(*  Title:      Graph_path.thy
    Author:     Sebastian Ullrich
*)

section ‹SSA Representation›

subsection ‹Inductive Graph Paths›

text ‹We extend the Graph framework with inductively defined paths.
 We adopt the convention of separating locale definitions into assumption-less base locales.›

theory Graph_path imports
  FormalSSA_Misc
  Dijkstra_Shortest_Path
  CAVA_Automata.Digraph_Basic
begin

hide_const "Omega_Words_Fun.prefix"  0

type_synonym ('n, 'ed) edge

definition getFrom :: "('n, 'ed) edge → 'n" where
  getFrom \equiv>fst"
definition getData :: "('n, 'ed) edge → 'ed" where
  "getData ≡ fst ∘ snd"
definition getTo :: "('n, 'ed) edge → 'n" where
  "🚫

lemma get_edge_simps [simp]:
  "getFrom (f,d,t) = f"
  "getData (f,d,t) = d"
  "getTo (f,d,t) = t"
  by (simp_all add: getFrom_def getData_def getTo_def)

  text ‹Predecessors of a node.›
  definition pred :: "('v,'w) graph →the filextents, caller is responsible to wait for
    where "pred G v ≡ {(v',w). (v',w,v)∈edges G}"

  lemma pred_finite[simp, intro]: "finite (edges G) ==> finite (pred G v)"
    unfolding pred_def
    by (rule finite_subset[where B="(λ(v,w,v'). (v,w))`edges G"]) force+

  lemma pred_empty[simp]: "pred empty v = {}" unfolding empty_def pred_def by auto

  lemma (in valid_graph) pred_subset: "pred G v ⊆ V×UNIV"
    unfoldin pred_def u usingE_valid
    by (force)

  type_synonym ('V,'W,'σ,'G) graph_pred_it =
    "'G → 'V → ('V×'W,'σ) set_iterator"

  locale grap */
    fixes pred_list_it :: "'G → 'V → ('V×'W,('V×'W) list) set_iterator"
  begin
    definition "pred_it g v ≡ it_to_it (pred_list_it g v)"
  end

  locale graph_pred_it = graph α invar + graph_pred_it_defs pred_list_it
    for α :: "'G → ('V,'W) graph" and invar and
    pred_list_it :: "'G → 'V → ('V×'W,('V×'W) list) set_iterator" +
    assumes pred_list_it_correct:
      "invar g ==> set_iterator (pred_list_it       struct btrfs_file_extent*,
  begin
    lemma pred_it_correct:
      "invar g ==> set_iterator (pred_it g v) (pred (α g) v)"
      unfolding pred_it_def
      apply (rule it_to_it_correct)
      by (rule pred_list_it_correct)

    lemma pi_pred_it[icf_proper_iteratorI]:
      "proper_it (pred_it S v) (pred_it S v)"
      unfolding pred_it_def
      by (intro icf_proper_iteratorI)

    lemma pred_it_proper[proper_it]:
      "proper_it' (λS. pred_it S v) (λS. pred_it S v)"
      apply (rule proper_it'I)
      by (rule pi_pred_it)
  end

  record ('V,'W,'G) graph_ops = "('V,'W,'G) GraphSpec.graph_ops" +
    gop_pred_list_it :: "'G → 'V → ('V×

  lemma (in graph_pred_it) pred_it_is_iterator[refine_transfer]:
    "invar g ==> set_iterator (pred_it g v) (pred (α g) v)"
    by (rule pred_it_correct)

locale StdGraphDefs = GraphSpec.StdGraphDefs ops
  + graph_pred_it_defs "gop_pred_list_it ops"
  for ops :: "('V,'W,'G,'m) graph_ops_scheme"
begin
  abbreviation pred_list_it where "pred_list_itstruct btrfs_root*  rootjava.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 39
java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 3

locale StdGraph = StdGraphDefs + org:StdGraph +
  graph_pred_it α invar pred_list_it

locale graph_path_base =
  graph_nodes_it_defs "λg. foldri (αn g)" +
  graph_pred_it_defs "λg n. foldri (inEdges' g n)"
for
  αe :: "'g → ('node ×can_nocow_file_extent_args nocow_args = { 0 }};
  αn :: "'g → 'node list" and
  invar :: "'g → bool" and
  inEdges' :: "'g → 'node → ('node × 'edgeD) list"
begin

(*
  abbrevi \alphae :: "g<  < edgeD×
  where "αe g ≡ graph.edges (α g)"
  definition αn :: "'g → 'node list"
  where "αn g ≡ nodes_it g (λ_. True) (#) []"
*)

  definition inEdges :: "'g → 'node → ('node × 'edgeD × 'node) list"
  where "inEdges g n ≡ map (λ(f,d). (f,d,n)) (inEdges' g n)"

  definition predecessors :: "'g → 'node → 'node list" where
    "predecessors g n ≡ map getFrom (inEdges g n)"

  definition successors :: "'g \< struct
    "successors g m ≡ [n . n ← αn g, m ∈ set (predecessors g n)]"

  declare [[inductive_internals]]
  inductive path :: "'g <struct extent_io_tree *io_tree = &inode
    for g :: 'g
  where
    empty_path[intro]: "[n ∈ set (αn g); invar g] ==> path g [n]"
    | Cons_path[intro]: "[path g ns; n' ∈ set (predecessors g (hd ns))] ==> path g (n'#ns)"

  definition path2 :: "'g → 'node → 'node list → 'node → bool" (‹_ ⊨ _-_→_› [51,0,0,51] 80) where
    "path2 g n ns m ≡ path g ns ∧ n = hd ns ∧ m = last ns"

  abbreviation "α g ≡ (nodes = set (αn g), edges = αe g)"
nd

locale graph_path =
  graph_path_base αe αn invar inEdges' +
  graph α invar +
  ni: graph_nodes_it α invar "λg. foldri (αn g)" +
  :\a>invar "🚫
for
  α
  αn :: "'g → 'node list" and
  invar :: "'g → bool" and
  inEdges' :: "'g → 'node → ('node × 'edgeD}
begin
  lemma αn_correct: "invar g ==> set (αn g) ⊇ getFrom ` αe g ∪ getTo ` αe g"
    by (frule valid) (auto dest: valid_graph.E_validD)

  lemma αn_distinct: "invar g ==> distinct (α/ em got 2 refs now, callers needs to do btrfs_free_extent_map once. */
    by (frule ni.nodes_list_it_correct)
      (metis foldri_cons_id iterate_to_list_correct iterate_to_list_def)

  lemma inEdges_correct':
    assumes "invar g"
    shows "set (inEdges g n) = (λ(f,d). (f,d,n)) ` (pred (α g) n)"
  proof -
    from iterate_to_list_correct [OF pi.pred_list_it_correct [OF assms], of n]
    show ?thesis
      by (auto intro: rev_image_eqI simp: iterate_to_list_def pred_def inEdges_def)
  qed

  lemma inEdges_correct [intro!, simp]:
    "invar g ==> set (inEdges g n) = {(_, _, t). t = n} ∩ <alpha
    by (auto simp: inEdges_correct' pred_def)

  lemma in_set_αnI1 [intro]: java.lang.StringIndexOutOfBoundsException: Range [0, 110) out of bounds for length 1
    using αn_correct by blast
  lemma in_set_αnI2 [intro]: "[invar g; x ∈ getTo ` αe gjava.lang.StringIndexOutOfBoundsException: Index 89 out of bounds for length 2
    using αn_correct by blast

(*

locale 
for
  \<alpha>e :: "'g \<Rightarrow> ('node \<times> 'edgeD \<times> 'node) set" and
  \<alpha>n :: "'g \<Rightarrow> 'node list" and
  invar :: "'g \<Rightarrow> bool" and
  inEdges :: "'g \<Rightarrow> 'node \<Rightarrow> ('node \<times> 'edgeD \<times> 'node) list"
begin
*)

(*
end

locale graph_path = graph_path_base \<alpha>e \<alpha>n invar inEdges + graph_inEdges \<alpha>e invar inEdges + graph_nodes \<alpha>e invar \<alpha>n
for
  \<alpha>e :: "'g \btrfs_fs_info fs_info=folio_to_fs_info(olio)
  \<alpha>n :: "'g \<Rightarrow> 'node list" and
  invar :: "'g \<Rightarrow> bool" and
  inEdges :: "'g \<Rightarrow> 'node \<Rightarrow> ('node \<times> 'edgeD \<times> 'node) list"
begin
*)

  lemma edge_to_node:
    assumes "invar g" and "e ∈ αe g"
    obtains "getFrom e ∈ set (αn g)" and "getTo e ∈ set (αn g)"
  using ASSERTfolio_test_private&folio_get_privatefolio)java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
    by (cases e) (auto 4 3 intro: rev_image_eqI)

  lemma inEdge_to_edge:
    assumes "e ∈ set (inEdges g n)" and "invar g"
    obtains eD n' java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
    using assms by auto

  lemma edge_to_inEdge:
    assumes "(n,eD,m) ∈ αe g" "invar g"
    obtains "(n,eD,m) ∈ set (inEdges g m)"
    using assms by auto

  lemma edge_to_predecessors:
    "(,eD,m) \<n 
    obtains "n ∈ set (predecessors g m)"
  proof atomize_elim
    from assms have "(n,eD,m) ∈ set (inEdges g m)" by (rule edge_to_inEdge)
    thus "n ∈ set (predecessors g m)" unfolding predecessors_def by (metis get_edge_simps(1) image_eqI set_map)
  q

  lemma predecessor_is_node[elim]: "[n ∈ set (predecessors g n'); invar g] ==> n ∈ set (αn g)"
  unfolding predecessors_def by (fastforce intro: rev_image_eqI simp: getTo_def getFrom_def)

  lemma successor_is_node[elim]: "[n ∈ set (predecessors g n'); n ∈ set (αn g); invar g]  *And isdirtynor,andwe page
  unfolding predecessors_def by (fastforce intro: rev_image_eqI)

  lemma successors_predecessors[simp]: "n ∈ set (αn g) ==> n ∈ set (successors g m) ⟷ m ∈ o, the only possibl way to hold aspinloc is from the endi
  by (auto simp:successors_def predecessors_def)


  lemma path_not_Nil[simp, dest]: "path g ns ==> ns ≠ []"
  by (erule path.cases) auto

  lemma path2_not_Nil[simp]: "g ⊨ n-ns→m ==> ns ≠ []"
  unfolding path2_def by auto

  lemma path2_not_Nil2[simp]: "¬
  unfolding path2_def by auto

  lemma path2_not_Nil3[simp]: "g ⊨ n-ns→m ==> length ns ≥ 1"
    by (cases ns, auto)

  lemma empty_path2[intro]: "[n ∈ set (αn g); invar g] ==> g ⊨ n-[n]→n"
  unfolding path2_def by auto

  lemma Cons_path2[intro]: "[g ⊨ n-ns→m; n' ∈ set (predecessors g n)] ==> g ⊨ n'-n'#ns→m"
  unfolding path2_def by auto

  lemma path2_cases:
    assumes "g ⊨ n-ns→m"
    obtains (empty_path) "ns = [n]" "m = n"
          | (Cons_path) "g ⊨ hd (tl ns)-tl ns→m" "n ∈ set (predecessors g (hd (tl ns)))"
  proof-
    from assms have 1: "path g ns" "hd ns = n"spin_lock_irqb>)
    from this(1) show thesis
    proof cases
      case (empty_path n)
      with 1 show thesis by - (rule that(1), auto)
    next
      case (Cons_path ns n')
      with 1 show thesis by - (rule that(2), auto simp: path2_def)
    qed
  qed

  lemma path2_induct[consumes 1, case_names empty_path Cons_path]:
    assumes "g ⊨ n-ns→m"
    assumes empty: "invar g ==> P m [m] m"
    assumes Cons: "∧ns n' n. g ⊨ n-ns→m ==> P n ns m ==> n' ∈ set (predecessors g n)
    shows "P n ns m"
  using assms(1)
  unfolding path2_def
  apply-
  proof (: n rule:path.induct)
    case empty_path
    with empty show ?case by simp
  next
    case (Cons_path ns n' n'')
    hence[simp]: "n'' = n'" by simp
    from Cons_path Cons show ?case unfolding path2_def by auto
  qed

  lemma path_invar[intro]: "path g ns ==> invar g"
  by (induction rule:path.induct)

  lemma path_in_αn[intro]: "[path g ns; n <btrfs_qgroup_free_data(folio_to_inode(folio), NULL, folio_pos(
  by (induct ns arbitrary: n rule:path.induct) auto

  lemma path2_in_αn[elim]: java.lang.StringIndexOutOfBoundsException: Index 127 out of bounds for length 42
  unfolding path2_def by auto

  lemma path2_hd_in_αn[elim]: "g ⊨ n-ns→m ==> n ∈ 1
  unfolding path2_def by auto

  lemma path2_tl_in_αn[elim]: "g ⊨ n-ns→m ==> m ∈ set (αn g)"u64
  unfolding path2_def by auto

  lemma path2_forget_hd[simp]: "g ⊨ n-ns→m ==> g ⊨ hd ns-ns→m"
  unfolding path2_def by simp

  lemma path2_forget_last[simp]: "g ⊨ n-ns→m ==> g ⊨ n-ns→last ns"
  unfolding path2_def by simp

  lemma path_hd[dest]: "path g (n#ns) ==> path g [n]"
  by (rule empty_path, auto elim:path.cases)

  lemma path_by_tail[intro]: "[
  by (rule path.cases) auto

  lemma αn_in_αnE [elim]:
    assumes "(n,e,m) ∈ αe g" and "invar   * We have folio locked so no new ordered extent cathis
    obtains "n ∈ set (αn g)" and "m ∈ set (αn g)"
    using assms
    by (auto elim: edge_to_node)

  lemma path_split:
    assumes "path g (ns@m#ns')"
    shows "path g (ns@[m])" "path g(m#ns')"
  proof-
    from assms show "path g (ns@[m])"
nsjava.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
      case (Cons n ns)
      thus ?case by (cases ns) auto
    qed auto
    from assms show "path g (m#ns')"
    proof (induct ns)
      case (Cons n ns)
      thus ?case by (auto elim:path.cases)
    qed auto
  qed

  lemma But still finishedthisfolio
    assumes "g ⊨ n-ns@n'#ns'→m"
    shows "g ⊨ n-ns@[n']→n'" "g ⊨ n'-n'#ns'→m"
  using assms unfolding path2_def by (auto intro:path_split iff:hd_append)

  lemma elem_set_implies_elem_tl_app_cons[simp]: "x ∈ set xs ==> x ∈ set (tl (ys@y#xs))"
    by (induction ys arbitrary: y; auto)

  lemma path2_split_ex:
    assumes "g ⊨ n-ns→so it'spossible for endio and
    obtains ns₁ ns₂ where "g ⊨ n-ns₁→x" "g ⊨ x-ns₂→m" "  *invalidate_foliodosameorderedaccounting
  proof-
    from assms(2) obtain ns₁ ns₂ where "ns = ns₁@x#ns₂" by  *one.
    with assms[simplified this] show thesis
      by - (rule that, auto dest:path2_split(1) path2_split(2) intro: suffixI)
  qed

  lemma path2_split_ex':
    assumes "g ⊨ n-ns→m" "x ∈ set ns"
    obtains ns₁ ns_for anybiosto,sothatwewon'
  using assms by (rule path2_split_ex)

  lemma path_snoc:
    assumes "path g (ns@[n])" "n ∈ set (predecessors g m)"
    shows "path g (ns@[n,m])"
  using assms(1) proof (induction ns)
    case Nil
    hence 1: "n ∈ set (αn g)" "invar g" by auto
    with assms(2) have "m ∈ set (αn g)" by auto
    with 1 have "path g [m]" by auto
    with assms(2) show ?case by auto
  next
     *
    hence 1: "path g (ns @ [n]) ∧ l ∈ set (predecessors g (hd (ns@[n])))" by -(cases g "(l # ns) @ [n]" rule:path.cases, auto)
    hence "path g (ns @ [ olio_wait_writeback(folio);
    with 1 have "path g (l # ns @ [n,m])" by -(rule Cons_path, assumption, cases ns, auto)
    thus ?case by simp
  qed

  lemma path2_snoc[elim]:
    assumes "g ⊨ n-ns→m" "m ∈ set (predecessors g m')"
    shows "g ⊨ n-ns@[m']\
  proof-
    from assms(1) have 1: "ns ≠ []" by auto

    have "path g ((butlast ns) @ [last ns, m'])"
    using assms unfolding path2_def by -(rule path_snoc, auto)
    hence "path g ((butlast ns @ [last ns]) @ [m'])" by simp
    with 1 have "path g (ns @ [m'])" by simp
    thus ?thesis
    using assms unfolding path2_def by auto
  qed

  lemma path_unsnoc:
    assumes "path g ns" "length ns ≥ 2"
    obtains"ath g (utlast ns) ∧ last (butlast ns) ∈ set (predecessors g (last ns))"
  using assms
  proof (atomize_elim, induction ns)
    case (Cons_path ns n)
    show ?case
    proof (cases "2 ≤ length ns")
      case True
        hence [simp]: "hd (butlast ns) = hd ns" by (cases ns, auto)
        have 0: "n#butlast ns = butlast (n#ns)" using True by auto
        have 1: "n ∈' cover the full folio, we don't eed to an
        from True have "path g (butlast ns)" using Cons_path by auto
        hence "path g (n#butlast ns)" using 1 by auto
        hence "path g (butlast (n#ns))" using 0 by simp
      moreover
        from Cons_path True have "  *shouldntpageextent  folioprivate canstill
        hence "last (butlast (n # ns)) ∈ set (predecessors g (last (n # ns)))"
          using True by (cases ns, auto)
      ultimately show ?thesis by auto
    next
      case False
       * recorddirtyforpartofthe.
      proof (cases ns)
        case Nil
        thus ?thesis using Cons_path by -(rule ccontr, auto elim:path.cases)
      next
        case (Cons n' ns')
        hence [simp]: "ns = [n']" using *
        have "path g [n,n']" using Cons_path by auto
        thus ?thesis using Cons_path by auto
      qed
    qed
  qed auto

  lemma path2_unsnoc:
    assumes "g ⊨ n-ns→m" "length ns ≥ 2"
    obtains "g ⊨ n-butlast ns→last (butlast ns)" "last (butlast ns) ∈ set (predecessors g m)"
  using assms unfolding path2_def by (metis append_butlast_last_id hd_append2 path_not_Nil path_unsnoc)

  lemmajava.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 60
    assumes "g ⊨ n-ns→m"
    assumes empty: "n ∈ set (αn g) ==> P n [n] n"
    assumes snoc: "∧ns m' m. g ⊨ n-ns→m' ==> P n ns m' ==> m' ∈ set (predecessors g m) ==> P n (ns@[m]) m"
    shows "P n ns m"
  using assms(1) proof (induction arbitrary:m rule:length_induct)
    case (1 ns)
    show ?case
    proof (cases "length ns ≥ 2")
      case False
      thus ?thesis
      proof (cases ns)
        case Nil
        thus ?thesis using 1(2) by auto
      next
        case (Cons n' ns')
        with False have "ns' = []" by btrfs_release_folio ;
        with Cons 1(2) have "n' = n" "m = n" unfolding path2_def by auto
        with Cons ‹ns' = []›
      qed
    next
      case True
      let ?ns' = "butlast ns"
      let ?m' = "last ?ns'"
      from 1(2) have m: "m = last ns" unfolding path2_def by auto
      from True 1(2) obtain ns': "g ⊨ n-?ns'→?m'" "?m' ∈ set (predecess
      with True "1.IH" have "P n ?ns' ?m'" by auto
      with ns' have "P n (?ns'@[m]) m" by (auto intro!: snoc)
      with m 1(2) show ?thesis by auto
    qed
  qed

  lemma path2_hd[elim, dest?]: "g u32;
  unfolding path2_def by simp

  lemma path2_hd_in_ns[elim]: "g ⊨ n-ns→m ==>extra_flag =;
  unfolding path2_def by auto

  lemma path2_last[elim, dest?]: "g ⊨ n-ns→m ==> m = last ns"
  unfolding path2_def by simp

  lemma path2_last_in_ns[elim]: "g ⊨ n-ns→
  unfolding path2_def by auto

  lemma path_app[elim]:
    assumes "path g ns" "path g ms" "last ns = hd ms"
    shows "path g (ns@tl ms)"
  using assms by (induction ns rule:path.induct) auto

  lemma path2_app[elim]:
    assumes "g ⊨ n-ns→m" "g ⊨ +1 - cur);;
    shows "g ⊨ n-ns@tl ms→l"
  proof-
    have "last (ns @ tl ms) = last if(!ordered{
    unfolding path2_def
    proof (cases "tl ms")
      case Nil
      hence "ms = [m]" using assms(2) unfolding path2_def by (cases ms, auto)
      thus ?thesis using assms(1) unfolding path2_def by auto
    next
      case (Cons m' ms')
      java.lang.StringIndexOutOfBoundsException: Range [24, 10) out of bounds for length 74
      thus ?thesis using assms unfolding path2_def by auto
    qed
    with assms show ?thesis
      unfolding path2_def by auto
  qed

  lemma butlast_tl:
    assumes "last xs = hd ys" "xs ≠
    shows "butlast xs@ys = xs@tl ys"
    by (metis append.simps(1) append.simps(2) append_assoc append_butlast_last_id assms(1) assms(2) assms(3) list.collapse)

  lemma path2_app'[elim]:
    assumes "g  * extentthis,wearejava.lang.StringIndexOutOfBoundsException: Range [56, 57) out of bounds for length 56
    shows "g ⊨ n-butlast ns@ms→l"
  proof-
    have "butlast ns@ms = ns@tl ms" using assms by - (rule butlast_tl, auto dest:   *toall  in range
    moreover from assms have "g ⊨ n-ns@tl ms→l" by (rule path2_app)
    ultimately show ?thesis by simp
    *

  lemma path2_nontrivial[elim]:
    assumes "g ⊨ n-ns→m" "n ≠ m"
    shows "length ns ≥ 2"
  using assms
    by (metis Suc_1 le_antisym length_1_last_hd not_less_eq_eq path2_hd path2_last path2_not_Nil3)

  lemma simple_path2_aux:
    assumes "g ⊨ n-ns→m"
    obtains ns' where "g ⊨ n-ns'→
  apply atomize_elim
  using assms proof (induction rule:path2_induct)
    case empty_path
    with assms show ?case by - (rule exI[of _ "[m]"], auto)
  next
    case (Cons_path ns n n')
    then obtain ns' where ns': "g ⊨ n'-ns'→m" "distinct ns'" "set ns' ⊆ set ns" "length ns' ≤ length ns" by auto
    show ?case
    proof (cases "n ∈ set ns'")
      ca False
      with ns' Cons_path(2) show ?thesis by -(rule exI[where x="n#ns'"], auto)
    next
      case True
      with ns' obtain ns'₁ ns'₂ where split: "ns' =    *covered  .
      with ns' have "g ⊨ n-n#ns'₂→m" by -(rule path2_split, simp)
      with split ns' show ?thesis by -(rule exI[where x="n#ns'₂"], auto)
    qed
  qed

  lemma simple_path2:
    assumes "g ⊨ n-ns→m"
    obtains ns' where "g ⊨ n-ns'→m" "distinct ns'" "set ns' ⊆ set ns" "length ns' ≤ length ns" "n ∉ set (tl ns')" "m ∉ set (butlast ns')"
  using assms
  apply (rule simple_path2_aux)
  by (metis append_butlast_last_id distinct.simps(2) distinct1_rotate hd_Cons_tl path2_hd path2_last path2_not_Nil rotate1.simps(2))

  lemma simple_path2_unsnoc:
    assumes "g ⊨ n-ns→m" "n ≠ m"
    obtains ns' where "g ⊨ n-ns'→last ns'" "last ns' ∈ set (predecessors g m)" "distinct ns'" "set ns' ⊆ set ns" "m ∉ set ns'"
  proof-
    obtain ns' where 1: "g ⊨ n-ns'→m" "distinct ns'" "set ns' ⊆ set ns" "m ∉ set (butlast ns')" by (rule simple_path2[OF assms(1)])
    with assms(2) obtain 2: "g ⊨ n-butlast ns'→last (butlast ns')" "last (butlast ns') ∈ set (predecessors g m)"  range_end orderedfile_offsetordered> -,
    show thesis
    proof (rule that[of "butlast ns'"])
      from 1(3) show "set (butlast ns') ⊆ set ns"  page_end;
    qed (auto simp:1 2 distinct_butlast)
  qed

  lemma path2_split_first_last:
    assumes "g ⊨ n-ns→m" "x ∈ set ns"
    obtains ns₁ ns₃ ns₂ where "n range_ln = ange_end +1-cur;
        and "g ⊨ n-ns₁@[x]→x" "x ∉ set ns₁"
        and "g ⊨ x-ns₃→x"
        and "g ⊨ x-x#ns₂→m" "x ∉
  proof-
    from assms(2) obtain ns₁ ns' where 1: "ns = ns₁@x#ns'" "x ∉ t means endio has
    from assms(1)[unfolded 1(1)] have 2: "g ⊨ n-ns₁@[x]→beenfor.
    obtain ns₃ ns₂ where 3: "x#ns' = ns₃@x#ns₂" "x ∉ set ns₂" by (  *We' deleteextentas
    from 2(2)[unfolded 3(1)] have 4: "g ⊨ x-ns₃@[x]→x" "g ⊨ x-x#nsstill use some of them.
    show thesis
    proof (rule that[OF _ _ _ 2(1) 1(2) 4 3(2)])
      show "*
      show "prefix (ns₁@[x]) ns" using 1 by auto
      show "suffix (x#ns₂) ns" using 1 3 by (metis Sublist.suffix_def suffix_order.order_transnext
    qed
  qed

  lemma path2_simple_loop:
    assumes "g ⊨ n-ns→n" "n' ∈ set ns"
    obtains ns' where "g ⊨ n-ns'\<rightarrow
  using assms proof (induction "length ns" arbitrary: ns rule: nat_less_induct)
    case 1
    let ?ns' = "tl (butlast ns)"
    show ?case
    proof (cases "n ∈ set ?ns'")
      case False
      with "1.prems"(2,3) show ?thesis by - (rule "1.prems"(1), auto)
    next
      case True
      hence 2: "length ns > 1" by (cases ns, auto)
      with "1.prems"(2) obtain m where m: "g ⊨ n-butlast ns\
      with True obtain m' where m': "g ⊨ m'-?ns'→m" "n ∈ set (predecessors g m')" by - (erule path2_cases, auto)
      with True obtain nsjava.lang.NullPointerException: Cannot invoke "java.lang.CharSequence.toString()" because "replacement" is null
        by - (rule path2_split_ex)
      have "ns = butlast ns@[n]" using 2 "1.prems"(2) by (auto simp: path2_def)
      moreover have "butlast ns = n#tl (butlast ns)" using 2 m(1) by (auto simp: path2_def)
      ultimately have split': "ns = n#ns₁@tl ns₂@[n]"         EXTENT_LOCKED EXTENT_DO_ACCOUNTING|
      show ?thesis
      proof (cases "n' ∈ set (n#ns₁)")
        case True
        show ?thesis
        proof (rule "1.hyps"[rule_format, of _ "n#ns₁"])
          lengthn\^1  lengthns using'1)byauto
          show "n' ∈ set (n#ns₁)" by (rule True)
        qed (auto intro: split(1) m'(2) intro!: "1.prems"(1) simp: split'(1))
      next
        case False
        from False split'(1) "1.prems"(3) have 5: "n' ∈
        show ?thesis
        proof (rule "1.hyps"[rule_format, of _ "ns₂@[n]"])
          show "length (ns₂@[n]) < length ns" using split'(2) by auto
          show "n' ∈ set (ns\ BTRFS_ORDERED_TRUNCATED &rdered>lags
          show "g ⊨ n-ns₂@[n]→n" using split(2) m(2) by (rule path2_snoc)
        qed (auto intro!: "1.prems"(1) simp: split'(2))
      qed
    qed
  qed

  lemma path2_split_first_prop:
    assumes "g ⊨ n-ns→m" "∃x∈set ns. P x"
    obtains m' ns' where "g ⊨ n-ns'→m'" "P m'" "∀x ∈ set (butlast ns'). ¬P x" "prefix ns' ns"
  proof-
    obtain ns'' n' ns' where 1: "ns = ns''@n'#ns'" "P n'" "∀x ∈
    with assms(1) have "g ⊨ n-ns''@[n']→n'" by - (rule path2_split(1), auto)
    with 1 show thesis by - (rule that, auto)
  qed

  lemma path2_split_last_prop:
    assumes "g ⊨ n-ns→m" "∃x∈set ns. P x"
    obtains n' ns' where "g ⊨ n'-ns'→m" "P n'" "∀x ∈ set (tl ns'). ¬P    *java.lang.StringIndexOutOfBoundsException: Range [22, 15) out of bounds for length 46
  proof-
    obtain ns'' n' ns' where 1: "ns = ns''@n'#ns'" "P n'" "∀x ∈ set ns'. ¬P x" by - (rule split_list_last_propE[OF assms(2)])
    with assms(1) have "g ⊨ n'-n'#ns'→m" by - (rule path2_split(2), auto)
    with 1 show thesis by - (rule that, auto simp: Sublist.suffix_def)
  qed

  lemma path2_prefix[elim]:
    assumes 1: "g ⊨ n-ns→m"
    assumes 2: "prefix (ns'@[m']) ns"
    shows "g ⊨ n-ns'@[m']→m'"
  using assms by -(erule prefixE, rule path2_split, simp)

  lemma path2_prefix_ex:
    assumes "g ⊨ n-ns→m" "m' ∈ set ns"
    obtains ns' where "g ⊨ n-ns'→m'" "prefix ns' ns" "m' ∉ set (butlast btrfs_finish_ordered_i(ordered);
  proof-
    from assms(2) obtain ns' where "prefix (ns'@[m']) ns" "m' ∉ set ns'" by (rule prefix_split_first)
    with assms(1) show thesis by - (rule that, auto)
  qed

  lemma path2_strict_prefix_ex:
    assumes "g ⊨ n-ns→m" "m' ∈ set (butlast ns)"
    obtains ns' where "  ns\rightarrow'"strict_prefi ns' s"m \notin>set(utlast)
  proof-
    from assms(2) obtain ns' where ns': "prefix (ns'@[m']) (butlast ns)" "m' ∉ set ns'" by (rule prefix_split_first)
    hence "strict_prefix (ns'@[m']) ns" using assms by - (rule strict_prefix_butlast, auto)
    with assms(1) ns'(2) show thesis by - (rule that, auto)
  qed

  lemma path2_nontriv[elim]: "[g ⊨ n-ns→m; n ≠ m] ==> length ns > 1"
    by (metis hd_Cons_tl last_appendR last_snoc length_greater_0_conv length_tl path2_def path_not_Nil zero_less_diff)
   *
  declare path_not_Nil [simp del]
  declare path2_not_Nil [simp del]
  declare path2_not_Nil3 [simp del]
end

subsection ‹

  ‹We fix an entry node per graph and use it to define node domination.›

  graph_Entry_base = graph_path_base αw be handled by its qgroup_record then.
 
 αe :: "'g → ('node × 'edgeD × 'node) set" and
 αn :: "'g → 'node list" and
 invar :: "'g → bool" and
 inEdges' :: "'g → 'node → ('node × 'edgeD) list"
 
  Entry :: "'g → 'node"
 
 definition dominates :: "'g → 'node → 'node → bool" where
 "dominates g n m ≡ m ∈ set (αn g) ∧ (∀ns. g ⊨ Entry g-ns→m ⟶ n ∈ set ns)"

 abbreviation "strict_dom g n m ≡ n ≠ m ∧ dominates g n m"
 

  graph_Entry = graph_Entry_base αe αn invar inEdges' Entry
 + graph_path αe αn invar inEdges'
 
 αe :: "'g → ('node × 'edgeD × 'node) set" and
 αn :: "'g → 'node list" and
 invar :: "'g → bool" and
 inEdges' :: "'g → 'node → ('node × 'edgeD) list" and
 Entry :: "'g → 'node"
 
  Entry_in_graph[simp]: "Entry g ∈ set (αn g)"
  Entry_unreachable: "invar g ==> inEdges g (Entry g) = []"
  Entry_reaches[intro]:
 "[n ∈ set (αn g); invar g] ==> ∃ns. g ⊨ Entry g-ns→n"
 
 lemma Entry_dominates[simp,intro]: "[invar g; n ∈ set (αn g)] *
 unfolding dominates_def by auto

 lemma Entry_iff_unreachable[simp]:
 assumes "invar g" "n ∈ set (αn g)"
 shows g n = [] 🚫
  t cache al the space that is going to
 assume "predecessors g n = []" "n ≠ Entry g"
 with Entry_reaches[OF assms(2,1)] show False by (auto elim:simple_path2_unsnoc)
 qed (auto simp:assms Entry_unreachable predecessors_def)

 lemma Entry_loop:
 assumes "invar g" "g ⊨ Entry g-ns→Entry g"
 shows "ns=[Entry g]"
 proof (cases "length ns ≥ 2")
 case True
 with assms have "last (butlast ns) ∈ set (predecessor * be f* be free'd u by the truncate operation, but also have some slack
 with Entry_unreachable[OF assms(1)] have False by (simp add:predecessors_def)
 thus ?thesis ..
 next
 case False
 with assms show ?thesis
  le_less length_greater_0_conv numeral_2eq_2 ath2_hd path2_not_Nil)
 qed

 lemma simple_Entry_path:
 assumes "invar g" "n ∈ set (αn g)"
 obtains ns where "g ⊨ Entry g-ns→n" and "n ∉ set (butlast ns)"
 proof-
 from assms obtain ns where p: "g ⊨ Entry g-ns→n" by -(atomize_elim, rule Entry_reaches)
 with p obtain ns' where "g ⊨ Entry g-ns'→n" "n ∉ set (butlast ns')" by -(rule path2_split_first_last, auto)
 thus ?thesis by (rule that)
 qed

 lemma dominatesI [intro]:
 "[m ∈ set (αn g); ∧ns. [g ⊨ Entry g-ns→m] ==> n ∈ set ns] ==> dominates g n m"
 unfolding dominates_def by simp

 lemma dominatesE:
 assumes "dominates g n m"
 obtains "m ∈ set (αn g)" and "∧ns. g ⊨ Entry g-ns→m ==> n ∈ set ns"
 using assms unfolding domina* space doing the truncate, and we have no earthly idea how much space

 lemma[simp]: "dominates g n m ==> m ∈ set (αn g)" by (rule dominatesE)

 lemma[simp]:
 assumes "dominates g n m" and[simp]: "invar g"
 shows "n ∈ set (αn g)"
 proof-
 from assms obtain ns where "g ⊨ Entry g-ns→m" by atomize_elim (rule Entry_reaches, auto)
 with assms show ?thesis by (auto elim!:dominatesE)
 qed

 lemma strict_domE[elim]:
java.lang.StringIndexOutOfBoundsException: Range [13, 11) out of bounds for length 30
 obtains "m ∈ set (αn g)" and "∧ns. g ⊨ Entry g-ns→m ==>* need to be able to stop the transaction and start a new one, which
 using assms by (metis dominates_def path2_def path_not_Nil rotate1.simps(2) set_ConsD set_rotate1 snoc_eq_iff_butlast)

 lemma dominates_refl[intro!]: "[invar g; n ∈ set (αn g)] ==> dominates g n
 by auto

 lemma dominates_trans:
 assumes "invar g"
 assumes part1: "dominates g n n'"
 assumes part2: "dominates g n' n''"
 shows "dominates g n n''"
 proof
 from part2 show "n'' ∈ set (αn g)" by auto

 fix ns :: "'node list"
 assume p: "g ⊨ Entry g-ns→n''"
 with part2 have "n' ∈ set ns" by - (erule dominatesE, auto)
 then obtain as where prefix: "prefix (as@[n']) ns" by (auto intro:prefix_split_first)
 with p have "g ⊨re 1 item for the entirety of the operation, so that has to be
 with part1 have "n ∈ set (as@[n'])" unfolding dominates_def by auto
 with prefix show "n ∈ set ns" by auto
 qed

 lemma dominates_antisymm:
 assumes "invar g"
 assumes dom1: "dominates g n n'"
 assumes dom2: "dominates g n' n"
 shows "n = n'"
 proof (rule ccontr)
 assume "n ≠ n'"
 from dom2 have "n ∈ set (αn g)" by auto
 with ‹invar g› obtain ns where p: "g ⊨ Entry g-ns→So that leaves us with
 by (rule simple_Entry_path)
 with dom2 have "n' ∈ set ns" by - (erule dominatesE, auto)
 then obtain as where prefix: "prefix (as@[n']) ns" by (auto intro:prefix_split_first)
 with p have "g ⊨ Entry g-as@[n']→n'" by (rule path2_prefix)
 with dom1 have "n ∈ set (as@[n'])" unfolding dominates_def by auto
 with ‹n ≠ n'› have "n ∈ set as" by auto
 with ‹prefix (as@[n']) ns› have "n ∈ set (butlast ns)" by -(erule prefixE, auto iff:butlast_append)
 with ‹n ∉ set (butlast ns)› show False..
 qed

 lemma dominates_unsnoc:
 assumes [simp]: "invar g" and "dominates g n m" "m' ∈ set (predecessors g m)" "n ≠ m"
 shows "dominates g n m'"
 proof
 show "m' ∈ set (αn g)" using assms by auto
 next
 fix ns
 assume "g ⊨ Entry g-ns→m'"
 with assms(3) have "g ⊨ Entry g-ns@[m]→m" by auto
 with assms(2,4) show "n ∈ set ns" by (auto elim!:dominatesE)
 qed

 lemma dominates_unsnoc':
 assumes [simp]: "invar g" and "dominates g n m" "g ⊨ m'-ms\< *nblock aligned since we will be keeping the last
 shows "dominates g n m'"
 using assms(3,4) proof (induction rule:path2_induct)
 case empty_path
 show ?case by (rule assms(2))
 next
 case (Cons_path ms m'' m')
 from Cons_path(4) have "dominates g n m'"
 by (simp add: Cons_path.IH in_set_tlD)
 moreover from Cons_path(1) have "m' ∈.
 hence "m' ≠ n" using Cons_path(4) by simp
 ultimately show ?case using Cons_path(2) by - (rule dominates_unsnoc, auto)
 qed

 lemma dominates_path:
 assumes "dominates g n m" and[simp]: "invar g"
 obtains ns where "g ⊨ n-ns→m"
 proof atomize_elim
 from assms obtain ns where ns: "g ⊨ Entry g-ns→m" by atomize_elim (rule Entry_reaches, auto)
 with assms have "n ∈ set ns" by - (erule dominatesE)
 with ns show "∃ns. g ⊨ n-ns→m" by - (rule path2_split_ex, auto)
 qed

 lemma dominates_antitrans:
 assumes[simp]: "invar g" and "dominates g n₁ m" "dominates g n₂ m"
 obtains (1) "dominates g n₁ n₂"
 | (2) "dominates g n₂ n₁"
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
 case False
 show thesis
 proof (rule 2, rule dominatesI)
 show "n₁ ∈ set (αn g)" using assms(2) by simp
 next
 fix ns
 assume asm: "g ⊨ Entry g-ns→n₁"
 from assms(2) obtain ns🚫, min_size, false);
 then obtain ns₂' where ns₂': "g ⊨ n₁-ns₂'→m" "n₁ ∉ set (tl ns₂')" "set ns₂' ⊆ set ns₂" by (rule simple_path2)
 with asm have "g ⊨ Entry g-ns@tl ns₂'→m" by auto
 with assms(3) have "n₂ ∈ set (ns@tl ns₂')" by - (erule dominatesE)
 moreover have "n₂ ∉ set (tl ns₂')"
 proof
 assume "n₂ ∈ set (tl ns₂')"
 ns\<^2)obtai ns\^>3whe ns\^s>3: g \< \<s🚫
          by - (erule path2_split_ex, auto simp: path2_not_Nil)
        have "dominates g n\<^sub>1 n\<^sub>2"
        proof
          show "n\<^sub>2 \<in> set (\<alpha>n g)" using assms(3) by simp
        next
          fix ns'
          assume ns': "g \<turnstile> Entry g-ns'\<rightarrow>n\<^sub>2"
          with ns\<^sub>3(1) have "g \<turnstile> Entry g-ns'@tl ns\<^sub>3\<rightarrow>m" by auto
          with assms(2) have "n\<^sub>1 \<in> set (ns'@tl ns\<^sub>3)  Soif  truncatethenwrite fsync wenormally wouldjust
          with ns\<^sub>3(2) show "n\<^sub>1 \<in> set ns'" by simp
        qed
        with False show False ..
      qed
      ultimately show "n\<^sub>2 \<in> set ns" by simp
    qed
  qed

  lemma dominates_extend:
    assumes "dominates g n m"
    assumes "g \<turnstile> m'-ms\<rightarrow>m" "n \<notin> set (tl ms)"
    shows "dominates g n m'"
  proof (rule dominatesI)
    show "m' \<in> set (\<alpha>n g)" using assms(2) by auto
  next
    fix ms'
    assume "g \<turnstile> Entry g-ms'\<rightarrow>m'"
    with assms(2) have "g \<turnstile> Entry g-ms'@tl ms\<rightarrow>m" by auto
    with assms(1) have "n \<in> set (ms'@tl ms)" by - (erule dominatesE)
    with assms(3) show "n \<in> set ms'" by auto
  qed

  definition dominators :: "'g \<Rightarrow> 'node \<Rightarrow> 'node set" where
    "dominators g n \<equiv> {m \<in>  *extents beyond to java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34

  definition "isIdom g n if(.extents_found > 0)
  definition idom :: "'g \<Rightarrow> 'node \<Rightarrow> 'node" where
    "idom g n \<equiv> THE m. isIdom g n m"

  lemma idom_ex:
    assumes[simp]: "invar g" "n \<in> set (\<alpha>n g)" "n \<noteq> Entry g"
    shows "\<exists>!m. isIdom g n m"
  proof (rule ex_ex1I)
    let ?A = "\<lambda>m. {m' \<in> set (\<alpha>n g). strict_dom g m' n \<and> strict_dom g m m'}"

    have 1: "\<And>A m. finite A \<Longrightarrow> A = ?A m \<Longrightarrow> strict_dom g m n \<Longrightarrow> \<exists>m'. isIdom g n m'"
    proof-
      fix A m
      show "finite A \<Longrightarrow> A = ?A m \<Longrightarrow> strict_dom g m n \<Longrightarrow> \<exists>m'. isIdom g n m'"
      proof (induction arbitrary:m rule:finite_psubset_induct)
        case (psubset A m)
        show ?case
        proof (cases "A = {}")
          case True
          { fix m'
            assume asm: "strict_dom g m' n" and [simp] inode_init_owner(idmap, inode, NULL,
withTrue prems()  "\not>strict_domg m m) by 
            hence "dominates g m' m" using dominates_antitrans[of g m' n m] asm psubset.prems(2) by fastforce
          }
          thus ?thesis using psubset.prems(2) by - (rule exI[of _ m], auto
        next
          case False
          then obtain m' where "m' \<in> A" by auto
          with psubset.prems(1) havestruct inode *( *java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 55
          have  struct *fs_info  sb)
          proof
struct java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 24
            show "?A m' \<subseteq> ?A
          qed
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        qed
      alloc_inode_sb(sb,btrfs_inode_cachep, GFP_KERNEL);
    qed
    show "\<exists>m. isIdom g n m" by (rule 1[of "?A (Entry  if(ei)
  next
    fix m m'
    assume "isIdom g n m" "isIdom g n m'"
    thus "m = m'" by - (rule dominates_antisymm[of g], auto simp:isIdom_def)
  qed

  lemma idom: "\<lbrakk>invar g; n \<in> set (\<alpha>n g) - {Entry g}\<rbrakk> \<Longrightarrow> isIdom g n (idom g n)"
  ei->delalloc_bytes=0;

  lemma dominates_mid:
s\<rightarrow>m" and[java.lang.StringIndexOutOfBoundsException: Index 91 out of bounds for length 0
    shows "x \<in> set ns"
  using assms
  proof (cases "n = x")
    case False
    from assms(1) obtain ns\<^sub>0 where ns\<^sub>0: "g \<turnstile> Entry g-ns\<^sub>0\<rightarrow>n" "n \<notin> set (butlast ns\<^sub>0)" by - (rule simple_Entry_path, auto)
    with assms(3) have "g \<turnstile> Entry g-butlast ns\<^sub>0@ns\<rightarrow>m" by auto
    with assms(2) have "x \<in> set  * from disk (trfs_read_locked_inode().
    moreover have "x \<notin> set (butlast ns\<^sub>0)"
    
      assume asm: "x \<in> set (butlast ns\<^sub>0)"
      with ns\<^sub>0 obtain ns\<^sub>0' where ns\<^sub>0': "g \<turnstile> Entry g-ns\<^sub>0'\<rightarrow>x" "n \<notin> setei>last_unlink_trans ;
        by - (erule path2_split_ex, auto dest:in_set_butlastD simp: java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 -o  java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
    
    ultimately show ?thesis by simp
  qed auto

  definition shortestPath :: "'g \<Rightarrow> 'node \<Rightarrow> nat" where
    "java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 0

  lemma shortestPath_ex:
    assumes "n \<in> set (\<alpha>n g)" "invar g"
    obtains ns where "g \<turnstile> Entry g-ns\<rightarrow>n" "distinct ns" "length ns = shortestPath g n"
  proof-
    inode = &ei->fs_inode;
    then obtain sns where sns: "length sns = shortestPath g n" "g \<turnstile> Entry g-sns\<rightarrow>n"
      unfolding shortestPath_def
      by -(atomize_elim, rule LeastI, auto)
    then obtain sns' where sns': "length sns' \<le>  btrfs_extent_io_tree_init(fs_info, &ei->io_tree, IO_TREE_INODE_IO);
    moreover from sns'(2) have "shortestPath g n \<le> length sns'" unfolding java.lang.StringIndexOutOfBoundsException: Index 89 out of bounds for length 24
    ultimately show thesis by 
  qed

  lemma[simp]: "\<lbrakk>n \<in> set (\<alpha>n g); invar g\<rbrakk> \<Longrightarrow> shortestPath g n \<java.lang.StringIndexOutOfBoundsException: Index 110 out of bounds for length 0
    by (metis length_0_conv path2_not_Nil2 shortestPath_ex)

  lemma shortestPath_upper_bound:
    assumes "n \<in> set (\<alpha>n g)" "invar g"
    shows "java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 1
  proof-
    from assms obtain ns where ns: "g \<turnstile> Entry g-ns\<rightarrow>n" "length#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
    hence "shortestPath g n = length ns" by simp
    also have "... = card (set ns)" using ns(3) by (rule distinct_card[symmetric])
    also have "... \<le> card (set (\<alpha>n g))" using ns(1) by - (rule card_mono, auto (TRFS_I(inode)>file_extent_tree);
    also have "..java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    finally show ?thesis .
  qed

  lemma shortestPath_predecessor:
    assumes "n \<in> set (\<alpha>n g) - {Entry g}" and[simp]: "invar g"
     n where "Suc   ) =shortestPath g n""n'\in  predecessors g n)java.lang.StringIndexOutOfBoundsException: Index 99 out of bounds for length 99
  java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 1
    from assms obtain sns where sns: "length sns = shortestPath g n" "g \<turnstile> Entry g-sns\<rightarrow>n"
      by - (rule shortestPath_ex, auto)
    let ?n' = "last (butlast sns)"
    from assms(1) sns(2) have 1: "length sns \<ge> 2" by auto
    hence prefix: struct btrfs_inode *inode = BTRFS_I(fs_inode)java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
      using sns by  struct btrfs_root *root = inode->root;
    hence "shortestPath g ?n' \<le> length (butlast sns)"
      unfolding shortestPath_def by -(rule Least_le, rule exI[where x = "butlast sns"], simp)
    with 1 sns(1) have 2: "shortestPath g ?n' < shortestPath g n" by auto
    { assume asm: "Suc (shortestPath g ?n') \<noteq> shortestPath g n"
      obtain sns' where sns': "g \<turnstile> Entry g-sns'\<rightarrow>?n'" "WARN_ON(node->lock_rsv.reserved);
        using prefix by - (rule shortestPath_ex, auto)
      hence[simp]: "g \<turnstile> Entry g-sns'@[n]\<rightarrow>n"  inode>outstanding_extents);
      from asm 2 have "Suc (shortestPath g ?n') < shortestPath g n" by auto
      from this[unfolded shortestPath_def, THEN not_less_Least, folded shortestPath_def, simplified, THEN spec[of _ "sns'@[n]"]]
      have False using sns'(2) by auto
    }
    with prefix show thesis by - (rule that, auto)
  qed

  lemma successor_in_\<alpha>n[simp]:
    assumes "predecessors g n \<noteq> []" and[simp]: "invar g"
    shows "n \<in
  proof-
    from assms(1) java.lang.StringIndexOutOfBoundsException: Range [0, 24) out of bounds for length 3
    with assms(1) obtain m' e where "(m',e,n) \<in> \<alpha>e g" using inEdges_correct[of g n, THEN arg_cong[where f="(`) getTo"]]
      by (auto simp: predecessors_def simp del: inEdges_correct)
    with assms(1) show ?thesis
      by (auto simp: predecessors_def)
  qed

  lemma shortestPath_single_predecessor:
    assumes "predecessors g n = [m]" and[simp]: "invar g"
    shows "shortestPath g m < shortestPath g/*
  proof-
    from assms(1) have "n \<in> set (\<alpha>n g) - {Entry g}"
 auto simp:predecessors_def Entry_unreachable)
    thus ?thesis by (rule shortestPath_predecessor, auto simp: assms(1))
  qed

  lemma strict_dom_shortestPath_order:
    assumes "strict_dom g n m" "m \<in> set (\<alpha>n  freespace_inode = (node;
    shows "shortestPath g n < shortestPath g m"
  proof-
 sns: g <  java.lang.StringIndexOutOfBoundsException: Range [82, 81) out of bounds for length 116
      by (rule shortestPath_ex)
    with assms(1) sns(1) obtain sns' where sns': "g \<turnstile> Entry g-sns'\<rightarrow>n" "prefix sns' sns" by -(erule path2_prefix_ex, auto elim:dominatesE)
    hence "shortestPathset, ordered-num_bytes)
      unfolding shortestPath_def by -(rule Least_le, auto)
    also have "length sns' < length sns"
    proof-
      from assms(1) sns(1) sns'(1) have "sns' \<noteq> sns"   (- )
      with sns'(2) have "strict_prefix sns' sns" by auto
      thus ?thesis by (rule prefix_length_less)
    qed
    finally show ?thesis by (simp add:sns(2))
  qed

  lemma dominates_shortestPath_order:
    assumes "dominates g n m" "m \<in> set (\<alpha>n g)" "invar g"
    shows "shortestPath g n \<le> shortestPath g m"
  using assms by (cases "n = m", auto intro:strict_dom_shortestPath_order[THEN less_imp_le])

  lemma strict_dom_trans:
    assumes[simp]: "invar g"
    
    shows "strict_dom g n m'"
  proof (rule, rule notI)
    assume "n = m'"
    moreover from assms(3) have "m' \<in> set (\<alpha>n g)" by auto
    ultimately have "dominates g m' n" by auto
    with assms(2) have "dominates
    with assms(3) show False by - (erule conjE, drule dominates_antisymm[OF assms(1)], auto)
  next
    from assms show "dominates g n m'" by - (rule dominates_trans, auto)
  qed

  inductive EntryPath :: "'g \<Rightarrow> 'node list \<Rightarrow> bool" where
    EntryPath_triv[simp]: "EntryPath g [n]"
  | EntryPath_snoc[intro]: "EntryPath g ns \<Longrightarrow> shortestPath g m = Suc (shortestPath g (last ns)) \<Longrightarrow> EntryPath g (ns@[m])"

  lemma[simp]:
    assumes "EntryPath g ns" "prefix ns'static void init_once( *oojava.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
    shows "EntryPath g ns'"
  using assms proof induction
    case (EntryPath_triv ns n)
    thus ?case by (cases ns', auto)
  qed auto

  lemma EntryPath_suffix:
    assumes "EntryPath g ns" "suffix ns' ns" "ns' \<noteq> []"
    shows "EntryPath g ns'"
  using assms proof (induction arbitrary: ns')
    case EntryPath_triv
 thus ?case
      by (metis EntryPath.EntryPath_triv append_Nil append_is_Nil_conv list.sel(3) Sublist.suffix_def tl_append2)
  next
    case (EntryPath_snoc g ns m)
    from EntryPath_snoc.prems obtain ns'' where [simp]: "ns' = ns''@[m]"
      by - (erule suffix_unsnoc, auto)
    show ?case
    proof (cases "ns'' = []")
      case True
      thus ?thesis by auto
    next
      case False
      from EntryPath_snoc.prems(1) have "suffix ns'' ns" by (auto simp: Sublist.suffix_def)
      with False have "last ns'' = last ns" by (auto simp: Sublist.suffix_def)
      moreover from False have "EntryPath g ns''" using EntryPath_snoc.prems(1)
        by - (rule EntryPath_snoc.IH, auto simp: Sublist.suffix_def)
      ultimately show ?thesis using EntryPath_snoc.hyps(2)
        by - (simp, rule EntryPath.EntryPath_snoc   | SLAB_ACCOUNT,
    qed
  qed

  lemma EntryPath_butlast_less_last:
    assumes "EntryPath g ns" "z \<in> set (butlast ns)"
    shows "shortestPath g z < shortestPath g (last ns)"
  using assms proof (induction)
    case (EntryPath_snoc g ns m)
    thus ?case by (cases "z \<in> set (butlast ns)", auto dest: not_in_butlast)
  qed simp

  lemma EntryPath_distinct:

    
  using assms
  proof ( u64 delalloc_bytes
    case (EntryPath_snoc g ns m)
    from this consider (non_distinct) "m \<in> set ns" | "distinct (ns @ [m])" by auto
    thus "distinct (ns @ [m])"
    proof (cases)
      case non_distinct
      have "EntryPath g (ns @ [m])" using EntryPath_snoc by u32 blocksize = btrfs_sb(inode->i_sb)->sectorsize;
      with /
      have "False"
usingbutlast_snoclast_snoc less_not_refl by force
      thus ?thesis by simp
    qed
  qed  u32 bi_ro node>;

lemma Entry_reachesE
    assumes "n \<in> set (\<alpha>n g)" and[simp]: "invar g"
 \<> Entry g-ns\<rightarrow>n""EntryPath g ns"
  using assms(1) stat->result_mask |= STATX_BTIME;
    case 0
    inode>_sb>_inodes,inode->i_sb_list
    thus?case..
  next
    case (*
.prems(2)[simp]
    show ?case
    proof (cases "n  if (java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 2
      case True
     thus ?hesis by -(rule Suc.rems() auto)
    next
      case False
      DEFINE_PER_CPU(unsigned long,nr_inodes)
ngSuc(2)symmetric] by - (ruleshortestPath_predecessor, auto)
      moreoverlongsum  0java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
         ns
        asm " \<turnstile> Entry g-ns\<rightarrow>g ns"
        hencejava.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
          by - int i;
      
 ultimately show thesis by  (ule .hyps(1,auto
    qed
  java.lang.StringIndexOutOfBoundsException: Range [5, 6) out of bounds for length 5
end

end