Impressum AOT_NaturalNumbers.thy Sprache: Isabelle

(*<*)
theory AOT_NaturalNumbers
 imports AOT_PossibleWorlds AOT_ExtendedRelationComprehension
 abbrevs one-to-one = ‹₁_-₁›
 and onto = ‹_o_n_t_o›
begin
(*>*)

section‹Natural Numbers›

AOT_define CorrelatesOneToOne :: ‹τ → τ → τ → φ› (‹_ |: _ ₁_-₁⟷ _›)
 "1-1-cor": ‹R |: F ₁_-₁⟷ G ≡_d_f R↓ & F↓ & G↓ &
∀x ([F]x → ∃!y([G]y & [R]xy)) &
∀y ([G]y → ∃!x([F]x & [R]xy))›

AOT_define MapsTo :: ‹τ → τ → τ → φ› (‹_ |: _ ⟶ _›)
 "fFG:1": ‹R |: F ⟶ G ≡_d_f R↓ & F↓ & G↓ & ∀x ([F]x → ∃!y([G]y & [R]xy))›

AOT_define MapsToOneToOne :: ‹τ → τ → τ → φ› (‹_ |: _ ₁_-₁⟶ _›)
 "fFG:2": ‹R |: F ₁_-₁⟶ G ≡_d_f
R |: F ⟶ G & ∀x∀y∀z (([F]x & [F]y & [G]z) → ([R]xz & [R]yz ='font-size: 18px;'>→ x = y))›

AOT_define MapsOnto :: ‹τ → τ → τ → φ› (‹_ |: _ ⟶_o_n_t_o _›)
 "fFG:3": ‹R |: F ⟶_o_n_t_o G ≡_d_f R |: F ⟶ G & ∀y ([G]y → ∃x([F]x & [R]xy))›

AOT_define MapsOneToOneOnto :: ‹τ → τ → τ → φ› (‹_ |: _ ₁_-₁⟶_o_n_t_o _›)
 "fFG:4": ‹R |: F ₁_-₁⟶_o_n_t_o G ≡_d_f R |: F ₁_-₁⟶ G & R |: F ⟶_o_n_t_o G›

AOT_theorem "eq-1-1": ‹R |: F ₁_-₁⟷ G ≡ R |: F ₁_-₁⟶_o_n_t_o G›
proof(rule "≡I"; rule "→I")
 AOT_assume ‹R |: F ₁_-₁⟷ G›
 AOT_hence A: ‹∀x ([F]x → ∃!y([G]y & [R]xy))›
 and B: ‹∀y ([G]y → ∃!x([F]x & [R]xy))›
 using "≡_d_fE"[OF "1-1-cor"] "&E" by blast+
 AOT_have C: ‹R |: F ⟶ G›
 proof (rule "≡_d_fI"[OF "fFG:1"]; rule "&I")
 AOT_show ‹R↓ & F↓ & G↓›
 using "cqt:2[const_var]"[axiom_inst] "&I" by metis
 next
 AOT_show ‹∀x ([F]x → ∃!y([G]y & [R]xy))› by (rule A)
 qed
 AOT_show ‹R |: F ₁_-₁⟶_o_n_t_o G›
 proof (rule "≡_d_fI"[OF "fFG:4"]; rule "&I")
 AOT_show ‹R |: F ₁_-₁⟶ G›
 proof (rule "≡_d_fI"[OF "fFG:2"]; rule "&I")
 AOT_show ‹R |: F ⟶ G› using C.
 next
 AOT_show ‹∀x∀y∀z ([F]x & [F]y & [G]z → ([R]xz & [R]yz → x = y))›
 proof(rule GEN; rule GEN; rule GEN; rule "→I"; rule "→I")
 fix x y z
 AOT_assume 1: ‹[F]x & [F]y & [G]z›
 moreover AOT_assume 2: ‹[R]xz & [R]yz›
 ultimately AOT_have 3: ‹∃!x ([F]x & [R]xz)›
 using B "&E" "∀E" "→E" by fast
 AOT_show ‹x = y›
 by (rule "uni-most"[THEN "→E", OF 3, THEN "∀E"(2)[where β=x],
 THEN "∀E"(2)[where β=y], THEN "→E"])
 (metis "&I" "&E" 1 2)
 qed
 qed
 next
 AOT_show ‹R |: F ⟶_o_n_t_o G›
 proof (rule "≡_d_fI"[OF "fFG:3"]; rule "&I")
 AOT_show ‹R |: F ⟶ G› using C.
 next
 AOT_show ‹∀y ([G]y → ∃x ([F]x & [R]xy))›
 proof(rule GEN; rule "→I")
 fix y
 AOT_assume ‹[G]y›
 AOT_hence ‹∃!x ([F]x & [R]xy)›
 using B[THEN "∀E"(2), THEN "→E"] by blast
 AOT_hence ‹∃x ([F]x & [R]xy & ∀β (([F]β & [R]βy) → β = x))›
 using "uniqueness:1"[THEN "≡_d_fE"] by blast
 then AOT_obtain x where ‹[F]x & [R]xy›
 using "∃E"[rotated] "&E" by blast
 AOT_thus ‹∃x ([F]x & [R]xy)› by (rule "∃I")
 qed
 qed
 qed
next
 AOT_assume ‹R |: F ₁_-₁⟶_o_n_t_o G›
 AOT_hence ‹R |: F ₁_-₁⟶ G› and ‹R |: F ⟶_o_n_t_o G›
 using "≡_d_fE"[OF "fFG:4"] "&E" by blast+
 AOT_hence C: ‹R |: F ⟶ G›
 and D: ‹∀x∀y∀z ([F]x & [F]y & [G]z → ([R]xz & [R]yz → x = y))›
 and E: ‹∀y ([G]y → ∃x ([F]x & [R]xy))›
 using "≡_d_fE"[OF "fFG:2"] "≡_d_fE"[OF "fFG:3"] "&E" by blast+
 AOT_show ‹R |: F ₁_-₁⟷ G›
 proof(rule "1-1-cor"[THEN "≡_d_fI"]; safe intro!: "&I" "cqt:2[const_var]"[axiom_inst])
 AOT_show ‹∀x ([F]x → ∃!y ([G]y & [R]xy))›
 using "≡_d_fE"[OF "fFG:1", OF C] "&E" by blast
 next
 AOT_show ‹∀y ([G]y → ∃!x ([F]x & [R]xy))›
 proof (rule "GEN"; rule "→I")
 fix y
 AOT_assume 0: ‹[G]y›
 AOT_hence ‹∃x ([F]x & [R]xy)›
 using E "∀E" "→E" by fast
 then AOT_obtain a where a_prop: ‹[F]a & [R]ay›
 using "∃E"[rotated] by blast
 moreover AOT_have ‹∀z ([F]z & [R]zy → z = a)›
 proof (rule GEN; rule "→I")
 fix z
 AOT_assume ‹[F]z & [R]zy›
 AOT_thus ‹z = a›
 using D[THEN "∀E"(2)[where β=z], THEN "∀E"(2)[where β=a],
 THEN "∀E"(2)[where β=y], THEN "→E", THEN "→E"]
 a_prop 0 "&E" "&I" by metis
 qed
 ultimately AOT_have ‹∃x ([F]x & [R]xy & ∀z ([F]z & [R]zy → z = x))›
 using "&I" "∃I"(2) by fast
 AOT_thus ‹∃!x ([F]x & [R]xy)›
 using "uniqueness:1"[THEN "≡_d_fI"] by fast
 qed
 qed
qed

text‹We have already introduced the restricted type of Ordinary objects in the
Extended Relation Comprehension theory. However, make sure all variable names
are defined as expected (avoiding conflicts with situations
of possible world theory).›
AOT_register_variable_names
 Ordinary: u v r t s

AOT_theorem "equi:1": ‹∃!u φ{u} ≡ ∃u (φ{u} & ∀v (φ{v} → v =_E u))›
proof(rule "≡I"; rule "→I")
 AOT_assume ‹∃!u φ{u}›
 AOT_hence ‹∃!x (O!x & φ{x})›.
 AOT_hence ‹∃x (O!x & φ{x} & ∀β (O!β & φ{β} → β = x))›
 using "uniqueness:1"[THEN "≡_d_fE"] by blast
 then AOT_obtain x where x_prop: ‹O!x & φ{x} & ∀β (O!β & φ{β} → β = x)›
 using "∃E"[rotated] by blast
 {
 fix β
 AOT_assume beta_ord: ‹O!β›
 moreover AOT_assume ‹φ{β}›
 ultimately AOT_have ‹β = x›
 using x_prop[THEN "&E"(2), THEN "∀E"(2)[where β=β]] "&I" "→E" by blast
 AOT_hence ‹β =_E x›
 using "ord-=E=:1"[THEN "→E", OF "∨I"(1)[OF beta_ord],
 THEN "qml:2"[axiom_inst, THEN "→E"],
 THEN "≡E"(1)]
 by blast
 }
 AOT_hence ‹(O!β → (φ{β} → β =_E x))› for β
 using "→I" by blast
 AOT_hence ‹∀β(O!β → (φ{β} → β =_E x))›
 by (rule GEN)
 AOT_hence ‹O!x & φ{x} & ∀y (O!y → (φ{y} → y =_E x))›
 using x_prop[THEN "&E"(1)] "&I" by blast
 AOT_hence ‹O!x & (φ{x} & ∀y (O!y → (φ{y} → y =_E x)))›
 using "&E" "&I" by meson
 AOT_thus ‹∃u (φ{u} & ∀v (φ{v} → v =_E u))›
 using "∃I" by fast
next
 AOT_assume ‹∃u (φ{u} & ∀v (φ{v} → v =_E u))›
 AOT_hence ‹∃x (O!x & (φ{x} & ∀y (O!y → (φ{y} → y =_E x))))›
 by blast
 then AOT_obtain x where x_prop: ‹O!x & (φ{x} & ∀y (O!y → (φ{y} → y =_E x)))›
 using "∃E"[rotated] by blast
 AOT_have ‹∀y ([O!]y & φ{y} → y = x)›
 proof(rule GEN; rule "→I")
 fix y
 AOT_assume ‹O!y & φ{y}›
 AOT_hence ‹y =_E x›
 using x_prop[THEN "&E"(2), THEN "&E"(2), THEN "∀E"(2)[where β=y]]
 "→E" "&E" by blast
 AOT_thus ‹y = x›
 using "ord-=E=:1"[THEN "→E", OF "∨I"(2)[OF x_prop[THEN "&E"(1)]],
 THEN "qml:2"[axiom_inst, THEN "→E"], THEN "≡E"(2)] by blast
 qed
 AOT_hence ‹[O!]x & φ{x} & ∀y ([O!]y & φ{y} → y = x)›
 using x_prop "&E" "&I" by meson
 AOT_hence ‹∃x ([O!]x & φ{x} & ∀y ([O!]y & φ{y} → y = x))›
 by (rule "∃I")
 AOT_hence ‹∃!x (O!x & φ{x})›
 by (rule "uniqueness:1"[THEN "≡_d_fI"])
 AOT_thus ‹∃!u φ{u}›.
qed

AOT_define CorrelatesEOneToOne :: ‹τ → τ → τ → φ› (‹_ |: _ ₁_-₁⟷_E _›)
 "equi:2": ‹R |: F ₁_-₁⟷_E G ≡_d_f R↓ & F↓ & G↓ &
∀u ([F]u → ∃!v([G]v & [R]uv)) &
∀v ([G]v → ∃!u([F]u & [R]uv))›

AOT_define EquinumerousE :: ‹τ → τ → φ› (infixl ‹≈_E› 50)
 "equi:3": ‹F ≈_E G ≡_d_f ∃R (R |: F ₁_-₁⟷_E G)›

text‹Note: not explicitly in PLM.›
AOT_theorem eq_den_1: ‹Π↓› if ‹Π ≈_E Π'›
proof -
 AOT_have ‹∃R (R |: Π ₁_-₁⟷_E Π')›
 using "equi:3"[THEN "≡_d_fE"] that by blast
 then AOT_obtain R where ‹R |: Π ₁_-₁⟷_E Π'›
 using "∃E"[rotated] by blast
 AOT_thus ‹Π↓›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast
qed

text‹Note: not explicitly in PLM.›
AOT_theorem eq_den_2: ‹Π'↓› if ‹Π ≈_E Π'›
proof -
 AOT_have ‹∃R (R |: Π ₁_-₁⟷_E Π')›
 using "equi:3"[THEN "≡_d_fE"] that by blast
 then AOT_obtain R where ‹R |: Π ₁_-₁⟷_E Π'›
 using "∃E"[rotated] by blast
 AOT_thus ‹Π'↓›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
qed

AOT_theorem "eq-part:1": ‹F ≈_E F›
proof (safe intro!: "&I" GEN "→I" "cqt:2[const_var]"[axiom_inst]
 "≡_d_fI"[OF "equi:3"] "≡_d_fI"[OF "equi:2"] "∃I"(1))
 fix x
 AOT_assume 1: ‹O!x›
 AOT_assume 2: ‹[F]x›
 AOT_show ‹∃!v ([F]v & x =_E v)›
 proof(rule "equi:1"[THEN "≡E"(2)];
 rule "∃I"(2)[where β=x];
 safe dest!: "&E"(2)
 intro!: "&I" "→I" 1 2 Ordinary.GEN "ord=Eequiv:1"[THEN "→E", OF 1])
 AOT_show ‹v =_E x› if ‹x =_E v› for v
 by (metis that "ord=Eequiv:2"[THEN "→E"])
 qed
next
 fix y
 AOT_assume 1: ‹O!y›
 AOT_assume 2: ‹[F]y›
 AOT_show ‹∃!u ([F]u & u =_E y)›
 by(safe dest!: "&E"(2)
 intro!: "equi:1"[THEN "≡E"(2)] "∃I"(2)[where β=y]
 "&I" "→I" 1 2 GEN "ord=Eequiv:1"[THEN "→E", OF 1])
qed(auto simp: "=E[denotes]")

AOT_theorem "eq-part:2": ‹F ≈_E G → G ≈_E F›
proof (rule "→I")
 AOT_assume ‹F ≈_E G›
 AOT_hence ‹∃R R |: F ₁_-₁⟷_E G›
 using "equi:3"[THEN "≡_d_fE"] by blast
 then AOT_obtain R where ‹R |: F ₁_-₁⟷_E G›
 using "∃E"[rotated] by blast
 AOT_hence 0: ‹R↓ & F↓ & G↓ & style='font-size: 18px;'>∀u ([F]u → ∃!v([G]v & [R]uv)) &
∀v ([G]v → ∃!u([F]u & [R]uv))›
 using "equi:2"[THEN "≡_d_fE"] by blast

 AOT_have ‹[λxy [R]yx]↓ & G↓ & F>↓ & ∀u ([G]u → ∃!v([F]v & [λxy [R]yx]uv)) &
∀v ([F]v → ∃!u([G]u & [λxy [R]yx]uv))›
 proof (AOT_subst ‹[λxy [R]yx]yx› ‹[R]xy› for: x y;
 (safe intro!: "&I" "cqt:2[const_var]"[axiom_inst] 0[THEN "&E"(2)]
 0[THEN "&E"(1), THEN "&E"(2)]; "cqt:2[lambda]")?)
 AOT_modally_strict {
 AOT_have ‹[λxy [R]yx]xy› if ‹[R]yx› for y x
 by (auto intro!: "β←C"(1) "cqt:2"
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" that)
 moreover AOT_have ‹[R]yx› if ‹[λxy [R]yx]xy› for y x
 using "β→C"(1)[where φ="λ(x,y). _ (x,y)" and κ₁κ_n="(_,_)",
 simplified, OF that, simplified].
 ultimately AOT_show ‹[λxy [R]yx]αβ ≡ [R]βα› for α β
 by (metis "deduction-theorem" "≡I")
 }
 qed
 AOT_hence ‹[λxy [R]yx] |: G ₁_-₁⟷_E F›
 using "equi:2"[THEN "≡_d_fI"] by blast
 AOT_hence ‹∃R R |: G ₁_-₁⟷_E F›
 by (rule "∃I"(1)) "cqt:2[lambda]"
 AOT_thus ‹G ≈_E F›
 using "equi:3"[THEN "≡_d_fI"] by blast
qed

text‹Note: not explicitly in PLM.›
AOT_theorem "eq-part:2[terms]": ‹Π ≈_E Π' → Π' ≈_E Π›
 using "eq-part:2"[unvarify F G] eq_den_1 eq_den_2 "→I" by meson
declare "eq-part:2[terms]"[THEN "→E", sym]

AOT_theorem "eq-part:3": ‹(F ≈_E G & G ≈_E H) → F ≈_E H›
proof (rule "→I")
 AOT_assume ‹F ≈_E G & G ≈_E H›
 then AOT_obtain R₁ and R₂ where
 ‹R₁ |: F ₁_-₁⟷_E G›
 and ‹R₂ |: G ₁_-₁⟷_E H›
 using "equi:3"[THEN "≡_d_fE"] "&E" "∃E"[rotated] by metis
 AOT_hence θ: ‹∀u ([F]u → ∃!v([G]v & [R₁]uv)) & ∀v ([G]v → ∃!u([F]u & [R₁]uv))›
 and ξ: ‹∀u ([G]u → ∃!v([H]v & [R₂]uv)) & ∀v ([H]v → ∃!u([G]u & [R₂]uv))›
 using "equi:2"[THEN "≡_d_fE", THEN "&E"(2)]
 "equi:2"[THEN "≡_d_fE", THEN "&E"(1), THEN "&E"(2)]
 "&I" by blast+
 AOT_have ‹∃R R = [λxy O!x & O!y & ∃v ([G]v & [R₁]xv & [R₂]vy)]›
 by (rule "free-thms:3[lambda]") cqt_2_lambda_inst_prover
 then AOT_obtain R where R_def: ‹R = [λxy O!x & O!y & ∃v ([G]v & [R₁]xv & [R₂]vy)]›
 using "∃E"[rotated] by blast
 AOT_have 1: ‹∃!v (([H]v & [R]uv))› if a: ‹[O!]u› and b: ‹[F]u› for u
 proof (rule "≡E"(2)[OF "equi:1"])
 AOT_obtain b where
 b_prop: ‹[O!]b & ([G]b & [R₁]ub & ∀v ([G]v & [R₁]uv → v =_E b))›
 using θ[THEN "&E"(1), THEN "∀E"(2), THEN "→E", THEN "→E",
 OF a b, THEN "≡E"(1)[OF "equi:1"]]
 "∃E"[rotated] by blast
 AOT_obtain c where
 c_prop: "[O!]c & ([H]c & [R₂]bc & ∀v ([H]v & [R₂]bv → v =_E c))"
 using ξ[THEN "&E"(1), THEN "∀E"(2)[where β=b], THEN "→E",
 OF b_prop[THEN "&E"(1)], THEN "→E",
 OF b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)],
 THEN "≡E"(1)[OF "equi:1"]]
 "∃E"[rotated] by blast
 AOT_show ‹∃v ([H]v & [R]uv & ∀v' ([H]v' & [R]uv' → v' =_E v))›
 proof (safe intro!: "&I" GEN "→I" "∃I"(2)[where β=c])
 AOT_show ‹O!c› using c_prop "&E" by blast
 next
 AOT_show ‹[H]c› using c_prop "&E" by blast
 next
 AOT_have 0: ‹[O!]u & [O!]c & ∃v ([G]v & [R₁]uv & [R₂]vc)›
 by (safe intro!: "&I" a c_prop[THEN "&E"(1)] "∃I"(2)[where β=b]
 b_prop[THEN "&E"(1)] b_prop[THEN "&E"(2), THEN "&E"(1)]
 c_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)])
 AOT_show ‹[R]uc›
 by (auto intro: "rule=E"[rotated, OF R_def[symmetric]]
 intro!: "β←C"(1) "cqt:2"
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" 0)
 next
 fix x
 AOT_assume ordx: ‹O!x›
 AOT_assume ‹[H]x & [R]ux›
 AOT_hence hx: ‹[H]x› and ‹[R]ux› using "&E" by blast+
 AOT_hence ‹[λxy O!x & O!y & ∃v ([G]v & [R₁]xv & [R₂]vy)]ux›
 using "rule=E"[rotated, OF R_def] by fast
 AOT_hence ‹O!u & O!x & ∃v ([G]v & [R₁]uv & [R₂]vx)›
 by (rule "β→C"(1)[where φ="λ(κ,κ'). _ κ κ'" and κ₁κ_n="(_,_)", simplified])
 then AOT_obtain z where z_prop: ‹O!z & ([G]z & [R₁]uz & [R₂]zx)›
 using "&E" "∃E"[rotated] by blast
 AOT_hence ‹z =_E b›
 using b_prop[THEN "&E"(2), THEN "&E"(2), THEN "∀E"(2)[where β=z]]
 using "&E" "→E" by metis
 AOT_hence ‹z = b›
 by (metis "=E-simple:2"[THEN "→E"])
 AOT_hence ‹[R₂]bx›
 using z_prop[THEN "&E"(2), THEN "&E"(2)] "rule=E" by fast
 AOT_thus ‹x =_E c›
 using c_prop[THEN "&E"(2), THEN "&E"(2), THEN "∀E"(2)[where β=x],
 THEN "→E", THEN "→E", OF ordx]
 hx "&I" by blast
 qed
 qed
 AOT_have 2: ‹∃!u (([F]u & [R]uv))› if a: ‹[O!]v› and b: ‹[H]v› for v
 proof (rule "≡E"(2)[OF "equi:1"])
 AOT_obtain b where
 b_prop: ‹[O!]b & ([G]b & [R₂]bv & ∀u ([G]u & [R₂]uv → u =_E b))›
 using ξ[THEN "&E"(2), THEN "∀E"(2), THEN "→E", THEN "→E",
 OF a b, THEN "≡E"(1)[OF "equi:1"]]
 "∃E"[rotated] by blast
 AOT_obtain c where
 c_prop: "[O!]c & ([F]c & [R₁]cb & ∀v ([F]v & [R₁]vb → v =_E c))"
 using θ[THEN "&E"(2), THEN "∀E"(2)[where β=b], THEN "→E",
 OF b_prop[THEN "&E"(1)], THEN "→E",
 OF b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)],
 THEN "≡E"(1)[OF "equi:1"]]
 "∃E"[rotated] by blast
 AOT_show ‹∃u ([F]u & [R]uv & ∀v' ([F]v' & [R]v'v → v' =_E u))›
 proof (safe intro!: "&I" GEN "→I" "∃I"(2)[where β=c])
 AOT_show ‹O!c› using c_prop "&E" by blast
 next
 AOT_show ‹[F]c› using c_prop "&E" by blast
 next
 AOT_have ‹[O!]c & [O!]v & ∃u ([G]u & [R₁]cu & [R₂]uv)›
 by (safe intro!: "&I" a "∃I"(2)[where β=b]
 c_prop[THEN "&E"(1)] b_prop[THEN "&E"(1)]
 b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
 b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
 c_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)])
 AOT_thus ‹[R]cv›
 by (auto intro: "rule=E"[rotated, OF R_def[symmetric]]
 intro!: "β←C"(1) "cqt:2"
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
 next
 fix x
 AOT_assume ordx: ‹O!x›
 AOT_assume ‹[F]x & [R]xv›
 AOT_hence hx: ‹[F]x› and ‹[R]xv› using "&E" by blast+
 AOT_hence ‹[λxy O!x & O!y & ∃v ([G]v & [R₁]xv & [R₂]vy)]xv›
 using "rule=E"[rotated, OF R_def] by fast
 AOT_hence ‹O!x & O!v & ∃u ([G]u & [R₁]xu & [R₂]uv)›
 by (rule "β→C"(1)[where φ="λ(κ,κ'). _ κ κ'" and κ₁κ_n="(_,_)", simplified])
 then AOT_obtain z where z_prop: ‹O!z & ([G]z & [R₁]xz & [R₂]zv)›
 using "&E" "∃E"[rotated] by blast
 AOT_hence ‹z =_E b›
 using b_prop[THEN "&E"(2), THEN "&E"(2), THEN "∀E"(2)[where β=z]]
 using "&E" "→E" "&I" by metis
 AOT_hence ‹z = b›
 by (metis "=E-simple:2"[THEN "→E"])
 AOT_hence ‹[R₁]xb›
 using z_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)] "rule=E" by fast
 AOT_thus ‹x =_E c›
 using c_prop[THEN "&E"(2), THEN "&E"(2), THEN "∀E"(2)[where β=x],
 THEN "→E", THEN "→E", OF ordx]
 hx "&I" by blast
 qed
 qed
 AOT_show ‹F ≈_E H›
 apply (rule "equi:3"[THEN "≡_d_fI"])
 apply (rule "∃I"(2)[where β=R])
 by (auto intro!: 1 2 "equi:2"[THEN "≡_d_fI"] "&I" "cqt:2[const_var]"[axiom_inst]
 Ordinary.GEN "→I" Ordinary.ψ)
qed

text‹Note: not explicitly in PLM.›
AOT_theorem "eq-part:3[terms]": ‹Π ≈_E Π''› if ‹Π ≈_E Π'› and ‹Π' ≈_E Π''›
 using "eq-part:3"[unvarify F G H, THEN "→E"] eq_den_1 eq_den_2 "→I" "&I"
 by (metis that(1) that(2))
declare "eq-part:3[terms]"[trans]

AOT_theorem "eq-part:4": ‹F ≈_E G ≡ ∀H (H ≈_E F ≡ H ≈_E G)›
proof(rule "≡I"; rule "→I")
 AOT_assume 0: ‹F ≈_E G›
 AOT_hence 1: ‹G ≈_E F› using "eq-part:2"[THEN "→E"] by blast
 AOT_show ‹∀H (H ≈_E F ≡ H ≈_E G)›
 proof (rule GEN; rule "≡I"; rule "→I")
 AOT_show ‹H ≈_E G› if ‹H ≈_E F› for H using 0
 by (meson "&I" "eq-part:3" that "vdash-properties:6")
 next
 AOT_show ‹H ≈_E F› if ‹H ≈_E G› for H using 1
 by (metis "&I" "eq-part:3" that "vdash-properties:6")
 qed
next
 AOT_assume ‹∀H (H ≈_E F ≡ H ≈_E G)›
 AOT_hence ‹F ≈_E F ≡ F ≈_E G› using "∀E" by blast
 AOT_thus ‹F ≈_E G› using "eq-part:1" "≡E" by blast
qed

AOT_define MapsE :: ‹τ → τ → τ → φ› (‹_ |: _ ⟶E _›)
 "equi-rem:1":
 ‹R |: F ⟶E G ≡_d_f R↓ & F↓ & G↓ & ∀u ([F]u → ∃!v ([G]v & [R]uv))›

AOT_define MapsEOneToOne :: ‹τ → τ → τ → φ› (‹_ |: _ ₁_-₁⟶E _›)
 "equi-rem:2":
 ‹R |: F ₁_-₁⟶E G ≡_d_f
R |: F ⟶E G & ∀t∀u∀v (([F]t & [F]u & [G]v) → ([R]tv & [R]uv e='font-size: 18px;'>→ t =_E u))›

AOT_define MapsEOnto :: ‹τ → τ → τ → φ› (‹_ |: _ ⟶_o_n_t_oE _›)
 "equi-rem:3":
 ‹R |: F ⟶_o_n_t_oE G ≡_d_f R |: F ⟶E G & ∀v ([G]v → ∃u ([F]u & [R]uv))›

AOT_define MapsEOneToOneOnto :: ‹τ → τ → τ → φ› (‹_ |: _ ₁_-₁⟶_o_n_t_oE _›)
 "equi-rem:4":
 ‹R |: F ₁_-₁⟶_o_n_t_oE G ≡_d_f R |: F ₁_-₁⟶E G & R |: F ⟶_o_n_t_oE G›

AOT_theorem "equi-rem-thm":
 ‹R |: F ₁_-₁⟷_E G ≡ R |: F ₁_-₁⟶_o_n_t_oE G›
proof -
 AOT_have ‹R |: F ₁_-₁⟷_E G ≡ R |: [λx O!x & [F]x] ₁_-₁⟷ [λx O!x & [G]x]›
 proof(safe intro!: "≡I" "→I" "&I")
 AOT_assume ‹R |: F ₁_-₁⟷_E G›
 AOT_hence ‹∀u ([F]u → ∃!v ([G]v & [R]uv))›
 and ‹∀v ([G]v → ∃!u ([F]u & [R]uv))›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
 AOT_hence a: ‹([F]u → ∃!v ([G]v & [R]uv))›
 and b: ‹([G]v → ∃!u ([F]u & [R]uv))› for u v
 using "Ordinary.∀E" by fast+
 AOT_have ‹([λx [O!]x & [F]x]x → ∃!y ([λx [O!]x & [G]x]y & [R]xy))› for x
 apply (AOT_subst ‹[λx [O!]x & [F]x]x› ‹[O!]x & [F]x›)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 apply (AOT_subst ‹[λx [O!]x & [G]x]x› ‹[O!]x & [G]x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 apply (AOT_subst ‹O!y & [G]y & [R]xy› ‹O!y & ([G]y & [R]xy)› for: y)
 apply (meson "≡E"(6) "Associativity of &" "oth-class-taut:3:a")
 apply (rule "→I") apply (frule "&E"(1)) apply (drule "&E"(2))
 by (fact a[unconstrain u, THEN "→E", THEN "→E", of x])
 AOT_hence A: ‹∀x ([λx [O!]x & [F]x]x → ∃!y ([λx [O!]x & [G]x]y & [R]xy))›
 by (rule GEN)
 AOT_have ‹([λx [O!]x & [G]x]y → ∃!x ([λx [O!]x & [F]x]x & [R]xy))› for y
 apply (AOT_subst ‹[λx [O!]x & [G]x]y› ‹[O!]y & [G]y›)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 apply (AOT_subst ‹[λx [O!]x & [F]x]x› ‹[O!]x & [F]x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 apply (AOT_subst ‹O!x & [F]x & [R]xy› ‹O!x & ([F]x & [R]xy)› for: x)
 apply (meson "≡E"(6) "Associativity of &" "oth-class-taut:3:a")
 apply (rule "→I") apply (frule "&E"(1)) apply (drule "&E"(2))
 by (fact b[unconstrain v, THEN "→E", THEN "→E", of y])
 AOT_hence B: ‹∀y ([λx [O!]x & [G]x]y → ∃!x ([λx [O!]x & [F]x]x & [R]xy))›
 by (rule GEN)
 AOT_show ‹R |: [λx [O!]x & [F]x] ₁_-₁⟷ [λx [O!]x & [G]x]›
 by (safe intro!: "1-1-cor"[THEN "≡_d_fI"] "&I"
 "cqt:2[const_var]"[axiom_inst] A B)
 "cqt:2[lambda]"+
 next
 AOT_assume ‹R |: [λx [O!]x & [F]x] ₁_-₁⟷ [λx [O!]x & [G]x]›
 AOT_hence a: ‹([λx [O!]x & [F]x]x → ∃!y ([λx [O!]x & [G]x]y & [R]xy))› and
 b: ‹([λx [O!]x & [G]x]y → ∃!x ([λx [O!]x & [F]x]x & [R]xy))› for x y
 using "1-1-cor"[THEN "≡_d_fE"] "&E" "∀E"(2) by blast+
 AOT_have ‹[F]u → ∃!v ([G]v & [R]uv)› for u
 proof (safe intro!: "→I")
 AOT_assume fu: ‹[F]u›
 AOT_have 0: ‹[λx [O!]x & [F]x]u›
 by (auto intro!: "β←C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
 Ordinary.ψ fu "&I")
 AOT_show ‹∃!v ([G]v & [R]uv)›
 apply (AOT_subst ‹[O!]x & ([G]x & [R]ux)›
 ‹([O!]x & [G]x) & [R]ux› for: x)
 apply (simp add: "Associativity of &")
 apply (AOT_subst (reverse) ‹[O!]x & [G]x›
 ‹[λx [O!]x & [G]x]x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 using a[THEN "→E", OF 0] by blast
 qed
 AOT_hence A: ‹∀u ([F]u → ∃!v ([G]v & [R]uv))›
 by (rule Ordinary.GEN)
 AOT_have ‹[G]v → ∃!u ([F]u & [R]uv)› for v
 proof (safe intro!: "→I")
 AOT_assume gu: ‹[G]v›
 AOT_have 0: ‹[λx [O!]x & [G]x]v›
 by (auto intro!: "β←C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
 Ordinary.ψ gu "&I")
 AOT_show ‹∃!u ([F]u & [R]uv)›
 apply (AOT_subst ‹[O!]x & ([F]x & [R]xv)› ‹([O!]x & [F]x) & [R]xv› for: x)
 apply (simp add: "Associativity of &")
 apply (AOT_subst (reverse) ‹[O!]x & [F]x›\‹[λx [O!]x & [F]x]x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 using b[THEN "→E", OF 0] by blast
 qed
 AOT_hence B: ‹∀v ([G]v → ∃!u ([F]u & [R]uv))› by (rule Ordinary.GEN)
 AOT_show ‹R |: F ₁_-₁⟷_E G›
 by (safe intro!: "equi:2"[THEN "≡_d_fI"] "&I" A B "cqt:2[const_var]"[axiom_inst])
 qed
 also AOT_have ‹… ≡ R |: F ₁_-₁⟶_o_n_t_oE G›
 proof(safe intro!: "≡I" "→I" "&I")
 AOT_assume ‹R |: [λx [O!]x & [F]x] ₁_-₁⟷ [λx [O!]x & [G]x]›
 AOT_hence a: ‹([λx [O!]x & [F]x]x → ∃!y ([λx [O!]x & [G]x]y & [R]xy))› and
 b: ‹([λx [O!]x & [G]x]y → ∃!x ([λx [O!]x & [F]x]x & [R]xy))› for x y
 using "1-1-cor"[THEN "≡_d_fE"] "&E" "∀E"(2) by blast+
 AOT_show ‹R |: F ₁_-₁⟶_o_n_t_oE G›
 proof (safe intro!: "equi-rem:4"[THEN "≡_d_fI"] "&I" "equi-rem:3"[THEN "≡_d_fI"]
 "equi-rem:2"[THEN "≡_d_fI"] "equi-rem:1"[THEN "≡_d_fI"]
 "cqt:2[const_var]"[axiom_inst] Ordinary.GEN "→I")
 fix u
 AOT_assume fu: ‹[F]u›
 AOT_have 0: ‹[λx [O!]x & [F]x]u›
 by (auto intro!: "β←C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
 Ordinary.ψ fu "&I")
 AOT_hence 1: ‹∃!y ([λx [O!]x & [G]x]y & [R]uy)›
 using a[THEN "→E"] by blast
 AOT_show ‹∃!v ([G]v & [R]uv)›
 apply (AOT_subst ‹[O!]x & ([G]x & [R]ux)› ‹([O!]x & [G]x) & [R]ux› for: x)
 apply (simp add: "Associativity of &")
 apply (AOT_subst (reverse) ‹[O!]x & [G]x› ‹[λx [O!]x & [G]x]x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 by (fact 1)
 next
 fix t u v
 AOT_assume ‹[F]t & [F]u & [G]v› and rtv_tuv: ‹[R]tv & [R]uv›
 AOT_hence oft: ‹[λx O!x & [F]x]t› and
 ofu: ‹[λx O!x & [F]x]u› and
 ogv: ‹[λx O!x & [G]x]v›
 by (auto intro!: "β←C"(1) "cqt:2" "&I"
 simp: Ordinary.ψ dest: "&E")
 AOT_hence ‹∃!x ([λx [O!]x & [F]x]x & [R]xv)›
 using b[THEN "→E"] by blast
 then AOT_obtain a where
 a_prop: ‹[λx [O!]x & [F]x]a & [R]av &
∀x (([λx [O!]x & [F]x]x & [R]xv) → x = a)›
 using "uniqueness:1"[THEN "≡_d_fE"] "∃E"[rotated] by blast
 AOT_hence ua: ‹u = a›
 using ofu rtv_tuv[THEN "&E"(2)] "∀E"(2) "→E" "&I" "&E"(2) by blast
 moreover AOT_have ta: ‹t = a›
 using a_prop oft rtv_tuv[THEN "&E"(1)] "∀E"(2) "→E" "&I" "&E"(2) by blast
 ultimately AOT_have ‹t = u› by (metis "rule=E" id_sym)
 AOT_thus ‹t =_E u›
 using "rule=E" id_sym "ord=Eequiv:1" Ordinary.ψ ta ua "→E" by fast
 next
 fix u
 AOT_assume ‹[F]u›
 AOT_hence ‹[λx O!x & [F]x]u›
 by (auto intro!: "β←C"(1) "cqt:2" "&I"
 simp: "cqt:2[const_var]"[axiom_inst] Ordinary.ψ)
 AOT_hence ‹∃!y ([λx [O!]x & [G]x]y & [R]uy)›
 using a[THEN "→E"] by blast
 then AOT_obtain a where
 a_prop: ‹[λx [O!]x & [G]x]a & [R]ua &
∀x (([λx [O!]x & [G]x]x & [R]ux) → x = a)›
 using "uniqueness:1"[THEN "≡_d_fE"] "∃E"[rotated] by blast
 AOT_have ‹O!a & [G]a›
 by (rule "β→C"(1)) (auto simp: a_prop[THEN "&E"(1), THEN "&E"(1)])
 AOT_hence ‹O!a› and ‹[G]a› using "&E" by blast+
 moreover AOT_have ‹∀v ([G]v & [R]uv → v =_E a)›
 proof(safe intro!: Ordinary.GEN "→I"; frule "&E"(1); drule "&E"(2))
 fix v
 AOT_assume ‹[G]v› and ruv: ‹[R]uv›
 AOT_hence ‹[λx [O!]x & [G]x]v›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" simp: Ordinary.ψ)
 AOT_hence ‹v = a›
 using a_prop[THEN "&E"(2), THEN "∀E"(2), THEN "→E", OF "&I"] ruv by blast
 AOT_thus ‹v =_E a›
 using "rule=E" "ord=Eequiv:1" Ordinary.ψ "→E" by fast
 qed
 ultimately AOT_have ‹O!a & ([G]a & [R]ua & ∀v' ([G]v' & [R]uv' e='font-size: 18px;'>→ v' =_E a))›
 using "∃I" "&I" a_prop[THEN "&E"(1), THEN "&E"(2)] by simp
 AOT_hence ‹∃v ([G]v & [R]uv & ∀v' ([G]v' & [R]uv' → v' =_E v))›
 by (rule "∃I")
 AOT_thus ‹∃!v ([G]v & [R]uv)›
 by (rule "equi:1"[THEN "≡E"(2)])
 next
 fix v
 AOT_assume ‹[G]v›
 AOT_hence ‹[λx O!x & [G]x]v›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" Ordinary.ψ)
 AOT_hence ‹∃!x ([λx [O!]x & [F]x]x & [R]xv)›
 using b[THEN "→E"] by blast
 then AOT_obtain a where
 a_prop: ‹[λx [O!]x & [F]x]a & [R]av &
∀y ([λx [O!]x & [F]x]y & [R]yv → y = a)›
 using "uniqueness:1"[THEN "≡_d_fE", THEN "∃E"[rotated]] by blast
 AOT_have ‹O!a & [F]a›
 by (rule "β→C"(1)) (auto simp: a_prop[THEN "&E"(1), THEN "&E"(1)])
 AOT_hence ‹O!a & ([F]a & [R]av)›
 using a_prop[THEN "&E"(1), THEN "&E"(2)] "&E" "&I" by metis
 AOT_thus ‹∃u ([F]u & [R]uv)›
 by (rule "∃I")
 qed
 next
 AOT_assume ‹R |: F ₁_-₁⟶_o_n_t_oE G›
 AOT_hence 1: ‹R |: F ₁_-₁⟶E G›
 and 2: ‹R |: F ⟶_o_n_t_oE G›
 using "equi-rem:4"[THEN "≡_d_fE"] "&E" by blast+
 AOT_hence 3: ‹R |: F ⟶E G›
 and A: ‹∀t ∀u ∀v ([F]t & [F]u & [G]v → ([R]tv & [R]uv → t =_E u))›
 using "equi-rem:2"[THEN "≡_d_fE", OF 1] "&E" by blast+
 AOT_hence B: ‹∀u ([F]u → ∃!v ([G]v & [R]uv))›
 using "equi-rem:1"[THEN "≡_d_fE"] "&E" by blast
 AOT_have C: ‹∀v ([G]v → ∃u ([F]u & [R]uv))›
 using "equi-rem:3"[THEN "≡_d_fE", OF 2] "&E" by blast
 AOT_show ‹R |: [λx [O!]x & [F]x] ₁_-₁⟷ [λx [O!]x & [G]x]›
 proof (rule "1-1-cor"[THEN "≡_d_fI"];
 safe intro!: "&I" "cqt:2" GEN "→I")
 fix x
 AOT_assume 1: ‹[λx [O!]x & [F]x]x›
 AOT_have ‹O!x & [F]x›
 by (rule "β→C"(1)) (auto simp: 1)
 AOT_hence ‹∃!v ([G]v & [R]xv)›
 using B[THEN "∀E"(2), THEN "→E", THEN "→E"] "&E" by blast
 then AOT_obtain y where
 y_prop: ‹O!y & ([G]y & [R]xy & ∀u ([G]u & [R]xu → u =_E y))›
 using "equi:1"[THEN "≡E"(1)] "∃E"[rotated] by fastforce
 AOT_hence ‹[λx O!x & [G]x]y›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" dest: "&E")
 moreover AOT_have ‹∀z ([λx O!x & [G]x]z & [R]xz → z = y)›
 proof(safe intro!: GEN "→I"; frule "&E"(1); drule "&E"(2))
 fix z
 AOT_assume 1: ‹[λx [O!]x & [G]x]z›
 AOT_have 2: ‹O!z & [G]z›
 by (rule "β→C"(1)) (auto simp: 1)
 moreover AOT_assume ‹[R]xz›
 ultimately AOT_have ‹z =_E y›
 using y_prop[THEN "&E"(2), THEN "&E"(2), THEN "∀E"(2),
 THEN "→E", THEN "→E", rotated, OF "&I"] "&E"
 by blast
 AOT_thus ‹z = y›
 using 2[THEN "&E"(1)] by (metis "=E-simple:2" "→E")
 qed
 ultimately AOT_have ‹[λx O!x & [G]x]y & [R]xy &
∀z ([λx O!x & [G]x]z & [R]xz → z = y)›
 using y_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)] "&I" by auto
 AOT_hence ‹∃y ([λx O!x & [G]x]y & [R]xy &
∀z ([λx O!x & [G]x]z & [R]xz → z = y))›
 by (rule "∃I")
 AOT_thus ‹∃!y ([λx [O!]x & [G]x]y & [R]xy)›
 using "uniqueness:1"[THEN "≡_d_fI"] by fast
 next
 fix y
 AOT_assume 1: ‹[λx [O!]x & [G]x]y›
 AOT_have oy_gy: ‹O!y & [G]y›
 by (rule "β→C"(1)) (auto simp: 1)
 AOT_hence ‹∃u ([F]u & [R]uy)›
 using C[THEN "∀E"(2), THEN "→E", THEN "→E"] "&E" by blast
 then AOT_obtain x where x_prop: ‹O!x & ([F]x & [R]xy)›
 using "∃E"[rotated] by blast
 AOT_hence ofx: ‹[λx O!x & [F]x]x›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" dest: "&E")
 AOT_have ‹∃α ([λx [O!]x & [F]x]α & [R]αy &
∀β ([λx [O!]x & [F]x]β & [R]βy → β = α))›
 proof (safe intro!: "∃I"(2)[where β=x] "&I" GEN "→I")
 AOT_show ‹[λx O!x & [F]x]x› using ofx.
 next
 AOT_show ‹[R]xy› using x_prop[THEN "&E"(2), THEN "&E"(2)].
 next
 fix z
 AOT_assume 1: ‹[λx [O!]x & [F]x]z & [R]zy›
 AOT_have oz_fz: ‹O!z & [F]z›
 by (rule "β→C"(1)) (auto simp: 1[THEN "&E"(1)])
 AOT_have ‹z =_E x›
 using A[THEN "∀E"(2)[where β=z], THEN "→E", THEN "∀E"(2)[where β=x],
 THEN "→E", THEN "∀E"(2)[where β=y], THEN "→E",
 THEN "→E", THEN "→E", OF oz_fz[THEN "&E"(1)],
 OF x_prop[THEN "&E"(1)], OF oy_gy[THEN "&E"(1)], OF "&I", OF "&I",
 OF oz_fz[THEN "&E"(2)], OF x_prop[THEN "&E"(2), THEN "&E"(1)],
 OF oy_gy[THEN "&E"(2)], OF "&I", OF 1[THEN "&E"(2)],
 OF x_prop[THEN "&E"(2), THEN "&E"(2)]].
 AOT_thus ‹z = x›
 by (metis "=E-simple:2" "vdash-properties:10")
 qed
 AOT_thus ‹∃!x ([λx [O!]x & [F]x]x & [R]xy)›
 by (rule "uniqueness:1"[THEN "≡_d_fI"])
 qed
 qed
 finally show ?thesis.
qed

AOT_theorem "empty-approx:1": ‹(¬∃u [F]u & ¬∃v [H]v) → F ≈_E H›
proof(rule "→I"; frule "&E"(1); drule "&E"(2))
 AOT_assume 0: ‹¬∃u [F]u› and 1: ‹¬∃v [H]v›
 AOT_have ‹∀u ([F]u → ∃!v ([H]v & [R]uv))› for R
 proof(rule Ordinary.GEN; rule "→I"; rule "raa-cor:1")
 fix u
 AOT_assume ‹[F]u›
 AOT_hence ‹∃u [F]u› using "Ordinary.∃I" "&I" by fast
 AOT_thus ‹∃u [F]u & ¬∃u [F]u› using "&I" 0 by blast
 qed
 moreover AOT_have ‹∀v ([H]v → ∃!u ([F]u & [R]uv))› for R
 proof(rule Ordinary.GEN; rule "→I"; rule "raa-cor:1")
 fix v
 AOT_assume ‹[H]v›
 AOT_hence ‹∃v [H]v› using "Ordinary.∃I" "&I" by fast
 AOT_thus ‹∃v [H]v & ¬∃v [H]v› using 1 "&I" by blast
 qed
 ultimately AOT_have ‹R |: F ₁_-₁⟷_E H› for R
 apply (safe intro!: "equi:2"[THEN "≡_d_fI"] "&I" GEN "cqt:2[const_var]"[axiom_inst])
 using "∀E" by blast+
 AOT_hence ‹∃R R |: F ₁_-₁⟷_E H› by (rule "∃I")
 AOT_thus ‹F ≈_E H›
 by (rule "equi:3"[THEN "≡_d_fI"])
qed

AOT_theorem "empty-approx:2": ‹(∃u [F]u & ¬∃v [H]v) → ¬(F ≈_E H)›
proof(rule "→I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:2")
 AOT_assume 1: ‹∃u [F]u› and 2: ‹¬∃v [H]v›
 AOT_obtain b where b_prop: ‹O!b & [F]b›
 using 1 "∃E"[rotated] by blast
 AOT_assume ‹F ≈_E H›
 AOT_hence ‹∃R R |: F ₁_-₁⟷_E H›
 by (rule "equi:3"[THEN "≡_d_fE"])
 then AOT_obtain R where ‹R |: F ₁_-₁⟷_E H›
 using "∃E"[rotated] by blast
 AOT_hence θ: ‹∀u ([F]u → ∃!v ([H]v & [R]uv))›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
 AOT_have ‹∃!v ([H]v & [R]bv)› for u
 using θ[THEN "∀E"(2)[where β=b], THEN "→E", THEN "→E",
 OF b_prop[THEN "&E"(1)], OF b_prop[THEN "&E"(2)]].
 AOT_hence ‹∃v ([H]v & [R]bv & ∀u ([H]u & [R]bu → u =_E v))›
 by (rule "equi:1"[THEN "≡E"(1)])
 then AOT_obtain x where ‹O!x & ([H]x & [R]bx & ∀u ([H]u & [R]bu e='font-size: 18px;'>→ u =_E x))›
 using "∃E"[rotated] by blast
 AOT_hence ‹O!x & [H]x› using "&E" "&I" by blast
 AOT_hence ‹∃v [H]v› by (rule "∃I")
 AOT_thus ‹∃v [H]v & ¬∃v [H]v› using 2 "&I" by blast
qed

AOT_define FminusU :: ‹Π → τ → Π› (‹_^-^_›)
 "F-u": ‹[F]^-^x =_d_f [λz [F]z & z ≠_E x]›

text‹Note: not explicitly in PLM.›
AOT_theorem "F-u[den]": ‹[F]^-^x↓›
 by (rule "=_d_fI"(1)[OF "F-u", where τ₁τ_n="(_,_)", simplified]; "cqt:2[lambda]")
AOT_theorem "F-u[equiv]": ‹[[F]^-^x]y ≡ ([F]y & y ≠_E x)›
 by (auto intro: "F-u"[THEN "=_d_fI"(1), where τ₁τ_n="(_,_)", simplified]
 intro!: "cqt:2" "beta-C-cor:2"[THEN "→E", THEN "∀E"(2)])

AOT_theorem eqP': ‹F ≈_E G & [F]u & [G]v → [F]^-^u ≈_E [G]^-^v›
proof (rule "→I"; frule "&E"(2); drule "&E"(1); frule "&E"(2); drule "&E"(1))
 AOT_assume ‹F ≈_E G›
 AOT_hence ‹∃R R |: F ₁_-₁⟷_E G›
 using "equi:3"[THEN "≡_d_fE"] by blast
 then AOT_obtain R where R_prop: ‹R |: F ₁_-₁⟷_E G›
 using "∃E"[rotated] by blast
 AOT_hence A: ‹∀u ([F]u → ∃!v ([G]v & [R]uv))›
 and B: ‹∀v ([G]v → ∃!u ([F]u & [R]uv))›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
 AOT_have ‹R |: F ₁_-₁⟶_o_n_t_oE G›
 using "equi-rem-thm"[THEN "≡E"(1), OF R_prop].
 AOT_hence ‹R |: F ₁_-₁⟶E G & R |: F ⟶_o_n_t_oE G›
 using "equi-rem:4"[THEN "≡_d_fE"] by blast
 AOT_hence C: ‹∀t∀u∀v (([F]t & [F]u & [G]v) → ([R]tv & [R]uv → t =_E u))›
 using "equi-rem:2"[THEN "≡_d_fE"] "&E" by blast
 AOT_assume fu: ‹[F]u›
 AOT_assume gv: ‹[G]v›
 AOT_have ‹[λz [Π]z & z ≠_E κ]↓› for Π κ
 by "cqt:2[lambda]"
 note Π_minus_κI = "rule-id-df:2:b[2]"[
 where τ=‹(λ(Π, κ). «[Π]^-^\κ¬)›, simplified, OF "F-u", simplified, OF this]
 and Π_minus_κE = "rule-id-df:2:a[2]"[
 where τ=‹(λ(Π, κ). «[Π]^-^\κ¬)›, simplified, OF "F-u", simplified, OF this]
 AOT_have Π_minus_κ_den: ‹[Π]^-^\κ↓› for Π κ
 by (rule Π_minus_κI) "cqt:2[lambda]"+
 {
 fix R
 AOT_assume R_prop: ‹R |: F ₁_-₁⟷_E G›
 AOT_hence A: ‹∀u ([F]u → ∃!v ([G]v & [R]uv))›
 and B: ‹∀v ([G]v → ∃!u ([F]u & [R]uv))›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
 AOT_have ‹R |: F ₁_-₁⟶_o_n_t_oE G›
 using "equi-rem-thm"[THEN "≡E"(1), OF R_prop].
 AOT_hence ‹R |: F ₁_-₁⟶E G & R |: F ⟶_o_n_t_oE G›
 using "equi-rem:4"[THEN "≡_d_fE"] by blast
 AOT_hence C: ‹∀t∀u∀v (([F]t & [F]u & [G]v) → ([R]tv & [R]uv → t =_E u))›
 using "equi-rem:2"[THEN "≡_d_fE"] "&E" by blast

 AOT_assume Ruv: ‹[R]uv›
 AOT_have ‹R |: [F]^-^u ₁_-₁⟷_E [G]^-^v›
 proof(safe intro!: "equi:2"[THEN "≡_d_fI"] "&I" "cqt:2[const_var]"[axiom_inst]
 Π_minus_κ_den Ordinary.GEN "→I")
 fix u'
 AOT_assume ‹[[F]^-^u]u'›
 AOT_hence 0: ‹[λz [F]z & z ≠_E u]u'›
 using Π_minus_κE by fast
 AOT_have 0: ‹[F]u' & u' ≠_E u›
 by (rule "β→C"(1)[where κ₁κ_n="AOT_term_of_var (Ordinary.Rep u')"]) (fact 0)
 AOT_have ‹∃!v ([G]v & [R]u'v)›
 using A[THEN "Ordinary.∀E"[where α=u'], THEN "→E", OF 0[THEN "&E"(1)]].
 then AOT_obtain v' where
 v'_prop: ‹[G]v' & [R]u'v' & ∀ t ([G]t & [R]u't → t =_E v')›
 using "equi:1"[THEN "≡E"(1)] "Ordinary.∃E"[rotated] by fastforce

 AOT_show ‹∃!v' ([[G]^-^v]v' & [R]u'v')›
 proof (safe intro!: "equi:1"[THEN "≡E"(2)] "Ordinary.∃I"[where β=v']
 "&I" Ordinary.GEN "→I")
 AOT_show ‹[[G]^-^v]v'›
 proof (rule Π_minus_κI;
 safe intro!: "β←C"(1) "cqt:2" "&I" "thm-neg=E"[THEN "≡E"(2)])
 AOT_show ‹[G]v'› using v'_prop "&E" by blast
 next
 AOT_show ‹¬v' =_E v›
 proof (rule "raa-cor:2")
 AOT_assume ‹v' =_E v›
 AOT_hence ‹v' = v› by (metis "=E-simple:2" "→E")
 AOT_hence Ruv': ‹[R]uv'› using "rule=E" Ruv id_sym by fast
 AOT_have ‹u' =_E u›
 by (rule C[THEN "Ordinary.∀E", THEN "Ordinary.∀E",
 THEN "Ordinary.∀E"[where α=v'], THEN "→E", THEN "→E"])
 (safe intro!: "&I" 0[THEN "&E"(1)] fu
 v'_prop[THEN "&E"(1), THEN "&E"(1)]
 Ruv' v'_prop[THEN "&E"(1), THEN "&E"(2)])
 moreover AOT_have ‹¬(u' =_E u)›
 using "0" "&E"(2) "≡E"(1) "thm-neg=E" by blast
 ultimately AOT_show ‹u' =_E u & ¬u' =_E u› using "&I" by blast
 qed
 qed
 next
 AOT_show ‹[R]u'v'› using v'_prop "&E" by blast
 next
 fix t
 AOT_assume t_prop: ‹[[G]^-^v]t & [R]u't›
 AOT_have gt_t_noteq_v: ‹[G]t & t ≠_E v›
 apply (rule "β→C"(1)[where κ₁κ_n="AOT_term_of_var (Ordinary.Rep t)"])
 apply (rule Π_minus_κE)
 by (fact t_prop[THEN "&E"(1)])
 AOT_show ‹t =_E v'›
 using v'_prop[THEN "&E"(2), THEN "Ordinary.∀E", THEN "→E",
 OF "&I", OF gt_t_noteq_v[THEN "&E"(1)],
 OF t_prop[THEN "&E"(2)]].
 qed
 next
 fix v'
 AOT_assume G_minus_v_v': ‹[[G]^-^v]v'›
 AOT_have gt_t_noteq_v: ‹[G]v' & v' ≠_E v›
 apply (rule "β→C"(1)[where κ₁κ_n="AOT_term_of_var (Ordinary.Rep v')"])
 apply (rule Π_minus_κE)
 by (fact G_minus_v_v')
 AOT_have ‹∃!u([F]u & [R]uv')›
 using B[THEN "Ordinary.∀E", THEN "→E", OF gt_t_noteq_v[THEN "&E"(1)]].
 then AOT_obtain u' where
 u'_prop: ‹[F]u' & [R]u'v' & ∀t ([F]t & [R]tv' → t =_E u')›
 using "equi:1"[THEN "≡E"(1)] "Ordinary.∃E"[rotated] by fastforce
 AOT_show ‹∃!u' ([[F]^-^u]u' & [R]u'v')›
 proof (safe intro!: "equi:1"[THEN "≡E"(2)] "Ordinary.∃I"[where β=u'] "&I"
 u'_prop[THEN "&E"(1), THEN "&E"(2)] Ordinary.GEN "→I")
 AOT_show ‹[[F]^-^u]u'›
 proof (rule Π_minus_κI;
 safe intro!: "β←C"(1) "cqt:2" "&I" "thm-neg=E"[THEN "≡E"(2)]
 u'_prop[THEN "&E"(1), THEN "&E"(1)]; rule "raa-cor:2")
 AOT_assume u'_eq_u: ‹u' =_E u›
 AOT_hence ‹u' = u›
 using "=E-simple:2" "vdash-properties:10" by blast
 AOT_hence Ru'v: ‹[R]u'v› using "rule=E" Ruv id_sym by fast
 AOT_have ‹v' ≠_E v›
 using "&E"(2) gt_t_noteq_v by blast
 AOT_hence v'_noteq_v: ‹¬(v' =_E v)› by (metis "≡E"(1) "thm-neg=E")
 AOT_have ‹∃u ([G]u & [R]u'u & ∀v ([G]v & [R]u'v → v =_E u))›
 using A[THEN "Ordinary.∀E", THEN "→E",
 OF u'_prop[THEN "&E"(1), THEN "&E"(1)],
 THEN "equi:1"[THEN "≡E"(1)]].
 then AOT_obtain t where
 t_prop: ‹[G]t & [R]u't & ∀v ([G]v & [R]u'v → v =_E t)›
 using "Ordinary.∃E"[rotated] by meson
 AOT_have ‹v =_E t› if ‹[G]v› and ‹[R]u'v› for v
 using t_prop[THEN "&E"(2), THEN "Ordinary.∀E", THEN "→E",
 OF "&I", OF that].
 AOT_hence ‹v' =_E t› and ‹v =_E t›
 by (auto simp: gt_t_noteq_v[THEN "&E"(1)] Ru'v gv
 u'_prop[THEN "&E"(1), THEN "&E"(2)])
 AOT_hence ‹v' =_E v›
 using "rule=E" "=E-simple:2" id_sym "→E" by fast
 AOT_thus ‹v' =_E v & ¬v' =_E v›
 using v'_noteq_v "&I" by blast
 qed
 next
 fix t
 AOT_assume 0: ‹[[F]^-^u]t & [R]tv'›
 moreover AOT_have ‹[F]t & t ≠_E u›
 apply (rule "β→C"(1)[where κ₁κ_n="AOT_term_of_var (Ordinary.Rep t)"])
 apply (rule Π_minus_κE)
 by (fact 0[THEN "&E"(1)])
 ultimately AOT_show ‹t =_E u'›
 using u'_prop[THEN "&E"(2), THEN "Ordinary.∀E", THEN "→E", OF "&I"]
 "&E" by blast
 qed
 qed
 AOT_hence ‹∃R R |: [F]^-^u ₁_-₁⟷_E [G]^-^v›
 by (rule "∃I")
 } note 1 = this
 moreover {
 AOT_assume not_Ruv: ‹¬[R]uv›
 AOT_have ‹∃!v ([G]v & [R]uv)›
 using A[THEN "Ordinary.∀E", THEN "→E", OF fu].
 then AOT_obtain b where
 b_prop: ‹O!b & ([G]b & [R]ub & ∀t([G]t & [R]ut → t =_E b))›
 using "equi:1"[THEN "≡E"(1)] "∃E"[rotated] by fastforce
 AOT_hence ob: ‹O!b› and gb: ‹[G]b› and Rub: ‹[R]ub›
 using "&E" by blast+
 AOT_have ‹O!t → ([G]t & [R]ut → t =_E b)› for t
 using b_prop "&E"(2) "∀E"(2) by blast
 AOT_hence b_unique: ‹t =_E b› if ‹O!t› and ‹[G]t› and ‹[R]ut› for t
 by (metis Adjunction "modus-tollens:1" "reductio-aa:1" that)
 AOT_have not_v_eq_b: ‹¬(v =_E b)›
 proof(rule "raa-cor:2")
 AOT_assume ‹v =_E b›
 AOT_hence 0: ‹v = b›
 by (metis "=E-simple:2" "→E")
 AOT_have ‹[R]uv›
 using b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
 "rule=E"[rotated, OF 0[symmetric]] by fast
 AOT_thus ‹[R]uv & ¬[R]uv›
 using not_Ruv "&I" by blast
 qed
 AOT_have not_b_eq_v: ‹¬(b =_E v)›
 using "modus-tollens:1" not_v_eq_b "ord=Eequiv:2" by blast
 AOT_have ‹∃!u ([F]u & [R]uv)›
 using B[THEN "Ordinary.∀E", THEN "→E", OF gv].
 then AOT_obtain a where
 a_prop: ‹O!a & ([F]a & [R]av & ∀t([F]t & [R]tv → t =_E a))›
 using "equi:1"[THEN "≡E"(1)] "∃E"[rotated] by fastforce
 AOT_hence Oa: ‹O!a› and fa: ‹[F]a› and Rav: ‹[R]av›
 using "&E" by blast+
 AOT_have ‹O!t → ([F]t & [R]tv → t =_E a)› for t
 using a_prop "&E" "∀E"(2) by blast
 AOT_hence a_unique: ‹t =_E a› if ‹O!t› and ‹[F]t› and ‹[R]tv› for t
 by (metis Adjunction "modus-tollens:1" "reductio-aa:1" that)
 AOT_have not_u_eq_a: ‹¬(u =_E a)›
 proof(rule "raa-cor:2")
 AOT_assume ‹u =_E a›
 AOT_hence 0: ‹u = a›
 by (metis "=E-simple:2" "→E")
 AOT_have ‹[R]uv›
 using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
 "rule=E"[rotated, OF 0[symmetric]] by fast
 AOT_thus ‹[R]uv & ¬[R]uv›
 using not_Ruv "&I" by blast
 qed
 AOT_have not_a_eq_u: ‹¬(a =_E u)›
 using "modus-tollens:1" not_u_eq_a "ord=Eequiv:2" by blast
 let ?R = ‹«[λu'v' (u' ≠_E u & v' ≠_E v & [R]u'v') ∨
(u' =_E a & v' =_E b) ∨
(u' =_E u & v' =_E v)]¬›
 AOT_have ‹[«?R¬]↓› by "cqt:2[lambda]"
 AOT_hence ‹∃ β β = [«?R¬]›
 using "free-thms:1" "≡E"(1) by fast
 then AOT_obtain R₁ where R₁_def: ‹R₁ = [«?R¬]›
 using "∃E"[rotated] by blast
 AOT_have Rxy1: ‹[R]xy› if ‹[R₁]xy› and ‹x ≠_E u› and ‹x ≠_E a› for x y
 proof -
 AOT_have 0: ‹[«?R¬]xy›
 by (rule "rule=E"[rotated, OF R₁_def]) (fact that(1))
 AOT_have ‹(x ≠_E u & y ≠_E v & [R]xy) ∨ (x =_E a & y =_E b) ∨ (x =_E u & y =_E v)›
 using "β→C"(1)[OF 0] by simp
 AOT_hence ‹x ≠_E u & y ≠_E v & [R]xy› using that(2,3)
 by (metis "∨E"(3) "Conjunction Simplification"(1) "≡E"(1)
 "modus-tollens:1" "thm-neg=E")
 AOT_thus ‹[R]xy› using "&E" by blast+
 qed
 AOT_have Rxy2: ‹[R]xy› if ‹[R₁]xy› and ‹y ≠_E v› and ‹y ≠_E b› for x y
 proof -
 AOT_have 0: ‹[«?R¬]xy›
 by (rule "rule=E"[rotated, OF R₁_def]) (fact that(1))
 AOT_have ‹(x ≠_E u & y ≠_E v & [R]xy) ∨ (x =_E a & y =_E b) ∨ (x =_E u & y =_E v)›
 using "β→C"(1)[OF 0] by simp
 AOT_hence ‹x ≠_E u & y ≠_E v & [R]xy›
 using that(2,3)
 by (metis "∨E"(3) "Conjunction Simplification"(2) "≡E"(1)
 "modus-tollens:1" "thm-neg=E")
 AOT_thus ‹[R]xy› using "&E" by blast+
 qed
 AOT_have R₁xy: ‹[R₁]xy› if ‹[R]xy› and ‹x ≠_E u› and ‹y ≠_E v› for x y
 by (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 (auto intro!: "β←C"(1) "cqt:2"
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" that "∨I"(1))
 AOT_have R₁ab: ‹[R₁]ab›
 apply (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 apply (safe intro!: "β←C"(1) "cqt:2" prod_denotesI "&I")
 by (meson a_prop b_prop "&I" "&E"(1) "∨I"(1) "∨I"(2) "ord=Eequiv:1" "→E")
 AOT_have R₁uv: ‹[R₁]uv›
 apply (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 apply (safe intro!: "β←C"(1) "cqt:2" prod_denotesI "&I")
 by (meson "&I" "∨I"(2) "ord=Eequiv:1" Ordinary.ψ "→E")
 moreover AOT_have ‹R₁ |: F ₁_-₁⟷_E G›
 proof (safe intro!: "equi:2"[THEN "≡_d_fI"] "&I" "cqt:2" Ordinary.GEN "→I")
 fix u'
 AOT_assume fu': ‹[F]u'›
 {
 AOT_assume not_u'_eq_u: ‹¬(u' =_E u)› and not_u'_eq_a: ‹¬(u' =_E a)›
 AOT_hence u'_noteq_u: ‹u' ≠_E u› and u'_noteq_a: ‹u' ≠_E a›
 by (metis "≡E"(2) "thm-neg=E")+
 AOT_have ‹∃!v ([G]v & [R]u'v)›
 using A[THEN "Ordinary.∀E", THEN "→E", OF fu'].
 AOT_hence ‹∃v ([G]v & [R]u'v & ∀t ([G]t & [R]u't → t =_E v))›
 using "equi:1"[THEN "≡E"(1)] by simp
 then AOT_obtain v' where
 v'_prop: ‹[G]v' & [R]u'v' & ∀t ([G]t & [R]u't → t =_E v')›
 using "Ordinary.∃E"[rotated] by meson
 AOT_hence gv': ‹[G]v'› and Ru'v': ‹[R]u'v'›
 using "&E" by blast+
 AOT_have not_v'_eq_v: ‹¬v' =_E v›
 proof (rule "raa-cor:2")
 AOT_assume ‹v' =_E v›
 AOT_hence ‹v' = v›
 by (metis "=E-simple:2" "→E")
 AOT_hence Ru'v: ‹[R]u'v›
 using "rule=E" Ru'v' by fast
 AOT_have ‹u' =_E a›
 using a_unique[OF Ordinary.ψ, OF fu', OF Ru'v].
 AOT_thus ‹u' =_E a & ¬u' =_E a›
 using not_u'_eq_a "&I" by blast
 qed
 AOT_hence v'_noteq_v: ‹v' ≠_E v›
 using "≡E"(2) "thm-neg=E" by blast
 AOT_have ‹∀t ([G]t & [R]u't → t =_E v')›
 using v'_prop "&E" by blast
 AOT_hence ‹[G]t & [R]u't → t =_E v'› for t
 using "Ordinary.∀E" by meson
 AOT_hence v'_unique: ‹t =_E v'› if ‹[G]t› and ‹[R]u't› for t
 by (metis "&I" that "→E")

 AOT_have ‹[G]v' & [R₁]u'v' & ∀t ([G]t & [R₁]u't → t =_E v')›
 proof (safe intro!: "&I" gv' R₁xy Ru'v' u'_noteq_u u'_noteq_a "→I"
 Ordinary.GEN "thm-neg=E"[THEN "≡E"(2)] not_v'_eq_v)
 fix t
 AOT_assume 1: ‹[G]t & [R₁]u't›
 AOT_have ‹[R]u't›
 using Rxy1[OF 1[THEN "&E"(2)], OF u'_noteq_u, OF u'_noteq_a].
 AOT_thus ‹t =_E v'›
 using v'_unique 1[THEN "&E"(1)] by blast
 qed
 AOT_hence ‹∃v ([G]v & [R₁]u'v & ∀t ([G]t & [R₁]u't → t =_E v))›
 by (rule "Ordinary.∃I")
 AOT_hence ‹∃!v ([G]v & [R₁]u'v)›
 by (rule "equi:1"[THEN "≡E"(2)])
 }
 moreover {
 AOT_assume 0: ‹u' =_E u›
 AOT_hence u'_eq_u: ‹u' = u›
 using "=E-simple:2" "→E" by blast
 AOT_have ‹∃!v ([G]v & [R₁]u'v)›
 proof (safe intro!: "equi:1"[THEN "≡E"(2)] "Ordinary.∃I"[where β=v]
 "&I" Ordinary.GEN "→I" gv)
 AOT_show ‹[R₁]u'v›
 apply (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 apply (safe intro!: "β←C"(1) "cqt:2" "&I" prod_denotesI)
 by (safe intro!: "∨I"(2) "&I" 0 "ord=Eequiv:1"[THEN "→E", OF Ordinary.ψ])
 next
 fix v'
 AOT_assume ‹[G]v' & [R₁]u'v'›
 AOT_hence 0: ‹[R₁]uv'›
 using "rule=E"[rotated, OF u'_eq_u] "&E"(2) by fast
 AOT_have 1: ‹[«?R¬]uv'›
 by (rule "rule=E"[rotated, OF R₁_def]) (fact 0)
 AOT_have 2: ‹(u ≠_E u & v' ≠_E v & [R]uv') ∨
(u =_E a & v' =_E b) ∨
(u =_E u & v' =_E v)›
 using "β→C"(1)[OF 1] by simp
 AOT_have ‹¬u ≠_E u›
 using "≡E"(4) "modus-tollens:1" "ord=Eequiv:1" Ordinary.ψ
 "reductio-aa:2" "thm-neg=E" by blast
 AOT_hence ‹¬((u ≠_E u & v' ≠_E v & [R]uv') ∨ (u =_E a & v' =_E b))›
 using not_u_eq_a
 by (metis "∨E"(2) "Conjunction Simplification"(1)
 "modus-tollens:1" "reductio-aa:1")
 AOT_hence ‹(u =_E u & v' =_E v)›
 using 2 by (metis "∨E"(2))
 AOT_thus ‹v' =_E v›
 using "&E" by blast
 qed
 }
 moreover {
 AOT_assume 0: ‹u' =_E a›
 AOT_hence u'_eq_a: ‹u' = a›
 using "=E-simple:2" "→E" by blast
 AOT_have ‹∃!v ([G]v & [R₁]u'v)›
 proof (safe intro!: "equi:1"[THEN "≡E"(2)] "∃I"(2)[where β=b] "&I"
 Ordinary.GEN "→I" b_prop[THEN "&E"(1)]
 b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)])
 AOT_show ‹[R₁]u'b›
 apply (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 apply (safe intro!: "β←C"(1) "cqt:2" "&I" prod_denotesI)
 apply (rule "∨I"(1); rule "∨I"(2); rule "&I")
 apply (fact 0)
 using b_prop "&E"(1) "ord=Eequiv:1" "→E" by blast
 next
 fix v'
 AOT_assume gv'_R1u'v': ‹[G]v' & [R₁]u'v'›
 AOT_hence 0: ‹[R₁]av'›
 using u'_eq_a by (meson "rule=E" "&E"(2))
 AOT_have 1: ‹[«?R¬]av'›
 by (rule "rule=E"[rotated, OF R₁_def]) (fact 0)
 AOT_have ‹(a ≠_E u & v' ≠_E v & [R]av') ∨
(a =_E a & v' =_E b) ∨
(a =_E u & v' =_E v)›
 using "β→C"(1)[OF 1] by simp
 moreover {
 AOT_assume 0: ‹a ≠_E u & v' ≠_E v & [R]av'›
 AOT_have ‹∃!v ([G]v & [R]u'v)›
 using A[THEN "Ordinary.∀E", THEN "→E", OF fu'].
 AOT_hence ‹∃!v ([G]v & [R]av)›
 using u'_eq_a "rule=E" by fast
 AOT_hence ‹∃v ([G]v & [R]av & ∀t ([G]t & [R]at → t =_E v))›
 using "equi:1"[THEN "≡E"(1)] by fast
 then AOT_obtain s where
 s_prop: ‹[G]s & [R]as & ∀t ([G]t & [R]at → t =_E s)›
 using "Ordinary.∃E"[rotated] by meson
 AOT_have ‹v' =_E s›
 using s_prop[THEN "&E"(2), THEN "Ordinary.∀E"]
 gv'_R1u'v'[THEN "&E"(1)] 0[THEN "&E"(2)]
 by (metis "&I" "vdash-properties:10")
 moreover AOT_have ‹v =_E s›
 using s_prop[THEN "&E"(2), THEN "Ordinary.∀E"] gv Rav
 by (metis "&I" "→E")
 ultimately AOT_have ‹v' =_E v›
 by (metis "&I" "ord=Eequiv:2" "ord=Eequiv:3" "→E")
 moreover AOT_have ‹¬(v' =_E v)›
 using 0[THEN "&E"(1), THEN "&E"(2)]
 by (metis "≡E"(1) "thm-neg=E")
 ultimately AOT_have ‹v' =_E b›
 by (metis "raa-cor:3")
 }
 moreover {
 AOT_assume ‹a =_E u & v' =_E v›
 AOT_hence ‹v' =_E b›
 by (metis "&E"(1) not_a_eq_u "reductio-aa:1")
 }
 ultimately AOT_show ‹v' =_E b›
 by (metis "&E"(2) "∨E"(3) "reductio-aa:1")
 qed
 }
 ultimately AOT_show ‹∃!v ([G]v & [R₁]u'v)›
 by (metis "raa-cor:1")
 next
 fix v'
 AOT_assume gv': ‹[G]v'›
 {
 AOT_assume not_v'_eq_v: ‹¬(v' =_E v)›
 and not_v'_eq_b: ‹¬(v' =_E b)›
 AOT_hence v'_noteq_v: ‹v' ≠_E v›
 and v'_noteq_b: ‹v' ≠_E b›
 by (metis "≡E"(2) "thm-neg=E")+
 AOT_have ‹∃!u ([F]u & [R]uv')›
 using B[THEN "Ordinary.∀E", THEN "→E", OF gv'].
 AOT_hence ‹∃u ([F]u & [R]uv' & ∀t ([F]t & [R]tv' → t =_E u))›
 using "equi:1"[THEN "≡E"(1)] by simp
 then AOT_obtain u' where
 u'_prop: ‹[F]u' & [R]u'v' & ∀t ([F]t & [R]tv' → t =_E u')›
 using "Ordinary.∃E"[rotated] by meson
 AOT_hence fu': ‹[F]u'› and Ru'v': ‹[R]u'v'›
 using "&E" by blast+
 AOT_have not_u'_eq_u: ‹¬u' =_E u›
 proof (rule "raa-cor:2")
 AOT_assume ‹u' =_E u›
 AOT_hence ‹u' = u›
 by (metis "=E-simple:2" "→E")
 AOT_hence Ruv': ‹[R]uv'›
 using "rule=E" Ru'v' by fast
 AOT_have ‹v' =_E b›
 using b_unique[OF Ordinary.ψ, OF gv', OF Ruv'].
 AOT_thus ‹v' =_E b & ¬v' =_E b›
 using not_v'_eq_b "&I" by blast
 qed
 AOT_hence u'_noteq_u: ‹u' ≠_E u›
 using "≡E"(2) "thm-neg=E" by blast
 AOT_have ‹∀t ([F]t & [R]tv' → t =_E u')›
 using u'_prop "&E" by blast
 AOT_hence ‹[F]t & [R]tv' → t =_E u'› for t
 using "Ordinary.∀E" by meson
 AOT_hence u'_unique: ‹t =_E u'› if ‹[F]t› and ‹[R]tv'› for t
 by (metis "&I" that "→E")

 AOT_have ‹[F]u' & [R₁]u'v' & ∀t ([F]t & [R₁]tv' → t =_E u')›
 proof (safe intro!: "&I" gv' R₁xy Ru'v' u'_noteq_u Ordinary.GEN "→I"
 "thm-neg=E"[THEN "≡E"(2)] not_v'_eq_v fu')
 fix t
 AOT_assume 1: ‹[F]t & [R₁]tv'›
 AOT_have ‹[R]tv'›
 using Rxy2[OF 1[THEN "&E"(2)], OF v'_noteq_v, OF v'_noteq_b].
 AOT_thus ‹t =_E u'›
 using u'_unique 1[THEN "&E"(1)] by blast
 qed
 AOT_hence ‹∃u ([F]u & [R₁]uv' & ∀t ([F]t & [R₁]tv' → t =_E u))›
 by (rule "Ordinary.∃I")
 AOT_hence ‹∃!u ([F]u & [R₁]uv')›
 by (rule "equi:1"[THEN "≡E"(2)])
 }
 moreover {
 AOT_assume 0: ‹v' =_E v›
 AOT_hence u'_eq_u: ‹v' = v›
 using "=E-simple:2" "→E" by blast
 AOT_have ‹∃!u ([F]u & [R₁]uv')›
 proof (safe intro!: "equi:1"[THEN "≡E"(2)] "Ordinary.∃I"[where β=u]
 "&I" Ordinary.GEN "→I" fu)
 AOT_show ‹[R₁]uv'›
 by (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 (safe intro!: "β←C"(1) "cqt:2" "&I" prod_denotesI Ordinary.ψ
 "∨I"(2) 0 "ord=Eequiv:1"[THEN "→E"])
 next
 fix u'
 AOT_assume ‹[F]u' & [R₁]u'v'›
 AOT_hence 0: ‹[R₁]u'v›
 using "rule=E"[rotated, OF u'_eq_u] "&E"(2) by fast
 AOT_have 1: ‹[«?R¬]u'v›
 by (rule "rule=E"[rotated, OF R₁_def]) (fact 0)
 AOT_have 2: ‹(u' ≠_E u & v ≠_E v & [R]u'v) ∨
(u' =_E a & v =_E b) ∨
(u' =_E u & v =_E v)›
 using "β→C"(1)[OF 1, simplified] by simp
 AOT_have ‹¬v ≠_E v›
 using "≡E"(4) "modus-tollens:1" "ord=Eequiv:1" Ordinary.ψ
 "reductio-aa:2" "thm-neg=E" by blast
 AOT_hence ‹¬((u' ≠_E u & v ≠_E v & [R]u'v) ∨ (u' =_E a & v =_E b))›
 by (metis "&E"(1) "&E"(2) "∨E"(3) not_v_eq_b "raa-cor:3")
 AOT_hence ‹(u' =_E u & v =_E v)›
 using 2 by (metis "∨E"(2))
 AOT_thus ‹u' =_E u›
 using "&E" by blast
 qed
 }
 moreover {
 AOT_assume 0: ‹v' =_E b›
 AOT_hence v'_eq_b: ‹v' = b›
 using "=E-simple:2" "→E" by blast
 AOT_have ‹∃!u ([F]u & [R₁]uv')›
 proof (safe intro!: "equi:1"[THEN "≡E"(2)] "∃I"(2)[where β=a] "&I"
 Ordinary.GEN "→I" b_prop[THEN "&E"(1)] Oa fa
 b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)])
 AOT_show ‹[R₁]av'›
 apply (rule "rule=E"[rotated, OF R₁_def[symmetric]])
 apply (safe intro!: "β←C"(1) "cqt:2" "&I" prod_denotesI)
 apply (rule "∨I"(1); rule "∨I"(2); rule "&I")
 using Oa "ord=Eequiv:1" "→E" apply blast
 using "0" by blast
 next
 fix u'
 AOT_assume fu'_R1u'v': ‹[F]u' & [R₁]u'v'›
 AOT_hence 0: ‹[R₁]u'b›
 using v'_eq_b by (meson "rule=E" "&E"(2))
 AOT_have 1: ‹[«?R¬]u'b›
 by (rule "rule=E"[rotated, OF R₁_def]) (fact 0)
 AOT_have ‹(u' ≠_E u & b ≠_E v & [R]u'b) ∨
(u' =_E a & b =_E b) ∨
(u' =_E u & b =_E v)›
 using "β→C"(1)[OF 1, simplified] by simp
 moreover {
 AOT_assume 0: ‹u' ≠_E u & b ≠_E v & [R]u'b›
 AOT_have ‹∃!u ([F]u & [R]uv')›
 using B[THEN "Ordinary.∀E", THEN "→E", OF gv'].
 AOT_hence ‹∃!u ([F]u & [R]ub)›
 using v'_eq_b "rule=E" by fast
 AOT_hence ‹∃u ([F]u & [R]ub & ∀t ([F]t & [R]tb → t =_E u))›
 using "equi:1"[THEN "≡E"(1)] by fast
 then AOT_obtain s where
 s_prop: ‹[F]s & [R]sb & ∀t ([F]t & [R]tb → t =_E s)›
 using "Ordinary.∃E"[rotated] by meson
 AOT_have ‹u' =_E s›
 using s_prop[THEN "&E"(2), THEN "Ordinary.∀E"]
 fu'_R1u'v'[THEN "&E"(1)] 0[THEN "&E"(2)]
 by (metis "&I" "→E")
 moreover AOT_have ‹u =_E s›
 using s_prop[THEN "&E"(2), THEN "Ordinary.∀E"] fu Rub
 by (metis "&I" "→E")
 ultimately AOT_have ‹u' =_E u›
 by (metis "&I" "ord=Eequiv:2" "ord=Eequiv:3" "→E")
 moreover AOT_have ‹¬(u' =_E u)›
 using 0[THEN "&E"(1), THEN "&E"(1)] by (metis "≡E"(1) "thm-neg=E")
 ultimately AOT_have ‹u' =_E a›
 by (metis "raa-cor:3")
 }
 moreover {
 AOT_assume ‹u' =_E u & b =_E v›
 AOT_hence ‹u' =_E a›
 by (metis "&E"(2) not_b_eq_v "reductio-aa:1")
 }
 ultimately AOT_show ‹u' =_E a›
 by (metis "&E"(1) "∨E"(3) "reductio-aa:1")
 qed
 }
 ultimately AOT_show ‹∃!u ([F]u & [R₁]uv')›
 by (metis "raa-cor:1")
 qed
 ultimately AOT_have ‹∃R R |: [F]^-^u ₁_-₁⟷_E [G]^-^v›
 using 1 by blast
 }
 ultimately AOT_have ‹∃R R |: [F]^-^u ₁_-₁⟷_E [G]^-^v›
 using R_prop by (metis "reductio-aa:2")
 AOT_thus ‹[F]^-^u ≈_E [G]^-^v›
 by (rule "equi:3"[THEN "≡_d_fI"])
qed

AOT_theorem "P'-eq": ‹[F]^-^u ≈_E [G]^-^v & [F]u & [G]v → F ≈_E G›
proof(safe intro!: "→I"; frule "&E"(1); drule "&E"(2);
 frule "&E"(1); drule "&E"(2))
 AOT_have ‹[λz [Π]z & z ≠_E κ]↓› for Π κ by "cqt:2[lambda]"
 note Π_minus_κI = "rule-id-df:2:b[2]"[
 where τ=‹(λ(Π, κ). «[Π]^-^\κ¬)›, simplified, OF "F-u", simplified, OF this]
 and Π_minus_κE = "rule-id-df:2:a[2]"[
 where τ=‹(λ(Π, κ). «[Π]^-^\κ¬)›, simplified, OF "F-u", simplified, OF this]
 AOT_have Π_minus_κ_den: ‹[Π]^-^\κ↓› for Π κ
 by (rule Π_minus_κI) "cqt:2[lambda]"+

 AOT_have Π_minus_κE1: ‹[Π]κ'›
 and Π_minus_κE2: ‹κ' ≠_E κ› if ‹[[Π]^-^\κ]κ'› for Π κ κ'
 proof -
 AOT_have ‹[λz [Π]z & z ≠_E κ]κ'›
 using Π_minus_κE that by fast
 AOT_hence ‹[Π]κ' & κ' ≠_E κ›
 by (rule "β→C"(1))
 AOT_thus ‹[Π]κ'› and ‹κ' ≠_E κ›
 using "&E" by blast+
 qed
 AOT_have Π_minus_κI': ‹[[Π]^-^\κ]κ'› if ‹[Π]κ'› and ‹κ' ≠_E κ› for Π κ κ'
 proof -
 AOT_have κ'_den: ‹κ'↓›
 by (metis "russell-axiom[exe,1].ψ_denotes_asm" that(1))
 AOT_have ‹[λz [Π]z & z ≠_E κ]κ'›
 by (safe intro!: "β←C"(1) "cqt:2" κ'_den "&I" that)
 AOT_thus ‹[[Π]^-^\κ]κ'›
 using Π_minus_κI by fast
 qed

 AOT_assume Gv: ‹[G]v›
 AOT_assume Fu: ‹[F]u›
 AOT_assume ‹[F]^-^u ≈_E [G]^-^v›
 AOT_hence ‹∃R R |: [F]^-^u ₁_-₁⟷_E [G]^-^v›
 using "equi:3"[THEN "≡_d_fE"] by blast
 then AOT_obtain R where R_prop: ‹R |: [F]^-^u ₁_-₁⟷_E [G]^-^v›
 using "∃E"[rotated] by blast
 AOT_hence Fact1: ‹∀r([[F]^-^u]r → ∃!s ([[G]^-^v]s & [R]rs))›
 and Fact1': ‹∀s([[G]^-^v]s → ∃!r ([[F]^-^u]r & [R]rs))›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
 AOT_have ‹R |: [F]^-^u ₁_-₁⟶_o_n_t_oE [G]^-^v›
 using "equi-rem-thm"[unvarify F G, OF Π_minus_κ_den, OF Π_minus_κ_den,
 THEN "≡E"(1), OF R_prop].
 AOT_hence ‹R |: [F]^-^u ₁_-₁⟶E [G]^-^v & R |: [F]^-^u ⟶_o_n_t_oE [G]^-^v›
 using "equi-rem:4"[THEN "≡_d_fE"] by blast
 AOT_hence Fact2:
 ‹∀r∀s∀t(([[F]^-^u]r & [[F]^-^u]s & [[G]^-^v]t) → ([R]rt & [R]st → r =_E s))›
 using "equi-rem:2"[THEN "≡_d_fE"] "&E" by blast

 let ?R = ‹«[λxy ([[F]^-^u]x & [[G]^-^v]y & [R]xy) ∨ (x =_E u & y =_E v)]¬›
 AOT_have R_den: ‹«?R¬↓› by "cqt:2[lambda]"

 AOT_show ‹F ≈_E G›
 proof(safe intro!: "equi:3"[THEN "≡_d_fI"] "∃I"(1)[where τ="?R"] R_den
 "equi:2"[THEN "≡_d_fI"] "&I" "cqt:2" Ordinary.GEN "→I")
 fix r
 AOT_assume Fr: ‹[F]r›
 {
 AOT_assume not_r_eq_u: ‹¬(r =_E u)›
 AOT_hence r_noteq_u: ‹r ≠_E u›
 using "≡E"(2) "thm-neg=E" by blast
 AOT_have ‹[[F]^-^u]r›
 by(rule Π_minus_κI; safe intro!: "β←C"(1) "cqt:2" "&I" Fr r_noteq_u)
 AOT_hence ‹∃!s ([[G]^-^v]s & [R]rs)›
 using Fact1[THEN "∀E"(2)] "→E" Ordinary.ψ by blast
 AOT_hence ‹∃s ([[G]^-^v]s & [R]rs & ∀t ([[G]^-^v]t & [R]rt → t =_E s))›
 using "equi:1"[THEN "≡E"(1)] by simp
 then AOT_obtain s where s_prop: ‹[[G]^-^v]s & [R]rs & ∀t ([[G]^-^v]t & [R]rt >→ t =_E s)›
 using "Ordinary.∃E"[rotated] by meson
 AOT_hence G_minus_v_s: ‹[[G]^-^v]s› and Rrs: ‹[R]rs›
 using "&E" by blast+
 AOT_have s_unique: ‹t =_E s› if ‹[[G]^-^v]t› and ‹[R]rt› for t
 using s_prop[THEN "&E"(2), THEN "Ordinary.∀E", THEN "→E", OF "&I", OF that].
 AOT_have Gs: ‹[G]s›
 using Π_minus_κE1[OF G_minus_v_s].
 AOT_have s_noteq_v: ‹s ≠_E v›
 using Π_minus_κE2[OF G_minus_v_s].
 AOT_have ‹∃s ([G]s & [«?R¬]rs & (∀t ([G]t & [«?R¬]rt → t =_E s)))›
 proof(safe intro!: "Ordinary.∃I"[where β=s] "&I" Gs Ordinary.GEN "→I")
 AOT_show ‹[«?R¬]rs›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" "∨I"(1) Π_minus_κI' Fr Gs
 s_noteq_v Rrs r_noteq_u
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
 next
 fix t
 AOT_assume 0: ‹[G]t & [«?R¬]rt›
 AOT_hence ‹([[F]^-^u]r & [[G]^-^v]t & [R]rt) ∨ (r =_E u & t =_E v)›
 using "β→C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
 AOT_hence 1: ‹[[F]^-^u]r & [[G]^-^v]t & [R]rt›
 using not_r_eq_u by (metis "&E"(1) "∨E"(3) "reductio-aa:1")
 AOT_show ‹t =_E s› using s_unique 1 "&E" by blast
 qed
 }
 moreover {
 AOT_assume r_eq_u: ‹r =_E u›
 AOT_have ‹∃s ([G]s & [«?R¬]rs & (∀t ([G]t & [«?R¬]rt → t =_E s)))›
 proof(safe intro!: "Ordinary.∃I"[where β=v] "&I" Gv Ordinary.GEN "→I")
 AOT_show ‹[«?R¬]rv›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" "∨I"(2) Π_minus_κI' Fr r_eq_u
 "ord=Eequiv:1"[THEN "→E"] Ordinary.ψ
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
 next
 fix t
 AOT_assume 0: ‹[G]t & [«?R¬]rt›
 AOT_hence ‹([[F]^-^u]r & [[G]^-^v]t & [R]rt) ∨ (r =_E u & t =_E v)›
 using "β→C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
 AOT_hence ‹r =_E u & t =_E v›
 using r_eq_u Π_minus_κE2
 by (metis "&E"(1) "∨E"(2) "≡E"(1) "reductio-aa:1" "thm-neg=E")
 AOT_thus ‹t =_E v› using "&E" by blast
 qed
 }
 ultimately AOT_show ‹∃!s ([G]s & [«?R¬]rs)›
 using "reductio-aa:2" "equi:1"[THEN "≡E"(2)] by fast
 next
 fix s
 AOT_assume Gs: ‹[G]s›

 {
 AOT_assume not_s_eq_v: ‹¬(s =_E v)›
 AOT_hence s_noteq_v: ‹s ≠_E v›
 using "≡E"(2) "thm-neg=E" by blast
 AOT_have ‹[[G]^-^v]s›
 by (rule Π_minus_κI; auto intro!: "β←C"(1) "cqt:2" "&I" Gs s_noteq_v)
 AOT_hence ‹∃!r ([[F]^-^u]r & [R]rs)›
 using Fact1'[THEN "Ordinary.∀E"] "→E" by blast
 AOT_hence ‹∃r ([[F]^-^u]r & [R]rs & ∀t ([[F]^-^u]t & [R]ts → t =_E r))›
 using "equi:1"[THEN "≡E"(1)] by simp
 then AOT_obtain r where
 r_prop: ‹[[F]^-^u]r & [R]rs & ∀t ([[F]^-^u]t & [R]ts → t =_E r)›
 using "Ordinary.∃E"[rotated] by meson
 AOT_hence F_minus_u_r: ‹[[F]^-^u]r› and Rrs: ‹[R]rs›
 using "&E" by blast+
 AOT_have r_unique: ‹t =_E r› if ‹[[F]^-^u]t› and ‹[R]ts› for t
 using r_prop[THEN "&E"(2), THEN "Ordinary.∀E",
 THEN "→E", OF "&I", OF that].
 AOT_have Fr: ‹[F]r›
 using Π_minus_κE1[OF F_minus_u_r].
 AOT_have r_noteq_u: ‹r ≠_E u›
 using Π_minus_κE2[OF F_minus_u_r].
 AOT_have ‹∃r ([F]r & [«?R¬]rs & (∀t ([F]t & [«?R¬]ts → t =_E r)))›
 proof(safe intro!: "Ordinary.∃I"[where β=r] "&I" Fr Ordinary.GEN "→I")
 AOT_show ‹[«?R¬]rs›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" "∨I"(1) Π_minus_κI' Fr
 Gs s_noteq_v Rrs r_noteq_u
 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
 next
 fix t
 AOT_assume 0: ‹[F]t & [«?R¬]ts›
 AOT_hence ‹([[F]^-^u]t & [[G]^-^v]s & [R]ts) ∨ (t =_E u & s =_E v)›
 using "β→C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
 AOT_hence 1: ‹[[F]^-^u]t & [[G]^-^v]s & [R]ts›
 using not_s_eq_v by (metis "&E"(2) "∨E"(3) "reductio-aa:1")
 AOT_show ‹t =_E r› using r_unique 1 "&E" by blast
 qed
 }
 moreover {
 AOT_assume s_eq_v: ‹s =_E v›
 AOT_have ‹∃r ([F]r & [«?R¬]rs & (∀t ([F]t & [«?R¬]ts → t =_E r)))›
 proof(safe intro!: "Ordinary.∃I"[where β=u] "&I" Fu Ordinary.GEN "→I")
 AOT_show ‹[«?R¬]us›
 by (auto intro!: "β←C"(1) "cqt:2" "&I" prod_denotesI "∨I"(2)
 Π_minus_κI' Gs s_eq_v Ordinary.ψ
 "ord=Eequiv:1"[THEN "→E"])
 next
 fix t
 AOT_assume 0: ‹[F]t & [«?R¬]ts›
 AOT_hence 1: ‹([[F]^-^u]t & [[G]^-^v]s & [R]ts) ∨ (t =_E u & s =_E v)›
 using "β→C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
 moreover AOT_have ‹¬([[F]^-^u]t & [[G]^-^v]s & [R]ts)›
 proof (rule "raa-cor:2")
 AOT_assume ‹([[F]^-^u]t & [[G]^-^v]s & [R]ts)›
 AOT_hence ‹[[G]^-^v]s› using "&E" by blast
 AOT_thus ‹s =_E v & ¬(s =_E v)›
 by (metis Π_minus_κE2 "≡E"(4) "reductio-aa:1" s_eq_v "thm-neg=E")
 qed
 ultimately AOT_have ‹t =_E u & s =_E v›
 by (metis "∨E"(2))
 AOT_thus ‹t =_E u› using "&E" by blast
 qed
 }
 ultimately AOT_show ‹∃!r ([F]r & [«?R¬]rs)›
 using "≡E"(2) "equi:1" "reductio-aa:2" by fast
 qed
qed

AOT_theorem "approx-cont:1": ‹∃F∃G ♢(F ≈_E G & ♢¬F ≈_E G)›
proof -
 let ?P = ‹«[λx E!x & ¬\AE!x]¬›
 AOT_have ‹♢q₀ & ♢¬q₀› by (metis q₀_prop)
 AOT_hence 1: ‹♢∃x(E!x & ¬\AE!x) & ♢¬∃x(E!x & ¬\AE!x)›
 by (rule q₀_def[THEN "=_d_fE"(2), rotated])
 (simp add: "log-prop-prop:2")
 AOT_have θ: ‹♢∃x [«?P¬]x & ♢¬∃x [«?P¬]x›
 apply (AOT_subst ‹[«?P¬]x› ‹E!x & ¬\AE!x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"]; "cqt:2[lambda]")
 by (fact 1)
 show ?thesis
 proof (rule "∃I"(1))+
 AOT_have ‹♢[L]^- ≈_E [«?P¬] & ♢¬[L]^- ≈_E [«?P¬]›
 proof (rule "&I"; rule "RM♢"[THEN "→E"]; (rule "→I")?)
 AOT_modally_strict {
 AOT_assume A: ‹¬∃x [«?P¬]x›
 AOT_show ‹[L]^- ≈_E [«?P¬]›
 proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "→E"]
 "rel-neg-T:3" "&I")
 AOT_show ‹[«?P¬]↓› by "cqt:2[lambda]"
 next
 AOT_show ‹¬∃u [L^-]u›
 proof (rule "raa-cor:2")
 AOT_assume ‹∃u [L^-]u›
 then AOT_obtain u where ‹[L^-]u›
 using "Ordinary.∃E"[rotated] by blast
 moreover AOT_have ‹¬[L^-]u›
 using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "≡_d_fE"],
 THEN "&E"(2)]
 by (metis "qml:2"[axiom_inst] "rule-ui:3" "→E")
 ultimately AOT_show ‹p & ¬p› for p
 by (metis "raa-cor:3")
 qed
 next
 AOT_show ‹¬∃v [«?P¬]v›
 proof (rule "raa-cor:2")
 AOT_assume ‹∃v [«?P¬]v›
 then AOT_obtain u where ‹[«?P¬]u›
 using "Ordinary.∃E"[rotated] by blast
 AOT_hence ‹[«?P¬]u›
 using "&E" by blast
 AOT_hence ‹∃x [«?P¬]x›
 by (rule "∃I")
 AOT_thus ‹∃x [«?P¬]x & ¬∃x [«?P¬]x›
 using A "&I" by blast
 qed
 qed
 }
 next
 AOT_show ‹♢¬∃x [«?P¬]x›
 using θ "&E" by blast
 next
 AOT_modally_strict {
 AOT_assume A: ‹∃x [«?P¬]x›
 AOT_have B: ‹¬[«?P¬] ≈_E [L]^-›
 proof (safe intro!: "empty-approx:2"[unvarify F H, THEN "→E"]
 "rel-neg-T:3" "&I")
 AOT_show ‹[«?P¬]↓›
 by "cqt:2[lambda]"
 next
 AOT_obtain x where Px: ‹[«?P¬]x›
 using A "∃E" by blast
 AOT_hence ‹E!x & ¬\AE!x›
 by (rule "β→C"(1))
 AOT_hence 1: ‹♢E!x›
 by (metis "T♢" "&E"(1) "vdash-properties:10")
 AOT_have ‹[λx ♢E!x]x›
 by (auto intro!: "β←C"(1) "cqt:2" 1)
 AOT_hence ‹O!x›
 by (rule AOT_ordinary[THEN "=_d_fI"(2), rotated]) "cqt:2[lambda]"
 AOT_hence ‹O!x & [«?P¬]x›
 using Px "&I" by blast
 AOT_thus ‹∃u [«?P¬]u›
 by (rule "∃I")
 next
 AOT_show ‹¬∃u [L^-]u›
 proof (rule "raa-cor:2")
 AOT_assume ‹∃u [L^-]u›
 then AOT_obtain u where ‹[L^-]u›
 using "Ordinary.∃E"[rotated] by blast
 moreover AOT_have ‹¬[L^-]u›
 using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "≡_d_fE"]]
 by (metis "qml:2"[axiom_inst] "rule-ui:3" "→E" "&E"(2))
 ultimately AOT_show ‹p & ¬p› for p
 by (metis "raa-cor:3")
 qed
 qed
 AOT_show ‹¬[L]^- ≈_E [«?P¬]›
 proof (rule "raa-cor:2")
 AOT_assume ‹[L]^- ≈_E [«?P¬]›
 AOT_hence ‹[«?P¬] ≈_E [L]^-›
 apply (rule "eq-part:2"[unvarify F G, THEN "→E", rotated 2])
 apply "cqt:2[lambda]"
 by (simp add: "rel-neg-T:3")
 AOT_thus ‹[«?P¬] ≈_E [L]^- & ¬[«?P¬] ≈_E [L]^-›
 using B "&I" by blast
 qed
 }
 next
 AOT_show ‹♢∃x [«?P¬]x›
 using θ "&E" by blast
 qed
 AOT_thus ‹♢([L]^- ≈_E [«?P¬] & ♢¬[L]^- ≈_E [«?P¬])›
 using "S5Basic:11" "≡E"(2) by blast
 next
 AOT_show ‹[λx [E!]x & ¬\A[E!]x]↓›
 by "cqt:2"
 next
 AOT_show ‹[L]^-↓›
 by (simp add: "rel-neg-T:3")
 qed
qed

AOT_theorem "approx-cont:2":
 ‹∃F∃G ♢([λz \A[F]z] ≈_E G & ♢¬[λz \A[F]z] ≈_E G)›
proof -
 let ?P = ‹«[λx E!x & ¬\AE!x]¬›
 AOT_have ‹♢q₀ & ♢¬q₀› by (metis q₀_prop)
 AOT_hence 1: ‹♢∃x(E!x & ¬\AE!x) & ♢¬∃x(E!x & ¬\AE!x)›
 by (rule q₀_def[THEN "=_d_fE"(2), rotated])
 (simp add: "log-prop-prop:2")
 AOT_have θ: ‹♢∃x [«?P¬]x & ♢¬∃x [«?P¬]x›
 apply (AOT_subst ‹[«?P¬]x› ‹E!x & ¬\AE!x› for: x)
 apply (rule "beta-C-meta"[THEN "→E"]; "cqt:2")
 by (fact 1)
 show ?thesis
 proof (rule "∃I"(1))+
 AOT_have ‹♢[λz \A[L^-]z] ≈_E [«?P¬] & ♢¬[λz \A[L^-]z] ≈_E [«?P¬]›
 proof (rule "&I"; rule "RM♢"[THEN "→E"]; (rule "→I")?)
 AOT_modally_strict {
 AOT_assume A: ‹¬∃x [«?P¬]x›
 AOT_show ‹[λz \A[L^-]z] ≈_E [«?P¬]›
 proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "→E"]
 "rel-neg-T:3" "&I")
 AOT_show ‹[«?P¬]↓› by "cqt:2"
 next
 AOT_show ‹¬∃u [λz \A[L^-]z]u›
 proof (rule "raa-cor:2")
 AOT_assume ‹∃u [λz \A[L^-]z]u›
 then AOT_obtain u where ‹[λz \A[L^-]z]u›
 using "Ordinary.∃E"[rotated] by blast
 AOT_hence ‹\A[L^-]u›
 using "β→C"(1) "&E" by blast
 moreover AOT_have ‹◻¬[L^-]u›
 using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "≡_d_fE"]]
 by (metis RN "qml:2"[axiom_inst] "rule-ui:3" "→E" "&E"(2))
 ultimately AOT_show ‹p & ¬p› for p
 by (metis "Act-Sub:3" "KBasic2:1" "≡E"(1) "raa-cor:3" "→E")
 qed
 next
 AOT_show ‹¬∃v [«?P¬]v›
 proof (rule "raa-cor:2")
 AOT_assume ‹∃v [«?P¬]v›
 then AOT_obtain u where ‹[«?P¬]u›
 using "Ordinary.∃E"[rotated] by blast
 AOT_hence ‹[«?P¬]u›
 using "&E" by blast
 AOT_hence ‹∃x [«?P¬]x›
 by (rule "∃I")
 AOT_thus ‹∃x [«?P¬]x & ¬∃x [«?P¬]x›
 using A "&I" by blast
 qed
 next
 AOT_show ‹[λz \A[L^-]z]↓› by "cqt:2"
 qed
 }
 next
 AOT_show ‹♢¬∃x [«?P¬]x› using θ "&E" by blast
 next
 AOT_modally_strict {
 AOT_assume A: ‹∃x [«?P¬]x›
 AOT_have B: ‹¬[«?P¬] ≈_E [λz \A[L^-]z]›
 proof (safe intro!: "empty-approx:2"[unvarify F H, THEN "→E"]
 "rel-neg-T:3" "&I")
 AOT_show ‹[«?P¬]↓› by "cqt:2"
 next
 AOT_obtain x where Px: ‹[«?P¬]x›
 using A "∃E" by blast
 AOT_hence ‹E!x & ¬\AE!x›
 by (rule "β→C"(1))
 AOT_hence ‹♢E!x›
 by (metis "T♢" "&E"(1) "→E")
 AOT_hence ‹[λx ♢E!x]x›
 by (auto intro!: "β←C"(1) "cqt:2")
 AOT_hence ‹O!x›
 by (rule AOT_ordinary[THEN "=_d_fI"(2), rotated]) "cqt:2"
 AOT_hence ‹O!x & [«?P¬]x›
 using Px "&I" by blast
 AOT_thus ‹∃u [«?P¬]u›
 by (rule "∃I")
 next
 AOT_show ‹¬∃u [λz \A[L^-]z]u›
 proof (rule "raa-cor:2")
 AOT_assume ‹∃u [λz \A[L^-]z]u›
 then AOT_obtain u where ‹[λz \A[L^-]z]u›
 using "Ordinary.∃E"[rotated] by blast
 AOT_hence ‹\A[L^-]u›
 using "β→C"(1) "&E" by blast
 moreover AOT_have ‹◻¬[L^-]u›
 using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "≡_d_fE"]]
 by (metis RN "qml:2"[axiom_inst] "rule-ui:3" "→E" "&E"(2))
 ultimately AOT_show ‹p & ¬p› for p
 by (metis "Act-Sub:3" "KBasic2:1" "≡E"(1) "raa-cor:3" "→E")
 qed
 next
 AOT_show ‹[λz \A[L^-]z]↓› by "cqt:2"
 qed
 AOT_show ‹¬[λz \A[L^-]z] ≈_E [«?P¬]›
 proof (rule "raa-cor:2")
 AOT_assume ‹[λz \A[L^-]z] ≈_E [«?P¬]›
 AOT_hence ‹[«?P¬] ≈_E [λz \A[L^-]z]›
 by (rule "eq-part:2"[unvarify F G, THEN "→E", rotated 2])
 "cqt:2"+
 AOT_thus ‹[«?P¬] ≈_E [λz \A[L^-]z] & ¬[«?P¬] ≈_E [λz \A[L^-]z]›
 using B "&I" by blast
 qed
 }
 next
 AOT_show ‹♢∃x [«?P¬]x›
 using θ "&E" by blast
 qed
 AOT_thus ‹♢([λz \A[L^-]z] ≈_E [«?P¬] & ♢¬[λz \A[L^-]z] ≈_E [«?P¬])›
 using "S5Basic:11" "≡E"(2) by blast
 next
 AOT_show ‹[λx [E!]x & ¬\A[E!]x]↓› by "cqt:2"
 next
 AOT_show ‹[L]^-↓›
 by (simp add: "rel-neg-T:3")
 qed
qed

notepad
begin
 text‹We already have defined being equivalent on the ordinary objects in the
Extended Relation Comprehension theory.›
 AOT_have ‹F ≡_E G ≡_d_f F↓ & G↓ & ∀u ([F]u ≡ [G]u)› for F G
 using eqE by blast
end

AOT_theorem "apE-eqE:1": ‹F ≡_E G → F ≈_E G›
proof(rule "→I")
 AOT_assume 0: ‹F ≡_E G›
 AOT_have ‹∃R R |: F ₁_-₁⟷_E G›
 proof (safe intro!: "∃I"(1)[where τ="«(=_E)¬"] "equi:2"[THEN "≡_d_fI"] "&I"
 "=E[denotes]" "cqt:2[const_var]"[axiom_inst] Ordinary.GEN
 "→I" "equi:1"[THEN "≡E"(2)])
 fix u
 AOT_assume Fu: ‹[F]u›
 AOT_hence Gu: ‹[G]u›
 using "≡_d_fE"[OF eqE, OF 0, THEN "&E"(2),
 THEN "Ordinary.∀E"[where α=u], THEN "≡E"(1)]
 Ordinary.ψ Fu by blast
 AOT_show ‹∃v ([G]v & u =_E v & ∀v' ([G]v' & u =_E v' → v' =_E v))›
 by (safe intro!: "Ordinary.∃I"[where β=u] "&I" GEN "→I" Ordinary.ψ Gu
 "ord=Eequiv:1"[THEN "→E", OF Ordinary.ψ]
 "ord=Eequiv:2"[THEN "→E"] dest!: "&E"(2))
 next
 fix v
 AOT_assume Gv: ‹[G]v›
 AOT_hence Fv: ‹[F]v›
 using "≡_d_fE"[OF eqE, OF 0, THEN "&E"(2),
 THEN "Ordinary.∀E"[where α=v], THEN "≡E"(2)]
 Ordinary.ψ Gv by blast
 AOT_show ‹∃u ([F]u & u =_E v & ∀v' ([F]v' & v' =_E v → v' =_E u))›
 by (safe intro!: "Ordinary.∃I"[where β=v] "&I" GEN "→I" Ordinary.ψ Fv
 "ord=Eequiv:1"[THEN "→E", OF Ordinary.ψ]
 "ord=Eequiv:2"[THEN "→E"] dest!: "&E"(2))
 qed
 AOT_thus ‹F ≈_E G›
 by (rule "equi:3"[THEN "≡_d_fI"])
qed

AOT_theorem "apE-eqE:2": ‹(F ≈_E G & G ≡_E H) → F ≈_E H›
proof(rule "→I")
 AOT_assume ‹F ≈_E G & G ≡_E H›
 AOT_hence ‹F ≈_E G› and ‹G ≈_E H›
 using "apE-eqE:1"[THEN "→E"] "&E" by blast+
 AOT_thus ‹F ≈_E H›
 by (metis Adjunction "eq-part:3" "vdash-properties:10")
qed

AOT_act_theorem "eq-part-act:1": ‹[λz \A[F]z] ≡_E F›
proof (safe intro!: eqE[THEN "≡_d_fI"] "&I" "cqt:2" Ordinary.GEN "→I")
 fix u
 AOT_have ‹[λz \A[F]z]u ≡ \A[F]u›
 by (rule "beta-C-meta"[THEN "→E"]) "cqt:2[lambda]"
 also AOT_have ‹… ≡ [F]u›
 using "act-conj-act:4" "logic-actual"[act_axiom_inst, THEN "→E"] by blast
 finally AOT_show ‹[λz \A[F]z]u ≡ [F]u›.
qed

AOT_act_theorem "eq-part-act:2": ‹[λz \A[F]z] ≈_E F›
 by (safe intro!: "apE-eqE:1"[unvarify F, THEN "→E"] "eq-part-act:1") "cqt:2"

AOT_theorem "actuallyF:1": ‹\A(F ≈_E [λz \A[F]z])›
proof -
 AOT_have 1: ‹\A([F]x ≡ \A[F]x)› for x
 by (meson "Act-Basic:5" "act-conj-act:4" "≡E"(2) "Commutativity of ≡")
 AOT_have ‹\A([F]x ≡ [λz \A[F]z]x)› for x
 apply (AOT_subst ‹[λz \A[F]z]x› ‹\A[F]x›)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 by (fact 1)
 AOT_hence ‹O!x → \A([F]x ≡ [λz \A[F]z]x)› for x
 by (metis "→I")
 AOT_hence ‹∀u \A([F]u ≡ [λz \A[F]z]u)›
 using "∀I" by fast
 AOT_hence 1: ‹\A∀u ([F]u ≡ [λz \A[F]z]u)›
 by (metis "Ordinary.res-var-bound-reas[2]" "→E")
 AOT_modally_strict {
 AOT_have ‹[λz \A[F]z]↓› by "cqt:2"
 } note 2 = this
 AOT_have ‹\A(F ≡_E [λz \A[F]z])›
 apply (AOT_subst ‹F ≡_E [λz \A[F]z]› ‹∀u ([F]u ≡ [λz \A[F]z]u)›)
 using eqE[THEN "≡Df", THEN "≡S"(1), OF "&I",
 OF "cqt:2[const_var]"[axiom_inst], OF 2]
 by (auto simp: 1)
 moreover AOT_have ‹\A(F ≡_E [λz \A[F]z] → F ≈_E [λz \A[F]z])›
 using "apE-eqE:1"[unvarify G, THEN "RA[2]", OF 2] by metis
 ultimately AOT_show ‹\AF ≈_E [λz \A[F]z]›
 by (metis "act-cond" "→E")
qed

AOT_theorem "actuallyF:2": ‹Rigid([λz \A[F]z])›
proof(safe intro!: GEN "→I" "df-rigid-rel:1"[THEN "≡_d_fI"] "&I")
 AOT_show ‹[λz \A[F]z]↓› by "cqt:2"
next
 AOT_show ‹◻∀x ([λz \A[F]z]x → ◻[λz \A[F]z]x)›
 proof(rule RN; rule GEN; rule "→I")
 AOT_modally_strict {
 fix x
 AOT_assume ‹[λz \A[F]z]x›
 AOT_hence ‹\A[F]x›
 by (rule "β→C"(1))
 AOT_hence 1: ‹◻\A[F]x› by (metis "Act-Basic:6" "≡E"(1))
 AOT_show ‹◻[λz \A[F]z]x›
 apply (AOT_subst ‹[λz \A[F]z]x› ‹\A[F]x›)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 by (fact 1)
 }
 qed
qed

AOT_theorem "approx-nec:1": ‹Rigid(F) → F ≈_E [λz \A[F]z]›
proof(rule "→I")
 AOT_assume ‹Rigid([F])›
 AOT_hence A: ‹◻∀x ([F]x → ◻[F]x)›
 using "df-rigid-rel:1"[THEN "≡_d_fE", THEN "&E"(2)] by blast
 AOT_hence 0: ‹∀x ◻([F]x → ◻[F]x)›
 using CBF[THEN "→E"] by blast
 AOT_hence 1: ‹∀x ([F]x → ◻[F]x)›
 using A "qml:2"[axiom_inst, THEN "→E"] by blast
 AOT_have act_F_den: ‹[λz \A[F]z]↓›
 by "cqt:2"
 AOT_show ‹F ≈_E [λz \A[F]z]›
 proof (safe intro!: "apE-eqE:1"[unvarify G, THEN "→E"] eqE[THEN "≡_d_fI"] "&I"
 "cqt:2" act_F_den Ordinary.GEN "→I" "≡I")
 fix u
 AOT_assume ‹[F]u›
 AOT_hence ‹◻[F]u›
 using 1[THEN "∀E"(2), THEN "→E"] by blast
 AOT_hence act_F_u: ‹\A[F]u›
 by (metis "nec-imp-act" "→E")
 AOT_show ‹[λz \A[F]z]u›
 by (auto intro!: "β←C"(1) "cqt:2" act_F_u)
 next
 fix u
 AOT_assume ‹[λz \A[F]z]u›
 AOT_hence ‹\A[F]u›
 by (rule "β→C"(1))
 AOT_thus ‹[F]u›
 using 0[THEN "∀E"(2)]
 by (metis "≡E"(1) "sc-eq-fur:2" "→E")
 qed
qed

AOT_theorem "approx-nec:2":
 ‹F ≈_E G ≡ ∀H ([λz \A[H]z] ≈_E F ≡ [λz \A[H]z] ≈_E G)›
proof(rule "≡I"; rule "→I")
 AOT_assume 0: ‹F ≈_E G›
 AOT_assume 0: ‹F ≈_E G›
 AOT_hence ‹∀H (H ≈_E F ≡ H ≈_E G)›
 using "eq-part:4"[THEN "≡E"(1), OF 0] by blast
 AOT_have ‹[λz \A[H]z] ≈_E F ≡ [λz \A[H]z] ≈_E G› for H
 by (rule "∀E"(1)[OF "eq-part:4"[THEN "≡E"(1), OF 0]]) "cqt:2"
 AOT_thus ‹∀H ([λz \A[H]z] ≈_E F ≡ [λz \A[H]z] ≈_E G)›
 by (rule GEN)
next
 AOT_assume 0: ‹∀H ([λz \A[H]z] ≈_E F ≡ [λz \A[H]z] ≈_E G)›
 AOT_obtain H where ‹Rigidifies(H,F)›
 using "rigid-der:3" "∃E" by metis
 AOT_hence H: ‹Rigid(H) & ∀x ([H]x ≡ [F]x)›
 using "df-rigid-rel:2"[THEN "≡_d_fE"] by blast
 AOT_have H_rigid: ‹◻∀x ([H]x → ◻[H]x)›
 using H[THEN "&E"(1), THEN "df-rigid-rel:1"[THEN "≡_d_fE"], THEN "&E"(2)].
 AOT_hence ‹∀x ◻([H]x → ◻[H]x)›
 using "CBF" "vdash-properties:10" by blast
 AOT_hence ‹◻([H]x → ◻[H]x)› for x using "∀E"(2) by blast
 AOT_hence rigid: ‹[H]x ≡ \A[H]x› for x
 by (metis "≡E"(6) "oth-class-taut:3:a" "sc-eq-fur:2" "→E")
 AOT_have ‹H ≡_E F›
 proof (safe intro!: eqE[THEN "≡_d_fI"] "&I" "cqt:2" Ordinary.GEN "→I")
 AOT_show ‹[H]u ≡ [F]u› for u using H[THEN "&E"(2)] "∀E"(2) by fast
 qed
 AOT_hence ‹H ≈_E F›
 by (rule "apE-eqE:2"[THEN "→E", OF "&I", rotated])
 (simp add: "eq-part:1")
 AOT_hence F_approx_H: ‹F ≈_E H›
 by (metis "eq-part:2" "→E")
 moreover AOT_have H_eq_act_H: ‹H ≡_E [λz \A[H]z]›
 proof (safe intro!: eqE[THEN "≡_d_fI"] "&I" "cqt:2" Ordinary.GEN "→I")
 AOT_show ‹[H]u ≡ [λz \A[H]z]u› for u
 apply (AOT_subst ‹[λz \A[H]z]u› ‹\A[H]u›)
 apply (rule "beta-C-meta"[THEN "→E"])
 apply "cqt:2[lambda]"
 using rigid by blast
 qed
 AOT_have a: ‹F ≈_E [λz \A[H]z]›
 apply (rule "apE-eqE:2"[unvarify H, THEN "→E"])
 apply "cqt:2[lambda]"
 using F_approx_H H_eq_act_H "&I" by blast
 AOT_hence ‹[λz \A[H]z] ≈_E F›
 apply (rule "eq-part:2"[unvarify G, THEN "→E", rotated])
 by "cqt:2[lambda]"
 AOT_hence b: ‹[λz \A[H]z] ≈_E G›
 by (rule 0[THEN "∀E"(1), THEN "≡E"(1), rotated]) "cqt:2"
 AOT_show ‹F ≈_E G›
 by (rule "eq-part:3"[unvarify G, THEN "→E", rotated, OF "&I", OF a, OF b])
 "cqt:2"
qed

AOT_theorem "approx-nec:3":
 ‹(Rigid(F) & Rigid(G)) → ◻(F ≈_E G → ◻F ≈_E G)›
proof (rule "→I")
 AOT_assume ‹Rigid(F) & Rigid(G)›
 AOT_hence ‹◻∀x([F]x → ◻[F]x)› and ‹◻∀x([G]x → ◻[G]x)›
 using "df-rigid-rel:1"[THEN "≡_d_fE", THEN "&E"(2)] "&E" by blast+
 AOT_hence ‹◻(◻∀x([F]x → ◻[F]x) & ◻∀x([G]x → ◻[G]x))›
 using "KBasic:3" "4" "&I" "≡E"(2) "vdash-properties:10" by meson
 moreover AOT_have ‹◻(◻∀x([F]x → ◻[F]x) & ◻∀x([G]x → ◻[G]x)) →
◻(F ≈_E G → ◻F ≈_E G)›
 proof(rule RM; rule "→I"; rule "→I")
 AOT_modally_strict {
 AOT_assume ‹◻∀x([F]x → ◻[F]x) & ◻∀x([G]x → ◻[G]x)›
 AOT_hence ‹◻∀x([F]x → ◻[F]x)› and ‹◻∀x([G]x → ◻[G]x)›
 using "&E" by blast+
 AOT_hence ‹∀x◻([F]x → ◻[F]x)› and ‹∀x◻([G]x → ◻[G]x)›
 using CBF[THEN "→E"] by blast+
 AOT_hence F_nec: ‹◻([F]x → ◻[F]x)›
 and G_nec: ‹◻([G]x → ◻[G]x)› for x
 using "∀E"(2) by blast+
 AOT_assume ‹F ≈_E G›
 AOT_hence ‹∃R R |: F ₁_-₁⟷_E G›
 by (metis "≡_d_fE" "equi:3")
 then AOT_obtain R where ‹R |: F ₁_-₁⟷_E G›
 using "∃E"[rotated] by blast
 AOT_hence C1: ‹∀u ([F]u → ∃!v ([G]v & [R]uv))›
 and C2: ‹∀v ([G]v → ∃!u ([F]u & [R]uv))›
 using "equi:2"[THEN "≡_d_fE"] "&E" by blast+
 AOT_obtain R' where ‹Rigidifies(R', R)›
 using "rigid-der:3" "∃E"[rotated] by blast
 AOT_hence 1: ‹Rigid(R') & ∀x₁...∀x_n ([R']x₁...x_n ≡ [R]x₁...x_n)›
 using "df-rigid-rel:2"[THEN "≡_d_fE"] by blast
 AOT_hence ‹◻∀x₁...∀x_n ([R']x₁...x_n → ◻[R']x₁...x_n)›
 using "df-rigid-rel:1"[THEN "≡_d_fE"] "&E" by blast
 AOT_hence ‹∀x₁...∀x_n (♢[R']x₁...x_n → ◻[R']x₁...x_n)›
 using "≡E"(1) "rigid-rel-thms:1" by blast
 AOT_hence D: ‹∀x₁∀x₂ (♢[R']x₁x₂ → ◻[R']x₁x₂)›
 using tuple_forall[THEN "≡_d_fE"] by blast
 AOT_have E: ‹∀x₁∀x₂ ([R']x₁x₂ ≡ [R]x₁x₂)›
 using tuple_forall[THEN "≡_d_fE", OF 1[THEN "&E"(2)]] by blast
 AOT_have ‹∀u ◻([F]u → ∃!v ([G]v & [R']uv))›
 and ‹∀v ◻([G]v → ∃!u ([F]u & [R']uv))›
 proof (safe intro!: Ordinary.GEN "→I")
 fix u
 AOT_show ‹◻([F]u → ∃!v ([G]v & [R']uv))›
 proof (rule "raa-cor:1")
 AOT_assume ‹¬◻([F]u → ∃!v ([G]v & [R']uv))›
 AOT_hence 1: ‹♢¬([F]u → ∃!v ([G]v & [R']uv))›
 using "KBasic:11" "≡E"(1) by blast
 AOT_have ‹♢([F]u & ¬∃!v ([G]v & [R']uv))›
 apply (AOT_subst ‹[F]u & ¬∃!v ([G]v & [R']uv)›
 ‹¬([F]u → ∃!v ([G]v & [R']uv))›)
 apply (meson "≡E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
 by (fact 1)
 AOT_hence A: ‹♢[F]u & ♢¬∃!v ([G]v & [R']uv)›
 using "KBasic2:3" "→E" by blast
 AOT_hence ‹◻[F]u›
 using F_nec "&E"(1) "≡E"(1) "sc-eq-box-box:1" "→E" by blast
 AOT_hence ‹[F]u›
 by (metis "qml:2"[axiom_inst] "\<rightarrow>E")
 AOT_hence \<open>\<exists>!v ([G]v & [R]uv)\<close>
 using C1[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E"] by blast
 AOT_hence \<open>\<exists>v ([G]v & [R]uv & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>E v))\<close>
 using "equi:1"[THEN "\<equiv>E"(1)] by auto
 then AOT_obtain a where
 a_prop: \<open>O!a & ([G]a & [R]ua & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>E a))\<close>
 using "\<exists>E"[rotated] by blast
 AOT_have \<open>\<exists>v \<box>([G]v & [R']uv & \<forall>v' ([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E v))\<close>
 proof(safe intro!: "\<exists>I"(2)[where \<beta>=a] "&I" a_prop[THEN "&E"(1)]
 "KBasic:3"[THEN "\<equiv>E"(2)])
 AOT_show \<open>\<box>[G]a\<close>
 using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
 by (metis G_nec "qml:2"[axiom_inst] "\<rightarrow>E")
 next
 AOT_show \<open>\<box>[R']ua\<close>
 using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
 E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2),
 OF a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]]
 by (metis "T\<diamond>" "\<rightarrow>E")
 next
 AOT_have \<open>\<forall>v' \<box>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
 proof (rule Ordinary.GEN; rule "raa-cor:1")
 fix v'
 AOT_assume \<open>\<not>\<box>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
 AOT_hence \<open>\<diamond>\<not>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
 by (metis "KBasic:11" "\<equiv>E"(1))
 AOT_hence \<open>\<diamond>([G]v' & [R']uv' & \<not>v' =\<^sub>E a)\<close>
 by (AOT_subst \<open>[G]v' & [R']uv' & \<not>v' =\<^sub>E a\<close>
 \<open>\<not>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>)
 (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
 AOT_hence 1: \<open>\<diamond>[G]v'\<close> and 2: \<open>\<diamond>[R']uv'\<close> and 3: \<open>\<diamond>\<not>v' =\<^sub>E a\<close>
 using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)]
 "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast+
 AOT_have Gv': \<open>[G]v'\<close> using G_nec 1
 by (meson "B\<diamond>" "KBasic:13" "\<rightarrow>E")
 AOT_have \<open>\<box>[R']uv'\<close>
 using 2 D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
 AOT_hence R'uv': \<open>[R']uv'\<close>
 by (metis "B\<diamond>" "T\<diamond>" "\<rightarrow>E")
 AOT_hence \<open>[R]uv'\<close>
 using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
 AOT_hence \<open>v' =\<^sub>E a\<close>
 using a_prop[THEN "&E"(2), THEN "&E"(2), THEN "Ordinary.\<forall>E",
 THEN "\<rightarrow>E", OF "&I", OF Gv'] by blast
 AOT_hence \<open>\<box>(v' =\<^sub>E a)\<close>
 by (metis "id-nec3:1" "\<equiv>E"(4) "raa-cor:3")
 moreover AOT_have \<open>\<not>\<box>(v' =\<^sub>E a)\<close>
 using 3 "KBasic:11" "\<equiv>E"(2) by blast
 ultimately AOT_show \<open>\<box>(v' =\<^sub>E a) & \<not>\<box>(v' =\<^sub>E a)\<close>
 using "&I" by blast
 qed
 AOT_thus \<open>\<box>\<forall>v'([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E a)\<close>
 using "Ordinary.res-var-bound-reas[BF]" "\<rightarrow>E" by fast
 qed
 AOT_hence \<open>\<box>\<exists>v ([G]v & [R']uv & \<forall>v' ([G]v' & [R']uv' \<rightarrow> v' =\<^sub>E v))\<close>
 using "Ordinary.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
 AOT_hence \<open>\<box>\<exists>!v ([G]v & [R']uv)\<close>
 by (AOT_subst_thm "equi:1")
 moreover AOT_have \<open>\<not>\<box>\<exists>!v ([G]v & [R']uv)\<close>
 using A[THEN "&E"(2)] "KBasic:11"[THEN "\<equiv>E"(2)] by blast
 ultimately AOT_show \<open>\<box>\<exists>!v ([G]v & [R']uv) & \<not>\<box>\<exists>!v ([G]v & [R']uv)\<close>
 by (rule "&I")
 qed
 next
 fix v
 AOT_show \<open>\<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
 proof (rule "raa-cor:1")
 AOT_assume \<open>\<not>\<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
 AOT_hence 1: \<open>\<diamond>\<not>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
 using "KBasic:11" "\<equiv>E"(1) by blast
 AOT_hence \<open>\<diamond>([G]v & \<not>\<exists>!u ([F]u & [R']uv))\<close>
 by (AOT_subst \<open>[G]v & \<not>\<exists>!u ([F]u & [R']uv)\<close>
 \<open>\<not>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>)
 (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
 AOT_hence A: \<open>\<diamond>[G]v & \<diamond>\<not>\<exists>!u ([F]u & [R']uv)\<close>
 using "KBasic2:3" "\<rightarrow>E" by blast
 AOT_hence \<open>\<box>[G]v\<close>
 using G_nec "&E"(1) "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E" by blast
 AOT_hence \<open>[G]v\<close> by (metis "qml:2"[axiom_inst] "\<rightarrow>E")
 AOT_hence \<open>\<exists>!u ([F]u & [R]uv)\<close>
 using C2[THEN "Ordinary.\<forall>E", THEN "\<rightarrow>E"] by blast
 AOT_hence \<open>\<exists>u ([F]u & [R]uv & \<forall>u' ([F]u' & [R]u'v \<rightarrow> u' =\<^sub>E u))\<close>
 using "equi:1"[THEN "\<equiv>E"(1)] by auto
 then AOT_obtain a where
 a_prop: \<open>O!a & ([F]a & [R]av & \<forall>u' ([F]u' & [R]u'v \<rightarrow> u' =\<^sub>E a))\<close>
 using "\<exists>E"[rotated] by blast
 AOT_have \<open>\<exists>u \<box>([F]u & [R']uv & \<forall>u' ([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E u))\<close>
 proof(safe intro!: "\<exists>I"(2)[where \<beta>=a] "&I" a_prop[THEN "&E"(1)]
 "KBasic:3"[THEN "\<equiv>E"(2)])
 AOT_show \<open>\<box>[F]a\<close>
 using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
 by (metis F_nec "qml:2"[axiom_inst] "\<rightarrow>E")
 next
 AOT_show \<open>\<box>[R']av\<close>
 using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
 E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2),
 OF a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]]
 by (metis "T\<diamond>" "\<rightarrow>E")
 next
 AOT_have \<open>\<forall>u' \<box>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
 proof (rule Ordinary.GEN; rule "raa-cor:1")
 fix u'
 AOT_assume \<open>\<not>\<box>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
 AOT_hence \<open>\<diamond>\<not>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
 by (metis "KBasic:11" "\<equiv>E"(1))
 AOT_hence \<open>\<diamond>([F]u' & [R']u'v & \<not>u' =\<^sub>E a)\<close>
 by (AOT_subst \<open>[F]u' & [R']u'v & \<not>u' =\<^sub>E a\<close>
 \<open>\<not>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>)
 (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
 AOT_hence 1: \<open>\<diamond>[F]u'\<close> and 2: \<open>\<diamond>[R']u'v\<close> and 3: \<open>\<diamond>\<not>u' =\<^sub>E a\<close>
 using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)]
 "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast+
 AOT_have Fu': \<open>[F]u'\<close> using F_nec 1
 by (meson "B\<diamond>" "KBasic:13" "\<rightarrow>E")
 AOT_have \<open>\<box>[R']u'v\<close>
 using 2 D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
 AOT_hence R'u'v: \<open>[R']u'v\<close>
 by (metis "B\<diamond>" "T\<diamond>" "\<rightarrow>E")
 AOT_hence \<open>[R]u'v\<close>
 using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
 AOT_hence \<open>u' =\<^sub>E a\<close>
 using a_prop[THEN "&E"(2), THEN "&E"(2), THEN "Ordinary.\<forall>E",
 THEN "\<rightarrow>E", OF "&I", OF Fu'] by blast
 AOT_hence \<open>\<box>(u' =\<^sub>E a)\<close>
 by (metis "id-nec3:1" "\<equiv>E"(4) "raa-cor:3")
 moreover AOT_have \<open>\<not>\<box>(u' =\<^sub>E a)\<close>
 using 3 "KBasic:11" "\<equiv>E"(2) by blast
 ultimately AOT_show \<open>\<box>(u' =\<^sub>E a) & \<not>\<box>(u' =\<^sub>E a)\<close>
 using "&I" by blast
 qed
 AOT_thus \<open>\<box>\<forall>u'([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E a)\<close>
 using "Ordinary.res-var-bound-reas[BF]" "\<rightarrow>E" by fast
 qed
 AOT_hence 1: \<open>\<box>\<exists>u ([F]u & [R']uv & \<forall>u' ([F]u' & [R']u'v \<rightarrow> u' =\<^sub>E u))\<close>
 using "Ordinary.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
 AOT_hence \<open>\<box>\<exists>!u ([F]u & [R']uv)\<close>
 by (AOT_subst_thm "equi:1")
 moreover AOT_have \<open>\<not>\<box>\<exists>!u ([F]u & [R']uv)\<close>
 using A[THEN "&E"(2)] "KBasic:11"[THEN "\<equiv>E"(2)] by blast
 ultimately AOT_show \<open>\<box>\<exists>!u ([F]u & [R']uv) & \<not>\<box>\<exists>!u ([F]u & [R']uv)\<close>
 by (rule "&I")
 qed
 qed
 AOT_hence \<open>\<box>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
 and \<open>\<box>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
 using "Ordinary.res-var-bound-reas[BF]"[THEN "\<rightarrow>E"] by auto
 moreover AOT_have \<open>\<box>[R']\<down>\<close> and \<open>\<box>[F]\<down>\<close> and \<open>\<box>[G]\<down>\<close>
 by (simp_all add: "ex:2:a")
 ultimately AOT_have \<open>\<box>([R']\<down> & [F]\<down> & [G]\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv)) &
 \<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv)))\<close>
 using "KBasic:3" "&I" "\<equiv>E"(2) by meson
 AOT_hence \<open>\<box>R' |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
 by (AOT_subst_def "equi:2")
 AOT_hence \<open>\<exists>R \<box>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
 by (rule "\<exists>I"(2))
 AOT_hence \<open>\<box>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close>
 by (metis Buridan "\<rightarrow>E")
 AOT_thus \<open>\<box>F \<approx>\<^sub>E G\<close>
 by (AOT_subst_def "equi:3")
 }
 qed
 ultimately AOT_show \<open>\<box>(F \<approx>\<^sub>E G \<rightarrow> \<box>F \<approx>\<^sub>E G)\<close>
 using "\<rightarrow>E" by blast
qed

AOT_define numbers :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Numbers'(_,_')\<close>)
 \<open>Numbers(x,G) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>

AOT_theorem "numbers[den]":
 \<open>\<Pi>\<down> \<rightarrow> (Numbers(\<kappa>, \<Pi>) \<equiv> A!\<kappa> & \<forall>F(\<kappa>[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E \<Pi>))\<close>
 apply (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<equiv>I" "\<rightarrow>I" "cqt:2"
 dest!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"])
 using "&E" by blast+

AOT_theorem "num-tran:1":
 \<open>G \<approx>\<^sub>E H \<rightarrow> (Numbers(x, G) \<equiv> Numbers(x, H))\<close>
proof (safe intro!: "\<rightarrow>I" "\<equiv>I")
 AOT_assume 0: \<open>G \<approx>\<^sub>E H\<close>
 AOT_assume \<open>Numbers(x, G)\<close>
 AOT_hence Ax: \<open>A!x\<close> and \<theta>: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
 AOT_show \<open>Numbers(x, H)\<close>
 proof(safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ax "cqt:2" GEN)
 fix F
 AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
 using \<theta>[THEN "\<forall>E"(2)].
 also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>
 using 0 "approx-nec:2"[THEN "\<equiv>E"(1), THEN "\<forall>E"(2)] by metis
 finally AOT_show \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>.
 qed
next
 AOT_assume \<open>G \<approx>\<^sub>E H\<close>
 AOT_hence 0: \<open>H \<approx>\<^sub>E G\<close>
 by (metis "eq-part:2" "\<rightarrow>E")
 AOT_assume \<open>Numbers(x, H)\<close>
 AOT_hence Ax: \<open>A!x\<close> and \<theta>: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
 AOT_show \<open>Numbers(x, G)\<close>
 proof(safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ax "cqt:2" GEN)
 fix F
 AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>
 using \<theta>[THEN "\<forall>E"(2)].
 also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
 using 0 "approx-nec:2"[THEN "\<equiv>E"(1), THEN "\<forall>E"(2)] by metis
 finally AOT_show \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>.
 qed
qed

AOT_theorem "num-tran:2":
 \<open>(Numbers(x, G) & Numbers(x,H)) \<rightarrow> G \<approx>\<^sub>E H\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
 AOT_assume \<open>Numbers(x,G)\<close>
 AOT_hence \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
 AOT_hence 1: \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close> for F
 using "\<forall>E"(2) by blast
 AOT_assume \<open>Numbers(x,H)\<close>
 AOT_hence \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
 AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close> for F
 using "\<forall>E"(2) by blast
 AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close> for F
 by (metis "1" "\<equiv>E"(6))
 AOT_thus \<open>G \<approx>\<^sub>E H\<close>
 using "approx-nec:2"[THEN "\<equiv>E"(2), OF GEN] by blast
qed

AOT_theorem "num-tran:3":
 \<open>G \<equiv>\<^sub>E H \<rightarrow> (Numbers(x, G) \<equiv> Numbers(x, H))\<close>
 using "apE-eqE:1" "Hypothetical Syllogism" "num-tran:1" by blast

AOT_theorem "pre-Hume":
 \<open>(Numbers(x,G) & Numbers(y,H)) \<rightarrow> (x = y \<equiv> G \<approx>\<^sub>E H)\<close>
proof(safe intro!: "\<rightarrow>I" "\<equiv>I"; frule "&E"(1); drule "&E"(2))
 AOT_assume \<open>Numbers(x, G)\<close>
 moreover AOT_assume \<open>x = y\<close>
 ultimately AOT_have \<open>Numbers(y, G)\<close> by (rule "rule=E")
 moreover AOT_assume \<open>Numbers(y, H)\<close>
 ultimately AOT_show \<open>G \<approx>\<^sub>E H\<close> using "num-tran:2" "\<rightarrow>E" "&I"n> by blast
next
 AOT_assume \<open>Numbers(x, G)\<close>
 AOT_hence Ax: \<open>A!x\<close> and xF: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
 AOT_assume \<open>Numbers(y, H)\<close>
 AOT_hence Ay: \<open>A!y\<close> and yF: \<open>\<forall>F (y[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
 AOT_assume G_approx_H: \<open>G \<approx>\<^sub>E H\<close>
 AOT_show \<open>x = y\<close>
 proof(rule "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "&I", OF Ax, OF Ay]; rule GEN)
 fix F
 AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
 using xF[THEN "\<forall>E"(2)].
 also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E H\<close>
 using "approx-nec:2"[THEN "\<equiv>E"(1), OF G_approx_H, THEN "\<forall>E"(2)].
 also AOT_have \<open>\<dots> \<equiv> y[F]\<close>
 using yF[THEN "\<forall>E"(2), symmetric].
 finally AOT_show \<open>x[F] \<equiv> y[F]\<close>.
 qed
qed

AOT_theorem "two-num-not":
 \<open>\<exists>u\<exists>v(u \<noteq> v) \<rightarrow> \<exists>x\<exists>G\<exists>H(Numbers(x,G) & Numbers(x, H) & \<not>G \<equiv>\<^sub>E H)\<close>
proof (rule "\<rightarrow>I")
 AOT_have eqE_den: \<open>[\<lambda>x x =\<^sub>E y]\<down>\<close> for y by "cqt:2"
 AOT_assume \<open>\<exists>u\<exists>v(u \<noteq> v)\<close>
 then AOT_obtain c where Oc: \<open>O!c\<close> and \<open>\<exists>v (c \<noteq> v)\<close>
 using "&E" "\<exists>E"[rotated] by blast
 then AOT_obtain d where Od: \<open>O!d\<close> and c_noteq_d: \<open>c \<noteq> d\<close>
 using "&E" "\<exists>E"[rotated] by blast
 AOT_hence c_noteqE_d: \<open>c \<noteq>\<^sub>E d\<close>
 using "=E-simple:2"[THEN "\<rightarrow>E"] "=E-simple:2" "\<equiv>E"(2) "modus-tollens:1"
 "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "thm-neg=E" by fast
 AOT_hence not_c_eqE_d: \<open>\<not>c =\<^sub>E d\<close>
 using "\<equiv>E"(1) "thm-neg=E" by blast
 AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E c]))\<close>
 by (simp add: "A-objects"[axiom_inst])
 then AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E c])\<close>
 using "\<exists>E"[rotated] by blast
 AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E d]))\<close>
 by (simp add: "A-objects" "vdash-properties:1[2]")
 then AOT_obtain b where b_prop: \<open>A!b & \<forall>F (b[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E d])\<close>
 using "\<exists>E"[rotated] by blast
 AOT_have num_a_eq_c: \<open>Numbers(a, [\<lambda>x x =\<^sub>E c])\<close>
 by (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" a_prop[THEN "&E"(1)]
 a_prop[THEN "&E"(2)]) "cqt:2"
 moreover AOT_have num_b_eq_d: \<open>Numbers(b, [\<lambda>x x =\<^sub>E d])\<close>
 by (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" b_prop[THEN "&E"(1)]
 b_prop[THEN "&E"(2)]) "cqt:2"
 moreover AOT_have \<open>[\<lambda>x x =\<^sub>E c] \<approx>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
 proof (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
 let ?R = \<open>\<guillemotleft>[\<lambda>xy (x =\<^sub>E c & y =\<^sub>E d)]\<guillemotright>\<close>
 AOT_have Rcd: \<open>[\<guillemotleft>?R\<guillemotright>]cd\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI
 "ord=Eequiv:1"[THEN "\<rightarrow>E"] Od Oc)
 AOT_show \<open>\<exists>R R |: [\<lambda>x x =\<^sub>E c] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
 proof (safe intro!: "\<exists>I"(1)[where \<tau>=\<open>?R\<close>] "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
 eqE_den Ordinary.GEN "\<rightarrow>I")
 AOT_show \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close> by "cqt:2"
 next
 fix u
 AOT_assume \<open>[\<lambda>x x =\<^sub>E c]u\<close>
 AOT_hence \<open>u =\<^sub>E c\<close>
 by (metis "\<beta>\<rightarrow>C"(1))
 AOT_hence u_is_c: \<open>u = c\<close>
 by (metis "=E-simple:2" "\<rightarrow>E")
 AOT_show \<open>\<exists>!v ([\<lambda>x x =\<^sub>E d]v & [\<guillemotleft>?R\<guillemotright>]uv)\<close>
 proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=d] "&I"
 Od Ordinary.GEN "\<rightarrow>I")
 AOT_show \<open>[\<lambda>x x =\<^sub>E d]d\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Od])
 next
 AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]ud\<close>
 using u_is_c[symmetric] Rcd "rule=E" by fast
 next
 fix v
 AOT_assume \<open>[\<lambda>x x =\<^sub>E d]v & [\<guillemotleft>?R\<guillemotright>]uv\<close>
 AOT_thus \<open>v =\<^sub>E d\<close>
 by (metis "\<beta>\<rightarrow>C"(1) "&E"(1))
 qed
 next
 fix v
 AOT_assume \<open>[\<lambda>x x =\<^sub>E d]v\<close>
 AOT_hence \<open>v =\<^sub>E d\<close>
 by (metis "\<beta>\<rightarrow>C"(1))
 AOT_hence v_is_d: \<open>v = d\<close>
 by (metis "=E-simple:2" "\<rightarrow>E")
 AOT_show \<open>\<exists>!u ([\<lambda>x x =\<^sub>E c]u & [\<guillemotleft>?R\<guillemotright>]uv)\<close>
 proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=c] "&I"
 Oc Ordinary.GEN "\<rightarrow>I")
 AOT_show \<open>[\<lambda>x x =\<^sub>E c]c\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Oc])
 next
 AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]cv\<close>
 using v_is_d[symmetric] Rcd "rule=E" by fast
 next
 fix u
 AOT_assume \<open>[\<lambda>x x =\<^sub>E c]u & [\<guillemotleft>?R\<guillemotright>]uv\<close>
 AOT_thus \<open>u =\<^sub>E c\<close>
 by (metis "\<beta>\<rightarrow>C"(1) "&E"(1))
 qed
 next
 AOT_show \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close>
 by "cqt:2"
 qed
 qed
 ultimately AOT_have \<open>a = b\<close>
 using "pre-Hume"[unvarify G H, OF eqE_den, OF eqE_den, THEN "\<rightarrow>E",
 OF "&I", THEN "\<equiv>E"(2)] by blast
 AOT_hence num_a_eq_d: \<open>Numbers(a, [\<lambda>x x =\<^sub>E d])\<close>
 using num_b_eq_d "rule=E" id_sym by fast
 AOT_have not_equiv: \<open>\<not>[\<lambda>x x =\<^sub>E c] \<equiv>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
 proof (rule "raa-cor:2")
 AOT_assume \<open>[\<lambda>x x =\<^sub>E c] \<equiv>\<^sub>E [\<lambda>x x =\<^sub>E d]\<close>
 AOT_hence \<open>[\<lambda>x x =\<^sub>E c]c \<equiv> [\<lambda>x x =\<^sub>E d]c\<close>
 using eqE[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] Oc by blast
 moreover AOT_have \<open>[\<lambda>x x =\<^sub>E c]c\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Oc])
 ultimately AOT_have \<open>[\<lambda>x x =\<^sub>E d]c\<close>
 using "\<equiv>E"(1) by blast
 AOT_hence \<open>c =\<^sub>E d\<close>
 by (rule "\<beta>\<rightarrow>C"(1))
 AOT_thus \<open>c =\<^sub>E d & \<not>c =\<^sub>E d\<close>
 using not_c_eqE_d "&I" by blast
 qed
 AOT_show \<open>\<exists>x \<exists>G \<exists>H (Numbers(x,G) & Numbers(x,H) & \<not>G \<equiv>\<^sub>E H)\<close>
 apply (rule "\<exists>I"(2)[where \<beta>=a])
 apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x x =\<^sub>E c]\<guillemotright>\<close>])
 apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x x =\<^sub>E d]\<guillemotright>\<close>])
 by (safe intro!: eqE_den "&I" num_a_eq_c num_a_eq_d not_equiv)
qed

AOT_theorem "num:1": \<open>\<exists>x Numbers(x,G)\<close>
 by (AOT_subst \<open>Numbers(x,G)\<close> \<open>[A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for: x)
 (auto simp: "numbers[den]"[THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst]]
 "A-objects"[axiom_inst])

AOT_theorem "num:2": \<open>\<exists>!x Numbers(x,G)\<close>
 by (AOT_subst \<open>Numbers(x,G)\<close> \<open>[A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for: x)
 (auto simp: "numbers[den]"[THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst]]
 "A-objects!")

AOT_theorem "num-cont:1":
 \<open>\<exists>x\<exists>G(Numbers(x, G) & \<not>\<box>Numbers(x, G))\<close>
proof -
 AOT_have \<open>\<exists>F\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "approx-cont:2".
 then AOT_obtain F where \<open>\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "\<exists>E"[rotated] by blast
 then AOT_obtain G where \<open>\<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "\<exists>E"[rotated] by blast
 AOT_hence \<theta>: \<open>\<diamond>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close> and \<zeta>: \<open>\<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>
 using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" "4\<diamond>"[THEN "\<rightarrow>E"] by blast+
 AOT_obtain a where \<open>Numbers(a, G)\<close>
 using "num:1" "\<exists>E"[rotated] by blast
 moreover AOT_have \<open>\<not>\<box>Numbers(a, G)\<close>
 proof (rule "raa-cor:2")
 AOT_assume \<open>\<box>Numbers(a, G)\<close>
 AOT_hence \<open>\<box>([A!]a & G\<down> & \<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
 by (AOT_subst_def (reverse) numbers)
 AOT_hence \<open>\<box>A!a\<close> and \<open>\<box>\<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "KBasic:3"[THEN "\<equiv>E"(1)] "&E" by blast+
 AOT_hence \<open>\<forall>F \<box>(a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using CBF[THEN "\<rightarrow>E"] by blast
 AOT_hence \<open>\<box>(a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "\<forall>E"(2) by blast
 AOT_hence A: \<open>\<box>(a[F] \<rightarrow> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 and B: \<open>\<box>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> a[F])\<close>
 using "KBasic:4"[THEN "\<equiv>E"(1)] "&E" by blast+
 AOT_have \<open>\<box>(\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> \<not>a[F])\<close>
 apply (AOT_subst \<open>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> \<not>a[F]\<close> \<open>a[F] \<rightarrow> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close>)
 using "\<equiv>I" "useful-tautologies:4" "useful-tautologies:5" apply presburger
 by (fact A)
 AOT_hence \<open>\<diamond>\<not>a[F]\<close>
 by (metis "KBasic:13" \<zeta> "\<rightarrow>E")
 AOT_hence \<open>\<not>a[F]\<close>
 by (metis "KBasic:11" "en-eq:2[1]" "\<equiv>E"(2) "\<equiv>E"(4))
 AOT_hence \<open>\<not>\<diamond>a[F]\<close>
 by (metis "en-eq:3[1]" "\<equiv>E"(4))
 moreover AOT_have \<open>\<diamond>a[F]\<close>
 by (meson B \<theta> "KBasic:13" "\<rightarrow>E")
 ultimately AOT_show \<open>\<diamond>a[F] & \<not>\<diamond>a[F]\<close>
 using "&I" by blast
 qed

 ultimately AOT_have \<open>Numbers(a, G) & \<not>\<box>Numbers(a, G)\<close>
 using "&I" by blast
 AOT_hence \<open>\<exists>G (Numbers(a, G) & \<not>\<box>Numbers(a, G))\<close>
 by (rule "\<exists>I")
 AOT_thus \<open>\<exists>x\<exists>G (Numbers(x, G) & \<not>\<box>Numbers(x, G))\<close>
 by (rule "\<exists>I")
qed

AOT_theorem "num-cont:2":
 \<open>Rigid(G) \<rightarrow> \<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
proof(rule "\<rightarrow>I")
 AOT_assume \<open>Rigid(G)\<close>
 AOT_hence \<open>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close>
 using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast
 AOT_hence \<open>\<box>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close> by (metis "S5Basic:6" "\<equiv>E"(1))
 moreover AOT_have \<open>\<box>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z) \<rightarrow> \<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
 proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
 AOT_modally_strict {
 AOT_have act_den: \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F by "cqt:2[lambda]"
 fix x
 AOT_assume G_nec: \<open>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close>
 AOT_hence G_rigid: \<open>Rigid(G)\<close>
 using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I"] "cqt:2"
 by blast
 AOT_assume \<open>Numbers(x, G)\<close>
 AOT_hence \<open>[A!]x & G\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
 AOT_hence Ax: \<open>[A!]x\<close> and \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "&E" by blast+
 AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G\<close> for F
 using "\<forall>E"(2) by blast
 moreover AOT_have \<open>\<box>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<rightarrow> \<box>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for F
 using "approx-nec:3"[unvarify F, OF act_den, THEN "\<rightarrow>E", OF "&I",
 OF "actuallyF:2", OF G_rigid].
 moreover AOT_have \<open>\<box>(x[F] \<rightarrow> \<box>x[F])\<close> for F
 by (simp add: RN "pre-en-eq:1[1]")
 ultimately AOT_have \<open>\<box>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close> for F
 using "sc-eq-box-box:5" "\<rightarrow>E" "qml:2"[axiom_inst] "&I" by meson
 AOT_hence \<open>\<forall>F \<box>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 by (rule "\<forall>I")
 AOT_hence 1: \<open>\<box>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using BF[THEN "\<rightarrow>E"] by fast
 AOT_have \<open>\<box>G\<down>\<close>
 by (simp add: "ex:2:a")
 moreover AOT_have \<open>\<box>[A!]x\<close>
 using Ax "oa-facts:2" "\<rightarrow>E" by blast
 ultimately AOT_have \<open>\<box>(A!x & G\<down>)\<close>
 by (metis "KBasic:3" "&I" "\<equiv>E"(2))
 AOT_hence \<open>\<box>(A!x & G\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
 using 1 "KBasic:3" "&I" "\<equiv>E"(2) by fast
 AOT_thus \<open>\<box>Numbers(x, G)\<close>
 by (AOT_subst_def numbers)
 }
 qed
 ultimately AOT_show \<open>\<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
 using "\<rightarrow>E" by blast
qed

AOT_theorem "num-cont:3":
 \<open>\<box>\<forall>x(Numbers(x, [\<lambda>z \<^bold>\<A>[G]z]) \<rightarrow> \<box>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z]))\<close>
 by (rule "num-cont:2"[unvarify G, THEN "\<rightarrow>E"];
 ("cqt:2[lambda]" | rule "actuallyF:2"))

AOT_theorem "num-uniq": \<open>\<^bold>\<iota>x Numbers(x, G)\<down>\<close>
 using "\<equiv>E"(2) "A-Exists:2" "RA[2]" "num:2" by blast

AOT_define num :: \<open>\<tau> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>#_\<close> [100] 100)
 "num-def:1": \<open>#G =\<^sub>d\<^sub>f \<^bold>\<iota>x Numbers(x, G)\<close>

AOT_theorem "num-def:2": \<open>#G\<down>\<close>
 using "num-def:1"[THEN "=\<^sub>d\<^sub>fI"(1)] "num-uniq" by simp

AOT_theorem "num-can:1":
 \<open>#G = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
proof -
 AOT_have \<open>\<box>\<forall>x(Numbers(x,G) \<equiv> [A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
 by (safe intro!: RN GEN "numbers[den]"[THEN "\<rightarrow>E"] "cqt:2")
 AOT_hence \<open>\<^bold>\<iota>x Numbers(x, G) = \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
 using "num-uniq" "equiv-desc-eq:3"[THEN "\<rightarrow>E", OF "&I"] by auto
 thus ?thesis
 by (rule "=\<^sub>d\<^sub>fI"(1)[OF "num-def:1", OF "num-uniq"])
qed

AOT_theorem "num-can:2": \<open>#G = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
proof (rule id_trans[OF "num-can:1"]; rule "equiv-desc-eq:2"[THEN "\<rightarrow>E"];
 safe intro!: "&I" "A-descriptions" GEN "Act-Basic:5"[THEN "\<equiv>E"(2)]
 "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)])
 AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F
 by "cqt:2"
 AOT_have "eq-part:3[terms]": \<open>\<^bold>\<turnstile>\<^sub>\<box> F \<approx>\<^sub>E G & F \<approx>\<^sub>E H \<rightarrow> G \<approx>\<^sub>E H\<close> for F G H
 by (metis "&I" "eq-part:2" "eq-part:3" "\<rightarrow>I" "&E" "\<rightarrow>E")
 fix x
 {
 fix F
 AOT_have \<open>\<^bold>\<A>(F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z])\<close>
 by (simp add: "actuallyF:1")
 moreover AOT_have \<open>\<^bold>\<A>((F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]) \<rightarrow> ([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> F \<approx>\<^sub>E G))\<close>
 by (auto intro!: "RA[2]" "\<rightarrow>I" "\<equiv>I"
 simp: "eq-part:3"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "&I"]
 "eq-part:3[terms]"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "&I"])
 ultimately AOT_have \<open>\<^bold>\<A>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> F \<approx>\<^sub>E G)\<close>
 using "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(1), THEN "\<rightarrow>E"] by blast

 AOT_hence \<open>\<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G \<equiv> \<^bold>\<A>F \<approx>\<^sub>E G\<close>
 by (metis "Act-Basic:5" "\<equiv>E"(1))
 AOT_hence 0: \<open>(\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>F \<approx>\<^sub>E G)\<close>
 by (auto intro!: "\<equiv>I" "\<rightarrow>I" elim: "\<equiv>E")
 AOT_have \<open>\<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 by (simp add: "Act-Basic:5")
 also AOT_have \<open>\<dots> \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>F \<approx>\<^sub>E G)\<close> using 0.
 also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
 by (meson "Act-Basic:5" "\<equiv>E"(6) "oth-class-taut:3:a")
 finally AOT_have 0: \<open>\<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>E G))\<close>.
 } note 0 = this
 AOT_have \<open>\<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> \<forall>F \<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)\<close>
 using "logic-actual-nec:3" "vdash-properties:1[2]" by blast
 also AOT_have \<open>\<dots> \<equiv> \<forall>F \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
 apply (safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
 using 0 "\<equiv>E"(1) "\<equiv>E"(2) "rule-ui:3" by blast+
 also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
 using "\<equiv>E"(6) "logic-actual-nec:3"[axiom_inst] "oth-class-taut:3:a" by fast
 finally AOT_have 0: \<open>\<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G) \<equiv> \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>.
 AOT_have \<open>\<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)) \<equiv>
 (\<^bold>\<A>A!x & \<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G))\<close>
 by (simp add: "Act-Basic:2")
 also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>[A!]x & \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
 using 0 "oth-class-taut:4:f" "\<rightarrow>E" by blast
 also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>
 using "Act-Basic:2" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
 finally AOT_show \<open>\<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E G)) \<equiv>
 \<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>E G))\<close>.
qed

AOT_define NaturalCardinal :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>NaturalCardinal'(_')\<close>)
 card: \<open>NaturalCardinal(x) \<equiv>\<^sub>d\<^sub>f \<exists>G(x = #G)\<close>

AOT_theorem "natcard-nec": \<open>NaturalCardinal(x) \<rightarrow> \<box>NaturalCardinal(x)\<close>
proof(rule "\<rightarrow>I")
 AOT_assume \<open>NaturalCardinal(x)\<close>
 AOT_hence \<open>\<exists>G(x = #G)\<close> using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
 then AOT_obtain G where \<open>x = #G\<close> using "\<exists>E"[rotated] by blast
 AOT_hence \<open>\<box>x = #G\<close> by (metis "id-nec:2" "\<rightarrow>E")
 AOT_hence \<open>\<exists>G \<box>x = #G\<close> by (rule "\<exists>I")
 AOT_hence \<open>\<box>\<exists>G x = #G\<close> by (metis Buridan "\<rightarrow>E")
 AOT_thus \<open>\<box>NaturalCardinal(x)\<close>
 by (AOT_subst_def card)
qed

AOT_act_theorem "hume:1": \<open>Numbers(#G, G)\<close>
 apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "num-def:1"])
 apply (simp add: "num-uniq")
 using "num-uniq" "vdash-properties:10" "y-in:3" by blast

AOT_act_theorem "hume:2": \<open>#F = #G \<equiv> F \<approx>\<^sub>E G\<close>
 by (safe intro!: "pre-Hume"[unvarify x y, OF "num-def:2",
 OF "num-def:2", THEN "\<rightarrow>E"] "&I" "hume:1")

AOT_act_theorem "hume:3": \<open>#F = #G \<equiv> \<exists>R (R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G)\<close>
 using "equi-rem-thm"
 apply (AOT_subst (reverse) \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oE G\<close>
 \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>E G\<close> for: R :: \<open><\<kappa>\<times>\<kappa>>\<close>)
 using "equi:3" "hume:2" "\<equiv>E"(5) "\<equiv>Df" by blast

AOT_act_theorem "hume:4": \<open>F \<equiv>\<^sub>E G \<rightarrow> #F = #G\<close>
 by (metis "apE-eqE:1" "deduction-theorem" "hume:2" "\<equiv>E"(2) "\<rightarrow>E")

AOT_theorem "hume-strict:1":
 \<open>\<exists>x (Numbers(x, F) & Numbers(x, G)) \<equiv> F \<approx>\<^sub>E G\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
 AOT_assume \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
 then AOT_obtain a where \<open>Numbers(a, F) & Numbers(a, G)\<close>
 using "\<exists>E"[rotated] by blast
 AOT_thus \<open>F \<approx>\<^sub>E G\<close>
 using "num-tran:2" "\<rightarrow>E" by blast
next
 AOT_assume 0: \<open>F \<approx>\<^sub>E G\<close>
 moreover AOT_obtain b where num_b_F: \<open>Numbers(b, F)\<close>
 by (metis "instantiation" "num:1")
 moreover AOT_have num_b_G: \<open>Numbers(b, G)\<close>
 using calculation "num-tran:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] by blast
 ultimately AOT_have \<open>Numbers(b, F) & Numbers(b, G)\<close>
 by (safe intro!: "&I")
 AOT_thus \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
 by (rule "\<exists>I")
qed

AOT_theorem "hume-strict:2":
 \<open>\<exists>x\<exists>y (Numbers(x, F) &
 \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
 Numbers(y, G) &
 \<forall>z (Numbers(z, G) \<rightarrow> z = y) &
 x = y) \<equiv>
 F \<approx>\<^sub>E G\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
 AOT_assume \<open>\<exists>x\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
 Numbers(y, G) & \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
 then AOT_obtain x where
 \<open>\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
 \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
 using "\<exists>E"[rotated] by blast
 then AOT_obtain y where
 \<open>Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
 \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y\<close>
 using "\<exists>E"[rotated] by blast
 AOT_hence \<open>Numbers(x, F)\<close> and \<open>Numbers(y,G)\<close> and \<open>x = y\<close>
 using "&E" by blast+
 AOT_hence \<open>Numbers(y, F) & Numbers(y, G)\<close>
 using "&I" "rule=E" by fast
 AOT_hence \<open>\<exists>y (Numbers(y, F) & Numbers(y, G))\<close>
 by (rule "\<exists>I")
 AOT_thus \<open>F \<approx>\<^sub>E G\<close>
 using "hume-strict:1"[THEN "\<equiv>E"(1)] by blast
next
 AOT_assume \<open>F \<approx>\<^sub>E G\<close>
 AOT_hence \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
 using "hume-strict:1"[THEN "\<equiv>E"(2)] by blast
 then AOT_obtain x where \<open>Numbers(x, F) & Numbers(x, G)\<close>
 using "\<exists>E"[rotated] by blast
 moreover AOT_have \<open>\<forall>z (Numbers(z, F) \<rightarrow> z = x)\<close>
 and \<open>\<forall>z (Numbers(z, G) \<rightarrow> z = x)\<close>
 using calculation
 by (auto intro!: GEN "\<rightarrow>I" "pre-Hume"[THEN "\<rightarrow>E", OF "&I", THEN "\<equiv>E"(2),
 rotated 2, OF "eq-part:1"] dest: "&E")
 ultimately AOT_have \<open>Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
 Numbers(x, G) & \<forall>z (Numbers(z, G) \<rightarrow> z = x) & x = x\<close>
 by (auto intro!: "&I" "id-eq:1" dest: "&E")
 AOT_thus \<open>\<exists>x\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
 \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
 by (auto intro!: "\<exists>I")
qed

AOT_theorem unotEu: \<open>\<not>\<exists>y[\<lambda>x O!x & x \<noteq>\<^sub>E x]y\<close>
proof(rule "raa-cor:2")
 AOT_assume \<open>\<exists>y[\<lambda>x O!x & x \<noteq>\<^sub>E x]y\<close>
 then AOT_obtain y where \<open>[\<lambda>x O!x & x \<noteq>\<^sub>E x]y\<close>
 using "\<exists>E"[rotated] by blast
 AOT_hence 0: \<open>O!y & y \<noteq>\<^sub>E y\<close>
 by (rule "\<beta>\<rightarrow>C"(1))
 AOT_hence \<open>\<not>(y =\<^sub>E y)\<close>
 using "&E"(2) "\<equiv>E"(1) "thm-neg=E" by blast
 moreover AOT_have \<open>y =\<^sub>E y\<close>
 by (metis 0[THEN "&E"(1)] "ord=Eequiv:1" "\<rightarrow>E")
 ultimately AOT_show \<open>p & \<not>p\<close> for p
 by (metis "raa-cor:3")
qed

AOT_define zero :: \<open>\<kappa>\<^sub>s\<close> (\<open>0\<close>)
 "zero:1": \<open>0 =\<^sub>d\<^sub>f #[\<lambda>x O!x & x \<noteq>\<^sub>E x]\<close>

AOT_theorem "zero:2": \<open>0\<down>\<close>
 by (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"]; rule "num-def:2"[unvarify G]; "cqt:2")

AOT_theorem "zero-card": \<open>NaturalCardinal(0)\<close>
 apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"])
 apply (rule "num-def:2"[unvarify G]; "cqt:2")
 apply (rule card[THEN "\<equiv>\<^sub>d\<^sub>fI"])
 apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x [O!]x & x \<noteq>\<^sub>E x]\<guillemotright>\<close>])
 apply (rule "rule=I:1"; rule "num-def:2"[unvarify G]; "cqt:2")
 by "cqt:2"

AOT_theorem "eq-num:1":
 \<open>\<^bold>\<A>Numbers(x, G) \<equiv> Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])\<close>
proof -
 AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F by "cqt:2"
 AOT_have \<open>\<box>(\<exists>x(Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])) \<equiv> G \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[G]z])\<close>
 using "hume-strict:1"[unvarify G, OF act_den, THEN RN].
 AOT_hence \<open>\<^bold>\<A>(\<exists>x(Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])) \<equiv> G \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[G]z])\<close>
 using "nec-imp-act"[THEN "\<rightarrow>E"] by fast
 AOT_hence \<open>\<^bold>\<A>(\<exists>x(Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
 using "actuallyF:1" "Act-Basic:5" "\<equiv>E"(1) "\<equiv>E"(2) by fast
 AOT_hence \<open>\<exists>x \<^bold>\<A>((Numbers(x, G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
 by (metis "Act-Basic:10" "intro-elim:3:a")
 then AOT_obtain a where \<open>\<^bold>\<A>(Numbers(a, G) & Numbers(a,[\<lambda>z \<^bold>\<A>[G]z]))\<close>
 using "\<exists>E"[rotated] by blast
 AOT_hence act_a_num_G: \<open>\<^bold>\<A>Numbers(a, G)\<close>
 and act_a_num_actG: \<open>\<^bold>\<A>Numbers(a,[\<lambda>z \<^bold>\<A>[G]z])\<close>
 using "Act-Basic:2" "&E" "\<equiv>E"(1) by blast+
 AOT_hence num_a_act_g: \<open>Numbers(a, [\<lambda>z \<^bold>\<A>[G]z])\<close>
 using "num-cont:2"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "actuallyF:2",
 THEN CBF[THEN "\<rightarrow>E"], THEN "\<forall>E"(2)]
 by (metis "\<equiv>E"(1) "sc-eq-fur:2" "vdash-properties:6")
 AOT_have 0: \<open>\<^bold>\<turnstile>\<^sub>\<box> Numbers(x, G) & Numbers(y, G) \<rightarrow> x = y\<close> for y
 using "pre-Hume"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), rotated, OF "eq-part:1"]
 "\<rightarrow>I" by blast
 show ?thesis
 proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
 AOT_assume \<open>\<^bold>\<A>Numbers(x, G)\<close>
 AOT_hence \<open>\<^bold>\<A>x = a\<close>
 using 0[THEN "RA[2]", THEN "act-cond"[THEN "\<rightarrow>E"], THEN "\<rightarrow>E",
 OF "Act-Basic:2"[THEN "\<equiv>E"(2)], OF "&I"]
 act_a_num_G by blast
 AOT_hence \<open>x = a\<close> by (metis "id-act:1" "\<equiv>E"(2))
 AOT_hence \<open>a = x\<close> using id_sym by auto
 AOT_thus \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
 using "rule=E" num_a_act_g by fast
 next
 AOT_assume \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
 AOT_hence \<open>a = x\<close>
 using "pre-Hume"[unvarify G H, THEN "\<rightarrow>E", OF act_den, OF act_den, OF "&I",
 OF num_a_act_g, THEN "\<equiv>E"(2)]
 "eq-part:1"[unvarify F, OF act_den] by blast
 AOT_thus \<open>\<^bold>\<A>Numbers(x, G)\<close>
 using act_a_num_G "rule=E" by fast
 qed
qed

AOT_theorem "eq-num:2": \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G\<close>
proof -
 AOT_have 0: \<open>\<^bold>\<turnstile>\<^sub>\<box> x = \<^bold>\<iota>x Numbers(x, G) \<equiv> \<forall>y (Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]) \<equiv> y = x)\<close> for x
 by (AOT_subst (reverse) \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close> \<open>\<^bold>\<A>Numbers(x, G)\<close> for: x)
 (auto simp: "eq-num:1" descriptions[axiom_inst])
 AOT_have \<open>#G = \<^bold>\<iota>x Numbers(x, G) \<equiv> \<forall>y (Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]) \<equiv> y = #G)\<close>
 using 0[unvarify x, OF "num-def:2"].
 moreover AOT_have \<open>#G = \<^bold>\<iota>x Numbers(x, G)\<close>
 using "num-def:1" "num-uniq" "rule-id-df:1" by blast
 ultimately AOT_have \<open>\<forall>y (Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]) \<equiv> y = #G)\<close>
 using "\<equiv>E" by blast
 thus ?thesis using "\<forall>E"(2) by blast
qed

AOT_theorem "eq-num:3": \<open>Numbers(#G, [\<lambda>y \<^bold>\<A>[G]y])\<close>
proof -
 AOT_have \<open>#G = #G\<close>
 by (simp add: "rule=I:1" "num-def:2")
 thus ?thesis
 using "eq-num:2"[unvarify x, OF "num-def:2", THEN "\<equiv>E"(2)] by blast
qed

AOT_theorem "eq-num:4":
 \<open>A!#G & \<forall>F (#G[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[G]z])\<close>
 by (auto intro!: "&I" "eq-num:3"[THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"],
 THEN "&E"(1), THEN "&E"(1)]
 "eq-num:3"[THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)])

AOT_theorem "eq-num:5": \<open>#G[G]\<close>
 by (auto intro!: "eq-num:4"[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2)]
 "eq-part:1"[unvarify F] simp: "cqt:2")

AOT_theorem "eq-num:6": \<open>Numbers(x, G) \<rightarrow> NaturalCardinal(x)\<close>
proof(rule "\<rightarrow>I")
 AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F
 by "cqt:2"
 AOT_obtain F where \<open>Rigidifies(F, G)\<close>
 by (metis "instantiation" "rigid-der:3")
 AOT_hence \<theta>: \<open>Rigid(F)\<close> and \<open>\<forall>x([F]x \<equiv> [G]x)\<close>
 using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
 "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)]
 by blast+
 AOT_hence \<open>F \<equiv>\<^sub>E G\<close>
 by (auto intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I" elim: "\<forall>E"(2))
 moreover AOT_assume \<open>Numbers(x, G)\<close>
 ultimately AOT_have \<open>Numbers(x, F)\<close>
 using "num-tran:3"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2)] by blast
 moreover AOT_have \<open>F \<approx>\<^sub>E [\<lambda>z \<^bold>\<A>[F]z]\<close>
 using \<theta> "approx-nec:1" "\<rightarrow>E" by blast
 ultimately AOT_have \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[F]z])\<close>
 using "num-tran:1"[unvarify H, OF act_den, THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] by blast
 AOT_hence \<open>x = #F\<close>
"2[ \E() blast
<>< =F<>
 by (rule "\<exists*Bigendian little- byte-wapping/bitmaps
AOT_thus \openNaturalCardinal()\<lose>

qed

"--num" <>\<> x=#)\equiv <> NumbersxG)\close>
safe ! \""I)
 AOT_assume \<open>\<exists>G (x = #G*java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
>
 "<>"rotated]by blast
AOT_hence \open>umbers,[<lambda>z \<^bold>\<>[Pz]\<lose>
 using "eq-num:2"[THEN "\<equiv>E"(2)] by blast
=ext4_inode_table,gdp;
ultimatelyAOT_show <><>(umbersxG)\close rule"<>I")
next
 AOT_assume \<open>\<exists>G (Numbers(x,G))\<close>
 then AOT_obtain Q where \<open>Numbers(x,Q)\<close>
 using block_cluster =EXT4_B2C(sbi,
 AOT_hence \<open>NaturalCardinal(x)\<close>
 using "eq- )
 AOT_thus \<open>\<exists>G (x = #G)\<close>
 ;
st * s)java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40

AOT_theorem "card-java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
("<rightarrow>"rule)
 AOT_have act_den: \< *java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 fix F
 AOT_assume \<open>NaturalCardinal(x)\<close>
 AOT_hence block for fortheinodetable anddatablocks
 using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
 then AOT_obtain P where x_def: \<open>x = #P\<close>
 *s: super block
 AOT_hence struct ext4_group_desc ext4_get_group_desc(struct super_block *sb,
 using int ;
 AOT_have \<open> sb,block_group bh)java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
 using "eq-num:4"[THEN "&E"(2), THEN "\<forall>E"(2)] by blast
 AOT_hence \<open>x[F] \< * justthe and remains.
 offset EXT4_DESC_SIZEsb)
 AOT_have<>dots <( \java.lang.StringIndexOutOfBoundsException: Range [61, 60) out of bounds for length 89
 using "num-tran:1 NULL;
 using "num-tran:2"[unvarify G H, OF act_den, OF act_den]
&" deduction-theorem" "<>" "<>"2 num_x_act_P
 also AOT_have *blocksmaynot ingroupatall
 using "eq-num:2" by blast
 finally AOT_show \<open>x }
qed

<\not<> []u\equiv> Numbers(0 F\close>
proof -
 java.lang.StringIndexOutOfBoundsException: Range [17, 16) out of bounds for length 39
 proof(rule "raa-cor:2")
 AOT_assume \<open ext4_unlock_group ;
 then AOT_obtain y ext4_unlock_group(sb, block_group);
 using ,java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
 AOT_hence 0: \<open>O!y & \<^bold>\<A>y \<noteq>\<^sub>E y\<close>
 by (rule "\<beta>\<rightarrow */
>\A\not( =<> y\close>
 AOT_subst\open><not>y =\^>Ey)<> <> <> \close>
 apply (meson "\<equiv>E"(2 = %lu,
 by
pen\not(y=\^sub>E y)\<close>
 ( \not<>I "Sub:""-:""<>"4)
 moreover AOT_have \ (," init group java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
 by (metis /
 ultimately AOT_show \< * submit the buffer_head for
 =(,,block_group )
 qed
 AOT_have()
 apply (java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 2
rule"-:"unvarifyG cqt2)
 apply (rule *r_blocks_countshouldalwaysbemultiple of java.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
 by "cqt:2[lambda EXT4_FREECLUSTERS_WATERMARK java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
 /* Hm
rulenum3[ xG, THEN"<E" "<>E"() 4]java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
 AOT_show s64 , flags
 proof ould_retry_alloc()- check ifablock allocation should be retried
 fix u
 \open>\lambday\<^bold><>[<ambdaxOx&x\n><subEx]] \equiv>\^><>[<ambda> !x &x \> x\<close>
 by (rulejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 also AOT_have \<open> *
apply<>[<lambdaxO! &x <>Exu< <>! <oteq>\ \close>)
 apply (rule "beta-C-meta"[THEN " java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 by (simp add: "oth-class-taut:3:a")
 also AOT_have*@ount: pointertototal of needed
 by (simp add: "Act-Basic:2")
 also AOT_have \< retjava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
 by (metis Ordinary.\< count =arlen;
 also AOT_have \<open>\<dots> *
>E ] "qt2[lambda])
 finally AOT_show \<open>[\<lambda>y \<^bold>\<A*/
 qed
 qed(fact "zero:2" | "cqt:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
thesis
 proof(safe intro! printkKERN_DEBUG"roup% =d =%\,
 AOT_assume \<open>\<not>\<exists>u [F]u\<close>
 moreover if!)
 using unotEu_act_ord.
 ultimately AOT_have if(= )
 by (rule "empty-approx:1"[unvarify H, THEN "\<rightarrow>E", rotated, OF "&I"]) "cqt:2"
 AOT_thus \<open>Numbers(0, F)\< * in this group. Currently this will b 0 .
 by ( if( = le32_to_cpues-s_backup_bgs[])||
 THEN "\<equiv>E"(2), rotated, rotated])
 (fact "zero:2" numbers0 | "java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 0
 next
 AOT_assume \<open>Numbers(0, F)\<java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 34
 AOT_hence 1: \<open>F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x]\<close>
n-:2x \rightarrow,rotated2,OF&")
 (fact numbers0 "zero:2 return java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 43
 AOT_show \<open>\<not>\<exists>u [F]u\<close>

 AOT_have 0: \ if(um java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
 AOT_assume \
 /
 by (rule "empty-approx:2"[unvarify H, OF 0, THEN "\<rightarrow>E", OF "&java.lang.StringIndexOutOfBoundsException: Range [0, 81) out of bounds for length 23
 (rule block_group = ei->i_block_group
 AOT_thus \<open>F \<approx>\<^sub>E [\<lambda>x [O!]x & \<^bold>\<A>x \<noteq>\<^sub>E x] * group forand . Regular
 using 1 "&I" by blast

 qed
qed

AOT_theorem "0F:2": \<open>\<not>\<exists>u \<^bold>\<A>[F]u \<equiv> #F = 0\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
 AOT_assume 0: \<open>\<not>\<exists>u \<^bold>\<A>[F]u\<close>
 AOT_have \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 proof(rule "raa-cor:2")
 AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
 using "Ordinary.\<exists>E"[rotated] by blast
 AOT_hence \<open>\<^bold>\<A>[F]u\<close>
 by (metis "betaC:1:a")
 AOT_hence \<open>\<exists>u \<^bold>\<A>[F]u\<close>
 by (rule "Ordinary.\<exists>I")
 AOT_thus \<open>\<exists>u \<^bold>\<A>[F]u & \<not>\<exists>u \<^bold>\<A>[F]u\<close>
 using 0 "&I" by blast
 qed
 AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
 by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)]) "cqt:2"
 AOT_hence \<open>0 = #F\<close>
 by (rule "eq-num:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)])
 AOT_thus \<open>#F = 0\<close> using id_sym by blast
next
 AOT_assume \<open>#F = 0\<close>
 AOT_hence \<open>0 = #F\<close> using id_sym by blast
 AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
 by (rule "eq-num:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)])
 AOT_hence 0: \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(2)]) "cqt:2"
 AOT_show \<open>\<not>\<exists>u \<^bold>\<A>[F]u\<close>
 proof(rule "raa-cor:2")
 AOT_assume \<open>\<exists>u \<^bold>\<A>[F]u\<close>
 then AOT_obtain u where \<open>\<^bold>\<A>[F]u\<close>
 using "Ordinary.\<exists>E"[rotated] by meson
 AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
 by (auto intro!: "\<beta>\<leftarrow>C" "cqt:2")
 AOT_hence \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 using "Ordinary.\<exists>I" by blast
 AOT_thus \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u & \<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 using "&I" 0 by blast
 qed
qed

AOT_theorem "0F:3": \<open>\<box>\<not>\<exists>u [F]u \<rightarrow> #F = 0\<close>
proof(rule "\<rightarrow>I")
 AOT_assume \<open>\<box>\<not>\<exists>u [F]u\<close>
 AOT_hence 0: \<open>\<not>\<diamond>\<exists>u [F]u\<close>
 using "KBasic2:1" "\<equiv>E"(1) by blast
 AOT_have \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 proof(rule "raa-cor:2")
 AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
 then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
 using "Ordinary.\<exists>E"[rotated] by blast
 AOT_hence \<open>\<^bold>\<A>[F]u\<close>
 by (metis "betaC:1:a")
 AOT_hence \<open>\<diamond>[F]u\<close>
 by (metis "Act-Sub:3" "\<rightarrow>E")
 AOT_hence \<open>\<exists>u \<diamond>[F]u\<close>
 by (rule "Ordinary.\<exists>I")
 AOT_hence \<open>\<diamond>\<exists>u [F]u\<close>
 using "Ordinary.res-var-bound-reas[CBF\<diamond>]"[THEN "\<rightarrow>E"] by blast
 AOT_thus \<open>\<diamond>\<exists>u [F]u & \<not>\<diamond>\<exists>u [F]u\<close>
 using 0 "&I" by blast
 qed
 AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
 by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)]) "cqt:2"
 AOT_hence \<open>0 = #F\<close>
 by (rule "eq-num:2"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)])
 AOT_thus \<open>#F = 0\<close> using id_sym by blast
qed

AOT_theorem "0F:4": \<open>w \<Turnstile> \<not>\<exists>u [F]u \<equiv> #[F]\<^sub>w = 0\<close>
proof (rule "rule-id-df:2:b"[OF "w-index", where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
 AOT_show \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [F]x\<^sub>1...x\<^sub>n]\<down>\<close>
 by (simp add: "w-rel:3")
next
 AOT_show \<open>w \<Turnstile> \<not>\<exists>u [F]u \<equiv> #[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
 proof (rule "\<equiv>I"; rule "\<rightarrow>I")
 AOT_assume \<open>w \<Turnstile> \<not>\<exists>u [F]u\<close>
 AOT_hence 0: \<open>\<not>w \<Turnstile> \<exists>u [F]u\<close>
 using "coherent:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
 AOT_have \<open>\<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
 proof(rule "raa-cor:2")
 AOT_assume \<open>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
 then AOT_obtain u where \<open>\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
 using "Ordinary.\<exists>E"[rotated] by meson
 AOT_hence \<open>\<^bold>\<A>w \<Turnstile> [F]u\<close>
 by (AOT_subst (reverse) \<open>w \<Turnstile> [F]u\<close> \<open>[\<lambda>x w \<Turnstile> [F]x]u\<close>;
 safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "w-rel:1"[THEN "\<rightarrow>E"])
 "cqt:2"
 AOT_hence 1: \<open>w \<Turnstile> [F]u\<close>
 using "rigid-truth-at:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
 by blast
 AOT_have \<open>\<box>([F]u \<rightarrow> \<exists>u [F]u)\<close>
 using "Ordinary.\<exists>I" "\<rightarrow>I" RN by simp
 AOT_hence \<open>w \<Turnstile> ([F]u \<rightarrow> \<exists>u [F]u)\<close>
 using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
 "PossibleWorld.\<forall>E" by fast
 AOT_hence \<open>w \<Turnstile> \<exists>u [F]u\<close>
 using 1 "conj-dist-w:2"[unvarify p q, OF "log-prop-prop:2",
 OF "log-prop-prop:2", THEN "\<equiv>E"(1),
 THEN "\<rightarrow>E"] by blast
 AOT_thus \<open>w \<Turnstile> \<exists>u [F]u & \<not>w \<Turnstile> \<exists>u [F]u\<close>
 using 0 "&I" by blast
 qed
 AOT_thus \<open>#[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
 by (safe intro!: "0F:2"[unvarify F, THEN "\<equiv>E"(1)] "w-rel:1"[THEN "\<rightarrow>E"])
 "cqt:2"
 next
 AOT_assume \<open>#[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
 AOT_hence 0: \<open>\<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
 by (safe intro!: "0F:2"[unvarify F, THEN "\<equiv>E"(2)] "w-rel:1"[THEN "\<rightarrow>E"])
 "cqt:2"
 AOT_have \<open>\<not>w \<Turnstile> \<exists>u [F]u\<close>
 proof (rule "raa-cor:2")
 AOT_assume \<open>w \<Turnstile> \<exists>u [F]u\<close>
 AOT_hence \<open>\<exists>x w \<Turnstile> (O!x & [F]x)\<close>
 using "conj-dist-w:6"[THEN "\<equiv>E"(1)] by fast
 then AOT_obtain x where \<open>w \<Turnstile> (O!x & [F]x)\<close>
 using "\<exists>E"[rotated] by blast
 AOT_hence \<open>w \<Turnstile> O!x\<close> and Fx_in_w: \<open>w \<Turnstile> [F]x\<close>
 using "conj-dist-w:1"[unvarify p q] "\<equiv>E"(1) "log-prop-prop:2"
 "&E" by blast+
 AOT_hence \<open>\<diamond>O!x\<close>
 using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
 "PossibleWorld.\<exists>I" by simp
 AOT_hence ord_x: \<open>O!x\<close>
 using "oa-facts:3"[THEN "\<rightarrow>E"] by blast
 AOT_have \<open>\<^bold>\<A>w \<Turnstile> [F]x\<close>
 using "rigid-truth-at:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
 Fx_in_w by blast
 AOT_hence \<open>\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x\<close>
 by (AOT_subst \<open>[\<lambda>x w \<Turnstile> [F]x]x\<close> \<open>w \<Turnstile> [F]x\<close>;
 safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "w-rel:1"[THEN "\<rightarrow>E"]) "cqt:2"
 AOT_hence \<open>O!x & \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x\<close>
 using ord_x "&I" by blast
 AOT_hence \<open>\<exists>x (O!x & \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x)\<close>
 using "\<exists>I" by fast
 AOT_thus \<open>\<exists>u (\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u) & \<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
 using 0 "&I" by blast
 qed
 AOT_thus \<open>w \<Turnstile> \<not>\<exists>u[F]u\<close>
 using "coherent:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)] by blast
 qed
qed

AOT_act_theorem "zero=:1":
 \<open>NaturalCardinal(x) \<rightarrow> \<forall>F (x[F] \<equiv> Numbers(x, F))\<close>
proof(safe intro!: "\<rightarrow>I" GEN)
 fix F
 AOT_assume \<open>NaturalCardinal(x)\<close>
 AOT_hence \<open>\<forall>F (x[F] \<equiv> x = #F)\<close>
 by (metis "card-en" "\<rightarrow>E")
 AOT_hence 1: \<open>x[F] \<equiv> x = #F\<close>
 using "\<forall>E"(2) by blast
 AOT_have 2: \<open>x[F] \<equiv> x = \<^bold>\<iota>y(Numbers(y, F))\<close>
 by (rule "num-def:1"[THEN "=\<^sub>d\<^sub>fE"(1)])
 (auto simp: 1 "num-uniq")
 AOT_have \<open>x = \<^bold>\<iota>y(Numbers(y, F)) \<rightarrow> Numbers(x, F)\<close>
 using "y-in:1" by blast
 moreover AOT_have \<open>Numbers(x, F) \<rightarrow> x = \<^bold>\<iota>y(Numbers(y, F))\<close>
 proof(rule "\<rightarrow>I")
 AOT_assume 1: \<open>Numbers(x, F)\<close>
 moreover AOT_obtain z where z_prop: \<open>\<forall>y (Numbers(y, F) \<rightarrow> y = z)\<close>
 using "num:2"[THEN "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"]] "\<exists>E"[rotated] "&E"span> by blast
 ultimately AOT_have \<open>x = z\<close>
 using "\<forall>E"(2) "\<rightarrow>E" by blast
 AOT_hence \<open>\<forall>y (Numbers(y, F) \<rightarrow> y = x)\<close>
 using z_prop "rule=E" id_sym by fast
 AOT_thus \<open>x = \<^bold>\<iota>y(Numbers(y,F))\<close>
 by (rule hintikka[THEN "\<equiv>E"(2), OF "&I", rotated])
 (fact 1)
 qed
 ultimately AOT_have \<open>x = \<^bold>\<iota>y(Numbers(y, F)) \<equiv> Numbers(x, F)\<close>
 by (metis "\<equiv>I")
 AOT_thus \<open>x[F] \<equiv> Numbers(x, F)\<close>
 using 2 by (metis "\<equiv>E"(5))
qed

AOT_act_theorem "zero=:2": \<open>0[F] \<equiv> \<not>\<exists>u[F]u\<close>
proof -
 AOT_have \<open>0[F] \<equiv> Numbers(0, F)\<close>
 using "zero=:1"[unvarify x, OF "zero:2", THEN "\<rightarrow>E",
 OF "zero-card", THEN "\<forall>E"(2)].
 also AOT_have \<open>\<dots> \<equiv> \<not>\<exists>u[F]u\<close>
 using "0F:1"[symmetric].
 finally show ?thesis.
qed

AOT_act_theorem "zero=:3": \<open>\<not>\<exists>u[F]u \<equiv> #F = 0\<close>
proof -
 AOT_have \<open>\<not>\<exists>u[F]u \<equiv> 0[F]\<close> using "zero=:2"[symmetric].
 also AOT_have \<open>\<dots> \<equiv> 0 = #F\<close>
 using "card-en"[unvarify x, OF "zero:2", THEN "\<rightarrow>E",
 OF "zero-card", THEN "\<forall>E"(2)].
 also AOT_have \<open>\<dots> \<equiv> #F = 0\<close>
 by (simp add: "deduction-theorem" id_sym "\<equiv>I")
 finally show ?thesis.
qed

AOT_define Hereditary :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Hereditary'(_,_')\<close>)
 "hered:1":
 \<open>Hereditary(F, R) \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & \<forall>x\<forall>y([R]xy \<rightarrow> ([F]x \<rightarrow> [F]y))\<close>

AOT_theorem "hered:2":
 \<open>[\<lambda>xy \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)]\<down>\<close>
 by "cqt:2[lambda]"

AOT_define StrongAncestral :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> (\<open>_\<^sup>*\<close>)
 "ances-df":
 \<open>R\<^sup>* =\<^sub>d\<^sub>f [\<lambda>xy \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)]\<close>

AOT_theorem "ances":
 \<open>[R\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)\<close>
 apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "ances-df"])
 apply "cqt:2[lambda]"
 apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF "hered:2", unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
 where \<tau>=\<open>(_,_)\<close>, simplified])
 by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")

AOT_theorem "anc-her:1":
 \<open>[R]xy \<rightarrow> [R\<^sup>*]xy\<close>
proof (safe intro!: "\<rightarrow>I" ances[THEN "\<equiv>E"(2)] GEN)
 fix F
 AOT_assume \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F, R)\<close>
 AOT_hence \<open>[R]xy \<rightarrow> [F]y\<close>
 using "\<forall>E"(2) "&E" by blast
 moreover AOT_assume \<open>[R]xy\<close>
 ultimately AOT_show \<open>[F]y\<close>
 using "\<rightarrow>E" by blast
qed

AOT_theorem "anc-her:2":
 \<open>([R\<^sup>*]xy & \<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y\<close>
proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
 AOT_assume \<open>[R\<^sup>*]xy\<close>
 AOT_hence \<open>(\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y\<close>
 using ances[THEN "\<equiv>E"(1)] "\<forall>E"(2) by blast
 moreover AOT_assume \<open>\<forall>z([R]xz \<rightarrow> [F]z)\<close>
 moreover AOT_assume \<open>Hereditary(F,R)\<close>
 ultimately AOT_show \<open>[F]y\<close>
 using "\<rightarrow>E" "&I" by blast
qed

AOT_theorem "anc-her:3":
 \<open>([F]x & [R\<^sup>*]xy & Hereditary(F, R)) \<rightarrow> [F]y\<close>
proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
 AOT_assume 1: \<open>[F]x\<close>
 AOT_assume 2: \<open>Hereditary(F, R)\<close>
 AOT_hence 3: \<open>\<forall>x \<forall>y ([R]xy \<rightarrow> ([F]x \<rightarrow> [F]y))\<close>
 using "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
 AOT_have \<open>\<forall>z ([R]xz \<rightarrow> [F]z)\<close>
 proof (rule GEN; rule "\<rightarrow>I")
 fix z
 AOT_assume \<open>[R]xz\<close>
 moreover AOT_have \<open>[R]xz \<rightarrow> ([F]x \<rightarrow> [F]z)\<close>
 using 3 "\<forall>E"(2) by blast
 ultimately AOT_show \<open>[F]z\<close>
 using 1 "\<rightarrow>E" by blast
 qed
 moreover AOT_assume \<open>[R\<^sup>*]xy\<close>
 ultimately AOT_show \<open>[F]y\<close>
 by (auto intro!: 2 "anc-her:2"[THEN "\<rightarrow>E"] "&I")
qed

AOT_theorem "anc-her:4": \<open>([R]xy & [R\<^sup>*]yz) \<rightarrow> [R\<^sup>*]xz\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
 AOT_assume 0: \<open>[R\<^sup>*]yz\<close> and 1: \<open>[R]xy\<close>
 AOT_show \<open>[R\<^sup>*]xz\<close>
 proof(safe intro!: ances[THEN "\<equiv>E"(2)] GEN "&I" "\<rightarrow>I";
 frule "&E"(1); drule "&E"(2))
 fix F
 AOT_assume \<open>\<forall>z ([R]xz \<rightarrow> [F]z)\<close>
 AOT_hence 1: \<open>[F]y\<close>
 using 1 "\<forall>E"(2) "\<rightarrow>E" by blast
 AOT_assume 2: \<open>Hereditary(F,R)\<close>
 AOT_show \<open>[F]z\<close>
 by (rule "anc-her:3"[THEN "\<rightarrow>E"]; auto intro!: "&I" 1 2 0)
 qed
qed

AOT_theorem "anc-her:5": \<open>[R\<^sup>*]xy \<rightarrow> \<exists>z [R]zy\<close>
proof (rule "\<rightarrow>I")
 AOT_have 0: \<open>[\<lambda>y \<exists>x [R]xy]\<down>\<close> by "cqt:2"
 AOT_assume 1: \<open>[R\<^sup>*]xy\<close>
 AOT_have \<open>[\<lambda>y\<exists>x [R]xy]y\<close>
 proof(rule "anc-her:2"[unvarify F, OF 0, THEN "\<rightarrow>E"];
 safe intro!: "&I" GEN "\<rightarrow>I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2" 0)
 AOT_show \<open>[R\<^sup>*]xy\<close> using 1.
 next
 fix z
 AOT_assume \<open>[R]xz\<close>
 AOT_hence \<open>\<exists>x [R]xz\<close> by (rule "\<exists>I")
 AOT_thus \<open>[\<lambda>y\<exists>x [R]xy]z\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
 next
 fix x y
 AOT_assume \<open>[R]xy\<close>
 AOT_hence \<open>\<exists>x [R]xy\<close> by (rule "\<exists>I")
 AOT_thus \<open>[\<lambda>y \<exists>x [R]xy]y\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
 qed
 AOT_thus \<open>\<exists>z [R]zy\<close>
 by (rule "\<beta>\<rightarrow>C"(1))
qed

AOT_theorem "anc-her:6": \<open>([R\<^sup>*]xy & [R\<^sup>*]yz) \<rightarrow> [R\<^sup>*]xz\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
 AOT_assume \<open>[R\<^sup>*]xy\<close>
 AOT_hence \<theta>: \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F,R) \<rightarrow> [F]y\<close> for F
 using "\<forall>E"(2) ances[THEN "\<equiv>E"(1)] by blast
 AOT_assume \<open>[R\<^sup>*]yz\<close>
 AOT_hence \<xi>: \<open>\<forall>z ([R]yz \<rightarrow> [F]z) & Hereditary(F,R) \<rightarrow> [F]z\<close> for F
 using "\<forall>E"(2) ances[THEN "\<equiv>E"(1)] by blast
 AOT_show \<open>[R\<^sup>*]xz\<close>
 proof (rule ances[THEN "\<equiv>E"(2)]; safe intro!: GEN "\<rightarrow>I")
 fix F
 AOT_assume \<zeta>: \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F,R)\<close>
 AOT_show \<open>[F]z\<close>
 proof (rule \<xi>[THEN "\<rightarrow>E", OF "&I"])
 AOT_show \<open>Hereditary(F,R)\<close>
 using \<zeta>[THEN "&E"(2)].
 next
 AOT_show \<open>\<forall>z ([R]yz \<rightarrow> [F]z)\<close>
 proof(rule GEN; rule "\<rightarrow>I")
 fix z
 AOT_assume \<open>[R]yz\<close>
 moreover AOT_have \<open>[F]y\<close>
 using \<theta>[THEN "\<rightarrow>E", OF \<zeta>].
 ultimately AOT_show \<open>[F]z\<close>
 using \<zeta>[THEN "&E"(2), THEN "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
 THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<forall>E"(2),
 THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
 by blast
 qed
 qed
 qed
qed

AOT_define OneToOne :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>1-1'(_')\<close>)
 "df-1-1:1": \<open>1-1(R) \<equiv>\<^sub>d\<^sub>f R\<down> & \<forall>x\<forall>y\<forall>z([R]xz & [R]yz \<rightarrow> x = y)\<close>

AOT_define RigidOneToOne :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Rigid\<^sub>1\<^sub>-\<^sub>1'(_')\<close>)
 "df-1-1:2": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<equiv>\<^sub>d\<^sub>f 1-1(R) & Rigid(R)\<close>

AOT_theorem "df-1-1:3": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<rightarrow> \<box>1-1(R)\<close>
proof(rule "\<rightarrow>I")
 AOT_assume \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
 AOT_hence \<open>1-1(R)\<close> and RigidR: \<open>Rigid(R)\<close>
 using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
 AOT_hence 1: \<open>[R]xz & [R]yz \<rightarrow> x = y\<close> for x y z
 using "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2) "\<forall>E"(2) by blast
 AOT_have 1: \<open>[R]xz & [R]yz \<rightarrow> \<box>x = y\<close> for x y z
 by (AOT_subst (reverse) \<open>\<box>x = y\<close> \<open>x = y\<close>)
 (auto simp: 1 "id-nec:2" "\<equiv>I" "qml:2"[axiom_inst])
 AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
 using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF RigidR] "&E" by blast
 AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
 using "CBF"[THEN "\<rightarrow>E"] by fast
 AOT_hence \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 \<box>([R]x\<^sub>1x\<^sub>2 \<rightarrow> \<box>[R]x\<^sub>1x\<^sub>2)\<close>
 using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
 AOT_hence \<open>\<box>([R]xy \<rightarrow> \<box>[R]xy)\<close> for x y
 using "\<forall>E"(2) by blast
 AOT_hence \<open>\<box>(([R]xz \<rightarrow> \<box>[R]xz) & ([R]yz \<rightarrow> \<box>[R]yz))\<close> for x y z
 by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
 moreover AOT_have \<open>\<box>(([R]xz \<rightarrow> \<box>[R]xz) & ([R]yz \<rightarrow> \<box>[R]yz)) \<rightarrow>
 \<box>(([R]xz & [R]yz) \<rightarrow> \<box>([R]xz & [R]yz))\<close> for x y z
 by (rule RM) (metis "\<rightarrow>I" "KBasic:3" "&I" "&E"(1) "&E"(2) "\<equiv>E"(2) "\<rightarrow>E")
 ultimately AOT_have 2: \<open>\<box>(([R]xz & [R]yz) \<rightarrow> \<box>([R]xz & [R]yz))\<close> for x y z
 using "\<rightarrow>E" by blast
 AOT_hence 3: \<open>\<box>([R]xz & [R]yz \<rightarrow> x = y)\<close> for x y z
 using "sc-eq-box-box:6"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF 2, OF 1] by blast
 AOT_hence 4: \<open>\<box>\<forall>x\<forall>y\<forall>z([R]xz & [R]yz \<rightarrow> x = y)\<close>
 by (safe intro!: GEN BF[THEN "\<rightarrow>E"] 3)
 AOT_thus \<open>\<box>1-1(R)\<close>
 by (AOT_subst_thm "df-1-1:1"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
 OF "cqt:2[const_var]"[axiom_inst]])
qed

AOT_theorem "df-1-1:4": \<open>\<forall>R(Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<rightarrow> \<box>Rigid\<^sub>1\<^sub>-\<^sub>1(R))\<close>
proof(rule GEN;rule "\<rightarrow>I")
AOT_modally_strict {
 fix R
 AOT_assume 0: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
 AOT_hence 1: \<open>R\<down>\<close>
 by (meson "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "df-1-1:1" "df-1-1:2")
 AOT_hence 2: \<open>\<box>R\<down>\<close>
 using "exist-nec" "\<rightarrow>E" by blast
 AOT_have 4: \<open>\<box>1-1(R)\<close>
 using "df-1-1:3"[unvarify R, OF 1, THEN "\<rightarrow>E", OF 0].
 AOT_have \<open>Rigid(R)\<close>
 using 0 "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:2"] "&E" by blast
 AOT_hence \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
 using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
 AOT_hence \<open>\<box>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
 by (metis "S5Basic:6" "\<equiv>E"(1))
 AOT_hence \<open>\<box>Rigid(R)\<close>
 apply (AOT_subst_def "df-rigid-rel:1")
 using 2 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
 AOT_thus \<open>\<box>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
 apply (AOT_subst_def "df-1-1:2")
 using 4 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
}
qed

AOT_define InDomainOf :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>InDomainOf'(_,_')\<close>)
 "df-1-1:5": \<open>InDomainOf(x, R) \<equiv>\<^sub>d\<^sub>f \<exists>y [R]xy\<close>

AOT_register_rigid_restricted_type
 RigidOneToOneRelation: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>)\<close>
proof
 AOT_modally_strict {
 AOT_show \<open>\<exists>\<alpha> Rigid\<^sub>1\<^sub>-\<^sub>1(\<alpha>)\<close>
 proof (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>(=\<^sub>E)\<guillemotright>\<close>])
 AOT_show \<open>Rigid\<^sub>1\<^sub>-\<^sub>1((=\<^sub>E))\<close>
 proof (safe intro!: "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
 GEN "\<rightarrow>I" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "=E[denotes]")
 fix x y z
 AOT_assume \<open>x =\<^sub>E z & y =\<^sub>E z\<close>
 AOT_thus \<open>x = y\<close>
 by (metis "rule=E" "&E"(1) "Conjunction Simplification"(2)
 "=E-simple:2" id_sym "\<rightarrow>E")
 next
 AOT_have \<open>\<forall>x\<forall>y \<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close>
 proof(rule GEN; rule GEN)
 AOT_show \<open>\<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close> for x y
 by (meson RN "deduction-theorem" "id-nec3:1" "\<equiv>E"(1))
 qed
 AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
 by (rule tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"])
 AOT_thus \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
 using BF[THEN "\<rightarrow>E"] by fast
 qed
 qed(fact "=E[denotes]")
 }
next
 AOT_modally_strict {
 AOT_show \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>) \<rightarrow> \<Pi>\<down>\<close> for \<Pi>
 proof(rule "\<rightarrow>I")
 AOT_assume \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>)\<close>
 AOT_hence \<open>1-1(\<Pi>)\<close>
 using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
 AOT_thus \<open>\<Pi>\<down>\<close>
 using "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
 qed
 }
next
 AOT_modally_strict {
 AOT_show \<open>\<forall>F(Rigid\<^sub>1\<^sub>-\<^sub>1(F) \<rightarrow> \<box>Rigid\<^sub>1\<^sub>-\<^sub>1(F))\<close>
 by (safe intro!: GEN "df-1-1:4"[THEN "\<forall>E"(2)])
 }
qed
AOT_register_variable_names
 RigidOneToOneRelation: \<R> \<S>

AOT_define IdentityRestrictedToDomain :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> (\<open>'(=\<^sub>_')\<close>)
 "id-d-R": \<open>(=\<^sub>\<R>) =\<^sub>d\<^sub>f [\<lambda>xy \<exists>z ([\<R>]xz & [\<R>]yz)]\<close>

syntax "_AOT_id_d_R_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>(_ =\<^sub>_/ _)\<close> [50, 51, 51] 50)
translations
 "_AOT_id_d_R_infix \<kappa> \<Pi> \<kappa>'" ==
 "CONST AOT_exe (CONST IdentityRestrictedToDomain \<Pi>) (\<kappa>,\<kappa>')"

AOT_theorem "id-R-thm:1": \<open>x =\<^sub>\<R> y \<equiv> \<exists>z ([\<R>]xz & [\<R>]yz)\<close>
proof -
 AOT_have 0: \<open>[\<lambda>xy \<exists>z ([\<R>]xz & [\<R>]yz)]\<down>\<close> by "cqt:2"
 show ?thesis
 apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
 apply (fact 0)
 apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF 0, unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
 where \<tau>=\<open>(_,_)\<close>, simplified])
 by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
qed

AOT_theorem "id-R-thm:2":
 \<open>x =\<^sub>\<R> y \<rightarrow> (InDomainOf(x, \<R>) & InDomainOf(y, \<R>))\<close>
proof(rule "\<rightarrow>I")
 AOT_assume \<open>x =\<^sub>\<R> y\<close>
 AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
 using "id-R-thm:1"[THEN "\<equiv>E"(1)] by simp
 then AOT_obtain z where z_prop: \<open>[\<R>]xz & [\<R>]yz\<close>
 using "\<exists>E"[rotated] by blast
 AOT_show ‹InDomainOf(x, R) & InDomainOf(y, R)›
 proof (safe intro!: "&I" "df-1-1:5"[THEN "≡_d_fI"])
 AOT_show ‹∃y [R]xy›
 using z_prop[THEN "&E"(1)] "∃I" by fast
 next
 AOT_show ‹∃z [R]yz›
 using z_prop[THEN "&E"(2)] "∃I" by fast
 qed
qed

AOT_theorem "id-R-thm:3": ‹x =_\R y → x = y›
proof(rule "→I")
 AOT_assume ‹x =_\R y›
 AOT_hence ‹∃z ([R]xz & [R]yz)›
 using "id-R-thm:1"[THEN "≡E"(1)] by simp
 then AOT_obtain z where z_prop: ‹[R]xz & [R]yz›
 using "∃E"[rotated] by blast
 AOT_thus ‹x = y›
 using "df-1-1:3"[THEN "→E", OF RigidOneToOneRelation.ψ,
 THEN "qml:2"[axiom_inst, THEN "→E"],
 THEN "≡_d_fE"[OF "df-1-1:1"], THEN "&E"(2),
 THEN "∀E"(2), THEN "∀E"(2),
 THEN "∀E"(2), THEN "→E"]
 by blast
qed

AOT_theorem "id-R-thm:4":
 ‹(InDomainOf(x, R) ∨ InDomainOf(y, R)) → (x =_\R y ≡ x = y)›
proof (rule "→I")
 AOT_assume ‹InDomainOf(x, R) ∨ InDomainOf(y, R)›
 moreover {
 AOT_assume ‹InDomainOf(x, R)›
 AOT_hence ‹∃z [R]xz›
 by (metis "≡_d_fE" "df-1-1:5")
 then AOT_obtain z where z_prop: ‹[R]xz›
 using "∃E"[rotated] by blast
 AOT_have ‹x =_\R y ≡ x = y›
 proof(safe intro!: "≡I" "→I" "id-R-thm:3"[THEN "→E"])
 AOT_assume ‹x = y›
 AOT_hence ‹[R]yz›
 using z_prop "rule=E" by fast
 AOT_hence ‹[R]xz & [R]yz›
 using z_prop "&I" by blast
 AOT_hence ‹∃z ([R]xz & [R]yz)›
 by (rule "∃I")
 AOT_thus ‹x =_\R y›
 using "id-R-thm:1" "≡E"(2) by blast
 qed
 }
 moreover {
 AOT_assume ‹InDomainOf(y, R)›
 AOT_hence ‹∃z [R]yz›
 by (metis "≡_d_fE" "df-1-1:5")
 then AOT_obtain z where z_prop: ‹[R]yz›
 using "∃E"[rotated] by blast
 AOT_have ‹x =_\R y ≡ x = y›
 proof(safe intro!: "≡I" "→I" "id-R-thm:3"[THEN "→E"])
 AOT_assume ‹x = y›
 AOT_hence ‹[R]xz›
 using z_prop "rule=E" id_sym by fast
 AOT_hence ‹[R]xz & [R]yz›
 using z_prop "&I" by blast
 AOT_hence ‹∃z ([R]xz & [R]yz)›
 by (rule "∃I")
 AOT_thus ‹x =_\R y›
 using "id-R-thm:1" "≡E"(2) by blast
 qed
 }
 ultimately AOT_show ‹x =_\R y ≡ x = y›
 by (metis "∨E"(2) "raa-cor:1")
qed

AOT_theorem "id-R-thm:5": ‹InDomainOf(x, R) → x =_\R x›
proof (rule "→I")
 AOT_assume ‹InDomainOf(x, R)›
 AOT_hence ‹∃z [R]xz›
 by (metis "≡_d_fE" "df-1-1:5")
 then AOT_obtain z where z_prop: ‹[R]xz›
 using "∃E"[rotated] by blast
 AOT_hence ‹[R]xz & [R]xz›
 using "&I" by blast
 AOT_hence ‹∃z ([R]xz & [R]xz)›
 using "∃I" by fast
 AOT_thus ‹x =_\R x›
 using "id-R-thm:1" "≡E"(2) by blast
qed

AOT_theorem "id-R-thm:6": java.lang.NullPointerException
(rule "→I")
java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 77
AOT_hence 1: ‹InDomainOf(x,R) & InDomainOf(y,R)›
using "id-R-thm:2"[THEN "→E"] by blast
AOT_hence ‹x =_\R y ≡ x = y›
definition rerr :: "(ip ⇀ sqn) × ip → msg"
java.lang.StringIndexOutOfBoundsException: Range [12, 11) out of bounds for length 32
using 0 by (metis "≡E"(1))
AOT_hence ‹y = x›
using id_sym by blast
moreover AOT_have ‹ pkt_def by simp
using "id-R-thm:4"[THEN "→E", OF "∨I"(2)] 1 "&E" by blast
ultimately AOT_show ‹y =_\R x›
by (metis "≡E"(2))

"id-R-thm:7": ‹x =_\R y & y =_\R z → x =_\R z›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume 0: ‹x =_\R y›
AOT_hence 1: ‹InDomainOf(x,R) & InDomainOf(y,R)›
using "id-R-thm:2"[THEN "→E"] by blast
AOT_hence ‹x =_\R y ≡ x = y›
using "id-R-thm:4"[THEN "→E", OF "∨I"(1)] "&E" by blast
AOT_hence x_eq_y: ‹x = y›
using 0 by (metis "≡E"(1))
AOT_assume 2: ‹y =_\R z›
AOT_hence 3: ‹InDomainOf(y,R) & InDomainOf(z,R)›
using "id-R-thm:2"[THEN "→E"] by blast
AOT_hence ‹y =_\R z ≡ y = z›
using "id-R-thm:4"[THEN "→E", OF "∨I"(1)] "&E" by blast
AOT_hence ‹y = z›
using 2 by (metis "≡E"(1))
AOT_hence x_eq_z: ‹x = z›
using x_eq_y id_trans by blast
AOT_have ‹InDomainOf(x,R) & InDomainOf(z,R)›
using 1 3 "&I" "&E" by meson
AOT_hence ‹x =_\R z ≡ x = z›
using "id-R-thm:4"[THEN "→E", OF "∨I"(1)] "&E" by blast
AOT_thus ‹x =_\R z›
using x_eq_z "≡E"(2) by blast

WeakAncestral :: ‹Π → Π› (‹_⁺›)
"w-ances-df": ‹[R]⁺ =_d_f [λxy [R]^*xy ∨ x =_\R y]›

"w-ances-df[den1]": ‹[λxy [Π]^*xy ∨ x =_\Π y]↓›
by "cqt:2"
"w-ances-df[den2]": ‹[Π]⁺↓›
using "w-ances-df[den1]" "=_d_fI"(1)[OF "w-ances-df"] by blast

"w-ances": ‹[R]⁺xy ≡ ([R]^*xy ∨ x =_\R y)›
-
AOT_have 0: ‹[λxy [R^*]xy ∨ x =_\R y]↓›
by "cqt:2"
AOT_have 1: ‹«(AOT_term_of_var x,AOT_term_of_var y)¬↓›
by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
have 2: ‹«[λμ₁...μ_n [R^*]μ₁...μ_n ∨ [(=_\R)]μ₁...μ_n]xy¬ =
«[λxy [R^*]xy ∨ [(=_\R)]xy]xy¬›
by (simp add: cond_case_prod_eta)
show ?thesis
apply (rule "=_d_fI"(1)[OF "w-ances-df"])
apply (fact "w-ances-df[den1]")
using "beta-C-meta"[THEN "→E", OF 0, unvarify ν₁ν_n,
where τ=‹(_,_)›, simplified, OF 1] 2 by simp

"w-ances-her:1": ‹[R]xy → [R]⁺xy›
(rule "→I")
AOT_assume ‹[R]xy›
AOT_hence ‹[R]^*xy›
using "anc-her:1"[THEN "→E"] by blast
AOT_thus ‹[R]⁺xy›
using "w-ances"[THEN "≡E"(2)] "∨I" by blast

"w-ances-her:2":
‹[F]x & [R]⁺xy & Hereditary(F, R) → [F]y›
(rule "→I"; (frule "&E"(1); drule "&E"(2))+)
AOT_assume 0: ‹[F]x›
AOT_assume 1: ‹Hereditary(F, R)›
AOT_assume ‹[R]⁺xy›
AOT_hence ‹[R]^*xy ∨ x =_\R y›
using "w-ances"[THEN "≡E"(1)] by simp
moreover {
AOT_assume ‹[R]^*xy›
AOT_hence ‹[F]y›
using "anc-her:3"[THEN "→E", OF "&I", OF "&I"] 0 1 by blast
}
moreover {
AOT_assume ‹x =_\R y›
AOT_hence ‹x = y›
using "id-R-thm:3"[THEN "→E"] by blast
AOT_hence ‹[F]y›
using 0 "rule=E" by blast
}
ultimately AOT_show ‹[F]y›
by (metis "∨E"(3) "raa-cor:1")

"w-ances-her:3": ‹([R]⁺xy & [R]yz) → [R]^*xz›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume ‹[R]⁺xy›
moreover AOT_assume Ryz: ‹[R]yz›
ultimately AOT_have ‹[R]^*xy ∨ x =_\R y›
using "w-ances"[THEN "≡E"(1)] by metis
moreover {
AOT_assume R_star_xy: ‹[R]^*xy›
AOT_have ‹[R]^*xz›
proof (safe intro!: ances[THEN "≡E"(2)] "→I" GEN)
fix F
AOT_assume 0: ‹∀z ([R]xz → [F]z) & Hereditary(F,R)›
AOT_hence ‹[F]y›
using R_star_xy ances[THEN "≡E"(1), OF R_star_xy,
THEN "∀E"(2), THEN "→E"] by blast
AOT_thus ‹[F]z›
using "hered:1"[THEN "≡_d_fE", OF 0[THEN "&E"(2)], THEN "&E"(2)]
"∀E"(2) "→E" Ryz by blast
qed
}
moreover {
AOT_assume ‹x =_\R y›
AOT_hence ‹x = y›
using "id-R-thm:3"[THEN "→E"] by blast
AOT_hence ‹[R]xz›
using Ryz "rule=E" id_sym by fast
AOT_hence ‹[R]^*xz›
by (metis "anc-her:1"[THEN "→E"])
}
ultimately AOT_show ‹[R]^*xz›
by (metis "∨E"(3) "raa-cor:1")

"w-ances-her:4": ‹([R]^*xy & [R]yz) → [R]⁺xz›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume ‹[R]^*xy›
AOT_hence ‹[R]^*xy ∨ x =_\R y›
using "∨I" by blast
AOT_hence ‹[R]⁺xy›
using "w-ances"[THEN "≡E"(2)] by blast
moreover AOT_assume ‹[R]yz›
ultimately AOT_have ‹[R]^*xz›
using "w-ances-her:3"[THEN "→E", OF "&I"] by simp
AOT_hence ‹[R]^*xz ∨ x =_\R z›
using "∨I" by blast
AOT_thus ‹[R]⁺xz›
using "w-ances"[THEN "≡E"(2)] by blast

"w-ances-her:5": ‹([R]xy & [R]⁺yz) → [R]^*xz›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume 0: ‹[R]xy›
AOT_assume ‹[R]⁺yz›
AOT_hence ‹[R]^*yz ∨ y =_\R z›
by (metis "≡E"(1) "w-ances")
moreover {
AOT_assume ‹[R]^*yz›
AOT_hence ‹[R]^*xz›
using 0 by (metis "anc-her:4" Adjunction "→E")
}
moreover {
AOT_assume ‹y =_\R z›
AOT_hence ‹y = z›
by (metis "id-R-thm:3" "→E")
AOT_hence ‹[R]xz›
using 0 "rule=E" by fast
AOT_hence ‹[R]^*xz›
by (metis "anc-her:1" "→E")
}
ultimately AOT_show ‹[R]^*xz› by (metis "∨E"(2) "reductio-aa:1")

"w-ances-her:6": ‹([R]⁺xy & [R]⁺yz) → [R]⁺xz›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume 0: ‹[R]⁺xy›
AOT_hence 1: ‹[R]^*xy ∨ x =_\R y›
by (metis "≡E"(1) "w-ances")
AOT_assume 2: ‹[R]⁺yz›
{
AOT_assume ‹x =_\R y›
AOT_hence ‹x = y›
by (metis "id-R-thm:3" "→E")
AOT_hence ‹[R]⁺xz›
using 2 "rule=E" id_sym by fast
}
moreover {
AOT_assume ‹¬(x =_\R y)›
AOT_hence 3: ‹[R]^*xy›
using 1 by (metis "∨E"(3))
AOT_have ‹[R]^*yz ∨ y =_\R z›
using 2 by (metis "≡E"(1) "w-ances")
moreover {
AOT_assume ‹[R]^*yz›
AOT_hence ‹[R]^*xz›
using 3 by (metis "anc-her:6" Adjunction "→E")
AOT_hence ‹[R]⁺xz›
by (metis "∨I"(1) "≡E"(2) "w-ances")
}
moreover {
AOT_assume ‹y =_\R z›
AOT_hence ‹y = z›
by (metis "id-R-thm:3" "→E")
AOT_hence ‹[R]⁺xz›
using 0 "rule=E" id_sym by fast
}
ultimately AOT_have ‹[R]⁺xz›
by (metis "∨E"(3) "reductio-aa:1")
}
ultimately AOT_show ‹[R]⁺xz›
by (metis "reductio-aa:1")

"w-ances-her:7": ‹[R]^*xy → ∃z([R]⁺xz & [R]zy)›
(rule "→I")
AOT_assume 0: ‹[R]^*xy›
AOT_have 1: ‹∀z ([R]xz → [Π]z) & Hereditary(Π,R) → [Π]y› if ‹Π↓› for Π
using ances[THEN "≡E"(1), THEN "∀E"(1), OF 0] that by blast
AOT_have ‹[λy ∃z([R]⁺xz & [R]zy)]y›
proof (rule 1[THEN "→E"]; "cqt:2[lambda]"?;
safe intro!: "&I" GEN "→I" "hered:1"[THEN "≡_d_fI"] "cqt:2")
fix z
AOT_assume 0: ‹[R]xz›
AOT_hence ‹∃z [R]xz› by (rule "∃I")
AOT_hence ‹InDomainOf(x, R)› by (metis "≡_d_fI" "df-1-1:5")
AOT_hence ‹x =_\R x› by (metis "id-R-thm:5" "→E")
AOT_hence ‹[R]⁺xx› by (metis "∨I"(2) "≡E"(2) "w-ances")
AOT_hence ‹[R]⁺xx & [R]xz› using 0 "&I" by blast
AOT_hence ‹∃y ([R]⁺xy & [R]yz)› by (rule "∃I")
AOT_thus ‹[λy ∃z ([R]⁺xz & [R]zy)]z›
by (auto intro!: "β←C"(1) "cqt:2")
next
fix x' y
AOT_assume Rx'y: ‹[R]x'y›
AOT_assume ‹[λy ∃z ([R]⁺xz & [R]zy)]x'›
AOT_hence ‹∃z ([R]⁺xz & [R]zx')›
using "β→C"(1) by blast
then AOT_obtain c where c_prop: ‹[R]⁺xc & [R]cx'›
using "∃E"[rotated] by blast
AOT_hence ‹[R]^*xx'›
by (meson Rx'y "anc-her:1" "anc-her:6" Adjunction "→E" "w-ances-her:3")
AOT_hence ‹[R]^*xx' ∨ x =_\R x'› by (rule "∨I")
AOT_hence ‹[R]⁺xx'› by (metis "≡E"(2) "w-ances")
AOT_hence ‹[R]⁺xx' & [R]x'y› using Rx'y by (metis "&I")
AOT_hence ‹∃z ([R]⁺xz & [R]zy)› by (rule "∃I")
AOT_thus ‹[λy ∃z ([R]⁺xz & [R]zy)]y›
by (auto intro!: "β←C"(1) "cqt:2")
qed
AOT_thus ‹∃z([R]⁺xz & [R]zy)›
using "β→C"(1) by fast

"1-1-R:1": ‹([R]xy & [R]^*zy) → [R]⁺zx›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume ‹[R]^*zy›
AOT_hence ‹∃x ([R]⁺zx & [R]xy)›
using "w-ances-her:7"[THEN "→E"] by simp
then AOT_obtain a where a_prop: ‹[R]⁺za & [R]ay›
using "∃E"[rotated] by blast
moreover AOT_assume ‹[R]xy›
ultimately AOT_have ‹x = a›
using "df-1-1:2"[THEN "≡_d_fE", OF RigidOneToOneRelation.ψ, THEN "&E"(1),
THEN "≡_d_fE"[OF "df-1-1:1"], THEN "&E"(2), THEN "∀E"(2),
THEN "∀E"(2), THEN "∀E"(2), THEN "→E", OF "&I"]
"&E" by blast
AOT_thus ‹[R]⁺zx›
using a_prop[THEN "&E"(1)] "rule=E" id_sym by fast

"1-1-R:2": ‹[R]xy → (¬[R]^*xx → ¬[R]^*yy)›
(rule "→I"; rule "useful-tautologies:5"[THEN "→E"]; rule "→I")
AOT_assume 0: ‹[R]xy›
moreover AOT_assume ‹[R]^*yy›
ultimately AOT_have ‹[R]⁺yx›
using "1-1-R:1"[THEN "→E", OF "&I"] by blast
AOT_thus ‹[R]^*xx›
using 0 by (metis "&I" "→E" "w-ances-her:5")

"1-1-R:3": ‹¬[R]^*xx → ([R]⁺xy → ¬[R]^*yy)›
(safe intro!: "→I")
AOT_have 0: ‹[λz ¬[R]^*zz]↓› by "cqt:2"
AOT_assume 1: ‹¬[R]^*xx›
AOT_assume 2: ‹[R]⁺xy›
AOT_have ‹[λz ¬[R]^*zz]y›
proof(rule "w-ances-her:2"[unvarify F, OF 0, THEN "→E"];
safe intro!: "&I" "hered:1"[THEN "≡_d_fI"] "cqt:2" GEN "→I")
AOT_show ‹[λz ¬[R]^*zz]x›
by (auto intro!: "β←C"(1) "cqt:2" simp: 1)
next
AOT_show ‹[R]⁺xy› by (fact 2)
next
fix x y
AOT_assume ‹[λz ¬[R^*]zz]x›
AOT_hence ‹¬[R]^*xx› by (rule "β→C"(1))
moreover AOT_assume ‹[R]xy›
ultimately AOT_have ‹¬[R]^*yy›
using "1-1-R:2"[THEN "→E", THEN "→E"] by blast
AOT_thus ‹[λz ¬[R^*]zz]y›
by (auto intro!: "β←C"(1) "cqt:2")
qed
AOT_thus ‹¬[R]^*yy›
using "β→C"(1) by blast

"1-1-R:4": ‹[R]^*xy → InDomainOf(x,R)›
(rule "→I"; rule "df-1-1:5"[THEN "≡_d_fI"])
AOT_assume 1: ‹[R]^*xy›
AOT_have ‹[λz [R^*]xz → ∃y [R]xy]y›
proof (safe intro!: "anc-her:2"[unvarify F, THEN "→E"];
safe intro!: "cqt:2" "&I" GEN "→I" "hered:1"[THEN "≡_d_fI"])
AOT_show ‹[R]^*xy› by (fact 1)
next
fix z
AOT_assume ‹[R]xz›
AOT_thus ‹[λz [R^*]xz → ∃y [R]xy]z›
by (safe intro!: "β←C"(1) "cqt:2")
(meson "→I" "existential:2[const_var]")
next
fix x' y
AOT_assume Rx'y: ‹[R]x'y›
AOT_assume ‹[λz [R^*]xz → ∃y [R]xy]x'›
AOT_hence 0: ‹[R^*]xx' → ∃y [R]xy› by (rule "β→C"(1))
AOT_have 1: ‹[R^*]xy → ∃y [R]xy›
proof(rule "→I")
AOT_assume ‹[R]^*xy›
AOT_hence ‹[R]⁺xx'› by (metis Rx'y "&I" "1-1-R:1" "→E")
AOT_hence ‹[R]^*xx' ∨ x =_\R x'› by (metis "≡E"(1) "w-ances")
moreover {
AOT_assume ‹[R]^*xx'›
AOT_hence ‹∃y [R]xy› using 0 by (metis "→E")
}
moreover {
AOT_assume ‹x =_\R x'›
AOT_hence ‹x = x'› by (metis "id-R-thm:3" "→E")
AOT_hence ‹[R]xy› using Rx'y "rule=E" id_sym by fast
AOT_hence ‹∃y [R]xy› by (rule "∃I")
}
ultimately AOT_show ‹∃y [R]xy›
by (metis "∨E"(3) "reductio-aa:1")
qed
AOT_show ‹[λz [R^*]xz → ∃y [R]xy]y›
by (auto intro!: "β←C"(1) "cqt:2" 1)
qed
AOT_hence ‹[R^*]xy → ∃y [R]xy› by (rule "β→C"(1))
AOT_thus ‹∃y [R]xy› using 1 "→E" by blast

"1-1-R:5": ‹[R]⁺xy → InDomainOf(x,R)›
(rule "→I")
AOT_assume ‹[R]⁺xy›
AOT_hence ‹[R]^*xy ∨ x =_\R y›
by (metis "≡E"(1) "w-ances")
moreover {
AOT_assume ‹[R]^*xy›
AOT_hence ‹InDomainOf(x,R)›
using "1-1-R:4" "→E" by blast
}
moreover {
AOT_assume ‹x =_\R y›
AOT_hence ‹InDomainOf(x,R)›
by (metis "Conjunction Simplification"(1) "id-R-thm:2" "→E")
}
ultimately AOT_show ‹InDomainOf(x,R)›
by (metis "∨E"(3) "reductio-aa:1")

"pre-ind":
‹([F]z & ∀x∀y(([R]⁺zx & [R]⁺zy) → ([R]xy → ([F]x → [F]y)))) →
∀x ([R]⁺zx → [F]x)›
(safe intro!: "→I" GEN)
AOT_have den: ‹[λy [F]y & [R]⁺zy]↓› by "cqt:2"
fix x
AOT_assume θ: ‹[F]z & ∀x∀y(([R]⁺zx & [R]⁺zy) → ([R]xy → ([F]x → [F]y)))›
AOT_assume 0: ‹[R]⁺zx›

AOT_have ‹[λy [F]y & [R]⁺zy]x›
proof (rule "w-ances-her:2"[unvarify F, OF den, THEN "→E"]; safe intro!: "&I")
AOT_show ‹[λy [F]y & [R]⁺zy]z›
proof (safe intro!: "β←C"(1) "cqt:2" "&I")
AOT_show ‹[F]z› using θ "&E" by blast
next
AOT_show ‹[R]⁺zz›
by (rule "w-ances"[THEN "≡E"(2), OF "∨I"(2)])
(meson "0" "id-R-thm:5" "1-1-R:5" "→E")
qed
next
AOT_show ‹[R]⁺zx› by (fact 0)
next
AOT_show ‹Hereditary([λy [F]y & [R]⁺zy],R)›
proof (safe intro!: "hered:1"[THEN "≡_d_fI"] "&I" "cqt:2" GEN "→I")
fix x' y
AOT_assume 1: ‹[R]x'y›
AOT_assume ‹[λy [F]y & [R]⁺zy]x'›
AOT_hence 2: ‹[F]x' & [R]⁺zx'› by (rule "β→C"(1))
AOT_have ‹[R]^*zy› using 1 2[THEN "&E"(2)]
by (metis Adjunction "modus-tollens:1" "reductio-aa:1" "w-ances-her:3")
AOT_hence 3: ‹[R]⁺zy› by (metis "∨I"(1) "≡E"(2) "w-ances")
AOT_show ‹[λy [F]y & [R]⁺zy]y›
proof (safe intro!: "β←C"(1) "cqt:2" "&I" 3)
AOT_show ‹[F]y›
proof (rule θ[THEN "&E"(2), THEN "∀E"(2), THEN "∀E"(2),
THEN "→E", THEN "→E", THEN "→E"])
AOT_show ‹[R]⁺zx' & [R]⁺zy›
using 2 3 "&E" "&I" by blast
next
AOT_show ‹[R]x'y› by (fact 1)
next
AOT_show ‹[F]x'› using 2 "&E" by blast
qed
qed
qed
qed
AOT_thus ‹[F]x› using "β→C"(1) "&E"(1) by fast

‹The following is not part of PLM, but a theorem of AOT.
It states that the predecessor relation coexists with numbering a property.
We will use this fact to derive the predecessor axiom, which asserts that the
predecessor relation denotes, from the fact that our models validate that
numbering a property denotes.›
pred_coex:
‹[λxy ∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))]↓ ≡ ∀F ([λx Numbers(x,F)]↓)›
(safe intro!: "≡I" "→I" GEN)
fix F
let ?P = ‹«[λxy ∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))]¬›
AOT_assume ‹[«?P¬]↓›
AOT_hence ‹◻[«?P¬]↓›
using "exist-nec" "→E" by blast
moreover AOT_have
‹◻[«?P¬]↓ → ◻(∀x∀y(∀F([F]x ≡ [F]y) → (Numbers(x,F) ≡ Numbers(y,F))))›
proof(rule RM; safe intro!: "→I" GEN)
AOT_modally_strict {
fix x y
AOT_assume pred_den: ‹[«?P¬]↓›
AOT_hence pred_equiv:
‹[«?P¬]xy ≡ ∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))› for x y
by (safe intro!: "beta-C-meta"[unvarify ν₁ν_n, where τ=‹(_,_)›, THEN "→E",
rotated, OF pred_den, simplified]
tuple_denotes[THEN "≡_d_fI"] "&I" "cqt:2")
text‹We show as a subproof that any natural cardinal that is not zero
has a predecessor.›
AOT_have CardinalPredecessor:
‹∃y [«?P¬]yx› if card_x: ‹NaturalCardinal(x)› and x_nonzero: ‹x ≠ 0› for x
proof -
AOT_have ‹∃G x = #G›
using card[THEN "≡_d_fE", OF card_x].
AOT_hence ‹∃G Numbers(x,G)›
using "eq-df-num"[THEN "≡E"(1)] by blast
then AOT_obtain G' where numxG': ‹Numbers(x,G')›
using "∃E"[rotated] by blast
AOT_obtain G where ‹Rigidifies(G,G')›
using "rigid-der:3" "∃E"[rotated] by blast

AOT_hence H: ‹Rigid(G) & ∀x ([G]x ≡ [G']x)›
using "df-rigid-rel:2"[THEN "≡_d_fE"] by blast
AOT_have H_rigid: ‹◻∀x ([G]x → ◻[G]x)›
using H[THEN "&E"(1), THEN "df-rigid-rel:1"[THEN "≡_d_fE"], THEN "&E"(2)].
AOT_hence ‹∀x ◻([G]x → ◻[G]x)›
using "CBF" "→E" by blast
AOT_hence R: ‹◻([G]x → ◻[G]x)› for x using "∀E"(2) by blast
AOT_hence rigid: ‹[G]x ≡ \A[G]x› for x
by (metis "≡E"(6) "oth-class-taut:3:a" "sc-eq-fur:2" "→E")
AOT_have ‹G ≡_E G'›
proof (safe intro!: eqE[THEN "≡_d_fI"] "&I" "cqt:2" GEN "→I")
AOT_show ‹[G]x ≡ [G']x› for x using H[THEN "&E"(2)] "∀E"(2) by fast
qed
AOT_hence ‹G ≈_E G'›
by (rule "apE-eqE:2"[THEN "→E", OF "&I", rotated])
(simp add: "eq-part:1")
AOT_hence numxG: ‹Numbers(x,G)›
using "num-tran:1"[THEN "→E", THEN "≡E"(2)] numxG' by blast

{
AOT_assume ‹¬∃y(y ≠ x & [«?P¬]yx)›
AOT_hence ‹∀y ¬(y ≠ x & [«?P¬]yx)›
using "cqt-further:4" "→E" by blast
AOT_hence ‹¬(y ≠ x & [«?P¬]yx)› for y
using "∀E"(2) by blast
AOT_hence 0: ‹¬y ≠ x ∨ ¬[«?P¬]yx› for y
using "¬¬E" "intro-elim:3:c" "oth-class-taut:5:a" by blast
{
fix y
AOT_assume ‹[«?P¬]yx›
AOT_hence ‹¬y ≠ x›
using 0 "¬¬I" "con-dis-i-e:4:c" by blast
AOT_hence ‹y = x›
using "=-infix" "≡_d_fI" "raa-cor:4" by blast
} note Pxy_imp_eq = this
AOT_have ‹[«?P¬]xx›
proof(rule "raa-cor:1")
AOT_assume notPxx: ‹¬[«?P¬]xx›
AOT_hence ‹¬∃F∃u([F]u & Numbers(x,F) & Numbers(x,[F]^-^u))›
using pred_equiv "intro-elim:3:c" by blast
AOT_hence ‹∀F ¬∃u([F]u & Numbers(x,F) & Numbers(x,[F]^-^u))›
using "cqt-further:4"[THEN "→E"] by blast
AOT_hence ‹¬∃u([F]u & Numbers(x,F) & Numbers(x,[F]^-^u))› for F
using "∀E"(2) by blast
AOT_hence ‹∀y ¬(O!y & ([F]y & Numbers(x,F) & Numbers(x,[F]^-^y)))› for F
using "cqt-further:4"[THEN "→E"] by blast
AOT_hence 0: ‹¬(O!u & ([F]u & Numbers(x,F) & Numbers(x,[F]^-^u)))› for F u
using "∀E"(2) by blast
AOT_have ‹◻¬∃u [G]u›
proof(rule "raa-cor:1")
AOT_assume ‹¬◻¬∃u [G]u›
AOT_hence ‹♢∃u [G]u›
using "≡_d_fI" "conventions:5" by blast
AOT_hence ‹∃u ♢[G]u›
by (metis "Ordinary.res-var-bound-reas[BF♢]"[THEN "→E"])
then AOT_obtain u where posGu: ‹♢[G]u›
using "Ordinary.∃E"[rotated] by meson
AOT_hence Gu: ‹[G]u›
by (meson "B♢" "K♢" "→E" R)
AOT_have ‹¬([G]u & Numbers(x,G) & Numbers(x,[G]^-^u))›
using 0 Ordinary.ψ
by (metis "con-dis-i-e:1" "raa-cor:1")
AOT_hence notnumx: ‹¬Numbers(x,[G]^-^u)›
using Gu numxG "con-dis-i-e:1" "raa-cor:5" by metis
AOT_obtain y where numy: ‹Numbers(y,[G]^-^u)›
using "num:1"[unvarify G, OF "F-u[den]"] "∃E"[rotated] by blast
AOT_hence ‹[G]u & Numbers(x,G) & Numbers(y,[G]^-^u)›
using Gu numxG "&I" by blast
AOT_hence ‹∃u ([G]u & Numbers(x,G) & Numbers(y,[G]^-^u))›
by (rule "Ordinary.∃I")
AOT_hence ‹∃G∃u ([G]u & Numbers(x,G) & Numbers(y,[G]^-^u))›
by (rule "∃I")
AOT_hence ‹[«?P¬]yx›
using pred_equiv[THEN "≡E"(2)] by blast
AOT_hence ‹y = x› using Pxy_imp_eq by blast
AOT_hence ‹Numbers(x,[G]^-^u)›
using numy "rule=E" by fast
AOT_thus ‹p & ¬p› for p using notnumx "reductio-aa:1" by blast
qed
AOT_hence ‹¬∃u [G]u›
using "qml:2"[axiom_inst, THEN "→E"] by blast
AOT_hence num0G: ‹Numbers(0, G)›
using "0F:1"[THEN "≡E"(1)] by blast
AOT_hence ‹x = 0›
using "pre-Hume"[unvarify x, THEN "→E", OF "zero:2", OF "&I",
THEN "≡E"(2), OF num0G, OF numxG, OF "eq-part:1"]
id_sym by blast
moreover AOT_have ‹¬x = 0›
using x_nonzero
using "=-infix" "≡_d_fE" by blast
ultimately AOT_show ‹p & ¬p› for p using "reductio-aa:1" by blast
qed
}
AOT_hence ‹[«?P¬]xx ∨ ∃y (y ≠ x & [«?P¬]yx)›
using "con-dis-i-e:3:a" "con-dis-i-e:3:b" "raa-cor:1" by blast
moreover {
AOT_assume ‹[«?P¬]xx›
AOT_hence ‹∃y [«?P¬]yx›
by (rule "∃I")
}
moreover {
AOT_assume ‹∃y (y ≠ x & [«?P¬]yx)›
then AOT_obtain y where ‹y ≠ x & [«?P¬]yx›
using "∃E"[rotated] by blast
AOT_hence ‹[«?P¬]yx›
using "&E" by blast
AOT_hence ‹∃y [«?P¬]yx›
by (rule "∃I")
}
ultimately AOT_show ‹∃y [«?P¬]yx›
using "∨E"(1) "→I" by blast
qed

text‹Given above lemma, we can show that if one of two indistinguishable objects
numbers a property, the other one numbers this property as well.›
AOT_assume indist: ‹∀F([F]x ≡ [F]y)›
AOT_assume numxF: ‹Numbers(x,F)›
AOT_hence 0: ‹NaturalCardinal(x)›
by (metis "eq-num:6" "vdash-properties:10")
text‹We show by case distinction that x equals y.
As first case we consider x to be non-zero.›
{
AOT_assume ‹¬(x = 0)›
AOT_hence ‹x ≠ 0›
by (metis "=-infix" "≡_d_fI")
AOT_hence ‹∃y [«?P¬]yx›
using CardinalPredecessor 0 by blast
then AOT_obtain z where Pxz: ‹[«?P¬]zx›
using "∃E"[rotated] by blast
AOT_hence ‹[λy [«?P¬]zy]x›
by (safe intro!: "β←C" "cqt:2")
AOT_hence ‹[λy [«?P¬]zy]y›
by (safe intro!: indist[THEN "∀E"(1), THEN "≡E"(1)] "cqt:2")
AOT_hence Pyz: ‹[«?P¬]zy›
using "β→C"(1) by blast
AOT_hence ‹∃F∃u ([F]u & Numbers(y,F) & Numbers(z,[F]^-^u))›
using Pyz pred_equiv[THEN "≡E"(1)] by blast
then AOT_obtain F₁ where ‹∃u ([F₁]u & Numbers(y,F₁) & Numbers(z,[F₁]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain u where u_prop: ‹[F₁]u & Numbers(y,F₁) & Numbers(z,[F₁]^-^u)›
using "Ordinary.∃E"[rotated] by meson
AOT_have ‹∃F∃u ([F]u & Numbers(x,F) & Numbers(z,[F]^-^u))›
using Pxz pred_equiv[THEN "≡E"(1)] by blast
then AOT_obtain F₂ where ‹∃u ([F₂]u & Numbers(x,F₂) & Numbers(z,[F₂]^-^u))›
using "∃:: "nat →→item"
then AOT_obtain v where v_prop: ‹[Fr (x::item). intitmrk"
using "Ordinary.∃E"[rotated] by meson
‹2]^v ≈₁]^u›
hume-strict:1"[unvarify F G, THEN "≡E"(1), OF "F-u[den]",
bin_d Scan_def)
\pi_step_regular: "regular ((Scan T k) o (Complete k) o (Predict k))"
AOT_hence ‹2 ≈E F_cl>
using "P'-eq"[THEN "→assms elem_setmon by fastforce
u_rop v_prop "&E" by mes
🚫
using "pre-Hume"[THEN "→E", THEN "≡
v_prop u_prop "&E" by blast
}
text‹
java.lang.StringIndexOutOfBoundsException: Range [16, 15) out of bounds for length 16
fix u
AOT_assume x_is_zero: ‹
?ca
proof (safe intro!: "0F:1"[unvarify F, THEN "≡ nonword_leftmost splits_at_d by auto
"F-u[den]"[unvarify F])
AOT_assume ‹
then AOT_obtain v where ‹
using "Ordinary.∃ bl
AOT_hence ‹
by (auto intapply auto
intro!: "cqt:2" "F-u[equiv]"[unvarify F, THEN "≡E"(1)]
"F-u[den]"[unvarify F])
AOT_thus \<apply (simp
using "β→o \< where γ: "LeftDerives1 δ (fst e) (snd e) γ ∧ LeftDerivation γ E []" by blast
"raa-cor:3" by fast
qed
ultimately AOT_have 0: ‹Numbers(x,[λz z =_E u]^-^u)›
using "rule=E" id_sym by fast
AOT_have ‹∃y Numbers(y,[λz z =_E u])›
by (safe intro!: "num:1"[unvarify G] "cqt:2")
then AOT_obtain z where ‹Numbers(z,[λz z =_E u])›
using "∃E" by metis
moreover AOT_have ‹[λz z=_E u]u›
by (safe intro!: "β←C" "cqt:2" "ord=Eequiv:1"[THEN "→E"] Ordinary.ψ)
ultimately AOT_have
1: ‹[λz z=_E u]u & Numbers(z,[λz z=_E u]) & Numbers(x,[λz z=_E u]^-^u)›
using 0 "&I" by auto
AOT_hence ‹∃v([λz z=_E u]v & Numbers(z,[λz z =_E u]) & Numbers(x,[λz z=_E u]^-^v))›
by (rule "Ordi append_Nil ap append_Nil2 leftmost_def length_0_c less_nat_zero_code linorder_neqE_nat
AOT_hence ‹pi>_rgular regular_implies_setmonotone subset_setmonotone by blast
by (rule "∃I"; "cqt:2")
Px1: \o[«?P¬]xz›
using "beta-C-cor:2"[THEN "→E", OF pred_den,
THEN tuple_forall[THEN "≡_d_fE"], THEN "∀E"(2),
THEN "∀E"(2), THEN "≡E"(2)] by simp
AOT_hence ‹[λy [«?P¬]yz]x›
by (safe intro!: "β←C" "cqt:2")
AOT_hence ‹[λy [«?P¬]yz]y›
by (safe intro!: indist[THEN "∀E"(1), THEN "≡E"(1)] "cqt:2")
AOT_hence Py1: ‹[«?P¬]yz›
using "β→C" by blast
AOT_hence ‹∃F∃u([F]u & Numbers(z,[F]) & Numbers(y,[F]^-^u))›
using "β→C" by fast
then AOT_obtain G where ‹∃u([G]u & Numbers(z,[G]) & Numbers(y,[G]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain v where 2: ‹[G]v & Numbers(z,[G]) & Numbers(y,[G]^-^list.inject mem_Collect_eq next_symbol_x singletonI)
using "Ordinary.∃[rotated] by meson
note y_props = this
by (auto intro!: "hume-strict:1"[unvarify F, THEN "\< usinginc_dot_dot
OF "∃=z], OF "&I"] "cqt:2"
dest: "&E")
AOT_hence 3: ‹
using 1 2
by (safe_step intro!: "eqP'"[unvarify F, THEN "→E"])
(auto dest: "&E" intro!: "cqt:2" "&I")
with 1 2 AOT_have ‹x = y›
by (auto intro!: "pre-Hume"[unvarify G H, THEN "→E",
THEN "≡E"(2), rotated 3, OF 3]
"F-u[den]"[unvarify F] "cqt:2" "&I"
dest: "&E")
}
ultimately AOT_have ‹x = y›
using "∨E"(1) "→I" "reductio-aa:1" by blast
text‹Now since x numbers F, so does y.›
AOT_hence ‹Numbers(y,F)›
using numxF "rule=E" by fast
} note 0 = this
text‹The only thing left is to generalize this result to a biconditional.›
AOT_modally_strict {
fix x y
AOT_assume ‹[«?P¬]↓›
moreover AOT_assume ‹∀F([F]x ≡ [F]y)›
moreover AOT_have ‹∀F([F]y ≡ [F]x)›
by (metis "cqt-basic:11" "intro-elim:3:a" calculation(2))
ultimately AOT_show ‹Numbers(x,F) ≡ Numbers(y,F)›
using 0 "≡I" "→I" by auto
}
qed
ultimately AOT_show ‹[λx Numbers(x,F)]↓›
using "kirchner-thm:1"[THEN "≡E"(2)] "→E" by fast

text‹The converse can be shown by coexistence.›
AOT_assume ‹∀F [λx Numbers(x,F)]↓›
AOT_hence ‹[λx Numbers(x,F)]↓› for F
using "∀E"(2) by blast
AOT_hence ‹◻[λx Numbers(x,F)]↓› for F
using "exist-nec"[THEN "→E"] by blast
AOT_hence ‹∀F ◻[λx Numbers(x,F)]↓›
by (rule GEN)
AOT_hence ‹◻∀F [λx Numbers(x,F)]↓›
using BF[THEN "→E"] by fast
moreover AOT_have
‹◻∀F [λx Numbers(x,F)]↓ →
◻∀x ∀y (∃F ∃u ([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x) ≡
∃F ∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u)))›
proof(rule RM; safe intro!: "→I" GEN)
AOT_modally_strict {
fix x y
AOT_assume 0: ‹∀F [λx Numbers(x,F)]↓›
AOT_show ‹∃F ∃u ([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x) ≡
∃F ∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
proof(safe intro!: "≡I" "→I")
AOT_assume ‹∃F ∃u ([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x)›
then AOT_obtain F where
‹∃u ([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x)›
using "∃E"[rotated] by blast
then AOT_obtain u where ‹[F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x›
using "Ordinary.∃E"[rotated] by meson
AOT_hence ‹[F]u & Numbers(y,F) & Numbers(x,[F]^-^u)›
by (auto intro!: "&I" dest: "&E" "β→C")
AOT_thus ‹∃F ∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using "∃I" "Ordinary.∃I" by fast
next
AOT_assume ‹∃F ∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
then AOT_obtain F where ‹∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain u where ‹[F]u & Numbers(y,F) & Numbers(x,[F]^-^u)›
using "Ordinary.∃E"[rotated] by meson
AOT_hence ‹[F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x›
by (auto intro!: "&I" "β←C" 0[THEN "∀E"(1)] "F-u[den]"
dest: "&E" intro: "cqt:2")
AOT_hence ‹∃u([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x)›
by (rule "Ordinary.∃I")
AOT_thus ‹∃F∃u([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x)›
by (rule "∃I")
qed
}
qed
ultimately AOT_have
‹◻∀x ∀y (∃F ∃u ([F]u & [λz Numbers(z,F)]y & [λz Numbers(z,[F]^-^u)]x) ≡
∃F ∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u)))›
using "→E" by blast
AOT_thus ‹[λxy ∃F ∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))]↓›
by (rule "safe-ext[2]"[axiom_inst, THEN "→E", OF "&I", rotated]) "cqt:2"

‹The following is not part of PLM, but a consequence of extended relation
comprehension and can be used to @{emph ‹derive›} the predecessor axiom.›
numbers_prop_den: ‹[λx Numbers(x,G)]↓›
(rule "safe-ext"[axiom_inst, THEN "→E", OF "&I"])
AOT_show ‹[λx A!x & [λx ∀F (x[F] ≡ [λz \A[F]z] ≈_E G)]x]↓›
by "cqt:2"

AOT_have 0: ‹\⊨_\◻ [λx ∀F (x[F] ≡ [λz \A[F]z] ≈_E G)]↓›
proof(safe intro!: Comprehension_3[THEN "→E"] "→I" RN GEN)
AOT_modally_strict {
fix F H
AOT_assume ‹◻H ≡_E F›
AOT_hence ‹◻∀u ([H]u ≡ [F]u)›
by (AOT_subst (reverse) ‹∀u ([H]u ≡ [F]u)› ‹H ≡_E F›)
(safe intro!: "eqE"[THEN "≡Df", THEN "≡S"(1), OF "&I"] "cqt:2")
AOT_hence ‹∀u ◻([H]u ≡ [F]u)›
by (metis "Ordinary.res-var-bound-reas[CBF]" "→E")
AOT_hence ‹◻([H]u ≡ [F]u)› for u
using "Ordinary.∀E" by fast
AOT_hence ‹\A([H]u ≡ [F]u)› for u
by (metis "nec-imp-act" "→E")
AOT_hence ‹\A([F]u ≡ [H]u)› for u
by (metis "Act-Basic:5" "Commutativity of ≡" "intro-elim:3:b")
AOT_hence ‹[λz \A[F]z] ≡_E [λz \A[H]z]›
by (safe intro!: "eqE"[THEN "≡_d_fI"] "&I" "cqt:2" Ordinary.GEN;
AOT_subst ‹[λz \A[F]z]u› ‹\A[F]u› for: u F)
(auto intro!: "beta-C-meta"[THEN "→E"] "cqt:2"
"Act-Basic:5"[THEN "≡E"(1)])
AOT_hence ‹[λz \A[F]z] ≈_E [λz \A[H]z]›
by (safe intro!: "apE-eqE:1"[unvarify F G, THEN "→E"] "cqt:2")
AOT_thus ‹[λz \A[F]z] ≈_E G ≡ [λz \A[H]z] ≈_E G›
using "≡I" "eq-part:2[terms]" "eq-part:3[terms]" "→E" "→I"
by metis
}
qed
AOT_show ‹◻∀x (A!x & [λx ∀F (x[F] ≡ [λz \A[F]z] ≈_E G)]x ≡ Numbers(x,G))›
proof (safe intro!: RN GEN)
AOT_modally_strict {
fix x
AOT_show ‹A!x & [λx ∀F (x[F] ≡ [λz \A[F]z] ≈_E G)]x ≡ Numbers(x,G)›
by (AOT_subst_def numbers; AOT_subst_thm "beta-C-meta"[THEN "→E", OF 0])
(auto intro!: "beta-C-meta"[THEN "→E", OF 0] "≡I" "→I" "&I" "cqt:2"
dest: "&E")
}
qed

‹The two theorems above allow us to derive
the predecessor axiom of PLM as theorem.›

pred: ‹[λxy ∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))]↓›
using pred_coex numbers_prop_den["∀I" G] "≡E" by blast

Predecessor :: ‹Π› (‹ℙ›)
"pred-thm:1":
‹ℙ =_d_f [λxy ∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))]›

"pred-thm:2": ‹ℙ↓›
using pred "pred-thm:1" "rule-id-df:2:b[zero]" by blast

"pred-thm:3":
‹[ℙ]xy ≡ ∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
by (auto intro!: "beta-C-meta"[unvarify ν₁ν_n, where τ=‹(_,_)›, THEN "→E",
rotated, OF pred, simplified]
tuple_denotes[THEN "≡_d_fI"] "&I" "cqt:2" pred
intro: "=_d_fI"(2)[OF "pred-thm:1"])

"pred-1-1:1": ‹[ℙ]xy → ◻[ℙ]xy›
(rule "→I")
AOT_assume ‹[ℙ]xy›
AOT_hence ‹∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using "≡E"(1) "pred-thm:3" by fast
then AOT_obtain F where ‹∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain u where props: ‹[F]u & Numbers(y,F) & Numbers(x,[F]^-^u)›
using "Ordinary.∃E"[rotated] by meson
AOT_obtain G where Ridigifies_G_F: ‹Rigidifies(G, F)›
by (metis "instantiation" "rigid-der:3")
AOT_hence ξ: ‹◻∀x([G]x → ◻[G]x)› and ζ: ‹∀x([G]x ≡ [F]x)›
using "df-rigid-rel:2"[THEN "≡_d_fE", THEN "&E"(1),
THEN "≡_d_fE"[OF "df-rigid-rel:1"], THEN "&E"(2)]
"df-rigid-rel:2"[THEN "≡_d_fE", THEN "&E"(2)] by blast+

AOT_have rigid_num_nec: ‹Numbers(x,F) & Rigidifies(G,F) → ◻Numbers(x,G)›
for x G F
proof(rule "→I"; frule "&E"(1); drule "&E"(2))
fix G F x
AOT_assume Numbers_xF: ‹Numbers(x,F)›
AOT_assume ‹Rigidifies(G,F)›
AOT_hence ξ: ‹Rigid(G)› and ζ: ‹∀x([G]x ≡ [F]x)›
using "df-rigid-rel:2"[THEN "≡_d_fE"] "&E" by blast+
AOT_thus ‹◻Numbers(x,G)›
proof (safe intro!:
"num-cont:2"[THEN "→E", OF ξ, THEN "qml:2"[axiom_inst, THEN "→E"],
THEN "∀E"(2), THEN "→E"]
"num-tran:3"[THEN "→E", THEN "≡E"(1), rotated, OF Numbers_xF]
eqE[THEN "≡_d_fI"]
"&I" "cqt:2[const_var]"[axiom_inst] Ordinary.GEN "→I")
AOT_show ‹[F]u ≡ [G]u› for u
using ζ[THEN "∀E"(2)] by (metis "≡E"(6) "oth-class-taut:3:a")
qed
qed
AOT_have ‹◻Numbers(y,G)›
using rigid_num_nec[THEN "→E", OF "&I", OF props[THEN "&E"(1), THEN "&E"(2)],
OF Ridigifies_G_F].
moreover {
AOT_have ‹Rigidifies([G]^-^u, [F]^-^u)›
proof (safe intro!: "df-rigid-rel:1"[THEN "≡_d_fI"] "df-rigid-rel:2"[THEN "≡_d_fI"]
"&I" "F-u[den]" GEN "≡I" "→I")
AOT_have ‹◻∀x([G]x → ◻[G]x) → ◻∀x([[G]^-^u]x → ◻[[G]^-^u]x)›
proof (rule RM; safe intro!: "→I" GEN)
AOT_modally_strict {
fix x
AOT_assume 0: ‹∀x([G]x → ◻[G]x)›
AOT_assume 1: ‹[[G]^-^u]x›
AOT_have ‹[λx [G]x & x ≠_E u]x›
apply (rule "F-u"[THEN "=_d_fE"(1), where τ₁τ_n="(_,_)", simplified])
apply "cqt:2[lambda]"
by (fact 1)
AOT_hence ‹[G]x & x ≠_E u›
by (rule "β→C"(1))
AOT_hence 2: ‹◻[G]x› and 3: ‹◻x ≠_E u›
using "&E" 0[THEN "∀E"(2), THEN "→E"] "id-nec4:1" "≡E"(1) by blast+
AOT_show ‹◻[[G]^-^u]x›
apply (AOT_subst ‹[[G]^-^u]x› ‹[G]x & x ≠_E u›)
apply (rule "F-u"[THEN "=_d_fI"(1), where τ₁τ_n="(_,_)", simplified])
apply "cqt:2[lambda]"
apply (rule "beta-C-meta"[THEN "→E"])
apply "cqt:2[lambda]"
using 2 3 "KBasic:3" "≡S"(2) "≡E"(2) by blast
}
qed
AOT_thus ‹◻∀x([[G]^-^u]x → ◻[[G]^-^u]x)› using ξ "→E" by blast
next
fix x
AOT_assume ‹[[G]^-^u]x›
AOT_hence ‹[λx [G]x & x ≠_E u]x›
by (auto intro: "F-u"[THEN "=_d_fE"(1), where τ₁τ_n="(_,_)", simplified]
intro!: "cqt:2")
AOT_hence ‹[G]x & x ≠_E u›
by (rule "β→C"(1))
AOT_hence ‹[F]x & x ≠_E u›
using ζ "&I" "&E"(1) "&E"(2) "≡E"(1) "rule-ui:3" by blast
AOT_hence ‹[λx [F]x & x ≠_E u]x›
by (auto intro!: "β←C"(1) "cqt:2")
AOT_thus ‹[[F]^-^u]x›
by (auto intro: "F-u"[THEN "=_d_fI"(1), where τ₁τ_n="(_,_)", simplified]
intro!: "cqt:2")
next
fix x
AOT_assume ‹[[F]^-^u]x›
AOT_hence ‹[λx [F]x & x ≠_E u]x›
by (auto intro: "F-u"[THEN "=_d_fE"(1), where τ₁τ_n="(_,_)", simplified]
intro!: "cqt:2")
AOT_hence ‹[F]x & x ≠_E u›
by (rule "β→C"(1))
AOT_hence ‹[G]x & x ≠_E u›
using ζ "&I" "&E"(1) "&E"(2) "≡E"(2) "rule-ui:3" by blast
AOT_hence ‹[λx [G]x & x ≠_E u]x›
by (auto intro!: "β←C"(1) "cqt:2")
AOT_thus ‹[[G]^-^u]x›
by (auto intro: "F-u"[THEN "=_d_fI"(1), where τ₁τ_n="(_,_)", simplified]
intro!: "cqt:2")
qed
AOT_hence ‹◻Numbers(x,[G]^-^u)›
using rigid_num_nec[unvarify F G, OF "F-u[den]", OF "F-u[den]", THEN "→E",
OF "&I", OF props[THEN "&E"(2)]] by blast
}
moreover AOT_have ‹◻[G]u›
using props[THEN "&E"(1), THEN "&E"(1), THEN ζ[THEN "∀E"(2), THEN "≡E"(2)]]
ξ[THEN "qml:2"[axiom_inst, THEN "→E"], THEN "∀E"(2), THEN "→E"]
by blast
ultimately AOT_have ‹◻([G]u & Numbers(y,G) & Numbers(x,[G]^-^u))›
by (metis "KBasic:3" "&I" "≡E"(2))
AOT_hence ‹∃u (◻([G]u & Numbers(y,G) & Numbers(x,[G]^-^u)))›
by (rule "Ordinary.∃I")
AOT_hence ‹◻∃u ([G]u & Numbers(y,G) & Numbers(x,[G]^-^u))›
using "Ordinary.res-var-bound-reas[Buridan]" "→E" by fast
AOT_hence ‹∃F ◻∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
by (rule "∃I")
AOT_hence 0: ‹◻∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using Buridan "vdash-properties:10" by fast
AOT_show ‹◻[ℙ]xy›
by (AOT_subst ‹[ℙ]xy› ‹∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›;
simp add: "pred-thm:3" 0)

"pred-1-1:2": ‹Rigid(ℙ)›
by (safe intro!: "df-rigid-rel:1"[THEN "≡_d_fI"] "pred-thm:2" "&I"
RN tuple_forall[THEN "≡_d_fI"];
safe intro!: GEN "pred-1-1:1")

"pred-1-1:3": ‹1-1(ℙ)›
(safe intro!: "df-1-1:1"[THEN "≡_d_fI"] "pred-thm:2" "&I" GEN "→I";
frule "&E"(1); drule "&E"(2))
fix x y z
AOT_assume ‹[ℙ]xz›
AOT_hence ‹∃F∃u ([F]u & Numbers(z,F) & Numbers(x,[F]^-^u))›
using "pred-thm:3"[THEN "≡E"(1)] by blast
then AOT_obtain F where ‹∃u ([F]u & Numbers(z,F) & Numbers(x,[F]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain u where u_prop: ‹[F]u & Numbers(z,F) & Numbers(x,[F]^-^u)›
using "Ordinary.∃E"[rotated] by meson
AOT_assume ‹[ℙ]yz›
AOT_hence ‹∃F∃u ([F]u & Numbers(z,F) & Numbers(y,[F]^-^u))›
using "pred-thm:3"[THEN "≡E"(1)] by blast
then AOT_obtain G where ‹∃u ([G]u & Numbers(z,G) & Numbers(y,[G]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain v where v_prop: ‹[G]v & Numbers(z,G) & Numbers(y,[G]^-^v)›
using "Ordinary.∃E"[rotated] by meson
AOT_show ‹x = y›
proof (rule "pre-Hume"[unvarify G H, OF "F-u[den]", OF "F-u[den]",
THEN "→E", OF "&I", THEN "≡E"(2)])
AOT_show ‹Numbers(x, [F]^-^u)›
using u_prop "&E" by blast
next
AOT_show ‹Numbers(y, [G]^-^v)›
using v_prop "&E" by blast
next
AOT_have ‹F ≈_E G›
using u_prop[THEN "&E"(1), THEN "&E"(2)]
using v_prop[THEN "&E"(1), THEN "&E"(2)]
using "num-tran:2"[THEN "→E", OF "&I"] by blast
AOT_thus ‹[F]^-^u ≈_E [G]^-^v›
using u_prop[THEN "&E"(1), THEN "&E"(1)]
using v_prop[THEN "&E"(1), THEN "&E"(1)]
using eqP'[THEN "→E", OF "&I", OF "&I"]
by blast
qed

"pred-1-1:4": ‹Rigid₁_-₁(ℙ)›
by (meson "≡_d_fI" "&I" "df-1-1:2" "pred-1-1:2" "pred-1-1:3")

"assume-anc:1":
‹[ℙ]^* = [λxy ∀F((∀z([ℙ]xz → [F]z) & Hereditary(F,ℙ)) → [F]y)]›
apply (rule "=_d_fI"(1)[OF "ances-df"])
apply "cqt:2[lambda]"
apply (rule "=I"(1))
by "cqt:2[lambda]"

"assume-anc:2": ‹ℙ^*↓›
using "t=t-proper:1" "assume-anc:1" "vdash-properties:10" by blast

"assume-anc:3":
‹[ℙ^*]xy ≡ ∀F((∀z([ℙ]xz → [F]z) & ∀x'∀y'([ℙ]x'y' → ([F]x' → [F]y'))) → [F]y)›
-
AOT_have prod_den: ‹\⊨_\◻ «(AOT_term_of_var x₁,AOT_term_of_var x₂)¬↓›
for x₁ x₂ :: ‹κ AOT_var›
by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
AOT_have den: ‹[λxy ∀F((∀z([ℙ]xz → [F]z) & Hereditary(F,ℙ)) → [F]y)]↓›
by "cqt:2[lambda]"
AOT_have 1: ‹[ℙ^*]xy ≡ ∀F((∀z([ℙ]xz → [F]z) & Hereditary(F,ℙ)) → [F]y)›
apply (rule "rule=E"[rotated, OF "assume-anc:1"[symmetric]])
by (rule "beta-C-meta"[unvarify ν₁ν_n, OF prod_den, THEN "→E",
simplified, OF den, simplified])
show ?thesis
apply (AOT_subst (reverse) ‹∀x'∀y' ([ℙ]x'y' → ([F]x' → [F]y'))›
‹Hereditary(F,ℙ)› for: F :: ‹<\<kappa>>›)
using "hered:1"[THEN "≡Df", THEN "≡S"(1), OF "&I", OF "pred-thm:2",
OF "cqt:2[const_var]"[axiom_inst]] apply blast
by (fact 1)

"no-pred-0:1": ‹¬∃x [ℙ]x 0›
(rule "raa-cor:2")
AOT_assume ‹∃x [ℙ]x 0›
then AOT_obtain a where ‹[ℙ]a 0›
using "∃E"[rotated] by blast
AOT_hence ‹∃F∃u ([F]u & Numbers(0, F) & Numbers(a, [F]^-^u))›
using "pred-thm:3"[unvarify y, OF "zero:2", THEN "≡E"(1)] by blast
then AOT_obtain F where ‹∃u ([F]u & Numbers(0, F) & Numbers(a, [F]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain u where ‹[F]u & Numbers(0, F) & Numbers(a, [F]^-^u)›
using "Ordinary.∃E"[rotated] by meson
AOT_hence ‹[F]u› and num0_F: ‹Numbers(0, F)›
using "&E" "&I" by blast+
AOT_hence ‹∃u [F]u›
using "Ordinary.∃I" by fast
moreover AOT_have ‹¬∃u [F]u›
using num0_F "≡E"(2) "0F:1" by blast
ultimately AOT_show ‹p & ¬p› for p
by (metis "raa-cor:3")

"no-pred-0:2": ‹¬∃x [ℙ^*]x 0›
(rule "raa-cor:2")
AOT_assume ‹∃x [ℙ^*]x 0›
then AOT_obtain a where ‹[ℙ^*]a 0›
using "∃E"[rotated] by blast
AOT_hence ‹∃z [ℙ]z 0›
using "anc-her:5"[unvarify R y, OF "zero:2",
OF "pred-thm:2", THEN "→E"] by auto
AOT_thus ‹∃z [ℙ]z 0 & ¬∃z [ℙ]z 0›
by (metis "no-pred-0:1" "raa-cor:3")

"no-pred-0:3": ‹¬[ℙ^*]0 0›
by (metis "existential:1" "no-pred-0:2" "reductio-aa:1" "zero:2")

"assume1:1": ‹(=_\ℙ) = [λxy ∃z ([ℙ]xz & [ℙ]yz)]›
apply (rule "=_d_fI"(1)[OF "id-d-R"])
apply "cqt:2[lambda]"
apply (rule "=I"(1))
by "cqt:2[lambda]"

"assume1:2": ‹ AFP
(rule "rule=E"[rotated, OF "assume1:1"[symmetric]])
AOT_have prod_den: ‹\⊨_\◻ «(AOT_term_of_var x₁,AOT_term_of_var x₂)¬↓›
for x₁ x₂ :: ‹κ AOT_var›
by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
AOT_have 1: ‹[λxy ∃z ([ℙ]xz & [ℙ]yz)]↓›
by "cqt:2"
AOT_show ‹[λxy ∃z ([ℙ]xz & [ℙ]yz)]xy ≡ ∃z ([ℙ]xz & [style='font-size: 18px;'>ℙ]yz)›
using "beta-C-meta"[THEN "→E", OF 1, unvarify ν₁ν_n,
OF prod_den, simplified] by blast

"assume1:3": ‹[ℙ]⁺ = [λxy [ℙ]^*xy ∨ x =_\ℙ y]›
apply (rule "=_d_fI"(1)[OF "w-ances-df"])
apply (simp add: "w-ances-df[den1]")
apply (rule "rule=E"[rotated, OF "assume1:1"[symmetric]])
apply (rule "=_d_fI"(1)[OF "id-d-R"])
apply "cqt:2[lambda]"
apply (rule "=I"(1))
by "cqt:2[lambda]"

"assume1:4": ‹[ℙ]⁺↓›
using "w-ances-df[den2]".

"assume1:5": ‹[ℙ]⁺xy ≡ [ℙ]^*xy ∨ x =_\ℙ y›
-
AOT_have 0: ‹[λxy [ℙ]^*xy ∨ x =_\ℙ y]↓› by "cqt:2"
AOT_have prod_den: ‹\⊨_\◻ «(AOT_term_of_var x₁, AOT_term_of_var x₂)¬↓›
for x₁ x₂ :: ‹κ AOT_var›
by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
show ?thesis
apply (rule "rule=E"[rotated, OF "assume1:3"[symmetric]])
using "beta-C-meta"[THEN "→E", OF 0, unvarify ν₁ν_n, OF prod_den, simplified]
by (simp add: cond_case_prod_eta)

NaturalNumber :: ‹τ› (‹ℕ›)
"nnumber:1": ‹ℕ =_d_f [λx [ℙ]⁺0x]›

"nnumber:2": ‹ℕ↓›
by (rule "=_d_fI"(2)[OF "nnumber:1"]; "cqt:2[lambda]")

"nnumber:3": ‹[ℕ]x ≡ [ℙ]⁺0x›
apply (rule "=_d_fI"(2)[OF "nnumber:1"])
apply "cqt:2[lambda]"
apply (rule "beta-C-meta"[THEN "→E"])
by "cqt:2[lambda]"

"0-n": ‹[ℕ]0›
(safe intro!: "nnumber:3"[unvarify x, OF "zero:2", THEN "≡E"(2)]
"assume1:5"[unvarify x y, OF "zero:2", OF "zero:2", THEN "≡E"(2)]
"∨I"(2) "assume1:2"[unvarify x y, OF "zero:2", OF "zero:2", THEN "≡E"(2)])
fix u
AOT_have den: ‹[λx O!x & x =_E u]↓› by "cqt:2[lambda]"
AOT_obtain a where a_prop: ‹Numbers(a, [λx O!x & x =_E u])›
using "num:1"[unvarify G, OF den] "∃E"[rotated] by blast
AOT_have ‹[ℙ]0a›
proof (safe intro!: "pred-thm:3"[unvarify x, OF "zero:2", THEN "≡E"(2)]
"∃I"(1)[where τ=‹«[λx O!x & x =_E u]¬›]
"Ordinary.∃I"[where β=u] "&I" den
"0F:1"[unvarify F, OF "F-u[den]", unvarify F,
OF den, THEN "≡E"(1)])
AOT_show ‹[λx [O!]x & x =_E u]u›
by (auto intro!: "β←C"(1) "cqt:2" "&I" "ord=Eequiv:1"[THEN "→E"]
Ordinary.ψ)
next
AOT_show ‹Numbers(a,[λx [O!]x & x =_E u])›
using a_prop.
next
AOT_show ‹¬∃v [[λx [O!]x & x =_E u]^-^u]v›
proof(rule "raa-cor:2")
AOT_assume ‹∃v [[λx [O!]x & x =_E u]^-^u]v›
then AOT_obtain v where ‹[[λx [O!]x & x =_E u]^-^u]v›
using "Ordinary.∃E"[rotated] "&E" by blast
AOT_hence ‹[λz [λx [O!]x & x =_E u]z & z ≠_E u]v›
apply (rule "F-u"[THEN "=_d_fE"(1), where τ₁τ_n="(_,_)", simplified, rotated])
by "cqt:2[lambda]"
AOT_hence ‹[λx [O!]x & x =_E u]v & v ≠_E u›
by (rule "β→C"(1))
AOT_hence ‹v =_E u› and ‹v ≠_E u›
using "β→C"(1) "&E" by blast+
AOT_hence ‹v =_E u & ¬(v =_E u)›
by (metis "≡E"(4) "reductio-aa:1" "thm-neg=E")
AOT_thus ‹p & ¬p› for p
by (metis "raa-cor:1")
qed
qed
AOT_thus ‹∃z ([ℙ]0z & [ℙ]0z)›
by (safe intro!: "&I" "∃I"(2)[where β=a])

"mod-col-num:1": ‹[ℕ]x → ◻[ℕ]x›
(rule "→I")
AOT_have nec0N: ‹[λx ◻[ℕ]x]0›
by (auto intro!: "β←C"(1) "cqt:2" simp: "zero:2" RN "0-n")
AOT_have 1: ‹[λx ◻[ℕ]x]0 &
∀x∀y ([[ℙ]⁺]0x & [[ℙ]⁺]0y → ([ℙ]xy → ([λx ◻[ℕ]x]x → [λx ◻[ℕ]x]y))) →
∀x ([[ℙ]⁺]0x → [λx ◻[ℕ]x]x)›
by (auto intro!: "cqt:2"
intro: "pre-ind"[unconstrain R, unvarify β, OF "pred-thm:2",
THEN "→E", OF "pred-1-1:4", unvarify z, OF "zero:2",
unvarify F])
AOT_have ‹∀x ([[ℙ]⁺]0x → [λx ◻[ℕ]x]x)›
proof (rule 1[THEN "→E"]; safe intro!: "&I" GEN "→I" nec0N;
frule "&E"(1); drule "&E"(2))
fix x y
AOT_assume ‹[ℙ]xy›
AOT_hence 0: ‹◻[ℙ]xy›
by (metis "pred-1-1:1" "→E")
AOT_assume ‹[λx ◻[ℕ]x]x›
AOT_hence ‹◻[ℕ]x›
by (rule "β→C"(1))
AOT_hence ‹◻([ℙ]xy & [ℕ]x)›
by (metis "0" "KBasic:3" Adjunction "≡E"(2) "→E")
moreover AOT_have ‹◻([ℙ]xy & [ℕ]x) → ◻[ℕ]y›
proof (rule RM; rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_modally_strict {
AOT_assume 0: ‹[ℙ]xy›
AOT_assume ‹[ℕ]x›
AOT_hence 1: ‹[[ℙ]⁺]0x›
by (metis "≡E"(1) "nnumber:3")
AOT_show ‹[ℕ]y›
apply (rule "nnumber:3"[THEN "≡E"(2)])
apply (rule "assume1:5"[unvarify x, OF "zero:2", THEN "≡E"(2)])
apply (rule "∨I"(1))
apply (rule "w-ances-her:3"[unconstrain R, unvarify β, OF "pred-thm:2",
THEN "→E", OF "pred-1-1:4", unvarify x,
OF "zero:2", THEN "→E"])
apply (rule "&I")
apply (fact 1)
by (fact 0)
}
qed
ultimately AOT_have ‹◻[ℕ]y›
by (metis "→E")
AOT_thus ‹[λx ◻[ℕ]x]y›
by (auto intro!: "β←C"(1) "cqt:2")
qed
AOT_hence 0: ‹[[ℙ]⁺]0x → [λx ◻[ℕ]x]x›
using "∀E"(2) by blast
AOT_assume ‹[ℕ]x›
AOT_hence ‹[[ℙ]⁺]0x›
by (metis "≡E"(1) "nnumber:3")
AOT_hence ‹[λx ◻[ℕ]x]x›
using 0[THEN "→E"] by blast
AOT_thus ‹◻[ℕ]x›
by (rule "β→C"(1))

"mod-col-num:2": ‹Rigid(ℕ)›
by (safe intro!: "df-rigid-rel:1"[THEN "≡_d_fI"] "&I" RN GEN
"mod-col-num:1" "nnumber:2")

Number: ‹[ℕ]κ›

AOT_modally_strict {
AOT_show ‹∃x [ℕ]x›
by (rule "∃I"(1)[where τ=‹«0¬›]; simp add: "0-n" "zero:2")
}

AOT_modally_strict {
AOT_show ‹[ℕ]κ → κ↓› for κ
by (simp add: "→I" "cqt:5:a[1]"[axiom_inst, THEN "→E", THEN "&E"(2)])
}

AOT_modally_strict {
AOT_show ‹∀x([ℕ]x → ◻[ℕ]x)›
by (simp add: GEN "mod-col-num:1")
}

Number: m n k i j

"0-pred": ‹¬∃n [ℙ]n 0›
(rule "raa-cor:2")
AOT_assume ‹∃n [ℙ]n 0›
then AOT_obtain n where ‹[ℙ]n 0›
using "Number.∃E"[rotated] by meson
AOT_hence ‹∃x [ℙ]x 0›
using "&E" "∃I" by fast
AOT_thus ‹∃x [ℙ]x 0 & ¬∃x [ℙ]x 0›
using "no-pred-0:1" "&I" by auto

"no-same-succ":
‹∀n∀m∀k([ℙ]nk & [ℙ]mk → n = m)›
(safe intro!: Number.GEN "→I")
fix n m k
AOT_assume ‹[ℙ]nk & [ℙ]mk›
AOT_thus ‹n = m›
by (safe intro!: "cqt:2[const_var]"[axiom_inst] "df-1-1:3"[
unvarify R, OF "pred-thm:2",
THEN "→E", OF "pred-1-1:4", THEN "qml:2"[axiom_inst, THEN "→E"],
THEN "≡_d_fE"[OF "df-1-1:1"], THEN "&E"(2), THEN "∀E"(1), THEN "∀E"(1),
THEN "∀E"(1)[where τ=‹AOT_term_of_var (Number.Rep k)›], THEN "→E"])

induction:
‹∀F([F]0 & ∀n∀m([ℙ]nm → ([F]n → [F]m)) → ∀n[F]n)›
(safe intro!: GEN[where 'a=‹<\<kappa>>›] Number.GEN "&I" "→I";
frule "&E"(1); drule "&E"(2))
fix F n
AOT_assume F0: ‹[F]0›
AOT_assume 0: ‹∀n∀m([ℙ]nm → ([F]n → [F]m))›
{
fix x y
AOT_assume ‹[[ℙ]⁺]0x & [[ℙ]⁺]0y›
AOT_hence ‹[ℕ]x› and ‹[ℕ]y›
using "&E" "≡E"(2) "nnumber:3" by blast+
moreover AOT_assume ‹[ℙ]xy›
moreover AOT_assume ‹[F]x›
ultimately AOT_have ‹[F]y›
using 0[THEN "∀E"(2), THEN "→E", THEN "∀E"(2), THEN "→E",
THEN "→E", THEN "→E"] by blast
} note 1 = this
AOT_have 0: ‹[[ℙ]⁺]0n›
by (metis "≡E"(1) "nnumber:3" Number.ψ)
AOT_show ‹[F]n›
apply (rule "pre-ind"[unconstrain R, unvarify β, THEN "→E", OF "pred-thm:2",
OF "pred-1-1:4", unvarify z, OF "zero:2", THEN "→E",
THEN "∀E"(2), THEN "→E"];
safe intro!: 0 "&I" GEN "→I" F0)
using 1 by blast

"suc-num:1": ‹[ℙ]nx → [ℕ]x›
(rule "→I")
AOT_have ‹[[ℙ]⁺]0 n›
by (meson Number.ψ "≡E"(1) "nnumber:3")
moreover AOT_assume ‹[ℙ]nx›
ultimately AOT_have ‹[[ℙ]^*]0 x›
using "w-ances-her:3"[unconstrain R, unvarify β, OF "pred-thm:2", THEN "→E",
OF "pred-1-1:4", unvarify x, OF "zero:2",
THEN "→E", OF "&I"]
by blast
AOT_hence ‹[[ℙ]⁺]0 x›
using "assume1:5"[unvarify x, OF "zero:2", THEN "≡E"(2), OF "∨I"(1)]
by blast
AOT_thus ‹[ℕ]x›
by (metis "≡E"(2) "nnumber:3")

"suc-num:2": ‹[[ℙ]^*]nx → [ℕ]x›
(rule "→I")
AOT_have ‹[[ℙ]⁺]0 n›
using Number.ψ "≡E"(1) "nnumber:3" by blast
AOT_assume ‹[[ℙ]^*]n x›
AOT_hence ‹∀F (∀z ([ℙ]nz → [F]z) & ∀x'∀y' ([ℙ]x'y' → ([F]x' → [F]y')) → [F]x)›
using "assume-anc:3"[THEN "≡E"(1)] by blast
AOT_hence θ: ‹∀z ([ℙ]nz → [ℕ]z) & ∀x'∀y' ([ℙ]x'y' → ([ℕ]x' → [ℕ]y')) → [ℕ]x›
using "∀E"(1) "nnumber:2" by blast
AOT_show ‹[ℕ]x›
proof (safe intro!: θ[THEN "→E"] GEN "→I" "&I")
AOT_show ‹[ℕ]z› if ‹[ℙ]nz› for z
using Number.ψ "suc-num:1" that "→E" by blast
next
AOT_show ‹[ℕ]y› if ‹[ℙ]xy› and ‹[ℕ]x› for x y
using "suc-num:1"[unconstrain n, THEN "→E"] that "→E" by blast
qed

"suc-num:3": ‹[ℙ]⁺nx → [ℕ]x›
(rule "→I")
AOT_assume ‹[ℙ]⁺nx›
AOT_hence ‹[ℙ]^*nx ∨ n =_\ℙ x›
by (metis "assume1:5" "≡E"(1))
moreover {
AOT_assume ‹[ℙ]^*nx›
AOT_hence ‹[ℕ]x›
by (metis "suc-num:2" "→E")
}
moreover {
AOT_assume ‹n =_\ℙ x›
AOT_hence ‹n = x›
using "id-R-thm:3"[unconstrain R, unvarify β, OF "pred-thm:2",
THEN "→E", OF "pred-1-1:4", THEN "→E"] by blast
AOT_hence ‹[ℕ]x›
by (metis "rule=E" Number.ψ)
}
ultimately AOT_show ‹[ℕ]x›
by (metis "∨E"(3) "reductio-aa:1")

"pred-num": ‹[ℙ]xn → [ℕ]x›
(rule "→I")
AOT_assume 0: ‹[ℙ]xn›
AOT_have ‹[[ℙ]⁺]0 n›
using Number.ψ "≡E"(1) "nnumber:3" by blast
AOT_hence ‹[[ℙ]^*]0 n ∨ 0 =_\ℙ n›
using "assume1:5"[unvarify x, OF "zero:2"] by (metis "≡E"(1))
moreover {
AOT_assume ‹0 =_\ℙ n›
AOT_hence ‹∃z ([ℙ]0z & [ℙ]nz)›
using "assume1:2"[unvarify x, OF "zero:2", THEN "≡E"(1)] by blast
then AOT_obtain a where ‹[ℙ]0a & [ℙ]na› using "∃E"[rotated] by blast
AOT_hence ‹0 = n›
using "pred-1-1:3"[THEN "df-1-1:1"[THEN "≡_d_fE"], THEN "&E"(2),
THEN "∀E"(1), OF "zero:2", THEN "∀E"(2),
THEN "∀E"(2), THEN "→E"] by blast
AOT_hence ‹[ℙ]x 0›
using 0 "rule=E" id_sym by fast
AOT_hence ‹∃x [ℙ]x 0›
by (rule "∃I")
AOT_hence ‹∃x [ℙ]x 0 & ¬∃x [ℙ]x 0›
by (metis "no-pred-0:1" "raa-cor:3")
}
ultimately AOT_have ‹[[ℙ]^*]0n›
by (metis "∨E"(3) "raa-cor:1")
AOT_hence ‹∃z ([[ℙ]⁺]0z & [ℙ]zn)›
using "w-ances-her:7"[unconstrain R, unvarify β, OF "pred-thm:2",
THEN "→E", OF "pred-1-1:4", unvarify x,
OF "zero:2", THEN "→E"] by blast
then AOT_obtain b where b_prop: ‹[[ℙ]⁺]0b & [ℙ]bn›
using "∃E"[rotated] by blast
AOT_hence ‹[ℕ]b›
by (metis "&E"(1) "≡E"(2) "nnumber:3")
moreover AOT_have ‹x = b›
using "pred-1-1:3"[THEN "df-1-1:1"[THEN "≡_d_fE"], THEN "&E"(2),
THEN "∀E"(2), THEN "∀E"(2), THEN "∀E"(2), THEN "→E",
OF "&I", OF 0, OF b_prop[THEN "&E"(2)]].
ultimately AOT_show ‹[ℕ]x›
using "rule=E" id_sym by fast

"nat-card": ‹[ℕ]x → NaturalCardinal(x)›
(rule "→I")
AOT_assume ‹[ℕ]x›
AOT_hence ‹[[ℙ]⁺]0x›
by (metis "≡E"(1) "nnumber:3")
AOT_hence ‹[[ℙ]^*]0x ∨ 0 =_\ℙ x›
using "assume1:5"[unvarify x, OF "zero:2", THEN "≡E"(1)] by blast
moreover {
AOT_assume ‹[[ℙ]^*]0x›
then AOT_obtain a where ‹[ℙ]ax›
using "anc-her:5"[unvarify R x, OF "zero:2", OF "pred-thm:2", THEN "→E"]
"∃E"[rotated] by blast
AOT_hence ‹∃F∃u ([F]u & Numbers(x,F) & Numbers(a,[F]^-^u))›
using "pred-thm:3"[THEN "≡E"(1)] by blast
then AOT_obtain F where ‹∃u ([F]u & Numbers(x,F) & Numbers(a,[F]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain u where ‹[F]u & Numbers(x,F) & Numbers(a,[F]^-^u)›
using "Ordinary.∃E"[rotated] by meson
AOT_hence ‹NaturalCardinal(x)›
using "eq-num:6"[THEN "→E"] "&E" by blast
}
moreover {
AOT_assume ‹0 =_\ℙ x›
AOT_hence ‹0 = x›
using "id-R-thm:3"[unconstrain R, unvarify β, OF "pred-thm:2",
THEN "→E", OF "pred-1-1:4", unvarify x,
OF "zero:2", THEN "→E"] by blast
AOT_hence ‹NaturalCardinal(x)›
by (metis "rule=E" "zero-card")
}
ultimately AOT_show ‹NaturalCardinal(x)›
by (metis "∨E"(2) "raa-cor:1")

"pred-func:1": ‹[ℙ]xy & [ℙ]xz → y = z›
(rule "→I"; frule "&E"(1); drule "&E"(2))
AOT_assume ‹[ℙ]xy›
AOT_hence ‹∃F∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using "pred-thm:3"[THEN "≡E"(1)] by blast
then AOT_obtain F where ‹∃u ([F]u & Numbers(y,F) & Numbers(x,[F]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain a where
Oa: ‹O!a›
and a_prop: ‹[F]a & Numbers(y,F) & Numbers(x,[F]^-^a)›
using "∃E"[rotated] "&E" by blast
AOT_assume ‹[ℙ]xz›
AOT_hence ‹∃F∃u ([F]u & Numbers(z,F) & Numbers(x,[F]^-^u))›
using "pred-thm:3"[THEN "≡E"(1)] by blast
then AOT_obtain G where ‹∃u ([G]u & Numbers(z,G) & Numbers(x,[G]^-^u))›
using "∃E"[rotated] by blast
then AOT_obtain b where Ob: ‹O!b›
and b_prop: ‹[G]b & Numbers(z,G) & Numbers(x,[G]^-^b)›
using "∃E"[rotated] "&E" by blast
AOT_have ‹[F]^-^a ≈_E [G]^-^b›
using "num-tran:2"[unvarify G H, OF "F-u[den]", OF "F-u[den]",
THEN "→E", OF "&I", OF a_prop[THEN "&E"(2)],
OF b_prop[THEN "&E"(2)]].
AOT_hence ‹F ≈_E G›
using "P'-eq"[unconstrain u, THEN "→E", OF Oa, unconstrain v, THEN "→E",
OF Ob, THEN "→E", OF "&I", OF "&I"]
a_prop[THEN "&E"(1), THEN "&E"(1)]
b_prop[THEN "&E"(1), THEN "&E"(1)] by blast
AOT_thus ‹y = z›
using "pre-Hume"[THEN "→E", THEN "≡E"(2), OF "&I",
OF a_prop[THEN "&E"(1), THEN "&E"(2)],
OF b_prop[THEN "&E"(1), THEN "&E"(2)]]
by blast

"pred-func:2": ‹[ℙ]nm & [ℙ]nk → m = k›
using "pred-func:1".

being_number_of_den: ‹[λx x = #G]↓›
(rule "safe-ext"[axiom_inst, THEN "→E"]; safe intro!: "&I" GEN RN)
AOT_show ‹[λx Numbers(x,[λz \A[G]z])]↓›
by (rule numbers_prop_den[unvarify G]) "cqt:2[lambda]"

AOT_modally_strict {
AOT_show ‹Numbers(x,[λz \A[G]z]) ≡ x = #G› for x
using "eq-num:2".
}

ψ_nat :: ‹ψ → nat› where ψ_nat: ‹surj ψ_nat›
‹Unfortunately, since the axiom requires the type @{typ ψ}
to have an infinite domain, @{command nitpick} can only find a potential model
and no genuine model.
However, since we could trivially choose @{typ ψ} as a copy of @{typ nat},
we can still be assured that above axiom is consistent.›
‹True› nitpick[satisfy, user_axioms, card nat=1, expect = potential] ..

"modal-axiom":
‹∃x([ℕ]x & x = #G) → ♢∃y([E!]y & ∀u (\A[G]u → u ≠_E y))›
(rule AOT_model_axiomI) AOT_modally_strict {
text‹The actual extension on the ordinary objects of a property is the
set of ordinary urelements that exemplifies the property in the
designated actual world.›
define act_ψext :: ‹<\<kappa>> → ψ set› where
 \<open>act_\<omega>ext \<equiv> \<lambda> \<Pi> . {x :: \<omega> . [w\<^sub>0 \<Turnstile> [\<Pi>]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>]}\<close>
 text\<open>Encoding a property with infinite actual extension on the ordinary objects
 denotes a property by extended relation comprehension.\<close>
 AOT_have enc_finite_act_\<omega>ext_den:
 \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>x \<exists>F(\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]\<down>\<close>
 proof(safe intro!: Comprehension_1[THEN "\<rightarrow>E"] RN GEN "\<rightarrow>I")
 AOT_modally_strict {
 fix F G
 AOT_assume \<open>\<box>G \<equiv>\<^sub>E F\<close>
 AOT_hence \<open>\<^bold>\<A>G \<equiv>\<^sub>E F\<close>
 using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
 AOT_hence \<open>\<^bold>\<A>(G\<down> & F\<down> & \<forall>u([G]u \<equiv> [F]u))\<close>
 by (AOT_subst_def (reverse) eqE)
 hence \<open>[w\<^sub>0 \<Turnstile> [G]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>] = [w\<^sub>0 \<Turnstile> [F]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>]\<close> for x
 by (auto dest!: "\<forall>E"(1) "\<rightarrow>E"
 simp: AOT_model_denotes_\<kappa>_def AOT_sem_denotes AOT_sem_conj
 AOT_model_\<omega>\<kappa>_ordinary AOT_sem_act AOT_sem_equiv)
 AOT_thus \<open>\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var F))\<guillemotright> \<equiv>
 \<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext (AOT_term_of_var G))\<guillemotright>\<close>
 by (simp add: AOT_sem_not AOT_sem_equiv act_\<omega>ext_def
 AOT_model_proposition_choice_simp)
 }
 qed
 text\<open>By coexistence, encoding only properties with finite actual extension
 on the ordinary objects denotes.\<close>
 AOT_have \<open>[\<lambda>x \<forall>F(x[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)]\<down>\<close>
 proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I" RN GEN)
 AOT_show \<open>[\<lambda>x \<not>[\<lambda>x \<exists>F(\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]x]\<down>\<close>
 by "cqt:2"
 next
 AOT_modally_strict {
 fix x
 AOT_show \<open>\<not>[\<lambda>x \<exists>F (\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]x \<equiv>
 \<forall>F(x[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
 by (AOT_subst \<open>[\<lambda>x \<exists>F (\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])]x\<close>
 \<open>\<exists>F (\<not>\<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright> & x[F])\<close>;
 (rule "beta-C-meta"[THEN "\<rightarrow>E"])?)
 (auto simp: enc_finite_act_\<omega>ext_den AOT_sem_equiv AOT_sem_not
 AOT_sem_forall AOT_sem_imp AOT_sem_conj AOT_sem_exists)
 }
 qed
 text\<open>We show by induction that any property encoded by a natural number
 has a finite actual extension on the ordinary objects.\<close>
 AOT_hence \<open>[\<lambda>x \<forall>F any be found.
 proof(rule induction[THEN "\<forall>E"* -track recordmedia errors, throwout devices
 safe intro!: "&I" "Number.GEN" "\<beta>\<leftarrow>C" "zero:2" "\<java.lang.StringIndexOutOfBoundsException: Index 82 out of bounds for length 3
 !:"<beta>\<rightarrow>C")
 *java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 proof(safe intro!: GEN "\<rightarrow>I")
* bitmap at ( blocksize)bits,
 AOT_assume \<open>0[F]\<close>
 java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
 AOT_hence \<open>\<not>\<exists>u [F]u\ */
*reporting purposes.
 AOT_hence ( /BTRFS_MIN_BLOCKSIZE)]java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52

 hence \<
 by t scrubcontext or theworkersare
 inline #name(struct *stripe,\


AOT_thus<><\><sub\o> (<ext )\guillemotright\close>
java.lang.StringIndexOutOfBoundsException: Range [62, 56) out of bounds for length 77

 next

 sizeof(struct ),
 AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(m,F) & Numbers(n,[F]\<^sup>-\<^sup>u))\<close>
using"red-:3"THEN"<E()
 where\\exists> (Gu&Numbers(,)&Numbers(,G\^>\<s>)<>
 "<"
 atomic_set(sctx-cancel_req,0;
 usingjava.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2

 AOT_assume n_prop: \<open>\<forall>F(n[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
 AOT_show \<open>\<forall>F(m[F] \<rightarrow> \<guillemotleft>\<epsilon>\<^sub>\<o> w. finite (act_\<omega>ext F)\<guillemotright>)\<close>
>,nlink,
 fix F
 AOT_assume \<open>m[F] *;
 physical;
 >[;
 THEN scrub tobackrefforlogical%llu d,
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 java.lang.StringIndexOutOfBoundsException: Range [0, 11) out of bounds for length 0
 AOT_assumejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 hence inf: \<open>infinite (act_\<omega>ext
byautosimp: AOT_sem_not AOT_model_proposition_choice_simp)
 then AOT_obtain v where act_F_v: \<open>\<^bold>\<A>[F]v\<close>
unfoldingAOT_sem_act \omega>ext_def
AOT_model_\<mega>\<kappa>_ordinary
shash> = -;
mem_Collect_eq )
 AOT_hence \<ifstripe-[]. =
 scrub_bitmap_clear_csum_errorstripe,sector_nr,sectors_per_tree);
 AOT_hence \<int ;
 by (safe /
 0[ * This onlyhappenona filesystemwherechunks
 moreover AOT_have \<open>[ stripe->logical);
 ( intro!:"apE-:"[nvarify F G THEN \<ightarrow>E" "qt"
 "F-u[den]"[unvarify F] eqE */
 Ordinary.GENjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 fix u
>x \<bold><A>F]]x& x\<oteq\<subE v]\<quiv \<lambda>x \^bold>\A[F]]u&u\noteq>\^sub>E \<close>
by( intro! "eta-C-meta"[THEN"\rightarrow>E"] "cqt:2")
\<bold\A[]x & \noteq\E v \equiv> <bold>\<A>F]u &u<>E \c>
 AOT_subst <>\lambdax\^>\<[]xu<>\open><^><>F]\<lose>java.lang.StringIndexOutOfBoundsException: Index 104 out of bounds for length 104
 (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2"
 "oth-class- struct btrfs_fs_info *fs_info = stripe->bg-*=stripe>->fs_info;
 also AOT_have \<open>\<^bold>\< ASSERT(bio->io.bi_size;
 }
 also AOT_have \<open>\<^bold>\<Ajava.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 by (AOT_subst \<open>java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 3
 (safe intro!: "beta-C-meta"[THEN " u64 mapped_len=fs_info-sectorsize;
 "oth-class-taut:3:a")
 also AOT_have java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
 by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E", symmetric] "cqt:2")
 finally AOT_show \ java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
intro ruleid-:2:[OF "-",where <><^>\tau><s>n\open>__\close>simplified)

 ultimatelyfor (nti=0 i <errors->nr_csum_errors; i++)
 using "eq-part:2[terms]" "eq-part:3[terms] >tat. + >java.lang.StringIndexOutOfBoundsException: Index 61 out of bounds for length 61
 \open>[\<ambda> Fy&y \<noteq> v]<lose>
 by (safe intro!: 0[THEN "&E"(2), THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"],
 THEN "&E"(2), THEN "java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 hence finite: \<open>java.lang.StringIndexOutOfBoundsException: Range [0, 35) out of bounds for length 30
 by (safe intro!: n_prop[THEN "\<forall> /*
 *
 "cqt if(()
obtain where y_def<><>\kappa>y (Ordinary.Rep v)\<close>
 by (etis <><>Ordinary.restricted_var_condition)
 AOT_actually {
 fix x
 \>\lambday[]y& <><E\\<>\java.lang.StringIndexOutOfBoundsException: Range [119, 118) out of bounds for length 127
AOT_hence open[]<guillemotleft><mega>< \<guillemotright><>
>\<>""E())
 }
 moreover AOT_actuallyjava.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2
<F\guillemotleft><><appa>y\guillemotright\close>
 unfolding y_def using act_F_v AOT_sem_act (java.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 52

 moreover AOT_actually {
 x
 assume noteq: \<open>x \<noteq> y\<java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 30
 AOT_assume \<open>[F]\<guillemotleft>\<omega>\<kappa> x\<guillemotright>\<close>
 moreover AOT_have \<omega> if(!test_bit(io_off>>fs_info->sectorsize_bits,
 using AOT_sem_exe calculation by blast
 moreover*
 AOT_have \<open>\<not>(\<guillemotleft>\<omega>\<kappa> x\<guillemotright> =\<^sub>E v)\ */
 proof(rule "raa-cor:2")
 AOT_assume \<open>\<guillemotleft>\<omega>\java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 17
 AOT_hence \<open>\<guillemotleft>\<omega>\<kappa> x\<guillemotright> = v\<close>
using =E-simple:"unvarify x, \,\\_java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
 by blast
 hence \<open>\<omega>\<kappa> x = \<omega>\<kappa> y\<close>
 unfolding y_def AOT_sem_eq
 -+ ;
 timeout;
 by blast
 AOT_thus \<open>p & \<not>p\<close> for p using noteq by blast
 qed
 \open>\guillemotleft><omega>\kappa> x\guillemotright>\noteq><^sub>E v\close>
 by (safe intro!: "thm-neg=E"[unvarify x, THEN "\<equiv>E"(2)] \<omega>java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
* 0 the extent range covers any byte of the range.
 ultimately AOT_have \<open>[\<lambda>y [F] /
 auto intro!:"<beta><leftarrow>C" ":2 "&"java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
 }
 ultimately have \<open>(insert y (act_\<omega>ext \<guillemotleft> [@search_start, @search_start @earch_length)
 act_\omega>(AOT_term_of_var F)\close>
 unfolding act_\<omega>ext_def
 by auto
 hence \<open>finite (act_\<omega>ext (AOT_term_of_var F))\<close>
(ath->odes[]java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
 AOT_thus \<open>p & \<not>p\<close> for p
 using inf by blast

 qed
 qed
 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 using "\<;

 text ASSERT(.ype =BTRFS_METADATA_ITEM_KEY|
 the domain of ordinary objects to be infinite.\<close>
 AOT_show \<open>\<exists>

 AOT_assume \< extent_flags
 then AOT_obtain n where \<open>n = #G\<close>
 }
 AOT_hence \<open/*
 using "eq-num Return >0 if there no such stripe in the specified .
 AOT_hence \<open>n[G]\<close>
 u64 =java.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 33
 THEN "\<forall>Escrub_stripe_reset_bitmapsstripe)
 "eq ;
 AOT_hence * Round to .
 using nat_enc_finite[THEN "\<forall>E"(2) bg-;
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
( simp)
 AOT_have \<open>\<exists>u \<not>\/* Now csum.*/
 proof(rule "raa-cor:1"
 AOT_assume \<open>\<}
 AOT_hence \<open>\< for (nt =;i -nr_sectors +){
 by (metis "cqt-further:java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 AOT_hence \<java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
 using "\<forall> ASSERT(-bio.;
 hence \<open>[w\<^sub>0 \<Turnstile i <s;
 metis <\_
 AOT_model_denotes_\<kappa>_def AOT_sem_act \<kappa>.disc(7))
 hence \<open
 unfolding act_\<omega>ext_def by auto
have < U::<>set)\>
finite_UNIV_char_0
 btrfs_need_stripe_tree_update(>-f)java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
 by simp
 AOT_thus \<open>p & \<not */
 qed
 then AOT_obtain x * java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 55
 \E[java.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 42
 java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 42
 by (java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 2
moreoverAOT_have <pen>b\forall> (<b\A>] <ightarrow>u \<oteq><^Ex)<>

 dally_strict{
 y
 AOT_assume \<open>O!y\<close>
 AOT_assume 0 \open><bold><>[]y<close>
 AOT_show \<open>y \<noteq>\<^sub> int ;i< +
 proof (safe intro!: "thm-neg=E ;
 int s *,struct btrfs_block_group bg,
java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 40
 by (metis "=E-simple:2" "vdash-properties:10")
hence<>y \close>
 by (simp add: AOT_sem_eq AOT_term_of_var_inject)
 AOT_hence scrub_raid56_parity_stripejava.lang.StringIndexOutOfBoundsException: Range [45, 44) out of bounds for length 61
 using x_prop "&E" AOT_sem_not AOT_sem_act by metis
 AOT_thus \<open>\<^bold>\<A>[G ;
 * asthe maybe extent.Thus
 qed
 java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
 qed
 ultimately AOT_have \<open>\<diamond>(\< BTRFS_STRIPE_LEN,stripe)
 using "KBasic:16"[THEN "\<rightarrow>E", OF "&I"] by blast
 AOT_hence \<open>\<diamond>(E!x & }
 by (AOT_subst \<open>E!x & \for(int i = 0 i < data_stripes; i+) {
 (auto simp: "oth-class-taut:2:a")
 AOT_hence \<open>\<exists>y \<diamond>(E!y java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2
 using "\<exists>I" by fast
 AOT_thus \<open>\<diamond>\<exists>y (E!y & \<forall>java.lang.StringIndexOutOfBoundsException: Range [0, 58) out of bounds for length 4
CBF\diamond>[HEN "\rightarrow>" fast
 qed
java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

modallemma"
 \<open>\<diamond>\<forall>u(\<^bold>\<A (ret < 0){
proof(safe intro!: "\<rightarrow>I" java.lang.StringIndexOutOfBoundsException: Range [0, 44) out of bounds for length 22
 AOT_modally_strict {
 fix u
 btrfs_release_path(extent_path)java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
 AOT_have java.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 71
<I"
 ,
 AOT_hence \<open>\<^bold>\< *The java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
 using "Ordinary.\<forall>E" by fast
 AOT_thus \>;
 using act_Gu "\<rightarrow>E" by blast
 qed
 } note 0 = this
AOT_have\theta>: <open>\<>\<forall>u(\^bold><A>Gu \rightarrow> u \<noteq>\<^sub>E v) \<rightarrow> u \<noteq>\<^sub>E v)\<close> if \<open>\<box>\<^bold>\<A>[G]u\<close> for u
 proof -
 AOT_have \<open>\<box>\<^bold>\<A>[G]u \<rightarrow> \<box *skip
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 thus ?thesis using that "\<rightarrow>E" by blast
 qed
int = ;
 AOT_assume 1java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 AOT_assume \<open>\<^bold>\<A>[G]u\<close>
 AOT_hence \<open>\<box>\<^bold>\<A>[G]u\<close>
 by (metis "Act-Basic:6" "\<equiv>E"(1))
 const u64 -t & ;
 using Ordinary.\<psi> \<theta> by blast
 AOT_hence \<open>\<diamond>u \<noteq>\<^sub>E v\<close>
 - )
AOT_thus \open> <> v\<lose>
 by (metis "id-nec4:2" "\<equiv>E"(1))
qed

oralln\exists>! [<bbbP>]m\<close>
proof(safe intro!: Number.GEN "\<rightarrow>I" "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
 fix n
 AOT_have \<open>NaturalCardinal(n)\<close>
natcard"\psi \rightarrow>")
 AOT_hence \<open>\<exists>G(n = #G)\<close>
 by (metis "\<equiv>\<^sub>d\<^sub>fE" =chunk_logicaljava.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
 then AOT_obtain G where n_num_G: \<open>n = #G\<close>
 using "\<exists>E"[rotated] by blast
 AOT_hence \<open>\<exists>n (n = #G)\<close physical_end)
 by (rule "Number.\<exists>I")
 AOT_hence \<open>\<diamond>\<exists>y ( *stripe itis than SINGLE profile.
-axiom"[xiom_inst THEN \<rightarrow>E" byblast
 AOT_hence \<open>\ ->stat. =physical;
 using "BF\<diamond>"[THEN "\<rightarrow>E"] by auto
 then AOT_obtain y where \<open>\ if (sctx>raid56_data_stripes) {
 using "\<exists>E"[rotated] by blast
 AOT_hence \<open>\<diamond>E!y\<close> and 2: \<open>\<diamond>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y)\<close>
 using "KBasic2:3" "&E" "\<rightarrowreturn ret < 0 ? ret : 0;
 AOT_hence Oy: \<open>O!y\<close>
 by (auto intro!: "\<beta>\<leftarrow>C"(java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 !(, &-runtime_flags)java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62
 using ;
 AOT_have 1: \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<java.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 51
 java.lang.StringIndexOutOfBoundsException: Range [33, 31) out of bounds for length 39
 AOT_obtain b where b_prop: \<open>Numbers(b, [\<lambda>x \<^bold>\<A;
 using s *,
 AOT_have Pnb: \<open>[\<bbbP>]nb\<close>
 proof(safe intro!: struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
 "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\< -NOMEM;
 1 "\<exists>I"(2)[java.lang.StringIndexOutOfBoundsException: Range [0, 44) out of bounds for length 19
 AOT_show \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]y\<close>
byauto ! \<>\lC"(1 cqt:2 \orI()
 "ord=Eequiv:1"[THEN "\
 next break;
 AOT_have equinum: \<open>[\<lambda>x \<^bold>\<A>[G]x if (. <key.)
 proof( chunk_offset =btrfs_dev_extent_chunk_offsetl ;
 ( */java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 AOT_show \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x *We the searchdevice java.lang.StringIndexOutOfBoundsException: Range [66, 67) out of bounds for length 66
 proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" *thisjava.lang.StringIndexOutOfBoundsException: Range [44, 42) out of bounds for length 65
 Ordinary.GEN "\<rightarrow>I"; "cqt:2"?)
 fix u
 AOT_have \<open>[[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]\<^sup */
 java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 4
 by (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)]; "cqt:2")
 also AOT_have t,&-runtime_flags)
 apply (AOT_subst \<open> *call )
 apply r "-cor"THEN "rightarrow>" \forallE();":2)
 using "oth-class-taut:3:a" by blast
 also AOT_have \<open>\<dots> \<equiv> SYSTEM 'sjava.lang.StringIndexOutOfBoundsException: Range [48, 47) out of bounds for length 55
 proof(safe java.lang.StringIndexOutOfBoundsException: Range [0, 24) out of bounds for length 4
 AOT_assume \<open>(\< *
 AOT_thus \<open>\<^bold>\<A>[G]u\<close>
 by (metis "&E"(1) "&E"(2 dev 'nottoa
 next
 AOT_assume \<open>\<^bold>\<A>[G]u\<close>
 \open> \noteq> y<>and \open><bold><>G] <> =<> \close>
 using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF Ordinary failed in creating new chunk for metadata.
"∨
java.lang.NullPointerException
using "&I" by simp
qed
java.lang.StringIndexOutOfBoundsException: Index 84 out of bounds for length 84
by (rule "beta-C-cor:2"[THEN "→E", THEN "∀E"(2), symmetric]; "cqt:2")
java.lang.NullPointerException
qed
qed
java.lang.NullPointerException
AOT_show ‹Numbers(n,[λx \A[G]x ∨ x =->cursor_right = found_key.offset + dev_extent_len;
using "num-tran:1"[unvarify G H, OF 2, OF "F-u[den]"[unvarify F, OF 1],
java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 0
OF " !btrfs_finish_block_group_to_copy(dev_replace->srcdev,
qed
AOT_show ‹∃d->cursor_right;
proof(safe intro!: "∃I"(2)[where β=b] "&I" Pnb "→I" GEN)
java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 87
next
fix y
AOT_assume 0: ‹[ℕ]y & [ℙ]ny›
AOT_show ‹y = b›
apply (rule "pred-func:1"[THEN "→E"])
using 0[THEN "&E"(2)] Pnb "&I" by blast
qed

(* Note the use of a bold '. *)
AOT_define Successor :: ‹τ → κ_s› (‹_''› [100] 100)
 "def-suc": ‹n' =_d_f \ιm([ℙ]nm)›

text‹Note: not explicitly in PLM›
AOT_theorem "def-suc[den1]": ‹\ιm([ℙ]nm)↓›
 using "A-Exists:2" "RA[2]" "≡E"(2) "th-succ"[THEN "Number.∀E"] by blast
text‹Note: not explicitly in PLM›
AOT_theorem "def-suc[den2]": shows ‹n'↓\<
by (rule "def-suc"[THEN "= dev->devid,
:e-u[e1)

(* TODO: not in PLM *)
AOT_theorem suc_eq_desc: ‹n\<
java.lang.NullPointerException
(auto simp: "def-suc[den1]" "rule=I:1")

"suc-fact": ‹
(rule "→
AOT_assume 0: ‹
AOT_show ‹n' = m'›
apply (rule "rule=E"[rotated, OF 0])
by (rule "=I"(1)[OF "def-suc[den2]"])

"ind-gnd": \
-
AOT_have ‹[[ℙ]⁺;
using Number.ψ
AOT_hence ‹ p_nc(st-st_lo)
using "assume1:5"[unvarify x, OF "zero:2", THEN "≡E"(1)] by blast
moreover {
AOT_assume ‹[[ℙ] iif (refcu_dcanmue_ok&sno>su_wokr_ect
AOT_hence ‹∃
using "w-ances-her:7"[unconstrain R, unvarify β x, OF "zero:2",
OF "pred-thm:2", THEN "→E", OF "pred-1-
THEN "→E"]
by blast
then AOT_obtain z where θ: ‹[[ℙ]⁺]0z› and ξ: ‹[ℙ]zm›
using "&E" "∃E"[rotated] by blast
AOT_have Nz: ‹[ℕ]z›
using θ "≡E"(2) "nnumber:3" by blast
moreover AOT_have ‹m = z'›
proof (rule "def-suc"[THEN "=_d_fI"(1)];
safe intro!: "def-suc[den1]"[unconstrain n, THEN "→E", OF Nz]
"nec-hintikka-scheme"[THEN "≡E"(2)] "&I"
GEN "→I" "Act-Basic:2"[THEN "≡E"(2)])
AOT_show ‹
by (meson "mod-col-num:1" "nec-imp-act" "→
next
AOT_show ‹\A[ℙ]zm› using ξ
t radol,iti_dvrplc)
next
fix y
subseteq> S ==>it ==> S-(it-{x}) = insert x (S-it)" by auto
AOT_hence ‹A[ℕ and ‹A[ℙ
java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 57
AOT_hence 0: ‹[ℙ]zy›
by (metis RN "≡
AOT_thus ‹y = m›
using "pred-func:1"[THEN "→E", OF "&I"] ξ
mutex_oc(&f_info->s_device-dvie_istt_mtex;
ultimately AOT_have ‹[ℕ]z & m = z'›c){
by (rule "&I")
AOT_hence ‹∃
by (rule "∃
hence ?thesis
by (rule "∨I")

moreover {
AOT_assumei_rule :
AOT_hence ‹0 = m› ssumes II1: "∧σ. [I {} σ] ==> P σ"
text \We first define a fold-function in the nrest-monad›
THEN "→rightarrow>E"]
by auto
hence ?thesis using id_sym "∨I" by blast
}
ultimately show ?thesis
(fs_nf)

"suc-thm": ‹[ℙ]n n CR Cns.prmsby (at ip EUNT_efn dst:furl)
java.lang.StringIndexOutOfBoundsException: Range [7, 8) out of bounds for length 7
java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 58
using "free-thms:1"[TE \>E"(1), OF "def-suc[den2]"]
using "∃
java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
apply (rule "rule=E"[rotated, OF suc_eq_desc[symmetric]])
apply (rule "actual-desc:4"[THEN "→E"])
by (simp add: "def-suc[den1]")
AOT_hence ‹
using "Act-Basic:2" "≡E"(1) "&E" by blast+
AOT_hence ‹
using m_is_n[symmetric] "rule=E" by fast+
AOT_hence ‹[ℙ]nx›
by (metis RN "≡E"(1) "pred-1-1:1" "sc-eq-fur:2" "→E")
thus ?thtf_inf(sino, crb so eid luwt tau:%d,
using m_is_n "rule=E" by fast

Numeral1 :: ‹κ_s› (‹1›, s scru has finished..
"numerals:1": ‹1 =_d(need_commit) {

"prec-facts:1": ‹[ℙ]0 1›
o "numerals:1"[THEN rl-iddf2bzr],
OF "def-suc[den2]"[unconstrain n, unvarify β,
OF "zero:2", THEN "→E", OF "0-n"]]
"suc-thm"[unconstrain n, unvarify β, OF "zero:2",
THEN "→E", OF "0-n"])

(* TODO: more theorems *)

(* Note: we forgo restricted variables for natural cardinals. *)
AOT_define Finite :: ‹τ → φ› (‹-scrubs_pau) !=
"inf-card:1": ‹
Infinite :: ‹τ → φ› (‹
"inf-card:2": ‹Infinite(x) ≡_d_f NaturalCardinal(x) & ¬Finite(x)›

"inf-card-exist:1": ‹NaturalCardinal(#O!)›
java.lang.NullPointerException
"num-def:2"[unvarify G] "oa-exist mutex_unlock(&fs_info->scrub_lock);

java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 48
java.lang.NullPointerException
AOT_show ‹¬Finite(#O!)›
proof(rule "raa-cor:2")
AOT_assume ‹Finite(#O!)›
AOT_hence 0: ‹[ℕ]#O!›
java.lang.NullPointerException
AOT_have ‹
using "eq-num:3"[unvarify G, OF "oa-exist:1"].
AOT_hence ‹#O! = #O!›
using "eq-num:2"[unvarify x G, THEN "≡E"(1), OF "oa-exist:1",
OF "num-def:2"[unvarify G], OF "oa-exist:1"]
by blast
AOT_hence ‹[ℕscrub *sctx = NULL;;
using 0 "&I" by blast
AOT_hence ‹∃x ([ℕ]x & x = #O!)›
using "num-def:2"[unvarify G, OF "oa-exist:1"] "∃I"(1) by fast
AOT_hence ‹♢EN) : -ENODE;
using "modal-axiom"[axiom_inst, unvarify G, THEN "→E", OF "oa-exist:1"] by blast
AOT_hence ‹∃y ♢([E!]y & ∀u (\A[O!]u → u ≠_E y))›
using "BF♢"[THEN "→E"] by blast
then AOT_obtain b where ‹♢([E!]b & ∀u (\A[O!]u → u ≠_E b))›
using "∃E"[rotated] by blast
AOT_hence ‹♢[E!]b› and 2: ‹♢∀u (\A[O!]u → u ≠_E b)›
using "KBasic2:3"[THEN "→E"] "&E" by blast+
AOT_hence ‹[λx ♢[E!]x]b›
by (auto intro!: "β←C"(1) "cqt:2")
moreover AOT_have ‹O! = [λx ♢[E!]x]›
by (rule "rule-id-df:1[zero]"[OF "oa:1"]) "cqt:2"
ultimately AOT_have b_ord: ‹O!b›
using "rule=E" id_sym by fast
AOT_hence ‹\AO!b›
by (meson "≡E"(1) "oa-facts:7")
moreover AOT_have 2: ‹∀u (\A[O!]u → u ≠_E b)›
using "modal-lemma"[unvarify G, unconstrain v, OF "oa-exist:1",
THEN "→E", OF b_ord, THEN "→E", OF 2].
ultimately AOT_have ‹b ≠_E b›
using "Ordinary.∀E"[OF 2, unconstrain α, THEN "→E",
OF b_ord, THEN "→E"] by blast
AOT_hence ‹¬(b =_E b)›
by (metis "≡E"(1) "thm-neg=E")
moreover AOT_have ‹b =_E b›
using "ord=Eequiv:1"[THEN "→E", OF b_ord].
ultimately AOT_show ‹p & ¬p› for p
by (metis "raa-cor:3")
qed

(*<*)
end
(*>*)

Messung
C	H	Z	G
88	97	100	95

¤ Dauer der Verarbeitung: 0.642 Sekunden (vorverarbeitet am 2026-11-04) ¤

Wurzel

Suchen

PVS Prover

Isabelle Prover

Cephes Mathematical Library

Vienna Development Method

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.