| Definitions | t  T, ES, Type,  , x:A  B(x), AbsInterface(A), sys-antecedent(es;Sys), fifo-antecedent(es;Sys;f), f(a), <a, b>, E,  b, P   Q, P  Q, x:A  B(x), P & Q, P Q,  A, input-forwarding{i:l}(es; Cmd; Sys; isupdate; In; f), chain-consistent(f;chain), {x:A| B(x)} , e c e', left + right, P  Q, e loc e' , if b then t else f fi , case b of inl(x) => s(x) | inr(y) => t(y), !Void(), False,  x:A. B(x), did-forward(es; Sys; f; e), Id, a < b, hd(l), L1  L2, adjacent(T;L;x;y), (x l), no_repeats(T;l), (e < e'), l1 l2, e  X, X(e), loc(e), is-query(In;isupdate;e), null(as), map(f;as), a:A fp B(a), Unit, strong-subtype(A;B), True, Top,  , A List , let x,y = A in B(x;y), t.1, ff, inr x , tt, inl x , f(x)?z, A c B, S T, as @ bs, rec-case(a) of [] => s | x::y => z.t(x;y;z),  x:A.B(x),  , Outcome, #$n, A B, ||as||,  , l[i], |g|, EqDecider(T), IdLnk, EOrderAxioms(E; pred?; info), EState(T), Knd,   x. t(x), x,y. t(x;y), kindcase(k; a.f(a); l,t.g(l;t) ), Msg(M),  , val-axiom(E;V;M;info;pred?;init;Trans;Choose;Send;val;time), e < e', r s, constant_function(f;A;B), locl(a), approx_sm(es; In; Out; Cmd; isupdate; Rsp; Delta; Q), abstract-chain-replication, loc(e), kind(e), SWellFounded(R(x;y)), pred!(e;e'), suptype(S; T), first(e), pred(e), cr-explanation{i:l}(es; Sys; f; e), updates(L), x.A(x), X(L), es-interface-history(es; X; e), filter(P;l), type List, s = t, E(X),  x:A. B(x), (e <loc e'), e(e1,e2].P(e), @e(x v), (last change to x before e), pred(e), lastchange(x;e), es-init(es;e), f**(e), sender(e), [], {i..j },  T, Dec(P), e<e'.P(e), ee'.P(e), e<e'. P(e), ee'.P(e), e[e1,e2).P(e), e[e1,e2).P(e), e[e1,e2].P(e), e[e1,e2].P(e), e(e1,e2].P(e), SqStable(P), a =!x:T. Q(x), InvFuns(A;B;f;g), Inj(A;B;f), IsEqFun(T;eq), Refl(T;x,y.E(x;y)), Sym(T;x,y.E(x;y)), Trans(T;x,y.E(x;y)), AntiSym(T;x,y.R(x;y)), Connex(T;x,y.R(x;y)), CoPrime(a,b), Ident(T;op;id), Assoc(T;op), Comm(T;op), Inverse(T;op;id;inv), BiLinear(T;pl;tm), IsBilinear(A;B;C;+a;+b;+c;f), IsAction(A;x;e;S;f), Dist1op2opLR(A;1op;2op), fun_thru_1op(A;B;opa;opb;f), FunThru2op(A;B;opa;opb;f), Cancel(T;S;op), monot(T;x,y.R(x;y);f), IsMonoid(T;op;id), IsGroup(T;op;id;inv), IsMonHom{M1,M2}(f), a b, IsIntegDom(r), IsPrimeIdeal(R;P), f g, es-prior-fixedpoints{i:l}(es; Sys; f; e), [car / cdr], last(L), y is f*(x), b | a, a ~ b, a b, a <p b, a < b, x f y, xL. P(x), (xL.P(x)), r < s, q-rel(r;x), l_disjoint(T;l1;l2), y=f*(x) via L, {T}, SQType(T), s ~ t, Atom$n, x <<= y, x << y, consistent-updates(es;In;Out;Cmd;isupdate;expl), x dom(f) |
| Lemmas | l all filter, es-interface-history wf, list-equal-set, chain-consistent-updates, member null, es-fix-sqequal, chain-order-le antisymmetry, chain-path-ordered, es-fix-equal, fun-connected-step-back, guard wf, Id sq, fun-connected-step, decidable equal es-E-interface, chain-path-query, decidable es-E-equal, member-es-fix-prior-fixedpoints, subtype rel self, l member set2, decidable wf, decidable assert, es-fix property, es-fix wf, strong-subtype-set3, strong-subtype wf, strong-subtype-self, es-fix wf2, member filter, l member subtype, sq stable from decidable, decidable es-causle, es-prior-fixedpoints-causle, es-le-causle, es-loc wf, es-causle-le, es-locl wf, es-le wf, approx sm wf, abstract-chain-replication wf, kind wf, loc wf, first wf, pred! wf, strongwellfounded wf, es-interface-vals wf, input-forwarding-invariant, updates of wf, cr-explanation wf, constant function wf, qle wf, cless wf, val-axiom wf, rationals wf, Msg wf, kindcase wf, Knd wf, EState wf, EOrderAxioms wf, Id wf, IdLnk wf, deq wf, event system wf, sys-antecedent wf, es-E-interface-subtype rel, es-interface-subtype rel, nat wf, length wf1, select wf, l member wf, es-causl wf, es-causle wf, null wf, null wf3, append wf, iseg wf, btrue wf, bfalse wf, not wf, is-query wf, map wf, es-E wf, es-is-interface wf, false wf, es-interface-val wf, es-interface-val wf2, top wf, es-interface wf, assert wf, es-E-interface wf, true wf, member wf, unit wf, bool wf, subtype rel wf |
Q:(({c:Cmd|