if-p-then-p" by blast
    ultimately AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]x\<close>
      using "\<beta>\<leftarrow>C" by blast
  }
  AOT_hence 0: \<open>\<box>\<forall>x [\<lambda>x E!x \<rightarrow> E!x]x\<close>
    using RN GEN by blast
  show ?thesis
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
     apply "cqt:2[lambda]"
    by (rule "contingent-properties:1"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF 0])
qed

AOT_theorem "thm-noncont-e-e:2": \<open>Impossible([L]\<^sup>-)\<close>
proof -
  AOT_modally_strict {
    fix x

    AOT_have 0: \<open>\<forall>F (\<not>[F]\<^sup>-x \<equiv> [F]x)\<close>
      using "thm-relation-negation:2" GEN by fast
    AOT_have \<open>\<not>[\<lambda>x E!x \<rightarrow> E!x]\<^sup>-x \<equiv> [\<lambda>x E!x \<rightarrow> E!x]x\<close>
      by (rule 0[THEN "\<forall>E"(1)]) "cqt:2[lambda]"
    moreover {
      AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]\<down>\<close> by "cqt:2[lambda]"
      moreover AOT_have \<open>x\<down>\<close> using "cqt:2[const_var]"[axiom_inst] by blast
      moreover AOT_have \<open>E!x \<rightarrow> E!x\<close> using "if-p-then-p" by blast
      ultimately AOT_have \<open>[\<lambda>x E!x \<rightarrow> E!x]x\<close>
        using "\<beta>\<leftarrow>C" by blast
    }
    ultimately AOT_have \<open>\<not>[\<lambda>x E!x \<rightarrow> E!x]\<^sup>-x\<close>
      using "\<equiv>E" by blast
  }
  AOT_hence 0: \<open>\<box>\<forall>x \<not>[\<lambda>x E!x \<rightarrow> E!x]\<^sup>-x\<close>
    using RN GEN by fast
  show ?thesis
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
     apply "cqt:2[lambda]"
    apply (rule "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "&I")
     using "rel-neg-T:3"
     apply blast
    using 0
    by blast
qed

AOT_theorem "thm-noncont-e-e:3": \<open>NonContingent(L)\<close>
  using "thm-noncont-e-e:1"
  by (rule "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "\<or>I"(1)])

AOT_theorem "thm-noncont-e-e:4": \<open>NonContingent([L]\<^sup>-)\<close>
proof -
  AOT_have 0: \<open>\<forall>F (NonContingent([F]) \<equiv> NonContingent([F]\<^sup>-))\<close>
    using "thm-cont-prop:1" "\<forall>I" by fast
  moreover AOT_have 1: \<open>L\<down>\<close>
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
  AOT_show \<open>NonContingent([L]\<^sup>-)\<close>
    using "\<forall>E"(1)[OF 0, OF 1, THEN "\<equiv>E"(1), OF "thm-noncont-e-e:3"] by blast
qed

AOT_theorem "thm-noncont-e-e:5":
  \<open>\<exists>F \<exists>G (F \<noteq> \<guillemotleft>G::<\<kappa>>\<guillemotright> & NonContingent([F]) & NonContingent([G]))\<close>
proof (rule "\<exists>I")+
  {
    AOT_have \<open>\<forall>F [F] \<noteq> [F]\<^sup>-\<close>
      using "thm-relation-negation:5" GEN by fast
    moreover AOT_have \<open>L\<down>\<close>
      by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
    ultimately AOT_have \<open>L \<noteq> [L]\<^sup>-\<close>
      using "\<forall>E" by blast
  }
  AOT_thus \<open>L \<noteq> [L]\<^sup>- & NonContingent(L) & NonContingent([L]\<^sup>-)\<close>
    using "thm-noncont-e-e:3" "thm-noncont-e-e:4" "&I" by metis
next
  AOT_show \<open>[L]\<^sup>-\<down>\<close>
    using "rel-neg-T:3" by blast
next
  AOT_show \<open>L\<down>\<close>
      by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
qed

AOT_theorem "lem-cont-e:1": \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
proof -
  AOT_have \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<exists>x \<diamond>([F]x & \<diamond>\<not>[F]x)\<close>
    using "BF\<diamond>" "CBF\<diamond>" "\<equiv>I" by blast
  also AOT_have \<open>\<dots> \<equiv> \<exists>x (\<diamond>[F]x &  \<diamond>\<not>[F]x)\<close>
    by (AOT_subst \<open>\<diamond>([F]x & \<diamond>\<not>[F]x)\<close> \<open>\<diamond>[F]x &  \<diamond>\<not>[F]x\<close> for: x)
       (auto simp: "S5Basic:11" "cqt-further:7")
  also AOT_have \<open>\<dots> \<equiv> \<exists>x (\<diamond>\<not>[F]x & \<diamond>[F]x)\<close>
    by (AOT_subst \<open>\<diamond>\<not>[F]x & \<diamond>[F]x\<close>  \<open>\<diamond>[F]x & \<diamond>\<not>[F]x\<close> for: x)
       (auto simp: "Commutativity of &" "cqt-further:7")
  also AOT_have \<open>\<dots> \<equiv> \<exists>x \<diamond>(\<not>[F]x & \<diamond>[F]x)\<close>
    by (AOT_subst \<open>\<diamond>(\<not>[F]x & \<diamond>[F]x)\<close> \<open>\<diamond>\<not>[F]x &&nbsp;\<diamond>[F]x\<close> for: x)
       (auto simp: "S5Basic:11" "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
    using "BF\<diamond>" "CBF\<diamond>" "\<equiv>I" by fast
  finally show ?thesis.
qed

AOT_theorem "lem-cont-e:2":
  \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x ([F]\<^sup>-x & \<diamond>\<not>[F]\<^sup>-x)\<close>
proof -
  AOT_have \<open>\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
    using "lem-cont-e:1".
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<exists>x ([F]\<^sup>-x & \<diamond>\<not>[F]\<^sup>-x)\<close>
    apply (AOT_subst \<open>\<not>[F]\<^sup>-x\<close> \<open>[F]x\<close> for: x)
     apply (simp add: "thm-relation-negation:2")
    apply (AOT_subst \<open>[F]\<^sup>-x\<close> \<open>\<not>[F]x\<close> for: x)
     apply (simp add: "thm-relation-negation:1")
    by (simp add: "oth-class-taut:3:a")
  finally show ?thesis.
qed

AOT_theorem "thm-cont-e:1": \<open>\<diamond>\<exists>x (E!x & \<diamond>\<not>E!x)\<close>
proof (rule "CBF\<diamond>"[THEN "\<rightarrow>E"])
  AOT_have \<open>\<exists>x \<diamond>(E!x & \<not>\<^bold>\<A>E!x)\<close>
    using "qml:4"[axiom_inst] "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
  then AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>E!a)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<theta>: \<open>\<diamond>E!a & \<diamond>\<not>\<^bold>\<A>E!a\<close>
    using "KBasic2:3"[THEN "\<rightarrow>E"] by blast
  AOT_have \<xi>: \<open>\<diamond>E!a & \<diamond>\<^bold>\<A>\<not>E!a\<close>
    by (AOT_subst  \<open>\<^bold>\<A>\<not>E!a\<close> \<open>\<not>\<^bold>\<A>E!a\<close>)
       (auto simp: "logic-actual-nec:1"[axiom_inst] \<theta>)
  AOT_have \<zeta>: \<open>\<diamond>E!a & \<^bold>\<A>\<not>E!a\<close>
    by (AOT_subst \<open>\<^bold>\<A>\<not>E!a\<close> \<open>\<diamond>\<^bold>\<A>\<not>E!a\<close>)
       (auto simp add: "Act-Sub:4" \<xi>)
  AOT_hence \<open>\<diamond>E!a & \<diamond>\<not>E!a\<close>
    using "&E" "&I" "Act-Sub:3"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<diamond>(E!a & \<diamond>\<not>E!a)\<close>
    using "S5Basic:11"[THEN "\<equiv>E"(2)] by simp
  AOT_thus \<open>\<exists>x \<diamond>(E!x & \<diamond>\<not>E!x)\<close>
    using "\<exists>I"(2) by fast
qed

AOT_theorem "thm-cont-e:2": \<open>\<diamond>\<exists>x (\<not>E!x & \<diamond>E!x)\<close>
proof -
  AOT_have \<open>\<forall>F (\<diamond>\<exists>x ([F]x & \<diamond>\<not>[F]x) \<equiv> \<diamond>\<exists>x (\<not>[F]x & \<diamond>[F]x))\<close>
    using "lem-cont-e:1" GEN by fast
  AOT_hence \<open>(\<diamond>\<exists>x (E!x & \<diamond>\<not>E!x) \<equiv> \<diamond>\<exists>x (\<not>E!x & \<diamond>E!x))\<close>
    using "\<forall>E"(2) by blast
  thus ?thesis using "thm-cont-e:1" "\<equiv>E" by blast
qed

AOT_theorem "thm-cont-e:3": \<open>\<diamond>\<exists>x E!x\<close>
proof (rule "CBF\<diamond>"[THEN "\<rightarrow>E"])
  AOT_obtain a where \<open>\<diamond>(E!a & \<diamond>\<not>E!a)\<close>
    using "\<exists>E"[rotated, OF "thm-cont-e:1"[THEN "BF\<diamond>"[THEN "\<rightarrow>E"]]] by blast
  AOT_hence \<open>\<diamond>E!a\<close>
    using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)] by blast
  AOT_thus \<open>\<exists>x \<diamond>E!x\<close> using "\<exists>I" by fast
qed

AOT_theorem "thm-cont-e:4": \<open>\<diamond>\<exists>x \<not>E!x\<close>
proof (rule "CBF\<diamond>"[THEN "\<rightarrow>E"])
  AOT_obtain a where \<open>\<diamond>(E!a & \<diamond>\<not>E!a)\<close>
    using "\<exists>E"[rotated, OF "thm-cont-e:1"[THEN "BF\<diamond>"[THEN "\<rightarrow>E"]]] by blast
  AOT_hence \<open>\<diamond>\<diamond>\<not>E!a\<close>
    using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast
  AOT_hence \<open>\<diamond>\<not>E!a\<close>
    using "4\<diamond>"[THEN "\<rightarrow>E"] by blast
  AOT_thus \<open>\<exists>x \<diamond>\<not>E!x\<close> using "\<exists>I" by fast
qed

AOT_theorem "thm-cont-e:5": \<open>Contingent([E!])\<close>
proof -
  AOT_have \<open>\<forall>F (Contingent([F]) \<equiv> \<diamond>\<exists>x [F]x & \<diamond>\<exists>x \<not>[F]x)\<close>
    using "thm-cont-prop:2" GEN by fast
  AOT_hence \<open>Contingent([E!]) \<equiv> \<diamond>\<exists>x E!x & \<diamond>\<exists>x \<not>E!x\<close>
    using "\<forall>E"(2) by blast
  thus ?thesis
    using "thm-cont-e:3" "thm-cont-e:4" "\<equiv>E"(2) "&I" by blast
qed

AOT_theorem "thm-cont-e:6": \<open>Contingent([E!]\<^sup>-)\<close>
proof -
  AOT_have \<open>\<forall>F (Contingent([\<guillemotleft>F::<\<kappa>>\<guillemotright>]) \<equiv> Contingent([F]\<^sup>-))\<close>
    using "thm-cont-prop:3" GEN by fast
  AOT_hence \<open>Contingent([E!]) \<equiv> Contingent([E!]\<^sup>-)\<close>
    using "\<forall>E"(2) by fast
  thus ?thesis using "thm-cont-e:5" "\<equiv>E" by blast
qed

AOT_theorem "thm-cont-e:7":
  \<open>\<exists>F\<exists>G (Contingent([\<guillemotleft>F::<\<kappa>>\<guillemotright>]) & Contingent([G]) & F \<noteq> G)\<close>
proof (rule "\<exists>I")+
  AOT_have \<open>\<forall>F [\<guillemotleft>F::<\<kappa>>\<guillemotright>] \<noteq> [F]\<^sup>-\<close>
    using "thm-relation-negation:5" GEN by fast
  AOT_hence \<open>[E!] \<noteq> [E!]\<^sup>-\<close>
    using "\<forall>E" by fast
  AOT_thus \<open>Contingent([E!]) & Contingent([E!]\<^sup>-) & [E!] \<noteq> [E!]\<^sup>-\<close>
    using "thm-cont-e:5" "thm-cont-e:6" "&I" by metis
next
  AOT_show \<open>E!\<^sup>-\<down>\<close>
    by (fact AOT)
qed("cqt:2")

AOT_theorem "property-facts:1":
  \<open>NonContingent([F]) \<rightarrow> \<not>\<exists>G (Contingent([G]) & G = F)\<close>
proof (rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_assume \<open>NonContingent([F])\<close>
  AOT_hence 1: \<open>Necessary([F]) \<or> Impossible([F])\<close>
    using "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_assume \<open>\<exists>G (Contingent([G]) & G = F)\<close>
  then AOT_obtain G where \<open>Contingent([G]) & G = F\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>Contingent([F])\<close> using "rule=E" "&E" by blast
  AOT_hence \<open>\<not>(Necessary([F]) \<or> Impossible([F]))\<close>
    using "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
            OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(1)] by blast
  AOT_thus \<open>(Necessary([F]) \<or> Impossible([F])) &
            \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
    using 1 "&I" by blast
qed

AOT_theorem "property-facts:2":
  \<open>Contingent([F]) \<rightarrow> \<not>\<exists>G (NonContingent([G]) & G = F)\<close>
proof (rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_assume \<open>Contingent([F])\<close>
  AOT_hence 1: \<open>\<not>(Necessary([F]) \<or> Impossible([F]))\<close>
    using "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
            OF "cqt:2[const_var]"[axiom_inst], THEN "\<equiv>E"(1)] by blast
  AOT_assume \<open>\<exists>G (NonContingent([G]) & G = F)\<close>
  then AOT_obtain G where \<open>NonContingent([G]) & G = F\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>NonContingent([F])\<close>
    using "rule=E" "&E" by blast
  AOT_hence \<open>Necessary([F]) \<or> Impossible([F])\<close>
    using "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_thus \<open>(Necessary([F]) \<or> Impossible([F])) &
            \<not>(Necessary([F]) \<or> Impossible([F]))\<close>
    using 1 "&I" by blast
qed

AOT_theorem "property-facts:3":
  \<open>L \<noteq> [L]\<^sup>- & L \<noteq> E! & L \<noteq> E!\<^sup>- & [L]\<^sup>- \<noteq> [E!]\<^sup>- & E! \<noteq> [E!]\<^sup>-\<close>
proof -
  AOT_have noneqI: \<open>\<Pi> \<noteq> \<Pi>'\<close> if \<open>\<phi>{\<Pi>}\<close> and \<open>\<not>\<phi>{\<Pi>'}\<close> for \<phi> and \<Pi> \<Pi>' :: \<open><\<kappa>>\<close>
    apply (rule "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "raa-cor:2")
    using "rule=E"[where \<phi>=\<phi> and \<tau>=\<Pi> and \<sigma> = \<Pi>'] that "&I" by blast
  AOT_have contingent_denotes: \<open>\<Pi>\<down>\<close> if \<open>Contingent([\<Pi>])\<close> for \<Pi> :: \<open><\<kappa>>\<close>
    using that "contingent-properties:4"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)] by blast
  AOT_have not_noncontingent_if_contingent:
    \<open>\<not>NonContingent([\<Pi>])\<close> if \<open>Contingent([\<Pi>])\<close> for \<Pi> :: \<open><\<kappa>>\<close>
  proof(rule RAA(2))
    AOT_show \<open>\<not>(Necessary([\<Pi>]) \<or> Impossible([\<Pi>]))\<close>
      using that "contingent-properties:4"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
                    OF contingent_denotes[OF that], THEN "\<equiv>E"(1)]
      by blast
  next
    AOT_assume \<open>NonContingent([\<Pi>])\<close>
    AOT_thus \<open>Necessary([\<Pi>]) \<or> Impossible([\<Pi>])\<close>
      using "contingent-properties:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  qed

  show ?thesis
  proof (safe intro!: "&I")
    AOT_show \<open>L \<noteq> [L]\<^sup>-\<close>
      apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
       apply "cqt:2[lambda]"
      apply (rule "\<forall>E"(1)[where \<phi>="\<lambda> \<Pi> . \<guillemotleft>\<Pi> \<noteq> [\<Pi>]\<^sup>-\<guillemotright>"])
       apply (rule GEN) apply (fact AOT)
      by "cqt:2[lambda]"
  next
    AOT_show \<open>L \<noteq> E!\<close>
      apply (rule noneqI)
      using "thm-noncont-e-e:3"
            not_noncontingent_if_contingent[OF "thm-cont-e:5"]
      by auto
  next
    AOT_show \<open>L \<noteq> E!\<^sup>-\<close>
      apply (rule noneqI)
      using "thm-noncont-e-e:3" apply fast
      apply (rule not_noncontingent_if_contingent)
      apply (rule "\<forall>E"(1)[
            where \<phi>="\<lambda> \<Pi> . \<guillemotleft>Contingent([\<Pi>]) \<equiv> Contingent([\<Pi>]\<^sup>-)\<guillemotright>",
            rotated, OF contingent_denotes, THEN "\<equiv>E"(1), rotated])
      using "thm-cont-prop:3" GEN apply fast
      using "thm-cont-e:5" by fast+
  next
    AOT_show \<open>[L]\<^sup>- \<noteq> E!\<^sup>-\<close>
      apply (rule noneqI)
      using "thm-noncont-e-e:4" apply fast
      apply (rule not_noncontingent_if_contingent)
      apply (rule "\<forall>E"(1)[
            where \<phi>="\<lambda> \<Pi> . \<guillemotleft>Contingent([\<Pi>]) \<equiv> Contingent([\<Pi>]\<^sup>-)\<guillemotright>",
            rotated, OF contingent_denotes, THEN "\<equiv>E"(1), rotated])
      using "thm-cont-prop:3" GEN apply fast
      using "thm-cont-e:5" by fast+
  next
    AOT_show \<open>E! \<noteq> E!\<^sup>-\<close>
      apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
       apply "cqt:2[lambda]"
      apply (rule "\<forall>E"(1)[where \<phi>="\<lambda> \<Pi> . \<guillemotleft>\<Pi> \<noteq> [\<Pi>]\<^sup>-\<guillemotright>"])
       apply (rule GEN) apply (fact AOT)
      by "cqt:2"
  qed
qed

AOT_theorem "thm-cont-propos:1":
  \<open>NonContingent0(p) \<equiv> NonContingent0(((p)\<^sup>-))\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>NonContingent0(p)\<close>
  AOT_hence \<open>Necessary0(p) \<or> Impossible0(p)\<close>
    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  moreover {
    AOT_assume \<open>Necessary0(p)\<close>
    AOT_hence 1: \<open>\<box>p\<close>
      using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    AOT_have \<open>\<box>\<not>((p)\<^sup>-)\<close>
      by (AOT_subst \<open>\<not>((p)\<^sup>-)\<close> \<open>p\<close>)
         (auto simp add: 1 "thm-relation-negation:4")
    AOT_hence \<open>Impossible0(((p)\<^sup>-))\<close>
      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  }
  moreover {
    AOT_assume \<open>Impossible0(p)\<close>
    AOT_hence 1: \<open>\<box>\<not>p\<close>
      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
    AOT_have \<open>\<box>((p)\<^sup>-)\<close>
      by (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>) 
         (auto simp: 1 "thm-relation-negation:3")
    AOT_hence \<open>Necessary0(((p)\<^sup>-))\<close>
      by (rule "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  }
  ultimately AOT_have \<open>Necessary0(((p)\<^sup>-)) \<or> Impossible0(((p)\<^sup>-))\<close>
    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
  AOT_thus \<open>NonContingent0(((p)\<^sup>-))\<close>
    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
next
  AOT_assume \<open>NonContingent0(((p)\<^sup>-))\<close>
  AOT_hence \<open>Necessary0(((p)\<^sup>-)) \<or> Impossible0(((p)\<^sup>-))\<close>
    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  moreover {
    AOT_assume \<open>Impossible0(((p)\<^sup>-))\<close>
    AOT_hence 1: \<open>\<box>\<not>((p)\<^sup>-)\<close>
      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
    AOT_have \<open>\<box>p\<close>
      by (AOT_subst (reverse) \<open>p\<close> \<open>\<not>((p)\<^sup>-)\<close>)
         (auto simp: 1 "thm-relation-negation:4")
    AOT_hence \<open>Necessary0(p)\<close>
      using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
  }
  moreover {
    AOT_assume \<open>Necessary0(((p)\<^sup>-))\<close>
    AOT_hence 1: \<open>\<box>((p)\<^sup>-)\<close>
      by (rule "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
    AOT_have \<open>\<box>\<not>p\<close>
      by (AOT_subst (reverse) \<open>\<not>p\<close> \<open>((p)\<^sup>-)\<close>)
         (auto simp: 1 "thm-relation-negation:3")
    AOT_hence \<open>Impossible0(p)\<close>
      by (rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  }
  ultimately AOT_have \<open>Necessary0(p) \<or> Impossible0(p)\<close>
    using "\<or>E"(1) "\<or>I" "\<rightarrow>I" by metis
  AOT_thus \<open>NonContingent0(p)\<close>
    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed

AOT_theorem "thm-cont-propos:2": \<open>Contingent0(\<phi>) \<equiv> \<diamond>\<phi> & \<diamond>\<not>\<phi>\<close>
proof -
  AOT_have \<open>Contingent0(\<phi>) \<equiv> \<not>(Necessary0(\<phi>) \<or> Impossible0(\<phi>))\<close>
    using "contingent-properties:4[zero]"[THEN "\<equiv>Df"] by simp
  also AOT_have \<open>\<dots> \<equiv> \<not>Necessary0(\<phi>) & \<not>Impossible0(\<phi>)\<close>
    by (fact AOT)
  also AOT_have \<open>\<dots> \<equiv> \<not>Impossible0(\<phi>) & \<not>Necessary0(\<phi>)\<close>
    by (fact AOT)
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<phi> & \<diamond>\<not>\<phi>\<close>
    apply (AOT_subst \<open>\<diamond>\<phi>\<close> \<open>\<not>\<box>\<not>\<phi>\<close>)
     apply (simp add: "conventions:5" "\<equiv>Df")
    apply (AOT_subst \<open>Impossible0(\<phi>)\<close> \<open>\<box>\<not>\<phi>\<close>)
     apply (simp add: "contingent-properties:2[zero]" "\<equiv>Df")
    apply (AOT_subst (reverse) \<open>\<diamond>\<not>\<phi>\<close> \<open>\<not>\<box>\<phi>\<close>)
     apply (simp add: "KBasic:11")
    apply (AOT_subst \<open>Necessary0(\<phi>)\<close> \<open>\<box>\<phi>\<close>)
     apply (simp add: "contingent-properties:1[zero]" "\<equiv>Df")
    by (simp add: "oth-class-taut:3:a")
  finally show ?thesis.
qed

AOT_theorem "thm-cont-propos:3": \<open>Contingent0(p) \<equiv> Contingent0(((p)\<^sup>-))\<close>
proof -
  AOT_have \<open>Contingent0(p) \<equiv> \<diamond>p & \<diamond>\<not>p\<close> using "thm-cont-propos:2".
  also AOT_have \<open>\<dots> \<equiv> \<diamond>\<not>p & \<diamond>p\<close> by (fact AOT)
  also AOT_have \<open>\<dots> \<equiv> \<diamond>((p)\<^sup>-) & \<diamond>p\<close>
    by (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>)
       (auto simp: "thm-relation-negation:3" "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<diamond>((p)\<^sup>-) & \<diamond>\<not>((p)\<^sup>-)\<close>
    by (AOT_subst \<open>\<not>((p)\<^sup>-)\<close> \<open>p\<close>)
       (auto simp: "thm-relation-negation:4" "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> Contingent0(((p)\<^sup>-))\<close>
    using "thm-cont-propos:2"[symmetric] by blast
  finally show ?thesis.
qed

AOT_define noncontingent_prop :: \<open>\<phi>\<close> (\<open>p\<^sub>0\<close>)
  p\<^sub>0_def: "(p\<^sub>0) =\<^sub>d\<^sub>f (\<forall>x (E!x \<rightarrow> E!x))"

AOT_theorem "thm-noncont-propos:1":  \<open>Necessary0((p\<^sub>0))\<close>
proof(rule "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_show \<open>\<box>(p\<^sub>0)\<close>
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF p\<^sub>0_def])
    using "log-prop-prop:2" apply simp
    using "if-p-then-p" RN GEN by fast
qed

AOT_theorem "thm-noncont-propos:2": \<open>Impossible0(((p\<^sub>0)\<^sup>-))\<close>
proof(rule "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_show \<open>\<box>\<not>((p\<^sub>0)\<^sup>-)\<close>
    apply (AOT_subst \<open>((p\<^sub>0)\<^sup>-)\<close> \<open>\<not>p\<^sub>0\<close>)
    using "thm-relation-negation:3" GEN "\<forall>E"(1)[rotated, OF "log-prop-prop:2"]
     apply fast
    apply (AOT_subst (reverse) \<open>\<not>\<not>p\<^sub>0\<close> \<open>p\<^sub>0\<close>)
     apply (simp add: "oth-class-taut:3:b")
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF p\<^sub>0_def])
    using "log-prop-prop:2" apply simp
    using "if-p-then-p" RN GEN by fast
qed

AOT_theorem "thm-noncont-propos:3": \<open>NonContingent0((p\<^sub>0))\<close>
  apply(rule "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  using "thm-noncont-propos:1" "\<or>I" by blast

AOT_theorem "thm-noncont-propos:4": \<open>NonContingent0(((p\<^sub>0)\<^sup>-))\<close>
  apply(rule "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  using "thm-noncont-propos:2" "\<or>I" by blast

AOT_theorem "thm-noncont-propos:5":
  \<open>\<exists>p\<exists>q (NonContingent0((p)) & NonContingent0((q)) & p \<noteq> q)\<close>
proof(rule "\<exists>I")+
  AOT_have 0: \<open>\<phi> \<noteq> (\<phi>)\<^sup>-\<close> for \<phi>
    using "thm-relation-negation:6" "\<forall>I"
          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
  AOT_thus \<open>NonContingent0((p\<^sub>0)) & NonContingent0(((p\<^sub>0)\<^sup>-)) & ;(p\<^sub>0) \<noteq> (p\<^sub>0)\<^sup>-\<close>
    using "thm-noncont-propos:3" "thm-noncont-propos:4" "&I" by auto
qed(auto simp: "log-prop-prop:2")

AOT_act_theorem "no-cnac": \<open>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
  then AOT_obtain a where a: \<open>E!a & \<not>\<^bold>\<A>E!a\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<^bold>\<A>\<not>E!a\<close>
    using "&E" "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
  AOT_hence \<open>\<not>E!a\<close>
    using "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>E!a & \<not>E!a\<close>
    using a "&E" "&I" by blast
  AOT_thus \<open>p & \<not>p\<close> for p using "raa-cor:1" by blast
qed

AOT_theorem "pos-not-pna:1": \<open>\<not>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
  AOT_hence \<open>\<exists>x \<^bold>\<A>(E!x & \<not>\<^bold>\<A>E!x)\<close>
    using "Act-Basic:10"[THEN "\<equiv>E"(1)] by blast
  then AOT_obtain a where \<open>\<^bold>\<A>(E!a & \<not>\<^bold>\<A>E!a)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence 1: \<open>\<^bold>\<A>E!a & \<^bold>\<A>\<not>\<^bold>\<A>E!a\<close>
    using "Act-Basic:2"[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<not>\<^bold>\<A>\<^bold>\<A>E!a\<close>
    using "&E"(2) "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<not>\<^bold>\<A>E!a\<close>
    using "logic-actual-nec:4"[axiom_inst, THEN "\<equiv>E"(1)] RAA by blast
  AOT_thus \<open>p & \<not>p\<close> for p using 1[THEN "&E"(1)] "&I" "raa-cor:1" by blast
qed

AOT_theorem "pos-not-pna:2": \<open>\<diamond>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
proof (rule RAA(1))
  AOT_show \<open>\<not>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
    using "pos-not-pna:1" by blast
next
  AOT_assume \<open>\<not>\<diamond>\<not>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
  AOT_hence \<open>\<box>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
    using "KBasic:12"[THEN "\<equiv>E"(2)] by blast
  AOT_thus \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
    using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "pos-not-pna:3": \<open>\<exists>x (\<diamond>E!x & \<not>\<^bold>\<A>E!x)\<close>
proof -
  AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>E!a)\<close>
    using "qml:4"[axiom_inst] "BF\<diamond>"[THEN "\<rightarrow>E"] "\<exists>E"[rotated] by blast
  AOT_hence \<theta>: \<open>\<diamond>E!a\<close> and \<xi>: \<open>\<diamond>\<not>\<^bold>\<A>E!a\<close>
    using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" by blast+
  AOT_have \<open>\<not>\<box>\<^bold>\<A>E!a\<close>
    using \<xi> "KBasic:11"[THEN "\<equiv>E"(2)] by blast
  AOT_hence \<open>\<not>\<^bold>\<A>E!a\<close>
    using "Act-Basic:6"[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
                        THEN "\<equiv>E"(2)] by blast
  AOT_hence \<open>\<diamond>E!a & \<not>\<^bold>\<A>E!a\<close> using \<theta> "&I" by blast
  thus ?thesis using "\<exists>I" by fast
qed

AOT_define contingent_prop :: \<phi> (\<open>q\<^sub>0\<close>)
  q\<^sub>0_def: \<open>(q\<^sub>0) =\<^sub>d\<^sub>f (\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>

AOT_theorem q\<^sub>0_prop: \<open>\<diamond>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
  apply (fact "log-prop-prop:2")
  apply (rule "&I")
   apply (fact "qml:4"[axiom_inst])
  by (fact "pos-not-pna:2")

AOT_theorem "basic-prop:1": \<open>Contingent0((q\<^sub>0))\<close>
proof(rule "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_have \<open>\<not>Necessary0((q\<^sub>0)) & \<not>Impossible0((q\<^sub>0))\<close>
  proof (rule "&I";
         rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def];
         (rule "log-prop-prop:2" | rule "raa-cor:2"))
    AOT_assume \<open>Necessary0(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
    AOT_hence \<open>\<box>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
      using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    AOT_hence \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
      using "Act-Basic:8"[THEN "\<rightarrow>E"] "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
    AOT_thus \<open>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x) & \<not>\<^bold>\<A>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>
      using "pos-not-pna:1" "&I" by blast
  next
    AOT_assume \<open>Impossible0(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
    AOT_hence \<open>\<box>\<not>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
      using "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    AOT_hence \<open>\<not>\<diamond>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
      using "KBasic2:1"[THEN "\<equiv>E"(1)] by blast
    AOT_thus \<open>\<diamond>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x)) & \<not>\<diamond>(\<exists>x (E!x & \<not>\<^bold>\<A>E!x))\<close>
      using "qml:4"[axiom_inst] "&I" by blast
  qed
  AOT_thus \<open>\<not>(Necessary0((q\<^sub>0)) \<or> Impossible0((q\<^sub>0)))\<close>
    using "oth-class-taut:5:d" "\<equiv>E"(2) by blast
qed

AOT_theorem "basic-prop:2": \<open>\<exists>p Contingent0((p))\<close>
  using "\<exists>I"(1)[rotated, OF "log-prop-prop:2"] "basic-prop:1" by blast

AOT_theorem "basic-prop:3": \<open>Contingent0(((q\<^sub>0)\<^sup>-))\<close>
  apply (AOT_subst \<open>((q\<^sub>0)\<^sup>-)\<close> \<open>\<not>q\<^sub>0\<close>)
   apply (insert "thm-relation-negation:3" "\<forall>I"
                "\<forall>E"(1)[rotated, OF "log-prop-prop:2"]; fast)
  apply (rule "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  apply (rule "oth-class-taut:5:d"[THEN "\<equiv>E"(2)])
  apply (rule "&I")
   apply (rule "contingent-properties:1[zero]"[THEN "df-rules-formulas[3]",
                  THEN "useful-tautologies:5"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
   apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
   apply (rule "=\<^sub>d\<^sub>fE"(2)[OF q\<^sub>0_def])
    apply (rule "log-prop-prop:2")
   apply (rule q\<^sub>0_prop[THEN "&E"(1)])
  apply (rule "contingent-properties:2[zero]"[THEN "df-rules-formulas[3]",
                THEN "useful-tautologies:5"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"])
  apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
  by (rule q\<^sub>0_prop[THEN "&E"(2)])

AOT_theorem "basic-prop:4":
  \<open>\<exists>p\<exists>q (p \<noteq> q & Contingent0(p) & Contingent0(q))\<close>
proof(rule "\<exists>I")+
  AOT_have 0: \<open>\<phi> \<noteq> (\<phi>)\<^sup>-\<close> for \<phi>
    using "thm-relation-negation:6" "\<forall>I"
          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
  AOT_show \<open>(q\<^sub>0) \<noteq> (q\<^sub>0)\<^sup>- & Contingent0(q\<^sub>0) & Contingent0(((q\<^sub>0)\<^sup>-))\<close>
    using "basic-prop:1" "basic-prop:3" "&I" 0 by presburger
qed(auto simp: "log-prop-prop:2")

AOT_theorem "proposition-facts:1":
  \<open>NonContingent0(p) \<rightarrow> \<not>\<exists>q (Contingent0(q) & q = p)\<close>
proof(rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_assume \<open>NonContingent0(p)\<close>
  AOT_hence 1: \<open>Necessary0(p) \<or> Impossible0(p)\<close>
    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_assume \<open>\<exists>q (Contingent0(q) & q = p)\<close>
  then AOT_obtain q where \<open>Contingent0(q) & q = p\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>Contingent0(p)\<close>
    using "rule=E" "&E" by fast
  AOT_thus \<open>(Necessary0(p) \<or> Impossible0(p)) &
            \<not>(Necessary0(p) \<or> Impossible0(p))\<close>
    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] 1 "&I" by blast
qed

AOT_theorem "proposition-facts:2":
  \<open>Contingent0(p) \<rightarrow> \<not>\<exists>q (NonContingent0(q) & q = p)\<close>
proof(rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_assume \<open>Contingent0(p)\<close>
  AOT_hence 1: \<open>\<not>(Necessary0(p) \<or> Impossible0(p))\<close>
    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_assume \<open>\<exists>q (NonContingent0(q) & q = p)\<close>
  then AOT_obtain q where \<open>NonContingent0(q) & q = p\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>NonContingent0(p)\<close>
    using "rule=E" "&E" by fast
  AOT_thus \<open>(Necessary0(p) \<or> Impossible0(p)) &
            \<not>(Necessary0(p) \<or> Impossible0(p))\<close>
    using "contingent-properties:3[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] 1 "&I" by blast
qed

AOT_theorem "proposition-facts:3":
  \<open>(p\<^sub>0) \<noteq> (p\<^sub>0)\<^sup>- & (p\<^sub>0) \<noteq> (q\<^sub>0) & (p\<^sub>0) \<noteq> (q\<^sub>0)\<^sup>- & (p\<^sub>0)\<^sup>- \<noteq> (q\<^sub>0)\<^sup>- & (q\<^sub>0) \<noteq> (q\<^sub>0)\<^sup>-\<close>
proof -
  {
    fix \<chi> \<phi> \<psi>
    AOT_assume \<open>\<chi>{\<phi>}\<close>
    moreover AOT_assume \<open>\<not>\<chi>{\<psi>}\<close>
    ultimately AOT_have \<open>\<not>(\<chi>{\<phi>} \<equiv> \<chi>{\<psi>})\<close>
      using RAA "\<equiv>E" by metis
    moreover {
      AOT_have \<open>\<forall>p\<forall>q ((\<not>(\<chi>{p} \<equiv> \<chi>{q})) \<rightarrow> p \<noteq> q)\<close>
        by (rule "\<forall>I"; rule "\<forall>I"; rule "pos-not-equiv-ne:4[zero]")
      AOT_hence \<open>((\<not>(\<chi>{\<phi>} \<equiv> \<chi>{\<psi>})) \<rightarrow> \<phi> \<noteq> \<psi>)\<close>
        using "\<forall>E" "log-prop-prop:2" by blast
    }
    ultimately AOT_have \<open>\<phi> \<noteq> \<psi>\<close>
      using "\<rightarrow>E" by blast
  } note 0 = this
  AOT_have contingent_neg: \<open>Contingent0(\<phi>) \<equiv> Contingent0(((\<phi>)\<^sup>-))\<close> for \<phi>
    using "thm-cont-propos:3" "\<forall>I"
          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
  AOT_have not_noncontingent_if_contingent:
    \<open>\<not>NonContingent0(\<phi>)\<close> if \<open>Contingent0(\<phi>)\<close> for \<phi>
    apply (rule "contingent-properties:3[zero]"[THEN "\<equiv>Df",
                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
    using that "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  show ?thesis
    apply (rule "&I")+
    using "thm-relation-negation:6" "\<forall>I"
          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"]
        apply fast
       apply (rule 0)
    using "thm-noncont-propos:3" apply fast
       apply (rule not_noncontingent_if_contingent)
       apply (fact AOT)
      apply (rule 0)
    apply (rule "thm-noncont-propos:3")
      apply (rule not_noncontingent_if_contingent)
      apply (rule contingent_neg[THEN "\<equiv>E"(1)])
      apply (fact AOT)
     apply (rule 0)
    apply (rule "thm-noncont-propos:4")
      apply (rule not_noncontingent_if_contingent)
      apply (rule contingent_neg[THEN "\<equiv>E"(1)])
     apply (fact AOT)
    using "thm-relation-negation:6" "\<forall>I"
          "\<forall>E"(1)[rotated, OF "log-prop-prop:2"] by fast
qed

AOT_define ContingentlyTrue :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>ContingentlyTrue'(_')\<close>)
  "cont-tf:1": \<open>ContingentlyTrue(p) \<equiv>\<^sub>d\<^sub>f p & \<diamond>\<not>p\<close>

AOT_define ContingentlyFalse :: \<open>\<phi> \<Rightarrow> \<phi>\<close> (\<open>ContingentlyFalse'(_')\<close>)
  "cont-tf:2": \<open>ContingentlyFalse(p) \<equiv>\<^sub>d\<^sub>f \<not>p & \<diamond>p\<close>

AOT_theorem "cont-true-cont:1":
  \<open>ContingentlyTrue((p)) \<rightarrow> Contingent0((p))\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>ContingentlyTrue((p))\<close>
  AOT_hence 1: \<open>p\<close> and 2: \<open>\<diamond>\<not>p\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_have \<open>\<not>Necessary0((p))\<close>
    apply (rule "contingent-properties:1[zero]"[THEN "\<equiv>Df",
                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
    using 2 "KBasic:11"[THEN "\<equiv>E"(2)] by blast
  moreover AOT_have \<open>\<not>Impossible0((p))\<close>
    apply (rule "contingent-properties:2[zero]"[THEN "\<equiv>Df",
                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
    apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
    using "T\<diamond>"[THEN "\<rightarrow>E", OF 1].
  ultimately AOT_have \<open>\<not>(Necessary0((p)) \<or> Impossible0((p)))\<close>
    using DeMorgan(2)[THEN "\<equiv>E"(2)] "&I" by blast
  AOT_thus \<open>Contingent0((p))\<close>
    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed

AOT_theorem "cont-true-cont:2":
  \<open>ContingentlyFalse((p)) \<rightarrow> Contingent0((p))\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>ContingentlyFalse((p))\<close>
  AOT_hence 1: \<open>\<not>p\<close> and 2: \<open>\<diamond>p\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_have \<open>\<not>Necessary0((p))\<close>
    apply (rule "contingent-properties:1[zero]"[THEN "\<equiv>Df",
                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
    using "KBasic:11"[THEN "\<equiv>E"(2)] "T\<diamond>"[THEN "\<rightarrow>E", OF 1] by blast
  moreover AOT_have \<open>\<not>Impossible0((p))\<close>
    apply (rule "contingent-properties:2[zero]"[THEN "\<equiv>Df",
                  THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], THEN "\<equiv>E"(2)])
    apply (rule "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
    using 2.
  ultimately AOT_have \<open>\<not>(Necessary0((p)) \<or> Impossible0((p)))\<close>
    using DeMorgan(2)[THEN "\<equiv>E"(2)] "&I" by blast
  AOT_thus \<open>Contingent0((p))\<close>
    using "contingent-properties:4[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed

AOT_theorem "cont-true-cont:3":
  \<open>ContingentlyTrue((p)) \<equiv> ContingentlyFalse(((p)\<^sup>-))\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>ContingentlyTrue((p))\<close>
  AOT_hence 0: \<open>p & \<diamond>\<not>p\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_have 1: \<open>ContingentlyFalse(\<not>p)\<close>
    apply (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
    apply (AOT_subst (reverse) \<open>\<not>\<not>p\<close> p)
    by (auto simp: "oth-class-taut:3:b" 0)
  AOT_show \<open>ContingentlyFalse(((p)\<^sup>-))\<close>
    apply (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>)
    by (auto simp: "thm-relation-negation:3" 1)
next
  AOT_assume 1: \<open>ContingentlyFalse(((p)\<^sup>-))\<close>
  AOT_have \<open>ContingentlyFalse(\<not>p)\<close>
    by (AOT_subst (reverse) \<open>\<not>p\<close> \<open>((p)\<^sup>-)\<close>)
       (auto simp: "thm-relation-negation:3" 1)
  AOT_hence \<open>\<not>\<not>p & \<diamond>\<not>p\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence \<open>p & \<diamond>\<not>p\<close>
    using "&I" "&E" "useful-tautologies:1"[THEN "\<rightarrow>E"] by metis
  AOT_thus \<open>ContingentlyTrue((p))\<close>
    using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed

AOT_theorem "cont-true-cont:4":
  \<open>ContingentlyFalse((p)) \<equiv> ContingentlyTrue(((p)\<^sup>-))\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>ContingentlyFalse(p)\<close>
  AOT_hence 0: \<open>\<not>p & \<diamond>p\<close>
    using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_have \<open>\<not>p & \<diamond>\<not>\<not>p\<close>
    by (AOT_subst (reverse) \<open>\<not>\<not>p\<close> p)
       (auto simp: "oth-class-taut:3:b" 0)
  AOT_hence 1: \<open>ContingentlyTrue(\<not>p)\<close>
    by (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_show \<open>ContingentlyTrue(((p)\<^sup>-))\<close>
    by (AOT_subst \<open>((p)\<^sup>-)\<close> \<open>\<not>p\<close>)
       (auto simp: "thm-relation-negation:3" 1)
next
  AOT_assume 1: \<open>ContingentlyTrue(((p)\<^sup>-))\<close>
  AOT_have \<open>ContingentlyTrue(\<not>p)\<close>
    by (AOT_subst (reverse) \<open>\<not>p\<close> \<open>((p)\<^sup>-)\<close>)
       (auto simp add: "thm-relation-negation:3" 1)
  AOT_hence 2: \<open>\<not>p & \<diamond>\<not>\<not>p\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_have \<open>\<diamond>p\<close>
    by (AOT_subst p \<open>\<not>\<not>p\<close>)
       (auto simp add: "oth-class-taut:3:b" 2[THEN "&E"(2)])
  AOT_hence \<open>\<not>p & \<diamond>p\<close> using 2[THEN "&E"(1)] "&I" by blast
  AOT_thus \<open>ContingentlyFalse(p)\<close>
    by (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
qed

AOT_theorem "cont-true-cont:5":
  \<open>(ContingentlyTrue((p)) & Necessary0((q))) \<rightarrow> p \<noteq> q\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:1")
  AOT_assume \<open>ContingentlyTrue((p))\<close>
  AOT_hence \<open>\<diamond>\<not>p\<close>
    using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_hence 0: \<open>\<not>\<box>p\<close> using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
  AOT_assume \<open>Necessary0((q))\<close>
  moreover AOT_assume \<open>\<not>(p \<noteq> q)\<close>
  AOT_hence \<open>p = q\<close>
    using "=-infix"[THEN "\<equiv>Df",
                    THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
                    THEN "\<equiv>E"(1)]
          "useful-tautologies:1"[THEN "\<rightarrow>E"] by blast
  ultimately AOT_have \<open>Necessary0((p))\<close> using "rule=E" id_sym by blast
  AOT_hence \<open>\<box>p\<close>
    using "contingent-properties:1[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_thus \<open>\<box>p & \<not>\<box>p\<close> using 0 "&I" by blast
qed

AOT_theorem "cont-true-cont:6":
  \<open>(ContingentlyFalse((p)) & Impossible0((q))) \<rightarrow> p \<noteq> q\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:1")
  AOT_assume \<open>ContingentlyFalse((p))\<close>
  AOT_hence \<open>\<diamond>p\<close>
    using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_hence 1: \<open>\<not>\<box>\<not>p\<close>
    using "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_assume \<open>Impossible0((q))\<close>
  moreover AOT_assume \<open>\<not>(p \<noteq> q)\<close>
  AOT_hence \<open>p = q\<close>
    using "=-infix"[THEN "\<equiv>Df",
                    THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
                    THEN "\<equiv>E"(1)]
          "useful-tautologies:1"[THEN "\<rightarrow>E"] by blast
  ultimately AOT_have \<open>Impossible0((p))\<close> using "rule=E" id_sym by blast
  AOT_hence \<open>\<box>\<not>p\<close>
    using "contingent-properties:2[zero]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_thus \<open>\<box>\<not>p & \<not>\<box>\<not>p\<close> using 1 "&I" by blast
qed

AOT_act_theorem "q0cf:1": \<open>ContingentlyFalse(q\<^sub>0)\<close>
  apply (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
   apply (fact "log-prop-prop:2")
  apply (rule "&I")
   apply (fact "no-cnac")
  by (fact "qml:4"[axiom_inst])

AOT_act_theorem "q0cf:2": \<open>ContingentlyTrue(((q\<^sub>0)\<^sup>-))\<close>
  apply (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
   apply (fact "log-prop-prop:2")
  apply (rule "&I")
   apply (rule "thm-relation-negation:3"
                [unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)])
     apply (fact "no-cnac")
  apply (rule "rule=E"[rotated,
                OF "thm-relation-negation:7"
                   [unvarify p, OF "log-prop-prop:2", THEN id_sym]])
  apply (AOT_subst (reverse) \<open>\<not>\<not>(\<exists>x  (E!x & \<not>\<^bold>\<A>E!x))\<close> \<open>\<exists>x (E!x & \<not>\<^bold>\<A>E!x)\<close>)
  by (auto simp: "oth-class-taut:3:b" "qml:4"[axiom_inst])

AOT_theorem "cont-tf-thm:1": \<open>\<exists>p ContingentlyTrue((p))\<close>
proof(rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I"; rule "\<exists>I")
  AOT_assume \<open>q\<^sub>0\<close>
  AOT_hence \<open>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(2)] "&I" by blast
  AOT_thus \<open>ContingentlyTrue(q\<^sub>0)\<close>
    by (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
next
  AOT_assume \<open>\<not>q\<^sub>0\<close>
  AOT_hence \<open>\<not>q\<^sub>0 & \<diamond>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(1)] "&I" by blast
  AOT_hence \<open>ContingentlyFalse(q\<^sub>0)\<close>
    by (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_thus \<open>ContingentlyTrue(((q\<^sub>0)\<^sup>-))\<close>
    by (rule "cont-true-cont:4"[unvarify p,
                OF "log-prop-prop:2", THEN "\<equiv>E"(1)])
qed(auto simp: "log-prop-prop:2")


AOT_theorem "cont-tf-thm:2": \<open>\<exists>p ContingentlyFalse((p))\<close>
proof(rule "\<or>E"(1)[OF "exc-mid"]; rule "\<rightarrow>I"; rule "\<exists>I")
  AOT_assume \<open>q\<^sub>0\<close>
  AOT_hence \<open>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(2)] "&I" by blast
  AOT_hence \<open>ContingentlyTrue(q\<^sub>0)\<close>
    by (rule "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_thus \<open>ContingentlyFalse(((q\<^sub>0)\<^sup>-))\<close>
    by (rule "cont-true-cont:3"[unvarify p,
                OF "log-prop-prop:2", THEN "\<equiv>E"(1)])
next
  AOT_assume \<open>\<not>q\<^sub>0\<close>
  AOT_hence \<open>\<not>q\<^sub>0 & \<diamond>q\<^sub>0\<close> using q\<^sub>0_prop[THEN "&E"(1)] "&I" by blast
  AOT_thus \<open>ContingentlyFalse(q\<^sub>0)\<close>
    by (rule "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
qed(auto simp: "log-prop-prop:2")

AOT_theorem "property-facts1:1": \<open>\<exists>F\<exists>x ([F]x & \<diamond>\<not>[F]x)\<close>
proof -
  fix x
  AOT_obtain p\<^sub>1 where \<open>ContingentlyTrue((p\<^sub>1))\<close>
    using "cont-tf-thm:1" "\<exists>E"[rotated] by blast
  AOT_hence 1: \<open>p\<^sub>1 & \<diamond>\<not>p\<^sub>1\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_modally_strict {
    AOT_have \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> ([\<lambda>z p]x \<equiv> p)\<close>
      by (rule "beta-C-cor:3"[THEN "\<forall>E"(2)]) cqt_2_lambda_inst_prover
    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> \<box> ([\<lambda>z p]x \<equiv> p)\<close>
      by (rule RN)
    AOT_hence \<open>\<forall>p \<box>([\<lambda>z p]x \<equiv> p)\<close> using GEN by fast
    AOT_hence \<open>\<box>([\<lambda>z p\<^sub>1]x \<equiv> p\<^sub>1)\<close> using "\<forall>E" by fast
  } note 2 = this
  AOT_hence \<open>\<box>([\<lambda>z p\<^sub>1]x \<equiv> p\<^sub>1)\<close> using "\<forall>E" by blast
  AOT_hence \<open>[\<lambda>z p\<^sub>1]x\<close>
    using 1[THEN "&E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(2) by blast
  moreover AOT_have \<open>\<diamond>\<not>[\<lambda>z p\<^sub>1]x\<close>
    using 2[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]]
    apply (AOT_subst \<open>[\<lambda>z p\<^sub>1]x\<close> \<open>p\<^sub>1\<close>)
    using 1[THEN "&E"(2)] by blast
  ultimately AOT_have \<open>[\<lambda>z p\<^sub>1]x & \<diamond>\<not>[\<lambda>z p\<^sub>1]x\<close> using "&I" by blast
  AOT_hence \<open>\<exists>x ([\<lambda>z p\<^sub>1]x & \<diamond>\<not>[\<lambda>z p\<^sub>1]x)\<close> using "\<exists>I"(2) by fast
  moreover AOT_have \<open>[\<lambda>z p\<^sub>1]\<down>\<close> by "cqt:2[lambda]"
  ultimately AOT_show \<open>\<exists>F\<exists>x ([F]x & \<diamond>\<not>[F]x)\<close> by (rule "\<exists>I"(1))
qed

AOT_theorem "property-facts1:2": \<open>\<exists>F\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close>
proof -
  fix x
  AOT_obtain p\<^sub>1 where \<open>ContingentlyFalse((p\<^sub>1))\<close>
    using "cont-tf-thm:2" "\<exists>E"[rotated] by blast
  AOT_hence 1: \<open>\<not>p\<^sub>1 & \<diamond>p\<^sub>1\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_modally_strict {
    AOT_have \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> ([\<lambda>z p]x \<equiv> p)\<close>
      by (rule "beta-C-cor:3"[THEN "\<forall>E"(2)]) cqt_2_lambda_inst_prover
    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> (\<not>[\<lambda>z p]x \<equiv> \<not>p)\<close>
      using "oth-class-taut:4:b" "\<equiv>E" by blast
    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> \<box>(\<not>[\<lambda>z p]x \<equiv> \<not>p)\<close>
      by (rule RN)
    AOT_hence \<open>\<forall>p \<box>(\<not>[\<lambda>z p]x \<equiv> \<not>p)\<close> using GEN by fast
    AOT_hence \<open>\<box>(\<not>[\<lambda>z p\<^sub>1]x \<equiv> \<not>p\<^sub>1)\<close> using "\<forall>E" by fast
  } note 2 = this
  AOT_hence \<open>\<box>(\<not>[\<lambda>z p\<^sub>1]x \<equiv> \<not>p\<^sub>1)\<close> using "\<forall>E" by blast
  AOT_hence 3: \<open>\<not>[\<lambda>z p\<^sub>1]x\<close>
    using 1[THEN "&E"(1)] "qml:2"[axiom_inst, THEN "\<rightarrow>E"] "\<equiv>E"(2) by blast
  AOT_modally_strict {
    AOT_have \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> ([\<lambda>z p]x \<equiv> p)\<close>
      by (rule "beta-C-cor:3"[THEN "\<forall>E"(2)]) cqt_2_lambda_inst_prover
    AOT_hence \<open>for arbitrary p: \<^bold>\<turnstile>\<^sub>\<box> \<box>([\<lambda>z p]x \<equiv> p)\<close>
      by (rule RN)
    AOT_hence \<open>\<forall>p \<box>([\<lambda>z p]x \<equiv> p)\<close> using GEN by fast
    AOT_hence \<open>\<box>([\<lambda>z p\<^sub>1]x \<equiv> p\<^sub>1)\<close> using "\<forall>E" by fast
  } note 4 = this
  AOT_have \<open>\<diamond>[\<lambda>z p\<^sub>1]x\<close>
    using 4[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]]
    apply (AOT_subst \<open>[\<lambda>z p\<^sub>1]x\<close> \<open>p\<^sub>1\<close>)
    using 1[THEN "&E"(2)] by blast
  AOT_hence \<open>\<not>[\<lambda>z p\<^sub>1]x & \<diamond>[\<lambda>z p\<^sub>1]x\<close> using 3 "&I"</span> by blast
  AOT_hence \<open>\<exists>x (\<not>[\<lambda>z p\<^sub>1]x & \<diamond>[\<lambda>z p\<^sub>1]x)\<close> using "\<exists>I"(2) by fast
  moreover AOT_have \<open>[\<lambda>z p\<^sub>1]\<down>\<close> by "cqt:2[lambda]"
  ultimately AOT_show \<open>\<exists>F\<exists>x (\<not>[F]x & \<diamond>[F]x)\<close> by (rule "\<exists>I"(1))
qed

context
begin

private AOT_lemma eqnotnec_123_Aux_\<zeta>: \<open>[L]x \<equiv> (E!x \<rightarrow> E!x)\<close>
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def])
     apply "cqt:2[lambda]"
    apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
  by "cqt:2[lambda]"

private AOT_lemma eqnotnec_123_Aux_\<omega>: \<open>[\<lambda>z \<phi>]x \<equiv> \<phi>\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"

private AOT_lemma eqnotnec_123_Aux_\<theta>: \<open>\<phi> \<equiv> \<forall>x([L]x \<equiv> [\<lambda>z \<phi>]x)\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I"; (rule "\<forall>I")?)
  fix x
  AOT_assume 1: \<open>\<phi>\<close>
  AOT_have \<open>[L]x \<equiv> (E!x \<rightarrow> E!x)\<close> using eqnotnec_123_Aux_\<zeta>.
  also AOT_have \<open>\<dots> \<equiv> \<phi>\<close>
    using "if-p-then-p" 1 "\<equiv>I" "\<rightarrow>I" by simp
  also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<phi>]x\<close>
    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] eqnotnec_123_Aux_\<omega> by blast
  finally AOT_show \<open>[L]x \<equiv> [\<lambda>z \<phi>]x\<close>.
next
  fix x
  AOT_assume \<open>\<forall>x([L]x \<equiv> [\<lambda>z \<phi>]x)\<close>
  AOT_hence \<open>[L]x \<equiv> [\<lambda>z \<phi>]x\<close> using "\<forall>E" by blast
  also AOT_have \<open>\<dots> \<equiv> \<phi>\<close> using eqnotnec_123_Aux_\<omega>.
  finally AOT_have \<open>\<phi> \<equiv> [L]x\<close>
    using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
  also AOT_have \<open>\<dots> \<equiv> E!x \<rightarrow> E!x\<close> using eqnotnec_123_Aux_\<zeta>.
  finally AOT_show \<open>\<phi>\<close> using "\<equiv>E" "if-p-then-p" by fast
qed
private lemmas eqnotnec_123_Aux_\<xi> =
  eqnotnec_123_Aux_\<theta>[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
    THEN "conventions:3"[THEN "\<equiv>Df", THEN "\<equiv>E"(1), THEN "&E"(1)],
    THEN "RM\<diamond>"]
private lemmas eqnotnec_123_Aux_\<xi>' =
  eqnotnec_123_Aux_\<theta>[
    THEN "conventions:3"[THEN "\<equiv>Df", THEN "\<equiv>E"(1), THEN "&E"(1)],
    THEN "RM\<diamond>"]

AOT_theorem "eqnotnec:1": \<open>\<exists>F\<exists>G(\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
proof-
  AOT_obtain p\<^sub>1 where \<open>ContingentlyTrue(p\<^sub>1)\<close>
    using "cont-tf-thm:1" "\<exists>E"[rotated] by blast
  AOT_hence \<open>p\<^sub>1 & \<diamond>\<not>p\<^sub>1\<close> using "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence \<open>\<forall>x ([L]x \<equiv> [\<lambda>z p\<^sub>1]x) & \<diamond>\<not>\<forall>x([L]x \<equiv> [\<lambda>z p\<^sub>1]x)\<close>
    apply - apply (rule "&I")
    using "&E" eqnotnec_123_Aux_\<theta>[THEN "\<equiv>E"(1)]
          eqnotnec_123_Aux_\<xi> "\<rightarrow>E" by fast+
  AOT_hence \<open>\<exists>G (\<forall>x([L]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([L]x \<equiv> [G]x))\<close>
    by (rule "\<exists>I") "cqt:2[lambda]"
  AOT_thus \<open>\<exists>F\<exists>G (\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
    apply (rule "\<exists>I")
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
qed

AOT_theorem "eqnotnec:2": \<open>\<exists>F\<exists>G(\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
proof-
  AOT_obtain p\<^sub>1 where \<open>ContingentlyFalse(p\<^sub>1)\<close>
    using "cont-tf-thm:2" "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<not>p\<^sub>1 & \<diamond>p\<^sub>1\<close> using "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence \<open>\<not>\<forall>x ([L]x \<equiv> [\<lambda>z p\<^sub>1]x) & \<diamond>\<forall>x([L]x \<equiv> [\<lambda>z p\<^sub>1]x)\<close>
    apply - apply (rule "&I")
    using eqnotnec_123_Aux_\<theta>[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
                             THEN "\<equiv>E"(1)]
          "&E" eqnotnec_123_Aux_\<xi>' "\<rightarrow>E" by fast+
  AOT_hence \<open>\<exists>G (\<not>\<forall>x([L]x \<equiv> [G]x) & \<diamond>\<forall>x([L]x \<equiv> [G]x))\<close>
    by (rule "\<exists>I") "cqt:2[lambda]"
  AOT_thus \<open>\<exists>F\<exists>G (\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
    apply (rule "\<exists>I")
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
qed

AOT_theorem "eqnotnec:3": \<open>\<exists>F\<exists>G(\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
proof-
  AOT_have \<open>\<not>\<^bold>\<A>q\<^sub>0\<close>
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
     apply (fact "log-prop-prop:2")
    by (fact AOT)
  AOT_hence \<open>\<^bold>\<A>\<not>q\<^sub>0\<close>
    using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
  AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x)\<close>
    using eqnotnec_123_Aux_\<theta>[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)],
            THEN "conventions:3"[THEN "\<equiv>Df", THEN "\<equiv>E"(1), THEN "&E"(1)],
            THEN "RA[2]", THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E"] by blast
  moreover AOT_have \<open>\<diamond>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x)\<close>
    using eqnotnec_123_Aux_\<xi>'[THEN "\<rightarrow>E"] q\<^sub>0_prop[THEN "&E"(1)] by blast
  ultimately AOT_have \<open>\<^bold>\<A>\<not>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x) & \<diamond>\<forall>x ([L]x \<equiv> [\<lambda>z q\<^sub>0]x)\<close>
    using "&I" by blast
  AOT_hence \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x([L]x \<equiv> [G]x) & \<diamond>\<forall>x([L]x \<equiv> [G]x))\<close>
    by (rule "\<exists>I") "cqt:2[lambda]"
  AOT_thus \<open>\<exists>F\<exists>G (\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
    apply (rule "\<exists>I")
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
qed

end

AOT_theorem "eqnotnec:4": \<open>\<forall>F\<exists>G(\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
proof(rule GEN)
  fix F
  AOT_have Aux_A: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<rightarrow> \<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi>]x)\<close> for \<psi>
  proof(rule "\<rightarrow>I"; rule GEN)
    AOT_modally_strict {
    fix x
    AOT_assume 0: \<open>\<psi>\<close>
    AOT_have \<open>[\<lambda>z [F]z & \<psi>]x \<equiv> [F]x & \<psi>\<close>
      by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
    also AOT_have \<open>... \<equiv> [F]x\<close>
      apply (rule "\<equiv>I"; rule "\<rightarrow>I")
      using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
      apply blast
      using 0 "&I" by blast
    finally AOT_show \<open>[F]x \<equiv> [\<lambda>z [F]z & \<psi>]x\<close>
      using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
    }
  qed

  AOT_have Aux_B: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<psi> \<rightarrow> \<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close> for \<psi>
  proof (rule "\<rightarrow>I"; rule GEN)
    AOT_modally_strict {
      fix x
      AOT_assume 0: \<open>\<psi>\<close>
      AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x \<equiv> (([F]x & \<psi>) \<or> \<not>\<psi>)\<close>
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      also AOT_have \<open>... \<equiv> [F]x\<close>
        apply (rule "\<equiv>I"; rule "\<rightarrow>I")
        using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0]
              "&E"
         apply blast
        apply (rule "\<or>I"(1)) using 0 "&I" by blast
      finally AOT_show \<open>[F]x \<equiv> [\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x\<close>
        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
    }
  qed

  AOT_have Aux_C:
    \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<not>\<psi> \<rightarrow> \<diamond>\<not>\<forall>z([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close> for \<psi>
  proof(rule "RM\<diamond>"; rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_modally_strict {
      AOT_assume 0: \<open>\<not>\<psi>\<close>
      AOT_assume \<open>\<forall>z ([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close>
      AOT_hence \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using "\<forall>E" by blast
      moreover AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [F]z & \<psi>\<close> for z
          by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      moreover AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]z \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      ultimately AOT_have \<open>[F]z & \<psi> \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "\<equiv>E"(5) by meson
      moreover AOT_have \<open>(([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z using 0 "\<or>I" by blast
      ultimately AOT_have \<open>\<psi>\<close> using "\<equiv>E" "&E" by metis
      AOT_thus \<open>\<psi> & \<not>\<psi>\<close> using 0 "&I" by blast
    }
  qed

  AOT_have Aux_D: \<open>\<box>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
      (\<diamond>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
       \<diamond>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
  proof (rule "\<rightarrow>I")
    AOT_assume A: \<open>\<box>\<forall>z([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
    AOT_show \<open>\<diamond>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z &&nbsp;\<psi> \<or> \<not>\<psi>]x) \<equiv>
              \<diamond>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
    proof(rule "\<equiv>I"; rule "KBasic:13"[THEN "\<rightarrow>E"];
          rule "RN[prem]"[where \<Gamma>="{\<guillemotleft>\<forall>z([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<guillemotright>}", simplified];
          (rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")?)
      AOT_modally_strict {
        AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
        AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
          using "\<forall>E" by blast
        AOT_assume \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
        AOT_hence 2: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
          using "\<forall>E" by blast
        AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
          using "\<equiv>E" 1 2 by meson
        AOT_thus \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
          by (rule GEN)
      }
    next
      AOT_modally_strict {
        AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
        AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
          using "\<forall>E" by blast
        AOT_assume \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
        AOT_hence 2: \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
          using "\<forall>E" by blast
        AOT_have \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
          using 1 2 "\<equiv>E" by meson
        AOT_thus \<open> \<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
          by (rule GEN)
      }
    qed(auto simp: A)
  qed

  AOT_obtain p\<^sub>1 where p\<^sub>1_prop: \<open>p\<^sub>1 & \<diamond>\<not>p\<^sub>1\<close>
    using "cont-tf-thm:1" "\<exists>E"[rotated]
          "cont-tf:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  {
    AOT_assume 1: \<open>\<box>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
    AOT_have 2: \<open>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using Aux_B[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(1)]].
    AOT_have \<open>\<diamond>\<not>\<forall>x([\<lambda>z [F]z & p\<^sub>1]x \<equiv> [\<lambda>z [F]z &&nbsp;p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using Aux_C[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(2)]].
    AOT_hence 3: \<open>\<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using Aux_D[THEN "\<rightarrow>E", OF 1, THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x) &
               \<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using 2 "&I" by blast
    AOT_hence \<open>\<exists>G (\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  }
  moreover {
    AOT_assume 2: \<open>\<not>\<box>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
    AOT_hence \<open>\<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
      using "KBasic:11"[THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
      using Aux_A[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(1)]] "&I" by blast
    AOT_hence \<open>\<exists>G (\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  }
  ultimately AOT_show \<open>\<exists>G (\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<not>\<forall>x([F]x \<equiv> [G]x))\<close>
    using "\<or>E"(1)[OF "exc-mid"] "\<rightarrow>I" by blast
qed

AOT_theorem "eqnotnec:5": \<open>\<forall>F\<exists>G(\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
proof(rule GEN)
  fix F
  AOT_have Aux_A: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi>]x)\<close> for \<psi>
  proof(rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
    AOT_modally_strict {
    fix x
    AOT_assume 0: \<open>\<psi>\<close>
    AOT_have \<open>[\<lambda>z [F]z & \<psi>]x \<equiv> [F]x & \<psi>\<close>
      by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
    also AOT_have \<open>... \<equiv> [F]x\<close>
      apply (rule "\<equiv>I"; rule "\<rightarrow>I")
      using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
       apply blast
      using 0 "&I" by blast
    finally AOT_show \<open>[F]x \<equiv> [\<lambda>z [F]z & \<psi>]x\<close>
      using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
    }
  qed

  AOT_have Aux_B: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close> for \<psi>
  proof (rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
    AOT_modally_strict {
      fix x
      AOT_assume 0: \<open>\<psi>\<close>
      AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x \<equiv> (([F]x & \<psi>) \<or> \<not>\<psi>)\<close>
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      also AOT_have \<open>... \<equiv> [F]x\<close>
        apply (rule "\<equiv>I"; rule "\<rightarrow>I")
        using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
         apply blast
        apply (rule "\<or>I"(1)) using 0 "&I" by blast
      finally AOT_show \<open>[F]x \<equiv> [\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x\<close>
        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
    }
  qed

  AOT_have Aux_C: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<not>\<psi> \<rightarrow> \<not>\<forall>z([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close> for \<psi>
  proof(rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_modally_strict {
      AOT_assume 0: \<open>\<not>\<psi>\<close>
      AOT_assume \<open>\<forall>z ([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close>
      AOT_hence \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using "\<forall>E" by blast
      moreover AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [F]z & \<psi>\<close> for z
          by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      moreover AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]z \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      ultimately AOT_have \<open>[F]z & \<psi> \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "\<equiv>E"(5) by meson
      moreover AOT_have \<open>(([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        using 0 "\<or>I" by blast
      ultimately AOT_have \<open>\<psi>\<close> using "\<equiv>E" "&E" by metis
      AOT_thus \<open>\<psi> & \<not>\<psi>\<close> using 0 "&I" by blast
    }
  qed

  AOT_have Aux_D: \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
    (\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
     \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
  proof (rule "\<rightarrow>I"; rule "\<equiv>I";
         (rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")?)
    AOT_modally_strict {
      AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
      AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
        using "\<forall>E" by blast
      AOT_assume \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
      AOT_hence 2: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using "\<forall>E" by blast
      AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using "\<equiv>E" 1 2 by meson
      AOT_thus \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
        by (rule GEN)
    }
  next
    AOT_modally_strict {
      AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
      AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
        using "\<forall>E" by blast
      AOT_assume \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
      AOT_hence 2: \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using "\<forall>E" by blast
      AOT_have \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using 1 2 "\<equiv>E" by meson
      AOT_thus \<open> \<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
        by (rule GEN)
    }
  qed

  AOT_obtain p\<^sub>1 where p\<^sub>1_prop: \<open>\<not>p\<^sub>1 & \<diamond>p\<^sub>1\<close>
    using "cont-tf-thm:2" "\<exists>E"[rotated] "cont-tf:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  {
    AOT_assume 1: \<open>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
    AOT_have 2: \<open>\<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using Aux_B[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(2)]].
    AOT_have \<open>\<not>\<forall>x([\<lambda>z [F]z & p\<^sub>1]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using Aux_C[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(1)]].
    AOT_hence 3: \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using Aux_D[THEN "\<rightarrow>E", OF 1, THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x) &
               \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1 \<or> \<not>p\<^sub>1]x)\<close>
      using 2 "&I" by blast
    AOT_hence \<open>\<exists>G (\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  }
  moreover {
    AOT_assume 2: \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
    AOT_hence \<open>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
      using "KBasic:11"[THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x) &
               \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & p\<^sub>1]x)\<close>
      using Aux_A[THEN "\<rightarrow>E", OF p\<^sub>1_prop[THEN "&E"(2)]] "&I" by blast
    AOT_hence \<open>\<exists>G (\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  }
  ultimately AOT_show \<open>\<exists>G (\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
    using "\<or>E"(1)[OF "exc-mid"] "\<rightarrow>I" by blast
qed

AOT_theorem "eqnotnec:6": \<open>\<forall>F\<exists>G(\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
proof(rule GEN)
  fix F
  AOT_have Aux_A: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi>]x)\<close> for \<psi>
  proof(rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
    AOT_modally_strict {
    fix x
    AOT_assume 0: \<open>\<psi>\<close>
    AOT_have \<open>[\<lambda>z [F]z & \<psi>]x \<equiv> [F]x & \<psi>\<close>
      by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
    also AOT_have \<open>... \<equiv> [F]x\<close>
      apply (rule "\<equiv>I"; rule "\<rightarrow>I")
      using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0]
            "&E"
       apply blast
      using 0 "&I" by blast
    finally AOT_show \<open>[F]x \<equiv> [\<lambda>z [F]z & \<psi>]x\<close>
      using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
    }
  qed

  AOT_have Aux_B: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<diamond>\<psi> \<rightarrow> \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close> for \<psi>
  proof (rule "RM\<diamond>"; rule "\<rightarrow>I"; rule GEN)
    AOT_modally_strict {
      fix x
      AOT_assume 0: \<open>\<psi>\<close>
      AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x \<equiv> (([F]x & \<psi>) \<or> \<not>\<psi>)\<close>
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      also AOT_have \<open>... \<equiv> [F]x\<close>
        apply (rule "\<equiv>I"; rule "\<rightarrow>I")
        using "\<or>E"(3)[rotated, OF "useful-tautologies:2"[THEN "\<rightarrow>E"], OF 0] "&E"
         apply blast
        apply (rule "\<or>I"(1)) using 0 "&I" by blast
      finally AOT_show \<open>[F]x \<equiv> [\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]x\<close>
        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
    }
  qed

  AOT_have Aux_C:
    \<open>\<^bold>\<turnstile>\<^sub>\<box> \<^bold>\<A>\<not>\<psi> \<rightarrow> \<^bold>\<A>\<not>\<forall>z([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close> for \<psi>
  proof(rule "act-cond"[THEN "\<rightarrow>E"]; rule "RA[2]"; rule "\<rightarrow>I"; rule "raa-cor:2")
  AOT_modally_strict {
      AOT_assume 0: \<open>\<not>\<psi>\<close>
      AOT_assume \<open>\<forall>z ([\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z)\<close>
      AOT_hence \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
        using "\<forall>E" by blast
      moreover AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [F]z & \<psi>\<close> for z
          by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      moreover AOT_have \<open>[\<lambda>z ([F]z & \<psi>) \<or> \<not>\<psi>]z \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
      ultimately AOT_have \<open>[F]z & \<psi> \<equiv> (([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        using "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] "\<equiv>E"(5) by meson
      moreover AOT_have \<open>(([F]z & \<psi>) \<or> \<not>\<psi>)\<close> for z
        using 0 "\<or>I" by blast
      ultimately AOT_have \<open>\<psi>\<close> using "\<equiv>E" "&E" by metis
      AOT_thus \<open>\<psi> & \<not>\<psi>\<close> using 0 "&I" by blast
    }
  qed

  AOT_have \<open>\<box>(\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
    (\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
     \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)))\<close> for \<psi>
  proof (rule RN; rule "\<rightarrow>I")
    AOT_modally_strict {
        AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
        AOT_thus \<open>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
                  \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
          apply -
        proof(rule "\<equiv>I"; (rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")?)
          AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
          AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
            using "\<forall>E" by blast
          AOT_assume \<open>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
          AOT_hence 2: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
            using "\<forall>E" by blast
          AOT_have \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
            using "\<equiv>E" 1 2 by meson
          AOT_thus \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
            by (rule GEN)
        next
            AOT_assume \<open>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z)\<close>
            AOT_hence 1: \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi>]z\<close> for z
              using "\<forall>E" by blast
            AOT_assume \<open>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
            AOT_hence 2: \<open>[\<lambda>z [F]z & \<psi>]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
              using "\<forall>E" by blast
            AOT_have \<open>[F]z \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]z\<close> for z
              using 1 2 "\<equiv>E" by meson
            AOT_thus \<open> \<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)\<close>
              by (rule GEN)
        qed
    }
  qed
  AOT_hence \<open>\<^bold>\<A>(\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
    (\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
     \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x)))\<close> for \<psi>
    using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<^bold>\<A>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
    \<^bold>\<A>(\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
    \<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
    using "act-cond"[THEN "\<rightarrow>E"] by blast
  AOT_hence Aux_D: \<open>\<^bold>\<A>\<forall>z ([F]z \<equiv> [\<lambda>z [F]z & \<psi>]z) \<rightarrow>
    (\<^bold>\<A>\<not>\<forall>x ([\<lambda>z [F]z & \<psi>]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x) \<equiv>
     \<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & \<psi> \<or> \<not>\<psi>]x))\<close> for \<psi>
    by (auto intro!: "\<rightarrow>I" "Act-Basic:5"[THEN "\<equiv>E"(1)] dest!: "\<rightarrow>E")

  AOT_have \<open>\<not>\<^bold>\<A>q\<^sub>0\<close>
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF q\<^sub>0_def])
     apply (fact "log-prop-prop:2")
    by (fact AOT)
  AOT_hence q\<^sub>0_prop_1: \<open>\<^bold>\<A>\<not>q\<^sub>0\<close>
    using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
  {
    AOT_assume 1: \<open>\<^bold>\<A>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
    AOT_have 2: \<open>\<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
      using Aux_B[THEN "\<rightarrow>E", OF q\<^sub>0_prop[THEN "&E"(1)]].
    AOT_have \<open>\<^bold>\<A>\<not>\<forall>x([\<lambda>z [F]z & q\<^sub>0]x \<equiv> [\<lambda>z [F]z &&nbsp;q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
      using Aux_C[THEN "\<rightarrow>E", OF q\<^sub>0_prop_1].
    AOT_hence 3: \<open>\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
      using Aux_D[THEN "\<rightarrow>E", OF 1, THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x) &
               \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0 \<or> \<not>q\<^sub>0]x)\<close>
      using 2 "&I" by blast
    AOT_hence \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  }
  moreover {
    AOT_assume 2: \<open>\<not>\<^bold>\<A>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
    AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
      using "logic-actual-nec:1"[axiom_inst, THEN "\<equiv>E"(2)] by blast
    AOT_hence \<open>\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x) & \<diamond>\<forall>x([F]x \<equiv> [\<lambda>z [F]z & q\<^sub>0]x)\<close>
      using Aux_A[THEN "\<rightarrow>E", OF q\<^sub>0_prop[THEN "&E"(1)]] "&I" by blast
    AOT_hence \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
      by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  }
  ultimately AOT_show \<open>\<exists>G (\<^bold>\<A>\<not>\<forall>x ([F]x \<equiv> [G]x) & \<diamond>\<forall>x([F]x \<equiv> [G]x))\<close>
    using "\<or>E"(1)[OF "exc-mid"] "\<rightarrow>I" by blast
qed

AOT_theorem "oa-contingent:1": \<open>O! \<noteq> A!\<close>
proof(rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"]; rule "raa-cor:2")
  fix x
  AOT_assume 1: \<open>O! = A!\<close>
  AOT_hence \<open>[\<lambda>x \<diamond>E!x] = A!\<close>
    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_ordinary, rotated]) "cqt:2[lambda]"
  AOT_hence \<open>[\<lambda>x \<diamond>E!x] = [\<lambda>x \<not>\<diamond>E!x]\<close>
    by (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract, rotated]) "cqt:2[lambda]"
  moreover AOT_have \<open>[\<lambda>x \<diamond>E!x]x \<equiv> \<diamond>E!x\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
  ultimately AOT_have \<open>[\<lambda>x \<not>\<diamond>E!x]x \<equiv> \<diamond>E!x\<close>
    using "rule=E" by fast
  moreover AOT_have \<open>[\<lambda>x \<not>\<diamond>E!x]x \<equiv> \<not>\<diamond>E!x\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
  ultimately AOT_have \<open>\<diamond>E!x \<equiv> \<not>\<diamond>E!x\<close>
    using "\<equiv>E"(6) "Commutativity of \<equiv>"[THEN "\<equiv>E"(1)] by blast
  AOT_thus "(\<diamond>E!x \<equiv> \<not>\<diamond>E!x) & \<not>(\<diamond>E!x \<equiv> \<not>\<diamond>E!x)"
    using "oth-class-taut:3:c" "&I" by blast
qed

AOT_theorem "oa-contingent:2": \<open>O!x \<equiv> \<not>A!x\<close>
proof -
  AOT_have \<open>O!x \<equiv> [\<lambda>x \<diamond>E!x]x\<close>
    apply (rule "\<equiv>I"; rule "\<rightarrow>I")
     apply (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_ordinary])
      apply "cqt:2[lambda]"
     apply argo
    apply (rule  "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary])
     apply "cqt:2[lambda]"
    by argo
  also AOT_have \<open>\<dots> \<equiv> \<diamond>E!x\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
  also AOT_have \<open>\<dots> \<equiv> \<not>\<not>\<diamond>E!x\<close>
    using "oth-class-taut:3:b".
  also AOT_have \<open>\<dots> \<equiv> \<not>[\<lambda>x \<not>\<diamond>E!x]x\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E",
              THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], symmetric])
       "cqt:2"
  also AOT_have \<open>\<dots> \<equiv> \<not>A!x\<close>
    apply (rule "\<equiv>I"; rule "\<rightarrow>I")
     apply (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_abstract])
      apply "cqt:2[lambda]"
     apply argo
    apply (rule "=\<^sub>d\<^sub>fE"(2)[OF AOT_abstract])
     apply "cqt:2[lambda]"
    by argo
  finally show ?thesis.
qed

AOT_theorem "oa-contingent:3": \<open>A!x \<equiv> \<not>O!x\<close>
  by (AOT_subst \<open>A!x\<close> \<open>\<not>\<not>A!x\<close>)
     (auto simp add: "oth-class-taut:3:b" "oa-contingent:2"[THEN
         "oth-class-taut:4:b"[THEN "\<equiv>E"(1)], symmetric])

AOT_theorem "oa-contingent:4": \<open>Contingent(O!)\<close>
proof (rule "thm-cont-prop:2"[unvarify F, OF "oa-exist:1", THEN "\<equiv>E"(2)];
       rule "&I")
  AOT_have \<open>\<diamond>\<exists>x E!x\<close> using "thm-cont-e:3" .
  AOT_hence \<open>\<exists>x \<diamond>E!x\<close> using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
  then AOT_obtain a where \<open>\<diamond>E!a\<close> using "\<exists>E"[rotated] by blast
  AOT_hence \<open>[\<lambda>x \<diamond>E!x]a\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), rotated]) "cqt:2"
  AOT_hence \<open>O!a\<close>
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2"
  AOT_hence \<open>\<exists>x O!x\<close> using "\<exists>I" by blast
  AOT_thus \<open>\<diamond>\<exists>x O!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
next
  AOT_obtain a where \<open>A!a\<close>
    using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
  AOT_hence \<open>\<not>O!a\<close> using "oa-contingent:3"[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<exists>x \<not>O!x\<close> using "\<exists>I" by fast
  AOT_thus \<open>\<diamond>\<exists>x \<not>O!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "oa-contingent:5": \<open>Contingent(A!)\<close>
proof (rule "thm-cont-prop:2"[unvarify F, OF "oa-exist:2", THEN "\<equiv>E"(2)];
       rule "&I")
  AOT_obtain a where \<open>A!a\<close>
    using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
  AOT_hence \<open>\<exists>x A!x\<close> using "\<exists>I" by fast
  AOT_thus \<open>\<diamond>\<exists>x A!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
next
  AOT_have \<open>\<diamond>\<exists>x E!x\<close> using "thm-cont-e:3" .
  AOT_hence \<open>\<exists>x \<diamond>E!x\<close> using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
  then AOT_obtain a where \<open>\<diamond>E!a\<close> using "\<exists>E"[rotated] by blast
  AOT_hence \<open>[\<lambda>x \<diamond>E!x]a\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), rotated]) "cqt:2[lambda]"
  AOT_hence \<open>O!a\<close>
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2[lambda]"
  AOT_hence \<open>\<not>A!a\<close> using "oa-contingent:2"[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<exists>x \<not>A!x\<close> using "\<exists>I" by fast
  AOT_thus \<open>\<diamond>\<exists>x \<not>A!x\<close> using "T\<diamond>"[THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "oa-contingent:7": \<open>O!\<^sup>-x \<equiv> \<not>A!\<^sup>-x\<close>
proof -
  AOT_have \<open>O!x \<equiv> \<not>A!x\<close>
    using "oa-contingent:2" by blast
  also AOT_have \<open>\<dots> \<equiv> A!\<^sup>-x\<close>
    using "thm-relation-negation:1"[symmetric, unvarify F, OF "oa-exist:2"].
  finally AOT_have 1: \<open>O!x \<equiv> A!\<^sup>-x\<close>.

  AOT_have \<open>A!x \<equiv> \<not>O!x\<close>
    using "oa-contingent:3" by blast
  also AOT_have \<open>\<dots> \<equiv> O!\<^sup>-x\<close>
    using "thm-relation-negation:1"[symmetric, unvarify F, OF "oa-exist:1"].
  finally AOT_have 2: \<open>A!x \<equiv> O!\<^sup>-x\<close>.

  AOT_show \<open>O!\<^sup>-x \<equiv> \<not>A!\<^sup>-x\<close>
    using 1[THEN "oth-class-taut:4:b"[THEN "\<equiv>E"(1)]]
          "oa-contingent:3"[of _ x] 2[symmetric]
          "\<equiv>E"(5) by blast
qed

AOT_theorem "oa-contingent:6": \<open>O!\<^sup>- \<noteq> A!\<^sup>-\<close>
proof (rule "=-infix"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; rule "raa-cor:2")
  AOT_assume 1: \<open>O!\<^sup>- = A!\<^sup>-\<close>
  fix x
  AOT_have \<open>A!\<^sup>-x \<equiv> O!\<^sup>-x\<close>
    apply (rule "rule=E"[rotated, OF 1])
    by (fact "oth-class-taut:3:a")
  AOT_hence \<open>A!\<^sup>-x \<equiv> \<not>A!\<^sup>-x\<close>
    using "oa-contingent:7" "\<equiv>E" by fast
  AOT_thus \<open>(A!\<^sup>-x \<equiv> \<not>A!\<^sup>-x) & \<not>(A!\<^sup>-x \<equiv> \<not>A!\<^sup>-x)\<close>
    using "oth-class-taut:3:c" "&I" by blast
qed

AOT_theorem "oa-contingent:8": \<open>Contingent(O!\<^sup>-)\<close>
  using "thm-cont-prop:3"[unvarify F, OF "oa-exist:1", THEN "\<equiv>E"(1),
          OF "oa-contingent:4"].

AOT_theorem "oa-contingent:9": \<open>Contingent(A!\<^sup>-)\<close>
  using "thm-cont-prop:3"[unvarify F, OF "oa-exist:2", THEN "\<equiv>E"(1),
          OF "oa-contingent:5"].

AOT_define WeaklyContingent :: \<open>\<Pi> \<Rightarrow> \<phi>\<close> (\<open>WeaklyContingent'(_')\<close>)
  "df-cont-nec":
  \<open>WeaklyContingent([F]) \<equiv>\<^sub>d\<^sub>f Contingent([F]) & \<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>

AOT_theorem "cont-nec-fact1:1":
  \<open>WeaklyContingent([F]) \<equiv> WeaklyContingent([F]\<^sup>-)\<close>
proof -
  AOT_have \<open>WeaklyContingent([F]) \<equiv> Contingent([F]) & \<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
    using "df-cont-nec"[THEN "\<equiv>Df"] by blast
  also AOT_have \<open>... \<equiv> Contingent([F]\<^sup>-) & \<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
    apply (rule "oth-class-taut:8:f"[THEN "\<equiv>E"(2)]; rule "\<rightarrow>I")
    using "thm-cont-prop:3".
  also AOT_have \<open>\<dots> \<equiv> Contingent([F]\<^sup>-) & \<forall>x (\<diamond>[F]\<^sup>-x \<rightarrow> \<box>[F]\<^sup>-x)\<close>
  proof (rule "oth-class-taut:8:e"[THEN "\<equiv>E"(2)];
         rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I"; rule GEN; rule "\<rightarrow>I")
    fix x
    AOT_assume 0: \<open>\<forall>x (\<diamond>[F]x \<rightarrow> \<box>[F]x)\<close>
    AOT_assume 1: \<open>\<diamond>[F]\<^sup>-x\<close>
    AOT_have \<open>\<diamond>\<not>[F]x\<close>
      by (AOT_subst (reverse) \<open>\<not>[F]x\<close> \<open>[F]\<^sup>-x\<close>)
         (auto simp add: "thm-relation-negation:1" 1)
    AOT_hence 2: \<open>\<not>\<box>[F]x\<close>
      using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
    AOT_show \<open>\<box>[F]\<^sup>-x\<close>
    proof (rule "raa-cor:1")
      AOT_assume 3: \<open>\<not>\<box>[F]\<^sup>-x\<close>
      AOT_have \<open>\<not>\<box>\<not>[F]x\<close>
        by (AOT_subst (reverse) \<open>\<not>[F]x\<close> \<open>[F]\<^sup>-x\<close>)
           (auto simp add: "thm-relation-negation:1" 3)
      AOT_hence \<open>\<diamond>[F]x\<close>
        using "conventions:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by simp
      AOT_hence \<open>\<box>[F]x\<close> using 0 "\<forall>E" "\<rightarrow>E" by fast
      AOT_thus \<open>\<box>[F]x & \<not>\<box>[F]x\<close> using "&I" 2 by blast
    qed
  next
    fix x
    AOT_assume 0: \<open>\<forall>x (\<diamond>[F]\<^sup>-x \<rightarrow> \<box>[F]\<^sup>-x)\<close>
    AOT_assume 1: \<open>\<diamond>[F]x\<close>
    AOT_have \<open>\<diamond>\<not>[F]\<^sup>-x\<close>
      by (AOT_subst \<open>\<not>[F]\<^sup>-x\<close> \<open>[F]x\<close>)
         (auto simp: "thm-relation-negation:2" 1)
    AOT_hence 2: \<open>\<not>\<box>[F]\<^sup>-x\<close>
      using "KBasic:11"[THEN "\<equiv>E"(2)] by blast
    AOT_show \<open>\<box>[F]x\<close>
    proof (rule "raa-cor:1")
      AOT_assume 3: \<open>\<not>\<box>[F]x\<close>
      AOT_have \<open>\<not>\<box>\<not>[F]\<^sup>-x\<close>
        by (AOT_subst \<open>\<not>[F]\<^sup>-x\<close> \<open>[F]x\<close>)
           (auto simp add: "thm-relation-negation:2" 3)
      AOT_hence ‹♢[F]^-x›
        using "conventions:5"[THEN "≡_dfI"] by simp
      AOT_hence ‹◻[F]^-x› using 0 "∀E" "→E" by fast
      AOT_thus ‹◻[F]^-x & ¬◻[F]^-x› using "&I" 2 by blast
    qed
  qed
  also AOT_have ‹… ≡ WeaklyContingent([F]^-)›
    using "df-cont-nec"[THEN "≡Df", symmetric] by blast
  finally show ?thesis.
qed

AOT_theorem "cont-nec-fact1:2":
  ‹(WeaklyContingent([F]) & ¬WeaklyContingent([G])) → F ≠ G›
proof (rule "→I"; rule "=-infix"[THEN "≡_dfI"]; rule "raa-cor:2")
  AOT_assume 1: ‹WeaklyContingent([F]) & ¬WeaklyContingent([G])›
  AOT_hence ‹WeaklyContingent([F])› using "&E" by blast
  moreover AOT_assume ‹F = G›
  ultimately AOT_have ‹WeaklyContingent([G])›
    using "rule=E" by blast
  AOT_thus ‹WeaklyContingent([G]) & ¬WeaklyContingent([G])›
    using 1 "&I" "&E" by blast
qed

AOT_theorem "cont-nec-fact2:1": ‹WeaklyContingent(O!)›
proof (rule "df-cont-nec"[THEN "≡_dfI"]; rule "&I")
  AOT_show ‹Contingent(O!)›
    using "oa-contingent:4".
next
  AOT_show ‹∀x (♢[O!]x → ◻[O!]x)›
    apply (rule GEN; rule "→I")
    using "oa-facts:5"[THEN "≡E"(1)] by blast
qed


AOT_theorem "cont-nec-fact2:2": ‹WeaklyContingent(A!)›
proof (rule "df-cont-nec"[THEN "≡_dfI"]; rule "&I")
  AOT_show ‹Contingent(A!)›
    using "oa-contingent:5".
next
  AOT_show ‹∀x (♢[A!]x → ◻[A!]x)›
    apply (rule GEN; rule "→I")
    using "oa-facts:6"[THEN "≡E"(1)] by blast
qed

AOT_theorem "cont-nec-fact2:3": ‹¬WeaklyContingent(E!)›
proof (rule "df-cont-nec"[THEN "≡Df",
                          THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
                          THEN "≡E"(2)];
       rule DeMorgan(1)[THEN "≡E"(2)]; rule "∨I"(2); rule "raa-cor:2")
  AOT_have ‹♢∃x (E!x & ¬\AE!x)› using "qml:4"[axiom_inst].
  AOT_hence ‹∃x ♢(E!x & ¬\AE!x)› using "BF♢"[THEN "→E"] by blast
  then AOT_obtain a where ‹♢(E!a & ¬\AE!a)› using "∃E"[rotated] by blast
  AOT_hence 1: ‹♢E!a & ♢¬\AE!a› using "KBasic2:3"[THEN "→E"] by simp
  moreover AOT_assume ‹∀x (♢[E!]x → ◻[E!]x)›
  ultimately AOT_have ‹◻E!a› using "&E" "∀E" "→E" by fast
  AOT_hence ‹\AE!a› using "nec-imp-act"[THEN "→E"] by blast
  AOT_hence ‹◻\AE!a› using "qml-act:1"[axiom_inst, THEN "→E"] by blast
  moreover AOT_have ‹¬◻\AE!a›
    using "KBasic:11"[THEN "≡E"(2)] 1[THEN "&E"(2)] by meson
  ultimately AOT_have ‹◻\AE!a & ¬◻\AE!a› using "&I" by blast
  AOT_thus ‹p & ¬p› for p using "raa-cor:1" by blast
qed

AOT_theorem "cont-nec-fact2:4": ‹¬WeaklyContingent(L)›
  apply (rule "df-cont-nec"[THEN "≡Df",
                            THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
                            THEN "≡E"(2)];
       rule DeMorgan(1)[THEN "≡E"(2)]; rule "∨I"(1))
  apply (rule "contingent-properties:4"
                [THEN "≡Df",
                 THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
                 THEN "≡E"(2)])
  apply (rule DeMorgan(1)[THEN "≡E"(2)];
         rule "∨I"(2);
         rule "useful-tautologies:2"[THEN "→E"])
  using "thm-noncont-e-e:3"[THEN "contingent-properties:3"[THEN "≡_dfE"]].

AOT_theorem "cont-nec-fact2:5": ‹O! ≠ E! & O! ≠ E!^- & O! style='font-size: 18px;'>≠ L & O! ≠ L^-›
proof -
  AOT_have 1: ‹L↓›
    java.lang.StringIndexOutOfBoundsException: Range [15, 12) out of bounds for length 64
  java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
    fix φ and Π_  =
    AOT_have A: ‹ pointermap_sane (dpm bdd) ∧(cl bd) bd"
 r "aac:"
java.lang.StringIndexOutOfBoundsException: Range [47, 46) out of bounds for length 69
 AOT_hence ‹t ol_ase)
 AOT_thus \\<{Π'} & ¬φ{Π'}› using that(2) "&I" by blast
 qed
 AOT_have ‹Π' ≠ Π› if ‹Π↓› and ‹Π'↓› and ‹φ{Π}› and ‹¬φ{Π'}›
 using "pos-not-equiv-ne:4"[unvarify F G, THEN "→E",
 OF that(1,2), OF A[OF that(3, 4)]].
 } note 0 = this
 show ?thesis
 apply(safe intro!: "&I"; rule 0)
 apply "cqt:2"
 using "oa-exist:1" apply blast
 using "cont-nec-fact2:3" apply fast
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:1" apply fast
 using "rel-neg-T:3" apply fast
 using "oa-exist:1" apply blast
 using "cont-nec-fact1:1"[THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
 THEN "≡E"(1), rotated, OF "cont-nec-fact2:3"] apply fast
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:1" apply blast
 apply (rule "=_dfI"(2)[OF L_def]; "cqt:2[lambda]")
  oa-exist:11" apply fas
  "cont-nec-fact2:4" apply fast
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:1" apply fast
  "rel-ng-T:3" apply fast
 using "oa- apply(simp_all)[2]
  assumes "i_pre.les s s'"
 THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
  "\equiv(1), rotated, OF "cont-nec-fact2:4"])
 apply (rule "=_fI"(2)[OF L_def]; "; "cq:2laba"
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:1" by blast
 

 -nec-fact:6": \o>! ≠ E! & A! ≠ E!^- & A! ≠ L & A! ≠ L^-›
proof -
  AOT_have 1: ‹L↓›
    by (rule "=_dfI"(2)[OF L_def]) "cqt:2[lambda]"+
  {
    fix φ and Π Π' :: ‹<\<
 AOT_have A: ‹¬(φ{Π'} ≡ φ{Π})› if ‹φ{Π}› and ‹¬φ{Π'}›
 proof (rule "raa-cor:2")
 AOT_assume ‹φ{Π'} ≡ φ{Π}›
 AOT_hence ‹φ{Π'}› using that(1) "≡E" by blast
 AOT_thus ‹φ{Π'} & ¬φ{Π'}› using that(2) "&I" by blast
 qed
 AOT_have ‹Π' ≠ Π› if ‹Π↓› and ‹Π'↓› and ‹φ{Π}› and ‹¬φ{Π'}›
 using "pos-not-equiv-ne:4"[unvarify F G, THEN "→E",
 OF that(1,2), OF A[OF that(3, 4)]].
 } note 0 = this
 show ?thesis
 apply(safe intro!: "&I"; rule 0)
 apply "cqt:2"
 using "oa-exist:2" apply blast
 using "cont-nec-fact2:3" apply fast
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:2" apply fast
 using "rel-neg-T:3" apply fast
 using "oa-exist:2" apply blast
 using "cont-nec-fact1:1"[THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
 THEN "≡E"(1), rotated, OF "cont-nec-fact2:3"] apply fast
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:2" apply blast
 apply (rule "=_dfI"(2)[OF L_def]; "cqt:2[lambda]")
 using "oa-exist:2" apply fast
 using "cont-nec-fact2:4" apply fast
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:2" apply fast
 using "rel-neg-T:3" apply fast
 using "oa-exist:2" apply fast
 apply (rule "cont-nec-fact1:1"[unvarify F,
 THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
 THEN "≡E"(1), rotated, OF "cont-nec-fact2:4"])
 apply (rule "=_dfI"(2)[OF L_def]; "cqt:2[lambda]")
 apply (rule "useful-tautologies:2"[THEN "→E"])
 using "cont-nec-fact2:2" by blast
 

  necessary_or_contingently_false :: ‹φ → φ› (‹\Δ_› [49] 54)
 ‹\Δp ≡_df ◻p ∨ (¬\Ap & ♢p)›

  sixteen:
 shows ‹∃F₁∃F₂∃F₃∃F₄∃F₅∃F₆∃F₇∃F₈∃F₉∃F₁₀∃F₁₁∃F₁₂∃F₁₃∃F₁₄∃F₁₅∃F₁₆ (
 «F₁::<\<kappa>>¬ ≠ F₂ & F₁ ≠ F₃ & F₁ ≠ F₄ & F₁ ≠ F₅ & F₁ ≠ F₆ & F₁ ≠ F₇ &
 F₁ ≠ F₈ & F₁ ≠ F₉ & F₁ ≠ F₁₀ & F₁ ≠ F₁₁ & F₁ ≠ F₁₂ & F₁ ≠ F₁₃ &
 F₁ ≠ F₁₄ & F₁ ≠ F₁₅ & F₁ ≠ F₁₆ &
 F₂ ≠ F₃ & F₂ ≠ F₄ & F₂ ≠ F₅ & F₂ ≠ F₆ & F₂ ≠ F₇ & F₂ ≠ F₈ &
 F₂ ≠ F₉ & F₂ ≠ F₁₀ & F₂ ≠ F₁₁ & F₂ ≠ F₁₂ & F₂ ≠ F₁₃ & F₂ ≠ F₁₄ &
 F₂ ≠ F₁₅ & F₂ ≠ F₁₆ &
 F₃ ≠ F₄ & F₃ ≠ F₅ & F₃ ≠ F₆ & F₃ ≠ F₇ & F₃ ≠ F₈ & F₃ ≠ F₉ & F₃ ≠ F₁₀ &
 F₃ ≠ F₁₁ & F₃ ≠ F₁₂ & F₃ ≠ F₁₃ & F₃ ≠ F₁₄ & F₃ ≠ F₁₅ & F₃ ≠ F₁₆ &
 F₄ ≠ F₅ & F₄ ≠ F₆ & F₄ ≠ F₇ & F₄ ≠ F₈ & F₄ ≠ F₉ & F₄ ≠ F₁₀ & F₄ ≠ F₁₁ &
 F₄ ≠ F₁₂ & F₄ ≠ F₁₃ & F₄ ≠ F₁₄ & F₄ ≠ F₁₅ & F₄ ≠ F₁₆ &
 F₅ ≠ F₆ & F₅ ≠ F₇ & F₅ ≠ F₈ & F₅ ≠ F₉ & F₅ ≠ F₁₀ & F₅ ≠ F₁₁ & F₅ ≠ F₁₂ &
 F₅ ≠ F₁₃ & F₅ ≠ F₁₄ & F₅ ≠ F₁₅ & F₅ ≠ F₁₆ &
 F₆ ≠ F₇ & F₆ ≠ F₈ & F₆ ≠ F₉ & F₆ ≠ F₁₀ & F₆ ≠ F₁₁ & F₆ ≠ F₁₂ & F₆ ≠ F₁₃ &
 F₆ ≠ F₁₄ & F₆ ≠ F₁₅ & F₆ ≠ F₁₆ &
 F₇ ≠ F₈ & F₇ ≠ F₉ & F₇ ≠ F₁₀ & F₇ ≠ F₁₁ & F₇ ≠ F₁₂ & F₇ ≠ F₁₃ & F₇ ≠ F₁₄ &
 F₇ ≠ F₁₅ & F₇ ≠ F₁₆ &
 F₈ ≠ F₉ & F₈ ≠ F₁₀ & F₈ ≠ F₁₁ & F₈ ≠ F₁₂ & F₈ ≠ F₁₃ & F₈ ≠ F₁₄ & F₈ ≠ F₁₅ &
 F₈ ≠ F₁₆ &
 F₉ ≠ F₁₀ & F₉ ≠ F₁₁ & F₉ ≠ F₁₂ & F₉ ≠ F₁₃ & F₉ ≠ F₁₄ & F₉ ≠ F₁₅ & F₉ ≠ F₁₆ &
 F₁₀ ≠ F₁₁ & F₁₀ ≠ F₁₂ & F₁₀ ≠ F₁₃ & F₁₀ ≠ F₁₄ & F₁₀ ≠ F₁₅ & F₁₀ ≠ F₁₆ &
 F₁₁ ≠ F₁₂ & F₁₁ ≠ F₁₃ & F₁₁ ≠ F₁₄ & F₁₁ ≠ F₁₅ & F₁₁ ≠ F₁₆ &
 F₁₂ ≠ F₁₃ & F₁₂ ≠ F₁₄ & F₁₂ ≠ F₁₅ & F₁₂ ≠ F₁₆ &
 F₁₃ ≠ F₁₄ & F₁₃ ≠ F₁₅ & F₁₃ ≠ F₁₆ &
 F₁₄ ≠ F₁₅ & F₁₄ ≠ F₁₆ &
 F₁₅ ≠ F₁₆)›
  -
 AOT_have Delta_pos: ‹\Δφ → ♢φ› for φ
 proof(rule "→I")
 AOT_assume ‹\Δφ›
 AOT_hence ‹◻φ ∨ (¬\Aφ & ♢φ)›
 using "≡_dfE"[OF necessary_or_contingently_false] by blast
 moreover {
 AOT_assume ‹◻φ›
 AOT_hence ‹♢φ›
 by (metis "B♢" "T♢" "vdash-properties:10")
 }
 moreover {
 AOT_assume ‹¬\Aφ & ♢φ›
 AOT_hence ‹♢φ›
 using "&E" by blast
 }
 ultimately AOT_show ‹♢φ›
 by (metis "∨E"(2) "raa-cor:1")
 qed

 AOT_have act_and_not_nec_not_delta: ‹¬\Δφ› if ‹\Aφ› and ‹¬◻φ› for φ
 using "≡_dfE" "&E"(1) "∨E"(2) necessary_or_contingently_false
 "raa-cor:3" that(1,2) by blast
 AOT_have act_and_pos_not_not_delta: ‹¬\Δφ› if ‹\Aφ› and ‹♢¬φ› for φ
 using "KBasic:11" act_and_not_nec_not_delta "≡E"(2) that(1,2) by blast
 AOT_have impossible_delta: ‹¬\Δφ› if ‹¬♢φ› for φ
 using Delta_pos "modus-tollens:1" that by blast
 AOT_have not_act_and_pos_delta: ‹\Δφ› if ‹¬\Aφ› and ‹♢φ› for φ
 by (meson "≡_dfI" "&I" "∨I"(2) necessary_or_contingently_false that(1,2))
 AOT_have nec_delta: ‹\Δφ› if ‹◻φ› for φ
 using "≡_dfI" "∨I"(1) necessary_or_contingently_false that by blast

 AOT_obtain a where a_prop: ‹A!a›
 using "A-objects"[axiom_inst] "∃E"[rotated] "&E" by blast
 AOT_obtain b where b_prop: ‹♢[E!]b & ¬\A[E!]b›
 using "pos-not-pna:3" using "∃E"[rotated] by blast

 AOT_have b_ord: ‹[O!]b›
 proof(rule "=_dfI"(2)[OF AOT_ordinary])
 AOT_show ‹[λx ♢[E!]x]↓› by "cqt:2[lambda]"
 next
 AOT_show ‹[λx ♢[E!]x]b›
 proof (rule "β←C"(1); ("cqt:2[lambda]")?)
 AOT_show ‹b↓› by (rule "cqt:2[const_var]"[axiom_inst])
 AOT_show ‹♢[E!]b› by (fact b_prop[THEN "&E"(1)])
 qed
 qed

 AOT_have nec_not_L_neg: ‹◻¬[L^-]x› for x
 using "thm-noncont-e-e:2" "contingent-properties:2"[THEN "≡_dfE"] "&E"
 CBF[THEN "→E"] "∀E" by blast
 AOT_have nec_L: ‹◻[L]x› for x
 using "thm-noncont-e-e:1" "contingent-properties:1"[THEN "≡_dfE"]
 CBF[THEN "→E"] "∀E" by blast

 AOT_have act_ord_b: ‹\A[O!]b›
 using b_ord "≡E"(1) "oa-facts:7" by blast
 AOT_have delta_ord_b: ‹\Δ[O!]b›
 by (meson "≡_dfI" b_ord "∨I"(1) necessary_or_contingently_false
 "oa-facts:1" "→E")
 AOT_have not_act_ord_a: ‹¬\A[O!]a›
 by (meson a_prop "≡E"(1) "≡E"(3) "oa-contingent:3" "oa-facts:7")
 AOT_have not_delta_ord_a: ‹¬\Δ[O!]a›
 by (metis Delta_pos "≡E"(4) not_act_ord_a "oa-facts:3" "oa-facts:7"
 "reductio-aa:1" "→E")

 AOT_have not_act_abs_b: ‹¬\A[A!]b›
 by (meson b_ord "≡E"(1) "≡E"(3) "oa-contingent:2" "oa-facts:8")
 AOT_have not_delta_abs_b: ‹¬\Δ[A!]b›
 proof(rule "raa-cor:2")
 AOT_assume ‹\Δ[A!]b›
 AOT_hence ‹♢[A!]b›
 by (metis Delta_pos "vdash-properties:10")
 AOT_thus ‹[A!]b & ¬[A!]b›
 by (metis b_ord "&I" "≡E"(1) "oa-contingent:2"
 "oa-facts:4" "→E")
 qed
 AOT_have act_abs_a: ‹\A[A!]a›
 using a_prop "≡E"(1) "oa-facts:8" by blast
 AOT_have delta_abs_a: ‹\Δ[A!]a›
 by (metis "≡_dfI" a_prop "oa-facts:2" "→E" "∨I"(1)
 necessary_or_contingently_false)

 AOT_have not_act_concrete_b: ‹¬\A[E!]b›
 using b_prop "&E"(2) by blast
 AOT_have delta_concrete_b: ‹\Δ[E!]b›
 proof (rule "≡_dfI"[OF necessary_or_contingently_false];
 rule "∨I"(2); rule "&I")
 AOT_show ‹¬\A[E!]b› using b_prop "&E"(2) by blast
 next
 AOT_show ‹♢[E!]b› using b_prop "&E"(1) by blast
 qed
 AOT_have not_act_concrete_a: ‹¬\A[E!]a›
 proof (rule "raa-cor:2")
 AOT_assume ‹\A[E!]a›
 AOT_hence 1: ‹♢[E!]a› by (metis "Act-Sub:3" "→E")
 AOT_have ‹[A!]a› by (simp add: a_prop)
 AOT_hence ‹[λx ¬♢[E!]x]a›
 by (rule "=_dfE"(2)[OF AOT_abstract, rotated]) "cqt:2"
 AOT_hence ‹¬♢[E!]a› using "β→C"(1) by blast
 AOT_thus ‹♢[E!]a & ¬♢[E!]a› using 1 "&I" by blast
 qed
 AOT_have not_delta_concrete_a: ‹¬\Δ[E!]a›
 proof (rule "raa-cor:2")
 AOT_assume ‹\Δ[E!]a›
 AOT_hence 1: ‹♢[E!]a› by (metis Delta_pos "vdash-properties:10")
 AOT_have ‹[A!]a› by (simp add: a_prop)
 AOT_hence ‹[λx ¬♢[E!]x]a›
 by (rule "=_dfE"(2)[OF AOT_abstract, rotated]) "cqt:2[lambda]"
 AOT_hence ‹¬♢[E!]a› using "β→C"(1) by blast
 AOT_thus ‹♢[E!]a & ¬♢[E!]a› using 1 "&I" by blast
 qed

 AOT_have not_act_q_zero: ‹¬\Aq₀›
 by (meson "log-prop-prop:2" "pos-not-pna:1"
 q₀_def "reductio-aa:1" "rule-id-df:2:a[zero]")
 AOT_have delta_q_zero: ‹\Δq₀›
 proof(rule "≡_dfI"[OF necessary_or_contingently_false];
 rule "∨I"(2); rule "&I")
 AOT_show ‹¬\Aq₀› using not_act_q_zero.
 AOT_show ‹♢q₀› by (meson "&E"(1) q₀_prop)
 qed
 AOT_have act_not_q_zero: ‹\A¬q₀›
 using "Act-Basic:1" "∨E"(2) not_act_q_zero by blast
 AOT_have not_delta_not_q_zero: ‹¬\Δ¬q₀›
 using "≡_dfE" "conventions:5" "Act-Basic:1" act_and_not_nec_not_delta
 "&E"(1) "∨E"(2) not_act_q_zero q₀_prop by blast

 AOT_have ‹[L^-]↓› by (simp add: "rel-neg-T:3")
 moreover AOT_have ‹¬\A[L^-]b & ¬\Δ[L^-]b & ¬\A[L^-]a & ¬\Δ[L^-]a›
 proof (safe intro!: "&I")
 AOT_show ‹¬\A[L^-]b›
 by (meson "≡E"(1) "logic-actual-nec:1"[axiom_inst] "nec-imp-act"
 nec_not_L_neg "→E")
 AOT_show ‹¬\Δ[L^-]b›
 by (meson Delta_pos "KBasic2:1" "≡E"(1)
 "modus-tollens:1" nec_not_L_neg)
 AOT_show ‹¬\A[L^-]a›
 by (meson "≡E"(1) "logic-actual-nec:1"[axiom_inst]
 "nec-imp-act" nec_not_L_neg "→E")
 AOT_show ‹¬\Δ[L^-]a›
 using Delta_pos "KBasic2:1" "≡E"(1) "modus-tollens:1"
 nec_not_L_neg by blast
 qed
 ultimately AOT_obtain F₀ where ‹¬\A[F₀]b & ¬\Δ[F₀]b & pan style='font-size: 18px;'>¬\A[F₀]a & ¬\Δ[F₀]a›
 using "∃I"(1)[rotated, THEN "∃E"[rotated]] by fastforce
 AOT_hence ‹¬\A[F₀]b› and ‹¬\Δ[F₀]b› and ‹¬\A[F₀]a› and ‹¬\Δ[F₀]a›
 using "&E" by blast+
 note props = this

 let ?Π = "«[λy [A!]y & q₀]¬"
 AOT_modally_strict {
 AOT_have ‹[«?Π¬]↓› by "cqt:2[lambda]"
 } note 1 = this
 moreover AOT_have ‹¬\A[«?Π¬]b & ¬\Δ[«?Π¬]b & ¬\A[«?Π¬]a & \Δ[«?Π¬]a›
 proof (safe intro!: "&I"; AOT_subst ‹[λy A!y & q₀]x› ‹A!x & q₀› for: x)
 AOT_show ‹¬\A([A!]b & q₀)›
 using "Act-Basic:2" "&E"(1) "≡E"(1) not_act_abs_b "raa-cor:3" by blast
 next AOT_show ‹¬\Δ([A!]b & q₀)›
 by (metis Delta_pos "KBasic2:3" "&E"(1) "≡E"(4) not_act_abs_b
 "oa-facts:4" "oa-facts:8" "raa-cor:3" "→E")
 next AOT_show ‹¬\A([A!]a & q₀)›
 using "Act-Basic:2" "&E"(2) "≡E"(1) not_act_q_zero
 "raa-cor:3" by blast
 next AOT_show ‹\Δ([A!]a & q₀)›
 proof (rule not_act_and_pos_delta)
 AOT_show ‹¬\A([A!]a & q₀)›
 using "Act-Basic:2" "&E"(2) "≡E"(4) not_act_q_zero
 "raa-cor:3" by blast
 next AOT_show ‹♢([A!]a & q₀)›
 by (metis "&I" "→E" Delta_pos "KBasic:16" "&E"(1) delta_abs_a
 "≡E"(1) "oa-facts:6" q₀_prop)
 qed
 qed(auto simp: "beta-C-meta"[THEN "→E", OF 1])
 ultimately AOT_obtain F₁ where ‹¬\A[F₁]b & ¬\Δ[F₁]b & pan style='font-size: 18px;'>¬\A[F₁]a & \Δ[F₁]a›
 using "∃I"(1)[rotated, THEN "∃E"[rotated]] by fastforce
 AOT_hence ‹¬\A[F₁]b› and ‹¬\Δ[F₁]b› and ‹¬\A[F₁]a› and ‹\Δ[F₁]a›
 using "&E" by blast+
 note props = props this

 let ?Π = "«[λy [A!]y & ¬q₀]¬"
 AOT_modally_strict {
 AOT_have ‹[«?Π¬]↓› by "cqt:2[lambda]"
 } note 1 = this
 moreover AOT_have ‹¬\A[«?Π¬]b & ¬\Δ[«?Π¬]b & \A[«?Π¬]a & yle='font-size: 18px;'>¬\Δ[«?Π¬]a›
 proof (safe intro!: "&I"; AOT_subst ‹[λy A!y & ¬q₀]x› ‹A!x & ¬q₀› for: x)
 AOT_show ‹¬\A([A!]b & ¬q₀)›
 using "Act-Basic:2" "&E"(1) "≡E"(1) not_act_abs_b "raa-cor:3" by blast
 next AOT_show ‹¬\Δ([A!]b & ¬q₀)›
 by (meson "RM♢" Delta_pos "Conjunction Simplification"(1) "≡E"(4)
 "modus-tollens:1" not_act_abs_b "oa-facts:4" "oa-facts:8")
 next AOT_show ‹\A([A!]a & ¬q₀)›
 by (metis "Act-Basic:1" "Act-Basic:2" act_abs_a "&I" "∨E"(2)
 "≡E"(3) not_act_q_zero "raa-cor:3")
 next AOT_show ‹¬\Δ([A!]a & ¬q₀)›
    proof (rule act_and_not_nec_not_delta)
      AOT_show \<open>\<^bold>\<A>([A!]a & \<not>q\<^sub>0)\<close>
        by (metis "Act-Basic:1" "Act-Basic:2" act_abs_a "&I" "\<or>E"(2)
                  "\<equiv>E"(3) not_act_q_zero "raa-cor:3")
    next
      AOT_show \<open>\<not>\<box>([A!]a & \<not>q\<^sub>0)\<close>
        by (metis "KBasic2:1" "KBasic:3" "&E"(1) "&E"(2) "\<equiv>E"(4)
                  q\<^sub>0_prop "raa-cor:3")
    qed
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>2 where \<open>\<not>\<^bold>\<A>[F\<^sub>2]b & \<not>\<^bold>\<Delta>[F\<^sub>2]b & \<^bold>\<A>[F\<^sub>2]a & \<not>\<^bold>\<Delta>[F\<^sub>2]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>2]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>2]b\<close> and \<open>\<^bold>\<A>[F\<^sub>2]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>2]a\<close>
    using "&E" by blast+
  note props = props this

  AOT_have abstract_prop: \<open>\<not>\<^bold>\<A>[A!]b & \<not>\<^bold>\<Delta>[A!]b & \<^bold>\<A>[A!]a & \<^bold>\<Delta>[A!]a\<close>
    using act_abs_a "&I" delta_abs_a not_act_abs_b not_delta_abs_b
    by presburger
  then AOT_obtain F\<^sub>3 where \<open>\<not>\<^bold>\<A>[F\<^sub>3]b & \<not>\<^bold>\<Delta>[F\<^sub>3]b & \<^bold>\<A>[F\<^sub>3]a & \<^bold>\<Delta>[F\<^sub>3]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] "oa-exist:2" by fastforce
  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>3]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>3]b\<close> and \<open>\<^bold>\<A>[F\<^sub>3]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>3]a\<close>
    using "&E" by blast+
  note props = props this

  AOT_have \<open>\<not>\<^bold>\<A>[E!]b & \<^bold>\<Delta>[E!]b & \<not>\<^bold>\<A>[E!]a &n> \<not>\<^bold>\<Delta>[E!]a\<close>
    by (meson "&I" delta_concrete_b not_act_concrete_a
              not_act_concrete_b not_delta_concrete_a)
  then AOT_obtain F\<^sub>4 where \<open>\<not>\<^bold>\<A>[F\<^sub>4]b & \<^bold>\<Delta>[F\<^sub>4]b & \<not>\<^bold>\<A>[F\<^sub>4]a & \<not>\<^bold>\<Delta>[F\<^sub>4]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]]
    by fastforce
  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>4]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>4]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>4]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>4]a\<close>
    using "&E" by blast+
  note props = props this

AOT_modally_strict{
AOT_have <>[<ambda>q\<^sub>0\down>\>by cqt:2[lambda"
 } 1 = 
          >m ctxt java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
      i, prop)
 :  delta_q_zero  beta--meta"T \<ightarrowE, OF1)
  ultimately AOT_obtain F\<^sub>5 where \<open>\<not>\<^bold>\<A>[F\<^sub>5]b & \<^bold>\<Delta>[properties.
   "<>"1[,THEN "<xists>"rotated]
    by                  (, th java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
  java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
    using "&E" by blast+
  note props = props this

  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [E!]y \<or> ([A!]y & \<not>q\<^sub>0)]\<guillemotright>"
  AOT_modally_strict {
    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
  proof(safe intro!: "&I";
        AOT_subst \<open>[\<lambda>y E!y \<or> (A!y & \<not>q\<^sub>0)]x\<close> \<open>E!x \<or> (A!x & \<not>q\<^sub>0)\<close> for: x)
    AOT_have \<open>\<^bold>\<A>\<not>([A!]b & \<not>q\<^sub>0)\<close>
      by (metis "Act-Basic:1" "Act-Basic:2" abstract_prop "&E"(1) "\<or>E"(2)
                "\<equiv>E"(1) "raa-cor:3")
    moreover AOT_have \<open>\<not>\<^bold>\<A>[E!]b\<close>
      using b_prop "&E"(2) by blast
    ultimately AOT_have 2: \<open>\<^bold>\<A>(\<not>[E!]b & \<not>([A!]b & \<not>q\<^sub>0))\<close>
      by (metis "Act-Basic:2" "Act-Sub:1" "&I" "\<equiv>E"(3) "raa-cor:1")
    AOT_have \<open>\<^bold>\<A>\<not>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
      by (AOT_subst \<open>\<not>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close> \<open>\<not>[E!]b &> \<not>([A!]b & \<not>q\<^sub>0)\<close>)
         (auto simp: "oth-class-taut:5:d" 2)
    AOT_thus \<open>\<not>\<^bold>\<A>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
      by (metis "\<not>\<not>I" "Act-Sub:1" "\<equiv>E"(4))
  next
    AOT_show \<open>\<^bold>\<Delta>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
    proof (rule not_act_and_pos_delta)
      AOT_show \<open>\<not>\<^bold>\<A>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
        by (metis "Act-Basic:2" "Act-Basic:9" "\<or>E"(2) "raa-cor:3"
                  "Conjunction Simplification"(1) "\<equiv>E"(4)
                  "modus-tollens:1" not_act_abs_b not_act_concrete_b)
    next
      AOT_show \<open>\<diamond>([E!]b \<or> ([A!]b & \<not>q\<^sub>0))\<close>
        using "KBasic2:2" b_prop "&E"(1) "\<or>I"(1) "\<equiv>E"(3) "raa-cor:3" by blast
    qed
  next AOT_show \<open>\<^bold>\<A>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
      by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_abs_a "&I"
                "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(3) not_act_q_zero "raa-cor:1")
  next AOT_show \<open>\<not>\<^bold>\<Delta>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
    proof (rule act_and_not_nec_not_delta)
      AOT_show \<open>\<^bold>\<A>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
        by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_abs_a "&I"
                  "\<or>I"(2) "\<or>E"(2) "\<equiv>E"(3) not_act_q_zero "raa-cor:1")
    next
      AOT_have \<open>\<box>\<not>[E!]a\<close>
        by (metis "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" "&I" "\<or>I"(2)
                  necessary_or_contingently_false
                  not_act_concrete_a not_delta_concrete_a "raa-cor:3")
      moreover AOT_have \<open>\<diamond>\<not>([A!]a & \<not>q\<^sub>0)\<close>
        by (metis "KBasic2:1" "KBasic:11" "KBasic:3"
                  "&E"(1,2) "\<equiv>E"(1) q\<^sub>0_prop "raa-cor:3")
      ultimately AOT_have \<open>\<diamond>(\<not>[E!]a & \<not>([A!]a & \<not>q\<^sub>0))\<close>
        by (metis "KBasic:16" "&I" "vdash-properties:10")
      AOT_hence \<open>\<diamond>\<not>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
        by (metis "RE\<diamond>" "\<equiv>E"(2) "oth-class-taut:5:d")
      AOT_thus \<open>\<not>\<box>([E!]a \<or> ([A!]a & \<not>q\<^sub>0))\<close>
        by (metis "KBasic:12" "\<equiv>E"(1) "raa-cor:3")
    qed
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>6 where \<open>\<not>\<^bold>\<A>[F\<^sub>6]b & \<^bold>\<Delta>[F\<^sub>6]b & \<^bold>\<A>[F\<^sub>6]a & \<not>\<^bold>\<Delta>[F\<^sub>6]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>6]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>6]b\<close> and \<open>\<^bold>\<A>[F\<^sub>6]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>6]a\<close>
    using "&E" by blast+
  note props = props this

  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [A!]y \<or> [E!]y]\<guillemotright>"
  AOT_modally_strict {
    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
  proof(safe intro!: "&I"; AOT_subst \<open>[\<lambda>y A!y \<or> E!y]x\<close> \<open>A!x \<or> E!x\<close> for: x)
    AOT_show \<open>\<not>\<^bold>\<A>([A!]b \<or> [E!]b)\<close>
      using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_abs_b
            not_act_concrete_b "raa-cor:3" by blast
  next AOT_show \<open>\<^bold>\<Delta>([A!]b \<or> [E!]b)\<close>
    proof (rule not_act_and_pos_delta)
      AOT_show \<open>\<not>\<^bold>\<A>([A!]b \<or> [E!]b)\<close>
        using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_abs_b
              not_act_concrete_b "raa-cor:3" by blast
    next AOT_show \<open>\<diamond>([A!]b \<or> [E!]b)\<close>
        using "KBasic2:2" b_prop "&E"(1) "\<or>I"(2) "\<equiv>E"(2) by blast
    qed
  next AOT_show \<open>\<^bold>\<A>([A!]a \<or> [E!]a)\<close>
      by (meson "Act-Basic:9" act_abs_a "\<or>I"(1) "\<equiv>E"(2))
  next AOT_show \<open>\<^bold>\<Delta>([A!]a \<or> [E!]a) \<close>
    proof (rule nec_delta)
      AOT_show \<open>\<box>([A!]a \<or> [E!]a)\<close>
        by (metis "KBasic:15" act_abs_a act_and_not_nec_not_delta
                  "Disjunction Addition"(1) delta_abs_a "raa-cor:3" "\<rightarrow>E")
    qed
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>7 where \<open>\<not>\<^bold>\<A>[F\<^sub>7]b & \<^bold>\<Delta>[F\<^sub>7]b & \<^bold>\<A>[F\<^sub>7]a & \<^bold>\<Delta>[F\<^sub>7]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<not>\<^bold>\<A>[F\<^sub>7]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>7]b\<close> and \<open>\<^bold>\<A>[F\<^sub>7]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>7]a\<close>
    using "&E" by blast+
  note props = props this

  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [O!]y & \<not>[E!]y]\<guillemotright>"
  AOT_modally_strict {
    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
  proof(safe intro!: "&I"; AOT_subst \<open>[\<lambda>y O!y & \<not>E!y]x\<close> \<open>O!x & \<not>E!x\<close> for: x)
    AOT_show \<open>\<^bold>\<A>([O!]b & \<not>[E!]b)\<close>
      by (metis "Act-Basic:1" "Act-Basic:2" act_ord_b "&I" "\<or>E"(2)
                "\<equiv>E"(3) not_act_concrete_b "raa-cor:3")
  next AOT_show \<open>\<not>\<^bold>\<Delta>([O!]b & \<not>[E!]b)\<close>
      by (metis (no_types, opaque_lifting) "conventions:5" "Act-Sub:1" "RM:1"
                act_and_not_nec_not_delta "act-conj-act:3"
                act_ord_b b_prop "&I" "&E"(1) "Conjunction Simplification"(2)
                "df-rules-formulas[3]"
                "\<equiv>E"(3) "raa-cor:1" "\<rightarrow>E")
  next AOT_show \<open>\<not>\<^bold>\<A>([O!]a & \<not>[E!]a)\<close>
      using "Act-Basic:2" "&E"(1) "\<equiv>E"(1) not_act_ord_a "raa-cor:3" by blast
  next AOT_have \<open>\<not>\<diamond>([O!]a & \<not>[E!]a)\<close>
      by (metis "KBasic2:3" "&E"(1) "\<equiv>E"(4) not_act_ord_a "oa-facts:3"
                "oa-facts:7" "raa-cor:3" "vdash-properties:10")
    AOT_thus \<open>\<not>\<^bold>\<Delta>([O!]a & \<not>[E!]a)\<close>
      by (rule impossible_delta)
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>8 where \<open>\<^bold>\<A>[F\<^sub>8]b & \<not>\<^bold>\<Delta>[F\<^sub>8]b & \<not>\<^bold>\<A>[F\<^sub>8]a & \<not>\<^bold>\<Delta>[F\<^sub>8]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>8]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>8]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>8]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>8]a\<close>
    using "&E" by blast+
  note props = props this

  let ?\<Pi> = "\<guillemotleft>[\<lambda>y \<not>[E!]y & ([O!]y \<or> q\<^sub>0)]\<guillemotright>"
  AOT_modally_strict {
    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
  proof(safe intro!: "&I";
        AOT_subst \<open>[\<lambda>y \<not>E!y & (O!y \<or> q\<^sub>0)]x\<close> \<open>\<not>E!x & (O!x \<or> q\<^sub>0)\<close> for: x)
    AOT_show \<open>\<^bold>\<A>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
      by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_ord_b "&I"
                "\<or>I"(1) "\<or>E"(2) "\<equiv>E"(3) not_act_concrete_b "raa-cor:1")
  next AOT_show \<open>\<not>\<^bold>\<Delta>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
    proof (rule act_and_pos_not_not_delta)
      AOT_show \<open>\<^bold>\<A>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
        by (metis "Act-Basic:1" "Act-Basic:2" "Act-Basic:9" act_ord_b "&I"
                  "\<or>I"(1) "\<or>E"(2) "\<equiv>E"(3) not_act_concrete_b "raa-cor:1")
    next
      AOT_show \<open>\<diamond>\<not>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close>
      proof (AOT_subst \<open>\<not>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0))\<close> \<open>[E!]b \<or> \<not>([O!]b \<or> q\<^sub>0)\<close>)
        AOT_modally_strict {
          AOT_show \<open>\<not>(\<not>[E!]b & ([O!]b \<or> q\<^sub>0)) \<equiv> [E!]b \<or> \<not>([O!]b \<or> q\<^sub>0)\<close>
            by (metis "&I" "&E"(1,2) "\<or>I"(1,2) "\<or>E"(2)
                      "\<rightarrow>I" "\<equiv>I" "reductio-aa:1")
        }
      next
        AOT_show \<open>\<diamond>([E!]b \<or> \<not>([O!]b \<or> q\<^sub>0))\<close>
          using "KBasic2:2" b_prop "&E"(1) "\<or>I"(1) "\<equiv>E"(3)
                "raa-cor:3" by blast
       qed
     qed
   next
     AOT_show \<open>\<not>\<^bold>\<A>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
       using "Act-Basic:2" "Act-Basic:9" "&E"(2) "\<or>E"(3) "\<equiv>E"(1)
             not_act_ord_a not_act_q_zero "reductio-aa:2" by blast
   next
     AOT_show \<open>\<^bold>\<Delta>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
     proof (rule not_act_and_pos_delta)
       AOT_show \<open>\<not>\<^bold>\<A>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
         by (metis "Act-Basic:2" "Act-Basic:9" "&E"(2) "\<or>E"(3) "\<equiv>E"(1)
                   not_act_ord_a not_act_q_zero "reductio-aa:2")
     next
       AOT_have \<open>\<box>\<not>[E!]a\<close>
         using "KBasic2:1" "\<equiv>E"(2) not_act_and_pos_delta not_act_concrete_a
               not_delta_concrete_a "raa-cor:5" by blast
       moreover AOT_have \<open>\<diamond>([O!]a \<or> q\<^sub>0)\<close>
         by (metis "KBasic2:2" "&E"(1) "\<or>I"(2) "\<equiv>E"(3) q\<^sub>0_prop "raa-cor:3")
       ultimately AOT_show \<open>\<diamond>(\<not>[E!]a & ([O!]a \<or> q\<^sub>0))\<close>
         by (metis "KBasic:16" "&I" "vdash-properties:10")
     qed
   qed(auto simp:  "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>9 where \<open>\<^bold>\<A>[F\<^sub>9]b & \<not>\<^bold>\<Delta>[F\<^sub>9]b & \<not>\<^bold>\<A>[F\<^sub>9]a & \<^bold>\<Delta>[F\<^sub>9]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>9]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>9]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>9]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>9]a\<close>
    using "&E" by blast+
  note props = props this

  AOT_modally_strict {
    AOT_have \<open>[\<lambda>y \<not>q\<^sub>0]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<^bold>\<A>[\<lambda>y \<not>q\<^sub>0]b & \<not>\<^bold>\<Delta>[\<lambda>y \<not>q\<^sub>0]b & \<^bold>\<A>[\<lambda>y \<not>q\<^sub>0]a & \<not>\<^bold>\<Delta>[\<lambda>y \<not>q\<^sub>0]a\<close>
    by (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y \<not>q\<^sub>0]x\<close> \<open>\<not>q\<^sub>0\<close> for: x)
       (auto simp: act_not_q_zero not_delta_not_q_zero
                   "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>1\<^sub>0 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>0]b & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]b & \<^bold>\<A>[F\<^sub>1\<^sub>0]a & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>0]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>0]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>0]a\<close>
    using "&E" by blast+
  note props = props this

  AOT_modally_strict {
    AOT_have \<open>[\<lambda>y \<not>[E!]y]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<^bold>\<A>[\<lambda>y \<not>[E!]y]b & \<not>\<^bold>\<Delta>[\<lambda>y \<not>[E!]y]b &
                     \<^bold>\<A>[\<lambda>y \<not>[E!]y]a & \<^bold>\<Delta>[\<lambda>y \<not>[E!]y]a\<close>
  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y \<not>[E!]y]x\<close> \<open>\<not>[E!]x\<close> for: x)
    AOT_show \<open>\<^bold>\<A>\<not>[E!]b\<close>
      using "Act-Basic:1" "\<or>E"(2) not_act_concrete_b by blast
  next AOT_show \<open>\<not>\<^bold>\<Delta>\<not>[E!]b\<close>
      using "\<equiv>\<^sub>d\<^sub>fE" "conventions:5" "Act-Basic:1" act_and_not_nec_not_delta
            b_prop "&E"(1) "\<or>E"(2) not_act_concrete_b by blast
  next AOT_show \<open>\<^bold>\<A>\<not>[E!]a\<close>
      using "Act-Basic:1" "\<or>E"(2) not_act_concrete_a by blast
  next AOT_show \<open>\<^bold>\<Delta>\<not>[E!]a\<close>
      using "KBasic2:1" "\<equiv>E"(2) nec_delta not_act_and_pos_delta
            not_act_concrete_a not_delta_concrete_a "reductio-aa:1"
      by blast
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>1\<^sub>1 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>1]b & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>1]b & \<^bold>\<A>[F\<^sub>1\<^sub>1]a & \<^bold>\<Delta>[F\<^sub>1\<^sub>1]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>1]b\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>1]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>1]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>1]a\<close>
    using "&E" by blast+
  note props = props this

  AOT_have \<open>\<^bold>\<A>[O!]b & \<^bold>\<Delta>[O!]b & \<not>\<^bold>\<A>[O!]a & \<not>\<^bold>\<Delta>[O!]a\<close>
    by (simp add: act_ord_b "&I" delta_ord_b not_act_ord_a not_delta_ord_a)
  then AOT_obtain F\<^sub>1\<^sub>2 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>2]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>2]b & \<not>\<^bold>\<A>[F\<^sub>1\<^sub>2]a & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>2]a\<close>
    using "oa-exist:1" "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>2]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>2]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>1\<^sub>2]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>2]a\<close>
    using "&E" by blast+
  note props = props this

  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [O!]y \<or> q\<^sub>0]\<guillemotright>"
  AOT_modally_strict {
    AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<not>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y O!y \<or> q\<^sub>0]x\<close> \<open>O!x \<or> q\<^sub>0\<close> for: x)
    AOT_show \<open>\<^bold>\<A>([O!]b \<or> q\<^sub>0)\<close>
      by (meson "Act-Basic:9" act_ord_b "\<or>I"(1) "\<equiv>E"(2))
  next AOT_show \<open>\<^bold>\<Delta>([O!]b \<or> q\<^sub>0)\<close>
      by (meson "KBasic:15" b_ord "\<or>I"(1) nec_delta "oa-facts:1" "\<rightarrow>E")
  next AOT_show \<open>\<not>\<^bold>\<A>([O!]a \<or> q\<^sub>0)\<close>
      using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_ord_a
            not_act_q_zero "raa-cor:3" by blast
  next AOT_show \<open>\<^bold>\<Delta>([O!]a \<or> q\<^sub>0)\<close>
    proof (rule not_act_and_pos_delta)
      AOT_show \<open>\<not>\<^bold>\<A>([O!]a \<or> q\<^sub>0)\<close>
        using "Act-Basic:9" "\<or>E"(2) "\<equiv>E"(4) not_act_ord_a
              not_act_q_zero "raa-cor:3" by blast
    next AOT_show \<open>\<diamond>([O!]a \<or> q\<^sub>0)\<close>
        using "KBasic2:2" "&E"(1) "\<or>I"(2) "\<equiv>E"(2) q\<^sub>0_prop by blast
    qed
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>1\<^sub>3 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>3]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>3]b & \<not>\<^bold>\<A>[F\<^sub>1\<^sub>3]a & \<^bold>\<Delta>[F\<^sub>1\<^sub>3]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>3]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>3]b\<close> and \<open>\<not>\<^bold>\<A>[F\<^sub>1\<^sub>3]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>3]a\<close>
    using "&E" by blast+
  note props = props this

  let ?\<Pi> = "\<guillemotleft>[\<lambda>y [O!]y \<or> \<not>q\<^sub>0]\<guillemotright>"
  AOT_modally_strict {
     AOT_have \<open>[\<guillemotleft>?\<Pi>\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
  } note 1 = this
  moreover AOT_have \<open>\<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]b & \<^bold>\<A>[\<guillemotleft>?\<Pi>\<guillemotright>]a & \<not>\<^bold>\<Delta>[\<guillemotleft>?\<Pi>\<guillemotright>]a\<close>
  proof (safe intro!: "&I"; AOT_subst \<open>[\<lambda>y O!y \<or> \<not>q\<^sub>0]x\<close> \<open>O!x \<or> \<not>q\<^sub>0\<close> for: x)
    AOT_show \<open>\<^bold>\<A>([O!]b \<or> \<not>q\<^sub>0)\<close>
      by (meson "Act-Basic:9" act_not_q_zero "\<or>I"(2) "\<equiv>E"(2))
  next AOT_show \<open>\<^bold>\<Delta>([O!]b \<or> \<not>q\<^sub>0)\<close>
      by (meson "KBasic:15" b_ord "\<or>I"(1) nec_delta "oa-facts:1" "\<rightarrow>E")
  next AOT_show \<open>\<^bold>\<A>([O!]a \<or> \<not>q\<^sub>0)\<close>
      by (meson "Act-Basic:9" act_not_q_zero "\<or>I"(2) "\<equiv>E"(2))
  AOT_show <\not><^bold>\Delta>[!] <> \not\<sub>0)<>
    proof(rule act_and_pos_not_not_delta)
       <>\^><>[!a \<or>\not\<^sub>)<
        by (eson "ct-Basic:9"act_not_q_zero "\<or>I"(2) "\<equiv>E"(2))
    next
      <\b>\not>O!<>
        using        using "KBasic2:1" "\<equiv>E"(2
              java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 0
      moreover AOT_have \<open>\<diamond>q\<^sub>0\<close>
        by (meson "&E"(1) q\<^sub>0_prop)
      ultimately AOT_have 2: \<open>\<diamond>(\<not>[O!]a & q\<^sub>0)\<close>
         by (metis "KBasic:16" "&I" "vdash-properties:10")
      AOT_show \<open>\<diamond>\<not>([O!]a \<or> \<not>q\<^sub>0)\<close>
      proof (AOT_subst (reverse) \<open>\<not>([O!]a \<or> \<not>q\<^sub>0)\<close> \<open>\<not>[O!]a & q\<^sub>0\<close>)
        AOT_modally_strict {
          AOT_show \<open>\<not>[O!]a & q\<^sub>0 \<equiv> \<not>([O!]a \<or> \<not>q\<^sub>0)\<close>
            by (metis "&I" "&E"(1) "&E"(2) "\<or>I"(1) "\<or>I"(2)
                      "\<or>E"(3) "deduction-theorem" "\<equiv>I" "raa-cor:3")
        }
      next
        AOT_show \<open>\<diamond>(\<not>[O!]a & q\<^sub>0)\<close>
          using "2" by blast
      qed
    qed
  qed(auto simp: "beta-C-meta"[THEN "\<rightarrow>E", OF 1])
  ultimately AOT_obtain F\<^sub>1\<^sub>4 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>4]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>4]b & \<^bold>\<A>[F\<^sub>1\<^sub>4]a & \<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>4]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>4]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>4]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>4]a\<close> and \<open>\<not>\<^bold>\<Delta>[F\<^sub>1\<^sub>4]a\<close>
    using "&E" by blast+
  note props = props this

  AOT_have \<open>[L]\<down>\<close>
    by (rule "=\<^sub>d\<^sub>fI"(2)[OF L_def]) "cqt:2[lambda]"+
  moreover AOT_have \<open>\<^bold>\<A>[L]b & \<^bold>\<Delta>[L]b & \<^bold>\<A>[L]a & \<^bold>\<Delta>[L]a\<close>
  proof (safe intro!: "&I")
    AOT_show \<open>\<^bold>\<A>[L]b\<close>
      by (meson nec_L "nec-imp-act" "vdash-properties:10")
    next AOT_show \<open>\<^bold>\<Delta>[L]b\<close> using nec_L nec_delta by blast
    next AOT_show \<open>\<^bold>\<A>[L]a\<close> by (meson nec_L "nec-imp-act" "\<rightarrow>E")
    next AOT_show \<open>\<^bold>\<Delta>[L]a\<close> using nec_L nec_delta by blast
  qed
  ultimately AOT_obtain F\<^sub>1\<^sub>5 where \<open>\<^bold>\<A>[F\<^sub>1\<^sub>5]b & \<^bold>\<Delta>[F\<^sub>1\<^sub>5]b & \<^bold>\<A>[F\<^sub>1\<^sub>5]a & \<^bold>\<Delta>[F\<^sub>1\<^sub>5]a\<close>
    using "\<exists>I"(1)[rotated, THEN "\<exists>E"[rotated]] by fastforce
  AOT_hence \<open>\<^bold>\<A>[F\<^sub>1\<^sub>5]b\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>5]b\<close> and \<open>\<^bold>\<A>[F\<^sub>1\<^sub>5]a\<close> and \<open>\<^bold>\<Delta>[F\<^sub>1\<^sub>5]a\<close>
    using "&E" by blast+
  note props = props this

  show ?thesis
    by (rule "\<exists>I"(2)[where \<beta>=F\<^sub>0]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>2]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>3];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>4]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>5];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>6]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>7];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>8]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>9];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>0]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>1];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>2]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>3];
        rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>4]; rule "\<exists>I"(2)[where \<beta>=F\<^sub>1\<^sub>5];
        safe intro!: "&I")
       (match conclusion in "[?v \<Turnstile> [F] \<noteq> [G]]" for F G \<Rightarrow> \<open>
        match props in A: "[?v \<Turnstile> \<not>\<phi>{F}]" for \<phi> \<Rightarrow> \<open>
        match (\<phi>) in "\<lambda>a . ?p" \<Rightarrow> \<open>fail\<close> \<bar> "\<lambda>a . a" \<Rightarrow> \<open>fail\<close> \<bar> _ \<Rightarrow> \<open>
        match props in B: "[?v \<Turnstile> \<phi>{G}]" \<Rightarrow> \<open>
        fact "pos-not-equiv-ne:4"[where F=F and G=G and \<phi>=\<phi>, THEN "\<rightarrow>E",
                                OF "oth-class-taut:4:h"[THEN "\<equiv>E"(2)],
                                OF "Disjunction Addition"(2)[THEN "\<rightarrow>E"],
                                OF "&I", OF A, OF B]\<close>\<close>\<close>\<close>)+
qed

subsection\<open>The Theory of Objects\<close>
text\<open>\label{PLM: 9.11}\<close>

AOT_theorem "o-objects-exist:1": \<open>\<box>\<exists>x O!x\<close>
proof(rule RN)
  AOT_modally_strict {
    AOT_obtain a where \<open>\<diamond>(E!a & \<not>\<^bold>\<A>[E!]a)\<close>
      using "\<exists>E"[rotated, OF "qml:4"[axiom_inst, THEN "BF\<diamond>"[THEN "\<rightarrow>E"]]]
      by blast
    AOT_hence 1: \<open>\<diamond>E!a\<close> by (metis "KBasic2:3" "&E"(1) "\<rightarrow>E")
    AOT_have \<open>[\<lambda>x \<diamond>[E!]x]a\<close>
    proof (rule "\<beta>\<leftarrow>C"(1); "cqt:2[lambda]"?)
      AOT_show \<open>a\<down>\<close> using "cqt:2[const_var]"[axiom_inst] by blast
    next
      AOT_show \<open>\<diamond>E!a\<close> by (fact 1)
    qed
    AOT_hence \<open>O!a\<close> by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2"
    AOT_thus \<open>\<exists>x [O!]x\<close> by (rule "\<exists>I")
  }
qed

AOT_theorem "o-objects-exist:2": \<open>\<box>\<exists>x A!x\<close>
proof (rule RN)
  AOT_modally_strict {
    AOT_obtain a where \<open>[A!]a\<close>
      using "A-objects"[axiom_inst] "\<exists>E"[rotated] "&E" by blast
    AOT_thus \<open>\<exists>x A!x\<close> using "\<exists>I" by blast
  }
qed

AOT_theorem "o-objects-exist:3": \<open>\<box>\<not>\<forall>x O!x\<close>
  by (rule RN)
     (metis (no_types, opaque_lifting) "\<exists>E" "cqt-orig:1[const_var]"
        "\<equiv>E"(4) "modus-tollens:1" "o-objects-exist:2" "oa-contingent:2"
        "qml:2"[axiom_inst] "reductio-aa:2")

AOT_theorem "o-objects-exist:4": \<open>\<box>\<not>\<forall>x A!x\<close>
  by (rule RN)
     (metis (mono_tags, opaque_lifting) "\<exists>E" "cqt-orig:1[const_var]"
        "\<equiv>E"(1) "modus-tollens:1" "o-objects-exist:1" "oa-contingent:2"
        "qml:2"[axiom_inst] "\<rightarrow>E")

AOT_theorem "o-objects-exist:5": \<open>\<box>\<not>\<forall>x E!x\<close>
proof (rule RN; rule "raa-cor:2")
  AOT_modally_strict {
    AOT_assume \<open>\<forall>x E!x\<close>
    moreover AOT_obtain a where abs: \<open>A!a\<close>
      using "o-objects-exist:2"[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]]
            "\<exists>E"[rotated] by blast
    ultimately AOT_have \<open>E!a\<close> using "\<forall>E" by blast
    AOT_hence 1: \<open>\<diamond>E!a\<close> by (metis "T\<diamond>" "\<rightarrow>E")
    AOT_have \<open>[\<lambda>y \<diamond>E!y]a\<close>
    proof (rule "\<beta>\<leftarrow>C"(1); "cqt:2[lambda]"?)
      AOT_show \<open>a\<down>\<close> using "cqt:2[const_var]"[axiom_inst].
    next
      AOT_show \<open>\<diamond>E!a\<close> by (fact 1)
    qed
    AOT_hence \<open>O!a\<close>
      by (rule "=\<^sub>d\<^sub>fI"(2)[OF AOT_ordinary, rotated]) "cqt:2[lambda]"
    AOT_hence \<open>\<not>A!a\<close> by (metis "\<equiv>E"(1) "oa-contingent:2") 
    AOT_thus \<open>p & \<not>p\<close> for p using abs by (metis "raa-cor:3")
  }
qed

AOT_theorem partition: \<open>\<not>\<exists>x (O!x & A!x)\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<exists>x (O!x & A!x)\<close>
  then AOT_obtain a where \<open>O!a & A!a\<close>
    using "\<exists>E"[rotated] by blast
  AOT_thus \<open>p & \<not>p\<close> for p
    by (metis "&E"(1) "Conjunction Simplification"(2) "\<equiv>E"(1)
              "modus-tollens:1" "oa-contingent:2" "raa-cor:3")
qed

AOT_define eq_E :: \<open>\<Pi>\<close> (\<open>'(=\<^sub>E')\<close>)
  "=E": \<open>(=\<^sub>E) =\<^sub>d\<^sub>f [\<lambda>xy O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)]\<close>

syntax "_AOT_eq_E_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl \<open>=\<^sub>E\<close> 50)
translations
  "_AOT_eq_E_infix \<kappa> \<kappa>'" == "CONST AOT_exe (CONST eq_E) (CONST Pair \<kappa> \<kappa>')"
print_translation\<open>
AOT_syntax_print_translations
[(\<^const_syntax>\<open>AOT_exe\<close>, fn ctxt => fn [
  Const (\<^const_name>\<open>eq_E\<close>, _),
  Const (\<^const_syntax>\<open>Pair\<close>, _) $ lhs $ rhs
] => Const (\<^syntax_const>\<open>_AOT_eq_E_infix\<close>, dummyT) $ lhs $ rhs)]\<close>

text\<open>Note: Not explicitly mentioned as theorem in PLM.\<close>
AOT_theorem "=E[denotes]": \<open>[(=\<^sub>E)]\<down>\<close>
  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "=E"]) "cqt:2[lambda]"+

AOT_theorem "=E-simple:1": \<open>x =\<^sub>E y \<equiv> (O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y))\<close>
proof -
  AOT_have 1: \<open>[\<lambda>xy [O!]x & [O!]y & \<box>\<forall>F ([F]x \<equiv> [F]y)]\<down>\<close> by "cqt:2"
  show ?thesis
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "=E"]; "cqt:2[lambda]"?)
    using "beta-C-meta"[THEN "\<rightarrow>E", OF 1, unvarify \<nu>\<^sub>1\<nu>\<^sub>n, of "(_,_)",
                        OF tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"], OF "&I",
                        OF "cqt:2[const_var]"[axiom_inst],
                        OF "cqt:2[const_var]"[axiom_inst]]
    by fast
qed

AOT_theorem "=E-simple:2": \<open>x =\<^sub>E y \<rightarrow> x = y\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>x =\<^sub>E y\<close>
  AOT_hence \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "=E-simple:1"[THEN "\<equiv>E"(1)] by blast
  AOT_thus \<open>x = y\<close>
    using "\<equiv>\<^sub>d\<^sub>fI"[OF "identity:1"] "\<or>I" by blast
qed

AOT_theorem "id-nec3:1": \<open>x =\<^sub>E y \<equiv> \<box>(x =\<^sub>E y)\<close>
proof (rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>x =\<^sub>E y\<close>
  AOT_hence \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "=E-simple:1" "\<equiv>E" by blast
  AOT_hence \<open>\<box>O!x & \<box>O!y & \<box>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    by (metis "S5Basic:6" "&I" "&E"(1) "&E"(2) "\<equiv>E"(4)
              "oa-facts:1" "raa-cor:3" "vdash-properties:10")
  AOT_hence \<open>\<box>(O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y))\<close>
    by (metis "&E"(1) "&E"(2) "\<equiv>E"(2) "KBasic:3" "&I")
  AOT_thus \<open>\<box>(x =\<^sub>E y)\<close>
    using "=E-simple:1"
    by (AOT_subst \<open>x =\<^sub>E y\<close> \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>) auto
next
  AOT_assume \<open>\<box>(x =\<^sub>E y)\<close>
  AOT_thus \<open>x =\<^sub>E y\<close> using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "id-nec3:2": \<open>\<diamond>(x =\<^sub>E y) \<equiv> x =\<^sub>E y\<close>
  by (meson "RE\<diamond>" "S5Basic:2" "id-nec3:1" "\<equiv>E"(1,5) "Commutativity of \<equiv>")

AOT_theorem "id-nec3:3": \<open>\<diamond>(x =\<^sub>E y) \<equiv> \<box>(x =\<^sub>E y)\<close>
  by (meson "id-nec3:1" "id-nec3:2" "\<equiv>E"(5))

syntax "_AOT_non_eq_E" :: \<open>\<Pi>\<close> (\<open>'(\<noteq>\<^sub>E')\<close>)
translations
  (\<Pi>) "(\<noteq>\<^sub>E)" == (\<Pi>) "(=\<^sub>E)\<^sup>-"
syntax "_AOT_non_eq_E_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl \<open>\<noteq>\<^sub>E\<close> 50)
translations
 "_AOT_non_eq_E_infix \<kappa> \<kappa>'" ==
 "CONST AOT_exe (CONST relation_negation (CONST eq_E)) (CONST Pair \<kappa> \<kappa>')"
print_translation\<open>
AOT_syntax_print_translations
[(\<^const_syntax>\<open>AOT_exe\<close>, fn ctxt => fn [
  Const (\<^const_syntax>\<open>relation_negation\<close>, _) $ Const (\<^const_name>\<open>eq_E\<close>, _),
  Const (\<^const_syntax>\<open>Pair\<close>, _) $ lhs $ rhs
] => Const (\<^syntax_const>\<open>_AOT_non_eq_E_infix\<close>, dummyT) $ lhs $ rhs)]\<close>
AOT_theorem "thm-neg=E": \<open>x \<noteq>\<^sub>E y \<equiv> \<not>(x =\<^sub>E y)\<close>
proof -
  AOT_have \<theta>: \<open>[\<lambda>x\<^sub>1...x\<^sub>2 \<not>(=\<^sub>E)x\<^sub>1...x\<^sub>2]\<down>\<close> by "cqt:2"
  AOT_have \<open>x \<noteq>\<^sub>E y \<equiv> [\<lambda>x\<^sub>1...x\<^sub>2 \<not>(=\<^sub>E)x\<^sub>1...x\<^sub>2]xy\<close>
    by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF \<theta>])
       (meson "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<not>(=\<^sub>E)xy\<close>
    by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E", unvarify \<nu>\<^sub>1\<nu>\<^sub>n] "cqt:2"
                     tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I")
  finally show ?thesis.
qed

AOT_theorem "id-nec4:1": \<open>x \<noteq>\<^sub>E y \<equiv> \<box>(x \<noteq>\<^sub>E y)\<close>
proof -
  AOT_have \<open>x \<noteq>\<^sub>E y \<equiv> \<not>(x =\<^sub>E y)\<close> using "thm-neg=E".
  also AOT_have \<open>\<dots> \<equiv> \<not>\<diamond>(x =\<^sub>E y)\<close>
    by (meson "id-nec3:2" "\<equiv>E"(1) "Commutativity of \<equiv>" "oth-class-taut:4:b")
  also AOT_have \<open>\<dots> \<equiv> \<box>\<not>(x =\<^sub>E y)\<close>
    by (meson "KBasic2:1" "\<equiv>E"(2) "Commutativity of \<equiv>")
  also AOT_have \<open>\<dots> \<equiv> \<box>(x \<noteq>\<^sub>E y)\<close>
    by (AOT_subst (reverse) \<open>\<not>(x =\<^sub>E y)\<close> \<open>x \<noteq>\<^sub>E y\<close>)
       (auto simp: "thm-neg=E" "oth-class-taut:3:a")
  finally show ?thesis.
qed

AOT_theorem "id-nec4:2": \<open>\<diamond>(x \<noteq>\<^sub>E y) \<equiv> (x \<noteq>\<^sub>E y)\<close>
  by (meson "RE\<diamond>" "S5Basic:2" "id-nec4:1" "\<equiv>E"(2,5) "Commutativity of \<equiv>")

AOT_theorem "id-nec4:3": \<open>\<diamond>(x \<noteq>\<^sub>E y) \<equiv> \<box>(x \<noteq>\<^sub>E y)\<close>
  by (meson "id-nec4:1" "id-nec4:2" "\<equiv>E"(5))

AOT_theorem "id-act2:1": \<open>x =\<^sub>E y \<equiv> \<^bold>\<A>x =\<^sub>E y\<close>
  by (meson "Act-Basic:5" "Act-Sub:2" "RA[2]" "id-nec3:2" "\<equiv>E"(1,6))
AOT_theorem "id-act2:2": \<open>x \<noteq>\<^sub>E y \<equiv> \<^bold>\<A>x \<noteq>\<^sub>E y\<close>
  by (meson "Act-Basic:5" "Act-Sub:2" "RA[2]" "id-nec4:2" "\<equiv>E"(1,6))

AOT_theorem "ord=Eequiv:1": \<open>O!x \<rightarrow> x =\<^sub>E x\<close>
proof (rule "\<rightarrow>I")
  AOT_assume 1: \<open>O!x\<close>
  AOT_show \<open>x =\<^sub>E x\<close>
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "=E"]) apply "cqt:2[lambda]"
    apply (rule "\<beta>\<leftarrow>C"(1))
      apply "cqt:2[lambda]"
     apply (simp add: "&I" "cqt:2[const_var]"[axiom_inst] prod_denotesI)
    by (simp add: "1" RN "&I" "oth-class-taut:3:a" "universal-cor")
qed

AOT_theorem "ord=Eequiv:2": \<open>x =\<^sub>E y \<rightarrow> y =\<^sub>E x\<close>
proof(rule CP)
  AOT_assume 1: \<open>x =\<^sub>E y\<close>
  AOT_hence 2: \<open>x = y\<close> by (metis "=E-simple:2" "vdash-properties:10") 
  AOT_have \<open>O!x\<close> using 1 by (meson "&E"(1) "=E-simple:1" "\<equiv>E"(1))
  AOT_hence \<open>x =\<^sub>E x\<close> using "ord=Eequiv:1" "\<rightarrow>E" by blast
  AOT_thus \<open>y =\<^sub>E x\<close> using "rule=E"[rotated, OF 2] by fast
qed

AOT_theorem "ord=Eequiv:3": \<open>(x =\<^sub>E y & y =\<^sub>E z) \<rightarrow> x =\<^sub>E z\<close>
proof (rule CP)
  AOT_assume 1: \<open>x =\<^sub>E y & y =\<^sub>E z\<close>
  AOT_hence \<open>x = y & y = z\<close>
    by (metis "&I" "&E"(1) "&E"(2) "=E-simple:2" "vdash-properties:6")
  AOT_hence \<open>x = z\<close> by (metis "id-eq:3" "vdash-properties:6")
  moreover AOT_have \<open>x =\<^sub>E x\<close>
    using 1[THEN "&E"(1)] "&E"(1) "=E-simple:1" "\<equiv>E"(1)
          "ord=Eequiv:1" "\<rightarrow>E" by blast
  ultimately AOT_show \<open>x =\<^sub>E z\<close>
    using "rule=E" by fast
qed

AOT_theorem "ord-=E=:1": \<open>(O!x \<or> O!y) \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>E y)\<close>
proof(rule CP)
  AOT_assume \<open>O!x \<or> O!y\<close>
  moreover {
    AOT_assume \<open>O!x\<close>
    AOT_hence \<open>\<box>O!x\<close> by (metis "oa-facts:1" "vdash-properties:10")
    moreover {
      AOT_modally_strict {
        AOT_have \<open>O!x \<rightarrow> (x = y \<equiv> x =\<^sub>E y)\<close>
        proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
          AOT_assume \<open>O!x\<close>
          AOT_hence \<open>x =\<^sub>E x\<close> by (metis "ord=Eequiv:1" "\<rightarrow>E")
          moreover AOT_assume \<open>x = y\<close>
          ultimately AOT_show \<open>x =\<^sub>E y\<close> using "rule=E" by fast
        next
          AOT_assume \<open>x =\<^sub>E y\<close>
          AOT_thus \<open>x = y\<close> by (metis "=E-simple:2" "\<rightarrow>E")
        qed
      }
      AOT_hence \<open>\<box>O!x \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>E y)\<close> by (metis "RM:1")
    }
    ultimately AOT_have \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> using "\<rightarrow>E" by blast
  }
  moreover {
    AOT_assume \<open>O!y\<close>
    AOT_hence \<open>\<box>O!y\<close> by (metis "oa-facts:1" "vdash-properties:10")
    moreover {
      AOT_modally_strict {
        AOT_have \<open>O!y \<rightarrow> (x = y \<equiv> x =\<^sub>E y)\<close>
        proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I")
          AOT_assume \<open>O!y\<close>
          AOT_hence \<open>y =\<^sub>E y\<close> by (metis "ord=Eequiv:1" "\<rightarrow>E")
          moreover AOT_assume \<open>x = y\<close>
          ultimately AOT_show \<open>x =\<^sub>E y\<close> using "rule=E" id_sym by fast
        next
          AOT_assume \<open>x =\<^sub>E y\<close>
          AOT_thus \<open>x = y\<close> by (metis "=E-simple:2" "\<rightarrow>E")
        qed
      }
      AOT_hence \<open>\<box>O!y \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>E y)\<close> by (metis "RM:1")
    }
    ultimately AOT_have \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> using "\<rightarrow>E" by blast
  }
  ultimately AOT_show \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> by (metis "\<or>E"(3) "raa-cor:1")
qed

AOT_theorem "ord-=E=:2": \<open>O!y \<rightarrow> [\<lambda>x x = y]\<down>\<close>
proof (rule "\<rightarrow>I"; rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; rule "&n>I")
  AOT_show \<open>[\<lambda>x x =\<^sub>E y]\<down>\<close> by "cqt:2[lambda]"
next
  AOT_assume \<open>O!y\<close>
  AOT_hence 1: \<open>\<box>(x = y \<equiv> x =\<^sub>E y)\<close> for x
    using "ord-=E=:1" "\<rightarrow>E" "\<or>I" by blast
  AOT_have \<open>\<box>(x =\<^sub>E y \<equiv> x = y)\<close> for x
    by (AOT_subst \<open>x =\<^sub>E y \<equiv> x = y\<close> \<open>x = y \<equiv> x =\<^sub>E y\<close>)
       (auto simp add: "Commutativity of \<equiv>" 1)
  AOT_hence \<open>\<forall>x \<box>(x =\<^sub>E y \<equiv> x = y)\<close> by (rule GEN)
  AOT_thus \<open>\<box>\<forall>x (x =\<^sub>E y \<equiv> x = y)\<close> by (rule BF[THEN "\<rightarrow>E"])
qed


AOT_theorem "ord-=E=:3": \<open>[\<lambda>xy O!x & O!y & x = y]\<down>\<close>
proof (rule "safe-ext[2]"[axiom_inst, THEN "\<rightarrow>E"]; rule "&I")
  AOT_show \<open>[\<lambda>xy O!x & O!y & x =\<^sub>E y]\<down>\<close> by "cqt:2[lambda]"
next
  AOT_show \<open>\<box>\<forall>x\<forall>y ([O!]x & [O!]y & x =\<^sub>E y \<equiv> [O!]x &n> [O!]y & x = y)\<close>
  proof (rule RN; rule GEN; rule GEN; rule "\<equiv>I"; rule "\<rightarrow>I")
    AOT_modally_strict {
      AOT_show \<open>[O!]x & [O!]y & x = y\<close> if \<open>[O!]x & [O!]y & x =\<^sub>E y\<close> for x y
        by (metis "&I" "&E"(1) "Conjunction Simplification"(2) "=E-simple:2"
                  "modus-tollens:1" "raa-cor:1" that)
    }
  next
    AOT_modally_strict {
      AOT_show \<open>[O!]x & [O!]y & x =\<^sub>E y\<close> if \<open>[O!]x & [O!]y & x = y\<close> for x y
        apply(safe intro!: "&I")
          apply (metis that[THEN "&E"(1), THEN "&E"(1)])
         apply (metis that[THEN "&E"(1), THEN "&E"(2)])
        using "rule=E"[rotated, OF that[THEN "&E"(2)]]
              "ord=Eequiv:1"[THEN "\<rightarrow>E", OF that[THEN "&E"(1), THEN "&E"(1)]]
        by fast
    }
  qed
qed

AOT_theorem "ind-nec": \<open>\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
  moreover AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]\<down>\<close> by "cqt:2[lambda]"
  ultimately AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]x \<equiv> [\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]y\<close>
    using "\<forall>E" by blast
  moreover AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]y\<close>
    apply (rule "\<beta>\<leftarrow>C"(1))
      apply "cqt:2[lambda]"
     apply (fact "cqt:2[const_var]"[axiom_inst])
    by (simp add: RN GEN "oth-class-taut:3:a")
  ultimately AOT_have \<open>[\<lambda>x \<box>\<forall>F ([F]x \<equiv> [F]y)]x\<close> using "\<equiv>E" by blast
  AOT_thus \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "\<beta>\<rightarrow>C"(1) by blast
qed

AOT_theorem "ord=E:1": \<open>(O!x & O!y) \<rightarrow> (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> x =\<^sub>E y)\<close>
proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
  AOT_hence \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "ind-nec"[THEN "\<rightarrow>E"] by blast
  moreover AOT_assume \<open>O!x & O!y\<close>
  ultimately AOT_have \<open>O!x & O!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "&I" by blast
  AOT_thus \<open>x =\<^sub>E y\<close> using "=E-simple:1"[THEN "\<equiv>E"(2)] by blast
qed

AOT_theorem "ord=E:2": \<open>(O!x & O!y) \<rightarrow> (\<forall>F ([F]x \<equiv> [F]y) \<rightarrow> x = y)\<close>
proof (rule "\<rightarrow>I"; rule "\<rightarrow>I")
  AOT_assume \<open>O!x & O!y\<close>
  moreover AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
  ultimately AOT_have \<open>x =\<^sub>E y\<close>
    using "ord=E:1" "\<rightarrow>E" by blast
  AOT_thus \<open>x = y\<close> using "=E-simple:2"[THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "ord=E2:1":
  \<open>(O!x & O!y) \<rightarrow> (x \<noteq> y \<equiv> [\<lambda>z z =\<^sub>E x] \<noteq> [\<lambda>z z =\<^sub>E y])\<close>
proof (rule "\<rightarrow>I"; rule "\<equiv>I"; rule "\<rightarrow>I";
       rule "\<equiv>\<^sub>d\<^sub>fI"[OF "=-infix"]; rule "raa-cor:2")
  AOT_assume 0: \<open>O!x & O!y\<close>
  AOT_assume \<open>x \<noteq> y\<close>
  AOT_hence 1: \<open>\<not>(x = y)\<close> using "\<equiv>\<^sub>d\<^sub>fE"[OF "=-infix"] by blast
  AOT_assume \<open>[\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y]\<close>
  moreover AOT_have \<open>[\<lambda>z z =\<^sub>E x]x\<close>
    apply (rule "\<beta>\<leftarrow>C"(1))
      apply "cqt:2[lambda]"
     apply (fact "cqt:2[const_var]"[axiom_inst])
    using "ord=Eequiv:1"[THEN "\<rightarrow>E", OF 0[THEN "&E"(1)]].
  ultimately AOT_have \<open>[\<lambda>z z =\<^sub>E y]x\<close> using "rule=E" by fast
  AOT_hence \<open>x =\<^sub>E y\<close> using "\<beta>\<rightarrow>C"(1) by blast
  AOT_hence \<open>x = y\<close> by (metis "=E-simple:2" "vdash-properties:6")
  AOT_thus \<open>x = y & \<not>(x = y)\<close> using 1 "&I" by blast
next
  AOT_assume \<open>[\<lambda>z z =\<^sub>E x] \<noteq> [\<lambda>z z =\<^sub>E y]\<close>
  AOT_hence 0: \<open>\<not>([\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E y])\<close>
    using "\<equiv>\<^sub>d\<^sub>fE"[OF "=-infix"] by blast
  AOT_have \<open>[\<lambda>z z =\<^sub>E x]\<down>\<close> by "cqt:2[lambda]"
  AOT_hence \<open>[\<lambda>z z =\<^sub>E x] = [\<lambda>z z =\<^sub>E x]\<close>
 by (metis "rule=I:1")
 moreover AOT_assume ‹x = y›
 ultimately AOT_have ‹[λz z =_E x] = [λz z =_E y]›
 using "rule=E" by fast
 AOT_thus ‹[λz z =_E x] = [λz z =_E y] & ¬([λz z =_E x] = [λz z =_E y])›
 using 0 "&I" by blast
 

  "ord=E2:2":
 ‹(O!x & O!y) → (x ≠ y ≡ [λz z = x] ≠ [λz z = y])›
  (rule "→I"; rule "≡I"; rule "→I";
 rule "≡_dfI"[OF "=-infix"]; rule "raa-cor:2")
 AOT_assume 0: ‹O!x & O!y›
 AOT_assume ‹x ≠ y›
 AOT_hence 1: ‹¬(x = y)› using "≡_dfE"[OF "=-infix"] by blast
 AOT_assume ‹[λz z = x] = [λz z = y]›
 moreover AOT_have ‹[λz z = x]x›
 apply (rule "β←C"(1))
 apply (fact "ord-=E=:2"[THEN "→E", OF 0[THEN "&E"(1)]])
 apply (fact "cqt:2[const_var]"[axiom_inst])
 by (simp add: "id-eq:1")
 ultimately AOT_have ‹[λz z = y]x› using "rule=E" by fast
 AOT_hence ‹x = y› using "β→C"(1) by blast
 AOT_thus ‹x = y & ¬(x = y)› using 1 "&I" by blast
 
 AOT_assume 0: ‹O!x & O!y›
 AOT_assume ‹[λz z = x] ≠ [λz z = y]›
 AOT_hence 1: ‹¬([λz z = x] = [λz z = y])›
 using "≡_dfE"[OF "=-infix"] by blast
 AOT_have ‹[λz z = x]↓›
 by (fact "ord-=E=:2"[THEN "→E", OF 0[THEN "&E"(1)]])
 AOT_hence ‹[λz z = x] = [λz z = x]›
 by (metis "rule=I:1")
 moreover AOT_assume ‹x = y›
 ultimately AOT_have ‹[λz z = x] = [λz z = y]›
 using "rule=E" by fast
 AOT_thus ‹[λz z = x] = [λz z = y] & ¬([λz z = x] = [λz z = y])›
 using 1 "&I" by blast
 

  ordnecfail: ‹O!x → ◻¬∃F x[F]›
 by (meson "RM:1" "→I" nocoder[axiom_inst] "oa-facts:1" "→E")

  "ab-obey:1": ‹(A!x & A!y) → (∀F (x[F] ≡ y[F]) → x = y)›
java.lang.StringIndexOutOfBoundsException: Range [92, 90) out of bounds for length 144
 AOT_assume 1: ‹A!x & A!y›
 AOT_assume ‹Even if OpenFlow 1. does not require this behavior, some switches may still silently drop matches without prerequsites.
 
 AOT_hence ‹ y[F])› for F by (mei en-eq:6[1]" "\equiv>E"(1))
 >∀F ◻ y[F])›by(ueGN
java.lang.StringIndexOutOfBoundsException: Range [18, 16) out of bounds for length 54
 AOT_thus ‹x = y›
java.lang.StringIndexOutOfBoundsException: Range [11, 9) out of bounds for length 86
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

  "ab-obey:2":
 ‹(∃F (x[F] & ¬y[F]) ∨ ∃F (y[F] & ¬x[F])) → x ≠ y›
  (rule "→I"; rule "≡_dfI"[OF "=-infix"]; rule "raa-cor:2")
 AOT_assume 1: ‹x = y›
 AOT_assume ‹∃F (x[F] & ¬y[F]) ∨ ∃F (y[F] & 'font-size: 18px;'>¬x[F])›
 moreover {
 AOT_assume ‹∃F (x[F] & ¬y[F])›
 then AOT_obtain F where ‹x[F] & ¬y[F]›
 using "∃E"[rotated] by blast
 moreover AOT_have ‹y[F]›
 using calculation[THEN "&E"(1)] 1 "rule=E" by fast
 ultimately AOT_have ‹p & ¬p› for p
 by (metis "Conjunction Simplification"(2) "modus-tollens:2" "raa-cor:3")
 }
 moreover {
 AOT_assume ‹∃F (y[F] & ¬x[F])›
 then AOT_obtain F where ‹y[F] & ¬x[F]›
 using "∃E"[rotated] by blast
 moreover AOT_have ‹¬y[F]›
 using calculation[THEN "&E"(2)] 1 "rule=E" by fast
 ultimately AOT_have ‹p & ¬p› for p
 by (metis "Conjunction Simplification"(1) "modus-tollens:1" "raa-cor:3")
 }
 ultimately AOT_show ‹p & ¬p› for p
 by (metis "∨E"(3) "raa-cor:1")
 

  "encoders-are-abstract": ‹∃F x[F] → A!x›
 by (meson "deduction-theorem" "≡E"(2) "modus-tollens:2" nocoder
 "oa-contingent:3" "vdash-properties:1[2]")

  "denote=:1": ‹∀H∃x x[H]›
 by (rule GEN; rule "existence:2[1]"[THEN "≡_dfE"]; "cqt:2")

  "denote=:2": ‹∀G∃x₁...∃x_n x₁...x_n[H]›
 by (rule GEN; rule "existence:2"[THEN "≡_dfE"]; "cqt:2")

  "denote=:2[2]": ‹∀G∃x₁∃x₂ x₁x₂[H]›
 by (rule GEN; rule "existence:2[2]"[THEN "≡_dfE"]; "cqt:2")

  "denote=:2[3]": ‹∀G∃x₁∃x₂∃x₃ x₁x₂x₃[H]›
 by (rule GEN; rule "existence:2[3]"[THEN "≡_dfE"]; "cqt:2")

  "denote=:2[4]": ‹∀G∃x₁∃x₂∃x₃∃x₄ x₁x₂x₃x₄[H]›
 by (rule GEN; rule "existence:2[4]"[THEN "≡_dfE"]; "cqt:2")

  "denote=:3": ‹∃x x[Π] ≡ ∃H (H = Π)›
 using "existence:2[1]" "free-thms:1" "≡E"(2,5)
 "Commutativity of ≡" "≡Df" by blast

  "denote=:4": ‹(∃x₁...∃x_n x₁...x_n[Π]) ≡ ∃H (H = Π)›
 using "existence:2" "free-thms:1" "≡E"(6) "≡Df" by blast

  "denote=:4[2]": ‹(∃x₁∃x₂ x₁x₂[Π]) ≡ ∃H (H = Π)›
 using "existence:2[2]" "free-thms:1" "≡E"(6) "≡Df" by blast

  "denote=:4[3]": ‹(∃x₁∃x₂∃x₃ x₁x₂x₃[Π]) ≡ ∃H (H = Π)›
 using "existence:2[3]" "free-thms:1" "≡E"(6) "≡Df" by blast

  "denote=:4[4]": ‹(∃x₁∃x₂∃x₃∃x₄ x₁x₂x₃x₄[Π]) ≡ ∃H (H = Π)›
 using "existence:2[4]" "free-thms:1" "≡E"(6) "≡Df" by blast

  "A-objects!": ‹∃!x (A!x & ∀F (x[F] ≡ φ{F}))›
  (rule "uniqueness:1"[THEN "≡_dfI"])
 AOT_obtain a where a_prop: ‹A!a & ∀F (a[F] ≡ φ{F})›
 using "A-objects"[axiom_inst] "∃E"[rotated] by blast
 AOT_have ‹(A!β & ∀F (β[F] ≡ φ{F})) → β = a› for β
 proof (rule "→I")
 AOT_assume β_prop: ‹[A!]β & ∀F (β[F] ≡ φ{F})›
 AOT_hence ‹β[F] ≡ φ{F}› for F
 using "∀E" "&E" by blast
 AOT_hence ‹β[F] ≡ a[F]› for F
 using a_prop[THEN "&E"(2)] "∀E" "≡E"(2,5)
 "Commutativity of ≡" by fast
 AOT_hence ‹∀F (β[F] ≡ a[F])› by (rule GEN)
 AOT_thus ‹β = a›
 using "ab-obey:1"[THEN "→E",
 OF "&I"[OF β_prop[THEN "&E"(1)], OF a_prop[THEN "&E"(1)]],
 THEN "→E"] by blast
 qed
 AOT_hence ‹∀β ((A!β & ∀F (β[F] ≡ φ{F})) → β = a)› by (rule GEN)
 AOT_thus ‹∃α ([A!]α & ∀F (α[F] ≡ φ{F}) &
 ∀β ([A!]β & ∀F (β[F] ≡ φ{F}) → β = α))›
 using "∃I" using a_prop "&I" by fast
 

  "obj-oth:1": ‹∃!x (A!x & ∀F (x[F] ≡ [F]y))›
 using "A-objects!" by fast

  "obj-oth:2": ‹∃!x (A!x & ∀F (x[F] ≡ [F]y & [F]z))›
 using "A-objects!" by fast

  "obj-oth:3": ‹∃!x (A!x & ∀F (x[F] ≡ [F]y ∨ [F]z))›
 using "A-objects!" by fast

  "obj-oth:4": ‹∃!x (A!x & ∀F (x[F] ≡ ◻[F]y))›
 using "A-objects!" by fast

  "obj-oth:5": ‹∃!x (A!x & ∀F (x[F] ≡ F = G))›
 using "A-objects!" by fast

  "obj-oth:6": ‹∃!x (A!x & ∀F (x[F] ≡ ◻∀y([G]y → [F]y)))›
 using "A-objects!" by fast

  "A-descriptions": ‹\ιx (A!x & ∀F (x[F] ≡ φ{F}))↓›
 by (rule "A-Exists:2"[THEN "≡E"(2)]; rule "RA[2]"; rule "A-objects!")

  "thm-can-terms2":
 ‹y = \ιx(A!x & ∀F (x[F] ≡ φ{F})) → (A!y & ∀F (y[F] ≡ φ{F}))›
 using "y-in:2" by blast

  "can-ab2": ‹y = \ιx(A!x & ∀F (x[F] ≡ φ{F})) → A!y›
 (rule "→I")
 AOT_assume ‹y = \ιx(A!x & ∀F (x[F] ≡ φ{F}))›
 AOT_hence ‹\A(A!y & ∀F (y[F] ≡ φ{F}))›
 using "actual-desc:2"[THEN "→E"] by blast
 AOT_hence ‹\AA!y› by (metis "Act-Basic:2" "&E"(1) "≡E"(1))
 AOT_thus ‹A!y› by (metis "≡E"(2) "oa-facts:8")
 

  "desc-encode:1": ‹\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F}›
  -
 AOT_have ‹\ιx(A!x & ∀F (x[F] ≡ φ{F}))↓›
 by (simp add: "A-descriptions")
 AOT_hence ‹A!\ιx(A!x & ∀F (x[F] ≡ φ{F})) &
 ∀F(\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F})›
 using "y-in:3"[THEN "→E"] by blast
 AOT_thus ‹\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F}›
 using "&E" "∀E" by blast
 

  "desc-encode:2": ‹\ιx(A!x & ∀F (x[F] ≡ φ{F}))[G] ≡ φ{G}›
 using "desc-encode:1".

  "desc-nec-encode:1":
 ‹\ιx (A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ \Aφ{F}›
  -
 AOT_have 0: ‹\ιx(A!x & ∀F (x[F] ≡ φ{F}))↓›
 by (simp add: "A-descriptions")
 AOT_hence ‹\A(A!\ιx(A!x & ∀F (x[F] ≡ φ{F})) &
 ∀F(\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F}))›
 using "actual-desc:4"[THEN "→E"] by blast
 AOT_hence ‹\A∀F (\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F})›
 using "Act-Basic:2" "&E"(2) "≡E"(1) by blast
 AOT_hence ‹∀F \A(\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F})›
 using "≡E"(1) "logic-actual-nec:3" "vdash-properties:1[2]" by blast
 AOT_hence ‹\A(\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ φ{F})›
 using "∀E" by blast
 AOT_hence ‹\A\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ \Aφ{F}›
 using "Act-Basic:5" "≡E"(1) by blast
 AOT_thus ‹\ιx(A!x & ∀F (x[F] ≡ φ{F}))[F] ≡ \Aφ{F}›
 using "en-eq:10[1]"[unvarify x₁, OF 0] "≡E"(6) by blast
 

  "desc-nec-encode:2":
 ‹\ιx (A!x & ∀F (x[F] ≡ φ{F}))[G] ≡ \Aφ{G}›
 using "desc-nec-encode:1".

  "Box-desc-encode:1": ‹◻φ{G} → \ιx(A!x & ∀F (x[F] ≡ φ{G}))[G]›
 by (rule "→I"; rule "desc-nec-encode:2"[THEN "≡E"(2)])
 (meson "nec-imp-act" "vdash-properties:10")

  "Box-desc-encode:2":
 ‹◻φ{G} → ◻(\ιx(A!x & ∀F (x[F] ≡ φ{G}))[G] ≡ φ{G})›
 (rule CP)
 AOT_assume ‹◻φ{G}›
 AOT_hence ‹◻◻φ{G}› by (metis "S5Basic:6" "≡E"(1))
 moreover AOT_have ‹◻◻φ{G} → ◻(\ιx(A!x & ∀F (x[F] ≡ φ{G}))[G] ≡ φ{G})›
 proof (rule RM; rule "→I")
 AOT_modally_strict {
 AOT_assume 1: ‹◻φ{G}›
 AOT_hence ‹\ιx(A!x & ∀F (x[F] ≡ φ{G}))[G]›
 using "Box-desc-encode:1" "→E" by blast
 moreover AOT_have ‹φ{G}›
 using 1 by (meson "qml:2"[axiom_inst] "→E")
 ultimately AOT_show ‹\ιx(A!x & ∀F (x[F] ≡ φ{G}))[G] ≡ φ{G}›
 using "→I" "≡I" by simp
 }
 qed
 ultimately AOT_show ‹◻(\ιx(A!x & ∀F (x[F] ≡ φ{G}))[G] ≡ φ{G})›
 using "→E" by blast
 

  rigid_condition where
 ‹rigid_condition φ ≡ ∀v . [v ⊨ ∀α (φ{α} → ◻φ{α})]›
  rigid_condition :: ‹id_position → AOT_prop› (‹RIGID'_CONDITION'(_')›)

  "strict-can:1[E]":
 assumes ‹RIGID_CONDITION(φ)›
 shows ‹∀α (φ{α} → ◻φ{α})›
 using assms[unfolded rigid_condition_def] by auto

  "strict-can:1[I]":
 assumes ‹\⊨_\◻ ∀α (φ{α} → ◻φ{α})›
 shows ‹RIGID_CONDITION(φ)›
 using assms rigid_condition_def by auto

  "box-phi-a:1":
 assumes ‹RIGID_CONDITION(φ)›
 shows ‹(A!x & ∀F (x[F] ≡ φ{F})) → ◻(A!x & ∀F (x[F] ≡ φ{F}))›
  (rule "→I")
 AOT_assume a: ‹A!x & ∀F (x[F] ≡ φ{F})›
 AOT_hence b: ‹◻A!x›
 by (metis "Conjunction Simplification"(1) "oa-facts:2" "→E")
 AOT_have ‹x[F] ≡ φ{F}› for F
 using a[THEN "&E"(2)] "∀E" by blast
 moreover AOT_have ‹◻(x[F] → ◻x[F])› for F
 by (meson "pre-en-eq:1[1]" RN)
 moreover AOT_have ‹◻(φ{F} → ◻φ{F})› for F
 using RN "strict-can:1[E]"[OF assms] "∀E" by blast
 ultimately AOT_have ‹◻(x[F] ≡ φ{F})› for F
 using "sc-eq-box-box:5" "qml:2"[axiom_inst, THEN "→E"] "→E" "&I" by metis
 AOT_hence ‹∀F ◻(x[F] ≡ φ{F})› by (rule GEN)
 AOT_hence ‹◻∀F (x[F] ≡ φ{F})› by (rule BF[THEN "→E"])
 AOT_thus ‹◻([A!]x & ∀F (x[F] ≡ φ{F}))›
 using b "KBasic:3" "≡S"(1) "≡E"(2) by blast
 

  "box-phi-a:2":
 assumes ‹RIGID_CONDITION(φ)›
 shows ‹y = \ιx(A!x & ∀F (x[F] ≡ φ{F})) → (A!y & e='font-size: 18px;'>∀F (y[F] ≡ φ{F}))›
 (rule "→I")
 AOT_assume ‹y = \ιx(A!x & ∀F (x[F] ≡ φ{F}))›
 AOT_hence ‹\A(A!y & ∀F (y[F] ≡ φ{F}))›
 using "actual-desc:2"[THEN "→E"] by fast
 AOT_hence abs: ‹\AA!y› and ‹\A∀F (y[F] ≡ φ{F})›
 using "Act-Basic:2" "&E" "≡E"(1) by blast+
 AOT_hence ‹∀F \A(y[F] ≡ φ{F})›
 by (metis "≡E"(1) "logic-actual-nec:3" "vdash-properties:1[2]")
 AOT_hence ‹\A(y[F] ≡ φ{F})› for F
 using "∀E" by blast
 AOT_hence ‹\Ay[F] ≡ \Aφ{F}› for F
 by (metis "Act-Basic:5" "≡E"(1))
 AOT_hence ‹y[F] ≡ φ{F}› for F
 using "sc-eq-fur:2"[THEN "→E",
 OF "strict-can:1[E]"[OF assms,
 THEN "∀E"(2)[where β=F], THEN RN]]
 by (metis "en-eq:10[1]" "≡E"(6))
 AOT_hence ‹∀F (y[F] ≡ φ{F})› by (rule GEN)
 AOT_thus ‹[A!]y & ∀F (y[F] ≡ φ{F})›
 using abs "&I" "≡E"(2) "oa-facts:8" by blast
 

  "box-phi-a:3":
 assumes ‹
java.lang.StringIndexOutOfBoundsException: Range [87, 86) out of bounds for length 105
 using "desc-nec-encode:2"
 "sc-eq-fur:2"[THEN "→E",
 OF "strict-can:1[E]"[OF assms,
 THEN "∀E"(2)[where β=F], THEN RN]]
java.lang.StringIndexOutOfBoundsException: Range [27, 10) out of bounds for length 115

  Nul : <>tau
 "df-null-uni:1": ‹Null(x) ≡_df A!x & ¬∃F x[F]›

  Universal :: ‹τ → φ› (‹Universal'(_')›)
 "df-null-uni:2": ‹Universal(x) ≡_df A!x & ∀F x[F]›

  "null-uni-uniq:1": ‹∃!x Null(x)›
  (rule "uniqueness:1"[THEN "≡_dfI"])
 AOT_obtain a where a_prop: ‹A!a & ∀F (a[F] ≡ ¬(F = F))›
 using "A-objects"[axiom_inst] "∃E"[rotated] by fast
 AOT_have a_null: ‹¬a[F]› for F
 proof (rule "raa-cor:2")
 AOT_assume ‹a[F]›
 AOT_hence ‹¬(F = F)› using a_prop[THEN "&E"(2)] "∀E" "≡E" by blast
 AOT_hence ‹F = F & ¬(F = F)› by (metis "id-eq:1" "raa-cor:3")
 AOT_thus ‹p & ¬p› for p by (metis "raa-cor:1")
 qed
 AOT_have ‹Null(a) & ∀β (Null(β) → β = a)›
 proof (rule "&I")
 AOT_have ‹¬∃F a[F]›
 using a_null by (metis "instantiation" "reductio-aa:1")
 AOT_thus ‹Null(a)›
 using "df-null-uni:1"[THEN "≡_dfI"] a_prop[THEN "&E"(1)] "&I" by metis
 next
 AOT_show ‹∀β (Null(β) → β = a)›
 proof (rule GEN; rule "→I")
 fix β
 AOT_assume a: ‹Null(β)›
 AOT_hence ‹¬∃F β[F]›
 using "df-null-uni:1"[THEN "≡_dfE"] "&E" by blast
 AOT_hence β_null: ‹¬β[F]› for F
 by (metis "existential:2[const_var]" "reductio-aa:1")
 AOT_have ‹∀F (β[F] ≡ a[F])›
 apply (rule GEN; rule "≡I"; rule CP)
 using "raa-cor:3" β_null a_null by blast+
 moreover AOT_have ‹A!β›
 using a "df-null-uni:1"[THEN "≡_dfE"] "&E" by blast
 ultimately AOT_show ‹β = a›
 using a_prop[THEN "&E"(1)] "ab-obey:1"[THEN "→E", THEN "→E"]
 "&I" by blast
 qed
 qed
 AOT_thus ‹∃α (Null(α) & ∀β (Null(β) → β = α))›
 using "∃I"(2) by fast
 

  "null-uni-uniq:2": ‹∃!x Universal(x)›
  (rule "uniqueness:1"[THEN "≡_dfI"])
 AOT_obtain a where a_prop: ‹A!a & ∀F (a[F] ≡ F = F)›
 using "A-objects"[axiom_inst] "∃E"[rotated] by fast
 AOT_hence aF: ‹a[F]› for F using "&E" "∀E" "≡E" "id-eq:1" by fast
 AOT_hence ‹Universal(a)›
 using "df-null-uni:2"[THEN "≡_dfI"] "&I" a_prop[THEN "&E"(1)] GEN by blast
 moreover AOT_have ‹∀β (Universal(β) → β = a)›
 proof (rule GEN; rule "→I")
 fix β
 AOT_assume ‹Universal(β)›
 AOT_hence abs_β: ‹A!β› and ‹β[F]› for F
 using "df-null-uni:2"[THEN "≡_dfE"] "&E" "∀E" by blast+
 AOT_hence ‹β[F] ≡ a[F]› for F
 using aF by (metis "deduction-theorem" "≡I")
 AOT_hence ‹∀F (β[F] ≡ a[F])› by (rule GEN)
 AOT_thus ‹β = a›
 using a_prop[THEN "&E"(1)] "ab-obey:1"[THEN "→E", THEN "→E"]
 "&I" abs_β by blast
 qed
 ultimately AOT_show ‹∃α (Universal(α) & ∀β (Universal(β) → β = α))›
 using "&I" "∃I" by fast
 

  "null-uni-uniq:3": ‹\ιx Null(x)↓›
 using "A-Exists:2" "RA[2]" "≡E"(2) "null-uni-uniq:1" by blast

  "null-uni-uniq:4": ‹\ιx Universal(x)↓›
 using "A-Exists:2" "RA[2]" "≡E"(2) "null-uni-uniq:2" by blast

  Null_object :: ‹κ_s› (‹a_\∅›)
 "df-null-uni-terms:1": ‹a_\∅ =_df \ιx Null(x)›

  Universal_object :: ‹κ_s› (‹a_V›)
 "df-null-uni-terms:2": ‹a_V =_df \ιx Universal(x)›

  "null-uni-facts:1": ‹Null(x) → ◻Null(x)›
  (rule "→I")
 AOT_assume ‹Null(x)›
 AOT_hence x_abs: ‹A!x› and x_null: ‹¬∃F x[F]›
 using "df-null-uni:1"[THEN "≡_dfE"] "&E" by blast+
 AOT_have ‹¬x[F]› for F using x_null
 using "existential:2[const_var]" "reductio-aa:1"
 by metis
 AOT_hence ‹◻¬x[F]› for F by (metis "en-eq:7[1]" "≡E"(1))
 AOT_hence ‹∀F ◻¬x[F]› by (rule GEN)
 AOT_hence ‹◻∀F ¬x[F]› by (rule BF[THEN "→E"])
 moreover AOT_have ‹◻∀F ¬x[F] → ◻¬∃F x[F]›
 apply (rule RM)
 by (metis (full_types) "instantiation" "cqt:2[const_var]"[axiom_inst]
 "→I" "reductio-aa:1" "rule-ui:1")
 ultimately AOT_have ‹◻¬∃F x[F]›
 by (metis "→E")
 moreover AOT_have ‹◻A!x› using x_abs
 using "oa-facts:2" "vdash-properties:10" by blast
 ultimately AOT_have r: ‹◻(A!x & ¬∃F x[F])›
 by (metis "KBasic:3" "&I" "≡E"(3) "raa-cor:3")
 AOT_show ‹◻Null(x)›
 by (AOT_subst ‹Null(x)› ‹A!x & ¬∃F x[F]›)
 (auto simp: "df-null-uni:1" "≡Df" r)
 

  "null-uni-facts:2": ‹Universal(x) → ◻Universal(x)›
  (rule "→I")
 AOT_assume ‹Universal(x)›
 AOT_hence x_abs: ‹A!x› and x_univ: ‹∀F x[F]›
 using "df-null-uni:2"[THEN "≡_dfE"] "&E" by blast+
 AOT_have ‹x[F]› for F using x_univ "∀E" by blast
 AOT_hence ‹◻x[F]› for F by (metis "en-eq:2[1]" "≡E"(1))
 AOT_hence ‹∀F ◻x[F]› by (rule GEN)
 AOT_hence ‹◻∀F x[F]› by (rule BF[THEN "→E"])
 moreover AOT_have ‹◻A!x› using x_abs
 using "oa-facts:2" "vdash-properties:10" by blast
 ultimately AOT_have r: ‹◻(A!x & ∀F x[F])›
 by (metis "KBasic:3" "&I" "≡E"(3) "raa-cor:3")
 AOT_show ‹◻Universal(x)›
 by (AOT_subst ‹Universal(x)› ‹A!x & ∀F x[F]›)
 (auto simp add: "df-null-uni:2" "≡Df" r)
 

  "null-uni-facts:3": ‹Null(a_\∅)›
 apply (rule "=_dfI"(2)[OF "df-null-uni-terms:1"])
 apply (simp add: "null-uni-uniq:3")
 using "actual-desc:4"[THEN "→E", OF "null-uni-uniq:3"]
 "sc-eq-fur:2"[THEN "→E",
 OF "null-uni-facts:1"[unvarify x, THEN RN, OF "null-uni-uniq:3"],
 THEN "≡E"(1)]
 by blast

  "null-uni-facts:4": ‹Universal(a_V)›
 apply (rule "=_dfI"(2)[OF "df-null-uni-terms:2"])
 apply (simp add: "null-uni-uniq:4")
 using "actual-desc:4"[THEN "→E", OF "null-uni-uniq:4"]
 "sc-eq-fur:2"[THEN "→E",
 OF "null-uni-facts:2"[unvarify x, THEN RN, OF "null-uni-uniq:4"],
 THEN "≡E"(1)]
 by blast

  "null-uni-facts:5": ‹a_\∅ ≠ a_V›
  (rule "=_dfI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"];
 rule "=_dfI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"];
 rule "≡_dfI"[OF "=-infix"];
 rule "raa-cor:2")
 AOT_obtain x where nullx: ‹Null(x)›
 by (metis "instantiation" "df-null-uni-terms:1" "existential:1"
 "null-uni-facts:3" "null-uni-uniq:3" "rule-id-df:2:b[zero]")
 AOT_hence act_null: ‹\ANull(x)›
 by (metis "nec-imp-act" "null-uni-facts:1" "→E")
 AOT_assume ‹\ιx Null(x) = \ιx Universal(x)›
 AOT_hence ‹\A∀x(Null(x) ≡ Universal(x))›
 using "actual-desc:5"[THEN "→E"] by blast
 AOT_hence ‹∀x \A(Null(x) ≡ Universal(x))›
 by (metis "≡E"(1) "logic-actual-nec:3" "vdash-properties:1[2]")
 AOT_hence ‹\ANull(x) ≡ \AUniversal(x)›
 using "Act-Basic:5" "≡E"(1) "rule-ui:3" by blast
 AOT_hence ‹\AUniversal(x)› using act_null "≡E" by blast
 AOT_hence ‹Universal(x)›
 by (metis RN "≡E"(1) "null-uni-facts:2" "sc-eq-fur:2" "→E")
 AOT_hence ‹∀F x[F]› using "≡_dfE"[OF "df-null-uni:2"] "&E" by metis
 moreover AOT_have ‹¬∃F x[F]›
 using nullx "≡_dfE"[OF "df-null-uni:1"] "&E" by metis
 ultimately AOT_show ‹p & ¬p› for p
 by (metis "cqt-further:1" "raa-cor:3" "→E")
 

  "null-uni-facts:6": ‹a_\∅ = \ιx(A!x & ∀F (x[F] ≡ F ≠ F))›
  (rule "ab-obey:1"[unvarify x y, THEN "→E", THEN "→E"])
 AOT_show ‹\ιx([A!]x & ∀F (x[F] ≡ F ≠ F))↓›
 by (simp add: "A-descriptions")
 
 AOT_show ‹a_\∅↓›
 by (rule "=_dfI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"])
 (simp add: "null-uni-uniq:3")
 
 AOT_have ‹\ιx([A!]x & ∀F (x[F] ≡ F ≠ F))↓›
 by (simp add: "A-descriptions")
 AOT_hence 1: ‹\ιx([A!]x & ∀F (x[F] ≡ F ≠ F)) = \ιx([A!]x & ∀F (x[F] ≡ F ≠ F))›
 using "rule=I:1" by blast
 AOT_show ‹[A!]a_\∅ & [A!]\ιx([A!]x & ∀F (x[F] ≡ F ≠ F))›
 apply (rule "=_dfI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"];
 rule "&I")
 apply (meson "≡_dfE" "Conjunction Simplification"(1)
 "df-null-uni:1" "df-null-uni-terms:1" "null-uni-facts:3"
 "null-uni-uniq:3" "rule-id-df:2:a[zero]" "→E")
 using "can-ab2"[unvarify y, OF "A-descriptions", THEN "→E", OF 1].
 
 AOT_show ‹∀F (a_\∅[F] ≡ \ιx([A!]x & ∀F (x[F] ≡ F ≠ F))[F])›
 proof (rule GEN)
 fix F
 AOT_have ‹¬a_\∅[F]›
 by (rule "=_dfI"(2)[OF "df-null-uni-terms:1", OF "null-uni-uniq:3"])
 (metis (no_types, lifting) "≡_dfE" "&E"(2) "∨I"(2) "∨E"(3) "∃I"(2)
 "df-null-uni:1" "df-null-uni-terms:1" "null-uni-facts:3"
 "raa-cor:2" "rule-id-df:2:a[zero]"
 "russell-axiom[enc,1].ψ_denotes_asm")
 moreover AOT_have ‹¬\ιx([A!]x & ∀F (x[F] ≡ F ≠ F))[F]›
 proof(rule "raa-cor:2")
 AOT_assume 0: ‹\ιx([A!]x & ∀F (x[F] ≡ F ≠ F))[F]›
 AOT_hence ‹\A(F ≠ F)›
 using "desc-nec-encode:2"[THEN "≡E"(1), OF 0] by blast
 moreover AOT_have ‹¬\A(F ≠ F)›
 using "≡_dfE" "id-act:2" "id-eq:1" "≡E"(2)
 "=-infix" "raa-cor:3" by blast
 ultimately AOT_show ‹\A(F ≠ F) & ¬\A(F ≠ F)› by (rule "&I")
 qed
 ultimately AOT_show ‹a_\∅[F] ≡ \ιx([A!]x & ∀F (x[F] ≡ F ≠ F))[F]›
 using "deduction-theorem" "≡I" "raa-cor:4" by blast
 qed
 

  "null-uni-facts:7": ‹a_V = \ιx(A!x & ∀F (x[F] ≡ F = F))›
  (rule "ab-obey:1"[unvarify x y, THEN "→E", THEN "→E"])
 AOT_show ‹\ιx([A!]x & ∀F (x[F] ≡ F = F))↓›
 by (simp add: "A-descriptions")
 
 AOT_show ‹a_V↓›
 by (rule "=_dfI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"])
 (simp add: "null-uni-uniq:4")
 
 AOT_have ‹\ιx([A!]x & ∀F (x[F] ≡ F = F))↓›
 by (simp add: "A-descriptions")
 AOT_hence 1: ‹\ιx([A!]x & ∀F (x[F] ≡ F = F)) = \ιx([A!]x & ∀F (x[F] ≡ F = F))›
 using "rule=I:1" by blast
 AOT_show ‹[A!]a_V & [A!]\ιx([A!]x & ∀F (x[F] ≡ F = F))›
 apply (rule "=_dfI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"];
 rule "&I")
 apply (meson "≡_dfE" "Conjunction Simplification"(1) "df-null-uni:2"
 "df-null-uni-terms:2" "null-uni-facts:4" "null-uni-uniq:4"
 "rule-id-df:2:a[zero]" "→E")
 using "can-ab2"[unvarify y, OF "A-descriptions", THEN "→E", OF 1].
 
 AOT_show ‹∀F (a_V[F] ≡ \ιx([A!]x & ∀F (x[F] ≡ F = F))[F])›
 proof (rule GEN)
 fix F
 AOT_have ‹a_V[F]›
 apply (rule "=_dfI"(2)[OF "df-null-uni-terms:2", OF "null-uni-uniq:4"])
 using "≡_dfE" "&E"(2) "df-null-uni:2" "df-null-uni-terms:2"
 "null-uni-facts:4" "null-uni-uniq:4" "rule-id-df:2:a[zero]"
 "rule-ui:3" by blast
 moreover AOT_have ‹\ιx([A!]x & ∀F (x[F] ≡ F = F))[F]›
 using "RA[2]" "desc-nec-encode:2" "id-eq:1" "≡E"(2) by fastforce
 ultimately AOT_show ‹a_V[F] ≡ \ιx([A!]x & ∀F (x[F] ≡ F = F))[F]›
 using "deduction-theorem" "≡I" by simp
 qed
 

  "aclassical:1":
 ‹∀R∃x∃y(A!x & A!y & x ≠ y & [λz [R]zx] = [λz [R]zy])›
 (rule GEN)
 fix R
 AOT_obtain a where a_prop:
 ‹A!a & ∀F (a[F] ≡ ∃y(A!y & F = [λz [R]zy] & 'font-size: 18px;'>¬y[F]))›
 using "A-objects"[axiom_inst] "∃E"[rotated] by fast
 AOT_have a_enc: ‹a[λz [R]za]›
 proof (rule "raa-cor:1")
 AOT_assume 0: ‹¬a[λz [R]za]›
 AOT_hence ‹¬∃y(A!y & [λz [R]za] = [λz [R]zy] & ¬y[λz [R]za])›
 by (rule a_prop[THEN "&E"(2), THEN "∀E"(1)[where τ="«[λz [R]za]¬"],
 THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
 THEN "≡E"(1), rotated])
 "cqt:2[lambda]"
 AOT_hence ‹∀y ¬(A!y & [λz [R]za] = [λz [R]zy] & ¬y[λz [R]za])›
 using "cqt-further:4" "vdash-properties:10" by blast
 AOT_hence ‹¬(A!a & [λz [R]za] = [λz [R]za] & ¬a[λz [R]za])›
 using "∀E" by blast
 AOT_hence ‹(A!a & [λz [R]za] = [λz [R]za]) → a[λz [R]za]›
 by (metis "&I" "deduction-theorem" "raa-cor:3")
 moreover AOT_have ‹[λz [R]za] = [λz [R]za]›
 by (rule "=I") "cqt:2[lambda]"
 ultimately AOT_have ‹a[λz [R]za]›
 using a_prop[THEN "&E"(1)] "→E" "&I" by blast
 AOT_thus ‹a[λz [R]za] & ¬a[λz [R]za]›
 using 0 "&I" by blast
 qed
 AOT_hence ‹∃y(A!y & [λz [R]za] = [λz [R]zy] & ¬y[λz [R]za])›
 by (rule a_prop[THEN "&E"(2), THEN "∀E"(1), THEN "≡E"(1), rotated])
 "cqt:2"
 then AOT_obtain b where b_prop:
 ‹A!b & [λz [R]za] = [λz [R]zb] & ¬b[λz [R]za]›
 using "∃E"[rotated] by blast
 AOT_have ‹a ≠ b›
 apply (rule "≡_dfI"[OF "=-infix"])
 using a_enc b_prop[THEN "&E"(2)]
 using "¬¬I" "rule=E" id_sym "≡E"(4) "oth-class-taut:3:a"
 "raa-cor:3" "reductio-aa:1" by fast
 AOT_hence ‹A!a & A!b & a ≠ b & [λz [R]za] = [λz [R]zb]›
 using b_prop "&E" a_prop "&I" by meson
 AOT_hence ‹∃y (A!a & A!y & a ≠ y & [λz [R]za] = [λz [R]zy])› by (rule "∃I")
 AOT_thus ‹∃x∃y (A!x & A!y & x ≠ y & [λz [R]zx] = [λz [R]zy])› by (rule "∃I")
 

  "aclassical:2":
 ‹∀R∃x∃y(A!x & A!y & x ≠ y & [λz [R]xz] = [λz [R]yz])›
 (rule GEN)
 fix R
 AOT_obtain a where a_prop:
 ‹A!a & ∀F (a[F] ≡ ∃y(A!y & F = [λz [R]yz] & 'font-size: 18px;'>¬y[F]))›
 using "A-objects"[axiom_inst] "∃E"[rotated] by fast
 AOT_have a_enc: ‹a[λz [R]az]›
 proof (rule "raa-cor:1")
 AOT_assume 0: ‹¬a[λz [R]az]›
 AOT_hence ‹¬∃y(A!y & [λz [R]az] = [λz [R]yz] & ¬y[λz [R]az])›
 by (rule a_prop[THEN "&E"(2), THEN "∀E"(1)[where τ="«[λz [R]az]¬"],
 THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
 THEN "≡E"(1), rotated])
 "cqt:2[lambda]"
 AOT_hence ‹∀y ¬(A!y & [λz [R]az] = [λz [R]yz] & ¬y[λz [R]az])›
 using "cqt-further:4" "vdash-properties:10" by blast
 AOT_hence ‹¬(A!a & [λz [R]az] = [λz [R]az] & ¬a[λz [R]az])›
 using "∀E" by blast
 AOT_hence ‹(A!a & [λz [R]az] = [λz [R]az]) → a[λz [R]az]›
 by (metis "&I" "deduction-theorem" "raa-cor:3")
 moreover AOT_have ‹[λz [R]az] = [λz [R]az]›
 by (rule "=I") "cqt:2[lambda]"
 ultimately AOT_have ‹a[λz [R]az]›
 using a_prop[THEN "&E"(1)] "→E" "&I" by blast
 AOT_thus ‹a[λz [R]az] & ¬a[λz [R]az]›
 using 0 "&I" by blast
 qed
 AOT_hence ‹∃y(A!y & [λz [R]az] = [λz [R]yz] & ¬y[λz [R]az])›
 by (rule a_prop[THEN "&E"(2), THEN "∀E"(1), THEN "≡E"(1), rotated])
 "cqt:2"
 then AOT_obtain b where b_prop:
 ‹A!b & [λz [R]az] = [λz [R]bz] & ¬b[λz [R]az]›
 using "∃E"[rotated] by blast
 AOT_have ‹a ≠ b›
 apply (rule "≡_dfI"[OF "=-infix"])
 using a_enc b_prop[THEN "&E"(2)]
 using "¬¬I" "rule=E" id_sym "≡E"(4) "oth-class-taut:3:a"
 "raa-cor:3" "reductio-aa:1" by fast
 AOT_hence ‹A!a & A!b & a ≠ b & [λz [R]az] = [λz [R]bz]›
 using b_prop "&E" a_prop "&I" by meson
 AOT_hence ‹∃y (A!a & A!y & a ≠ y & [λz [R]az] = [λz [R]yz])› by (rule "∃I")
 AOT_thus ‹∃x∃y (A!x & A!y & x ≠ y & [λz [R]xz] = [λz [R]yz])› by (rule "∃I")
 

  "aclassical:3":
 ‹∀F∃x∃y(A!x & A!y & x ≠ y & [λ [F]x] = [λ [F]y])›
 (rule GEN)
 fix R
 AOT_obtain a where a_prop:
 ‹A!a & ∀F (a[F] ≡ ∃y(A!y & F = [λz [R]y] & ¬y[F]))›
 using "A-objects"[axiom_inst] "∃E"[rotated] by fast
 AOT_have den: ‹[λz [R]a]↓› by "cqt:2[lambda]"
 AOT_have a_enc: ‹a[λz [R]a]›
 proof (rule "raa-cor:1")
 AOT_assume 0: ‹¬a[λz [R]a]›
 AOT_hence ‹¬∃y(A!y & [λz [R]a] = [λz [R]y] & ¬y[λz [R]a])›
 by (safe intro!: a_prop[THEN "&E"(2), THEN "∀E"(1)[where τ=‹«[λz [R]a]¬›],
 THEN "oth-class-taut:4:b"[THEN "≡E"(1)],
 THEN "≡E"(1), rotated] "cqt:2")
 AOT_hence ‹∀y ¬(A!y & [λz [R]a] = [λz [R]y] & ¬y[λz [R]a])›
 using "cqt-further:4" "→E" by blast
 AOT_hence ‹¬(A!a & [λz [R]a] = [λz [R]a] & ¬a[λz [R]a])› using "∀E" by blast
 AOT_hence ‹(A!a & [λz [R]a] = [λz [R]a]) → a[λz [R]a]›
 by (metis "&I" "deduction-theorem" "raa-cor:3")
 AOT_hence ‹a[λz [R]a]›
 using a_prop[THEN "&E"(1)] "→E" "&I"
 by (metis "rule=I:1" den)
 AOT_thus ‹a[λz [R]a] & ¬a[λz [R]a]› by (metis "0" "raa-cor:3")
 qed
 AOT_hence ‹∃y(A!y & [λz [R]a] = [λz [R]y] & ¬y[λz [R]a])›
 by (rule a_prop[THEN "&E"(2), THEN "∀E"(1), OF den, THEN "≡E"(1), rotated])
 then AOT_obtain b where b_prop: ‹A!b & [λz [R]a] = [λz [R]b] & ¬b[λz [R]a]›
 using "∃E"[rotated] by blast
 AOT_have 1: ‹a ≠ b›
 apply (rule "≡_dfI"[OF "=-infix"])
 using a_enc b_prop[THEN "&E"(2)]
 using "¬¬I" "rule=E" id_sym "≡E"(4) "oth-class-taut:3:a"
 "raa-cor:3" "reductio-aa:1" by fast
 AOT_have a: ‹[λ [R]a] = ([R]a)›
 apply (rule "lambda-predicates:3[zero]"[axiom_inst, unvarify p])
 by (meson "log-prop-prop:2")
 AOT_have b: ‹[λ [R]b] = ([R]b)›
 apply (rule "lambda-predicates:3[zero]"[axiom_inst, unvarify p])
 by (meson "log-prop-prop:2")
 AOT_have ‹[λ [R]a] = [λ [R]b]›
 apply (rule "rule=E"[rotated, OF a[THEN id_sym]])
 apply (rule "rule=E"[rotated, OF b[THEN id_sym]])
 apply (rule "identity:4"[THEN "≡_dfI", OF "&I", rotated])
 using b_prop "&E" apply blast
 apply (safe intro!: "&I")
 by (simp add: "log-prop-prop:2")+
 AOT_hence ‹A!a & A!b & a ≠ b & [λ [R]a] = [λ [R]b]›
 using 1 a_prop[THEN "&E"(1)] b_prop[THEN "&E"(1), THEN "&E"(1)]
 "&I" by auto
 AOT_hence ‹∃y (A!a & A!y & a ≠ y & [λ [R]a] = [λ [R]y])› by (rule "∃I")
 AOT_thus ‹∃x∃y (A!x & A!y & x ≠ y & [λ [R]x] = [λ [R]y])› by (rule "∃I")
 

  aclassical2: ‹∃x∃y (A!x & A!y & x ≠ y & ∀F ([F]x ≡ [F]y))›
  -
 AOT_have ‹∃x ∃y ([A!]x & [A!]y & x ≠ y &
 [λz [λxy ∀F ([F]x ≡ [F]y)]zx] =
 [λz [λxy ∀F ([F]x ≡ [F]y)]zy])›
 by (rule "aclassical:1"[THEN "∀E"(1)[where τ="«[λxy ∀F ([F]x ≡ [F]y)]¬"]])
 "cqt:2"
 then AOT_obtain x where ‹∃y ([A!]x & [A!]y & x ≠ y &
 [λz [λxy ∀F ([F]x ≡ [F]y)]zx] =
 [λz [λxy ∀F ([F]x ≡ [F]y)]zy])›
 using "∃E"[rotated] by blast
 then AOT_obtain y where 0: ‹([A!]x & [A!]y & x ≠ y &
 [λz [λxy ∀F ([F]x ≡ [F]y)]zx] =
 [λz [λxy ∀F ([F]x ≡ [F]y)]zy])›
 using "∃E"[rotated] by blast
 AOT_have ‹[λz [λxy ∀F ([F]x ≡ [F]y)]zx]x›
 by (auto intro!: "β←C"(1) "cqt:2"
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3"
 "oth-class-taut:3:a" "universal-cor")
 AOT_hence ‹[λz [λxy ∀F ([F]x ≡ [F]y)]zy]x›
 by (rule "rule=E"[rotated, OF 0[THEN "&E"(2)]])
 AOT_hence ‹[λxy ∀F ([F]x ≡ [F]y)]xy›
 by (rule "β→C"(1))
 AOT_hence ‹∀F ([F]x ≡ [F]y)›
 using "β→C"(1) old.prod.case by fast
 AOT_hence ‹[A!]x & [A!]y & x ≠ y & ∀F ([F]x ≡ [F]y)›
 using 0 "&E" "&I" by blast
 AOT_hence ‹∃y ([A!]x & [A!]y & x ≠ y & ∀F ([F]x ≡ [F]y))› by (rule "∃I")
 AOT_thus ‹∃x∃y ([A!]x & [A!]y & x ≠ y & ∀F ([F]x ≡ [F]y))› by (rule "∃I"(2))
 

  "kirchner-thm:1":
 ‹[λx φ{x}]↓ ≡ ◻∀x∀y(∀F([F]x ≡ [F]y) → (φ{x} ≡ φ{y}))›
 (rule "≡I"; rule "→I")
 AOT_assume ‹[λx φ{x}]↓›
 AOT_hence ‹◻[λx φ{x}]↓› by (metis "exist-nec" "vdash-properties:10")
 moreover AOT_have ‹◻[λx φ{x}]↓ → ◻∀x∀y(∀F([F]x ≡ [F]y) → (φ{x} ≡ φ{y}))›
 proof (rule "RM:1"; rule "→I"; rule GEN; rule GEN; rule "→I")
 AOT_modally_strict {
 fix x y
 AOT_assume 0: ‹[λx φ{x}]↓›
 moreover AOT_assume ‹∀F([F]x ≡ [F]y)›
--> --------------------

--> maximum size reached

--> --------------------