diff --git a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy
--- a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy
+++ b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy
@@ -1,1007 +1,1008 @@
 section \<open>Accuracy without cutoff\label{sec:accuracy_wo_cutoff}\<close>
 
 text \<open>This section verifies that each of the $l$ estimate have the required accuracy with high
 probability assuming that there was no cut-off, i.e., that $s=0$. Section~\ref{sec:accuracy} will
 then show that this remains true as long as the cut-off is below @{term "t f"} the subsampling
 threshold.\<close>
 
 theory Distributed_Distinct_Elements_Accuracy_Without_Cutoff
   imports
+    Concentration_Inequalities.Bienaymes_Identity
     Distributed_Distinct_Elements_Inner_Algorithm
     Distributed_Distinct_Elements_Balls_and_Bins
 begin
 
 no_notation Polynomials.var ("X\<index>")
 
 locale inner_algorithm_fix_A = inner_algorithm +
   fixes A
   assumes A_range: "A \<subseteq> {..<n}"
   assumes A_nonempty: "{} \<noteq> A"
 begin
 
 definition X :: nat where "X = card A"
 
 definition q_max where "q_max = nat (\<lceil>log 2 X\<rceil> - b_exp)"
 
 definition t :: "(nat \<Rightarrow> nat) \<Rightarrow> int"
   where "t f = int (Max (f ` A)) - b_exp + 9"
 
 definition s :: "(nat \<Rightarrow> nat) \<Rightarrow> nat"
   where "s f = nat (t f)"
 
 definition R :: "(nat \<Rightarrow> nat) \<Rightarrow> nat set"
   where "R f = {a. a \<in> A \<and> f a \<ge> s f}"
 
 definition r :: "nat \<Rightarrow> (nat \<Rightarrow> nat) \<Rightarrow> nat"
   where "r x f = card {a. a \<in> A \<and> f a \<ge> x}"
 
 definition p where "p = (\<lambda>(f,g,h). card {j\<in> {..<b}. \<tau>\<^sub>1 (f,g,h) A 0 j \<ge> s f})"
 
 definition Y where "Y = (\<lambda>(f,g,h). 2 ^ s f * \<rho>_inv (p (f,g,h)))"
 
 lemma fin_A: "finite A"
   using A_range finite_nat_iff_bounded by auto
 
 lemma X_le_n: "X \<le> n"
 proof -
   have "card A \<le> card {..<n}"
     by (intro card_mono A_range) simp
   thus ?thesis
     unfolding X_def by simp
 qed
 
 lemma X_ge_1: "X \<ge> 1"
   unfolding X_def
   using fin_A A_nonempty by (simp add: leI)
 
 lemma of_bool_square: "(of_bool x)\<^sup>2 = ((of_bool x)::real)"
   by (cases x, auto)
 
 lemma r_eq: "r x f = (\<Sum> a \<in> A.( of_bool( x \<le> f a) :: real))"
   unfolding r_def of_bool_def sum.If_cases[OF fin_A]
   by (simp add: Collect_conj_eq)
 
 lemma
   shows
     r_exp: "(\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1) = real X * (of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1) / 2^x)" and
     r_var: "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r x \<omega>)) \<le> (\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1)"
 proof -
   define V :: "nat \<Rightarrow> (nat \<Rightarrow> nat) \<Rightarrow> real" where "V = (\<lambda>a f. of_bool (x \<le> f a))"
 
   have V_exp: "(\<integral>\<omega>. V a \<omega> \<partial>\<Psi>\<^sub>1) = of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/2^x"
     (is "?L = ?R") if "a \<in> A" for a
   proof -
     have a_le_n: "a < n"
       using that A_range by auto
 
     have "?L = (\<integral>\<omega>. indicator {f. x \<le> f a} \<omega> \<partial> \<Psi>\<^sub>1)"
       unfolding V_def by (intro integral_cong_AE) auto
     also have "... = measure (map_pmf (\<lambda>\<omega>. \<omega> a) (sample_pmf \<Psi>\<^sub>1)) {f. x \<le> f}"
       by simp
     also have "... = measure (\<G> n_exp) {f. x \<le> f}"
       unfolding \<Psi>\<^sub>1.single[OF a_le_n] by simp
     also have "... = of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/2^x"
       unfolding \<G>_prob n_exp_def by simp
     finally show ?thesis by simp
   qed
 
   have b:"(\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1) = (\<Sum> a \<in> A. (\<integral>\<omega>. V a \<omega> \<partial>\<Psi>\<^sub>1))"
     unfolding r_eq V_def  using \<Psi>\<^sub>1.sample_space
     by (intro Bochner_Integration.integral_sum) auto
   also have "... = (\<Sum> a \<in> A.  of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/2^x)"
     using V_exp by (intro sum.cong) auto
   also have "... = X * (of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1) / 2^x)"
     using X_def by simp
   finally show "(\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1) = real X * (of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/ 2^x)"
     by simp
 
   have "(\<integral>\<omega>. (V a \<omega>)^2 \<partial> \<Psi>\<^sub>1) = (\<integral>\<omega>. V a \<omega> \<partial> \<Psi>\<^sub>1)" for a
     unfolding V_def of_bool_square by simp
 
   hence a:"measure_pmf.variance \<Psi>\<^sub>1 (V a) \<le> measure_pmf.expectation \<Psi>\<^sub>1 (V a)"  for a
     using \<Psi>\<^sub>1.sample_space by (subst measure_pmf.variance_eq) auto
 
   have "J \<subseteq> A \<Longrightarrow> card J = 2 \<Longrightarrow> prob_space.indep_vars \<Psi>\<^sub>1 (\<lambda>_. borel) V J" for J
     unfolding V_def using A_range finite_subset[OF _ fin_A]
     by (intro prob_space.indep_vars_compose2[where Y="\<lambda>i y. of_bool(x \<le> y)" and M'="\<lambda>_. discrete"]
         prob_space.k_wise_indep_vars_subset[OF _ \<Psi>\<^sub>1.indep]) (auto simp:prob_space_measure_pmf)
   hence "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r x \<omega>)) = (\<Sum> a \<in> A. measure_pmf.variance \<Psi>\<^sub>1 (V a))"
     unfolding r_eq V_def using \<Psi>\<^sub>1.sample_space
     by (intro measure_pmf.bienaymes_identity_pairwise_indep_2 fin_A) (simp_all)
   also have "... \<le> (\<Sum> a \<in> A. (\<integral>\<omega>. V a \<omega> \<partial> \<Psi>\<^sub>1))"
     by (intro sum_mono a)
   also have "... = (\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1)"
     unfolding b by simp
   finally show "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r x \<omega>)) \<le> (\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1)" by simp
 qed
 
 definition E\<^sub>1 where "E\<^sub>1 = (\<lambda>(f,g,h). 2 powr (-t f) * X \<in> {b/2^16..b/2})"
 
 lemma t_low:
   "measure \<Psi>\<^sub>1 {f. of_int (t f) < log 2 (real X) + 1 - b_exp} \<le> 1/2^7" (is "?L \<le> ?R")
 proof (cases "log 2 (real X) \<ge> 8")
   case True
   define Z :: "(nat \<Rightarrow> nat) \<Rightarrow> real" where "Z = r (nat \<lceil>log 2 (real X) - 8\<rceil>)"
 
   have "log 2 (real X) \<le> log 2 (real n)"
     using X_le_n X_ge_1 by (intro log_mono) auto
   hence "nat \<lceil>log 2 (real X) - 8\<rceil> \<le> nat \<lceil>log 2 (real n)\<rceil>"
     by (intro nat_mono ceiling_mono) simp
   hence a:"(nat \<lceil>log 2 (real X) - 8\<rceil> \<le> max (nat \<lceil>log 2 (real n)\<rceil>) 1)"
     by simp
 
   have b:"real (nat (\<lceil>log 2 (real X)\<rceil> - 8)) \<le> log 2 (real X) - 7"
     using True by linarith
 
   have "2 ^ 7 = real X / (2 powr (log 2 X) * 2 powr (-7))"
     using X_ge_1 by simp
   also have "... = real X / (2 powr (log 2 X - 7))"
     by (subst powr_add[symmetric]) simp
   also have "... \<le> real X / (2 powr (real (nat \<lceil>log 2 (real X) - 8\<rceil>)))"
     using b by (intro divide_left_mono powr_mono) auto
   also have "... = real X / 2 ^ nat \<lceil>log 2 (real X) - 8\<rceil>"
     by (subst powr_realpow) auto
   finally have "2 ^ 7 \<le> real X / 2 ^ nat \<lceil>log 2 (real X) - 8\<rceil>"
     by simp
   hence exp_Z_gt_2_7: "(\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<ge> 2^7"
     using a unfolding Z_def r_exp by simp
 
   have var_Z_le_exp_Z: "measure_pmf.variance \<Psi>\<^sub>1 Z \<le> (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)"
     unfolding Z_def by (intro r_var)
 
   have "?L \<le> measure \<Psi>\<^sub>1 {f. of_nat (Max (f ` A)) < log 2 (real X) - 8}"
     unfolding t_def by (intro pmf_mono) (auto simp add:int_of_nat_def)
   also have "... \<le> measure \<Psi>\<^sub>1 {f \<in> space \<Psi>\<^sub>1.  (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> \<bar>Z f - (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<bar>}"
   proof (rule pmf_mono)
     fix f assume "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)"
     have fin_f_A: "finite (f ` A)" using fin_A finite_imageI by blast
     assume " f \<in> {f. real (Max (f ` A)) < log 2 (real X) - 8}"
     hence "real (Max (f ` A)) < log 2 (real X) - 8" by auto
     hence "real (f a) < log 2 (real X) - 8" if "a \<in> A" for a
       using Max_ge[OF fin_f_A] imageI[OF that]  order_less_le_trans by fastforce
     hence "of_nat (f a) < \<lceil>log 2 (real X) - 8\<rceil>" if "a \<in> A" for a
       using that by (subst less_ceiling_iff) auto
     hence "f a < nat \<lceil>log 2 (real X) - 8\<rceil>" if "a \<in> A" for a
       using that True by fastforce
     hence "r (nat \<lceil>log 2 (real X) - 8\<rceil>) f = 0"
       unfolding r_def card_eq_0_iff using not_less by auto
     hence "Z f = 0"
       unfolding Z_def by simp
     thus "f \<in> {f \<in> space \<Psi>\<^sub>1.  (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> \<bar>Z f - (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)\<bar>}"
       by auto
   qed
   also have "... \<le> measure_pmf.variance \<Psi>\<^sub>1 Z / (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)^2"
     using exp_Z_gt_2_7 \<Psi>\<^sub>1.sample_space by (intro measure_pmf.second_moment_method) simp_all
   also have "... \<le> (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) / (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)^2"
     by (intro divide_right_mono var_Z_le_exp_Z) simp
   also have "... = 1 / (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)"
     using exp_Z_gt_2_7 by (simp add:power2_eq_square)
   also have "... \<le> ?R"
     using exp_Z_gt_2_7 by (intro divide_left_mono) auto
   finally show ?thesis by simp
 next
   case "False"
   have "?L \<le> measure \<Psi>\<^sub>1 {f. of_nat (Max (f ` A)) < log 2 (real X) - 8}"
     unfolding t_def by (intro pmf_mono) (auto simp add:int_of_nat_def)
   also have "... \<le> measure \<Psi>\<^sub>1 {}"
     using False by (intro pmf_mono) simp
   also have "... = 0"
     by simp
   also have "... \<le> ?R" by simp
   finally show ?thesis by simp
 qed
 
 lemma t_high:
   "measure \<Psi>\<^sub>1 {f. of_int (t f) > log 2 (real X) + 16 - b_exp} \<le> 1/2^7" (is "?L \<le> ?R")
 proof -
   define Z :: "(nat \<Rightarrow> nat) \<Rightarrow> real" where "Z = r (nat \<lfloor>log 2 (real X) + 8\<rfloor>)"
 
   have Z_nonneg: "Z f \<ge> 0" for f
     unfolding Z_def r_def by simp
 
   have "(\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> real X / (2 ^ nat \<lfloor>log 2 (real X) + 8\<rfloor>)"
     unfolding Z_def r_exp by simp
   also have "... \<le> real X / (2 powr (real (nat \<lfloor>log 2 (real X) + 8\<rfloor>)))"
     by (subst powr_realpow) auto
   also have "... \<le> real X / (2 powr \<lfloor>log 2 (real X) + 8\<rfloor>)"
     by (intro divide_left_mono powr_mono) auto
   also have "... \<le> real X / (2 powr (log 2 (real X) + 7))"
     by (intro divide_left_mono powr_mono, linarith) auto
   also have "... = real X / 2 powr (log 2 (real X)) / 2 powr 7"
     by (subst powr_add) simp
   also have "... \<le> 1/2 powr 7"
     using X_ge_1 by (subst powr_log_cancel) auto
   finally have Z_exp: "(\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> 1/2^7"
     by simp
 
   have "?L \<le> measure \<Psi>\<^sub>1 {f. of_nat (Max (f ` A)) > log 2 (real X) + 7}"
     unfolding t_def  by (intro pmf_mono) (auto simp add:int_of_nat_def)
   also have "... \<le> measure \<Psi>\<^sub>1 {f. Z f \<ge> 1}"
   proof (rule pmf_mono)
     fix f assume "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)"
     assume " f \<in> {f. real (Max (f ` A)) > log 2 (real X) + 7}"
     hence "real (Max (f ` A)) > log 2 (real X) + 7" by simp
     hence "int (Max (f ` A)) \<ge> \<lfloor>log 2 (real X) + 8\<rfloor>"
       by linarith
     hence "Max (f ` A) \<ge> nat \<lfloor>log 2 (real X) + 8\<rfloor>"
       by simp
     moreover have "f ` A \<noteq> {}" "finite (f ` A)"
       using fin_A finite_imageI A_nonempty by auto
     ultimately obtain fa where "fa \<in> f ` A" " fa \<ge>  nat \<lfloor>log 2 (real X) + 8\<rfloor>"
       using Max_in by auto
     then obtain ae where ae_def: "ae \<in> A" "nat \<lfloor>log 2 (real X) + 8\<rfloor> \<le> f ae"
       by auto
     hence "r (nat \<lfloor>log 2 (real X) + 8\<rfloor>) f > 0"
       unfolding r_def card_gt_0_iff using fin_A by auto
     hence "Z f \<ge> 1"
       unfolding Z_def by simp
     thus "f \<in> {f. 1 \<le> Z f}" by simp
   qed
   also have "... \<le> (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) / 1"
     using Z_nonneg using \<Psi>\<^sub>1.sample_space by (intro pmf_markov) auto
   also have "... \<le> ?R"
     using Z_exp by simp
   finally show ?thesis by simp
 qed
 
 lemma e_1: "measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi>} \<le> 1/2^6"
 proof -
   have "measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X \<notin> {real b/2^16..real b/2}} \<le>
     measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X < real b/2^16} +
     measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X > real b/2}"
     by (intro pmf_add) auto
   also have "... \<le> measure \<Psi>\<^sub>1 {f. of_int (t f) > log 2 X + 16 - b_exp} +
                    measure \<Psi>\<^sub>1 {f. of_int (t f) < log 2 X + 1 - b_exp}"
   proof (rule add_mono)
     show "measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X < real b/2^16} \<le>
     measure \<Psi>\<^sub>1 {f. of_int (t f) > log 2 X + 16 - b_exp}"
     proof (rule pmf_mono)
       fix f assume "f \<in> {f. 2 powr real_of_int (-t f) * real X < real b / 2 ^ 16}"
       hence "2 powr real_of_int (-t f) * real X < real b / 2 ^ 16"
         by simp
       hence "log 2 (2 powr of_int (-t f) * real X) < log 2 (real b / 2^16)"
         using b_min X_ge_1 by (intro iffD2[OF log_less_cancel_iff]) auto
       hence "of_int (-t f) + log  2 (real X) < log 2 (real b / 2^16)"
         using X_ge_1 by (subst (asm) log_mult) auto
       also have  "... = real b_exp - log 2 (2 powr 16)"
         unfolding b_def by (subst log_divide) auto
       also have "... = real b_exp - 16"
         by (subst log_powr_cancel) auto
       finally have "of_int (-t f) + log 2 (real X) < real b_exp - 16" by simp
       thus "f \<in> {f. of_int (t f) > log 2 (real X) + 16 - b_exp}"
         by simp
     qed
   next
     show "measure \<Psi>\<^sub>1 {f. 2 powr of_int (-t f) * real X > real b/2} \<le>
       measure \<Psi>\<^sub>1 {f. of_int (t f) < log 2 X + 1 - b_exp}"
     proof (rule pmf_mono)
       fix f assume "f \<in> {f. 2 powr real_of_int (-t f) * real X > real b / 2}"
       hence "2 powr real_of_int (-t f) * real X > real b / 2"
         by simp
       hence "log 2 (2 powr of_int (-t f) * real X) > log 2 (real b / 2)"
         using b_min X_ge_1 by (intro iffD2[OF log_less_cancel_iff]) auto
       hence "of_int (-t f) + log  2 (real X) > log 2 (real b / 2)"
         using X_ge_1 by (subst (asm) log_mult) auto
       hence  "of_int (-t f) + log  2 (real X) > real b_exp - 1"
         unfolding b_def by (subst (asm) log_divide) auto
       hence "of_int (t f) < log 2 (real X) + 1 - b_exp"
         by simp
       thus "f \<in> {f. of_int (t f) < log 2 (real X) + 1 - b_exp}"
         by simp
     qed
   qed
   also have "... \<le> 1/2^7 + 1/2^7"
     by (intro add_mono t_low t_high)
   also have "... = 1/2^6" by simp
   finally have "measure \<Psi>\<^sub>1 {f. 2 powr of_int (-t f) * real X \<notin> {real b/2^16..real b/2}} \<le> 1/2^6"
     by simp
 
   thus ?thesis
     unfolding sample_pmf_\<Psi> E\<^sub>1_def case_prod_beta
     by (subst pair_pmf_prob_left)
 qed
 
 definition E\<^sub>2 where "E\<^sub>2 = (\<lambda>(f,g,h). \<bar>card (R f) - X / 2^(s f)\<bar> \<le> \<epsilon>/3 * X / 2^(s f))"
 
 lemma e_2: "measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> \<not>E\<^sub>2 \<psi>} \<le> 1/2^6" (is "?L \<le> ?R")
 proof -
   define t\<^sub>m :: int where "t\<^sub>m = \<lfloor>log 2 (real X)\<rfloor> + 16 - b_exp"
 
   have t_m_bound: "t\<^sub>m \<le> \<lfloor>log 2 (real X)\<rfloor> - 10"
     unfolding t\<^sub>m_def using b_exp_ge_26 by simp
 
   have "real b / 2^16 = (real X * (1/ X)) * (real b / 2^16)"
     using X_ge_1 by simp
   also have "... = (real X * 2 powr (-log 2 X)) * (real b / 2^16)"
     using X_ge_1 by (subst powr_minus_divide) simp
   also have "... \<le> (real X * 2 powr (- \<lfloor>log 2 (real X)\<rfloor>)) * (2 powr b_exp / 2^16)"
     unfolding b_def using powr_realpow
     by (intro mult_mono powr_mono) auto
   also have "... = real X * (2 powr (- \<lfloor>log 2 (real X)\<rfloor>) * 2 powr(real b_exp-16))"
     by (subst powr_diff) simp
   also have "... = real X * 2 powr (- \<lfloor>log 2 (real X)\<rfloor> + (int b_exp - 16))"
     by (subst powr_add[symmetric]) simp
   also have "... = real X * 2 powr (-t\<^sub>m)"
     unfolding t\<^sub>m_def by (simp add:algebra_simps)
   finally have c:"real b / 2^16 \<le> real X * 2 powr (-t\<^sub>m)" by simp
 
   define T :: "nat set" where "T = {x. (real X / 2^x \<ge> real b / 2^16)}"
 
   have "x \<in> T \<longleftrightarrow> int x \<le> t\<^sub>m" for x
   proof -
     have "x \<in> T \<longleftrightarrow> 2^ x \<le> real X * 2^16 / b"
       using b_min by (simp add: field_simps T_def)
     also have "... \<longleftrightarrow> log 2 (2^x) \<le> log 2 (real X * 2^16 / b)"
       using X_ge_1 b_min by (intro log_le_cancel_iff[symmetric] divide_pos_pos) auto
     also have "... \<longleftrightarrow> x \<le> log 2 (real X * 2^16) - log 2 b"
       using X_ge_1 b_min by (subst log_divide) auto
     also have "... \<longleftrightarrow> x \<le> log 2 (real X) + log 2 (2 powr 16) - b_exp"
       unfolding b_def using X_ge_1 by (subst log_mult) auto
     also have "... \<longleftrightarrow> x \<le> \<lfloor>log 2 (real X) + log 2 (2 powr 16) - b_exp\<rfloor>"
       by linarith
     also have "... \<longleftrightarrow> x \<le> \<lfloor>log 2 (real X) + 16 - real_of_int (int b_exp)\<rfloor>"
       by (subst log_powr_cancel) auto
     also have "... \<longleftrightarrow> x \<le> t\<^sub>m"
       unfolding t\<^sub>m_def by linarith
     finally show ?thesis by simp
   qed
   hence T_eq: "T = {x. int x \<le> t\<^sub>m}" by auto
 
   have "T = {x. int x < t\<^sub>m+1}"
     unfolding T_eq by simp
   also have "... = {x. x < nat (t\<^sub>m + 1)}"
     unfolding zless_nat_eq_int_zless by simp
   finally have T_eq_2: "T = {x. x < nat (t\<^sub>m + 1)}"
     by simp
 
   have inj_1: "inj_on ((-) (nat t\<^sub>m)) T"
     unfolding T_eq by (intro inj_onI) simp
   have fin_T: "finite T"
     unfolding T_eq_2 by simp
 
   have r_exp: "(\<integral>\<omega>. real (r t \<omega>) \<partial>\<Psi>\<^sub>1) = real X / 2^t" if "t \<in> T" for t
   proof -
     have "t \<le> t\<^sub>m"
       using that unfolding T_eq by simp
     also have "... \<le> \<lfloor>log 2 (real X)\<rfloor> - 10"
       using t_m_bound by simp
     also have "... \<le> \<lfloor>log 2 (real X)\<rfloor>"
       by simp
     also have "... \<le> \<lfloor>log 2 (real n)\<rfloor>"
       using X_le_n X_ge_1 by (intro floor_mono log_mono) auto
     also have "... \<le> \<lceil>log 2 (real n)\<rceil>"
       by simp
     finally have "t \<le> \<lceil>log 2 (real n)\<rceil>" by simp
     hence "t \<le> max (nat \<lceil>log 2 (real n)\<rceil>) 1"by simp
     thus ?thesis
       unfolding r_exp by simp
   qed
 
   have r_var: "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r t \<omega>)) \<le> real X / 2^t" if "t \<in> T" for t
     using r_exp[OF that] r_var by metis
 
   have "9 = C\<^sub>4 / \<epsilon>\<^sup>2 * \<epsilon>^2/2^23"
     using \<epsilon>_gt_0 by (simp add:C\<^sub>4_def)
   also have "... = 2 powr (log 2 (C\<^sub>4 /  \<epsilon>\<^sup>2)) *  \<epsilon>^2/2^23"
     using \<epsilon>_gt_0 C\<^sub>4_def by (subst powr_log_cancel) auto
   also have "... \<le> 2 powr b_exp * \<epsilon>^2/2^23"
     unfolding b_exp_def
     by (intro divide_right_mono mult_right_mono powr_mono, linarith) auto
   also have "... = b * \<epsilon>^2/2^23"
     using powr_realpow unfolding b_def by simp
   also have "... = (b/2^16) * (\<epsilon>^2/2^7)"
     by simp
   also have "... \<le> (X * 2 powr (-t\<^sub>m)) * (\<epsilon>^2/2^7)"
     by (intro mult_mono c) auto
   also have "... = X * (2 powr (-t\<^sub>m) * 2 powr (-7)) * \<epsilon>^2"
     using powr_realpow by simp
   also have "... = 2 powr (-t\<^sub>m-7) * (\<epsilon>^2 * X)"
     by (subst powr_add[symmetric]) (simp )
   finally have "9 \<le> 2 powr (-t\<^sub>m-7) * (\<epsilon>^2 * X)" by simp
   hence b: "9/ (\<epsilon>^2 * X) \<le> 2 powr (-t\<^sub>m -7)"
     using \<epsilon>_gt_0 X_ge_1
     by (subst pos_divide_le_eq) auto
 
   have a: "measure \<Psi>\<^sub>1 {f.\<bar>real (r t f)-real X/2^t\<bar>> \<epsilon>/3 *real X/2^t} \<le> 2 powr (real t-t\<^sub>m-7)"
     (is"?L1 \<le> ?R1") if "t \<in> T" for t
   proof -
     have "?L1 \<le> \<P>(f in \<Psi>\<^sub>1. \<bar>real (r t f) - real X / 2^t\<bar> \<ge>  \<epsilon>/3 * real X / 2^t)"
       by (intro pmf_mono) auto
     also have "... = \<P>(f in \<Psi>\<^sub>1. \<bar>real (r t f)-(\<integral>\<omega>. real (r t \<omega>) \<partial> \<Psi>\<^sub>1)\<bar> \<ge> \<epsilon>/3 * real X/2^t)"
       by (simp add: r_exp[OF that])
     also have "... \<le> measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r t \<omega>)) / (\<epsilon>/3 * real X / 2^t)^2"
       using X_ge_1 \<epsilon>_gt_0 \<Psi>\<^sub>1.sample_space
       by (intro measure_pmf.Chebyshev_inequality divide_pos_pos mult_pos_pos) auto
     also have "... \<le> (X / 2^t) / (\<epsilon>/3 * X / 2^t)^2"
       by (intro divide_right_mono r_var[OF that]) simp
     also have "... = 2^t*(9/ ( \<epsilon>^2 * X))"
       by (simp add:power2_eq_square algebra_simps)
     also have "... \<le> 2^t*(2 powr (-t\<^sub>m-7))"
       by (intro mult_left_mono b) simp
     also have "... = 2 powr t * 2 powr (-t\<^sub>m-7)"
       by (subst powr_realpow[symmetric]) auto
     also have "... = ?R1"
       by (subst powr_add[symmetric]) (simp add:algebra_simps)
     finally show "?L1 \<le> ?R1" by simp
   qed
 
   have "\<exists>y<nat (t\<^sub>m + 1). x = nat t\<^sub>m - y" if "x < nat (t\<^sub>m+1)" for x
     using that by (intro exI[where x="nat t\<^sub>m - x"]) simp
   hence T_reindex: "(-) (nat t\<^sub>m) ` {x. x < nat (t\<^sub>m + 1)} = {..<nat (t\<^sub>m + 1)}"
     by (auto simp add: set_eq_iff image_iff)
 
   have "?L \<le> measure \<Psi> {\<psi>. (\<exists>t \<in> T. \<bar>real (r t (fst \<psi>))-real X/2^t\<bar> > \<epsilon>/3 * real X / 2^t)}"
   proof (rule pmf_mono)
     fix \<psi>
     assume "\<psi> \<in> set_pmf (sample_pmf \<Psi>)"
     obtain f g h where \<psi>_def: "\<psi> = (f,g,h)" by (metis prod_cases3)
     assume "\<psi> \<in> {\<psi>. E\<^sub>1 \<psi> \<and> \<not> E\<^sub>2 \<psi>}"
     hence a:"2 powr ( -real_of_int (t f)) * real X \<in> {real b/2^16..real b/2}" and
       b:"\<bar>card (R f) - real X / 2^(s f)\<bar> >  \<epsilon>/3 * X / 2^(s f)"
       unfolding E\<^sub>1_def E\<^sub>2_def by (auto simp add:\<psi>_def)
     have "\<bar>card (R f) - X / 2^(s f)\<bar> = 0" if "s f= 0"
       using that by (simp add:R_def X_def)
     moreover have "( \<epsilon>/3) * (X / 2^s f) \<ge> 0"
       using \<epsilon>_gt_0 X_ge_1 by (intro mult_nonneg_nonneg) auto
     ultimately have "False" if "s f = 0"
       using b that by simp
     hence "s f > 0" by auto
     hence "t f = s f" unfolding s_def by simp
     hence "2 powr (-real (s f)) * X \<ge> b / 2^16"
       using a by simp
     hence "X / 2 powr (real (s f)) \<ge> b / 2^16"
       by (simp add: divide_powr_uminus mult.commute)
     hence "real X / 2 ^ (s f) \<ge> b / 2^16"
       by (subst (asm) powr_realpow, auto)
     hence "s f \<in> T" unfolding T_def by simp
     moreover have "\<bar>r (s f) f - X / 2^s f\<bar> >  \<epsilon>/3 * X / 2^s f"
       using R_def r_def b by simp
     ultimately have "\<exists>t \<in> T. \<bar>r t (fst \<psi>) - X / 2^t\<bar> >  \<epsilon>/3 * X / 2^t"
       using \<psi>_def by (intro bexI[where x="s f"]) simp
     thus "\<psi> \<in> {\<psi>. (\<exists>t \<in> T. \<bar>r t (fst \<psi>) - X / 2^t\<bar> >  \<epsilon>/3 * X / 2^t)}" by simp
   qed
   also have "... = measure \<Psi>\<^sub>1 {f. (\<exists>t \<in> T. \<bar>real (r t f)-real X / 2^t\<bar> > \<epsilon>/3 * real X/2^t)}"
     unfolding sample_pmf_\<Psi> by (intro pair_pmf_prob_left)
   also have "... = measure \<Psi>\<^sub>1 (\<Union>t \<in> T. {f. \<bar>real (r t f)-real X / 2^t\<bar> > \<epsilon>/3 * real X/2^t})"
     by (intro measure_pmf_cong) auto
   also have "... \<le> (\<Sum>t \<in> T. measure \<Psi>\<^sub>1 {f.\<bar>real (r t f)-real X / 2^t\<bar> > \<epsilon>/3 * real X/2^t})"
     by (intro measure_UNION_le fin_T) (simp)
   also have "... \<le> (\<Sum>t \<in> T.  2 powr (real t - of_int t\<^sub>m - 7))"
     by (intro sum_mono a)
   also have "... = (\<Sum>t \<in> T.  2 powr (-int (nat t\<^sub>m-t) - 7))"
     unfolding T_eq
     by (intro sum.cong refl arg_cong2[where f="(powr)"]) simp
   also have "... = (\<Sum>x \<in> (\<lambda>x. nat t\<^sub>m - x) ` T. 2 powr (-real x - 7))"
     by (subst sum.reindex[OF inj_1]) simp
   also have "... = (\<Sum>x \<in> (\<lambda>x. nat t\<^sub>m - x) ` T. 2 powr (-7) * 2 powr (-real x))"
     by (subst powr_add[symmetric]) (simp add:algebra_simps)
   also have "... = 1/2^7 * (\<Sum>x \<in> (\<lambda>x. nat t\<^sub>m - x) ` T. 2 powr (-real x))"
     by (subst sum_distrib_left) simp
   also have "... = 1/2^7 * (\<Sum>x <nat (t\<^sub>m+1). 2 powr (-real x))"
     unfolding T_eq_2 T_reindex
     by (intro arg_cong2[where f="(*)"] sum.cong) auto
   also have "... = 1/2^7 * (\<Sum>x <nat (t\<^sub>m+1). (2 powr (-1)) powr (real x))"
     by (subst powr_powr) simp
   also have "... = 1/2^7 * (\<Sum>x <nat (t\<^sub>m+1). (1/2)^x)"
     using powr_realpow by simp
   also have "... \<le> 1/2^7 * 2"
     by(subst geometric_sum) auto
   also have "... = 1/2^6" by simp
   finally show ?thesis by simp
 qed
 
 definition E\<^sub>3 where "E\<^sub>3 = (\<lambda>(f,g,h). inj_on g (R f))"
 
 lemma R_bound:
   fixes f g h
   assumes "E\<^sub>1 (f,g,h)"
   assumes "E\<^sub>2 (f,g,h)"
   shows "card (R f) \<le> 2/3 * b"
 proof -
   have "real (card (R f)) \<le> ( \<epsilon> / 3) * (real X / 2 ^ s f) + real X / 2 ^ s f"
     using assms(2) unfolding E\<^sub>2_def by simp
   also have "... \<le> (1/3) * (real X / 2 ^ s f) + real X / 2 ^ s f"
     using \<epsilon>_lt_1 by (intro add_mono mult_right_mono) auto
   also have "... = (4/3) * (real X / 2 powr s f)"
     using powr_realpow by simp
   also have "... \<le> (4/3) * (real X / 2 powr t f)"
     unfolding s_def
     by (intro mult_left_mono divide_left_mono powr_mono) auto
   also have "... = (4/3) * (2 powr (-(of_int (t f))) * real X)"
     by (subst powr_minus_divide) simp
   also have "... = (4/3) * (2 powr (- t f) * real X)"
     by simp
   also have "... \<le> (4/3) * (b/2)"
     using assms(1) unfolding E\<^sub>1_def
     by (intro mult_left_mono) auto
   also have "... \<le> (2/3) * b" by simp
   finally show ?thesis by simp
 qed
 
 lemma e_3: "measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> \<not>E\<^sub>3 \<psi>} \<le> 1/2^6" (is "?L \<le> ?R")
 proof -
   let ?\<alpha> = "(\<lambda>(z,x,y) f. z < C\<^sub>7*b^2 \<and> x \<in> R f \<and> y \<in> R f \<and> x < y)"
   let ?\<beta> = "(\<lambda>(z,x,y) g. g x = z \<and> g y = z)"
 
   have \<beta>_prob: "measure \<Psi>\<^sub>2 {g. ?\<beta> \<omega> g} \<le> (1/real (C\<^sub>7*b^2)^2)"
     if "?\<alpha> \<omega> f" for \<omega> f
   proof -
     obtain x y z where \<omega>_def: "\<omega> = (z,x,y)" by (metis prod_cases3)
     have a:"prob_space.k_wise_indep_vars \<Psi>\<^sub>2 2 (\<lambda>i. discrete) (\<lambda>x \<omega>. \<omega> x = z) {..<n}"
       by (intro prob_space.k_wise_indep_vars_compose[OF _ \<Psi>\<^sub>2.indep])
        (simp_all add:prob_space_measure_pmf)
 
     have "u \<in> R f \<Longrightarrow> u < n" for u
       unfolding R_def using A_range by auto
     hence b: "x < n" "y < n" "card {x, y} = 2"
       using that \<omega>_def by auto
     have c: "z < C\<^sub>7*b\<^sup>2" using \<omega>_def that by simp
 
     have "measure \<Psi>\<^sub>2 {g. ?\<beta> \<omega> g} = measure \<Psi>\<^sub>2 {g. (\<forall>\<xi> \<in> {x,y}. g \<xi> = z)}"
       by (simp add:\<omega>_def)
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure \<Psi>\<^sub>2 {g. g \<xi> = z})"
       using b by (intro measure_pmf.split_indep_events[OF refl, where I="{x,y}"]
           prob_space.k_wise_indep_vars_subset[OF _ a]) (simp_all add:prob_space_measure_pmf)
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure (map_pmf (\<lambda>\<omega>. \<omega> \<xi>) (sample_pmf \<Psi>\<^sub>2)) {g. g = z}) "
       by (simp add:vimage_def)
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure [C\<^sub>7 * b\<^sup>2]\<^sub>S {g. g=z})"
       using b \<Psi>\<^sub>2.single by (intro prod.cong) fastforce+
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure (pmf_of_set {..<C\<^sub>7 * b\<^sup>2}) {z})"
       by (subst nat_sample_pmf) simp
     also have "... = (measure (pmf_of_set {..<C\<^sub>7 * b\<^sup>2}) {z})^2"
       using b by simp
     also have "... \<le> (1 /(C\<^sub>7*b\<^sup>2))^2"
       using c by (subst measure_pmf_of_set) auto
     also have "... = (1 /(C\<^sub>7*b\<^sup>2)^2)"
       by (simp add:algebra_simps power2_eq_square)
     finally show ?thesis by simp
   qed
 
   have \<alpha>_card: "card {\<omega>. ?\<alpha> \<omega> f} \<le> (C\<^sub>7*b^2) * (card (R f) * (card (R f)-1)/2)"
     (is "?TL \<le> ?TR") and fin_\<alpha>: "finite {\<omega>. ?\<alpha> \<omega> f}" (is "?T2") for f
   proof -
     have t1: "{\<omega>. ?\<alpha> \<omega> f} \<subseteq> {..<C\<^sub>7*b^2} \<times> {(x,y) \<in> R f \<times> R f. x < y}"
       by (intro subsetI) auto
     moreover have "card ({..<C\<^sub>7*b^2} \<times> {(x,y) \<in> R f \<times> R f. x < y}) = ?TR"
       using  card_ordered_pairs'[where M="R f"]
       by (simp add: card_cartesian_product)
     moreover have "finite (R f)"
       unfolding R_def using fin_A finite_subset by simp
     hence "finite {(x, y). (x, y) \<in> R f \<times> R f \<and> x < y}"
       by (intro finite_subset[where B="R f \<times> R f", OF _ finite_cartesian_product]) auto
     hence t2: "finite ({..<C\<^sub>7*b^2} \<times> {(x,y) \<in> R f \<times> R f. x < y})"
       by (intro finite_cartesian_product) auto
     ultimately show "?TL \<le> ?TR"
       using card_mono of_nat_le_iff by (metis (no_types, lifting))
     show ?T2
       using finite_subset[OF t1 t2] by simp
   qed
 
   have "?L \<le> measure \<Psi> {(f,g,h). card (R f) \<le> b \<and> (\<exists> x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)}"
   proof (rule pmf_mono)
     fix \<psi> assume b:"\<psi> \<in> set_pmf (sample_pmf \<Psi>)"
     obtain f g h where \<psi>_def:"\<psi> = (f,g,h)" by (metis prod_cases3)
     have "(f,g,h) \<in> sample_set \<Psi>"
       using sample_space_alt[OF sample_space_\<Psi>] b \<psi>_def by simp
     hence c:"g x < C\<^sub>7*b^2" for x
       using g_range by simp
 
     assume a:"\<psi> \<in> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> \<not> E\<^sub>3 \<psi>}"
     hence "card (R f) \<le> 2/3 * b"
       using R_bound \<psi>_def by force
     moreover have "\<exists>a b. a \<in> R f \<and> b \<in> R f \<and> a \<noteq> b \<and> g a = g b"
       using a unfolding \<psi>_def E\<^sub>3_def inj_on_def by auto
     hence "\<exists>x y. x \<in> R f \<and> y \<in> R f \<and> x < y \<and> g x = g y"
       by (metis not_less_iff_gr_or_eq)
     hence "\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g"
       using c by blast
     ultimately show "\<psi> \<in> {(f, g, h). card (R f) \<le> b \<and> (\<exists> x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)}"
       unfolding \<psi>_def by auto
   qed
   also have "... = (\<integral>f. measure (pair_pmf \<Psi>\<^sub>2 \<Psi>\<^sub>3)
      {g. card (R f) \<le> b \<and> (\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) (fst g))} \<partial>\<Psi>\<^sub>1)"
     unfolding sample_pmf_\<Psi> split_pair_pmf by (simp add: case_prod_beta)
   also have
     "... = (\<integral>f. measure \<Psi>\<^sub>2 {g. card (R f) \<le> b \<and> (\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)} \<partial>\<Psi>\<^sub>1)"
     by (subst pair_pmf_prob_left) simp
   also have "... \<le> (\<integral>f. 1/real (2*C\<^sub>7) \<partial>\<Psi>\<^sub>1)"
   proof (rule pmf_exp_mono[OF integrable_sample_pmf[OF \<Psi>\<^sub>1.sample_space]
           integrable_sample_pmf[OF \<Psi>\<^sub>1.sample_space]])
     fix f assume "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)"
     show "measure \<Psi>\<^sub>2 {g. card (R f) \<le> b \<and> (\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)} \<le> 1 / real (2 * C\<^sub>7)"
       (is "?L1 \<le> ?R1")
     proof (cases "card (R f) \<le> b")
       case True
       have "?L1 \<le> measure \<Psi>\<^sub>2 (\<Union> \<omega> \<in> {\<omega>. ?\<alpha> \<omega> f}. {g. ?\<beta> \<omega> g})"
         by (intro pmf_mono) auto
       also have "... \<le> (\<Sum>\<omega> \<in> {\<omega>. ?\<alpha> \<omega> f}. measure \<Psi>\<^sub>2 {g. ?\<beta> \<omega> g})"
         by (intro measure_UNION_le fin_\<alpha>) auto
       also have "... \<le> (\<Sum>\<omega> \<in> {\<omega>. ?\<alpha> \<omega> f}. (1/real (C\<^sub>7*b^2)^2))"
         by (intro sum_mono \<beta>_prob) auto
       also have "... = card {\<omega>. ?\<alpha> \<omega> f} /(C\<^sub>7*b^2)^2"
         by simp
       also have "... \<le> (C\<^sub>7*b^2) * (card (R f) * (card (R f)-1)/2) / (C\<^sub>7*b^2)^2"
         by (intro \<alpha>_card divide_right_mono) simp
       also have "... \<le> (C\<^sub>7*b^2) * (b * b / 2)  / (C\<^sub>7*b^2)^2"
         unfolding C\<^sub>7_def using True
         by (intro divide_right_mono Nat.of_nat_mono mult_mono) auto
       also have "... = 1/(2*C\<^sub>7)"
         using b_min by (simp add:algebra_simps power2_eq_square)
       finally show ?thesis by simp
     next
       case False
       then show ?thesis by simp
     qed
   qed
   also have "... \<le> 1/2^6"
     unfolding C\<^sub>7_def by simp
   finally show ?thesis by simp
 qed
 
 definition E\<^sub>4 where "E\<^sub>4 = (\<lambda>(f,g,h). \<bar>p (f,g,h) - \<rho> (card (R f))\<bar> \<le>  \<epsilon>/12 * card (R f))"
 
 lemma e_4_h: "9 / sqrt b \<le> \<epsilon> / 12"
 proof -
   have "108 \<le> sqrt (C\<^sub>4)"
     unfolding C\<^sub>4_def by (approximation 5)
   also have "... \<le> sqrt( \<epsilon>^2 * real b)"
     using b_lower_bound \<epsilon>_gt_0
     by (intro real_sqrt_le_mono) (simp add: pos_divide_le_eq algebra_simps)
   also have "... =  \<epsilon> * sqrt b"
     using \<epsilon>_gt_0 by (simp add:real_sqrt_mult)
   finally have "108 \<le>  \<epsilon> * sqrt b"  by simp
   thus ?thesis
     using b_min by (simp add:pos_divide_le_eq)
 qed
 
 lemma e_4: "measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> E\<^sub>3 \<psi> \<and> \<not>E\<^sub>4 \<psi>} \<le> 1/2^6" (is "?L \<le> ?R")
 proof -
   have a: "measure \<Psi>\<^sub>3 {h. E\<^sub>1 (f,g,h) \<and> E\<^sub>2 (f,g,h) \<and> E\<^sub>3 (f,g,h) \<and> \<not>E\<^sub>4 (f,g,h)} \<le> 1/2^6"
     (is "?L1 \<le> ?R1") if "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)" "g \<in> set_pmf(sample_pmf \<Psi>\<^sub>2)"
     for f g
   proof (cases "card (R f) \<le> b \<and> inj_on g (R f)")
     case True
 
     have g_inj: "inj_on g (R f)"
       using True by simp
 
     have fin_R: "finite (g ` R f)"
       unfolding R_def using fin_A
       by (intro finite_imageI) simp
 
     interpret B:balls_and_bins_abs "g ` R f" "{..<b}"
       using fin_R b_ne by unfold_locales auto
 
     have "range g \<subseteq> {..<C\<^sub>7 * b\<^sup>2}"
       using g_range_1 that(2) unfolding sample_space_alt[OF \<Psi>\<^sub>2.sample_space] by auto
     hence g_ran: "g ` R f \<subseteq> {..<C\<^sub>7 * b\<^sup>2}"
       by auto
 
     have "sample_pmf [b]\<^sub>S = pmf_of_set {..<b}"
       unfolding sample_pmf_def nat_sample_space_def by simp
     hence " map_pmf (\<lambda>\<omega>. \<omega> x) (sample_pmf (\<H> k (C\<^sub>7 * b\<^sup>2) [b]\<^sub>S)) = pmf_of_set {..<b}"
       if "x \<in> g ` R f" for x
       using g_ran \<Psi>\<^sub>3.single that by auto
     moreover have "prob_space.k_wise_indep_vars \<Psi>\<^sub>3 k (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) (g ` R f)"
       by (intro prob_space.k_wise_indep_subset[OF _ _ \<Psi>\<^sub>3.indep] g_ran prob_space_measure_pmf)
     ultimately have lim_balls_and_bins: "B.lim_balls_and_bins k (sample_pmf (\<H> k (C\<^sub>7 * b\<^sup>2) [b]\<^sub>S))"
       unfolding B.lim_balls_and_bins_def by auto
 
     have card_g_R: "card (g ` R f) = card (R f)"
       using True card_image by auto
     hence b_mu: "\<rho> (card (R f)) = B.\<mu>"
       unfolding B.\<mu>_def \<rho>_def using b_min by (simp add:powr_realpow)
 
     have card_g_le_b: "card (g ` R f) \<le> card {..<b}"
       unfolding card_g_R using True by simp
 
     have "?L1 \<le> measure \<Psi>\<^sub>3 {h. \<bar>B.Y h - B.\<mu>\<bar> > 9 * real (card (g ` R f)) / sqrt (card {..<b})}"
     proof (rule pmf_mono)
       fix h assume "h \<in> {h. E\<^sub>1 (f,g,h) \<and> E\<^sub>2 (f,g,h) \<and> E\<^sub>3 (f,g,h) \<and> \<not>E\<^sub>4 (f,g,h)}"
       hence b: "\<bar>p (f,g,h) -\<rho> (card (R f))\<bar> >  \<epsilon>/12 * card (R f)"
         unfolding E\<^sub>4_def by simp
       assume "h \<in> set_pmf (sample_pmf \<Psi>\<^sub>3)"
       hence h_range: "h x < b" for x
         unfolding sample_space_alt[OF \<Psi>\<^sub>3.sample_space,symmetric] using h_range_1 by simp
 
       have "{j \<in> {..<b}. int (s f) \<le> \<tau>\<^sub>1 (f, g, h) A 0 j} =
         {j \<in> {..<b}. int (s f) \<le> max (Max ({int (f a) |a. a \<in> A \<and> h (g a) = j} \<union> {-1})) (- 1)}"
         unfolding \<tau>\<^sub>1_def by simp
       also have "... = {j \<in> {..<b}. int (s f) \<le> Max ({int (f a) |a. a \<in> A \<and> h (g a) = j} \<union> {-1})}"
         using fin_A by (subst max_absorb1) (auto intro: Max_ge)
       also have "... = {j \<in> {..<b}. (\<exists>a \<in> R f. h (g a) = j)}"
         unfolding R_def using fin_A by (subst Max_ge_iff) auto
       also have "... = {j. \<exists>a \<in> R f. h (g a) = j}"
         using h_range by auto
       also have "... = (h \<circ> g) ` (R f)"
         by (auto simp add:set_eq_iff image_iff)
       also have "... = h ` (g ` (R f))"
         by (simp add:image_image)
       finally have c:"{j \<in> {..<b}. int (s f) \<le> \<tau>\<^sub>1 (f, g, h) A 0 j} = h ` (g ` R f)"
         by simp
       have "9 * real (card (g ` R f)) / sqrt (card {..<b}) = 9/ sqrt b * real (card (R f))"
         using card_image[OF g_inj] by simp
       also have "... \<le>  \<epsilon>/12 * card (R f)"
         by (intro mult_right_mono e_4_h) simp
       also have "... < \<bar>B.Y h - B.\<mu>\<bar>"
         using b c unfolding B.Y_def p_def b_mu by simp
       finally show "h \<in> {h. \<bar>B.Y h - B.\<mu>\<bar> >  9 * real (card (g ` R f)) / sqrt (card {..<b})}"
         by simp
     qed
     also have "... \<le> 1/2^6"
       using k_min
       by (intro B.devitation_bound[OF card_g_le_b lim_balls_and_bins]) auto
     finally show ?thesis by simp
   next
     case False
     have "?L1 \<le> measure \<Psi>\<^sub>3 {}"
     proof (rule pmf_mono)
       fix h assume b:"h \<in> {h. E\<^sub>1 (f, g, h) \<and> E\<^sub>2 (f, g, h) \<and> E\<^sub>3 (f, g, h) \<and> \<not> E\<^sub>4 (f, g, h)}"
       hence "card (R f) \<le> (2/3)*b"
         by (auto intro!: R_bound[simplified])
       hence "card (R f) \<le> b"
         by simp
       moreover have "inj_on g (R f)"
         using b by (simp add:E\<^sub>3_def)
       ultimately have "False" using False by simp
       thus "h \<in> {}" by simp
     qed
     also have "... = 0" by simp
     finally show ?thesis by simp
   qed
 
   have "?L = (\<integral>f. (\<integral>g.
     measure \<Psi>\<^sub>3 {h. E\<^sub>1 (f,g,h) \<and> E\<^sub>2 (f,g,h) \<and> E\<^sub>3 (f,g,h) \<and> \<not>E\<^sub>4 (f,g,h)} \<partial>\<Psi>\<^sub>2) \<partial>\<Psi>\<^sub>1)"
     unfolding sample_pmf_\<Psi> split_pair_pmf by simp
   also have "... \<le> (\<integral>f. (\<integral>g.  1/2^6  \<partial>\<Psi>\<^sub>2) \<partial>\<Psi>\<^sub>1)"
     using a \<Psi>\<^sub>1.sample_space \<Psi>\<^sub>2.sample_space
     by (intro integral_mono_AE AE_pmfI) simp_all
   also have "... = 1/2^6"
     by simp
   finally show ?thesis by simp
 qed
 
 lemma \<rho>_inverse: "\<rho>_inv (\<rho> x) = x"
 proof -
   have a:"1-1/b \<noteq> 0"
     using b_min by simp
 
   have "\<rho> x = b * (1-(1-1/b) powr x)"
     unfolding \<rho>_def by simp
   hence "\<rho> x / real b = 1-(1-1/b) powr x" by simp
   hence "ln (1 - \<rho> x / real b) = ln ((1-1/b) powr x)" by simp
   also have "... = x * ln (1 - 1/ b)"
     using a by (intro ln_powr)
   finally have "ln (1 - \<rho> x / real b) = x * ln (1- 1/ b)"
     by simp
   moreover have "ln (1-1/b) < 0"
     using b_min by (subst ln_less_zero_iff) auto
   ultimately show ?thesis
     using \<rho>_inv_def by simp
 qed
 
 lemma rho_mono:
   assumes "x \<le> y"
   shows "\<rho> x \<le> \<rho> y"
 proof-
   have "(1 - 1 / real b) powr y \<le> (1 - 1 / real b) powr x"
     using b_min
     by (intro powr_mono_rev assms) auto
   thus ?thesis
     unfolding \<rho>_def by (intro mult_left_mono) auto
 qed
 
 lemma rho_two_thirds: "\<rho> (2/3 * b) \<le> 3/5 *b"
 proof -
   have "1/3 \<le> exp ( - 13 / 12::real )"
     by (approximation 8)
   also have "... \<le> exp ( - 1 - 2 / real b )"
     using b_min by (intro iffD2[OF exp_le_cancel_iff]) (simp add:algebra_simps)
   also have "... \<le> exp ( b * (-(1/real b)-2*(1/real b)^2))"
     using b_min by (simp add:algebra_simps power2_eq_square)
   also have  "... \<le> exp ( b * ln (1-1/real b))"
     using b_min
     by (intro iffD2[OF exp_le_cancel_iff] mult_left_mono ln_one_minus_pos_lower_bound) auto
   also have "... = exp ( ln ( (1-1/real b) powr b))"
     using b_min by (subst ln_powr) auto
   also have "... = (1-1/real b) powr b"
     using b_min by (subst exp_ln) auto
   finally have a:"1/3 \<le> (1-1/real b) powr b" by simp
 
   have "2/5 \<le> (1/3) powr (2/3::real)"
     by (approximation 5)
   also have "... \<le> ((1-1/real b) powr b) powr (2/3)"
     by (intro powr_mono2 a) auto
   also have "... = (1-1/real b) powr (2/3 * real b)"
     by (subst powr_powr) (simp add:algebra_simps)
   finally have "2/5 \<le> (1 - 1 / real b) powr (2 / 3 * real b)" by simp
   hence "1 - (1 - 1 / real b) powr (2 / 3 * real b) \<le> 3/5"
     by simp
   hence "\<rho> (2/3 * b) \<le> b * (3/5)"
     unfolding \<rho>_def by (intro mult_left_mono) auto
   thus ?thesis
     by simp
 qed
 
 definition \<rho>_inv' :: "real \<Rightarrow> real"
   where "\<rho>_inv' x = -1 / (real b * (1-x / real b) * ln (1 - 1 / real b))"
 
 lemma \<rho>_inv'_bound:
   assumes "x \<ge> 0"
   assumes "x \<le> 59/90*b"
   shows "\<bar>\<rho>_inv' x\<bar> \<le> 4"
 proof -
   have c:"ln (1 - 1 / real b) < 0"
     using b_min
     by (subst ln_less_zero_iff) auto
   hence d:"real b * (1 - x / real b) * ln (1 - 1 / real b) < 0"
     using b_min assms by (intro Rings.mult_pos_neg) auto
 
   have "(1::real) \<le> 31/30" by simp
   also have "... \<le> (31/30) * (b * -(- 1 / real b))"
     using b_min by simp
   also have "... \<le> (31/30) * (b * -ln (1 + (- 1 / real b)))"
     using b_min
     by (intro mult_left_mono le_imp_neg_le  ln_add_one_self_le_self2) auto
   also have "... \<le> 3 * (31/90) * (- b * ln (1 - 1 / real b))"
     by simp
   also have "... \<le> 3 * (1 - x / real b) * (- b * ln (1 - 1 / real b))"
     using assms b_min pos_divide_le_eq[where c="b"] c
     by (intro mult_right_mono mult_left_mono mult_nonpos_nonpos) auto
   also have "... \<le> 3 * (real b * (1 - x / real b) * (-ln (1 - 1 / real b)))"
     by (simp add:algebra_simps)
   finally have "3 * (real b * (1 - x / real b) * (-ln (1 - 1 / real b))) \<ge> 1" by simp
   hence "3 * (real b * (1 - x / real b) * ln (1 - 1 / real b)) \<le> -1" by simp
   hence "\<rho>_inv' x \<le> 3"
     unfolding \<rho>_inv'_def using d
     by (subst neg_divide_le_eq) auto
   moreover have "\<rho>_inv' x > 0"
     unfolding \<rho>_inv'_def using d by (intro divide_neg_neg) auto
   ultimately show ?thesis by simp
 qed
 
 lemma \<rho>_inv':
   fixes x :: real
   assumes "x < b"
   shows "DERIV \<rho>_inv x :> \<rho>_inv' x"
 proof -
   have "DERIV (ln \<circ> (\<lambda>x. (1 - x / real b))) x :> 1 / (1-x / real b) * (0 -1/b)"
     using assms b_min
     by (intro DERIV_chain DERIV_ln_divide DERIV_cdivide derivative_intros) auto
   hence "DERIV \<rho>_inv x :> (1 / (1-x / real b) * (-1/b)) / ln (1-1/real b)"
     unfolding comp_def \<rho>_inv_def by (intro DERIV_cdivide) auto
   thus ?thesis
     by (simp add:\<rho>_inv'_def algebra_simps)
 qed
 
 lemma accuracy_without_cutoff:
   "measure \<Psi> {(f,g,h). \<bar>Y (f,g,h) - real X\<bar> > \<epsilon> * X \<or> s f < q_max} \<le> 1/2^4"
   (is "?L \<le> ?R")
 proof -
   have "?L \<le> measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi> \<or>  \<not>E\<^sub>2 \<psi> \<or>  \<not>E\<^sub>3 \<psi> \<or>  \<not>E\<^sub>4 \<psi>}"
   proof (rule pmf_rev_mono)
     fix \<psi> assume "\<psi> \<in> set_pmf (sample_pmf \<Psi>)"
     obtain f g h where \<psi>_def: "\<psi> = (f,g,h)" by (metis prod_cases3)
 
     assume "\<psi> \<notin> {\<psi>. \<not> E\<^sub>1 \<psi> \<or> \<not> E\<^sub>2 \<psi> \<or> \<not> E\<^sub>3 \<psi> \<or> \<not> E\<^sub>4 \<psi>}"
     hence assms: "E\<^sub>1 (f,g,h)" "E\<^sub>2 (f,g,h)" "E\<^sub>3 (f,g,h)" "E\<^sub>4 (f,g,h)"
       unfolding \<psi>_def by auto
 
     define I :: "real set" where "I = {0..59/90*b}"
 
     have "p (f,g,h) \<le> \<rho> (card (R f)) + \<epsilon>/12 * card (R f)"
       using assms(4) E\<^sub>4_def unfolding abs_le_iff by simp
     also have "... \<le> \<rho>(2/3*b) + 1/12* (2/3*b)"
       using \<epsilon>_lt_1 R_bound[OF assms(1,2)]
       by (intro add_mono rho_mono mult_mono) auto
     also have "... \<le> 3/5 * b + 1/18*b"
       by (intro add_mono rho_two_thirds) auto
     also have "... \<le> 59/90 * b"
        by simp
     finally have "p (f,g,h) \<le> 59/90 * b" by simp
     hence p_in_I: "p (f,g,h) \<in> I"
       unfolding I_def by simp
 
     have "\<rho> (card (R f)) \<le> \<rho>(2/3 * b)"
       using  R_bound[OF assms(1,2)]
       by (intro rho_mono) auto
     also have "... \<le> 3/5 * b"
       using rho_two_thirds by simp
     also have "... \<le> b * 59/90" by simp
     finally have "\<rho> (card (R f)) \<le> b * 59/90" by simp
     moreover have "(1 - 1 / real b) powr (real (card (R f))) \<le> 1 powr (real (card (R f)))"
       using b_min by (intro powr_mono2) auto
     hence "\<rho> (card (R f)) \<ge> 0"
       unfolding \<rho>_def by (intro mult_nonneg_nonneg) auto
     ultimately have "\<rho> (card (R f)) \<in> I"
       unfolding I_def by simp
 
     moreover have "interval I"
       unfolding I_def interval_def by simp
     moreover have "59 / 90 * b < b"
       using b_min by simp
     hence "DERIV \<rho>_inv x :> \<rho>_inv' x" if "x \<in> I" for x
       using that I_def by (intro \<rho>_inv') simp
     ultimately obtain \<xi> :: real where \<xi>_def: "\<xi> \<in> I"
       "\<rho>_inv (p(f,g,h)) - \<rho>_inv (\<rho> (card (R f))) = (p (f,g,h) - \<rho>(card (R f))) * \<rho>_inv' \<xi>"
       using p_in_I MVT_interval by blast
 
     have "\<bar>\<rho>_inv(p (f,g,h)) - card (R f)\<bar> = \<bar>\<rho>_inv(p (f,g,h)) - \<rho>_inv(\<rho>(card (R f)))\<bar>"
       by (subst \<rho>_inverse) simp
     also have "... = \<bar>(p (f,g,h) - \<rho> (card (R f)))\<bar> * \<bar>\<rho>_inv' \<xi> \<bar>"
       using \<xi>_def(2) abs_mult by simp
     also have "... \<le> \<bar>p (f,g,h) - \<rho> (card (R f))\<bar> * 4"
       using \<xi>_def(1) I_def
       by (intro mult_left_mono \<rho>_inv'_bound) auto
     also have "... \<le> ( \<epsilon>/12 * card (R f)) * 4"
       using assms(4) E\<^sub>4_def by (intro mult_right_mono) auto
     also have "... = \<epsilon>/3 * card (R f)" by simp
     finally have b: "\<bar>\<rho>_inv(p (f,g,h)) - card (R f)\<bar> \<le> \<epsilon>/3 * card (R f)"  by simp
 
     have "\<bar>\<rho>_inv(p (f,g,h)) - X / 2 ^ (s f)\<bar> \<le>
       \<bar>\<rho>_inv(p (f,g,h)) - card (R f)\<bar> + \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       by simp
     also have "... \<le> \<epsilon>/3 * card (R f) + \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       by (intro add_mono b) auto
     also have "... =  \<epsilon>/3 * \<bar>X / 2 ^ (s f) + (card (R f) - X / 2 ^ (s f))\<bar> +
       \<bar>card (R f) - X / 2 ^ (s f)\<bar>" by simp
     also have "... \<le>  \<epsilon>/3 * (\<bar>X / 2 ^ (s f)\<bar> + \<bar>card (R f) - X / 2 ^ (s f)\<bar>) +
       \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       using \<epsilon>_gt_0 by (intro mult_left_mono add_mono abs_triangle_ineq) auto
     also have "... \<le>  \<epsilon>/3 * \<bar>X / 2 ^ (s f)\<bar> + (1+  \<epsilon>/3) * \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       using \<epsilon>_gt_0 \<epsilon>_lt_1 by (simp add:algebra_simps)
     also have "... \<le>  \<epsilon>/3 * \<bar>X / 2 ^ s f\<bar> + (4/3) * ( \<epsilon> / 3 * real X / 2 ^ s f)"
       using assms(2) \<epsilon>_gt_0 \<epsilon>_lt_1
       unfolding E\<^sub>2_def by (intro add_mono mult_mono) auto
     also have "... = (7/9) * \<epsilon> * real X / 2^s f"
       using X_ge_1 by (subst abs_of_nonneg) auto
     also have "... \<le> 1 * \<epsilon> * real X / 2^s f"
       using \<epsilon>_gt_0 by (intro mult_mono divide_right_mono) auto
     also have "... =  \<epsilon> * real X / 2^s f" by simp
     finally have a:"\<bar>\<rho>_inv(p (f,g,h)) - X / 2 ^ (s f)\<bar> \<le> \<epsilon> * X / 2 ^ (s f)"
       by simp
 
     have "\<bar>Y (f, g, h) - real X\<bar> = \<bar>2 ^ (s f)\<bar> * \<bar>\<rho>_inv(p (f,g,h)) - real X / 2 ^ (s f)\<bar>"
       unfolding Y_def by (subst abs_mult[symmetric]) (simp add:algebra_simps powr_add[symmetric])
     also have "... \<le> 2 ^ (s f) * (\<epsilon> * X / 2 ^ (s f))"
       by (intro mult_mono a) auto
     also have "... = \<epsilon> * X"
       by (simp add:algebra_simps powr_add[symmetric])
     finally have "\<bar>Y (f, g, h) - real X\<bar> \<le> \<epsilon> * X" by simp
     moreover have "2 powr (\<lceil>log 2 (real X)\<rceil> - t f) \<le> 2 powr b_exp" (is "?L1 \<le> ?R1")
     proof -
       have "?L1 \<le> 2 powr (1 + log 2 (real X)- t f)"
         by (intro powr_mono, linarith) auto
       also have "... = 2 powr 1 * 2 powr (log 2 (real X)) * 2 powr (- t f)"
         unfolding powr_add[symmetric] by simp
       also have "... = 2 * (2 powr (-t f) * X)"
         using X_ge_1 by simp
       also have "... \<le> 2 * (b/2)"
         using assms(1) unfolding E\<^sub>1_def by (intro mult_left_mono) auto
       also have "... = b" by simp
       also have "... = ?R1"
         unfolding b_def by (simp add: powr_realpow)
       finally show ?thesis by simp
     qed
     hence "\<lceil>log 2 (real X)\<rceil> - t f \<le> real b_exp"
       unfolding not_less[symmetric] using powr_less_mono[where x="2"] by simp
     hence "s f \<ge> q_max" unfolding s_def q_max_def by (intro nat_mono) auto
     ultimately show "\<psi> \<notin> {(f, g, h). \<epsilon> * X < \<bar>Y (f, g, h) - real X\<bar> \<or> s f < q_max}"
       unfolding \<psi>_def by auto
   qed
   also have "... \<le>
     measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi> \<or> \<not>E\<^sub>2 \<psi> \<or> \<not>E\<^sub>3 \<psi>} + measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> E\<^sub>3 \<psi> \<and> \<not>E\<^sub>4 \<psi>}"
     by (intro pmf_add) auto
   also have "... \<le> (measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi> \<or> \<not>E\<^sub>2 \<psi>} + measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> \<not>E\<^sub>3 \<psi>}) + 1/2^6"
     by (intro add_mono e_4 pmf_add) auto
   also have "... \<le> ((measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi>} + measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> \<not>E\<^sub>2 \<psi>}) + 1/2^6) + 1/2^6"
     by (intro add_mono e_3 pmf_add) auto
   also have "... \<le> ((1/2^6 + 1/2^6) + 1/2^6) + 1/2^6"
     by (intro add_mono e_2 e_1) auto
   also have "... = ?R" by simp
   finally show ?thesis by simp
 qed
 
 end
 
 end
diff --git a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Balls_and_Bins.thy b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Balls_and_Bins.thy
--- a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Balls_and_Bins.thy
+++ b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Balls_and_Bins.thy
@@ -1,1926 +1,1926 @@
 section \<open>Balls and Bins\<close>
 
 text \<open>The balls and bins model describes the probability space of throwing r balls into b
 bins. This section derives the expected number of bins hit by at least one ball, as well as the
 variance in the case that each ball is thrown independently. Further, using an approximation
 argument it is then possible to derive bounds for the same measures in the case when the balls
 are being thrown only $k$-wise independently. The proofs follow the reasoning described in
 \cite[\S A.1]{kane2010} but improve on the constants, as well as constraints.\<close>
 
 theory Distributed_Distinct_Elements_Balls_and_Bins
   imports
     Distributed_Distinct_Elements_Preliminary
     Discrete_Summation.Factorials
     "HOL-Combinatorics.Stirling"
     "HOL-Computational_Algebra.Polynomial"
     "HOL-Decision_Procs.Approximation"
 begin
 
 hide_fact "Henstock_Kurzweil_Integration.integral_sum"
 hide_fact "Henstock_Kurzweil_Integration.integral_mult_right"
 hide_fact "Henstock_Kurzweil_Integration.integral_nonneg"
 hide_fact "Henstock_Kurzweil_Integration.integral_cong"
 unbundle intro_cong_syntax
 
 lemma sum_power_distrib:
   fixes f :: "'a \<Rightarrow> real"
   assumes "finite R"
   shows "(\<Sum>i\<in>R. f i) ^ s = (\<Sum>xs | set xs \<subseteq> R \<and> length xs = s. (\<Prod>x \<leftarrow> xs. f x))"
 proof (induction s)
   case 0
   have "{xs. xs = [] \<and> set xs \<subseteq> R} = {[]}"
     by (auto simp add:set_eq_iff)
   then show ?case by simp
 next
   case (Suc s)
   have a:
     "(\<Union>i\<in>R. (#) i ` {xs. set xs \<subseteq> R \<and> length xs = s}) = {xs. set xs \<subseteq> R \<and> length xs = Suc s}"
     by (subst lists_length_Suc_eq)  auto
   have "sum f R ^ Suc s = (sum f R) * (sum f R)^s"
     by simp
   also have "... = (sum f R) * (\<Sum>xs | set xs \<subseteq> R \<and> length xs = s. (\<Prod>x \<leftarrow> xs. f x))"
     using Suc by simp
   also have "... = (\<Sum>i \<in> R. (\<Sum>xs | set xs \<subseteq> R \<and> length xs = s. (\<Prod>x \<leftarrow> i#xs. f x)))"
     by (subst sum_product) simp
   also have "... =
     (\<Sum>i \<in> R. (\<Sum>xs \<in> (\<lambda>xs. i#xs) ` {xs. set xs \<subseteq> R \<and> length xs = s}. (\<Prod>x \<leftarrow> xs. f x)))"
     by (subst sum.reindex) (auto)
   also have "... =  (\<Sum>xs\<in>(\<Union>i\<in>R. (#) i ` {xs. set xs \<subseteq> R \<and> length xs = s}). (\<Prod>x \<leftarrow> xs. f x))"
     by (intro sum.UNION_disjoint[symmetric] assms ballI finite_imageI finite_lists_length_eq)
     auto
   also have "... = (\<Sum>xs| set xs \<subseteq> R \<and> length xs = Suc s. (\<Prod>x \<leftarrow> xs. f x))"
     by (intro sum.cong a) auto
   finally show ?case by simp
 qed
 
 lemma sum_telescope_eq:
   fixes f :: "nat \<Rightarrow> 'a :: {comm_ring_1}"
   shows "(\<Sum>k\<in>{Suc m..n}. f k - f (k - 1)) = of_bool(m \<le> n) *(f n - f m)"
   by (cases "m \<le> n", subst sum_telescope'', auto)
 
 text \<open>An improved version of @{thm [source] diff_power_eq_sum}.\<close>
 lemma power_diff_sum:
   fixes a b :: "'a :: {comm_ring_1,power}"
   shows "a^k - b^k = (a-b) * (\<Sum>i = 0..<k. a ^ i * b ^ (k - 1 - i))"
 proof (cases "k")
   case 0
   then show ?thesis by simp
 next
   case (Suc nat)
   then show ?thesis
     unfolding Suc diff_power_eq_sum
     using atLeast0LessThan diff_Suc_1 by presburger
 qed
 
 lemma power_diff_est:
   assumes "(a :: real) \<ge> b"
   assumes "b \<ge> 0"
   shows "a^k - b^k \<le> (a-b) * k * a^(k-1)"
 proof -
   have "a^k - b^k = (a-b) * (\<Sum>i = 0..<k. a ^ i * b ^ (k - 1 - i))"
     by (rule power_diff_sum)
   also have "... \<le> (a-b) * (\<Sum>i = 0..<k. a^i * a^(k-1-i))"
     using assms by (intro mult_left_mono sum_mono mult_right_mono power_mono, auto)
   also have "... = (a-b) * (k * a^(k-1))"
     by (simp add:power_add[symmetric])
   finally show ?thesis by simp
 qed
 
 lemma power_diff_est_2:
   assumes "(a :: real) \<ge> b"
   assumes "b \<ge> 0"
   shows "a^k - b^k \<ge> (a-b) * k * b^(k-1)"
 proof -
   have "(a-b) * k * b^(k-1) = (a-b) * (\<Sum>i=0..<k. b^i * b^(k-1-i))"
     by (simp add:power_add[symmetric])
   also have "... \<le>  (a-b)* (\<Sum>i=0..<k. a^i * b^(k-1-i))"
     using assms
     by (intro mult_left_mono sum_mono mult_right_mono power_mono) auto
   also have "... = a^k - b^k"
     by (rule power_diff_sum[symmetric])
   finally show ?thesis by simp
 qed
 
 lemma of_bool_prod:
   assumes "finite R"
   shows "(\<Prod> j \<in> R. of_bool(f j)) = (of_bool(\<forall>j \<in> R. f j) :: real)"
   using assms by (induction R rule:finite_induct) auto
 
 text \<open>Additional results about falling factorials:\<close>
 
 lemma ffact_nonneg:
   fixes x :: real
   assumes "k - 1 \<le> x"
   shows "ffact k x \<ge> 0"
   using assms unfolding prod_ffact[symmetric]
   by (intro prod_nonneg ballI) simp
 
 lemma ffact_pos:
   fixes x :: real
   assumes "k - 1 < x"
   shows "ffact k x > 0"
   using assms unfolding prod_ffact[symmetric]
   by (intro prod_pos ballI) simp
 
 lemma ffact_mono:
   fixes x y :: real
   assumes "k-1 \<le> x" "x \<le> y"
   shows "ffact k x \<le> ffact k y"
   using assms
   unfolding prod_ffact[symmetric]
   by (intro prod_mono) auto
 
 lemma ffact_of_nat_nonneg:
   fixes x :: "'a :: {comm_ring_1, linordered_nonzero_semiring}"
   assumes "x \<in> \<nat>"
   shows "ffact k x \<ge> 0"
 proof -
   obtain y where y_def: "x = of_nat y"
     using assms(1) Nats_cases by auto
   have "(0::'a) \<le> of_nat (ffact k y)"
     by simp
   also have "... = ffact k x"
     by (simp add:of_nat_ffact y_def)
   finally show ?thesis by simp
 qed
 
 lemma ffact_suc_diff:
   fixes x :: "('a :: comm_ring_1)"
   shows "ffact k x - ffact k (x-1) = of_nat k * ffact (k-1) (x-1)" (is "?L = ?R")
 proof (cases "k")
   case 0
   then show ?thesis by simp
 next
   case (Suc n)
   hence "?L = ffact (Suc n) x - ffact (Suc n) (x-1)" by simp
   also have "... =  x * ffact n (x-1) - ((x-1)-of_nat n) * ffact n (x-1)"
     by (subst (1) ffact_Suc, simp add: ffact_Suc_rev)
   also have "... = of_nat (Suc n)  * ffact n (x-1)"
     by (simp add:algebra_simps)
   also have "... = of_nat k * ffact (k-1) (x-1)" using Suc by simp
   finally show ?thesis by simp
 qed
 
 lemma ffact_bound:
   "ffact k (n::nat) \<le> n^k"
 proof -
   have "ffact k n = (\<Prod>i=0..<k. (n-i))"
     unfolding prod_ffact_nat[symmetric]
     by simp
   also have "... \<le> (\<Prod>i=0..<k. n)"
     by (intro prod_mono) auto
   also have "... = n^k"
     by simp
   finally show ?thesis by simp
 qed
 
 lemma fact_moment_binomial:
   fixes n :: nat and \<alpha> :: real
   assumes "\<alpha> \<in> {0..1}"
   defines "p \<equiv> binomial_pmf n \<alpha>"
   shows "(\<integral>\<omega>. ffact s (real \<omega>) \<partial>p) = ffact s (real n) * \<alpha>^s" (is "?L = ?R")
 proof (cases "s \<le> n")
   case True
   have "?L =  (\<Sum>k\<le>n. (real (n choose k) * \<alpha> ^ k * (1 - \<alpha>) ^ (n - k)) * real (ffact s k))"
     unfolding p_def using assms by (subst expectation_binomial_pmf') (auto simp add:of_nat_ffact)
   also have "... = (\<Sum>k \<in> {0+s..(n-s)+s}. (real (n choose k) * \<alpha> ^ k * (1 - \<alpha>) ^ (n - k)) * ffact s k)"
     using True ffact_nat_triv by (intro sum.mono_neutral_cong_right) auto
   also have "... = (\<Sum>k=0..n-s. \<alpha>^s * real (n choose (k+s)) * \<alpha>^k * (1-\<alpha>)^(n-(k+s)) *ffact s (k+s))"
     by (subst sum.atLeastAtMost_shift_bounds, simp add:algebra_simps power_add)
   also have "... = \<alpha>^s * (\<Sum>k\<le>n-s. real (n choose (k+s))*ffact s (k+s)*\<alpha>^k*(1-\<alpha>)^((n-s)-k))"
     using atMost_atLeast0 by (simp add: sum_distrib_left algebra_simps cong:sum.cong)
   also have "... = \<alpha>^s * (\<Sum>k\<le>n-s. real (n choose (k+s))*fact (k+s) / fact k * \<alpha>^k*(1-\<alpha>)^((n-s)-k))"
     using real_of_nat_div[OF fact_dvd[OF le_add1]]
     by (subst fact_div_fact_ffact_nat[symmetric], auto)
   also have "... = \<alpha>^s * (\<Sum>k\<le>n-s.
     (fact n / fact (n-s)) * fact (n-s) / (fact ((n-s)-k) * fact k) * \<alpha>^k*(1-\<alpha>)^((n-s)-k))"
     using True by (intro arg_cong2[where f="(*)"] sum.cong)
      (auto simp add: binomial_fact algebra_simps)
   also have "... = \<alpha>^s * (fact n / fact (n - s)) *
     (\<Sum>k\<le>n-s. fact (n-s) / (fact ((n-s)-k) * fact k) * \<alpha>^k*(1-\<alpha>)^((n-s)-k))"
     by (simp add:sum_distrib_left algebra_simps)
   also have "... = \<alpha>^s * (fact n / fact (n - s)) * (\<Sum>k\<le>n-s. ((n-s) choose k) * \<alpha>^k*(1-\<alpha>)^((n-s)-k))"
     using True by (intro_cong "[\<sigma>\<^sub>2(*)]" more: sum.cong) (auto simp add: binomial_fact)
   also have "... = \<alpha>^s * real (fact n div fact (n - s)) * (\<alpha>+(1-\<alpha>))^(n-s)"
     using True real_of_nat_div[OF fact_dvd] by (subst binomial_ring, simp)
   also have "... = \<alpha>^s * real (ffact s n)"
     by (subst fact_div_fact_ffact_nat[OF True], simp)
   also have "... = ?R"
     by (subst of_nat_ffact, simp)
   finally show ?thesis by simp
 next
   case False
   have "?L =  (\<Sum>k\<le>n. (real (n choose k) * \<alpha> ^ k * (1 - \<alpha>) ^ (n - k)) * real (ffact s k))"
     unfolding p_def using assms by (subst expectation_binomial_pmf') (auto simp add:of_nat_ffact)
   also have "... = (\<Sum>k\<le>n. (real (n choose k) * \<alpha> ^ k * (1 - \<alpha>) ^ (n - k)) * real 0)"
     using False
     by (intro_cong "[\<sigma>\<^sub>2(*),\<sigma>\<^sub>1 of_nat]" more: sum.cong ffact_nat_triv) auto
   also have "... = 0" by simp
   also have "... = real (ffact s n) * \<alpha>^s"
     using False by (subst ffact_nat_triv, auto)
   also have "... = ?R"
     by (subst of_nat_ffact, simp)
   finally show ?thesis by simp
 qed
 
 text \<open>The following describes polynomials of a given maximal degree as a subset of the functions,
 similar to the subsets @{term "\<int>"} or @{term "\<rat>"} as subsets of larger number classes.\<close>
 
 definition Polynomials ("\<bbbP>")
   where "Polynomials k = {f. \<exists>p. f = poly p \<and> degree p \<le> k}"
 
 lemma Polynomials_mono:
   assumes "s \<le> t"
   shows "\<bbbP> s \<subseteq> \<bbbP> t"
   using assms unfolding Polynomials_def by auto
 
 lemma Polynomials_addI:
   assumes "f \<in> \<bbbP> k" "g \<in> \<bbbP> k"
   shows "(\<lambda>\<omega>. f \<omega> + g \<omega>) \<in> \<bbbP> k"
 proof -
   obtain pf pg where fg_def: "f = poly pf" "degree pf  \<le> k" "g = poly pg" "degree pg \<le> k"
     using assms unfolding Polynomials_def by blast
   hence "degree (pf + pg) \<le> k" "(\<lambda>x. f x + g x) = poly (pf + pg)"
     using degree_add_le by auto
   thus ?thesis unfolding Polynomials_def by auto
 qed
 
 lemma Polynomials_diffI:
   fixes f g :: "'a :: comm_ring \<Rightarrow> 'a"
   assumes "f \<in> \<bbbP> k" "g \<in> \<bbbP> k"
   shows "(\<lambda>x. f x - g x) \<in> \<bbbP> k"
 proof -
   obtain pf pg where fg_def: "f = poly pf" "degree pf  \<le> k" "g = poly pg" "degree pg \<le> k"
     using assms unfolding Polynomials_def by blast
   hence "degree (pf - pg) \<le> k" "(\<lambda>x. f x - g x) = poly (pf - pg)"
     using degree_diff_le by auto
   thus ?thesis unfolding Polynomials_def by auto
 qed
 
 lemma Polynomials_idI:
   "(\<lambda>x. x) \<in> (\<bbbP> 1 :: ('a::comm_ring_1 \<Rightarrow> 'a) set)"
 proof -
   have "(\<lambda>x. x) = poly [: 0,(1::'a) :]"
     by (intro ext, auto)
   also have "... \<in> \<bbbP> 1"
     unfolding Polynomials_def by auto
   finally show ?thesis by simp
 qed
 
 lemma Polynomials_constI:
   "(\<lambda>x. c) \<in> \<bbbP> k"
 proof -
   have "(\<lambda>x. c) = poly [: c :]"
     by (intro ext, simp)
   also have "... \<in> \<bbbP> k"
     unfolding Polynomials_def by auto
   finally show ?thesis by simp
 qed
 
 lemma Polynomials_multI:
   fixes f g :: "'a :: {comm_ring} \<Rightarrow> 'a"
   assumes "f \<in> \<bbbP> s" "g \<in> \<bbbP> t"
   shows "(\<lambda>x. f x * g x) \<in> \<bbbP> (s+t)"
 proof -
   obtain pf pg where xy_def: "f = poly pf" "degree pf \<le> s" "g = poly pg" "degree pg \<le> t"
     using assms unfolding Polynomials_def by blast
 
   have "degree (pf * pg) \<le> degree pf + degree pg"
     by (intro degree_mult_le)
   also have "... \<le> s + t"
     using xy_def by (intro add_mono) auto
   finally have "degree (pf * pg) \<le> s+t" by simp
   moreover have "(\<lambda>x. f x * g x) = poly (pf * pg)"
     using xy_def by auto
   ultimately show ?thesis unfolding Polynomials_def by auto
 qed
 
 lemma Polynomials_composeI:
   fixes f g :: "'a :: {comm_semiring_0, semiring_no_zero_divisors} \<Rightarrow> 'a"
   assumes "f \<in> \<bbbP> s" "g \<in> \<bbbP> t"
   shows "(\<lambda>x. f (g x)) \<in> \<bbbP> (s*t)"
 proof -
   obtain pf pg where xy_def: "f = poly pf" "degree pf \<le> s" "g = poly pg" "degree pg \<le> t"
     using assms unfolding Polynomials_def by blast
   have "degree (pf \<circ>\<^sub>p pg) = degree pf * degree pg"
     by (intro degree_pcompose)
   also have "... \<le> s * t"
     using xy_def by (intro mult_mono) auto
   finally have "degree (pf \<circ>\<^sub>p pg) \<le> s * t"
     by simp
   moreover have "(\<lambda>x. f (g x)) = poly (pf \<circ>\<^sub>p pg)"
     unfolding xy_def
     by (intro ext poly_pcompose[symmetric])
   ultimately show ?thesis unfolding Polynomials_def by auto
 qed
 
 lemma Polynomials_const_left_multI:
   fixes c :: "'a :: {comm_ring}"
   assumes "f \<in> \<bbbP> k"
   shows "(\<lambda>x. c * f x) \<in> \<bbbP> k"
 proof -
   have "(\<lambda>x. c * f x) \<in> \<bbbP> (0+k)"
     by (intro Polynomials_multI Polynomials_constI assms)
   thus ?thesis by simp
 qed
 
 lemma Polynomials_const_right_multI:
   fixes c :: "'a :: {comm_ring}"
   assumes "f \<in> \<bbbP> k"
   shows "(\<lambda>x. f x * c) \<in> \<bbbP> k"
 proof -
   have "(\<lambda>x. f x * c) \<in> \<bbbP> (k+0)"
     by (intro Polynomials_multI Polynomials_constI assms)
   thus ?thesis by simp
 qed
 
 lemma Polynomials_const_divI:
   fixes c :: "'a :: {field}"
   assumes "f \<in> \<bbbP> k"
   shows "(\<lambda>x. f x / c) \<in> \<bbbP> k"
 proof -
   have "(\<lambda>x. f x * (1/c)) \<in> \<bbbP> (k+0)"
     by (intro Polynomials_multI Polynomials_constI assms)
   thus ?thesis by simp
 qed
 
 lemma Polynomials_ffact: "(\<lambda>x. ffact s (x - y))  \<in> (\<bbbP> s :: ('a :: comm_ring_1  \<Rightarrow> 'a) set)"
 proof (induction s arbitrary: y)
   case 0
   then show ?case
     using Polynomials_constI[where c="1"] by simp
 next
   case (Suc s)
   have "(\<lambda>(x :: 'a). ffact (Suc s) (x-y)) = (\<lambda>x. (x-y) * ffact s (x - (y+1)))"
     by (simp add: ffact_Suc algebra_simps)
   also have "... \<in> \<bbbP> (1+s)"
     by (intro Polynomials_multI Suc Polynomials_diffI Polynomials_idI Polynomials_constI)
   finally show ?case by simp
 qed
 
 lemmas Polynomials_intros =
   Polynomials_const_divI
   Polynomials_composeI
   Polynomials_const_left_multI
   Polynomials_const_right_multI
   Polynomials_multI
   Polynomials_addI
   Polynomials_diffI
   Polynomials_idI
   Polynomials_constI
   Polynomials_ffact
 
 definition C\<^sub>2 :: real where "C\<^sub>2 = 7.5"
 definition C\<^sub>3 :: real where "C\<^sub>3 = 16"
 
 text \<open>A locale fixing the sets of balls and bins\<close>
 
 locale balls_and_bins_abs =
   fixes R :: "'a set" and B :: "'b set"
   assumes fin_B: "finite B" and B_ne: "B \<noteq> {}"
   assumes fin_R: "finite R"
 begin
 
 text \<open>Independent balls and bins space:\<close>
 definition \<Omega>
   where "\<Omega> = prod_pmf R (\<lambda>_. pmf_of_set B)"
 
 lemma set_pmf_\<Omega>: "set_pmf \<Omega> = R \<rightarrow>\<^sub>E B"
   unfolding \<Omega>_def set_prod_pmf[OF fin_R]
   by  (simp add:comp_def set_pmf_of_set[OF B_ne fin_B])
 
 lemma card_B_gt_0: "card B > 0"
   using B_ne fin_B by auto
 
 lemma card_B_ge_1: "card B \<ge> 1"
   using card_B_gt_0 by simp
 
 definition "Z j \<omega> = real (card {i. i \<in> R \<and> \<omega> i = (j::'b)})"
 definition "Y \<omega> = real (card (\<omega> ` R))"
 definition "\<mu> = real (card B) * (1 - (1-1/real (card B))^card R)"
 
 text \<open>Factorial moments for the random variable describing the number of times a bin will be hit:\<close>
 
 lemma fact_moment_balls_and_bins:
   assumes "J \<subseteq> B" "J \<noteq> {}"
   shows "(\<integral>\<omega>. ffact s (\<Sum>j \<in> J. Z j \<omega>) \<partial>\<Omega>) =
     ffact s (real (card R)) * (real (card J) / real (card B))^s"
     (is "?L = ?R")
 proof -
   let ?\<alpha> = "real (card J) / real (card B)"
   let ?q = "binomial_pmf (card R) ?\<alpha>"
   let ?Y = "(\<lambda>\<omega>. card {r \<in> R. \<omega> r \<in> J})"
 
   have fin_J: "finite J"
     using finite_subset assms(1) fin_B by auto
 
   have Z_sum_eq: "(\<Sum>j \<in> J. Z j \<omega>) = real (?Y \<omega>)" for \<omega>
   proof -
     have "?Y \<omega> = card (\<Union>j \<in> J. {r \<in> R. \<omega> r= j})"
       by (intro arg_cong[where f="card"]) auto
     also have "... =  (\<Sum>i\<in>J. card {r \<in> R. \<omega> r = i})"
       using fin_R fin_J by (intro card_UN_disjoint) auto
     finally have "?Y \<omega> = (\<Sum>j \<in> J. card {r \<in> R. \<omega> r  = j})" by simp
     thus ?thesis
     unfolding Z_def of_nat_sum[symmetric] by simp
   qed
 
   have card_J: "card J \<le> card B"
     using assms(1) fin_B card_mono by auto
   have \<alpha>_range: "?\<alpha> \<ge> 0" "?\<alpha> \<le> 1"
     using card_J card_B_gt_0 by auto
 
   have "pmf (map_pmf (\<lambda>\<omega>. \<omega> \<in> J) (pmf_of_set B)) x = pmf (bernoulli_pmf ?\<alpha>) x"
     (is "?L1=?R1") for x
   proof -
     have "?L1 = real (card (B \<inter> {\<omega>. (\<omega> \<in> J) = x})) / real (card B)"
       using B_ne fin_B
       by (simp add:pmf_map measure_pmf_of_set vimage_def)
     also have "... = (if x then (card J) else (card (B - J))) / real (card B)"
       using Int_absorb1[OF assms(1)] by (auto simp add:Diff_eq Int_def)
     also have "... = (if x then (card J) / card B else (real (card B) - card J) / real (card B))"
       using card_J fin_J assms(1) by (simp add: of_nat_diff card_Diff_subset)
     also have "... = (if x then ?\<alpha> else (1 - ?\<alpha>))"
       using card_B_gt_0 by (simp add:divide_simps)
     also have "... = ?R1"
       using \<alpha>_range by auto
     finally show ?thesis by simp
   qed
   hence c:"map_pmf (\<lambda>\<omega>. \<omega> \<in> J) (pmf_of_set B) = bernoulli_pmf ?\<alpha>"
     by (intro pmf_eqI) simp
 
   have "map_pmf (\<lambda>\<omega>. \<lambda>r \<in> R. \<omega> r \<in> J) \<Omega> = prod_pmf R (\<lambda>_. (map_pmf (\<lambda>\<omega>. \<omega> \<in> J) (pmf_of_set B)))"
     unfolding map_pmf_def \<Omega>_def restrict_def using fin_R
     by (subst Pi_pmf_bind[where d'="undefined"]) auto
   also have "... = prod_pmf R (\<lambda>_. bernoulli_pmf ?\<alpha>)"
     unfolding c by simp
   finally have b:"map_pmf (\<lambda>\<omega>. \<lambda>r \<in> R. \<omega> r \<in> J) \<Omega>  =  prod_pmf R (\<lambda>_. bernoulli_pmf ?\<alpha>)"
     by simp
 
   have "map_pmf ?Y \<Omega> = map_pmf ((\<lambda>\<omega>. card {r \<in> R. \<omega> r}) \<circ> (\<lambda>\<omega>. \<lambda>r\<in>R. \<omega> r \<in> J)) \<Omega>"
     unfolding comp_def
     by (intro map_pmf_cong arg_cong[where f="card"]) (auto simp add:comp_def)
   also have "... = (map_pmf (\<lambda>\<omega>. card {r \<in> R. \<omega> r}) \<circ> map_pmf (\<lambda>\<omega>. \<lambda>r \<in> R. \<omega> r \<in> J)) \<Omega>"
     by (subst map_pmf_compose[symmetric]) auto
   also have "... = map_pmf (\<lambda>\<omega>. card {r \<in> R. \<omega> r}) (prod_pmf R (\<lambda>_. (bernoulli_pmf ?\<alpha>)))"
     unfolding comp_def b by simp
   also have "... = ?q"
     using \<alpha>_range by (intro binomial_pmf_altdef'[symmetric] fin_R) auto
   finally have a:"map_pmf ?Y \<Omega> =?q"
     by simp
 
   have "?L = (\<integral>\<omega>. ffact s (real (?Y \<omega>)) \<partial>\<Omega>)"
     unfolding Z_sum_eq by simp
   also have "... = (\<integral>\<omega>. ffact s (real \<omega>) \<partial>(map_pmf ?Y \<Omega>))"
     by simp
   also have "... = (\<integral>\<omega>. ffact s (real \<omega>) \<partial>?q)"
     unfolding a by simp
   also have "... = ?R"
     using \<alpha>_range by (subst fact_moment_binomial, auto)
   finally show ?thesis by simp
 qed
 
 text \<open>Expectation and variance for the number of distinct bins that are hit by at least one ball
 in the fully independent model. The result for the variance is improved by a factor of $4$ w.r.t.
 the paper.\<close>
 
 lemma
   shows exp_balls_and_bins: "measure_pmf.expectation \<Omega> Y = \<mu>" (is "?AL = ?AR")
     and var_balls_and_bins: "measure_pmf.variance \<Omega> Y \<le> card R * (real (card R) - 1) / card B"
       (is "?BL \<le> ?BR")
 proof -
   let ?b = "real (card B)"
   let ?r = "card R"
   define Z :: "'b \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> real"
     where "Z = (\<lambda>i \<omega>. of_bool(i \<notin> \<omega> ` R))"
   define \<alpha> where "\<alpha> = (1 - 1 / ?b)^?r"
   define \<beta> where "\<beta> = (1 - 2 / ?b)^?r"
 
   have "card (B \<times> B \<inter> {x. fst x = snd x}) = card ((\<lambda>x. (x,x)) ` B)"
     by (intro arg_cong[where f="card"]) auto
   also have "... = card B"
     by (intro card_image, simp add:inj_on_def)
   finally have d: "card (B \<times> B \<inter> {x. fst x = snd x}) = card B"
     by simp
   hence count_1: "real (card (B \<times> B \<inter> {x. fst x = snd x})) = card B"
     by simp
 
   have "card B + card (B \<times> B \<inter> -{x. fst x = snd x}) =
     card (B \<times> B \<inter> {x. fst x = snd x}) + card (B \<times> B \<inter> -{x. fst x = snd x})"
     by (subst d) simp
   also have "... = card ((B \<times> B \<inter> {x. fst x = snd x}) \<union> (B \<times> B \<inter> -{x. fst x = snd x}))"
     using finite_subset[OF _ finite_cartesian_product[OF fin_B fin_B]]
     by (intro card_Un_disjoint[symmetric]) auto
   also have "... = card (B \<times> B)"
     by (intro arg_cong[where f="card"]) auto
   also have "... = card B^2"
     unfolding card_cartesian_product by (simp add:power2_eq_square)
   finally have "card B + card (B \<times> B \<inter> -{x. fst x = snd x}) = card B^2" by simp
 
   hence count_2: "real (card (B \<times> B \<inter> -{x. fst x = snd x})) = real (card B)^2 - card B"
     by (simp add:algebra_simps flip: of_nat_add of_nat_power)
 
   hence "finite (set_pmf \<Omega>)"
     unfolding set_pmf_\<Omega>
     using fin_R fin_B by (auto intro!:finite_PiE)
   hence int: "integrable (measure_pmf \<Omega>) f"
     for f :: "('a \<Rightarrow> 'b) \<Rightarrow> real"
     by (intro integrable_measure_pmf_finite) simp
 
   have a:"prob_space.indep_vars (measure_pmf \<Omega>) (\<lambda>i. discrete) (\<lambda>x \<omega>. \<omega> x) R"
     unfolding \<Omega>_def using indep_vars_Pi_pmf[OF fin_R] by metis
   have b: "(\<integral>\<omega>. of_bool (\<omega> ` R \<subseteq> A) \<partial>\<Omega>) = (real (card (B \<inter> A)) / real (card B))^card R"
     (is "?L = ?R") for A
   proof -
     have "?L = (\<integral>\<omega>. (\<Prod> j \<in> R. of_bool(\<omega> j \<in> A)) \<partial>\<Omega>)"
       by (intro Bochner_Integration.integral_cong ext)
         (auto simp add: of_bool_prod[OF fin_R])
     also have "... = (\<Prod> j \<in> R. (\<integral>\<omega>. of_bool(\<omega> j \<in> A) \<partial>\<Omega>))"
       using fin_R
       by (intro prob_space.indep_vars_lebesgue_integral[OF prob_space_measure_pmf] int
           prob_space.indep_vars_compose2[OF prob_space_measure_pmf a]) auto
     also have "... = (\<Prod> j \<in> R. (\<integral>\<omega>. of_bool(\<omega> \<in> A) \<partial>(map_pmf (\<lambda>\<omega>. \<omega> j) \<Omega>)))"
       by simp
     also have "... = (\<Prod> j \<in> R. (\<integral>\<omega>. of_bool(\<omega> \<in> A) \<partial>(pmf_of_set B)))"
       unfolding \<Omega>_def by (subst Pi_pmf_component[OF fin_R]) simp
     also have "... = ((\<Sum>\<omega>\<in>B. of_bool (\<omega> \<in> A)) / real (card B)) ^ card R"
       by (simp add: integral_pmf_of_set[OF B_ne fin_B])
     also have "... = ?R"
       unfolding of_bool_def sum.If_cases[OF fin_B] by simp
     finally show ?thesis by simp
   qed
 
   have Z_exp: "(\<integral>\<omega>. Z i \<omega> \<partial>\<Omega>) = \<alpha>" if "i \<in> B" for i
   proof -
     have "real (card (B \<inter> -{i})) = real (card (B - {i}))"
       by (intro_cong "[\<sigma>\<^sub>1 card,\<sigma>\<^sub>1 of_nat]") auto
     also have "... = real (card B - card {i})"
       using that by (subst card_Diff_subset)  auto
     also have "... = real (card B) - real (card {i})"
       using fin_B that by (intro of_nat_diff card_mono) auto
     finally have c: "real (card (B \<inter> -{i})) = real (card B) - 1"
       by simp
 
     have "(\<integral>\<omega>. Z i \<omega> \<partial>\<Omega>) = (\<integral>\<omega>. of_bool(\<omega> ` R \<subseteq> - {i}) \<partial>\<Omega>)"
       unfolding Z_def by simp
     also have "... = (real (card (B \<inter> -{i})) / real (card B))^card R"
       by (intro b)
     also have "... = ((real (card B) -1) / real (card B))^card R"
       by (subst c) simp
     also have "... = \<alpha>"
       unfolding \<alpha>_def using card_B_gt_0
       by (simp add:divide_eq_eq diff_divide_distrib)
     finally show ?thesis
       by simp
   qed
 
   have Z_prod_exp: "(\<integral>\<omega>. Z i \<omega> * Z j \<omega> \<partial>\<Omega>) = (if i = j then \<alpha> else \<beta>)"
     if "i \<in> B" "j \<in> B" for i j
   proof -
     have "real (card (B \<inter> -{i,j})) = real (card (B - {i,j}))"
       by (intro_cong "[\<sigma>\<^sub>1 card,\<sigma>\<^sub>1 of_nat]") auto
     also have "... = real (card B - card {i,j})"
       using that by (subst card_Diff_subset)  auto
     also have "... = real (card B) - real (card {i,j})"
       using fin_B that by (intro of_nat_diff card_mono) auto
     finally have c: "real (card (B \<inter> -{i,j})) = real (card B) - card {i,j}"
       by simp
 
     have "(\<integral>\<omega>. Z i \<omega> * Z j \<omega> \<partial>\<Omega>) = (\<integral>\<omega>. of_bool(\<omega> ` R \<subseteq> - {i,j}) \<partial>\<Omega>)"
       unfolding Z_def of_bool_conj[symmetric]
       by (intro integral_cong ext) auto
     also have "... = (real (card (B \<inter> -{i,j})) / real (card B))^card R"
       by (intro b)
     also have "... = ((real (card B) - card {i,j}) / real (card B))^card R"
       by (subst c) simp
     also have "... = (if i = j then \<alpha> else \<beta>)"
       unfolding \<alpha>_def \<beta>_def using card_B_gt_0
       by (simp add:divide_eq_eq diff_divide_distrib)
     finally show ?thesis by simp
   qed
 
   have Y_eq: "Y \<omega> = (\<Sum>i \<in> B. 1 - Z i \<omega>)" if "\<omega> \<in> set_pmf \<Omega>" for \<omega>
   proof -
     have "set_pmf \<Omega> \<subseteq> Pi R (\<lambda>_. B)"
       using set_pmf_\<Omega> by (simp add:PiE_def)
     hence "\<omega> ` R \<subseteq> B"
       using that by auto
     hence "Y \<omega> = card (B \<inter> \<omega> ` R)"
       unfolding Y_def using Int_absorb1 by metis
     also have "... = (\<Sum> i \<in> B. of_bool(i \<in> \<omega> ` R))"
       unfolding of_bool_def sum.If_cases[OF fin_B] by(simp)
     also have "... = (\<Sum> i \<in> B. 1 - Z i \<omega>)"
       unfolding Z_def by (intro sum.cong) (auto simp add:of_bool_def)
     finally show "Y \<omega> = (\<Sum>i \<in> B. 1 - Z i \<omega>)" by simp
   qed
 
   have Y_sq_eq: "(Y \<omega>)\<^sup>2 = (\<Sum>(i,j) \<in> B \<times> B. 1 - Z i \<omega> - Z j \<omega> + Z i \<omega> * Z j \<omega>)"
     if "\<omega> \<in> set_pmf \<Omega>" for \<omega>
     unfolding Y_eq[OF that] power2_eq_square sum_product sum.cartesian_product
     by (intro sum.cong) (auto simp add:algebra_simps)
 
   have "measure_pmf.expectation \<Omega> Y = (\<integral>\<omega>. (\<Sum>i \<in> B. 1 - Z i \<omega>) \<partial>\<Omega>)"
     using Y_eq by (intro integral_cong_AE AE_pmfI) auto
   also have "... = (\<Sum>i \<in> B. 1 - (\<integral>\<omega>. Z i \<omega> \<partial>\<Omega>))"
     using int by simp
   also have "... = ?b * (1 - \<alpha>)"
     using Z_exp by simp
   also have "... = ?AR"
     unfolding \<alpha>_def \<mu>_def by simp
   finally show "?AL = ?AR" by simp
 
   have "measure_pmf.variance \<Omega> Y = (\<integral>\<omega>. Y \<omega>^2 \<partial>\<Omega>) - (\<integral>\<omega>. Y \<omega> \<partial>\<Omega>)^2"
     using int by (subst measure_pmf.variance_eq) auto
   also have "... =
     (\<integral>\<omega>. (\<Sum>i \<in> B \<times> B. 1 - Z (fst i) \<omega> - Z (snd i) \<omega> + Z (fst i) \<omega> * Z (snd i) \<omega>) \<partial>\<Omega>) -
     (\<integral>\<omega>. (\<Sum>i \<in> B. 1 - Z i \<omega>) \<partial>\<Omega>)^2"
     using Y_eq Y_sq_eq
     by (intro_cong "[\<sigma>\<^sub>2(-),\<sigma>\<^sub>2 power]" more: integral_cong_AE AE_pmfI) (auto simp add:case_prod_beta)
   also have "... =
     (\<Sum>i \<in> B \<times> B. (\<integral>\<omega>. (1 - Z (fst i) \<omega> - Z (snd i) \<omega> + Z (fst i) \<omega> * Z (snd i) \<omega>) \<partial>\<Omega>)) -
     (\<Sum>i \<in> B. (\<integral>\<omega>. (1 - Z i \<omega>) \<partial>\<Omega>))^2"
     by (intro_cong "[\<sigma>\<^sub>2 (-), \<sigma>\<^sub>2 power]" more: integral_sum int)
   also have "... =
     (\<Sum>i \<in> B \<times> B. (\<integral>\<omega>. (1 - Z (fst i) \<omega> - Z (snd i) \<omega> + Z (fst i) \<omega> * Z (snd i) \<omega>) \<partial>\<Omega>)) -
     (\<Sum>i \<in> B \<times> B. (\<integral>\<omega>. (1 - Z (fst i) \<omega>) \<partial>\<Omega>) * (\<integral>\<omega>. (1 - Z (snd i) \<omega>) \<partial>\<Omega>))"
     unfolding power2_eq_square sum_product sum.cartesian_product
     by (simp add:case_prod_beta)
   also have "... = (\<Sum>(i,j) \<in> B \<times> B. (\<integral>\<omega>. (1 - Z i \<omega> - Z j \<omega> + Z i \<omega> * Z j \<omega>) \<partial>\<Omega>) -
     (\<integral>\<omega>. (1 - Z i \<omega>) \<partial>\<Omega>) * (\<integral>\<omega>. (1 - Z j \<omega>) \<partial>\<Omega>))"
     by (subst sum_subtractf[symmetric], simp add:case_prod_beta)
   also have "... = (\<Sum>(i,j) \<in> B \<times> B. (\<integral>\<omega>. Z i \<omega> * Z j \<omega> \<partial>\<Omega>) -(\<integral>\<omega>. Z i \<omega> \<partial>\<Omega>) * (\<integral> \<omega>. Z j \<omega> \<partial>\<Omega>))"
     using int by (intro sum.cong refl) (simp add:algebra_simps case_prod_beta)
   also have "... = (\<Sum>i \<in> B \<times> B. (if fst i = snd i then \<alpha> - \<alpha>^2 else \<beta> - \<alpha>^2))"
     by (intro sum.cong refl)
       (simp add:Z_exp Z_prod_exp mem_Times_iff case_prod_beta power2_eq_square)
   also have "... = ?b * (\<alpha> - \<alpha>\<^sup>2) + (?b^2 - card B) * (\<beta> - \<alpha>\<^sup>2)"
     using count_1 count_2 finite_cartesian_product fin_B by (subst sum.If_cases) auto
   also have "... = ?b^2 * (\<beta> - \<alpha>\<^sup>2) + ?b * (\<alpha> - \<beta>)"
     by (simp add:algebra_simps)
   also have "... = ?b * ((1-1/?b)^?r - (1-2/?b)^?r) - ?b^2 * (((1-1/?b)^2)^?r - (1-2/?b)^?r)"
     unfolding \<beta>_def \<alpha>_def
     by (simp add: power_mult[symmetric] algebra_simps)
   also have "... \<le> card R * (real (card R) - 1)/ card B" (is "?L \<le> ?R")
   proof (cases "?b \<ge> 2")
     case True
     have "?L \<le>
     ?b * (((1 - 1 /?b) - (1-2 /?b)) * ?r * (1-1/?b)^(?r - 1)) -
     ?b^2 * ((((1-1 /?b)^2) - ((1 - 2 /?b))) * ?r * ((1-2/?b))^(?r - 1))"
     using True
     by (intro diff_mono mult_left_mono power_diff_est_2 power_diff_est divide_right_mono)
       (auto simp add:power2_eq_square algebra_simps)
     also have "... = ?b * ((1/?b) * ?r * (1-1/?b)^(?r-1)) - ?b^2*((1/?b^2)*?r*((1-2/?b))^(?r-1))"
       by (intro arg_cong2[where f="(-)"] arg_cong2[where f="(*)"] refl)
         (auto simp add:algebra_simps power2_eq_square)
     also have "... = ?r * ((1-1/?b)^(?r - 1) - ((1-2/?b))^(?r - 1))"
       by (simp add:algebra_simps)
     also have "... \<le> ?r * (((1-1/?b) - (1-2/?b)) * (?r - 1) * (1-1/?b)^(?r -1 -1))"
       using True by (intro mult_left_mono power_diff_est) (auto simp add:algebra_simps)
     also have "... \<le> ?r * ((1/?b) * (?r - 1) * 1^(?r - 1-1))"
       using True by (intro mult_left_mono mult_mono power_mono) auto
     also have "... =  ?R"
       using card_B_gt_0 by auto
     finally show "?L \<le> ?R" by simp
   next
     case False
     hence "?b = 1" using card_B_ge_1 by simp
     thus "?L \<le> ?R"
       by (cases "card R =0") auto
   qed
   finally show "measure_pmf.variance \<Omega> Y \<le> card R * (real (card R) - 1)/ card B"
     by simp
 qed
 
 definition "lim_balls_and_bins k p = (
    prob_space.k_wise_indep_vars (measure_pmf p) k (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) R \<and>
   (\<forall>x. x \<in> R \<longrightarrow> map_pmf (\<lambda>\<omega>. \<omega> x) p = pmf_of_set B))"
 
 lemma indep:
   assumes "lim_balls_and_bins k p"
   shows "prob_space.k_wise_indep_vars (measure_pmf p) k (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) R"
   using assms lim_balls_and_bins_def by simp
 
 lemma ran:
   assumes "lim_balls_and_bins k p" "x \<in> R"
   shows "map_pmf (\<lambda>\<omega>. \<omega> x) p = pmf_of_set B"
   using assms lim_balls_and_bins_def by simp
 
 lemma Z_integrable:
   fixes f :: "real \<Rightarrow> real"
   assumes "lim_balls_and_bins k p"
   shows "integrable p (\<lambda>\<omega>. f (Z i \<omega>) )"
   unfolding Z_def using fin_R card_mono
   by (intro integrable_pmf_iff_bounded[where C="Max (abs ` f ` real ` {..card R})"])
    fastforce+
 
 lemma Z_any_integrable_2:
  fixes f :: "real \<Rightarrow> real"
   assumes "lim_balls_and_bins k p"
   shows "integrable p (\<lambda>\<omega>. f (Z i \<omega> + Z j \<omega>))"
 proof -
   have q:"real (card A) + real (card B) \<in> real ` {..2 * card R}" if "A \<subseteq> R" "B \<subseteq> R" for A B
   proof -
     have "card A + card B \<le> card R + card R"
       by (intro add_mono card_mono fin_R that)
     also have "... = 2 * card R" by simp
     finally show ?thesis by force
   qed
 
   thus ?thesis
     unfolding Z_def using fin_R card_mono abs_triangle_ineq
     by (intro integrable_pmf_iff_bounded[where C="Max (abs ` f ` real ` {..2*card R})"] Max_ge
         finite_imageI imageI) auto
 qed
 
 lemma hit_count_prod_exp:
   assumes "j1 \<in> B" "j2 \<in> B" "s+t \<le> k"
   assumes "lim_balls_and_bins k p"
   defines "L \<equiv> {(xs,ys). set xs \<subseteq> R \<and> set ys \<subseteq> R \<and>
     (set xs \<inter> set ys = {} \<or> j1 = j2) \<and> length xs = s \<and> length ys = t}"
   shows "(\<integral>\<omega>. Z j1 \<omega>^s * Z j2 \<omega>^t \<partial>p) =
     (\<Sum>(xs,ys) \<in> L. (1/real (card B))^(card (set xs \<union> set ys)))"
     (is "?L = ?R")
 proof -
   define W1 :: "'a \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> real"
     where "W1 = (\<lambda>i \<omega>. of_bool (\<omega> i = j1) :: real)"
   define W2 :: "'a \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> real"
     where "W2 = (\<lambda>i \<omega>. of_bool (\<omega> i = j2) :: real)"
   define \<tau> :: "'a list \<times> 'a list \<Rightarrow> 'a \<Rightarrow> 'b"
     where "\<tau> = (\<lambda>l x. if x \<in> set (fst l) then j1 else j2)"
 
   have \<tau>_check_1: "\<tau> l x = j1" if "x \<in> set (fst l)" and "l \<in> L" for x l
     using that unfolding \<tau>_def L_def by auto
   have \<tau>_check_2: "\<tau> l x = j2" if "x \<in> set (snd l)" and "l \<in> L" for x l
     using that unfolding \<tau>_def L_def by auto
   have \<tau>_check_3: "\<tau> l x \<in> B" for x l
     using assms(1,2) unfolding \<tau>_def by simp
 
   have Z1_eq: "Z j1 \<omega> = (\<Sum>i \<in> R. W1 i \<omega>)" for \<omega>
     using fin_R unfolding Z_def W1_def
     by (simp add:of_bool_def sum.If_cases Int_def)
 
   have Z2_eq: "Z j2 \<omega> = (\<Sum>i \<in> R. W2 i \<omega>)" for \<omega>
     using fin_R unfolding Z_def W2_def
     by (simp add:of_bool_def sum.If_cases Int_def)
 
   define \<alpha> where "\<alpha> = 1 / real (card B)"
 
   have a: "(\<integral>\<omega>. (\<Prod>x\<leftarrow>a. W1 x \<omega>) * (\<Prod>y\<leftarrow>b. W2 y \<omega>) \<partial>p) = 0" (is "?L1 = 0")
     if "x \<in> set a \<inter> set b" "j1 \<noteq> j2" "length a = s" "length b = t" for x a b
   proof -
     have  "(\<Prod>x\<leftarrow>a. W1 x \<omega>) * (\<Prod>y\<leftarrow>b. W2 y \<omega>) = 0" for \<omega>
     proof -
       have "W1 x \<omega> = 0 \<or> W2 x \<omega> = 0"
         unfolding W1_def W2_def using that by simp
       hence "(\<Prod>x\<leftarrow>a. W1 x \<omega>) = 0 \<or> (\<Prod>y\<leftarrow>b. W2 y \<omega>) = 0"
         unfolding prod_list_zero_iff using that(1) by auto
       thus ?thesis by simp
     qed
     hence "?L1 = (\<integral>\<omega>. 0 \<partial>p)"
       by (intro arg_cong2[where f="measure_pmf.expectation"]) auto
     also have "... = 0"
       by simp
     finally show ?thesis by simp
   qed
 
   have b: "prob_space.indep_vars p (\<lambda>_. discrete) (\<lambda>i \<omega>. \<omega> i) (set (fst x) \<union> set (snd x))"
     if "x \<in> L" for x
   proof -
     have "card (set (fst x) \<union> set (snd x)) \<le> card (set (fst x)) + card (set (snd x))"
       by (intro card_Un_le)
     also have "... \<le> length (fst x) + length (snd x)"
       by (intro add_mono card_length)
     also have "... = s + t"
       using that L_def by auto
     also have "... \<le> k" using assms(3) by simp
     finally have "card (set (fst x) \<union> set (snd x)) \<le> k" by simp
     moreover have "set (fst x) \<union> set (snd x) \<subseteq> R"
       using that L_def by auto
     ultimately show ?thesis
       by (intro prob_space.k_wise_indep_vars_subset[OF prob_space_measure_pmf indep[OF assms(4)]])
        auto
   qed
 
   have c: "(\<integral>\<omega>. of_bool (\<omega> x = z) \<partial>p) = \<alpha>" (is "?L1 = _")
     if "z \<in> B" "x \<in> R" for x z
   proof -
     have "?L1 = (\<integral>\<omega>. indicator {\<omega>. \<omega> x = z} \<omega> \<partial>p)"
       unfolding indicator_def by simp
     also have "... = measure p {\<omega>. \<omega> x = z}"
       by simp
     also have "... = measure (map_pmf (\<lambda>\<omega>. \<omega> x) p) {z}"
       by (subst measure_map_pmf) (simp add:vimage_def)
     also have "... = measure (pmf_of_set B) {z}"
       using that by (subst ran[OF assms(4)]) auto
     also have "... = 1/card B"
       using fin_B that by (subst measure_pmf_of_set) auto
     also have "... = \<alpha>"
       unfolding \<alpha>_def by simp
     finally show ?thesis by simp
   qed
 
   have d: "abs x \<le> 1 \<Longrightarrow> abs y \<le> 1 \<Longrightarrow> abs (x*y) \<le> 1" for x y :: real
     by (simp add:abs_mult mult_le_one)
   have e:"(\<And>x. x \<in> set xs \<Longrightarrow> abs x \<le>1) \<Longrightarrow> abs(prod_list xs) \<le> 1 " for xs :: "real list"
     using d by (induction xs, simp, simp)
 
   have "?L = (\<integral>\<omega>. (\<Sum>j \<in> R. W1 j \<omega>)^s * (\<Sum>j \<in> R. W2 j \<omega>)^t \<partial>p)"
     unfolding Z1_eq Z2_eq by simp
   also have "... = (\<integral>\<omega>. (\<Sum>xs | set xs \<subseteq> R \<and> length xs = s. (\<Prod>x \<leftarrow> xs. W1 x \<omega>)) *
                         (\<Sum>ys | set ys \<subseteq> R \<and> length ys = t. (\<Prod>y \<leftarrow> ys. W2 y \<omega>)) \<partial>p)"
     unfolding sum_power_distrib[OF fin_R] by simp
   also have "... = (\<integral>\<omega>.
     (\<Sum>l\<in>{xs. set xs \<subseteq> R \<and> length xs = s} \<times> {ys. set ys \<subseteq> R \<and> length ys = t}.
       (\<Prod>x\<leftarrow>fst l. W1 x \<omega>) * (\<Prod>y\<leftarrow>snd l. W2 y \<omega>)) \<partial>p)"
     by (intro arg_cong[where f="integral\<^sup>L p"])
       (simp add: sum_product sum.cartesian_product case_prod_beta)
   also have "... = (\<Sum>l\<in>{xs. set xs \<subseteq> R \<and> length xs = s} \<times> {ys. set ys \<subseteq> R \<and> length ys = t}.
     (\<integral>\<omega>. (\<Prod>x\<leftarrow>fst l. W1 x \<omega>) * (\<Prod>y\<leftarrow>snd l. W2 y \<omega>) \<partial>p))"
     unfolding W1_def W2_def
     by (intro integral_sum integrable_pmf_iff_bounded[where C="1"] d e) auto
   also have "... = (\<Sum>l\<in> L. (\<integral>\<omega>. (\<Prod>x\<leftarrow>fst l. W1 x \<omega>) * (\<Prod>y\<leftarrow>snd l. W2 y \<omega>) \<partial>p))"
     unfolding L_def using a by (intro sum.mono_neutral_right finite_cartesian_product
         finite_lists_length_eq fin_R) auto
   also have "... = (\<Sum>l\<in> L. (\<integral>\<omega>. (\<Prod>x\<leftarrow>fst l.
     of_bool(\<omega> x = \<tau> l x)) * (\<Prod>y\<leftarrow>snd l. of_bool(\<omega> y = \<tau> l y)) \<partial>p))"
     unfolding W1_def W2_def using \<tau>_check_1 \<tau>_check_2
     by (intro sum.cong arg_cong[where f="integral\<^sup>L p"] ext arg_cong2[where f="(*)"]
         arg_cong[where f="prod_list"]) auto
   also have "... = (\<Sum>l\<in> L. (\<integral>\<omega>. (\<Prod>x\<leftarrow>(fst l@snd l). of_bool(\<omega> x = \<tau> l x))\<partial> p))"
     by simp
   also have "... = (\<Sum>l\<in> L. (\<integral>\<omega>. (\<Prod>x \<in> set (fst l@snd l).
     of_bool(\<omega> x = \<tau> l x)^count_list (fst l@snd l) x) \<partial> p))"
     unfolding prod_list_eval by simp
   also have "... = (\<Sum>l\<in> L. (\<integral>\<omega>. (\<Prod>x \<in> set (fst l) \<union> set (snd l).
     of_bool(\<omega> x = \<tau> l x)^count_list (fst l@snd l) x) \<partial> p))"
     by simp
   also have "... = (\<Sum>l\<in> L. (\<integral>\<omega>. (\<Prod>x \<in> set (fst l) \<union> set (snd l). of_bool(\<omega> x = \<tau> l x)) \<partial> p))"
     using count_list_gr_1
     by (intro sum.cong arg_cong[where f="integral\<^sup>L p"] ext prod.cong) force+
   also have "... = (\<Sum>l\<in> L. (\<Prod>x \<in> set (fst l) \<union> set (snd l). (\<integral>\<omega>. of_bool(\<omega> x = \<tau> l x) \<partial> p)))"
     by (intro sum.cong prob_space.indep_vars_lebesgue_integral[OF prob_space_measure_pmf]
         integrable_pmf_iff_bounded[where C="1"]
         prob_space.indep_vars_compose2[OF prob_space_measure_pmf b]) auto
   also have "... = (\<Sum>l\<in> L. (\<Prod>x \<in> set (fst l) \<union> set (snd l). \<alpha>))"
     using \<tau>_check_3 unfolding L_def by (intro sum.cong prod.cong c) auto
   also have "... = (\<Sum>l \<in> L. \<alpha>^(card (set (fst l) \<union> set (snd l))))"
     by simp
   also have "... = ?R"
     unfolding L_def \<alpha>_def by (simp add:case_prod_beta)
   finally show ?thesis by simp
 qed
 
 lemma hit_count_prod_pow_eq:
   assumes "i \<in> B" "j \<in> B"
   assumes "lim_balls_and_bins k p"
   assumes "lim_balls_and_bins k q"
   assumes "s+t \<le> k"
   shows "(\<integral>\<omega>. (Z i \<omega>)^s * (Z j \<omega>)^t \<partial>p) = (\<integral>\<omega>. (Z i \<omega>)^s * (Z j \<omega>)^t \<partial>q)"
     unfolding hit_count_prod_exp[OF assms(1,2,5,3)]
     unfolding hit_count_prod_exp[OF assms(1,2,5,4)]
     by simp
 
 lemma hit_count_sum_pow_eq:
   assumes "i \<in> B" "j \<in> B"
   assumes "lim_balls_and_bins k p"
   assumes "lim_balls_and_bins k q"
   assumes "s \<le> k"
   shows "(\<integral>\<omega>. (Z i \<omega> + Z j \<omega>)^s \<partial>p) = (\<integral>\<omega>. (Z i \<omega> + Z j \<omega>)^s \<partial>q)"
     (is "?L = ?R")
 proof -
   have q2: "\<bar>Z i x ^ l * Z j x ^ (s - l)\<bar> \<le> real (card R ^ s)"
     if "l \<in> {..s}" for s i j l x
   proof -
     have "\<bar>Z i x ^ l * Z j x ^ (s - l)\<bar> \<le> Z i x ^ l * Z j x ^ (s - l)"
       unfolding Z_def by auto
     also have "... \<le> real (card R) ^ l * real (card R) ^ (s-l)"
       unfolding Z_def
       by (intro mult_mono power_mono of_nat_mono card_mono fin_R) auto
     also have "... = real (card R)^s" using that
       by (subst power_add[symmetric]) simp
     also have "... = real (card R^s)"
       by simp
     finally show ?thesis by simp
   qed
 
   have "?L = (\<integral>\<omega>. (\<Sum>l\<le>s. real (s choose l) * (Z i \<omega>^l * Z j \<omega>^(s-l))) \<partial>p)"
     by (subst binomial_ring) (simp add:algebra_simps)
   also have "... = (\<Sum>l\<le>s. (\<integral>\<omega>. real (s choose l) * (Z i \<omega>^l * Z j \<omega>^(s-l)) \<partial>p))"
     by (intro integral_sum integrable_mult_right
         integrable_pmf_iff_bounded[where C="card R^s"] q2) auto
   also have "... = (\<Sum>l\<le>s. real (s choose l) * (\<integral>\<omega>. (Z i \<omega>^l * Z j \<omega>^(s-l)) \<partial>p))"
     by (intro sum.cong integral_mult_right
         integrable_pmf_iff_bounded[where C="card R^s"] q2) auto
   also have "... = (\<Sum>l\<le>s. real (s choose l) * (\<integral>\<omega>. (Z i \<omega>^l * Z j \<omega>^(s-l)) \<partial>q))"
     using assms(5)
     by (intro_cong "[\<sigma>\<^sub>2 (*)]" more: sum.cong hit_count_prod_pow_eq[OF assms(1-4)])
        auto
   also have "... = (\<Sum>l\<le>s. (\<integral>\<omega>. real (s choose l) * (Z i \<omega>^l * Z j \<omega>^(s-l)) \<partial>q))"
     by (intro sum.cong integral_mult_right[symmetric]
         integrable_pmf_iff_bounded[where C="card R^s"] q2) auto
   also have "... = (\<integral>\<omega>. (\<Sum>l\<le>s. real (s choose l) * (Z i \<omega>^l * Z j \<omega>^(s-l))) \<partial>q)"
     by (intro integral_sum[symmetric] integrable_mult_right
         integrable_pmf_iff_bounded[where C="card R^s"] q2) auto
   also have "... = ?R"
     by (subst binomial_ring) (simp add:algebra_simps)
   finally show ?thesis by simp
 qed
 
 lemma hit_count_sum_poly_eq:
   assumes "i \<in> B" "j \<in> B"
   assumes "lim_balls_and_bins k p"
   assumes "lim_balls_and_bins k q"
   assumes "f \<in> \<bbbP> k"
   shows "(\<integral>\<omega>. f (Z i \<omega> + Z j \<omega>) \<partial>p) = (\<integral>\<omega>. f (Z i \<omega> + Z j \<omega>) \<partial>q)"
     (is "?L = ?R")
 proof -
   obtain fp where f_def: "f = poly fp" "degree fp \<le> k"
     using assms(5) unfolding Polynomials_def by auto
 
   have "?L = (\<Sum>d\<le>degree fp. (\<integral>\<omega>. poly.coeff fp d * (Z i \<omega> + Z j \<omega>) ^ d \<partial>p))"
     unfolding f_def poly_altdef
     by (intro integral_sum integrable_mult_right Z_any_integrable_2[OF assms(3)])
   also have "... = (\<Sum>d\<le>degree fp. poly.coeff fp d * (\<integral>\<omega>. (Z i \<omega> + Z j \<omega>) ^ d \<partial>p))"
     by (intro sum.cong integral_mult_right Z_any_integrable_2[OF assms(3)])
      simp
   also have "... = (\<Sum>d\<le>degree fp. poly.coeff fp d *(\<integral>\<omega>. (Z i \<omega> + Z j \<omega>) ^ d \<partial>q))"
     using f_def
     by (intro sum.cong arg_cong2[where f="(*)"] hit_count_sum_pow_eq[OF assms(1-4)]) auto
   also have "... = (\<Sum>d\<le>degree fp. (\<integral>\<omega>. poly.coeff fp d * (Z i \<omega> + Z j \<omega>) ^ d \<partial>q))"
     by (intro sum.cong) auto
   also have "... = ?R"
     unfolding f_def poly_altdef by (intro integral_sum[symmetric]
         integrable_mult_right Z_any_integrable_2[OF assms(4)])
   finally show ?thesis by simp
 qed
 
 lemma hit_count_poly_eq:
   assumes "b \<in> B"
   assumes "lim_balls_and_bins k p"
   assumes "lim_balls_and_bins k q"
   assumes "f \<in> \<bbbP> k"
   shows "(\<integral>\<omega>. f (Z b \<omega>) \<partial>p) = (\<integral>\<omega>. f (Z b \<omega>) \<partial>q)" (is "?L = ?R")
 proof -
   have a:"(\<lambda>a. f (a / 2)) \<in> \<bbbP> (k*1)"
     by (intro Polynomials_composeI[OF assms(4)] Polynomials_intros)
   have "?L = \<integral>\<omega>. f ((Z b \<omega> + Z b \<omega>)/2) \<partial>p"
     by simp
   also have "... = \<integral>\<omega>. f ((Z b \<omega> + Z b \<omega>)/2) \<partial>q"
     using a by (intro hit_count_sum_poly_eq[OF assms(1,1,2,3)]) simp
   also have "... = ?R" by simp
   finally show ?thesis by simp
 qed
 
 lemma lim_balls_and_bins_from_ind_balls_and_bins:
   "lim_balls_and_bins k \<Omega>"
 proof -
   have "prob_space.indep_vars (measure_pmf \<Omega>) (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) R"
     unfolding \<Omega>_def using indep_vars_Pi_pmf[OF fin_R] by metis
   hence "prob_space.indep_vars (measure_pmf \<Omega>) (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) J" if "J \<subseteq> R" for J
     using prob_space.indep_vars_subset[OF prob_space_measure_pmf _ that] by auto
   hence a:"prob_space.k_wise_indep_vars (measure_pmf \<Omega>) k (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) R"
     by (simp add:prob_space.k_wise_indep_vars_def[OF prob_space_measure_pmf])
 
   have b: "map_pmf (\<lambda>\<omega>. \<omega> x) \<Omega> = pmf_of_set B" if "x \<in> R" for x
     using that unfolding \<Omega>_def Pi_pmf_component[OF fin_R] by simp
 
   show ?thesis
     using a b fin_R fin_B unfolding lim_balls_and_bins_def by auto
 qed
 
 lemma hit_count_factorial_moments:
   assumes a:"j \<in> B"
   assumes "s \<le> k"
   assumes "lim_balls_and_bins k p"
   shows "(\<integral>\<omega>. ffact s (Z j \<omega>) \<partial>p) = ffact s (real (card R)) * (1 / real (card B))^s"
     (is "?L = ?R")
 proof -
   have "(\<lambda>x. ffact s (x-0::real)) \<in> \<bbbP> s"
     by (intro Polynomials_intros)
   hence b: "ffact s \<in> (\<bbbP> k :: (real \<Rightarrow> real) set)"
     using Polynomials_mono[OF assms(2)] by auto
 
   have "?L = (\<integral>\<omega>. ffact s (Z j \<omega>) \<partial>\<Omega>)"
     by (intro hit_count_poly_eq[OF a assms(3) lim_balls_and_bins_from_ind_balls_and_bins] b)
   also have "... = (\<integral>\<omega>. ffact s (\<Sum>i \<in> {j}. Z i \<omega>) \<partial>\<Omega>)"
     by simp
   also have "... = ffact s (real (card R)) * (real (card {j}) / real (card B)) ^ s "
     using assms(1)
     by (intro fact_moment_balls_and_bins fin_R fin_B) auto
   also have "... = ?R"
     by simp
   finally show ?thesis by simp
 qed
 
 lemma hit_count_factorial_moments_2:
   assumes a:"i \<in> B" "j \<in> B"
   assumes "i \<noteq> j" "s \<le> k" "card R \<le> card B"
   assumes "lim_balls_and_bins k p"
   shows "(\<integral>\<omega>. ffact s (Z i \<omega> + Z j \<omega>) \<partial>p) \<le> 2^s"
     (is "?L \<le> ?R")
 proof -
   have "(\<lambda>x. ffact s (x-0::real)) \<in> \<bbbP> s"
     by (intro Polynomials_intros)
   hence b: "ffact s \<in> (\<bbbP> k :: (real \<Rightarrow> real) set)"
     using Polynomials_mono[OF assms(4)] by auto
 
   have or_distrib: "(a \<and> b) \<or> (a \<and> c) \<longleftrightarrow> a \<and> (b \<or> c)" for a b c
     by auto
   have "?L = (\<integral>\<omega>. ffact s  (Z i \<omega> + Z j \<omega>) \<partial>\<Omega>)"
     by (intro hit_count_sum_poly_eq[OF a assms(6) lim_balls_and_bins_from_ind_balls_and_bins] b)
   also have "... = (\<integral>\<omega>. ffact s ((\<Sum>t \<in> {i,j}. Z t \<omega>)) \<partial>\<Omega>)"
     using assms(3) by simp
   also have "... = ffact s (real (card R)) * (real (card {i,j}) / real (card B)) ^ s "
     using assms(1,2)
     by (intro fact_moment_balls_and_bins fin_R fin_B) auto
   also have "... = real (ffact s (card R)) * (real (card {i,j}) / real (card B)) ^ s "
     by (simp add:of_nat_ffact)
   also have "... \<le> (card R)^s * (real (card {i,j}) / real (card B)) ^ s "
     by (intro mult_mono of_nat_mono ffact_bound, simp_all)
   also have "... \<le> (card B)^s * (real (2) / real (card B)) ^ s "
     using assms(3)
     by (intro mult_mono of_nat_mono power_mono assms(5), simp_all)
   also have "... = ?R"
     using card_B_gt_0 by (simp add:divide_simps)
   finally show ?thesis by simp
 qed
 
 lemma balls_and_bins_approx_helper:
   fixes x :: real
   assumes "x \<ge> 2"
   assumes "real k \<ge> 5*x / ln x"
   shows "k \<ge> 2"
     and "2^(k+3) / fact k \<le> (1/exp x)^2"
     and "2 / fact k \<le> 1 / (exp 1 * exp x)"
 proof -
   have ln_inv: "ln x = - ln (1/ x)"  if "x > 0" for x :: real
     using that by (subst ln_div, auto)
 
   have apx:
     "exp 1 \<le> (5::real)"
     "4 * ln 4 \<le>  (2 - 2*exp 1/5)*ln (450::real)"
     "ln 8 * 2 \<le> (450::real)"
     "4 / 5 * 2 * exp 1 + ln (5 / 4) * exp 1 \<le> (5::real)"
     "exp 1 \<le> (2::real)^4"
     by (approximation 10)+
 
   have "2 \<le> 5 * (x / (x-1))"
     using assms(1) by (simp add:divide_simps)
   also have "... \<le> 5 * (x / ln x)"
     using assms(1)
     by (intro mult_left_mono divide_left_mono ln_le_minus_one mult_pos_pos) auto
   also have "... \<le> k" using assms(2) by simp
   finally show k_ge_2: "k \<ge> 2" by simp
 
   have "ln x * (2 * exp 1) = ln (((4/5) * x)*(5/4)) * (2 * exp 1)"
     by simp
   also have "... = ln ((4/5) * x) * (2 * exp 1) + ln((5/4))*(2 * exp 1)"
     using assms(1) by (subst ln_mult, simp_all add:algebra_simps)
   also have "... < (4/5)* x * (2 * exp 1) + ln (5/4) * (x * exp 1)"
     using assms(1) by (intro add_less_le_mono mult_strict_right_mono ln_less_self
         mult_left_mono mult_right_mono)  (auto simp add:algebra_simps)
   also have "... = ((4/5) * 2 * exp 1 + ln(5/4) * exp 1) * x"
     by (simp add:algebra_simps)
   also have "... \<le> 5 * x"
     using assms(1) apx(4) by (intro mult_right_mono, simp_all)
   finally have 1: "ln x * (2 * exp 1) \<le> 5 * x" by simp
 
   have "ln 8 \<le> 3 * x - 5 * x * ln(2*exp 1 /5 * ln x) / ln x"
   proof (cases "x \<in> {2..450}")
     case True
     then show ?thesis by (approximation 10 splitting: x=10)
   next
     case False
     hence x_ge_450: "x \<ge> 450" using assms(1) by simp
 
     have "4 * ln 4 \<le>  (2 - 2*exp 1/5)*ln (450::real)"
       using apx(2) by (simp)
     also have "... \<le> (2 - 2*exp 1/5)* ln x"
       using x_ge_450 apx(1)
       by (intro mult_left_mono iffD2[OF ln_le_cancel_iff], simp_all)
     finally have "(2 - 2*exp 1/5) * ln x \<ge> 4 * ln 4" by simp
     hence "2*exp 1/5 * ln x + 0 \<le> 2 * exp 1 / 5 * ln x + ((2 - 2*exp 1/5) * ln x - 4 * ln 4)"
       by (intro add_mono) auto
     also have "... = 4 * (1/2) * ln x - 4 * ln 4"
       by (simp add:algebra_simps)
     also have "... = 4 * (ln (x powr (1/2)) - ln 4)"
       using x_ge_450 by (subst ln_powr, auto)
     also have "... = 4 * (ln (x powr (1/2)/4))"
       using x_ge_450 by (subst ln_div) auto
     also have "... < 4 * (x powr (1/2)/4)"
       using x_ge_450 by (intro mult_strict_left_mono ln_less_self) auto
     also have "... = x powr (1/2)" by simp
     finally have "2* exp 1/ 5 * ln x \<le> x powr (1/2)" by simp
     hence "ln(2* exp 1/ 5 * ln x) \<le> ln (x powr (1/2))"
       using x_ge_450 ln_le_cancel_iff by simp
     hence 0:"ln(2* exp 1/ 5 * ln x) / ln x \<le> 1/2"
       using x_ge_450 by (subst (asm) ln_powr, auto)
     have "ln 8 \<le> 3 * x - 5 * x * (1/2)"
       using x_ge_450 apx(3) by simp
     also have "... \<le> 3 * x - 5 * x * (ln(2* exp 1/ 5 * ln x) / ln x)"
       using x_ge_450 by (intro diff_left_mono mult_left_mono 0) auto
     finally show ?thesis by simp
   qed
 
   hence "2 * x + ln 8 \<le> 2 * x + (3 * x - 5 * x * ln(2*exp 1 /5 * ln x) / ln x)"
     by (intro add_mono, auto)
   also have "... = 5 * x + 5 * x * ln(5 / (2*exp 1*ln x)) / ln x"
     using assms(1) by (subst ln_inv) (auto simp add:algebra_simps)
   also have "... = 5 * x * (ln x + ln(5 / (2*exp 1*ln x))) / ln x"
     using assms(1) by (simp add:algebra_simps add_divide_distrib)
   also have "... = 5 * x * (ln (5 * x / (2 * exp 1 * ln x))) / ln x"
     using assms(1) by (subst ln_mult[symmetric], auto)
   also have "... = (5 * x / ln x) * ln ((5 * x / ln x) / (2 * exp 1))"
     by (simp add:algebra_simps)
   also have "... \<le> k * ln (k / (2*exp 1))"
     using assms(1,2) 1 k_ge_2
     by (intro mult_mono iffD2[OF ln_le_cancel_iff] divide_right_mono)
      auto
   finally have "k * ln (k/(2*exp 1)) \<ge> 2*x + ln 8" by simp
   hence "k * ln(2*exp 1/k) \<le> -2*x - ln 8"
     using k_ge_2 by (subst ln_inv, auto)
   hence "ln ((2*exp 1/k) powr k) \<le> ln(exp(-2*x)) - ln 8"
     using k_ge_2 by (subst ln_powr, auto)
   also have "... = ln(exp(-2*x)/8)"
     by (simp add:ln_div)
   finally have "ln ((2*exp 1/k) powr k) \<le>  ln (exp(-2*x)/8)" by simp
   hence 1: "(2*exp 1/k) powr k \<le>  exp(-2*x)/8"
     using k_ge_2 assms(1) by (subst (asm) ln_le_cancel_iff) auto
   have "2^(k+3)/fact k \<le> 2^(k+3)/(k / exp 1)^k"
     using k_ge_2 by (intro divide_left_mono fact_lower_bound_1) auto
   also have "... = 8 * 2^k * (exp 1 / k)^k"
     by (simp add:power_add algebra_simps power_divide)
   also have "... = 8 * (2*exp 1/k) powr k"
     using k_ge_2 powr_realpow
     by (simp add:power_mult_distrib[symmetric])
   also have "... \<le> 8 * (exp(-2*x)/8)"
     by (intro mult_left_mono 1) auto
   also have "... = exp((-x)*2)"
     by simp
   also have "... = exp(-x)^2"
     by (subst exp_powr[symmetric], simp)
   also have "... = (1/exp x)^2"
     by (simp add: exp_minus inverse_eq_divide)
   finally show 2:"2^(k+3)/fact k \<le> (1/exp x)^2" by simp
 
   have "(2::real)/fact k = (2^(k+3)/fact k)/(2^(k+2))"
     by (simp add:divide_simps power_add)
   also have "... \<le> (1/exp x)^2/(2^(k+2))"
     by (intro divide_right_mono 2, simp)
   also have "... \<le> (1/exp x)^1/(2^(k+2))"
     using assms(1) by (intro divide_right_mono power_decreasing) auto
   also have "... \<le> (1/exp x)^1/(2^4)"
     using k_ge_2 by (intro divide_left_mono power_increasing) auto
   also have "... \<le> (1/exp x)^1/exp(1)"
     using k_ge_2 apx(5) by (intro divide_left_mono) auto
   also have "... = 1/(exp 1 * exp x)" by simp
   finally show "(2::real)/fact k \<le> 1/(exp 1 * exp x)" by simp
 qed
 
 text \<open>Bounds on the expectation and variance in the k-wise independent case. Here the indepedence
 assumption is improved by a factor of two compared to the result in the paper.\<close>
 
 lemma
   assumes "card R \<le> card B"
   assumes "\<And>c. lim_balls_and_bins (k+1) (p c)"
   assumes "\<epsilon> \<in> {0<..1/exp(2)}"
   assumes "k \<ge> 5 * ln (card B / \<epsilon>) / ln (ln (card B / \<epsilon>))"
   shows
     exp_approx: "\<bar>measure_pmf.expectation (p True) Y - measure_pmf.expectation (p False) Y\<bar> \<le>
       \<epsilon> * real (card R)" (is "?A") and
     var_approx: "\<bar>measure_pmf.variance (p True) Y - measure_pmf.variance (p False) Y\<bar> \<le> \<epsilon>\<^sup>2"
       (is "?B")
 proof -
   let ?p1 = "p False"
   let ?p2 = "p True"
 
   have "exp (2::real) = 1/ (1/exp 2)" by simp
   also have "... \<le> 1/ \<epsilon>"
     using assms(3) by (intro divide_left_mono) auto
   also have "... \<le> real (card B)/ \<epsilon>"
     using assms(3) card_B_gt_0 by (intro divide_right_mono) auto
   finally have "exp 2 \<le> real (card B) / \<epsilon>" by simp
   hence k_condition_h: "2 \<le> ln (card B / \<epsilon>)"
     using assms(3) card_B_gt_0 by (subst ln_ge_iff) auto
   have k_condition_h_2: "0 < real (card B) / \<epsilon>"
     using assms(3) card_B_gt_0 by (intro divide_pos_pos) auto
 
   note k_condition = balls_and_bins_approx_helper[OF k_condition_h assms(4)]
 
   define \<phi> :: "real \<Rightarrow> real" where "\<phi> = (\<lambda>x. min x 1)"
 
   define f where "f = (\<lambda>x. 1 -  (-1)^k / real (fact k) * ffact k (x-1))"
   define g where "g = (\<lambda>x. \<phi> x - f x)"
   have \<phi>_exp: "\<phi> x = f x + g x" for x
     unfolding g_def by simp
 
   have k_ge_2: "k \<ge> 2"
     using k_condition(1) by simp
 
   define \<gamma> where "\<gamma> = 1 / real (fact k)"
   have \<gamma>_nonneg: "\<gamma> \<ge> 0"
     unfolding \<gamma>_def by simp
 
   have k_le_k_plus_1: "k \<le> k+1"
     by simp
 
   have "f \<in> \<bbbP> k"
     unfolding f_def by (intro Polynomials_intros)
   hence f_poly: "f \<in> \<bbbP> (k+1)"
     using Polynomials_mono[OF k_le_k_plus_1] by auto
 
   have g_diff: "\<bar>g x - g (x-1)\<bar> = ffact (k-1) (x-2) / fact (k-1)"
     if "x \<ge> k" for x :: real
   proof -
     have "x \<ge> 2" using k_ge_2 that by simp
     hence "\<phi> x = \<phi> (x- 1)"
       unfolding \<phi>_def by simp
     hence "\<bar>g x - g (x-1)\<bar> = \<bar>f (x-1) - f x\<bar>"
       unfolding g_def by (simp add:algebra_simps)
     also have "... = \<bar>(-1)^k / real (fact k) * (ffact k (x-2) - ffact k (x-1))\<bar>"
       unfolding f_def by (simp add:algebra_simps)
     also have "... = 1 / real (fact k) * \<bar>ffact k (x-1) - ffact k ((x-1)-1)\<bar>"
       by (simp add:abs_mult)
     also have "... = 1 / real (fact k) * real k * \<bar>ffact (k-1) (x-2)\<bar>"
       by (subst ffact_suc_diff, simp add:abs_mult)
     also have "... = \<bar>ffact (k-1) (x-2)\<bar> / fact (k-1)"
       using k_ge_2 by (subst fact_reduce) auto
     also have "... = ffact (k-1) (x-2) / fact (k-1)"
       unfolding ffact_eq_fact_mult_binomial using that k_ge_2
       by (intro arg_cong2[where f="(/)"] abs_of_nonneg ffact_nonneg) auto
     finally show ?thesis by simp
   qed
 
 
   have f_approx_\<phi>: "f x = \<phi> x" if f_approx_\<phi>_1: "x \<in> real ` {0..k}" for x
   proof (cases "x = 0")
     case True
     hence "f x  =  1 - (-1)^k / real (fact k) * (\<Prod>i = 0..<k. - (real i+1))"
       unfolding f_def prod_ffact[symmetric] by (simp add:algebra_simps)
     also have "... = 1 - (-1)^k / real (fact k) * ((\<Prod>i = 0..<k. (- 1)::real) * (\<Prod>i = 0..<k. real i+1))"
       by (subst prod.distrib[symmetric]) simp
     also have "... = 1 - (-1)^k / real (fact k) * ((-1)^k * (\<Prod>i \<in> (\<lambda>x. x + 1) ` {0..<k}. real i))"
       by (subst prod.reindex, auto simp add:inj_on_def comp_def algebra_simps)
     also have "... = 1 - (-1)^k / real (fact k) * ((-1)^k * (\<Prod>i \<in> {1..k}. real i))"
       by (intro arg_cong2[where f="(-)"] arg_cong2[where f="(*)"] prod.cong refl) auto
     also have "... = 0"
       unfolding fact_prod by simp
     also have "... = \<phi> x"
       using True \<phi>_def by simp
     finally show ?thesis by simp
   next
     case False
     hence a: " x \<ge> 1" using that by auto
     obtain x' where x'_def: "x' \<in> {0..k}" "x = real x'"
       using f_approx_\<phi>_1 by auto
     hence "x' - 1 \<in> {0..<k}" using k_ge_2 by simp
     moreover have "x- real 1 = real (x'-1)"
       using False x'_def(2) by simp
     ultimately have b: "x - 1 = real (x' - 1)" "x' - 1 < k"
       by auto
 
     have "f x =  1 - (- 1) ^ k / real (fact k) * real (ffact k (x' - 1))"
       unfolding f_def b of_nat_ffact by simp
     also have "... = 1"
       using b by (subst ffact_nat_triv, auto)
     also have "... = \<phi> x"
       unfolding \<phi>_def using a by auto
     finally show ?thesis by simp
   qed
 
   have q2: "\<bar>Z i x ^ l * Z j x ^ (s - l)\<bar> \<le> real (card R ^ s)"
     if "l \<in> {..s}" for s i j l x
   proof -
     have "\<bar>Z i x ^ l * Z j x ^ (s - l)\<bar> \<le> Z i x ^ l * Z j x ^ (s - l)"
       unfolding Z_def by auto
     also have "... \<le> real (card R) ^ l * real (card R) ^ (s-l)"
       unfolding Z_def
       by (intro mult_mono power_mono of_nat_mono card_mono fin_R) auto
     also have "... = real (card R)^s" using that
       by (subst power_add[symmetric]) simp
     also have "... = real (card R^s)"
       by simp
     finally show ?thesis by simp
   qed
 
   have q:"real (card A) + real (card B) \<in> real ` {..2 * card R}" if "A \<subseteq> R" "B \<subseteq> R" for A B
   proof -
     have "card A + card B \<le> card R + card R"
       by (intro add_mono card_mono fin_R that)
     also have "... = 2 * card R" by simp
     finally show ?thesis by force
   qed
 
   have g_eq_0_iff_2: "abs (g x) * y = 0" if "x \<in> \<int>" "x \<ge> 0" "x \<le> k" for x y :: real
   proof -
     have "\<exists>x'. x = real_of_int x' \<and> x' \<le> k \<and> x' \<ge> 0"
       using that Ints_def by fastforce
     hence "\<exists>x'. x = real x' \<and> x' \<le> k"
       by (metis nat_le_iff of_nat_nat)
     hence "x \<in> real ` {0..k}"
       by auto
     hence "g x = 0"
       unfolding g_def using f_approx_\<phi> by simp
     thus ?thesis by simp
   qed
 
   have g_bound_abs: "\<bar>\<integral>\<omega>. g (f \<omega>) \<partial>p\<bar> \<le> (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) * \<gamma>"
     (is "?L \<le> ?R")
     if "range f \<subseteq> real ` {..m}" for m and p :: "('a \<Rightarrow> 'b) pmf" and f :: "('a \<Rightarrow> 'b) \<Rightarrow> real"
   proof -
     have f_any_integrable:
       "integrable p (\<lambda>\<omega>. h (f \<omega>))" for h :: "real \<Rightarrow> real"
       using that
       by (intro integrable_pmf_iff_bounded[where C="Max (abs ` h` real ` {..m})"]
           Max_ge finite_imageI imageI) auto
 
     have f_val: "f \<omega> \<in> real ` {..m}" for \<omega> using  that by auto
     hence f_nat: "f \<omega> \<in> \<nat>" for \<omega>
       unfolding Nats_def by auto
 
     have f_int: "f \<omega> \<ge> real y + 1" if "f \<omega> > real y" for y \<omega>
     proof -
       obtain x where x_def: "f \<omega> = real x" "x \<le> m" using f_val by auto
       hence "y < x" using that by simp
       hence "y + 1 \<le> x" by simp
       then show ?thesis using x_def by simp
     qed
 
     have f_nonneg: "f \<omega> \<ge> 0" for \<omega>
     proof -
       obtain x where x_def: "f \<omega> = real x" "x \<le> m" using f_val by auto
       hence "x \<ge> 0" by simp
       then show ?thesis using x_def by simp
     qed
 
     have "\<not>(real x \<le> f \<omega>)" if "x > m" for x \<omega>
     proof -
       obtain x where x_def: "f \<omega> = real x" "x \<le> m" using f_val by auto
       then show ?thesis using x_def that by simp
     qed
 
     hence max_Z1: "measure p {\<omega>. real x \<le> f \<omega>} = 0" if "x > m" for x
       using that by auto
 
     have "?L \<le> (\<integral>\<omega>. \<bar>g (f \<omega>)\<bar> \<partial>p)"
       by (intro integral_abs_bound)
     also have "... = (\<Sum>y\<in>real ` {..m}. \<bar>g y\<bar> * measure p {\<omega>. f \<omega> = y})"
       using that by (intro pmf_exp_of_fin_function) auto
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> * measure p {\<omega>. f \<omega> = real y})"
       by (subst sum.reindex) (auto simp add:comp_def)
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> *
       (measure p ({\<omega>. f \<omega> = real y} \<union> {\<omega>. f \<omega> > y}) - measure p {\<omega>. f \<omega> > y}))"
       by (subst measure_Union) auto
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> * (measure p {\<omega>. f \<omega> \<ge> y} - measure p {\<omega>. f \<omega> > y}))"
       by (intro sum.cong arg_cong2[where f="(*)"] arg_cong2[where f="(-)"]
           arg_cong[where f="measure p"]) auto
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> * measure p {\<omega>. f \<omega> \<ge> y}) -
       (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> * measure p {\<omega>. f \<omega> > y})"
       by (simp add:algebra_simps sum_subtractf)
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> * measure p {\<omega>. f \<omega> \<ge> y}) -
                      (\<Sum>y\<in>{..m}. \<bar>g (real y)\<bar> * measure p {\<omega>. f \<omega> \<ge> real (y+1)})"
       using f_int
       by (intro sum.cong arg_cong2[where f="(-)"] arg_cong2[where f="(*)"]
           arg_cong[where f="measure p"]) fastforce+
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)    \<bar> * measure p {\<omega>. f \<omega> \<ge> real y}) -
                (\<Sum>y\<in>Suc ` {..m}. \<bar>g (real y - 1)\<bar> * measure p {\<omega>. f \<omega> \<ge> real y})"
       by (subst sum.reindex) (auto simp add:comp_def)
     also have "... = (\<Sum>y\<in>{..m}. \<bar>g (real y)    \<bar> * measure p {\<omega>. f \<omega> \<ge> real y}) -
                     (\<Sum>y\<in>{1..m}. \<bar>g (real y - 1)\<bar> * measure p {\<omega>. f \<omega> \<ge> real y})"
       using max_Z1 image_Suc_atMost
       by (intro arg_cong2[where f="(-)"] sum.mono_neutral_cong) auto
     also have "... = (\<Sum>y\<in>{k+1..m}. \<bar>g (real y)    \<bar> * measure p {\<omega>. f \<omega> \<ge> y}) -
                      (\<Sum>y\<in>{k+1..m}. \<bar>g (real y - 1)\<bar> * measure p {\<omega>. f \<omega> \<ge> y})"
       using k_ge_2
       by (intro arg_cong2[where f="(-)"] sum.mono_neutral_cong_right ballI g_eq_0_iff_2)
         auto
     also have "... = (\<Sum>y\<in>{k+1..m}. (\<bar>g (real y)\<bar> - \<bar>g (real y-1)\<bar>) * measure p {\<omega>. f \<omega> \<ge> y})"
       by (simp add:algebra_simps sum_subtractf)
     also have "... \<le> (\<Sum>y\<in>{k+1..m}. \<bar>g (real y)- g (real y-1)\<bar> *
       measure p {\<omega>. ffact (k+1) (f \<omega>) \<ge> ffact (k+1) (real y)})"
-      using ffact_mono by (intro sum_mono mult_mono measure_pmf.pmf_mono[OF refl]) auto
+      using ffact_mono by (intro sum_mono mult_mono pmf_mono) auto
     also have "... = (\<Sum>y\<in>{k+1..m}. (ffact (k-1) (real y-2) / fact (k-1)) *
       measure p {\<omega>. ffact (k+1) (f \<omega>) \<ge> ffact (k+1) (real y)})"
       by (intro sum.cong, simp_all add: g_diff)
     also have "... \<le> (\<Sum>y\<in>{k+1..m}. (ffact (k-1) (real y-2) / fact (k-1)) *
       ((\<integral>\<omega>. ffact (k+1) (f \<omega>)\<partial>p) / ffact (k+1) (real y)))"
       using k_ge_2 f_nat
       by (intro sum_mono mult_left_mono pmf_markov f_any_integrable
           divide_nonneg_pos ffact_of_nat_nonneg ffact_pos) auto
     also have "... = (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) * (\<Sum>y\<in>{k+1..m}.
        ffact (k-1) (real y - 2) / ffact (Suc (Suc (k-1))) (real y))"
       using k_ge_2 by (simp add:algebra_simps sum_distrib_left)
     also have "... = (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) * (\<Sum>y\<in>{k+1..m}.
        ffact (k-1) (real y - 2) / (real y * (real y - 1) * ffact (k-1) (real y - 2)))"
       by (subst ffact_Suc, subst ffact_Suc, simp)
     also have "... = (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) *
       (\<Sum>y\<in>{k+1..m}. 1 / (real y * (real y - 1)))"
       using order.strict_implies_not_eq[OF ffact_pos] k_ge_2
       by (intro arg_cong2[where f="(*)"] sum.cong) auto
     also have "... = (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) *
       (\<Sum>y\<in>{Suc k..m}. 1 / (real y - 1) - 1/(real y))"
       using k_ge_2 by (intro arg_cong2[where f="(*)"] sum.cong) (auto simp add: divide_simps)
     also have "... = (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) *
       (\<Sum>y\<in>{Suc k..m}.  (-1/(real y)) - (-1 / (real (y - 1))))"
       using k_ge_2 by (intro arg_cong2[where f="(*)"] sum.cong) (auto)
     also have "... =  (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) *
       (of_bool (k \<le> m) * (1/real k-1/real m))"
       by (subst sum_telescope_eq, auto)
     also have "... \<le>  (\<integral>\<omega>. ffact (k+1) (f \<omega>) \<partial>p) / fact (k-1) * (1 / real k)"
       using k_ge_2 f_nat
       by (intro mult_left_mono divide_nonneg_nonneg integral_nonneg
           ffact_of_nat_nonneg) auto
     also have "... = ?R"
       using k_ge_2 unfolding \<gamma>_def by (cases k) (auto simp add:algebra_simps)
     finally show ?thesis by simp
   qed
 
   have z1_g_bound: "\<bar>\<integral>\<omega>. g (Z i \<omega>) \<partial>p c\<bar> \<le> (real (card R) / real (card B)) * \<gamma>"
     (is "?L1 \<le> ?R1") if "i \<in> B" for i c
   proof -
 
     have "?L1 \<le> (\<integral>\<omega>. ffact (k+1) (Z i \<omega>) \<partial>p c) * \<gamma>"
       unfolding Z_def using fin_R
       by (intro g_bound_abs[where m1="card R"]) (auto intro!:imageI card_mono)
     also have "... = ffact (k+1) (real (card R)) * (1 / real (card B))^(k+1) * \<gamma>"
       using that by (subst hit_count_factorial_moments[OF _ _ assms(2)], simp_all)
     also have "... = real (ffact (k+1) (card R)) * (1 / real (card B))^(k+1) * \<gamma>"
       by (simp add:of_nat_ffact)
     also have "... \<le> real (card R^(k+1)) * (1 / real (card B))^(k+1) * \<gamma>"
       using \<gamma>_nonneg
       by (intro mult_right_mono of_nat_mono ffact_bound, simp_all)
     also have "... \<le> (real (card R) / real (card B))^(k+1) * \<gamma>"
       by (simp add:divide_simps)
     also have "... \<le> (real (card R) / real (card B))^1 * \<gamma>"
       using assms(1) card_B_gt_0 \<gamma>_nonneg by (intro mult_right_mono power_decreasing) auto
     also have "... = ?R1" by simp
     finally show ?thesis by simp
   qed
 
   have g_add_bound: "\<bar>\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>p c\<bar> \<le> 2^(k+1) * \<gamma>"
     (is "?L1 \<le> ?R1") if ij_in_B: "i \<in> B" "j \<in> B" "i \<noteq> j" for i j c
   proof -
     have "?L1 \<le> (\<integral>\<omega>. ffact (k+1) (Z i \<omega> + Z j \<omega>) \<partial>p c) * \<gamma>"
       unfolding Z_def using assms(1)
       by (intro g_bound_abs[where m1="2*card R"]) (auto intro!:imageI q)
     also have "... \<le> 2^(k+1) * \<gamma>"
       by (intro \<gamma>_nonneg mult_right_mono hit_count_factorial_moments_2[OF that(1,2,3) _ assms(1,2)])
         auto
     finally show ?thesis by simp
   qed
 
   have Z_poly_diff:
     "\<bar>(\<integral>\<omega>. \<phi> (Z i \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi> (Z i \<omega>) \<partial>?p2)\<bar> \<le> 2 * ((real (card R) / card B) * \<gamma>)"
     (is "?L \<le> 2 * ?R") if "i \<in> B" for i
   proof -
     note Z_poly_eq =
       hit_count_poly_eq[OF that assms(2)[of "True"] assms(2)[of "False"] f_poly]
 
     have "?L = \<bar>(\<integral>\<omega>. f (Z i \<omega>) \<partial>?p1) + (\<integral>\<omega>. g (Z i \<omega>) \<partial>?p1) -
       (\<integral>\<omega>. f (Z i \<omega>) \<partial>?p2) - (\<integral>\<omega>. g (Z i \<omega>) \<partial>?p2)\<bar>"
       using Z_integrable[OF assms(2)] unfolding \<phi>_exp by simp
     also have "... = \<bar>(\<integral>\<omega>. g (Z i \<omega>) \<partial>?p1) + (- (\<integral>\<omega>. g (Z i \<omega>) \<partial>?p2))\<bar>"
       by (subst Z_poly_eq) auto
     also have "... \<le> \<bar>(\<integral>\<omega>. g (Z i \<omega>) \<partial>?p1)\<bar> + \<bar>(\<integral>\<omega>. g (Z i \<omega>) \<partial>?p2)\<bar>"
       by simp
     also have "... \<le> ?R + ?R"
       by (intro add_mono z1_g_bound that)
     also have "... = 2 * ?R"
       by (simp add:algebra_simps)
     finally show ?thesis by simp
   qed
 
   have Z_poly_diff_2: "\<bar>(\<integral>\<omega>. \<phi> (Z i \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi> (Z i \<omega>) \<partial>?p2)\<bar> \<le> 2 * \<gamma>"
     (is "?L \<le> ?R") if "i \<in> B" for i
   proof -
     have "?L \<le> 2 * ((real (card R) / real (card B)) * \<gamma>)"
       by (intro Z_poly_diff that)
     also have "... \<le> 2 * (1 * \<gamma>)"
       using assms fin_B that \<gamma>_nonneg card_gt_0_iff
       by (intro mult_mono that iffD2[OF pos_divide_le_eq]) auto
     also have "... = ?R" by simp
     finally show ?thesis by simp
   qed
 
   have Z_poly_diff_3: "\<bar>(\<integral>\<omega>. \<phi> (Z i \<omega> + Z j \<omega>) \<partial>?p2) - (\<integral>\<omega>. \<phi> (Z i \<omega> + Z j \<omega>) \<partial>?p1)\<bar> \<le> 2^(k+2)*\<gamma>"
     (is "?L \<le> ?R") if "i \<in> B" "j \<in> B" "i \<noteq> j" for i j
   proof -
     note Z_poly_eq_2 =
       hit_count_sum_poly_eq[OF that(1,2) assms(2)[of "True"] assms(2)[of "False"] f_poly]
 
     have "?L = \<bar>(\<integral>\<omega>. f (Z i \<omega> + Z j \<omega>) \<partial>?p2) + (\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>?p2) -
       (\<integral>\<omega>. f (Z i \<omega> + Z j \<omega>) \<partial>?p1) - (\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>?p1)\<bar>"
       using Z_any_integrable_2[OF assms(2)] unfolding \<phi>_exp by simp
     also have "... = \<bar>(\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>?p2) + (- (\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>?p1))\<bar>"
       by (subst Z_poly_eq_2) auto
     also have "... \<le> \<bar>(\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>?p1)\<bar> + \<bar>(\<integral>\<omega>. g (Z i \<omega> + Z j \<omega>) \<partial>?p2)\<bar>"
       by simp
     also have "... \<le> 2^(k+1)*\<gamma> + 2^(k+1)*\<gamma>"
       by (intro add_mono g_add_bound that)
     also have "... = ?R"
       by (simp add:algebra_simps)
     finally show ?thesis by simp
   qed
 
 
   have Y_eq: "Y \<omega> = (\<Sum>i \<in> B. \<phi> (Z i \<omega>))" if "\<omega> \<in> set_pmf (p c)" for c \<omega>
   proof -
     have "\<omega> ` R \<subseteq> B"
     proof (rule image_subsetI)
       fix x assume a:"x \<in> R"
       have "\<omega> x \<in> set_pmf (map_pmf (\<lambda>\<omega>. \<omega> x) (p c))"
         using that by (subst set_map_pmf) simp
       also have "... = set_pmf (pmf_of_set B)"
         by (intro arg_cong[where f="set_pmf"] assms ran[OF assms(2)] a)
       also have "... = B"
         by (intro set_pmf_of_set fin_B B_ne)
       finally show "\<omega> x \<in> B" by simp
     qed
     hence "(\<omega> ` R) = B \<inter> \<omega> ` R"
       by auto
     hence "Y \<omega> = card (B \<inter> \<omega> ` R)"
       unfolding Y_def by auto
     also have  "... = (\<Sum>i \<in> B. of_bool (i \<in> \<omega> ` R))"
       unfolding of_bool_def using fin_B by (subst sum.If_cases) auto
     also have  "... = (\<Sum>i \<in> B. of_bool (card {r \<in> R.  \<omega> r = i} > 0))"
       using fin_R by (intro sum.cong arg_cong[where f="of_bool"])
         (auto simp add:card_gt_0_iff)
     also have "... = (\<Sum>i \<in> B. \<phi>(Z i \<omega>))"
       unfolding \<phi>_def Z_def by (intro sum.cong) (auto simp add:of_bool_def)
     finally show ?thesis by simp
   qed
 
   let ?\<phi>2 = "(\<lambda>x y. \<phi> x + \<phi> y - \<phi> (x+y))"
   let ?Bd = "{x \<in> B \<times> B. fst x \<noteq> snd x}"
 
   have Y_sq_eq': "Y \<omega>^ 2 = (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) + Y \<omega>"
     (is "?L = ?R") if "\<omega> \<in> set_pmf (p c)" for c \<omega>
   proof -
     have a: "\<phi> (Z x \<omega>) = of_bool(card {r \<in> R. \<omega> r = x} > 0)" for x
       unfolding \<phi>_def Z_def by auto
     have b: "\<phi> (Z x \<omega> + Z y \<omega>) =
       of_bool( card {r \<in> R. \<omega> r = x} > 0 \<or> card {r \<in> R. \<omega> r = y} > 0)" for x y
       unfolding \<phi>_def Z_def by auto
     have c: "\<phi> (Z x \<omega>) * \<phi>(Z y \<omega>) = ?\<phi>2 (Z x \<omega>) (Z y \<omega>)"  for x y
       unfolding a b of_bool_def by auto
     have d: "\<phi> (Z x \<omega>) * \<phi>(Z x \<omega>) = \<phi> (Z x \<omega>)"  for x
       unfolding a of_bool_def by auto
 
     have "?L = (\<Sum>i\<in>B \<times> B. \<phi> (Z (fst i) \<omega>) * \<phi> (Z (snd i) \<omega>))"
       unfolding Y_eq[OF that] power2_eq_square sum_product sum.cartesian_product
       by (simp add:case_prod_beta)
     also have "... = (\<Sum>i\<in>?Bd \<union> {x \<in> B \<times> B. fst x = snd x}. \<phi> (Z (fst i) \<omega>) * \<phi> (Z (snd i) \<omega>))"
       by (intro sum.cong refl) auto
     also have "... = (\<Sum>i\<in>?Bd. \<phi> (Z (fst i) \<omega>) * \<phi> (Z (snd i) \<omega>)) +
       (\<Sum>i\<in>{x \<in> B \<times> B. fst x = snd x}. \<phi> (Z (fst i) \<omega>) * \<phi> (Z (snd i) \<omega>))"
       using assms fin_B  by (intro sum.union_disjoint, auto)
     also have "... = (\<Sum>i\<in>?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) +
       (\<Sum>i\<in>{x \<in> B \<times> B. fst x = snd x}. \<phi> (Z (fst i) \<omega>) * \<phi> (Z (fst i) \<omega>))"
       unfolding c by (intro arg_cong2[where f="(+)"] sum.cong) auto
     also have "... = (\<Sum>i\<in>?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) +
       (\<Sum>i\<in>fst ` {x \<in> B \<times> B. fst x = snd x}. \<phi> (Z i \<omega>) * \<phi> (Z i \<omega>))"
       by (subst sum.reindex, auto simp add:inj_on_def)
     also have "... = (\<Sum>i\<in>?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) + (\<Sum>i \<in> B. \<phi> (Z i \<omega>))"
       using d by (intro arg_cong2[where f="(+)"] sum.cong refl d) (auto simp add:image_iff)
     also have "... = ?R"
       unfolding Y_eq[OF that] by simp
     finally show ?thesis by simp
   qed
 
   have "\<bar>integral\<^sup>L ?p1 Y - integral\<^sup>L ?p2 Y\<bar> =
     \<bar>(\<integral>\<omega>. (\<Sum>i \<in> B. \<phi>(Z i \<omega>)) \<partial>?p1) - (\<integral>\<omega>. (\<Sum>i \<in> B. \<phi>(Z i \<omega>)) \<partial>?p2)\<bar>"
     by (intro arg_cong[where f="abs"] arg_cong2[where f="(-)"]
         integral_cong_AE AE_pmfI Y_eq) auto
   also have "... =
     \<bar>(\<Sum>i \<in> B. (\<integral>\<omega>. \<phi>(Z i \<omega>) \<partial>?p1)) - (\<Sum>i \<in> B. (\<integral>\<omega>. \<phi>(Z i \<omega>) \<partial>?p2))\<bar>"
     by (intro arg_cong[where f="abs"] arg_cong2[where f="(-)"]
         integral_sum Z_integrable[OF assms(2)])
   also have "... = \<bar>(\<Sum>i \<in> B. (\<integral>\<omega>. \<phi>(Z i \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z i \<omega>) \<partial>?p2))\<bar>"
     by (subst sum_subtractf) simp
   also have "... \<le> (\<Sum>i \<in> B. \<bar>(\<integral>\<omega>. \<phi>(Z i \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z i \<omega>) \<partial>?p2)\<bar>)"
     by simp
   also have "... \<le> (\<Sum>i \<in> B. 2 * ((real (card R) / real (card B)) *\<gamma>))"
     by (intro sum_mono Z_poly_diff)
   also have "... \<le> 2 * real (card R) *\<gamma>"
     using \<gamma>_nonneg by (simp)
   finally have Y_exp_diff_1: "\<bar>integral\<^sup>L ?p1 Y - integral\<^sup>L ?p2 Y\<bar> \<le> 2 * real (card R) *\<gamma>"
     by simp
 
   have "\<bar>integral\<^sup>L ?p1 Y - integral\<^sup>L ?p2 Y\<bar> \<le> (2 / fact k) * real (card R)"
     using Y_exp_diff_1 by (simp add:algebra_simps \<gamma>_def)
   also have "... \<le>  1 / (exp 1 * (real (card B) / \<epsilon>)) * card R"
     using k_condition(3) k_condition_h_2 by (intro mult_right_mono) auto
   also have "... =  \<epsilon> / (exp 1 * real (card B)) * card R"
     by simp
   also have "... \<le> \<epsilon> / (1 * 1) * card R"
     using assms(3) card_B_gt_0
     by (intro mult_right_mono divide_left_mono mult_mono) auto
   also have "... = \<epsilon> * card R"
     by simp
   finally show ?A
     by simp
 
   have "\<bar>integral\<^sup>L ?p1 Y - integral\<^sup>L ?p2 Y\<bar> \<le>  2 * real (card R) *\<gamma>"
     using Y_exp_diff_1 by simp
   also have "... \<le> 2 * real (card B) *\<gamma>"
     by (intro mult_mono of_nat_mono assms \<gamma>_nonneg) auto
   finally have Y_exp_diff_2:
     "\<bar>integral\<^sup>L ?p1 Y - integral\<^sup>L ?p2 Y\<bar> \<le> 2 *\<gamma> * real (card B)"
     by (simp add:algebra_simps)
 
   have int_Y: "integrable (measure_pmf (p c)) Y" for c
     using fin_R card_image_le unfolding Y_def
     by (intro integrable_pmf_iff_bounded[where C="card R"])  auto
 
   have int_Y_sq: "integrable (measure_pmf (p c)) (\<lambda>\<omega>. Y \<omega>^2)" for c
     using fin_R card_image_le unfolding Y_def
     by (intro integrable_pmf_iff_bounded[where C="real (card R)^2"]) auto
 
   have "\<bar>(\<integral>\<omega>. (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) \<partial>?p1) -
      (\<integral>\<omega>. (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) \<partial>?p2)\<bar>
     \<le> \<bar>(\<Sum>i \<in> ?Bd.
     (\<integral>\<omega>. \<phi> (Z (fst i) \<omega>) \<partial>?p1) + (\<integral>\<omega>. \<phi>(Z (snd i) \<omega>) \<partial>?p1) -
     (\<integral>\<omega>. \<phi> (Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p1) - ( (\<integral>\<omega>. \<phi>(Z (fst i) \<omega>) \<partial>?p2) +
     (\<integral>\<omega>. \<phi> (Z (snd i) \<omega>) \<partial>?p2) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p2)))\<bar>" (is "?R3 \<le> _ ")
     using Z_integrable[OF assms(2)] Z_any_integrable_2[OF assms(2)]
     by (simp add:integral_sum sum_subtractf)
   also have "... = \<bar>(\<Sum>i \<in> ?Bd.
     ((\<integral>\<omega>. \<phi> (Z (fst i) \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega>) \<partial>?p2)) +
     ((\<integral>\<omega>. \<phi> (Z (snd i) \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z (snd i) \<omega>) \<partial>?p2)) +
     ((\<integral>\<omega>. \<phi> (Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p2) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p1)))\<bar>"
     by (intro arg_cong[where f="abs"] sum.cong) auto
   also have "... \<le> (\<Sum>i \<in> ?Bd. \<bar>
     ((\<integral>\<omega>. \<phi> (Z (fst i) \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega>) \<partial>?p2)) +
     ((\<integral>\<omega>. \<phi> (Z (snd i) \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z (snd i) \<omega>) \<partial>?p2)) +
     ((\<integral>\<omega>. \<phi> (Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p2) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p1))\<bar>)"
     by (intro sum_abs)
   also have "... \<le> (\<Sum>i \<in> ?Bd.
     \<bar>(\<integral>\<omega>. \<phi> (Z (fst i) \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega>) \<partial>?p2)\<bar> +
     \<bar>(\<integral>\<omega>. \<phi> (Z (snd i) \<omega>) \<partial>?p1) - (\<integral>\<omega>. \<phi>(Z (snd i) \<omega>) \<partial>?p2)\<bar> +
     \<bar>(\<integral>\<omega>. \<phi> (Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p2) - (\<integral>\<omega>. \<phi>(Z (fst i) \<omega> + Z (snd i) \<omega>) \<partial>?p1)\<bar>)"
     by (intro sum_mono) auto
   also have "... \<le> (\<Sum>i \<in> ?Bd. 2*\<gamma> + 2 *\<gamma> + 2^(k+2)*\<gamma>)"
     by (intro sum_mono add_mono Z_poly_diff_2 Z_poly_diff_3) auto
   also have "... = (2^(k+2)+4) *\<gamma> * real (card ?Bd)"
     by (simp add:algebra_simps)
   finally have Y_sq_exp_diff_1:"?R3 \<le> (2^(k+2)+4) *\<gamma> * real (card ?Bd)"
     by simp
 
   have "\<bar>(\<integral>\<omega>. Y \<omega> ^2 \<partial>?p1) - (\<integral>\<omega>. Y \<omega>^2 \<partial>?p2)\<bar> =
     \<bar>(\<integral>\<omega>. (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) + Y \<omega> \<partial>?p1) -
      (\<integral>\<omega>. (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) + Y \<omega> \<partial>?p2)\<bar>"
     by (intro_cong "[\<sigma>\<^sub>2 (-), \<sigma>\<^sub>1 abs]" more:  integral_cong_AE AE_pmfI Y_sq_eq') auto
   also have "... \<le> \<bar>(\<integral>\<omega>. Y \<omega> \<partial>?p1) - (\<integral>\<omega>. Y \<omega> \<partial>?p2)\<bar> +
     \<bar>(\<integral>\<omega>. (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) \<partial>?p1) -
     (\<integral>\<omega>. (\<Sum>i \<in> ?Bd. ?\<phi>2 (Z (fst i) \<omega>) (Z (snd i) \<omega>)) \<partial>?p2)\<bar>"
     using Z_integrable[OF assms(2)] Z_any_integrable_2[OF assms(2)] int_Y by simp
   also have "... \<le>  2 *\<gamma> * real (card B) + ?R3"
     by (intro add_mono Y_exp_diff_2, simp)
   also have "... \<le> (2^(k+2)+4) *\<gamma> * real (card B) + (2^(k+2)+4) *\<gamma> * real (card ?Bd)"
     using  \<gamma>_nonneg by (intro add_mono Y_sq_exp_diff_1 mult_right_mono) auto
   also have "... = (2^(k+2)+4) *\<gamma> * (real (card B) + real (card ?Bd))"
     by (simp add:algebra_simps)
   also have "... = (2^(k+2)+4) * \<gamma> * real (card B)^2"
     using power2_nat_le_imp_le
     by (simp add:card_distinct_pairs of_nat_diff)
   finally have Y_sq_exp_diff:
     "\<bar>(\<integral>\<omega>. Y \<omega> ^2 \<partial>?p1) - (\<integral>\<omega>. Y \<omega>^2 \<partial>?p2)\<bar> \<le> (2^(k+2)+4) *\<gamma> * real (card B)^2" by simp
 
   have Y_exp_rough_bound: "\<bar>integral\<^sup>L (p c) Y\<bar> \<le> card B" (is "?L \<le> ?R") for c
   proof -
     have "?L \<le> (\<integral>\<omega>. \<bar>Y \<omega>\<bar> \<partial>(p c))"
       by (intro integral_abs_bound)
     also have "... \<le> (\<integral>\<omega>. real (card R)  \<partial>(p c))"
       unfolding Y_def using card_image_le[OF fin_R]
       by (intro integral_mono integrable_pmf_iff_bounded[where C="card R"])
        auto
     also have "... = card R" by simp
     also have "... \<le> card B" using assms by simp
     finally show ?thesis by simp
   qed
 
   have "\<bar>measure_pmf.variance ?p1 Y - measure_pmf.variance ?p2 Y\<bar> =
     \<bar>(\<integral>\<omega>. Y \<omega> ^2 \<partial>?p1) - (\<integral>\<omega>. Y \<omega> \<partial> ?p1)^2 - ((\<integral>\<omega>. Y \<omega> ^2 \<partial>?p2) - (\<integral>\<omega>. Y \<omega> \<partial> ?p2)^2)\<bar>"
     by (intro_cong "[\<sigma>\<^sub>2 (-), \<sigma>\<^sub>1 abs]" more: measure_pmf.variance_eq int_Y int_Y_sq)
   also have "... \<le> \<bar>(\<integral>\<omega>. Y \<omega>^2 \<partial>?p1) - (\<integral>\<omega>. Y \<omega>^2 \<partial>?p2)\<bar> + \<bar>(\<integral>\<omega>. Y \<omega> \<partial> ?p1)\<^sup>2 - (\<integral>\<omega>. Y \<omega> \<partial> ?p2)\<^sup>2\<bar>"
     by simp
   also have "... = \<bar>(\<integral>\<omega>. Y \<omega>^2 \<partial>?p1) - (\<integral>\<omega>. Y \<omega>^2 \<partial>?p2)\<bar> +
     \<bar>(\<integral>\<omega>. Y \<omega> \<partial> ?p1) - (\<integral>\<omega>. Y \<omega> \<partial> ?p2)\<bar>*\<bar>(\<integral>\<omega>. Y \<omega> \<partial> ?p1) + (\<integral>\<omega>. Y \<omega> \<partial> ?p2)\<bar>"
     by (simp add:power2_eq_square algebra_simps abs_mult[symmetric])
   also have "... \<le> (2^(k+2)+4) *\<gamma> * real (card B)^2 + (2*\<gamma> *real (card B)) *
     (\<bar>\<integral>\<omega>. Y \<omega> \<partial>?p1\<bar> + \<bar>\<integral>\<omega>. Y \<omega> \<partial> ?p2\<bar>)"
     using \<gamma>_nonneg
     by (intro add_mono mult_mono divide_left_mono Y_sq_exp_diff Y_exp_diff_2) auto
   also have "... \<le> (2^(k+2)+4)*\<gamma> * real (card B)^2 + (2*\<gamma> * real (card B)) *
     (real (card B) + real (card B))"
     using \<gamma>_nonneg by (intro add_mono mult_left_mono Y_exp_rough_bound) auto
   also have "... = (2^(k+2)+2^3) * \<gamma> * real (card B)^2"
     by (simp add:algebra_simps power2_eq_square)
   also have "... \<le> (2^(k+2)+2^(k+2)) * \<gamma> * real (card B)^2"
     using k_ge_2 \<gamma>_nonneg
     by (intro mult_right_mono add_mono power_increasing, simp_all)
   also have "... = (2^(k+3) / fact k) * card B^2"
     by (simp add:power_add \<gamma>_def)
   also have "... \<le> (1 / (real (card B) / \<epsilon>))^2 * card B^2"
     using k_condition(2) k_condition_h_2
     by (intro mult_right_mono) auto
   also have "... = \<epsilon>^2"
     using card_B_gt_0 by (simp add:divide_simps)
   finally show ?B
     by simp
 qed
 
 lemma
   assumes "card R \<le> card B"
   assumes "lim_balls_and_bins (k+1) p"
   assumes "k \<ge> 7.5 * (ln (card B) + 2)"
   shows exp_approx_2: "\<bar>measure_pmf.expectation p Y - \<mu>\<bar> \<le> card R / sqrt (card B)"
       (is "?AL \<le> ?AR")
     and var_approx_2: "measure_pmf.variance p Y  \<le> real (card R)^2 / card B"
       (is "?BL \<le> ?BR")
 proof -
   define q where "q = (\<lambda>c. if c then \<Omega> else p)"
 
   have q_altdef: "q True = \<Omega>" "q False = p"
     unfolding q_def by auto
 
   have a:"lim_balls_and_bins (k+1) (q c)" for c
     unfolding q_def using assms lim_balls_and_bins_from_ind_balls_and_bins by auto
 
   define \<epsilon> :: real where "\<epsilon> = min (sqrt (1/card B)) (1 / exp 2)"
 
   have c: "\<epsilon> \<in> {0<..1 / exp 2}"
     using card_B_gt_0 unfolding \<epsilon>_def by auto
 
   have b: "5 * ln (card B / \<epsilon>) / ln (ln (card B / \<epsilon>)) \<le> real k"
   proof (cases "card B \<ge> exp 4")
     case True
     hence "sqrt(1/card B) \<le> sqrt(1/exp 4)"
       using card_B_gt_0 by (intro real_sqrt_le_mono divide_left_mono) auto
     also have "... = (1/exp 2)"
       by (subst powr_half_sqrt[symmetric]) (auto simp add:powr_divide exp_powr)
     finally have "sqrt(1/card B) \<le> (1 / exp 2)" by simp
     hence \<epsilon>_eq: "\<epsilon> = sqrt(1 /card B)"
       unfolding \<epsilon>_def by simp
 
     have "exp (6::real) = (exp 4) powr (3/2)"
       by (simp add:exp_powr)
     also have "...\<le> card B powr (3/2)"
       by (intro powr_mono2 True) auto
     finally have q4:"exp 6 \<le> card B powr (3/2)" by simp
 
     have "(2::real) \<le> exp 6"
       by (approximation 5)
     hence q1: "2 \<le> real (card B) powr (3 / 2)"
       using q4 by argo
     have "(1::real) < ln(exp 6)"
       by (approximation 5)
     also have "... \<le> ln (card B powr (3 / 2))"
       using card_B_gt_0 by (intro iffD2[OF ln_le_cancel_iff] q4) auto
     finally have q2: "1 < ln (card B powr (3 / 2))" by simp
     have "exp (exp (1::real)) \<le> exp 6"
       by (approximation 5)
     also have "... \<le> card B powr (3/2)" using q4 by simp
     finally have "exp (exp 1) \<le> card B powr (3/2)"
       by simp
     hence q3: "1\<le>ln(ln (card B powr (3/2)))"
       using card_B_gt_0 q1 by (intro iffD2[OF ln_ge_iff] ln_gt_zero, auto)
 
     have "5 * ln (card B / \<epsilon>) / ln (ln (card B / \<epsilon>)) =
       5 * ln (card B powr (1+1/2)) / ln(ln (card B powr (1+1/2)))"
       unfolding powr_add by (simp add:real_sqrt_divide  powr_half_sqrt[symmetric] \<epsilon>_eq)
     also have "... \<le> 5 * ln (card B powr (1+1/2)) / 1"
       using True q1 q2 q3 by (intro divide_left_mono mult_nonneg_nonneg mult_pos_pos
           ln_ge_zero ln_gt_zero) auto
     also have "... = 5 * (1+1/2) * ln(card B)"
       using card_B_gt_0 by (subst ln_powr) auto
     also have "... = 7.5 * ln(card B)" by simp
     also have "... \<le> k" using assms(3) by simp
     finally show ?thesis by simp
   next
     case False
     have "(1::real) / exp 2 \<le> sqrt(1 / exp 4)"
       by (simp add:real_sqrt_divide powr_half_sqrt[symmetric] exp_powr)
     also have "...\<le> sqrt(1 /card B)"
       using False card_B_gt_0
       by (intro real_sqrt_le_mono divide_left_mono mult_pos_pos) auto
     finally have "1 / exp 2 \<le> sqrt(1/card B)"
       by simp
     hence \<epsilon>_eq: "\<epsilon> = 1/ exp 2"
       unfolding \<epsilon>_def by simp
 
     have q2:"5 * (ln x + 2) / ln (ln x + 2) \<le> 7.5 * (ln x + 2)"
       if "x \<in> {1..exp 4}" for x:: real
       using that by (approximation 10 splitting: x=10)
 
     have "5 * ln (card B / \<epsilon>) / ln (ln (card B / \<epsilon>)) =
           5 * (ln (card B) +2) / ln (ln (card B) + 2)"
       using card_B_gt_0 unfolding \<epsilon>_eq by (simp add:ln_mult)
     also have "... \<le> 7.5 * (ln (card B) + 2)"
       using False card_B_gt_0 by (intro q2) auto
     also have "... \<le> k" using assms(3) by simp
     finally show ?thesis by simp
   qed
 
   have "?AL = \<bar>(\<integral>\<omega>. Y \<omega> \<partial>(q True)) - (\<integral>\<omega>. Y \<omega> \<partial>(q False))\<bar>"
     using exp_balls_and_bins unfolding q_def by simp
   also have "... \<le> \<epsilon> * card R"
     by (intro exp_approx[OF assms(1) a c b])
   also have "... \<le> sqrt (1 / card B) * card R"
     unfolding \<epsilon>_def by (intro mult_right_mono) auto
   also have "... = ?AR" using real_sqrt_divide by simp
   finally show "?AL \<le> ?AR" by simp
 
   show "?BL \<le> ?BR"
   proof (cases "R= {}")
     case True
     then show ?thesis unfolding Y_def by simp
   next
     case "False"
     hence "card R > 0" using fin_R by auto
     hence card_R_ge_1: "real (card R) \<ge> 1" by simp
 
     have "?BL \<le> measure_pmf.variance (q True) Y +
       \<bar>measure_pmf.variance (q True) Y - measure_pmf.variance (q False) Y\<bar>"
       unfolding q_def by auto
     also have "... \<le> measure_pmf.variance (q True) Y + \<epsilon>^2"
       by (intro add_mono var_approx[OF assms(1) a c b]) auto
     also have "... \<le> measure_pmf.variance (q True) Y + sqrt(1 / card B)^2"
       unfolding \<epsilon>_def by (intro add_mono power_mono) auto
     also have "... \<le> card R * (real (card R) - 1) / card B + sqrt(1 / card B)^2"
       unfolding q_altdef  by (intro add_mono var_balls_and_bins) auto
     also have "... = card R * (real (card R) - 1) / card B + 1 / card B"
       by (auto simp add:power_divide real_sqrt_divide)
     also have "... \<le> card R * (real (card R) - 1) / card B + card R / card B"
       by (intro add_mono divide_right_mono card_R_ge_1) auto
     also have "... = (card R * (real (card R) - 1) + card R) / card B"
       by argo
     also have "... = ?BR"
       by (simp add:algebra_simps power2_eq_square)
     finally show "?BL \<le> ?BR" by simp
   qed
 qed
 
 lemma devitation_bound:
   assumes "card R \<le> card B"
   assumes "lim_balls_and_bins k p"
   assumes "real k \<ge> C\<^sub>2 * ln (real (card B)) + C\<^sub>3"
   shows "measure p {\<omega>. \<bar>Y \<omega> - \<mu>\<bar> > 9 * real (card R) / sqrt (real (card B))} \<le> 1 / 2^6"
     (is "?L \<le> ?R")
 proof (cases "card R > 0")
   case True
 
   define k' :: nat where "k' = k - 1"
   have "(1::real) \<le> 7.5 * 0 + 16" by simp
   also have "... \<le> 7.5 * ln (real (card B)) + 16"
     using card_B_ge_1 by (intro add_mono mult_left_mono ln_ge_zero) auto
   also have "... \<le> k"  using assms(3) unfolding C\<^sub>2_def C\<^sub>3_def by simp
   finally have k_ge_1: "k \<ge> 1" by simp
   have lim: "lim_balls_and_bins (k'+1) p"
     using k_ge_1 assms(2) unfolding  k'_def by simp
 
   have k'_min: "real k' \<ge> 7.5 * (ln (real (card B)) + 2)"
     using k_ge_1 assms(3) unfolding C\<^sub>2_def C\<^sub>3_def k'_def by simp
 
   let ?r = "real (card R)"
   let ?b = "real (card B)"
   have a: "integrable p (\<lambda>\<omega>. (Y \<omega>)\<^sup>2)"
     unfolding Y_def
     by (intro integrable_pmf_iff_bounded[where C="real (card R)^2"])
      (auto intro!: card_image_le[OF fin_R])
 
   have "?L \<le> \<P>(\<omega> in measure_pmf p. \<bar>Y \<omega>- (\<integral>\<omega>. Y \<omega> \<partial>p)\<bar> \<ge> 8*?r / sqrt ?b)"
-  proof (rule measure_pmf.pmf_mono[OF refl])
+  proof (rule pmf_mono)
     fix \<omega> assume "\<omega> \<in> set_pmf p"
     assume a:"\<omega> \<in> {\<omega>. 9 * real (card R) / sqrt (real (card B)) < \<bar>Y \<omega> - \<mu>\<bar>}"
     have "8 * ?r / sqrt ?b = 9 * ?r / sqrt ?b - ?r / sqrt ?b"
       by simp
     also have "... \<le>  \<bar>Y \<omega> - \<mu>\<bar> - \<bar> (\<integral>\<omega>. Y \<omega> \<partial>p) - \<mu>\<bar>"
       using a by (intro diff_mono exp_approx_2[OF assms(1) lim k'_min]) simp
     also have "... \<le> \<bar>Y \<omega> - (\<integral>\<omega>. Y \<omega> \<partial>p)\<bar>"
       by simp
     finally have "8 * ?r / sqrt ?b \<le> \<bar>Y \<omega> - (\<integral>\<omega>. Y \<omega> \<partial>p)\<bar>" by simp
     thus "\<omega> \<in> {\<omega> \<in> space (measure_pmf p). 8 * ?r / sqrt ?b \<le> \<bar>Y \<omega> - (\<integral>\<omega>. Y \<omega> \<partial>p)\<bar>}"
       by simp
   qed
   also have "... \<le> measure_pmf.variance p Y / (8*?r / sqrt ?b)^2"
     using True card_B_gt_0 a
     by (intro measure_pmf.Chebyshev_inequality) auto
   also have "... \<le> (?r^2 / ?b) / (8*?r / sqrt ?b)^2"
     by (intro divide_right_mono var_approx_2[OF assms(1) lim k'_min]) simp
   also have "... = 1/2^6"
     using card_B_gt_0 True
     by (simp add:power2_eq_square)
   finally show ?thesis by simp
 next
   case False
   hence "R = {}" "card R = 0" using fin_R by auto
   thus ?thesis
     unfolding Y_def \<mu>_def by simp
 qed
 
 end
 
 unbundle no_intro_cong_syntax
 
 end
\ No newline at end of file
diff --git a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Preliminary.thy b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Preliminary.thy
--- a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Preliminary.thy
+++ b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Preliminary.thy
@@ -1,349 +1,336 @@
 section \<open>Preliminary Results\<close>
 
 text \<open>This section contains various short preliminary results used in the sections below.\<close>
 
 theory Distributed_Distinct_Elements_Preliminary
   imports
     Frequency_Moments.Frequency_Moments_Preliminary_Results
-    Frequency_Moments.Product_PMF_Ext
+    Universal_Hash_Families.Universal_Hash_Families_More_Product_PMF
     Median_Method.Median
     Expander_Graphs.Extra_Congruence_Method
     Expander_Graphs.Constructive_Chernoff_Bound
     Frequency_Moments.Landau_Ext
     Stirling_Formula.Stirling_Formula
 begin
 
 unbundle intro_cong_syntax
 
-text \<open>Simplified versions of measure theoretic results for pmfs:\<close>
-
-lemma measure_pmf_cong:
-  assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> x \<in> P \<longleftrightarrow> x \<in> Q"
-  shows "measure (measure_pmf p) P = measure (measure_pmf p)  Q"
-  using assms
-  by (intro finite_measure.finite_measure_eq_AE AE_pmfI) auto
+text \<open>The following aliases are here to prevent possible merge-conflicts. The lemmas have been moved
+to @{theory "Universal_Hash_Families.Universal_Hash_Families_More_Product_PMF"}.\<close>
 
-lemma pmf_mono:
-  assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> x \<in> P \<Longrightarrow> x \<in> Q"
-  shows "measure (measure_pmf p) P \<le> measure (measure_pmf p) Q"
-proof -
-  have "measure (measure_pmf p) P = measure (measure_pmf p) (P \<inter> (set_pmf p))"
-    by (intro measure_pmf_cong) auto
-  also have "... \<le> measure (measure_pmf p) Q"
-    using assms by (intro finite_measure.finite_measure_mono) auto
-  finally show ?thesis by simp
-qed
+lemmas measure_pmf_cong = measure_pmf_cong
+lemmas pmf_mono = pmf_mono
 
 lemma pmf_rev_mono:
   assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> x \<notin> Q \<Longrightarrow> x \<notin> P"
   shows "measure p P \<le> measure p Q"
   using assms by (intro pmf_mono) blast
 
 lemma pmf_exp_mono:
   fixes f g :: "'a \<Rightarrow> real"
   assumes "integrable (measure_pmf p) f" "integrable (measure_pmf p) g"
   assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> f x \<le> g x"
   shows "integral\<^sup>L (measure_pmf p) f \<le> integral\<^sup>L (measure_pmf p) g"
   using assms  by (intro integral_mono_AE AE_pmfI) auto
 
 lemma pmf_markov:
   assumes "integrable (measure_pmf p) f" "c > 0"
   assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> f x \<ge> 0"
   shows "measure p {\<omega>. f \<omega> \<ge> c} \<le> (\<integral>\<omega>. f \<omega> \<partial>p)/ c" (is "?L \<le> ?R")
 proof -
   have a:"AE \<omega> in (measure_pmf p). 0 \<le> f \<omega>"
     by (intro AE_pmfI assms(3))
   have b:"{} \<in> measure_pmf.events p"
     unfolding assms(1) by simp
 
   have "?L = \<P>(\<omega> in (measure_pmf p). f \<omega> \<ge> c)"
     using assms(1) by simp
   also have "... \<le>  ?R"
     by (intro  integral_Markov_inequality_measure[OF _ b] assms a)
   finally show ?thesis by simp
 qed
 
 lemma pmf_add:
   assumes  "\<And>x. x \<in> P \<Longrightarrow> x \<in> set_pmf p \<Longrightarrow> x \<in> Q \<or> x \<in> R"
   shows "measure p P \<le> measure p Q + measure p R"
 proof -
   have "measure p P \<le> measure p (Q \<union> R)"
     using assms by (intro pmf_mono) blast
   also have "... \<le> measure p Q + measure p R"
     by (rule measure_subadditive, auto)
   finally show ?thesis by simp
 qed
 
 lemma pair_pmf_prob_left:
   "measure_pmf.prob (pair_pmf A B) {\<omega>. P (fst \<omega>)} = measure_pmf.prob A {\<omega>. P \<omega>}" (is "?L = ?R")
 proof -
   have "?L = measure_pmf.prob (map_pmf fst (pair_pmf A B)) {\<omega>. P \<omega>}"
     by (subst measure_map_pmf) simp
   also have "... = ?R"
     by (subst map_fst_pair_pmf) simp
   finally show ?thesis by simp
 qed
 
 lemma pmf_exp_of_fin_function:
   assumes "finite A" "g ` set_pmf p \<subseteq> A"
   shows "(\<integral>\<omega>. f (g \<omega>) \<partial>p) = (\<Sum>y \<in> A. f y * measure p {\<omega>. g \<omega> = y})"
     (is "?L = ?R")
 proof -
   have "?L = integral\<^sup>L (map_pmf g p) f"
     using integral_map_pmf assms by simp
   also have "... = (\<Sum>a\<in>A. f a * pmf (map_pmf g p) a)"
     using assms
     by (intro integral_measure_pmf_real) auto
   also have " ... = (\<Sum>y \<in> A. f y * measure p (g -` {y}))"
     unfolding assms(1) by (intro_cong "[\<sigma>\<^sub>2 (*)]" more:sum.cong pmf_map)
   also have "... = ?R"
     by (intro sum.cong) (auto simp add: vimage_def)
   finally show ?thesis by simp
 qed
 
 text \<open>Cardinality rules for distinct/ordered pairs of a set without the finiteness constraint - to
 use in simplification:\<close>
 
 lemma card_distinct_pairs:
   "card {x \<in> B \<times> B. fst x \<noteq> snd x} = card B^2 - card B" (is "card ?L = ?R")
 proof (cases "finite B")
   case True
   include intro_cong_syntax
   have "card ?L = card (B \<times> B - (\<lambda>x. (x,x)) ` B)"
     by (intro arg_cong[where f="card"]) auto
   also have "... = card (B \<times> B) - card ((\<lambda>x. (x,x)) ` B)"
     by (intro card_Diff_subset finite_imageI True image_subsetI) auto
   also have "... = ?R"
     using True by (intro_cong "[\<sigma>\<^sub>2 (-)]" more: card_image)
       (auto simp add:power2_eq_square inj_on_def)
   finally show ?thesis by simp
 next
   case False
   then obtain p where p_in: "p \<in> B" by fastforce
   have "False" if "finite ?L"
   proof -
     have "(\<lambda>x. (p,x)) ` (B - {p}) \<subseteq> ?L"
       using p_in by (intro image_subsetI) auto
     hence "finite ((\<lambda>x. (p,x)) ` (B - {p}))"
       using finite_subset that by auto
     hence "finite (B - {p})"
       by (rule finite_imageD) (simp add:inj_on_def)
     hence "finite B"
       by simp
     thus "False" using False by simp
   qed
   hence "infinite ?L" by auto
   hence "card ?L = 0" by simp
   also have "... = ?R"
     using False by simp
   finally show ?thesis by simp
 qed
 
 lemma card_ordered_pairs':
   fixes M :: "('a ::linorder) set"
   shows "card {(x,y) \<in> M \<times> M. x < y} = card M * (card M - 1) / 2"
 proof (cases "finite M")
   case True
   show ?thesis using card_ordered_pairs[OF True] by linarith
 next
   case False
   then obtain p where p_in: "p \<in> M" by fastforce
   let ?f= "(\<lambda>x. if x < p then (x,p) else (p,x))"
   have "False" if "finite {(x,y) \<in> M \<times> M. x < y}" (is "finite ?X")
   proof -
     have "?f ` (M-{p}) \<subseteq> ?X"
       using p_in by (intro image_subsetI) auto
     hence "finite (?f ` (M-{p}))" using that finite_subset by auto
     moreover have "inj_on ?f (M-{p})"
       by (intro inj_onI) (metis Pair_inject)
     ultimately have "finite (M - {p})"
       using finite_imageD by blast
     hence "finite M"
       using finite_insert[where a="p" and A="M-{p}"] by simp
     thus "False" using False by simp
   qed
   hence "infinite ?X" by auto
   then show ?thesis using False by simp
 qed
 
 text \<open>The following are versions of the mean value theorem, where the interval endpoints may be
 reversed.\<close>
 
 lemma MVT_symmetric:
   assumes "\<And>x. \<lbrakk>min a b \<le> x; x \<le> max a b\<rbrakk> \<Longrightarrow> DERIV f x :> f' x"
   shows "\<exists>z::real. min a b \<le> z \<and> z \<le> max a b \<and> (f b - f a = (b - a) * f' z)"
 proof -
   consider (a) "a < b" | (b) "a = b" | (c) "a > b"
     by argo
   then show ?thesis
   proof (cases)
     case a
     then obtain z :: real where r: "a < z" "z < b" "f b - f a = (b - a) * f' z"
       using assms MVT2[where a="a" and b="b" and f="f" and f'="f'"] by auto
     have "a \<le> z" "z \<le> b" using r(1,2) by auto
     thus ?thesis using a r(3) by auto
   next
     case b
     then show ?thesis by auto
   next
     case c
     then obtain z :: real where r: "b < z" "z < a" "f a - f b = (a - b) * f' z"
       using assms MVT2[where a="b" and b="a" and f="f" and f'="f'"] by auto
     have "f b - f a = (b-a) * f' z" using r by argo
     moreover have "b \<le> z" "z \<le> a" using r(1,2) by auto
     ultimately show ?thesis using c by auto
   qed
 qed
 
 lemma MVT_interval:
   fixes I :: "real set"
   assumes "interval I" "a \<in> I" "b \<in> I"
   assumes "\<And>x. x \<in> I \<Longrightarrow> DERIV f x :> f' x"
   shows "\<exists>z. z \<in> I \<and> (f b - f a = (b - a) * f' z)"
 proof -
   have a:"min a b \<in> I"
     using assms(2,3) by (cases "a < b") auto
   have b:"max a b \<in> I"
     using assms(2,3) by (cases "a < b") auto
   have c:"x \<in> {min a b..max a b} \<Longrightarrow> x \<in> I" for x
     using interval_def assms(1) a b by auto
   have "\<lbrakk>min a b \<le> x; x \<le> max a b\<rbrakk> \<Longrightarrow> DERIV f x :> f' x" for x
     using c assms(4) by auto
   then obtain z where z:"z \<ge> min a b" "z \<le> max a b" "f b - f a = (b-a) * f' z"
     using MVT_symmetric by blast
   have "z \<in> I"
     using c z(1,2) by auto
   thus ?thesis using z(3) by auto
 qed
 
 text \<open>Ln is monotone on the positive numbers and thus commutes with min and max:\<close>
 lemma ln_min_swap:
   "x > (0::real) \<Longrightarrow> (y > 0) \<Longrightarrow> ln (min x y) = min (ln x) (ln y)"
   using ln_less_cancel_iff by fastforce
 
 lemma ln_max_swap:
   "x > (0::real) \<Longrightarrow> (y > 0) \<Longrightarrow> ln (max x y) = max (ln x) (ln y)"
   using ln_le_cancel_iff by fastforce
 
 text \<open>Loose lower bounds for the factorial fuction:.\<close>
 
 lemma fact_lower_bound:
   "sqrt(2*pi*n)*(n/exp(1))^n \<le> fact n" (is "?L \<le> ?R")
 proof (cases "n > 0")
   case True
   have "ln ?L = ln (2*pi*n)/2 + n * ln n - n"
     using True by (simp add: ln_mult ln_sqrt ln_realpow ln_div algebra_simps)
   also have "... \<le> ln ?R"
     by (intro Stirling_Formula.ln_fact_bounds True)
   finally show ?thesis
     using iffD1[OF ln_le_cancel_iff] True by simp
 next
   case False
   then show ?thesis by simp
 qed
 
 lemma fact_lower_bound_1:
   assumes "n > 0"
   shows "(n/exp 1)^n \<le> fact n" (is "?L \<le> ?R")
 proof -
   have "2 * pi \<ge> 1" using pi_ge_two by auto
   moreover have "n \<ge> 1" using assms by simp
   ultimately have "2 * pi * n \<ge> 1*1"
     by (intro mult_mono) auto
   hence a:"2 * pi * n \<ge> 1" by simp
 
   have "?L = 1 * ?L" by simp
   also have "... \<le> sqrt(2 * pi * n) * ?L"
     using a by (intro mult_right_mono) auto
   also have "... \<le> ?R"
     using fact_lower_bound by simp
   finally show ?thesis by simp
 qed
 
 text \<open>Rules to handle O-notation with multiple variables, where some filters may be towards zero:\<close>
 
 lemma real_inv_at_right_0_inf:
   "\<forall>\<^sub>F x in at_right (0::real). c \<le> 1 / x"
 proof -
   have "c \<le> 1 /  x" if b:" x \<in> {0<..<1 / (max c 1)}" for x
   proof -
     have "c * x \<le> (max c 1) * x"
       using b by (intro mult_right_mono, linarith, auto)
     also have "... \<le> (max c 1)  * (1 / (max c 1))"
       using b by (intro mult_left_mono) auto
     also have "... \<le> 1"
       by (simp add:of_rat_divide)
     finally have "c * x \<le> 1" by simp
     moreover have "0 < x"
       using b by simp
     ultimately show ?thesis by (subst pos_le_divide_eq, auto)
   qed
   thus ?thesis
     by (intro eventually_at_rightI[where b="1/(max c 1)"], simp_all)
 qed
 
 lemma bigo_prod_1:
   assumes "(\<lambda>x. f x) \<in> O[F](\<lambda>x. g x)" "G \<noteq> bot"
   shows "(\<lambda>x. f (fst x)) \<in> O[F \<times>\<^sub>F G](\<lambda>x. g (fst x))"
 proof -
   obtain c where a: "\<forall>\<^sub>F x in F. norm (f x) \<le> c * norm (g x)" and c_gt_0: "c > 0"
     using assms unfolding bigo_def by auto
 
   have "\<exists>c>0. \<forall>\<^sub>F x in F \<times>\<^sub>F G. norm (f (fst x)) \<le> c * norm (g (fst x))"
     by (intro exI[where x="c"] conjI c_gt_0  eventually_prod1' a assms(2))
   thus ?thesis
     unfolding bigo_def by simp
 qed
 
 lemma bigo_prod_2:
   assumes "(\<lambda>x. f x) \<in> O[G](\<lambda>x. g x)" "F \<noteq> bot"
   shows "(\<lambda>x. f (snd x)) \<in> O[F \<times>\<^sub>F G](\<lambda>x. g (snd x))"
 proof -
   obtain c where a: "\<forall>\<^sub>F x in G. norm (f x) \<le> c * norm (g x)" and c_gt_0: "c > 0"
     using assms unfolding bigo_def by auto
 
   have "\<exists>c>0. \<forall>\<^sub>F x in F \<times>\<^sub>F G. norm (f (snd x)) \<le> c * norm (g (snd x))"
     by (intro exI[where x="c"] conjI c_gt_0  eventually_prod2' a assms(2))
   thus ?thesis
     unfolding bigo_def by simp
 qed
 
 lemma eventually_inv:
   fixes P :: "real \<Rightarrow> bool"
   assumes "eventually (\<lambda>x. P (1/x)) at_top "
   shows "eventually (\<lambda>x. P x) (at_right 0)"
 proof -
   obtain N where c:"n \<ge> N \<Longrightarrow> P (1/n)" for n
     using assms unfolding eventually_at_top_linorder by auto
 
   define q where "q = max 1 N"
   have d: "0 < 1 / q" "q > 0"
     unfolding q_def by auto
 
   have "P x" if "x \<in> {0<..<1 / q}" for x
   proof -
     define n where "n = 1/x"
     have x_eq: "x = 1 / n"
       unfolding n_def using that by simp
 
     have "N \<le> q" unfolding q_def by simp
     also have "... \<le> n"
       unfolding n_def using that d by (simp add:divide_simps ac_simps)
     finally have "N \<le> n" by simp
     thus ?thesis
       unfolding x_eq by (intro c)
   qed
 
   thus ?thesis
     by (intro eventually_at_rightI[where b="1/q"] d)
 qed
 
 lemma bigo_inv:
   fixes f g :: "real \<Rightarrow> real"
   assumes "(\<lambda>x. f (1/x)) \<in> O(\<lambda>x. g (1/x))"
   shows "f \<in> O[at_right 0](g)"
   using assms eventually_inv unfolding bigo_def by auto
 
 unbundle no_intro_cong_syntax
 
 end
\ No newline at end of file
diff --git a/thys/Distributed_Distinct_Elements/Pseudorandom_Combinators.thy b/thys/Distributed_Distinct_Elements/Pseudorandom_Combinators.thy
--- a/thys/Distributed_Distinct_Elements/Pseudorandom_Combinators.thy
+++ b/thys/Distributed_Distinct_Elements/Pseudorandom_Combinators.thy
@@ -1,787 +1,788 @@
 section \<open>Combinators for Pseudo-random Objects\<close>
 
 text \<open>This section introduces a combinator library for pseudo-random objects. Each object can be
 described as a sample space, a function from an initial segment of the natural numbers that selects
 a value (or data structure.) Semantically they are multisets with the natural interpretation as a
 probability space (each element is selected with a probability proportional to its occurence count
 in the multiset). Operationally the selection procedure describes an algorithm to sample from the
 space.
 
 After general definitions and lemmas basic sample spaces, such as chosing a natural uniformly in
 an initial segment, a product construction the main pseudo-random objects: hash families and
 expander graphs are introduced. In both cases the range is itself an arbitrary sample space, such
 that it is for example possible to construct a pseudo-random object that samples seeds for hash
 families using an expander walk.
 
 The definitions @{term "\<Psi>"} in Section~\ref{sec:inner_algorithm} and @{term "\<Theta>"} in
 Section~\ref{sec:outer_algorithm} are good examples.
 
 A nice introduction into such constructions has been published by Goldreich~\cite{goldreich2011}.\<close>
 
 subsection \<open>Definitions and General Lemmas\<close>
 
 theory Pseudorandom_Combinators
   imports
     Finite_Fields.Card_Irreducible_Polynomials
     Universal_Hash_Families.Carter_Wegman_Hash_Family
-    Frequency_Moments.Product_PMF_Ext
     Distributed_Distinct_Elements_Preliminary
+    Universal_Hash_Families.Universal_Hash_Families_More_Product_PMF
     Expander_Graphs.Expander_Graphs_Strongly_Explicit
 begin
 
 unbundle intro_cong_syntax
-hide_const "Quantum.T"
-hide_const "Discrete_Topology.discrete"
-hide_const "Polynomial.order"
+hide_const (open) Quantum.T
+hide_const (open) Discrete_Topology.discrete
+hide_const (open) Isolated.discrete
+hide_const (open) Polynomial.order
 no_notation Digraph.dominates ("_ \<rightarrow>\<index> _" [100,100] 40)
 
 record 'a sample_space =
   size :: "nat"
   sample_space_select :: "nat \<Rightarrow> 'a"
 
 definition sample_pmf
   where "sample_pmf S = map_pmf (sample_space_select S) (pmf_of_set {..<size S})"
 
 definition "sample_space S \<equiv> size S > 0"
 
 definition "select S k = (sample_space_select S (if k < size S then k else 0))"
 
 definition "sample_set S = select S ` {..<size S}"
 
 lemma sample_space_imp_ne:
   assumes "sample_space S"
   shows "{..<size S} \<noteq> {}"
   using assms unfolding sample_space_def by auto
 
 lemma sample_pmf_alt:
   assumes "sample_space S"
   shows "sample_pmf S = map_pmf (select S) (pmf_of_set {..<size S})"
   using sample_space_imp_ne[OF assms] unfolding sample_pmf_def select_def
   by (intro map_pmf_cong refl) simp
 
 lemma sample_space_alt:
   assumes "sample_space S"
   shows "sample_set S = set_pmf (sample_pmf S)"
   using sample_space_imp_ne[OF assms]
   unfolding sample_set_def sample_pmf_alt[OF assms]
   by simp
 
 lemma sample_set_alt:
   assumes "sample_space S"
   shows "sample_set S = sample_space_select S ` {..<size S}"
   unfolding sample_set_def select_def
   by (intro image_cong) auto
 
 lemma select_range:
   assumes "sample_space S"
   shows "select S i \<in> sample_set S"
   using assms unfolding sample_space_def select_def sample_set_def by auto
 
 declare [[coercion sample_pmf]]
 
 lemma integrable_sample_pmf[simp]:
   fixes f :: "'a \<Rightarrow> 'c::{banach, second_countable_topology}"
   assumes "sample_space S"
   shows "integrable (measure_pmf (sample_pmf S)) f"
 proof -
   have "finite (set_pmf (pmf_of_set {..<size S}))"
     using assms sample_space_def
     by (subst set_pmf_of_set) auto
   hence "finite (set_pmf (sample_pmf S))"
     unfolding sample_pmf_def by simp
   thus ?thesis
     by (intro integrable_measure_pmf_finite)
 qed
 
 subsection \<open>Basic sample spaces\<close>
 
 text \<open>Sample space for uniformly selecting a natural number less than a given bound:\<close>
 
 definition nat_sample_space :: "nat \<Rightarrow> nat sample_space" ("[_]\<^sub>S")
   where "nat_sample_space n = \<lparr> size = n, select = id \<rparr>"
 
 lemma nat_sample_pmf:
   "sample_pmf ([x]\<^sub>S) = pmf_of_set {..<x}"
   unfolding nat_sample_space_def sample_pmf_def by simp
 
 lemma nat_sample_space[simp]:
   assumes "n > 0"
   shows "sample_space [n]\<^sub>S"
   using assms
   unfolding sample_space_def nat_sample_space_def by simp
 
 text \<open>Sample space for the product of two sample spaces:\<close>
 
 definition prod_sample_space ::
   "'a sample_space \<Rightarrow> 'b sample_space \<Rightarrow> ('a \<times> 'b) sample_space" (infixr "\<times>\<^sub>S" 65)
   where
     "prod_sample_space s t =
       \<lparr> size = size s * size t,
         select = (\<lambda>i. (select s (i mod (size s)), select t (i div (size s)))) \<rparr>"
 
 lemma split_pmf_mod_div':
   assumes "a > (0::nat)"
   assumes "b > 0"
   shows "map_pmf (\<lambda>x. (x mod a, x div a)) (pmf_of_set {..<a * b}) = pmf_of_set ({..<a} \<times> {..<b})"
 proof -
   have "x + a * y < a * b" if "x < a" "y < b" for x y
   proof -
     have a:"y+1 \<le> b" using that by simp
     have "x + a * y < a + a * y"
       using that by simp
     also have "... = a * (y+1)"
       by simp
     also have "... \<le> a * b"
       by (intro mult_left_mono a) auto
     finally show ?thesis by simp
   qed
 
   hence "bij_betw (\<lambda>x. (x mod a, x div a)) {..<a * b} ({..<a} \<times> {..<b})"
     using assms less_mult_imp_div_less
     by (intro bij_betwI[where g="(\<lambda>x. fst x + a * snd x)"])
      (auto simp add:mult.commute)
 
   moreover have "a * b > 0" using assms by simp
   hence "{..<a * b} \<noteq> {}" by blast
   ultimately show "?thesis"
     by (intro map_pmf_of_set_bij_betw) auto
 qed
 
 lemma pmf_of_set_prod_eq:
   assumes "A \<noteq> {}" "finite A"
   assumes "B \<noteq> {}" "finite B"
   shows  "pmf_of_set (A \<times> B) = pair_pmf (pmf_of_set A) (pmf_of_set B)"
 proof -
   have "indicat_real (A \<times> B) (i, j) = indicat_real A i * indicat_real B j" for i j
     by (cases "i \<in> A"; cases "j \<in> B") auto
   hence "pmf (pmf_of_set (A \<times> B)) (i,j) = pmf (pair_pmf (pmf_of_set A) (pmf_of_set B)) (i,j)"
     for i j using assms by (simp add:pmf_pair)
   thus ?thesis
     by (intro pmf_eqI) auto
 qed
 
 lemma split_pmf_mod_div:
   assumes "a > (0::nat)"
   assumes "b > 0"
   shows "map_pmf (\<lambda>x. (x mod a, x div a)) (pmf_of_set {..<a * b}) =
     pair_pmf (pmf_of_set {..<a}) (pmf_of_set {..<b})"
   using assms by (auto intro!: pmf_of_set_prod_eq simp add:split_pmf_mod_div')
 
 lemma split_pmf_mod:
   assumes "a > (0::nat)"
   assumes "b > 0"
   shows "map_pmf (\<lambda>x. x mod a) (pmf_of_set {..<a * b}) = pmf_of_set {..<a}"
 proof -
   have "map_pmf (\<lambda>x. x mod a) (pmf_of_set {..<a * b}) =
    map_pmf (fst \<circ> (\<lambda>x. (x mod a, x div a))) (pmf_of_set {..<a * b})"
     by (simp add:comp_def)
   also have "... = map_pmf fst (pair_pmf (pmf_of_set {..<a}) (pmf_of_set {..<b}))"
     by (simp add:map_pmf_compose split_pmf_mod_div[OF assms])
   also have "... = pmf_of_set {..<a}"
     by (simp add:map_fst_pair_pmf)
   finally show ?thesis by simp
 qed
 
 lemma prod_sample_pmf:
   assumes "sample_space S"
   assumes "sample_space T"
   shows "sample_pmf (S \<times>\<^sub>S T) = pair_pmf (sample_pmf S) (sample_pmf T)" (is "?L = ?R")
 proof -
   have size: "size S * size T > 0"
     using assms sample_space_def by (metis nat_0_less_mult_iff)
   hence a:"{..<size S * size T} \<noteq> {}" "finite {..<size S * size T}"
     using lessThan_empty_iff by auto
   have b:"x div size S mod size T = x div size S" if "x < size S * size T" for x
     by (simp add: algebra_simps less_mult_imp_div_less that)
 
   have "?L = map_pmf (\<lambda>i. (select S (i mod size S), select T (i div size S)))
     (pmf_of_set {..<size S * size T})"
     unfolding sample_pmf_def prod_sample_space_def by simp
   also have "... = map_pmf ((\<lambda>(x,y). (select S x, select T y)) \<circ> (\<lambda>i. (i mod size S, i div size S)))
     (pmf_of_set {..<size S * size T})"
     by (simp add:comp_def)
   also have "... = map_pmf (\<lambda>(x,y). (select S x, select T y))
     (map_pmf (\<lambda>i. (i mod size S, i div size S)) (pmf_of_set {..<size S * size T}))"
     by (subst map_pmf_compose)  simp
   also have "... = map_pmf (\<lambda>(x,y). (select S x, select T y))
     (pair_pmf (pmf_of_set {..<size S}) (pmf_of_set {..<size T}))"
     using size by (subst split_pmf_mod_div) auto
   also have "... = ?R"
     unfolding sample_pmf_alt[OF assms(1)] sample_pmf_alt[OF assms(2)] map_pair by simp
   finally show ?thesis
     by simp
 qed
 
 lemma prod_sample_space[simp]:
   assumes "sample_space S" "sample_space T"
   shows "sample_space (S \<times>\<^sub>S T)"
   using assms
   unfolding sample_space_def prod_sample_space_def by simp
 
 lemma prod_sample_set:
   assumes "sample_space S"
   assumes "sample_space T"
   shows "sample_set (S \<times>\<^sub>S T) = sample_set S \<times> sample_set T" (is "?L = ?R")
   using assms by (simp add:sample_space_alt prod_sample_pmf)
 
 subsection \<open>Hash Families\<close>
 
 lemma indep_vars_map_pmf:
   assumes "prob_space.indep_vars (measure_pmf p) (\<lambda>_. discrete) (\<lambda>i \<omega>. X' i (f \<omega>)) I"
   shows "prob_space.indep_vars (measure_pmf (map_pmf f p)) (\<lambda>_. discrete) X' I"
 proof -
   have "prob_space.indep_vars (measure_pmf p) (\<lambda>_. discrete) (\<lambda>i. X' i \<circ> f) I"
     using assms by (simp add:comp_def)
   hence "prob_space.indep_vars (distr (measure_pmf p) discrete f) (\<lambda>_. discrete) X' I"
     by (intro prob_space.indep_vars_distr prob_space_measure_pmf) auto
   thus ?thesis
     using map_pmf_rep_eq by metis
 qed
 
 lemma k_wise_indep_vars_map_pmf:
   assumes "prob_space.k_wise_indep_vars (measure_pmf p) k (\<lambda>_. discrete) (\<lambda>i \<omega>. X' i (f \<omega>)) I"
   shows "prob_space.k_wise_indep_vars (measure_pmf (map_pmf f p)) k (\<lambda>_. discrete) X' I"
   using assms indep_vars_map_pmf
   unfolding prob_space.k_wise_indep_vars_def[OF prob_space_measure_pmf]
   by blast
 
 lemma (in prob_space) k_wise_indep_subset:
   assumes "J \<subseteq> I"
   assumes "k_wise_indep_vars k M' X' I"
   shows "k_wise_indep_vars k M' X' J"
   using assms unfolding k_wise_indep_vars_def by simp
 
 lemma (in prob_space) k_wise_indep_vars_reindex:
   assumes "inj_on f I"
   assumes "k_wise_indep_vars k M' X' (f ` I)"
   shows "k_wise_indep_vars k (M' \<circ> f) (\<lambda>k \<omega>. X' (f k) \<omega>) I"
 proof -
   have "indep_vars (M' \<circ> f) (\<lambda>k. X' (f k)) J" if "finite J" "card J \<le> k" "J \<subseteq> I" for J
   proof -
     have "f ` J \<subseteq> f ` I" using that by auto
     moreover have "card (f ` J) \<le> k"
       using card_image_le[OF that(1)] that(2) order.trans by auto
     moreover have "finite (f ` J)" using that by auto
     ultimately have "indep_vars M' X' (f ` J)"
       using assms(2) unfolding k_wise_indep_vars_def by simp
     thus ?thesis
       using that assms(1) inj_on_subset
       by (intro indep_vars_reindex)
   qed
   thus ?thesis
     unfolding k_wise_indep_vars_def by simp
 qed
 
 definition GF :: "nat \<Rightarrow> int set list set ring"
   where "GF n = (SOME F. finite_field F \<and> order F = n)"
 
 definition is_prime_power :: "nat \<Rightarrow> bool"
   where "is_prime_power n \<longleftrightarrow> (\<exists>p k. Factorial_Ring.prime p \<and> k > 0 \<and> n = p^k)"
 
 lemma
   assumes "is_prime_power n"
   shows GF: "finite_field (GF n)" "order (GF n) = n"
 proof -
   obtain p k where p_k: "Factorial_Ring.prime p" "k > 0" "n = p^k"
     using assms unfolding is_prime_power_def by blast
   have a:"\<exists>(F :: int set list set ring). finite_field F \<and> order F = n"
     using existence[OF p_k(2,1)] p_k(3) by simp
   show  "finite_field (GF n)" "order (GF n) = n"
     unfolding GF_def
     using someI_ex[OF a]
     by auto
 qed
 
 lemma is_prime_power: "Factorial_Ring.prime p \<Longrightarrow> k > 0 \<Longrightarrow> is_prime_power (p^k)"
   unfolding is_prime_power_def by auto
 
 definition split_prime_power :: "nat \<Rightarrow> (nat \<times> nat)"
   where "split_prime_power n = (THE (p, k). p^k = n \<and> Factorial_Ring.prime p \<and> k > 0)"
 
 lemma split_prime_power:
   assumes "Factorial_Ring.prime p"
   assumes "k > 0"
   shows "split_prime_power (p^k) = (p,k)"
 proof -
   have "q = p \<and> l = k" if "q^l = p^k" "Factorial_Ring.prime q" "l > 0" for q l
   proof -
     have "q dvd p^k" using that by (metis dvd_power)
     hence "q dvd p" using prime_dvd_power that by auto
     moreover have "p dvd q^l" using that assms(2) by (metis dvd_power)
     hence "p dvd q" using prime_dvd_power that assms by blast
     ultimately have a:"p = q" by auto
     hence "l = k" using that prime_power_inj by auto
     thus ?thesis using a by simp
   qed
   thus ?thesis
     unfolding split_prime_power_def using assms
     by (intro the_equality) auto
 qed
 
 definition \<H> :: "nat \<Rightarrow> nat \<Rightarrow> 'a sample_space \<Rightarrow> (nat \<Rightarrow> 'a) sample_space"
   where "\<H> k d R = (
     let (p,n) = split_prime_power (size R);
         m = (LEAST j. d \<le> p^j \<and> j \<ge> n);
         f = from_nat_into (carrier (GF (p^m)));
         f' = to_nat_on (carrier (GF (p^m)));
         g = from_nat_into (bounded_degree_polynomials (GF (p^m)) k) in
     \<lparr> size = p^(m*k), select = (\<lambda>i x. select R ((f' (ring.hash (GF (p^m)) (f x) (g i))) mod p^n))\<rparr>)"
 
 locale hash_sample_space =
   fixes k d p n :: nat
   fixes R :: "'a sample_space"
   assumes p_prime: "Factorial_Ring.prime p"
   assumes size_R: "size R = p ^ n"
   assumes k_gt_0: "k > 0"
   assumes n_gt_0: "n > 0"
 begin
 
 abbreviation S where "S \<equiv> \<H> k d R"
 
 lemma p_n_def: "(p,n) = split_prime_power (size R)"
   unfolding size_R
   by (intro split_prime_power[symmetric] n_gt_0 p_prime)
 
 definition m where "m = (LEAST j. d \<le> p^j \<and> j \<ge> n)"
 definition f where "f = from_nat_into (carrier (GF (p^m)))"
 definition f' where "f' = to_nat_on (carrier (GF (p^m)))"
 
 lemma n_lt_m: "n \<le> m" and d_lt_p_m: "d \<le> p^m"
 proof -
   define j :: nat where "j = max n d"
   have "d \<le> 2^d" by simp
   also have "... \<le> 2^j"
     unfolding j_def
     by (intro iffD2[OF power_increasing_iff]) auto
   also have "... \<le> p^j"
     using p_prime prime_ge_2_nat
     by (intro power_mono) auto
   finally have "d \<le> p^j" by simp
   moreover have "n \<le> j" unfolding j_def by simp
   ultimately have "d \<le> p^m \<and> m \<ge> n"
     unfolding m_def
     by (intro LeastI[where P="\<lambda>x. d \<le> p^ x \<and> x \<ge> n" and k="j"]) auto
   thus "n \<le> m" "d \<le> p^m"
     by auto
 qed
 
 lemma
   is_field: "finite_field (GF (p^m))" (is "?A") and
   field_order: "order (GF(p^m)) = p^m"  (is "?B")
 proof -
   have "is_prime_power (p^m)"
     using n_gt_0 n_lt_m
     by (intro is_prime_power p_prime) auto
 
   thus "?A" "?B"
     using GF by auto
 qed
 
 interpretation cw: carter_wegman_hash_family "GF (p^m)" "k"
   using finite_field_def is_field finite_field_axioms_def
   by (intro carter_wegman_hash_familyI k_gt_0) auto
 
 lemma field_size: "cw.field_size = p^m"
   using field_order unfolding Coset.order_def by simp
 
 lemma f_bij: "bij_betw f {..<p^m} (carrier (GF (p^m)))"
   unfolding f_def using field_size  bij_betw_from_nat_into_finite[where S="carrier (GF (p^m))"]
   by simp
 
 definition g where "g = from_nat_into cw.space"
 
 lemma p_n_gt_0: "p^n > 0"
   by (metis p_prime gr0I not_prime_0 power_not_zero)
 
 lemma p_m_gt_0: "p^m > 0"
   by (metis p_prime gr0I not_prime_0 power_not_zero)
 
 lemma S_eq: "S = \<lparr> size = p^(m*k), sample_space_select = (\<lambda> i x. select R (f' (cw.hash (f x) (g i)) mod p^n )) \<rparr>"
   unfolding \<H>_def
   by (simp add:p_n_def[symmetric] m_def[symmetric] f_def[symmetric] g_def f'_def Let_def cw.space_def)
 
 lemma \<H>_size: "size S > 0"
   unfolding S_eq using p_m_gt_0 k_gt_0 by simp
 
 lemma sample_space: "sample_space S"
   using \<H>_size unfolding sample_space_def by simp
 
 lemma sample_space_R: "sample_space R"
   using size_R p_n_gt_0 unfolding sample_space_def by auto
 
 lemma range: "range (select S i) \<subseteq> sample_set R"
 proof -
   define \<alpha> where "\<alpha> = select S i"
   have "\<alpha> x \<in> sample_set R" for x
   proof -
     have "\<alpha> \<in> sample_set S"
       unfolding \<alpha>_def by (intro select_range sample_space)
     then obtain j where \<alpha>_alt: "\<alpha> = (\<lambda>x. select R (f' (cw.hash (f x) (g j)) mod p^n))" "j < p^(m*k)"
       unfolding sample_set_alt[OF sample_space] unfolding S_eq by auto
     thus "\<alpha> x \<in> sample_set R"
       unfolding \<alpha>_alt
       by (intro select_range sample_space_R)
   qed
   thus ?thesis
     unfolding \<alpha>_def by auto
 qed
 
 lemma cw_space: "map_pmf g (pmf_of_set {..<p^(m*k)}) = pmf_of_set cw.space"
 proof-
   have card_cw_space: "p ^ (m * k) = card (cw.space)"
     unfolding cw.space_def cw.bounded_degree_polynomials_card  field_size
     by (simp add:power_mult)
   have card_cw_space_gt_0: "card (cw.space) > 0"
     using card_gt_0_iff cw.finite_space cw.non_empty_bounded_degree_polynomials by blast
 
   show ?thesis
     unfolding g_def using card_cw_space card_cw_space_gt_0
       bij_betw_from_nat_into_finite[where S="cw.space"]
     by (intro map_pmf_of_set_bij_betw) auto
 qed
 
 lemma single:
   assumes "x < d"
   shows "map_pmf (\<lambda>\<omega>. \<omega> x) (sample_pmf S) = sample_pmf R" (is "?L = ?R")
 proof -
   have f_x_carr: "f x \<in> carrier (GF (p^m))"
     using assms d_lt_p_m
     by (intro bij_betw_apply[OF f_bij]) auto
 
   have "pmf (map_pmf (cw.hash (f x)) (pmf_of_set cw.space)) i =
     pmf (pmf_of_set (carrier (GF (p ^ m)))) i" (is "?L1 = ?R1") for i
   proof -
     have "?L1 = cw.prob (cw.hash (f x) -` {i})"
       unfolding cw.M_def by (simp add:pmf_map)
     also have "... = real (card ({i} \<inter> carrier (GF (p ^ m)))) / real cw.field_size"
       using cw.prob_range[OF f_x_carr, where A="{i}" ] by (simp add:vimage_def)
     also have "... = ?R1"
       by (cases "i \<in> carrier (GF (p^m))", auto)
     finally  show ?thesis by simp
   qed
 
   hence b: "map_pmf (cw.hash (f x)) (pmf_of_set cw.space) = pmf_of_set (carrier (GF (p^m)))"
     by (intro pmf_eqI) simp
 
   have c: "map_pmf f' (pmf_of_set (carrier (GF (p^m)))) = pmf_of_set {..<p^m}"
     unfolding f'_def using to_nat_on_finite[where S="carrier (GF (p^m))"] field_size
     by (intro map_pmf_of_set_bij_betw) auto
 
   have "n \<le> m" "p > 0"
     using n_lt_m p_prime prime_gt_0_nat by auto
   hence d: "map_pmf (\<lambda>x. x mod p^n) (pmf_of_set {..<p^m}) = pmf_of_set {..<p^n}"
     using split_pmf_mod[where a = "p^n" and b="p^(m-n)"]
     by (simp add:power_add[symmetric])
 
   have "?L = map_pmf ((\<lambda>\<omega>. \<omega> x) \<circ> (sample_space_select S)) (pmf_of_set {..<size S})"
     unfolding sample_pmf_def by (simp add:map_pmf_compose)
   also have "... = map_pmf (\<lambda>\<omega>. sample_space_select S \<omega> x) (pmf_of_set {..<size S})"
     by (simp add:comp_def)
   also have "... = map_pmf (select R \<circ> (\<lambda>x. x mod p^n) \<circ> f' \<circ> (cw.hash (f x)) \<circ> g) (pmf_of_set {..<p^(m*k)})"
     unfolding S_eq by (simp add:comp_def)
   also have "... = map_pmf (select R) (pmf_of_set {..<p^n})"
     by (simp add:map_pmf_compose cw_space b c d)
   also have "... = ?R"
     unfolding sample_pmf_alt[OF sample_space_R] size_R by simp
   finally show ?thesis by simp
 qed
 
 lemma indep:
   "prob_space.k_wise_indep_vars (sample_pmf S) k (\<lambda>_. discrete) (\<lambda>i \<omega>. \<omega> i) {..<d}"
 proof -
   let ?p = "map_pmf g (pmf_of_set {..<p ^ (m * k)})"
   let ?h = "(\<lambda>i x. select R (f' (cw.hash (f x) i) mod p ^ n))"
 
   have a:"cw.k_wise_indep_vars k (\<lambda>_. discrete) cw.hash (f ` {..<d})"
     using d_lt_p_m
     by (intro cw.k_wise_indep_subset[OF _ cw.k_wise_indep] image_subsetI bij_betw_apply[OF f_bij])
     auto
 
   have "cw.k_wise_indep_vars k (\<lambda>_. discrete) (\<lambda>i \<omega>. select R (f' (cw.hash i \<omega>) mod p^n)) (f ` {..<d})"
     by (intro cw.k_wise_indep_vars_compose[OF a]) auto
   moreover
   have "inj_on f {..<p^m}"
     using f_bij bij_betw_def by auto
   hence "inj_on f {..<d}"
     using inj_on_subset d_lt_p_m by blast
   ultimately have "cw.k_wise_indep_vars k (\<lambda>_. discrete) (\<lambda>i \<omega>. select R (f' (cw.hash (f i) \<omega>) mod p ^ n)) {..<d}"
     using cw.k_wise_indep_vars_reindex[where f="f"] unfolding comp_def by auto
 
   hence "prob_space.k_wise_indep_vars (measure_pmf ((map_pmf ?h \<circ> map_pmf g) (pmf_of_set {..<p^(m*k)}))) k
      (\<lambda>_. discrete) (\<lambda>i \<omega>. \<omega> i) {..<d}"
     unfolding cw.M_def cw_space[symmetric] comp_def by (intro k_wise_indep_vars_map_pmf[where p="?p"]) auto
 
   hence "prob_space.k_wise_indep_vars (measure_pmf (map_pmf (\<lambda>i x. ?h (g i) x) (pmf_of_set {..<p^(m*k)}))) k
      (\<lambda>_. discrete) (\<lambda>i \<omega>. \<omega> i) {..<d}"
     unfolding map_pmf_compose[symmetric] by (simp add:comp_def)
 
   thus ?thesis
     unfolding sample_pmf_def S_eq by simp
 qed
 
 lemma size:
   fixes m :: nat
   assumes "d > 0"
   defines m_altdef: "m \<equiv> max n (nat \<lceil>log p d\<rceil>)"
   shows "size S = p^(m*k)"
 proof -
   have "real d = p powr (log p d)"
     using assms prime_gt_1_nat[OF p_prime]
     by (intro powr_log_cancel[symmetric]) auto
   also have "... \<le> p powr (nat \<lceil>log p d\<rceil>)"
     using prime_gt_1_nat[OF p_prime] by (intro powr_mono) linarith+
   also have "... = p^ (nat \<lceil>log p d\<rceil>)"
     using prime_gt_1_nat[OF p_prime] by (subst powr_realpow) auto
   also have "... \<le> p^m"
     using prime_gt_1_nat[OF p_prime] unfolding m_altdef
     by (intro power_increasing Nat.of_nat_mono) auto
   finally have "d \<le> p ^ m"
     by simp
 
   moreover have "n \<le> m"
     unfolding m_altdef by simp
   moreover have "m \<le> y" if "d \<le> p ^ y" "n \<le> y" for y
   proof -
     have "log p d \<le> log p (p ^ y)"
       using assms prime_gt_1_nat[OF p_prime]
       by (intro iffD2[OF log_le_cancel_iff] that(1) Nat.of_nat_mono) auto
     also have "... = log p (p powr (real y))"
       using prime_gt_1_nat[OF p_prime] by (subst powr_realpow) auto
     also have "... = y"
       using prime_gt_1_nat[OF p_prime] by (intro log_powr_cancel) auto
     finally have "log p d \<le> y" by simp
     hence "nat \<lceil>log p d\<rceil> \<le> y"
       by simp
     thus "m \<le> y"
       using that(2) unfolding m_altdef by simp
   qed
   ultimately have m_eq: "m = (LEAST j. d \<le> p ^ j \<and> n \<le> j)"
     by (intro Least_equality[symmetric]) auto
 
   show ?thesis
     unfolding S_eq m_def m_eq by simp
 qed
 
 end
 
 text \<open>Sample space with a geometric distribution\<close>
 
 fun count_zeros :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
   "count_zeros 0 k = 0" |
   "count_zeros (Suc n) k = (if odd k then 0 else 1 + count_zeros n (k div 2))"
 
 lemma count_zeros_iff: "j \<le> n \<Longrightarrow> count_zeros n k \<ge> j \<longleftrightarrow> 2^j dvd k"
 proof (induction j arbitrary: n k)
   case 0
   then show ?case by simp
 next
   case (Suc j)
   then obtain n' where n_def: "n = Suc n'" using Suc_le_D by presburger
   show ?case using Suc unfolding n_def by auto
 qed
 
 lemma count_zeros_max:
   "count_zeros n k \<le> n"
   by (induction n arbitrary: k) auto
 
 definition \<G> :: "nat \<Rightarrow> nat sample_space" where
   "\<G> n = \<lparr> size = 2^n, sample_space_select = count_zeros n \<rparr>"
 
 lemma \<G>_sample_space[simp]: "sample_space (\<G> n)"
   unfolding sample_space_def \<G>_def by simp
 
 lemma \<G>_range: "sample_set (\<G> n) \<subseteq> {..n}"
   using count_zeros_max
   unfolding sample_set_alt[OF \<G>_sample_space] unfolding \<G>_def by auto
 
 lemma \<G>_prob:
   "measure  (sample_pmf (\<G> n)) {\<omega>. \<omega> \<ge> j} = of_bool (j \<le> n) / 2^j" (is "?L = ?R")
 proof (cases "j \<le> n")
   case True
   have a:"{..<(2^n)::nat} \<noteq> {}"
     by (simp add: lessThan_empty_iff)
   have b:"finite {..<(2^n)::nat}" by simp
 
   define f :: "nat \<Rightarrow> nat" where "f = (\<lambda>x. x * 2^j)"
   have d:"inj_on  f {..<2^(n-j)}" unfolding f_def by (intro inj_onI) simp
 
   have e:"2^j > (0::nat)" by simp
 
   have "y \<in> f ` {..< 2^(n-j)} \<longleftrightarrow> y \<in> {x. x < 2^n \<and> 2^j dvd x}" for y :: nat
   proof -
     have "y \<in> f ` {..< 2^(n-j)} \<longleftrightarrow> (\<exists>x. x < 2 ^ (n - j) \<and> y = 2 ^ j * x)"
       unfolding f_def by auto
     also have "... \<longleftrightarrow> (\<exists>x. 2^j * x < 2^j * 2 ^ (n-j) \<and> y = 2 ^ j * x)"
       using e by simp
     also have "... \<longleftrightarrow> (\<exists>x. 2^j * x < 2^n \<and> y = 2 ^ j * x)"
       using True by (subst power_add[symmetric]) simp
     also have "... \<longleftrightarrow> (\<exists>x. y < 2^n \<and> y = x * 2 ^ j)"
       by (metis Groups.mult_ac(2))
     also have "... \<longleftrightarrow> y \<in> {x. x < 2^n \<and> 2^j dvd x}" by auto
     finally show ?thesis by simp
   qed
 
   hence c:"f ` {..< 2^(n-j)} = {x. x < 2^n \<and> 2^j dvd x}" by auto
 
   have "?L = measure (pmf_of_set {..<2^n}) {\<omega>. count_zeros n \<omega> \<ge> j}"
     unfolding sample_pmf_def \<G>_def by simp
   also have "... = real (card {x::nat. x < 2^n \<and> 2^j dvd x}) / 2^n"
     by (simp add: measure_pmf_of_set[OF a b] count_zeros_iff[OF True])
      (simp add:lessThan_def Collect_conj_eq)
   also have "... = real (card (f ` {..<2^(n-j)})) / 2^n"
     by (simp add:c)
   also have "... = real (card ({..<(2^(n-j)::nat)})) / 2^n"
     by (simp add: card_image[OF d])
   also have "... = ?R"
     using True by (simp add:frac_eq_eq power_add[symmetric])
   finally show ?thesis by simp
 next
   case False
   have "set_pmf (sample_pmf (\<G> n)) \<subseteq> {..n}"
     unfolding sample_space_alt[OF \<G>_sample_space, symmetric]
     using \<G>_range by simp
   hence "?L = measure (sample_pmf (\<G> n)) {}"
     using False by (intro measure_pmf_cong) auto
   also have "... = ?R"
     using False by simp
   finally show ?thesis
     by simp
 qed
 
 lemma \<G>_prob_single:
   "measure  (sample_pmf (\<G> n)) {j} \<le> 1 / 2^j" (is "?L \<le> ?R")
 proof -
   have "?L = measure (sample_pmf (\<G> n)) ({j..}-{j+1..})"
     by (intro measure_pmf_cong) auto
   also have "... = measure (sample_pmf (\<G> n)) {j..} - measure (sample_pmf (\<G> n)) {j+1..}"
     by (intro measure_Diff) auto
   also have "... = measure (sample_pmf (\<G> n)) {\<omega>. \<omega> \<ge> j}-measure (sample_pmf (\<G> n)) {\<omega>. \<omega> \<ge> (j+1)}"
     by (intro arg_cong2[where f="(-)"] measure_pmf_cong) auto
   also have "... = of_bool (j \<le> n) * 1 / 2 ^ j - of_bool (j + 1 \<le> n) / 2 ^ (j + 1)"
     unfolding \<G>_prob by simp
   also have "... \<le> 1/2^j - 0"
     by (intro diff_mono) auto
   also have "... = ?R" by simp
   finally show ?thesis by simp
 qed
 
 subsection \<open>Expander Walks\<close>
 
 definition \<E> :: "nat \<Rightarrow> real \<Rightarrow> 'a sample_space \<Rightarrow> (nat \<Rightarrow> 'a) sample_space"
   where "\<E> l \<Lambda> S = (let e = see_standard (size S) \<Lambda> in
     \<lparr> size = see_size e * see_degree e^(l-1),
       sample_space_select = (\<lambda>i j. select S (see_sample_walk e (l-1) i ! j)) \<rparr>) "
 
 locale expander_sample_space =
   fixes l :: nat
   fixes \<Lambda> :: real
   fixes S :: "'a sample_space"
   assumes l_gt_0: "l > 0"
   assumes \<Lambda>_gt_0: "\<Lambda> > 0"
   assumes sample_space_S: "sample_space S"
 begin
 
 definition e where "e = see_standard (size S) \<Lambda>"
 
 lemma size_S_gt_0: "size S > 0"
   using sample_space_S unfolding sample_space_def by simp
 
 lemma \<E>_alt: "(\<E> l \<Lambda> S) =
   \<lparr> size = see_size e * see_degree e^(l-1),
     sample_space_select = (\<lambda>i j. select S (see_sample_walk e (l-1) i ! j)) \<rparr>"
   unfolding \<E>_def e_def[symmetric] by (simp add:Let_def)
 
 lemmas see_standard = see_standard[OF size_S_gt_0 \<Lambda>_gt_0]
 
 sublocale E: regular_graph "graph_of e"
   using see_standard(1) unfolding is_expander_def e_def by auto
 
 lemma e_deg_gt_0: "see_degree e > 0"
   unfolding e_def see_standard by simp
 
 lemma e_size_gt_0: "see_size e > 0"
   unfolding e_def see_standard using size_S_gt_0 by simp
 
 lemma sample_space: "sample_space (\<E> l \<Lambda> S)"
   unfolding sample_space_def \<E>_alt using e_size_gt_0 e_deg_gt_0 by simp
 
 lemma range: "select (\<E> l \<Lambda> S) i j \<in> sample_set S"
 proof -
   define \<alpha> where "\<alpha> = select (\<E> l \<Lambda> S) i"
   have "\<alpha> \<in> sample_set (\<E> l \<Lambda> S)"
     unfolding \<alpha>_def by (intro select_range sample_space)
   then obtain k where "\<alpha> = sample_space_select  (\<E> l \<Lambda> S) k"
     using sample_set_alt[OF sample_space] by auto
   hence "\<alpha> j \<in> sample_set S"
     unfolding \<E>_alt using select_range[OF sample_space_S] by simp
   thus ?thesis
     unfolding \<alpha>_def by simp
 qed
 
 lemma sample_set: "sample_set (\<E> l \<Lambda> S) \<subseteq> (UNIV \<rightarrow> sample_set S)"
 proof (rule subsetI)
   fix x assume "x \<in> sample_set (\<E> l \<Lambda> S)"
 
   then obtain i where "x = select (\<E> l \<Lambda> S) i"
     unfolding sample_set_def by auto
   thus "x \<in> UNIV \<rightarrow> sample_set S"
     using range by auto
 qed
 
 lemma walks:
   defines "R \<equiv> map_pmf (\<lambda>xs i. select S (xs ! i)) (pmf_of_multiset (walks (graph_of e) l))"
   shows "sample_pmf (\<E> l \<Lambda> S) = R"
 proof -
   let ?S = "{..<see_size e * see_degree e ^ (l-1)}"
   let ?T = "(map_pmf (see_sample_walk e (l-1)) (pmf_of_set ?S))"
 
   have "0 \<in> ?S"
     using e_size_gt_0 e_deg_gt_0 l_gt_0 by auto
   hence "?S \<noteq> {}"
     by blast
   hence "?T = pmf_of_multiset {#see_sample_walk e (l-1) i. i \<in># mset_set ?S#}"
     by (subst map_pmf_of_set) simp_all
   also have "... = pmf_of_multiset (walks' (graph_of e) (l-1))"
     by (subst see_sample_walk) auto
   also have "... = pmf_of_multiset (walks (graph_of e) l)"
     unfolding walks_def using l_gt_0 by (cases l, simp_all)
   finally have 0:"?T = pmf_of_multiset (walks (graph_of e) l)"
     by simp
 
   have "sample_pmf (\<E> l \<Lambda> S) = map_pmf (\<lambda>xs j. select S (xs ! j)) ?T"
     unfolding map_pmf_comp sample_pmf_def \<E>_alt by simp
   also have "... = R"
     unfolding 0 R_def by simp
   finally show ?thesis by simp
 qed
 
 lemma uniform_property:
   assumes "i < l"
   shows "map_pmf (\<lambda>w. w i) (\<E> l \<Lambda> S) = sample_pmf S" (is "?L = ?R")
 proof -
   have "?L = map_pmf (select S) (map_pmf (\<lambda>xs. (xs ! i)) (pmf_of_multiset (walks (graph_of e) l)))"
     unfolding walks by (simp add: map_pmf_comp)
   also have "... = map_pmf (select S) (pmf_of_set (verts (graph_of e)))"
     unfolding E.uniform_property[OF assms] by simp
   also have "... = ?R"
     unfolding sample_pmf_alt[OF sample_space_S] e_def graph_of_def using see_standard by simp
   finally show ?thesis
     by simp
 qed
 
 lemma size:
   "size (\<E> l \<Lambda> S) =  size S * (16 ^ ((l-1) * nat \<lceil>ln \<Lambda> / ln (19 / 20)\<rceil>))" (is "?L = ?R")
 proof -
   have "?L = see_size e * see_degree e ^ (l - 1)"
     unfolding \<E>_alt by simp
   also have "... = size S *  (16 ^ nat \<lceil>ln \<Lambda> / ln (19 / 20)\<rceil>) ^ (l - 1)"
     using see_standard unfolding e_def by simp
   also have "... = size S * (16 ^ ((l-1) * nat \<lceil>ln \<Lambda> / ln (19 / 20)\<rceil>))"
     unfolding power_mult[symmetric] by (simp add:ac_simps)
   finally show ?thesis
     by simp
 qed
 
 end
 
 end
\ No newline at end of file
diff --git a/thys/Distributed_Distinct_Elements/ROOT b/thys/Distributed_Distinct_Elements/ROOT
--- a/thys/Distributed_Distinct_Elements/ROOT
+++ b/thys/Distributed_Distinct_Elements/ROOT
@@ -1,20 +1,21 @@
 chapter AFP
 
 session Distributed_Distinct_Elements = "Expander_Graphs" +
   options [timeout = 1200]
   sessions
     Discrete_Summation
     Stirling_Formula
+    Frequency_Moments
   theories
     Distributed_Distinct_Elements_Preliminary
     Pseudorandom_Combinators
     Distributed_Distinct_Elements_Balls_and_Bins
     Distributed_Distinct_Elements_Tail_Bounds
     Distributed_Distinct_Elements_Inner_Algorithm
     Distributed_Distinct_Elements_Accuracy_Without_Cutoff
     Distributed_Distinct_Elements_Cutoff_Level
     Distributed_Distinct_Elements_Accuracy
     Distributed_Distinct_Elements_Outer_Algorithm
   document_files
     "root.tex"
     "root.bib"
diff --git a/thys/Expander_Graphs/Constructive_Chernoff_Bound.thy b/thys/Expander_Graphs/Constructive_Chernoff_Bound.thy
--- a/thys/Expander_Graphs/Constructive_Chernoff_Bound.thy
+++ b/thys/Expander_Graphs/Constructive_Chernoff_Bound.thy
@@ -1,431 +1,431 @@
 subsection \<open>Constructive Chernoff Bound\label{sec:constructive_chernoff_bound}\<close>
 
 text \<open>This section formalizes Theorem~5 by Impagliazzo and Kabanets~\cite{impagliazzo2010}. It is
-a general result with which Chernoff-type tail bounds for various kinds of weakly dependent random 
+a general result with which Chernoff-type tail bounds for various kinds of weakly dependent random
 variables can be obtained. The results here are general and will be applied in
 Section~\ref{sec:random_walks} to random walks in expander graphs.\<close>
 
 theory Constructive_Chernoff_Bound
-  imports 
-    "HOL-Probability.Probability_Measure" 
-    Frequency_Moments.Product_PMF_Ext
+  imports
+    "HOL-Probability.Probability_Measure"
+    Universal_Hash_Families.Universal_Hash_Families_More_Product_PMF
     Weighted_Arithmetic_Geometric_Mean.Weighted_Arithmetic_Geometric_Mean
 begin
 
 lemma powr_mono_rev:
   fixes x :: real
   assumes "a \<le> b" and  "x > 0" "x \<le> 1"
   shows "x powr b \<le> x powr a"
 proof -
   have "x powr b = (1/x) powr (-b)"
     using assms by (simp add: powr_divide powr_minus_divide)
   also have "... \<le> (1/x) powr (-a)"
     using assms by (intro powr_mono) auto
   also have "... = x powr a"
     using assms by (simp add: powr_divide powr_minus_divide)
   finally show ?thesis by simp
 qed
 
 lemma exp_powr: "(exp x) powr y = exp (x*y)" for x :: real
   unfolding powr_def by simp
 
 lemma integrable_pmf_iff_bounded:
   fixes f :: "'a \<Rightarrow> real"
   assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> abs (f x) \<le> C"
   shows "integrable (measure_pmf p) f"
 proof -
   obtain x where "x \<in> set_pmf p"
     using set_pmf_not_empty by fast
   hence "C \<ge> 0" using assms(1) by fastforce
-  hence " (\<integral>\<^sup>+ x. ennreal (abs (f x)) \<partial>measure_pmf p) \<le> (\<integral>\<^sup>+ x. C \<partial>measure_pmf p)" 
+  hence " (\<integral>\<^sup>+ x. ennreal (abs (f x)) \<partial>measure_pmf p) \<le> (\<integral>\<^sup>+ x. C \<partial>measure_pmf p)"
     using assms ennreal_le_iff
     by (intro nn_integral_mono_AE AE_pmfI) auto
   also have "... = C"
     by simp
   also have "... < Orderings.top"
     by simp
   finally have "(\<integral>\<^sup>+ x. ennreal (abs (f x)) \<partial>measure_pmf p) < Orderings.top" by simp
-  thus ?thesis 
+  thus ?thesis
     by (intro iffD2[OF integrable_iff_bounded]) auto
 qed
 
-lemma split_pair_pmf: 
-  "measure_pmf.prob (pair_pmf A B) S = integral\<^sup>L A (\<lambda>a. measure_pmf.prob B {b. (a,b) \<in> S})" 
+lemma split_pair_pmf:
+  "measure_pmf.prob (pair_pmf A B) S = integral\<^sup>L A (\<lambda>a. measure_pmf.prob B {b. (a,b) \<in> S})"
   (is "?L = ?R")
 proof -
   have a:"integrable (measure_pmf A) (\<lambda>x. measure_pmf.prob B {b. (x, b) \<in> S})"
     by (intro integrable_pmf_iff_bounded[where C="1"]) simp
 
   have "?L = (\<integral>\<^sup>+x. indicator S x \<partial>(measure_pmf (pair_pmf A B)))"
     by (simp add: measure_pmf.emeasure_eq_measure)
   also have "... = (\<integral>\<^sup>+x. (\<integral>\<^sup>+y. indicator S (x,y) \<partial>B) \<partial>A)"
-    by (simp add: nn_integral_pair_pmf')  
+    by (simp add: nn_integral_pair_pmf')
   also have "... = (\<integral>\<^sup>+x. (\<integral>\<^sup>+y. indicator {b. (x,b) \<in> S} y \<partial>B) \<partial>A)"
     by (simp add:indicator_def)
   also have "... = (\<integral>\<^sup>+x. (measure_pmf.prob B {b. (x,b) \<in> S}) \<partial>A)"
     by (simp add: measure_pmf.emeasure_eq_measure)
   also have "... = ?R"
     using a
     by (subst nn_integral_eq_integral) auto
   finally show ?thesis by simp
 qed
 
-lemma split_pair_pmf_2: 
-  "measure(pair_pmf A B) S = integral\<^sup>L B (\<lambda>a. measure_pmf.prob A {b. (b,a) \<in> S})" 
+lemma split_pair_pmf_2:
+  "measure(pair_pmf A B) S = integral\<^sup>L B (\<lambda>a. measure_pmf.prob A {b. (b,a) \<in> S})"
   (is "?L = ?R")
 proof -
   have "?L = measure (pair_pmf B A) {\<omega>. (snd \<omega>, fst \<omega>) \<in> S}"
     by (subst pair_commute_pmf) (simp add:vimage_def case_prod_beta)
   also have "... = ?R"
     unfolding split_pair_pmf by simp
   finally show ?thesis by simp
 qed
 
-definition KL_div :: "real \<Rightarrow> real \<Rightarrow> real" 
+definition KL_div :: "real \<Rightarrow> real \<Rightarrow> real"
   where "KL_div p q = p * ln (p/q) + (1-p) * ln ((1-p)/(1-q))"
 
 theorem impagliazzo_kabanets_pmf:
-  fixes Y :: "nat \<Rightarrow> 'a \<Rightarrow> bool" 
+  fixes Y :: "nat \<Rightarrow> 'a \<Rightarrow> bool"
   fixes p :: "'a pmf"
   assumes "n > 0"
   assumes "\<And>i. i \<in> {..<n} \<Longrightarrow> \<delta> i \<in> {0..1}"
   assumes "\<And>S. S \<subseteq> {..<n} \<Longrightarrow> measure p {\<omega>. (\<forall>i \<in> S. Y i \<omega>)} \<le> (\<Prod>i \<in> S. \<delta> i)"
   defines "\<delta>_avg \<equiv> (\<Sum>i\<in> {..<n}. \<delta> i)/n"
   assumes "\<gamma> \<in> {\<delta>_avg..1}"
-  assumes "\<delta>_avg > 0" 
-  shows "measure p {\<omega>. real (card {i \<in> {..<n}. Y i \<omega>}) \<ge> \<gamma> * n} \<le> exp (-real n * KL_div \<gamma> \<delta>_avg)" 
+  assumes "\<delta>_avg > 0"
+  shows "measure p {\<omega>. real (card {i \<in> {..<n}. Y i \<omega>}) \<ge> \<gamma> * n} \<le> exp (-real n * KL_div \<gamma> \<delta>_avg)"
     (is "?L \<le> ?R")
 proof -
   let ?n = "real n"
   define q :: real where "q = (if \<gamma> = 1 then 1 else (\<gamma>-\<delta>_avg)/(\<gamma>*(1-\<delta>_avg)))"
 
   define g where "g \<omega> = card {i. i < n \<and> \<not>Y i \<omega>}" for \<omega>
   let ?E = "(\<lambda>\<omega>. real (card {i. i < n \<and> Y i \<omega>}) \<ge> \<gamma> * n)"
   let ?\<Xi> = "prod_pmf {..<n} (\<lambda>_. bernoulli_pmf q)"
 
-  have q_range:"q \<in>{0..1}" 
+  have q_range:"q \<in>{0..1}"
   proof (cases "\<gamma> < 1")
     case True
-    then show ?thesis 
+    then show ?thesis
       using assms(5,6)
       unfolding q_def by (auto intro!:divide_nonneg_pos simp add:algebra_simps)
   next
     case False
     hence "\<gamma> = 1" using assms(5) by simp
     then show ?thesis unfolding q_def by simp
   qed
 
   have abs_pos_le_1I: "abs x \<le> 1" if "x \<ge> 0" "x \<le> 1" for x :: real
     using that by auto
 
-  have \<gamma>_n_nonneg: "\<gamma>*?n \<ge> 0" 
-    using assms(1,5,6) by simp 
+  have \<gamma>_n_nonneg: "\<gamma>*?n \<ge> 0"
+    using assms(1,5,6) by simp
   define r where "r = n - nat \<lceil>\<gamma>*n\<rceil>"
 
   have 2:"(1-q) ^ r \<le> (1-q)^ g \<omega>" if "?E \<omega>" for \<omega>
   proof -
     have "g \<omega> = card ({i. i < n} - {i. i < n \<and> Y i \<omega>})"
       unfolding g_def by (intro arg_cong[where f="\<lambda>x. card x"]) auto
     also have "... = card {i. i < n} - card {i. i < n \<and> Y i \<omega>}"
       by (subst card_Diff_subset, auto)
     also have "... \<le> card {i. i < n} - nat \<lceil>\<gamma>*n\<rceil>"
       using that \<gamma>_n_nonneg by (intro diff_le_mono2) simp
     also have "... = r"
       unfolding r_def by simp
     finally have "g \<omega> \<le> r" by simp
     thus "(1-q) ^ r \<le> (1-q) ^ (g \<omega>)"
       using q_range by (intro power_decreasing) auto
   qed
 
   have \<gamma>_gt_0: "\<gamma> > 0"
     using assms(5,6) by simp
 
   have q_lt_1: "q < 1" if "\<gamma> < 1"
   proof -
     have "\<delta>_avg < 1" using assms(5) that by simp
-    hence "(\<gamma> - \<delta>_avg) / (\<gamma> * (1 - \<delta>_avg)) < 1" 
+    hence "(\<gamma> - \<delta>_avg) / (\<gamma> * (1 - \<delta>_avg)) < 1"
       using \<gamma>_gt_0 assms(6) that
       by (subst pos_divide_less_eq) (auto simp add:algebra_simps)
     thus "q < 1"
       unfolding q_def using that by simp
   qed
 
   have 5: "(\<delta>_avg * q + (1-q)) / (1-q) powr (1-\<gamma>) = exp (- KL_div \<gamma> \<delta>_avg)" (is "?L1 = ?R1")
-    if "\<gamma> < 1" 
+    if "\<gamma> < 1"
   proof -
-    have \<delta>_avg_range: "\<delta>_avg \<in> {0<..<1}" 
+    have \<delta>_avg_range: "\<delta>_avg \<in> {0<..<1}"
       using that assms(5,6)  by simp
 
     have "?L1 = (1 - (1-\<delta>_avg) * q) / (1-q) powr (1-\<gamma>)"
       by (simp add:algebra_simps)
     also have "... = (1 - (\<gamma>-\<delta>_avg) / \<gamma> ) / (1-q) powr (1-\<gamma>)"
       unfolding q_def using that \<gamma>_gt_0 \<delta>_avg_range by simp
     also have "... = (\<delta>_avg / \<gamma>) / (1-q) powr (1-\<gamma>)"
       using \<gamma>_gt_0 by (simp add:divide_simps)
     also have "... = (\<delta>_avg / \<gamma>) * (1/(1-q)) powr (1-\<gamma>)"
       using q_lt_1[OF that] by (subst powr_divide, simp_all)
     also have "... = (\<delta>_avg / \<gamma>) * (1/((\<gamma>*(1-\<delta>_avg)-(\<gamma>-\<delta>_avg))/(\<gamma>*(1-\<delta>_avg)))) powr (1-\<gamma>)"
       using \<gamma>_gt_0 \<delta>_avg_range unfolding q_def by (simp add:divide_simps)
     also have "... = (\<delta>_avg / \<gamma>) * ((\<gamma> / \<delta>_avg) *((1-\<delta>_avg)/(1-\<gamma>))) powr (1-\<gamma>)"
       by (simp add:algebra_simps)
     also have "... = (\<delta>_avg / \<gamma>) * (\<gamma> / \<delta>_avg) powr (1-\<gamma>) *((1-\<delta>_avg)/(1-\<gamma>)) powr (1-\<gamma>)"
       using \<gamma>_gt_0  \<delta>_avg_range that by (subst powr_mult, auto)
     also have "... = (\<delta>_avg / \<gamma>) powr 1 * (\<delta>_avg / \<gamma>) powr -(1-\<gamma>) *((1-\<delta>_avg)/(1-\<gamma>)) powr (1-\<gamma>)"
       using \<gamma>_gt_0 \<delta>_avg_range that unfolding powr_minus_divide by (simp add:powr_divide)
     also have "... = (\<delta>_avg / \<gamma>) powr \<gamma> *((1-\<delta>_avg)/(1-\<gamma>)) powr (1-\<gamma>)"
       by (subst powr_add[symmetric]) simp
     also have "... = exp ( ln ((\<delta>_avg / \<gamma>) powr \<gamma> *((1-\<delta>_avg)/(1-\<gamma>)) powr (1-\<gamma>)))"
       using \<gamma>_gt_0 \<delta>_avg_range that by (intro exp_ln[symmetric] mult_pos_pos) auto
-    also have "... =  exp ((ln ((\<delta>_avg / \<gamma>) powr \<gamma>) + ln (((1 - \<delta>_avg) / (1 - \<gamma>)) powr (1-\<gamma>))))" 
+    also have "... =  exp ((ln ((\<delta>_avg / \<gamma>) powr \<gamma>) + ln (((1 - \<delta>_avg) / (1 - \<gamma>)) powr (1-\<gamma>))))"
       using \<gamma>_gt_0 \<delta>_avg_range that by (subst ln_mult) auto
-    also have "... =  exp ((\<gamma> * ln (\<delta>_avg / \<gamma>) + (1 - \<gamma>) * ln ((1 - \<delta>_avg) / (1 - \<gamma>))))" 
+    also have "... =  exp ((\<gamma> * ln (\<delta>_avg / \<gamma>) + (1 - \<gamma>) * ln ((1 - \<delta>_avg) / (1 - \<gamma>))))"
       using \<gamma>_gt_0 \<delta>_avg_range that by (simp add:ln_powr algebra_simps)
-    also have "... =  exp (- (\<gamma> * ln (\<gamma> / \<delta>_avg) + (1 - \<gamma>) * ln ((1 - \<gamma>) / (1 - \<delta>_avg))))" 
+    also have "... =  exp (- (\<gamma> * ln (\<gamma> / \<delta>_avg) + (1 - \<gamma>) * ln ((1 - \<gamma>) / (1 - \<delta>_avg))))"
       using \<gamma>_gt_0 \<delta>_avg_range that by (simp add: ln_div algebra_simps)
     also have "... = ?R1"
       unfolding KL_div_def by simp
 
     finally show ?thesis by simp
   qed
 
   have 3: "(\<delta>_avg * q + (1-q)) ^ n / (1-q) ^ r \<le> exp (- ?n* KL_div \<gamma> \<delta>_avg)" (is "?L1 \<le> ?R1")
   proof (cases "\<gamma> < 1")
     case True
-    have "\<gamma> * real n \<le> 1 * real n" 
+    have "\<gamma> * real n \<le> 1 * real n"
       using True by (intro mult_right_mono) auto
     hence "r = real n - real (nat \<lceil>\<gamma> * real n\<rceil>)"
       unfolding r_def by (subst of_nat_diff) auto
     also have "... = real n - \<lceil>\<gamma> * real n\<rceil>"
       using \<gamma>_n_nonneg by (subst of_nat_nat, auto)
     also have "... \<le> ?n - \<gamma> * ?n"
       by (intro diff_mono) auto
     also have "... = (1-\<gamma>) *?n" by (simp add:algebra_simps)
     finally have r_bound: "r \<le> (1-\<gamma>)*n" by simp
 
     have "?L1 = (\<delta>_avg * q + (1-q)) ^ n / (1-q) powr r"
       using q_lt_1[OF True] assms(1) by (simp add: powr_realpow)
     also have "... = (\<delta>_avg * q + (1-q)) powr n / (1-q) powr r"
       using q_lt_1[OF True] assms(6) q_range
       by (subst powr_realpow[symmetric], auto intro!:add_nonneg_pos)
     also have "... \<le> (\<delta>_avg * q + (1-q)) powr n / (1-q) powr ((1-\<gamma>)*n)"
       using q_range q_lt_1[OF True] by (intro divide_left_mono powr_mono_rev r_bound) auto
     also have "... = (\<delta>_avg * q + (1-q)) powr n / ((1-q) powr (1-\<gamma>)) powr n"
       unfolding powr_powr by simp
     also have "... = ((\<delta>_avg * q + (1-q)) / (1-q) powr (1-\<gamma>)) powr n"
       using assms(6) q_range by (subst powr_divide) auto
     also have "... = exp (- KL_div \<gamma> \<delta>_avg) powr real n"
       unfolding 5[OF True] by simp
-    also have "... = ?R1" 
+    also have "... = ?R1"
       unfolding exp_powr by simp
     finally show ?thesis by simp
   next
     case False
     hence \<gamma>_eq_1: "\<gamma>=1" using assms(5) by simp
     have "?L1 = \<delta>_avg ^ n"
       using \<gamma>_eq_1 r_def q_def by simp
     also have "... = exp( - KL_div 1 \<delta>_avg) ^ n"
-      unfolding KL_div_def using assms(6) by (simp add:ln_div) 
-    also have "... = ?R1" 
+      unfolding KL_div_def using assms(6) by (simp add:ln_div)
+    also have "... = ?R1"
       using \<gamma>_eq_1 by (simp add: powr_realpow[symmetric] exp_powr)
     finally show ?thesis by simp
   qed
 
-  have 4: "(1 - q) ^ r > 0" 
+  have 4: "(1 - q) ^ r > 0"
   proof (cases "\<gamma> < 1")
     case True
     then show ?thesis using q_lt_1[OF True] by simp
   next
     case False
     hence "\<gamma>=1" using assms(5) by simp
     hence "r=0" unfolding r_def by simp
     then show ?thesis by simp
   qed
 
   have "(1-q) ^ r * ?L = (\<integral>\<omega>. indicator {\<omega>. ?E \<omega>} \<omega> * (1-q) ^ r \<partial>p)"
     by simp
   also have "... \<le> (\<integral>\<omega>. indicator {\<omega>. ?E \<omega>} \<omega> * (1-q) ^ g \<omega> \<partial>p)"
-    using q_range 2 by (intro integral_mono_AE integrable_pmf_iff_bounded[where C="1"] 
-        abs_pos_le_1I mult_le_one power_le_one AE_pmfI) (simp_all split:split_indicator) 
+    using q_range 2 by (intro integral_mono_AE integrable_pmf_iff_bounded[where C="1"]
+        abs_pos_le_1I mult_le_one power_le_one AE_pmfI) (simp_all split:split_indicator)
   also have "... = (\<integral>\<omega>. indicator {\<omega>. ?E \<omega>} \<omega> * (\<Prod>i \<in> {i. i < n \<and> \<not>Y i \<omega>}. (1-q)) \<partial>p)"
     unfolding g_def using q_range
     by (intro integral_cong_AE AE_pmfI, simp_all add:powr_realpow)
   also have "... = (\<integral>\<omega>. indicator {\<omega>. ?E \<omega>} \<omega> * measure ?\<Xi> ({j. j < n \<and> \<not>Y j \<omega>} \<rightarrow> {False}) \<partial>p)"
     using q_range by (subst prob_prod_pmf') (auto simp add:measure_pmf_single)
   also have "... = (\<integral>\<omega>. measure ?\<Xi> {\<xi>. ?E \<omega> \<and> (\<forall>i\<in>{j. j < n \<and> \<not>Y j \<omega>}. \<not>\<xi> i)} \<partial>p)"
     by (intro integral_cong_AE AE_pmfI, simp_all add:Pi_def split:split_indicator)
   also have "... = (\<integral>\<omega>. measure ?\<Xi> {\<xi>. ?E \<omega> \<and> (\<forall>i\<in>{..<n}. \<xi> i \<longrightarrow> Y i \<omega>)} \<partial>p)"
     by (intro integral_cong_AE AE_pmfI measure_eq_AE) auto
-  also have "... = measure (pair_pmf p ?\<Xi>) {\<phi>.?E (fst \<phi>)\<and>(\<forall>i \<in> {..<n}. snd \<phi> i \<longrightarrow> Y i (fst \<phi>))}" 
+  also have "... = measure (pair_pmf p ?\<Xi>) {\<phi>.?E (fst \<phi>)\<and>(\<forall>i \<in> {..<n}. snd \<phi> i \<longrightarrow> Y i (fst \<phi>))}"
     unfolding split_pair_pmf by simp
   also have "... \<le> measure (pair_pmf p ?\<Xi>) {\<phi>. (\<forall>i \<in> {j. j < n \<and> snd \<phi> j}. Y i (fst \<phi>))}"
-    by (intro measure_pmf.pmf_mono[OF refl], auto)
+    by (intro pmf_mono, auto)
   also have "... = (\<integral>\<xi>. measure p {\<omega>. \<forall>i\<in>{j. j< n \<and> \<xi> j}. Y i \<omega>} \<partial> ?\<Xi>)"
     unfolding split_pair_pmf_2 by simp
   also have "... \<le> (\<integral>a. (\<Prod>i \<in> {j. j < n \<and> a j}. \<delta> i) \<partial> ?\<Xi>)"
-    using assms(2) by (intro integral_mono_AE AE_pmfI assms(3) subsetI  prod_le_1 prod_nonneg 
+    using assms(2) by (intro integral_mono_AE AE_pmfI assms(3) subsetI  prod_le_1 prod_nonneg
         integrable_pmf_iff_bounded[where C="1"] abs_pos_le_1I) auto
   also have "... = (\<integral>a. (\<Prod>i \<in> {..<n}. \<delta> i^ of_bool(a i)) \<partial> ?\<Xi>)"
-    unfolding of_bool_def by (intro integral_cong_AE AE_pmfI) 
+    unfolding of_bool_def by (intro integral_cong_AE AE_pmfI)
       (auto simp add:if_distrib prod.If_cases Int_def)
   also have "... = (\<Prod>i<n. (\<integral>a. (\<delta> i ^ of_bool a) \<partial>(bernoulli_pmf q)))"
     using assms(2) by (intro expectation_prod_Pi_pmf integrable_pmf_iff_bounded[where C="1"]) auto
   also have "... = (\<Prod>i<n. \<delta> i * q + (1-q))"
     using q_range by simp
   also have "... = (root (card {..<n}) (\<Prod>i<n. \<delta> i * q + (1-q))) ^ (card {..<n})"
     using assms(1,2) q_range by (intro real_root_pow_pos2[symmetric] prod_nonneg) auto
   also have "... \<le> ((\<Sum>i<n. \<delta> i * q + (1-q))/card{..<n})^(card {..<n})"
-    using assms(1,2) q_range by (intro power_mono arithmetic_geometric_mean) 
+    using assms(1,2) q_range by (intro power_mono arithmetic_geometric_mean)
       (auto intro: prod_nonneg)
   also have "... = ((\<Sum>i<n. \<delta> i * q)/n + (1-q))^n"
     using assms(1) by (simp add:sum.distrib divide_simps mult.commute)
   also have "... = (\<delta>_avg * q + (1-q))^n"
     unfolding \<delta>_avg_def by (simp add: sum_distrib_right[symmetric])
   finally have "(1-q) ^ r * ?L \<le> (\<delta>_avg * q + (1-q)) ^ n" by simp
   hence "?L \<le> (\<delta>_avg * q + (1-q)) ^ n / (1-q) ^ r"
     using 4 by (subst pos_le_divide_eq) (auto simp add:algebra_simps)
   also have "... \<le> ?R"
-    by (intro 3) 
+    by (intro 3)
   finally show ?thesis by simp
 qed
 
-text \<open>The distribution of a random variable with a countable range is a discrete probability space, 
+text \<open>The distribution of a random variable with a countable range is a discrete probability space,
 i.e., induces a PMF. Using this it is possible to generalize the previous result to arbitrary
 probability spaces.\<close>
 
 lemma (in prob_space) establish_pmf:
   fixes f :: "'a \<Rightarrow> 'b"
   assumes rv: "random_variable discrete f"
   assumes "countable (f ` space M)"
   shows "distr M discrete f \<in> {M. prob_space M \<and> sets M = UNIV \<and> (AE x in M. measure M {x} \<noteq> 0)}"
 proof -
   define N where "N = {x \<in> space M.\<not> prob (f -` {f x} \<inter> space M) \<noteq> 0}"
   define I where "I = {z \<in> (f ` space M). prob (f -` {z}  \<inter> space M) = 0}"
 
-  have countable_I: " countable I" 
+  have countable_I: " countable I"
     unfolding I_def by (intro countable_subset[OF _ assms(2)]) auto
 
-  have disj: "disjoint_family_on (\<lambda>y. f -` {y} \<inter> space M) I" 
+  have disj: "disjoint_family_on (\<lambda>y. f -` {y} \<inter> space M) I"
     unfolding disjoint_family_on_def by auto
 
   have N_alt_def: "N = (\<Union>y \<in> I. f -` {y} \<inter> space M)"
     unfolding N_def I_def by (auto simp add:set_eq_iff)
   have "emeasure M N = \<integral>\<^sup>+ y. emeasure M (f -` {y} \<inter> space M) \<partial>count_space I"
-    using rv countable_I unfolding N_alt_def 
-    by (subst emeasure_UN_countable) (auto simp add:disjoint_family_on_def) 
+    using rv countable_I unfolding N_alt_def
+    by (subst emeasure_UN_countable) (auto simp add:disjoint_family_on_def)
   also have "... =  \<integral>\<^sup>+ y. 0 \<partial>count_space I"
     unfolding I_def using emeasure_eq_measure ennreal_0
-    by (intro nn_integral_cong) auto 
+    by (intro nn_integral_cong) auto
   also have "... = 0" by simp
   finally have 0:"emeasure M N = 0" by simp
 
-  have 1:"N \<in> events" 
+  have 1:"N \<in> events"
     unfolding N_alt_def using rv
     by (intro  sets.countable_UN'' countable_I) simp
 
   have " AE x in M. prob (f -` {f x} \<inter> space M) \<noteq> 0"
-    using 0 1 by (subst AE_iff_measurable[OF _ N_def[symmetric]])  
+    using 0 1 by (subst AE_iff_measurable[OF _ N_def[symmetric]])
   hence " AE x in M. measure (distr M discrete f) {f x} \<noteq> 0"
     by (subst measure_distr[OF rv], auto)
   hence "AE x in distr M discrete f. measure (distr M discrete f) {x} \<noteq> 0"
     by (subst AE_distr_iff[OF rv], auto)
-  thus ?thesis 
+  thus ?thesis
     using prob_space_distr rv by auto
 qed
 
 lemma singletons_image_eq:
   "(\<lambda>x. {x}) ` T \<subseteq> Pow T"
   by auto
 
 theorem (in prob_space) impagliazzo_kabanets:
   fixes Y :: "nat \<Rightarrow> 'a \<Rightarrow> bool"
   assumes "n > 0"
   assumes "\<And>i. i \<in> {..<n} \<Longrightarrow> random_variable discrete (Y i)"
   assumes "\<And>i. i \<in> {..<n} \<Longrightarrow> \<delta> i \<in> {0..1}"
   assumes "\<And>S. S \<subseteq> {..<n} \<Longrightarrow> \<P>(\<omega> in M. (\<forall>i \<in> S. Y i \<omega>)) \<le> (\<Prod>i \<in> S. \<delta> i)"
-  defines "\<delta>_avg \<equiv> (\<Sum>i\<in> {..<n}. \<delta> i)/n" 
+  defines "\<delta>_avg \<equiv> (\<Sum>i\<in> {..<n}. \<delta> i)/n"
   assumes "\<gamma> \<in> {\<delta>_avg..1}" "\<delta>_avg > 0"
-  shows "\<P>(\<omega> in M. real (card {i \<in> {..<n}. Y i \<omega>}) \<ge> \<gamma> * n) \<le> exp (-real n * KL_div \<gamma> \<delta>_avg)" 
+  shows "\<P>(\<omega> in M. real (card {i \<in> {..<n}. Y i \<omega>}) \<ge> \<gamma> * n) \<le> exp (-real n * KL_div \<gamma> \<delta>_avg)"
     (is "?L \<le> ?R")
 proof -
   define f where "f = (\<lambda>\<omega> i. if i < n then Y i \<omega> else False)"
   define g where "g = (\<lambda>\<omega> i. if i < n then \<omega> i else False)"
   define T where "T = {\<omega>. (\<forall>i. \<omega> i \<longrightarrow> i < n)}"
 
   have g_idem: "g \<circ> f = f" unfolding f_def g_def by (simp add:comp_def)
 
-  have f_range: " f \<in> space M \<rightarrow> T" 
+  have f_range: " f \<in> space M \<rightarrow> T"
     unfolding T_def f_def by simp
 
   have "T = PiE_dflt {..<n} False (\<lambda>_. UNIV)"
     unfolding T_def PiE_dflt_def by auto
-  hence "finite T" 
+  hence "finite T"
     using finite_PiE_dflt by auto
-  hence countable_T: "countable T" 
+  hence countable_T: "countable T"
     by (intro countable_finite)
-  moreover have "f ` space M \<subseteq> T" 
+  moreover have "f ` space M \<subseteq> T"
     using f_range by auto
   ultimately have countable_f: "countable (f ` space M)"
     using countable_subset by auto
 
   have "f -` y \<inter> space M \<in> events" if t:"y \<in> (\<lambda>x. {x}) ` T" for y
   proof -
     obtain t where "y = {t}" and t_range: "t \<in> T" using t by auto
-    hence "f -` y \<inter> space M = {\<omega> \<in> space M. f \<omega> = t}" 
+    hence "f -` y \<inter> space M = {\<omega> \<in> space M. f \<omega> = t}"
       by (auto simp add:vimage_def)
     also have "... = {\<omega> \<in> space M. (\<forall>i < n. Y i \<omega> = t i)}"
       using t_range unfolding f_def T_def by auto
     also have "... = (\<Inter>i \<in> {..<n}. {\<omega> \<in> space M. Y i \<omega> = t i})"
       using assms(1) by auto
     also have "... \<in> events"
       using assms(1,2)
       by (intro sets.countable_INT) auto
     finally show ?thesis by simp
   qed
 
   hence "random_variable (count_space T) f"
     using sigma_sets_singletons[OF countable_T] singletons_image_eq f_range
     by (intro measurable_sigma_sets[where \<Omega>="T" and A=" (\<lambda>x. {x}) ` T"]) simp_all
   moreover have "g \<in> measurable discrete (count_space T)"
     unfolding g_def T_def by simp
   ultimately have "random_variable discrete (g \<circ> f)"
     by simp
   hence rv:"random_variable discrete f"
     unfolding g_idem by simp
-  
+
   define M' :: "(nat \<Rightarrow> bool) measure"
-    where "M' = distr M discrete f" 
+    where "M' = distr M discrete f"
 
   define \<Omega> where "\<Omega> = Abs_pmf M'"
   have a:"measure_pmf (Abs_pmf M') = M'"
     unfolding M'_def
     by (intro Abs_pmf_inverse[OF establish_pmf] rv countable_f)
 
   have b:"{i. (i < n \<longrightarrow> Y i x) \<and> i < n} = {i. i < n \<and> Y i x}" for x
     by auto
 
   have c: "measure \<Omega> {\<omega>. \<forall>i\<in>S. \<omega> i} \<le> prod \<delta> S" (is "?L1 \<le> ?R1") if "S \<subseteq> {..<n}" for S
   proof -
-    have d: "i \<in> S \<Longrightarrow> i < n" for i 
+    have d: "i \<in> S \<Longrightarrow> i < n" for i
       using that by auto
     have "?L1 = measure M' {\<omega>. \<forall>i\<in>S. \<omega> i}"
       unfolding \<Omega>_def a by simp
     also have "... = \<P>(\<omega> in M. (\<forall>i \<in> S. Y i \<omega>))"
       unfolding M'_def using that d
       by (subst measure_distr[OF rv]) (auto simp add:f_def Int_commute Int_def)
     also have "... \<le> ?R1"
       using that assms(4) by simp
     finally show ?thesis by simp
   qed
 
   have "?L = measure M' {\<omega>. real (card {i. i < n \<and> \<omega> i}) \<ge> \<gamma> * n}"
-    unfolding M'_def by (subst measure_distr[OF rv]) 
+    unfolding M'_def by (subst measure_distr[OF rv])
       (auto simp add:f_def algebra_simps Int_commute Int_def b)
   also have "... = measure_pmf.prob \<Omega> {\<omega>. real (card {i \<in> {..<n}. \<omega> i}) \<ge> \<gamma> * n}"
     unfolding \<Omega>_def a by simp
   also have "... \<le> ?R"
     using assms(1,3,6,7) c unfolding \<delta>_avg_def
     by (intro impagliazzo_kabanets_pmf) auto
   finally show ?thesis by simp
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_Algebra.thy b/thys/Expander_Graphs/Expander_Graphs_Algebra.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Algebra.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Algebra.thy
@@ -1,958 +1,958 @@
 section \<open>Algebra-only Theorems\<close>
 
 text \<open>This section verifies the linear algebraic counter-parts of the graph-theoretic theorems
 about Random walks. The graph-theoretic results are then derived in Section~\ref{sec:random_walks}.\<close>
 
 theory Expander_Graphs_Algebra
-  imports 
+  imports
     "HOL-Library.Monad_Syntax"
     Expander_Graphs_TTS
 begin
 
-lemma pythagoras: 
+lemma pythagoras:
   fixes v w :: "'a::real_inner"
   assumes "v \<bullet> w  = 0"
-  shows "norm (v+w)^2 = norm v^2 + norm w^2"  
+  shows "norm (v+w)^2 = norm v^2 + norm w^2"
   using assms by (simp add:power2_norm_eq_inner algebra_simps inner_commute)
 
 definition diag :: "('a :: zero)^'n \<Rightarrow> 'a^'n^'n"
   where "diag v = (\<chi> i j. if i = j then (v $ i) else 0)"
 
 definition ind_vec :: "'n set \<Rightarrow> real^'n"
   where "ind_vec S = (\<chi> i. of_bool( i \<in> S))"
 
 lemma diag_mult_eq: "diag x ** diag y = diag (x * y)"
-  unfolding diag_def 
-  by (vector matrix_matrix_mult_def) 
+  unfolding diag_def
+  by (vector matrix_matrix_mult_def)
    (auto simp add:if_distrib if_distribR sum.If_cases)
 
 lemma diag_vec_mult_eq: "diag x *v y = x * y"
-  unfolding diag_def matrix_vector_mult_def 
+  unfolding diag_def matrix_vector_mult_def
   by (simp add:if_distrib if_distribR sum.If_cases times_vec_def)
 
 definition matrix_norm_bound :: "real^'n^'m \<Rightarrow> real \<Rightarrow> bool"
   where "matrix_norm_bound A l = (\<forall>x. norm (A *v x) \<le> l * norm x)"
 
 lemma  matrix_norm_boundI:
   assumes "\<And>x. norm (A *v x) \<le> l * norm x"
   shows "matrix_norm_bound A l"
   using assms unfolding matrix_norm_bound_def by simp
 
 lemma matrix_norm_boundD:
   assumes "matrix_norm_bound A l"
   shows "norm (A *v x) \<le> l * norm x"
   using assms unfolding matrix_norm_bound_def by simp
 
 lemma matrix_norm_bound_nonneg:
   fixes A :: "real^'n^'m"
   assumes "matrix_norm_bound A l"
-  shows "l \<ge> 0" 
+  shows "l \<ge> 0"
 proof -
   have "0 \<le> norm (A *v 1)" by simp
-  also have "... \<le> l * norm (1::real^'n)" 
+  also have "... \<le> l * norm (1::real^'n)"
     using assms(1) unfolding matrix_norm_bound_def by simp
   finally have "0 \<le> l  * norm (1::real^'n)"
     by simp
   moreover have "norm (1::real^'n) > 0"
     by simp
-  ultimately show ?thesis 
+  ultimately show ?thesis
     by (simp add: zero_le_mult_iff)
 qed
 
-lemma  matrix_norm_bound_0: 
-  assumes "matrix_norm_bound A 0" 
+lemma  matrix_norm_bound_0:
+  assumes "matrix_norm_bound A 0"
   shows "A = (0::real^'n^'m)"
 proof (intro iffD2[OF matrix_eq] allI)
   fix x :: "real^'n"
   have "norm (A *v x) = 0"
     using assms unfolding matrix_norm_bound_def by simp
   thus "A *v x = 0 *v x"
     by simp
 qed
 
 lemma matrix_norm_bound_diag:
   fixes x :: "real^'n"
   assumes "\<And>i. \<bar>x $ i\<bar> \<le> l"
   shows "matrix_norm_bound (diag x) l"
 proof (rule matrix_norm_boundI)
   fix y :: "real^'n"
 
   have l_ge_0: "l \<ge> 0" using assms by fastforce
 
   have a: "\<bar>x $ i * v\<bar> \<le> \<bar>l * v\<bar>" for v i
     using l_ge_0 assms by (simp add:abs_mult mult_right_mono)
 
   have "norm (diag x *v y) = sqrt (\<Sum>i \<in> UNIV. (x $ i * y $ i)^2)"
     unfolding matrix_vector_mult_def diag_def norm_vec_def L2_set_def
     by (auto simp add:if_distrib if_distribR sum.If_cases)
   also have "... \<le> sqrt (\<Sum>i \<in> UNIV. (l * y $ i)^2)"
     by (intro real_sqrt_le_mono sum_mono iffD1[OF abs_le_square_iff] a)
   also have "... = l * norm y"
-    using l_ge_0 by (simp add:norm_vec_def L2_set_def algebra_simps 
+    using l_ge_0 by (simp add:norm_vec_def L2_set_def algebra_simps
         sum_distrib_left[symmetric] real_sqrt_mult)
   finally show "norm (diag x *v y) \<le> l * norm y" by simp
 qed
 
-lemma vector_scaleR_matrix_ac_2: "b *\<^sub>R (A::real^'n^'m) *v x = b *\<^sub>R (A *v x)" 
+lemma vector_scaleR_matrix_ac_2: "b *\<^sub>R (A::real^'n^'m) *v x = b *\<^sub>R (A *v x)"
   unfolding vector_transpose_matrix[symmetric]  transpose_scalar
   by (intro vector_scaleR_matrix_ac)
 
-lemma  matrix_norm_bound_scale: 
+lemma  matrix_norm_bound_scale:
   assumes "matrix_norm_bound A l"
   shows "matrix_norm_bound (b *\<^sub>R A) (\<bar>b\<bar> * l)"
 proof (intro matrix_norm_boundI)
   fix x
-  have "norm (b *\<^sub>R A *v x) = norm (b *\<^sub>R (A *v x))" 
+  have "norm (b *\<^sub>R A *v x) = norm (b *\<^sub>R (A *v x))"
     by (metis transpose_scalar vector_scaleR_matrix_ac vector_transpose_matrix)
-  also have "... = \<bar>b\<bar> * norm (A *v x)" 
+  also have "... = \<bar>b\<bar> * norm (A *v x)"
     by simp
   also have "... \<le> \<bar>b\<bar> * (l * norm x)"
     using assms matrix_norm_bound_def by (intro mult_left_mono) auto
   also have "... \<le> (\<bar>b\<bar> * l) * norm x" by simp
   finally show "norm (b *\<^sub>R A *v x) \<le> (\<bar>b\<bar> * l) * norm x" by simp
 qed
 
 definition nonneg_mat :: "real^'n^'m \<Rightarrow> bool"
   where "nonneg_mat A = (\<forall>i j. A $ i $ j \<ge> 0)"
 
 lemma nonneg_mat_1:
   shows "nonneg_mat (mat 1)"
   unfolding nonneg_mat_def mat_def by auto
 
 lemma nonneg_mat_prod:
   assumes "nonneg_mat A" "nonneg_mat B"
   shows "nonneg_mat (A ** B)"
-  using assms unfolding nonneg_mat_def matrix_matrix_mult_def 
+  using assms unfolding nonneg_mat_def matrix_matrix_mult_def
   by (auto intro:sum_nonneg)
 
 lemma nonneg_mat_transpose:
   "nonneg_mat (transpose A) = nonneg_mat A"
-  unfolding nonneg_mat_def transpose_def 
+  unfolding nonneg_mat_def transpose_def
   by auto
 
 definition spec_bound :: "real^'n^'n \<Rightarrow> real \<Rightarrow> bool"
   where "spec_bound M l = (l \<ge> 0 \<and> (\<forall>v. v \<bullet> 1 = 0 \<longrightarrow> norm (M *v v) \<le> l * norm v))"
 
 lemma spec_boundD1:
   assumes "spec_bound M l"
-  shows "0 \<le> l" 
+  shows "0 \<le> l"
   using assms unfolding spec_bound_def by simp
 
 lemma spec_boundD2:
   assumes "spec_bound M l"
   assumes "v \<bullet> 1 = 0 "
-  shows "norm (M *v v) \<le> l * norm v" 
+  shows "norm (M *v v) \<le> l * norm v"
   using assms unfolding spec_bound_def by simp
 
 lemma spec_bound_mono:
   assumes "spec_bound M \<alpha>" "\<alpha> \<le> \<beta>"
   shows "spec_bound M \<beta>"
 proof -
   have "norm (M *v v) \<le> \<beta> * norm v" if "inner v 1 = 0"  for v
   proof -
-    have "norm (M *v v) \<le> \<alpha> * norm v" 
+    have "norm (M *v v) \<le> \<alpha> * norm v"
       by (intro spec_boundD2[OF assms(1)] that)
     also have "... \<le> \<beta> * norm v"
       by (intro mult_right_mono assms(2)) auto
     finally show ?thesis by simp
   qed
   moreover have "\<beta> \<ge> 0"
     using assms(2) spec_boundD1[OF assms(1)] by simp
-  ultimately show ?thesis 
+  ultimately show ?thesis
     unfolding spec_bound_def by simp
 qed
 
 definition markov :: "real^'n^'n \<Rightarrow> bool"
   where "markov M = (nonneg_mat M \<and> M *v 1  = 1 \<and> 1 v* M = 1)"
 
 lemma markov_symI:
   assumes "nonneg_mat A" "transpose A = A" "A *v 1 = 1"
   shows "markov A"
 proof -
   have "1 v* A = transpose A *v 1"
     unfolding vector_transpose_matrix[symmetric] by simp
   also have "... = 1" unfolding assms(2,3) by simp
   finally have "1 v* A = 1" by simp
   thus ?thesis
     unfolding markov_def using assms by auto
 qed
 
 lemma markov_apply:
   assumes "markov M"
   shows "M *v 1 = 1" "1 v* M = 1"
   using assms unfolding markov_def by auto
 
 lemma markov_transpose:
   "markov A = markov (transpose A)"
   unfolding markov_def nonneg_mat_transpose by auto
-fun matrix_pow where 
+fun matrix_pow where
   "matrix_pow M 0 = mat 1" |
   "matrix_pow M (Suc n) = M ** (matrix_pow M n)"
 
-lemma markov_orth_inv: 
+lemma markov_orth_inv:
   assumes "markov A"
   shows "inner (A *v x) 1 = inner x 1"
 proof -
   have "inner (A *v x) 1 = inner x (1 v* A)"
     using dot_lmul_matrix inner_commute by metis
   also have "... = inner x 1"
     using markov_apply[OF assms(1)] by simp
   finally show ?thesis by simp
 qed
 
 lemma markov_id:
   "markov (mat 1)"
   unfolding markov_def using nonneg_mat_1 by simp
 
 lemma markov_mult:
   assumes "markov A" "markov B"
   shows "markov (A ** B)"
 proof -
   have "nonneg_mat (A ** B)"
     using assms unfolding markov_def by (intro nonneg_mat_prod) auto
-  moreover have "(A ** B) *v 1 = 1" 
+  moreover have "(A ** B) *v 1 = 1"
     using assms unfolding markov_def
     unfolding matrix_vector_mul_assoc[symmetric] by simp
-  moreover have "1 v* (A ** B) = 1" 
+  moreover have "1 v* (A ** B) = 1"
     using assms unfolding markov_def
     unfolding vector_matrix_mul_assoc[symmetric] by simp
   ultimately show ?thesis
     unfolding markov_def by simp
 qed
 
 lemma markov_matrix_pow:
   assumes "markov A"
   shows "markov (matrix_pow A k)"
   using markov_id assms markov_mult
   by (induction k, auto)
 
-lemma spec_bound_prod: 
+lemma spec_bound_prod:
   assumes "markov A" "markov B"
   assumes "spec_bound A la" "spec_bound B lb"
   shows "spec_bound (A ** B) (la*lb)"
 proof -
   have la_ge_0: "la \<ge> 0" using spec_boundD1[OF assms(3)] by simp
 
   have "norm ((A ** B) *v x) \<le> (la * lb) * norm x" if "inner x 1 = 0" for x
   proof -
     have "norm ((A ** B) *v x) = norm (A *v (B *v x))"
       by (simp add:matrix_vector_mul_assoc)
     also have "... \<le> la * norm (B *v x)"
       by (intro spec_boundD2[OF assms(3)]) (simp add:markov_orth_inv that assms(2))
-    also have "... \<le> la * (lb * norm x)" 
+    also have "... \<le> la * (lb * norm x)"
       by (intro spec_boundD2[OF assms(4)] mult_left_mono that la_ge_0)
     finally show ?thesis by simp
   qed
   moreover have "la * lb \<ge> 0"
     using la_ge_0 spec_boundD1[OF assms(4)] by simp
   ultimately show ?thesis
     using spec_bound_def by auto
 qed
 
-lemma spec_bound_pow: 
+lemma spec_bound_pow:
   assumes "markov A"
   assumes "spec_bound A l"
   shows "spec_bound (matrix_pow A k) (l^k)"
 proof (induction k)
   case 0
   then show ?case unfolding spec_bound_def by simp
 next
   case (Suc k)
   have "spec_bound (A ** matrix_pow A k) (l * l ^ k)"
     by (intro spec_bound_prod assms Suc markov_matrix_pow)
   thus ?case by simp
 qed
 
 fun intersperse :: "'a \<Rightarrow> 'a list \<Rightarrow> 'a list"
-  where 
+  where
     "intersperse x [] = []" |
     "intersperse x (y#[]) = y#[]" |
     "intersperse x (y#z#zs) = y#x#intersperse x (z#zs)"
 
 lemma intersperse_snoc:
   assumes "xs \<noteq> []"
   shows "intersperse z (xs@[y]) = intersperse z xs@[z,y]"
   using assms
 proof (induction xs rule:list_nonempty_induct)
   case (single x)
   then show ?case by simp
 next
   case (cons x xs)
   then obtain xsh xst where t:"xs = xsh#xst"
     by (metis neq_Nil_conv)
   have "intersperse z ((x # xs) @ [y]) = x#z#intersperse z (xs@[y])"
     unfolding t by simp
   also have "... = x#z#intersperse z xs@[z,y]"
     using cons by simp
   also have "... = intersperse z (x#xs)@[z,y]"
     unfolding t by simp
   finally show ?case by simp
 qed
 
 lemma foldl_intersperse:
   assumes "xs \<noteq> []"
   shows "foldl f a ((intersperse x xs)@[x]) = foldl (\<lambda>y z. f (f y z) x) a xs"
   using assms by (induction xs rule:rev_nonempty_induct) (auto simp add:intersperse_snoc)
 
 lemma foldl_intersperse_2:
   shows "foldl f a (intersperse y (x#xs)) = foldl (\<lambda>x z. f (f x y) z) (f a x) xs"
 proof (induction xs rule:rev_induct)
   case Nil
   then show ?case by simp
 next
   case (snoc xst xs)
-  have "foldl f a (intersperse y ((x # xs) @ [xst])) = foldl (\<lambda>x. f (f x y)) (f a x) (xs @ [xst])" 
+  have "foldl f a (intersperse y ((x # xs) @ [xst])) = foldl (\<lambda>x. f (f x y)) (f a x) (xs @ [xst])"
     by (subst intersperse_snoc, auto simp add:snoc)
   then show ?case  by simp
 qed
 
 
 context regular_graph_tts
 begin
 
 definition stat :: "real^'n"
   where "stat = (1 / real CARD('n)) *\<^sub>R 1"
 
 definition J :: "('c :: field)^'n^'n"
   where "J = (\<chi> i j. of_nat 1 / of_nat CARD('n))"
 
 lemma inner_1_1: "1 \<bullet> (1::real^'n) = CARD('n)"
   unfolding inner_vec_def by simp
 
 definition proj_unit :: "real^'n \<Rightarrow> real^'n"
   where "proj_unit v = (1 \<bullet> v) *\<^sub>R stat"
 
-definition proj_rem :: "real^'n \<Rightarrow> real^'n" 
+definition proj_rem :: "real^'n \<Rightarrow> real^'n"
   where "proj_rem v = v - proj_unit v"
 
 lemma proj_rem_orth: "1 \<bullet> (proj_rem v) = 0"
   unfolding proj_rem_def proj_unit_def inner_diff_right stat_def
   by (simp add:inner_1_1)
 
-lemma split_vec: "v = proj_unit v + proj_rem v" 
+lemma split_vec: "v = proj_unit v + proj_rem v"
   unfolding proj_rem_def by simp
 
 lemma apply_J: "J *v x = proj_unit x"
 proof (intro iffD2[OF vec_eq_iff] allI)
   fix i
-  have "(J *v x) $ i = inner (\<chi> j. 1 / real CARD('n)) x" 
+  have "(J *v x) $ i = inner (\<chi> j. 1 / real CARD('n)) x"
     unfolding matrix_vector_mul_component J_def by simp
   also have "... = inner stat x"
     unfolding stat_def scaleR_vec_def by auto
   also have "... = (proj_unit x) $ i"
     unfolding proj_unit_def stat_def by simp
   finally show "(J *v x) $ i = (proj_unit x) $ i" by simp
-qed 
+qed
 
 lemma spec_bound_J: "spec_bound (J :: real^'n^'n) 0"
 proof -
   have "norm (J *v v) = 0" if "inner v 1 = 0" for v :: "real^'n"
   proof -
     have "inner (proj_unit v + proj_rem v) 1 = 0"
       using that by (subst (asm) split_vec[of "v"], simp)
     hence "inner (proj_unit v) 1 = 0"
-      using proj_rem_orth inner_commute unfolding inner_add_left 
+      using proj_rem_orth inner_commute unfolding inner_add_left
       by (metis add_cancel_left_right)
     hence "proj_unit v = 0"
       unfolding proj_unit_def stat_def by simp
     hence "J *v v = 0"
       unfolding apply_J by simp
     thus ?thesis by simp
   qed
   thus ?thesis
     unfolding spec_bound_def by simp
 qed
 
 lemma matrix_decomposition_lemma_aux:
   fixes A :: "real^'n^'n"
   assumes "markov A"
   shows "spec_bound A l \<longleftrightarrow> matrix_norm_bound (A - (1-l) *\<^sub>R J) l" (is "?L \<longleftrightarrow> ?R")
-proof 
+proof
   assume a:"?L"
-  hence l_ge_0: "l \<ge> 0" using spec_boundD1 by auto 
-  show "?R" 
+  hence l_ge_0: "l \<ge> 0" using spec_boundD1 by auto
+  show "?R"
   proof (rule matrix_norm_boundI)
     fix x :: "real^'n"
     have "(A - (1-l) *\<^sub>R J) *v x = A *v x - (1-l) *\<^sub>R (proj_unit x)"
       by (simp add:algebra_simps vector_scaleR_matrix_ac_2 apply_J)
     also have "... = A *v proj_unit x + A *v proj_rem x - (1-l) *\<^sub>R (proj_unit x)"
       by (subst split_vec[of "x"], simp add:algebra_simps)
     also have "... = proj_unit x + A *v proj_rem x - (1-l) *\<^sub>R (proj_unit x)"
       using markov_apply[OF assms(1)]
       unfolding proj_unit_def stat_def by (simp add:algebra_simps)
     also have "... = A *v proj_rem x + l *\<^sub>R proj_unit x" (is "_ = ?R1")
       by (simp add:algebra_simps)
     finally have d:"(A - (1-l) *\<^sub>R J) *v x = ?R1" by simp
 
-    have "inner (l *\<^sub>R proj_unit x) (A *v proj_rem x) = 
+    have "inner (l *\<^sub>R proj_unit x) (A *v proj_rem x) =
       inner ((l * inner 1 x / real CARD('n)) *\<^sub>R 1 v* A) (proj_rem x)"
-      by (subst dot_lmul_matrix[symmetric]) (simp add:proj_unit_def stat_def) 
-    also have "... = (l * inner 1 x / real CARD('n)) * inner 1 (proj_rem x)" 
+      by (subst dot_lmul_matrix[symmetric]) (simp add:proj_unit_def stat_def)
+    also have "... = (l * inner 1 x / real CARD('n)) * inner 1 (proj_rem x)"
       unfolding scaleR_vector_matrix_assoc markov_apply[OF assms] by simp
     also have "... = 0"
       unfolding proj_rem_orth by simp
     finally have b:"inner (l *\<^sub>R proj_unit x) (A *v proj_rem x) = 0" by simp
 
-    have c: "inner (proj_rem x) (proj_unit x) = 0" 
+    have c: "inner (proj_rem x) (proj_unit x) = 0"
       using proj_rem_orth[of "x"]
       unfolding proj_unit_def stat_def by (simp add:inner_commute)
 
-    have "norm (?R1)^2 = norm (A *v proj_rem x)^2 + norm (l *\<^sub>R proj_unit x)^2" 
+    have "norm (?R1)^2 = norm (A *v proj_rem x)^2 + norm (l *\<^sub>R proj_unit x)^2"
       using b by (intro pythagoras) (simp add:inner_commute)
-    also have "... \<le> (l * norm (proj_rem x))^2 + norm (l *\<^sub>R proj_unit x)^2" 
+    also have "... \<le> (l * norm (proj_rem x))^2 + norm (l *\<^sub>R proj_unit x)^2"
       using proj_rem_orth[of "x"]
       by (intro add_mono power_mono spec_boundD2 a) (auto simp add:inner_commute)
     also have "... = l^2 * (norm (proj_rem x)^2 + norm (proj_unit x)^2)"
       by (simp add:algebra_simps)
     also have "... = l^2 * (norm (proj_rem x + proj_unit x)^2)"
       using c by (subst pythagoras) auto
     also have "... = l^2 * norm x^2"
       by (subst (3) split_vec[of "x"]) (simp add:algebra_simps)
     also have "... = (l * norm x)^2"
       by (simp add:algebra_simps)
     finally have "norm (?R1)^2 \<le> (l * norm x)^2" by simp
     hence "norm (?R1) \<le> l * norm x"
       using l_ge_0 by (subst (asm) power_mono_iff) auto
 
     thus "norm ((A - (1-l) *\<^sub>R J) *v x) \<le> l * norm x"
       unfolding d by simp
   qed
-next  
-  assume a:"?R" 
-  have "norm (A *v x) \<le> l * norm x" if "inner x 1 = 0" for x 
+next
+  assume a:"?R"
+  have "norm (A *v x) \<le> l * norm x" if "inner x 1 = 0" for x
   proof -
-    have "(1 - l) *\<^sub>R J *v x = (1 - l) *\<^sub>R (proj_unit x)" 
+    have "(1 - l) *\<^sub>R J *v x = (1 - l) *\<^sub>R (proj_unit x)"
       by (simp add:vector_scaleR_matrix_ac_2 apply_J)
     also have "... = 0"
       unfolding proj_unit_def using that by (simp add:inner_commute)
     finally have b: "(1 - l) *\<^sub>R J *v x = 0" by simp
 
     have "norm (A *v x) = norm ((A - (1-l) *\<^sub>R J) *v x  + ((1-l) *\<^sub>R J) *v x)"
       by (simp add:algebra_simps)
     also have "... \<le> norm ((A - (1-l) *\<^sub>R J) *v x) + norm (((1-l) *\<^sub>R J) *v x)"
       by (intro norm_triangle_ineq)
     also have "... \<le> l * norm x + 0"
       using a b unfolding  matrix_norm_bound_def by (intro add_mono, auto)
     also have "... = l * norm x"
       by simp
     finally show ?thesis by simp
   qed
 
-  moreover have "l \<ge> 0" 
+  moreover have "l \<ge> 0"
     using a matrix_norm_bound_nonneg by blast
 
-  ultimately show "?L" 
+  ultimately show "?L"
     unfolding spec_bound_def by simp
 qed
 
 lemma matrix_decomposition_lemma:
   fixes A :: "real^'n^'n"
   assumes "markov A"
-  shows "spec_bound A l \<longleftrightarrow> (\<exists>E. A = (1-l) *\<^sub>R J + l *\<^sub>R E \<and> matrix_norm_bound E 1 \<and> l \<ge> 0)" 
+  shows "spec_bound A l \<longleftrightarrow> (\<exists>E. A = (1-l) *\<^sub>R J + l *\<^sub>R E \<and> matrix_norm_bound E 1 \<and> l \<ge> 0)"
     (is "?L \<longleftrightarrow> ?R")
 proof -
-  have "?L \<longleftrightarrow> matrix_norm_bound (A - (1-l) *\<^sub>R J) l" 
+  have "?L \<longleftrightarrow> matrix_norm_bound (A - (1-l) *\<^sub>R J) l"
     using matrix_decomposition_lemma_aux[OF assms] by simp
   also have "... \<longleftrightarrow> ?R"
   proof
     assume a:"matrix_norm_bound (A - (1 - l) *\<^sub>R J) l"
     hence l_ge_0: "l \<ge> 0" using matrix_norm_bound_nonneg by auto
     define E where "E = (1/l) *\<^sub>R (A - (1-l) *\<^sub>R J)"
-    have "A = J" if "l = 0" 
+    have "A = J" if "l = 0"
     proof -
       have "matrix_norm_bound (A - J) 0"
         using a that by simp
       hence "A - J = 0" using matrix_norm_bound_0 by blast
       thus "A = J" by simp
     qed
     hence "A = (1-l) *\<^sub>R J + l *\<^sub>R E"
       unfolding E_def by simp
-    moreover have "matrix_norm_bound E 1" 
+    moreover have "matrix_norm_bound E 1"
     proof (cases "l = 0")
       case True
       hence "E = 0" if "l = 0"
         unfolding E_def by simp
       thus "matrix_norm_bound E 1" if "l = 0"
         using that unfolding matrix_norm_bound_def by auto
     next
       case False
       hence "l > 0" using l_ge_0 by simp
       moreover have "matrix_norm_bound E (\<bar>1 / l\<bar>* l)"
         unfolding E_def
         by (intro matrix_norm_bound_scale a)
       ultimately show ?thesis by auto
     qed
     ultimately show ?R using l_ge_0 by auto
   next
     assume a:?R
     then obtain E where E_def: "A = (1 - l) *\<^sub>R J + l *\<^sub>R E"  "matrix_norm_bound E 1" "l \<ge> 0"
       by auto
-    have "matrix_norm_bound (l *\<^sub>R E) (abs l*1)" 
+    have "matrix_norm_bound (l *\<^sub>R E) (abs l*1)"
       by (intro matrix_norm_bound_scale E_def(2))
-    moreover have "l \<ge> 0" using E_def by simp 
-    moreover have " l *\<^sub>R E = (A - (1 - l) *\<^sub>R J)" 
+    moreover have "l \<ge> 0" using E_def by simp
+    moreover have " l *\<^sub>R E = (A - (1 - l) *\<^sub>R J)"
       using E_def(1) by simp
     ultimately show "matrix_norm_bound (A - (1 - l) *\<^sub>R J) l"
-      by simp  
+      by simp
   qed
   finally show ?thesis by simp
 qed
 
 lemma hitting_property_alg:
   fixes S :: "('n :: finite) set"
   assumes l_range: "l \<in> {0..1}"
   defines "P \<equiv> diag (ind_vec S)"
   defines "\<mu> \<equiv> card S / CARD('n)"
   assumes "\<And>M. M \<in> set Ms \<Longrightarrow> spec_bound M l \<and> markov M"
   shows "foldl (\<lambda>x M. P *v (M *v x)) (P *v stat) Ms \<bullet> 1 \<le> (\<mu> + l * (1-\<mu>))^(length Ms+1)"
 proof -
   define t :: "real^'n" where "t = (\<chi> i. of_bool (i \<in> S))"
   define r where "r = foldl (\<lambda>x M. P *v (M *v x)) (P *v stat) Ms"
   have P_proj: "P ** P = P"
     unfolding P_def diag_mult_eq ind_vec_def by (intro arg_cong[where f="diag"]) (vector)
 
   have P_1_left: "1 v* P = t"
     unfolding P_def diag_def ind_vec_def vector_matrix_mult_def t_def by simp
 
   have P_1_right: "P *v 1 = t"
     unfolding P_def diag_def ind_vec_def matrix_vector_mult_def t_def by simp
 
   have P_norm :"matrix_norm_bound P 1"
     unfolding P_def ind_vec_def by (intro matrix_norm_bound_diag) simp
 
-  have norm_t: "norm t = sqrt (real (card S))" 
+  have norm_t: "norm t = sqrt (real (card S))"
     unfolding t_def norm_vec_def L2_set_def of_bool_def
     by (simp add:sum.If_cases if_distrib if_distribR)
 
-  have \<mu>_range: "\<mu> \<ge> 0" "\<mu> \<le> 1" 
-    unfolding \<mu>_def by (auto simp add:card_mono) 
+  have \<mu>_range: "\<mu> \<ge> 0" "\<mu> \<le> 1"
+    unfolding \<mu>_def by (auto simp add:card_mono)
 
-  define condition :: "real^'n \<Rightarrow> nat \<Rightarrow> bool" 
-    where "condition = (\<lambda>x n. norm x \<le> (\<mu> + l * (1-\<mu>))^n * sqrt (card S)/CARD('n) \<and> P *v x = x)" 
+  define condition :: "real^'n \<Rightarrow> nat \<Rightarrow> bool"
+    where "condition = (\<lambda>x n. norm x \<le> (\<mu> + l * (1-\<mu>))^n * sqrt (card S)/CARD('n) \<and> P *v x = x)"
 
   have a:"condition r (length Ms)"
     unfolding r_def using assms(4)
   proof (induction Ms rule:rev_induct)
     case Nil
     have "norm (P *v stat) = (1 / real CARD('n)) * norm t"
       unfolding stat_def matrix_vector_mult_scaleR P_1_right by simp
     also have "... \<le>  (1 / real CARD('n)) * sqrt (real (card S))"
       using  norm_t by (intro mult_left_mono) auto
     also have "... = sqrt (card S)/CARD('n)" by simp
     finally have "norm (P *v stat) \<le> sqrt (card S)/CARD('n)" by simp
     moreover have "P *v (P *v stat) = P *v stat"
       unfolding matrix_vector_mul_assoc P_proj by simp
     ultimately show ?case unfolding condition_def by simp
   next
     case (snoc M xs)
     hence "spec_bound M l \<and> markov M"
         using snoc(2) by simp
-    then obtain E where E_def: "M = (1-l) *\<^sub>R J + l *\<^sub>R E" "matrix_norm_bound E 1" 
+    then obtain E where E_def: "M = (1-l) *\<^sub>R J + l *\<^sub>R E" "matrix_norm_bound E 1"
       using iffD1[OF matrix_decomposition_lemma] by auto
 
     define y where "y = foldl (\<lambda>x M. P *v (M *v x)) (P *v stat) xs"
     have b:"condition y (length xs)"
       using snoc unfolding y_def by simp
     hence a:"P *v y = y" using condition_def by simp
 
     have "norm (P *v (M *v y)) = norm (P *v ((1-l)*\<^sub>R J *v y) + P *v (l *\<^sub>R E *v y))"
       by (simp add:E_def algebra_simps)
     also have "... \<le> norm (P *v ((1-l)*\<^sub>R J *v y)) + norm (P *v (l *\<^sub>R E *v y)) "
       by (intro norm_triangle_ineq)
     also have "... = (1 - l) * norm (P *v (J *v y)) + l * norm (P *v (E *v y))"
       using l_range
       by (simp add:vector_scaleR_matrix_ac_2 matrix_vector_mult_scaleR)
     also have "... = (1-l) * \<bar>1 \<bullet> (P *v y)/real CARD('n)\<bar> * norm t + l * norm (P *v (E *v y))"
-      by (subst a[symmetric]) 
+      by (subst a[symmetric])
         (simp add:apply_J proj_unit_def stat_def P_1_right matrix_vector_mult_scaleR)
     also have "... = (1-l) * \<bar>t \<bullet> y\<bar>/real CARD('n) * norm t + l * norm (P *v (E *v y))"
       by (subst dot_lmul_matrix[symmetric]) (simp add:P_1_left)
     also have "... \<le> (1-l) * (norm t * norm y) / real CARD('n) * norm t + l * (1 * norm (E *v y))"
       using P_norm Cauchy_Schwarz_ineq2 l_range
       by (intro add_mono mult_right_mono mult_left_mono divide_right_mono matrix_norm_boundD) auto
     also have "... = (1-l) * \<mu> * norm y + l * norm (E *v y)"
       unfolding \<mu>_def norm_t by simp
     also have "... \<le> (1-l) * \<mu> * norm y + l * (1 * norm y)"
       using \<mu>_range l_range
       by (intro add_mono matrix_norm_boundD mult_left_mono E_def) auto
     also have "... = (\<mu> + l * (1-\<mu>)) * norm y"
       by (simp add:algebra_simps)
     also have "... \<le> (\<mu> + l * (1-\<mu>)) * ((\<mu> + l * (1-\<mu>))^length xs * sqrt (card S)/CARD('n))"
       using b \<mu>_range l_range unfolding condition_def
       by (intro mult_left_mono) auto
     also have "... = (\<mu> + l * (1-\<mu>))^(length xs +1) * sqrt (card S)/CARD('n)"
       by simp
     finally have "norm (P *v (M *v y)) \<le> (\<mu> + l * (1-\<mu>))^(length xs +1) * sqrt (card S)/CARD('n)"
       by simp
 
     moreover have "P *v (P *v (M *v y)) = P *v (M *v y)"
-      unfolding matrix_vector_mul_assoc matrix_mul_assoc P_proj 
+      unfolding matrix_vector_mul_assoc matrix_mul_assoc P_proj
       by simp
 
     ultimately have "condition (P *v (M *v y)) (length (xs@[M]))"
       unfolding condition_def by simp
-  
-    then show ?case 
+
+    then show ?case
       unfolding y_def by simp
   qed
 
   have "inner r 1 = inner (P *v r) 1"
     using a condition_def by simp
   also have "... = inner (1 v* P) r"
     unfolding dot_lmul_matrix by (simp add:inner_commute)
   also have "... = inner t r"
     unfolding P_1_left by simp
   also have "... \<le> norm t * norm r"
     by (intro norm_cauchy_schwarz)
   also have "... \<le> sqrt (card S) * ((\<mu> + l * (1-\<mu>))^(length Ms) * sqrt(card S)/CARD('n))"
     using a unfolding condition_def norm_t
     by (intro mult_mono) auto
   also have "... = (\<mu> + 0) * ((\<mu> + l * (1-\<mu>))^(length Ms))"
     by (simp add:\<mu>_def)
   also have "... \<le> (\<mu> + l * (1-\<mu>)) * (\<mu> + l * (1-\<mu>))^(length Ms)"
     using \<mu>_range l_range
     by (intro mult_right_mono zero_le_power add_mono) auto
   also have "... = (\<mu> + l * (1-\<mu>))^(length Ms+1)" by simp
-  finally show ?thesis 
+  finally show ?thesis
     unfolding r_def by simp
 qed
 
 lemma upto_append:
   assumes "i \<le> j" "j \<le> k"
   shows  "[i..<j]@[j..<k] = [i..<k]"
   using assms by (metis less_eqE upt_add_eq_append)
 
 definition bool_list_split :: "bool list \<Rightarrow> (nat list \<times> nat)"
-  where "bool_list_split xs = foldl (\<lambda>(ys,z) x. (if x then (ys@[z],0) else (ys,z+1))) ([],0) xs" 
+  where "bool_list_split xs = foldl (\<lambda>(ys,z) x. (if x then (ys@[z],0) else (ys,z+1))) ([],0) xs"
 
 lemma bool_list_split:
   assumes "bool_list_split xs = (ys,z)"
   shows "xs = concat (map (\<lambda>k. replicate k False@[True]) ys)@replicate z False"
   using assms
 proof (induction xs arbitrary: ys z rule:rev_induct)
   case Nil
   then show ?case unfolding bool_list_split_def by simp
 next
   case (snoc x xs)
-  obtain u v where uv_def: "bool_list_split xs = (u,v)" 
+  obtain u v where uv_def: "bool_list_split xs = (u,v)"
     by (metis surj_pair)
 
-  show ?case 
+  show ?case
   proof (cases x)
     case True
     have a:"ys = u@[v]" "z = 0"
       using snoc(2) True uv_def unfolding bool_list_split_def by auto
     have "xs@[x] = concat (map (\<lambda>k. replicate k False@[True]) u)@replicate v False@[True]"
       using snoc(1)[OF uv_def] True by simp
     also have "... = concat (map (\<lambda>k. replicate k False@[True]) (u@[v]))@replicate 0 False"
       by simp
     also have "... = concat (map (\<lambda>k. replicate k False@[True]) (ys))@replicate z False"
       using a by simp
     finally show ?thesis by simp
   next
     case False
     have a:"ys = u" "z = v+1"
       using snoc(2) False uv_def unfolding bool_list_split_def by auto
     have "xs@[x] = concat (map (\<lambda>k. replicate k False@[True]) u)@replicate (v+1) False"
       using snoc(1)[OF uv_def] False unfolding replicate_add by simp
     also have "... = concat (map (\<lambda>k. replicate k False@[True]) (ys))@replicate z False"
       using a by simp
     finally show ?thesis by simp
   qed
 qed
 
 lemma bool_list_split_count:
   assumes "bool_list_split xs = (ys,z)"
   shows "length (filter id xs) = length ys"
   unfolding bool_list_split[OF assms(1)] by (simp add:filter_concat comp_def)
 
 lemma foldl_concat:
   "foldl f a (concat xss) = foldl (\<lambda>y xs. foldl f y xs) a xss"
   by (induction xss rule:rev_induct, auto)
 
 lemma hitting_property_alg_2:
-  fixes S :: "('n :: finite) set" and l :: nat 
+  fixes S :: "('n :: finite) set" and l :: nat
   fixes M :: "real^'n^'n"
   assumes \<alpha>_range: "\<alpha> \<in> {0..1}"
   assumes "I \<subseteq> {..<l}"
   defines "P i \<equiv> (if i \<in> I then diag (ind_vec S) else mat 1)"
   defines "\<mu> \<equiv> real (card S) / real (CARD('n))"
   assumes "spec_bound M \<alpha>" "markov M"
-  shows 
+  shows
     "foldl (\<lambda>x M. M *v x) stat (intersperse M (map P [0..<l])) \<bullet> 1 \<le> (\<mu>+\<alpha>*(1-\<mu>))^card I"
     (is "?L \<le> ?R")
 proof (cases "I \<noteq> {}")
   case True
   define xs where "xs = map (\<lambda>i. i \<in> I) [0..<l]"
   define Q where "Q = diag (ind_vec S)"
   define P' where "P' = (\<lambda>x. if x then Q else mat 1)"
 
   let ?rep = "(\<lambda>x. replicate x (mat 1))"
 
   have P_eq: "P i = P' (i \<in> I)" for i
     unfolding P_def P'_def Q_def by simp
 
-  have "l > 0" 
+  have "l > 0"
     using True assms(2) by auto
-  hence xs_ne: "xs \<noteq> []" 
+  hence xs_ne: "xs \<noteq> []"
     unfolding xs_def by simp
 
   obtain ys z where ys_z: "bool_list_split xs = (ys,z)"
     by (metis surj_pair)
 
 
-  have "length ys = length (filter id xs)" 
+  have "length ys = length (filter id xs)"
     using bool_list_split_count[OF ys_z] by simp
   also have "... = card (I \<inter> {0..<l})"
     unfolding xs_def filter_map by (simp add:comp_def distinct_length_filter)
   also have "... = card I"
     using Int_absorb2[OF assms(2)] unfolding atLeast0LessThan by simp
   finally have  len_ys: "length ys = card I" by simp
 
   hence "length ys > 0"
     using True assms(2) by (metis card_gt_0_iff finite_nat_iff_bounded)
-  then obtain yh yt where ys_split: "ys = yh#yt" 
+  then obtain yh yt where ys_split: "ys = yh#yt"
     by (metis length_greater_0_conv neq_Nil_conv)
 
   have a:"foldl (\<lambda>x N. M *v (N *v x)) x (?rep z) \<bullet> 1 = x \<bullet> 1" for x
   proof (induction z)
     case 0
     then show ?case by simp
   next
     case (Suc z)
     have "foldl (\<lambda>x N. M *v (N *v x)) x (?rep (z+1)) \<bullet> 1 = x \<bullet> 1"
-      unfolding replicate_add using Suc 
+      unfolding replicate_add using Suc
       by (simp add:markov_orth_inv[OF assms(6)])
     then show ?case by simp
   qed
 
-  have "M *v stat = stat" 
+  have "M *v stat = stat"
     using assms(6) unfolding stat_def matrix_vector_mult_scaleR markov_def by simp
   hence b: "foldl (\<lambda>x N. M *v (N *v x)) stat (?rep yh) = stat"
     by (induction yh, auto)
 
   have "foldl (\<lambda>x N. N *v (M *v x)) a (?rep x) = matrix_pow M x *v a" for x a
   proof (induction x)
     case 0
     then show ?case by simp
   next
     case (Suc x)
     have "foldl (\<lambda>x N. N *v (M *v x)) a (?rep (x+1)) =  matrix_pow M (x+1) *v a"
       unfolding replicate_add using Suc by (simp add: matrix_vector_mul_assoc)
     then show ?case by simp
   qed
   hence c: "foldl (\<lambda>x N. N *v (M *v x)) a (?rep x @ [Q]) = Q *v (matrix_pow M (x+1) *v a)" for x a
     by (simp add:matrix_vector_mul_assoc matrix_mul_assoc)
 
   have d: "spec_bound N \<alpha> \<and> markov N" if t1: "N \<in> set (map (\<lambda>x. matrix_pow M (x + 1)) yt)" for N
   proof -
     obtain y where N_def: "N = matrix_pow M (y+1)"
       using t1 by auto
     hence d1: "spec_bound N (\<alpha>^(y+1))"
       unfolding N_def using spec_bound_pow assms(5,6) by blast
-    have "spec_bound N (\<alpha>^1)" 
-      using \<alpha>_range by (intro spec_bound_mono[OF d1] power_decreasing) auto 
+    have "spec_bound N (\<alpha>^1)"
+      using \<alpha>_range by (intro spec_bound_mono[OF d1] power_decreasing) auto
     moreover have "markov N"
       unfolding N_def by (intro markov_matrix_pow assms(6))
     ultimately show ?thesis by simp
   qed
 
   have "?L = foldl (\<lambda>x M. M *v x) stat (intersperse M (map P' xs)) \<bullet> 1"
     unfolding P_eq xs_def map_map by (simp add:comp_def)
   also have "... = foldl (\<lambda>x M. M *v x) stat (intersperse M (map P' xs)@[M]) \<bullet> 1"
-    by (simp add:markov_orth_inv[OF assms(6)]) 
+    by (simp add:markov_orth_inv[OF assms(6)])
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map P' xs) \<bullet> 1"
     using xs_ne by (subst foldl_intersperse) auto
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat ((ys \<bind> (\<lambda>x. ?rep x @ [Q])) @ ?rep z) \<bullet> 1"
     unfolding bool_list_split[OF ys_z] P'_def List.bind_def by (simp add: comp_def map_concat)
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (ys \<bind> (\<lambda>x. ?rep x @ [Q])) \<bullet> 1"
     by (simp add: a)
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (?rep yh @[Q]@(yt \<bind>(\<lambda>x. ?rep x @ [Q]))) \<bullet> 1"
     unfolding ys_split by simp
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat ([Q]@(yt \<bind>(\<lambda>x. ?rep x @ [Q]))) \<bullet> 1"
     by (simp add:b)
   also have "... = foldl (\<lambda>x N. N *v x) stat (intersperse M (Q#(yt \<bind>(\<lambda>x.?rep x@[Q])))@[M])\<bullet>1"
     by (subst foldl_intersperse, auto)
   also have "... = foldl (\<lambda>x N. N *v x) stat (intersperse M (Q#(yt \<bind>(\<lambda>x.?rep x@[Q])))) \<bullet> 1"
-    by (simp add:markov_orth_inv[OF assms(6)]) 
-  also have "... = foldl (\<lambda>x N. N *v (M *v x)) (Q *v stat) (yt \<bind>(\<lambda>x.?rep x@[Q])) \<bullet> 1" 
+    by (simp add:markov_orth_inv[OF assms(6)])
+  also have "... = foldl (\<lambda>x N. N *v (M *v x)) (Q *v stat) (yt \<bind>(\<lambda>x.?rep x@[Q])) \<bullet> 1"
     by (subst foldl_intersperse_2, simp)
   also have "... = foldl (\<lambda>a x. foldl (\<lambda>x N. N *v (M *v x)) a (?rep x @ [Q])) (Q *v stat) yt \<bullet> 1"
     unfolding List.bind_def foldl_concat foldl_map by simp
   also have "... = foldl (\<lambda>a x. Q *v (matrix_pow M (x+1) *v a)) (Q *v stat) yt \<bullet> 1"
     unfolding c by simp
   also have "... = foldl (\<lambda>a N. Q *v (N *v a)) (Q *v stat) (map (\<lambda>x. matrix_pow M (x+1)) yt) \<bullet> 1"
     by (simp add:foldl_map)
   also have "... \<le> (\<mu> + \<alpha>*(1-\<mu>))^(length (map (\<lambda>x. matrix_pow M (x+1)) yt)+1)"
     unfolding \<mu>_def Q_def by (intro hitting_property_alg \<alpha>_range d) simp
-  also have "... = (\<mu> + \<alpha>*(1-\<mu>))^(length ys)" 
+  also have "... = (\<mu> + \<alpha>*(1-\<mu>))^(length ys)"
     unfolding ys_split by simp
   also have "... = ?R" unfolding len_ys by simp
   finally show ?thesis by simp
 next
   case False
   hence I_empty: "I = {}" by simp
 
   have "?L = stat \<bullet> (1 :: real^'n)"
   proof (cases "l > 0")
     case True
     have "?L = foldl (\<lambda>x M. M *v x) stat ((intersperse M (map P [0..<l]))@[M]) \<bullet> 1"
-      by (simp add:markov_orth_inv[OF assms(6)]) 
+      by (simp add:markov_orth_inv[OF assms(6)])
     also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map P [0..<l])  \<bullet> 1"
       using True by (subst foldl_intersperse, auto)
     also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map (\<lambda>_. mat 1) [0..<l])  \<bullet> 1"
       unfolding  P_def using I_empty by simp
     also have "... = foldl (\<lambda>x _. M *v x) stat [0..<l] \<bullet> 1"
       unfolding foldl_map by simp
     also have "... = stat \<bullet> (1 :: real^'n)"
       by (induction l, auto simp add:markov_orth_inv[OF assms(6)])
     finally show ?thesis by simp
   next
     case False
     then show ?thesis by simp
   qed
   also have "... = 1"
     unfolding stat_def by (simp add:inner_vec_def)
   also have "... \<le> ?R" unfolding I_empty by simp
   finally show ?thesis by simp
 qed
 
 lemma uniform_property_alg:
   fixes x :: "('n :: finite)" and l :: nat
   assumes "i < l"
   defines "P j \<equiv> (if j = i then diag (ind_vec {x}) else mat 1)"
   assumes "markov M"
   shows "foldl (\<lambda>x M. M *v x) stat (intersperse M (map P [0..<l])) \<bullet> 1 = 1 / CARD('n)"
-    (is "?L = ?R") 
+    (is "?L = ?R")
 proof -
   have a:"l > 0" using assms(1) by simp
 
   have 0: "foldl (\<lambda>x N. M *v (N *v x)) y (xs) \<bullet> 1 = y  \<bullet> 1" if "set xs \<subseteq> {mat 1}" for xs y
     using that
   proof (induction xs rule:rev_induct)
     case Nil
     then show ?case by simp
   next
     case (snoc x xs)
-    have "x = mat 1" 
+    have "x = mat 1"
       using snoc(2) by simp
     hence "foldl (\<lambda>x N. M *v (N *v x)) y (xs @ [x]) \<bullet> 1 = foldl (\<lambda>x N. M *v (N *v x)) y xs \<bullet> 1"
       by (simp add:markov_orth_inv[OF assms(3)])
     also have "... = y \<bullet> 1"
       using snoc(2) by (intro snoc(1)) auto
     finally show ?case by simp
   qed
 
-  have M_stat: "M *v stat = stat" 
+  have M_stat: "M *v stat = stat"
     using assms(3) unfolding stat_def matrix_vector_mult_scaleR markov_def by simp
 
   hence 1: "(foldl (\<lambda>x N. M *v (N *v x)) stat xs) = stat" if "set xs \<subseteq> {mat 1}" for xs
     using that by (induction xs, auto)
 
   have "?L = foldl (\<lambda>x M. M *v x) stat ((intersperse M (map P [0..<l]))@[M]) \<bullet> 1"
-    by (simp add:markov_orth_inv[OF assms(3)]) 
+    by (simp add:markov_orth_inv[OF assms(3)])
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map P [0..<l]) \<bullet> 1"
     using a by (subst foldl_intersperse) auto
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map P ([0..<i+1]@[i+1..<l])) \<bullet> 1"
     using assms(1) by (subst upto_append) auto
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map P [0..<i + 1]) \<bullet> 1"
     unfolding map_append foldl_append  P_def by (subst 0) auto
   also have "... = foldl (\<lambda>x N. M *v (N *v x)) stat (map P ([0..<i]@[i])) \<bullet> 1"
     by simp
   also have "... = (M *v (diag (ind_vec {x}) *v stat)) \<bullet> 1"
     unfolding map_append foldl_append P_def by (subst 1) auto
-  also have "... = (diag (ind_vec {x}) *v stat) \<bullet> 1" 
-    by (simp add:markov_orth_inv[OF assms(3)]) 
-  also have "... = ((1/CARD('n)) *\<^sub>R ind_vec {x}) \<bullet> 1" 
-    unfolding diag_def ind_vec_def  stat_def matrix_vector_mult_def 
-    by (intro arg_cong2[where f="(\<bullet>)"] refl) 
+  also have "... = (diag (ind_vec {x}) *v stat) \<bullet> 1"
+    by (simp add:markov_orth_inv[OF assms(3)])
+  also have "... = ((1/CARD('n)) *\<^sub>R ind_vec {x}) \<bullet> 1"
+    unfolding diag_def ind_vec_def  stat_def matrix_vector_mult_def
+    by (intro arg_cong2[where f="(\<bullet>)"] refl)
       (vector of_bool_def sum.If_cases if_distrib if_distribR)
   also have "... = (1/CARD('n)) * (ind_vec {x} \<bullet> 1)"
     by simp
   also have "... = (1/CARD('n)) * 1"
-    unfolding inner_vec_def ind_vec_def of_bool_def 
+    unfolding inner_vec_def ind_vec_def of_bool_def
     by (intro arg_cong2[where f="(*)"] refl) (simp)
   finally show ?thesis by simp
 qed
 
 end
 
 lemma foldl_matrix_mult_expand:
   fixes Ms :: "(('r::{semiring_1,comm_monoid_mult})^'a^'a) list"
-  shows "(foldl (\<lambda>x M. M *v x) a Ms) $ k = (\<Sum>x | length x = length Ms+1 \<and> x! length Ms = k. 
+  shows "(foldl (\<lambda>x M. M *v x) a Ms) $ k = (\<Sum>x | length x = length Ms+1 \<and> x! length Ms = k.
   (\<Prod> i< length Ms. (Ms ! i) $ (x ! (i+1)) $ (x ! i)) * a $ (x ! 0))"
 proof (induction Ms arbitrary: k rule:rev_induct)
   case Nil
   have "length x = Suc 0 \<Longrightarrow> x = [x!0]" for x :: "'a list"
     by (cases x, auto)
-  hence "{x. length x = Suc 0 \<and> x ! 0 = k} = {[k]}" 
-    by auto 
+  hence "{x. length x = Suc 0 \<and> x ! 0 = k} = {[k]}"
+    by auto
   thus ?case by auto
 next
   case (snoc M Ms)
   let ?l = "length Ms"
 
   have 0: "finite {w. length w = Suc (length Ms) \<and> w ! length Ms = i}" for i :: 'a
     using finite_lists_length_eq[where A="UNIV::'a set" and n="?l +1"] by simp
 
   have "take (?l+1) x @ [x ! (?l+1)] = x" if "length x = ?l+2" for x :: "'a list"
   proof -
     have "take (?l+1) x @ [x ! (?l+1)] = take (Suc (?l+1)) x"
       using that by (intro take_Suc_conv_app_nth[symmetric], simp)
-    also have "... = x" 
+    also have "... = x"
       using that by simp
     finally show ?thesis by simp
   qed
   hence 1: "bij_betw  (take (?l+1)) {w. length w=?l+2 \<and> w!(?l+1) =k} {w. length w = ?l+1}"
     by (intro bij_betwI[where g="\<lambda>x. x@[k]"]) (auto simp add:nth_append)
 
   have "foldl (\<lambda>x M. M *v x) a (Ms @ [M]) $ k = (\<Sum>j\<in>UNIV. M$k$j *(foldl (\<lambda>x M. M *v x) a Ms $ j))"
     by (simp add:matrix_vector_mult_def)
-  also have "... = 
+  also have "... =
     (\<Sum>j\<in>UNIV. M$k$j * (\<Sum>w|length w=?l+1\<and>w!?l=j. (\<Prod>i<?l. Ms!i $ w!(i+1) $ w!i) * a $ w!0))"
     unfolding snoc by simp
-  also have "... = 
+  also have "... =
     (\<Sum>j\<in>UNIV. (\<Sum>w|length w=?l+1\<and>w!?l=j. M$k$w!?l * (\<Prod>i<?l. Ms!i $ w!(i+1) $ w!i) * a $ w!0))"
     by (intro sum.cong refl) (simp add: sum_distrib_left algebra_simps)
-  also have "... = (\<Sum>w\<in> (\<Union>j \<in> UNIV. {w. length w=?l+1 \<and> w!?l =j}). 
+  also have "... = (\<Sum>w\<in> (\<Union>j \<in> UNIV. {w. length w=?l+1 \<and> w!?l =j}).
     M$k$w!?l*(\<Prod>i<?l. Ms!i $ w!(i+1) $ w!i) * a $ w!0)"
-    using 0 by (subst sum.UNION_disjoint, simp, simp) auto 
+    using 0 by (subst sum.UNION_disjoint, simp, simp) auto
   also have "... = (\<Sum>w | length w=?l+1. M$k$(w!?l)*(\<Prod>i<?l. Ms!i $ w!(i+1) $ w!i) * a $ w!0)"
     by (intro sum.cong arg_cong2[where f="(*)"] refl) auto
-  also have "... = (\<Sum>w \<in> take (?l+1) ` {w. length w=?l+2 \<and> w!(?l+1) =k}. 
+  also have "... = (\<Sum>w \<in> take (?l+1) ` {w. length w=?l+2 \<and> w!(?l+1) =k}.
     M$k$w!?l*(\<Prod>i<?l. Ms!i $ w!(i+1) $ w!i) * a $ w!0)"
-    using 1 unfolding bij_betw_def by (intro sum.cong refl, auto) 
+    using 1 unfolding bij_betw_def by (intro sum.cong refl, auto)
   also have "... = (\<Sum>w|length w=?l+2\<and>w!(?l+1)=k. M$k$w!?l*(\<Prod>i<?l. Ms!i $ w!(i+1) $ w!i)* a$w!0)"
     using 1 unfolding bij_betw_def by (subst sum.reindex, auto)
-  also have "... = (\<Sum>w|length w=?l+2\<and>w!(?l+1)=k. 
+  also have "... = (\<Sum>w|length w=?l+2\<and>w!(?l+1)=k.
     (Ms@[M])!?l$k$w!?l*(\<Prod>i<?l. (Ms@[M])!i $ w!(i+1) $ w!i)* a$w!0)"
     by (intro sum.cong arg_cong2[where f="(*)"] prod.cong refl) (auto simp add:nth_append)
   also have "... = (\<Sum>w|length w=?l+2\<and>w!(?l+1)=k. (\<Prod>i<(?l+1). (Ms@[M])!i $ w!(i+1) $ w!i)* a$w!0)"
     by (intro sum.cong, auto simp add:algebra_simps)
-  finally have "foldl (\<lambda>x M. M *v x) a (Ms @ [M]) $ k = 
+  finally have "foldl (\<lambda>x M. M *v x) a (Ms @ [M]) $ k =
     (\<Sum> w | length w = ?l+2 \<and> w ! (?l+1) = k. (\<Prod>i<(?l+1). (Ms@[M])!i $ w!(i+1) $ w!i)* a$w!0)"
     by simp
   then show ?case by simp
 qed
 
 lemma foldl_matrix_mult_expand_2:
   fixes Ms :: "(real^'a^'a) list"
-  shows "(foldl (\<lambda>x M. M *v x) a Ms) \<bullet> 1 = (\<Sum>x | length x = length Ms+1. 
+  shows "(foldl (\<lambda>x M. M *v x) a Ms) \<bullet> 1 = (\<Sum>x | length x = length Ms+1.
           (\<Prod> i< length Ms. (Ms ! i) $ (x ! (i+1)) $ (x ! i)) * a $ (x ! 0))"
   (is "?L = ?R")
 proof -
   let ?l = "length Ms"
   have "?L = (\<Sum>j \<in> UNIV. (foldl (\<lambda>x M. M *v x) a Ms) $ j)"
     by (simp add:inner_vec_def)
   also have "... = (\<Sum>j\<in>UNIV. \<Sum>x|length x=?l+1 \<and> x!?l=j.(\<Prod>i<?l. Ms!i $ x!(i+1) $ x!i) * a $ x!0)"
     unfolding foldl_matrix_mult_expand by simp
   also have "... = (\<Sum>x \<in> (\<Union>j\<in> UNIV.{w. length w = length Ms+1 \<and> w ! length Ms = j}).
           (\<Prod> i< length Ms. (Ms ! i) $ (x ! (i+1)) $ (x ! i)) * a $ (x ! 0))"
     using finite_lists_length_eq[where A="UNIV::'a set" and n="?l +1"]
     by (intro sum.UNION_disjoint[symmetric]) auto
   also have "... = ?R"
     by (intro sum.cong, auto)
   finally show ?thesis by simp
 qed
 
 end
diff --git a/thys/Expander_Graphs/Expander_Graphs_Cheeger_Inequality.thy b/thys/Expander_Graphs/Expander_Graphs_Cheeger_Inequality.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Cheeger_Inequality.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Cheeger_Inequality.thy
@@ -1,700 +1,699 @@
 section \<open>Cheeger Inequality\label{sec:cheeger_ineq}\<close>
 
 text \<open>The Cheeger inequality relates edge expansion (a combinatorial property) with the second
 largest eigenvalue.\<close>
 
 theory Expander_Graphs_Cheeger_Inequality
-  imports 
-    Expander_Graphs_Eigenvalues
+  imports Expander_Graphs_Eigenvalues
 begin
 
 unbundle intro_cong_syntax
 hide_const Quantum.T
 
 context regular_graph
 begin
 
 lemma edge_expansionD2:
   assumes "m = card (S \<inter> verts G)" "2*m \<le> n"
   shows "\<Lambda>\<^sub>e * m \<le> real (card (edges_betw S (-S)))"
 proof -
   define S' where "S' = S \<inter> verts G"
   have "\<Lambda>\<^sub>e * m = \<Lambda>\<^sub>e * card S'"
     using assms(1) S'_def by simp
   also have "... \<le> real (card (edges_betw S' (-S')))"
     using assms unfolding S'_def by (intro edge_expansionD) auto
   also have "... = real (card (edges_betw S (-S)))"
     unfolding S'_def edges_betw_def
     by (intro arg_cong[where f="real"] arg_cong[where f="card"]) auto
   finally show ?thesis by simp
 qed
 
 lemma edges_betw_sym:
   "card (edges_betw S T) = card (edges_betw T S)" (is "?L = ?R")
 proof -
   have "?L =  (\<Sum>a \<in> arcs G. of_bool (tail G a \<in> S \<and> head G a \<in> T))"
     unfolding edges_betw_def of_bool_def by (simp add:sum.If_cases Int_def)
   also have "... = (\<Sum>e \<in># edges G. of_bool (fst e \<in> S \<and> snd e \<in> T))"
     unfolding sum_unfold_sum_mset edges_def arc_to_ends_def
     by (simp add:image_mset.compositionality comp_def)
   also have "... =  (\<Sum>e \<in># edges G. of_bool (snd e \<in> S \<and> fst e \<in> T))"
-    by (subst edges_sym[OF sym, symmetric]) 
+    by (subst edges_sym[OF sym, symmetric])
         (simp add:image_mset.compositionality comp_def case_prod_beta)
   also have "... = (\<Sum>a \<in> arcs G. of_bool (tail G a \<in> T \<and> head G a \<in> S))"
     unfolding sum_unfold_sum_mset edges_def arc_to_ends_def
     by (simp add:image_mset.compositionality comp_def conj.commute)
   also have "... = ?R"
     unfolding edges_betw_def of_bool_def by (simp add:sum.If_cases Int_def)
   finally show ?thesis by simp
 qed
 
 lemma edges_betw_reg:
   assumes "S \<subseteq> verts G"
   shows "card (edges_betw S UNIV) = card S * d" (is "?L = ?R")
 proof -
   have "?L = card (\<Union>(out_arcs G ` S))"
     unfolding edges_betw_def out_arcs_def by (intro arg_cong[where f="card"]) auto
   also have "... = (\<Sum>i\<in>S. card (out_arcs G i))"
     using finite_subset[OF assms] unfolding out_arcs_def
     by (intro card_UN_disjoint) auto
   also have "... = (\<Sum>i\<in>S. out_degree G i)"
     unfolding out_degree_def by simp
   also have "... = (\<Sum>i\<in>S. d)"
     using assms by (intro sum.cong reg) auto
   also have "... = ?R"
     by simp
   finally show ?thesis by simp
 qed
 
 text \<open>The following proof follows Hoory et al.~@{cite \<open>\S 4.5.1\<close> "hoory2006"}.\<close>
 
 lemma cheeger_aux_2:
   assumes "n > 1"
   shows "\<Lambda>\<^sub>e \<ge> d*(1-\<Lambda>\<^sub>2)/2"
 proof -
-  have "real (card (edges_betw S (-S))) \<ge> (d * (1 - \<Lambda>\<^sub>2) / 2) * real (card S)" 
+  have "real (card (edges_betw S (-S))) \<ge> (d * (1 - \<Lambda>\<^sub>2) / 2) * real (card S)"
     if "S \<subseteq> verts G" "2 * card S \<le> n" for S
   proof -
-    let ?ct = "real (card (verts G - S))" 
-    let ?cs = "real (card S)" 
+    let ?ct = "real (card (verts G - S))"
+    let ?cs = "real (card S)"
 
     have "card (edges_betw S S)+card (edges_betw S (-S))=card(edges_betw S S\<union>edges_betw S (-S))"
       unfolding edges_betw_def by (intro card_Un_disjoint[symmetric]) auto
     also have "... = card (edges_betw S UNIV)"
       unfolding edges_betw_def by (intro arg_cong[where f="card"]) auto
     also have "... = d * ?cs"
       using edges_betw_reg[OF that(1)] by simp
-    finally have "card (edges_betw S S) + card (edges_betw S (-S)) = d * ?cs" by simp 
+    finally have "card (edges_betw S S) + card (edges_betw S (-S)) = d * ?cs" by simp
     hence 4: "card (edges_betw S S) = d * ?cs - card (edges_betw S (-S))"
       by simp
 
     have "card(edges_betw S(-S))+card(edges_betw(-S)(-S))=card(edges_betw S(-S)\<union>edges_betw(-S)(-S))"
       unfolding edges_betw_def by (intro card_Un_disjoint[symmetric]) auto
     also have "... = card (edges_betw UNIV (verts G - S))"
       unfolding edges_betw_def by (intro arg_cong[where f="card"]) auto
     also have "... = card (edges_betw (verts G - S) UNIV)"
       by (intro edges_betw_sym)
     also have "... = d * ?ct"
       using edges_betw_reg by auto
     finally have "card (edges_betw S (-S)) + card (edges_betw (-S) (-S)) = d * ?ct" by simp
     hence 5: "card (edges_betw (-S) (-S)) = d * ?ct - card (edges_betw S (-S))"
       by simp
-    have 6: "card (edges_betw (-S) S) = card (edges_betw S (-S))" 
+    have 6: "card (edges_betw (-S) S) = card (edges_betw S (-S))"
       by (intro edges_betw_sym)
 
     have "?cs + ?ct =real (card (S \<union> (verts G- S)))"
       unfolding of_nat_add[symmetric] using finite_subset[OF that(1)]
       by (intro_cong "[\<sigma>\<^sub>1 of_nat, \<sigma>\<^sub>1 card]" more:card_Un_disjoint[symmetric]) auto
     also have "... = real n"
-      unfolding n_def  using that(1) by (intro_cong "[\<sigma>\<^sub>1 of_nat, \<sigma>\<^sub>1 card]") auto 
+      unfolding n_def  using that(1) by (intro_cong "[\<sigma>\<^sub>1 of_nat, \<sigma>\<^sub>1 card]") auto
     finally have 7: "?cs + ?ct = n"  by simp
 
-    define f  where 
+    define f  where
       "f x = real (card (verts G - S)) * of_bool (x \<in> S) - card S * of_bool (x \<notin> S)" for x
 
     have "g_inner f (\<lambda>_. 1) = ?cs * ?ct - real (card (verts G \<inter> {x. x \<notin> S})) * ?cs"
       unfolding g_inner_def f_def using Int_absorb1[OF that(1)] by (simp add:sum_subtractf)
     also have "... = ?cs * ?ct - ?ct * ?cs"
       by (intro_cong "[\<sigma>\<^sub>2 (-), \<sigma>\<^sub>2 (*), \<sigma>\<^sub>1 of_nat, \<sigma>\<^sub>1 card]") auto
     also have "... = 0" by simp
     finally have 11:" g_inner f (\<lambda>_. 1) = 0" by simp
 
     have "g_norm f^2 = (\<Sum>v\<in>verts G. f v^2)"
       unfolding g_norm_sq g_inner_def conjugate_real_def by (simp add:power2_eq_square)
     also have "...=(\<Sum>v\<in>verts G. ?ct^2*(of_bool (v \<in> S))\<^sup>2)+(\<Sum>v\<in>verts G. ?cs^2*(of_bool (v \<notin> S))\<^sup>2)"
       unfolding f_def power2_diff by (simp add:sum.distrib sum_subtractf power_mult_distrib)
     also have "... = real (card (verts G \<inter> S))*?ct^2 + real (card (verts G \<inter> {v. v \<notin> S})) * ?cs^2"
       unfolding of_bool_def by (simp add:if_distrib if_distribR sum.If_cases)
     also have "... = real(card S)*(real(card(verts G-S)))\<^sup>2 + real(card(verts G-S))*(real(card S))\<^sup>2"
       using that(1) by (intro_cong "[\<sigma>\<^sub>2(+), \<sigma>\<^sub>2 (*), \<sigma>\<^sub>2 power, \<sigma>\<^sub>1 of_nat, \<sigma>\<^sub>1 card]") auto
     also have "...  = real(card S)*real (card (verts G -S))*(?cs + ?ct)"
       by (simp add:power2_eq_square algebra_simps)
     also have "...  = real(card S)*real (card (verts G -S))*n"
       unfolding 7 by simp
     finally have 9:" g_norm f^2 = real(card S)*real (card (verts G -S))*real n" by simp
 
-    have "(\<Sum>a \<in> arcs G. f (head G a) * f (tail G a)) = 
-      (card (edges_betw S S) * ?ct*?ct) + (card (edges_betw (-S) (-S)) * ?cs*?cs) - 
+    have "(\<Sum>a \<in> arcs G. f (head G a) * f (tail G a)) =
+      (card (edges_betw S S) * ?ct*?ct) + (card (edges_betw (-S) (-S)) * ?cs*?cs) -
       (card (edges_betw S (-S)) * ?ct*?cs) - (card (edges_betw (-S) S) * ?cs*?ct)"
-      unfolding f_def by (simp add:of_bool_def algebra_simps Int_def if_distrib if_distribR 
+      unfolding f_def by (simp add:of_bool_def algebra_simps Int_def if_distrib if_distribR
           edges_betw_def sum.If_cases)
     also have "... = d*?cs*?ct*(?cs+?ct) - card (edges_betw S (-S))*(?ct*?ct+2*?ct*?cs+?cs*?cs)"
       unfolding 4 5 6 by (simp add:algebra_simps)
     also have "... = d*?cs*?ct*n - (?ct+?cs)^2 * card (edges_betw S (-S))"
       unfolding power2_diff 7 power2_sum by (simp add:ac_simps power2_eq_square)
     also have "... = d *?cs*?ct*n - n^2 * card (edges_betw S (-S))"
       using 7 by (simp add:algebra_simps)
-    finally have 8:"(\<Sum>a \<in> arcs G. f(head G a)*f(tail G a))=d*?cs*?ct*n-n^2*card(edges_betw S (-S))" 
+    finally have 8:"(\<Sum>a \<in> arcs G. f(head G a)*f(tail G a))=d*?cs*?ct*n-n^2*card(edges_betw S (-S))"
       by simp
 
     have "d*?cs*?ct*n-n^2*card(edges_betw S (-S)) = (\<Sum>a \<in> arcs G. f (head G a) * f (tail G a))"
       unfolding 8 by simp
     also have "... \<le> d * (g_inner f (g_step f))"
       unfolding g_inner_step_eq using d_gt_0
       by simp
     also have "... \<le> d * (\<Lambda>\<^sub>2 * g_norm f^2)"
       by (intro mult_left_mono os_expanderD 11) auto
     also have "... = d * \<Lambda>\<^sub>2 * ?cs*?ct*n"
       unfolding 9 by simp
-    finally have "d*?cs*?ct*n-n^2*card(edges_betw S (-S)) \<le> d * \<Lambda>\<^sub>2 * ?cs*?ct*n" 
+    finally have "d*?cs*?ct*n-n^2*card(edges_betw S (-S)) \<le> d * \<Lambda>\<^sub>2 * ?cs*?ct*n"
       by simp
     hence "n * n * card (edges_betw S (-S)) \<ge> n * (d * ?cs * ?ct * (1-\<Lambda>\<^sub>2))"
       by (simp add:power2_eq_square algebra_simps)
     hence 10:"n * card (edges_betw S (-S)) \<ge> d * ?cs * ?ct * ( 1-\<Lambda>\<^sub>2)"
-      using n_gt_0 by simp 
+      using n_gt_0 by simp
 
     have "(d * (1 - \<Lambda>\<^sub>2) / 2) * ?cs = (d * (1-\<Lambda>\<^sub>2) * (1 - 1 / 2)) * ?cs"
       by simp
     also have "... \<le> d * (1-\<Lambda>\<^sub>2) * ((n - ?cs) / n) * ?cs"
-      using that n_gt_0 \<Lambda>\<^sub>2_le_1 
+      using that n_gt_0 \<Lambda>\<^sub>2_le_1
       by (intro mult_left_mono mult_right_mono mult_nonneg_nonneg) auto
     also have "... = (d * (1-\<Lambda>\<^sub>2) * ?ct / n) * ?cs"
       using 7 by simp
     also have "... = d * ?cs * ?ct * (1-\<Lambda>\<^sub>2) / n"
       by simp
     also have "... \<le> n * card (edges_betw S (-S)) / n"
       by (intro divide_right_mono 10) auto
     also have "... = card (edges_betw S (-S))"
       using n_gt_0 by simp
     finally show ?thesis by simp
   qed
   thus ?thesis
     by (intro edge_expansionI assms) auto
 qed
 
 end
 
 lemma surj_onI:
   assumes "\<And>x. x \<in> B \<Longrightarrow> g x \<in> A \<and> f (g x) = x"
   shows "B \<subseteq> f ` A"
   using assms by force
 
 lemma find_sorted_bij_1:
   fixes g :: "'a \<Rightarrow> ('b :: linorder)"
   assumes "finite S"
   shows "\<exists>f. bij_betw f {..<card S} S \<and> mono_on {..<card S} (g\<circ> f)"
 proof -
   define h where "h x = from_nat_into S x" for x
 
   have h_bij:"bij_betw h {..<card S} S"
     unfolding h_def using bij_betw_from_nat_into_finite[OF assms] by simp
 
   define xs where "xs = sort_key (g \<circ> h) [0..<card S]"
   define f where "f i = h (xs ! i)" for i
 
-  have l_xs: "length xs = card S" 
-    unfolding xs_def by auto 
-  have set_xs: "set xs = {..<card S}" 
-    unfolding xs_def by auto 
-  have dist_xs: "distinct xs" 
+  have l_xs: "length xs = card S"
+    unfolding xs_def by auto
+  have set_xs: "set xs = {..<card S}"
+    unfolding xs_def by auto
+  have dist_xs: "distinct xs"
     using l_xs set_xs by (intro card_distinct) simp
   have sorted_xs: "sorted (map (g \<circ> h) xs)"
     unfolding xs_def using sorted_sort_key by simp
 
   have "(\<lambda>i. xs ! i) ` {..<card S} = set xs"
     using l_xs by (auto simp:in_set_conv_nth)
   also have "... = {..<card S}"
     unfolding set_xs by simp
-  finally have set_xs': 
+  finally have set_xs':
     "(\<lambda>i. xs ! i) ` {..<card S} = {..<card S}" by simp
 
   have "f ` {..<card S} = h ` ((\<lambda>i. xs ! i) ` {..<card S})"
     unfolding f_def image_image by simp
   also have "... = h ` {..<card S}"
     unfolding set_xs' by simp
   also have "... = S"
     using bij_betw_imp_surj_on[OF h_bij] by simp
   finally have 0: "f ` {..<card S} = S" by simp
 
-  have "inj_on ((!) xs) {..<card S}" 
-    using dist_xs l_xs unfolding distinct_conv_nth 
-    by (intro inj_onI) auto  
+  have "inj_on ((!) xs) {..<card S}"
+    using dist_xs l_xs unfolding distinct_conv_nth
+    by (intro inj_onI) auto
   hence "inj_on (h \<circ> (\<lambda>i. xs ! i)) {..<card S}"
     using set_xs' bij_betw_imp_inj_on[OF h_bij]
     by (intro comp_inj_on) auto
   hence 1: "inj_on f {..<card S}"
     unfolding f_def comp_def by simp
-  have 2: "mono_on {..<card S} (g \<circ> f)" 
-    using sorted_nth_mono[OF sorted_xs] l_xs unfolding f_def 
+  have 2: "mono_on {..<card S} (g \<circ> f)"
+    using sorted_nth_mono[OF sorted_xs] l_xs unfolding f_def
     by (intro mono_onI)  simp
-  thus ?thesis 
+  thus ?thesis
     using 0 1 2 unfolding bij_betw_def by auto
 qed
 
 lemma find_sorted_bij_2:
   fixes g :: "'a \<Rightarrow> ('b :: linorder)"
   assumes "finite S"
   shows "\<exists>f. bij_betw f S {..<card S} \<and> (\<forall>x y. x \<in> S \<and> y \<in> S \<and> f x < f y \<longrightarrow> g x \<le> g y)"
 proof -
   obtain f where f_def: "bij_betw f {..<card S} S" "mono_on {..<card S} (g \<circ> f)"
     using find_sorted_bij_1 [OF assms] by auto
 
   define h where "h = the_inv_into {..<card S} f"
   have bij_h: "bij_betw h S {..<card S}"
     unfolding h_def by (intro bij_betw_the_inv_into f_def)
 
   moreover have "g x \<le> g y" if "h x < h y" "x \<in> S" "y \<in> S" for x y
   proof -
     have "h y < card S" "h x < card S" "h x \<le> h y"
       using bij_betw_apply[OF bij_h] that by auto
     hence "g (f (h x)) \<le> g (f (h y))"
       using f_def(2) unfolding mono_on_def by simp
     moreover have "f ` {..<card S} = S"
-      using bij_betw_imp_surj_on[OF f_def(1)] by simp 
+      using bij_betw_imp_surj_on[OF f_def(1)] by simp
     ultimately show "g x \<le> g y"
       unfolding h_def using that f_the_inv_into_f[OF bij_betw_imp_inj_on[OF f_def(1)]]
       by auto
   qed
   ultimately show ?thesis by auto
 qed
 
 context regular_graph_tts
 begin
 
 text \<open>Normalized Laplacian of the graph\<close>
 definition L where "L = mat 1 - A"
 
 lemma L_pos_semidefinite:
   fixes v :: "real ^'n"
   shows  "v \<bullet> (L *v v)  \<ge> 0"
 proof -
   have "0 = v \<bullet> v - norm v^2" unfolding power2_norm_eq_inner by simp
   also have "... \<le> v \<bullet> v - abs (v \<bullet> (A *v v))"
     by (intro diff_mono rayleigh_bound) auto
   also have "... \<le> v \<bullet> v - v \<bullet> (A *v v)"
     by (intro diff_mono) auto
   also have "... = v \<bullet> (L *v v)"
     unfolding L_def by (simp add:algebra_simps)
   finally show ?thesis by simp
 qed
 
 text \<open>The following proof follows Hoory et al.~@{cite \<open>\S 4.5.2\<close> "hoory2006"}.\<close>
 
 lemma cheeger_aux_1:
   assumes "n > 1"
   shows "\<Lambda>\<^sub>e \<le> d * sqrt (2 * (1-\<Lambda>\<^sub>2))"
 proof -
   obtain v where v_def: "v \<bullet> 1 = 0" "v \<noteq> 0" "A *v v = \<Lambda>\<^sub>2 *s v"
     using \<Lambda>\<^sub>2_eq_\<gamma>\<^sub>2 \<gamma>\<^sub>2_ev[OF assms] by auto
 
   have "False" if "2*card {i. (1 *s v) $h i > 0} > n" "2*card {i. ((-1) *s v) $h i > 0} > n"
   proof -
     have "2 * n = n + n" by simp
     also have "... <2 * card {i.  (1 *s v) $h i > 0} + 2 * card {i. ((-1) *s v) $h i > 0}"
       by (intro add_strict_mono that)
     also have "... = 2 * (card {i.  (1 *s v) $h i > 0} + card {i.  ((-1) *s v) $h i > 0})"
       by simp
     also have "... = 2 * (card ({i.  (1 *s v) $h i > 0} \<union> {i.  ((-1) *s v) $h i > 0}))"
       by (intro arg_cong2[where f="(*)"] card_Un_disjoint[symmetric]) auto
     also have "... \<le> 2 * (card (UNIV :: 'n set))"
       by (intro mult_left_mono card_mono) auto
-    finally have "2 * n < 2 * n" 
+    finally have "2 * n < 2 * n"
       unfolding n_def card_n by auto
     thus ?thesis by simp
   qed
   then obtain \<beta>  :: real where \<beta>_def: "\<beta> = 1 \<or> \<beta>=(-1)" "2* card {i. (\<beta> *s v) $h i > 0 } \<le> n"
     unfolding not_le[symmetric] by blast
 
   define g where "g = \<beta> *s v"
 
-  have g_orth: "g \<bullet> 1 = 0" unfolding g_def using v_def(1) 
+  have g_orth: "g \<bullet> 1 = 0" unfolding g_def using v_def(1)
     by (simp add: scalar_mult_eq_scaleR)
-  have g_nz: "g \<noteq> 0" 
+  have g_nz: "g \<noteq> 0"
     unfolding g_def using \<beta>_def(1) v_def(2) by auto
   have g_ev: "A *v g = \<Lambda>\<^sub>2 *s g"
     unfolding g_def scalar_mult_eq_scaleR matrix_vector_mult_scaleR v_def(3) by auto
   have g_supp: "2 * card { i. g $h i > 0 } \<le> n"
     unfolding g_def using \<beta>_def(2) by auto
 
   define f where "f = (\<chi> i. max (g $h i) 0)"
 
   have "(L *v f) $h i \<le> (1-\<Lambda>\<^sub>2) * g $h i" (is "?L \<le> ?R") if "g $h i > 0" for i
   proof -
     have "?L = f $h i - (A *v f) $h i"
       unfolding L_def by (simp add:algebra_simps)
     also have "... = g $h i - (\<Sum>j \<in> UNIV. A $h i $h j * f $h j)"
       unfolding matrix_vector_mult_def f_def using that by auto
     also have "... \<le> g $h i - (\<Sum>j \<in> UNIV. A $h i $h j * g $h j)"
       unfolding f_def A_def by (intro diff_mono sum_mono mult_left_mono) auto
-    also have "... = g $h i - (A *v g) $h i" 
+    also have "... = g $h i - (A *v g) $h i"
       unfolding matrix_vector_mult_def by simp
     also have "... = (1-\<Lambda>\<^sub>2) * g $h i"
       unfolding g_ev by (simp add:algebra_simps)
     finally show ?thesis by simp
   qed
-  moreover have "f $h i \<noteq> 0 \<Longrightarrow> g $h i > 0 "for i 
+  moreover have "f $h i \<noteq> 0 \<Longrightarrow> g $h i > 0 "for i
     unfolding f_def by simp
   ultimately have  0:"(L *v f) $h i \<le> (1-\<Lambda>\<^sub>2) * g $h i \<or> f $h i = 0" for i
     by auto
 
   text \<open>Part (i) in Hoory et al. (\S 4.5.2) but the operator L here is normalized.\<close>
   have "f \<bullet> (L *v f) = (\<Sum>i\<in>UNIV. (L *v f) $h i * f $h i)"
     unfolding inner_vec_def by (simp add:ac_simps)
   also have "... \<le> (\<Sum>i\<in>UNIV. ((1-\<Lambda>\<^sub>2) * g $h i) * f $h i)"
     by (intro sum_mono mult_right_mono' 0) (simp add:f_def)
   also have "... = (\<Sum>i\<in>UNIV. (1-\<Lambda>\<^sub>2) * f $h i * f $h i)"
     unfolding f_def by (intro sum.cong refl) auto
   also have "... = (1-\<Lambda>\<^sub>2) * (f \<bullet> f)"
     unfolding inner_vec_def by (simp add:sum_distrib_left ac_simps)
   also have "... = (1 - \<Lambda>\<^sub>2) * norm f^2"
     by (simp add: power2_norm_eq_inner)
   finally have h_part_i: "f \<bullet> (L *v f) \<le> (1 - \<Lambda>\<^sub>2) * norm f^2" by simp
 
   define f' where "f' x = f $h (enum_verts_inv x)" for x
   have f'_alt: "f = (\<chi> i. f' (enum_verts i))"
     unfolding f'_def Rep_inverse by simp
 
   define B\<^sub>f where "B\<^sub>f  = (\<Sum>a\<in>arcs G. \<bar>f' (tail G a)^2-f' (head G a)^2\<bar>)"
 
   have "(x + y)^2 \<le> 2 * (x^2  + y^2)" for x y :: real
   proof -
     have "(x + y)^2 = (x^2 + y^2) + 2 * x * y"
       unfolding power2_sum by simp
     also have "... \<le> (x^2 + y^2) + (x^2 + y^2)"
       by (intro add_mono sum_squares_bound) auto
     finally show ?thesis by simp
   qed
   hence "(\<Sum>a\<in>arcs G.(f'(tail G a)+ f'(head G a))\<^sup>2)\<le>(\<Sum>a\<in>arcs G. 2*(f'(tail G a)^2+f'(head G a)^2))"
     by (intro sum_mono) auto
   also have "... = 2*((\<Sum>a\<in>arcs G. f'(tail G a)^2) +  (\<Sum>a\<in>arcs G. f'(head G a)^2))"
     by (simp add:sum_distrib_left)
   also have "... = 4 * d * g_norm f'^2"
     unfolding sum_arcs_tail[where f="\<lambda>x. f' x^2"] sum_arcs_head[where f="\<lambda>x. f' x^2"]
       g_norm_sq g_inner_def by (simp add:power2_eq_square)
   also have "... = 4 * d * norm f^2"
     unfolding g_norm_conv f'_alt by simp
   finally have 1: "(\<Sum>i\<in>arcs G. (f' (tail G i) + f' (head G i))\<^sup>2) \<le> 4*d* norm f^2"
     by simp
 
-  have "(\<Sum>a\<in>arcs G. (f' (tail G a) - f' (head G a))\<^sup>2) = (\<Sum>a\<in>arcs G. (f' (tail G a))\<^sup>2) + 
+  have "(\<Sum>a\<in>arcs G. (f' (tail G a) - f' (head G a))\<^sup>2) = (\<Sum>a\<in>arcs G. (f' (tail G a))\<^sup>2) +
     (\<Sum>a\<in>arcs G. (f' (head G a))\<^sup>2) - 2* (\<Sum>a\<in>arcs G. f' (tail G a) * f' (head G a))"
     unfolding power2_diff by (simp add:sum_subtractf sum_distrib_left ac_simps)
   also have "... =  2 * (d * (\<Sum>v\<in>verts G. (f' v)\<^sup>2) - (\<Sum>a\<in>arcs G. f' (tail G a) * f' (head G a)))"
     unfolding sum_arcs_tail[where f="\<lambda>x. f' x^2"] sum_arcs_head[where f="\<lambda>x. f' x^2"] by simp
   also have "... =  2 * (d * g_inner f' f' - d * g_inner f' (g_step f'))"
     unfolding g_inner_step_eq using d_gt_0
     by (intro_cong "[\<sigma>\<^sub>2 (*), \<sigma>\<^sub>2 (-)]") (auto simp:power2_eq_square g_inner_def ac_simps)
   also have "... = 2 * d * (g_inner f' f' -g_inner f' (g_step f'))"
-    by (simp add:algebra_simps) 
+    by (simp add:algebra_simps)
   also have "... = 2 * d * (f \<bullet> f - f \<bullet> (A *v f))"
     unfolding g_inner_conv g_step_conv f'_alt by simp
   also have "... = 2 * d * (f \<bullet> (L *v f))"
     unfolding L_def by (simp add:algebra_simps)
   finally have 2:"(\<Sum>a\<in>arcs G. (f' (tail G a) - f' (head G a))\<^sup>2) = 2 * d * (f \<bullet> (L *v f))" by simp
 
   have "B\<^sub>f = (\<Sum>a\<in>arcs G. \<bar>f' (tail G a)+f' (head G a)\<bar>*\<bar>f' (tail G a)-f' (head G a)\<bar>)"
     unfolding B\<^sub>f_def abs_mult[symmetric] by (simp add:algebra_simps power2_eq_square)
-  also have "...\<le> L2_set (\<lambda>a. f'(tail G a) + f'(head G a)) (arcs G) * 
+  also have "...\<le> L2_set (\<lambda>a. f'(tail G a) + f'(head G a)) (arcs G) *
     L2_set (\<lambda>a. f' (tail G a) - f'(head G a)) (arcs G)"
     by (intro L2_set_mult_ineq)
   also have "... \<le> sqrt (4*d* norm f^2) * sqrt (2 * d * (f \<bullet> (L *v f)))"
     unfolding L2_set_def 2
-    by (intro mult_right_mono iffD2[OF real_sqrt_le_iff] 1 real_sqrt_ge_zero 
+    by (intro mult_right_mono iffD2[OF real_sqrt_le_iff] 1 real_sqrt_ge_zero
         mult_nonneg_nonneg L_pos_semidefinite) auto
   also have "... = 2 * sqrt 2 * d * norm f * sqrt (f \<bullet> (L *v f))"
     by (simp add:real_sqrt_mult)
-  finally have hoory_4_12: "B\<^sub>f \<le> 2 * sqrt 2 * d * norm f * sqrt (f \<bullet> (L *v f))" 
+  finally have hoory_4_12: "B\<^sub>f \<le> 2 * sqrt 2 * d * norm f * sqrt (f \<bullet> (L *v f))"
     by simp
   text \<open>The last statement corresponds to Lemma 4.12 in Hoory et al.\<close>
 
 
-  obtain \<rho> :: "'a \<Rightarrow> nat" where \<rho>_bij: "bij_betw \<rho> (verts G) {..<n}" and 
+  obtain \<rho> :: "'a \<Rightarrow> nat" where \<rho>_bij: "bij_betw \<rho> (verts G) {..<n}" and
     \<rho>_dec: "\<And>x y. x \<in> verts G \<Longrightarrow> y \<in> verts G \<Longrightarrow> \<rho> x < \<rho> y \<Longrightarrow> f' x \<ge> f' y"
     unfolding n_def
     using find_sorted_bij_2[where S="verts G" and g="(\<lambda>x. - f' x)"] by auto
 
   define \<phi> where "\<phi> = the_inv_into (verts G) \<rho>"
   have \<phi>_bij: "bij_betw \<phi> {..<n} (verts G)"
     unfolding \<phi>_def by (intro bij_betw_the_inv_into \<rho>_bij)
 
   have "edges G = {# e \<in># edges G . \<rho>(fst e) \<noteq> \<rho>(snd e) \<or> \<rho>(fst e) = \<rho>(snd e) #}"
     by simp
   also have "... = {# e \<in># edges G . \<rho>(fst e) \<noteq> \<rho>(snd e) #} + {#e\<in>#edges G. \<rho>(fst e)=\<rho>(snd e)#}"
     by (simp add:filter_mset_ex_predicates)
   also have "...={# e\<in>#edges G. \<rho>(fst e)<\<rho>(snd e)\<or>\<rho>(fst e)>\<rho>(snd e)#}+{#e\<in>#edges G. fst e=snd e#}"
     using bij_betw_imp_inj_on[OF \<rho>_bij] edge_set
     by (intro arg_cong2[where f="(+)"] filter_mset_cong refl inj_on_eq_iff[where A="verts G"])
      auto
-  also have "... = {#e \<in># edges G. \<rho>(fst e) < \<rho> (snd e) #} + 
-    {#e \<in># edges G. \<rho>(fst e) > \<rho> (snd e) #} + 
+  also have "... = {#e \<in># edges G. \<rho>(fst e) < \<rho> (snd e) #} +
+    {#e \<in># edges G. \<rho>(fst e) > \<rho> (snd e) #} +
     {#e \<in># edges G. fst e = snd e #}"
     by (intro arg_cong2[where f="(+)"] filter_mset_ex_predicates[symmetric]) auto
-  finally have edges_split: "edges G = {#e \<in># edges G. \<rho>(fst e) < \<rho> (snd e) #} + 
-    {#e \<in># edges G. \<rho>(fst e) > \<rho> (snd e) #} + {#e \<in># edges G. fst e = snd e #}" 
+  finally have edges_split: "edges G = {#e \<in># edges G. \<rho>(fst e) < \<rho> (snd e) #} +
+    {#e \<in># edges G. \<rho>(fst e) > \<rho> (snd e) #} + {#e \<in># edges G. fst e = snd e #}"
     by simp
 
   have \<rho>_lt_n: "\<rho> x < n" if "x \<in> verts G" for x
     using bij_betw_apply[OF \<rho>_bij] that by auto
 
   have \<phi>_\<rho>_inv: "\<phi> (\<rho> x) = x" if "x \<in> verts G" for x
     unfolding \<phi>_def using bij_betw_imp_inj_on[OF \<rho>_bij]
     by (intro the_inv_into_f_f that) auto
 
   have \<rho>_\<phi>_inv: "\<rho> (\<phi> x) = x" if "x < n" for x
     unfolding \<phi>_def using bij_betw_imp_inj_on[OF \<rho>_bij] bij_betw_imp_surj_on[OF \<rho>_bij] that
     by (intro f_the_inv_into_f) auto
 
   define \<tau> where "\<tau> x = (if x < n then f' (\<phi> x) else 0)" for x
 
-  have \<tau>_nonneg: "\<tau> k \<ge> 0" for k 
+  have \<tau>_nonneg: "\<tau> k \<ge> 0" for k
     unfolding \<tau>_def f'_def f_def by auto
 
   have \<tau>_antimono: "\<tau> k \<ge> \<tau> l" if " k < l" for k l
   proof (cases "l \<ge> n")
     case True
     hence "\<tau> l = 0" unfolding \<tau>_def by simp
-    then show ?thesis using \<tau>_nonneg by simp 
+    then show ?thesis using \<tau>_nonneg by simp
   next
     case False
-    hence "\<tau> l = f' (\<phi> l)" 
+    hence "\<tau> l = f' (\<phi> l)"
       unfolding \<tau>_def by simp
     also have "... \<le> f' (\<phi> k)"
-      using \<rho>_\<phi>_inv False that 
-      by (intro \<rho>_dec bij_betw_apply[OF \<phi>_bij]) auto  
+      using \<rho>_\<phi>_inv False that
+      by (intro \<rho>_dec bij_betw_apply[OF \<phi>_bij]) auto
     also have "... = \<tau> k"
       unfolding \<tau>_def using False that by simp
     finally show ?thesis by simp
   qed
 
   define m :: nat where "m = Min {i. \<tau> i = 0 \<and> i \<le> n}"
 
-  have "\<tau> n = 0" 
+  have "\<tau> n = 0"
     unfolding \<tau>_def by simp
   hence "m \<in> {i. \<tau> i = 0 \<and> i \<le> n}"
     unfolding m_def by (intro Min_in) auto
 
   hence m_rel_1: "\<tau> m = 0" and m_le_n: "m \<le> n" by auto
 
   have "\<tau> k > 0" if "k < m" for k
   proof (rule ccontr)
-    assume "\<not>(\<tau> k > 0)" 
+    assume "\<not>(\<tau> k > 0)"
     hence "\<tau> k = 0"
       by (intro order_antisym \<tau>_nonneg) simp
     hence "k \<in> {i. \<tau> i = 0 \<and> i \<le> n}"
       using that m_le_n by simp
-    hence "m \<le> k" 
+    hence "m \<le> k"
       unfolding m_def by (intro Min_le) auto
     thus "False" using that by simp
   qed
   hence m_rel_2: "f' x > 0" if "x \<in> \<phi> ` {..<m}" for x
     unfolding \<tau>_def using m_le_n that by auto
 
   have "2 * m = 2 * card {..<m}" by simp
-  also have "... = 2 * card (\<phi> ` {..<m})" 
+  also have "... = 2 * card (\<phi> ` {..<m})"
     using m_le_n inj_on_subset[OF bij_betw_imp_inj_on[OF \<phi>_bij]]
     by (intro_cong "[\<sigma>\<^sub>2 (*)]" more:card_image[symmetric]) auto
   also have "... \<le> 2 * card {x \<in> verts G. f' x > 0}"
     using m_rel_2 bij_betw_apply[OF \<phi>_bij] m_le_n
-    by (intro mult_left_mono card_mono subsetI) auto 
+    by (intro mult_left_mono card_mono subsetI) auto
   also have "... = 2 * card (enum_verts_inv ` {x \<in> verts G. f $h (enum_verts_inv x) > 0})"
     unfolding f'_def using Abs_inject
-    by (intro arg_cong2[where f="(*)"] card_image[symmetric] inj_onI) auto 
+    by (intro arg_cong2[where f="(*)"] card_image[symmetric] inj_onI) auto
   also have "... = 2 * card {x. f $h x > 0}"
-    using Rep_inverse Rep_range unfolding f'_def by (intro_cong "[\<sigma>\<^sub>2 (*), \<sigma>\<^sub>1 card]" 
-        more:subset_antisym image_subsetI surj_onI[where g="enum_verts"]) auto 
+    using Rep_inverse Rep_range unfolding f'_def by (intro_cong "[\<sigma>\<^sub>2 (*), \<sigma>\<^sub>1 card]"
+        more:subset_antisym image_subsetI surj_onI[where g="enum_verts"]) auto
   also have "... = 2 * card {x. g $h x > 0}"
     unfolding f_def by (intro_cong "[\<sigma>\<^sub>2 (*), \<sigma>\<^sub>1 card]") auto
-  also have "... \<le> n" 
+  also have "... \<le> n"
     by (intro g_supp)
   finally have m2_le_n: "2*m \<le> n" by simp
 
   have "\<tau> k \<le> 0" if "k > m" for k
     using m_rel_1 \<tau>_antimono that by metis
   hence "\<tau> k \<le> 0" if "k \<ge> m" for k
     using m_rel_1 that by (cases "k > m") auto
   hence \<tau>_supp: "\<tau> k = 0" if "k \<ge> m" for k
     using that  by (intro order_antisym \<tau>_nonneg) auto
 
   have 4: "\<rho> v \<le> x \<longleftrightarrow> v \<in> \<phi> ` {..x}" if "v \<in> verts G" "x < n" for v x
   proof -
-    have "\<rho> v \<le> x \<longleftrightarrow> \<rho> v \<in> {..x}" 
+    have "\<rho> v \<le> x \<longleftrightarrow> \<rho> v \<in> {..x}"
       by simp
     also have "... \<longleftrightarrow> \<phi> (\<rho> v) \<in> \<phi> ` {..x}"
       using bij_betw_imp_inj_on[OF \<phi>_bij] bij_betw_apply[OF \<rho>_bij] that
       by (intro inj_on_image_mem_iff[where B="{..<n}", symmetric]) auto
     also have "... \<longleftrightarrow> v \<in> \<phi> ` {..x}"
       unfolding \<phi>_\<rho>_inv[OF that(1)] by simp
     finally show ?thesis by simp
   qed
 
   have "B\<^sub>f = (\<Sum>a\<in>arcs G. \<bar>f' (tail G a)^2 - f' (head G a)^2\<bar>)"
     unfolding B\<^sub>f_def by simp
   also have "... = (\<Sum>e \<in># edges G. \<bar>f' (fst e)^2 - f' (snd e)^2\<bar>)"
-    unfolding edges_def arc_to_ends_def sum_unfold_sum_mset 
+    unfolding edges_def arc_to_ends_def sum_unfold_sum_mset
     by (simp add:image_mset.compositionality comp_def)
-  also have "... = 
+  also have "... =
     (\<Sum>e\<in>#{#e \<in># edges G. \<rho> (fst e) < \<rho> (snd e)#}. \<bar>(f' (fst e))\<^sup>2 - (f' (snd e))\<^sup>2\<bar>) +
     (\<Sum>e\<in>#{#e \<in># edges G. \<rho> (snd e) < \<rho> (fst e)#}. \<bar>(f' (fst e))\<^sup>2 - (f' (snd e))\<^sup>2\<bar>) +
     (\<Sum>e\<in>#{#e \<in># edges G. fst e = snd e#}. \<bar>(f' (fst e))\<^sup>2 - (f' (snd e))\<^sup>2\<bar>)"
     by (subst edges_split) simp
   also have "... =
     (\<Sum>e\<in>#{#e \<in># edges G. \<rho> (snd e) < \<rho> (fst e)#}. \<bar>(f' (fst e))\<^sup>2 - (f' (snd e))\<^sup>2\<bar>) +
     (\<Sum>e\<in>#{#e \<in># edges G. \<rho> (snd e) < \<rho> (fst e)#}. \<bar>(f' (snd e))\<^sup>2 - (f' (fst e))\<^sup>2\<bar>) +
     (\<Sum>e\<in>#{#e \<in># edges G. fst e = snd e#}. \<bar>(f' (fst e))\<^sup>2 - (f' (snd e))\<^sup>2\<bar>)"
-    by (subst edges_sym[OF sym, symmetric]) (simp add:image_mset.compositionality 
+    by (subst edges_sym[OF sym, symmetric]) (simp add:image_mset.compositionality
         comp_def image_mset_filter_mset_swap[symmetric] case_prod_beta)
-  also have "... = 
+  also have "... =
     (\<Sum>e\<in>#{#e \<in># edges G. \<rho> (snd e) < \<rho> (fst e)#}. \<bar>(f' (snd e))\<^sup>2 - (f' (fst e))\<^sup>2\<bar>) +
     (\<Sum>e\<in>#{#e \<in># edges G. \<rho> (snd e) < \<rho> (fst e)#}. \<bar>(f' (snd e))\<^sup>2 - (f' (fst e))\<^sup>2\<bar>) +
     (\<Sum>e\<in>#{#e \<in># edges G. fst e = snd e#}. 0)"
     by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>1 sum_mset]" more:image_mset_cong) auto
   also have "... = 2 * (\<Sum>e\<in>#{#e\<in>#edges G. \<rho>(snd e)<\<rho>(fst e)#}. \<bar>(f' (snd e))\<^sup>2 - (f' (fst e))\<^sup>2\<bar>)"
     by simp
   also have "... = 2 *(\<Sum>a|a\<in>arcs G\<and>\<rho>(tail G a)>\<rho>(head G a). \<bar>f'(head G a)^2 - f'(tail G a)^2\<bar>)"
-    unfolding edges_def arc_to_ends_def sum_unfold_sum_mset 
+    unfolding edges_def arc_to_ends_def sum_unfold_sum_mset
     by (simp add:image_mset.compositionality comp_def image_mset_filter_mset_swap[symmetric])
   also have "... = 2 *
     (\<Sum>a|a\<in>arcs G\<and>\<rho>(tail G a)>\<rho>(head G a). \<bar>\<tau>(\<rho>(head G a))^2 - \<tau>(\<rho>(tail G a))^2\<bar>)"
     unfolding \<tau>_def using \<phi>_\<rho>_inv \<rho>_lt_n
     by (intro arg_cong2[where f="(*)"] sum.cong refl) auto
   also have "... = 2 * (\<Sum>a|a\<in>arcs G\<and>\<rho>(tail G a)>\<rho>(head G a). \<tau>(\<rho>(head G a))^2 - \<tau>(\<rho>(tail G a))^2)"
     using \<tau>_antimono power_mono \<tau>_nonneg
     by (intro arg_cong2[where f="(*)"] sum.cong refl abs_of_nonneg)(auto)
   also have "... = 2 *
     (\<Sum>a|a\<in>arcs G\<and>\<rho>(tail G a)>\<rho>(head G a). (-(\<tau>(\<rho>(tail G a))^2)) - (-(\<tau>(\<rho>(head G a))^2)))"
     by (simp add:algebra_simps)
-  also have "... = 2 *(\<Sum>a|a\<in>arcs G\<and>\<rho>(tail G a)>\<rho>(head G a). 
+  also have "... = 2 *(\<Sum>a|a\<in>arcs G\<and>\<rho>(tail G a)>\<rho>(head G a).
     (\<Sum>i=\<rho>(head G a)..<\<rho>(tail G a). (-(\<tau> (Suc i)^2)) - (-(\<tau> i^2))))"
     by (intro arg_cong2[where f="(*)"] sum.cong refl sum_Suc_diff'[symmetric]) auto
-  also have "...=2*(\<Sum>(a, i)\<in>(SIGMA x:{a \<in> arcs G. \<rho> (head G a) < \<rho> (tail G a)}. 
-    {\<rho> (head G x)..<\<rho> (tail G x)}).  \<tau> i^2 - \<tau> (Suc i)^2)" 
+  also have "...=2*(\<Sum>(a, i)\<in>(SIGMA x:{a \<in> arcs G. \<rho> (head G a) < \<rho> (tail G a)}.
+    {\<rho> (head G x)..<\<rho> (tail G x)}).  \<tau> i^2 - \<tau> (Suc i)^2)"
     by (subst sum.Sigma) auto
-  also have "...=2*(\<Sum>p\<in>{(a,i).a \<in> arcs G\<and>\<rho>(head G a)\<le>i\<and>i<\<rho>(tail G a)}. \<tau>(snd p)^2-\<tau> (snd p+1)^2)" 
+  also have "...=2*(\<Sum>p\<in>{(a,i).a \<in> arcs G\<and>\<rho>(head G a)\<le>i\<and>i<\<rho>(tail G a)}. \<tau>(snd p)^2-\<tau> (snd p+1)^2)"
     by (intro arg_cong2[where f="(*)"] sum.cong refl) (auto simp add:Sigma_def)
-  also have "...=2*(\<Sum>p\<in>{(i,a).a \<in> arcs G\<and>\<rho>(head G a) \<le> i\<and>i < \<rho>(tail G a)}. \<tau>(fst p)^2-\<tau>(fst p+1)^2)" 
+  also have "...=2*(\<Sum>p\<in>{(i,a).a \<in> arcs G\<and>\<rho>(head G a) \<le> i\<and>i < \<rho>(tail G a)}. \<tau>(fst p)^2-\<tau>(fst p+1)^2)"
     by (intro sum.reindex_cong[where l="prod.swap"] arg_cong2[where f="(*)"]) auto
   also have "...=2*
-    (\<Sum>(i, a)\<in>(SIGMA x:{..<n}. {a \<in> arcs G. \<rho> (head G a)\<le>x \<and> x<\<rho>(tail G a)}). \<tau> i^2-\<tau> (i+1)^2)" 
-    using less_trans[OF _ \<rho>_lt_n] by (intro sum.cong arg_cong2[where f="(*)"]) auto 
-  also have "...=2*(\<Sum>i<n. (\<Sum>a|a\<in>arcs G \<and>\<rho>(head G a) \<le> i\<and>i < \<rho>(tail G a). \<tau> i^2 - \<tau> (i+1)^2))" 
+    (\<Sum>(i, a)\<in>(SIGMA x:{..<n}. {a \<in> arcs G. \<rho> (head G a)\<le>x \<and> x<\<rho>(tail G a)}). \<tau> i^2-\<tau> (i+1)^2)"
+    using less_trans[OF _ \<rho>_lt_n] by (intro sum.cong arg_cong2[where f="(*)"]) auto
+  also have "...=2*(\<Sum>i<n. (\<Sum>a|a\<in>arcs G \<and>\<rho>(head G a) \<le> i\<and>i < \<rho>(tail G a). \<tau> i^2 - \<tau> (i+1)^2))"
     by (subst sum.Sigma) auto
   also have "...=2*(\<Sum>i<n. card {a\<in>arcs G. \<rho>(head G a)\<le>i\<and>i<\<rho>(tail G a)} * (\<tau> i^2 - \<tau> (i+1)^2))"
     by simp
   also have "...=2*(\<Sum>i<n. card {a\<in>arcs G. \<rho>(head G a)\<le>i\<and>\<not>(\<rho>(tail G a)\<le>i)} * (\<tau> i^2 - \<tau> (i+1)^2))"
     by (intro_cong "[\<sigma>\<^sub>2 (*), \<sigma>\<^sub>1 card, \<sigma>\<^sub>1 of_nat]" more:sum.cong Collect_cong) auto
   also have "...=2*(\<Sum>i<n. card {a\<in>arcs G. head G a\<in>\<phi>`{..i}\<and>tail G a\<notin>\<phi>`{..i}} * (\<tau> i^2-\<tau> (i+1)^2))"
-    using 4 
+    using 4
     by (intro_cong "[\<sigma>\<^sub>2 (*), \<sigma>\<^sub>1 card, \<sigma>\<^sub>1 of_nat, \<sigma>\<^sub>2 (\<and>)]" more:sum.cong restr_Collect_cong) auto
   also have "... = 2 * (\<Sum>i<n. real (card (edges_betw (-\<phi>`{..i}) (\<phi>`{..i}))) * (\<tau> i^2-\<tau> (i+1)^2))"
     unfolding edges_betw_def by (auto simp:conj.commute)
   also have "... = 2 * (\<Sum>i<n. real (card (edges_betw (\<phi>`{..i}) (-\<phi>`{..i}))) * (\<tau> i^2-\<tau> (i+1)^2))"
     using edges_betw_sym by simp
   also have "... = 2 * (\<Sum>i<m. real (card (edges_betw (\<phi>`{..i}) (-\<phi>`{..i}))) * (\<tau> i^2-\<tau> (i+1)^2))"
     using \<tau>_supp m_le_n by (intro sum.mono_neutral_right arg_cong2[where f="(*)"]) auto
-  finally have Bf_eq: 
+  finally have Bf_eq:
     "B\<^sub>f = 2 * (\<Sum>i<m. real (card (edges_betw (\<phi>`{..i}) (-\<phi>`{..i}))) * (\<tau> i^2-\<tau> (i+1)^2))"
     by simp
 
-  have 3:"card (\<phi> ` {..i} \<inter> verts G) = i + 1" if "i < m" for i 
+  have 3:"card (\<phi> ` {..i} \<inter> verts G) = i + 1" if "i < m" for i
   proof -
     have "card (\<phi> ` {..i} \<inter> verts G) = card (\<phi> ` {..i})"
-      using m_le_n that by (intro arg_cong[where f="card"] Int_absorb2 
+      using m_le_n that by (intro arg_cong[where f="card"] Int_absorb2
           image_subsetI bij_betw_apply[OF \<phi>_bij]) auto
     also have "... = card {..i}"
-      using m_le_n that by (intro card_image 
+      using m_le_n that by (intro card_image
           inj_on_subset[OF bij_betw_imp_inj_on[OF \<phi>_bij]]) auto
     also have "... = i+1" by simp
     finally show ?thesis
       by simp
   qed
 
   have "2 * \<Lambda>\<^sub>e * norm f^2 =  2 * \<Lambda>\<^sub>e * (g_norm f'^2)"
     unfolding g_norm_conv f'_alt by simp
   also have "... \<le> 2 * \<Lambda>\<^sub>e * (\<Sum>v\<in> verts G. f' v^2)"
     unfolding g_norm_sq g_inner_def by (simp add:power2_eq_square)
   also have "... = 2 * \<Lambda>\<^sub>e * (\<Sum>i<n. f' (\<phi> i)^2)"
     by (intro arg_cong2[where f="(*)"] refl sum.reindex_bij_betw[symmetric] \<phi>_bij)
   also have "... = 2 * \<Lambda>\<^sub>e * (\<Sum>i<n. \<tau> i^2)"
     unfolding \<tau>_def by (intro arg_cong2[where f="(*)"] refl sum.cong) auto
   also have "... = 2 * \<Lambda>\<^sub>e * (\<Sum>i<m. \<tau> i^2)"
     using \<tau>_supp m_le_n by (intro sum.mono_neutral_cong_right arg_cong2[where f="(*)"] refl) auto
   also have "... \<le> 2 * \<Lambda>\<^sub>e * ((\<Sum>i<m. \<tau> i^2) + (real 0 * \<tau> 0^2 - m * \<tau> m^2))"
     using \<tau>_supp[of "m"] by simp
   also have "... \<le> 2 * \<Lambda>\<^sub>e * ((\<Sum>i<m. \<tau> i^2) + (\<Sum>i<m. i*\<tau> i^2-(Suc i)*\<tau> (Suc i)^2))"
     by (subst sum_lessThan_telescope'[symmetric]) simp
   also have "... \<le> 2 * (\<Sum>i<m. (\<Lambda>\<^sub>e * (i+1)) * (\<tau> i^2-\<tau> (i+1)^2))"
     by (simp add:sum_distrib_left algebra_simps sum.distrib[symmetric])
   also have "... \<le> 2 * (\<Sum>i<m. real (card (edges_betw (\<phi>`{..i}) (-\<phi>`{..i}))) * (\<tau> i^2-\<tau> (i+1)^2))"
     using \<tau>_nonneg \<tau>_antimono power_mono 3 m2_le_n
     by (intro mult_left_mono sum_mono mult_right_mono edge_expansionD2) auto
   also have "... = B\<^sub>f"
     unfolding Bf_eq by simp
   finally have hoory_4_13: "2 * \<Lambda>\<^sub>e * norm f^2 \<le> B\<^sub>f"
     by simp
   text \<open>Corresponds to Lemma 4.13 in Hoory et al.\<close>
 
-  have f_nz: "f \<noteq> 0" 
+  have f_nz: "f \<noteq> 0"
   proof (rule ccontr)
-    assume f_nz_assms: "\<not> (f \<noteq> 0)" 
+    assume f_nz_assms: "\<not> (f \<noteq> 0)"
     have "g $h i \<le> 0" for i
     proof -
-      have "g $h i \<le> max (g $h i) 0" 
+      have "g $h i \<le> max (g $h i) 0"
         by simp
       also have "... = 0"
         using f_nz_assms unfolding f_def vec_eq_iff by auto
       finally show ?thesis by simp
     qed
     moreover have "(\<Sum>i \<in> UNIV. 0-g $h i) = 0"
       using g_orth unfolding sum_subtractf inner_vec_def by auto
     ultimately have "\<forall>x\<in>UNIV. -(g $h x) = 0"
       by (intro iffD1[OF sum_nonneg_eq_0_iff]) auto
     thus "False"
       using g_nz unfolding vec_eq_iff by simp
   qed
   hence norm_f_gt_0: "norm f> 0"
     by simp
 
   have "\<Lambda>\<^sub>e * norm f * norm f \<le> sqrt 2 * real d * norm f * sqrt (f \<bullet> (L *v f))"
     using order_trans[OF hoory_4_13 hoory_4_12] by (simp add:power2_eq_square)
   hence "\<Lambda>\<^sub>e \<le> real d * sqrt 2 * sqrt (f \<bullet> (L *v f)) / norm f"
     using norm_f_gt_0 by (simp add:ac_simps divide_simps)
   also have "... \<le> real d * sqrt 2 * sqrt ((1 - \<Lambda>\<^sub>2) * (norm f)\<^sup>2) / norm f"
     by (intro mult_left_mono divide_right_mono real_sqrt_le_mono h_part_i) auto
   also have "... = real d * sqrt 2 * sqrt (1- \<Lambda>\<^sub>2)"
     using f_nz by (simp add:real_sqrt_mult)
   also have "... = d * sqrt (2 * (1-\<Lambda>\<^sub>2))"
     by (simp add:real_sqrt_mult[symmetric])
   finally show ?thesis
     by simp
 qed
 
 end
 
 context regular_graph
-begin 
+begin
 
-lemmas (in regular_graph) cheeger_aux_1 =  
+lemmas (in regular_graph) cheeger_aux_1 =
   regular_graph_tts.cheeger_aux_1[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
 theorem cheeger_inequality:
   assumes "n > 1"
   shows "\<Lambda>\<^sub>e \<in> {d * (1 - \<Lambda>\<^sub>2) / 2.. d * sqrt (2 * (1 - \<Lambda>\<^sub>2))}"
   using cheeger_aux_1 cheeger_aux_2 assms by auto
 
 unbundle no_intro_cong_syntax
 
 end
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_Definition.thy b/thys/Expander_Graphs/Expander_Graphs_Definition.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Definition.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Definition.thy
@@ -1,1049 +1,1049 @@
 section \<open>Definitions\label{sec:definitions}\<close>
 
 text \<open>This section introduces regular graphs as a sublocale in the graph theory developed by
-Lars Noschinski~\cite{Graph_Theory-AFP} and introduces various expansion coefficients.\<close> 
+Lars Noschinski~\cite{Graph_Theory-AFP} and introduces various expansion coefficients.\<close>
 
 theory Expander_Graphs_Definition
-  imports 
+  imports
     Graph_Theory.Digraph_Isomorphism
-    "HOL-Analysis.L2_Norm" 
+    "HOL-Analysis.L2_Norm"
     Extra_Congruence_Method
     Expander_Graphs_Multiset_Extras
     Jordan_Normal_Form.Conjugate
     Interpolation_Polynomials_HOL_Algebra.Interpolation_Polynomial_Cardinalities
 begin
 
 unbundle intro_cong_syntax
 
 definition arcs_betw where "arcs_betw G u v = {a. a \<in> arcs G \<and> head G a = v \<and> tail G a = u}"
 
-text \<open>The following is a stronger notion than the notion of symmetry defined in 
-@{theory "Graph_Theory.Digraph"}, it requires that the number of edges from @{term "v"} to 
-@{term "w"} must be equal to the number of edges from @{term "w"} to @{term "v"} for any pair of 
+text \<open>The following is a stronger notion than the notion of symmetry defined in
+@{theory "Graph_Theory.Digraph"}, it requires that the number of edges from @{term "v"} to
+@{term "w"} must be equal to the number of edges from @{term "w"} to @{term "v"} for any pair of
 vertices @{term "v"} @{term "w \<in> verts G"}.\<close>
 
 definition symmetric_multi_graph where "symmetric_multi_graph G =
   (fin_digraph G \<and> (\<forall>v w. {v, w} \<subseteq> verts G \<longrightarrow> card (arcs_betw G w v) = card (arcs_betw G v w)))"
 
 lemma symmetric_multi_graphI:
   assumes "fin_digraph G"
   assumes "bij_betw f (arcs G) (arcs G)"
   assumes "\<And>e. e \<in> arcs G \<Longrightarrow> head G (f e) = tail G e \<and> tail G (f e) = head G e"
   shows "symmetric_multi_graph G"
 proof -
   have "card (arcs_betw G w v) = card (arcs_betw G v w)"
     (is "?L = ?R") if "v \<in> verts G" "w \<in> verts G" for v w
   proof -
     have a:"f x \<in> arcs G" if "x \<in> arcs G" for x
       using assms(2) that unfolding bij_betw_def by auto
     have b:"\<exists>y. y \<in> arcs G \<and> f y = x" if "x \<in> arcs G" for x
       using bij_betw_imp_surj_on[OF assms(2)] that by force
 
-    have "inj_on f (arcs G)" 
+    have "inj_on f (arcs G)"
       using assms(2) unfolding bij_betw_def by simp
     hence "inj_on f {e \<in> arcs G. head G e = v \<and> tail G e = w}"
       by (rule inj_on_subset, auto)
     hence "?L = card (f ` {e \<in> arcs G. head G e = v \<and> tail G e = w})"
       unfolding arcs_betw_def
       by (intro card_image[symmetric])
     also have "... = ?R"
       unfolding arcs_betw_def using a b assms(3)
-      by (intro arg_cong[where f="card"] order_antisym image_subsetI subsetI) fastforce+ 
+      by (intro arg_cong[where f="card"] order_antisym image_subsetI subsetI) fastforce+
     finally show ?thesis by simp
   qed
-  thus ?thesis 
+  thus ?thesis
     using assms(1) unfolding symmetric_multi_graph_def by simp
 qed
 
 lemma symmetric_multi_graphD2:
   assumes "symmetric_multi_graph G"
   shows "fin_digraph G"
-  using assms unfolding symmetric_multi_graph_def by simp 
+  using assms unfolding symmetric_multi_graph_def by simp
 
 lemma symmetric_multi_graphD:
   assumes "symmetric_multi_graph G"
-  shows "card {e \<in> arcs G. head G e=v \<and> tail G e=w} = card {e \<in> arcs G. head G e=w \<and> tail G e=v}" 
+  shows "card {e \<in> arcs G. head G e=v \<and> tail G e=w} = card {e \<in> arcs G. head G e=w \<and> tail G e=v}"
     (is "card ?L = card ?R")
 proof (cases "v \<in> verts G \<and> w \<in> verts G")
   case True
-  then show ?thesis 
-  using assms unfolding symmetric_multi_graph_def arcs_betw_def by simp 
+  then show ?thesis
+  using assms unfolding symmetric_multi_graph_def arcs_betw_def by simp
 next
   case False
   interpret fin_digraph G
     using symmetric_multi_graphD2[OF assms(1)] by simp
   have 0:"?L = {}" "?R = {}"
     using False wellformed by auto
   show ?thesis unfolding 0 by simp
 qed
 
 lemma symmetric_multi_graphD3:
   assumes "symmetric_multi_graph G"
   shows
-    "card {e\<in>arcs G. tail G e=v \<and> head G e=w}=card {e\<in>arcs G. tail G e=w\<and>head G e=v}" 
+    "card {e\<in>arcs G. tail G e=v \<and> head G e=w}=card {e\<in>arcs G. tail G e=w\<and>head G e=v}"
   using symmetric_multi_graphD[OF assms] by (simp add:conj.commute)
 
 lemma symmetric_multi_graphD4:
   assumes "symmetric_multi_graph G"
-  shows "card (arcs_betw G v w) = card (arcs_betw G w v)" 
+  shows "card (arcs_betw G v w) = card (arcs_betw G w v)"
   using symmetric_multi_graphD[OF assms] unfolding arcs_betw_def by simp
 
 lemma symmetric_degree_eq:
   assumes "symmetric_multi_graph G"
   assumes "v \<in> verts G"
   shows "out_degree G v = in_degree G v" (is "?L = ?R")
 proof -
-  interpret fin_digraph "G" 
+  interpret fin_digraph "G"
     using assms(1) symmetric_multi_graph_def by auto
 
   have "?L = card {e \<in> arcs G. tail G e = v}"
     unfolding out_degree_def out_arcs_def by simp
   also have "... = card (\<Union>w \<in> verts G. {e \<in> arcs G. head G e = w \<and> tail G e = v})"
     by (intro arg_cong[where f="card"]) (auto simp add:set_eq_iff)
   also have "... = (\<Sum>w \<in> verts G. card {e \<in> arcs G. head G e = w \<and> tail G e = v})"
     by (intro card_UN_disjoint) auto
   also have "... = (\<Sum>w \<in> verts G. card {e \<in> arcs G. head G e = v \<and> tail G e = w})"
     by (intro sum.cong refl symmetric_multi_graphD assms)
   also have "... = card (\<Union>w \<in> verts G. {e \<in> arcs G. head G e = v \<and> tail G e = w})"
     by (intro card_UN_disjoint[symmetric]) auto
   also have "... = card (in_arcs G v)"
-    by (intro arg_cong[where f="card"]) (auto simp add:set_eq_iff) 
-  also have "... = ?R" 
+    by (intro arg_cong[where f="card"]) (auto simp add:set_eq_iff)
+  also have "... = ?R"
     unfolding in_degree_def by simp
   finally show ?thesis by simp
 qed
 
 definition edges where "edges G = image_mset (arc_to_ends G) (mset_set (arcs G))"
 
 lemma (in fin_digraph) count_edges:
   "count (edges G) (u,v) = card (arcs_betw G u v)" (is "?L = ?R")
 proof -
   have "?L = card {x \<in> arcs G. arc_to_ends G x = (u, v)}"
     unfolding edges_def count_mset_exp image_mset_filter_mset_swap[symmetric] by simp
   also have "... = ?R"
     unfolding arcs_betw_def arc_to_ends_def
     by (intro arg_cong[where f="card"]) auto
   finally show ?thesis by simp
 qed
 
 lemma (in fin_digraph) count_edges_sym:
   assumes "symmetric_multi_graph G"
-  shows "count (edges G) (v, w) = count (edges G) (w, v)" 
+  shows "count (edges G) (v, w) = count (edges G) (w, v)"
   unfolding count_edges using symmetric_multi_graphD4[OF assms]  by simp
 
 lemma (in fin_digraph) edges_sym:
   assumes "symmetric_multi_graph G"
-  shows "{# (y,x). (x,y) \<in># (edges G) #} = edges G" 
+  shows "{# (y,x). (x,y) \<in># (edges G) #} = edges G"
 proof -
   have "count {#(y, x). (x, y) \<in># edges G#} x = count (edges G) x" (is "?L = ?R") for x
   proof -
     have "?L = count (edges G) (snd x, fst x)"
       unfolding count_mset_exp
       by (simp add:image_mset_filter_mset_swap[symmetric] case_prod_beta prod_eq_iff ac_simps)
     also have "... = count (edges G) (fst x, snd x)"
       unfolding count_edges_sym[OF assms] by simp
     also have "... = count (edges G) x" by simp
     finally show ?thesis by simp
   qed
 
   thus ?thesis
     by (intro multiset_eqI) simp
 qed
 
 definition "vertices_from G v = {# snd e | e \<in># edges G. fst e = v #}"
 definition "vertices_to G v = {# fst e | e \<in># edges G. snd e = v #}"
 
 context fin_digraph
 begin
 
-lemma edge_set: 
+lemma edge_set:
   assumes "x \<in># edges G"
   shows "fst x \<in> verts G" "snd x \<in> verts G"
   using assms unfolding edges_def arc_to_ends_def by auto
 
 lemma  verts_from_alt:
   "vertices_from G v = image_mset (head G) (mset_set (out_arcs G v))"
 proof -
   have "{#x \<in># mset_set (arcs G). tail G x = v#} = mset_set {a \<in> arcs G. tail G a = v}"
     by (intro filter_mset_mset_set) simp
   thus ?thesis
     unfolding vertices_from_def out_arcs_def edges_def arc_to_ends_def
     by (simp add:image_mset.compositionality image_mset_filter_mset_swap[symmetric] comp_def)
 qed
 
 lemma verts_to_alt:
   "vertices_to G v = image_mset (tail G) (mset_set (in_arcs G v))"
 proof -
   have "{#x \<in># mset_set (arcs G). head G x = v#} = mset_set {a \<in> arcs G. head G a = v}"
     by (intro filter_mset_mset_set) simp
   thus ?thesis
     unfolding vertices_to_def in_arcs_def edges_def arc_to_ends_def
     by (simp add:image_mset.compositionality image_mset_filter_mset_swap[symmetric] comp_def)
 qed
 
 lemma set_mset_vertices_from:
   "set_mset (vertices_from G x) \<subseteq> verts G"
   unfolding vertices_from_def using edge_set by auto
 
 lemma set_mset_vertices_to:
   "set_mset (vertices_to G x) \<subseteq> verts G"
   unfolding vertices_to_def using edge_set by auto
 
 end
 
 text \<open>A symmetric multigraph is regular if every node has the same degree. This is the context
 in which the expansion conditions are introduced.\<close>
 
 locale regular_graph = fin_digraph +
   assumes sym: "symmetric_multi_graph G"
   assumes verts_non_empty: "verts G \<noteq> {}"
   assumes arcs_non_empty: "arcs G \<noteq> {}"
   assumes reg': "\<And>v w. v \<in> verts G \<Longrightarrow> w \<in> verts G \<Longrightarrow> out_degree G v = out_degree G w"
 begin
 
 definition d where "d = out_degree G (SOME v. v \<in> verts G)"
 
 lemmas count_sym = count_edges_sym[OF sym]
 
-lemma reg: 
+lemma reg:
   assumes "v \<in> verts G"
   shows "out_degree G v = d" "in_degree G v = d"
 proof -
   define w where "w = (SOME v. v \<in> verts G)"
   have "w \<in> verts G"
     unfolding w_def using assms(1) by (rule someI)
   hence "out_degree G v = out_degree G w"
     by (intro reg' assms(1))
   also have "... = d"
     unfolding d_def w_def by simp
   finally show a:"out_degree G v = d" by simp
 
   show "in_degree G v = d"
     using a symmetric_degree_eq[OF sym assms(1)] by simp
 qed
 
 definition n where "n = card (verts G)"
 
 lemma n_gt_0: "n > 0"
   unfolding n_def using verts_non_empty by auto
 
 lemma d_gt_0: "d > 0"
 proof -
   obtain a where a:"a \<in> arcs G"
     using arcs_non_empty by auto
   hence "a \<in> in_arcs G (head G a) "
     unfolding in_arcs_def by simp
   hence "0 < in_degree G (head G a)"
     unfolding in_degree_def card_gt_0_iff by blast
   also have "... = d"
     using a by (intro reg) simp
   finally show ?thesis by simp
 qed
 
-definition g_inner :: "('a \<Rightarrow> ('c :: conjugatable_field)) \<Rightarrow> ('a \<Rightarrow> 'c) \<Rightarrow> 'c" 
+definition g_inner :: "('a \<Rightarrow> ('c :: conjugatable_field)) \<Rightarrow> ('a \<Rightarrow> 'c) \<Rightarrow> 'c"
   where "g_inner f g = (\<Sum>x \<in> verts G. (f x) * conjugate (g x))"
 
 lemma conjugate_divide[simp]:
   fixes x y :: "'c :: conjugatable_field"
   shows "conjugate (x / y) = conjugate x / conjugate y"
 proof (cases "y = 0")
   case True
   then show ?thesis by simp
 next
   case False
   have "conjugate (x/y) * conjugate y = conjugate x"
     using False by (simp add:conjugate_dist_mul[symmetric])
   thus ?thesis
     by (simp add:divide_simps)
 qed
 
 lemma g_inner_simps:
-  "g_inner (\<lambda>x. 0) g = 0" 
-  "g_inner f (\<lambda>x. 0) = 0" 
-  "g_inner (\<lambda>x. c * f x) g = c * g_inner f g" 
-  "g_inner f (\<lambda>x. c * g x) = conjugate c * g_inner f g" 
-  "g_inner (\<lambda>x. f x - g x) h = g_inner f h - g_inner g h" 
-  "g_inner (\<lambda>x. f x + g x) h = g_inner f h + g_inner g h" 
-  "g_inner f (\<lambda>x. g x + h x) = g_inner f g + g_inner f h" 
-  "g_inner f (\<lambda>x. g x / c) = g_inner f g / conjugate c" 
-  "g_inner (\<lambda>x. f x / c) g = g_inner f g / c" 
-  unfolding g_inner_def 
-  by (auto simp add:sum.distrib algebra_simps sum_distrib_left sum_subtractf sum_divide_distrib 
+  "g_inner (\<lambda>x. 0) g = 0"
+  "g_inner f (\<lambda>x. 0) = 0"
+  "g_inner (\<lambda>x. c * f x) g = c * g_inner f g"
+  "g_inner f (\<lambda>x. c * g x) = conjugate c * g_inner f g"
+  "g_inner (\<lambda>x. f x - g x) h = g_inner f h - g_inner g h"
+  "g_inner (\<lambda>x. f x + g x) h = g_inner f h + g_inner g h"
+  "g_inner f (\<lambda>x. g x + h x) = g_inner f g + g_inner f h"
+  "g_inner f (\<lambda>x. g x / c) = g_inner f g / conjugate c"
+  "g_inner (\<lambda>x. f x / c) g = g_inner f g / c"
+  unfolding g_inner_def
+  by (auto simp add:sum.distrib algebra_simps sum_distrib_left sum_subtractf sum_divide_distrib
       conjugate_dist_mul conjugate_dist_add)
 
 definition "g_norm f = sqrt (g_inner f f)"
 
 lemma g_norm_eq: "g_norm f = L2_set f (verts G)"
   unfolding g_norm_def g_inner_def L2_set_def
   by (intro arg_cong[where f="sqrt"] sum.cong refl) (simp add:power2_eq_square)
 
 lemma g_inner_cauchy_schwartz:
   fixes f g :: "'a \<Rightarrow> real"
   shows "\<bar>g_inner f g\<bar> \<le> g_norm f * g_norm g"
 proof -
-  have "\<bar>g_inner f g\<bar> \<le> (\<Sum>v \<in> verts G. \<bar>f v * g v\<bar>)" 
+  have "\<bar>g_inner f g\<bar> \<le> (\<Sum>v \<in> verts G. \<bar>f v * g v\<bar>)"
     unfolding g_inner_def conjugate_real_def by (intro sum_abs)
   also have "... \<le> g_norm f * g_norm g"
     unfolding g_norm_eq abs_mult by (intro L2_set_mult_ineq)
   finally show ?thesis by simp
 qed
 
 lemma g_inner_cong:
   assumes "\<And>x. x \<in> verts G \<Longrightarrow> f1 x = f2 x"
   assumes "\<And>x. x \<in> verts G \<Longrightarrow> g1 x = g2 x"
   shows "g_inner f1 g1 = g_inner f2 g2"
   unfolding g_inner_def using assms
   by (intro sum.cong refl) auto
 
 lemma g_norm_cong:
   assumes "\<And>x. x \<in> verts G \<Longrightarrow> f x = g x"
   shows "g_norm f = g_norm g"
-  unfolding g_norm_def 
+  unfolding g_norm_def
   by (intro arg_cong[where f="sqrt"] g_inner_cong assms)
 
-lemma g_norm_nonneg: "g_norm f \<ge> 0" 
+lemma g_norm_nonneg: "g_norm f \<ge> 0"
   unfolding g_norm_def g_inner_def
   by (intro real_sqrt_ge_zero sum_nonneg) auto
 
 lemma g_norm_sq:
-  "g_norm f^2 = g_inner f f" 
+  "g_norm f^2 = g_inner f f"
   using g_norm_nonneg g_norm_def by simp
 
 definition g_step :: "('a \<Rightarrow> real) \<Rightarrow> ('a \<Rightarrow> real)"
   where "g_step f v = (\<Sum>x \<in> in_arcs G v. f (tail G x) / real d)"
 
 lemma g_step_simps:
   "g_step (\<lambda>x. f x + g x) y = g_step f y + g_step g y"
   "g_step (\<lambda>x. f x / c) y = g_step f y / c"
   unfolding g_step_def sum_divide_distrib[symmetric] using finite_in_arcs d_gt_0
   by (auto intro:sum.cong simp add:sum.distrib field_simps sum_distrib_left sum_subtractf)
 
 lemma g_inner_step_eq:
   "g_inner f (g_step f) = (\<Sum>a \<in> arcs G. f (head G a) * f (tail G a)) / d" (is "?L = ?R")
 proof -
   have "?L = (\<Sum>v\<in>verts G. f v * (\<Sum>a\<in>in_arcs G v. f (tail G a) / d))"
     unfolding g_inner_def g_step_def by simp
   also have "... = (\<Sum>v\<in>verts G. (\<Sum>a\<in>in_arcs G v. f v * f (tail G a) / d))"
     by (subst sum_distrib_left) simp
   also have "... =  (\<Sum>v\<in>verts G. (\<Sum>a\<in>in_arcs G v. f (head G a) * f (tail G a) / d))"
     unfolding in_arcs_def by (intro sum.cong refl) simp
   also have "... = (\<Sum>a \<in> (\<Union> (in_arcs G ` verts G)). f (head G a) * f (tail G a) / d)"
-    using finite_verts by (intro sum.UNION_disjoint[symmetric] ballI) 
+    using finite_verts by (intro sum.UNION_disjoint[symmetric] ballI)
       (auto simp add:in_arcs_def)
   also have "... = (\<Sum>a \<in> arcs G. f (head G a) * f (tail G a) / d)"
     unfolding in_arcs_def using wellformed by (intro sum.cong) auto
   also have "... = ?R"
     by (intro sum_divide_distrib[symmetric])
   finally show ?thesis by simp
 qed
 
-definition \<Lambda>_test 
+definition \<Lambda>_test
   where "\<Lambda>_test = {f. g_norm f^2 \<noteq> 0 \<and> g_inner f (\<lambda>_. 1) = 0}"
 
-lemma \<Lambda>_test_ne: 
+lemma \<Lambda>_test_ne:
   assumes "n > 1"
   shows "\<Lambda>_test \<noteq> {}"
 proof -
   obtain v where v_def: "v \<in> verts G" using verts_non_empty by auto
   have "False" if "\<And>w. w \<in> verts G \<Longrightarrow> w = v"
   proof -
-    have "verts G = {v}" using that v_def 
+    have "verts G = {v}" using that v_def
       by (intro iffD2[OF set_eq_iff] allI) blast
     thus False
       using assms n_def by simp
   qed
-  then obtain w where w_def: "w \<in> verts G" "v \<noteq> w" 
+  then obtain w where w_def: "w \<in> verts G" "v \<noteq> w"
     by auto
   define f where "f x= (if x = v then 1 else (if x = w then (-1) else (0::real)))" for x
 
   have "g_norm f^2 = (\<Sum>x\<in>verts G. (if x = v then 1 else if x = w then - 1 else 0)\<^sup>2)"
-    unfolding g_norm_sq g_inner_def conjugate_real_def power2_eq_square[symmetric] 
+    unfolding g_norm_sq g_inner_def conjugate_real_def power2_eq_square[symmetric]
     by (simp add:f_def)
   also have "... = (\<Sum>x \<in> {v,w}. (if x = v then 1 else if x = w then -1 else 0)\<^sup>2)"
     using v_def(1) w_def(1) by (intro sum.mono_neutral_cong refl) auto
   also have "... = (\<Sum>x \<in> {v,w}. (if x = v then 1 else - 1)\<^sup>2)"
     by (intro sum.cong) auto
   also have "... = 2"
     using w_def(2) by (simp add:if_distrib if_distribR sum.If_cases)
   finally have "g_norm f^2 = 2" by simp
   hence "g_norm f \<noteq> 0" by auto
 
   moreover have "g_inner f (\<lambda>_.1) = 0"
     unfolding g_inner_def f_def using v_def w_def by (simp add:sum.If_cases)
   ultimately have "f \<in> \<Lambda>_test"
     unfolding \<Lambda>_test_def by simp
   thus ?thesis by auto
 qed
 
-lemma \<Lambda>_test_empty: 
+lemma \<Lambda>_test_empty:
   assumes "n = 1"
   shows "\<Lambda>_test = {}"
 proof -
   obtain v where v_def: "verts G = {v}"
     using assms card_1_singletonE unfolding n_def by auto
   have "False" if "f \<in> \<Lambda>_test" for f
   proof -
     have "0 = (g_inner f (\<lambda>_.1))^2"
       using that \<Lambda>_test_def by simp
     also have "... = (f v)^2"
       unfolding g_inner_def v_def by simp
     also have "... = g_norm f^2"
-      unfolding g_norm_sq g_inner_def v_def 
+      unfolding g_norm_sq g_inner_def v_def
       by (simp add:power2_eq_square)
     also have "... \<noteq> 0"
       using that \<Lambda>_test_def by simp
     finally show "False" by simp
   qed
   thus ?thesis by auto
 qed
 
-text \<open>The following are variational definitions for the maxiumum of the spectrum (resp. maximum 
+text \<open>The following are variational definitions for the maxiumum of the spectrum (resp. maximum
 modulus of the spectrum) of the stochastic matrix (excluding the Perron eigenvalue $1$). Note that
 both values can still obtain the value one $1$ (if the multiplicity of the eigenvalue $1$ is larger
 than $1$ in the stochastic matrix, or in the modulus case if $-1$ is an eigenvalue).
 
 The definition relies on the supremum of the Rayleigh-Quotient for vectors orthogonal to the
 stationary distribution). In Section~\ref{sec:expander_eigenvalues}, the equivalence of this
 value with the algebraic definition will be shown. The definition here has the advantage
 that it is (obviously) independent of the matrix representation (ordering of the vertices) used.\<close>
 
 definition \<Lambda>\<^sub>2 :: real
   where "\<Lambda>\<^sub>2 = (if n > 1 then (SUP f \<in> \<Lambda>_test. g_inner f (g_step f)/g_inner f f) else 0)"
 
 definition \<Lambda>\<^sub>a :: real
   where "\<Lambda>\<^sub>a = (if n > 1 then (SUP f \<in> \<Lambda>_test. \<bar>g_inner f (g_step f)\<bar>/g_inner f f) else 0)"
 
 lemma sum_arcs_tail:
   fixes f :: "'a \<Rightarrow> ('c :: semiring_1)"
   shows "(\<Sum>a \<in> arcs G. f (tail G a)) = of_nat d * (\<Sum>v \<in> verts G. f v)" (is "?L = ?R")
 proof -
   have "?L = (\<Sum>a\<in>(\<Union>(out_arcs G ` verts G)). f (tail G a))"
     by (intro sum.cong) auto
   also have "... =  (\<Sum>v \<in> verts G. (\<Sum>a \<in> out_arcs G v. f (tail G a)))"
     by (intro sum.UNION_disjoint) auto
   also have "... = (\<Sum>v \<in> verts G. of_nat (out_degree G v) * f v)"
     unfolding out_degree_def by simp
   also have "... = (\<Sum>v \<in> verts G. of_nat d * f v)"
     by (intro sum.cong arg_cong2[where f="(*)"] arg_cong[where f="of_nat"] reg) auto
   also have "... = ?R" by (simp add:sum_distrib_left)
   finally show ?thesis by simp
 qed
 
 lemma sum_arcs_head:
   fixes f :: "'a \<Rightarrow> ('c :: semiring_1)"
   shows "(\<Sum>a \<in> arcs G. f (head G a)) = of_nat d * (\<Sum>v \<in> verts G. f v)" (is "?L = ?R")
 proof -
   have "?L = (\<Sum>a\<in>(\<Union>(in_arcs G ` verts G)). f (head G a))"
     by (intro sum.cong) auto
   also have "... =  (\<Sum>v \<in> verts G. (\<Sum>a \<in> in_arcs G v. f (head G a)))"
     by (intro sum.UNION_disjoint) auto
   also have "... = (\<Sum>v \<in> verts G. of_nat (in_degree G v) * f v)"
     unfolding in_degree_def by simp
   also have "... = (\<Sum>v \<in> verts G. of_nat d * f v)"
     by (intro sum.cong arg_cong2[where f="(*)"] arg_cong[where f="of_nat"] reg) auto
   also have "... = ?R" by (simp add:sum_distrib_left)
   finally show ?thesis by simp
 qed
 
 lemma bdd_above_aux:
   "\<bar>\<Sum>a\<in>arcs G. f(head G a)*f(tail G a)\<bar> \<le> d* g_norm f^2" (is "?L \<le> ?R")
 proof -
   have "(\<Sum>a\<in>arcs G. f (head G a)^2) =  d * g_norm f^2"
     unfolding sum_arcs_head[where f="\<lambda>x. f x^2"] g_norm_sq g_inner_def
     by (simp add:power2_eq_square)
-  hence 0:"L2_set (\<lambda>a. f (head G a)) (arcs G) \<le> sqrt (d * g_norm f^2)" 
+  hence 0:"L2_set (\<lambda>a. f (head G a)) (arcs G) \<le> sqrt (d * g_norm f^2)"
     using g_norm_nonneg unfolding L2_set_def by simp
 
   have "(\<Sum>a\<in>arcs G. f (tail G a)^2) = d * g_norm f^2"
     unfolding sum_arcs_tail[where f="\<lambda>x. f x^2"] sum_distrib_left[symmetric] g_norm_sq g_inner_def
     by (simp add:power2_eq_square)
-  hence 1:"L2_set (\<lambda>a. f (tail G a)) (arcs G) \<le> sqrt (d * g_norm f^2)" 
+  hence 1:"L2_set (\<lambda>a. f (tail G a)) (arcs G) \<le> sqrt (d * g_norm f^2)"
     unfolding L2_set_def by simp
 
   have "?L \<le> (\<Sum>a \<in> arcs G. \<bar>f (head G a)\<bar> * \<bar>f(tail G a)\<bar>)"
-    unfolding abs_mult[symmetric] by (intro divide_right_mono sum_abs) 
+    unfolding abs_mult[symmetric] by (intro divide_right_mono sum_abs)
   also have "... \<le> (L2_set (\<lambda>a. f (head G a)) (arcs G) * L2_set (\<lambda>a. f (tail G a)) (arcs G))"
-    by (intro L2_set_mult_ineq) 
+    by (intro L2_set_mult_ineq)
   also have "... \<le> (sqrt (d * g_norm f^2) * sqrt (d * g_norm f^2))"
     by (intro mult_mono 0 1) auto
   also have "... = d * g_norm f^2"
     using d_gt_0 g_norm_nonneg by simp
   finally show ?thesis by simp
 qed
 
-lemma bdd_above_aux_2: 
+lemma bdd_above_aux_2:
   assumes "f \<in> \<Lambda>_test"
   shows "\<bar>g_inner f (g_step f)\<bar> / g_inner f f \<le> 1"
 proof -
-  have 0:"g_inner f f > 0" 
+  have 0:"g_inner f f > 0"
     using assms unfolding \<Lambda>_test_def g_norm_sq[symmetric] by auto
 
   have "\<bar>g_inner f (g_step f)\<bar> = \<bar>\<Sum>a\<in>arcs G. f (head G a) * f (tail G a)\<bar> / real d"
     unfolding g_inner_step_eq by simp
   also have "... \<le> d * g_norm f^2 / d"
     by (intro divide_right_mono bdd_above_aux assms) auto
   also have "... = g_inner f f"
     using d_gt_0 unfolding g_norm_sq by simp
-  finally have "\<bar>g_inner f (g_step f)\<bar> \<le> g_inner f f" 
+  finally have "\<bar>g_inner f (g_step f)\<bar> \<le> g_inner f f"
     by simp
 
   thus ?thesis
     using 0 by simp
 qed
 
-lemma bdd_above_aux_3: 
+lemma bdd_above_aux_3:
   assumes "f \<in> \<Lambda>_test"
   shows "g_inner f (g_step f) / g_inner f f \<le> 1" (is "?L \<le> ?R")
 proof -
   have "?L \<le> \<bar>g_inner f (g_step f)\<bar> / g_inner f f"
     unfolding g_norm_sq[symmetric]
     by (intro divide_right_mono) auto
   also have "... \<le> 1"
     using bdd_above_aux_2[OF assms] by simp
   finally show ?thesis by simp
 qed
 
 lemma bdd_above_\<Lambda>: "bdd_above ((\<lambda>f. \<bar>g_inner f (g_step f)\<bar> / g_inner f f) ` \<Lambda>_test)"
   using bdd_above_aux_2
   by (intro bdd_aboveI[where M="1"])  auto
 
 lemma bdd_above_\<Lambda>\<^sub>2: "bdd_above ((\<lambda>f. g_inner f (g_step f) / g_inner f f) ` \<Lambda>_test)"
   using bdd_above_aux_3
   by (intro bdd_aboveI[where M="1"])  auto
 
 lemma \<Lambda>_le_1: "\<Lambda>\<^sub>a \<le> 1"
 proof (cases "n > 1")
   case True
-  have "(SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f) \<le> 1" 
+  have "(SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f) \<le> 1"
     using bdd_above_aux_2 \<Lambda>_test_ne[OF True] by (intro cSup_least) auto
   thus "\<Lambda>\<^sub>a \<le> 1"
     unfolding \<Lambda>\<^sub>a_def using True by simp
 next
   case False
   thus ?thesis unfolding \<Lambda>\<^sub>a_def by simp
 qed
 
 lemma \<Lambda>\<^sub>2_le_1: "\<Lambda>\<^sub>2 \<le> 1"
 proof (cases "n > 1")
   case True
-  have "(SUP f\<in>\<Lambda>_test. g_inner f (g_step f) / g_inner f f) \<le> 1" 
+  have "(SUP f\<in>\<Lambda>_test. g_inner f (g_step f) / g_inner f f) \<le> 1"
     using bdd_above_aux_3 \<Lambda>_test_ne[OF True] by (intro cSup_least) auto
   thus "\<Lambda>\<^sub>2 \<le> 1"
     unfolding \<Lambda>\<^sub>2_def using True by simp
 next
   case False
   thus ?thesis unfolding \<Lambda>\<^sub>2_def by simp
 qed
 
 lemma \<Lambda>_ge_0: "\<Lambda>\<^sub>a \<ge> 0"
 proof (cases "n > 1")
   case True
-  obtain f where f_def: "f \<in> \<Lambda>_test" 
+  obtain f where f_def: "f \<in> \<Lambda>_test"
     using \<Lambda>_test_ne[OF True] by auto
   have "0 \<le> \<bar>g_inner f (g_step f)\<bar> / g_inner f f"
     unfolding g_norm_sq[symmetric] by (intro divide_nonneg_nonneg) auto
   also have "... \<le> (SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f)"
     using f_def by (intro cSup_upper bdd_above_\<Lambda>) auto
   finally have "(SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f) \<ge> 0"
     by simp
   thus ?thesis
     unfolding \<Lambda>\<^sub>a_def using True by simp
 next
   case False
   thus ?thesis unfolding \<Lambda>\<^sub>a_def by simp
 qed
 
 lemma os_expanderI:
   assumes "n > 1"
-  assumes "\<And>f. g_inner f (\<lambda>_. 1)=0 \<Longrightarrow> g_inner f (g_step f) \<le> C*g_norm f^2" 
+  assumes "\<And>f. g_inner f (\<lambda>_. 1)=0 \<Longrightarrow> g_inner f (g_step f) \<le> C*g_norm f^2"
   shows "\<Lambda>\<^sub>2 \<le> C"
 proof -
   have "g_inner f (g_step f) / g_inner f f \<le> C" if "f \<in> \<Lambda>_test" for f
   proof -
     have "g_inner f (g_step f) \<le> C*g_inner f f"
       using that \<Lambda>_test_def assms(2) unfolding g_norm_sq by auto
     moreover have "g_inner f f > 0"
       using that unfolding \<Lambda>_test_def g_norm_sq[symmetric] by auto
-    ultimately show ?thesis 
+    ultimately show ?thesis
       by (simp add:divide_simps)
   qed
   hence "(SUP f\<in>\<Lambda>_test. g_inner f (g_step f) / g_inner f f) \<le> C"
     using \<Lambda>_test_ne[OF assms(1)] by (intro cSup_least) auto
   thus ?thesis
     unfolding \<Lambda>\<^sub>2_def using assms by simp
 qed
 
 lemma os_expanderD:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   shows "g_inner f (g_step f) \<le> \<Lambda>\<^sub>2 * g_norm f^2"  (is "?L \<le> ?R")
 proof (cases "g_norm f \<noteq> 0")
   case True
 
   have 0:"f \<in> \<Lambda>_test"
     unfolding \<Lambda>_test_def using assms True by auto
 
-  hence 1:"n > 1" 
+  hence 1:"n > 1"
     using \<Lambda>_test_empty n_gt_0 by fastforce
 
-  have "g_inner f (g_step f)/ g_norm f^2 = g_inner f (g_step f)/g_inner f f" 
+  have "g_inner f (g_step f)/ g_norm f^2 = g_inner f (g_step f)/g_inner f f"
     unfolding g_norm_sq by simp
   also have "... \<le> (SUP f\<in>\<Lambda>_test. g_inner f (g_step f) / g_inner f f)"
-    by (intro cSup_upper bdd_above_\<Lambda>\<^sub>2 imageI 0) 
+    by (intro cSup_upper bdd_above_\<Lambda>\<^sub>2 imageI 0)
   also have "... = \<Lambda>\<^sub>2"
     using 1 unfolding \<Lambda>\<^sub>2_def by simp
   finally have "g_inner f (g_step f)/ g_norm f^2 \<le> \<Lambda>\<^sub>2" by simp
-  thus ?thesis 
+  thus ?thesis
     using True by (simp add:divide_simps)
 next
   case False
   hence "g_inner f f = 0"
     unfolding g_norm_sq[symmetric] by simp
   hence 0:"\<And>v. v \<in> verts G \<Longrightarrow> f v = 0"
     unfolding g_inner_def by (subst (asm) sum_nonneg_eq_0_iff) auto
   hence "?L = 0"
-    unfolding g_step_def g_inner_def by simp 
+    unfolding g_step_def g_inner_def by simp
   also have "... \<le> \<Lambda>\<^sub>2 * g_norm f^2"
     using False by simp
   finally show ?thesis by simp
 qed
 
 lemma expander_intro_1:
   assumes "C \<ge> 0"
-  assumes "\<And>f. g_inner f (\<lambda>_. 1)=0 \<Longrightarrow> \<bar>g_inner f (g_step f)\<bar> \<le> C*g_norm f^2" 
+  assumes "\<And>f. g_inner f (\<lambda>_. 1)=0 \<Longrightarrow> \<bar>g_inner f (g_step f)\<bar> \<le> C*g_norm f^2"
   shows "\<Lambda>\<^sub>a \<le> C"
 proof (cases "n > 1")
   case True
   have "\<bar>g_inner f (g_step f)\<bar> / g_inner f f \<le> C" if "f \<in> \<Lambda>_test" for f
   proof -
     have "\<bar>g_inner f (g_step f)\<bar> \<le> C*g_inner f f"
       using that \<Lambda>_test_def assms(2) unfolding g_norm_sq by auto
     moreover have "g_inner f f > 0"
       using that unfolding \<Lambda>_test_def g_norm_sq[symmetric] by auto
-    ultimately show ?thesis 
+    ultimately show ?thesis
       by (simp add:divide_simps)
   qed
 
-  hence "(SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f) \<le> C" 
+  hence "(SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f) \<le> C"
     using \<Lambda>_test_ne[OF True] by (intro cSup_least) auto
   thus ?thesis using True unfolding \<Lambda>\<^sub>a_def by auto
 next
   case False
   then show ?thesis using assms unfolding \<Lambda>\<^sub>a_def by simp
 qed
 
 lemma expander_intro:
   assumes "C \<ge> 0"
-  assumes "\<And>f. g_inner f (\<lambda>_. 1)=0 \<Longrightarrow> \<bar>\<Sum>a \<in> arcs G. f(head G a) * f(tail G a)\<bar> \<le> C*g_norm f^2" 
+  assumes "\<And>f. g_inner f (\<lambda>_. 1)=0 \<Longrightarrow> \<bar>\<Sum>a \<in> arcs G. f(head G a) * f(tail G a)\<bar> \<le> C*g_norm f^2"
   shows "\<Lambda>\<^sub>a \<le> C/d"
 proof -
-  have "\<bar>g_inner f (g_step f)\<bar> \<le> C / real d * (g_norm f)\<^sup>2" (is "?L \<le> ?R") 
+  have "\<bar>g_inner f (g_step f)\<bar> \<le> C / real d * (g_norm f)\<^sup>2" (is "?L \<le> ?R")
     if "g_inner f (\<lambda>_. 1) = 0" for f
   proof -
     have "?L = \<bar>\<Sum>a\<in>arcs G. f (head G a) * f (tail G a)\<bar> / real d"
       unfolding g_inner_step_eq by simp
     also have "... \<le> C*g_norm f^2 / real d"
       by (intro divide_right_mono assms(2)[OF that]) auto
     also have "... = ?R" by simp
     finally show ?thesis by simp
   qed
   thus ?thesis
     by (intro expander_intro_1 divide_nonneg_nonneg assms) auto
 qed
 
 lemma expansionD1:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   shows "\<bar>g_inner f (g_step f)\<bar> \<le> \<Lambda>\<^sub>a * g_norm f^2"  (is "?L \<le> ?R")
 proof (cases "g_norm f \<noteq> 0")
   case True
 
   have 0:"f \<in> \<Lambda>_test"
     unfolding \<Lambda>_test_def using assms True by auto
 
-  hence 1:"n > 1" 
+  hence 1:"n > 1"
     using \<Lambda>_test_empty n_gt_0 by fastforce
 
-  have "\<bar>g_inner f (g_step f)\<bar>/ g_norm f^2 = \<bar>g_inner f (g_step f)\<bar>/g_inner f f" 
+  have "\<bar>g_inner f (g_step f)\<bar>/ g_norm f^2 = \<bar>g_inner f (g_step f)\<bar>/g_inner f f"
     unfolding g_norm_sq by simp
   also have "... \<le> (SUP f\<in>\<Lambda>_test. \<bar>g_inner f (g_step f)\<bar> / g_inner f f)"
-    by (intro cSup_upper bdd_above_\<Lambda> imageI 0) 
+    by (intro cSup_upper bdd_above_\<Lambda> imageI 0)
   also have "... = \<Lambda>\<^sub>a"
     using 1 unfolding \<Lambda>\<^sub>a_def by simp
   finally have "\<bar>g_inner f (g_step f)\<bar>/ g_norm f^2 \<le> \<Lambda>\<^sub>a" by simp
-  thus ?thesis 
+  thus ?thesis
     using True by (simp add:divide_simps)
 next
   case False
   hence "g_inner f f = 0"
     unfolding g_norm_sq[symmetric] by simp
   hence 0:"\<And>v. v \<in> verts G \<Longrightarrow> f v = 0"
     unfolding g_inner_def by (subst (asm) sum_nonneg_eq_0_iff) auto
   hence "?L = 0"
-    unfolding g_step_def g_inner_def by simp 
+    unfolding g_step_def g_inner_def by simp
   also have "... \<le> \<Lambda>\<^sub>a * g_norm f^2"
     using False by simp
   finally show ?thesis by simp
 qed
 
 lemma expansionD:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   shows "\<bar>\<Sum>a \<in> arcs G. f (head G a) * f (tail G a)\<bar> \<le> d * \<Lambda>\<^sub>a * g_norm f^2"  (is "?L \<le> ?R")
 proof -
   have "?L = \<bar>g_inner f (g_step f) * d\<bar>"
     unfolding g_inner_step_eq using d_gt_0 by simp
   also have "... \<le> \<bar>g_inner f (g_step f)\<bar> * d"
     by (simp add:abs_mult)
   also have "... \<le> (\<Lambda>\<^sub>a * g_norm f^2) * d"
     by (intro expansionD1 mult_right_mono assms(1)) auto
   also have "... = ?R" by simp
   finally show ?thesis by simp
 qed
 
 definition edges_betw where "edges_betw S T = {a \<in> arcs G. tail G a \<in> S \<and> head G a \<in> T}"
 
 text \<open>This parameter is the edge expansion. It is usually denoted by the symbol $h$ or $h(G)$ in
 text books. Contrary to the previous definitions it doesn't have a spectral theoretic counter
 part.\<close>
 
 definition \<Lambda>\<^sub>e where "\<Lambda>\<^sub>e = (if n > 1 then
   (MIN S\<in>{S. S\<subseteq>verts G\<and>2*card S\<le>n\<and>S\<noteq>{}}. real (card (edges_betw S (-S)))/card S) else 0)"
 
 lemma edge_expansionD:
   assumes "S \<subseteq> verts G" "2*card S \<le> n"
   shows "\<Lambda>\<^sub>e * card S \<le> real (card (edges_betw S (-S)))"
 proof (cases "S \<noteq> {}")
   case True
-  moreover have "finite S" 
+  moreover have "finite S"
     using finite_subset[OF assms(1)] by simp
   ultimately have "card S > 0" by auto
   hence 1: "real (card S) > 0" by simp
   hence 2: "n > 1" using assms(2) by simp
 
   let ?St = "{S. S \<subseteq> verts G \<and> 2 * card S \<le> n \<and> S \<noteq> {}}"
 
   have 0: "finite ?St"
     by (rule finite_subset[where B="Pow (verts G)"]) auto
   have "\<Lambda>\<^sub>e = (MIN S\<in>?St. real (card (edges_betw S (-S)))/card S)"
     using 2 unfolding \<Lambda>\<^sub>e_def by simp
 
   also have "... \<le> real (card (edges_betw S (-S))) / card S"
     using assms True by (intro Min_le finite_imageI imageI) auto
   finally have "\<Lambda>\<^sub>e \<le> real (card (edges_betw S (-S))) / card S" by simp
   thus ?thesis using 1 by (simp add:divide_simps)
 next
   case False
   hence "card S = 0" by simp
   thus ?thesis by simp
 qed
 
 lemma edge_expansionI:
   fixes \<alpha> :: real
   assumes "n > 1"
-  assumes "\<And>S. S \<subseteq> verts G \<Longrightarrow> 2*card S \<le> n \<Longrightarrow> S \<noteq> {} \<Longrightarrow> card (edges_betw S (-S)) \<ge> \<alpha> * card S" 
+  assumes "\<And>S. S \<subseteq> verts G \<Longrightarrow> 2*card S \<le> n \<Longrightarrow> S \<noteq> {} \<Longrightarrow> card (edges_betw S (-S)) \<ge> \<alpha> * card S"
   shows "\<Lambda>\<^sub>e \<ge> \<alpha>"
 proof -
   define St where "St = {S. S \<subseteq> verts G \<and> 2*card S \<le> n \<and> S \<noteq> {}}"
   have 0: "finite St"
     unfolding St_def
-    by (rule finite_subset[where B="Pow (verts G)"]) auto 
+    by (rule finite_subset[where B="Pow (verts G)"]) auto
 
-  obtain v where v_def: "v \<in> verts G" using verts_non_empty by auto 
+  obtain v where v_def: "v \<in> verts G" using verts_non_empty by auto
 
-  have "{v} \<in> St" 
+  have "{v} \<in> St"
     using assms v_def unfolding St_def n_def by auto
   hence 1: "St \<noteq> {}" by auto
 
-  have 2: "\<alpha> \<le> real (card (edges_betw S (- S))) / real (card S)" if "S \<in> St" for S 
+  have 2: "\<alpha> \<le> real (card (edges_betw S (- S))) / real (card S)" if "S \<in> St" for S
   proof -
-    have "real (card (edges_betw S (- S)))  \<ge> \<alpha> * card S" 
+    have "real (card (edges_betw S (- S)))  \<ge> \<alpha> * card S"
       using assms(2) that unfolding St_def by simp
-    moreover have "finite S" 
+    moreover have "finite S"
       using that unfolding St_def
       by (intro finite_subset[OF _ finite_verts]) auto
-    hence "card S > 0" 
+    hence "card S > 0"
       using that unfolding St_def by auto
-    ultimately show ?thesis 
+    ultimately show ?thesis
       by (simp add:divide_simps)
   qed
 
   have "\<alpha> \<le> (MIN S\<in>St. real (card (edges_betw S (- S))) / real (card S))"
     using 0 1 2
     by (intro Min.boundedI finite_imageI) auto
 
   thus ?thesis
-    unfolding \<Lambda>\<^sub>e_def St_def[symmetric] using assms by auto 
+    unfolding \<Lambda>\<^sub>e_def St_def[symmetric] using assms by auto
 qed
 
 end
 
 lemma regular_graphI:
   assumes "symmetric_multi_graph G"
   assumes "verts G \<noteq> {}" "d > 0"
   assumes "\<And>v. v \<in> verts G \<Longrightarrow> out_degree G v = d"
   shows "regular_graph G"
 proof -
   obtain v where v_def: "v \<in> verts G"
     using assms(2) by auto
-  have "arcs G \<noteq> {}" 
+  have "arcs G \<noteq> {}"
   proof (rule ccontr)
     assume "\<not>arcs G \<noteq> {}"
     hence "arcs G = {}" by simp
     hence "out_degree G v = 0"
       unfolding out_degree_def out_arcs_def by simp
     hence "d = 0"
       using v_def assms(4) by simp
     thus False
       using assms(3) by simp
   qed
 
   thus ?thesis
     using assms symmetric_multi_graphD2[OF assms(1)]
     unfolding regular_graph_def regular_graph_axioms_def
     by simp
 qed
 
 text \<open>The following theorems verify that a graph isomorphisms preserve symmetry, regularity and all
 the expansion coefficients.\<close>
 
 lemma (in fin_digraph) symmetric_graph_iso:
   assumes "digraph_iso G H"
   assumes "symmetric_multi_graph G"
   shows "symmetric_multi_graph H"
 proof -
   obtain h where hom_iso: "digraph_isomorphism h" and H_alt: "H = app_iso h G"
     using assms unfolding digraph_iso_def by auto
 
   have 0:"fin_digraph H"
     unfolding H_alt
     by (intro fin_digraphI_app_iso hom_iso)
 
   interpret H:fin_digraph H
     using 0 by auto
 
   have 1:"arcs_betw H (iso_verts h v) (iso_verts h w) = iso_arcs h ` arcs_betw G v w"
     (is "?L = ?R") if "v \<in> verts G" "w \<in> verts G" for v w
   proof -
     have "?L = {a \<in> iso_arcs h ` arcs G. iso_head h a=iso_verts h w \<and> iso_tail h a=iso_verts h v}"
       unfolding arcs_betw_def H_alt arcs_app_iso head_app_iso tail_app_iso by simp
-    also have "... = {a. (\<exists>b \<in> arcs G. a = iso_arcs h b \<and> iso_verts h (head G b) = iso_verts h w \<and> 
+    also have "... = {a. (\<exists>b \<in> arcs G. a = iso_arcs h b \<and> iso_verts h (head G b) = iso_verts h w \<and>
       iso_verts h (tail G b) = iso_verts h v)}"
       using iso_verts_head[OF hom_iso] iso_verts_tail[OF hom_iso] by auto
-    also have "... = {a. (\<exists>b \<in> arcs G. a = iso_arcs h b \<and> head G b = w \<and> tail G b = v)}" 
+    also have "... = {a. (\<exists>b \<in> arcs G. a = iso_arcs h b \<and> head G b = w \<and> tail G b = v)}"
       using that iso_verts_eq_iff[OF hom_iso] by auto
     also have "... = ?R"
       unfolding arcs_betw_def by (auto simp add:image_iff set_eq_iff)
     finally show ?thesis by simp
   qed
 
-  have "card (arcs_betw H w v) = card (arcs_betw H v w)" (is "?L = ?R") 
+  have "card (arcs_betw H w v) = card (arcs_betw H v w)" (is "?L = ?R")
     if v_range: "v \<in> verts H" and w_range: "w \<in> verts H" for v w
   proof -
     obtain v' where v': "v = iso_verts h v'" "v' \<in> verts G"
       using that v_range verts_app_iso unfolding H_alt by auto
     obtain w' where w': "w = iso_verts h w'" "w' \<in> verts G"
       using that w_range verts_app_iso unfolding H_alt by auto
     have "?L = card (arcs_betw H (iso_verts h w') (iso_verts h v'))"
       unfolding v' w' by simp
     also have "... = card (iso_arcs h ` arcs_betw G w' v')"
       by (intro arg_cong[where f="card"] 1 v' w')
     also have "... = card (arcs_betw G w' v')"
       using iso_arcs_eq_iff[OF hom_iso] unfolding arcs_betw_def
       by (intro card_image inj_onI) auto
     also have "... = card (arcs_betw G v' w')"
-      by (intro symmetric_multi_graphD4 assms(2)) 
+      by (intro symmetric_multi_graphD4 assms(2))
     also have "... = card (iso_arcs h ` arcs_betw G v' w')"
       using iso_arcs_eq_iff[OF hom_iso] unfolding arcs_betw_def
       by (intro card_image[symmetric] inj_onI) auto
     also have "... = card (arcs_betw H (iso_verts h v') (iso_verts h w'))"
       by (intro arg_cong[where f="card"] 1[symmetric] v' w')
     also have "... = ?R"
       unfolding v' w' by simp
     finally show ?thesis by simp
   qed
 
   thus ?thesis
     using 0 unfolding symmetric_multi_graph_def by auto
 qed
 
 lemma (in regular_graph)
   assumes "digraph_iso G H"
-  shows regular_graph_iso: "regular_graph H" 
+  shows regular_graph_iso: "regular_graph H"
     and regular_graph_iso_size: "regular_graph.n H = n"
     and regular_graph_iso_degree: "regular_graph.d H = d"
     and regular_graph_iso_expansion_le:  "regular_graph.\<Lambda>\<^sub>a H \<le> \<Lambda>\<^sub>a"
     and regular_graph_iso_os_expansion_le: "regular_graph.\<Lambda>\<^sub>2 H \<le> \<Lambda>\<^sub>2"
     and regular_graph_iso_edge_expansion_ge: "regular_graph.\<Lambda>\<^sub>e H \<ge> \<Lambda>\<^sub>e"
 proof -
   obtain h where hom_iso: "digraph_isomorphism h" and H_alt: "H = app_iso h G"
     using assms unfolding digraph_iso_def by auto
 
   have 0:"symmetric_multi_graph H"
     by (intro symmetric_graph_iso[OF assms(1)] sym)
 
-  have 1:"verts H \<noteq> {}" 
+  have 1:"verts H \<noteq> {}"
     unfolding H_alt verts_app_iso using verts_non_empty by simp
 
   then obtain h_wit where h_wit: "h_wit \<in> verts H"
     by auto
 
   have 3:"out_degree H v = d" if v_range: "v \<in> verts H" for v
   proof -
     obtain v' where v': "v = iso_verts h v'" "v' \<in> verts G"
       using that v_range verts_app_iso unfolding H_alt by auto
     have "out_degree H v = out_degree G v'"
       unfolding v' H_alt by (intro out_degree_app_iso_eq[OF hom_iso] v')
     also have "... = d"
       by (intro reg v')
     finally  show ?thesis by simp
   qed
 
   thus 2:"regular_graph H"
     by (intro regular_graphI[where d="d"] 0 d_gt_0 1) auto
   interpret H:"regular_graph" H
     using 2 by auto
 
   have "H.n = card (iso_verts h ` verts G)"
     unfolding H.n_def unfolding H_alt verts_app_iso by simp
   also have "... = card (verts G)"
-    by (intro card_image digraph_isomorphism_inj_on_verts hom_iso) 
+    by (intro card_image digraph_isomorphism_inj_on_verts hom_iso)
   also have "... = n"
     unfolding n_def by simp
   finally show n_eq: "H.n = n" by simp
 
   have "H.d = out_degree H h_wit"
     by (intro H.reg[symmetric] h_wit)
   also have "... = d"
     by (intro 3 h_wit)
   finally show 4:"H.d = d" by simp
 
-  have "bij_betw (iso_verts h) (verts G) (verts H)" 
-    unfolding H_alt using hom_iso 
+  have "bij_betw (iso_verts h) (verts G) (verts H)"
+    unfolding H_alt using hom_iso
     by (simp add: bij_betw_def digraph_isomorphism_inj_on_verts)
 
-  hence g_inner_conv: 
-    "H.g_inner f g = g_inner (\<lambda>x. f (iso_verts h x)) (\<lambda>x. g (iso_verts h x))" 
-    for f g :: "'c \<Rightarrow> real" 
+  hence g_inner_conv:
+    "H.g_inner f g = g_inner (\<lambda>x. f (iso_verts h x)) (\<lambda>x. g (iso_verts h x))"
+    for f g :: "'c \<Rightarrow> real"
     unfolding g_inner_def H.g_inner_def by (intro sum.reindex_bij_betw[symmetric])
 
   have g_step_conv:
     "H.g_step f (iso_verts h x) = g_step (\<lambda>x. f (iso_verts h x)) x" if "x \<in> verts G"
-    for f :: "'c \<Rightarrow> real" and x 
+    for f :: "'c \<Rightarrow> real" and x
   proof -
-    have "inj_on (iso_arcs h) (in_arcs G x)" 
-      using inj_on_subset[OF digraph_isomorphism_inj_on_arcs[OF hom_iso]] 
+    have "inj_on (iso_arcs h) (in_arcs G x)"
+      using inj_on_subset[OF digraph_isomorphism_inj_on_arcs[OF hom_iso]]
       by (simp add:in_arcs_def)
     moreover have "in_arcs H (iso_verts h x) = iso_arcs h ` in_arcs G x"
-      unfolding H_alt by (intro in_arcs_app_iso_eq[OF hom_iso] that) 
-    moreover have "tail H (iso_arcs h a) = iso_verts h (tail G a)" if "a \<in> in_arcs G x" for a 
+      unfolding H_alt by (intro in_arcs_app_iso_eq[OF hom_iso] that)
+    moreover have "tail H (iso_arcs h a) = iso_verts h (tail G a)" if "a \<in> in_arcs G x" for a
       unfolding H_alt using that by (simp add: hom_iso iso_verts_tail)
     ultimately show ?thesis
-      unfolding g_step_def H.g_step_def 
+      unfolding g_step_def H.g_step_def
       by (intro_cong "[\<sigma>\<^sub>2(/), \<sigma>\<^sub>1 f, \<sigma>\<^sub>1 of_nat]" more: 4 sum.reindex_cong[where l="iso_arcs h"])
   qed
 
   show "H.\<Lambda>\<^sub>a \<le> \<Lambda>\<^sub>a"
-    using expansionD1 by (intro H.expander_intro_1 \<Lambda>_ge_0) 
+    using expansionD1 by (intro H.expander_intro_1 \<Lambda>_ge_0)
       (simp add:g_inner_conv g_step_conv H.g_norm_sq g_norm_sq cong:g_inner_cong)
 
   show "H.\<Lambda>\<^sub>2 \<le> \<Lambda>\<^sub>2"
   proof (cases "n > 1")
     case True
     hence "H.n  > 1"
       by (simp add:n_eq)
     thus ?thesis
-      using os_expanderD by (intro H.os_expanderI) 
+      using os_expanderD by (intro H.os_expanderI)
         (simp_all add:g_inner_conv g_step_conv H.g_norm_sq g_norm_sq cong:g_inner_cong)
-  next 
+  next
     case False
     thus ?thesis
       unfolding H.\<Lambda>\<^sub>2_def \<Lambda>\<^sub>2_def by (simp add:n_eq)
   qed
 
   show "H.\<Lambda>\<^sub>e \<ge> \<Lambda>\<^sub>e"
   proof (cases "n > 1")
     case True
     hence n_gt_1: "H.n  > 1"
       by (simp add:n_eq)
-    have "\<Lambda>\<^sub>e * real (card S) \<le> real (card (H.edges_betw S (- S)))" 
-      if "S \<subseteq> verts H" "2 * card S \<le> H.n" "S \<noteq> {}" for S 
+    have "\<Lambda>\<^sub>e * real (card S) \<le> real (card (H.edges_betw S (- S)))"
+      if "S \<subseteq> verts H" "2 * card S \<le> H.n" "S \<noteq> {}" for S
     proof -
       define T where "T = iso_verts h -` S \<inter> verts G"
       have 4:"card T = card S"
         using that(1) unfolding T_def H_alt verts_app_iso
         by (intro card_vimage_inj_on digraph_isomorphism_inj_on_verts[OF hom_iso]) auto
 
       have "card (H.edges_betw S (-S))=card {a\<in>iso_arcs h`arcs G. iso_tail h a\<in>S\<and>iso_head h a\<in> -S}"
         unfolding H.edges_betw_def unfolding H_alt tail_app_iso head_app_iso arcs_app_iso
         by simp
       also have "...=
         card(iso_arcs h` {a \<in> arcs G. iso_tail h (iso_arcs h a)\<in>S\<and> iso_head h (iso_arcs h a)\<in>-S})"
         by (intro arg_cong[where f="card"]) auto
       also have "... = card {a \<in> arcs G. iso_tail h (iso_arcs h a)\<in>S\<and> iso_head h (iso_arcs h a)\<in>-S}"
         by (intro card_image inj_on_subset[OF digraph_isomorphism_inj_on_arcs[OF hom_iso]]) auto
       also have "... = card {a \<in> arcs G. iso_verts h (tail G a) \<in> S \<and> iso_verts h (head G a) \<in> -S}"
         by (intro restr_Collect_cong arg_cong[where f="card"])
          (simp add: iso_verts_tail[OF hom_iso] iso_verts_head[OF hom_iso])
       also have "... = card {a \<in> arcs G. tail G a \<in> T \<and> head G a \<in> -T }"
         unfolding T_def by (intro_cong "[\<sigma>\<^sub>1(card),\<sigma>\<^sub>2 (\<and>)]" more: restr_Collect_cong) auto
       also have "... = card (edges_betw T (-T))"
         unfolding edges_betw_def by simp
-      finally have 5:"card (edges_betw T (-T)) = card (H.edges_betw S (-S))" 
+      finally have 5:"card (edges_betw T (-T)) = card (H.edges_betw S (-S))"
         by simp
 
       have 6: "T \<subseteq> verts G" unfolding T_def by simp
 
       have "\<Lambda>\<^sub>e * real (card S) = \<Lambda>\<^sub>e * real (card T)"
         unfolding 4 by simp
       also have "... \<le> real (card (edges_betw T (-T)))"
         using that(2) by (intro edge_expansionD 6) (simp add:4 n_eq)
       also have "... = real (card (H.edges_betw S (-S)))"
         unfolding 5 by simp
       finally show ?thesis by simp
     qed
 
     thus ?thesis
       by (intro H.edge_expansionI n_gt_1) auto
   next
     case False
     thus ?thesis
       unfolding H.\<Lambda>\<^sub>e_def \<Lambda>\<^sub>e_def by (simp add:n_eq)
   qed
 
 qed
 
 lemma (in regular_graph)
   assumes "digraph_iso G H"
   shows regular_graph_iso_expansion: "regular_graph.\<Lambda>\<^sub>a H = \<Lambda>\<^sub>a"
     and regular_graph_iso_os_expansion: "regular_graph.\<Lambda>\<^sub>2 H = \<Lambda>\<^sub>2"
     and regular_graph_iso_edge_expansion: "regular_graph.\<Lambda>\<^sub>e H = \<Lambda>\<^sub>e"
 proof -
   interpret H:"regular_graph" "H"
     by (intro regular_graph_iso assms)
 
   have iso:"digraph_iso H G"
     using digraph_iso_swap assms wf_digraph_axioms by blast
 
   hence "\<Lambda>\<^sub>a \<le> H.\<Lambda>\<^sub>a"
     by (intro H.regular_graph_iso_expansion_le)
   moreover have "H.\<Lambda>\<^sub>a \<le> \<Lambda>\<^sub>a"
     using regular_graph_iso_expansion_le[OF assms] by auto
   ultimately show "H.\<Lambda>\<^sub>a = \<Lambda>\<^sub>a"
     by auto
 
   have "\<Lambda>\<^sub>2 \<le> H.\<Lambda>\<^sub>2" using iso
     by (intro H.regular_graph_iso_os_expansion_le)
   moreover have "H.\<Lambda>\<^sub>2 \<le> \<Lambda>\<^sub>2"
     using regular_graph_iso_os_expansion_le[OF assms] by auto
   ultimately show "H.\<Lambda>\<^sub>2 = \<Lambda>\<^sub>2"
     by auto
 
   have "\<Lambda>\<^sub>e \<ge> H.\<Lambda>\<^sub>e" using iso
     by (intro H.regular_graph_iso_edge_expansion_ge)
   moreover have "H.\<Lambda>\<^sub>e \<ge> \<Lambda>\<^sub>e"
     using regular_graph_iso_edge_expansion_ge[OF assms] by auto
   ultimately show "H.\<Lambda>\<^sub>e = \<Lambda>\<^sub>e"
     by auto
 qed
 
 unbundle no_intro_cong_syntax
 
 end
diff --git a/thys/Expander_Graphs/Expander_Graphs_Eigenvalues.thy b/thys/Expander_Graphs/Expander_Graphs_Eigenvalues.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Eigenvalues.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Eigenvalues.thy
@@ -1,1469 +1,1469 @@
 section \<open>Spectral Theory\label{sec:expander_eigenvalues}\<close>
 
-text \<open>This section establishes the correspondence of the variationally defined expansion paramters 
-with the definitions using the spectrum of the stochastic matrix. Additionally stronger 
+text \<open>This section establishes the correspondence of the variationally defined expansion paramters
+with the definitions using the spectrum of the stochastic matrix. Additionally stronger
 results for the expansion parameters are derived.\<close>
 
 theory Expander_Graphs_Eigenvalues
-  imports 
+  imports
     Expander_Graphs_Algebra
-    Expander_Graphs_TTS 
+    Expander_Graphs_TTS
     Perron_Frobenius.HMA_Connect
     Commuting_Hermitian.Commuting_Hermitian
 begin
 
 unbundle intro_cong_syntax
 
 hide_const Matrix_Legacy.transpose
 hide_const Matrix_Legacy.row
 hide_const Matrix_Legacy.mat
 hide_const Matrix.mat
 hide_const Matrix.row
 hide_fact Matrix_Legacy.row_def
 hide_fact Matrix_Legacy.mat_def
 hide_fact Matrix.vec_eq_iff
 hide_fact Matrix.mat_def
 hide_fact Matrix.row_def
 no_notation Matrix.scalar_prod  (infix "\<bullet>" 70)
 no_notation Ordered_Semiring.max ("Max\<index>")
 
-lemma mult_right_mono': "y \<ge> (0::real) \<Longrightarrow> x \<le> z \<or> y = 0 \<Longrightarrow> x * y \<le> z * y"  
+lemma mult_right_mono': "y \<ge> (0::real) \<Longrightarrow> x \<le> z \<or> y = 0 \<Longrightarrow> x * y \<le> z * y"
   by (metis mult_cancel_right mult_right_mono)
 
 lemma poly_prod_zero:
   fixes x :: "'a :: idom"
   assumes "poly (\<Prod>a\<in>#xs. [:- a, 1:]) x = 0"
   shows "x \<in># xs"
   using assms by (induction xs, auto)
 
 lemma poly_prod_inj_aux_1:
   fixes xs ys :: "('a :: idom) multiset"
   assumes "x \<in># xs"
   assumes "(\<Prod>a\<in>#xs. [:- a, 1:]) = (\<Prod>a\<in>#ys. [:- a, 1:])"
   shows "x \<in># ys"
 proof -
   have "poly (\<Prod>a\<in>#ys. [:- a, 1:]) x = poly (\<Prod>a\<in>#xs. [:- a, 1:]) x" using assms(2) by simp
   also have "... = poly (\<Prod>a\<in>#xs - {#x#} + {#x#}. [:- a, 1:]) x"
     using assms(1) by simp
   also have "... = 0"
     by simp
   finally have "poly (\<Prod>a\<in>#ys. [:- a, 1:]) x = 0" by simp
   thus "x \<in># ys" using poly_prod_zero by blast
 qed
 
 lemma poly_prod_inj_aux_2:
   fixes xs ys :: "('a :: idom) multiset"
   assumes "x \<in># xs \<union># ys"
   assumes "(\<Prod>a\<in>#xs. [:- a, 1:]) = (\<Prod>a\<in>#ys. [:- a, 1:])"
   shows "x \<in># xs \<inter># ys"
 proof (cases "x \<in># xs")
   case True
   then show ?thesis using poly_prod_inj_aux_1[OF True assms(2)] by simp
 next
   case False
   hence a:"x \<in># ys"
     using assms(1) by simp
-  then show ?thesis 
+  then show ?thesis
     using poly_prod_inj_aux_1[OF a assms(2)[symmetric]] by simp
 qed
 
 lemma poly_prod_inj:
   fixes xs ys :: "('a :: idom) multiset"
   assumes "(\<Prod>a\<in>#xs. [:- a, 1:]) = (\<Prod>a\<in>#ys. [:- a, 1:])"
   shows "xs = ys"
   using assms
 proof (induction "size xs + size ys" arbitrary: xs ys rule:nat_less_induct)
   case 1
   show ?case
   proof (cases "xs \<union># ys = {#}")
     case True
     then show ?thesis by simp
   next
     case False
     then obtain x where "x \<in># xs \<union># ys" by auto
     hence a:"x \<in># xs \<inter># ys"
       by (intro poly_prod_inj_aux_2[OF _ 1(2)])
-    have b: "[:- x, 1:] \<noteq> 0" 
+    have b: "[:- x, 1:] \<noteq> 0"
       by simp
-    have c: "size (xs-{#x#}) + size (ys-{#x#}) < size xs + size ys" 
+    have c: "size (xs-{#x#}) + size (ys-{#x#}) < size xs + size ys"
       using a by (simp add: add_less_le_mono size_Diff1_le size_Diff1_less)
 
     have "[:- x, 1:] * (\<Prod>a\<in>#xs - {#x#}. [:- a, 1:]) = (\<Prod>a\<in>#xs. [:- a, 1:])"
       using a by (subst prod_mset.insert[symmetric]) simp
     also have "... = (\<Prod>a\<in>#ys. [:- a, 1:])" using 1 by simp
     also have "... = [:- x, 1:] * (\<Prod>a\<in>#ys - {#x#}. [:- a, 1:])"
       using a by (subst prod_mset.insert[symmetric]) simp
     finally have "[:- x, 1:]*(\<Prod>a\<in>#xs-{#x#}. [:- a, 1:])=[:-x, 1:]*(\<Prod>a\<in>#ys-{#x#}. [:- a, 1:])"
       by simp
-    hence "(\<Prod>a\<in>#xs-{#x#}. [:- a, 1:]) = (\<Prod>a\<in>#ys-{#x#}. [:- a, 1:])" 
+    hence "(\<Prod>a\<in>#xs-{#x#}. [:- a, 1:]) = (\<Prod>a\<in>#ys-{#x#}. [:- a, 1:])"
       using mult_left_cancel[OF b] by simp
     hence d:"xs - {#x#} = ys - {#x#}"
       using 1 c by simp
     have "xs = xs - {#x#} + {#x#}"
       using a by simp
     also have "... = ys - {#x#} + {#x#}"
       unfolding d by simp
     also have "... = ys"
       using a by simp
     finally show ?thesis by simp
   qed
 qed
 
-definition eigenvalues :: "('a::comm_ring_1)^'n^'n \<Rightarrow> 'a multiset" 
-  where 
+definition eigenvalues :: "('a::comm_ring_1)^'n^'n \<Rightarrow> 'a multiset"
+  where
     "eigenvalues A = (SOME as. charpoly A = (\<Prod>a\<in>#as. [:- a, 1:]) \<and> size as = CARD ('n))"
 
-lemma char_poly_factorized_hma: 
+lemma char_poly_factorized_hma:
   fixes A :: "complex^'n^'n"
   shows "\<exists>as. charpoly A = (\<Prod>a\<leftarrow>as. [:- a, 1:]) \<and> length as = CARD ('n)"
   by (transfer_hma rule:char_poly_factorized)
 
 lemma eigvals_poly_length:
   fixes A :: "complex^'n^'n"
-  shows 
-    "charpoly A = (\<Prod>a\<in>#eigenvalues A. [:- a, 1:])" (is "?A") 
+  shows
+    "charpoly A = (\<Prod>a\<in>#eigenvalues A. [:- a, 1:])" (is "?A")
     "size (eigenvalues A) = CARD ('n)" (is "?B")
 proof -
   define f where "f as = (charpoly A = (\<Prod>a\<in>#as. [:- a, 1:]) \<and> size as = CARD('n))" for as
   obtain as where as_def: "charpoly A = (\<Prod>a\<leftarrow>as. [:- a, 1:])" "length as = CARD('n)"
     using char_poly_factorized_hma by auto
 
   have "charpoly A = (\<Prod>a\<leftarrow>as. [:- a, 1:])"
     unfolding as_def by simp
-  also have "... = (\<Prod>a\<in>#mset as. [:- a, 1:])" 
+  also have "... = (\<Prod>a\<in>#mset as. [:- a, 1:])"
     unfolding prod_mset_prod_list[symmetric] mset_map by simp
   finally have "charpoly A = (\<Prod>a\<in>#mset as. [:- a, 1:])" by simp
   moreover have "size (mset as)  = CARD('n)"
     using as_def by simp
-  ultimately have "f (mset as)" 
+  ultimately have "f (mset as)"
     unfolding f_def by auto
-  hence "f (eigenvalues A)" 
+  hence "f (eigenvalues A)"
     unfolding eigenvalues_def f_def[symmetric] using someI[where x = "mset as" and P="f"] by auto
   thus ?A ?B
     unfolding f_def by auto
 qed
 
 lemma similar_matrix_eigvals:
   fixes A B :: "complex^'n^'n"
   assumes "similar_matrix A B"
   shows "eigenvalues A = eigenvalues B"
 proof -
   have "(\<Prod>a\<in>#eigenvalues A. [:- a, 1:]) = (\<Prod>a\<in>#eigenvalues B. [:- a, 1:])"
     using similar_matrix_charpoly[OF assms] unfolding eigvals_poly_length(1) by simp
   thus ?thesis
     by (intro poly_prod_inj) simp
 qed
 
 definition upper_triangular_hma :: "'a::zero^'n^'n \<Rightarrow> bool"
   where "upper_triangular_hma A \<equiv>
     \<forall>i. \<forall> j. (to_nat j < Bij_Nat.to_nat i \<longrightarrow> A $h i $h j = 0)"
 
 lemma for_all_reindex2:
   assumes "range f = A"
   shows "(\<forall>x \<in> A. \<forall>y \<in> A. P x y) \<longleftrightarrow> (\<forall>x y. P (f x) (f y))"
   using assms by auto
 
-lemma upper_triangular_hma: 
+lemma upper_triangular_hma:
   fixes A :: "('a::zero)^'n^'n"
   shows "upper_triangular (from_hma\<^sub>m A) = upper_triangular_hma A" (is "?L = ?R")
 proof -
   have "?L \<longleftrightarrow> (\<forall>i\<in>{0..<CARD('n)}. \<forall>j\<in>{0..<CARD('n)}. j < i \<longrightarrow> A $h from_nat i $h from_nat j = 0)"
     unfolding upper_triangular_def from_hma\<^sub>m_def by auto
   also have "... \<longleftrightarrow>  (\<forall>(i::'n) (j::'n). to_nat j < to_nat i \<longrightarrow> A $h from_nat (to_nat i) $h from_nat (to_nat j) = 0)"
     by (intro for_all_reindex2 range_to_nat[where 'a="'n"])
   also have "... \<longleftrightarrow>  ?R"
     unfolding upper_triangular_hma_def by auto
   finally show ?thesis by simp
 qed
 
-lemma from_hma_carrier: 
+lemma from_hma_carrier:
   fixes A :: "'a^('n::finite)^('m::finite)"
   shows "from_hma\<^sub>m A \<in> carrier_mat (CARD ('m)) (CARD ('n))"
   unfolding from_hma\<^sub>m_def by simp
 
 definition diag_mat_hma :: "'a^'n^'n \<Rightarrow> 'a multiset"
   where "diag_mat_hma A = image_mset (\<lambda>i. A $h i $h i)  (mset_set UNIV)"
 
-lemma diag_mat_hma: 
+lemma diag_mat_hma:
   fixes A :: "'a^'n^'n"
   shows  "mset (diag_mat (from_hma\<^sub>m A)) = diag_mat_hma A" (is "?L = ?R")
-proof - 
-  have "?L = {#from_hma\<^sub>m A $$ (i, i). i \<in># mset [0..<CARD('n)]#}" 
+proof -
+  have "?L = {#from_hma\<^sub>m A $$ (i, i). i \<in># mset [0..<CARD('n)]#}"
     using from_hma_carrier[where A="A"] unfolding diag_mat_def mset_map by simp
   also have "... = {#from_hma\<^sub>m A $$ (i, i). i \<in># image_mset to_nat (mset_set (UNIV :: 'n set))#}"
     using range_to_nat[where 'a="'n"]
     by (intro arg_cong2[where f="image_mset"] refl) (simp add:image_mset_mset_set[OF inj_to_nat])
   also have "... = {#from_hma\<^sub>m A $$ (to_nat i, to_nat i). i \<in># (mset_set (UNIV :: 'n set))#}"
     by (simp add:image_mset.compositionality comp_def)
   also have "... = ?R"
     unfolding diag_mat_hma_def from_hma\<^sub>m_def using to_nat_less_card[where 'a="'n"]
     by (intro image_mset_cong) auto
   finally show ?thesis by simp
 qed
 
 definition adjoint_hma :: "complex^'m^'n \<Rightarrow> complex^'n^'m" where
   "adjoint_hma A = map_matrix cnj (transpose A)"
 
 lemma adjoint_hma_eq: "adjoint_hma A $h i $h j = cnj (A $h j $h i)"
   unfolding adjoint_hma_def map_matrix_def map_vector_def transpose_def by auto
 
 lemma adjoint_hma:
   fixes A :: "complex^('n::finite)^('m::finite)"
   shows "mat_adjoint (from_hma\<^sub>m A) = from_hma\<^sub>m (adjoint_hma A)"
 proof -
   have "mat_adjoint (from_hma\<^sub>m A) $$ (i,j) = from_hma\<^sub>m (adjoint_hma A) $$ (i,j)"
     if "i < CARD('n)" "j < CARD('m)"  for i j
-    using from_hma_carrier that unfolding mat_adjoint_def from_hma\<^sub>m_def adjoint_hma_def 
+    using from_hma_carrier that unfolding mat_adjoint_def from_hma\<^sub>m_def adjoint_hma_def
       Matrix.mat_of_rows_def map_matrix_def map_vector_def transpose_def by auto
   thus ?thesis
     using from_hma_carrier
     by (intro eq_matI) auto
 qed
 
 definition cinner where "cinner v w = scalar_product v (map_vector cnj w)"
 
-context 
-  includes lifting_syntax 
+context
+  includes lifting_syntax
 begin
 
-lemma cinner_hma: 
+lemma cinner_hma:
   fixes x y :: "complex^'n"
   shows "cinner x y = (from_hma\<^sub>v x) \<bullet>c (from_hma\<^sub>v y)" (is "?L = ?R")
 proof -
-  have "?L = (\<Sum>i\<in>UNIV. x $h i * cnj (y $h i))" 
+  have "?L = (\<Sum>i\<in>UNIV. x $h i * cnj (y $h i))"
     unfolding cinner_def map_vector_def  scalar_product_def by simp
   also have "... = (\<Sum>i = 0..<CARD('n). x $h from_nat i * cnj (y $h from_nat i))"
     using to_nat_less_card to_nat_from_nat_id
     by (intro sum.reindex_bij_betw[symmetric] bij_betwI[where g="to_nat"]) auto
-  also have "... = ?R" 
+  also have "... = ?R"
     unfolding Matrix.scalar_prod_def from_hma\<^sub>v_def
     by simp
   finally show ?thesis by simp
 qed
 
-lemma cinner_hma_transfer[transfer_rule]: 
+lemma cinner_hma_transfer[transfer_rule]:
   "(HMA_V ===> HMA_V ===> (=)) (\<bullet>c) cinner"
   unfolding  HMA_V_def  cinner_hma
   by (auto simp:rel_fun_def)
 
-lemma adjoint_hma_transfer[transfer_rule]: 
+lemma adjoint_hma_transfer[transfer_rule]:
   "(HMA_M ===> HMA_M) (mat_adjoint) adjoint_hma"
   unfolding HMA_M_def rel_fun_def by (auto simp add:adjoint_hma)
 
 end
 
 lemma adjoint_adjoint_id[simp]: "adjoint_hma (adjoint_hma A ) = A"
   by (transfer) (simp add:adjoint_adjoint)
 
-lemma adjoint_def_alter_hma: 
-  "cinner (A *v v) w = cinner v (adjoint_hma A *v w)" 
+lemma adjoint_def_alter_hma:
+  "cinner (A *v v) w = cinner v (adjoint_hma A *v w)"
   by (transfer_hma rule:adjoint_def_alter)
 
 lemma cinner_0: "cinner 0 0 = 0"
   by (transfer_hma)
 
 lemma cinner_scale_left: "cinner (a *s v) w = a * cinner v w"
   by transfer_hma
 
 lemma cinner_scale_right: "cinner v (a *s w) = cnj a * cinner v w"
   by transfer (simp add: inner_prod_smult_right)
 
-lemma norm_of_real: 
+lemma norm_of_real:
   shows "norm (map_vector complex_of_real v) = norm v"
   unfolding norm_vec_def map_vector_def
   by (intro L2_set_cong) auto
 
 definition unitary_hma :: "complex^'n^'n \<Rightarrow> bool"
   where "unitary_hma A \<longleftrightarrow> A ** adjoint_hma A = Finite_Cartesian_Product.mat 1"
 
 definition unitarily_equiv_hma where
   "unitarily_equiv_hma A B U \<equiv> (unitary_hma U \<and> similar_matrix_wit A B U (adjoint_hma U))"
 
 definition diagonal_mat :: "('a::zero)^('n::finite)^'n \<Rightarrow> bool" where
   "diagonal_mat A \<equiv> (\<forall>i. \<forall>j. i \<noteq> j \<longrightarrow> A $h i $h j = 0)"
 
-lemma diagonal_mat_ex: 
+lemma diagonal_mat_ex:
   assumes "diagonal_mat A"
   shows "A = diag (\<chi> i. A $h i $h i)"
-  using assms unfolding diagonal_mat_def diag_def 
+  using assms unfolding diagonal_mat_def diag_def
   by (intro iffD2[OF vec_eq_iff] allI) auto
 
 lemma diag_diagonal_mat[simp]: "diagonal_mat (diag x)"
   unfolding diag_def diagonal_mat_def by auto
 
 lemma diag_imp_upper_tri: "diagonal_mat A \<Longrightarrow> upper_triangular_hma A"
-  unfolding diagonal_mat_def upper_triangular_hma_def  
+  unfolding diagonal_mat_def upper_triangular_hma_def
   by (metis nat_neq_iff)
 
 definition unitary_diag where
     "unitary_diag A b U \<equiv> unitarily_equiv_hma A (diag b) U"
 
 definition real_diag_decomp_hma where
-  "real_diag_decomp_hma A d U \<equiv> unitary_diag A d U  \<and> 
+  "real_diag_decomp_hma A d U \<equiv> unitary_diag A d U  \<and>
   (\<forall>i. d $h i \<in> Reals)"
 
-definition hermitian_hma :: "complex^'n^'n \<Rightarrow> bool" where 
+definition hermitian_hma :: "complex^'n^'n \<Rightarrow> bool" where
   "hermitian_hma A = (adjoint_hma A = A)"
 
 lemma from_hma_one:
   "from_hma\<^sub>m (mat 1 :: (('a::{one,zero})^'n^'n)) = 1\<^sub>m CARD('n)"
   unfolding Finite_Cartesian_Product.mat_def from_hma\<^sub>m_def using from_nat_inj
   by (intro eq_matI) auto
 
-lemma from_hma_mult: 
+lemma from_hma_mult:
   fixes A :: "('a :: semiring_1)^'m^'n"
   fixes B :: "'a^'k^'m::finite"
   shows "from_hma\<^sub>m A * from_hma\<^sub>m B = from_hma\<^sub>m (A ** B)"
   using HMA_M_mult unfolding rel_fun_def HMA_M_def by auto
 
 lemma hermitian_hma:
   "hermitian_hma A = hermitian (from_hma\<^sub>m A)"
    unfolding hermitian_def adjoint_hma hermitian_hma_def by auto
 
 lemma unitary_hma:
   fixes A :: "complex^'n^'n"
   shows  "unitary_hma A = unitary (from_hma\<^sub>m A)" (is "?L = ?R")
 proof -
   have "?R \<longleftrightarrow> from_hma\<^sub>m A * mat_adjoint (from_hma\<^sub>m A) = 1\<^sub>m (CARD('n))"
     using from_hma_carrier
     unfolding unitary_def inverts_mat_def by simp
   also have "... \<longleftrightarrow> from_hma\<^sub>m (A ** adjoint_hma A) = from_hma\<^sub>m (mat 1::complex^'n^'n)"
     unfolding adjoint_hma from_hma_mult from_hma_one by simp
   also have "... \<longleftrightarrow> A ** adjoint_hma A = Finite_Cartesian_Product.mat 1"
     unfolding from_hma\<^sub>m_inj  by simp
   also have "... \<longleftrightarrow> ?L" unfolding unitary_hma_def by simp
   finally show ?thesis by simp
 qed
 
 lemma unitary_hmaD:
   fixes A :: "complex^'n^'n"
   assumes "unitary_hma A"
   shows "adjoint_hma A ** A = mat 1" (is "?A") "A ** adjoint_hma A = mat 1" (is "?B")
 proof -
   have "mat_adjoint (from_hma\<^sub>m A) * from_hma\<^sub>m A = 1\<^sub>m CARD('n)"
     using assms unitary_hma by (intro unitary_simps from_hma_carrier ) auto
   thus ?A
     unfolding adjoint_hma from_hma_mult from_hma_one[symmetric] from_hma\<^sub>m_inj
     by simp
   show ?B
     using assms unfolding unitary_hma_def by simp
 qed
 
 lemma unitary_hma_adjoint:
   assumes "unitary_hma A"
   shows "unitary_hma (adjoint_hma A)"
   unfolding unitary_hma_def adjoint_adjoint_id unitary_hmaD[OF assms] by simp
 
 lemma unitarily_equiv_hma:
   fixes A :: "complex^'n^'n"
-  shows  "unitarily_equiv_hma A B U = 
+  shows  "unitarily_equiv_hma A B U =
     unitarily_equiv (from_hma\<^sub>m A) (from_hma\<^sub>m B) (from_hma\<^sub>m U)"
     (is "?L = ?R")
 proof -
   have "?R \<longleftrightarrow> (unitary_hma U \<and> similar_mat_wit (from_hma\<^sub>m A) (from_hma\<^sub>m B) (from_hma\<^sub>m U) (from_hma\<^sub>m (adjoint_hma U)))"
     unfolding Spectral_Theory_Complements.unitarily_equiv_def unitary_hma[symmetric] adjoint_hma
     by simp
   also have "... \<longleftrightarrow> unitary_hma U \<and> similar_matrix_wit A B U (adjoint_hma U)"
     using HMA_similar_mat_wit unfolding rel_fun_def HMA_M_def
-    by (intro arg_cong2[where f="(\<and>)"] refl) force 
+    by (intro arg_cong2[where f="(\<and>)"] refl) force
   also have "... \<longleftrightarrow> ?L"
     unfolding unitarily_equiv_hma_def by auto
   finally show ?thesis by simp
 qed
 
-lemma Matrix_diagonal_matD: 
+lemma Matrix_diagonal_matD:
   assumes "Matrix.diagonal_mat A"
   assumes "i<dim_row A" "j<dim_col A"
   assumes "i \<noteq> j"
   shows "A $$ (i,j) = 0"
   using assms unfolding Matrix.diagonal_mat_def by auto
 
 lemma diagonal_mat_hma:
   fixes A :: "('a :: zero)^('n :: finite)^'n"
   shows  "diagonal_mat A = Matrix.diagonal_mat (from_hma\<^sub>m A)" (is "?L = ?R")
-proof 
+proof
   show "?L \<Longrightarrow> ?R"
-    unfolding diagonal_mat_def Matrix.diagonal_mat_def from_hma\<^sub>m_def 
+    unfolding diagonal_mat_def Matrix.diagonal_mat_def from_hma\<^sub>m_def
     using from_nat_inj  by auto
 next
   assume a:"?R"
 
   have "A $h i $h j = 0" if "i \<noteq> j" for i j
   proof -
     have "A $h i $h j = (from_hma\<^sub>m A) $$ (to_nat i,to_nat j)"
-      unfolding from_hma\<^sub>m_def using to_nat_less_card[where 'a="'n"] by simp 
+      unfolding from_hma\<^sub>m_def using to_nat_less_card[where 'a="'n"] by simp
     also have "... = 0"
-      using to_nat_less_card[where 'a="'n"] to_nat_inj that 
+      using to_nat_less_card[where 'a="'n"] to_nat_inj that
       by (intro Matrix_diagonal_matD[OF a]) auto
     finally show ?thesis by simp
   qed
   thus "?L"
     unfolding diagonal_mat_def by auto
 qed
 
 lemma unitary_diag_hma:
   fixes A :: "complex^'n^'n"
-  shows "unitary_diag A d U = 
+  shows "unitary_diag A d U =
     Spectral_Theory_Complements.unitary_diag (from_hma\<^sub>m A) (from_hma\<^sub>m (diag d)) (from_hma\<^sub>m U)"
 proof -
   have "Matrix.diagonal_mat (from_hma\<^sub>m (diag d))"
     unfolding diagonal_mat_hma[symmetric] by simp
   thus ?thesis
     unfolding unitary_diag_def Spectral_Theory_Complements.unitary_diag_def unitarily_equiv_hma
     by auto
 qed
 
 lemma real_diag_decomp_hma:
   fixes A :: "complex^'n^'n"
-  shows "real_diag_decomp_hma A d U = 
+  shows "real_diag_decomp_hma A d U =
     real_diag_decomp (from_hma\<^sub>m A) (from_hma\<^sub>m (diag d)) (from_hma\<^sub>m U)"
 proof -
   have 0:"(\<forall>i. d $h i \<in> \<real>) \<longleftrightarrow> (\<forall>i < CARD('n). from_hma\<^sub>m (diag d) $$ (i,i) \<in> \<real>)"
     unfolding from_hma\<^sub>m_def diag_def using to_nat_less_card by fastforce
   show ?thesis
     unfolding real_diag_decomp_hma_def real_diag_decomp_def unitary_diag_hma 0
     by auto
 qed
 
 lemma diagonal_mat_diag_ex_hma:
   assumes "Matrix.diagonal_mat A" "A \<in> carrier_mat CARD('n) CARD ('n :: finite)"
   shows "from_hma\<^sub>m (diag (\<chi> (i::'n). A $$ (to_nat i,to_nat i))) = A"
   using assms from_nat_inj unfolding from_hma\<^sub>m_def diag_def Matrix.diagonal_mat_def
   by (intro eq_matI) (auto simp add:to_nat_from_nat_id)
 
 theorem commuting_hermitian_family_diag_hma:
   fixes Af :: "(complex^'n^'n) set"
   assumes "finite Af"
     and "Af \<noteq> {}"
     and "\<And>A. A \<in> Af \<Longrightarrow> hermitian_hma A"
     and "\<And>A B. A \<in> Af \<Longrightarrow> B\<in> Af \<Longrightarrow> A ** B = B ** A"
-  shows "\<exists> U. \<forall> A\<in> Af. \<exists>B. real_diag_decomp_hma A B U"  
+  shows "\<exists> U. \<forall> A\<in> Af. \<exists>B. real_diag_decomp_hma A B U"
 proof -
   have 0:"finite (from_hma\<^sub>m ` Af)"
-    using assms(1)by (intro finite_imageI) 
+    using assms(1)by (intro finite_imageI)
   have 1: "from_hma\<^sub>m ` Af \<noteq> {}"
     using assms(2) by simp
   have 2: "A \<in> carrier_mat (CARD ('n)) (CARD ('n))" if "A \<in> from_hma\<^sub>m ` Af" for A
     using that unfolding from_hma\<^sub>m_def by (auto simp add:image_iff)
   have 3: "0 < CARD('n)"
     by simp
   have 4: "hermitian A" if "A \<in> from_hma\<^sub>m ` Af" for A
     using hermitian_hma assms(3) that by auto
   have 5: "A * B = B * A" if "A \<in> from_hma\<^sub>m ` Af" "B \<in> from_hma\<^sub>m ` Af" for A B
     using that assms(4) by (auto simp add:image_iff from_hma_mult)
   have "\<exists>U. \<forall>A\<in> from_hma\<^sub>m ` Af. \<exists>B. real_diag_decomp A B U"
     using commuting_hermitian_family_diag[OF 0 1 2 3 4 5] by auto
   then obtain U Bmap where U_def: "\<And>A. A \<in> from_hma\<^sub>m ` Af \<Longrightarrow> real_diag_decomp A (Bmap A) U"
     by metis
   define U' :: "complex^'n^'n" where "U' = to_hma\<^sub>m U"
-  define Bmap' :: "complex^'n^'n \<Rightarrow> complex^'n" 
+  define Bmap' :: "complex^'n^'n \<Rightarrow> complex^'n"
     where "Bmap' = (\<lambda>M. (\<chi> i. (Bmap (from_hma\<^sub>m M)) $$ (to_nat i,to_nat i)))"
 
-  have "real_diag_decomp_hma A (Bmap' A) U'" if "A \<in> Af" for A 
+  have "real_diag_decomp_hma A (Bmap' A) U'" if "A \<in> Af" for A
   proof -
     have rdd: "real_diag_decomp (from_hma\<^sub>m A) (Bmap (from_hma\<^sub>m A)) U"
       using U_def that by simp
 
-    have "U \<in> carrier_mat CARD('n) CARD('n)" "Bmap (from_hma\<^sub>m A) \<in> carrier_mat CARD('n) CARD('n)" 
+    have "U \<in> carrier_mat CARD('n) CARD('n)" "Bmap (from_hma\<^sub>m A) \<in> carrier_mat CARD('n) CARD('n)"
       "Matrix.diagonal_mat (Bmap (from_hma\<^sub>m A))"
       using rdd unfolding real_diag_decomp_def Spectral_Theory_Complements.unitary_diag_def
         Spectral_Theory_Complements.unitarily_equiv_def similar_mat_wit_def
       by (auto simp add:Let_def)
 
     hence "(from_hma\<^sub>m (diag (Bmap' A))) = Bmap (from_hma\<^sub>m A)" "(from_hma\<^sub>m U') = U"
       unfolding Bmap'_def U'_def by (auto simp add:diagonal_mat_diag_ex_hma)
     hence "real_diag_decomp (from_hma\<^sub>m A) (from_hma\<^sub>m (diag (Bmap' A))) (from_hma\<^sub>m U')"
       using rdd by auto
     thus "?thesis"
       unfolding real_diag_decomp_hma by simp
   qed
   thus ?thesis
     by (intro exI[where x="U'"]) auto
 qed
 
-lemma char_poly_upper_triangular: 
+lemma char_poly_upper_triangular:
   fixes A :: "complex^'n^'n"
   assumes "upper_triangular_hma A"
   shows "charpoly A = (\<Prod>a \<in># diag_mat_hma A. [:- a, 1:])"
 proof -
   have "charpoly A = char_poly (from_hma\<^sub>m A)"
     using HMA_char_poly unfolding rel_fun_def HMA_M_def
     by (auto simp add:eq_commute)
   also have "... = (\<Prod>a\<leftarrow>diag_mat (from_hma\<^sub>m A). [:- a, 1:])"
     using assms unfolding upper_triangular_hma[symmetric]
     by (intro char_poly_upper_triangular[where n="CARD('n)"] from_hma_carrier) auto
   also have "... = (\<Prod>a\<in># mset (diag_mat (from_hma\<^sub>m A)). [:- a, 1:])"
     unfolding prod_mset_prod_list[symmetric] mset_map by simp
   also have "... = (\<Prod>a\<in># diag_mat_hma A. [:- a, 1:])"
     unfolding diag_mat_hma by simp
   finally show "charpoly A = (\<Prod>a\<in># diag_mat_hma A. [:- a, 1:])" by simp
 qed
 
 lemma upper_tri_eigvals:
   fixes A :: "complex^'n^'n"
   assumes "upper_triangular_hma A"
   shows "eigenvalues A = diag_mat_hma A"
 proof -
   have "(\<Prod>a\<in>#eigenvalues A. [:- a, 1:]) = charpoly A"
     unfolding  eigvals_poly_length[symmetric] by simp
   also have "... = (\<Prod>a\<in>#diag_mat_hma A. [:- a, 1:])"
     by (intro char_poly_upper_triangular assms)
   finally have "(\<Prod>a\<in>#eigenvalues A. [:- a, 1:]) = (\<Prod>a\<in>#diag_mat_hma A. [:- a, 1:])"
     by simp
   thus ?thesis
     by (intro poly_prod_inj) simp
 qed
 
 lemma cinner_self:
   fixes v :: "complex^'n"
   shows "cinner v v = norm v^2"
 proof -
-  have 0: "x * cnj x = complex_of_real (x \<bullet> x)" for x :: complex 
+  have 0: "x * cnj x = complex_of_real (x \<bullet> x)" for x :: complex
     unfolding inner_complex_def complex_mult_cnj by (simp add:power2_eq_square)
   thus ?thesis
-    unfolding cinner_def power2_norm_eq_inner scalar_product_def inner_vec_def 
-      map_vector_def by simp 
+    unfolding cinner_def power2_norm_eq_inner scalar_product_def inner_vec_def
+      map_vector_def by simp
 qed
 
 lemma unitary_iso:
-  assumes "unitary_hma U" 
+  assumes "unitary_hma U"
   shows "norm (U *v v) = norm v"
 proof -
   have "norm (U *v v)^2 = cinner (U *v v) (U *v v)"
     unfolding cinner_self by simp
   also have "... = cinner v v"
     unfolding adjoint_def_alter_hma matrix_vector_mul_assoc unitary_hmaD[OF assms] by simp
   also have "... = norm v^2"
     unfolding cinner_self by simp
   finally have "complex_of_real (norm (U *v v)^2) = norm v^2" by simp
   thus ?thesis
     by (meson norm_ge_zero of_real_hom.injectivity power2_eq_iff_nonneg)
 qed
 
 lemma (in semiring_hom) mult_mat_vec_hma:
   "map_vector hom (A *v v) = map_matrix hom A *v map_vector hom v"
   using mult_mat_vec_hom by transfer auto
 
 lemma (in semiring_hom) mat_hom_mult_hma:
   "map_matrix hom (A ** B) = map_matrix hom A ** map_matrix hom B"
   using mat_hom_mult by transfer auto
 
-context regular_graph_tts 
+context regular_graph_tts
 begin
 
 lemma to_nat_less_n: "to_nat (x::'n) < n"
-  using to_nat_less_card card_n by metis 
+  using to_nat_less_card card_n by metis
 
 lemma to_nat_from_nat: "x < n \<Longrightarrow> to_nat (from_nat x :: 'n) = x"
   using to_nat_from_nat_id card_n by metis
 
 lemma hermitian_A: "hermitian_hma A"
-  using count_sym unfolding hermitian_hma_def adjoint_hma_def A_def map_matrix_def 
+  using count_sym unfolding hermitian_hma_def adjoint_hma_def A_def map_matrix_def
     map_vector_def transpose_def by simp
 
 lemma nonneg_A: "nonneg_mat A"
   unfolding nonneg_mat_def A_def by auto
 
 lemma g_step_1:
   assumes "v \<in> verts G"
   shows "g_step (\<lambda>_. 1) v = 1" (is "?L = ?R")
 proof -
   have "?L = in_degree G v / d"
     unfolding g_step_def in_degree_def by simp
   also have "... = 1"
     unfolding reg(2)[OF assms] using d_gt_0 by simp
   finally show ?thesis by simp
 qed
 
 lemma markov: "markov (A :: real^'n^'n)"
 proof -
   have "A *v 1 = (1::real ^'n)" (is "?L = ?R")
   proof -
     have "A *v 1 = (\<chi> i. g_step (\<lambda>_. 1) (enum_verts i))"
       unfolding g_step_conv one_vec_def by simp
     also have "... = (\<chi> i. 1)"
       using bij_betw_apply[OF enum_verts] by (subst g_step_1) auto
     also have "... = 1" unfolding one_vec_def by simp
     finally show ?thesis by simp
   qed
   thus ?thesis
     by (intro markov_symI nonneg_A symmetric_A)
 qed
 
 lemma nonneg_J: "nonneg_mat J"
   unfolding nonneg_mat_def J_def by auto
 
 lemma J_eigvals: "eigenvalues J = {#1::complex#} + replicate_mset (n - 1) 0"
 proof -
   define \<alpha> :: "nat \<Rightarrow> real" where "\<alpha> i = sqrt (i^2+i)" for i :: nat
 
   define q :: "nat \<Rightarrow> nat \<Rightarrow> real"
     where "q i j = (
         if i = 0 then (1/sqrt n) else (
         if j < i then ((-1) / \<alpha> i) else (
         if j = i then (i / \<alpha> i) else 0)))" for i j
 
   define Q :: "complex^'n^'n" where "Q = (\<chi> i j. complex_of_real (q (to_nat i) (to_nat j)))"
 
-  define D :: "complex^'n^'n" where 
+  define D :: "complex^'n^'n" where
     "D = (\<chi> i j. if to_nat i = 0 \<and> to_nat j = 0 then 1 else 0)"
 
   have 2: "[0..<n] = 0#[1..<n]"
     using n_gt_0 upt_conv_Cons by auto
 
   have aux0: "(\<Sum>k = 0..<n. q j k * q i k) = of_bool (i = j)" if 1:"i \<le> j" "j < n"  for i j
   proof -
     consider (a) "i = j \<and> j = 0" | (b) "i = 0 \<and> i < j" | (c) " 0 < i \<and> i < j" | (d) "0 < i \<and> i = j"
       using 1 by linarith
     thus ?thesis
     proof (cases)
       case a
       then show ?thesis using n_gt_0 by (simp add:q_def)
     next
       case b
       have "(\<Sum>k = 0..<n. q j k*q i k)=(\<Sum>k\<in>insert j ({0..<j} \<union> {j+1..<n}). q j k*q i k)"
         using that(2) by (intro sum.cong) auto
       also have "...=q j j*q i j+(\<Sum>k=0..<j. q j k * q i k)+(\<Sum>k=j+1..<n. q j k * q i k)"
         by (subst sum.insert) (auto simp add: sum.union_disjoint)
       also have "... = 0" using b unfolding q_def by simp
       finally show ?thesis using b by simp
     next
       case c
       have "(\<Sum>k = 0..<n. q j k*q i k)=(\<Sum>k\<in>insert i ({0..<i} \<union> {i+1..<n}). q j k*q i k)"
         using that(2) c by (intro sum.cong) auto
       also have "...=q j i*q i i+(\<Sum>k=0..<i. q j k * q i k)+(\<Sum>k=i+1..<n. q j k * q i k)"
         by (subst sum.insert) (auto simp add: sum.union_disjoint)
       also have "... =(-1) / \<alpha> j * i / \<alpha> i+ i * ((-1) / \<alpha> j *  (-1) / \<alpha> i)"
         using c unfolding q_def by simp
       also have "... = 0"
         by (simp add:algebra_simps)
       finally show ?thesis using c by simp
     next
       case d
       have "real i + real i^2 = real (i + i^2)" by simp
-      also have "... \<noteq> real 0" 
+      also have "... \<noteq> real 0"
         unfolding of_nat_eq_iff using d by simp
       finally have d_1: "real i  + real i^2 \<noteq> 0" by simp
       have "(\<Sum>k = 0..<n. q j k*q i k)=(\<Sum>k\<in>insert i ({0..<i} \<union> {i+1..<n}). q j k*q i k)"
         using that(2) d by (intro sum.cong) auto
       also have "...=q j i*q i i+(\<Sum>k=0..<i. q j k * q i k)+(\<Sum>k=i+1..<n. q j k * q i k)"
         by (subst sum.insert) (auto simp add: sum.union_disjoint)
       also have "... = i/ \<alpha> i * i / \<alpha> i+ i * ((-1) / \<alpha> i *  (-1) / \<alpha> i)"
         using d that unfolding q_def by simp
       also have "... = (i^2 + i) / (\<alpha> i)^2"
         by (simp add: power2_eq_square divide_simps)
       also have "... = 1"
-        using d_1 unfolding \<alpha>_def by (simp add:algebra_simps) 
+        using d_1 unfolding \<alpha>_def by (simp add:algebra_simps)
       finally show ?thesis using d by simp
     qed
   qed
 
   have 0:"(\<Sum>k = 0..<n. q j k * q i k) = of_bool (i = j)" (is "?L = ?R")  if "i < n" "j < n"  for i j
   proof -
     have "?L = (\<Sum>k = 0..<n. q (max i j) k * q (min i j) k)"
       by (cases "i \<le> j") ( simp_all add:ac_simps cong:sum.cong)
     also have "... = of_bool (min i j = max i j)"
       using that by (intro aux0) auto
-    also have "... = ?R" 
+    also have "... = ?R"
       by (cases "i \<le> j") auto
     finally show ?thesis by simp
   qed
-  
+
   have "(\<Sum>k\<in>UNIV. Q $h j $h k * cnj (Q $h i $h k)) = of_bool (i=j)" (is "?L = ?R") for i j
   proof -
-    have "?L = complex_of_real (\<Sum>k \<in> (UNIV::'n set). q (to_nat j) (to_nat k) * q (to_nat i) (to_nat k))" 
-      unfolding Q_def 
+    have "?L = complex_of_real (\<Sum>k \<in> (UNIV::'n set). q (to_nat j) (to_nat k) * q (to_nat i) (to_nat k))"
+      unfolding Q_def
       by (simp add:case_prod_beta scalar_prod_def map_vector_def inner_vec_def row_def inner_complex_def)
     also have "... = complex_of_real (\<Sum>k=0..<n. q (to_nat j) k * q (to_nat i) k)"
       using to_nat_less_n to_nat_from_nat
       by (intro arg_cong[where f="of_real"] sum.reindex_bij_betw bij_betwI[where g="from_nat"]) (auto)
     also have "... = complex_of_real (of_bool(to_nat i = to_nat j))"
       using to_nat_less_n by (intro arg_cong[where f="of_real"] 0) auto
     also have "... = ?R"
       using to_nat_inj by auto
     finally show ?thesis by simp
   qed
   hence "Q ** adjoint_hma Q = mat 1"
     by (intro iffD2[OF vec_eq_iff]) (auto simp add:matrix_matrix_mult_def mat_def adjoint_hma_eq)
   hence unit_Q: "unitary_hma Q"
     unfolding unitary_hma_def by simp
 
-  have "card {(k::'n). to_nat k = 0} = card {from_nat 0 :: 'n}" 
+  have "card {(k::'n). to_nat k = 0} = card {from_nat 0 :: 'n}"
     using to_nat_from_nat[where x="0"] n_gt_0
     by (intro arg_cong[where f="card"] iffD2[OF set_eq_iff]) auto
   hence 5:"card {(k::'n). to_nat k = 0} = 1" by simp
   hence 1:"adjoint_hma Q ** D = (\<chi> i j. (if to_nat j = 0 then complex_of_real (1/sqrt n) else 0))"
     unfolding Q_def D_def by (intro iffD2[OF vec_eq_iff] allI)
      (auto simp add:adjoint_hma_eq matrix_matrix_mult_def q_def if_distrib if_distribR sum.If_cases)
 
-  have "(adjoint_hma Q ** D ** Q) $h i $h j = J $h i $h j" (is "?L1 = ?R1") for i j 
-  proof - 
+  have "(adjoint_hma Q ** D ** Q) $h i $h j = J $h i $h j" (is "?L1 = ?R1") for i j
+  proof -
     have "?L1 =1/((sqrt (real n)) * complex_of_real (sqrt (real n)))"
       unfolding 1 unfolding Q_def using n_gt_0 5
-      by (auto simp add:matrix_matrix_mult_def q_def if_distrib if_distribR sum.If_cases) 
+      by (auto simp add:matrix_matrix_mult_def q_def if_distrib if_distribR sum.If_cases)
     also have "... = 1/sqrt (real n)^2"
       unfolding of_real_divide of_real_mult power2_eq_square
       by simp
     also have "... = J $h i $h j"
       unfolding J_def card_n using n_gt_0 by simp
     finally show ?thesis by simp
   qed
 
   hence "adjoint_hma Q ** D ** Q = J"
-    by (intro iffD2[OF vec_eq_iff] allI) auto 
+    by (intro iffD2[OF vec_eq_iff] allI) auto
 
-  hence "similar_matrix_wit J D (adjoint_hma Q) Q" 
+  hence "similar_matrix_wit J D (adjoint_hma Q) Q"
     unfolding similar_matrix_wit_def unitary_hmaD[OF unit_Q] by auto
   hence "similar_matrix J D"
     unfolding similar_matrix_def by auto
   hence "eigenvalues J = eigenvalues D"
     by (intro similar_matrix_eigvals)
   also have "... = diag_mat_hma D"
     by (intro upper_tri_eigvals diag_imp_upper_tri) (simp add:D_def diagonal_mat_def)
   also have "... = {# of_bool (to_nat i = 0). i \<in># mset_set (UNIV :: 'n set)#}"
-    unfolding diag_mat_hma_def D_def of_bool_def by simp 
+    unfolding diag_mat_hma_def D_def of_bool_def by simp
   also have "... = {# of_bool (i = 0). i \<in># mset_set (to_nat ` (UNIV :: 'n set))#}"
-    unfolding image_mset_mset_set[OF inj_to_nat, symmetric] 
+    unfolding image_mset_mset_set[OF inj_to_nat, symmetric]
     by (simp add:image_mset.compositionality comp_def)
   also have "... = mset (map (\<lambda>i. of_bool(i=0)) [0..<n])"
     unfolding range_to_nat card_n mset_map by simp
   also have "... = mset (1 # map (\<lambda>i. 0) [1..<n])"
     unfolding 2 by (intro arg_cong[where f="mset"]) simp
   also have "... = {#1#} + replicate_mset (n-1) 0"
     using n_gt_0 by (simp add:map_replicate_const mset_repl)
   finally show ?thesis by simp
 qed
 
 lemma J_markov: "markov J"
 proof -
   have "nonneg_mat J"
     unfolding J_def nonneg_mat_def by auto
-  moreover have "transpose J = J" 
+  moreover have "transpose J = J"
     unfolding J_def transpose_def by auto
   moreover have "J *v 1 = (1 :: real^'n)"
-    unfolding J_def by (simp add:matrix_vector_mult_def one_vec_def) 
+    unfolding J_def by (simp add:matrix_vector_mult_def one_vec_def)
   ultimately show ?thesis
     by (intro markov_symI) auto
 qed
 
-lemma markov_complex_apply: 
+lemma markov_complex_apply:
   assumes "markov M"
   shows "(map_matrix complex_of_real M) *v (1 :: complex^'n) = 1" (is "?L = ?R")
 proof -
   have "?L = (map_matrix complex_of_real M) *v (map_vector complex_of_real 1)"
     by (intro arg_cong2[where f="(*v)"] refl) (simp add: map_vector_def one_vec_def)
   also have "... = map_vector (complex_of_real) 1"
     unfolding of_real_hom.mult_mat_vec_hma[symmetric] markov_apply[OF assms] by simp
   also have "... = ?R"
     by (simp add: map_vector_def one_vec_def)
   finally show ?thesis by simp
 qed
 
-lemma J_A_comm_real: "J ** A = A ** (J :: real^'n^'n)" 
+lemma J_A_comm_real: "J ** A = A ** (J :: real^'n^'n)"
 proof -
-  have 0: "(\<Sum>k\<in>UNIV. A $h k $h i / real CARD('n)) = 1 / real CARD('n)" (is "?L = ?R") for i 
+  have 0: "(\<Sum>k\<in>UNIV. A $h k $h i / real CARD('n)) = 1 / real CARD('n)" (is "?L = ?R") for i
   proof -
     have "?L = (1 v* A) $h i / real CARD('n)"
-      unfolding vector_matrix_mult_def by (simp add:sum_divide_distrib) 
+      unfolding vector_matrix_mult_def by (simp add:sum_divide_distrib)
     also have "... = ?R"
       unfolding markov_apply[OF markov] by simp
     finally show ?thesis by simp
   qed
-  have 1: "(\<Sum>k\<in>UNIV. A $h i $h k / real CARD('n)) = 1 / real CARD('n)" (is "?L = ?R") for i 
+  have 1: "(\<Sum>k\<in>UNIV. A $h i $h k / real CARD('n)) = 1 / real CARD('n)" (is "?L = ?R") for i
   proof -
     have "?L = (A *v 1) $h i / real CARD('n)"
-      unfolding matrix_vector_mult_def by (simp add:sum_divide_distrib) 
+      unfolding matrix_vector_mult_def by (simp add:sum_divide_distrib)
     also have "... = ?R"
       unfolding markov_apply[OF markov] by simp
     finally show ?thesis by simp
   qed
 
   show ?thesis
     unfolding J_def using 0 1
     by (intro iffD2[OF vec_eq_iff] allI) (simp add:matrix_matrix_mult_def)
 qed
 
 lemma J_A_comm: "J ** A = A ** (J :: complex^'n^'n)" (is "?L = ?R")
 proof -
   have "J ** A = map_matrix complex_of_real (J ** A)"
     unfolding of_real_hom.mat_hom_mult_hma J_def A_def
     by (auto simp add:map_matrix_def map_vector_def)
   also have "... = map_matrix complex_of_real (A ** J)"
     unfolding J_A_comm_real by simp
   also have "... = map_matrix complex_of_real A ** map_matrix complex_of_real J"
     unfolding of_real_hom.mat_hom_mult_hma by simp
   also have "... = ?R"
     unfolding A_def J_def
     by (auto simp add:map_matrix_def map_vector_def)
   finally show ?thesis by simp
 qed
 
 definition \<gamma>\<^sub>a :: "'n itself \<Rightarrow> real" where
   "\<gamma>\<^sub>a _ = (if n > 1 then Max_mset (image_mset cmod (eigenvalues A - {#1#})) else 0)"
 
 definition \<gamma>\<^sub>2 :: "'n itself \<Rightarrow> real" where
   "\<gamma>\<^sub>2 _ = (if n > 1 then Max_mset {# Re x. x \<in># (eigenvalues A - {#1#})#} else 0)"
 
 lemma J_sym: "hermitian_hma J"
   unfolding J_def hermitian_hma_def
   by (intro  iffD2[OF vec_eq_iff] allI) (simp add: adjoint_hma_eq)
 
 lemma
   shows evs_real: "set_mset (eigenvalues A::complex multiset) \<subseteq> \<real>" (is "?R1")
     and ev_1: "(1::complex) \<in># eigenvalues A"
     and \<gamma>\<^sub>a_ge_0: "\<gamma>\<^sub>a TYPE ('n) \<ge> 0"
-    and find_any_ev: 
-      "\<forall>\<alpha> \<in># eigenvalues A - {#1#}. \<exists>v. cinner v 1 = 0 \<and> v \<noteq> 0 \<and> A *v v = \<alpha> *s v" 
+    and find_any_ev:
+      "\<forall>\<alpha> \<in># eigenvalues A - {#1#}. \<exists>v. cinner v 1 = 0 \<and> v \<noteq> 0 \<and> A *v v = \<alpha> *s v"
     and \<gamma>\<^sub>a_bound: "\<forall>v. cinner v 1 = 0 \<longrightarrow> norm (A *v v) \<le> \<gamma>\<^sub>a TYPE('n) * norm v"
     and \<gamma>\<^sub>2_bound: "\<forall>(v::real^'n). v \<bullet> 1 = 0 \<longrightarrow> v \<bullet> (A *v v) \<le> \<gamma>\<^sub>2 TYPE ('n) * norm v^2"
 proof -
-  have "\<exists> U. \<forall> A\<in> {J,A}. \<exists>B. real_diag_decomp_hma A B U"  
+  have "\<exists> U. \<forall> A\<in> {J,A}. \<exists>B. real_diag_decomp_hma A B U"
     using J_sym hermitian_A J_A_comm
     by (intro commuting_hermitian_family_diag_hma) auto
-  then obtain U Ad Jd 
+  then obtain U Ad Jd
     where A_decomp: "real_diag_decomp_hma A Ad U" and K_decomp: "real_diag_decomp_hma J Jd U"
     by auto
-  have J_sim: "similar_matrix_wit J (diag Jd) U (adjoint_hma U)" and 
+  have J_sim: "similar_matrix_wit J (diag Jd) U (adjoint_hma U)" and
     unit_U: "unitary_hma U"
     using K_decomp unfolding real_diag_decomp_hma_def unitary_diag_def unitarily_equiv_hma_def
     by auto
 
   have "diag_mat_hma (diag Jd) = eigenvalues (diag Jd)"
     by (intro upper_tri_eigvals[symmetric] diag_imp_upper_tri J_sim) auto
   also have "... = eigenvalues J"
     using J_sim by (intro similar_matrix_eigvals[symmetric]) (auto simp add:similar_matrix_def)
   also have "... ={#1::complex#} + replicate_mset (n - 1) 0"
     unfolding J_eigvals by simp
   finally have 0:"diag_mat_hma (diag Jd) = {#1::complex#} + replicate_mset (n - 1) 0" by simp
   hence "1 \<in># diag_mat_hma (diag Jd)" by simp
-  then obtain i where i_def:"Jd $h i = 1" 
+  then obtain i where i_def:"Jd $h i = 1"
     unfolding diag_mat_hma_def diag_def by auto
   have "{# Jd $h j. j \<in># mset_set (UNIV - {i}) #} = {#Jd $h j. j \<in># mset_set UNIV - mset_set {i}#}"
     unfolding diag_mat_hma_def by (intro arg_cong2[where f="image_mset"] mset_set_Diff) auto
   also have "... = diag_mat_hma (diag Jd)  - {#1#}"
     unfolding diag_mat_hma_def diag_def by (subst image_mset_Diff) (auto simp add:i_def)
   also have "... =  replicate_mset (n - 1) 0"
     unfolding 0 by simp
   finally have "{# Jd $h j. j \<in># mset_set (UNIV - {i}) #} = replicate_mset (n - 1) 0"
     by simp
-  hence "set_mset {# Jd $h j. j \<in># mset_set (UNIV - {i}) #} \<subseteq> {0}" 
+  hence "set_mset {# Jd $h j. j \<in># mset_set (UNIV - {i}) #} \<subseteq> {0}"
     by simp
   hence 1:"Jd $h j = 0" if "j \<noteq> i" for j
     using that by auto
 
   define u where "u = adjoint_hma U *v 1"
   define \<alpha> where "\<alpha> = u $h i"
 
   have "U *v u = (U ** adjoint_hma U) *v 1"
     unfolding u_def by (simp add:matrix_vector_mul_assoc)
   also have "... = 1"
     unfolding unitary_hmaD[OF unit_U] by simp
   also have "... \<noteq>  0"
     by simp
-  finally have "U *v u \<noteq> 0" by simp 
+  finally have "U *v u \<noteq> 0" by simp
   hence u_nz: "u \<noteq> 0"
     by (cases "u = 0") auto
 
   have "diag Jd *v u = adjoint_hma U ** U ** diag Jd ** adjoint_hma U *v 1"
     unfolding unitary_hmaD[OF unit_U] u_def by (auto simp add:matrix_vector_mul_assoc)
   also have "... = adjoint_hma U ** (U ** diag Jd ** adjoint_hma U) *v 1"
     by (simp add:matrix_mul_assoc)
   also have "... = adjoint_hma U ** J *v 1"
     using J_sim unfolding similar_matrix_wit_def by simp
   also have "... = adjoint_hma U *v (map_matrix complex_of_real J *v 1)"
     by (simp add:map_matrix_def map_vector_def J_def matrix_vector_mul_assoc)
   also have "... = u"
     unfolding u_def markov_complex_apply[OF J_markov] by simp
   finally have u_ev: "diag Jd *v u = u" by simp
   hence "Jd * u = u"
     unfolding diag_vec_mult_eq by simp
   hence "u $h j = 0" if "j \<noteq> i" for j
     using 1 that unfolding times_vec_def vec_eq_iff by auto
   hence u_alt: "u = axis i \<alpha>"
     unfolding \<alpha>_def axis_def vec_eq_iff by auto
   hence \<alpha>_nz: "\<alpha> \<noteq> 0"
     using u_nz by (cases "\<alpha>=0") auto
 
   have A_sim: "similar_matrix_wit A (diag Ad) U (adjoint_hma U)" and Ad_real: "\<forall>i. Ad $h i \<in> \<real>"
     using A_decomp unfolding real_diag_decomp_hma_def unitary_diag_def unitarily_equiv_hma_def
     by auto
 
   have "diag_mat_hma (diag Ad) = eigenvalues (diag Ad)"
     by (intro upper_tri_eigvals[symmetric] diag_imp_upper_tri A_sim) auto
   also have "... = eigenvalues A"
     using A_sim by (intro similar_matrix_eigvals[symmetric]) (auto simp add:similar_matrix_def)
-  finally have 3:"diag_mat_hma (diag Ad) = eigenvalues A" 
+  finally have 3:"diag_mat_hma (diag Ad) = eigenvalues A"
     by simp
 
   show ?R1
     unfolding 3[symmetric] diag_mat_hma_def diag_def using Ad_real by auto
 
   have "diag Ad *v u = adjoint_hma U ** U ** diag Ad ** adjoint_hma U *v 1"
     unfolding unitary_hmaD[OF unit_U] u_def by (auto simp add:matrix_vector_mul_assoc)
   also have "... = adjoint_hma U ** (U ** diag Ad ** adjoint_hma U) *v 1"
     by (simp add:matrix_mul_assoc)
   also have "... = adjoint_hma U ** A *v 1"
     using A_sim unfolding similar_matrix_wit_def by simp
   also have "... = adjoint_hma U *v (map_matrix complex_of_real A *v 1)"
     by (simp add:map_matrix_def map_vector_def A_def matrix_vector_mul_assoc)
   also have "... = u"
     unfolding u_def markov_complex_apply[OF markov] by simp
   finally have u_ev_A: "diag Ad *v u = u" by simp
   hence "Ad * u = u"
     unfolding diag_vec_mult_eq by simp
   hence 5:"Ad $h i = 1"
-    using \<alpha>_nz unfolding u_alt times_vec_def vec_eq_iff axis_def by force 
+    using \<alpha>_nz unfolding u_alt times_vec_def vec_eq_iff axis_def by force
 
   thus ev_1: "(1::complex) \<in># eigenvalues A"
     unfolding 3[symmetric] diag_mat_hma_def diag_def by auto
 
   have "eigenvalues A - {#1#} = diag_mat_hma (diag Ad) - {#1#}"
     unfolding 3 by simp
   also have "... = {#Ad $h j. j \<in># mset_set UNIV#} - {# Ad $h i #}"
     unfolding 5 diag_mat_hma_def diag_def by simp
   also have "... = {#Ad $h j. j \<in># mset_set UNIV - mset_set {i}#}"
     by (subst image_mset_Diff) auto
   also have "... = {#Ad $h j. j \<in># mset_set (UNIV - {i})#}"
-    by (intro arg_cong2[where f="image_mset"] mset_set_Diff[symmetric]) auto 
+    by (intro arg_cong2[where f="image_mset"] mset_set_Diff[symmetric]) auto
   finally have 4:"eigenvalues A - {#1#} = {#Ad $h j. j \<in># mset_set (UNIV - {i})#}" by simp
 
   have "cmod (Ad $h k) \<le> \<gamma>\<^sub>a TYPE ('n)" if "n > 1" "k \<noteq> i" for k
     unfolding \<gamma>\<^sub>a_def 4 using that Max_ge by auto
   moreover have "k = i" if "n = 1" for k
-    using that to_nat_less_n by simp 
+    using that to_nat_less_n by simp
   ultimately have norm_Ad: "norm (Ad $h k) \<le> \<gamma>\<^sub>a TYPE ('n) \<or> k = i" for k
-    using n_gt_0 by (cases "n = 1", auto) 
+    using n_gt_0 by (cases "n = 1", auto)
 
   have "Re (Ad $h k) \<le> \<gamma>\<^sub>2 TYPE ('n)" if "n > 1" "k \<noteq> i" for k
     unfolding \<gamma>\<^sub>2_def 4 using that Max_ge by auto
   moreover have "k = i" if "n = 1" for k
-    using that to_nat_less_n by simp 
+    using that to_nat_less_n by simp
   ultimately have Re_Ad: "Re (Ad $h k) \<le> \<gamma>\<^sub>2 TYPE ('n) \<or> k = i" for k
-    using n_gt_0 by (cases "n = 1", auto) 
+    using n_gt_0 by (cases "n = 1", auto)
 
   show \<Lambda>\<^sub>e_ge_0: "\<gamma>\<^sub>a TYPE ('n) \<ge> 0"
   proof (cases "n > 1")
     case True
     then obtain k where k_def: "k \<noteq> i"
       by (metis (full_types) card_n from_nat_inj n_gt_0 one_neq_zero)
-    have "0 \<le> cmod (Ad $h k)" 
+    have "0 \<le> cmod (Ad $h k)"
       by simp
-    also have "... \<le> \<gamma>\<^sub>a TYPE ('n)" 
+    also have "... \<le> \<gamma>\<^sub>a TYPE ('n)"
       using norm_Ad k_def by auto
     finally show ?thesis by auto
   next
     case False
     thus ?thesis unfolding \<gamma>\<^sub>a_def by simp
   qed
 
   have "\<exists>v. cinner v 1 = 0 \<and> v \<noteq> 0 \<and> A *v v = \<beta> *s v" if \<beta>_ran: "\<beta> \<in># eigenvalues A - {#1#}" for \<beta>
   proof -
     obtain j where j_def: "\<beta> = Ad $h j" "j \<noteq> i"
       using \<beta>_ran unfolding 4 by auto
-    define v where "v = U *v axis j 1" 
+    define v where "v = U *v axis j 1"
 
-    have "A *v v = A ** U *v axis j 1" 
+    have "A *v v = A ** U *v axis j 1"
       unfolding v_def by (simp add:matrix_vector_mul_assoc)
     also have "... = ((U ** diag Ad ** adjoint_hma U) ** U) *v axis j 1"
       using A_sim unfolding similar_matrix_wit_def by simp
     also have "... = U ** diag Ad ** (adjoint_hma U ** U) *v axis j 1"
       by (simp add:matrix_mul_assoc)
     also have "... = U ** diag Ad *v axis j 1"
       using unitary_hmaD[OF unit_U] by simp
     also have "... = U *v (Ad * axis j 1)"
       by (simp add:matrix_vector_mul_assoc[symmetric] diag_vec_mult_eq)
     also have "... = U *v (\<beta> *s axis j 1)"
-      by (intro arg_cong2[where f="(*v)"] iffD2[OF vec_eq_iff]) (auto simp:j_def axis_def) 
+      by (intro arg_cong2[where f="(*v)"] iffD2[OF vec_eq_iff]) (auto simp:j_def axis_def)
     also have "... = \<beta> *s v"
-      unfolding v_def by (simp add:vector_scalar_commute) 
+      unfolding v_def by (simp add:vector_scalar_commute)
     finally have 5:"A *v v = \<beta> *s v" by simp
 
     have "cinner v 1 = cinner (axis j 1) (adjoint_hma U *v 1)"
       unfolding v_def adjoint_def_alter_hma by simp
     also have "... = cinner (axis j 1) (axis i \<alpha>)"
       unfolding u_def[symmetric] u_alt by simp
-    also have " ... = 0" 
-      using j_def(2) unfolding cinner_def axis_def scalar_product_def  map_vector_def 
+    also have " ... = 0"
+      using j_def(2) unfolding cinner_def axis_def scalar_product_def  map_vector_def
       by (auto simp:if_distrib if_distribR sum.If_cases)
     finally have 6:"cinner v 1  = 0 "
       by simp
 
     have "cinner v v = cinner (axis j 1) (adjoint_hma U *v (U *v (axis j 1)))"
       unfolding v_def adjoint_def_alter_hma by simp
     also have "... = cinner (axis j 1) (axis j 1)"
       unfolding matrix_vector_mul_assoc unitary_hmaD[OF unit_U] by simp
     also have "... = 1"
-      unfolding cinner_def axis_def scalar_product_def  map_vector_def 
+      unfolding cinner_def axis_def scalar_product_def  map_vector_def
       by (auto simp:if_distrib if_distribR sum.If_cases)
     finally have "cinner v v = 1"
       by simp
     hence 7:"v \<noteq> 0"
       by (cases "v=0") (auto simp add:cinner_0)
 
     show ?thesis
       by (intro exI[where x="v"] conjI 6 7 5)
   qed
 
   thus "\<forall>\<alpha> \<in># eigenvalues A - {#1#}. \<exists>v. cinner v 1 = 0 \<and> v \<noteq> 0 \<and> A *v v = \<alpha> *s v"
     by simp
 
-  have "norm (A *v v) \<le> \<gamma>\<^sub>a TYPE('n) * norm v" if "cinner v 1 = 0" for v 
+  have "norm (A *v v) \<le> \<gamma>\<^sub>a TYPE('n) * norm v" if "cinner v 1 = 0" for v
   proof -
     define w where "w= adjoint_hma U *v v"
 
     have "w $h i = cinner w (axis i 1)"
-      unfolding cinner_def axis_def scalar_product_def map_vector_def 
+      unfolding cinner_def axis_def scalar_product_def map_vector_def
       by (auto simp:if_distrib if_distribR sum.If_cases)
     also have "... = cinner v (U *v axis i 1)"
       unfolding w_def adjoint_def_alter_hma by simp
     also have "... = cinner v ((1 / \<alpha>) *s (U *v u))"
       unfolding vector_scalar_commute[symmetric] u_alt using \<alpha>_nz
       by (intro_cong "[\<sigma>\<^sub>2 cinner, \<sigma>\<^sub>2 (*v)]") (auto simp add:axis_def vec_eq_iff)
     also have "... = cinner v ((1 / \<alpha>) *s 1)"
       unfolding u_def matrix_vector_mul_assoc unitary_hmaD[OF unit_U] by simp
     also have "... = 0"
       unfolding cinner_scale_right that by simp
     finally have w_orth: "w $h i = 0" by simp
 
     have "norm (A *v v) = norm (U *v (diag Ad *v w))"
       using A_sim  unfolding matrix_vector_mul_assoc similar_matrix_wit_def w_def
       by (simp add:matrix_mul_assoc)
     also have "... = norm (diag Ad *v w)"
       unfolding unitary_iso[OF unit_U] by simp
     also have "... = norm (Ad * w)"
       unfolding diag_vec_mult_eq by simp
     also have "... = sqrt (\<Sum>i\<in>UNIV. (cmod (Ad $h i) * cmod (w $h i))\<^sup>2)"
       unfolding norm_vec_def L2_set_def times_vec_def by (simp add:norm_mult)
     also have "... \<le> sqrt (\<Sum>i\<in>UNIV. ((\<gamma>\<^sub>a TYPE('n)) * cmod (w $h i))^2)"
       using w_orth norm_Ad
       by (intro iffD2[OF real_sqrt_le_iff] sum_mono power_mono mult_right_mono') auto
     also have "... = \<bar>\<gamma>\<^sub>a TYPE('n)\<bar> * sqrt (\<Sum>i\<in>UNIV. (cmod (w $h i))\<^sup>2)"
       by (simp add:power_mult_distrib sum_distrib_left[symmetric] real_sqrt_mult)
     also have "... = \<bar>\<gamma>\<^sub>a TYPE('n)\<bar> * norm w"
       unfolding norm_vec_def L2_set_def by simp
     also have "... = \<gamma>\<^sub>a TYPE('n) * norm w"
       using \<Lambda>\<^sub>e_ge_0 by simp
     also have "... = \<gamma>\<^sub>a TYPE('n) * norm v"
       unfolding w_def unitary_iso[OF unitary_hma_adjoint[OF unit_U]] by simp
     finally show "norm (A *v v) \<le> \<gamma>\<^sub>a TYPE('n) * norm v"
       by simp
   qed
 
   thus "\<forall>v. cinner v 1 = 0 \<longrightarrow> norm (A *v v) \<le> \<gamma>\<^sub>a TYPE('n) * norm v" by auto
 
   have "v \<bullet> (A *v v) \<le> \<gamma>\<^sub>2 TYPE ('n) * norm v^2" if "v \<bullet> 1 = 0" for v :: "real^'n"
   proof -
     define v' where "v' = map_vector complex_of_real v"
     define w where "w= adjoint_hma U *v v'"
 
     have "w $h i = cinner w (axis i 1)"
-      unfolding cinner_def axis_def scalar_product_def map_vector_def 
+      unfolding cinner_def axis_def scalar_product_def map_vector_def
       by (auto simp:if_distrib if_distribR sum.If_cases)
     also have "... = cinner v' (U *v axis i 1)"
       unfolding w_def adjoint_def_alter_hma by simp
     also have "... = cinner v' ((1 / \<alpha>) *s (U *v u))"
       unfolding vector_scalar_commute[symmetric] u_alt using \<alpha>_nz
       by (intro_cong "[\<sigma>\<^sub>2 cinner, \<sigma>\<^sub>2 (*v)]") (auto simp add:axis_def vec_eq_iff)
     also have "... = cinner v' ((1 / \<alpha>) *s 1)"
       unfolding u_def matrix_vector_mul_assoc unitary_hmaD[OF unit_U] by simp
     also have "... = cnj (1 / \<alpha>) * cinner v' 1"
       unfolding cinner_scale_right by simp
     also have "... = cnj (1 / \<alpha>) * complex_of_real (v \<bullet> 1)"
       unfolding cinner_def scalar_product_def map_vector_def inner_vec_def v'_def
       by (intro arg_cong2[where f="(*)"] refl) (simp)
     also have "... = 0"
       unfolding that by simp
     finally have w_orth: "w $h i = 0" by simp
 
-    have "complex_of_real (norm v^2) = complex_of_real (v \<bullet> v)" 
+    have "complex_of_real (norm v^2) = complex_of_real (v \<bullet> v)"
       by (simp add: power2_norm_eq_inner)
     also have "... = cinner v' v'"
       unfolding v'_def cinner_def scalar_product_def inner_vec_def map_vector_def by simp
     also have "... = norm v'^2"
       unfolding cinner_self by simp
     also have "... = norm w^2"
       unfolding w_def unitary_iso[OF unitary_hma_adjoint[OF unit_U]] by simp
     also have "... = cinner w w"
       unfolding cinner_self by simp
     also have "... = (\<Sum>j\<in>UNIV. complex_of_real (cmod (w $h j)^2))"
-      unfolding cinner_def scalar_product_def map_vector_def 
+      unfolding cinner_def scalar_product_def map_vector_def
       cmod_power2 complex_mult_cnj[symmetric] by simp
     also have "... = complex_of_real (\<Sum>j\<in>UNIV.  (cmod (w $h j)^2))"
       by simp
     finally have "complex_of_real (norm v^2) = complex_of_real (\<Sum>j\<in>UNIV.  (cmod (w $h j)^2))"
       by simp
     hence norm_v: "norm v^2 = (\<Sum>j\<in>UNIV.  (cmod (w $h j)^2))"
       using of_real_hom.injectivity by blast
 
     have "complex_of_real (v \<bullet> (A *v v)) = cinner v' (map_vector of_real (A *v v))"
       unfolding v'_def cinner_def scalar_product_def inner_vec_def map_vector_def
       by simp
-    also have "... = cinner v' (map_matrix of_real A *v v')" 
+    also have "... = cinner v' (map_matrix of_real A *v v')"
       unfolding v'_def of_real_hom.mult_mat_vec_hma by simp
     also have "... = cinner v' (A *v v')"
       unfolding map_matrix_def map_vector_def A_def by auto
     also have "... = cinner v' (U ** diag Ad ** adjoint_hma U *v v')"
       using A_sim unfolding similar_matrix_wit_def by simp
     also have "... = cinner (adjoint_hma U *v v') (diag Ad ** adjoint_hma U *v v')"
       unfolding adjoint_def_alter_hma adjoint_adjoint adjoint_adjoint_id
       by (simp add:matrix_vector_mul_assoc matrix_mul_assoc)
     also have "... = cinner w (diag Ad *v w)"
       unfolding w_def by (simp add:matrix_vector_mul_assoc)
     also have "... = cinner w (Ad * w)"
       unfolding diag_vec_mult_eq by simp
     also have "... = (\<Sum>j\<in>UNIV. cnj (Ad $h j) * cmod (w $h j)^2)"
       unfolding cinner_def map_vector_def scalar_product_def cmod_power2 complex_mult_cnj[symmetric]
       by (simp add:algebra_simps)
     also have "... = (\<Sum>j\<in>UNIV. Ad $h j * cmod (w $h j)^2)"
       using Ad_real by (intro sum.cong refl arg_cong2[where f="(*)"] iffD1[OF Reals_cnj_iff]) auto
     also have "... = (\<Sum>j\<in>UNIV. complex_of_real (Re (Ad $h j) * cmod (w $h j)^2))"
       using Ad_real by (intro sum.cong refl) simp
     also have "... = complex_of_real (\<Sum>j\<in> UNIV. Re (Ad $h j) * cmod (w $h j)^2)"
       by simp
     finally have "complex_of_real (v\<bullet>(A *v v)) = of_real(\<Sum>j\<in>UNIV. Re (Ad $h j) * cmod (w $h j)^2)"
       by simp
-    hence "v\<bullet>(A *v v) = (\<Sum>j\<in>UNIV. Re (Ad $h j) * cmod (w $h j)^2)" 
+    hence "v\<bullet>(A *v v) = (\<Sum>j\<in>UNIV. Re (Ad $h j) * cmod (w $h j)^2)"
       using of_real_hom.injectivity by blast
     also have "... \<le> (\<Sum>j\<in>UNIV. \<gamma>\<^sub>2 TYPE ('n) * cmod (w $h j)^2)"
       using w_orth Re_Ad by (intro sum_mono mult_right_mono') auto
     also have "... = \<gamma>\<^sub>2 TYPE ('n) * (\<Sum>j\<in>UNIV. cmod (w $h j)^2)"
       by (simp add:sum_distrib_left)
     also have "... = \<gamma>\<^sub>2 TYPE ('n) * norm v^2"
       unfolding norm_v by simp
     finally show ?thesis by simp
   qed
 
   thus "\<forall>(v::real^'n). v \<bullet> 1 = 0 \<longrightarrow> v \<bullet> (A *v v) \<le> \<gamma>\<^sub>2 TYPE ('n) * norm v^2"
     by auto
 qed
 
 lemma find_any_real_ev:
   assumes "complex_of_real \<alpha> \<in># eigenvalues A - {#1#}"
   shows "\<exists>v. v \<bullet> 1 = 0 \<and> v \<noteq> 0 \<and> A *v v = \<alpha> *s v"
 proof -
   obtain w where w_def: "cinner w 1 = 0" "w \<noteq> 0" "A *v w = \<alpha> *s w"
     using find_any_ev assms by auto
 
   have "w = 0" if "map_vector Re (1 *s w) = 0" "map_vector Re (\<i> *s w) = 0"
-    using that by (simp add:vec_eq_iff map_vector_def complex_eq_iff) 
+    using that by (simp add:vec_eq_iff map_vector_def complex_eq_iff)
   then obtain c where c_def: "map_vector Re (c *s w) \<noteq> 0"
     using w_def(2) by blast
 
   define u where "u = c *s w"
 
-  define v where "v = map_vector Re u" 
+  define v where "v = map_vector Re u"
 
   hence "v \<bullet> 1 = Re (cinner u 1)"
     unfolding cinner_def inner_vec_def scalar_product_def map_vector_def by simp
   also have "... = 0"
     unfolding u_def cinner_scale_left w_def(1) by simp
   finally have 1:"v \<bullet> 1 = 0" by simp
 
   have "A *v v = (\<chi> i. \<Sum>j\<in>UNIV. A $h i $h j * Re (u $h j))"
     unfolding matrix_vector_mult_def v_def map_vector_def by simp
   also have "... = (\<chi> i. \<Sum>j\<in>UNIV. Re ( of_real (A $h i $h j) * u $h j))"
     by simp
   also have "... = (\<chi> i. Re (\<Sum>j\<in>UNIV. A $h i $h j * u $h j))"
     unfolding A_def by simp
   also have "... = map_vector Re (A *v u)"
     unfolding map_vector_def matrix_vector_mult_def by simp
   also have "... = map_vector Re (of_real \<alpha> *s u)"
-    unfolding u_def vector_scalar_commute w_def(3)  
+    unfolding u_def vector_scalar_commute w_def(3)
     by (simp add:ac_simps)
   also have "... = \<alpha> *s v"
     unfolding v_def by (simp add:vec_eq_iff map_vector_def)
   finally have 2: "A *v v = \<alpha> *s v" by simp
 
-  have 3:"v \<noteq> 0" 
+  have 3:"v \<noteq> 0"
     unfolding v_def u_def using c_def by simp
 
   show ?thesis
     by (intro exI[where x="v"] conjI 1 2 3)
 qed
 
 lemma size_evs:
   "size (eigenvalues A - {#1::complex#}) = n-1"
 proof -
   have "size (eigenvalues A :: complex multiset) = n"
     using eigvals_poly_length card_n[symmetric] by auto
   thus "size (eigenvalues A - {#(1::complex)#}) = n -1"
     using ev_1 by (simp add: size_Diff_singleton)
 qed
 
 lemma find_\<gamma>\<^sub>2:
   assumes "n > 1"
   shows "\<gamma>\<^sub>a TYPE('n) \<in># image_mset cmod (eigenvalues A - {#1::complex#})"
 proof -
   have "set_mset (eigenvalues A - {#(1::complex)#}) \<noteq> {}"
     using assms size_evs by auto
   hence 2: "cmod ` set_mset (eigenvalues A - {#1#}) \<noteq> {}"
     by simp
   have "\<gamma>\<^sub>a TYPE('n) \<in> set_mset (image_mset cmod (eigenvalues A - {#1#}))"
     unfolding \<gamma>\<^sub>a_def using assms 2 Max_in by auto
   thus "\<gamma>\<^sub>a TYPE('n) \<in># image_mset cmod (eigenvalues A - {#1#})"
     by simp
 qed
 
 lemma \<gamma>\<^sub>2_real_ev:
   assumes "n > 1"
-  shows "\<exists>v. (\<exists>\<alpha>. abs \<alpha>=\<gamma>\<^sub>a TYPE('n) \<and> v \<bullet> 1=0 \<and> v \<noteq> 0 \<and> A *v v = \<alpha> *s v)"  
+  shows "\<exists>v. (\<exists>\<alpha>. abs \<alpha>=\<gamma>\<^sub>a TYPE('n) \<and> v \<bullet> 1=0 \<and> v \<noteq> 0 \<and> A *v v = \<alpha> *s v)"
 proof -
   obtain \<alpha> where \<alpha>_def: "cmod \<alpha> = \<gamma>\<^sub>a TYPE('n)" "\<alpha> \<in># eigenvalues A - {#1#}"
     using find_\<gamma>\<^sub>2[OF assms] by auto
   have "\<alpha> \<in> \<real>"
     using in_diffD[OF \<alpha>_def(2)] evs_real by auto
-  then obtain \<beta> where \<beta>_def: "\<alpha> = of_real \<beta>" 
+  then obtain \<beta> where \<beta>_def: "\<alpha> = of_real \<beta>"
     using Reals_cases by auto
 
   have 0:"complex_of_real \<beta> \<in># eigenvalues A-{#1#}"
     using \<alpha>_def unfolding \<beta>_def by auto
 
   have 1: "\<bar>\<beta>\<bar> = \<gamma>\<^sub>a TYPE('n)"
     using \<alpha>_def unfolding \<beta>_def by simp
   show ?thesis
     using find_any_real_ev[OF 0] 1 by auto
 qed
 
-lemma \<gamma>\<^sub>a_real_bound: 
+lemma \<gamma>\<^sub>a_real_bound:
   fixes v :: "real^'n"
   assumes "v \<bullet> 1 = 0"
   shows "norm (A *v v) \<le> \<gamma>\<^sub>a TYPE('n) * norm v"
 proof -
   define w where "w = map_vector complex_of_real v"
 
   have "cinner w 1 = v \<bullet> 1"
-    unfolding w_def cinner_def map_vector_def scalar_product_def inner_vec_def 
+    unfolding w_def cinner_def map_vector_def scalar_product_def inner_vec_def
     by simp
   also have "... = 0" using assms by simp
   finally have 0: "cinner w 1 = 0" by simp
   have "norm (A *v v) = norm (map_matrix complex_of_real A *v (map_vector complex_of_real v))"
     unfolding norm_of_real of_real_hom.mult_mat_vec_hma[symmetric] by simp
   also have "... = norm (A *v w)"
     unfolding w_def A_def map_matrix_def map_vector_def by simp
   also have "... \<le> \<gamma>\<^sub>a TYPE('n) * norm w"
     using \<gamma>\<^sub>a_bound 0 by auto
   also have "... = \<gamma>\<^sub>a TYPE('n) * norm v"
     unfolding w_def norm_of_real by simp
   finally show ?thesis by simp
 qed
 
 lemma \<Lambda>\<^sub>e_eq_\<Lambda>: "\<Lambda>\<^sub>a = \<gamma>\<^sub>a TYPE('n)"
 proof -
-  have "\<bar>g_inner f (g_step f)\<bar> \<le> \<gamma>\<^sub>a TYPE('n) * (g_norm f)\<^sup>2" 
+  have "\<bar>g_inner f (g_step f)\<bar> \<le> \<gamma>\<^sub>a TYPE('n) * (g_norm f)\<^sup>2"
     (is "?L \<le> ?R") if "g_inner f (\<lambda>_. 1) = 0" for f
   proof -
     define v where "v = (\<chi> i. f (enum_verts i))"
-    have 0: " v \<bullet> 1 = 0" 
+    have 0: " v \<bullet> 1 = 0"
       using that unfolding g_inner_conv one_vec_def v_def by auto
     have "?L = \<bar>v \<bullet> (A *v v)\<bar>"
       unfolding g_inner_conv g_step_conv v_def by simp
     also have "... \<le> (norm v * norm (A *v v))"
-      by (intro Cauchy_Schwarz_ineq2) 
+      by (intro Cauchy_Schwarz_ineq2)
     also have "... \<le> (norm v * (\<gamma>\<^sub>a TYPE('n) * norm v))"
       by (intro mult_left_mono \<gamma>\<^sub>a_real_bound 0) auto
     also have "... = ?R"
       unfolding g_norm_conv v_def by (simp add:algebra_simps power2_eq_square)
     finally show ?thesis by simp
   qed
   hence "\<Lambda>\<^sub>a \<le> \<gamma>\<^sub>a TYPE('n)"
     using \<gamma>\<^sub>a_ge_0 by (intro expander_intro_1) auto
 
-  moreover have "\<Lambda>\<^sub>a \<ge> \<gamma>\<^sub>a TYPE('n)" 
+  moreover have "\<Lambda>\<^sub>a \<ge> \<gamma>\<^sub>a TYPE('n)"
   proof (cases "n > 1")
     case True
     then obtain v \<alpha> where v_def: "abs \<alpha> = \<gamma>\<^sub>a TYPE('n)" "A *v v =\<alpha> *s v" "v \<noteq> 0" "v \<bullet> 1 = 0"
       using \<gamma>\<^sub>2_real_ev by auto
     define f where "f x = v $h enum_verts_inv x" for x
     have v_alt: "v = (\<chi> i. f (enum_verts i))"
       unfolding f_def Rep_inverse by simp
 
     have "g_inner f (\<lambda>_. 1) = v \<bullet> 1"
       unfolding g_inner_conv v_alt one_vec_def by simp
     also have "... = 0" using v_def by simp
     finally have 2:"g_inner f (\<lambda>_. 1) = 0" by simp
 
-    have "\<gamma>\<^sub>a TYPE('n) * g_norm f^2 = \<gamma>\<^sub>a TYPE('n) * norm v^2" 
+    have "\<gamma>\<^sub>a TYPE('n) * g_norm f^2 = \<gamma>\<^sub>a TYPE('n) * norm v^2"
       unfolding g_norm_conv v_alt by simp
-    also have "... = \<gamma>\<^sub>a TYPE('n) * \<bar>v \<bullet> v\<bar>" 
+    also have "... = \<gamma>\<^sub>a TYPE('n) * \<bar>v \<bullet> v\<bar>"
       by (simp add: power2_norm_eq_inner)
-    also have "... = \<bar>v \<bullet> (\<alpha> *s v)\<bar>" 
-      unfolding v_def(1)[symmetric] scalar_mult_eq_scaleR 
+    also have "... = \<bar>v \<bullet> (\<alpha> *s v)\<bar>"
+      unfolding v_def(1)[symmetric] scalar_mult_eq_scaleR
       by (simp add:abs_mult)
-    also have "... = \<bar>v \<bullet> (A *v v)\<bar>" 
+    also have "... = \<bar>v \<bullet> (A *v v)\<bar>"
       unfolding v_def by simp
-    also have "... = \<bar>g_inner f (g_step f)\<bar>" 
+    also have "... = \<bar>g_inner f (g_step f)\<bar>"
       unfolding g_inner_conv g_step_conv v_alt by simp
-    also have "... \<le> \<Lambda>\<^sub>a * g_norm f^2" 
-      by (intro expansionD1 2) 
+    also have "... \<le> \<Lambda>\<^sub>a * g_norm f^2"
+      by (intro expansionD1 2)
     finally have "\<gamma>\<^sub>a TYPE('n) * g_norm f^2 \<le>  \<Lambda>\<^sub>a * g_norm f^2" by simp
-    moreover have "norm v^2 > 0" 
+    moreover have "norm v^2 > 0"
       using v_def(3) by simp
-    hence "g_norm f^2 > 0" 
+    hence "g_norm f^2 > 0"
       unfolding g_norm_conv v_alt by simp
-    ultimately show ?thesis by simp 
+    ultimately show ?thesis by simp
   next
     case False
     hence "n = 1" using n_gt_0 by simp
     hence "\<gamma>\<^sub>a TYPE('n) = 0"
       unfolding \<gamma>\<^sub>a_def by simp
 
     then show ?thesis using \<Lambda>_ge_0 by simp
   qed
   ultimately show ?thesis by simp
 qed
 
-lemma \<gamma>\<^sub>2_ev: 
+lemma \<gamma>\<^sub>2_ev:
   assumes "n > 1"
   shows "\<exists>v. v \<bullet> 1 = 0 \<and> v \<noteq> 0 \<and> A *v v = \<gamma>\<^sub>2 TYPE('n) *s v"
 proof -
   have "set_mset (eigenvalues A - {#1::complex#}) \<noteq> {}"
     using size_evs assms by auto
   hence "Max (Re ` set_mset (eigenvalues A - {#1#})) \<in> Re ` set_mset (eigenvalues A - {#1#})"
     by (intro Max_in) auto
-  hence "\<gamma>\<^sub>2 TYPE ('n) \<in> Re ` set_mset (eigenvalues A - {#1#})" 
+  hence "\<gamma>\<^sub>2 TYPE ('n) \<in> Re ` set_mset (eigenvalues A - {#1#})"
     unfolding \<gamma>\<^sub>2_def using assms by simp
   then obtain \<alpha> where \<alpha>_def: "\<alpha> \<in> set_mset (eigenvalues A - {#1#})" "\<gamma>\<^sub>2 TYPE ('n) = Re \<alpha>"
     by auto
   have \<alpha>_real: "\<alpha> \<in> \<real>"
     using evs_real in_diffD[OF \<alpha>_def(1)] by auto
   have "complex_of_real (\<gamma>\<^sub>2 TYPE ('n)) = of_real (Re \<alpha>)"
     unfolding \<alpha>_def by simp
   also have "... = \<alpha>"
     using \<alpha>_real by simp
   also have "... \<in># eigenvalues A - {#1#}"
     using \<alpha>_def(1) by simp
   finally have 0:"complex_of_real (\<gamma>\<^sub>2 TYPE ('n)) \<in># eigenvalues A - {#1#}" by simp
   thus ?thesis
     using find_any_real_ev[OF 0] by auto
 qed
 
 lemma \<Lambda>\<^sub>2_eq_\<gamma>\<^sub>2: "\<Lambda>\<^sub>2 = \<gamma>\<^sub>2 TYPE ('n)"
 proof (cases "n > 1")
   case True
 
-  obtain v where v_def: "v \<bullet> 1 = 0" "v \<noteq> 0" "A *v v = \<gamma>\<^sub>2 TYPE('n) *s v" 
+  obtain v where v_def: "v \<bullet> 1 = 0" "v \<noteq> 0" "A *v v = \<gamma>\<^sub>2 TYPE('n) *s v"
     using \<gamma>\<^sub>2_ev[OF True] by auto
 
   define f where "f x = v $h enum_verts_inv x" for x
   have v_alt: "v = (\<chi> i. f (enum_verts i))"
     unfolding f_def Rep_inverse by simp
 
   have "g_inner f (\<lambda>_. 1) = v \<bullet> 1"
     unfolding g_inner_conv v_alt one_vec_def by simp
   also have "... = 0" unfolding v_def(1) by simp
   finally have f_orth: "g_inner f (\<lambda>_. 1) = 0" by simp
 
   have "\<gamma>\<^sub>2 TYPE('n) * norm v^2= v \<bullet> (\<gamma>\<^sub>2 TYPE('n) *s v)"
     unfolding power2_norm_eq_inner by (simp add:algebra_simps scalar_mult_eq_scaleR)
   also have "... = v \<bullet> (A *v v)"
     unfolding v_def by simp
   also have "... = g_inner f (g_step f)"
     unfolding v_alt g_inner_conv g_step_conv by simp
   also have "... \<le> \<Lambda>\<^sub>2 * g_norm f^2"
-    by (intro os_expanderD f_orth) 
+    by (intro os_expanderD f_orth)
   also have "... = \<Lambda>\<^sub>2 * norm v^2"
     unfolding v_alt g_norm_conv by simp
   finally have "\<gamma>\<^sub>2 TYPE('n) * norm v^2 \<le> \<Lambda>\<^sub>2 * norm v^2" by simp
   hence "\<gamma>\<^sub>2 TYPE('n) \<le> \<Lambda>\<^sub>2"
     using v_def(2) by simp
   moreover have "\<Lambda>\<^sub>2 \<le> \<gamma>\<^sub>2 TYPE ('n)"
-    using \<gamma>\<^sub>2_bound  
-    by (intro os_expanderI[OF True]) 
+    using \<gamma>\<^sub>2_bound
+    by (intro os_expanderI[OF True])
       (simp add: g_inner_conv g_step_conv g_norm_conv one_vec_def)
   ultimately show ?thesis by simp
 next
   case False
-  then show ?thesis 
+  then show ?thesis
     unfolding \<Lambda>\<^sub>2_def \<gamma>\<^sub>2_def by simp
 qed
 
 lemma expansionD2:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   shows "g_norm (g_step f) \<le> \<Lambda>\<^sub>a * g_norm f" (is "?L \<le> ?R")
 proof -
   define v where "v = (\<chi> i. f (enum_verts i))"
   have "v \<bullet> 1 = g_inner f (\<lambda>_. 1)"
     unfolding g_inner_conv v_def one_vec_def by simp
   also have "... = 0" using assms by simp
   finally have 0:"v \<bullet> 1 = 0" by simp
   have "g_norm (g_step f) = norm (A *v v)"
     unfolding g_norm_conv g_step_conv v_def by auto
   also have "... \<le> \<Lambda>\<^sub>a * norm v"
     unfolding \<Lambda>\<^sub>e_eq_\<Lambda> by (intro \<gamma>\<^sub>a_real_bound 0)
   also have "... = \<Lambda>\<^sub>a * g_norm f"
     unfolding g_norm_conv v_def by simp
   finally show ?thesis by simp
 qed
 
-lemma rayleigh_bound: 
+lemma rayleigh_bound:
   fixes v :: "real^'n"
   shows "\<bar>v \<bullet> (A *v v)\<bar> \<le> norm v^2"
 proof -
   define f where "f x = v $h enum_verts_inv x" for x
   have v_alt: "v = (\<chi> i. f (enum_verts i))"
     unfolding f_def Rep_inverse by simp
 
   have "\<bar>v \<bullet> (A *v v)\<bar> = \<bar>g_inner f (g_step f)\<bar>"
     unfolding v_alt g_inner_conv g_step_conv by simp
   also have "... = \<bar>(\<Sum>a\<in>arcs G. f (head G a) * f (tail G a))\<bar>/d"
     unfolding g_inner_step_eq by simp
   also have "... \<le> (d * (g_norm f)\<^sup>2) / d"
     by (intro divide_right_mono bdd_above_aux) auto
-  also have "... = g_norm f^2" 
+  also have "... = g_norm f^2"
     using d_gt_0 by simp
   also have "... = norm v^2"
     unfolding g_norm_conv v_alt by simp
   finally show ?thesis by simp
 qed
 
 text \<open>The following implies that two-sided expanders are also one-sided expanders.\<close>
 
 lemma \<Lambda>\<^sub>2_range: "\<bar>\<Lambda>\<^sub>2\<bar> \<le> \<Lambda>\<^sub>a"
 proof (cases "n > 1")
   case True
   hence 0:"set_mset (eigenvalues A - {#1::complex#}) \<noteq> {}"
     using size_evs by auto
 
   have "\<gamma>\<^sub>2 TYPE ('n) = Max (Re ` set_mset (eigenvalues A - {#1::complex#}))"
     unfolding \<gamma>\<^sub>2_def using True by simp
   also have "... \<in> Re ` set_mset (eigenvalues A - {#1::complex#})"
     using Max_in 0 by simp
   finally have "\<gamma>\<^sub>2 TYPE ('n) \<in> Re ` set_mset (eigenvalues A - {#1::complex#})"
     by simp
   then obtain \<alpha> where \<alpha>_def: "\<alpha> \<in> set_mset (eigenvalues A - {#1::complex#})" "\<gamma>\<^sub>2 TYPE ('n) = Re \<alpha>"
     by auto
 
   have "\<bar>\<Lambda>\<^sub>2\<bar> = \<bar>\<gamma>\<^sub>2 TYPE ('n) \<bar>"
     using \<Lambda>\<^sub>2_eq_\<gamma>\<^sub>2 by simp
-  also have "... = \<bar>Re \<alpha>\<bar>" 
+  also have "... = \<bar>Re \<alpha>\<bar>"
     using \<alpha>_def by simp
   also have "... \<le> cmod \<alpha>"
     using abs_Re_le_cmod by simp
   also have "... \<le> Max (cmod ` set_mset (eigenvalues A - {#1#}))"
     using \<alpha>_def(1) by (intro Max_ge) auto
-  also have "... \<le> \<gamma>\<^sub>a TYPE('n)" 
+  also have "... \<le> \<gamma>\<^sub>a TYPE('n)"
     unfolding \<gamma>\<^sub>a_def using True by simp
   also have "... = \<Lambda>\<^sub>a"
     using \<Lambda>\<^sub>e_eq_\<Lambda> by simp
   finally show ?thesis by simp
-next 
+next
   case False
-  thus ?thesis 
+  thus ?thesis
     unfolding \<Lambda>\<^sub>2_def \<Lambda>\<^sub>a_def by simp
 qed
 
 end
 
-lemmas (in regular_graph) expansionD2 =  
+lemmas (in regular_graph) expansionD2 =
   regular_graph_tts.expansionD2[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
-lemmas (in regular_graph) \<Lambda>\<^sub>2_range =  
+lemmas (in regular_graph) \<Lambda>\<^sub>2_range =
   regular_graph_tts.\<Lambda>\<^sub>2_range[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
 unbundle no_intro_cong_syntax
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_MGG.thy b/thys/Expander_Graphs/Expander_Graphs_MGG.thy
--- a/thys/Expander_Graphs/Expander_Graphs_MGG.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_MGG.thy
@@ -1,1260 +1,1260 @@
 section \<open>Margulis Gabber Galil Construction\label{sec:margulis}\<close>
 
 text \<open>This section formalizes the Margulis-Gabber-Galil expander graph, which is defined on the
 product space $\mathbb Z_n \times \mathbb Z_n$. The construction is an adaptation of graph
 introduced by Margulis~\cite{margulis1973}, for which he gave a non-constructive proof of its
 spectral gap. Later Gabber and Galil~\cite{gabber1981} adapted the graph and derived an explicit
 spectral gap, i.e., that the second largest eigenvalue is bounded by $\frac{5}{8} \sqrt{2}$. The
-proof was later improved by Jimbo and Marouka~\cite{jimbo1987} using Fourier Analysis. 
+proof was later improved by Jimbo and Marouka~\cite{jimbo1987} using Fourier Analysis.
 Hoory et al.~\cite[\S 8]{hoory2006} present a slight simplification of that proof (due to Boppala)
 which this formalization is based on.\<close>
 
 theory Expander_Graphs_MGG
-  imports 
+  imports
     "HOL-Analysis.Complex_Transcendental"
     "HOL-Decision_Procs.Approximation"
     Expander_Graphs_Definition
 begin
 
-datatype ('a, 'b) arc = Arc (arc_tail: 'a)  (arc_head: 'a) (arc_label: 'b)  
+datatype ('a, 'b) arc = Arc (arc_tail: 'a)  (arc_head: 'a) (arc_label: 'b)
 
 fun mgg_graph_step :: "nat \<Rightarrow> (int \<times> int) \<Rightarrow> (nat \<times> int) \<Rightarrow> (int \<times> int)"
-  where "mgg_graph_step n (i,j) (l,\<sigma>) = 
+  where "mgg_graph_step n (i,j) (l,\<sigma>) =
   [ ((i+\<sigma>*(2*j+0)) mod int n, j), (i, (j+\<sigma>*(2*i+0)) mod int n)
   , ((i+\<sigma>*(2*j+1)) mod int n, j), (i, (j+\<sigma>*(2*i+1)) mod int n) ] ! l"
 
-definition mgg_graph :: "nat \<Rightarrow> (int \<times> int, (int \<times> int, nat \<times> int) arc) pre_digraph" where 
+definition mgg_graph :: "nat \<Rightarrow> (int \<times> int, (int \<times> int, nat \<times> int) arc) pre_digraph" where
   "mgg_graph n =
-    \<lparr> verts = {0..<n} \<times> {0..<n}, 
-      arcs = (\<lambda>(t,l). (Arc t (mgg_graph_step n t l) l))`(({0..<int n}\<times>{0..<int n})\<times>({..<4}\<times>{-1,1})), 
+    \<lparr> verts = {0..<n} \<times> {0..<n},
+      arcs = (\<lambda>(t,l). (Arc t (mgg_graph_step n t l) l))`(({0..<int n}\<times>{0..<int n})\<times>({..<4}\<times>{-1,1})),
       tail = arc_tail,
       head = arc_head \<rparr>"
 
 locale margulis_gaber_galil =
   fixes m :: nat
   assumes m_gt_0: "m > 0"
 begin
 
 abbreviation G where "G \<equiv> mgg_graph m"
 
 lemma wf_digraph: "wf_digraph (mgg_graph m)"
 proof -
-  have 
-    "tail (mgg_graph m) e \<in> verts (mgg_graph m)" (is "?A") 
+  have
+    "tail (mgg_graph m) e \<in> verts (mgg_graph m)" (is "?A")
     "head (mgg_graph m) e \<in> verts (mgg_graph m)" (is "?B")
     if a:"e \<in> arcs (mgg_graph m)" for e
   proof -
-    obtain t l \<sigma> where tl_def: 
-      "t \<in> {0..<int m} \<times> {0..<int m}" "l \<in> {..<4}" "\<sigma> \<in> {-1,1}" 
+    obtain t l \<sigma> where tl_def:
+      "t \<in> {0..<int m} \<times> {0..<int m}" "l \<in> {..<4}" "\<sigma> \<in> {-1,1}"
       "e = Arc t (mgg_graph_step m t (l,\<sigma>)) (l,\<sigma>)"
-      using a mgg_graph_def by auto 
+      using a mgg_graph_def by auto
     thus ?A
       unfolding mgg_graph_def by auto
-    have "mgg_graph_step m (fst t, snd t) (l,\<sigma>) \<in> {0..<int m} \<times> {0..<int m}" 
+    have "mgg_graph_step m (fst t, snd t) (l,\<sigma>) \<in> {0..<int m} \<times> {0..<int m}"
       unfolding mgg_graph_step.simps using tl_def(1,2) m_gt_0
       by (intro set_mp[OF _ nth_mem])  auto
-    hence "arc_head e \<in> {0..<int m} \<times> {0..<int m}" 
+    hence "arc_head e \<in> {0..<int m} \<times> {0..<int m}"
       unfolding tl_def(4) by simp
     thus ?B
       unfolding mgg_graph_def by simp
   qed
   thus ?thesis
     by unfold_locales auto
 qed
 
 lemma mgg_finite: "fin_digraph (mgg_graph m)"
 proof -
   have "finite (verts (mgg_graph m))" "finite (arcs (mgg_graph m))"
     unfolding mgg_graph_def by auto
   thus ?thesis
     using wf_digraph
     unfolding fin_digraph_def fin_digraph_axioms_def by auto
 qed
 
 interpretation fin_digraph "mgg_graph m"
   using mgg_finite by simp
 
-definition arcs_pos :: "(int \<times> int, nat \<times> int) arc set" 
+definition arcs_pos :: "(int \<times> int, nat \<times> int) arc set"
     where "arcs_pos = (\<lambda>(t,l). (Arc t (mgg_graph_step m t (l,1)) (l, 1)))`(verts G\<times>{..<4})"
-definition arcs_neg :: "(int \<times> int, nat \<times> int) arc set" 
+definition arcs_neg :: "(int \<times> int, nat \<times> int) arc set"
     where "arcs_neg = (\<lambda>(h,l). (Arc (mgg_graph_step m h (l,1)) h (l,-1)))`(verts G\<times>{..<4})"
 
 lemma arcs_sym:
   "arcs G = arcs_pos \<union> arcs_neg"
 proof -
-  have 0: "x \<in> arcs G" if "x \<in> arcs_pos" for x 
-    using that unfolding arcs_pos_def mgg_graph_def by auto 
-  have 1: "a \<in> arcs G" if t:"a \<in> arcs_neg" for a 
+  have 0: "x \<in> arcs G" if "x \<in> arcs_pos" for x
+    using that unfolding arcs_pos_def mgg_graph_def by auto
+  have 1: "a \<in> arcs G" if t:"a \<in> arcs_neg" for a
   proof -
     obtain h l where hl_def: "h \<in> verts G" "l \<in> {..<4}" "a = Arc (mgg_graph_step m h (l,1)) h (l,-1)"
       using t unfolding arcs_neg_def by auto
 
     define t where "t = mgg_graph_step m h (l,1)"
 
-    have h_ran: "h \<in> {0..<int m} \<times> {0..<int m}" 
+    have h_ran: "h \<in> {0..<int m} \<times> {0..<int m}"
       using hl_def(1) unfolding mgg_graph_def by simp
-    have l_ran: "l \<in> set [0,1,2,3]" 
+    have l_ran: "l \<in> set [0,1,2,3]"
       using hl_def(2) by auto
 
-    have "t \<in> {0..<int m} \<times> {0..<int m}" 
+    have "t \<in> {0..<int m} \<times> {0..<int m}"
       using h_ran l_ran
       unfolding t_def by (cases h, auto simp add:mod_simps)
-    hence t_ran: "t \<in> verts G" 
+    hence t_ran: "t \<in> verts G"
       unfolding mgg_graph_def by simp
 
-    have "h = mgg_graph_step m t (l,-1)" 
+    have "h = mgg_graph_step m t (l,-1)"
       using h_ran l_ran unfolding t_def by (cases h, auto simp add:mod_simps)
     hence "a = Arc t (mgg_graph_step m t (l,-1)) (l,-1)"
       unfolding t_def hl_def(3) by simp
-    thus ?thesis 
+    thus ?thesis
       using t_ran hl_def(2) mgg_graph_def by (simp add:image_iff)
   qed
 
   have "card (arcs_pos \<union> arcs_neg) = card arcs_pos + card arcs_neg"
     unfolding arcs_pos_def arcs_neg_def by (intro card_Un_disjoint finite_imageI) auto
   also have "... = card (verts G\<times>{..<4::nat}) + card (verts G\<times>{..<4::nat})"
     unfolding arcs_pos_def arcs_neg_def
     by (intro arg_cong2[where f="(+)"] card_image inj_onI) auto
   also have "... = card (verts G\<times>{..<4::nat}\<times>{-1,1::int})"
     by simp
   also have "... = card ((\<lambda>(t, l). Arc t (mgg_graph_step m t l) l) ` (verts G \<times>{..<4}\<times>{-1,1}))"
     by (intro card_image[symmetric] inj_onI) auto
   also have "... = card (arcs G)"
     unfolding mgg_graph_def by simp
-  finally have "card (arcs_pos \<union> arcs_neg) = card (arcs G)" 
+  finally have "card (arcs_pos \<union> arcs_neg) = card (arcs G)"
     by simp
   hence "arcs_pos \<union> arcs_neg = arcs G"
-    using 0 1 by (intro card_subset_eq, auto) 
+    using 0 1 by (intro card_subset_eq, auto)
   thus ?thesis by simp
 qed
 
 lemma sym: "symmetric_multi_graph (mgg_graph m)"
 proof -
-  define f :: "(int \<times> int, nat \<times> int) arc \<Rightarrow> (int \<times> int, nat \<times> int) arc"  
-    where "f a = Arc (arc_head a) (arc_tail a) (apsnd (\<lambda>x. (-1) * x) (arc_label a))" for a 
+  define f :: "(int \<times> int, nat \<times> int) arc \<Rightarrow> (int \<times> int, nat \<times> int) arc"
+    where "f a = Arc (arc_head a) (arc_tail a) (apsnd (\<lambda>x. (-1) * x) (arc_label a))" for a
 
   have a: "bij_betw f arcs_pos arcs_neg"
     by (intro bij_betwI[where g="f"])
      (auto simp add:f_def image_iff arcs_pos_def arcs_neg_def)
 
   have b: "bij_betw f arcs_neg arcs_pos"
     by (intro bij_betwI[where g="f"])
      (auto simp add:f_def image_iff  arcs_pos_def arcs_neg_def)
 
   have c:"bij_betw f (arcs_pos \<union> arcs_neg) (arcs_neg \<union> arcs_pos)"
     by (intro bij_betw_combine[OF a b])  (auto simp add:arcs_pos_def arcs_neg_def)
 
   hence c:"bij_betw f (arcs G) (arcs G)"
     unfolding arcs_sym by (subst (2) sup_commute, simp)
   show ?thesis
-    by (intro symmetric_multi_graphI[where f="f"] fin_digraph_axioms c) 
+    by (intro symmetric_multi_graphI[where f="f"] fin_digraph_axioms c)
      (simp add:f_def mgg_graph_def)
 qed
 
 lemma out_deg:
   assumes "v \<in> verts G"
   shows "out_degree G v = 8"
 proof -
   have "out_degree (mgg_graph m) v = card (out_arcs (mgg_graph m) v)"
     unfolding out_degree_def by simp
-  also have "... = card {e. (\<exists>w \<in> verts (mgg_graph m). \<exists>l \<in> {..<4} \<times> {-1,1}. 
-    e = Arc w (mgg_graph_step m w l) l \<and> arc_tail e = v)}" 
+  also have "... = card {e. (\<exists>w \<in> verts (mgg_graph m). \<exists>l \<in> {..<4} \<times> {-1,1}.
+    e = Arc w (mgg_graph_step m w l) l \<and> arc_tail e = v)}"
     unfolding mgg_graph_def out_arcs_def by (simp add:image_iff)
   also have "... = card {e. (\<exists>l \<in> {..<4} \<times> {-1,1}. e = Arc v (mgg_graph_step m v l) l)}"
     using assms by (intro arg_cong[where f="card"] iffD2[OF set_eq_iff] allI)  auto
   also have "... = card ((\<lambda>l. Arc v (mgg_graph_step m v l) l) ` ({..<4} \<times> {-1,1}))"
     by (intro arg_cong[where f="card"]) (auto simp add:image_iff)
   also have "... = card ({..<4::nat} \<times> {-1,1::int})"
     by (intro card_image inj_onI) simp
   also have "... = 8" by simp
   finally show ?thesis by simp
 qed
 
 lemma verts_ne:
-  "verts G \<noteq> {}" 
+  "verts G \<noteq> {}"
   using m_gt_0 unfolding mgg_graph_def by simp
 
 sublocale regular_graph "mgg_graph m"
   using out_deg verts_ne
   by (intro regular_graphI[where d="8"] sym) auto
 
 lemma d_eq_8: "d = 8"
 proof -
   obtain v where v_def: "v \<in> verts G"
     using verts_ne by auto
   hence 0:"(SOME v. v \<in> verts G) \<in> verts G"
     by (rule someI[where x="v"])
   show ?thesis
     using out_deg[OF 0]
     unfolding d_def by simp
 qed
 
 text \<open>We start by introducing Fourier Analysis on the torus $\mathbb Z_n \times \mathbb Z_n$. The
 following is too specialized for a general AFP entry.\<close>
 
 lemma g_inner_sum_left:
   assumes "finite I"
   shows "g_inner (\<lambda>x. (\<Sum>i \<in> I. f i x)) g = (\<Sum>i\<in> I. g_inner (f i) g)"
   using assms by (induction I rule:finite_induct) (auto simp add:g_inner_simps)
 
 lemma g_inner_sum_right:
   assumes "finite I"
   shows "g_inner f (\<lambda>x. (\<Sum>i \<in> I. g i x)) = (\<Sum>i\<in> I. g_inner f (g i))"
   using assms by (induction I rule:finite_induct) (auto simp add:g_inner_simps)
 
 lemma g_inner_reindex:
   assumes "bij_betw h (verts G) (verts G)"
   shows "g_inner f g = g_inner (\<lambda>x. (f (h x))) (\<lambda>x. (g (h x)))"
   unfolding g_inner_def
   by (subst sum.reindex_bij_betw[OF assms,symmetric]) simp
-  
+
 definition \<omega>\<^sub>F :: "real \<Rightarrow> complex" where "\<omega>\<^sub>F x = cis (2*pi*x/m)"
 
 lemma \<omega>\<^sub>F_simps:
   "\<omega>\<^sub>F (x + y) = \<omega>\<^sub>F x * \<omega>\<^sub>F y"
   "\<omega>\<^sub>F (x - y) = \<omega>\<^sub>F x * \<omega>\<^sub>F (-y)"
   "cnj (\<omega>\<^sub>F x) = \<omega>\<^sub>F (-x)"
-  unfolding \<omega>\<^sub>F_def by (auto simp add:algebra_simps diff_divide_distrib 
+  unfolding \<omega>\<^sub>F_def by (auto simp add:algebra_simps diff_divide_distrib
       add_divide_distrib cis_mult cis_divide cis_cnj)
 
 lemma \<omega>\<^sub>F_cong:
   fixes x y :: int
-  assumes "x mod m = y mod m" 
+  assumes "x mod m = y mod m"
   shows "\<omega>\<^sub>F (of_int x) = \<omega>\<^sub>F (of_int y)"
 proof -
   obtain z :: int where "y = x + m*z" using mod_eqE[OF assms] by auto
   hence "\<omega>\<^sub>F (of_int y) = \<omega>\<^sub>F (of_int x + of_int (m*z))"
     by simp
   also have "... = \<omega>\<^sub>F (of_int x) * \<omega>\<^sub>F (of_int (m*z))"
     by (simp add:\<omega>\<^sub>F_simps)
   also have "... = \<omega>\<^sub>F (of_int x) * cis (2 * pi * of_int (z))"
-    unfolding \<omega>\<^sub>F_def  using m_gt_0 
+    unfolding \<omega>\<^sub>F_def  using m_gt_0
     by (intro arg_cong2[where f="(*)"] arg_cong[where f="cis"]) auto
   also have "... = \<omega>\<^sub>F (of_int x) * 1"
     by (intro arg_cong2[where f="(*)"] cis_multiple_2pi) auto
   finally show ?thesis by simp
 qed
 
 lemma cis_eq_1_imp:
   assumes "cis (2 * pi * x) = 1"
   shows "x \<in> \<int>"
 proof -
-  have "cos (2 * pi * x) = Re (cis (2*pi*x))" 
+  have "cos (2 * pi * x) = Re (cis (2*pi*x))"
     using cis.simps by simp
-  also have "... = 1" 
+  also have "... = 1"
     unfolding assms by simp
   finally have "cos (2 * pi * x) = 1" by simp
   then obtain y where "2 * pi * x = of_int y * 2 * pi"
     using cos_one_2pi_int by auto
   hence "y = x" by simp
   thus ?thesis by auto
 qed
 
 lemma \<omega>\<^sub>F_eq_1_iff:
   fixes x :: int
   shows "\<omega>\<^sub>F x = 1 \<longleftrightarrow> x mod m = 0"
 proof
   assume "\<omega>\<^sub>F (real_of_int x) = 1"
   hence "cis (2 * pi * real_of_int x / real m) = 1"
     unfolding \<omega>\<^sub>F_def by simp
   hence "real_of_int x / real m \<in> \<int>"
     using cis_eq_1_imp by simp
   then obtain z :: int where "of_int x / real m = z"
     using Ints_cases by auto
   hence "x = z * real m"
     using m_gt_0 by (simp add: nonzero_divide_eq_eq)
   hence "x = z * m" using of_int_eq_iff by fastforce
   thus "x mod m = 0" by simp
 next
   assume "x mod m = 0"
   hence "\<omega>\<^sub>F x = \<omega>\<^sub>F (of_int 0)"
     by (intro \<omega>\<^sub>F_cong) auto
   also have "... = 1" unfolding \<omega>\<^sub>F_def by simp
   finally show "\<omega>\<^sub>F x= 1" by simp
 qed
 
 definition FT :: "(int \<times> int \<Rightarrow> complex) \<Rightarrow> (int \<times> int \<Rightarrow> complex)"
   where "FT f v = g_inner f (\<lambda>x. \<omega>\<^sub>F (fst x * fst v + snd x * snd v))"
 
 lemma FT_altdef: "FT f (u,v) = g_inner f (\<lambda>x. \<omega>\<^sub>F (fst x * u + snd x * v))"
   unfolding FT_def by (simp add:case_prod_beta)
 
 lemma FT_add: "FT (\<lambda>x. f x + g x) v = FT f v + FT g v"
   unfolding FT_def by (simp add:g_inner_simps algebra_simps)
 
 lemma FT_zero: "FT (\<lambda>x. 0) v = 0"
   unfolding FT_def g_inner_def by simp
 
-lemma FT_sum: 
-  assumes "finite I" 
+lemma FT_sum:
+  assumes "finite I"
   shows "FT (\<lambda>x. (\<Sum>i \<in> I. f i x)) v = (\<Sum>i \<in> I. FT (f i) v)"
   using assms by (induction rule: finite_induct, auto simp add:FT_zero FT_add)
 
 lemma FT_scale: "FT (\<lambda>x. c * f x) v = c * FT f v"
   unfolding FT_def by (simp add: g_inner_simps)
 
 lemma FT_cong:
   assumes "\<And>x. x \<in> verts G \<Longrightarrow> f x = g x"
   shows "FT f = FT g"
   unfolding FT_def by (intro ext g_inner_cong assms refl)
 
 lemma parseval:
   "g_inner f g = g_inner (FT f) (FT g)/m^2" (is "?L = ?R")
 proof -
   define \<delta> :: "(int \<times> int) \<Rightarrow> (int \<times> int) \<Rightarrow> complex" where "\<delta> x y = of_bool (x = y)" for x y
 
   have FT_\<delta>: "FT (\<delta> v) x = \<omega>\<^sub>F (-(fst v *fst x +snd v * snd x))" if "v \<in> verts G" for v x
     using that by (simp add:FT_def g_inner_def \<delta>_def \<omega>\<^sub>F_simps)
 
   have 1: "(\<Sum>x=0..<int m. \<omega>\<^sub>F (z*x)) = m * of_bool(z mod m = 0)" (is "?L1 = ?R1") for z :: int
   proof (cases "z mod m = 0")
     case True
     have "(\<Sum>x=0..<int m. \<omega>\<^sub>F (z*x)) = (\<Sum>x=0..<int m. \<omega>\<^sub>F (of_int 0))"
       using True by (intro sum.cong \<omega>\<^sub>F_cong refl) auto
     also have "... = m * of_bool(z mod m = 0)"
       unfolding \<omega>\<^sub>F_def True by simp
     finally show ?thesis by simp
   next
     case False
     have "(1-\<omega>\<^sub>F z) * ?L1 = (1-\<omega>\<^sub>F z) * (\<Sum>x \<in> int ` {..<m}. \<omega>\<^sub>F(z*x))"
       by (intro arg_cong2[where f="(*)"] sum.cong refl)
        (simp add: image_atLeastZeroLessThan_int)
     also have "... = (\<Sum>x<m. \<omega>\<^sub>F(z*real x) - \<omega>\<^sub>F(z*(real (Suc x))))"
       by (subst sum.reindex, auto simp add:algebra_simps sum_distrib_left \<omega>\<^sub>F_simps)
     also have "... = \<omega>\<^sub>F (z * 0) - \<omega>\<^sub>F (z * m)"
       by (subst sum_lessThan_telescope') simp
     also have "... = \<omega>\<^sub>F (of_int 0) - \<omega>\<^sub>F (of_int 0)"
       by (intro arg_cong2[where f="(-)"] \<omega>\<^sub>F_cong) auto
     also have "... = 0"
       by simp
     finally have "(1- \<omega>\<^sub>F z) * ?L1 = 0" by simp
     moreover have "\<omega>\<^sub>F z \<noteq> 1" using \<omega>\<^sub>F_eq_1_iff False by simp
     hence "(1- \<omega>\<^sub>F z) \<noteq> 0" by simp
     ultimately have "?L1 = 0" by simp
     then show ?thesis using False by simp
   qed
 
   have 0:"g_inner (\<delta> v) (\<delta> w) = g_inner (FT (\<delta> v)) (FT (\<delta> w))/m^2" (is "?L1 = ?R1/_")
     if "v \<in> verts G" "w \<in> verts G" for v w
   proof -
     have "?R1=g_inner(\<lambda>x. \<omega>\<^sub>F(-(fst v *fst x +snd v * snd x)))(\<lambda>x. \<omega>\<^sub>F(-(fst w *fst x +snd w * snd x)))"
       using that by (intro g_inner_cong, auto simp add:FT_\<delta>)
     also have "...=(\<Sum>(x,y)\<in>{0..<int m}\<times>{0..<int m}. \<omega>\<^sub>F((fst w-fst v)*x)*\<omega>\<^sub>F((snd w - snd v)* y))"
       unfolding g_inner_def by (simp add:\<omega>\<^sub>F_simps algebra_simps case_prod_beta mgg_graph_def)
     also have "...=(\<Sum>x=0..<int m. \<Sum>y = 0..<int m. \<omega>\<^sub>F((fst w - fst v)*x)*\<omega>\<^sub>F((snd w - snd v) * y))"
       by (subst sum.cartesian_product[symmetric]) simp
     also have "...=(\<Sum>x=0..<int m. \<omega>\<^sub>F((fst w - fst v)*x))*(\<Sum>y = 0..<int m. \<omega>\<^sub>F((snd w - snd v) * y))"
       by (subst sum.swap) (simp add:sum_distrib_left sum_distrib_right)
-    also have "... = of_nat (m * of_bool(fst v mod m = fst w mod m)) * 
+    also have "... = of_nat (m * of_bool(fst v mod m = fst w mod m)) *
       of_nat (m * of_bool(snd v mod m = snd w mod m))"
-      using m_gt_0 unfolding 1 
-      by (intro arg_cong2[where f="(*)"] arg_cong[where f="of_bool"] 
+      using m_gt_0 unfolding 1
+      by (intro arg_cong2[where f="(*)"] arg_cong[where f="of_bool"]
           arg_cong[where f="of_nat"] refl) (auto simp add:algebra_simps cong:mod_diff_cong)
     also have "... = m^2 * of_bool(v = w)"
       using that by (auto simp add:prod_eq_iff mgg_graph_def power2_eq_square)
-    also have "... = m^2 * ?L1" 
+    also have "... = m^2 * ?L1"
       using that unfolding g_inner_def \<delta>_def by simp
     finally have "?R1 = m^2 * ?L1" by simp
     thus ?thesis using m_gt_0 by simp
   qed
 
   have "?L = g_inner (\<lambda>x. (\<Sum>v \<in> verts G. (f v) * \<delta> v x)) (\<lambda>x. (\<Sum>v \<in> verts G. (g v) * \<delta> v x))"
     unfolding \<delta>_def by (intro g_inner_cong) auto
   also have "... = (\<Sum>v\<in>verts G. (f v) * (\<Sum>w\<in>verts G. cnj (g w) * g_inner (\<delta> v) (\<delta> w)))"
     by (simp add:g_inner_simps g_inner_sum_left g_inner_sum_right)
   also have "... = (\<Sum>v\<in>verts G. (f v) * (\<Sum>w\<in>verts G. cnj (g w) * g_inner(FT (\<delta> v)) (FT (\<delta> w))))/m^2"
     by (simp add:0 sum_divide_distrib sum_distrib_left algebra_simps)
   also have "...=g_inner(\<lambda>x.(\<Sum>v\<in>verts G. (f v)*FT (\<delta> v) x))(\<lambda>x.(\<Sum>v\<in>verts G. (g v)*FT (\<delta> v) x))/m\<^sup>2"
     by (simp add:g_inner_simps g_inner_sum_left g_inner_sum_right)
   also have "...=g_inner(FT(\<lambda>x.(\<Sum>v\<in>verts G.(f v)*\<delta> v x)))(FT(\<lambda>x.(\<Sum>v\<in>verts G.(g v)*\<delta> v x)))/m\<^sup>2"
     by (intro g_inner_cong arg_cong2[where f="(/)"]) (simp_all add: FT_sum FT_scale)
   also have "... = g_inner (FT f) (FT g)/m^2 "
     unfolding \<delta>_def comp_def
     by (intro g_inner_cong arg_cong2[where f="(/)"] fun_cong[OF FT_cong]) auto
   finally show ?thesis by simp
 qed
 
 lemma plancharel:
   "(\<Sum>v \<in> verts G. norm (f v)^2) = (\<Sum>v \<in> verts G. norm (FT f v)^2)/m^2" (is "?L = ?R")
 proof -
   have "complex_of_real ?L = g_inner f f"
     by (simp flip:of_real_power add:complex_norm_square g_inner_def algebra_simps)
   also have "... = g_inner (FT f) (FT f) / m^2"
     by (subst parseval) simp
   also have "... = complex_of_real ?R"
     by (simp flip:of_real_power add:complex_norm_square g_inner_def algebra_simps) simp
   finally have "complex_of_real ?L = complex_of_real ?R" by simp
-  thus ?thesis 
+  thus ?thesis
     using of_real_eq_iff by blast
 qed
 
 lemma FT_swap:
   "FT (\<lambda>x. f (snd x, fst x)) (u,v) = FT f (v,u)"
 proof -
   have 0:"bij_betw (\<lambda>(x::int \<times> int). (snd x, fst x)) (verts G) (verts G)"
     by (intro bij_betwI[where g="(\<lambda>(x::int \<times> int). (snd x, fst x))"])
      (auto simp add:mgg_graph_def)
   show ?thesis
     unfolding FT_def
     by (subst g_inner_reindex[OF 0]) (simp add:algebra_simps)
 qed
 
 lemma mod_add_mult_eq:
   fixes a x y :: int
   shows "(a + x * (y mod m)) mod m = (a+x*y) mod m"
   using mod_add_cong mod_mult_right_eq by blast
 
 definition periodic where "periodic f = (\<forall>x y. f (x,y) = f (x mod int m, y mod int m))"
 
 lemma periodicD:
   assumes "periodic f"
   shows "f (x,y) = f (x mod m, y mod m)"
   using assms unfolding periodic_def by simp
 
 lemma periodic_comp:
   assumes "periodic f"
   shows "periodic (\<lambda>x. g (f x))"
   using assms unfolding periodic_def by simp
 
 lemma periodic_cong:
   fixes x y u v :: int
   assumes "periodic f"
-  assumes "x mod m = u mod m" "y mod m = v mod m" 
+  assumes "x mod m = u mod m" "y mod m = v mod m"
   shows "f (x,y) = f (u, v)"
   using periodicD[OF assms(1)] assms(2,3) by metis
 
 lemma periodic_FT: "periodic (FT f)"
 proof -
   have "FT f (x,y) = FT f (x mod m,y mod m)" for x y
-    unfolding FT_altdef by (intro g_inner_cong \<omega>\<^sub>F_cong ext) 
+    unfolding FT_altdef by (intro g_inner_cong \<omega>\<^sub>F_cong ext)
      (auto simp add:mod_simps cong:mod_add_cong)
-  thus ?thesis 
+  thus ?thesis
     unfolding periodic_def by simp
 qed
 
 lemma FT_sheer_aux:
   fixes u v c d :: int
-  assumes "periodic f" 
-  shows  "FT (\<lambda>x. f (fst x,snd x+c*fst x+d)) (u,v) = \<omega>\<^sub>F (d* v) * FT f (u-c* v,v)" 
+  assumes "periodic f"
+  shows  "FT (\<lambda>x. f (fst x,snd x+c*fst x+d)) (u,v) = \<omega>\<^sub>F (d* v) * FT f (u-c* v,v)"
     (is "?L = ?R")
 proof -
   define s where "s = (\<lambda>(x,y). (x, (y - c * x-d) mod m))"
   define s0 where "s0 = (\<lambda>(x,y). (x, (y-c*x) mod m))"
   define s1 where "s1 = (\<lambda>(x::int,y). (x, (y-d) mod m))"
 
   have 0:"bij_betw s0 (verts G) (verts G)"
     by (intro bij_betwI[where g="\<lambda>(x,y). (x,(y+c*x) mod m)"])
      (auto simp add:mgg_graph_def s0_def Pi_def mod_simps)
   have 1:"bij_betw s1 (verts G) (verts G)"
     by (intro bij_betwI[where g="\<lambda>(x,y). (x,(y+d) mod m)"])
      (auto simp add:mgg_graph_def s1_def Pi_def mod_simps)
   have 2: "s = (s1 \<circ> s0)"
     by (simp add:s1_def s0_def s_def comp_def mod_simps case_prod_beta ext)
   have 3:"bij_betw s (verts G) (verts G)"
     unfolding 2 using bij_betw_trans[OF 0 1] by simp
 
   have 4:"(snd (s x) + c * fst x + d) mod int m = snd x mod m" for x
     unfolding s_def by (simp add:case_prod_beta cong:mod_add_cong) (simp add:algebra_simps)
   have 5: "fst (s x) = fst x" for x
     unfolding s_def by (cases x, simp)
 
   have "?L = g_inner (\<lambda>x. f (fst x, snd x + c*fst x+d)) (\<lambda>x. \<omega>\<^sub>F (fst x*u + snd x* v))"
     unfolding FT_altdef by simp
   also have "... = g_inner (\<lambda>x. f (fst x, (snd x + c*fst x+d) mod m)) (\<lambda>x. \<omega>\<^sub>F (fst x*u + snd x* v))"
     by (intro g_inner_cong  periodic_cong[OF assms]) (auto simp add:algebra_simps)
   also have "... = g_inner (\<lambda>x. f (fst x, snd x mod m)) (\<lambda>x. \<omega>\<^sub>F (fst x*u+ snd (s x)* v))"
     by (subst g_inner_reindex[OF 3]) (simp add:4 5)
   also have "... =
     g_inner (\<lambda>x. f (fst x, snd x mod m)) (\<lambda>x. \<omega>\<^sub>F (fst x*u+ ((snd x-c*fst x-d) mod m)* v))"
     by (simp add:s_def case_prod_beta)
   also have "... = g_inner f (\<lambda>x. \<omega>\<^sub>F (fst x* (u-c * v) + snd x * v-d * v))"
-    by (intro g_inner_cong \<omega>\<^sub>F_cong) (auto simp add:mgg_graph_def algebra_simps mod_add_mult_eq) 
+    by (intro g_inner_cong \<omega>\<^sub>F_cong) (auto simp add:mgg_graph_def algebra_simps mod_add_mult_eq)
   also have "... = g_inner f (\<lambda>x. \<omega>\<^sub>F (-d* v)*\<omega>\<^sub>F (fst x*(u-c* v) + snd x * v))"
     by (simp add: \<omega>\<^sub>F_simps   algebra_simps)
   also have "... = \<omega>\<^sub>F (d* v)*g_inner f (\<lambda>x. \<omega>\<^sub>F (fst x*(u-c* v) + snd x * v))"
     by (simp add:g_inner_simps \<omega>\<^sub>F_simps)
   also have "... = ?R"
-    unfolding FT_altdef by simp 
+    unfolding FT_altdef by simp
   finally show ?thesis by simp
 qed
 
 lemma FT_sheer:
   fixes u v c d :: int
-  assumes "periodic f" 
-  shows 
+  assumes "periodic f"
+  shows
     "FT (\<lambda>x. f (fst x,snd x+c*fst x+d)) (u,v) = \<omega>\<^sub>F (d* v) * FT f (u-c* v,v)" (is "?A")
     "FT (\<lambda>x. f (fst x,snd x+c*fst x)) (u,v) = FT f (u-c* v,v)" (is "?B")
     "FT (\<lambda>x. f (fst x+c* snd x+d,snd x)) (u,v) = \<omega>\<^sub>F (d* u) * FT f (u,v-c*u)" (is "?C")
     "FT (\<lambda>x. f (fst x+c* snd x,snd x)) (u,v) = FT f (u,v-c*u)" (is "?D")
 proof -
-  have 1: "periodic (\<lambda>x. f (snd x, fst x))" 
+  have 1: "periodic (\<lambda>x. f (snd x, fst x))"
     using assms unfolding periodic_def by simp
 
   have 0:"\<omega>\<^sub>F 0 = 1"
     unfolding \<omega>\<^sub>F_def by simp
   show ?A
     using FT_sheer_aux[OF assms] by simp
   show ?B
     using 0 FT_sheer_aux[OF assms, where d="0"] by simp
   show ?C
     using FT_sheer_aux[OF 1] by (subst (1 2) FT_swap[symmetric], simp)
   show ?D
     using 0 FT_sheer_aux[OF 1, where d="0"] by (subst (1 2) FT_swap[symmetric], simp)
 qed
 
 definition T\<^sub>1 :: "int \<times> int \<Rightarrow> int \<times> int" where "T\<^sub>1 x = ((fst x + 2 * snd x) mod m, snd x)"
 definition S\<^sub>1 :: "int \<times> int \<Rightarrow> int \<times> int" where "S\<^sub>1 x = ((fst x - 2 * snd x) mod m, snd x)"
 definition T\<^sub>2 :: "int \<times> int \<Rightarrow> int \<times> int" where "T\<^sub>2 x = (fst x, (snd x + 2 * fst x) mod m)"
 definition S\<^sub>2 :: "int \<times> int \<Rightarrow> int \<times> int" where "S\<^sub>2 x = (fst x, (snd x - 2 * fst x) mod m)"
 
-definition \<gamma>_aux :: "int \<times> int \<Rightarrow> real \<times> real" 
+definition \<gamma>_aux :: "int \<times> int \<Rightarrow> real \<times> real"
     where "\<gamma>_aux x = (\<bar>fst x/m-1/2\<bar>,\<bar>snd x/m-1/2\<bar>)"
 
 definition compare :: "real \<times> real \<Rightarrow> real \<times> real \<Rightarrow> bool"
   where "compare x y = (fst x \<le> fst y \<and> snd x \<le> snd y \<and> x \<noteq> y)"
 
-text \<open>The value here is different from the value in the source material. This is because the proof 
+text \<open>The value here is different from the value in the source material. This is because the proof
 in Hoory~\cite[\S 8]{hoory2006} only establishes the bound $\frac{73}{80}$ while this formalization
 establishes the improved bound of $\frac{5}{8} \sqrt 2$.\<close>
 
-definition \<alpha> :: real where "\<alpha> = sqrt 2" 
+definition \<alpha> :: real where "\<alpha> = sqrt 2"
 
-lemma \<alpha>_inv: "1/\<alpha> = \<alpha>/2" 
+lemma \<alpha>_inv: "1/\<alpha> = \<alpha>/2"
   unfolding \<alpha>_def by (simp add: real_div_sqrt)
 
-definition \<gamma> :: "int \<times> int \<Rightarrow> int \<times> int \<Rightarrow> real" 
+definition \<gamma> :: "int \<times> int \<Rightarrow> int \<times> int \<Rightarrow> real"
   where "\<gamma> x y = (if compare (\<gamma>_aux x) (\<gamma>_aux y) then \<alpha> else (if compare  (\<gamma>_aux y) (\<gamma>_aux x) then (1 / \<alpha>) else 1))"
 
-lemma \<gamma>_sym: "\<gamma> x y * \<gamma> y x = 1" 
+lemma \<gamma>_sym: "\<gamma> x y * \<gamma> y x = 1"
   unfolding \<gamma>_def \<alpha>_def compare_def by (auto simp add:prod_eq_iff)
 
 lemma \<gamma>_nonneg: "\<gamma> x y \<ge> 0"
   unfolding \<gamma>_def \<alpha>_def by auto
 
 definition \<tau> :: "int \<Rightarrow> real" where "\<tau> x = \<bar>cos(pi*x/m)\<bar>"
 
-definition \<gamma>' :: "real \<Rightarrow> real \<Rightarrow> real" 
+definition \<gamma>' :: "real \<Rightarrow> real \<Rightarrow> real"
   where "\<gamma>' x y = (if abs (x - 1/2) < abs (y - 1/2) then \<alpha> else (if abs (x-1/2) > abs (y-1/2) then (1 / \<alpha>) else 1))"
 
 definition \<phi> :: "real \<Rightarrow> real \<Rightarrow> real"
   where "\<phi> x y = \<gamma>' y (frac(y-2*x))+\<gamma>' y (frac (y+2*x))"
 
 lemma \<gamma>'_cases:
   "abs (x-1/2) = abs (y-1/2) \<Longrightarrow> \<gamma>' x y = 1"
   "abs (x-1/2) > abs (y-1/2) \<Longrightarrow> \<gamma>' x y = 1/\<alpha>"
   "abs (x-1/2) < abs (y-1/2) \<Longrightarrow> \<gamma>' x y = \<alpha>"
   unfolding \<gamma>'_def by auto
 
 lemma if_cong_direct:
   assumes "a = b"
   assumes "c = d'"
   assumes "e = f"
   shows "(if a then c else e) = (if b then d' else f)"
   using assms by (intro if_cong) auto
 
 lemma \<gamma>'_cong:
   assumes "abs (x-1/2) = abs (u-1/2)"
   assumes "abs (y-1/2) = abs (v-1/2)"
   shows "\<gamma>' x y = \<gamma>' u v"
   unfolding \<gamma>'_def
   using assms by (intro if_cong_direct refl) auto
 
 lemma add_swap_cong:
   fixes x y u v :: "'a :: ab_semigroup_add"
   assumes "x = y" "u = v"
   shows "x + u = v + y"
   using assms by (simp add:algebra_simps)
 
 lemma frac_cong:
   fixes x y :: real
   assumes "x - y \<in> \<int>"
   shows "frac x = frac y"
 proof -
   obtain k where x_eq: "x = y + of_int k"
     using Ints_cases[OF assms] by (metis add_minus_cancel uminus_add_conv_diff)
   thus ?thesis
     unfolding x_eq  unfolding frac_def by simp
 qed
 
 lemma frac_expand:
   fixes x :: real
   shows "frac x = (if x < (-1) then (x-\<lfloor>x\<rfloor>) else (if x < 0 then (x+1) else (if x < 1 then x else (if x < 2 then (x-1) else  (x-\<lfloor>x\<rfloor>)))))"
 proof -
   have "real_of_int y = -1 \<longleftrightarrow> y= -1" for y
     by auto
   thus ?thesis
-    unfolding frac_def  by (auto simp add:not_less floor_eq_iff) 
+    unfolding frac_def  by (auto simp add:not_less floor_eq_iff)
 qed
 
 lemma one_minus_frac:
   fixes x :: real
   shows "1 - frac x = (if x \<in> \<int> then 1 else frac (-x))"
   unfolding frac_neg by simp
 
 lemma abs_rev_cong:
   fixes x y :: real
   assumes "x = - y"
   shows "abs x = abs y"
   using assms by simp
 
 lemma cos_pi_ge_0:
   assumes "x \<in>{-1/2.. 1/2}"
   shows "cos (pi * x) \<ge> 0"
 proof -
   have "pi * x \<in> ((*) pi ` {-1/2..1/2})"
     by (intro imageI assms)
-  also have "... =  {-pi/2..pi/2}" 
+  also have "... =  {-pi/2..pi/2}"
     by (subst image_mult_atLeastAtMost[OF pi_gt_zero])  simp
   finally have "pi * x \<in> {-pi/2..pi/2}" by simp
   thus ?thesis
-    by (intro cos_ge_zero) auto 
+    by (intro cos_ge_zero) auto
 qed
 
 text \<open>The following is the first step in establishing Eq. 15 in Hoory et al.~\cite[\S 8]{hoory2006}.
 Afterwards using various symmetries (diagonal, x-axis, y-axis) the result will follow for the entire
 square $[0,1] \times [0,1]$.\<close>
 
 lemma fun_bound_real_3:
   assumes "0 \<le> x"  "x \<le> y" "y \<le> 1/2" "(x,y) \<noteq> (0,0)"
   shows "\<bar>cos(pi*x)\<bar>*\<phi> x y + \<bar>cos(pi*y)\<bar>*\<phi> y x \<le> 2.5 * sqrt 2" (is "?L \<le> ?R")
 proof -
   have apx:"4 \<le> 5 * sqrt (2::real)" "8 * cos (pi / 4) \<le> 5 * sqrt (2::real)"
     by (approximation 5)+
 
-  have "cos (pi * x) \<ge> 0" 
+  have "cos (pi * x) \<ge> 0"
     using assms(1,2,3)  by (intro cos_pi_ge_0) simp
-  moreover have "cos (pi * y) \<ge> 0" 
+  moreover have "cos (pi * y) \<ge> 0"
     using assms(1,2,3)  by (intro cos_pi_ge_0) simp
   ultimately have 0:"?L = cos(pi*x)*\<phi> x y + cos(pi*y)*\<phi> y x"  (is "_ = ?T")
     by simp
 
   consider (a) "x+y < 1/2" | (b) "y = 1/2- x" | (c) "x+y > 1/2" by argo
   hence "?T \<le> 2.5 * sqrt 2" (is "?T \<le> ?R")
   proof (cases)
     case a
-    consider 
-      (1) "x < y" "x > 0" | 
-      (2) "x=0" "y < 1/2" | 
-      (3) "y=x" "x > 0" 
+    consider
+      (1) "x < y" "x > 0" |
+      (2) "x=0" "y < 1/2" |
+      (3) "y=x" "x > 0"
       using assms(1,2,3,4) a by fastforce
-    thus ?thesis 
+    thus ?thesis
     proof (cases)
       case 1
       have "\<phi> x y = \<alpha> + 1/\<alpha>"
         unfolding \<phi>_def using 1 a
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       moreover have "\<phi> y x = 1/\<alpha> + 1/\<alpha>"
         unfolding \<phi>_def using 1 a
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       ultimately have "?T = cos (pi * x) * (\<alpha> + 1/\<alpha>) + cos (pi * y) * (1/\<alpha> + 1/\<alpha>)"
         by simp
       also have "... \<le> 1 * (\<alpha> + 1/\<alpha>) + 1 * (1/\<alpha> + 1/\<alpha>)"
         unfolding \<alpha>_def by (intro add_mono mult_right_mono) auto
       also have "... = ?R"
-        unfolding \<alpha>_def by (simp add:divide_simps) 
+        unfolding \<alpha>_def by (simp add:divide_simps)
       finally show ?thesis by simp
     next
       case 2
-      have y_range: "y \<in> {0<..<1/2}" 
+      have y_range: "y \<in> {0<..<1/2}"
         using assms 2 by simp
       have "\<phi> 0 y = 1 + 1"
         unfolding \<phi>_def using y_range
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
-      moreover 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
+      moreover
       have "\<bar>x\<bar> * 2 < 1 \<longleftrightarrow> x < 1/2 \<and> -x < 1/2" for x :: real by auto
       hence "\<phi> y 0 = 1 / \<alpha> + 1/ \<alpha>"
         unfolding \<phi>_def using y_range
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (simp_all add:frac_expand)
       ultimately have "?T = 2 + cos (pi * y) * (2 / \<alpha>)"
         unfolding 2 by simp
       also have "... \<le> 2 + 1 * (2 / \<alpha>)"
         unfolding \<alpha>_def by (intro add_mono mult_right_mono) auto
-      also have "... \<le> ?R" 
+      also have "... \<le> ?R"
         unfolding \<alpha>_def by (approximation 10)
       finally show ?thesis by simp
     next
       case 3
       have "\<phi> x y = 1 + 1/\<alpha>"
         unfolding \<phi>_def using 3 a
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       moreover have "\<phi> y x = 1 + 1/\<alpha>"
         unfolding \<phi>_def using 3 a
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       ultimately have "?T = cos (pi * x) * (2*(1+1/ \<alpha>))"
         unfolding 3 by simp
       also have "... \<le> 1 * (2*(1+1/ \<alpha>))"
         unfolding \<alpha>_def by (intro mult_right_mono) auto
       also have "... \<le> ?R"
         unfolding \<alpha>_def by (approximation 10)
       finally show ?thesis by simp
     qed
   next
     case b
     have x_range: "x \<in> {0..1/4}"
       using assms b by simp
     then consider (1) "x = 0" | (2) "x = 1/4" | (3) "x \<in> {0<..<1/4}" by fastforce
-    thus ?thesis 
+    thus ?thesis
     proof (cases)
       case 1
       hence y_eq: "y = 1/2" using b by simp
-      show ?thesis using apx unfolding 1 y_eq \<phi>_def by (simp add:\<gamma>'_def \<alpha>_def frac_def) 
+      show ?thesis using apx unfolding 1 y_eq \<phi>_def by (simp add:\<gamma>'_def \<alpha>_def frac_def)
     next
       case 2
       hence y_eq: "y = 1/4" using b by simp
       show ?thesis using apx unfolding y_eq 2 \<phi>_def by (simp add:\<gamma>'_def frac_def)
     next
       case 3
       have "\<phi> x y = \<alpha> + 1"
         unfolding \<phi>_def b using 3
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       moreover have "\<phi> y x = 1/\<alpha> + 1"
         unfolding \<phi>_def b using 3
-        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand) 
+        by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       ultimately have "?T = cos (pi * x) * (\<alpha> + 1) + cos (pi * (1 / 2 - x)) * (1/\<alpha> + 1)"
         unfolding b by simp
       also have "... \<le> ?R"
         unfolding \<alpha>_def using x_range
         by (approximation 10 splitting: x=10)
       finally show ?thesis by simp
     qed
   next
     case c
-    consider 
-      (1) "x < y" "y < 1/2" | 
-      (2) "y=1/2" "x < 1/2" | 
-      (3) "y=x" "x < 1/2" | 
+    consider
+      (1) "x < y" "y < 1/2" |
+      (2) "y=1/2" "x < 1/2" |
+      (3) "y=x" "x < 1/2" |
       (4) "x=1/2" "y =1/2"
       using assms(2,3) c  by fastforce
     thus ?thesis
     proof (cases)
       case 1
       define \<theta> :: real where "\<theta> = arcsin (6 / 10)"
       have "cos \<theta> = sqrt (1-0.6^2)"
         unfolding \<theta>_def by (intro cos_arcsin) auto
       also have "... = sqrt ( 0.8^2)"
         by (intro arg_cong[where f="sqrt"]) (simp add:power2_eq_square)
       also have "... = 0.8" by simp
       finally have cos_\<theta>: "cos \<theta> = 0.8" by simp
       have sin_\<theta>: "sin \<theta> = 0.6"
         unfolding \<theta>_def by simp
 
       have "\<phi> x y = \<alpha> + \<alpha>"
         unfolding \<phi>_def using c 1
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       moreover have "\<phi> y x = 1/\<alpha> + \<alpha>"
         unfolding \<phi>_def using c 1
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       ultimately have "?T = cos (pi * x) * (2 * \<alpha>) + cos (pi * y) * (\<alpha> + 1 / \<alpha>)"
         by simp
       also have "... \<le> cos (pi * (1/2-y)) * (2*\<alpha>) + cos (pi * y) * (\<alpha>+1 / \<alpha>)"
         unfolding \<alpha>_def using assms(1,2,3) c
         by (intro add_mono mult_right_mono order.refl iffD2[OF cos_mono_le_eq]) auto
       also have "... = (2.5*\<alpha>)* (sin (pi * y) * 0.8 + cos (pi * y) * 0.6)"
         unfolding sin_cos_eq \<alpha>_inv by (simp add:algebra_simps)
       also have "... = (2.5*\<alpha>)* sin(pi*y + \<theta>)"
         unfolding sin_add cos_\<theta> sin_\<theta>
         by (intro arg_cong2[where f="(*)"] arg_cong2[where f="(+)"] refl)
       also have "... \<le> (?R) * 1"
         unfolding \<alpha>_def by (intro mult_left_mono) auto
       finally show ?thesis by simp
     next
       case 2
       have x_range: "x > 0" "x < 1/2"
         using c 2 by auto
       have "\<phi> x y = \<alpha> + \<alpha>"
         unfolding \<phi>_def 2 using x_range
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       moreover have "\<phi> y x = 1 + 1"
         unfolding \<phi>_def 2 using x_range
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       ultimately have "?T = cos (pi * x) * (2*\<alpha>)"
         unfolding 2 by simp
       also have "... \<le> 1 * (2* sqrt 2)"
         unfolding \<alpha>_def by (intro mult_right_mono) auto
-      also have "... \<le> ?R" 
+      also have "... \<le> ?R"
         by (approximation 5)
       finally show ?thesis by simp
     next
       case 3
       have x_range: "x \<in> {1/4..1/2}" using 3 c by simp
       hence cos_bound: "cos (pi * x) \<le> 0.71"
         by (approximation 10)
       have "\<phi> x y = 1+\<alpha>"
         unfolding \<phi>_def 3 using 3 c
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       moreover have "\<phi> y x = 1+\<alpha>"
         unfolding \<phi>_def 3 using 3 c
         by (intro arg_cong2[where f="(+)"] \<gamma>'_cases) (auto simp add:frac_expand)
       ultimately have "?T = 2 * cos (pi * x) * (1+\<alpha>)"
         unfolding 3 by simp
       also have "... \<le> 2 * 0.71 * (1+sqrt 2)"
         unfolding \<alpha>_def by (intro mult_right_mono mult_left_mono cos_bound) auto
       also have "... \<le> ?R"
         by (approximation 6)
       finally show ?thesis by simp
-    next 
+    next
       case 4
       show ?thesis  unfolding 4 by simp
     qed
   qed
   thus ?thesis using 0 by simp
 qed
 
 text \<open>Extend to square $[0, \frac{1}{2}] \times [0,\frac{1}{2}]$ using symmetry around x=y axis.\<close>
 
 lemma fun_bound_real_2:
   assumes "x \<in> {0..1/2}" "y \<in> {0..1/2}" "(x,y) \<noteq> (0,0)"
   shows "\<bar>cos(pi*x)\<bar>*\<phi> x y + \<bar>cos(pi*y)\<bar>*\<phi> y x \<le> 2.5 * sqrt 2"  (is "?L \<le> ?R")
 proof (cases "y < x")
   case True
   have "?L = \<bar>cos(pi*y)\<bar>*\<phi> y x + \<bar>cos(pi*x)\<bar>*\<phi> x y"
     by simp
   also have "... \<le> ?R"
     using True assms
     by (intro fun_bound_real_3)  auto
   finally show ?thesis by simp
 next
   case False
   then show ?thesis using assms
     by (intro fun_bound_real_3) auto
 qed
 
 text \<open>Extend to $x > \frac{1}{2}$ using symmetry around $x=\frac{1}{2}$ axis.\<close>
 
 lemma fun_bound_real_1:
   assumes "x \<in> {0..<1}" "y \<in> {0..1/2}" "(x,y) \<noteq> (0,0)"
   shows "\<bar>cos(pi*x)\<bar>*\<phi> x y + \<bar>cos(pi*y)\<bar>*\<phi> y x \<le> 2.5 * sqrt 2" (is "?L \<le> ?R")
 proof (cases "x > 1/2")
   case True
   define x' where "x' = 1-x"
 
   have "\<bar>frac (x - 2 * y) - 1 / 2\<bar> = \<bar>frac (1 - x + 2 * y) - 1 / 2\<bar>"
   proof (cases "x - 2 * y \<in> \<int>")
     case True
-    then obtain k where x_eq: "x = 2*y + of_int k" using Ints_cases[OF True] 
+    then obtain k where x_eq: "x = 2*y + of_int k" using Ints_cases[OF True]
       by (metis add_minus_cancel uminus_add_conv_diff)
     show ?thesis unfolding x_eq frac_def by simp
   next
     case False
-    hence "1 - x + 2 * y \<notin> \<int>" 
+    hence "1 - x + 2 * y \<notin> \<int>"
       using Ints_1 Ints_diff by fastforce
-    thus ?thesis 
+    thus ?thesis
       by (intro abs_rev_cong) (auto intro:frac_cong simp:one_minus_frac)
   qed
 
-  moreover have "\<bar>frac (x + 2 * y) - 1 / 2\<bar> = \<bar>frac (1 - x - 2 * y) - 1 / 2\<bar>" 
+  moreover have "\<bar>frac (x + 2 * y) - 1 / 2\<bar> = \<bar>frac (1 - x - 2 * y) - 1 / 2\<bar>"
   proof (cases "x + 2 * y \<in> \<int>")
     case True
-    then obtain k where x_eq: "x = of_int k - 2*y" using Ints_cases[OF True] 
+    then obtain k where x_eq: "x = of_int k - 2*y" using Ints_cases[OF True]
       by (metis add.right_neutral add_diff_eq cancel_comm_monoid_add_class.diff_cancel)
     show ?thesis unfolding x_eq frac_def by simp
   next
     case False
-    hence "1 - x - 2 * y \<notin> \<int>" 
+    hence "1 - x - 2 * y \<notin> \<int>"
       using Ints_1 Ints_diff by fastforce
-    thus ?thesis 
+    thus ?thesis
       by (intro abs_rev_cong) (auto intro:frac_cong simp:one_minus_frac)
   qed
-  ultimately have "\<phi> y x = \<phi> y x'" 
-    unfolding \<phi>_def  x'_def by (intro \<gamma>'_cong add_swap_cong) simp_all 
+  ultimately have "\<phi> y x = \<phi> y x'"
+    unfolding \<phi>_def  x'_def by (intro \<gamma>'_cong add_swap_cong) simp_all
 
   moreover have "\<phi> x y = \<phi> x' y"
-    unfolding \<phi>_def x'_def  
-    by (intro \<gamma>'_cong add_swap_cong refl arg_cong[where f="(\<lambda>x. abs (x-1/2))"] frac_cong) 
+    unfolding \<phi>_def x'_def
+    by (intro \<gamma>'_cong add_swap_cong refl arg_cong[where f="(\<lambda>x. abs (x-1/2))"] frac_cong)
      (simp_all add:algebra_simps)
 
   moreover have "\<bar>cos(pi*x)\<bar> = \<bar>cos(pi*x')\<bar>"
     unfolding x'_def by (intro abs_rev_cong) (simp add:algebra_simps)
 
   ultimately have "?L = \<bar>cos(pi*x')\<bar>*\<phi> x' y + \<bar>cos(pi*y)\<bar>*\<phi> y x'"
     by simp
   also have "... \<le> ?R"
     using assms True by (intro fun_bound_real_2) (auto simp add:x'_def)
   finally show ?thesis by simp
 next
   case False
-  thus ?thesis using assms fun_bound_real_2 by simp 
+  thus ?thesis using assms fun_bound_real_2 by simp
 qed
 
 text \<open>Extend to $y > \frac{1}{2}$ using symmetry around $y=\frac{1}{2}$ axis.\<close>
 
 lemma fun_bound_real:
   assumes "x \<in> {0..<1}" "y \<in> {0..<1}" "(x,y) \<noteq> (0,0)"
   shows "\<bar>cos(pi*x)\<bar>*\<phi> x y + \<bar>cos(pi*y)\<bar>*\<phi> y x \<le> 2.5 * sqrt 2"  (is "?L \<le> ?R")
 proof (cases "y > 1/2")
   case True
   define y' where "y' = 1-y"
 
   have "\<bar>frac (y - 2 * x) - 1 / 2\<bar> = \<bar>frac (1 - y + 2 * x) - 1 / 2\<bar>"
   proof (cases "y - 2 * x \<in> \<int>")
     case True
-    then obtain k where y_eq: "y = 2*x + of_int k" using Ints_cases[OF True] 
+    then obtain k where y_eq: "y = 2*x + of_int k" using Ints_cases[OF True]
       by (metis add_minus_cancel uminus_add_conv_diff)
     show ?thesis unfolding y_eq frac_def by simp
   next
     case False
-    hence "1 - y + 2 * x \<notin> \<int>" 
+    hence "1 - y + 2 * x \<notin> \<int>"
       using Ints_1 Ints_diff by fastforce
-    thus ?thesis 
+    thus ?thesis
       by (intro abs_rev_cong) (auto intro:frac_cong simp:one_minus_frac)
   qed
 
-  moreover have "\<bar>frac (y + 2 * x) - 1 / 2\<bar> = \<bar>frac (1 - y - 2 * x) - 1 / 2\<bar>" 
+  moreover have "\<bar>frac (y + 2 * x) - 1 / 2\<bar> = \<bar>frac (1 - y - 2 * x) - 1 / 2\<bar>"
   proof (cases "y + 2 * x \<in> \<int>")
     case True
-    then obtain k where y_eq: "y = of_int k - 2*x" using Ints_cases[OF True] 
+    then obtain k where y_eq: "y = of_int k - 2*x" using Ints_cases[OF True]
       by (metis add.right_neutral add_diff_eq cancel_comm_monoid_add_class.diff_cancel)
     show ?thesis unfolding y_eq frac_def by simp
   next
     case False
-    hence "1 - y - 2 * x \<notin> \<int>" 
+    hence "1 - y - 2 * x \<notin> \<int>"
       using Ints_1 Ints_diff by fastforce
-    thus ?thesis 
+    thus ?thesis
       by (intro abs_rev_cong) (auto intro:frac_cong simp:one_minus_frac)
   qed
-  ultimately have "\<phi> x y = \<phi> x y'" 
+  ultimately have "\<phi> x y = \<phi> x y'"
     unfolding \<phi>_def  y'_def  by (intro \<gamma>'_cong add_swap_cong) simp_all
 
   moreover have "\<phi> y x = \<phi> y' x"
-    unfolding \<phi>_def y'_def  
-    by (intro \<gamma>'_cong add_swap_cong refl arg_cong[where f="(\<lambda>x. abs (x-1/2))"] frac_cong) 
+    unfolding \<phi>_def y'_def
+    by (intro \<gamma>'_cong add_swap_cong refl arg_cong[where f="(\<lambda>x. abs (x-1/2))"] frac_cong)
      (simp_all add:algebra_simps)
 
   moreover have "\<bar>cos(pi*y)\<bar> = \<bar>cos(pi*y')\<bar>"
     unfolding y'_def by (intro abs_rev_cong) (simp add:algebra_simps)
 
   ultimately have "?L = \<bar>cos(pi*x)\<bar>*\<phi> x y' + \<bar>cos(pi*y')\<bar>*\<phi> y' x"
     by simp
   also have "... \<le> ?R"
     using assms True by (intro fun_bound_real_1) (auto simp add:y'_def)
   finally show ?thesis by simp
 next
   case False
-  thus ?thesis using assms fun_bound_real_1 by simp 
+  thus ?thesis using assms fun_bound_real_1 by simp
 qed
 
-lemma mod_to_frac: 
+lemma mod_to_frac:
   fixes x :: int
   shows "real_of_int (x mod m) = m * frac (x/m)" (is "?L = ?R")
 proof -
   obtain y where y_def: "x mod m = x + int m* y"
-    by (metis mod_eqE mod_mod_trivial) 
+    by (metis mod_eqE mod_mod_trivial)
 
   have 0: "x mod int m < m" "x mod int m \<ge> 0"
     using m_gt_0 by auto
 
   have "?L = real m * (of_int (x mod m) / m )"
     using m_gt_0 by (simp add:algebra_simps)
   also have "... = real m * frac (of_int (x mod m) / m)"
     using 0 by (subst iffD2[OF frac_eq]) auto
   also have "... = real m * frac (x / m + y)"
     unfolding y_def using m_gt_0 by (simp add:divide_simps mult.commute)
-  also have "... = ?R" 
+  also have "... = ?R"
     unfolding frac_def by simp
   finally show ?thesis by simp
 qed
 
 lemma fun_bound:
   assumes "v \<in> verts G" "v \<noteq> (0,0)"
-  shows "\<tau>(fst v)*(\<gamma> v (S\<^sub>2 v)+\<gamma> v (T\<^sub>2 v))+\<tau>(snd v)*(\<gamma> v (S\<^sub>1 v)+\<gamma> v (T\<^sub>1 v)) \<le> 2.5 * sqrt 2" 
+  shows "\<tau>(fst v)*(\<gamma> v (S\<^sub>2 v)+\<gamma> v (T\<^sub>2 v))+\<tau>(snd v)*(\<gamma> v (S\<^sub>1 v)+\<gamma> v (T\<^sub>1 v)) \<le> 2.5 * sqrt 2"
     (is "?L \<le> ?R")
 proof -
   obtain x y where v_def: "v = (x,y)" by (cases v) auto
   define x' where "x' = x/real m"
   define y' where "y' = y/real m"
 
   have 0:"\<gamma> v (S\<^sub>1 v) = \<gamma>' x' (frac(x'-2*y'))"
     unfolding \<gamma>_def \<gamma>'_def compare_def v_def \<gamma>_aux_def T\<^sub>1_def S\<^sub>1_def x'_def y'_def using m_gt_0
-    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps) 
+    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps)
   have 1:"\<gamma> v (T\<^sub>1 v) = \<gamma>' x' (frac(x'+2*y'))"
     unfolding \<gamma>_def \<gamma>'_def compare_def v_def \<gamma>_aux_def T\<^sub>1_def x'_def y'_def using m_gt_0
-    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps) 
+    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps)
   have 2:"\<gamma> v (S\<^sub>2 v) = \<gamma>' y' (frac(y'-2*x'))"
     unfolding \<gamma>_def \<gamma>'_def compare_def v_def \<gamma>_aux_def S\<^sub>2_def x'_def y'_def using m_gt_0
-    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps) 
+    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps)
   have 3:"\<gamma> v (T\<^sub>2 v) = \<gamma>' y' (frac(y'+2*x'))"
     unfolding \<gamma>_def \<gamma>'_def compare_def v_def \<gamma>_aux_def T\<^sub>2_def x'_def y'_def using m_gt_0
-    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps) 
+    by (intro if_cong_direct refl) (auto simp add:case_prod_beta mod_to_frac divide_simps)
   have 4: "\<tau> (fst v)  = \<bar>cos(pi*x')\<bar>" "\<tau> (snd v)  = \<bar>cos(pi*y')\<bar>"
     unfolding \<tau>_def v_def x'_def y'_def by auto
 
   have "x \<in> {0..<int m}" "y \<in> {0..<int m}" "(x,y) \<noteq> (0,0)"
     using assms  unfolding v_def mgg_graph_def by auto
-  hence 5:"x' \<in> {0..<1}" "y' \<in> {0..<1}" "(x',y') \<noteq> (0,0)" 
+  hence 5:"x' \<in> {0..<1}" "y' \<in> {0..<1}" "(x',y') \<noteq> (0,0)"
     unfolding x'_def y'_def by auto
 
   have "?L = \<bar>cos(pi*x')\<bar>*\<phi> x' y' + \<bar>cos(pi*y')\<bar>*\<phi> y' x'"
     unfolding 0 1 2 3 4 \<phi>_def by simp
   also have "... \<le> ?R"
-    by (intro fun_bound_real 5) 
+    by (intro fun_bound_real 5)
   finally show ?thesis by simp
 qed
 
 text \<open>Equation 15 in Proof of Theorem 8.8\<close>
 
 lemma hoory_8_8:
   fixes f :: "int \<times> int \<Rightarrow> real"
   assumes "\<And>x. f x \<ge> 0"
   assumes "f (0,0) = 0"
   assumes "periodic f"
   shows "g_inner f (\<lambda>x. f(S\<^sub>2 x)*\<tau> (fst x)+f(S\<^sub>1 x)*\<tau> (snd x))\<le>1.25* sqrt 2*g_norm f^2"
     (is "?L \<le> ?R")
 proof -
   have 0: "2 * f x * f y \<le> \<gamma> x y * f x^2 + \<gamma> y x * f y^2" (is "?L1 \<le> ?R1") for x y
-  proof - 
+  proof -
     have "0 \<le> ((sqrt (\<gamma> x y) * f x) - (sqrt (\<gamma> y x) * f y))^2"
       by simp
     also have "... = ?R1 - 2 * (sqrt (\<gamma> x y) * f x) * (sqrt (\<gamma> y x) * f y)"
       unfolding power2_diff using \<gamma>_nonneg assms(1)
       by (intro arg_cong2[where f="(-)"] arg_cong2[where f="(+)"]) (auto simp add: power2_eq_square)
     also have "... = ?R1 -2 * sqrt (\<gamma> x y * \<gamma> y x) * f x * f y"
       unfolding real_sqrt_mult by simp
     also have "... = ?R1 - ?L1"
       unfolding \<gamma>_sym by simp
     finally have "0 \<le> ?R1 - ?L1" by simp
     thus ?thesis by simp
   qed
 
   have [simp]: "fst (S\<^sub>2 x) = fst x"  "snd (S\<^sub>1 x) = snd x" for x
     unfolding S\<^sub>1_def S\<^sub>2_def by auto
 
   have S_2_inv [simp]: "T\<^sub>2 (S\<^sub>2 x) = x" if "x \<in> verts G" for x
-    using that unfolding T\<^sub>2_def S\<^sub>2_def mgg_graph_def 
+    using that unfolding T\<^sub>2_def S\<^sub>2_def mgg_graph_def
     by (cases x,simp add:mod_simps)
   have S_1_inv [simp]: "T\<^sub>1 (S\<^sub>1 x) = x" if "x \<in> verts G" for x
-    using that unfolding T\<^sub>1_def S\<^sub>1_def mgg_graph_def 
+    using that unfolding T\<^sub>1_def S\<^sub>1_def mgg_graph_def
     by (cases x,simp add:mod_simps)
 
   have S2_inj: "inj_on S\<^sub>2 (verts G)"
     using S_2_inv by (intro inj_on_inverseI[where g="T\<^sub>2"])
   have S1_inj: "inj_on S\<^sub>1 (verts G)"
     using S_1_inv by (intro inj_on_inverseI[where g="T\<^sub>1"])
 
   have "S\<^sub>2 ` verts G \<subseteq> verts G"
     unfolding mgg_graph_def S\<^sub>2_def
     by (intro image_subsetI)  auto
-  hence S2_ran: "S\<^sub>2 ` verts G = verts G" 
+  hence S2_ran: "S\<^sub>2 ` verts G = verts G"
     by (intro card_subset_eq card_image S2_inj) auto
 
   have "S\<^sub>1 ` verts G \<subseteq> verts G"
     unfolding mgg_graph_def S\<^sub>1_def
     by (intro image_subsetI)  auto
   hence S1_ran: "S\<^sub>1 ` verts G = verts G"
-    by (intro card_subset_eq card_image S1_inj) auto 
+    by (intro card_subset_eq card_image S1_inj) auto
 
   have 2: "g v * f v^2 \<le> 2.5 * sqrt 2 * f v^2" if "g v \<le> 2.5 * sqrt 2 \<or> v = (0,0)" for v g
   proof (cases "v=(0,0)")
     case True
     then show ?thesis using assms(2) by simp
   next
     case False
     then show ?thesis using that by (intro mult_right_mono) auto
   qed
 
   have "2*?L=(\<Sum>v\<in>verts G. \<tau>(fst v)*(2*f v *f(S\<^sub>2 v)))+(\<Sum>v\<in>verts G. \<tau>(snd v) * (2 * f v * f (S\<^sub>1 v)))"
     unfolding g_inner_def by (simp add: algebra_simps sum_distrib_left sum.distrib)
   also have "... \<le>
     (\<Sum>v\<in>verts G. \<tau>(fst v)*(\<gamma> v (S\<^sub>2 v) * f v^2 + \<gamma> (S\<^sub>2 v) v * f(S\<^sub>2 v)^2))+
     (\<Sum>v\<in>verts G. \<tau>(snd v)*(\<gamma> v (S\<^sub>1 v) * f v^2 + \<gamma> (S\<^sub>1 v) v * f(S\<^sub>1 v)^2))"
     unfolding \<tau>_def by (intro add_mono sum_mono mult_left_mono 0) auto
-  also have "... = 
+  also have "... =
     (\<Sum>v\<in>verts G. \<tau>(fst v)*\<gamma> v (S\<^sub>2 v)*f v^2)+(\<Sum>v\<in>verts G. \<tau>(fst v) * \<gamma> (S\<^sub>2 v) v * f(S\<^sub>2 v)^2)+
     (\<Sum>v\<in>verts G. \<tau>(snd v)*\<gamma> v (S\<^sub>1 v)*f v^2)+(\<Sum>v\<in>verts G. \<tau>(snd v) * \<gamma> (S\<^sub>1 v) v * f(S\<^sub>1 v)^2)"
     by (simp add:sum.distrib algebra_simps)
-  also have "... = 
+  also have "... =
     (\<Sum>v\<in>verts G. \<tau>(fst v)*\<gamma> v (S\<^sub>2 v)*f v^2)+
     (\<Sum>v\<in>verts G. \<tau>(fst (S\<^sub>2 v)) * \<gamma> (S\<^sub>2 v) (T\<^sub>2 (S\<^sub>2 v)) * f(S\<^sub>2 v)^2)+
     (\<Sum>v\<in>verts G. \<tau>(snd v)*\<gamma> v (S\<^sub>1 v)*f v^2)+
     (\<Sum>v\<in>verts G. \<tau>(snd (S\<^sub>1 v)) * \<gamma> (S\<^sub>1 v) (T\<^sub>1 (S\<^sub>1 v)) * f(S\<^sub>1 v)^2)"
     by (intro arg_cong2[where f="(+)"] sum.cong refl) simp_all
   also have "... =
     (\<Sum>v\<in>verts G. \<tau>(fst v)*\<gamma> v (S\<^sub>2 v)*f v^2)+ (\<Sum>v\<in>S\<^sub>2 ` verts G. \<tau>(fst v) * \<gamma> v (T\<^sub>2 v) * f v^2)+
     (\<Sum>v\<in>verts G. \<tau>(snd v)*\<gamma> v (S\<^sub>1 v)*f v^2)+ (\<Sum>v\<in>S\<^sub>1 ` verts G. \<tau>(snd v) * \<gamma> v (T\<^sub>1 v) * f v^2)"
     using S1_inj S2_inj by (simp add:sum.reindex)
-  also have "... = 
+  also have "... =
     (\<Sum>v\<in>verts G. (\<tau>(fst v)*(\<gamma> v (S\<^sub>2 v)+\<gamma> v (T\<^sub>2 v))+\<tau>(snd v)*(\<gamma> v (S\<^sub>1 v)+\<gamma> v (T\<^sub>1 v))) *f v^2)"
     unfolding S1_ran S2_ran by (simp add:algebra_simps sum.distrib)
   also have "... \<le> (\<Sum>v\<in>verts G. 2.5 * sqrt 2 * f v^2)"
     using fun_bound by (intro sum_mono 2) auto
-  also have "... \<le>  2.5 * sqrt 2 * g_norm f^2" 
-    unfolding g_norm_sq g_inner_def 
+  also have "... \<le>  2.5 * sqrt 2 * g_norm f^2"
+    unfolding g_norm_sq g_inner_def
     by (simp add:algebra_simps power2_eq_square sum_distrib_left)
   finally have "2 * ?L \<le> 2.5 * sqrt 2 * g_norm f^2" by simp
   thus ?thesis by simp
 qed
 
 lemma hoory_8_7:
   fixes f :: "int\<times>int \<Rightarrow> complex"
   assumes "f (0,0) = 0"
   assumes "periodic f"
   shows "norm(g_inner f (\<lambda>x. f (S\<^sub>2 x) * (1+\<omega>\<^sub>F (fst x)) + f (S\<^sub>1 x) * (1+\<omega>\<^sub>F (snd x))))
     \<le> (2.5 * sqrt 2) * (\<Sum>v \<in> verts G. norm (f v)^2)" (is "?L \<le> ?R")
 proof -
   define g :: "int\<times>int \<Rightarrow> real" where "g x = norm (f x)" for x
 
   have g_zero: "g (0,0) = 0"
     using assms(1) unfolding g_def by simp
   have g_nonneg: "g x \<ge> 0" for x
     unfolding g_def by simp
   have g_periodic: "periodic g"
     unfolding g_def by (intro periodic_comp[OF assms(2)])
 
   have 0: "norm(1+\<omega>\<^sub>F x) = 2*\<tau> x" for x :: int
   proof -
     have "norm(1+\<omega>\<^sub>F x) = norm(\<omega>\<^sub>F (-x/2)*(\<omega>\<^sub>F 0 + \<omega>\<^sub>F x))"
       unfolding \<omega>\<^sub>F_def norm_mult by simp
     also have "... = norm (\<omega>\<^sub>F (0-x/2) + \<omega>\<^sub>F (x-x/2))"
       unfolding \<omega>\<^sub>F_simps by (simp add: algebra_simps)
     also have "... = norm (\<omega>\<^sub>F (x/2) + cnj (\<omega>\<^sub>F (x/2)))"
       unfolding \<omega>\<^sub>F_simps(3) by (simp add:algebra_simps)
     also have "... = \<bar>2*Re (\<omega>\<^sub>F (x/2))\<bar>"
       unfolding complex_add_cnj norm_of_real by simp
     also have "... =  2*\<bar>cos(pi*x/m)\<bar>"
       unfolding \<omega>\<^sub>F_def cis.simps by simp
     also have "... = 2*\<tau> x" unfolding \<tau>_def by simp
     finally show ?thesis by simp
   qed
 
   have "?L\<le>norm(\<Sum>v\<in>verts G. f v * cnj(f(S\<^sub>2 v)*(1+\<omega>\<^sub>F (fst v))+f(S\<^sub>1 v )*(1+\<omega>\<^sub>F (snd v))))"
     unfolding g_inner_def by (simp add:case_prod_beta)
   also have "...\<le>(\<Sum>v\<in>verts G. norm(f v * cnj(f (S\<^sub>2 v) *(1+\<omega>\<^sub>F (fst v))+f (S\<^sub>1 v)*(1+\<omega>\<^sub>F (snd v)))))"
     by (intro norm_sum)
   also have "...=(\<Sum>v\<in>verts G. g v * norm(f (S\<^sub>2 v) *(1+\<omega>\<^sub>F (fst v))+f (S\<^sub>1 v)*(1+\<omega>\<^sub>F (snd v))))"
     unfolding norm_mult g_def complex_mod_cnj by simp
   also have "...\<le>(\<Sum>v\<in>verts G. g v * (norm (f(S\<^sub>2 v)*(1+\<omega>\<^sub>F (fst v)))+norm(f(S\<^sub>1 v)*(1+\<omega>\<^sub>F(snd v)))))"
     by (intro sum_mono norm_triangle_ineq mult_left_mono g_nonneg)
   also have "...=2*g_inner g (\<lambda>x. g (S\<^sub>2 x)*\<tau> (fst x)+g(S\<^sub>1 x)*\<tau> (snd x))"
-    unfolding g_def g_inner_def norm_mult 0 
+    unfolding g_def g_inner_def norm_mult 0
     by (simp add:sum_distrib_left algebra_simps case_prod_beta)
   also have "... \<le>2*(1.25* sqrt 2*g_norm g^2)"
     by (intro mult_left_mono hoory_8_8 g_nonneg g_zero g_periodic) auto
   also have "... = ?R"
     unfolding g_norm_sq g_def g_inner_def by (simp add:power2_eq_square)
   finally show ?thesis by simp
 qed
 
 lemma hoory_8_3:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   assumes "periodic f"
-  shows "\<bar>(\<Sum>(x,y)\<in>verts G. f(x,y)*(f(x+2*y,y)+f(x+2*y+1,y)+f(x,y+2*x)+f(x,y+2*x+1)))\<bar> 
+  shows "\<bar>(\<Sum>(x,y)\<in>verts G. f(x,y)*(f(x+2*y,y)+f(x+2*y+1,y)+f(x,y+2*x)+f(x,y+2*x+1)))\<bar>
     \<le> (2.5 * sqrt 2) * g_norm f^2" (is "\<bar>?L\<bar> \<le> ?R")
 proof -
   let ?f = "(\<lambda>x. complex_of_real (f x))"
 
-  define Ts :: "(int \<times> int \<Rightarrow> int \<times> int) list" where 
+  define Ts :: "(int \<times> int \<Rightarrow> int \<times> int) list" where
     "Ts = [(\<lambda>(x,y).(x+2*y,y)),(\<lambda>(x,y).(x+2*y+1,y)),(\<lambda>(x,y).(x,y+2*x)),(\<lambda>(x,y).(x,y+2*x+1))]"
-  have p: "periodic ?f" 
+  have p: "periodic ?f"
     by (intro periodic_comp[OF assms(2)])
 
-  have 0: "(\<Sum>T\<leftarrow>Ts. FT (?f\<circ>T) v) = FT ?f (S\<^sub>2 v)*(1+\<omega>\<^sub>F (fst v))+FT ?f (S\<^sub>1 v)*(1+\<omega>\<^sub>F (snd v))" 
+  have 0: "(\<Sum>T\<leftarrow>Ts. FT (?f\<circ>T) v) = FT ?f (S\<^sub>2 v)*(1+\<omega>\<^sub>F (fst v))+FT ?f (S\<^sub>1 v)*(1+\<omega>\<^sub>F (snd v))"
     (is "?L1 = ?R1") for v :: "int \<times> int"
   proof -
     obtain x y where v_def: "v = (x,y)" by (cases v, auto)
     have "?L1 = (\<Sum>T\<leftarrow>Ts. FT (?f\<circ>T) (x,y))"
       unfolding v_def by simp
     also have "... = FT ?f (x,y-2*x)*(1+\<omega>\<^sub>F x) + FT ?f (x-2*y,y)*(1+\<omega>\<^sub>F y)"
       unfolding Ts_def by (simp add:FT_sheer[OF p] case_prod_beta comp_def) (simp add:algebra_simps)
     also have "... = ?R1"
       unfolding v_def S\<^sub>2_def S\<^sub>1_def
       by (intro arg_cong2[where f="(+)"] arg_cong2[where f="(*)"] periodic_cong[OF periodic_FT]) auto
     finally show ?thesis by simp
   qed
 
   have "cmod ((of_nat m)^2) = cmod (of_real (of_nat m^2))" by simp
   also have "... = abs (of_nat m^2)" by (intro norm_of_real)
   also have "... = real m^2" by simp
   finally have 1: "cmod ((of_nat m)\<^sup>2) = (real m)\<^sup>2" by simp
 
   have "FT (\<lambda>x. complex_of_real (f x)) (0, 0) = complex_of_real (g_inner f (\<lambda>_ . 1))"
     unfolding FT_def g_inner_def g_inner_def \<omega>\<^sub>F_def by simp
   also have "... = 0"
     unfolding assms by simp
   finally have 2: "FT (\<lambda>x. complex_of_real (f x)) (0, 0) = 0"
     by simp
 
-  have "abs ?L = norm (complex_of_real ?L)" 
+  have "abs ?L = norm (complex_of_real ?L)"
     unfolding norm_of_real by simp
   also have "... = norm (\<Sum>T \<leftarrow> Ts. (g_inner ?f (?f \<circ> T)))"
     unfolding Ts_def by (simp add:algebra_simps g_inner_def  sum.distrib comp_def case_prod_beta)
-  also have "... = norm (\<Sum>T \<leftarrow> Ts. (g_inner (FT ?f) (FT (?f \<circ> T)))/m^2)" 
+  also have "... = norm (\<Sum>T \<leftarrow> Ts. (g_inner (FT ?f) (FT (?f \<circ> T)))/m^2)"
     by (subst parseval) simp
   also have "... = norm (g_inner (FT ?f) (\<lambda>x. (\<Sum>T \<leftarrow> Ts. (FT (?f \<circ> T) x)))/m^2)"
     unfolding Ts_def by (simp add:g_inner_simps case_prod_beta add_divide_distrib)
   also have "...=norm(g_inner(FT ?f)(\<lambda>x.(FT ?f(S\<^sub>2 x)*(1+\<omega>\<^sub>F (fst x))+FT f(S\<^sub>1 x)*(1+\<omega>\<^sub>F (snd x)))))/m^2"
     by (subst 0) (simp add:norm_divide 1)
   also have "... \<le> (2.5 * sqrt 2) * (\<Sum>v \<in> verts G. norm (FT f v)^2) / m^2"
-    by (intro divide_right_mono hoory_8_7[where f="FT f"] 2 periodic_FT) auto 
+    by (intro divide_right_mono hoory_8_7[where f="FT f"] 2 periodic_FT) auto
   also have "... = (2.5 * sqrt 2) * (\<Sum>v \<in> verts G. cmod (f v)^2)"
     by (subst (2) plancharel) simp
   also have "... = (2.5 * sqrt 2) * (g_inner f f)"
     unfolding g_inner_def norm_of_real by (simp add: power2_eq_square)
-  also have "... = ?R" 
+  also have "... = ?R"
     using g_norm_sq by auto
   finally show ?thesis by simp
 qed
 
-text \<open>Inequality stated before Theorem 8.3 in Hoory.\<close> 
+text \<open>Inequality stated before Theorem 8.3 in Hoory.\<close>
 
 lemma mgg_numerical_radius_aux:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   shows "\<bar>(\<Sum>a \<in> arcs G. f (head G a) * f (tail G a))\<bar> \<le> (5 * sqrt 2) * g_norm f^2"  (is "?L \<le> ?R")
 proof -
   define g where "g x = f (fst x mod m, snd x mod m)" for x :: "int \<times> int"
-  have 0:"g x = f x" if "x \<in> verts G" for x 
+  have 0:"g x = f x" if "x \<in> verts G" for x
     unfolding g_def using that
     by (auto simp add:mgg_graph_def mem_Times_iff)
 
   have g_mod_simps[simp]: "g (x, y mod m) = g (x, y)" "g (x mod m, y) = g (x, y)" for x y :: int
     unfolding g_def by auto
 
   have periodic_g: "periodic g"
     unfolding periodic_def by simp
 
   have "g_inner g (\<lambda>_. 1) = g_inner f (\<lambda>_. 1)"
     by (intro g_inner_cong 0) auto
   also have "... = 0"
     using assms by simp
   finally have 1:"g_inner g (\<lambda>_. 1) = 0" by simp
 
   have 2:"g_norm g = g_norm f"
     by (intro g_norm_cong 0) (auto)
 
   have "?L = \<bar>(\<Sum>a \<in> arcs G. g (head G a) * g (tail G a))\<bar>"
     using wellformed
     by (intro arg_cong[where f="abs"] sum.cong arg_cong2[where f="(*)"] 0[symmetric]) auto
   also have "...=\<bar>(\<Sum>a\<in>arcs_pos. g(head G a)*g(tail G a))+(\<Sum>a\<in>arcs_neg. g(head G a)*g(tail G a))\<bar>"
     unfolding arcs_sym arcs_pos_def arcs_neg_def
     by (intro arg_cong[where f="abs"] sum.union_disjoint) auto
   also have "... = \<bar>2 * (\<Sum>(v,l)\<in>verts G \<times> {..<4}. g v * g (mgg_graph_step m v (l, 1)))\<bar>"
     unfolding arcs_pos_def arcs_neg_def
     by (simp add:inj_on_def sum.reindex case_prod_beta mgg_graph_def algebra_simps)
   also have "... = 2 * \<bar>(\<Sum>v \<in> verts G. (\<Sum>l \<in> {..<4}. g v * g (mgg_graph_step m v (l, 1))))\<bar>"
     by (subst sum.cartesian_product)  (simp add:abs_mult)
   also have "... = 2*\<bar>(\<Sum>(x,y)\<in>verts G. (\<Sum>l\<leftarrow>[0..<4]. g(x,y)* g (mgg_graph_step m (x,y) (l,1))))\<bar>"
     by (subst interv_sum_list_conv_sum_set_nat)
-      (auto simp add:atLeast0LessThan case_prod_beta simp del:mgg_graph_step.simps) 
+      (auto simp add:atLeast0LessThan case_prod_beta simp del:mgg_graph_step.simps)
   also have "... =2*\<bar>\<Sum>(x,y)\<in>verts G. g (x,y)* (g(x+2*y,y)+g(x+2*y+1,y)+g(x,y+2*x)+g(x,y+2*x+1))\<bar>"
-    by (simp add:case_prod_beta numeral_eq_Suc algebra_simps) 
+    by (simp add:case_prod_beta numeral_eq_Suc algebra_simps)
   also have "... \<le> 2* ((2.5 * sqrt 2) * g_norm g^2)"
     by (intro mult_left_mono hoory_8_3 1 periodic_g) auto
   also have "... \<le> ?R" unfolding 2 by simp
   finally show ?thesis by simp
 qed
 
 definition MGG_bound :: real
   where "MGG_bound = 5 * sqrt 2 / 8"
 
-text \<open>Main result: Theorem 8.2 in Hoory.\<close> 
+text \<open>Main result: Theorem 8.2 in Hoory.\<close>
 
 lemma mgg_numerical_radius: "\<Lambda>\<^sub>a \<le> MGG_bound"
 proof -
   have "\<Lambda>\<^sub>a \<le> (5 * sqrt 2)/real d"
     by (intro expander_intro mgg_numerical_radius_aux) auto
   also have "... = MGG_bound"
-    unfolding MGG_bound_def d_eq_8 by simp 
+    unfolding MGG_bound_def d_eq_8 by simp
   finally show ?thesis by simp
 qed
 
 end
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_Multiset_Extras.thy b/thys/Expander_Graphs/Expander_Graphs_Multiset_Extras.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Multiset_Extras.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Multiset_Extras.thy
@@ -1,195 +1,225 @@
 subsection \<open>Multisets\<close>
 
 text \<open>Some preliminary results about multisets.\<close>
 
 theory Expander_Graphs_Multiset_Extras
-  imports 
-    Frequency_Moments.Frequency_Moments_Preliminary_Results 
+  imports
+    "HOL-Library.Multiset"
     Extra_Congruence_Method
 begin
 
 unbundle intro_cong_syntax
 
-lemma sum_mset_conv: 
+text \<open>This is an induction scheme over the distinct elements of a multisets:
+We can represent each multiset as a sum like:
+@{text "replicate_mset n\<^sub>1 x\<^sub>1 + replicate_mset n\<^sub>2 x\<^sub>2 + ... + replicate_mset n\<^sub>k x\<^sub>k"} where the
+@{term "x\<^sub>i"} are distinct.\<close>
+
+lemma disj_induct_mset:
+  assumes "P {#}"
+  assumes "\<And>n M x. P M \<Longrightarrow> \<not>(x \<in># M) \<Longrightarrow> n > 0 \<Longrightarrow> P (M + replicate_mset n x)"
+  shows "P M"
+proof (induction "size M" arbitrary: M rule:nat_less_induct)
+  case 1
+  show ?case
+  proof (cases "M = {#}")
+    case True
+    then show ?thesis using assms by simp
+  next
+    case False
+    then obtain x where x_def: "x \<in># M" using multiset_nonemptyE by auto
+    define M1 where "M1 = M - replicate_mset (count M x) x"
+    then have M_def: "M = M1 + replicate_mset (count M x) x"
+      by (metis count_le_replicate_mset_subset_eq dual_order.refl subset_mset.diff_add)
+    have "size M1 < size M"
+      by (metis M_def x_def count_greater_zero_iff less_add_same_cancel1 size_replicate_mset size_union)
+    hence "P M1" using 1 by blast
+    then show "P M"
+      apply (subst M_def, rule assms(2), simp)
+      by (simp add:M1_def x_def count_eq_zero_iff[symmetric])+
+  qed
+qed
+
+lemma sum_mset_conv:
   fixes f :: "'a \<Rightarrow> 'b::{semiring_1}"
   shows "sum_mset (image_mset f A) = sum (\<lambda>x. of_nat (count A x) * f x) (set_mset A)"
 proof (induction A rule: disj_induct_mset)
   case 1
   then show ?case by simp
 next
   case (2 n M x)
   moreover have "count M x = 0" using 2 by (simp add: count_eq_zero_iff)
   moreover have "\<And>y. y \<in> set_mset M \<Longrightarrow> y \<noteq> x" using 2 by blast
-  ultimately show ?case by (simp add:algebra_simps) 
+  ultimately show ?case by (simp add:algebra_simps)
 qed
 
-lemma sum_mset_conv_2: 
+lemma sum_mset_conv_2:
   fixes f :: "'a \<Rightarrow> 'b::{semiring_1}"
   assumes "set_mset A \<subseteq> B" "finite B"
   shows "sum_mset (image_mset f A) = sum (\<lambda>x. of_nat (count A x) * f x) B" (is "?L = ?R")
 proof -
   have "?L = sum (\<lambda>x. of_nat (count A x) * f x) (set_mset A)"
     unfolding sum_mset_conv by simp
   also have "... = ?R"
     by (intro sum.mono_neutral_left assms) (simp_all add: iffD2[OF count_eq_zero_iff])
   finally show ?thesis by simp
 qed
 
 lemma count_mset_exp: "count A x = size (filter_mset (\<lambda>y. y = x) A)"
   by (induction A, simp, simp)
 
 lemma mset_repl: "mset (replicate k x) = replicate_mset k x"
   by (induction k, auto)
 
 lemma count_image_mset_inj:
   assumes "inj f"
   shows "count (image_mset f A) (f x) = count A x"
 proof (cases "x \<in> set_mset A")
   case True
-  hence "f -` {f x} \<inter> set_mset A = {x}" 
-    using assms by (auto simp add:vimage_def inj_def) 
+  hence "f -` {f x} \<inter> set_mset A = {x}"
+    using assms by (auto simp add:vimage_def inj_def)
   then show ?thesis by (simp add:count_image_mset)
 next
   case False
-  hence "f -` {f x} \<inter> set_mset A = {}" 
-    using assms by (auto simp add:vimage_def inj_def) 
+  hence "f -` {f x} \<inter> set_mset A = {}"
+    using assms by (auto simp add:vimage_def inj_def)
   thus ?thesis  using False by (simp add:count_image_mset count_eq_zero_iff)
 qed
 
 lemma count_image_mset_0_triv:
   assumes "x \<notin> range f"
-  shows "count (image_mset f A) x = 0" 
+  shows "count (image_mset f A) x = 0"
 proof -
-  have "x \<notin> set_mset (image_mset f A)" 
+  have "x \<notin> set_mset (image_mset f A)"
     using assms by auto
-  thus ?thesis 
+  thus ?thesis
     by (meson count_inI)
 qed
 
 lemma filter_mset_ex_predicates:
   assumes "\<And>x. \<not> P x \<or> \<not> Q x"
   shows "filter_mset P M + filter_mset Q M = filter_mset (\<lambda>x. P x \<or> Q x) M"
   using assms by (induction M, auto)
 
-lemma sum_count_2: 
+lemma sum_count_2:
   assumes "finite F"
   shows "sum (count M) F = size (filter_mset (\<lambda>x. x \<in> F) M)"
   using assms
 proof (induction F rule:finite_induct)
   case empty
   then show ?case by simp
 next
   case (insert x F)
   have "sum (count M) (insert x F) = size ({#y \<in># M. y = x#} + {#x \<in># M. x \<in> F#})"
     using insert(1,2,3) by (simp add:count_mset_exp)
   also have "... = size ({#y \<in># M. y = x \<or> y \<in> F#})"
     using insert(2)
     by (intro arg_cong[where f="size"] filter_mset_ex_predicates) simp
   also have "... = size (filter_mset (\<lambda>y. y \<in> insert x F) M)"
     by simp
   finally show ?case by simp
 qed
 
 definition concat_mset :: "('a multiset) multiset \<Rightarrow> 'a multiset"
   where "concat_mset xss = fold_mset (\<lambda>xs ys. xs + ys) {#} xss"
 
 lemma image_concat_mset:
   "image_mset f (concat_mset xss) = concat_mset (image_mset (image_mset f) xss)"
   unfolding concat_mset_def by (induction xss, auto)
 
 lemma concat_add_mset:
   "concat_mset (image_mset (\<lambda>x. f x + g x) xs) = concat_mset (image_mset f xs) + concat_mset (image_mset g xs)"
   unfolding concat_mset_def by (induction xs) auto
 
 lemma concat_add_mset_2:
   "concat_mset (xs + ys) = concat_mset xs + concat_mset ys"
   unfolding concat_mset_def by (induction xs, auto)
 
 lemma size_concat_mset:
   "size (concat_mset xss) = sum_mset (image_mset size xss)"
   unfolding concat_mset_def by (induction xss, auto)
 
 lemma filter_concat_mset:
   "filter_mset P (concat_mset xss) = concat_mset (image_mset (filter_mset P) xss)"
   unfolding concat_mset_def by (induction xss, auto)
 
 lemma count_concat_mset:
   "count (concat_mset xss) xs = sum_mset (image_mset (\<lambda>x. count x xs) xss)"
   unfolding concat_mset_def by (induction xss, auto)
 
 lemma set_mset_concat_mset:
   "set_mset (concat_mset xss) = \<Union> (set_mset ` (set_mset xss))"
   unfolding concat_mset_def by (induction xss, auto)
 
 lemma concat_mset_empty: "concat_mset {#} = {#}"
   unfolding concat_mset_def by simp
 
 lemma concat_mset_single: "concat_mset {#x#} = x"
   unfolding concat_mset_def by simp
 
 lemma concat_disjoint_union_mset:
   assumes "finite I"
   assumes "\<And>i. i \<in> I \<Longrightarrow> finite (A i)"
   assumes "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> i \<noteq> j \<Longrightarrow> A i \<inter> A j = {}"
   shows  "mset_set (\<Union> (A ` I)) = concat_mset (image_mset (mset_set \<circ> A) (mset_set I))"
   using assms
 proof (induction I rule:finite_induct)
   case empty
   then show ?case by (simp add:concat_mset_empty)
 next
   case (insert x F)
   have "mset_set (\<Union> (A ` insert x F)) = mset_set (A x \<union> (\<Union> (A ` F)))"
     by simp
   also have "... = mset_set (A x) + mset_set (\<Union> (A ` F))"
     using insert by (intro mset_set_Union) auto
   also have "... = mset_set (A x) + concat_mset (image_mset (mset_set \<circ> A) (mset_set F))"
     using insert by (intro arg_cong2[where f="(+)"] insert(3)) auto
   also have "... = concat_mset (image_mset (mset_set \<circ> A) ({#x#} + mset_set F))"
     by (simp add:concat_mset_def)
   also have "... = concat_mset (image_mset (mset_set \<circ> A) (mset_set (insert x F)))"
     using insert by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset]") auto
   finally show ?case by blast
 qed
 
 lemma size_filter_mset_conv:
   "size (filter_mset f A) = sum_mset (image_mset (\<lambda>x. of_bool (f x) :: nat) A)"
   by (induction A, auto)
 
 lemma filter_mset_const: "filter_mset (\<lambda>_. c) xs = (if c then xs else {#})"
   by simp
 
-lemma repeat_image_concat_mset: 
+lemma repeat_image_concat_mset:
   "repeat_mset n (image_mset f A) = concat_mset (image_mset (\<lambda>x. replicate_mset n (f x)) A)"
   unfolding concat_mset_def by (induction A, auto)
 
 lemma mset_prod_eq:
   assumes "finite A" "finite B"
-  shows 
+  shows
     "mset_set (A \<times> B) = concat_mset {# {# (x,y). y \<in># mset_set B #} .x \<in># mset_set A #}"
   using assms(1)
 proof (induction rule:finite_induct)
   case empty
   then show ?case unfolding concat_mset_def by simp
 next
   case (insert x F)
   have "mset_set (insert x F \<times> B) = mset_set (F \<times> B \<union> (\<lambda>y. (x,y)) ` B)"
     by (intro arg_cong[where f="mset_set"]) auto
   also have "... = mset_set (F \<times> B) + mset_set ((\<lambda>y. (x,y)) ` B)"
     using insert(1,2) assms(2) by (intro mset_set_Union finite_cartesian_product) auto
   also have "... = mset_set (F \<times> B) + {# (x,y). y \<in># mset_set B #}"
     by (intro arg_cong2[where f="(+)"] image_mset_mset_set[symmetric] inj_onI) auto
   also have "... = concat_mset {#image_mset (Pair x) (mset_set B). x \<in># {#x#} + (mset_set F)#}"
     unfolding insert image_mset_union concat_add_mset_2 by (simp add:concat_mset_single)
   also have "... = concat_mset {#image_mset (Pair x) (mset_set B). x \<in># mset_set (insert x F)#}"
     using insert(1,2) by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset]") auto
   finally show ?case by simp
 qed
 
-lemma sum_mset_repeat: 
+lemma sum_mset_repeat:
   fixes f :: "'a \<Rightarrow> 'b :: {comm_monoid_add,semiring_1}"
   shows "sum_mset (image_mset f (repeat_mset n A)) = of_nat n * sum_mset (image_mset f A)"
   by (induction n, auto simp add:sum_mset.distrib algebra_simps)
 
 unbundle no_intro_cong_syntax
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_Power_Construction.thy b/thys/Expander_Graphs/Expander_Graphs_Power_Construction.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Power_Construction.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Power_Construction.thy
@@ -1,566 +1,566 @@
 section \<open>Graph Powers\label{sec:graph_power}\<close>
 
 theory Expander_Graphs_Power_Construction
-  imports 
+  imports
     Expander_Graphs_Walks
     Graph_Theory.Arc_Walk
 begin
 
 unbundle intro_cong_syntax
 
 fun is_arc_walk :: "('a, 'b) pre_digraph \<Rightarrow> 'a \<Rightarrow> 'b list \<Rightarrow> bool"
-  where 
+  where
     "is_arc_walk G _ [] = True" |
     "is_arc_walk G y (x#xs) = (is_arc_walk G (head G x) xs \<and> tail G x = y \<and> x \<in> arcs G)"
 
-definition arc_walk_head :: "('a, 'b) pre_digraph \<Rightarrow> ('a \<times> 'b list) \<Rightarrow> 'a" 
+definition arc_walk_head :: "('a, 'b) pre_digraph \<Rightarrow> ('a \<times> 'b list) \<Rightarrow> 'a"
   where
     "arc_walk_head G x = (if snd x = [] then fst x else head G (last (snd x)))"
 
 lemma is_arc_walk_snoc:
   "is_arc_walk G y (xs@[x]) \<longleftrightarrow> is_arc_walk G y xs \<and> x \<in> out_arcs G (arc_walk_head G (y,xs))"
   by (induction xs arbitrary: y, simp_all add:ac_simps arc_walk_head_def)
 
 lemma is_arc_walk_set:
-  assumes "is_arc_walk G u w" 
+  assumes "is_arc_walk G u w"
   shows "set w \<subseteq> arcs G"
   using assms by (induction w arbitrary: u, auto)
 
 lemma (in wf_digraph) awalk_is_arc_walk:
   assumes "u \<in> verts G"
   shows "is_arc_walk G u w \<longleftrightarrow> awalk u w (awlast u w)"
   using assms unfolding awalk_def by (induction w arbitrary: u, auto)
 
 definition arc_walks :: "('a, 'b) pre_digraph \<Rightarrow> nat \<Rightarrow> ('a \<times> 'b list) set"
   where
     "arc_walks G l = {(u,w). u \<in> verts G \<and> is_arc_walk G u w \<and> length w = l}"
 
 lemma arc_walks_len:
-  assumes "x \<in> arc_walks G l" 
+  assumes "x \<in> arc_walks G l"
   shows "length (snd x) = l"
   using assms unfolding arc_walks_def by auto
 
 lemma (in wf_digraph) awhd_of_arc_walk:
   assumes "w \<in> arc_walks G l"
   shows "awhd (fst w) (snd w) = fst w"
-  using assms unfolding arc_walks_def awalk_verts_def 
+  using assms unfolding arc_walks_def awalk_verts_def
   by (cases "snd w", auto)
 
 lemma (in wf_digraph) awlast_of_arc_walk:
   assumes "w \<in> arc_walks G l"
   shows "awlast (fst w) (snd w) = arc_walk_head G w"
   unfolding awalk_verts_conv arc_walk_head_def by simp
 
 lemma (in wf_digraph) arc_walk_head_wellformed:
   assumes "w \<in> arc_walks G l"
   shows "arc_walk_head G w \<in> verts G"
 proof (cases "snd w = []")
   case True
-  then show ?thesis 
+  then show ?thesis
     using assms unfolding arc_walks_def arc_walk_head_def by auto
 next
   case False
   have 0:"is_arc_walk G (fst w) (snd w)" using assms unfolding arc_walks_def by auto
   have "last (snd w) \<in> set (snd w)"
     using False last_in_set by auto
   also have "... \<subseteq> arcs G"
     by (intro is_arc_walk_set[OF 0])
   finally have "last (snd w) \<in> arcs G" by simp
   thus ?thesis unfolding arc_walk_head_def using False by simp
 qed
 
 lemma (in wf_digraph) arc_walk_tail_wellformed:
   assumes "w \<in> arc_walks G l"
   shows "fst w \<in> verts G"
   using assms unfolding arc_walks_def by auto
 
-lemma (in fin_digraph) arc_walks_fin: 
+lemma (in fin_digraph) arc_walks_fin:
   "finite (arc_walks G l)"
 proof -
   have 0:"finite (verts G \<times> {w. set w \<subseteq> arcs G \<and> length w = l})"
     by (intro finite_cartesian_product finite_lists_length_eq) auto
   show "finite (arc_walks G l)"
     unfolding arc_walks_def using is_arc_walk_set[where G="G"]
     by (intro finite_subset[OF _ 0] subsetI) auto
 qed
 
 lemma (in wf_digraph) awalk_verts_unfold:
   assumes "w \<in> arc_walks G l"
   shows "awalk_verts (fst w) (snd w) = fst w#map (head G) (snd w)" (is "?L = ?R")
 proof -
   obtain u v where w_def: "w = (u,v)" by fastforce
 
   have "awalk u v (awlast u v)"
     using assms unfolding w_def arc_walks_def
     by (intro iffD1[OF awalk_is_arc_walk]) auto
   hence cas: "cas u v (awlast u v)"
     unfolding awalk_def by simp
 
   have 0: "tail G (hd v) = u" if "v \<noteq> []"
     using cas that by (cases v) auto
 
   have "?L = awalk_verts u v"
     unfolding w_def by simp
   also have "... = (if v = [] then [u] else tail G (hd v) # map (head G) v)"
     by (intro awalk_verts_conv'[OF cas])
   also have "... = u# map (head G) v"
     using 0 by simp
   also have "... = ?R"
     unfolding w_def by simp
   finally show ?thesis by simp
 qed
 
-lemma (in fin_digraph) arc_walks_map_walks': 
+lemma (in fin_digraph) arc_walks_map_walks':
   "walks' G l = image_mset (case_prod awalk_verts) (mset_set (arc_walks G l))"
 proof (induction l)
   case 0
   let ?g = "\<lambda>x. fst x#map (head G) (snd x)"
 
   have "walks' G 0 = {#[x]. x \<in># mset_set (verts G)#}"
     by simp
   also have "... = image_mset ?g (image_mset (\<lambda>x. (x,[])) (mset_set (verts G)))"
     unfolding image_mset.compositionality by (simp add:comp_def)
   also have "... = image_mset ?g (mset_set ((\<lambda>x. (x,[])) ` verts G))"
     by (intro arg_cong2[where f="image_mset"] image_mset_mset_set inj_onI) auto
   also have "... = image_mset ?g (mset_set ({(u, w). u \<in> verts G \<and> w = []}))"
     by (intro_cong "[\<sigma>\<^sub>2 image_mset]") auto
   also have "... = image_mset ?g (mset_set (arc_walks G 0))"
     unfolding arc_walks_def by (intro_cong "[\<sigma>\<^sub>2 image_mset,\<sigma>\<^sub>1 mset_set]") auto
   also have "... = image_mset (case_prod awalk_verts) (mset_set (arc_walks G 0))"
     using arc_walks_fin by (intro image_mset_cong) (simp add:case_prod_beta awalk_verts_unfold)
   finally show ?case by simp
 next
   case (Suc l)
   let ?f = "\<lambda>(u,w) a. (u,w@[a])"
   let ?g = "\<lambda>x. fst x#map (head G) (snd x)"
 
   have "arc_walks G (l+1) = case_prod ?f ` {(x,y). ?f x y \<in> arc_walks G (l+1)}"
     using arc_walks_len[where G="G" and l="Suc l", THEN iffD1[OF length_Suc_conv_rev]]
     by force
   also have "... = case_prod ?f ` {(x,y). x \<in> arc_walks G l \<and> y \<in> out_arcs G (arc_walk_head G x)}"
     unfolding arc_walks_def using is_arc_walk_snoc[where G="G"]
     by (intro_cong "[\<sigma>\<^sub>2 image]")  auto
   also have "... = (\<Union>w \<in> arc_walks G l. ?f w ` out_arcs G (arc_walk_head G w))"
     by (auto simp add:image_iff)
   finally have 0:"arc_walks G (l+1) = (\<Union>w \<in> arc_walks G l. ?f w ` out_arcs G (arc_walk_head G w))"
     by simp
 
-  have "mset_set (arc_walks G (l+1)) = concat_mset (image_mset (mset_set \<circ> 
+  have "mset_set (arc_walks G (l+1)) = concat_mset (image_mset (mset_set \<circ>
     (\<lambda>w. ?f w ` out_arcs G (arc_walk_head G w))) (mset_set (arc_walks G l)))"
-    unfolding 0 by (intro concat_disjoint_union_mset arc_walks_fin finite_imageI) auto 
-  also have "... = concat_mset {# mset_set (?f x ` out_arcs G (arc_walk_head G x)). 
+    unfolding 0 by (intro concat_disjoint_union_mset arc_walks_fin finite_imageI) auto
+  also have "... = concat_mset {# mset_set (?f x ` out_arcs G (arc_walk_head G x)).
     x\<in>#mset_set(arc_walks G l)#}"
-    by (simp add:comp_def case_prod_beta) 
-  also have "... = concat_mset {# {# ?f x y. y \<in># mset_set (out_arcs G (arc_walk_head G x))#}. 
+    by (simp add:comp_def case_prod_beta)
+  also have "... = concat_mset {# {# ?f x y. y \<in># mset_set (out_arcs G (arc_walk_head G x))#}.
     x \<in># mset_set (arc_walks G l)#}"
     by (intro_cong "[\<sigma>\<^sub>1 concat_mset]" more:image_mset_cong image_mset_mset_set[symmetric] inj_onI)
      auto
-  finally have 1:"mset_set (arc_walks G (l+1)) = concat_mset 
+  finally have 1:"mset_set (arc_walks G (l+1)) = concat_mset
     {# {# ?f x y. y \<in># mset_set (out_arcs G (arc_walk_head G x))#}. x \<in># mset_set (arc_walks G l)#}"
     by simp
 
   have "walks' G (l+1)=concat_mset {#{#w @ [z]. z\<in># vertices_from G (last w)#}. w \<in># walks' G l#}"
     by simp
   also have "... = concat_mset {#
-      {#awalk_verts (fst x) (snd x) @ [z]. z \<in># vertices_from G (awlast (fst x) (snd x))#}. 
+      {#awalk_verts (fst x) (snd x) @ [z]. z \<in># vertices_from G (awlast (fst x) (snd x))#}.
       x \<in># mset_set (arc_walks G l)#}"
     unfolding Suc by (simp add:image_mset.compositionality comp_def case_prod_beta)
   also have "... = concat_mset {#
-      {#?g x @ [z]. z \<in># vertices_from G (awlast (fst x) (snd x))#}. 
+      {#?g x @ [z]. z \<in># vertices_from G (awlast (fst x) (snd x))#}.
       x \<in># mset_set (arc_walks G l)#}"
-    using arc_walks_fin 
+    using arc_walks_fin
     by (intro_cong "[\<sigma>\<^sub>1 concat_mset]" more:image_mset_cong) (auto simp: awalk_verts_unfold)
-  also have "... = concat_mset {# {#?g x @ [z]. z \<in># vertices_from G (arc_walk_head G x)#}. 
+  also have "... = concat_mset {# {#?g x @ [z]. z \<in># vertices_from G (arc_walk_head G x)#}.
       x \<in># mset_set (arc_walks G l)#}"
     using arc_walks_fin awlast_of_arc_walk
     by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset]" more: image_mset_cong) auto
-  also have "... = (concat_mset {# {# ?g (fst x, snd x@[y]). 
+  also have "... = (concat_mset {# {# ?g (fst x, snd x@[y]).
     y \<in># mset_set (out_arcs G (arc_walk_head G x))#}. x \<in># mset_set (arc_walks G l)#})"
     unfolding verts_from_alt by (simp add:image_mset.compositionality comp_def)
-  also have "... = image_mset ?g (concat_mset {# {# ?f x y. 
+  also have "... = image_mset ?g (concat_mset {# {# ?f x y.
     y \<in># mset_set (out_arcs G (arc_walk_head G x))#}. x \<in># mset_set (arc_walks G l)#})"
     unfolding image_concat_mset
-    by (auto simp add:comp_def case_prod_beta image_mset.compositionality) 
+    by (auto simp add:comp_def case_prod_beta image_mset.compositionality)
   also have "... = image_mset ?g (mset_set (arc_walks G (l+1)))"
     unfolding 1 by simp
   also have "... = image_mset (case_prod awalk_verts) (mset_set (arc_walks G (l+1)))"
     using arc_walks_fin by (intro image_mset_cong) (simp add:case_prod_beta awalk_verts_unfold)
   finally show ?case by simp
 qed
 
-lemma (in fin_digraph) arc_walks_map_walks: 
+lemma (in fin_digraph) arc_walks_map_walks:
   "walks G (l+1) = image_mset (case_prod awalk_verts) (mset_set (arc_walks G l))"
   using arc_walks_map_walks' unfolding walks_def by simp
 
 lemma (in wf_digraph)
   assumes "awalk u a v " "length a = l" "l > 0"
   shows awalk_ends: "tail G (hd a) = u" "head G (last a) = v"
 proof -
-  have 0:"cas u a v" 
+  have 0:"cas u a v"
     using assms unfolding awalk_def by simp
   have 1: "a \<noteq> []" using assms(2,3) by auto
 
   show "tail G (hd a) = u"
     using 0 unfolding cas_simp[OF 1] by auto
 
   show "head G (last a) = v"
-    using 1 0 by (induction a arbitrary:u rule:list_nonempty_induct) auto 
+    using 1 0 by (induction a arbitrary:u rule:list_nonempty_induct) auto
 qed
 
 definition graph_power :: "('a, 'b) pre_digraph \<Rightarrow> nat \<Rightarrow> ('a, ('a \<times> 'b list)) pre_digraph"
   where "graph_power G l =
     \<lparr> verts = verts G, arcs = arc_walks G l, tail = fst, head = arc_walk_head G \<rparr>"
 
-lemma (in wf_digraph) graph_power_wf: 
+lemma (in wf_digraph) graph_power_wf:
   "wf_digraph (graph_power G l)"
 proof -
   have "tail (graph_power G l) a \<in> verts (graph_power G l)"
-       "head (graph_power G l) a \<in> verts (graph_power G l)" 
+       "head (graph_power G l) a \<in> verts (graph_power G l)"
        if "a \<in> arcs (graph_power G l)" for a
     using that arc_walk_head_wellformed arc_walk_tail_wellformed
     unfolding graph_power_def by simp_all
-  thus ?thesis 
+  thus ?thesis
     unfolding wf_digraph_def by auto
 qed
 
-lemma (in fin_digraph) graph_power_fin: 
+lemma (in fin_digraph) graph_power_fin:
   "fin_digraph (graph_power G l)"
 proof -
-  interpret H:wf_digraph "graph_power G l" 
+  interpret H:wf_digraph "graph_power G l"
     using graph_power_wf by auto
 
-  have "finite (arcs (graph_power G l))" 
+  have "finite (arcs (graph_power G l))"
     using arc_walks_fin
     unfolding graph_power_def by simp
 
-  moreover have "finite (verts (graph_power G l))" 
+  moreover have "finite (verts (graph_power G l))"
     unfolding graph_power_def by simp
   ultimately show ?thesis
     by unfold_locales auto
 qed
 
 lemma (in fin_digraph) graph_power_count_edges:
   fixes l v w
   defines "S \<equiv> {x. length x=l+1\<and>set x\<subseteq>verts G\<and>hd x=v\<and>last x=w}"
   shows "count (edges (graph_power G l)) (v,w) = (\<Sum>x \<in> S.(\<Prod>i<l. count(edges G)(x!i,x!(i+1))))"
     (is "?L = ?R")
 proof -
-  interpret H:fin_digraph "graph_power G l" 
+  interpret H:fin_digraph "graph_power G l"
     using graph_power_fin by auto
 
   have 0:"finite {x. set x \<subseteq> verts G \<and> length x = l+1}"
     by (intro finite_lists_length_eq) auto
   have fin_S: "finite S"
     unfolding S_def by (intro finite_subset[OF _ 0]) auto
 
   have "?L = size {#x \<in># mset_set (arc_walks G l). fst x = v \<and> arc_walk_head G x = w#}"
-    unfolding graph_power_def edges_def arc_to_ends_def 
+    unfolding graph_power_def edges_def arc_to_ends_def
     by (simp add:count_mset_exp image_mset_filter_mset_swap[symmetric])
-  also have "... = size 
+  also have "... = size
     {#x \<in># mset_set (arc_walks G l). awhd (fst x) (snd x) = v \<and> awlast (fst x) (snd x) = w#}"
     using awlast_of_arc_walk awhd_of_arc_walk arc_walks_fin
     by (intro arg_cong[where f="size"] filter_mset_cong refl) simp
   also have "... = size {#x \<in># walks G (l+1). hd x = v \<and> last x = w#}"
-    unfolding arc_walks_map_walks 
+    unfolding arc_walks_map_walks
     by (simp add:image_mset_filter_mset_swap[symmetric] case_prod_beta)
   also have "...=size{#x\<in># walks G (l+1).x \<in> S#}"
     unfolding S_def using set_walks_3
     by (intro arg_cong[where f="size"] filter_mset_cong refl) auto
   also have "...=sum (count (walks G (l+1))) S"
-    by (intro sum_count_2[symmetric] fin_S) 
+    by (intro sum_count_2[symmetric] fin_S)
   also have "...=(\<Sum>x\<in>S.(\<Prod>i<l+1-1. count (edges G) (x!i,x!(i+1))))"
     unfolding S_def
     by (intro sum.cong refl count_walks) auto
   also have "...=?R"
     by simp
   finally show ?thesis by simp
 qed
 
 lemma (in fin_digraph) graph_power_sym_aux:
   assumes "symmetric_multi_graph G"
   assumes "v \<in> verts (graph_power G l)"  "w \<in> verts (graph_power G l)"
-  shows "card (arcs_betw (graph_power G l) v w) = card (arcs_betw (graph_power G l) w v)" 
+  shows "card (arcs_betw (graph_power G l) v w) = card (arcs_betw (graph_power G l) w v)"
     (is "?L = ?R")
 proof -
-  interpret H:fin_digraph "graph_power G l" 
+  interpret H:fin_digraph "graph_power G l"
     using graph_power_fin by auto
 
   define S where "S v w = {x. length x=l+1 \<and> set x \<subseteq> verts G \<and> hd x = v \<and> last x = w}" for v w
 
   have 0: "bij_betw rev (S w v) (S v w)"
-    unfolding S_def by (intro bij_betwI[where g="rev"]) (auto simp add:hd_rev last_rev) 
+    unfolding S_def by (intro bij_betwI[where g="rev"]) (auto simp add:hd_rev last_rev)
 
   have 1: "bij_betw ((-) (l - 1)) {..<l} {..<l}"
     by (intro bij_betwI[where g="\<lambda>x. (l-1-x)"]) auto
 
   have "?L = count (edges (graph_power G l)) (v, w)"
     unfolding H.count_edges by simp
   also have "... = (\<Sum>x \<in> S v w. (\<Prod>i<l. count (edges G) (x!i,x!(i+1))))"
     unfolding S_def graph_power_count_edges by simp
   also have "... = (\<Sum>x \<in> S w v. (\<Prod>i<l. count (edges G) (rev x!i,rev x!(i+1))))"
-    by (intro sum.reindex_bij_betw[symmetric] 0) 
+    by (intro sum.reindex_bij_betw[symmetric] 0)
   also have "... = (\<Sum>x \<in> S w v. (\<Prod>i<l. count (edges G) (x!((l-1-i)+1),x!(l-1-i))))"
-    unfolding S_def by (intro sum.cong refl prod.cong) (simp_all add: rev_nth Suc_diff_Suc) 
+    unfolding S_def by (intro sum.cong refl prod.cong) (simp_all add: rev_nth Suc_diff_Suc)
   also have "... = (\<Sum>x \<in> S w v. (\<Prod>i<l. count (edges G) (x!(i+1),x!i)))"
     by (intro sum.cong prod.reindex_bij_betw refl 1)
   also have "... = (\<Sum>x \<in> S w v. (\<Prod>i<l. count (edges G) (x!i,x!(i+1))))"
     by (intro sum.cong prod.cong count_edges_sym[OF assms(1)] refl)
   also have "... = count (edges (graph_power G l)) (w, v)"
     unfolding S_def graph_power_count_edges by simp
   also have "... = ?R"
     unfolding H.count_edges by simp
   finally show ?thesis by simp
 qed
 
 lemma (in fin_digraph) graph_power_sym:
   assumes "symmetric_multi_graph G"
   shows "symmetric_multi_graph (graph_power G l)"
 proof -
-  interpret H:fin_digraph "graph_power G l" 
+  interpret H:fin_digraph "graph_power G l"
     using graph_power_fin by auto
 
   show ?thesis
     using graph_power_sym_aux[OF assms]
     unfolding symmetric_multi_graph_def by auto
 qed
 
 lemma  (in fin_digraph) graph_power_out_degree':
   assumes reg: "\<And>v. v \<in> verts G \<Longrightarrow> out_degree G v = d"
   assumes "v \<in> verts (graph_power G l)"
   shows "out_degree (graph_power G l) v = d ^ l"  (is "?L = ?R")
 proof -
-  interpret H:fin_digraph "graph_power G l" 
+  interpret H:fin_digraph "graph_power G l"
     using graph_power_fin by auto
 
   have v_vert: "v \<in> verts G"
     using assms unfolding graph_power_def by simp
 
   have "?L = size (vertices_from (graph_power G l) v)"
     unfolding out_degree_def H.verts_from_alt by simp
   also have "... = size ({# e \<in># edges (graph_power G l). fst e = v #})"
     unfolding vertices_from_def by simp
   also have "... = size {#w \<in># mset_set (arc_walks G l). fst w = v#}"
-    unfolding graph_power_def edges_def arc_to_ends_def 
+    unfolding graph_power_def edges_def arc_to_ends_def
     by (simp add:count_mset_exp image_mset_filter_mset_swap[symmetric])
   also have "... = size {#w \<in># mset_set (arc_walks G l). awhd (fst w) (snd w) = v#}"
     using awlast_of_arc_walk awhd_of_arc_walk arc_walks_fin
     by (intro arg_cong[where f="size"] filter_mset_cong refl) simp
   also have "... = size {#x \<in># walks' G l. hd x = v #}"
-    unfolding arc_walks_map_walks' 
+    unfolding arc_walks_map_walks'
     by (simp add:image_mset_filter_mset_swap[symmetric] case_prod_beta)
   also have "... = d^l"
   proof (induction l)
     case 0
     have "size {#x \<in># walks' G 0. hd x = v#} = card {x. x = v \<and> x \<in> verts G}"
       by (simp add:image_mset_filter_mset_swap[symmetric])
     also have "... = card {v}"
       using v_vert by (intro arg_cong[where f="card"]) auto
     also have "... = d^0" by simp
     finally show ?case by simp
   next
     case (Suc l)
     have "size {#x \<in># walks' G (Suc l). hd x = v#} =
       (\<Sum>x\<in>#walks' G l. size {#y \<in># vertices_from G (last x). hd (x @ [y]) = v#})"
-      by (simp add:size_concat_mset image_mset_filter_mset_swap[symmetric] 
+      by (simp add:size_concat_mset image_mset_filter_mset_swap[symmetric]
           filter_concat_mset image_mset.compositionality comp_def)
     also have "... = (\<Sum>x\<in>#walks' G l. size {#y \<in># vertices_from G (last x). hd x = v#})"
-      using set_walks_2 
+      using set_walks_2
       by (intro_cong "[\<sigma>\<^sub>1 sum_mset, \<sigma>\<^sub>1 size]" more:image_mset_cong filter_mset_cong) auto
     also have "... = (\<Sum>x\<in>#walks' G l. (if hd x = v then out_degree G (last x) else 0))"
       unfolding verts_from_alt out_degree_def
       by (simp add:filter_mset_const if_distribR if_distrib cong:if_cong)
     also have "... = (\<Sum>x\<in>#walks' G l. d * of_bool (hd x = v))"
       using set_walks_2[where l="l"] last_in_set
       by (intro arg_cong[where f="sum_mset"] image_mset_cong) (auto intro!:reg)
-    also have "... = d * (\<Sum>x\<in>#walks' G l. of_bool (hd x = v))" 
+    also have "... = d * (\<Sum>x\<in>#walks' G l. of_bool (hd x = v))"
       by (simp add:sum_mset_distrib_left image_mset.compositionality comp_def)
     also have "... = d * (size {#x \<in># walks' G l. hd x = v#})"
       by (simp add:size_filter_mset_conv)
     also have "... = d * d ^ l"
       using Suc by simp
     also have "... = d^Suc l"
       by simp
     finally show ?case by simp
-  qed 
+  qed
 
   finally show ?thesis by simp
 qed
 
 lemma  (in regular_graph) graph_power_out_degree:
   assumes "v \<in> verts (graph_power G l)"
   shows "out_degree (graph_power G l) v = d ^ l"  (is "?L = ?R")
   by (intro graph_power_out_degree' assms reg) auto
 
-lemma (in regular_graph) graph_power_regular: 
+lemma (in regular_graph) graph_power_regular:
   "regular_graph (graph_power G l)"
 proof -
-  interpret H:fin_digraph "graph_power G l" 
+  interpret H:fin_digraph "graph_power G l"
     using graph_power_fin by auto
 
   have "verts (graph_power G l) \<noteq> {}"
     using verts_non_empty unfolding graph_power_def by simp
 
   moreover have "0 < d^l"
     using d_gt_0 by simp
 
   ultimately show ?thesis
     using graph_power_out_degree
     by (intro regular_graphI[where d="d^l"] graph_power_sym sym)
 qed
 
-lemma (in regular_graph) graph_power_degree: 
+lemma (in regular_graph) graph_power_degree:
   "regular_graph.d (graph_power G l) = d^l" (is "?L = ?R")
 proof -
-  interpret H:regular_graph "graph_power G l" 
+  interpret H:regular_graph "graph_power G l"
     using graph_power_regular by auto
   obtain v where v_set: "v \<in> verts (graph_power G l)"
     using H.verts_non_empty by auto
-  hence "?L = out_degree (graph_power G l) v" 
+  hence "?L = out_degree (graph_power G l) v"
     using v_set H.reg by auto
   also have "... =?R"
-    by (intro graph_power_out_degree[OF v_set]) 
+    by (intro graph_power_out_degree[OF v_set])
   finally show ?thesis by simp
 qed
 
 lemma (in regular_graph) graph_power_step:
   assumes "x \<in> verts G"
   shows "regular_graph.g_step (graph_power G l) f x = (g_step^^l) f x"
   using assms
 proof (induction l arbitrary: x)
   case 0
   let ?H = "graph_power G 0"
   interpret H:regular_graph "?H"
     using graph_power_regular by auto
   have "regular_graph.g_step (graph_power G 0) f x = H.g_step f x"
     by simp
   have "H.g_step f x = (\<Sum>x\<in>in_arcs ?H x. f (tail ?H x))"
     unfolding H.g_step_def graph_power_degree by simp
   also have "... = (\<Sum>v\<in>{e \<in> arc_walks G 0. arc_walk_head G e = x}. f (fst v))"
     unfolding in_arcs_def graph_power_def by (simp add:case_prod_beta)
   also have "... = (\<Sum>v\<in>{x}. f v)"
     unfolding arc_walks_def using 0
     by (intro sum.reindex_bij_betw bij_betwI[where g="(\<lambda>x. (x,[]))"])
       (auto simp add:arc_walk_head_def)
   also have "... = f x"
     by simp
   also have "... = (g_step^^0) f x"
     by simp
   finally show ?case by simp
 next
   case (Suc l)
   let ?H = "graph_power G l"
   interpret H:regular_graph "?H"
     using graph_power_regular by auto
   let ?HS = "graph_power G (l+1)"
   interpret HS:regular_graph "?HS"
     using graph_power_regular by auto
 
   let ?bij = "(\<lambda>(x,(y1,y2)). (y1,y2@[x]))"
   let ?bijr = "(\<lambda>(y1,y2). (last y2, (y1,butlast y2)))"
 
   define S where "S = {y. fst y \<in> in_arcs G x \<and> snd y \<in> in_arcs ?H (tail G (fst y))}"
 
   have "S = {(u,v). u \<in> arcs G \<and> head G u = x \<and> v \<in> arc_walks G l \<and> arc_walk_head G v = tail G u}"
     unfolding S_def graph_power_def in_arcs_def by auto
   also have "... = {(u,v). (fst v,snd v@[u]) \<in> arc_walks G (l+1) \<and> arc_walk_head G (fst v,snd v@[u]) = x}"
-    unfolding arc_walks_def by (intro iffD2[OF set_eq_iff] allI) 
+    unfolding arc_walks_def by (intro iffD2[OF set_eq_iff] allI)
       (auto simp add: is_arc_walk_snoc case_prod_beta arc_walk_head_def)
   also have "... = {(u,v). (fst v,snd v@[u]) \<in> in_arcs ?HS x}"
     unfolding in_arcs_def graph_power_def by auto
   finally have S_alt: "S = {(u,v). (fst v,snd v@[u]) \<in> in_arcs ?HS x}" by simp
 
   have len_in_arcs: "a \<in> in_arcs ?HS x \<Longrightarrow> snd a \<noteq> []" for a
     unfolding in_arcs_def graph_power_def arc_walks_def by auto
 
   have 0:"bij_betw ?bij S (in_arcs ?HS x)"
     unfolding S_alt using len_in_arcs
     by (intro bij_betwI[where g="?bijr"]) auto
 
   have "HS.g_step f x = (\<Sum>y\<in>in_arcs ?HS x. f (tail ?HS y)/ d^(l+1))"
     unfolding HS.g_step_def graph_power_degree by simp
   also have "... = (\<Sum>y\<in>in_arcs ?HS x. f (fst y)/ d^(l+1))"
     unfolding graph_power_def by simp
-  also have "... = (\<Sum>y \<in> S. f (fst (?bij y))/ d^(l+1))" 
+  also have "... = (\<Sum>y \<in> S. f (fst (?bij y))/ d^(l+1))"
     by (intro sum.reindex_bij_betw[symmetric] 0)
-  also have "... = (\<Sum>y \<in> S. f (fst (snd y))/ d^(l+1))" 
+  also have "... = (\<Sum>y \<in> S. f (fst (snd y))/ d^(l+1))"
     by (intro_cong "[\<sigma>\<^sub>2 (/),\<sigma>\<^sub>1 f]" more: sum.cong) (simp add:case_prod_beta)
-  also have "...=(\<Sum>y\<in>(\<Union>a\<in>in_arcs G x. (Pair a)`in_arcs ?H (tail G a)). f (fst (snd y))/ d^(l+1))" 
+  also have "...=(\<Sum>y\<in>(\<Union>a\<in>in_arcs G x. (Pair a)`in_arcs ?H (tail G a)). f (fst (snd y))/ d^(l+1))"
     unfolding S_def by (intro sum.cong) auto
   also have "...=(\<Sum>a\<in>in_arcs G x. (\<Sum>y\<in>(Pair a)`in_arcs ?H (tail G a). f (fst (snd y))/ d^(l+1)))"
     by (intro sum.UNION_disjoint) auto
-  also have "... = (\<Sum>a \<in> in_arcs G x. (\<Sum>b \<in> in_arcs ?H (tail G a). f (fst b) / d^(l+1)))" 
+  also have "... = (\<Sum>a \<in> in_arcs G x. (\<Sum>b \<in> in_arcs ?H (tail G a). f (fst b) / d^(l+1)))"
     by (intro sum.cong sum.reindex_bij_betw) (auto simp add:bij_betw_def inj_on_def image_iff)
-  also have "... = (\<Sum>a \<in> in_arcs G x. (\<Sum>b \<in> in_arcs ?H (tail G a). f (tail ?H b) / d^l)/d)" 
+  also have "... = (\<Sum>a \<in> in_arcs G x. (\<Sum>b \<in> in_arcs ?H (tail G a). f (tail ?H b) / d^l)/d)"
     unfolding graph_power_def
     by (simp add:sum_divide_distrib algebra_simps)
-  also have "... = (\<Sum>a \<in> in_arcs G x. H.g_step f (tail G a)/ d)" 
+  also have "... = (\<Sum>a \<in> in_arcs G x. H.g_step f (tail G a)/ d)"
     unfolding H.g_step_def graph_power_degree by simp
   also have "... = (\<Sum>a \<in> in_arcs G x. (g_step^^l) f (tail G a)/ d)"
     by (intro sum.cong refl arg_cong2[where f="(/)"] Suc) auto
   also have "... = g_step ((g_step^^l) f) x"
     unfolding g_step_def by simp
   also have "... = (g_step^^(l+1)) f x"
     by simp
   finally show ?case by simp
 qed
 
 lemma (in regular_graph) graph_power_expansion:
   "regular_graph.\<Lambda>\<^sub>a (graph_power G l) \<le> \<Lambda>\<^sub>a^l"
 proof -
-  interpret H:regular_graph "graph_power G l" 
+  interpret H:regular_graph "graph_power G l"
     using graph_power_regular by auto
 
   have "\<bar>H.g_inner f (H.g_step f)\<bar> \<le> \<Lambda>\<^sub>a ^ l * (H.g_norm f)\<^sup>2" (is "?L \<le> ?R")
     if "H.g_inner f (\<lambda>_. 1) = 0"  for f
   proof -
     have "g_inner f (\<lambda>_. 1) = H.g_inner f (\<lambda>_.1)"
       unfolding g_inner_def H.g_inner_def
       by (intro sum.cong) (auto simp add:graph_power_def)
     also have "... = 0" using that by simp
     finally have 1:"g_inner f (\<lambda>_. 1) = 0" by simp
 
     have 2: "g_inner ((g_step^^l) f) (\<lambda>_. 1) = 0" for l
       using g_step_remains_orth 1 by (induction l, auto)
 
     have 0: "g_norm ((g_step^^l) f) \<le> \<Lambda>\<^sub>a ^ l * g_norm f"
     proof (induction l)
       case 0
       then show ?case by simp
     next
       case (Suc l)
       have "g_norm ((g_step ^^ Suc l) f) = g_norm (g_step ((g_step ^^ l) f))"
         by simp
       also have "... \<le> \<Lambda>\<^sub>a * g_norm (((g_step ^^ l) f))"
         by (intro expansionD2 2)
       also have "... \<le> \<Lambda>\<^sub>a * (\<Lambda>\<^sub>a^l * g_norm f)"
         by (intro mult_left_mono \<Lambda>_ge_0 Suc)
       also have "... = \<Lambda>\<^sub>a^(l+1) * g_norm f" by simp
       finally show ?case by simp
     qed
 
     have "?L = \<bar>g_inner f (H.g_step f)\<bar>"
-      unfolding H.g_inner_def g_inner_def 
+      unfolding H.g_inner_def g_inner_def
       by (intro_cong "[\<sigma>\<^sub>1 abs]" more:sum.cong) (auto simp add:graph_power_def)
     also have "... = \<bar>g_inner f ((g_step^^l) f)\<bar>"
       by (intro_cong "[\<sigma>\<^sub>1 abs]" more:g_inner_cong graph_power_step) auto
     also have "... \<le> g_norm f * g_norm ((g_step^^l) f)"
       by (intro g_inner_cauchy_schwartz)
     also have "... \<le> g_norm f * (\<Lambda>\<^sub>a ^ l * g_norm f)"
-      by (intro mult_left_mono 0 g_norm_nonneg) 
+      by (intro mult_left_mono 0 g_norm_nonneg)
     also have "... = \<Lambda>\<^sub>a ^ l * g_norm f^2"
       by (simp add:power2_eq_square)
-    also have "... = ?R" 
+    also have "... = ?R"
       unfolding g_norm_sq H.g_norm_sq g_inner_def H.g_inner_def
       by (intro_cong "[\<sigma>\<^sub>2 (*)]" more:sum.cong) (auto simp add:graph_power_def)
     finally show ?thesis by simp
   qed
-  moreover have " 0 \<le> \<Lambda>\<^sub>a ^ l" 
+  moreover have " 0 \<le> \<Lambda>\<^sub>a ^ l"
     using \<Lambda>_ge_0 by simp
 
   ultimately show ?thesis
-    by (intro H.expander_intro_1) auto 
+    by (intro H.expander_intro_1) auto
 qed
 
 unbundle no_intro_cong_syntax
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_Strongly_Explicit.thy b/thys/Expander_Graphs/Expander_Graphs_Strongly_Explicit.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Strongly_Explicit.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Strongly_Explicit.thy
@@ -1,1079 +1,1079 @@
 section \<open>Strongly Explicit Expander Graphs\label{sec:see}\<close>
 
 text \<open>In some applications, representing an expander graph using a data structure (for example
-as an adjacency lists) would be prohibitive. For such cases strongly explicit expander graphs (SEE) 
-are relevant. These are expander graphs, which can be represented implicitly using a function that 
-computes for each vertex its neighbors in space and time logarithmic w.r.t. to the size of the 
-graph. An application can for example sample a random walk, from a SEE using such a function 
-efficiently. An example of such a graph is the Margulis construction from 
+as an adjacency lists) would be prohibitive. For such cases strongly explicit expander graphs (SEE)
+are relevant. These are expander graphs, which can be represented implicitly using a function that
+computes for each vertex its neighbors in space and time logarithmic w.r.t. to the size of the
+graph. An application can for example sample a random walk, from a SEE using such a function
+efficiently. An example of such a graph is the Margulis construction from
 Section~\ref{sec:margulis}. This section presents the latter as a SEE but also shows that two graph
-operations that preserve the SEE property, in particular the graph power construction from 
-Section~\ref{sec:graph_power} and a compression scheme introduced by 
-Murtagh et al.~\cite[Theorem~20]{murtagh2019}. Combining all of the above it is possible to construct 
-strongly explicit expander graphs of \emph{every size} and spectral gap, which is formalized in 
+operations that preserve the SEE property, in particular the graph power construction from
+Section~\ref{sec:graph_power} and a compression scheme introduced by
+Murtagh et al.~\cite[Theorem~20]{murtagh2019}. Combining all of the above it is possible to construct
+strongly explicit expander graphs of \emph{every size} and spectral gap, which is formalized in
 Subsection~\ref{sec:see_standard}.\<close>
 
 theory Expander_Graphs_Strongly_Explicit
   imports Expander_Graphs_Power_Construction Expander_Graphs_MGG
 begin
 
 unbundle intro_cong_syntax
 no_notation Digraph.dominates ("_ \<rightarrow>\<index> _" [100,100] 40)
 
 record strongly_explicit_expander =
   see_size :: nat
   see_degree :: nat
   see_step :: "nat \<Rightarrow> nat \<Rightarrow> nat"
 
 definition graph_of :: "strongly_explicit_expander \<Rightarrow> (nat, (nat,nat) arc) pre_digraph"
-  where "graph_of e = 
-    \<lparr> verts = {..<see_size e}, 
+  where "graph_of e =
+    \<lparr> verts = {..<see_size e},
       arcs = (\<lambda>(v, i). Arc v (see_step e i v) i) ` ({..<see_size e} \<times> {..<see_degree e}),
       tail = arc_tail,
       head = arc_head \<rparr>"
 
 definition "is_expander e \<Lambda>\<^sub>a \<longleftrightarrow>
   regular_graph (graph_of e) \<and> regular_graph.\<Lambda>\<^sub>a (graph_of e) \<le> \<Lambda>\<^sub>a"
 
 lemma is_expander_mono:
   assumes "is_expander e a" "a \<le> b"
   shows "is_expander e b"
   using assms unfolding is_expander_def by auto
 
 lemma graph_of_finI:
   assumes "see_step e \<in> ({..<see_degree e} \<rightarrow> ({..<see_size e} \<rightarrow> {..<see_size e}))"
   shows "fin_digraph (graph_of e)"
 proof -
   let ?G = "graph_of e"
 
-  have "head ?G a \<in> verts ?G \<and> tail ?G a \<in> verts ?G" if "a \<in> arcs ?G" for a 
+  have "head ?G a \<in> verts ?G \<and> tail ?G a \<in> verts ?G" if "a \<in> arcs ?G" for a
     using assms that unfolding graph_of_def by (auto simp add:Pi_def)
 
   hence 0: "wf_digraph ?G"
     unfolding wf_digraph_def by auto
 
-  have 1: "finite (verts ?G)" 
+  have 1: "finite (verts ?G)"
     unfolding graph_of_def by simp
 
-  have 2: "finite (arcs ?G)" 
+  have 2: "finite (arcs ?G)"
     unfolding graph_of_def by simp
   show ?thesis
     using 0 1 2 unfolding fin_digraph_def fin_digraph_axioms_def by  auto
 qed
 
 lemma edges_graph_of:
   "edges(graph_of e)={#(v,see_step e i v). (v,i)\<in>#mset_set ({..<see_size e}\<times>{..<see_degree e})#}"
 proof -
   have 0:"mset_set ((\<lambda>(v, i). Arc v (see_step e i v) i) ` ({..<see_size e} \<times> {..<see_degree e}))
     = {# Arc v (see_step e i v) i. (v,i) \<in># mset_set ( {..<see_size e} \<times> {..<see_degree e})#}"
     by (intro image_mset_mset_set[symmetric] inj_onI) auto
 
-  have "edges (graph_of e) = 
+  have "edges (graph_of e) =
     {#(fst p, see_step e (snd p) (fst p)). p \<in># mset_set ({..<see_size e} \<times> {..<see_degree e})#}"
-    unfolding edges_def graph_of_def arc_to_ends_def using 0 
+    unfolding edges_def graph_of_def arc_to_ends_def using 0
     by (simp add:image_mset.compositionality comp_def case_prod_beta)
   also have "... = {#(v, see_step e i v). (v,i) \<in># mset_set ({..<see_size e} \<times> {..<see_degree e})#}"
     by (intro image_mset_cong) auto
   finally show ?thesis by simp
 qed
 
 lemma out_degree_see:
   assumes "v \<in> verts (graph_of e)"
   shows "out_degree (graph_of e) v = see_degree e" (is "?L = ?R")
 proof -
   let ?d = "see_degree e"
   let ?n = "see_size e"
-  have 0: "v < ?n" 
+  have 0: "v < ?n"
     using assms unfolding graph_of_def by simp
 
   have "?L = card {a. (\<exists>x\<in>{..<?n}. \<exists>y\<in>{..<?d}. a = Arc x (see_step e y x) y) \<and> arc_tail a = v}"
     unfolding out_degree_def out_arcs_def graph_of_def by (simp add:image_iff)
   also have "... = card {a. (\<exists>y\<in>{..<?d}. a = Arc v (see_step e y v) y)}"
     using 0 by (intro arg_cong[where f="card"]) auto
   also have "... = card ((\<lambda>y. Arc v (see_step e y v) y) ` {..<?d})"
     by (intro arg_cong[where f="card"] iffD2[OF set_eq_iff]) (simp add:image_iff)
   also have "... = card {..<?d}"
     by (intro card_image inj_onI) auto
   also have "... = ?d" by simp
   finally show ?thesis by simp
 qed
 
 lemma card_arc_walks_see:
   assumes "fin_digraph (graph_of e)"
   shows "card (arc_walks (graph_of e) n) = see_degree e^n * see_size e" (is "?L = ?R")
 proof -
   let ?G = "graph_of e"
   interpret fin_digraph ?G
     using assms by auto
   have "?L = card (\<Union>v \<in> verts ?G. {x. fst x = v \<and> is_arc_walk ?G v (snd x) \<and> length (snd x) = n})"
     unfolding arc_walks_def by (intro arg_cong[where f="card"]) auto
   also have "... = (\<Sum>v \<in> verts ?G. card {x. fst x=v\<and>is_arc_walk ?G v (snd x)\<and>length (snd x) = n})"
     using is_arc_walk_set[where G="?G"]
     by (intro card_UN_disjoint ballI finite_cartesian_product subsetI finite_lists_length_eq
         finite_subset[where B="verts ?G \<times> {x. set x \<subseteq> arcs ?G \<and> length x = n}"]) force+
   also have "... = (\<Sum>v \<in> verts ?G. out_degree (graph_power ?G n) v)"
-    unfolding out_degree_def graph_power_def out_arcs_def arc_walks_def 
+    unfolding out_degree_def graph_power_def out_arcs_def arc_walks_def
     by (intro sum.cong arg_cong[where f="card"]) auto
   also have "... = (\<Sum>v \<in> verts ?G. see_degree e^n)"
     by (intro sum.cong graph_power_out_degree' out_degree_see refl) (simp_all add: graph_power_def)
   also have "... = ?R"
     by (simp add:graph_of_def)
   finally show ?thesis by simp
 qed
 
 lemma regular_graph_degree_eq_see_degree:
   assumes "regular_graph (graph_of e)"
   shows "regular_graph.d (graph_of e) = see_degree e" (is "?L = ?R")
 proof -
   interpret regular_graph "graph_of e"
     using assms(1) by simp
   obtain v where v_set: "v \<in> verts (graph_of e)"
     using verts_non_empty by auto
-  hence "?L = out_degree (graph_of e) v" 
+  hence "?L = out_degree (graph_of e) v"
     using v_set reg by auto
   also have "... = see_degree e"
     by (intro out_degree_see v_set)
   finally show ?thesis by simp
 qed
 
 text \<open>The following introduces the compression scheme, described in \cite[Theorem 20]{murtagh2019}.\<close>
 
 fun see_compress :: "nat \<Rightarrow> strongly_explicit_expander \<Rightarrow> strongly_explicit_expander"
-  where "see_compress m e = 
+  where "see_compress m e =
     \<lparr> see_size = m, see_degree = see_degree e * 2
-    , see_step = (\<lambda>k v. 
-      if k < see_degree e 
-        then (see_step e k v) mod m 
+    , see_step = (\<lambda>k v.
+      if k < see_degree e
+        then (see_step e k v) mod m
         else (if v+m < see_size e then (see_step e (k-see_degree e) (v+m)) mod m else v)) \<rparr>"
 
 lemma edges_of_compress:
   fixes e m
   assumes "2*m \<ge> see_size e" "m \<le> see_size e"
   defines "A \<equiv> {# (x mod m, y mod m). (x,y) \<in># edges (graph_of e)#}"
   defines "B \<equiv> repeat_mset (see_degree e) {# (x,x). x \<in># (mset_set {see_size e - m..<m})#}"
   shows "edges (graph_of (see_compress m e)) = A + B" (is "?L = ?R")
 proof -
   let ?d = "see_degree e"
   let ?c = "see_step (see_compress m e)"
   let ?n = "see_size e"
   let ?s = "see_step e"
 
   have 7:"m \<le> v \<Longrightarrow> v < ?n \<Longrightarrow> v - m = v mod m" for v
     using assms by (simp add: le_mod_geq)
 
   let ?M = "mset_set ({..<m}\<times>{..<2*?d})"
   define M1 where "M1 = mset_set ({..<m} \<times> {..<?d})"
   define M2 where "M2 = mset_set ({..<?n-m} \<times> {?d..<2*?d})"
   define M3 where "M3 = mset_set ({?n-m..<m} \<times> {?d..<2*?d})"
 
   have "M2 = mset_set ((\<lambda>(x,y). (x-m,y+?d)) ` ({m..<?n} \<times> {..<?d}))"
-    using assms(2) unfolding M2_def map_prod_def[symmetric] atLeast0LessThan[symmetric] 
+    using assms(2) unfolding M2_def map_prod_def[symmetric] atLeast0LessThan[symmetric]
     by (intro arg_cong[where f="mset_set"] map_prod_surj_on[symmetric])
       (simp_all add:  image_minus_const_atLeastLessThan_nat mult_2)
   also have "... = image_mset (\<lambda>(x,y). (x-m,y+?d)) (mset_set ({m..<?n} \<times> {..<?d}))"
     by (intro image_mset_mset_set[symmetric] inj_onI) auto
   finally have M2_eq: "M2 = image_mset (\<lambda>(x,y). (x-m,y+?d)) (mset_set ({m..<?n} \<times> {..<?d}))"
     by simp
 
   have "?M = mset_set ({..<m}\<times>{..<?d} \<union> {..<?n-m}\<times>{?d..<2*?d} \<union> {?n-m..<m}\<times>{?d..<2*?d})"
     using assms(1,2) by (intro arg_cong[where f="mset_set"]) auto
   also have "... = mset_set ({..<m}\<times>{..<?d} \<union> {..<?n-m}\<times>{?d..<2*?d}) + M3"
     unfolding M3_def by (intro mset_set_Union) auto
   also have "... = M1 + M2 + M3"
     unfolding M1_def M2_def
     by (intro arg_cong2[where f="(+)"] mset_set_Union) auto
   finally have 0:"mset_set ({..<m} \<times> {..<2*?d}) = M1 + M2 + M3" by simp
 
   have 1:"{#(v,?c i v). (v,i)\<in>#M1#}={#(v mod m,?s i v mod m). (v,i)\<in>#mset_set ({..<m}\<times>{..<?d})#}"
     unfolding M1_def by (intro image_mset_cong) auto
 
   have "{#(v,?c i v).(v,i)\<in>#M2#}={#(fst x-m,?c(snd x+?d)(fst x-m)).x\<in>#mset_set({m..<?n}\<times>{..<?d})#}"
-    unfolding M2_eq 
+    unfolding M2_eq
     by (simp add:image_mset.compositionality comp_def case_prod_beta del:see_compress.simps)
   also have "... = {#(v - m,?s i v mod m). (v,i)\<in>#mset_set ({m..<?n}\<times>{..<?d})#}"
-    by (intro image_mset_cong) auto 
+    by (intro image_mset_cong) auto
   also have "... = {#(v mod m,?s i v mod m). (v,i)\<in>#mset_set ({m..<?n}\<times>{..<?d})#}"
-    using 7 by (intro image_mset_cong) auto 
+    using 7 by (intro image_mset_cong) auto
   finally have 2:
     "{#(v,?c i v). (v,i)\<in>#M2#}={#(v mod m,?s i v mod m). (v,i)\<in>#mset_set ({m..<?n}\<times>{..<?d})#}"
     by simp
 
   have "{#(v,?c i v). (v,i)\<in>#M3#} = {#(v,v). (v,i) \<in>#  mset_set ({?n-m..<m} \<times> {?d..<2*?d})#}"
     unfolding M3_def by (intro image_mset_cong) auto
   also have "... = concat_mset {#{#(x, x). xa \<in># mset_set {?d..<2 * ?d}#}. x \<in># mset_set {?n - m..<m}#}"
     by (subst mset_prod_eq) (auto simp:image_mset.compositionality image_concat_mset comp_def)
   also have "... = concat_mset {#replicate_mset ?d (x, x). x \<in># mset_set {?n - m..<m}#}"
     unfolding image_mset_const_eq by simp
   also have "... = B"
     unfolding B_def repeat_image_concat_mset by simp
   finally have 3:"{#(v,?c i v). (v,i)\<in>#M3#}=B" by simp
 
   have "A = {#(fst x mod m, ?s (snd x) (fst x) mod m). x \<in># mset_set ({..<?n} \<times> {..<?d})#}"
     unfolding A_def edges_graph_of by (simp add:image_mset.compositionality comp_def case_prod_beta)
   also have "... = {#(v mod m,?s i v mod m). (v,i)\<in>#mset_set({..<?n}\<times>{..<?d})#}"
     by (intro image_mset_cong) auto
   finally have 4: "A = {#(v mod m,?s i v mod m). (v,i)\<in>#mset_set({..<?n}\<times>{..<?d})#}"
     by simp
 
   have "?L = {# (v, ?c i v). (v,i) \<in># ?M #}"
     unfolding edges_graph_of by (simp add:ac_simps)
   also have "... = {#(v,?c i v). (v,i)\<in>#M1#}+{#(v,?c i v). (v,i)\<in>#M2#}+{#(v,?c i v). (v,i)\<in>#M3#}"
     unfolding 0 image_mset_union by simp
   also have "...={#(v mod m,?s i v mod m). (v,i)\<in>#mset_set({..<m}\<times>{..<?d}\<union>{m..<?n}\<times>{..<?d})#}+B"
     unfolding 1 2 3 image_mset_union[symmetric]
     by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 image_mset]" more: mset_set_Union[symmetric]) auto
   also have "...={#(v mod m,?s i v mod m). (v,i)\<in>#mset_set({..<?n}\<times>{..<?d})#}+B"
     using assms(2) by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 image_mset, \<sigma>\<^sub>1 mset_set]") auto
   also have "... = A + B"
     unfolding 4 by simp
   finally show ?thesis by simp
 qed
 
 lemma see_compress_sym:
   assumes "2*m \<ge> see_size e" "m \<le> see_size e"
   assumes "symmetric_multi_graph (graph_of e)"
   shows "symmetric_multi_graph (graph_of (see_compress m e))"
 proof -
   let ?c = "see_compress m e"
   let ?d = "see_degree e"
   let ?G = "graph_of e"
   let ?H = "graph_of (see_compress m e)"
 
   interpret G:"fin_digraph" "?G"
-    by (intro symmetric_multi_graphD2[OF assms(3)]) 
+    by (intro symmetric_multi_graphD2[OF assms(3)])
   interpret H:"fin_digraph" "?H"
     by (intro graph_of_finI) simp
 
   have deg_compres: "see_degree ?c = 2 * see_degree e"
     by simp
 
-  have 1: "card (arcs_betw ?H v w) = card (arcs_betw ?H w v)" (is "?L = ?R") 
-    if "v \<in> verts ?H" "w \<in> verts ?H" for v w 
+  have 1: "card (arcs_betw ?H v w) = card (arcs_betw ?H w v)" (is "?L = ?R")
+    if "v \<in> verts ?H" "w \<in> verts ?H" for v w
   proof -
     define b where "b =count {#(x, x). x \<in># mset_set {see_size e - m..<m}#} (v, w)"
 
     have b_alt_def: "b = count {#(x, x). x \<in># mset_set {see_size e - m..<m}#} (w, v)"
       unfolding b_def count_mset_exp
       by (simp add:case_prod_beta image_mset_filter_mset_swap[symmetric] ac_simps)
 
     have "?L = count (edges ?H) (v,w)"
       unfolding H.count_edges by simp
     also have "... = count {#(x mod m, y mod m). (x, y) \<in># edges (graph_of e)#} (v, w) + ?d * b"
       unfolding edges_of_compress[OF assms(1,2)] b_def by simp
     also have "... = count {#(snd e mod m, fst e mod m). e \<in># edges (graph_of e)#} (v, w) + ?d * b"
       by (subst G.edges_sym[OF assms(3),symmetric])
         (simp add:image_mset.compositionality comp_def case_prod_beta)
     also have "... = count {#(x mod m, y mod m). (x,y) \<in># edges (graph_of e)#} (w, v) + ?d * b"
-      unfolding count_mset_exp 
+      unfolding count_mset_exp
       by (simp add:image_mset_filter_mset_swap[symmetric] ac_simps case_prod_beta)
     also have "... = count (edges ?H) (w,v)"
       unfolding edges_of_compress[OF assms(1,2)] b_alt_def by simp
-    also have "... = ?R" 
+    also have "... = ?R"
       unfolding H.count_edges by simp
     finally show ?thesis by simp
   qed
 
   show ?thesis
     using 1 H.fin_digraph_axioms
     unfolding symmetric_multi_graph_def by auto
 qed
 
 lemma see_compress:
   assumes "is_expander e \<Lambda>\<^sub>a"
   assumes "2*m \<ge> see_size e" "m \<le> see_size e"
   shows "is_expander (see_compress m e) (\<Lambda>\<^sub>a/2 + 1/2)"
 proof -
   let ?H = "graph_of (see_compress m e)"
   let ?G = "graph_of e"
   let ?d = "see_degree e"
   let ?n = "see_size e"
 
-  interpret G:regular_graph "graph_of e" 
+  interpret G:regular_graph "graph_of e"
     using assms(1) is_expander_def by simp
 
   have d_eq: "?d = G.d"
     using regular_graph_degree_eq_see_degree[OF G.regular_graph_axioms] by simp
 
   have n_eq: "G.n = ?n"
     unfolding G.n_def by (simp add:graph_of_def)
 
   have n_gt_1: "?n > 0"
     using G.n_gt_0 n_eq by auto
 
   have "symmetric_multi_graph (graph_of (see_compress m e))"
     by (intro see_compress_sym assms(2,3) G.sym)
-  moreover have "see_size e > 0" 
+  moreover have "see_size e > 0"
     using G.verts_non_empty unfolding graph_of_def by auto
   hence "m > 0" using assms(2) by simp
-  hence "verts (graph_of (see_compress m e)) \<noteq> {}" 
+  hence "verts (graph_of (see_compress m e)) \<noteq> {}"
     unfolding graph_of_def by auto
-  moreover have 1:"0 < see_degree e" 
+  moreover have 1:"0 < see_degree e"
     using d_eq G.d_gt_0 by auto
   hence "0 < see_degree (see_compress m e)" by simp
   ultimately have 0:"regular_graph ?H"
     by (intro regular_graphI[where d="see_degree (see_compress m e)"] out_degree_see) auto
   interpret H:regular_graph ?H
     using 0 by auto
 
-  have "\<bar>\<Sum>a\<in>arcs ?H. f (head ?H a) * f (tail ?H a)\<bar> \<le> (real G.d * G.\<Lambda>\<^sub>a + G.d) * (H.g_norm f)\<^sup>2" 
+  have "\<bar>\<Sum>a\<in>arcs ?H. f (head ?H a) * f (tail ?H a)\<bar> \<le> (real G.d * G.\<Lambda>\<^sub>a + G.d) * (H.g_norm f)\<^sup>2"
     (is "?L \<le> ?R") if "H.g_inner f (\<lambda>_. 1) = 0" for f
   proof -
     define f' where "f' x = f (x mod m)" for x
     let ?L1 = "G.g_norm f'^2 + \<bar>\<Sum>x=?n-m..<m. f x^2\<bar>"
     let ?L2 = "G.g_inner f' (\<lambda>_.1)^2/ G.n + \<bar>\<Sum>x=?n-m..<m. f x^2\<bar>"
 
     have "?L1 = (\<Sum>x<?n. f (x mod m)^2) + \<bar>\<Sum>x=?n-m..<m. f x^2\<bar>"
       unfolding G.g_norm_sq G.g_inner_def f'_def by (simp add:graph_of_def power2_eq_square)
-    also have "... = (\<Sum>x\<in>{0..<m} \<union> {m..<?n}. f (x mod m)^2) + (\<Sum>x=?n-m..<m. f x^2)" 
+    also have "... = (\<Sum>x\<in>{0..<m} \<union> {m..<?n}. f (x mod m)^2) + (\<Sum>x=?n-m..<m. f x^2)"
       using assms(3) by (intro_cong "[\<sigma>\<^sub>2 (+)]" more:sum.cong abs_of_nonneg sum_nonneg) auto
     also have "...=(\<Sum>x=0..<m. f (x mod m)^2) + (\<Sum>x=m..<?n. f (x mod m)^2) + (\<Sum>x=?n-m..<m. f x^2)"
       by (intro_cong "[\<sigma>\<^sub>2 (+)]" more:sum.union_disjoint) auto
     also have "...  = (\<Sum>x=0..<m. f (x mod m)^2) + (\<Sum>x=0..<?n-m. f x^2) + (\<Sum>x=?n-m..<m. f x^2)"
       using assms(2,3)
       by (intro_cong "[\<sigma>\<^sub>2 (+)]" more: sum.reindex_bij_betw bij_betwI[where g="(\<lambda>x. x+m)"])
        (auto simp add:le_mod_geq)
     also have "... = (\<Sum>x=0..<m. f x^2) + (\<Sum>x=0..<?n-m. f x^2) + (\<Sum>x=?n-m..<m. f x^2)"
       by (intro sum.cong arg_cong2[where f="(+)"]) auto
     also have "... = (\<Sum>x=0..<m. f x^2) + ((\<Sum>x=0..<?n-m. f x^2) + (\<Sum>x=?n-m..<m. f x^2))"
       by simp
     also have "... = (\<Sum>x=0..<m. f x^2) + (\<Sum>x\<in>{0..<?n-m}\<union>{?n-m..<m}. f x^2)"
       by (intro sum.union_disjoint[symmetric] arg_cong2[where f="(+)"]) auto
     also have "... = (\<Sum>x<m. f x^2) + (\<Sum>x<m. f x^2)"
       using assms(2,3) by (intro arg_cong2[where f="(+)"] sum.cong) auto
     also have " ... = 2 * H.g_norm f^2"
       unfolding mult_2 H.g_norm_sq H.g_inner_def by (simp add:graph_of_def power2_eq_square)
     finally have 2:"?L1 = 2 * H.g_norm f^2" by simp
 
     have "?L2 = (\<Sum>x\<in>{..<m}\<union>{m..<?n}. f (x mod m))^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       unfolding G.g_inner_def f'_def using assms(2,3)
       by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/), \<sigma>\<^sub>2 (power)]" more: sum.cong abs_of_nonneg sum_nonneg)
        (auto simp add:graph_of_def)
     also have "...=((\<Sum>x<m. f (x mod m))+(\<Sum>x=m..<?n. f (x mod m)))^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/), \<sigma>\<^sub>2 (power)]" more:sum.union_disjoint) auto
     also have "...=((\<Sum>x<m. f (x mod m))+(\<Sum>x=0..<?n-m. f x))^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
-      using assms(2,3) by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/), \<sigma>\<^sub>2 (power)]" 
+      using assms(2,3) by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/), \<sigma>\<^sub>2 (power)]"
           more:sum.reindex_bij_betw bij_betwI[where g="(\<lambda>x. x+m)"]) (auto simp add:le_mod_geq)
     also have "...=(H.g_inner f (\<lambda>_. 1) +(\<Sum>x<?n-m. f x))^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       unfolding H.g_inner_def
-      by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/), \<sigma>\<^sub>2 (power)]" more: sum.cong) (auto simp:graph_of_def) 
+      by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/), \<sigma>\<^sub>2 (power)]" more: sum.cong) (auto simp:graph_of_def)
     also have "...=(\<Sum>x<?n-m. f x)^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       unfolding that by simp
     also have "...\<le> (\<Sum>x<?n-m. \<bar>f x\<bar> * \<bar>1\<bar>)^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       by (intro add_mono divide_right_mono iffD1[OF abs_le_square_iff]) auto
     also have "... \<le> (L2_set f {..<?n-m} * L2_set (\<lambda>_. 1) {..<?n-m})^2/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       by (intro add_mono divide_right_mono power_mono L2_set_mult_ineq sum_nonneg) auto
     also have "... = ((\<Sum>x <?n-m. f x^2) * (?n-m))/G.n + (\<Sum>x=?n-m..<m. f x^2)"
       unfolding power_mult_distrib L2_set_def real_sqrt_mult
       by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>2 (/),\<sigma>\<^sub>2 (*)]" more:real_sqrt_pow2 sum_nonneg) auto
     also have "... = (\<Sum>x <?n-m. f x^2) * ((?n-m)/?n) + (\<Sum>x=?n-m..<m. f x^2)"
       unfolding n_eq by simp
     also have "... \<le> (\<Sum>x <?n-m. f x^2) * 1 + (\<Sum>x=?n-m..<m. f x^2)"
       using assms(3) n_gt_1 by (intro mult_left_mono add_mono sum_nonneg) auto
     also have "... = (\<Sum>x\<in>{..<?n-m}\<union>{?n-m..<m}. f x^2)"
       unfolding mult_1_right by (intro sum.union_disjoint[symmetric]) auto
     also have "... = H.g_norm f^2"
-      using assms(2,3) unfolding H.g_norm_sq H.g_inner_def 
+      using assms(2,3) unfolding H.g_norm_sq H.g_inner_def
       by (intro sum.cong) (auto simp add:graph_of_def power2_eq_square)
     finally have 3:"?L2 \<le> H.g_norm f^2" by simp
 
     have "?L = \<bar>\<Sum>(u, v)\<in>#edges ?H. f v * f u\<bar>"
-      unfolding edges_def arc_to_ends_def sum_unfold_sum_mset 
+      unfolding edges_def arc_to_ends_def sum_unfold_sum_mset
       by (simp add:image_mset.compositionality comp_def del:see_compress.simps)
     also have "...=\<bar>(\<Sum>x \<in># edges ?G.f(snd x mod m)*f(fst x mod m))+(\<Sum>x=?n-m..<m.?d*(f x^2))\<bar>"
-      unfolding edges_of_compress[OF assms(2,3)]  sum_unfold_sum_mset 
-      by (simp add:image_mset.compositionality sum_mset_repeat comp_def 
+      unfolding edges_of_compress[OF assms(2,3)]  sum_unfold_sum_mset
+      by (simp add:image_mset.compositionality sum_mset_repeat comp_def
           case_prod_beta power2_eq_square del:see_compress.simps)
     also have "...=\<bar>(\<Sum>(u,v) \<in># edges ?G.f(u mod m)*f(v mod m))+(\<Sum>x=?n-m..<m.?d*(f x^2))\<bar>"
       by (intro_cong "[\<sigma>\<^sub>1 abs, \<sigma>\<^sub>2 (+), \<sigma>\<^sub>1 sum_mset]" more:image_mset_cong)
        (simp_all add:case_prod_beta)
     also have "... \<le> \<bar>\<Sum>(u,v) \<in># edges ?G.f(u mod m)*f(v mod m)\<bar>+\<bar>\<Sum>x=?n-m..<m.?d*(f x^2)\<bar> "
       by (intro abs_triangle_ineq)
     also have "... = ?d * (\<bar>\<Sum>(u,v) \<in># edges ?G.f(v mod m)*f(u mod m)\<bar>/G.d+\<bar>\<Sum>x=?n-m..<m.(f x^2)\<bar>)"
-      unfolding d_eq using G.d_gt_0 
+      unfolding d_eq using G.d_gt_0
       by (simp add:divide_simps ac_simps sum_distrib_left[symmetric] abs_mult)
-    also have "... = ?d * (\<bar>G.g_inner f' (G.g_step f')\<bar> + \<bar>\<Sum>x=?n-m..<m. f x^2\<bar>)" 
+    also have "... = ?d * (\<bar>G.g_inner f' (G.g_step f')\<bar> + \<bar>\<Sum>x=?n-m..<m. f x^2\<bar>)"
       unfolding G.g_inner_step_eq sum_unfold_sum_mset edges_def arc_to_ends_def f'_def
       by (simp add:image_mset.compositionality comp_def del:see_compress.simps)
     also have "...\<le> ?d * ((G.\<Lambda>\<^sub>a * G.g_norm f'^2 + (1-G.\<Lambda>\<^sub>a)*G.g_inner f' (\<lambda>_.1)^2/ G.n)
       + \<bar>\<Sum>x=?n-m..<m. f x^2\<bar>)"
       by (intro add_mono G.expansionD3 mult_left_mono) auto
     also have "... = ?d * (G.\<Lambda>\<^sub>a * ?L1 + (1 - G.\<Lambda>\<^sub>a) * ?L2)"
       by (simp add:algebra_simps)
     also have "... \<le> ?d * (G.\<Lambda>\<^sub>a * (2 * H.g_norm f^2) + (1-G.\<Lambda>\<^sub>a) * H.g_norm f^2)"
       unfolding 2 using G.\<Lambda>_ge_0 G.\<Lambda>_le_1 by (intro mult_left_mono add_mono 3) auto
     also have "... = ?R"
       unfolding d_eq[symmetric] by (simp add:algebra_simps)
     finally show ?thesis by simp
   qed
 
   hence "H.\<Lambda>\<^sub>a \<le> (G.d*G.\<Lambda>\<^sub>a+G.d)/H.d"
     using G.d_gt_0 G.\<Lambda>_ge_0 by (intro H.expander_intro) (auto simp del:see_compress.simps)
   also have "... = (see_degree e * G.\<Lambda>\<^sub>a + see_degree e) / (2* see_degree e)"
     unfolding d_eq[symmetric] regular_graph_degree_eq_see_degree[OF H.regular_graph_axioms]
     by simp
   also have "... = G.\<Lambda>\<^sub>a/2 + 1/2"
     using 1 by (simp add:field_simps)
   also have "... \<le> \<Lambda>\<^sub>a/2 + 1/2"
     using assms(1) unfolding is_expander_def by simp
   finally have "H.\<Lambda>\<^sub>a \<le> \<Lambda>\<^sub>a/2 + 1/2" by simp
   thus ?thesis unfolding is_expander_def using 0 by simp
 qed
 
 text \<open>The graph power of a strongly explicit expander graph is itself a strongly explicit expander
 graph.\<close>
 
 fun to_digits :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat list"
-  where 
+  where
     "to_digits _ 0 _ = []" |
     "to_digits b (Suc l) k = (k mod b)# to_digits b l (k div b)"
 
 fun from_digits :: "nat \<Rightarrow> nat list \<Rightarrow> nat"
   where
     "from_digits b [] = 0" |
     "from_digits b (x#xs) = x + b * from_digits b xs"
 
 lemma to_from_digits:
   assumes "length xs = n" "set xs \<subseteq> {..<b}"
   shows "to_digits b n (from_digits b xs) = xs"
 proof -
   have "to_digits b (length xs) (from_digits b xs) = xs"
-    using assms(2) by (induction xs, auto) 
+    using assms(2) by (induction xs, auto)
   thus ?thesis unfolding assms(1) by auto
 qed
 
 lemma from_digits_range:
   assumes "length xs = n" "set xs \<subseteq> {..<b}"
   shows "from_digits b xs < b^n"
 proof (cases "b > 0")
   case True
   have "from_digits b xs \<le> b^length xs - 1"
-    using assms(2) 
+    using assms(2)
   proof (induction xs)
     case Nil
     then show ?case by simp
   next
     case (Cons a xs)
     have "from_digits b (a # xs) =  a + b * from_digits b xs"
       by simp
     also have "... \<le> (b-1) + b * from_digits b xs"
       using Cons by (intro add_mono) auto
     also have "... \<le> (b-1) + b * (b^length xs-1)"
       using Cons(2) by (intro add_mono mult_left_mono Cons(1)) auto
     also have "... = b^length (a#xs) - 1"
       using True by (simp add:algebra_simps)
-    finally show "from_digits b (a # xs) \<le> b^length (a#xs) - 1" by simp 
+    finally show "from_digits b (a # xs) \<le> b^length (a#xs) - 1" by simp
   qed
   also have "... < b^n"
     using True assms(1) by simp
   finally show ?thesis by simp
-next 
+next
   case False
   hence "b = 0" by simp
   hence "xs = []"
     using assms(2) by simp
   thus ?thesis using assms(1) by simp
 qed
 
 lemma from_digits_inj:
   "inj_on (from_digits b) {xs. set xs \<subseteq> {..<b} \<and> length xs = n}"
   by (intro inj_on_inverseI[where g="to_digits b n"] to_from_digits) auto
-  
+
 fun see_power :: "nat \<Rightarrow> strongly_explicit_expander \<Rightarrow> strongly_explicit_expander"
   where "see_power l e =
     \<lparr> see_size = see_size e, see_degree = see_degree e^l
     , see_step = (\<lambda>k v. foldl (\<lambda>y x. see_step e x y) v (to_digits (see_degree e) l k)) \<rparr>"
 
 lemma graph_power_iso_see_power:
   assumes "fin_digraph (graph_of e)"
   shows "digraph_iso (graph_power (graph_of e) n) (graph_of (see_power n e))"
 proof -
   let ?G = "graph_of e"
   let ?P = "graph_power (graph_of e) n"
   let ?H = "graph_of (see_power n e)"
   let ?d = "see_degree e"
   let ?n = "see_size e"
 
   interpret fin_digraph "(graph_of e)"
     using assms by auto
 
   interpret P:fin_digraph ?P
     by (intro graph_power_fin)
 
-  define \<phi> where 
+  define \<phi> where
     "\<phi> = (\<lambda>(u,v). Arc u (arc_walk_head ?G (u, v)) (from_digits ?d (map arc_label v)))"
 
-  define iso where "iso = 
-    \<lparr> iso_verts = id, iso_arcs = \<phi>, iso_head = arc_head, iso_tail = arc_tail \<rparr>" 
+  define iso where "iso =
+    \<lparr> iso_verts = id, iso_arcs = \<phi>, iso_head = arc_head, iso_tail = arc_tail \<rparr>"
 
-  have "xs = ys" if "length xs = length ys" "map arc_label xs = map arc_label ys" 
+  have "xs = ys" if "length xs = length ys" "map arc_label xs = map arc_label ys"
     "is_arc_walk ?G u xs \<and> is_arc_walk ?G u ys \<and> u \<in> verts ?G" for xs ys u
     using that
   proof (induction xs ys arbitrary: u rule:list_induct2)
     case Nil
     then show ?case by simp
   next
     case (Cons x xs y ys)
     have "arc_label x = arc_label y" "u \<in> verts ?G" "x \<in> out_arcs ?G u" "y \<in> out_arcs ?G u"
       using Cons by auto
-    hence a:"x = y" 
+    hence a:"x = y"
       unfolding graph_of_def by auto
     moreover have "head ?G y \<in> verts ?G" using Cons by auto
-    ultimately have "xs = ys" 
+    ultimately have "xs = ys"
       using Cons(3,4) by (intro Cons(2)[of "head ?G y"]) auto
     thus ?case using a by auto
   qed
   hence 5:"inj_on (\<lambda>(u,v). (u, map arc_label v)) (arc_walks ?G n)"
     unfolding arc_walks_def by (intro inj_onI) auto
-  have 3:"set (map arc_label (snd xs)) \<subseteq> {..<?d}" "length (snd xs) = n" 
+  have 3:"set (map arc_label (snd xs)) \<subseteq> {..<?d}" "length (snd xs) = n"
     if "xs \<in> arc_walks ?G n" for xs
   proof -
     show "length (snd xs) = n"
       using subsetD[OF is_arc_walk_set[where G="?G"]] that unfolding arc_walks_def by auto
     have "set (snd xs) \<subseteq> arcs ?G"
       using subsetD[OF is_arc_walk_set[where G="?G"]] that unfolding arc_walks_def by auto
     thus "set (map arc_label (snd xs)) \<subseteq> {..<?d}"
       unfolding graph_of_def by auto
   qed
 
   hence 7:"inj_on (\<lambda>(u,v). (u, from_digits ?d (map arc_label v))) (arc_walks ?G n)"
     using inj_onD[OF 5] inj_onD[OF from_digits_inj] by (intro inj_onI) auto
 
   hence "inj_on \<phi> (arc_walks ?G n)"
     unfolding inj_on_def \<phi>_def by auto
-  hence "inj_on (iso_arcs iso) (arcs (graph_power (graph_of e) n))" 
+  hence "inj_on (iso_arcs iso) (arcs (graph_power (graph_of e) n))"
     unfolding iso_def graph_power_def by simp
-  moreover have "inj_on (iso_verts iso) (verts (graph_power (graph_of e) n))" 
+  moreover have "inj_on (iso_verts iso) (verts (graph_power (graph_of e) n))"
     unfolding iso_def by simp
-  moreover have 
+  moreover have
     "iso_verts iso (tail ?P a) = iso_tail iso (iso_arcs iso a)"
-    "iso_verts iso (head ?P a) = iso_head iso (iso_arcs iso a)" if "a \<in> arcs ?P" for a 
+    "iso_verts iso (head ?P a) = iso_head iso (iso_arcs iso a)" if "a \<in> arcs ?P" for a
     unfolding \<phi>_def iso_def graph_power_def by (simp_all add:case_prod_beta)
   ultimately have 0:"P.digraph_isomorphism iso"
-    unfolding P.digraph_isomorphism_def by (intro conjI ballI P.wf_digraph_axioms) auto 
+    unfolding P.digraph_isomorphism_def by (intro conjI ballI P.wf_digraph_axioms) auto
 
   have "card((\<lambda>(u, v).(u,from_digits ?d (map arc_label v)))`arc_walks ?G n)=card(arc_walks ?G n)"
     by (intro card_image 7)
   also have "... = ?d^n * ?n"
-    by (intro card_arc_walks_see fin_digraph_axioms) 
+    by (intro card_arc_walks_see fin_digraph_axioms)
   finally have "card((\<lambda>(u, v).(u,from_digits ?d (map arc_label v)))`arc_walks ?G n) = ?d^n * ?n"
     by simp
   moreover have "fst v \<in> {..<?n}" if "v \<in> arc_walks ?G n" for v
     using that unfolding arc_walks_def graph_of_def by auto
   moreover have "from_digits ?d (map arc_label (snd v)) < ?d ^ n" if "v \<in> arc_walks ?G n" for v
     using 3[OF that] by (intro from_digits_range) auto
 
-  ultimately have 2: 
-    "{..<?n}\<times>{..<?d^n} = (\<lambda>(u,v). (u, from_digits ?d (map arc_label v))) ` arc_walks ?G n" 
+  ultimately have 2:
+    "{..<?n}\<times>{..<?d^n} = (\<lambda>(u,v). (u, from_digits ?d (map arc_label v))) ` arc_walks ?G n"
     by (intro card_subset_eq[symmetric]) auto
 
-  have "foldl (\<lambda>y x. see_step e x y) u (map arc_label w) = arc_walk_head ?G (u,w)" 
-    if "is_arc_walk ?G u w" "u \<in> verts ?G" for u w 
+  have "foldl (\<lambda>y x. see_step e x y) u (map arc_label w) = arc_walk_head ?G (u,w)"
+    if "is_arc_walk ?G u w" "u \<in> verts ?G" for u w
     using that
   proof (induction w rule:rev_induct)
     case Nil
     then show ?case by (simp add:arc_walk_head_def)
   next
     case (snoc x xs)
-    hence "x \<in> arcs ?G" by (simp add:is_arc_walk_snoc) 
-    hence "see_step e (arc_label x) (tail ?G x) = (head ?G x)"  
+    hence "x \<in> arcs ?G" by (simp add:is_arc_walk_snoc)
+    hence "see_step e (arc_label x) (tail ?G x) = (head ?G x)"
       unfolding graph_of_def by (auto simp add:image_iff)
     also have "... = arc_walk_head (graph_of e) (u, xs @ [x])"
       unfolding arc_walk_head_def by simp
     finally have "see_step e (arc_label x) (tail ?G x) =  arc_walk_head (graph_of e) (u, xs @ [x])"
       by simp
     thus ?case using snoc by (simp add:is_arc_walk_snoc)
   qed
 
-  hence 4: "foldl (\<lambda>y x. see_step e x y) (fst x) (map arc_label (snd x)) = arc_walk_head ?G x" 
-    if "x \<in> arc_walks (graph_of e) n" for x 
+  hence 4: "foldl (\<lambda>y x. see_step e x y) (fst x) (map arc_label (snd x)) = arc_walk_head ?G x"
+    if "x \<in> arc_walks (graph_of e) n" for x
     using that unfolding arc_walks_def by (simp add:case_prod_beta)
 
   have "arcs ?H = (\<lambda>(v, i). Arc v (see_step (see_power n e) i v) i) ` ({..<?n}\<times>{..<?d^n})"
-    unfolding graph_of_def by simp 
-  also have "... = (\<lambda>(v,w). Arc v (see_step (see_power n e) (from_digits ?d (map arc_label w)) v) 
+    unfolding graph_of_def by simp
+  also have "... = (\<lambda>(v,w). Arc v (see_step (see_power n e) (from_digits ?d (map arc_label w)) v)
     (from_digits ?d (map arc_label w))) ` arc_walks ?G n"
     unfolding 2 image_image by (simp del:see_power.simps add: case_prod_beta comp_def)
-  also have "... = (\<lambda>(v,w). Arc v (foldl (\<lambda>y x. see_step e x y) v (map arc_label w)) 
+  also have "... = (\<lambda>(v,w). Arc v (foldl (\<lambda>y x. see_step e x y) v (map arc_label w))
     (from_digits ?d (map arc_label w))) ` arc_walks ?G n"
     using 3  by (intro image_cong refl) (simp add:case_prod_beta to_from_digits)
   also have "... = \<phi> ` arc_walks ?G n"
-    unfolding \<phi>_def using 4 by (simp add:case_prod_beta) 
+    unfolding \<phi>_def using 4 by (simp add:case_prod_beta)
   also have "... = iso_arcs iso ` arcs ?P"
     unfolding iso_def graph_power_def by simp
   finally have "arcs ?H = iso_arcs iso ` arcs ?P"
     by simp
   moreover have "verts ?H = iso_verts iso ` verts ?P"
     unfolding iso_def graph_of_def graph_power_def by simp
   moreover have "tail ?H = iso_tail iso"
     unfolding iso_def graph_of_def by simp
   moreover have "head ?H = iso_head iso"
     unfolding iso_def graph_of_def by simp
   ultimately have 1:"?H = app_iso iso ?P"
-    unfolding app_iso_def  
+    unfolding app_iso_def
     by (intro pre_digraph.equality) (simp_all del:see_power.simps)
 
-  show ?thesis 
+  show ?thesis
     using 0 1 unfolding digraph_iso_def by auto
 qed
 
 lemma see_power:
   assumes "is_expander e \<Lambda>\<^sub>a"
   shows "is_expander (see_power n e) (\<Lambda>\<^sub>a^n)"
 proof -
-  interpret G: "regular_graph" "graph_of e" 
+  interpret G: "regular_graph" "graph_of e"
     using assms unfolding is_expander_def by auto
 
   interpret H:"regular_graph" "graph_power (graph_of e) n"
     by (intro G.graph_power_regular)
 
   have 0:"digraph_iso (graph_power (graph_of e) n) (graph_of (see_power n e))"
-    by (intro graph_power_iso_see_power) auto 
+    by (intro graph_power_iso_see_power) auto
 
   have "regular_graph.\<Lambda>\<^sub>a (graph_of (see_power n e)) = H.\<Lambda>\<^sub>a"
     using H.regular_graph_iso_expansion[OF 0] by auto
   also have "... \<le> G.\<Lambda>\<^sub>a^n"
     by (intro G.graph_power_expansion)
   also have "... \<le> \<Lambda>\<^sub>a^n"
     using assms(1) unfolding is_expander_def
     by (intro power_mono G.\<Lambda>_ge_0)  auto
   finally have "regular_graph.\<Lambda>\<^sub>a (graph_of (see_power n e)) \<le> \<Lambda>\<^sub>a^n"
     by simp
   moreover have "regular_graph (graph_of (see_power n e))"
     using H.regular_graph_iso[OF 0] by auto
   ultimately show ?thesis
     unfolding is_expander_def by auto
 qed
 
 text \<open>The Margulis Construction from Section~\ref{sec:margulis} is a strongly explicit expander
 graph.\<close>
 
 definition mgg_vert :: "nat \<Rightarrow> nat \<Rightarrow> (int \<times> int)"
   where "mgg_vert n x = (x mod n, x div n)"
 
 definition mgg_vert_inv :: "nat \<Rightarrow> (int \<times> int) \<Rightarrow> nat"
   where "mgg_vert_inv n x = nat (fst x) + nat (snd x) * n"
 
 lemma mgg_vert_inv:
   assumes "n > 0" "x \<in> {0..<int n}\<times>{0..<int n}"
   shows "mgg_vert n (mgg_vert_inv n x) = x"
   using assms unfolding mgg_vert_def mgg_vert_inv_def by auto
 
 definition mgg_arc :: "nat \<Rightarrow> (nat \<times> int)"
   where "mgg_arc k = (k mod 4, if k \<ge> 4 then (-1) else 1)"
 
 definition mgg_arc_inv :: "(nat \<times> int) \<Rightarrow> nat"
   where "mgg_arc_inv x = (nat (fst x) + 4 * of_bool (snd x < 0))"
 
 lemma mgg_arc_inv:
   assumes  "x \<in> {..<4}\<times>{-1,1}"
   shows "mgg_arc (mgg_arc_inv x) = x"
   using assms unfolding mgg_arc_def mgg_arc_inv_def by auto
 
 definition see_mgg :: "nat \<Rightarrow> strongly_explicit_expander" where
-  "see_mgg n = \<lparr> see_size = n^2, see_degree = 8, 
+  "see_mgg n = \<lparr> see_size = n^2, see_degree = 8,
     see_step = (\<lambda>i v. mgg_vert_inv n (mgg_graph_step n (mgg_vert n v) (mgg_arc i))) \<rparr>"
 
 lemma mgg_graph_iso:
   assumes "n > 0"
   shows "digraph_iso (mgg_graph n) (graph_of (see_mgg n))"
 proof -
   let ?v = "mgg_vert n" let ?vi = "mgg_vert_inv n"
   let ?a = "mgg_arc" let ?ai = "mgg_arc_inv"
   let ?G = "graph_of (see_mgg n)" let ?s = "mgg_graph_step n"
 
   define \<phi> where "\<phi> a = Arc (?vi (arc_tail a)) (?vi (arc_head a)) (?ai (arc_label a))" for a
 
-  define iso where "iso = 
-    \<lparr> iso_verts = mgg_vert_inv n, iso_arcs = \<phi>, iso_head = arc_head, iso_tail = arc_tail \<rparr>" 
+  define iso where "iso =
+    \<lparr> iso_verts = mgg_vert_inv n, iso_arcs = \<phi>, iso_head = arc_head, iso_tail = arc_tail \<rparr>"
 
   interpret M: margulis_gaber_galil n
     using assms by unfold_locales
 
   have inj_vi: "inj_on ?vi (verts M.G)"
     unfolding mgg_graph_def mgg_vert_inv_def
     by (intro inj_on_inverseI[where g="mgg_vert n"]) (auto simp:mgg_vert_def)
   have "card (?vi ` verts M.G) = card (verts M.G)"
     by (intro card_image inj_vi)
   moreover have "card (verts M.G) = n\<^sup>2"
     unfolding mgg_graph_def by (auto simp:power2_eq_square)
-  moreover have "mgg_vert_inv n x \<in> {..<n\<^sup>2}" if "x \<in> verts M.G" for x 
+  moreover have "mgg_vert_inv n x \<in> {..<n\<^sup>2}" if "x \<in> verts M.G" for x
   proof -
     have "mgg_vert_inv n x = nat (fst x) + nat (snd x) * n"
       unfolding mgg_vert_inv_def by simp
     also have "... \<le> (n-1) + (n-1) * n"
       using that unfolding mgg_graph_def
       by (intro add_mono mult_right_mono) auto
     also have "... = n * n - 1" using assms by (simp add:algebra_simps)
     also have "... < n^2"
       using assms by (simp add: power2_eq_square)
     finally have "mgg_vert_inv n x < n^2" by simp
     thus ?thesis by simp
   qed
   ultimately have 0:"{..<n^2} = ?vi ` verts M.G"
     by (intro card_subset_eq[symmetric] image_subsetI) auto
 
   have inj_ai: "inj_on ?ai ({..<4} \<times> {-1,1})"
     unfolding mgg_arc_inv_def by (intro inj_onI) auto
   have "card (?ai ` ({..<4} \<times> {- 1, 1})) = card ({..<4::nat} \<times> {-1,1::int})"
     by (intro card_image inj_ai)
   hence 1:"{..<8} = ?ai ` ({..<4} \<times> {-1,1})"
     by (intro card_subset_eq[symmetric] image_subsetI) (auto simp add:mgg_arc_inv_def)
 
   have "arcs ?G = (\<lambda>(v, i). Arc v (?vi (?s (?v v) (?a i))) i) ` ({..<n\<^sup>2} \<times> {..<8})"
-    by (simp add:see_mgg_def graph_of_def) 
-  also have "... = (\<lambda>(v, i). Arc (?vi v) (?vi (?s (?v (?vi v)) (?a (?ai i)))) (?ai i)) ` 
+    by (simp add:see_mgg_def graph_of_def)
+  also have "... = (\<lambda>(v, i). Arc (?vi v) (?vi (?s (?v (?vi v)) (?a (?ai i)))) (?ai i)) `
     (verts M.G \<times> ({..<4} \<times> {-1,1}))"
     unfolding 0 1 mgg_arc_inv by (auto simp add:image_iff)
   also have "... = (\<lambda>(v, i). Arc (?vi v) (?vi (?s v i)) (?ai i)) ` (verts M.G \<times> ({..<4} \<times> {-1,1}))"
     using mgg_vert_inv[OF assms] mgg_arc_inv unfolding mgg_graph_def by (intro image_cong) auto
-  also have "... = (\<phi> \<circ> (\<lambda>(t, l). Arc t (?s t l) l)) ` (verts M.G \<times> ({..<4} \<times> {-1,1}))" 
+  also have "... = (\<phi> \<circ> (\<lambda>(t, l). Arc t (?s t l) l)) ` (verts M.G \<times> ({..<4} \<times> {-1,1}))"
     unfolding \<phi>_def by (intro image_cong refl) ( simp add:comp_def case_prod_beta )
-  also have "... = \<phi> ` arcs M.G" 
+  also have "... = \<phi> ` arcs M.G"
     unfolding mgg_graph_def by (simp add:image_image)
   also have "... = iso_arcs iso ` arcs (mgg_graph n)"
     unfolding iso_def by simp
-  finally have "arcs (graph_of (see_mgg n)) = iso_arcs iso ` arcs (mgg_graph n)" 
+  finally have "arcs (graph_of (see_mgg n)) = iso_arcs iso ` arcs (mgg_graph n)"
     by simp
   moreover have "verts ?G = iso_verts iso ` verts (mgg_graph n)"
-    unfolding iso_def graph_of_def see_mgg_def using 0 by simp 
+    unfolding iso_def graph_of_def see_mgg_def using 0 by simp
   moreover have "tail ?G = iso_tail iso"
     unfolding iso_def graph_of_def by simp
   moreover have "head ?G = iso_head iso"
     unfolding iso_def graph_of_def by simp
-  ultimately have 0:"?G = app_iso iso (mgg_graph n)" 
+  ultimately have 0:"?G = app_iso iso (mgg_graph n)"
     unfolding app_iso_def   by (intro pre_digraph.equality) simp_all
 
   have "inj_on \<phi> (arcs M.G)"
   proof (rule inj_onI)
     fix x y assume assms': "x \<in> arcs M.G" "y \<in> arcs M.G" "\<phi> x = \<phi> y"
 
     have "?vi (head M.G x) = ?vi (head M.G y)"
       using assms'(3) unfolding \<phi>_def mgg_graph_def by auto
     hence "head M.G x = head M.G y"
       using assms'(1,2) by (intro inj_onD[OF inj_vi]) auto
     hence "arc_head x = arc_head y"
       unfolding mgg_graph_def by simp
 
     moreover have "?vi (tail M.G x) = ?vi (tail M.G y)"
       using assms'(3) unfolding \<phi>_def mgg_graph_def by auto
     hence "tail M.G x = tail M.G y"
       using assms'(1,2) by (intro inj_onD[OF inj_vi]) auto
     hence "arc_tail x = arc_tail y"
       unfolding mgg_graph_def by simp
 
     moreover have "?ai (arc_label x) = ?ai (arc_label y)"
       using assms'(3) unfolding \<phi>_def by auto
     hence "arc_label x = arc_label y"
       using assms'(1,2) unfolding mgg_graph_def
       by (intro inj_onD[OF inj_ai]) (auto simp del:mgg_graph_step.simps)
 
     ultimately show "x = y"
       by (intro arc.expand) auto
   qed
-  hence "inj_on (iso_arcs iso) (arcs M.G)" 
+  hence "inj_on (iso_arcs iso) (arcs M.G)"
     unfolding iso_def by simp
-  moreover have "inj_on (iso_verts iso) (verts M.G)" 
+  moreover have "inj_on (iso_verts iso) (verts M.G)"
     using inj_vi unfolding iso_def by simp
-  moreover have 
-    "iso_verts iso (tail M.G a) = iso_tail iso (iso_arcs iso a)" 
+  moreover have
+    "iso_verts iso (tail M.G a) = iso_tail iso (iso_arcs iso a)"
     "iso_verts iso (head M.G a) = iso_head iso (iso_arcs iso a)"  if "a \<in> arcs M.G" for a
     unfolding iso_def \<phi>_def mgg_graph_def by auto
   ultimately have 1:"M.digraph_isomorphism iso"
     unfolding M.digraph_isomorphism_def by (intro conjI ballI M.wf_digraph_axioms) auto
 
   show ?thesis unfolding digraph_iso_def using 0 1 by auto
 qed
 
 lemma see_mgg:
   assumes "n > 0"
   shows "is_expander (see_mgg n) (5* sqrt 2 / 8)"
 proof -
-  interpret G: "margulis_gaber_galil" "n" 
+  interpret G: "margulis_gaber_galil" "n"
     using assms by unfold_locales auto
 
   note 0 = mgg_graph_iso[OF assms]
 
   have "regular_graph.\<Lambda>\<^sub>a (graph_of (see_mgg n)) = G.\<Lambda>\<^sub>a"
     using G.regular_graph_iso_expansion[OF 0] by auto
   also have "... \<le> (5* sqrt 2 / 8)"
     using G.mgg_numerical_radius unfolding G.MGG_bound_def by simp
   finally have "regular_graph.\<Lambda>\<^sub>a (graph_of (see_mgg n)) \<le> (5* sqrt 2 / 8)"
     by simp
   moreover have "regular_graph (graph_of (see_mgg n))"
     using G.regular_graph_iso[OF 0] by auto
   ultimately show ?thesis
     unfolding is_expander_def by auto
 qed
 
-text \<open>Using all of the above it is possible to construct strongly explicit expanders of every 
+text \<open>Using all of the above it is possible to construct strongly explicit expanders of every
 size and spectral gap with asymptotically optimal degree.\<close>
 
-definition see_standard_aux 
+definition see_standard_aux
   where "see_standard_aux n = see_compress n (see_mgg (nat \<lceil>sqrt n\<rceil>))"
 
 lemma see_standard_aux:
   assumes "n > 0"
-  shows 
+  shows
     "is_expander (see_standard_aux n) ((8+5 * sqrt 2) / 16)" (is "?A")
     "see_degree (see_standard_aux n) = 16" (is "?B")
     "see_size (see_standard_aux n) = n" (is "?C")
 proof -
   have 2:"sqrt (real n) > -1"
     by (rule less_le_trans[where y="0"]) auto
 
-  have 0:"real n \<le> of_int \<lceil>sqrt (real n)\<rceil>^2" 
+  have 0:"real n \<le> of_int \<lceil>sqrt (real n)\<rceil>^2"
     by (simp add:sqrt_le_D)
 
-  consider (a) "n = 1" | (b) "n \<ge> 2 \<and> n \<le> 4" | (c) "n \<ge> 5 \<and> n \<le> 9" | (d) "n \<ge> 10" 
+  consider (a) "n = 1" | (b) "n \<ge> 2 \<and> n \<le> 4" | (c) "n \<ge> 5 \<and> n \<le> 9" | (d) "n \<ge> 10"
     using assms by linarith
-  hence 1:"of_int \<lceil>sqrt (real n)\<rceil>^2 \<le> 2 * real n" 
+  hence 1:"of_int \<lceil>sqrt (real n)\<rceil>^2 \<le> 2 * real n"
   proof (cases)
     case a then show ?thesis by simp
   next
     case b
     hence "real_of_int \<lceil>sqrt (real n)\<rceil>^2 \<le> of_int \<lceil>sqrt (real 4)\<rceil>^2"
       using 2
       by (intro power_mono iffD2[OF of_int_le_iff] ceiling_mono iffD2[OF real_sqrt_le_iff]) auto
     also have "... = 2 * real 2" by simp
     also have "... \<le> 2 * real n"
       using b by (intro mult_left_mono) auto
     finally show ?thesis by simp
   next
     case c
     hence "real_of_int \<lceil>sqrt (real n)\<rceil>^2 \<le> of_int \<lceil>sqrt (real 9)\<rceil>^2"
       using 2
       by (intro power_mono iffD2[OF of_int_le_iff] ceiling_mono iffD2[OF real_sqrt_le_iff]) auto
     also have "... = 9" by simp
     also have "... \<le> 2 * real 5" by simp
     also have "... \<le> 2 * real n"
       using c by (intro mult_left_mono) auto
     finally show ?thesis by simp
   next
     case d
     have "real_of_int \<lceil>sqrt (real n)\<rceil>^2 \<le> (sqrt (real n)+1)^2"
       using 2 by (intro power_mono) auto
     also have "... = real n + sqrt (4 * real n + 0) + 1"
       using real_sqrt_pow2 by (simp add:power2_eq_square algebra_simps real_sqrt_mult)
     also have "... \<le> real n + sqrt (4 * real n + (real n * (real n - 6) + 1)) + 1"
       using d by (intro add_mono iffD2[OF real_sqrt_le_iff]) auto
     also have "... = real n + sqrt ((real n-1)^2) + 1"
       by (intro_cong "[\<sigma>\<^sub>2 (+), \<sigma>\<^sub>1 sqrt]") (auto simp add:power2_eq_square algebra_simps)
     also have "... = 2 * real n"
       using d by simp
     finally show ?thesis by simp
   qed
 
   have "real (nat \<lceil>sqrt (real n)\<rceil>^2) = of_int \<lceil>sqrt (real n)\<rceil>^2"
     unfolding of_nat_power using 2 by (simp add:not_less)
-  also have "... \<in> {real n..2 * real n}" 
+  also have "... \<in> {real n..2 * real n}"
     using 0 1 by auto
   also have "... = {real n..real (2*n)}" by simp
   finally have "real (nat \<lceil>sqrt (real n)\<rceil>^2) \<in> {real n..real (2*n)}" by simp
   hence "nat \<lceil>sqrt (real n)\<rceil>^2 \<in> {n..2*n}" by (simp del:of_nat_mult)
   hence "see_size (see_mgg (nat \<lceil>sqrt (real n)\<rceil>)) \<in> {n..2*n}"
     by (simp add:see_mgg_def)
   moreover have "sqrt (real n) > 0" using assms by simp
   hence "0 < nat \<lceil>sqrt (real n)\<rceil>" by simp
   ultimately have "is_expander (see_standard_aux n) ((5* sqrt 2 / 8)/2 + 1/2)"
     unfolding see_standard_aux_def by (intro see_compress see_mgg) auto
-  thus ?A 
+  thus ?A
     by (auto simp add:field_simps)
-  show ?B 
+  show ?B
     unfolding see_standard_aux_def by (simp add:see_mgg_def)
-  show ?C 
+  show ?C
     unfolding see_standard_aux_def by simp
 qed
 
 definition see_standard_power
   where "see_standard_power x  = (if x \<le> (0::real) then 0 else nat \<lceil>ln x / ln 0.95\<rceil>)"
 
 lemma see_standard_power:
   assumes "\<Lambda>\<^sub>a > 0"
   shows "0.95^(see_standard_power \<Lambda>\<^sub>a) \<le> \<Lambda>\<^sub>a" (is "?L \<le> ?R")
 proof (cases "\<Lambda>\<^sub>a \<le> 1")
   case True
-  hence "0 \<le> ln \<Lambda>\<^sub>a / ln 0.95" 
+  hence "0 \<le> ln \<Lambda>\<^sub>a / ln 0.95"
     using assms by (intro divide_nonpos_neg) auto
-  hence 1:"0 \<le> \<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>" 
+  hence 1:"0 \<le> \<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>"
     by simp
   have "?L = 0.95^nat \<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>"
     using assms unfolding see_standard_power_def by simp
   also have "... = 0.95 powr (of_nat (nat (\<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>)))"
-    by (subst powr_realpow) auto 
+    by (subst powr_realpow) auto
   also have "... = 0.95 powr \<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>"
     using 1 by (subst of_nat_nat) auto
   also have "... \<le> 0.95 powr (ln \<Lambda>\<^sub>a / ln 0.95)"
     by (intro powr_mono_rev) auto
   also have "... = ?R"
     using assms unfolding powr_def by simp
   finally show ?thesis by simp
 next
   case False
   hence "ln \<Lambda>\<^sub>a / ln 0.95 \<le> 0"
     by (subst neg_divide_le_eq) auto
   hence "see_standard_power \<Lambda>\<^sub>a = 0"
     unfolding see_standard_power_def by simp
   then show ?thesis using False by simp
 qed
 
-lemma see_standard_power_eval[code]: 
+lemma see_standard_power_eval[code]:
   "see_standard_power x = (if x \<le> 0 \<or> x \<ge> 1 then 0 else (1+see_standard_power (x/0.95)))"
 proof (cases "x \<le> 0 \<or> x \<ge> 1")
   case True
   have "ln x / ln (19 / 20) \<le> 0" if "x > 0"
   proof -
     have "x \<ge> 1" using that True by auto
     thus ?thesis
       by (intro divide_nonneg_neg) auto
   qed
   then show ?thesis using True unfolding see_standard_power_def by simp
 next
   case False
   hence x_range: "x > 0" "x < 1" by auto
 
-  have "ln (x / 0.95) < ln (1/0.95)" 
+  have "ln (x / 0.95) < ln (1/0.95)"
     using x_range by (intro iffD2[OF ln_less_cancel_iff]) auto
-  also have "... = - ln 0.95" 
+  also have "... = - ln 0.95"
     by (subst ln_div) auto
   finally have "ln (x / 0.95) < - ln 0.95" by simp
   hence 0: "-1 < ln (x / 0.95) / ln 0.95"
     by (subst neg_less_divide_eq)  auto
 
   have "see_standard_power x = nat \<lceil>ln x / ln 0.95\<rceil>"
-    using x_range unfolding see_standard_power_def by simp  
+    using x_range unfolding see_standard_power_def by simp
   also have "... = nat \<lceil>ln (x/0.95) / ln 0.95 + 1\<rceil>"
     by (subst ln_div[OF x_range(1)]) (simp_all add:field_simps )
   also have "... = nat (\<lceil>ln (x/0.95) / ln 0.95\<rceil>+1)"
     by (intro arg_cong[where f="nat"]) simp
   also have "... = 1 + nat \<lceil>ln (x/0.95) / ln 0.95\<rceil>"
     using 0 by (subst nat_add_distrib) auto
   also have "... = (if x \<le> 0 \<or> 1 \<le> x then 0 else 1 + see_standard_power (x/0.95))"
     unfolding see_standard_power_def using x_range by auto
   finally show ?thesis by simp
 qed
 
 definition see_standard :: "nat \<Rightarrow> real \<Rightarrow> strongly_explicit_expander"
   where "see_standard n \<Lambda>\<^sub>a = see_power (see_standard_power \<Lambda>\<^sub>a) (see_standard_aux n)"
 
 theorem see_standard:
   assumes "n > 0" "\<Lambda>\<^sub>a > 0"
   shows "is_expander (see_standard n \<Lambda>\<^sub>a) \<Lambda>\<^sub>a"
     and "see_size (see_standard n \<Lambda>\<^sub>a) = n"
     and "see_degree (see_standard n \<Lambda>\<^sub>a) = 16 ^ (nat \<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>)" (is "?C")
 proof -
   have 0:"is_expander (see_standard_aux n) 0.95"
     by (intro see_standard_aux(1)[OF assms(1)] is_expander_mono[where a="(8+5 * sqrt 2) / 16"])
      (approximation 10)
 
   show "is_expander (see_standard n \<Lambda>\<^sub>a) \<Lambda>\<^sub>a"
-    unfolding see_standard_def 
+    unfolding see_standard_def
     by (intro see_power 0 is_expander_mono[where a="0.95^(see_standard_power \<Lambda>\<^sub>a)"]
       see_standard_power assms(2))
   show "see_size (see_standard n \<Lambda>\<^sub>a) = n"
     unfolding see_standard_def using see_standard_aux[OF assms(1)] by simp
 
   have "see_degree (see_standard n \<Lambda>\<^sub>a) = 16 ^ (see_standard_power \<Lambda>\<^sub>a)"
-    unfolding see_standard_def using see_standard_aux[OF assms(1)] by simp 
+    unfolding see_standard_def using see_standard_aux[OF assms(1)] by simp
   also have "... = 16 ^ (nat \<lceil>ln \<Lambda>\<^sub>a / ln 0.95\<rceil>)"
     unfolding see_standard_power_def using assms(2) by simp
   finally show ?C by simp
 qed
 
 fun see_sample_walk :: "strongly_explicit_expander \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat list"
-  where 
+  where
     "see_sample_walk e 0 x = [x]" |
-    "see_sample_walk e (Suc l) x = (let w = see_sample_walk e l (x div (see_degree e)) in 
+    "see_sample_walk e (Suc l) x = (let w = see_sample_walk e l (x div (see_degree e)) in
       w@[see_step e (x mod (see_degree e)) (last w)])"
 
 theorem see_sample_walk:
   fixes e l
   assumes "fin_digraph (graph_of e)"
-  defines "r \<equiv> see_size e * see_degree e ^l" 
+  defines "r \<equiv> see_size e * see_degree e ^l"
   shows "{# see_sample_walk e l k. k \<in># mset_set {..<r} #} = walks' (graph_of e) l"
   unfolding r_def
 proof (induction l)
   case 0
   then show ?case unfolding graph_of_def by simp
 next
   case (Suc l)
   interpret fin_digraph "graph_of e"
     using assms(1) by auto
 
   let ?d = "see_degree e"
   let ?n = "see_size e"
   let ?w = "see_sample_walk e"
   let ?G = "graph_of e"
-  define r where "r = ?n * ?d^l" 
+  define r where "r = ?n * ?d^l"
 
   have 1: "{i * ?d..<(i + 1) * ?d} \<inter> {j * ?d..<(j + 1) * ?d} = {}" if "i \<noteq> j" for i j
     using that index_div_eq by blast
 
-  have 2:"vertices_from ?G x = {# see_step e i x. i \<in># mset_set {..<?d}#}" (is "?L = ?R") 
+  have 2:"vertices_from ?G x = {# see_step e i x. i \<in># mset_set {..<?d}#}" (is "?L = ?R")
     if "x \<in> verts ?G" for x
   proof -
-    have "x < ?n" 
+    have "x < ?n"
       using that unfolding graph_of_def by simp
     hence 1:"out_arcs ?G x = (\<lambda>i. Arc x (see_step e i x) i) ` {..<?d}"
       unfolding out_arcs_def graph_of_def by (auto simp add:image_iff set_eq_iff)
-    
+
     have "?L = {# arc_head a. a \<in># mset_set (out_arcs ?G x) #}"
       unfolding verts_from_alt by (simp add:graph_of_def)
-    also have "... = {# arc_head a. a \<in># {# Arc x (see_step e i x) i. i \<in># mset_set {..<?d}#}#} " 
-      unfolding 1 
+    also have "... = {# arc_head a. a \<in># {# Arc x (see_step e i x) i. i \<in># mset_set {..<?d}#}#} "
+      unfolding 1
       by (intro arg_cong2[where f= "image_mset"] image_mset_mset_set[symmetric] inj_onI) auto
     also have "... = ?R"
       by (simp add:image_mset.compositionality comp_def)
     finally show ?thesis by simp
   qed
 
   have "card (\<Union>w<r. {w * ?d..<(w + 1) *?d}) = (\<Sum>w < r. card {w * ?d..<(w + 1) *?d})"
     using 1 by (intro card_UN_disjoint) auto
   also have "... = r * ?d" by simp
   finally have "card (\<Union>w<r. {w * ?d..<(w + 1) *?d}) = card {..<?d * r}" by simp
-  moreover  have "?d + z * ?d \<le> ?d * r" if "z < r" for z 
-  proof - 
+  moreover  have "?d + z * ?d \<le> ?d * r" if "z < r" for z
+  proof -
     have "?d + z * ?d = ?d * (z + 1)" by simp
-    also have "... \<le> ?d * r" 
+    also have "... \<le> ?d * r"
       using that by (intro mult_left_mono) auto
     finally show ?thesis by simp
   qed
   ultimately have 0: "(\<Union>w<r. {w * ?d..<(w + 1) *?d}) = {..<?d * r}"
-    using order_less_le_trans by (intro card_subset_eq subsetI) auto 
+    using order_less_le_trans by (intro card_subset_eq subsetI) auto
 
   have "{# ?w (l+1) k. k \<in># mset_set {..<?n * ?d^(l+1)} #} = {#?w (l+1) k. k \<in># mset_set {..<?d * r}#}"
     unfolding r_def by (simp add:ac_simps)
   also have "... = {# ?w (l+1) x. x \<in># mset_set (\<Union>w<r. {w * ?d..<(w + 1) * ?d})#}"
     unfolding 0 by simp
   also have "... = image_mset (?w (l+1)) (concat_mset
      (image_mset (mset_set \<circ> (\<lambda>w. {w * ?d..<(w + 1) * ?d})) (mset_set {..<r})))"
     by (intro arg_cong2[where f="image_mset"] concat_disjoint_union_mset refl 1) auto
   also have "... = concat_mset{#{#?w (l+1) i. i\<in>#mset_set {w*?d..<(w+1)*?d}#}. w\<in>#mset_set {..<r}#}"
     by (simp add:image_concat_mset image_mset.compositionality comp_def del:see_sample_walk.simps)
   also have "...=concat_mset {#{#?w(l+1)i. i\<in>#mset_set ((+)(w*?d)`{..<?d})#}. w\<in>#mset_set {..<r}#}"
     by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset, \<sigma>\<^sub>1 mset_set]" more:ext)
      (simp add:  atLeast0LessThan[symmetric])
-  also have "... = concat_mset 
+  also have "... = concat_mset
     {#{#?w (l+1) i. i\<in>#image_mset ((+) (w*?d)) (mset_set {..<?d})#}. w\<in>#mset_set {..<r}#}"
-    by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset]" more:image_mset_cong 
+    by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset]" more:image_mset_cong
         image_mset_mset_set[symmetric] inj_onI) auto
   also have "... = concat_mset {#{#?w (l+1) (w*?d+i).i\<in>#mset_set {..<?d}#}. w\<in>#mset_set {..<r}#}"
     by (simp add:image_mset.compositionality comp_def del:see_sample_walk.simps)
-  also have "... = concat_mset 
+  also have "... = concat_mset
     {#{#?w l w@[see_step e i (last (?w l w))].i\<in>#mset_set {..<?d}#}.w\<in>#mset_set {..<r}#}"
     by (intro_cong "[\<sigma>\<^sub>1 concat_mset]" more:image_mset_cong) (simp add:Let_def)
   also have "... = concat_mset {#{#w@[see_step e i (last w)].i\<in>#mset_set {..<?d}#}.w\<in>#walks' ?G l#}"
     unfolding r_def Suc[symmetric] image_mset.compositionality comp_def by simp
-  also have "... = concat_mset 
+  also have "... = concat_mset
     {#{#w@[x].x\<in>#{# see_step e i (last w). i\<in>#mset_set {..<?d}#}#}. w \<in># walks' ?G l#}"
     unfolding image_mset.compositionality comp_def by simp
   also have "... = concat_mset {#{#w@[x].x\<in>#vertices_from ?G (last w)#}. w \<in># walks' ?G l#}"
     using last_in_set set_walks_2(1,2)
     by (intro_cong "[\<sigma>\<^sub>1 concat_mset, \<sigma>\<^sub>2 image_mset]" more:image_mset_cong 2[symmetric]) blast
   also have "... = walks' (graph_of e) (l+1)"
     by (simp add:image_mset.compositionality comp_def)
-  finally show ?case by simp 
+  finally show ?case by simp
 qed
 
 unbundle no_intro_cong_syntax
 
 end
diff --git a/thys/Expander_Graphs/Expander_Graphs_TTS.thy b/thys/Expander_Graphs/Expander_Graphs_TTS.thy
--- a/thys/Expander_Graphs/Expander_Graphs_TTS.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_TTS.thy
@@ -1,141 +1,141 @@
 section \<open>Setup for Types to Sets\label{sec:tts}\<close>
 
 theory Expander_Graphs_TTS
-  imports 
-    Expander_Graphs_Definition     
+  imports
+    Expander_Graphs_Definition
     "HOL-Analysis.Cartesian_Space"
     "HOL-Types_To_Sets.Types_To_Sets"
 begin
 
 text \<open>This section sets up a sublocale with the assumption that there is a finite type with the same
-cardinality as the vertex set of a regular graph. This allows defining the adjacency matrix for 
+cardinality as the vertex set of a regular graph. This allows defining the adjacency matrix for
 the graph using type-based linear algebra.
 
 Theorems shown in the sublocale that do not refer to the local type are then lifted to the
 @{locale regular_graph} locale using the Types-To-Sets mechanism.\<close>
 
 locale regular_graph_tts = regular_graph +
   fixes n_itself :: "('n :: finite) itself"
   assumes td: "\<exists>(f :: ('n \<Rightarrow> 'a)) g. type_definition f g (verts G)"
 begin
 
-definition td_components :: "('n \<Rightarrow> 'a) \<times> ('a \<Rightarrow> 'n)" 
+definition td_components :: "('n \<Rightarrow> 'a) \<times> ('a \<Rightarrow> 'n)"
   where "td_components = (SOME q. type_definition (fst q) (snd q) (verts G))"
 
 definition enum_verts where "enum_verts = fst td_components"
 definition enum_verts_inv where "enum_verts_inv = snd td_components"
 
 sublocale type_definition "enum_verts" "enum_verts_inv" "verts G"
 proof -
   have 0:"\<exists>q. type_definition ((fst q)::('n \<Rightarrow> 'a)) (snd q) (verts G)"
     using td by simp
   show "type_definition enum_verts enum_verts_inv (verts G)"
     unfolding td_components_def enum_verts_def enum_verts_inv_def using someI_ex[OF 0] by simp
 qed
 
 lemma enum_verts: "bij_betw enum_verts UNIV (verts G)"
   unfolding bij_betw_def by (simp add: Rep_inject Rep_range inj_on_def)
 
 text \<open>The stochastic matrix associated to the graph.\<close>
 
 definition A :: "('c::field)^'n^'n" where
   "A = (\<chi> i j. of_nat (count (edges G) (enum_verts j,enum_verts i))/of_nat d)"
 
 lemma card_n: "CARD('n) = n"
   unfolding n_def card by simp
 
 lemma symmetric_A: "transpose A = A"
 proof -
   have "A $ i $ j = A $ j $ i" for i j
     unfolding A_def count_edges arcs_betw_def using symmetric_multi_graphD[OF sym]
     by auto
   thus ?thesis
     unfolding transpose_def
     by (intro iffD2[OF vec_eq_iff] allI) auto
 qed
 
-lemma g_step_conv: 
+lemma g_step_conv:
   "(\<chi> i. g_step f (enum_verts i)) = A *v (\<chi> i. f (enum_verts i))"
 proof -
   have "g_step f (enum_verts i) = (\<Sum>j\<in>UNIV. A $ i $ j * f (enum_verts j))" (is "?L = ?R") for i
   proof -
     have "?L = (\<Sum>x\<in>in_arcs G (enum_verts i). f (tail G x) / d)"
       unfolding g_step_def by simp
     also have "... = (\<Sum>x\<in>#vertices_to G (enum_verts i). f x/d)"
       unfolding verts_to_alt sum_unfold_sum_mset by (simp add:image_mset.compositionality comp_def)
     also have "... = (\<Sum>j\<in>verts G. (count (vertices_to G (enum_verts i)) j) * (f j / real d))"
       by (intro sum_mset_conv_2 set_mset_vertices_to) auto
     also have "... = (\<Sum>j\<in>verts G. (count (edges G) (j,enum_verts i)) * (f j / real d))"
-      unfolding vertices_to_def count_mset_exp 
+      unfolding vertices_to_def count_mset_exp
       by (intro sum.cong arg_cong[where f="real"] arg_cong2[where f="(*)"])
        (auto simp add:filter_filter_mset image_mset_filter_mset_swap[symmetric] prod_eq_iff ac_simps)
     also have "...=(\<Sum>j\<in>UNIV.(count(edges G)(enum_verts j,enum_verts i))*(f(enum_verts j)/real d))"
       by (intro sum.reindex_bij_betw[symmetric] enum_verts)
     also have "... = ?R"
       unfolding A_def by simp
     finally show ?thesis by simp
   qed
   thus ?thesis
     unfolding matrix_vector_mult_def by (intro iffD2[OF vec_eq_iff] allI) simp
 qed
 
-lemma g_inner_conv: 
+lemma g_inner_conv:
   "g_inner f g = (\<chi> i. f (enum_verts i)) \<bullet> (\<chi> i. g (enum_verts i))"
   unfolding inner_vec_def g_inner_def vec_lambda_beta inner_real_def conjugate_real_def
   by (intro sum.reindex_bij_betw[symmetric] enum_verts)
 
-lemma g_norm_conv: 
+lemma g_norm_conv:
   "g_norm f = norm (\<chi> i. f (enum_verts i))"
 proof -
   have "g_norm f^2 = norm (\<chi> i. f (enum_verts i))^2"
     unfolding g_norm_sq power2_norm_eq_inner g_inner_conv by simp
   thus ?thesis
     using g_norm_nonneg norm_ge_zero by simp
 qed
 
 end
 
 lemma eg_tts_1:
   assumes "regular_graph G"
   assumes "\<exists>(f::('n::finite) \<Rightarrow> 'a) g. type_definition f g (verts G)"
   shows "regular_graph_tts TYPE('n) G"
-  using assms  
+  using assms
   unfolding regular_graph_tts_def  regular_graph_tts_axioms_def by auto
 
-context regular_graph 
+context regular_graph
 begin
 
 lemma remove_finite_premise_aux:
   assumes "\<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G)"
   shows "class.finite TYPE('n)"
 proof -
   obtain Rep :: "'n \<Rightarrow> 'a" and Abs where d:"type_definition Rep Abs (verts G)"
     using assms by auto
   interpret type_definition Rep Abs "verts G"
     using d by simp
-                              
-  have "finite (verts G)" by simp 
+
+  have "finite (verts G)" by simp
   thus ?thesis
     unfolding class.finite_def univ by auto
 qed
 
-lemma remove_finite_premise: 
-  "(class.finite TYPE('n) \<Longrightarrow> \<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G) \<Longrightarrow> PROP Q) 
-  \<equiv> (\<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G) \<Longrightarrow> PROP Q)" 
+lemma remove_finite_premise:
+  "(class.finite TYPE('n) \<Longrightarrow> \<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G) \<Longrightarrow> PROP Q)
+  \<equiv> (\<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G) \<Longrightarrow> PROP Q)"
   (is "?L \<equiv> ?R")
 proof (intro Pure.equal_intr_rule)
   assume e:"\<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G)" and l:"PROP ?L"
-  hence f: "class.finite TYPE('n)" 
+  hence f: "class.finite TYPE('n)"
     using remove_finite_premise_aux[OF e] by simp
 
   show "PROP ?R"
     using l[OF f] by auto
 next
   assume "\<exists>(Rep :: 'n  \<Rightarrow> 'a) Abs. type_definition Rep Abs (verts G)" and l:"PROP ?R"
   show "PROP ?L"
     using l by auto
 qed
 
 end
 
 end
\ No newline at end of file
diff --git a/thys/Expander_Graphs/Expander_Graphs_Walks.thy b/thys/Expander_Graphs/Expander_Graphs_Walks.thy
--- a/thys/Expander_Graphs/Expander_Graphs_Walks.thy
+++ b/thys/Expander_Graphs/Expander_Graphs_Walks.thy
@@ -1,580 +1,580 @@
 section \<open>Random Walks\label{sec:random_walks}\<close>
 
 theory Expander_Graphs_Walks
   imports
     Expander_Graphs_Algebra
     Expander_Graphs_Eigenvalues
     Expander_Graphs_TTS
     Constructive_Chernoff_Bound
-begin                           
+begin
 
 unbundle intro_cong_syntax
 
 no_notation Matrix.vec_index (infixl "$" 100)
 hide_const Matrix.vec_index
 hide_const Matrix.vec
 no_notation Matrix.scalar_prod  (infix "\<bullet>" 70)
 
 fun walks' :: "('a,'b) pre_digraph \<Rightarrow> nat \<Rightarrow> ('a list) multiset"
-  where 
+  where
     "walks' G 0 = image_mset (\<lambda>x. [x]) (mset_set (verts G))" |
-    "walks' G (Suc n) = 
-      concat_mset {#{#w @[z].z\<in># vertices_from G (last w)#}. w \<in># walks' G n#}" 
+    "walks' G (Suc n) =
+      concat_mset {#{#w @[z].z\<in># vertices_from G (last w)#}. w \<in># walks' G n#}"
 
 definition "walks G l = (case l of 0 \<Rightarrow> {#[]#} | Suc pl \<Rightarrow> walks' G pl)"
 
 lemma Union_image_mono: "(\<And>x. x \<in> A \<Longrightarrow> f x \<subseteq> g x) \<Longrightarrow> \<Union> (f ` A) \<subseteq> \<Union> (g ` A)"
   by auto
 
 context fin_digraph
 begin
 
 lemma count_walks':
   assumes "set xs \<subseteq> verts G"
   assumes "length xs = l+1"
   shows "count (walks' G l) xs = (\<Prod>i \<in> {..<l}. count (edges G) (xs ! i, xs ! (i+1)))"
 proof -
   have a:"xs \<noteq> []" using assms(2) by auto
 
   have "count (walks' G (length xs-1)) xs = (\<Prod>i<length xs -1. count (edges G) (xs ! i, xs ! (i + 1)))"
     using a assms(1)
   proof (induction xs rule:rev_nonempty_induct)
     case (single x)
     hence "x \<in> verts G" by simp
-    hence "count {#[x]. x \<in># mset_set (verts G)#} [x] = 1" 
-      by (subst count_image_mset_inj, auto simp add:inj_def) 
-    then show ?case by simp 
+    hence "count {#[x]. x \<in># mset_set (verts G)#} [x] = 1"
+      by (subst count_image_mset_inj, auto simp add:inj_def)
+    then show ?case by simp
   next
     case (snoc x xs)
     have set_xs: "set xs \<subseteq> verts G" using snoc by simp
 
-    define l where "l = length xs - 1" 
+    define l where "l = length xs - 1"
     have l_xs: "length xs = l + 1" unfolding l_def using snoc by simp
     have "count (walks' G (length (xs @ [x]) - 1)) (xs @ [x]) =
       (\<Sum>ys\<in>#walks' G l. count {#ys @ [z]. z \<in># vertices_from G (last ys)#} (xs @ [x]))"
       by (simp add:l_xs count_concat_mset image_mset.compositionality comp_def)
-    also have "... = (\<Sum>ys\<in>#walks' G l. 
+    also have "... = (\<Sum>ys\<in>#walks' G l.
       (if ys = xs then count {#xs @ [z]. z \<in># vertices_from G (last xs)#} (xs @ [x]) else 0))"
-      by (intro arg_cong[where f="sum_mset"] image_mset_cong) (auto intro!: count_image_mset_0_triv) 
+      by (intro arg_cong[where f="sum_mset"] image_mset_cong) (auto intro!: count_image_mset_0_triv)
     also have "... = (\<Sum>ys\<in>#walks' G l.(if ys=xs then count (vertices_from G (last xs)) x else 0))"
       by (subst count_image_mset_inj, auto simp add:inj_def)
     also have "... = count (walks' G l) xs * count (vertices_from G (last xs)) x"
       by (subst sum_mset_delta, simp)
     also have "... = count (walks' G l) xs * count (edges G) (last xs, x)"
-      unfolding vertices_from_def count_mset_exp image_mset_filter_mset_swap[symmetric] 
+      unfolding vertices_from_def count_mset_exp image_mset_filter_mset_swap[symmetric]
         filter_filter_mset by (simp add:prod_eq_iff)
     also have "... = count (walks' G l) xs * count (edges G) ((xs@[x])!l, (xs@[x])!(l+1))"
-      using snoc(1) unfolding l_def nth_append last_conv_nth[OF snoc(1)] by simp 
+      using snoc(1) unfolding l_def nth_append last_conv_nth[OF snoc(1)] by simp
     also have "... = (\<Prod>i<l+1. count (edges G) ((xs@[x])!i, (xs@[x])!(i+1)))"
       unfolding l_def snoc(2)[OF set_xs] by (simp add:nth_append)
     finally have "count (walks' G (length (xs @ [x]) - 1)) (xs @ [x]) =
        (\<Prod>i<length (xs@[x]) - 1. count (edges G) ((xs@[x])!i, (xs@[x])!(i+1)))"
       unfolding l_def using snoc(1) by simp
-    then show ?case by simp 
+    then show ?case by simp
   qed
   moreover have "l = length xs - 1" using a assms by simp
   ultimately show ?thesis by simp
 qed
 
 lemma count_walks:
   assumes "set xs \<subseteq> verts G"
   assumes "length xs = l" "l > 0"
   shows "count (walks G l) xs = (\<Prod>i \<in> {..<l-1}. count (edges G)  (xs ! i, xs ! (i+1)))"
   using assms unfolding walks_def by (cases l, auto simp add:count_walks')
 
 lemma set_walks':
   "set_mset (walks' G l) \<subseteq> {xs. set xs \<subseteq> verts G \<and> length xs = (l+1)}"
 proof (induction l)
   case 0
-  then show ?case by auto 
+  then show ?case by auto
 next
   case (Suc l)
 
   have "set_mset (walks' G (Suc l)) =
     (\<Union>x\<in>set_mset (walks' G l). (\<lambda>z. x @ [z]) ` set_mset (vertices_from G (last x)))"
     by (simp add:set_mset_concat_mset)
-  also have "... \<subseteq> (\<Union>x\<in>{xs. set xs \<subseteq> verts G \<and> length xs = l + 1}. 
+  also have "... \<subseteq> (\<Union>x\<in>{xs. set xs \<subseteq> verts G \<and> length xs = l + 1}.
     (\<lambda>z. x @ [z]) ` set_mset (vertices_from G (last x)))"
     by (intro Union_mono image_mono Suc)
   also have "... \<subseteq> (\<Union>x\<in>{xs. set xs \<subseteq> verts G \<and> length xs = l + 1}. (\<lambda>z. x @ [z]) ` verts G)"
     by (intro Union_image_mono image_mono set_mset_vertices_from)
   also have "... \<subseteq> {xs. set xs \<subseteq> verts G \<and> length xs = (Suc l + 1)}"
     by (intro subsetI) auto
   finally show ?case by simp
 qed
 
 lemma set_walks:
   "set_mset (walks G l) \<subseteq> {xs. set xs \<subseteq> verts G \<and> length xs = l}"
   unfolding walks_def using set_walks' by (cases l, auto)
 
 lemma set_walks_2:
   assumes  "xs \<in># walks' G l"
   shows "set xs \<subseteq> verts G" "xs \<noteq> []"
 proof -
   have a:"xs \<in> set_mset (walks' G l)"
     using assms by simp
   thus "set xs \<subseteq> verts G"
     using set_walks' by auto
   have "length xs \<noteq> 0"
     using set_walks' a by fastforce
   thus "xs \<noteq> []" by simp
 qed
 
 lemma set_walks_3:
   assumes "xs \<in># walks G l"
   shows  "set xs \<subseteq> verts G" "length xs = l"
   using set_walks assms by auto
 end
 
 lemma measure_pmf_of_multiset:
   assumes "A \<noteq> {#}"
-  shows "measure (pmf_of_multiset A) S = real (size (filter_mset (\<lambda>x. x \<in> S) A)) / size A" 
+  shows "measure (pmf_of_multiset A) S = real (size (filter_mset (\<lambda>x. x \<in> S) A)) / size A"
     (is "?L = ?R")
 proof -
   have "sum (count A) (S \<inter> set_mset A) = size (filter_mset (\<lambda>x. x \<in> S \<inter> set_mset A) A)"
     by (intro sum_count_2) simp
   also have "... = size (filter_mset (\<lambda>x. x \<in> S) A)"
     by (intro arg_cong[where f="size"] filter_mset_cong) auto
-  finally have a: "sum (count A) (S \<inter> set_mset A) = size (filter_mset (\<lambda>x. x \<in> S) A)" 
+  finally have a: "sum (count A) (S \<inter> set_mset A) = size (filter_mset (\<lambda>x. x \<in> S) A)"
     by simp
 
   have "?L = measure (pmf_of_multiset A) (S \<inter> set_mset A)"
     using assms by (intro measure_eq_AE AE_pmfI) auto
   also have "... = sum (pmf (pmf_of_multiset A)) (S \<inter> set_mset A)"
     by (intro measure_measure_pmf_finite) simp
   also have "... = (\<Sum>x \<in> S \<inter> set_mset A. count A x / size A)"
     using assms by (intro sum.cong, auto)
   also have "... = (\<Sum>x \<in> S \<inter> set_mset A. count A x) / size A"
     by (simp add:sum_divide_distrib)
-  also have "... = ?R" 
+  also have "... = ?R"
     using a by simp
   finally show ?thesis
     by simp
 qed
 
 lemma pmf_of_multiset_image_mset:
   assumes "A \<noteq> {#}"
   shows "pmf_of_multiset (image_mset f A) = map_pmf f (pmf_of_multiset A)"
-  using assms by (intro pmf_eqI) (simp add:pmf_map measure_pmf_of_multiset count_mset_exp 
+  using assms by (intro pmf_eqI) (simp add:pmf_map measure_pmf_of_multiset count_mset_exp
       image_mset_filter_mset_swap[symmetric])
 
 
-context regular_graph 
+context regular_graph
 begin
 
 lemma size_walks':
   "size (walks' G l) = card (verts G) * d^l"
 proof (induction l)
   case 0
   then show ?case by simp
 next
   case (Suc l)
   have a:"out_degree G (last x) = d" if "x \<in># walks' G l" for x
   proof -
-    have "last x \<in> verts G" 
+    have "last x \<in> verts G"
       using set_walks_2 that by fastforce
     thus ?thesis
       using reg by simp
   qed
 
   have "size (walks' G (Suc l)) = (\<Sum>x\<in>#walks' G l. out_degree G (last x))"
     by (simp add:size_concat_mset image_mset.compositionality comp_def verts_from_alt out_degree_def)
   also have "... = (\<Sum>x\<in>#walks' G l. d)"
     by (intro arg_cong[where f="sum_mset"] image_mset_cong a) simp
   also have "... = size (walks' G l) * d" by simp
   also have "... = card (verts G) * d^(Suc l)" using Suc by simp
   finally show ?case by simp
 qed
 
 lemma size_walks:
   "size (walks G l) = (if l > 0 then n * d^(l-1) else 1)"
   using size_walks' unfolding walks_def n_def by (cases l, auto)
 
-lemma walks_nonempty: 
+lemma walks_nonempty:
   "walks G l \<noteq> {#}"
 proof -
   have "size (walks G l) > 0"
-    unfolding size_walks using d_gt_0 n_gt_0 by auto 
+    unfolding size_walks using d_gt_0 n_gt_0 by auto
   thus "walks G l \<noteq> {#}"
     by auto
 qed
 
 end
 
 context regular_graph_tts
 begin
 
 lemma g_step_remains_orth:
   assumes "g_inner f (\<lambda>_. 1) = 0"
   shows "g_inner (g_step f) (\<lambda>_. 1) = 0" (is "?L = ?R")
 proof -
   have "?L = (A *v (\<chi> i. f (enum_verts i))) \<bullet> 1"
     unfolding g_inner_conv g_step_conv one_vec_def by simp
   also have "... = (\<chi> i. f (enum_verts i)) \<bullet> 1"
     by (intro markov_orth_inv markov)
   also have "... = g_inner f (\<lambda>_. 1)"
     unfolding g_inner_conv one_vec_def by simp
   also have "... = 0" using assms by simp
   finally show ?thesis by simp
 qed
 
 lemma spec_bound:
   "spec_bound A \<Lambda>\<^sub>a"
 proof -
   have "norm (A *v v) \<le> \<Lambda>\<^sub>a * norm v" if "v \<bullet> 1 = (0::real)" for v::"real^'n"
     unfolding \<Lambda>\<^sub>e_eq_\<Lambda>
     by (intro \<gamma>\<^sub>a_real_bound that)
   thus ?thesis
     unfolding spec_bound_def using \<Lambda>_ge_0 by auto
 qed
 
-text \<open>A spectral expansion rule that does not require orthogonality of the vector for the stationary 
+text \<open>A spectral expansion rule that does not require orthogonality of the vector for the stationary
 distribution:\<close>
 
 lemma expansionD3:
   "\<bar>g_inner f (g_step f)\<bar> \<le> \<Lambda>\<^sub>a * g_norm f^2 + (1-\<Lambda>\<^sub>a) * g_inner f (\<lambda>_. 1)^2 / n" (is "?L \<le> ?R")
 proof -
   define v where "v = (\<chi> i. f (enum_verts i))"
   define v1 :: "real^ 'n" where "v1 = ((v \<bullet> 1) / n) *\<^sub>R 1"
   define v2 :: "real^ 'n" where "v2 = v - v1"
   have v_eq: "v = v1 + v2"
     unfolding v2_def by simp
 
-  have 0: "A *v v1 = v1" 
-    unfolding v1_def using markov_apply[OF markov] 
+  have 0: "A *v v1 = v1"
+    unfolding v1_def using markov_apply[OF markov]
     by (simp add:algebra_simps)
-  have 1: "v1 v* A = v1" 
-    unfolding v1_def using markov_apply[OF markov] 
+  have 1: "v1 v* A = v1"
+    unfolding v1_def using markov_apply[OF markov]
     by (simp add:algebra_simps scaleR_vector_matrix_assoc)
 
   have "v2 \<bullet> 1 = v \<bullet> 1 - v1 \<bullet> 1"
     unfolding v2_def by (simp add:algebra_simps)
   also have "... = v \<bullet> 1  - v \<bullet> 1 * real CARD('n) / real n"
     unfolding v1_def by (simp add:inner_1_1)
   also have "... = 0 "
     using verts_non_empty unfolding card n_def by simp
   finally have 4:"v2 \<bullet> 1 = 0" by simp
   hence 2: "v1 \<bullet> v2 = 0"
     unfolding v1_def by (simp add:inner_commute)
 
   define f2 where "f2 i = v2 $ (enum_verts_inv i)" for i
   have f2_def: "v2 = (\<chi> i. f2 (enum_verts i))"
     unfolding f2_def Rep_inverse by simp
 
   have 6: "g_inner f2 (\<lambda>_. 1) = 0"
     unfolding g_inner_conv f2_def[symmetric] one_vec_def[symmetric] 4 by simp
 
   have "\<bar>v2 \<bullet> (A *v v2)\<bar> = \<bar>g_inner f2 (g_step f2)\<bar>"
     unfolding f2_def g_inner_conv g_step_conv by simp
   also have "... \<le> \<Lambda>\<^sub>a * (g_norm f2)\<^sup>2"
-    by (intro expansionD1 6) 
+    by (intro expansionD1 6)
   also have "... = \<Lambda>\<^sub>a * (norm v2)^2"
     unfolding g_norm_conv f2_def by simp
   finally have 5:"\<bar>v2 \<bullet> (A *v v2)\<bar> \<le> \<Lambda>\<^sub>a * (norm v2)\<^sup>2" by simp
 
   have 3: "norm (1 :: real^'n)^2 = n"
-    unfolding power2_norm_eq_inner inner_1_1 card n_def by presburger 
+    unfolding power2_norm_eq_inner inner_1_1 card n_def by presburger
 
   have "?L = \<bar>v \<bullet> (A *v v)\<bar>"
     unfolding g_inner_conv g_step_conv v_def by simp
   also have "... = \<bar>v1 \<bullet> (A *v v1) + v2 \<bullet> (A *v v1) + v1 \<bullet> (A *v v2) + v2 \<bullet> (A *v v2)\<bar>"
     unfolding v_eq by (simp add:algebra_simps)
   also have "... = \<bar>v1 \<bullet> v1 + v2 \<bullet> v1 + v1 \<bullet> v2 + v2 \<bullet> (A *v v2)\<bar>"
     unfolding dot_lmul_matrix[where x="v1",symmetric] 0 1 by simp
   also have "... = \<bar>v1 \<bullet> v1 + v2 \<bullet> (A *v v2)\<bar>"
     using 2 by (simp add:inner_commute)
   also have "... \<le> \<bar>norm v1^2\<bar> + \<bar>v2 \<bullet> (A *v v2)\<bar>"
     unfolding power2_norm_eq_inner by (intro abs_triangle_ineq)
   also have "... \<le> norm v1^2 + \<Lambda>\<^sub>a * norm v2^2"
     by (intro add_mono 5) auto
   also have "... = \<Lambda>\<^sub>a * (norm v1^2 + norm v2^2) + (1 - \<Lambda>\<^sub>a) * norm v1^2"
     by (simp add:algebra_simps)
   also have "... = \<Lambda>\<^sub>a * norm v^2 + (1 - \<Lambda>\<^sub>a) * norm v1^2"
     unfolding v_eq pythagoras[OF 2] by simp
   also have "... = \<Lambda>\<^sub>a * norm v^2 + ((1 - \<Lambda>\<^sub>a)) * ((v \<bullet> 1)^2*n)/n^2"
     unfolding v1_def by (simp add:power_divide power_mult_distrib 3)
   also have "... = \<Lambda>\<^sub>a * norm v^2 + ((1 - \<Lambda>\<^sub>a)/n) * (v \<bullet> 1)^2"
     by (simp add:power2_eq_square)
   also have "... = ?R"
     unfolding g_norm_conv g_inner_conv v_def one_vec_def by (simp add:field_simps)
   finally show ?thesis by simp
 qed
 
 definition ind_mat where "ind_mat S = diag (ind_vec (enum_verts -` S))"
 
 lemma walk_distr:
   "measure (pmf_of_multiset (walks G l)) {\<omega>. (\<forall>i<l. \<omega> ! i \<in> S i)} =
-  foldl (\<lambda>x M. M *v x) stat (intersperse A (map (\<lambda>i. ind_mat (S i)) [0..<l]))\<bullet>1" 
+  foldl (\<lambda>x M. M *v x) stat (intersperse A (map (\<lambda>i. ind_mat (S i)) [0..<l]))\<bullet>1"
   (is "?L = ?R")
 proof (cases "l > 0")
   case True
   let ?n = "real n"
   let ?d = "real d"
   let ?W = "{(w::'a list). set w \<subseteq> verts G \<and> length w = l}"
   let ?V = "{(w::'n list). length w = l}"
 
   have a: "set_mset (walks G l) \<subseteq> ?W"
     using set_walks by auto
   have b: "finite ?W"
     by (intro finite_lists_length_eq) auto
 
   define lp where "lp = l - 1"
 
   define xs where "xs = map (\<lambda>i. ind_mat (S i)) [0..<l]"
   have "xs \<noteq> []" unfolding xs_def using True by simp
   then obtain xh xt where xh_xt: "xh#xt=xs" by (cases xs, auto)
 
   have "length xs = l"
     unfolding xs_def by simp
-  hence len_xt: "length xt = lp" 
+  hence len_xt: "length xt = lp"
     using True unfolding xh_xt[symmetric] lp_def by simp
 
-  have "xh = xs ! 0" 
+  have "xh = xs ! 0"
     unfolding xh_xt[symmetric] by simp
   also have "... = ind_mat (S 0)"
     using True unfolding xs_def by simp
-  finally have xh_eq: "xh = ind_mat (S 0)" 
+  finally have xh_eq: "xh = ind_mat (S 0)"
     by simp
 
   have inj_map_enum_verts: "inj_on (map enum_verts) ?V"
     using bij_betw_imp_inj_on[OF enum_verts] inj_on_subset
     by (intro inj_on_mapI) auto
 
   have "card ?W = card (verts G)^l"
     by (intro card_lists_length_eq) simp
   also have "... = card {w. set w \<subseteq> (UNIV :: 'n set) \<and> length w  = l}"
     unfolding card[symmetric] by (intro card_lists_length_eq[symmetric]) simp
   also have "... = card ?V"
     by (intro arg_cong[where f="card"]) auto
   also have "... = card (map enum_verts ` ?V)"
     by (intro card_image[symmetric] inj_map_enum_verts)
   finally have "card ?W = card (map enum_verts ` ?V)"
     by simp
   hence "map enum_verts ` ?V = ?W"
     using bij_betw_apply[OF enum_verts]
     by (intro card_subset_eq b image_subsetI) auto
 
   hence bij_map_enum_verts: "bij_betw (map enum_verts) ?V ?W"
     using inj_map_enum_verts unfolding bij_betw_def by auto
 
   have "?L = size {# w \<in># walks G l. \<forall>i<l. w ! i \<in> S i #} / (?n * ?d^(l-1))"
     using True unfolding size_walks measure_pmf_of_multiset[OF walks_nonempty] by simp
   also have "... = (\<Sum>w\<in>?W. real (count (walks G l) w) * of_bool (\<forall>i<l. w!i \<in> S i))/(?n*?d^(l-1))"
     unfolding size_filter_mset_conv sum_mset_conv_2[OF a b] by simp
-  also have "... = (\<Sum>w\<in>?W. (\<Prod>i<l-1. real (count (edges G) (w!i,w!(i+1)))) * 
+  also have "... = (\<Sum>w\<in>?W. (\<Prod>i<l-1. real (count (edges G) (w!i,w!(i+1)))) *
                             (\<Prod>i<l. of_bool (w!i \<in> S i)))/(?n*?d^(l-1))"
     using True by (intro sum.cong arg_cong2[where f="(/)"]) (auto simp add: count_walks)
-  also have "... = 
+  also have "... =
     (\<Sum>w\<in>?W. (\<Prod>i<l-1. real (count (edges G) (w!i,w!(i+1)))/?d)*(\<Prod>i<l. of_bool (w!i \<in> S i)))/?n"
     using True unfolding prod_dividef by (simp add:sum_divide_distrib algebra_simps)
-  also have "... = 
-    (\<Sum>w\<in>?V. (\<Prod>i<l-1. count (edges G) (map enum_verts w!i,map enum_verts w!(i+1)) / ?d) * 
+  also have "... =
+    (\<Sum>w\<in>?V. (\<Prod>i<l-1. count (edges G) (map enum_verts w!i,map enum_verts w!(i+1)) / ?d) *
     (\<Prod>i<l. of_bool (map enum_verts w!i \<in> S i)))/?n"
     by (intro sum.reindex_bij_betw[symmetric] arg_cong2[where f="(/)"] refl bij_map_enum_verts)
-  also have "... = 
+  also have "... =
     (\<Sum>w\<in>?V. (\<Prod>i<lp. A $ w!(i+1) $ w!i) * (\<Prod>i<Suc lp. of_bool(enum_verts (w!i) \<in> S i)))/?n"
     unfolding A_def lp_def using True by simp
-  also have "... = (\<Sum>w\<in>?V. (\<Prod>i<lp. A $ w!(i+1) $ w!i) * 
+  also have "... = (\<Sum>w\<in>?V. (\<Prod>i<lp. A $ w!(i+1) $ w!i) *
     (\<Prod>i\<in>insert 0 (Suc ` {..<lp}). of_bool(enum_verts (w!i) \<in> S i)))/?n"
     using lessThan_Suc_eq_insert_0
     by (intro sum.cong arg_cong2[where f="(/)"] arg_cong2[where f="(*)"] prod.cong) auto
-  also have "... = (\<Sum>w\<in>?V. (\<Prod>i<lp. of_bool(enum_verts (w!(i+1))\<in>S(i+1))* A$ w!(i+1) $ w!i) 
+  also have "... = (\<Sum>w\<in>?V. (\<Prod>i<lp. of_bool(enum_verts (w!(i+1))\<in>S(i+1))* A$ w!(i+1) $ w!i)
     * of_bool(enum_verts(w!0)\<in>S 0))/?n"
     by (simp add:prod.reindex algebra_simps prod.distrib)
-  also have "... = 
+  also have "... =
     (\<Sum>w\<in>?V. (\<Prod>i<lp. (ind_mat (S (i+1))**A) $ w!(i+1) $ w!i) * of_bool(enum_verts (w!0)\<in>S 0))/?n"
     unfolding diag_def ind_vec_def matrix_matrix_mult_def ind_mat_def
-    by (intro sum.cong arg_cong2[where f="(/)"] arg_cong2[where f="(*)"] prod.cong refl) 
+    by (intro sum.cong arg_cong2[where f="(/)"] arg_cong2[where f="(*)"] prod.cong refl)
       (simp add:if_distrib if_distribR sum.If_cases)
-  also have "... = 
+  also have "... =
     (\<Sum>w\<in>?V. (\<Prod>i<lp. (xs!(i+1)**A) $ w!(i+1) $ w!i) * of_bool(enum_verts (w!0)\<in>S 0))/?n"
     unfolding xs_def lp_def True
-    by (intro sum.cong arg_cong2[where f="(/)"] arg_cong2[where f="(*)"] prod.cong refl) auto 
-  also have "... = 
+    by (intro sum.cong arg_cong2[where f="(/)"] arg_cong2[where f="(*)"] prod.cong refl) auto
+  also have "... =
     (\<Sum>w\<in>?V. (\<Prod>i<lp. (xt ! i ** A) $ w!(i+1) $ w!i) * of_bool(enum_verts (w!0)\<in>S 0))/?n"
     unfolding xh_xt[symmetric] by auto
   also have "... = (\<Sum>w\<in>?V. (\<Prod>i<lp. (xt!i**A)$ w!(i+1) $ w!i)*(ind_mat(S 0)*v stat) $w!0)"
     using n_def unfolding matrix_vector_mult_def diag_def stat_def ind_vec_def ind_mat_def card
     by (simp add:sum.If_cases if_distrib if_distribR sum_divide_distrib)
   also have "... = (\<Sum>w\<in>?V. (\<Prod>i<lp. (xt ! i ** A) $ w!(i+1) $ w!i) * (xh *v stat) $ w ! 0)"
     unfolding xh_eq by simp
-  also have "... = foldl (\<lambda>x M. M *v x) (xh *v stat) (map (\<lambda>x. x ** A) xt) \<bullet> 1" 
+  also have "... = foldl (\<lambda>x M. M *v x) (xh *v stat) (map (\<lambda>x. x ** A) xt) \<bullet> 1"
     using True unfolding foldl_matrix_mult_expand_2 by (simp add:len_xt lp_def)
-  also have "... = foldl (\<lambda>x M. M *v (A *v x)) (xh *v stat) xt \<bullet> 1" 
+  also have "... = foldl (\<lambda>x M. M *v (A *v x)) (xh *v stat) xt \<bullet> 1"
     by (simp add: matrix_vector_mul_assoc foldl_map)
-  also have "... = foldl (\<lambda>x M. M *v x) stat (intersperse A (xh#xt)) \<bullet> 1" 
+  also have "... = foldl (\<lambda>x M. M *v x) stat (intersperse A (xh#xt)) \<bullet> 1"
     by (subst foldl_intersperse_2, simp)
   also have "... = ?R"  unfolding xh_xt xs_def by simp
   finally show ?thesis by simp
 next
   case False
   hence "l = 0" by simp
   thus ?thesis unfolding stat_def by (simp add: inner_1_1)
 qed
 
 lemma hitting_property:
-  assumes "S \<subseteq> verts G" 
+  assumes "S \<subseteq> verts G"
   assumes "I \<subseteq> {..<l}"
   defines "\<mu> \<equiv> real (card S) / card (verts G)"
-  shows "measure (pmf_of_multiset (walks G l)) {w. set (nths w I) \<subseteq> S} \<le> (\<mu>+\<Lambda>\<^sub>a*(1-\<mu>))^card I" 
+  shows "measure (pmf_of_multiset (walks G l)) {w. set (nths w I) \<subseteq> S} \<le> (\<mu>+\<Lambda>\<^sub>a*(1-\<mu>))^card I"
     (is "?L \<le> ?R")
 proof -
-  define T where "T = (\<lambda>i. if i \<in> I then S else UNIV)" 
+  define T where "T = (\<lambda>i. if i \<in> I then S else UNIV)"
 
   have 0: "ind_mat UNIV = mat 1"
     unfolding ind_mat_def diag_def ind_vec_def Finite_Cartesian_Product.mat_def by vector
 
   have \<Lambda>_range: "\<Lambda>\<^sub>a \<in> {0..1}"
     using \<Lambda>_ge_0 \<Lambda>_le_1 by simp
 
-  have "S \<subseteq> range enum_verts" 
+  have "S \<subseteq> range enum_verts"
     using assms(1) enum_verts unfolding bij_betw_def by simp
-  moreover have "inj enum_verts" 
+  moreover have "inj enum_verts"
     using bij_betw_imp_inj_on[OF enum_verts] by simp
   ultimately have \<mu>_alt: "\<mu> = real (card (enum_verts -` S)) / CARD ('n)"
     unfolding \<mu>_def card by (subst card_vimage_inj) auto
 
   have "?L = measure (pmf_of_multiset (walks G l)) {w. \<forall>i<l. w ! i \<in> T i}"
     using walks_nonempty set_walks_3 unfolding T_def set_nths
     by (intro measure_eq_AE AE_pmfI) auto
-  also have "... = foldl (\<lambda>x M. M *v x) stat 
+  also have "... = foldl (\<lambda>x M. M *v x) stat
     (intersperse A (map (\<lambda>i. (if i \<in> I then ind_mat S else mat 1)) [0..<l])) \<bullet> 1"
     unfolding walk_distr T_def by (simp add:if_distrib if_distribR 0 cong:if_cong)
   also have "... \<le> ?R"
     unfolding \<mu>_alt ind_mat_def
     by (intro hitting_property_alg_2[OF \<Lambda>_range assms(2) spec_bound markov])
   finally show ?thesis by simp
 qed
 
 lemma uniform_property:
   assumes  "i < l" "x \<in> verts G"
-  shows "measure (pmf_of_multiset (walks G l)) {w. w ! i = x} = 1/real (card (verts G))" 
+  shows "measure (pmf_of_multiset (walks G l)) {w. w ! i = x} = 1/real (card (verts G))"
     (is "?L = ?R")
 proof -
-  obtain xi where xi_def: "enum_verts xi = x" 
+  obtain xi where xi_def: "enum_verts xi = x"
     using assms(2) bij_betw_imp_surj_on[OF enum_verts] by force
 
   define T where "T = (\<lambda>j. if j = i then {x} else UNIV)"
 
   have "diag (ind_vec UNIV) = mat 1"
     unfolding diag_def ind_vec_def Finite_Cartesian_Product.mat_def by vector
   moreover have "enum_verts -` {x} = {xi}"
     using bij_betw_imp_inj_on[OF enum_verts]
     unfolding vimage_def xi_def[symmetric] by (auto simp add:inj_on_def)
   ultimately have 0: "ind_mat (T j) = (if j = i then diag (ind_vec {xi}) else mat 1)" for j
     unfolding T_def ind_mat_def by (cases "j = i", auto)
 
   have "?L = measure (pmf_of_multiset (walks G l)) {w. \<forall>j < l. w ! j \<in> T j}"
     unfolding T_def using assms(1) by simp
   also have "... = foldl (\<lambda>x M. M *v x) stat (intersperse A (map (\<lambda>j. ind_mat (T j)) [0..<l])) \<bullet> 1"
     unfolding walk_distr by simp
   also have "... = 1/CARD('n)"
     unfolding 0 uniform_property_alg[OF assms(1) markov] by simp
-  also have "... = ?R" 
+  also have "... = ?R"
     unfolding card by simp
   finally show ?thesis  by simp
 qed
 
 end
 
 context regular_graph
 begin
 
-lemmas expansionD3 =  
+lemmas expansionD3 =
   regular_graph_tts.expansionD3[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
-lemmas g_step_remains_orth =  
+lemmas g_step_remains_orth =
   regular_graph_tts.g_step_remains_orth[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
-lemmas hitting_property =  
+lemmas hitting_property =
   regular_graph_tts.hitting_property[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
-lemmas uniform_property_2 =  
+lemmas uniform_property_2 =
   regular_graph_tts.uniform_property[OF eg_tts_1,
-    internalize_sort "'n :: finite", OF _ regular_graph_axioms, 
+    internalize_sort "'n :: finite", OF _ regular_graph_axioms,
     unfolded remove_finite_premise, cancel_type_definition, OF verts_non_empty]
 
 theorem uniform_property:
   assumes "i < l"
   shows "map_pmf (\<lambda>w. w ! i) (pmf_of_multiset (walks G l)) = pmf_of_set (verts G)" (is "?L = ?R")
 proof (rule pmf_eqI)
   fix x :: "'a"
   have a:"measure (pmf_of_multiset (walks G l)) {w. w ! i = x} = 0" (is "?L1 = ?R1")
     if "x \<notin> verts G"
   proof -
     have "?L1 \<le> measure (pmf_of_multiset (walks G l)) {w. set w \<subseteq> verts G \<and> x \<in> set w}"
       using walks_nonempty set_walks_3 assms(1)
-      by (intro measure_pmf.pmf_mono[OF refl]) auto
+      by (intro pmf_mono) auto
     also have "... \<le> measure (pmf_of_multiset (walks G l)) {}"
-      using that by (intro measure_pmf.pmf_mono[OF refl]) auto
+      using that by (intro pmf_mono) auto
     also have "... = 0" by simp
     finally have "?L1 \<le> 0" by simp
     thus ?thesis using measure_le_0_iff by blast
   qed
 
   have "pmf ?L x = measure (pmf_of_multiset (walks G l)) {w. w ! i = x}"
     unfolding pmf_map by (simp add:vimage_def)
   also have "... = indicator (verts G) x/real (card (verts G))"
     using uniform_property_2[OF assms(1)] a
     by (cases "x \<in> verts G", auto)
   also have "... = pmf ?R x"
-    using verts_non_empty by (intro pmf_of_set[symmetric]) auto 
+    using verts_non_empty by (intro pmf_of_set[symmetric]) auto
   finally show "pmf ?L x = pmf ?R x" by simp
 qed
 
 lemma uniform_property_gen:
   fixes S :: "'a set"
   assumes "S \<subseteq> verts G" "i < l"
   defines "\<mu> \<equiv> real (card S) / card (verts G)"
   shows "measure (pmf_of_multiset (walks G l)) {w. w ! i \<in> S} = \<mu>" (is "?L = ?R")
 proof -
 
   have "?L = measure (map_pmf (\<lambda>w. w ! i) (pmf_of_multiset (walks G l))) S"
     unfolding measure_map_pmf by (simp add:vimage_def)
   also have "... = measure (pmf_of_set (verts G)) S"
     unfolding uniform_property[OF assms(2)] by simp
   also have "... = ?R"
-    using verts_non_empty Int_absorb1[OF assms(1)] 
-    unfolding \<mu>_def by (subst measure_pmf_of_set) auto 
+    using verts_non_empty Int_absorb1[OF assms(1)]
+    unfolding \<mu>_def by (subst measure_pmf_of_set) auto
   finally show ?thesis by simp
 qed
 
 theorem kl_chernoff_property:
   assumes "l > 0"
   assumes "S \<subseteq> verts G"
   defines "\<mu> \<equiv> real (card S) / card (verts G)"
   assumes "\<gamma> \<le> 1" "\<mu> + \<Lambda>\<^sub>a * (1-\<mu>) \<in> {0<..\<gamma>}"
-  shows "measure (pmf_of_multiset (walks G l)) {w. real (card {i \<in> {..<l}. w ! i \<in> S}) \<ge> \<gamma>*l} 
+  shows "measure (pmf_of_multiset (walks G l)) {w. real (card {i \<in> {..<l}. w ! i \<in> S}) \<ge> \<gamma>*l}
     \<le> exp (- real l * KL_div \<gamma> (\<mu>+\<Lambda>\<^sub>a*(1-\<mu>)))" (is "?L \<le> ?R")
 proof -
   let ?\<delta> = "(\<Sum>i<l. \<mu>+\<Lambda>\<^sub>a*(1-\<mu>))/l"
 
   have a: "measure (pmf_of_multiset (walks G l)) {w. \<forall>i\<in>T. w ! i \<in> S} \<le> (\<mu> + \<Lambda>\<^sub>a*(1-\<mu>)) ^ card T"
-    (is "?L1 \<le> ?R1") if "T \<subseteq> {..<l}" for T 
+    (is "?L1 \<le> ?R1") if "T \<subseteq> {..<l}" for T
   proof -
     have "?L1 = measure (pmf_of_multiset (walks G l)) {w. set (nths w T) \<subseteq> S}"
       unfolding set_nths setcompr_eq_image using that set_walks_3 walks_nonempty
       by (intro measure_eq_AE AE_pmfI) (auto simp add:image_subset_iff)
     also have "... \<le> ?R1"
       unfolding \<mu>_def by (intro hitting_property[OF assms(2) that])
     finally show ?thesis by simp
   qed
- 
+
   have "?L \<le> exp ( - real l * KL_div \<gamma> ?\<delta>)"
     using assms(1,4,5) a by (intro impagliazzo_kabanets_pmf) simp_all
   also have "... = ?R" by simp
   finally show ?thesis by simp
 qed
 
 end
 
 unbundle no_intro_cong_syntax
 
 end
 
diff --git a/thys/Expander_Graphs/Extra_Congruence_Method.thy b/thys/Expander_Graphs/Extra_Congruence_Method.thy
--- a/thys/Expander_Graphs/Extra_Congruence_Method.thy
+++ b/thys/Expander_Graphs/Extra_Congruence_Method.thy
@@ -1,57 +1,57 @@
 subsection \<open>Congruence Method\<close>
 
 text \<open>The following is a method for proving equalities of large terms by checking the equivalence
 of subterms. It is possible to precisely control which operators to split by.\<close>
 
 theory Extra_Congruence_Method
-  imports 
-    Main 
+  imports
+    Main
     "HOL-Eisbach.Eisbach"
 begin
 
 datatype cong_tag_type = CongTag
 
-definition cong_tag_1 :: "('a \<Rightarrow> 'b) \<Rightarrow> cong_tag_type" 
+definition cong_tag_1 :: "('a \<Rightarrow> 'b) \<Rightarrow> cong_tag_type"
   where "cong_tag_1 x = CongTag"
 definition cong_tag_2 :: "('a \<Rightarrow> 'b \<Rightarrow> 'c) \<Rightarrow> cong_tag_type"
   where "cong_tag_2 x = CongTag"
-definition cong_tag_3 :: "('a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'd) \<Rightarrow> cong_tag_type" 
+definition cong_tag_3 :: "('a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'd) \<Rightarrow> cong_tag_type"
   where "cong_tag_3 x = CongTag"
 
 lemma arg_cong3:
   assumes "x1 = x2" "y1 = y2" "z1 = z2"
   shows "f x1 y1 z1 = f x2 y2 z2"
   using assms by auto
 
-method intro_cong for A :: "cong_tag_type list" uses more = 
-  (match (A) in 
-      "cong_tag_1 f#h" (multi) for f :: "'a \<Rightarrow> 'b" and h 
+method intro_cong for A :: "cong_tag_type list" uses more =
+  (match (A) in
+      "cong_tag_1 f#h" (multi) for f :: "'a \<Rightarrow> 'b" and h
         \<Rightarrow> \<open>intro_cong h more:more arg_cong[where f="f"]\<close>
-    \<bar> "cong_tag_2 f#h" (multi) for f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c" and h 
+    \<bar> "cong_tag_2 f#h" (multi) for f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c" and h
         \<Rightarrow> \<open>intro_cong h more:more arg_cong2[where f="f"]\<close>
-    \<bar> "cong_tag_3 f#h" (multi) for f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'd" and h 
+    \<bar> "cong_tag_3 f#h" (multi) for f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'd" and h
         \<Rightarrow> \<open>intro_cong h more:more arg_cong3[where f="f"]\<close>
     \<bar> _ \<Rightarrow> \<open>intro more refl\<close>)
 
 bundle intro_cong_syntax
 begin
   notation cong_tag_1 ("\<sigma>\<^sub>1")
   notation cong_tag_2 ("\<sigma>\<^sub>2")
   notation cong_tag_3 ("\<sigma>\<^sub>3")
 end
 
 bundle no_intro_cong_syntax
 begin
   no_notation cong_tag_1 ("\<sigma>\<^sub>1")
   no_notation cong_tag_2 ("\<sigma>\<^sub>2")
   no_notation cong_tag_3 ("\<sigma>\<^sub>3")
 end
 
 lemma restr_Collect_cong:
   assumes "\<And>x. x \<in> A \<Longrightarrow> P x = Q x"
   shows "{x \<in> A. P x} = {x \<in> A. Q x}"
   using assms by auto
 
 end
 
 
diff --git a/thys/Expander_Graphs/ROOT b/thys/Expander_Graphs/ROOT
--- a/thys/Expander_Graphs/ROOT
+++ b/thys/Expander_Graphs/ROOT
@@ -1,25 +1,26 @@
 chapter AFP
 
-session Expander_Graphs = Frequency_Moments +
+session Expander_Graphs = "HOL-Probability" +
   options [timeout = 1200]
   sessions
     Graph_Theory
     Perron_Frobenius
     Commuting_Hermitian
     Weighted_Arithmetic_Geometric_Mean
+    Universal_Hash_Families
   theories
     Constructive_Chernoff_Bound
     Expander_Graphs_Algebra
     Expander_Graphs_Cheeger_Inequality
     Expander_Graphs_Definition
     Expander_Graphs_Eigenvalues
     Expander_Graphs_MGG
     Expander_Graphs_Multiset_Extras
     Expander_Graphs_Power_Construction
     Expander_Graphs_Strongly_Explicit
     Expander_Graphs_TTS
     Expander_Graphs_Walks
     Extra_Congruence_Method
   document_files
     "root.tex"
     "root.bib"
diff --git a/thys/Frequency_Moments/Frequency_Moment_0.thy b/thys/Frequency_Moments/Frequency_Moment_0.thy
--- a/thys/Frequency_Moments/Frequency_Moment_0.thy
+++ b/thys/Frequency_Moments/Frequency_Moment_0.thy
@@ -1,1314 +1,1315 @@
 section \<open>Frequency Moment $0$\label{sec:f0}\<close>
 
 theory Frequency_Moment_0
   imports
     Frequency_Moments_Preliminary_Results
-    Median_Method.Median 
-    K_Smallest 
+    Median_Method.Median
+    K_Smallest
     Universal_Hash_Families.Carter_Wegman_Hash_Family
     Frequency_Moments
-    Landau_Ext 
+    Landau_Ext
+    Probability_Ext
     Product_PMF_Ext
     Universal_Hash_Families.Universal_Hash_Families_More_Finite_Fields
 begin
 
 text \<open>This section contains a formalization of a new algorithm for the zero-th frequency moment
 inspired by ideas described in \<^cite>\<open>"baryossef2002"\<close>.
-It is a KMV-type ($k$-minimum value) algorithm with a rounding method and matches the space complexity 
+It is a KMV-type ($k$-minimum value) algorithm with a rounding method and matches the space complexity
 of the best algorithm described in \<^cite>\<open>"baryossef2002"\<close>.
 
 In addition to the Isabelle proof here, there is also an informal hand-written proof in
 Appendix~\ref{sec:f0_proof}.\<close>
 
 type_synonym f0_state = "nat \<times> nat \<times> nat \<times> nat \<times> (nat \<Rightarrow> nat list) \<times> (nat \<Rightarrow> float set)"
 
 definition hash where "hash p = ring.hash (mod_ring p)"
 
 fun f0_init :: "rat \<Rightarrow> rat \<Rightarrow> nat \<Rightarrow> f0_state pmf" where
   "f0_init \<delta> \<epsilon> n =
     do {
       let s = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil>;
       let t = nat \<lceil>80 / (real_of_rat \<delta>)\<^sup>2\<rceil>;
       let p = prime_above (max n 19);
-      let r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23); 
+      let r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23);
       h \<leftarrow> prod_pmf {..<s} (\<lambda>_. pmf_of_set (bounded_degree_polynomials (mod_ring p) 2));
       return_pmf (s, t, p, r, h, (\<lambda>_ \<in> {0..<s}. {}))
     }"
 
 fun f0_update :: "nat \<Rightarrow> f0_state \<Rightarrow> f0_state pmf" where
-  "f0_update x (s, t, p, r, h, sketch) = 
+  "f0_update x (s, t, p, r, h, sketch) =
     return_pmf (s, t, p, r, h, \<lambda>i \<in> {..<s}.
       least t (insert (float_of (truncate_down r (hash p x (h i)))) (sketch i)))"
 
 fun f0_result :: "f0_state \<Rightarrow> rat pmf" where
   "f0_result (s, t, p, r, h, sketch) = return_pmf (median s (\<lambda>i \<in> {..<s}.
       (if card (sketch i) < t then of_nat (card (sketch i)) else
         rat_of_nat t* rat_of_nat p / rat_of_float (Max (sketch i)))
     ))"
 
 fun f0_space_usage :: "(nat \<times> rat \<times> rat) \<Rightarrow> real" where
   "f0_space_usage (n, \<epsilon>, \<delta>) = (
-    let s = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil> in 
+    let s = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil> in
     let r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23) in
     let t = nat \<lceil>80 / (real_of_rat \<delta>)\<^sup>2 \<rceil> in
     6 +
     2 * log 2 (real s + 1) +
     2 * log 2 (real t + 1) +
     2 * log 2 (real n + 21) +
     2 * log 2 (real r + 1) +
     real s * (5 + 2 * log 2 (21 + real n) +
     real t * (13 + 4 * r + 2 * log 2 (log 2 (real n + 13)))))"
 
 definition encode_f0_state :: "f0_state \<Rightarrow> bool list option" where
-  "encode_f0_state = 
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>s. 
+  "encode_f0_state =
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>s.
     N\<^sub>e \<times>\<^sub>e (
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>p. 
-    N\<^sub>e \<times>\<^sub>e ( 
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>p.
+    N\<^sub>e \<times>\<^sub>e (
     ([0..<s] \<rightarrow>\<^sub>e (P\<^sub>e p 2)) \<times>\<^sub>e
     ([0..<s] \<rightarrow>\<^sub>e (S\<^sub>e F\<^sub>e))))))"
 
 lemma "inj_on encode_f0_state (dom encode_f0_state)"
 proof -
-  have "is_encoding encode_f0_state" 
+  have "is_encoding encode_f0_state"
     unfolding encode_f0_state_def
     by (intro dependent_encoding exp_golomb_encoding poly_encoding fun_encoding set_encoding float_encoding)
   thus ?thesis  by (rule encoding_imp_inj)
 qed
 
 context
   fixes \<epsilon> \<delta> :: rat
   fixes n :: nat
   fixes as :: "nat list"
   fixes result
   assumes \<epsilon>_range: "\<epsilon> \<in> {0<..<1}"
   assumes \<delta>_range: "\<delta> \<in> {0<..<1}"
   assumes as_range: "set as \<subseteq> {..<n}"
   defines "result \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n) \<bind> f0_result"
-begin  
+begin
 
 private definition t where "t = nat \<lceil>80 / (real_of_rat \<delta>)\<^sup>2\<rceil>"
 private lemma t_gt_0: "t > 0" using \<delta>_range by (simp add:t_def)
 
 private definition s where "s = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil>"
 private lemma s_gt_0: "s > 0" using \<epsilon>_range by (simp add:s_def)
 
 private definition p where "p = prime_above (max n 19)"
 
 private lemma p_prime:"Factorial_Ring.prime p"
   using p_def prime_above_prime by presburger
 
 private lemma p_ge_18: "p \<ge> 18"
 proof -
-  have "p \<ge> 19" 
+  have "p \<ge> 19"
     by (metis p_def prime_above_lower_bound max.bounded_iff)
   thus ?thesis by simp
 qed
 
 private lemma p_gt_0: "p > 0" using p_ge_18 by simp
 private lemma p_gt_1: "p > 1" using p_ge_18 by simp
 
 private lemma n_le_p: "n \<le> p"
 proof -
   have "n \<le> max n 19" by simp
   also have "... \<le> p"
     unfolding p_def by (rule prime_above_lower_bound)
   finally show ?thesis by simp
 qed
 
 private lemma p_le_n: "p \<le> 2*n + 40"
 proof -
   have "p \<le> 2 * (max n 19) + 2"
     by (subst p_def, rule prime_above_upper_bound)
   also have "... \<le> 2 * n + 40"
     by (cases "n \<ge> 19", auto)
   finally show ?thesis by simp
 qed
 
-private lemma as_lt_p: "\<And>x. x \<in> set as \<Longrightarrow> x < p" 
+private lemma as_lt_p: "\<And>x. x \<in> set as \<Longrightarrow> x < p"
   using as_range atLeastLessThan_iff
   by (intro order_less_le_trans[OF _ n_le_p]) blast
 
 private lemma as_subset_p: "set as \<subseteq> {..<p}"
    using as_lt_p  by (simp add: subset_iff)
 
 private definition r where "r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23)"
 
 private lemma r_bound: "4 * log 2 (1 / real_of_rat \<delta>) + 23 \<le> r"
 proof -
-  have "0 \<le> log 2 (1 / real_of_rat \<delta>)" using \<delta>_range by simp 
+  have "0 \<le> log 2 (1 / real_of_rat \<delta>)" using \<delta>_range by simp
   hence "0 \<le> \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil>" by simp
   hence "0 \<le> 4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23"
     by (intro add_nonneg_nonneg mult_nonneg_nonneg, auto)
   thus ?thesis by (simp add:r_def)
 qed
 
 private lemma r_ge_23: "r \<ge> 23"
 proof -
   have "(23::real) = 0 + 23" by simp
-  also have "... \<le> 4 * log 2 (1 / real_of_rat \<delta>) + 23" 
-    using \<delta>_range by (intro add_mono mult_nonneg_nonneg, auto) 
+  also have "... \<le> 4 * log 2 (1 / real_of_rat \<delta>) + 23"
+    using \<delta>_range by (intro add_mono mult_nonneg_nonneg, auto)
   also have "... \<le> r" using r_bound by simp
   finally show "23 \<le> r" by simp
 qed
 
 private lemma two_pow_r_le_1: "0 < 1 - 2 powr - real r"
 proof -
   have a: "2 powr (0::real) = 1"
     by simp
-  show ?thesis using r_ge_23 
+  show ?thesis using r_ge_23
     by (simp, subst a[symmetric], intro powr_less_mono, auto)
 qed
 
 interpretation carter_wegman_hash_family "mod_ring p" 2
   rewrites "ring.hash (mod_ring p) = Frequency_Moment_0.hash p"
   using carter_wegman_hash_familyI[OF mod_ring_is_field mod_ring_finite]
   using hash_def p_prime by auto
 
 private definition tr_hash where "tr_hash x \<omega> = truncate_down r (hash x \<omega>)"
 
 private definition sketch_rv where
   "sketch_rv \<omega> = least t ((\<lambda>x. float_of (tr_hash x \<omega>)) ` set as)"
 
-private definition estimate 
+private definition estimate
    where "estimate S = (if card S < t then of_nat (card S) else of_nat t * of_nat p / rat_of_float (Max S))"
 
 private definition sketch_rv' where "sketch_rv' \<omega> = least t ((\<lambda>x. tr_hash x \<omega>) ` set as)"
 private definition estimate' where "estimate' S = (if card S < t then real (card S) else real t * real p / Max S)"
 
 private definition \<Omega>\<^sub>0 where "\<Omega>\<^sub>0 = prod_pmf {..<s} (\<lambda>_. pmf_of_set space)"
 
 private lemma f0_alg_sketch:
   defines "sketch \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n)"
-  shows "sketch = map_pmf (\<lambda>x. (s,t,p,r, x, \<lambda>i \<in> {..<s}. sketch_rv (x i))) \<Omega>\<^sub>0" 
-  unfolding sketch_rv_def 
+  shows "sketch = map_pmf (\<lambda>x. (s,t,p,r, x, \<lambda>i \<in> {..<s}. sketch_rv (x i))) \<Omega>\<^sub>0"
+  unfolding sketch_rv_def
 proof (subst sketch_def, induction as rule:rev_induct)
   case Nil
   then show ?case
     by (simp add:s_def p_def[symmetric] map_pmf_def t_def r_def Let_def least_def restrict_def space_def \<Omega>\<^sub>0_def)
 next
   case (snoc x xs)
   let ?sketch = "\<lambda>\<omega> xs. least t ((\<lambda>a. float_of (tr_hash a \<omega>)) ` set xs)"
   have "fold (\<lambda>a state. state \<bind> f0_update a) (xs @ [x]) (f0_init \<delta> \<epsilon> n) =
      (map_pmf (\<lambda>\<omega>. (s, t, p, r, \<omega>, \<lambda>i \<in> {..<s}. ?sketch (\<omega> i) xs)) \<Omega>\<^sub>0) \<bind> f0_update x"
     by (simp add: restrict_def snoc del:f0_init.simps)
   also have "... = \<Omega>\<^sub>0 \<bind> (\<lambda>\<omega>. f0_update x (s, t, p, r, \<omega>, \<lambda>i\<in>{..<s}. ?sketch (\<omega> i) xs)) "
     by (simp add:map_pmf_def bind_assoc_pmf bind_return_pmf del:f0_update.simps)
   also have "... = map_pmf (\<lambda>\<omega>. (s, t, p, r, \<omega>, \<lambda>i\<in>{..<s}. ?sketch (\<omega> i) (xs@[x]))) \<Omega>\<^sub>0"
     by (simp add:least_insert map_pmf_def tr_hash_def cong:restrict_cong)
   finally show ?case by blast
 qed
 
 private lemma card_nat_in_ball:
   fixes x :: nat
   fixes q :: real
   assumes "q \<ge> 0"
   defines "A \<equiv> {k. abs (real x - real k) \<le> q \<and> k \<noteq> x}"
   shows "real (card A) \<le> 2 * q" and "finite A"
 proof -
   have a: "of_nat x \<in> {\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>}"
-    using assms 
+    using assms
     by (simp add: ceiling_le_iff)
 
   have "card A = card (int ` A)"
     by (rule card_image[symmetric], simp)
   also have "... \<le> card ({\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>} - {of_nat x})"
     by (intro card_mono image_subsetI, simp_all add:A_def abs_le_iff, linarith)
   also have "... = card {\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>} - 1"
     by (rule card_Diff_singleton, rule a)
   also have "... = int (card {\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>}) - int 1"
     by (intro of_nat_diff)
      (metis a card_0_eq empty_iff finite_atLeastAtMost_int less_one linorder_not_le)
   also have "... \<le> \<lfloor>q+real x\<rfloor>+1 -\<lceil>real x-q\<rceil> - 1"
     using assms by (simp, linarith)
   also have "... \<le> 2*q"
     by linarith
   finally show "card A \<le> 2 * q"
     by simp
 
   have "A \<subseteq> {..x + nat \<lceil>q\<rceil>}"
     by (rule subsetI, simp add:A_def abs_le_iff, linarith)
   thus "finite A"
     by (rule finite_subset, simp)
 qed
 
 private lemma prob_degree_lt_1:
-   "prob {\<omega>. degree \<omega> < 1} \<le> 1/real p" 
+   "prob {\<omega>. degree \<omega> < 1} \<le> 1/real p"
 proof -
   have "space \<inter> {\<omega>. length \<omega> \<le> Suc 0} = bounded_degree_polynomials (mod_ring p) 1"
     by (auto simp:set_eq_iff bounded_degree_polynomials_def space_def)
   moreover have "field_size = p" by (simp add:mod_ring_def)
   hence "real (card (bounded_degree_polynomials (mod_ring p) (Suc 0))) / real (card space) = 1 / real p"
     by (simp add:space_def bounded_degree_polynomials_card power2_eq_square)
   ultimately show ?thesis
     by (simp add:M_def measure_pmf_of_set)
 qed
 
 private lemma collision_prob:
   assumes "c \<ge> 1"
-  shows "prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le> 
+  shows "prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le>
     (5/2) * (real (card (set as)))\<^sup>2 * c\<^sup>2 * 2 powr -(real r) / (real p)\<^sup>2 + 1/real p" (is "prob {\<omega>. ?l \<omega>} \<le> ?r1 + ?r2")
 proof -
   define \<rho> :: real where "\<rho> = 9/8"
 
-  have rho_c_ge_0: "\<rho> * c \<ge> 0" unfolding \<rho>_def using assms by simp 
+  have rho_c_ge_0: "\<rho> * c \<ge> 0" unfolding \<rho>_def using assms by simp
 
   have c_ge_0: "c\<ge>0" using assms by simp
-  
+
   have "degree \<omega> \<ge> 1 \<Longrightarrow> \<omega> \<in> space \<Longrightarrow> degree \<omega> = 1" for \<omega>
-    by (simp add:bounded_degree_polynomials_def space_def) 
+    by (simp add:bounded_degree_polynomials_def space_def)
      (metis One_nat_def Suc_1 le_less_Suc_eq less_imp_diff_less list.size(3) pos2)
 
-  hence a: "\<And>\<omega> x y. x < p \<Longrightarrow> y < p \<Longrightarrow>  x \<noteq> y \<Longrightarrow> degree \<omega> \<ge> 1 \<Longrightarrow> \<omega> \<in> space \<Longrightarrow>  hash x \<omega> \<noteq> hash y \<omega>" 
-    using inj_onD[OF inj_if_degree_1]  mod_ring_carr by blast 
+  hence a: "\<And>\<omega> x y. x < p \<Longrightarrow> y < p \<Longrightarrow>  x \<noteq> y \<Longrightarrow> degree \<omega> \<ge> 1 \<Longrightarrow> \<omega> \<in> space \<Longrightarrow>  hash x \<omega> \<noteq> hash y \<omega>"
+    using inj_onD[OF inj_if_degree_1]  mod_ring_carr by blast
 
   have b: "prob {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le> 5 * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2"
     if b_assms: "x \<in> set as"  "y \<in> set as"  "x < y" for x y
   proof -
     have c: "real u \<le> \<rho> * c \<and> \<bar>real u - real v\<bar> \<le> \<rho> * c * 2 powr (-real r)"
       if c_assms:"truncate_down r (real u) \<le> c" "truncate_down r (real u) = truncate_down r (real v)" for u v
     proof -
-      have "9 * 2 powr - real r \<le> 9 * 2 powr (- real 23)" 
+      have "9 * 2 powr - real r \<le> 9 * 2 powr (- real 23)"
         using r_ge_23 by (intro mult_left_mono powr_mono, auto)
 
       also have "... \<le> 1" by simp
 
       finally have "9 * 2 powr - real r \<le> 1" by simp
 
-      hence "1 \<le> \<rho> * (1 - 2 powr (- real r))" 
+      hence "1 \<le> \<rho> * (1 - 2 powr (- real r))"
         by (simp add:\<rho>_def)
 
-      hence d: "(c*1) / (1 - 2 powr (-real r)) \<le> c * \<rho>" 
+      hence d: "(c*1) / (1 - 2 powr (-real r)) \<le> c * \<rho>"
         using assms two_pow_r_le_1 by (simp add: pos_divide_le_eq)
 
-      have "\<And>x. truncate_down r (real x) \<le> c \<Longrightarrow> real x * (1 - 2 powr - real r) \<le> c * 1" 
+      have "\<And>x. truncate_down r (real x) \<le> c \<Longrightarrow> real x * (1 - 2 powr - real r) \<le> c * 1"
         using  truncate_down_pos[OF of_nat_0_le_iff] order_trans by (simp, blast)
 
       hence "\<And>x. truncate_down r (real x) \<le>  c  \<Longrightarrow> real x \<le> c * \<rho>"
-        using two_pow_r_le_1 by (intro order_trans[OF _ d], simp add: pos_le_divide_eq) 
+        using two_pow_r_le_1 by (intro order_trans[OF _ d], simp add: pos_le_divide_eq)
 
-      hence e: "real u \<le> c * \<rho>" "real v \<le> c * \<rho>" 
+      hence e: "real u \<le> c * \<rho>" "real v \<le> c * \<rho>"
         using c_assms by auto
 
       have " \<bar>real u - real v\<bar> \<le> (max \<bar>real u\<bar> \<bar>real v\<bar>) * 2 powr (-real r)"
         using c_assms by (intro truncate_down_eq, simp)
 
       also have "... \<le> (c * \<rho>) * 2 powr (-real r)"
         using e by (intro mult_right_mono, auto)
 
       finally have "\<bar>real u - real v\<bar> \<le> \<rho> * c * 2 powr (-real r)"
         by (simp add:algebra_simps)
 
       thus ?thesis using e by (simp add:algebra_simps)
     qed
 
     have "prob {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le>
       prob (\<Union> i \<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and> truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}.
       {\<omega>.  hash x \<omega> = fst i \<and> hash y \<omega> = snd i})"
-      using a by (intro pmf_mono[OF M_def], simp add:tr_hash_def) 
-       (metis hash_range mod_ring_carr b_assms as_subset_p lessThan_iff nat_neq_iff subset_eq) 
+      using a by (intro pmf_mono[OF M_def], simp add:tr_hash_def)
+       (metis hash_range mod_ring_carr b_assms as_subset_p lessThan_iff nat_neq_iff subset_eq)
 
     also have "... \<le> (\<Sum> i\<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and>
-      truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}. 
+      truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}.
       prob {\<omega>. hash x \<omega> = fst i \<and> hash  y \<omega> = snd i})"
       by (intro measure_UNION_le finite_cartesian_product finite_subset[where B="{0..<p} \<times> {0..<p}"])
        (auto simp add:M_def)
 
     also have "... \<le> (\<Sum> i\<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and>
-      truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}. 
-      prob {\<omega>. (\<forall>u \<in> {x,y}. hash u \<omega> = (if u = x then (fst i) else (snd i)))})" 
+      truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}.
+      prob {\<omega>. (\<forall>u \<in> {x,y}. hash u \<omega> = (if u = x then (fst i) else (snd i)))})"
       by (intro sum_mono  pmf_mono[OF M_def]) force
 
     also have "... \<le> (\<Sum> i\<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and>
       truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}. 1/(real p)\<^sup>2)"
       using assms as_subset_p b_assms
       by (intro sum_mono, subst hash_prob)  (auto simp add: mod_ring_def power2_eq_square)
 
-    also have "... = 1/(real p)\<^sup>2 * 
+    also have "... = 1/(real p)\<^sup>2 *
       card {(u,v) \<in> {0..<p} \<times> {0..<p}. u \<noteq> v \<and> truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}"
       by simp
 
-    also have "... \<le> 1/(real p)\<^sup>2 * 
+    also have "... \<le> 1/(real p)\<^sup>2 *
       card {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and> real u \<le> \<rho> * c \<and> abs (real u - real v) \<le> \<rho> * c * 2 powr (-real r)}"
       using c
       by (intro mult_mono of_nat_mono card_mono finite_cartesian_product finite_subset[where B="{..<p}\<times>{..<p}"])
         auto
 
     also have "... \<le> 1/(real p)\<^sup>2 * card (\<Union>u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
         {(u::nat,v::nat). u = u' \<and> abs (real u - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'})"
       by (intro mult_left_mono of_nat_mono card_mono finite_cartesian_product finite_subset[where B="{..<p}\<times>{..<p}"])
        auto
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       card  {(u,v). u = u' \<and> abs (real u - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'})"
       by (intro mult_left_mono of_nat_mono card_UN_le, auto)
 
     also have "... = 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and>  real u \<le> \<rho> * c}.
       card ((\<lambda>x. (u' ,x)) ` {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'}))"
       by (intro arg_cong2[where f="(*)"] arg_cong[where f="real"] sum.cong arg_cong[where f="card"])
        (auto simp add:set_eq_iff)
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       card {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'})"
       by (intro mult_left_mono of_nat_mono sum_mono card_image_le, auto)
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       card {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v \<noteq> u'})"
       by (intro mult_left_mono sum_mono of_nat_mono card_mono card_nat_in_ball subsetI)  auto
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       real (card {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v \<noteq> u'}))"
       by simp
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}. 2 * (\<rho> * c * 2 powr (-real r)))"
       by (intro mult_left_mono sum_mono card_nat_in_ball(1), auto)
 
     also have "... =  1/(real p)\<^sup>2 * (real (card {u. u < p \<and> real u \<le> \<rho> * c}) * (2 * (\<rho> * c * 2 powr (-real r))))"
       by simp
 
     also have "... \<le>  1/(real p)\<^sup>2 * (real (card {u. u \<le> nat (\<lfloor>\<rho> * c \<rfloor>)}) * (2 * (\<rho> * c * 2 powr (-real r))))"
       using rho_c_ge_0 le_nat_floor
       by (intro mult_left_mono mult_right_mono of_nat_mono card_mono subsetI) auto
 
     also have "... \<le>  1/(real p)\<^sup>2 * ((1+\<rho> * c) * (2 * (\<rho> * c * 2 powr (-real r))))"
       using rho_c_ge_0 by (intro mult_left_mono mult_right_mono, auto)
 
-    also have "... \<le>  1/(real p)\<^sup>2 * (((1+\<rho>) * c) * (2 * (\<rho> * c * 2 powr (-real r))))" 
+    also have "... \<le>  1/(real p)\<^sup>2 * (((1+\<rho>) * c) * (2 * (\<rho> * c * 2 powr (-real r))))"
       using assms by (intro mult_mono, auto simp add:distrib_left distrib_right \<rho>_def)
 
     also have "... = (\<rho> * (2 + \<rho> * 2)) * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2"
-      by (simp add:ac_simps power2_eq_square) 
+      by (simp add:ac_simps power2_eq_square)
 
     also have "... \<le> 5 * c\<^sup>2 *  2 powr (-real r) /(real p)\<^sup>2"
       by (intro divide_right_mono mult_right_mono) (auto simp add:\<rho>_def)
 
     finally show ?thesis by simp
   qed
 
-  have "prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} \<le> 
+  have "prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} \<le>
     prob (\<Union> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash (fst i) \<omega> \<le> c \<and>
     tr_hash (fst i) \<omega> = tr_hash (snd i) \<omega>})"
     by (rule pmf_mono[OF M_def], simp, metis linorder_neqE_nat)
 
-  also have "... \<le> (\<Sum> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. prob 
+  also have "... \<le> (\<Sum> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. prob
     {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash  (fst i) \<omega> \<le> c \<and> tr_hash (fst i) \<omega> = tr_hash (snd i) \<omega>})"
     unfolding M_def
     by (intro measure_UNION_le finite_cartesian_product finite_subset[where B="(set as) \<times> (set as)"])
       auto
 
   also have "... \<le> (\<Sum> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. 5  * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2)"
     using b by (intro sum_mono, simp add:case_prod_beta)
 
   also have "... =  ((5/2) * c\<^sup>2  * 2 powr (-real r) /(real p)\<^sup>2) * (2 * card  {(x,y) \<in> (set as) \<times> (set as). x < y})"
     by simp
 
   also have "... =  ((5/2) * c\<^sup>2  * 2 powr (-real r) /(real p)\<^sup>2) * (card (set as) * (card (set as) - 1))"
-    by (subst card_ordered_pairs, auto) 
+    by (subst card_ordered_pairs, auto)
 
   also have "... \<le> ((5/2) * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2) * (real (card (set as)))\<^sup>2"
     by (intro mult_left_mono) (auto simp add:power2_eq_square mult_left_mono)
 
   also have "... = (5/2) * (real (card (set as)))\<^sup>2 * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2"
     by (simp add:algebra_simps)
 
   finally have f:"prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} \<le> ?r1" by simp
 
   have "prob {\<omega>. ?l \<omega>} \<le> prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} + prob {\<omega>. degree \<omega> < 1}"
     by (rule pmf_add[OF M_def], auto)
   also have "... \<le> ?r1 + ?r2"
     by (intro add_mono f prob_degree_lt_1)
   finally show ?thesis by simp
 qed
 
 private lemma of_bool_square: "(of_bool x)\<^sup>2 = ((of_bool x)::real)"
   by (cases x, auto)
 
 private definition Q where "Q y \<omega> = card {x \<in> set as. int (hash x \<omega>) < y}"
 
 private definition m where "m = card (set as)"
 
 private lemma
   assumes "a \<ge> 0"
   assumes "a \<le> int p"
   shows exp_Q: "expectation (\<lambda>\<omega>. real (Q a \<omega>)) = real m * (of_int a) / p"
   and var_Q: "variance (\<lambda>\<omega>. real (Q a \<omega>)) \<le> real m * (of_int a) / p"
 proof -
   have exp_single: "expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)) = real_of_int a /real p"
     if a:"x \<in> set as" for x
   proof -
     have x_le_p: "x < p" using a as_lt_p by simp
     have "expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)) = expectation (indicat_real {\<omega>. int (Frequency_Moment_0.hash p x \<omega>) < a})"
       by (intro arg_cong2[where f="integral\<^sup>L"] ext, simp_all)
     also have "... = prob {\<omega>. hash x \<omega> \<in> {k. int k < a}}"
       by (simp add:M_def)
     also have "... = card ({k. int k < a} \<inter> {..<p}) / real p"
       by (subst prob_range, simp_all add: x_le_p mod_ring_def)
     also have "... = card {..<nat a} / real p"
       using assms by (intro arg_cong2[where f="(/)"] arg_cong[where f="real"] arg_cong[where f="card"])
-       (auto simp add:set_eq_iff) 
+       (auto simp add:set_eq_iff)
     also have "... =  real_of_int a/real p"
       using assms by simp
     finally show "expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)) = real_of_int a /real p"
       by simp
   qed
 
   have "expectation(\<lambda>\<omega>. real (Q a \<omega>)) = expectation (\<lambda>\<omega>. (\<Sum>x \<in> set as. of_bool (int (hash x \<omega>) < a)))"
     by (simp add:Q_def Int_def)
   also have "... =  (\<Sum>x \<in> set as. expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)))"
     by (rule Bochner_Integration.integral_sum, simp)
   also have "... = (\<Sum> x \<in> set as. a /real p)"
     by (rule sum.cong, simp, subst exp_single, simp, simp)
   also have "... = real m *  real_of_int a / real p"
     by (simp add:m_def)
   finally show "expectation (\<lambda>\<omega>. real (Q a \<omega>)) = real m * real_of_int a / p" by simp
 
   have indep: "J \<subseteq> set as \<Longrightarrow> card J = 2 \<Longrightarrow> indep_vars (\<lambda>_. borel) (\<lambda>i x. of_bool (int (hash i x) < a)) J" for J
     using as_subset_p mod_ring_carr
     by (intro indep_vars_compose2[where Y="\<lambda>i x. of_bool (int x < a)" and M'="\<lambda>_. discrete"]
         k_wise_indep_vars_subset[OF k_wise_indep] finite_subset[OF _ finite_set]) auto
 
   have rv: "\<And>x. x \<in> set as \<Longrightarrow> random_variable borel (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a))"
      by (simp add:M_def)
 
   have "variance (\<lambda>\<omega>. real (Q a \<omega>)) = variance (\<lambda>\<omega>. (\<Sum>x \<in> set as. of_bool (int (hash x \<omega>) < a)))"
     by (simp add:Q_def Int_def)
   also have "... = (\<Sum>x \<in> set as. variance (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)))"
     by (intro bienaymes_identity_pairwise_indep_2 indep rv) auto
   also have "... \<le> (\<Sum> x \<in> set as. a / real p)"
     by (rule sum_mono, simp add: variance_eq of_bool_square, simp add: exp_single)
   also have "... = real m * real_of_int a /real p"
     by (simp add:m_def)
   finally show "variance (\<lambda>\<omega>. real (Q a \<omega>)) \<le> real m * real_of_int a / p"
     by simp
 qed
 
 private lemma t_bound: "t \<le> 81 / (real_of_rat \<delta>)\<^sup>2"
 proof -
   have "t \<le> 80 / (real_of_rat \<delta>)\<^sup>2 + 1" using t_def t_gt_0 by linarith
   also have "... \<le> 80 / (real_of_rat \<delta>)\<^sup>2 + 1 /  (real_of_rat \<delta>)\<^sup>2"
     using \<delta>_range by (intro add_mono, simp, simp add:power_le_one)
   also have "... = 81 / (real_of_rat \<delta>)\<^sup>2" by simp
   finally show ?thesis by simp
 qed
 
 private lemma t_r_bound:
   "18 * 40 * (real t)\<^sup>2 * 2 powr (-real r) \<le> 1"
 proof -
   have "720 * (real t)\<^sup>2 * 2 powr (-real r) \<le> 720 * (81 / (real_of_rat \<delta>)\<^sup>2)\<^sup>2 * 2 powr (-4 * log 2 (1 / real_of_rat \<delta>) - 23)"
     using r_bound t_bound by (intro mult_left_mono mult_mono power_mono powr_mono, auto)
 
   also have "... \<le> 720 * (81 / (real_of_rat \<delta>)\<^sup>2)\<^sup>2 * (2 powr (-4 * log 2 (1 / real_of_rat \<delta>)) * 2 powr (-23))"
     using \<delta>_range by (intro mult_left_mono mult_mono power_mono add_mono)
      (simp_all add:power_le_one powr_diff)
 
   also have "... = 720 * (81\<^sup>2 / (real_of_rat \<delta>)^4) * (2 powr (log 2 ((real_of_rat \<delta>)^4))  * 2 powr (-23))"
     using \<delta>_range by (intro arg_cong2[where f="(*)"])
       (simp_all add:power2_eq_square power4_eq_xxxx log_divide log_powr[symmetric])
 
   also have "... = 720 * 81\<^sup>2 * 2 powr (-23)" using \<delta>_range by simp
 
   also have "... \<le> 1" by simp
 
   finally show ?thesis by simp
 qed
 
 private lemma m_eq_F_0: "real m = of_rat (F 0 as)"
   by (simp add:m_def F_def)
 
 private lemma estimate'_bounds:
   "prob {\<omega>. of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le> 1/3"
 proof (cases "card (set as) \<ge> t")
   case True
   define \<delta>' where "\<delta>' = 3 * real_of_rat \<delta> / 4"
   define u where "u = \<lceil>real t * p / (m * (1+\<delta>'))\<rceil>"
   define v where "v = \<lfloor>real t * p / (m * (1-\<delta>'))\<rfloor>"
 
-  define has_no_collision where 
+  define has_no_collision where
     "has_no_collision = (\<lambda>\<omega>. \<forall>x\<in> set as. \<forall>y \<in> set as. (tr_hash x \<omega> = tr_hash y \<omega> \<longrightarrow> x = y) \<or> tr_hash x \<omega> > v)"
 
   have "2 powr (-real r) \<le> 2 powr (-(4 * log 2 (1 / real_of_rat \<delta>) + 23))"
     using r_bound by (intro powr_mono, linarith, simp)
   also have "... = 2 powr (-4 * log 2 (1 /real_of_rat \<delta>) -23)"
     by (rule arg_cong2[where f="(powr)"], auto simp add:algebra_simps)
   also have "... \<le> 2 powr ( -1 * log 2 (1 /real_of_rat \<delta>) -4)"
     using \<delta>_range by (intro powr_mono diff_mono, auto)
   also have "... = 2 powr ( -1 * log 2 (1 /real_of_rat \<delta>)) /  16"
     by (simp add: powr_diff)
   also have "... = real_of_rat \<delta> / 16"
     using \<delta>_range by (simp add:log_divide)
   also have "... < real_of_rat \<delta> / 8"
     using \<delta>_range by (subst pos_divide_less_eq, auto)
   finally have r_le_\<delta>: "2 powr (-real r) < real_of_rat \<delta> / 8"
     by simp
 
   have \<delta>'_gt_0: "\<delta>' > 0" using \<delta>_range by (simp add:\<delta>'_def)
   have "\<delta>' < 3/4" using \<delta>_range by (simp add:\<delta>'_def)+
   also have "... < 1" by simp
   finally have \<delta>'_lt_1: "\<delta>' < 1" by simp
 
   have "t \<le> 81 / (real_of_rat \<delta>)\<^sup>2"
     using t_bound by simp
   also have "... = (81*9/16) / (\<delta>')\<^sup>2"
     by (simp add:\<delta>'_def power2_eq_square)
   also have "... \<le> 46 / \<delta>'\<^sup>2"
     by (intro divide_right_mono, simp, simp)
   finally have t_le_\<delta>': "t \<le> 46/ \<delta>'\<^sup>2" by simp
 
   have "80 \<le> (real_of_rat \<delta>)\<^sup>2 * (80 / (real_of_rat \<delta>)\<^sup>2)" using \<delta>_range by simp
   also have "... \<le> (real_of_rat \<delta>)\<^sup>2 * t"
     by (intro mult_left_mono, simp add:t_def of_nat_ceiling, simp)
   finally have "80 \<le> (real_of_rat \<delta>)\<^sup>2 * t" by simp
   hence t_ge_\<delta>': "45 \<le> t * \<delta>' * \<delta>'" by (simp add:\<delta>'_def power2_eq_square)
 
   have "m \<le> card {..<n}" unfolding m_def using as_range by (intro card_mono, auto)
   also have "... \<le> p" using n_le_p by simp
   finally have m_le_p: "m \<le> p" by simp
 
   hence t_le_m: "t \<le> card (set as)" using True by simp
   have m_ge_0: "real m > 0" using m_def True t_gt_0 by simp
 
   have "v \<le> real t * real p / (real m * (1 - \<delta>'))" by (simp add:v_def)
 
   also have "... \<le> real t * real p / (real m * (1/4))"
     using \<delta>'_lt_1 m_ge_0 \<delta>_range
     by (intro divide_left_mono mult_left_mono mult_nonneg_nonneg mult_pos_pos, simp_all add:\<delta>'_def)
 
   finally have v_ubound: "v \<le> 4 * real t * real p / real m" by (simp add:algebra_simps)
 
   have a_ge_1: "u \<ge> 1" using \<delta>'_gt_0 p_gt_0 m_ge_0 t_gt_0
-    by (auto intro!:mult_pos_pos divide_pos_pos simp add:u_def) 
+    by (auto intro!:mult_pos_pos divide_pos_pos simp add:u_def)
   hence a_ge_0: "u \<ge> 0" by simp
   have "real m * (1 - \<delta>') < real m" using \<delta>'_gt_0 m_ge_0 by simp
   also have "... \<le> 1 * real p" using m_le_p by simp
   also have "... \<le> real t * real p" using t_gt_0 by (intro mult_right_mono, auto)
   finally have " real m * (1 - \<delta>') < real t * real p" by simp
   hence v_gt_0: "v > 0" using mult_pos_pos m_ge_0 \<delta>'_lt_1 by (simp add:v_def)
   hence v_ge_1: "real_of_int v \<ge> 1" by linarith
 
   have "real t \<le> real m" using True m_def by linarith
   also have "... < (1 + \<delta>') * real m" using \<delta>'_gt_0 m_ge_0 by force
   finally have a_le_p_aux: "real t < (1 + \<delta>') * real m"  by simp
 
   have "u \<le> real t * real p / (real m * (1 + \<delta>'))+1" by (simp add:u_def)
-  also have "... < real p + 1" 
+  also have "... < real p + 1"
     using m_ge_0 \<delta>'_gt_0 a_le_p_aux  a_le_p_aux p_gt_0
-    by (simp add: pos_divide_less_eq ac_simps) 
-  finally have "u \<le> real p" 
+    by (simp add: pos_divide_less_eq ac_simps)
+  finally have "u \<le> real p"
     by (metis int_less_real_le not_less of_int_le_iff of_int_of_nat_eq)
   hence u_le_p: "u \<le> int p" by linarith
 
-  have "prob {\<omega>. Q u \<omega> \<ge> t} \<le> prob {\<omega> \<in> Sigma_Algebra.space M. abs (real (Q u \<omega>) - 
+  have "prob {\<omega>. Q u \<omega> \<ge> t} \<le> prob {\<omega> \<in> Sigma_Algebra.space M. abs (real (Q u \<omega>) -
     expectation (\<lambda>\<omega>. real (Q u \<omega>))) \<ge> 3 * sqrt (m * real_of_int u / p)}"
   proof (rule pmf_mono[OF M_def])
     fix \<omega>
     assume "\<omega> \<in> {\<omega>. t \<le> Q u \<omega>}"
     hence t_le: "t \<le> Q u \<omega>" by simp
     have "real m * real_of_int u / real p \<le> real m * (real t * real p / (real m * (1 + \<delta>'))+1) / real p"
       using m_ge_0 p_gt_0 by (intro divide_right_mono mult_left_mono, simp_all add: u_def)
     also have "... = real m * real t * real p / (real m * (1+\<delta>') * real p) + real m / real p"
       by (simp add:distrib_left add_divide_distrib)
     also have "... = real t / (1+\<delta>') + real m / real p"
       using p_gt_0 m_ge_0 by simp
     also have "... \<le> real t / (1+\<delta>') + 1"
       using m_le_p p_gt_0 by (intro add_mono, auto)
     finally have "real m * real_of_int u / real p \<le> real t / (1 + \<delta>') + 1"
       by simp
 
-    hence "3 * sqrt (real m * of_int u / real p) + real m * of_int u / real p \<le> 
+    hence "3 * sqrt (real m * of_int u / real p) + real m * of_int u / real p \<le>
       3 * sqrt (t / (1+\<delta>')+1)+(t/(1+\<delta>')+1)"
       by (intro add_mono mult_left_mono real_sqrt_le_mono, auto)
     also have "... \<le> 3 * sqrt (real t+1) + ((t * (1 - \<delta>' / (1+\<delta>'))) + 1)"
       using \<delta>'_gt_0 t_gt_0 by (intro add_mono mult_left_mono real_sqrt_le_mono)
         (simp_all add: pos_divide_le_eq left_diff_distrib)
     also have "... = 3 * sqrt (real t+1) + (t - \<delta>' * t / (1+\<delta>')) + 1" by (simp add:algebra_simps)
     also have "... \<le> 3 * sqrt (46 / \<delta>'\<^sup>2 + 1 / \<delta>'\<^sup>2) + (t - \<delta>' * t/2) + 1 / \<delta>'"
       using \<delta>'_gt_0 t_gt_0 \<delta>'_lt_1 add_pos_pos  t_le_\<delta>'
       by (intro add_mono mult_left_mono real_sqrt_le_mono add_mono)
        (simp_all add: power_le_one pos_le_divide_eq)
-    also have "... \<le> (21 / \<delta>' + (t - 45 / (2*\<delta>'))) + 1 / \<delta>'" 
+    also have "... \<le> (21 / \<delta>' + (t - 45 / (2*\<delta>'))) + 1 / \<delta>'"
       using \<delta>'_gt_0 t_ge_\<delta>' by (intro add_mono)
          (simp_all add:real_sqrt_divide divide_le_cancel real_le_lsqrt pos_divide_le_eq ac_simps)
     also have "... \<le> t" using \<delta>'_gt_0 by simp
     also have "... \<le> Q u \<omega>" using t_le by simp
     finally have "3 * sqrt (real m * of_int u / real p) + real m * of_int u / real p \<le> Q u \<omega>"
       by simp
     hence " 3 * sqrt (real m * real_of_int u / real p) \<le> \<bar>real (Q u \<omega>) - expectation (\<lambda>\<omega>. real (Q u \<omega>))\<bar>"
       using a_ge_0 u_le_p  True by (simp add:exp_Q abs_ge_iff)
 
-    thus "\<omega> \<in> {\<omega> \<in> Sigma_Algebra.space M. 3 * sqrt (real m * real_of_int u / real p) \<le> 
+    thus "\<omega> \<in> {\<omega> \<in> Sigma_Algebra.space M. 3 * sqrt (real m * real_of_int u / real p) \<le>
       \<bar>real (Q u \<omega>) - expectation (\<lambda>\<omega>. real (Q u \<omega>))\<bar>}"
       by (simp add: M_def)
   qed
   also have "... \<le> variance  (\<lambda>\<omega>. real (Q u \<omega>)) / (3 * sqrt (real m * of_int u / real p))\<^sup>2"
-    using a_ge_1 p_gt_0 m_ge_0 
-    by (intro Chebyshev_inequality, simp add:M_def, auto) 
+    using a_ge_1 p_gt_0 m_ge_0
+    by (intro Chebyshev_inequality, simp add:M_def, auto)
 
   also have "... \<le> (real m * real_of_int u / real p) / (3 * sqrt (real m * of_int u / real p))\<^sup>2"
     using a_ge_0 u_le_p by (intro divide_right_mono var_Q, auto)
 
   also have "... \<le> 1/9" using a_ge_0 by simp
 
   finally have case_1: "prob {\<omega>. Q u \<omega> \<ge> t} \<le> 1/9" by simp
 
   have case_2: "prob {\<omega>. Q v \<omega> < t} \<le> 1/9"
   proof (cases "v \<le> p")
     case True
-    have "prob {\<omega>. Q v \<omega> < t} \<le> prob {\<omega> \<in> Sigma_Algebra.space M. abs (real (Q v \<omega>) - expectation (\<lambda>\<omega>. real (Q v \<omega>))) 
+    have "prob {\<omega>. Q v \<omega> < t} \<le> prob {\<omega> \<in> Sigma_Algebra.space M. abs (real (Q v \<omega>) - expectation (\<lambda>\<omega>. real (Q v \<omega>)))
       \<ge> 3 * sqrt (m * real_of_int v / p)}"
     proof (rule pmf_mono[OF M_def])
       fix \<omega>
       assume "\<omega> \<in> set_pmf (pmf_of_set space)"
       have "(real t + 3 * sqrt (real t / (1 - \<delta>') )) * (1 - \<delta>') = real t - \<delta>' * t + 3 * ((1-\<delta>') * sqrt( real t / (1-\<delta>') ))"
         by (simp add:algebra_simps)
 
       also have "... = real t - \<delta>' * t + 3 * sqrt (  (1-\<delta>')\<^sup>2 * (real t /  (1-\<delta>')))"
         using \<delta>'_lt_1 by (subst real_sqrt_mult, simp)
 
       also have "... = real t - \<delta>' * t + 3 * sqrt ( real t * (1- \<delta>'))"
         by (simp add:power2_eq_square distrib_left)
 
       also have "... \<le> real t - 45/ \<delta>' + 3 * sqrt ( real t )"
         using \<delta>'_gt_0 t_ge_\<delta>' \<delta>'_lt_1 by (intro add_mono mult_left_mono real_sqrt_le_mono)
          (simp_all add:pos_divide_le_eq ac_simps left_diff_distrib power_le_one)
 
        also have "... \<le> real t - 45/ \<delta>' + 3 * sqrt ( 46 / \<delta>'\<^sup>2)"
          using  t_le_\<delta>' \<delta>'_lt_1 \<delta>'_gt_0
          by (intro add_mono mult_left_mono real_sqrt_le_mono, simp_all add:pos_divide_le_eq power_le_one)
 
       also have "... = real t + (3 * sqrt(46) - 45)/ \<delta>'"
         using \<delta>'_gt_0 by (simp add:real_sqrt_divide diff_divide_distrib)
 
       also have "... \<le> t"
         using \<delta>'_gt_0 by (simp add:pos_divide_le_eq real_le_lsqrt)
 
       finally have aux: "(real t + 3 * sqrt (real t / (1 - \<delta>'))) * (1 - \<delta>') \<le> real t "
         by simp
 
       assume "\<omega> \<in> {\<omega>. Q v \<omega> < t}"
       hence "Q v \<omega> < t" by simp
 
-      hence "real (Q v \<omega>) + 3 * sqrt (real m * real_of_int v / real p) 
+      hence "real (Q v \<omega>) + 3 * sqrt (real m * real_of_int v / real p)
         \<le> real t - 1 + 3 * sqrt (real m * real_of_int v / real p)"
         using m_le_p p_gt_0 by (intro add_mono, auto simp add: algebra_simps add_divide_distrib)
 
       also have "... \<le> (real t-1) + 3 * sqrt (real m * (real t * real p / (real m * (1- \<delta>'))) / real p)"
         by (intro add_mono mult_left_mono real_sqrt_le_mono divide_right_mono)
          (auto simp add:v_def)
 
       also have "... \<le> real t + 3 * sqrt(real t / (1-\<delta>')) - 1"
         using m_ge_0 p_gt_0 by simp
 
-      also have "... \<le> real t / (1-\<delta>')-1" 
-        using \<delta>'_lt_1 aux by (simp add: pos_le_divide_eq)   
+      also have "... \<le> real t / (1-\<delta>')-1"
+        using \<delta>'_lt_1 aux by (simp add: pos_le_divide_eq)
       also have "... \<le> real m * (real t * real p / (real m * (1-\<delta>'))) / real p - 1"
         using p_gt_0 m_ge_0 by simp
       also have "... \<le> real m * (real t * real p / (real m * (1-\<delta>'))) / real p - real m / real p"
           using m_le_p p_gt_0
           by (intro diff_mono, auto)
-      also have "... = real m * (real t * real p / (real m * (1-\<delta>'))-1) / real p" 
+      also have "... = real m * (real t * real p / (real m * (1-\<delta>'))-1) / real p"
           by (simp add: left_diff_distrib right_diff_distrib diff_divide_distrib)
-      also have "... \<le>  real m * real_of_int v / real p"      
+      also have "... \<le>  real m * real_of_int v / real p"
         by (intro divide_right_mono mult_left_mono, simp_all add:v_def)
 
-      finally have "real (Q v \<omega>) + 3 * sqrt (real m * real_of_int v / real p) 
+      finally have "real (Q v \<omega>) + 3 * sqrt (real m * real_of_int v / real p)
         \<le> real m * real_of_int v / real p" by simp
 
-      hence " 3 * sqrt (real m * real_of_int v / real p) \<le> \<bar>real (Q v \<omega>) -expectation (\<lambda>\<omega>. real (Q v \<omega>))\<bar>"  
+      hence " 3 * sqrt (real m * real_of_int v / real p) \<le> \<bar>real (Q v \<omega>) -expectation (\<lambda>\<omega>. real (Q v \<omega>))\<bar>"
         using v_gt_0 True by (simp add: exp_Q abs_ge_iff)
 
-      thus "\<omega> \<in> {\<omega>\<in> Sigma_Algebra.space M. 3 * sqrt (real m * real_of_int v / real p) \<le> 
-        \<bar>real (Q v \<omega>) - expectation (\<lambda>\<omega>. real (Q v \<omega>))\<bar>}" 
+      thus "\<omega> \<in> {\<omega>\<in> Sigma_Algebra.space M. 3 * sqrt (real m * real_of_int v / real p) \<le>
+        \<bar>real (Q v \<omega>) - expectation (\<lambda>\<omega>. real (Q v \<omega>))\<bar>}"
         by (simp add:M_def)
     qed
-    also have "... \<le> variance (\<lambda>\<omega>. real (Q v \<omega>)) / (3 * sqrt (real m * real_of_int v / real p))\<^sup>2" 
-      using v_gt_0 p_gt_0 m_ge_0 
+    also have "... \<le> variance (\<lambda>\<omega>. real (Q v \<omega>)) / (3 * sqrt (real m * real_of_int v / real p))\<^sup>2"
+      using v_gt_0 p_gt_0 m_ge_0
       by (intro Chebyshev_inequality, simp add:M_def, auto)
 
     also have "... \<le> (real m * real_of_int v / real p) / (3 * sqrt (real m * real_of_int v / real p))\<^sup>2"
       using  v_gt_0 True  by (intro divide_right_mono var_Q, auto)
 
     also have "... = 1/9"
       using p_gt_0 v_gt_0 m_ge_0 by (simp add:power2_eq_square)
 
     finally show ?thesis by simp
   next
     case False
     have "prob {\<omega>. Q v \<omega> < t} \<le> prob {\<omega>. False}"
     proof (rule pmf_mono[OF M_def])
       fix \<omega>
       assume a:"\<omega> \<in> {\<omega>. Q v \<omega> < t}"
       assume "\<omega> \<in> set_pmf (pmf_of_set space)"
-      hence b:"\<And>x. x < p \<Longrightarrow> hash x \<omega> < p" 
-        using hash_range mod_ring_carr by (simp add:M_def measure_pmf_inverse) 
+      hence b:"\<And>x. x < p \<Longrightarrow> hash x \<omega> < p"
+        using hash_range mod_ring_carr by (simp add:M_def measure_pmf_inverse)
       have "t \<le> card (set as)" using True by simp
       also have "... \<le> Q v \<omega>"
-        unfolding Q_def  using b False as_lt_p by (intro card_mono subsetI, simp, force) 
+        unfolding Q_def  using b False as_lt_p by (intro card_mono subsetI, simp, force)
       also have "... < t" using a by simp
       finally have "False" by auto
       thus "\<omega> \<in> {\<omega>. False}" by simp
     qed
     also have "... = 0" by auto
     finally show ?thesis by simp
   qed
 
   have "prob {\<omega>. \<not>has_no_collision \<omega>} \<le>
     prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real_of_int v \<and> tr_hash x \<omega> = tr_hash y \<omega>}"
-    by (rule pmf_mono[OF M_def]) (simp add:has_no_collision_def M_def, force) 
+    by (rule pmf_mono[OF M_def]) (simp add:has_no_collision_def M_def, force)
 
   also have "... \<le> (5/2) * (real (card (set as)))\<^sup>2 * (real_of_int v)\<^sup>2 * 2 powr - real r / (real p)\<^sup>2 + 1 / real p"
     using collision_prob v_ge_1 by blast
 
   also have "... \<le> (5/2) * (real m)\<^sup>2 * (real_of_int v)\<^sup>2 * 2 powr - real r / (real p)\<^sup>2 + 1 / real p"
     by (intro divide_right_mono add_mono mult_right_mono mult_mono power_mono, simp_all add:m_def)
 
   also have "... \<le> (5/2) * (real m)\<^sup>2 * (4 * real t * real p / real m)\<^sup>2 * (2 powr - real r) / (real p)\<^sup>2 + 1 / real p"
     using v_def v_ge_1 v_ubound
     by (intro add_mono divide_right_mono  mult_right_mono  mult_left_mono, auto)
 
   also have "... = 40 * (real t)\<^sup>2 * (2 powr -real r) + 1 / real p"
     using p_gt_0 m_ge_0 t_gt_0 by (simp add:algebra_simps power2_eq_square)
 
   also have "... \<le> 1/18 + 1/18"
     using t_r_bound p_ge_18 by (intro add_mono, simp_all add: pos_le_divide_eq)
 
   also have "... = 1/9" by simp
 
   finally have case_3: "prob {\<omega>. \<not>has_no_collision \<omega>} \<le> 1/9" by simp
 
-  have "prob {\<omega>. real_of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le> 
+  have "prob {\<omega>. real_of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le>
     prob {\<omega>. Q u \<omega> \<ge> t \<or> Q v \<omega> < t \<or> \<not>(has_no_collision \<omega>)}"
   proof (rule pmf_mono[OF M_def], rule ccontr)
     fix \<omega>
     assume "\<omega> \<in> set_pmf (pmf_of_set space)"
     assume "\<omega> \<in> {\<omega>. real_of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)\<bar>}"
     hence est: "real_of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)\<bar>" by simp
     assume "\<omega> \<notin> {\<omega>. t \<le> Q u \<omega> \<or> Q v \<omega> < t \<or> \<not> has_no_collision \<omega>}"
     hence "\<not>( t \<le> Q u \<omega> \<or> Q v \<omega> < t \<or> \<not> has_no_collision \<omega>)" by simp
     hence lb: "Q u \<omega> < t" and ub: "Q v \<omega> \<ge> t" and no_col: "has_no_collision \<omega>" by simp+
 
     define y where "y =  nth_mset (t-1) {#int (hash x \<omega>). x \<in># mset_set (set as)#}"
     define y' where "y' = nth_mset (t-1) {#tr_hash x \<omega>. x \<in># mset_set (set as)#}"
 
     have rank_t_lb: "u \<le> y"
       unfolding y_def using True t_gt_0 lb
       by (intro nth_mset_bound_left, simp_all add:count_less_def swap_filter_image Q_def)
-  
+
     have rank_t_ub: "y \<le> v - 1"
       unfolding y_def using True t_gt_0 ub
       by (intro nth_mset_bound_right, simp_all add:Q_def swap_filter_image count_le_def)
 
     have y_ge_0: "real_of_int y \<ge> 0" using rank_t_lb a_ge_0 by linarith
 
-    have "mono (\<lambda>x. truncate_down r (real_of_int x))" 
+    have "mono (\<lambda>x. truncate_down r (real_of_int x))"
       by (metis truncate_down_mono mono_def of_int_le_iff)
     hence y'_eq: "y' = truncate_down r y"
       unfolding y_def y'_def  using True t_gt_0
-      by (subst nth_mset_commute_mono[where f="(\<lambda>x. truncate_down r (of_int x))"]) 
+      by (subst nth_mset_commute_mono[where f="(\<lambda>x. truncate_down r (of_int x))"])
         (simp_all add: multiset.map_comp comp_def tr_hash_def)
 
     have "real_of_int u * (1 - 2 powr -real r) \<le> real_of_int y * (1 - 2 powr (-real r))"
       using rank_t_lb of_int_le_iff two_pow_r_le_1
       by (intro mult_right_mono, auto)
     also have "... \<le> y'"
       using y'_eq truncate_down_pos[OF y_ge_0] by simp
     finally have rank_t_lb': "u * (1 - 2 powr -real r) \<le> y'" by simp
 
     have "y' \<le> real_of_int y"
       by (subst y'_eq, rule truncate_down_le, simp)
     also have "... \<le> real_of_int (v-1)"
       using rank_t_ub of_int_le_iff by blast
     finally have rank_t_ub': "y' \<le> v-1"
       by simp
 
     have "0 < u * (1-2 powr -real r)"
       using a_ge_1 two_pow_r_le_1 by (intro mult_pos_pos, auto)
     hence y'_pos: "y' > 0" using rank_t_lb' by linarith
 
     have no_col': "\<And>x. x \<le> y' \<Longrightarrow> count {#tr_hash x \<omega>. x \<in># mset_set (set as)#} x \<le> 1"
-      using  rank_t_ub' no_col 
+      using  rank_t_ub' no_col
       by (simp add:vimage_def card_le_Suc0_iff_eq count_image_mset has_no_collision_def) force
 
     have h_1: "Max (sketch_rv' \<omega>) = y'"
       using True t_gt_0 no_col'
       by (simp add:sketch_rv'_def y'_def nth_mset_max)
 
     have "card (sketch_rv' \<omega>) = card (least ((t-1)+1) (set_mset {#tr_hash x \<omega>. x \<in># mset_set (set as)#}))"
       using t_gt_0 by (simp add:sketch_rv'_def)
     also have "... = (t-1) +1"
       using True t_gt_0 no_col' by (intro nth_mset_max(2), simp_all add:y'_def)
     also have "... = t" using t_gt_0 by simp
     finally have "card (sketch_rv' \<omega>) = t" by simp
     hence h_3: "estimate' (sketch_rv' \<omega>) = real t * real p / y'"
       using h_1 by (simp add:estimate'_def)
 
-    have "(real t) * real p \<le>  (1 + \<delta>') * real m * ((real t) * real p / (real m * (1 + \<delta>')))" 
+    have "(real t) * real p \<le>  (1 + \<delta>') * real m * ((real t) * real p / (real m * (1 + \<delta>')))"
       using \<delta>'_lt_1 m_def True t_gt_0 \<delta>'_gt_0 by auto
     also have "... \<le> (1+\<delta>') * m * u"
       using \<delta>'_gt_0 by (intro mult_left_mono, simp_all add:u_def)
     also have "... < ((1 + real_of_rat \<delta>)*(1-real_of_rat \<delta>/8)) * m * u"
       using True m_def t_gt_0 a_ge_1 \<delta>_range
       by (intro mult_strict_right_mono, auto simp add:\<delta>'_def right_diff_distrib)
     also have "... \<le> ((1 + real_of_rat \<delta>)*(1-2 powr (-r))) * m * u"
       using r_le_\<delta> \<delta>_range a_ge_0 by (intro mult_right_mono mult_left_mono, auto)
-    also have "... = (1 + real_of_rat \<delta>) * m * (u * (1-2 powr -real r))" 
+    also have "... = (1 + real_of_rat \<delta>) * m * (u * (1-2 powr -real r))"
       by simp
     also have "... \<le> (1 + real_of_rat \<delta>) * m * y'"
       using \<delta>_range by (intro mult_left_mono rank_t_lb', simp)
     finally have "real t * real p < (1 + real_of_rat \<delta>) * m * y'" by simp
     hence f_1: "estimate' (sketch_rv' \<omega>) < (1 + real_of_rat \<delta>) * m"
       using y'_pos by (simp add: h_3 pos_divide_less_eq)
 
-    have "(1 - real_of_rat \<delta>) * m * y' \<le> (1 - real_of_rat \<delta>) * m * v" 
+    have "(1 - real_of_rat \<delta>) * m * y' \<le> (1 - real_of_rat \<delta>) * m * v"
       using \<delta>_range rank_t_ub' y'_pos by (intro mult_mono rank_t_ub', simp_all)
     also have "... = (1-real_of_rat \<delta>) * (real m * v)"
       by simp
-    also have "... < (1-\<delta>') * (real m * v)" 
+    also have "... < (1-\<delta>') * (real m * v)"
       using \<delta>_range m_ge_0 v_ge_1
       by (intro mult_strict_right_mono mult_pos_pos, simp_all add:\<delta>'_def)
     also have "... \<le> (1-\<delta>') * (real m * (real t * real p / (real m * (1-\<delta>'))))"
       using \<delta>'_gt_0 \<delta>'_lt_1 by (intro mult_left_mono, auto simp add:v_def)
     also have "... = real t * real p"
       using \<delta>'_gt_0 \<delta>'_lt_1 t_gt_0 p_gt_0 m_ge_0 by auto
     finally have "(1 - real_of_rat \<delta>) * m * y' < real t * real p" by simp
     hence f_2: "estimate' (sketch_rv' \<omega>) > (1 - real_of_rat \<delta>) * m"
       using y'_pos by (simp add: h_3 pos_less_divide_eq)
 
     have "abs (estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)) < real_of_rat \<delta> * (real_of_rat (F 0 as))"
       using f_1 f_2 by (simp add:abs_less_iff algebra_simps m_eq_F_0)
     thus "False" using est by linarith
   qed
   also have "... \<le> 1/9 + (1/9 + 1/9)"
     by (intro pmf_add_2[OF M_def] case_1 case_2 case_3)
   also have "... = 1/3" by simp
   finally show ?thesis by simp
 next
   case False
   have "prob {\<omega>. real_of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le>
-    prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real p \<and> tr_hash x \<omega> = tr_hash y \<omega>}" 
+    prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real p \<and> tr_hash x \<omega> = tr_hash y \<omega>}"
   proof (rule pmf_mono[OF M_def])
     fix \<omega>
     assume a:"\<omega> \<in> {\<omega>. real_of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)\<bar>}"
-    assume b:"\<omega> \<in> set_pmf (pmf_of_set space)" 
+    assume b:"\<omega> \<in> set_pmf (pmf_of_set space)"
     have c: "card (set as) < t" using False by auto
     hence "card ((\<lambda>x. tr_hash x \<omega>) ` set as) < t"
       using card_image_le order_le_less_trans by blast
     hence d:"card (sketch_rv' \<omega>) = card ((\<lambda>x. tr_hash x \<omega>) ` (set as))"
       by (simp add:sketch_rv'_def card_least)
     have "card (sketch_rv' \<omega>) < t"
       by (metis List.finite_set  c d card_image_le  order_le_less_trans)
     hence "estimate' (sketch_rv' \<omega>) = card (sketch_rv' \<omega>)" by (simp add:estimate'_def)
     hence "card (sketch_rv' \<omega>) \<noteq> real_of_rat (F 0 as)"
-      using a \<delta>_range by simp 
+      using a \<delta>_range by simp
         (metis abs_zero cancel_comm_monoid_add_class.diff_cancel of_nat_less_0_iff pos_prod_lt zero_less_of_rat_iff)
     hence "card (sketch_rv' \<omega>) \<noteq> card (set as)"
       using m_def m_eq_F_0 by linarith
     hence "\<not>inj_on (\<lambda>x. tr_hash x \<omega>) (set as)"
       using card_image d by auto
     moreover have "tr_hash x \<omega> \<le> real p" if a:"x \<in> set as" for x
     proof -
-      have "hash x \<omega> < p" 
+      have "hash x \<omega> < p"
         using hash_range as_lt_p a b by (simp add:mod_ring_carr M_def)
       thus "tr_hash x \<omega> \<le> real p" using truncate_down_le by (simp add:tr_hash_def)
     qed
    ultimately show "\<omega> \<in> {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real p \<and> tr_hash x \<omega> = tr_hash y \<omega>}"
      by (simp add:inj_on_def, blast)
   qed
   also have "... \<le> (5/2) * (real (card (set as)))\<^sup>2 * (real p)\<^sup>2 * 2 powr - real r / (real p)\<^sup>2 + 1 / real p"
     using p_gt_0 by (intro collision_prob, auto)
   also have "... = (5/2) * (real (card (set as)))\<^sup>2 * 2 powr (- real r) + 1 / real p"
     using p_gt_0 by (simp add:ac_simps power2_eq_square)
   also have "... \<le> (5/2) * (real t)\<^sup>2 * 2 powr (-real r) + 1 / real p"
     using False by (intro add_mono mult_right_mono mult_left_mono power_mono, auto)
   also have "... \<le> 1/6 + 1/6"
     using t_r_bound p_ge_18 by (intro add_mono, simp_all)
   also have "... \<le> 1/3" by simp
   finally show ?thesis by simp
 qed
 
 private lemma median_bounds:
   "\<P>(\<omega> in measure_pmf \<Omega>\<^sub>0. \<bar>median s (\<lambda>i. estimate (sketch_rv (\<omega> i))) - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1 - real_of_rat \<epsilon>"
 proof -
   have "strict_mono_on A real_of_float" for A by (meson less_float.rep_eq strict_mono_onI)
-  hence real_g_2: "\<And>\<omega>.  sketch_rv' \<omega> = real_of_float ` sketch_rv \<omega>" 
+  hence real_g_2: "\<And>\<omega>.  sketch_rv' \<omega> = real_of_float ` sketch_rv \<omega>"
     by (simp add: sketch_rv'_def sketch_rv_def tr_hash_def least_mono_commute image_comp)
 
   moreover have "inj_on real_of_float A" for A
     using  real_of_float_inject by (simp add:inj_on_def)
-  ultimately have card_eq: "\<And>\<omega>. card (sketch_rv \<omega>) = card (sketch_rv' \<omega>)" 
+  ultimately have card_eq: "\<And>\<omega>. card (sketch_rv \<omega>) = card (sketch_rv' \<omega>)"
     using real_g_2 by (auto intro!: card_image[symmetric])
 
-  have "Max (sketch_rv' \<omega>) = real_of_float (Max (sketch_rv \<omega>))" if a:"card (sketch_rv' \<omega>) \<ge> t" for \<omega> 
+  have "Max (sketch_rv' \<omega>) = real_of_float (Max (sketch_rv \<omega>))" if a:"card (sketch_rv' \<omega>) \<ge> t" for \<omega>
   proof -
     have "mono real_of_float"
       using less_eq_float.rep_eq mono_def by blast
     moreover have "finite (sketch_rv \<omega>)"
       by (simp add:sketch_rv_def least_def)
     moreover have " sketch_rv \<omega> \<noteq> {}"
-      using card_eq[symmetric] card_gt_0_iff t_gt_0 a by (simp, force)  
+      using card_eq[symmetric] card_gt_0_iff t_gt_0 a by (simp, force)
     ultimately show ?thesis
       by (subst mono_Max_commute[where f="real_of_float"], simp_all add:real_g_2)
   qed
   hence real_g: "\<And>\<omega>. estimate' (sketch_rv' \<omega>) = real_of_rat (estimate (sketch_rv \<omega>))"
     by (simp add:estimate_def estimate'_def card_eq of_rat_divide of_rat_mult of_rat_add real_of_rat_of_float)
 
   have indep: "prob_space.indep_vars (measure_pmf \<Omega>\<^sub>0) (\<lambda>_. borel) (\<lambda>i \<omega>. estimate' (sketch_rv' (\<omega> i))) {0..<s}"
     unfolding \<Omega>\<^sub>0_def
     by (rule indep_vars_restrict_intro', auto simp add:restrict_dfl_def lessThan_atLeast0)
 
   moreover have "- (18 * ln (real_of_rat \<epsilon>)) \<le> real s"
     using of_nat_ceiling by (simp add:s_def) blast
 
   moreover have "i < s \<Longrightarrow> measure \<Omega>\<^sub>0 {\<omega>. of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' (\<omega> i)) - of_rat (F 0 as)\<bar>} \<le> 1/3"
     for i
     using estimate'_bounds unfolding \<Omega>\<^sub>0_def M_def
     by (subst prob_prod_pmf_slice, simp_all)
- 
+
   ultimately have "1-real_of_rat \<epsilon> \<le> \<P>(\<omega> in measure_pmf \<Omega>\<^sub>0.
       \<bar>median s (\<lambda>i. estimate' (sketch_rv' (\<omega> i))) - real_of_rat (F 0 as)\<bar> \<le>  real_of_rat \<delta> * real_of_rat (F 0 as))"
     using \<epsilon>_range prob_space_measure_pmf
     by (intro prob_space.median_bound_2) auto
-  also have "... = \<P>(\<omega> in measure_pmf \<Omega>\<^sub>0. 
+  also have "... = \<P>(\<omega> in measure_pmf \<Omega>\<^sub>0.
       \<bar>median s (\<lambda>i. estimate (sketch_rv (\<omega> i))) - F 0 as\<bar> \<le>  \<delta> * F 0 as)"
-    using s_gt_0 median_rat[symmetric] real_g by (intro arg_cong2[where f="measure"]) 
+    using s_gt_0 median_rat[symmetric] real_g by (intro arg_cong2[where f="measure"])
       (simp_all add:of_rat_diff[symmetric] of_rat_mult[symmetric] of_rat_less_eq)
   finally show "\<P>(\<omega> in measure_pmf \<Omega>\<^sub>0. \<bar>median s (\<lambda>i. estimate (sketch_rv (\<omega> i))) - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1-real_of_rat \<epsilon>"
     by blast
 qed
 
 lemma f0_alg_correct':
   "\<P>(\<omega> in measure_pmf result. \<bar>\<omega> - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1 - of_rat \<epsilon>"
 proof -
   have f0_result_elim: "\<And>x. f0_result (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i)) =
     return_pmf (median s (\<lambda>i. estimate (sketch_rv (x i))))"
     by (simp add:estimate_def, rule median_cong, simp)
- 
+
   have "result = map_pmf (\<lambda>x. (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<Omega>\<^sub>0 \<bind> f0_result"
     by (subst result_def, subst f0_alg_sketch, simp)
   also have "... = \<Omega>\<^sub>0 \<bind> (\<lambda>x. return_pmf (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<bind> f0_result"
     by (simp add:t_def p_def r_def s_def map_pmf_def)
   also have "... = \<Omega>\<^sub>0 \<bind> (\<lambda>x. return_pmf (median s (\<lambda>i. estimate (sketch_rv (x i)))))"
     by (subst bind_assoc_pmf, subst bind_return_pmf, subst f0_result_elim)  simp
   finally have a:"result =  \<Omega>\<^sub>0 \<bind> (\<lambda>x. return_pmf (median s (\<lambda>i. estimate (sketch_rv (x i)))))"
     by simp
 
   show ?thesis
     using median_bounds by (simp add: a map_pmf_def[symmetric])
 qed
 
 private lemma f_subset:
   assumes "g ` A \<subseteq> h ` B"
   shows "(\<lambda>x. f (g x)) ` A \<subseteq> (\<lambda>x. f (h x)) ` B"
   using assms by auto
 
 lemma f0_exact_space_usage':
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n)"
   shows "AE \<omega> in \<Omega>. bit_count (encode_f0_state \<omega>) \<le> f0_space_usage (n, \<epsilon>, \<delta>)"
 proof -
-  
-  have log_2_4: "log 2 4 = 2" 
+
+  have log_2_4: "log 2 4 = 2"
     by (metis log2_of_power_eq mult_2 numeral_Bit0 of_nat_numeral power2_eq_square)
 
-  have a: "bit_count (F\<^sub>e (float_of (truncate_down r y))) \<le> 
+  have a: "bit_count (F\<^sub>e (float_of (truncate_down r y))) \<le>
     ereal (12 + 4 * real r + 2 * log 2 (log 2 (n+13)))" if a_1:"y \<in> {..<p}" for y
   proof (cases "y \<ge> 1")
     case True
 
-    have aux_1: " 0 < 2 + log 2 (real y)" 
+    have aux_1: " 0 < 2 + log 2 (real y)"
       using True by (intro add_pos_nonneg, auto)
     have aux_2: "0 < 2 + log 2 (real p)"
       using p_gt_1 by (intro add_pos_nonneg, auto)
 
-    have "bit_count (F\<^sub>e (float_of (truncate_down r y))) \<le> 
+    have "bit_count (F\<^sub>e (float_of (truncate_down r y))) \<le>
       ereal (10 + 4 * real r + 2 * log 2 (2 + \<bar>log 2 \<bar>real y\<bar>\<bar>))"
       by (rule truncate_float_bit_count)
     also have "... = ereal (10 + 4 * real r + 2 * log 2 (2 + (log 2 (real y))))"
       using True by simp
     also have "... \<le> ereal (10 + 4 * real r + 2 * log 2 (2 + log 2 p))"
       using aux_1 aux_2 True p_gt_0 a_1 by simp
     also have "... \<le> ereal (10 + 4 * real r + 2 * log 2 (log 2 4 + log 2 (2 * n + 40)))"
       using log_2_4 p_le_n p_gt_0
       by (intro ereal_mono add_mono mult_left_mono log_mono of_nat_mono add_pos_nonneg, auto)
     also have "... = ereal (10 + 4 * real r + 2 * log 2 (log 2 (8 * n + 160)))"
       by (simp add:log_mult[symmetric])
     also have "... \<le> ereal (10 + 4 * real r + 2 * log 2 (log 2 ((n+13) powr 2)))"
       by (intro ereal_mono add_mono mult_left_mono log_mono of_nat_mono add_pos_nonneg)
        (auto simp add:power2_eq_square algebra_simps)
     also have "... = ereal (10 +  4 * real r + 2 * log 2 (log 2 4 * log 2 (n + 13)))"
       by (subst log_powr, simp_all add:log_2_4)
     also have "... = ereal (12 +  4 * real r + 2 * log 2 (log 2 (n + 13)))"
       by (subst log_mult, simp_all add:log_2_4)
     finally show ?thesis by simp
   next
     case False
     hence "y = 0" using a_1 by simp
     then show ?thesis by (simp add:float_bit_count_zero)
   qed
 
-  have "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<le> 
+  have "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<le>
         f0_space_usage (n, \<epsilon>, \<delta>)" if b: "x \<in> {..<s} \<rightarrow>\<^sub>E space" for x
   proof -
-    have c: "x \<in> extensional {..<s}" using b by (simp add:PiE_def) 
+    have c: "x \<in> extensional {..<s}" using b by (simp add:PiE_def)
 
     have d: "sketch_rv (x y) \<subseteq> (\<lambda>k. float_of (truncate_down r k)) ` {..<p} "
       if d_1: "y < s" for y
     proof -
       have "sketch_rv (x y) \<subseteq> (\<lambda>xa. float_of (truncate_down r (hash xa (x y)))) ` set as"
-        using least_subset by (auto simp add:sketch_rv_def tr_hash_def) 
+        using least_subset by (auto simp add:sketch_rv_def tr_hash_def)
       also have "... \<subseteq> (\<lambda>k. float_of (truncate_down r (real k))) ` {..<p}"
         using b hash_range as_lt_p d_1
         by (intro f_subset[where f="\<lambda>x. float_of (truncate_down r (real x))"] image_subsetI)
          (simp add: PiE_iff mod_ring_carr)
       finally show ?thesis
         by simp
     qed
 
     have "\<And>y. y < s \<Longrightarrow> finite (sketch_rv (x y))"
       unfolding sketch_rv_def by (rule finite_subset[OF least_subset], simp)
     moreover have card_sketch: "\<And>y. y < s \<Longrightarrow> card (sketch_rv (x y)) \<le> t "
       by (simp add:sketch_rv_def card_least)
-    moreover have "\<And>y z. y < s \<Longrightarrow> z \<in> sketch_rv (x y) \<Longrightarrow> 
+    moreover have "\<And>y z. y < s \<Longrightarrow> z \<in> sketch_rv (x y) \<Longrightarrow>
       bit_count (F\<^sub>e z) \<le> ereal (12 + 4 * real r + 2 * log 2 (log 2 (real n + 13)))"
       using a d by auto
-    ultimately have e: "\<And>y. y < s \<Longrightarrow> bit_count (S\<^sub>e F\<^sub>e (sketch_rv (x y))) 
+    ultimately have e: "\<And>y. y < s \<Longrightarrow> bit_count (S\<^sub>e F\<^sub>e (sketch_rv (x y)))
       \<le> ereal (real t) * (ereal (12 + 4 * real r + 2 * log 2 (log 2 (real (n + 13)))) + 1) + 1"
       using float_encoding by (intro set_bit_count_est, auto)
 
     have f: "\<And>y. y < s \<Longrightarrow> bit_count (P\<^sub>e p 2 (x y)) \<le> ereal (real 2 * (log 2 (real p) + 1))"
       using p_gt_1 b
       by (intro bounded_degree_polynomial_bit_count) (simp_all add:space_def PiE_def Pi_def)
 
     have "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) =
       bit_count (N\<^sub>e s) + bit_count (N\<^sub>e t) +  bit_count (N\<^sub>e p) + bit_count (N\<^sub>e r) +
       bit_count (([0..<s] \<rightarrow>\<^sub>e P\<^sub>e p 2) x) +
       bit_count (([0..<s] \<rightarrow>\<^sub>e S\<^sub>e F\<^sub>e) (\<lambda>i\<in>{..<s}. sketch_rv (x i)))"
       by (simp add:encode_f0_state_def dependent_bit_count lessThan_atLeast0
         s_def[symmetric] t_def[symmetric] p_def[symmetric] r_def[symmetric] ac_simps)
     also have "... \<le> ereal (2* log 2 (real s + 1) + 1) + ereal  (2* log 2 (real t + 1) + 1)
       + ereal (2* log 2 (real p + 1) + 1) + ereal (2 * log 2 (real r + 1) + 1)
-      + (ereal (real s) * (ereal (real 2 * (log 2 (real p) + 1)))) 
-      + (ereal (real s) * ((ereal (real t) * 
+      + (ereal (real s) * (ereal (real 2 * (log 2 (real p) + 1))))
+      + (ereal (real s) * ((ereal (real t) *
             (ereal (12 + 4 * real r + 2 * log 2 (log 2 (real (n + 13)))) + 1) + 1)))"
       using c e f
       by (intro add_mono exp_golomb_bit_count fun_bit_count_est[where xs="[0..<s]", simplified])
        (simp_all add:lessThan_atLeast0)
-    also have "... = ereal ( 4 + 2 * log 2 (real s + 1) + 2 * log 2 (real t + 1) + 
-      2 * log 2 (real p + 1) + 2 * log 2 (real r + 1) + real s * (3 + 2 * log 2 (real p) + 
+    also have "... = ereal ( 4 + 2 * log 2 (real s + 1) + 2 * log 2 (real t + 1) +
+      2 * log 2 (real p + 1) + 2 * log 2 (real r + 1) + real s * (3 + 2 * log 2 (real p) +
       real t * (13 + (4 * real r + 2 * log 2 (log 2 (real n + 13))))))"
       by (simp add:algebra_simps)
-    also have "... \<le> ereal ( 4 + 2 * log 2 (real s + 1)  + 2 * log 2 (real t + 1) + 
-      2 * log 2 (2 * (21 + real n)) + 2 * log 2 (real r + 1) + real s * (3 + 2 * log 2 (2 * (21 + real n)) + 
+    also have "... \<le> ereal ( 4 + 2 * log 2 (real s + 1)  + 2 * log 2 (real t + 1) +
+      2 * log 2 (2 * (21 + real n)) + 2 * log 2 (real r + 1) + real s * (3 + 2 * log 2 (2 * (21 + real n)) +
       real t * (13 + (4 * real r + 2 * log 2 (log 2 (real n + 13))))))"
       using p_le_n p_gt_0
       by (intro ereal_mono add_mono mult_left_mono, auto)
-    also have "... =  ereal (6 + 2 * log 2 (real s + 1) + 2 * log 2 (real t + 1) + 
-      2 * log 2 (21 + real n) + 2 * log 2 (real r + 1) + real s * (5 + 2 * log 2 (21 + real n) + 
+    also have "... =  ereal (6 + 2 * log 2 (real s + 1) + 2 * log 2 (real t + 1) +
+      2 * log 2 (21 + real n) + 2 * log 2 (real r + 1) + real s * (5 + 2 * log 2 (21 + real n) +
       real t * (13 + (4 * real r + 2 * log 2 (log 2 (real n + 13))))))"
       by (subst (1 2) log_mult, auto)
     also have "... \<le> f0_space_usage (n, \<epsilon>, \<delta>)"
       by (simp add:s_def[symmetric] r_def[symmetric] t_def[symmetric] Let_def)
        (simp add:algebra_simps)
-    finally show "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<le> 
+    finally show "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<le>
         f0_space_usage (n, \<epsilon>, \<delta>)" by simp
   qed
   hence "\<And>x. x \<in> set_pmf \<Omega>\<^sub>0 \<Longrightarrow>
          bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i)))  \<le> ereal (f0_space_usage (n, \<epsilon>, \<delta>))"
     by (simp add:\<Omega>\<^sub>0_def set_prod_pmf del:f0_space_usage.simps)
   hence "\<And>y. y \<in> set_pmf \<Omega> \<Longrightarrow> bit_count (encode_f0_state y) \<le> ereal (f0_space_usage (n, \<epsilon>, \<delta>))"
     by (simp add: \<Omega>_def f0_alg_sketch del:f0_space_usage.simps f0_init.simps)
      (metis (no_types, lifting) image_iff pmf.set_map)
   thus ?thesis
     by (simp add: AE_measure_pmf_iff del:f0_space_usage.simps)
 qed
 
 end
 
 text \<open>Main results of this section:\<close>
 
 theorem f0_alg_correct:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> \<in> {0<..<1}"
   assumes "set as \<subseteq> {..<n}"
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n) \<bind> f0_result"
   shows "\<P>(\<omega> in measure_pmf \<Omega>. \<bar>\<omega> - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1 - of_rat \<epsilon>"
   using f0_alg_correct'[OF assms(1-3)] unfolding \<Omega>_def by blast
 
 theorem f0_exact_space_usage:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> \<in> {0<..<1}"
   assumes "set as \<subseteq> {..<n}"
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n)"
   shows "AE \<omega> in \<Omega>. bit_count (encode_f0_state \<omega>) \<le> f0_space_usage (n, \<epsilon>, \<delta>)"
   using f0_exact_space_usage'[OF assms(1-3)] unfolding \<Omega>_def by blast
 
 theorem f0_asymptotic_space_complexity:
-  "f0_space_usage \<in> O[at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda>(n, \<epsilon>, \<delta>). ln (1 / of_rat \<epsilon>) * 
+  "f0_space_usage \<in> O[at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda>(n, \<epsilon>, \<delta>). ln (1 / of_rat \<epsilon>) *
   (ln (real n) + 1 / (of_rat \<delta>)\<^sup>2 * (ln (ln (real n)) + ln (1 / of_rat \<delta>))))"
   (is "_ \<in> O[?F](?rhs)")
 proof -
   define n_of :: "nat \<times> rat \<times> rat \<Rightarrow> nat" where "n_of = (\<lambda>(n, \<epsilon>, \<delta>). n)"
   define \<epsilon>_of :: "nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<epsilon>_of = (\<lambda>(n, \<epsilon>, \<delta>). \<epsilon>)"
   define \<delta>_of :: "nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<delta>_of = (\<lambda>(n, \<epsilon>, \<delta>). \<delta>)"
   define t_of where "t_of = (\<lambda>x. nat \<lceil>80 / (real_of_rat (\<delta>_of x))\<^sup>2\<rceil>)"
   define s_of where "s_of = (\<lambda>x. nat \<lceil>-(18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>)"
   define r_of where "r_of = (\<lambda>x. nat (4 * \<lceil>log 2 (1 / real_of_rat (\<delta>_of x))\<rceil> + 23))"
 
-  define g where "g = (\<lambda>x. ln (1 / of_rat (\<epsilon>_of x)) * (ln (real (n_of x)) + 
+  define g where "g = (\<lambda>x. ln (1 / of_rat (\<epsilon>_of x)) * (ln (real (n_of x)) +
     1 / (of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / of_rat (\<delta>_of x)))))"
 
-  have evt: "(\<And>x. 
-    0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and> 
+  have evt: "(\<And>x.
+    0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and>
     1/real_of_rat (\<delta>_of x) \<ge> \<delta> \<and> 1/real_of_rat (\<epsilon>_of x) \<ge> \<epsilon> \<and>
     real (n_of x) \<ge> n \<Longrightarrow> P x) \<Longrightarrow> eventually P ?F"  (is "(\<And>x. ?prem x \<Longrightarrow> _) \<Longrightarrow> _")
     for \<delta> \<epsilon> n P
     apply (rule eventually_mono[where P="?prem" and Q="P"])
     apply (simp add:\<epsilon>_of_def case_prod_beta' \<delta>_of_def n_of_def)
-     apply (intro eventually_conj eventually_prod1' eventually_prod2' 
+     apply (intro eventually_conj eventually_prod1' eventually_prod2'
         sequentially_inf eventually_at_right_less inv_at_right_0_inf)
     by (auto simp add:prod_filter_eq_bot)
 
   have exp_pos: "exp k \<le> real x \<Longrightarrow> x > 0" for k x
-    using exp_gt_zero gr0I by force 
+    using exp_gt_zero gr0I by force
 
   have exp_gt_1: "exp 1 \<ge> (1::real)"
     by simp
 
   have 1: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (auto intro!:landau_o.big_mono evt[where \<epsilon>="exp 1"] iffD2[OF ln_ge_iff] simp add:abs_ge_iff)
 
-  have 2: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<delta>_of x)))" 
+  have 2: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<delta>_of x)))"
     by (auto intro!:landau_o.big_mono evt[where \<delta>="exp 1"] iffD2[OF ln_ge_iff] simp add:abs_ge_iff)
 
   have 3: " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
     using exp_pos
     by (intro landau_sum_2 2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff], auto)
-  have 4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)" 
+  have 4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using one_le_power
     by (intro landau_o.big_mono evt[where \<delta>="1"], auto simp add:power_one_over[symmetric])
 
   have "(\<lambda>x. 80 * (1 / (real_of_rat (\<delta>_of x))\<^sup>2)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     by (subst landau_o.big.cmult_in_iff, auto)
   hence 5: "(\<lambda>x. real (t_of x)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
-    unfolding  t_of_def 
+    unfolding  t_of_def
     by (intro landau_real_nat landau_ceil 4, auto)
 
   have "(\<lambda>x. ln (real_of_rat (\<epsilon>_of x))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono evt[where \<epsilon>="1"], auto simp add:ln_div)
   hence 6: "(\<lambda>x. real (s_of x)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     unfolding s_of_def by (intro landau_nat_ceil 1, simp)
 
   have 7: " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     using exp_pos by (auto intro!: landau_o.big_mono evt[where n="exp 1"] iffD2[OF ln_ge_iff] simp: abs_ge_iff)
 
-  have 8:" (\<lambda>_. 1) \<in> 
+  have 8:" (\<lambda>_. 1) \<in>
     O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using order_trans[OF exp_gt_1] exp_pos
-    by (intro landau_sum_1 7 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff] 
+    by (intro landau_sum_1 7 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff]
         mult_nonneg_nonneg add_nonneg_nonneg) auto
 
   have "(\<lambda>x. ln (real (s_of x) + 1)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_ln_3 sum_in_bigo 6 1, simp)
 
   hence 9: "(\<lambda>x. log 2 (real (s_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 8, auto simp:log_def)
   have 10: "(\<lambda>x. 1) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 8 1)
 
-  have "(\<lambda>x. ln (real (t_of x) + 1)) \<in> 
+  have "(\<lambda>x. ln (real (t_of x) + 1)) \<in>
     O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using 5 by (intro landau_o.big_mult_1 3 landau_ln_3 sum_in_bigo 4, simp_all)
-  hence " (\<lambda>x. log 2 (real (t_of x) + 1)) \<in> 
+  hence " (\<lambda>x. log 2 (real (t_of x) + 1)) \<in>
   O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using order_trans[OF exp_gt_1] exp_pos
-    by (intro landau_sum_2  evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff] 
+    by (intro landau_sum_2  evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff]
         mult_nonneg_nonneg add_nonneg_nonneg) (auto simp add:log_def)
   hence 11: "(\<lambda>x. log 2 (real (t_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def  by (intro landau_o.big_mult_1' 1, auto)
-  have " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. real (n_of x))" 
+  have " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. real (n_of x))"
     by (intro landau_o.big_mono evt[where n="1"], auto)
-  hence "(\<lambda>x. ln (real (n_of x) + 21)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))" 
+  hence "(\<lambda>x. ln (real (n_of x) + 21)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     by (intro landau_ln_2[where a="2"] evt[where n="2"] sum_in_bigo, auto)
 
   hence 12: "(\<lambda>x. log 2 (real (n_of x) + 21)) \<in> O[?F](g)"
     unfolding g_def using exp_pos order_trans[OF exp_gt_1]
-    by (intro landau_o.big_mult_1' 1 landau_sum_1  evt[where n="exp 1" and \<delta>="1"] 
+    by (intro landau_o.big_mult_1' 1 landau_sum_1  evt[where n="exp 1" and \<delta>="1"]
         ln_ge_zero  iffD2[OF ln_ge_iff] mult_nonneg_nonneg add_nonneg_nonneg)  (auto simp add:log_def)
 
-  have "(\<lambda>x. ln (1 / real_of_rat (\<delta>_of x))) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)" 
-    by (intro landau_ln_3 evt[where \<delta>="1"] landau_o.big_mono) 
+  have "(\<lambda>x. ln (1 / real_of_rat (\<delta>_of x))) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
+    by (intro landau_ln_3 evt[where \<delta>="1"] landau_o.big_mono)
       (auto simp add:power_one_over[symmetric] self_le_power)
   hence " (\<lambda>x. real (nat (4*\<lceil>log 2 (1 / real_of_rat (\<delta>_of x))\<rceil>+23))) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using 4 by (auto intro!: landau_real_nat sum_in_bigo landau_ceil simp:log_def)
   hence " (\<lambda>x. ln (real (r_of x) + 1)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     unfolding r_of_def
     by (intro landau_ln_3 sum_in_bigo 4, auto)
-  hence " (\<lambda>x. log 2 (real (r_of x) + 1)) \<in> 
+  hence " (\<lambda>x. log 2 (real (r_of x) + 1)) \<in>
     O[?F](\<lambda>x. (1 / (real_of_rat (\<delta>_of x))\<^sup>2) * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     by (intro landau_o.big_mult_1 3, simp add:log_def)
-  hence " (\<lambda>x. log 2 (real (r_of x) + 1)) \<in> 
+  hence " (\<lambda>x. log 2 (real (r_of x) + 1)) \<in>
     O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using exp_pos order_trans[OF exp_gt_1]
-    by (intro landau_sum_2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  
+    by (intro landau_sum_2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero
         iffD2[OF ln_ge_iff] add_nonneg_nonneg mult_nonneg_nonneg) (auto)
   hence 13: "(\<lambda>x. log 2 (real (r_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def  by (intro landau_o.big_mult_1' 1, auto)
-  have 14: "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. real (n_of x))" 
+  have 14: "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. real (n_of x))"
     by (intro landau_o.big_mono evt[where n="1"], auto)
 
-  have "(\<lambda>x. ln (real (n_of x) + 13)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))" 
+  have "(\<lambda>x. ln (real (n_of x) + 13)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     using 14 by (intro landau_ln_2[where a="2"]  evt[where n="2"] sum_in_bigo, auto)
 
   hence "(\<lambda>x. ln (log 2 (real (n_of x) + 13))) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))))"
     using exp_pos by (intro landau_ln_2[where a="2"] iffD2[OF ln_ge_iff] evt[where n="exp 2"])
         (auto simp add:log_def)
 
   hence "(\<lambda>x. log 2 (log 2 (real (n_of x) + 13))) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
     using exp_pos by (intro landau_sum_1 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff])
      (auto simp add:log_def)
 
   moreover have  "(\<lambda>x. real (r_of x)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<delta>_of x)))"
     unfolding r_of_def using 2
     by (auto intro!: landau_real_nat sum_in_bigo landau_ceil simp:log_def)
   hence "(\<lambda>x. real (r_of x)) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
-    using exp_pos 
+    using exp_pos
     by (intro landau_sum_2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff], auto)
 
   ultimately have 15:" (\<lambda>x. real (t_of x) * (13 + 4 * real (r_of x) + 2 * log 2 (log 2 (real (n_of x) + 13))))
       \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
-    using 5 3 
+    using 5 3
     by (intro landau_o.mult sum_in_bigo, auto)
 
   have "(\<lambda>x. 5 + 2 * log 2 (21 + real (n_of x)) + real (t_of x) * (13 + 4 * real (r_of x) + 2 * log 2 (log 2 (real (n_of x) + 13))))
       \<in> O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
   proof -
-    have "\<forall>\<^sub>F x in ?F. 0 \<le> ln (real (n_of x))" 
+    have "\<forall>\<^sub>F x in ?F. 0 \<le> ln (real (n_of x))"
       by (intro evt[where n="1"] ln_ge_zero, auto)
     moreover have "\<forall>\<^sub>F x in ?F. 0 \<le> 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
       using exp_pos
-      by (intro evt[where n="exp 1" and \<delta>="1"] mult_nonneg_nonneg add_nonneg_nonneg 
+      by (intro evt[where n="exp 1" and \<delta>="1"] mult_nonneg_nonneg add_nonneg_nonneg
           ln_ge_zero iffD2[OF ln_ge_iff]) auto
-    moreover have " (\<lambda>x. ln (21 + real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)))" 
+    moreover have " (\<lambda>x. ln (21 + real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
       using 14 by (intro landau_ln_2[where a="2"] sum_in_bigo evt[where n="2"], auto)
     hence "(\<lambda>x. 5 + 2 * log 2 (21 + real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
       using 7  by (intro sum_in_bigo, auto simp add:log_def)
     ultimately show ?thesis
       using 15 by (rule landau_sum)
   qed
 
   hence 16: "(\<lambda>x. real (s_of x) * (5 + 2 * log 2 (21 + real (n_of x)) + real (t_of x) *
     (13 + 4 * real (r_of x) + 2 * log 2 (log 2 (real (n_of x) + 13)))))  \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.mult 6, auto)
 
   have "f0_space_usage = (\<lambda>x. f0_space_usage (n_of x, \<epsilon>_of x, \<delta>_of x))"
     by (simp add:case_prod_beta' n_of_def \<epsilon>_of_def \<delta>_of_def)
   also have "... \<in>  O[?F](g)"
     using 9 10 11 12 13 16
-    by (simp add:fun_cong[OF s_of_def[symmetric]] fun_cong[OF t_of_def[symmetric]] 
+    by (simp add:fun_cong[OF s_of_def[symmetric]] fun_cong[OF t_of_def[symmetric]]
         fun_cong[OF r_of_def[symmetric]] Let_def) (intro sum_in_bigo, auto)
   also have "... = O[?F](?rhs)"
     by (simp add:case_prod_beta' g_def n_of_def \<epsilon>_of_def \<delta>_of_def)
   finally show ?thesis
     by simp
 qed
 
 end
diff --git a/thys/Frequency_Moments/Frequency_Moment_2.thy b/thys/Frequency_Moments/Frequency_Moment_2.thy
--- a/thys/Frequency_Moments/Frequency_Moment_2.thy
+++ b/thys/Frequency_Moments/Frequency_Moment_2.thy
@@ -1,721 +1,725 @@
 section \<open>Frequency Moment $2$\<close>
 
 theory Frequency_Moment_2
   imports
     Universal_Hash_Families.Carter_Wegman_Hash_Family
     Universal_Hash_Families.Universal_Hash_Families_More_Finite_Fields
     Equivalence_Relation_Enumeration.Equivalence_Relation_Enumeration
     Landau_Ext
     Median_Method.Median
+    Probability_Ext
     Product_PMF_Ext
-    Frequency_Moments 
+    Frequency_Moments
 begin
 
+hide_const (open) Discrete_Topology.discrete
+hide_const (open) Isolated.discrete
+
 text \<open>This section contains a formalization of the algorithm for the second frequency moment.
 It is based on the algorithm described in \<^cite>\<open>\<open>\textsection 2.2\<close> in "alon1999"\<close>.
 The only difference is that the algorithm is adapted to work with prime field of odd order, which
 greatly reduces the implementation complexity.\<close>
 
 fun f2_hash where
   "f2_hash p h k = (if even (ring.hash (mod_ring p) k h) then int p - 1 else - int p - 1)"
 
 type_synonym f2_state = "nat \<times> nat \<times> nat \<times> (nat \<times> nat \<Rightarrow> nat list) \<times> (nat \<times> nat \<Rightarrow> int)"
 
 fun f2_init :: "rat \<Rightarrow> rat \<Rightarrow> nat \<Rightarrow> f2_state pmf" where
   "f2_init \<delta> \<epsilon> n =
     do {
       let s\<^sub>1 = nat \<lceil>6 / \<delta>\<^sup>2\<rceil>;
       let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil>;
       let p = prime_above (max n 3);
       h \<leftarrow> prod_pmf ({..<s\<^sub>1} \<times> {..<s\<^sub>2}) (\<lambda>_. pmf_of_set (bounded_degree_polynomials (mod_ring p) 4));
       return_pmf (s\<^sub>1, s\<^sub>2, p, h, (\<lambda>_ \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. (0 :: int)))
     }"
 
 fun f2_update :: "nat \<Rightarrow> f2_state \<Rightarrow> f2_state pmf" where
-  "f2_update x (s\<^sub>1, s\<^sub>2, p, h, sketch) = 
+  "f2_update x (s\<^sub>1, s\<^sub>2, p, h, sketch) =
     return_pmf (s\<^sub>1, s\<^sub>2, p, h, \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. f2_hash p (h i) x + sketch i)"
 
 fun f2_result :: "f2_state \<Rightarrow> rat pmf" where
-  "f2_result (s\<^sub>1, s\<^sub>2, p, h, sketch) = 
-    return_pmf (median s\<^sub>2 (\<lambda>i\<^sub>2 \<in> {..<s\<^sub>2}. 
+  "f2_result (s\<^sub>1, s\<^sub>2, p, h, sketch) =
+    return_pmf (median s\<^sub>2 (\<lambda>i\<^sub>2 \<in> {..<s\<^sub>2}.
       (\<Sum>i\<^sub>1\<in>{..<s\<^sub>1} . (rat_of_int (sketch (i\<^sub>1, i\<^sub>2)))\<^sup>2) / (((rat_of_nat p)\<^sup>2-1) * rat_of_nat s\<^sub>1)))"
 
 fun f2_space_usage :: "(nat \<times> nat \<times> rat \<times> rat) \<Rightarrow> real" where
   "f2_space_usage (n, m, \<epsilon>, \<delta>) = (
     let s\<^sub>1 = nat \<lceil>6 / \<delta>\<^sup>2 \<rceil> in
-    let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil> in 
+    let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil> in
     3 +
     2 * log 2 (s\<^sub>1 + 1) +
     2 * log 2 (s\<^sub>2 + 1) +
     2 * log 2 (9 + 2 * real n) +
     s\<^sub>1 * s\<^sub>2 * (5 + 4*log 2 (8 + 2 * real n) + 2 * log 2 (real m * (18 + 4 * real n) + 1 )))"
 
 definition encode_f2_state :: "f2_state \<Rightarrow> bool list option" where
-  "encode_f2_state = 
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>1. 
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>2. 
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>p. 
+  "encode_f2_state =
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>1.
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>2.
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>p.
     (List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e P\<^sub>e p 4) \<times>\<^sub>e
     (List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e))))"
 
 lemma "inj_on encode_f2_state (dom encode_f2_state)"
 proof -
   have " is_encoding encode_f2_state"
     unfolding encode_f2_state_def
     by (intro dependent_encoding exp_golomb_encoding fun_encoding list_encoding int_encoding poly_encoding)
-      
+
   thus ?thesis
     by (rule encoding_imp_inj)
 qed
 
 context
   fixes \<epsilon> \<delta> :: rat
   fixes n :: nat
   fixes as :: "nat list"
   fixes result
   assumes \<epsilon>_range: "\<epsilon> \<in> {0<..<1}"
   assumes \<delta>_range: "\<delta> > 0"
   assumes as_range: "set as \<subseteq> {..<n}"
   defines "result \<equiv> fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n) \<bind> f2_result"
-begin  
+begin
 
 private definition s\<^sub>1 where "s\<^sub>1 = nat \<lceil>6 / \<delta>\<^sup>2\<rceil>"
 
 lemma s1_gt_0: "s\<^sub>1 > 0"
     using \<delta>_range by (simp add:s\<^sub>1_def)
 
 private definition s\<^sub>2 where "s\<^sub>2 = nat \<lceil>-(18* ln (real_of_rat \<epsilon>))\<rceil>"
 
 lemma s2_gt_0: "s\<^sub>2 > 0"
     using \<epsilon>_range by (simp add:s\<^sub>2_def)
 
 private definition p where "p = prime_above (max n 3)"
- 
-lemma p_prime: "Factorial_Ring.prime p" 
+
+lemma p_prime: "Factorial_Ring.prime p"
   unfolding p_def using prime_above_prime by blast
 
 lemma p_ge_3: "p \<ge> 3"
     unfolding p_def by (meson max.boundedE prime_above_lower_bound)
 
 lemma p_gt_0: "p > 0" using p_ge_3 by linarith
 
 lemma p_gt_1: "p > 1" using p_ge_3 by simp
 
 lemma p_ge_n: "p \<ge> n" unfolding p_def
   by (meson max.boundedE prime_above_lower_bound )
 
 interpretation carter_wegman_hash_family "mod_ring p" 4
   using carter_wegman_hash_familyI[OF mod_ring_is_field mod_ring_finite]
   using p_prime by auto
 
 definition sketch where "sketch = fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n)"
-private definition \<Omega> where"\<Omega> = prod_pmf ({..<s\<^sub>1} \<times> {..<s\<^sub>2}) (\<lambda>_. pmf_of_set space)" 
-private definition \<Omega>\<^sub>p where"\<Omega>\<^sub>p = measure_pmf \<Omega>" 
+private definition \<Omega> where"\<Omega> = prod_pmf ({..<s\<^sub>1} \<times> {..<s\<^sub>2}) (\<lambda>_. pmf_of_set space)"
+private definition \<Omega>\<^sub>p where"\<Omega>\<^sub>p = measure_pmf \<Omega>"
 private definition sketch_rv where "sketch_rv \<omega> = of_int (sum_list (map (f2_hash p \<omega>) as))^2"
 private definition mean_rv where "mean_rv \<omega> = (\<lambda>i\<^sub>2. (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) / (((of_nat p)\<^sup>2 - 1) * of_nat s\<^sub>1))"
 private definition result_rv where "result_rv \<omega> = median s\<^sub>2 (\<lambda>i\<^sub>2\<in>{..<s\<^sub>2}. mean_rv \<omega> i\<^sub>2)"
 
 lemma mean_rv_alg_sketch:
   "sketch = \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (\<omega> i)) as)))"
 proof -
   have "sketch =  fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n)"
     by (simp add:sketch_def)
-  also have "... = \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, 
+  also have "... = \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>,
       \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (\<omega> i)) as)))"
   proof (induction as rule:rev_induct)
     case Nil
-    then show ?case 
-      by (simp add:s\<^sub>1_def s\<^sub>2_def space_def p_def[symmetric] \<Omega>_def restrict_def Let_def) 
+    then show ?case
+      by (simp add:s\<^sub>1_def s\<^sub>2_def space_def p_def[symmetric] \<Omega>_def restrict_def Let_def)
   next
     case (snoc a as)
-    have "fold (\<lambda>a state. state \<bind> f2_update a) (as @ [a]) (f2_init \<delta> \<epsilon> n) = \<Omega> \<bind> 
+    have "fold (\<lambda>a state. state \<bind> f2_update a) (as @ [a]) (f2_init \<delta> \<epsilon> n) = \<Omega> \<bind>
       (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, \<lambda>s \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. (\<Sum>x \<leftarrow> as.  f2_hash p (\<omega> s) x)) \<bind> f2_update a)"
       using snoc by (simp add: bind_assoc_pmf restrict_def del:f2_hash.simps f2_init.simps)
     also have "... =  \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. (\<Sum>x \<leftarrow> as@[a].  f2_hash p (\<omega> i) x)))"
       by (subst bind_return_pmf) (simp add: add.commute del:f2_hash.simps cong:restrict_cong)
     finally show ?case by blast
   qed
   finally show ?thesis by auto
 qed
 
 lemma distr:  "result = map_pmf result_rv \<Omega>"
 proof -
   have "result = sketch \<bind> f2_result"
     by (simp add:result_def sketch_def)
   also have "... = \<Omega> \<bind> (\<lambda>x. f2_result (s\<^sub>1, s\<^sub>2, p, x, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (x i)) as)))"
     by (simp add: mean_rv_alg_sketch  bind_assoc_pmf bind_return_pmf)
   also have "... = map_pmf result_rv \<Omega>"
     by (simp add:map_pmf_def result_rv_def mean_rv_def sketch_rv_def lessThan_atLeast0 cong:restrict_cong)
   finally show ?thesis by simp
 qed
 
 private lemma f2_hash_pow_exp:
   assumes "k < p"
   shows
-    "expectation (\<lambda>\<omega>. real_of_int (f2_hash p \<omega> k) ^m) = 
+    "expectation (\<lambda>\<omega>. real_of_int (f2_hash p \<omega> k) ^m) =
      ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p)"
 proof -
 
   have "odd p" using p_prime p_ge_3 prime_odd_nat assms by simp
-  then obtain t where t_def: "p=2*t+1" 
+  then obtain t where t_def: "p=2*t+1"
     using oddE by blast
 
-  have "Collect even \<inter> {..<2 * t + 1} \<subseteq> (*) 2 ` {..<t + 1}" 
+  have "Collect even \<inter> {..<2 * t + 1} \<subseteq> (*) 2 ` {..<t + 1}"
     by (rule in_image_by_witness[where g="\<lambda>x. x div 2"], simp, linarith)
   moreover have " (*) 2 ` {..<t + 1} \<subseteq> Collect even \<inter> {..<2 * t + 1}"
     by (rule image_subsetI, simp)
   ultimately have "card ({k. even k} \<inter> {..<p}) = card ((\<lambda>x. 2*x) ` {..<t+1})"
     unfolding t_def using order_antisym by metis
-  also have "... = card {..<t+1}" 
+  also have "... = card {..<t+1}"
     by (rule card_image, simp add: inj_on_mult)
   also have "... =  t+1" by simp
   finally have card_even: "card ({k. even k} \<inter> {..<p}) = t+1" by simp
   hence "card ({k. even k} \<inter> {..<p}) * 2 = (p+1)" by (simp add:t_def)
   hence prob_even: "prob {\<omega>. hash k \<omega> \<in> Collect even} = (real p + 1)/(2*real p)"
-    using assms by (subst prob_range, auto simp:frac_eq_eq p_gt_0 mod_ring_def) 
+    using assms by (subst prob_range, auto simp:frac_eq_eq p_gt_0 mod_ring_def)
 
   have "p = card {..<p}" by simp
-  also have "... = card (({k. odd k} \<inter> {..<p}) \<union> ({k. even k} \<inter> {..<p}))" 
+  also have "... = card (({k. odd k} \<inter> {..<p}) \<union> ({k. even k} \<inter> {..<p}))"
     by (rule arg_cong[where f="card"], auto)
   also have "... = card ({k. odd k} \<inter> {..<p}) +  card ({k. even k} \<inter> {..<p})"
     by (rule card_Un_disjoint, simp, simp, blast)
   also have "... = card ({k. odd k} \<inter> {..<p}) + t+1"
     by (simp add:card_even)
   finally have "p = card ({k. odd k} \<inter> {..<p}) + t+1"
     by simp
-  hence "card ({k. odd k} \<inter> {..<p}) * 2 = (p-1)" 
+  hence "card ({k. odd k} \<inter> {..<p}) * 2 = (p-1)"
     by (simp add:t_def)
   hence prob_odd: "prob {\<omega>. hash k \<omega> \<in> Collect odd} = (real p - 1)/(2*real p)"
     using assms by (subst prob_range, auto simp add: frac_eq_eq mod_ring_def)
 
   have "expectation (\<lambda>x. real_of_int (f2_hash p x k) ^ m) =
-    expectation (\<lambda>\<omega>. indicator {\<omega>. even (hash k \<omega>)} \<omega> * (real p - 1)^m + 
-      indicator {\<omega>. odd (hash k \<omega>)} \<omega> * (-real p - 1)^m)" 
+    expectation (\<lambda>\<omega>. indicator {\<omega>. even (hash k \<omega>)} \<omega> * (real p - 1)^m +
+      indicator {\<omega>. odd (hash k \<omega>)} \<omega> * (-real p - 1)^m)"
     by (rule Bochner_Integration.integral_cong, simp, simp)
-  also have "... = 
-     prob {\<omega>. hash  k \<omega> \<in> Collect even}  * (real p - 1) ^ m  + 
+  also have "... =
+     prob {\<omega>. hash  k \<omega> \<in> Collect even}  * (real p - 1) ^ m  +
      prob {\<omega>. hash  k \<omega> \<in> Collect odd}  * (-real p - 1) ^ m "
     by (simp, simp add:M_def)
   also have "... = (real p + 1) * (real p - 1) ^ m / (2 * real p) + (real p - 1) * (- real p - 1) ^ m / (2 * real p)"
     by (subst prob_even, subst prob_odd, simp)
-  also have "... =  
+  also have "... =
     ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p)"
     by (simp add:add_divide_distrib ac_simps)
-  finally show "expectation (\<lambda>x. real_of_int (f2_hash p x k) ^ m) = 
+  finally show "expectation (\<lambda>x. real_of_int (f2_hash p x k) ^ m) =
     ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p)" by simp
 qed
 
-lemma 
+lemma
   shows var_sketch_rv:"variance sketch_rv \<le> 2*(real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2" (is "?A")
   and exp_sketch_rv:"expectation sketch_rv = real_of_rat (F 2 as) * ((real p)\<^sup>2-1)" (is "?B")
 proof -
   define h where "h = (\<lambda>\<omega> x. real_of_int (f2_hash p \<omega> x))"
   define c where "c = (\<lambda>x. real (count_list as x))"
   define r where "r = (\<lambda>(m::nat). ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p))"
-  define h_prod where "h_prod = (\<lambda>as \<omega>. prod_list (map (h \<omega>) as))" 
+  define h_prod where "h_prod = (\<lambda>as \<omega>. prod_list (map (h \<omega>) as))"
 
   define exp_h_prod :: "nat list \<Rightarrow> real" where "exp_h_prod = (\<lambda>as. (\<Prod>i \<in> set as. r (count_list as i)))"
 
   have f_eq: "sketch_rv = (\<lambda>\<omega>. (\<Sum>x \<in> set as. c x * h \<omega> x)^2)"
     by (rule ext, simp add:sketch_rv_def c_def h_def sum_list_eval del:f2_hash.simps)
 
   have r_one: "r (Suc 0) = 0"
     by (simp add:r_def algebra_simps)
 
   have r_two: "r 2 = (real p^2-1)"
-    using p_gt_0 unfolding r_def power2_eq_square 
+    using p_gt_0 unfolding r_def power2_eq_square
     by (simp add:nonzero_divide_eq_eq, simp add:algebra_simps)
 
   have"(real p)^2 \<ge> 2^2"
     by (rule power_mono, use p_gt_1 in linarith, simp)
   hence p_square_ge_4: "(real p)\<^sup>2 \<ge> 4" by simp
 
-  have "r 4 = (real p)^4+2*(real p)\<^sup>2 - 3" 
+  have "r 4 = (real p)^4+2*(real p)\<^sup>2 - 3"
     using p_gt_0 unfolding r_def
     by (subst nonzero_divide_eq_eq, auto simp:power4_eq_xxxx power2_eq_square algebra_simps)
   also have "... \<le> (real p)^4+2*(real p)\<^sup>2 + 3"
     by simp
   also have "... \<le> 3 * r 2 * r 2"
     using p_square_ge_4
     by (simp add:r_two power4_eq_xxxx power2_eq_square algebra_simps mult_left_mono)
   finally have r_four_est: "r 4 \<le> 3 * r 2 * r 2"  by simp
 
-  have exp_h_prod_elim: "exp_h_prod = (\<lambda>as. prod_list (map (r \<circ> count_list as) (remdups as)))" 
+  have exp_h_prod_elim: "exp_h_prod = (\<lambda>as. prod_list (map (r \<circ> count_list as) (remdups as)))"
     by (simp add:exp_h_prod_def prod.set_conv_list[symmetric])
 
   have exp_h_prod: "\<And>x. set x \<subseteq> set as \<Longrightarrow> length x \<le> 4 \<Longrightarrow> expectation (h_prod x) = exp_h_prod x"
   proof -
-    fix x 
+    fix x
     assume "set x \<subseteq> set as"
     hence x_sub_p: "set x \<subseteq> {..<p}" using as_range p_ge_n by auto
     hence x_le_p: "\<And>k. k \<in> set x \<Longrightarrow> k < p" by auto
     assume "length x \<le> 4"
     hence card_x: "card (set x) \<le> 4" using card_length dual_order.trans by blast
 
     have "set x \<subseteq> carrier (mod_ring p) "
       using x_sub_p by (simp add:mod_ring_def)
 
     hence h_indep: "indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. h \<omega> i ^ count_list x i) (set x)"
       using k_wise_indep_vars_subset[OF k_wise_indep] card_x as_range h_def
       by (auto intro:indep_vars_compose2[where X="hash" and M'=" (\<lambda>_. discrete)"])
 
     have "expectation (h_prod x) = expectation (\<lambda>\<omega>. \<Prod> i \<in> set x. h \<omega> i^(count_list x i))"
       by (simp add:h_prod_def prod_list_eval)
     also have "... = (\<Prod>i \<in> set x. expectation (\<lambda>\<omega>. h \<omega> i^(count_list x i)))"
       by (simp add: indep_vars_lebesgue_integral[OF _ h_indep])
     also have "... = (\<Prod>i \<in> set x. r (count_list x i))"
-      using f2_hash_pow_exp x_le_p 
+      using f2_hash_pow_exp x_le_p
       by (simp add:h_def r_def M_def[symmetric] del:f2_hash.simps)
     also have "... = exp_h_prod x"
       by (simp add:exp_h_prod_def)
     finally show "expectation (h_prod x) = exp_h_prod x" by simp
   qed
 
-  have "\<And>x y. kernel_of x = kernel_of y \<Longrightarrow> exp_h_prod x = exp_h_prod y" 
+  have "\<And>x y. kernel_of x = kernel_of y \<Longrightarrow> exp_h_prod x = exp_h_prod y"
   proof -
     fix x y :: "nat list"
     assume a:"kernel_of x = kernel_of y"
     then obtain f where b:"bij_betw f (set x) (set y)" and c:"\<And>z. z \<in> set x \<Longrightarrow> count_list x z = count_list y (f z)"
       using kernel_of_eq_imp_bij by blast
     have "exp_h_prod x = prod ( (\<lambda>i. r(count_list y i)) \<circ> f) (set x)"
       by (simp add:exp_h_prod_def c)
     also have "... = (\<Prod>i \<in> f ` (set x). r(count_list y i))"
       by (metis b bij_betw_def prod.reindex)
     also have "... = exp_h_prod y"
       unfolding exp_h_prod_def
       by (rule prod.cong, metis b bij_betw_def) simp
     finally show "exp_h_prod x = exp_h_prod y" by simp
   qed
 
-  hence exp_h_prod_cong: "\<And>p x. of_bool (kernel_of x = kernel_of p) * exp_h_prod p = 
-    of_bool (kernel_of x = kernel_of p) * exp_h_prod x" 
+  hence exp_h_prod_cong: "\<And>p x. of_bool (kernel_of x = kernel_of p) * exp_h_prod p =
+    of_bool (kernel_of x = kernel_of p) * exp_h_prod x"
     by (metis (full_types) of_bool_eq_0_iff vector_space_over_itself.scale_zero_left)
 
   have c:"(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * r) = r"
     if a:"length xs = n" for xs :: "nat list" and n and r :: real
   proof -
     have "(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * 1) = (1::real)"
-      using equiv_rels_2[OF a[symmetric]] by (simp add:equiv_rels_def comp_def) 
-    thus "(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * r) = (r::real)" 
+      using equiv_rels_2[OF a[symmetric]] by (simp add:equiv_rels_def comp_def)
+    thus "(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * r) = (r::real)"
       by (simp add:sum_list_mult_const)
   qed
 
   have "expectation sketch_rv = (\<Sum>i\<in>set as. (\<Sum>j\<in>set as. c i * c j * expectation (h_prod [i,j])))"
     by (simp add:f_eq h_prod_def power2_eq_square sum_distrib_left sum_distrib_right Bochner_Integration.integral_sum algebra_simps)
   also have "... = (\<Sum>i\<in>set as. (\<Sum>j\<in>set as. c i * c j * exp_h_prod [i,j]))"
     by (simp add:exp_h_prod)
-  also have "... = (\<Sum>i \<in> set as. (\<Sum>j \<in> set as.  
+  also have "... = (\<Sum>i \<in> set as. (\<Sum>j \<in> set as.
     c i * c j * (sum_list (map (\<lambda>p. of_bool (kernel_of [i,j] = kernel_of p) * exp_h_prod p) (enum_rgfs 2)))))"
     by (subst exp_h_prod_cong, simp add:c)
   also have "... = (\<Sum>i\<in>set as. c i * c i * r 2)"
     by (simp add: numeral_eq_Suc kernel_of_eq All_less_Suc exp_h_prod_elim r_one distrib_left sum.distrib sum_collapse)
   also have "... = real_of_rat (F 2 as) * ((real p)^2-1)"
     by (simp add: sum_distrib_right[symmetric] c_def F_def power2_eq_square of_rat_sum of_rat_mult r_two)
   finally show b:?B by simp
 
   have "expectation (\<lambda>x. (sketch_rv x)\<^sup>2) = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as.
     c i1 * c i2 * c i3 * c i4 * expectation (h_prod [i1, i2, i3, i4])))))"
     by (simp add:f_eq h_prod_def power4_eq_xxxx sum_distrib_left sum_distrib_right Bochner_Integration.integral_sum algebra_simps)
-  also have "... = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as. 
+  also have "... = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as.
     c i1 * c i2 * c i3 * c i4 * exp_h_prod [i1,i2,i3,i4]))))"
     by (simp add:exp_h_prod)
-  also have "... = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as. 
-    c i1 * c i2 * c i3 * c i4 * 
+  also have "... = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as.
+    c i1 * c i2 * c i3 * c i4 *
     (sum_list (map (\<lambda>p. of_bool (kernel_of [i1,i2,i3,i4] = kernel_of p) * exp_h_prod p) (enum_rgfs 4)))))))"
     by (subst exp_h_prod_cong, simp add:c)
-  also have "... = 
+  also have "... =
     3 * (\<Sum>i \<in> set as. (\<Sum>j \<in> set as. c i^2 * c j^2 * r 2 * r 2)) + ((\<Sum> i \<in> set as. c i^4 * r 4) - 3 *  (\<Sum> i \<in> set as. c i ^ 4 * r 2 * r 2))"
     apply (simp add: numeral_eq_Suc exp_h_prod_elim r_one) (* large intermediate terms *)
     apply (simp add: kernel_of_eq All_less_Suc numeral_eq_Suc distrib_left sum.distrib sum_collapse neq_commute of_bool_not_iff)
     apply (simp add: algebra_simps sum_subtractf sum_collapse)
     apply (simp add: sum_distrib_left algebra_simps)
     done
   also have "... = 3 * (\<Sum>i \<in> set as. c i^2 * r 2)^2 + (\<Sum> i \<in> set as. c i ^ 4 * (r 4 - 3 * r 2 * r 2))"
     by (simp add:power2_eq_square sum_distrib_left algebra_simps sum_subtractf)
   also have "... = 3 * (\<Sum>i \<in> set as. c i^2)^2 * (r 2)^2 + (\<Sum>i \<in> set as. c i ^ 4 * (r 4 - 3 * r 2 * r 2))"
     by (simp add:power_mult_distrib sum_distrib_right[symmetric])
   also have "... \<le> 3 * (\<Sum>i \<in> set as. c i^2)^2 * (r 2)^2 + (\<Sum>i \<in> set as. c i ^ 4 * 0)"
-    using r_four_est  
+    using r_four_est
     by (auto intro!: sum_nonpos simp add:mult_nonneg_nonpos)
-  also have "... = 3 * (real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2" 
+  also have "... = 3 * (real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2"
     by (simp add:c_def r_two F_def of_rat_sum of_rat_power)
   finally have "expectation (\<lambda>x. (sketch_rv x)\<^sup>2) \<le> 3 * (real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2"
     by simp
-  
+
   thus "variance sketch_rv \<le> 2*(real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2"
      by (simp add: variance_eq, simp add:power_mult_distrib b)
 qed
 
 lemma space_omega_1 [simp]: "Sigma_Algebra.space \<Omega>\<^sub>p = UNIV"
     by (simp add:\<Omega>\<^sub>p_def)
 
 interpretation \<Omega>: prob_space "\<Omega>\<^sub>p"
   by (simp add:\<Omega>\<^sub>p_def prob_space_measure_pmf)
 
 lemma integrable_\<Omega>:
   fixes f :: "((nat \<times> nat) \<Rightarrow> (nat list)) \<Rightarrow> real"
   shows "integrable \<Omega>\<^sub>p f"
   unfolding \<Omega>\<^sub>p_def \<Omega>_def
   by (rule integrable_measure_pmf_finite, auto intro:finite_PiE simp:set_prod_pmf)
 
 lemma sketch_rv_exp:
   assumes "i\<^sub>2 < s\<^sub>2"
   assumes "i\<^sub>1 \<in> {0..<s\<^sub>1}"
   shows "\<Omega>.expectation (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) = real_of_rat (F 2 as) * ((real p)\<^sup>2 - 1)"
 proof -
   have "\<Omega>.expectation (\<lambda>\<omega>.  (sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) :: real) = expectation sketch_rv"
     using integrable_\<Omega> integrable_M assms
     unfolding \<Omega>_def \<Omega>\<^sub>p_def M_def
     by (subst expectation_Pi_pmf_slice, auto)
   also have "... = (real_of_rat (F 2 as)) * ((real p)\<^sup>2 - 1)"
     using exp_sketch_rv by simp
   finally show ?thesis by simp
 qed
 
 lemma sketch_rv_var:
   assumes "i\<^sub>2 < s\<^sub>2"
   assumes "i\<^sub>1 \<in> {0..<s\<^sub>1}"
   shows "\<Omega>.variance (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) \<le> 2 * (real_of_rat (F 2 as))\<^sup>2 * ((real p)\<^sup>2 - 1)\<^sup>2"
 proof -
   have "\<Omega>.variance (\<lambda>\<omega>. (sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2)) :: real)) = variance sketch_rv"
     using integrable_\<Omega> integrable_M assms
     unfolding \<Omega>_def \<Omega>\<^sub>p_def M_def
     by (subst variance_prod_pmf_slice, auto)
   also have "... \<le>  2 * (real_of_rat (F 2 as))\<^sup>2 * ((real p)\<^sup>2 - 1)\<^sup>2"
     using var_sketch_rv by simp
   finally show ?thesis by simp
 qed
 
 lemma mean_rv_exp:
   assumes "i < s\<^sub>2"
   shows "\<Omega>.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = real_of_rat (F 2 as)"
 proof -
   have a:"(real p)\<^sup>2 > 1" using p_gt_1 by simp
 
   have "\<Omega>.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. \<Omega>.expectation (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i)))) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)"
     using assms integrable_\<Omega> by (simp add:mean_rv_def)
-  also have "... = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. real_of_rat (F 2 as) * ((real p)\<^sup>2 - 1)) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)" 
+  also have "... = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. real_of_rat (F 2 as) * ((real p)\<^sup>2 - 1)) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)"
     using sketch_rv_exp[OF assms] by simp
   also have "... = real_of_rat (F 2 as)"
     using s1_gt_0 a by simp
   finally show ?thesis by simp
 qed
 
 lemma mean_rv_var:
   assumes "i < s\<^sub>2"
   shows "\<Omega>.variance (\<lambda>\<omega>. mean_rv \<omega> i) \<le> (real_of_rat (\<delta> * F 2 as))\<^sup>2 / 3"
 proof -
   have a: "\<Omega>.indep_vars (\<lambda>_. borel) (\<lambda>i\<^sub>1 x. sketch_rv (x (i\<^sub>1, i))) {0..<s\<^sub>1}"
     using assms
     unfolding \<Omega>\<^sub>p_def \<Omega>_def
     by (intro indep_vars_restrict_intro'[where f="fst"])
      (auto simp add: restrict_dfl_def case_prod_beta lessThan_atLeast0)
 
-  have p_sq_ne_1: "(real p)^2 \<noteq> 1" 
+  have p_sq_ne_1: "(real p)^2 \<noteq> 1"
     by (metis p_gt_1 less_numeral_extra(4) of_nat_power one_less_power pos2 semiring_char_0_class.of_nat_eq_1_iff)
 
   have s1_bound: " 6 / (real_of_rat \<delta>)\<^sup>2 \<le> real s\<^sub>1"
     unfolding s\<^sub>1_def
     by  (metis (mono_tags, opaque_lifting) of_rat_ceiling of_rat_divide of_rat_numeral_eq of_rat_power real_nat_ceiling_ge)
 
   have "\<Omega>.variance (\<lambda>\<omega>. mean_rv \<omega> i) = \<Omega>.variance (\<lambda>\<omega>. \<Sum>i\<^sub>1 = 0..<s\<^sub>1. sketch_rv (\<omega> (i\<^sub>1, i))) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)\<^sup>2"
     unfolding mean_rv_def by (subst \<Omega>.variance_divide[OF integrable_\<Omega>], simp)
   also have "... = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. \<Omega>.variance (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i)))) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)\<^sup>2"
     by (subst \<Omega>.bienaymes_identity_full_indep[OF _ _ integrable_\<Omega> a]) (auto simp: \<Omega>_def \<Omega>\<^sub>p_def)
   also have "... \<le>  (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. 2*(real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2)  / (((real p)\<^sup>2 - 1) * real s\<^sub>1)\<^sup>2"
     by (rule divide_right_mono, rule sum_mono[OF sketch_rv_var[OF assms]], auto)
   also have "... = 2 * (real_of_rat (F 2 as)^2) / real s\<^sub>1"
     using p_sq_ne_1 s1_gt_0 by (subst frac_eq_eq, auto simp:power2_eq_square)
   also have "... \<le> 2 * (real_of_rat (F 2 as)^2) / (6 / (real_of_rat \<delta>)\<^sup>2)"
     using  s1_gt_0 \<delta>_range by (intro divide_left_mono mult_pos_pos s1_bound) auto
   also have "... = (real_of_rat (\<delta> * F 2 as))\<^sup>2 / 3"
     by (simp add:of_rat_mult algebra_simps)
   finally show ?thesis by simp
 qed
 
 lemma mean_rv_bounds:
   assumes "i < s\<^sub>2"
   shows "\<Omega>.prob {\<omega>. real_of_rat \<delta> * real_of_rat (F 2 as) < \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>} \<le> 1/3"
 proof (cases "as = []")
   case True
   then show ?thesis
     using assms by (subst mean_rv_def, subst sketch_rv_def, simp add:F_def)
 next
   case False
   hence "F 2 as > 0" using F_gr_0 by auto
 
   hence a: "0 < real_of_rat (\<delta> * F 2 as)"
     using \<delta>_range by simp
   have [simp]: "(\<lambda>\<omega>. mean_rv \<omega> i) \<in> borel_measurable \<Omega>\<^sub>p"
     by (simp add:\<Omega>_def \<Omega>\<^sub>p_def)
-  have "\<Omega>.prob {\<omega>. real_of_rat \<delta> * real_of_rat (F 2 as) < \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>} \<le> 
+  have "\<Omega>.prob {\<omega>. real_of_rat \<delta> * real_of_rat (F 2 as) < \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>} \<le>
       \<Omega>.prob {\<omega>. real_of_rat (\<delta> * F 2 as) \<le> \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>}"
     by (rule \<Omega>.pmf_mono[OF \<Omega>\<^sub>p_def], simp add:of_rat_mult)
   also have "... \<le>  \<Omega>.variance (\<lambda>\<omega>. mean_rv \<omega> i) / (real_of_rat (\<delta> * F 2 as))\<^sup>2"
-    using \<Omega>.Chebyshev_inequality[where a="real_of_rat (\<delta> * F 2 as)" and f="\<lambda>\<omega>. mean_rv \<omega> i",simplified] 
+    using \<Omega>.Chebyshev_inequality[where a="real_of_rat (\<delta> * F 2 as)" and f="\<lambda>\<omega>. mean_rv \<omega> i",simplified]
       a prob_space_measure_pmf[where p="\<Omega>"] mean_rv_exp[OF assms] integrable_\<Omega> by simp
   also have "... \<le> ((real_of_rat (\<delta> * F 2 as))\<^sup>2/3) / (real_of_rat (\<delta> * F 2 as))\<^sup>2"
     by (rule divide_right_mono, rule mean_rv_var[OF assms], simp)
   also  have "... = 1/3" using a by force
   finally show ?thesis by blast
 qed
 
 lemma f2_alg_correct':
    "\<P>(\<omega> in measure_pmf result. \<bar>\<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as) \<ge> 1-of_rat \<epsilon>"
 proof -
-  have a: "\<Omega>.indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. mean_rv \<omega> i) {0..<s\<^sub>2}" 
+  have a: "\<Omega>.indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. mean_rv \<omega> i) {0..<s\<^sub>2}"
     using s1_gt_0 unfolding \<Omega>\<^sub>p_def \<Omega>_def
     by (intro indep_vars_restrict_intro'[where f="snd"])
       (auto simp: \<Omega>\<^sub>p_def \<Omega>_def mean_rv_def restrict_dfl_def)
 
-  have b: "- 18 * ln (real_of_rat \<epsilon>) \<le> real s\<^sub>2" 
+  have b: "- 18 * ln (real_of_rat \<epsilon>) \<le> real s\<^sub>2"
     unfolding  s\<^sub>2_def using of_nat_ceiling by auto
 
   have "1 - of_rat \<epsilon> \<le> \<Omega>.prob {\<omega>.  \<bar>median s\<^sub>2 (mean_rv \<omega>) -  real_of_rat (F 2 as) \<bar> \<le> of_rat \<delta> * of_rat (F 2 as)}"
     using \<epsilon>_range \<Omega>.median_bound_2[OF _ a b, where \<delta>="real_of_rat \<delta> * real_of_rat (F 2 as)"
         and \<mu>="real_of_rat (F 2 as)"] mean_rv_bounds
     by simp
   also have "... = \<Omega>.prob {\<omega>.  \<bar>real_of_rat (result_rv \<omega>) - of_rat (F 2 as) \<bar> \<le> of_rat \<delta> * of_rat (F 2 as)}"
     by (simp add:result_rv_def median_restrict lessThan_atLeast0 median_rat[OF s2_gt_0]
          mean_rv_def sketch_rv_def of_rat_divide of_rat_sum of_rat_mult of_rat_diff of_rat_power)
-  also have "... = \<Omega>.prob {\<omega>. \<bar>result_rv \<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as} " 
+  also have "... = \<Omega>.prob {\<omega>. \<bar>result_rv \<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as} "
     by (simp add:of_rat_less_eq of_rat_mult[symmetric]  of_rat_diff[symmetric] set_eq_iff)
   finally have "\<Omega>.prob {y. \<bar>result_rv y - F 2 as\<bar> \<le> \<delta> * F 2 as} \<ge> 1-of_rat \<epsilon> " by simp
   thus ?thesis by (simp add: distr \<Omega>\<^sub>p_def)
 qed
 
 lemma f2_exact_space_usage':
    "AE \<omega> in sketch . bit_count (encode_f2_state \<omega>) \<le> f2_space_usage (n, length as, \<epsilon>, \<delta>)"
 proof -
   have "p \<le> 2 * max n 3 + 2"
     by (subst p_def, rule prime_above_upper_bound)
   also have "... \<le> 2 * n + 8"
     by (cases "n \<le> 2", simp_all)
-  finally have p_bound: "p \<le> 2 * n + 8" 
+  finally have p_bound: "p \<le> 2 * n + 8"
     by simp
   have "bit_count (N\<^sub>e p) \<le> ereal (2 * log 2 (real p + 1) + 1)"
     by (rule exp_golomb_bit_count)
   also have "... \<le> ereal (2 * log 2 (2 * real n + 9) + 1)"
     using p_bound by simp
   finally have p_bit_count: "bit_count (N\<^sub>e p) \<le> ereal (2 * log 2 (2 * real n + 9) + 1)"
     by simp
 
-  have a: "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. 
+  have a: "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}.
       sum_list (map (f2_hash p (y i)) as))) \<le> ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))"
     if a:"y\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2} \<rightarrow>\<^sub>E bounded_degree_polynomials (mod_ring p) 4" for y
   proof -
     have "y \<in> extensional ({..<s\<^sub>1} \<times> {..<s\<^sub>2})" using a PiE_iff by blast
     hence y_ext: "y \<in> extensional (set (List.product [0..<s\<^sub>1] [0..<s\<^sub>2]))"
       by (simp add:lessThan_atLeast0)
 
     have h_bit_count_aux: "bit_count (P\<^sub>e p 4 (y x)) \<le> ereal (4 + 4 * log 2 (8 + 2 * real n))"
       if b:"x \<in>  set (List.product [0..<s\<^sub>1] [0..<s\<^sub>2])" for x
     proof -
       have "y x \<in> bounded_degree_polynomials (mod_ring p) 4"
         using b a by force
       hence "bit_count (P\<^sub>e p 4 (y x)) \<le> ereal (real 4 * (log 2 (real p) + 1))"
         by (rule bounded_degree_polynomial_bit_count[OF p_gt_1] )
       also have "... \<le> ereal (real 4 * (log 2 (8 + 2 * real n) + 1) )"
         using p_gt_0 p_bound by simp
       also have "... \<le> ereal (4 + 4 * log 2 (8 + 2 * real n))"
         by simp
       finally show ?thesis
         by blast
     qed
 
-    have h_bit_count: 
+    have h_bit_count:
       "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e P\<^sub>e p 4) y) \<le> ereal (real s\<^sub>1 * real s\<^sub>2 * (4 + 4 * log 2 (8 + 2 * real n)))"
       using fun_bit_count_est[where e="P\<^sub>e p 4", OF y_ext h_bit_count_aux]
       by simp
 
     have sketch_bit_count_aux:
       "bit_count (I\<^sub>e (sum_list (map (f2_hash p (y x)) as))) \<le> ereal (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1))" (is "?lhs \<le> ?rhs")
       if " x \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}" for x
     proof -
-      have "\<bar>sum_list (map (f2_hash p (y x)) as)\<bar> \<le> sum_list (map (abs \<circ> (f2_hash p (y x))) as)" 
+      have "\<bar>sum_list (map (f2_hash p (y x)) as)\<bar> \<le> sum_list (map (abs \<circ> (f2_hash p (y x))) as)"
         by (subst map_map[symmetric])  (rule sum_list_abs)
       also have "... \<le>  sum_list (map (\<lambda>_. (int p+1)) as)"
-        by (rule sum_list_mono) (simp add:p_gt_0) 
+        by (rule sum_list_mono) (simp add:p_gt_0)
       also have "... = int (length as) * (int p+1)"
         by (simp add: sum_list_triv)
       also have "... \<le> int (length as) * (9+2*(int n))"
         using p_bound by (intro mult_mono, auto)
       finally  have "\<bar>sum_list (map (f2_hash p (y x)) as)\<bar> \<le> int (length as) * (9 + 2 * int n)" by simp
       hence "?lhs \<le> ereal (2 * log 2 (real_of_int (2* (int (length as) * (9 + 2 * int n)) + 1)) + 1)"
         by (rule int_bit_count_est)
       also have "... = ?rhs" by (simp add:algebra_simps)
       finally show "?thesis" by simp
     qed
 
-    have 
+    have
       "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as)))
       \<le> ereal (real (length (List.product [0..<s\<^sub>1] [0..<s\<^sub>2]))) * (ereal (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1)))"
-      by (intro fun_bit_count_est)  
+      by (intro fun_bit_count_est)
        (simp_all add:extensional_def lessThan_atLeast0 sketch_bit_count_aux del:f2_hash.simps)
     also have "... = ereal (real s\<^sub>1 * real s\<^sub>2 * (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1)))"
       by simp
-    finally have sketch_bit_count: 
+    finally have sketch_bit_count:
        "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le>
       ereal (real s\<^sub>1 * real s\<^sub>2 * (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1)))" by simp
 
-    have "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le> 
+    have "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le>
       bit_count (N\<^sub>e s\<^sub>1) + bit_count (N\<^sub>e s\<^sub>2) +bit_count (N\<^sub>e p) +
       bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e P\<^sub>e p 4) y) +
-      bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as)))"   
+      bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as)))"
       by (simp add:Let_def s\<^sub>1_def s\<^sub>2_def encode_f2_state_def dependent_bit_count add.assoc)
-    also have "... \<le> ereal (2 * log 2 (real s\<^sub>1 + 1) + 1) + ereal (2 * log 2 (real s\<^sub>2 + 1) + 1) + ereal (2 * log 2 (2 * real n + 9) + 1) + 
-      (ereal (real s\<^sub>1 * real s\<^sub>2) * (4 + 4 * log 2 (8 + 2 * real n))) + 
+    also have "... \<le> ereal (2 * log 2 (real s\<^sub>1 + 1) + 1) + ereal (2 * log 2 (real s\<^sub>2 + 1) + 1) + ereal (2 * log 2 (2 * real n + 9) + 1) +
+      (ereal (real s\<^sub>1 * real s\<^sub>2) * (4 + 4 * log 2 (8 + 2 * real n))) +
       (ereal (real s\<^sub>1 * real s\<^sub>2) * (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1) ))"
       by (intro add_mono exp_golomb_bit_count p_bit_count, auto intro: h_bit_count sketch_bit_count)
     also have "... = ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))"
       by (simp add:distrib_left add.commute s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric] Let_def)
-    finally show "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le>  
-      ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))" 
+    finally show "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le>
+      ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))"
       by simp
   qed
 
   have "set_pmf \<Omega> = {..<s\<^sub>1} \<times> {..<s\<^sub>2} \<rightarrow>\<^sub>E bounded_degree_polynomials (mod_ring p) 4"
     by (simp add: \<Omega>_def set_prod_pmf) (simp add: space_def)
   thus ?thesis
     by (simp  add:mean_rv_alg_sketch AE_measure_pmf_iff del:f2_space_usage.simps, metis a)
 qed
 
 end
 
 
 text \<open>Main results of this section:\<close>
 
 theorem f2_alg_correct:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n) \<bind> f2_result"
   shows "\<P>(\<omega> in measure_pmf \<Omega>. \<bar>\<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as) \<ge> 1-of_rat \<epsilon>"
   using f2_alg_correct'[OF assms(1,2,3)] \<Omega>_def by auto
 
 theorem f2_exact_space_usage:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n)"
   shows "AE \<omega> in M. bit_count (encode_f2_state \<omega>) \<le> f2_space_usage (n, length as, \<epsilon>, \<delta>)"
   using f2_exact_space_usage'[OF assms(1,2,3)]
   by (subst (asm) sketch_def[OF assms(1,2,3)], subst M_def, simp)
 
 theorem f2_asymptotic_space_complexity:
-  "f2_space_usage \<in> O[at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda> (n, m, \<epsilon>, \<delta>). 
+  "f2_space_usage \<in> O[at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda> (n, m, \<epsilon>, \<delta>).
   (ln (1 / of_rat \<epsilon>)) / (of_rat \<delta>)\<^sup>2 * (ln (real n) + ln (real m)))"
   (is "_ \<in> O[?F](?rhs)")
 proof -
   define n_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "n_of = (\<lambda>(n, m, \<epsilon>, \<delta>). n)"
   define m_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "m_of = (\<lambda>(n, m, \<epsilon>, \<delta>). m)"
   define \<epsilon>_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<epsilon>_of = (\<lambda>(n, m, \<epsilon>, \<delta>). \<epsilon>)"
   define \<delta>_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<delta>_of = (\<lambda>(n, m, \<epsilon>, \<delta>). \<delta>)"
 
   define g where "g = (\<lambda>x. (1/ (of_rat (\<delta>_of x))\<^sup>2) * (ln (1 / of_rat (\<epsilon>_of x))) * (ln (real (n_of x)) + ln (real (m_of x))))"
 
-  have evt: "(\<And>x. 
-    0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and> 
+  have evt: "(\<And>x.
+    0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and>
     1/real_of_rat (\<delta>_of x) \<ge> \<delta> \<and> 1/real_of_rat (\<epsilon>_of x) \<ge> \<epsilon> \<and>
-    real (n_of x) \<ge> n \<and> real (m_of x) \<ge> m\<Longrightarrow> P x) 
+    real (n_of x) \<ge> n \<and> real (m_of x) \<ge> m\<Longrightarrow> P x)
     \<Longrightarrow> eventually P ?F"  (is "(\<And>x. ?prem x \<Longrightarrow> _) \<Longrightarrow> _")
     for \<delta> \<epsilon> n m P
     apply (rule eventually_mono[where P="?prem" and Q="P"])
     apply (simp add:\<epsilon>_of_def case_prod_beta' \<delta>_of_def n_of_def m_of_def)
-     apply (intro eventually_conj eventually_prod1' eventually_prod2' 
+     apply (intro eventually_conj eventually_prod1' eventually_prod2'
         sequentially_inf eventually_at_right_less inv_at_right_0_inf)
     by (auto simp add:prod_filter_eq_bot)
 
   have unit_1: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using one_le_power
     by (intro landau_o.big_mono evt[where \<delta>="1"], auto simp add:power_one_over[symmetric])
 
   have unit_2: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono  evt[where \<epsilon>="exp 1"])
      (auto intro!:iffD2[OF ln_ge_iff] simp add:abs_ge_iff)
 
   have unit_3: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x))"
     by (intro landau_o.big_mono evt, auto)
 
   have unit_4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (m_of x))"
     by (intro landau_o.big_mono evt, auto)
 
   have unit_5: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     by (auto intro!: landau_o.big_mono evt[where n="exp 1"])
       (metis abs_ge_self linorder_not_le ln_ge_iff not_exp_le_zero order.trans)
 
   have unit_6: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1 evt unit_5 iffD2[OF ln_ge_iff], auto)
 
   have unit_7: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / real_of_rat (\<epsilon>_of x))"
     by (intro landau_o.big_mono  evt[where \<epsilon>="1"], auto)
- 
-  have unit_8: "(\<lambda>_. 1) \<in> O[?F](g)" 
+
+  have unit_8: "(\<lambda>_. 1) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 unit_1 unit_2 unit_6)
 
   have unit_9: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x) * real (m_of x))"
     by (intro landau_o.big_mult_1 unit_3 unit_4)
 
   have " (\<lambda>x. 6 * (1 / (real_of_rat (\<delta>_of x))\<^sup>2)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     by (subst landau_o.big.cmult_in_iff, simp_all)
   hence l1: "(\<lambda>x. real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     by (intro landau_real_nat  landau_rat_ceil[OF unit_1]) (simp_all add:of_rat_divide of_rat_power)
 
   have "(\<lambda>x. - ( ln (real_of_rat (\<epsilon>_of x)))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono evt) (subst ln_div, auto)
   hence l2: "(\<lambda>x. real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_real_nat landau_ceil[OF unit_2], simp)
 
   have l3_aux: " (\<lambda>x. real (m_of x) * (18 + 4 * real (n_of x)) + 1) \<in> O[?F](\<lambda>x. real (n_of x) * real (m_of x))"
     by (rule sum_in_bigo[OF _unit_9], subst mult.commute)
       (intro landau_o.mult sum_in_bigo, auto simp:unit_3)
 
   have "(\<lambda>x. ln (real (m_of x) * (18 + 4 * real (n_of x)) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x) * real (m_of x)))"
      apply (rule landau_ln_2[where a="2"], simp, simp)
       apply (rule evt[where m="2" and n="1"])
      apply (metis dual_order.trans mult_left_mono mult_of_nat_commute of_nat_0_le_iff verit_prod_simplify(1))
     using l3_aux by simp
   also have "(\<lambda>x. ln (real (n_of x) * real (m_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln(real (m_of x)))"
     by (intro landau_o.big_mono evt[where m="1" and n="1"], auto simp add:ln_mult)
   finally have l3: "(\<lambda>x. ln (real (m_of x) * (18 + 4 * real (n_of x)) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     using  landau_o.big_trans by simp
 
   have l4: "(\<lambda>x. ln (8 + 2 * real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1  evt[where n="2"] landau_ln_2[where a="2"] iffD2[OF ln_ge_iff])
      (auto intro!: sum_in_bigo simp add:unit_3)
 
   have l5: "(\<lambda>x. ln (9 + 2 * real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1  evt[where n="2"] landau_ln_2[where a="2"] iffD2[OF ln_ge_iff])
      (auto intro!: sum_in_bigo simp add:unit_3)
 
   have l6: "(\<lambda>x. ln (real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>) + 1)) \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.big_mult_1 landau_ln_3 sum_in_bigo unit_6 unit_2 l1 unit_1, simp)
 
   have l7: "(\<lambda>x. ln (9 + 2 * real (n_of x))) \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.big_mult_1' unit_1 unit_2 l5)
 
   have l8: "(\<lambda>x. ln (real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>) + 1) ) \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.big_mult_1 unit_6 landau_o.big_mult_1' unit_1 landau_ln_3 sum_in_bigo l2 unit_2) simp
 
   have l9: "(\<lambda>x. 5 + 4 * ln (8 + 2 * real (n_of x)) / ln 2 + 2 * ln (real (m_of x) * (18 + 4 * real (n_of x)) + 1) / ln 2)
       \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro sum_in_bigo, auto simp: l3 l4 unit_6)
 
-  have l10: "(\<lambda>x. real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>) * real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>) * 
+  have l10: "(\<lambda>x. real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>) * real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>) *
       (5 + 4 * ln (8 + 2 * real (n_of x)) / ln 2 + 2 * ln(real (m_of x) * (18 + 4 * real (n_of x)) + 1) / ln 2))
       \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.mult, auto simp: l1 l2 l9)
 
   have "f2_space_usage = (\<lambda>x. f2_space_usage (n_of x, m_of x, \<epsilon>_of x, \<delta>_of x))"
     by (simp add:case_prod_beta' n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def)
   also have "... \<in> O[?F](g)"
     by (auto intro!:sum_in_bigo simp:Let_def log_def l6 l7 l8 l10 unit_8)
   also have "... = O[?F](?rhs)"
     by (simp add:case_prod_beta' g_def n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def)
   finally show ?thesis by simp
 qed
 
 end
diff --git a/thys/Frequency_Moments/Frequency_Moment_k.thy b/thys/Frequency_Moments/Frequency_Moment_k.thy
--- a/thys/Frequency_Moments/Frequency_Moment_k.thy
+++ b/thys/Frequency_Moments/Frequency_Moment_k.thy
@@ -1,1015 +1,1016 @@
 section \<open>Frequency Moment $k$\<close>
 
 theory Frequency_Moment_k
-  imports 
+  imports
     Frequency_Moments
-    Landau_Ext 
+    Landau_Ext
     Lp.Lp
     Median_Method.Median
-    Product_PMF_Ext 
+    Probability_Ext
+    Product_PMF_Ext
 begin
 
 text \<open>This section contains a formalization of the algorithm for the $k$-th frequency moment.
 It is based on the algorithm described in \<^cite>\<open>\<open>\textsection 2.1\<close> in "alon1999"\<close>.\<close>
 
 type_synonym fk_state = "nat \<times> nat \<times> nat \<times> nat \<times> (nat \<times> nat \<Rightarrow> (nat \<times> nat))"
 
 fun fk_init :: "nat \<Rightarrow> rat \<Rightarrow> rat \<Rightarrow> nat \<Rightarrow> fk_state pmf" where
   "fk_init k \<delta> \<epsilon> n =
     do {
       let s\<^sub>1 = nat \<lceil>3 * real k * n powr (1-1/real k) / (real_of_rat \<delta>)\<^sup>2\<rceil>;
       let s\<^sub>2 = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil>;
       return_pmf (s\<^sub>1, s\<^sub>2, k, 0, (\<lambda>_ \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. (0,0)))
     }"
 
 fun fk_update :: "nat \<Rightarrow> fk_state \<Rightarrow> fk_state pmf" where
-  "fk_update a (s\<^sub>1, s\<^sub>2, k, m, r) = 
+  "fk_update a (s\<^sub>1, s\<^sub>2, k, m, r) =
     do {
       coins \<leftarrow> prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. bernoulli_pmf (1/(real m+1)));
-      return_pmf (s\<^sub>1, s\<^sub>2, k, m+1, \<lambda>i \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. 
-        if coins i then 
-          (a,0) 
+      return_pmf (s\<^sub>1, s\<^sub>2, k, m+1, \<lambda>i \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}.
+        if coins i then
+          (a,0)
         else (
           let (x,l) = r i in (x, l + of_bool (x=a))
         )
       )
     }"
 
 fun fk_result :: "fk_state \<Rightarrow> rat pmf" where
-  "fk_result (s\<^sub>1, s\<^sub>2, k, m, r) = 
+  "fk_result (s\<^sub>1, s\<^sub>2, k, m, r) =
     return_pmf (median s\<^sub>2 (\<lambda>i\<^sub>2 \<in> {0..<s\<^sub>2}.
       (\<Sum>i\<^sub>1\<in>{0..<s\<^sub>1}. rat_of_nat (let t = snd (r (i\<^sub>1, i\<^sub>2)) + 1 in m * (t^k - (t - 1)^k))) / (rat_of_nat s\<^sub>1))
     )"
 
 lemma bernoulli_pmf_1: "bernoulli_pmf 1 = return_pmf True"
   by (rule pmf_eqI, simp add:indicator_def)
 
 fun fk_space_usage :: "(nat \<times> nat \<times> nat \<times> rat \<times> rat) \<Rightarrow> real" where
   "fk_space_usage (k, n, m, \<epsilon>, \<delta>) = (
     let s\<^sub>1 = nat \<lceil>3*real k* (real n) powr (1-1/ real k) / (real_of_rat \<delta>)\<^sup>2 \<rceil> in
-    let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil> in 
+    let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil> in
     4 +
     2 * log 2 (s\<^sub>1 + 1) +
     2 * log 2 (s\<^sub>2 + 1) +
     2 * log 2 (real k + 1) +
     2 * log 2 (real m + 1) +
     s\<^sub>1 * s\<^sub>2 * (2 + 2 * log 2 (real n+1) + 2 * log 2 (real m+1)))"
 
 definition encode_fk_state :: "fk_state \<Rightarrow> bool list option" where
-  "encode_fk_state = 
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>1. 
-    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>2. 
-    N\<^sub>e \<times>\<^sub>e  
-    N\<^sub>e \<times>\<^sub>e  
+  "encode_fk_state =
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>1.
+    N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>2.
+    N\<^sub>e \<times>\<^sub>e
+    N\<^sub>e \<times>\<^sub>e
     (List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e (N\<^sub>e \<times>\<^sub>e N\<^sub>e))))"
 
 lemma "inj_on encode_fk_state (dom encode_fk_state)"
 proof -
   have "is_encoding encode_fk_state"
     by (simp add:encode_fk_state_def)
      (intro dependent_encoding exp_golomb_encoding fun_encoding)
 
   thus ?thesis by (rule encoding_imp_inj)
 qed
 
 text \<open>This is an intermediate non-parallel form @{term "fk_update"} used only in the correctness proof.\<close>
 
 fun fk_update_2 :: "'a \<Rightarrow> (nat \<times> 'a \<times> nat) \<Rightarrow> (nat \<times> 'a \<times> nat) pmf" where
-  "fk_update_2 a (m,x,l) = 
+  "fk_update_2 a (m,x,l) =
     do {
       coin \<leftarrow> bernoulli_pmf (1/(real m+1));
       return_pmf (m+1,if coin then (a,0) else (x, l + of_bool (x=a)))
     }"
 
 definition sketch where "sketch as i = (as ! i, count_list (drop (i+1) as) (as ! i))"
 
 lemma fk_update_2_distr:
   assumes "as \<noteq> []"
   shows "fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0,0,0)) =
   pmf_of_set {..<length as} \<bind> (\<lambda>k. return_pmf (length as, sketch as k))"
   using assms
 proof (induction as rule:rev_nonempty_induct)
   case (single x)
-  show ?case using single 
-    by (simp add:bind_return_pmf pmf_of_set_singleton bernoulli_pmf_1 lessThan_def sketch_def) 
+  show ?case using single
+    by (simp add:bind_return_pmf pmf_of_set_singleton bernoulli_pmf_1 lessThan_def sketch_def)
 next
   case (snoc x xs)
   let ?h = "(\<lambda>xs k. count_list (drop (Suc k) xs) (xs ! k))"
   let ?q = "(\<lambda>xs k. (length xs, sketch xs k))"
 
   have non_empty: " {..<Suc (length xs)} \<noteq> {}" " {..<length xs} \<noteq> {}" using snoc by auto
 
-  have fk_update_2_eta:"fk_update_2 x = (\<lambda>a. fk_update_2 x (fst a, fst (snd a), snd (snd a)))" 
+  have fk_update_2_eta:"fk_update_2 x = (\<lambda>a. fk_update_2 x (fst a, fst (snd a), snd (snd a)))"
     by auto
 
   have "pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
-    (\<lambda>coin. return_pmf (if coin then length xs else k))) = 
+    (\<lambda>coin. return_pmf (if coin then length xs else k))) =
     bernoulli_pmf (1 / (real (length xs) + 1)) \<bind> (\<lambda>y. pmf_of_set {..<length xs} \<bind>
       (\<lambda>k. return_pmf (if y then length xs else k)))"
     by (subst bind_commute_pmf, simp)
   also have "... = pmf_of_set {..<length xs + 1}"
     using snoc(1) non_empty
     by (intro pmf_eqI, simp add: pmf_bind measure_pmf_of_set)
      (simp add:indicator_def algebra_simps frac_eq_eq)
   finally have b: "pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k))) = pmf_of_set {..<length xs +1}" by simp
-   
+
   have "fold (\<lambda>x s. (s \<bind> fk_update_2 x)) (xs@[x]) (return_pmf (0,0,0)) =
     (pmf_of_set {..<length xs} \<bind> (\<lambda>k. return_pmf (length xs, sketch xs k))) \<bind> fk_update_2 x"
     using snoc by (simp add:case_prod_beta')
-  also have "... = (pmf_of_set {..<length xs} \<bind> (\<lambda>k. return_pmf (length xs, sketch xs k))) \<bind> 
-    (\<lambda>(m,a,l). bernoulli_pmf (1 / (real m + 1)) \<bind> (\<lambda>coin. 
+  also have "... = (pmf_of_set {..<length xs} \<bind> (\<lambda>k. return_pmf (length xs, sketch xs k))) \<bind>
+    (\<lambda>(m,a,l). bernoulli_pmf (1 / (real m + 1)) \<bind> (\<lambda>coin.
     return_pmf (m + 1, if coin then (x, 0) else (a, (l + of_bool (a = x))))))"
     by (subst fk_update_2_eta, subst fk_update_2.simps, simp add:case_prod_beta')
   also have "... = pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (length xs + 1, if coin then (x, 0) else (xs ! k, ?h xs k + of_bool (xs ! k = x)))))"
     by (subst bind_assoc_pmf, simp add: bind_return_pmf sketch_def)
   also have "... = pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k) \<bind> (\<lambda>k'. return_pmf (?q (xs@[x]) k'))))"
     using non_empty
     by (intro bind_pmf_cong, auto simp add:bind_return_pmf nth_append count_list_append sketch_def)
   also have "... = pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k))) \<bind> (\<lambda>k'. return_pmf (?q (xs@[x]) k'))"
     by (subst bind_assoc_pmf, subst bind_assoc_pmf, simp)
   also have "... = pmf_of_set {..<length (xs@[x])} \<bind> (\<lambda>k'. return_pmf (?q (xs@[x]) k'))"
     by (subst b, simp)
   finally show ?case by simp
 qed
 
 context
   fixes \<epsilon> \<delta> :: rat
   fixes n k :: nat
   fixes as
   assumes k_ge_1: "k \<ge> 1"
   assumes \<epsilon>_range: "\<epsilon> \<in> {0<..<1}"
   assumes \<delta>_range: "\<delta> > 0"
   assumes as_range: "set as \<subseteq> {..<n}"
 begin
 
 definition s\<^sub>1 where "s\<^sub>1 = nat \<lceil>3 * real k * (real n) powr (1-1/real k) / (real_of_rat \<delta>)\<^sup>2\<rceil>"
 definition s\<^sub>2 where "s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil>"
 
 definition "M\<^sub>1 = {(u, v). v < count_list as u}"
 definition "\<Omega>\<^sub>1 = measure_pmf (pmf_of_set M\<^sub>1)"
 
 definition "M\<^sub>2 = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set M\<^sub>1)"
 definition "\<Omega>\<^sub>2 = measure_pmf M\<^sub>2"
 
 interpretation prob_space "\<Omega>\<^sub>1"
   unfolding \<Omega>\<^sub>1_def by (simp add:prob_space_measure_pmf)
 
 interpretation \<Omega>\<^sub>2:prob_space "\<Omega>\<^sub>2"
   unfolding \<Omega>\<^sub>2_def by (simp add:prob_space_measure_pmf)
 
 lemma split_space: "(\<Sum>a\<in>M\<^sub>1. f (snd a)) = (\<Sum>u \<in> set as. (\<Sum>v \<in>{0..<count_list as u}. f v))"
 proof -
   define A where "A = (\<lambda>u. {u} \<times> {v. v < count_list as u})"
 
-  have a: "inj_on snd (A x)" for x 
-    by (simp add:A_def inj_on_def) 
+  have a: "inj_on snd (A x)" for x
+    by (simp add:A_def inj_on_def)
 
   have "\<And>u v. u < count_list as v \<Longrightarrow> v \<in> set as"
     by (subst count_list_gr_1, force)
   hence "M\<^sub>1 = \<Union> (A ` set as)"
     by (auto simp add:set_eq_iff A_def M\<^sub>1_def)
   hence "(\<Sum>a\<in>M\<^sub>1. f (snd a)) = sum (f \<circ> snd)  (\<Union> (A ` set as))"
     by (intro sum.cong, auto)
   also have "... = sum (\<lambda>x. sum (f \<circ> snd) (A x)) (set as)"
-    by (rule sum.UNION_disjoint, simp, simp add:A_def, simp add:A_def, blast) 
+    by (rule sum.UNION_disjoint, simp, simp add:A_def, simp add:A_def, blast)
   also have "... = sum (\<lambda>x. sum f (snd ` A x)) (set as)"
     by (intro sum.cong, auto simp add:sum.reindex[OF a])
   also have "... = (\<Sum>u \<in> set as. (\<Sum>v \<in>{0..<count_list as u}. f v))"
     unfolding A_def by (intro sum.cong, auto)
   finally show ?thesis by blast
 qed
 
 lemma
   assumes "as \<noteq> []"
-  shows fin_space: "finite M\<^sub>1" 
+  shows fin_space: "finite M\<^sub>1"
     and non_empty_space: "M\<^sub>1 \<noteq> {}"
     and card_space: "card M\<^sub>1 = length as"
 proof -
   have "M\<^sub>1 \<subseteq> set as \<times> {k. k < length as}"
   proof (rule subsetI)
     fix x
     assume a:"x \<in> M\<^sub>1"
     have "fst x \<in> set as"
       using a by (simp add:case_prod_beta count_list_gr_1 M\<^sub>1_def)
     moreover have "snd x < length as"
       using a count_le_length order_less_le_trans
       by (simp add:case_prod_beta M\<^sub>1_def) fast
     ultimately show "x \<in> set as \<times> {k. k < length as}"
       by (simp add:mem_Times_iff)
   qed
   thus fin_space: "finite M\<^sub>1"
     using finite_subset by blast
 
-  have "(as ! 0, 0) \<in> M\<^sub>1" 
+  have "(as ! 0, 0) \<in> M\<^sub>1"
     using assms(1) unfolding M\<^sub>1_def
     by (simp, metis count_list_gr_1 gr0I length_greater_0_conv not_one_le_zero nth_mem)
   thus "M\<^sub>1 \<noteq> {}" by blast
 
   show "card M\<^sub>1 = length as"
     using fin_space split_space[where f="\<lambda>_. (1::nat)"]
     by (simp add:sum_count_set[where X="set as" and xs="as", simplified])
 qed
 
 lemma
   assumes "as \<noteq> []"
   shows integrable_1: "integrable \<Omega>\<^sub>1 (f :: _ \<Rightarrow> real)" and
     integrable_2: "integrable \<Omega>\<^sub>2 (g :: _ \<Rightarrow> real)"
 proof -
   have fin_omega: "finite (set_pmf (pmf_of_set M\<^sub>1))"
     using fin_space[OF assms] non_empty_space[OF assms] by auto
   thus "integrable \<Omega>\<^sub>1 f"
     unfolding \<Omega>\<^sub>1_def
     by (rule integrable_measure_pmf_finite)
 
   have "finite (set_pmf M\<^sub>2)"
     unfolding M\<^sub>2_def using fin_omega
     by (subst set_prod_pmf) (auto intro:finite_PiE)
 
   thus "integrable \<Omega>\<^sub>2 g"
     unfolding \<Omega>\<^sub>2_def by (intro integrable_measure_pmf_finite)
 qed
 
 lemma sketch_distr:
   assumes "as \<noteq> []"
   shows "pmf_of_set {..<length as} \<bind> (\<lambda>k. return_pmf (sketch as k)) = pmf_of_set M\<^sub>1"
 proof -
-  have "x < y \<Longrightarrow> y < length as \<Longrightarrow> 
+  have "x < y \<Longrightarrow> y < length as \<Longrightarrow>
     count_list (drop (y+1) as) (as ! y) < count_list (drop (x+1) as) (as ! y)" for x y
     by (intro count_list_lt_suffix suffix_drop_drop, simp_all)
      (metis Suc_diff_Suc diff_Suc_Suc diff_add_inverse lessI less_natE)
   hence a1: "inj_on (sketch as) {k. k < length as}"
     unfolding sketch_def by (intro inj_onI) (metis Pair_inject mem_Collect_eq nat_neq_iff)
 
   have "x < length as \<Longrightarrow> count_list (drop (x+1) as) (as ! x) < count_list as (as ! x)" for x
     by (rule count_list_lt_suffix, auto simp add:suffix_drop)
   hence "sketch as ` {k. k < length as} \<subseteq> M\<^sub>1"
     by (intro image_subsetI, simp add:sketch_def M\<^sub>1_def)
   moreover have "card M\<^sub>1 \<le> card (sketch as ` {k. k < length as})"
     by (simp add: card_space[OF assms(1)] card_image[OF a1])
   ultimately have "sketch as ` {k. k < length as} = M\<^sub>1"
     using fin_space[OF assms(1)] by (intro card_seteq, simp_all)
   hence "bij_betw (sketch as) {k. k < length as} M\<^sub>1"
     using a1 by (simp add:bij_betw_def)
   hence "map_pmf (sketch as) (pmf_of_set {k. k < length as}) = pmf_of_set M\<^sub>1"
     using assms by (intro map_pmf_of_set_bij_betw, auto)
   thus ?thesis by (simp add: sketch_def map_pmf_def lessThan_def)
 qed
 
 lemma fk_update_distr:
-  "fold (\<lambda>x s. s \<bind> fk_update x) as (fk_init k \<delta> \<epsilon> n) = 
-  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0,0,0))) 
+  "fold (\<lambda>x s. s \<bind> fk_update x) as (fk_init k \<delta> \<epsilon> n) =
+  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0,0,0)))
     \<bind> (\<lambda>x. return_pmf (s\<^sub>1,s\<^sub>2,k, length as, \<lambda>i\<in>{0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. snd (x i)))"
 proof (induction as rule:rev_induct)
   case Nil
-  then show ?case 
+  then show ?case
     by (auto simp:Let_def s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric] bind_return_pmf)
 next
   case (snoc x xs)
 
-  have fk_update_2_eta:"fk_update_2 x = (\<lambda>a. fk_update_2 x (fst a, fst (snd a), snd (snd a)))" 
+  have fk_update_2_eta:"fk_update_2 x = (\<lambda>a. fk_update_2 x (fst a, fst (snd a), snd (snd a)))"
     by auto
 
   have a: "fk_update x (s\<^sub>1, s\<^sub>2, k, length xs, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (f i)) =
-    prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i)) \<bind> 
+    prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i)) \<bind>
     (\<lambda>a. return_pmf (s\<^sub>1,s\<^sub>2, k, Suc (length xs), \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (a i)))"
-    if b: "f \<in> set_pmf (prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
+    if b: "f \<in> set_pmf (prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})
                   (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) xs (return_pmf (0, 0, 0))))" for f
   proof -
     have c:"fst (f i) = length xs" if d:"i \<in> {0..<s\<^sub>1} \<times>{0..<s\<^sub>2}" for i
     proof (cases "xs = []")
       case True
       then show ?thesis using b d by (simp add: set_Pi_pmf)
-    next  
+    next
       case False
       hence "{..<length xs} \<noteq> {}" by force
-      thus ?thesis using b d 
+      thus ?thesis using b d
         by (simp add:set_Pi_pmf fk_update_2_distr[OF False] PiE_dflt_def) force
     qed
     show ?thesis
       apply (subst fk_update_2_eta, subst fk_update_2.simps, simp)
       apply (simp add: Pi_pmf_bind_return[where d'="undefined"] bind_assoc_pmf)
       apply (rule bind_pmf_cong, simp add:c cong:Pi_pmf_cong)
       by (auto simp add:bind_return_pmf case_prod_beta)
   qed
- 
-  have "fold (\<lambda>x s. s \<bind> fk_update x) (xs @ [x]) (fk_init k \<delta> \<epsilon> n) = 
-     prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) xs (return_pmf (0,0,0))) 
+
+  have "fold (\<lambda>x s. s \<bind> fk_update x) (xs @ [x]) (fk_init k \<delta> \<epsilon> n) =
+     prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) xs (return_pmf (0,0,0)))
     \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1,s\<^sub>2,k, length xs, \<lambda>i\<in>{0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. snd (\<omega> i)) \<bind> fk_update x)"
     using snoc
     by (simp add:restrict_def bind_assoc_pmf del:fk_init.simps)
-  also have "... =  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
+  also have "... =  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})
     (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) xs (return_pmf (0, 0, 0))) \<bind>
     (\<lambda>f. prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i)) \<bind>
     (\<lambda>a. return_pmf (s\<^sub>1, s\<^sub>2, k, Suc (length xs), \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (a i))))"
     using a
     by (intro bind_pmf_cong, simp_all add:bind_return_pmf del:fk_update.simps)
-  also have "... =  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
+  also have "... =  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})
     (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) xs (return_pmf (0, 0, 0))) \<bind>
     (\<lambda>f. prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i))) \<bind>
     (\<lambda>a. return_pmf (s\<^sub>1, s\<^sub>2, k, Suc (length xs), \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (a i)))"
     by (simp add:bind_assoc_pmf)
-  also have "... = (prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
-    (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) (xs@[x]) (return_pmf (0,0,0))) 
+  also have "... = (prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})
+    (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) (xs@[x]) (return_pmf (0,0,0)))
     \<bind> (\<lambda>a. return_pmf (s\<^sub>1,s\<^sub>2,k, length (xs@[x]), \<lambda>i\<in>{0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. snd (a i))))"
     by (simp, subst Pi_pmf_bind, auto)
 
   finally show ?case by blast
 qed
 
 lemma power_diff_sum:
   fixes a b :: "'a :: {comm_ring_1,power}"
   assumes "k > 0"
   shows "a^k - b^k = (a-b) * (\<Sum>i = 0..<k. a ^ i * b ^ (k - 1 - i))" (is "?lhs = ?rhs")
 proof -
   have insert_lb: "m < n \<Longrightarrow> insert m {Suc m..<n} = {m..<n}" for m n :: nat
     by auto
 
-  have "?rhs = sum (\<lambda>i. a * (a^i * b^(k-1-i))) {0..<k} - 
+  have "?rhs = sum (\<lambda>i. a * (a^i * b^(k-1-i))) {0..<k} -
     sum (\<lambda>i. b * (a^i * b^(k-1-i))) {0..<k}"
     by (simp add: sum_distrib_left[symmetric] algebra_simps)
-  also have "... = sum ((\<lambda>i. (a^i * b^(k-i))) \<circ> (\<lambda>i. i+1)) {0..<k} - 
+  also have "... = sum ((\<lambda>i. (a^i * b^(k-i))) \<circ> (\<lambda>i. i+1)) {0..<k} -
     sum (\<lambda>i. (a^i * (b^(1+(k-1-i))))) {0..<k}"
     by (simp add:algebra_simps)
-  also have "... = sum ((\<lambda>i. (a^i * b^(k-i))) \<circ> (\<lambda>i. i+1)) {0..<k} - 
+  also have "... = sum ((\<lambda>i. (a^i * b^(k-i))) \<circ> (\<lambda>i. i+1)) {0..<k} -
     sum (\<lambda>i. (a^i * b^(k-i))) {0..<k}"
-    by (intro arg_cong2[where f="(-)"] sum.cong arg_cong2[where f="(*)"] 
+    by (intro arg_cong2[where f="(-)"] sum.cong arg_cong2[where f="(*)"]
         arg_cong2[where f="(\<lambda>x y. x ^ y)"]) auto
-  also have "... = sum (\<lambda>i. (a^i * b^(k-i))) (insert k {1..<k}) - 
+  also have "... = sum (\<lambda>i. (a^i * b^(k-i))) (insert k {1..<k}) -
     sum (\<lambda>i. (a^i * b^(k-i))) (insert 0 {Suc 0..<k})"
     using assms
     by (subst sum.reindex[symmetric], simp, subst insert_lb, auto)
   also have "... = ?lhs"
     by simp
   finally show ?thesis by presburger
 qed
 
 lemma power_diff_est:
   assumes "k > 0"
   assumes "(a :: real) \<ge> b"
   assumes "b \<ge> 0"
   shows "a^k -b^k \<le> (a-b) * k * a^(k-1)"
 proof -
   have " \<And>i. i < k \<Longrightarrow> a ^ i * b ^ (k - 1 - i) \<le> a ^ i * a ^ (k-1-i)"
     using assms by (intro mult_left_mono power_mono) auto
   also have "\<And>i. i < k \<Longrightarrow> a ^ i * a ^ (k - 1 - i) = a ^ (k - Suc 0)"
     using assms(1) by (subst power_add[symmetric], simp)
   finally have a: "\<And>i. i < k \<Longrightarrow> a ^ i * b ^ (k - 1 - i) \<le> a ^ (k - Suc 0)"
     by blast
   have "a^k - b^k = (a-b) * (\<Sum>i = 0..<k. a ^ i * b ^ (k - 1 - i))"
     by (rule power_diff_sum[OF assms(1)])
   also have "... \<le> (a-b) * (\<Sum>i = 0..<k.  a^(k-1))"
     using a assms by (intro mult_left_mono sum_mono, auto)
   also have "... = (a-b) * (k * a^(k-Suc 0))"
     by simp
   finally show ?thesis by simp
 qed
 
 text \<open>Specialization of the Hoelder inquality for sums.\<close>
 lemma Holder_inequality_sum:
   assumes "p > (0::real)" "q > 0" "1/p + 1/q = 1"
   assumes "finite A"
   shows "\<bar>\<Sum>x\<in>A. f x * g x\<bar> \<le> (\<Sum>x\<in>A. \<bar>f x\<bar> powr p) powr (1/p) * (\<Sum>x\<in>A. \<bar>g x\<bar> powr q) powr (1/q)"
 proof -
-  have "\<bar>LINT x|count_space A. f x * g x\<bar> \<le> 
-    (LINT x|count_space A. \<bar>f x\<bar> powr p) powr (1 / p) * 
+  have "\<bar>LINT x|count_space A. f x * g x\<bar> \<le>
+    (LINT x|count_space A. \<bar>f x\<bar> powr p) powr (1 / p) *
     (LINT x|count_space A. \<bar>g x\<bar> powr q) powr (1 / q)"
     using assms integrable_count_space
     by (intro Lp.Holder_inequality, auto)
   thus ?thesis
     using assms by (simp add: lebesgue_integral_count_space_finite[symmetric])
 qed
 
 lemma real_count_list_pos:
   assumes "x \<in> set as"
   shows "real (count_list as x) > 0"
   using count_list_gr_1 assms by force
 
 lemma fk_estimate:
   assumes "as \<noteq> []"
   shows "length as * of_rat (F (2*k-1) as) \<le> n powr (1 - 1 / real k) * (of_rat (F k as))^2"
   (is "?lhs \<le> ?rhs")
 proof (cases "k \<ge> 2")
   case True
-  define M where "M = Max (count_list as ` set as)" 
+  define M where "M = Max (count_list as ` set as)"
   have "M \<in> count_list as ` set as"
     unfolding M_def using assms by (intro Max_in, auto)
   then obtain m where m_in: "m \<in> set as" and m_def: "M = count_list as m"
     by blast
 
   have a: "real M > 0" using m_in count_list_gr_1 by (simp add:m_def, force)
   have b: "2*k-1 = (k-1) + k" by simp
 
-  have " 0 < real (count_list as m)" 
+  have " 0 < real (count_list as m)"
     using m_in count_list_gr_1 by force
   hence "M powr k = real (count_list as m) ^ k"
     by (simp add: powr_realpow m_def)
   also have "... \<le> (\<Sum>x\<in>set as. real (count_list as x) ^ k)"
     using m_in by (intro member_le_sum, simp_all)
   also have "... \<le> real_of_rat (F k as)"
     by (simp add:F_def of_rat_sum of_rat_power)
   finally have d: "M powr k \<le> real_of_rat (F k as)" by simp
 
-  have e: "0 \<le> real_of_rat (F k as)" 
+  have e: "0 \<le> real_of_rat (F k as)"
     using F_gr_0[OF assms(1)] by (simp add: order_le_less)
 
   have "real (k - 1) / real k + 1 = real (k - 1) / real k + real k / real k"
     using assms True by simp
   also have "... =  real (2 * k - 1) / real k"
     using b by (subst add_divide_distrib[symmetric], force)
   finally have f: "real (k - 1) / real k + 1 = real (2 * k - 1) / real k"
     by blast
 
-  have "real_of_rat (F (2*k-1) as) = 
-    (\<Sum>x\<in>set as. real (count_list as x) ^ (k - 1) * real (count_list as x) ^ k)" 
+  have "real_of_rat (F (2*k-1) as) =
+    (\<Sum>x\<in>set as. real (count_list as x) ^ (k - 1) * real (count_list as x) ^ k)"
     using b by (simp add:F_def of_rat_sum sum_distrib_left of_rat_mult power_add of_rat_power)
   also have "... \<le> (\<Sum>x\<in>set as. real M ^ (k - 1) * real (count_list as x) ^ k)"
     by (intro sum_mono mult_right_mono power_mono of_nat_mono) (auto simp:M_def)
   also have "... = M powr (k-1) * of_rat (F k as)" using a
     by (simp add:sum_distrib_left F_def of_rat_mult of_rat_sum of_rat_power powr_realpow)
   also have "... = (M powr k) powr (real (k - 1) / real k) * of_rat (F k as) powr 1"
     using e by (simp add:powr_powr)
   also have "... \<le>  (real_of_rat (F k as)) powr ((k-1)/k) * (real_of_rat (F k as) powr 1)"
     using d by (intro mult_right_mono powr_mono2, auto)
   also have "... = (real_of_rat (F k as)) powr ((2*k-1) / k)"
     by (subst powr_add[symmetric], subst f, simp)
   finally have a: "real_of_rat (F (2*k-1) as) \<le> (real_of_rat (F k as)) powr ((2*k-1) / k)"
     by blast
 
   have g: "card (set as) \<le> n"
     using card_mono[OF _ as_range] by simp
 
   have "length as = abs (sum (\<lambda>x. real (count_list as x)) (set as))"
     by (subst of_nat_sum[symmetric], simp add: sum_count_set)
-  also have "... \<le> card (set as) powr ((k-Suc 0)/k) * 
+  also have "... \<le> card (set as) powr ((k-Suc 0)/k) *
     (sum (\<lambda>x. \<bar>real (count_list as x)\<bar> powr k) (set as)) powr (1/k)"
     using assms True
     by (intro Holder_inequality_sum[where p="k/(k-1)" and q="k" and f="\<lambda>_.1", simplified])
      (auto simp add:algebra_simps add_divide_distrib[symmetric])
   also have "... = (card (set as)) powr ((k-1) / real k) * of_rat (F k as) powr (1/ k)"
     using real_count_list_pos
     by (simp add:F_def of_rat_sum of_rat_power powr_realpow)
   also have "... = (card (set as)) powr (1 - 1 / real k) * of_rat (F k as) powr (1/ k)"
     using k_ge_1
     by (subst of_nat_diff[OF k_ge_1], subst diff_divide_distrib, simp)
   also have "... \<le> n powr (1 - 1 / real k) * of_rat (F k as) powr (1/ k)"
     using k_ge_1 g
     by (intro mult_right_mono powr_mono2, auto)
   finally have h: "length as \<le> n powr (1 - 1 / real k) * of_rat (F k as) powr (1/real k)"
     by blast
 
   have i:"1 / real k + real (2 * k - 1) / real k = real 2"
     using True by (subst add_divide_distrib[symmetric], simp_all add:of_nat_diff)
 
   have "?lhs \<le> n powr (1 - 1/k) * of_rat (F k as) powr (1/k) * (of_rat (F k as)) powr ((2*k-1) / k)"
     using a h F_ge_0 by (intro mult_mono mult_nonneg_nonneg, auto)
   also have "... = ?rhs"
     using i F_gr_0[OF assms] by (simp add:powr_add[symmetric] powr_realpow[symmetric])
   finally show ?thesis
     by blast
 next
   case False
   have "n = 0 \<Longrightarrow> False"
     using as_range assms by auto
-  hence "n > 0" 
+  hence "n > 0"
     by auto
   moreover have "k = 1"
     using assms k_ge_1 False by linarith
   moreover have "length as = real_of_rat (F (Suc 0) as)"
     by (simp add:F_def sum_count_set of_nat_sum[symmetric] del:of_nat_sum)
   ultimately show ?thesis
     by (simp add:power2_eq_square)
 qed
 
 definition result
   where "result a = of_nat (length as) * of_nat (Suc (snd a) ^ k - snd a ^ k)"
 
 lemma result_exp_1:
   assumes "as \<noteq> []"
   shows "expectation result = real_of_rat (F k as)"
 proof -
   have "expectation result = (\<Sum>a\<in>M\<^sub>1. result a * pmf (pmf_of_set M\<^sub>1) a)"
     unfolding \<Omega>\<^sub>1_def using non_empty_space assms fin_space
     by (subst integral_measure_pmf_real) auto
   also have "... = (\<Sum>a\<in>M\<^sub>1. result a / real (length as))"
    using non_empty_space assms fin_space card_space by simp
   also have "... = (\<Sum>a\<in>M\<^sub>1. real (Suc (snd a) ^ k - snd a ^ k))"
     using assms by (simp add:result_def)
   also have "... = (\<Sum>u\<in>set as. \<Sum>v = 0..<count_list as u. real (Suc v ^ k) - real (v ^ k))"
     using k_ge_1 by (subst split_space, simp add:of_nat_diff)
   also have "... = (\<Sum>u\<in>set as. real (count_list as u)^k)"
     using k_ge_1 by (subst sum_Suc_diff') (auto simp add:zero_power)
   also have "... = of_rat (F k as)"
     by (simp add:F_def of_rat_sum of_rat_power)
   finally show ?thesis by simp
 qed
 
 lemma result_var_1:
   assumes "as \<noteq> []"
   shows "variance result \<le> (of_rat (F k as))\<^sup>2 * k * n powr (1 - 1 / real k)"
-proof -  
+proof -
   have k_gt_0: "k > 0" using k_ge_1 by linarith
 
   have c:"real (Suc v ^ k) - real (v ^ k) \<le> k * real (count_list as a) ^ (k - Suc 0)"
     if c_1: "v < count_list as a" for a v
   proof -
     have "real (Suc v ^ k) - real (v ^ k) \<le> (real (v+1) - real v) * k * (1 + real v) ^ (k - Suc 0)"
       using k_gt_0 power_diff_est[where a="Suc v" and b="v"] by simp
     moreover have "(real (v+1) - real v) = 1" by auto
     ultimately have "real (Suc v ^ k) - real (v ^ k) \<le> k * (1 + real v) ^ (k - Suc 0)"
       by auto
     also have "... \<le> k * real (count_list as a) ^ (k- Suc 0)"
       using c_1 by (intro mult_left_mono power_mono, auto)
     finally show ?thesis by blast
   qed
-      
+
   have "length as * (\<Sum>a\<in> M\<^sub>1. (real (Suc (snd a)  ^ k - (snd a) ^ k))\<^sup>2) =
-    length as * (\<Sum>a\<in> set as. (\<Sum>v \<in> {0..<count_list as a}. 
+    length as * (\<Sum>a\<in> set as. (\<Sum>v \<in> {0..<count_list as a}.
     real (Suc v ^ k - v ^ k) * real (Suc v ^ k - v^k)))"
     by (subst split_space, simp add:power2_eq_square)
-  also have "... \<le> length as * (\<Sum>a\<in> set as. (\<Sum>v \<in> {0..<count_list as a}. 
+  also have "... \<le> length as * (\<Sum>a\<in> set as. (\<Sum>v \<in> {0..<count_list as a}.
     k * real (count_list as a) ^ (k-1) * real (Suc v ^ k - v ^ k)))"
     using c by (intro mult_left_mono sum_mono mult_right_mono) (auto simp:power_mono of_nat_diff)
-  also have "... = length as * k * (\<Sum>a\<in> set as. real (count_list as a) ^ (k-1) * 
+  also have "... = length as * k * (\<Sum>a\<in> set as. real (count_list as a) ^ (k-1) *
     (\<Sum>v \<in> {0..<count_list as a}. real (Suc v ^ k) - real (v ^ k)))"
     by (simp add:sum_distrib_left ac_simps of_nat_diff power_mono)
   also have "... = length as * k * (\<Sum>a\<in> set as. real (count_list as a ^ (2*k-1)))"
     using assms k_ge_1
     by (subst sum_Suc_diff', auto simp: zero_power[OF k_gt_0] mult_2 power_add[symmetric])
   also have "... = k * (length as * of_rat (F (2*k-1) as))"
     by (simp add:sum_distrib_left[symmetric] F_def of_rat_sum of_rat_power)
   also have "... \<le> k * (of_rat (F k as)^2 * n powr (1 - 1 / real k))"
     using fk_estimate[OF assms] by (intro mult_left_mono) (auto simp: mult.commute)
-  finally have b: "real (length as) * (\<Sum>a\<in> M\<^sub>1. (real (Suc (snd a) ^ k - (snd a) ^ k))\<^sup>2) \<le> 
+  finally have b: "real (length as) * (\<Sum>a\<in> M\<^sub>1. (real (Suc (snd a) ^ k - (snd a) ^ k))\<^sup>2) \<le>
     k * ((of_rat (F k as))\<^sup>2 * n powr (1 - 1 / real k))"
     by blast
 
   have "expectation (\<lambda>\<omega>. (result \<omega> :: real)^2) - (expectation result)^2 \<le> expectation (\<lambda>\<omega>. result \<omega>^2)"
     by simp
   also have "... = (\<Sum>a\<in>M\<^sub>1. (length as * real (Suc (snd a) ^ k - snd a ^ k))\<^sup>2 * pmf (pmf_of_set M\<^sub>1) a)"
     using fin_space non_empty_space assms unfolding \<Omega>\<^sub>1_def result_def
     by (subst integral_measure_pmf_real[where A="M\<^sub>1"], auto)
   also have "... = (\<Sum>a\<in>M\<^sub>1. length as * (real (Suc (snd a) ^ k - snd a ^ k))\<^sup>2)"
     using assms non_empty_space fin_space by (subst pmf_of_set)
      (simp_all add:card_space power_mult_distrib power2_eq_square ac_simps)
   also have "... \<le> k * ((of_rat (F k as))\<^sup>2 * n powr (1 - 1 / real k))"
     using b by (simp add:sum_distrib_left[symmetric])
   also have "... = of_rat (F k as)^2 * k * n powr (1 - 1 / real k)"
     by (simp add:ac_simps)
-  finally have "expectation (\<lambda>\<omega>. result \<omega>^2) - (expectation result)^2 \<le> 
+  finally have "expectation (\<lambda>\<omega>. result \<omega>^2) - (expectation result)^2 \<le>
     of_rat (F k as)^2 * k * n powr (1 - 1 / real k)"
     by blast
 
   thus ?thesis
     using integrable_1[OF assms] by (simp add:variance_eq)
 qed
 
 theorem fk_alg_sketch:
   assumes "as \<noteq> []"
-  shows "fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) = 
+  shows "fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) =
     map_pmf (\<lambda>x. (s\<^sub>1,s\<^sub>2,k,length as, x)) M\<^sub>2" (is "?lhs = ?rhs")
 proof -
-  have "?lhs = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
+  have "?lhs = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})
     (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0, 0, 0))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst fk_update_distr, simp)
-  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
+  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind>
     (\<lambda>k. return_pmf (length as, sketch as k))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst fk_update_2_distr[OF assms], simp)
-  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
+  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind>
     (\<lambda>k. return_pmf (sketch as k)) \<bind> (\<lambda>s. return_pmf (length as, s))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst bind_assoc_pmf, subst bind_return_pmf, simp)
-  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
+  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind>
     (\<lambda>k. return_pmf (sketch as k))) \<bind>
     (\<lambda>x. return_pmf (\<lambda>i \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. (length as, x i))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst Pi_pmf_bind_return[where d'="undefined"], simp, simp add:restrict_def)
-  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
+  also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind>
     (\<lambda>k. return_pmf (sketch as k))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, restrict x ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})))"
     by (subst bind_assoc_pmf, simp add:bind_return_pmf cong:restrict_cong)
   also have "... = M\<^sub>2 \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, restrict x ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})))"
     by (subst sketch_distr[OF assms], simp add:M\<^sub>2_def)
   also have "... = M\<^sub>2 \<bind> (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, x))"
-    by (rule bind_pmf_cong, auto simp add:PiE_dflt_def M\<^sub>2_def set_Pi_pmf) 
+    by (rule bind_pmf_cong, auto simp add:PiE_dflt_def M\<^sub>2_def set_Pi_pmf)
   also have "... = ?rhs"
     by (simp add:map_pmf_def)
   finally show ?thesis by simp
 qed
 
-definition mean_rv 
+definition mean_rv
   where "mean_rv \<omega> i\<^sub>2 = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. result (\<omega> (i\<^sub>1, i\<^sub>2))) / of_nat s\<^sub>1"
 
-definition median_rv 
+definition median_rv
     where "median_rv \<omega> = median s\<^sub>2 (\<lambda>i\<^sub>2. mean_rv \<omega> i\<^sub>2)"
 
 lemma fk_alg_correct':
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) \<bind> fk_result"
   shows "\<P>(\<omega> in measure_pmf M. \<bar>\<omega> - F k as\<bar> \<le> \<delta> * F k as) \<ge> 1 - of_rat \<epsilon>"
 proof (cases "as = []")
   case True
-  have a: "nat \<lceil>- (18 * ln (real_of_rat \<epsilon>))\<rceil> > 0"  using \<epsilon>_range by simp 
-  show ?thesis using True \<epsilon>_range 
+  have a: "nat \<lceil>- (18 * ln (real_of_rat \<epsilon>))\<rceil> > 0"  using \<epsilon>_range by simp
+  show ?thesis using True \<epsilon>_range
     by (simp add:F_def M_def bind_return_pmf median_const[OF a] Let_def)
 next
   case False
 
   have "set as \<noteq> {}" using assms False by blast
   hence n_nonzero: "n > 0" using as_range by fastforce
 
   have fk_nonzero: "F k as > 0"
     using F_gr_0[OF False] by simp
 
   have s1_nonzero: "s\<^sub>1 > 0"
     using \<delta>_range k_ge_1 n_nonzero by (simp add:s\<^sub>1_def)
   have s2_nonzero: "s\<^sub>2 > 0"
-    using \<epsilon>_range by (simp add:s\<^sub>2_def) 
+    using \<epsilon>_range by (simp add:s\<^sub>2_def)
 
   have real_of_rat_mean_rv: "\<And>x i. mean_rv x = (\<lambda>i. real_of_rat (mean_rv x i))"
     by (rule ext, simp add:of_rat_divide of_rat_sum of_rat_mult result_def mean_rv_def)
   have real_of_rat_median_rv: "\<And>x. median_rv x = real_of_rat (median_rv x)"
     unfolding median_rv_def using s2_nonzero
     by (subst real_of_rat_mean_rv, simp add: median_rat median_restrict)
 
 
   have space_\<Omega>\<^sub>2: "space \<Omega>\<^sub>2 = UNIV" by (simp add:\<Omega>\<^sub>2_def)
 
-  have fk_result_eta: "fk_result = (\<lambda>(x,y,z,u,v). fk_result (x,y,z,u,v))" 
-    by auto 
+  have fk_result_eta: "fk_result = (\<lambda>(x,y,z,u,v). fk_result (x,y,z,u,v))"
+    by auto
 
-  have a:"fold (\<lambda>x state. state \<bind> fk_update x) as (fk_init k \<delta> \<epsilon> n) = 
+  have a:"fold (\<lambda>x state. state \<bind> fk_update x) as (fk_init k \<delta> \<epsilon> n) =
     map_pmf (\<lambda>x. (s\<^sub>1,s\<^sub>2,k,length as, x)) M\<^sub>2"
     by (subst fk_alg_sketch[OF False]) (simp add:s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric])
 
   have "M =  map_pmf (\<lambda>x. (s\<^sub>1, s\<^sub>2, k, length as, x)) M\<^sub>2 \<bind> fk_result"
     by (subst M_def, subst a, simp)
   also have "... = M\<^sub>2 \<bind> return_pmf \<circ> median_rv"
     by (subst fk_result_eta)
-     (auto simp add:map_pmf_def bind_assoc_pmf bind_return_pmf median_rv_def mean_rv_def comp_def 
+     (auto simp add:map_pmf_def bind_assoc_pmf bind_return_pmf median_rv_def mean_rv_def comp_def
        M\<^sub>1_def result_def median_restrict)
   finally have b: "M = M\<^sub>2 \<bind> return_pmf \<circ> median_rv"
     by simp
 
-  have result_exp: 
+  have result_exp:
     "i\<^sub>1 < s\<^sub>1 \<Longrightarrow> i\<^sub>2 < s\<^sub>2 \<Longrightarrow> \<Omega>\<^sub>2.expectation (\<lambda>x. result (x (i\<^sub>1, i\<^sub>2))) = real_of_rat (F k as)"
     for i\<^sub>1 i\<^sub>2
     unfolding \<Omega>\<^sub>2_def M\<^sub>2_def
     using integrable_1[OF False] result_exp_1[OF False]
     by (subst expectation_Pi_pmf_slice, auto simp:\<Omega>\<^sub>1_def)
 
 
-  have result_var: "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (i\<^sub>1, i\<^sub>2))) \<le> of_rat (\<delta> * F k as)^2 * real s\<^sub>1 / 3" 
+  have result_var: "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (i\<^sub>1, i\<^sub>2))) \<le> of_rat (\<delta> * F k as)^2 * real s\<^sub>1 / 3"
     if result_var_assms: "i\<^sub>1 < s\<^sub>1" "i\<^sub>2 < s\<^sub>2" for i\<^sub>1 i\<^sub>2
   proof -
     have "3 * real k * n powr (1 - 1 / real k) =
       (of_rat \<delta>)\<^sup>2 * (3 * real k * n powr (1 - 1 / real k) / (of_rat \<delta>)\<^sup>2)"
       using \<delta>_range by simp
     also have "... \<le>  (real_of_rat \<delta>)\<^sup>2 * (real s\<^sub>1)"
       unfolding s\<^sub>1_def
       by (intro mult_mono of_nat_ceiling, simp_all)
     finally have f2_var_2: "3 * real k * n powr (1 - 1 / real k) \<le> (of_rat \<delta>)\<^sup>2 * (real s\<^sub>1)"
       by blast
 
     have "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (i\<^sub>1, i\<^sub>2)) :: real)  = variance result"
       using result_var_assms integrable_1[OF False]
-      unfolding \<Omega>\<^sub>2_def M\<^sub>2_def \<Omega>\<^sub>1_def 
+      unfolding \<Omega>\<^sub>2_def M\<^sub>2_def \<Omega>\<^sub>1_def
       by (subst variance_prod_pmf_slice, auto)
     also have "... \<le> of_rat (F k as)^2 * real k * n powr (1 - 1 / real k)"
       using assms False result_var_1 \<Omega>\<^sub>1_def by simp
     also have "... =
       of_rat (F k as)^2 * (real k * n powr (1 - 1 / real k))"
       by (simp add:ac_simps)
     also have "... \<le> of_rat (F k as)^2 * (of_rat \<delta>^2 * (real s\<^sub>1 / 3))"
-      using f2_var_2 by (intro mult_left_mono, auto) 
+      using f2_var_2 by (intro mult_left_mono, auto)
     also have "... = of_rat (F k as * \<delta>)^2 * (real s\<^sub>1 / 3)"
-      by (simp add: of_rat_mult power_mult_distrib) 
+      by (simp add: of_rat_mult power_mult_distrib)
     also have "... = of_rat (\<delta> * F k as)^2 * real s\<^sub>1 / 3"
       by (simp add:ac_simps)
     finally show ?thesis
       by simp
   qed
 
   have mean_rv_exp: "\<Omega>\<^sub>2.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = real_of_rat (F k as)"
     if mean_rv_exp_assms: "i < s\<^sub>2" for i
   proof -
     have "\<Omega>\<^sub>2.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = \<Omega>\<^sub>2.expectation (\<lambda>\<omega>. \<Sum>n = 0..<s\<^sub>1. result (\<omega> (n, i)) / real s\<^sub>1)"
       by (simp add:mean_rv_def sum_divide_distrib)
     also have "... = (\<Sum>n = 0..<s\<^sub>1. \<Omega>\<^sub>2.expectation (\<lambda>\<omega>. result (\<omega> (n, i))) / real s\<^sub>1)"
       using integrable_2[OF False]
       by (subst Bochner_Integration.integral_sum, auto)
     also have "... = of_rat (F k as)"
       using s1_nonzero mean_rv_exp_assms
       by (simp add:result_exp)
     finally show ?thesis by simp
   qed
 
-  have mean_rv_var: "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i) \<le> real_of_rat (\<delta> * F k as)^2/3" 
+  have mean_rv_var: "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i) \<le> real_of_rat (\<delta> * F k as)^2/3"
     if mean_rv_var_assms: "i < s\<^sub>2" for i
   proof -
     have a:"\<Omega>\<^sub>2.indep_vars (\<lambda>_. borel) (\<lambda>n x. result (x (n, i)) / real s\<^sub>1) {0..<s\<^sub>1}"
       unfolding \<Omega>\<^sub>2_def M\<^sub>2_def using mean_rv_var_assms
       by (intro indep_vars_restrict_intro'[where f="fst"], simp, simp add:restrict_dfl_def, simp, simp)
     have "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i) = \<Omega>\<^sub>2.variance (\<lambda>\<omega>. \<Sum>j = 0..<s\<^sub>1. result (\<omega> (j, i)) / real s\<^sub>1)"
       by (simp add:mean_rv_def sum_divide_distrib)
     also have "... = (\<Sum>j = 0..<s\<^sub>1. \<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (j, i)) / real s\<^sub>1))"
       using a integrable_2[OF False]
       by (subst \<Omega>\<^sub>2.bienaymes_identity_full_indep, auto simp add:\<Omega>\<^sub>2_def)
     also have "... = (\<Sum>j = 0..<s\<^sub>1. \<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (j, i))) / real s\<^sub>1^2)"
       using integrable_2[OF False]
       by (subst \<Omega>\<^sub>2.variance_divide, auto)
     also have "... \<le> (\<Sum>j = 0..<s\<^sub>1. ((real_of_rat (\<delta> * F k as))\<^sup>2 * real s\<^sub>1 / 3) / (real s\<^sub>1^2))"
       using result_var[OF _ mean_rv_var_assms]
       by (intro sum_mono divide_right_mono, auto)
     also have "... = real_of_rat (\<delta> * F k as)^2/3"
       using s1_nonzero
       by (simp add:algebra_simps power2_eq_square)
     finally show ?thesis by simp
   qed
 
-  have "\<Omega>\<^sub>2.prob {y. of_rat (\<delta> * F k as) < \<bar>mean_rv y i - real_of_rat (F k as)\<bar>} \<le> 1/3" 
+  have "\<Omega>\<^sub>2.prob {y. of_rat (\<delta> * F k as) < \<bar>mean_rv y i - real_of_rat (F k as)\<bar>} \<le> 1/3"
     (is "?lhs \<le> _") if c_assms: "i < s\<^sub>2" for i
   proof -
     define a where "a = real_of_rat (\<delta> * F k as)"
     have c: "0 < a" unfolding  a_def
       using assms \<delta>_range fk_nonzero
       by (metis zero_less_of_rat_iff mult_pos_pos)
     have "?lhs \<le> \<Omega>\<^sub>2.prob {y \<in> space \<Omega>\<^sub>2. a \<le> \<bar>mean_rv y i -  \<Omega>\<^sub>2.expectation (\<lambda>\<omega>. mean_rv \<omega> i)\<bar>}"
-      by (intro \<Omega>\<^sub>2.pmf_mono[OF \<Omega>\<^sub>2_def], simp add:a_def mean_rv_exp[OF c_assms] space_\<Omega>\<^sub>2) 
+      by (intro \<Omega>\<^sub>2.pmf_mono[OF \<Omega>\<^sub>2_def], simp add:a_def mean_rv_exp[OF c_assms] space_\<Omega>\<^sub>2)
     also have "... \<le> \<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i)/a^2"
       by (intro \<Omega>\<^sub>2.Chebyshev_inequality integrable_2 c False)  (simp add:\<Omega>\<^sub>2_def)
     also have "... \<le> 1/3" using c
-      using mean_rv_var[OF c_assms] 
+      using mean_rv_var[OF c_assms]
       by (simp add:algebra_simps, simp add:a_def)
     finally show ?thesis
       by blast
   qed
 
   moreover have "\<Omega>\<^sub>2.indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. mean_rv \<omega> i) {0..<s\<^sub>2}"
     using s1_nonzero unfolding \<Omega>\<^sub>2_def M\<^sub>2_def
     by (intro indep_vars_restrict_intro'[where f="snd"] finite_cartesian_product)
      (simp_all add:mean_rv_def restrict_dfl_def space_\<Omega>\<^sub>2)
   moreover have " - (18 * ln (real_of_rat \<epsilon>)) \<le> real s\<^sub>2"
     by (simp add:s\<^sub>2_def, linarith)
-  ultimately have "1 - of_rat \<epsilon> \<le> 
-    \<Omega>\<^sub>2.prob {y \<in> space \<Omega>\<^sub>2. \<bar>median s\<^sub>2 (mean_rv y) - real_of_rat (F k as)\<bar> \<le> of_rat (\<delta> * F k as)}" 
+  ultimately have "1 - of_rat \<epsilon> \<le>
+    \<Omega>\<^sub>2.prob {y \<in> space \<Omega>\<^sub>2. \<bar>median s\<^sub>2 (mean_rv y) - real_of_rat (F k as)\<bar> \<le> of_rat (\<delta> * F k as)}"
     using \<epsilon>_range
     by (intro \<Omega>\<^sub>2.median_bound_2, simp_all add:space_\<Omega>\<^sub>2)
-  also have "... = \<Omega>\<^sub>2.prob {y. \<bar>median_rv y - real_of_rat (F k as)\<bar> \<le> real_of_rat (\<delta> * F k as)}" 
+  also have "... = \<Omega>\<^sub>2.prob {y. \<bar>median_rv y - real_of_rat (F k as)\<bar> \<le> real_of_rat (\<delta> * F k as)}"
     by (simp add:median_rv_def space_\<Omega>\<^sub>2)
   also have "... =  \<Omega>\<^sub>2.prob {y. \<bar>median_rv y - F k as\<bar> \<le> \<delta> * F k as}"
     by (simp add:real_of_rat_median_rv of_rat_less_eq flip: of_rat_diff)
   also have "... = \<P>(\<omega> in measure_pmf M. \<bar>\<omega> - F k as\<bar> \<le> \<delta> * F k as)"
     by (simp add: b comp_def map_pmf_def[symmetric] \<Omega>\<^sub>2_def)
   finally show ?thesis by simp
 qed
 
 lemma fk_exact_space_usage':
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n)"
   shows "AE \<omega> in M. bit_count (encode_fk_state \<omega>) \<le> fk_space_usage (k, n, length as, \<epsilon>, \<delta>)"
     (is "AE \<omega> in M. (_  \<le> ?rhs)")
 proof -
   define H where "H = (if as = [] then return_pmf (\<lambda>i\<in> {0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. (0,0)) else M\<^sub>2)"
 
   have a:"M = map_pmf (\<lambda>x.(s\<^sub>1,s\<^sub>2,k,length as, x)) H"
   proof (cases "as \<noteq> []")
     case True
-    then show ?thesis 
+    then show ?thesis
       unfolding M_def fk_alg_sketch[OF True] H_def
       by (simp add:M\<^sub>2_def)
   next
     case False
     then show ?thesis
       by (simp add:H_def M_def s\<^sub>1_def[symmetric] Let_def s\<^sub>2_def[symmetric] map_pmf_def bind_return_pmf)
   qed
 
   have "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le> ?rhs"
     if b:"y \<in> set_pmf H" for y
   proof -
     have b0:" as \<noteq> [] \<Longrightarrow> y \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2} \<rightarrow>\<^sub>E M\<^sub>1"
       using b non_empty_space fin_space by (simp add:H_def M\<^sub>2_def set_prod_pmf)
 
-    have "bit_count ((N\<^sub>e \<times>\<^sub>e N\<^sub>e) (y x)) \<le> 
+    have "bit_count ((N\<^sub>e \<times>\<^sub>e N\<^sub>e) (y x)) \<le>
       ereal (2 * log 2 (real n + 1) + 1) + ereal (2 * log 2 (real (length as) + 1) + 1)"
       (is "_ \<le> ?rhs1")
       if b1_assms: "x \<in> {0..<s\<^sub>1}\<times>{0..<s\<^sub>2}" for x
     proof -
       have "fst (y x) \<le> n"
       proof (cases "as = []")
         case True
         then show ?thesis using b b1_assms by (simp add:H_def)
       next
         case False
         hence "1 \<le> count_list as (fst (y x))"
           using b0 b1_assms by (simp add:PiE_iff case_prod_beta M\<^sub>1_def, fastforce)
         hence "fst (y x) \<in> set as"
           using count_list_gr_1 by metis
-        then show ?thesis 
+        then show ?thesis
           by (meson lessThan_iff less_imp_le_nat subsetD as_range)
       qed
-      moreover have "snd (y x) \<le> length as" 
+      moreover have "snd (y x) \<le> length as"
       proof (cases "as = []")
         case True
         then show ?thesis using b b1_assms by (simp add:H_def)
       next
         case False
         hence "(y x) \<in> M\<^sub>1"
           using b0 b1_assms by auto
         hence "snd (y x) \<le> count_list as (fst (y x))"
           by (simp add:M\<^sub>1_def case_prod_beta)
         then show ?thesis using count_le_length by (metis order_trans)
       qed
       ultimately have "bit_count (N\<^sub>e (fst (y x))) + bit_count (N\<^sub>e (snd (y x))) \<le> ?rhs1"
         using exp_golomb_bit_count_est  by (intro add_mono, auto)
       thus ?thesis
         by (subst dependent_bit_count_2, simp)
     qed
 
     moreover have "y \<in> extensional ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})"
       using b0 b PiE_iff by (cases "as = []", auto simp:H_def PiE_iff)
 
-    ultimately have "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e N\<^sub>e \<times>\<^sub>e N\<^sub>e) y) \<le> 
+    ultimately have "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e N\<^sub>e \<times>\<^sub>e N\<^sub>e) y) \<le>
       ereal (real s\<^sub>1 * real s\<^sub>2) * (ereal (2 * log 2 (real n + 1) + 1) +
       ereal (2 * log 2 (real (length as) + 1) + 1))"
       by (intro fun_bit_count_est[where xs="(List.product [0..<s\<^sub>1] [0..<s\<^sub>2])", simplified], auto)
-    hence "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le> 
-       ereal (2 * log 2 (real s\<^sub>1 + 1) + 1) + 
-      (ereal (2 * log 2 (real s\<^sub>2 + 1) + 1) +  
-      (ereal (2 * log 2 (real k + 1) + 1) + 
-      (ereal (2 * log 2 (real (length as) + 1) + 1) +  
-      (ereal (real s\<^sub>1 * real s\<^sub>2) * (ereal (2 * log 2 (real n+1) + 1) + 
+    hence "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le>
+       ereal (2 * log 2 (real s\<^sub>1 + 1) + 1) +
+      (ereal (2 * log 2 (real s\<^sub>2 + 1) + 1) +
+      (ereal (2 * log 2 (real k + 1) + 1) +
+      (ereal (2 * log 2 (real (length as) + 1) + 1) +
+      (ereal (real s\<^sub>1 * real s\<^sub>2) * (ereal (2 * log 2 (real n+1) + 1) +
        ereal (2 * log 2 (real (length as)+1) + 1))))))"
       unfolding encode_fk_state_def dependent_bit_count
       by (intro add_mono exp_golomb_bit_count, auto)
-    also have "... \<le> ?rhs" 
+    also have "... \<le> ?rhs"
       by (simp add: s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric] Let_def) (simp add:ac_simps)
     finally show "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le> ?rhs"
       by blast
   qed
   thus ?thesis
     by (simp add: a AE_measure_pmf_iff del:fk_space_usage.simps)
 qed
 
 end
 
 text \<open>Main results of this section:\<close>
 
 theorem fk_alg_correct:
   assumes "k \<ge> 1"
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) \<bind> fk_result"
   shows "\<P>(\<omega> in measure_pmf M. \<bar>\<omega> - F k as\<bar> \<le> \<delta> * F k as) \<ge> 1 - of_rat \<epsilon>"
   unfolding M_def using fk_alg_correct'[OF assms(1-4)] by blast
 
 theorem fk_exact_space_usage:
   assumes "k \<ge> 1"
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n)"
   shows "AE \<omega> in M. bit_count (encode_fk_state \<omega>) \<le> fk_space_usage (k, n, length as, \<epsilon>, \<delta>)"
   unfolding M_def using fk_exact_space_usage'[OF assms(1-4)] by blast
 
 theorem fk_asymptotic_space_complexity:
-  "fk_space_usage \<in> 
+  "fk_space_usage \<in>
   O[at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_right (0::rat) \<times>\<^sub>F at_right (0::rat)](\<lambda> (k, n, m, \<epsilon>, \<delta>).
   real k * real n powr (1-1/ real k) / (of_rat \<delta>)\<^sup>2 * (ln (1 / of_rat \<epsilon>)) * (ln (real n) + ln (real m)))"
   (is "_ \<in> O[?F](?rhs)")
 proof -
   define k_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "k_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). k)"
   define n_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "n_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). n)"
   define m_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "m_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). m)"
   define \<epsilon>_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<epsilon>_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). \<epsilon>)"
   define \<delta>_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<delta>_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). \<delta>)"
 
-  define g1 where 
+  define g1 where
     "g1 = (\<lambda>x. real (k_of x)*(real (n_of x)) powr (1-1/ real (k_of x)) * (1 / of_rat (\<delta>_of x)^2))"
 
-  define g where 
+  define g where
     "g = (\<lambda>x. g1 x * (ln (1 / of_rat (\<epsilon>_of x))) * (ln (real (n_of x)) + ln (real (m_of x))))"
 
-  define s1_of where "s1_of = (\<lambda>x. 
+  define s1_of where "s1_of = (\<lambda>x.
     nat \<lceil>3 * real (k_of x) * real (n_of x) powr (1 - 1 / real (k_of x)) / (real_of_rat (\<delta>_of x))\<^sup>2\<rceil>)"
   define s2_of where "s2_of = (\<lambda>x. nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>)"
 
-  have evt: "(\<And>x. 
-    0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and> 
+  have evt: "(\<And>x.
+    0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and>
     1/real_of_rat (\<delta>_of x) \<ge> \<delta> \<and> 1/real_of_rat (\<epsilon>_of x) \<ge> \<epsilon> \<and>
-    real (n_of x) \<ge> n \<and> real (k_of x) \<ge> k \<and> real (m_of x) \<ge> m\<Longrightarrow> P x) 
+    real (n_of x) \<ge> n \<and> real (k_of x) \<ge> k \<and> real (m_of x) \<ge> m\<Longrightarrow> P x)
     \<Longrightarrow> eventually P ?F"  (is "(\<And>x. ?prem x \<Longrightarrow> _) \<Longrightarrow> _")
     for \<delta> \<epsilon> n k m P
     apply (rule eventually_mono[where P="?prem" and Q="P"])
     apply (simp add:\<epsilon>_of_def case_prod_beta' \<delta>_of_def n_of_def k_of_def m_of_def)
      apply (intro eventually_conj eventually_prod1' eventually_prod2'
         sequentially_inf eventually_at_right_less inv_at_right_0_inf)
     by (auto simp add:prod_filter_eq_bot)
 
-  have 1: 
+  have 1:
     "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x))"
     "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (m_of x))"
     "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (k_of x))"
     by (intro landau_o.big_mono eventually_mono[OF evt], auto)+
 
 
   have "(\<lambda>x. ln (real (m_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (m_of x)))"
     by (intro landau_ln_2[where a="2"] evt[where m="2"] sum_in_bigo 1, auto)
   hence 2: " (\<lambda>x. log 2 (real (m_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_2  eventually_mono[OF evt[where n="1" and m="1"]])
      (auto simp add:log_def)
 
-  have 3: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))" 
+  have 3: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     using order_less_le_trans[OF exp_gt_zero] ln_ge_iff
     by (intro landau_o.big_mono  evt[where \<epsilon>="exp 1"])
      (simp add: abs_ge_iff, blast)
 
   have 4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using one_le_power
     by (intro landau_o.big_mono evt[where \<delta>="1"])
      (simp add:power_one_over[symmetric], blast)
 
   have "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     using order_less_le_trans[OF exp_gt_zero] ln_ge_iff
     by (intro landau_o.big_mono  evt[where n="exp 1"])
      (simp add: abs_ge_iff, blast)
 
   hence 5: "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1 evt[where n="1" and m="1"], auto)
 
-  have "(\<lambda>x. -ln(of_rat (\<epsilon>_of x))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))" 
+  have "(\<lambda>x. -ln(of_rat (\<epsilon>_of x))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono evt) (auto simp add:ln_div)
   hence 6: "(\<lambda>x. real (s2_of x)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     unfolding s2_of_def
     by (intro landau_nat_ceil 3, simp)
 
   have 7: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x) powr (1 - 1 / real (k_of x)))"
     by (intro landau_o.big_mono evt[where n="1" and k="1"])
      (auto simp add: ge_one_powr_ge_zero)
 
   have 8: "(\<lambda>_. 1) \<in> O[?F](g1)"
     unfolding g1_def by (intro landau_o.big_mult_1 1 7 4)
 
   have "(\<lambda>x. 3 * (real (k_of x) * (n_of x) powr (1 - 1 / real (k_of x)) / (of_rat (\<delta>_of x))\<^sup>2))
     \<in> O[?F](g1)"
     by (subst landau_o.big.cmult_in_iff, simp, simp add:g1_def)
   hence 9: "(\<lambda>x. real (s1_of x)) \<in> O[?F](g1)"
     unfolding s1_of_def by (intro landau_nat_ceil 8, auto simp:ac_simps)
 
-  have 10: "(\<lambda>_. 1) \<in> O[?F](g)" 
+  have 10: "(\<lambda>_. 1) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 8 3 5)
-  
+
   have "(\<lambda>x. real (s1_of x)) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 5 3 9)
   hence "(\<lambda>x. ln (real (s1_of x) + 1)) \<in> O[?F](g)"
     using 10 by (intro landau_ln_3 sum_in_bigo, auto)
   hence 11: "(\<lambda>x. log 2 (real (s1_of x) + 1)) \<in> O[?F](g)"
     by (simp add:log_def)
 
   have 12: " (\<lambda>x. ln (real (s2_of x) + 1)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     using evt[where \<epsilon>="2"] 6 3
     by (intro landau_ln_3 sum_in_bigo, auto)
 
-  have 13: "(\<lambda>x. log 2 (real (s2_of x) + 1)) \<in> O[?F](g)" 
-    unfolding g_def 
+  have 13: "(\<lambda>x. log 2 (real (s2_of x) + 1)) \<in> O[?F](g)"
+    unfolding g_def
     by (rule landau_o.big_mult_1, rule landau_o.big_mult_1', auto simp add: 8 5 12 log_def)
 
   have "(\<lambda>x. real (k_of x)) \<in> O[?F](g1)"
     unfolding g1_def using 7 4
     by (intro landau_o.big_mult_1, simp_all)
   hence "(\<lambda>x. log 2 (real (k_of x) + 1)) \<in> O[?F](g1)"
     by (simp add:log_def) (intro landau_ln_3 sum_in_bigo 8, auto)
   hence 14: "(\<lambda>x. log 2 (real (k_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def  by (intro landau_o.big_mult_1 3 5)
 
   have 15: "(\<lambda>x. log 2 (real (m_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def using 2 8 3
     by (intro landau_o.big_mult_1', simp_all)
 
   have "(\<lambda>x. ln (real (n_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     by (intro landau_ln_2[where a="2"] eventually_mono[OF evt[where n="2"]] sum_in_bigo 1, auto)
   hence " (\<lambda>x. log 2 (real (n_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1 evt[where n="1" and m="1"])
      (auto simp add:log_def)
   hence 16: "(\<lambda>x. real (s1_of x) * real (s2_of x) *
-    (2 + 2 * log 2 (real (n_of x) + 1) + 2 * log 2 (real (m_of x) + 1))) \<in> O[?F](g)" 
+    (2 + 2 * log 2 (real (n_of x) + 1) + 2 * log 2 (real (m_of x) + 1))) \<in> O[?F](g)"
     unfolding g_def using 9 6 5 2
     by (intro landau_o.mult sum_in_bigo, auto)
 
   have "fk_space_usage = (\<lambda>x. fk_space_usage (k_of x, n_of x, m_of x, \<epsilon>_of x, \<delta>_of x))"
     by (simp add:case_prod_beta' k_of_def n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def)
   also have "... \<in> O[?F](g)"
     using 10 11 13 14 15 16
     by (simp add:fun_cong[OF s1_of_def[symmetric]] fun_cong[OF s2_of_def[symmetric]] Let_def)
      (intro sum_in_bigo, auto)
   also have "... = O[?F](?rhs)"
     by (simp add:case_prod_beta' g1_def g_def n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def k_of_def)
   finally show ?thesis by simp
 qed
 
 end
diff --git a/thys/Frequency_Moments/Frequency_Moments.thy b/thys/Frequency_Moments/Frequency_Moments.thy
--- a/thys/Frequency_Moments/Frequency_Moments.thy
+++ b/thys/Frequency_Moments/Frequency_Moments.thy
@@ -1,115 +1,115 @@
 section "Frequency Moments"
 
 theory Frequency_Moments
-  imports 
+  imports
     Frequency_Moments_Preliminary_Results
     Universal_Hash_Families.Universal_Hash_Families_More_Finite_Fields
     Interpolation_Polynomials_HOL_Algebra.Interpolation_Polynomial_Cardinalities
 begin
 
-text \<open>This section contains a definition of the frequency moments of a stream and a few general results about 
+text \<open>This section contains a definition of the frequency moments of a stream and a few general results about
 frequency moments..\<close>
 
 definition F where
   "F k xs = (\<Sum> x \<in> set xs. (rat_of_nat (count_list xs x)^k))"
 
 lemma F_ge_0: "F k as \<ge> 0"
   unfolding F_def by (rule sum_nonneg, simp)
 
 lemma F_gr_0:
   assumes "as \<noteq> []"
   shows "F k as > 0"
 proof -
   have "rat_of_nat 1 \<le> rat_of_nat (card (set as))"
-    using assms card_0_eq[where A="set as"] 
+    using assms card_0_eq[where A="set as"]
     by (intro of_nat_mono)
      (metis List.finite_set One_nat_def Suc_leI neq0_conv set_empty)
   also have "... = (\<Sum>x\<in>set as. 1)" by simp
   also have "... \<le> (\<Sum>x\<in>set as. rat_of_nat (count_list as x) ^ k)"
     by (intro sum_mono one_le_power)
      (metis  count_list_gr_1  of_nat_1 of_nat_le_iff)
   also have "... \<le> F k as"
     by (simp add:F_def)
   finally show ?thesis by simp
 qed
 
 definition P\<^sub>e :: "nat \<Rightarrow> nat \<Rightarrow> nat list \<Rightarrow> bool list option" where
   "P\<^sub>e p n f = (if p > 1 \<and> f \<in> bounded_degree_polynomials (mod_ring p) n then
     ([0..<n] \<rightarrow>\<^sub>e Nb\<^sub>e p) (\<lambda>i \<in> {..<n}. ring.coeff (mod_ring p) f i) else None)"
 
 lemma poly_encoding:
   "is_encoding (P\<^sub>e p n)"
 proof (cases "p > 1")
   case True
   interpret cring "mod_ring p"
     using mod_ring_is_cring True by blast
   have a:"inj_on (\<lambda>x. (\<lambda>i \<in> {..<n}. (coeff x i))) (bounded_degree_polynomials (mod_ring p) n)"
   proof (rule inj_onI)
     fix x y
     assume b:"x \<in> bounded_degree_polynomials (mod_ring p) n"
     assume c:"y \<in> bounded_degree_polynomials (mod_ring p) n"
     assume d:"restrict (coeff x) {..<n} = restrict (coeff y) {..<n}"
     have "coeff x i = coeff y i" for i
     proof (cases "i < n")
       case True
       then show ?thesis by (metis lessThan_iff restrict_apply d)
     next
       case False
       hence e: "i \<ge> n" by linarith
       have "coeff x i = \<zero>\<^bsub>mod_ring p\<^esub>"
         using b e by (subst coeff_length, auto simp:bounded_degree_polynomials_length)
       also have "... = coeff y i"
         using c e by (subst coeff_length, auto simp:bounded_degree_polynomials_length)
       finally show ?thesis by simp
     qed
     then show "x = y"
-      using b c univ_poly_carrier 
-      by (subst coeff_iff_polynomial_cond) (auto simp:bounded_degree_polynomials_length) 
+      using b c univ_poly_carrier
+      by (subst coeff_iff_polynomial_cond) (auto simp:bounded_degree_polynomials_length)
   qed
 
   have "is_encoding (\<lambda>f. P\<^sub>e p n f)"
     unfolding P\<^sub>e_def using a True
-    by (intro encoding_compose[where f="([0..<n] \<rightarrow>\<^sub>e Nb\<^sub>e p)"] fun_encoding bounded_nat_encoding) 
+    by (intro encoding_compose[where f="([0..<n] \<rightarrow>\<^sub>e Nb\<^sub>e p)"] fun_encoding bounded_nat_encoding)
      auto
   thus ?thesis by simp
 next
   case False
   hence "is_encoding (\<lambda>f. P\<^sub>e p n f)"
     unfolding P\<^sub>e_def using encoding_triv by simp
   then show ?thesis by simp
 qed
 
 lemma bounded_degree_polynomial_bit_count:
   assumes "p > 1"
   assumes "x \<in> bounded_degree_polynomials (mod_ring p) n"
   shows "bit_count (P\<^sub>e p n x) \<le> ereal (real n * (log 2 p + 1))"
 proof -
   interpret cring "mod_ring p"
     using mod_ring_is_cring assms by blast
 
   have a: "x \<in> carrier (poly_ring (mod_ring p))"
     using assms(2) by (simp add:bounded_degree_polynomials_def)
 
   have "real_of_int \<lfloor>log 2 (p-1)\<rfloor>+1 \<le> log 2 (p-1) + 1"
-    using floor_eq_iff by (intro add_mono, auto) 
+    using floor_eq_iff by (intro add_mono, auto)
   also have "... \<le> log 2 p + 1"
     using assms by (intro add_mono, auto)
   finally have b: "\<lfloor>log 2 (p-1)\<rfloor>+1 \<le> log 2 p + 1"
     by simp
 
   have "bit_count (P\<^sub>e p n x) = (\<Sum> k \<leftarrow> [0..<n]. bit_count (Nb\<^sub>e p (coeff x k)))"
-    using assms restrict_extensional 
+    using assms restrict_extensional
     by (auto intro!:arg_cong[where f="sum_list"] simp add:P\<^sub>e_def fun_bit_count lessThan_atLeast0)
   also have "... = (\<Sum> k \<leftarrow> [0..<n]. ereal (floorlog 2 (p-1)))"
-    using coeff_in_carrier[OF a] mod_ring_carr 
+    using coeff_in_carrier[OF a] mod_ring_carr
     by (subst bounded_nat_bit_count_2, auto)
   also have "... = n * ereal (floorlog 2 (p-1))"
     by (simp add: sum_list_triv)
-  also have "... = n * real_of_int (\<lfloor>log 2 (p-1)\<rfloor>+1)" 
+  also have "... = n * real_of_int (\<lfloor>log 2 (p-1)\<rfloor>+1)"
     using assms(1) by (simp add:floorlog_def)
-  also have "... \<le> ereal (real n * (log 2 p + 1))" 
+  also have "... \<le> ereal (real n * (log 2 p + 1))"
     by (subst ereal_less_eq, intro mult_left_mono b, auto)
   finally show ?thesis by simp
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Frequency_Moments/Frequency_Moments_Preliminary_Results.thy b/thys/Frequency_Moments/Frequency_Moments_Preliminary_Results.thy
--- a/thys/Frequency_Moments/Frequency_Moments_Preliminary_Results.thy
+++ b/thys/Frequency_Moments/Frequency_Moments_Preliminary_Results.thy
@@ -1,491 +1,464 @@
 section \<open>Preliminary Results\<close>
 
 theory Frequency_Moments_Preliminary_Results
-  imports 
-    "HOL.Transcendental" 
+  imports
+    "HOL.Transcendental"
     "HOL-Computational_Algebra.Primes"
     "HOL-Library.Extended_Real"
     "HOL-Library.Multiset"
     "HOL-Library.Sublist"
     Prefix_Free_Code_Combinators.Prefix_Free_Code_Combinators
     Bertrands_Postulate.Bertrand
+    Expander_Graphs.Expander_Graphs_Multiset_Extras
 begin
 
 text \<open>This section contains various preliminary results.\<close>
 
 lemma card_ordered_pairs:
-  fixes M :: "('a ::linorder) set" 
+  fixes M :: "('a ::linorder) set"
   assumes "finite M"
   shows "2 * card {(x,y) \<in> M \<times> M. x < y} = card M * (card M - 1)"
 proof -
   have a: "finite (M \<times> M)" using assms by simp
 
   have inj_swap: "inj (\<lambda>x. (snd x, fst x))"
     by (rule inj_onI, simp add: prod_eq_iff)
 
   have "2 * card {(x,y) \<in> M \<times> M. x < y} =
     card {(x,y) \<in> M \<times> M. x < y} + card ((\<lambda>x. (snd x, fst x))`{(x,y) \<in> M \<times> M. x < y})"
     by (simp add: card_image[OF inj_on_subset[OF inj_swap]])
   also have "... = card {(x,y) \<in> M \<times> M. x < y} + card {(x,y) \<in> M \<times> M. y < x}"
     by (auto intro: arg_cong[where f="card"] simp add:set_eq_iff image_iff)
   also have "... = card ({(x,y) \<in> M \<times> M. x < y} \<union> {(x,y) \<in> M \<times> M. y < x})"
     by (intro card_Un_disjoint[symmetric] a finite_subset[where B="M \<times> M"] subsetI) auto
   also have "... = card ((M \<times> M) - {(x,y) \<in> M \<times> M. x = y})"
-    by (auto intro: arg_cong[where f="card"] simp add:set_eq_iff) 
+    by (auto intro: arg_cong[where f="card"] simp add:set_eq_iff)
   also have "... = card (M \<times> M) - card {(x,y) \<in> M \<times> M. x = y}"
     by (intro card_Diff_subset a finite_subset[where B="M \<times> M"] subsetI) auto
   also have "... = card M ^ 2 - card ((\<lambda>x. (x,x)) ` M)"
     using assms
     by (intro arg_cong2[where f="(-)"] arg_cong[where f="card"])
       (auto simp:power2_eq_square set_eq_iff image_iff)
   also have "... = card M ^ 2 - card M"
     by (intro arg_cong2[where f="(-)"] card_image inj_onI, auto)
   also have "... = card M * (card M - 1)"
     by (cases "card M \<ge> 0", auto simp:power2_eq_square algebra_simps)
   finally show ?thesis by simp
 qed
 
 lemma ereal_mono: "x \<le> y \<Longrightarrow> ereal x \<le> ereal y"
   by simp
 
 lemma log_mono: "a > 1 \<Longrightarrow> x \<le> y \<Longrightarrow> 0 < x \<Longrightarrow> log a x \<le> log a y"
   by (subst log_le_cancel_iff, auto)
 
 lemma abs_ge_iff: "((x::real) \<le> abs y) = (x \<le> y \<or> x \<le> -y)"
   by linarith
 
 lemma count_list_gr_1:
   "(x \<in> set xs) = (count_list xs x \<ge> 1)"
   by (induction xs, simp, simp)
 
 lemma count_list_append: "count_list (xs@ys) v = count_list xs v + count_list ys v"
   by (induction xs, simp, simp)
 
 lemma count_list_lt_suffix:
   assumes "suffix a b"
   assumes "x \<in> {b ! i| i. i <  length b - length a}"
   shows  "count_list a x < count_list b x"
 proof -
-  have "length a \<le> length b" using assms(1) 
+  have "length a \<le> length b" using assms(1)
     by (simp add: suffix_length_le)
   hence "x \<in> set (nths b {i. i < length b - length a})"
-    using assms diff_commute by (auto simp add:set_nths) 
+    using assms diff_commute by (auto simp add:set_nths)
   hence a:"x \<in> set (take (length b - length a) b)"
     by (subst (asm) lessThan_def[symmetric], simp)
   have "b = (take (length b - length a) b)@drop (length b - length a) b"
     by simp
   also have "... = (take (length b - length a) b)@a"
-    using assms(1) suffix_take by auto 
+    using assms(1) suffix_take by auto
   finally have b:"b = (take (length b - length a) b)@a" by simp
 
   have "count_list a x < 1 + count_list a x" by simp
   also have "... \<le> count_list (take (length b - length a) b) x + count_list a x"
     using a count_list_gr_1
-    by (intro add_mono, fast, simp)  
+    by (intro add_mono, fast, simp)
   also have "... = count_list b x"
     using b count_list_append by metis
   finally show ?thesis by simp
 qed
 
 lemma suffix_drop_drop:
   assumes "x \<ge> y"
   shows "suffix (drop x a) (drop y a)"
 proof -
   have "drop y a = take (x - y) (drop y a)@drop (x- y) (drop y a)"
     by (subst append_take_drop_id, simp)
   also have " ... = take (x-y) (drop y a)@drop x a"
     using assms by simp
   finally have "drop y a = take (x-y) (drop y a)@drop x a" by simp
-  thus ?thesis 
-    by (auto simp add:suffix_def) 
+  thus ?thesis
+    by (auto simp add:suffix_def)
 qed
 
 lemma count_list_card: "count_list xs x = card {k. k < length xs \<and> xs ! k = x}"
 proof -
   have "count_list xs x = length (filter ((=) x) xs)"
     by (induction xs, simp, simp)
   also have "... = card {k. k < length xs \<and> xs ! k = x}"
     by (subst length_filter_conv_card, metis)
   finally show ?thesis by simp
 qed
 
 lemma card_gr_1_iff:
   assumes "finite S"  "x \<in> S"  "y \<in> S"  "x \<noteq> y"
   shows "card S > 1"
   using assms card_le_Suc0_iff_eq leI by auto
 
 lemma count_list_ge_2_iff:
   assumes "y < z"
   assumes "z < length xs"
   assumes "xs ! y = xs ! z"
   shows "count_list xs (xs ! y) > 1"
 proof -
   have " 1 < card {k. k < length xs \<and> xs ! k = xs ! y}"
     using assms by (intro card_gr_1_iff[where x="y" and y="z"], auto)
 
   thus ?thesis
     by (simp add: count_list_card)
 qed
 
 text \<open>Results about multisets and sorting\<close>
 
-text \<open>This is a induction scheme over the distinct elements of a multisets: 
-We can represent each multiset as a sum like: 
-@{text "replicate_mset n\<^sub>1 x\<^sub>1 + replicate_mset n\<^sub>2 x\<^sub>2 + ... + replicate_mset n\<^sub>k x\<^sub>k"} where the 
-@{term "x\<^sub>i"} are distinct.\<close>
+lemmas disj_induct_mset = disj_induct_mset
 
-lemma disj_induct_mset:
-  assumes "P {#}"
-  assumes "\<And>n M x. P M \<Longrightarrow> \<not>(x \<in># M) \<Longrightarrow> n > 0 \<Longrightarrow> P (M + replicate_mset n x)"
-  shows "P M"
-proof (induction "size M" arbitrary: M rule:nat_less_induct)
-  case 1
-  show ?case
-  proof (cases "M = {#}")
-    case True
-    then show ?thesis using assms by simp
-  next
-    case False
-    then obtain x where x_def: "x \<in># M" using multiset_nonemptyE by auto
-    define M1 where "M1 = M - replicate_mset (count M x) x"
-    then have M_def: "M = M1 + replicate_mset (count M x) x"
-      by (metis count_le_replicate_mset_subset_eq dual_order.refl subset_mset.diff_add)
-    have "size M1 < size M"
-      by (metis M_def x_def count_greater_zero_iff less_add_same_cancel1 size_replicate_mset size_union)
-    hence "P M1" using 1 by blast
-    then show "P M" 
-      apply (subst M_def, rule assms(2), simp)
-      by (simp add:M1_def x_def count_eq_zero_iff[symmetric])+
-  qed
-qed
-
-lemma prod_mset_conv: 
+lemma prod_mset_conv:
   fixes f :: "'a \<Rightarrow> 'b::{comm_monoid_mult}"
   shows "prod_mset (image_mset f A) = prod (\<lambda>x. f x^(count A x)) (set_mset A)"
 proof (induction A rule: disj_induct_mset)
   case 1
   then show ?case by simp
 next
   case (2 n M x)
   moreover have "count M x = 0" using 2 by (simp add: count_eq_zero_iff)
   moreover have "\<And>y. y \<in> set_mset M \<Longrightarrow> y \<noteq> x" using 2 by blast
-  ultimately show ?case by (simp add:algebra_simps) 
+  ultimately show ?case by (simp add:algebra_simps)
 qed
 
 text \<open>There is a version @{thm [source] sum_list_map_eq_sum_count} but it doesn't work
 if the function maps into the reals.\<close>
 
 lemma sum_list_eval:
   fixes f :: "'a \<Rightarrow> 'b::{ring,semiring_1}"
   shows "sum_list (map f xs) = (\<Sum>x \<in> set xs. of_nat (count_list xs x) * f x)"
 proof -
   define M where "M = mset xs"
   have "sum_mset (image_mset f M) = (\<Sum>x \<in> set_mset M. of_nat (count M x) * f x)"
   proof (induction "M" rule:disj_induct_mset)
     case 1
     then show ?case by simp
   next
     case (2 n M x)
     have a:"\<And>y. y \<in> set_mset M \<Longrightarrow> y \<noteq> x" using 2(2) by blast
     show ?case using 2 by (simp add:a  count_eq_zero_iff[symmetric])
   qed
-  moreover have "\<And>x. count_list xs x = count (mset xs) x" 
+  moreover have "\<And>x. count_list xs x = count (mset xs) x"
     by (induction xs, simp, simp)
   ultimately show ?thesis
     by (simp add:M_def sum_mset_sum_list[symmetric])
 qed
 
 lemma prod_list_eval:
   fixes f :: "'a \<Rightarrow> 'b::{ring,semiring_1,comm_monoid_mult}"
   shows "prod_list (map f xs) = (\<Prod>x \<in> set xs. (f x)^(count_list xs x))"
 proof -
   define M where "M = mset xs"
   have "prod_mset (image_mset f M) = (\<Prod>x \<in> set_mset M. f x ^ (count M x))"
   proof (induction "M" rule:disj_induct_mset)
     case 1
     then show ?case by simp
   next
     case (2 n M x)
     have a:"\<And>y. y \<in> set_mset M \<Longrightarrow> y \<noteq> x" using 2(2) by blast
-    have b:"count M x = 0" using 2 by (subst  count_eq_zero_iff) blast 
+    have b:"count M x = 0" using 2 by (subst  count_eq_zero_iff) blast
     show ?case using 2  by (simp add:a b mult.commute)
   qed
-  moreover have "\<And>x. count_list xs x = count (mset xs) x" 
+  moreover have "\<And>x. count_list xs x = count (mset xs) x"
     by (induction xs, simp, simp)
   ultimately show ?thesis
     by (simp add:M_def prod_mset_prod_list[symmetric])
 qed
 
 lemma sorted_sorted_list_of_multiset: "sorted (sorted_list_of_multiset M)"
-  by (induction M, auto simp:sorted_insort) 
+  by (induction M, auto simp:sorted_insort)
 
 lemma count_mset: "count (mset xs) a = count_list xs a"
   by (induction xs, auto)
 
 lemma swap_filter_image: "filter_mset g (image_mset f A) = image_mset f (filter_mset (g \<circ> f) A)"
   by (induction A, auto)
 
 lemma list_eq_iff:
   assumes "mset xs = mset ys"
   assumes "sorted xs"
   assumes "sorted ys"
-  shows "xs = ys" 
+  shows "xs = ys"
   using assms properties_for_sort by blast
 
 lemma sorted_list_of_multiset_image_commute:
   assumes "mono f"
   shows "sorted_list_of_multiset (image_mset f M) = map f (sorted_list_of_multiset M)"
 proof -
-  have "sorted (sorted_list_of_multiset (image_mset f M))" 
+  have "sorted (sorted_list_of_multiset (image_mset f M))"
     by (simp add:sorted_sorted_list_of_multiset)
   moreover have " sorted_wrt (\<lambda>x y. f x \<le> f y) (sorted_list_of_multiset M)"
-    by (rule sorted_wrt_mono_rel[where P="\<lambda>x y. x \<le> y"]) 
+    by (rule sorted_wrt_mono_rel[where P="\<lambda>x y. x \<le> y"])
       (auto intro: monoD[OF assms] sorted_sorted_list_of_multiset)
   hence "sorted (map f (sorted_list_of_multiset M))"
     by (subst sorted_wrt_map)
   ultimately show ?thesis
     by (intro list_eq_iff, auto)
 qed
 
 text \<open>Results about rounding and floating point numbers\<close>
 
 lemma round_down_ge:
   "x \<le> round_down prec x + 2 powr (-prec)"
   using round_down_correct by (simp, meson diff_diff_eq diff_eq_diff_less_eq)
 
 lemma truncate_down_ge:
   "x \<le> truncate_down prec x + abs x * 2 powr (-prec)"
 proof (cases "abs x > 0")
   case True
   have "x \<le> round_down (int prec - \<lfloor>log 2 \<bar>x\<bar>\<rfloor>) x + 2 powr (-real_of_int(int prec - \<lfloor>log 2 \<bar>x\<bar>\<rfloor>))"
     by (rule round_down_ge)
   also have "... \<le> truncate_down prec x + 2 powr ( \<lfloor>log 2 \<bar>x\<bar>\<rfloor>) * 2 powr (-real prec)"
     by (rule add_mono, simp_all add:powr_add[symmetric] truncate_down_def)
   also have "... \<le> truncate_down prec x + \<bar>x\<bar> * 2 powr (-real prec)"
     using True
     by (intro add_mono mult_right_mono, simp_all add:le_log_iff[symmetric])
   finally show ?thesis by simp
 next
   case False
   then show ?thesis by simp
 qed
 
 lemma truncate_down_pos:
   assumes "x \<ge> 0"
   shows "x * (1 - 2 powr (-prec)) \<le> truncate_down prec x"
   by (simp add:right_diff_distrib diff_le_eq)
    (metis truncate_down_ge assms  abs_of_nonneg)
 
 lemma truncate_down_eq:
   assumes "truncate_down r x = truncate_down r y"
   shows "abs (x-y) \<le> max (abs x) (abs y) * 2 powr (-real r)"
-proof - 
+proof -
   have "x - y \<le> truncate_down r x + abs x * 2 powr (-real r) - y"
     by (rule diff_right_mono, rule truncate_down_ge)
   also have "... \<le> y + abs x * 2 powr (-real r) - y"
     using truncate_down_le
     by (intro diff_right_mono add_mono, subst assms(1), simp_all)
   also have "... \<le> abs x * 2 powr (-real r)" by simp
   also have "... \<le> max (abs x) (abs y) * 2 powr (-real r)" by simp
   finally have a:"x - y \<le> max (abs x) (abs y) * 2 powr (-real r)" by simp
 
   have "y - x \<le> truncate_down r y + abs y * 2 powr (-real r) - x"
     by (rule diff_right_mono, rule truncate_down_ge)
   also have "... \<le> x + abs y * 2 powr (-real r) - x"
     using truncate_down_le
     by (intro diff_right_mono add_mono, subst assms(1)[symmetric], auto)
   also have "... \<le> abs y * 2 powr (-real r)" by simp
   also have "... \<le> max (abs x) (abs y) * 2 powr (-real r)" by simp
   finally have b:"y - x \<le> max (abs x) (abs y) * 2 powr (-real r)" by simp
 
   show ?thesis
     using abs_le_iff a b by linarith
 qed
 
-definition rat_of_float :: "float \<Rightarrow> rat" where 
-  "rat_of_float f = of_int (mantissa f) * 
-    (if exponent f \<ge> 0 then 2 ^ (nat (exponent f)) else 1 / 2 ^ (nat (-exponent f)))" 
+definition rat_of_float :: "float \<Rightarrow> rat" where
+  "rat_of_float f = of_int (mantissa f) *
+    (if exponent f \<ge> 0 then 2 ^ (nat (exponent f)) else 1 / 2 ^ (nat (-exponent f)))"
 
 lemma real_of_rat_of_float: "real_of_rat (rat_of_float x) = real_of_float x"
 proof -
   have "real_of_rat (rat_of_float x) = mantissa x * (2 powr (exponent x))"
     by (simp add:rat_of_float_def of_rat_mult of_rat_divide of_rat_power powr_realpow[symmetric] powr_minus_divide)
   also have "... = real_of_float x"
     using mantissa_exponent by simp
-  finally show ?thesis by simp 
+  finally show ?thesis by simp
 qed
 
 lemma log_est: "log 2 (real n + 1) \<le> n"
 proof -
   have "1 + real n = real (n + 1)"
     by simp
   also have "... \<le> real (2 ^ n)"
     by (intro of_nat_mono suc_n_le_2_pow_n)
   also have "... = 2 powr (real n)"
     by (simp add:powr_realpow)
   finally have "1 + real n \<le> 2 powr (real n)"
     by simp
   thus ?thesis
     by (simp add: Transcendental.log_le_iff)
 qed
 
 lemma truncate_mantissa_bound:
   "abs (\<lfloor>x * 2 powr (real r - real_of_int \<lfloor>log 2 \<bar>x\<bar>\<rfloor>)\<rfloor>) \<le> 2 ^ (r+1)" (is "?lhs \<le> _")
 proof -
   define q where "q = \<lfloor>x * 2 powr (real r - real_of_int (\<lfloor>log 2 \<bar>x\<bar>\<rfloor>))\<rfloor>"
 
   have "abs q \<le> 2 ^ (r + 1)" if a:"x > 0"
   proof -
     have "abs q = q"
       using a by (intro abs_of_nonneg, simp add:q_def)
     also have "... \<le> x * 2 powr (real r - real_of_int \<lfloor>log 2 \<bar>x\<bar>\<rfloor>)"
       unfolding q_def using of_int_floor_le by blast
     also have "... = x * 2 powr real_of_int (int r - \<lfloor>log 2 \<bar>x\<bar>\<rfloor>)"
       by auto
     also have "... = 2 powr (log 2 x + real_of_int (int r - \<lfloor>log 2 \<bar>x\<bar>\<rfloor>))"
       using a by (simp add:powr_add)
     also have "... \<le> 2 powr (real r + 1)"
-      using a by (intro powr_mono, linarith+) 
+      using a by (intro powr_mono, linarith+)
     also have "... = 2 ^ (r+1)"
       by (subst powr_realpow[symmetric], simp_all add:add.commute)
-    finally show "abs q \<le> 2 ^ (r+1)" 
+    finally show "abs q \<le> 2 ^ (r+1)"
       by (metis of_int_le_iff of_int_numeral of_int_power)
   qed
-    
+
   moreover have "abs q \<le> (2 ^ (r + 1))" if a: "x < 0"
   proof -
     have "-(2 ^ (r+1) + 1) = -(2 powr (real r + 1)+1)"
       by (subst powr_realpow[symmetric], simp_all add: add.commute)
     also have  "... < -(2 powr (log 2 (- x) + (r - \<lfloor>log 2 \<bar>x\<bar>\<rfloor>)) + 1)"
       using a by (simp, linarith)
     also have "... = x * 2 powr (r - \<lfloor>log 2 \<bar>x\<bar>\<rfloor>) - 1"
       using a by (simp add:powr_add)
     also have "... \<le> q"
       by (simp add:q_def)
     also have "... = - abs q"
       using a
       by (subst abs_of_neg, simp_all add: mult_pos_neg2 q_def)
     finally have "-(2 ^ (r+1)+1) < - abs q" using of_int_less_iff by fastforce
     hence "-(2 ^ (r+1)) \<le> - abs q" by linarith
     thus "abs q \<le> 2^(r+1)" by linarith
   qed
 
   moreover have "x = 0 \<Longrightarrow> abs q \<le> 2^(r+1)"
     by (simp add:q_def)
   ultimately have "abs q \<le> 2^(r+1)"
     by fastforce
   thus ?thesis using q_def by blast
 qed
 
 lemma truncate_float_bit_count:
-  "bit_count (F\<^sub>e (float_of (truncate_down r x))) \<le> 10 + 4 * real r + 2*log 2 (2 + \<bar>log 2 \<bar>x\<bar>\<bar>)" 
+  "bit_count (F\<^sub>e (float_of (truncate_down r x))) \<le> 10 + 4 * real r + 2*log 2 (2 + \<bar>log 2 \<bar>x\<bar>\<bar>)"
   (is "?lhs \<le> ?rhs")
 proof -
   define m where "m = \<lfloor>x * 2 powr (real r - real_of_int \<lfloor>log 2 \<bar>x\<bar>\<rfloor>)\<rfloor>"
   define e where "e = \<lfloor>log 2 \<bar>x\<bar>\<rfloor> - int r"
 
   have a: "(real_of_int \<lfloor>log 2 \<bar>x\<bar>\<rfloor> - real r) = e"
     by (simp add:e_def)
   have "abs m + 2 \<le> 2 ^ (r + 1) + 2^1"
     using truncate_mantissa_bound
     by (intro add_mono, simp_all add:m_def)
   also have "... \<le> 2 ^ (r+2)"
     by simp
   finally have b:"abs m + 2 \<le> 2 ^ (r+2)" by simp
-  hence "real_of_int (\<bar>m\<bar> + 2) \<le> real_of_int (4 * 2 ^ r)" 
+  hence "real_of_int (\<bar>m\<bar> + 2) \<le> real_of_int (4 * 2 ^ r)"
     by (subst of_int_le_iff, simp)
-  hence "\<bar>real_of_int m\<bar> + 2 \<le> 4 * 2 ^ r" 
+  hence "\<bar>real_of_int m\<bar> + 2 \<le> 4 * 2 ^ r"
     by simp
   hence c:"log 2 (real_of_int (\<bar>m\<bar> + 2)) \<le> r+2"
     by (simp add: Transcendental.log_le_iff powr_add powr_realpow)
 
   have "real_of_int (abs e + 1) \<le> real_of_int \<bar>\<lfloor>log 2 \<bar>x\<bar>\<rfloor>\<bar> +  real_of_int r + 1"
     by (simp add:e_def)
   also have "... \<le> 1 + abs (log 2 (abs x)) + real_of_int r + 1"
     by (simp add:abs_le_iff, linarith)
   also have "... \<le> (real_of_int r+ 1) * (2 + abs (log 2 (abs x)))"
     by (simp add:distrib_left distrib_right)
   finally have d:"real_of_int (abs e + 1) \<le> (real_of_int r+ 1) * (2 + abs (log 2 (abs x)))" by simp
 
   have "log 2 (real_of_int (abs e + 1)) \<le> log 2 (real_of_int r + 1) + log 2 (2 + abs (log 2 (abs x)))"
     using d by (simp add: log_mult[symmetric])
   also have "... \<le> r + log 2 (2 + abs (log 2 (abs x)))"
     using log_est by (intro add_mono, simp_all add:add.commute)
   finally have e: "log 2 (real_of_int (abs e + 1)) \<le> r + log 2 (2 + abs (log 2 (abs x)))" by simp
 
   have "?lhs =  bit_count (F\<^sub>e (float_of (real_of_int m * 2 powr real_of_int e)))"
     by (simp add:truncate_down_def round_down_def m_def[symmetric] a)
   also have "... \<le> ereal (6 + (2 * log 2 (real_of_int (\<bar>m\<bar> + 2)) + 2 * log 2 (real_of_int (\<bar>e\<bar> + 1))))"
     using float_bit_count_2 by simp
   also have "... \<le> ereal (6 + (2 * real (r+2) + 2 * (r + log 2 (2 + abs (log 2 (abs x))))))"
     using c e
-    by (subst ereal_less_eq, intro add_mono mult_left_mono, linarith+) 
+    by (subst ereal_less_eq, intro add_mono mult_left_mono, linarith+)
   also have "... = ?rhs" by simp
   finally show ?thesis by simp
 qed
 
-definition prime_above :: "nat \<Rightarrow> nat" 
+definition prime_above :: "nat \<Rightarrow> nat"
   where "prime_above n = (SOME x. x \<in> {n..(2*n+2)} \<and> prime x)"
 
 text \<open>The term @{term"prime_above n"} returns a prime between @{term "n::nat"} and @{term "2*(n::nat)+2"}.
 Because of Bertrand's postulate there always is such a value. In a refinement of the algorithms, it may make sense to
 replace this with an algorithm, that finds such a prime exactly or approximately.
 
 The definition is intentionally inexact, to allow refinement with various algorithms, without modifying the
 high-level mathematical correctness proof.\<close>
 
 lemma ex_subset:
   assumes "\<exists>x \<in> A. P x"
   assumes "A \<subseteq> B"
   shows "\<exists>x \<in> B. P x"
   using assms by auto
 
 lemma
   shows prime_above_prime: "prime (prime_above n)"
   and prime_above_range: "prime_above n \<in> {n..(2*n+2)}"
 proof -
   define r where "r = (\<lambda>x. x \<in> {n..(2*n+2)} \<and> prime x)"
   have "\<exists>x. r x"
   proof (cases "n>2")
     case True
     hence "n-1 > 1" by simp
     hence "\<exists>x \<in> {(n-1)<..<(2*(n-1))}. prime x"
       using bertrand by simp
     moreover have "{n - 1<..<2 * (n - 1)} \<subseteq> {n..2 * n + 2}"
-      by (intro subsetI, auto) 
+      by (intro subsetI, auto)
     ultimately have "\<exists>x \<in> {n..(2*n+2)}. prime x"
       by (rule ex_subset)
     then show ?thesis by (simp add:r_def Bex_def)
   next
     case False
-    hence "2 \<in> {n..(2*n+2)}" 
+    hence "2 \<in> {n..(2*n+2)}"
       by simp
-    moreover have "prime (2::nat)" 
+    moreover have "prime (2::nat)"
       using two_is_prime_nat by blast
     ultimately have "r 2"
       using r_def by simp
     then show ?thesis by (rule exI)
   qed
   moreover have "prime_above n = (SOME x. r x)"
     by (simp add:prime_above_def r_def)
   ultimately have a:"r (prime_above n)"
     using someI_ex by metis
   show "prime (prime_above n)"
     using a unfolding r_def by blast
   show "prime_above n \<in> {n..(2*n+2)}"
     using a unfolding r_def by blast
 qed
 
 lemma prime_above_min:  "prime_above n \<ge> 2"
-  using prime_above_prime 
+  using prime_above_prime
   by (simp add: prime_ge_2_nat)
 
 lemma prime_above_lower_bound: "prime_above n \<ge> n"
   using prime_above_range
   by simp
 
 lemma prime_above_upper_bound: "prime_above n \<le> 2*n+2"
   using prime_above_range
   by simp
 
 end
diff --git a/thys/Frequency_Moments/K_Smallest.thy b/thys/Frequency_Moments/K_Smallest.thy
--- a/thys/Frequency_Moments/K_Smallest.thy
+++ b/thys/Frequency_Moments/K_Smallest.thy
@@ -1,385 +1,385 @@
 section \<open>Ranks, $k$ smallest element and elements\<close>
 
 theory K_Smallest
-  imports 
+  imports
     Frequency_Moments_Preliminary_Results
     Interpolation_Polynomials_HOL_Algebra.Interpolation_Polynomial_Cardinalities
 begin
 
 text \<open>This section contains definitions and results for the selection of the $k$ smallest elements, the $k$-th smallest element, rank of an element in an ordered set.\<close>
 
-definition rank_of :: "'a :: linorder \<Rightarrow> 'a set \<Rightarrow> nat" where "rank_of x S = card {y \<in> S. y < x}"  
+definition rank_of :: "'a :: linorder \<Rightarrow> 'a set \<Rightarrow> nat" where "rank_of x S = card {y \<in> S. y < x}"
 text \<open>The function @{term "rank_of"} returns the rank of an element within a set.\<close>
 
 lemma rank_mono:
   assumes "finite S"
   shows "x \<le> y \<Longrightarrow> rank_of x S \<le> rank_of y S"
   unfolding rank_of_def using assms by (intro card_mono, auto)
 
 lemma rank_mono_2:
   assumes "finite S"
   shows "S' \<subseteq> S \<Longrightarrow> rank_of x S' \<le> rank_of x S"
   unfolding rank_of_def using assms by (intro card_mono, auto)
 
 lemma rank_mono_commute:
   assumes "finite S"
   assumes "S \<subseteq> T"
   assumes "strict_mono_on T f"
   assumes "x \<in> T"
   shows "rank_of x S = rank_of (f x) (f ` S)"
 proof -
   have a: "inj_on f T"
     by (metis assms(3) strict_mono_on_imp_inj_on)
 
   have "rank_of (f x) (f ` S) = card (f ` {y \<in> S. f y < f x})"
     unfolding rank_of_def by (intro arg_cong[where f="card"], auto)
   also have "... = card (f ` {y \<in> S. y < x})"
     using assms by (intro arg_cong[where f="card"] arg_cong[where f="(`) f"])
      (meson in_mono linorder_not_le strict_mono_onD strict_mono_on_leD set_eq_iff)
   also have "... = card {y \<in> S. y < x}"
     using assms by (intro card_image  inj_on_subset[OF a], blast)
   also have "... = rank_of x S"
     by (simp add:rank_of_def)
   finally show ?thesis
     by simp
 qed
 
 definition least where "least k S = {y \<in> S. rank_of y S < k}"
 text \<open>The function @{term "least"} returns the k smallest elements of a finite set.\<close>
 
-lemma rank_strict_mono: 
+lemma rank_strict_mono:
   assumes "finite S"
   shows "strict_mono_on S (\<lambda>x. rank_of x S)"
 proof -
   have "\<And>x y. x \<in> S \<Longrightarrow> y \<in> S \<Longrightarrow> x < y \<Longrightarrow> rank_of x S < rank_of y S"
-    unfolding rank_of_def using assms 
+    unfolding rank_of_def using assms
     by (intro psubset_card_mono, auto)
 
   thus ?thesis
     by (simp add:rank_of_def strict_mono_on_def)
 qed
 
 lemma rank_of_image:
   assumes "finite S"
   shows "(\<lambda>x. rank_of x S) ` S = {0..<card S}"
 proof (rule card_seteq)
   show "finite {0..<card S}" by simp
 
   have "\<And>x. x \<in> S \<Longrightarrow> card {y \<in> S. y < x} < card S"
     by (rule psubset_card_mono, metis assms, blast)
   thus "(\<lambda>x. rank_of x S) ` S \<subseteq> {0..<card S}"
     by (intro image_subsetI, simp add:rank_of_def)
 
   have "inj_on (\<lambda>x. rank_of x S) S"
-    by (metis strict_mono_on_imp_inj_on rank_strict_mono assms) 
+    by (metis strict_mono_on_imp_inj_on rank_strict_mono assms)
   thus "card {0..<card S} \<le> card ((\<lambda>x. rank_of x S) ` S)"
     by (simp add:card_image)
 qed
 
 lemma card_least:
   assumes "finite S"
   shows "card (least k S) = min k (card S)"
 proof (cases "card S < k")
   case True
-  have "\<And>t. rank_of t S \<le> card S" 
-    unfolding rank_of_def using assms 
+  have "\<And>t. rank_of t S \<le> card S"
+    unfolding rank_of_def using assms
     by (intro card_mono, auto)
-  hence "\<And>t. rank_of t S < k" 
+  hence "\<And>t. rank_of t S < k"
     by (metis True not_less_iff_gr_or_eq order_less_le_trans)
   hence "least k S = S"
     by (simp add:least_def)
   then show ?thesis using True by simp
 next
   case False
   hence a:"card S \<ge> k" using leI by blast
   hence "card ((\<lambda>x. rank_of x S) -` {0..<k} \<inter> S) = card {0..<k}"
     using assms
     by (intro card_vimage_inj_on strict_mono_on_imp_inj_on rank_strict_mono)
      (simp_all add: rank_of_image)
   hence "card (least k S) = k"
     by (simp add: Collect_conj_eq Int_commute least_def vimage_def)
   then show ?thesis using a by linarith
 qed
 
 lemma least_subset: "least k S \<subseteq> S"
   by (simp add:least_def)
 
 lemma least_mono_commute:
   assumes "finite S"
   assumes "strict_mono_on S f"
   shows "f ` least k S = least k (f ` S)"
 proof -
-  have a:"inj_on f S" 
+  have a:"inj_on f S"
     using strict_mono_on_imp_inj_on[OF assms(2)] by simp
 
   have "card (least k (f ` S)) = min k (card (f ` S))"
     by (subst card_least, auto simp add:assms)
   also have "... = min k (card S)"
     by (subst card_image, metis a, auto)
   also have "... = card (least k S)"
     by (subst card_least, auto simp add:assms)
   also have "... = card (f ` least k S)"
     by (subst card_image[OF inj_on_subset[OF a]], simp_all add:least_def)
   finally have b: "card (least k (f ` S)) \<le> card (f ` least k S)" by simp
 
   have c: "f ` least k S \<subseteq>least k (f ` S)"
-    using assms by (intro image_subsetI) 
+    using assms by (intro image_subsetI)
       (simp add:least_def rank_mono_commute[symmetric, where T="S"])
 
   show ?thesis
     using b c assms by (intro card_seteq, simp_all add:least_def)
 qed
 
 lemma least_eq_iff:
   assumes "finite B"
   assumes "A \<subseteq> B"
   assumes "\<And>x. x \<in> B \<Longrightarrow> rank_of x B < k \<Longrightarrow> x \<in> A"
   shows "least k A = least k B"
 proof -
   have "least k B \<subseteq> least k A"
     using assms rank_mono_2[OF assms(1,2)] order_le_less_trans
-    by (simp add:least_def, blast) 
+    by (simp add:least_def, blast)
   moreover have "card (least k B) \<ge> card (least k A)"
     using assms finite_subset[OF assms(2,1)] card_mono[OF assms(1,2)]
     by (simp add: card_least min_le_iff_disj)
-  moreover have "finite (least k A)" 
+  moreover have "finite (least k A)"
     using finite_subset least_subset assms(1,2) by metis
   ultimately show ?thesis
     by (intro card_seteq[symmetric], simp_all)
 qed
 
-lemma least_insert: 
+lemma least_insert:
   assumes "finite S"
   shows "least k (insert x (least k S)) = least k (insert x S)" (is "?lhs = ?rhs")
 proof (rule least_eq_iff)
   show "finite (insert x S)"
     using assms(1) by simp
   show "insert x (least k S) \<subseteq> insert x S"
     using least_subset by blast
   show "y \<in> insert x (least k S)" if a: "y \<in> insert x S" and b: "rank_of y (insert x S) < k" for y
   proof -
     have "rank_of y S \<le> rank_of y (insert x S)"
       using assms by (intro rank_mono_2, auto)
     also have "... < k" using b by simp
     finally have "rank_of y S < k" by simp
-    hence "y = x \<or> (y \<in> S \<and> rank_of y S < k)" 
+    hence "y = x \<or> (y \<in> S \<and> rank_of y S < k)"
       using a by simp
     thus ?thesis by (simp add:least_def)
   qed
 qed
 
 
 definition count_le where "count_le x M = size {#y \<in># M. y \<le> x#}"
 definition count_less where "count_less x M = size {#y \<in># M. y < x#}"
 
 definition nth_mset :: "nat \<Rightarrow> ('a :: linorder) multiset \<Rightarrow> 'a" where
   "nth_mset k M = sorted_list_of_multiset M ! k"
 
 lemma nth_mset_bound_left:
   assumes "k < size M"
   assumes "count_less x M \<le> k"
   shows "x \<le> nth_mset k M"
 proof (rule ccontr)
   define xs where "xs = sorted_list_of_multiset M"
   have s_xs: "sorted xs" by (simp add:xs_def sorted_sorted_list_of_multiset)
   have l_xs: "k < length xs"
-    using  assms(1) by (simp add:xs_def size_mset[symmetric]) 
+    using  assms(1) by (simp add:xs_def size_mset[symmetric])
   have M_xs: "M = mset xs" by (simp add:xs_def)
   hence a:"\<And>i. i \<le> k \<Longrightarrow> xs ! i \<le> xs ! k"
     using s_xs l_xs sorted_iff_nth_mono by blast
 
   assume "\<not>(x \<le> nth_mset k M)"
   hence "x > nth_mset k M" by simp
   hence b:"x > xs ! k" by (simp add:nth_mset_def xs_def[symmetric])
 
   have "k < card {0..k}" by simp
   also have "... \<le> card {i. i < length xs \<and> xs ! i < x}"
-    using a b l_xs order_le_less_trans 
+    using a b l_xs order_le_less_trans
     by (intro card_mono subsetI) auto
   also have "... = length (filter (\<lambda>y. y < x) xs)"
     by (subst length_filter_conv_card, simp)
   also have "... = size (mset (filter (\<lambda>y. y < x) xs))"
     by (subst size_mset, simp)
   also have "... = count_less x M"
     by (simp add:count_less_def M_xs)
   also have "... \<le> k"
     using assms by simp
   finally show "False" by simp
 qed
 
 lemma nth_mset_bound_left_excl:
   assumes "k < size M"
   assumes "count_le x M \<le> k"
   shows "x < nth_mset k M"
 proof (rule ccontr)
   define xs where "xs = sorted_list_of_multiset M"
   have s_xs: "sorted xs" by (simp add:xs_def sorted_sorted_list_of_multiset)
-  have l_xs: "k < length xs" 
-    using  assms(1) by (simp add:xs_def size_mset[symmetric]) 
+  have l_xs: "k < length xs"
+    using  assms(1) by (simp add:xs_def size_mset[symmetric])
   have M_xs: "M = mset xs" by (simp add:xs_def)
   hence a:"\<And>i. i \<le> k \<Longrightarrow> xs ! i \<le> xs ! k"
     using s_xs l_xs sorted_iff_nth_mono by blast
 
   assume "\<not>(x < nth_mset k M)"
   hence "x \<ge> nth_mset k M" by simp
   hence b:"x \<ge> xs ! k" by (simp add:nth_mset_def xs_def[symmetric])
 
   have "k+1 \<le> card {0..k}" by simp
   also have "... \<le> card {i. i < length xs \<and> xs ! i \<le> xs ! k}"
     using a b l_xs order_le_less_trans
     by (intro card_mono subsetI, auto)
   also have "... \<le> card {i. i < length xs \<and> xs ! i \<le> x}"
     using b by (intro card_mono subsetI, auto)
   also have "... = length (filter (\<lambda>y. y \<le> x) xs)"
     by (subst length_filter_conv_card, simp)
   also have "... = size (mset (filter (\<lambda>y. y \<le> x) xs))"
     by (subst size_mset, simp)
   also have "... = count_le x M"
     by (simp add:count_le_def M_xs)
   also have "... \<le> k"
     using assms by simp
   finally show "False" by simp
 qed
 
 lemma nth_mset_bound_right:
   assumes "k < size M"
   assumes "count_le x M > k"
   shows "nth_mset k M \<le> x"
 proof (rule ccontr)
   define xs where "xs = sorted_list_of_multiset M"
   have s_xs: "sorted xs" by (simp add:xs_def sorted_sorted_list_of_multiset)
-  have l_xs: "k < length xs" 
-    using  assms(1) by (simp add:xs_def size_mset[symmetric]) 
+  have l_xs: "k < length xs"
+    using  assms(1) by (simp add:xs_def size_mset[symmetric])
   have M_xs: "M = mset xs" by (simp add:xs_def)
 
   assume "\<not>(nth_mset k M \<le> x)"
   hence "x < nth_mset k M" by simp
-  hence "x < xs ! k" 
+  hence "x < xs ! k"
     by (simp add:nth_mset_def xs_def[symmetric])
   hence a:"\<And>i. i < length xs \<and> xs ! i \<le> x \<Longrightarrow> i < k"
     using s_xs l_xs sorted_iff_nth_mono leI by fastforce
   have "count_le x M = size (mset (filter (\<lambda>y. y \<le> x) xs))"
     by (simp add:count_le_def M_xs)
   also have "... = length (filter (\<lambda>y. y \<le> x) xs)"
     by (subst size_mset, simp)
   also have "... = card {i. i < length xs \<and> xs ! i \<le> x}"
     by (subst length_filter_conv_card, simp)
   also have "... \<le> card {i. i < k}"
     using a by (intro card_mono subsetI, auto)
   also have "... = k" by simp
   finally have "count_le x M \<le> k" by simp
   thus "False" using assms by simp
 qed
 
 lemma nth_mset_commute_mono:
   assumes "mono f"
   assumes "k < size M"
   shows "f (nth_mset k M) = nth_mset k (image_mset f M)"
 proof -
   have a:"k < length (sorted_list_of_multiset M)"
     by (metis assms(2) mset_sorted_list_of_multiset size_mset)
   show ?thesis
     using a by (simp add:nth_mset_def sorted_list_of_multiset_image_commute[OF assms(1)])
-qed 
+qed
 
-lemma nth_mset_max: 
+lemma nth_mset_max:
   assumes "size A > k"
   assumes "\<And>x. x \<le> nth_mset k A \<Longrightarrow> count A x \<le> 1"
   shows "nth_mset k A = Max (least (k+1) (set_mset A))" and "card (least (k+1) (set_mset A)) = k+1"
 proof -
   define xs where "xs = sorted_list_of_multiset A"
   have k_bound: "k < length xs" unfolding xs_def
-    by (metis size_mset mset_sorted_list_of_multiset assms(1))  
+    by (metis size_mset mset_sorted_list_of_multiset assms(1))
 
   have A_def: "A = mset xs" by (simp add:xs_def)
   have s_xs: "sorted xs" by (simp add:xs_def sorted_sorted_list_of_multiset)
   have "\<And>x. x \<le> xs ! k \<Longrightarrow> count A x \<le> Suc 0"
     using assms(2) by (simp add:xs_def[symmetric] nth_mset_def)
-  hence no_col: "\<And>x. x \<le> xs ! k \<Longrightarrow> count_list xs x \<le> 1" 
-    by (simp add:A_def count_mset) 
+  hence no_col: "\<And>x. x \<le> xs ! k \<Longrightarrow> count_list xs x \<le> 1"
+    by (simp add:A_def count_mset)
 
   have inj_xs: "inj_on (\<lambda>k. xs ! k) {0..k}"
     by (rule inj_onI, simp) (metis (full_types) count_list_ge_2_iff k_bound no_col
         le_neq_implies_less linorder_not_le order_le_less_trans s_xs sorted_iff_nth_mono)
 
   have "\<And>y. y < length xs \<Longrightarrow> rank_of (xs ! y) (set xs) < k+1 \<Longrightarrow> y < k+1"
   proof (rule ccontr)
     fix y
     assume b:"y < length xs"
     assume "\<not>y < k +1"
     hence a:"k + 1 \<le> y" by simp
 
     have d:"Suc k < length xs" using a b by simp
 
-    have "k+1 = card ((!) xs ` {0..k})" 
+    have "k+1 = card ((!) xs ` {0..k})"
       by (subst card_image[OF inj_xs], simp)
     also have "... \<le> rank_of (xs ! (k+1)) (set xs)"
       unfolding rank_of_def using k_bound
-      by (intro card_mono image_subsetI conjI, simp_all) (metis count_list_ge_2_iff no_col not_le le_imp_less_Suc s_xs 
+      by (intro card_mono image_subsetI conjI, simp_all) (metis count_list_ge_2_iff no_col not_le le_imp_less_Suc s_xs
           sorted_iff_nth_mono d order_less_le)
     also have "... \<le> rank_of (xs ! y) (set xs)"
       unfolding rank_of_def
       by (intro card_mono subsetI, simp_all)
        (metis Suc_eq_plus1 a b s_xs order_less_le_trans sorted_iff_nth_mono)
     also assume "... < k+1"
     finally show "False" by force
   qed
 
   moreover have "rank_of (xs ! y) (set xs) < k+1" if a:"y < k + 1" for y
   proof -
     have "rank_of (xs ! y) (set xs) \<le> card ((\<lambda>k. xs ! k) ` {k. k < length xs \<and> xs ! k < xs ! y})"
       unfolding rank_of_def
       by (intro card_mono subsetI, simp)
        (metis (no_types, lifting) imageI in_set_conv_nth mem_Collect_eq)
     also have "... \<le> card {k. k < length xs \<and> xs ! k < xs ! y}"
       by (rule card_image_le, simp)
     also have "... \<le> card {k. k < y}"
       by (intro card_mono subsetI, simp_all add:not_less)
        (metis sorted_iff_nth_mono s_xs linorder_not_less)
     also have "... = y" by simp
     also have "... < k + 1" using a by simp
     finally show "rank_of (xs ! y) (set xs) < k+1" by simp
   qed
 
   ultimately have rank_conv: "\<And>y. y < length xs \<Longrightarrow> rank_of (xs ! y) (set xs) < k+1 \<longleftrightarrow> y < k+1"
     by blast
 
   have "y \<le> xs ! k"  if a:"y \<in> least (k+1) (set xs)"  for y
   proof -
     have "y \<in> set xs" using a least_subset by blast
     then obtain i where i_bound: "i < length xs" and y_def: "y = xs ! i" using in_set_conv_nth by metis
     hence "rank_of (xs ! i) (set xs) < k+1"
       using a y_def i_bound by (simp add: least_def)
     hence "i < k+1"
       using rank_conv i_bound by blast
     hence "i \<le> k" by linarith
     hence "xs ! i \<le> xs ! k"
       using s_xs i_bound k_bound sorted_nth_mono by blast
     thus "y \<le> xs ! k" using y_def by simp
   qed
 
   moreover have "xs ! k \<in> least (k+1) (set xs)"
     using k_bound rank_conv by (simp add:least_def)
 
   ultimately have "Max (least (k+1) (set xs)) = xs ! k"
     by (intro Max_eqI finite_subset[OF least_subset], auto)
 
-  hence "nth_mset k A = Max (K_Smallest.least (Suc k) (set xs))" 
+  hence "nth_mset k A = Max (K_Smallest.least (Suc k) (set xs))"
     by (simp add:nth_mset_def xs_def[symmetric])
   also have "... = Max (least (k+1) (set_mset A))"
     by (simp add:A_def)
   finally show "nth_mset k A = Max (least (k+1) (set_mset A))"  by simp
 
-  have "k + 1 = card ((\<lambda>i. xs ! i) ` {0..k})" 
-    by (subst card_image[OF inj_xs], simp) 
+  have "k + 1 = card ((\<lambda>i. xs ! i) ` {0..k})"
+    by (subst card_image[OF inj_xs], simp)
   also have "... \<le> card (least (k+1) (set xs))"
     using rank_conv k_bound
     by (intro card_mono image_subsetI finite_subset[OF least_subset], simp_all add:least_def)
   finally have "card (least (k+1) (set xs)) \<ge> k+1" by simp
   moreover have "card (least (k+1) (set xs)) \<le> k+1"
     by (subst card_least, simp, simp)
   ultimately have "card (least (k+1) (set xs)) = k+1" by simp
   thus "card (least (k+1) (set_mset A)) = k+1"  by (simp add:A_def)
 qed
 
 end
diff --git a/thys/Frequency_Moments/Landau_Ext.thy b/thys/Frequency_Moments/Landau_Ext.thy
--- a/thys/Frequency_Moments/Landau_Ext.thy
+++ b/thys/Frequency_Moments/Landau_Ext.thy
@@ -1,243 +1,243 @@
 section \<open>Landau Symbols\<close>
 
 theory Landau_Ext
-  imports 
+  imports
     "HOL-Library.Landau_Symbols"
     "HOL.Topological_Spaces"
 begin
 
 text \<open>This section contains results about Landau Symbols in addition to "HOL-Library.Landau".\<close>
 
 lemma landau_sum:
-  assumes "eventually (\<lambda>x. g1 x \<ge> (0::real)) F" 
-  assumes "eventually (\<lambda>x. g2 x \<ge> 0) F" 
+  assumes "eventually (\<lambda>x. g1 x \<ge> (0::real)) F"
+  assumes "eventually (\<lambda>x. g2 x \<ge> 0) F"
   assumes "f1 \<in> O[F](g1)"
   assumes "f2 \<in> O[F](g2)"
   shows "(\<lambda>x. f1 x + f2 x) \<in> O[F](\<lambda>x. g1 x + g2 x)"
 proof -
   obtain c1 where a1: "c1 > 0" and b1: "eventually (\<lambda>x. abs (f1 x) \<le> c1 * abs (g1 x)) F"
     using assms(3) by (simp add:bigo_def, blast)
   obtain c2 where a2: "c2 > 0" and b2: "eventually (\<lambda>x. abs (f2 x) \<le> c2 * abs (g2 x)) F"
     using assms(4) by (simp add:bigo_def, blast)
   have "eventually (\<lambda>x. abs (f1 x + f2 x) \<le> (max c1 c2) * abs (g1 x + g2 x)) F"
   proof (rule eventually_mono[OF eventually_conj[OF b1 eventually_conj[OF b2 eventually_conj[OF assms(1,2)]]]])
     fix x
     assume a: "\<bar>f1 x\<bar> \<le> c1 * \<bar>g1 x\<bar> \<and> \<bar>f2 x\<bar> \<le> c2 * \<bar>g2 x\<bar> \<and> 0 \<le> g1 x \<and> 0 \<le> g2 x"
     have "\<bar>f1 x + f2 x\<bar> \<le> \<bar>f1 x \<bar> + \<bar>f2 x\<bar>" using abs_triangle_ineq by blast
     also have "... \<le> c1 *  \<bar>g1 x\<bar> + c2 * \<bar>g2 x\<bar>" using a add_mono by blast
-    also have "... \<le> max c1 c2 * \<bar>g1 x\<bar> + max c1 c2 * \<bar>g2 x\<bar>" 
+    also have "... \<le> max c1 c2 * \<bar>g1 x\<bar> + max c1 c2 * \<bar>g2 x\<bar>"
       by (intro add_mono mult_right_mono) auto
     also have "... = max c1 c2 * (\<bar>g1 x\<bar> + \<bar>g2 x\<bar>)"
       by (simp add:algebra_simps)
     also have "... \<le> max c1 c2 * (\<bar>g1 x + g2 x\<bar>)"
       using a a1 a2 by (intro mult_left_mono) auto
     finally show "\<bar>f1 x + f2 x\<bar> \<le> max c1 c2 * \<bar>g1 x + g2 x\<bar>"
       by (simp add:algebra_simps)
   qed
   hence " 0 < max c1 c2 \<and> (\<forall>\<^sub>F x in F. \<bar>f1 x + f2 x\<bar> \<le> max c1 c2 * \<bar>g1 x + g2 x\<bar>)"
     using a1 a2 by linarith
   thus ?thesis
-    by (simp add: bigo_def, blast) 
+    by (simp add: bigo_def, blast)
 qed
 
 lemma landau_sum_1:
-  assumes "eventually (\<lambda>x. g1 x \<ge> (0::real)) F" 
-  assumes "eventually (\<lambda>x. g2 x \<ge> 0) F" 
+  assumes "eventually (\<lambda>x. g1 x \<ge> (0::real)) F"
+  assumes "eventually (\<lambda>x. g2 x \<ge> 0) F"
   assumes "f \<in> O[F](g1)"
   shows "f \<in> O[F](\<lambda>x. g1 x + g2 x)"
 proof -
   have "f = (\<lambda>x. f x + 0)" by simp
   also have "... \<in> O[F](\<lambda>x. g1 x + g2 x)"
     using assms zero_in_bigo by (intro landau_sum)
   finally show ?thesis by simp
 qed
 
 lemma landau_sum_2:
-  assumes "eventually (\<lambda>x. g1 x \<ge> (0::real)) F" 
-  assumes "eventually (\<lambda>x. g2 x \<ge> 0) F" 
+  assumes "eventually (\<lambda>x. g1 x \<ge> (0::real)) F"
+  assumes "eventually (\<lambda>x. g2 x \<ge> 0) F"
   assumes "f \<in> O[F](g2)"
   shows "f \<in> O[F](\<lambda>x. g1 x + g2 x)"
 proof -
   have "f = (\<lambda>x. 0 + f x)" by simp
   also have "... \<in> O[F](\<lambda>x. g1 x + g2 x)"
     using assms zero_in_bigo by (intro landau_sum)
   finally show ?thesis by simp
 qed
 
 lemma landau_ln_3:
-  assumes "eventually (\<lambda>x. (1::real) \<le> f x) F" 
-  assumes "f \<in> O[F](g)" 
-  shows "(\<lambda>x. ln (f x)) \<in> O[F](g)" 
+  assumes "eventually (\<lambda>x. (1::real) \<le> f x) F"
+  assumes "f \<in> O[F](g)"
+  shows "(\<lambda>x. ln (f x)) \<in> O[F](g)"
 proof -
   have "1 \<le> x \<Longrightarrow> \<bar>ln x\<bar> \<le> \<bar>x\<bar>" for x :: real
     using ln_bound by auto
   hence "(\<lambda>x. ln (f x)) \<in> O[F](f)"
     by (intro landau_o.big_mono eventually_mono[OF assms(1)]) simp
   thus ?thesis
     using assms(2) landau_o.big_trans by blast
 qed
 
 lemma landau_ln_2:
   assumes "a > (1::real)"
-  assumes "eventually (\<lambda>x. 1 \<le> f x) F" 
-  assumes "eventually (\<lambda>x. a \<le> g x) F" 
-  assumes "f \<in> O[F](g)" 
-  shows "(\<lambda>x. ln (f x)) \<in> O[F](\<lambda>x. ln (g x))" 
+  assumes "eventually (\<lambda>x. 1 \<le> f x) F"
+  assumes "eventually (\<lambda>x. a \<le> g x) F"
+  assumes "f \<in> O[F](g)"
+  shows "(\<lambda>x. ln (f x)) \<in> O[F](\<lambda>x. ln (g x))"
 proof -
   obtain c where a: "c > 0" and b: "eventually (\<lambda>x. abs (f x) \<le> c * abs (g x)) F"
     using assms(4) by (simp add:bigo_def, blast)
   define d where "d = 1 + (max 0 (ln c)) / ln a"
   have d:"eventually (\<lambda>x. abs (ln (f x)) \<le> d * abs (ln (g x))) F"
   proof (rule eventually_mono[OF eventually_conj[OF b eventually_conj[OF assms(3,2)]]])
     fix x
-    assume c:"\<bar>f x\<bar> \<le> c * \<bar>g x\<bar> \<and> a \<le> g x \<and> 1 \<le> f x" 
+    assume c:"\<bar>f x\<bar> \<le> c * \<bar>g x\<bar> \<and> a \<le> g x \<and> 1 \<le> f x"
     have "abs (ln (f x)) = ln (f x)"
       by (subst abs_of_nonneg, rule ln_ge_zero, metis c, simp)
     also have "... \<le> ln (c * abs (g x))"
-      using c assms(1)  mult_pos_pos[OF a] by auto      
+      using c assms(1)  mult_pos_pos[OF a] by auto
     also have "... \<le> ln c + ln (abs (g x))"
       using c assms(1)
       by (simp add: ln_mult[OF a])
     also have "... \<le> (d-1)*ln a + ln (g x)"
       using assms(1) c
       by (intro add_mono iffD2[OF ln_le_cancel_iff], simp_all add:d_def)
     also have "... \<le> (d-1)* ln (g x) + ln (g x)"
       using assms(1) c
       by (intro add_mono mult_left_mono iffD2[OF ln_le_cancel_iff], simp_all add:d_def)
     also have "... = d * ln (g x)" by (simp add:algebra_simps)
     also have "... = d * abs (ln (g x))"
       using c assms(1) by auto
     finally show "abs (ln (f x)) \<le> d * abs (ln (g x))" by simp
   qed
   hence "\<forall>\<^sub>F x in F. \<bar>ln (f x)\<bar> \<le> d * \<bar>ln (g x)\<bar>"
     by simp
   moreover have "0 < d"
     unfolding d_def using assms(1)
     by (intro add_pos_nonneg divide_nonneg_pos, auto)
   ultimately show ?thesis
     by (auto simp:bigo_def)
 qed
 
 lemma landau_real_nat:
   fixes f :: "'a \<Rightarrow> int"
   assumes "(\<lambda>x. of_int (f x)) \<in> O[F](g)"
   shows "(\<lambda>x. real (nat (f x))) \<in> O[F](g)"
 proof -
   obtain c where a: "c > 0" and b: "eventually (\<lambda>x. abs (of_int (f x)) \<le> c * abs (g x)) F"
     using assms(1) by (simp add:bigo_def, blast)
   have "\<forall>\<^sub>F x in F. real (nat (f x)) \<le> c * \<bar>g x\<bar>"
     by (rule eventually_mono[OF b],  simp)
   thus ?thesis using a
     by (auto simp:bigo_def)
 qed
 
 lemma landau_ceil:
   assumes "(\<lambda>_. 1) \<in> O[F'](g)"
   assumes "f \<in> O[F'](g)"
   shows "(\<lambda>x. real_of_int \<lceil>f x\<rceil>) \<in> O[F'](g)"
 proof -
   have "(\<lambda>x. real_of_int \<lceil>f x\<rceil>) \<in> O[F'](\<lambda>x. 1 + abs (f x))"
     by (intro landau_o.big_mono always_eventually allI, simp, linarith)
   also have "(\<lambda>x. 1 + abs(f x)) \<in> O[F'](g)"
     using assms(2) by (intro sum_in_bigo assms(1), auto)
   finally show ?thesis by simp
 qed
 
 lemma landau_rat_ceil:
   assumes "(\<lambda>_. 1) \<in> O[F'](g)"
   assumes "(\<lambda>x. real_of_rat (f x)) \<in> O[F'](g)"
   shows "(\<lambda>x. real_of_int \<lceil>f x\<rceil>) \<in> O[F'](g)"
 proof -
   have a:"\<bar>real_of_int \<lceil>x\<rceil>\<bar> \<le> 1 + real_of_rat \<bar>x\<bar>" for x :: rat
   proof (cases "x \<ge> 0")
     case True
-    then show ?thesis 
+    then show ?thesis
       by  (simp, metis  add.commute  of_int_ceiling_le_add_one of_rat_ceiling)
   next
     case False
     have "real_of_rat x - 1 \<le> real_of_rat x"
       by simp
-    also have "... \<le> real_of_int \<lceil>x\<rceil>" 
+    also have "... \<le> real_of_int \<lceil>x\<rceil>"
       by (metis ceiling_correct of_rat_ceiling)
     finally have " real_of_rat (x)-1 \<le> real_of_int \<lceil>x\<rceil>" by simp
 
     hence "- real_of_int \<lceil>x\<rceil> \<le> 1 + real_of_rat (- x)"
       by (simp add: of_rat_minus)
-    then show ?thesis using False by simp 
+    then show ?thesis using False by simp
   qed
-  have "(\<lambda>x. real_of_int \<lceil>f x\<rceil>) \<in> O[F'](\<lambda>x. 1 + abs (real_of_rat (f x)))" 
+  have "(\<lambda>x. real_of_int \<lceil>f x\<rceil>) \<in> O[F'](\<lambda>x. 1 + abs (real_of_rat (f x)))"
     using a
     by (intro landau_o.big_mono always_eventually allI, simp)
   also have "(\<lambda>x. 1 + abs (real_of_rat (f x))) \<in> O[F'](g)"
     using assms
     by (intro sum_in_bigo assms(1), subst landau_o.big.abs_in_iff, simp)
   finally show ?thesis by simp
 qed
 
 lemma landau_nat_ceil:
   assumes "(\<lambda>_. 1) \<in> O[F'](g)"
   assumes "f \<in> O[F'](g)"
   shows "(\<lambda>x. real (nat \<lceil>f x\<rceil>)) \<in> O[F'](g)"
   using assms
   by (intro landau_real_nat landau_ceil, auto)
 
 lemma eventually_prod1':
   assumes "B \<noteq> bot"
   assumes " (\<forall>\<^sub>F x in A. P x)"
   shows "(\<forall>\<^sub>F x in A \<times>\<^sub>F B. P (fst x))"
 proof -
   have "(\<forall>\<^sub>F x in A \<times>\<^sub>F B. P (fst x)) = (\<forall>\<^sub>F (x,y) in A \<times>\<^sub>F B. P x)"
     by (simp add:case_prod_beta')
   also have "... = (\<forall>\<^sub>F x in A. P x)"
     by (subst eventually_prod1[OF assms(1)], simp)
   finally show ?thesis using assms(2) by simp
 qed
 
 lemma eventually_prod2':
   assumes "A \<noteq> bot"
   assumes " (\<forall>\<^sub>F x in B. P x)"
   shows "(\<forall>\<^sub>F x in A \<times>\<^sub>F B. P (snd x))"
 proof -
   have "(\<forall>\<^sub>F x in A \<times>\<^sub>F B. P (snd x)) = (\<forall>\<^sub>F (x,y) in A \<times>\<^sub>F B. P y)"
     by (simp add:case_prod_beta')
   also have "... = (\<forall>\<^sub>F x in B. P x)"
     by (subst eventually_prod2[OF assms(1)], simp)
   finally show ?thesis using assms(2) by simp
 qed
 
 lemma sequentially_inf: "\<forall>\<^sub>F x in sequentially. n \<le> real x"
   by (meson eventually_at_top_linorder nat_ceiling_le_eq)
 
 instantiation rat :: linorder_topology
 begin
 
 definition open_rat :: "rat set \<Rightarrow> bool"
   where "open_rat = generate_topology (range (\<lambda>a. {..< a}) \<union> range (\<lambda>a. {a <..}))"
 
 instance
   by standard (rule open_rat_def)
 end
 
 lemma inv_at_right_0_inf:
   "\<forall>\<^sub>F x in at_right 0. c \<le> 1 / real_of_rat x"
 proof -
   have a:" c \<le> 1 / real_of_rat x" if b:" x \<in> {0<..<1 / rat_of_int (max \<lceil>c\<rceil> 1)}" for x
   proof -
     have "c * real_of_rat x \<le> real_of_int (max \<lceil>c\<rceil> 1) * real_of_rat x"
       using b by (intro mult_right_mono, linarith, auto)
     also have "... < real_of_int (max \<lceil>c\<rceil> 1)  * real_of_rat (1/rat_of_int  (max \<lceil>c\<rceil> 1) )"
       using b by (intro mult_strict_left_mono iffD2[OF of_rat_less], auto)
     also have "... \<le> 1"
       by (simp add:of_rat_divide)
     finally have "c * real_of_rat x \<le> 1" by simp
     moreover have "0 < real_of_rat x"
       using b by simp
     ultimately show ?thesis by (subst pos_le_divide_eq, auto)
   qed
 
   show ?thesis
     using a
     by (intro eventually_at_rightI[where b="1/rat_of_int (max \<lceil>c\<rceil> 1)"], simp_all)
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Frequency_Moments/Product_PMF_Ext.thy b/thys/Frequency_Moments/Product_PMF_Ext.thy
--- a/thys/Frequency_Moments/Product_PMF_Ext.thy
+++ b/thys/Frequency_Moments/Product_PMF_Ext.thy
@@ -1,210 +1,30 @@
 section \<open>Indexed Products of Probability Mass Functions\<close>
 
 theory Product_PMF_Ext
-  imports Main Probability_Ext "HOL-Probability.Product_PMF" Universal_Hash_Families.Universal_Hash_Families_More_Independent_Families
+  imports
+    Probability_Ext
+    Universal_Hash_Families.Universal_Hash_Families_More_Product_PMF
 begin
 
-hide_const "Isolated.discrete"
-
-text \<open>This section introduces a restricted version of @{term "Pi_pmf"} where the default value is @{term "undefined"}
-and contains some additional results about that case in addition to @{theory "HOL-Probability.Product_PMF"}\<close>
-
-abbreviation prod_pmf where "prod_pmf I M \<equiv> Pi_pmf I undefined M"
-
-lemma pmf_prod_pmf: 
-  assumes "finite I"
-  shows "pmf (prod_pmf I M) x = (if x \<in> extensional I then \<Prod>i \<in> I. (pmf (M i)) (x i) else 0)"
-  by (simp add:  pmf_Pi[OF assms(1)] extensional_def)
-
-lemma PiE_defaut_undefined_eq: "PiE_dflt I undefined M = PiE I M" 
-  by (simp add:PiE_dflt_def PiE_def extensional_def Pi_def set_eq_iff) blast
-
-lemma set_prod_pmf:
-  assumes "finite I"
-  shows "set_pmf (prod_pmf I M) = PiE I (set_pmf \<circ> M)"
-  by (simp add:set_Pi_pmf[OF assms] PiE_defaut_undefined_eq)
-
-text \<open>A more general version of @{thm [source] "measure_Pi_pmf_Pi"}.\<close>
-lemma prob_prod_pmf': 
-  assumes "finite I"
-  assumes "J \<subseteq> I"
-  shows "measure (measure_pmf (Pi_pmf I d M)) (Pi J A) = (\<Prod> i \<in> J. measure (M i) (A i))"
-proof -
-  have a:"Pi J A = Pi I (\<lambda>i. if i \<in> J then A i else UNIV)"
-    using assms by (simp add:Pi_def set_eq_iff, blast)
-  show ?thesis
-    using assms
-    by (simp add:if_distrib  a measure_Pi_pmf_Pi[OF assms(1)] prod.If_cases[OF assms(1)] Int_absorb1)
-qed
-
-lemma prob_prod_pmf_slice:
-  assumes "finite I"
-  assumes "i \<in> I"
-  shows "measure (measure_pmf (prod_pmf I M)) {\<omega>. P (\<omega> i)} = measure (M i) {\<omega>. P \<omega>}"
-  using prob_prod_pmf'[OF assms(1), where J="{i}" and M="M" and A="\<lambda>_. Collect P"]
-  by (simp add:assms Pi_def)
-
-
-definition restrict_dfl where "restrict_dfl f A d = (\<lambda>x. if x \<in> A then f x else d)"
-
-lemma pi_pmf_decompose:
-  assumes "finite I"
-  shows "Pi_pmf I d M = map_pmf (\<lambda>\<omega>. restrict_dfl (\<lambda>i. \<omega> (f i) i) I d) (Pi_pmf (f ` I) (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> I) d M))"
-proof -
-  have fin_F_I:"finite (f ` I)" using assms by blast
-
-  have "finite I \<Longrightarrow> ?thesis"
-    using fin_F_I
-  proof (induction "f ` I" arbitrary: I rule:finite_induct)
-    case empty
-    then show ?case by (simp add:restrict_dfl_def)
-  next
-    case (insert x F)
-    have a: "(f -` {x} \<inter> I) \<union> (f -` F \<inter> I) = I"
-      using insert(4) by blast
-    have b: "F = f `  (f -` F \<inter> I) " using insert(2,4) 
-      by (auto simp add:set_eq_iff image_def vimage_def) 
-    have c: "finite (f -` F \<inter> I)" using insert by blast
-    have d: "\<And>j. j \<in> F \<Longrightarrow> (f -` {j} \<inter> (f -` F \<inter> I)) = (f -` {j} \<inter> I)"
-      using insert(4) by blast 
-
-    have " Pi_pmf I d M = Pi_pmf ((f -` {x} \<inter> I) \<union> (f -` F \<inter> I)) d M"
-      by (simp add:a)
-    also have "... = map_pmf (\<lambda>(g, h) i. if i \<in> f -` {x} \<inter> I then g i else h i) 
-      (pair_pmf (Pi_pmf (f -` {x} \<inter> I) d M) (Pi_pmf (f -` F \<inter> I) d M))"
-      using insert by (subst Pi_pmf_union) auto
-    also have "... = map_pmf (\<lambda>(g,h) i. if f i = x \<and> i \<in> I then g i else if f i \<in> F \<and> i \<in> I then h (f i) i else d)
-      (pair_pmf (Pi_pmf (f -` {x} \<inter> I) d M) (Pi_pmf F (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> (f -` F \<inter> I)) d M)))"
-      by (simp add:insert(3)[OF b c] map_pmf_comp case_prod_beta' apsnd_def map_prod_def 
-          pair_map_pmf2 b[symmetric] restrict_dfl_def) (metis fst_conv snd_conv)
-    also have "... = map_pmf (\<lambda>(g,h) i. if i \<in> I then (h(x := g)) (f i) i else d) 
-      (pair_pmf (Pi_pmf (f -` {x} \<inter> I) d M) (Pi_pmf F (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> I) d M)))" 
-      using insert(4) d
-      by (intro arg_cong2[where f="map_pmf"] ext) (auto simp add:case_prod_beta' cong:Pi_pmf_cong) 
-    also have "... = map_pmf (\<lambda>\<omega> i. if i \<in> I then \<omega> (f i) i else d) (Pi_pmf (insert x F) (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> I) d M))"
-      by (simp add:Pi_pmf_insert[OF insert(1,2)] map_pmf_comp case_prod_beta')
-    finally show ?case by (simp add:insert(4) restrict_dfl_def)
-  qed
-  thus ?thesis using assms by blast
-qed
-
-lemma restrict_dfl_iter: "restrict_dfl (restrict_dfl f I d) J d = restrict_dfl f (I \<inter> J) d"
-  by (rule ext, simp add:restrict_dfl_def)
+text \<open>The following aliases are here to prevent possible merge-conflicts. The lemmas have been
+moved to @{theory Universal_Hash_Families.Universal_Hash_Families_More_Product_PMF}.\<close>
 
-lemma indep_vars_restrict':
-  assumes "finite I"
-  shows "prob_space.indep_vars (Pi_pmf I d M) (\<lambda>_. discrete) (\<lambda>i \<omega>. restrict_dfl \<omega> (f -` {i} \<inter> I) d) (f ` I)"
-proof -
-  let ?Q = "(Pi_pmf (f ` I) (\<lambda>_. d) (\<lambda>i. Pi_pmf (I \<inter> f -` {i}) d M))"
-  have a:"prob_space.indep_vars ?Q (\<lambda>_. discrete) (\<lambda>i \<omega>. \<omega> i) (f ` I)"
-    using assms by (intro indep_vars_Pi_pmf, blast)
-  have b: "AE x in measure_pmf ?Q. \<forall>i\<in>f ` I. x i = restrict_dfl (\<lambda>i. x (f i) i) (I \<inter> f -` {i}) d"
-    using assms
-    by (auto simp add:PiE_dflt_def restrict_dfl_def AE_measure_pmf_iff set_Pi_pmf comp_def Int_commute)
-  have "prob_space.indep_vars ?Q (\<lambda>_. discrete) (\<lambda>i x. restrict_dfl (\<lambda>i. x (f i) i) (I \<inter> f -` {i}) d) (f ` I)"
-    by (rule prob_space.indep_vars_cong_AE[OF prob_space_measure_pmf b a],  simp)
-  thus ?thesis
-    using prob_space_measure_pmf 
-    by (auto intro!:prob_space.indep_vars_distr simp:pi_pmf_decompose[OF assms, where f="f"]  
-        map_pmf_rep_eq comp_def restrict_dfl_iter Int_commute) 
-qed
-
-lemma indep_vars_restrict_intro':
-  assumes "finite I"
-  assumes "\<And>i \<omega>. i \<in> J \<Longrightarrow> X' i \<omega> = X' i (restrict_dfl \<omega> (f -` {i} \<inter> I) d)"
-  assumes "J = f ` I"
-  assumes "\<And>\<omega> i. i \<in> J \<Longrightarrow>  X' i \<omega> \<in> space (M' i)"
-  shows "prob_space.indep_vars (measure_pmf (Pi_pmf I d p)) M' (\<lambda>i \<omega>. X' i \<omega>) J"
-proof -
-  define M where "M \<equiv> measure_pmf (Pi_pmf I d p)"
-  interpret prob_space "M"
-    using M_def prob_space_measure_pmf by blast
-  have "indep_vars (\<lambda>_. discrete) (\<lambda>i x. restrict_dfl x (f -` {i} \<inter> I) d) (f ` I)" 
-    unfolding M_def  by (rule indep_vars_restrict'[OF assms(1)])
-  hence "indep_vars M' (\<lambda>i \<omega>. X' i (restrict_dfl \<omega> ( f -` {i} \<inter> I) d)) (f ` I)"
-    using assms(4)
-    by (intro indep_vars_compose2[where Y="X'" and N="M'" and M'="\<lambda>_. discrete"])  (auto simp:assms(3))
-  hence "indep_vars M' (\<lambda>i \<omega>. X' i \<omega>) (f ` I)"
-    using assms(2)[symmetric]
-    by (simp add:assms(3) cong:indep_vars_cong)
-  thus ?thesis
-    unfolding M_def using assms(3) by simp 
-qed
-
-lemma  
-  fixes f :: "'b \<Rightarrow> ('c :: {second_countable_topology,banach,real_normed_field})"
-  assumes "finite I"
-  assumes "i \<in> I"
-  assumes "integrable (measure_pmf (M i)) f"
-  shows  integrable_Pi_pmf_slice: "integrable (Pi_pmf I d M) (\<lambda>x. f (x i))"
-  and expectation_Pi_pmf_slice: "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f (x i)) = integral\<^sup>L (M i) f"
-proof -
-  have a:"distr (Pi_pmf I d M) (M i) (\<lambda>\<omega>. \<omega> i) = distr (Pi_pmf I d M) discrete (\<lambda>\<omega>. \<omega> i)"
-    by (rule distr_cong, auto)
-
-  have b: "measure_pmf.random_variable (M i) borel f"
-    using assms(3) by simp
-
-  have c:"integrable (distr (Pi_pmf I d M) (M i) (\<lambda>\<omega>. \<omega> i)) f" 
-    using assms(1,2,3)
-    by (subst a, subst map_pmf_rep_eq[symmetric], subst Pi_pmf_component, auto)
+abbreviation prod_pmf where "prod_pmf \<equiv> Universal_Hash_Families_More_Product_PMF.prod_pmf"
+abbreviation restrict_dfl where "restrict_dfl \<equiv> Universal_Hash_Families_More_Product_PMF.restrict_dfl"
 
-  show "integrable (Pi_pmf I d M) (\<lambda>x. f (x i))"
-    by (rule integrable_distr[where f="f" and M'="M i"])  (auto intro: c)
-
-  have "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f (x i)) = integral\<^sup>L (distr (Pi_pmf I d M) (M i) (\<lambda>\<omega>. \<omega> i)) f"
-    using b by (intro integral_distr[symmetric], auto)
-  also have "... =  integral\<^sup>L (map_pmf (\<lambda>\<omega>. \<omega> i) (Pi_pmf I d M)) f"
-    by (subst a, subst map_pmf_rep_eq[symmetric], simp)
-  also have "... =  integral\<^sup>L (M i) f"
-    using assms(1,2) by (simp add: Pi_pmf_component)
-  finally show "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f (x i)) = integral\<^sup>L (M i) f" by simp
-qed
-
-text \<open>This is an improved version of @{thm [source] "expectation_prod_Pi_pmf"}.
-It works for general normed fields instead of non-negative real functions .\<close>
+lemmas pmf_prod_pmf = pmf_prod_pmf
+lemmas PiE_defaut_undefined_eq = PiE_defaut_undefined_eq
+lemmas set_prod_pmf = set_prod_pmf
+lemmas prob_prod_pmf' = prob_prod_pmf'
+lemmas prob_prod_pmf_slice = prob_prod_pmf_slice
+lemmas pi_pmf_decompose = pi_pmf_decompose
+lemmas restrict_dfl_iter = restrict_dfl_iter
+lemmas indep_vars_restrict' = indep_vars_restrict'
+lemmas indep_vars_restrict_intro' = indep_vars_restrict_intro'
+lemmas integrable_Pi_pmf_slice = integrable_Pi_pmf_slice
+lemmas expectation_Pi_pmf_slice = expectation_Pi_pmf_slice
+lemmas expectation_prod_Pi_pmf = expectation_prod_Pi_pmf
+lemmas variance_prod_pmf_slice = variance_prod_pmf_slice
+lemmas Pi_pmf_bind_return = Pi_pmf_bind_return
 
-lemma expectation_prod_Pi_pmf: 
-  fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> ('c :: {second_countable_topology,banach,real_normed_field})"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable (measure_pmf (M i)) (f i)"
-  shows   "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. (\<Prod>i \<in> I. f i (x i))) = (\<Prod> i \<in> I. integral\<^sup>L (M i) (f i))"
-proof -
-  have a: "prob_space.indep_vars (measure_pmf (Pi_pmf I d M)) (\<lambda>_. borel) (\<lambda>i \<omega>. f i (\<omega> i)) I"
-    by (intro prob_space.indep_vars_compose2[where Y="f" and M'="\<lambda>_. discrete"] 
-        prob_space_measure_pmf indep_vars_Pi_pmf assms(1)) auto
-  have "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. (\<Prod>i \<in> I. f i (x i))) = (\<Prod> i \<in> I. integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f i (x i)))"
-    by (intro prob_space.indep_vars_lebesgue_integral prob_space_measure_pmf assms(1,2) 
-        a integrable_Pi_pmf_slice) auto
-  also have "... = (\<Prod> i \<in> I. integral\<^sup>L (M i) (f i))"
-    by (intro prod.cong expectation_Pi_pmf_slice assms(1,2)) auto
-  finally show ?thesis by simp
-qed
-
-lemma variance_prod_pmf_slice:
-  fixes f :: "'a \<Rightarrow> real"
-  assumes "i \<in> I" "finite I"
-  assumes "integrable (measure_pmf (M i)) (\<lambda>\<omega>. f \<omega>^2)"
-  shows "prob_space.variance (Pi_pmf I d M) (\<lambda>\<omega>. f (\<omega> i)) = prob_space.variance (M i) f"
-proof -
-  have a:"integrable (measure_pmf (M i)) f"
-    using assms(3) measure_pmf.square_integrable_imp_integrable by auto
-  have b:" integrable (measure_pmf (Pi_pmf I d M)) (\<lambda>x. (f (x i))\<^sup>2)"
-    by (rule integrable_Pi_pmf_slice[OF assms(2) assms(1)], metis assms(3))
-  have c:" integrable (measure_pmf (Pi_pmf I d M)) (\<lambda>x. (f (x i)))"
-    by (rule integrable_Pi_pmf_slice[OF assms(2) assms(1)], metis a)
-
-  have "measure_pmf.expectation (Pi_pmf I d M) (\<lambda>x. (f (x i))\<^sup>2) - (measure_pmf.expectation (Pi_pmf I d M) (\<lambda>x. f (x i)))\<^sup>2 =
-      measure_pmf.expectation (M i) (\<lambda>x. (f x)\<^sup>2) - (measure_pmf.expectation (M i) f)\<^sup>2"
-    using assms a b c by ((subst expectation_Pi_pmf_slice[OF assms(2,1)])?, simp)+
-
-  thus ?thesis
-    using assms a b c by (simp add: measure_pmf.variance_eq)
-qed
-
-lemma Pi_pmf_bind_return:
-  assumes "finite I"
-  shows "Pi_pmf I d (\<lambda>i. M i \<bind> (\<lambda>x. return_pmf (f i x))) = Pi_pmf I d' M \<bind> (\<lambda>x. return_pmf (\<lambda>i. if i \<in> I then f i (x i) else d))"
-  using assms by (simp add: Pi_pmf_bind[where d'="d'"])
-
-end
+end
\ No newline at end of file
diff --git a/thys/Frequency_Moments/ROOT b/thys/Frequency_Moments/ROOT
--- a/thys/Frequency_Moments/ROOT
+++ b/thys/Frequency_Moments/ROOT
@@ -1,27 +1,27 @@
 chapter AFP
 
 session Frequency_Moments = "HOL-Probability" +
   options [timeout = 1200]
   sessions
     Bertrands_Postulate
     Concentration_Inequalities
     Equivalence_Relation_Enumeration
-    "HOL-Algebra"
     Interpolation_Polynomials_HOL_Algebra
     Lp
     Prefix_Free_Code_Combinators
     Median_Method
     Universal_Hash_Families
+    Expander_Graphs
   theories
     Frequency_Moments_Preliminary_Results
     Frequency_Moments
     Frequency_Moment_0
     Frequency_Moment_2
     Frequency_Moment_k
     Landau_Ext
     K_Smallest
     Probability_Ext
     Product_PMF_Ext
   document_files
     "root.tex"
     "root.bib"
diff --git a/thys/Universal_Hash_Families/ROOT b/thys/Universal_Hash_Families/ROOT
--- a/thys/Universal_Hash_Families/ROOT
+++ b/thys/Universal_Hash_Families/ROOT
@@ -1,16 +1,18 @@
 chapter AFP
 
 session Universal_Hash_Families = "HOL-Probability" +
   options [timeout = 600]
   sessions
     "HOL-Algebra"
-    "Finite_Fields"
-    "Interpolation_Polynomials_HOL_Algebra"
+    Concentration_Inequalities
+    Finite_Fields
+    Interpolation_Polynomials_HOL_Algebra
   theories
     Universal_Hash_Families
     Universal_Hash_Families_More_Independent_Families
     Carter_Wegman_Hash_Family
     Universal_Hash_Families_More_Finite_Fields
+    Universal_Hash_Families_More_Product_PMF
   document_files
     "root.tex"
     "root.bib"
diff --git a/thys/Universal_Hash_Families/Universal_Hash_Families_More_Product_PMF.thy b/thys/Universal_Hash_Families/Universal_Hash_Families_More_Product_PMF.thy
new file mode 100644
--- /dev/null
+++ b/thys/Universal_Hash_Families/Universal_Hash_Families_More_Product_PMF.thy
@@ -0,0 +1,229 @@
+section \<open>Indexed Products of Probability Mass Functions\<close>
+
+theory Universal_Hash_Families_More_Product_PMF
+  imports
+    "HOL-Probability.Product_PMF"
+    Concentration_Inequalities.Concentration_Inequalities_Preliminary
+    Universal_Hash_Families_More_Independent_Families
+begin
+
+hide_const (open) Isolated.discrete
+
+text \<open>This section introduces a restricted version of @{term "Pi_pmf"} where the default value is @{term "undefined"}
+and contains some additional results about that case in addition to @{theory "HOL-Probability.Product_PMF"}\<close>
+
+abbreviation prod_pmf where "prod_pmf I M \<equiv> Pi_pmf I undefined M"
+
+lemma measure_pmf_cong:
+  assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> x \<in> P \<longleftrightarrow> x \<in> Q"
+  shows "measure (measure_pmf p) P = measure (measure_pmf p)  Q"
+  using assms
+  by (intro finite_measure.finite_measure_eq_AE AE_pmfI) auto
+
+lemma pmf_mono:
+  assumes "\<And>x. x \<in> set_pmf p \<Longrightarrow> x \<in> P \<Longrightarrow> x \<in> Q"
+  shows "measure (measure_pmf p) P \<le> measure (measure_pmf p) Q"
+proof -
+  have "measure (measure_pmf p) P = measure (measure_pmf p) (P \<inter> (set_pmf p))"
+    by (intro measure_pmf_cong) auto
+  also have "... \<le> measure (measure_pmf p) Q"
+    using assms by (intro finite_measure.finite_measure_mono) auto
+  finally show ?thesis by simp
+qed
+
+lemma pmf_prod_pmf:
+  assumes "finite I"
+  shows "pmf (prod_pmf I M) x = (if x \<in> extensional I then \<Prod>i \<in> I. (pmf (M i)) (x i) else 0)"
+  by (simp add:  pmf_Pi[OF assms(1)] extensional_def)
+
+lemma PiE_defaut_undefined_eq: "PiE_dflt I undefined M = PiE I M"
+  by (simp add:PiE_dflt_def PiE_def extensional_def Pi_def set_eq_iff) blast
+
+lemma set_prod_pmf:
+  assumes "finite I"
+  shows "set_pmf (prod_pmf I M) = PiE I (set_pmf \<circ> M)"
+  by (simp add:set_Pi_pmf[OF assms] PiE_defaut_undefined_eq)
+
+text \<open>A more general version of @{thm [source] "measure_Pi_pmf_Pi"}.\<close>
+lemma prob_prod_pmf':
+  assumes "finite I"
+  assumes "J \<subseteq> I"
+  shows "measure (measure_pmf (Pi_pmf I d M)) (Pi J A) = (\<Prod> i \<in> J. measure (M i) (A i))"
+proof -
+  have a:"Pi J A = Pi I (\<lambda>i. if i \<in> J then A i else UNIV)"
+    using assms by (simp add:Pi_def set_eq_iff, blast)
+  show ?thesis
+    using assms
+    by (simp add:if_distrib  a measure_Pi_pmf_Pi[OF assms(1)] prod.If_cases[OF assms(1)] Int_absorb1)
+qed
+
+lemma prob_prod_pmf_slice:
+  assumes "finite I"
+  assumes "i \<in> I"
+  shows "measure (measure_pmf (prod_pmf I M)) {\<omega>. P (\<omega> i)} = measure (M i) {\<omega>. P \<omega>}"
+  using prob_prod_pmf'[OF assms(1), where J="{i}" and M="M" and A="\<lambda>_. Collect P"]
+  by (simp add:assms Pi_def)
+
+definition restrict_dfl where "restrict_dfl f A d = (\<lambda>x. if x \<in> A then f x else d)"
+
+lemma pi_pmf_decompose:
+  assumes "finite I"
+  shows "Pi_pmf I d M = map_pmf (\<lambda>\<omega>. restrict_dfl (\<lambda>i. \<omega> (f i) i) I d) (Pi_pmf (f ` I) (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> I) d M))"
+proof -
+  have fin_F_I:"finite (f ` I)" using assms by blast
+
+  have "finite I \<Longrightarrow> ?thesis"
+    using fin_F_I
+  proof (induction "f ` I" arbitrary: I rule:finite_induct)
+    case empty
+    then show ?case by (simp add:restrict_dfl_def)
+  next
+    case (insert x F)
+    have a: "(f -` {x} \<inter> I) \<union> (f -` F \<inter> I) = I"
+      using insert(4) by blast
+    have b: "F = f `  (f -` F \<inter> I) " using insert(2,4)
+      by (auto simp add:set_eq_iff image_def vimage_def)
+    have c: "finite (f -` F \<inter> I)" using insert by blast
+    have d: "\<And>j. j \<in> F \<Longrightarrow> (f -` {j} \<inter> (f -` F \<inter> I)) = (f -` {j} \<inter> I)"
+      using insert(4) by blast
+
+    have " Pi_pmf I d M = Pi_pmf ((f -` {x} \<inter> I) \<union> (f -` F \<inter> I)) d M"
+      by (simp add:a)
+    also have "... = map_pmf (\<lambda>(g, h) i. if i \<in> f -` {x} \<inter> I then g i else h i)
+      (pair_pmf (Pi_pmf (f -` {x} \<inter> I) d M) (Pi_pmf (f -` F \<inter> I) d M))"
+      using insert by (subst Pi_pmf_union) auto
+    also have "... = map_pmf (\<lambda>(g,h) i. if f i = x \<and> i \<in> I then g i else if f i \<in> F \<and> i \<in> I then h (f i) i else d)
+      (pair_pmf (Pi_pmf (f -` {x} \<inter> I) d M) (Pi_pmf F (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> (f -` F \<inter> I)) d M)))"
+      by (simp add:insert(3)[OF b c] map_pmf_comp case_prod_beta' apsnd_def map_prod_def
+          pair_map_pmf2 b[symmetric] restrict_dfl_def) (metis fst_conv snd_conv)
+    also have "... = map_pmf (\<lambda>(g,h) i. if i \<in> I then (h(x := g)) (f i) i else d)
+      (pair_pmf (Pi_pmf (f -` {x} \<inter> I) d M) (Pi_pmf F (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> I) d M)))"
+      using insert(4) d
+      by (intro arg_cong2[where f="map_pmf"] ext) (auto simp add:case_prod_beta' cong:Pi_pmf_cong)
+    also have "... = map_pmf (\<lambda>\<omega> i. if i \<in> I then \<omega> (f i) i else d) (Pi_pmf (insert x F) (\<lambda>_. d) (\<lambda>j. Pi_pmf (f -` {j} \<inter> I) d M))"
+      by (simp add:Pi_pmf_insert[OF insert(1,2)] map_pmf_comp case_prod_beta')
+    finally show ?case by (simp add:insert(4) restrict_dfl_def)
+  qed
+  thus ?thesis using assms by blast
+qed
+
+lemma restrict_dfl_iter: "restrict_dfl (restrict_dfl f I d) J d = restrict_dfl f (I \<inter> J) d"
+  by (rule ext, simp add:restrict_dfl_def)
+
+lemma indep_vars_restrict':
+  assumes "finite I"
+  shows "prob_space.indep_vars (Pi_pmf I d M) (\<lambda>_. discrete) (\<lambda>i \<omega>. restrict_dfl \<omega> (f -` {i} \<inter> I) d) (f ` I)"
+proof -
+  let ?Q = "(Pi_pmf (f ` I) (\<lambda>_. d) (\<lambda>i. Pi_pmf (I \<inter> f -` {i}) d M))"
+  have a:"prob_space.indep_vars ?Q (\<lambda>_. discrete) (\<lambda>i \<omega>. \<omega> i) (f ` I)"
+    using assms by (intro indep_vars_Pi_pmf, blast)
+  have b: "AE x in measure_pmf ?Q. \<forall>i\<in>f ` I. x i = restrict_dfl (\<lambda>i. x (f i) i) (I \<inter> f -` {i}) d"
+    using assms
+    by (auto simp add:PiE_dflt_def restrict_dfl_def AE_measure_pmf_iff set_Pi_pmf comp_def Int_commute)
+  have "prob_space.indep_vars ?Q (\<lambda>_. discrete) (\<lambda>i x. restrict_dfl (\<lambda>i. x (f i) i) (I \<inter> f -` {i}) d) (f ` I)"
+    by (rule prob_space.indep_vars_cong_AE[OF prob_space_measure_pmf b a],  simp)
+  thus ?thesis
+    using prob_space_measure_pmf
+    by (auto intro!:prob_space.indep_vars_distr simp:pi_pmf_decompose[OF assms, where f="f"]
+        map_pmf_rep_eq comp_def restrict_dfl_iter Int_commute)
+qed
+
+lemma indep_vars_restrict_intro':
+  assumes "finite I"
+  assumes "\<And>i \<omega>. i \<in> J \<Longrightarrow> X' i \<omega> = X' i (restrict_dfl \<omega> (f -` {i} \<inter> I) d)"
+  assumes "J = f ` I"
+  assumes "\<And>\<omega> i. i \<in> J \<Longrightarrow>  X' i \<omega> \<in> space (M' i)"
+  shows "prob_space.indep_vars (measure_pmf (Pi_pmf I d p)) M' (\<lambda>i \<omega>. X' i \<omega>) J"
+proof -
+  define M where "M \<equiv> measure_pmf (Pi_pmf I d p)"
+  interpret prob_space "M"
+    using M_def prob_space_measure_pmf by blast
+  have "indep_vars (\<lambda>_. discrete) (\<lambda>i x. restrict_dfl x (f -` {i} \<inter> I) d) (f ` I)"
+    unfolding M_def  by (rule indep_vars_restrict'[OF assms(1)])
+  hence "indep_vars M' (\<lambda>i \<omega>. X' i (restrict_dfl \<omega> ( f -` {i} \<inter> I) d)) (f ` I)"
+    using assms(4)
+    by (intro indep_vars_compose2[where Y="X'" and N="M'" and M'="\<lambda>_. discrete"])  (auto simp:assms(3))
+  hence "indep_vars M' (\<lambda>i \<omega>. X' i \<omega>) (f ` I)"
+    using assms(2)[symmetric]
+    by (simp add:assms(3) cong:indep_vars_cong)
+  thus ?thesis
+    unfolding M_def using assms(3) by simp
+qed
+
+lemma
+  fixes f :: "'b \<Rightarrow> ('c :: {second_countable_topology,banach,real_normed_field})"
+  assumes "finite I"
+  assumes "i \<in> I"
+  assumes "integrable (measure_pmf (M i)) f"
+  shows  integrable_Pi_pmf_slice: "integrable (Pi_pmf I d M) (\<lambda>x. f (x i))"
+  and expectation_Pi_pmf_slice: "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f (x i)) = integral\<^sup>L (M i) f"
+proof -
+  have a:"distr (Pi_pmf I d M) (M i) (\<lambda>\<omega>. \<omega> i) = distr (Pi_pmf I d M) discrete (\<lambda>\<omega>. \<omega> i)"
+    by (rule distr_cong, auto)
+
+  have b: "measure_pmf.random_variable (M i) borel f"
+    using assms(3) by simp
+
+  have c:"integrable (distr (Pi_pmf I d M) (M i) (\<lambda>\<omega>. \<omega> i)) f"
+    using assms(1,2,3)
+    by (subst a, subst map_pmf_rep_eq[symmetric], subst Pi_pmf_component, auto)
+
+  show "integrable (Pi_pmf I d M) (\<lambda>x. f (x i))"
+    by (rule integrable_distr[where f="f" and M'="M i"])  (auto intro: c)
+
+  have "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f (x i)) = integral\<^sup>L (distr (Pi_pmf I d M) (M i) (\<lambda>\<omega>. \<omega> i)) f"
+    using b by (intro integral_distr[symmetric], auto)
+  also have "... =  integral\<^sup>L (map_pmf (\<lambda>\<omega>. \<omega> i) (Pi_pmf I d M)) f"
+    by (subst a, subst map_pmf_rep_eq[symmetric], simp)
+  also have "... =  integral\<^sup>L (M i) f"
+    using assms(1,2) by (simp add: Pi_pmf_component)
+  finally show "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f (x i)) = integral\<^sup>L (M i) f" by simp
+qed
+
+text \<open>This is an improved version of @{thm [source] "expectation_prod_Pi_pmf"}.
+It works for general normed fields instead of non-negative real functions .\<close>
+
+lemma expectation_prod_Pi_pmf:
+  fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> ('c :: {second_countable_topology,banach,real_normed_field})"
+  assumes "finite I"
+  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable (measure_pmf (M i)) (f i)"
+  shows   "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. (\<Prod>i \<in> I. f i (x i))) = (\<Prod> i \<in> I. integral\<^sup>L (M i) (f i))"
+proof -
+  have a: "prob_space.indep_vars (measure_pmf (Pi_pmf I d M)) (\<lambda>_. borel) (\<lambda>i \<omega>. f i (\<omega> i)) I"
+    by (intro prob_space.indep_vars_compose2[where Y="f" and M'="\<lambda>_. discrete"]
+        prob_space_measure_pmf indep_vars_Pi_pmf assms(1)) auto
+  have "integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. (\<Prod>i \<in> I. f i (x i))) = (\<Prod> i \<in> I. integral\<^sup>L (Pi_pmf I d M) (\<lambda>x. f i (x i)))"
+    by (intro prob_space.indep_vars_lebesgue_integral prob_space_measure_pmf assms(1,2)
+        a integrable_Pi_pmf_slice) auto
+  also have "... = (\<Prod> i \<in> I. integral\<^sup>L (M i) (f i))"
+    by (intro prod.cong expectation_Pi_pmf_slice assms(1,2)) auto
+  finally show ?thesis by simp
+qed
+
+lemma variance_prod_pmf_slice:
+  fixes f :: "'a \<Rightarrow> real"
+  assumes "i \<in> I" "finite I"
+  assumes "integrable (measure_pmf (M i)) (\<lambda>\<omega>. f \<omega>^2)"
+  shows "prob_space.variance (Pi_pmf I d M) (\<lambda>\<omega>. f (\<omega> i)) = prob_space.variance (M i) f"
+proof -
+  have a:"integrable (measure_pmf (M i)) f"
+    using assms(3) measure_pmf.square_integrable_imp_integrable by auto
+  have b:" integrable (measure_pmf (Pi_pmf I d M)) (\<lambda>x. (f (x i))\<^sup>2)"
+    by (rule integrable_Pi_pmf_slice[OF assms(2) assms(1)], metis assms(3))
+  have c:" integrable (measure_pmf (Pi_pmf I d M)) (\<lambda>x. (f (x i)))"
+    by (rule integrable_Pi_pmf_slice[OF assms(2) assms(1)], metis a)
+
+  have "measure_pmf.expectation (Pi_pmf I d M) (\<lambda>x. (f (x i))\<^sup>2) - (measure_pmf.expectation (Pi_pmf I d M) (\<lambda>x. f (x i)))\<^sup>2 =
+      measure_pmf.expectation (M i) (\<lambda>x. (f x)\<^sup>2) - (measure_pmf.expectation (M i) f)\<^sup>2"
+    using assms a b c by ((subst expectation_Pi_pmf_slice[OF assms(2,1)])?, simp)+
+
+  thus ?thesis
+    using assms a b c by (simp add: measure_pmf.variance_eq)
+qed
+
+lemma Pi_pmf_bind_return:
+  assumes "finite I"
+  shows "Pi_pmf I d (\<lambda>i. M i \<bind> (\<lambda>x. return_pmf (f i x))) = Pi_pmf I d' M \<bind> (\<lambda>x. return_pmf (\<lambda>i. if i \<in> I then f i (x i) else d))"
+  using assms by (simp add: Pi_pmf_bind[where d'="d'"])
+
+end