AOT_NaturalNumbers.thy

(*<*)
theory AOT_NaturalNumbers
  imports AOT_PossibleWorlds AOT_RestrictedVariables
  abbrevs one-to-one = \<open>\<^sub>1\<^sub>-\<^sub>1\<close>
      and onto = \<open>\<^sub>o\<^sub>n\<^sub>t\<^sub>o\<close>
begin
(*>*)

(* TODO: move to right place (274) *)
AOT_theorem "discern-obj:1": \<open>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]\<down>\<close>
proof(safe intro!: "kirchner-thm:1"[THEN "\<equiv>E"(2)] RN GEN "\<rightarrow>I")
  AOT_modally_strict {
    fix x y
    AOT_assume 0: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    AOT_hence 1: \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
      using "\<rightarrow>E" "ind-nec" by blast
    AOT_assume aux: \<open>\<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      moreover {
        AOT_assume Ox: \<open>O!x\<close>
        AOT_hence Oy: \<open>O!y\<close>
          using 0 "\<equiv>E"(1) "\<forall>E"(1) "oa-exist:1" by blast
        AOT_hence \<open>x = y\<close>
          using 1 Ox "identity:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
          using "con-dis-i-e:3:a" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by presburger
        AOT_hence \<open>\<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
          using aux "rule=E" by fast
      }
      moreover {
        AOT_assume 2: \<open>A!x\<close>
        AOT_have Ay: \<open>A!y\<close> using 0
          using "2" "cqt-basic:6.\<equiv>E(2).\<forall>E(1).\<forall>E(1)" "intro-elim:3:a" "oa-exist:2" by blast
        AOT_hence \<open>\<box>A!y\<close> by (metis "oa-facts:2" "vdash-properties:10")
        moreover AOT_have \<open>\<box>A!x\<close>
          using "2" "oa-facts:2.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" by auto
        ultimately AOT_have 3: \<open>\<box>(A!x & A!y & \<forall>F ([F]x \<equiv> [F]y) & \<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)))\<close>
          using "1" "KBasic:3.\<equiv>E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" aux by presburger
        AOT_have \<open>\<box>(A!x & A!y & \<forall>F ([F]x \<equiv> [F]y) & \<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))) \<rightarrow> \<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
        proof (rule RM; safe intro!: "\<rightarrow>I")
          AOT_modally_strict {
            AOT_assume A: \<open>A!x & A!y & \<forall>F ([F]x \<equiv> [F]y) & \<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
            AOT_show \<open>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
            proof(safe intro!: GEN "\<rightarrow>I")
              fix z
              AOT_assume z_not_y: \<open>z \<noteq> y\<close>
              AOT_show \<open>\<exists>F \<not>([F]z \<equiv> [F]y)\<close>
              proof(rule "raa-cor:1")
                AOT_assume \<open>\<not>\<exists>F \<not>([F]z \<equiv> [F]y)\<close>
                AOT_hence B: \<open>\<forall>F ([F]z \<equiv> [F]y)\<close>
                  by (metis "cqt-further:3" "intro-elim:3:b")
                AOT_have C: \<open>\<forall>F ([F]z \<equiv> [F]x)\<close>
                proof(rule GEN)
                  fix F
                  AOT_have \<open>[F]z \<equiv> [F]y\<close> using B[THEN "\<forall>E"(2)] by simp
                  also AOT_have \<open>\<dots> \<equiv> [F]x\<close> using A[THEN "&E"(1), THEN "&E"(2), THEN "\<forall>E"(2)]
                    by (metis "Commutativity of \<equiv>" "intro-elim:3:b")
                  finally AOT_show \<open>[F]z \<equiv> [F]x\<close>.
                qed
                AOT_have \<open>z = x\<close>
                proof(rule "raa-cor:1")
                  AOT_assume \<open>\<not>(z = x)\<close>
                  AOT_hence \<open>z \<noteq> x\<close> by (metis "=-infix" "\<equiv>\<^sub>d\<^sub>fI")
                  AOT_hence \<open>\<exists>F \<not>([F]z \<equiv> [F]x)\<close>
                    using A[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
                  then AOT_obtain F where \<open>\<not>([F]z \<equiv> [F]x)\<close> using "\<exists>E"[rotated] by blast
                  AOT_thus \<open>p & \<not>p\<close> for p using C[THEN "\<forall>E"(2)] by (metis "reductio-aa:1")
                qed
                AOT_hence \<open>x \<noteq> y\<close>
                  using z_not_y "rule=E" by fast
                AOT_hence \<open>y \<noteq> x\<close> by (metis "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "\<equiv>\<^sub>d\<^sub>fI" "reductio-aa:1" id_sym)
                AOT_hence \<open>\<exists>F \<not>([F]y \<equiv> [F]x)\<close>
                  using A[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" by blast
                then AOT_obtain F where \<open>\<not>([F]y \<equiv> [F]x)\<close>
                  using "\<exists>E"[rotated] by blast
                moreover {
                  AOT_have \<open>[F]x \<equiv> [F]y\<close> using A[THEN "&E"(1), THEN "&E"(2), THEN "\<forall>E"(2)] by blast
                  AOT_hence \<open>[F]y \<equiv> [F]x\<close> by (metis "intro-elim:3:f" "oth-class-taut:3:a")
                }
                ultimately AOT_show \<open>p & \<not>p\<close> for p by (metis "reductio-aa:1")
              qed
            qed
          }
        qed
        AOT_hence \<open>\<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
          using 3 "\<rightarrow>E" by blast
      }
      ultimately AOT_have \<open>\<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
        using "con-dis-i-e:4:a" "deduction-theorem" "oa-exist:3" by blast
  } note impl = this
  AOT_modally_strict {
    fix x y
    AOT_assume 0: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    AOT_hence 1: \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
      by (metis "cqt-basic:11" "intro-elim:3:b")
    AOT_show \<open>\<box>\<forall>z(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x)) \<equiv> \<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
      AOT_assume \<open>\<box>\<forall>z(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x))\<close>
      AOT_thus \<open>\<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close> using impl 0 by blast
    next
      AOT_assume \<open>\<box>\<forall>z(z \<noteq> y \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]y))\<close>
      AOT_thus \<open>\<box>\<forall>z(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x))\<close>  using impl 1 by blast
    qed
  }
qed

AOT_define Discernible :: \<open>\<Pi>\<close> (\<open>D!\<close>)
  "discern-obj:2": \<open>D! =\<^sub>d\<^sub>f [\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]\<close>


AOT_theorem "discern-obj:2[undef]": \<open>D! = [\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]\<close>
  using "rule-id-df:1[zero]"[OF "discern-obj:2", OF "discern-obj:1"].

AOT_theorem Discernible_den: \<open>D!\<down>\<close>
  using "discern-obj:2[undef]" "t=t-proper:1" "vdash-properties:10" by blast

AOT_theorem "discern-obj:3": \<open>D!x \<equiv> \<forall>z(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x))\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>D!x\<close>
  moreover AOT_have \<open>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]x \<equiv> \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    using "beta-C-meta"[THEN "\<rightarrow>E"] "discern-obj:1" by fast
  ultimately AOT_have \<open>\<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    using "discern-obj:2[undef].rule=E'" "intro-elim:3:a" by fastforce
  AOT_thus \<open>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    by (meson "B\<diamond>" "T\<diamond>" "vdash-properties:10")
next
  AOT_assume 0: \<open>\<forall>z(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x))\<close>
  AOT_modally_strict {
    fix z x
    AOT_have \<open>(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x)) \<equiv> (\<exists>F \<not>([F]z \<equiv> [F]x) \<or> z = x)\<close>
      by (smt (verit) "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "\<equiv>\<^sub>d\<^sub>fI" "con-dis-i-e:3:a" "con-dis-i-e:3:b" "con-dis-i-e:4:c" "deduction-theorem"
          "intro-elim:2" "reductio-aa:2" "vdash-properties:6")
    also AOT_have \<open>(\<exists>F \<not>([F]z \<equiv> [F]x) \<or> z = x) \<equiv> (\<not>\<forall>F ([F]z \<equiv> [F]x) \<or> z = x)\<close>
      by (metis (mono_tags, lifting) "con-dis-i-e:3:a" "con-dis-i-e:3:b" "con-dis-i-e:4:b" "cqt-further:2.\<rightarrow>E.\<exists>E'" "deduction-theorem"
          "existential:2[const_var]" "instantiation" "intro-elim:2" "raa-cor:1" "rule-ui:3")
    also AOT_have \<open>(\<not>\<forall>F ([F]z \<equiv> [F]x) \<or> z = x) \<equiv> (\<forall>F ([F]z \<equiv> [F]x) \<rightarrow> z = x)\<close>
      using "intro-elim:3:f" "oth-class-taut:1:c" "oth-class-taut:3:a" by blast
    finally AOT_have \<open>(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x)) \<equiv> (\<forall>F([F]z \<equiv> [F]x) \<rightarrow> z = x)\<close>.
  } note 1 = this
  {
    fix z
    AOT_have \<open>z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x)\<close>
      using 0 "rule-ui:3" by blast
    AOT_hence \<open>\<forall>F([F]z \<equiv> [F]x) \<rightarrow> z = x\<close>
      using 1
      by (metis (no_types, lifting) ext "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "deduction-theorem" "instantiation" "reductio-aa:1" "rule-ui:3"
          "vdash-properties:10")
    moreover AOT_have \<open>\<box>(\<forall>F([F]z \<equiv> [F]x) \<rightarrow> \<box>\<forall>F([F]z \<equiv> [F]x))\<close>
      by (simp add: "ind-nec" RN)
    moreover AOT_have \<open>\<box>(z = x \<rightarrow> \<box>z = x)\<close>
      by (simp add: "id-nec:1" RN)
    ultimately AOT_have \<open>\<box>(\<forall>F([F]z \<equiv> [F]x) \<rightarrow> z = x)\<close>
      using "Hypothetical Syllogism" "S5Basic:4.\<rightarrow>E" "T-S5-fund:1.\<rightarrow>E" "sc-eq-box-box:6.\<rightarrow>E.\<rightarrow>E" by blast
    AOT_hence \<open>\<box>(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x))\<close>
      by (AOT_subst \<open>z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x)\<close> \<open>\<forall>F([F]z \<equiv> [F]x) \<rightarrow> z = x\<close>)
         (auto simp add: "1")
  }
  AOT_hence \<open>\<forall>y\<box>(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    by (rule GEN)
  AOT_hence \<open>\<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    by (simp add: "BFs:1.\<rightarrow>E")
  AOT_hence \<open>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]x\<close>
    by (simp add: "beta-C-cor:2.\<rightarrow>E.\<forall>E(1).\<equiv>E(2)" "cqt:2"(1) "discern-obj:1")
  AOT_thus \<open>D!x\<close>
    using "rule=E" "discern-obj:2[undef]" id_sym by fast
qed

AOT_theorem "discern-obj:4": \<open>O!x \<rightarrow> D!x\<close>
proof(rule "\<rightarrow>I")
  AOT_assume Ox: \<open>O!x\<close>
  AOT_have \<open>\<forall>z(z \<noteq> x \<rightarrow> \<exists>F \<not>([F]z \<equiv> [F]x))\<close>
  proof(rule GEN; rule "contraposition:1[2]"; rule "\<rightarrow>I")
    fix z
    AOT_assume \<open>\<not>\<exists>F \<not>([F]z \<equiv> [F]x)\<close>
    AOT_hence indist: \<open>\<forall>F([F]z \<equiv> [F]x)\<close>
      using "cqt-further:3" "intro-elim:3:b" by blast
    AOT_hence \<open>O!z\<close>
      using "intro-elim:3:b" "oa-exist:1" "rule-ui:1" Ox by blast
    AOT_hence \<open>z = x\<close>
      using "ord=E:2"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
      by (simp add: "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" Ox indist)
    AOT_thus \<open>\<not>(z \<noteq> x)\<close>
      using "=-infix" "df-rules-formulas[3]" "useful-tautologies:6.\<rightarrow>E.\<rightarrow>E" by blast
  qed
  AOT_thus \<open>D!x\<close>
    using "cqt:2"(1) "discern-obj:3.unvarify_x.\<forall>E(1).\<equiv>E(2)" by blast
qed

AOT_theorem "discern-obj:5": \<open>\<exists>x D!x\<close>
  by (metis "S5Basic:4.\<rightarrow>E" "T-S5-fund:1.\<rightarrow>E" "discern-obj:4.unvarify_x.\<forall>E(1).\<rightarrow>E" "existential:2[const_var]" "instantiation"
      "o-objects-exist:1" "russell-axiom[exe,1].\<psi>_denotes_asm")

AOT_theorem "discern-obj:6": \<open>\<exists>x(A!x & \<not>D!x)\<close>
proof -
  AOT_obtain x y where xy: \<open>A!x & A!y & x \<noteq> y & \<forall>F ([F]x \<equiv> [F]y)\<close>
    using "aclassical2" "\<exists>E"[rotated] by blast
  moreover AOT_have \<open>\<not>D!y\<close>
  proof(rule "raa-cor:2")
    AOT_assume \<open>D!y\<close>
    AOT_hence \<open>x \<noteq> y \<rightarrow> \<exists>F \<not>([F]x \<equiv> [F]y)\<close>
      using "cqt:2"(1) "discern-obj:3" "intro-elim:3:a" "rule-ui:1" by blast
    AOT_hence \<open>\<exists>F \<not>([F]x \<equiv> [F]y)\<close>
      using "con-dis-i-e:2:a" "con-dis-i-e:2:b" "vdash-properties:10" xy by blast
    AOT_thus \<open>p & \<not>p\<close> for p
      using "con-dis-i-e:2:b" "cqt-further:3.\<equiv>E(1)" "raa-cor:4" xy by blast
  qed
  ultimately AOT_have \<open>A!y & \<not>D!y\<close>
    by (meson "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E")
  AOT_thus \<open>\<exists>x(A!x & \<not>D!x)\<close>
    using "\<exists>I" by fast
qed

AOT_theorem "discern-obj:7": \<open>(D!x \<or> D!y) \<rightarrow> (\<forall>F([F]x \<equiv> [F]y) \<rightarrow> x = y)\<close>
proof(safe intro!: "\<rightarrow>I"; rule "raa-cor:1")
  AOT_assume \<open>D!x \<or> D!y\<close>
  moreover AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
  ultimately AOT_have \<open>D!y\<close>
    using "con-dis-i-e:4:b" "intro-elim:3:a" "raa-cor:1" "rule-ui:1" Discernible_den by blast
  AOT_hence \<open>x \<noteq> y \<rightarrow> \<exists>F \<not>([F]x \<equiv> [F]y)\<close>
    by (meson "cqt:2"(1) "deduction-theorem" "discern-obj:3.unvarify_x.\<forall>E(1).\<equiv>E(1).\<forall>E(1).\<rightarrow>E.\<exists>E'" "existential:1")
  moreover AOT_assume \<open>\<not>(x = y)\<close>
  ultimately AOT_have \<open>\<exists>F \<not>([F]x \<equiv> [F]y)\<close>
    using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "vdash-properties:10" by blast
  AOT_thus \<open>p & \<not>p\<close> for p
    using "cqt-further:3.\<equiv>E(1)" "raa-cor:4" indist by blast
qed

(* Note: added to improve automation *)
AOT_theorem "discern-obj:7[1]": \<open>D!x \<rightarrow> (\<forall>F([F]x \<equiv> [F]y) \<rightarrow> x = y)\<close>
  using "Hypothetical Syllogism" "con-dis-taut:3" "discern-obj:7" by blast
AOT_theorem "discern-obj:7[2]": \<open>D!y \<rightarrow> (\<forall>F([F]x \<equiv> [F]y) \<rightarrow> x = y)\<close>
  using "Hypothetical Syllogism" "con-dis-taut:4" "discern-obj:7" by blast

AOT_theorem "discern-obj:8": \<open>D!x \<rightarrow> \<box>D!x\<close>
proof (rule "\<rightarrow>I")
    AOT_assume \<open>D!x\<close>
    AOT_hence \<open>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]x\<close>
      using "discern-obj:2[undef].rule=E'" by fastforce
    AOT_hence \<open>\<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      using "betaC:1:a" by auto
    AOT_hence \<open>\<box>\<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      by (simp add: "S5Basic:5.\<rightarrow>E")
    AOT_hence \<open>\<box>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]x\<close>
      apply (AOT_subst \<open>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]x\<close> \<open>\<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>)
       apply (metis (no_types, lifting) ext "betaC:1:a" "betaC:2:a" "cqt:2"(1) "deduction-theorem" "discern-obj:1" "intro-elim:2")
      by simp
    AOT_thus \<open>\<box>D!x\<close>
      apply (AOT_subst \<open>D!x\<close> \<open>[\<lambda>x \<box>\<forall>y(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))]x\<close>)
      using "discern-obj:2[undef].rule=E'" "oth-class-taut:3:a" by fast+
qed

AOT_theorem "discern-obj:9": \<open>D!x \<equiv> \<box>D!x\<close>
  by (simp add: "discern-obj:8" "intro-elim:2" "qml:2" "vdash-properties:1[2]")

AOT_theorem "discern-obj:10": \<open>\<diamond>D!x \<equiv> D!x\<close>
  by (meson "Commutativity of \<equiv>" "RE\<diamond>" "S5Basic:2" "discern-obj:9" "intro-elim:3:a" "intro-elim:3:e")

AOT_theorem "discern-obj:11": \<open>\<diamond>D!x \<equiv> \<box>D!x\<close>
  using "discern-obj:10" "discern-obj:9" "intro-elim:3:e" by blast

AOT_theorem "discern-obj:12": \<open>D!x \<equiv> \<^bold>\<A>D!x\<close>
  by (metis "Act-Sub:3" "cqt:2"(1) "deduction-theorem" "discern-obj:10.unvarify_x.\<forall>E(1).\<equiv>E(1)" "discern-obj:9" "intro-elim:2"
      "intro-elim:3:a" "nec-imp-act")

AOT_theorem "discern-obj:13": \<open>[\<lambda>x D!x & \<phi>{x}]\<down>\<close>
proof(safe intro!: "kirchner-thm:1"[THEN "\<equiv>E"(2)] RN GEN "\<rightarrow>I")
  AOT_modally_strict {
    fix x y
    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    AOT_show \<open>(D!x & \<phi>{x}) \<equiv> (D!y & \<phi>{y})\<close>
    proof(safe intro!: "\<rightarrow>I" "\<equiv>I")
      AOT_assume 0: \<open>D!x & \<phi>{x}\<close>
      moreover AOT_have \<open>x = y\<close>
        by (safe intro!: "discern-obj:7"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] 0[THEN "&E"(1)] "\<or>I"(1) indist)
      ultimately AOT_show \<open>D!y & \<phi>{y}\<close>
        using "rule=E" by fast
    next
      AOT_assume 0: \<open>D!y & \<phi>{y}\<close>
      moreover AOT_have \<open>x = y\<close>
        by (safe intro!: "discern-obj:7"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] 0[THEN "&E"(1)] "\<or>I"(2) indist)
      ultimately AOT_show \<open>D!x & \<phi>{x}\<close>
        using "rule=E" id_sym by fast
    qed
  }
qed

(* TODO: "discern-obj:14" "discern-obj:15" (general case) *)

AOT_theorem "discern-obj:15[2]": \<open>[\<lambda>xy D!x & D!y & \<phi>{x,y}]\<down>\<close>
proof(rule "safe-ext[2]"[axiom_inst, THEN "\<rightarrow>E"])
  AOT_have \<open>\<box>\<forall>x \<forall>y (D!x & D!y & \<exists>x' \<exists>y' (\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'}) \<equiv> D!x & D!y & \<phi>{x,y})\<close>
  proof(safe intro!: "\<equiv>I" RN GEN "\<rightarrow>I")
    AOT_modally_strict {
      fix x y
      AOT_assume 0: \<open>D!x & D!y & \<exists>x' \<exists>y' (\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'})\<close>
      then AOT_obtain x' where \<open>\<exists>y' (\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'})\<close>
        using "&E" "\<exists>E"[rotated] by blast
      then AOT_obtain y' where 2: \<open>\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'}\<close>
        using "\<exists>E"[rotated] by blast
      AOT_hence \<open>x = x'\<close>
        using "discern-obj:7"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "\<or>I"(1)]
        using "0" "con-dis-i-e:2:a" by blast
      AOT_hence \<open>\<phi>{x,y'}\<close>
        using 2[THEN "&E"(2)] "rule=E" "&E" 0
        by (metis id_sym)
      moreover AOT_have \<open>y = y'\<close>
        using 2
        using "discern-obj:7"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "\<or>I"(1)]
        using "0" "con-dis-i-e:2:a" "con-dis-i-e:2:b" by blast
      ultimately AOT_have \<open>\<phi>{x,y}\<close>
        using 2[THEN "&E"(2)] "rule=E" "&E" 0
        by (metis id_sym)
      AOT_thus \<open>D!x & D!y & \<phi>{x,y}\<close>
        using 0 "&E" "&I"
        by blast        
    }
  next
    AOT_modally_strict {
      fix x y
      AOT_assume 0: \<open>D!x & D!y & \<phi>{x,y}\<close>
      AOT_hence \<open>\<forall>F([F]x \<equiv> [F]x) & \<forall>F([F]y \<equiv> [F]y) & \<phi>{x,y}\<close>
        by (meson "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "oth-class-taut:3:a" "universal-cor")
      AOT_hence \<open>\<exists>x' \<exists>y' (\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'})\<close>
        using "\<exists>I" by meson
      AOT_thus \<open>D!x & D!y & \<exists>x' \<exists>y' (\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'})\<close>
        using "&I" "&E" 0 by blast
    }
  qed
  AOT_thus \<open>[\<lambda>xy D!x & D!y & \<exists>x'\<exists>y'(\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'})]\<down> & \<box>\<forall>x\<forall>y(D!x & D!y & \<exists>x'\<exists>y'(\<forall>F([F]x \<equiv> [F]x') & \<forall>F([F]y \<equiv> [F]y') & \<phi>{x',y'}) \<equiv> D!x & D!y & \<phi>{x,y})\<close>
    by(safe intro!: "&I" "cqt:2")
qed

AOT_theorem "discern-obj:16": \<open>[\<lambda>xy D!x & D!y & x = y]\<down>\<close>
  by (simp add: "discern-obj:15[2]")


AOT_define eq_D :: \<open>\<Pi>\<close> (\<open>'(=\<^sub>D')\<close>)
  "discern-obj:17": \<open>(=\<^sub>D) =\<^sub>d\<^sub>f [\<lambda>xy D!x & D!y & \<box>\<forall>F([F]x \<equiv> [F]y)]\<close>

syntax "_AOT_eq_D_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "=\<^sub>D" 50)
translations
  "_AOT_eq_D_infix \<kappa> \<kappa>'" == "CONST AOT_exe (CONST eq_D) (CONST Pair \<kappa> \<kappa>')"
print_translation\<open>
AOT_syntax_print_translations
[(\<^const_syntax>\<open>AOT_exe\<close>, fn ctxt => fn [
  Const ("\<^const>AOT_PLM.eq_D", _),
  Const (\<^const_syntax>\<open>Pair\<close>, _) $ lhs $ rhs
] => Const (\<^syntax_const>\<open>_AOT_eq_D_infix\<close>, dummyT) $ lhs $ rhs)]\<close>

AOT_theorem "=D[denotes]": \<open>[(=\<^sub>D)]\<down>\<close>
  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "discern-obj:17"]) "cqt:2"

(* Note: slight ordering mismatch to make things simpler on automation *)
AOT_theorem "discern-obj:20": \<open>x =\<^sub>D y \<equiv> (D!x & D!y & \<box>\<forall>F ([F]x \<equiv> [F]y))\<close>
proof -
  AOT_have 0: \<open>\<guillemotleft>(AOT_term_of_var x,AOT_term_of_var y)\<guillemotright>\<down>\<close>
    by (simp add: "&I" "cqt:2[const_var]"[axiom_inst] prod_denotesI)
  AOT_have 1: \<open>[\<lambda>xy D!x & D!y & \<box>\<forall>F ([F]x \<equiv> [F]y)]\<down>\<close> by "cqt:2"
  show ?thesis apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "discern-obj:17"]; "cqt:2[lambda]"?)
    using "beta-C-meta"[THEN "\<rightarrow>E", OF 1, unvarify \<nu>\<^sub>1\<nu>\<^sub>n, of "(_,_)", OF 0]
    by fast
qed

AOT_theorem "discern-obj:18": \<open>x =\<^sub>D y \<equiv> (D!x & D!y & x = y)\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>x =\<^sub>D y\<close>
  AOT_hence 0: \<open>D!x & D!y & \<box>\<forall>F([F]x \<equiv> [F]y)\<close>
    using "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(1)"
      "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(2)"
      "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2)" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm"
      "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by auto
  AOT_hence \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
    using "S5Basic:2.\<equiv>E(1)" "S5Basic:4.\<rightarrow>E" "con-dis-i-e:2:b" by blast
  AOT_thus \<open>D!x & D!y & x = y\<close>
    by (metis (no_types, lifting) "0" "con-dis-taut:2" "con-dis-taut:3" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:7" "intro-elim:3:b"
        "oth-class-taut:2:a" "vdash-properties:10")
next
  AOT_assume 0: \<open>D!x & D!y & x = y\<close>
  moreover AOT_have \<open>\<box>\<forall>F([F]x \<equiv> [F]x)\<close>
    by (simp add: "oth-class-taut:3:a" "universal-cor" RN)
  ultimately AOT_have \<open>\<box>\<forall>F([F]x \<equiv> [F]y)\<close>
    using "rule=E" "&E" id_sym by fast
  AOT_thus \<open>x =\<^sub>D y\<close>
    using "0" "con-dis-i-e:2:a" "df-simplify:1.\<equiv>E(2)" "discern-obj:20" by blast
qed

AOT_theorem "discern-obj:19": \<open>x =\<^sub>D y \<rightarrow> x = y\<close>
  by (metis "deduction-theorem" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "id-eq:1"
      "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")

thm "discern-obj:20"

AOT_theorem "discern-obj:21": \<open>x =\<^sub>D y \<equiv> \<box>(x =\<^sub>D y)\<close>
proof (rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume 0: \<open>x =\<^sub>D y\<close>
  AOT_hence 1: \<open>D!x & D!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(1)"
      "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(2)"
      "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2)" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm"
      "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by force
  AOT_hence \<open>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "&E" by blast
  AOT_hence \<open>\<box>\<box>\<forall>F ([F]x \<equiv> [F]y)\<close>
    using "S5Basic:5" "vdash-properties:6" by blast
  moreover AOT_have \<open>\<box>D!x & \<box>D!y\<close>
    by (meson "0" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(1)"
        "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(2)" "discern-obj:8.unvarify_x.\<forall>E(1).\<rightarrow>E")
  AOT_thus \<open>\<box>(x =\<^sub>D y)\<close>
    apply (AOT_subst \<open>x =\<^sub>D y\<close> \<open>D!x & D!y & \<box>\<forall>F ([F]x \<equiv> [F]y)\<close>)
    apply (simp add: "discern-obj:20")
    by (simp add: "KBasic:3.\<equiv>E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" calculation)
next
  AOT_assume \<open>\<box>(x =\<^sub>D y)\<close>
  AOT_thus \<open>x =\<^sub>D y\<close> using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
qed

AOT_theorem "discern-obj:22": \<open>\<diamond>(x =\<^sub>D y) \<equiv> (x =\<^sub>D y)\<close>
  by (meson "B\<diamond>" "RE\<diamond>" "T\<diamond>" "deduction-theorem" "discern-obj:21" "intro-elim:2" "intro-elim:3:e")

AOT_theorem "discern-obj:23": \<open>\<diamond>(x =\<^sub>D y) \<equiv> \<box>(x =\<^sub>D y)\<close>
  using "discern-obj:21" "discern-obj:22" "intro-elim:3:e" by blast

AOT_theorem "discern-obj:24": \<open>(x =\<^sub>D y) \<equiv> \<^bold>\<A>(x =\<^sub>D y)\<close>
  by (metis "Act-Sub:3" "deduction-theorem" "discern-obj:21" "discern-obj:22" "intro-elim:2" "intro-elim:3:f" "nec-imp-act")

syntax "_AOT_non_eq_D" :: \<open>\<Pi>\<close> ("'(\<noteq>\<^sub>D')")
translations
  (\<Pi>) "(\<noteq>\<^sub>D)" == (\<Pi>) "(=\<^sub>D)\<^sup>-"
syntax "_AOT_non_eq_D_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "\<noteq>\<^sub>D" 50)
translations
 "_AOT_non_eq_D_infix \<kappa> \<kappa>'" ==
 "CONST AOT_exe (CONST relation_negation (CONST eq_D)) (CONST Pair \<kappa> \<kappa>')"
print_translation\<open>
AOT_syntax_print_translations
[(\<^const_syntax>\<open>AOT_exe\<close>, fn ctxt => fn [
  Const (\<^const_syntax>\<open>relation_negation\<close>, _) $ Const ("\<^const>AOT_PLM.eq_D", _),
  Const (\<^const_syntax>\<open>Pair\<close>, _) $ lhs $ rhs
] => Const (\<^syntax_const>\<open>_AOT_non_eq_D_infix\<close>, dummyT) $ lhs $ rhs)]\<close>

AOT_theorem "discern-obj:25": \<open>x \<noteq>\<^sub>D y \<equiv> \<not>(x =\<^sub>D y)\<close>
proof -
  AOT_have \<theta>: \<open>[\<lambda>x\<^sub>1...x\<^sub>2 \<not>(=\<^sub>D)x\<^sub>1...x\<^sub>2]\<down>\<close> by "cqt:2"
  AOT_have \<open>x \<noteq>\<^sub>D y \<equiv> [\<lambda>x\<^sub>1...x\<^sub>2 \<not>(=\<^sub>D)x\<^sub>1...x\<^sub>2]xy\<close>
    by (rule "=\<^sub>d\<^sub>fI"(1)[OF "df-relation-negation", OF \<theta>])
       (meson "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> \<not>(=\<^sub>D)xy\<close>
    apply (rule "beta-C-meta"[THEN "\<rightarrow>E", unvarify \<nu>\<^sub>1\<nu>\<^sub>n])
     apply "cqt:2[lambda]"
    using "\<equiv>\<^sub>d\<^sub>fI" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) tuple_denotes by blast
  finally show ?thesis.
qed


AOT_theorem "discern-obj:26": \<open>x \<noteq>\<^sub>D y \<equiv> \<box>(x \<noteq>\<^sub>D y)\<close>
proof -
  AOT_have \<open>x \<noteq>\<^sub>D y \<equiv> \<not>(x =\<^sub>D y)\<close>
    using "discern-obj:25" by auto
  also AOT_have \<open>\<dots> \<equiv> \<not>\<diamond>(x =\<^sub>D y)\<close>
    by (simp add: "T\<diamond>" "contraposition:1[1]" "cqt:2"(1) "deduction-theorem" "discern-obj:22.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)"
        "intro-elim:2")
  also AOT_have \<open>\<dots> \<equiv> \<box>\<not>(x =\<^sub>D y)\<close>
    by (meson "KBasic2:1" "\<equiv>E"(2) "Commutativity of \<equiv>")
  also AOT_have \<open>\<dots> \<equiv> \<box>(x \<noteq>\<^sub>D y)\<close>
    using "RM:3" "discern-obj:25" "intro-elim:3:f" "oth-class-taut:3:a" by blast
  finally show ?thesis.
qed

AOT_theorem "discern-obj:27": \<open>\<diamond>(x \<noteq>\<^sub>D y) \<equiv> (x \<noteq>\<^sub>D y)\<close>
  by (meson "RE\<diamond>" "S5Basic:2" "discern-obj:26" "\<equiv>E"(2,5) "Commutativity of \<equiv>")

AOT_theorem "discern-obj:28": \<open>\<diamond>(x \<noteq>\<^sub>D y) \<equiv> \<box>(x \<noteq>\<^sub>D y)\<close>
  by (meson "discern-obj:27" "discern-obj:26" "\<equiv>E"(5))

AOT_theorem "discern-obj:29": \<open>x =\<^sub>D y \<equiv> \<^bold>\<A>x =\<^sub>D y\<close>
  by (meson "Act-Basic:5" "Act-Sub:2" "RA[2]" "discern-obj:24" "\<equiv>E"(1,6))

AOT_theorem "discern-obj:30": \<open>D!x \<rightarrow> x =\<^sub>D x\<close>
  by (simp add: "con-dis-i-e:1" "deduction-theorem" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "rule=I:1"
      "russell-axiom[exe,1].\<psi>_denotes_asm")

AOT_theorem "discern-obj:31": \<open>x =\<^sub>D y \<rightarrow> y =\<^sub>D x\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 0: \<open>x =\<^sub>D y\<close>
  AOT_hence \<open>D!x & D!y & \<box>\<forall>F([F]x \<equiv> [F]y)\<close>
    using "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(1)"
      "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(2)"
      "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2)" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm"
      "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by force
  AOT_hence \<open>D!y & D!x & \<box>\<forall>F([F]y \<equiv> [F]x)\<close>
    by (metis (no_types, lifting) ext "0" "Commutativity of \<equiv>" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E"
        "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(1)"
        "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(2)"
        "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2)" "rule-sub-lem:1:d" "rule-sub-lem:1:g.\<equiv>E(2)"
        "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" RN)
  AOT_thus \<open>y =\<^sub>D x\<close>
    by (simp add: "cqt:2"(1) "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)")
qed

AOT_theorem "discern-obj:32": \<open>x =\<^sub>D y & y =\<^sub>D z \<rightarrow> x =\<^sub>D z\<close>
proof(rule "\<rightarrow>I")
  AOT_assume A: \<open>x =\<^sub>D y & y =\<^sub>D z\<close>
  AOT_hence 0: \<open>D!x\<close> and 1: \<open>D!y\<close> and 2: \<open>D!z\<close> and \<open>\<box>\<forall>F([F]x \<equiv> [F]y)\<close> and \<open>\<box>\<forall>F([F]y \<equiv> [F]z)\<close>
    using "discern-obj:20" "intro-elim:3:a" "&E"
    by meson+
  AOT_hence \<open>\<box>(\<forall>F([F]x \<equiv> [F]y) & \<forall>F([F]y \<equiv> [F]z))\<close>
    by (smt (verit) "KBasic:3" "df-simplify:1" "intro-elim:3:b")
  moreover AOT_have \<open>\<box>(\<forall>F([F]x \<equiv> [F]y) & \<forall>F([F]y \<equiv> [F]z)) \<rightarrow> \<box>\<forall>F([F]x \<equiv> [F]z)\<close>
    apply (rule RM)
    by (simp add: "cqt-basic:10")
  ultimately AOT_have \<open>\<box>\<forall>F([F]x \<equiv> [F]z)\<close>
    using "vdash-properties:6" by blast
  AOT_thus \<open>x =\<^sub>D z\<close>
    by (simp add: "0" "2" "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "con-dis-i-e:1" "cqt:2"(1))
qed

AOT_theorem "discern-obj:33": \<open>D!x \<or> D!y \<rightarrow> \<box>(x = y \<equiv> x =\<^sub>D y)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 0: \<open>D!x \<or> D!y\<close>
  {
    fix x y
    AOT_assume Dx: \<open>D!x\<close>
    AOT_have \<open>(x = y \<equiv> x =\<^sub>D y)\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
      AOT_assume \<open>x = y\<close>
      moreover AOT_hence \<open>D!y\<close>
        using "rule=E'" Dx by blast
      ultimately AOT_show \<open>x =\<^sub>D y\<close>
        by (metis (mono_tags, lifting) "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "\<equiv>I" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "ind-nec.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E" "rule=E'" CP GEN id_sym)
    next
      AOT_assume \<open>x =\<^sub>D y\<close>
      AOT_thus \<open>x = y\<close>
        using "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "id-eq:1" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm"
          "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by blast
    qed
  } note 1 = this
  {
    AOT_assume \<open>D!x\<close>
    AOT_hence \<open>(x = y \<equiv> x =\<^sub>D y)\<close>
      using 1 by blast
    moreover AOT_have \<open>(x = y) \<equiv> \<box>(x = y)\<close>
      by (simp add: "id-nec:2" "intro-elim:2" "qml:2" "vdash-properties:1[2]")
    moreover AOT_have \<open>(x =\<^sub>D y) \<equiv> \<box>(x =\<^sub>D y)\<close>
      using "discern-obj:21" by auto
    ultimately AOT_have \<open>\<box>(x = y \<equiv> x =\<^sub>D y)\<close>
    proof (safe intro!: "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&I")
      AOT_show \<open>\<box>(x = y \<rightarrow> \<box>x = y)\<close>
        by (simp add: "id-nec:1" RN)
    next
      AOT_show \<open>\<box>(x =\<^sub>D y \<rightarrow> \<box>x =\<^sub>D y)\<close>
        using "discern-obj:21"
        by (meson "if-p-then-p" "rule-sub-remark:6[1]" RN)
    next
      AOT_assume \<open>x = y \<equiv> x =\<^sub>D y\<close>
      moreover AOT_assume \<open>x = y \<equiv> \<box>x = y\<close>
      moreover AOT_assume \<open>x =\<^sub>D y \<equiv> \<box>x =\<^sub>D y\<close>
      ultimately AOT_show \<open>\<box>x = y \<equiv> \<box>x =\<^sub>D y\<close>
        using "intro-elim:3:f" by blast
    qed
  }
  moreover {
    AOT_assume Dy: \<open>D!y\<close>
    AOT_hence 0: \<open>y = x \<equiv> y =\<^sub>D x\<close>
      using 1 by blast
    AOT_hence \<open>x = y \<equiv> x =\<^sub>D y\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
      AOT_assume 2: \<open>x = y\<close>
      AOT_hence 3: \<open>y = x\<close> using id_sym by blast
      AOT_hence \<open>y =\<^sub>D x\<close> using 0[THEN "\<equiv>E"(1)] by blast
      AOT_thus \<open>x =\<^sub>D y\<close>
        using "1" "2" "3" "intro-elim:3:a" "rule=E" Dy by blast
    next
      AOT_assume \<open>x =\<^sub>D y\<close>
      AOT_thus \<open>x = y\<close>
        using "cqt:2"(1) "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "rule=I:1" by blast
    qed
    moreover AOT_have \<open>(x = y) \<equiv> \<box>(x = y)\<close>
      by (simp add: "id-nec:2" "intro-elim:2" "qml:2" "vdash-properties:1[2]")
    moreover AOT_have \<open>(x =\<^sub>D y) \<equiv> \<box>(x =\<^sub>D y)\<close>
      using "discern-obj:21" by auto
    ultimately AOT_have \<open>\<box>(x = y \<equiv> x =\<^sub>D y)\<close>
    proof (safe intro!: "sc-eq-box-box:4"[THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&I")
      AOT_show \<open>\<box>(x = y \<rightarrow> \<box>x = y)\<close>
        by (simp add: "id-nec:1" RN)
    next
      AOT_show \<open>\<box>(x =\<^sub>D y \<rightarrow> \<box>x =\<^sub>D y)\<close>
        using "discern-obj:21"
        by (meson "if-p-then-p" "rule-sub-remark:6[1]" RN)
    next
      AOT_assume \<open>x = y \<equiv> x =\<^sub>D y\<close>
      moreover AOT_assume \<open>x = y \<equiv> \<box>x = y\<close>
      moreover AOT_assume \<open>x =\<^sub>D y \<equiv> \<box>x =\<^sub>D y\<close>
      ultimately AOT_show \<open>\<box>x = y \<equiv> \<box>x =\<^sub>D y\<close>
        using "intro-elim:3:f" by blast
    qed
  }
  ultimately AOT_show \<open>\<box>(x = y \<equiv> x =\<^sub>D y)\<close>
    using 0 by (metis "con-dis-i-e:4:b" "raa-cor:1")
qed

AOT_theorem "discern-obj:34": \<open>D!y \<rightarrow> [\<lambda>x x = y]\<down>\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume Dy: \<open>D!y\<close>
  AOT_show \<open>[\<lambda>x x = y]\<down>\<close>
  proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; rule "&I")
    AOT_show \<open>[\<lambda>x D!x & x = y]\<down>\<close>
      by (simp add: "discern-obj:13")
  next
    AOT_have \<open>\<box>(D!y \<rightarrow> \<forall>x (D!x & x = y \<equiv> x = y))\<close>
      by (smt (verit, del_insts) "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" "intro-elim:2" "rule=E" "universal-cor" RN
          id_sym)
    AOT_thus\<open>\<box>\<forall>x (D!x & x = y \<equiv> x = y)\<close>
      by (meson "KBasic:1.\<rightarrow>E" "KBasic:5.\<rightarrow>E.\<equiv>E(2)" "con-dis-i-e:1" "discern-obj:8.unvarify_x.\<forall>E(1).\<rightarrow>E"
          "russell-axiom[exe,1].\<psi>_denotes_asm" Dy)
  qed
qed

AOT_theorem "discern-obj:35": \<open>(D!x & D!y) \<rightarrow> (x \<noteq> y \<equiv> [\<lambda>z z = x] \<noteq> [\<lambda>z z = y])\<close>
proof(safe intro!: "\<rightarrow>I" "\<equiv>I")
  AOT_assume 0: \<open>D!x & D!y\<close>
  AOT_assume 1: \<open>x \<noteq> y\<close>
  AOT_show \<open>[\<lambda>z z = x] \<noteq> [\<lambda>z z = y]\<close>
  proof(rule "raa-cor:1")
    AOT_assume \<open>\<not>[\<lambda>z z = x] \<noteq> [\<lambda>z z = y]\<close>
    AOT_hence \<open>[\<lambda>z z = x] = [\<lambda>z z = y]\<close>
      using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "reductio-aa:1" by blast
    moreover AOT_have \<open>[\<lambda>z z = x]x\<close>
      using "0" "betaC:2:a" "con-dis-i-e:2:a" "cqt:2"(1) "discern-obj:34" "id-eq:1" "vdash-properties:10" by blast
    ultimately AOT_have \<open>[\<lambda>z z = y]x\<close>
      using "rule=E" by fast
    AOT_hence \<open>x = y\<close>
      using "betaC:1:a" by blast
    AOT_thus \<open>x = y & \<not>x = y\<close>
      using "1" "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by blast
  qed
next
  AOT_assume 0: \<open>D!x & D!y\<close>
  AOT_assume 1: \<open>[\<lambda>z z = x] \<noteq> [\<lambda>z z = y]\<close>
  AOT_show \<open>x \<noteq> y\<close>
  proof(rule "raa-cor:1")
    AOT_assume \<open>\<not>x \<noteq> y\<close>
    AOT_hence \<open>x = y\<close>
      using "=-infix" "df-rules-formulas[4]" "useful-tautologies:7.\<rightarrow>E.\<rightarrow>E" by blast
    moreover AOT_have \<open>[\<lambda>z z = x] = [\<lambda>z z = x]\<close>
      using "0" "con-dis-i-e:2:a" "discern-obj:34.unvarify_y.\<forall>E(1).\<rightarrow>E" "rule=I:1" "russell-axiom[exe,1].\<psi>_denotes_asm" by blast
    ultimately AOT_have \<open>[\<lambda>z z = x] = [\<lambda>z z = y]\<close>
      using "rule=E" by fast
    AOT_thus \<open>[\<lambda>z z = x] = [\<lambda>z z = y] & \<not>[\<lambda>z z = x] = [\<lambda>z z = y]\<close>
      using 1 "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by blast
  qed
qed


AOT_register_rigid_restricted_type
  Discernible: \<open>D!\<kappa>\<close>
proof
  AOT_modally_strict {
    AOT_show \<open>\<exists>x D!x\<close>
      using "discern-obj:5" by blast
  }
next
  AOT_modally_strict {
    AOT_show \<open>D!\<kappa> \<rightarrow> \<kappa>\<down>\<close> for \<kappa>
      by (simp add: "deduction-theorem" "russell-axiom[exe,1].\<psi>_denotes_asm")
  }
next
  AOT_modally_strict {
    AOT_have \<open>D!x \<rightarrow> \<box>D!x\<close> for x
      using "discern-obj:8" by auto
    AOT_thus \<open>\<forall>x (D!x \<rightarrow> \<box>D!x)\<close>
      by (rule GEN)
  }
qed

text\<open>We have already introduced the restricted type of Ordinary objects in the
     Extended Relation Comprehension theory. However, make sure all variable names
     are defined as expected (avoiding conflicts with situations
     of possible world theory).\<close>
AOT_register_variable_names
  Discernible: u v r t s


section\<open>Natural Numbers\<close>
 
AOT_define CorrelatesOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> _\<close>)
  "1-1-cor": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> &
                                   \<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy)) &
                                   \<forall>y ([G]y \<rightarrow> \<exists>!x([F]x & [R]xy))\<close>

AOT_define MapsTo :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<longrightarrow> _\<close>)
  "fFG:1": \<open>R |: F \<longrightarrow> G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> & \<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy))\<close>

AOT_define MapsToOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> _\<close>)
  "fFG:2": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G \<equiv>\<^sub>d\<^sub>f
      R |: F \<longrightarrow> G & \<forall>x\<forall>y\<forall>z (([F]x & [F]y & [G]z) \<rightarrow> ([R]xz & [R]yz \<rightarrow> x = y))\<close>

AOT_define MapsOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o _\<close>)
  "fFG:3": \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G \<equiv>\<^sub>d\<^sub>f R |: F \<longrightarrow> G & \<forall>y ([G]y \<rightarrow> \<exists>x([F]x & [R]xy))\<close>

AOT_define MapsOneToOneOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o _\<close>)
  "fFG:4": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G \<equiv>\<^sub>d\<^sub>f R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>

AOT_theorem "eq-1-1": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G \<equiv> R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G\<close>
  AOT_hence A: \<open>\<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy))\<close>
        and B: \<open>\<forall>y ([G]y \<rightarrow> \<exists>!x([F]x & [R]xy))\<close>
    using "\<equiv>\<^sub>d\<^sub>fE"[OF "1-1-cor"] "&E" by blast+
  AOT_have C: \<open>R |: F \<longrightarrow> G\<close>
  proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:1"]; rule "&I")
    AOT_show \<open>R\<down> & F\<down> & G\<down>\<close>
      using "cqt:2[const_var]"[axiom_inst] "&I" by metis
  next
    AOT_show \<open>\<forall>x ([F]x \<rightarrow> \<exists>!y([G]y & [R]xy))\<close> by (rule A)
  qed
  AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
  proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:4"]; rule "&I")
    AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G\<close>
    proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:2"]; rule "&I")
      AOT_show \<open>R |: F \<longrightarrow> G\<close> using C.
    next
      AOT_show \<open>\<forall>x\<forall>y\<forall>z ([F]x & [F]y & [G]z \<rightarrow> ([R]xz & [R]yz \<rightarrow> x = y))\<close>
      proof(rule GEN; rule GEN; rule GEN; rule "\<rightarrow>I"; rule "\<rightarrow>I")
        fix x y z
        AOT_assume 1: \<open>[F]x & [F]y & [G]z\<close>
        moreover AOT_assume 2: \<open>[R]xz & [R]yz\<close>
        ultimately AOT_have 3: \<open>\<exists>!x ([F]x & [R]xz)\<close>
          using B "&E" "\<forall>E" "\<rightarrow>E" by fast
        AOT_show \<open>x = y\<close>
          by (rule "uni-most"[THEN "\<rightarrow>E", OF 3, THEN "\<forall>E"(2)[where \<beta>=x],
                              THEN "\<forall>E"(2)[where \<beta>=y], THEN "\<rightarrow>E"])
             (metis "&I" "&E" 1 2)
      qed
    qed
  next
    AOT_show \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
    proof (rule "\<equiv>\<^sub>d\<^sub>fI"[OF "fFG:3"]; rule "&I")
      AOT_show \<open>R |: F \<longrightarrow> G\<close> using C.
    next
      AOT_show \<open>\<forall>y ([G]y \<rightarrow> \<exists>x ([F]x & [R]xy))\<close>
      proof(rule GEN; rule "\<rightarrow>I")
        fix y
        AOT_assume \<open>[G]y\<close>
        AOT_hence \<open>\<exists>!x ([F]x & [R]xy)\<close>
          using B[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
        AOT_hence \<open>\<exists>x ([F]x & [R]xy & \<forall>\<beta> (([F]\<beta> & [R]\<beta>y) \<rightarrow> \<beta> = x))\<close>
          using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
        then AOT_obtain x where \<open>[F]x & [R]xy\<close>
          using "\<exists>E"[rotated] "&E" by blast
        AOT_thus \<open>\<exists>x ([F]x & [R]xy)\<close> by (rule "\<exists>I")
      qed
    qed
  qed
next
  AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
  AOT_hence \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow> G\<close> and \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>o G\<close>
    using "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:4"] "&E" by blast+
  AOT_hence C: \<open>R |: F \<longrightarrow> G\<close>
    and D: \<open>\<forall>x\<forall>y\<forall>z ([F]x & [F]y & [G]z \<rightarrow> ([R]xz & [R]yz \<rightarrow> x = y))\<close>
    and E: \<open>\<forall>y ([G]y \<rightarrow> \<exists>x ([F]x & [R]xy))\<close>
    using "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:2"] "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:3"] "&E" by blast+
  AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> G\<close>
  proof(rule "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fI"]; safe intro!: "&I" "cqt:2[const_var]"[axiom_inst])
    AOT_show \<open>\<forall>x ([F]x \<rightarrow> \<exists>!y ([G]y & [R]xy))\<close>
      using "\<equiv>\<^sub>d\<^sub>fE"[OF "fFG:1", OF C] "&E" by blast
  next
    AOT_show \<open>\<forall>y ([G]y \<rightarrow> \<exists>!x ([F]x & [R]xy))\<close>
    proof (rule "GEN"; rule "\<rightarrow>I")
      fix y
      AOT_assume 0: \<open>[G]y\<close>
      AOT_hence \<open>\<exists>x ([F]x & [R]xy)\<close>
        using E "\<forall>E" "\<rightarrow>E" by fast
      then AOT_obtain a where a_prop: \<open>[F]a & [R]ay\<close>
        using "\<exists>E"[rotated] by blast
      moreover AOT_have \<open>\<forall>z ([F]z & [R]zy \<rightarrow> z = a)\<close>
      proof (rule GEN; rule "\<rightarrow>I")
        fix z
        AOT_assume \<open>[F]z & [R]zy\<close>
        AOT_thus \<open>z = a\<close>
          using D[THEN "\<forall>E"(2)[where \<beta>=z], THEN "\<forall>E"(2)[where \<beta>=a],
                  THEN "\<forall>E"(2)[where \<beta>=y], THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
                a_prop 0 "&E" "&I" by metis
      qed
      ultimately AOT_have \<open>\<exists>x ([F]x & [R]xy & \<forall>z ([F]z & [R]zy \<rightarrow> z = x))\<close>
        using "&I" "\<exists>I"(2) by fast
      AOT_thus \<open>\<exists>!x ([F]x & [R]xy)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by fast
    qed
  qed
qed

AOT_theorem "equi:1": \<open>\<exists>!u \<phi>{u} \<equiv> \<exists>u (\<phi>{u} & \<forall>v (\<phi>{v} \<rightarrow> v =\<^sub>D u))\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume \<open>\<exists>!u \<phi>{u}\<close>
  AOT_hence \<open>\<exists>!x (D!x & \<phi>{x})\<close>.
  AOT_hence \<open>\<exists>x (D!x & \<phi>{x} & \<forall>\<beta> (D!\<beta> & \<phi>{\<beta>} \<rightarrow> \<beta> = x))\<close>
    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  then AOT_obtain x where x_prop: \<open>D!x & \<phi>{x} & \<forall>\<beta> (D!\<beta> & \<phi>{\<beta>} \<rightarrow> \<beta> = x)\<close>
    using "\<exists>E"[rotated] by blast
  {
    fix \<beta>
    AOT_assume beta_ord: \<open>D!\<beta>\<close>
    moreover AOT_assume \<open>\<phi>{\<beta>}\<close>
    ultimately AOT_have \<open>\<beta> = x\<close>
      using x_prop[THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=\<beta>]] "&I" "\<rightarrow>E" by blast
    AOT_hence \<open>\<beta> =\<^sub>D x\<close>
      by (metis "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "rule=E'"
          "russell-axiom[exe,1].\<psi>_denotes_asm" beta_ord)
  }
  AOT_hence \<open>(D!\<beta> \<rightarrow> (\<phi>{\<beta>} \<rightarrow> \<beta> =\<^sub>D x))\<close> for \<beta>
    using "\<rightarrow>I" by blast
  AOT_hence \<open>\<forall>\<beta>(D!\<beta> \<rightarrow> (\<phi>{\<beta>} \<rightarrow> \<beta> =\<^sub>D x))\<close>
    by (rule GEN)
  AOT_hence \<open>D!x & \<phi>{x} & \<forall>y (D!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>D x))\<close>
    using x_prop[THEN "&E"(1)] "&I" by blast
  AOT_hence \<open>D!x & (\<phi>{x} & \<forall>y (D!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>D x)))\<close>
    using "&E" "&I" by meson
  AOT_thus \<open>\<exists>u (\<phi>{u} & \<forall>v (\<phi>{v} \<rightarrow> v =\<^sub>D u))\<close>
    using "\<exists>I" by fast
next
  AOT_assume \<open>\<exists>u (\<phi>{u} & \<forall>v (\<phi>{v} \<rightarrow> v =\<^sub>D u))\<close>
  AOT_hence \<open>\<exists>x (D!x & (\<phi>{x} & \<forall>y (D!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>D x))))\<close>
    by blast
  then AOT_obtain x where x_prop: \<open>D!x & (\<phi>{x} & \<forall>y (D!y \<rightarrow> (\<phi>{y} \<rightarrow> y =\<^sub>D x)))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<open>\<forall>y (D!y & \<phi>{y} \<rightarrow> y = x)\<close>
  proof(rule GEN; rule "\<rightarrow>I")
    fix y
    AOT_assume \<open>D!y & \<phi>{y}\<close>
    AOT_hence \<open>y =\<^sub>D x\<close>
      using x_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=y]]
            "\<rightarrow>E" "&E" by blast
    AOT_thus \<open>y = x\<close>
      using "discern-obj:19" "vdash-properties:10" by blast
  qed
  AOT_hence \<open>D!x & \<phi>{x} & \<forall>y (D!y & \<phi>{y} \<rightarrow> y = x)\<close>
    using x_prop "&E" "&I" by meson
  AOT_hence \<open>\<exists>x (D!x & \<phi>{x} & \<forall>y (D!y & \<phi>{y} \<rightarrow> y = x))\<close>
    by (rule "\<exists>I")
  AOT_hence \<open>\<exists>!x (D!x & \<phi>{x})\<close>
    by (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  AOT_thus \<open>\<exists>!u \<phi>{u}\<close>.
qed

AOT_define CorrelatesDOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D _\<close>)
  "equi:2": \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> &
                               \<forall>u ([F]u \<rightarrow> \<exists>!v([G]v & [R]uv)) &
                               \<forall>v ([G]v \<rightarrow> \<exists>!u([F]u & [R]uv))\<close>

AOT_define EquinumerousE :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl "\<approx>\<^sub>D" 50)
  "equi:3": \<open>F \<approx>\<^sub>D G \<equiv>\<^sub>d\<^sub>f \<exists>R (R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G)\<close>

text\<open>Note: not explicitly in PLM.\<close>
AOT_theorem eq_den_1: \<open>\<Pi>\<down>\<close> if \<open>\<Pi> \<approx>\<^sub>D \<Pi>'\<close>
proof -
  AOT_have \<open>\<exists>R (R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>')\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] that by blast
  then AOT_obtain R where \<open>R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>'\<close>
    using "\<exists>E"[rotated] by blast
  AOT_thus \<open>\<Pi>\<down>\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
qed

text\<open>Note: not explicitly in PLM.\<close>
AOT_theorem eq_den_2: \<open>\<Pi>'\<down>\<close> if \<open>\<Pi> \<approx>\<^sub>D \<Pi>'\<close>
proof -
  AOT_have \<open>\<exists>R (R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>')\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] that by blast
  then AOT_obtain R where \<open>R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>'\<close>
    using "\<exists>E"[rotated] by blast
  AOT_thus \<open>\<Pi>'\<down>\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
qed

AOT_theorem "eq-part:1": \<open>F \<approx>\<^sub>D F\<close>
proof (safe intro!: "&I" GEN "\<rightarrow>I" "cqt:2[const_var]"[axiom_inst]
                    "\<equiv>\<^sub>d\<^sub>fI"[OF "equi:3"] "\<equiv>\<^sub>d\<^sub>fI"[OF "equi:2"] "\<exists>I"(1))
  fix x
  AOT_assume 1: \<open>D!x\<close>
  AOT_assume 2: \<open>[F]x\<close>
  AOT_show \<open>\<exists>!v ([F]v & x =\<^sub>D v)\<close>
  proof(rule "equi:1"[THEN "\<equiv>E"(2)];
        rule "\<exists>I"(2)[where \<beta>=x];
        safe dest!: "&E"(2)
             intro!:  "&I" "\<rightarrow>I" 1 2 Discernible.GEN)
    AOT_show \<open>x =\<^sub>D x\<close>
      using "1" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" by force
    AOT_show \<open>v =\<^sub>D x\<close> if \<open>x =\<^sub>D v\<close> for v
      by (simp add: "cqt:2"(1) "discern-obj:31.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E" that)
  qed
next
  fix y
  AOT_assume 1: \<open>D!y\<close>
  AOT_assume 2: \<open>[F]y\<close>
  AOT_show \<open>\<exists>!u ([F]u & u =\<^sub>D y)\<close>
    by(safe dest!: "&E"(2)
            intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=y]
                    "&I" "\<rightarrow>I" 1 2 GEN "discern-obj:30"[THEN "\<rightarrow>E"])
qed(auto simp: "=D[denotes]")


AOT_theorem "eq-part:2": \<open>F \<approx>\<^sub>D G \<rightarrow> G \<approx>\<^sub>D F\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>F \<approx>\<^sub>D G\<close>
  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  then AOT_obtain R where \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence 0: \<open>R\<down> & F\<down> & G\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v([G]v & [R]uv)) &
                            \<forall>v ([G]v \<rightarrow> \<exists>!u([F]u & [R]uv))\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast

  AOT_have \<open>[\<lambda>xy [R]yx]\<down> & G\<down> & F\<down> & \<forall>u ([G]u \<rightarrow> \<exists>!v([F]v & [\<lambda>xy [R]yx]uv)) &
                            \<forall>v ([F]v \<rightarrow> \<exists>!u([G]u & [\<lambda>xy [R]yx]uv))\<close>
  proof (AOT_subst \<open>[\<lambda>xy [R]yx]yx\<close> \<open>[R]xy\<close> for: x y;
        (safe intro!: "&I" "cqt:2[const_var]"[axiom_inst] 0[THEN "&E"(2)]
                      0[THEN "&E"(1), THEN "&E"(2)]; "cqt:2[lambda]")?)
    AOT_modally_strict {
      AOT_have \<open>[\<lambda>xy [R]yx]xy\<close> if \<open>[R]yx\<close> for y x
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" that)
      moreover AOT_have \<open>[R]yx\<close> if \<open>[\<lambda>xy [R]yx]xy\<close> for y x
        using "\<beta>\<rightarrow>C"(1)[where \<phi>="\<lambda>(x,y). _ (x,y)" and \<kappa>\<^sub>1\<kappa>\<^sub>n="(_,_)",
                        simplified, OF that, simplified].
      ultimately AOT_show \<open>[\<lambda>xy [R]yx]\<alpha>\<beta> \<equiv> [R]\<beta>\<alpha>\<close> for \<alpha> \<beta>
        by (metis "deduction-theorem" "\<equiv>I")
    }
  qed
  AOT_hence \<open>[\<lambda>xy [R]yx] |: G \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D F\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
  AOT_hence \<open>\<exists>R R |: G \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D F\<close>
    by (rule "\<exists>I"(1)) "cqt:2[lambda]"
  AOT_thus \<open>G \<approx>\<^sub>D F\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed

text\<open>Note: not explicitly in PLM.\<close>
AOT_theorem "eq-part:2[terms]": \<open>\<Pi> \<approx>\<^sub>D \<Pi>' \<rightarrow> \<Pi>' \<approx>\<^sub>D \<Pi>\<close>
  using "eq-part:2"[unvarify F G] eq_den_1 eq_den_2 "\<rightarrow>I" by meson
declare "eq-part:2[terms]"[THEN "\<rightarrow>E", sym]

AOT_theorem "eq-part:3": \<open>(F \<approx>\<^sub>D G & G \<approx>\<^sub>D H) \<rightarrow> F \<approx>\<^sub>D H\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>F \<approx>\<^sub>D G & G \<approx>\<^sub>D H\<close>
  then AOT_obtain R\<^sub>1 and R\<^sub>2 where
       \<open>R\<^sub>1 |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
   and \<open>R\<^sub>2 |: G \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D H\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<exists>E"[rotated] by metis
  AOT_hence \<theta>: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v([G]v & [R\<^sub>1]uv)) & \<forall>v ([G]v \<rightarrow> \<exists>!u([F]u & [R\<^sub>1]uv))\<close>
        and \<xi>: \<open>\<forall>u ([G]u \<rightarrow> \<exists>!v([H]v & [R\<^sub>2]uv)) & \<forall>v ([H]v \<rightarrow> \<exists>!u([G]u & [R\<^sub>2]uv))\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
          "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1), THEN "&E"(2)]
          "&I" by blast+
  AOT_have \<open>\<exists>R R = [\<lambda>xy D!x & D!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]\<close>
    by (rule "free-thms:3[lambda]") cqt_2_lambda_inst_prover
  then AOT_obtain R where R_def: \<open>R = [\<lambda>xy D!x & D!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have 1: \<open>\<exists>!v (([H]v & [R]uv))\<close> if a: \<open>[D!]u\<close> and b: \<open>[F]u\<close> for u
  proof (rule "\<equiv>E"(2)[OF "equi:1"])
    AOT_obtain b where
      b_prop: \<open>[D!]b & ([G]b & [R\<^sub>1]ub & \<forall>v ([G]v & [R\<^sub>1]uv \<rightarrow> v =\<^sub>D b))\<close>
      using \<theta>[THEN "&E"(1), THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E",
              OF a b, THEN "\<equiv>E"(1)[OF "equi:1"]]
            "\<exists>E"[rotated] by blast
    AOT_obtain c where
      c_prop: "[D!]c & ([H]c & [R\<^sub>2]bc & \<forall>v ([H]v & [R\<^sub>2]bv \<rightarrow> v =\<^sub>D c))"
      using \<xi>[THEN "&E"(1), THEN "\<forall>E"(2)[where \<beta>=b], THEN "\<rightarrow>E",
              OF b_prop[THEN "&E"(1)], THEN "\<rightarrow>E",
              OF b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)],
              THEN "\<equiv>E"(1)[OF "equi:1"]]
    "\<exists>E"[rotated] by blast
    AOT_show \<open>\<exists>v ([H]v & [R]uv & \<forall>v' ([H]v' & [R]uv' \<rightarrow> v' =\<^sub>D v))\<close>
    proof (safe intro!: "&I" GEN "\<rightarrow>I" "\<exists>I"(2)[where \<beta>=c])
      AOT_show \<open>D!c\<close> using c_prop "&E" by blast
    next
      AOT_show \<open>[H]c\<close> using c_prop "&E" by blast
    next
      AOT_have 0: \<open>[D!]u & [D!]c & \<exists>v ([G]v & [R\<^sub>1]uv & [R\<^sub>2]vc)\<close>
        by (safe intro!: "&I" a c_prop[THEN "&E"(1)] "\<exists>I"(2)[where \<beta>=b]
                         b_prop[THEN "&E"(1)] b_prop[THEN "&E"(2), THEN "&E"(1)]
                         c_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)])
      AOT_show \<open>[R]uc\<close>
        by (auto intro: "rule=E"[rotated, OF R_def[symmetric]]
                 intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" 0)
    next
      fix x
      AOT_assume ordx: \<open>D!x\<close>
      AOT_assume \<open>[H]x & [R]ux\<close>
      AOT_hence hx: \<open>[H]x\<close> and \<open>[R]ux\<close> using "&E" by blast+
      AOT_hence \<open>[\<lambda>xy D!x & D!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]ux\<close>
        using "rule=E"[rotated, OF R_def] by fast
      AOT_hence \<open>D!u & D!x & \<exists>v ([G]v & [R\<^sub>1]uv & [R\<^sub>2]vx)\<close>
        by (rule "\<beta>\<rightarrow>C"(1)[where \<phi>="\<lambda>(\<kappa>,\<kappa>'). _ \<kappa> \<kappa>'" and \<kappa>\<^sub>1\<kappa>\<^sub>n="(_,_)", simplified])
      then AOT_obtain z where z_prop: \<open>D!z & ([G]z & [R\<^sub>1]uz & [R\<^sub>2]zx)\<close>
        using "&E" "\<exists>E"[rotated] by blast
      AOT_hence \<open>z =\<^sub>D b\<close>
        using b_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=z]]
        using "&E" "\<rightarrow>E" by metis
      AOT_hence \<open>z = b\<close>
        using "cqt:2"(1) "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "rule=I:1" by blast
      AOT_hence \<open>[R\<^sub>2]bx\<close>
        using z_prop[THEN "&E"(2), THEN "&E"(2)] "rule=E" by fast
      AOT_thus \<open>x =\<^sub>D c\<close>
        using c_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=x],
                     THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF ordx]
              hx "&I" by blast
    qed
  qed
  AOT_have 2: \<open>\<exists>!u (([F]u & [R]uv))\<close> if a: \<open>[D!]v\<close> and b: \<open>[H]v\<close> for v
  proof (rule "\<equiv>E"(2)[OF "equi:1"])
    AOT_obtain b where
      b_prop: \<open>[D!]b & ([G]b & [R\<^sub>2]bv & \<forall>u ([G]u & [R\<^sub>2]uv \<rightarrow> u =\<^sub>D b))\<close>
      using \<xi>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E",
              OF a b, THEN "\<equiv>E"(1)[OF "equi:1"]]
            "\<exists>E"[rotated] by blast
    AOT_obtain c where
      c_prop: "[D!]c & ([F]c & [R\<^sub>1]cb & \<forall>v ([F]v & [R\<^sub>1]vb \<rightarrow> v =\<^sub>D c))"
      using \<theta>[THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=b], THEN "\<rightarrow>E",
              OF b_prop[THEN "&E"(1)], THEN "\<rightarrow>E",
              OF b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)],
              THEN "\<equiv>E"(1)[OF "equi:1"]]
    "\<exists>E"[rotated] by blast
    AOT_show \<open>\<exists>u ([F]u & [R]uv & \<forall>v' ([F]v' & [R]v'v \<rightarrow> v' =\<^sub>D u))\<close>
    proof (safe intro!: "&I" GEN "\<rightarrow>I" "\<exists>I"(2)[where \<beta>=c])
      AOT_show \<open>D!c\<close> using c_prop "&E" by blast
    next
      AOT_show \<open>[F]c\<close> using c_prop "&E" by blast
    next
      AOT_have \<open>[D!]c & [D!]v & \<exists>u ([G]u & [R\<^sub>1]cu & [R\<^sub>2]uv)\<close>
        by (safe intro!: "&I" a "\<exists>I"(2)[where \<beta>=b] 
                     c_prop[THEN "&E"(1)] b_prop[THEN "&E"(1)]
                     b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
                     b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
                     c_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)])
      AOT_thus \<open>[R]cv\<close>
        by (auto intro: "rule=E"[rotated, OF R_def[symmetric]]
                 intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
    next
      fix x
      AOT_assume ordx: \<open>D!x\<close>
      AOT_assume \<open>[F]x & [R]xv\<close>
      AOT_hence hx: \<open>[F]x\<close> and \<open>[R]xv\<close> using "&E" by blast+
      AOT_hence \<open>[\<lambda>xy D!x & D!y & \<exists>v ([G]v & [R\<^sub>1]xv & [R\<^sub>2]vy)]xv\<close>
        using "rule=E"[rotated, OF R_def] by fast
      AOT_hence \<open>D!x & D!v & \<exists>u ([G]u & [R\<^sub>1]xu & [R\<^sub>2]uv)\<close>
        by (rule "\<beta>\<rightarrow>C"(1)[where \<phi>="\<lambda>(\<kappa>,\<kappa>'). _ \<kappa> \<kappa>'" and \<kappa>\<^sub>1\<kappa>\<^sub>n="(_,_)", simplified])
      then AOT_obtain z where z_prop: \<open>D!z & ([G]z & [R\<^sub>1]xz & [R\<^sub>2]zv)\<close>
        using "&E" "\<exists>E"[rotated] by blast
      AOT_hence \<open>z =\<^sub>D b\<close>
        using b_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=z]]
        using "&E" "\<rightarrow>E" "&I" by metis
      AOT_hence \<open>z = b\<close>
        using "cqt:2"(1) "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "rule=I:1" by blast
      AOT_hence \<open>[R\<^sub>1]xb\<close>
        using z_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)] "rule=E" by fast
      AOT_thus \<open>x =\<^sub>D c\<close>
        using c_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2)[where \<beta>=x],
                     THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF ordx]
              hx "&I" by blast
    qed
  qed
  AOT_show \<open>F \<approx>\<^sub>D H\<close>
    apply (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
    apply (rule "\<exists>I"(2)[where \<beta>=R])
    by (auto intro!: 1 2 "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2[const_var]"[axiom_inst]
                     Discernible.GEN "\<rightarrow>I" Discernible.\<psi>)
qed

text\<open>Note: not explicitly in PLM.\<close>
AOT_theorem "eq-part:3[terms]": \<open>\<Pi> \<approx>\<^sub>D \<Pi>''\<close> if \<open>\<Pi> \<approx>\<^sub>D \<Pi>'\<close> and \<open>\<Pi>' \<approx>\<^sub>D \<Pi>''\<close>
  using "eq-part:3"[unvarify F G H, THEN "\<rightarrow>E"] eq_den_1 eq_den_2 "\<rightarrow>I" "&I"
  by (metis that(1) that(2))
declare "eq-part:3[terms]"[trans]

AOT_theorem "eq-part:4": \<open>F \<approx>\<^sub>D G \<equiv> \<forall>H (H \<approx>\<^sub>D F \<equiv> H \<approx>\<^sub>D G)\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume 0: \<open>F \<approx>\<^sub>D G\<close>
  AOT_hence 1: \<open>G \<approx>\<^sub>D F\<close> using "eq-part:2"[THEN "\<rightarrow>E"] by blast
  AOT_show \<open>\<forall>H (H \<approx>\<^sub>D F \<equiv> H \<approx>\<^sub>D G)\<close>
  proof (rule GEN; rule "\<equiv>I"; rule "\<rightarrow>I")
    AOT_show \<open>H \<approx>\<^sub>D G\<close> if \<open>H \<approx>\<^sub>D F\<close> for H using 0
      by (meson "&I" "eq-part:3" that "vdash-properties:6")
  next
    AOT_show \<open>H \<approx>\<^sub>D F\<close> if \<open>H \<approx>\<^sub>D G\<close> for H using 1
      by (metis "&I" "eq-part:3" that "vdash-properties:6")
  qed
next
  AOT_assume \<open>\<forall>H (H \<approx>\<^sub>D F \<equiv> H \<approx>\<^sub>D G)\<close>
  AOT_hence \<open>F \<approx>\<^sub>D F \<equiv> F \<approx>\<^sub>D G\<close> using "\<forall>E" by blast
  AOT_thus \<open>F \<approx>\<^sub>D G\<close> using "eq-part:1" "\<equiv>E" by blast
qed

AOT_define MapsD :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<longrightarrow>D _")
  "equi-rem:1":
  \<open>R |: F \<longrightarrow>D G \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & G\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>

AOT_define MapsDOneToOne :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D _")
  "equi-rem:2":
  \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D G \<equiv>\<^sub>d\<^sub>f
      R |: F \<longrightarrow>D G & \<forall>t\<forall>u\<forall>v (([F]t & [F]u & [G]v) \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>D u))\<close>

AOT_define MapsDOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD _")
  "equi-rem:3":
  \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G \<equiv>\<^sub>d\<^sub>f R |: F \<longrightarrow>D G & \<forall>v ([G]v \<rightarrow> \<exists>u ([F]u & [R]uv))\<close>

AOT_define MapsDOneToOneOnto :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("_ |: _ \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD _")
  "equi-rem:4":
  \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G \<equiv>\<^sub>d\<^sub>f R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>

AOT_theorem "equi-rem-thm":
  \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G \<equiv> R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
proof -
  AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G \<equiv> R |: [\<lambda>x D!x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x D!x & [G]x]\<close>
  proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
    AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    AOT_hence \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
          and \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
      using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
    AOT_hence a: \<open>([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
          and b: \<open>([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> for u v
      using "Discernible.\<forall>E" by fast+
    AOT_have \<open>([\<lambda>x [D!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]xy))\<close> for x
      apply (AOT_subst \<open>[\<lambda>x [D!]x & [F]x]x\<close> \<open>[D!]x & [F]x\<close>)
       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
       apply "cqt:2[lambda]"
      apply (AOT_subst \<open>[\<lambda>x [D!]x & [G]x]x\<close> \<open>[D!]x & [G]x\<close> for: x)
       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
       apply "cqt:2[lambda]"
      apply (AOT_subst \<open>D!y & [G]y & [R]xy\<close> \<open>D!y & ([G]y & [R]xy)\<close> for: y)
       apply (meson "\<equiv>E"(6) "Associativity of &" "oth-class-taut:3:a")
      apply (rule "\<rightarrow>I") apply (frule "&E"(1)) apply (drule "&E"(2))
      by (fact a[unconstrain u, THEN "\<rightarrow>E", THEN "\<rightarrow>E", of x])
    AOT_hence A: \<open>\<forall>x ([\<lambda>x [D!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]xy))\<close>
      by (rule GEN)
    AOT_have \<open>([\<lambda>x [D!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xy))\<close> for y
      apply (AOT_subst \<open>[\<lambda>x [D!]x & [G]x]y\<close> \<open>[D!]y & [G]y\<close>)
       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
       apply "cqt:2[lambda]"
      apply (AOT_subst \<open>[\<lambda>x [D!]x & [F]x]x\<close> \<open>[D!]x & [F]x\<close> for: x)
       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
       apply "cqt:2[lambda]"
      apply (AOT_subst \<open>D!x & [F]x & [R]xy\<close> \<open>D!x & ([F]x & [R]xy)\<close> for: x)
       apply (meson "\<equiv>E"(6) "Associativity of &" "oth-class-taut:3:a")
      apply (rule "\<rightarrow>I") apply (frule "&E"(1)) apply (drule "&E"(2))
      by (fact b[unconstrain v, THEN "\<rightarrow>E", THEN "\<rightarrow>E", of y])
    AOT_hence B: \<open>\<forall>y ([\<lambda>x [D!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xy))\<close>
      by (rule GEN)
    AOT_show \<open>R |: [\<lambda>x [D!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [D!]x & [G]x]\<close>
      by (safe intro!: "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
                       "cqt:2[const_var]"[axiom_inst] A B)
          "cqt:2[lambda]"+
  next
    AOT_assume \<open>R |: [\<lambda>x [D!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [D!]x & [G]x]\<close>
    AOT_hence a: \<open>([\<lambda>x [D!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]xy))\<close> and 
              b: \<open>([\<lambda>x [D!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xy))\<close> for x y
      using "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<forall>E"(2) by blast+
    AOT_have \<open>[F]u \<rightarrow> \<exists>!v ([G]v & [R]uv)\<close> for u
    proof (safe intro!: "\<rightarrow>I")
      AOT_assume fu: \<open>[F]u\<close>
      AOT_have 0: \<open>[\<lambda>x [D!]x & [F]x]u\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
                         Discernible.\<psi> fu "&I")
      AOT_show \<open>\<exists>!v ([G]v & [R]uv)\<close>
        apply (AOT_subst \<open>[D!]x & ([G]x & [R]ux)\<close>
                         \<open>([D!]x & [G]x) & [R]ux\<close> for: x)
         apply (simp add: "Associativity of &")
        apply (AOT_subst (reverse) \<open>[D!]x & [G]x\<close>
                                   \<open>[\<lambda>x [D!]x & [G]x]x\<close> for: x)
         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
         apply "cqt:2[lambda]"
        using a[THEN "\<rightarrow>E", OF 0] by blast
    qed
    AOT_hence A: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
      by (rule Discernible.GEN)
    AOT_have \<open>[G]v \<rightarrow> \<exists>!u ([F]u & [R]uv)\<close> for v
    proof (safe intro!: "\<rightarrow>I")
      AOT_assume gu: \<open>[G]v\<close>
      AOT_have 0: \<open>[\<lambda>x [D!]x & [G]x]v\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
                         Discernible.\<psi> gu "&I")
      AOT_show \<open>\<exists>!u ([F]u & [R]uv)\<close>
        apply (AOT_subst \<open>[D!]x & ([F]x & [R]xv)\<close> \<open>([D!]x & [F]x) & [R]xv\<close> for: x)
         apply (simp add: "Associativity of &")
        apply (AOT_subst (reverse) \<open>[D!]x & [F]x\<close> \<open>[\<lambda>x [D!]x & [F]x]x\<close>  for: x)
         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
         apply "cqt:2[lambda]"
        using b[THEN "\<rightarrow>E", OF 0] by blast
    qed
    AOT_hence B: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> by (rule Discernible.GEN)
    AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
      by (safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" A B "cqt:2[const_var]"[axiom_inst])
  qed
  also AOT_have \<open>\<dots> \<equiv> R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
  proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
    AOT_assume \<open>R |: [\<lambda>x [D!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [D!]x & [G]x]\<close>
    AOT_hence a: \<open>([\<lambda>x [D!]x & [F]x]x \<rightarrow> \<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]xy))\<close> and 
              b: \<open>([\<lambda>x [D!]x & [G]x]y \<rightarrow> \<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xy))\<close> for x y
      using "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" "\<forall>E"(2) by blast+
    AOT_show \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
    proof (safe intro!: "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "equi-rem:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
                        "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "equi-rem:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
                        "cqt:2[const_var]"[axiom_inst] Discernible.GEN "\<rightarrow>I")
      fix u
      AOT_assume fu: \<open>[F]u\<close>
      AOT_have 0: \<open>[\<lambda>x [D!]x & [F]x]u\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "cqt:2[const_var]"[axiom_inst]
                         Discernible.\<psi> fu "&I")
      AOT_hence 1: \<open>\<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]uy)\<close>
        using a[THEN "\<rightarrow>E"] by blast
      AOT_show \<open>\<exists>!v ([G]v & [R]uv)\<close>
        apply (AOT_subst \<open>[D!]x & ([G]x & [R]ux)\<close> \<open>([D!]x & [G]x) & [R]ux\<close> for: x)
         apply (simp add: "Associativity of &")
        apply (AOT_subst (reverse) \<open>[D!]x & [G]x\<close> \<open>[\<lambda>x [D!]x & [G]x]x\<close> for: x)
         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
         apply "cqt:2[lambda]"
        by (fact 1)
    next
      fix t u v
      AOT_assume \<open>[F]t & [F]u & [G]v\<close> and rtv_tuv: \<open>[R]tv & [R]uv\<close>
      AOT_hence oft: \<open>[\<lambda>x D!x & [F]x]t\<close> and
                ofu: \<open>[\<lambda>x D!x & [F]x]u\<close> and
                ogv: \<open>[\<lambda>x D!x & [G]x]v\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I"
                 simp: Discernible.\<psi> dest: "&E")
      AOT_hence \<open>\<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xv)\<close>
        using b[THEN "\<rightarrow>E"] by blast
      then AOT_obtain a where
          a_prop: \<open>[\<lambda>x [D!]x & [F]x]a & [R]av &
                   \<forall>x (([\<lambda>x [D!]x & [F]x]x & [R]xv) \<rightarrow> x = a)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "\<exists>E"[rotated] by blast
      AOT_hence ua: \<open>u = a\<close>
        using ofu rtv_tuv[THEN "&E"(2)] "\<forall>E"(2) "\<rightarrow>E" "&I" "&E"(2) by blast
      moreover AOT_have ta: \<open>t = a\<close>
        using a_prop oft rtv_tuv[THEN "&E"(1)] "\<forall>E"(2) "\<rightarrow>E" "&I" "&E"(2) by blast
      ultimately AOT_have \<open>t = u\<close> by (metis "rule=E" id_sym)
      AOT_thus \<open>t =\<^sub>D u\<close>
        by (simp add: "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)"
            Discernible.restricted_var_condition)
    next
      fix u
      AOT_assume \<open>[F]u\<close>
      AOT_hence \<open>[\<lambda>x D!x & [F]x]u\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I"
                 simp: "cqt:2[const_var]"[axiom_inst] Discernible.\<psi>)
      AOT_hence \<open>\<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]uy)\<close>
        using a[THEN "\<rightarrow>E"] by blast
      then AOT_obtain a where
        a_prop: \<open>[\<lambda>x [D!]x & [G]x]a & [R]ua &
                 \<forall>x (([\<lambda>x [D!]x & [G]x]x & [R]ux) \<rightarrow> x = a)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "\<exists>E"[rotated] by blast
      AOT_have \<open>D!a & [G]a\<close>
        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: a_prop[THEN "&E"(1), THEN "&E"(1)])
      AOT_hence \<open>D!a\<close> and \<open>[G]a\<close> using "&E" by blast+
      moreover AOT_have \<open>\<forall>v ([G]v & [R]uv \<rightarrow> v =\<^sub>D a)\<close>
      proof(safe intro!: Discernible.GEN "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
        fix v
        AOT_assume \<open>[G]v\<close> and ruv: \<open>[R]uv\<close>
        AOT_hence \<open>[\<lambda>x [D!]x & [G]x]v\<close>
          by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" simp: Discernible.\<psi>)
        AOT_hence \<open>v = a\<close>
          using a_prop[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF "&I"] ruv by blast
        AOT_thus \<open>v =\<^sub>D a\<close>
          by (simp add: "con-dis-i-e:1" "cqt:2"(1) "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)"
              Discernible.restricted_var_condition calculation(1))
      qed
      ultimately AOT_have \<open>D!a & ([G]a & [R]ua & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>D a))\<close>
        using "\<exists>I" "&I" a_prop[THEN "&E"(1), THEN "&E"(2)] by simp
      AOT_hence \<open>\<exists>v ([G]v & [R]uv & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>D v))\<close>
        by (rule "\<exists>I")
      AOT_thus \<open>\<exists>!v ([G]v & [R]uv)\<close>
        by (rule "equi:1"[THEN "\<equiv>E"(2)])
    next
      fix v
      AOT_assume \<open>[G]v\<close>
      AOT_hence \<open>[\<lambda>x D!x & [G]x]v\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" Discernible.\<psi>)
      AOT_hence \<open>\<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xv)\<close>
        using b[THEN "\<rightarrow>E"] by blast
      then AOT_obtain a where
        a_prop: \<open>[\<lambda>x [D!]x & [F]x]a & [R]av &
                 \<forall>y ([\<lambda>x [D!]x & [F]x]y & [R]yv \<rightarrow> y = a)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "\<exists>E"[rotated]] by blast
      AOT_have \<open>D!a & [F]a\<close>
        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: a_prop[THEN "&E"(1), THEN "&E"(1)])
      AOT_hence \<open>D!a & ([F]a & [R]av)\<close>
        using a_prop[THEN "&E"(1), THEN "&E"(2)] "&E" "&I" by metis
      AOT_thus \<open>\<exists>u ([F]u & [R]uv)\<close>
        by (rule "\<exists>I")
    qed
  next
    AOT_assume \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
    AOT_hence 1: \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D G\<close>
          and 2: \<open>R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
      using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
    AOT_hence 3: \<open>R |: F \<longrightarrow>D G\<close>
          and A: \<open>\<forall>t \<forall>u \<forall>v ([F]t & [F]u & [G]v \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>D u))\<close>
      using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 1] "&E" by blast+
    AOT_hence B: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
      using "equi-rem:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
    AOT_have C: \<open>\<forall>v ([G]v \<rightarrow> \<exists>u ([F]u & [R]uv))\<close>
      using "equi-rem:3"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 2] "&E" by blast
    AOT_show \<open>R |: [\<lambda>x [D!]x & [F]x] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow> [\<lambda>x [D!]x & [G]x]\<close>
    proof (rule "1-1-cor"[THEN "\<equiv>\<^sub>d\<^sub>fI"];
           safe intro!: "&I" "cqt:2" GEN "\<rightarrow>I")
      fix x
      AOT_assume 1: \<open>[\<lambda>x [D!]x & [F]x]x\<close>
      AOT_have \<open>D!x & [F]x\<close>
        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1)
      AOT_hence \<open>\<exists>!v ([G]v & [R]xv)\<close>
        using B[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&E" by blast
      then AOT_obtain y where
        y_prop: \<open>D!y & ([G]y & [R]xy & \<forall>u ([G]u & [R]xu \<rightarrow> u =\<^sub>D y))\<close>
        using "equi:1"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by fastforce
      AOT_hence \<open>[\<lambda>x D!x & [G]x]y\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" dest: "&E")
      moreover AOT_have \<open>\<forall>z ([\<lambda>x D!x & [G]x]z & [R]xz \<rightarrow> z = y)\<close>
      proof(safe intro!: GEN "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
        fix z
        AOT_assume 1: \<open>[\<lambda>x [D!]x & [G]x]z\<close>
        AOT_have 2: \<open>D!z & [G]z\<close>
          by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1)
        moreover AOT_assume \<open>[R]xz\<close>
        ultimately AOT_have \<open>z =\<^sub>D y\<close>
          using y_prop[THEN "&E"(2), THEN "&E"(2), THEN "\<forall>E"(2),
                       THEN "\<rightarrow>E", THEN "\<rightarrow>E", rotated, OF "&I"] "&E"
          by blast
        AOT_thus \<open>z = y\<close>
          using 2[THEN "&E"(1)]
          using "discern-obj:19" "vdash-properties:10" by blast
      qed
      ultimately AOT_have \<open>[\<lambda>x D!x & [G]x]y & [R]xy &
                           \<forall>z ([\<lambda>x D!x & [G]x]z & [R]xz \<rightarrow> z = y)\<close>
        using y_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)] "&I" by auto
      AOT_hence \<open>\<exists>y ([\<lambda>x D!x & [G]x]y & [R]xy &
                    \<forall>z ([\<lambda>x D!x & [G]x]z & [R]xz \<rightarrow> z = y))\<close>
        by (rule "\<exists>I")
      AOT_thus \<open>\<exists>!y ([\<lambda>x [D!]x & [G]x]y & [R]xy)\<close>
        using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by fast
    next
      fix y
      AOT_assume 1: \<open>[\<lambda>x [D!]x & [G]x]y\<close>
      AOT_have oy_gy: \<open>D!y & [G]y\<close>
        by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1)
      AOT_hence \<open>\<exists>u ([F]u & [R]uy)\<close>
        using C[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<rightarrow>E"] "&E" by blast
      then AOT_obtain x where x_prop: \<open>D!x & ([F]x & [R]xy)\<close>
        using "\<exists>E"[rotated] by blast
      AOT_hence ofx: \<open>[\<lambda>x D!x & [F]x]x\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" dest: "&E")
      AOT_have \<open>\<exists>\<alpha> ([\<lambda>x [D!]x & [F]x]\<alpha> & [R]\<alpha>y &
                    \<forall>\<beta> ([\<lambda>x [D!]x & [F]x]\<beta> & [R]\<beta>y \<rightarrow> \<beta> = \<alpha>))\<close>
      proof (safe intro!: "\<exists>I"(2)[where \<beta>=x] "&I" GEN "\<rightarrow>I")
        AOT_show \<open>[\<lambda>x D!x & [F]x]x\<close> using ofx.
      next
        AOT_show \<open>[R]xy\<close> using x_prop[THEN "&E"(2), THEN "&E"(2)].
      next
        fix z
        AOT_assume 1: \<open>[\<lambda>x [D!]x & [F]x]z & [R]zy\<close>
        AOT_have oz_fz: \<open>D!z & [F]z\<close>
          by (rule "\<beta>\<rightarrow>C"(1)) (auto simp: 1[THEN "&E"(1)])
        AOT_have \<open>z =\<^sub>D x\<close>
          using A[THEN "\<forall>E"(2)[where \<beta>=z], THEN "\<rightarrow>E", THEN "\<forall>E"(2)[where \<beta>=x],
                  THEN "\<rightarrow>E", THEN "\<forall>E"(2)[where \<beta>=y], THEN "\<rightarrow>E",
                  THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF oz_fz[THEN "&E"(1)],
                  OF x_prop[THEN "&E"(1)], OF oy_gy[THEN "&E"(1)], OF "&I", OF "&I",
                  OF oz_fz[THEN "&E"(2)], OF x_prop[THEN "&E"(2), THEN "&E"(1)],
                  OF oy_gy[THEN "&E"(2)], OF "&I", OF 1[THEN "&E"(2)],
                  OF x_prop[THEN "&E"(2), THEN "&E"(2)]].
        AOT_thus \<open>z = x\<close>
          using "discern-obj:19" "vdash-properties:10" by blast
      qed
      AOT_thus \<open>\<exists>!x ([\<lambda>x [D!]x & [F]x]x & [R]xy)\<close>
        by (rule "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
    qed
  qed
  finally show ?thesis.
qed

AOT_theorem "empty-approx:1": \<open>(\<not>\<exists>u [F]u & \<not>\<exists>v [H]v) \<rightarrow> F \<approx>\<^sub>D H\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume 0: \<open>\<not>\<exists>u [F]u\<close> and 1: \<open>\<not>\<exists>v [H]v\<close>
  AOT_have \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([H]v & [R]uv))\<close> for R
  proof(rule Discernible.GEN; rule "\<rightarrow>I"; rule "raa-cor:1")
    fix u
    AOT_assume \<open>[F]u\<close>
    AOT_hence \<open>\<exists>u [F]u\<close> using "Discernible.\<exists>I" "&I" by fast
    AOT_thus \<open>\<exists>u [F]u & \<not>\<exists>u [F]u\<close> using "&I" 0 by blast
  qed
  moreover AOT_have \<open>\<forall>v ([H]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> for R
  proof(rule Discernible.GEN; rule "\<rightarrow>I"; rule "raa-cor:1")
    fix v
    AOT_assume \<open>[H]v\<close>
    AOT_hence \<open>\<exists>v [H]v\<close> using "Discernible.\<exists>I" "&I" by fast
    AOT_thus \<open>\<exists>v [H]v & \<not>\<exists>v [H]v\<close> using 1 "&I" by blast
  qed
  ultimately AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D H\<close> for R
    apply (safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" GEN "cqt:2[const_var]"[axiom_inst])
    using "\<forall>E" by blast+
  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D H\<close> by (rule "\<exists>I")
  AOT_thus \<open>F \<approx>\<^sub>D H\<close>
    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
qed

AOT_theorem "empty-approx:2": \<open>(\<exists>u [F]u & \<not>\<exists>v [H]v) \<rightarrow> \<not>(F \<approx>\<^sub>D H)\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2); rule "raa-cor:2")
  AOT_assume 1: \<open>\<exists>u [F]u\<close> and 2: \<open>\<not>\<exists>v [H]v\<close>
  AOT_obtain b where b_prop: \<open>D!b & [F]b\<close>
    using 1 "\<exists>E"[rotated] by blast
  AOT_assume \<open>F \<approx>\<^sub>D H\<close>
  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D H\<close>
    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"])
  then AOT_obtain R where \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D H\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<theta>: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([H]v & [R]uv))\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_have \<open>\<exists>!v ([H]v & [R]bv)\<close> for u
    using \<theta>[THEN "\<forall>E"(2)[where \<beta>=b], THEN "\<rightarrow>E", THEN "\<rightarrow>E",
            OF b_prop[THEN "&E"(1)], OF b_prop[THEN "&E"(2)]].
  AOT_hence \<open>\<exists>v ([H]v & [R]bv & \<forall>u ([H]u & [R]bu \<rightarrow> u =\<^sub>D v))\<close>
    by (rule "equi:1"[THEN "\<equiv>E"(1)])
  then AOT_obtain x where \<open>D!x & ([H]x & [R]bx & \<forall>u ([H]u & [R]bu \<rightarrow> u =\<^sub>D x))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>D!x & [H]x\<close> using "&E" "&I" by blast
  AOT_hence \<open>\<exists>v [H]v\<close> by (rule "\<exists>I")
  AOT_thus \<open>\<exists>v [H]v & \<not>\<exists>v [H]v\<close> using 2 "&I" by blast
qed

(* Note: in PLM weaker with F instead of \<Pi>, but more general due to remarks *)
AOT_theorem "F-u:1": \<open>[\<lambda>z [\<Pi>]z & z \<noteq> u]\<down>\<close>
proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I")
  AOT_show \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>D u]\<down>\<close>
    by "cqt:2[lambda]"
next
  AOT_show \<open>\<box>\<forall>z ([\<Pi>]z & z \<noteq>\<^sub>D u \<equiv> [\<Pi>]z & z \<noteq> u)\<close>
  proof (safe intro!: RN GEN "\<equiv>I" "\<rightarrow>I")
    AOT_modally_strict {
      fix z
      AOT_assume \<open>[\<Pi>]z & z \<noteq>\<^sub>D u\<close>
      AOT_hence \<open>[\<Pi>]z & \<not>(z =\<^sub>D u)\<close>
        using "discern-obj:25" "intro-elim:3:a" "oth-class-taut:4:f.\<rightarrow>E" by blast
      AOT_hence \<open>[\<Pi>]z & \<not>(z = u)\<close>
        by (metis (mono_tags, opaque_lifting) "con-dis-i-e:2:b" "con-dis-taut:1.\<rightarrow>E" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:18"
            "id_sym.rule=E'" "intro-elim:3:c" "raa-cor:1" Discernible.restricted_var_condition)
      AOT_thus \<open>[\<Pi>]z & z \<noteq> u\<close>
        using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by blast
    }
  next
    AOT_modally_strict {
      fix z
      AOT_assume \<open>[\<Pi>]z & z \<noteq> u\<close>
      AOT_hence \<open>[\<Pi>]z & \<not>(z = u)\<close>
        using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by blast
      AOT_hence \<open>[\<Pi>]z & \<not>(z =\<^sub>D u)\<close>
        by (metis "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:19" "raa-cor:4"
            "useful-tautologies:8.\<rightarrow>E.\<rightarrow>E")
      AOT_thus \<open>[\<Pi>]z & z \<noteq>\<^sub>D u\<close>
        by (metis "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1)
            "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)")
    }
  qed
qed

AOT_define FminusU :: \<open>\<Pi> \<Rightarrow> \<tau> \<Rightarrow> \<Pi>\<close> ("_\<^sup>-\<^sup>_")
  "F-u:2": \<open>[F]\<^sup>-\<^sup>u =\<^sub>d\<^sub>f [\<lambda>z [F]z & z \<noteq> u]\<close>

text\<open>Note: not explicitly in PLM.\<close>
AOT_theorem "F-u:2[den]": \<open>[\<Pi>]\<^sup>-\<^sup>u\<down>\<close>
  by (safe intro!: "=\<^sub>d\<^sub>fI"(1)[OF "F-u:2", where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified] "F-u:1")

AOT_theorem "F-u:2[equiv]": \<open>[[\<Pi>]\<^sup>-\<^sup>u]y \<equiv> ([\<Pi>]y & y \<noteq> u)\<close>
  by (auto intro: "F-u:2"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
           intro!: "F-u:1" "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)])

AOT_theorem eqP': \<open>F \<approx>\<^sub>D G & [F]u & [G]v \<rightarrow> [F]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
proof (rule "\<rightarrow>I"; frule "&E"(2); drule "&E"(1); frule "&E"(2); drule "&E"(1))
  AOT_assume \<open>F \<approx>\<^sub>D G\<close>
  AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  then AOT_obtain R where R_prop: \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence A: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
        and B: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
    using "equi-rem-thm"[THEN "\<equiv>E"(1), OF R_prop].
  AOT_hence \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
    using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence C: \<open>\<forall>t\<forall>u\<forall>v (([F]t & [F]u & [G]v) \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>D u))\<close>
    using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_assume fu: \<open>[F]u\<close>
  AOT_assume gv: \<open>[G]v\<close>
  AOT_have \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>D \<kappa>]\<down>\<close> for \<Pi> \<kappa>
    by "cqt:2[lambda]"
  note \<Pi>_minus_\<kappa>I = "rule-id-df:2:b[2]"[
      where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u:2", simplified, OF "F-u:1"]
   and \<Pi>_minus_\<kappa>E = "rule-id-df:2:a[2]"[
   where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u:2", simplified, OF "F-u:1"]
  {
    fix R
    AOT_assume R_prop: \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    AOT_hence A: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
          and B: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
      using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
    AOT_have \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
      using "equi-rem-thm"[THEN "\<equiv>E"(1), OF R_prop].
    AOT_hence \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D G & R |: F \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
      using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    AOT_hence C: \<open>\<forall>t\<forall>u\<forall>v (([F]t & [F]u & [G]v) \<rightarrow> ([R]tv & [R]uv \<rightarrow> t =\<^sub>D u))\<close>
      using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast

    AOT_assume Ruv: \<open>[R]uv\<close>
    AOT_have \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
    proof(safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2[const_var]"[axiom_inst]
                       "F-u:2[den]" Discernible.GEN "\<rightarrow>I")
      fix u'
      AOT_assume \<open>[[F]\<^sup>-\<^sup>u]u'\<close>
      AOT_hence 0: \<open>[\<lambda>z [F]z & z \<noteq> u]u'\<close>
        using \<Pi>_minus_\<kappa>E by fast
      AOT_have 0: \<open>[F]u' & u' \<noteq> u\<close>
        by (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Discernible.Rep u')"]) (fact 0)
      AOT_have \<open>\<exists>!v ([G]v & [R]u'v)\<close>
        using A[THEN "Discernible.\<forall>E"[where \<alpha>=u'], THEN "\<rightarrow>E", OF 0[THEN "&E"(1)]].
      then AOT_obtain v' where
        v'_prop: \<open>[G]v' & [R]u'v' & \<forall> t ([G]t & [R]u't \<rightarrow> t =\<^sub>D v')\<close>
        using "equi:1"[THEN "\<equiv>E"(1)] "Discernible.\<exists>E"[rotated] by fastforce

      AOT_show \<open>\<exists>!v' ([[G]\<^sup>-\<^sup>v]v' & [R]u'v')\<close>
      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Discernible.\<exists>I"[where \<beta>=v']
                          "&I" Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[[G]\<^sup>-\<^sup>v]v'\<close>
        proof (rule \<Pi>_minus_\<kappa>I; 
               safe intro!: "\<beta>\<leftarrow>C"(1) "F-u:1" "&I" "cqt:2")
          AOT_show \<open>[G]v'\<close> using v'_prop "&E" by blast
        next
          AOT_have \<open>\<not>v' =\<^sub>D v\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>v' =\<^sub>D v\<close>
            AOT_hence \<open>v' = v\<close>
              using "discern-obj:19" "vdash-properties:10" by blast
            AOT_hence Ruv': \<open>[R]uv'\<close> using "rule=E" Ruv id_sym by fast
            AOT_have \<open>u' =\<^sub>D u\<close>
              by (rule C[THEN "Discernible.\<forall>E", THEN "Discernible.\<forall>E",
                         THEN "Discernible.\<forall>E"[where \<alpha>=v'], THEN "\<rightarrow>E", THEN "\<rightarrow>E"])
                 (safe intro!: "&I" 0[THEN "&E"(1)] fu
                               v'_prop[THEN "&E"(1), THEN "&E"(1)]
                               Ruv' v'_prop[THEN "&E"(1), THEN "&E"(2)])
            moreover AOT_have \<open>\<not>(u' =\<^sub>D u)\<close>
              using "0" "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:b" "contraposition:1[1]" "discern-obj:19" "vdash-properties:6" by blast
            ultimately AOT_show \<open>u' =\<^sub>D u & \<not>u' =\<^sub>D u\<close> using "&I" by blast
          qed
          AOT_hence \<open>\<not>v' = v\<close>
            by (metis "con-dis-i-e:1" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "raa-cor:4" "russell-axiom[exe,1].\<psi>_denotes_asm"
                Discernible.restricted_var_condition)
          AOT_thus \<open>v' \<noteq> v\<close>
            using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" by blast
       qed
      next
        AOT_show \<open>[R]u'v'\<close> using v'_prop "&E" by blast
      next
        fix t
        AOT_assume t_prop: \<open>[[G]\<^sup>-\<^sup>v]t & [R]u't\<close>
        AOT_have gt_t_noteq_v: \<open>[G]t & t \<noteq> v\<close>
          apply (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Discernible.Rep t)"])
          apply (rule \<Pi>_minus_\<kappa>E)
          by (fact t_prop[THEN "&E"(1)])
        AOT_show \<open>t =\<^sub>D v'\<close>
          using v'_prop[THEN "&E"(2), THEN "Discernible.\<forall>E", THEN "\<rightarrow>E",
                        OF "&I", OF gt_t_noteq_v[THEN "&E"(1)],
                        OF t_prop[THEN "&E"(2)]].
      qed
    next
      fix v'
      AOT_assume G_minus_v_v': \<open>[[G]\<^sup>-\<^sup>v]v'\<close>
      AOT_have gt_t_noteq_v: \<open>[G]v' & v' \<noteq> v\<close>
        apply (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Discernible.Rep v')"])
        apply (rule \<Pi>_minus_\<kappa>E)
        by (fact G_minus_v_v')
      AOT_have \<open>\<exists>!u([F]u & [R]uv')\<close>
        using B[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF gt_t_noteq_v[THEN "&E"(1)]].
      then AOT_obtain u' where
        u'_prop: \<open>[F]u' & [R]u'v' & \<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>D u')\<close>
        using "equi:1"[THEN "\<equiv>E"(1)] "Discernible.\<exists>E"[rotated] by fastforce
      AOT_show \<open>\<exists>!u' ([[F]\<^sup>-\<^sup>u]u' & [R]u'v')\<close>
      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Discernible.\<exists>I"[where \<beta>=u'] "&I"
                          u'_prop[THEN "&E"(1), THEN "&E"(2)] Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[[F]\<^sup>-\<^sup>u]u'\<close>
        proof (rule \<Pi>_minus_\<kappa>I;
               safe intro!: "\<beta>\<leftarrow>C"(1) "F-u:1"  "&I"
               u'_prop[THEN "&E"(1), THEN "&E"(1)] "cqt:2")
          AOT_have \<open>\<not>(u' = u)\<close>
          proof(rule "raa-cor:2")
            AOT_assume \<open>u' = u\<close>
            AOT_hence Ru'v: \<open>[R]u'v\<close> using "rule=E" Ruv id_sym by fast
            AOT_have \<open>v' \<noteq>\<^sub>D v\<close>
              by (meson "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:b" "cqt:2"(1) "discern-obj:19" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)"
                  "modus-tollens:1" gt_t_noteq_v)
            AOT_hence v'_noteq_v: \<open>\<not>(v' =\<^sub>D v)\<close>
              by (simp add: "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" "ex:1:a" "rule-ui:3")
            AOT_have \<open>\<exists>u ([G]u & [R]u'u & \<forall>v ([G]v & [R]u'v \<rightarrow> v =\<^sub>D u))\<close>
              using A[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E",
                      OF u'_prop[THEN "&E"(1), THEN "&E"(1)],
                      THEN "equi:1"[THEN "\<equiv>E"(1)]].
            then AOT_obtain t where
              t_prop: \<open>[G]t & [R]u't & \<forall>v ([G]v & [R]u'v \<rightarrow> v =\<^sub>D t)\<close>
              using "Discernible.\<exists>E"[rotated] by meson
            AOT_have \<open>v =\<^sub>D t\<close> if \<open>[G]v\<close> and \<open>[R]u'v\<close> for v
              using t_prop[THEN "&E"(2), THEN "Discernible.\<forall>E", THEN "\<rightarrow>E",
                           OF "&I", OF that].
            AOT_hence \<open>v' =\<^sub>D t\<close> and v_eq_t: \<open>v =\<^sub>D t\<close>
              by (auto simp: gt_t_noteq_v[THEN "&E"(1)] Ru'v gv
                             u'_prop[THEN "&E"(1), THEN "&E"(2)])
            AOT_hence \<open>v' =\<^sub>D t\<close> and \<open>t =\<^sub>D v\<close>
               apply simp
              using "discern-obj:31" "vdash-properties:10" v_eq_t by blast
            AOT_hence \<open>v' =\<^sub>D v\<close>
              by (meson "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
            AOT_thus \<open>v' =\<^sub>D v & \<not>v' =\<^sub>D v\<close>
              using v'_noteq_v "&I" by blast
          qed
          AOT_thus \<open>u' \<noteq> u\<close>
            using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" by blast
        qed
      next
        fix t
        AOT_assume 0: \<open>[[F]\<^sup>-\<^sup>u]t & [R]tv'\<close>
        moreover AOT_have \<open>[F]t & t \<noteq> u\<close>
          apply (rule "\<beta>\<rightarrow>C"(1)[where \<kappa>\<^sub>1\<kappa>\<^sub>n="AOT_term_of_var (Discernible.Rep t)"])
          apply (rule \<Pi>_minus_\<kappa>E)
          by (fact 0[THEN "&E"(1)])
        ultimately AOT_show \<open>t =\<^sub>D u'\<close>
          using u'_prop[THEN "&E"(2), THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF "&I"]
                "&E" by blast
      qed
    qed
    AOT_hence \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
      by (rule "\<exists>I")
  } note 1 = this
  moreover {
    AOT_assume not_Ruv: \<open>\<not>[R]uv\<close>
    AOT_have \<open>\<exists>!v ([G]v & [R]uv)\<close>
      using A[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF fu].
    then AOT_obtain b where
      b_prop: \<open>D!b & ([G]b & [R]ub & \<forall>t([G]t & [R]ut \<rightarrow> t =\<^sub>D b))\<close>
      using "equi:1"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by fastforce
    AOT_hence ob: \<open>D!b\<close> and gb: \<open>[G]b\<close> and Rub: \<open>[R]ub\<close>
      using "&E" by blast+
    AOT_have \<open>D!t \<rightarrow> ([G]t & [R]ut \<rightarrow> t =\<^sub>D b)\<close> for t
      using b_prop "&E"(2) "\<forall>E"(2) by blast
    AOT_hence b_unique: \<open>t =\<^sub>D b\<close> if \<open>D!t\<close> and \<open>[G]t\<close> and \<open>[R]ut\<close> for t
      by (metis Adjunction "modus-tollens:1" "reductio-aa:1" that)
    AOT_have not_v_eq_b: \<open>\<not>(v =\<^sub>D b)\<close>
    proof(rule "raa-cor:2")
      AOT_assume \<open>v =\<^sub>D b\<close>
      AOT_hence 0: \<open>v = b\<close>
        using "discern-obj:19" "vdash-properties:10" by blast
      AOT_have \<open>[R]uv\<close>
        using b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
              "rule=E"[rotated, OF 0[symmetric]] by fast
      AOT_thus \<open>[R]uv & \<not>[R]uv\<close>
        using not_Ruv "&I" by blast
    qed
    AOT_have not_b_eq_v: \<open>\<not>(b =\<^sub>D v)\<close>
      using "discern-obj:31" "modus-tollens:1" not_v_eq_b by blast
    AOT_have \<open>\<exists>!u ([F]u & [R]uv)\<close>
      using B[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF gv].
    then AOT_obtain a where
      a_prop: \<open>D!a & ([F]a & [R]av & \<forall>t([F]t & [R]tv \<rightarrow> t =\<^sub>D a))\<close>
      using "equi:1"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by fastforce
    AOT_hence oa: \<open>D!a\<close> and fa: \<open>[F]a\<close> and Rav: \<open>[R]av\<close>
      using "&E" by blast+
    AOT_have \<open>D!t \<rightarrow> ([F]t & [R]tv \<rightarrow> t =\<^sub>D a)\<close> for t
      using a_prop "&E" "\<forall>E"(2) by blast
    AOT_hence a_unique: \<open>t =\<^sub>D a\<close> if \<open>D!t\<close> and \<open>[F]t\<close> and \<open>[R]tv\<close> for t
      by (metis Adjunction "modus-tollens:1" "reductio-aa:1" that) 
    AOT_have not_u_eq_a: \<open>\<not>(u =\<^sub>D a)\<close>
    proof(rule "raa-cor:2")
      AOT_assume \<open>u =\<^sub>D a\<close>
      AOT_hence 0: \<open>u = a\<close>
        by (metis "discern-obj:19" "reductio-aa:2" "useful-tautologies:3.\<rightarrow>E.\<rightarrow>E" "useful-tautologies:8.\<rightarrow>E.\<rightarrow>E")
      AOT_have \<open>[R]uv\<close>
        using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]
              "rule=E"[rotated, OF 0[symmetric]] by fast
      AOT_thus \<open>[R]uv & \<not>[R]uv\<close>
        using not_Ruv "&I" by blast
    qed
    AOT_have not_a_eq_u: \<open>\<not>(a =\<^sub>D u)\<close>
      using "discern-obj:31" "modus-tollens:1" not_u_eq_a by blast
    let ?R = \<open>\<guillemotleft>[\<lambda>u'v' (u' \<noteq>\<^sub>D u & v' \<noteq>\<^sub>D v & [R]u'v') \<or>
                      (u' =\<^sub>D a & v' =\<^sub>D b) \<or>
                      (u' =\<^sub>D u & v' =\<^sub>D v)]\<guillemotright>\<close>
    AOT_have \<open>[\<guillemotleft>?R\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
    AOT_hence \<open>\<exists> \<beta> \<beta> = [\<guillemotleft>?R\<guillemotright>]\<close>
      using "free-thms:1" "\<equiv>E"(1) by fast
    then AOT_obtain R\<^sub>1 where R\<^sub>1_def: \<open>R\<^sub>1 = [\<guillemotleft>?R\<guillemotright>]\<close>
      using "\<exists>E"[rotated] by blast
    AOT_have Rxy1: \<open>[R]xy\<close> if \<open>[R\<^sub>1]xy\<close> and \<open>x \<noteq>\<^sub>D u\<close> and \<open>x \<noteq>\<^sub>D a\<close> for x y
    proof -
      AOT_have 0: \<open>[\<guillemotleft>?R\<guillemotright>]xy\<close>
        by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact that(1))
      AOT_have \<open>(x \<noteq>\<^sub>D u & y \<noteq>\<^sub>D v & [R]xy) \<or> (x =\<^sub>D a & y =\<^sub>D b) \<or> (x =\<^sub>D u & y =\<^sub>D v)\<close>
        using "\<beta>\<rightarrow>C"(1)[OF 0] by simp
      AOT_hence \<open>x \<noteq>\<^sub>D u & y \<noteq>\<^sub>D v & [R]xy\<close> using that(2,3)
        by (meson "con-dis-i-e:4:c" "con-dis-taut:1" "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)"
            "modus-tollens:1")
      AOT_thus \<open>[R]xy\<close> using "&E" by blast+
    qed
    AOT_have Rxy2: \<open>[R]xy\<close>  if \<open>[R\<^sub>1]xy\<close> and \<open>y \<noteq>\<^sub>D v\<close> and \<open>y \<noteq>\<^sub>D b\<close> for x y
    proof -
      AOT_have 0: \<open>[\<guillemotleft>?R\<guillemotright>]xy\<close>
        by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact that(1))
      AOT_have \<open>(x \<noteq>\<^sub>D u & y \<noteq>\<^sub>D v & [R]xy) \<or> (x =\<^sub>D a & y =\<^sub>D b) \<or> (x =\<^sub>D u & y =\<^sub>D v)\<close>
        using "\<beta>\<rightarrow>C"(1)[OF 0] by simp
      AOT_hence \<open>x \<noteq>\<^sub>D u & y \<noteq>\<^sub>D v & [R]xy\<close>
        using that(2,3)
        by (metis "con-dis-i-e:2:b" "con-dis-i-e:4:b" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" "raa-cor:4"
            "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" that(1))
      AOT_thus \<open>[R]xy\<close> using "&E" by blast+
    qed
    AOT_have R\<^sub>1xy: \<open>[R\<^sub>1]xy\<close> if \<open>[R]xy\<close> and \<open>x \<noteq>\<^sub>D u\<close> and \<open>y \<noteq>\<^sub>D v\<close> for x y
      by (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
         (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2"
                 simp: "&I" "ex:1:a" prod_denotesI "rule-ui:3" that "\<or>I"(1))
    AOT_have R\<^sub>1ab: \<open>[R\<^sub>1]ab\<close>
      apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
      apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I")
      by (simp add: "con-dis-i-e:3:a" "con-dis-taut:4.\<rightarrow>E" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "ex:1:a"
          "rule-ui:3" oa ob)
    AOT_have R\<^sub>1uv: \<open>[R\<^sub>1]uv\<close>
      apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
      apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I")
      by (simp add: "con-dis-i-e:1" "con-dis-i-e:3:b" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "ex:1:a" "rule-ui:3"
          Discernible.restricted_var_condition)
    moreover AOT_have \<open>R\<^sub>1 |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    proof (safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Discernible.GEN "\<rightarrow>I")
      fix u'
      AOT_assume fu': \<open>[F]u'\<close>
      {
        AOT_assume not_u'_eq_u: \<open>\<not>(u' =\<^sub>D u)\<close> and not_u'_eq_a: \<open>\<not>(u' =\<^sub>D a)\<close>
        AOT_hence u'_noteq_u: \<open>u' \<noteq>\<^sub>D u\<close> and u'_noteq_a: \<open>u' \<noteq>\<^sub>D a\<close>
          by (metis "\<equiv>E"(2) "discern-obj:25")+
        AOT_have \<open>\<exists>!v ([G]v & [R]u'v)\<close>
          using A[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF fu'].
        AOT_hence \<open>\<exists>v ([G]v & [R]u'v & \<forall>t ([G]t & [R]u't \<rightarrow> t =\<^sub>D v))\<close>
          using "equi:1"[THEN "\<equiv>E"(1)] by simp
        then AOT_obtain v' where
          v'_prop: \<open>[G]v' & [R]u'v' & \<forall>t ([G]t & [R]u't \<rightarrow> t =\<^sub>D v')\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        AOT_hence gv': \<open>[G]v'\<close> and Ru'v': \<open>[R]u'v'\<close>
          using "&E" by blast+
        AOT_have not_v'_eq_v: \<open>\<not>v' =\<^sub>D v\<close>
        proof (rule "raa-cor:2")
          AOT_assume \<open>v' =\<^sub>D v\<close>
          AOT_hence \<open>v' = v\<close>
            using "discern-obj:19" "vdash-properties:10" by blast
          AOT_hence Ru'v: \<open>[R]u'v\<close>
            using "rule=E" Ru'v' by fast
          AOT_have \<open>u' =\<^sub>D a\<close>
            using a_unique[OF Discernible.\<psi>, OF fu', OF Ru'v].
          AOT_thus \<open>u' =\<^sub>D a & \<not>u' =\<^sub>D a\<close>
            using not_u'_eq_a "&I" by blast
        qed
        AOT_hence v'_noteq_v: \<open>v' \<noteq>\<^sub>D v\<close>
          by (simp add: "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)")
        AOT_have \<open>\<forall>t ([G]t & [R]u't \<rightarrow> t =\<^sub>D v')\<close>
          using v'_prop "&E" by blast
        AOT_hence \<open>[G]t & [R]u't \<rightarrow> t =\<^sub>D v'\<close> for t
          using "Discernible.\<forall>E" by meson
        AOT_hence v'_unique: \<open>t =\<^sub>D v'\<close> if \<open>[G]t\<close> and \<open>[R]u't\<close> for t
          by (metis "&I" that "\<rightarrow>E")

        AOT_have \<open>[G]v' & [R\<^sub>1]u'v' & \<forall>t ([G]t & [R\<^sub>1]u't \<rightarrow> t =\<^sub>D v')\<close>
        proof (safe intro!: "&I" gv' R\<^sub>1xy Ru'v' u'_noteq_u u'_noteq_a "\<rightarrow>I"
                            Discernible.GEN "discern-obj:25"[THEN "\<equiv>E"(2)] not_v'_eq_v)
          fix t
          AOT_assume 1: \<open>[G]t & [R\<^sub>1]u't\<close>
          AOT_have \<open>[R]u't\<close>
            using Rxy1[OF 1[THEN "&E"(2)], OF u'_noteq_u, OF u'_noteq_a].
          AOT_thus \<open>t =\<^sub>D v'\<close>
            using v'_unique 1[THEN "&E"(1)] by blast
        qed
        AOT_hence \<open>\<exists>v ([G]v & [R\<^sub>1]u'v & \<forall>t ([G]t & [R\<^sub>1]u't \<rightarrow> t =\<^sub>D v))\<close>
          by (rule "Discernible.\<exists>I")
        AOT_hence \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
          by (rule "equi:1"[THEN "\<equiv>E"(2)])
      }
      moreover {
        AOT_assume 0: \<open>u' =\<^sub>D u\<close>
        AOT_hence u'_eq_u: \<open>u' = u\<close>
          using "discern-obj:19" "vdash-properties:10" by blast
        AOT_have \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Discernible.\<exists>I"[where \<beta>=v]
                            "&I" Discernible.GEN "\<rightarrow>I" gv)
          AOT_show \<open>[R\<^sub>1]u'v\<close>
            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI)
            apply (safe intro!: "\<or>I"(2) "&I" 0)
            using "cqt:2"(1) "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" Discernible.restricted_var_condition by blast
        next
          fix v'
          AOT_assume \<open>[G]v' & [R\<^sub>1]u'v'\<close>
          AOT_hence 0: \<open>[R\<^sub>1]uv'\<close>
            using "rule=E"[rotated, OF u'_eq_u] "&E"(2) by fast
          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]uv'\<close>
            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
          AOT_have 2: \<open>(u \<noteq>\<^sub>D u & v' \<noteq>\<^sub>D v & [R]uv') \<or>
                       (u =\<^sub>D a & v' =\<^sub>D b) \<or>
                       (u =\<^sub>D u & v' =\<^sub>D v)\<close>
            using "\<beta>\<rightarrow>C"(1)[OF 1] by simp
          AOT_have \<open>\<not>u \<noteq>\<^sub>D u\<close>
            using "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "reductio-aa:2" R\<^sub>1uv Rxy1 not_Ruv not_u_eq_a
            by blast
          AOT_hence \<open>\<not>((u \<noteq>\<^sub>D u & v' \<noteq>\<^sub>D v & [R]uv') \<or> (u =\<^sub>D a & v' =\<^sub>D b))\<close>
            using not_u_eq_a
            by (metis "\<or>E"(2) "Conjunction Simplification"(1)
                      "modus-tollens:1" "reductio-aa:1")
          AOT_hence \<open>(u =\<^sub>D u & v' =\<^sub>D v)\<close>
            using 2 by (metis "\<or>E"(2))
          AOT_thus \<open>v' =\<^sub>D v\<close>
            using "&E" by blast
        qed
      }
      moreover {
        AOT_assume 0: \<open>u' =\<^sub>D a\<close>
        AOT_hence u'_eq_a: \<open>u' = a\<close>
          using "discern-obj:19" "vdash-properties:10" by blast
        AOT_have \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=b] "&I"
                            Discernible.GEN "\<rightarrow>I" b_prop[THEN "&E"(1)]
                            b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)])
          AOT_show \<open>[R\<^sub>1]u'b\<close>
            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI)
            apply (rule "\<or>I"(1); rule "\<or>I"(2); rule "&I")
             apply (fact 0)
            using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" ob by blast
        next
          fix v'
          AOT_assume gv'_R1u'v': \<open>[G]v' & [R\<^sub>1]u'v'\<close>
          AOT_hence 0: \<open>[R\<^sub>1]av'\<close>
            using u'_eq_a by (meson "rule=E" "&E"(2))
          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]av'\<close>
            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
          AOT_have \<open>(a \<noteq>\<^sub>D u & v' \<noteq>\<^sub>D v & [R]av') \<or>
                    (a =\<^sub>D a & v' =\<^sub>D b) \<or>
                    (a =\<^sub>D u & v' =\<^sub>D v)\<close>
            using "\<beta>\<rightarrow>C"(1)[OF 1] by simp
          moreover {
            AOT_assume 0: \<open>a \<noteq>\<^sub>D u & v' \<noteq>\<^sub>D v & [R]av'\<close>
            AOT_have \<open>\<exists>!v ([G]v & [R]u'v)\<close>
              using A[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF fu'].
            AOT_hence \<open>\<exists>!v ([G]v & [R]av)\<close>
              using u'_eq_a "rule=E" by fast
            AOT_hence \<open>\<exists>v ([G]v & [R]av & \<forall>t ([G]t & [R]at \<rightarrow> t =\<^sub>D v))\<close>
              using "equi:1"[THEN "\<equiv>E"(1)] by fast
            then AOT_obtain s where
              s_prop: \<open>[G]s & [R]as & \<forall>t ([G]t & [R]at \<rightarrow> t =\<^sub>D s)\<close>
              using "Discernible.\<exists>E"[rotated] by meson
            AOT_have \<open>v' =\<^sub>D s\<close>
              using s_prop[THEN "&E"(2), THEN "Discernible.\<forall>E"]
                    gv'_R1u'v'[THEN "&E"(1)] 0[THEN "&E"(2)]
              by (metis "&I" "vdash-properties:10")
            moreover AOT_have \<open>v =\<^sub>D s\<close>
              using s_prop[THEN "&E"(2), THEN "Discernible.\<forall>E"] gv Rav
              by (metis "&I" "\<rightarrow>E")
            ultimately AOT_have \<open>v' =\<^sub>D v\<close>
              by (meson "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "discern-obj:31"
                  "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" "vdash-properties:10")
            moreover AOT_have \<open>\<not>(v' =\<^sub>D v)\<close>
              using 0[THEN "&E"(1), THEN "&E"(2)]
              by (simp add: "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)")
            ultimately AOT_have \<open>v' =\<^sub>D b\<close>
              by (metis "raa-cor:3")
          }
          moreover {
            AOT_assume \<open>a =\<^sub>D u & v' =\<^sub>D v\<close>
            AOT_hence \<open>v' =\<^sub>D b\<close>
              by (metis "&E"(1) not_a_eq_u "reductio-aa:1")
          }
          ultimately AOT_show \<open>v' =\<^sub>D b\<close>
            by (metis "&E"(2) "\<or>E"(3) "reductio-aa:1") 
        qed
      }
      ultimately AOT_show \<open>\<exists>!v ([G]v & [R\<^sub>1]u'v)\<close>
        by (metis "raa-cor:1")
    next
      fix v'
      AOT_assume gv': \<open>[G]v'\<close>
      {
        AOT_assume not_v'_eq_v: \<open>\<not>(v' =\<^sub>D v)\<close>
               and not_v'_eq_b: \<open>\<not>(v' =\<^sub>D b)\<close>
        AOT_hence v'_noteq_v: \<open>v' \<noteq>\<^sub>D v\<close>
              and v'_noteq_b: \<open>v' \<noteq>\<^sub>D b\<close>
          by (metis "\<equiv>E"(2) "discern-obj:25")+
        AOT_have \<open>\<exists>!u ([F]u & [R]uv')\<close>
          using B[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF gv'].
        AOT_hence \<open>\<exists>u ([F]u & [R]uv' & \<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>D u))\<close>
          using "equi:1"[THEN "\<equiv>E"(1)] by simp
        then AOT_obtain u' where
          u'_prop: \<open>[F]u' & [R]u'v' & \<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>D u')\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        AOT_hence fu': \<open>[F]u'\<close> and Ru'v': \<open>[R]u'v'\<close>
          using "&E" by blast+
        AOT_have not_u'_eq_u: \<open>\<not>u' =\<^sub>D u\<close>
        proof (rule "raa-cor:2")
          AOT_assume \<open>u' =\<^sub>D u\<close>
          AOT_hence \<open>u' = u\<close>
            using "cqt:2"(1) "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "rule=I:1" by blast
          AOT_hence Ruv': \<open>[R]uv'\<close>
            using "rule=E" Ru'v' by fast
          AOT_have \<open>v' =\<^sub>D b\<close>
            using b_unique[OF Discernible.\<psi>, OF gv', OF Ruv'].
          AOT_thus \<open>v' =\<^sub>D b & \<not>v' =\<^sub>D b\<close>
            using not_v'_eq_b "&I" by blast
        qed
        AOT_hence u'_noteq_u: \<open>u' \<noteq>\<^sub>D u\<close>
          by (simp add: "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)")
        AOT_have \<open>\<forall>t ([F]t & [R]tv' \<rightarrow> t =\<^sub>D u')\<close>
          using u'_prop "&E" by blast
        AOT_hence \<open>[F]t & [R]tv' \<rightarrow> t =\<^sub>D u'\<close> for t
          using "Discernible.\<forall>E" by meson
        AOT_hence u'_unique: \<open>t =\<^sub>D u'\<close> if \<open>[F]t\<close> and \<open>[R]tv'\<close> for t
          by (metis "&I" that "\<rightarrow>E")

        AOT_have \<open>[F]u' & [R\<^sub>1]u'v' & \<forall>t ([F]t & [R\<^sub>1]tv' \<rightarrow> t =\<^sub>D u')\<close>
        proof (safe intro!: "&I" gv' R\<^sub>1xy Ru'v' u'_noteq_u Discernible.GEN "\<rightarrow>I"
                            "discern-obj:25"[THEN "\<equiv>E"(2)] not_v'_eq_v fu')
          fix t
          AOT_assume 1: \<open>[F]t & [R\<^sub>1]tv'\<close>
          AOT_have \<open>[R]tv'\<close>
            using Rxy2[OF 1[THEN "&E"(2)], OF v'_noteq_v, OF v'_noteq_b].
          AOT_thus \<open>t =\<^sub>D u'\<close>
            using u'_unique 1[THEN "&E"(1)] by blast
        qed
        AOT_hence \<open>\<exists>u ([F]u & [R\<^sub>1]uv' & \<forall>t ([F]t & [R\<^sub>1]tv' \<rightarrow> t =\<^sub>D u))\<close>
          by (rule "Discernible.\<exists>I")
        AOT_hence \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
          by (rule "equi:1"[THEN "\<equiv>E"(2)])
      }
      moreover {
        AOT_assume 0: \<open>v' =\<^sub>D v\<close>
        AOT_hence u'_eq_u: \<open>v' = v\<close>
          using "discern-obj:19" "vdash-properties:10" by blast
        AOT_have \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "Discernible.\<exists>I"[where \<beta>=u]
                            "&I" Discernible.GEN "\<rightarrow>I" fu)
          AOT_show \<open>[R\<^sub>1]uv'\<close>
            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I" "\<or>I"(2))
            using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Discernible.restricted_var_condition
            apply force
            by (simp add: "0")
        next
          fix u'
          AOT_assume \<open>[F]u' & [R\<^sub>1]u'v'\<close>
          AOT_hence 0: \<open>[R\<^sub>1]u'v\<close>
            using "rule=E"[rotated, OF u'_eq_u] "&E"(2) by fast
          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]u'v\<close>
            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
          AOT_have 2: \<open>(u' \<noteq>\<^sub>D u & v \<noteq>\<^sub>D v & [R]u'v) \<or>
                       (u' =\<^sub>D a & v =\<^sub>D b) \<or>
                       (u' =\<^sub>D u & v =\<^sub>D v)\<close>
            using "\<beta>\<rightarrow>C"(1)[OF 1, simplified] by simp
          AOT_have \<open>\<not>v \<noteq>\<^sub>D v\<close>
            by (metis "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "reductio-aa:2" R\<^sub>1uv Rxy2 not_Ruv not_v_eq_b)
          AOT_hence \<open>\<not>((u' \<noteq>\<^sub>D u & v \<noteq>\<^sub>D v & [R]u'v) \<or> (u' =\<^sub>D a & v =\<^sub>D b))\<close>
            by (metis "&E"(1) "&E"(2) "\<or>E"(3) not_v_eq_b "raa-cor:3")
          AOT_hence \<open>(u' =\<^sub>D u & v =\<^sub>D v)\<close>
            using 2 by (metis "\<or>E"(2))
          AOT_thus \<open>u' =\<^sub>D u\<close>
            using "&E" by blast
        qed
      }
      moreover {
        AOT_assume 0: \<open>v' =\<^sub>D b\<close>
        AOT_hence v'_eq_b: \<open>v' = b\<close>
          using "discern-obj:19" "vdash-properties:10" by blast
        AOT_have \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
        proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=a] "&I"
                            Discernible.GEN "\<rightarrow>I" b_prop[THEN "&E"(1)] oa fa
                            b_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)])
          AOT_show \<open>[R\<^sub>1]av'\<close>
            apply (rule "rule=E"[rotated, OF R\<^sub>1_def[symmetric]])
            apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI)
            apply (rule "\<or>I"(1); rule "\<or>I"(2); rule "&I")
            using oa "discern-obj:30" "\<rightarrow>E" apply blast
            using "0" by blast
        next
          fix u'
          AOT_assume fu'_R1u'v': \<open>[F]u' & [R\<^sub>1]u'v'\<close>
          AOT_hence 0: \<open>[R\<^sub>1]u'b\<close>
            using v'_eq_b by (meson "rule=E" "&E"(2))
          AOT_have 1: \<open>[\<guillemotleft>?R\<guillemotright>]u'b\<close>
            by (rule "rule=E"[rotated, OF R\<^sub>1_def]) (fact 0)
          AOT_have \<open>(u' \<noteq>\<^sub>D u & b \<noteq>\<^sub>D v & [R]u'b) \<or>
                    (u' =\<^sub>D a & b =\<^sub>D b) \<or>
                    (u' =\<^sub>D u & b =\<^sub>D v)\<close>
            using "\<beta>\<rightarrow>C"(1)[OF 1, simplified] by simp
          moreover {
            AOT_assume 0: \<open>u' \<noteq>\<^sub>D u & b \<noteq>\<^sub>D v & [R]u'b\<close>
            AOT_have \<open>\<exists>!u ([F]u & [R]uv')\<close>
              using B[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF gv'].
            AOT_hence \<open>\<exists>!u ([F]u & [R]ub)\<close>
              using v'_eq_b "rule=E" by fast
            AOT_hence \<open>\<exists>u ([F]u & [R]ub & \<forall>t ([F]t & [R]tb \<rightarrow> t =\<^sub>D u))\<close>
              using "equi:1"[THEN "\<equiv>E"(1)] by fast
            then AOT_obtain s where
              s_prop: \<open>[F]s & [R]sb & \<forall>t ([F]t & [R]tb \<rightarrow> t =\<^sub>D s)\<close>
              using "Discernible.\<exists>E"[rotated] by meson
            AOT_have \<open>u' =\<^sub>D s\<close>
              using s_prop[THEN "&E"(2), THEN "Discernible.\<forall>E"]
                    fu'_R1u'v'[THEN "&E"(1)] 0[THEN "&E"(2)]
              by (metis "&I" "\<rightarrow>E")
            moreover AOT_have \<open>u =\<^sub>D s\<close>
              using s_prop[THEN "&E"(2), THEN "Discernible.\<forall>E"] fu Rub
              by (metis "&I" "\<rightarrow>E")
            ultimately AOT_have \<open>u' =\<^sub>D u\<close>
              by (meson "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "discern-obj:31"
                  "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" "vdash-properties:10")
            moreover AOT_have \<open>\<not>(u' =\<^sub>D u)\<close>
              using 0[THEN "&E"(1), THEN "&E"(1)]
              using "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" by blast
            ultimately AOT_have \<open>u' =\<^sub>D a\<close>
              by (metis "raa-cor:3")
          }
          moreover {
            AOT_assume \<open>u' =\<^sub>D u & b =\<^sub>D v\<close>
            AOT_hence \<open>u' =\<^sub>D a\<close>
              by (metis "&E"(2) not_b_eq_v "reductio-aa:1")
          }
          ultimately AOT_show \<open>u' =\<^sub>D a\<close>
            by (metis "&E"(1) "\<or>E"(3) "reductio-aa:1") 
        qed
      }
      ultimately AOT_show \<open>\<exists>!u ([F]u & [R\<^sub>1]uv')\<close>
        by (metis "raa-cor:1")
    qed
    ultimately AOT_have \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
      using 1 by blast
  }
  ultimately AOT_have \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
    using R_prop by (metis "reductio-aa:2") 
  AOT_thus \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
qed

(* TODO: the proof is fixed ad-hoc and can probably be simplified *)
AOT_theorem "P'-eq": \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v & [F]u & [G]v \<rightarrow> F \<approx>\<^sub>D G\<close>
proof(safe intro!: "\<rightarrow>I"; frule "&E"(1); drule "&E"(2);
      frule "&E"(1); drule "&E"(2))
  AOT_have \<open>[\<lambda>z [\<Pi>]z & z \<noteq>\<^sub>D \<kappa>]\<down>\<close> for \<Pi> \<kappa> by "cqt:2[lambda]"
  note \<Pi>_minus_\<kappa>I = "rule-id-df:2:b[2]"[
      where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u:2", simplified, OF "F-u:1"]
   and \<Pi>_minus_\<kappa>E = "rule-id-df:2:a[2]"[
   where \<tau>=\<open>(\<lambda>(\<Pi>, \<kappa>). \<guillemotleft>[\<Pi>]\<^sup>-\<^sup>\<kappa>\<guillemotright>)\<close>, simplified, OF "F-u:2", simplified, OF "F-u:1"]
  AOT_have \<Pi>_minus_\<kappa>_den: \<open>[\<Pi>]\<^sup>-\<^sup>u\<down>\<close> for \<Pi> u
    by (simp add: "F-u:2[den]")

  AOT_assume Gv: \<open>[G]v\<close>
  AOT_assume Fu: \<open>[F]u\<close>
  AOT_assume \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
  AOT_hence \<open>\<exists>R R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  then AOT_obtain R where R_prop: \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence Fact1: \<open>\<forall>r([[F]\<^sup>-\<^sup>u]r \<rightarrow> \<exists>!s ([[G]\<^sup>-\<^sup>v]s & [R]rs))\<close>
        and Fact1': \<open>\<forall>s([[G]\<^sup>-\<^sup>v]s \<rightarrow> \<exists>!r ([[F]\<^sup>-\<^sup>u]r & [R]rs))\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_have \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD [G]\<^sup>-\<^sup>v\<close>
    using "equi-rem-thm"[unvarify F G, OF \<Pi>_minus_\<kappa>_den, OF \<Pi>_minus_\<kappa>_den,
                         THEN "\<equiv>E"(1), OF R_prop].
  AOT_hence \<open>R |: [F]\<^sup>-\<^sup>u \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>D [G]\<^sup>-\<^sup>v & R |: [F]\<^sup>-\<^sup>u \<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD [G]\<^sup>-\<^sup>v\<close>
    using "equi-rem:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence Fact2:
    \<open>\<forall>r\<forall>s\<forall>t(([[F]\<^sup>-\<^sup>u]r & [[F]\<^sup>-\<^sup>u]s & [[G]\<^sup>-\<^sup>v]t) \<rightarrow> ([R]rt & [R]st \<rightarrow> r =\<^sub>D s))\<close>
    using "equi-rem:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast

  let ?R = \<open>\<guillemotleft>[\<lambda>xy ([[F]\<^sup>-\<^sup>u]x & [[G]\<^sup>-\<^sup>v]y & [R]xy) \<or> (x =\<^sub>D u & y =\<^sub>D v)]\<guillemotright>\<close>
  AOT_have R_den: \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close> by "cqt:2[lambda]"

  AOT_show \<open>F \<approx>\<^sub>D G\<close>
  proof(safe intro!: "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<exists>I"(1)[where \<tau>="?R"] R_den
                     "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Discernible.GEN "\<rightarrow>I")
    fix r
    AOT_assume Fr: \<open>[F]r\<close>
    {
      AOT_assume not_r_eq_u: \<open>\<not>(r =\<^sub>D u)\<close>
      AOT_hence r_noteq_u: \<open>r \<noteq> u\<close>
        by (smt (verit, del_insts) "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)"
            "raa-cor:2" "russell-axiom[exe,1].\<psi>_denotes_asm" Discernible.restricted_var_condition)
      AOT_have F_minus_u_r: \<open>[[F]\<^sup>-\<^sup>u]r\<close>
        by(rule \<Pi>_minus_\<kappa>I; safe intro!: "\<beta>\<leftarrow>C"(1) "F-u:1" "cqt:2" "&I" Fr r_noteq_u)
      AOT_hence \<open>\<exists>!s ([[G]\<^sup>-\<^sup>v]s & [R]rs)\<close>
        using Fact1[THEN "\<forall>E"(2)] "\<rightarrow>E" Discernible.\<psi> by blast
      AOT_hence \<open>\<exists>s ([[G]\<^sup>-\<^sup>v]s & [R]rs & \<forall>t ([[G]\<^sup>-\<^sup>v]t & [R]rt \<rightarrow> t =\<^sub>D s))\<close>
        using "equi:1"[THEN "\<equiv>E"(1)] by simp
      then AOT_obtain s where s_prop: \<open>[[G]\<^sup>-\<^sup>v]s & [R]rs & \<forall>t ([[G]\<^sup>-\<^sup>v]t & [R]rt \<rightarrow> t =\<^sub>D s)\<close>
        using "Discernible.\<exists>E"[rotated] by meson
      AOT_hence G_minus_v_s: \<open>[[G]\<^sup>-\<^sup>v]s\<close> and Rrs: \<open>[R]rs\<close>
        using "&E" by blast+
      AOT_have s_unique: \<open>t =\<^sub>D s\<close> if \<open>[[G]\<^sup>-\<^sup>v]t\<close> and \<open>[R]rt\<close> for t
        using s_prop[THEN "&E"(2), THEN "Discernible.\<forall>E", THEN "\<rightarrow>E", OF "&I", OF that].
      AOT_have Gs: \<open>[G]s\<close>
        using "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)" "russell-axiom[exe,1].\<psi>_denotes_asm"
          Discernible.restricted_var_condition G_minus_v_s by blast
      AOT_have s_noteq_v: \<open>s \<noteq>\<^sub>D v\<close>
        by (smt (verit) "=-infix" "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "\<equiv>\<^sub>d\<^sub>fE" "cqt:2"(1)
            "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)"
            "id-eq:1" "raa-cor:6" Discernible.restricted_var_condition G_minus_v_s)
      AOT_have \<open>\<exists>s ([G]s & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([G]t & [\<guillemotleft>?R\<guillemotright>]rt \<rightarrow> t =\<^sub>D s)))\<close>
      proof(safe intro!: "Discernible.\<exists>I"[where \<beta>=s] "&I" Gs Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]rs\<close>
          by (safe intro!: "\<beta>\<leftarrow>C"(1) F_minus_u_r G_minus_v_s Rrs "cqt:2" "&I" prod_denotesI "\<or>I"(1))
      next
        fix t
        AOT_assume 0: \<open>[G]t & [\<guillemotleft>?R\<guillemotright>]rt\<close>
        AOT_hence \<open>([[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt) \<or> (r =\<^sub>D u & t =\<^sub>D v)\<close>
          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
        AOT_hence 1: \<open>[[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt\<close>
          using not_r_eq_u by (metis "&E"(1) "\<or>E"(3) "reductio-aa:1")
        AOT_show \<open>t =\<^sub>D s\<close> using s_unique 1 "&E" by blast
      qed
    }
    moreover {
      AOT_assume r_eq_u: \<open>r =\<^sub>D u\<close>
      AOT_hence r_eq_u': \<open>r = u\<close>
        using "discern-obj:19" "vdash-properties:10" by blast
      AOT_have \<open>\<exists>s ([G]s & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([G]t & [\<guillemotleft>?R\<guillemotright>]rt \<rightarrow> t =\<^sub>D s)))\<close>
      proof(safe intro!: "Discernible.\<exists>I"[where \<beta>=v] "&I" Gv Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]rv\<close>
          by (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI "\<or>I"(2) r_eq_u
                           "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" Discernible.\<psi>)
      next
        fix t
        AOT_assume 0: \<open>[G]t & [\<guillemotleft>?R\<guillemotright>]rt\<close>
        AOT_hence \<open>([[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt) \<or> (r =\<^sub>D u & t =\<^sub>D v)\<close>
          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
        moreover {
          AOT_assume 0: \<open>[[F]\<^sup>-\<^sup>u]r & [[G]\<^sup>-\<^sup>v]t & [R]rt\<close>
          AOT_hence \<open>r \<noteq> u\<close>
            by (meson "F-u:2[equiv]" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "intro-elim:3:a")
          AOT_hence \<open>r = u & \<not>(r = u)\<close>
            using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" r_eq_u' by blast
        }
        ultimately AOT_have \<open>r =\<^sub>D u & t =\<^sub>D v\<close>
          using "con-dis-i-e:4:b" "raa-cor:2" by blast
        AOT_thus \<open>t =\<^sub>D v\<close> using "&E" by blast
      qed
    }
    ultimately AOT_show \<open>\<exists>!s ([G]s & [\<guillemotleft>?R\<guillemotright>]rs)\<close>
      using "reductio-aa:2" "equi:1"[THEN "\<equiv>E"(2)] by fast
  next
    fix s
    AOT_assume Gs: \<open>[G]s\<close>

    {
      AOT_assume not_s_eq_v: \<open>\<not>(s =\<^sub>D v)\<close>
      AOT_hence s_noteq_v: \<open>s \<noteq>\<^sub>D v\<close>
        using "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" by blast
      AOT_hence s_noteq_v': \<open>s \<noteq> v\<close>
        by (meson "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "df-simplify:1" "discern-obj:18" "intro-elim:3:c"
            Discernible.restricted_var_condition not_s_eq_v)
      AOT_have G_minus_v_s: \<open>[[G]\<^sup>-\<^sup>v]s\<close>
        using "F-u:2[equiv]" "df-simplify:1.\<equiv>E(2)" Gs s_noteq_v' by blast
      AOT_hence \<open>\<exists>!r ([[F]\<^sup>-\<^sup>u]r & [R]rs)\<close>
        using Fact1'[THEN "Discernible.\<forall>E"] "\<rightarrow>E" by blast
      AOT_hence \<open>\<exists>r ([[F]\<^sup>-\<^sup>u]r & [R]rs & \<forall>t ([[F]\<^sup>-\<^sup>u]t & [R]ts \<rightarrow> t =\<^sub>D r))\<close>
        using "equi:1"[THEN "\<equiv>E"(1)] by simp
      then AOT_obtain r where
        r_prop: \<open>[[F]\<^sup>-\<^sup>u]r & [R]rs & \<forall>t ([[F]\<^sup>-\<^sup>u]t & [R]ts \<rightarrow> t =\<^sub>D r)\<close>
        using "Discernible.\<exists>E"[rotated] by meson
      AOT_hence F_minus_u_r: \<open>[[F]\<^sup>-\<^sup>u]r\<close> and Rrs: \<open>[R]rs\<close>
        using "&E" by blast+
      AOT_have r_unique: \<open>t =\<^sub>D r\<close> if \<open>[[F]\<^sup>-\<^sup>u]t\<close> and \<open>[R]ts\<close> for t
        using r_prop[THEN "&E"(2), THEN "Discernible.\<forall>E",
                     THEN "\<rightarrow>E", OF "&I", OF that].
      AOT_have Fr: \<open>[F]r\<close>
        using "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)" "russell-axiom[exe,1].\<psi>_denotes_asm"
          Discernible.restricted_var_condition F_minus_u_r by blast
      AOT_have r_noteq_u: \<open>r \<noteq> u\<close>
        using "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "russell-axiom[exe,1].\<psi>_denotes_asm"
          Discernible.restricted_var_condition F_minus_u_r by blast
      AOT_have \<open>\<exists>r ([F]r & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([F]t & [\<guillemotleft>?R\<guillemotright>]ts \<rightarrow> t =\<^sub>D r)))\<close>
      proof(safe intro!: "Discernible.\<exists>I"[where \<beta>=r] "&I" Fr Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]rs\<close>
          by (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I" "\<or>I"(1) F_minus_u_r G_minus_v_s Rrs)
      next
        fix t
        AOT_assume 0: \<open>[F]t & [\<guillemotleft>?R\<guillemotright>]ts\<close>
        AOT_hence \<open>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts) \<or> (t =\<^sub>D u & s =\<^sub>D v)\<close>
          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
        AOT_hence 1: \<open>[[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts\<close>
          using not_s_eq_v by (metis "&E"(2) "\<or>E"(3) "reductio-aa:1")
        AOT_show \<open>t =\<^sub>D r\<close> using r_unique 1 "&E" by blast
      qed
    }
    moreover {
      AOT_assume s_eq_v: \<open>s =\<^sub>D v\<close>
      AOT_have \<open>\<exists>r ([F]r & [\<guillemotleft>?R\<guillemotright>]rs & (\<forall>t ([F]t & [\<guillemotleft>?R\<guillemotright>]ts \<rightarrow> t =\<^sub>D r)))\<close>
      proof(safe intro!: "Discernible.\<exists>I"[where \<beta>=u] "&I" Fu Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]us\<close>
          by (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" prod_denotesI "&I" "\<or>I"(2) s_eq_v)
             (simp add: "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "ex:1:a" "rule-ui:3" Discernible.restricted_var_condition)
      next
        fix t
        AOT_assume 0: \<open>[F]t & [\<guillemotleft>?R\<guillemotright>]ts\<close>
        AOT_hence 1: \<open>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts) \<or> (t =\<^sub>D u & s =\<^sub>D v)\<close>
          using "\<beta>\<rightarrow>C"(1)[OF 0[THEN "&E"(2)], simplified] by blast
        moreover AOT_have \<open>\<not>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts)\<close>
        proof (rule "raa-cor:2")
          AOT_assume \<open>([[F]\<^sup>-\<^sup>u]t & [[G]\<^sup>-\<^sup>v]s & [R]ts)\<close>
          AOT_hence \<open>[[G]\<^sup>-\<^sup>v]s\<close> using "&E" by blast
          AOT_thus \<open>s =\<^sub>D v & \<not>(s =\<^sub>D v)\<close>
            by (meson "=-infix" "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "discern-obj:19"
                "intro-elim:3:a" "modus-tollens:1" "rule-eq-df:1" "russell-axiom[exe,1].\<psi>_denotes_asm" Discernible.restricted_var_condition
                s_eq_v)
        qed
        ultimately AOT_have \<open>t =\<^sub>D u & s =\<^sub>D v\<close>
          by (metis "\<or>E"(2))
        AOT_thus \<open>t =\<^sub>D u\<close> using "&E" by blast
      qed
    }
    ultimately AOT_show \<open>\<exists>!r ([F]r & [\<guillemotleft>?R\<guillemotright>]rs)\<close>
      using "\<equiv>E"(2) "equi:1" "reductio-aa:2" by fast
  qed
qed


AOT_theorem "approx-cont:1": \<open>\<exists>F\<exists>G \<diamond>(F \<approx>\<^sub>D G & \<diamond>\<not>F \<approx>\<^sub>D G)\<close>
proof -
  let ?P = \<open>\<guillemotleft>[\<lambda>x E!x & \<not>\<^bold>\<A>E!x]\<guillemotright>\<close>
  AOT_have \<open>\<diamond>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> by (metis q\<^sub>0_prop)
  AOT_hence 1: \<open>\<diamond>\<exists>x(E!x & \<not>\<^bold>\<A>E!x) & \<diamond>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
    by (rule q\<^sub>0_def[THEN "=\<^sub>d\<^sub>fE"(2), rotated])
       (simp add: "log-prop-prop:2")
  AOT_have \<theta>: \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
    apply (AOT_subst \<open>[\<guillemotleft>?P\<guillemotright>]x\<close> \<open>E!x & \<not>\<^bold>\<A>E!x\<close> for: x)
     apply (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2[lambda]")
    by (fact 1)
  show ?thesis
  proof (rule "\<exists>I"(1))+
    AOT_have \<open>\<diamond>[L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
    proof (rule "&I"; rule "RM\<diamond>"[THEN "\<rightarrow>E"]; (rule "\<rightarrow>I")?)
      AOT_modally_strict {
        AOT_assume A: \<open>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        AOT_show \<open>[L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
        proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "\<rightarrow>E"]
                            "rel-neg-T:3" "&I")
          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close> by "cqt:2[lambda]"
        next
          AOT_show \<open>\<not>\<exists>u [L\<^sup>-]u\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>\<exists>u [L\<^sup>-]u\<close>
            then AOT_obtain u where \<open>[L\<^sup>-]u\<close>
              using "Discernible.\<exists>E"[rotated] by blast
            moreover AOT_have \<open>\<not>[L\<^sup>-]u\<close>
              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
                                        THEN "&E"(2)]
              by (metis "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E")
            ultimately AOT_show \<open>p & \<not>p\<close> for p
              by (metis  "raa-cor:3")
          qed
        next
          AOT_show \<open>\<not>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
            then AOT_obtain u where \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
              using "Discernible.\<exists>E"[rotated] by blast
            AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
              using "&E" by blast
            AOT_hence \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
              by (rule "\<exists>I")
            AOT_thus \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
              using A "&I" by blast
          qed
        qed
      }
    next
      AOT_show \<open>\<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        using \<theta> "&E" by blast
    next
      AOT_modally_strict {
        AOT_assume A: \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        AOT_have B: \<open>\<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [L]\<^sup>-\<close>
        proof (safe intro!: "empty-approx:2"[unvarify F H, THEN "\<rightarrow>E"]
                            "rel-neg-T:3" "&I")
          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
            by "cqt:2[lambda]"
        next
          AOT_obtain x where Px: \<open>[\<guillemotleft>?P\<guillemotright>]x\<close>
            using A "\<exists>E" by blast
          AOT_hence \<open>E!x & \<not>\<^bold>\<A>E!x\<close>
            by (rule "\<beta>\<rightarrow>C"(1))
          AOT_hence 1: \<open>\<diamond>E!x\<close>
            by (metis "T\<diamond>" "&E"(1) "vdash-properties:10")
          AOT_have \<open>[\<lambda>x \<diamond>E!x]x\<close>
            by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" 1)
          AOT_hence \<open>O!x\<close>
            by (rule AOT_ordinary[THEN "=\<^sub>d\<^sub>fI"(2), rotated]) "cqt:2[lambda]"
          AOT_hence \<open>D!x\<close>
            using "\<equiv>E"(2) "\<or>I"(1)
            using "discern-obj:4.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" by blast
          AOT_hence \<open>D!x & [\<guillemotleft>?P\<guillemotright>]x\<close>
            using Px "&I" by blast
          AOT_thus \<open>\<exists>u [\<guillemotleft>?P\<guillemotright>]u\<close>
            by (rule "\<exists>I")
        next
          AOT_show \<open>\<not>\<exists>u [L\<^sup>-]u\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>\<exists>u [L\<^sup>-]u\<close>
            then AOT_obtain u where \<open>[L\<^sup>-]u\<close>
              using "Discernible.\<exists>E"[rotated] by blast
            moreover AOT_have \<open>\<not>[L\<^sup>-]u\<close>
              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]]
              by (metis "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E" "&E"(2))
            ultimately AOT_show \<open>p & \<not>p\<close> for p
              by (metis "raa-cor:3")
          qed
        qed
        AOT_show \<open>\<not>[L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
        proof (rule "raa-cor:2")
          AOT_assume \<open>[L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
          AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [L]\<^sup>-\<close>
            apply (rule "eq-part:2"[unvarify F G, THEN "\<rightarrow>E", rotated 2])
             apply "cqt:2[lambda]"
            by (simp add: "rel-neg-T:3")
          AOT_thus \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [L]\<^sup>- & \<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [L]\<^sup>-\<close>
            using B "&I" by blast
        qed
      }
    next
      AOT_show \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        using \<theta> "&E" by blast
    qed
    AOT_thus \<open>\<diamond>([L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[L]\<^sup>- \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>])\<close>
      using "S5Basic:11" "\<equiv>E"(2) by blast
  next
    AOT_show \<open>[\<lambda>x [E!]x & \<not>\<^bold>\<A>[E!]x]\<down>\<close>
      by "cqt:2"
  next
    AOT_show \<open>[L]\<^sup>-\<down>\<close>
      by (simp add: "rel-neg-T:3")
  qed
qed


AOT_theorem "approx-cont:2":
  \<open>\<exists>F\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
proof -
  let ?P = \<open>\<guillemotleft>[\<lambda>x E!x & \<not>\<^bold>\<A>E!x]\<guillemotright>\<close>
  AOT_have \<open>\<diamond>q\<^sub>0 & \<diamond>\<not>q\<^sub>0\<close> by (metis q\<^sub>0_prop)
  AOT_hence 1: \<open>\<diamond>\<exists>x(E!x & \<not>\<^bold>\<A>E!x) & \<diamond>\<not>\<exists>x(E!x & \<not>\<^bold>\<A>E!x)\<close>
    by (rule q\<^sub>0_def[THEN "=\<^sub>d\<^sub>fE"(2), rotated])
       (simp add: "log-prop-prop:2")
  AOT_have \<theta>: \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
    apply (AOT_subst \<open>[\<guillemotleft>?P\<guillemotright>]x\<close> \<open>E!x & \<not>\<^bold>\<A>E!x\<close> for: x)
     apply (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2")
    by (fact 1)
  show ?thesis
  proof (rule "\<exists>I"(1))+
    AOT_have \<open>\<diamond>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
    proof (rule "&I"; rule "RM\<diamond>"[THEN "\<rightarrow>E"]; (rule "\<rightarrow>I")?)
      AOT_modally_strict {
        AOT_assume A: \<open>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        AOT_show \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
        proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "\<rightarrow>E"]
                            "rel-neg-T:3" "&I")
          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close> by "cqt:2"
        next
          AOT_show \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
            then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
              using "Discernible.\<exists>E"[rotated] by blast
            AOT_hence \<open>\<^bold>\<A>[L\<^sup>-]u\<close>
              using "\<beta>\<rightarrow>C"(1) "&E" by blast
            moreover AOT_have \<open>\<box>\<not>[L\<^sup>-]u\<close>
              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]]
              by (metis RN "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E" "&E"(2))
            ultimately AOT_show \<open>p & \<not>p\<close> for p
              by (metis "Act-Sub:3" "KBasic2:1" "\<equiv>E"(1) "raa-cor:3" "\<rightarrow>E")
          qed
        next
          AOT_show \<open>\<not>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>\<exists>v [\<guillemotleft>?P\<guillemotright>]v\<close>
            then AOT_obtain u where \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
              using "Discernible.\<exists>E"[rotated] by blast
            AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]u\<close>
              using "&E" by blast
            AOT_hence \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
              by (rule "\<exists>I")
            AOT_thus \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x & \<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
              using A "&I" by blast
          qed
        next
          AOT_show \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<down>\<close> by "cqt:2"
        qed
      }
    next
      AOT_show \<open>\<diamond>\<not>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close> using \<theta> "&E" by blast
    next
      AOT_modally_strict {
        AOT_assume A: \<open>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        AOT_have B: \<open>\<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<close>
        proof (safe intro!: "empty-approx:2"[unvarify F H, THEN "\<rightarrow>E"]
                            "rel-neg-T:3" "&I")
          AOT_show \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close> by "cqt:2"
        next
          AOT_obtain x where Px: \<open>[\<guillemotleft>?P\<guillemotright>]x\<close>
            using A "\<exists>E" by blast
          AOT_hence \<open>E!x & \<not>\<^bold>\<A>E!x\<close>
            by (rule "\<beta>\<rightarrow>C"(1))
          AOT_hence \<open>\<diamond>E!x\<close>
            by (metis "T\<diamond>" "&E"(1) "\<rightarrow>E")
          AOT_hence \<open>[\<lambda>x \<diamond>E!x]x\<close>
            by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
          AOT_hence \<open>O!x\<close>
            by (rule AOT_ordinary[THEN "=\<^sub>d\<^sub>fI"(2), rotated]) "cqt:2"
          AOT_hence \<open>D!x\<close>
            by (simp add: "discern-obj:4.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm")
          AOT_hence \<open>D!x & [\<guillemotleft>?P\<guillemotright>]x\<close>
            using Px "&I" by blast
          AOT_thus \<open>\<exists>u [\<guillemotleft>?P\<guillemotright>]u\<close>
            by (rule "\<exists>I")
        next
          AOT_show \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
          proof (rule "raa-cor:2")
            AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
            then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]u\<close>
              using "Discernible.\<exists>E"[rotated] by blast
            AOT_hence \<open>\<^bold>\<A>[L\<^sup>-]u\<close>
              using "\<beta>\<rightarrow>C"(1) "&E" by blast
            moreover AOT_have \<open>\<box>\<not>[L\<^sup>-]u\<close>
              using "thm-noncont-e-e:2"[THEN "contingent-properties:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"]]
              by (metis RN "qml:2"[axiom_inst] "rule-ui:3" "\<rightarrow>E" "&E"(2))
            ultimately AOT_show \<open>p & \<not>p\<close> for p
              by (metis "Act-Sub:3" "KBasic2:1" "\<equiv>E"(1) "raa-cor:3" "\<rightarrow>E")
          qed
        next
          AOT_show \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<down>\<close> by "cqt:2"
        qed
        AOT_show \<open>\<not>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
        proof (rule "raa-cor:2")
          AOT_assume \<open>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>]\<close>
          AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<close>
            by (rule "eq-part:2"[unvarify F G, THEN "\<rightarrow>E", rotated 2])
               "cqt:2"+
          AOT_thus \<open>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[L\<^sup>-]z] & \<not>[\<guillemotleft>?P\<guillemotright>] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[L\<^sup>-]z]\<close>
            using B "&I" by blast
        qed
      }
    next
      AOT_show \<open>\<diamond>\<exists>x [\<guillemotleft>?P\<guillemotright>]x\<close>
        using \<theta> "&E" by blast
    qed
    AOT_thus \<open>\<diamond>([\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>] & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[L\<^sup>-]z] \<approx>\<^sub>D [\<guillemotleft>?P\<guillemotright>])\<close>
      using "S5Basic:11" "\<equiv>E"(2) by blast
  next
    AOT_show \<open>[\<lambda>x [E!]x & \<not>\<^bold>\<A>[E!]x]\<down>\<close> by "cqt:2"
  next
    AOT_show \<open>[L]\<^sup>-\<down>\<close>
      by (simp add: "rel-neg-T:3")
  qed
qed

AOT_define eqD :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (infixl \<open>\<equiv>\<^sub>D\<close> 50)
  \<open>F \<equiv>\<^sub>D G \<equiv>\<^sub>d\<^sub>f F\<down> & G\<down> & \<forall>u ([F]u \<equiv> [G]u)\<close>

AOT_theorem "apE-eqE:1": \<open>F \<equiv>\<^sub>D G \<rightarrow> F \<approx>\<^sub>D G\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 0: \<open>F \<equiv>\<^sub>D G\<close>
  AOT_have \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
  proof (safe intro!: "\<exists>I"(1)[where \<tau>="\<guillemotleft>(=\<^sub>D)\<guillemotright>"] "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
                      "=D[denotes]" "cqt:2[const_var]"[axiom_inst] Discernible.GEN
                      "\<rightarrow>I" "equi:1"[THEN "\<equiv>E"(2)])
    fix u
    AOT_assume Fu: \<open>[F]u\<close>
    AOT_hence Gu: \<open>[G]u\<close>
      using "\<equiv>\<^sub>d\<^sub>fE"[OF eqD, OF 0, THEN "&E"(2),
                   THEN "Discernible.\<forall>E"[where \<alpha>=u], THEN "\<equiv>E"(1)]
            Discernible.\<psi> Fu by blast
    moreover AOT_have Du: \<open>D!u\<close>
      by (simp add: Discernible.restricted_var_condition)
    ultimately AOT_have \<open>[G]u & u =\<^sub>D u & \<forall>v' ([G]v' & u =\<^sub>D v' \<rightarrow> v' =\<^sub>D u)\<close>
      by (metis (no_types, lifting) "con-dis-i-e:1" "con-dis-i-e:2:b" "deduction-theorem" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E"
          "discern-obj:31.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" "universal-cor")
    AOT_thus \<open>\<exists>v ([G]v & u =\<^sub>D v & \<forall>v' ([G]v' & u =\<^sub>D v' \<rightarrow> v' =\<^sub>D v))\<close>
      by (meson "con-dis-i-e:1" "existential:1" "russell-axiom[exe,1].\<psi>_denotes_asm" Du)
  next
    fix v
    AOT_assume Gv: \<open>[G]v\<close>
    AOT_hence Fv: \<open>[F]v\<close>
      using "\<equiv>\<^sub>d\<^sub>fE"[OF eqD, OF 0, THEN "&E"(2),
                   THEN "Discernible.\<forall>E"[where \<alpha>=v], THEN "\<equiv>E"(2)]
            Discernible.\<psi> Gv by blast
    AOT_hence \<open>([F]v & v =\<^sub>D v & \<forall>v' ([F]v' & v' =\<^sub>D v \<rightarrow> v' =\<^sub>D v))\<close>
      by (simp add: "con-dis-i-e:1" "con-dis-taut:2" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm"
          "universal-cor" "vdash-properties:9" Discernible.restricted_var_condition)
    AOT_thus \<open>\<exists>u ([F]u & u =\<^sub>D v & \<forall>v' ([F]v' & v' =\<^sub>D v \<rightarrow> v' =\<^sub>D u))\<close>
      by (meson "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:1" "russell-axiom[exe,1].\<psi>_denotes_asm" Discernible.restricted_var_condition)
  qed
  AOT_thus \<open>F \<approx>\<^sub>D G\<close>
    by (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
qed

AOT_theorem "apE-eqE:2": \<open>(F \<approx>\<^sub>D G & G \<equiv>\<^sub>D H) \<rightarrow> F \<approx>\<^sub>D H\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>F \<approx>\<^sub>D G & G \<equiv>\<^sub>D H\<close>
  AOT_hence \<open>F \<approx>\<^sub>D G\<close> and \<open>G \<approx>\<^sub>D H\<close>
    using "apE-eqE:1"[THEN "\<rightarrow>E"] "&E" by blast+
  AOT_thus \<open>F \<approx>\<^sub>D H\<close>
    by (metis Adjunction "eq-part:3" "vdash-properties:10")
qed


AOT_act_theorem "eq-part-act:1": \<open>[\<lambda>z \<^bold>\<A>[F]z] \<equiv>\<^sub>D F\<close>
proof (safe intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Discernible.GEN "\<rightarrow>I")
  fix u
  AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]u \<equiv> \<^bold>\<A>[F]u\<close>
    by (rule "beta-C-meta"[THEN "\<rightarrow>E"]) "cqt:2[lambda]"
  also AOT_have \<open>\<dots> \<equiv> [F]u\<close>
    using "act-conj-act:4" "logic-actual"[act_axiom_inst, THEN "\<rightarrow>E"] by blast
  finally AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]u \<equiv> [F]u\<close>.
qed

AOT_act_theorem "eq-part-act:2": \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D F\<close>
  by (safe intro!: "apE-eqE:1"[unvarify F, THEN "\<rightarrow>E"] "eq-part-act:1") "cqt:2"


AOT_theorem "actuallyF:1": \<open>\<^bold>\<A>(F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z])\<close>
proof -
  AOT_have 1: \<open>\<^bold>\<A>([F]x \<equiv> \<^bold>\<A>[F]x)\<close> for x
    by (meson "Act-Basic:5" "act-conj-act:4" "\<equiv>E"(2) "Commutativity of \<equiv>")
  AOT_have \<open>\<^bold>\<A>([F]x \<equiv> [\<lambda>z \<^bold>\<A>[F]z]x)\<close> for x
    apply (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close> \<open>\<^bold>\<A>[F]x\<close>)
     apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
     apply "cqt:2[lambda]"
    by (fact 1)
  AOT_hence \<open>D!x \<rightarrow> \<^bold>\<A>([F]x \<equiv> [\<lambda>z \<^bold>\<A>[F]z]x)\<close> for x
    by (metis "\<rightarrow>I") 
  AOT_hence \<open>\<forall>u \<^bold>\<A>([F]u \<equiv> [\<lambda>z \<^bold>\<A>[F]z]u)\<close>
    using "\<forall>I" by fast
  AOT_hence 1: \<open>\<^bold>\<A>\<forall>u ([F]u \<equiv> [\<lambda>z \<^bold>\<A>[F]z]u)\<close>
    by (metis "Discernible.res-var-bound-reas[2]" "\<rightarrow>E")
  AOT_modally_strict {
    AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> by "cqt:2"
  } note 2 = this
  AOT_have \<open>\<^bold>\<A>(F \<equiv>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z])\<close>
    apply (AOT_subst \<open>F \<equiv>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z]\<close> \<open>\<forall>u ([F]u \<equiv> [\<lambda>z \<^bold>\<A>[F]z]u)\<close>)
    using eqD[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I",
              OF "cqt:2[const_var]"[axiom_inst], OF 2]
    by (auto simp: 1)
  moreover AOT_have \<open>\<^bold>\<A>(F \<equiv>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z] \<rightarrow> F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z])\<close>
    using "apE-eqE:1"[unvarify G, THEN "RA[2]", OF 2] by metis
  ultimately AOT_show \<open>\<^bold>\<A>F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z]\<close>
    by (metis "act-cond" "\<rightarrow>E")
qed

AOT_theorem "actuallyF:2": \<open>Rigid([\<lambda>z \<^bold>\<A>[F]z])\<close>
proof(safe intro!: GEN "\<rightarrow>I" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I")
  AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> by "cqt:2"
next
  AOT_show \<open>\<box>\<forall>x ([\<lambda>z \<^bold>\<A>[F]z]x \<rightarrow> \<box>[\<lambda>z \<^bold>\<A>[F]z]x)\<close>
  proof(rule RN; rule GEN; rule "\<rightarrow>I")
    AOT_modally_strict {
      fix x
      AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close>
      AOT_hence \<open>\<^bold>\<A>[F]x\<close>
        by (rule "\<beta>\<rightarrow>C"(1))
      AOT_hence 1: \<open>\<box>\<^bold>\<A>[F]x\<close> by (metis "Act-Basic:6" "\<equiv>E"(1))
      AOT_show \<open>\<box>[\<lambda>z \<^bold>\<A>[F]z]x\<close>
        apply (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close> \<open>\<^bold>\<A>[F]x\<close>)
         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
         apply "cqt:2[lambda]"
        by (fact 1)
    }
  qed
qed

AOT_theorem "approx-nec:1": \<open>Rigid(F) \<rightarrow> F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z]\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>Rigid([F])\<close>
  AOT_hence A: \<open>\<box>\<forall>x ([F]x \<rightarrow> \<box>[F]x)\<close>
    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast
  AOT_hence 0: \<open>\<forall>x \<box>([F]x \<rightarrow> \<box>[F]x)\<close>
    using CBF[THEN "\<rightarrow>E"] by blast
  AOT_hence 1: \<open>\<forall>x ([F]x \<rightarrow> \<box>[F]x)\<close>
    using A "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
  AOT_have act_F_den: \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close>
    by "cqt:2"
  AOT_show \<open>F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z]\<close>
  proof (safe intro!: "apE-eqE:1"[unvarify G, THEN "\<rightarrow>E"] eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
                      "cqt:2" act_F_den Discernible.GEN "\<rightarrow>I" "\<equiv>I")
    fix u
    AOT_assume \<open>[F]u\<close>
    AOT_hence \<open>\<box>[F]u\<close>
      using 1[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
    AOT_hence act_F_u: \<open>\<^bold>\<A>[F]u\<close>
      by (metis "nec-imp-act" "\<rightarrow>E")
    AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" act_F_u)
  next
    fix u
    AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
      by (rule "\<beta>\<rightarrow>C"(1))
    AOT_thus \<open>[F]u\<close>
      using 0[THEN "\<forall>E"(2)]
      by (metis "\<equiv>E"(1) "sc-eq-fur:2" "\<rightarrow>E")
  qed
qed


AOT_theorem "approx-nec:2":
  \<open>F \<approx>\<^sub>D G \<equiv> \<forall>H ([\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D G)\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume 0: \<open>F \<approx>\<^sub>D G\<close>
  AOT_assume 0: \<open>F \<approx>\<^sub>D G\<close>
  AOT_hence \<open>\<forall>H (H \<approx>\<^sub>D F \<equiv> H \<approx>\<^sub>D G)\<close>
    using "eq-part:4"[THEN "\<equiv>E"(1), OF 0] by blast
  AOT_have \<open>[\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D G\<close> for H
    by (rule "\<forall>E"(1)[OF "eq-part:4"[THEN "\<equiv>E"(1), OF 0]]) "cqt:2"
  AOT_thus \<open>\<forall>H ([\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D G)\<close>
    by (rule GEN)
next
  AOT_assume 0: \<open>\<forall>H ([\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D F \<equiv> [\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D G)\<close>
  AOT_obtain H where \<open>Rigidifies(H,F)\<close>
    using "rigid-der:3" "\<exists>E" by metis
  AOT_hence H: \<open>Rigid(H) & \<forall>x ([H]x \<equiv> [F]x)\<close>
    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_have H_rigid: \<open>\<box>\<forall>x ([H]x \<rightarrow> \<box>[H]x)\<close>
    using H[THEN "&E"(1), THEN "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)].
  AOT_hence \<open>\<forall>x \<box>([H]x \<rightarrow> \<box>[H]x)\<close>
    using "CBF" "vdash-properties:10" by blast
  AOT_hence \<open>\<box>([H]x \<rightarrow> \<box>[H]x)\<close> for x using "\<forall>E"(2) by blast
  AOT_hence rigid: \<open>[H]x \<equiv> \<^bold>\<A>[H]x\<close> for x
     by (metis "\<equiv>E"(6) "oth-class-taut:3:a" "sc-eq-fur:2" "\<rightarrow>E")
  AOT_have \<open>H \<equiv>\<^sub>D F\<close>
  proof (safe intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Discernible.GEN "\<rightarrow>I")
    AOT_show \<open>[H]u \<equiv> [F]u\<close> for u using H[THEN "&E"(2)] "\<forall>E"(2) by fast
  qed
  AOT_hence \<open>H \<approx>\<^sub>D F\<close>
    by (rule "apE-eqE:2"[THEN "\<rightarrow>E", OF "&I", rotated])
       (simp add: "eq-part:1")
  AOT_hence F_approx_H: \<open>F \<approx>\<^sub>D H\<close>
    by (metis "eq-part:2" "\<rightarrow>E")
  moreover AOT_have H_eq_act_H: \<open>H \<equiv>\<^sub>D [\<lambda>z \<^bold>\<A>[H]z]\<close>
  proof (safe intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Discernible.GEN "\<rightarrow>I")
    AOT_show \<open>[H]u \<equiv> [\<lambda>z \<^bold>\<A>[H]z]u\<close> for u
      apply (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[H]z]u\<close> \<open>\<^bold>\<A>[H]u\<close>)
       apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
       apply "cqt:2[lambda]"
      using rigid by blast
  qed
  AOT_have a: \<open>F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[H]z]\<close>
    apply (rule "apE-eqE:2"[unvarify H, THEN "\<rightarrow>E"])
     apply "cqt:2[lambda]"
    using F_approx_H H_eq_act_H "&I" by blast
  AOT_hence \<open>[\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D F\<close>
    apply (rule "eq-part:2"[unvarify G, THEN "\<rightarrow>E", rotated])
    by "cqt:2[lambda]"
  AOT_hence b: \<open>[\<lambda>z \<^bold>\<A>[H]z] \<approx>\<^sub>D G\<close>
    by (rule 0[THEN "\<forall>E"(1), THEN "\<equiv>E"(1), rotated]) "cqt:2" 
  AOT_show \<open>F \<approx>\<^sub>D G\<close>
    by (rule "eq-part:3"[unvarify G, THEN "\<rightarrow>E", rotated, OF "&I", OF a, OF b])
       "cqt:2"
qed

AOT_theorem "approx-nec:3":
  \<open>(Rigid(F) & Rigid(G)) \<rightarrow> \<box>(F \<approx>\<^sub>D G \<rightarrow> \<box>F \<approx>\<^sub>D G)\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>Rigid(F) & Rigid(G)\<close>
  AOT_hence \<open>\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x)\<close> and \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] "&E" by blast+
  AOT_hence \<open>\<box>(\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x) & \<box>\<forall>x([G]x \<rightarrow> \<box>[G]x))\<close>
    using "KBasic:3" "4" "&I" "\<equiv>E"(2) "vdash-properties:10" by meson
  moreover AOT_have \<open>\<box>(\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x) & \<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)) \<rightarrow>
                     \<box>(F \<approx>\<^sub>D G \<rightarrow> \<box>F \<approx>\<^sub>D G)\<close>
  proof(rule RM; rule "\<rightarrow>I"; rule "\<rightarrow>I")
    AOT_modally_strict {
      AOT_assume \<open>\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x) & \<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
      AOT_hence \<open>\<box>\<forall>x([F]x \<rightarrow> \<box>[F]x)\<close> and \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
        using "&E" by blast+
      AOT_hence \<open>\<forall>x\<box>([F]x \<rightarrow> \<box>[F]x)\<close> and \<open>\<forall>x\<box>([G]x \<rightarrow> \<box>[G]x)\<close>
        using CBF[THEN "\<rightarrow>E"] by blast+
      AOT_hence F_nec: \<open>\<box>([F]x \<rightarrow> \<box>[F]x)\<close>
            and G_nec: \<open>\<box>([G]x \<rightarrow> \<box>[G]x)\<close> for x
        using "\<forall>E"(2) by blast+
      AOT_assume \<open>F \<approx>\<^sub>D G\<close>
      AOT_hence \<open>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
        by (metis "\<equiv>\<^sub>d\<^sub>fE" "equi:3")
      then AOT_obtain R where \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
        using "\<exists>E"[rotated] by blast
      AOT_hence C1: \<open>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close>
            and C2: \<open>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
        using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
      AOT_obtain R' where \<open>Rigidifies(R', R)\<close>
        using "rigid-der:3" "\<exists>E"[rotated] by blast
      AOT_hence 1: \<open>Rigid(R') & \<forall>x\<^sub>1...\<forall>x\<^sub>n ([R']x\<^sub>1...x\<^sub>n \<equiv> [R]x\<^sub>1...x\<^sub>n)\<close>
        using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
      AOT_hence \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R']x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R']x\<^sub>1...x\<^sub>n)\<close>
        using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
      AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n (\<diamond>[R']x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R']x\<^sub>1...x\<^sub>n)\<close>
        using "\<equiv>E"(1) "rigid-rel-thms:1" by blast
      AOT_hence D: \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 (\<diamond>[R']x\<^sub>1x\<^sub>2 \<rightarrow> \<box>[R']x\<^sub>1x\<^sub>2)\<close>
        using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
      AOT_have E: \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 ([R']x\<^sub>1x\<^sub>2 \<equiv> [R]x\<^sub>1x\<^sub>2)\<close>
        using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 1[THEN "&E"(2)]] by blast
      AOT_have \<open>\<forall>u \<box>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
           and \<open>\<forall>v \<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
      proof (safe intro!: Discernible.GEN "\<rightarrow>I")
        fix u
        AOT_show \<open>\<box>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
        proof (rule "raa-cor:1")
          AOT_assume \<open>\<not>\<box>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
          AOT_hence 1: \<open>\<diamond>\<not>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
            using "KBasic:11" "\<equiv>E"(1) by blast
          AOT_have \<open>\<diamond>([F]u & \<not>\<exists>!v ([G]v & [R']uv))\<close>
            apply (AOT_subst \<open>[F]u & \<not>\<exists>!v ([G]v & [R']uv)\<close>
                             \<open>\<not>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>)
             apply (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
            by (fact 1)
          AOT_hence A: \<open>\<diamond>[F]u & \<diamond>\<not>\<exists>!v ([G]v & [R']uv)\<close>
            using "KBasic2:3" "\<rightarrow>E" by blast
          AOT_hence \<open>\<box>[F]u\<close>
            using F_nec "&E"(1) "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E" by blast
          AOT_hence \<open>[F]u\<close>
            by (metis "qml:2"[axiom_inst] "\<rightarrow>E")
          AOT_hence \<open>\<exists>!v ([G]v & [R]uv)\<close>
            using C1[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E"] by blast
          AOT_hence \<open>\<exists>v ([G]v & [R]uv & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>D v))\<close>
            using "equi:1"[THEN "\<equiv>E"(1)] by auto
          then AOT_obtain a where
            a_prop: \<open>D!a & ([G]a & [R]ua & \<forall>v' ([G]v' & [R]uv' \<rightarrow> v' =\<^sub>D a))\<close>
            using "\<exists>E"[rotated] by blast
          AOT_have \<open>\<exists>v \<box>([G]v & [R']uv & \<forall>v' ([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D v))\<close>
          proof(safe intro!: "\<exists>I"(2)[where \<beta>=a] "&I" a_prop[THEN "&E"(1)]
                             "KBasic:3"[THEN "\<equiv>E"(2)])
            AOT_show \<open>\<box>[G]a\<close>
              using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
              by (metis G_nec "qml:2"[axiom_inst] "\<rightarrow>E")
          next
            AOT_show \<open>\<box>[R']ua\<close>
              using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
                    E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2),
                      OF a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]]
              by (metis "T\<diamond>" "\<rightarrow>E")
          next
            AOT_have \<open>\<forall>v' \<box>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D a)\<close>
            proof (rule Discernible.GEN; rule "raa-cor:1")
              fix v'
              AOT_assume \<open>\<not>\<box>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D a)\<close>
              AOT_hence \<open>\<diamond>\<not>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D a)\<close>
                by (metis "KBasic:11" "\<equiv>E"(1))
              AOT_hence \<open>\<diamond>([G]v' & [R']uv' & \<not>v' =\<^sub>D a)\<close>
                by (AOT_subst \<open>[G]v' & [R']uv' & \<not>v' =\<^sub>D a\<close>
                              \<open>\<not>([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D a)\<close>)
                   (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
              AOT_hence 1: \<open>\<diamond>[G]v'\<close> and 2: \<open>\<diamond>[R']uv'\<close> and 3: \<open>\<diamond>\<not>v' =\<^sub>D a\<close>
                using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)]
                      "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast+
              AOT_have Gv': \<open>[G]v'\<close> using G_nec 1
                by (meson "B\<diamond>" "KBasic:13" "\<rightarrow>E")
              AOT_have \<open>\<box>[R']uv'\<close>
                using 2 D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
              AOT_hence R'uv': \<open>[R']uv'\<close>
                by (metis "B\<diamond>" "T\<diamond>" "\<rightarrow>E") 
              AOT_hence \<open>[R]uv'\<close>
                using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
              AOT_hence \<open>v' =\<^sub>D a\<close>
                using a_prop[THEN "&E"(2), THEN "&E"(2), THEN "Discernible.\<forall>E",
                             THEN "\<rightarrow>E", OF "&I", OF Gv'] by blast
              AOT_hence \<open>\<box>(v' =\<^sub>D a)\<close>
                using "cqt:2"(1) "discern-obj:21.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" by blast
              moreover AOT_have \<open>\<not>\<box>(v' =\<^sub>D a)\<close>
                using 3 "KBasic:11" "\<equiv>E"(2) by blast
              ultimately AOT_show \<open>\<box>(v' =\<^sub>D a) & \<not>\<box>(v' =\<^sub>D a)\<close>
                using "&I" by blast
            qed
            AOT_thus \<open>\<box>\<forall>v'([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D a)\<close>
              using "Discernible.res-var-bound-reas[BF]" "\<rightarrow>E" by fast
          qed
          AOT_hence \<open>\<box>\<exists>v ([G]v & [R']uv & \<forall>v' ([G]v' & [R']uv' \<rightarrow> v' =\<^sub>D v))\<close>
            using "Discernible.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
          AOT_hence \<open>\<box>\<exists>!v ([G]v & [R']uv)\<close>
            by (AOT_subst_thm "equi:1")
          moreover AOT_have \<open>\<not>\<box>\<exists>!v ([G]v & [R']uv)\<close>
            using A[THEN "&E"(2)] "KBasic:11"[THEN "\<equiv>E"(2)] by blast
          ultimately AOT_show \<open>\<box>\<exists>!v ([G]v & [R']uv) & \<not>\<box>\<exists>!v ([G]v & [R']uv)\<close>
            by (rule "&I")
        qed
      next
        fix v
        AOT_show \<open>\<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
        proof (rule "raa-cor:1")
          AOT_assume \<open>\<not>\<box>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
          AOT_hence 1: \<open>\<diamond>\<not>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
            using "KBasic:11" "\<equiv>E"(1) by blast
          AOT_hence \<open>\<diamond>([G]v & \<not>\<exists>!u ([F]u & [R']uv))\<close>
            by (AOT_subst \<open>[G]v & \<not>\<exists>!u ([F]u & [R']uv)\<close>
                          \<open>\<not>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>)
               (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
          AOT_hence A: \<open>\<diamond>[G]v & \<diamond>\<not>\<exists>!u ([F]u & [R']uv)\<close>
            using "KBasic2:3" "\<rightarrow>E" by blast
          AOT_hence \<open>\<box>[G]v\<close>
            using G_nec "&E"(1) "\<equiv>E"(1) "sc-eq-box-box:1" "\<rightarrow>E" by blast
          AOT_hence \<open>[G]v\<close> by (metis "qml:2"[axiom_inst] "\<rightarrow>E")
          AOT_hence \<open>\<exists>!u ([F]u & [R]uv)\<close>
            using C2[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E"] by blast
          AOT_hence \<open>\<exists>u ([F]u & [R]uv & \<forall>u' ([F]u' & [R]u'v \<rightarrow> u' =\<^sub>D u))\<close>
            using "equi:1"[THEN "\<equiv>E"(1)] by auto
          then AOT_obtain a where
              a_prop: \<open>D!a & ([F]a & [R]av & \<forall>u' ([F]u' & [R]u'v \<rightarrow> u' =\<^sub>D a))\<close>
            using "\<exists>E"[rotated] by blast
          AOT_have \<open>\<exists>u \<box>([F]u & [R']uv & \<forall>u' ([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D u))\<close>
          proof(safe intro!: "\<exists>I"(2)[where \<beta>=a] "&I" a_prop[THEN "&E"(1)]
                             "KBasic:3"[THEN "\<equiv>E"(2)])
            AOT_show \<open>\<box>[F]a\<close>
              using a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(1)]
              by (metis F_nec "qml:2"[axiom_inst] "\<rightarrow>E")
          next
            AOT_show \<open>\<box>[R']av\<close>
              using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
                    E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2),
                      OF a_prop[THEN "&E"(2), THEN "&E"(1), THEN "&E"(2)]]
              by (metis "T\<diamond>" "\<rightarrow>E")
          next
            AOT_have \<open>\<forall>u' \<box>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D a)\<close>
            proof (rule Discernible.GEN; rule "raa-cor:1")
              fix u'
              AOT_assume \<open>\<not>\<box>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D a)\<close>
              AOT_hence \<open>\<diamond>\<not>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D a)\<close>
                by (metis "KBasic:11" "\<equiv>E"(1))
              AOT_hence \<open>\<diamond>([F]u' & [R']u'v & \<not>u' =\<^sub>D a)\<close>
                by (AOT_subst \<open>[F]u' & [R']u'v & \<not>u' =\<^sub>D a\<close>
                              \<open>\<not>([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D a)\<close>)
                   (meson "\<equiv>E"(6) "oth-class-taut:1:b" "oth-class-taut:3:a")
              AOT_hence 1: \<open>\<diamond>[F]u'\<close> and 2: \<open>\<diamond>[R']u'v\<close> and 3: \<open>\<diamond>\<not>u' =\<^sub>D a\<close>
                using "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(1)]
                      "KBasic2:3"[THEN "\<rightarrow>E", THEN "&E"(2)] by blast+
              AOT_have Fu': \<open>[F]u'\<close> using F_nec 1
                by (meson "B\<diamond>" "KBasic:13" "\<rightarrow>E")
              AOT_have \<open>\<box>[R']u'v\<close>
                using 2 D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
              AOT_hence R'u'v: \<open>[R']u'v\<close>
                by (metis "B\<diamond>" "T\<diamond>" "\<rightarrow>E") 
              AOT_hence \<open>[R]u'v\<close>
                using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
              AOT_hence \<open>u' =\<^sub>D a\<close>
                using a_prop[THEN "&E"(2), THEN "&E"(2), THEN "Discernible.\<forall>E",
                             THEN "\<rightarrow>E", OF "&I", OF Fu'] by blast
              AOT_hence \<open>\<box>(u' =\<^sub>D a)\<close>
                by (simp add: "cqt:2"(1) "discern-obj:21.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)")
              moreover AOT_have \<open>\<not>\<box>(u' =\<^sub>D a)\<close>
                using 3 "KBasic:11" "\<equiv>E"(2) by blast
              ultimately AOT_show \<open>\<box>(u' =\<^sub>D a) & \<not>\<box>(u' =\<^sub>D a)\<close>
                using "&I" by blast
            qed
            AOT_thus \<open>\<box>\<forall>u'([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D a)\<close>
              using "Discernible.res-var-bound-reas[BF]" "\<rightarrow>E" by fast
          qed
          AOT_hence 1: \<open>\<box>\<exists>u ([F]u & [R']uv & \<forall>u' ([F]u' & [R']u'v \<rightarrow> u' =\<^sub>D u))\<close>
            using "Discernible.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
          AOT_hence \<open>\<box>\<exists>!u ([F]u & [R']uv)\<close>
            by (AOT_subst_thm "equi:1")
          moreover AOT_have \<open>\<not>\<box>\<exists>!u ([F]u & [R']uv)\<close>
            using A[THEN "&E"(2)] "KBasic:11"[THEN "\<equiv>E"(2)] by blast
          ultimately AOT_show \<open>\<box>\<exists>!u ([F]u & [R']uv) & \<not>\<box>\<exists>!u ([F]u & [R']uv)\<close>
            by (rule "&I")
        qed
      qed
      AOT_hence \<open>\<box>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
            and \<open>\<box>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
        using "Discernible.res-var-bound-reas[BF]"[THEN "\<rightarrow>E"] by auto
      moreover AOT_have \<open>\<box>[R']\<down>\<close> and \<open>\<box>[F]\<down>\<close> and \<open>\<box>[G]\<down>\<close>
        by (simp_all add: "ex:2:a")
      ultimately AOT_have \<open>\<box>([R']\<down> & [F]\<down> & [G]\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv)) &
                                                   \<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv)))\<close>
        using "KBasic:3" "&I" "\<equiv>E"(2) by meson
      AOT_hence \<open>\<box>R' |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
        by (AOT_subst_def "equi:2")
      AOT_hence \<open>\<exists>R \<box>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
        by (rule "\<exists>I"(2))
      AOT_hence \<open>\<box>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
        by (metis Buridan "\<rightarrow>E")
      AOT_thus \<open>\<box>F \<approx>\<^sub>D G\<close>
        by (AOT_subst_def "equi:3")
    }
  qed
  ultimately AOT_show \<open>\<box>(F \<approx>\<^sub>D G \<rightarrow> \<box>F \<approx>\<^sub>D G)\<close>
    using "\<rightarrow>E" by blast
qed


AOT_define numbers :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Numbers'(_,_')\<close>)
  \<open>Numbers(x,G) \<equiv>\<^sub>d\<^sub>f A!x & G\<down> & \<forall>F(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>

AOT_theorem "numbers[den]":
  \<open>\<Pi>\<down> \<rightarrow> (Numbers(\<kappa>, \<Pi>) \<equiv> A!\<kappa> & \<forall>F(\<kappa>[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D \<Pi>))\<close>
  apply (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "\<equiv>I" "\<rightarrow>I" "cqt:2"
               dest!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"])
  using "&E" by blast+

AOT_theorem "num:1": \<open>\<exists>x Numbers(x,G)\<close>
  by (AOT_subst \<open>Numbers(x,G)\<close> \<open>[A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close> for: x)
     (auto simp: "numbers[den]"[THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst]]
                 "A-objects"[axiom_inst])

AOT_theorem "num:2": \<open>\<exists>!x Numbers(x,G)\<close>
  by (AOT_subst \<open>Numbers(x,G)\<close> \<open>[A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close> for: x)
     (auto simp: "numbers[den]"[THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst]]
                 "A-objects!")


AOT_theorem "num-tran:1":
  \<open>G \<approx>\<^sub>D H \<rightarrow> (Numbers(x, G) \<equiv> Numbers(x, H))\<close>
proof (safe intro!: "\<rightarrow>I" "\<equiv>I")
  AOT_assume 0: \<open>G \<approx>\<^sub>D H\<close>
  AOT_assume \<open>Numbers(x, G)\<close>
  AOT_hence Ax: \<open>A!x\<close> and \<theta>: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_show \<open>Numbers(x, H)\<close>
  proof(safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ax "cqt:2" GEN)
    fix F
    AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>
      using \<theta>[THEN "\<forall>E"(2)].
    also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close>
      using 0 "approx-nec:2"[THEN "\<equiv>E"(1), THEN "\<forall>E"(2)] by metis
    finally AOT_show \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close>.
  qed
next
  AOT_assume \<open>G \<approx>\<^sub>D H\<close>
  AOT_hence 0: \<open>H \<approx>\<^sub>D G\<close>
    by (metis "eq-part:2" "\<rightarrow>E")
  AOT_assume \<open>Numbers(x, H)\<close>
  AOT_hence Ax: \<open>A!x\<close> and \<theta>: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H)\<close>
    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_show \<open>Numbers(x, G)\<close>
  proof(safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Ax "cqt:2"  GEN)
    fix F
    AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close>
      using \<theta>[THEN "\<forall>E"(2)].
    also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>
      using 0 "approx-nec:2"[THEN "\<equiv>E"(1), THEN "\<forall>E"(2)] by metis
    finally AOT_show \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>.
  qed
qed

AOT_theorem "num-tran:2":
  \<open>(Numbers(x, G) & Numbers(x,H)) \<rightarrow> G \<approx>\<^sub>D H\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>Numbers(x,G)\<close>
  AOT_hence \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_hence 1: \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close> for F
    using "\<forall>E"(2) by blast
  AOT_assume \<open>Numbers(x,H)\<close>
  AOT_hence \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H)\<close>
    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close> for F
    using "\<forall>E"(2) by blast
  AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close> for F
    by (metis "1" "\<equiv>E"(6))
  AOT_thus \<open>G \<approx>\<^sub>D H\<close>
    using "approx-nec:2"[THEN "\<equiv>E"(2), OF GEN] by blast
qed

AOT_theorem "pre-Hume:1":
  \<open>(Numbers(x,G) & Numbers(y,H)) \<rightarrow> (x = y \<equiv> G \<approx>\<^sub>D H)\<close>
proof(safe intro!: "\<rightarrow>I" "\<equiv>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>Numbers(x, G)\<close>
  moreover AOT_assume \<open>x = y\<close>
  ultimately AOT_have \<open>Numbers(y, G)\<close> by (rule "rule=E")
  moreover AOT_assume \<open>Numbers(y, H)\<close>
  ultimately AOT_show \<open>G \<approx>\<^sub>D H\<close> using "num-tran:2" "\<rightarrow>E" "&I" by blast
next
  AOT_assume \<open>Numbers(x, G)\<close>
  AOT_hence Ax: \<open>A!x\<close> and xF: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_assume \<open>Numbers(y, H)\<close>
  AOT_hence Ay: \<open>A!y\<close> and yF: \<open>\<forall>F (y[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H)\<close>
    using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_assume G_approx_H: \<open>G \<approx>\<^sub>D H\<close>
  AOT_show \<open>x = y\<close>
  proof(rule "ab-obey:1"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF "&I", OF Ax, OF Ay]; rule GEN)
    fix F
    AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>
      using xF[THEN "\<forall>E"(2)].
    also AOT_have \<open>\<dots> \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close>
      using "approx-nec:2"[THEN "\<equiv>E"(1), OF G_approx_H, THEN "\<forall>E"(2)].
    also AOT_have \<open>\<dots> \<equiv> y[F]\<close>
      using yF[THEN "\<forall>E"(2), symmetric].
    finally AOT_show \<open>x[F] \<equiv> y[F]\<close>.
  qed
qed

AOT_theorem "pre-Hume:2": \<open>\<exists>x(Numbers(x,F) & Numbers(x,G)) \<equiv> F \<approx>\<^sub>D G\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>\<exists>x (Numbers(x,F) & Numbers(x,G))\<close>
  then AOT_obtain x where \<open>Numbers(x,F) & Numbers(x,G)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_thus \<open>F \<approx>\<^sub>D G\<close>
    using "num-tran:2" "vdash-properties:10" by blast
next
  AOT_assume 0: \<open>F \<approx>\<^sub>D G\<close>
  AOT_have \<open>\<exists>x(Numbers(x,F))\<close>
    by (simp add: "num:1")
  then AOT_obtain x where x: \<open>Numbers(x,F)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<open>\<exists>x(Numbers(x,G))\<close>
    by (simp add: "num:1")
  then AOT_obtain y where y: \<open>Numbers(y,G)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_show \<open>\<exists>x(Numbers(x,F) & Numbers(x,G))\<close>
    using x y "&I" "\<exists>I"(2)
    by (metis (no_types, lifting) "0" "cqt:2"(1) "num-tran:1.unvarify_G.unvarify_H.unvarify_x.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)")
qed

AOT_theorem "pre-Hume:3": \<open>\<exists>x\<exists>y(Numbers(x,F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y,G) & \<forall>z(Numbers(z,G) \<rightarrow> z = y) & x = y) \<equiv> F \<approx>\<^sub>D G\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>\<exists>x\<exists>y(Numbers(x,F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y,G) & \<forall>z(Numbers(z,G) \<rightarrow> z = y) & x = y)\<close>
  then AOT_obtain x y where 0: \<open>Numbers(x,F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y,G) & \<forall>z(Numbers(z,G) \<rightarrow> z = y) & x = y\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<open>Numbers(x,G)\<close>
    using 0
    by (metis (no_types, lifting) "con-dis-i-e:1" "con-dis-i-e:2:b" "con-dis-taut:1.\<rightarrow>E" "cqt:2"(1) "num-tran:1.unvarify_G.unvarify_H.unvarify_x.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)" "pre-Hume:1.unvarify_x.unvarify_G.unvarify_y.unvarify_H.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)")
  AOT_thus \<open>F \<approx>\<^sub>D G\<close>
    using 0
    by (meson "con-dis-taut:1.\<rightarrow>E" "num-tran:2" "oth-class-taut:7:a.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E")
next
  AOT_assume 0: \<open>F \<approx>\<^sub>D G\<close>
  AOT_have \<open>\<exists>!x(Numbers(x,F))\<close>
    by (simp add: "num:2")
  then AOT_obtain x where 1: \<open>Numbers(x,F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x)\<close>
    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "\<exists>E"[rotated] by blast
  AOT_have \<open>\<exists>!x(Numbers(x,G))\<close>
    by (simp add: "num:2")
  then AOT_obtain y where 2: \<open>Numbers(y,G) & \<forall>z(Numbers(z,G) \<rightarrow> z = y)\<close>
    using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "\<exists>E"[rotated] by blast

  AOT_have \<open>Numbers(x,F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y,G) & \<forall>z(Numbers(z,G) \<rightarrow> z = y) & x = y\<close>
    using 1 2
    by (metis (no_types, lifting) "0" "con-dis-i-e:1" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "cqt:2"(1) "id-eq:2" "num-tran:1.unvarify_G.unvarify_H.unvarify_x.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)" "rule-ui:1" "vdash-properties:10")
  AOT_thus \<open>\<exists>x\<exists>y(Numbers(x,F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y,G) & \<forall>z(Numbers(z,G) \<rightarrow> z = y) & x = y)\<close>
    using"\<exists>I"
    by meson
qed


AOT_theorem "num-tran2":
  \<open>G \<equiv>\<^sub>D H \<rightarrow> (Numbers(x, G) \<equiv> Numbers(x, H))\<close>
  using "apE-eqE:1" "Hypothetical Syllogism" "num-tran:1" by blast


AOT_theorem "two-num-not":
  \<open>\<exists>u\<exists>v(u \<noteq> v) \<rightarrow> \<exists>x\<exists>G\<exists>H(Numbers(x,G) & Numbers(x, H) & \<not>G \<equiv>\<^sub>D H)\<close>
proof (rule "\<rightarrow>I")
  AOT_have eqE_den: \<open>[\<lambda>x x =\<^sub>D y]\<down>\<close> for y by "cqt:2"
  AOT_assume \<open>\<exists>u\<exists>v(u \<noteq> v)\<close>
  then AOT_obtain c where Oc: \<open>D!c\<close> and \<open>\<exists>v (c \<noteq> v)\<close>
    using "&E" "\<exists>E"[rotated] by blast
  then AOT_obtain d where Od: \<open>D!d\<close> and c_noteq_d: \<open>c \<noteq> d\<close>
    using "&E" "\<exists>E"[rotated] by blast
  AOT_hence c_noteqE_d: \<open>c \<noteq>\<^sub>D d\<close>
    by (meson "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "cqt:2"(1) "discern-obj:19" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)"
        "modus-tollens:1")
  AOT_hence not_c_eqE_d: \<open>\<not>c =\<^sub>D d\<close>
    by (simp add: "cqt:2"(1) "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)")
  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>x x =\<^sub>D c]))\<close>
    by (simp add: "A-objects"[axiom_inst])
  then AOT_obtain a where a_prop: \<open>A!a & \<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>x x =\<^sub>D c])\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<open>\<exists>x (A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>x x =\<^sub>D d]))\<close>
    by (simp add: "A-objects" "vdash-properties:1[2]")
  then AOT_obtain b where b_prop: \<open>A!b & \<forall>F (b[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>x x =\<^sub>D d])\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have num_a_eq_c: \<open>Numbers(a, [\<lambda>x x =\<^sub>D c])\<close>
    by (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" a_prop[THEN "&E"(1)]
                     a_prop[THEN "&E"(2)]) "cqt:2"
  moreover AOT_have num_b_eq_d: \<open>Numbers(b, [\<lambda>x x =\<^sub>D d])\<close>
    by (safe intro!: numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" b_prop[THEN "&E"(1)]
                     b_prop[THEN "&E"(2)]) "cqt:2"
  moreover AOT_have \<open>[\<lambda>x x =\<^sub>D c] \<approx>\<^sub>D [\<lambda>x x =\<^sub>D d]\<close>
  proof (rule "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
    let ?R = \<open>\<guillemotleft>[\<lambda>xy (x =\<^sub>D c & y =\<^sub>D d)]\<guillemotright>\<close>
    AOT_have Rcd: \<open>[\<guillemotleft>?R\<guillemotright>]cd\<close>
      apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" prod_denotesI
                       "discern-obj:30" Od Oc)
      using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Oc Od by blast+
    AOT_show \<open>\<exists>R R |: [\<lambda>x x =\<^sub>D c] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [\<lambda>x x =\<^sub>D d]\<close>
    proof (safe intro!: "\<exists>I"(1)[where \<tau>=\<open>?R\<close>] "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I"
                        eqE_den Discernible.GEN "\<rightarrow>I")
      AOT_show \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close> by "cqt:2"
    next
      fix u
      AOT_assume \<open>[\<lambda>x x =\<^sub>D c]u\<close>
      AOT_hence \<open>u =\<^sub>D c\<close>
        by (metis "\<beta>\<rightarrow>C"(1))
      AOT_hence u_is_c: \<open>u = c\<close>
        using "discern-obj:19" "vdash-properties:6" by blast
      AOT_show \<open>\<exists>!v ([\<lambda>x x =\<^sub>D d]v & [\<guillemotleft>?R\<guillemotright>]uv)\<close>
      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=d] "&I"
                          Od Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[\<lambda>x x =\<^sub>D d]d\<close>
          apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "discern-obj:30")
          using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Od by blast
      next
        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]ud\<close>
          using u_is_c[symmetric] Rcd "rule=E" by fast
      next
        fix v
        AOT_assume \<open>[\<lambda>x x =\<^sub>D d]v & [\<guillemotleft>?R\<guillemotright>]uv\<close>
        AOT_thus \<open>v =\<^sub>D d\<close>
          by (metis "\<beta>\<rightarrow>C"(1) "&E"(1))
      qed
    next
      fix v
      AOT_assume \<open>[\<lambda>x x =\<^sub>D d]v\<close>
      AOT_hence \<open>v =\<^sub>D d\<close>
        by (metis "\<beta>\<rightarrow>C"(1))
      AOT_hence v_is_d: \<open>v = d\<close>
        using "discern-obj:19" "vdash-properties:6" by blast
      AOT_show \<open>\<exists>!u ([\<lambda>x x =\<^sub>D c]u & [\<guillemotleft>?R\<guillemotright>]uv)\<close>
      proof (safe intro!: "equi:1"[THEN "\<equiv>E"(2)] "\<exists>I"(2)[where \<beta>=c] "&I"
                          Oc Discernible.GEN "\<rightarrow>I")
        AOT_show \<open>[\<lambda>x x =\<^sub>D c]c\<close>
          apply (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "discern-obj:30")
          using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Oc by blast
      next
        AOT_show \<open>[\<guillemotleft>?R\<guillemotright>]cv\<close>
          using v_is_d[symmetric] Rcd "rule=E" by fast
      next
        fix u
        AOT_assume \<open>[\<lambda>x x =\<^sub>D c]u & [\<guillemotleft>?R\<guillemotright>]uv\<close>
        AOT_thus \<open>u =\<^sub>D c\<close>
          by (metis "\<beta>\<rightarrow>C"(1) "&E"(1))
      qed
    next
      AOT_show \<open>\<guillemotleft>?R\<guillemotright>\<down>\<close>
        by "cqt:2"
    qed
  qed
  ultimately AOT_have \<open>a = b\<close>
    using "pre-Hume:1"[unvarify G H, OF eqE_den, OF eqE_den, THEN "\<rightarrow>E",
                     OF "&I", THEN "\<equiv>E"(2)] by blast
  AOT_hence num_a_eq_d: \<open>Numbers(a, [\<lambda>x x =\<^sub>D d])\<close>
    using num_b_eq_d "rule=E" id_sym by fast
  AOT_have not_equiv: \<open>\<not>[\<lambda>x x =\<^sub>D c] \<equiv>\<^sub>D [\<lambda>x x =\<^sub>D d]\<close>
  proof (rule "raa-cor:2")
    AOT_assume \<open>[\<lambda>x x =\<^sub>D c] \<equiv>\<^sub>D [\<lambda>x x =\<^sub>D d]\<close>
    AOT_hence \<open>[\<lambda>x x =\<^sub>D c]c \<equiv> [\<lambda>x x =\<^sub>D d]c\<close>
      using eqD[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] Oc by blast
    moreover AOT_have \<open>[\<lambda>x x =\<^sub>D c]c\<close>
      apply (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "discern-obj:30")
      using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Oc by blast
    ultimately AOT_have \<open>[\<lambda>x x =\<^sub>D d]c\<close>
      using "\<equiv>E"(1) by blast
    AOT_hence \<open>c =\<^sub>D d\<close>
      by (rule "\<beta>\<rightarrow>C"(1))
    AOT_thus \<open>c =\<^sub>D d & \<not>c =\<^sub>D d\<close>
      using not_c_eqE_d "&I" by blast
  qed
  AOT_show \<open>\<exists>x \<exists>G \<exists>H (Numbers(x,G) & Numbers(x,H) & \<not>G \<equiv>\<^sub>D H)\<close>
    apply (rule "\<exists>I"(2)[where \<beta>=a])
    apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x x =\<^sub>D c]\<guillemotright>\<close>])
     apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x x =\<^sub>D d]\<guillemotright>\<close>])
    by (safe intro!: eqE_den "&I" num_a_eq_c num_a_eq_d not_equiv)
qed

AOT_theorem "num-cont:1":
  \<open>\<exists>x\<exists>G(Numbers(x, G) & \<not>\<box>Numbers(x, G))\<close>
proof -
  AOT_have \<open>\<exists>F\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using "approx-cont:2".
  then AOT_obtain F where \<open>\<exists>G \<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain G where \<open>\<diamond>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G & \<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<theta>: \<open>\<diamond>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close> and \<zeta>: \<open>\<diamond>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>
    using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" "4\<diamond>"[THEN "\<rightarrow>E"] by blast+
  AOT_obtain a where \<open>Numbers(a, G)\<close>
    using "num:1" "\<exists>E"[rotated] by blast
  moreover AOT_have \<open>\<not>\<box>Numbers(a, G)\<close>
  proof (rule "raa-cor:2")
    AOT_assume \<open>\<box>Numbers(a, G)\<close>
    AOT_hence \<open>\<box>([A!]a & G\<down> & \<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G))\<close>
      by (AOT_subst_def (reverse) numbers)
    AOT_hence \<open>\<box>A!a\<close> and \<open>\<box>\<forall>F (a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
      using "KBasic:3"[THEN "\<equiv>E"(1)] "&E" by blast+
    AOT_hence \<open>\<forall>F \<box>(a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
      using CBF[THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<box>(a[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
      using "\<forall>E"(2) by blast
    AOT_hence A: \<open>\<box>(a[F] \<rightarrow> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
          and B: \<open>\<box>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<rightarrow> a[F])\<close>
      using "KBasic:4"[THEN "\<equiv>E"(1)] "&E" by blast+
    AOT_have \<open>\<box>(\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<rightarrow> \<not>a[F])\<close>
      apply (AOT_subst \<open>\<not>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<rightarrow> \<not>a[F]\<close> \<open>a[F] \<rightarrow> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>)
       using "\<equiv>I" "useful-tautologies:4" "useful-tautologies:5" apply presburger
       by (fact A)
     AOT_hence \<open>\<diamond>\<not>a[F]\<close>
       by (metis "KBasic:13" \<zeta> "\<rightarrow>E")
    AOT_hence \<open>\<not>a[F]\<close>
      by (metis "KBasic:11" "en-eq:2[1]" "\<equiv>E"(2) "\<equiv>E"(4))
    AOT_hence \<open>\<not>\<diamond>a[F]\<close>
      by (metis "en-eq:3[1]" "\<equiv>E"(4))
    moreover AOT_have \<open>\<diamond>a[F]\<close>
      by (meson B \<theta> "KBasic:13" "\<rightarrow>E")
    ultimately AOT_show \<open>\<diamond>a[F] & \<not>\<diamond>a[F]\<close>
      using "&I" by blast
  qed

  ultimately AOT_have \<open>Numbers(a, G) & \<not>\<box>Numbers(a, G)\<close>
    using "&I" by blast
  AOT_hence \<open>\<exists>G (Numbers(a, G) & \<not>\<box>Numbers(a, G))\<close>
    by (rule "\<exists>I")
  AOT_thus \<open>\<exists>x\<exists>G (Numbers(x, G) & \<not>\<box>Numbers(x, G))\<close>
    by (rule "\<exists>I")
qed

AOT_theorem "num-cont:2":
  \<open>Rigid(G) \<rightarrow> \<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>Rigid(G)\<close>
  AOT_hence \<open>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close>
    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast
  AOT_hence \<open>\<box>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close> by (metis "S5Basic:6" "\<equiv>E"(1))
  moreover AOT_have \<open>\<box>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z) \<rightarrow> \<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
    AOT_modally_strict {
      AOT_have act_den: \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F by "cqt:2[lambda]"
      fix x
      AOT_assume G_nec: \<open>\<box>\<forall>z([G]z \<rightarrow> \<box>[G]z)\<close>
      AOT_hence G_rigid: \<open>Rigid(G)\<close>
        using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI", OF "&I"] "cqt:2"
        by blast
      AOT_assume \<open>Numbers(x, G)\<close>
      AOT_hence \<open>[A!]x & G\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
        using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
      AOT_hence Ax: \<open>[A!]x\<close> and \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
        using "&E" by blast+
      AOT_hence \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close> for F
        using "\<forall>E"(2) by blast
      moreover AOT_have \<open>\<box>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<rightarrow> \<box>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close> for F
        using "approx-nec:3"[unvarify F, OF act_den, THEN "\<rightarrow>E", OF "&I",
                             OF "actuallyF:2", OF G_rigid].
      moreover AOT_have \<open>\<box>(x[F] \<rightarrow> \<box>x[F])\<close> for F
        by (simp add: RN "pre-en-eq:1[1]")
      ultimately AOT_have \<open>\<box>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close> for F
        using "sc-eq-box-box:5" "\<rightarrow>E" "qml:2"[axiom_inst] "&I" by meson
      AOT_hence \<open>\<forall>F \<box>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
        by (rule "\<forall>I")
      AOT_hence 1: \<open>\<box>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
        using BF[THEN "\<rightarrow>E"] by fast
      AOT_have \<open>\<box>G\<down>\<close>
        by (simp add: "ex:2:a")
      moreover AOT_have \<open>\<box>[A!]x\<close>
        using Ax "oa-facts:2" "\<rightarrow>E" by blast
      ultimately AOT_have \<open>\<box>(A!x & G\<down>)\<close>
        by (metis "KBasic:3" "&I" "\<equiv>E"(2))
      AOT_hence \<open>\<box>(A!x & G\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G))\<close>
        using 1 "KBasic:3" "&I" "\<equiv>E"(2) by fast
      AOT_thus \<open>\<box>Numbers(x, G)\<close>
        by (AOT_subst_def numbers)
    }
  qed
  ultimately AOT_show \<open>\<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
    using "\<rightarrow>E" by blast
qed

AOT_theorem "num-cont:3":
  \<open>\<box>\<forall>x(Numbers(x, [\<lambda>z \<^bold>\<A>[G]z]) \<rightarrow> \<box>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z]))\<close>
  by (rule "num-cont:2"[unvarify G, THEN "\<rightarrow>E"];
      ("cqt:2[lambda]" | rule "actuallyF:2"))


AOT_theorem "num-cont:4":
  \<open>\<^bold>\<A>Numbers(x, [G]) \<equiv> Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
proof -
  AOT_have \<open>\<forall>F\<forall>G\<box>(\<exists>x (Numbers(x,F) & Numbers(x,G)) \<equiv> F \<approx>\<^sub>D G)\<close>
    using "pre-Hume:2" RN GEN
    by meson
  moreover AOT_have den: \<open>[\<lambda>z \<^bold>\<A>[G]z]\<down>\<close>
    by "cqt:2"
  ultimately AOT_have \<open>\<box>(\<exists>x (Numbers(x,G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])) \<equiv> G \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z])\<close>
    using "\<forall>E"(1) "\<forall>E"(2) by blast
  AOT_hence 0: \<open>\<^bold>\<A>(\<exists>x (Numbers(x,G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])) \<equiv> G \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z])\<close>
    using "nec-imp-act.\<rightarrow>E" by blast
  AOT_hence 0: \<open>\<^bold>\<A>(\<exists>x (Numbers(x,G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]))) \<equiv> \<^bold>\<A>(G \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z])\<close>
    using "Act-Basic:5" "intro-elim:3:a" by blast
  AOT_hence \<open>\<^bold>\<A>(\<exists>x (Numbers(x,G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
    using "actuallyF:1" "intro-elim:3:b" by blast
  AOT_hence \<open>\<exists>x\<^bold>\<A>((Numbers(x,G) & Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
    by (meson "Act-Basic:10.\<equiv>E(1).\<exists>E'" "existential:2[const_var]")
  then AOT_obtain a where x_prop: \<open>\<^bold>\<A>((Numbers(a,G) & Numbers(a,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<^bold>\<A>Numbers(a,[\<lambda>z \<^bold>\<A>[G]z])\<close>
    using "Act-Basic:2.\<equiv>E(1).&E(2)" by blast
  moreover AOT_have \<open>\<box>(Numbers(a,[\<lambda>z \<^bold>\<A>[G]z]) \<rightarrow> \<box>(Numbers(a,[\<lambda>z \<^bold>\<A>[G]z])))\<close>
    using "RM:1.\<rightarrow>E" "cqt-orig:3" "num-cont:3" by blast
  ultimately AOT_have D: \<open>Numbers(a,[\<lambda>z \<^bold>\<A>[G]z])\<close>
    using "sc-eq-fur:2.\<rightarrow>E.\<equiv>E(1)" by blast
  AOT_have B: \<open>\<^bold>\<A>Numbers(a,G)\<close>
    using "Act-Basic:2.\<equiv>E(1).&E(1)" x_prop by blast


  AOT_show \<open>\<^bold>\<A>Numbers(x, [G]) \<equiv> Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
    AOT_assume 0: \<open>\<^bold>\<A>Numbers(x,G)\<close>
    AOT_hence \<open>\<^bold>\<A>\<exists>!y(Numbers(y,G))\<close>
      using "RA[2]" "num:2" by blast
    AOT_hence \<open>\<exists>!y\<^bold>\<A>(Numbers(y,G))\<close>
      by (simp add: "A-Exists:1.\<equiv>E(1)")
    AOT_hence \<open>a = x\<close>
      by (meson "0" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "rule=I:1" "uni-most.\<rightarrow>E.\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" local.B)
    AOT_thus \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
      using D by (meson "rule=E'")
  next
    AOT_assume 0: \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[G]z])\<close>
    AOT_hence \<open>\<^bold>\<A>\<exists>!y(Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]))\<close>
      by (simp add: "RA[2]" "actuallyF:2" "df-rigid-rel:1.\<equiv>\<^sub>d\<^sub>fE.&E(1)" "num:2.unvarify_G.\<forall>E(1)")
    AOT_hence \<open>\<exists>!y\<^bold>\<A>(Numbers(y, [\<lambda>z \<^bold>\<A>[G]z]))\<close>
      using "A-Exists:1.\<equiv>E(1)" by blast
    AOT_hence \<open>a = x\<close>
      using D
      by (metis (no_types, lifting) "0" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "eq-part:1.unvarify_F.\<forall>E(1)" "pre-Hume:1.unvarify_x.unvarify_G.unvarify_y.unvarify_H.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2).rule=E'" "rule=I:1" den)
    AOT_thus \<open>\<^bold>\<A>Numbers(x, G)\<close>
      by (meson "Act-Basic:2.\<equiv>E(1).&E(1)" "rule=E" x_prop)
  qed
qed

AOT_theorem "num-uniq": \<open>\<^bold>\<iota>x Numbers(x, G)\<down>\<close>
  using "\<equiv>E"(2) "A-Exists:2" "RA[2]" "num:2" by blast

AOT_define num :: \<open>\<tau> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>#_\<close> [100] 100)
  "num-def:1": \<open>#G =\<^sub>d\<^sub>f \<^bold>\<iota>x Numbers(x, G)\<close>

AOT_theorem "num-def:2": \<open>#G\<down>\<close>
  using "num-def:1"[THEN "=\<^sub>d\<^sub>fI"(1)] "num-uniq" by simp

AOT_theorem "num-can:1":
  \<open>#G = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G))\<close>
proof -
  AOT_have \<open>\<box>\<forall>x(Numbers(x,G) \<equiv> [A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G))\<close>
    by (safe intro!: RN GEN "numbers[den]"[THEN "\<rightarrow>E"] "cqt:2")
  AOT_hence \<open>\<^bold>\<iota>x Numbers(x, G) = \<^bold>\<iota>x([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G))\<close>
    using "num-uniq" "equiv-desc-eq:3"[THEN "\<rightarrow>E", OF "&I"] by auto
  thus ?thesis
    by (rule "=\<^sub>d\<^sub>fI"(1)[OF "num-def:1", OF "num-uniq"])
qed

AOT_theorem "num-can:2": \<open>#G = \<^bold>\<iota>x(A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>D G))\<close>
proof (rule id_trans[OF "num-can:1"]; rule "equiv-desc-eq:2"[THEN "\<rightarrow>E"];
       safe intro!: "&I" "A-descriptions" GEN "Act-Basic:5"[THEN "\<equiv>E"(2)]
                    "logic-actual-nec:3"[axiom_inst, THEN "\<equiv>E"(2)])
  AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F
    by "cqt:2"
  AOT_have "eq-part:3[terms]": \<open>\<^bold>\<turnstile>\<^sub>\<box> F \<approx>\<^sub>D G & F \<approx>\<^sub>D H \<rightarrow> G \<approx>\<^sub>D H\<close> for F G H
    by (metis "&I" "eq-part:2" "eq-part:3" "\<rightarrow>I" "&E" "\<rightarrow>E")
  fix x
  {
    fix F
    AOT_have \<open>\<^bold>\<A>(F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z])\<close>
      by (simp add: "actuallyF:1")
    moreover AOT_have \<open>\<^bold>\<A>((F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z]) \<rightarrow> ([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<equiv> F \<approx>\<^sub>D G))\<close>
      by (auto intro!: "RA[2]" "\<rightarrow>I" "\<equiv>I"
               simp: "eq-part:3"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "&I"]
                     "eq-part:3[terms]"[unvarify G, OF act_den, THEN "\<rightarrow>E", OF "&I"])
    ultimately AOT_have \<open>\<^bold>\<A>([\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<equiv> F \<approx>\<^sub>D G)\<close>
      using "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(1), THEN "\<rightarrow>E"] by blast

    AOT_hence \<open>\<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G \<equiv> \<^bold>\<A>F \<approx>\<^sub>D G\<close>
      by (metis "Act-Basic:5" "\<equiv>E"(1))
    AOT_hence 0: \<open>(\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G) \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>F \<approx>\<^sub>D G)\<close>
      by (auto intro!: "\<equiv>I" "\<rightarrow>I" elim: "\<equiv>E")
    AOT_have \<open>\<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G) \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
      by (simp add: "Act-Basic:5")
    also AOT_have \<open>\<dots> \<equiv> (\<^bold>\<A>x[F] \<equiv> \<^bold>\<A>F \<approx>\<^sub>D G)\<close> using 0.
    also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>D G))\<close>
      by (meson "Act-Basic:5" "\<equiv>E"(6) "oth-class-taut:3:a")
    finally AOT_have 0: \<open>\<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G) \<equiv> \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>D G))\<close>.
  } note 0 = this
  AOT_have \<open>\<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G) \<equiv> \<forall>F \<^bold>\<A>(x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    using "logic-actual-nec:3" "vdash-properties:1[2]" by blast
  also AOT_have \<open>\<dots> \<equiv>  \<forall>F \<^bold>\<A>((x[F] \<equiv> F \<approx>\<^sub>D G))\<close>
    apply (safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
    using 0 "\<equiv>E"(1) "\<equiv>E"(2) "rule-ui:3" by blast+
  also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>D G))\<close>
    using "\<equiv>E"(6) "logic-actual-nec:3"[axiom_inst] "oth-class-taut:3:a" by fast
  finally AOT_have 0: \<open>\<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G) \<equiv> \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>D G))\<close>.
  AOT_have \<open>\<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)) \<equiv>
            (\<^bold>\<A>A!x & \<^bold>\<A>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G))\<close>
    by (simp add: "Act-Basic:2")
  also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>[A!]x & \<^bold>\<A>(\<forall>F (x[F] \<equiv> F \<approx>\<^sub>D G))\<close>
    using 0 "oth-class-taut:4:f" "\<rightarrow>E" by blast
  also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(A!x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>D G))\<close>
    using "Act-Basic:2" "\<equiv>E"(6) "oth-class-taut:3:a" by blast
  finally AOT_show \<open>\<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)) \<equiv>
                    \<^bold>\<A>([A!]x & \<forall>F (x[F] \<equiv> F \<approx>\<^sub>D G))\<close>.
qed

AOT_theorem "eq-num:1": \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G\<close>
proof -
  AOT_have 0: \<open>#G\<down>\<close>
    using "num-def:2" by force
  AOT_have \<theta>: \<open>#G = \<^bold>\<iota>x Numbers(x,G) \<equiv> \<forall>x(\<^bold>\<A>Numbers(x,G) \<equiv> x = #G)\<close>
    using descriptions[axiom_inst, unvarify y, OF 0]
    by auto
  AOT_have \<open>#G = \<^bold>\<iota>x Numbers(x,G) \<equiv> \<forall>x(Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G)\<close>
    apply (AOT_subst \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])\<close> \<open>\<^bold>\<A>Numbers(x,G)\<close> for: x)
    using "num-cont:4"[symmetric]
     apply (simp add: "num-cont:4")
    using \<theta> by simp
  moreover AOT_have \<open>#G =\<^bold>\<iota>x(Numbers(x,G))\<close>
    using "num-def:1" "num-uniq" "rule-id-df:1" by blast
  ultimately AOT_have \<open>\<forall>x(Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G)\<close>
    using "intro-elim:3:a" by blast
  thus ?thesis using "\<forall>E"(2) by blast
qed

AOT_theorem "eq-num:2": \<open>Numbers(#G, [\<lambda>y \<^bold>\<A>[G]y])\<close>
proof -
  AOT_have \<open>#G = #G\<close>
    by (simp add: "rule=I:1" "num-def:2")
  thus ?thesis
    using "eq-num:1"[unvarify x, OF "num-def:2", THEN "\<equiv>E"(2)] by blast
qed

AOT_theorem "eq-num:3":
  \<open>A!#G & \<forall>F (#G[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z])\<close>
  by (auto intro!: "&I" "eq-num:2"[THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"],
                                   THEN "&E"(1), THEN "&E"(1)]
                   "eq-num:2"[THEN numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)])

AOT_theorem "eq-num:4": \<open>#G[G]\<close>
  by (auto intro!: "eq-num:3"[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2)]
                   "eq-part:1"[unvarify F] simp: "cqt:2")


AOT_theorem "eq-num:5": \<open>Rigid(G) \<rightarrow> Numbers(#G, G)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 1: \<open>Rigid(G)\<close>
  AOT_hence \<open>\<box>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
    by (simp add: "df-rigid-rel:1.\<equiv>\<^sub>d\<^sub>fE.&E(1)" "num-cont:2.unvarify_G.\<forall>E(1).\<rightarrow>E")
  AOT_hence \<theta>: \<open>\<forall>x(Numbers(x,G) \<rightarrow> \<box>Numbers(x,G))\<close>
    using "oth-class-taut:8:b.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E.&E(1)" "qml:2" axiom_inst by blast
  AOT_hence \<open>\<exists>!x(Numbers(x,G)) \<rightarrow> \<forall>y(y = \<^bold>\<iota>x(Numbers(x,G)) \<rightarrow> Numbers(y,G))\<close>
    using "!box-desc:2" "deduction-theorem" "vdash-properties:6" by blast
  moreover AOT_have \<open>\<exists>!x Numbers(x,G)\<close>
    by (simp add: "num:2")
  ultimately AOT_have \<open>\<forall>y(y = \<^bold>\<iota>x(Numbers(x,G)) \<rightarrow> Numbers(y,G))\<close>
    using "vdash-properties:10" by blast
  AOT_hence \<open>#G = \<^bold>\<iota>x(Numbers(x,G)) \<rightarrow> Numbers(#G,G)\<close>
    using "num-def:2" "rule-ui:1" by blast
  AOT_thus \<open>Numbers(#G,G)\<close>
    using "1" "approx-nec:1.unvarify_F.\<forall>E(1).\<rightarrow>E" "df-rigid-rel:1.\<equiv>\<^sub>d\<^sub>fE.&E(1)" "eq-num:2" "num-def:2.unvarify_G.\<forall>E(1)" "num-tran:1.unvarify_G.unvarify_H.unvarify_x.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)" eq_den_2 by blast
qed

AOT_theorem "hume-strict": \<open>(Rigid(F) & Rigid(G)) \<rightarrow> (#F = #G \<equiv> F \<approx>\<^sub>D G)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 0: \<open>Rigid(F) & Rigid(G)\<close>
  AOT_have \<open>(Numbers(#F,F) & Numbers(#G, G)) \<rightarrow> (#F = #G \<equiv> F \<approx>\<^sub>D G)\<close>
    using "pre-Hume:1"
    by (metis "cqt:2"(1) "deduction-theorem" "intro-elim:2" "num-def:2" "pre-Hume:1.unvarify_x.unvarify_G.unvarify_y.unvarify_H.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)" "pre-Hume:1.unvarify_x.unvarify_G.unvarify_y.unvarify_H.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2).rule=E'" "rule=I:1")
  AOT_thus \<open>#F = #G \<equiv> F \<approx>\<^sub>D G\<close>
    using 0
    by (metis "con-dis-i-e:2:a" "con-dis-i-e:2:b" "cqt:2"(1) "eq-num:5.unvarify_G.\<forall>E(1).\<rightarrow>E" "oth-class-taut:7:a.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E")
qed


AOT_act_theorem "hume:1": \<open>Numbers(#G, G)\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "num-def:1"])
  apply (simp add: "num-uniq")
  using "num-uniq" "vdash-properties:10" "y-in:3" by blast

AOT_act_theorem "hume:2": \<open>#F = #G \<equiv> F \<approx>\<^sub>D G\<close>
  by (safe intro!: "pre-Hume:1"[unvarify x y, OF "num-def:2",
                              OF "num-def:2", THEN "\<rightarrow>E"] "&I" "hume:1")

AOT_act_theorem "hume:3": \<open>#F = #G \<equiv> \<exists>R (R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G)\<close>
  using "equi-rem-thm"
  apply (AOT_subst (reverse) \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longrightarrow>\<^sub>o\<^sub>n\<^sub>t\<^sub>oD G\<close>
                             \<open>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close> for: R :: \<open><\<kappa>\<times>\<kappa>>\<close>)
  using "equi:3" "hume:2" "\<equiv>E"(5) "\<equiv>Df" by blast

AOT_act_theorem "hume:4": \<open>F \<equiv>\<^sub>D G \<rightarrow> #F = #G\<close>
  by (metis "apE-eqE:1" "deduction-theorem" "hume:2" "\<equiv>E"(2) "\<rightarrow>E")

(* TODO: OLD VERSION *)
AOT_theorem "hume-strict:1-old":
  \<open>\<exists>x (Numbers(x, F) & Numbers(x, G)) \<equiv> F \<approx>\<^sub>D G\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
  then AOT_obtain a where \<open>Numbers(a, F) & Numbers(a, G)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_thus \<open>F \<approx>\<^sub>D G\<close>
    using "num-tran:2" "\<rightarrow>E" by blast
next
  AOT_assume 0: \<open>F \<approx>\<^sub>D G\<close>
  moreover AOT_obtain b where num_b_F: \<open>Numbers(b, F)\<close>
    by (metis "instantiation" "num:1")
  moreover AOT_have num_b_G: \<open>Numbers(b, G)\<close>
    using calculation "num-tran:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] by blast
  ultimately AOT_have \<open>Numbers(b, F) & Numbers(b, G)\<close>
    by (safe intro!: "&I")
  AOT_thus \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
    by (rule "\<exists>I")
qed

(* TODO: OLD VERSION *)
AOT_theorem "hume-strict:2-old":
  \<open>\<exists>x\<exists>y (Numbers(x, F) &
         \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
         Numbers(y, G) &
         \<forall>z (Numbers(z, G) \<rightarrow> z = y) &
         x = y) \<equiv>
   F \<approx>\<^sub>D G\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>\<exists>x\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
                    Numbers(y, G) & \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
  then AOT_obtain x where
    \<open>\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
         \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain y where
    \<open>Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
     \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>Numbers(x, F)\<close> and \<open>Numbers(y,G)\<close> and \<open>x = y\<close>
    using "&E" by blast+
  AOT_hence \<open>Numbers(y, F) & Numbers(y, G)\<close>
    using "&I" "rule=E" by fast
  AOT_hence \<open>\<exists>y (Numbers(y, F) & Numbers(y, G))\<close>
    by (rule "\<exists>I")
  AOT_thus \<open>F \<approx>\<^sub>D G\<close>
    using "hume-strict:1-old"[THEN "\<equiv>E"(1)] by blast
next
  AOT_assume \<open>F \<approx>\<^sub>D G\<close>
  AOT_hence \<open>\<exists>x (Numbers(x, F) & Numbers(x, G))\<close>
    using "hume-strict:1-old"[THEN "\<equiv>E"(2)] by blast
  then AOT_obtain x where \<open>Numbers(x, F) & Numbers(x, G)\<close>
    using "\<exists>E"[rotated] by blast
  moreover AOT_have \<open>\<forall>z (Numbers(z, F) \<rightarrow> z = x)\<close>
                and \<open>\<forall>z (Numbers(z, G) \<rightarrow> z = x)\<close>
    using calculation
    by (auto intro!: GEN "\<rightarrow>I" "pre-Hume:1"[THEN "\<rightarrow>E", OF "&I", THEN "\<equiv>E"(2),
                                         rotated 2, OF "eq-part:1"] dest: "&E")
  ultimately AOT_have \<open>Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) &
                       Numbers(x, G) & \<forall>z (Numbers(z, G) \<rightarrow> z = x) & x = x\<close>
    by (auto intro!: "&I" "id-eq:1" dest: "&E")
  AOT_thus \<open>\<exists>x\<exists>y (Numbers(x, F) & \<forall>z(Numbers(z,F) \<rightarrow> z = x) & Numbers(y, G) &
                  \<forall>z (Numbers(z, G) \<rightarrow> z = y) & x = y)\<close>
    by (auto intro!: "\<exists>I")
qed

AOT_define NaturalCardinal :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>NaturalCardinal'(_')\<close>)
  card: \<open>NaturalCardinal(x) \<equiv>\<^sub>d\<^sub>f \<exists>G(x = #G)\<close>


AOT_theorem "eq-df-num:1": \<open>Numbers(x, G) \<rightarrow> NaturalCardinal(x)\<close>
proof(rule "\<rightarrow>I")
  AOT_have act_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> [\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> for F
    by "cqt:2"
  AOT_obtain F where \<open>Rigidifies(F, G)\<close>
    by (metis "instantiation" "rigid-der:3")
  AOT_hence \<theta>: \<open>Rigid(F)\<close> and \<open>\<forall>x([F]x \<equiv> [G]x)\<close>
    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)]
          "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1)]
    by blast+
  AOT_hence \<open>F \<equiv>\<^sub>D G\<close>
    by (auto intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I" elim: "\<forall>E"(2))
  moreover AOT_assume \<open>Numbers(x, G)\<close>
  ultimately AOT_have \<open>Numbers(x, F)\<close>
    using "num-tran2"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2)]
    by blast
  moreover AOT_have \<open>F \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[F]z]\<close>
    using \<theta> "approx-nec:1" "\<rightarrow>E" by blast
  ultimately AOT_have \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[F]z])\<close>
    using "num-tran:1"[unvarify H, OF act_den, THEN "\<rightarrow>E", THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>x = #F\<close>
    using "eq-num:1"[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<open>\<exists>F x = #F\<close>
    by (rule "\<exists>I")
  AOT_thus \<open>NaturalCardinal(x)\<close>
    using card[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
qed


AOT_theorem "eq-df-num:2": \<open>\<exists>G (x = #G) \<equiv> \<exists>G (Numbers(x,G))\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>\<exists>G (x = #G)\<close>
  then AOT_obtain P where \<open>x = #P\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[P]z])\<close>
    using "eq-num:1"[THEN "\<equiv>E"(2)] by blast
  moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[P]z]\<down>\<close> by "cqt:2"
  ultimately AOT_show \<open>\<exists>G(Numbers(x,G))\<close> by (rule "\<exists>I")
next
  AOT_assume \<open>\<exists>G (Numbers(x,G))\<close>
  then AOT_obtain Q where \<open>Numbers(x,Q)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>NaturalCardinal(x)\<close>
    using "eq-df-num:1"[THEN "\<rightarrow>E"] by blast
  AOT_thus \<open>\<exists>G (x = #G)\<close>
    using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
qed

AOT_theorem "natcard-nec:1": \<open>NaturalCardinal(x) \<rightarrow> \<box>NaturalCardinal(x)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>NaturalCardinal(x)\<close>
  AOT_hence \<open>\<exists>G(x = #G)\<close> using card[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  then AOT_obtain G where \<open>x = #G\<close> using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<box>x = #G\<close> by (metis "id-nec:2" "\<rightarrow>E")
  AOT_hence \<open>\<exists>G \<box>x = #G\<close> by (rule "\<exists>I")
  AOT_hence \<open>\<box>\<exists>G x = #G\<close> by (metis Buridan "\<rightarrow>E")
  AOT_thus \<open>\<box>NaturalCardinal(x)\<close>
    by (AOT_subst_def card)
qed

AOT_theorem "natcard-nec:2": \<open>Numbers(x,G) \<rightarrow> \<box>NaturalCardinal(x)\<close>
  using "Hypothetical Syllogism" "eq-df-num:1" "natcard-nec:1" by blast

AOT_theorem "card-en": \<open>NaturalCardinal(x) \<rightarrow> \<forall>F(x[F] \<equiv> x = #F)\<close>
proof(safe intro!: "\<rightarrow>I" GEN)
  fix F
  AOT_assume \<open>NaturalCardinal(x)\<close>
  AOT_hence \<open>\<exists>G(x = #G)\<close>
    using "\<equiv>\<^sub>d\<^sub>fE" card by blast
  then AOT_obtain P where x_eq: \<open>x = #P\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<theta>: \<open>Numbers(x, [\<lambda>z \<^bold>\<A>[P]z])\<close>
    by (simp add: "cqt:2"(1) "eq-num:1.unvarify_x.unvarify_G.\<forall>E(1).\<forall>E(1).\<equiv>E(2)")
  AOT_have \<open>#P[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[P]z]\<close>
    by (simp add: "cqt:2"(1) "deduction-theorem" "eq-num:3.unvarify_G.\<forall>E(1).&E(2).\<forall>E(1).\<equiv>E(1)" "eq-num:3.unvarify_G.\<forall>E(1).&E(2).\<forall>E(1).\<equiv>E(2)" "intro-elim:2")
  AOT_hence \<xi>: \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[P]z]\<close>
    using x_eq
    by (metis "cqt:2"(1) "deduction-theorem" "eq-num:1.unvarify_x.unvarify_G.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "intro-elim:2" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<equiv>E(1)" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<equiv>E(2)")

  AOT_have 0: \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close>
    by "cqt:2"
  AOT_have 1: \<open>[\<lambda>z \<^bold>\<A>[P]z]\<down>\<close>
    by "cqt:2"
  AOT_have \<open>x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[P]z]\<close>
    by (simp add: \<xi>)
  also AOT_have \<open>\<dots> \<equiv> (Numbers(x,[\<lambda>z \<^bold>\<A>[F]z]) \<equiv> Numbers(x,[\<lambda>z \<^bold>\<A>[P]z]))\<close>
    by (metis (no_types, lifting) "0" "1" "cqt:2"(1) "deduction-theorem" "eq-num:1.unvarify_x.unvarify_G.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "eq-num:3.unvarify_G.\<forall>E(1).&E(2).\<forall>E(1).\<equiv>E(1)" "eq-num:4.unvarify_G.\<forall>E(1)" "eq-part:2[terms].\<rightarrow>E" "eq-part:3[terms]" "intro-elim:2" "intro-elim:3:b" "num-tran:1.unvarify_G.unvarify_H.unvarify_x.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<equiv>E(1)" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<equiv>E(2)" \<theta> x_eq)
  also AOT_have \<open>\<dots> \<equiv> Numbers(x,[\<lambda>z \<^bold>\<A>[F]z])\<close>
    by (metis "deduction-theorem" "intro-elim:2" "intro-elim:3:b" \<theta>)
  also AOT_have \<open>\<dots> \<equiv> x = #F\<close>
    by (simp add: "eq-num:1")
  finally AOT_show \<open>x[F] \<equiv> x = #F\<close>.
qed


AOT_theorem unotEu: \<open>\<not>\<exists>y[\<lambda>x D!x & x \<noteq>\<^sub>D x]y\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<exists>y[\<lambda>x D!x & x \<noteq>\<^sub>D x]y\<close>
  then AOT_obtain y where \<open>[\<lambda>x D!x & x \<noteq>\<^sub>D x]y\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence 0: \<open>D!y & y \<noteq>\<^sub>D y\<close>
    by (rule "\<beta>\<rightarrow>C"(1))
  AOT_hence \<open>\<not>(y =\<^sub>D y)\<close>
    using "con-dis-i-e:2:b" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm"
    by blast
  moreover AOT_have \<open>y =\<^sub>D y\<close>
    using "0" "con-dis-i-e:2:a" "cqt:2"(1) "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" by blast
  ultimately AOT_show \<open>p & \<not>p\<close> for p
    by (metis "raa-cor:3")
qed

AOT_define zero :: \<open>\<kappa>\<^sub>s\<close> (\<open>0\<close>)
  "zero:1": \<open>0 =\<^sub>d\<^sub>f #[\<lambda>x D!x & x \<noteq>\<^sub>D x]\<close>

AOT_theorem "zero:2": \<open>0\<down>\<close>
  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"]; rule "num-def:2"[unvarify G]; "cqt:2")

AOT_theorem "zero-card": \<open>NaturalCardinal(0)\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"])
   apply (rule "num-def:2"[unvarify G]; "cqt:2")
  apply (rule card[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  apply (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x [D!]x & x \<noteq>\<^sub>D x]\<guillemotright>\<close>])
   apply (rule "rule=I:1"; rule "num-def:2"[unvarify G]; "cqt:2")
  by "cqt:2"

AOT_theorem "0F:1": \<open>\<not>\<exists>u [F]u \<equiv> Numbers(0, F)\<close>
proof -
  AOT_have unotEu_act_ord: \<open>\<not>\<exists>v[\<lambda>x D!x & \<^bold>\<A>x \<noteq>\<^sub>D x]v\<close>
  proof(rule "raa-cor:2")
    AOT_assume \<open>\<exists>v[\<lambda>x D!x & \<^bold>\<A>x \<noteq>\<^sub>D x]v\<close>
    then AOT_obtain y where \<open>[\<lambda>x D!x & \<^bold>\<A>x \<noteq>\<^sub>D x]y\<close>
      using "\<exists>E"[rotated] "&E" by blast
    AOT_hence 0: \<open>D!y & \<^bold>\<A>y \<noteq>\<^sub>D y\<close>
      by (rule "\<beta>\<rightarrow>C"(1))
    AOT_have \<open>\<^bold>\<A>\<not>(y =\<^sub>D y)\<close>
      apply (AOT_subst  \<open>\<not>(y =\<^sub>D y)\<close> \<open>y \<noteq>\<^sub>D y\<close>)
       apply (meson "\<equiv>E"(2) "Commutativity of \<equiv>" "discern-obj:25")
      by (fact 0[THEN "&E"(2)])
    AOT_hence \<open>\<not>(y =\<^sub>D y)\<close>
      using "Act-Sub:1.\<equiv>E(1)" "cqt:2"(1) "discern-obj:29.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" "reductio-aa:2" by blast
    moreover AOT_have \<open>y =\<^sub>D y\<close>
      by (metis 0[THEN "&E"(1)] "discern-obj:30" "\<rightarrow>E")
    ultimately AOT_show \<open>p & \<not>p\<close> for p
      by (metis "raa-cor:3")
  qed
  AOT_have \<open>Numbers(0, [\<lambda>y \<^bold>\<A>[\<lambda>x D!x & x \<noteq>\<^sub>D x]y])\<close>
    apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "zero:1"])
     apply (rule "num-def:2"[unvarify G]; "cqt:2")
    apply (rule "eq-num:2"[unvarify G])
    by "cqt:2[lambda]"
  AOT_hence numbers0: \<open>Numbers(0, [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x])\<close>
  proof (rule "num-tran2"[unvarify x G H, THEN "\<rightarrow>E", THEN "\<equiv>E"(1), rotated 4])
    AOT_show \<open>[\<lambda>y \<^bold>\<A>[\<lambda>x D!x & x \<noteq>\<^sub>D x]y] \<equiv>\<^sub>D [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]\<close>
    proof (safe intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" Discernible.GEN "\<rightarrow>I" "cqt:2")
      fix u
      AOT_have \<open>[\<lambda>y \<^bold>\<A>[\<lambda>x D!x & x \<noteq>\<^sub>D x]y]u \<equiv> \<^bold>\<A>[\<lambda>x D!x & x \<noteq>\<^sub>D x]u\<close>
        by (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2[lambda]")
      also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>(D!u & u \<noteq>\<^sub>D u)\<close>
        apply (AOT_subst \<open>[\<lambda>x D!x & x \<noteq>\<^sub>D x]u\<close> \<open>D!u & u \<noteq>\<^sub>D u\<close>)
         apply (rule "beta-C-meta"[THEN "\<rightarrow>E"]; "cqt:2[lambda]")
        by (simp add: "oth-class-taut:3:a")
      also AOT_have \<open>\<dots> \<equiv> (\<^bold>\<A>D!u & \<^bold>\<A>u \<noteq>\<^sub>D u)\<close>
        by (simp add: "Act-Basic:2")
      also AOT_have \<open>\<dots> \<equiv> (D!u & \<^bold>\<A>u \<noteq>\<^sub>D u)\<close>
        using "oth-class-taut:4:e" "sc-eq-fur:2" "vdash-properties:6" Discernible.rigid_condition by blast
      also AOT_have \<open>\<dots> \<equiv> [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]u\<close>
        by (rule "beta-C-meta"[THEN "\<rightarrow>E", symmetric]; "cqt:2[lambda]")
      finally AOT_show \<open>[\<lambda>y \<^bold>\<A>[\<lambda>x D!x & x \<noteq>\<^sub>D x]y]u \<equiv> [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]u\<close>.
    qed
  qed(fact "zero:2" | "cqt:2")+
  show ?thesis
  proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
    AOT_assume \<open>\<not>\<exists>u [F]u\<close>
    moreover AOT_have \<open>\<not>\<exists>v [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]v\<close>
      using unotEu_act_ord.
    ultimately AOT_have 0: \<open>F \<approx>\<^sub>D [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]\<close>
      by (rule "empty-approx:1"[unvarify H, THEN "\<rightarrow>E", rotated, OF "&I"]) "cqt:2"
    AOT_thus \<open>Numbers(0, F)\<close>
      by (rule "num-tran:1"[unvarify x H, THEN "\<rightarrow>E",
                            THEN "\<equiv>E"(2), rotated, rotated])
         (fact "zero:2" numbers0 | "cqt:2[lambda]")+
  next
    AOT_assume \<open>Numbers(0, F)\<close>
    AOT_hence 1: \<open>F \<approx>\<^sub>D [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]\<close>
      by (rule "num-tran:2"[unvarify x H, THEN "\<rightarrow>E", rotated 2, OF "&I"])
         (fact numbers0 "zero:2" | "cqt:2[lambda]")+
    AOT_show \<open>\<not>\<exists>u [F]u\<close>
    proof(rule "raa-cor:2")
      AOT_have 0: \<open>[\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x]\<down>\<close> by "cqt:2[lambda]"
      AOT_assume \<open>\<exists>u [F]u\<close>
      AOT_hence \<open>\<not>(F \<approx>\<^sub>D [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x])\<close>
        by (rule "empty-approx:2"[unvarify H, OF 0, THEN "\<rightarrow>E", OF "&I"])
           (rule unotEu_act_ord)
      AOT_thus \<open>F \<approx>\<^sub>D [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x] & \<not>(F \<approx>\<^sub>D [\<lambda>x [D!]x & \<^bold>\<A>x \<noteq>\<^sub>D x])\<close> 
        using 1 "&I" by blast
    qed
  qed
qed

AOT_theorem "0F:2": \<open>\<exists>u [F]u \<equiv> \<exists>x(Numbers(x,F) & x \<noteq> 0)\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume 0: \<open>\<exists>u [F]u\<close>
  AOT_hence \<open>\<exists>x Numbers(x,F)\<close>
    by (meson "cqt:2"(1) "existential:2[const_var]" "num:1.unvarify_G.\<forall>E(1).\<exists>E'")
  then AOT_obtain b where b: \<open>Numbers(b,F)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have \<open>b \<noteq> 0\<close>
  proof(rule "raa-cor:1")
    AOT_assume \<open>\<not>b \<noteq> 0\<close>
    AOT_hence \<open>b = 0\<close>
      using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "reductio-aa:2" "useful-tautologies:3.\<rightarrow>E.\<rightarrow>E" by blast
    AOT_hence \<open>Numbers(0, F)\<close>
      by (meson "rule=E'" b)
    AOT_hence \<open>\<not>\<exists>u [F]u\<close>
      by (simp add: "0F:1.unvarify_F.\<forall>E(1).\<equiv>E(2)" "cqt:2"(1))
    AOT_thus \<open>\<exists>u [F]u & \<not>\<exists>u [F]u\<close>
      using 0 "&I" by blast
  qed
  AOT_hence \<open>Numbers(b, F) & b \<noteq> 0\<close>
    using b "&I" by blast
  AOT_thus \<open>\<exists>x(Numbers(x,F) & x \<noteq> 0)\<close>
    using "\<exists>I" by fast
next
  AOT_assume \<open>\<exists>x(Numbers(x,F) & x \<noteq> 0)\<close>
  then AOT_obtain x where x: \<open>Numbers(x,F) & x \<noteq> 0\<close>
    using "\<exists>E"[rotated] by blast
  AOT_show \<open>\<exists>u [F]u\<close>
  proof(rule "raa-cor:1")
    AOT_assume \<open>\<not>\<exists>u [F]u\<close>
    AOT_hence 1: \<open>Numbers(0, F)\<close>
      by (simp add: "0F:1.unvarify_F.\<forall>E(1).\<equiv>E(1)" "cqt:2"(1))
    AOT_hence \<open>x = 0 \<equiv> F \<approx>\<^sub>D F\<close>
      using "pre-Hume:1"[unvarify y]
      using "con-dis-i-e:2:a" "oth-class-taut:7:a.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" "zero:2" x by blast
    moreover AOT_have \<open>F \<approx>\<^sub>D F\<close>
      by (simp add: "eq-part:1")
    ultimately AOT_have \<open>x = 0\<close>
      using "intro-elim:3:b" by blast
    moreover AOT_have \<open>\<not>x = 0\<close>
      using x
      using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:b" by blast
    ultimately AOT_show \<open>p & \<not>p\<close> for p
      using "raa-cor:4" by blast
  qed
qed

AOT_theorem "0F:3": \<open>\<not>\<exists>u \<^bold>\<A>[F]u \<equiv> #F = 0\<close>
proof(rule "\<equiv>I"; rule "\<rightarrow>I")
  AOT_assume 0: \<open>\<not>\<exists>u \<^bold>\<A>[F]u\<close>
  AOT_have \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
  proof(rule "raa-cor:2")
    AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
    then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
      using "Discernible.\<exists>E"[rotated] by blast
    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
      by (metis "betaC:1:a")
    AOT_hence \<open>\<exists>u \<^bold>\<A>[F]u\<close>
      by (rule "Discernible.\<exists>I")
    AOT_thus \<open>\<exists>u \<^bold>\<A>[F]u & \<not>\<exists>u \<^bold>\<A>[F]u\<close>
      using 0 "&I" by blast
  qed
  AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
    by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)]) "cqt:2"
  AOT_hence \<open>0 = #F\<close>
    by (rule "eq-num:1"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)])
  AOT_thus \<open>#F = 0\<close> using id_sym by blast
next
  AOT_assume \<open>#F = 0\<close>
  AOT_hence \<open>0 = #F\<close> using id_sym by blast
  AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
    by (rule "eq-num:1"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)])
  AOT_hence 0: \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
    by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(2)]) "cqt:2"
  AOT_show \<open>\<not>\<exists>u \<^bold>\<A>[F]u\<close>
  proof(rule "raa-cor:2")
    AOT_assume \<open>\<exists>u \<^bold>\<A>[F]u\<close>
    then AOT_obtain u where \<open>\<^bold>\<A>[F]u\<close>
      using "Discernible.\<exists>E"[rotated] by meson
    AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
      by (auto intro!: "\<beta>\<leftarrow>C" "cqt:2")
    AOT_hence \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
      using "Discernible.\<exists>I" by blast
    AOT_thus \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u & \<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
      using "&I" 0 by blast
  qed
qed


AOT_theorem "0F:4": \<open>\<box>\<not>\<exists>u [F]u \<rightarrow> #F = 0\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>\<box>\<not>\<exists>u [F]u\<close>
  AOT_hence 0: \<open>\<not>\<diamond>\<exists>u [F]u\<close>
    using "KBasic2:1" "\<equiv>E"(1) by blast
  AOT_have \<open>\<not>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
  proof(rule "raa-cor:2")
    AOT_assume \<open>\<exists>u [\<lambda>z \<^bold>\<A>[F]z]u\<close>
    then AOT_obtain u where \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
      using "Discernible.\<exists>E"[rotated] by blast
    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
      by (metis "betaC:1:a")
    AOT_hence \<open>\<diamond>[F]u\<close>
      by (metis "Act-Sub:3" "\<rightarrow>E")
    AOT_hence \<open>\<exists>u \<diamond>[F]u\<close>
      by (rule "Discernible.\<exists>I")
    AOT_hence \<open>\<diamond>\<exists>u [F]u\<close>
      using "Discernible.res-var-bound-reas[CBF\<diamond>]"[THEN "\<rightarrow>E"] by blast
    AOT_thus \<open>\<diamond>\<exists>u [F]u & \<not>\<diamond>\<exists>u [F]u\<close>
      using 0 "&I" by blast
  qed
  AOT_hence \<open>Numbers(0,[\<lambda>z \<^bold>\<A>[F]z])\<close>
    by (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)]) "cqt:2"
  AOT_hence \<open>0 = #F\<close>
    by (rule "eq-num:1"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)])
  AOT_thus \<open>#F = 0\<close> using id_sym by blast
qed

AOT_theorem "0F:5": \<open>w \<Turnstile> \<not>\<exists>u [F]u \<equiv> #[F]\<^sub>w = 0\<close>
proof (rule "rule-id-df:2:b"[OF "w-index", where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
  AOT_show \<open>[\<lambda>x\<^sub>1...x\<^sub>n w \<Turnstile> [F]x\<^sub>1...x\<^sub>n]\<down>\<close>
    by (simp add: "w-rel:3")
next
  AOT_show \<open>w \<Turnstile> \<not>\<exists>u [F]u \<equiv> #[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
  proof (rule "\<equiv>I"; rule "\<rightarrow>I")
    AOT_assume \<open>w \<Turnstile> \<not>\<exists>u [F]u\<close>
    AOT_hence 0: \<open>\<not>w \<Turnstile> \<exists>u [F]u\<close>
      using "coherent:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)] by blast
    AOT_have \<open>\<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
    proof(rule "raa-cor:2")
      AOT_assume \<open>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
      then AOT_obtain u where \<open>\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
        using "Discernible.\<exists>E"[rotated] by meson
      AOT_hence \<open>\<^bold>\<A>w \<Turnstile> [F]u\<close>
        by (AOT_subst (reverse) \<open>w \<Turnstile> [F]u\<close> \<open>[\<lambda>x w \<Turnstile> [F]x]u\<close>;
            safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "w-rel:1"[THEN "\<rightarrow>E"])
           "cqt:2"
      AOT_hence 1: \<open>w \<Turnstile> [F]u\<close>
        using "rigid-truth-at:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
        by blast
      AOT_have \<open>\<box>([F]u \<rightarrow> \<exists>u [F]u)\<close>
        using "Discernible.\<exists>I" "\<rightarrow>I" RN by simp
      AOT_hence \<open>w \<Turnstile> ([F]u \<rightarrow> \<exists>u [F]u)\<close>
        using "fund:2"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(1)]
              "PossibleWorld.\<forall>E" by fast
      AOT_hence \<open>w \<Turnstile> \<exists>u [F]u\<close>
        using 1 "conj-dist-w:2"[unvarify p q, OF "log-prop-prop:2",
                                OF "log-prop-prop:2", THEN "\<equiv>E"(1),
                                THEN "\<rightarrow>E"] by blast
      AOT_thus \<open>w \<Turnstile> \<exists>u [F]u & \<not>w \<Turnstile> \<exists>u [F]u\<close>
        using 0 "&I" by blast
    qed
    AOT_thus \<open>#[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
      by (safe intro!: "0F:3"[unvarify F, THEN "\<equiv>E"(1)] "w-rel:1"[THEN "\<rightarrow>E"])
         "cqt:2"
  next
    AOT_assume \<open>#[\<lambda>x w \<Turnstile> [F]x] = 0\<close>
    AOT_hence 0: \<open>\<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
      by (safe intro!: "0F:3"[unvarify F, THEN "\<equiv>E"(2)] "w-rel:1"[THEN "\<rightarrow>E"])
         "cqt:2"
    AOT_have \<open>\<not>w \<Turnstile> \<exists>u [F]u\<close>
    proof (rule "raa-cor:2")
      AOT_assume \<open>w \<Turnstile> \<exists>u [F]u\<close>
      AOT_hence \<open>\<exists>x w \<Turnstile> (D!x & [F]x)\<close>
        using "conj-dist-w:6"[THEN "\<equiv>E"(1)] by fast
      then AOT_obtain x where \<open>w \<Turnstile> (D!x & [F]x)\<close>
        using "\<exists>E"[rotated] by blast
      AOT_hence \<open>w \<Turnstile> D!x\<close> and Fx_in_w: \<open>w \<Turnstile> [F]x\<close>
        using "conj-dist-w:1"[unvarify p q] "\<equiv>E"(1) "log-prop-prop:2"
              "&E" by blast+
      AOT_hence \<open>\<diamond>D!x\<close>
        using "fund:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
              "PossibleWorld.\<exists>I" by simp
      AOT_hence ord_x: \<open>D!x\<close>
        by (metis "B\<diamond>" "RM\<diamond>" "T\<diamond>" "vdash-properties:10" Discernible.rigid_condition)
      AOT_have \<open>\<^bold>\<A>w \<Turnstile> [F]x\<close>
        using "rigid-truth-at:4"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)]
              Fx_in_w by blast
      AOT_hence \<open>\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x\<close>
        by (AOT_subst \<open>[\<lambda>x w \<Turnstile> [F]x]x\<close> \<open>w \<Turnstile> [F]x\<close>;
            safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "w-rel:1"[THEN "\<rightarrow>E"]) "cqt:2"
      AOT_hence \<open>D!x & \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x\<close>
        using ord_x "&I" by blast
      AOT_hence \<open>\<exists>x (D!x & \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]x)\<close>
        using "\<exists>I" by fast
      AOT_thus \<open>\<exists>u (\<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u) & \<not>\<exists>u \<^bold>\<A>[\<lambda>x w \<Turnstile> [F]x]u\<close>
        using 0 "&I" by blast
    qed
    AOT_thus \<open>w \<Turnstile> \<not>\<exists>u[F]u\<close>
      using "coherent:1"[unvarify p, OF "log-prop-prop:2", THEN "\<equiv>E"(2)] by blast
  qed
qed

AOT_act_theorem "zero=:1":
  \<open>NaturalCardinal(x) \<rightarrow> \<forall>F (x[F] \<equiv> Numbers(x, F))\<close>
proof(safe intro!: "\<rightarrow>I" GEN)
  fix F
  AOT_assume \<open>NaturalCardinal(x)\<close>
  AOT_hence \<open>\<forall>F (x[F] \<equiv> x = #F)\<close>
    by (metis "card-en" "\<rightarrow>E")
  AOT_hence 1: \<open>x[F] \<equiv> x = #F\<close>
    using "\<forall>E"(2) by blast
  AOT_have 2: \<open>x[F] \<equiv> x = \<^bold>\<iota>y(Numbers(y, F))\<close>
    by (rule "num-def:1"[THEN "=\<^sub>d\<^sub>fE"(1)])
       (auto simp: 1 "num-uniq")
  AOT_have \<open>x = \<^bold>\<iota>y(Numbers(y, F)) \<rightarrow> Numbers(x, F)\<close>
    using "y-in:1" by blast
  moreover AOT_have \<open>Numbers(x, F) \<rightarrow> x = \<^bold>\<iota>y(Numbers(y, F))\<close>
  proof(rule "\<rightarrow>I")
    AOT_assume 1: \<open>Numbers(x, F)\<close>
    moreover AOT_obtain z where z_prop: \<open>\<forall>y (Numbers(y, F) \<rightarrow> y = z)\<close>
      using "num:2"[THEN "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"]] "\<exists>E"[rotated] "&E" by blast
    ultimately AOT_have \<open>x = z\<close>
      using "\<forall>E"(2) "\<rightarrow>E" by blast
    AOT_hence \<open>\<forall>y (Numbers(y, F) \<rightarrow> y = x)\<close>
      using z_prop "rule=E" id_sym by fast
    AOT_thus \<open>x = \<^bold>\<iota>y(Numbers(y,F))\<close>
      by (rule hintikka[THEN "\<equiv>E"(2), OF "&I", rotated])
         (fact 1)
  qed
  ultimately AOT_have \<open>x = \<^bold>\<iota>y(Numbers(y, F)) \<equiv> Numbers(x, F)\<close>
    by (metis "\<equiv>I")
  AOT_thus \<open>x[F] \<equiv> Numbers(x, F)\<close>
    using 2 by (metis "\<equiv>E"(5))
qed

AOT_act_theorem "zero=:2": \<open>0[F] \<equiv> \<not>\<exists>u[F]u\<close>
proof -
  AOT_have \<open>0[F] \<equiv> Numbers(0, F)\<close>
    using "zero=:1"[unvarify x, OF "zero:2", THEN "\<rightarrow>E",
                    OF "zero-card", THEN "\<forall>E"(2)].
  also AOT_have \<open>\<dots> \<equiv> \<not>\<exists>u[F]u\<close>
    using "0F:1"[symmetric].
  finally show ?thesis.
qed

AOT_act_theorem "zero=:3": \<open>\<not>\<exists>u[F]u \<equiv> #F = 0\<close>
proof -
  AOT_have \<open>\<not>\<exists>u[F]u \<equiv> 0[F]\<close> using "zero=:2"[symmetric].
  also AOT_have \<open>\<dots> \<equiv> 0 = #F\<close>
    using "card-en"[unvarify x, OF "zero:2", THEN "\<rightarrow>E",
                    OF "zero-card", THEN "\<forall>E"(2)].
  also AOT_have \<open>\<dots> \<equiv> #F = 0\<close>
    by (simp add: "deduction-theorem" id_sym "\<equiv>I")
  finally show ?thesis.
qed

AOT_define Hereditary :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>Hereditary'(_,_')\<close>)
  "hered:1":
  \<open>Hereditary(F, R) \<equiv>\<^sub>d\<^sub>f R\<down> & F\<down> & \<forall>x\<forall>y([R]xy \<rightarrow> ([F]x \<rightarrow> [F]y))\<close>

AOT_theorem "hered:2":
  \<open>[\<lambda>xy \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)]\<down>\<close>
  by "cqt:2[lambda]"

AOT_define StrongAncestral :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> (\<open>_\<^sup>*\<close>)
  "ances-df":
  \<open>R\<^sup>* =\<^sub>d\<^sub>f [\<lambda>xy \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)]\<close>

AOT_theorem "ances":
  \<open>[R\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y)\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "ances-df"])
   apply "cqt:2[lambda]"
  apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF "hered:2", unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
                            where \<tau>=\<open>(_,_)\<close>, simplified])
  by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")

AOT_theorem "anc-her:1":
  \<open>[R]xy \<rightarrow> [R\<^sup>*]xy\<close>
proof (safe intro!: "\<rightarrow>I" ances[THEN "\<equiv>E"(2)] GEN)
  fix F
  AOT_assume \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F, R)\<close>
  AOT_hence \<open>[R]xy \<rightarrow> [F]y\<close>
    using "\<forall>E"(2) "&E" by blast
  moreover AOT_assume \<open>[R]xy\<close>
  ultimately AOT_show \<open>[F]y\<close>
    using "\<rightarrow>E" by blast
qed

AOT_theorem "anc-her:2":
  \<open>([R\<^sup>*]xy & \<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y\<close>
proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
  AOT_assume \<open>[R\<^sup>*]xy\<close>
  AOT_hence \<open>(\<forall>z([R]xz \<rightarrow> [F]z) & Hereditary(F,R)) \<rightarrow> [F]y\<close>
    using ances[THEN "\<equiv>E"(1)] "\<forall>E"(2) by blast
  moreover AOT_assume \<open>\<forall>z([R]xz \<rightarrow> [F]z)\<close>
  moreover AOT_assume \<open>Hereditary(F,R)\<close>
  ultimately AOT_show \<open>[F]y\<close>
    using "\<rightarrow>E" "&I" by blast
qed

AOT_theorem "anc-her:3":
  \<open>([F]x & [R\<^sup>*]xy & Hereditary(F, R)) \<rightarrow> [F]y\<close>
proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
  AOT_assume 1: \<open>[F]x\<close>
  AOT_assume 2: \<open>Hereditary(F, R)\<close>
  AOT_hence 3: \<open>\<forall>x \<forall>y ([R]xy \<rightarrow> ([F]x \<rightarrow> [F]y))\<close>
    using "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_have \<open>\<forall>z ([R]xz \<rightarrow> [F]z)\<close>
  proof (rule GEN; rule "\<rightarrow>I")
    fix z
    AOT_assume \<open>[R]xz\<close>
    moreover AOT_have \<open>[R]xz \<rightarrow> ([F]x \<rightarrow> [F]z)\<close>
      using 3 "\<forall>E"(2) by blast
    ultimately AOT_show \<open>[F]z\<close>
      using 1 "\<rightarrow>E" by blast
  qed
  moreover AOT_assume \<open>[R\<^sup>*]xy\<close>
  ultimately AOT_show \<open>[F]y\<close>
    by (auto intro!: 2 "anc-her:2"[THEN "\<rightarrow>E"] "&I")
qed

AOT_theorem "anc-her:4": \<open>([R]xy & [R\<^sup>*]yz) \<rightarrow> [R\<^sup>*]xz\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume 0: \<open>[R\<^sup>*]yz\<close> and 1: \<open>[R]xy\<close>
  AOT_show \<open>[R\<^sup>*]xz\<close>
  proof(safe intro!: ances[THEN "\<equiv>E"(2)] GEN "&I" "\<rightarrow>I";
                     frule "&E"(1); drule "&E"(2))
    fix F
    AOT_assume \<open>\<forall>z ([R]xz \<rightarrow> [F]z)\<close>
    AOT_hence 1: \<open>[F]y\<close>
      using 1 "\<forall>E"(2) "\<rightarrow>E" by blast
    AOT_assume 2: \<open>Hereditary(F,R)\<close>
    AOT_show \<open>[F]z\<close>
      by (rule "anc-her:3"[THEN "\<rightarrow>E"]; auto intro!: "&I" 1 2 0)
  qed
qed

AOT_theorem "anc-her:5": \<open>[R\<^sup>*]xy \<rightarrow> \<exists>z [R]zy\<close>
proof (rule "\<rightarrow>I")
  AOT_have 0: \<open>[\<lambda>y \<exists>x [R]xy]\<down>\<close> by "cqt:2"
  AOT_assume 1: \<open>[R\<^sup>*]xy\<close>
  AOT_have \<open>[\<lambda>y\<exists>x [R]xy]y\<close>
  proof(rule "anc-her:2"[unvarify F, OF 0, THEN "\<rightarrow>E"];
        safe intro!: "&I" GEN "\<rightarrow>I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2" 0)
    AOT_show \<open>[R\<^sup>*]xy\<close> using 1.
  next
    fix z
    AOT_assume \<open>[R]xz\<close>
    AOT_hence \<open>\<exists>x [R]xz\<close> by (rule "\<exists>I")
    AOT_thus \<open>[\<lambda>y\<exists>x [R]xy]z\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
  next
    fix x y
    AOT_assume \<open>[R]xy\<close>
    AOT_hence \<open>\<exists>x [R]xy\<close> by (rule "\<exists>I")
    AOT_thus \<open>[\<lambda>y \<exists>x [R]xy]y\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
  qed
  AOT_thus \<open>\<exists>z [R]zy\<close>
    by (rule "\<beta>\<rightarrow>C"(1))
qed

AOT_theorem "anc-her:6": \<open>([R\<^sup>*]xy & [R\<^sup>*]yz) \<rightarrow> [R\<^sup>*]xz\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>[R\<^sup>*]xy\<close>
  AOT_hence \<theta>: \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F,R) \<rightarrow> [F]y\<close> for F
    using "\<forall>E"(2)  ances[THEN "\<equiv>E"(1)] by blast
  AOT_assume \<open>[R\<^sup>*]yz\<close>
  AOT_hence \<xi>: \<open>\<forall>z ([R]yz \<rightarrow> [F]z) & Hereditary(F,R) \<rightarrow> [F]z\<close> for F
    using "\<forall>E"(2) ances[THEN "\<equiv>E"(1)] by blast
  AOT_show \<open>[R\<^sup>*]xz\<close>
  proof (rule ances[THEN "\<equiv>E"(2)]; safe intro!: GEN "\<rightarrow>I")
    fix F
    AOT_assume \<zeta>: \<open>\<forall>z ([R]xz \<rightarrow> [F]z) & Hereditary(F,R)\<close>
    AOT_show \<open>[F]z\<close>
    proof (rule \<xi>[THEN "\<rightarrow>E", OF "&I"])
      AOT_show \<open>Hereditary(F,R)\<close>
        using \<zeta>[THEN "&E"(2)].
    next
      AOT_show \<open>\<forall>z ([R]yz \<rightarrow> [F]z)\<close>
      proof(rule GEN; rule "\<rightarrow>I")
        fix z
        AOT_assume \<open>[R]yz\<close>
        moreover AOT_have \<open>[F]y\<close>
          using \<theta>[THEN "\<rightarrow>E", OF \<zeta>].
        ultimately AOT_show \<open>[F]z\<close>
          using \<zeta>[THEN "&E"(2), THEN "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"],
                  THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<forall>E"(2),
                  THEN "\<rightarrow>E", THEN "\<rightarrow>E"]
          by blast
      qed
    qed
  qed
qed

(* TODO: Note: PLM uses a wrongly restricted variable in the proof! Also: this is not cited in the proof of pre-ind. *)
AOT_theorem "anc-her:7": \<open>[G\<^sup>*]xy \<rightarrow> \<exists>z[G]xz\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume A: \<open>[G\<^sup>*]xy\<close>
  AOT_show \<open>\<exists>z[G]xz\<close>
  proof(rule "raa-cor:1")
    fix p
    AOT_assume \<open>\<not>\<exists>z[G]xz\<close>
    AOT_hence \<open>\<forall>y ([G]xy \<rightarrow> [\<lambda>x p & \<not>p]y)\<close>
      by (metis (no_types, lifting) "\<rightarrow>I" "\<exists>I"(2) GEN "useful-tautologies:3.\<rightarrow>E.\<rightarrow>E")
    moreover AOT_have \<open>Hereditary([\<lambda>x p & \<not>p],G)\<close>
      using "beta-C-cor:2.\<rightarrow>E.\<forall>E(1).\<equiv>E(2)" "betaC:1:a" "cqt:2"(1) "prop-prop2:2"
      by (safe intro!: "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" Discernible_den GEN "\<rightarrow>I") blast
    ultimately AOT_have \<open>[\<lambda>x p & \<not>p]y\<close>
      by (safe intro!: "anc-her:2"[unvarify F, THEN "\<rightarrow>E", rotated, OF "&I", OF "&I", OF A] "&I" "cqt:2")
    AOT_thus \<open>p & \<not>p\<close>
      using "betaC:1:a" by blast
  qed
qed

(* TODO: remove START *)
(*
AOT_define RigidOneToOne :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Rigid\<^sub>1\<^sub>-\<^sub>1'(_')\<close>)
  "df-1-1:2": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<equiv>\<^sub>d\<^sub>f 1-1(R) & Rigid(R)\<close>

AOT_theorem "df-1-1:3": \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<rightarrow> \<box>1-1(R)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
  AOT_hence \<open>1-1(R)\<close> and RigidR: \<open>Rigid(R)\<close>
    using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
  AOT_hence 1: \<open>[R]xz & [R]yz \<rightarrow> x = y\<close> for x y z
    using "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2) "\<forall>E"(2) by blast
  AOT_have 1: \<open>[R]xz & [R]yz \<rightarrow> \<box>x = y\<close> for x y z
    by (AOT_subst (reverse) \<open>\<box>x = y\<close>  \<open>x = y\<close>)
       (auto simp: 1 "id-nec:2" "\<equiv>I" "qml:2"[axiom_inst])
  AOT_have \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF RigidR] "&E" by blast
  AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
    using "CBF"[THEN "\<rightarrow>E"] by fast
  AOT_hence \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 \<box>([R]x\<^sub>1x\<^sub>2 \<rightarrow> \<box>[R]x\<^sub>1x\<^sub>2)\<close>
    using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence \<open>\<box>([R]xy \<rightarrow> \<box>[R]xy)\<close> for x y
    using "\<forall>E"(2) by blast
  AOT_hence \<open>\<box>(([R]xz \<rightarrow> \<box>[R]xz) & ([R]yz \<rightarrow> \<box>[R]yz))\<close> for x y z
    by (metis "KBasic:3" "&I" "\<equiv>E"(3) "raa-cor:3")
  moreover AOT_have \<open>\<box>(([R]xz \<rightarrow> \<box>[R]xz) & ([R]yz \<rightarrow> \<box>[R]yz)) \<rightarrow>
                     \<box>(([R]xz & [R]yz) \<rightarrow> \<box>([R]xz & [R]yz))\<close> for x y z
    by (rule RM) (metis "\<rightarrow>I" "KBasic:3" "&I" "&E"(1) "&E"(2) "\<equiv>E"(2) "\<rightarrow>E")
  ultimately AOT_have 2: \<open>\<box>(([R]xz & [R]yz) \<rightarrow> \<box>([R]xz & [R]yz))\<close> for x y z
    using "\<rightarrow>E" by blast
  AOT_hence 3: \<open>\<box>([R]xz & [R]yz \<rightarrow> x = y)\<close> for x y z
    using "sc-eq-box-box:6"[THEN "\<rightarrow>E", THEN "\<rightarrow>E", OF 2, OF 1] by blast
  AOT_hence 4: \<open>\<box>\<forall>x\<forall>y\<forall>z([R]xz & [R]yz \<rightarrow> x = y)\<close>
    by (safe intro!: GEN BF[THEN "\<rightarrow>E"] 3)
  AOT_thus \<open>\<box>1-1(R)\<close>
    by (AOT_subst_thm "df-1-1:1"[THEN "\<equiv>Df", THEN "\<equiv>S"(1),
                                 OF "cqt:2[const_var]"[axiom_inst]])
qed

AOT_theorem "df-1-1:4": \<open>\<forall>R(Rigid\<^sub>1\<^sub>-\<^sub>1(R) \<rightarrow> \<box>Rigid\<^sub>1\<^sub>-\<^sub>1(R))\<close>
proof(rule GEN;rule "\<rightarrow>I")
AOT_modally_strict {
  fix R
      AOT_assume 0: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
      AOT_hence 1: \<open>R\<down>\<close>
        by (meson "\<equiv>\<^sub>d\<^sub>fE" "&E"(1) "df-1-1:1" "df-1-1:2")
      AOT_hence 2: \<open>\<box>R\<down>\<close>
        using "exist-nec" "\<rightarrow>E" by blast
      AOT_have 4: \<open>\<box>1-1(R)\<close>
        using "df-1-1:3"[unvarify R, OF 1, THEN "\<rightarrow>E", OF 0].
      AOT_have \<open>Rigid(R)\<close>
        using 0 "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:2"] "&E" by blast
      AOT_hence \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
        using  "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
      AOT_hence \<open>\<box>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R]x\<^sub>1...x\<^sub>n)\<close>
        by (metis "S5Basic:6" "\<equiv>E"(1))
      AOT_hence \<open>\<box>Rigid(R)\<close>
        apply (AOT_subst_def "df-rigid-rel:1")
        using 2 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
      AOT_thus \<open>\<box>Rigid\<^sub>1\<^sub>-\<^sub>1(R)\<close>
        apply (AOT_subst_def "df-1-1:2")
        using 4 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
}
qed

AOT_define InDomainOf :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> (\<open>InDomainOf'(_,_')\<close>)
  "df-1-1:5": \<open>InDomainOf(x, R) \<equiv>\<^sub>d\<^sub>f \<exists>y [R]xy\<close>

AOT_register_rigid_restricted_type
  RigidOneToOneRelation: \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>)\<close>
proof
  AOT_modally_strict {
    AOT_show \<open>\<exists>\<alpha> Rigid\<^sub>1\<^sub>-\<^sub>1(\<alpha>)\<close>
    proof (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>(=\<^sub>E)\<guillemotright>\<close>])
      AOT_show \<open>Rigid\<^sub>1\<^sub>-\<^sub>1((=\<^sub>E))\<close>
      proof (safe intro!: "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
                          GEN "\<rightarrow>I" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "=E[denotes]")
        fix x y z
        AOT_assume \<open>x =\<^sub>E z & y =\<^sub>E z\<close>
        AOT_thus \<open>x = y\<close>
          by (metis "rule=E" "&E"(1) "Conjunction Simplification"(2)
                    "=E-simple:2" id_sym "\<rightarrow>E")
      next
        AOT_have \<open>\<forall>x\<forall>y \<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close>
        proof(rule GEN; rule GEN)
          AOT_show \<open>\<box>(x =\<^sub>E y \<rightarrow> \<box>x =\<^sub>E y)\<close> for x y
            by (meson RN "deduction-theorem" "id-nec3:1" "\<equiv>E"(1))
        qed
        AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n \<box>([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
          by (rule tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"])
        AOT_thus \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([(=\<^sub>E)]x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[(=\<^sub>E)]x\<^sub>1...x\<^sub>n)\<close>
          using BF[THEN "\<rightarrow>E"] by fast
      qed
    qed(fact "=E[denotes]")
  }
next
  AOT_modally_strict {
    AOT_show \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>) \<rightarrow> \<Pi>\<down>\<close> for \<Pi>
    proof(rule "\<rightarrow>I")
      AOT_assume \<open>Rigid\<^sub>1\<^sub>-\<^sub>1(\<Pi>)\<close>
      AOT_hence \<open>1-1(\<Pi>)\<close>
        using "df-1-1:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
      AOT_thus \<open>\<Pi>\<down>\<close>
        using "df-1-1:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
    qed
  }
next
  AOT_modally_strict {
    AOT_show \<open>\<forall>F(Rigid\<^sub>1\<^sub>-\<^sub>1(F) \<rightarrow> \<box>Rigid\<^sub>1\<^sub>-\<^sub>1(F))\<close>
      by (safe intro!: GEN "df-1-1:4"[THEN "\<forall>E"(2)])
  }
qed
AOT_register_variable_names
  RigidOneToOneRelation: \<R> \<S>

AOT_define IdentityRestrictedToDomain :: \<open>\<tau> \<Rightarrow> \<Pi>\<close> (\<open>'(=\<^sub>_')\<close>)
  "id-d-R": \<open>(=\<^sub>\<R>) =\<^sub>d\<^sub>f [\<lambda>xy \<exists>z ([\<R>]xz & [\<R>]yz)]\<close>

syntax "_AOT_id_d_R_infix" :: \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> \<tau> \<Rightarrow> \<phi>\<close> ("(_ =\<^sub>_/ _)" [50, 51, 51] 50)
translations
  "_AOT_id_d_R_infix \<kappa> \<Pi> \<kappa>'" ==
  "CONST AOT_exe (CONST IdentityRestrictedToDomain \<Pi>) (\<kappa>,\<kappa>')"

AOT_theorem "id-R-thm:1": \<open>x =\<^sub>\<R> y \<equiv> \<exists>z ([\<R>]xz & [\<R>]yz)\<close>
proof -
  AOT_have 0: \<open>[\<lambda>xy \<exists>z ([\<R>]xz & [\<R>]yz)]\<down>\<close> by "cqt:2"
  show ?thesis
    apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
    apply (fact 0)
    apply (rule "beta-C-meta"[THEN "\<rightarrow>E", OF 0, unvarify \<nu>\<^sub>1\<nu>\<^sub>n,
                              where \<tau>=\<open>(_,_)\<close>, simplified])
    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
qed

AOT_theorem "id-R-thm:2":
  \<open>x =\<^sub>\<R> y \<rightarrow> (InDomainOf(x, \<R>) & InDomainOf(y, \<R>))\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>x =\<^sub>\<R> y\<close>
  AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
    using "id-R-thm:1"[THEN "\<equiv>E"(1)] by simp
  then AOT_obtain z where z_prop: \<open>[\<R>]xz & [\<R>]yz\<close>
    using "\<exists>E"[rotated] by blast
  AOT_show \<open>InDomainOf(x, \<R>) & InDomainOf(y, \<R>)\<close>
  proof (safe intro!: "&I" "df-1-1:5"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
    AOT_show \<open>\<exists>y [\<R>]xy\<close>
      using z_prop[THEN "&E"(1)] "\<exists>I" by fast
  next
    AOT_show \<open>\<exists>z [\<R>]yz\<close>
      using z_prop[THEN "&E"(2)] "\<exists>I" by fast
  qed
qed

AOT_theorem "id-R-thm:3": \<open>x =\<^sub>\<R> y \<rightarrow> x = y\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>x =\<^sub>\<R> y\<close>
  AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
    using "id-R-thm:1"[THEN "\<equiv>E"(1)] by simp
  then AOT_obtain z where z_prop: \<open>[\<R>]xz & [\<R>]yz\<close>
    using "\<exists>E"[rotated] by blast
  AOT_thus \<open>x = y\<close>
    using "df-1-1:3"[THEN "\<rightarrow>E", OF RigidOneToOneRelation.\<psi>,
                     THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
                     THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-1-1:1"], THEN "&E"(2),
                     THEN "\<forall>E"(2), THEN "\<forall>E"(2),
                     THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
     by blast
qed

AOT_theorem "id-R-thm:4":
  \<open>(InDomainOf(x, \<R>) \<or> InDomainOf(y, \<R>)) \<rightarrow> (x =\<^sub>\<R> y \<equiv> x = y)\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>InDomainOf(x, \<R>) \<or> InDomainOf(y, \<R>)\<close>
  moreover {
    AOT_assume \<open>InDomainOf(x, \<R>)\<close>
    AOT_hence \<open>\<exists>z [\<R>]xz\<close>
      by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
    then AOT_obtain z where z_prop: \<open>[\<R>]xz\<close>
      using "\<exists>E"[rotated] by blast
    AOT_have \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "id-R-thm:3"[THEN "\<rightarrow>E"])
      AOT_assume \<open>x = y\<close>
      AOT_hence \<open>[\<R>]yz\<close>
        using z_prop "rule=E" by fast
      AOT_hence \<open>[\<R>]xz & [\<R>]yz\<close>
        using z_prop "&I" by blast
      AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
        by (rule "\<exists>I")
      AOT_thus \<open>x =\<^sub>\<R> y\<close>
        using "id-R-thm:1" "\<equiv>E"(2) by blast
    qed
  }
  moreover {
    AOT_assume \<open>InDomainOf(y, \<R>)\<close>
    AOT_hence \<open>\<exists>z [\<R>]yz\<close>
      by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
    then AOT_obtain z where z_prop: \<open>[\<R>]yz\<close>
      using "\<exists>E"[rotated] by blast
    AOT_have \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "id-R-thm:3"[THEN "\<rightarrow>E"])
      AOT_assume \<open>x = y\<close>
      AOT_hence \<open>[\<R>]xz\<close>
        using z_prop "rule=E" id_sym by fast
      AOT_hence \<open>[\<R>]xz & [\<R>]yz\<close>
        using z_prop "&I" by blast
      AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]yz)\<close>
        by (rule "\<exists>I")
      AOT_thus \<open>x =\<^sub>\<R> y\<close>
        using "id-R-thm:1" "\<equiv>E"(2) by blast
    qed
  }
  ultimately AOT_show \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
    by (metis "\<or>E"(2) "raa-cor:1")
qed

AOT_theorem "id-R-thm:5": \<open>InDomainOf(x, \<R>) \<rightarrow> x =\<^sub>\<R> x\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>InDomainOf(x, \<R>)\<close>
  AOT_hence \<open>\<exists>z [\<R>]xz\<close>
    by (metis "\<equiv>\<^sub>d\<^sub>fE" "df-1-1:5")
  then AOT_obtain z where z_prop: \<open>[\<R>]xz\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>[\<R>]xz & [\<R>]xz\<close>
    using "&I" by blast
  AOT_hence \<open>\<exists>z ([\<R>]xz & [\<R>]xz)\<close>
    using "\<exists>I" by fast
  AOT_thus \<open>x =\<^sub>\<R> x\<close>
    using "id-R-thm:1" "\<equiv>E"(2) by blast
qed

AOT_theorem "id-R-thm:6": \<open>x =\<^sub>\<R> y \<rightarrow> y =\<^sub>\<R> x\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 0: \<open>x =\<^sub>\<R> y\<close>
  AOT_hence 1: \<open>InDomainOf(x,\<R>) & InDomainOf(y,\<R>)\<close>
    using "id-R-thm:2"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
  AOT_hence \<open>x = y\<close>
    using 0 by (metis "\<equiv>E"(1))
  AOT_hence \<open>y = x\<close>
    using id_sym by blast
  moreover AOT_have \<open>y =\<^sub>\<R> x \<equiv> y = x\<close>
    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(2)] 1 "&E" by blast
  ultimately AOT_show \<open>y =\<^sub>\<R> x\<close>
    by (metis "\<equiv>E"(2))
qed

AOT_theorem "id-R-thm:7": \<open>x =\<^sub>\<R> y & y =\<^sub>\<R> z \<rightarrow> x =\<^sub>\<R> z\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume 0: \<open>x =\<^sub>\<R> y\<close>
  AOT_hence 1: \<open>InDomainOf(x,\<R>) & InDomainOf(y,\<R>)\<close>
    using "id-R-thm:2"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>x =\<^sub>\<R> y \<equiv> x = y\<close>
    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
  AOT_hence x_eq_y: \<open>x = y\<close>
    using 0 by (metis "\<equiv>E"(1))
  AOT_assume 2: \<open>y =\<^sub>\<R> z\<close>
  AOT_hence 3: \<open>InDomainOf(y,\<R>) & InDomainOf(z,\<R>)\<close>
    using "id-R-thm:2"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>y =\<^sub>\<R> z \<equiv> y = z\<close>
    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
  AOT_hence \<open>y = z\<close>
    using 2 by (metis "\<equiv>E"(1))
  AOT_hence x_eq_z: \<open>x = z\<close>
    using x_eq_y id_trans by blast
  AOT_have \<open>InDomainOf(x,\<R>) & InDomainOf(z,\<R>)\<close>
    using 1 3 "&I" "&E" by meson
  AOT_hence \<open>x =\<^sub>\<R> z \<equiv> x = z\<close>
    using "id-R-thm:4"[THEN "\<rightarrow>E", OF "\<or>I"(1)] "&E" by blast
  AOT_thus \<open>x =\<^sub>\<R> z\<close>
    using x_eq_z "\<equiv>E"(2) by blast
qed
*)
(* TODO: remove END *)

(* TODO: note: this is in PLM, but doesn't seem to be needed! *)


AOT_define OnDiscernibles2 :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>OnDiscernibles\<^sup>2'(_')\<close>)
  "df-rel-dis[2]": \<open>OnDiscernibles\<^sup>2(\<Pi>) \<equiv>\<^sub>d\<^sub>f \<Pi>\<down> & \<box>\<forall>x\<^sub>1\<forall>x\<^sub>2([\<Pi>]x\<^sub>1x\<^sub>2 \<rightarrow> ([D!]x\<^sub>1 & [D!]x\<^sub>2))\<close>

AOT_register_rigid_restricted_type
  OnDiscernibles: \<open>OnDiscernibles\<^sup>2(\<guillemotleft>\<Pi>::<\<kappa>\<times>\<kappa>>\<guillemotright>)\<close>
proof
  AOT_modally_strict {
    AOT_show \<open>\<exists>F OnDiscernibles\<^sup>2(F)\<close>
    proof(rule "\<exists>I")
      AOT_show \<open>OnDiscernibles\<^sup>2([\<lambda>xy D!x & D!y])\<close>
      proof(safe intro!: "df-rel-dis[2]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" RN GEN "cqt:2")
        AOT_modally_strict {
          fix x y
          AOT_show \<open>[\<lambda>xy D!x & D!y]xy \<rightarrow> (D!x & D!y)\<close>
            using "betaC:1:a" "deduction-theorem" by fastforce
        }
      qed
    next
      AOT_show \<open>[\<lambda>xy D!x & D!y]\<down>\<close>
        by "cqt:2"
    qed
  }
next
  AOT_modally_strict {
    AOT_show \<open>OnDiscernibles\<^sup>2(\<Pi>) \<rightarrow> \<Pi>\<down>\<close> for \<Pi>
      by (simp add: "deduction-theorem" "df-rel-dis[2].\<equiv>\<^sub>d\<^sub>fE.&E(1)")
  }
next
  AOT_modally_strict {
    AOT_show \<open>\<forall>F (OnDiscernibles\<^sup>2(F) \<rightarrow> \<box>OnDiscernibles\<^sup>2(F))\<close>
    proof(safe intro!: GEN "\<rightarrow>I")
      fix F
      AOT_assume \<open>OnDiscernibles\<^sup>2(F)\<close>
      AOT_hence "F\<down> & \<box>\<forall>x\<^sub>1\<forall>x\<^sub>2([F]x\<^sub>1x\<^sub>2 \<rightarrow> ([D!]x\<^sub>1 & [D!]x\<^sub>2))"
        using "df-rel-dis[2]"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
      AOT_hence "\<box>(F\<down> & \<box>\<forall>x\<^sub>1\<forall>x\<^sub>2([F]x\<^sub>1x\<^sub>2 \<rightarrow> ([D!]x\<^sub>1 & [D!]x\<^sub>2)))"
        by (meson "KBasic:3.\<equiv>E(2)" "S5Basic:5.\<rightarrow>E" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "ex:2:a")
      AOT_thus \<open>\<box>OnDiscernibles\<^sup>2(F)\<close>
        using "RM:1.\<rightarrow>E" "df-rel-dis[2]" "df-rules-formulas[4]" by blast
    qed
  }
qed
AOT_register_variable_names
  OnDiscernibles: \<R> \<S>

AOT_theorem OnDiscerniblesE: \<open>[\<R>]xy \<rightarrow> (D!x & D!y)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>[\<R>]xy\<close>
  moreover {
    AOT_have \<open>\<box>\<forall>x\<^sub>1\<forall>x\<^sub>2([\<R>]x\<^sub>1x\<^sub>2 \<rightarrow> ([D!]x\<^sub>1 & [D!]x\<^sub>2))\<close>
      using "df-rel-dis[2]"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF OnDiscernibles.\<psi>, THEN "&E"(2)]
      by blast
    AOT_hence \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2([\<R>]x\<^sub>1x\<^sub>2 \<rightarrow> ([D!]x\<^sub>1 & [D!]x\<^sub>2))\<close>
      using "S5Basic:2.\<equiv>E(1)" "S5Basic:4.\<rightarrow>E" by blast
  }
  ultimately AOT_show \<open>D!x & D!y\<close>
    using "rule-ui:2[const_var]" "vdash-properties:10" by blast
qed

AOT_define WeakAncestral :: \<open>\<Pi> \<Rightarrow> \<Pi>\<close> (\<open>_\<^sup>+\<close>)
  "w-ances-df": \<open>[\<R>]\<^sup>+ =\<^sub>d\<^sub>f [\<lambda>xy [\<R>]\<^sup>*xy \<or> x =\<^sub>D y]\<close>

AOT_theorem "w-ances-df[den1]": \<open>[\<lambda>xy [\<R>]\<^sup>*xy \<or> x =\<^sub>D y]\<down>\<close>
  by "cqt:2"
AOT_theorem "w-ances-df[den2]": \<open>[\<R>]\<^sup>+\<down>\<close>
  using "w-ances-df[den1]" "=\<^sub>d\<^sub>fI"(1)[OF "w-ances-df"] by blast

AOT_theorem "w-ances": \<open>[\<R>]\<^sup>+xy \<equiv> [\<R>]\<^sup>*xy \<or> x =\<^sub>D y\<close>
proof -
  AOT_have 1: \<open>\<guillemotleft>(AOT_term_of_var x,AOT_term_of_var y)\<guillemotright>\<down>\<close>
    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
  show ?thesis
    apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "w-ances-df"])
     apply (fact "w-ances-df[den1]")
    by (metis (no_types, lifting) "w-ances-df[den1]" "1" "betaC:1:a" "betaC:2:a" "deduction-theorem" "intro-elim:2" case_prod_conv)
qed

AOT_theorem "wances-her:1": \<open>[\<R>]xy \<rightarrow> [\<R>]\<^sup>+xy\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>[\<R>]xy\<close>
  AOT_hence \<open>[\<R>]\<^sup>*xy\<close>
    using "anc-her:1"[THEN "\<rightarrow>E"] by blast
  AOT_thus \<open>[\<R>]\<^sup>+xy\<close>
    using "w-ances"[THEN "\<equiv>E"(2)] "\<or>I" by blast
qed

AOT_theorem "wances-her:2":
  \<open>[F]x & [\<R>]\<^sup>+xy & Hereditary(F, \<R>) \<rightarrow> [F]y\<close>
proof(rule "\<rightarrow>I"; (frule "&E"(1); drule "&E"(2))+)
  AOT_assume 0: \<open>[F]x\<close>
  AOT_assume 1: \<open>Hereditary(F, \<R>)\<close>
  AOT_assume \<open>[\<R>]\<^sup>+xy\<close>
  AOT_hence \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>D y\<close>
    using "w-ances"[THEN "\<equiv>E"(1)] by simp
  moreover {
    AOT_assume \<open>[\<R>]\<^sup>*xy\<close>
    AOT_hence \<open>[F]y\<close>
      using "anc-her:3"[THEN "\<rightarrow>E", OF "&I", OF "&I"] 0 1 by blast
  }
  moreover {
    AOT_assume \<open>x =\<^sub>D y\<close>
    AOT_hence \<open>x = y\<close>
      using "discern-obj:19" "vdash-properties:10" by blast
    AOT_hence \<open>[F]y\<close>
      using 0 "rule=E" by blast
  }
  ultimately AOT_show \<open>[F]y\<close>
    by (metis "\<or>E"(3) "raa-cor:1")
qed

AOT_theorem "wances-her:3": \<open>([\<R>]\<^sup>+xy & [\<R>]yz) \<rightarrow> [\<R>]\<^sup>*xz\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>[\<R>]\<^sup>+xy\<close>
  moreover AOT_assume Ryz: \<open>[\<R>]yz\<close>
  ultimately AOT_have \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>D y\<close>
    using "w-ances"[THEN "\<equiv>E"(1)] by metis
  moreover {
    AOT_assume R_star_xy: \<open>[\<R>]\<^sup>*xy\<close>
    AOT_have \<open>[\<R>]\<^sup>*xz\<close>
    proof (safe intro!: ances[THEN "\<equiv>E"(2)] "\<rightarrow>I" GEN)
      fix F
      AOT_assume 0: \<open>\<forall>z ([\<R>]xz \<rightarrow> [F]z) & Hereditary(F,\<R>)\<close>
      AOT_hence \<open>[F]y\<close>
        using R_star_xy ances[THEN "\<equiv>E"(1), OF R_star_xy,
                              THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
      AOT_thus \<open>[F]z\<close>
        using "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 0[THEN "&E"(2)], THEN "&E"(2)]
              "\<forall>E"(2) "\<rightarrow>E" Ryz by blast
    qed
  }
  moreover {
    AOT_assume \<open>x =\<^sub>D y\<close>
    AOT_hence \<open>x = y\<close>
      using "discern-obj:19" "vdash-properties:10" by blast
    AOT_hence \<open>[\<R>]xz\<close>
      using Ryz "rule=E" id_sym by fast
    AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
      by (metis "anc-her:1"[THEN "\<rightarrow>E"])
  }
  ultimately AOT_show \<open>[\<R>]\<^sup>*xz\<close>
    by (metis "\<or>E"(3) "raa-cor:1")
qed

AOT_theorem "wances-her:4": \<open>([\<R>]\<^sup>*xy & [\<R>]yz) \<rightarrow> [\<R>]\<^sup>+xz\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>[\<R>]\<^sup>*xy\<close>
  AOT_hence \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>D y\<close>
    using "\<or>I" by blast
  AOT_hence \<open>[\<R>]\<^sup>+xy\<close>
    using "w-ances"[THEN "\<equiv>E"(2)] by blast
  moreover AOT_assume \<open>[\<R>]yz\<close>
  ultimately AOT_have \<open>[\<R>]\<^sup>*xz\<close>
    using "wances-her:3"[THEN "\<rightarrow>E", OF "&I"] by simp
  AOT_hence \<open>[\<R>]\<^sup>*xz \<or> x =\<^sub>D z\<close>
    using "\<or>I" by blast
  AOT_thus \<open>[\<R>]\<^sup>+xz\<close>
    using "w-ances"[THEN "\<equiv>E"(2)] by blast
qed

AOT_theorem "wances-her:5": \<open>([\<R>]xy & [\<R>]\<^sup>+yz) \<rightarrow> [\<R>]\<^sup>*xz\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume 0: \<open>[\<R>]xy\<close>
  AOT_assume \<open>[\<R>]\<^sup>+yz\<close>
  AOT_hence \<open>[\<R>]\<^sup>*yz \<or> y =\<^sub>D z\<close>
    by (metis "\<equiv>E"(1) "w-ances")
  moreover {
    AOT_assume \<open>[\<R>]\<^sup>*yz\<close>
    AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
      using 0 by (metis "anc-her:4" Adjunction "\<rightarrow>E")
  }
  moreover {
    AOT_assume \<open>y =\<^sub>D z\<close>
    AOT_hence \<open>y = z\<close>
      using "discern-obj:19" "vdash-properties:10" by blast
    AOT_hence \<open>[\<R>]xz\<close>
      using 0 "rule=E" by fast
    AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
      by (metis "anc-her:1" "\<rightarrow>E")
  }
  ultimately AOT_show \<open>[\<R>]\<^sup>*xz\<close> by (metis "\<or>E"(2) "reductio-aa:1")
qed

AOT_theorem "wances-her:6": \<open>([\<R>]\<^sup>+xy & [\<R>]\<^sup>+yz) \<rightarrow> [\<R>]\<^sup>+xz\<close>
proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume 0: \<open>[\<R>]\<^sup>+xy\<close>
  AOT_hence 1: \<open>[\<R>]\<^sup>*xy \<or> x =\<^sub>D y\<close>
    by (metis "\<equiv>E"(1) "w-ances")
  AOT_assume 2: \<open>[\<R>]\<^sup>+yz\<close>
  {
    AOT_assume \<open>x =\<^sub>D y\<close>
    AOT_hence \<open>x = y\<close>
      using "discern-obj:19" "vdash-properties:10" by blast
    AOT_hence \<open>[\<R>]\<^sup>+xz\<close>
      using 2 "rule=E" id_sym by fast
  }
  moreover {
    AOT_assume \<open>\<not>(x =\<^sub>D y)\<close>
    AOT_hence 3: \<open>[\<R>]\<^sup>*xy\<close>
      using 1 by (metis "\<or>E"(3)) 
    AOT_have \<open>[\<R>]\<^sup>*yz \<or> y =\<^sub>D z\<close>
      using 2 by (metis "\<equiv>E"(1) "w-ances")
    moreover {
      AOT_assume \<open>[\<R>]\<^sup>*yz\<close>
      AOT_hence \<open>[\<R>]\<^sup>*xz\<close>
        using 3 by (metis "anc-her:6" Adjunction "\<rightarrow>E")
      AOT_hence \<open>[\<R>]\<^sup>+xz\<close>
        by (metis "\<or>I"(1) "\<equiv>E"(2) "w-ances")
    }
    moreover {
      AOT_assume \<open>y =\<^sub>D z\<close>
      AOT_hence \<open>y = z\<close>
        using "discern-obj:19" "vdash-properties:6" by blast
      AOT_hence \<open>[\<R>]\<^sup>+xz\<close>
        using 0 "rule=E" by fast
    }
    ultimately AOT_have \<open>[\<R>]\<^sup>+xz\<close>
      by (metis "\<or>E"(3) "reductio-aa:1")
  }
  ultimately AOT_show \<open>[\<R>]\<^sup>+xz\<close>
    by (metis "reductio-aa:1")
qed

AOT_theorem "wances-her:7":  \<open>[\<R>]\<^sup>*xy \<rightarrow> \<exists>z([\<R>]\<^sup>+xz & [\<R>]zy)\<close>
proof(rule "\<rightarrow>I")
  AOT_assume 0: \<open>[\<R>]\<^sup>*xy\<close>
  AOT_have 1: \<open>\<forall>z ([\<R>]xz \<rightarrow> [\<Pi>]z) & Hereditary(\<Pi>,\<R>) \<rightarrow> [\<Pi>]y\<close> if \<open>\<Pi>\<down>\<close> for \<Pi>
    using ances[THEN "\<equiv>E"(1), THEN "\<forall>E"(1), OF 0] that by blast
  AOT_have \<open>[\<lambda>y \<exists>z([\<R>]\<^sup>+xz & [\<R>]zy)]y\<close>
  proof (rule 1[THEN "\<rightarrow>E"]; "cqt:2[lambda]"?;
         safe intro!: "&I" GEN "\<rightarrow>I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2")
    fix z
    AOT_assume 0: \<open>[\<R>]xz\<close>
    AOT_hence \<open>D!x\<close>
      using OnDiscerniblesE[THEN "\<rightarrow>E"] "&E" by blast
    AOT_hence \<open>x =\<^sub>D x\<close>
      using "discern-obj:30" "vdash-properties:6" by blast
    AOT_hence \<open>[\<R>]\<^sup>+xx\<close> by (metis "\<or>I"(2) "\<equiv>E"(2) "w-ances")
    AOT_hence \<open>[\<R>]\<^sup>+xx & [\<R>]xz\<close> using 0 "&I" by blast
    AOT_hence \<open>\<exists>y ([\<R>]\<^sup>+xy & [\<R>]yz)\<close> by (rule "\<exists>I")
    AOT_thus \<open>[\<lambda>y \<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)]z\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
  next
    fix x' y
    AOT_assume Rx'y: \<open>[\<R>]x'y\<close>
    AOT_assume \<open>[\<lambda>y \<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)]x'\<close>
    AOT_hence \<open>\<exists>z ([\<R>]\<^sup>+xz & [\<R>]zx')\<close>
      using "\<beta>\<rightarrow>C"(1) by blast
    then AOT_obtain c where c_prop: \<open>[\<R>]\<^sup>+xc & [\<R>]cx'\<close>
      using "\<exists>E"[rotated] by blast
    AOT_hence \<open>[\<R>]\<^sup>*xx'\<close>
      by (meson Rx'y "anc-her:1" "anc-her:6" Adjunction "\<rightarrow>E" "wances-her:3")
    AOT_hence \<open>[\<R>]\<^sup>*xx' \<or> x =\<^sub>D x'\<close> by (rule "\<or>I")
    AOT_hence \<open>[\<R>]\<^sup>+xx'\<close> by (metis "\<equiv>E"(2) "w-ances")
    AOT_hence \<open>[\<R>]\<^sup>+xx' & [\<R>]x'y\<close> using Rx'y by (metis "&I")
    AOT_hence \<open>\<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)\<close> by (rule "\<exists>I")
    AOT_thus \<open>[\<lambda>y \<exists>z ([\<R>]\<^sup>+xz & [\<R>]zy)]y\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
  qed
  AOT_thus \<open>\<exists>z([\<R>]\<^sup>+xz & [\<R>]zy)\<close>
    using "\<beta>\<rightarrow>C"(1) by fast
qed

AOT_define OneToOne :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>1-1'(_')\<close>)
  "1-1-R:1": \<open>1-1(\<R>) \<equiv>\<^sub>d\<^sub>f \<R>\<down> & \<forall>x\<forall>y\<forall>z([\<R>]xz & [\<R>]yz \<rightarrow> x = y)\<close>


AOT_theorem "1-1-R:2": \<open>1-1(\<R>) \<rightarrow> (([\<R>]xy & [\<R>]\<^sup>*zy) \<rightarrow> [\<R>]\<^sup>+zx)\<close>
proof(rule "\<rightarrow>I"; rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume 0: \<open>1-1(\<R>)\<close>
  AOT_assume \<open>[\<R>]\<^sup>*zy\<close>
  AOT_hence \<open>\<exists>x ([\<R>]\<^sup>+zx & [\<R>]xy)\<close>
    using "wances-her:7"[THEN "\<rightarrow>E"]
    by simp
  then AOT_obtain a where a_prop: \<open>[\<R>]\<^sup>+za & [\<R>]ay\<close>
    using "\<exists>E"[rotated] by blast
  moreover AOT_assume \<open>[\<R>]xy\<close>
  ultimately AOT_have \<open>x = a\<close>
    by (metis "0" "1-1-R:1.\<equiv>\<^sub>d\<^sub>fE.&E(2).&E(2).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "con-dis-i-e:1" "con-dis-i-e:2:b" "cqt:2"(1) "rule=I:1")
  AOT_thus \<open>[\<R>]\<^sup>+zx\<close>
    using a_prop[THEN "&E"(1)] "rule=E" id_sym by fast
qed

AOT_theorem "1-1-R:3": \<open>1-1(\<R>) \<rightarrow> ([\<R>]xy \<rightarrow> (\<not>[\<R>]\<^sup>*xx \<rightarrow> \<not>[\<R>]\<^sup>*yy))\<close>
proof(rule "\<rightarrow>I"; rule "\<rightarrow>I"; rule "useful-tautologies:5"[THEN "\<rightarrow>E"]; rule "\<rightarrow>I")
  AOT_assume one_to_one: \<open>1-1(\<R>)\<close>
  AOT_assume 0: \<open>[\<R>]xy\<close>
  moreover AOT_assume \<open>[\<R>]\<^sup>*yy\<close>
  ultimately AOT_have \<open>[\<R>]\<^sup>+yx\<close>
    using "1-1-R:2"[THEN "\<rightarrow>E", OF one_to_one, THEN "\<rightarrow>E", OF "&I"] by blast
  AOT_thus \<open>[\<R>]\<^sup>*xx\<close>
    using 0 by (metis "&I" "\<rightarrow>E" "wances-her:5")
qed

AOT_theorem "1-1-R:4":  \<open>1-1(\<R>) \<rightarrow> (\<not>[\<R>]\<^sup>*xx \<rightarrow> ([\<R>]\<^sup>+xy \<rightarrow> \<not>[\<R>]\<^sup>*yy))\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume one_to_one: \<open>1-1(\<R>)\<close>
  AOT_have 0: \<open>[\<lambda>z \<not>[\<R>]\<^sup>*zz]\<down>\<close> by "cqt:2"
  AOT_assume 1: \<open>\<not>[\<R>]\<^sup>*xx\<close>
  AOT_assume 2: \<open>[\<R>]\<^sup>+xy\<close>
  AOT_have \<open>[\<lambda>z \<not>[\<R>]\<^sup>*zz]y\<close>
  proof(rule "wances-her:2"[unvarify F, OF 0, THEN "\<rightarrow>E"];
        safe intro!: "&I" "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "cqt:2" GEN "\<rightarrow>I")
    AOT_show  \<open>[\<lambda>z \<not>[\<R>]\<^sup>*zz]x\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" simp: 1)
  next
    AOT_show \<open>[\<R>]\<^sup>+xy\<close> by (fact 2)
  next
    fix x y
    AOT_assume \<open>[\<lambda>z \<not>[\<R>\<^sup>*]zz]x\<close>
    AOT_hence \<open>\<not>[\<R>]\<^sup>*xx\<close> by (rule "\<beta>\<rightarrow>C"(1))
    moreover AOT_assume \<open>[\<R>]xy\<close>
    ultimately AOT_have \<open>\<not>[\<R>]\<^sup>*yy\<close>
      by (meson "1-1-R:3.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) OnDiscernibles.restricted_var_condition one_to_one)
    AOT_thus \<open>[\<lambda>z \<not>[\<R>\<^sup>*]zz]y\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
  qed
  AOT_thus \<open>\<not>[\<R>]\<^sup>*yy\<close>
    using "\<beta>\<rightarrow>C"(1) by blast
qed

(*** NOTE: PLM skips over the subproof of D!z ***)
AOT_theorem "pre-ind":
  \<open>([F]z & \<forall>x\<forall>y(([\<R>]\<^sup>+zx & [\<R>]\<^sup>+zy) \<rightarrow> ([\<R>]xy \<rightarrow> ([F]x \<rightarrow> [F]y)))) \<rightarrow>
   \<forall>x ([\<R>]\<^sup>+zx \<rightarrow> [F]x)\<close>
proof(safe intro!: "\<rightarrow>I" GEN)
  AOT_have den: \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]\<down>\<close> by "cqt:2"
  fix x
  AOT_assume \<theta>: \<open>[F]z & \<forall>x\<forall>y(([\<R>]\<^sup>+zx & [\<R>]\<^sup>+zy) \<rightarrow> ([\<R>]xy \<rightarrow> ([F]x \<rightarrow> [F]y)))\<close>
  AOT_assume 0: \<open>[\<R>]\<^sup>+zx\<close>
  AOT_hence \<open>[\<R>]\<^sup>*zx \<or> z =\<^sub>D x\<close>
    by (simp add: "cqt:2"(1) "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)" OnDiscernibles.restricted_var_condition)
  moreover AOT_have OnDisc: \<open>[\<R>]xy \<rightarrow> (D!x & D!y)\<close> for x y
    using OnDiscerniblesE by blast
  moreover {
    thm "anc-her:7"
    AOT_assume 1: \<open>[\<R>]\<^sup>*zx\<close>
    (* TODO: this is nontrivially dependent on anc-her:7, which is not cited by PLM *)
    AOT_hence \<open>D!z\<close>
      by (meson "anc-her:7.unvarify_G.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<exists>E'" "con-dis-taut:1" "cqt:2"(1) "oth-class-taut:4:a.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" OnDiscerniblesE)
  }
  moreover {
    AOT_assume \<open>z =\<^sub>D x\<close>
    AOT_hence \<open>D!z\<close>
      using "discern-obj:20.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(1).&E(1)" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by force
  }
  ultimately AOT_have Dz: \<open>D!z\<close>
    using "con-dis-i-e:4:c" "raa-cor:2" by blast
  AOT_have \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]x\<close>
  proof (rule "wances-her:2"[unvarify F, OF den, THEN "\<rightarrow>E"]; safe intro!: "&I")
    AOT_show \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]z\<close>
    proof (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I")
      AOT_show \<open>[F]z\<close> using \<theta> "&E" by blast
    next
      AOT_show \<open>[\<R>]\<^sup>+zz\<close>
        apply (rule "w-ances"[THEN "\<equiv>E"(2), OF "\<or>I"(2)])
        by (simp add: "cqt:2"(1) "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" Dz)
    qed
  next
    AOT_show \<open>[\<R>]\<^sup>+zx\<close> by (fact 0)
  next
    AOT_show \<open>Hereditary([\<lambda>y [F]y & [\<R>]\<^sup>+zy],\<R>)\<close>
    proof (safe intro!: "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I")
      fix x' y
      AOT_assume 1: \<open>[\<R>]x'y\<close>
      AOT_assume \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]x'\<close>
      AOT_hence 2: \<open>[F]x' & [\<R>]\<^sup>+zx'\<close> by (rule "\<beta>\<rightarrow>C"(1))
      AOT_have \<open>[\<R>]\<^sup>*zy\<close> using 1 2[THEN "&E"(2)]
        by (metis Adjunction "modus-tollens:1" "reductio-aa:1" "wances-her:3")
      AOT_hence 3: \<open>[\<R>]\<^sup>+zy\<close> by (metis "\<or>I"(1) "\<equiv>E"(2) "w-ances")
      AOT_show \<open>[\<lambda>y [F]y & [\<R>]\<^sup>+zy]y\<close>
      proof (safe intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "&I" 3)
        AOT_show \<open>[F]y\<close>
        proof (rule \<theta>[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<forall>E"(2),
                      THEN "\<rightarrow>E", THEN "\<rightarrow>E", THEN "\<rightarrow>E"])
          AOT_show \<open>[\<R>]\<^sup>+zx' & [\<R>]\<^sup>+zy\<close>
            using 2 3 "&E" "&I" by blast
        next
          AOT_show \<open>[\<R>]x'y\<close> by (fact 1)
        next
          AOT_show \<open>[F]x'\<close> using 2 "&E" by blast
        qed
      qed
    qed
  qed
  AOT_thus \<open>[F]x\<close> using "\<beta>\<rightarrow>C"(1) "&E"(1) by fast
qed

text\<open>The following is not part of PLM, but a theorem of AOT.
     It states that the predecessor relation coexists with numbering a property.
     We will use this fact to derive the predecessor axiom, which asserts that the
     predecessor relation denotes, from the fact that our models validate that
     numbering a property denotes.\<close>

AOT_theorem pred_coex:
  \<open>[\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<down> \<equiv> \<forall>F ([\<lambda>x Numbers(x,F)]\<down>)\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
  fix F
  let ?P = \<open>\<guillemotleft>[\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<guillemotright>\<close>
  AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
  AOT_hence \<open>\<box>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
    using "exist-nec" "\<rightarrow>E" by blast
  moreover AOT_have
    \<open>\<box>[\<guillemotleft>?P\<guillemotright>]\<down> \<rightarrow> \<box>(\<forall>x\<forall>y(\<forall>F([F]x \<equiv> [F]y) \<rightarrow> (Numbers(x,F) \<equiv> Numbers(y,F))))\<close>
  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
    AOT_modally_strict {
      fix x y
      AOT_assume pred_den: \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
      AOT_hence pred_equiv:
        \<open>[\<guillemotleft>?P\<guillemotright>]xy \<equiv> \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close> for x y
        by (safe intro!: "beta-C-meta"[unvarify \<nu>\<^sub>1\<nu>\<^sub>n, where \<tau>=\<open>(_,_)\<close>, THEN "\<rightarrow>E",
                                       rotated, OF pred_den, simplified]
                         tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2")
      text\<open>We show as a subproof that any natural cardinal that is not zero
           has a predecessor.\<close>
      AOT_have CardinalPredecessor:
        \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close> if card_x: \<open>NaturalCardinal(x)\<close> and x_nonzero: \<open>x \<noteq> 0\<close> for x
      proof -
        AOT_have \<open>\<exists>G x = #G\<close>
          using card[THEN "\<equiv>\<^sub>d\<^sub>fE", OF card_x].
        AOT_hence \<open>\<exists>G Numbers(x,G)\<close>
          using "eq-df-num:2"[THEN "\<equiv>E"(1)] by blast
        then AOT_obtain G' where numxG': \<open>Numbers(x,G')\<close>
          using "\<exists>E"[rotated] by blast
        AOT_obtain G where \<open>Rigidifies(G,G')\<close>
          using "rigid-der:3" "\<exists>E"[rotated] by blast
      
        AOT_hence H: \<open>Rigid(G) & \<forall>x ([G]x \<equiv> [G']x)\<close>
          using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
        AOT_have H_rigid: \<open>\<box>\<forall>x ([G]x \<rightarrow> \<box>[G]x)\<close>
          using H[THEN "&E"(1), THEN "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "&E"(2)].
        AOT_hence \<open>\<forall>x \<box>([G]x \<rightarrow> \<box>[G]x)\<close>
          using "CBF" "\<rightarrow>E" by blast
        AOT_hence R: \<open>\<box>([G]x \<rightarrow> \<box>[G]x)\<close> for x using "\<forall>E"(2) by blast
        AOT_hence rigid: \<open>[G]x \<equiv> \<^bold>\<A>[G]x\<close> for x
           by (metis "\<equiv>E"(6) "oth-class-taut:3:a" "sc-eq-fur:2" "\<rightarrow>E")
        AOT_have \<open>G \<equiv>\<^sub>D G'\<close>
        proof (safe intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I")
          AOT_show \<open>[G]x \<equiv> [G']x\<close> for x using H[THEN "&E"(2)] "\<forall>E"(2) by fast
        qed
        AOT_hence \<open>G \<approx>\<^sub>D G'\<close>
          by (rule "apE-eqE:2"[THEN "\<rightarrow>E", OF "&I", rotated])
             (simp add: "eq-part:1")
        AOT_hence numxG: \<open>Numbers(x,G)\<close>
          using "num-tran:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2)] numxG' by blast
      
        {
          AOT_assume \<open>\<not>\<exists>y(y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
          AOT_hence \<open>\<forall>y \<not>(y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
            using "cqt-further:4" "\<rightarrow>E" by blast
          AOT_hence \<open>\<not>(y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close> for y
            using "\<forall>E"(2) by blast
          AOT_hence 0: \<open>\<not>y \<noteq> x \<or> \<not>[\<guillemotleft>?P\<guillemotright>]yx\<close> for y
            using "\<not>\<not>E" "intro-elim:3:c" "oth-class-taut:5:a" by blast
          {
            fix y
            AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]yx\<close>
            AOT_hence \<open>\<not>y \<noteq> x\<close>
              using 0 "\<not>\<not>I" "con-dis-i-e:4:c" by blast
            AOT_hence \<open>y = x\<close>
              using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "raa-cor:4" by blast
          } note Pxy_imp_eq = this
          AOT_have \<open>[\<guillemotleft>?P\<guillemotright>]xx\<close>
          proof(rule "raa-cor:1")
            AOT_assume notPxx: \<open>\<not>[\<guillemotleft>?P\<guillemotright>]xx\<close>
            AOT_hence \<open>\<not>\<exists>F\<exists>u([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
              using pred_equiv "intro-elim:3:c" by blast
            AOT_hence \<open>\<forall>F \<not>\<exists>u([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
              using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
            AOT_hence \<open>\<not>\<exists>u([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close> for F
              using "\<forall>E"(2) by blast
            AOT_hence \<open>\<forall>y \<not>(D!y & ([F]y & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>y)))\<close> for F
              using "cqt-further:4"[THEN "\<rightarrow>E"] by blast
            AOT_hence 0: \<open>\<not>(D!u & ([F]u & Numbers(x,F) & Numbers(x,[F]\<^sup>-\<^sup>u)))\<close> for F u
              using "\<forall>E"(2) by blast
            AOT_have \<open>\<box>\<not>\<exists>u [G]u\<close>
            proof(rule "raa-cor:1")
              AOT_assume \<open>\<not>\<box>\<not>\<exists>u [G]u\<close>
              AOT_hence \<open>\<diamond>\<exists>u [G]u\<close>
                using "\<equiv>\<^sub>d\<^sub>fI" "conventions:5" by blast
              AOT_hence \<open>\<exists>u \<diamond>[G]u\<close>
                by (metis "Discernible.res-var-bound-reas[BF\<diamond>]"[THEN "\<rightarrow>E"])
              then AOT_obtain u where posGu: \<open>\<diamond>[G]u\<close>
                using "Discernible.\<exists>E"[rotated] by meson
              AOT_hence Gu: \<open>[G]u\<close>
                by (meson "B\<diamond>" "K\<diamond>" "\<rightarrow>E" R)
              AOT_have \<open>\<not>([G]u & Numbers(x,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
                using 0 Discernible.\<psi>
                by (metis "con-dis-i-e:1" "raa-cor:1")
              AOT_hence notnumx: \<open>\<not>Numbers(x,[G]\<^sup>-\<^sup>u)\<close>
                using Gu numxG "con-dis-i-e:1" "raa-cor:5" by metis
              AOT_obtain y where numy: \<open>Numbers(y,[G]\<^sup>-\<^sup>u)\<close>
                using "num:1"[unvarify G, OF "F-u:2[den]"] "\<exists>E"[rotated] by blast
              AOT_hence \<open>[G]u & Numbers(x,G) & Numbers(y,[G]\<^sup>-\<^sup>u)\<close>
                using Gu numxG "&I" by blast
              AOT_hence \<open>\<exists>u ([G]u & Numbers(x,G) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
                by (rule "Discernible.\<exists>I")
              AOT_hence \<open>\<exists>G\<exists>u ([G]u & Numbers(x,G) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
                by (rule "\<exists>I")
              AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]yx\<close>
                using pred_equiv[THEN "\<equiv>E"(2)] by blast
              AOT_hence \<open>y = x\<close> using Pxy_imp_eq by blast
              AOT_hence \<open>Numbers(x,[G]\<^sup>-\<^sup>u)\<close>
                using numy "rule=E" by fast
              AOT_thus \<open>p & \<not>p\<close> for p using notnumx "reductio-aa:1" by blast
            qed
            AOT_hence \<open>\<not>\<exists>u [G]u\<close>
              using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
            AOT_hence num0G: \<open>Numbers(0, G)\<close>
              using "0F:1"[THEN "\<equiv>E"(1)] by blast
            AOT_hence \<open>x = 0\<close>
              using "pre-Hume:1"[unvarify x, THEN "\<rightarrow>E", OF "zero:2", OF "&I",
                               THEN "\<equiv>E"(2), OF num0G, OF numxG, OF "eq-part:1"]
                id_sym by blast
            moreover AOT_have \<open>\<not>x = 0\<close>
              using x_nonzero
              using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" by blast
            ultimately AOT_show \<open>p & \<not>p\<close> for p using "reductio-aa:1" by blast
          qed
        }
        AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]xx \<or> \<exists>y (y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
          using "con-dis-i-e:3:a" "con-dis-i-e:3:b" "raa-cor:1" by blast
        moreover {
          AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]xx\<close>
          AOT_hence \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
            by (rule "\<exists>I")
        }
        moreover {
          AOT_assume \<open>\<exists>y (y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx)\<close>
          then AOT_obtain y where \<open>y \<noteq> x & [\<guillemotleft>?P\<guillemotright>]yx\<close>
            using "\<exists>E"[rotated] by blast
          AOT_hence \<open>[\<guillemotleft>?P\<guillemotright>]yx\<close>
            using "&E" by blast
          AOT_hence \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
            by (rule "\<exists>I")
        }
        ultimately AOT_show \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
          using "\<or>E"(1) "\<rightarrow>I" by blast
      qed
      text\<open>Given above lemma, we can show that if one of two indistinguishable objects
           numbers a property, the other one numbers this property as well.\<close>
      AOT_assume indist: \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
      AOT_assume numxF: \<open>Numbers(x,F)\<close> 
      AOT_hence 0: \<open>NaturalCardinal(x)\<close>
        by (meson "cqt:2"(1) "eq-df-num:1.unvarify_x.unvarify_G.\<forall>E(1).\<forall>E(1).\<rightarrow>E")
      text\<open>We show by case distinction that x equals y.
           As first case we consider x to be non-zero.\<close>
      {
        AOT_assume \<open>\<not>(x = 0)\<close>
        AOT_hence \<open>x \<noteq> 0\<close>
          by (metis "=-infix" "\<equiv>\<^sub>d\<^sub>fI")
        AOT_hence \<open>\<exists>y [\<guillemotleft>?P\<guillemotright>]yx\<close>
          using CardinalPredecessor 0 by blast
        then AOT_obtain z where Pxz: \<open>[\<guillemotleft>?P\<guillemotright>]zx\<close>
          using "\<exists>E"[rotated] by blast
        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]zy]x\<close>
          by (safe intro!: "\<beta>\<leftarrow>C" "cqt:2")
        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]zy]y\<close>
          by (safe intro!: indist[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] "cqt:2")
        AOT_hence Pyz: \<open>[\<guillemotleft>?P\<guillemotright>]zy\<close>
          using "\<beta>\<rightarrow>C"(1) by blast
        AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(z,[F]\<^sup>-\<^sup>u))\<close>
          using Pyz pred_equiv[THEN "\<equiv>E"(1)] by blast
        then AOT_obtain F\<^sub>1 where \<open>\<exists>u ([F\<^sub>1]u & Numbers(y,F\<^sub>1) & Numbers(z,[F\<^sub>1]\<^sup>-\<^sup>u))\<close>
          using "\<exists>E"[rotated] by blast
        then AOT_obtain u where u_prop: \<open>[F\<^sub>1]u & Numbers(y,F\<^sub>1) & Numbers(z,[F\<^sub>1]\<^sup>-\<^sup>u)\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        AOT_have \<open>\<exists>F\<exists>u ([F]u & Numbers(x,F) & Numbers(z,[F]\<^sup>-\<^sup>u))\<close>
          using Pxz pred_equiv[THEN "\<equiv>E"(1)] by blast
        then AOT_obtain F\<^sub>2 where \<open>\<exists>u ([F\<^sub>2]u & Numbers(x,F\<^sub>2) & Numbers(z,[F\<^sub>2]\<^sup>-\<^sup>u))\<close>
          using "\<exists>E"[rotated] by blast
        then AOT_obtain v where v_prop: \<open>[F\<^sub>2]v & Numbers(x,F\<^sub>2) & Numbers(z,[F\<^sub>2]\<^sup>-\<^sup>v)\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        AOT_have \<open>[F\<^sub>2]\<^sup>-\<^sup>v \<approx>\<^sub>D [F\<^sub>1]\<^sup>-\<^sup>u\<close>
          using "hume-strict:1-old"[unvarify F G, THEN "\<equiv>E"(1), OF "F-u:2[den]",
                                OF "F-u:2[den]", OF "\<exists>I"(2)[where \<beta>=z], OF "&I"]
                  v_prop u_prop "&E" by blast
        AOT_hence \<open>F\<^sub>2 \<approx>\<^sub>D F\<^sub>1\<close>
          using "P'-eq"[THEN "\<rightarrow>E", OF "&I", OF "&I"] 
                 u_prop v_prop "&E" by meson
        AOT_hence \<open>x = y\<close>
          using "pre-Hume:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), OF "&I"]
                v_prop u_prop "&E" by blast
      }
      text\<open>The second case handles x being equal to zero.\<close>
      moreover {
        fix u
        AOT_assume x_is_zero: \<open>x = 0\<close>
        moreover AOT_have \<open>Numbers(0,[\<lambda>z z =\<^sub>D u]\<^sup>-\<^sup>u)\<close>
        proof (safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)] "cqt:2" "raa-cor:2"
                            "F-u:2[den]")
          AOT_assume \<open>\<exists>v [[\<lambda>z z =\<^sub>D u]\<^sup>-\<^sup>u]v\<close>
          then AOT_obtain v where \<open>[[\<lambda>z z =\<^sub>D u]\<^sup>-\<^sup>u]v\<close>
            using "Discernible.\<exists>E"[rotated] by meson
          AOT_hence 1: \<open>[\<lambda>z z =\<^sub>D u]v & v \<noteq> u\<close>
            by (auto intro: "F-u:2"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
                     intro!: "cqt:2" "F-u:2[equiv]"[THEN "\<equiv>E"(1)]
                             "F-u:2[den]")
          AOT_hence \<open>v = u\<close>
            by (metis "betaC:1:a" "con-dis-i-e:2:a" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'" "rule=I:1"
                "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
          AOT_thus \<open>p & \<not>p\<close> for p
            using 1
            using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:b" "raa-cor:3" by blast
        qed
        ultimately AOT_have 0: \<open>Numbers(x,[\<lambda>z z =\<^sub>D u]\<^sup>-\<^sup>u)\<close>
          using "rule=E" id_sym by fast
        AOT_have \<open>\<exists>y Numbers(y,[\<lambda>z z =\<^sub>D u])\<close>
          by (safe intro!: "num:1"[unvarify G] "cqt:2")
        then AOT_obtain z where \<open>Numbers(z,[\<lambda>z z =\<^sub>D u])\<close>
          using "\<exists>E" by metis
        moreover AOT_have \<open>[\<lambda>z z=\<^sub>D u]u\<close>
          using "betaC:2:a" "cqt:2"(1) "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(1).&E(2)" Discernible.restricted_var_condition calculation by blast
        ultimately AOT_have
          1: \<open>[\<lambda>z z=\<^sub>D u]u & Numbers(z,[\<lambda>z z=\<^sub>D u]) & Numbers(x,[\<lambda>z z=\<^sub>D u]\<^sup>-\<^sup>u)\<close>
          using 0 "&I" by auto
        AOT_hence \<open>\<exists>v([\<lambda>z z=\<^sub>D u]v & Numbers(z,[\<lambda>z z =\<^sub>D u]) & Numbers(x,[\<lambda>z z=\<^sub>D u]\<^sup>-\<^sup>v))\<close>
          by (rule "Discernible.\<exists>I")
        AOT_hence \<open>\<exists>F\<exists>u([F]u & Numbers(z,[F]) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
          by (rule "\<exists>I"; "cqt:2")
        AOT_hence Px1: \<open>[\<guillemotleft>?P\<guillemotright>]xz\<close>
          using "beta-C-cor:2"[THEN "\<rightarrow>E", OF pred_den,
                  THEN tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "\<forall>E"(2),
                  THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by simp
        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]yz]x\<close>
          by (safe intro!: "\<beta>\<leftarrow>C" "cqt:2")
        AOT_hence \<open>[\<lambda>y [\<guillemotleft>?P\<guillemotright>]yz]y\<close>
          by (safe intro!: indist[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] "cqt:2")
        AOT_hence Py1: \<open>[\<guillemotleft>?P\<guillemotright>]yz\<close>
          using "\<beta>\<rightarrow>C" by blast
        AOT_hence \<open>\<exists>F\<exists>u([F]u & Numbers(z,[F]) & Numbers(y,[F]\<^sup>-\<^sup>u))\<close>
          using "\<beta>\<rightarrow>C" by fast
        then AOT_obtain G where \<open>\<exists>u([G]u & Numbers(z,[G]) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
          using "\<exists>E"[rotated] by blast
        then AOT_obtain v where 2: \<open>[G]v & Numbers(z,[G]) & Numbers(y,[G]\<^sup>-\<^sup>v)\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        with 1 2 AOT_have \<open>[\<lambda>z z =\<^sub>D u] \<approx>\<^sub>D G\<close>
          by (auto intro!: "hume-strict:1-old"[unvarify F, THEN "\<equiv>E"(1), rotated,
                                OF "\<exists>I"(2)[where \<beta>=z], OF "&I"] "cqt:2"
                   dest: "&E")
        AOT_hence 3: \<open>[\<lambda>z z =\<^sub>D u]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
          using 1 2
          by (safe_step intro!: "eqP'"[unvarify F, THEN "\<rightarrow>E"])
             (auto dest: "&E" intro!: "cqt:2" "&I")
        with 1 2 AOT_have \<open>x = y\<close>
          by (auto intro!: "pre-Hume:1"[unvarify G H, THEN "\<rightarrow>E",
                                      THEN "\<equiv>E"(2), rotated 3, OF 3]
                           "F-u:2[den]" "cqt:2" "&I"
                   dest: "&E")
      }
      ultimately AOT_have \<open>x = y\<close>
        using "\<or>E"(1) "\<rightarrow>I" "reductio-aa:1" by blast
      text\<open>Now since x numbers F, so does y.\<close>
      AOT_hence \<open>Numbers(y,F)\<close>
          using numxF "rule=E" by fast
    } note 0 = this
    text\<open>The only thing left is to generalize this result to a biconditional.\<close>
    AOT_modally_strict {
      fix x y
      AOT_assume \<open>[\<guillemotleft>?P\<guillemotright>]\<down>\<close>
      moreover AOT_assume \<open>\<forall>F([F]x \<equiv> [F]y)\<close>
      moreover AOT_have \<open>\<forall>F([F]y \<equiv> [F]x)\<close>
        by (metis "cqt-basic:11" "intro-elim:3:a" calculation(2))
      ultimately AOT_show \<open>Numbers(x,F) \<equiv> Numbers(y,F)\<close>
        using 0 "\<equiv>I" "\<rightarrow>I" by auto
    }
  qed
  ultimately AOT_show \<open>[\<lambda>x Numbers(x,F)]\<down>\<close>
    using "kirchner-thm:1"[THEN "\<equiv>E"(2)] "\<rightarrow>E" by fast
next
  text\<open>The converse can be shown by coexistence.\<close>
  AOT_assume \<open>\<forall>F [\<lambda>x Numbers(x,F)]\<down>\<close>
  AOT_hence \<open>[\<lambda>x Numbers(x,F)]\<down>\<close> for F
    using "\<forall>E"(2) by blast
  AOT_hence \<open>\<box>[\<lambda>x Numbers(x,F)]\<down>\<close> for F
    using "exist-nec"[THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<forall>F \<box>[\<lambda>x Numbers(x,F)]\<down>\<close>
    by (rule GEN)
  AOT_hence \<open>\<box>\<forall>F [\<lambda>x Numbers(x,F)]\<down>\<close>
    using BF[THEN "\<rightarrow>E"] by fast
  moreover AOT_have
    \<open>\<box>\<forall>F [\<lambda>x Numbers(x,F)]\<down> \<rightarrow>
     \<box>\<forall>x \<forall>y (\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x) \<equiv>
              \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)))\<close>
  proof(rule RM; safe intro!: "\<rightarrow>I" GEN)
    AOT_modally_strict {
      fix x y
      AOT_assume 0: \<open>\<forall>F [\<lambda>x Numbers(x,F)]\<down>\<close>
      AOT_show \<open>\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x) \<equiv>
              \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
      proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
        AOT_assume \<open>\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
        then AOT_obtain F where
          \<open>\<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
          using "\<exists>E"[rotated] by blast
        then AOT_obtain u where \<open>[F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        AOT_hence \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
          by (auto intro!: "&I" dest: "&E" "\<beta>\<rightarrow>C")
        AOT_thus \<open>\<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
          using "\<exists>I" "Discernible.\<exists>I" by fast
      next
        AOT_assume \<open>\<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
        then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
          using "\<exists>E"[rotated] by blast
        then AOT_obtain u where \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
          using "Discernible.\<exists>E"[rotated] by meson
        AOT_hence \<open>[F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x\<close>
          by (auto intro!: "&I" "\<beta>\<leftarrow>C" 0[THEN "\<forall>E"(1)] "F-u:2[den]"
                   dest: "&E" intro: "cqt:2")
        AOT_hence \<open>\<exists>u([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
          by (rule "Discernible.\<exists>I")
        AOT_thus \<open>\<exists>F\<exists>u([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x)\<close>
          by (rule "\<exists>I")
      qed
    }
  qed
  ultimately AOT_have
    \<open>\<box>\<forall>x \<forall>y (\<exists>F \<exists>u ([F]u & [\<lambda>z Numbers(z,F)]y & [\<lambda>z Numbers(z,[F]\<^sup>-\<^sup>u)]x) \<equiv>
              \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)))\<close>
    using "\<rightarrow>E" by blast
  AOT_thus \<open>[\<lambda>xy \<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<down>\<close>
    by (rule "safe-ext[2]"[axiom_inst, THEN "\<rightarrow>E", OF "&I", rotated]) "cqt:2"
qed

AOT_theorem lambda_dist_denotes2: \<open>[\<lambda>xy D!x & D!y & \<phi>{x,y}]\<down>\<close>
proof(rule "safe-ext[2]"[axiom_inst, THEN "\<rightarrow>E"])
  AOT_have \<open>\<box>\<forall>x \<forall>y (D!x & D!y & \<exists>x' \<exists>y' (x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'}) \<equiv> D!x & D!y & \<phi>{x,y})\<close>
  proof(safe intro!: "\<equiv>I" RN GEN "\<rightarrow>I")
    AOT_modally_strict {
      fix x y
      AOT_assume 0: \<open>D!x & D!y & \<exists>x' \<exists>y' (x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'})\<close>
      then AOT_obtain x' where \<open>\<exists>y' (x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'})\<close>
        using "&E" "\<exists>E"[rotated] by blast
      then AOT_obtain y' where 2: \<open>x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'}\<close>
        using "\<exists>E"[rotated] by blast
      AOT_hence \<open>x = x'\<close>
        by (metis (no_types, lifting) "0" "discern-obj:19" "con-dis-i-e:2:a" "vdash-properties:6")
      AOT_hence \<open>\<phi>{x,y'}\<close>
        using 2[THEN "&E"(2)] "rule=E" "&E" 0
        by (metis id_sym)
      moreover AOT_have \<open>y = y'\<close>
        using 2
        by (metis (no_types, lifting) "0" "discern-obj:19" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "vdash-properties:6")
      ultimately AOT_have \<open>\<phi>{x,y}\<close>
        using 2[THEN "&E"(2)] "rule=E" "&E" 0
        by (metis id_sym)
      AOT_thus \<open>D!x & D!y & \<phi>{x,y}\<close>
        using 0 "&E" "&I"
        by blast        
    }
  next
    AOT_modally_strict {
      fix x y
      AOT_assume 0: \<open>D!x & D!y & \<phi>{x,y}\<close>
      AOT_hence \<open>x =\<^sub>D x & y =\<^sub>D y & \<phi>{x,y}\<close>
        by (metis "con-dis-i-e:1" "con-dis-i-e:2:b" "con-dis-taut:1.\<rightarrow>E" "discern-obj:30" "oth-class-taut:7:a.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" "oth-class-taut:8:d")
      AOT_hence \<open>\<exists>x' \<exists>y' (x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'})\<close>
        using "\<exists>I" by meson
      AOT_thus \<open>D!x & D!y & \<exists>x' \<exists>y' (x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'})\<close>
        using "&I" "&E" 0 by blast
    }
  qed
  AOT_thus \<open>[\<lambda>xy D!x & D!y & \<exists>x'\<exists>y'(x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'})]\<down> & \<box>\<forall>x\<forall>y(D!x & D!y & \<exists>x'\<exists>y'(x =\<^sub>D x' & y =\<^sub>D y' & \<phi>{x',y'}) \<equiv> D!x & D!y & \<phi>{x,y})\<close>
    by(safe intro!: "&I" "cqt:2")
qed


(************************************** MODEL LEVEL PROOFS ***************************************)

AOT_theorem unique_subst:
  assumes \<open>\<forall>x (\<phi>{x} \<equiv> \<psi>{x})\<close>
  shows \<open>\<exists>!x \<phi>{x} \<equiv> \<exists>!x \<psi>{x}\<close>
proof -
  {
    fix \<phi> \<psi>
    AOT_assume 0: \<open>\<forall>x (\<phi>{x} \<equiv> \<psi>{x})\<close>
    AOT_assume \<open>\<exists>!x \<phi>{x}\<close>
    AOT_hence \<open>\<exists>x (\<phi>{x} & \<forall>y (\<phi>{y} \<rightarrow> y = x))\<close>
      using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    then AOT_obtain x where \<phi>_prop: \<open>\<phi>{x} & \<forall>y (\<phi>{y} \<rightarrow> y = x)\<close>
      using "\<exists>E"[rotated] by blast
    AOT_have \<open>\<psi>{x} & \<forall>y (\<psi>{y} \<rightarrow> y = x)\<close>
    proof(safe intro!: "&I" GEN "\<rightarrow>I")
      AOT_show \<open>\<psi>{x}\<close>
        using 0[THEN "\<forall>E"(2), THEN "\<equiv>E"(1), OF \<phi>_prop[THEN "&E"(1)]].
    next
      fix y
      AOT_assume \<open>\<psi>{y}\<close>
      AOT_hence \<open>\<phi>{y}\<close>
        using 0[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by blast
      AOT_thus \<open>y = x\<close>
        using \<phi>_prop[THEN "&E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
    qed
    AOT_hence \<open>\<exists>x(\<psi>{x} & \<forall>y (\<psi>{y} \<rightarrow> y = x))\<close>
      by (rule "\<exists>I")
    AOT_hence \<open>\<exists>!x \<psi>{x}\<close>
      using "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
  }
  moreover AOT_have \<open>\<forall>x (\<psi>{x} \<equiv> \<phi>{x})\<close>
    using assms  "cqt-basic:11" "\<equiv>E"(1,2) "\<equiv>I" "\<rightarrow>I" by blast
  ultimately AOT_show \<open>\<exists>!x \<phi>{x} \<equiv> \<exists>!x \<psi>{x}\<close>
    using "\<equiv>I" "\<rightarrow>I" assms by auto
qed

AOT_theorem act_approx_lem: \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z] \<equiv> \<^bold>\<A>(F \<approx>\<^sub>D G)\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z]\<close>
  AOT_hence \<open>\<exists>R R |: [\<lambda>z \<^bold>\<A>[F]z] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z]\<close>
    using "equi:3"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  then AOT_obtain R where \<open>R |: [\<lambda>z \<^bold>\<A>[F]z] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z]\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>R\<down> & [\<lambda>z \<^bold>\<A>[F]z]\<down> & [\<lambda>z \<^bold>\<A>[G]z]\<down> & \<forall>u ([\<lambda>z \<^bold>\<A>[F]z]u \<rightarrow> \<exists>!v ([\<lambda>z \<^bold>\<A>[G]z]v & [R]uv)) & \<forall>v ([\<lambda>z \<^bold>\<A>[G]z]v \<rightarrow> \<exists>!u ([\<lambda>z \<^bold>\<A>[F]z]u & [R]uv))\<close>
    using "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence F_imp: \<open>\<forall>u ([\<lambda>z \<^bold>\<A>[F]z]u \<rightarrow> \<exists>!v ([\<lambda>z \<^bold>\<A>[G]z]v & [R]uv))\<close>
        and G_imp: \<open>\<forall>v ([\<lambda>z \<^bold>\<A>[G]z]v \<rightarrow> \<exists>!u ([\<lambda>z \<^bold>\<A>[F]z]u & [R]uv))\<close>
    using "&E" by blast+
  AOT_obtain R' where \<open>Rigidifies(R',R)\<close>
    using "rigid-der:3" "\<exists>E"[rotated] by blast
  AOT_hence 1: \<open>Rigid(R') & \<forall>x\<^sub>1...\<forall>x\<^sub>n ([R']x\<^sub>1...x\<^sub>n \<equiv> [R]x\<^sub>1...x\<^sub>n)\<close>
    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_hence \<open>\<box>\<forall>x\<^sub>1...\<forall>x\<^sub>n ([R']x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R']x\<^sub>1...x\<^sub>n)\<close>
    using "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast
  AOT_hence \<open>\<forall>x\<^sub>1...\<forall>x\<^sub>n (\<diamond>[R']x\<^sub>1...x\<^sub>n \<rightarrow> \<box>[R']x\<^sub>1...x\<^sub>n)\<close>
    using "\<equiv>E"(1) "rigid-rel-thms:1" by blast
  AOT_hence D: \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 (\<diamond>[R']x\<^sub>1x\<^sub>2 \<rightarrow> \<box>[R']x\<^sub>1x\<^sub>2)\<close>
    using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_have E: \<open>\<forall>x\<^sub>1\<forall>x\<^sub>2 ([R']x\<^sub>1x\<^sub>2 \<equiv> [R]x\<^sub>1x\<^sub>2)\<close>
    using tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE", OF 1[THEN "&E"(2)]] by blast
  {
    fix x y
    AOT_assume \<open>[R]xy\<close>
    AOT_hence \<open>[R']xy\<close>
      using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(2)] by blast
    AOT_hence \<open>\<diamond>[R']xy\<close> using "T-S5-fund:1"[THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<box>[R']xy\<close> using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<^bold>\<A>[R']xy\<close> using "nec-imp-act"[THEN "\<rightarrow>E"] by blast
  } note rigid1 = this
  {
    fix x y
    AOT_assume \<open>\<^bold>\<A>[R']xy\<close>
    AOT_hence \<open>\<diamond>[R']xy\<close>
      using "Act-Sub:3"[THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<box>[R']xy\<close> using D[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>[R']xy\<close>
      using "qml:2"[axiom_inst, THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>[R]xy\<close>
      using E[THEN "\<forall>E"(2), THEN "\<forall>E"(2), THEN "\<equiv>E"(1)] by blast
  } note rigid2 = this
  {
    {
      fix u
      AOT_have \<open>\<^bold>\<A>[F]u \<rightarrow> \<^bold>\<A>\<exists>!v ([G]v & [R']uv)\<close>
      proof(rule "\<rightarrow>I")
        AOT_assume \<open>\<^bold>\<A>[F]u\<close>
        AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
          by (safe intro!: "betaC:2:a" "cqt:2")
        AOT_hence \<open>\<exists>!v ([\<lambda>z \<^bold>\<A>[G]z]v & [R]uv)\<close>
          using F_imp[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E"] by blast
        moreover {
          AOT_have \<open>\<^bold>\<A>[G]x\<close> if \<open>[\<lambda>z \<^bold>\<A>[G]z]x\<close> for x
            using "betaC:1:a" that by blast
          moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[G]z]x\<close> if \<open>\<^bold>\<A>[G]x\<close> for x
            by (safe intro!: that "cqt:2" "betaC:2:a")
          ultimately AOT_have \<open>\<forall>x ((D!x & ([\<lambda>z \<^bold>\<A>[G]z]x & [R]ux)) \<equiv> (D!x & (\<^bold>\<A>[G]x & \<^bold>\<A>[R']ux)))\<close>
            using rigid1 rigid2
            apply(auto intro!: GEN "\<rightarrow>I" "\<equiv>I" "&I" dest: "&E")
            by (meson "&E")+
        } 
        ultimately AOT_have \<open>\<exists>!v (\<^bold>\<A>[G]v & \<^bold>\<A>[R']uv)\<close>
          using unique_subst "\<equiv>E"(1) by fast
        AOT_hence \<open>\<exists>!v \<^bold>\<A>([G]v & [R']uv)\<close>
          by (AOT_subst \<open>\<^bold>\<A>([G]v & [R']uv)\<close> \<open>\<^bold>\<A>[G]v & \<^bold>\<A>[R']uv\<close> for: v)
              (auto simp: "Act-Basic:2")
        AOT_thus \<open>\<^bold>\<A>\<exists>!v ([G]v & [R']uv)\<close>
          using "Discernible.res-var-bound-reas[A-Exists:1]"[THEN "\<equiv>E"(2)] by auto
      qed
      AOT_hence \<open>\<^bold>\<A>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
        using "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(2)] by blast
    }
    AOT_hence \<open>\<forall>u \<^bold>\<A>([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close> by (rule "Discernible.GEN")
    AOT_hence \<open>\<^bold>\<A>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv))\<close>
      using "Discernible.res-var-bound-reas[2]"[THEN "\<rightarrow>E"] by auto
  }
  moreover {
    {
      fix v
      AOT_have \<open>\<^bold>\<A>[G]v \<rightarrow> \<^bold>\<A>\<exists>!u ([F]u & [R']uv)\<close>
      proof(rule "\<rightarrow>I")
        AOT_assume \<open>\<^bold>\<A>[G]v\<close>
        AOT_hence \<open>[\<lambda>z \<^bold>\<A>[G]z]v\<close>
          by (safe intro!: "betaC:2:a" "cqt:2")
        AOT_hence \<open>\<exists>!u ([\<lambda>z \<^bold>\<A>[F]z]u & [R]uv)\<close>
          using G_imp[THEN "Discernible.\<forall>E", THEN "\<rightarrow>E"] by blast
        moreover {
          AOT_have \<open>\<^bold>\<A>[F]x\<close> if \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close> for x
            using "betaC:1:a" that by blast
          moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]x\<close> if \<open>\<^bold>\<A>[F]x\<close> for x
            by (safe intro!: that "cqt:2" "betaC:2:a")
          ultimately AOT_have \<open>\<forall>x ((D!x & ([\<lambda>z \<^bold>\<A>[F]z]x & [R]xv)) \<equiv> (D!x & (\<^bold>\<A>[F]x & \<^bold>\<A>[R']xv)))\<close>
            using rigid1 rigid2
            apply(auto intro!: GEN "\<rightarrow>I" "\<equiv>I" "&I" dest: "&E")
            by (meson "&E")+
        } 
        ultimately AOT_have \<open>\<exists>!u (\<^bold>\<A>[F]u & \<^bold>\<A>[R']uv)\<close>
          using unique_subst "\<equiv>E"(1) by fast
        AOT_hence \<open>\<exists>!u \<^bold>\<A>([F]u & [R']uv)\<close>
          by (AOT_subst \<open>\<^bold>\<A>([F]u & [R']uv)\<close> \<open>\<^bold>\<A>[F]u & \<^bold>\<A>[R']uv\<close> for: u)
              (auto simp: "Act-Basic:2")
        AOT_thus \<open>\<^bold>\<A>\<exists>!u ([F]u & [R']uv)\<close>
          using "Discernible.res-var-bound-reas[A-Exists:1]"[THEN "\<equiv>E"(2)] by auto
      qed
      AOT_hence \<open>\<^bold>\<A>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
        using "logic-actual-nec:2"[axiom_inst, THEN "\<equiv>E"(2)] by blast
    }
    AOT_hence \<open>\<forall>v \<^bold>\<A>([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close> by (rule "Discernible.GEN")
    AOT_hence \<open>\<^bold>\<A>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv))\<close>
      using "Discernible.res-var-bound-reas[2]"[THEN "\<rightarrow>E"] by auto
  }
  ultimately AOT_have \<open>\<^bold>\<A>(R'\<down> & [F]\<down> & [G]\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R']uv)) & \<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R']uv)))\<close>
    by (safe intro!: "Act-Basic:2"[THEN "\<equiv>E"(2)] "&I" "cqt:2[const_var]"[axiom_inst, THEN "RA[2]"])
  AOT_hence \<open>\<^bold>\<A>R' |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    by (AOT_subst_def "equi:2")
  AOT_hence \<open>\<exists>R \<^bold>\<A>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    by (rule "\<exists>I")
  AOT_hence \<open>\<^bold>\<A>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    using "Act-Basic:10"[THEN "\<equiv>E"(2)] by fast
  AOT_thus \<open>\<^bold>\<A>F \<approx>\<^sub>D G\<close>
    by (AOT_subst_def "equi:3")
next
  AOT_assume \<open>\<^bold>\<A>F \<approx>\<^sub>D G\<close>
  AOT_hence \<open>\<^bold>\<A>\<exists>R R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    by (AOT_subst_def (reverse) "equi:3")
  AOT_hence \<open>\<exists>R \<^bold>\<A>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    by (meson "Act-Basic:10.\<equiv>E(1).\<exists>E'" "existential:2[const_var]")
  then AOT_obtain R where \<open>\<^bold>\<A>R |: F \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D G\<close>
    using "\<exists>E'" by blast
  AOT_hence \<open>\<^bold>\<A>(R\<down> & [F]\<down> & [G]\<down> & \<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv)) & \<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv)))\<close>
    by (AOT_subst_def (reverse) "equi:2")
  AOT_hence \<open>\<^bold>\<A>(\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv)) & \<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv)))\<close>
    by (meson "Act-Basic:2.\<equiv>E(1).&E(1)" "Act-Basic:2.\<equiv>E(1).&E(2)" "act-conj-act:3.\<rightarrow>E" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E")
  AOT_hence \<open>\<^bold>\<A>\<forall>u ([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv)) & \<^bold>\<A>\<forall>v ([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
    using "Act-Basic:2.\<equiv>E(1).&E(1)" "Act-Basic:2.\<equiv>E(1).&E(2)" "con-dis-i-e:1" by blast
  AOT_hence \<open>\<forall>u \<^bold>\<A>([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close> and \<open>\<forall>v \<^bold>\<A>([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close>
    using "Discernible.res-var-bound-reas[3]"[THEN "\<rightarrow>E"] "&E" by meson+
  AOT_hence 0: \<open>\<^bold>\<A>([F]u \<rightarrow> \<exists>!v ([G]v & [R]uv))\<close> and 1: \<open>\<^bold>\<A>([G]v \<rightarrow> \<exists>!u ([F]u & [R]uv))\<close> for u v
    using "Discernible.\<forall>E" by fast+
  AOT_have \<open>[\<lambda>xy \<^bold>\<A>[R]xy] |: [\<lambda>z \<^bold>\<A>[F]z] \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z]\<close>
  proof(safe intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" "Discernible.\<forall>I" "\<rightarrow>I")
    fix u
    AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z]u\<close>
    AOT_hence \<open>\<^bold>\<A>[F]u\<close>
      using "betaC:1:a" by blast
    AOT_hence \<open>\<^bold>\<A>\<exists>!v ([G]v & [R]uv)\<close>
      using 0 "act-cond.\<rightarrow>E.\<rightarrow>E" by blast
    AOT_hence \<open>\<exists>!v \<^bold>\<A>([G]v & [R]uv)\<close>
      using "Discernible.res-var-bound-reas[A-Exists:1]" "intro-elim:3:a" by fastforce
    AOT_thus \<open>\<exists>!v ([\<lambda>z \<^bold>\<A>[G]z]v & [\<lambda>xy \<^bold>\<A>[R]xy]uv)\<close>
    proof (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[G]z]v & [\<lambda>xy \<^bold>\<A>[R]xy]uv\<close> \<open>\<^bold>\<A>([G]v & [R]uv)\<close> for: v)
      AOT_modally_strict {
        AOT_show \<open>[\<lambda>z \<^bold>\<A>[G]z]x & [\<lambda>xy \<^bold>\<A>[R]xy]ux \<equiv> \<^bold>\<A>([G]x & [R]ux)\<close> for x
        proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
          AOT_assume \<open>[\<lambda>z \<^bold>\<A>[G]z]x & [\<lambda>xy \<^bold>\<A>[R]xy]ux\<close>
          AOT_hence \<open>\<^bold>\<A>[G]x & \<^bold>\<A>[R]ux\<close>
            by (metis "betaC:1:a" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" case_prod_conv)
          AOT_thus \<open>\<^bold>\<A>([G]x & [R]ux)\<close>
            using "act-conj-act:3.\<rightarrow>E" by presburger
        next
          AOT_assume \<open>\<^bold>\<A>([G]x & [R]ux)\<close>
          AOT_hence \<open>\<^bold>\<A>[G]x & \<^bold>\<A>[R]ux\<close>
            using "Act-Basic:2.\<equiv>E(1).&E(1)" "Act-Basic:2.\<equiv>E(1).&E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by blast
          moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[G]z]\<down>\<close> and \<open>[\<lambda>xy \<^bold>\<A>[R]xy]\<down>\<close> by "cqt:2"+
          ultimately AOT_show \<open>[\<lambda>z \<^bold>\<A>[G]z]x & [\<lambda>xy \<^bold>\<A>[R]xy]ux\<close>
            by (smt (verit) "\<equiv>\<^sub>d\<^sub>fI" "betaC:2:a" "con-dis-i-e:1" "con-dis-i-e:2:b" "con-dis-taut:1.\<rightarrow>E" "cqt:2"(1) old.prod.case tuple_denotes)
        qed
      }
    qed(auto)
  next
    fix v
    AOT_assume \<open>[\<lambda>z \<^bold>\<A>[G]z]v\<close>
    AOT_hence \<open>\<^bold>\<A>[G]v\<close>
      using "betaC:1:a" by blast
    AOT_hence \<open>\<^bold>\<A>\<exists>!u ([F]u & [R]uv)\<close>
      using 1 "act-cond.\<rightarrow>E.\<rightarrow>E" by blast
    AOT_hence \<open>\<exists>!u \<^bold>\<A>([F]u & [R]uv)\<close>
      using "Discernible.res-var-bound-reas[A-Exists:1]" "intro-elim:3:a" by fastforce
    AOT_thus \<open>\<exists>!u ([\<lambda>z \<^bold>\<A>[F]z]u & [\<lambda>xy \<^bold>\<A>[R]xy]uv)\<close>
    proof (AOT_subst \<open>[\<lambda>z \<^bold>\<A>[F]z]u & [\<lambda>xy \<^bold>\<A>[R]xy]uv\<close> \<open>\<^bold>\<A>([F]u & [R]uv)\<close> for: u)
      AOT_modally_strict {
        AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]x & [\<lambda>xy \<^bold>\<A>[R]xy]xv \<equiv> \<^bold>\<A>([F]x & [R]xv)\<close> for x
        proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
          AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z]x & [\<lambda>xy \<^bold>\<A>[R]xy]xv\<close>
          AOT_hence \<open>\<^bold>\<A>[F]x & \<^bold>\<A>[R]xv\<close>
            by (metis "betaC:1:a" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" case_prod_conv)
          AOT_thus \<open>\<^bold>\<A>([F]x & [R]xv)\<close>
            using "act-conj-act:3.\<rightarrow>E" by presburger
        next
          AOT_assume \<open>\<^bold>\<A>([F]x & [R]xv)\<close>
          AOT_hence \<open>\<^bold>\<A>[F]x & \<^bold>\<A>[R]xv\<close>
            using "Act-Basic:2.\<equiv>E(1).&E(1)" "Act-Basic:2.\<equiv>E(1).&E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by blast
          moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> and \<open>[\<lambda>xy \<^bold>\<A>[R]xy]\<down>\<close> by "cqt:2"+
          ultimately AOT_show \<open>[\<lambda>z \<^bold>\<A>[F]z]x & [\<lambda>xy \<^bold>\<A>[R]xy]xv\<close>
            by (smt (verit) "\<equiv>\<^sub>d\<^sub>fI" "betaC:2:a" "con-dis-i-e:1" "con-dis-i-e:2:b" "con-dis-taut:1.\<rightarrow>E" "cqt:2"(1) old.prod.case tuple_denotes)
        qed
      }
    qed(auto)
  qed
  AOT_thus \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[G]z]\<close>
    by (simp add: "equi:2.\<equiv>\<^sub>d\<^sub>fE.&E(1).&E(1).&E(1).&E(1)" "equi:3.\<equiv>\<^sub>d\<^sub>fI" "existential:1")
qed


lemma some_null_simp[AOT_no_atp]: \<open>(SOME xa. \<kappa>\<upsilon> xa = null\<upsilon> x) = null\<kappa> x\<close>
  by (smt (verit, best) AOT_model_denotes_\<kappa>_def AOT_model_term_equiv_\<kappa>_def
            AOT_model_term_equiv_denotes \<kappa>\<upsilon>.simps(3) \<upsilon>.sel(3) is_null\<kappa>_def verit_sko_ex')

lemma some_equiv[AOT_no_atp]: \<open>AOT_model_term_equiv (SOME x. \<kappa>\<upsilon> x = \<kappa>\<upsilon> \<kappa>) \<kappa>\<close>
  by (metis (mono_tags, lifting) AOT_model_term_equiv_\<kappa>_def AOT_model_term_equiv_eps(2) Eps_cong)

lemma indist_\<alpha>\<sigma>[AOT_no_atp]:
  assumes Ax: \<open>[v \<Turnstile> A!x]\<close>
  shows \<open>[v \<Turnstile> \<forall>F ([F]x \<equiv> [F]y)] = (\<exists>a b . AOT_term_of_var x = \<alpha>\<kappa> a \<and> AOT_term_of_var y = \<alpha>\<kappa> b \<and> \<alpha>\<sigma> a = \<alpha>\<sigma> b)\<close>
proof
  AOT_world v
  AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
  AOT_have \<open>A!y\<close>
    using indist[THEN "\<forall>E"(1), OF "oa-exist:2", THEN "\<equiv>E"(1), OF Ax].
  then obtain a b where a_prop: \<open>AOT_term_of_var x = \<alpha>\<kappa> a\<close>
                    and b_prop: \<open>AOT_term_of_var y = \<alpha>\<kappa> b\<close>
    using Ax AOT_model_abstract_\<alpha>\<kappa> by force
  moreover have \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
  proof -
    AOT_have \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]\<down>\<close>
      unfolding AOT_sem_denotes AOT_model_lambda_denotes AOT_model_proposition_choice_simp
      using AOT_model_term_equiv_\<kappa>_def by presburger
    moreover AOT_have \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]x\<close>
      by (metis (mono_tags) "cqt:2"(1) AOT_model_proposition_choice_simp AOT_sem_lambda_beta \<kappa>\<upsilon>.simps(2) a_prop calculation)
    ultimately AOT_have \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]y\<close>
      using indist[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] by blast
    AOT_hence \<open>\<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>\<upsilon> (AOT_term_of_var y) = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>\<close>
      using "betaC:1:a" by blast
    hence \<open>\<kappa>\<upsilon> (AOT_term_of_var y) = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<close>
      using AOT_model_proposition_choice_simp by auto
    thus \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
      by (metis \<kappa>\<upsilon>.simps(2) \<upsilon>.inject(2) b_prop)
  qed
  ultimately show \<open>\<exists>a b . AOT_term_of_var x = \<alpha>\<kappa> a \<and> AOT_term_of_var y = \<alpha>\<kappa> b \<and> \<alpha>\<sigma> a = \<alpha>\<sigma> b\<close> by blast
next
  AOT_world v
    assume \<open>\<exists>a b . AOT_term_of_var x = \<alpha>\<kappa> a \<and> AOT_term_of_var y = \<alpha>\<kappa> b \<and> \<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
    then obtain a b where a_prop: \<open>AOT_term_of_var x = \<alpha>\<kappa> a\<close>
                      and b_prop: \<open>AOT_term_of_var y = \<alpha>\<kappa> b\<close>
                      and \<alpha>\<sigma>_eq: \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
      by auto
    hence \<open>\<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> (AOT_term_of_var y)\<close>
      by simp
    hence term_equiv: \<open>AOT_model_term_equiv (AOT_term_of_var x) (AOT_term_of_var y)\<close>
       by (metis AOT_model_term_equiv_\<kappa>_def)
    AOT_show \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    proof(safe intro!: GEN "\<equiv>I" "\<rightarrow>I")
      fix F
      AOT_assume \<open>[F]x\<close>
      AOT_thus \<open>[F]y\<close>
        by (metis AOT_model_denotes_rel.rep_eq AOT_sem_denotes AOT_sem_exe term_equiv) 
    next
      fix F
      AOT_assume \<open>[F]y\<close>
      AOT_thus \<open>[F]x\<close>
        by (metis AOT_model_denotes_rel.rep_eq AOT_sem_denotes AOT_sem_exe term_equiv) 
    qed
qed

lemma model_disc[AOT_no_atp]: \<open>[v \<Turnstile> D!x] = (\<forall>\<kappa>'. \<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> \<kappa>' \<longrightarrow> (AOT_term_of_var x) = \<kappa>')\<close>
proof
  AOT_world v
  AOT_assume \<open>D!x\<close>
  AOT_hence \<open>\<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    using "RM:3.\<equiv>E(1)" "discern-obj:3" "discern-obj:8" "raa-cor:1" "raa-cor:4" "useful-tautologies:8.\<rightarrow>E.\<rightarrow>E" by blast
  AOT_hence \<open>O!x \<or> (A!x & \<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)))\<close>
    by (meson "con-dis-i-e:3:c" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" "oa-exist:3")
  moreover {
    AOT_assume \<open>O!x\<close>
    then obtain u where 0: \<open>\<kappa>\<upsilon> (AOT_term_of_var x) = \<omega>\<upsilon> u\<close>
      by (metis AOT_model_ordinary_\<omega>\<kappa> \<kappa>\<upsilon>.simps(1))
    have \<open>\<forall>\<kappa>'. \<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> \<kappa>' \<longrightarrow> (AOT_term_of_var x) = \<kappa>'\<close>
      by (metis 0 \<kappa>.exhaust_disc \<kappa>\<upsilon>.simps(1,2,3) \<upsilon>.distinct(1,3) \<upsilon>.sel(1) is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def is_null\<kappa>_def)
  }
  moreover {
    AOT_assume \<open>A!x & \<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    AOT_hence Ax: \<open>A!x\<close> and 1: \<open>\<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      using "&E" by blast+
    AOT_have \<open>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      using 1[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"]] by blast
    AOT_hence 2: \<open>y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)\<close> for y using "\<forall>E"(2) by blast
    AOT_have 3: \<open>\<forall>F([F]y \<equiv> [F]x) \<rightarrow> y = x\<close> for y
    proof(rule "\<rightarrow>I")
      AOT_assume 3: \<open>\<forall>F([F]y \<equiv> [F]x)\<close>
      AOT_show \<open>y = x\<close>
      proof(rule "raa-cor:1")
        AOT_assume \<open>\<not>y = x\<close>
        AOT_hence \<open>y \<noteq> x\<close>
          by (metis "=-infix" "\<equiv>\<^sub>d\<^sub>fI")
        AOT_hence \<open>\<exists>F \<not>([F]y \<equiv> [F]x)\<close> using 2[THEN "\<rightarrow>E"] by blast
        then AOT_obtain F where \<open>\<not>([F]y \<equiv> [F]x)\<close> using "\<exists>E"[rotated] by blast
        AOT_thus \<open>p & \<not>p\<close> for p using 3[THEN "\<forall>E"(2)] "reductio-aa:1" by blast
      qed
    qed
    obtain s where s: \<open>\<kappa>\<upsilon> (AOT_term_of_var x) = \<sigma>\<upsilon> s\<close>
      by (metis Ax AOT_model_abstract_\<alpha>\<kappa> \<kappa>\<upsilon>.simps(2))
    {
      fix \<kappa>'
      obtain a where a: \<open>AOT_term_of_var x = \<alpha>\<kappa> a\<close>
        using AOT_model_abstract_\<alpha>\<kappa> Ax by presburger
      assume \<open>\<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> \<kappa>'\<close>
      moreover obtain y where y: \<open>AOT_term_of_var y = \<kappa>'\<close> 
        by (metis AOT_model.AOT_term_of_var_cases AOT_model_denotes_\<kappa>_def
                      \<kappa>\<upsilon>.simps(3) s \<upsilon>.distinct(5) calculation is_null\<kappa>_def)
      ultimately obtain b where \<open>AOT_term_of_var y = \<alpha>\<kappa> b\<close> and \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
        by (metis \<kappa>.exhaust_disc \<kappa>\<upsilon>.simps(1,2,3) \<upsilon>.distinct(5) \<upsilon>.sel(2) \<upsilon>.simps(5)
                  a is_\<alpha>\<kappa>_def is_\<omega>\<kappa>_def is_null\<kappa>_def)
      have b: \<open>\<exists>a b. AOT_term_of_var y = \<alpha>\<kappa> a \<and> AOT_term_of_var x = \<alpha>\<kappa> b \<and> \<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
        by (metis \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close> \<open>AOT_term_of_var y = \<alpha>\<kappa> b\<close> a)
      AOT_have Ay: \<open>A!y\<close>
        using AOT_model_\<alpha>\<kappa>_ordinary b by force
      AOT_have \<open>\<forall>F([F]y \<equiv> [F]x)\<close>
        using indist_\<alpha>\<sigma>[OF Ay, THEN iffD2, OF b] by blast
      AOT_hence \<open>y = x\<close> using 3[THEN "\<rightarrow>E"] by blast
      hence \<open>y = x\<close> by (metis AOT_sem_eq AOT_var.AOT_term_of_var_inject)
      hence \<open>AOT_term_of_var x = \<kappa>'\<close>
         by (metis y)
    }
    hence \<open>\<forall>\<kappa>'. \<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> \<kappa>' \<longrightarrow> (AOT_term_of_var x) = \<kappa>'\<close>
      by blast
  }
  ultimately show \<open>\<forall>\<kappa>'. \<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> \<kappa>' \<longrightarrow> (AOT_term_of_var x) = \<kappa>'\<close>
    using "con-dis-i-e:4:c" "raa-cor:1" by blast
next
  AOT_world v
  assume 0: \<open>\<forall>\<kappa>'. \<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> \<kappa>' \<longrightarrow> (AOT_term_of_var x) = \<kappa>'\<close>
  AOT_have \<open>O!x \<or> A!x\<close>
    by (simp add: "oa-exist:3")
  moreover AOT_have \<open>A!x \<rightarrow> (A!x & \<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)))\<close>
  proof(safe intro!: "\<rightarrow>I" "&I")
    AOT_assume Ax: \<open>A!x\<close>
    AOT_have \<open>\<box>(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close> for y
    proof (AOT_subst \<open>y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)\<close> \<open>\<forall>F ([F]y \<equiv> [F]x) \<rightarrow> y = x\<close>)
      AOT_show \<open>\<box>(\<forall>F ([F]y \<equiv> [F]x) \<rightarrow> y = x)\<close>
      proof(safe intro!: RN "\<rightarrow>I")
        AOT_modally_strict {
          AOT_have Ax: \<open>A!x\<close>
            by (metis AOT_model_\<alpha>\<kappa>_ordinary AOT_model_abstract_\<alpha>\<kappa> Ax)
          moreover AOT_assume \<open>\<forall>F([F]y \<equiv> [F]x)\<close>
          ultimately obtain a b where \<open>(AOT_term_of_var x) = \<alpha>\<kappa> a\<close>
                                  and \<open>(AOT_term_of_var y) = \<alpha>\<kappa> b\<close>
                                  and \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
            by (metis "\<forall>E"(1) AOT_sem_equiv AOT_sem_exe indist_\<alpha>\<sigma>)
          hence \<open>\<kappa>\<upsilon> (AOT_term_of_var x) = \<kappa>\<upsilon> (AOT_term_of_var y)\<close>
            by (metis \<kappa>\<upsilon>.simps(2))
          hence \<open>AOT_term_of_var x = AOT_term_of_var y\<close>
            using 0 by blast
          AOT_thus \<open>y = x\<close>
            by (metis "rule=I:2[const_var]")
        }
      qed
    next
      AOT_modally_strict {
        AOT_show \<open>y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x) \<equiv> \<forall>F ([F]y \<equiv> [F]x) \<rightarrow> y = x\<close>
        proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
          AOT_assume 0: \<open>y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)\<close>
          AOT_assume 1: \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
          AOT_show \<open>y = x\<close>
          proof(rule "raa-cor:1")
            AOT_assume \<open>\<not>y = x\<close>
            AOT_hence \<open>y \<noteq> x\<close>  by (metis "=-infix" AOT_model_equiv_def)
            AOT_hence \<open>\<exists>F \<not>([F]y \<equiv> [F]x)\<close> using 0[THEN "\<rightarrow>E"] by blast
            then AOT_obtain F where \<open>\<not>([F]y \<equiv> [F]x)\<close> using "\<exists>E"[rotated] by blast
            AOT_thus \<open>p & \<not>p\<close> for p using 1[THEN "\<forall>E"(2)] "reductio-aa:1" by blast
          qed
        next
          AOT_assume \<open>y \<noteq> x\<close>
          AOT_hence \<open>\<not>y = x\<close>
            by (metis "=-infix" AOT_model_equiv_def)
          moreover AOT_assume \<open>\<forall>F ([F]y \<equiv> [F]x) \<rightarrow> y = x\<close>
          ultimately AOT_have \<open>\<not>\<forall>F ([F]y \<equiv> [F]x)\<close>
            by (metis "modus-tollens:1")
          AOT_thus \<open>\<exists>F \<not>([F]y \<equiv> [F]x)\<close>
            by (metis "cqt-further:2" "vdash-properties:10")
        qed
      }
    qed
    AOT_hence \<open>\<forall>y \<box>(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      by (rule GEN)
    AOT_thus \<open>\<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
      using BF[THEN "\<rightarrow>E"] by fast
  qed
  ultimately AOT_have \<open>O!x \<or> (A!x & \<box>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)))\<close>
    using "con-dis-i-e:3:c" "cqt-orig:1[const_var]" AOT_sem_disj by fastforce
  AOT_thus \<open>D!x\<close>
    by (metis (lifting) ext "KBasic:12.\<equiv>E(1)" "T-S5-fund:1.\<rightarrow>E" "con-dis-i-e:2:b" "con-dis-i-e:4:c" "cqt:2"(1)
        "discern-obj:3.unvarify_x.\<forall>E(1).\<equiv>E(2)" "discern-obj:4" "reductio-aa:1" "useful-tautologies:8.\<rightarrow>E.\<rightarrow>E")
qed

lemma model_equinum[AOT_no_atp]:
  assumes \<open>AOT_model_denotes \<Pi>\<close>
      and \<open>AOT_model_denotes \<Pi>'\<close>
    shows \<open>[w\<^sub>0 \<Turnstile> \<Pi> \<approx>\<^sub>D \<Pi>'] = (\<exists> f . bij_betw f {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]})\<close>
proof -
  AOT_actually {
  }
  AOT_actually {
    AOT_assume \<open>\<Pi> \<approx>\<^sub>D \<Pi>'\<close>
    AOT_hence \<open>\<exists>R R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>'\<close>
      using "\<equiv>\<^sub>d\<^sub>fE" "equi:3" by blast
    then AOT_obtain R where R_prop: \<open>R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>'\<close>
      by (metis AOT_model.AOT_var_of_term_inverse AOT_sem_denotes AOT_sem_exists)
    AOT_hence \<open>\<forall>u ([\<Pi>]u \<rightarrow> \<exists>!v(([\<Pi>']v & [R]uv))) & \<forall>v ([\<Pi>']v \<rightarrow> \<exists>!u(([\<Pi>]u & [R]uv)))\<close>
      using "equi:2"
      by (meson "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:1" "con-dis-i-e:2:a" "con-dis-i-e:2:b")
    AOT_have desc_den_\<Pi>': \<open>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<down>\<close> if \<open>\<kappa>\<down> & [D!]\<kappa> & [\<Pi>]\<kappa>\<close> for \<kappa>
      using  "!-exists:1" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E"
            "equi:2.\<equiv>\<^sub>d\<^sub>fE.&E(1).&E(2).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "intro-elim:3:b"
            AOT_sem_desc_denotes R_prop that
      by (smt (verit, ccfv_threshold))
    AOT_have desc_den_\<Pi>: \<open>\<^bold>\<iota>u ([\<Pi>]u & [R]u\<kappa>)\<down>\<close> if \<open>\<kappa>\<down> & [D!]\<kappa> & [\<Pi>']\<kappa>\<close> for \<kappa>
      using  "!-exists:1" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E"
            "equi:2.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "intro-elim:3:b"
            AOT_sem_desc_denotes R_prop that
      by (smt (verit, ccfv_threshold))
    have \<open>inj_on (\<lambda> \<kappa> . \<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<guillemotright>) {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
    proof
      fix \<kappa> \<kappa>'
      assume \<open>\<kappa> \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
      AOT_hence \<kappa>_assm: \<open>[D!]\<kappa> & [\<Pi>]\<kappa>\<close>
        by blast
      AOT_hence \<kappa>_assms': \<open>\<kappa>\<down> & [D!]\<kappa> & [\<Pi>]\<kappa>\<close>
        by (simp add: AOT_sem_conj AOT_sem_exe)
      assume \<open>\<kappa>' \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
      AOT_hence \<kappa>'_assm: \<open>[D!]\<kappa>' & [\<Pi>]\<kappa>'\<close>
        by blast
      AOT_hence \<kappa>'_assm': \<open>\<kappa>'\<down> & [D!]\<kappa>' & [\<Pi>]\<kappa>'\<close>
        by (simp add: AOT_sem_conj AOT_sem_exe)

      AOT_have \<open>\<exists>!v([\<Pi>']v & [R]\<kappa>v)\<close>
        using "!-exists:1.\<equiv>E(1)" \<kappa>_assms' desc_den_\<Pi>' by blast
      then AOT_obtain v where v_def: \<open>v = \<^bold>\<iota>v ([\<Pi>']v & [R]\<kappa>v)\<close>
        by (metis (no_types, lifting) "!-exists:2.\<equiv>E(2).\<exists>E'" "con-dis-i-e:2:a" "hintikka.unvarify_x.\<forall>E(1).\<equiv>E(1).&E(1)" AOT_sem_eq Discernible.Rep_cases mem_Collect_eq)

      AOT_hence unique\<Pi>: \<open>\<exists>!u([\<Pi>]u & [R]uv)\<close>
        using "con-dis-i-e:2:a" "con-dis-i-e:2:b" "equi:2.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "hintikka.unvarify_x.\<forall>E(1).\<equiv>E(1).&E(1)" "russell-axiom[exe,1].\<psi>_denotes_asm" Discernible.restricted_var_condition R_prop by blast
    AOT_hence \<open>\<exists>x (D!x & ([\<Pi>]x & [R]xv) & \<forall>y (D!y & ([\<Pi>]y & [R]yv) \<rightarrow> y = x))\<close>
      using "cqt:2"(1) "uniqueness:1.\<equiv>\<^sub>d\<^sub>fE.\<exists>E'" AOT_sem_exists by blast
    then AOT_obtain x where x_prop: \<open>D!x & ([\<Pi>]x & [R]xv) & \<forall>y (D!y & ([\<Pi>]y & [R]yv) \<rightarrow> y = x)\<close>
      by (meson "instantiation")
    moreover AOT_have \<open>[\<Pi>']v & [R]\<kappa>v\<close>
      using v_def "con-dis-i-e:2:b" "hintikka.unvarify_x.\<forall>E(1).\<equiv>E(1).&E(1)" AOT_sem_eq by blast
    ultimately AOT_have \<kappa>isx: \<open>\<kappa> = x\<close>
      by (metis (no_types, lifting) "&E"(1) "&E"(2) "\<forall>E"(1) "\<rightarrow>E" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" \<kappa>_assm)

      assume \<open>\<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<guillemotright> = \<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>'u)\<guillemotright>\<close>
      AOT_hence \<open>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u) = \<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>'u)\<close>
        using AOT_sem_eq desc_den_\<Pi>'
        using \<kappa>'_assm' by auto

      AOT_hence \<open>[\<Pi>']v & [R]\<kappa>'v\<close>
        using "y-in:3.\<rightarrow>E" AOT_sem_conj AOT_sem_eq v_def by fastforce
      AOT_hence \<kappa>'isx: \<open>\<kappa>' = x\<close>
        using x_prop
        by (metis (no_types, lifting) "&E"(1) "&E"(2) "\<forall>E"(1) "\<rightarrow>E" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" \<kappa>'_assm)

      AOT_have \<open>\<kappa> = \<kappa>'\<close>
        using "id_sym.rule=E'" \<kappa>'isx \<kappa>isx by blast
      thus \<open>\<kappa> = \<kappa>'\<close>
        by (simp add: AOT_sem_eq)
    qed
    moreover have \<open>(\<lambda> \<kappa> . \<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<guillemotright>) ` {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} = {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
    proof(rule; rule)
      fix \<kappa>
      assume \<open>\<kappa> \<in> (\<lambda> \<kappa> . \<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<guillemotright>) ` {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
      AOT_hence \<open>\<exists>x ((D!x & [\<Pi>]x) & \<kappa> = \<^bold>\<iota>u([\<Pi>']u & [R]xu))\<close>
        unfolding image_def apply simp
        by (smt (verit, del_insts) "&E"(1) "&E"(2) "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" "y-in:3.\<rightarrow>E" AOT_sem_desc_denotes AOT_sem_eq AOT_sem_exists desc_den_\<Pi>')
      then AOT_obtain x where \<open>(D!x & [\<Pi>]x) & \<kappa> = \<^bold>\<iota>u([\<Pi>']u & [R]xu)\<close>
        by (meson "instantiation")
      AOT_hence \<open>D!\<kappa> & [\<Pi>']\<kappa>\<close>
        using "y-in:3.\<rightarrow>E" AOT_sem_conj AOT_sem_eq by fastforce
      thus \<open>\<kappa> \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
        by simp
    next
      fix \<kappa>
      assume \<open>\<kappa> \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
      AOT_hence assm: \<open>D!\<kappa> & [\<Pi>']\<kappa>\<close>
        by simp
      AOT_hence \<open>\<exists>!u([\<Pi>]u & [R]u\<kappa>)\<close>
        using "con-dis-i-e:2:a" "con-dis-i-e:2:b" "equi:2.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" R_prop by blast
      AOT_hence \<open>\<exists>x ((D!x & [\<Pi>]x) & \<kappa> = \<^bold>\<iota>u([\<Pi>']u & [R]xu))\<close>
        by (smt (verit, del_insts) "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E"
            "russell-axiom[exe,1].\<psi>_denotes_asm" "y-in:3.\<rightarrow>E" AOT_sem_desc_denotes AOT_sem_eq AOT_sem_exists assm desc_den_\<Pi>
            desc_den_\<Pi>')
      thus \<open>\<kappa> \<in> (\<lambda> \<kappa> . \<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<guillemotright>) ` {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
        unfolding image_def apply simp
        by (smt (verit, del_insts) "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "y-in:3.\<rightarrow>E" AOT_sem_desc_denotes AOT_sem_eq AOT_sem_exists)
    qed

    ultimately have \<open>bij_betw (\<lambda> \<kappa> . \<guillemotleft>\<^bold>\<iota>u ([\<Pi>']u & [R]\<kappa>u)\<guillemotright>)
            {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
      unfolding bij_betw_def
      by blast
    hence \<open>\<exists>f . bij_betw f {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
      by auto
  }
  moreover AOT_actually {
    AOT_have \<Pi>_den: \<open>\<Pi>\<down>\<close>
      using assms(1) AOT_sem_denotes by auto
    AOT_have \<Pi>'_den: \<open>\<Pi>'\<down>\<close>
      using assms(2) AOT_sem_denotes by auto

    assume \<open>\<exists>f . bij_betw f {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
    then obtain f where f_prop: \<open>bij_betw f {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
      by blast
    obtain g where g_def: \<open>g = inv_into {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} f\<close>
      by simp
    have g_prop: \<open>bij_betw g {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
      using f_prop g_def bij_betwE bij_betw_inv_into f_prop by fastforce
    have fg_id: \<open>x \<in> f ` {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} \<Longrightarrow> f (g x) = x\<close> for x
      unfolding g_def
      by (simp add: f_inv_into_f)
    moreover have f_image: \<open>f ` {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} = {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
      by (simp add: bij_betw_imp_surj_on f_prop)
    ultimately have fg_id: \<open>x \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]} \<Longrightarrow> f (g x) = x\<close> for x
      by auto
    have gf_id: \<open>x \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]} \<Longrightarrow> g (f x) = x\<close> for x
      unfolding g_def
      using bij_betw_inv_into_left f_prop by fastforce
    AOT_have den: \<open>[\<lambda>xy D!x & D!y & \<guillemotleft>\<epsilon>\<^sub>\<o> w . y = f x \<guillemotright>]\<down>\<close>
      by (simp add: lambda_dist_denotes2)
    then AOT_obtain R where \<open>R = [\<lambda>xy D!x & D!y & \<guillemotleft>\<epsilon>\<^sub>\<o> w . y = f x \<guillemotright>]\<close>
      using "free-thms:3[const_var].unvarify_\<alpha>.\<forall>E(1).\<exists>E'" by blast
    moreover AOT_have \<open>[\<lambda>xy D!x & D!y & \<guillemotleft>\<epsilon>\<^sub>\<o> w . y = f x \<guillemotright>]\<kappa>\<kappa>' \<equiv> (D!\<kappa> & D!\<kappa>' & \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>' = f \<kappa> \<guillemotright>)\<close> for \<kappa> \<kappa>'
      apply (rule "\<equiv>I")
      using den
      apply (metis (no_types, lifting) "betaC:1:a" "deduction-theorem" case_prod_conv)
      using den
      by (metis (no_types, lifting) "\<equiv>\<^sub>d\<^sub>fI" "beta-C-cor:2.\<rightarrow>E.\<forall>E(1).\<equiv>E(2)" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" "russell-axiom[exe,1].\<psi>_denotes_asm" case_prod_conv tuple_denotes)
    ultimately AOT_have R_eq: \<open>[R]\<kappa>\<kappa>' \<equiv> (D!\<kappa> & D!\<kappa>' & \<guillemotleft>\<epsilon>\<^sub>\<o> w . \<kappa>' = f \<kappa> \<guillemotright>)\<close> for \<kappa> \<kappa>'
      by (simp add: AOT_sem_eq)
    {
      fix x
      AOT_assume Dx: \<open>[D!]x\<close>
      moreover AOT_assume \<open>[\<Pi>]x\<close>
      ultimately have \<open>AOT_term_of_var x \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
        by (simp add: "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E")
      hence \<open>f (AOT_term_of_var x) \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
        using bij_betwE f_prop by blast
      AOT_hence 0: \<open>[D!]\<guillemotleft>f (AOT_term_of_var x)\<guillemotright> & [\<Pi>']\<guillemotleft>f (AOT_term_of_var x)\<guillemotright>\<close>
        by simp
      then AOT_obtain y where y_prop: \<open>y = \<guillemotleft>f (AOT_term_of_var x)\<guillemotright>\<close>
        by (meson "free-thms:3[const_var].unvarify_\<alpha>.\<forall>E(1).\<exists>E'" "russell-axiom[exe,1].\<psi>_denotes_asm" AOT_sem_conj)
      AOT_hence 1: \<open>[D!]y & [\<Pi>']y\<close>
        by (simp add: "0" AOT_sem_eq)
      AOT_hence \<open>D!x & D!y & \<guillemotleft>\<epsilon>\<^sub>\<o> w . AOT_term_of_var y = f (AOT_term_of_var x) \<guillemotright>\<close>
        by (metis (full_types) "con-dis-i-e:2:a" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" AOT_model_proposition_choice_simp AOT_sem_eq Dx y_prop)
      AOT_hence \<open>[R]xy\<close>
        using R_eq by (metis AOT_sem_equiv)
      AOT_hence \<open>[D!]y & ([\<Pi>']y & [R]xy)\<close>
        using "1" "df-simplify:2.\<equiv>E(2)" "oth-class-taut:2:b" by blast
      moreover {
        fix z
        AOT_assume \<open>[D!]z & ([\<Pi>']z & [R]xz)\<close>
        AOT_hence \<open>\<guillemotleft>\<epsilon>\<^sub>\<o> w . AOT_term_of_var z = f (AOT_term_of_var x)\<guillemotright>\<close>
          using AOT_sem_conj AOT_sem_equiv R_eq by force
        hence \<open>AOT_term_of_var z = f (AOT_term_of_var x)\<close>
          by (simp add: AOT_model_proposition_choice_simp)
        hence \<open>y = z\<close>
          using y_prop by (metis AOT_model.AOT_term_of_var_inject AOT_sem_eq)
        AOT_hence \<open>y = z\<close>
          using "id-eq:1" by auto
      }
      ultimately AOT_have \<open>\<exists>!v([\<Pi>']v & [R]xv)\<close>
        using "uniqueness:1"
        by (smt (verit, del_insts) "\<equiv>\<^sub>d\<^sub>fI" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" "existential:1" "universal-cor" AOT_sem_eq)
    }
    moreover {
      fix y
      AOT_assume Dy: \<open>[D!]y\<close>
      moreover AOT_assume \<open>[\<Pi>']y\<close>
      ultimately have y0: \<open>AOT_term_of_var y \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>']\<kappa>]}\<close>
        by (simp add: "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E")
      hence \<open>g (AOT_term_of_var y) \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<Pi>]\<kappa>]}\<close>
        using bij_betwE g_prop by blast
      AOT_hence 0: \<open>[D!]\<guillemotleft>g (AOT_term_of_var y)\<guillemotright> & [\<Pi>]\<guillemotleft>g (AOT_term_of_var y)\<guillemotright>\<close>
        by simp


      then AOT_obtain x where x_prop: \<open>x = \<guillemotleft>g (AOT_term_of_var y)\<guillemotright>\<close>
        by (meson "free-thms:3[const_var].unvarify_\<alpha>.\<forall>E(1).\<exists>E'" "russell-axiom[exe,1].\<psi>_denotes_asm" AOT_sem_conj)
      hence x_prop': \<open>AOT_term_of_var y = f (AOT_term_of_var x)\<close>
        by (metis AOT_sem_eq fg_id y0)
      AOT_have 1: \<open>[D!]x & [\<Pi>]x\<close>
          using x_prop
        by (simp add: "0" AOT_sem_eq)
      AOT_hence \<open>D!x & D!y & \<guillemotleft>\<epsilon>\<^sub>\<o> w . AOT_term_of_var y = f (AOT_term_of_var x) \<guillemotright>\<close>
        by (metis (full_types) "con-dis-i-e:2:a" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" AOT_model_proposition_choice_simp Dy x_prop')
      AOT_hence \<open>[R]xy\<close>
        by (rule R_eq[THEN "\<equiv>E"(2)])
      AOT_hence \<open>[D!]x & ([\<Pi>]x & [R]xy)\<close>
        using "1" "df-simplify:2.\<equiv>E(2)" "oth-class-taut:2:b" by blast
      moreover {
        fix z
        AOT_assume az: \<open>[D!]z & ([\<Pi>]z & [R]zy)\<close>
        AOT_hence \<open>\<guillemotleft>\<epsilon>\<^sub>\<o> w . AOT_term_of_var y = f (AOT_term_of_var z)\<guillemotright>\<close>
          using AOT_sem_conj AOT_sem_equiv R_eq by force
        hence \<open>AOT_term_of_var y = f (AOT_term_of_var z)\<close>
          by (simp add: AOT_model_proposition_choice_simp)
        hence \<open>x = z\<close>
          by (metis "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" AOT_model.AOT_term_of_var_inject AOT_sem_eq az gf_id mem_Collect_eq x_prop)
        AOT_hence \<open>x = z\<close>
          using "id-eq:1" by auto
      }
      ultimately AOT_have \<open>\<exists>!u([\<Pi>]u & [R]uy)\<close>
        using "uniqueness:1"
        by (smt (verit, del_insts) "\<equiv>\<^sub>d\<^sub>fI" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" "existential:1" "universal-cor" AOT_sem_eq)
    }
    ultimately AOT_have \<open>\<forall>u ([\<Pi>]u \<rightarrow> \<exists>!v([\<Pi>']v & [R]uv)) & \<forall>v ([\<Pi>']v \<rightarrow> \<exists>!u(([\<Pi>]u & [R]uv)))\<close>
      by (auto intro!: "&I" GEN "\<rightarrow>I")
    AOT_hence \<open>R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>'\<close>
      by (auto intro!: "equi:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" \<Pi>_den \<Pi>'_den "cqt:2" elim: "&E")
    AOT_hence \<open>\<exists>R R |: \<Pi> \<^sub>1\<^sub>-\<^sub>1\<longleftrightarrow>\<^sub>D \<Pi>'\<close>
      using "\<exists>I" by fast
    AOT_hence \<open>\<Pi> \<approx>\<^sub>D \<Pi>'\<close>
      by (simp add: "equi:3.\<equiv>\<^sub>d\<^sub>fI")
  }
  ultimately show ?thesis
    by auto
qed

lemma finite_card_zeroI[AOT_no_atp]:
  assumes \<open>[w\<^sub>0 \<Turnstile> \<Pi>\<down>]\<close>
  assumes \<open>[w\<^sub>0 \<Turnstile> \<not>\<exists>x (D!x & [\<Pi>]x)]\<close>
  shows \<open>finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<Pi>]\<kappa>]} = Some 0\<close>
proof -
  AOT_world w\<^sub>0
  {
    fix \<kappa>
    AOT_assume \<Pi>\<kappa>: \<open>[\<Pi>]\<kappa>\<close>
    AOT_assume D\<kappa>: \<open>D!\<kappa>\<close>
    AOT_have \<open>D!\<kappa> & [\<Pi>]\<kappa>\<close> using \<Pi>\<kappa> D\<kappa> "&I" by blast
    hence \<open>False\<close> using assms(2)
      using "russell-axiom[exe,1].\<psi>_denotes_asm" AOT_sem_exists AOT_sem_not \<Pi>\<kappa> by blast
  }
  hence \<open>{\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<Pi>]\<kappa>]} = {}\<close>
    using AOT_sem_conj by blast
  thus ?thesis by (metis card_eq_0_iff finite.emptyI finite_card_def)
qed

lemma AOT_model_discernible'[AOT_no_atp]: \<open>{\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]} = {\<kappa> . AOT_model_discernible \<kappa> \<and> AOT_model_valid_in w\<^sub>0 (Rep_urrel r (\<kappa>\<upsilon> \<kappa>))}\<close>
proof(rule; rule)
  fix \<kappa>
  assume \<open>\<kappa> \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]}\<close>
  hence \<open>[w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]\<close>
    by blast
  hence \<open>AOT_model_discernible \<kappa> \<and> AOT_model_valid_in w\<^sub>0 (Rep_urrel r (\<kappa>\<upsilon> \<kappa>))\<close>
    unfolding AOT_model_discernible_def
    by (metis AOT_model.AOT_term_of_var_cases AOT_sem_conj AOT_sem_denotes AOT_sem_exe Abs_rel_inverse UNIV_I model_disc urrel_to_rel_def)
  thus \<open>\<kappa> \<in> {\<kappa> . AOT_model_discernible \<kappa> \<and> AOT_model_valid_in w\<^sub>0 (Rep_urrel r (\<kappa>\<upsilon> \<kappa>))}\<close>
    by auto
next
  fix \<kappa>
  have den: \<open>AOT_model_denotes (Abs_rel (\<lambda>x. Rep_urrel r (\<kappa>\<upsilon> x)))\<close>
    by (simp add: AOT_model_denotes_\<kappa>_def AOT_model_denotes_rel.abs_eq AOT_model_term_equiv_\<kappa>_def AOT_model_unary_regular urrel_null_false)
  assume \<open>\<kappa> \<in> {\<kappa> . AOT_model_discernible \<kappa> \<and> AOT_model_valid_in w\<^sub>0 (Rep_urrel r (\<kappa>\<upsilon> \<kappa>))}\<close>
  hence 0: \<open>AOT_model_discernible \<kappa> \<and> AOT_model_valid_in w\<^sub>0 (Rep_urrel r (\<kappa>\<upsilon> \<kappa>))\<close>
    by blast
  have \<open>[w\<^sub>0 \<Turnstile> [D!]\<kappa>]\<close>
    using 0[THEN conjunct1] model_disc
    unfolding AOT_model_discernible_def
    by (metis "0" AOT_model.AOT_term_of_var_cases AOT_model_denotes_\<kappa>_def urrel_null_false)
  moreover have \<open>[w\<^sub>0 \<Turnstile> [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]\<close>
    unfolding urrel_to_rel_def AOT_sem_exe Abs_rel_inverse[simplified]
    using den AOT_sem_denotes
    using "russell-axiom[exe,1].\<psi>_denotes_asm" calculation
    using "0" by blast
  ultimately have \<open>[w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]\<close>
    by (simp add: AOT_sem_conj)
  thus \<open>\<kappa> \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]}\<close>
    by blast
qed

lemma \<alpha>\<sigma>_disc'[AOT_no_atp]:
  assumes \<open>\<alpha>\<sigma> x = \<alpha>\<sigma> y\<close> (* x and y have the same proxy/urelement *)
  and \<open>(\<And>r. (r \<in> x) = (finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]} = Some n))\<close>
  shows \<open>x = y\<close>
proof -
  have \<open>x = { r . (finite_card  {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]} = Some n)}\<close>
    using AOT_model_discernible' assms(2) by blast
  thus ?thesis
    using \<alpha>\<sigma>_disc[OF assms(1)] assms(2) AOT_model_discernible'
    by auto
qed

lemma \<alpha>\<sigma>_disc_infinite'[AOT_no_atp]:
  assumes \<open>\<alpha>\<sigma> x = \<alpha>\<sigma> y\<close>
  and \<open>(\<And>r. (r \<in> x) = (infinite {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]}))\<close>
  shows \<open>x = y\<close>
proof -
  have \<open>x = { r . (infinite  {\<kappa>. [w\<^sub>0 \<Turnstile> [D!]\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]})}\<close>
    using AOT_model_discernible' assms(2) by blast
  thus ?thesis
    using \<alpha>\<sigma>_disc_infinite assms AOT_model_discernible'
    by auto
qed


lemma countable_disc_prop[AOT_no_atp]: \<open>countable {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa>]}\<close>
proof -
  have \<open>{\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa>]} = {\<kappa>::\<kappa>. \<not>is_null\<kappa> \<kappa> \<and> AOT_model_discernible \<kappa>}\<close>
    using model_disc
    unfolding AOT_model_discernible_def
    by (metis (full_types) AOT_model.AOT_term_of_var_cases AOT_model_denotes_\<kappa>_def AOT_sem_denotes AOT_sem_exe Collect_cong)
  thus ?thesis
    by (simp add: disc_countable)
qed

lemma countable_disc_conj_prop[AOT_no_atp]: \<open>countable {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & \<phi>{\<kappa>}]}\<close>
proof -
  {
    fix x
    assume \<open>x \<in> {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & \<phi>{\<kappa>}]}\<close>
    hence \<open>x \<in> {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa>]}\<close>
      using "con-dis-i-e:2:a" by blast
  }
  thus ?thesis
    using countable_disc_prop countable_subset subsetI by blast
qed

(* Note: actually not needed anymore and subsumed in the theorem below *)
theorem numbers_zero_den[AOT_no_atp]: \<open>[v \<Turnstile> [\<lambda>x Numbers(x,[\<lambda>z D!z & z \<noteq>\<^sub>D z])]\<down>]\<close>
proof (safe intro!: "kirchner-thm:1"[THEN "\<equiv>E"(2)] RN "\<rightarrow>I" GEN)
  AOT_modally_strict {
      AOT_have \<open>[\<lambda>z D!z & z \<noteq>\<^sub>D z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[\<lambda>z D!z & z \<noteq>\<^sub>D z]z]\<close>
      proof (safe intro!: "approx-nec:1"[unvarify F, THEN "\<rightarrow>E"] "cqt:2" "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I")
        AOT_show \<open>\<box>\<forall>x ([\<lambda>z D!z & z \<noteq>\<^sub>D z]x \<rightarrow> \<box>[\<lambda>z D!z & z \<noteq>\<^sub>D z]x)\<close>
        proof (rule RN; safe intro!: GEN "\<rightarrow>I")
          AOT_modally_strict {
            fix x
            AOT_assume \<open>[\<lambda>z D!z & z \<noteq>\<^sub>D z]x\<close>
            AOT_hence 0: \<open>D!x & x \<noteq>\<^sub>D x\<close>  by (metis "betaC:1:a")
            AOT_hence \<open>\<not>x =\<^sub>D x\<close>
              by (metis "con-dis-taut:2" "intro-elim:3:d" "modus-tollens:1" "discern-obj:25" AOT_sem_not)
            moreover AOT_have \<open>x =\<^sub>D x\<close>
              using "0" "con-dis-taut:1.\<rightarrow>E" "cqt:2"(1) "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" by blast
            ultimately AOT_show \<open>\<box>[\<lambda>z D!z & z \<noteq>\<^sub>D z]x\<close> using "reductio-aa:1" by blast
          }
        qed
      qed
  } note empty_approx_act_empty = this
  AOT_modally_strict {
    fix x y
    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    AOT_assume x_numbers_zero: \<open>Numbers(x,[\<lambda>z D!z & z \<noteq>\<^sub>D z])\<close>
    AOT_hence \<open>A!x & [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z])\<close>
      using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    AOT_hence Ax: \<open>A!x\<close> and x_prop: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z])\<close>
      using "&E" by blast+

    obtain a b where a_prop: \<open>AOT_term_of_var x = \<alpha>\<kappa> a\<close>
                 and b_prop: \<open>AOT_term_of_var y = \<alpha>\<kappa> b\<close>
                 and \<alpha>\<sigma>_eq: \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
      using indist_\<alpha>\<sigma>[OF Ax] indist by blast

    {
      fix r
      assume \<open>r \<in> a\<close>
      AOT_hence \<open>x[\<guillemotleft>urrel_to_rel r\<guillemotright>]\<close>
        by (metis (no_types, lifting) AOT_enc_\<kappa>_meta AOT_model.AOT_term_of_var
              AOT_model_enc_\<kappa>_def AOT_rel_equiv_def Quotient3_abs_rep
              Quotient3_rel_rep \<kappa>.simps(11) a_prop urrel_quotient3)
      moreover AOT_have r_den: \<open>\<guillemotleft>urrel_to_rel r\<guillemotright>\<down>\<close>
        using AOT_sem_enc_denotes calculation by blast
      ultimately AOT_have \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<close>
        using x_prop[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] by blast
      AOT_hence \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[\<lambda>z D!z & z \<noteq>\<^sub>D z]z]\<close>
        using empty_approx_act_empty
        by (smt (verit, del_insts) "eq-part:3[terms]")
      AOT_hence act_approx: \<open>\<^bold>\<A>\<guillemotleft>urrel_to_rel r\<guillemotright> \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<close>
        by (safe intro!: act_approx_lem[unvarify F G, THEN "\<equiv>E"(1)] "cqt:2" r_den)
      AOT_actually {
        AOT_have equin: \<open>\<guillemotleft>urrel_to_rel r\<guillemotright> \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<close>
          using act_approx AOT_sem_act by blast
        have \<open>\<exists>f. bij_betw f {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]} {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<kappa>]}\<close>
          apply (rule model_equinum[THEN iffD1, rotated, rotated, OF equin])
          using AOT_sem_denotes r_den apply blast
          using AOT_sem_denotes eq_den_2 equin by blast
        hence \<open>finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]} =
                finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<kappa>]}\<close>
          by (metis (no_types, lifting) "existential:1" "russell-axiom[exe,1].\<psi>_denotes_asm" AOT_sem_conj AOT_sem_not bij_betwE mem_Collect_eq unotEu)
        moreover have \<open>finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<kappa>]} = Some 0\<close>
        proof(rule finite_card_zeroI)
          AOT_show \<open>[\<lambda>z D!z & z \<noteq>\<^sub>D z]\<down>\<close> by "cqt:2"
        next
          AOT_show \<open>\<not>\<exists>x (D!x & [\<lambda>z D!z & z \<noteq>\<^sub>D z]x)\<close>
          proof(rule "raa-cor:2")
            AOT_assume \<open>\<exists>x (D!x & [\<lambda>z D!z & z \<noteq>\<^sub>D z]x)\<close>
            then AOT_obtain x where \<open>D!x & [\<lambda>z D!z & z \<noteq>\<^sub>D z]x\<close>
              using "\<exists>E"[rotated] by blast
            AOT_hence 0: \<open>D!x & x \<noteq>\<^sub>D x\<close>
              using "betaC:1:a" AOT_sem_conj by blast
            AOT_hence \<open>\<not>(x =\<^sub>D x)\<close>
              by (metis "con-dis-taut:2" "intro-elim:3:d" "modus-tollens:1" "discern-obj:25" AOT_sem_not)
            moreover AOT_have \<open>x =\<^sub>D x\<close>
              using "0" "con-dis-i-e:2:a" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" by blast
            ultimately AOT_show \<open>p & \<not>p\<close> for p using "reductio-aa:1" by blast
          qed
        qed
        ultimately have \<open>finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]} = Some 0\<close>
          by (smt (verit, del_insts) Abs_rel_inverse Collect_cong iso_tuple_UNIV_I urrel_to_rel_def)
      }
      hence \<open>finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]} = Some 0\<close>
        by blast
    }
    moreover {
      fix r
      assume \<open>finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]} = Some 0\<close>
      hence 0: \<open>{\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]} = {}\<close>
        by (metis (no_types, lifting) card_0_eq finite_card_def option.distinct(1) option.inject)
      AOT_have r_den: \<open>\<guillemotleft>urrel_to_rel r\<guillemotright>\<down>\<close>
        by (metis AOT_rel_equiv_def AOT_sem_denotes Quotient3_rel_rep urrel_quotient3)
      AOT_actually {
        AOT_have r_den: \<open>\<guillemotleft>urrel_to_rel r\<guillemotright>\<down>\<close>
          by (metis AOT_rel_equiv_def AOT_sem_denotes Quotient3_rel_rep urrel_quotient3)
        AOT_hence \<open>\<guillemotleft>urrel_to_rel r\<guillemotright> \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<close>
        proof (safe intro!: "empty-approx:1"[unvarify F H, THEN "\<rightarrow>E"] "cqt:2" "&I")
          AOT_show \<open>\<not>\<exists>u [\<guillemotleft>urrel_to_rel r\<guillemotright>]u\<close>
          proof(rule "raa-cor:2")
            AOT_assume \<open>\<exists>u [\<guillemotleft>urrel_to_rel r\<guillemotright>]u\<close>
            then AOT_obtain x where x_prop: \<open>D!x & [\<guillemotleft>urrel_to_rel r\<guillemotright>]x\<close> using "\<exists>E"[rotated] by blast
            hence \<open>AOT_term_of_var x \<in> {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>(urrel_to_rel r)\<guillemotright>]\<kappa>]}\<close>
              by auto
            hence \<open>False\<close>
              using 0 by (metis emptyE)
            AOT_thus \<open>p & \<not>p\<close> for p by auto
          qed
        next
          AOT_show \<open>\<not>\<exists>v [\<lambda>z D!z & z \<noteq>\<^sub>D z]v\<close>
          proof(rule "raa-cor:2")
            AOT_assume \<open>\<exists>v [\<lambda>z D!z & z \<noteq>\<^sub>D z]v\<close>
            then AOT_obtain v where v: \<open>[\<lambda>z D!z & z \<noteq>\<^sub>D z]v\<close>
              using "Discernible.\<exists>E" by blast
            AOT_hence \<open>\<not>(v =\<^sub>D v)\<close> by (smt (verit, del_insts) "existential:2[const_var]" "raa-cor:5" unotEu)
            moreover AOT_have \<open>v =\<^sub>D v\<close>
              using "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Discernible.restricted_var_condition by force
            ultimately AOT_show \<open>p & \<not>p\<close> for p using "reductio-aa:1" by blast
          qed
        qed
      }
    AOT_hence \<open>\<^bold>\<A>(\<guillemotleft>urrel_to_rel r\<guillemotright> \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z])\<close>
         by (smt (verit, del_insts) AOT_sem_act)
     AOT_hence \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[\<lambda>z D!z & z \<noteq>\<^sub>D z]z]\<close>
       by (safe intro!: act_approx_lem[unvarify F G, THEN "\<equiv>E"(2)] "cqt:2" r_den)
     AOT_hence \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D [\<lambda>z D!z & z \<noteq>\<^sub>D z]\<close>
       using "eq-part:2[terms]" "eq-part:3[terms]" "vdash-properties:10" empty_approx_act_empty by blast
     AOT_hence \<open>x[\<guillemotleft>urrel_to_rel r\<guillemotright>]\<close>
       using x_prop[THEN "\<forall>E"(1), THEN "\<equiv>E"(2), OF r_den] by blast
     hence \<open>r \<in> a\<close>
       by (smt (verit, del_insts) AOT_enc_\<kappa>_meta AOT_model_enc_\<kappa>_def Quotient3_abs_rep \<kappa>.simps(11) a_prop urrel_quotient3)
   }
    ultimately have \<open>a = b\<close> using \<alpha>\<sigma>_disc'[OF \<alpha>\<sigma>_eq] by blast
    AOT_hence \<open>x = y\<close>
      by (metis "rule=I:2[const_var]" a_prop b_prop)

    AOT_hence \<open>Numbers(y,[\<lambda>z D!z & z \<noteq>\<^sub>D z])\<close>
       by (smt (verit, del_insts) \<open>a = b\<close> a_prop b_prop x_numbers_zero)
  } note 0 = this
  AOT_modally_strict {
    fix x y
    AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    moreover AOT_have \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
      using calculation
      by (metis "cqt-basic:11" "intro-elim:3:b")
    ultimately AOT_show \<open>Numbers(x,[\<lambda>z D!z & z \<noteq>\<^sub>D z]) \<equiv> Numbers(y,[\<lambda>z D!z & z \<noteq>\<^sub>D z])\<close>
      using 0 "\<equiv>I" "\<rightarrow>I" by auto
  }
qed

theorem numbers_prop_den[AOT_no_atp]: \<open>[v \<Turnstile> [\<lambda>x Numbers(x,G)]\<down>]\<close>
proof (safe intro!: "kirchner-thm:1"[THEN "\<equiv>E"(2)] RN "\<rightarrow>I" GEN)
  AOT_modally_strict {
    fix x y
    AOT_assume indist: \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    AOT_assume num_x_G: \<open>Numbers(x,G)\<close>

    AOT_obtain H where \<open>Rigidifies(H,G)\<close>
      by (metis "instantiation" "rigid-der:3")
    AOT_hence rigid_H: \<open>Rigid(H)\<close> and eq: \<open>\<forall>x ([H]x \<equiv> [G]x)\<close>
      using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
    AOT_have \<open>H \<equiv>\<^sub>D G\<close>
      by (safe intro!: eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" GEN "\<rightarrow>I" eq[THEN "\<forall>E"(2)])
    AOT_hence H_approx_G: \<open>H \<approx>\<^sub>D G\<close>
      by (metis "apE-eqE:1" "vdash-properties:10")
    AOT_hence numxH: \<open>Numbers(x,H)\<close>
       by (metis "num-tran:1" "vdash-properties:10" "\<equiv>E"(2) num_x_G)

    AOT_hence \<open>A!x & H\<down> & \<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H)\<close>
      using numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
    AOT_hence Ax: \<open>A!x\<close> and equinum_x: \<open>\<forall>F (x[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H)\<close>
      using "&E" by blast+
    AOT_have Ay: \<open>A!y\<close> using indist[THEN "\<forall>E"(1)] Ax "\<equiv>E" "oa-exist:2" by fast

    obtain a and b where a_def: \<open>AOT_term_of_var x = \<alpha>\<kappa> a\<close>
                     and b_def: \<open>AOT_term_of_var y = \<alpha>\<kappa> b\<close>
      using AOT_model_abstract_\<alpha>\<kappa> Ax Ay by presburger+


    AOT_have den: \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w. \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]\<down>\<close>
      unfolding AOT_sem_denotes AOT_model_lambda_denotes AOT_model_proposition_choice_simp
      using AOT_model_term_equiv_\<kappa>_def by presburger
    AOT_hence \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w. \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]x \<equiv> [\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w. \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]y\<close>
      using indist "\<forall>E"(1) by blast
    moreover AOT_have \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w. \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]x\<close>
      unfolding AOT_sem_exe apply (simp add: den "cqt:2")
      by (metis (mono_tags, lifting) "betaC:2:a" "russell-axiom[exe,1].\<psi>_denotes_asm"
          AOT_model_proposition_choice_simp AOT_sem_exe_denoting Ax \<kappa>\<upsilon>.simps(2) a_def den)
    ultimately AOT_have \<open>[\<lambda>x \<guillemotleft>\<epsilon>\<^sub>\<o> w. \<kappa>\<upsilon> x = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<guillemotright>]y\<close>
      using "\<equiv>E"(1) by blast
    hence \<open>\<kappa>\<upsilon> (\<alpha>\<kappa> b) = \<sigma>\<upsilon> (\<alpha>\<sigma> a)\<close>
      unfolding b_def
      by (meson "betaC:1:a" AOT_model_proposition_choice_simp)
    hence \<alpha>\<sigma>_eq: \<open>\<alpha>\<sigma> a = \<alpha>\<sigma> b\<close>
      by simp

    {
      fix r
      assume \<open>r \<in> a\<close>
      moreover AOT_have urrl_to_rel_r_denotes: \<open>\<guillemotleft>urrel_to_rel r\<guillemotright>\<down>\<close>
        by (metis AOT_rel_equiv_def AOT_sem_denotes Quotient3_rel_rep urrel_quotient3)
      moreover AOT_have \<open>x[\<guillemotleft>urrel_to_rel r\<guillemotright>]\<close>
        unfolding a_def
        unfolding AOT_enc_\<kappa>_meta
        by (smt (verit, best) AOT_model_denotes_\<kappa>_def AOT_model_enc_\<kappa>_def
                  AOT_rel_equiv_def Quotient3_def \<kappa>.disc(8)
                  \<kappa>.simps(11) urrel_quotient3 calculation)
      ultimately AOT_have \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D H\<close>
        using equinum_x[THEN "\<forall>E"(1), THEN "\<equiv>E"(1)] by blast
      moreover AOT_have \<open>H \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[H]z]\<close>
        by (simp add: "approx-nec:1.unvarify_F.\<forall>E(1).\<rightarrow>E" "cqt:2"(1) rigid_H)
      ultimately AOT_have \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[H]z]\<close>
        using "eq-part:3[terms]" by blast
      AOT_hence 0: \<open>\<^bold>\<A>([\<guillemotleft>urrel_to_rel r\<guillemotright>] \<approx>\<^sub>D H)\<close>
        by (simp add: "act_approx_lem.unvarify_F.unvarify_G.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" "cqt:2"(1) urrl_to_rel_r_denotes)
      hence \<open>\<exists>f . bij_betw f {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}  {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]}\<close>
        using AOT_model.AOT_term_of_var AOT_sem_act AOT_sem_denotes model_equinum urrl_to_rel_r_denotes by blast
    } note 0 = this
    moreover {
      fix r
      assume \<open>\<exists>f . bij_betw f {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}  {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]}\<close>
      moreover AOT_have urrl_to_rel_r_denotes: \<open>\<guillemotleft>urrel_to_rel r\<guillemotright>\<down>\<close>
        by (metis AOT_rel_equiv_def AOT_sem_denotes Quotient3_rel_rep urrel_quotient3)
      ultimately AOT_have 0: \<open>\<^bold>\<A>([\<guillemotleft>urrel_to_rel r\<guillemotright>] \<approx>\<^sub>D H)\<close>
        by (simp add: AOT_model.AOT_term_of_var AOT_sem_act AOT_sem_denotes model_equinum)
      AOT_hence \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[H]z]\<close>
        by (simp add: "act_approx_lem.unvarify_F.unvarify_G.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "cqt:2"(1) urrl_to_rel_r_denotes)
      moreover AOT_have \<open>H \<approx>\<^sub>D [\<lambda>z \<^bold>\<A>[H]z]\<close>
        by (simp add: "approx-nec:1.unvarify_F.\<forall>E(1).\<rightarrow>E" "cqt:2"(1) rigid_H)
      ultimately AOT_have \<open>[\<lambda>z \<^bold>\<A>[\<guillemotleft>urrel_to_rel r\<guillemotright>]z] \<approx>\<^sub>D H\<close>
        using "eq-part:2[terms].\<rightarrow>E" "eq-part:3[terms]" by blast
      AOT_hence \<open>x[\<guillemotleft>urrel_to_rel r\<guillemotright>]\<close>
        using "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(2).\<forall>E(1).\<equiv>E(2)" numxH urrl_to_rel_r_denotes by auto
      hence \<open>r \<in> a\<close>
        by (metis (no_types, lifting) AOT_enc_\<kappa>_meta AOT_model_enc_\<kappa>_def Quotient3_abs_rep \<kappa>.simps(11) a_def urrel_quotient3)
    }
    ultimately have r_in_a_cond: \<open>r \<in> a = (\<exists>f . bij_betw f {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}  {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]})\<close> for r
      by blast

    {
      assume finite_h: \<open>finite {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]}\<close>
      hence \<open>\<exists> n . finite_card {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]} = Some n\<close>
        by (meson finite_card_def)
      then obtain n where n_prop: \<open>finite_card {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]} = Some n\<close>
        by auto
      hence \<open>(\<exists>f . bij_betw f {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}  {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]}) =
             (finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]} = Some n)\<close> for r
        by (smt (verit, ccfv_SIG) bij_betw_finite bij_betw_same_card finite_card_def finite_same_card_bij option.inject option.simps(3))
      hence \<open>r \<in> a = (finite_card {\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [\<guillemotleft>urrel_to_rel r\<guillemotright>]\<kappa>]} = Some n)\<close> for r
        using r_in_a_cond
        by auto
      hence \<open>a = b\<close>
        by (simp add: \<alpha>\<sigma>_disc' \<alpha>\<sigma>_eq)
    }
    moreover {
      assume infinite_assm: \<open>infinite {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [H]\<kappa>]}\<close>
      hence countable_assm: \<open>countable {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [H]\<kappa>]}\<close>
        by (simp add: countable_disc_conj_prop)
      have 1: \<open>bij_betw (to_nat_on {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [H]\<kappa>]}) {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [H]\<kappa>]} UNIV\<close>
        by (simp add: countable_assm infinite_assm to_nat_on_infinite)
      have 2: \<open>bij_betw (from_nat_into {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [H]\<kappa>]}) UNIV {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> & [H]\<kappa>]}\<close>
        by (simp add: countable_assm infinite_assm bij_betw_from_nat_into)
        thm to_nat_on_infinite bij_betw_from_nat_into
      thm \<alpha>\<sigma>_disc_infinite'
      {
        fix r
        assume \<open>r \<in> a\<close>
        hence \<open>infinite {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}\<close>
          using r_in_a_cond infinite_assm bij_betw_finite by blast
      }
      moreover {
        fix r
        assume 3: \<open>infinite {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}\<close>
        hence 4: \<open>countable {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}\<close>
          by (simp add: countable_disc_conj_prop)
        have \<open>(\<exists>f . bij_betw f {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}  {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]})\<close>
          apply (rule exI[where x="from_nat_into {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [H] \<kappa>]} o to_nat_on {\<kappa>::\<kappa>. [w\<^sub>0 \<Turnstile> D!\<kappa> &  [\<guillemotleft>urrel_to_rel r\<guillemotright>] \<kappa>]}"])
          using "2" "3" "local.4" bij_betw_trans to_nat_on_infinite by blast
        hence \<open>r \<in> a\<close>
          using r_in_a_cond
          by blast
      }
      hence \<open>a = b\<close>
        using \<alpha>\<sigma>_disc_infinite'
        using \<alpha>\<sigma>_eq calculation by blast
    }
    ultimately have \<open>a = b\<close>
      by blast

    AOT_hence y1: \<open>\<forall>F (y[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H)\<close>
      using a_def b_def equinum_x by auto
    AOT_have \<open>\<forall>F (y[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" GEN)
      fix F
      AOT_assume \<open>y[F]\<close>
      moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> by "cqt:2"
      ultimately AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close>
        using y1[THEN "\<forall>E"(2)] "\<equiv>E" by blast
      AOT_thus \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>
        using H_approx_G by (metis "eq-part:3[terms]")
    next
      fix F
      AOT_assume \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G\<close>
      AOT_hence \<open>[\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D H\<close>
        using H_approx_G "eq-part:3[terms]" "eq-part:2[terms]" "\<rightarrow>E" by fast
      moreover AOT_have \<open>[\<lambda>z \<^bold>\<A>[F]z]\<down>\<close> by "cqt:2"
      ultimately AOT_show \<open>y[F]\<close>
        using y1[THEN "\<forall>E"(2)] "\<equiv>E" by blast
    qed
    AOT_hence \<open>A!y & G\<down> & \<forall>F (y[F] \<equiv> [\<lambda>z \<^bold>\<A>[F]z] \<approx>\<^sub>D G)\<close>
      by (safe intro!: "&I" Ay "cqt:2")
    AOT_hence \<open>Numbers(y,G)\<close>
      using numbers[THEN "\<equiv>\<^sub>d\<^sub>fI"] by blast
  } note 1 = this
  AOT_modally_strict {
    fix x y
    AOT_assume \<open>\<forall>F ([F]x \<equiv> [F]y)\<close>
    moreover AOT_have \<open>\<forall>F ([F]y \<equiv> [F]x)\<close>
      using calculation
      by (metis "cqt-basic:11" "intro-elim:3:b")
    ultimately AOT_show \<open>Numbers(x,G) \<equiv> Numbers(y,G)\<close>
      using 1 "\<equiv>I" "\<rightarrow>I" by auto
  }
qed
declare AOT_no_atp[no_atp]

(************************************ MODEL LEVEL PROOFS END *************************************)

text\<open>The two theorems above allow us to derive
     the predecessor axiom of PLM as theorem.\<close>

AOT_theorem pred: \<open>[\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<down>\<close>
  using pred_coex numbers_prop_den["\<forall>I" G] "\<equiv>E" by blast

AOT_define Predecessor :: \<open>\<Pi>\<close> (\<open>\<bbbP>\<close>)
  "pred-thm:1":
  \<open>\<bbbP> =\<^sub>d\<^sub>f [\<lambda>xy \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))]\<close>

AOT_theorem "pred-thm:2": \<open>\<bbbP>\<down>\<close>
  using pred "pred-thm:1" "rule-id-df:2:b[zero]" by blast

AOT_theorem "pred-thm:3":
  \<open>[\<bbbP>]xy \<equiv> \<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    by (auto intro!: "beta-C-meta"[unvarify \<nu>\<^sub>1\<nu>\<^sub>n, where \<tau>=\<open>(_,_)\<close>, THEN "\<rightarrow>E",
                                   rotated, OF pred, simplified]
                     tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "cqt:2" pred
             intro: "=\<^sub>d\<^sub>fI"(2)[OF "pred-thm:1"])

AOT_theorem "pred-1-1:1": \<open>[\<bbbP>]xy \<rightarrow> \<box>[\<bbbP>]xy\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>[\<bbbP>]xy\<close>
  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "\<equiv>E"(1) "pred-thm:3" by fast
  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain u where props: \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
    using "Discernible.\<exists>E"[rotated] by meson
  AOT_obtain G where Ridigifies_G_F: \<open>Rigidifies(G, F)\<close>
    by (metis "instantiation" "rigid-der:3")
  AOT_hence \<xi>: \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close> and \<zeta>: \<open>\<forall>x([G]x \<equiv> [F]x)\<close>
    using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(1),
                           THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-rigid-rel:1"], THEN "&E"(2)]
          "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE", THEN "&E"(2)] by blast+

  AOT_have rigid_num_nec: \<open>Numbers(x,F) & Rigidifies(G,F) \<rightarrow> \<box>Numbers(x,G)\<close>
    for x G F
  proof(rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
    fix G F x
    AOT_assume Numbers_xF: \<open>Numbers(x,F)\<close>
    AOT_assume \<open>Rigidifies(G,F)\<close>
    AOT_hence \<xi>: \<open>Rigid(G)\<close> and \<zeta>: \<open>\<forall>x([G]x \<equiv> [F]x)\<close>
      using "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E" by blast+
    AOT_thus \<open>\<box>Numbers(x,G)\<close>
    proof (safe intro!:
          "num-cont:2"[THEN "\<rightarrow>E", OF \<xi>, THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"],
                       THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
          "num-tran2"[THEN "\<rightarrow>E", THEN "\<equiv>E"(1), rotated, OF Numbers_xF]
          eqD[THEN "\<equiv>\<^sub>d\<^sub>fI"]
            "&I" "cqt:2[const_var]"[axiom_inst] Discernible.GEN "\<rightarrow>I")
      AOT_show \<open>[F]u \<equiv> [G]u\<close> for u
        using \<zeta>[THEN "\<forall>E"(2)] by (metis "\<equiv>E"(6) "oth-class-taut:3:a") 
    qed
  qed
  AOT_have \<open>\<box>Numbers(y,G)\<close>
    using rigid_num_nec[THEN "\<rightarrow>E", OF "&I", OF props[THEN "&E"(1), THEN "&E"(2)],
                        OF Ridigifies_G_F].
  moreover {
    AOT_have \<open>Rigidifies([G]\<^sup>-\<^sup>u, [F]\<^sup>-\<^sup>u)\<close>
    proof (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "df-rigid-rel:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
                        "&I" "F-u:2[den]" GEN "\<equiv>I" "\<rightarrow>I")
      AOT_have \<open>\<box>\<forall>x([G]x \<rightarrow> \<box>[G]x) \<rightarrow> \<box>\<forall>x([[G]\<^sup>-\<^sup>u]x \<rightarrow> \<box>[[G]\<^sup>-\<^sup>u]x)\<close>
      proof (rule RM; safe intro!: "\<rightarrow>I" GEN)
        AOT_modally_strict {
          fix x
          AOT_assume 0: \<open>\<forall>x([G]x \<rightarrow> \<box>[G]x)\<close>
          AOT_assume 1: \<open>[[G]\<^sup>-\<^sup>u]x\<close>
          AOT_have \<open>[\<lambda>x [G]x & x \<noteq> u]x\<close>
            apply (rule "F-u:2"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
            apply (rule "F-u:1")
            by (fact 1)
          AOT_hence A: \<open>[G]x & x \<noteq> u\<close>
            by (rule "\<beta>\<rightarrow>C"(1))
          AOT_hence 2: \<open>\<box>[G]x\<close>
            using "&E" 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E"] "id-nec4:1" "\<equiv>E"(1)
            by blast
          AOT_have 3: \<open>\<box>x \<noteq> u\<close>
            using A[THEN "&E"(2)]
            by (simp add: "cqt:2"(1) "id-nec2:2.unvarify_\<alpha>.unvarify_\<beta>.\<forall>E(1).\<forall>E(1).\<rightarrow>E")
          AOT_show \<open>\<box>[[G]\<^sup>-\<^sup>u]x\<close>
            apply (AOT_subst \<open>[[G]\<^sup>-\<^sup>u]x\<close> \<open>[G]x & x \<noteq> u\<close>)
             apply (rule "F-u:2"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified])
              apply (rule "F-u:1")
             apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
             apply (rule "F-u:1")
            using 2 3 "KBasic:3" "\<equiv>S"(2) "\<equiv>E"(2) by blast
        }
      qed
      AOT_thus \<open>\<box>\<forall>x([[G]\<^sup>-\<^sup>u]x \<rightarrow> \<box>[[G]\<^sup>-\<^sup>u]x)\<close> using \<xi> "\<rightarrow>E" by blast
    next
      fix x
      AOT_assume \<open>[[G]\<^sup>-\<^sup>u]x\<close>
      AOT_hence \<open>[\<lambda>x [G]x & x \<noteq> u]x\<close>
        by (auto intro: "F-u:2"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
                intro!: "F-u:1")
      AOT_hence \<open>[G]x & x \<noteq> u\<close>
        by (rule "\<beta>\<rightarrow>C"(1))
      AOT_hence \<open>[F]x & x \<noteq> u\<close>
        using \<zeta> "&I" "&E"(1) "&E"(2) "\<equiv>E"(1) "rule-ui:3" by blast
      AOT_hence \<open>[\<lambda>x [F]x & x \<noteq> u]x\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "F-u:1" "cqt:2")
      AOT_thus \<open>[[F]\<^sup>-\<^sup>u]x\<close>
        by (auto intro: "F-u:2"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
                intro!: "F-u:1" "cqt:2")
    next
      fix x
      AOT_assume \<open>[[F]\<^sup>-\<^sup>u]x\<close>
      AOT_hence \<open>[\<lambda>x [F]x & x \<noteq> u]x\<close>
        by (auto intro: "F-u:2"[THEN "=\<^sub>d\<^sub>fE"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
                intro!: "F-u:1" "cqt:2")
      AOT_hence \<open>[F]x & x \<noteq> u\<close>
        by (rule "\<beta>\<rightarrow>C"(1))
      AOT_hence \<open>[G]x & x \<noteq> u\<close>
        using \<zeta> "&I" "&E"(1) "&E"(2) "\<equiv>E"(2) "rule-ui:3" by blast
      AOT_hence \<open>[\<lambda>x [G]x & x \<noteq> u]x\<close>
        by (auto intro!: "\<beta>\<leftarrow>C"(1) "F-u:1" "cqt:2")
      AOT_thus \<open>[[G]\<^sup>-\<^sup>u]x\<close>
        by (auto intro: "F-u:2"[THEN "=\<^sub>d\<^sub>fI"(1), where \<tau>\<^sub>1\<tau>\<^sub>n="(_,_)", simplified]
                intro!: "F-u:1" "cqt:2")
    qed
    AOT_hence \<open>\<box>Numbers(x,[G]\<^sup>-\<^sup>u)\<close>
      using rigid_num_nec[unvarify F G, OF "F-u:2[den]", OF "F-u:2[den]", THEN "\<rightarrow>E",
                          OF "&I", OF props[THEN "&E"(2)]] by blast
  }
  moreover AOT_have \<open>\<box>[G]u\<close>
    using props[THEN "&E"(1), THEN "&E"(1), THEN \<zeta>[THEN "\<forall>E"(2), THEN "\<equiv>E"(2)]]
          \<xi>[THEN "qml:2"[axiom_inst, THEN "\<rightarrow>E"], THEN "\<forall>E"(2), THEN "\<rightarrow>E"]
    by blast
  ultimately AOT_have \<open>\<box>([G]u & Numbers(y,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
    by (metis "KBasic:3" "&I" "\<equiv>E"(2))
  AOT_hence \<open>\<exists>u (\<box>([G]u & Numbers(y,G) & Numbers(x,[G]\<^sup>-\<^sup>u)))\<close>
    by (rule "Discernible.\<exists>I")
  AOT_hence \<open>\<box>\<exists>u ([G]u & Numbers(y,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
    using "Discernible.res-var-bound-reas[Buridan]" "\<rightarrow>E" by fast
  AOT_hence \<open>\<exists>F \<box>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    by (rule "\<exists>I")
  AOT_hence 0: \<open>\<box>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using Buridan "vdash-properties:10" by fast
  AOT_show \<open>\<box>[\<bbbP>]xy\<close>
    by (AOT_subst \<open>[\<bbbP>]xy\<close> \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>;
        simp add: "pred-thm:3" 0)
qed

AOT_theorem "pred-1-1:2": \<open>Rigid(\<bbbP>)\<close>
  by (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "pred-thm:2" "&I"
                   RN tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"];
      safe intro!: GEN "pred-1-1:1")

(***** NOTE: PLM assumes this in 804 before proving it in 805! ******)

AOT_theorem numbers_den: \<open>[\<lambda>z Numbers(z,F)]\<down>\<close>
  using pred_coex[THEN "\<equiv>E"(1), OF pred] "\<forall>E" by blast

AOT_theorem numbers_disc: \<open>Numbers(x,F) \<rightarrow> D!x\<close>
proof(safe intro!: "\<rightarrow>I" "discern-obj:3"[THEN "\<equiv>E"(2)] "&I")
  AOT_assume 0: \<open>Numbers(x, F)\<close>
  AOT_have \<open>\<exists>G Rigidifies(G,F)\<close>
    by (simp add: "rigid-der:3")
  then AOT_obtain G where \<open>Rigidifies(G,F)\<close>
    using "0" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(1).&E(2)" "rigid-der:3.unvarify_G.\<forall>E(1).\<exists>E'" by blast
  AOT_hence G_prop: \<open>Rigid(G) & \<forall>x([G]x \<equiv> [F]x)\<close>
    using "df-rigid-rel:2" "\<equiv>\<^sub>d\<^sub>fE" by blast
  AOT_hence \<open>G \<equiv>\<^sub>D F\<close>
    by (metis (no_types, lifting) "con-dis-i-e:1" "con-dis-i-e:2:b" "cqt:2"(1) "deduction-theorem" "eqD.\<equiv>\<^sub>d\<^sub>fI" "rule-ui:2[const_var]" "universal-cor")
  AOT_hence numxG: \<open>Numbers(x,G)\<close>
    by (meson "0" "cqt:2"(1) "num-tran2.unvarify_G.unvarify_H.unvarify_x.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)")
  AOT_hence nec_numxG: \<open>\<box>Numbers(x,G)\<close>
    using G_prop
    by (metis (no_types, lifting) "con-dis-taut:1.\<rightarrow>E" "cqt-orig:3" "num-cont:2" "qml:2" "vdash-properties:10" axiom_inst)
  AOT_have 1: \<open>A!x & F\<down> & \<forall>G (x[G] \<equiv>  [\<lambda>z \<^bold>\<A>[G]z] \<approx>\<^sub>D F)\<close>
    using 0 numbers[THEN "\<equiv>\<^sub>d\<^sub>fE"] by blast
  AOT_have \<open>y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x)\<close> for y
  proof(safe intro!: "\<rightarrow>I")
    AOT_assume noteq: \<open>y \<noteq> x\<close>
    AOT_have \<open>\<box>\<not>([\<lambda>z Numbers(z,G)]y \<equiv> [\<lambda>z Numbers(z,G)]x)\<close>
    proof(rule "raa-cor:1")
      AOT_assume \<open>\<not>\<box>\<not>([\<lambda>z Numbers(z,G)]y \<equiv> [\<lambda>z Numbers(z,G)]x)\<close>
      AOT_hence \<open>\<diamond>([\<lambda>z Numbers(z,G)]y \<equiv> [\<lambda>z Numbers(z,G)]x)\<close>
        using "KBasic:11.\<equiv>E(1)" "RM:4.\<equiv>E(2)" "oth-class-taut:3:b" by blast
      AOT_hence \<open>\<diamond>(Numbers(y,G) \<equiv> Numbers(x,G))\<close>
        apply (AOT_subst \<open>Numbers(y,G)\<close> \<open>[\<lambda>z Numbers(z,G)]y\<close>)
         apply (metis "betaC:1:a" "betaC:2:a" "cqt:2"(1) "deduction-theorem" "intro-elim:2" numbers_den)
        apply (AOT_subst \<open>Numbers(x,G)\<close> \<open>[\<lambda>z Numbers(z,G)]x\<close>)
         apply (metis "betaC:1:a" "betaC:2:a" "cqt:2"(1) "deduction-theorem" "intro-elim:2" numbers_den)
        by blast
      AOT_hence \<open>\<diamond>(Numbers(x,G) \<rightarrow> Numbers(y,G))\<close>
        by (meson "RM:2.\<rightarrow>E" "deduction-theorem" "intro-elim:3:b")
      AOT_hence \<open>\<diamond>Numbers(y,G)\<close>
        using nec_numxG
        using "KBasic2:4.\<equiv>E(1).\<rightarrow>E" by blast
      moreover AOT_have \<open>\<box>(Numbers(y,G) \<rightarrow> \<box>Numbers(y,G))\<close>
        using "RM:1.\<rightarrow>E" "con-dis-i-e:2:a" "cqt-orig:3" "num-cont:2" "vdash-properties:10" G_prop by blast
      ultimately AOT_have numyG: \<open>Numbers(y,G)\<close>
        using "KBasic:13.\<rightarrow>E.\<rightarrow>E" "S5Basic:4.\<rightarrow>E" by blast
      AOT_have \<open>y = x\<close>
        using "pre-Hume:1"[THEN "\<rightarrow>E", OF "&I", OF numyG, OF numxG, THEN "\<equiv>E"(2)]
        using "eq-part:1" by auto
      AOT_thus \<open>p & \<not>p\<close>
        using noteq "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "raa-cor:4" by blast
    qed
    AOT_hence \<open>\<not>([\<lambda>z Numbers(z,G)]y \<equiv> [\<lambda>z Numbers(z,G)]x)\<close>
      using "qml:2" "vdash-properties:10" axiom_inst by blast
    AOT_thus \<open>\<exists>F \<not>([F]y \<equiv> [F]x)\<close>
      using numbers_den
      by (simp add: "existential:1")
  qed
  AOT_hence \<open>(y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close> for y
    by (simp add: "id-nec2:2" "sc-eq-box-box:6.\<rightarrow>E.\<rightarrow>E" RN)
  AOT_thus \<open>\<forall>y (y \<noteq> x \<rightarrow> \<exists>F \<not>([F]y \<equiv> [F]x))\<close>
    by (simp add: "universal-cor")
qed

AOT_theorem "pred-rel-disc[aux]": \<open>OnDiscernibles\<^sup>2(\<bbbP>)\<close>
proof(safe intro!: "df-rel-dis[2]"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "pred-thm:2" RN GEN "\<rightarrow>I")
  AOT_modally_strict {
    fix x y
    AOT_assume \<open>[\<bbbP>]xy\<close>
    AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
      using "\<equiv>E"(1) "pred-thm:3" by fast
    then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
      using "\<exists>E"[rotated] by blast
    then AOT_obtain u where u_prop: \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
      using "Discernible.\<exists>E"[rotated] by meson
    AOT_thus \<open>D!x\<close> and \<open>D!y\<close>
      using "F-u:2[den]" "con-dis-i-e:2:b" "cqt:2"(1) "numbers_disc.unvarify_x.unvarify_F.\<forall>E(1).\<forall>E(1).\<rightarrow>E" apply blast
      by (meson "con-dis-i-e:2:a" "con-dis-i-e:2:b" "cqt:2"(1) "numbers_disc.unvarify_x.unvarify_F.\<forall>E(1).\<forall>E(1).\<rightarrow>E" u_prop)
  }
qed

thm "1-1-R:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"]
AOT_theorem "pred-1-1:3": \<open>1-1(\<bbbP>)\<close>
proof (safe intro!: "1-1-R:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "pred-thm:2" "&I" GEN "\<rightarrow>I" "pred-rel-disc[aux]";
       frule "&E"(1); drule "&E"(2))
  fix x y z
  AOT_assume \<open>[\<bbbP>]xz\<close>
  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain u where u_prop: \<open>[F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
    using "Discernible.\<exists>E"[rotated] by meson
  AOT_assume \<open>[\<bbbP>]yz\<close>
  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(z,F) & Numbers(y,[F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
  then AOT_obtain G where \<open>\<exists>u ([G]u & Numbers(z,G) & Numbers(y,[G]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain v where v_prop: \<open>[G]v & Numbers(z,G) & Numbers(y,[G]\<^sup>-\<^sup>v)\<close>
    using "Discernible.\<exists>E"[rotated] by meson
  AOT_show \<open>x = y\<close>
  proof (rule "pre-Hume:1"[unvarify G H, OF "F-u:2[den]", OF "F-u:2[den]",
                         THEN "\<rightarrow>E", OF "&I", THEN "\<equiv>E"(2)])
    AOT_show \<open>Numbers(x, [F]\<^sup>-\<^sup>u)\<close>
      using u_prop "&E" by blast
  next
    AOT_show \<open>Numbers(y, [G]\<^sup>-\<^sup>v)\<close>
      using v_prop "&E" by blast
  next
    AOT_have \<open>F \<approx>\<^sub>D G\<close>
      using u_prop[THEN "&E"(1), THEN "&E"(2)]
      using v_prop[THEN "&E"(1), THEN "&E"(2)]
      using "num-tran:2"[THEN "\<rightarrow>E", OF "&I"] by blast
    AOT_thus \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
      using u_prop[THEN "&E"(1), THEN "&E"(1)]
      using v_prop[THEN "&E"(1), THEN "&E"(1)]
      using eqP'[THEN "\<rightarrow>E", OF "&I", OF "&I"]
      by blast
  qed
qed

AOT_theorem "pred-1-1:4": \<open>[\<bbbP>]xy & [\<bbbP>]xz \<rightarrow> y = z\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume 0: \<open>[\<bbbP>]xy & [\<bbbP>]xz\<close>
  AOT_have \<open>\<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[THEN "\<equiv>E"(1), OF 0[THEN "&E"(1)]].
  then AOT_obtain F where F_prop: \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain u where u_prop: \<open>[F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u)\<close>
    using "Discernible.\<exists>E"[rotated] by meson
    
  AOT_have \<open>\<exists>F \<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[THEN "\<equiv>E"(1), OF 0[THEN "&E"(2)]].
  then AOT_obtain G where G_prop: \<open>\<exists>u ([G]u & Numbers(z,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain v where v_prop: \<open>[G]v & Numbers(z,G) & Numbers(x,[G]\<^sup>-\<^sup>v)\<close>
    using "Discernible.\<exists>E"[rotated] by meson
  AOT_have \<open>[F]\<^sup>-\<^sup>u \<approx>\<^sub>D [G]\<^sup>-\<^sup>v\<close>
    using "&I" u_prop v_prop "&E"
    by (metis "cqt:2"(1) "num-tran:2.unvarify_x.unvarify_G.unvarify_H.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E" "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(1).&E(2)")
  AOT_hence \<open>F \<approx>\<^sub>D G\<close>
    using u_prop[THEN "&E"(1), THEN "&E"(1)] v_prop[THEN "&E"(1), THEN "&E"(1)]
          "P'-eq"
    by (meson "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "vdash-properties:10")
  AOT_thus \<open>y = z\<close>
    by (metis "0" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "pre-Hume:1.unvarify_x.unvarify_G.unvarify_y.unvarify_H.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2).rule=E'" "rule=I:1" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" eq_den_1 eq_den_2 u_prop v_prop)
qed

AOT_theorem "pred-rel-disc:1": \<open>\<exists>x\<exists>y [\<bbbP>]xy\<close>
proof -
  AOT_obtain a where Da: \<open>[D!]a\<close>
    using Discernible.restricted_var_condition by blast
  AOT_hence 2: \<open>[\<lambda>x x = a]\<down>\<close>
    by (simp add: "discern-obj:34.unvarify_y.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm")
  AOT_hence aux: \<open>#[\<lambda>x x = a]\<down>\<close>
    by (simp add: "num-def:2.unvarify_G.\<forall>E(1)")
  AOT_have P0: \<open>Numbers(#[\<lambda>x x = a],[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z])\<close>
    using "eq-num:2"[unvarify G, OF 2] by simp
  AOT_have \<open>a = a\<close>
    by (simp add: "id-eq:1")
  AOT_modally_strict {
    {
    fix y
    {
    AOT_assume \<open>D!y\<close>
    AOT_hence 2: \<open>[\<lambda>x x = y]\<down>\<close>
      by (simp add: "discern-obj:34.unvarify_y.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm")
    AOT_have \<open>y = y\<close>
      by (simp add: "id-eq:1")
    moreover AOT_have \<open>[\<lambda>x x = y]y \<equiv> y = y\<close>
      by (simp add: "2" "betaC:2:a" "cqt:2"(1) "deduction-theorem" "id-eq:1" "intro-elim:2")
    ultimately AOT_have \<open>[\<lambda>x x = y]y\<close>
      using "intro-elim:3:b" by blast
    }
    AOT_hence \<open>D!y \<rightarrow> [\<lambda>x x = y]y\<close>
      using "deduction-theorem" by blast
    }
    AOT_hence \<open>\<forall>y(D!y \<rightarrow> [\<lambda>x x = y]y)\<close>
      by (rule GEN)
  }
  AOT_hence \<open>\<box>\<forall>y(D!y \<rightarrow> [\<lambda>x x = y]y)\<close>
    by (rule RN)
  AOT_hence \<open>\<forall>y \<box>(D!y \<rightarrow> [\<lambda>x x = y]y)\<close>
    by (meson "RM:1.\<rightarrow>E" "cqt-basic:5" "universal-cor")
  AOT_hence \<open>\<box>(D!a \<rightarrow> [\<lambda>x x = a]a)\<close>
    by (simp add: "betaC:2:a" "cqt:2"(1) "deduction-theorem" "discern-obj:34.unvarify_y.\<forall>E(1).\<rightarrow>E" "rule=I:2[const_var]" RN)
  AOT_hence \<open>\<^bold>\<A>(D!a \<rightarrow> [\<lambda>x x = a]a)\<close>
    using "nec-imp-act.\<rightarrow>E" by blast
  AOT_hence \<open>\<^bold>\<A>D!a \<rightarrow> \<^bold>\<A>[\<lambda>x x = a]a\<close>
    using "act-cond.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" by blast
  moreover AOT_have \<open>\<^bold>\<A>D!a\<close>
    using "discern-obj:12.unvarify_x.\<forall>E(1).\<equiv>E(1)" "russell-axiom[exe,1].\<psi>_denotes_asm" Da by blast
  ultimately AOT_have \<open>\<^bold>\<A>[\<lambda>x x = a]a\<close>
    using "vdash-properties:10" by blast
  moreover AOT_have 3: \<open>[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<down>\<close>
    by "cqt:2"
  ultimately AOT_have P1: \<open>[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]a\<close>
    by (simp add: "betaC:2:a" "cqt:2"(1))
  AOT_have 1: \<open>[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<^sup>-\<^sup>a\<down>\<close>
    using 3 "F-u:2[den].unconstrain_u.\<forall>E(1).\<rightarrow>E" "cqt:2" Da by blast
  AOT_have P2: \<open>Numbers(0, [\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<^sup>-\<^sup>a)\<close>
  proof(safe intro!: "0F:1"[unvarify F, THEN "\<equiv>E"(1)] 1)
    AOT_show \<open>\<not>\<exists>u ([[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<^sup>-\<^sup>a]u)\<close>
    proof(rule "raa-cor:2")
      AOT_assume \<open>\<exists>u ([[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<^sup>-\<^sup>a]u)\<close>
      then AOT_obtain u where \<open>[[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<^sup>-\<^sup>a]u\<close>
        using "Discernible.\<exists>E"[rotated] by blast
      AOT_hence 4: \<open>[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]u & u \<noteq> a\<close>
        by (meson "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)"
            "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm"
            Da)
      AOT_hence \<open>\<^bold>\<A>[\<lambda>x x = a]u\<close>
        using "betaC:1:a" "con-dis-i-e:2:a" by blast
      AOT_hence \<open>\<^bold>\<A>u = a\<close>
        apply (AOT_subst \<open>u = a\<close> \<open>[\<lambda>x x = a]u\<close>)
        apply (metis "beta-C-cor:2.\<rightarrow>E.\<forall>E(1).\<equiv>E(2)" "betaC:1:a" "cqt:2"(1) "deduction-theorem" "discern-obj:34.unvarify_y.\<forall>E(1).\<rightarrow>E" "intro-elim:2"
            "rule=E'" Discernible.restricted_var_condition)
        by simp
      AOT_hence \<open>u = a\<close>
        using "id-act:1" "intro-elim:3:b" by blast
      AOT_hence \<open>u = a & \<not>(u = a)\<close>
        using "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:b" "local.4" "raa-cor:4" by blast
      AOT_thus \<open>p & \<not>p\<close> for p
        using "raa-cor:1" by blast
    qed
  qed
  AOT_have \<open>[\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]a & Numbers(#[\<lambda>x x = a], [\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]) & Numbers(0, [\<lambda>z \<^bold>\<A>[\<lambda>x x = a]z]\<^sup>-\<^sup>a)\<close>
    by(safe intro!: "&I" P1 P2 P0)
  AOT_hence \<open>\<exists>F\<exists>u([F]u & Numbers(#[\<lambda>x x = a], F) & Numbers(0, [F]\<^sup>-\<^sup>u))\<close>
    by (metis (no_types, lifting) "3" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:1" "russell-axiom[exe,1].\<psi>_denotes_asm" Da)
  AOT_hence \<open>[\<bbbP>]0#[\<lambda>x x = a]\<close>
    using "pred-thm:3.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "zero:2" aux by blast
  AOT_thus \<open>\<exists>x\<exists>y [\<bbbP>]xy\<close>
    by (meson "existential:1" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
qed

AOT_theorem "pred-rel-disc:2": \<open>NaturalCardinal(x) & x \<noteq> 0 \<rightarrow> \<exists>y [\<bbbP>]yx\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume 0: \<open>NaturalCardinal(x) & x \<noteq> 0\<close>
  AOT_hence 1: \<open>\<exists>G(x = #G)\<close>
    using "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:a" card by blast
  AOT_hence 2: \<open>\<exists>G(Numbers(x,G))\<close>
    using "cqt:2"(1) "eq-df-num:2.unvarify_x.\<forall>E(1).\<equiv>E(1).\<exists>E'" "existential:2[const_var]" by blast
  then AOT_obtain Q where 3: \<open>Numbers(x,Q)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have 4: \<open>\<exists>u [Q]u\<close>
    by (metis (no_types, lifting) "0" "0F:2.unvarify_F.\<forall>E(1).\<equiv>E(2).\<exists>E'" "3" "con-dis-i-e:1" "con-dis-i-e:2:b" "cqt:2"(1) "existential:1")
  then AOT_obtain u where 5: \<open>[Q]u\<close>
    using "Discernible.\<exists>E" by blast
  AOT_have 6: \<open>[[Q]\<^sup>-\<^sup>u]\<down>\<close>
    by (simp add: "F-u:2[den]")
  AOT_have 7: \<open>\<exists>y Numbers(y,[Q]\<^sup>-\<^sup>u)\<close>
    by (metis "F-u:2[den]" "existential:2[const_var]" "num:1.unvarify_G.\<forall>E(1).\<exists>E'")
  then AOT_obtain b where 8: \<open>Numbers(b, [Q]\<^sup>-\<^sup>u)\<close>
    using "\<exists>E"[rotated] by blast
  AOT_have 9: \<open>[Q]u & Numbers(x, Q) & Numbers(b,[Q]\<^sup>-\<^sup>u)\<close>
    using "3" "5" "8" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" by force
  AOT_hence 10: \<open>\<exists>F\<exists>u ([F]u & Numbers(x,F) & Numbers(b, [F]\<^sup>-\<^sup>u))\<close>
    by (meson "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:2[const_var]" Discernible.restricted_var_condition)
  AOT_hence \<open>[\<bbbP>]bx\<close>
    using "cqt:2"(1) "pred-thm:3.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" by blast
  AOT_thus \<open>\<exists>y [\<bbbP>]yx\<close>
    by (simp add: "existential:2[const_var]")
qed

(* TODO: start again here with Ed and Daniel *)
(* Note: fixed F\<^sup>-\<^sup>u to use \<noteq> instead of \<noteq>\<^sub>D ; no major problems per se, but: *)
(*
  Remark (embedding):
    the embedding might not strictly follow Remark (340) about restricted variables in definitions-by-identity
 *)
(*
  Remark (Principia):
    The remark below (754.1) seems to be wrong in its appeal to (340.2) (where is the definition-by-identity in (754.1)?)

    Given (340), there may be some disconnect between (754.1) and (754.2).
    Does (754.1) need to be [\<lambda>z D!y & Fz & z \<noteq> y]\<down> to be able to argue for (754.2) to be "safe"?
    As given, (754.1) is really D!y \<rightarrow> [\<lambda>z Fz & z \<noteq> y]\<down> and *not* [\<lambda>z D!y & Fz & z \<noteq> y]\<down>
    (340.2) does not apply, but instead (342) does.

    I'm not sure whether there's other occurrences of this issue in Principia.
  *)
(*
  Remark: All seems to work out with a plain
    F\<^sup>-\<^sup>x =\<^sub>d\<^sub>f [\<lambda>z Fz & z \<noteq> x]
  While F\<^sup>-\<^sup>x\<down> is just not a theorem, but F\<^sup>-\<^sup>u\<down> is.
  Is it better, for an indiscernible a, to have \<not>F\<^sup>-\<^sup>a\<down> or to have F\<^sup>-\<^sup>a\<down>, but empty? In both cases, we'd have
  \<forall>x \<not>F\<^sup>-\<^sup>ax, but there are some subtle differences (like F\<^sup>-\<^sup>a = F\<^sup>-\<^sup>a vs F\<^sup>-\<^sup>a \<noteq> F\<^sup>-\<^sup>a).
  This may be fine in general - arguably a nice way to avoid the complexity of (340.3)

  Conversely, for {u} =\<^sub>d\<^sub>f {y|y = u} the situation may be reversed.

  Minor remark:
    typo in (340.3): [\<lambda>\<nu>\<^sub>1...nu\<^sub>n \<phi>]


*)

AOT_theorem "assume-anc:1":
  \<open>\<bbbP>\<^sup>* = [\<lambda>xy \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & Hereditary(F,\<bbbP>)) \<rightarrow> [F]y)]\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "ances-df"])
   apply "cqt:2[lambda]"
  apply (rule "=I"(1))
  by "cqt:2[lambda]"

AOT_theorem "assume-anc:2": \<open>\<bbbP>\<^sup>*\<down>\<close>
  using "t=t-proper:1" "assume-anc:1" "vdash-properties:10" by blast

AOT_theorem "assume-anc:3":
  \<open>[\<bbbP>\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & \<forall>x'\<forall>y'([\<bbbP>]x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y'))) \<rightarrow> [F]y)\<close>
proof -
  AOT_have prod_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<guillemotleft>(AOT_term_of_var x\<^sub>1,AOT_term_of_var x\<^sub>2)\<guillemotright>\<down>\<close>
    for x\<^sub>1 x\<^sub>2 :: \<open>\<kappa> AOT_var\<close>
    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
  AOT_have den: \<open>[\<lambda>xy \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & Hereditary(F,\<bbbP>)) \<rightarrow> [F]y)]\<down>\<close>
    by "cqt:2[lambda]"
  AOT_have 1: \<open>[\<bbbP>\<^sup>*]xy \<equiv> \<forall>F((\<forall>z([\<bbbP>]xz \<rightarrow> [F]z) & Hereditary(F,\<bbbP>)) \<rightarrow> [F]y)\<close>
    apply (rule "rule=E"[rotated, OF "assume-anc:1"[symmetric]])
    by (rule "beta-C-meta"[unvarify \<nu>\<^sub>1\<nu>\<^sub>n, OF prod_den, THEN "\<rightarrow>E",
                           simplified, OF den, simplified])
  show ?thesis
    apply (AOT_subst (reverse) \<open>\<forall>x'\<forall>y' ([\<bbbP>]x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y'))\<close>
                               \<open>Hereditary(F,\<bbbP>)\<close> for: F :: \<open><\<kappa>>\<close>)
    using "hered:1"[THEN "\<equiv>Df", THEN "\<equiv>S"(1), OF "&I", OF "pred-thm:2",
                    OF "cqt:2[const_var]"[axiom_inst]] apply blast
    by (fact 1)
qed

(***** NOTE: the proof here is arguable much simpler than the one in PLM *****)
AOT_theorem "assume-anc:4": \<open>Rigid(\<bbbP>\<^sup>*)\<close>
proof (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "pred-thm:2" "&I"
                   RN tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fI"] "assume-anc:2"; safe intro!: GEN)
  AOT_modally_strict {
    fix x y
    AOT_show \<open>[\<bbbP>\<^sup>*]xy \<rightarrow> \<box>[\<bbbP>\<^sup>*]xy\<close>
    proof(rule "\<rightarrow>I")
      AOT_assume 0: \<open>[\<bbbP>\<^sup>*]xy\<close>
      AOT_hence 1: \<open>\<forall>F (\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y)\<close>
        using "assume-anc:3" "intro-elim:3:a" by blast
      AOT_show \<open>\<box>[\<bbbP>\<^sup>*]xy\<close>
      proof(rule "raa-cor:1")
        AOT_assume \<open>\<not>\<box>[\<bbbP>\<^sup>*]xy\<close>
        AOT_hence 2: \<open>\<diamond>\<not>[\<bbbP>\<^sup>*]xy\<close>
          by (simp add: "KBasic:11.\<equiv>E(1)")
        AOT_have \<open>\<diamond>\<not>\<forall>F (\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y)\<close>
          apply (AOT_subst_thm (reverse) "assume-anc:3")
          using 2 by blast
        AOT_hence \<open>\<diamond>\<exists>F \<not>(\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y)\<close>
          using "RM:2[prem].\<rightarrow>E" "cqt-further:2" by blast

        AOT_hence \<open>\<exists>w w \<Turnstile> (\<exists>F \<not>(\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y))\<close>
          by (meson "existential:2[const_var]" "fund:1.unvarify_p.\<forall>E(1).\<equiv>E(1).\<exists>E'" "log-prop-prop:2")
        then AOT_obtain w where \<open>w \<Turnstile> (\<exists>F \<not>(\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y))\<close>
          using "PossibleWorld.\<exists>E" by meson
        then AOT_obtain F where \<open>w \<Turnstile> (\<not>(\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y))\<close>
          using "conj-dist-w:6"[THEN "\<equiv>E"(1)] "\<exists>E"[rotated] by blast
        AOT_hence \<open>\<not>w \<Turnstile> (\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]y)\<close>
          using "coherent:1.unconstrain_w.unvarify_p.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)" "cqt:2"(1) "log-prop-prop:2" PossibleWorld.restricted_var_condition by blast
        moreover AOT_have \<open>w \<Turnstile> ((\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y'))) \<rightarrow> [F]y)\<close>
        proof (safe intro!: "conj-dist-w:2[meta]"[THEN "\<equiv>E"(2)] "\<rightarrow>I")
          AOT_assume \<open>w \<Turnstile> (\<forall>z (\<bbbP>xz \<rightarrow> [F]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')))\<close>
          AOT_hence A: \<open>w \<Turnstile> \<bbbP>xz \<rightarrow> w \<Turnstile> [F]z\<close> 
            and B: \<open>w \<Turnstile> \<bbbP>x'y' \<rightarrow> w \<Turnstile> ([F]x' \<rightarrow> [F]y')\<close> for x' y' z
            using "conj-dist-w:2[meta]" "intro-elim:3:a"
            by (metis (lifting) "conj-dist-w:1.unconstrain_w.unvarify_p.unvarify_q.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)"
                 "cqt:2"(1)
                "log-prop-prop:2" PossibleWorld.restricted_var_condition
                "conj-dist-w:1.unconstrain_w.unvarify_p.unvarify_q.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "conj-dist-w:2[meta]"
                "conj-dist-w:5.unconstrain_w.\<forall>E(1).\<rightarrow>E.\<equiv>E(1).\<forall>E(1)" "cqt:2"(1) "intro-elim:3:a" "log-prop-prop:2"
                PossibleWorld.restricted_var_condition)+

          AOT_have Fw_den: \<open>[\<lambda>x w \<Turnstile> [F]x]\<down>\<close>
            by (simp add: "w-rel:3")
          AOT_hence 3: \<open>\<forall>z (\<bbbP>xz \<rightarrow> [\<lambda>x w \<Turnstile> [F]x]z) & \<forall>x' \<forall>y' (\<bbbP>x'y' \<rightarrow> ([\<lambda>x w \<Turnstile> [F]x]x' \<rightarrow> [\<lambda>x w \<Turnstile> [F]x]y')) \<rightarrow> [\<lambda>x w \<Turnstile> [F]x]y\<close>
            using "0" "assume-anc:3.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).\<forall>E(1).\<rightarrow>E" "deduction-theorem" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by force

          AOT_have \<open>[\<lambda>x w \<Turnstile> [F]x]y\<close>
          proof (safe intro!: 3[THEN "\<rightarrow>E"] "&I" GEN "\<rightarrow>I")
            fix z
            AOT_assume \<open>\<bbbP>xz\<close>
            AOT_hence \<open>\<box>\<bbbP>xz\<close>
              by (simp add: "cqt:2"(1) "pred-1-1:1.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E")
            AOT_hence \<open>w \<Turnstile> \<bbbP>xz\<close>
              by (simp add: "fund:2.unvarify_p.\<forall>E(1).\<equiv>E(1).\<forall>E(1).\<rightarrow>E" "log-prop-prop:2" "world:3.\<rightarrow>E" PossibleWorld.restricted_var_condition)
            AOT_hence \<open>w \<Turnstile> [F]z\<close> using A "vdash-properties:10" by blast
            AOT_thus \<open>[\<lambda>x w \<Turnstile> [F]x]z\<close>
              by (simp add: "betaC:2:a" "cqt:2"(1) "w-rel:3")
          next
            fix x' y'
            AOT_assume \<open>\<bbbP>x'y'\<close>
            AOT_hence \<open>\<box>\<bbbP>x'y'\<close>
              by (simp add: "cqt:2"(1) "pred-1-1:1.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E")
            AOT_hence 0: \<open>w \<Turnstile> \<bbbP>x'y'\<close>
              by (simp add: "fund:2.unvarify_p.\<forall>E(1).\<equiv>E(1).\<forall>E(1).\<rightarrow>E" "log-prop-prop:2" "world:3.\<rightarrow>E" PossibleWorld.restricted_var_condition)
            AOT_assume \<open>[\<lambda>x w \<Turnstile> [F]x]x'\<close>
            AOT_hence \<open>w \<Turnstile> [F]x'\<close>
              using "betaC:1:a" by blast
            AOT_hence \<open>w \<Turnstile> [F]y'\<close>
              using B "0" "conj-dist-w:2[meta]" "intro-elim:3:a" "vdash-properties:10" by blast
            AOT_thus \<open>[\<lambda>x w \<Turnstile> [F]x]y'\<close>
              by (simp add: "betaC:2:a" "cqt:2"(1) "w-rel:3")
          qed
          AOT_thus \<open>w \<Turnstile> [F]y\<close>
            using "betaC:1:a" by blast
        qed
        ultimately AOT_show \<open>p & \<not>p\<close> for p
          using "raa-cor:3" by blast
      qed
    qed
  }
qed

AOT_theorem "no-pred-0:1": \<open>\<not>\<exists>x [\<bbbP>]x 0\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<exists>x [\<bbbP>]x 0\<close>
  then AOT_obtain a where \<open>[\<bbbP>]a 0\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(0, F) & Numbers(a, [F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[unvarify y, OF "zero:2", THEN "\<equiv>E"(1)] by blast
  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(0, F) & Numbers(a, [F]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain u where \<open>[F]u & Numbers(0, F) & Numbers(a, [F]\<^sup>-\<^sup>u)\<close>
    using "Discernible.\<exists>E"[rotated] by meson
  AOT_hence \<open>[F]u\<close> and num0_F: \<open>Numbers(0, F)\<close>
    using "&E" "&I" by blast+
  AOT_hence \<open>\<exists>u [F]u\<close>
    using "Discernible.\<exists>I" by fast
  moreover AOT_have \<open>\<not>\<exists>u [F]u\<close>
    using num0_F  "\<equiv>E"(2) "0F:1" by blast
  ultimately AOT_show \<open>p & \<not>p\<close> for p
    by (metis "raa-cor:3")
qed

AOT_theorem "no-pred-0:2": \<open>\<not>\<exists>x [\<bbbP>\<^sup>*]x 0\<close>
proof(rule "raa-cor:2")
  AOT_assume \<open>\<exists>x [\<bbbP>\<^sup>*]x 0\<close>
  then AOT_obtain a where \<open>[\<bbbP>\<^sup>*]a 0\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<exists>z [\<bbbP>]z 0\<close>
    using "anc-her:5"[unvarify R y, OF "zero:2",
                      OF "pred-thm:2", THEN "\<rightarrow>E"] by auto
  AOT_thus \<open>\<exists>z [\<bbbP>]z 0 & \<not>\<exists>z [\<bbbP>]z 0\<close>
    by (metis "no-pred-0:1" "raa-cor:3")
qed

AOT_theorem "no-pred-0:3": \<open>\<not>[\<bbbP>\<^sup>*]0 0\<close>
  by (metis "existential:1" "no-pred-0:2" "reductio-aa:1" "zero:2")

AOT_theorem "assume1:1": \<open>\<bbbP>\<^sup>+\<down>\<close>
  using "pred-rel-disc[aux]" "pred-thm:2" "w-ances-df[den2].unconstrain_\<R>.\<forall>E(1).\<rightarrow>E" by blast

AOT_theorem "assume1:2": \<open>\<bbbP>\<^sup>+xy \<equiv> (\<bbbP>\<^sup>*xy \<or> x =\<^sub>D y)\<close>
  oops

(* TODO *)
AOT_theorem "assume1:3": \<open>Rigid(\<bbbP>\<^sup>+)\<close>
  oops

(* TODO: remove *)
(*
AOT_theorem "assume1:1": \<open>(=\<^sub>\<bbbP>) = [\<lambda>xy \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)]\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
   apply "cqt:2[lambda]"
  apply (rule "=I"(1))
  by "cqt:2[lambda]"


AOT_theorem "assume1:2": \<open>x =\<^sub>D y \<equiv> \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)\<close>
proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
  AOT_assume \<open>x =\<^sub>D y\<close>
  AOT_hence \<open>\<box>\<forall>F([F]x \<equiv> [F]y)\<close>
    by (simp add: "discern-obj:20.unvarify_x.unvarify_y.\<forall>E_1.\<forall>E_1.\<equiv>E_1.&E_2" "cqt:2"(1))
  AOT_have 1: \<open>[\<lambda>xy \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)]\<down>\<close>
    by "cqt:2"
  AOT_have \<open>[\<lambda>xy \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)]xy \<equiv> \<exists>z ([\<bbbP>]xz & [\<bbbP>]yz)\<close>
    using "beta-C-meta"[THEN "\<rightarrow>E", OF 1, unvarify \<nu>\<^sub>1\<nu>\<^sub>n, OF tuple_denotes[THEN "\<equiv>\<^sub>d\<^sub>fI"], OF "&I", simplified]
          "cqt:2"(1) by blast

qed


AOT_theorem "assume1:3": \<open>[\<bbbP>]\<^sup>+ = [\<lambda>xy [\<bbbP>]\<^sup>*xy \<or> x =\<^sub>\<bbbP> y]\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "w-ances-df"])
   apply (simp add: "w-ances-df[den1]")
  apply (rule "rule=E"[rotated, OF "assume1:1"[symmetric]])
  apply (rule "=\<^sub>d\<^sub>fI"(1)[OF "id-d-R"])
   apply "cqt:2[lambda]"
  apply (rule "=I"(1))
  by "cqt:2[lambda]"

AOT_theorem "assume1:4": \<open>[\<bbbP>]\<^sup>+\<down>\<close>
  using "w-ances-df[den2]".

AOT_theorem "assume1:5": \<open>[\<bbbP>]\<^sup>+xy \<equiv> [\<bbbP>]\<^sup>*xy \<or> x =\<^sub>\<bbbP> y\<close>
proof -
  AOT_have 0: \<open>[\<lambda>xy [\<bbbP>]\<^sup>*xy \<or> x =\<^sub>\<bbbP> y]\<down>\<close> by "cqt:2"
  AOT_have prod_den: \<open>\<^bold>\<turnstile>\<^sub>\<box> \<guillemotleft>(AOT_term_of_var x\<^sub>1, AOT_term_of_var x\<^sub>2)\<guillemotright>\<down>\<close>
    for x\<^sub>1 x\<^sub>2 :: \<open>\<kappa> AOT_var\<close>
    by (simp add: "&I" "ex:1:a" prod_denotesI "rule-ui:3")
  show ?thesis
    apply (rule "rule=E"[rotated, OF "assume1:3"[symmetric]])
    using "beta-C-meta"[THEN "\<rightarrow>E", OF 0, unvarify \<nu>\<^sub>1\<nu>\<^sub>n, OF prod_den, simplified]
    by (simp add: cond_case_prod_eta)
qed
*)
AOT_define NaturalNumber :: \<open>\<tau>\<close> (\<open>\<nat>\<close>)
  "nnumber:1": \<open>\<nat> =\<^sub>d\<^sub>f [\<lambda>x [\<bbbP>]\<^sup>+0x]\<close>

AOT_theorem "nnumber:2": \<open>\<nat>\<down>\<close>
  by (rule "=\<^sub>d\<^sub>fI"(2)[OF "nnumber:1"]; "cqt:2[lambda]")

AOT_theorem "nnumber:3": \<open>[\<nat>]x \<equiv> [\<bbbP>]\<^sup>+0x\<close>
  apply (rule "=\<^sub>d\<^sub>fI"(2)[OF "nnumber:1"])
   apply "cqt:2[lambda]"
  apply (rule "beta-C-meta"[THEN "\<rightarrow>E"])
  by "cqt:2[lambda]"

AOT_theorem zero_disc: \<open>D!0\<close>
proof -
  AOT_have \<open>\<not>\<exists>u [\<lambda>x x \<noteq>\<^sub>D x]u\<close>
    by (metis (no_types, lifting) "betaC:1:a" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "instantiation" "raa-cor:1" "raa-cor:3" "russell-axiom[exe,1].\<psi>_denotes_asm" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)")
  moreover AOT_have \<open>[\<lambda>x x \<noteq>\<^sub>D x]\<down>\<close>
    by "cqt:2"
  ultimately AOT_have \<open>Numbers(0, [\<lambda>x x \<noteq>\<^sub>D x])\<close>
    by (simp add: "0F:1.unvarify_F.\<forall>E(1).\<equiv>E(1)")
  AOT_thus \<open>D!0\<close>
    using "numbers.\<equiv>\<^sub>d\<^sub>fE.&E(1).&E(2)" "numbers_disc.unvarify_x.unvarify_F.\<forall>E(1).\<forall>E(1).\<rightarrow>E" "zero:2" by blast
qed

AOT_theorem "0-n": \<open>[\<nat>]0\<close>
  apply(rule "nnumber:3"[unvarify x, OF "zero:2", THEN "\<equiv>E"(2)])
  apply(rule "w-ances"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2", unvarify x, OF "zero:2", unvarify y, OF "zero:2", THEN "\<rightarrow>E", OF "pred-rel-disc[aux]", THEN "\<equiv>E"(2)])
  apply(rule "\<or>I"(2))
  by (simp add: "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "zero:2" zero_disc)

AOT_theorem "mod-col-num:1": \<open>[\<nat>]x \<rightarrow> \<box>[\<nat>]x\<close>
proof(rule "\<rightarrow>I")
  AOT_have necN_den: \<open>[\<lambda>x \<box>[\<nat>]x]\<down>\<close>
    by "cqt:2"
  AOT_have nec0N: \<open>[\<lambda>x \<box>[\<nat>]x]0\<close>
    by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" simp: "zero:2" RN "0-n")
  AOT_have 1: \<open>[\<lambda>x \<box>[\<nat>]x]0 &
    \<forall>x\<forall>y ([[\<bbbP>]\<^sup>+]0x & [[\<bbbP>]\<^sup>+]0y \<rightarrow> ([\<bbbP>]xy \<rightarrow> ([\<lambda>x \<box>[\<nat>]x]x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]y))) \<rightarrow>
    \<forall>x ([[\<bbbP>]\<^sup>+]0x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]x)\<close>
    using "pre-ind"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2", THEN "\<rightarrow>E", OF "pred-rel-disc[aux]", unvarify z, OF "zero:2", unvarify F, OF necN_den].
  AOT_have \<open>\<forall>x ([[\<bbbP>]\<^sup>+]0x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]x)\<close>
  proof (rule 1[THEN "\<rightarrow>E"]; safe intro!: "&I" GEN "\<rightarrow>I" nec0N;
         frule "&E"(1); drule "&E"(2))
    fix x y
    AOT_assume \<open>[\<bbbP>]xy\<close>
    AOT_hence 0: \<open>\<box>[\<bbbP>]xy\<close>
      by (metis "pred-1-1:1" "\<rightarrow>E")
    AOT_assume \<open>[\<lambda>x \<box>[\<nat>]x]x\<close>
    AOT_hence \<open>\<box>[\<nat>]x\<close>
      by (rule "\<beta>\<rightarrow>C"(1))
    AOT_hence \<open>\<box>([\<bbbP>]xy & [\<nat>]x)\<close>
      by (metis "0" "KBasic:3" Adjunction "\<equiv>E"(2) "\<rightarrow>E")
    moreover AOT_have \<open>\<box>([\<bbbP>]xy & [\<nat>]x) \<rightarrow> \<box>[\<nat>]y\<close>
    proof (rule RM; rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
      AOT_modally_strict {
        AOT_assume 0: \<open>[\<bbbP>]xy\<close>
        AOT_assume \<open>[\<nat>]x\<close>
        AOT_hence 1: \<open>[[\<bbbP>]\<^sup>+]0x\<close>
          by (metis "\<equiv>E"(1) "nnumber:3")
        AOT_show \<open>[\<nat>]y\<close>
          apply (rule "nnumber:3"[THEN "\<equiv>E"(2)])
          by (meson "0" "1" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "pred-rel-disc[aux]" "pred-thm:2" "wances-her:1.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "wances-her:6.unconstrain_\<R>.unvarify_x.unvarify_y.unvarify_z.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "zero:2")
      }
    qed
    ultimately AOT_have \<open>\<box>[\<nat>]y\<close>
      by (metis "\<rightarrow>E") 
    AOT_thus \<open>[\<lambda>x \<box>[\<nat>]x]y\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
  qed
  AOT_hence 0: \<open>[[\<bbbP>]\<^sup>+]0x \<rightarrow> [\<lambda>x \<box>[\<nat>]x]x\<close>
    using "\<forall>E"(2) by blast
  AOT_assume \<open>[\<nat>]x\<close>
  AOT_hence \<open>[[\<bbbP>]\<^sup>+]0x\<close>
    by (metis "\<equiv>E"(1) "nnumber:3")
  AOT_hence \<open>[\<lambda>x \<box>[\<nat>]x]x\<close>
    using 0[THEN "\<rightarrow>E"] by blast
  AOT_thus \<open>\<box>[\<nat>]x\<close>                  
    by (rule "\<beta>\<rightarrow>C"(1))
qed

AOT_theorem "mod-col-num:2": \<open>Rigid(\<nat>)\<close>
  by (safe intro!: "df-rigid-rel:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" RN GEN
                   "mod-col-num:1" "nnumber:2")

AOT_register_rigid_restricted_type
  Number: \<open>[\<nat>]\<kappa>\<close>
proof
  AOT_modally_strict {
    AOT_show \<open>\<exists>x [\<nat>]x\<close>
      by (rule "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>0\<guillemotright>\<close>]; simp add: "0-n" "zero:2")
  }
next
  AOT_modally_strict {
    AOT_show \<open>[\<nat>]\<kappa> \<rightarrow> \<kappa>\<down>\<close> for \<kappa>
      by (simp add: "\<rightarrow>I" "cqt:5:a[1]"[axiom_inst, THEN "\<rightarrow>E", THEN "&E"(2)])
  }
next
  AOT_modally_strict {
    AOT_show \<open>\<forall>x([\<nat>]x \<rightarrow> \<box>[\<nat>]x)\<close>
      by (simp add: GEN "mod-col-num:1")
  }
qed
AOT_register_variable_names
  Number: m n k i j

AOT_theorem "0-pred": \<open>\<not>\<exists>n [\<bbbP>]n 0\<close>
proof (rule "raa-cor:2")
  AOT_assume \<open>\<exists>n [\<bbbP>]n 0\<close>
  then AOT_obtain n where \<open>[\<bbbP>]n 0\<close>
    using "Number.\<exists>E"[rotated] by meson
  AOT_hence \<open>\<exists>x [\<bbbP>]x 0\<close>
    using "&E" "\<exists>I" by fast
  AOT_thus \<open>\<exists>x [\<bbbP>]x 0 & \<not>\<exists>x [\<bbbP>]x 0\<close>
    using "no-pred-0:1" "&I" by auto
qed

AOT_theorem "no-same-succ":
  \<open>\<forall>n\<forall>m\<forall>k([\<bbbP>]nk & [\<bbbP>]mk \<rightarrow> n = m)\<close>
proof(safe intro!: Number.GEN "\<rightarrow>I")
  fix n m k
  AOT_assume \<open>[\<bbbP>]nk & [\<bbbP>]mk\<close>
  AOT_thus \<open>n = m\<close>
    using "1-1-R:1.\<equiv>\<^sub>d\<^sub>fE.&E(2).&E(2).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "cqt:2"(1) "id-eq:1" "pred-1-1:3" by blast
qed

AOT_theorem induction:
  \<open>\<forall>F([F]0 & \<forall>n\<forall>m([\<bbbP>]nm \<rightarrow> ([F]n \<rightarrow> [F]m)) \<rightarrow> \<forall>n[F]n)\<close>
proof (safe intro!: GEN[where 'a=\<open><\<kappa>>\<close>] Number.GEN "&I" "\<rightarrow>I";
       frule "&E"(1); drule "&E"(2))
  fix F n
  AOT_assume F0: \<open>[F]0\<close>
  AOT_assume 0: \<open>\<forall>n\<forall>m([\<bbbP>]nm \<rightarrow> ([F]n \<rightarrow> [F]m))\<close>
  {
    fix x y
    AOT_assume \<open>[[\<bbbP>]\<^sup>+]0x & [[\<bbbP>]\<^sup>+]0y\<close>
    AOT_hence \<open>[\<nat>]x\<close> and \<open>[\<nat>]y\<close>
      using "&E" "\<equiv>E"(2) "nnumber:3" by blast+
    moreover AOT_assume \<open>[\<bbbP>]xy\<close>
    moreover AOT_assume \<open>[F]x\<close>
    ultimately AOT_have \<open>[F]y\<close>
      using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E", THEN "\<forall>E"(2), THEN "\<rightarrow>E",
              THEN "\<rightarrow>E", THEN "\<rightarrow>E"] by blast
  } note 1 = this
  AOT_have 0: \<open>[[\<bbbP>]\<^sup>+]0n\<close>
    by (metis "\<equiv>E"(1) "nnumber:3" Number.\<psi>)
  AOT_show \<open>[F]n\<close>
    apply (rule "pre-ind"[unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2", THEN "\<rightarrow>E", OF "pred-rel-disc[aux]", unvarify z, OF "zero:2", THEN "\<rightarrow>E", THEN "\<forall>E"(2), THEN "\<rightarrow>E"])
    apply (safe intro!: 0 "&I" GEN "\<rightarrow>I" F0)
    using 1 by blast
qed

AOT_theorem "nat-card:1": \<open>[\<nat>]x \<rightarrow> NaturalCardinal(x)\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume \<open>[\<nat>]x\<close>
  AOT_hence \<open>[\<bbbP>]\<^sup>+0x\<close>
    by (simp add: "nnumber:3.unvarify_x.\<forall>E(1).\<equiv>E(1)" "russell-axiom[exe,1].\<psi>_denotes_asm")
  AOT_hence \<open>[\<bbbP>\<^sup>*]0x \<or> 0 =\<^sub>D x\<close>
    by (simp add: "cqt:2"(1) "pred-rel-disc[aux]" "pred-thm:2" "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)" "zero:2")
  moreover {
    AOT_assume \<open>0 =\<^sub>D x\<close>
    AOT_hence \<open>0 = x\<close>
      using "discern-obj:19.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "rule=I:1" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" "zero:2" by blast
    AOT_hence \<open>NaturalCardinal(x)\<close>
      using "rule=E" "zero-card" by blast
  }
  moreover {
    AOT_assume \<open>[\<bbbP>\<^sup>*]0x\<close>
    AOT_hence \<open>\<exists>y [\<bbbP>]yx\<close>
      by (meson "anc-her:5.unvarify_R.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<exists>E'" "existential:2[const_var]" "pred-thm:2" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
    then AOT_obtain y where \<open>[\<bbbP>]yx\<close>
      using "\<exists>E"[rotated] by blast
    AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(x, F) & Numbers(y, [F]\<^sup>-\<^sup>u))\<close>
      using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
    then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(x, F) & Numbers(y, [F]\<^sup>-\<^sup>u))\<close>
      using "\<exists>E"[rotated] by blast
    then AOT_obtain u where \<open>[F]u & Numbers(x, F) & Numbers(y, [F]\<^sup>-\<^sup>u)\<close>
      using "Discernible.\<exists>E"[rotated] by meson
    AOT_hence \<open>NaturalCardinal(x)\<close>
      by (meson "con-dis-taut:1" "con-dis-taut:2" "eq-df-num:1" "vdash-properties:10")
  }
  ultimately AOT_show \<open>NaturalCardinal(x)\<close>
    using "con-dis-i-e:4:c" "raa-cor:2" by blast
qed

AOT_theorem "nat-card:2": \<open>[\<nat>]x \<rightarrow> D!x\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>[\<nat>]x\<close>
  AOT_hence \<open>NaturalCardinal(x)\<close>
    by (simp add: "nat-card:1.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm")
  AOT_hence \<open>\<exists>F Numbers(x,F)\<close>
    using "\<equiv>\<^sub>d\<^sub>fE" "cqt:2"(1) "eq-df-num:2.unvarify_x.\<forall>E(1).\<equiv>E(1).\<exists>E'" "existential:2[const_var]" card by blast
  AOT_thus \<open>D!x\<close>
    by (meson "cqt:2"(1) "instantiation" "numbers_disc.unvarify_x.unvarify_F.\<forall>E(1).\<forall>E(1).\<rightarrow>E")
qed

AOT_theorem "suc-num:1": \<open>[\<bbbP>]nx \<rightarrow> [\<nat>]x\<close>
proof(rule "\<rightarrow>I")
  AOT_have \<open>[[\<bbbP>]\<^sup>+]0 n\<close>
    by (meson Number.\<psi> "\<equiv>E"(1) "nnumber:3")
  moreover AOT_assume \<open>[\<bbbP>]nx\<close>
  ultimately AOT_have \<open>[[\<bbbP>]\<^sup>*]0 x\<close>
    by (meson "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "df-rel-dis[2].\<equiv>\<^sub>d\<^sub>fE.&E(1)" "pred-rel-disc[aux]" "wances-her:3.unconstrain_\<R>.unvarify_x.unvarify_y.unvarify_z.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "zero:2")
  AOT_hence \<open>[[\<bbbP>]\<^sup>+]0 x\<close> 
    by (simp add: "con-dis-i-e:3:a" "pred-rel-disc[aux]" "pred-thm:2" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)" "zero:2")
  AOT_thus \<open>[\<nat>]x\<close>
    by (metis "\<equiv>E"(2) "nnumber:3")
qed

AOT_theorem "suc-num:2": \<open>[[\<bbbP>]\<^sup>*]nx \<rightarrow> [\<nat>]x\<close>
proof(rule "\<rightarrow>I")
  AOT_have \<open>[[\<bbbP>]\<^sup>+]0 n\<close>
    using Number.\<psi> "\<equiv>E"(1) "nnumber:3" by blast
  AOT_assume \<open>[[\<bbbP>]\<^sup>*]n x\<close>
  AOT_hence \<open>\<forall>F (\<forall>z ([\<bbbP>]nz \<rightarrow> [F]z) & \<forall>x'\<forall>y' ([\<bbbP>]x'y' \<rightarrow> ([F]x' \<rightarrow> [F]y')) \<rightarrow> [F]x)\<close>
    using "assume-anc:3"[THEN "\<equiv>E"(1)] by blast
  AOT_hence \<theta>: \<open>\<forall>z ([\<bbbP>]nz \<rightarrow> [\<nat>]z) & \<forall>x'\<forall>y' ([\<bbbP>]x'y' \<rightarrow> ([\<nat>]x' \<rightarrow> [\<nat>]y')) \<rightarrow> [\<nat>]x\<close>
    using "\<forall>E"(1) "nnumber:2" by blast
  AOT_show \<open>[\<nat>]x\<close>
  proof (safe intro!: \<theta>[THEN "\<rightarrow>E"] GEN "\<rightarrow>I" "&I")
    AOT_show \<open>[\<nat>]z\<close> if \<open>[\<bbbP>]nz\<close> for z
      using Number.\<psi> "suc-num:1" that "\<rightarrow>E" by blast
  next
    AOT_show \<open>[\<nat>]y\<close> if \<open>[\<bbbP>]xy\<close> and \<open>[\<nat>]x\<close> for x y
      using "suc-num:1"[unconstrain n, THEN "\<rightarrow>E"] that "\<rightarrow>E" by blast
  qed
qed

AOT_theorem "suc-num:3": \<open>[\<bbbP>]\<^sup>+nx \<rightarrow> [\<nat>]x\<close>
proof (rule "\<rightarrow>I")
  AOT_assume \<open>[\<bbbP>]\<^sup>+nx\<close>
  AOT_hence \<open>[\<bbbP>]\<^sup>*nx \<or> n =\<^sub>D x\<close>
    by (simp add: "ex:1:a" "pred-rel-disc[aux]" "pred-thm:2" "rule-ui:3" "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)")
  moreover {
    AOT_assume \<open>[\<bbbP>]\<^sup>*nx\<close>
    AOT_hence \<open>[\<nat>]x\<close>
      by (metis "suc-num:2" "\<rightarrow>E")
  }
  moreover {
    AOT_assume 0: \<open>n =\<^sub>D x\<close>
    AOT_hence \<open>n = x\<close>
      by (meson "discern-obj:19.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "rule=I:1" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
    AOT_hence \<open>[\<nat>]x\<close>
      using "rule=E'" Number.restricted_var_condition by blast
  }
  ultimately AOT_show \<open>[\<nat>]x\<close>
    by (metis "\<or>E"(3) "reductio-aa:1")
qed

AOT_theorem "pred-num": \<open>[\<bbbP>]xn \<rightarrow> [\<nat>]x\<close>
proof (rule "\<rightarrow>I")
  AOT_assume 0: \<open>[\<bbbP>]xn\<close>
  AOT_have \<open>[[\<bbbP>]\<^sup>+]0 n\<close>
    using Number.\<psi> "\<equiv>E"(1) "nnumber:3" by blast
  AOT_hence \<open>[[\<bbbP>]\<^sup>*]0 n \<or> 0 =\<^sub>D n\<close>
    by (simp add: "df-rel-dis[2].\<equiv>\<^sub>d\<^sub>fE.&E(1)" "pred-rel-disc[aux]" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)")
  moreover {
    AOT_assume \<open>0 =\<^sub>D n\<close>
    AOT_hence \<open>0 = n\<close>
      by (meson "discern-obj:19.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "rule=I:1" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
    AOT_hence \<open>[\<bbbP>]x 0\<close>
      using 0 "rule=E" id_sym by fast
    AOT_hence \<open>\<exists>x [\<bbbP>]x 0\<close>
      by (rule "\<exists>I")
    AOT_hence \<open>\<exists>x [\<bbbP>]x 0 & \<not>\<exists>x [\<bbbP>]x 0\<close>
      by (metis "no-pred-0:1" "raa-cor:3")
  }
  ultimately AOT_have \<open>[[\<bbbP>]\<^sup>*]0n\<close>
    by (metis "\<or>E"(3) "raa-cor:1")
  AOT_hence \<open>\<exists>z ([[\<bbbP>]\<^sup>+]0z & [\<bbbP>]zn)\<close>
    by (meson "cqt:2"(1) "existential:2[const_var]" "pred-rel-disc[aux]" "pred-thm:2" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "wances-her:7.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E.\<exists>E'")
  then AOT_obtain b where b_prop: \<open>[[\<bbbP>]\<^sup>+]0b & [\<bbbP>]bn\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>[\<nat>]b\<close>
    by (metis "&E"(1) "\<equiv>E"(2) "nnumber:3")
  moreover AOT_have \<open>x = b\<close>
    by (metis "0" "1-1-R:1.\<equiv>\<^sub>d\<^sub>fE.&E(2).&E(2).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "pred-1-1:3" "rule=I:1" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" b_prop)
  ultimately AOT_show \<open>[\<nat>]x\<close>
    using "rule=E" id_sym by fast
qed

AOT_theorem "pred-func:1": \<open>[\<bbbP>]xy & [\<bbbP>]xz \<rightarrow> y = z\<close>
proof (rule "\<rightarrow>I"; frule "&E"(1); drule "&E"(2))
  AOT_assume \<open>[\<bbbP>]xy\<close>
  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
  then AOT_obtain F where \<open>\<exists>u ([F]u & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain a where
            Oa: \<open>D!a\<close>
    and a_prop: \<open>[F]a & Numbers(y,F) & Numbers(x,[F]\<^sup>-\<^sup>a)\<close>
    using "\<exists>E"[rotated] "&E" by blast
  AOT_assume \<open>[\<bbbP>]xz\<close>
  AOT_hence \<open>\<exists>F\<exists>u ([F]u & Numbers(z,F) & Numbers(x,[F]\<^sup>-\<^sup>u))\<close>
    using "pred-thm:3"[THEN "\<equiv>E"(1)] by blast
  then AOT_obtain G where \<open>\<exists>u ([G]u & Numbers(z,G) & Numbers(x,[G]\<^sup>-\<^sup>u))\<close>
    using "\<exists>E"[rotated] by blast
  then AOT_obtain b where Ob: \<open>D!b\<close>
                  and b_prop: \<open>[G]b & Numbers(z,G) & Numbers(x,[G]\<^sup>-\<^sup>b)\<close>
    using "\<exists>E"[rotated] "&E" by blast
  AOT_have \<open>[F]\<^sup>-\<^sup>a \<approx>\<^sub>D  [G]\<^sup>-\<^sup>b\<close>
    using "num-tran:2"[unvarify G H, OF "F-u:2[den]"[unconstrain u, unvarify \<beta>, THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst], OF Ob],
         OF "F-u:2[den]"[unconstrain u, unvarify \<beta>, THEN "\<rightarrow>E", OF "cqt:2[const_var]"[axiom_inst], OF Oa],THEN "\<rightarrow>E", OF "&I", OF a_prop[THEN "&E"(2)],
                       OF b_prop[THEN "&E"(2)]].
  AOT_hence \<open>F \<approx>\<^sub>D G\<close>
    using "P'-eq"[unconstrain u, THEN "\<rightarrow>E", OF Oa, unconstrain v, THEN "\<rightarrow>E",
                  OF Ob, THEN "\<rightarrow>E", OF "&I", OF "&I"]
          a_prop[THEN "&E"(1), THEN "&E"(1)]
          b_prop[THEN "&E"(1), THEN "&E"(1)] by blast
  AOT_thus \<open>y = z\<close>
    using "pre-Hume:1"[THEN "\<rightarrow>E", THEN "\<equiv>E"(2), OF "&I",
                     OF a_prop[THEN "&E"(1), THEN "&E"(2)],
                     OF b_prop[THEN "&E"(1), THEN "&E"(2)]]
    by blast
qed

AOT_theorem "pred-func:2": \<open>[\<bbbP>]nm & [\<bbbP>]nk \<rightarrow> m = k\<close>
  using "pred-func:1".

AOT_theorem being_number_of_den: \<open>[\<lambda>x x = #G]\<down>\<close>
proof (rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I" GEN RN)
  AOT_show \<open>[\<lambda>x Numbers(x,[\<lambda>z \<^bold>\<A>[G]z])]\<down>\<close>
    by (rule numbers_prop_den[unvarify G]) "cqt:2[lambda]"
next
  AOT_modally_strict {
    AOT_show \<open>Numbers(x,[\<lambda>z \<^bold>\<A>[G]z]) \<equiv> x = #G\<close> for x
      by (simp add: "eq-num:1")
  }
qed

AOT_theorem "th-succ-lem:1": \<open>\<forall>x([\<nat>]x \<rightarrow> \<not>[\<bbbP>]\<^sup>*xx)\<close>
proof(safe intro!: GEN "\<rightarrow>I")
  fix x
  AOT_assume Nx: \<open>[\<nat>]x\<close>
  AOT_have \<open>[\<lambda>z \<not>[\<bbbP>]\<^sup>*zz]x\<close>
  proof (rule "wances-her:2"[unvarify x, OF "zero:2", unconstrain \<R>, unvarify \<beta>, OF "pred-thm:2", THEN "\<rightarrow>E",  OF "pred-rel-disc[aux]", unvarify F, THEN "\<rightarrow>E"]; safe intro!: "cqt:2" "&I")
    AOT_have \<open>[\<lambda>z \<not>[\<bbbP>]\<^sup>*zz]\<down>\<close> by "cqt:2"
    moreover AOT_have \<open>\<not>[\<bbbP>]\<^sup>*0 0\<close>
      by (simp add: "no-pred-0:3")
    ultimately AOT_show \<open>[\<lambda>z \<not>[\<bbbP>]\<^sup>*zz]0\<close>
      using "betaC:2:a" "zero:2" by blast
  next
    AOT_show \<open>[\<bbbP>]\<^sup>+0x\<close>
      by (simp add: "cqt:2"(1) "nnumber:3.unvarify_x.\<forall>E(1).\<equiv>E(1)" Nx)
  next
    AOT_show \<open>Hereditary([\<lambda>z \<not>[\<bbbP>\<^sup>*]zz],\<bbbP>)\<close>
    proof(safe intro!: "hered:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "pred-thm:2" "cqt:2" GEN "\<rightarrow>I")
      fix x y
      AOT_assume 0: \<open>\<bbbP>xy\<close>
      AOT_assume \<open>[\<lambda>z \<not>[\<bbbP>\<^sup>*]zz]x\<close>
      AOT_hence \<open>\<not>[\<bbbP>\<^sup>*]xx\<close>
        using "betaC:1:a" by blast
      AOT_hence \<open>\<not>[\<bbbP>\<^sup>*]yy\<close>
        using "0" "1-1-R:3.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "pred-1-1:3" "pred-rel-disc[aux]" "pred-thm:2" by blast
      moreover AOT_have \<open>[\<lambda>z \<not>[\<bbbP>\<^sup>*]zz]\<down>\<close>
        by "cqt:2"
      ultimately AOT_show \<open>[\<lambda>z \<not>[\<bbbP>\<^sup>*]zz]y\<close>
        using "beta-C-cor:2.\<rightarrow>E.\<forall>E(1).\<equiv>E(2)" "cqt:2"(1) by blast
    qed
  qed
  AOT_thus \<open>\<not>[\<bbbP>\<^sup>*]xx\<close>
    using "betaC:1:a" by blast
qed

AOT_theorem "th-succ-lem:2": \<open>([\<nat>]x & [\<bbbP>]yx) \<rightarrow> (Numbers(z,[\<lambda>z [\<bbbP>\<^sup>+]zy]) \<equiv> Numbers(z,[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x))\<close>
proof(safe intro!: "\<rightarrow>I" "num-tran2"[unvarify G, unvarify H, THEN "\<rightarrow>E"] "cqt:2" "F-u:2[den]" "eqD.\<equiv>\<^sub>d\<^sub>fI" "&I" Discernible.GEN)
  AOT_assume \<open>[\<nat>]x & [\<bbbP>]yx\<close>
  AOT_hence Dx: \<open>D!x\<close>
    using "con-dis-i-e:2:a" "cqt:2"(1) "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E" by blast
  AOT_show \<open>[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x\<down>\<close>
    using "F-u:2[den].unconstrain_u.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Dx by presburger
next
  AOT_assume \<open>[\<nat>]x & [\<bbbP>]yx\<close>
  AOT_hence Dx: \<open>D!x\<close>
    using "con-dis-i-e:2:a" "cqt:2"(1) "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E" by blast
  AOT_show \<open>[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x\<down>\<close>
    using "F-u:2[den].unconstrain_u.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" Dx by presburger
next
  fix u
  AOT_assume 0: \<open>[\<nat>]x & [\<bbbP>]yx\<close>
  AOT_have Dx: \<open>D!x\<close>
    using "0" "con-dis-i-e:2:a" "cqt:2"(1) "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E" by blast
  note \<Pi>_minus_x_den = "F-u:1"[unconstrain u, unvarify \<beta>, OF "cqt:2[const_var]"[axiom_inst], THEN "\<rightarrow>E", OF Dx]
  AOT_have \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]u \<equiv> [\<bbbP>\<^sup>+]uy\<close>
    by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2")
  also AOT_have \<open>\<dots> \<equiv> ([\<bbbP>\<^sup>+]ux & u \<noteq> x)\<close>
  proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
    AOT_assume \<open>[\<bbbP>\<^sup>+]uy\<close>
    AOT_hence 1: \<open>[\<bbbP>\<^sup>*]ux\<close>
      by (meson "0" "con-dis-i-e:1" "con-dis-i-e:2:b" "cqt:2"(1) "df-rel-dis[2].\<equiv>\<^sub>d\<^sub>fE.&E(1)" "pred-rel-disc[aux]" "wances-her:3.unconstrain_\<R>.unvarify_x.unvarify_y.unvarify_z.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E")
    AOT_thus \<open>[\<bbbP>\<^sup>+]ux\<close>
      by (simp add: "con-dis-i-e:3:a" "pred-rel-disc[aux]" "pred-thm:2" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)")
    AOT_show \<open>u \<noteq> x\<close>
    proof(rule "raa-cor:1")
      AOT_assume \<open>\<not>u \<noteq> x\<close>
      AOT_hence \<open>u = x\<close>
        using "=-infix" "\<equiv>\<^sub>d\<^sub>fI" "raa-cor:4" by blast
      AOT_hence \<open>[\<bbbP>\<^sup>*]xx\<close>
        using 1 "rule=E" by fast
      AOT_thus \<open>[\<bbbP>\<^sup>*]xx & \<not>[\<bbbP>\<^sup>*]xx\<close>
        by (meson "0" "con-dis-i-e:1" "con-dis-i-e:2:a" "russell-axiom[exe,2,2].\<psi>_denotes_asm" "th-succ-lem:1.\<forall>E(1).\<rightarrow>E")
    qed
  next
    AOT_assume \<open>[\<bbbP>\<^sup>+]ux & u \<noteq> x\<close>
    AOT_hence 1: \<open>[\<bbbP>\<^sup>+]ux & u \<noteq>\<^sub>D x\<close>
        by (meson "=-infix" "\<equiv>\<^sub>d\<^sub>fE" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "discern-obj:19"
            "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(2)" "modus-tollens:1")
    AOT_show \<open>[\<bbbP>\<^sup>+]uy\<close>
    proof(rule "raa-cor:1")
      AOT_assume 2: \<open>\<not>[\<bbbP>\<^sup>+]uy\<close>
      AOT_hence \<open>[\<bbbP>\<^sup>*]ux\<close>
        by (metis "1" "con-dis-i-e:2:a" "con-dis-i-e:2:b" "con-dis-i-e:4:c" "cqt:2"(1) "pred-rel-disc[aux]" "pred-thm:2" "discern-obj:25.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)" "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)")
      moreover {
        AOT_have \<open>([\<bbbP>]yx & [\<bbbP>\<^sup>*]ux) \<rightarrow> [\<bbbP>\<^sup>+]uy\<close>
          using "1-1-R:2.unconstrain_\<R>.unvarify_x.unvarify_y.unvarify_z.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "deduction-theorem" "pred-1-1:3" "pred-rel-disc[aux]" "pred-thm:2" by blast
        AOT_hence \<open>\<not>[\<bbbP>\<^sup>*]ux\<close>
          using "0" "2" "con-dis-i-e:2:b" "oth-class-taut:7:a.\<rightarrow>E.\<rightarrow>E.\<rightarrow>E" "useful-tautologies:3.\<rightarrow>E.\<rightarrow>E" calculation by blast
      }
      ultimately AOT_show \<open>[\<bbbP>\<^sup>*]ux & \<not>[\<bbbP>\<^sup>*]ux\<close>
        using "&I" by blast
    qed
  qed
  also AOT_have \<open>\<dots> \<equiv> ([\<lambda>z [\<bbbP>\<^sup>+]zx]u & u \<noteq> x)\<close>
    by (AOT_subst \<open>[\<lambda>z [\<bbbP>\<^sup>+]zx]u\<close> \<open>[\<bbbP>\<^sup>+]ux\<close>)
       (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E"] "cqt:2" "oth-class-taut:3:a")
  also AOT_have \<open>\<dots> \<equiv> [\<lambda>z [\<lambda>z [\<bbbP>\<^sup>+]zx]z & z \<noteq> x]u\<close>
    by (safe intro!: "beta-C-meta"[THEN "\<rightarrow>E", symmetric] \<Pi>_minus_x_den "cqt:2")
  thm "F-u:1"
  also AOT_have \<open>\<dots> \<equiv> [[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x]u\<close>
    apply (rule "F-u:2"[THEN "=\<^sub>d\<^sub>fI"(1)[where \<tau>\<^sub>1\<tau>\<^sub>n=\<open>(_,_)\<close>], simplified]; (rule \<Pi>_minus_x_den)?)

    using "oth-class-taut:3:a" by auto
  finally AOT_show \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]u \<equiv> [[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x]u\<close>.
qed

AOT_theorem "th-succ-lem:3[lem]": \<open>[\<bbbP>\<^sup>+]xy \<rightarrow> \<box>[\<bbbP>\<^sup>+]xy\<close>
proof(rule "\<rightarrow>I")
  AOT_assume \<open>[\<bbbP>\<^sup>+]xy\<close>
  AOT_hence \<open>[\<bbbP>\<^sup>*]xy \<or> x =\<^sub>D y\<close>
    using "w-ances"
    by (simp add: "cqt:2"(1) "pred-rel-disc[aux]" "pred-thm:2"
        "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)")
  moreover {
    AOT_assume \<open>[\<bbbP>\<^sup>*]xy\<close>
    AOT_hence \<open>\<box>[\<bbbP>\<^sup>*]xy\<close>
      using "assume-anc:4"[THEN "\<equiv>\<^sub>d\<^sub>fE"[OF "df-rigid-rel:1"], THEN "&E"(2), THEN CBF[THEN "\<rightarrow>E"],
            THEN tuple_forall[THEN "\<equiv>\<^sub>d\<^sub>fE"], THEN "\<forall>E"(2)[where \<beta>=x], THEN "\<forall>E"(2)[where \<beta>=y]]
      using "T-S5-fund:1.\<rightarrow>E" "con-dis-i-e:3:a" "sc-eq-box-box:2.\<rightarrow>E.\<equiv>E(1)" by presburger
  }
  moreover {
    AOT_assume \<open>x =\<^sub>D y\<close>
    AOT_hence \<open>\<box>x =\<^sub>D y\<close>
      by (simp add: "cqt:2"(1) "discern-obj:21.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1)")
  }
  ultimately AOT_have \<open>\<box>[\<bbbP>\<^sup>*]xy \<or> \<box>x =\<^sub>D y\<close>
    using "con-dis-i-e:3:c" "deduction-theorem" by blast
  AOT_thus \<open>\<box>[\<bbbP>\<^sup>+]xy\<close>
    apply (AOT_subst \<open>[\<bbbP>\<^sup>+]xy\<close> \<open>[\<bbbP>\<^sup>*]xy \<or> x =\<^sub>D y\<close>)
    apply (simp add: "cqt:2"(1) "deduction-theorem" "intro-elim:2" "pred-rel-disc[aux]" "pred-thm:2"
        "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)"
        "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)")
    using "KBasic:15.\<rightarrow>E" by blast
qed

AOT_theorem "th-succ-lem:3[lem']": \<open>Rigid([\<lambda>z [\<bbbP>\<^sup>+]zy])\<close>
proof (safe intro!: "df-rigid-rel:1.\<equiv>\<^sub>d\<^sub>fI" "&I" GEN "\<rightarrow>I" BF[THEN "\<rightarrow>E"])
  AOT_show \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]\<down>\<close>
    by "cqt:2"
  AOT_show \<open>\<box>([\<lambda>z [\<bbbP>\<^sup>+]zy]x \<rightarrow> \<box>([\<lambda>z [\<bbbP>\<^sup>+]zy]x))\<close> for x
  proof(rule RN; rule "\<rightarrow>I")
    AOT_modally_strict {
      AOT_assume \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]x\<close>
      AOT_hence \<open>[\<bbbP>\<^sup>+]xy\<close>
        using "betaC:1:a" by blast
      AOT_hence 4: \<open>\<box>[\<bbbP>\<^sup>+]xy\<close>
        by (simp add: "cqt:2"(1) "th-succ-lem:3[lem].unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E")
      AOT_show \<open>\<box>[\<lambda>z [\<bbbP>\<^sup>+]zy]x\<close>
      proof (AOT_subst \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]x\<close> \<open>[\<bbbP>\<^sup>+]xy\<close>)
        AOT_modally_strict {
          AOT_have \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]\<down>\<close>
            by "cqt:2"
          AOT_thus \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]x \<equiv> [\<bbbP>\<^sup>+]xy\<close>
            using "beta-C-cor:2" "rule-ui:3" "vdash-properties:10" by blast
        }
      next
        AOT_show \<open>\<box>[\<bbbP>\<^sup>+]xy\<close>
          using 4.
      qed
    }
  qed
qed

AOT_theorem "th-succ-lem:3": \<open>([\<nat>]x & [\<bbbP>]yx) \<rightarrow> #[\<lambda>z [\<bbbP>\<^sup>+]zy] = #[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x\<close>
proof(safe intro!: "\<rightarrow>I")
  AOT_assume 1: \<open>[\<nat>]x & [\<bbbP>]yx\<close>
  AOT_have 2: \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy]\<down>\<close>
    by "cqt:2"
  AOT_have 3: \<open>[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x\<down>\<close>
    using "F-u:2[den].unconstrain_u.\<forall>E(1).\<rightarrow>E" "con-dis-i-e:2:a" "cqt:2"(1)
      "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E" 1 by blast
  AOT_have Dx: \<open>D!x\<close>
    using "1" "con-dis-i-e:2:a" "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm"
    by blast
  AOT_obtain a where \<open>Numbers(a,[\<lambda>z [\<bbbP>\<^sup>+]zy])\<close>
    using "2" "num:1.unvarify_G.\<forall>E(1).\<exists>E'" by blast
  moreover AOT_have \<open>Numbers(a,[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x)\<close>
    using calculation "th-succ-lem:2"[THEN "\<rightarrow>E", OF 1]
    using "intro-elim:3:a" by blast
  ultimately AOT_have \<open>[\<lambda>z [\<bbbP>\<^sup>+]zy] \<approx>\<^sub>D [\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x\<close>
    using "num-tran:2"[unvarify G H, THEN "\<rightarrow>E"]
    using "3" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" 2 by blast
  AOT_thus \<open>#[\<lambda>z [\<bbbP>\<^sup>+]zy] = #[\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x\<close>
  proof (safe intro!: "hume-strict"[unvarify F G, THEN "\<rightarrow>E", THEN "\<equiv>E"(2)] 2 3 "&I")
    AOT_show \<open>Rigid([\<lambda>z [\<bbbP>\<^sup>+]zy])\<close>
      using "th-succ-lem:3[lem']".
    AOT_obtain u where u_is_x: \<open>u = x\<close>
      by (metis (no_types, lifting) "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "existential:1" "rule=I:1"
          Discernible.instantiation Dx id_sym)
    AOT_have \<open>Rigid([\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u)\<close>
    proof (safe intro!: "df-rigid-rel:1.\<equiv>\<^sub>d\<^sub>fI" "&I" GEN "\<rightarrow>I" BF[THEN "\<rightarrow>E"])
      AOT_have \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<down>\<close>
        by "cqt:2"
      AOT_thus \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u\<down>\<close>
        using "F-u:2[den]" by blast
      AOT_show \<open>\<box>([\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u y \<rightarrow> \<box>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u y)\<close> for y
      proof(rule RN; rule "\<rightarrow>I")
        AOT_modally_strict {
          fix y
          AOT_assume \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u y\<close>
          AOT_hence \<open>[\<bbbP>\<^sup>+]yu & y \<noteq> u\<close>
            by (metis "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)"
                "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "betaC:1:a"
                "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) Discernible.restricted_var_condition)
          AOT_hence \<open>\<box>([\<bbbP>\<^sup>+]yu & y \<noteq> u)\<close>
            by (metis "KBasic:3.\<equiv>E(2)" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "deduction-theorem" "id-nec2:2"
                "oth-class-taut:7:b.\<rightarrow>E.\<rightarrow>E" "th-succ-lem:3[lem]")
          AOT_thus \<open>\<box>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u y\<close>
          proof (AOT_subst \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u y\<close> \<open>[\<bbbP>\<^sup>+]yu & y \<noteq> u\<close>)
            AOT_modally_strict {
              AOT_have 1: \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<down>\<close>
                by "cqt:2"
              AOT_hence 2: \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u\<down>\<close>
                by (simp add: "F-u:2[den]")
              AOT_thus \<open>[\<lambda>z [\<bbbP>\<^sup>+]zu]\<^sup>-\<^sup>u y \<equiv> [\<bbbP>\<^sup>+]yu & y \<noteq> u\<close>
                by (metis "1" "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)"
                    "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)"
                    "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)" "betaC:1:a" "betaC:2:a"
                    "con-dis-taut:1.\<rightarrow>E" "con-dis-taut:2" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "cqt:2"(1) "deduction-theorem"
                    "intro-elim:2" "intro-elim:3:b" Discernible.restricted_var_condition)
            }
          qed(auto)
        }
      qed
    qed
    AOT_thus \<open>Rigid([\<lambda>z [\<bbbP>\<^sup>+]zx]\<^sup>-\<^sup>x)\<close>
      using "rule=E" u_is_x by fast
  qed
qed

AOT_theorem "th-succ-lem:4": \<open>[\<lambda>x \<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)]\<down>\<close>
proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I" RN GEN)
  AOT_show \<open>[\<lambda>x D!x & \<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)]\<down>\<close>
    by (simp add: "discern-obj:13")
next
  AOT_modally_strict {
    fix x
    AOT_show \<open>(D!x & \<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)) \<equiv> \<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
      AOT_assume \<open>D!x & \<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)\<close>
      AOT_thus \<open>\<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)\<close>
        using "con-dis-i-e:2:b" by blast
    next
      AOT_assume \<open>\<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy)\<close>
      then AOT_obtain y where \<open>Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & [\<bbbP>]xy\<close>
        using "\<exists>E"[rotated] by blast
      AOT_thus \<open>D!x\<close>
        using "OnDiscerniblesE.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E.&E(1)"
          "con-dis-i-e:2:b" "cqt:2"(1) "pred-rel-disc[aux]" "pred-thm:2" by blast
    qed
  }
qed

AOT_theorem "th-succ-lem:5": \<open>[\<lambda>x [\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]]\<down>\<close>
proof(rule "safe-ext"[axiom_inst, THEN "\<rightarrow>E"]; safe intro!: "&I" RN GEN)
  AOT_show \<open>[\<lambda>x D!x & [\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]]\<down>\<close>
    by (simp add: "discern-obj:13")
next
  AOT_modally_strict {
    fix x
    AOT_show \<open>(D!x & [\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]) \<equiv> [\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]\<close>
    proof(safe intro!: "\<equiv>I" "\<rightarrow>I" "&I")
      AOT_assume \<open>D!x & [\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]\<close>
      AOT_thus \<open>[\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]\<close>
        using "con-dis-i-e:2:b" by blast
    next
      AOT_assume \<open>[\<bbbP>]x#[\<lambda>z [\<bbbP>\<^sup>+]zx]\<close>
      AOT_thus \<open>D!x\<close>
        using "OnDiscerniblesE.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E.&E(1)"
          "pred-rel-disc[aux]" "pred-thm:2" "russell-axiom[exe,2,1,1].\<psi>_denotes_asm"
          "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" by blast
    qed
  }
qed

AOT_theorem "th-succ-lem:6": \<open>\<forall>n\<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zn]) & [\<bbbP>]ny)\<close>
proof(rule "Number.GEN")
  fix n
  AOT_have \<open>[\<lambda>x \<exists>y (Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & \<bbbP>xy)]n\<close>
  proof(rule induction[THEN "\<forall>E"(1), OF "th-succ-lem:4", THEN "\<rightarrow>E", THEN "Number.\<forall>E"];
        safe intro!: "&I" "Number.GEN" "\<rightarrow>I")
    AOT_have 0: \<open>[\<lambda>z [\<bbbP>\<^sup>+]z 0]\<down>\<close>
      by "cqt:2"
    AOT_obtain y where y: \<open>Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]z 0])\<close>
      using "0" "num:1.unvarify_G.\<forall>E(1).\<exists>E'" by blast
    moreover AOT_have \<open>\<bbbP>0y\<close>
    proof(safe intro!: "pred-thm:3"[unvarify x, THEN "\<equiv>E"(2)] "zero:2")
      AOT_have \<open>[\<lambda>z [\<bbbP>\<^sup>+]z 0]0 & Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]z 0]) & Numbers(0,[\<lambda>z [\<bbbP>\<^sup>+]z 0]\<^sup>-\<^sup>0)\<close>
      proof(safe intro!: "&I" y)
        AOT_have \<open>[\<bbbP>\<^sup>+]0 0\<close>
          using "0-n" "nnumber:3.unvarify_x.\<forall>E(1).\<equiv>E(1)" "russell-axiom[exe,1].\<psi>_denotes_asm"
          by blast
        AOT_thus \<open>[\<lambda>z [\<bbbP>\<^sup>+]z 0]0\<close>
          using "0" "0-n" "betaC:2:a" "russell-axiom[exe,1].\<psi>_denotes_asm" by blast
      next
        AOT_have \<open>\<not>\<exists>u [\<lambda>z [\<bbbP>\<^sup>+]z 0]\<^sup>-\<^sup>0 u\<close>
        proof(rule "raa-cor:2")
          AOT_assume \<open>\<exists>u [\<lambda>z [\<bbbP>\<^sup>+]z 0]\<^sup>-\<^sup>0 u\<close>
          then AOT_obtain u where \<open>[\<lambda>z [\<bbbP>\<^sup>+]z 0]\<^sup>-\<^sup>0 u\<close>
            using "Discernible.\<exists>E"[rotated] by meson
          AOT_hence \<open>[\<bbbP>\<^sup>+]u 0 & u \<noteq> 0\<close>
            by (metis "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(1)"
                "F-u:2[equiv].unconstrain_u.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1).&E(2)" "betaC:1:a"
                "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm" zero_disc)
          moreover AOT_have \<open>\<not>(u =\<^sub>D 0)\<close>
            by (metis "con-dis-i-e:2:b" "discern-obj:18.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<equiv>E(1).&E(2).rule=E'"
                "discern-obj:3.unvarify_x.\<forall>E(1).\<equiv>E(1).\<forall>E(1).\<rightarrow>E.\<exists>E'"
                "discern-obj:31.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<rightarrow>E" "oth-class-taut:3:a" "reductio-aa:1"
                "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm" calculation
                zero_disc)
          ultimately AOT_have \<open>[\<bbbP>\<^sup>*]u 0\<close>
            using "w-ances"[unvarify y, OF "zero:2"]
            using "con-dis-i-e:4:c" "con-dis-taut:1.\<rightarrow>E" "cqt:2"(1) "pred-rel-disc[aux]" "pred-thm:2"
              "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(1)" "zero:2"
            by blast
          moreover AOT_have \<open>\<not>[\<bbbP>\<^sup>*]u 0\<close>
            using "existential:2[const_var]" "no-pred-0:2" "reductio-aa:2" by blast
          ultimately AOT_show \<open>p & \<not>p\<close> for p
            using "raa-cor:4" by blast
        qed
        AOT_thus \<open>Numbers(0,[\<lambda>z [\<bbbP>\<^sup>+]z 0]\<^sup>-\<^sup>0)\<close>
          using "0F:1.unvarify_F.\<forall>E(1).\<equiv>E(1)" "F-u:2[den].unconstrain_u.\<forall>E(1).\<rightarrow>E"
            "russell-axiom[exe,1].\<psi>_denotes_asm" zero_disc by blast
      qed
      AOT_thus \<open>\<exists>F \<exists>u ([F]u & Numbers(y,F) & Numbers(0,[F]\<^sup>-\<^sup>u))\<close>
        by (metis (no_types, lifting) "0" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:1"
            "russell-axiom[exe,1].\<psi>_denotes_asm" zero_disc)
    qed
    ultimately AOT_have \<open>\<exists>y (Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]z 0]) & \<bbbP>0y)\<close>
      by (meson "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:2[const_var]")
    AOT_thus \<open>[\<lambda>x \<exists>y (Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & \<bbbP>xy)]0\<close>
      by (simp add: "betaC:2:a" "th-succ-lem:4" "zero:2")
  next
    fix n m
    AOT_assume Pnm: \<open>[\<bbbP>]nm\<close>
    AOT_assume \<open>[\<lambda>x \<exists>y (Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & \<bbbP>xy)]n\<close>
    AOT_hence \<open>\<exists>y (Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zn]) & \<bbbP>ny)\<close>
      using "betaC:1:a" by blast
    then AOT_obtain y where y: \<open>Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zn]) & \<bbbP>ny\<close>
      using "\<exists>E"[rotated] by blast
    AOT_have 1: \<open>[\<lambda>z [\<bbbP>\<^sup>+]zm]\<down>\<close>
      by "cqt:2"
    then AOT_obtain c where c: \<open>Numbers(c, [\<lambda>z [\<bbbP>\<^sup>+]zm])\<close>
      using "num:1.unvarify_G.\<forall>E(1).\<exists>E'" by blast
    moreover AOT_have \<open>\<bbbP>mc\<close>
    proof(safe intro!: "pred-thm:3"[THEN "\<equiv>E"(2)])
      AOT_have \<open>[\<lambda>z [\<bbbP>\<^sup>+]zm]m & Numbers(c,[\<lambda>z [\<bbbP>\<^sup>+]zm]) & Numbers(m,[\<lambda>z [\<bbbP>\<^sup>+]zm]\<^sup>-\<^sup>m)\<close>
      proof(safe intro!: "&I" c)
        AOT_have \<open>[\<bbbP>\<^sup>+]mm\<close>
          by (meson "con-dis-i-e:3:b" "discern-obj:30.unvarify_x.\<forall>E(1).\<rightarrow>E" "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E"
              "pred-rel-disc[aux]" "pred-thm:2" "russell-axiom[exe,1].\<psi>_denotes_asm"
              "w-ances.unconstrain_\<R>.unvarify_x.unvarify_y.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<equiv>E(2)"
              Number.restricted_var_condition)
        AOT_thus \<open>[\<lambda>z [\<bbbP>\<^sup>+]zm]m\<close>
          by (simp add: "1" "betaC:2:a" "cqt:2"(1))
      next
        AOT_show \<open>Numbers(m,[\<lambda>z [\<bbbP>\<^sup>+]zm]\<^sup>-\<^sup>m)\<close>
        proof(rule "th-succ-lem:2"[THEN "\<rightarrow>E", THEN "\<equiv>E"(1)]; (safe intro!: "&I")?)
          AOT_show \<open>[\<nat>]m\<close>
            by (simp add: Number.restricted_var_condition)
          AOT_show \<open>[\<bbbP>]nm\<close>
            using Pnm.
          AOT_have \<open>y = m\<close>
            by (meson "con-dis-i-e:1" "con-dis-taut:2" "pred-func:1" "vdash-properties:10" Pnm y)
          AOT_thus \<open>Numbers(m,[\<lambda>z [\<bbbP>\<^sup>+]zn])\<close>
            using "con-dis-i-e:2:a" "rule=E" y by fast
        qed
      qed
      AOT_thus \<open>\<exists>F \<exists>u ([F]u & Numbers(c,F) & Numbers(m,[F]\<^sup>-\<^sup>u))\<close>
        by (metis (no_types, lifting) "1" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:1"
            "nat-card:2.unvarify_x.\<forall>E(1).\<rightarrow>E" "russell-axiom[exe,1].\<psi>_denotes_asm"
            Number.restricted_var_condition)
    qed
    ultimately AOT_have \<open>Numbers(c, [\<lambda>z [\<bbbP>\<^sup>+]zm]) & \<bbbP>mc\<close>
      using "&I" by blast
    AOT_hence \<open>\<exists>y (Numbers(y, [\<lambda>z [\<bbbP>\<^sup>+]zm]) & \<bbbP>my)\<close>
      using "\<exists>I" by fast
    AOT_thus \<open>[\<lambda>x \<exists>y (Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zx]) & \<bbbP>xy)]m\<close>
      using "betaC:2:a" "russell-axiom[exe,1].\<psi>_denotes_asm" "th-succ-lem:4"
        Number.restricted_var_condition by blast
  qed
  AOT_thus \<open>\<exists>y(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zn]) & [\<bbbP>]ny)\<close>
    using "betaC:1:a" by blast
qed

AOT_theorem "th-succ-lem:7": \<open>\<forall>n [\<bbbP>]n#[\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
proof(safe intro!: "Number.\<forall>I")
  fix n
  AOT_have 1: \<open>[\<lambda>z [\<bbbP>\<^sup>+]zn]\<down>\<close>
    by "cqt:2"
  AOT_obtain y where y: \<open>(Numbers(y,[\<lambda>z [\<bbbP>\<^sup>+]zn]) & [\<bbbP>]ny)\<close>
    using "russell-axiom[exe,1].\<psi>_denotes_asm" "th-succ-lem:6.\<forall>E(1).\<rightarrow>E.\<exists>E'"
      Number.restricted_var_condition by blast
  moreover AOT_have 2: \<open>Numbers(#[\<lambda>z [\<bbbP>\<^sup>+]zn], [\<lambda>z [\<bbbP>\<^sup>+]zn])\<close>
    using "eq-num:5"[unvarify G, OF 1, THEN "\<rightarrow>E", OF "th-succ-lem:3[lem']"].
  AOT_have \<open>y = #[\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
  proof(rule "pre-Hume:1"[unvarify y H G, OF 1, OF 1, THEN "\<rightarrow>E", THEN "\<equiv>E"(2)]; (safe intro!: "&I" y[THEN "&E"(1)] 2)?)
    AOT_show \<open>#[\<lambda>z [\<bbbP>\<^sup>+]zn]\<down>\<close>
      by (simp add: "1" "num-def:2.unvarify_G.\<forall>E(1)")
    AOT_show \<open>[\<lambda>z [\<bbbP>\<^sup>+]zn] \<approx>\<^sub>D [\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
      using "1" "eq-part:1.unvarify_F.\<forall>E(1)" by blast
  qed
  AOT_thus \<open>[\<bbbP>]n#[\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
    using y
    by (meson "con-dis-i-e:2:b" "rule=E'")
qed

AOT_theorem "th-succ": \<open>\<forall>n\<exists>!m [\<bbbP>]nm\<close>
proof(safe intro!: Number.GEN "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  fix n
  AOT_have \<open>[\<nat>]#[\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
    using "russell-axiom[exe,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm"
      "suc-num:1.unconstrain_n.unvarify_x.\<forall>E(1).\<forall>E(1).\<rightarrow>E.\<rightarrow>E" "th-succ-lem:7.\<forall>E(1).\<rightarrow>E"
      Number.restricted_var_condition by blast
  moreover AOT_have 1: \<open>[\<bbbP>]n#[\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
    using "russell-axiom[exe,1].\<psi>_denotes_asm" "th-succ-lem:7.\<forall>E(1).\<rightarrow>E" Number.restricted_var_condition
    by force
  moreover AOT_have \<open>\<forall>y([\<nat>]y & [\<bbbP>]ny \<rightarrow> y = #[\<lambda>z [\<bbbP>\<^sup>+]zn])\<close>
  proof(safe intro!: GEN "\<rightarrow>I")
    fix y
    AOT_assume 2: \<open>[\<nat>]y & [\<bbbP>]ny\<close>
    AOT_thus \<open>y = #[\<lambda>z [\<bbbP>\<^sup>+]zn]\<close>
      by (metis "1" "con-dis-i-e:2:b" "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E"
          "pred-func:1.unvarify_x.unvarify_y.unvarify_z.\<forall>E(1).\<forall>E(1).\<forall>E(1).\<rightarrow>E.rule=E'" "rule=I:1"
          "russell-axiom[exe,2,1,1].\<psi>_denotes_asm" "russell-axiom[exe,2,1,2].\<psi>_denotes_asm")
  qed
  ultimately AOT_show \<open>\<exists>x ([\<nat>]x & [\<bbbP>]nx & \<forall>y([\<nat>]y & [\<bbbP>]ny \<rightarrow> y = x))\<close>
    by (meson "con-dis-taut:5.\<rightarrow>E.\<rightarrow>E" "existential:1" "russell-axiom[exe,1].\<psi>_denotes_asm")
qed

(**************** START HERE ***********************)


(*
proof(safe intro!: Number.GEN "\<rightarrow>I" "uniqueness:1"[THEN "\<equiv>\<^sub>d\<^sub>fI"])
  fix n
  AOT_have \<open>NaturalCardinal(n)\<close>
    by (metis "nat-card" Number.\<psi> "\<rightarrow>E")
  AOT_hence \<open>\<exists>G(n = #G)\<close>
    by (metis "\<equiv>\<^sub>d\<^sub>fE" card)
  then AOT_obtain G where n_num_G: \<open>n = #G\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<exists>n (n = #G)\<close>
    by (rule "Number.\<exists>I")
  AOT_hence \<open>\<diamond>\<exists>y ([E!]y & \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
    using "modal-axiom"[axiom_inst, THEN "\<rightarrow>E"] by blast
  AOT_hence \<open>\<exists>y \<diamond>([E!]y & \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
    using "BF\<diamond>"[THEN "\<rightarrow>E"] by auto
  then AOT_obtain y where \<open>\<diamond>([E!]y & \<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
    using "\<exists>E"[rotated] by blast
  AOT_hence \<open>\<diamond>E!y\<close> and 2: \<open>\<diamond>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y)\<close>
    using "KBasic2:3" "&E" "\<rightarrow>E" by blast+
  AOT_hence Oy: \<open>O!y\<close>
    by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" intro: AOT_ordinary[THEN "=\<^sub>d\<^sub>fI"(2)])
  AOT_have 0: \<open>\<forall>u(\<^bold>\<A>[G]u \<rightarrow> u \<noteq>\<^sub>E y)\<close>
    using 2 "modal-lemma"[unconstrain v, THEN "\<rightarrow>E", OF Oy, THEN "\<rightarrow>E"] by simp
  AOT_have 1: \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<down>\<close>
    by "cqt:2"
  AOT_obtain b where b_prop: \<open>Numbers(b, [\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y])\<close>
    using "num:1"[unvarify G, OF 1] "\<exists>E"[rotated] by blast
  AOT_have Pnb: \<open>[\<bbbP>]nb\<close>
  proof(safe intro!: "pred-thm:3"[THEN "\<equiv>E"(2)]
                     "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<guillemotright>\<close>]
                     1 "\<exists>I"(2)[where \<beta>=y] "&I" Oy b_prop)
    AOT_show \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]y\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2" "\<or>I"(2)
                       "ord=Eequiv:1"[THEN "\<rightarrow>E", OF Oy])
  next
    AOT_have equinum: \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<^sup>-\<^sup>y \<approx>\<^sub>E [\<lambda>x \<^bold>\<A>[G]x]\<close>
    proof(rule "apE-eqE:1"[unvarify F G, THEN "\<rightarrow>E"];
          ("cqt:2[lambda]" | rule "F-u[den]"[unvarify F]; "cqt:2[lambda]")?)
      AOT_show \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<^sup>-\<^sup>y \<equiv>\<^sub>E [\<lambda>x \<^bold>\<A>[G]x]\<close>
      proof (safe intro!: eqE[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "F-u[den]"[unvarify F]
                          Ordinary.GEN "\<rightarrow>I"; "cqt:2"?)
        fix u
        AOT_have \<open>[[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]\<^sup>-\<^sup>y]u \<equiv> ([\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]u) & u \<noteq>\<^sub>E y\<close>
          apply (rule "F-u"[THEN "=\<^sub>d\<^sub>fI"(1)[where \<tau>\<^sub>1\<tau>\<^sub>n=\<open>(_,_)\<close>], simplified]; "cqt:2"?)
          by (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)]; "cqt:2")
        also AOT_have \<open>\<dots> \<equiv>  (\<^bold>\<A>[G]u \<or> u =\<^sub>E y) & u \<noteq>\<^sub>E y\<close>
          apply (AOT_subst \<open>[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]u\<close> \<open>\<^bold>\<A>[G]u \<or> u =\<^sub>E y\<close>)
           apply (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2)]; "cqt:2")
          using "oth-class-taut:3:a" by blast
        also AOT_have \<open>\<dots> \<equiv> \<^bold>\<A>[G]u\<close>
        proof(safe intro!: "\<equiv>I" "\<rightarrow>I")
          AOT_assume \<open>(\<^bold>\<A>[G]u \<or> u =\<^sub>E y) & u \<noteq>\<^sub>E y\<close>
          AOT_thus \<open>\<^bold>\<A>[G]u\<close>
            by (metis "&E"(1) "&E"(2) "\<or>E"(3) "\<equiv>E"(1) "thm-neg=E")
        next
          AOT_assume \<open>\<^bold>\<A>[G]u\<close>
          AOT_hence \<open>u \<noteq>\<^sub>E y\<close> and \<open>\<^bold>\<A>[G]u \<or> u =\<^sub>E y\<close>
            using 0[THEN "\<forall>E"(2), THEN "\<rightarrow>E", OF Ordinary.\<psi>, THEN "\<rightarrow>E"]
                  "\<or>I" by blast+
          AOT_thus \<open>(\<^bold>\<A>[G]u \<or> u =\<^sub>E y) & u \<noteq>\<^sub>E y\<close>
            using "&I" by simp
        qed
        also AOT_have \<open>\<dots> \<equiv> [\<lambda>x \<^bold>\<A>[G]x]u\<close>
          by (rule "beta-C-cor:2"[THEN "\<rightarrow>E", THEN "\<forall>E"(2), symmetric]; "cqt:2")
        finally AOT_show \<open>[[\<lambda>x \<^bold>\<A>[G]x \<or> [(=\<^sub>E)]xy]\<^sup>-\<^sup>y]u \<equiv> [\<lambda>x \<^bold>\<A>[G]x]u\<close>.
      qed
    qed
    AOT_have 2: \<open>[\<lambda>x \<^bold>\<A>[G]x]\<down>\<close> by "cqt:2[lambda]"
    AOT_show \<open>Numbers(n,[\<lambda>x \<^bold>\<A>[G]x \<or> x =\<^sub>E y]\<^sup>-\<^sup>y)\<close>
      using "num-tran:1"[unvarify G H, OF 2, OF "F-u[den]"[unvarify F, OF 1],
                       THEN "\<rightarrow>E", OF equinum, THEN "\<equiv>E"(2),
                       OF "eq-num:2"[THEN "\<equiv>E"(2), OF n_num_G]].
  qed
  AOT_show \<open>\<exists>\<alpha> ([\<nat>]\<alpha> & [\<bbbP>]n\<alpha> & \<forall>\<beta> ([\<nat>]\<beta> & [\<bbbP>]n\<beta> \<rightarrow> \<beta> = \<alpha>))\<close>
  proof(safe intro!: "\<exists>I"(2)[where \<beta>=b] "&I" Pnb "\<rightarrow>I" GEN)
    AOT_show \<open>[\<nat>]b\<close> using "suc-num:1"[THEN "\<rightarrow>E", OF Pnb].
  next
    fix y
    AOT_assume 0: \<open>[\<nat>]y & [\<bbbP>]ny\<close>
    AOT_show \<open>y = b\<close>
      apply (rule "pred-func:1"[THEN "\<rightarrow>E"])
      using 0[THEN "&E"(2)] Pnb "&I" by blast
  qed
qed
*)

(* Note the use of a bold '. *)
AOT_define Successor :: \<open>\<tau> \<Rightarrow> \<kappa>\<^sub>s\<close> (\<open>_\<^bold>''\<close> [100] 100)
  "def-suc": \<open>n\<^bold>' =\<^sub>d\<^sub>f \<^bold>\<iota>m([\<bbbP>]nm)\<close>

text\<open>Note: not explicitly in PLM\<close>
AOT_theorem "def-suc[den1]": \<open>\<^bold>\<iota>m([\<bbbP>]nm)\<down>\<close>
  using "A-Exists:2" "RA[2]" "\<equiv>E"(2) "th-succ"[THEN "Number.\<forall>E"] by blast
text\<open>Note: not explicitly in PLM\<close>
AOT_theorem "def-suc[den2]": shows \<open>n\<^bold>'\<down>\<close>
  by (rule "def-suc"[THEN "=\<^sub>d\<^sub>fI"(1)])
     (auto simp: "def-suc[den1]")

(* TODO: not in PLM *)
AOT_theorem suc_eq_desc: \<open>n\<^bold>' = \<^bold>\<iota>m([\<bbbP>]nm)\<close>
  by (rule "def-suc"[THEN "=\<^sub>d\<^sub>fI"(1)])
     (auto simp: "def-suc[den1]" "rule=I:1")

AOT_theorem "suc-fact": \<open>n = m \<rightarrow> n\<^bold>' = m\<^bold>'\<close>
proof (rule "\<rightarrow>I")
  AOT_assume 0: \<open>n = m\<close>
  AOT_show \<open>n\<^bold>' = m\<^bold>'\<close>
    apply (rule "rule=E"[rotated, OF 0])
    by (rule "=I"(1)[OF "def-suc[den2]"])
qed

(*
AOT_theorem "ind-gnd": \<open>m = 0 \<or> \<exists>n(m = n\<^bold>')\<close>
proof -
  AOT_have \<open>[[\<bbbP>]\<^sup>+]0m\<close>
    using Number.\<psi> "\<equiv>E"(1) "nnumber:3" by blast
  AOT_hence \<open>[[\<bbbP>]\<^sup>*]0m \<or> 0 =\<^sub>\<bbbP> m\<close>
    using "assume1:5"[unvarify x, OF "zero:2", THEN "\<equiv>E"(1)] by blast
  moreover {
    AOT_assume \<open>[[\<bbbP>]\<^sup>*]0m\<close>
    AOT_hence \<open>\<exists>z ([[\<bbbP>]\<^sup>+]0z & [\<bbbP>]zm)\<close>
      using "w-ances-her:7"[unconstrain \<R>, unvarify \<beta> x, OF "zero:2",
                            OF "pred-thm:2", THEN "\<rightarrow>E", OF "pred-1-1:4",
                            THEN "\<rightarrow>E"]
      by blast
    then AOT_obtain z where \<theta>: \<open>[[\<bbbP>]\<^sup>+]0z\<close> and \<xi>: \<open>[\<bbbP>]zm\<close>
      using "&E" "\<exists>E"[rotated] by blast
    AOT_have Nz: \<open>[\<nat>]z\<close>
      using \<theta> "\<equiv>E"(2) "nnumber:3" by blast
    moreover AOT_have \<open>m = z\<^bold>'\<close>
    proof (rule "def-suc"[THEN "=\<^sub>d\<^sub>fI"(1)];
           safe intro!: "def-suc[den1]"[unconstrain n, THEN "\<rightarrow>E", OF Nz]
                        "nec-hintikka-scheme"[THEN "\<equiv>E"(2)] "&I"
                        GEN "\<rightarrow>I" "Act-Basic:2"[THEN "\<equiv>E"(2)])
      AOT_show \<open>\<^bold>\<A>[\<nat>]m\<close> using Number.\<psi>
        by (meson "mod-col-num:1" "nec-imp-act" "\<rightarrow>E")
    next
      AOT_show \<open>\<^bold>\<A>[\<bbbP>]zm\<close> using \<xi>
        by (meson "nec-imp-act" "pred-1-1:1" "\<rightarrow>E")
    next
      fix y
      AOT_assume \<open>\<^bold>\<A>([\<nat>]y & [\<bbbP>]zy)\<close>
      AOT_hence \<open>\<^bold>\<A>[\<nat>]y\<close> and \<open>\<^bold>\<A>[\<bbbP>]zy\<close>
        using "Act-Basic:2" "&E" "\<equiv>E"(1) by blast+
      AOT_hence 0: \<open>[\<bbbP>]zy\<close>
        by (metis RN "\<equiv>E"(1) "pred-1-1:1" "sc-eq-fur:2" "\<rightarrow>E")
      AOT_thus \<open>y = m\<close>
        using "pred-func:1"[THEN "\<rightarrow>E", OF "&I"] \<xi> by metis
    qed
    ultimately AOT_have \<open>[\<nat>]z & m = z\<^bold>'\<close>
      by (rule "&I")
    AOT_hence \<open>\<exists>n m = n\<^bold>'\<close>
      by (rule "\<exists>I")
    hence ?thesis
      by (rule "\<or>I")
  }
  moreover {
    AOT_assume \<open>0 =\<^sub>\<bbbP> m\<close>
    AOT_hence \<open>0 = m\<close>
      using "id-R-thm:3"[unconstrain \<R>, unvarify \<beta> x, OF "zero:2", OF "pred-thm:2",
                         THEN "\<rightarrow>E", OF "pred-1-1:4", THEN "\<rightarrow>E"]
      by auto
    hence ?thesis using id_sym "\<or>I" by blast
  }
  ultimately show ?thesis
    by (metis "\<or>E"(2) "raa-cor:1")
qed

AOT_theorem "suc-thm": \<open>[\<bbbP>]n n\<^bold>'\<close>
proof -
  AOT_obtain x where m_is_n: \<open>x = n\<^bold>'\<close>
    using "free-thms:1"[THEN "\<equiv>E"(1), OF "def-suc[den2]"]
    using "\<exists>E" by metis
  AOT_have \<open>\<^bold>\<A>([\<nat>]n\<^bold>' & [\<bbbP>]n n\<^bold>')\<close>
    apply (rule "rule=E"[rotated, OF suc_eq_desc[symmetric]])
    apply (rule "actual-desc:4"[THEN "\<rightarrow>E"])
    by (simp add:  "def-suc[den1]")
  AOT_hence \<open>\<^bold>\<A>[\<nat>]n\<^bold>'\<close> and \<open>\<^bold>\<A>[\<bbbP>]n n\<^bold>'\<close>
    using "Act-Basic:2" "\<equiv>E"(1) "&E" by blast+
  AOT_hence \<open>\<^bold>\<A>[\<bbbP>]nx\<close>
    using m_is_n[symmetric] "rule=E" by fast+
  AOT_hence \<open>[\<bbbP>]nx\<close>
    by (metis RN "\<equiv>E"(1) "pred-1-1:1" "sc-eq-fur:2" "\<rightarrow>E")
  thus ?thesis
    using m_is_n "rule=E" by fast
qed

AOT_define Numeral1 :: \<open>\<kappa>\<^sub>s\<close> ("1")
  "numerals:1": \<open>1 =\<^sub>d\<^sub>f 0\<^bold>'\<close>

AOT_theorem "prec-facts:1": \<open>[\<bbbP>]0 1\<close>
  by (auto intro: "numerals:1"[THEN "rule-id-df:2:b[zero]",
                               OF "def-suc[den2]"[unconstrain n, unvarify \<beta>,
                                                  OF "zero:2", THEN "\<rightarrow>E", OF "0-n"]]
                  "suc-thm"[unconstrain n, unvarify \<beta>, OF "zero:2",
                            THEN "\<rightarrow>E", OF "0-n"])

(* TODO: more theorems *)

(* Note: we forgo restricted variables for natural cardinals. *)
AOT_define Finite :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Finite'(_')\<close>)
  "inf-card:1": \<open>Finite(x) \<equiv>\<^sub>d\<^sub>f NaturalCardinal(x) & [\<nat>]x\<close>
AOT_define Infinite :: \<open>\<tau> \<Rightarrow> \<phi>\<close> (\<open>Infinite'(_')\<close>)
  "inf-card:2": \<open>Infinite(x) \<equiv>\<^sub>d\<^sub>f NaturalCardinal(x) & \<not>Finite(x)\<close>

AOT_theorem "inf-card-exist:1": \<open>NaturalCardinal(#O!)\<close>
  by (safe intro!: card[THEN "\<equiv>\<^sub>d\<^sub>fI"] "\<exists>I"(1)[where \<tau>=\<open>\<guillemotleft>O!\<guillemotright>\<close>] "=I"
                   "num-def:2"[unvarify G] "oa-exist:1")

AOT_theorem "inf-card-exist:2": \<open>Infinite(#O!)\<close>
  oops
(*
proof (safe intro!: "inf-card:2"[THEN "\<equiv>\<^sub>d\<^sub>fI"] "&I" "inf-card-exist:1")
  AOT_show \<open>\<not>Finite(#O!)\<close>
  proof(rule "raa-cor:2")
    AOT_assume \<open>Finite(#O!)\<close>
    AOT_hence 0: \<open>[\<nat>]#O!\<close>
      using "inf-card:1"[THEN "\<equiv>\<^sub>d\<^sub>fE"] "&E"(2) by blast
    AOT_have \<open>Numbers(#O!, [\<lambda>z \<^bold>\<A>O!z])\<close>
      using "eq-num:3"[unvarify G, OF "oa-exist:1"].
    AOT_hence \<open>#O! = #O!\<close>
      using "eq-num:2"[unvarify x G, THEN "\<equiv>E"(1), OF "oa-exist:1",
                       OF "num-def:2"[unvarify G], OF "oa-exist:1"]
      by blast
    AOT_hence \<open>[\<nat>]#O! & #O! = #O!\<close>
      using 0 "&I" by blast
    AOT_hence \<open>\<exists>x ([\<nat>]x & x = #O!)\<close>
      using "num-def:2"[unvarify G, OF "oa-exist:1"] "\<exists>I"(1) by fast
    AOT_hence \<open>\<diamond>\<exists>y ([E!]y & \<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
      using "modal-axiom"[axiom_inst, unvarify G, THEN "\<rightarrow>E", OF "oa-exist:1"] by blast
    AOT_hence \<open>\<exists>y \<diamond>([E!]y & \<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E y))\<close>
      using "BF\<diamond>"[THEN "\<rightarrow>E"] by blast
    then AOT_obtain b where \<open>\<diamond>([E!]b & \<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E b))\<close>
      using "\<exists>E"[rotated] by blast
    AOT_hence \<open>\<diamond>[E!]b\<close> and 2: \<open>\<diamond>\<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E b)\<close>
      using "KBasic2:3"[THEN "\<rightarrow>E"] "&E" by blast+
    AOT_hence \<open>[\<lambda>x \<diamond>[E!]x]b\<close>
      by (auto intro!: "\<beta>\<leftarrow>C"(1) "cqt:2")
    moreover AOT_have \<open>O! = [\<lambda>x \<diamond>[E!]x]\<close>
      by (rule "rule-id-df:1[zero]"[OF "oa:1"]) "cqt:2"
    ultimately AOT_have b_ord: \<open>O!b\<close>
      using "rule=E" id_sym by fast
    AOT_hence \<open>\<^bold>\<A>O!b\<close>
      by (meson "\<equiv>E"(1) "oa-facts:7")
    moreover AOT_have 2: \<open>\<forall>u (\<^bold>\<A>[O!]u \<rightarrow> u \<noteq>\<^sub>E b)\<close>
      using "modal-lemma"[unvarify G, unconstrain v, OF "oa-exist:1",
                          THEN "\<rightarrow>E", OF b_ord, THEN "\<rightarrow>E", OF 2].
    ultimately AOT_have \<open>b \<noteq>\<^sub>E b\<close>
      using "Ordinary.\<forall>E"[OF 2, unconstrain \<alpha>, THEN "\<rightarrow>E",
                          OF b_ord, THEN "\<rightarrow>E"] by blast
    AOT_hence \<open>\<not>(b =\<^sub>E b)\<close>
      by (metis "\<equiv>E"(1) "thm-neg=E")
    moreover AOT_have \<open>b =\<^sub>E b\<close>
      using "ord=Eequiv:1"[THEN "\<rightarrow>E", OF b_ord].
    ultimately AOT_show \<open>p & \<not>p\<close> for p
      by (metis "raa-cor:3")
  qed
qed
*)
*)

(*<*)
end
(*>*)