diff --git a/thys/Core_DOM/common/Core_DOM_Functions.thy b/thys/Core_DOM/common/Core_DOM_Functions.thy
--- a/thys/Core_DOM/common/Core_DOM_Functions.thy
+++ b/thys/Core_DOM/common/Core_DOM_Functions.thy
@@ -1,3725 +1,3767 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Querying and Modifying the DOM\<close>
 text\<open>In this theory, we are formalizing the functions for querying and modifying 
 the DOM.\<close>
 
 theory Core_DOM_Functions
 imports
   "monads/DocumentMonad"
 begin
 
 text \<open>If we do not declare show\_variants, then all abbreviations that contain
   constants that are overloaded by using adhoc\_overloading get immediately unfolded.\<close>
 declare [[show_variants]]
 
 subsection \<open>Various Functions\<close>
 
 lemma insort_split: "x \<in> set (insort y xs) \<longleftrightarrow> (x = y \<or> x \<in> set xs)"
   apply(induct xs)
   by(auto)
 
 lemma concat_map_distinct: 
   "distinct (concat (map f xs)) \<Longrightarrow> y \<in> set (concat (map f xs)) \<Longrightarrow> \<exists>!x \<in> set xs. y \<in> set (f x)"
   apply(induct xs) 
   by(auto)
 
 lemma concat_map_all_distinct: "distinct (concat (map f xs)) \<Longrightarrow> x \<in> set xs \<Longrightarrow> distinct (f x)"
   apply(induct xs)
   by(auto)
 
 lemma distinct_concat_map_I:
   assumes "distinct xs"
     and "\<And>x. x \<in> set xs \<Longrightarrow> distinct (f x)"
 and "\<And>x y. x \<in> set xs \<Longrightarrow> y \<in> set xs \<Longrightarrow> x \<noteq> y \<Longrightarrow> (set (f x)) \<inter> (set (f y)) = {}"
 shows "distinct (concat ((map f xs)))"
   using assms
   apply(induct xs) 
   by(auto)
 
 lemma distinct_concat_map_E:
   assumes "distinct (concat ((map f xs)))"
   shows "\<And>x y. x \<in> set xs \<Longrightarrow> y \<in> set xs \<Longrightarrow> x \<noteq> y \<Longrightarrow> (set (f x)) \<inter> (set (f y)) = {}"
     and "\<And>x. x \<in> set xs \<Longrightarrow> distinct (f x)"
   using assms
   apply(induct xs) 
   by(auto)
 
 lemma bind_is_OK_E3 [elim]:
   assumes "h \<turnstile> ok (f \<bind> g)" and "pure f h"
   obtains x where "h \<turnstile> f \<rightarrow>\<^sub>r x"  and "h \<turnstile> ok (g x)"
   using assms 
   by(auto simp add: bind_def returns_result_def returns_heap_def is_OK_def execute_def pure_def
                split: sum.splits)
 
 
 subsection \<open>Basic Functions\<close>
 
 subsubsection \<open>get\_child\_nodes\<close>
 
 locale l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 
 definition get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: "(_) element_ptr \<Rightarrow> unit \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   where
     "get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r element_ptr _ = get_M element_ptr RElement.child_nodes"
 
 definition get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: "(_) character_data_ptr \<Rightarrow> unit \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   where
     "get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r _ _ = return []"
 
 definition get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: "(_) document_ptr \<Rightarrow> unit \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   where
     "get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr _ = do {
     doc_elem \<leftarrow> get_M document_ptr document_element;
     (case doc_elem of
       Some element_ptr \<Rightarrow> return [cast element_ptr]
     | None \<Rightarrow> return [])
   }"
 
 definition a_get_child_nodes_tups :: "(((_) object_ptr \<Rightarrow> bool) \<times> ((_) object_ptr \<Rightarrow> unit
   \<Rightarrow> (_, (_) node_ptr list) dom_prog)) list"
   where
     "a_get_child_nodes_tups = [
         (is_element_ptr, get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast),
         (is_character_data_ptr, get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast),
         (is_document_ptr, get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast)
      ]"
 
 definition a_get_child_nodes :: "(_) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   where
     "a_get_child_nodes ptr = invoke a_get_child_nodes_tups ptr ()"
 
 definition a_get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   where
     "a_get_child_nodes_locs ptr \<equiv> 
       (if is_element_ptr_kind ptr then {preserved (get_M (the (cast ptr)) RElement.child_nodes)} else {}) \<union>
       (if is_document_ptr_kind ptr then {preserved (get_M (the (cast ptr)) RDocument.document_element)} else {}) \<union>
       {preserved (get_M ptr RObject.nothing)}"
 
 definition first_child :: "(_) object_ptr \<Rightarrow> (_, (_) node_ptr option) dom_prog"
   where
     "first_child ptr = do {
       children \<leftarrow> a_get_child_nodes ptr;
       return (case children of [] \<Rightarrow> None | child#_ \<Rightarrow> Some child)}"
 end
 
 locale l_get_child_nodes_defs =
   fixes get_child_nodes :: "(_) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   fixes get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_known_ptr known_ptr + 
   l_get_child_nodes_defs get_child_nodes get_child_nodes_locs +
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set" +
   assumes known_ptr_impl: "known_ptr = DocumentClass.known_ptr"
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes get_child_nodes_impl: "get_child_nodes = a_get_child_nodes"
   assumes get_child_nodes_locs_impl: "get_child_nodes_locs = a_get_child_nodes_locs"
 begin
 lemmas get_child_nodes_def = get_child_nodes_impl[unfolded a_get_child_nodes_def]
 lemmas get_child_nodes_locs_def = get_child_nodes_locs_impl[unfolded a_get_child_nodes_locs_def]
 
 lemma get_child_nodes_split:
   "P (invoke (a_get_child_nodes_tups @ xs) ptr ()) =
     ((known_ptr ptr \<longrightarrow> P (get_child_nodes ptr))
     \<and> (\<not>(known_ptr ptr) \<longrightarrow> P (invoke xs ptr ())))"
   by(auto simp add: known_ptr_impl get_child_nodes_impl a_get_child_nodes_def a_get_child_nodes_tups_def 
                      known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs 
                      NodeClass.known_ptr_defs 
           split: invoke_splits)
 
 lemma get_child_nodes_split_asm:
   "P (invoke (a_get_child_nodes_tups @ xs) ptr ()) =
     (\<not>((known_ptr ptr \<and> \<not>P (get_child_nodes ptr))
     \<or> (\<not>(known_ptr ptr) \<and> \<not>P (invoke xs ptr ()))))"
   by(auto simp add: known_ptr_impl get_child_nodes_impl a_get_child_nodes_def 
                     a_get_child_nodes_tups_def known_ptr_defs CharacterDataClass.known_ptr_defs 
                     ElementClass.known_ptr_defs NodeClass.known_ptr_defs 
           split: invoke_splits)
 
 lemmas get_child_nodes_splits = get_child_nodes_split get_child_nodes_split_asm
 
 lemma get_child_nodes_ok [simp]:
   assumes "known_ptr ptr"
   assumes "type_wf h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   shows "h \<turnstile> ok (get_child_nodes ptr)"
   using assms(1) assms(2) assms(3)
   apply(auto simp add:  known_ptr_impl type_wf_impl get_child_nodes_def a_get_child_nodes_tups_def)[1]
   apply(split invoke_splits, rule conjI)+
      apply((rule impI)+, drule(1) known_ptr_not_document_ptr, drule(1) known_ptr_not_character_data_ptr, 
                          drule(1) known_ptr_not_element_ptr)
      apply(auto simp add: NodeClass.known_ptr_defs)[1]
     apply(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def dest: get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok 
                split: list.splits option.splits intro!: bind_is_OK_I2)[1]
    apply(auto simp add: get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)[1]                                                    
   apply (auto simp add: get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def  CharacterDataClass.type_wf_defs 
                         DocumentClass.type_wf_defs intro!: bind_is_OK_I2 split: option.splits)[1]
   using get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok \<open>type_wf h\<close>[unfolded type_wf_impl] by blast
 
 lemma get_child_nodes_ptr_in_heap [simp]:
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms
   by(auto simp add: get_child_nodes_impl a_get_child_nodes_def invoke_ptr_in_heap 
           dest: is_OK_returns_result_I)
 
 lemma get_child_nodes_pure [simp]:
   "pure (get_child_nodes ptr) h"
   apply (auto simp add: get_child_nodes_impl a_get_child_nodes_def a_get_child_nodes_tups_def)[1]
   apply(split invoke_splits, rule conjI)+
   by(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def 
                    get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_I split: option.splits)
 
 lemma get_child_nodes_reads: "reads (get_child_nodes_locs ptr) (get_child_nodes ptr) h h'"
   apply(simp add: get_child_nodes_locs_impl get_child_nodes_impl a_get_child_nodes_def 
       a_get_child_nodes_tups_def a_get_child_nodes_locs_def) 
   apply(split invoke_splits, rule conjI)+
      apply(auto)[1] 
     apply(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro: reads_subset[OF reads_singleton] 
       reads_subset[OF check_in_heap_reads]  
       intro!: reads_bind_pure  reads_subset[OF return_reads] split: option.splits)[1] (* slow: ca 1min *)
    apply(auto simp add: get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro: reads_subset[OF check_in_heap_reads] 
       intro!: reads_bind_pure  reads_subset[OF return_reads] )[1]
   apply(auto simp add: get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro: reads_subset[OF reads_singleton] 
       reads_subset[OF check_in_heap_reads] intro!: reads_bind_pure  reads_subset[OF return_reads] 
-      split: option.splits)
+      split: option.splits)[1]
   done
 end
 
 locale l_get_child_nodes = l_type_wf + l_known_ptr + l_get_child_nodes_defs +
   assumes get_child_nodes_reads: "reads (get_child_nodes_locs ptr) (get_child_nodes ptr) h h'"
   assumes get_child_nodes_ok: "type_wf h \<Longrightarrow> known_ptr ptr \<Longrightarrow> ptr |\<in>| object_ptr_kinds h 
                                          \<Longrightarrow> h \<turnstile> ok (get_child_nodes ptr)"
   assumes get_child_nodes_ptr_in_heap: "h \<turnstile> ok (get_child_nodes ptr) \<Longrightarrow> ptr |\<in>| object_ptr_kinds h"
   assumes get_child_nodes_pure [simp]: "pure (get_child_nodes ptr) h"
 
 global_interpretation l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   get_child_nodes = l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_child_nodes and
   get_child_nodes_locs = l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_child_nodes_locs
   .
 
 interpretation
   i_get_child_nodes?: l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   by(auto simp add: l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def get_child_nodes_def get_child_nodes_locs_def)
 declare l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_child_nodes_is_l_get_child_nodes [instances]: 
   "l_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs"
   apply(unfold_locales)
   using get_child_nodes_reads get_child_nodes_ok get_child_nodes_ptr_in_heap get_child_nodes_pure
   by blast+
 
 
 paragraph \<open>new\_element\<close>
 
 locale l_new_element_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma get_child_nodes_new_element: 
   "ptr' \<noteq> cast new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
   by (auto simp add: get_child_nodes_locs_def new_element_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t new_element_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t 
                      new_element_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t split: prod.splits if_splits option.splits 
            elim!: bind_returns_result_E bind_returns_heap_E intro: is_element_ptr_kind_obtains)
 
 lemma new_element_no_child_nodes:
   "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
   apply(auto simp add: get_child_nodes_def a_get_child_nodes_tups_def 
       split: prod.splits elim!: bind_returns_result_E bind_returns_heap_E)[1]
   apply(split invoke_splits, rule conjI)+
      apply(auto intro: new_element_is_element_ptr)[1]
   by(auto simp add: new_element_ptr_in_heap get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def check_in_heap_def 
       new_element_child_nodes intro!: bind_pure_returns_result_I 
       intro: new_element_is_element_ptr elim!: new_element_ptr_in_heap)
 end
 
 locale l_new_element_get_child_nodes = l_new_element + l_get_child_nodes +
   assumes get_child_nodes_new_element:  
           "ptr' \<noteq> cast new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr 
             \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
         assumes new_element_no_child_nodes: 
           "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>h h' 
             \<Longrightarrow> h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
 
 interpretation i_new_element_get_child_nodes?:
   l_new_element_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   by(unfold_locales)
 declare l_new_element_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma new_element_get_child_nodes_is_l_new_element_get_child_nodes [instances]: 
   "l_new_element_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs"
   using new_element_is_l_new_element get_child_nodes_is_l_get_child_nodes
   apply(auto simp add: l_new_element_get_child_nodes_def l_new_element_get_child_nodes_axioms_def)[1]
   using get_child_nodes_new_element new_element_no_child_nodes
   by fast+
 
 
 paragraph \<open>new\_character\_data\<close>
 
 locale l_new_character_data_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma get_child_nodes_new_character_data: 
   "ptr' \<noteq> cast new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr 
    \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
   by (auto simp add: get_child_nodes_locs_def new_character_data_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t 
                      new_character_data_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t new_character_data_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t 
            split: prod.splits if_splits option.splits 
            elim!: bind_returns_result_E bind_returns_heap_E 
            intro: is_character_data_ptr_kind_obtains)
 
 lemma new_character_data_no_child_nodes:
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
   apply(auto simp add: get_child_nodes_def a_get_child_nodes_tups_def 
              split: prod.splits elim!: bind_returns_result_E bind_returns_heap_E)[1]
   apply(split invoke_splits, rule conjI)+
      apply(auto intro: new_character_data_is_character_data_ptr)[1]
   by(auto simp add: new_character_data_ptr_in_heap get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def 
                     check_in_heap_def new_character_data_child_nodes 
           intro!: bind_pure_returns_result_I 
           intro: new_character_data_is_character_data_ptr elim!: new_character_data_ptr_in_heap)
 end
 
 locale l_new_character_data_get_child_nodes = l_new_character_data + l_get_child_nodes +
   assumes get_child_nodes_new_character_data:  
    "ptr' \<noteq> cast new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr 
        \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
  assumes new_character_data_no_child_nodes: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' 
        \<Longrightarrow> h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
 
 interpretation i_new_character_data_get_child_nodes?:
   l_new_character_data_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   by(unfold_locales)
 declare l_new_character_data_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma new_character_data_get_child_nodes_is_l_new_character_data_get_child_nodes [instances]: 
   "l_new_character_data_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs"
   using new_character_data_is_l_new_character_data get_child_nodes_is_l_get_child_nodes
   apply(simp add: l_new_character_data_get_child_nodes_def l_new_character_data_get_child_nodes_axioms_def)
   using get_child_nodes_new_character_data new_character_data_no_child_nodes
   by fast
 
 
 
 paragraph \<open>new\_document\<close>
 
 locale l_new_document_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma get_child_nodes_new_document: 
   "ptr' \<noteq> cast new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr 
      \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
   by (auto simp add: get_child_nodes_locs_def new_document_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t new_document_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
                      new_document_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t split: prod.splits if_splits option.splits 
            elim!: bind_returns_result_E bind_returns_heap_E 
            intro: is_document_ptr_kind_obtains)
 
 lemma new_document_no_child_nodes:
   "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []"
   apply(auto simp add: get_child_nodes_def a_get_child_nodes_tups_def 
       split: prod.splits 
       elim!: bind_returns_result_E bind_returns_heap_E)[1]
   apply(split invoke_splits, rule conjI)+
      apply(auto intro: new_document_is_document_ptr)[1]
   by(auto simp add: new_document_ptr_in_heap get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def check_in_heap_def 
       new_document_document_element 
       intro!: bind_pure_returns_result_I 
       intro: new_document_is_document_ptr elim!: new_document_ptr_in_heap split: option.splits)
 end
 
 locale l_new_document_get_child_nodes = l_new_document + l_get_child_nodes +
   assumes get_child_nodes_new_document:  
    "ptr' \<noteq> cast new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr 
      \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
  assumes new_document_no_child_nodes: 
    "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []"
 
 interpretation i_new_document_get_child_nodes?:
   l_new_document_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr get_child_nodes get_child_nodes_locs
   by(unfold_locales)
 declare l_new_document_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma new_document_get_child_nodes_is_l_new_document_get_child_nodes [instances]: 
   "l_new_document_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs"
   using new_document_is_l_new_document get_child_nodes_is_l_get_child_nodes
   apply(simp add: l_new_document_get_child_nodes_def l_new_document_get_child_nodes_axioms_def)
   using get_child_nodes_new_document new_document_no_child_nodes
   by fast
 
 subsubsection \<open>set\_child\_nodes\<close>
 
 locale l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 definition set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: 
   "(_) element_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   where
   "set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r element_ptr children = put_M element_ptr RElement.child_nodes_update children"
 
 definition set_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: 
   "(_) character_data_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   where
     "set_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r _ _ =  error HierarchyRequestError"
 
 definition set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   where
     "set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr children = do {
       (case children of
         [] \<Rightarrow> put_M document_ptr document_element_update None
       | child # [] \<Rightarrow> (case cast child of
           Some element_ptr \<Rightarrow> put_M document_ptr document_element_update (Some element_ptr)
         | None \<Rightarrow> error HierarchyRequestError)
       | _ \<Rightarrow> error HierarchyRequestError)
     }"
 
 definition a_set_child_nodes_tups :: 
   "(((_) object_ptr \<Rightarrow> bool) \<times> ((_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog)) list"
   where
     "a_set_child_nodes_tups \<equiv> [
         (is_element_ptr, set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast),
         (is_character_data_ptr, set_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast),
         (is_document_ptr, set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast)
      ]"
 
 definition a_set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   where
     "a_set_child_nodes ptr children = invoke a_set_child_nodes_tups ptr (children)"
 lemmas set_child_nodes_defs = a_set_child_nodes_def
 
 definition a_set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_set_child_nodes_locs ptr \<equiv> 
       (if is_element_ptr_kind ptr 
           then all_args (put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t (the (cast ptr)) RElement.child_nodes_update) else {}) \<union>
       (if is_document_ptr_kind ptr 
           then all_args (put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t (the (cast ptr)) document_element_update) else {})"
 end
 
 locale l_set_child_nodes_defs =
   fixes set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   fixes set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 locale l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_known_ptr known_ptr + 
   l_set_child_nodes_defs set_child_nodes set_child_nodes_locs +
   l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs 
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   and set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> (_, unit) dom_prog set" +
   assumes known_ptr_impl: "known_ptr = DocumentClass.known_ptr"
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes set_child_nodes_impl: "set_child_nodes = a_set_child_nodes"
   assumes set_child_nodes_locs_impl: "set_child_nodes_locs = a_set_child_nodes_locs"
 begin
 lemmas set_child_nodes_def = set_child_nodes_impl[unfolded a_set_child_nodes_def]
 lemmas set_child_nodes_locs_def = set_child_nodes_locs_impl[unfolded a_set_child_nodes_locs_def]
 
 lemma set_child_nodes_split:
   "P (invoke (a_set_child_nodes_tups @ xs) ptr (children)) =
     ((known_ptr ptr \<longrightarrow> P (set_child_nodes ptr children))
     \<and> (\<not>(known_ptr ptr) \<longrightarrow> P (invoke xs ptr (children))))"
   by(auto simp add: known_ptr_impl set_child_nodes_impl a_set_child_nodes_def 
           a_set_child_nodes_tups_def known_ptr_defs CharacterDataClass.known_ptr_defs 
           ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: invoke_splits)
 
 lemma set_child_nodes_split_asm:
   "P (invoke (a_set_child_nodes_tups @ xs) ptr (children)) =
     (\<not>((known_ptr ptr \<and> \<not>P (set_child_nodes ptr children))
     \<or> (\<not>(known_ptr ptr) \<and> \<not>P (invoke xs ptr (children)))))"
   by(auto simp add: known_ptr_impl set_child_nodes_impl a_set_child_nodes_def 
              a_set_child_nodes_tups_def known_ptr_defs CharacterDataClass.known_ptr_defs 
              ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: invoke_splits)[1]
 lemmas set_child_nodes_splits = set_child_nodes_split set_child_nodes_split_asm
 
 lemma set_child_nodes_writes: "writes (set_child_nodes_locs ptr) (set_child_nodes ptr children) h h'"
   apply(simp add: set_child_nodes_locs_impl set_child_nodes_impl a_set_child_nodes_def 
       a_set_child_nodes_tups_def a_set_child_nodes_locs_def)
   apply(split invoke_splits, rule conjI)+
      apply(auto)[1]
     apply(auto simp add: set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: writes_bind_pure 
       intro: writes_union_right_I split: list.splits)[1] 
         apply(auto intro: writes_union_right_I split: option.splits)[1]
        apply(auto intro: writes_union_right_I split: option.splits)[1]
       apply(auto intro: writes_union_right_I split: option.splits)[1]
      apply(auto intro: writes_union_right_I split: option.splits)[1]
     apply(auto intro: writes_union_right_I split: option.splits)[1]
    apply(auto intro: writes_union_right_I split: option.splits)[1] (*slow: ca. 1min *)
   apply(auto simp add: set_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: writes_bind_pure)[1]
   apply(auto simp add: set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro: writes_union_left_I 
       intro!: writes_bind_pure split: list.splits option.splits)[1]
   done
 
 lemma set_child_nodes_pointers_preserved:
   assumes "w \<in> set_child_nodes_locs object_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms(1) object_ptr_kinds_preserved[OF writes_singleton2 assms(2)]
   by(auto simp add: set_child_nodes_locs_impl all_args_def a_set_child_nodes_locs_def 
           split: if_splits)
 
 lemma set_child_nodes_typess_preserved:
   assumes "w \<in> set_child_nodes_locs object_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   using assms(1) type_wf_preserved[OF writes_singleton2 assms(2)]
   by(auto simp add: set_child_nodes_locs_impl type_wf_impl all_args_def a_set_child_nodes_locs_def
           split: if_splits)
 end
 
 locale l_set_child_nodes = l_type_wf + l_set_child_nodes_defs +
   assumes set_child_nodes_writes: 
    "writes (set_child_nodes_locs ptr) (set_child_nodes ptr children) h h'"
  assumes set_child_nodes_pointers_preserved: 
    "w \<in> set_child_nodes_locs object_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
  assumes set_child_nodes_types_preserved: 
    "w \<in> set_child_nodes_locs object_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
 
 global_interpretation l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   set_child_nodes = l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_child_nodes and
   set_child_nodes_locs = l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_child_nodes_locs .
 
 interpretation
   i_set_child_nodes?: l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr set_child_nodes set_child_nodes_locs
   apply(unfold_locales)
   by (auto simp add: set_child_nodes_def set_child_nodes_locs_def)
 declare l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 lemma set_child_nodes_is_l_set_child_nodes [instances]: 
   "l_set_child_nodes type_wf set_child_nodes set_child_nodes_locs"
   apply(unfold_locales)
   using set_child_nodes_pointers_preserved set_child_nodes_typess_preserved set_child_nodes_writes
   by blast+
 
 
 paragraph \<open>get\_child\_nodes\<close>
 
 locale l_set_child_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M = l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M + l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma set_child_nodes_get_child_nodes:
   assumes "known_ptr ptr"
   assumes "type_wf h"
   assumes "h \<turnstile> set_child_nodes ptr children \<rightarrow>\<^sub>h h'"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
 proof -
   have "h \<turnstile> check_in_heap ptr \<rightarrow>\<^sub>r ()"
     using assms set_child_nodes_impl[unfolded a_set_child_nodes_def] invoke_ptr_in_heap
     by (metis (full_types) check_in_heap_ptr_in_heap is_OK_returns_heap_I is_OK_returns_result_E 
         old.unit.exhaust)
   then have ptr_in_h: "ptr |\<in>| object_ptr_kinds h"
     by (simp add: check_in_heap_ptr_in_heap is_OK_returns_result_I)
 
   have "type_wf h'"
     apply(unfold type_wf_impl)
     apply(rule subst[where P=id, OF type_wf_preserved[OF set_child_nodes_writes assms(3), 
             unfolded all_args_def], simplified])
     by(auto simp add: all_args_def assms(2)[unfolded type_wf_impl] 
         set_child_nodes_locs_impl[unfolded a_set_child_nodes_locs_def]
         split: if_splits)
   have "h' \<turnstile> check_in_heap ptr \<rightarrow>\<^sub>r ()"
     using check_in_heap_reads set_child_nodes_writes assms(3) \<open>h \<turnstile> check_in_heap ptr \<rightarrow>\<^sub>r ()\<close> 
     apply(rule reads_writes_separate_forwards)
     by(auto simp add: all_args_def set_child_nodes_locs_impl[unfolded a_set_child_nodes_locs_def])
   then have "ptr |\<in>| object_ptr_kinds h'"
     using check_in_heap_ptr_in_heap by blast
   with assms ptr_in_h \<open>type_wf h'\<close> show ?thesis
     apply(auto simp add: get_child_nodes_impl set_child_nodes_impl type_wf_impl known_ptr_impl  
         a_get_child_nodes_def a_get_child_nodes_tups_def a_set_child_nodes_def 
         a_set_child_nodes_tups_def 
         del: bind_pure_returns_result_I2 
         intro!: bind_pure_returns_result_I2)[1]
     apply(split invoke_splits, rule conjI)
      apply(split invoke_splits, rule conjI)
       apply(split invoke_splits, rule conjI)
        apply(auto simp add: NodeClass.known_ptr_defs 
         dest!: known_ptr_not_document_ptr known_ptr_not_character_data_ptr 
         known_ptr_not_element_ptr)[1]                                                                                                                             
       apply(auto simp add: NodeClass.known_ptr_defs 
         dest!: known_ptr_not_document_ptr known_ptr_not_character_data_ptr 
         known_ptr_not_element_ptr)[1]                                                                                                                             
       apply(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
         split: list.splits option.splits 
         intro!: bind_pure_returns_result_I2 
         dest: get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok; auto dest: returns_result_eq 
         dest!: document_put_get[where getter = document_element])[1] (* slow, ca 1min *)
      apply(auto simp add: get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)[1]
     by(auto simp add: get_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def dest: element_put_get)
 qed
 
 lemma set_child_nodes_get_child_nodes_different_pointers: 
   assumes "ptr \<noteq> ptr'"
   assumes "w \<in> set_child_nodes_locs ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"   
   assumes "r \<in> get_child_nodes_locs ptr'"
   shows "r h h'"
   using assms
   apply(auto simp add: get_child_nodes_locs_impl set_child_nodes_locs_impl all_args_def 
       a_set_child_nodes_locs_def a_get_child_nodes_locs_def 
       split: if_splits option.splits )[1] 
    apply(rule is_document_ptr_kind_obtains) 
     apply(simp)
    apply(rule is_document_ptr_kind_obtains) 
     apply(auto)[1]
    apply(auto)[1]
   apply(rule is_element_ptr_kind_obtains) 
    apply(auto)[1]
   apply(auto)[1]
   apply(rule is_element_ptr_kind_obtains) 
-   apply(auto)
+   apply(auto)[1]
+  apply(auto)[1]
   done
 
 lemma set_child_nodes_element_ok [simp]:
   assumes "known_ptr ptr"
   assumes "type_wf h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "is_element_ptr_kind ptr"
   shows "h \<turnstile> ok (set_child_nodes ptr children)"
 proof -
   have "is_element_ptr ptr"
     using \<open>known_ptr ptr\<close> assms(4)
-    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
   then show ?thesis
     using assms
-    apply(auto simp add: set_child_nodes_def a_set_child_nodes_tups_def set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def split: option.splits)[1]
+    apply(auto simp add: set_child_nodes_def a_set_child_nodes_tups_def set_child_nodes\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        split: option.splits)[1]
     by (simp add: DocumentMonad.put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok local.type_wf_impl)
 qed
 
 lemma set_child_nodes_document1_ok [simp]:
   assumes "known_ptr ptr"
   assumes "type_wf h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "is_document_ptr_kind ptr"
   assumes "children = []"
   shows "h \<turnstile> ok (set_child_nodes ptr children)"
 proof -
   have "is_document_ptr ptr"
     using \<open>known_ptr ptr\<close> assms(4)
-    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
   then show ?thesis
     using assms
-    apply(auto simp add: set_child_nodes_def a_set_child_nodes_tups_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def split: option.splits)[1]
+    apply(auto simp add: set_child_nodes_def a_set_child_nodes_tups_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        split: option.splits)[1]
     by (simp add: DocumentMonad.put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok local.type_wf_impl)
 qed
 
 lemma set_child_nodes_document2_ok [simp]:
   assumes "known_ptr ptr"
   assumes "type_wf h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "is_document_ptr_kind ptr"
   assumes "children = [child]"
   assumes "is_element_ptr_kind child"
   shows "h \<turnstile> ok (set_child_nodes ptr children)"
 proof -
   have "is_document_ptr ptr"
     using \<open>known_ptr ptr\<close> assms(4)
-    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+    by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
   then show ?thesis
     using assms
-    apply(auto simp add: set_child_nodes_def a_set_child_nodes_tups_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)
+    apply(auto simp add: set_child_nodes_def a_set_child_nodes_tups_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)[1]
     apply(split invoke_splits, rule conjI)+
        apply(auto simp add: is_element_ptr_kind\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def split: option.splits)[1]
       apply(auto simp add: is_element_ptr_kind\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def split: option.splits)[1]
       apply (simp add: local.type_wf_impl put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok)
      apply(auto simp add: is_element_ptr_kind\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def split: option.splits)[1]
     by(auto simp add: is_element_ptr_kind\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def set_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def split: option.splits)[1]
 qed
 end
 
 locale l_set_child_nodes_get_child_nodes = l_get_child_nodes + l_set_child_nodes +
   assumes set_child_nodes_get_child_nodes: 
     "type_wf h \<Longrightarrow> known_ptr ptr 
                \<Longrightarrow> h \<turnstile> set_child_nodes ptr children \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes set_child_nodes_get_child_nodes_different_pointers: 
     "ptr \<noteq> ptr' \<Longrightarrow> w \<in> set_child_nodes_locs ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
                 \<Longrightarrow> r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
 
 interpretation
   i_set_child_nodes_get_child_nodes?: l_set_child_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
   known_ptr get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs
   by unfold_locales
 declare l_set_child_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_child_nodes_get_child_nodes_is_l_set_child_nodes_get_child_nodes [instances]: 
   "l_set_child_nodes_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs 
                                      set_child_nodes set_child_nodes_locs"
   using get_child_nodes_is_l_get_child_nodes set_child_nodes_is_l_set_child_nodes
   apply(auto simp add: l_set_child_nodes_get_child_nodes_def l_set_child_nodes_get_child_nodes_axioms_def)[1]
   using set_child_nodes_get_child_nodes apply blast
   using set_child_nodes_get_child_nodes_different_pointers apply metis
   done
 
 
 subsubsection \<open>get\_attribute\<close>
 
 locale l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 definition a_get_attribute :: "(_) element_ptr \<Rightarrow> attr_key \<Rightarrow> (_, attr_value option) dom_prog"
   where
     "a_get_attribute ptr k = do {m \<leftarrow> get_M ptr attrs; return (fmlookup m k)}"
 lemmas get_attribute_defs = a_get_attribute_def
 
 definition a_get_attribute_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   where
     "a_get_attribute_locs element_ptr = {preserved (get_M element_ptr attrs)}"
 end
 
 locale l_get_attribute_defs =
   fixes get_attribute :: "(_) element_ptr \<Rightarrow> attr_key \<Rightarrow> (_, attr_value option) dom_prog"
   fixes get_attribute_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_get_attribute_defs get_attribute get_attribute_locs +
   l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and get_attribute :: "(_) element_ptr \<Rightarrow> attr_key \<Rightarrow> (_, attr_value option) dom_prog"
   and get_attribute_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set" +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes get_attribute_impl: "get_attribute = a_get_attribute"
   assumes get_attribute_locs_impl: "get_attribute_locs = a_get_attribute_locs"
 begin
 lemma get_attribute_pure [simp]: "pure (get_attribute ptr k) h"
   by (auto simp add: bind_pure_I get_attribute_impl[unfolded a_get_attribute_def])
 
 lemma get_attribute_ok: 
   "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_attribute element_ptr k)"
   apply(unfold type_wf_impl)
   unfolding get_attribute_impl[unfolded a_get_attribute_def] using get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
   by (metis bind_is_OK_pure_I return_ok ElementMonad.get_M_pure)
     
 lemma get_attribute_ptr_in_heap: 
   "h \<turnstile> ok (get_attribute element_ptr k) \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h"
   unfolding get_attribute_impl[unfolded a_get_attribute_def]
   by (meson DocumentMonad.get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap bind_is_OK_E is_OK_returns_result_I)
 
 lemma get_attribute_reads: 
   "reads (get_attribute_locs element_ptr) (get_attribute element_ptr k) h h'"
   by(auto simp add: get_attribute_impl[unfolded a_get_attribute_def] 
                     get_attribute_locs_impl[unfolded a_get_attribute_locs_def] 
                     reads_insert_writes_set_right 
           intro!: reads_bind_pure)
 end
 
 locale l_get_attribute = l_type_wf + l_get_attribute_defs +
 assumes get_attribute_reads: 
   "reads (get_attribute_locs element_ptr) (get_attribute element_ptr k) h h'"
 assumes get_attribute_ok: 
   "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_attribute element_ptr k)"
 assumes get_attribute_ptr_in_heap: 
   "h \<turnstile> ok (get_attribute element_ptr k) \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h"
 assumes get_attribute_pure [simp]: "pure (get_attribute element_ptr k) h"
 
 global_interpretation l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   get_attribute = l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_attribute and
   get_attribute_locs = l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_attribute_locs .
 
 interpretation
   i_get_attribute?: l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_attribute get_attribute_locs
   apply(unfold_locales)
   by (auto simp add: get_attribute_def get_attribute_locs_def)
 declare l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_attribute_is_l_get_attribute [instances]: 
   "l_get_attribute type_wf get_attribute get_attribute_locs"
   apply(unfold_locales)
   using get_attribute_reads get_attribute_ok get_attribute_ptr_in_heap get_attribute_pure
   by blast+
 
 
 subsubsection \<open>set\_attribute\<close>
 
 locale l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 
 definition 
   a_set_attribute :: "(_) element_ptr \<Rightarrow> attr_key \<Rightarrow> attr_value option \<Rightarrow> (_, unit) dom_prog"
   where
     "a_set_attribute ptr k v = do {
       m \<leftarrow> get_M ptr attrs;
       put_M ptr attrs_update (if v = None then fmdrop k m else fmupd k (the v) m)
     }"
 
 definition a_set_attribute_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_set_attribute_locs element_ptr \<equiv> all_args (put_M element_ptr attrs_update)"
 end
 
 locale l_set_attribute_defs =
   fixes set_attribute :: "(_) element_ptr \<Rightarrow> attr_key \<Rightarrow> attr_value option \<Rightarrow> (_, unit) dom_prog"
   fixes set_attribute_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 locale l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_set_attribute_defs set_attribute set_attribute_locs +
   l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and set_attribute :: "(_) element_ptr \<Rightarrow> attr_key \<Rightarrow> attr_value option \<Rightarrow> (_, unit) dom_prog"
   and set_attribute_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set" +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes set_attribute_impl: "set_attribute = a_set_attribute"
   assumes set_attribute_locs_impl: "set_attribute_locs = a_set_attribute_locs"
 begin
 lemmas set_attribute_def = set_attribute_impl[folded a_set_attribute_def]
 lemmas set_attribute_locs_def = set_attribute_locs_impl[unfolded a_set_attribute_locs_def]
 
 lemma set_attribute_ok: "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_attribute element_ptr k v)"
   apply(unfold type_wf_impl)
   unfolding set_attribute_impl[unfolded a_set_attribute_def] using get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
   by(metis (no_types, lifting) DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ElementMonad.get_M_pure bind_is_OK_E 
                                bind_is_OK_pure_I is_OK_returns_result_I)
 
 lemma set_attribute_writes: 
   "writes (set_attribute_locs element_ptr) (set_attribute element_ptr k v) h h'"
   by(auto simp add: set_attribute_impl[unfolded a_set_attribute_def] 
                     set_attribute_locs_impl[unfolded a_set_attribute_locs_def] 
           intro: writes_bind_pure)
 end
 
 locale l_set_attribute = l_type_wf + l_set_attribute_defs +
   assumes set_attribute_writes: 
     "writes (set_attribute_locs element_ptr) (set_attribute element_ptr k v) h h'"
   assumes set_attribute_ok: 
     "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_attribute element_ptr k v)"
 
 global_interpretation l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   set_attribute = l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_attribute and
   set_attribute_locs = l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_attribute_locs .
 interpretation 
   i_set_attribute?: l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_attribute set_attribute_locs
   apply(unfold_locales)
   by (auto simp add: set_attribute_def set_attribute_locs_def)
 declare l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_attribute_is_l_set_attribute [instances]: 
   "l_set_attribute type_wf set_attribute set_attribute_locs"
   apply(unfold_locales)
   using set_attribute_ok set_attribute_writes
   by blast+
 
 
 paragraph \<open>get\_attribute\<close>
 
 locale l_set_attribute_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma set_attribute_get_attribute:
   "h \<turnstile> set_attribute ptr k v \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_attribute ptr k \<rightarrow>\<^sub>r v"
   by(auto simp add: set_attribute_impl[unfolded a_set_attribute_def] 
                     get_attribute_impl[unfolded a_get_attribute_def] 
           elim!: bind_returns_heap_E2 
           intro!: bind_pure_returns_result_I 
           elim: element_put_get)
 end
 
 locale l_set_attribute_get_attribute = l_get_attribute + l_set_attribute +
   assumes set_attribute_get_attribute:
     "h \<turnstile> set_attribute ptr k v \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_attribute ptr k \<rightarrow>\<^sub>r v"
 
 interpretation
   i_set_attribute_get_attribute?: l_set_attribute_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
                                   get_attribute get_attribute_locs set_attribute set_attribute_locs
   by(unfold_locales)
 declare l_set_attribute_get_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_attribute_get_attribute_is_l_set_attribute_get_attribute [instances]: 
   "l_set_attribute_get_attribute type_wf get_attribute get_attribute_locs set_attribute set_attribute_locs"
   using get_attribute_is_l_get_attribute set_attribute_is_l_set_attribute
   apply(simp add: l_set_attribute_get_attribute_def l_set_attribute_get_attribute_axioms_def)
   using set_attribute_get_attribute
   by blast
 
 paragraph \<open>get\_child\_nodes\<close>
 
 locale l_set_attribute_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_attribute_get_child_nodes:
   "\<forall>w \<in> set_attribute_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
   by(auto simp add: set_attribute_locs_def get_child_nodes_locs_def all_args_def 
           intro: element_put_get_preserved[where setter=attrs_update])
 end
 
 locale l_set_attribute_get_child_nodes =
   l_set_attribute +
   l_get_child_nodes +
   assumes set_attribute_get_child_nodes: 
          "\<forall>w \<in> set_attribute_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
 
 interpretation
   i_set_attribute_get_child_nodes?: l_set_attribute_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
                     set_attribute set_attribute_locs known_ptr get_child_nodes get_child_nodes_locs
   by unfold_locales
 declare l_set_attribute_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_attribute_get_child_nodes_is_l_set_attribute_get_child_nodes [instances]:
   "l_set_attribute_get_child_nodes type_wf set_attribute set_attribute_locs known_ptr 
                                    get_child_nodes get_child_nodes_locs"
   using set_attribute_is_l_set_attribute get_child_nodes_is_l_get_child_nodes
   apply(simp add: l_set_attribute_get_child_nodes_def l_set_attribute_get_child_nodes_axioms_def)
   using set_attribute_get_child_nodes
   by blast
 
 
 subsubsection \<open>get\_disconnected\_nodes\<close>
 
 locale l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 definition a_get_disconnected_nodes :: "(_) document_ptr
     \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   where
     "a_get_disconnected_nodes document_ptr = get_M document_ptr disconnected_nodes"
 lemmas get_disconnected_nodes_defs = a_get_disconnected_nodes_def
 
 definition a_get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   where
     "a_get_disconnected_nodes_locs document_ptr = {preserved (get_M document_ptr disconnected_nodes)}"
 end
 
 locale l_get_disconnected_nodes_defs = 
   fixes get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   fixes get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set" +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes get_disconnected_nodes_impl: "get_disconnected_nodes = a_get_disconnected_nodes"
   assumes get_disconnected_nodes_locs_impl: "get_disconnected_nodes_locs = a_get_disconnected_nodes_locs"
 begin
 lemmas 
   get_disconnected_nodes_def = get_disconnected_nodes_impl[unfolded a_get_disconnected_nodes_def]
 lemmas 
   get_disconnected_nodes_locs_def = get_disconnected_nodes_locs_impl[unfolded a_get_disconnected_nodes_locs_def]
 
 lemma get_disconnected_nodes_ok: 
   "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_disconnected_nodes document_ptr)"
   apply(unfold type_wf_impl)
   unfolding get_disconnected_nodes_impl[unfolded a_get_disconnected_nodes_def] using get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
   by fast
 
 lemma get_disconnected_nodes_ptr_in_heap: 
   "h \<turnstile> ok (get_disconnected_nodes document_ptr) \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h"
   unfolding get_disconnected_nodes_impl[unfolded a_get_disconnected_nodes_def]
   by (simp add: DocumentMonad.get_M_ptr_in_heap)
 
 lemma get_disconnected_nodes_pure [simp]: "pure (get_disconnected_nodes document_ptr) h"
   unfolding get_disconnected_nodes_impl[unfolded a_get_disconnected_nodes_def] by simp
 
 lemma get_disconnected_nodes_reads: 
   "reads (get_disconnected_nodes_locs document_ptr) (get_disconnected_nodes document_ptr) h h'"
   by(simp add: get_disconnected_nodes_impl[unfolded a_get_disconnected_nodes_def] 
                get_disconnected_nodes_locs_impl[unfolded a_get_disconnected_nodes_locs_def] 
                reads_bind_pure reads_insert_writes_set_right)
 end
 
 locale l_get_disconnected_nodes = l_type_wf + l_get_disconnected_nodes_defs +
   assumes get_disconnected_nodes_reads: 
     "reads (get_disconnected_nodes_locs document_ptr) (get_disconnected_nodes document_ptr) h h'"
   assumes get_disconnected_nodes_ok: 
     "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_disconnected_nodes document_ptr)"
   assumes get_disconnected_nodes_ptr_in_heap: 
     "h \<turnstile> ok (get_disconnected_nodes document_ptr) \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h"
   assumes get_disconnected_nodes_pure [simp]: 
    "pure (get_disconnected_nodes document_ptr) h"
 
 global_interpretation l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   get_disconnected_nodes = l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_disconnected_nodes and
   get_disconnected_nodes_locs = l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_disconnected_nodes_locs .
 interpretation 
   i_get_disconnected_nodes?: l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes 
                              get_disconnected_nodes_locs
   apply(unfold_locales)
   by (auto simp add: get_disconnected_nodes_def get_disconnected_nodes_locs_def)
 declare l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_disconnected_nodes_is_l_get_disconnected_nodes [instances]: 
   "l_get_disconnected_nodes type_wf get_disconnected_nodes get_disconnected_nodes_locs"
   apply(simp add: l_get_disconnected_nodes_def)
   using get_disconnected_nodes_reads get_disconnected_nodes_ok get_disconnected_nodes_ptr_in_heap 
         get_disconnected_nodes_pure
   by blast+
 
 
 paragraph \<open>set\_child\_nodes\<close>
 
 locale l_set_child_nodes_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   CD: l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_child_nodes_get_disconnected_nodes: 
   "\<forall>w \<in> a_set_child_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> a_get_disconnected_nodes_locs ptr'. r h h'))"
   by(auto simp add: a_set_child_nodes_locs_def a_get_disconnected_nodes_locs_def all_args_def)
 end
 
 locale l_set_child_nodes_get_disconnected_nodes = l_set_child_nodes + l_get_disconnected_nodes +
   assumes set_child_nodes_get_disconnected_nodes: 
   "\<forall>w \<in> set_child_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
 
 interpretation
   i_set_child_nodes_get_disconnected_nodes?: l_set_child_nodes_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
                                              known_ptr set_child_nodes set_child_nodes_locs 
                                              get_disconnected_nodes get_disconnected_nodes_locs
   by(unfold_locales)
 declare l_set_child_nodes_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_child_nodes_get_disconnected_nodes_is_l_set_child_nodes_get_disconnected_nodes [instances]:
   "l_set_child_nodes_get_disconnected_nodes type_wf set_child_nodes set_child_nodes_locs 
                                             get_disconnected_nodes get_disconnected_nodes_locs"
   using set_child_nodes_is_l_set_child_nodes get_disconnected_nodes_is_l_get_disconnected_nodes
   apply(simp add: l_set_child_nodes_get_disconnected_nodes_def 
                   l_set_child_nodes_get_disconnected_nodes_axioms_def)
   using set_child_nodes_get_disconnected_nodes
   by fast
 
 
 paragraph \<open>set\_attribute\<close>
 
 locale l_set_attribute_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_attribute_get_disconnected_nodes: 
   "\<forall>w \<in> a_set_attribute_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> a_get_disconnected_nodes_locs ptr'. r h h'))"
   by(auto simp add: a_set_attribute_locs_def a_get_disconnected_nodes_locs_def all_args_def)
 end
 
 locale l_set_attribute_get_disconnected_nodes = l_set_attribute + l_get_disconnected_nodes +
   assumes set_attribute_get_disconnected_nodes: 
   "\<forall>w \<in> set_attribute_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
 
 interpretation
   i_set_attribute_get_disconnected_nodes?: l_set_attribute_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
                 set_attribute set_attribute_locs get_disconnected_nodes get_disconnected_nodes_locs
   by(unfold_locales)
 declare l_set_attribute_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_attribute_get_disconnected_nodes_is_l_set_attribute_get_disconnected_nodes [instances]:
   "l_set_attribute_get_disconnected_nodes type_wf set_attribute set_attribute_locs 
                                           get_disconnected_nodes get_disconnected_nodes_locs"
   using set_attribute_is_l_set_attribute get_disconnected_nodes_is_l_get_disconnected_nodes
   apply(simp add: l_set_attribute_get_disconnected_nodes_def 
                   l_set_attribute_get_disconnected_nodes_axioms_def)
   using set_attribute_get_disconnected_nodes
   by fast
 
 
 paragraph \<open>new\_element\<close>
 
 locale l_new_element_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma get_disconnected_nodes_new_element:  
    "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>h h'
         \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
   by(auto simp add: get_disconnected_nodes_locs_def new_element_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
 end
 
 locale l_new_element_get_disconnected_nodes = l_get_disconnected_nodes_defs +
   assumes get_disconnected_nodes_new_element:  
    "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>h h'
         \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
 
 interpretation i_new_element_get_disconnected_nodes?: 
   l_new_element_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes 
   get_disconnected_nodes_locs
   by unfold_locales
 declare l_new_element_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma new_element_get_disconnected_nodes_is_l_new_element_get_disconnected_nodes [instances]:
   "l_new_element_get_disconnected_nodes get_disconnected_nodes_locs"
   by (simp add: get_disconnected_nodes_new_element l_new_element_get_disconnected_nodes_def)
 
 
 paragraph \<open>new\_character\_data\<close>
 
 locale l_new_character_data_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma get_disconnected_nodes_new_character_data:  
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'
        \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
   by(auto simp add: get_disconnected_nodes_locs_def new_character_data_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
 end
 
 locale l_new_character_data_get_disconnected_nodes = l_get_disconnected_nodes_defs +
   assumes get_disconnected_nodes_new_character_data:  
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'
        \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
 
 interpretation i_new_character_data_get_disconnected_nodes?: 
   l_new_character_data_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes 
                                                     get_disconnected_nodes_locs
   by unfold_locales
 declare l_new_character_data_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma new_character_data_get_disconnected_nodes_is_l_new_character_data_get_disconnected_nodes [instances]:
   "l_new_character_data_get_disconnected_nodes get_disconnected_nodes_locs"
   by (simp add: get_disconnected_nodes_new_character_data l_new_character_data_get_disconnected_nodes_def)
 
 
 paragraph \<open>new\_document\<close>
 
 locale l_new_document_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma get_disconnected_nodes_new_document_different_pointers:  
   "new_document_ptr \<noteq> ptr' \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h'
     \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
   by(auto simp add: get_disconnected_nodes_locs_def new_document_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
 
 lemma new_document_no_disconnected_nodes:
   "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []"
   by(simp add: get_disconnected_nodes_def new_document_disconnected_nodes)
   
 end
 
 interpretation i_new_document_get_disconnected_nodes?: 
   l_new_document_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs
   by unfold_locales
 declare l_new_document_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 locale l_new_document_get_disconnected_nodes = l_get_disconnected_nodes_defs +
   assumes get_disconnected_nodes_new_document_different_pointers:  
   "new_document_ptr \<noteq> ptr' \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h'
     \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
   assumes new_document_no_disconnected_nodes:
   "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []"
 
 lemma new_document_get_disconnected_nodes_is_l_new_document_get_disconnected_nodes [instances]:
   "l_new_document_get_disconnected_nodes get_disconnected_nodes get_disconnected_nodes_locs"
   apply (auto simp add: l_new_document_get_disconnected_nodes_def)[1]
   using get_disconnected_nodes_new_document_different_pointers apply fast
   using new_document_no_disconnected_nodes apply blast
   done
 
 
 
 subsubsection \<open>set\_disconnected\_nodes\<close>
 
 locale l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 
 definition a_set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   where
-    "a_set_disconnected_nodes document_ptr disc_nodes = put_M document_ptr disconnected_nodes_update disc_nodes"
+    "a_set_disconnected_nodes document_ptr disc_nodes =
+put_M document_ptr disconnected_nodes_update disc_nodes"
 lemmas set_disconnected_nodes_defs = a_set_disconnected_nodes_def
 
 definition a_set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_set_disconnected_nodes_locs document_ptr \<equiv> all_args (put_M document_ptr disconnected_nodes_update)"
 end
 
 locale l_set_disconnected_nodes_defs =
   fixes set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   fixes set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 locale l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf + 
   l_set_disconnected_nodes_defs set_disconnected_nodes set_disconnected_nodes_locs +
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> (_, unit) dom_prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> (_, unit) dom_prog set" +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes set_disconnected_nodes_impl: "set_disconnected_nodes = a_set_disconnected_nodes"
   assumes set_disconnected_nodes_locs_impl: "set_disconnected_nodes_locs = a_set_disconnected_nodes_locs"
 begin
 lemmas set_disconnected_nodes_def = set_disconnected_nodes_impl[unfolded a_set_disconnected_nodes_def]
-lemmas set_disconnected_nodes_locs_def = set_disconnected_nodes_locs_impl[unfolded a_set_disconnected_nodes_locs_def]
+lemmas set_disconnected_nodes_locs_def =
+  set_disconnected_nodes_locs_impl[unfolded a_set_disconnected_nodes_locs_def]
 lemma set_disconnected_nodes_ok:
-  "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_disconnected_nodes document_ptr node_ptrs)"
-  by (simp add: type_wf_impl put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok set_disconnected_nodes_impl[unfolded a_set_disconnected_nodes_def])
+  "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow>
+h \<turnstile> ok (set_disconnected_nodes document_ptr node_ptrs)"
+  by (simp add: type_wf_impl put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
+      set_disconnected_nodes_impl[unfolded a_set_disconnected_nodes_def])
 
 lemma set_disconnected_nodes_ptr_in_heap: 
   "h \<turnstile> ok (set_disconnected_nodes document_ptr disc_nodes) \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h"
   by (simp add: set_disconnected_nodes_impl[unfolded a_set_disconnected_nodes_def] 
                 DocumentMonad.put_M_ptr_in_heap)
 
 lemma set_disconnected_nodes_writes: 
   "writes (set_disconnected_nodes_locs document_ptr) (set_disconnected_nodes document_ptr disc_nodes) h h'"
   by(auto simp add: set_disconnected_nodes_impl[unfolded a_set_disconnected_nodes_def] 
                     set_disconnected_nodes_locs_impl[unfolded a_set_disconnected_nodes_locs_def] 
           intro: writes_bind_pure)
 
 lemma set_disconnected_nodes_pointers_preserved:
   assumes "w \<in> set_disconnected_nodes_locs object_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms(1) object_ptr_kinds_preserved[OF writes_singleton2 assms(2)]
   by(auto simp add: all_args_def  set_disconnected_nodes_locs_impl[unfolded 
                     a_set_disconnected_nodes_locs_def] 
           split: if_splits)
 
 lemma set_disconnected_nodes_typess_preserved:
   assumes "w \<in> set_disconnected_nodes_locs object_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   using assms(1) type_wf_preserved[OF writes_singleton2 assms(2)]
   apply(unfold type_wf_impl)
   by(auto simp add: all_args_def 
                     set_disconnected_nodes_locs_impl[unfolded a_set_disconnected_nodes_locs_def] 
           split: if_splits)
 end
 
 locale l_set_disconnected_nodes = l_type_wf + l_set_disconnected_nodes_defs +
   assumes set_disconnected_nodes_writes: 
-    "writes (set_disconnected_nodes_locs document_ptr) (set_disconnected_nodes document_ptr disc_nodes) h h'"
+    "writes (set_disconnected_nodes_locs document_ptr)
+(set_disconnected_nodes document_ptr disc_nodes) h h'"
   assumes set_disconnected_nodes_ok: 
-    "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_disconnected_nodes document_ptr disc_noded)"
+    "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow>
+h \<turnstile> ok (set_disconnected_nodes document_ptr disc_noded)"
   assumes set_disconnected_nodes_ptr_in_heap: 
-    "h \<turnstile> ok (set_disconnected_nodes document_ptr disc_noded) \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h"
+    "h \<turnstile> ok (set_disconnected_nodes document_ptr disc_noded) \<Longrightarrow>
+document_ptr |\<in>| document_ptr_kinds h"
   assumes set_disconnected_nodes_pointers_preserved: 
-   "w \<in> set_disconnected_nodes_locs document_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
+    "w \<in> set_disconnected_nodes_locs document_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow>
+object_ptr_kinds h = object_ptr_kinds h'"
  assumes set_disconnected_nodes_types_preserved: 
    "w \<in> set_disconnected_nodes_locs document_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
 
 global_interpretation l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   set_disconnected_nodes = l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_disconnected_nodes and
   set_disconnected_nodes_locs = l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_disconnected_nodes_locs .
 interpretation 
   i_set_disconnected_nodes?: l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_disconnected_nodes 
                              set_disconnected_nodes_locs
   apply unfold_locales
   by (auto simp add: set_disconnected_nodes_def set_disconnected_nodes_locs_def)
 declare l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_disconnected_nodes_is_l_set_disconnected_nodes [instances]: 
   "l_set_disconnected_nodes type_wf set_disconnected_nodes set_disconnected_nodes_locs"
   apply(simp add: l_set_disconnected_nodes_def)
-  using set_disconnected_nodes_ok set_disconnected_nodes_writes set_disconnected_nodes_pointers_preserved 
+  using set_disconnected_nodes_ok set_disconnected_nodes_writes
+    set_disconnected_nodes_pointers_preserved
         set_disconnected_nodes_ptr_in_heap set_disconnected_nodes_typess_preserved
   by blast+
 
 
 paragraph \<open>get\_disconnected\_nodes\<close>
 
 locale l_set_disconnected_nodes_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M = l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M 
                                                              + l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_disconnected_nodes_get_disconnected_nodes:
   assumes "h \<turnstile> a_set_disconnected_nodes document_ptr disc_nodes \<rightarrow>\<^sub>h h'"
   shows "h' \<turnstile> a_get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   using assms 
   by(auto simp add: a_get_disconnected_nodes_def a_set_disconnected_nodes_def)
 
 lemma set_disconnected_nodes_get_disconnected_nodes_different_pointers: 
   assumes "ptr \<noteq> ptr'"
   assumes "w \<in> a_set_disconnected_nodes_locs ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"   
   assumes "r \<in> a_get_disconnected_nodes_locs ptr'"
   shows "r h h'"
   using assms
   by(auto simp add: all_args_def a_set_disconnected_nodes_locs_def a_get_disconnected_nodes_locs_def 
              split: if_splits option.splits )
 end
 
 locale l_set_disconnected_nodes_get_disconnected_nodes = l_get_disconnected_nodes 
                                                        + l_set_disconnected_nodes +
   assumes set_disconnected_nodes_get_disconnected_nodes: 
   "h \<turnstile> set_disconnected_nodes document_ptr disc_nodes \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   assumes set_disconnected_nodes_get_disconnected_nodes_different_pointers: 
   "ptr \<noteq> ptr' \<Longrightarrow> w \<in> set_disconnected_nodes_locs ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> r \<in> get_disconnected_nodes_locs ptr' \<Longrightarrow> r h h'"
 
 interpretation i_set_disconnected_nodes_get_disconnected_nodes?:
   l_set_disconnected_nodes_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes 
                      get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
   by unfold_locales
 declare l_set_disconnected_nodes_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
-lemma set_disconnected_nodes_get_disconnected_nodes_is_l_set_disconnected_nodes_get_disconnected_nodes [instances]:
+lemma set_disconnected_nodes_get_disconnected_nodes_is_l_set_disconnected_nodes_get_disconnected_nodes
+  [instances]:
   "l_set_disconnected_nodes_get_disconnected_nodes  type_wf get_disconnected_nodes get_disconnected_nodes_locs 
                                                     set_disconnected_nodes set_disconnected_nodes_locs"
   using set_disconnected_nodes_is_l_set_disconnected_nodes get_disconnected_nodes_is_l_get_disconnected_nodes
   apply(simp add: l_set_disconnected_nodes_get_disconnected_nodes_def 
                   l_set_disconnected_nodes_get_disconnected_nodes_axioms_def)
   using set_disconnected_nodes_get_disconnected_nodes 
         set_disconnected_nodes_get_disconnected_nodes_different_pointers
   by fast+
 
 
 paragraph \<open>get\_child\_nodes\<close>
 
 locale l_set_disconnected_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_disconnected_nodes_get_child_nodes: 
   "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
   by(auto simp add: set_disconnected_nodes_locs_impl[unfolded a_set_disconnected_nodes_locs_def] 
                     get_child_nodes_locs_impl[unfolded a_get_child_nodes_locs_def] all_args_def)
 end
 
 locale l_set_disconnected_nodes_get_child_nodes = l_set_disconnected_nodes_defs + l_get_child_nodes_defs +
   assumes set_disconnected_nodes_get_child_nodes [simp]: 
     "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
 
 interpretation
   i_set_disconnected_nodes_get_child_nodes?: l_set_disconnected_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M 
                                              type_wf 
                                              set_disconnected_nodes set_disconnected_nodes_locs 
                                              known_ptr get_child_nodes get_child_nodes_locs
   by unfold_locales
 declare l_set_disconnected_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_disconnected_nodes_get_child_nodes_is_l_set_disconnected_nodes_get_child_nodes [instances]:
   "l_set_disconnected_nodes_get_child_nodes set_disconnected_nodes_locs get_child_nodes_locs"
   using set_disconnected_nodes_is_l_set_disconnected_nodes get_child_nodes_is_l_get_child_nodes
   apply(simp add: l_set_disconnected_nodes_get_child_nodes_def)
   using set_disconnected_nodes_get_child_nodes
   by fast
 
 
 subsubsection \<open>get\_tag\_name\<close>
 
 locale l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
-definition a_get_tag_name :: "(_) element_ptr \<Rightarrow> (_, tag_type) dom_prog"
+definition a_get_tag_name :: "(_) element_ptr \<Rightarrow> (_, tag_name) dom_prog"
   where
-    "a_get_tag_name element_ptr = get_M element_ptr tag_type"
+    "a_get_tag_name element_ptr = get_M element_ptr tag_name"
 
 definition a_get_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   where
-    "a_get_tag_name_locs element_ptr \<equiv> {preserved (get_M element_ptr tag_type)}"
+    "a_get_tag_name_locs element_ptr \<equiv> {preserved (get_M element_ptr tag_name)}"
 end
 
 locale l_get_tag_name_defs =
-  fixes get_tag_name :: "(_) element_ptr \<Rightarrow> (_, tag_type) dom_prog"
+  fixes get_tag_name :: "(_) element_ptr \<Rightarrow> (_, tag_name) dom_prog"
   fixes get_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_get_tag_name_defs get_tag_name get_tag_name_locs +
   l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs 
   for type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_tag_name :: "(_) element_ptr \<Rightarrow> (_, tag_type) dom_prog"
+    and get_tag_name :: "(_) element_ptr \<Rightarrow> (_, tag_name) dom_prog"
   and get_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set" +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes get_tag_name_impl: "get_tag_name = a_get_tag_name"
   assumes get_tag_name_locs_impl: "get_tag_name_locs = a_get_tag_name_locs"
 begin
 lemmas get_tag_name_def = get_tag_name_impl[unfolded a_get_tag_name_def]
 lemmas get_tag_name_locs_def = get_tag_name_locs_impl[unfolded a_get_tag_name_locs_def]
 
 
 
 lemma get_tag_name_ok: 
   "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_tag_name element_ptr)"
   apply(unfold type_wf_impl get_tag_name_impl[unfolded a_get_tag_name_def])
   using get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
   by blast
 
 lemma get_tag_name_pure [simp]: "pure (get_tag_name element_ptr) h"
   unfolding get_tag_name_impl[unfolded a_get_tag_name_def]
   by simp
 
 lemma get_tag_name_ptr_in_heap [simp]:
   assumes "h \<turnstile> get_tag_name element_ptr \<rightarrow>\<^sub>r children"
   shows "element_ptr |\<in>| element_ptr_kinds h"
   using assms
   by(auto simp add: get_tag_name_impl[unfolded a_get_tag_name_def] get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap 
           dest: is_OK_returns_result_I)
 
 lemma get_tag_name_reads: "reads (get_tag_name_locs element_ptr) (get_tag_name element_ptr) h h'"
   by(simp add: get_tag_name_impl[unfolded a_get_tag_name_def] 
                get_tag_name_locs_impl[unfolded a_get_tag_name_locs_def] reads_bind_pure 
                reads_insert_writes_set_right)
 end
 
 locale l_get_tag_name = l_type_wf + l_get_tag_name_defs +
   assumes get_tag_name_reads: 
     "reads (get_tag_name_locs element_ptr) (get_tag_name element_ptr) h h'"
   assumes get_tag_name_ok: 
     "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_tag_name element_ptr)"
   assumes get_tag_name_ptr_in_heap: 
     "h \<turnstile> ok (get_tag_name element_ptr) \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h"
   assumes get_tag_name_pure [simp]: 
     "pure (get_tag_name element_ptr) h"
 
 
 global_interpretation l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   get_tag_name = l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_tag_name and
   get_tag_name_locs = l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_tag_name_locs .
 
 interpretation
   i_get_tag_name?: l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_tag_name get_tag_name_locs
   apply(unfold_locales)
   by (auto simp add: get_tag_name_def get_tag_name_locs_def)
 declare l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_tag_name_is_l_get_tag_name [instances]: 
   "l_get_tag_name type_wf get_tag_name get_tag_name_locs"
   apply(unfold_locales)
   using get_tag_name_reads get_tag_name_ok get_tag_name_ptr_in_heap get_tag_name_pure
   by blast+
 
 
 paragraph \<open>set\_disconnected\_nodes\<close>
 
 locale l_set_disconnected_nodes_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_disconnected_nodes_get_tag_name: 
   "\<forall>w \<in> a_set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> a_get_tag_name_locs ptr'. r h h'))"
   by(auto simp add: a_set_disconnected_nodes_locs_def a_get_tag_name_locs_def all_args_def)
 end
 
 locale l_set_disconnected_nodes_get_tag_name = l_set_disconnected_nodes + l_get_tag_name +
   assumes set_disconnected_nodes_get_tag_name: 
   "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_tag_name_locs ptr'. r h h'))"
 
 interpretation
   i_set_disconnected_nodes_get_tag_name?: l_set_disconnected_nodes_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
                                           set_disconnected_nodes set_disconnected_nodes_locs 
                                           get_tag_name get_tag_name_locs
   by unfold_locales
 declare l_set_disconnected_nodes_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_disconnected_nodes_get_tag_name_is_l_set_disconnected_nodes_get_tag_name [instances]:
   "l_set_disconnected_nodes_get_tag_name type_wf set_disconnected_nodes set_disconnected_nodes_locs 
                                          get_tag_name get_tag_name_locs"
   using set_disconnected_nodes_is_l_set_disconnected_nodes get_tag_name_is_l_get_tag_name
   apply(simp add: l_set_disconnected_nodes_get_tag_name_def l_set_disconnected_nodes_get_tag_name_axioms_def)
   using set_disconnected_nodes_get_tag_name
   by fast
 
 
 paragraph \<open>set\_child\_nodes\<close>
 
 locale l_set_child_nodes_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_child_nodes_get_tag_name: 
   "\<forall>w \<in> set_child_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_tag_name_locs ptr'. r h h'))"
   by(auto simp add: set_child_nodes_locs_def get_tag_name_locs_def all_args_def 
-          intro: element_put_get_preserved[where getter=tag_type and setter=child_nodes_update])
+      intro: element_put_get_preserved[where getter=tag_name and setter=child_nodes_update])
 end
 
 locale l_set_child_nodes_get_tag_name = l_set_child_nodes + l_get_tag_name +
   assumes set_child_nodes_get_tag_name: 
     "\<forall>w \<in> set_child_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_tag_name_locs ptr'. r h h'))"
 
 interpretation
   i_set_child_nodes_get_tag_name?: l_set_child_nodes_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr 
                                    set_child_nodes set_child_nodes_locs get_tag_name get_tag_name_locs
   by unfold_locales
 declare l_set_child_nodes_get_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_child_nodes_get_tag_name_is_l_set_child_nodes_get_tag_name [instances]:
   "l_set_child_nodes_get_tag_name type_wf set_child_nodes set_child_nodes_locs get_tag_name get_tag_name_locs"
   using set_child_nodes_is_l_set_child_nodes get_tag_name_is_l_get_tag_name
   apply(simp add: l_set_child_nodes_get_tag_name_def l_set_child_nodes_get_tag_name_axioms_def)
   using set_child_nodes_get_tag_name
   by fast
 
 
 subsubsection \<open>set\_tag\_type\<close>
 
-locale l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
+locale l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 
-definition a_set_tag_type :: "(_) element_ptr \<Rightarrow> tag_type \<Rightarrow> (_, unit) dom_prog"
+definition a_set_tag_name :: "(_) element_ptr \<Rightarrow> tag_name \<Rightarrow> (_, unit) dom_prog"
   where
-    "a_set_tag_type ptr tag = do {
+    "a_set_tag_name ptr tag = do {
       m \<leftarrow> get_M ptr attrs;
-      put_M ptr tag_type_update tag
+      put_M ptr tag_name_update tag
     }"
-lemmas set_tag_type_defs = a_set_tag_type_def
-
-definition a_set_tag_type_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set"
+lemmas set_tag_name_defs = a_set_tag_name_def
+
+definition a_set_tag_name_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
-    "a_set_tag_type_locs element_ptr \<equiv> all_args (put_M element_ptr tag_type_update)"
+    "a_set_tag_name_locs element_ptr \<equiv> all_args (put_M element_ptr tag_name_update)"
 end
 
-locale l_set_tag_type_defs =
-  fixes set_tag_type :: "(_) element_ptr \<Rightarrow> tag_type \<Rightarrow> (_, unit) dom_prog"
-  fixes set_tag_type_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set"
-
-locale l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+locale l_set_tag_name_defs =
+  fixes set_tag_name :: "(_) element_ptr \<Rightarrow> tag_name \<Rightarrow> (_, unit) dom_prog"
+  fixes set_tag_name_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set"
+
+locale l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
-  l_set_tag_type_defs set_tag_type set_tag_type_locs +
-  l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs 
+  l_set_tag_name_defs set_tag_name set_tag_name_locs +
+  l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
-  and set_tag_type :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> (_, unit) dom_prog"
-  and set_tag_type_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set" +
+    and set_tag_name :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> (_, unit) dom_prog"
+    and set_tag_name_locs :: "(_) element_ptr \<Rightarrow> (_, unit) dom_prog set" +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
-  assumes set_tag_type_impl: "set_tag_type = a_set_tag_type"
-  assumes set_tag_type_locs_impl: "set_tag_type_locs = a_set_tag_type_locs"
+  assumes set_tag_name_impl: "set_tag_name = a_set_tag_name"
+  assumes set_tag_name_locs_impl: "set_tag_name_locs = a_set_tag_name_locs"
 begin
 
-lemma set_tag_type_ok: 
-  "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_tag_type element_ptr tag)"
+lemma set_tag_name_ok:
+  "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_tag_name element_ptr tag)"
   apply(unfold type_wf_impl)
-  unfolding set_tag_type_impl[unfolded a_set_tag_type_def] using get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
+  unfolding set_tag_name_impl[unfolded a_set_tag_name_def] using get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok
   by (metis (no_types, lifting) DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ElementMonad.get_M_pure bind_is_OK_E 
                                 bind_is_OK_pure_I is_OK_returns_result_I)
 
-lemma set_tag_type_writes: 
-  "writes (set_tag_type_locs element_ptr) (set_tag_type element_ptr tag) h h'"
-  by(auto simp add: set_tag_type_impl[unfolded a_set_tag_type_def] 
-                    set_tag_type_locs_impl[unfolded a_set_tag_type_locs_def] intro: writes_bind_pure)
-
-lemma set_tag_type_pointers_preserved:
-  assumes "w \<in> set_tag_type_locs element_ptr"
+lemma set_tag_name_writes:
+  "writes (set_tag_name_locs element_ptr) (set_tag_name element_ptr tag) h h'"
+  by(auto simp add: set_tag_name_impl[unfolded a_set_tag_name_def]
+      set_tag_name_locs_impl[unfolded a_set_tag_name_locs_def] intro: writes_bind_pure)
+
+lemma set_tag_name_pointers_preserved:
+  assumes "w \<in> set_tag_name_locs element_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms(1) object_ptr_kinds_preserved[OF writes_singleton2 assms(2)]
-  by(auto simp add: all_args_def set_tag_type_locs_impl[unfolded a_set_tag_type_locs_def] 
+  by(auto simp add: all_args_def set_tag_name_locs_impl[unfolded a_set_tag_name_locs_def]
           split: if_splits)
 
-lemma set_tag_type_typess_preserved:
-  assumes "w \<in> set_tag_type_locs element_ptr"
+lemma set_tag_name_typess_preserved:
+  assumes "w \<in> set_tag_name_locs element_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   apply(unfold type_wf_impl)
   using assms(1) type_wf_preserved[OF writes_singleton2 assms(2)]
-  by(auto simp add: all_args_def set_tag_type_locs_impl[unfolded a_set_tag_type_locs_def] 
+  by(auto simp add: all_args_def set_tag_name_locs_impl[unfolded a_set_tag_name_locs_def]
           split: if_splits)
 end
 
-locale l_set_tag_type = l_type_wf + l_set_tag_type_defs +
-  assumes set_tag_type_writes: 
-    "writes (set_tag_type_locs element_ptr) (set_tag_type element_ptr tag) h h'"
-  assumes set_tag_type_ok: 
-    "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_tag_type element_ptr tag)"
-  assumes set_tag_type_pointers_preserved: 
-    "w \<in> set_tag_type_locs element_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
-  assumes set_tag_type_types_preserved: 
-    "w \<in> set_tag_type_locs element_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
-
-
-global_interpretation l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
-  set_tag_type = l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_tag_type and
-  set_tag_type_locs = l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_tag_type_locs .
+locale l_set_tag_name = l_type_wf + l_set_tag_name_defs +
+  assumes set_tag_name_writes:
+    "writes (set_tag_name_locs element_ptr) (set_tag_name element_ptr tag) h h'"
+  assumes set_tag_name_ok:
+    "type_wf h \<Longrightarrow> element_ptr |\<in>| element_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_tag_name element_ptr tag)"
+  assumes set_tag_name_pointers_preserved:
+    "w \<in> set_tag_name_locs element_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
+  assumes set_tag_name_types_preserved:
+    "w \<in> set_tag_name_locs element_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
+
+
+global_interpretation l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
+  set_tag_name = l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_tag_name and
+  set_tag_name_locs = l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_tag_name_locs .
 interpretation 
-  i_set_tag_type?: l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_tag_type set_tag_type_locs
+  i_set_tag_name?: l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_tag_name set_tag_name_locs
   apply(unfold_locales)
-  by (auto simp add: set_tag_type_def set_tag_type_locs_def)
-declare l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
-
-lemma set_tag_type_is_l_set_tag_type [instances]: 
-  "l_set_tag_type type_wf set_tag_type set_tag_type_locs"
-  apply(simp add: l_set_tag_type_def)
-  using set_tag_type_ok set_tag_type_writes set_tag_type_pointers_preserved 
-        set_tag_type_typess_preserved
+  by (auto simp add: set_tag_name_def set_tag_name_locs_def)
+declare l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
+
+lemma set_tag_name_is_l_set_tag_name [instances]:
+  "l_set_tag_name type_wf set_tag_name set_tag_name_locs"
+  apply(simp add: l_set_tag_name_def)
+  using set_tag_name_ok set_tag_name_writes set_tag_name_pointers_preserved
+    set_tag_name_typess_preserved
   by blast
 
 paragraph \<open>get\_child\_nodes\<close>
 
-locale l_set_tag_type_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
-  l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+locale l_set_tag_name_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
-lemma set_tag_type_get_child_nodes: 
-  "\<forall>w \<in> set_tag_type_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
-  by(auto simp add: set_tag_type_locs_impl[unfolded a_set_tag_type_locs_def] 
+lemma set_tag_name_get_child_nodes:
+  "\<forall>w \<in> set_tag_name_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
+  by(auto simp add: set_tag_name_locs_impl[unfolded a_set_tag_name_locs_def]
                     get_child_nodes_locs_impl[unfolded a_get_child_nodes_locs_def] all_args_def 
-          intro: element_put_get_preserved[where setter=tag_type_update and getter=child_nodes])
+      intro: element_put_get_preserved[where setter=tag_name_update and getter=child_nodes])
 end
 
-locale l_set_tag_type_get_child_nodes = l_set_tag_type + l_get_child_nodes +
-  assumes set_tag_type_get_child_nodes: 
-    "\<forall>w \<in> set_tag_type_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
+locale l_set_tag_name_get_child_nodes = l_set_tag_name + l_get_child_nodes +
+  assumes set_tag_name_get_child_nodes:
+    "\<forall>w \<in> set_tag_name_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
 
 interpretation
-  i_set_tag_type_get_child_nodes?: l_set_tag_type_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
-                                   set_tag_type set_tag_type_locs known_ptr 
+  i_set_tag_name_get_child_nodes?: l_set_tag_name_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf
+  set_tag_name set_tag_name_locs known_ptr
                                    get_child_nodes get_child_nodes_locs
   by unfold_locales
-declare l_set_tag_type_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
-
-lemma set_tag_type_get_child_nodes_is_l_set_tag_type_get_child_nodes [instances]:
-  "l_set_tag_type_get_child_nodes type_wf set_tag_type set_tag_type_locs known_ptr get_child_nodes 
+declare l_set_tag_name_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
+
+lemma set_tag_name_get_child_nodes_is_l_set_tag_name_get_child_nodes [instances]:
+  "l_set_tag_name_get_child_nodes type_wf set_tag_name set_tag_name_locs known_ptr get_child_nodes
                                   get_child_nodes_locs"
-  using set_tag_type_is_l_set_tag_type get_child_nodes_is_l_get_child_nodes
-  apply(simp add: l_set_tag_type_get_child_nodes_def l_set_tag_type_get_child_nodes_axioms_def)
-  using set_tag_type_get_child_nodes
+  using set_tag_name_is_l_set_tag_name get_child_nodes_is_l_get_child_nodes
+  apply(simp add: l_set_tag_name_get_child_nodes_def l_set_tag_name_get_child_nodes_axioms_def)
+  using set_tag_name_get_child_nodes
   by fast
 
 
 paragraph \<open>get\_disconnected\_nodes\<close>
 
-locale l_set_tag_type_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
-  l_set_tag_type\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+locale l_set_tag_name_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
+  l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
-lemma set_tag_type_get_disconnected_nodes: 
-  "\<forall>w \<in> set_tag_type_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
-  by(auto simp add: set_tag_type_locs_impl[unfolded a_set_tag_type_locs_def] 
+lemma set_tag_name_get_disconnected_nodes:
+  "\<forall>w \<in> set_tag_name_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
+  by(auto simp add: set_tag_name_locs_impl[unfolded a_set_tag_name_locs_def]
                     get_disconnected_nodes_locs_impl[unfolded a_get_disconnected_nodes_locs_def] 
                     all_args_def)
 end
 
-locale l_set_tag_type_get_disconnected_nodes = l_set_tag_type + l_get_disconnected_nodes +
-  assumes set_tag_type_get_disconnected_nodes: 
-   "\<forall>w \<in> set_tag_type_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
+locale l_set_tag_name_get_disconnected_nodes = l_set_tag_name + l_get_disconnected_nodes +
+  assumes set_tag_name_get_disconnected_nodes:
+    "\<forall>w \<in> set_tag_name_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
 
 interpretation
-  i_set_tag_type_get_disconnected_nodes?: l_set_tag_type_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf 
-                                          set_tag_type set_tag_type_locs get_disconnected_nodes 
+  i_set_tag_name_get_disconnected_nodes?: l_set_tag_name_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf
+  set_tag_name set_tag_name_locs get_disconnected_nodes
                                           get_disconnected_nodes_locs
   by unfold_locales
-declare l_set_tag_type_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
-
-lemma set_tag_type_get_disconnected_nodes_is_l_set_tag_type_get_disconnected_nodes [instances]:
-  "l_set_tag_type_get_disconnected_nodes type_wf set_tag_type set_tag_type_locs get_disconnected_nodes 
+declare l_set_tag_name_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
+
+lemma set_tag_name_get_disconnected_nodes_is_l_set_tag_name_get_disconnected_nodes [instances]:
+  "l_set_tag_name_get_disconnected_nodes type_wf set_tag_name set_tag_name_locs get_disconnected_nodes
                                          get_disconnected_nodes_locs"
-  using set_tag_type_is_l_set_tag_type get_disconnected_nodes_is_l_get_disconnected_nodes
-  apply(simp add: l_set_tag_type_get_disconnected_nodes_def 
-                  l_set_tag_type_get_disconnected_nodes_axioms_def)
-  using set_tag_type_get_disconnected_nodes
+  using set_tag_name_is_l_set_tag_name get_disconnected_nodes_is_l_get_disconnected_nodes
+  apply(simp add: l_set_tag_name_get_disconnected_nodes_def
+      l_set_tag_name_get_disconnected_nodes_axioms_def)
+  using set_tag_name_get_disconnected_nodes
   by fast
 
 
 subsubsection \<open>set\_val\<close>
 
 locale l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 
 definition a_set_val :: "(_) character_data_ptr \<Rightarrow> DOMString \<Rightarrow> (_, unit) dom_prog"
   where
     "a_set_val ptr v = do {
       m \<leftarrow> get_M ptr val;
       put_M ptr val_update v
     }"
 lemmas set_val_defs = a_set_val_def
 
 definition a_set_val_locs :: "(_) character_data_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_set_val_locs character_data_ptr \<equiv> all_args (put_M character_data_ptr val_update)"
 end
 
 locale l_set_val_defs =
   fixes set_val :: "(_) character_data_ptr \<Rightarrow> DOMString \<Rightarrow> (_, unit) dom_prog"
   fixes set_val_locs :: "(_) character_data_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 locale l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_type_wf type_wf +
   l_set_val_defs set_val set_val_locs +
   l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   for type_wf :: "(_) heap \<Rightarrow> bool"
   and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> (_, unit) dom_prog"
   and set_val_locs :: "(_) character_data_ptr \<Rightarrow> (_, unit) dom_prog set"  +
   assumes type_wf_impl: "type_wf = DocumentClass.type_wf"
   assumes set_val_impl: "set_val = a_set_val"
   assumes set_val_locs_impl: "set_val_locs = a_set_val_locs"
 begin
 
 lemma set_val_ok: 
   "type_wf h \<Longrightarrow> character_data_ptr |\<in>| character_data_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_val character_data_ptr tag)"
   apply(unfold type_wf_impl)
   unfolding set_val_impl[unfolded a_set_val_def] using get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ok put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ok
   by (metis (no_types, lifting) DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a CharacterDataMonad.get_M_pure 
             bind_is_OK_E bind_is_OK_pure_I is_OK_returns_result_I)
 
 lemma set_val_writes: "writes (set_val_locs character_data_ptr) (set_val character_data_ptr tag) h h'"
   by(auto simp add: set_val_impl[unfolded a_set_val_def] set_val_locs_impl[unfolded a_set_val_locs_def] 
                intro: writes_bind_pure)
 
 lemma set_val_pointers_preserved:
   assumes "w \<in> set_val_locs character_data_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms(1) object_ptr_kinds_preserved[OF writes_singleton2 assms(2)]
   by(auto simp add: all_args_def set_val_locs_impl[unfolded a_set_val_locs_def] split: if_splits)
 
 lemma set_val_typess_preserved:
   assumes "w \<in> set_val_locs character_data_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   apply(unfold type_wf_impl)
   using assms(1) type_wf_preserved[OF writes_singleton2 assms(2)]
   by(auto simp add: all_args_def set_val_locs_impl[unfolded a_set_val_locs_def] split: if_splits)
 end
 
 locale l_set_val = l_type_wf + l_set_val_defs +
   assumes set_val_writes: 
     "writes (set_val_locs character_data_ptr) (set_val character_data_ptr tag) h h'"
   assumes set_val_ok: 
     "type_wf h \<Longrightarrow> character_data_ptr |\<in>| character_data_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (set_val character_data_ptr tag)"
   assumes set_val_pointers_preserved: 
     "w \<in> set_val_locs character_data_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
   assumes set_val_types_preserved: 
     "w \<in> set_val_locs character_data_ptr \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
 
 
 global_interpretation l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs defines
   set_val = l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_val and
   set_val_locs = l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_set_val_locs .
 interpretation 
   i_set_val?: l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_val set_val_locs
   apply(unfold_locales)
   by (auto simp add: set_val_def set_val_locs_def)
 declare l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_val_is_l_set_val [instances]: "l_set_val type_wf set_val set_val_locs"
   apply(simp add: l_set_val_def)
   using set_val_ok set_val_writes set_val_pointers_preserved set_val_typess_preserved
   by blast
 
 paragraph \<open>get\_child\_nodes\<close>
 
 locale l_set_val_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_val_get_child_nodes: 
   "\<forall>w \<in> set_val_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
   by(auto simp add: set_val_locs_impl[unfolded a_set_val_locs_def] 
                     get_child_nodes_locs_impl[unfolded a_get_child_nodes_locs_def] all_args_def)
 end
 
 locale l_set_val_get_child_nodes = l_set_val + l_get_child_nodes +
   assumes set_val_get_child_nodes: 
     "\<forall>w \<in> set_val_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_child_nodes_locs ptr'. r h h'))"
 
 interpretation
   i_set_val_get_child_nodes?: l_set_val_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_val set_val_locs known_ptr 
                               get_child_nodes get_child_nodes_locs
   by unfold_locales
 declare l_set_val_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_val_get_child_nodes_is_l_set_val_get_child_nodes [instances]:
   "l_set_val_get_child_nodes type_wf set_val set_val_locs known_ptr get_child_nodes get_child_nodes_locs"
   using set_val_is_l_set_val get_child_nodes_is_l_get_child_nodes
   apply(simp add: l_set_val_get_child_nodes_def l_set_val_get_child_nodes_axioms_def)
   using set_val_get_child_nodes
   by fast
 
 
 paragraph \<open>get\_disconnected\_nodes\<close>
 
 locale l_set_val_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma set_val_get_disconnected_nodes: 
   "\<forall>w \<in> set_val_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
   by(auto simp add: set_val_locs_impl[unfolded a_set_val_locs_def] 
                     get_disconnected_nodes_locs_impl[unfolded a_get_disconnected_nodes_locs_def] 
                     all_args_def)
 end
 
 locale l_set_val_get_disconnected_nodes = l_set_val + l_get_disconnected_nodes +
   assumes set_val_get_disconnected_nodes: 
    "\<forall>w \<in> set_val_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_disconnected_nodes_locs ptr'. r h h'))"
 
 interpretation
   i_set_val_get_disconnected_nodes?: l_set_val_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_val 
                                      set_val_locs get_disconnected_nodes get_disconnected_nodes_locs
   by unfold_locales
 declare l_set_val_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_val_get_disconnected_nodes_is_l_set_val_get_disconnected_nodes [instances]:
-  "l_set_val_get_disconnected_nodes type_wf set_val set_val_locs get_disconnected_nodes get_disconnected_nodes_locs"
+  "l_set_val_get_disconnected_nodes type_wf set_val set_val_locs get_disconnected_nodes
+get_disconnected_nodes_locs"
   using set_val_is_l_set_val get_disconnected_nodes_is_l_get_disconnected_nodes
   apply(simp add: l_set_val_get_disconnected_nodes_def l_set_val_get_disconnected_nodes_axioms_def)
   using set_val_get_disconnected_nodes
   by fast
 
 
 
 subsubsection \<open>get\_parent\<close>
 
 locale l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_child_nodes_defs get_child_nodes get_child_nodes_locs
   for get_child_nodes :: "(_::linorder) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 definition a_get_parent :: "(_) node_ptr \<Rightarrow> (_, (_::linorder) object_ptr option) dom_prog"
   where
     "a_get_parent node_ptr = do {
       check_in_heap (cast node_ptr);
       parent_ptrs \<leftarrow> object_ptr_kinds_M \<bind> filter_M (\<lambda>ptr. do {
         children \<leftarrow> get_child_nodes ptr;
         return (node_ptr \<in> set children)
       });
       (if parent_ptrs = []
         then return None
         else return (Some (hd parent_ptrs)))
     }"
 
 definition 
   "a_get_parent_locs \<equiv> (\<Union>ptr. get_child_nodes_locs ptr \<union> {preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t  ptr RObject.nothing)})"
 end
 
 locale l_get_parent_defs =
   fixes get_parent :: "(_) node_ptr \<Rightarrow> (_, (_::linorder) object_ptr option) dom_prog"
   fixes get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs +
   l_known_ptrs known_ptr known_ptrs +
   l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs +
   l_get_parent_defs get_parent get_parent_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and get_child_nodes (* :: "(_) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog" *)
   and get_child_nodes_locs (* :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set" *)
   and known_ptrs :: "(_) heap \<Rightarrow> bool"
   and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
   and get_parent_locs (* :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set" *) +
   assumes get_parent_impl: "get_parent = a_get_parent"
   assumes get_parent_locs_impl: "get_parent_locs = a_get_parent_locs"
 begin
 lemmas get_parent_def = get_parent_impl[unfolded a_get_parent_def]
 lemmas get_parent_locs_def = get_parent_locs_impl[unfolded a_get_parent_locs_def]
 
 lemma get_parent_pure [simp]: "pure (get_parent ptr) h"
   using get_child_nodes_pure
   by(auto simp add: get_parent_def intro!: bind_pure_I filter_M_pure_I)
 
 lemma get_parent_ok [simp]:
   assumes "type_wf h"
   assumes "known_ptrs h"
   assumes "ptr |\<in>| node_ptr_kinds h"
   shows "h \<turnstile> ok (get_parent ptr)"
   using assms get_child_nodes_ok get_child_nodes_pure
   by(auto simp add: get_parent_impl[unfolded a_get_parent_def] known_ptrs_known_ptr 
           intro!: bind_is_OK_pure_I filter_M_pure_I filter_M_is_OK_I bind_pure_I)
 
 lemma get_parent_ptr_in_heap [simp]: "h \<turnstile> ok (get_parent node_ptr) \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h"
   using get_parent_def is_OK_returns_result_I check_in_heap_ptr_in_heap
   by (metis (no_types, lifting) bind_returns_heap_E get_parent_pure node_ptr_kinds_commutes pure_pure)
 
 lemma get_parent_parent_in_heap:
   assumes "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent"
   shows "parent |\<in>| object_ptr_kinds h"
   using assms get_child_nodes_pure
   by(auto simp add: get_parent_def elim!: bind_returns_result_E2 
           dest!: filter_M_not_more_elements[where x=parent] 
           intro!: filter_M_pure_I bind_pure_I 
           split: if_splits)
 
 lemma get_parent_child_dual:
   assumes "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr"
   obtains children where "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children" and "child \<in> set children"
   using assms get_child_nodes_pure
   by(auto simp add: get_parent_def bind_pure_I 
           dest!: filter_M_holds_for_result 
           elim!: bind_returns_result_E2 
           intro!: filter_M_pure_I 
           split: if_splits)
 
 lemma get_parent_reads: "reads get_parent_locs (get_parent node_ptr) h h'"
   using get_child_nodes_reads[unfolded reads_def]
   by(auto simp add: get_parent_def get_parent_locs_def 
           intro!: reads_bind_pure reads_subset[OF check_in_heap_reads] 
                   reads_subset[OF get_child_nodes_reads] reads_subset[OF return_reads] 
                   reads_subset[OF object_ptr_kinds_M_reads] filter_M_reads filter_M_pure_I bind_pure_I)
 
 lemma get_parent_reads_pointers: "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr RObject.nothing) \<in> get_parent_locs"
   by(auto simp add: get_parent_locs_def)
 end
 
 locale l_get_parent = l_type_wf + l_known_ptrs + l_get_parent_defs + l_get_child_nodes +
   assumes get_parent_reads: 
     "reads get_parent_locs (get_parent node_ptr) h h'"
   assumes get_parent_ok: 
     "type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h \<Longrightarrow> h \<turnstile> ok (get_parent node_ptr)"
   assumes get_parent_ptr_in_heap: 
     "h \<turnstile> ok (get_parent node_ptr) \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h"
   assumes get_parent_pure [simp]: 
     "pure (get_parent node_ptr) h"
   assumes get_parent_parent_in_heap: 
     "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent \<Longrightarrow> parent |\<in>| object_ptr_kinds h"
   assumes get_parent_child_dual: 
     "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr \<Longrightarrow> (\<And>children. h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
          \<Longrightarrow> child \<in> set children \<Longrightarrow> thesis) \<Longrightarrow> thesis"
   assumes get_parent_reads_pointers: 
     "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr RObject.nothing) \<in> get_parent_locs"
 
 global_interpretation l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs defines      
   get_parent = "l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_parent get_child_nodes" and
   get_parent_locs = "l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_parent_locs get_child_nodes_locs" .
 
 interpretation 
   i_get_parent?: l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs 
                  get_parent get_parent_locs
   using instances
   apply(simp add: l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def)
   apply(simp add: get_parent_def get_parent_locs_def)
   done
 declare l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_parent_is_l_get_parent [instances]: 
   "l_get_parent type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs"
   using instances
   apply(auto simp add: l_get_parent_def l_get_parent_axioms_def)[1]
   using get_parent_reads get_parent_ok get_parent_ptr_in_heap get_parent_pure 
         get_parent_parent_in_heap get_parent_child_dual
   using get_parent_reads_pointers
   by blast+
 
 
 paragraph \<open>set\_disconnected\_nodes\<close>
 
 locale l_set_disconnected_nodes_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_disconnected_nodes_get_child_nodes
     set_disconnected_nodes set_disconnected_nodes_locs get_child_nodes get_child_nodes_locs
   + l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     type_wf set_disconnected_nodes set_disconnected_nodes_locs
   + l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and known_ptrs :: "(_) heap \<Rightarrow> bool"
   and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma set_disconnected_nodes_get_parent [simp]: 
   "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_parent_locs. r h h'))"
   by(auto simp add: get_parent_locs_def set_disconnected_nodes_locs_def all_args_def)
 end
 
 locale l_set_disconnected_nodes_get_parent = l_set_disconnected_nodes_defs + l_get_parent_defs +
   assumes set_disconnected_nodes_get_parent [simp]: 
      "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_parent_locs. r h h'))"
 
 interpretation i_set_disconnected_nodes_get_parent?:
   l_set_disconnected_nodes_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf set_disconnected_nodes 
   set_disconnected_nodes_locs get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
   using instances
   by (simp add: l_set_disconnected_nodes_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_set_disconnected_nodes_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma set_disconnected_nodes_get_parent_is_l_set_disconnected_nodes_get_parent [instances]:
   "l_set_disconnected_nodes_get_parent set_disconnected_nodes_locs get_parent_locs"
   by(simp add: l_set_disconnected_nodes_get_parent_def)
 
 
 
 subsubsection \<open>get\_root\_node\<close>
 
 locale l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_parent_defs get_parent get_parent_locs
   for get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_::linorder) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 partial_function (dom_prog) 
   a_get_ancestors :: "(_::linorder) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   where
     "a_get_ancestors ptr = do {
       check_in_heap ptr;
       ancestors \<leftarrow> (case cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr of
         Some node_ptr \<Rightarrow> do {
           parent_ptr_opt \<leftarrow> get_parent node_ptr;
           (case parent_ptr_opt of
             Some parent_ptr \<Rightarrow> a_get_ancestors parent_ptr
           | None \<Rightarrow> return [])
         }
       | None \<Rightarrow> return []);
       return (ptr # ancestors)
     }"
 
 definition "a_get_ancestors_locs = get_parent_locs"
 
 definition a_get_root_node :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr) dom_prog"
   where
     "a_get_root_node ptr = do {
       ancestors \<leftarrow> a_get_ancestors ptr;
       return (last ancestors)
     }"
 definition "a_get_root_node_locs = a_get_ancestors_locs"
 end
 
 locale l_get_ancestors_defs =
   fixes get_ancestors :: "(_::linorder) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   fixes get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_root_node_defs = 
   fixes get_root_node :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr) dom_prog"
   fixes get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 locale l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_parent +
   l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
   l_get_ancestors_defs +
   l_get_root_node_defs +
   assumes get_ancestors_impl: "get_ancestors = a_get_ancestors"
   assumes get_ancestors_locs_impl: "get_ancestors_locs = a_get_ancestors_locs"
   assumes get_root_node_impl: "get_root_node = a_get_root_node"
   assumes get_root_node_locs_impl: "get_root_node_locs = a_get_root_node_locs"
 begin
 lemmas get_ancestors_def = a_get_ancestors.simps[folded get_ancestors_impl]
 lemmas get_ancestors_locs_def = a_get_ancestors_locs_def[folded get_ancestors_locs_impl]
 lemmas get_root_node_def = a_get_root_node_def[folded get_root_node_impl get_ancestors_impl]
 lemmas get_root_node_locs_def = a_get_root_node_locs_def[folded get_root_node_locs_impl  
                                                          get_ancestors_locs_impl]
 
 lemma get_ancestors_pure [simp]:
   "pure (get_ancestors ptr) h"
 proof -
   have "\<forall>ptr h h' x. h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r x \<longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>h h' \<longrightarrow> h = h'"
   proof (induct rule: a_get_ancestors.fixp_induct[folded get_ancestors_impl])
     case 1
     then show ?case
       by(rule admissible_dom_prog)
   next
     case 2
     then show ?case
       by simp
   next
     case (3 f)
     then show ?case
       using get_parent_pure
       apply(auto simp add: pure_returns_heap_eq pure_def 
                  split: option.splits 
                  elim!: bind_returns_heap_E bind_returns_result_E 
                  dest!: pure_returns_heap_eq[rotated, OF check_in_heap_pure])[1]
       apply (meson option.simps(3) returns_result_eq)
       by (metis get_parent_pure pure_returns_heap_eq)
   qed
   then show ?thesis
     by (meson pure_eq_iff)
 qed
 
 
 lemma get_root_node_pure [simp]: "pure (get_root_node ptr) h"
   by(auto simp add: get_root_node_def bind_pure_I)
 
 
 lemma get_ancestors_ptr_in_heap:
   assumes "h \<turnstile> ok (get_ancestors ptr)"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms 
   by(auto simp add: get_ancestors_def check_in_heap_ptr_in_heap 
           elim!: bind_is_OK_E  dest: is_OK_returns_result_I)
 
 lemma get_ancestors_ptr:
   assumes "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
   shows "ptr \<in> set ancestors"
   using assms
   apply(simp add: get_ancestors_def) 
   by(auto  elim!: bind_returns_result_E2 split: option.splits intro!: bind_pure_I)
 
 lemma get_ancestors_not_node:
   assumes "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
   assumes "\<not>is_node_ptr_kind ptr"
   shows "ancestors = [ptr]"
   using assms
   apply(simp add: get_ancestors_def) 
   by(auto elim!: bind_returns_result_E2 split: option.splits)
 
 lemma get_root_node_no_parent: 
   "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r None \<Longrightarrow> h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r cast node_ptr"
   apply(auto simp add: check_in_heap_def get_root_node_def get_ancestors_def 
              intro!: bind_pure_returns_result_I )[1]
   using get_parent_ptr_in_heap by blast
 
 end
 
 locale l_get_ancestors = l_get_ancestors_defs +
   assumes get_ancestors_pure [simp]: "pure (get_ancestors node_ptr) h"
   assumes get_ancestors_ptr_in_heap: "h \<turnstile> ok (get_ancestors ptr) \<Longrightarrow> ptr |\<in>| object_ptr_kinds h"
   assumes get_ancestors_ptr: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ptr \<in> set ancestors"
 
 locale l_get_root_node = l_get_root_node_defs + l_get_parent_defs +
   assumes get_root_node_pure[simp]: 
    "pure (get_root_node ptr) h"
   assumes get_root_node_no_parent: 
    "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r None \<Longrightarrow> h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r cast node_ptr"
 
 global_interpretation l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_parent get_parent_locs
   defines get_root_node = "l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_root_node get_parent"
       and get_root_node_locs = "l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_root_node_locs get_parent_locs"
       and get_ancestors = "l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_ancestors get_parent"
       and get_ancestors_locs = "l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_ancestors_locs get_parent_locs"
   .
 declare a_get_ancestors.simps [code]
 
 interpretation 
   i_get_root_node?: l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr known_ptrs get_parent get_parent_locs 
                     get_child_nodes get_child_nodes_locs get_ancestors get_ancestors_locs 
                     get_root_node get_root_node_locs
   using instances
   apply(simp add: l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def)
   by(simp add: get_root_node_def get_root_node_locs_def get_ancestors_def get_ancestors_locs_def)
 declare l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_ancestors_is_l_get_ancestors [instances]: "l_get_ancestors get_ancestors"
   unfolding l_get_ancestors_def
   using get_ancestors_pure get_ancestors_ptr get_ancestors_ptr_in_heap
   by blast
 
 lemma get_root_node_is_l_get_root_node [instances]: "l_get_root_node get_root_node get_parent"
   apply(simp add: l_get_root_node_def)
   using get_root_node_no_parent
   by fast
 
 
 paragraph \<open>set\_disconnected\_nodes\<close>
 
 locale l_set_disconnected_nodes_get_ancestors\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_disconnected_nodes_get_parent
     set_disconnected_nodes set_disconnected_nodes_locs get_parent get_parent_locs
   + l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs 
     get_ancestors get_ancestors_locs get_root_node get_root_node_locs
   + l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
      type_wf set_disconnected_nodes set_disconnected_nodes_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptrs :: "(_) heap \<Rightarrow> bool"
   and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
   and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
   and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma set_disconnected_nodes_get_ancestors: 
   "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_ancestors_locs. r h h'))"
   by(auto simp add: get_parent_locs_def set_disconnected_nodes_locs_def get_ancestors_locs_def 
                     all_args_def)
 end
 
 locale l_set_disconnected_nodes_get_ancestors = l_set_disconnected_nodes_defs + l_get_ancestors_defs +
   assumes set_disconnected_nodes_get_ancestors: 
     "\<forall>w \<in> set_disconnected_nodes_locs ptr. (h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> get_ancestors_locs. r h h'))"
 
 interpretation
   i_set_disconnected_nodes_get_ancestors?: l_set_disconnected_nodes_get_ancestors\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr 
                                            set_disconnected_nodes set_disconnected_nodes_locs 
                                            get_child_nodes get_child_nodes_locs get_parent 
                                            get_parent_locs type_wf known_ptrs get_ancestors 
                                            get_ancestors_locs get_root_node get_root_node_locs
   using instances
   by (simp add: l_set_disconnected_nodes_get_ancestors\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)           
 declare l_set_disconnected_nodes_get_ancestors\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 lemma set_disconnected_nodes_get_ancestors_is_l_set_disconnected_nodes_get_ancestors [instances]:
   "l_set_disconnected_nodes_get_ancestors set_disconnected_nodes_locs get_ancestors_locs"
   using instances
   apply(simp add: l_set_disconnected_nodes_get_ancestors_def)
   using set_disconnected_nodes_get_ancestors
   by fast
 
 
 
 subsubsection \<open>get\_owner\_document\<close>
                                                                             
 locale l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_get_root_node_defs get_root_node get_root_node_locs
   for get_root_node :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
   and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 
 definition a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: "(_) node_ptr \<Rightarrow> unit \<Rightarrow> (_, (_) document_ptr) dom_prog"
   where                                                                                   
     "a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr _ = do {
       root \<leftarrow> get_root_node (cast node_ptr);
       (case cast root of
         Some document_ptr \<Rightarrow> return document_ptr
       | None \<Rightarrow> do {
         ptrs \<leftarrow> document_ptr_kinds_M;
         candidates \<leftarrow> filter_M (\<lambda>document_ptr. do {
           disconnected_nodes \<leftarrow> get_disconnected_nodes document_ptr;
           return (root \<in> cast ` set disconnected_nodes)
         }) ptrs;
         return (hd candidates)
       })
     }"
 
 definition 
   a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r :: "(_) document_ptr \<Rightarrow> unit \<Rightarrow> (_, (_) document_ptr) dom_prog"
   where
     "a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr _ = do {
       document_ptrs \<leftarrow> document_ptr_kinds_M;
       (if document_ptr \<in> set document_ptrs then return document_ptr else error SegmentationFault)}"
 
 definition 
   a_get_owner_document_tups :: "(((_) object_ptr \<Rightarrow> bool) \<times> ((_) object_ptr \<Rightarrow> unit 
                                                  \<Rightarrow> (_, (_) document_ptr) dom_prog)) list"
   where
      "a_get_owner_document_tups = [
         (is_element_ptr, a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast),
         (is_character_data_ptr, a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast),
         (is_document_ptr, a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast)
       ]"
 
 definition a_get_owner_document :: "(_) object_ptr \<Rightarrow> (_, (_) document_ptr) dom_prog"
   where
     "a_get_owner_document ptr = invoke a_get_owner_document_tups ptr ()"
 end
 
 locale l_get_owner_document_defs =
   fixes get_owner_document :: "(_::linorder) object_ptr \<Rightarrow> (_, (_) document_ptr) dom_prog"
                                                      
 locale l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_known_ptr known_ptr +
   l_get_disconnected_nodes type_wf get_disconnected_nodes get_disconnected_nodes_locs +
   l_get_root_node get_root_node get_root_node_locs +
   l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_root_node get_root_node_locs get_disconnected_nodes 
                                   get_disconnected_nodes_locs +
   l_get_owner_document_defs get_owner_document
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
   and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_owner_document :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog" +
   assumes known_ptr_impl: "known_ptr = a_known_ptr"
   assumes get_owner_document_impl: "get_owner_document = a_get_owner_document"
 begin
 lemmas known_ptr_def = known_ptr_impl[unfolded a_known_ptr_def]
 lemmas get_owner_document_def = a_get_owner_document_def[folded get_owner_document_impl]
 
 lemma get_owner_document_split:
   "P (invoke (a_get_owner_document_tups @ xs) ptr ()) =
     ((known_ptr ptr \<longrightarrow> P (get_owner_document ptr))
     \<and> (\<not>(known_ptr ptr) \<longrightarrow> P (invoke xs ptr ())))"
   by(auto simp add: get_owner_document_def a_get_owner_document_tups_def known_ptr_def 
                     CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs 
                     NodeClass.known_ptr_defs 
           split: invoke_splits option.splits)
 
 lemma get_owner_document_split_asm:
   "P (invoke (a_get_owner_document_tups @ xs) ptr ()) =
     (\<not>((known_ptr ptr \<and> \<not>P (get_owner_document ptr))
     \<or> (\<not>(known_ptr ptr) \<and> \<not>P (invoke xs ptr ()))))"
   by(auto simp add: get_owner_document_def a_get_owner_document_tups_def known_ptr_def 
                     CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs 
                     NodeClass.known_ptr_defs 
           split: invoke_splits)
 lemmas get_owner_document_splits = get_owner_document_split get_owner_document_split_asm
 
 lemma get_owner_document_pure [simp]:
   "pure (get_owner_document ptr) h"
 proof -
   have "\<And>node_ptr. pure (a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr ()) h"
     by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def 
                  intro!: bind_pure_I filter_M_pure_I 
                  split: option.splits)
   moreover have "\<And>document_ptr. pure (a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr ()) h"
     by(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def bind_pure_I)
   ultimately show ?thesis
     by(auto simp add: get_owner_document_def a_get_owner_document_tups_def 
             intro!: bind_pure_I 
             split: invoke_splits)
 qed
 
 lemma get_owner_document_ptr_in_heap:
   assumes "h \<turnstile> ok (get_owner_document ptr)"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms 
   by(auto simp add: get_owner_document_def invoke_ptr_in_heap dest: is_OK_returns_heap_I)
 end
 
 locale l_get_owner_document = l_get_owner_document_defs +
   assumes get_owner_document_ptr_in_heap: 
     "h \<turnstile> ok (get_owner_document ptr) \<Longrightarrow> ptr |\<in>| object_ptr_kinds h"
   assumes get_owner_document_pure [simp]: 
     "pure (get_owner_document ptr) h"
 
 global_interpretation l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_root_node get_root_node_locs 
                                                       get_disconnected_nodes get_disconnected_nodes_locs
   defines get_owner_document_tups = 
           "l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_owner_document_tups get_root_node get_disconnected_nodes"
      and get_owner_document = 
          "l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_owner_document get_root_node get_disconnected_nodes"
      and get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r = 
          "l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r get_root_node get_disconnected_nodes"
   .
 interpretation
   i_get_owner_document?: l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_parent get_parent_locs known_ptr type_wf 
                          get_disconnected_nodes get_disconnected_nodes_locs get_root_node 
                          get_root_node_locs get_owner_document
   using instances
      apply(auto simp add: l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def)[1]
   by(auto simp add: get_owner_document_tups_def get_owner_document_def get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)[1]
 declare l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_owner_document_is_l_get_owner_document [instances]: 
   "l_get_owner_document get_owner_document"
   using get_owner_document_ptr_in_heap
   by(auto simp add: l_get_owner_document_def)
 
 subsubsection \<open>remove\_child\<close>
 
 locale l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_child_nodes_defs get_child_nodes get_child_nodes_locs +
   l_set_child_nodes_defs set_child_nodes set_child_nodes_locs +
   l_get_parent_defs get_parent get_parent_locs +
   l_get_owner_document_defs get_owner_document +
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_disconnected_nodes_defs set_disconnected_nodes set_disconnected_nodes_locs
   for get_child_nodes :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_owner_document :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
 begin
 definition a_remove_child :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_, unit) dom_prog"
   where
     "a_remove_child ptr child = do {
       children \<leftarrow> get_child_nodes ptr;
       if child \<notin> set children then
         error NotFoundError
       else do {
         owner_document \<leftarrow> get_owner_document (cast child);
         disc_nodes \<leftarrow> get_disconnected_nodes owner_document;
         set_disconnected_nodes owner_document (child # disc_nodes);
         set_child_nodes ptr (remove1 child children)
       }
     }"
 
 definition a_remove_child_locs :: "(_) object_ptr \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_remove_child_locs ptr owner_document = set_child_nodes_locs ptr 
                                               \<union> set_disconnected_nodes_locs owner_document"
 
 definition a_remove :: "(_) node_ptr \<Rightarrow> (_, unit) dom_prog"
   where
     "a_remove node_ptr = do {
       parent_opt \<leftarrow> get_parent node_ptr;
       (case parent_opt of
         Some parent \<Rightarrow> do {
           a_remove_child parent node_ptr;
           return ()
         }
       | None \<Rightarrow> return ())
     }"
 end
 
 locale l_remove_child_defs =
   fixes remove_child :: "(_::linorder) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_, unit) dom_prog"
   fixes remove_child_locs :: "(_) object_ptr \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 locale l_remove_defs = 
   fixes remove :: "(_) node_ptr \<Rightarrow> (_, unit) dom_prog"
 
 locale l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
   l_remove_child_defs +
   l_remove_defs +
   l_get_parent +
   l_get_owner_document +
   l_set_child_nodes_get_child_nodes +
   l_set_child_nodes_get_disconnected_nodes +
   l_set_disconnected_nodes_get_disconnected_nodes +
   l_set_disconnected_nodes_get_child_nodes +
   assumes remove_child_impl: "remove_child = a_remove_child"
   assumes remove_child_locs_impl: "remove_child_locs = a_remove_child_locs"
   assumes remove_impl: "remove = a_remove"
 begin
 lemmas remove_child_def = a_remove_child_def[folded remove_child_impl]
 lemmas remove_child_locs_def = a_remove_child_locs_def[folded remove_child_locs_impl]
 lemmas remove_def = a_remove_def[folded remove_child_impl remove_impl]
 
 lemma remove_child_ptr_in_heap:
   assumes "h \<turnstile> ok (remove_child ptr child)"
   shows "ptr |\<in>| object_ptr_kinds h"
 proof -
   obtain children where children: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     using assms
     by(auto simp add: remove_child_def)
   moreover have "children \<noteq> []"
     using assms calculation
     by(auto simp add: remove_child_def elim!: bind_is_OK_E2)
   ultimately show ?thesis
     using assms(1) get_child_nodes_ptr_in_heap by blast 
 qed
 
 
 lemma remove_child_child_in_heap:
   assumes "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h'"
   shows "child |\<in>| node_ptr_kinds h"
   using assms
-  apply(auto simp add: remove_child_def elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated] split: if_splits)[1]
+  apply(auto simp add: remove_child_def
+      elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+      split: if_splits)[1]
   by (meson is_OK_returns_result_I local.get_owner_document_ptr_in_heap node_ptr_kinds_commutes)
 
 
 lemma remove_child_in_disconnected_nodes:
   (* assumes "known_ptrs h" *)
   assumes "h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r owner_document"
   assumes "h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes"
   shows "child \<in> set disc_nodes"
 proof -
   obtain prev_disc_nodes h2 children where
     disc_nodes: "h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r prev_disc_nodes" and
     h2: "h \<turnstile> set_disconnected_nodes owner_document (child # prev_disc_nodes) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> set_child_nodes ptr (remove1 child children) \<rightarrow>\<^sub>h h'"
     using assms(1)
     apply(auto simp add: remove_child_def 
                elim!: bind_returns_heap_E 
-               dest!: returns_result_eq[OF assms(2)] pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
+        dest!: returns_result_eq[OF assms(2)]
+        pure_returns_heap_eq[rotated, OF get_owner_document_pure]
                       pure_returns_heap_eq[rotated, OF get_child_nodes_pure] 
                split: if_splits)[1]
     by (metis get_disconnected_nodes_pure pure_returns_heap_eq)
   have "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes"
     apply(rule reads_writes_separate_backwards[OF get_disconnected_nodes_reads 
                set_child_nodes_writes h' assms(3)])
     by (simp add: set_child_nodes_get_disconnected_nodes)
   then show ?thesis
     by (metis (no_types, lifting) h2 set_disconnected_nodes_get_disconnected_nodes 
                                   list.set_intros(1) select_result_I2)
 qed
 
 lemma remove_child_writes [simp]: 
   "writes (remove_child_locs ptr |h \<turnstile> get_owner_document (cast child)|\<^sub>r) (remove_child ptr child) h h'"
   apply(auto simp add: remove_child_def intro!: writes_bind_pure[OF get_child_nodes_pure] 
                        writes_bind_pure[OF get_owner_document_pure] 
                        writes_bind_pure[OF get_disconnected_nodes_pure])[1]
   by(auto simp add: remove_child_locs_def set_disconnected_nodes_writes writes_union_right_I 
                     set_child_nodes_writes writes_union_left_I 
           intro!: writes_bind)
 
 lemma remove_writes: 
-  "writes (remove_child_locs (the |h \<turnstile> get_parent child|\<^sub>r) |h \<turnstile> get_owner_document (cast child)|\<^sub>r) (remove child) h h'"
+  "writes (remove_child_locs (the |h \<turnstile> get_parent child|\<^sub>r) |h \<turnstile> get_owner_document (cast child)|\<^sub>r)
+(remove child) h h'"
   by(auto simp add: remove_def intro!: writes_bind_pure split: option.splits)
 
 lemma remove_child_children_subset:
   assumes "h \<turnstile> remove_child parent child \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     and "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "set children' \<subseteq> set children"
 proof -
   obtain ptr_children owner_document h2 disc_nodes where
     owner_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r owner_document" and
     ptr_children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r ptr_children" and
     disc_nodes: "h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes" and
     h2: "h \<turnstile> set_disconnected_nodes owner_document (child # disc_nodes) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> set_child_nodes parent (remove1 child ptr_children) \<rightarrow>\<^sub>h h'"
     using assms(1)
     by(auto simp add: remove_child_def 
                  elim!: bind_returns_heap_E 
                  dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
                         pure_returns_heap_eq[rotated, OF get_disconnected_nodes_pure] 
                         pure_returns_heap_eq[rotated, OF get_child_nodes_pure] 
                  split: if_splits)
   have "parent |\<in>| object_ptr_kinds h"
     using get_child_nodes_ptr_in_heap ptr_children by blast
   have "object_ptr_kinds h = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
                                       OF set_disconnected_nodes_writes h2])
     using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
     by (auto simp add: reflp_def transp_def)
   have "type_wf h2"
     using type_wf writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", 
                                          OF set_disconnected_nodes_writes h2]
       using  set_disconnected_nodes_types_preserved  
       by(auto simp add: reflp_def transp_def)
   have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
    using get_child_nodes_reads set_disconnected_nodes_writes h2 assms(2)
       apply(rule reads_writes_separate_forwards)
       by (simp add: set_disconnected_nodes_get_child_nodes)
   moreover have "h2 \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r ptr_children"
     using get_child_nodes_reads set_disconnected_nodes_writes h2 ptr_children
       apply(rule reads_writes_separate_forwards)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     moreover have 
       "ptr \<noteq> parent \<Longrightarrow> h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using get_child_nodes_reads set_child_nodes_writes h'
       apply(rule reads_writes_preserved)
       by (metis set_child_nodes_get_child_nodes_different_pointers)
   moreover have "h' \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r remove1 child ptr_children"
     using h' set_child_nodes_get_child_nodes  known_ptrs type_wf known_ptrs_known_ptr 
               \<open>parent |\<in>| object_ptr_kinds h\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> \<open>type_wf h2\<close> 
               by fast
   moreover have "set ( remove1 child ptr_children) \<subseteq> set ptr_children"
     by (simp add: set_remove1_subset)
   ultimately show ?thesis
     by (metis assms(3) order_refl returns_result_eq)
 qed
 
 
 lemma remove_child_pointers_preserved:
   assumes "w \<in> remove_child_locs ptr owner_document"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms
   using set_child_nodes_pointers_preserved
   using set_disconnected_nodes_pointers_preserved
   unfolding remove_child_locs_def
   by auto
 
 lemma remove_child_types_preserved:
   assumes "w \<in> remove_child_locs ptr owner_document"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   using assms
   using set_child_nodes_types_preserved
   using set_disconnected_nodes_types_preserved
   unfolding remove_child_locs_def
   by auto
 end
 
 locale l_remove_child = l_type_wf + l_known_ptrs + l_remove_child_defs + l_get_owner_document_defs 
                       + l_get_child_nodes_defs + l_get_disconnected_nodes_defs +
   assumes remove_child_writes: 
-  "writes (remove_child_locs object_ptr |h \<turnstile> get_owner_document (cast child)|\<^sub>r) (remove_child object_ptr child) h h'"
+    "writes (remove_child_locs object_ptr |h \<turnstile> get_owner_document (cast child)|\<^sub>r)
+(remove_child object_ptr child) h h'"
   assumes remove_child_pointers_preserved: 
   "w \<in> remove_child_locs ptr owner_document \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
   assumes remove_child_types_preserved: 
   "w \<in> remove_child_locs ptr owner_document \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   assumes remove_child_in_disconnected_nodes:
     "known_ptrs h \<Longrightarrow> h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'
     \<Longrightarrow> h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r owner_document
     \<Longrightarrow> h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes
     \<Longrightarrow> child \<in> set disc_nodes"
   assumes remove_child_ptr_in_heap: "h \<turnstile> ok (remove_child ptr child) \<Longrightarrow> ptr |\<in>| object_ptr_kinds h"
   assumes remove_child_child_in_heap: "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h' \<Longrightarrow> child |\<in>| node_ptr_kinds h"
   assumes remove_child_children_subset:
     "known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> h \<turnstile> remove_child parent child \<rightarrow>\<^sub>h h'
     \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
     \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'
     \<Longrightarrow> set children' \<subseteq> set children"
 
 locale l_remove
 
 
 global_interpretation l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs set_child_nodes 
                                                 set_child_nodes_locs get_parent get_parent_locs 
                                                 get_owner_document get_disconnected_nodes 
                                                 get_disconnected_nodes_locs set_disconnected_nodes 
                                                 set_disconnected_nodes_locs
   defines remove = 
     "l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_remove get_child_nodes set_child_nodes get_parent get_owner_document 
                                         get_disconnected_nodes set_disconnected_nodes"
   and remove_child = 
     "l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_remove_child get_child_nodes set_child_nodes get_owner_document 
                                               get_disconnected_nodes set_disconnected_nodes"
   and remove_child_locs = 
     "l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_remove_child_locs set_child_nodes_locs set_disconnected_nodes_locs"
   .                                                                
 interpretation
   i_remove_child?: l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_child_nodes get_child_nodes_locs set_child_nodes 
                    set_child_nodes_locs get_parent get_parent_locs get_owner_document 
                    get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes 
                    set_disconnected_nodes_locs remove_child remove_child_locs remove type_wf 
                    known_ptr known_ptrs
   using instances
   apply(simp add: l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def)
   by(simp add: remove_child_def remove_child_locs_def remove_def)
 declare l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma remove_child_is_l_remove_child [instances]: 
   "l_remove_child type_wf known_ptr known_ptrs remove_child remove_child_locs get_owner_document 
                   get_child_nodes get_disconnected_nodes"
   using instances
   apply(auto simp add: l_remove_child_def l_remove_child_axioms_def)[1] (*slow, ca 1min *)
   using remove_child_pointers_preserved apply(blast)
   using remove_child_pointers_preserved apply(blast)
   using remove_child_types_preserved apply(blast)
   using remove_child_types_preserved apply(blast)
   using remove_child_in_disconnected_nodes apply(blast)
   using remove_child_ptr_in_heap  apply(blast)
   using remove_child_child_in_heap  apply(blast)
   using remove_child_children_subset  apply(blast)
   done
 
 
 
 subsubsection \<open>adopt\_node\<close>
 
 locale l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_owner_document_defs get_owner_document +
   l_get_parent_defs get_parent get_parent_locs +
   l_remove_child_defs remove_child remove_child_locs +
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_disconnected_nodes_defs set_disconnected_nodes set_disconnected_nodes_locs
   for get_owner_document :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
   and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and remove_child :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog"
   and remove_child_locs :: "(_) object_ptr \<Rightarrow> (_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
 begin
 definition a_adopt_node :: "(_) document_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_, unit) dom_prog"
   where
     "a_adopt_node document node = do {
       old_document \<leftarrow> get_owner_document (cast node);
       parent_opt \<leftarrow> get_parent node;
       (case parent_opt of
         Some parent \<Rightarrow> do {
           remove_child parent node
         } | None \<Rightarrow> do {
           return ()
         });
       (if document \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 node old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes document;
         set_disconnected_nodes document (node # disc_nodes)
       } else do {
         return ()
       })
     }"
 
 definition 
   a_adopt_node_locs :: "(_) object_ptr option \<Rightarrow> (_) document_ptr \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_adopt_node_locs parent owner_document document_ptr = 
     ((if parent = None 
       then {} 
       else remove_child_locs (the parent) owner_document) \<union> set_disconnected_nodes_locs document_ptr 
                                                           \<union> set_disconnected_nodes_locs owner_document)"
 end
 
 locale l_adopt_node_defs =
   fixes 
   adopt_node :: "(_) document_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_, unit) dom_prog"
   fixes 
   adopt_node_locs :: "(_) object_ptr option \<Rightarrow> (_) document_ptr \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 global_interpretation l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_owner_document get_parent get_parent_locs remove_child 
                                               remove_child_locs get_disconnected_nodes 
                                               get_disconnected_nodes_locs set_disconnected_nodes 
                                               set_disconnected_nodes_locs
   defines adopt_node = "l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_adopt_node get_owner_document get_parent remove_child 
                                                              get_disconnected_nodes set_disconnected_nodes"
       and adopt_node_locs = "l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_adopt_node_locs 
                                                       remove_child_locs set_disconnected_nodes_locs"
   .
 
 locale l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
     get_owner_document get_parent get_parent_locs remove_child remove_child_locs get_disconnected_nodes 
                        get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
   + l_adopt_node_defs
     adopt_node adopt_node_locs
   + l_get_owner_document
     get_owner_document
   + l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
   + l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs get_parent 
     get_parent_locs get_owner_document get_disconnected_nodes get_disconnected_nodes_locs 
     set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove type_wf 
     known_ptr known_ptrs
   + l_set_disconnected_nodes_get_disconnected_nodes
     type_wf get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes 
     set_disconnected_nodes_locs
   for get_owner_document :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
   and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and remove_child :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog"
   and remove_child_locs :: "(_) object_ptr \<Rightarrow> (_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and adopt_node :: "(_) document_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog"
   and adopt_node_locs :: "(_) object_ptr option \<Rightarrow> (_) document_ptr \<Rightarrow> (_) document_ptr 
                           \<Rightarrow> ((_) heap, exception, unit) prog set"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and known_ptrs :: "(_) heap \<Rightarrow> bool"
   and set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and remove :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog" +
   assumes adopt_node_impl: "adopt_node = a_adopt_node"
   assumes adopt_node_locs_impl: "adopt_node_locs = a_adopt_node_locs"
 begin
 lemmas adopt_node_def = a_adopt_node_def[folded adopt_node_impl]
 lemmas adopt_node_locs_def = a_adopt_node_locs_def[folded adopt_node_locs_impl]
 
 lemma adopt_node_writes:
   shows "writes (adopt_node_locs |h \<turnstile> get_parent node|\<^sub>r |h 
          \<turnstile> get_owner_document (cast node)|\<^sub>r document_ptr) (adopt_node document_ptr node) h h'"
   apply(auto simp add: adopt_node_def adopt_node_locs_def 
              intro!: writes_bind_pure[OF get_owner_document_pure] writes_bind_pure[OF get_parent_pure] 
                      writes_bind_pure[OF get_disconnected_nodes_pure] 
              split: option.splits)[1]
   apply(auto intro!: writes_bind)[1]
   apply (simp add: set_disconnected_nodes_writes writes_union_right_I)
     apply (simp add: set_disconnected_nodes_writes writes_union_left_I writes_union_right_I)
    apply(auto intro!: writes_bind)[1]
   apply (metis (no_types, lifting) remove_child_writes select_result_I2 writes_union_left_I)
     apply (simp add: set_disconnected_nodes_writes writes_union_right_I)
   by(auto intro: writes_subset[OF set_disconnected_nodes_writes] writes_subset[OF remove_child_writes])
 
 lemma adopt_node_children_subset:
   assumes "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     and "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "set children' \<subseteq> set children"
 proof -
   obtain old_document parent_opt h2 where
     old_document: "h \<turnstile> get_owner_document (cast node) \<rightarrow>\<^sub>r old_document" and
     parent_opt: "h \<turnstile> get_parent node \<rightarrow>\<^sub>r parent_opt" and
-    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> do { remove_child parent node } | None \<Rightarrow> do { return ()}) \<rightarrow>\<^sub>h h2" 
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> do { remove_child parent node } |
+None \<Rightarrow> do { return ()}) \<rightarrow>\<^sub>h h2"
     and
     h': "h2 \<turnstile> (if owner_document \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 node old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes owner_document;
         set_disconnected_nodes owner_document (node # disc_nodes)
       } else do { return () }) \<rightarrow>\<^sub>h h'"
     using assms(1)
     by(auto simp add: adopt_node_def 
             elim!: bind_returns_heap_E 
             dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
                    pure_returns_heap_eq[rotated, OF get_parent_pure])
 
   have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
   proof (cases "owner_document \<noteq> old_document")
     case True
     then obtain h3 old_disc_nodes disc_nodes where
       old_disc_nodes: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r old_disc_nodes" and
       h3: "h2 \<turnstile> set_disconnected_nodes old_document (remove1 node old_disc_nodes) \<rightarrow>\<^sub>h h3" and
       old_disc_nodes: "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes" and
       h': "h3 \<turnstile> set_disconnected_nodes owner_document (node # disc_nodes) \<rightarrow>\<^sub>h h'"
       using h'
       by(auto elim!: bind_returns_heap_E 
                      bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] ) 
     have "h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
       using get_child_nodes_reads set_disconnected_nodes_writes h' assms(3)
       apply(rule reads_writes_separate_backwards)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     show ?thesis
       using get_child_nodes_reads set_disconnected_nodes_writes h3 \<open>h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'\<close>
       apply(rule reads_writes_separate_backwards)
       by (simp add: set_disconnected_nodes_get_child_nodes)
   next
     case False
     then show ?thesis
       using h' assms(3) by(auto)
   qed
 
   show ?thesis
   proof (insert h2, induct parent_opt)
     case None
     then show ?case
       using assms
       by(auto dest!: returns_result_eq[OF \<open>h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'\<close>])
   next
     case (Some option)
     then show ?case 
-      using assms(2) \<open>h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'\<close> remove_child_children_subset known_ptrs type_wf 
+      using assms(2) \<open>h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'\<close> remove_child_children_subset known_ptrs
+        type_wf
       by simp
   qed
 qed
 
 lemma adopt_node_child_in_heap:
   assumes "h \<turnstile> ok (adopt_node document_ptr child)"
   shows "child |\<in>| node_ptr_kinds h"
   using assms
   apply(auto simp add: adopt_node_def elim!: bind_is_OK_E)[1]
   using get_owner_document_pure get_parent_ptr_in_heap pure_returns_heap_eq
   by fast
 
 lemma adopt_node_pointers_preserved:
   assumes "w \<in> adopt_node_locs parent owner_document document_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms
   using set_disconnected_nodes_pointers_preserved
   using remove_child_pointers_preserved
   unfolding adopt_node_locs_def
   by (auto split: if_splits)
 
 lemma adopt_node_types_preserved:
   assumes "w \<in> adopt_node_locs parent owner_document document_ptr"
   assumes "h \<turnstile> w \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   using assms
   using remove_child_types_preserved
   using set_disconnected_nodes_types_preserved
   unfolding adopt_node_locs_def
   by (auto split: if_splits)
 end
 
-locale l_adopt_node = l_type_wf + l_known_ptrs + l_get_parent_defs + l_adopt_node_defs + l_get_child_nodes_defs + l_get_owner_document_defs +
+locale l_adopt_node = l_type_wf + l_known_ptrs + l_get_parent_defs + l_adopt_node_defs +
+  l_get_child_nodes_defs + l_get_owner_document_defs +
   assumes adopt_node_writes: 
   "writes (adopt_node_locs |h \<turnstile> get_parent node|\<^sub>r 
            |h \<turnstile> get_owner_document (cast node)|\<^sub>r document_ptr) (adopt_node document_ptr node) h h'"
   assumes adopt_node_pointers_preserved: 
   "w \<in> adopt_node_locs parent owner_document document_ptr 
    \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h'"
   assumes adopt_node_types_preserved: 
   "w \<in> adopt_node_locs parent owner_document document_ptr 
    \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   assumes adopt_node_child_in_heap: 
   "h \<turnstile> ok (adopt_node document_ptr child) \<Longrightarrow> child |\<in>| node_ptr_kinds h"
   assumes adopt_node_children_subset:
   "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
      \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children' 
      \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> set children' \<subseteq> set children"
 
 interpretation
   i_adopt_node?: l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent get_parent_locs remove_child 
                  remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs 
                  set_disconnected_nodes set_disconnected_nodes_locs adopt_node adopt_node_locs 
                  known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs set_child_nodes 
                  set_child_nodes_locs remove
   apply(unfold_locales)
   by(auto simp add: adopt_node_def adopt_node_locs_def)                     
 declare l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 lemma adopt_node_is_l_adopt_node [instances]: 
   "l_adopt_node type_wf known_ptr known_ptrs get_parent adopt_node adopt_node_locs get_child_nodes 
                 get_owner_document"
   using instances
   by (simp add: l_adopt_node_axioms_def adopt_node_child_in_heap adopt_node_children_subset 
                 adopt_node_pointers_preserved adopt_node_types_preserved adopt_node_writes 
                 l_adopt_node_def)
 
 
 
 subsubsection \<open>insert\_before\<close>
                                                        
 locale l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_parent_defs get_parent get_parent_locs
   + l_get_child_nodes_defs get_child_nodes get_child_nodes_locs
   + l_set_child_nodes_defs set_child_nodes set_child_nodes_locs
   + l_get_ancestors_defs get_ancestors get_ancestors_locs
   + l_adopt_node_defs adopt_node adopt_node_locs
   + l_set_disconnected_nodes_defs set_disconnected_nodes set_disconnected_nodes_locs
   + l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs
   + l_get_owner_document_defs get_owner_document
   for get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_::linorder) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
   and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and adopt_node :: "(_) document_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog"
   and adopt_node_locs :: "(_) object_ptr option \<Rightarrow> (_) document_ptr \<Rightarrow> (_) document_ptr 
                                                 \<Rightarrow> ((_) heap, exception, unit) prog set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_owner_document :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
 begin
 
 definition a_next_sibling :: "(_) node_ptr \<Rightarrow> (_, (_) node_ptr option) dom_prog"
   where
     "a_next_sibling node_ptr = do {
       parent_opt \<leftarrow> get_parent node_ptr;
       (case parent_opt of
         Some parent \<Rightarrow> do {
           children \<leftarrow> get_child_nodes parent;
           (case (dropWhile (\<lambda>ptr. ptr = node_ptr) (dropWhile (\<lambda>ptr. ptr \<noteq> node_ptr) children)) of
             x#_ \<Rightarrow> return (Some x)
           | [] \<Rightarrow> return None)}
       | None \<Rightarrow> return None)
     }"
 
 fun insert_before_list :: "'xyz \<Rightarrow> 'xyz option \<Rightarrow> 'xyz list \<Rightarrow> 'xyz list"
   where
     "insert_before_list v (Some reference) (x#xs) = (if reference = x
       then v#x#xs else x # insert_before_list v (Some reference) xs)"
     | "insert_before_list v (Some _) [] = [v]"
     | "insert_before_list v None xs = xs @ [v]"
 
 definition a_insert_node :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_) node_ptr option
   \<Rightarrow> (_, unit) dom_prog"
   where
     "a_insert_node ptr new_child reference_child_opt = do {
       children \<leftarrow> get_child_nodes ptr;
       set_child_nodes ptr (insert_before_list new_child reference_child_opt children)
     }"
 
 definition a_ensure_pre_insertion_validity :: "(_) node_ptr \<Rightarrow> (_) object_ptr
   \<Rightarrow> (_) node_ptr option \<Rightarrow> (_, unit) dom_prog"
   where
     "a_ensure_pre_insertion_validity node parent child_opt = do {
       (if is_character_data_ptr_kind parent
         then error HierarchyRequestError else return ());
       ancestors \<leftarrow> get_ancestors parent;
       (if cast node \<in> set ancestors then error HierarchyRequestError else return ());
       (case child_opt of
         Some child \<Rightarrow> do {
           child_parent \<leftarrow> get_parent child;
           (if child_parent \<noteq> Some parent then error NotFoundError else return ())}
       | None \<Rightarrow> return ());
       children \<leftarrow> get_child_nodes parent;
       (if children \<noteq> [] \<and> is_document_ptr parent
         then error HierarchyRequestError else return ());
       (if is_character_data_ptr node \<and> is_document_ptr parent
         then error HierarchyRequestError else return ())
     }"
 
 definition a_insert_before :: "(_) object_ptr \<Rightarrow> (_) node_ptr
   \<Rightarrow> (_) node_ptr option \<Rightarrow> (_, unit) dom_prog"
   where
     "a_insert_before ptr node child = do {
       a_ensure_pre_insertion_validity node ptr child;
       reference_child \<leftarrow> (if Some node = child
         then a_next_sibling node                                         
         else return child);
       owner_document \<leftarrow> get_owner_document ptr;
       adopt_node owner_document node;
       disc_nodes \<leftarrow> get_disconnected_nodes owner_document;
       set_disconnected_nodes owner_document (remove1 node disc_nodes);
       a_insert_node ptr node reference_child
     }"
 
 definition a_insert_before_locs :: "(_) object_ptr \<Rightarrow> (_) object_ptr option \<Rightarrow> (_) document_ptr 
                                                    \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
   where
     "a_insert_before_locs ptr old_parent child_owner_document ptr_owner_document =
       adopt_node_locs old_parent child_owner_document ptr_owner_document \<union>
       set_child_nodes_locs ptr \<union>
       set_disconnected_nodes_locs ptr_owner_document"
 end
 
 locale l_insert_before_defs =
   fixes insert_before :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_) node_ptr option \<Rightarrow> (_, unit) dom_prog"
   fixes insert_before_locs :: "(_) object_ptr \<Rightarrow> (_) object_ptr option \<Rightarrow> (_) document_ptr 
                                               \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
 
 locale l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_insert_before_defs
 begin
 definition "a_append_child ptr child = insert_before ptr child None"
 end
 
 locale l_append_child_defs =
   fixes append_child :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_, unit) dom_prog"
                                                                  
 locale l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
     get_parent get_parent_locs get_child_nodes get_child_nodes_locs set_child_nodes 
     set_child_nodes_locs get_ancestors get_ancestors_locs adopt_node adopt_node_locs 
     set_disconnected_nodes set_disconnected_nodes_locs get_disconnected_nodes 
     get_disconnected_nodes_locs get_owner_document
   + l_insert_before_defs
     insert_before insert_before_locs
   + l_append_child_defs
     append_child
   + l_set_child_nodes_get_child_nodes
     type_wf known_ptr get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs
   + l_get_ancestors
     get_ancestors get_ancestors_locs
   + l_adopt_node
     type_wf known_ptr known_ptrs get_parent get_parent_locs adopt_node adopt_node_locs 
     get_child_nodes get_child_nodes_locs get_owner_document
   + l_set_disconnected_nodes
     type_wf set_disconnected_nodes set_disconnected_nodes_locs
   + l_get_disconnected_nodes
     type_wf get_disconnected_nodes get_disconnected_nodes_locs
   + l_get_owner_document
     get_owner_document
   + l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
   + l_set_disconnected_nodes_get_child_nodes
     set_disconnected_nodes set_disconnected_nodes_locs get_child_nodes get_child_nodes_locs
   for get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_::linorder) object_ptr option) prog"
   and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_child_nodes :: "(_) object_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
   and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and adopt_node :: "(_) document_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog"
   and adopt_node_locs :: "(_) object_ptr option \<Rightarrow> (_) document_ptr \<Rightarrow> (_) document_ptr 
                                                 \<Rightarrow> ((_) heap, exception, unit) prog set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and get_owner_document :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
-  and insert_before :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_) node_ptr option \<Rightarrow> ((_) heap, exception, unit) prog"
+    and insert_before ::
+    "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> (_) node_ptr option \<Rightarrow> ((_) heap, exception, unit) prog"
   and insert_before_locs :: "(_) object_ptr \<Rightarrow> (_) object_ptr option \<Rightarrow> (_) document_ptr 
                                             \<Rightarrow> (_) document_ptr \<Rightarrow> (_, unit) dom_prog set"
   and append_child :: "(_) object_ptr \<Rightarrow> (_) node_ptr \<Rightarrow> ((_) heap, exception, unit) prog"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   and known_ptrs :: "(_) heap \<Rightarrow> bool" +
   assumes insert_before_impl: "insert_before = a_insert_before"
   assumes insert_before_locs_impl: "insert_before_locs = a_insert_before_locs"
 begin
 lemmas insert_before_def = a_insert_before_def[folded insert_before_impl]
 lemmas insert_before_locs_def = a_insert_before_locs_def[folded insert_before_locs_impl]
 
 lemma next_sibling_pure [simp]:
   "pure (a_next_sibling new_child) h"
   by(auto simp add: a_next_sibling_def get_parent_pure intro!: bind_pure_I split: option.splits list.splits)
 
 lemma insert_before_list_in_set: "x \<in> set (insert_before_list v ref xs) \<longleftrightarrow> x = v \<or> x \<in> set xs"
   apply(induct v ref xs rule: insert_before_list.induct)
   by(auto)
 
 lemma insert_before_list_distinct: "x \<notin> set xs \<Longrightarrow> distinct xs \<Longrightarrow> distinct (insert_before_list x ref xs)"
   apply(induct x ref xs rule: insert_before_list.induct)
   by(auto simp add: insert_before_list_in_set)
 
 lemma insert_before_list_subset: "set xs \<subseteq> set (insert_before_list x ref xs)"
   apply(induct x ref xs rule: insert_before_list.induct)
   by(auto)
 
 lemma insert_before_list_node_in_set: "x \<in> set (insert_before_list x ref xs)"
   apply(induct x ref xs rule: insert_before_list.induct)
   by(auto)
 
 lemma insert_node_writes: 
   "writes (set_child_nodes_locs ptr) (a_insert_node ptr new_child reference_child_opt) h h'"
   by(auto simp add: a_insert_node_def set_child_nodes_writes 
           intro!: writes_bind_pure[OF get_child_nodes_pure])
 
 lemma ensure_pre_insertion_validity_pure [simp]:
   "pure (a_ensure_pre_insertion_validity node ptr child) h"
   by(auto simp add: a_ensure_pre_insertion_validity_def 
           intro!: bind_pure_I 
           split: option.splits)
 
 lemma insert_before_reference_child_not_in_children:
   assumes "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent"
     and "ptr \<noteq> parent"
     and "\<not>is_character_data_ptr_kind ptr"
     and "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
     and "cast node \<notin> set ancestors"
   shows "h \<turnstile> insert_before ptr node (Some child) \<rightarrow>\<^sub>e NotFoundError"
 proof -
   have "h \<turnstile> a_ensure_pre_insertion_validity node ptr (Some child) \<rightarrow>\<^sub>e NotFoundError"
     using assms unfolding insert_before_def a_ensure_pre_insertion_validity_def
     by auto (simp | rule bind_returns_error_I2)+
   then show ?thesis
     unfolding insert_before_def by auto
 qed
 
 lemma insert_before_ptr_in_heap:
   assumes "h \<turnstile> ok (insert_before ptr node reference_child)"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms
   apply(auto simp add: insert_before_def elim!: bind_is_OK_E)[1]
-  by (metis (mono_tags, lifting) ensure_pre_insertion_validity_pure is_OK_returns_result_I local.get_owner_document_ptr_in_heap next_sibling_pure pure_returns_heap_eq return_returns_heap)
+  by (metis (mono_tags, lifting) ensure_pre_insertion_validity_pure is_OK_returns_result_I
+      local.get_owner_document_ptr_in_heap next_sibling_pure pure_returns_heap_eq return_returns_heap)
 
 lemma insert_before_child_in_heap:
   assumes "h \<turnstile> ok (insert_before ptr node reference_child)"
   shows "node |\<in>| node_ptr_kinds h"
   using assms
   apply(auto simp add: insert_before_def elim!: bind_is_OK_E)[1]
   by (metis (mono_tags, lifting) ensure_pre_insertion_validity_pure is_OK_returns_heap_I 
             l_get_owner_document.get_owner_document_pure local.adopt_node_child_in_heap 
             local.l_get_owner_document_axioms next_sibling_pure pure_returns_heap_eq return_pure)
 
 lemma insert_node_children_remain_distinct:
     assumes insert_node: "h \<turnstile> a_insert_node ptr new_child reference_child_opt \<rightarrow>\<^sub>h h2"
     and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     and "new_child \<notin> set children"
     and "\<And>ptr children. h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> distinct children"
     and known_ptr: "known_ptr ptr"
     and type_wf: "type_wf h"
   shows "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> distinct children"
 proof -
   fix ptr' children'
   assume a1: "h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'"
   then show "distinct children'"
   proof (cases "ptr = ptr'")
     case True
     have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r (insert_before_list new_child reference_child_opt children)"
       using assms(1) assms(2) apply(auto simp add: a_insert_node_def elim!: bind_returns_heap_E)[1]
       using returns_result_eq set_child_nodes_get_child_nodes known_ptr type_wf
       using pure_returns_heap_eq by fastforce
     then show ?thesis
       using True a1 assms(2) assms(3) assms(4) insert_before_list_distinct returns_result_eq 
       by fastforce
   next
     case False
     have "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'"
       using  get_child_nodes_reads insert_node_writes insert_node a1
       apply(rule reads_writes_separate_backwards)
       by (meson False set_child_nodes_get_child_nodes_different_pointers)
     then show ?thesis
       using assms(4) by blast
   qed
 qed
                                                
 lemma insert_before_writes: 
   "writes (insert_before_locs ptr |h \<turnstile> get_parent child|\<^sub>r 
        |h \<turnstile> get_owner_document (cast child)|\<^sub>r |h \<turnstile> get_owner_document ptr|\<^sub>r) (insert_before ptr child ref) h h'"
   apply(auto simp add: insert_before_def insert_before_locs_def a_insert_node_def 
       intro!: writes_bind)[1]
        apply (metis (no_types, hide_lams) ensure_pre_insertion_validity_pure local.adopt_node_writes 
                     local.get_owner_document_pure next_sibling_pure pure_returns_heap_eq 
                     select_result_I2 sup_commute writes_union_right_I)
       apply (metis (no_types, hide_lams) ensure_pre_insertion_validity_pure next_sibling_pure 
                    pure_returns_heap_eq select_result_I2 set_disconnected_nodes_writes 
                    writes_union_right_I)
      apply (simp add: set_child_nodes_writes writes_union_left_I writes_union_right_I)
     apply (metis (no_types, hide_lams) adopt_node_writes ensure_pre_insertion_validity_pure 
                  get_owner_document_pure pure_returns_heap_eq select_result_I2 writes_union_left_I)
    apply (metis (no_types, hide_lams) ensure_pre_insertion_validity_pure pure_returns_heap_eq 
                 select_result_I2 set_disconnected_nodes_writes writes_union_right_I)
   by (simp add: set_child_nodes_writes writes_union_left_I writes_union_right_I)                      
 end
 
 
 locale l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_append_child_defs +
   l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +     
   assumes append_child_impl: "append_child = a_append_child"
 begin
 
 lemmas append_child_def = a_append_child_def[folded append_child_impl]
 end
 
 locale l_insert_before = l_insert_before_defs
 
 locale l_append_child = l_append_child_defs
 
 global_interpretation l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_parent get_parent_locs get_child_nodes 
    get_child_nodes_locs set_child_nodes set_child_nodes_locs get_ancestors get_ancestors_locs 
    adopt_node adopt_node_locs set_disconnected_nodes set_disconnected_nodes_locs 
    get_disconnected_nodes get_disconnected_nodes_locs get_owner_document
   defines
     next_sibling = "l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_next_sibling get_parent get_child_nodes" and
     insert_node = "l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_insert_node get_child_nodes set_child_nodes" and
     ensure_pre_insertion_validity = "l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_ensure_pre_insertion_validity 
                                                      get_parent get_child_nodes get_ancestors" and
     insert_before = "l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_insert_before get_parent get_child_nodes 
                                    set_child_nodes get_ancestors adopt_node set_disconnected_nodes 
                                    get_disconnected_nodes get_owner_document" and
     insert_before_locs = "l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_insert_before_locs set_child_nodes_locs 
                                                         adopt_node_locs set_disconnected_nodes_locs"
   .
 
 global_interpretation l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs insert_before
   defines append_child = "l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_append_child insert_before"
   .
 
 interpretation                                           
   i_insert_before?: l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_parent get_parent_locs get_child_nodes 
   get_child_nodes_locs set_child_nodes set_child_nodes_locs get_ancestors get_ancestors_locs 
   adopt_node adopt_node_locs set_disconnected_nodes set_disconnected_nodes_locs get_disconnected_nodes 
   get_disconnected_nodes_locs get_owner_document insert_before insert_before_locs append_child 
   type_wf known_ptr known_ptrs
   apply(simp add: l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
   by (simp add: insert_before_def insert_before_locs_def)
 declare l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 interpretation i_append_child?: l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M append_child insert_before insert_before_locs
   apply(simp add: l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances append_child_def)
   done
 declare l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 
 
 subsubsection \<open>create\_element\<close>
 
 locale l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_disconnected_nodes_defs set_disconnected_nodes set_disconnected_nodes_locs +
-  l_set_tag_type_defs set_tag_type set_tag_type_locs
+  l_set_tag_name_defs set_tag_name set_tag_name_locs
   for get_disconnected_nodes :: 
       "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: 
       "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: 
       "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: 
       "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and set_tag_type :: 
+    and set_tag_name ::
       "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_tag_type_locs :: 
+    and set_tag_name_locs ::
       "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
 begin
-definition a_create_element :: "(_) document_ptr \<Rightarrow> tag_type \<Rightarrow> (_, (_) element_ptr) dom_prog"
+definition a_create_element :: "(_) document_ptr \<Rightarrow> tag_name \<Rightarrow> (_, (_) element_ptr) dom_prog"
   where
     "a_create_element document_ptr tag = do {
       new_element_ptr \<leftarrow> new_element;
-      set_tag_type new_element_ptr tag;
+      set_tag_name new_element_ptr tag;
       disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
       set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes);
       return new_element_ptr
     }"
 end
 
 locale l_create_element_defs =
-  fixes create_element :: "(_) document_ptr \<Rightarrow> tag_type \<Rightarrow> (_, (_) element_ptr) dom_prog"
+  fixes create_element :: "(_) document_ptr \<Rightarrow> tag_name \<Rightarrow> (_, (_) element_ptr) dom_prog"
 
 global_interpretation l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_disconnected_nodes get_disconnected_nodes_locs 
                                                   set_disconnected_nodes set_disconnected_nodes_locs 
-                                                  set_tag_type set_tag_type_locs
+  set_tag_name set_tag_name_locs
   defines 
   create_element = "l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_create_element get_disconnected_nodes 
-                                                                set_disconnected_nodes set_tag_type"
+                                                                set_disconnected_nodes set_tag_name"
   .
 
 locale l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
-  l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs set_tag_type set_tag_type_locs +
+  l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs set_tag_name set_tag_name_locs +
   l_get_disconnected_nodes type_wf get_disconnected_nodes get_disconnected_nodes_locs +
-  l_set_tag_type type_wf set_tag_type set_tag_type_locs +
+  l_set_tag_name type_wf set_tag_name set_tag_name_locs +
   l_create_element_defs create_element +
   l_known_ptr known_ptr
   for get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and set_tag_type :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_tag_type_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and set_tag_name :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and create_element :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr) prog"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool" +
   assumes known_ptr_impl: "known_ptr = a_known_ptr"
   assumes create_element_impl: "create_element = a_create_element"
 begin
 lemmas create_element_def = a_create_element_def[folded create_element_impl]
 
 lemma create_element_document_in_heap:
   assumes "h \<turnstile> ok (create_element document_ptr tag)"
   shows "document_ptr |\<in>| document_ptr_kinds h"
 proof -
   obtain h' where "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
     using assms(1)
     by auto
   then
   obtain new_element_ptr h2 h3 disc_nodes_h3 where
     new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
     h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
-    h3: "h2 \<turnstile> set_tag_type new_element_ptr tag \<rightarrow>\<^sub>h h3" and
+    h3: "h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
     by(auto simp add: create_element_def
             elim!: bind_returns_heap_E 
                    bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
 
   have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     using new_element_new_ptr h2 new_element_ptr by blast
   
   moreover have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_tag_type_writes h3])
-    using set_tag_type_pointers_preserved
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_tag_name_writes h3])
+    using set_tag_name_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   moreover have "document_ptr |\<in>| document_ptr_kinds h3"
     by (meson disc_nodes_h3 is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap)
 
   ultimately show ?thesis
     by (auto simp add: document_ptr_kinds_def)
 qed
 
 lemma create_element_known_ptr:
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
   shows "known_ptr (cast new_element_ptr)"
 proof -
   have "is_element_ptr new_element_ptr"
     using assms
     apply(auto simp add: create_element_def elim!: bind_returns_result_E)[1]
     using new_element_is_element_ptr
     by blast
   then show ?thesis
-    by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs)
+    by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs)
 qed
 end
 
 locale l_create_element = l_create_element_defs
 
 interpretation
-  i_create_element?: l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs set_tag_type set_tag_type_locs type_wf create_element known_ptr
+  i_create_element?: l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs set_tag_name set_tag_name_locs type_wf
+  create_element known_ptr
   by(auto simp add: l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def create_element_def instances)
 declare l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 subsubsection \<open>create\_character\_data\<close>
 
 locale l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_set_val_defs set_val set_val_locs +
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_disconnected_nodes_defs set_disconnected_nodes set_disconnected_nodes_locs
   for set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
 begin
 definition a_create_character_data :: "(_) document_ptr \<Rightarrow> string \<Rightarrow> (_, (_) character_data_ptr) dom_prog"
   where
     "a_create_character_data document_ptr text = do {
       new_character_data_ptr \<leftarrow> new_character_data;
       set_val new_character_data_ptr text;
       disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
       set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes);
       return new_character_data_ptr
     }"
 end
 
 locale l_create_character_data_defs =
   fixes create_character_data :: "(_) document_ptr \<Rightarrow> string \<Rightarrow> (_, (_) character_data_ptr) dom_prog"
 
 global_interpretation l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs set_val set_val_locs get_disconnected_nodes 
                      get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
   defines create_character_data = "l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_create_character_data 
                                              set_val get_disconnected_nodes set_disconnected_nodes"
   .
 
 locale l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs set_val set_val_locs get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs +
   l_get_disconnected_nodes type_wf get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_val type_wf set_val set_val_locs +
   l_create_character_data_defs create_character_data +
   l_known_ptr known_ptr
   for get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
   and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and create_character_data :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) character_data_ptr) prog"
   and known_ptr :: "(_) object_ptr \<Rightarrow> bool" +
   assumes known_ptr_impl: "known_ptr = a_known_ptr"
   assumes create_character_data_impl: "create_character_data = a_create_character_data"
 begin
 lemmas create_character_data_def = a_create_character_data_def[folded create_character_data_impl] 
 
 lemma create_character_data_document_in_heap:
   assumes "h \<turnstile> ok (create_character_data document_ptr text)"
   shows "document_ptr |\<in>| document_ptr_kinds h"
 proof -
   obtain h' where "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
     using assms(1)
     by auto
   then
   obtain new_character_data_ptr h2 h3 disc_nodes_h3 where
     new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
     h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
     by(auto simp add: create_character_data_def
             elim!: bind_returns_heap_E 
                    bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
 
   have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using new_character_data_new_ptr h2 new_character_data_ptr by blast
   
   moreover have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_val_writes h3])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
     using set_val_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   moreover have "document_ptr |\<in>| document_ptr_kinds h3"
     by (meson disc_nodes_h3 is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap)
 
   ultimately show ?thesis
     by (auto simp add: document_ptr_kinds_def)
 qed
 
 lemma create_character_data_known_ptr:
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
   shows "known_ptr (cast new_character_data_ptr)"
 proof -
   have "is_character_data_ptr new_character_data_ptr"
     using assms
     apply(auto simp add: create_character_data_def elim!: bind_returns_result_E)[1]
     using new_character_data_is_character_data_ptr
     by blast
   then show ?thesis
-    by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs)
+    by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs)
 qed
 end
 
 locale l_create_character_data = l_create_character_data_defs
 
 interpretation
-  i_create_character_data?: l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs set_val set_val_locs type_wf create_character_data known_ptr
-  by(auto simp add: l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def create_character_data_def instances)
+  i_create_character_data?: l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes
+  get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs set_val set_val_locs
+  type_wf create_character_data known_ptr
+  by(auto simp add: l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def
+      create_character_data_def instances)
 declare l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 subsubsection \<open>create\_character\_data\<close>
 
 locale l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
 begin
 definition a_create_document :: "(_, (_) document_ptr) dom_prog"
   where
     "a_create_document = new_document"
 end
 
 locale l_create_document_defs =
   fixes create_document :: "(_, (_) document_ptr) dom_prog"
 
 global_interpretation l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs
   defines create_document = "l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_create_document"
   .
 
 locale l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
   l_create_document_defs +
   assumes create_document_impl: "create_document = a_create_document"
 begin
 lemmas 
   create_document_def = create_document_impl[unfolded create_document_def, unfolded a_create_document_def]
 end
 
 locale l_create_document = l_create_document_defs
 
 interpretation
   i_create_document?: l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M create_document
   by(simp add: l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>tree\_order\<close>
 
 locale l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_child_nodes_defs get_child_nodes get_child_nodes_locs
   for get_child_nodes :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 partial_function (dom_prog) a_to_tree_order :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   where
     "a_to_tree_order ptr = (do {
       children \<leftarrow> get_child_nodes ptr;
       treeorders \<leftarrow> map_M a_to_tree_order (map (cast) children);
       return (ptr # concat treeorders)
     })"
 end
 
 locale l_to_tree_order_defs =
   fixes to_tree_order :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
 
 global_interpretation l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs defines
   to_tree_order = "l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_to_tree_order get_child_nodes" .
 declare a_to_tree_order.simps [code]
 
 locale l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs +
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs +
   l_to_tree_order_defs to_tree_order
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
   and type_wf :: "(_) heap \<Rightarrow> bool"
   and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
   and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
   and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog" +
   assumes to_tree_order_impl: "to_tree_order = a_to_tree_order"
 begin
 lemmas to_tree_order_def = a_to_tree_order.simps[folded to_tree_order_impl]
 
 lemma to_tree_order_pure [simp]: "pure (to_tree_order ptr) h"
 proof -
   have "\<forall>ptr h h' x. h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r x \<longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>h h' \<longrightarrow> h = h'"
   proof (induct rule: a_to_tree_order.fixp_induct[folded to_tree_order_impl])
     case 1
     then show ?case
       by (rule admissible_dom_prog)
   next
     case 2
     then show ?case
       by simp
   next
     case (3 f)
     then have "\<And>x h. pure (f x) h"
       by (metis is_OK_returns_heap_E is_OK_returns_result_E pure_def)
     then have "\<And>xs h. pure (map_M f xs) h"
       by(rule map_M_pure_I)
     then show ?case
       by(auto elim!: bind_returns_heap_E2)
   qed
   then show ?thesis
     unfolding pure_def
     by (metis is_OK_returns_heap_E is_OK_returns_result_E)
 qed
 end
 
 locale l_to_tree_order =
   fixes to_tree_order :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   assumes to_tree_order_pure [simp]: "pure (to_tree_order ptr) h"
 
 interpretation 
   i_to_tree_order?: l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes get_child_nodes_locs 
                     to_tree_order
   apply(unfold_locales)
   by (simp add: to_tree_order_def)
 declare l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma to_tree_order_is_l_to_tree_order [instances]: "l_to_tree_order to_tree_order"
   using to_tree_order_pure l_to_tree_order_def by blast
 
 
 
 subsubsection \<open>first\_in\_tree\_order\<close>
 
 locale l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_to_tree_order_defs to_tree_order
   for to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
 begin
 definition a_first_in_tree_order :: "(_) object_ptr \<Rightarrow> ((_) object_ptr 
                                 \<Rightarrow> (_, 'result option) dom_prog) \<Rightarrow> (_, 'result option) dom_prog"
   where
     "a_first_in_tree_order ptr f = (do {
       tree_order \<leftarrow> to_tree_order ptr;
       results \<leftarrow> map_filter_M f tree_order;
       (case results of
         [] \<Rightarrow> return None
       | x#_\<Rightarrow> return (Some x))
     })"
 end
 
 locale l_first_in_tree_order_defs =
   fixes first_in_tree_order :: "(_) object_ptr \<Rightarrow> ((_) object_ptr \<Rightarrow> (_, 'result option) dom_prog) 
                                                \<Rightarrow> (_, 'result option) dom_prog"
 
 global_interpretation l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs to_tree_order defines
   first_in_tree_order = "l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_first_in_tree_order to_tree_order" .
 
 locale l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs to_tree_order +
   l_first_in_tree_order_defs first_in_tree_order
   for to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
   and first_in_tree_order :: "(_) object_ptr \<Rightarrow> ((_) object_ptr \<Rightarrow> ((_) heap, exception, 'result option) prog) 
                                              \<Rightarrow> ((_) heap, exception, 'result option) prog" +
 assumes first_in_tree_order_impl: "first_in_tree_order = a_first_in_tree_order"
 begin
 lemmas first_in_tree_order_def = first_in_tree_order_impl[unfolded a_first_in_tree_order_def]
 end
 
 locale l_first_in_tree_order
 
 interpretation i_first_in_tree_order?:
   l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M to_tree_order first_in_tree_order
   by unfold_locales (simp add: first_in_tree_order_def)
 declare l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 
 subsubsection \<open>get\_element\_by\<close>
 
 locale l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_first_in_tree_order_defs first_in_tree_order +
   l_to_tree_order_defs to_tree_order +
   l_get_attribute_defs get_attribute get_attribute_locs
   for to_tree_order :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
   and first_in_tree_order :: "(_) object_ptr \<Rightarrow> ((_) object_ptr 
                               \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog) 
                               \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
   and get_attribute :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, char list option) prog"
   and get_attribute_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 definition a_get_element_by_id :: "(_) object_ptr \<Rightarrow> attr_value \<Rightarrow> (_, (_) element_ptr option) dom_prog"
   where
     "a_get_element_by_id ptr iden = first_in_tree_order ptr (\<lambda>ptr. (case cast ptr of
       Some element_ptr \<Rightarrow> do {
         id_opt \<leftarrow> get_attribute element_ptr ''id'';
         (if id_opt = Some iden then return (Some element_ptr) else return None)
       }
     | _ \<Rightarrow> return None
     ))"
 
 definition a_get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> attr_value \<Rightarrow> (_, (_) element_ptr list) dom_prog"
   where
     "a_get_elements_by_class_name ptr class_name = to_tree_order ptr \<bind>
       map_filter_M (\<lambda>ptr. (case cast ptr of
         Some element_ptr \<Rightarrow> do {
           class_name_opt \<leftarrow> get_attribute element_ptr ''class'';
           (if class_name_opt = Some class_name then return (Some element_ptr) else return None)
         }
       | _ \<Rightarrow> return None))"
 
 definition a_get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> attr_value \<Rightarrow> (_, (_) element_ptr list) dom_prog"
   where
-    "a_get_elements_by_tag_name ptr tag_name = to_tree_order ptr \<bind>
+    "a_get_elements_by_tag_name ptr tag = to_tree_order ptr \<bind>
       map_filter_M (\<lambda>ptr. (case cast ptr of
         Some element_ptr \<Rightarrow> do {
-          this_tag_name \<leftarrow> get_M element_ptr tag_type;
-          (if this_tag_name = tag_name then return (Some element_ptr) else return None)
+          this_tag_name \<leftarrow> get_M element_ptr tag_name;
+          (if this_tag_name = tag then return (Some element_ptr) else return None)
         }
       | _ \<Rightarrow> return None))"
 end
 
 locale l_get_element_by_defs =
   fixes get_element_by_id :: "(_) object_ptr \<Rightarrow> attr_value \<Rightarrow> (_, (_) element_ptr option) dom_prog"
   fixes get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> attr_value \<Rightarrow> (_, (_) element_ptr list) dom_prog"
   fixes get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> attr_value \<Rightarrow> (_, (_) element_ptr list) dom_prog"
 
 global_interpretation 
 l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs to_tree_order first_in_tree_order get_attribute get_attribute_locs 
 defines                      
   get_element_by_id = "l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_element_by_id first_in_tree_order get_attribute" 
 and
-  get_elements_by_class_name = "l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_elements_by_class_name to_tree_order get_attribute" 
+    get_elements_by_class_name = "l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_elements_by_class_name
+to_tree_order get_attribute"
 and
   get_elements_by_tag_name = "l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_elements_by_tag_name to_tree_order" .
 
 locale l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs to_tree_order first_in_tree_order get_attribute get_attribute_locs +
   l_get_element_by_defs get_element_by_id get_elements_by_class_name get_elements_by_tag_name +
   l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M to_tree_order first_in_tree_order +
   l_to_tree_order to_tree_order +
   l_get_attribute type_wf get_attribute get_attribute_locs
   for to_tree_order :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
-  and first_in_tree_order :: "(_) object_ptr \<Rightarrow> ((_) object_ptr \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog) 
+    and first_in_tree_order ::
+    "(_) object_ptr \<Rightarrow> ((_) object_ptr \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog)
                                              \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
   and get_attribute :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, char list option) prog"
   and get_attribute_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
-  and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
-  and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_element_by_id ::
+    "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
+    and get_elements_by_class_name ::
+    "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
+    and get_elements_by_tag_name ::
+    "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
   and type_wf :: "(_) heap \<Rightarrow> bool" +
   assumes get_element_by_id_impl: "get_element_by_id = a_get_element_by_id"
   assumes get_elements_by_class_name_impl: "get_elements_by_class_name = a_get_elements_by_class_name"
   assumes get_elements_by_tag_name_impl: "get_elements_by_tag_name = a_get_elements_by_tag_name"
 begin
 lemmas 
   get_element_by_id_def = get_element_by_id_impl[unfolded a_get_element_by_id_def]
 lemmas 
   get_elements_by_class_name_def = get_elements_by_class_name_impl[unfolded a_get_elements_by_class_name_def]
 lemmas 
   get_elements_by_tag_name_def = get_elements_by_tag_name_impl[unfolded a_get_elements_by_tag_name_def]
 
 lemma get_element_by_id_result_in_tree_order:
   assumes "h \<turnstile> get_element_by_id ptr iden \<rightarrow>\<^sub>r Some element_ptr"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   shows "cast element_ptr \<in> set to"
   using assms 
   by(auto simp add: get_element_by_id_def first_in_tree_order_def  
                elim!: map_filter_M_pure_E[where y=element_ptr]  bind_returns_result_E2 
                dest!: bind_returns_result_E3[rotated, OF assms(2), rotated] 
                intro!: map_filter_M_pure map_M_pure_I bind_pure_I 
                split: option.splits list.splits if_splits)
 
 lemma get_elements_by_class_name_result_in_tree_order:
   assumes "h \<turnstile> get_elements_by_class_name ptr name \<rightarrow>\<^sub>r results"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   assumes "element_ptr \<in> set results"
   shows "cast element_ptr \<in> set to"
   using assms 
   by(auto simp add: get_elements_by_class_name_def first_in_tree_order_def  
                elim!: map_filter_M_pure_E[where y=element_ptr]  bind_returns_result_E2 
                dest!: bind_returns_result_E3[rotated, OF assms(2), rotated] 
                intro!: map_filter_M_pure map_M_pure_I bind_pure_I 
                split: option.splits list.splits if_splits)
 
 lemma get_elements_by_tag_name_result_in_tree_order:
   assumes "h \<turnstile> get_elements_by_tag_name ptr name \<rightarrow>\<^sub>r results"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   assumes "element_ptr \<in> set results"
   shows "cast element_ptr \<in> set to"
   using assms 
   by(auto simp add: get_elements_by_tag_name_def first_in_tree_order_def  
                elim!: map_filter_M_pure_E[where y=element_ptr]  bind_returns_result_E2 
                dest!: bind_returns_result_E3[rotated, OF assms(2), rotated] 
                intro!: map_filter_M_pure map_M_pure_I bind_pure_I 
                split: option.splits list.splits if_splits)
 
-lemma get_elements_by_tag_name_pure [simp]: "pure (get_elements_by_tag_name ptr tag_name) h"
+lemma get_elements_by_tag_name_pure [simp]: "pure (get_elements_by_tag_name ptr tag) h"
   by(auto simp add: get_elements_by_tag_name_def 
           intro!: bind_pure_I map_filter_M_pure 
           split: option.splits)
 end
 
 locale l_get_element_by = l_get_element_by_defs + l_to_tree_order_defs +
   assumes get_element_by_id_result_in_tree_order: 
           "h \<turnstile> get_element_by_id ptr iden \<rightarrow>\<^sub>r Some element_ptr \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to 
                \<Longrightarrow> cast element_ptr \<in> set to"
-  assumes get_elements_by_tag_name_pure [simp]: "pure (get_elements_by_tag_name ptr tag_name) h"
+  assumes get_elements_by_tag_name_pure [simp]: "pure (get_elements_by_tag_name ptr tag) h"
 
 interpretation 
   i_get_element_by?: l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M to_tree_order first_in_tree_order get_attribute 
                      get_attribute_locs get_element_by_id get_elements_by_class_name
                      get_elements_by_tag_name type_wf
   using instances
   apply(simp add: l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def)
   by(simp add: get_element_by_id_def get_elements_by_class_name_def get_elements_by_tag_name_def)
 declare l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_element_by_is_l_get_element_by [instances]: 
   "l_get_element_by get_element_by_id get_elements_by_tag_name to_tree_order"
   apply(unfold_locales)
   using get_element_by_id_result_in_tree_order get_elements_by_tag_name_pure
   by fast+
 end
diff --git a/thys/Core_DOM/common/classes/CharacterDataClass.thy b/thys/Core_DOM/common/classes/CharacterDataClass.thy
--- a/thys/Core_DOM/common/classes/CharacterDataClass.thy
+++ b/thys/Core_DOM/common/classes/CharacterDataClass.thy
@@ -1,350 +1,355 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>CharacterData\<close>
 text\<open>In this theory, we introduce the types for the CharacterData class.\<close>
 theory CharacterDataClass
   imports
     ElementClass
 begin
 
 subsubsection\<open>CharacterData\<close>
 
 text\<open>The type @{type "DOMString"} is a type synonym for @{type "string"}, defined 
      \autoref{sec:Core_DOM_Basic_Datatypes}.\<close>
 
 record RCharacterData = RNode +
   nothing :: unit
   val :: DOMString
 register_default_tvars "'CharacterData RCharacterData_ext" 
 type_synonym 'CharacterData CharacterData = "'CharacterData option RCharacterData_scheme"
 register_default_tvars "'CharacterData CharacterData" 
 type_synonym ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Node, 
     'Element, 'CharacterData) Node
   = "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 
       'CharacterData option RCharacterData_ext + 'Node, 'Element) Node"
 register_default_tvars "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Node, 
                          'Element, 'CharacterData) Node" 
 type_synonym ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Object, 'Node, 
     'Element, 'CharacterData) Object
   = "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Object, 
       'CharacterData option RCharacterData_ext + 'Node,
       'Element) Object"
 register_default_tvars "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Object, 
                          'Node, 'Element, 'CharacterData) Object" 
 
 type_synonym ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
     'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData) heap
   = "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 'shadow_root_ptr, 
       'Object, 'CharacterData option RCharacterData_ext + 'Node, 'Element) heap"
 register_default_tvars "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
                          'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData) heap"  
 type_synonym heap\<^sub>f\<^sub>i\<^sub>n\<^sub>a\<^sub>l = "(unit, unit, unit, unit, unit, unit, unit, unit, unit, unit) heap"
 
 
 definition character_data_ptr_kinds :: "(_) heap \<Rightarrow> (_) character_data_ptr fset"
   where                                                                                           
     "character_data_ptr_kinds heap = the |`| (cast |`| (ffilter is_character_data_ptr_kind 
                                                                 (node_ptr_kinds heap)))"
 
 lemma character_data_ptr_kinds_simp [simp]:
   "character_data_ptr_kinds (Heap (fmupd (cast character_data_ptr) character_data (the_heap h))) 
               = {|character_data_ptr|} |\<union>| character_data_ptr_kinds h"
   apply(auto simp add: character_data_ptr_kinds_def)[1]
   by force
 
 definition character_data_ptrs :: "(_) heap \<Rightarrow> _ character_data_ptr fset"
   where
     "character_data_ptrs heap = ffilter is_character_data_ptr (character_data_ptr_kinds heap)"
 
 abbreviation "character_data_ptr_exts heap \<equiv> character_data_ptr_kinds heap - character_data_ptrs heap"
 
 definition cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a :: "(_) Node \<Rightarrow> (_) CharacterData option"
   where
     "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a node = (case RNode.more node of
           Inr (Inl character_data) \<Rightarrow> Some (RNode.extend (RNode.truncate node) character_data)
         | _ \<Rightarrow> None)"
 adhoc_overloading cast cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 
 abbreviation cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a :: "(_) Object \<Rightarrow> (_) CharacterData  option"
   where
     "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a obj \<equiv> (case cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e obj of Some node \<Rightarrow> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a node 
                                                        | None \<Rightarrow> None)"
 adhoc_overloading cast cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 
 definition cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) CharacterData \<Rightarrow> (_) Node"
   where
     "cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e character_data = RNode.extend (RNode.truncate character_data)
                                                       (Inr (Inl (RNode.more character_data)))"
 adhoc_overloading cast cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 abbreviation cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) CharacterData \<Rightarrow> (_) Object"
   where
     "cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr \<equiv> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t (cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr)"
 adhoc_overloading cast cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 consts is_character_data_kind :: 'a
 definition is_character_data_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) Node \<Rightarrow> bool"
   where
     "is_character_data_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr \<longleftrightarrow> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr \<noteq> None"
 
 adhoc_overloading is_character_data_kind is_character_data_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 lemmas is_character_data_kind_def = is_character_data_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
 
 abbreviation is_character_data_kind\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) Object \<Rightarrow> bool"
   where
     "is_character_data_kind\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr \<equiv> cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr \<noteq> None"
 adhoc_overloading is_character_data_kind is_character_data_kind\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 lemma character_data_ptr_kinds_commutes [simp]:
   "cast character_data_ptr |\<in>| node_ptr_kinds h 
        \<longleftrightarrow> character_data_ptr |\<in>| character_data_ptr_kinds h"
   apply(auto simp add: character_data_ptr_kinds_def)[1]
   by (metis character_data_ptr_casts_commute2 comp_eq_dest_lhs ffmember_filter fimage_eqI 
       is_character_data_ptr_kind_none
       option.distinct(1) option.sel)
 
 definition get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a :: "(_) character_data_ptr \<Rightarrow> (_) heap \<Rightarrow> (_) CharacterData option"
   where                             
     "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr h = Option.bind (get\<^sub>N\<^sub>o\<^sub>d\<^sub>e (cast character_data_ptr) h) cast"
 adhoc_overloading get get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 
 locale l_type_wf_def\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 begin
 definition a_type_wf :: "(_) heap \<Rightarrow> bool"
   where
     "a_type_wf h = (ElementClass.type_wf h
                  \<and> (\<forall>character_data_ptr \<in> fset (character_data_ptr_kinds h).
                      get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr h \<noteq> None))"
 end
 global_interpretation l_type_wf_def\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a defines type_wf = a_type_wf .
 lemmas type_wf_defs = a_type_wf_def
 
 locale l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a = l_type_wf type_wf for type_wf :: "((_) heap \<Rightarrow> bool)" +
   assumes type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a: "type_wf h \<Longrightarrow> CharacterDataClass.type_wf h"
 
 sublocale l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a \<subseteq> l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
   apply(unfold_locales)
   using ElementClass.a_type_wf_def
   by (meson CharacterDataClass.a_type_wf_def l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_axioms l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
 
 locale l_get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas = l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 begin
 sublocale l_get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas by unfold_locales
 
 lemma get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_type_wf:
   assumes "type_wf h"
   shows "character_data_ptr |\<in>| character_data_ptr_kinds h 
           \<longleftrightarrow> get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr h \<noteq> None"
   using l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_axioms assms
   apply(simp add: type_wf_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
-  by (metis assms bind.bind_lzero character_data_ptr_kinds_commutes fmember.rep_eq local.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf option.exhaust option.simps(3))
+  by (metis assms bind.bind_lzero character_data_ptr_kinds_commutes fmember.rep_eq
+      local.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf option.exhaust option.simps(3))
 end
 
 global_interpretation l_get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas type_wf
   by unfold_locales
 
 definition put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a :: "(_) character_data_ptr \<Rightarrow> (_) CharacterData \<Rightarrow> (_) heap \<Rightarrow> (_) heap"
   where
     "put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr character_data = put\<^sub>N\<^sub>o\<^sub>d\<^sub>e (cast character_data_ptr) 
                    (cast character_data)"
 adhoc_overloading put put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 
 lemma put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_in_heap:
   assumes "put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr character_data h = h'"
   shows "character_data_ptr |\<in>| character_data_ptr_kinds h'"
   using assms put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_ptr_in_heap
   unfolding put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def character_data_ptr_kinds_def
   by (metis character_data_ptr_kinds_commutes character_data_ptr_kinds_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_ptr_in_heap)
 
 lemma put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_put_ptrs:
   assumes "put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr character_data h = h'"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast character_data_ptr|}"
   using assms
   by (simp add: put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_put_ptrs)
 
 
 lemma cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inject [simp]: "cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e x = cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e y \<longleftrightarrow> x = y"
   apply(simp add: cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RObject.extend_def RNode.extend_def)
   by (metis (full_types) RNode.surjective old.unit.exhaust)
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_none [simp]:
   "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a node = None \<longleftrightarrow> \<not> (\<exists>character_data. cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e character_data = node)"
   apply(auto simp add: cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RObject.extend_def RNode.extend_def 
       split: sum.splits)[1]
   by (metis (full_types) RNode.select_convs(2) RNode.surjective old.unit.exhaust)
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_some [simp]: 
   "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a node = Some character_data \<longleftrightarrow> cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e character_data = node"
   by(auto simp add: cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RObject.extend_def RNode.extend_def 
       split: sum.splits)
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_inv [simp]: 
   "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a (cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e character_data) = Some character_data"
   by simp
 
 lemma cast_element_not_character_data [simp]:
   "(cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e element \<noteq> cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e character_data)"
   "(cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e character_data \<noteq> cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e element)"
   by(auto simp add: cast\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RNode.extend_def)
 
 lemma get_CharacterData_simp1 [simp]: 
   "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr (put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr character_data h) 
        = Some character_data"
   by(auto simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
 lemma get_CharacterData_simp2 [simp]: 
   "character_data_ptr \<noteq> character_data_ptr' \<Longrightarrow> get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr 
          (put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr' character_data h) = get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr h"
   by(auto simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
 
 lemma get_CharacterData_simp3 [simp]: 
   "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr (put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr f h) = get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr h"
   by(auto simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
 lemma get_CharacterData_simp4 [simp]: 
   "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a element_ptr (put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t character_data_ptr f h) = get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a element_ptr h"
   by(auto simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a [simp]:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   shows "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr h = get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr h'"
   using assms
   by(auto simp add: new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 
 
 abbreviation "create_character_data_obj val_arg
   \<equiv> \<lparr> RObject.nothing = (), RNode.nothing = (), RCharacterData.nothing = (), val = val_arg, \<dots> = None \<rparr>"
 
 definition new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a :: "(_) heap \<Rightarrow> ((_) character_data_ptr \<times> (_) heap)"
   where
     "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h =
       (let new_character_data_ptr = character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref 
             |`| (character_data_ptrs h)))) in
         (new_character_data_ptr, put new_character_data_ptr (create_character_data_obj '''') h))"
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_in_heap:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   shows "new_character_data_ptr |\<in>| character_data_ptr_kinds h'"
   using assms
   unfolding new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def
   using put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_in_heap by blast
 
 lemma new_character_data_ptr_new: 
   "character_data_ptr.Ref (Suc (fMax (finsert 0 (character_data_ptr.the_ref |`| character_data_ptrs h)))) 
               |\<notin>| character_data_ptrs h"
-  by (metis Suc_n_not_le_n character_data_ptr.sel(1) fMax_ge fimage_finsert finsertI1 finsertI2 set_finsert)
+  by (metis Suc_n_not_le_n character_data_ptr.sel(1) fMax_ge fimage_finsert finsertI1
+      finsertI2 set_finsert)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_not_in_heap:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   shows "new_character_data_ptr |\<notin>| character_data_ptr_kinds h"
   using assms
   unfolding new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def
-  by (metis Pair_inject character_data_ptrs_def fMax_finsert fempty_iff ffmember_filter fimage_is_fempty is_character_data_ptr_ref max_0L new_character_data_ptr_new)
+  by (metis Pair_inject character_data_ptrs_def fMax_finsert fempty_iff ffmember_filter
+      fimage_is_fempty is_character_data_ptr_ref max_0L new_character_data_ptr_new)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_new_ptr:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
   using assms
   by (metis Pair_inject new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_put_ptrs)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_is_character_data_ptr:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   shows "is_character_data_ptr new_character_data_ptr"
   using assms
   by(auto simp add: new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t [simp]:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   assumes "ptr \<noteq> cast new_character_data_ptr"
   shows "get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_get\<^sub>N\<^sub>o\<^sub>d\<^sub>e [simp]:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   assumes "ptr \<noteq> cast new_character_data_ptr"
   shows "get\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr h = get\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr h'"
   using assms
   by(auto simp add: new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   shows "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a [simp]:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   assumes "ptr \<noteq> new_character_data_ptr"
   shows "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr h = get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr h'"
   using assms
   by(auto simp add: new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def)
 
 
 locale l_known_ptr\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 begin
 definition a_known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   where
     "a_known_ptr ptr = (known_ptr ptr \<or> is_character_data_ptr ptr)"
 
 lemma known_ptr_not_character_data_ptr: 
   "\<not>is_character_data_ptr ptr \<Longrightarrow> a_known_ptr ptr \<Longrightarrow> known_ptr ptr"
   by(simp add: a_known_ptr_def)
 end
 global_interpretation l_known_ptr\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a defines known_ptr = a_known_ptr .
 lemmas known_ptr_defs = a_known_ptr_def
 
 
 locale l_known_ptrs\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a = l_known_ptr known_ptr for known_ptr :: "(_) object_ptr \<Rightarrow> bool"
 begin
 definition a_known_ptrs :: "(_) heap \<Rightarrow> bool"
   where
     "a_known_ptrs h = (\<forall>ptr \<in> fset (object_ptr_kinds h). known_ptr ptr)"
 
 lemma known_ptrs_known_ptr: "a_known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptr ptr"
   apply(simp add: a_known_ptrs_def)
   using notin_fset by fastforce
 
 lemma known_ptrs_preserved: 
   "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
   by(auto simp add: a_known_ptrs_def)
 lemma known_ptrs_subset: 
   "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def less_eq_fset.rep_eq subsetD)
-lemma known_ptrs_new_ptr: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_new_ptr:
+  "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow>
+a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def)
 end
 global_interpretation l_known_ptrs\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a known_ptr defines known_ptrs = a_known_ptrs .
 lemmas known_ptrs_defs = a_known_ptrs_def
 
 lemma known_ptrs_is_l_known_ptrs: "l_known_ptrs known_ptr known_ptrs"
   using known_ptrs_known_ptr known_ptrs_preserved known_ptrs_subset known_ptrs_new_ptr l_known_ptrs_def
   by blast
 
 end
diff --git a/thys/Core_DOM/common/classes/DocumentClass.thy b/thys/Core_DOM/common/classes/DocumentClass.thy
--- a/thys/Core_DOM/common/classes/DocumentClass.thy
+++ b/thys/Core_DOM/common/classes/DocumentClass.thy
@@ -1,340 +1,345 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Document\<close>
 text\<open>In this theory, we introduce the types for the Document class.\<close>
 theory DocumentClass
   imports       
     CharacterDataClass
 begin           
 
 text\<open>The type @{type "doctype"} is a type synonym for @{type "string"}, defined 
      in \autoref{sec:Core_DOM_Basic_Datatypes}.\<close>
 
 record ('node_ptr, 'element_ptr, 'character_data_ptr) RDocument = RObject +
   nothing :: unit
   doctype :: doctype
   document_element :: "(_) element_ptr option"
   disconnected_nodes :: "('node_ptr, 'element_ptr, 'character_data_ptr) node_ptr list"
 type_synonym 
   ('node_ptr, 'element_ptr, 'character_data_ptr, 'Document) Document
   = "('node_ptr, 'element_ptr, 'character_data_ptr, 'Document option) RDocument_scheme"
 register_default_tvars 
   "('node_ptr, 'element_ptr, 'character_data_ptr, 'Document) Document"
 type_synonym 
   ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Object, 'Node, 
     'Element, 'CharacterData, 'Document) Object
   = "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 
         ('node_ptr, 'element_ptr, 'character_data_ptr, 'Document option)
     RDocument_ext + 'Object, 'Node, 'Element, 'CharacterData) Object"
 register_default_tvars "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 
      'Object, 'Node, 'Element, 'CharacterData, 'Document) Object" 
 
 type_synonym ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
     'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData, 'Document) heap
   = "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
       'shadow_root_ptr,                                 
       ('node_ptr, 'element_ptr, 'character_data_ptr, 'Document option) RDocument_ext + 'Object, 'Node, 
       'Element, 'CharacterData) heap"
 register_default_tvars 
   "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
   'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData, 'Document) heap"
 type_synonym heap\<^sub>f\<^sub>i\<^sub>n\<^sub>a\<^sub>l = "(unit, unit, unit, unit, unit, unit, unit, unit, unit, unit, unit) heap"
 
 
 definition document_ptr_kinds :: "(_) heap \<Rightarrow> (_) document_ptr fset"
   where
     "document_ptr_kinds heap = the |`| (cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |`| 
                                (ffilter is_document_ptr_kind (object_ptr_kinds heap)))"
 
 definition document_ptrs :: "(_) heap \<Rightarrow> (_) document_ptr fset"
   where
     "document_ptrs heap = ffilter is_document_ptr (document_ptr_kinds heap)"
 
 definition cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) Object \<Rightarrow> (_) Document option"
   where
     "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t obj = (case RObject.more obj of
       Inr (Inl document) \<Rightarrow> Some (RObject.extend (RObject.truncate obj) document)
     | _ \<Rightarrow> None)"
 adhoc_overloading cast cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 definition cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t:: "(_) Document \<Rightarrow> (_) Object"
   where
     "cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t document = (RObject.extend (RObject.truncate document) 
                                           (Inr (Inl (RObject.more document))))"
 adhoc_overloading cast cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 definition is_document_kind :: "(_) Object \<Rightarrow> bool"
   where
     "is_document_kind ptr \<longleftrightarrow> cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr \<noteq> None"
 
 lemma document_ptr_kinds_simp [simp]: 
   "document_ptr_kinds (Heap (fmupd (cast document_ptr) document (the_heap h))) 
           = {|document_ptr|} |\<union>| document_ptr_kinds h"
   apply(auto simp add: document_ptr_kinds_def)[1]
   by force
 
 lemma document_ptr_kinds_commutes [simp]: 
   "cast document_ptr |\<in>| object_ptr_kinds h \<longleftrightarrow> document_ptr |\<in>| document_ptr_kinds h"
   apply(auto simp add: object_ptr_kinds_def document_ptr_kinds_def)[1]
   by (metis (no_types, lifting) document_ptr_casts_commute2 document_ptr_document_ptr_cast 
       ffmember_filter fimage_eqI fset.map_comp option.sel)
 
 definition get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) document_ptr \<Rightarrow> (_) heap \<Rightarrow> (_) Document option"
   where                             
     "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h = Option.bind (get (cast document_ptr) h) cast"
 adhoc_overloading get get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 locale l_type_wf_def\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 definition a_type_wf :: "(_) heap \<Rightarrow> bool"
   where
     "a_type_wf h = (CharacterDataClass.type_wf h \<and> 
     (\<forall>document_ptr \<in> fset (document_ptr_kinds h). get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h \<noteq> None))"
 end
 global_interpretation l_type_wf_def\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t defines type_wf = a_type_wf .
 lemmas type_wf_defs = a_type_wf_def
 
 locale l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t = l_type_wf type_wf for type_wf :: "((_) heap \<Rightarrow> bool)" +
   assumes type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t: "type_wf h \<Longrightarrow> DocumentClass.type_wf h"
 
 sublocale l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t \<subseteq> l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
   apply(unfold_locales)
   by (metis (full_types) type_wf_defs l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_axioms l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 locale l_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas = l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 sublocale l_get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas by unfold_locales
 lemma get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf:
   assumes "type_wf h"
   shows "document_ptr |\<in>| document_ptr_kinds h \<longleftrightarrow> get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h \<noteq> None"
   using l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_axioms assms
   apply(simp add: type_wf_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
-  by (metis document_ptr_kinds_commutes fmember.rep_eq is_none_bind is_none_simps(1) is_none_simps(2) local.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf)
+  by (metis document_ptr_kinds_commutes fmember.rep_eq is_none_bind is_none_simps(1)
+      is_none_simps(2) local.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf)
 end
 
 global_interpretation l_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas type_wf by unfold_locales
 
 definition put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) document_ptr \<Rightarrow> (_) Document \<Rightarrow> (_) heap \<Rightarrow> (_) heap"
   where
     "put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr document = put (cast document_ptr) (cast document)"
 adhoc_overloading put put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 lemma put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap:
   assumes "put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr document h = h'"
   shows "document_ptr |\<in>| document_ptr_kinds h'"
   using assms
   unfolding put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
   by (metis document_ptr_kinds_commutes put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_ptr_in_heap)
 
 lemma put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_put_ptrs:
   assumes "put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr document h = h'"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast document_ptr|}"
   using assms
   by (simp add: put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_put_ptrs)
 
 
 lemma cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_inject [simp]: "cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t x = cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t y \<longleftrightarrow> x = y"
   apply(simp add: cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def)
   by (metis (full_types) RObject.surjective old.unit.exhaust)
 
 lemma cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_none [simp]: 
   "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t obj = None \<longleftrightarrow> \<not> (\<exists>document. cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t document = obj)"
   apply(auto simp add: cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def 
       split: sum.splits)[1]
   by (metis (full_types) RObject.select_convs(2) RObject.surjective old.unit.exhaust)
 
 lemma cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_some [simp]: 
   "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t obj = Some document \<longleftrightarrow> cast document = obj"
   by(auto simp add: cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def 
       split: sum.splits)
 
 lemma cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_inv [simp]: "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t (cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t document) = Some document"
   by simp
 
 lemma cast_document_not_node [simp]:
   "cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t document \<noteq> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t node"
   "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t node \<noteq> cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t document"
   by(auto simp add: cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def)
 
 lemma get_document_ptr_simp1 [simp]: 
   "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr document h) = Some document"
   by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 lemma get_document_ptr_simp2 [simp]: 
   "document_ptr \<noteq> document_ptr' 
    \<Longrightarrow> get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr' document h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
   by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 
 lemma get_document_ptr_simp3 [simp]: 
   "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr (put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr f h) = get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr h"
   by(auto simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
-lemma get_document_ptr_simp4 [simp]: "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr f h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
+lemma get_document_ptr_simp4 [simp]:
+  "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr f h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
   by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 lemma get_document_ptr_simp5 [simp]: 
   "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr (put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr f h) = get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr h"
   by(auto simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
-lemma get_document_ptr_simp6 [simp]: "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr f h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
+lemma get_document_ptr_simp6 [simp]:
+  "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr f h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
   by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   shows "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 lemma new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
   assumes "new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h = (new_character_data_ptr, h')"
   shows "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def)
 
 
 
 abbreviation 
   create_document_obj :: "char list \<Rightarrow> (_) element_ptr option \<Rightarrow> (_) node_ptr list \<Rightarrow> (_) Document"
   where
     "create_document_obj doctype_arg document_element_arg disconnected_nodes_arg
   \<equiv> \<lparr> RObject.nothing = (), RDocument.nothing = (), doctype = doctype_arg, 
       document_element = document_element_arg,
       disconnected_nodes = disconnected_nodes_arg, \<dots> = None \<rparr>"
 
 definition new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_)heap \<Rightarrow> ((_) document_ptr \<times> (_) heap)"
   where
     "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = 
      (let new_document_ptr = document_ptr.Ref (Suc (fMax (finsert 0 (document_ptr.the_ref |`| (document_ptrs h))))) 
         in
          (new_document_ptr, put new_document_ptr (create_document_obj '''' None []) h))"
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "new_document_ptr |\<in>| document_ptr_kinds h'"
   using assms
   unfolding new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def
   using put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap by blast
 
 lemma new_document_ptr_new: 
   "document_ptr.Ref (Suc (fMax (finsert 0 (document_ptr.the_ref |`| document_ptrs h)))) 
       |\<notin>| document_ptrs h"
   by (metis Suc_n_not_le_n document_ptr.sel(1) fMax_ge fimage_finsert finsertI1 finsertI2 set_finsert)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_not_in_heap:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "new_document_ptr |\<notin>| document_ptr_kinds h"
   using assms
   unfolding new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
   by (metis Pair_inject document_ptrs_def fMax_finsert fempty_iff ffmember_filter 
       fimage_is_fempty is_document_ptr_ref max_0L new_document_ptr_new)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_new_ptr:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_document_ptr|}"
   using assms
   by (metis Pair_inject new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_put_ptrs)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_is_document_ptr:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "is_document_ptr new_document_ptr"
   using assms
   by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t [simp]:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   assumes "ptr \<noteq> cast new_document_ptr"
   shows "get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>N\<^sub>o\<^sub>d\<^sub>e [simp]:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "get\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr h = get\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr h'"
   using assms
   apply(simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
   by(auto simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a [simp]:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   shows "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr h = get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr h'"
   using assms
   by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
   assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
   assumes "ptr \<noteq> new_document_ptr"
   shows "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 
 locale l_known_ptr\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 definition a_known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   where
     "a_known_ptr ptr = (known_ptr ptr \<or> is_document_ptr ptr)"
 
 lemma known_ptr_not_document_ptr: "\<not>is_document_ptr ptr \<Longrightarrow> a_known_ptr ptr \<Longrightarrow> known_ptr ptr"
   by(simp add: a_known_ptr_def)
 end
 global_interpretation l_known_ptr\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t defines known_ptr = a_known_ptr .
 lemmas known_ptr_defs = a_known_ptr_def
 
 
 locale l_known_ptrs\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t = l_known_ptr known_ptr for known_ptr :: "(_) object_ptr \<Rightarrow> bool"
 begin
 definition a_known_ptrs :: "(_) heap \<Rightarrow> bool"
   where
     "a_known_ptrs h = (\<forall>ptr \<in> fset (object_ptr_kinds h). known_ptr ptr)"
 
 lemma known_ptrs_known_ptr: "a_known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptr ptr"
   apply(simp add: a_known_ptrs_def)
   using notin_fset by fastforce
 
 lemma known_ptrs_preserved: 
   "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
   by(auto simp add: a_known_ptrs_def)
 lemma known_ptrs_subset: 
   "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def less_eq_fset.rep_eq subsetD)
-lemma known_ptrs_new_ptr: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_new_ptr:
+  "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow>
+a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def)
 end
 global_interpretation l_known_ptrs\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t known_ptr defines known_ptrs = a_known_ptrs .
 lemmas known_ptrs_defs = a_known_ptrs_def
 
 lemma known_ptrs_is_l_known_ptrs  [instances]: "l_known_ptrs known_ptr known_ptrs"
   using known_ptrs_known_ptr known_ptrs_preserved l_known_ptrs_def known_ptrs_subset known_ptrs_new_ptr
   by blast
 
 end
diff --git a/thys/Core_DOM/common/classes/NodeClass.thy b/thys/Core_DOM/common/classes/NodeClass.thy
--- a/thys/Core_DOM/common/classes/NodeClass.thy
+++ b/thys/Core_DOM/common/classes/NodeClass.thy
@@ -1,204 +1,209 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 
 section\<open>Node\<close>
 text\<open>In this theory, we introduce the types for the Node class.\<close>
 
 theory NodeClass
   imports
     ObjectClass
     "../pointers/NodePointer"
 begin
 
 subsubsection\<open>Node\<close>
 
 record RNode = RObject
   + nothing :: unit
 register_default_tvars "'Node RNode_ext" 
 type_synonym 'Node Node = "'Node RNode_scheme"
 register_default_tvars "'Node Node" 
 type_synonym ('Object, 'Node) Object = "('Node RNode_ext + 'Object) Object"
 register_default_tvars "('Object, 'Node) Object" 
 
 type_synonym ('object_ptr, 'node_ptr, 'Object, 'Node) heap
   = "('node_ptr node_ptr + 'object_ptr, 'Node RNode_ext + 'Object) heap"
 register_default_tvars
   "('object_ptr, 'node_ptr, 'Object, 'Node) heap" 
 type_synonym heap\<^sub>f\<^sub>i\<^sub>n\<^sub>a\<^sub>l = "(unit, unit, unit, unit) heap"
 
 
 definition node_ptr_kinds :: "(_) heap \<Rightarrow> (_) node_ptr fset"
   where
     "node_ptr_kinds heap = 
     (the |`| (cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r |`| (ffilter is_node_ptr_kind (object_ptr_kinds heap))))"
 
 lemma node_ptr_kinds_simp [simp]: 
   "node_ptr_kinds (Heap (fmupd (cast node_ptr) node (the_heap h))) 
        = {|node_ptr|} |\<union>| node_ptr_kinds h"
   apply(auto simp add: node_ptr_kinds_def)[1]
   by force
 
 definition cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) Object \<Rightarrow> (_) Node option"
   where
     "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e obj = (case RObject.more obj of Inl node 
     \<Rightarrow> Some (RObject.extend (RObject.truncate obj) node) | _ \<Rightarrow> None)"
 adhoc_overloading cast cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 definition cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t:: "(_) Node \<Rightarrow> (_) Object"
   where
     "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t node = (RObject.extend (RObject.truncate node) (Inl (RObject.more node)))"
 adhoc_overloading cast cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 definition is_node_kind :: "(_) Object \<Rightarrow> bool"
   where
     "is_node_kind ptr \<longleftrightarrow> cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr \<noteq> None"
 
 definition get\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) node_ptr \<Rightarrow> (_) heap \<Rightarrow> (_) Node option"
   where                             
     "get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr h = Option.bind (get (cast node_ptr) h) cast"
 adhoc_overloading get get\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 locale l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 begin
 definition a_type_wf :: "(_) heap \<Rightarrow> bool"
   where
     "a_type_wf h = (ObjectClass.type_wf h 
                     \<and> (\<forall>node_ptr \<in> fset( node_ptr_kinds h). get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr h \<noteq> None))"
 end
 global_interpretation l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e defines type_wf = a_type_wf .
 lemmas type_wf_defs = a_type_wf_def
 
 locale l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e = l_type_wf type_wf for type_wf :: "((_) heap \<Rightarrow> bool)" +
   assumes type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e: "type_wf h \<Longrightarrow> NodeClass.type_wf h"
 
 sublocale l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e \<subseteq> l_type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
   apply(unfold_locales)
   using ObjectClass.a_type_wf_def by auto
 
 locale l_get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas = l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 begin
 sublocale l_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas by unfold_locales
 lemma get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf:
   assumes "type_wf h"
   shows "node_ptr |\<in>| node_ptr_kinds h \<longleftrightarrow> get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr h \<noteq> None"
   using l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e_axioms assms
   apply(simp add: type_wf_defs get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
   by (metis bind_eq_None_conv ffmember_filter fimage_eqI fmember.rep_eq is_node_ptr_kind_cast 
             get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf node_ptr_casts_commute2 node_ptr_kinds_def option.sel option.simps(3))
 end
 
 global_interpretation l_get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas type_wf
   by unfold_locales
 
 definition put\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) node_ptr \<Rightarrow> (_) Node \<Rightarrow> (_) heap \<Rightarrow> (_) heap"
   where
     "put\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr node = put (cast node_ptr) (cast node)"
 adhoc_overloading put put\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 lemma put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_ptr_in_heap:
   assumes "put\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr node h = h'"
   shows "node_ptr |\<in>| node_ptr_kinds h'"
   using assms
   unfolding put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def node_ptr_kinds_def
   by (metis ffmember_filter fimage_eqI is_node_ptr_kind_cast node_ptr_casts_commute2 
       option.sel put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_ptr_in_heap)
 
 lemma put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_put_ptrs:
   assumes "put\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr node h = h'"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast node_ptr|}"
   using assms
   by (simp add: put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_put_ptrs)
 
 lemma node_ptr_kinds_commutes [simp]: 
   "cast node_ptr |\<in>| object_ptr_kinds h \<longleftrightarrow> node_ptr |\<in>| node_ptr_kinds h"
   apply(auto simp add: node_ptr_kinds_def split: option.splits)[1]
   by (metis (no_types, lifting) ffmember_filter fimage_eqI fset.map_comp 
       is_node_ptr_kind_none node_ptr_casts_commute2
       option.distinct(1) option.sel)
 
 lemma node_empty [simp]: 
   "\<lparr>RObject.nothing = (), RNode.nothing = (), \<dots> = RNode.more node\<rparr> = node"
   by simp
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_inject [simp]: "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t x = cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t y \<longleftrightarrow> x = y"
   apply(simp add: cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def)
   by (metis (full_types) RObject.surjective old.unit.exhaust)
 
 lemma cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_none [simp]: 
   "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e obj = None \<longleftrightarrow> \<not> (\<exists>node. cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t node = obj)"
   apply(auto simp add: cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def split: sum.splits)[1]
   by (metis (full_types) RObject.select_convs(2) RObject.surjective old.unit.exhaust)
 
 lemma cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_some [simp]: "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e obj = Some node \<longleftrightarrow> cast node = obj"
   by(auto simp add: cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def RObject.extend_def split: sum.splits)
 
 lemma cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv [simp]: "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e (cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t node) = Some node"
   by simp
 
 locale l_known_ptr\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 begin
 definition a_known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   where
     "a_known_ptr ptr = False"
 end
 global_interpretation l_known_ptr\<^sub>N\<^sub>o\<^sub>d\<^sub>e defines known_ptr = a_known_ptr .
 lemmas known_ptr_defs = a_known_ptr_def
 
 
 locale l_known_ptrs\<^sub>N\<^sub>o\<^sub>d\<^sub>e = l_known_ptr known_ptr for known_ptr :: "(_) object_ptr \<Rightarrow> bool"
 begin
 definition a_known_ptrs :: "(_) heap \<Rightarrow> bool"
   where
     "a_known_ptrs h = (\<forall>ptr \<in> fset (object_ptr_kinds h). known_ptr ptr)"
 
 lemma known_ptrs_known_ptr: "a_known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptr ptr"
   apply(simp add: a_known_ptrs_def)
   using notin_fset by fastforce
-lemma known_ptrs_preserved: "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
+lemma known_ptrs_preserved:
+  "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
   by(auto simp add: a_known_ptrs_def)
-lemma known_ptrs_subset: "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_subset:
+  "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def less_eq_fset.rep_eq subsetD)
-lemma known_ptrs_new_ptr: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_new_ptr:
+  "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow>
+a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def)
 end
 global_interpretation l_known_ptrs\<^sub>N\<^sub>o\<^sub>d\<^sub>e known_ptr defines known_ptrs = a_known_ptrs .
 lemmas known_ptrs_defs = a_known_ptrs_def
 
 lemma known_ptrs_is_l_known_ptrs: "l_known_ptrs known_ptr known_ptrs"
-  using known_ptrs_known_ptr known_ptrs_preserved l_known_ptrs_def known_ptrs_subset known_ptrs_new_ptr
+  using known_ptrs_known_ptr known_ptrs_preserved l_known_ptrs_def known_ptrs_subset
+    known_ptrs_new_ptr
   by blast
 
 lemma get_node_ptr_simp1 [simp]: "get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr (put\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr node h) = Some node"
   by(auto simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 lemma get_node_ptr_simp2 [simp]: 
   "node_ptr \<noteq> node_ptr' \<Longrightarrow> get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr (put\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr' node h) = get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr h"
   by(auto simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 end
diff --git a/thys/Core_DOM/common/classes/ObjectClass.thy b/thys/Core_DOM/common/classes/ObjectClass.thy
--- a/thys/Core_DOM/common/classes/ObjectClass.thy
+++ b/thys/Core_DOM/common/classes/ObjectClass.thy
@@ -1,217 +1,225 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Object\<close>
 text\<open>In this theory, we introduce the definition of the class Object. This class is the 
 common superclass of our class model.\<close>
 
 theory ObjectClass
   imports
     BaseClass
     "../pointers/ObjectPointer"
 begin
 
 record RObject =
   nothing :: unit
 register_default_tvars "'Object RObject_ext" 
 type_synonym 'Object Object = "'Object RObject_scheme"
 register_default_tvars "'Object Object" 
 
 datatype ('object_ptr, 'Object) heap = Heap (the_heap: "((_) object_ptr, (_) Object) fmap")
 register_default_tvars "('object_ptr, 'Object) heap"  
 type_synonym heap\<^sub>f\<^sub>i\<^sub>n\<^sub>a\<^sub>l = "(unit, unit) heap"
 
 definition object_ptr_kinds :: "(_) heap \<Rightarrow> (_) object_ptr fset"
   where
     "object_ptr_kinds = fmdom \<circ> the_heap"
 
 lemma object_ptr_kinds_simp [simp]: 
   "object_ptr_kinds (Heap (fmupd object_ptr object (the_heap h))) 
            = {|object_ptr|} |\<union>| object_ptr_kinds h"
   by(auto simp add: object_ptr_kinds_def)
 
 definition get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) object_ptr \<Rightarrow> (_) heap \<Rightarrow> (_) Object option"
   where
     "get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = fmlookup (the_heap h) ptr"
 adhoc_overloading get get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t 
 
 locale l_type_wf_def\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 begin
 definition a_type_wf :: "(_) heap \<Rightarrow> bool"
   where
     "a_type_wf h = True"
 end
 global_interpretation l_type_wf_def\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t defines type_wf = a_type_wf .
 lemmas type_wf_defs = a_type_wf_def
 
 locale l_type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t = l_type_wf type_wf for type_wf :: "((_) heap \<Rightarrow> bool)" +
   assumes type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t: "type_wf h \<Longrightarrow> ObjectClass.type_wf h"
 
 locale l_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas = l_type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 begin
 lemma get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf:
   assumes "type_wf h"
   shows "object_ptr |\<in>| object_ptr_kinds h \<longleftrightarrow> get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr h \<noteq> None"
   using l_type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_axioms assms
   apply(simp add: type_wf_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def)
   by (simp add: fmlookup_dom_iff object_ptr_kinds_def)
 end
 
 global_interpretation l_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas type_wf
   by (simp add: l_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas.intro l_type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t.intro)
 
 definition put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) object_ptr \<Rightarrow> (_) Object \<Rightarrow> (_) heap \<Rightarrow> (_) heap"
   where
     "put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h = Heap (fmupd ptr obj (the_heap h))"
 adhoc_overloading put put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 lemma put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_ptr_in_heap:
   assumes "put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr object h = h'"
   shows "object_ptr |\<in>| object_ptr_kinds h'"
   using assms
   unfolding put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def
   by auto
 
 lemma put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_put_ptrs:
   assumes "put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr object h = h'"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|object_ptr|}"
   using assms
   by (metis comp_apply fmdom_fmupd funion_finsert_right heap.sel object_ptr_kinds_def 
       sup_bot.right_neutral put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def)
 
 lemma object_more_extend_id [simp]: "more (extend x y) = y"
   by(simp add: extend_def)
 
 lemma object_empty [simp]: "\<lparr>nothing = (), \<dots> = more x\<rparr> = x"
   by simp
 
 locale l_known_ptr\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 begin
 definition a_known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   where
     "a_known_ptr ptr = False"
 
 lemma known_ptr_not_object_ptr: 
   "a_known_ptr ptr \<Longrightarrow> \<not>is_object_ptr ptr \<Longrightarrow> known_ptr ptr"
   by(simp add: a_known_ptr_def)
 end
 global_interpretation l_known_ptr\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t defines known_ptr = a_known_ptr .
 lemmas known_ptr_defs = a_known_ptr_def
 
 locale l_known_ptrs = l_known_ptr known_ptr for known_ptr :: "(_) object_ptr \<Rightarrow> bool" +
   fixes known_ptrs :: "(_) heap \<Rightarrow> bool"
   assumes known_ptrs_known_ptr: "known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptr ptr"
-  assumes known_ptrs_preserved: "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> known_ptrs h = known_ptrs h'"
-  assumes known_ptrs_subset: "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> known_ptrs h \<Longrightarrow> known_ptrs h'"
-  assumes known_ptrs_new_ptr: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow> known_ptrs h \<Longrightarrow> known_ptrs h'"
+  assumes known_ptrs_preserved:
+    "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> known_ptrs h = known_ptrs h'"
+  assumes known_ptrs_subset:
+    "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> known_ptrs h \<Longrightarrow> known_ptrs h'"
+  assumes known_ptrs_new_ptr:
+    "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow>
+known_ptrs h \<Longrightarrow> known_ptrs h'"
 
 locale l_known_ptrs\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t = l_known_ptr known_ptr for known_ptr :: "(_) object_ptr \<Rightarrow> bool"
 begin
 definition a_known_ptrs :: "(_) heap \<Rightarrow> bool"
   where
     "a_known_ptrs h = (\<forall>ptr \<in> fset (object_ptr_kinds h). known_ptr ptr)"
 
 lemma known_ptrs_known_ptr: 
   "a_known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptr ptr"
   apply(simp add: a_known_ptrs_def)
   using notin_fset by fastforce
 
-lemma known_ptrs_preserved: "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
+lemma known_ptrs_preserved:
+  "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
   by(auto simp add: a_known_ptrs_def)
-lemma known_ptrs_subset: "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_subset:
+  "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def less_eq_fset.rep_eq subsetD)
-lemma known_ptrs_new_ptr: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_new_ptr:
+  "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow>
+a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def)
 end
 global_interpretation l_known_ptrs\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t known_ptr defines known_ptrs = a_known_ptrs .
 lemmas known_ptrs_defs = a_known_ptrs_def
 
 lemma known_ptrs_is_l_known_ptrs: "l_known_ptrs known_ptr known_ptrs"
   using known_ptrs_known_ptr known_ptrs_preserved l_known_ptrs_def known_ptrs_subset known_ptrs_new_ptr
   by blast
 
 
 lemma get_object_ptr_simp1 [simp]: "get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr object h) = Some object"
   by(simp add: get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def)
 lemma get_object_ptr_simp2 [simp]: 
   "object_ptr \<noteq> object_ptr' 
    \<Longrightarrow> get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr' object h) = get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr h"
   by(simp add: get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def)
 
 
 subsection\<open>Limited Heap Modifications\<close>
 
 definition heap_unchanged_except :: "(_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   where
     "heap_unchanged_except S h h' = (\<forall>ptr \<in> (fset (object_ptr_kinds h) 
                                    \<union> (fset (object_ptr_kinds h'))) - S. get ptr h = get ptr h')"
 
 definition delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) object_ptr \<Rightarrow> (_) heap \<Rightarrow> (_) heap option" where
   "delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = (if ptr |\<in>| object_ptr_kinds h then Some (Heap (fmdrop ptr (the_heap h))) 
                                                       else None)"
 
 lemma delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_pointer_removed:
   assumes "delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = Some h'"
   shows "ptr |\<notin>| object_ptr_kinds h'"
   using assms
   by(auto simp add: delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def object_ptr_kinds_def split: if_splits)
 
 lemma delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_pointer_ptr_in_heap:
   assumes "delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = Some h'"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms
   by(auto simp add: delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def object_ptr_kinds_def split: if_splits)
 
 lemma delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_ok:
   assumes "ptr |\<in>| object_ptr_kinds h"
   shows "delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h \<noteq> None"
   using assms
   by(auto simp add: delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def object_ptr_kinds_def split: if_splits)
 
 
 subsection \<open>Code Generator Setup\<close>
 
 definition "create_heap xs = Heap (fmap_of_list xs)"
 
 code_datatype ObjectClass.heap.Heap create_heap
 
 lemma object_ptr_kinds_code3 [code]: 
   "fmlookup (the_heap (create_heap xs)) x = map_of xs x"
   by(auto simp add: create_heap_def fmlookup_of_list)
 
 lemma object_ptr_kinds_code4 [code]: 
   "the_heap (create_heap xs) = fmap_of_list xs"
   by(simp add: create_heap_def)
 
 lemma object_ptr_kinds_code5 [code]: 
   "the_heap (Heap x) = x"
   by simp
 
 
 end
diff --git a/thys/Core_DOM/common/monads/BaseMonad.thy b/thys/Core_DOM/common/monads/BaseMonad.thy
--- a/thys/Core_DOM/common/monads/BaseMonad.thy
+++ b/thys/Core_DOM/common/monads/BaseMonad.thy
@@ -1,375 +1,376 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>The Monad Infrastructure\<close>
 text\<open>In this theory, we introduce the basic infrastructure for our monadic class encoding.\<close>
 theory BaseMonad
   imports
     "../classes/BaseClass"
     "../preliminaries/Heap_Error_Monad"
 begin
 subsection\<open>Datatypes\<close>
 
-datatype exception = NotFoundError | SegmentationFault | HierarchyRequestError | AssertException 
-  | NonTerminationException | InvokeError | TypeError | DebugException nat
+datatype exception = NotFoundError | HierarchyRequestError | NotSupportedError | SegmentationFault
+  | AssertException | NonTerminationException | InvokeError | TypeError
 
 lemma finite_set_in [simp]: "x \<in> fset FS \<longleftrightarrow> x |\<in>| FS"
   by (meson notin_fset)
 
 consts put_M :: 'a
 consts get_M :: 'a
 consts delete_M :: 'a
 
 lemma sorted_list_of_set_eq [dest]: 
   "sorted_list_of_set (fset x) = sorted_list_of_set (fset y) \<Longrightarrow> x = y"
   by (metis finite_fset fset_inject sorted_list_of_set(1))
 
 
 locale l_ptr_kinds_M =
   fixes ptr_kinds :: "'heap \<Rightarrow> 'ptr::linorder fset"
 begin
 definition a_ptr_kinds_M :: "('heap, exception, 'ptr list) prog"
   where
     "a_ptr_kinds_M = do {
       h \<leftarrow> get_heap;
       return (sorted_list_of_set (fset (ptr_kinds h)))
     }"
 
 lemma ptr_kinds_M_ok [simp]: "h \<turnstile> ok a_ptr_kinds_M"
   by(simp add: a_ptr_kinds_M_def)
 
 lemma ptr_kinds_M_pure [simp]: "pure a_ptr_kinds_M h"
   by (auto simp add: a_ptr_kinds_M_def intro: bind_pure_I)
 
 lemma ptr_kinds_ptr_kinds_M [simp]: "ptr \<in> set |h \<turnstile> a_ptr_kinds_M|\<^sub>r \<longleftrightarrow> ptr |\<in>| ptr_kinds h"
   by(simp add: a_ptr_kinds_M_def)
 
 lemma ptr_kinds_M_ptr_kinds [simp]: 
   "h \<turnstile> a_ptr_kinds_M \<rightarrow>\<^sub>r xa \<longleftrightarrow> xa = sorted_list_of_set (fset (ptr_kinds h))"
   by(auto simp add: a_ptr_kinds_M_def)
 lemma ptr_kinds_M_ptr_kinds_returns_result [simp]: 
   "h \<turnstile> a_ptr_kinds_M \<bind> f \<rightarrow>\<^sub>r x \<longleftrightarrow> h \<turnstile> f (sorted_list_of_set (fset (ptr_kinds h))) \<rightarrow>\<^sub>r x"
   by(auto simp add: a_ptr_kinds_M_def)
 lemma ptr_kinds_M_ptr_kinds_returns_heap [simp]: 
   "h \<turnstile> a_ptr_kinds_M \<bind> f \<rightarrow>\<^sub>h h' \<longleftrightarrow> h \<turnstile> f (sorted_list_of_set (fset (ptr_kinds h))) \<rightarrow>\<^sub>h h'"
   by(auto simp add: a_ptr_kinds_M_def)
 end
 
 locale l_get_M = 
   fixes get :: "'ptr \<Rightarrow> 'heap \<Rightarrow> 'obj option"
   fixes type_wf :: "'heap \<Rightarrow> bool"
   fixes ptr_kinds :: "'heap \<Rightarrow> 'ptr fset"
   assumes "type_wf h \<Longrightarrow> ptr |\<in>| ptr_kinds h \<Longrightarrow> get ptr h \<noteq> None"
   assumes "get ptr h \<noteq> None \<Longrightarrow> ptr |\<in>| ptr_kinds h"
 begin
 
 definition a_get_M :: "'ptr \<Rightarrow> ('obj \<Rightarrow> 'result) \<Rightarrow>  ('heap, exception, 'result) prog"
   where
     "a_get_M ptr getter = (do {
       h \<leftarrow> get_heap;
       (case get ptr h of
         Some res \<Rightarrow> return (getter res)
       | None \<Rightarrow> error SegmentationFault)
     })"
 
 lemma get_M_pure [simp]: "pure (a_get_M ptr getter) h"
   by(auto simp add: a_get_M_def bind_pure_I split: option.splits)
 
 lemma get_M_ok:
   "type_wf h \<Longrightarrow> ptr |\<in>| ptr_kinds h \<Longrightarrow> h \<turnstile> ok (a_get_M ptr getter)"
   apply(simp add: a_get_M_def)
   by (metis l_get_M_axioms l_get_M_def option.case_eq_if return_ok)
 lemma get_M_ptr_in_heap:
   "h \<turnstile> ok (a_get_M ptr getter) \<Longrightarrow> ptr |\<in>| ptr_kinds h"
   apply(simp add: a_get_M_def)
   by (metis error_returns_result is_OK_returns_result_E l_get_M_axioms l_get_M_def option.simps(4))
 
 end
 
 locale l_put_M = l_get_M get for get :: "'ptr \<Rightarrow> 'heap \<Rightarrow> 'obj option" +
   fixes put :: "'ptr \<Rightarrow> 'obj \<Rightarrow> 'heap \<Rightarrow> 'heap"
 begin
 definition a_put_M :: "'ptr \<Rightarrow> (('v \<Rightarrow> 'v) \<Rightarrow> 'obj \<Rightarrow> 'obj) \<Rightarrow> 'v \<Rightarrow> ('heap, exception, unit) prog"
   where
     "a_put_M ptr setter v = (do {
       obj \<leftarrow> a_get_M ptr id;
       h \<leftarrow> get_heap;
       return_heap (put ptr (setter (\<lambda>_. v) obj) h)
     })"
 
 lemma put_M_ok:
   "type_wf h \<Longrightarrow> ptr |\<in>| ptr_kinds h \<Longrightarrow> h \<turnstile> ok (a_put_M ptr setter v)"
   by(auto simp add: a_put_M_def intro!: bind_is_OK_I2 dest: get_M_ok elim!: bind_is_OK_E)
 
 lemma put_M_ptr_in_heap:
   "h \<turnstile> ok (a_put_M ptr setter v) \<Longrightarrow> ptr |\<in>| ptr_kinds h"
   by(auto simp add: a_put_M_def intro!: bind_is_OK_I2 elim: get_M_ptr_in_heap 
       dest: is_OK_returns_result_I elim!: bind_is_OK_E)
 
 end
 
 subsection \<open>Setup for Defining Partial Functions\<close>
 
 lemma execute_admissible: 
   "ccpo.admissible (fun_lub (flat_lub (Inl (e::'e)))) (fun_ord (flat_ord (Inl e)))
      ((\<lambda>a. \<forall>(h::'heap) h2 (r::'result). h \<turnstile> a = Inr (r, h2) \<longrightarrow> P h h2 r) \<circ> Prog)"
 proof (unfold comp_def, rule ccpo.admissibleI, clarify)
   fix A :: "('heap \<Rightarrow> 'e + 'result \<times> 'heap) set"
   let ?lub = "Prog (fun_lub (flat_lub (Inl e)) A)"
   fix h h2 r
   assume 1: "Complete_Partial_Order.chain (fun_ord (flat_ord (Inl e))) A"
     and 2: "\<forall>xa\<in>A. \<forall>h h2 r. h \<turnstile> Prog xa = Inr (r, h2)  \<longrightarrow> P h h2 r"
     and 4: "h \<turnstile> Prog (fun_lub (flat_lub (Inl e)) A) = Inr (r, h2)"
   have h1:"\<And>a. Complete_Partial_Order.chain (flat_ord (Inl e)) {y. \<exists>f\<in>A. y = f a}"
     by (rule chain_fun[OF 1])
   show "P h h2 r"
     using chain_fun[OF 1] flat_lub_in_chain[OF chain_fun[OF 1]] 2 4 unfolding execute_def fun_lub_def
-    by auto (metis (lifting) Inl_Inr_False)
+    by force
 qed
 
 lemma execute_admissible2: 
   "ccpo.admissible (fun_lub (flat_lub (Inl (e::'e)))) (fun_ord (flat_ord (Inl e)))
      ((\<lambda>a. \<forall>(h::'heap) h' h2 h2' (r::'result) r'. 
                     h \<turnstile> a = Inr (r, h2) \<longrightarrow> h' \<turnstile> a = Inr (r', h2') \<longrightarrow> P h h' h2 h2' r r') \<circ> Prog)"
 proof (unfold comp_def, rule ccpo.admissibleI, clarify)
   fix A :: "('heap \<Rightarrow> 'e + 'result \<times> 'heap) set"
   let ?lub = "Prog (fun_lub (flat_lub (Inl e)) A)"
   fix h h' h2 h2' r r'
   assume 1: "Complete_Partial_Order.chain (fun_ord (flat_ord (Inl e))) A"
     and 2 [rule_format]: "\<forall>xa\<in>A. \<forall>h h' h2 h2' r r'. h \<turnstile> Prog xa = Inr (r, h2) 
                           \<longrightarrow> h' \<turnstile> Prog xa = Inr (r', h2') \<longrightarrow> P h h' h2 h2' r r'"
     and 4: "h \<turnstile> Prog (fun_lub (flat_lub (Inl e)) A) = Inr (r, h2)"
     and 5: "h' \<turnstile> Prog (fun_lub (flat_lub (Inl e)) A) = Inr (r', h2')"
   have h1:"\<And>a. Complete_Partial_Order.chain (flat_ord (Inl e)) {y. \<exists>f\<in>A. y = f a}"
     by (rule chain_fun[OF 1])
   have "h \<turnstile> ?lub \<in> {y. \<exists>f\<in>A. y = f h}"
     using flat_lub_in_chain[OF h1] 4
     unfolding execute_def fun_lub_def
-    by auto (metis (lifting) Inl_Inr_False)
+    by auto
   moreover have "h' \<turnstile> ?lub \<in> {y. \<exists>f\<in>A. y = f h'}"
     using flat_lub_in_chain[OF h1] 5
     unfolding execute_def fun_lub_def
-    by auto (metis (lifting) Inl_Inr_False)
+    by auto
   ultimately obtain f where
     "f \<in> A" and
     "h \<turnstile> Prog f = Inr (r, h2)" and
     "h' \<turnstile> Prog f = Inr (r', h2')"
     using 1 4 5 
-    by (auto simp add: chain_def fun_ord_def flat_ord_def execute_def)[1] (metis (lifting) Inl_Inr_False)
+    apply(auto simp add:  chain_def fun_ord_def flat_ord_def execute_def)[1]
+    by (metis Inl_Inr_False)
   then show "P h h' h2 h2' r r'"
     by(fact 2)
 qed
 
 definition dom_prog_ord :: 
   "('heap, exception, 'result) prog \<Rightarrow> ('heap, exception, 'result) prog \<Rightarrow> bool" where
   "dom_prog_ord = img_ord (\<lambda>a b. execute b a) (fun_ord (flat_ord (Inl NonTerminationException)))"
 
 definition dom_prog_lub :: 
   "('heap, exception, 'result) prog set \<Rightarrow> ('heap, exception, 'result) prog" where
   "dom_prog_lub = img_lub (\<lambda>a b. execute b a) Prog (fun_lub (flat_lub (Inl NonTerminationException)))"
 
 lemma dom_prog_lub_empty: "dom_prog_lub {} = error NonTerminationException"
   by(simp add: dom_prog_lub_def img_lub_def fun_lub_def flat_lub_def error_def)
 
 lemma dom_prog_interpretation: "partial_function_definitions dom_prog_ord dom_prog_lub"
 proof -
   have "partial_function_definitions (fun_ord (flat_ord (Inl NonTerminationException))) 
                                      (fun_lub (flat_lub (Inl NonTerminationException)))"
     by (rule partial_function_lift) (rule flat_interpretation)
   then show ?thesis
     apply (simp add: dom_prog_lub_def dom_prog_ord_def flat_interpretation execute_def)
     using partial_function_image prog.expand prog.sel by blast
 qed
 
 interpretation dom_prog: partial_function_definitions dom_prog_ord dom_prog_lub
   rewrites "dom_prog_lub {} \<equiv> error NonTerminationException"
   by (fact dom_prog_interpretation)(simp add: dom_prog_lub_empty)
 
 lemma admissible_dom_prog: 
   "dom_prog.admissible (\<lambda>f. \<forall>x h h' r. h \<turnstile> f x \<rightarrow>\<^sub>r r \<longrightarrow> h \<turnstile> f x \<rightarrow>\<^sub>h h' \<longrightarrow> P x h h' r)"
 proof (rule admissible_fun[OF dom_prog_interpretation])
   fix x
   show "ccpo.admissible dom_prog_lub dom_prog_ord (\<lambda>a. \<forall>h h' r. h \<turnstile> a \<rightarrow>\<^sub>r r \<longrightarrow> h \<turnstile> a \<rightarrow>\<^sub>h h' 
          \<longrightarrow> P x h h' r)"
     unfolding dom_prog_ord_def dom_prog_lub_def
   proof (intro admissible_image partial_function_lift flat_interpretation)
     show "ccpo.admissible (fun_lub (flat_lub (Inl NonTerminationException))) 
                           (fun_ord (flat_ord (Inl NonTerminationException)))
      ((\<lambda>a. \<forall>h h' r. h \<turnstile> a \<rightarrow>\<^sub>r r \<longrightarrow> h \<turnstile> a \<rightarrow>\<^sub>h h' \<longrightarrow> P x h h' r) \<circ> Prog)"
       by(auto simp add: execute_admissible returns_result_def returns_heap_def split: sum.splits)
   next
     show "\<And>x y. (\<lambda>b. b \<turnstile> x) = (\<lambda>b. b \<turnstile> y) \<Longrightarrow> x = y"
       by(simp add: execute_def prog.expand)
   next
     show "\<And>x. (\<lambda>b. b \<turnstile> Prog x) = x"
       by(simp add: execute_def)
   qed
 qed
 
 lemma admissible_dom_prog2:
   "dom_prog.admissible (\<lambda>f. \<forall>x h h2 h' h2' r r2. h \<turnstile> f x \<rightarrow>\<^sub>r r \<longrightarrow> h \<turnstile> f x \<rightarrow>\<^sub>h h' 
             \<longrightarrow> h2 \<turnstile> f x \<rightarrow>\<^sub>r r2 \<longrightarrow> h2 \<turnstile> f x \<rightarrow>\<^sub>h h2' \<longrightarrow> P x h h2 h' h2' r r2)"
 proof (rule admissible_fun[OF dom_prog_interpretation])
   fix x
   show "ccpo.admissible dom_prog_lub dom_prog_ord (\<lambda>a. \<forall>h h2 h' h2' r r2. h \<turnstile> a \<rightarrow>\<^sub>r r 
                    \<longrightarrow> h \<turnstile> a \<rightarrow>\<^sub>h h' \<longrightarrow> h2 \<turnstile> a \<rightarrow>\<^sub>r r2 \<longrightarrow> h2 \<turnstile> a \<rightarrow>\<^sub>h h2' \<longrightarrow> P x h h2 h' h2' r r2)"
     unfolding dom_prog_ord_def dom_prog_lub_def
   proof (intro admissible_image partial_function_lift flat_interpretation)
     show "ccpo.admissible (fun_lub (flat_lub (Inl NonTerminationException))) 
                           (fun_ord (flat_ord (Inl NonTerminationException)))
      ((\<lambda>a. \<forall>h h2 h' h2' r r2. h \<turnstile> a \<rightarrow>\<^sub>r r \<longrightarrow> h \<turnstile> a \<rightarrow>\<^sub>h h' \<longrightarrow> h2 \<turnstile> a \<rightarrow>\<^sub>r r2 \<longrightarrow> h2 \<turnstile> a \<rightarrow>\<^sub>h h2' 
                  \<longrightarrow> P x h h2 h' h2' r r2) \<circ> Prog)"
       by(auto simp add: returns_result_def returns_heap_def intro!: ccpo.admissibleI 
           dest!: ccpo.admissibleD[OF execute_admissible2[where P="P x"]] 
           split: sum.splits)
   next
     show "\<And>x y. (\<lambda>b. b \<turnstile> x) = (\<lambda>b. b \<turnstile> y) \<Longrightarrow> x = y"
       by(simp add: execute_def prog.expand)
   next
     show "\<And>x. (\<lambda>b. b \<turnstile> Prog x) = x"
       by(simp add: execute_def)
   qed
 qed
 
 lemma fixp_induct_dom_prog:
   fixes F :: "'c \<Rightarrow> 'c" and
     U :: "'c \<Rightarrow> 'b \<Rightarrow> ('heap, exception, 'result) prog" and
     C :: "('b \<Rightarrow> ('heap, exception, 'result) prog) \<Rightarrow> 'c" and
     P :: "'b \<Rightarrow> 'heap \<Rightarrow> 'heap \<Rightarrow> 'result \<Rightarrow> bool"
   assumes mono: "\<And>x. monotone (fun_ord dom_prog_ord) dom_prog_ord (\<lambda>f. U (F (C f)) x)"
   assumes eq: "f \<equiv> C (ccpo.fixp (fun_lub dom_prog_lub) (fun_ord dom_prog_ord) (\<lambda>f. U (F (C f))))"
   assumes inverse2: "\<And>f. U (C f) = f"
   assumes step: "\<And>f x h h' r. (\<And>x h h' r. h \<turnstile> (U f x) \<rightarrow>\<^sub>r r \<Longrightarrow> h \<turnstile> (U f x) \<rightarrow>\<^sub>h h' \<Longrightarrow> P x h h' r) 
     \<Longrightarrow> h \<turnstile> (U (F f) x) \<rightarrow>\<^sub>r r \<Longrightarrow> h \<turnstile> (U (F f) x) \<rightarrow>\<^sub>h h' \<Longrightarrow> P x h h' r"
   assumes defined: "h \<turnstile> (U f x) \<rightarrow>\<^sub>r r" and "h \<turnstile> (U f x) \<rightarrow>\<^sub>h h'"
   shows "P x h h' r"
   using step defined dom_prog.fixp_induct_uc[of U F C, OF mono eq inverse2 admissible_dom_prog, of P]
   by (metis assms(6) error_returns_heap)
 
 declaration \<open>Partial_Function.init "dom_prog" @{term dom_prog.fixp_fun}
   @{term dom_prog.mono_body} @{thm dom_prog.fixp_rule_uc} @{thm dom_prog.fixp_induct_uc}
   (SOME @{thm fixp_induct_dom_prog})\<close>
 
 
 abbreviation "mono_dom_prog \<equiv> monotone (fun_ord dom_prog_ord) dom_prog_ord"
 
 lemma dom_prog_ordI:
   assumes "\<And>h. h \<turnstile> f \<rightarrow>\<^sub>e NonTerminationException \<or> h \<turnstile> f = h \<turnstile> g"
   shows "dom_prog_ord f g"
 proof(auto simp add: dom_prog_ord_def img_ord_def fun_ord_def flat_ord_def)[1]
   fix x
   assume "x \<turnstile> f \<noteq> x \<turnstile> g"
   then show "x \<turnstile> f = Inl NonTerminationException"
     using assms[where h=x]
     by(auto simp add: returns_error_def split: sum.splits)
 qed
 
 lemma dom_prog_ordE:
   assumes "dom_prog_ord x y"
   obtains "h \<turnstile> x \<rightarrow>\<^sub>e NonTerminationException" | " h \<turnstile> x = h \<turnstile> y"
   using assms unfolding dom_prog_ord_def img_ord_def fun_ord_def flat_ord_def
   using returns_error_def by force
 
 
 lemma bind_mono [partial_function_mono]:
   fixes B :: "('a \<Rightarrow> ('heap, exception, 'result) prog) \<Rightarrow> ('heap, exception, 'result2) prog"
   assumes mf: "mono_dom_prog B" and mg: "\<And>y. mono_dom_prog (\<lambda>f. C y f)"
   shows "mono_dom_prog (\<lambda>f. B f \<bind> (\<lambda>y. C y f))"
 proof (rule monotoneI)
   fix f g :: "'a \<Rightarrow> ('heap, exception, 'result) prog"
   assume fg: "dom_prog.le_fun f g"
   from mf
   have 1: "dom_prog_ord (B f) (B g)" by (rule monotoneD) (rule fg)
   from mg
   have 2: "\<And>y'. dom_prog_ord (C y' f) (C y' g)" by (rule monotoneD) (rule fg)
 
   have "dom_prog_ord (B f \<bind> (\<lambda>y. C y f)) (B g \<bind> (\<lambda>y. C y f))"
     (is "dom_prog_ord ?L ?R")
   proof (rule dom_prog_ordI)
     fix h
     from 1 show "h \<turnstile> ?L \<rightarrow>\<^sub>e NonTerminationException \<or> h \<turnstile> ?L = h \<turnstile> ?R"
       apply(rule dom_prog_ordE) 
        apply(auto)[1]
       using bind_cong by fastforce
   qed
   also
   have h1: "dom_prog_ord (B g \<bind> (\<lambda>y'. C y' f)) (B g \<bind> (\<lambda>y'. C y' g))"
     (is "dom_prog_ord ?L ?R")
   proof (rule dom_prog_ordI)
     (* { *)
     fix h
     show "h \<turnstile> ?L \<rightarrow>\<^sub>e NonTerminationException \<or> h \<turnstile> ?L = h \<turnstile> ?R"
     proof (cases "h \<turnstile> ok (B g)")
       case True
       then obtain x h' where x: "h \<turnstile> B g \<rightarrow>\<^sub>r x" and h': "h \<turnstile> B g \<rightarrow>\<^sub>h h'"
         by blast
       then have "dom_prog_ord (C x f) (C x g)"
         using 2 by simp
       then show ?thesis
         using x h'
         apply(auto intro!: bind_returns_error_I3 dest: returns_result_eq dest!: dom_prog_ordE)[1]
         apply(auto simp add: execute_bind_simp)[1]
         using "2" dom_prog_ordE by metis
     next
       case False
       then obtain e where e: "h \<turnstile> B g \<rightarrow>\<^sub>e e"
         by(simp add: is_OK_def returns_error_def split: sum.splits)
       have "h \<turnstile> B g \<bind> (\<lambda>y'. C y' f) \<rightarrow>\<^sub>e e"
         using e by(auto)
       moreover have "h \<turnstile> B g \<bind> (\<lambda>y'. C y' g) \<rightarrow>\<^sub>e e"
         using e by auto
       ultimately show ?thesis
         using bind_returns_error_eq by metis
     qed
   qed
   finally (dom_prog.leq_trans)
   show "dom_prog_ord (B f \<bind> (\<lambda>y. C y f)) (B g \<bind> (\<lambda>y'. C y' g))" .
 qed
 
 lemma mono_dom_prog1 [partial_function_mono]:
   fixes g ::  "('a \<Rightarrow> ('heap, exception, 'result) prog) \<Rightarrow> 'b \<Rightarrow> ('heap, exception, 'result) prog"
   assumes "\<And>x. (mono_dom_prog (\<lambda>f. g f x))"
   shows "mono_dom_prog (\<lambda>f. map_M (g f) xs)"
   using assms
   apply (induct xs) 
   by(auto simp add: call_mono dom_prog.const_mono intro!: bind_mono)
 
 lemma mono_dom_prog2 [partial_function_mono]:
   fixes g ::  "('a \<Rightarrow> ('heap, exception, 'result) prog) \<Rightarrow> 'b \<Rightarrow> ('heap, exception, 'result) prog"
   assumes "\<And>x. (mono_dom_prog (\<lambda>f. g f x))"
   shows "mono_dom_prog (\<lambda>f. forall_M (g f) xs)"
   using assms
   apply (induct xs) 
   by(auto simp add: call_mono dom_prog.const_mono intro!: bind_mono)
 
 lemma sorted_list_set_cong [simp]: 
   "sorted_list_of_set (fset FS) = sorted_list_of_set (fset FS') \<longleftrightarrow> FS = FS'"
   by auto
 
 end
diff --git a/thys/Core_DOM/common/monads/CharacterDataMonad.thy b/thys/Core_DOM/common/monads/CharacterDataMonad.thy
--- a/thys/Core_DOM/common/monads/CharacterDataMonad.thy
+++ b/thys/Core_DOM/common/monads/CharacterDataMonad.thy
@@ -1,531 +1,534 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>CharacterData\<close>
 text\<open>In this theory, we introduce the monadic method setup for the CharacterData class.\<close>
 theory CharacterDataMonad
   imports
     ElementMonad
     "../classes/CharacterDataClass"
 begin
 
 type_synonym ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
     'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData, 'result) dom_prog
   = "((_) heap, exception, 'result) prog"
 register_default_tvars 
   "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 'shadow_root_ptr, 
                               'Object, 'Node, 'Element, 'CharacterData, 'result) dom_prog" 
 
 
 global_interpretation l_ptr_kinds_M character_data_ptr_kinds 
   defines character_data_ptr_kinds_M = a_ptr_kinds_M .
 lemmas character_data_ptr_kinds_M_defs = a_ptr_kinds_M_def
 
 lemma character_data_ptr_kinds_M_eq:
   assumes "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
   shows "|h \<turnstile> character_data_ptr_kinds_M|\<^sub>r = |h' \<turnstile> character_data_ptr_kinds_M|\<^sub>r"
   using assms 
   by(auto simp add: character_data_ptr_kinds_M_defs node_ptr_kinds_M_defs 
       character_data_ptr_kinds_def)
 
 lemma character_data_ptr_kinds_M_reads: 
   "reads (\<Union>node_ptr. {preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t node_ptr RObject.nothing)}) character_data_ptr_kinds_M h h'"
   using node_ptr_kinds_M_reads
   apply (simp add: reads_def node_ptr_kinds_M_defs character_data_ptr_kinds_M_defs 
       character_data_ptr_kinds_def preserved_def)
   by (smt node_ptr_kinds_small preserved_def unit_all_impI)
 
 global_interpretation l_dummy defines get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a = "l_get_M.a_get_M get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a" .
 lemma get_M_is_l_get_M: "l_get_M get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a type_wf character_data_ptr_kinds"
   apply(simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_type_wf l_get_M_def)
   by (metis (no_types, hide_lams) NodeMonad.get_M_is_l_get_M bind_eq_Some_conv 
       character_data_ptr_kinds_commutes get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def l_get_M_def option.distinct(1))
 lemmas get_M_defs = get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def[unfolded l_get_M.a_get_M_def[OF get_M_is_l_get_M]]
 
 adhoc_overloading get_M get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 
 locale l_get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas = l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 begin
 sublocale l_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas by unfold_locales
 
 interpretation l_get_M get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a type_wf character_data_ptr_kinds
   apply(unfold_locales)
    apply (simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_type_wf local.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a)
   by (meson CharacterDataMonad.get_M_is_l_get_M l_get_M_def)
 lemmas get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ok = get_M_ok[folded get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def]
 end
 
 global_interpretation l_get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas type_wf by unfold_locales
 
 
 global_interpretation l_put_M type_wf character_data_ptr_kinds get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a 
   rewrites "a_get_M = get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a" defines put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a = a_put_M
    apply (simp add: get_M_is_l_get_M l_put_M_def)
   by (simp add: get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
 
 lemmas put_M_defs = a_put_M_def
 adhoc_overloading put_M put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 
 
 locale l_put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas = l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
 begin
 sublocale l_put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas by unfold_locales
 
 interpretation l_put_M type_wf character_data_ptr_kinds get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
   apply(unfold_locales)
   using get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_type_wf l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a local.l_type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_axioms
    apply blast
   by (meson CharacterDataMonad.get_M_is_l_get_M l_get_M_def)
 lemmas put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ok = put_M_ok[folded put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def]
 end
 
 global_interpretation l_put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas type_wf by unfold_locales
 
 
 
 lemma CharacterData_simp1 [simp]: 
   "(\<And>x. getter (setter (\<lambda>_. v) x) = v) \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> h' \<turnstile> get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr getter \<rightarrow>\<^sub>r v"
   by(auto simp add: put_M_defs get_M_defs split: option.splits)
 lemma CharacterData_simp2 [simp]: 
   "character_data_ptr \<noteq> character_data_ptr' 
    \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr' getter) h h'"
   by(auto simp add: put_M_defs get_M_defs preserved_def split: option.splits dest: get_heap_E)
 lemma CharacterData_simp3 [simp]: "
   (\<And>x. getter (setter (\<lambda>_. v) x) = getter x) 
   \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr' getter) h h'"
   apply(cases "character_data_ptr = character_data_ptr'") 
   by(auto simp add: put_M_defs get_M_defs preserved_def split: option.splits dest: get_heap_E)
 lemma CharacterData_simp4 [simp]: 
   "h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr getter) h h'"
   by(auto simp add: put_M_defs ElementMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma CharacterData_simp5 [simp]: 
   "h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr getter) h h'"
   by(auto simp add: ElementMonad.put_M_defs get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma CharacterData_simp6 [simp]: 
   "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
    \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h'
   \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply (cases "cast character_data_ptr = object_ptr") 
   by(auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs NodeMonad.get_M_defs 
       get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       bind_eq_Some_conv split: option.splits)
 lemma CharacterData_simp7 [simp]: 
   "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
   \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   apply(cases "cast character_data_ptr = node_ptr")
   by(auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs NodeMonad.get_M_defs 
       get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       bind_eq_Some_conv split: option.splits)
 
 lemma CharacterData_simp8 [simp]: 
   "cast character_data_ptr \<noteq> node_ptr 
    \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def NodeMonad.get_M_defs 
       preserved_def split: option.splits dest: get_heap_E)
 lemma CharacterData_simp9 [simp]: 
   "h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
    \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   apply(cases "cast character_data_ptr \<noteq> node_ptr")
   by(auto simp add: put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def 
       NodeMonad.get_M_defs preserved_def split: option.splits bind_splits 
       dest: get_heap_E)
 lemma CharacterData_simp10 [simp]: 
   "cast character_data_ptr \<noteq> node_ptr 
    \<Longrightarrow> h \<turnstile> put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr getter) h h'"
   by(auto simp add: NodeMonad.put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def NodeMonad.get_M_defs 
       preserved_def split: option.splits dest: get_heap_E)
 
 lemma CharacterData_simp11 [simp]: 
   "cast character_data_ptr \<noteq> object_ptr 
   \<Longrightarrow> h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def 
       ObjectMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 
 lemma CharacterData_simp12 [simp]:
   "h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
    \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast character_data_ptr \<noteq> object_ptr")
    apply(auto simp add: put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def ObjectMonad.get_M_defs preserved_def 
       split: option.splits bind_splits dest: get_heap_E)[1]
   by(auto simp add: put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def ObjectMonad.get_M_defs preserved_def 
       split: option.splits bind_splits dest: get_heap_E)[1]
 
 lemma CharacterData_simp13 [simp]: 
   "cast character_data_ptr \<noteq> object_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr getter) h h'"
   by(auto simp add: ObjectMonad.put_M_defs get_M_defs get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       ObjectMonad.get_M_defs preserved_def split: option.splits dest: get_heap_E)
 
 lemma new_element_get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a: 
   "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr getter) h h'"
   by(auto simp add: new_element_def get_M_defs preserved_def split: prod.splits option.splits 
       elim!: bind_returns_result_E bind_returns_heap_E)
 
 
 subsection\<open>Creating CharacterData\<close>
 
 definition new_character_data :: "(_, (_) character_data_ptr) dom_prog"
   where
     "new_character_data = do {
       h \<leftarrow> get_heap;
       (new_ptr, h') \<leftarrow> return (new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a h);
       return_heap h';
       return new_ptr
     }"
 
 lemma new_character_data_ok [simp]:
   "h \<turnstile> ok new_character_data"
   by(auto simp add: new_character_data_def split: prod.splits)
 
 lemma new_character_data_ptr_in_heap:
   assumes "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr"
   shows "new_character_data_ptr |\<in>| character_data_ptr_kinds h'"
   using assms
   unfolding new_character_data_def
   by(auto simp add: new_character_data_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_in_heap 
       is_OK_returns_result_I
       elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_character_data_ptr_not_in_heap:
   assumes "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr"
   shows "new_character_data_ptr |\<notin>| character_data_ptr_kinds h"
   using assms new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_not_in_heap
   by(auto simp add: new_character_data_def split: prod.splits 
       elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_character_data_new_ptr:
   assumes "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
   using assms new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_new_ptr
   by(auto simp add: new_character_data_def split: prod.splits 
       elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_character_data_is_character_data_ptr:
   assumes "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr"
   shows "is_character_data_ptr new_character_data_ptr"
   using assms new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_is_character_data_ptr
   by(auto simp add: new_character_data_def elim!: bind_returns_result_E split: prod.splits)
 
 lemma new_character_data_child_nodes:
   assumes "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr"
   shows "h' \<turnstile> get_M new_character_data_ptr val \<rightarrow>\<^sub>r ''''"
   using assms
   by(auto simp add: get_M_defs new_character_data_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_character_data_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr 
     \<Longrightarrow> ptr \<noteq> cast new_character_data_ptr \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
   by(auto simp add: new_character_data_def ObjectMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_character_data_get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr 
     \<Longrightarrow> ptr \<noteq> cast new_character_data_ptr \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr getter) h h'"
   by(auto simp add: new_character_data_def NodeMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_character_data_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr 
     \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr getter) h h'"
   by(auto simp add: new_character_data_def ElementMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_character_data_get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr 
     \<Longrightarrow> ptr \<noteq> new_character_data_ptr \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr getter) h h'"
   by(auto simp add: new_character_data_def get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 
 
 subsection\<open>Modified Heaps\<close>
 
 lemma get_CharacterData_ptr_simp [simp]: 
   "get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) 
       = (if ptr = cast character_data_ptr then cast obj else get character_data_ptr h)"
   by(auto simp add: get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def split: option.splits Option.bind_splits)
 
 lemma Character_data_ptr_kinds_simp [simp]: 
   "character_data_ptr_kinds (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) = character_data_ptr_kinds h |\<union>| 
                             (if is_character_data_ptr_kind ptr then {|the (cast ptr)|} else {||})"
   by(auto simp add: character_data_ptr_kinds_def is_node_ptr_kind_def split: option.splits)
 
 lemma type_wf_put_I:
   assumes "type_wf h"
   assumes "ElementClass.type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "is_character_data_ptr_kind ptr \<Longrightarrow> is_character_data_kind obj"
   shows "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   using assms
   by(auto simp add: type_wf_defs split: option.splits)
 
 lemma type_wf_put_ptr_not_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<notin>| object_ptr_kinds h"
   shows "type_wf h"
   using assms
   apply(auto simp add: type_wf_defs elim!: ElementMonad.type_wf_put_ptr_not_in_heap_E 
-      split: option.splits if_splits)
+      split: option.splits if_splits)[1]
   using assms(2) node_ptr_kinds_commutes by blast
 
 lemma type_wf_put_ptr_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "ElementClass.type_wf h"
   assumes "is_character_data_ptr_kind ptr \<Longrightarrow> is_character_data_kind (the (get ptr h))"
   shows "type_wf h"
   using assms
   apply(auto simp add: type_wf_defs split: option.splits if_splits)[1]
-  by (metis (no_types, lifting) ElementClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf assms(2) bind.bind_lunit cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_inv cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def notin_fset option.collapse)
+  by (metis (no_types, lifting) ElementClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf assms(2) bind.bind_lunit
+      cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_inv cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def notin_fset option.collapse)
 
 subsection\<open>Preserving Types\<close>
 
 lemma new_element_type_wf_preserved [simp]:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
   shows "type_wf h = type_wf h'"
   using assms
   apply(auto simp add: new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       elim!: bind_returns_heap_E type_wf_put_ptr_not_in_heap_E 
       intro!: type_wf_put_I split: if_splits)[1]
   using CharacterDataClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t assms new_element_type_wf_preserved apply blast
   using element_ptrs_def apply fastforce
   using CharacterDataClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t assms new_element_type_wf_preserved apply blast
   by (metis Suc_n_not_le_n element_ptr.sel(1) element_ptrs_def fMax_ge ffmember_filter 
       fimage_eqI is_element_ptr_ref)
 
 lemma new_element_is_l_new_element: "l_new_element type_wf"
   using l_new_element.intro new_element_type_wf_preserved
   by blast
 
-lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_type_type_wf_preserved [simp]: 
-  "h \<turnstile> put_M element_ptr tag_type_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
+lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
+  "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I 
       ObjectMonad.type_wf_put_I)[1]
       apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
      apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
     apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
    apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
   using ObjectMonad.type_wf_put_ptr_in_heap_E ObjectMonad.type_wf_put_ptr_not_in_heap_E apply blast
    apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
   apply (metis finite_set_in)
   done
 
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_child_nodes_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr child_nodes_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       dest!: get_heap_E  elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
       apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs 
       split: option.splits)[1]
      apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs 
       split: option.splits)[1]
     apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs 
       split: option.splits)[1]
    apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs 
       split: option.splits)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs 
       split: option.splits)[1]
   using ObjectMonad.type_wf_put_ptr_in_heap_E ObjectMonad.type_wf_put_ptr_not_in_heap_E apply blast
    apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
   apply (metis finite_set_in)
   done
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_attrs_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I 
       ObjectMonad.type_wf_put_I)[1]
       apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
      apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
     apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
    apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
   using ObjectMonad.type_wf_put_ptr_in_heap_E ObjectMonad.type_wf_put_ptr_not_in_heap_E apply blast
    apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
   apply (metis finite_set_in)
   done
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_shadow_root_opt_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I 
       ObjectMonad.type_wf_put_I)[1]
       apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
      apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
     apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
    apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs 
       ElementMonad.get_M_defs split: option.splits)[1]
   using ObjectMonad.type_wf_put_ptr_in_heap_E ObjectMonad.type_wf_put_ptr_not_in_heap_E apply blast
    apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
   apply (metis finite_set_in)
   done
 
 
 lemma new_character_data_type_wf_preserved [simp]: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: new_character_data_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       elim!: bind_returns_heap_E type_wf_put_ptr_not_in_heap_E 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I 
       split: if_splits)[1]
       apply(simp_all add: type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs is_node_kind_def)
   by (meson new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_not_in_heap)
 
 locale l_new_character_data = l_type_wf +
   assumes new_character_data_types_preserved: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
 
 lemma new_character_data_is_l_new_character_data: "l_new_character_data type_wf"
   using l_new_character_data.intro new_character_data_type_wf_preserved
   by blast
 
 lemma put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_val_type_wf_preserved [simp]: 
   "h \<turnstile> put_M character_data_ptr val_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: CharacterDataMonad.put_M_defs put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       CharacterDataClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e CharacterDataClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I 
       ObjectMonad.type_wf_put_I)[1]      
    apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs CharacterDataMonad.get_M_defs 
       split: option.splits)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs CharacterDataMonad.get_M_defs
       ObjectClass.a_type_wf_def
       split: option.splits)[1]
    apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def)
   apply (metis finite_set_in)
   done
 
 lemma character_data_ptr_kinds_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   shows "character_data_ptr_kinds h = character_data_ptr_kinds h'"
   by(simp add: character_data_ptr_kinds_def node_ptr_kinds_def preserved_def 
       object_ptr_kinds_preserved_small[OF assms])
 
 lemma character_data_ptr_kinds_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<longrightarrow> (\<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h')"
   shows "character_data_ptr_kinds h = character_data_ptr_kinds h'"
   using writes_small_big[OF assms]
   apply(simp add: reflp_def transp_def preserved_def character_data_ptr_kinds_def)
   by (metis assms node_ptr_kinds_preserved)
 
 
 lemma type_wf_preserved_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   assumes "\<And>element_ptr. preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr RElement.nothing) h h'"
   assumes "\<And>character_data_ptr. preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr 
                                            RCharacterData.nothing) h h'"
   shows "type_wf h = type_wf h'"
   using type_wf_preserved_small[OF assms(1) assms(2) assms(3)]  
     allI[OF assms(4), of id, simplified] character_data_ptr_kinds_small[OF assms(1)]
   apply(auto simp add: type_wf_defs preserved_def get_M_defs character_data_ptr_kinds_small[OF assms(1)] 
       split: option.splits)[1]
    apply(force)
   by force
 
 lemma type_wf_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>element_ptr. preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr RElement.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>character_data_ptr. preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr 
                                               RCharacterData.nothing) h h'"
   shows "type_wf h = type_wf h'"
 proof -
   have "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
     using assms type_wf_preserved_small by fast
   with assms(1) assms(2) show ?thesis
     apply(rule writes_small_big)
     by(auto simp add: reflp_def transp_def)
 qed
 
 lemma type_wf_drop: "type_wf h \<Longrightarrow> type_wf (Heap (fmdrop ptr (the_heap h)))"
   apply(auto simp add: type_wf_def ElementMonad.type_wf_drop  
       l_type_wf_def\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a.a_type_wf_def)[1]
   using type_wf_drop
-  by (metis (no_types, lifting) ElementClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf character_data_ptr_kinds_commutes finite_set_in fmlookup_drop get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def node_ptr_kinds_commutes object_ptr_kinds_code5)
+  by (metis (no_types, lifting) ElementClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf
+      character_data_ptr_kinds_commutes finite_set_in fmlookup_drop get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
+      get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def node_ptr_kinds_commutes object_ptr_kinds_code5)
 
 end
diff --git a/thys/Core_DOM/common/monads/DocumentMonad.thy b/thys/Core_DOM/common/monads/DocumentMonad.thy
--- a/thys/Core_DOM/common/monads/DocumentMonad.thy
+++ b/thys/Core_DOM/common/monads/DocumentMonad.thy
@@ -1,603 +1,614 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Document\<close>
 text\<open>In this theory, we introduce the monadic method setup for the Document class.\<close>
 
 theory DocumentMonad
   imports
     CharacterDataMonad
     "../classes/DocumentClass"
 begin
 
 type_synonym ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
     'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData, 'Document, 'result) dom_prog
   = "((_) heap, exception, 'result) prog"
 register_default_tvars "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
            'shadow_root_ptr, 'Object, 'Node, 'Element, 'CharacterData, 'Document, 'result) dom_prog" 
 
 
 global_interpretation l_ptr_kinds_M document_ptr_kinds defines document_ptr_kinds_M = a_ptr_kinds_M .
 lemmas document_ptr_kinds_M_defs = a_ptr_kinds_M_def
 
 lemma document_ptr_kinds_M_eq:
   assumes "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
   shows "|h \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
   using assms 
   by(auto simp add: document_ptr_kinds_M_defs object_ptr_kinds_M_defs document_ptr_kinds_def)
 
 lemma document_ptr_kinds_M_reads: 
   "reads (\<Union>object_ptr. {preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing)}) document_ptr_kinds_M h h'"
   using object_ptr_kinds_M_reads
   apply (simp add: reads_def object_ptr_kinds_M_defs document_ptr_kinds_M_defs 
     document_ptr_kinds_def preserved_def cong del: image_cong_simp)
   apply (metis (mono_tags, hide_lams) object_ptr_kinds_preserved_small old.unit.exhaust preserved_def)
   done
 
 global_interpretation l_dummy defines get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t = "l_get_M.a_get_M get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t" .
 lemma get_M_is_l_get_M: "l_get_M get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t type_wf document_ptr_kinds"
   apply(simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf l_get_M_def)
   by (metis ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf ObjectClass.type_wf_defs bind_eq_None_conv 
       document_ptr_kinds_commutes get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def option.simps(3))
 lemmas get_M_defs = get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def[unfolded l_get_M.a_get_M_def[OF get_M_is_l_get_M]]
 
 adhoc_overloading get_M get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 locale l_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas = l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 sublocale l_get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas by unfold_locales
 
 interpretation l_get_M get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t type_wf document_ptr_kinds
   apply(unfold_locales)
    apply (simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf local.type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
   by (meson DocumentMonad.get_M_is_l_get_M l_get_M_def)
 lemmas get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok = get_M_ok[folded get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def]
 end
 
 global_interpretation l_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas type_wf by unfold_locales
 
 
 global_interpretation l_put_M type_wf document_ptr_kinds get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t 
   rewrites "a_get_M = get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t" defines put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t = a_put_M
    apply (simp add: get_M_is_l_get_M l_put_M_def)
   by (simp add: get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 lemmas put_M_defs = a_put_M_def
 adhoc_overloading put_M put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 
 locale l_put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas = l_type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 sublocale l_put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_lemmas by unfold_locales
 
 interpretation l_put_M type_wf document_ptr_kinds get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
   apply(unfold_locales)
    apply (simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf local.type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
   by (meson DocumentMonad.get_M_is_l_get_M l_get_M_def)
 lemmas put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok = put_M_ok[folded put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def]
 end
 
 global_interpretation l_put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas type_wf by unfold_locales
 
 
 lemma document_put_get [simp]: 
   "h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> (\<And>x. getter (setter (\<lambda>_. v) x) = v) 
      \<Longrightarrow> h' \<turnstile> get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr getter \<rightarrow>\<^sub>r v"
   by(auto simp add: put_M_defs get_M_defs split: option.splits)
 lemma get_M_Mdocument_preserved1 [simp]: 
   "document_ptr \<noteq> document_ptr' 
     \<Longrightarrow> h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr' getter) h h'"
   by(auto simp add: put_M_defs get_M_defs preserved_def split: option.splits dest: get_heap_E)
 lemma document_put_get_preserved [simp]: 
   "h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> (\<And>x. getter (setter (\<lambda>_. v) x) = getter x) 
    \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr' getter) h h'"
   apply(cases "document_ptr = document_ptr'") 
   by(auto simp add: put_M_defs get_M_defs preserved_def split: option.splits dest: get_heap_E)
 
 lemma get_M_Mdocument_preserved2 [simp]: 
   "h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs NodeMonad.get_M_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def split: option.splits dest: get_heap_E)
 
 lemma get_M_Mdocument_preserved3 [simp]: 
   "cast document_ptr \<noteq> object_ptr 
    \<Longrightarrow> h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def ObjectMonad.get_M_defs 
       preserved_def split: option.splits dest: get_heap_E)
 lemma get_M_Mdocument_preserved4  [simp]: 
   "h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' 
    \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
    \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast document_ptr \<noteq> object_ptr")[1]
   by(auto simp add: put_M_defs get_M_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       ObjectMonad.get_M_defs preserved_def 
       split: option.splits bind_splits dest: get_heap_E)
 
 lemma get_M_Mdocument_preserved5 [simp]: 
   "cast document_ptr \<noteq> object_ptr 
   \<Longrightarrow> h \<turnstile> put_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr getter) h h'"
   by(auto simp add: ObjectMonad.put_M_defs get_M_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def ObjectMonad.get_M_defs 
       preserved_def split: option.splits dest: get_heap_E)
 
 lemma get_M_Mdocument_preserved6 [simp]: 
   "h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr getter) h h'"
   by(auto simp add: put_M_defs ElementMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma get_M_Mdocument_preserved7 [simp]: 
   "h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr getter) h h'"
   by(auto simp add: ElementMonad.put_M_defs get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma get_M_Mdocument_preserved8 [simp]: 
   "h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr getter) h h'"
   by(auto simp add: put_M_defs CharacterDataMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma get_M_Mdocument_preserved9 [simp]: 
   "h \<turnstile> put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr getter) h h'"
   by(auto simp add: CharacterDataMonad.put_M_defs get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma get_M_Mdocument_preserved10 [simp]: 
   "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
     \<Longrightarrow> h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast document_ptr = object_ptr") 
   by(auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs NodeMonad.get_M_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def bind_eq_Some_conv 
       split: option.splits)
 
 lemma new_element_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t: 
   "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr getter) h h'"
   by(auto simp add: new_element_def get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_character_data_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr getter) h h'"
   by(auto simp add: new_character_data_def get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 
 subsection \<open>Creating Documents\<close>
 
 definition new_document :: "(_, (_) document_ptr) dom_prog"
   where
     "new_document = do {
       h \<leftarrow> get_heap;
       (new_ptr, h') \<leftarrow> return (new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h);
       return_heap h';
       return new_ptr
     }"
 
 lemma new_document_ok [simp]:
   "h \<turnstile> ok new_document"
   by(auto simp add: new_document_def split: prod.splits)
 
 lemma new_document_ptr_in_heap:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "new_document_ptr |\<in>| document_ptr_kinds h'"
   using assms
   unfolding new_document_def
   by(auto simp add: new_document_def new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap is_OK_returns_result_I
       elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_document_ptr_not_in_heap:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "new_document_ptr |\<notin>| document_ptr_kinds h"
   using assms new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_not_in_heap
   by(auto simp add: new_document_def split: prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_document_new_ptr:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_document_ptr|}"
   using assms new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_new_ptr
   by(auto simp add: new_document_def split: prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_document_is_document_ptr:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "is_document_ptr new_document_ptr"
   using assms new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_is_document_ptr
   by(auto simp add: new_document_def elim!: bind_returns_result_E split: prod.splits)
 
 lemma new_document_doctype:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "h' \<turnstile> get_M new_document_ptr doctype \<rightarrow>\<^sub>r ''''"
   using assms
   by(auto simp add: get_M_defs new_document_def new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_document_document_element:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "h' \<turnstile> get_M new_document_ptr document_element \<rightarrow>\<^sub>r None"
   using assms
   by(auto simp add: get_M_defs new_document_def new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_document_disconnected_nodes:
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr"
   shows "h' \<turnstile> get_M new_document_ptr disconnected_nodes \<rightarrow>\<^sub>r []"
   using assms
   by(auto simp add: get_M_defs new_document_def new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 
 lemma new_document_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t: 
   "h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr 
     \<Longrightarrow> ptr \<noteq> cast new_document_ptr \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
   by(auto simp add: new_document_def ObjectMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_document_get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e: 
   "h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr 
     \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr getter) h h'"
   by(auto simp add: new_document_def NodeMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_document_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t: 
   "h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr 
      \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr getter) h h'"
   by(auto simp add: new_document_def ElementMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_document_get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a: 
   "h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr 
     \<Longrightarrow> preserved (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a ptr getter) h h'"
   by(auto simp add: new_document_def CharacterDataMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_document_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t: 
   "h \<turnstile> new_document \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr \<Longrightarrow> ptr \<noteq> new_document_ptr 
      \<Longrightarrow> preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr getter) h h'"
   by(auto simp add: new_document_def get_M_defs preserved_def
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 
 
 subsection \<open>Modified Heaps\<close>
 
 lemma get_document_ptr_simp [simp]: 
   "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) 
      = (if ptr = cast document_ptr then cast obj else get document_ptr h)"
   by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def split: option.splits Option.bind_splits)
 
 lemma document_ptr_kidns_simp [simp]: 
   "document_ptr_kinds (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) 
     = document_ptr_kinds h |\<union>| (if is_document_ptr_kind ptr then {|the (cast ptr)|} else {||})"
   by(auto simp add: document_ptr_kinds_def split: option.splits)
 
 lemma type_wf_put_I:
   assumes "type_wf h"
   assumes "CharacterDataClass.type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "is_document_ptr_kind ptr \<Longrightarrow> is_document_kind obj"
   shows "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   using assms
   by(auto simp add: type_wf_defs is_document_kind_def split: option.splits)
 
 lemma type_wf_put_ptr_not_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<notin>| object_ptr_kinds h"
   shows "type_wf h"
   using assms
   by(auto simp add: type_wf_defs elim!: CharacterDataMonad.type_wf_put_ptr_not_in_heap_E 
       split: option.splits if_splits)
 
 lemma type_wf_put_ptr_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "CharacterDataClass.type_wf h"
   assumes "is_document_ptr_kind ptr \<Longrightarrow> is_document_kind (the (get ptr h))"
   shows "type_wf h"
   using assms
   apply(auto simp add: type_wf_defs elim!: CharacterDataMonad.type_wf_put_ptr_in_heap_E 
       split: option.splits if_splits)[1]
-  by (metis (no_types, lifting) CharacterDataClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf bind.bind_lunit get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def is_document_kind_def notin_fset option.exhaust_sel)
+  by (metis (no_types, lifting) CharacterDataClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf bind.bind_lunit get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
+      is_document_kind_def notin_fset option.exhaust_sel)
 
 
 
 subsection \<open>Preserving Types\<close>
 
 lemma new_element_type_wf_preserved [simp]: 
   "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def element_ptrs_def
       elim!: bind_returns_heap_E type_wf_put_ptr_not_in_heap_E 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I 
       split: if_splits)[1]
    apply fastforce
   by (metis Suc_n_not_le_n element_ptr.sel(1) element_ptrs_def fMax_ge ffmember_filter 
       fimage_eqI is_element_ptr_ref)
 
 lemma new_element_is_l_new_element [instances]: 
   "l_new_element type_wf"
   using l_new_element.intro new_element_type_wf_preserved
   by blast
 
-lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_type_type_wf_preserved [simp]: 
-  "h \<turnstile> put_M element_ptr tag_type_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
+lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
+  "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs
       ElementMonad.get_M_defs ObjectClass.type_wf_defs
       CharacterDataClass.type_wf_defs split: option.splits)[1]
-  apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse option.distinct(1) option.simps(3))
+   apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def
+      bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse
+      option.distinct(1) option.simps(3))
   by (metis fmember.rep_eq)
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_child_nodes_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr child_nodes_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def
       dest!: get_heap_E
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
-  apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse option.distinct(1) option.simps(3))
+   apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def
+      bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse
+      option.distinct(1) option.simps(3))
   by (metis fmember.rep_eq)
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_attrs_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def
       dest!: get_heap_E
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
-  apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse option.distinct(1) option.simps(3))
+   apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def
+      bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse
+      option.distinct(1) option.simps(3))
   by (metis fmember.rep_eq)
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_shadow_root_opt_type_wf_preserved [simp]:
   "h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def
       dest!: get_heap_E
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
-  apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse option.distinct(1) option.simps(3))
+   apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def
+      bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse
+      option.distinct(1) option.simps(3))
   by (metis fmember.rep_eq)
 
 lemma new_character_data_type_wf_preserved [simp]: 
   "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_kind_def
       new_character_data_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
       dest!: get_heap_E
       elim!: bind_returns_heap_E2 bind_returns_heap_E type_wf_put_ptr_not_in_heap_E
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
   by (meson new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_not_in_heap)
 
 lemma new_character_data_is_l_new_character_data [instances]: 
   "l_new_character_data type_wf"
   using l_new_character_data.intro new_character_data_type_wf_preserved
   by blast
 
 lemma put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_val_type_wf_preserved [simp]: 
   "h \<turnstile> put_M character_data_ptr val_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: CharacterDataMonad.put_M_defs put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t is_node_kind_def
       dest!: get_heap_E  elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
   apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs CharacterDataMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
   apply (metis bind.bind_lzero finite_set_in get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def option.distinct(1) option.exhaust_sel)
   by (metis finite_set_in)
 
 
 lemma new_document_type_wf_preserved [simp]: "h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: new_document_def new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a  DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_ptr_kind_none
       elim!: bind_returns_heap_E type_wf_put_ptr_not_in_heap_E 
       intro!: type_wf_put_I ElementMonad.type_wf_put_I CharacterDataMonad.type_wf_put_I 
       NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I 
       split: if_splits)[1] 
    apply(auto simp add: type_wf_defs ElementClass.type_wf_defs CharacterDataClass.type_wf_defs 
       NodeClass.type_wf_defs ObjectClass.type_wf_defs is_document_kind_def 
       split: option.splits)[1]
   using document_ptrs_def apply fastforce
    apply (simp add: is_document_kind_def)
-  apply (metis Suc_n_not_le_n document_ptr.sel(1) document_ptrs_def fMax_ge ffmember_filter fimage_eqI is_document_ptr_ref)
+  apply (metis Suc_n_not_le_n document_ptr.sel(1) document_ptrs_def fMax_ge ffmember_filter
+      fimage_eqI is_document_ptr_ref)
   done
 
 locale l_new_document = l_type_wf +
   assumes new_document_types_preserved: "h \<turnstile> new_document \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
 
 lemma new_document_is_l_new_document  [instances]: "l_new_document type_wf"
   using l_new_document.intro new_document_type_wf_preserved
   by blast
 
 lemma put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_doctype_type_wf_preserved [simp]: 
   "h \<turnstile> put_M document_ptr doctype_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: put_M_defs put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I 
       ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
          apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
         apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
        apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
       apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
      apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
     apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
    apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
   apply(auto simp add: is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
-  apply(auto simp add: get_M_defs)
+  apply(auto simp add: get_M_defs)[1]
   by (metis (mono_tags) error_returns_result finite_set_in option.exhaust_sel option.simps(4))
 
 lemma put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_document_element_type_wf_preserved [simp]: 
   "h \<turnstile> put_M document_ptr document_element_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: put_M_defs put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
       DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e
       DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t is_node_ptr_kind_none
       cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_none is_document_kind_def
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I 
       ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I 
       ObjectMonad.type_wf_put_I)[1]
   apply(auto simp add: get_M_defs is_document_kind_def type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs 
       split: option.splits)[1]
   by (metis finite_set_in)
 
 lemma put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_disconnected_nodes_type_wf_preserved [simp]: 
   "h \<turnstile> put_M document_ptr disconnected_nodes_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: put_M_defs put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
       DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a
       DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
       DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e
       DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       is_node_ptr_kind_none
       cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_none is_document_kind_def
       dest!: get_heap_E  
       elim!: bind_returns_heap_E2 
       intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I 
       ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I
       ObjectMonad.type_wf_put_I)[1] 
   apply(auto simp add: is_document_kind_def get_M_defs type_wf_defs ElementClass.type_wf_defs 
       NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs 
       CharacterDataClass.type_wf_defs split: option.splits)[1]
   by (metis finite_set_in)
 
 lemma document_ptr_kinds_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   shows "document_ptr_kinds h = document_ptr_kinds h'"
   by(simp add: document_ptr_kinds_def preserved_def object_ptr_kinds_preserved_small[OF assms])
 
 lemma document_ptr_kinds_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' 
            \<longrightarrow> (\<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h')"
   shows "document_ptr_kinds h = document_ptr_kinds h'"
   using writes_small_big[OF assms]
   apply(simp add: reflp_def transp_def preserved_def document_ptr_kinds_def)
   by (metis assms object_ptr_kinds_preserved)
 
 lemma type_wf_preserved_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   assumes "\<And>element_ptr. preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr RElement.nothing) h h'"
   assumes "\<And>character_data_ptr. preserved 
                           (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr RCharacterData.nothing) h h'"
   assumes "\<And>document_ptr. preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr RDocument.nothing) h h'"
   shows "DocumentClass.type_wf h = DocumentClass.type_wf h'"
   using type_wf_preserved_small[OF assms(1) assms(2) assms(3) assms(4)]  
     allI[OF assms(5), of id, simplified] document_ptr_kinds_small[OF assms(1)]
   apply(auto simp add: type_wf_defs )[1]
    apply(auto simp add: type_wf_defs preserved_def get_M_defs document_ptr_kinds_small[OF assms(1)] 
       split: option.splits)[1]
    apply force
   apply(auto simp add: type_wf_defs preserved_def get_M_defs document_ptr_kinds_small[OF assms(1)] 
       split: option.splits)[1]
   by force
 
 lemma type_wf_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>element_ptr. preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr RElement.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>character_data_ptr. preserved 
                     (get_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a character_data_ptr RCharacterData.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
           \<Longrightarrow> \<forall>document_ptr. preserved (get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr RDocument.nothing) h h'"
   shows "DocumentClass.type_wf h = DocumentClass.type_wf h'"
 proof -
   have "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> DocumentClass.type_wf h = DocumentClass.type_wf h'"
     using assms type_wf_preserved_small by fast
   with assms(1) assms(2) show ?thesis
     apply(rule writes_small_big)
     by(auto simp add: reflp_def transp_def)
 qed
 
 lemma type_wf_drop: "type_wf h \<Longrightarrow> type_wf (Heap (fmdrop ptr (the_heap h)))"
   apply(auto simp add: type_wf_defs)[1]
   using type_wf_drop
    apply blast
-  by (metis (no_types, lifting) CharacterDataClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf CharacterDataMonad.type_wf_drop document_ptr_kinds_commutes finite_set_in fmlookup_drop get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def heap.sel)
+  by (metis (no_types, lifting) CharacterDataClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf CharacterDataMonad.type_wf_drop
+      document_ptr_kinds_commutes finite_set_in fmlookup_drop get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def heap.sel)
 end
diff --git a/thys/Core_DOM/common/monads/ElementMonad.thy b/thys/Core_DOM/common/monads/ElementMonad.thy
--- a/thys/Core_DOM/common/monads/ElementMonad.thy
+++ b/thys/Core_DOM/common/monads/ElementMonad.thy
@@ -1,445 +1,445 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Element\<close>
 text\<open>In this theory, we introduce the monadic method setup for the Element class.\<close>
 theory ElementMonad
   imports
     NodeMonad
     "ElementClass"
 begin
 
 type_synonym ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 
     'shadow_root_ptr, 'Object, 'Node, 'Element,'result) dom_prog
   = "((_) heap, exception, 'result) prog"
 register_default_tvars "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 
                         'document_ptr, 'shadow_root_ptr, 'Object, 'Node, 'Element,'result) dom_prog" 
 
 
 global_interpretation l_ptr_kinds_M element_ptr_kinds defines element_ptr_kinds_M = a_ptr_kinds_M .
 lemmas element_ptr_kinds_M_defs = a_ptr_kinds_M_def
 
 
 lemma element_ptr_kinds_M_eq:
   assumes "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
   shows "|h \<turnstile> element_ptr_kinds_M|\<^sub>r = |h' \<turnstile> element_ptr_kinds_M|\<^sub>r"
   using assms 
   by(auto simp add: element_ptr_kinds_M_defs node_ptr_kinds_M_defs element_ptr_kinds_def)
 
 lemma element_ptr_kinds_M_reads: 
   "reads (\<Union>element_ptr. {preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t element_ptr RObject.nothing)}) element_ptr_kinds_M h h'"
   apply (simp add: reads_def node_ptr_kinds_M_defs element_ptr_kinds_M_defs element_ptr_kinds_def
     node_ptr_kinds_M_reads preserved_def cong del: image_cong_simp)
   apply (metis (mono_tags, hide_lams) node_ptr_kinds_small old.unit.exhaust preserved_def)
   done
 
 global_interpretation l_dummy defines get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t = "l_get_M.a_get_M get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t" .
 lemma get_M_is_l_get_M: "l_get_M get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t type_wf element_ptr_kinds"
   apply(simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf l_get_M_def)
   by (metis (no_types, lifting) ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf ObjectClass.type_wf_defs 
       bind_eq_Some_conv bind_eq_Some_conv element_ptr_kinds_commutes get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def node_ptr_kinds_commutes option.simps(3))
 lemmas get_M_defs = get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def[unfolded l_get_M.a_get_M_def[OF get_M_is_l_get_M]]
 
 adhoc_overloading get_M get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 locale l_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas = l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 sublocale l_get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas by unfold_locales
 
 interpretation l_get_M get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t type_wf element_ptr_kinds
   apply(unfold_locales)
    apply (simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf local.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
   by (meson ElementMonad.get_M_is_l_get_M l_get_M_def)
 lemmas get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok = get_M_ok[folded get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def]
 lemmas get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap = get_M_ptr_in_heap[folded get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def]
 end
 
 global_interpretation l_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas type_wf by unfold_locales
 
 
 global_interpretation l_put_M type_wf element_ptr_kinds get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t 
   rewrites "a_get_M = get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t" 
   defines put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t = a_put_M
    apply (simp add: get_M_is_l_get_M l_put_M_def)
   by (simp add: get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 lemmas put_M_defs = a_put_M_def
 adhoc_overloading put_M put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 
 locale l_put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas = l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 sublocale l_put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas by unfold_locales
 
 interpretation l_put_M type_wf element_ptr_kinds get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
   apply(unfold_locales)
    apply (simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf local.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t)
   by (meson ElementMonad.get_M_is_l_get_M l_get_M_def)
 
 lemmas put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ok = put_M_ok[folded put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def]
 end
 
 global_interpretation l_put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas type_wf by unfold_locales
 
 
 lemma element_put_get [simp]: 
   "h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> (\<And>x. getter (setter (\<lambda>_. v) x) = v) 
   \<Longrightarrow> h' \<turnstile> get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr getter \<rightarrow>\<^sub>r v"
   by(auto simp add: put_M_defs get_M_defs split: option.splits)
 lemma get_M_Element_preserved1 [simp]: 
   "element_ptr \<noteq> element_ptr' \<Longrightarrow> h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
      \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr' getter) h h'"
   by(auto simp add: put_M_defs get_M_defs preserved_def split: option.splits dest: get_heap_E)
 lemma element_put_get_preserved [simp]: 
   "(\<And>x. getter (setter (\<lambda>_. v) x) = getter x) \<Longrightarrow> h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr' getter) h h'"
   apply(cases "element_ptr = element_ptr'") 
   by(auto simp add: put_M_defs get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma  get_M_Element_preserved3 [simp]: 
   "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
     \<Longrightarrow> h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast element_ptr = object_ptr") 
   by (auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs NodeMonad.get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def bind_eq_Some_conv 
       split: option.splits)
 lemma  get_M_Element_preserved4 [simp]: 
   "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
      \<Longrightarrow> h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   apply(cases "cast element_ptr = node_ptr") 
   by(auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs NodeMonad.get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def bind_eq_Some_conv 
       split: option.splits)
 
 lemma  get_M_Element_preserved5 [simp]: 
   "cast element_ptr \<noteq> node_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
   \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def NodeMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma  get_M_Element_preserved6 [simp]: 
   "h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
     \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   apply(cases "cast element_ptr \<noteq> node_ptr")
   by(auto simp add: put_M_defs get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def NodeMonad.get_M_defs preserved_def 
       split: option.splits bind_splits dest: get_heap_E)
 
 lemma  get_M_Element_preserved7 [simp]: 
   "cast element_ptr \<noteq> node_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr getter) h h'"
   by(auto simp add: NodeMonad.put_M_defs get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def NodeMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 
 lemma  get_M_Element_preserved8 [simp]: 
   "cast element_ptr \<noteq> object_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       ObjectMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma  get_M_Element_preserved9 [simp]: 
   "h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
    \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast element_ptr \<noteq> object_ptr")
   by(auto simp add: put_M_defs get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       ObjectMonad.get_M_defs preserved_def 
       split: option.splits bind_splits dest: get_heap_E)
 
 lemma  get_M_Element_preserved10 [simp]: 
   "cast element_ptr \<noteq> object_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr getter) h h'"
   by(auto simp add: ObjectMonad.put_M_defs get_M_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       ObjectMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 
 subsection\<open>Creating Elements\<close>
 
 definition new_element :: "(_, (_) element_ptr) dom_prog"
   where
     "new_element = do {
       h \<leftarrow> get_heap;
       (new_ptr, h') \<leftarrow> return (new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h);
       return_heap h';
       return new_ptr
     }"
 
 lemma new_element_ok [simp]:
   "h \<turnstile> ok new_element"
   by(auto simp add: new_element_def split: prod.splits)
 
 lemma new_element_ptr_in_heap:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "new_element_ptr |\<in>| element_ptr_kinds h'"
   using assms
   unfolding new_element_def
   by(auto simp add: new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap is_OK_returns_result_I
       elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_element_ptr_not_in_heap:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "new_element_ptr |\<notin>| element_ptr_kinds h"
   using assms new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_not_in_heap
   by(auto simp add: new_element_def split: prod.splits elim!: bind_returns_result_E 
       bind_returns_heap_E)
 
 lemma new_element_new_ptr:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
     and "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
   using assms new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_new_ptr
   by(auto simp add: new_element_def split: prod.splits elim!: bind_returns_result_E 
       bind_returns_heap_E)
 
 lemma new_element_is_element_ptr:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "is_element_ptr new_element_ptr"
   using assms new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_is_element_ptr
   by(auto simp add: new_element_def elim!: bind_returns_result_E split: prod.splits)
 
 lemma new_element_child_nodes:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "h' \<turnstile> get_M new_element_ptr child_nodes \<rightarrow>\<^sub>r []"
   using assms
   by(auto simp add: get_M_defs new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
-lemma new_element_tag_type:
+lemma new_element_tag_name:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
-  shows "h' \<turnstile> get_M new_element_ptr tag_type \<rightarrow>\<^sub>r ''''"
+  shows "h' \<turnstile> get_M new_element_ptr tag_name \<rightarrow>\<^sub>r ''''"
   using assms
   by(auto simp add: get_M_defs new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_element_attrs:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "h' \<turnstile> get_M new_element_ptr attrs \<rightarrow>\<^sub>r fmempty"
   using assms
   by(auto simp add: get_M_defs new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_element_shadow_root_opt:
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr"
   shows "h' \<turnstile> get_M new_element_ptr shadow_root_opt \<rightarrow>\<^sub>r None"
   using assms
   by(auto simp add: get_M_defs new_element_def new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def 
       split: option.splits prod.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 lemma new_element_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t: 
   "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> ptr \<noteq> cast new_element_ptr 
    \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
   by(auto simp add: new_element_def ObjectMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_element_get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e: 
   "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> ptr \<noteq> cast new_element_ptr 
     \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr getter) h h'"
   by(auto simp add: new_element_def NodeMonad.get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 lemma new_element_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t: 
   "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr \<Longrightarrow> ptr \<noteq> new_element_ptr 
     \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr getter) h h'"
   by(auto simp add: new_element_def get_M_defs preserved_def 
       split: prod.splits option.splits elim!: bind_returns_result_E bind_returns_heap_E)
 
 subsection\<open>Modified Heaps\<close>
 
 lemma get_Element_ptr_simp [simp]: 
   "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) 
       = (if ptr = cast element_ptr then cast obj else get element_ptr h)"
   by(auto simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def split: option.splits Option.bind_splits)
 
 
 lemma element_ptr_kinds_simp [simp]: 
   "element_ptr_kinds (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) 
       = element_ptr_kinds h |\<union>| (if is_element_ptr_kind ptr then {|the (cast ptr)|} else {||})"
   by(auto simp add: element_ptr_kinds_def is_node_ptr_kind_def split: option.splits)
 
 lemma type_wf_put_I:
   assumes "type_wf h"
   assumes "NodeClass.type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "is_element_ptr_kind ptr \<Longrightarrow> is_element_kind obj"
   shows "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   using assms
   by(auto simp add: type_wf_defs split: option.splits)
 
 lemma type_wf_put_ptr_not_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<notin>| object_ptr_kinds h"
   shows "type_wf h"
   using assms
   apply(auto simp add: type_wf_defs elim!: NodeMonad.type_wf_put_ptr_not_in_heap_E 
                                     split: option.splits if_splits)[1]
   using assms(2) node_ptr_kinds_commutes by blast
 
 lemma type_wf_put_ptr_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "NodeClass.type_wf h"
   assumes "is_element_ptr_kind ptr \<Longrightarrow> is_element_kind (the (get ptr h))"
   shows "type_wf h"
   using assms
   apply(auto simp add: type_wf_defs split: option.splits if_splits)[1]
   by (metis (no_types, lifting) NodeClass.l_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas_axioms assms(2) bind.bind_lunit
             cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_inv cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
             l_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf option.collapse)
 
 subsection\<open>Preserving Types\<close>
 
 lemma new_element_type_wf_preserved [simp]: "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       new_element_def Let_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def
       split: prod.splits if_splits elim!: bind_returns_heap_E)[1]
      apply (metis element_ptr_kinds_commutes element_ptrs_def fempty_iff ffmember_filter finite_set_in
       is_element_ptr_ref)
     apply (metis element_ptrs_def fempty_iff ffmember_filter finite_set_in is_element_ptr_ref)
    apply (metis (no_types, lifting) Suc_n_not_le_n element_ptr.sel(1) element_ptr_kinds_commutes
                 element_ptrs_def fMax_ge ffmember_filter fimage_eqI is_element_ptr_ref notin_fset)
   apply (metis (no_types, lifting) Suc_n_not_le_n element_ptr.sel(1) element_ptrs_def
                fMax_ge ffmember_filter fimage_eqI finite_set_in is_element_ptr_ref)
   done
 
 locale l_new_element = l_type_wf +
   assumes new_element_types_preserved: "h \<turnstile> new_element \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
 
 lemma new_element_is_l_new_element: "l_new_element type_wf"
   using l_new_element.intro new_element_type_wf_preserved
   by blast
 
-lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_type_type_wf_preserved [simp]: 
-  "h \<turnstile> put_M element_ptr tag_type_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
+lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
+  "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs  
       Let_def put_M_defs get_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       split: prod.splits option.splits Option.bind_splits elim!: bind_returns_heap_E)[1]
    apply (metis finite_set_in option.inject)
   apply (metis cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in option.sel)
   done
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_child_nodes_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr child_nodes_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs  
       Let_def put_M_defs get_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       split: prod.splits option.splits Option.bind_splits elim!: bind_returns_heap_E)[1]
    apply (metis finite_set_in option.inject)
   apply (metis cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in option.sel)
   done
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_attrs_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs  Let_def 
       put_M_defs get_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def 
       get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       split: prod.splits option.splits Option.bind_splits elim!: bind_returns_heap_E)[1]
    apply (metis finite_set_in option.inject)
   apply (metis cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in option.sel)
   done
 
 lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_shadow_root_opt_type_wf_preserved [simp]: 
   "h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
   apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs  
       Let_def put_M_defs get_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       split: prod.splits option.splits Option.bind_splits elim!: bind_returns_heap_E)[1]
    apply (metis finite_set_in option.inject)
   apply (metis cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in option.sel)
   done
 
 lemma put_M_pointers_preserved:
   assumes "h \<turnstile> put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr setter v \<rightarrow>\<^sub>h h'"
   shows "object_ptr_kinds h = object_ptr_kinds h'"
   using assms 
   apply(auto simp add: put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def 
       elim!: bind_returns_heap_E2 dest!: get_heap_E)[1]
   by (meson get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap is_OK_returns_result_I)
 
 lemma element_ptr_kinds_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' 
                     \<longrightarrow> (\<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h')"
   shows "element_ptr_kinds h = element_ptr_kinds h'"
   using writes_small_big[OF assms]
   apply(simp add: reflp_def transp_def preserved_def element_ptr_kinds_def)
   by (metis assms node_ptr_kinds_preserved)
 
 
 lemma element_ptr_kinds_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   shows "element_ptr_kinds h = element_ptr_kinds h'"
   by(simp add: element_ptr_kinds_def node_ptr_kinds_def preserved_def 
       object_ptr_kinds_preserved_small[OF assms])
 
 lemma type_wf_preserved_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   assumes "\<And>element_ptr. preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr RElement.nothing) h h'"
   shows "type_wf h = type_wf h'"
   using type_wf_preserved_small[OF assms(1) assms(2)] allI[OF assms(3), of id, simplified]
   apply(auto simp add: type_wf_defs )[1]
    apply(auto simp add: preserved_def get_M_defs element_ptr_kinds_small[OF assms(1)] 
       split: option.splits,force)[1]
   by(auto simp add: preserved_def get_M_defs element_ptr_kinds_small[OF assms(1)] 
       split: option.splits,force)
 
 lemma type_wf_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
            \<Longrightarrow> \<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
            \<Longrightarrow> \<forall>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
            \<Longrightarrow> \<forall>element_ptr. preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr RElement.nothing) h h'"
   shows "type_wf h = type_wf h'"
 proof -
   have "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
     using assms type_wf_preserved_small by fast
   with assms(1) assms(2) show ?thesis
     apply(rule writes_small_big)
     by(auto simp add: reflp_def transp_def)
 qed
 
 lemma type_wf_drop: "type_wf h \<Longrightarrow> type_wf (Heap (fmdrop ptr (the_heap h)))"
   apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs 
       node_ptr_kinds_def object_ptr_kinds_def is_node_ptr_kind_def 
       get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def)[1]
    apply (metis (no_types, lifting) element_ptr_kinds_commutes finite_set_in fmdom_notD fmdom_notI
                 fmlookup_drop heap.sel node_ptr_kinds_commutes o_apply object_ptr_kinds_def)
   by (metis element_ptr_kinds_commutes fmdom_notI fmdrop_lookup heap.sel node_ptr_kinds_commutes
             o_apply object_ptr_kinds_def)
 
 end
diff --git a/thys/Core_DOM/common/monads/NodeMonad.thy b/thys/Core_DOM/common/monads/NodeMonad.thy
--- a/thys/Core_DOM/common/monads/NodeMonad.thy
+++ b/thys/Core_DOM/common/monads/NodeMonad.thy
@@ -1,218 +1,218 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Node\<close>
 text\<open>In this theory, we introduce the monadic method setup for the Node class.\<close>
 theory NodeMonad
   imports
     ObjectMonad
     "../classes/NodeClass"
 begin
 
 type_synonym ('object_ptr, 'node_ptr, 'Object, 'Node, 'result) dom_prog
   = "((_) heap, exception, 'result) prog"
 register_default_tvars "('object_ptr, 'node_ptr, 'Object, 'Node, 'result) dom_prog" 
 
 
 global_interpretation l_ptr_kinds_M node_ptr_kinds defines node_ptr_kinds_M = a_ptr_kinds_M .
 lemmas node_ptr_kinds_M_defs = a_ptr_kinds_M_def
 
 lemma node_ptr_kinds_M_eq:
   assumes "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
   shows "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
   using assms 
   by(auto simp add: node_ptr_kinds_M_defs object_ptr_kinds_M_defs node_ptr_kinds_def)
 
 
 global_interpretation l_dummy defines get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e = "l_get_M.a_get_M get\<^sub>N\<^sub>o\<^sub>d\<^sub>e" .
 lemma get_M_is_l_get_M: "l_get_M get\<^sub>N\<^sub>o\<^sub>d\<^sub>e type_wf node_ptr_kinds"
   apply(simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf l_get_M_def)
   by (metis ObjectClass.a_type_wf_def ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf bind_eq_None_conv get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       node_ptr_kinds_commutes option.simps(3))
 lemmas get_M_defs = get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def[unfolded l_get_M.a_get_M_def[OF get_M_is_l_get_M]]
 
 adhoc_overloading get_M get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 locale l_get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas = l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 begin
 sublocale l_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas by unfold_locales
 
 interpretation l_get_M get\<^sub>N\<^sub>o\<^sub>d\<^sub>e type_wf node_ptr_kinds
   apply(unfold_locales)
    apply (simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf local.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e)
   by (meson NodeMonad.get_M_is_l_get_M l_get_M_def)
 lemmas get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_ok = get_M_ok[folded get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def]
 end
 
 global_interpretation l_get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas type_wf by unfold_locales
 
 lemma node_ptr_kinds_M_reads: 
   "reads (\<Union>object_ptr. {preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing)}) node_ptr_kinds_M h h'"
   using object_ptr_kinds_M_reads
   apply (simp add: reads_def node_ptr_kinds_M_defs node_ptr_kinds_def
       object_ptr_kinds_M_reads preserved_def)
   by (smt object_ptr_kinds_preserved_small preserved_def unit_all_impI)
 
 global_interpretation l_put_M type_wf node_ptr_kinds get\<^sub>N\<^sub>o\<^sub>d\<^sub>e put\<^sub>N\<^sub>o\<^sub>d\<^sub>e 
   rewrites "a_get_M = get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e" 
   defines put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e = a_put_M
    apply (simp add: get_M_is_l_get_M l_put_M_def)
   by (simp add: get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 lemmas put_M_defs = a_put_M_def
 adhoc_overloading put_M put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 
 locale l_put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas = l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 begin
 sublocale l_put_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_lemmas by unfold_locales
 
 interpretation l_put_M type_wf node_ptr_kinds get\<^sub>N\<^sub>o\<^sub>d\<^sub>e put\<^sub>N\<^sub>o\<^sub>d\<^sub>e
   apply(unfold_locales)
    apply (simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf local.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e)
   by (meson NodeMonad.get_M_is_l_get_M l_get_M_def)
 lemmas put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_ok = put_M_ok[folded put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def]
 end
 
 global_interpretation l_put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas type_wf by unfold_locales
 
 lemma get_M_Object_preserved1 [simp]: 
   "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) \<Longrightarrow> h \<turnstile> put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast node_ptr = object_ptr") 
   by(auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def 
       bind_eq_Some_conv 
       split: option.splits)
 
 lemma get_M_Object_preserved2 [simp]: 
   "cast node_ptr \<noteq> object_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr setter v \<rightarrow>\<^sub>h h' 
     \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   by(auto simp add: put_M_defs get_M_defs get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def ObjectMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 lemma get_M_Object_preserved3 [simp]: 
   "h \<turnstile> put_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x)) 
     \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
   apply(cases "cast node_ptr \<noteq> object_ptr")
   by(auto simp add: put_M_defs get_M_defs get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def ObjectMonad.get_M_defs preserved_def 
       split: option.splits bind_splits dest: get_heap_E)
 
 lemma get_M_Object_preserved4 [simp]: 
   "cast node_ptr \<noteq> object_ptr \<Longrightarrow> h \<turnstile> put_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr setter v \<rightarrow>\<^sub>h h' 
       \<Longrightarrow> preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr getter) h h'"
   by(auto simp add: ObjectMonad.put_M_defs get_M_defs get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def ObjectMonad.get_M_defs preserved_def 
       split: option.splits dest: get_heap_E)
 
 subsection\<open>Modified Heaps\<close>
 
 lemma get_node_ptr_simp [simp]: 
   "get\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) = (if ptr = cast node_ptr then cast obj else get node_ptr h)"
   by(auto simp add: get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 lemma node_ptr_kinds_simp [simp]: 
   "node_ptr_kinds (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h) 
                 = node_ptr_kinds h |\<union>| (if is_node_ptr_kind ptr then {|the (cast ptr)|} else {||})"
   by(auto simp add: node_ptr_kinds_def)
 
 lemma type_wf_put_I:
   assumes "type_wf h"
   assumes "ObjectClass.type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "is_node_ptr_kind ptr \<Longrightarrow> is_node_kind obj"
   shows "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   using assms
   apply(auto simp add: type_wf_defs split: option.splits)[1]
   using cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_none is_node_kind_def apply blast
   using cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_none is_node_kind_def apply blast
   done
 
 lemma type_wf_put_ptr_not_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<notin>| object_ptr_kinds h"
   shows "type_wf h"
   using assms
   by(auto simp add: type_wf_defs elim!: ObjectMonad.type_wf_put_ptr_not_in_heap_E  
       split: option.splits if_splits)
 
 lemma type_wf_put_ptr_in_heap_E:
   assumes "type_wf (put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr obj h)"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "ObjectClass.type_wf h"
   assumes "is_node_ptr_kind ptr \<Longrightarrow> is_node_kind (the (get ptr h))"
   shows "type_wf h"
   using assms
-  apply(auto simp add: type_wf_defs split: option.splits if_splits)
+  apply(auto simp add: type_wf_defs split: option.splits if_splits)[1]
   by (metis ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf bind.bind_lunit finite_set_in get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def is_node_kind_def option.exhaust_sel)
 
 
 subsection\<open>Preserving Types\<close>
 
 lemma node_ptr_kinds_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   shows "node_ptr_kinds h = node_ptr_kinds h'"
   by(simp add: node_ptr_kinds_def preserved_def object_ptr_kinds_preserved_small[OF assms])
 
 lemma node_ptr_kinds_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' 
             \<longrightarrow> (\<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h')"
   shows "node_ptr_kinds h = node_ptr_kinds h'"
   using writes_small_big[OF assms]
   apply(simp add: reflp_def transp_def preserved_def node_ptr_kinds_def)
   by (metis assms object_ptr_kinds_preserved)
 
 
 lemma type_wf_preserved_small:
   assumes "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   shows "type_wf h = type_wf h'"
   using type_wf_preserved allI[OF assms(2), of id, simplified]
-  apply(auto simp add: type_wf_defs)
+  apply(auto simp add: type_wf_defs)[1]
    apply(auto simp add: preserved_def get_M_defs node_ptr_kinds_small[OF assms(1)]
       split: option.splits)[1]
   apply (metis notin_fset option.simps(3))
   by(auto simp add: preserved_def get_M_defs node_ptr_kinds_small[OF assms(1)]
       split: option.splits, force)[1]
 
 lemma type_wf_preserved:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
            \<Longrightarrow> \<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
            \<Longrightarrow> \<forall>node_ptr. preserved (get_M\<^sub>N\<^sub>o\<^sub>d\<^sub>e node_ptr RNode.nothing) h h'"
   shows "type_wf h = type_wf h'"
 proof -
   have "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
     using assms type_wf_preserved_small by fast
   with assms(1) assms(2) show ?thesis
     apply(rule writes_small_big)
     by(auto simp add: reflp_def transp_def)
 qed
 end
 
diff --git a/thys/Core_DOM/common/preliminaries/Heap_Error_Monad.thy b/thys/Core_DOM/common/preliminaries/Heap_Error_Monad.thy
--- a/thys/Core_DOM/common/preliminaries/Heap_Error_Monad.thy
+++ b/thys/Core_DOM/common/preliminaries/Heap_Error_Monad.thy
@@ -1,930 +1,917 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>The Heap Error Monad\<close>
 text \<open>In this theory, we define a heap and error monad for modeling exceptions. 
 This allows us to define composite methods similar to stateful programming in Haskell, 
 but also to stay close to the official DOM specification.\<close>
 theory 
   Heap_Error_Monad
   imports
     Hiding_Type_Variables
     "HOL-Library.Monad_Syntax"
 begin
 
 subsection \<open>The Program Data Type\<close>
 
 datatype ('heap, 'e, 'result) prog = Prog (the_prog: "'heap \<Rightarrow> 'e + 'result \<times> 'heap")
 register_default_tvars "('heap, 'e, 'result) prog" (print, parse)
 
 subsection \<open>Basic Functions\<close>
 
 definition 
   bind :: "(_, 'result) prog \<Rightarrow> ('result \<Rightarrow> (_, 'result2) prog) \<Rightarrow> (_, 'result2) prog"
   where
     "bind f g = Prog (\<lambda>h. (case (the_prog f) h of Inr (x, h') \<Rightarrow> (the_prog (g x)) h' 
                                                 | Inl exception \<Rightarrow> Inl exception))"
 
 adhoc_overloading Monad_Syntax.bind bind
 
 definition 
   execute :: "'heap \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> ('e + 'result \<times> 'heap)" 
   ("((_)/ \<turnstile> (_))" [51, 52] 55)
   where
     "execute h p = (the_prog p) h"
 
 definition 
   returns_result :: "'heap \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> 'result \<Rightarrow> bool" 
   ("((_)/ \<turnstile> (_)/ \<rightarrow>\<^sub>r (_))" [60, 35, 61] 65)
   where
     "returns_result h p r \<longleftrightarrow> (case h \<turnstile> p of Inr (r', _) \<Rightarrow> r = r' | Inl _ \<Rightarrow> False)"
 
 fun select_result ("|(_)|\<^sub>r")
   where
     "select_result (Inr (r, _)) = r"
   | "select_result (Inl _) = undefined"
 
 lemma returns_result_eq [elim]: "h \<turnstile> f \<rightarrow>\<^sub>r y \<Longrightarrow> h \<turnstile> f \<rightarrow>\<^sub>r y' \<Longrightarrow> y = y'"
   by(auto simp add: returns_result_def split: sum.splits)
 
 definition 
   returns_heap :: "'heap \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> 'heap \<Rightarrow> bool" 
   ("((_)/ \<turnstile> (_)/ \<rightarrow>\<^sub>h (_))" [60, 35, 61] 65)
   where
     "returns_heap h p h' \<longleftrightarrow> (case h \<turnstile> p of Inr (_ , h'') \<Rightarrow> h' = h'' | Inl _ \<Rightarrow> False)"
 
 fun select_heap ("|(_)|\<^sub>h")
   where
     "select_heap (Inr ( _, h)) = h"
   | "select_heap (Inl _) = undefined"
 
 lemma returns_heap_eq [elim]: "h \<turnstile> f \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> f \<rightarrow>\<^sub>h h'' \<Longrightarrow> h' = h''"
   by(auto simp add: returns_heap_def split: sum.splits)
 
 definition 
   returns_result_heap :: "'heap \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> 'result \<Rightarrow> 'heap \<Rightarrow> bool" 
   ("((_)/ \<turnstile> (_)/ \<rightarrow>\<^sub>r (_) \<rightarrow>\<^sub>h (_))" [60, 35, 61, 62] 65)
   where
     "returns_result_heap h p r h' \<longleftrightarrow> h \<turnstile> p \<rightarrow>\<^sub>r r \<and> h \<turnstile> p \<rightarrow>\<^sub>h h'"
 
-lemma return_result_heap_code [code]: "returns_result_heap h p r h' \<longleftrightarrow> (case h \<turnstile> p of Inr (r', h'') \<Rightarrow> r = r' \<and> h' = h'' | Inl _ \<Rightarrow> False)" 
+lemma return_result_heap_code [code]:
+  "returns_result_heap h p r h' \<longleftrightarrow> (case h \<turnstile> p of Inr (r', h'') \<Rightarrow> r = r' \<and> h' = h'' | Inl _ \<Rightarrow> False)"
   by(auto simp add: returns_result_heap_def returns_result_def returns_heap_def split: sum.splits)
 
 fun select_result_heap ("|(_)|\<^sub>r\<^sub>h")
   where
     "select_result_heap (Inr (r, h)) = (r, h)"
   | "select_result_heap (Inl _) = undefined"
 
 definition 
   returns_error :: "'heap \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> 'e \<Rightarrow> bool" 
   ("((_)/ \<turnstile> (_)/ \<rightarrow>\<^sub>e (_))" [60, 35, 61] 65)
   where
     "returns_error h p e = (case h \<turnstile> p of Inr _ \<Rightarrow> False | Inl e' \<Rightarrow> e = e')"
 
 definition is_OK :: "'heap \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> bool" ("((_)/ \<turnstile> ok (_))" [75, 75])
   where
     "is_OK h p = (case h \<turnstile> p of Inr _ \<Rightarrow> True | Inl _ \<Rightarrow> False)"
 
 lemma is_OK_returns_result_I [intro]: "h \<turnstile> f \<rightarrow>\<^sub>r y \<Longrightarrow> h \<turnstile> ok f"
   by(auto simp add: is_OK_def returns_result_def split: sum.splits)
 
 lemma is_OK_returns_result_E [elim]:
   assumes "h \<turnstile> ok f"
   obtains x where "h \<turnstile> f \<rightarrow>\<^sub>r x"
   using assms by(auto simp add: is_OK_def returns_result_def split: sum.splits)
 
 lemma is_OK_returns_heap_I [intro]: "h \<turnstile> f \<rightarrow>\<^sub>h h' \<Longrightarrow> h \<turnstile> ok f"
   by(auto simp add: is_OK_def returns_heap_def split: sum.splits)
 
 lemma is_OK_returns_heap_E [elim]:
   assumes "h \<turnstile> ok f"
   obtains h' where "h \<turnstile> f \<rightarrow>\<^sub>h h'"
   using assms by(auto simp add: is_OK_def returns_heap_def split: sum.splits)
 
 lemma select_result_I:
   assumes "h \<turnstile> ok f"
     and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> P x"
   shows "P |h \<turnstile> f|\<^sub>r"
   using assms
   by(auto simp add: is_OK_def returns_result_def split: sum.splits)
 
 lemma select_result_I2 [simp]:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>r x"
   shows "|h \<turnstile> f|\<^sub>r = x"
   using assms
   by(auto simp add: is_OK_def returns_result_def split: sum.splits)
 
 lemma returns_result_select_result [simp]:
   assumes "h \<turnstile> ok f"
   shows "h \<turnstile> f \<rightarrow>\<^sub>r |h \<turnstile> f|\<^sub>r"
   using assms
   by (simp add: select_result_I)
 
 lemma select_result_E:
   assumes "P |h \<turnstile> f|\<^sub>r" and "h \<turnstile> ok f" 
   obtains x where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "P x"
   using assms
   by(auto simp add: is_OK_def returns_result_def split: sum.splits)
 
 lemma select_result_eq: "(\<And>x .h \<turnstile> f \<rightarrow>\<^sub>r x = h' \<turnstile> f \<rightarrow>\<^sub>r x) \<Longrightarrow> |h \<turnstile> f|\<^sub>r = |h' \<turnstile> f|\<^sub>r"
   by (metis (no_types, lifting) is_OK_def old.sum.simps(6) select_result.elims 
       select_result_I select_result_I2)
 
 definition error :: "'e \<Rightarrow> ('heap, 'e, 'result) prog"
   where
     "error exception = Prog (\<lambda>h. Inl exception)"
 
 lemma error_bind [iff]: "(error e \<bind> g) = error e"
   unfolding error_def bind_def by auto
 
 lemma error_returns_result [simp]: "\<not> (h \<turnstile> error e \<rightarrow>\<^sub>r y)"
   unfolding returns_result_def error_def execute_def by auto
 
 lemma error_returns_heap [simp]: "\<not> (h \<turnstile> error e \<rightarrow>\<^sub>h h')"
   unfolding returns_heap_def error_def execute_def by auto
 
 lemma error_returns_error [simp]: "h \<turnstile> error e \<rightarrow>\<^sub>e e"
   unfolding returns_error_def error_def execute_def by auto
 
 definition return :: "'result \<Rightarrow> ('heap, 'e, 'result) prog"
   where
     "return result = Prog (\<lambda>h. Inr (result, h))"
 
 lemma return_ok [simp]: "h \<turnstile> ok (return x)"
   by(simp add: return_def is_OK_def execute_def)
 
 lemma return_bind [iff]: "(return x \<bind> g) = g x"
   unfolding return_def bind_def by auto
 
 lemma return_id [simp]: "f \<bind> return = f"
   by (induct f) (auto simp add: return_def bind_def split: sum.splits prod.splits)
 
 lemma return_returns_result [iff]: "(h \<turnstile> return x \<rightarrow>\<^sub>r y) = (x = y)"
   unfolding returns_result_def return_def execute_def by auto
 
 lemma return_returns_heap [iff]: "(h \<turnstile> return x \<rightarrow>\<^sub>h h') = (h = h')"
   unfolding returns_heap_def return_def execute_def by auto
 
 lemma return_returns_error [iff]: "\<not> h \<turnstile> return x \<rightarrow>\<^sub>e e"
   unfolding returns_error_def execute_def return_def by auto
 
 definition noop :: "('heap, 'e, unit) prog"
   where
     "noop = return ()"
 
 lemma noop_returns_heap [simp]: "h \<turnstile> noop \<rightarrow>\<^sub>h h' \<longleftrightarrow> h = h'"
   by(simp add: noop_def)
 
 definition get_heap :: "('heap, 'e, 'heap) prog"
   where
     "get_heap = Prog (\<lambda>h. h \<turnstile> return h)"
 
 lemma get_heap_ok [simp]: "h \<turnstile> ok (get_heap)"
   by (simp add: get_heap_def execute_def is_OK_def return_def)
 
 lemma get_heap_returns_result [simp]: "(h \<turnstile> get_heap \<bind> (\<lambda>h'. f h') \<rightarrow>\<^sub>r x) = (h \<turnstile> f h \<rightarrow>\<^sub>r x)"
   by(simp add: get_heap_def returns_result_def bind_def return_def execute_def)
 
 lemma get_heap_returns_heap [simp]: "(h \<turnstile> get_heap \<bind> (\<lambda>h'. f h') \<rightarrow>\<^sub>h h'') = (h \<turnstile> f h \<rightarrow>\<^sub>h h'')"
   by(simp add: get_heap_def returns_heap_def bind_def return_def execute_def)
 
 lemma get_heap_is_OK [simp]: "(h \<turnstile> ok (get_heap \<bind> (\<lambda>h'. f h'))) = (h \<turnstile> ok (f h))"
   by(auto simp add: get_heap_def is_OK_def bind_def return_def execute_def)
 
 lemma get_heap_E [elim]: "(h \<turnstile> get_heap \<rightarrow>\<^sub>r x) \<Longrightarrow> x = h"
   by(simp add: get_heap_def returns_result_def return_def execute_def)
 
 definition return_heap :: "'heap \<Rightarrow> ('heap, 'e, unit) prog"
   where
     "return_heap h = Prog (\<lambda>_. h \<turnstile> return ())"
 
 lemma return_heap_E [iff]: "(h \<turnstile> return_heap h' \<rightarrow>\<^sub>h h'') = (h'' = h')"
   by(simp add: return_heap_def returns_heap_def return_def execute_def)
 
 lemma return_heap_returns_result [simp]: "h \<turnstile> return_heap h' \<rightarrow>\<^sub>r ()"
   by(simp add: return_heap_def execute_def returns_result_def return_def)
 
 
 subsection \<open>Pure Heaps\<close>
 
 definition pure :: "('heap, 'e, 'result) prog \<Rightarrow> 'heap \<Rightarrow> bool"
   where "pure f h \<longleftrightarrow> h \<turnstile> ok f \<longrightarrow> h \<turnstile> f \<rightarrow>\<^sub>h h"
 
 lemma return_pure [simp]: "pure (return x) h"
   by(simp add: pure_def return_def is_OK_def returns_heap_def execute_def)
 
 lemma error_pure [simp]: "pure (error e) h"
   by(simp add: pure_def error_def is_OK_def returns_heap_def execute_def)
 
 lemma noop_pure [simp]: "pure (noop) h"
   by (simp add: noop_def)
 
 lemma get_pure [simp]: "pure get_heap h"
   by(simp add: pure_def get_heap_def is_OK_def returns_heap_def return_def execute_def)
 
 lemma pure_returns_heap_eq:
   "h \<turnstile> f \<rightarrow>\<^sub>h h' \<Longrightarrow> pure f h \<Longrightarrow> h = h'"
   by (meson pure_def is_OK_returns_heap_I returns_heap_eq)
 
 lemma pure_eq_iff:     
   "(\<forall>h' x. h \<turnstile> f \<rightarrow>\<^sub>r x \<longrightarrow> h \<turnstile> f \<rightarrow>\<^sub>h h' \<longrightarrow> h = h') \<longleftrightarrow> pure f h"
   by(auto simp add: pure_def)
 
 subsection \<open>Bind\<close>
 
 lemma bind_assoc [simp]:
   "((bind f g) \<bind> h) = (f \<bind> (\<lambda>x. (g x \<bind> h)))"
   by(auto simp add: bind_def split: sum.splits)
 
 lemma bind_returns_result_E:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y"
   obtains x h' where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> g x \<rightarrow>\<^sub>r y"
   using assms by(auto simp add: bind_def returns_result_def returns_heap_def execute_def 
       split: sum.splits)
 
 lemma bind_returns_result_E2:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y" and "pure f h"
   obtains x where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> g x \<rightarrow>\<^sub>r y"
   using assms pure_returns_heap_eq bind_returns_result_E by metis
 
 lemma bind_returns_result_E3:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y" and "h \<turnstile> f \<rightarrow>\<^sub>r x" and "pure f h"
   shows "h \<turnstile> g x \<rightarrow>\<^sub>r y"
   using assms returns_result_eq bind_returns_result_E2 by metis
 
 lemma bind_returns_result_E4:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y" and "h \<turnstile> f \<rightarrow>\<^sub>r x" 
   obtains h' where "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> g x \<rightarrow>\<^sub>r y"
   using assms returns_result_eq bind_returns_result_E by metis
 
 lemma bind_returns_heap_E:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>h h''"
   obtains x h' where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> g x \<rightarrow>\<^sub>h h''"
   using assms by(auto simp add: bind_def returns_result_def returns_heap_def execute_def 
       split: sum.splits)
 
 lemma bind_returns_heap_E2 [elim]:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>h h'" and "pure f h"
   obtains x where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> g x \<rightarrow>\<^sub>h h'"
   using assms pure_returns_heap_eq by (fastforce elim: bind_returns_heap_E)
 
 lemma bind_returns_heap_E3 [elim]:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>h h'" and "h \<turnstile> f \<rightarrow>\<^sub>r x" and "pure f h" 
   shows "h \<turnstile> g x \<rightarrow>\<^sub>h h'"
   using assms pure_returns_heap_eq returns_result_eq by (fastforce elim: bind_returns_heap_E)
 
 lemma bind_returns_heap_E4:
   assumes "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>h h''" and "h \<turnstile> f \<rightarrow>\<^sub>h h'"
   obtains x where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h' \<turnstile> g x \<rightarrow>\<^sub>h h''"
   using assms
   by (metis bind_returns_heap_E returns_heap_eq)
 
 lemma bind_returns_error_I [intro]:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>e e"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>e e"
   using assms
   by(auto simp add: returns_error_def bind_def execute_def split: sum.splits)
 
 lemma bind_returns_error_I3:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> g x \<rightarrow>\<^sub>e e"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>e e"
   using assms
   by(auto simp add: returns_error_def bind_def execute_def returns_heap_def returns_result_def 
       split: sum.splits)
 
 lemma bind_returns_error_I2 [intro]:
   assumes "pure f h" and "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> g x \<rightarrow>\<^sub>e e"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>e e"
   using assms
   by (meson bind_returns_error_I3 is_OK_returns_result_I pure_def)
 
 lemma bind_is_OK_E [elim]:
   assumes "h \<turnstile> ok (f \<bind> g)"
   obtains x h' where "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> ok (g x)"
   using assms 
   by(auto simp add: bind_def returns_result_def returns_heap_def is_OK_def execute_def 
       split: sum.splits)
 
 lemma bind_is_OK_E2:
   assumes "h \<turnstile> ok (f \<bind> g)" and "h \<turnstile> f \<rightarrow>\<^sub>r x"
   obtains h' where "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> ok (g x)"
   using assms 
   by(auto simp add: bind_def returns_result_def returns_heap_def is_OK_def execute_def 
       split: sum.splits)
 
 lemma bind_returns_result_I [intro]:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> g x \<rightarrow>\<^sub>r y"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y"
   using assms 
   by(auto simp add: bind_def returns_result_def returns_heap_def execute_def 
       split: sum.splits)
 
 lemma bind_pure_returns_result_I [intro]:
   assumes "pure f h" and "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> g x \<rightarrow>\<^sub>r y"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y"
   using assms
   by (meson bind_returns_result_I pure_def is_OK_returns_result_I)
 
 lemma bind_pure_returns_result_I2 [intro]:
   assumes "pure f h" and "h \<turnstile> ok f" and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> h \<turnstile> g x \<rightarrow>\<^sub>r y"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y"
   using assms by auto
 
 lemma bind_returns_heap_I [intro]:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> g x \<rightarrow>\<^sub>h h''"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>h h''"
   using assms 
   by(auto simp add: bind_def returns_result_def returns_heap_def execute_def 
       split: sum.splits)
 
 lemma bind_returns_heap_I2 [intro]:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> h' \<turnstile> g x \<rightarrow>\<^sub>h h''"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>h h''"
   using assms
   by (meson bind_returns_heap_I is_OK_returns_heap_I is_OK_returns_result_E)
 
 lemma bind_is_OK_I [intro]:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'" and "h' \<turnstile> ok (g x)"
   shows "h \<turnstile> ok (f \<bind> g)"
   by (meson assms(1) assms(2) assms(3) bind_returns_heap_I is_OK_returns_heap_E 
       is_OK_returns_heap_I)
 
 lemma bind_is_OK_I2 [intro]:
   assumes "h \<turnstile> ok f" and "\<And>x h'. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> h \<turnstile> f \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> ok (g x)"
   shows "h \<turnstile> ok (f \<bind> g)"
   using assms by blast  
 
 lemma bind_is_OK_pure_I [intro]:
   assumes "pure f h" and "h \<turnstile> ok f" and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> h \<turnstile> ok (g x)"
   shows "h \<turnstile> ok (f \<bind> g)"
   using assms by blast
 
 lemma bind_pure_I:
   assumes "pure f h" and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> pure (g x) h"
   shows "pure (f \<bind> g) h"
   using assms
   by (metis bind_returns_heap_E2 pure_def pure_returns_heap_eq is_OK_returns_heap_E)
 
 lemma pure_pure:
   assumes "h \<turnstile> ok f" and "pure f h"
   shows "h \<turnstile> f \<rightarrow>\<^sub>h h"
   using assms returns_heap_eq 
   unfolding pure_def
   by auto
 
 lemma bind_returns_error_eq: 
   assumes "h \<turnstile> f \<rightarrow>\<^sub>e e"
     and "h \<turnstile> g \<rightarrow>\<^sub>e e"
   shows "h \<turnstile> f = h \<turnstile> g"
   using assms 
   by(auto simp add: returns_error_def split: sum.splits)
 
 subsection \<open>Map\<close>
 
 fun map_M :: "('x \<Rightarrow> ('heap, 'e, 'result) prog) \<Rightarrow> 'x list \<Rightarrow> ('heap, 'e, 'result list) prog"
   where
     "map_M f [] = return []"
   | "map_M f (x#xs) = do {
       y \<leftarrow> f x;
       ys \<leftarrow> map_M f xs;
       return (y # ys)
     }"
 
 lemma map_M_ok_I [intro]: 
   "(\<And>x. x \<in> set xs \<Longrightarrow> h \<turnstile> ok (f x)) \<Longrightarrow> (\<And>x. x \<in> set xs \<Longrightarrow> pure (f x) h) \<Longrightarrow> h \<turnstile> ok (map_M f xs)"
   apply(induct xs)
   by (simp_all add: bind_is_OK_I2 bind_is_OK_pure_I)
 
 lemma map_M_pure_I : "\<And>h. (\<And>x. x \<in> set xs \<Longrightarrow> pure (f x) h) \<Longrightarrow> pure (map_M f xs) h"
   apply(induct xs)
    apply(simp)
   by(auto intro!: bind_pure_I)
 
 lemma map_M_pure_E :
   assumes "h \<turnstile> map_M g xs \<rightarrow>\<^sub>r ys" and "x \<in> set xs" and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (g x) h"
   obtains y where "h \<turnstile> g x \<rightarrow>\<^sub>r y" and "y \<in> set ys"
   apply(insert assms, induct xs arbitrary: ys)
    apply(simp)
   apply(auto elim!: bind_returns_result_E)[1]
   by (metis (full_types) pure_returns_heap_eq)
 
 lemma map_M_pure_E2:
   assumes "h \<turnstile> map_M g xs \<rightarrow>\<^sub>r ys" and "y \<in> set ys" and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (g x) h"
   obtains x where "h \<turnstile> g x \<rightarrow>\<^sub>r y" and "x \<in> set xs"
   apply(insert assms, induct xs arbitrary: ys)
    apply(simp)
   apply(auto elim!: bind_returns_result_E)[1]
   by (metis (full_types) pure_returns_heap_eq)
 
 
 subsection \<open>Forall\<close>
 
 fun forall_M :: "('y \<Rightarrow> ('heap, 'e, 'result) prog) \<Rightarrow> 'y list \<Rightarrow> ('heap, 'e, unit) prog"
   where
     "forall_M P [] = return ()"
   | "forall_M P (x # xs) = do {
       P x;
       forall_M P xs
     }"
-    (* 
-lemma forall_M_elim:
-  assumes "h \<turnstile> forall_M P xs \<rightarrow>\<^sub>r True" and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (P x) h"
-  shows "\<forall>x \<in> set xs. h \<turnstile> P x \<rightarrow>\<^sub>r True"
-  apply(insert assms, induct xs)
-   apply(simp)
-  apply(auto elim!: bind_returns_result_E)[1]
-  by (metis (full_types) pure_returns_heap_eq) *)
+    
 
 lemma pure_forall_M_I: "(\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h) \<Longrightarrow> pure (forall_M P xs) h"
   apply(induct xs)
   by(auto intro!: bind_pure_I)
-    (* 
-lemma forall_M_pure_I:
-  assumes "\<And>x. x \<in> set xs \<Longrightarrow> h \<turnstile> P x \<rightarrow>\<^sub>r True" and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (P x)h" 
-  shows "h \<turnstile> forall_M P xs \<rightarrow>\<^sub>r True"
-  apply(insert assms, induct xs)
-   apply(simp)
-  by(fastforce)
-
-lemma forall_M_pure_eq:
-  assumes "\<And>x. x \<in> set xs \<Longrightarrow> h \<turnstile> P x \<rightarrow>\<^sub>r True \<longleftrightarrow> h' \<turnstile> P x \<rightarrow>\<^sub>r True" 
-      and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (P x) h"
-  shows "(h \<turnstile> forall_M P xs \<rightarrow>\<^sub>r True) \<longleftrightarrow> h' \<turnstile> forall_M P xs \<rightarrow>\<^sub>r True"
-  using assms
-  by(auto intro!: forall_M_pure_I dest!: forall_M_elim) *)
+   
 
 subsection \<open>Fold\<close>
 
 fun fold_M :: "('result \<Rightarrow> 'y \<Rightarrow> ('heap, 'e, 'result) prog) \<Rightarrow> 'result \<Rightarrow> 'y list
   \<Rightarrow> ('heap, 'e, 'result) prog"
   where 
     "fold_M f d [] = return d" |
     "fold_M f d (x # xs) = do { y \<leftarrow> f d x; fold_M f y xs }"
 
 lemma fold_M_pure_I : "(\<And>d x. pure (f d x) h) \<Longrightarrow> (\<And>d. pure (fold_M f d xs) h)"
   apply(induct xs)
   by(auto intro: bind_pure_I)
 
 subsection \<open>Filter\<close>
 
 fun filter_M :: "('x \<Rightarrow> ('heap, 'e, bool) prog) \<Rightarrow> 'x list \<Rightarrow> ('heap, 'e, 'x list) prog"
   where
     "filter_M P [] = return []"
   | "filter_M P (x#xs) = do {
       p \<leftarrow> P x;
       ys \<leftarrow> filter_M P xs;
       return (if p then x # ys else ys)
     }"
 
 lemma filter_M_pure_I [intro]: "(\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h) \<Longrightarrow> pure (filter_M P xs)h"
   apply(induct xs) 
   by(auto intro!: bind_pure_I)
 
-lemma filter_M_is_OK_I [intro]: "(\<And>x. x \<in> set xs \<Longrightarrow> h \<turnstile> ok (P x)) \<Longrightarrow> (\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h) \<Longrightarrow> h \<turnstile> ok (filter_M P xs)"
+lemma filter_M_is_OK_I [intro]:
+  "(\<And>x. x \<in> set xs \<Longrightarrow> h \<turnstile> ok (P x)) \<Longrightarrow> (\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h) \<Longrightarrow> h \<turnstile> ok (filter_M P xs)"
   apply(induct xs)
    apply(simp)
   by(auto intro!: bind_is_OK_pure_I)
 
 lemma filter_M_not_more_elements:
   assumes "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys" and "\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h" and "x \<in> set ys"
   shows "x \<in> set xs"
   apply(insert assms, induct xs arbitrary: ys)
   by(auto elim!: bind_returns_result_E2 split: if_splits intro!: set_ConsD)
 
 lemma filter_M_in_result_if_ok:
-  assumes "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys" and "\<And>h x. x \<in> set xs \<Longrightarrow> pure (P x) h" and "x \<in> set xs" and "h \<turnstile> P x \<rightarrow>\<^sub>r True"
+  assumes "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys" and "\<And>h x. x \<in> set xs \<Longrightarrow> pure (P x) h" and "x \<in> set xs" and
+    "h \<turnstile> P x \<rightarrow>\<^sub>r True"
   shows "x \<in> set ys"
   apply(insert assms, induct xs arbitrary: ys)
    apply(simp)
   apply(auto elim!: bind_returns_result_E2)[1]
   by (metis returns_result_eq)
 
 lemma filter_M_holds_for_result:
   assumes "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys" and "x \<in> set ys" and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (P x) h"
   shows "h \<turnstile> P x \<rightarrow>\<^sub>r True"
   apply(insert assms, induct xs arbitrary: ys)
   by(auto elim!: bind_returns_result_E2 split: if_splits intro!: set_ConsD)
 
 lemma filter_M_empty_I:
   assumes "\<And>x. pure (P x) h"
     and "\<forall>x \<in> set xs. h \<turnstile> P x \<rightarrow>\<^sub>r False"
   shows "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r []"
   using assms
   apply(induct xs)
   by(auto intro!: bind_pure_returns_result_I)
 
 lemma filter_M_subset_2: "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys \<Longrightarrow> h' \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys' 
                           \<Longrightarrow> (\<And>x. pure (P x) h) \<Longrightarrow> (\<And>x. pure (P x) h') 
                           \<Longrightarrow> (\<forall>b. \<forall>x \<in> set xs. h \<turnstile> P x \<rightarrow>\<^sub>r True \<longrightarrow> h' \<turnstile> P x \<rightarrow>\<^sub>r b \<longrightarrow> b) 
                           \<Longrightarrow> set ys \<subseteq> set ys'"
 proof -
   assume 1: "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys" and 2: "h' \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys'" 
     and 3: "(\<And>x. pure (P x) h)" and "(\<And>x. pure (P x) h')" 
     and 4: "\<forall>b. \<forall>x\<in>set xs. h \<turnstile> P x \<rightarrow>\<^sub>r True \<longrightarrow> h' \<turnstile> P x \<rightarrow>\<^sub>r b \<longrightarrow> b"
   have h1: "\<forall>x \<in> set xs. h' \<turnstile> ok (P x)"
     using 2 3 \<open>(\<And>x. pure (P x) h')\<close>
     apply(induct xs arbitrary: ys')
     by(auto elim!: bind_returns_result_E2)
   then have 5: "\<forall>x\<in>set xs. h \<turnstile> P x \<rightarrow>\<^sub>r True \<longrightarrow> h' \<turnstile> P x \<rightarrow>\<^sub>r True"
     using 4
     apply(auto)[1]
     by (metis is_OK_returns_result_E)
   show ?thesis
     using 1 2 3 5 \<open>(\<And>x. pure (P x) h')\<close>
     apply(induct xs arbitrary: ys ys')
      apply(auto)[1]
     apply(auto elim!: bind_returns_result_E2 split: if_splits)[1]
           apply auto[1]
          apply auto[1]
         apply(metis returns_result_eq)
        apply auto[1]
       apply auto[1]
      apply auto[1]
     by(auto)
 qed
 
 lemma filter_M_subset: "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys \<Longrightarrow> set ys \<subseteq> set xs"
   apply(induct xs arbitrary: h ys)
    apply(auto)[1]
   apply(auto elim!: bind_returns_result_E split: if_splits)[1]
    apply blast
   by blast
 
 lemma filter_M_distinct: "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys \<Longrightarrow> distinct xs \<Longrightarrow> distinct ys"
   apply(induct xs arbitrary: h ys)
    apply(auto)[1]
   using filter_M_subset
   apply(auto elim!: bind_returns_result_E)[1]
   by fastforce
 
 lemma filter_M_filter: "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys \<Longrightarrow> (\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h) 
                        \<Longrightarrow> (\<forall>x \<in> set xs. h \<turnstile> ok P x) \<and> ys = filter (\<lambda>x. |h \<turnstile> P x|\<^sub>r) xs"
   apply(induct xs arbitrary: ys)
   by(auto elim!: bind_returns_result_E2)
 
 lemma filter_M_filter2: "(\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h \<and>  h \<turnstile> ok P x) 
                        \<Longrightarrow> filter (\<lambda>x. |h \<turnstile> P x|\<^sub>r) xs = ys \<Longrightarrow> h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys"
   apply(induct xs arbitrary: ys)
   by(auto elim!: bind_returns_result_E2 intro!: bind_pure_returns_result_I)
 
 lemma filter_ex1: "\<exists>!x \<in> set xs. P x \<Longrightarrow> P x \<Longrightarrow> x \<in> set xs \<Longrightarrow> distinct xs 
                   \<Longrightarrow> filter P xs = [x]"
   apply(auto)[1]
   apply(induct xs)
    apply(auto)[1]
   apply(auto)[1]
   using filter_empty_conv by fastforce
 
 lemma filter_M_ex1:
   assumes "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys"
     and "x \<in> set xs"
     and "\<exists>!x \<in> set xs. h \<turnstile> P x \<rightarrow>\<^sub>r True"
     and "\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h"
     and "distinct xs"
     and "h \<turnstile> P x \<rightarrow>\<^sub>r True"
   shows "ys = [x]"
 proof -
   have *: "\<exists>!x \<in> set xs. |h \<turnstile> P x|\<^sub>r"
     apply(insert assms(1) assms(3) assms(4))
     apply(drule filter_M_filter) 
      apply(simp)
     apply(auto simp add: select_result_I2)[1]
     by (metis (full_types) is_OK_returns_result_E select_result_I2)
   then show ?thesis
     apply(insert assms(1) assms(4))
     apply(drule filter_M_filter)
      apply(auto)[1] 
     by (metis * assms(2) assms(5) assms(6) distinct_filter 
         distinct_length_2_or_more filter_empty_conv filter_set list.exhaust 
         list.set_intros(1) list.set_intros(2) member_filter select_result_I2)
 qed
 
 lemma filter_M_eq:
   assumes "\<And>x. pure (P x) h" and "\<And>x. pure (P x) h'"
     and "\<And>b x. x \<in> set xs \<Longrightarrow> h \<turnstile> P x \<rightarrow>\<^sub>r b = h' \<turnstile> P x \<rightarrow>\<^sub>r b"
   shows "h \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys \<longleftrightarrow> h' \<turnstile> filter_M P xs \<rightarrow>\<^sub>r ys"
   using assms
   apply (induct xs arbitrary: ys)
   by(auto elim!: bind_returns_result_E2 intro!: bind_pure_returns_result_I 
       dest: returns_result_eq)
 
 
 subsection \<open>Map Filter\<close>
 
 definition map_filter_M :: "('x \<Rightarrow> ('heap, 'e, 'y option) prog) \<Rightarrow> 'x list
   \<Rightarrow> ('heap, 'e, 'y list) prog"
   where
     "map_filter_M f xs = do {
       ys_opts \<leftarrow> map_M f xs;
       ys_no_opts \<leftarrow> filter_M (\<lambda>x. return (x \<noteq> None)) ys_opts;
       map_M (\<lambda>x. return (the x)) ys_no_opts
     }"
 
 lemma map_filter_M_pure: "(\<And>x h. x \<in> set xs \<Longrightarrow> pure (f x) h) \<Longrightarrow> pure (map_filter_M f xs) h"
   by(auto simp add: map_filter_M_def map_M_pure_I intro!: bind_pure_I)
 
 lemma map_filter_M_pure_E:
   assumes "h \<turnstile> (map_filter_M::('x \<Rightarrow> ('heap, 'e, 'y option) prog) \<Rightarrow> 'x list
   \<Rightarrow> ('heap, 'e, 'y list) prog) f xs \<rightarrow>\<^sub>r ys" and "y \<in> set ys" and "\<And>x h. x \<in> set xs \<Longrightarrow> pure (f x) h"
   obtains x where "h \<turnstile> f x \<rightarrow>\<^sub>r Some y" and "x \<in> set xs"
 proof -
   obtain ys_opts ys_no_opts where
     ys_opts: "h \<turnstile> map_M f xs \<rightarrow>\<^sub>r ys_opts" and
     ys_no_opts: "h \<turnstile> filter_M (\<lambda>x. (return (x \<noteq> None)::('heap, 'e, bool) prog)) ys_opts \<rightarrow>\<^sub>r ys_no_opts" and
     ys: "h \<turnstile> map_M (\<lambda>x. (return (the x)::('heap, 'e, 'y) prog)) ys_no_opts \<rightarrow>\<^sub>r ys"
     using assms
     by(auto simp add: map_filter_M_def map_M_pure_I elim!: bind_returns_result_E2)
   have "\<forall>y \<in> set ys_no_opts. y \<noteq> None"
     using ys_no_opts filter_M_holds_for_result
     by fastforce
   then have "Some y \<in> set ys_no_opts"
     using map_M_pure_E2 ys \<open>y \<in> set ys\<close>
     by (metis (no_types, lifting) option.collapse return_pure return_returns_result)
   then have "Some y \<in> set ys_opts"
     using filter_M_subset ys_no_opts by fastforce
   then show "(\<And>x. h \<turnstile> f x \<rightarrow>\<^sub>r Some y \<Longrightarrow> x \<in> set xs \<Longrightarrow> thesis) \<Longrightarrow> thesis"
     by (metis assms(3) map_M_pure_E2 ys_opts)
 qed
 
 
 subsection \<open>Iterate\<close>
 
 fun iterate_M :: "('heap, 'e, 'result) prog list \<Rightarrow> ('heap, 'e, 'result) prog"
   where
     "iterate_M [] = return undefined"
   | "iterate_M (x # xs) = x \<bind> (\<lambda>_. iterate_M xs)"
 
 
 lemma iterate_M_concat:
   assumes "h \<turnstile> iterate_M xs \<rightarrow>\<^sub>h h'"
     and "h' \<turnstile> iterate_M ys \<rightarrow>\<^sub>h h''"
   shows "h \<turnstile> iterate_M (xs @ ys) \<rightarrow>\<^sub>h h''"
   using assms
   apply(induct "xs" arbitrary: h h'')
    apply(simp)
   apply(auto)[1]
   by (meson bind_returns_heap_E bind_returns_heap_I)
 
 subsection\<open>Miscellaneous Rules\<close>
 
 lemma execute_bind_simp:
   assumes "h \<turnstile> f \<rightarrow>\<^sub>r x" and "h \<turnstile> f \<rightarrow>\<^sub>h h'"
   shows "h \<turnstile> f \<bind> g = h' \<turnstile> g x"
   using assms 
   by(auto simp add: returns_result_def returns_heap_def bind_def execute_def  
       split: sum.splits)
 
 lemma bind_cong [fundef_cong]:
   fixes f1 f2 :: "('heap, 'e, 'result) prog"
     and g1 g2 :: "'result \<Rightarrow> ('heap, 'e, 'result2) prog"
   assumes "h \<turnstile> f1 = h \<turnstile> f2"
     and "\<And>y h'. h \<turnstile> f1 \<rightarrow>\<^sub>r y \<Longrightarrow> h \<turnstile> f1 \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> g1 y = h' \<turnstile> g2 y"
   shows "h \<turnstile> (f1 \<bind> g1) = h \<turnstile> (f2 \<bind> g2)"
   apply(insert assms, cases "h \<turnstile> f1") 
   by(auto simp add: bind_def returns_result_def returns_heap_def execute_def 
       split: sum.splits)
 
 lemma bind_cong_2:
   assumes "pure f h" and "pure f h'"
     and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x = h' \<turnstile> f \<rightarrow>\<^sub>r x"
     and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> h \<turnstile> g x \<rightarrow>\<^sub>r y = h' \<turnstile> g x \<rightarrow>\<^sub>r y'"
   shows "h \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y = h' \<turnstile> f \<bind> g \<rightarrow>\<^sub>r y'"
   using assms
   by(auto intro!: bind_pure_returns_result_I elim!: bind_returns_result_E2)
 
 lemma bind_case_cong [fundef_cong]:
   assumes "x = x'" and "\<And>a. x = Some a \<Longrightarrow> f a h = f' a h"
   shows "(case x of Some a \<Rightarrow> f a | None \<Rightarrow> g) h = (case x' of Some a \<Rightarrow> f' a | None \<Rightarrow> g) h"
   by (insert assms, simp add: option.case_eq_if)
 
 
 subsection \<open>Reasoning About Reads and Writes\<close>
 
 definition preserved :: "('heap, 'e, 'result) prog \<Rightarrow> 'heap \<Rightarrow> 'heap \<Rightarrow> bool"
   where
     "preserved f h h' \<longleftrightarrow> (\<forall>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<longleftrightarrow> h' \<turnstile> f \<rightarrow>\<^sub>r x)"
 
-lemma preserved_code [code]: "preserved f h h' = (((h \<turnstile> ok f) \<and> (h' \<turnstile> ok f) \<and> |h \<turnstile> f|\<^sub>r = |h' \<turnstile> f|\<^sub>r) \<or> ((\<not>h \<turnstile> ok f) \<and> (\<not>h' \<turnstile> ok f)))"
+lemma preserved_code [code]:
+  "preserved f h h' = (((h \<turnstile> ok f) \<and> (h' \<turnstile> ok f) \<and> |h \<turnstile> f|\<^sub>r = |h' \<turnstile> f|\<^sub>r) \<or> ((\<not>h \<turnstile> ok f) \<and> (\<not>h' \<turnstile> ok f)))"
   apply(auto simp add: preserved_def)[1]
    apply (meson is_OK_returns_result_E is_OK_returns_result_I)+
   done
 
 lemma reflp_preserved_f [simp]: "reflp (preserved f)"
   by(auto simp add: preserved_def reflp_def)
 lemma transp_preserved_f [simp]: "transp (preserved f)"
   by(auto simp add: preserved_def transp_def)
 
 
 definition 
   all_args :: "('a \<Rightarrow> ('heap, 'e, 'result) prog) \<Rightarrow> ('heap, 'e, 'result) prog set"
   where
     "all_args f = (\<Union>arg. {f arg})"
 
 
 definition  
   reads :: "('heap \<Rightarrow> 'heap \<Rightarrow> bool) set \<Rightarrow> ('heap, 'e, 'result) prog \<Rightarrow> 'heap 
             \<Rightarrow> 'heap \<Rightarrow> bool"
   where
     "reads S getter h h' \<longleftrightarrow> (\<forall>P \<in> S. reflp P \<and> transp P) \<and> ((\<forall>P \<in> S. P h h') 
                               \<longrightarrow> preserved getter h h')"
 
 lemma reads_singleton [simp]: "reads {preserved f} f h h'"
   by(auto simp add: reads_def)
 
 lemma reads_bind_pure:
   assumes "pure f h" and "pure f h'"
     and "reads S f h h'"
     and "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> reads S (g x) h h'"
   shows "reads S (f \<bind> g) h h'"
   using assms
   by(auto simp add: reads_def pure_pure preserved_def 
       intro!: bind_pure_returns_result_I is_OK_returns_result_I 
       dest: pure_returns_heap_eq 
       elim!: bind_returns_result_E)
 
-lemma reads_insert_writes_set_left: "\<forall>P \<in> S. reflp P \<and> transp P \<Longrightarrow> reads {getter} f h h' \<Longrightarrow> reads (insert getter S) f h h'"
+lemma reads_insert_writes_set_left:
+  "\<forall>P \<in> S. reflp P \<and> transp P \<Longrightarrow> reads {getter} f h h' \<Longrightarrow> reads (insert getter S) f h h'"
   unfolding reads_def by simp
 
-lemma reads_insert_writes_set_right: "reflp getter \<Longrightarrow> transp getter \<Longrightarrow> reads S f h h' \<Longrightarrow> reads (insert getter S) f h h'"
+lemma reads_insert_writes_set_right:
+  "reflp getter \<Longrightarrow> transp getter \<Longrightarrow> reads S f h h' \<Longrightarrow> reads (insert getter S) f h h'"
   unfolding reads_def by blast
 
-lemma reads_subset: "reads S f h h' \<Longrightarrow> \<forall>P \<in> S' - S. reflp P \<and> transp P \<Longrightarrow> S \<subseteq> S' \<Longrightarrow> reads S' f h h'"
+lemma reads_subset:
+  "reads S f h h' \<Longrightarrow> \<forall>P \<in> S' - S. reflp P \<and> transp P \<Longrightarrow> S \<subseteq> S' \<Longrightarrow> reads S' f h h'"
   by(auto simp add: reads_def)
 
 lemma return_reads [simp]: "reads {} (return x) h h'"
   by(simp add: reads_def preserved_def)
 
 lemma error_reads [simp]: "reads {} (error e) h h'"
   by(simp add: reads_def preserved_def)
 
 lemma noop_reads [simp]: "reads {} noop h h'"
   by(simp add: reads_def noop_def preserved_def)
 
 lemma filter_M_reads:
   assumes "\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h" and "\<And>x. x \<in> set xs \<Longrightarrow> pure (P x) h'"
     and "\<And>x. x \<in> set xs \<Longrightarrow> reads S (P x) h h'"
     and "\<forall>P \<in> S. reflp P \<and> transp P"
   shows "reads S (filter_M P xs) h h'"
   using assms
   apply(induct xs)
   by(auto intro: reads_subset[OF return_reads] intro!: reads_bind_pure)
 
 definition writes :: 
   "('heap, 'e, 'result) prog set \<Rightarrow> ('heap, 'e, 'result2) prog \<Rightarrow> 'heap \<Rightarrow> 'heap \<Rightarrow> bool"
   where                                                                                
     "writes S setter h h' 
      \<longleftrightarrow> (h \<turnstile> setter \<rightarrow>\<^sub>h h' \<longrightarrow> (\<exists>progs. set progs \<subseteq> S \<and> h \<turnstile> iterate_M progs \<rightarrow>\<^sub>h h'))"
 
 lemma writes_singleton [simp]: "writes (all_args f) (f a) h h'"
   apply(auto simp add: writes_def all_args_def)[1]
   apply(rule exI[where x="[f a]"])
   by(auto)
 
 lemma writes_singleton2 [simp]: "writes {f} f h h'"
   apply(auto simp add: writes_def all_args_def)[1]
   apply(rule exI[where x="[f]"])
   by(auto)
 
 lemma writes_union_left_I:
   assumes "writes S f h h'"
   shows "writes (S \<union> S') f h h'"
   using assms
   by(auto simp add: writes_def)
 
 lemma writes_union_right_I:
   assumes "writes S' f h h'"
   shows "writes (S \<union> S') f h h'"
   using assms
   by(auto simp add: writes_def)
 
 lemma writes_union_minus_split:
   assumes "writes (S - S2) f h h'"
     and "writes (S' - S2) f h h'"
   shows "writes ((S \<union> S') - S2) f h h'"
   using assms
   by(auto simp add: writes_def)
 
 lemma writes_subset: "writes S f h h' \<Longrightarrow> S \<subseteq> S' \<Longrightarrow> writes S' f h h'"
   by(auto simp add: writes_def)
 
 lemma writes_error [simp]: "writes S (error e) h h'"
   by(simp add: writes_def)
 
 lemma writes_not_ok [simp]: "\<not>h \<turnstile> ok f \<Longrightarrow> writes S f h h'"
   by(auto simp add: writes_def)
 
 lemma writes_pure [simp]:
   assumes "pure f h"
   shows "writes S f h h'"
   using assms
   apply(auto simp add: writes_def)[1]
   by (metis bot.extremum iterate_M.simps(1) list.set(1) pure_returns_heap_eq return_returns_heap)
 
 lemma writes_bind:
   assumes "\<And>h2. writes S f h h2" 
   assumes "\<And>x h2. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> h \<turnstile> f \<rightarrow>\<^sub>h h2 \<Longrightarrow> writes S (g x) h2 h'"
   shows "writes S (f \<bind> g) h h'"
   using assms
   apply(auto simp add: writes_def elim!: bind_returns_heap_E)[1]
   by (metis iterate_M_concat le_supI set_append)
 
 lemma writes_bind_pure:
   assumes "pure f h"
   assumes "\<And>x. h \<turnstile> f \<rightarrow>\<^sub>r x \<Longrightarrow> writes S (g x) h h'"
   shows "writes S (f \<bind> g) h h'"
   using assms
   by(auto simp add: writes_def elim!: bind_returns_heap_E2)
 
 lemma writes_small_big:
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h' w. w \<in> SW \<Longrightarrow>  h \<turnstile> w \<rightarrow>\<^sub>h h' \<Longrightarrow> P h h'"
   assumes "reflp P"
   assumes "transp P"
   shows "P h h'"
 proof -
   obtain progs where "set progs \<subseteq> SW" and iterate: "h \<turnstile> iterate_M progs \<rightarrow>\<^sub>h h'"
     by (meson assms(1) assms(2) writes_def)
   then have "\<And>h h'. \<forall>prog \<in> set progs. h \<turnstile> prog \<rightarrow>\<^sub>h h' \<longrightarrow> P h h'"
     using assms(3) by auto
   with iterate assms(4) assms(5) have "h \<turnstile> iterate_M progs \<rightarrow>\<^sub>h h' \<Longrightarrow> P h h'"
   proof(induct progs arbitrary: h)
     case Nil
     then show ?case
       using reflpE by force
   next
     case (Cons a progs)
     then show ?case
       apply(auto elim!: bind_returns_heap_E)[1]
       by (metis (full_types) transpD)
   qed
   then show ?thesis
     using assms(1) iterate by blast
 qed
 
 lemma reads_writes_preserved:
   assumes "reads SR getter h h'"
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> SR. r h h')"
   shows "h \<turnstile> getter \<rightarrow>\<^sub>r x \<longleftrightarrow> h' \<turnstile> getter \<rightarrow>\<^sub>r x"
 proof -
   obtain progs where "set progs \<subseteq> SW" and iterate: "h \<turnstile> iterate_M progs \<rightarrow>\<^sub>h h'"
     by (meson assms(2) assms(3) writes_def)
   then have "\<And>h h'. \<forall>prog \<in> set progs. h \<turnstile> prog \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> SR. r h h')"
     using assms(4) by blast
   with iterate have "\<forall>r \<in> SR. r h h'"
     using writes_small_big assms(1) unfolding reads_def
     by (metis assms(2) assms(3) assms(4))
   then show ?thesis
     using assms(1)
     by (simp add: preserved_def reads_def)
 qed
 
 lemma reads_writes_separate_forwards:
   assumes "reads SR getter h h'"
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> getter \<rightarrow>\<^sub>r x"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> SR. r h h')"
   shows "h' \<turnstile> getter \<rightarrow>\<^sub>r x"
   using reads_writes_preserved[OF assms(1) assms(2) assms(3) assms(5)] assms(4)
   by(auto simp add: preserved_def)
 
 lemma reads_writes_separate_backwards:
   assumes "reads SR getter h h'"
   assumes "writes SW setter h h'"
   assumes "h \<turnstile> setter \<rightarrow>\<^sub>h h'"
   assumes "h' \<turnstile> getter \<rightarrow>\<^sub>r x"
   assumes "\<And>h h'. \<forall>w \<in> SW. h \<turnstile> w \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r \<in> SR. r h h')"
   shows "h \<turnstile> getter \<rightarrow>\<^sub>r x"
   using reads_writes_preserved[OF assms(1) assms(2) assms(3) assms(5)] assms(4)
   by(auto simp add: preserved_def)
 
 end
diff --git a/thys/Core_DOM/common/preliminaries/Testing_Utils.thy b/thys/Core_DOM/common/preliminaries/Testing_Utils.thy
--- a/thys/Core_DOM/common/preliminaries/Testing_Utils.thy
+++ b/thys/Core_DOM/common/preliminaries/Testing_Utils.thy
@@ -1,92 +1,94 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 theory Testing_Utils
   imports Main
 begin
 ML \<open>
 val _ = Theory.setup 
   (Method.setup @{binding timed_code_simp}
     (Scan.succeed (SIMPLE_METHOD' o (CHANGED_PROP oo (fn a => fn b => fn tac =>
       let 
         val start = Time.now ();
         val result = Code_Simp.dynamic_tac a b tac;
         val t = Time.now() - start;
       in
         (if length (Seq.list_of result) > 0 then Output.information ("Took " ^ (Time.toString t)) else ());
         result
       end))))
     "timed simplification with code equations");
 
 val _ = Theory.setup
   (Method.setup @{binding timed_eval}
     (Scan.succeed (SIMPLE_METHOD' o (fn a => fn b => fn tac =>
       let
         val eval = CONVERSION (Conv.params_conv ~1 (K (Conv.concl_conv ~1 (Code_Runtime.dynamic_holds_conv a))) a) THEN'
           resolve_tac a [TrueI];
         val start = Time.now ();
         val result = eval b tac
         val t = Time.now() - start;
       in
         (if length (Seq.list_of result) > 0 then Output.information ("Took " ^ (Time.toString t)) else ());
         result
       end)))
     "timed evaluation");
 
 val _ = Theory.setup
   (Method.setup @{binding timed_eval_and_code_simp}
     (Scan.succeed (SIMPLE_METHOD' o (fn a => fn b => fn tac =>
       let
         val eval = CONVERSION (Conv.params_conv ~1 (K (Conv.concl_conv ~1 (Code_Runtime.dynamic_holds_conv a))) a) THEN'
           resolve_tac a [TrueI];
         val start = Time.now ();
         val result = eval b tac
         val t = Time.now() - start;
 
         val start2 = Time.now ();
         val result2_opt =
           Timeout.apply (seconds 600.0) (fn _ => SOME (Code_Simp.dynamic_tac a b tac)) ()
           handle Timeout.TIMEOUT _ => NONE;
         val t2 = Time.now() - start2;
       in
-        if length (Seq.list_of result) > 0 then (Output.information ("eval took " ^ (Time.toString t)); File.append (Path.explode "/tmp/isabellebench") (Time.toString t ^ ",")) else ();
+        if length (Seq.list_of result) > 0 then (Output.information ("eval took " ^ (Time.toString t));
+File.append (Path.explode "/tmp/isabellebench") (Time.toString t ^ ",")) else ();
         (case result2_opt of
           SOME result2 => 
-            (if length (Seq.list_of result2) > 0 then (Output.information ("code_simp took " ^ (Time.toString t2));  File.append (Path.explode "/tmp/isabellebench") (Time.toString t2 ^ "\n")) else ())
+            (if length (Seq.list_of result2) > 0 then (Output.information ("code_simp took " ^ (Time.toString t2));
+File.append (Path.explode "/tmp/isabellebench") (Time.toString t2 ^ "\n")) else ())
         | NONE => (Output.information "code_simp timed out after 600s"; File.append (Path.explode "/tmp/isabellebench") (">600.000\n")));
         result
       end)))
     "timed evaluation and simplification with code equations with file output");
 \<close>
 
 (* To run the DOM test cases with timing information output, simply replace the use *)
 (* of "eval" with either "timed_code_simp", "timed_eval", or, to run both and write the results *)
 (* to /tmp/isabellebench, "timed_eval_and_code_simp". *)
 
 end
diff --git a/thys/Core_DOM/common/tests/Core_DOM_BaseTest.thy b/thys/Core_DOM/common/tests/Core_DOM_BaseTest.thy
--- a/thys/Core_DOM/common/tests/Core_DOM_BaseTest.thy
+++ b/thys/Core_DOM/common/tests/Core_DOM_BaseTest.thy
@@ -1,273 +1,284 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Common Test Setup\<close>
 text\<open>This theory provides the common test setup that is used by all formalized test cases.\<close>
 
 theory Core_DOM_BaseTest
   imports
   (*<*) 
   "../preliminaries/Testing_Utils"
   (*>*) 
   "../Core_DOM"
 begin
 
 definition "assert_throws e p = do {
   h \<leftarrow> get_heap;
   (if (h \<turnstile> p \<rightarrow>\<^sub>e e) then return () else error AssertException)
 }"
 notation assert_throws ("assert'_throws'(_, _')")
 
 definition "test p h \<longleftrightarrow> h \<turnstile> ok p"
 
 
 definition field_access :: "(string \<Rightarrow> (_, (_) object_ptr option) dom_prog) \<Rightarrow> string 
                                     \<Rightarrow> (_, (_) object_ptr option) dom_prog"  (infix "." 80)
   where
     "field_access m field = m field"
 
 definition assert_equals :: "'a \<Rightarrow> 'a \<Rightarrow> (_, unit) dom_prog"
   where
     "assert_equals l r = (if l = r then return () else error AssertException)"
 definition assert_equals_with_message :: "'a \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> (_, unit) dom_prog"
   where
     "assert_equals_with_message l r _ = (if l = r then return () else error AssertException)"
 notation assert_equals ("assert'_equals'(_, _')")
 notation assert_equals_with_message ("assert'_equals'(_, _, _')")
 notation assert_equals ("assert'_array'_equals'(_, _')")
 notation assert_equals_with_message ("assert'_array'_equals'(_, _, _')")
 
 definition assert_not_equals :: "'a \<Rightarrow> 'a \<Rightarrow> (_, unit) dom_prog"
   where
     "assert_not_equals l r = (if l \<noteq> r then return () else error AssertException)"
 definition assert_not_equals_with_message :: "'a \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> (_, unit) dom_prog"
   where
     "assert_not_equals_with_message l r _ = (if l \<noteq> r then return () else error AssertException)"
 notation assert_not_equals ("assert'_not'_equals'(_, _')")
 notation assert_not_equals_with_message ("assert'_not'_equals'(_, _, _')")
 notation assert_not_equals ("assert'_array'_not'_equals'(_, _')")
 notation assert_not_equals_with_message ("assert'_array'_not'_equals'(_, _, _')")
 
 definition removeWhiteSpaceOnlyTextNodes :: "((_) object_ptr option) \<Rightarrow> (_, unit) dom_prog"
   where
     "removeWhiteSpaceOnlyTextNodes _ = return ()"
 
 
 subsection \<open>Making the functions under test compatible with untyped languages such as JavaScript\<close>
 
 fun set_attribute_with_null :: "((_) object_ptr option) \<Rightarrow> attr_key \<Rightarrow> attr_value \<Rightarrow> (_, unit) dom_prog"
   where
     "set_attribute_with_null (Some ptr) k v = (case cast ptr of
       Some element_ptr \<Rightarrow> set_attribute element_ptr k (Some v))"
 fun set_attribute_with_null2 :: "((_) object_ptr option) \<Rightarrow> attr_key \<Rightarrow> attr_value option \<Rightarrow> (_, unit) dom_prog"
   where
     "set_attribute_with_null2 (Some ptr) k v = (case cast ptr of
       Some element_ptr \<Rightarrow> set_attribute element_ptr k v)"
 notation set_attribute_with_null ("_ . setAttribute'(_, _')")
 notation set_attribute_with_null2 ("_ . setAttribute'(_, _')")
 
 fun get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_with_null :: "((_) object_ptr option) \<Rightarrow> (_, (_) object_ptr option list) dom_prog"
   where
     "get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_with_null (Some ptr) = do {
       children \<leftarrow> get_child_nodes ptr;
       return (map (Some \<circ> cast) children)
     }"
 notation get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_with_null ("_ . childNodes")
 
 fun create_element_with_null :: "((_) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
   where
     "create_element_with_null (Some owner_document_obj) tag = (case cast owner_document_obj of
       Some owner_document \<Rightarrow> do {
         element_ptr \<leftarrow> create_element owner_document tag;
         return (Some (cast element_ptr))})"
 notation create_element_with_null ("_ . createElement'(_')")
 
 fun create_character_data_with_null :: "((_) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
   where
     "create_character_data_with_null (Some owner_document_obj) tag = (case cast owner_document_obj of
       Some owner_document \<Rightarrow> do {
         character_data_ptr \<leftarrow> create_character_data owner_document tag;
         return (Some (cast character_data_ptr))})"
 notation create_character_data_with_null ("_ . createTextNode'(_')")
 
 definition create_document_with_null :: "string \<Rightarrow> (_, ((_::linorder) object_ptr option)) dom_prog"
   where
     "create_document_with_null title = do {
       new_document_ptr \<leftarrow> create_document;
       html \<leftarrow> create_element new_document_ptr ''html'';
       append_child (cast new_document_ptr) (cast html);
       heap \<leftarrow> create_element new_document_ptr ''heap'';
       append_child (cast html) (cast heap);
       body \<leftarrow> create_element new_document_ptr ''body'';
       append_child (cast html) (cast body);
       return (Some (cast new_document_ptr))
     }"
 abbreviation "create_document_with_null2 _ _ _ \<equiv> create_document_with_null ''''"
 notation create_document_with_null ("createDocument'(_')")
 notation create_document_with_null2 ("createDocument'(_, _, _')")
 
 fun get_element_by_id_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
   where                                                                     
     "get_element_by_id_with_null (Some ptr) id' = do {
         element_ptr_opt \<leftarrow> get_element_by_id ptr id';
         (case element_ptr_opt of
           Some element_ptr \<Rightarrow> return (Some (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r element_ptr))
         | None \<Rightarrow> return None)}"
   | "get_element_by_id_with_null _ _ = error SegmentationFault"
 notation get_element_by_id_with_null ("_ . getElementById'(_')")
 
-fun get_elements_by_class_name_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option) list) dom_prog"
+fun get_elements_by_class_name_with_null ::
+"((_::linorder) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option) list) dom_prog"
   where                                                                     
     "get_elements_by_class_name_with_null (Some ptr) class_name =
       get_elements_by_class_name ptr class_name \<bind> map_M (return \<circ> Some \<circ> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)"
 notation get_elements_by_class_name_with_null ("_ . getElementsByClassName'(_')")
 
-fun get_elements_by_tag_name_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option) list) dom_prog"
+fun get_elements_by_tag_name_with_null ::
+"((_::linorder) object_ptr option) \<Rightarrow> string \<Rightarrow> (_, ((_) object_ptr option) list) dom_prog"
   where                                                                     
-    "get_elements_by_tag_name_with_null (Some ptr) tag_name =
-      get_elements_by_tag_name ptr tag_name \<bind> map_M (return \<circ> Some \<circ> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)"
+    "get_elements_by_tag_name_with_null (Some ptr) tag =
+      get_elements_by_tag_name ptr tag \<bind> map_M (return \<circ> Some \<circ> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)"
 notation get_elements_by_tag_name_with_null ("_ . getElementsByTagName'(_')")
 
-fun insert_before_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
+fun insert_before_with_null ::
+"((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow>
+(_, ((_) object_ptr option)) dom_prog"
   where
     "insert_before_with_null (Some ptr) (Some child_obj) ref_child_obj_opt = (case cast child_obj of
       Some child \<Rightarrow> do {
         (case ref_child_obj_opt of
           Some ref_child_obj \<Rightarrow> insert_before ptr child (cast ref_child_obj)
         | None \<Rightarrow> insert_before ptr child None);
         return (Some child_obj)}
     | None \<Rightarrow> error HierarchyRequestError)"
 notation insert_before_with_null ("_ . insertBefore'(_, _')")
 
-fun append_child_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> (_, unit) dom_prog"
+fun append_child_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow>
+(_, unit) dom_prog"
   where
     "append_child_with_null (Some ptr) (Some child_obj) = (case cast child_obj of
       Some child \<Rightarrow> append_child ptr child
     | None \<Rightarrow> error SegmentationFault)"
 notation append_child_with_null ("_ . appendChild'(_')")
 
 fun get_body :: "((_::linorder) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
   where
     "get_body ptr = do {
        ptrs \<leftarrow> ptr . getElementsByTagName(''body'');
        return (hd ptrs)
     }"
 notation get_body ("_ . body")
 
-fun get_document_element_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
+fun get_document_element_with_null :: "((_::linorder) object_ptr option) \<Rightarrow>
+(_, ((_) object_ptr option)) dom_prog"
   where
     "get_document_element_with_null (Some ptr) = (case cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr of
     Some document_ptr \<Rightarrow> do {
       element_ptr_opt \<leftarrow> get_M document_ptr document_element;
       return (case element_ptr_opt of
         Some element_ptr \<Rightarrow> Some (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r element_ptr)
       | None \<Rightarrow> None)})"
 notation get_document_element_with_null ("_ . documentElement")
 
-fun get_owner_document_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
+fun get_owner_document_with_null :: "((_::linorder) object_ptr option) \<Rightarrow>
+(_, ((_) object_ptr option)) dom_prog"
   where
     "get_owner_document_with_null (Some ptr) = (do {
         document_ptr \<leftarrow> get_owner_document ptr;
         return (Some (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr))})"
 notation get_owner_document_with_null ("_ . ownerDocument")
 
-fun remove_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
+fun remove_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow>
+(_, ((_) object_ptr option)) dom_prog"
   where
     "remove_with_null (Some ptr) (Some child) = (case cast child of
       Some child_node \<Rightarrow> do {
         remove child_node;
         return (Some child)}
     | None \<Rightarrow> error NotFoundError)"
   | "remove_with_null None _ = error TypeError"
   | "remove_with_null _ None = error TypeError"
 notation remove_with_null ("_ . remove'(')")
 
-fun remove_child_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
+fun remove_child_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow>
+(_, ((_) object_ptr option)) dom_prog"
   where
     "remove_child_with_null (Some ptr) (Some child) = (case cast child of
       Some child_node \<Rightarrow> do {
         remove_child ptr child_node;
         return (Some child)}
     | None \<Rightarrow> error NotFoundError)"
   | "remove_child_with_null None _ = error TypeError"
   | "remove_child_with_null _ None = error TypeError"
 notation remove_child_with_null ("_ . removeChild")
 
 fun get_tag_name_with_null :: "((_) object_ptr option) \<Rightarrow> (_, attr_value) dom_prog"
   where
     "get_tag_name_with_null (Some ptr) = (case cast ptr of
-      Some element_ptr \<Rightarrow> get_M element_ptr tag_type)"
+      Some element_ptr \<Rightarrow> get_M element_ptr tag_name)"
 notation get_tag_name_with_null ("_ . tagName")
 
 abbreviation "remove_attribute_with_null ptr k \<equiv> set_attribute_with_null2 ptr k None"
 notation remove_attribute_with_null ("_ . removeAttribute'(_')")
 
 fun get_attribute_with_null :: "((_) object_ptr option) \<Rightarrow> attr_key \<Rightarrow> (_, attr_value option) dom_prog"
   where
     "get_attribute_with_null (Some ptr) k = (case cast ptr of 
       Some element_ptr \<Rightarrow> get_attribute element_ptr k)"
 fun get_attribute_with_null2 :: "((_) object_ptr option) \<Rightarrow> attr_key \<Rightarrow> (_, attr_value) dom_prog"
   where
     "get_attribute_with_null2 (Some ptr) k = (case cast ptr of 
       Some element_ptr \<Rightarrow> do {
         a \<leftarrow> get_attribute element_ptr k;
         return (the a)})"
 notation get_attribute_with_null ("_ . getAttribute'(_')")
 notation get_attribute_with_null2 ("_ . getAttribute'(_')")
 
 fun get_parent_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> (_, (_) object_ptr option) dom_prog"
   where
     "get_parent_with_null (Some ptr) = (case cast ptr of
       Some node_ptr \<Rightarrow> get_parent node_ptr)"
 notation get_parent_with_null ("_ . parentNode")
 
 fun first_child_with_null :: "((_) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
   where
     "first_child_with_null (Some ptr) = do {
       child_opt \<leftarrow> first_child ptr;
       return (case child_opt of
         Some child \<Rightarrow> Some (cast child)
       | None \<Rightarrow> None)}"
 notation first_child_with_null ("_ . firstChild")
 
-fun adopt_node_with_null :: "((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow> (_, ((_) object_ptr option)) dom_prog"
+fun adopt_node_with_null ::
+"((_::linorder) object_ptr option) \<Rightarrow> ((_) object_ptr option) \<Rightarrow>(_, ((_) object_ptr option)) dom_prog"
   where
     "adopt_node_with_null (Some ptr) (Some child) = (case cast ptr of
       Some document_ptr \<Rightarrow> (case cast child of
         Some child_node \<Rightarrow> do {
           adopt_node document_ptr child_node;
           return (Some child)}))"
 notation adopt_node_with_null ("_ . adoptNode'(_')")
       
 
-definition createTestTree :: "((_::linorder) object_ptr option) \<Rightarrow> (_, (string \<Rightarrow>  (_, ((_) object_ptr option)) dom_prog)) dom_prog"
+definition createTestTree ::
+"((_::linorder) object_ptr option) \<Rightarrow> (_, (string \<Rightarrow>  (_, ((_) object_ptr option)) dom_prog)) dom_prog"
   where
    "createTestTree ref = return (\<lambda>id. get_element_by_id_with_null ref id)"
 
 end
diff --git a/thys/Core_DOM/standard/Core_DOM_Heap_WF.thy b/thys/Core_DOM/standard/Core_DOM_Heap_WF.thy
--- a/thys/Core_DOM/standard/Core_DOM_Heap_WF.thy
+++ b/thys/Core_DOM/standard/Core_DOM_Heap_WF.thy
@@ -1,7790 +1,8045 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- * 
+ *
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Wellformedness\<close>
-text\<open>In this theory, we discuss the wellformedness of the DOM. First, we define 
-wellformedness and, second, we show for all functions for querying and modifying the 
+text\<open>In this theory, we discuss the wellformedness of the DOM. First, we define
+wellformedness and, second, we show for all functions for querying and modifying the
 DOM to what extend they preserve wellformendess.\<close>
 
 theory Core_DOM_Heap_WF
-imports
-  "Core_DOM_Functions"
+  imports
+    "Core_DOM_Functions"
 begin
 
 locale l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_child_nodes_defs get_child_nodes get_child_nodes_locs +
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs
   for get_child_nodes :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 definition a_owner_document_valid :: "(_) heap \<Rightarrow> bool"
   where
     "a_owner_document_valid h \<longleftrightarrow> (\<forall>node_ptr \<in> fset (node_ptr_kinds h).
-      ((\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h 
+      ((\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h
          \<and> node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
-    \<or> (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h 
+    \<or> (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h
             \<and> node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)))"
 
 lemma a_owner_document_valid_code [code]: "a_owner_document_valid h \<longleftrightarrow> node_ptr_kinds h |\<subseteq>|
-  fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r) (sorted_list_of_fset (object_ptr_kinds h)) @ map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r) (sorted_list_of_fset (document_ptr_kinds h))))
+  fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r)
+(sorted_list_of_fset (object_ptr_kinds h)) @ map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r)
+(sorted_list_of_fset (document_ptr_kinds h))))
 "
-  apply(auto simp add: a_owner_document_valid_def l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_owner_document_valid_def)[1]
+  apply(auto simp add: a_owner_document_valid_def
+      l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_owner_document_valid_def)[1]
 proof -
   fix x
-  assume 1: " \<forall>node_ptr\<in>fset (node_ptr_kinds h). 
-            (\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h \<and> node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) \<or>
-            (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<and> node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
+  assume 1: " \<forall>node_ptr\<in>fset (node_ptr_kinds h).
+            (\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h \<and>
+node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) \<or>
+            (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<and>
+node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
   assume 2: "x |\<in>| node_ptr_kinds h"
-  assume 3: "x |\<notin>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r) (sorted_list_of_fset (document_ptr_kinds h))))"
-  have "\<not>(\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h \<and> x \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
+  assume 3: "x |\<notin>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r)
+(sorted_list_of_fset (document_ptr_kinds h))))"
+  have "\<not>(\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h \<and>
+x \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
     using 1 2 3
     by (smt UN_I fset_of_list_elem image_eqI notin_fset set_concat set_map sorted_list_of_fset_simps(1))
   then
   have "(\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<and> x \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
     using 1 2
     by auto
-  then obtain parent_ptr where parent_ptr: "parent_ptr |\<in>| object_ptr_kinds h \<and> x \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
+  then obtain parent_ptr where parent_ptr:
+    "parent_ptr |\<in>| object_ptr_kinds h \<and> x \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
     by auto
   moreover have "parent_ptr \<in> set (sorted_list_of_fset (object_ptr_kinds h))"
     using parent_ptr by auto
-  moreover have "|h \<turnstile> get_child_nodes parent_ptr|\<^sub>r \<in> set (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r) (sorted_list_of_fset (object_ptr_kinds h)))"
+  moreover have "|h \<turnstile> get_child_nodes parent_ptr|\<^sub>r \<in> set (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r)
+(sorted_list_of_fset (object_ptr_kinds h)))"
     using calculation(2) by auto
   ultimately
-  show "x |\<in>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r) (sorted_list_of_fset (object_ptr_kinds h))))"
+  show "x |\<in>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r)
+(sorted_list_of_fset (object_ptr_kinds h))))"
     using fset_of_list_elem by fastforce
 next
   fix node_ptr
-  assume 1: "node_ptr_kinds h |\<subseteq>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r) (sorted_list_of_fset (object_ptr_kinds h)))) |\<union>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r) (sorted_list_of_fset (document_ptr_kinds h))))"
+  assume 1: "node_ptr_kinds h |\<subseteq>| fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r)
+(sorted_list_of_fset (object_ptr_kinds h)))) |\<union>|
+fset_of_list (concat (map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r)
+(sorted_list_of_fset (document_ptr_kinds h))))"
   assume 2: "node_ptr |\<in>| node_ptr_kinds h"
-  assume 3: "\<forall>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<longrightarrow> node_ptr \<notin> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
-  have "node_ptr \<in> set (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r) (sorted_list_of_fset (object_ptr_kinds h)))) \<or> node_ptr \<in> set (concat (map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r) (sorted_list_of_fset (document_ptr_kinds h))))"
+  assume 3: "\<forall>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<longrightarrow>
+node_ptr \<notin> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
+  have "node_ptr \<in> set (concat (map (\<lambda>parent. |h \<turnstile> get_child_nodes parent|\<^sub>r)
+(sorted_list_of_fset (object_ptr_kinds h)))) \<or>
+node_ptr \<in> set (concat (map (\<lambda>parent. |h \<turnstile> get_disconnected_nodes parent|\<^sub>r)
+(sorted_list_of_fset (document_ptr_kinds h))))"
     using 1 2
     by (meson fin_mono fset_of_list_elem funion_iff)
   then
-  show "\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h \<and> node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
+  show "\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h \<and>
+node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     using 3
     by auto
 qed
 
 definition a_parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
   where
-    "a_parent_child_rel h = {(parent, child). parent |\<in>| object_ptr_kinds h 
+    "a_parent_child_rel h = {(parent, child). parent |\<in>| object_ptr_kinds h
                             \<and> child \<in> cast ` set |h \<turnstile> get_child_nodes parent|\<^sub>r}"
 
 lemma a_parent_child_rel_code [code]: "a_parent_child_rel h = set (concat (map
   (\<lambda>parent. map
     (\<lambda>child. (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child))
     |h \<turnstile> get_child_nodes parent|\<^sub>r)
   (sorted_list_of_fset (object_ptr_kinds h)))
 )"
   by(auto simp add: a_parent_child_rel_def)
 
 definition a_acyclic_heap :: "(_) heap \<Rightarrow> bool"
   where
     "a_acyclic_heap h = acyclic (a_parent_child_rel h)"
 
 definition a_all_ptrs_in_heap :: "(_) heap \<Rightarrow> bool"
   where
     "a_all_ptrs_in_heap h \<longleftrightarrow>
       (\<forall>ptr \<in> fset (object_ptr_kinds h). set |h \<turnstile> get_child_nodes ptr|\<^sub>r \<subseteq> fset (node_ptr_kinds h)) \<and>
-      (\<forall>document_ptr \<in> fset (document_ptr_kinds h). set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r \<subseteq> fset (node_ptr_kinds h))"
+      (\<forall>document_ptr \<in> fset (document_ptr_kinds h).
+set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r \<subseteq> fset (node_ptr_kinds h))"
 
 definition a_distinct_lists :: "(_) heap \<Rightarrow> bool"
-  where                     
+  where
     "a_distinct_lists h = distinct (concat (
-      (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r) 
+      (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r)
    @ (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) |h \<turnstile> document_ptr_kinds_M|\<^sub>r)
     ))"
 
 definition a_heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
   where
     "a_heap_is_wellformed h \<longleftrightarrow>
       a_acyclic_heap h \<and> a_all_ptrs_in_heap h \<and> a_distinct_lists h \<and> a_owner_document_valid h"
 end
 
 locale l_heap_is_wellformed_defs =
   fixes heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
   fixes parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
 
-global_interpretation l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs 
-                       get_disconnected_nodes get_disconnected_nodes_locs
-defines heap_is_wellformed = "l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_heap_is_wellformed get_child_nodes 
+global_interpretation l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
+  defines heap_is_wellformed = "l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_heap_is_wellformed get_child_nodes
                      get_disconnected_nodes"
-      and parent_child_rel = "l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_parent_child_rel get_child_nodes"
-      and acyclic_heap = a_acyclic_heap
-      and all_ptrs_in_heap = a_all_ptrs_in_heap
-      and distinct_lists = a_distinct_lists
-      and owner_document_valid = a_owner_document_valid
+    and parent_child_rel = "l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_parent_child_rel get_child_nodes"
+    and acyclic_heap = a_acyclic_heap
+    and all_ptrs_in_heap = a_all_ptrs_in_heap
+    and distinct_lists = a_distinct_lists
+    and owner_document_valid = a_owner_document_valid
   .
 
 locale l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs
-  + l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs get_disconnected_nodes 
-                                    get_disconnected_nodes_locs
+  + l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_child_nodes get_child_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs
   + l_heap_is_wellformed_defs heap_is_wellformed parent_child_rel
   + l_get_disconnected_nodes type_wf get_disconnected_nodes get_disconnected_nodes_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set" +
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set" +
   assumes heap_is_wellformed_impl: "heap_is_wellformed = a_heap_is_wellformed"
   assumes parent_child_rel_impl: "parent_child_rel = a_parent_child_rel"
 begin
 lemmas heap_is_wellformed_def = heap_is_wellformed_impl[unfolded a_heap_is_wellformed_def]
 lemmas parent_child_rel_def = parent_child_rel_impl[unfolded a_parent_child_rel_def]
 lemmas acyclic_heap_def = a_acyclic_heap_def[folded parent_child_rel_impl]
 
 lemma parent_child_rel_node_ptr:
   "(parent, child) \<in> parent_child_rel h \<Longrightarrow> is_node_ptr_kind child"
   by(auto simp add: parent_child_rel_def)
 
 lemma parent_child_rel_child_nodes:
   assumes "known_ptr parent"
     and "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
     and "child \<in> set children"
   shows "(parent, cast child) \<in> parent_child_rel h"
   using assms
   apply(auto simp add: parent_child_rel_def is_OK_returns_result_I )[1]
   using get_child_nodes_ptr_in_heap by blast
 
 lemma parent_child_rel_child_nodes2:
   assumes "known_ptr parent"
     and "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
     and "child \<in> set children"
     and "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child = child_obj"
   shows "(parent, child_obj) \<in> parent_child_rel h"
   using assms parent_child_rel_child_nodes by blast
 
 
 lemma parent_child_rel_finite: "finite (parent_child_rel h)"
 proof -
-  have "parent_child_rel h = (\<Union>ptr \<in> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r. 
+  have "parent_child_rel h = (\<Union>ptr \<in> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r.
                  (\<Union>child \<in> set |h \<turnstile> get_child_nodes ptr|\<^sub>r. {(ptr, cast child)}))"
     by(auto simp add: parent_child_rel_def)
-  moreover have "finite (\<Union>ptr \<in> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r. 
+  moreover have "finite (\<Union>ptr \<in> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r.
                     (\<Union>child \<in> set |h \<turnstile> get_child_nodes ptr|\<^sub>r. {(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)}))"
     by simp
   ultimately show ?thesis
     by simp
 qed
 
 lemma distinct_lists_no_parent:
   assumes "a_distinct_lists h"
   assumes "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   assumes "node_ptr \<in> set disc_nodes"
-  shows "\<not>(\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h 
+  shows "\<not>(\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h
                 \<and> node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
   using assms
   apply(auto simp add: a_distinct_lists_def)[1]
 proof -
   fix parent_ptr :: "(_) object_ptr"
   assume a1: "parent_ptr |\<in>| object_ptr_kinds h"
-  assume a2: "(\<Union>x\<in>fset (object_ptr_kinds h). 
-              set |h \<turnstile> get_child_nodes x|\<^sub>r) \<inter> (\<Union>x\<in>fset (document_ptr_kinds h). 
+  assume a2: "(\<Union>x\<in>fset (object_ptr_kinds h).
+              set |h \<turnstile> get_child_nodes x|\<^sub>r) \<inter> (\<Union>x\<in>fset (document_ptr_kinds h).
                   set |h \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
   assume a3: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   assume a4: "node_ptr \<in> set disc_nodes"
   assume a5: "node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
   have f6: "parent_ptr \<in> fset (object_ptr_kinds h)"
     using a1 by auto
   have f7: "document_ptr \<in> fset (document_ptr_kinds h)"
     using a3 by (meson fmember.rep_eq get_disconnected_nodes_ptr_in_heap is_OK_returns_result_I)
   have "|h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r = disc_nodes"
     using a3 by simp
   then show False
     using f7 f6 a5 a4 a2 by blast
 qed
 
 
 lemma distinct_lists_disconnected_nodes:
   assumes "a_distinct_lists h"
     and "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   shows "distinct disc_nodes"
 proof -
-  have h1: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+  have h1: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                              |h \<turnstile> document_ptr_kinds_M|\<^sub>r))"
     using assms(1)
     by(simp add: a_distinct_lists_def)
   then show ?thesis
     using concat_map_all_distinct[OF h1] assms(2) is_OK_returns_result_I get_disconnected_nodes_ok
-    by (metis (no_types, lifting) DocumentMonad.ptr_kinds_ptr_kinds_M 
-                                  l_get_disconnected_nodes.get_disconnected_nodes_ptr_in_heap 
-                                  l_get_disconnected_nodes_axioms select_result_I2)
+    by (metis (no_types, lifting) DocumentMonad.ptr_kinds_ptr_kinds_M
+        l_get_disconnected_nodes.get_disconnected_nodes_ptr_in_heap
+        l_get_disconnected_nodes_axioms select_result_I2)
 qed
 
 lemma distinct_lists_children:
   assumes "a_distinct_lists h"
     and "known_ptr ptr"
     and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   shows "distinct children"
 proof (cases "children = []", simp)
   assume "children \<noteq> []"
   have h1: "distinct (concat ((map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r)))"
     using assms(1)
     by(simp add: a_distinct_lists_def)
   show ?thesis
     using concat_map_all_distinct[OF h1] assms(2) assms(3)
-    by (metis (no_types, lifting) ObjectMonad.ptr_kinds_ptr_kinds_M get_child_nodes_ptr_in_heap 
-                                  is_OK_returns_result_I select_result_I2)
+    by (metis (no_types, lifting) ObjectMonad.ptr_kinds_ptr_kinds_M get_child_nodes_ptr_in_heap
+        is_OK_returns_result_I select_result_I2)
 qed
 
 lemma heap_is_wellformed_children_in_heap:
   assumes "heap_is_wellformed h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "child \<in> set children"
   shows "child |\<in>| node_ptr_kinds h"
   using assms
   apply(auto simp add: heap_is_wellformed_def a_all_ptrs_in_heap_def)[1]
-  by (metis (no_types, lifting) finite_set_in is_OK_returns_result_I local.get_child_nodes_ptr_in_heap select_result_I2 subsetD)
+  by (metis (no_types, lifting) finite_set_in is_OK_returns_result_I
+      local.get_child_nodes_ptr_in_heap select_result_I2 subsetD)
 
 lemma heap_is_wellformed_one_parent:
   assumes "heap_is_wellformed h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'"
   assumes "set children \<inter> set children' \<noteq> {}"
   shows "ptr = ptr'"
   using assms
 proof (auto simp add: heap_is_wellformed_def a_distinct_lists_def)[1]
   fix x :: "(_) node_ptr"
   assume a1: "ptr \<noteq> ptr'"
   assume a2: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assume a3: "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'"
-  assume a4: "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) 
+  assume a4: "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r)
                                      (sorted_list_of_set (fset (object_ptr_kinds h)))))"
   have f5: "|h \<turnstile> get_child_nodes ptr|\<^sub>r = children"
     using a2 by simp
   have "|h \<turnstile> get_child_nodes ptr'|\<^sub>r = children'"
     using a3 by (meson select_result_I2)
-  then have "ptr \<notin> set (sorted_list_of_set (fset (object_ptr_kinds h))) 
-          \<or> ptr' \<notin> set (sorted_list_of_set (fset (object_ptr_kinds h))) 
+  then have "ptr \<notin> set (sorted_list_of_set (fset (object_ptr_kinds h)))
+          \<or> ptr' \<notin> set (sorted_list_of_set (fset (object_ptr_kinds h)))
           \<or> set children \<inter> set children' = {}"
     using f5 a4 a1 by (meson distinct_concat_map_E(1))
   then show False
-    using a3 a2 by (metis (no_types) assms(4) finite_fset fmember.rep_eq is_OK_returns_result_I 
-                                          local.get_child_nodes_ptr_in_heap set_sorted_list_of_set)
+    using a3 a2 by (metis (no_types) assms(4) finite_fset fmember.rep_eq is_OK_returns_result_I
+        local.get_child_nodes_ptr_in_heap set_sorted_list_of_set)
 qed
 
-lemma parent_child_rel_child: 
-  "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> child \<in> set children \<longleftrightarrow> (ptr, cast child) \<in> parent_child_rel h"
+lemma parent_child_rel_child:
+  "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow>
+child \<in> set children \<longleftrightarrow> (ptr, cast child) \<in> parent_child_rel h"
   by (simp add: is_OK_returns_result_I get_child_nodes_ptr_in_heap parent_child_rel_def)
 
 lemma parent_child_rel_acyclic: "heap_is_wellformed h \<Longrightarrow> acyclic (parent_child_rel h)"
   by (simp add: acyclic_heap_def local.heap_is_wellformed_def)
 
-lemma heap_is_wellformed_disconnected_nodes_distinct: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes \<Longrightarrow> distinct disc_nodes"
+lemma heap_is_wellformed_disconnected_nodes_distinct:
+  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes \<Longrightarrow>
+distinct disc_nodes"
   using distinct_lists_disconnected_nodes local.heap_is_wellformed_def by blast
 
-lemma parent_child_rel_parent_in_heap: 
+lemma parent_child_rel_parent_in_heap:
   "(parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> parent |\<in>| object_ptr_kinds h"
   using local.parent_child_rel_def by blast
 
-lemma parent_child_rel_child_in_heap: 
-  "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptr parent 
+lemma parent_child_rel_child_in_heap:
+  "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptr parent
     \<Longrightarrow> (parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> child_ptr |\<in>| object_ptr_kinds h"
   apply(auto simp add: heap_is_wellformed_def parent_child_rel_def a_all_ptrs_in_heap_def)[1]
   using get_child_nodes_ok
   by (meson finite_set_in subsetD)
 
-lemma heap_is_wellformed_disc_nodes_in_heap: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
+lemma heap_is_wellformed_disc_nodes_in_heap:
+  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
    \<Longrightarrow> node \<in> set disc_nodes \<Longrightarrow> node |\<in>| node_ptr_kinds h"
-  by (metis (no_types, lifting) finite_set_in is_OK_returns_result_I local.a_all_ptrs_in_heap_def local.get_disconnected_nodes_ptr_in_heap local.heap_is_wellformed_def select_result_I2 subsetD)
-
-lemma heap_is_wellformed_one_disc_parent: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
-   \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr' \<rightarrow>\<^sub>r disc_nodes' 
+  by (metis (no_types, lifting) finite_set_in is_OK_returns_result_I local.a_all_ptrs_in_heap_def
+      local.get_disconnected_nodes_ptr_in_heap local.heap_is_wellformed_def select_result_I2 subsetD)
+
+lemma heap_is_wellformed_one_disc_parent:
+  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
+   \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr' \<rightarrow>\<^sub>r disc_nodes'
    \<Longrightarrow> set disc_nodes \<inter> set disc_nodes' \<noteq> {} \<Longrightarrow> document_ptr = document_ptr'"
-  using DocumentMonad.ptr_kinds_ptr_kinds_M concat_append distinct_append distinct_concat_map_E(1) 
-        is_OK_returns_result_I local.a_distinct_lists_def local.get_disconnected_nodes_ptr_in_heap 
-        local.heap_is_wellformed_def select_result_I2
+  using DocumentMonad.ptr_kinds_ptr_kinds_M concat_append distinct_append distinct_concat_map_E(1)
+    is_OK_returns_result_I local.a_distinct_lists_def local.get_disconnected_nodes_ptr_in_heap
+    local.heap_is_wellformed_def select_result_I2
 proof -
   assume a1: "heap_is_wellformed h"
   assume a2: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   assume a3: "h \<turnstile> get_disconnected_nodes document_ptr' \<rightarrow>\<^sub>r disc_nodes'"
   assume a4: "set disc_nodes \<inter> set disc_nodes' \<noteq> {}"
   have f5: "|h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r = disc_nodes"
     using a2 by (meson select_result_I2)
   have f6: "|h \<turnstile> get_disconnected_nodes document_ptr'|\<^sub>r = disc_nodes'"
     using a3 by (meson select_result_I2)
   have "\<And>nss nssa. \<not> distinct (concat (nss @ nssa)) \<or> distinct (concat nssa::(_) node_ptr list)"
     by (metis (no_types) concat_append distinct_append)
   then have "distinct (concat (map (\<lambda>d. |h \<turnstile> get_disconnected_nodes d|\<^sub>r) |h \<turnstile> document_ptr_kinds_M|\<^sub>r))"
     using a1 local.a_distinct_lists_def local.heap_is_wellformed_def by blast
   then show ?thesis
-    using f6 f5 a4 a3 a2 by (meson DocumentMonad.ptr_kinds_ptr_kinds_M distinct_concat_map_E(1) 
-                                   is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap)
+    using f6 f5 a4 a3 a2 by (meson DocumentMonad.ptr_kinds_ptr_kinds_M distinct_concat_map_E(1)
+        is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap)
 qed
 
-lemma heap_is_wellformed_children_disc_nodes_different: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
-    \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
+lemma heap_is_wellformed_children_disc_nodes_different:
+  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
+    \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
    \<Longrightarrow> set children \<inter> set disc_nodes = {}"
-  by (metis (no_types, hide_lams) disjoint_iff_not_equal distinct_lists_no_parent 
-                                  is_OK_returns_result_I local.get_child_nodes_ptr_in_heap 
-                                  local.heap_is_wellformed_def select_result_I2)
-
-lemma heap_is_wellformed_children_disc_nodes: 
-  "heap_is_wellformed h \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h 
-   \<Longrightarrow>  \<not>(\<exists>parent \<in> fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r) 
+  by (metis (no_types, hide_lams) disjoint_iff_not_equal distinct_lists_no_parent
+      is_OK_returns_result_I local.get_child_nodes_ptr_in_heap
+      local.heap_is_wellformed_def select_result_I2)
+
+lemma heap_is_wellformed_children_disc_nodes:
+  "heap_is_wellformed h \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h
+   \<Longrightarrow>  \<not>(\<exists>parent \<in> fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)
    \<Longrightarrow> (\<exists>document_ptr \<in> fset (document_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
   apply(auto simp add: heap_is_wellformed_def a_distinct_lists_def a_owner_document_valid_def)[1]
   by (meson fmember.rep_eq)
-lemma heap_is_wellformed_children_distinct: 
+lemma heap_is_wellformed_children_distinct:
   "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> distinct children"
-  by (metis (no_types, lifting) ObjectMonad.ptr_kinds_ptr_kinds_M concat_append distinct_append 
-                                distinct_concat_map_E(2) is_OK_returns_result_I local.a_distinct_lists_def 
-                                local.get_child_nodes_ptr_in_heap local.heap_is_wellformed_def 
-                               select_result_I2)
+  by (metis (no_types, lifting) ObjectMonad.ptr_kinds_ptr_kinds_M concat_append distinct_append
+      distinct_concat_map_E(2) is_OK_returns_result_I local.a_distinct_lists_def
+      local.get_child_nodes_ptr_in_heap local.heap_is_wellformed_def
+      select_result_I2)
 end
 
-locale l_heap_is_wellformed = l_type_wf + l_known_ptr + l_heap_is_wellformed_defs 
-                              + l_get_child_nodes_defs + l_get_disconnected_nodes_defs +
-assumes heap_is_wellformed_children_in_heap: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> child \<in> set children 
+locale l_heap_is_wellformed = l_type_wf + l_known_ptr + l_heap_is_wellformed_defs
+  + l_get_child_nodes_defs + l_get_disconnected_nodes_defs +
+  assumes heap_is_wellformed_children_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> child \<in> set children
                         \<Longrightarrow> child |\<in>| node_ptr_kinds h"
-assumes heap_is_wellformed_disc_nodes_in_heap: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
+  assumes heap_is_wellformed_disc_nodes_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
                         \<Longrightarrow> node \<in> set disc_nodes \<Longrightarrow> node |\<in>| node_ptr_kinds h"
-assumes heap_is_wellformed_one_parent: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
-                        \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children' 
+  assumes heap_is_wellformed_one_parent:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
+                        \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'
                         \<Longrightarrow> set children \<inter> set children' \<noteq> {} \<Longrightarrow> ptr = ptr'"
-assumes heap_is_wellformed_one_disc_parent: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
-                        \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr' \<rightarrow>\<^sub>r disc_nodes' 
+  assumes heap_is_wellformed_one_disc_parent:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
+                        \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr' \<rightarrow>\<^sub>r disc_nodes'
                         \<Longrightarrow> set disc_nodes \<inter> set disc_nodes' \<noteq> {} \<Longrightarrow> document_ptr = document_ptr'"
-assumes heap_is_wellformed_children_disc_nodes_different: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
-                        \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
+  assumes heap_is_wellformed_children_disc_nodes_different:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
+                        \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
                         \<Longrightarrow> set children \<inter> set disc_nodes = {}"
-assumes heap_is_wellformed_disconnected_nodes_distinct: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes 
+  assumes heap_is_wellformed_disconnected_nodes_distinct:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes
                         \<Longrightarrow> distinct disc_nodes"
-assumes heap_is_wellformed_children_distinct: 
-  "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> distinct children"
-assumes heap_is_wellformed_children_disc_nodes: 
-  "heap_is_wellformed h \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h 
-   \<Longrightarrow>  \<not>(\<exists>parent \<in> fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r) 
+  assumes heap_is_wellformed_children_distinct:
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> distinct children"
+  assumes heap_is_wellformed_children_disc_nodes:
+    "heap_is_wellformed h \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h
+   \<Longrightarrow>  \<not>(\<exists>parent \<in> fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)
    \<Longrightarrow> (\<exists>document_ptr \<in> fset (document_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
-assumes parent_child_rel_child: 
-  "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
+  assumes parent_child_rel_child:
+    "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
    \<Longrightarrow> child \<in> set children \<longleftrightarrow> (ptr, cast child) \<in> parent_child_rel h"
-assumes parent_child_rel_finite: 
-  "heap_is_wellformed h \<Longrightarrow> finite (parent_child_rel h)"
-assumes parent_child_rel_acyclic: 
-  "heap_is_wellformed h \<Longrightarrow> acyclic (parent_child_rel h)"
-assumes parent_child_rel_node_ptr: 
-  "(parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> is_node_ptr_kind child_ptr"
-assumes parent_child_rel_parent_in_heap: 
-  "(parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> parent |\<in>| object_ptr_kinds h"
-assumes parent_child_rel_child_in_heap: 
-  "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptr parent 
+  assumes parent_child_rel_finite:
+    "heap_is_wellformed h \<Longrightarrow> finite (parent_child_rel h)"
+  assumes parent_child_rel_acyclic:
+    "heap_is_wellformed h \<Longrightarrow> acyclic (parent_child_rel h)"
+  assumes parent_child_rel_node_ptr:
+    "(parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> is_node_ptr_kind child_ptr"
+  assumes parent_child_rel_parent_in_heap:
+    "(parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> parent |\<in>| object_ptr_kinds h"
+  assumes parent_child_rel_child_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptr parent
    \<Longrightarrow> (parent, child_ptr) \<in> parent_child_rel h \<Longrightarrow> child_ptr |\<in>| object_ptr_kinds h"
 
-interpretation i_heap_is_wellformed?: l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes 
-               get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs 
-               heap_is_wellformed parent_child_rel
+interpretation i_heap_is_wellformed?: l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes
+  get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
+  heap_is_wellformed parent_child_rel
   apply(unfold_locales)
   by(auto simp add: heap_is_wellformed_def parent_child_rel_def)
 declare l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 lemma heap_is_wellformed_is_l_heap_is_wellformed [instances]:
-  "l_heap_is_wellformed type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes 
+  "l_heap_is_wellformed type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes
                         get_disconnected_nodes"
   apply(auto simp add: l_heap_is_wellformed_def)[1]
-  using heap_is_wellformed_children_in_heap 
+  using heap_is_wellformed_children_in_heap
                 apply blast
-  using heap_is_wellformed_disc_nodes_in_heap 
+  using heap_is_wellformed_disc_nodes_in_heap
                apply blast
-  using heap_is_wellformed_one_parent 
+  using heap_is_wellformed_one_parent
               apply blast
-  using heap_is_wellformed_one_disc_parent 
+  using heap_is_wellformed_one_disc_parent
              apply blast
-  using heap_is_wellformed_children_disc_nodes_different 
+  using heap_is_wellformed_children_disc_nodes_different
             apply blast
-  using heap_is_wellformed_disconnected_nodes_distinct 
+  using heap_is_wellformed_disconnected_nodes_distinct
            apply blast
-  using heap_is_wellformed_children_distinct 
+  using heap_is_wellformed_children_distinct
           apply blast
-  using heap_is_wellformed_children_disc_nodes 
+  using heap_is_wellformed_children_disc_nodes
          apply blast
-  using parent_child_rel_child 
+  using parent_child_rel_child
         apply (blast)
-  using parent_child_rel_child 
+  using parent_child_rel_child
        apply(blast)
-  using parent_child_rel_finite 
+  using parent_child_rel_finite
       apply blast
-  using parent_child_rel_acyclic 
+  using parent_child_rel_acyclic
      apply blast
-  using parent_child_rel_node_ptr 
+  using parent_child_rel_node_ptr
     apply blast
-  using parent_child_rel_parent_in_heap 
+  using parent_child_rel_parent_in_heap
    apply blast
-  using parent_child_rel_child_in_heap 
+  using parent_child_rel_child_in_heap
   apply blast
   done
 
 subsection \<open>get\_parent\<close>
 
 locale l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
+  known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
   + l_heap_is_wellformed
-    type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs 
-    get_disconnected_nodes get_disconnected_nodes_locs
+  type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and known_ptrs :: "(_) heap \<Rightarrow> bool"
-  and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
-  and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma child_parent_dual:
   assumes heap_is_wellformed: "heap_is_wellformed h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "child \<in> set children"
   assumes "known_ptrs h"
   assumes type_wf: "type_wf h"
   shows "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr"
 proof -
   obtain ptrs where ptrs: "h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have h1: "ptr \<in> set ptrs"
-    using get_child_nodes_ok assms(2) is_OK_returns_result_I 
-    by (metis (no_types, hide_lams) ObjectMonad.ptr_kinds_ptr_kinds_M 
-      \<open>\<And>thesis. (\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> 
-     get_child_nodes_ptr_in_heap returns_result_eq select_result_I2)
+    using get_child_nodes_ok assms(2) is_OK_returns_result_I
+    by (metis (no_types, hide_lams) ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>\<And>thesis. (\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
+        get_child_nodes_ptr_in_heap returns_result_eq select_result_I2)
 
   let ?P = "(\<lambda>ptr. get_child_nodes ptr \<bind> (\<lambda>children. return (child \<in> set children)))"
   let ?filter = "filter_M ?P ptrs"
 
   have "h \<turnstile> ok ?filter"
     using ptrs type_wf
     using get_child_nodes_ok
     apply(auto intro!: filter_M_is_OK_I bind_is_OK_pure_I get_child_nodes_ok simp add: bind_pure_I)[1]
-    using assms(4) local.known_ptrs_known_ptr by blast 
+    using assms(4) local.known_ptrs_known_ptr by blast
   then obtain parent_ptrs where parent_ptrs: "h \<turnstile> ?filter \<rightarrow>\<^sub>r parent_ptrs"
     by auto
 
-  have h5: "\<exists>!x. x \<in> set ptrs \<and> h \<turnstile> Heap_Error_Monad.bind (get_child_nodes x) 
+  have h5: "\<exists>!x. x \<in> set ptrs \<and> h \<turnstile> Heap_Error_Monad.bind (get_child_nodes x)
                   (\<lambda>children. return (child \<in> set children)) \<rightarrow>\<^sub>r True"
     apply(auto intro!: bind_pure_returns_result_I)[1]
     using heap_is_wellformed_one_parent
   proof -
     have "h \<turnstile> (return (child \<in> set children)::((_) heap, exception, bool) prog) \<rightarrow>\<^sub>r True"
       by (simp add: assms(3))
-    then show 
-      "\<exists>z. z \<in> set ptrs \<and> h \<turnstile> Heap_Error_Monad.bind (get_child_nodes z) 
+    then show
+      "\<exists>z. z \<in> set ptrs \<and> h \<turnstile> Heap_Error_Monad.bind (get_child_nodes z)
                                (\<lambda>ns. return (child \<in> set ns)) \<rightarrow>\<^sub>r True"
-      by (metis (no_types) assms(2) bind_pure_returns_result_I2 h1 is_OK_returns_result_I 
-                                local.get_child_nodes_pure select_result_I2)
+      by (metis (no_types) assms(2) bind_pure_returns_result_I2 h1 is_OK_returns_result_I
+          local.get_child_nodes_pure select_result_I2)
   next
     fix x y
     assume 0: "x \<in> set ptrs"
-      and 1: "h \<turnstile> Heap_Error_Monad.bind (get_child_nodes x) 
+      and 1: "h \<turnstile> Heap_Error_Monad.bind (get_child_nodes x)
                   (\<lambda>children. return (child \<in> set children)) \<rightarrow>\<^sub>r True"
       and 2: "y \<in> set ptrs"
-      and 3: "h \<turnstile> Heap_Error_Monad.bind (get_child_nodes y) 
+      and 3: "h \<turnstile> Heap_Error_Monad.bind (get_child_nodes y)
                   (\<lambda>children. return (child \<in> set children)) \<rightarrow>\<^sub>r True"
-      and 4: "(\<And>h ptr children ptr' children'. heap_is_wellformed h 
-              \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children' 
+      and 4: "(\<And>h ptr children ptr' children'. heap_is_wellformed h
+              \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'
               \<Longrightarrow> set children \<inter> set children' \<noteq> {} \<Longrightarrow> ptr = ptr')"
     then show "x = y"
-      by (metis (no_types, lifting) bind_returns_result_E disjoint_iff_not_equal heap_is_wellformed 
-                                    return_returns_result)
+      by (metis (no_types, lifting) bind_returns_result_E disjoint_iff_not_equal heap_is_wellformed
+          return_returns_result)
   qed
 
   have "child |\<in>| node_ptr_kinds h"
     using heap_is_wellformed_children_in_heap heap_is_wellformed assms(2) assms(3)
-    by fast 
+    by fast
   moreover have "parent_ptrs = [ptr]"
     apply(rule filter_M_ex1[OF parent_ptrs h1 h5])
-    using ptrs assms(2) assms(3) 
+    using ptrs assms(2) assms(3)
     by(auto simp add: object_ptr_kinds_M_defs bind_pure_I intro!: bind_pure_returns_result_I)
   ultimately  show ?thesis
     using ptrs parent_ptrs
-    by(auto simp add: bind_pure_I get_parent_def 
-            elim!: bind_returns_result_E2 
-            intro!: bind_pure_returns_result_I filter_M_pure_I) (*slow, ca 1min *)
+    by(auto simp add: bind_pure_I get_parent_def
+        elim!: bind_returns_result_E2
+        intro!: bind_pure_returns_result_I filter_M_pure_I) (*slow, ca 1min *)
 qed
 
 lemma parent_child_rel_parent:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent"
   shows "(parent, cast child_node) \<in> parent_child_rel h"
   using assms parent_child_rel_child get_parent_child_dual by auto
 
 lemma heap_wellformed_induct [consumes 1, case_names step]:
   assumes "heap_is_wellformed h"
-    and step: "\<And>parent. (\<And>children child. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children 
+    and step: "\<And>parent. (\<And>children child. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children
                \<Longrightarrow> child \<in> set children \<Longrightarrow> P (cast child)) \<Longrightarrow> P parent"
   shows "P ptr"
 proof -
   fix ptr
   have "wf ((parent_child_rel h)\<inverse>)"
     by (simp add: assms(1) finite_acyclic_wf_converse parent_child_rel_acyclic parent_child_rel_finite)
   then show "?thesis"
   proof (induct rule: wf_induct_rule)
     case (less parent)
     then show ?case
       using assms parent_child_rel_child
       by (meson converse_iff)
   qed
 qed
 
 lemma heap_wellformed_induct2 [consumes 3, case_names not_in_heap empty_children step]:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
     and not_in_heap: "\<And>parent. parent |\<notin>| object_ptr_kinds h \<Longrightarrow> P parent"
     and empty_children: "\<And>parent. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r [] \<Longrightarrow> P parent"
-    and step: "\<And>parent children child. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children 
+    and step: "\<And>parent children child. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children
                \<Longrightarrow> child \<in> set children \<Longrightarrow> P (cast child) \<Longrightarrow> P parent"
   shows "P ptr"
 proof(insert assms(1), induct rule: heap_wellformed_induct)
   case (step parent)
   then show ?case
   proof(cases "parent |\<in>| object_ptr_kinds h")
     case True
     then obtain children where children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
-      using get_child_nodes_ok assms(2) assms(3) 
+      using get_child_nodes_ok assms(2) assms(3)
       by (meson is_OK_returns_result_E local.known_ptrs_known_ptr)
     then show ?thesis
     proof (cases "children = []")
       case True
       then show ?thesis
         using children empty_children
         by simp
     next
       case False
       then show ?thesis
         using assms(6) children last_in_set step.hyps by blast
     qed
   next
     case False
-    then show ?thesis 
+    then show ?thesis
       by (simp add: not_in_heap)
   qed
 qed
 
 lemma heap_wellformed_induct_rev [consumes 1, case_names step]:
   assumes "heap_is_wellformed h"
-    and step: "\<And>child. (\<And>parent child_node. cast child_node = child 
+    and step: "\<And>child. (\<And>parent child_node. cast child_node = child
                \<Longrightarrow> h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent \<Longrightarrow> P parent) \<Longrightarrow> P child"
   shows "P ptr"
 proof -
   fix ptr
   have "wf ((parent_child_rel h))"
-    by (simp add: assms(1) local.parent_child_rel_acyclic local.parent_child_rel_finite 
-                wf_iff_acyclic_if_finite)
+    by (simp add: assms(1) local.parent_child_rel_acyclic local.parent_child_rel_finite
+        wf_iff_acyclic_if_finite)
 
   then show "?thesis"
   proof (induct rule: wf_induct_rule)
     case (less child)
     show ?case
       using assms get_parent_child_dual
       by (metis less.hyps parent_child_rel_parent)
   qed
 qed
 end
 
-interpretation i_get_parent_wf?: l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes 
-               get_child_nodes_locs known_ptrs get_parent get_parent_locs heap_is_wellformed 
-               parent_child_rel get_disconnected_nodes
+interpretation i_get_parent_wf?: l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes
+  get_child_nodes_locs known_ptrs get_parent get_parent_locs heap_is_wellformed
+  parent_child_rel get_disconnected_nodes
   using instances
   by(simp add: l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
 locale l_get_parent_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs 
-    heap_is_wellformed parent_child_rel get_disconnected_nodes get_disconnected_nodes_locs
+  known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
+  heap_is_wellformed parent_child_rel get_disconnected_nodes get_disconnected_nodes_locs
   + l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr type_wf get_child_nodes get_child_nodes_locs get_disconnected_nodes 
-    get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
+  known_ptr type_wf get_child_nodes get_child_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and known_ptrs :: "(_) heap \<Rightarrow> bool"
-  and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
-  and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 lemma preserves_wellformedness_writes_needed:
   assumes heap_is_wellformed: "heap_is_wellformed h"
     and "h \<turnstile> f \<rightarrow>\<^sub>h h'"
     and "writes SW f h h'"
-    and preserved_get_child_nodes: 
-    "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
+    and preserved_get_child_nodes:
+    "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h'
                       \<Longrightarrow> \<forall>object_ptr. \<forall>r \<in> get_child_nodes_locs object_ptr. r h h'"
-    and preserved_get_disconnected_nodes: 
-    "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
+    and preserved_get_disconnected_nodes:
+    "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h'
                       \<Longrightarrow> \<forall>document_ptr. \<forall>r \<in> get_disconnected_nodes_locs document_ptr. r h h'"
-    and preserved_object_pointers: 
-    "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h' 
+    and preserved_object_pointers:
+    "\<And>h h' w. w \<in> SW \<Longrightarrow> h \<turnstile> w \<rightarrow>\<^sub>h h'
                      \<Longrightarrow> \<forall>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
-shows "heap_is_wellformed h'"
+  shows "heap_is_wellformed h'"
 proof -
   have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
     using assms(2) assms(3) object_ptr_kinds_preserved preserved_object_pointers by blast
-  then have object_ptr_kinds_eq: 
-       "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
-    unfolding object_ptr_kinds_M_defs by simp 
+  then have object_ptr_kinds_eq:
+    "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    unfolding object_ptr_kinds_M_defs by simp
   then have object_ptr_kinds_eq2: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     using select_result_eq by force
   then have node_ptr_kinds_eq2: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by auto
   then have node_ptr_kinds_eq3: "node_ptr_kinds h = node_ptr_kinds h'"
     by auto
   have document_ptr_kinds_eq2: "|h \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_eq2 document_ptr_kinds_M_eq by auto
   then have document_ptr_kinds_eq3: "document_ptr_kinds h = document_ptr_kinds h'"
-     by auto
-   have children_eq: 
+    by auto
+  have children_eq:
     "\<And>ptr children. h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     apply(rule reads_writes_preserved[OF get_child_nodes_reads assms(3) assms(2)])
     using preserved_get_child_nodes by fast
   then have children_eq2: "\<And>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r = |h' \<turnstile> get_child_nodes ptr|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq: 
-    "\<And>document_ptr disconnected_nodes. 
-        h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes 
+  have disconnected_nodes_eq:
+    "\<And>document_ptr disconnected_nodes.
+        h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes
                              = h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes"
     apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads assms(3) assms(2)])
     using preserved_get_disconnected_nodes by fast
-  then have disconnected_nodes_eq2: 
-         "\<And>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r 
+  then have disconnected_nodes_eq2:
+    "\<And>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
                             = |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     using select_result_eq by force
   have get_parent_eq: "\<And>ptr parent. h \<turnstile> get_parent ptr \<rightarrow>\<^sub>r parent = h' \<turnstile> get_parent ptr \<rightarrow>\<^sub>r parent"
     apply(rule reads_writes_preserved[OF get_parent_reads assms(3) assms(2)])
     using preserved_get_child_nodes preserved_object_pointers unfolding get_parent_locs_def by fast
   have "a_acyclic_heap h"
     using heap_is_wellformed by (simp add: heap_is_wellformed_def)
   have "parent_child_rel h' \<subseteq> parent_child_rel h"
   proof
     fix x
     assume "x \<in> parent_child_rel h'"
     then show "x \<in> parent_child_rel h"
       by(simp add: parent_child_rel_def  children_eq2 object_ptr_kinds_eq3)
   qed
   then have "a_acyclic_heap h'"
     using \<open>a_acyclic_heap h\<close> acyclic_heap_def acyclic_subset by blast
 
   moreover have "a_all_ptrs_in_heap h"
     using heap_is_wellformed by (simp add: heap_is_wellformed_def)
   then have "a_all_ptrs_in_heap h'"
-    by (simp add: children_eq2 disconnected_nodes_eq2 document_ptr_kinds_eq3 l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_all_ptrs_in_heap_def node_ptr_kinds_eq3 object_ptr_kinds_eq3)
+    by (simp add: children_eq2 disconnected_nodes_eq2 document_ptr_kinds_eq3
+        l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_all_ptrs_in_heap_def node_ptr_kinds_eq3 object_ptr_kinds_eq3)
 
   moreover have h0: "a_distinct_lists h"
     using heap_is_wellformed by (simp add: heap_is_wellformed_def)
-  have h1: "map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) (sorted_list_of_set (fset (object_ptr_kinds h))) 
+  have h1: "map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) (sorted_list_of_set (fset (object_ptr_kinds h)))
          = map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r) (sorted_list_of_set (fset (object_ptr_kinds h')))"
-    by (simp add: children_eq2 object_ptr_kinds_eq3)                                                                                    
-  have h2: "map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
-               (sorted_list_of_set (fset (document_ptr_kinds h))) 
-          = map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+    by (simp add: children_eq2 object_ptr_kinds_eq3)
+  have h2: "map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
+               (sorted_list_of_set (fset (document_ptr_kinds h)))
+          = map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                 (sorted_list_of_set (fset (document_ptr_kinds h')))"
     using disconnected_nodes_eq document_ptr_kinds_eq2 select_result_eq by force
   have "a_distinct_lists h'"
-    using h0 
+    using h0
     by(simp add: a_distinct_lists_def h1 h2)
 
   moreover have "a_owner_document_valid h"
     using heap_is_wellformed by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
-    by(auto simp add: a_owner_document_valid_def children_eq2 disconnected_nodes_eq2 
-                      object_ptr_kinds_eq3 node_ptr_kinds_eq3 document_ptr_kinds_eq3)
+    by(auto simp add: a_owner_document_valid_def children_eq2 disconnected_nodes_eq2
+        object_ptr_kinds_eq3 node_ptr_kinds_eq3 document_ptr_kinds_eq3)
   ultimately show ?thesis
     by (simp add: heap_is_wellformed_def)
 qed
 end
 
-interpretation i_get_parent_wf2?: l_get_parent_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes 
-                                  get_child_nodes_locs known_ptrs get_parent get_parent_locs 
-                                  heap_is_wellformed parent_child_rel get_disconnected_nodes 
-                                  get_disconnected_nodes_locs
+interpretation i_get_parent_wf2?: l_get_parent_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes
+  get_child_nodes_locs known_ptrs get_parent get_parent_locs
+  heap_is_wellformed parent_child_rel get_disconnected_nodes
+  get_disconnected_nodes_locs
   using l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
   by (simp add: l_get_parent_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 
 declare l_get_parent_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
-locale l_get_parent_wf = l_type_wf + l_known_ptrs  + l_heap_is_wellformed_defs 
-                       + l_get_child_nodes_defs + l_get_parent_defs +
+locale l_get_parent_wf = l_type_wf + l_known_ptrs  + l_heap_is_wellformed_defs
+  + l_get_child_nodes_defs + l_get_parent_defs +
   assumes child_parent_dual:
     "heap_is_wellformed h
     \<Longrightarrow> type_wf h
     \<Longrightarrow> known_ptrs h
     \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
     \<Longrightarrow> child \<in> set children
     \<Longrightarrow> h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr"
   assumes heap_wellformed_induct [consumes 1, case_names step]:
     "heap_is_wellformed h
-    \<Longrightarrow> (\<And>parent. (\<And>children child. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children 
+    \<Longrightarrow> (\<And>parent. (\<And>children child. h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children
     \<Longrightarrow> child \<in> set children \<Longrightarrow> P (cast child)) \<Longrightarrow> P parent)
     \<Longrightarrow> P ptr"
   assumes heap_wellformed_induct_rev [consumes 1, case_names step]:
     "heap_is_wellformed h
-    \<Longrightarrow> (\<And>child. (\<And>parent child_node. cast child_node = child 
+    \<Longrightarrow> (\<And>child. (\<And>parent child_node. cast child_node = child
     \<Longrightarrow> h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent \<Longrightarrow> P parent) \<Longrightarrow> P child)
     \<Longrightarrow> P ptr"
-  assumes parent_child_rel_parent: "heap_is_wellformed h 
-    \<Longrightarrow> h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent 
+  assumes parent_child_rel_parent: "heap_is_wellformed h
+    \<Longrightarrow> h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent
     \<Longrightarrow> (parent, cast child_node) \<in> parent_child_rel h"
 
-lemma get_parent_wf_is_l_get_parent_wf [instances]: 
-  "l_get_parent_wf type_wf known_ptr known_ptrs heap_is_wellformed parent_child_rel 
+lemma get_parent_wf_is_l_get_parent_wf [instances]:
+  "l_get_parent_wf type_wf known_ptr known_ptrs heap_is_wellformed parent_child_rel
   get_child_nodes get_parent"
   using known_ptrs_is_l_known_ptrs
   apply(auto simp add: l_get_parent_wf_def l_get_parent_wf_axioms_def)[1]
   using child_parent_dual heap_wellformed_induct heap_wellformed_induct_rev parent_child_rel_parent
-  by metis+ 
+  by metis+
 
 
 
 subsection \<open>get\_disconnected\_nodes\<close>
 
 
 
 subsection \<open>set\_disconnected\_nodes\<close>
 
 
 subsubsection \<open>get\_disconnected\_nodes\<close>
 
 locale l_set_disconnected_nodes_get_disconnected_nodes_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_set_disconnected_nodes_get_disconnected_nodes
-    type_wf get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes 
-    set_disconnected_nodes_locs
+  type_wf get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs
   + l_heap_is_wellformed
-    type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs 
-    get_disconnected_nodes get_disconnected_nodes_locs
+  type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
   for known_ptr :: "(_) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 
 lemma remove_from_disconnected_nodes_removes:
   assumes "heap_is_wellformed h"
   assumes "h \<turnstile> get_disconnected_nodes ptr \<rightarrow>\<^sub>r disc_nodes"
   assumes "h \<turnstile> set_disconnected_nodes ptr (remove1 node_ptr disc_nodes) \<rightarrow>\<^sub>h h'"
   assumes "h' \<turnstile> get_disconnected_nodes ptr \<rightarrow>\<^sub>r disc_nodes'"
   shows "node_ptr \<notin> set disc_nodes'"
   using assms
-  by (metis distinct_remove1_removeAll heap_is_wellformed_disconnected_nodes_distinct 
-            set_disconnected_nodes_get_disconnected_nodes member_remove remove_code(1) 
-            returns_result_eq)
+  by (metis distinct_remove1_removeAll heap_is_wellformed_disconnected_nodes_distinct
+      set_disconnected_nodes_get_disconnected_nodes member_remove remove_code(1)
+      returns_result_eq)
 end
 
 locale l_set_disconnected_nodes_get_disconnected_nodes_wf = l_heap_is_wellformed
-          + l_set_disconnected_nodes_get_disconnected_nodes +
+  + l_set_disconnected_nodes_get_disconnected_nodes +
   assumes remove_from_disconnected_nodes_removes:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes ptr \<rightarrow>\<^sub>r disc_nodes 
-                          \<Longrightarrow> h \<turnstile> set_disconnected_nodes ptr (remove1 node_ptr disc_nodes) \<rightarrow>\<^sub>h h' 
-                          \<Longrightarrow> h' \<turnstile> get_disconnected_nodes ptr \<rightarrow>\<^sub>r disc_nodes' 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_disconnected_nodes ptr \<rightarrow>\<^sub>r disc_nodes
+                          \<Longrightarrow> h \<turnstile> set_disconnected_nodes ptr (remove1 node_ptr disc_nodes) \<rightarrow>\<^sub>h h'
+                          \<Longrightarrow> h' \<turnstile> get_disconnected_nodes ptr \<rightarrow>\<^sub>r disc_nodes'
                           \<Longrightarrow> node_ptr \<notin> set disc_nodes'"
 
 interpretation i_set_disconnected_nodes_get_disconnected_nodes_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M?:
-  l_set_disconnected_nodes_get_disconnected_nodes_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M  known_ptr type_wf get_disconnected_nodes 
-  get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs heap_is_wellformed 
+  l_set_disconnected_nodes_get_disconnected_nodes_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M  known_ptr type_wf get_disconnected_nodes
+  get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs heap_is_wellformed
   parent_child_rel get_child_nodes
   using instances
   by (simp add: l_set_disconnected_nodes_get_disconnected_nodes_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_set_disconnected_nodes_get_disconnected_nodes_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
- 
+
 lemma set_disconnected_nodes_get_disconnected_nodes_wf_is_l_set_disconnected_nodes_get_disconnected_nodes_wf [instances]:
-  "l_set_disconnected_nodes_get_disconnected_nodes_wf type_wf known_ptr heap_is_wellformed parent_child_rel 
+  "l_set_disconnected_nodes_get_disconnected_nodes_wf type_wf known_ptr heap_is_wellformed parent_child_rel
    get_child_nodes get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
       set_disconnected_nodes_locs"
-  apply(auto simp add: l_set_disconnected_nodes_get_disconnected_nodes_wf_def 
-                       l_set_disconnected_nodes_get_disconnected_nodes_wf_axioms_def instances)[1]
+  apply(auto simp add: l_set_disconnected_nodes_get_disconnected_nodes_wf_def
+      l_set_disconnected_nodes_get_disconnected_nodes_wf_axioms_def instances)[1]
   using remove_from_disconnected_nodes_removes apply fast
   done
 
 
 subsection \<open>get\_root\_node\<close>
 
 locale l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_heap_is_wellformed
-    type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs 
-    get_disconnected_nodes get_disconnected_nodes_locs
+  type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
   + l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
+  known_ptr type_wf get_child_nodes get_child_nodes_locs known_ptrs get_parent get_parent_locs
   + l_get_parent_wf
-    type_wf known_ptr known_ptrs heap_is_wellformed parent_child_rel get_child_nodes 
-    get_child_nodes_locs get_parent get_parent_locs
+  type_wf known_ptr known_ptrs heap_is_wellformed parent_child_rel get_child_nodes
+  get_child_nodes_locs get_parent get_parent_locs
   + l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs 
-    get_ancestors get_ancestors_locs get_root_node get_root_node_locs
+  type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_ancestors get_ancestors_locs get_root_node get_root_node_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and known_ptrs :: "(_) heap \<Rightarrow> bool"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
-  and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
-  and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
-  and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
+    and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
+    and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
+    and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 
 begin
 lemma get_ancestors_reads:
   assumes "heap_is_wellformed h"
   shows "reads get_ancestors_locs (get_ancestors node_ptr) h h'"
 proof (insert assms(1), induct rule: heap_wellformed_induct_rev)
   case (step child)
   then show ?case
     using [[simproc del: Product_Type.unit_eq]] get_parent_reads[unfolded reads_def]
     apply(simp (no_asm) add: get_ancestors_def)
-    by(auto simp add: get_ancestors_locs_def reads_subset[OF return_reads] get_parent_reads_pointers 
-            intro!: reads_bind_pure reads_subset[OF check_in_heap_reads] 
-                    reads_subset[OF get_parent_reads] reads_subset[OF get_child_nodes_reads] 
-            split: option.splits)
+    by(auto simp add: get_ancestors_locs_def reads_subset[OF return_reads] get_parent_reads_pointers
+        intro!: reads_bind_pure reads_subset[OF check_in_heap_reads]
+        reads_subset[OF get_parent_reads] reads_subset[OF get_child_nodes_reads]
+        split: option.splits)
 qed
 
 lemma get_ancestors_ok:
   assumes "heap_is_wellformed h"
     and "ptr |\<in>| object_ptr_kinds h"
     and "known_ptrs h"
     and type_wf: "type_wf h"
   shows "h \<turnstile> ok (get_ancestors ptr)"
 proof (insert assms(1) assms(2), induct rule: heap_wellformed_induct_rev)
   case (step child)
   then show ?case
     using assms(3) assms(4)
     apply(simp (no_asm) add: get_ancestors_def)
     apply(simp add: assms(1) get_parent_parent_in_heap)
     by(auto intro!: bind_is_OK_pure_I bind_pure_I get_parent_ok split: option.splits)
 qed
 
 lemma get_root_node_ptr_in_heap:
   assumes "h \<turnstile> ok (get_root_node ptr)"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms
   unfolding get_root_node_def
   using get_ancestors_ptr_in_heap
   by auto
 
 
 lemma get_root_node_ok:
   assumes "heap_is_wellformed h" "known_ptrs h" "type_wf h"
     and "ptr |\<in>| object_ptr_kinds h"
   shows "h \<turnstile> ok (get_root_node ptr)"
   unfolding get_root_node_def
   using assms get_ancestors_ok
   by auto
 
 
 lemma get_ancestors_parent:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent"
-  shows "h \<turnstile> get_ancestors (cast child) \<rightarrow>\<^sub>r (cast child) # parent # ancestors 
+  shows "h \<turnstile> get_ancestors (cast child) \<rightarrow>\<^sub>r (cast child) # parent # ancestors
      \<longleftrightarrow> h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r parent # ancestors"
 proof
-  assume a1: "h \<turnstile> get_ancestors (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child # parent # ancestors"
+  assume a1: "h \<turnstile> get_ancestors (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r
+cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child # parent # ancestors"
   then have "h \<turnstile> Heap_Error_Monad.bind (check_in_heap (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child))
           (\<lambda>_. Heap_Error_Monad.bind (get_parent child)
-              (\<lambda>x. Heap_Error_Monad.bind (case x of None \<Rightarrow> return [] | Some x \<Rightarrow> get_ancestors x) 
+              (\<lambda>x. Heap_Error_Monad.bind (case x of None \<Rightarrow> return [] | Some x \<Rightarrow> get_ancestors x)
                (\<lambda>ancestors. return (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child # ancestors))))
         \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child # parent # ancestors"
     by(simp add: get_ancestors_def)
   then show "h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r parent # ancestors"
     using assms(2) apply(auto elim!: bind_returns_result_E2 split: option.splits)[1]
     using returns_result_eq by fastforce
 next
   assume "h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r parent # ancestors"
   then show "h \<turnstile> get_ancestors (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child # parent # ancestors"
-    using assms(2) 
+    using assms(2)
     apply(simp (no_asm) add: get_ancestors_def)
     apply(auto intro!: bind_pure_returns_result_I split: option.splits)[1]
-    by (metis (full_types) assms(2) check_in_heap_ptr_in_heap is_OK_returns_result_I 
-                           local.get_parent_ptr_in_heap node_ptr_kinds_commutes old.unit.exhaust 
-                           select_result_I)
+    by (metis (full_types) assms(2) check_in_heap_ptr_in_heap is_OK_returns_result_I
+        local.get_parent_ptr_in_heap node_ptr_kinds_commutes old.unit.exhaust
+        select_result_I)
 qed
 
 
 lemma get_ancestors_never_empty:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_ancestors child \<rightarrow>\<^sub>r ancestors"
   shows "ancestors \<noteq> []"
 proof(insert assms(2), induct arbitrary: ancestors rule: heap_wellformed_induct_rev[OF assms(1)])
   case (1 child)
   then show ?case
   proof (induct "cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child")
     case None
     then show ?case
       apply(simp add: get_ancestors_def)
       by(auto elim!: bind_returns_result_E2 split: option.splits)
   next
     case (Some child_node)
     then obtain parent_opt where parent_opt: "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r parent_opt"
       apply(simp add: get_ancestors_def)
       by(auto elim!: bind_returns_result_E2 split: option.splits)
     with Some show ?case
     proof(induct parent_opt)
       case None
-      then show ?case 
+      then show ?case
         apply(simp add: get_ancestors_def)
         by(auto elim!: bind_returns_result_E2 split: option.splits)
     next
       case (Some option)
-      then show ?case 
+      then show ?case
         apply(simp add: get_ancestors_def)
         by(auto elim!: bind_returns_result_E2 split: option.splits)
     qed
   qed
 qed
 
 
 
 lemma get_ancestors_subset:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
     and "ancestor \<in> set ancestors"
     and "h \<turnstile> get_ancestors ancestor \<rightarrow>\<^sub>r ancestor_ancestors"
-and type_wf: "type_wf h"
-and known_ptrs: "known_ptrs h"
+    and type_wf: "type_wf h"
+    and known_ptrs: "known_ptrs h"
   shows "set ancestor_ancestors \<subseteq> set ancestors"
-proof (insert assms(1) assms(2) assms(3), induct ptr arbitrary: ancestors 
-              rule: heap_wellformed_induct_rev)
+proof (insert assms(1) assms(2) assms(3), induct ptr arbitrary: ancestors
+    rule: heap_wellformed_induct_rev)
   case (step child)
   have "child |\<in>| object_ptr_kinds h"
     using get_ancestors_ptr_in_heap step(2) by auto
- (*  then have "h \<turnstile> check_in_heap child \<rightarrow>\<^sub>r ()"
+      (*  then have "h \<turnstile> check_in_heap child \<rightarrow>\<^sub>r ()"
     using returns_result_select_result by force *)
   show ?case
   proof (induct "cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child")
     case None
     then have "ancestors = [child]"
-      using step(2) step(3) 
+      using step(2) step(3)
       by(auto simp add: get_ancestors_def elim!: bind_returns_result_E2)
     show ?case
       using step(2) step(3)
       apply(auto simp add: \<open>ancestors = [child]\<close>)[1]
       using assms(4) returns_result_eq by fastforce
   next
     case (Some child_node)
     note s1 = Some
     obtain parent_opt where parent_opt: "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r parent_opt"
-      using \<open>child |\<in>| object_ptr_kinds h\<close> assms(1) Some[symmetric] get_parent_ok[OF type_wf known_ptrs]
-      by (metis (no_types, lifting) is_OK_returns_result_E known_ptrs get_parent_ok 
-                l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms node_ptr_casts_commute node_ptr_kinds_commutes)
+      using \<open>child |\<in>| object_ptr_kinds h\<close> assms(1) Some[symmetric]
+        get_parent_ok[OF type_wf known_ptrs]
+      by (metis (no_types, lifting) is_OK_returns_result_E known_ptrs get_parent_ok
+          l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms node_ptr_casts_commute node_ptr_kinds_commutes)
     then show ?case
     proof (induct parent_opt)
       case None
       then have "ancestors = [child]"
         using step(2) step(3) s1
         apply(simp add: get_ancestors_def)
         by(auto elim!: bind_returns_result_E2 split: option.splits dest: returns_result_eq)
       show ?case
         using step(2) step(3)
         apply(auto simp add: \<open>ancestors = [child]\<close>)[1]
         using assms(4) returns_result_eq by fastforce
     next
       case (Some parent)
       have "h \<turnstile> Heap_Error_Monad.bind (check_in_heap child)
           (\<lambda>_. Heap_Error_Monad.bind
                  (case cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child of None \<Rightarrow> return []
-                  | Some node_ptr \<Rightarrow> Heap_Error_Monad.bind (get_parent node_ptr) 
-                                         (\<lambda>parent_ptr_opt. case parent_ptr_opt of None \<Rightarrow> return [] 
+                  | Some node_ptr \<Rightarrow> Heap_Error_Monad.bind (get_parent node_ptr)
+                                         (\<lambda>parent_ptr_opt. case parent_ptr_opt of None \<Rightarrow> return []
                                                                         | Some x \<Rightarrow> get_ancestors x))
                  (\<lambda>ancestors. return (child # ancestors)))
     \<rightarrow>\<^sub>r  ancestors"
         using step(2)
         by(simp add: get_ancestors_def)
       moreover obtain tl_ancestors where tl_ancestors: "ancestors = child # tl_ancestors"
         using calculation
         by(auto elim!: bind_returns_result_E2 split: option.splits)
       ultimately have "h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r tl_ancestors"
         using s1 Some
         by(auto elim!: bind_returns_result_E2 split: option.splits dest: returns_result_eq)
       show ?case
-        using step(1)[OF s1[symmetric, simplified] Some \<open>h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r tl_ancestors\<close>] 
-              step(3)
+        using step(1)[OF s1[symmetric, simplified] Some \<open>h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r tl_ancestors\<close>]
+          step(3)
         apply(auto simp add: tl_ancestors)[1]
         by (metis assms(4) insert_iff list.simps(15) local.step(2) returns_result_eq tl_ancestors)
     qed
   qed
 qed
 
 lemma get_ancestors_also_parent:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_ancestors some_ptr \<rightarrow>\<^sub>r ancestors"
     and "cast child \<in> set ancestors"
     and "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent"
     and type_wf: "type_wf h"
     and known_ptrs: "known_ptrs h"
   shows "parent \<in> set ancestors"
 proof -
   obtain child_ancestors where child_ancestors: "h \<turnstile> get_ancestors (cast child) \<rightarrow>\<^sub>r child_ancestors"
-    by (meson assms(1) assms(4) get_ancestors_ok is_OK_returns_result_I known_ptrs 
-              local.get_parent_ptr_in_heap node_ptr_kinds_commutes returns_result_select_result 
-              type_wf)
+    by (meson assms(1) assms(4) get_ancestors_ok is_OK_returns_result_I known_ptrs
+        local.get_parent_ptr_in_heap node_ptr_kinds_commutes returns_result_select_result
+        type_wf)
   then have "parent \<in> set child_ancestors"
     apply(simp add: get_ancestors_def)
-    by(auto elim!: bind_returns_result_E2 split: option.splits dest!: returns_result_eq[OF assms(4)] 
-                                                                     get_ancestors_ptr)
+    by(auto elim!: bind_returns_result_E2 split: option.splits dest!: returns_result_eq[OF assms(4)]
+        get_ancestors_ptr)
   then show ?thesis
     using assms child_ancestors get_ancestors_subset by blast
 qed
 
 lemma get_ancestors_obtains_children:
   assumes "heap_is_wellformed h"
     and "ancestor \<noteq> ptr"
     and "ancestor \<in> set ancestors"
     and "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
     and type_wf: "type_wf h"
     and known_ptrs: "known_ptrs h"
-  obtains children ancestor_child where "h \<turnstile> get_child_nodes ancestor \<rightarrow>\<^sub>r children" 
+  obtains children ancestor_child where "h \<turnstile> get_child_nodes ancestor \<rightarrow>\<^sub>r children"
     and "ancestor_child \<in> set children" and "cast ancestor_child \<in> set ancestors"
 proof -
   assume 0: "(\<And>children ancestor_child.
         h \<turnstile> get_child_nodes ancestor \<rightarrow>\<^sub>r children \<Longrightarrow>
-        ancestor_child \<in> set children \<Longrightarrow> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ancestor_child \<in> set ancestors 
+        ancestor_child \<in> set children \<Longrightarrow> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ancestor_child \<in> set ancestors
         \<Longrightarrow> thesis)"
   have "\<exists>child. h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ancestor \<and> cast child \<in> set ancestors"
-  proof (insert assms(1) assms(2) assms(3) assms(4), induct ptr arbitrary: ancestors 
-                rule: heap_wellformed_induct_rev)
+  proof (insert assms(1) assms(2) assms(3) assms(4), induct ptr arbitrary: ancestors
+      rule: heap_wellformed_induct_rev)
     case (step child)
     have "child |\<in>| object_ptr_kinds h"
       using get_ancestors_ptr_in_heap step(4) by auto
     show ?case
     proof (induct "cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child")
       case None
       then have "ancestors = [child]"
         using step(3) step(4)
         by(auto simp add: get_ancestors_def elim!: bind_returns_result_E2)
       show ?case
         using step(2) step(3) step(4)
         by(auto simp add: \<open>ancestors = [child]\<close>)
     next
       case (Some child_node)
       note s1 = Some
       obtain parent_opt where parent_opt: "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r parent_opt"
         using \<open>child |\<in>| object_ptr_kinds h\<close> assms(1) Some[symmetric]
         using get_parent_ok known_ptrs type_wf
-        by (metis (no_types, lifting) is_OK_returns_result_E node_ptr_casts_commute 
-                  node_ptr_kinds_commutes) 
+        by (metis (no_types, lifting) is_OK_returns_result_E node_ptr_casts_commute
+            node_ptr_kinds_commutes)
       then show ?case
       proof (induct parent_opt)
         case None
         then have "ancestors = [child]"
           using step(2) step(3) step(4) s1
           apply(simp add: get_ancestors_def)
           by(auto elim!: bind_returns_result_E2 split: option.splits dest: returns_result_eq)
         show ?case
           using step(2) step(3) step(4)
           by(auto simp add: \<open>ancestors = [child]\<close>)
       next
         case (Some parent)
         have "h \<turnstile> Heap_Error_Monad.bind (check_in_heap child)
             (\<lambda>_. Heap_Error_Monad.bind
                    (case cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child of None \<Rightarrow> return []
-                    | Some node_ptr \<Rightarrow> Heap_Error_Monad.bind (get_parent node_ptr) 
-                       (\<lambda>parent_ptr_opt. case parent_ptr_opt of None \<Rightarrow> return [] 
+                    | Some node_ptr \<Rightarrow> Heap_Error_Monad.bind (get_parent node_ptr)
+                       (\<lambda>parent_ptr_opt. case parent_ptr_opt of None \<Rightarrow> return []
                                                               | Some x \<Rightarrow> get_ancestors x))
                    (\<lambda>ancestors. return (child # ancestors)))
       \<rightarrow>\<^sub>r  ancestors"
           using step(4)
           by(simp add: get_ancestors_def)
         moreover obtain tl_ancestors where tl_ancestors: "ancestors = child # tl_ancestors"
           using calculation
           by(auto elim!: bind_returns_result_E2 split: option.splits)
         ultimately have "h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r tl_ancestors"
           using s1 Some
           by(auto elim!: bind_returns_result_E2 split: option.splits dest: returns_result_eq)
-        (* have "ancestor \<noteq> parent" *)
+            (* have "ancestor \<noteq> parent" *)
         have "ancestor \<in> set tl_ancestors"
           using tl_ancestors step(2) step(3) by auto
         show ?case
         proof (cases "ancestor \<noteq> parent")
           case True
-          show ?thesis 
-            using step(1)[OF s1[symmetric, simplified] Some True 
-                         \<open>ancestor \<in> set tl_ancestors\<close> \<open>h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r tl_ancestors\<close>]
+          show ?thesis
+            using step(1)[OF s1[symmetric, simplified] Some True
+                \<open>ancestor \<in> set tl_ancestors\<close> \<open>h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r tl_ancestors\<close>]
             using tl_ancestors by auto
         next
           case False
           have "child \<in> set ancestors"
             using step(4) get_ancestors_ptr by simp
           then show ?thesis
             using Some False s1[symmetric] by(auto)
         qed
       qed
     qed
   qed
-  then obtain child where child: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ancestor" 
-       and in_ancestors: "cast child \<in> set ancestors"
+  then obtain child where child: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ancestor"
+    and in_ancestors: "cast child \<in> set ancestors"
     by auto
   then obtain children where
     children: "h \<turnstile> get_child_nodes ancestor \<rightarrow>\<^sub>r children" and
     child_in_children: "child \<in> set children"
     using get_parent_child_dual by blast
   show thesis
     using 0[OF children child_in_children] child assms(3) in_ancestors by blast
 qed
 
 lemma get_ancestors_parent_child_rel:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_ancestors child \<rightarrow>\<^sub>r ancestors"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
-shows "(ptr, child) \<in> (parent_child_rel h)\<^sup>* \<longleftrightarrow> ptr \<in> set ancestors"
+  shows "(ptr, child) \<in> (parent_child_rel h)\<^sup>* \<longleftrightarrow> ptr \<in> set ancestors"
 proof (safe)
   assume 3: "(ptr, child) \<in> (parent_child_rel h)\<^sup>*"
   show "ptr \<in> set ancestors"
   proof (insert 3, induct ptr rule: heap_wellformed_induct[OF assms(1)])
     case (1 ptr)
     then show ?case
     proof (cases "ptr = child")
       case True
       then show ?thesis
         by (metis (no_types, lifting) assms(2) bind_returns_result_E get_ancestors_def
-             in_set_member member_rec(1) return_returns_result)
+            in_set_member member_rec(1) return_returns_result)
     next
       case False
       obtain ptr_child where
         ptr_child: "(ptr, ptr_child) \<in> (parent_child_rel h) \<and> (ptr_child, child) \<in> (parent_child_rel h)\<^sup>*"
         using converse_rtranclE[OF 1(2)] \<open>ptr \<noteq> child\<close>
         by metis
-      then obtain ptr_child_node 
-           where ptr_child_ptr_child_node: "ptr_child = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr_child_node"
+      then obtain ptr_child_node
+        where ptr_child_ptr_child_node: "ptr_child = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr_child_node"
         using ptr_child node_ptr_casts_commute3 parent_child_rel_node_ptr
         by (metis )
       then obtain children where
         children: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children" and
         ptr_child_node: "ptr_child_node \<in> set children"
       proof -
-        assume a1: "\<And>children. \<lbrakk>h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children; ptr_child_node \<in> set children\<rbrakk> 
+        assume a1: "\<And>children. \<lbrakk>h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children; ptr_child_node \<in> set children\<rbrakk>
                    \<Longrightarrow> thesis"
-   
+
         have "ptr |\<in>| object_ptr_kinds h"
           using local.parent_child_rel_parent_in_heap ptr_child by blast
         moreover have "ptr_child_node \<in> set |h \<turnstile> get_child_nodes ptr|\<^sub>r"
-          by (metis calculation known_ptrs local.get_child_nodes_ok local.known_ptrs_known_ptr 
-                    local.parent_child_rel_child ptr_child ptr_child_ptr_child_node 
-                    returns_result_select_result type_wf)
+          by (metis calculation known_ptrs local.get_child_nodes_ok local.known_ptrs_known_ptr
+              local.parent_child_rel_child ptr_child ptr_child_ptr_child_node
+              returns_result_select_result type_wf)
         ultimately show ?thesis
           using a1 get_child_nodes_ok type_wf known_ptrs
-          by (meson local.known_ptrs_known_ptr returns_result_select_result) 
+          by (meson local.known_ptrs_known_ptr returns_result_select_result)
       qed
       moreover have "(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr_child_node, child) \<in> (parent_child_rel h)\<^sup>*"
         using ptr_child ptr_child_ptr_child_node by auto
       ultimately have "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr_child_node \<in> set ancestors"
         using 1 by auto
       moreover have "h \<turnstile> get_parent ptr_child_node \<rightarrow>\<^sub>r Some ptr"
         using assms(1) children ptr_child_node child_parent_dual
-        using known_ptrs type_wf by blast 
+        using known_ptrs type_wf by blast
       ultimately show ?thesis
         using get_ancestors_also_parent assms type_wf by blast
     qed
   qed
-  next
+next
   assume 3: "ptr \<in> set ancestors"
   show "(ptr, child) \<in> (parent_child_rel h)\<^sup>*"
   proof (insert 3, induct ptr rule: heap_wellformed_induct[OF assms(1)])
     case (1 ptr)
     then show ?case
     proof (cases "ptr = child")
       case True
       then show ?thesis
         by simp
     next
       case False
       then obtain children ptr_child_node where
         children: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children" and
         ptr_child_node: "ptr_child_node \<in> set children" and
         ptr_child_node_in_ancestors: "cast ptr_child_node \<in> set ancestors"
         using 1(2) assms(2) get_ancestors_obtains_children assms(1)
         using known_ptrs type_wf by blast
       then have "(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr_child_node, child) \<in> (parent_child_rel h)\<^sup>*"
         using 1(1) by blast
-  
+
       moreover have "(ptr, cast ptr_child_node) \<in> parent_child_rel h"
         using children ptr_child_node assms(1) parent_child_rel_child_nodes2
         using child_parent_dual known_ptrs parent_child_rel_parent type_wf
         by blast
-  
+
       ultimately show ?thesis
         by auto
     qed
   qed
 qed
 
 lemma get_root_node_parent_child_rel:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r root"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "(root, child) \<in> (parent_child_rel h)\<^sup>*"
   using assms get_ancestors_parent_child_rel
   apply(auto simp add: get_root_node_def elim!: bind_returns_result_E2)[1]
   using get_ancestors_never_empty last_in_set by blast
 
 
 lemma get_ancestors_eq:
   assumes "heap_is_wellformed h"
     and "heap_is_wellformed h'"
     and "\<And>object_ptr w. object_ptr \<noteq> ptr \<Longrightarrow> w \<in> get_child_nodes_locs object_ptr \<Longrightarrow> w h h'"
     and pointers_preserved: "\<And>object_ptr. preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr RObject.nothing) h h'"
     and known_ptrs: "known_ptrs h"
     and known_ptrs': "known_ptrs h'"
     and "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
     and type_wf: "type_wf h"
     and type_wf': "type_wf h'"
   shows "h' \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
 proof -
   have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
     using pointers_preserved object_ptr_kinds_preserved_small by blast
-  then have object_ptr_kinds_M_eq: 
-           "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+  then have object_ptr_kinds_M_eq:
+    "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_eq: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by(simp)
   have "h' \<turnstile> ok (get_ancestors ptr)"
     using get_ancestors_ok get_ancestors_ptr_in_heap object_ptr_kinds_eq3 assms(1) known_ptrs
-        known_ptrs' assms(2) assms(7) type_wf'
-      by blast
+      known_ptrs' assms(2) assms(7) type_wf'
+    by blast
   then obtain ancestors' where ancestors': "h' \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors'"
     by auto
 
   obtain root where root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   proof -
     assume 0: "(\<And>root. h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root \<Longrightarrow> thesis)"
     show thesis
       apply(rule 0)
       using assms(7)
       by(auto simp add: get_root_node_def elim!: bind_returns_result_E2 split: option.splits)
   qed
 
-  have children_eq: 
-   "\<And>p children. p \<noteq> ptr \<Longrightarrow> h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children"
+  have children_eq:
+    "\<And>p children. p \<noteq> ptr \<Longrightarrow> h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads assms(3)
     apply(simp add: reads_def reflp_def transp_def preserved_def)
     by blast
 
   have "acyclic (parent_child_rel h)"
     using assms(1) local.parent_child_rel_acyclic by auto
   have "acyclic (parent_child_rel h')"
     using assms(2) local.parent_child_rel_acyclic by blast
-  have 2: "\<And>c parent_opt. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c \<in> set ancestors \<inter> set ancestors' 
+  have 2: "\<And>c parent_opt. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c \<in> set ancestors \<inter> set ancestors'
           \<Longrightarrow> h \<turnstile> get_parent c \<rightarrow>\<^sub>r parent_opt = h' \<turnstile> get_parent c \<rightarrow>\<^sub>r parent_opt"
   proof -
     fix c parent_opt
     assume 1: " cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c \<in> set ancestors \<inter> set ancestors'"
 
     obtain ptrs where ptrs: "h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
       by simp
 
     let ?P = "(\<lambda>ptr. Heap_Error_Monad.bind (get_child_nodes ptr) (\<lambda>children. return (c \<in> set children)))"
     have children_eq_True: "\<And>p. p \<in> set ptrs \<Longrightarrow> h \<turnstile> ?P p \<rightarrow>\<^sub>r True \<longleftrightarrow> h' \<turnstile> ?P p \<rightarrow>\<^sub>r True"
     proof -
       fix p
       assume "p \<in> set ptrs"
       then show "h \<turnstile> ?P p \<rightarrow>\<^sub>r True \<longleftrightarrow> h' \<turnstile> ?P p \<rightarrow>\<^sub>r True"
       proof (cases "p = ptr")
         case True
         have "(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c, ptr) \<in> (parent_child_rel h)\<^sup>*"
-          using get_ancestors_parent_child_rel 1 assms by blast 
+          using get_ancestors_parent_child_rel 1 assms by blast
         then have "(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h)"
         proof (cases "cast c = ptr")
           case True
-          then show ?thesis 
+          then show ?thesis
             using \<open>acyclic (parent_child_rel h)\<close> by(auto simp add: acyclic_def)
         next
           case False
           then have "(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h)\<^sup>*"
-            using \<open>acyclic (parent_child_rel h)\<close> False rtrancl_eq_or_trancl rtrancl_trancl_trancl 
-                   \<open>(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c, ptr) \<in> (parent_child_rel h)\<^sup>*\<close>
+            using \<open>acyclic (parent_child_rel h)\<close> False rtrancl_eq_or_trancl rtrancl_trancl_trancl
+              \<open>(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c, ptr) \<in> (parent_child_rel h)\<^sup>*\<close>
             by (metis acyclic_def)
           then show ?thesis
             using r_into_rtrancl by auto
         qed
         obtain children where children: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
-          using type_wf 
-          by (metis \<open>h' \<turnstile> ok get_ancestors ptr\<close> assms(1) get_ancestors_ptr_in_heap get_child_nodes_ok 
-                    heap_is_wellformed_def is_OK_returns_result_E known_ptrs local.known_ptrs_known_ptr 
-                    object_ptr_kinds_eq3)
+          using type_wf
+          by (metis \<open>h' \<turnstile> ok get_ancestors ptr\<close> assms(1) get_ancestors_ptr_in_heap get_child_nodes_ok
+              heap_is_wellformed_def is_OK_returns_result_E known_ptrs local.known_ptrs_known_ptr
+              object_ptr_kinds_eq3)
         then have "c \<notin> set children"
           using \<open>(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h)\<close> assms(1)
           using parent_child_rel_child_nodes2
           using child_parent_dual known_ptrs parent_child_rel_parent
-          type_wf by blast
+            type_wf by blast
         with children have "h \<turnstile> ?P p \<rightarrow>\<^sub>r False"
           by(auto simp add: True)
 
         moreover have "(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c, ptr) \<in> (parent_child_rel h')\<^sup>*"
-          using get_ancestors_parent_child_rel assms(2) ancestors' 1 known_ptrs' type_wf 
-          type_wf' by blast
+          using get_ancestors_parent_child_rel assms(2) ancestors' 1 known_ptrs' type_wf
+            type_wf' by blast
         then have "(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h')"
         proof (cases "cast c = ptr")
           case True
-          then show ?thesis 
+          then show ?thesis
             using \<open>acyclic (parent_child_rel h')\<close> by(auto simp add: acyclic_def)
         next
           case False
           then have "(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h')\<^sup>*"
             using \<open>acyclic (parent_child_rel h')\<close> False rtrancl_eq_or_trancl rtrancl_trancl_trancl
-                         \<open>(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c, ptr) \<in> (parent_child_rel h')\<^sup>*\<close>
+              \<open>(cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c, ptr) \<in> (parent_child_rel h')\<^sup>*\<close>
             by (metis acyclic_def)
           then show ?thesis
             using r_into_rtrancl by auto
         qed
         then have "(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h')"
           using r_into_rtrancl by auto
         obtain children' where children': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
-          using  type_wf  type_wf' 
-          by (meson \<open>h' \<turnstile> ok (get_ancestors ptr)\<close> assms(2) get_ancestors_ptr_in_heap 
-                          get_child_nodes_ok is_OK_returns_result_E known_ptrs' 
-                          local.known_ptrs_known_ptr)
+          using  type_wf  type_wf'
+          by (meson \<open>h' \<turnstile> ok (get_ancestors ptr)\<close> assms(2) get_ancestors_ptr_in_heap
+              get_child_nodes_ok is_OK_returns_result_E known_ptrs'
+              local.known_ptrs_known_ptr)
         then have "c \<notin> set children'"
-          using \<open>(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h')\<close> assms(2)  type_wf  type_wf' 
+          using \<open>(ptr, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<notin> (parent_child_rel h')\<close> assms(2)  type_wf  type_wf'
           using parent_child_rel_child_nodes2 child_parent_dual known_ptrs' parent_child_rel_parent
           by auto
         with children' have "h' \<turnstile> ?P p \<rightarrow>\<^sub>r False"
           by(auto simp add: True)
 
         ultimately show ?thesis
           by (metis returns_result_eq)
       next
         case False
         then show ?thesis
           using children_eq ptrs
-          by (metis (no_types, lifting) bind_pure_returns_result_I bind_returns_result_E 
-                get_child_nodes_pure return_returns_result)
+          by (metis (no_types, lifting) bind_pure_returns_result_I bind_returns_result_E
+              get_child_nodes_pure return_returns_result)
       qed
     qed
-    have "\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> ok (get_child_nodes pa 
-                     \<bind> (\<lambda>children. return (c \<in> set children))) = h' \<turnstile> ok ( get_child_nodes pa 
+    have "\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> ok (get_child_nodes pa
+                     \<bind> (\<lambda>children. return (c \<in> set children))) = h' \<turnstile> ok ( get_child_nodes pa
                      \<bind> (\<lambda>children. return (c \<in> set children)))"
-      using assms(1) assms(2) object_ptr_kinds_eq ptrs type_wf  type_wf' 
-      by (metis (no_types, lifting) ObjectMonad.ptr_kinds_ptr_kinds_M bind_is_OK_pure_I 
-                                    get_child_nodes_ok get_child_nodes_pure known_ptrs' 
-                                    local.known_ptrs_known_ptr return_ok select_result_I2) 
-    have children_eq_False: 
-         "\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> get_child_nodes pa 
-                  \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False = h' \<turnstile> get_child_nodes pa 
+      using assms(1) assms(2) object_ptr_kinds_eq ptrs type_wf  type_wf'
+      by (metis (no_types, lifting) ObjectMonad.ptr_kinds_ptr_kinds_M bind_is_OK_pure_I
+          get_child_nodes_ok get_child_nodes_pure known_ptrs'
+          local.known_ptrs_known_ptr return_ok select_result_I2)
+    have children_eq_False:
+      "\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> get_child_nodes pa
+                  \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False = h' \<turnstile> get_child_nodes pa
                   \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
     proof
       fix pa
-      assume "pa \<in> set ptrs" 
-          and "h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
-      have "h \<turnstile> ok (get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children))) 
+      assume "pa \<in> set ptrs"
+        and "h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
+      have "h \<turnstile> ok (get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)))
            \<Longrightarrow> h' \<turnstile> ok ( get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)))"
-        using \<open>pa \<in> set ptrs\<close> \<open>\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> ok (get_child_nodes pa 
-                    \<bind> (\<lambda>children. return (c \<in> set children))) = h' \<turnstile> ok ( get_child_nodes pa 
-                    \<bind> (\<lambda>children. return (c \<in> set children)))\<close> 
+        using \<open>pa \<in> set ptrs\<close> \<open>\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> ok (get_child_nodes pa
+                    \<bind> (\<lambda>children. return (c \<in> set children))) = h' \<turnstile> ok ( get_child_nodes pa
+                    \<bind> (\<lambda>children. return (c \<in> set children)))\<close>
         by auto
-      moreover have "h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False 
+      moreover have "h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False
         \<Longrightarrow> h' \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
-        by (metis (mono_tags, lifting) \<open>\<And>pa. pa \<in> set ptrs 
-              \<Longrightarrow> h \<turnstile> get_child_nodes pa 
-                  \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True = h' \<turnstile> get_child_nodes pa 
-                  \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True\<close> \<open>pa \<in> set ptrs\<close> 
-                calculation is_OK_returns_result_I returns_result_eq returns_result_select_result)
+        by (metis (mono_tags, lifting) \<open>\<And>pa. pa \<in> set ptrs
+              \<Longrightarrow> h \<turnstile> get_child_nodes pa
+                  \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True = h' \<turnstile> get_child_nodes pa
+                  \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True\<close> \<open>pa \<in> set ptrs\<close>
+            calculation is_OK_returns_result_I returns_result_eq returns_result_select_result)
       ultimately show "h' \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
         using \<open>h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False\<close>
         by auto
     next
       fix pa
-      assume "pa \<in> set ptrs" 
+      assume "pa \<in> set ptrs"
         and "h' \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
-      have "h' \<turnstile> ok (get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children))) 
+      have "h' \<turnstile> ok (get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)))
             \<Longrightarrow> h \<turnstile> ok ( get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)))"
-        using \<open>pa \<in> set ptrs\<close> \<open>\<And>pa. pa \<in> set ptrs 
-              \<Longrightarrow> h \<turnstile> ok (get_child_nodes pa 
-                  \<bind> (\<lambda>children. return (c \<in> set children))) = h' \<turnstile> ok ( get_child_nodes pa 
-                  \<bind> (\<lambda>children. return (c \<in> set children)))\<close> 
+        using \<open>pa \<in> set ptrs\<close> \<open>\<And>pa. pa \<in> set ptrs
+              \<Longrightarrow> h \<turnstile> ok (get_child_nodes pa
+                  \<bind> (\<lambda>children. return (c \<in> set children))) = h' \<turnstile> ok ( get_child_nodes pa
+                  \<bind> (\<lambda>children. return (c \<in> set children)))\<close>
         by auto
-      moreover have "h' \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False 
+      moreover have "h' \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False
                   \<Longrightarrow> h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
-        by (metis (mono_tags, lifting) 
-             \<open>\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> get_child_nodes pa 
-                        \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True = h' \<turnstile> get_child_nodes pa 
-                        \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True\<close> \<open>pa \<in> set ptrs\<close> 
-               calculation is_OK_returns_result_I returns_result_eq returns_result_select_result)
+        by (metis (mono_tags, lifting)
+            \<open>\<And>pa. pa \<in> set ptrs \<Longrightarrow> h \<turnstile> get_child_nodes pa
+                        \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True = h' \<turnstile> get_child_nodes pa
+                        \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r True\<close> \<open>pa \<in> set ptrs\<close>
+            calculation is_OK_returns_result_I returns_result_eq returns_result_select_result)
       ultimately show "h \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False"
         using \<open>h' \<turnstile> get_child_nodes pa \<bind> (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r False\<close> by blast
     qed
 
     have filter_eq: "\<And>xs. h \<turnstile> filter_M ?P ptrs \<rightarrow>\<^sub>r xs = h' \<turnstile> filter_M ?P ptrs \<rightarrow>\<^sub>r xs"
     proof (rule filter_M_eq)
-      show 
-      "\<And>xs x. pure (Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children))) h"
+      show
+        "\<And>xs x. pure (Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children))) h"
         by(auto intro!: bind_pure_I)
     next
-      show 
-      "\<And>xs x. pure (Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children))) h'"
+      show
+        "\<And>xs x. pure (Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children))) h'"
         by(auto intro!: bind_pure_I)
     next
       fix xs b x
       assume 0: "x \<in> set ptrs"
-      then show "h \<turnstile> Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r b 
+      then show "h \<turnstile> Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r b
               = h' \<turnstile> Heap_Error_Monad.bind (get_child_nodes x) (\<lambda>children. return (c \<in> set children)) \<rightarrow>\<^sub>r b"
         apply(induct b)
         using children_eq_True apply blast
         using children_eq_False apply blast
         done
     qed
 
     show "h \<turnstile> get_parent c \<rightarrow>\<^sub>r parent_opt = h' \<turnstile> get_parent c \<rightarrow>\<^sub>r parent_opt"
       apply(simp add: get_parent_def)
       apply(rule bind_cong_2)
          apply(simp)
         apply(simp)
        apply(simp add: check_in_heap_def node_ptr_kinds_def object_ptr_kinds_eq3)
       apply(rule bind_cong_2)
          apply(auto simp add: object_ptr_kinds_M_eq object_ptr_kinds_eq3)[1]
         apply(auto simp add: object_ptr_kinds_M_eq object_ptr_kinds_eq3)[1]
        apply(auto simp add: object_ptr_kinds_M_eq object_ptr_kinds_eq3)[1]
       apply(rule bind_cong_2)
          apply(auto intro!: filter_M_pure_I bind_pure_I)[1]
         apply(auto intro!: filter_M_pure_I bind_pure_I)[1]
-       apply(auto simp add: filter_eq (* dest!: returns_result_eq[OF ptrs] *))
+       apply(auto simp add: filter_eq (* dest!: returns_result_eq[OF ptrs] *))[1]
       using filter_eq ptrs apply auto[1]
       using filter_eq ptrs by auto
   qed
 
   have "ancestors = ancestors'"
-  proof(insert assms(1) assms(7) ancestors' 2, induct ptr arbitrary: ancestors ancestors' 
-               rule: heap_wellformed_induct_rev)
+  proof(insert assms(1) assms(7) ancestors' 2, induct ptr arbitrary: ancestors ancestors'
+      rule: heap_wellformed_induct_rev)
     case (step child)
     show ?case
       using step(2) step(3) step(4)
       apply(simp add: get_ancestors_def)
       apply(auto intro!: elim!: bind_returns_result_E2 split: option.splits)[1]
       using returns_result_eq apply fastforce
-      apply (meson option.simps(3) returns_result_eq)
+       apply (meson option.simps(3) returns_result_eq)
       by (metis IntD1 IntD2 option.inject returns_result_eq step.hyps)
   qed
   then show ?thesis
     using assms(5) ancestors'
     by simp
 qed
 
 lemma get_ancestors_remains_not_in_ancestors:
   assumes "heap_is_wellformed h"
     and "heap_is_wellformed h'"
     and "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
     and "h' \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors'"
-    and "\<And>p children children'. h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children 
+    and "\<And>p children children'. h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children
         \<Longrightarrow> h' \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children' \<Longrightarrow> set children' \<subseteq> set children"
     and "node \<notin> set ancestors"
     and object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
     and type_wf': "type_wf h'"
   shows "node \<notin> set ancestors'"
 proof -
-  have object_ptr_kinds_M_eq: 
+  have object_ptr_kinds_M_eq:
     "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     using object_ptr_kinds_eq3
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_eq: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by(simp)
 
   show ?thesis
-  proof (insert assms(1) assms(3) assms(4) assms(6), induct ptr arbitrary: ancestors ancestors' 
-        rule: heap_wellformed_induct_rev)
+  proof (insert assms(1) assms(3) assms(4) assms(6), induct ptr arbitrary: ancestors ancestors'
+      rule: heap_wellformed_induct_rev)
     case (step child)
     have 1: "\<And>p parent. h' \<turnstile> get_parent p \<rightarrow>\<^sub>r Some parent \<Longrightarrow> h \<turnstile> get_parent p \<rightarrow>\<^sub>r Some parent"
     proof -
       fix p parent
       assume "h' \<turnstile> get_parent p \<rightarrow>\<^sub>r Some parent"
       then obtain children' where
         children': "h' \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children'" and
         p_in_children': "p \<in> set children'"
         using get_parent_child_dual by blast
       obtain children where children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
-        using get_child_nodes_ok assms(1) get_child_nodes_ptr_in_heap object_ptr_kinds_eq children' 
-              known_ptrs
+        using get_child_nodes_ok assms(1) get_child_nodes_ptr_in_heap object_ptr_kinds_eq children'
+          known_ptrs
         using  type_wf type_wf'
-        by (metis \<open>h' \<turnstile> get_parent p \<rightarrow>\<^sub>r Some parent\<close> get_parent_parent_in_heap is_OK_returns_result_E 
-                  local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+        by (metis \<open>h' \<turnstile> get_parent p \<rightarrow>\<^sub>r Some parent\<close> get_parent_parent_in_heap is_OK_returns_result_E
+            local.known_ptrs_known_ptr object_ptr_kinds_eq3)
       have "p \<in> set children"
         using assms(5) children children' p_in_children'
         by blast
       then show "h \<turnstile> get_parent p \<rightarrow>\<^sub>r Some parent"
         using child_parent_dual assms(1) children known_ptrs  type_wf  by blast
     qed
     have "node \<noteq> child"
-      using assms(1) get_ancestors_parent_child_rel step.prems(1) step.prems(3) known_ptrs 
+      using assms(1) get_ancestors_parent_child_rel step.prems(1) step.prems(3) known_ptrs
       using type_wf type_wf'
       by blast
     then show ?case
       using step(2) step(3)
       apply(simp add: get_ancestors_def)
-      using step(4) 
+      using step(4)
       apply(auto elim!: bind_returns_result_E2 split: option.splits)[1]
       using 1
        apply (meson option.distinct(1) returns_result_eq)
       by (metis "1" option.inject returns_result_eq step.hyps)
   qed
 qed
 
 lemma get_ancestors_ptrs_in_heap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
   assumes "ptr' \<in> set ancestors"
   shows "ptr' |\<in>| object_ptr_kinds h"
 proof (insert assms(4) assms(5), induct ancestors arbitrary: ptr)
   case Nil
   then show ?case
     by(auto)
 next
   case (Cons a ancestors)
   then obtain x where x: "h \<turnstile> get_ancestors x \<rightarrow>\<^sub>r a # ancestors"
     by(auto simp add: get_ancestors_def[of a] elim!: bind_returns_result_E2 split: option.splits)
   then have "x = a"
     by(auto simp add: get_ancestors_def[of x] elim!: bind_returns_result_E2 split: option.splits)
   then show ?case
     using Cons.hyps Cons.prems(2) get_ancestors_ptr_in_heap x
-    by (metis assms(1) assms(2) assms(3) get_ancestors_obtains_children get_child_nodes_ptr_in_heap 
-              is_OK_returns_result_I)
+    by (metis assms(1) assms(2) assms(3) get_ancestors_obtains_children get_child_nodes_ptr_in_heap
+        is_OK_returns_result_I)
 qed
 
 
 lemma get_ancestors_prefix:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
   assumes "ptr' \<in> set ancestors"
   assumes "h \<turnstile> get_ancestors ptr' \<rightarrow>\<^sub>r ancestors'"
   shows "\<exists>pre. ancestors = pre @ ancestors'"
-proof (insert assms(1) assms(5) assms(6), induct ptr' arbitrary: ancestors' 
-       rule: heap_wellformed_induct)
+proof (insert assms(1) assms(5) assms(6), induct ptr' arbitrary: ancestors'
+    rule: heap_wellformed_induct)
   case (step parent)
   then show ?case
   proof (cases "parent \<noteq> ptr" )
     case True
 
-    then obtain children ancestor_child where "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children" 
-          and "ancestor_child \<in> set children" and "cast ancestor_child \<in> set ancestors"
-    using assms(1) assms(2) assms(3) assms(4) get_ancestors_obtains_children step.prems(1) by blast
-  then have "h \<turnstile> get_parent ancestor_child \<rightarrow>\<^sub>r Some parent"
-    using assms(1) assms(2) assms(3) child_parent_dual by blast
-  then have "h \<turnstile> get_ancestors (cast ancestor_child) \<rightarrow>\<^sub>r cast ancestor_child # ancestors'"
-    apply(simp add: get_ancestors_def)
-    using \<open>h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r ancestors'\<close> get_parent_ptr_in_heap
-    by(auto simp add: check_in_heap_def is_OK_returns_result_I intro!: bind_pure_returns_result_I)
-  then show ?thesis 
-    using step(1) \<open>h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children\<close> \<open>ancestor_child \<in> set children\<close> 
-      \<open>cast ancestor_child \<in> set ancestors\<close> \<open>h \<turnstile> get_ancestors (cast ancestor_child) \<rightarrow>\<^sub>r cast ancestor_child # ancestors'\<close>
-    by fastforce
+    then obtain children ancestor_child where "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
+      and "ancestor_child \<in> set children" and "cast ancestor_child \<in> set ancestors"
+      using assms(1) assms(2) assms(3) assms(4) get_ancestors_obtains_children step.prems(1) by blast
+    then have "h \<turnstile> get_parent ancestor_child \<rightarrow>\<^sub>r Some parent"
+      using assms(1) assms(2) assms(3) child_parent_dual by blast
+    then have "h \<turnstile> get_ancestors (cast ancestor_child) \<rightarrow>\<^sub>r cast ancestor_child # ancestors'"
+      apply(simp add: get_ancestors_def)
+      using \<open>h \<turnstile> get_ancestors parent \<rightarrow>\<^sub>r ancestors'\<close> get_parent_ptr_in_heap
+      by(auto simp add: check_in_heap_def is_OK_returns_result_I intro!: bind_pure_returns_result_I)
+    then show ?thesis
+      using step(1) \<open>h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children\<close> \<open>ancestor_child \<in> set children\<close>
+        \<open>cast ancestor_child \<in> set ancestors\<close>
+        \<open>h \<turnstile> get_ancestors (cast ancestor_child) \<rightarrow>\<^sub>r cast ancestor_child # ancestors'\<close>
+      by fastforce
   next
     case False
     then show ?thesis
       by (metis append_Nil assms(4) returns_result_eq step.prems(2))
   qed
 qed
 
 
 lemma get_ancestors_same_root_node:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors"
   assumes "ptr' \<in> set ancestors"
   assumes "ptr'' \<in> set ancestors"
   shows "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr \<longleftrightarrow> h \<turnstile> get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr"
 proof -
   have "ptr' |\<in>| object_ptr_kinds h"
-    by (metis assms(1) assms(2) assms(3) assms(4) assms(5) get_ancestors_obtains_children 
-              get_ancestors_ptr_in_heap get_child_nodes_ptr_in_heap is_OK_returns_result_I)
+    by (metis assms(1) assms(2) assms(3) assms(4) assms(5) get_ancestors_obtains_children
+        get_ancestors_ptr_in_heap get_child_nodes_ptr_in_heap is_OK_returns_result_I)
   then obtain ancestors' where ancestors': "h \<turnstile> get_ancestors ptr' \<rightarrow>\<^sub>r ancestors'"
     by (meson assms(1) assms(2) assms(3) get_ancestors_ok is_OK_returns_result_E)
   then have "\<exists>pre. ancestors = pre @ ancestors'"
     using get_ancestors_prefix assms by blast
   moreover have "ptr'' |\<in>| object_ptr_kinds h"
-    by (metis assms(1) assms(2) assms(3) assms(4) assms(6) get_ancestors_obtains_children 
-              get_ancestors_ptr_in_heap get_child_nodes_ptr_in_heap is_OK_returns_result_I)
+    by (metis assms(1) assms(2) assms(3) assms(4) assms(6) get_ancestors_obtains_children
+        get_ancestors_ptr_in_heap get_child_nodes_ptr_in_heap is_OK_returns_result_I)
   then obtain ancestors'' where ancestors'': "h \<turnstile> get_ancestors ptr'' \<rightarrow>\<^sub>r ancestors''"
     by (meson assms(1) assms(2) assms(3) get_ancestors_ok is_OK_returns_result_E)
   then have "\<exists>pre. ancestors = pre @ ancestors''"
     using get_ancestors_prefix assms by blast
   ultimately show ?thesis
     using ancestors' ancestors''
-    apply(auto simp add: get_root_node_def elim!: bind_returns_result_E2 
+    apply(auto simp add: get_root_node_def elim!: bind_returns_result_E2
         intro!: bind_pure_returns_result_I)[1]
-     apply (metis (no_types, lifting) assms(1) get_ancestors_never_empty last_appendR 
-                                      returns_result_eq)
+     apply (metis (no_types, lifting) assms(1) get_ancestors_never_empty last_appendR
+        returns_result_eq)
     by (metis assms(1) get_ancestors_never_empty last_appendR returns_result_eq)
 qed
 
 lemma get_root_node_parent_same:
   assumes "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr"
   shows "h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root \<longleftrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
 proof
   assume 1: " h \<turnstile> get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root"
   show "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
     using 1[unfolded get_root_node_def] assms
     apply(simp add: get_ancestors_def)
-    apply(auto simp add: get_root_node_def dest: returns_result_eq elim!: bind_returns_result_E2 
+    apply(auto simp add: get_root_node_def dest: returns_result_eq elim!: bind_returns_result_E2
         intro!: bind_pure_returns_result_I split: option.splits)[1]
     using returns_result_eq apply fastforce
     using get_ancestors_ptr by fastforce
 next
   assume 1: " h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   show "h \<turnstile> get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root"
     apply(simp add: get_root_node_def)
     using assms 1
     apply(simp add: get_ancestors_def)
-    apply(auto simp add: get_root_node_def dest: returns_result_eq elim!: bind_returns_result_E2 
-               intro!: bind_pure_returns_result_I split: option.splits)[1]
+    apply(auto simp add: get_root_node_def dest: returns_result_eq elim!: bind_returns_result_E2
+        intro!: bind_pure_returns_result_I split: option.splits)[1]
      apply (simp add: check_in_heap_def is_OK_returns_result_I)
     using get_ancestors_ptr get_parent_ptr_in_heap
     apply (simp add: is_OK_returns_result_I)
     by (meson list.distinct(1) list.set_cases local.get_ancestors_ptr)
 qed
 
 lemma get_root_node_same_no_parent:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r cast child"
   shows "h \<turnstile> get_parent child \<rightarrow>\<^sub>r None"
 proof (insert assms(1) assms(4), induct ptr rule: heap_wellformed_induct_rev)
   case (step c)
   then show ?case
   proof (cases "cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r c")
     case None
     then have "c = cast child"
       using step(2)
       by(auto simp add: get_root_node_def get_ancestors_def[of c] elim!: bind_returns_result_E2)
     then show ?thesis
       using None by auto
   next
     case (Some child_node)
     note s = this
     then obtain parent_opt where parent_opt: "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r parent_opt"
-      by (metis (no_types, lifting) assms(2) assms(3) get_root_node_ptr_in_heap 
-                is_OK_returns_result_I local.get_parent_ok node_ptr_casts_commute 
-                node_ptr_kinds_commutes returns_result_select_result step.prems)
+      by (metis (no_types, lifting) assms(2) assms(3) get_root_node_ptr_in_heap
+          is_OK_returns_result_I local.get_parent_ok node_ptr_casts_commute
+          node_ptr_kinds_commutes returns_result_select_result step.prems)
     then show ?thesis
     proof(induct parent_opt)
       case None
       then show ?case
         using Some get_root_node_no_parent returns_result_eq step.prems by fastforce
     next
       case (Some parent)
       then show ?case
         using step s
-        apply(auto simp add: get_root_node_def get_ancestors_def[of c] 
-                   elim!: bind_returns_result_E2 split: option.splits list.splits)[1]
+        apply(auto simp add: get_root_node_def get_ancestors_def[of c]
+            elim!: bind_returns_result_E2 split: option.splits list.splits)[1]
         using get_root_node_parent_same step.hyps step.prems by auto
     qed
   qed
 qed
 
 lemma get_root_node_not_node_same:
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "\<not>is_node_ptr_kind ptr"
   shows "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r ptr"
   using assms
   apply(simp add: get_root_node_def get_ancestors_def)
-  by(auto simp add: get_root_node_def dest: returns_result_eq elim!: bind_returns_result_E2 
-          intro!: bind_pure_returns_result_I split: option.splits)
+  by(auto simp add: get_root_node_def dest: returns_result_eq elim!: bind_returns_result_E2
+      intro!: bind_pure_returns_result_I split: option.splits)
 
 
 lemma get_root_node_root_in_heap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   shows "root |\<in>| object_ptr_kinds h"
   using assms
   apply(auto simp add: get_root_node_def elim!: bind_returns_result_E2)[1]
   by (simp add: get_ancestors_never_empty get_ancestors_ptrs_in_heap)
 
 
 lemma get_root_node_same_no_parent_parent_child_rel:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r ptr'"
   shows "\<not>(\<exists>p. (p, ptr') \<in> (parent_child_rel h))"
-  by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) get_root_node_same_no_parent 
-            l_heap_is_wellformed.parent_child_rel_child local.child_parent_dual local.get_child_nodes_ok 
-            local.known_ptrs_known_ptr local.l_heap_is_wellformed_axioms local.parent_child_rel_node_ptr
-            local.parent_child_rel_parent_in_heap node_ptr_casts_commute3 option.simps(3) returns_result_eq 
-            returns_result_select_result)
+  by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) get_root_node_same_no_parent
+      l_heap_is_wellformed.parent_child_rel_child local.child_parent_dual local.get_child_nodes_ok
+      local.known_ptrs_known_ptr local.l_heap_is_wellformed_axioms local.parent_child_rel_node_ptr
+      local.parent_child_rel_parent_in_heap node_ptr_casts_commute3 option.simps(3) returns_result_eq
+      returns_result_select_result)
 
 end
 
 
-locale l_get_ancestors_wf = l_heap_is_wellformed_defs + l_known_ptrs + l_type_wf + l_get_ancestors_defs 
-                          + l_get_child_nodes_defs + l_get_parent_defs +
+locale l_get_ancestors_wf = l_heap_is_wellformed_defs + l_known_ptrs + l_type_wf + l_get_ancestors_defs
+  + l_get_child_nodes_defs + l_get_parent_defs +
   assumes get_ancestors_never_empty:
     "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_ancestors child \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ancestors \<noteq> []"
   assumes get_ancestors_ok:
-    "heap_is_wellformed h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h 
+    "heap_is_wellformed h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h
                           \<Longrightarrow> h \<turnstile> ok (get_ancestors ptr)"
   assumes get_ancestors_reads:
     "heap_is_wellformed h \<Longrightarrow> reads get_ancestors_locs (get_ancestors node_ptr) h h'"
-  assumes get_ancestors_ptrs_in_heap: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                          \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ptr' \<in> set ancestors 
+  assumes get_ancestors_ptrs_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                          \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ptr' \<in> set ancestors
                           \<Longrightarrow> ptr' |\<in>| object_ptr_kinds h"
   assumes get_ancestors_remains_not_in_ancestors:
-    "heap_is_wellformed h \<Longrightarrow> heap_is_wellformed h' \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors 
-                          \<Longrightarrow> h' \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors' 
-                          \<Longrightarrow> (\<And>p children children'. h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children 
-                               \<Longrightarrow> h' \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children' 
-                               \<Longrightarrow> set children' \<subseteq> set children) 
-                          \<Longrightarrow> node \<notin> set ancestors 
-                          \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> known_ptrs h 
+    "heap_is_wellformed h \<Longrightarrow> heap_is_wellformed h' \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors
+                          \<Longrightarrow> h' \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors'
+                          \<Longrightarrow> (\<And>p children children'. h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children
+                               \<Longrightarrow> h' \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children'
+                               \<Longrightarrow> set children' \<subseteq> set children)
+                          \<Longrightarrow> node \<notin> set ancestors
+                          \<Longrightarrow> object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> type_wf h \<Longrightarrow> type_wf h' \<Longrightarrow> node \<notin> set ancestors'"
   assumes get_ancestors_also_parent:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_ancestors some_ptr \<rightarrow>\<^sub>r ancestors 
-                          \<Longrightarrow> cast child_node \<in> set ancestors 
-                          \<Longrightarrow> h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent \<Longrightarrow> type_wf h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_ancestors some_ptr \<rightarrow>\<^sub>r ancestors
+                          \<Longrightarrow> cast child_node \<in> set ancestors
+                          \<Longrightarrow> h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent \<Longrightarrow> type_wf h
                           \<Longrightarrow> known_ptrs h \<Longrightarrow> parent \<in> set ancestors"
   assumes get_ancestors_obtains_children:
-    "heap_is_wellformed h \<Longrightarrow> ancestor \<noteq> ptr \<Longrightarrow> ancestor \<in> set ancestors 
-                          \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                          \<Longrightarrow> (\<And>children ancestor_child . h \<turnstile> get_child_nodes ancestor \<rightarrow>\<^sub>r children 
-                               \<Longrightarrow> ancestor_child \<in> set children 
-                               \<Longrightarrow> cast ancestor_child \<in> set ancestors 
-                               \<Longrightarrow> thesis) 
+    "heap_is_wellformed h \<Longrightarrow> ancestor \<noteq> ptr \<Longrightarrow> ancestor \<in> set ancestors
+                          \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                          \<Longrightarrow> (\<And>children ancestor_child . h \<turnstile> get_child_nodes ancestor \<rightarrow>\<^sub>r children
+                               \<Longrightarrow> ancestor_child \<in> set children
+                               \<Longrightarrow> cast ancestor_child \<in> set ancestors
+                               \<Longrightarrow> thesis)
                           \<Longrightarrow> thesis"
   assumes get_ancestors_parent_child_rel:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_ancestors child \<rightarrow>\<^sub>r ancestors \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> get_ancestors child \<rightarrow>\<^sub>r ancestors \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h
                           \<Longrightarrow> (ptr, child) \<in> (parent_child_rel h)\<^sup>* \<longleftrightarrow> ptr \<in> set ancestors"
 
-locale l_get_root_node_wf = l_heap_is_wellformed_defs + l_get_root_node_defs + l_type_wf 
-                          + l_known_ptrs + l_get_ancestors_defs + l_get_parent_defs +
-  assumes get_root_node_ok: 
-    "heap_is_wellformed h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h 
+locale l_get_root_node_wf = l_heap_is_wellformed_defs + l_get_root_node_defs + l_type_wf
+  + l_known_ptrs + l_get_ancestors_defs + l_get_parent_defs +
+  assumes get_root_node_ok:
+    "heap_is_wellformed h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
                           \<Longrightarrow> h \<turnstile> ok (get_root_node ptr)"
-  assumes get_root_node_ptr_in_heap: 
+  assumes get_root_node_ptr_in_heap:
     "h \<turnstile> ok (get_root_node ptr) \<Longrightarrow> ptr |\<in>| object_ptr_kinds h"
-  assumes get_root_node_root_in_heap: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
+  assumes get_root_node_root_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root \<Longrightarrow> root |\<in>| object_ptr_kinds h"
-  assumes get_ancestors_same_root_node: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                          \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ptr' \<in> set ancestors 
-                          \<Longrightarrow> ptr'' \<in> set ancestors 
+  assumes get_ancestors_same_root_node:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                          \<Longrightarrow> h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ptr' \<in> set ancestors
+                          \<Longrightarrow> ptr'' \<in> set ancestors
                           \<Longrightarrow> h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr \<longleftrightarrow> h \<turnstile> get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr"
-  assumes get_root_node_same_no_parent: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
+  assumes get_root_node_same_no_parent:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r cast child \<Longrightarrow> h \<turnstile> get_parent child \<rightarrow>\<^sub>r None"
-  assumes get_root_node_parent_same: 
-    "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr 
+  assumes get_root_node_parent_same:
+    "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some ptr
         \<Longrightarrow> h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root \<longleftrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
 
 interpretation i_get_root_node_wf?:
-  l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf known_ptrs heap_is_wellformed parent_child_rel 
-  get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs 
+  l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf known_ptrs heap_is_wellformed parent_child_rel
+  get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
   get_parent get_parent_locs get_ancestors get_ancestors_locs get_root_node get_root_node_locs
   using instances
   by(simp add: l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 lemma get_ancestors_wf_is_l_get_ancestors_wf [instances]:
-  "l_get_ancestors_wf heap_is_wellformed parent_child_rel known_ptr known_ptrs type_wf get_ancestors 
+  "l_get_ancestors_wf heap_is_wellformed parent_child_rel known_ptr known_ptrs type_wf get_ancestors
   get_ancestors_locs get_child_nodes get_parent"
   using known_ptrs_is_l_known_ptrs
   apply(auto simp add: l_get_ancestors_wf_def l_get_ancestors_wf_axioms_def)[1]
   using get_ancestors_never_empty apply blast
   using get_ancestors_ok apply blast
   using get_ancestors_reads apply blast
   using get_ancestors_ptrs_in_heap apply blast
   using get_ancestors_remains_not_in_ancestors apply blast
   using get_ancestors_also_parent apply blast
   using get_ancestors_obtains_children apply blast
   using get_ancestors_parent_child_rel apply blast
   using get_ancestors_parent_child_rel apply blast
   done
 
 lemma get_root_node_wf_is_l_get_root_node_wf [instances]:
-  "l_get_root_node_wf heap_is_wellformed get_root_node type_wf known_ptr known_ptrs 
+  "l_get_root_node_wf heap_is_wellformed get_root_node type_wf known_ptr known_ptrs
    get_ancestors get_parent"
   using known_ptrs_is_l_known_ptrs
   apply(auto simp add: l_get_root_node_wf_def l_get_root_node_wf_axioms_def)[1]
   using get_root_node_ok apply blast
   using get_root_node_ptr_in_heap apply blast
   using get_root_node_root_in_heap apply blast
   using get_ancestors_same_root_node apply(blast, blast)
   using get_root_node_same_no_parent apply blast
   using get_root_node_parent_same apply (blast, blast)
   done
 
 
 subsection \<open>to\_tree\_order\<close>
 
-locale l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M = 
+locale l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_parent +
   l_get_parent_wf +
   l_heap_is_wellformed
   (* l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M *)
 begin
 
 lemma to_tree_order_ptr_in_heap:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> ok (to_tree_order ptr)"
   shows "ptr |\<in>| object_ptr_kinds h"
 proof(insert assms(1) assms(4), induct rule: heap_wellformed_induct)
   case (step parent)
   then show ?case
     apply(auto simp add: to_tree_order_def[of parent] map_M_pure_I elim!: bind_is_OK_E3)[1]
     using get_child_nodes_ptr_in_heap by blast
 qed
 
 lemma to_tree_order_either_ptr_or_in_children:
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
     and "node \<in> set nodes"
     and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     and "node \<noteq> ptr"
-  obtains child child_to where "child \<in> set children" 
+  obtains child child_to where "child \<in> set children"
     and "h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r child_to" and "node \<in> set child_to"
 proof -
   obtain treeorders where treeorders: "h \<turnstile> map_M to_tree_order (map cast children) \<rightarrow>\<^sub>r treeorders"
     using assms
     apply(auto simp add: to_tree_order_def elim!: bind_returns_result_E)[1]
     using pure_returns_heap_eq returns_result_eq by fastforce
   then have "node \<in> set (concat treeorders)"
     using assms[simplified to_tree_order_def]
     by(auto elim!: bind_returns_result_E4 dest: pure_returns_heap_eq)
-  then obtain treeorder where "treeorder \<in> set treeorders" 
-       and node_in_treeorder: "node \<in> set treeorder"
+  then obtain treeorder where "treeorder \<in> set treeorders"
+    and node_in_treeorder: "node \<in> set treeorder"
     by auto
-  then obtain child where "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r treeorder" 
-       and  "child \<in> set children"
+  then obtain child where "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r treeorder"
+    and  "child \<in> set children"
     using assms[simplified to_tree_order_def] treeorders
     by(auto elim!: map_M_pure_E2)
   then show ?thesis
     using node_in_treeorder returns_result_eq that by auto
 qed
 
 
 lemma to_tree_order_ptrs_in_heap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   assumes "ptr' \<in> set to"
   shows "ptr' |\<in>| object_ptr_kinds h"
 proof(insert assms(1) assms(4) assms(5), induct ptr arbitrary: to rule: heap_wellformed_induct)
   case (step parent)
   have "parent |\<in>| object_ptr_kinds h"
     using assms(1) assms(2) assms(3) step.prems(1) to_tree_order_ptr_in_heap by blast
-  then obtain children where children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children" 
+  then obtain children where children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
     by (meson assms(2) assms(3) get_child_nodes_ok is_OK_returns_result_E local.known_ptrs_known_ptr)
   then show ?case
   proof (cases "children = []")
     case True
     then have "to = [parent]"
       using step(2) children
       apply(auto simp add: to_tree_order_def[of parent] map_M_pure_I elim!: bind_returns_result_E2)[1]
       by (metis list.distinct(1) list.map_disc_iff list.set_cases map_M_pure_E2 returns_result_eq)
-    then show ?thesis 
+    then show ?thesis
       using \<open>parent |\<in>| object_ptr_kinds h\<close> step.prems(2) by auto
   next
     case False
     note f = this
     then show ?thesis
       using children step to_tree_order_either_ptr_or_in_children
     proof (cases "ptr' = parent")
       case True
       then show ?thesis
         using \<open>parent |\<in>| object_ptr_kinds h\<close> by blast
     next
       case False
-    then show ?thesis
-      using children step.hyps to_tree_order_either_ptr_or_in_children
-      by (metis step.prems(1) step.prems(2))
+      then show ?thesis
+        using children step.hyps to_tree_order_either_ptr_or_in_children
+        by (metis step.prems(1) step.prems(2))
     qed
   qed
 qed
 
 lemma to_tree_order_ok:
   assumes wellformed: "heap_is_wellformed h"
     and "ptr |\<in>| object_ptr_kinds h"
     and "known_ptrs h"
     and type_wf: "type_wf h"
   shows "h \<turnstile> ok (to_tree_order ptr)"
 proof(insert assms(1) assms(2), induct rule: heap_wellformed_induct)
   case (step parent)
   then show ?case
     using assms(3) type_wf
     apply(simp add: to_tree_order_def)
     apply(auto simp add: heap_is_wellformed_def intro!: map_M_ok_I bind_is_OK_pure_I map_M_pure_I)[1]
     using get_child_nodes_ok known_ptrs_known_ptr apply blast
     by (simp add: local.heap_is_wellformed_children_in_heap local.to_tree_order_def wellformed)
 qed
 
 lemma to_tree_order_child_subset:
   assumes "heap_is_wellformed h"
-   and "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
-   and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
-   and "node \<in> set children"
-   and "h \<turnstile> to_tree_order (cast node) \<rightarrow>\<^sub>r nodes'"
- shows "set nodes' \<subseteq> set nodes"
+    and "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
+    and "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
+    and "node \<in> set children"
+    and "h \<turnstile> to_tree_order (cast node) \<rightarrow>\<^sub>r nodes'"
+  shows "set nodes' \<subseteq> set nodes"
 proof
   fix x
   assume a1: "x \<in> set nodes'"
-  moreover obtain treeorders 
-           where treeorders: "h \<turnstile> map_M to_tree_order (map cast children) \<rightarrow>\<^sub>r treeorders"
+  moreover obtain treeorders
+    where treeorders: "h \<turnstile> map_M to_tree_order (map cast children) \<rightarrow>\<^sub>r treeorders"
     using assms(2) assms(3)
     apply(auto simp add: to_tree_order_def elim!: bind_returns_result_E)[1]
     using pure_returns_heap_eq returns_result_eq by fastforce
   then have "nodes' \<in> set treeorders"
     using assms(4) assms(5)
     by(auto elim!: map_M_pure_E dest: returns_result_eq)
   moreover have "set (concat treeorders) \<subseteq> set nodes"
     using treeorders assms(2) assms(3)
     by(auto simp add: to_tree_order_def elim!: bind_returns_result_E4 dest: pure_returns_heap_eq)
   ultimately show "x \<in> set nodes"
     by auto
 qed
 
 lemma to_tree_order_ptr_in_result:
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
   shows "ptr \<in> set nodes"
   using assms
   apply(simp add: to_tree_order_def)
   by(auto elim!: bind_returns_result_E2 intro!: map_M_pure_I bind_pure_I)
 
 lemma to_tree_order_subset:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
     and "node \<in> set nodes"
     and "h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'"
     and "known_ptrs h"
     and type_wf: "type_wf h"
   shows "set nodes' \<subseteq> set nodes"
 proof -
-  have "\<forall>nodes. h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes \<longrightarrow> (\<forall>node. node \<in> set nodes 
+  have "\<forall>nodes. h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes \<longrightarrow> (\<forall>node. node \<in> set nodes
        \<longrightarrow> (\<forall>nodes'. h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes' \<longrightarrow> set nodes' \<subseteq> set nodes))"
   proof(insert assms(1), induct ptr rule: heap_wellformed_induct)
     case (step parent)
     then show ?case
     proof safe
       fix nodes node nodes' x
       assume 1: "(\<And>children child.
              h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children \<Longrightarrow>
-             child \<in> set children \<Longrightarrow> \<forall>nodes. h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes 
-            \<longrightarrow> (\<forall>node. node \<in> set nodes \<longrightarrow> (\<forall>nodes'. h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes' 
+             child \<in> set children \<Longrightarrow> \<forall>nodes. h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes
+            \<longrightarrow> (\<forall>node. node \<in> set nodes \<longrightarrow> (\<forall>nodes'. h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'
                                               \<longrightarrow> set nodes' \<subseteq> set nodes)))"
         and 2: "h \<turnstile> to_tree_order parent \<rightarrow>\<^sub>r nodes"
         and 3: "node \<in> set nodes"
         and "h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'"
         and "x \<in> set nodes'"
       have h1: "(\<And>children child nodes node nodes'.
              h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children \<Longrightarrow>
-             child \<in> set children \<Longrightarrow> h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes 
+             child \<in> set children \<Longrightarrow> h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes
              \<longrightarrow> (node \<in> set nodes \<longrightarrow> (h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes' \<longrightarrow> set nodes' \<subseteq> set nodes)))"
         using 1
         by blast
       obtain children where children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
         using 2
         by(auto simp add: to_tree_order_def elim!: bind_returns_result_E)
       then have "set nodes' \<subseteq> set nodes"
       proof (cases "children = []")
         case True
         then show ?thesis
-          by (metis "2" "3" \<open>h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'\<close> children empty_iff list.set(1) 
-                     subsetI to_tree_order_either_ptr_or_in_children)
+          by (metis "2" "3" \<open>h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'\<close> children empty_iff list.set(1)
+              subsetI to_tree_order_either_ptr_or_in_children)
       next
         case False
         then show ?thesis
         proof (cases "node = parent")
           case True
           then show ?thesis
             using "2" \<open>h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'\<close> returns_result_eq by fastforce
         next
           case False
           then obtain child nodes_of_child where
             "child \<in> set children" and
             "h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes_of_child" and
             "node \<in> set nodes_of_child"
-            using 2[simplified to_tree_order_def] 3 
-                  to_tree_order_either_ptr_or_in_children[where node=node and ptr=parent] children
+            using 2[simplified to_tree_order_def] 3
+              to_tree_order_either_ptr_or_in_children[where node=node and ptr=parent] children
             apply(auto elim!: bind_returns_result_E2 intro: map_M_pure_I)[1]
             using is_OK_returns_result_E 2 a_all_ptrs_in_heap_def assms(1) heap_is_wellformed_def
             using "3" by blast
           then have "set nodes' \<subseteq> set nodes_of_child"
             using h1
             using \<open>h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes'\<close> children by blast
           moreover have "set nodes_of_child \<subseteq> set nodes"
-            using "2" \<open>child \<in> set children\<close> \<open>h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes_of_child\<close> 
-                  assms children to_tree_order_child_subset by auto
+            using "2" \<open>child \<in> set children\<close> \<open>h \<turnstile> to_tree_order (cast child) \<rightarrow>\<^sub>r nodes_of_child\<close>
+              assms children to_tree_order_child_subset by auto
           ultimately show ?thesis
             by blast
         qed
       qed
       then show "x \<in> set nodes"
         using \<open>x \<in> set nodes'\<close> by blast
     qed
   qed
   then show ?thesis
     using assms by blast
 qed
 
 lemma to_tree_order_parent:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
   assumes "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent"
   assumes "parent \<in> set nodes"
   shows "cast child \<in> set nodes"
 proof -
   obtain nodes' where nodes': "h \<turnstile> to_tree_order parent \<rightarrow>\<^sub>r nodes'"
     using assms to_tree_order_ok get_parent_parent_in_heap
     by (meson get_parent_parent_in_heap is_OK_returns_result_E)
 
   then have "set nodes' \<subseteq> set nodes"
     using to_tree_order_subset assms
     by blast
   moreover obtain children where
     children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children" and
     child: "child \<in> set children"
     using assms get_parent_child_dual by blast
   then obtain child_to where child_to: "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r child_to"
-    by (meson assms(1) assms(2) assms(3) assms(5) is_OK_returns_result_E is_OK_returns_result_I 
-              get_parent_ptr_in_heap node_ptr_kinds_commutes to_tree_order_ok)
+    by (meson assms(1) assms(2) assms(3) assms(5) is_OK_returns_result_E is_OK_returns_result_I
+        get_parent_ptr_in_heap node_ptr_kinds_commutes to_tree_order_ok)
   then have "cast child \<in> set child_to"
     apply(simp add: to_tree_order_def)
-    by(auto elim!: bind_returns_result_E2 map_M_pure_E 
-            dest!: bind_returns_result_E3[rotated, OF children, rotated]  intro!: map_M_pure_I)
-    
+    by(auto elim!: bind_returns_result_E2 map_M_pure_E
+        dest!: bind_returns_result_E3[rotated, OF children, rotated]  intro!: map_M_pure_I)
+
   have "cast child \<in> set nodes'"
     using nodes' child
     apply(simp add: to_tree_order_def)
-    apply(auto elim!: bind_returns_result_E2 map_M_pure_E 
-               dest!: bind_returns_result_E3[rotated, OF children, rotated]  intro!: map_M_pure_I)[1]
+    apply(auto elim!: bind_returns_result_E2 map_M_pure_E
+        dest!: bind_returns_result_E3[rotated, OF children, rotated]  intro!: map_M_pure_I)[1]
     using child_to \<open>cast child \<in> set child_to\<close> returns_result_eq by fastforce
   ultimately show ?thesis
     by auto
 qed
 
 lemma to_tree_order_child:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
   assumes "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children"
   assumes "cast child \<noteq> ptr"
   assumes "child \<in> set children"
   assumes "cast child \<in> set nodes"
-shows "parent \<in> set nodes"
-proof(insert assms(1) assms(4) assms(6) assms(8), induct ptr arbitrary: nodes 
-             rule: heap_wellformed_induct)
+  shows "parent \<in> set nodes"
+proof(insert assms(1) assms(4) assms(6) assms(8), induct ptr arbitrary: nodes
+    rule: heap_wellformed_induct)
   case (step p)
   have "p |\<in>| object_ptr_kinds h"
     using \<open>h \<turnstile> to_tree_order p \<rightarrow>\<^sub>r nodes\<close> to_tree_order_ptr_in_heap
     using assms(1) assms(2) assms(3) by blast
   then obtain children where children: "h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children"
     by (meson assms(2) assms(3) get_child_nodes_ok is_OK_returns_result_E local.known_ptrs_known_ptr)
   then show ?case
   proof (cases "children = []")
     case True
     then show ?thesis
       using step(2) step(3) step(4) children
-      by(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2  
-              dest!: bind_returns_result_E3[rotated, OF children, rotated])
+      by(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2
+          dest!: bind_returns_result_E3[rotated, OF children, rotated])
   next
     case False
     then obtain c child_to where
       child: "c \<in> set children" and
       child_to: "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<rightarrow>\<^sub>r child_to" and
       "cast child \<in> set child_to"
-      using step(2) children 
-      apply(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2 
-                 dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
+      using step(2) children
+      apply(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2
+          dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
       by (metis (full_types) assms(1) assms(2) assms(3) get_parent_ptr_in_heap
-                is_OK_returns_result_I l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.child_parent_dual 
-                l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms node_ptr_kinds_commutes
-                returns_result_select_result step.prems(1) step.prems(2) step.prems(3) 
-                to_tree_order_either_ptr_or_in_children to_tree_order_ok)
+          is_OK_returns_result_I l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.child_parent_dual
+          l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms node_ptr_kinds_commutes
+          returns_result_select_result step.prems(1) step.prems(2) step.prems(3)
+          to_tree_order_either_ptr_or_in_children to_tree_order_ok)
     then have "set child_to \<subseteq> set nodes"
       using assms(1) child children step.prems(1) to_tree_order_child_subset by auto
 
     show ?thesis
     proof (cases "c = child")
       case True
       then have "parent = p"
         using step(3) children child assms(5) assms(7)
         by (meson assms(1) assms(2) assms(3) child_parent_dual option.inject returns_result_eq)
-        
+
       then show ?thesis
         using step.prems(1) to_tree_order_ptr_in_result by blast
     next
       case False
-      then show ?thesis 
-      using step(1)[OF children child child_to] step(3) step(4)
-      using \<open>set child_to \<subseteq> set nodes\<close>
-      using \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child \<in> set child_to\<close> by auto
-  qed
+      then show ?thesis
+        using step(1)[OF children child child_to] step(3) step(4)
+        using \<open>set child_to \<subseteq> set nodes\<close>
+        using \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child \<in> set child_to\<close> by auto
+    qed
   qed
 qed
 
 lemma to_tree_order_node_ptrs:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
   assumes "ptr' \<noteq> ptr"
   assumes "ptr' \<in> set nodes"
   shows "is_node_ptr_kind ptr'"
-proof(insert assms(1) assms(4) assms(5) assms(6), induct ptr arbitrary: nodes 
-             rule: heap_wellformed_induct)
+proof(insert assms(1) assms(4) assms(5) assms(6), induct ptr arbitrary: nodes
+    rule: heap_wellformed_induct)
   case (step p)
   have "p |\<in>| object_ptr_kinds h"
     using \<open>h \<turnstile> to_tree_order p \<rightarrow>\<^sub>r nodes\<close> to_tree_order_ptr_in_heap
     using assms(1) assms(2) assms(3) by blast
   then obtain children where children: "h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children"
     by (meson assms(2) assms(3) get_child_nodes_ok is_OK_returns_result_E local.known_ptrs_known_ptr)
   then show ?case
   proof (cases "children = []")
     case True
     then show ?thesis
       using step(2) step(3) step(4) children
-      by(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2  
-              dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
+      by(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2
+          dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
   next
     case False
     then obtain c child_to where
       child: "c \<in> set children" and
       child_to: "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<rightarrow>\<^sub>r child_to" and
       "ptr' \<in> set child_to"
-      using step(2) children 
-      apply(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2 
-                 dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
-    using step.prems(1) step.prems(2) step.prems(3) to_tree_order_either_ptr_or_in_children by blast 
+      using step(2) children
+      apply(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2
+          dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
+      using step.prems(1) step.prems(2) step.prems(3) to_tree_order_either_ptr_or_in_children by blast
     then have "set child_to \<subseteq> set nodes"
       using assms(1) child children step.prems(1) to_tree_order_child_subset by auto
 
     show ?thesis
     proof (cases "cast c = ptr")
       case True
       then show ?thesis
         using step \<open>ptr' \<in> set child_to\<close> assms(5) child child_to children by blast
     next
       case False
       then show ?thesis
         using \<open>ptr' \<in> set child_to\<close> child child_to children is_node_ptr_kind_cast step.hyps by blast
     qed
   qed
 qed
 
 lemma to_tree_order_child2:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
   assumes "cast child \<noteq> ptr"
   assumes "cast child \<in> set nodes"
   obtains parent where "h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent" and "parent \<in> set nodes"
 proof -
   assume 1: "(\<And>parent. h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent \<Longrightarrow> parent \<in> set nodes \<Longrightarrow> thesis)"
   show thesis
   proof(insert assms(1) assms(4) assms(5) assms(6) 1, induct ptr arbitrary: nodes
-               rule: heap_wellformed_induct)
+      rule: heap_wellformed_induct)
     case (step p)
     have "p |\<in>| object_ptr_kinds h"
       using \<open>h \<turnstile> to_tree_order p \<rightarrow>\<^sub>r nodes\<close> to_tree_order_ptr_in_heap
       using assms(1) assms(2) assms(3) by blast
     then obtain children where children: "h \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children"
       by (meson assms(2) assms(3) get_child_nodes_ok is_OK_returns_result_E local.known_ptrs_known_ptr)
     then show ?case
     proof (cases "children = []")
       case True
       then show ?thesis
         using step(2) step(3) step(4) children
-        by(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2  
-                dest!: bind_returns_result_E3[rotated, OF children, rotated])
+        by(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2
+            dest!: bind_returns_result_E3[rotated, OF children, rotated])
     next
       case False
       then obtain c child_to where
         child: "c \<in> set children" and
         child_to: "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r c) \<rightarrow>\<^sub>r child_to" and
         "cast child \<in> set child_to"
-        using step(2) children 
-        apply(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2 
-                   dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
-        using step.prems(1) step.prems(2) step.prems(3) to_tree_order_either_ptr_or_in_children 
+        using step(2) children
+        apply(auto simp add: to_tree_order_def[of p] map_M_pure_I  elim!: bind_returns_result_E2
+            dest!: bind_returns_result_E3[rotated, OF children, rotated])[1]
+        using step.prems(1) step.prems(2) step.prems(3) to_tree_order_either_ptr_or_in_children
         by blast
       then have "set child_to \<subseteq> set nodes"
         using assms(1) child children step.prems(1) to_tree_order_child_subset by auto
 
       have "cast child |\<in>| object_ptr_kinds h"
         using assms(1) assms(2) assms(3) assms(4) assms(6) to_tree_order_ptrs_in_heap by blast
       then obtain parent_opt where parent_opt: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r parent_opt"
         by (meson assms(2) assms(3) is_OK_returns_result_E get_parent_ok node_ptr_kinds_commutes)
       then show ?thesis
       proof (induct parent_opt)
         case None
         then show ?case
-          by (metis \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child \<in> set child_to\<close> assms(1) assms(2) assms(3) 
-                        cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject child child_parent_dual child_to children
-                        option.distinct(1) returns_result_eq step.hyps)
+          by (metis \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child \<in> set child_to\<close> assms(1) assms(2) assms(3)
+              cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject child child_parent_dual child_to children
+              option.distinct(1) returns_result_eq step.hyps)
       next
         case (Some option)
-        then show ?case 
-          by (meson assms(1) assms(2) assms(3) get_parent_child_dual step.prems(1) step.prems(2) 
-                    step.prems(3) step.prems(4) to_tree_order_child)
+        then show ?case
+          by (meson assms(1) assms(2) assms(3) get_parent_child_dual step.prems(1) step.prems(2)
+              step.prems(3) step.prems(4) to_tree_order_child)
       qed
     qed
   qed
 qed
 
 lemma to_tree_order_parent_child_rel:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   shows "(ptr, child) \<in> (parent_child_rel h)\<^sup>* \<longleftrightarrow> child \<in> set to"
 proof
   assume 3: "(ptr, child) \<in> (parent_child_rel h)\<^sup>*"
   show "child \<in> set to"
   proof (insert 3, induct child rule: heap_wellformed_induct_rev[OF assms(1)])
     case (1 child)
     then show ?case
     proof (cases "ptr = child")
       case True
       then show ?thesis
         using assms(4)
         apply(simp add: to_tree_order_def)
         by(auto simp add: map_M_pure_I elim!: bind_returns_result_E2)
     next
       case False
       obtain child_parent where
         "(ptr, child_parent) \<in> (parent_child_rel h)\<^sup>*" and
         "(child_parent, child) \<in> (parent_child_rel h)"
         using \<open>ptr \<noteq> child\<close>
         by (metis "1.prems" rtranclE)
       obtain child_node where child_node: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child"
-        using \<open>(child_parent, child) \<in> parent_child_rel h\<close> node_ptr_casts_commute3 
-              parent_child_rel_node_ptr
+        using \<open>(child_parent, child) \<in> parent_child_rel h\<close> node_ptr_casts_commute3
+          parent_child_rel_node_ptr
         by blast
       then have "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some child_parent"
         using \<open>(child_parent, child) \<in> (parent_child_rel h)\<close>
-        by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E l_get_parent_wf.child_parent_dual 
-                  l_heap_is_wellformed.parent_child_rel_child local.get_child_nodes_ok 
-                  local.known_ptrs_known_ptr local.l_get_parent_wf_axioms 
-                  local.l_heap_is_wellformed_axioms local.parent_child_rel_parent_in_heap)
+        by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E l_get_parent_wf.child_parent_dual
+            l_heap_is_wellformed.parent_child_rel_child local.get_child_nodes_ok
+            local.known_ptrs_known_ptr local.l_get_parent_wf_axioms
+            local.l_heap_is_wellformed_axioms local.parent_child_rel_parent_in_heap)
       then show ?thesis
         using 1(1) child_node \<open>(ptr, child_parent) \<in> (parent_child_rel h)\<^sup>*\<close>
         using assms(1) assms(2) assms(3) assms(4) to_tree_order_parent by blast
     qed
   qed
 next
   assume "child \<in> set to"
   then show "(ptr, child) \<in> (parent_child_rel h)\<^sup>*"
   proof (induct child rule: heap_wellformed_induct_rev[OF assms(1)])
     case (1 child)
     then show ?case
     proof (cases "ptr = child")
       case True
       then show ?thesis
         by simp
     next
       case False
       then have "\<exists>parent. (parent, child) \<in> (parent_child_rel h)"
-        using 1(2) assms(4) to_tree_order_child2[OF assms(1) assms(2) assms(3) assms(4)] 
-              to_tree_order_node_ptrs
+        using 1(2) assms(4) to_tree_order_child2[OF assms(1) assms(2) assms(3) assms(4)]
+          to_tree_order_node_ptrs
         by (metis assms(1) assms(2) assms(3) node_ptr_casts_commute3 parent_child_rel_parent)
       then obtain child_node where child_node: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child"
         using node_ptr_casts_commute3 parent_child_rel_node_ptr by blast
       then obtain child_parent where child_parent: "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some child_parent"
         using \<open>\<exists>parent. (parent, child) \<in> (parent_child_rel h)\<close>
         by (metis "1.prems" False assms(1) assms(2) assms(3) assms(4) to_tree_order_child2)
       then have "(child_parent, child) \<in> (parent_child_rel h)"
         using assms(1) child_node parent_child_rel_parent by blast
       moreover have "child_parent \<in> set to"
-        by (metis "1.prems" False assms(1) assms(2) assms(3) assms(4) child_node child_parent 
-                  get_parent_child_dual to_tree_order_child)
+        by (metis "1.prems" False assms(1) assms(2) assms(3) assms(4) child_node child_parent
+            get_parent_child_dual to_tree_order_child)
       then have "(ptr, child_parent) \<in> (parent_child_rel h)\<^sup>*"
         using 1 child_node child_parent by blast
       ultimately show ?thesis
         by auto
     qed
   qed
 qed
 end
 
-interpretation i_to_tree_order_wf?: l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes 
-                                    get_child_nodes_locs to_tree_order known_ptrs get_parent 
-                                    get_parent_locs heap_is_wellformed parent_child_rel 
-                                    get_disconnected_nodes get_disconnected_nodes_locs
+interpretation i_to_tree_order_wf?: l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes
+  get_child_nodes_locs to_tree_order known_ptrs get_parent
+  get_parent_locs heap_is_wellformed parent_child_rel
+  get_disconnected_nodes get_disconnected_nodes_locs
   using instances
   apply(simp add: l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
   done
 declare l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
-locale l_to_tree_order_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs 
-                            + l_to_tree_order_defs 
-                            + l_get_parent_defs + l_get_child_nodes_defs +
-  assumes to_tree_order_ok: 
-    "heap_is_wellformed h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h 
+locale l_to_tree_order_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs
+  + l_to_tree_order_defs
+  + l_get_parent_defs + l_get_child_nodes_defs +
+  assumes to_tree_order_ok:
+    "heap_is_wellformed h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h
                           \<Longrightarrow> h \<turnstile> ok (to_tree_order ptr)"
-  assumes to_tree_order_ptrs_in_heap: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to 
+  assumes to_tree_order_ptrs_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to
                           \<Longrightarrow> ptr' \<in> set to \<Longrightarrow> ptr' |\<in>| object_ptr_kinds h"
   assumes to_tree_order_parent_child_rel:
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to 
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to
                           \<Longrightarrow> (ptr, child_ptr) \<in> (parent_child_rel h)\<^sup>* \<longleftrightarrow> child_ptr \<in> set to"
-  assumes to_tree_order_child2: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes 
-                          \<Longrightarrow> cast child \<noteq> ptr \<Longrightarrow> cast child \<in> set nodes 
-                          \<Longrightarrow> (\<And>parent. h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent  
-                                         \<Longrightarrow> parent \<in> set nodes \<Longrightarrow> thesis) 
+  assumes to_tree_order_child2:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes
+                          \<Longrightarrow> cast child \<noteq> ptr \<Longrightarrow> cast child \<in> set nodes
+                          \<Longrightarrow> (\<And>parent. h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent
+                                         \<Longrightarrow> parent \<in> set nodes \<Longrightarrow> thesis)
                           \<Longrightarrow> thesis"
-  assumes to_tree_order_node_ptrs: 
+  assumes to_tree_order_node_ptrs:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes
                           \<Longrightarrow> ptr' \<noteq> ptr \<Longrightarrow> ptr' \<in> set nodes \<Longrightarrow> is_node_ptr_kind ptr'"
-  assumes to_tree_order_child: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes 
-                          \<Longrightarrow> h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children \<Longrightarrow> cast child \<noteq> ptr 
-                          \<Longrightarrow> child \<in> set children \<Longrightarrow> cast child \<in> set nodes 
+  assumes to_tree_order_child:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes
+                          \<Longrightarrow> h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children \<Longrightarrow> cast child \<noteq> ptr
+                          \<Longrightarrow> child \<in> set children \<Longrightarrow> cast child \<in> set nodes
                           \<Longrightarrow> parent \<in> set nodes"
-  assumes to_tree_order_ptr_in_result: 
+  assumes to_tree_order_ptr_in_result:
     "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes \<Longrightarrow> ptr \<in> set nodes"
-  assumes to_tree_order_parent: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes 
-                          \<Longrightarrow> h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent \<Longrightarrow> parent \<in> set nodes 
+  assumes to_tree_order_parent:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes
+                          \<Longrightarrow> h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent \<Longrightarrow> parent \<in> set nodes
                           \<Longrightarrow> cast child \<in> set nodes"
   assumes to_tree_order_subset:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes \<Longrightarrow> node \<in> set nodes 
-                          \<Longrightarrow> h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes' \<Longrightarrow> known_ptrs h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes \<Longrightarrow> node \<in> set nodes
+                          \<Longrightarrow> h \<turnstile> to_tree_order node \<rightarrow>\<^sub>r nodes' \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> type_wf h \<Longrightarrow> set nodes' \<subseteq> set nodes"
 
-lemma to_tree_order_wf_is_l_to_tree_order_wf [instances]: 
-  "l_to_tree_order_wf heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs 
+lemma to_tree_order_wf_is_l_to_tree_order_wf [instances]:
+  "l_to_tree_order_wf heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
                       to_tree_order get_parent get_child_nodes"
   using instances
   apply(auto simp add: l_to_tree_order_wf_def l_to_tree_order_wf_axioms_def)[1]
-  using to_tree_order_ok 
+  using to_tree_order_ok
            apply blast
-  using to_tree_order_ptrs_in_heap 
+  using to_tree_order_ptrs_in_heap
           apply blast
   using to_tree_order_parent_child_rel
          apply(blast, blast)
   using to_tree_order_child2
        apply blast
   using to_tree_order_node_ptrs
       apply blast
-  using to_tree_order_child 
+  using to_tree_order_child
      apply blast
   using to_tree_order_ptr_in_result
     apply blast
   using to_tree_order_parent
    apply blast
   using to_tree_order_subset
   apply blast
   done
 
 
 subsubsection \<open>get\_root\_node\<close>
 
 locale l_to_tree_order_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   + l_to_tree_order_wf
 begin
 lemma to_tree_order_get_root_node:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   assumes "ptr' \<in> set to"
   assumes "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
   assumes "ptr'' \<in> set to"
   shows "h \<turnstile> get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr"
 proof -
   obtain ancestors' where ancestors': "h \<turnstile> get_ancestors ptr' \<rightarrow>\<^sub>r ancestors'"
-    by (meson assms(1) assms(2) assms(3) assms(4) assms(5) get_ancestors_ok is_OK_returns_result_E 
-              to_tree_order_ptrs_in_heap )
+    by (meson assms(1) assms(2) assms(3) assms(4) assms(5) get_ancestors_ok is_OK_returns_result_E
+        to_tree_order_ptrs_in_heap )
   moreover have "ptr \<in> set ancestors'"
     using \<open>h \<turnstile> get_ancestors ptr' \<rightarrow>\<^sub>r ancestors'\<close>
-    using assms(1) assms(2) assms(3) assms(4) assms(5) get_ancestors_parent_child_rel 
-          to_tree_order_parent_child_rel by blast
+    using assms(1) assms(2) assms(3) assms(4) assms(5) get_ancestors_parent_child_rel
+      to_tree_order_parent_child_rel by blast
 
   ultimately have "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<close>
     using assms(1) assms(2) assms(3) get_ancestors_ptr get_ancestors_same_root_node by blast
-  
+
   obtain ancestors'' where ancestors'': "h \<turnstile> get_ancestors ptr'' \<rightarrow>\<^sub>r ancestors''"
-    by (meson assms(1) assms(2) assms(3) assms(4) assms(7) get_ancestors_ok is_OK_returns_result_E 
-              to_tree_order_ptrs_in_heap)
+    by (meson assms(1) assms(2) assms(3) assms(4) assms(7) get_ancestors_ok is_OK_returns_result_E
+        to_tree_order_ptrs_in_heap)
   moreover have "ptr \<in> set ancestors''"
     using \<open>h \<turnstile> get_ancestors ptr'' \<rightarrow>\<^sub>r ancestors''\<close>
-    using assms(1) assms(2) assms(3) assms(4) assms(7) get_ancestors_parent_child_rel 
-          to_tree_order_parent_child_rel by blast
+    using assms(1) assms(2) assms(3) assms(4) assms(7) get_ancestors_parent_child_rel
+      to_tree_order_parent_child_rel by blast
   ultimately show ?thesis
-    using \<open>h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr\<close> assms(1) assms(2) assms(3) get_ancestors_ptr 
-          get_ancestors_same_root_node by blast
+    using \<open>h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr\<close> assms(1) assms(2) assms(3) get_ancestors_ptr
+      get_ancestors_same_root_node by blast
 qed
 
 lemma to_tree_order_same_root:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
   assumes "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r to"
   assumes "ptr' \<in> set to"
   shows "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
 proof (insert assms(1)(*  assms(4) assms(5) *) assms(6), induct ptr' rule: heap_wellformed_induct_rev)
   case (step child)
   then show ?case
   proof (cases "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child")
     case True
     then have "child = root_ptr"
       using  assms(1) assms(2) assms(3) assms(5) step.prems
-      by (metis (no_types, lifting) get_root_node_same_no_parent node_ptr_casts_commute3 
-                option.simps(3) returns_result_eq to_tree_order_child2 to_tree_order_node_ptrs)
+      by (metis (no_types, lifting) get_root_node_same_no_parent node_ptr_casts_commute3
+          option.simps(3) returns_result_eq to_tree_order_child2 to_tree_order_node_ptrs)
     then show ?thesis
       using True by blast
   next
     case False
-    then obtain child_node parent where "cast child_node = child" 
-                  and "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent"
-      by (metis assms(1) assms(2) assms(3) assms(4) assms(5) local.get_root_node_no_parent 
-                local.get_root_node_not_node_same local.get_root_node_same_no_parent 
-                local.to_tree_order_child2 local.to_tree_order_ptrs_in_heap node_ptr_casts_commute3  
-                step.prems)
+    then obtain child_node parent where "cast child_node = child"
+      and "h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent"
+      by (metis assms(1) assms(2) assms(3) assms(4) assms(5) local.get_root_node_no_parent
+          local.get_root_node_not_node_same local.get_root_node_same_no_parent
+          local.to_tree_order_child2 local.to_tree_order_ptrs_in_heap node_ptr_casts_commute3
+          step.prems)
     then show ?thesis
     proof (cases "child = root_ptr")
       case True
       then have "h \<turnstile> get_root_node root_ptr \<rightarrow>\<^sub>r root_ptr"
         using assms(4)
-        using \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child\<close> assms(1) assms(2) assms(3) 
-              get_root_node_no_parent get_root_node_same_no_parent
+        using \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child\<close> assms(1) assms(2) assms(3)
+          get_root_node_no_parent get_root_node_same_no_parent
         by blast
       then show ?thesis
         using step assms(4)
         using True by blast
     next
       case False
       then have "parent \<in> set to"
-        using assms(5) step(2) to_tree_order_child \<open>h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent\<close> 
-              \<open>cast child_node = child\<close>
+        using assms(5) step(2) to_tree_order_child \<open>h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent\<close>
+          \<open>cast child_node = child\<close>
         by (metis False assms(1) assms(2) assms(3) get_parent_child_dual)
       then show ?thesis
-        using \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child\<close> \<open>h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent\<close> 
-              get_root_node_parent_same 
+        using \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child\<close> \<open>h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent\<close>
+          get_root_node_parent_same
         using step.hyps by blast
     qed
-   
+
   qed
 qed
 end
 
-interpretation i_to_tree_order_wf_get_root_node_wf?: l_to_tree_order_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M 
-  known_ptr type_wf known_ptrs heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_parent get_parent_locs get_ancestors get_ancestors_locs get_root_node get_root_node_locs to_tree_order
+interpretation i_to_tree_order_wf_get_root_node_wf?: l_to_tree_order_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  known_ptr type_wf known_ptrs heap_is_wellformed parent_child_rel get_child_nodes
+  get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_parent get_parent_locs
+  get_ancestors get_ancestors_locs get_root_node get_root_node_locs to_tree_order
   using instances
   by(simp add: l_to_tree_order_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 
-locale l_to_tree_order_wf_get_root_node_wf = l_type_wf + l_known_ptrs + l_to_tree_order_defs 
-                                           + l_get_root_node_defs + l_heap_is_wellformed_defs +
-  assumes to_tree_order_get_root_node: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to 
-                          \<Longrightarrow> ptr' \<in> set to \<Longrightarrow> h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr 
+locale l_to_tree_order_wf_get_root_node_wf = l_type_wf + l_known_ptrs + l_to_tree_order_defs
+  + l_get_root_node_defs + l_heap_is_wellformed_defs +
+  assumes to_tree_order_get_root_node:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to
+                          \<Longrightarrow> ptr' \<in> set to \<Longrightarrow> h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
                           \<Longrightarrow> ptr'' \<in> set to \<Longrightarrow> h \<turnstile> get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr"
-  assumes to_tree_order_same_root: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                          \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr 
-                          \<Longrightarrow> h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r to \<Longrightarrow> ptr' \<in> set to 
+  assumes to_tree_order_same_root:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                          \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr
+                          \<Longrightarrow> h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r to \<Longrightarrow> ptr' \<in> set to
                           \<Longrightarrow> h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
 
 lemma to_tree_order_wf_get_root_node_wf_is_l_to_tree_order_wf_get_root_node_wf [instances]:
-  "l_to_tree_order_wf_get_root_node_wf type_wf known_ptr known_ptrs to_tree_order 
+  "l_to_tree_order_wf_get_root_node_wf type_wf known_ptr known_ptrs to_tree_order
                                        get_root_node heap_is_wellformed"
   using instances
-  apply(auto simp add: l_to_tree_order_wf_get_root_node_wf_def 
+  apply(auto simp add: l_to_tree_order_wf_get_root_node_wf_def
       l_to_tree_order_wf_get_root_node_wf_axioms_def)[1]
   using to_tree_order_get_root_node apply blast
   using to_tree_order_same_root apply blast
   done
 
 
 subsection \<open>get\_owner\_document\<close>
-                                                                                                                                          
+
 locale l_get_owner_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_known_ptrs
   + l_heap_is_wellformed
   + l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   + l_get_ancestors
   + l_get_ancestors_wf
   + l_get_parent
   + l_get_parent_wf
   + l_get_root_node_wf
   + l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_owner_document_disconnected_nodes:
   assumes "heap_is_wellformed h"
   assumes "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
   assumes "node_ptr \<in> set disc_nodes"
   assumes known_ptrs: "known_ptrs h"
   assumes type_wf: "type_wf h"
   shows "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r document_ptr"
 proof -
   have 2: "node_ptr |\<in>| node_ptr_kinds h"
     using assms heap_is_wellformed_disc_nodes_in_heap
     by blast
   have 3: "document_ptr |\<in>| document_ptr_kinds h"
     using assms(2) get_disconnected_nodes_ptr_in_heap by blast
-  have 0: 
-  "\<exists>!document_ptr\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r. node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
-    by (metis (no_types, lifting) "3" DocumentMonad.ptr_kinds_ptr_kinds_M assms(1) assms(2) assms(3) 
-              disjoint_iff_not_equal l_heap_is_wellformed.heap_is_wellformed_one_disc_parent 
-              local.get_disconnected_nodes_ok local.l_heap_is_wellformed_axioms 
-              returns_result_select_result select_result_I2 type_wf)
+  have 0:
+    "\<exists>!document_ptr\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r. node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
+    by (metis (no_types, lifting) "3" DocumentMonad.ptr_kinds_ptr_kinds_M assms(1) assms(2) assms(3)
+        disjoint_iff_not_equal l_heap_is_wellformed.heap_is_wellformed_one_disc_parent
+        local.get_disconnected_nodes_ok local.l_heap_is_wellformed_axioms
+        returns_result_select_result select_result_I2 type_wf)
 
   have "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r None"
     using heap_is_wellformed_children_disc_nodes_different child_parent_dual assms
-    using "2" disjoint_iff_not_equal local.get_parent_child_dual local.get_parent_ok 
-          returns_result_select_result split_option_ex
+    using "2" disjoint_iff_not_equal local.get_parent_child_dual local.get_parent_ok
+      returns_result_select_result split_option_ex
     by (metis (no_types, lifting))
 
   then have 4: "h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r cast node_ptr"
     using 2 get_root_node_no_parent
     by blast
   obtain document_ptrs where document_ptrs: "h \<turnstile> document_ptr_kinds_M \<rightarrow>\<^sub>r document_ptrs"
     by simp
-  
+
   then
   have "h \<turnstile> ok (filter_M (\<lambda>document_ptr. do {
           disconnected_nodes \<leftarrow> get_disconnected_nodes document_ptr;
           return (((cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)) \<in> cast ` set disconnected_nodes)
         }) document_ptrs)"
     using assms(1) get_disconnected_nodes_ok  type_wf unfolding heap_is_wellformed_def
     by(auto intro!: bind_is_OK_I2 filter_M_is_OK_I bind_pure_I)
-  then obtain candidates where 
+  then obtain candidates where
     candidates: "h \<turnstile> filter_M (\<lambda>document_ptr. do {
           disconnected_nodes \<leftarrow> get_disconnected_nodes document_ptr;
           return (((cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)) \<in> cast ` set disconnected_nodes)
         }) document_ptrs \<rightarrow>\<^sub>r candidates"
     by auto
 
 
-  have eq: "\<And>document_ptr. document_ptr |\<in>| document_ptr_kinds h 
+  have eq: "\<And>document_ptr. document_ptr |\<in>| document_ptr_kinds h
            \<Longrightarrow> node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r \<longleftrightarrow> |h \<turnstile> do {
           disconnected_nodes \<leftarrow> get_disconnected_nodes document_ptr;
           return (((cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)) \<in> cast ` set disconnected_nodes)
         }|\<^sub>r"
-    apply(auto dest!: get_disconnected_nodes_ok[OF type_wf] 
-               intro!: select_result_I[where P=id, simplified] elim!: bind_returns_result_E2)[1]
+    apply(auto dest!: get_disconnected_nodes_ok[OF type_wf]
+        intro!: select_result_I[where P=id, simplified] elim!: bind_returns_result_E2)[1]
     apply(drule select_result_E[where P=id, simplified])
     by(auto elim!: bind_returns_result_E2)
 
   have filter: "filter (\<lambda>document_ptr. |h \<turnstile> do {
           disconnected_nodes \<leftarrow> get_disconnected_nodes document_ptr;
           return (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr \<in> cast ` set disconnected_nodes)
         }|\<^sub>r) document_ptrs = [document_ptr]"
     apply(rule filter_ex1)
     using 0 document_ptrs apply(simp)[1]
     using eq
     using local.get_disconnected_nodes_ok apply auto[1]
     using assms(2) assms(3)
-      apply(auto intro!: intro!: select_result_I[where P=id, simplified] 
-                 elim!: bind_returns_result_E2)[1]
+      apply(auto intro!: intro!: select_result_I[where P=id, simplified]
+        elim!: bind_returns_result_E2)[1]
     using returns_result_eq apply fastforce
     using document_ptrs  3 apply(simp)
     using document_ptrs
     by simp
   have "h \<turnstile> filter_M (\<lambda>document_ptr. do {
           disconnected_nodes \<leftarrow> get_disconnected_nodes document_ptr;
           return (((cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)) \<in> cast ` set disconnected_nodes)
         }) document_ptrs \<rightarrow>\<^sub>r [document_ptr]"
     apply(rule filter_M_filter2)
-    using get_disconnected_nodes_ok document_ptrs 3  assms(1)  type_wf filter 
+    using get_disconnected_nodes_ok document_ptrs 3  assms(1)  type_wf filter
     unfolding heap_is_wellformed_def
     by(auto intro: bind_pure_I bind_is_OK_I2)
 
   with 4 document_ptrs have "h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr () \<rightarrow>\<^sub>r document_ptr"
     by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
-            intro!:  bind_pure_returns_result_I filter_M_pure_I bind_pure_I 
-            split: option.splits)[1]
+        intro!:  bind_pure_returns_result_I filter_M_pure_I bind_pure_I
+        split: option.splits)[1]
   moreover have "known_ptr (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)"
     using "4" assms(1)  known_ptrs type_wf known_ptrs_known_ptr "2" node_ptr_kinds_commutes by blast
   ultimately show ?thesis
     using 2
     apply(auto simp add: known_ptr_impl get_owner_document_def a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, (rule conjI | rule impI)+)+
-    apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
-    apply(drule(1)  known_ptr_not_character_data_ptr)
+       apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
+       apply(drule(1)  known_ptr_not_character_data_ptr)
        apply(drule(1)  known_ptr_not_element_ptr)
        apply(simp add: NodeClass.known_ptr_defs)
     by(auto split: option.splits intro!: bind_pure_returns_result_I)
 qed
 
 lemma in_disconnected_nodes_no_parent:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r None"
     and "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r owner_document"
     and "h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "node_ptr \<in> set disc_nodes"
 proof -
   have 2: "cast node_ptr |\<in>| object_ptr_kinds h"
     using assms(3) get_owner_document_ptr_in_heap by fast
   then have 3: "h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r cast node_ptr"
     using assms(2) local.get_root_node_no_parent by blast
 
-  have "\<not>(\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<and> node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
+  have "\<not>(\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h \<and>
+node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
     apply(auto)[1]
     using assms(2) child_parent_dual[OF assms(1)] type_wf
-          assms(1) assms(5) get_child_nodes_ok known_ptrs_known_ptr option.simps(3) 
-          returns_result_eq returns_result_select_result
+      assms(1) assms(5) get_child_nodes_ok known_ptrs_known_ptr option.simps(3)
+      returns_result_eq returns_result_select_result
     by (metis (no_types, hide_lams))
   moreover have "node_ptr |\<in>| node_ptr_kinds h"
     using assms(2) get_parent_ptr_in_heap by blast
   ultimately
   have 0: "\<exists>document_ptr\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r. node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     by (metis DocumentMonad.ptr_kinds_ptr_kinds_M assms(1) finite_set_in heap_is_wellformed_children_disc_nodes)
   then  obtain document_ptr where
     document_ptr: "document_ptr\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r" and
     node_ptr_in_disc_nodes: "node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     by auto
   then show ?thesis
     using get_owner_document_disconnected_nodes known_ptrs type_wf assms
-    using DocumentMonad.ptr_kinds_ptr_kinds_M assms(1) assms(3) assms(4) get_disconnected_nodes_ok 
-          returns_result_select_result select_result_I2
+    using DocumentMonad.ptr_kinds_ptr_kinds_M assms(1) assms(3) assms(4) get_disconnected_nodes_ok
+      returns_result_select_result select_result_I2
     by (metis (no_types, hide_lams) )
 qed
 
-lemma get_owner_document_owner_document_in_heap: 
+lemma get_owner_document_owner_document_in_heap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   shows "owner_document |\<in>| document_ptr_kinds h"
   using assms
   apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
   apply(split invoke_split_asm)+
 proof -
   assume "h \<turnstile> invoke [] ptr () \<rightarrow>\<^sub>r owner_document"
   then show "owner_document |\<in>| document_ptr_kinds h"
     by (meson invoke_empty is_OK_returns_result_I)
 next
   assume "h \<turnstile> Heap_Error_Monad.bind (check_in_heap ptr)
           (\<lambda>_. (local.a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) ptr ())
     \<rightarrow>\<^sub>r owner_document"
   then show "owner_document |\<in>| document_ptr_kinds h"
     by(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 split: if_splits)
 next
   assume 0: "heap_is_wellformed h"
     and 1: "type_wf h"
     and 2: "known_ptrs h"
     and 3: "\<not> is_element_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr"
     and 4: "is_character_data_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr"
-    and 5: "h \<turnstile> Heap_Error_Monad.bind (check_in_heap ptr) (\<lambda>_. (local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r) ptr ()) \<rightarrow>\<^sub>r owner_document"
+    and 5: "h \<turnstile> Heap_Error_Monad.bind (check_in_heap ptr)
+(\<lambda>_. (local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r) ptr ()) \<rightarrow>\<^sub>r owner_document"
   then obtain root where
     root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
-    by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2  split: option.splits)
+    by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2
+        split: option.splits)
 
   then show ?thesis
   proof (cases "is_document_ptr root")
     case True
     then show ?thesis
-      using 4 5 root 
-      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2 intro!: filter_M_pure_I bind_pure_I split: option.splits)[1] 
+      using 4 5 root
+      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2
+          intro!: filter_M_pure_I bind_pure_I split: option.splits)[1]
        apply(drule(1) returns_result_eq) apply(auto)[1]
       using "0" "1" "2" document_ptr_kinds_commutes local.get_root_node_root_in_heap by blast
   next
     case False
     have "known_ptr root"
       using "0" "1" "2" local.get_root_node_root_in_heap local.known_ptrs_known_ptr root by blast
     have "root |\<in>| object_ptr_kinds h"
       using root
       using "0" "1" "2" local.get_root_node_root_in_heap
       by blast
     then have "is_node_ptr_kind root"
       using False \<open>known_ptr root\<close>
-      apply(simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs)
+      apply(simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs)
       using is_node_ptr_kind_none by force
     then
-    have "(\<exists>document_ptr \<in> fset (document_ptr_kinds h). root \<in> cast ` set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
-      by (metis (no_types, lifting) "0" "1" "2" \<open>root |\<in>| object_ptr_kinds h\<close> local.child_parent_dual local.get_child_nodes_ok local.get_root_node_same_no_parent local.heap_is_wellformed_children_disc_nodes local.known_ptrs_known_ptr node_ptr_casts_commute3 node_ptr_inclusion node_ptr_kinds_commutes notin_fset option.distinct(1) returns_result_eq returns_result_select_result root)
-    then obtain some_owner_document where
-      "some_owner_document |\<in>| document_ptr_kinds h" and
-      "root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r"
-      by auto
-    then
-    obtain candidates where
-      candidates: "h \<turnstile> filter_M
-             (\<lambda>document_ptr.
-                 Heap_Error_Monad.bind (get_disconnected_nodes document_ptr)
-                  (\<lambda>disconnected_nodes. return (root \<in> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set disconnected_nodes)))
-             (sorted_list_of_set (fset (document_ptr_kinds h)))
-       \<rightarrow>\<^sub>r candidates"
-      by (metis (no_types, lifting) "1" bind_is_OK_I2 bind_pure_I filter_M_is_OK_I finite_fset is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_disconnected_nodes_pure notin_fset return_ok return_pure sorted_list_of_set(1))
-    then have "some_owner_document \<in> set candidates"
-      apply(rule filter_M_in_result_if_ok)
-      using \<open>some_owner_document |\<in>| document_ptr_kinds h\<close> \<open>root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
-        apply(auto intro!: bind_pure_I bind_pure_returns_result_I)[1]
-       apply (simp add: \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>)
-      using "1" \<open>root \<in> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close> \<open>some_owner_document |\<in>| document_ptr_kinds h\<close> 
-            local.get_disconnected_nodes_ok by auto 
-    then have "candidates \<noteq> []"
-      by auto
-    then have "owner_document \<in> set candidates"
-      using 5 root 4
-      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2 intro!: filter_M_pure_I bind_pure_I split: option.splits)[1] 
-       apply (metis candidates list.set_sel(1) returns_result_eq)
-      by (metis \<open>is_node_ptr_kind root\<close> node_ptr_no_document_ptr_cast returns_result_eq)
-
-    then show ?thesis
-      using candidates
-      by (meson bind_pure_I bind_returns_result_E2 filter_M_holds_for_result is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap local.get_disconnected_nodes_pure return_pure)
-  qed
-next
-  assume 0: "heap_is_wellformed h"
-    and 1: "type_wf h"
-    and 2: "known_ptrs h"
-    and 3: "is_element_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr"
-    and 4: "h \<turnstile> Heap_Error_Monad.bind (check_in_heap ptr) (\<lambda>_. (local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r) ptr ()) \<rightarrow>\<^sub>r owner_document"
-  then obtain root where
-    root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
-    by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2  split: option.splits)
-
-  then show ?thesis
-  proof (cases "is_document_ptr root")
-    case True
-    then show ?thesis
-      using 3 4 root 
-      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2 intro!: filter_M_pure_I bind_pure_I split: option.splits)[1] 
-       apply(drule(1) returns_result_eq) apply(auto)[1]
-      using "0" "1" "2" document_ptr_kinds_commutes local.get_root_node_root_in_heap by blast
-  next
-    case False
-    have "known_ptr root"
-      using "0" "1" "2" local.get_root_node_root_in_heap local.known_ptrs_known_ptr root by blast
-    have "root |\<in>| object_ptr_kinds h"
-      using root
-      using "0" "1" "2" local.get_root_node_root_in_heap
-      by blast
-    then have "is_node_ptr_kind root"
-      using False \<open>known_ptr root\<close>
-      apply(simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs)
-      using is_node_ptr_kind_none by force
-    then
-    have "(\<exists>document_ptr \<in> fset (document_ptr_kinds h). root \<in> cast ` set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
-      by (metis (no_types, lifting) "0" "1" "2" \<open>root |\<in>| object_ptr_kinds h\<close> local.child_parent_dual local.get_child_nodes_ok local.get_root_node_same_no_parent local.heap_is_wellformed_children_disc_nodes local.known_ptrs_known_ptr node_ptr_casts_commute3 node_ptr_inclusion node_ptr_kinds_commutes notin_fset option.distinct(1) returns_result_eq returns_result_select_result root)
+    have "(\<exists>document_ptr \<in> fset (document_ptr_kinds h).
+root \<in> cast ` set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
+      by (metis (no_types, lifting) "0" "1" "2" \<open>root |\<in>| object_ptr_kinds h\<close> local.child_parent_dual
+          local.get_child_nodes_ok local.get_root_node_same_no_parent local.heap_is_wellformed_children_disc_nodes
+          local.known_ptrs_known_ptr node_ptr_casts_commute3 node_ptr_inclusion node_ptr_kinds_commutes notin_fset
+          option.distinct(1) returns_result_eq returns_result_select_result root)
     then obtain some_owner_document where
       "some_owner_document |\<in>| document_ptr_kinds h" and
       "root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r"
       by auto
     then
     obtain candidates where
       candidates: "h \<turnstile> filter_M
              (\<lambda>document_ptr.
                  Heap_Error_Monad.bind (get_disconnected_nodes document_ptr)
                   (\<lambda>disconnected_nodes. return (root \<in> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set disconnected_nodes)))
              (sorted_list_of_set (fset (document_ptr_kinds h)))
        \<rightarrow>\<^sub>r candidates"
-      by (metis (no_types, lifting) "1" bind_is_OK_I2 bind_pure_I filter_M_is_OK_I finite_fset is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_disconnected_nodes_pure notin_fset return_ok return_pure sorted_list_of_set(1))
+      by (metis (no_types, lifting) "1" bind_is_OK_I2 bind_pure_I filter_M_is_OK_I finite_fset
+          is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_disconnected_nodes_pure notin_fset
+          return_ok return_pure sorted_list_of_set(1))
     then have "some_owner_document \<in> set candidates"
       apply(rule filter_M_in_result_if_ok)
-      using \<open>some_owner_document |\<in>| document_ptr_kinds h\<close> \<open>root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
-        apply(auto intro!: bind_pure_I bind_pure_returns_result_I)
+      using \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>
+        \<open>root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
+        apply(auto intro!: bind_pure_I bind_pure_returns_result_I)[1]
+       apply (simp add: \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>)
+      using "1" \<open>root \<in> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
+        \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>
+        local.get_disconnected_nodes_ok by auto
+    then have "candidates \<noteq> []"
+      by auto
+    then have "owner_document \<in> set candidates"
+      using 5 root 4
+      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2
+          intro!: filter_M_pure_I bind_pure_I split: option.splits)[1]
+       apply (metis candidates list.set_sel(1) returns_result_eq)
+      by (metis \<open>is_node_ptr_kind root\<close> node_ptr_no_document_ptr_cast returns_result_eq)
+
+    then show ?thesis
+      using candidates
+      by (meson bind_pure_I bind_returns_result_E2 filter_M_holds_for_result is_OK_returns_result_I
+          local.get_disconnected_nodes_ptr_in_heap local.get_disconnected_nodes_pure return_pure)
+  qed
+next
+  assume 0: "heap_is_wellformed h"
+    and 1: "type_wf h"
+    and 2: "known_ptrs h"
+    and 3: "is_element_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr"
+    and 4: "h \<turnstile> Heap_Error_Monad.bind (check_in_heap ptr)
+(\<lambda>_. (local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r \<circ> the \<circ> cast\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r) ptr ()) \<rightarrow>\<^sub>r owner_document"
+  then obtain root where
+    root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
+    by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2
+        split: option.splits)
+
+  then show ?thesis
+  proof (cases "is_document_ptr root")
+    case True
+    then show ?thesis
+      using 3 4 root
+      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2
+          intro!: filter_M_pure_I bind_pure_I split: option.splits)[1]
+       apply(drule(1) returns_result_eq) apply(auto)[1]
+      using "0" "1" "2" document_ptr_kinds_commutes local.get_root_node_root_in_heap by blast
+  next
+    case False
+    have "known_ptr root"
+      using "0" "1" "2" local.get_root_node_root_in_heap local.known_ptrs_known_ptr root by blast
+    have "root |\<in>| object_ptr_kinds h"
+      using root
+      using "0" "1" "2" local.get_root_node_root_in_heap
+      by blast
+    then have "is_node_ptr_kind root"
+      using False \<open>known_ptr root\<close>
+      apply(simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs)
+      using is_node_ptr_kind_none by force
+    then
+    have "(\<exists>document_ptr \<in> fset (document_ptr_kinds h). root \<in>
+cast ` set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
+      by (metis (no_types, lifting) "0" "1" "2" \<open>root |\<in>| object_ptr_kinds h\<close>
+          local.child_parent_dual local.get_child_nodes_ok local.get_root_node_same_no_parent
+          local.heap_is_wellformed_children_disc_nodes local.known_ptrs_known_ptr node_ptr_casts_commute3
+          node_ptr_inclusion node_ptr_kinds_commutes notin_fset option.distinct(1) returns_result_eq
+          returns_result_select_result root)
+    then obtain some_owner_document where
+      "some_owner_document |\<in>| document_ptr_kinds h" and
+      "root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r"
+      by auto
+    then
+    obtain candidates where
+      candidates: "h \<turnstile> filter_M
+             (\<lambda>document_ptr.
+                 Heap_Error_Monad.bind (get_disconnected_nodes document_ptr)
+                  (\<lambda>disconnected_nodes. return (root \<in> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set disconnected_nodes)))
+             (sorted_list_of_set (fset (document_ptr_kinds h)))
+       \<rightarrow>\<^sub>r candidates"
+      by (metis (no_types, lifting) "1" bind_is_OK_I2 bind_pure_I filter_M_is_OK_I finite_fset
+          is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_disconnected_nodes_pure notin_fset
+          return_ok return_pure sorted_list_of_set(1))
+    then have "some_owner_document \<in> set candidates"
+      apply(rule filter_M_in_result_if_ok)
+      using \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>
+        \<open>root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
+        apply(auto intro!: bind_pure_I bind_pure_returns_result_I)[1]
+      using \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>
+        \<open>root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
+       apply(auto intro!: bind_pure_I bind_pure_returns_result_I)[1]
+      using \<open>some_owner_document |\<in>| document_ptr_kinds h\<close>
+        \<open>root \<in> cast ` set |h \<turnstile> get_disconnected_nodes some_owner_document|\<^sub>r\<close>
+      apply(auto intro!: bind_pure_I bind_pure_returns_result_I)[1]
       by (simp add: "1" local.get_disconnected_nodes_ok)
 
     then have "candidates \<noteq> []"
       by auto
     then have "owner_document \<in> set candidates"
       using 4 root 3
-      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2 intro!: filter_M_pure_I bind_pure_I split: option.splits)[1] 
+      apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!:  bind_returns_result_E2
+          intro!: filter_M_pure_I bind_pure_I split: option.splits)[1]
        apply (metis candidates list.set_sel(1) returns_result_eq)
       by (metis \<open>is_node_ptr_kind root\<close> node_ptr_no_document_ptr_cast returns_result_eq)
 
     then show ?thesis
       using candidates
-      by (meson bind_pure_I bind_returns_result_E2 filter_M_holds_for_result is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap local.get_disconnected_nodes_pure return_pure)
+      by (meson bind_pure_I bind_returns_result_E2 filter_M_holds_for_result is_OK_returns_result_I
+          local.get_disconnected_nodes_ptr_in_heap local.get_disconnected_nodes_pure return_pure)
   qed
 qed
 
-lemma get_owner_document_ok: 
+lemma get_owner_document_ok:
   assumes "heap_is_wellformed h"  "known_ptrs h" "type_wf h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   shows "h \<turnstile> ok (get_owner_document ptr)"
 proof -
   have "known_ptr ptr"
     using assms(2) assms(4) local.known_ptrs_known_ptr
     by blast
   then show ?thesis
     apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, (rule conjI | rule impI)+)+
        apply(auto simp add: known_ptr_impl)[1]
-    using NodeClass.a_known_ptr_def known_ptr_not_character_data_ptr known_ptr_not_document_ptr known_ptr_not_element_ptr 
+    using NodeClass.a_known_ptr_def known_ptr_not_character_data_ptr known_ptr_not_document_ptr
+      known_ptr_not_element_ptr
        apply blast
     using assms(4)
-      apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_is_OK_pure_I)[1]
-        apply (metis (no_types, lifting) document_ptr_casts_commute3 document_ptr_kinds_commutes is_document_ptr_kind_none option.case_eq_if)
-    using assms(4)
-     apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_is_OK_pure_I)[1]
-       apply (metis (no_types, lifting) assms(1) assms(2) assms(3) is_node_ptr_kind_none local.get_root_node_ok node_ptr_casts_commute3 option.case_eq_if)
+      apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        intro!: bind_is_OK_pure_I)[1]
+      apply (metis (no_types, lifting) document_ptr_casts_commute3 document_ptr_kinds_commutes
+        is_document_ptr_kind_none option.case_eq_if)
     using assms(4)
-     apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_is_OK_pure_I)[1]
-     apply(auto split: option.splits intro!: bind_is_OK_pure_I filter_M_pure_I bind_pure_I filter_M_is_OK_I)[1]
-    using assms(3) local.get_disconnected_nodes_ok 
+     apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        intro!: bind_is_OK_pure_I)[1]
+      apply (metis (no_types, lifting) assms(1) assms(2) assms(3) is_node_ptr_kind_none
+        local.get_root_node_ok node_ptr_casts_commute3 option.case_eq_if)
+    using assms(4)
+     apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        intro!: bind_is_OK_pure_I)[1]
+     apply(auto split: option.splits
+        intro!: bind_is_OK_pure_I filter_M_pure_I bind_pure_I filter_M_is_OK_I)[1]
+    using assms(3) local.get_disconnected_nodes_ok
      apply blast
-     apply (simp add: assms(1) assms(2) assms(3) local.get_root_node_ok)
+    apply (simp add: assms(1) assms(2) assms(3) local.get_root_node_ok)
     using assms(4)
-    apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_is_OK_pure_I)[1]
-     apply(auto split: option.splits intro!: bind_is_OK_pure_I filter_M_pure_I bind_pure_I filter_M_is_OK_I)[1]
+    apply(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+        intro!: bind_is_OK_pure_I)[1]
+     apply(auto split: option.splits
+        intro!: bind_is_OK_pure_I filter_M_pure_I bind_pure_I filter_M_is_OK_I)[1]
      apply (simp add: assms(1) assms(2) assms(3) local.get_root_node_ok)[1]
-    apply(auto split: option.splits intro!: bind_is_OK_pure_I filter_M_pure_I bind_pure_I filter_M_is_OK_I)[1]
+    apply(auto split: option.splits
+        intro!: bind_is_OK_pure_I filter_M_pure_I bind_pure_I filter_M_is_OK_I)[1]
     using assms(3) local.get_disconnected_nodes_ok by blast
 qed
 
 lemma get_owner_document_child_same:
   assumes "heap_is_wellformed h"  "known_ptrs h" "type_wf h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "child \<in> set children"
   shows "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r owner_document"
 proof -
   have "ptr |\<in>| object_ptr_kinds h"
-    by (meson assms(4) is_OK_returns_result_I local.get_child_nodes_ptr_in_heap) 
+    by (meson assms(4) is_OK_returns_result_I local.get_child_nodes_ptr_in_heap)
   then have "known_ptr ptr"
-    using assms(2) local.known_ptrs_known_ptr by blast 
+    using assms(2) local.known_ptrs_known_ptr by blast
 
   have "cast child |\<in>| object_ptr_kinds h"
-    using assms(1) assms(4) assms(5) local.heap_is_wellformed_children_in_heap node_ptr_kinds_commutes by blast 
+    using assms(1) assms(4) assms(5) local.heap_is_wellformed_children_in_heap node_ptr_kinds_commutes
+    by blast
   then
   have "known_ptr (cast child)"
-    using assms(2) local.known_ptrs_known_ptr by blast 
+    using assms(2) local.known_ptrs_known_ptr by blast
 
   obtain root where root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
-    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_root_node_ok) 
+    by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.get_root_node_ok)
   then have "h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root"
-    using assms(1) assms(2) assms(3) assms(4) assms(5) local.child_parent_dual local.get_root_node_parent_same by blast 
+    using assms(1) assms(2) assms(3) assms(4) assms(5) local.child_parent_dual
+      local.get_root_node_parent_same
+    by blast
 
   have "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child () \<rightarrow>\<^sub>r owner_document"
   proof (cases "is_document_ptr ptr")
     case True
     then obtain document_ptr where document_ptr: "cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr = ptr"
-      using case_optionE document_ptr_casts_commute by blast 
+      using case_optionE document_ptr_casts_commute by blast
     then have "root = cast document_ptr"
       using root
-      by(auto simp add: get_root_node_def get_ancestors_def elim!: bind_returns_result_E2 split: option.splits)
-       
-    then have "h \<turnstile> a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr () \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child () \<rightarrow>\<^sub>r owner_document"
-      using document_ptr \<open>h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root\<close>[simplified \<open>root = cast document_ptr\<close> document_ptr] 
-      apply(auto simp add:  a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 dest!: bind_returns_result_E3[rotated, OF \<open>h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root\<close>[simplified \<open>root = cast document_ptr\<close> document_ptr], rotated] intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I split: if_splits option.splits)[1]
-      using \<open>ptr |\<in>| object_ptr_kinds h\<close> document_ptr_kinds_commutes by blast
+      by(auto simp add: get_root_node_def get_ancestors_def elim!: bind_returns_result_E2
+          split: option.splits)
+
+    then have "h \<turnstile> a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr () \<rightarrow>\<^sub>r owner_document \<longleftrightarrow>
+h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child () \<rightarrow>\<^sub>r owner_document"
+      using document_ptr
+        \<open>h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root\<close>[simplified \<open>root = cast document_ptr\<close> document_ptr]
+      apply(auto simp add:  a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
+          elim!: bind_returns_result_E2
+          dest!: bind_returns_result_E3[rotated, OF \<open>h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root\<close>
+            [simplified \<open>root = cast document_ptr\<close> document_ptr], rotated]
+          intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I
+          split: if_splits option.splits)[1]
+      using \<open>ptr |\<in>| object_ptr_kinds h\<close> document_ptr_kinds_commutes
+      by blast
     then show ?thesis
       using \<open>known_ptr ptr\<close>
       apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def known_ptr_impl)[1]
        apply(split invoke_splits, ((rule conjI | rule impI)+)?)+
           apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
           apply(drule(1)  known_ptr_not_character_data_ptr)
           apply(drule(1)  known_ptr_not_element_ptr)
           apply(simp add: NodeClass.known_ptr_defs)
       using \<open>ptr |\<in>| object_ptr_kinds h\<close> True
-      by(auto simp add: document_ptr[symmetric] intro!: bind_pure_returns_result_I split: option.splits)
+      by(auto simp add: document_ptr[symmetric]
+          intro!: bind_pure_returns_result_I
+          split: option.splits)
   next
     case False
     then obtain node_ptr where node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = ptr"
       using \<open>known_ptr ptr\<close>
-      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
-    then have "h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr () \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child () \<rightarrow>\<^sub>r owner_document"
+      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+          split: option.splits)
+    then have "h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr () \<rightarrow>\<^sub>r owner_document \<longleftrightarrow>
+h \<turnstile> a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child () \<rightarrow>\<^sub>r owner_document"
       using root \<open>h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root\<close>
       unfolding a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
       by (meson bind_pure_returns_result_I bind_returns_result_E3 local.get_root_node_pure)
     then show ?thesis
       using \<open>known_ptr ptr\<close>
-      apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def known_ptr_impl)
+      apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def known_ptr_impl)[1]
        apply(split invoke_splits, ((rule conjI | rule impI)+)?)+
           apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
           apply(drule(1)  known_ptr_not_character_data_ptr)
           apply(drule(1)  known_ptr_not_element_ptr)
           apply(simp add: NodeClass.known_ptr_defs)
       using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> False
          apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
       using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> False
         apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
       using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> False
        apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
       using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> False
       apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
       apply(split invoke_splits, ((rule conjI | rule impI)+)?)+
          apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
          apply (meson invoke_empty is_OK_returns_result_I)
         apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
-      apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
-     by(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
+       apply(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
+      by(auto simp add: node_ptr[symmetric] intro!: bind_pure_returns_result_I split: )[1]
   qed
   then show ?thesis
     using \<open>known_ptr (cast child)\<close>
-    apply(auto simp add: get_owner_document_def[of "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child"] a_get_owner_document_tups_def known_ptr_impl)[1]
+    apply(auto simp add: get_owner_document_def[of "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child"]
+        a_get_owner_document_tups_def known_ptr_impl)[1]
      apply(split invoke_splits, ((rule conjI | rule impI)+)?)+
         apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
         apply(drule(1)  known_ptr_not_character_data_ptr)
         apply(drule(1)  known_ptr_not_element_ptr)
         apply(simp add: NodeClass.known_ptr_defs)
     using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
        apply(auto intro!: bind_pure_returns_result_I split: option.splits)[1]
     using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
       apply(auto intro!: bind_pure_returns_result_I split: option.splits)[1]
     using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
      apply(auto intro!: bind_pure_returns_result_I split: option.splits)[1]
     using \<open>cast child |\<in>| object_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
     apply(auto intro!: bind_pure_returns_result_I split: option.splits)[1]
-    by (smt \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child |\<in>| object_ptr_kinds h\<close> cast_document_ptr_not_node_ptr(1) comp_apply invoke_empty invoke_not invoke_returns_result is_OK_returns_result_I node_ptr_casts_commute2 option.sel)
+    by (smt \<open>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child |\<in>| object_ptr_kinds h\<close> cast_document_ptr_not_node_ptr(1)
+        comp_apply invoke_empty invoke_not invoke_returns_result is_OK_returns_result_I
+        node_ptr_casts_commute2 option.sel)
 qed
 
 end
 
-locale l_get_owner_document_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs 
-                               + l_get_disconnected_nodes_defs + l_get_owner_document_defs 
-                               + l_get_parent_defs +
+locale l_get_owner_document_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs
+  + l_get_disconnected_nodes_defs + l_get_owner_document_defs
+  + l_get_parent_defs +
   assumes get_owner_document_disconnected_nodes:
     "heap_is_wellformed h \<Longrightarrow>
      known_ptrs h \<Longrightarrow>
      type_wf h \<Longrightarrow>
      h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes \<Longrightarrow>
      node_ptr \<in> set disc_nodes \<Longrightarrow>
      h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r document_ptr"
   assumes in_disconnected_nodes_no_parent:
-   "heap_is_wellformed h \<Longrightarrow>
+    "heap_is_wellformed h \<Longrightarrow>
     h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r None\<Longrightarrow>
     h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r owner_document \<Longrightarrow>
     h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes \<Longrightarrow>
     known_ptrs h \<Longrightarrow>
     type_wf h\<Longrightarrow>
     node_ptr \<in> set disc_nodes"
- assumes get_owner_document_owner_document_in_heap: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<Longrightarrow> owner_document |\<in>| document_ptr_kinds h"
- assumes get_owner_document_ok: 
-    "heap_is_wellformed h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h 
+  assumes get_owner_document_owner_document_in_heap:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow>
+h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<Longrightarrow>
+owner_document |\<in>| document_ptr_kinds h"
+  assumes get_owner_document_ok:
+    "heap_is_wellformed h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
                           \<Longrightarrow> h \<turnstile> ok (get_owner_document ptr)"
 
 interpretation i_get_owner_document_wf?: l_get_owner_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr known_ptrs type_wf heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_parent get_parent_locs get_ancestors get_ancestors_locs get_root_node get_root_node_locs get_owner_document
+  known_ptr known_ptrs type_wf heap_is_wellformed parent_child_rel get_child_nodes
+  get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_parent get_parent_locs
+  get_ancestors get_ancestors_locs get_root_node get_root_node_locs get_owner_document
   by(auto simp add: l_get_owner_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_owner_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 lemma get_owner_document_wf_is_l_get_owner_document_wf [instances]:
-  "l_get_owner_document_wf heap_is_wellformed type_wf known_ptr known_ptrs get_disconnected_nodes 
+  "l_get_owner_document_wf heap_is_wellformed type_wf known_ptr known_ptrs get_disconnected_nodes
                            get_owner_document get_parent"
   using known_ptrs_is_l_known_ptrs
   apply(auto simp add: l_get_owner_document_wf_def l_get_owner_document_wf_axioms_def)[1]
   using get_owner_document_disconnected_nodes apply fast
   using  in_disconnected_nodes_no_parent apply fast
   using get_owner_document_owner_document_in_heap apply fast
   using get_owner_document_ok apply fast
   done
 
 
 subsubsection \<open>get\_root\_node\<close>
 
 locale l_get_owner_document_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_root_node_wf +
   l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document_wf
 begin
 
 lemma get_root_node_document:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   assumes "is_document_ptr_kind root"
   shows "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r the (cast root)"
 proof -
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     by (meson is_OK_returns_result_I local.get_root_node_ptr_in_heap)
   then have "known_ptr ptr"
     using assms(3) local.known_ptrs_known_ptr by blast
   {
     assume "is_document_ptr_kind ptr"
     then have "ptr = root"
       using assms(4)
-      by(auto simp add: get_root_node_def get_ancestors_def elim!: bind_returns_result_E2 split: option.splits)
+      by(auto simp add: get_root_node_def get_ancestors_def elim!: bind_returns_result_E2
+          split: option.splits)
     then have ?thesis
       using \<open>is_document_ptr_kind ptr\<close> \<open>known_ptr ptr\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
       apply(auto simp add: known_ptr_impl get_owner_document_def a_get_owner_document_tups_def)[1]
       apply(split invoke_splits, (rule conjI | rule impI)+)+
          apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
          apply(drule(1) known_ptr_not_character_data_ptr)
          apply(drule(1) known_ptr_not_element_ptr)
          apply(simp add: NodeClass.known_ptr_defs)
-      by(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I split: option.splits)
+      by(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I
+          split: option.splits)
   }
   moreover
   {
     assume "is_node_ptr_kind ptr"
     then have ?thesis
       using \<open>known_ptr ptr\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
-      apply(auto simp add: known_ptr_impl get_owner_document_def a_get_owner_document_tups_def)
+      apply(auto simp add: known_ptr_impl get_owner_document_def a_get_owner_document_tups_def)[1]
       apply(split invoke_splits, (rule conjI | rule impI)+)+
          apply(drule(1) known_ptr_not_document_ptr[folded known_ptr_impl])
          apply(drule(1) known_ptr_not_character_data_ptr)
          apply(drule(1) known_ptr_not_element_ptr)
          apply(simp add: NodeClass.known_ptr_defs)
         apply(auto split: option.splits)[1]
       using \<open>h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root\<close> assms(5)
-      by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def is_document_ptr_kind_def intro!: bind_pure_returns_result_I  split: option.splits)[2]
+      by(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def is_document_ptr_kind_def
+          intro!: bind_pure_returns_result_I
+          split: option.splits)[2]
   }
-  ultimately 
+  ultimately
   show ?thesis
     using \<open>known_ptr ptr\<close>
-    by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+    by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+        ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+        split: option.splits)
 qed
 
 lemma get_root_node_same_owner_document:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   shows "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document"
 proof -
   have "ptr |\<in>| object_ptr_kinds h"
     by (meson assms(4) is_OK_returns_result_I local.get_root_node_ptr_in_heap)
   have "root |\<in>| object_ptr_kinds h"
     using assms(1) assms(2) assms(3) assms(4) local.get_root_node_root_in_heap by blast
   have "known_ptr ptr"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(3) local.known_ptrs_known_ptr by blast
   have "known_ptr root"
     using \<open>root |\<in>| object_ptr_kinds h\<close> assms(3) local.known_ptrs_known_ptr by blast
   show ?thesis
   proof (cases "is_document_ptr_kind ptr")
     case True
     then
     have "ptr = root"
       using assms(4)
       apply(auto simp add: get_root_node_def elim!: bind_returns_result_E2)[1]
-      by (metis document_ptr_casts_commute3 last_ConsL local.get_ancestors_not_node node_ptr_no_document_ptr_cast)
+      by (metis document_ptr_casts_commute3 last_ConsL local.get_ancestors_not_node
+          node_ptr_no_document_ptr_cast)
     then show ?thesis
       by auto
   next
     case False
     then have "is_node_ptr_kind ptr"
       using \<open>known_ptr ptr\<close>
-      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+          split: option.splits)
     then obtain node_ptr where node_ptr: "ptr = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr"
       by (metis node_ptr_casts_commute3)
     show ?thesis
     proof
       assume "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
       then have "h \<turnstile> local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr () \<rightarrow>\<^sub>r owner_document"
         using node_ptr
         apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
         apply(split invoke_splits)+
            apply (meson invoke_empty is_OK_returns_result_I)
         by(auto  elim!: bind_returns_result_E2 split: option.splits)
 
       show "h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document"
       proof (cases "is_document_ptr_kind root")
         case True
         have "is_document_ptr root"
           using True \<open>known_ptr root\<close>
-          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+              ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
         have "root = cast owner_document"
-          using True 
-          by (smt \<open>h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document\<close> assms(1) assms(2) assms(3) assms(4) document_ptr_casts_commute3 get_root_node_document returns_result_eq)
+          using True
+          by (smt \<open>h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document\<close> assms(1) assms(2) assms(3) assms(4)
+              document_ptr_casts_commute3 get_root_node_document returns_result_eq)
         then show ?thesis
-          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)
+          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
           apply(split invoke_splits, (rule conjI | rule impI)+)+
           using \<open>is_document_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root\<close> apply blast
           using \<open>root |\<in>| object_ptr_kinds h\<close>
           by(auto simp add: a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def is_node_ptr_kind_none)
 
       next
         case False
         then have "is_node_ptr_kind root"
           using \<open>known_ptr root\<close>
-          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+              ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
         then obtain root_node_ptr where root_node_ptr: "root = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr"
           by (metis node_ptr_casts_commute3)
         then have "h \<turnstile> local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr () \<rightarrow>\<^sub>r owner_document"
           using \<open>h \<turnstile> local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr () \<rightarrow>\<^sub>r owner_document\<close> assms(4)
-          apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I split: option.splits)
-           apply (metis assms(1) assms(2) assms(3) local.get_root_node_no_parent local.get_root_node_same_no_parent node_ptr returns_result_eq)
+          apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2
+              intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I split: option.splits)[1]
+           apply (metis assms(1) assms(2) assms(3) local.get_root_node_no_parent
+              local.get_root_node_same_no_parent node_ptr returns_result_eq)
           using \<open>is_node_ptr_kind root\<close> node_ptr returns_result_eq by fastforce
         then show ?thesis
-          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)
+          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
           apply(split invoke_splits, (rule conjI | rule impI)+)+
           using \<open>is_node_ptr_kind root\<close> \<open>known_ptr root\<close>
-             apply(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)[2]
+             apply(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs
+              CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+              split: option.splits)[1]
+            apply(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs
+              CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+              split: option.splits)[1]
           using \<open>root |\<in>| object_ptr_kinds h\<close>
           by(auto simp add: root_node_ptr)
       qed
     next
       assume "h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document"
       show "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
       proof (cases "is_document_ptr_kind root")
         case True
         have "root = cast owner_document"
           using \<open>h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document\<close>
-          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)
+          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
           apply(split invoke_splits)+
              apply (meson invoke_empty is_OK_returns_result_I)
-            apply(auto simp add: True a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 split: if_splits)
-           apply (metis True cast_document_ptr_not_node_ptr(2) is_document_ptr_kind_obtains is_node_ptr_kind_none node_ptr_casts_commute3 option.case_eq_if)
-          by (metis True cast_document_ptr_not_node_ptr(1) document_ptr_casts_commute3 is_node_ptr_kind_none node_ptr_casts_commute3 option.case_eq_if)
+            apply(auto simp add: True a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2
+              split: if_splits)[1]
+           apply (metis True cast_document_ptr_not_node_ptr(2) is_document_ptr_kind_obtains
+              is_node_ptr_kind_none node_ptr_casts_commute3 option.case_eq_if)
+          by (metis True cast_document_ptr_not_node_ptr(1) document_ptr_casts_commute3
+              is_node_ptr_kind_none node_ptr_casts_commute3 option.case_eq_if)
         then show ?thesis
           using assms(1) assms(2) assms(3) assms(4) get_root_node_document
           by fastforce
       next
         case False
         then have "is_node_ptr_kind root"
           using \<open>known_ptr root\<close>
-          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs
+              CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+              split: option.splits)
         then obtain root_node_ptr where root_node_ptr: "root = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr"
           by (metis node_ptr_casts_commute3)
         then have "h \<turnstile> local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr () \<rightarrow>\<^sub>r owner_document"
           using \<open>h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document\<close>
-          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)
+          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
           apply(split invoke_splits)+
              apply (meson invoke_empty is_OK_returns_result_I)
           by(auto simp add: is_document_ptr_kind_none elim!: bind_returns_result_E2)
         then have "h \<turnstile> local.a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr () \<rightarrow>\<^sub>r owner_document"
-          apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I split: option.splits)
-          using assms(1) assms(2) assms(3) assms(4) local.get_root_node_no_parent local.get_root_node_same_no_parent node_ptr returns_result_eq root_node_ptr 
+          apply(auto simp add: a_get_owner_document\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2
+              intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I split: option.splits)[1]
+          using assms(1) assms(2) assms(3) assms(4) local.get_root_node_no_parent
+            local.get_root_node_same_no_parent node_ptr returns_result_eq root_node_ptr
           by fastforce+
         then show ?thesis
-          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)
+          apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
           apply(split invoke_splits, (rule conjI | rule impI)+)+
           using node_ptr  \<open>known_ptr ptr\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close>
 
-          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs intro!: bind_pure_returns_result_I split: option.splits)
+          by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs
+              CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs
+              intro!: bind_pure_returns_result_I split: option.splits)
       qed
     qed
   qed
 qed
 end
 
-interpretation get_owner_document_wf_get_root_node_wf?: l_get_owner_document_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_ancestors get_ancestors_locs get_root_node get_root_node_locs heap_is_wellformed parent_child_rel get_disconnected_nodes get_disconnected_nodes_locs get_owner_document
+interpretation get_owner_document_wf_get_root_node_wf?: l_get_owner_document_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
+  type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs
+  get_ancestors get_ancestors_locs get_root_node get_root_node_locs heap_is_wellformed parent_child_rel
+  get_disconnected_nodes get_disconnected_nodes_locs get_owner_document
   by(auto simp add: l_get_owner_document_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_owner_document_wf_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
-locale l_get_owner_document_wf_get_root_node_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs + l_get_root_node_defs + l_get_owner_document_defs +
-  assumes get_root_node_document: "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root \<Longrightarrow> is_document_ptr_kind root \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r the (cast root)"
-  assumes get_root_node_same_owner_document: "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document"
+locale l_get_owner_document_wf_get_root_node_wf = l_heap_is_wellformed_defs + l_type_wf +
+  l_known_ptrs + l_get_root_node_defs + l_get_owner_document_defs +
+  assumes get_root_node_document:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root \<Longrightarrow>
+is_document_ptr_kind root \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r the (cast root)"
+  assumes get_root_node_same_owner_document:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root \<Longrightarrow>
+h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<longleftrightarrow> h \<turnstile> get_owner_document root \<rightarrow>\<^sub>r owner_document"
 
 lemma get_owner_document_wf_get_root_node_wf_is_l_get_owner_document_wf_get_root_node_wf [instances]:
-  "l_get_owner_document_wf_get_root_node_wf heap_is_wellformed type_wf known_ptr known_ptrs get_root_node get_owner_document"
-  apply(auto simp add: l_get_owner_document_wf_get_root_node_wf_def l_get_owner_document_wf_get_root_node_wf_axioms_def instances)
+  "l_get_owner_document_wf_get_root_node_wf heap_is_wellformed type_wf known_ptr known_ptrs
+get_root_node get_owner_document"
+  apply(auto simp add: l_get_owner_document_wf_get_root_node_wf_def
+      l_get_owner_document_wf_get_root_node_wf_axioms_def instances)[1]
   using get_root_node_document apply blast
   using get_root_node_same_owner_document apply (blast, blast)
   done
 
 
 subsection \<open>Preserving heap-wellformedness\<close>
 
 subsection \<open>set\_attribute\<close>
 
 locale l_set_attribute_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_parent_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
-  l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M + 
-  l_set_attribute_get_disconnected_nodes + 
+  l_set_attribute\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
+  l_set_attribute_get_disconnected_nodes +
   l_set_attribute_get_child_nodes
 begin
 lemma set_attribute_preserves_wellformedness:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> set_attribute element_ptr k v \<rightarrow>\<^sub>h h'"
   shows "heap_is_wellformed h'"
   thm preserves_wellformedness_writes_needed
   apply(rule preserves_wellformedness_writes_needed[OF assms set_attribute_writes])
   using  set_attribute_get_child_nodes
-  apply(fast)
+    apply(fast)
   using set_attribute_get_disconnected_nodes apply(fast)
   by(auto simp add: all_args_def set_attribute_locs_def)
 end
 
 
 subsection \<open>remove\_child\<close>
 
 locale l_remove_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_heap_is_wellformed +
   l_set_disconnected_nodes_get_child_nodes
 begin
 lemma remove_child_removes_parent:
   assumes wellformed: "heap_is_wellformed h"
     and remove_child: "h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h2"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "h2 \<turnstile> get_parent child \<rightarrow>\<^sub>r None"
 proof -
   obtain children where children: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     using remove_child remove_child_def by auto
   then have "child \<in> set children"
     using remove_child remove_child_def
     by(auto elim!: bind_returns_heap_E dest: returns_result_eq split: if_splits)
-  then have h1: "\<And>other_ptr other_children. other_ptr \<noteq> ptr 
+  then have h1: "\<And>other_ptr other_children. other_ptr \<noteq> ptr
                 \<Longrightarrow> h \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children \<Longrightarrow> child \<notin> set other_children"
     using assms(1) known_ptrs  type_wf child_parent_dual
     by (meson child_parent_dual children option.inject returns_result_eq)
 
   have known_ptr: "known_ptr ptr"
     using known_ptrs
-    by (meson is_OK_returns_heap_I l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms 
-              remove_child remove_child_ptr_in_heap)
+    by (meson is_OK_returns_heap_I l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms
+        remove_child remove_child_ptr_in_heap)
 
   obtain owner_document disc_nodes h' where
-    owner_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r owner_document" and 
+    owner_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r owner_document" and
     disc_nodes: "h \<turnstile>  get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes" and
     h': "h \<turnstile>  set_disconnected_nodes owner_document (child # disc_nodes) \<rightarrow>\<^sub>h h'" and
     h2: "h' \<turnstile> set_child_nodes ptr (remove1 child children) \<rightarrow>\<^sub>h h2"
     using assms children unfolding remove_child_def
     apply(auto split: if_splits elim!: bind_returns_heap_E)[1]
-    by (metis (full_types) get_child_nodes_pure get_disconnected_nodes_pure 
-       get_owner_document_pure pure_returns_heap_eq returns_result_eq)
+    by (metis (full_types) get_child_nodes_pure get_disconnected_nodes_pure
+        get_owner_document_pure pure_returns_heap_eq returns_result_eq)
 
   have "object_ptr_kinds h = object_ptr_kinds h2"
     using remove_child_writes remove_child unfolding remove_child_locs_def
     apply(rule writes_small_big)
     using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
     by(auto simp add: reflp_def transp_def)
   then have "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     unfolding object_ptr_kinds_M_defs by simp
 
   have "type_wf h'"
-    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", 
-                           OF set_disconnected_nodes_writes h']
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'",
+        OF set_disconnected_nodes_writes h']
     using set_disconnected_nodes_types_preserved type_wf
     by(auto simp add: reflp_def transp_def)
   have "type_wf h2"
-    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", 
-                           OF remove_child_writes remove_child]  unfolding remove_child_locs_def
-    using set_disconnected_nodes_types_preserved set_child_nodes_types_preserved type_wf 
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'",
+        OF remove_child_writes remove_child]  unfolding remove_child_locs_def
+    using set_disconnected_nodes_types_preserved set_child_nodes_types_preserved type_wf
     apply(auto simp add: reflp_def transp_def)[1]
     by blast
   then obtain children' where children': "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
     using h2 set_child_nodes_get_child_nodes known_ptr
-    by (metis \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> children get_child_nodes_ok 
-              get_child_nodes_ptr_in_heap is_OK_returns_result_E is_OK_returns_result_I)
+    by (metis \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> children get_child_nodes_ok
+        get_child_nodes_ptr_in_heap is_OK_returns_result_E is_OK_returns_result_I)
 
   have "child \<notin> set children'"
-    by (metis (mono_tags, lifting) \<open>type_wf h'\<close> children children' distinct_remove1_removeAll h2 
-              known_ptr local.heap_is_wellformed_children_distinct 
-              local.set_child_nodes_get_child_nodes member_remove remove_code(1) select_result_I2 
-              wellformed)
-
-
-  moreover have "\<And>other_ptr other_children. other_ptr \<noteq> ptr 
+    by (metis (mono_tags, lifting) \<open>type_wf h'\<close> children children' distinct_remove1_removeAll h2
+        known_ptr local.heap_is_wellformed_children_distinct
+        local.set_child_nodes_get_child_nodes member_remove remove_code(1) select_result_I2
+        wellformed)
+
+
+  moreover have "\<And>other_ptr other_children. other_ptr \<noteq> ptr
                 \<Longrightarrow> h' \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children \<Longrightarrow> child \<notin> set other_children"
   proof -
     fix other_ptr other_children
     assume a1: "other_ptr \<noteq> ptr"  and a3: "h' \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children"
     have "h \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children"
-      using get_child_nodes_reads set_disconnected_nodes_writes h' a3 
+      using get_child_nodes_reads set_disconnected_nodes_writes h' a3
       apply(rule reads_writes_separate_backwards)
       using set_disconnected_nodes_get_child_nodes by fast
     show "child \<notin> set other_children"
       using \<open>h \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children\<close> a1 h1 by blast
   qed
-  then have "\<And>other_ptr other_children. other_ptr \<noteq> ptr 
+  then have "\<And>other_ptr other_children. other_ptr \<noteq> ptr
             \<Longrightarrow>  h2 \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children \<Longrightarrow> child \<notin> set other_children"
   proof -
     fix other_ptr other_children
     assume a1: "other_ptr \<noteq> ptr" and a3: "h2 \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children"
     have "h' \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children"
       using get_child_nodes_reads set_child_nodes_writes h2 a3
       apply(rule reads_writes_separate_backwards)
-      using set_disconnected_nodes_get_child_nodes a1 set_child_nodes_get_child_nodes_different_pointers 
+      using set_disconnected_nodes_get_child_nodes a1 set_child_nodes_get_child_nodes_different_pointers
       by metis
     then show "child \<notin> set other_children"
-      using \<open>\<And>other_ptr other_children. \<lbrakk>other_ptr \<noteq> ptr; h' \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children\<rbrakk> 
+      using \<open>\<And>other_ptr other_children. \<lbrakk>other_ptr \<noteq> ptr; h' \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children\<rbrakk>
              \<Longrightarrow> child \<notin> set other_children\<close> a1 by blast
   qed
-  ultimately have ha: "\<And>other_ptr other_children. h2 \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children 
+  ultimately have ha: "\<And>other_ptr other_children. h2 \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children
                       \<Longrightarrow> child \<notin> set other_children"
     by (metis (full_types) children' returns_result_eq)
   moreover obtain ptrs where ptrs: "h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by (simp add: object_ptr_kinds_M_defs)
   moreover have "\<And>ptr. ptr \<in> set ptrs \<Longrightarrow> h2 \<turnstile> ok (get_child_nodes ptr)"
     using \<open>type_wf h2\<close> ptrs get_child_nodes_ok known_ptr
-    using \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> known_ptrs local.known_ptrs_known_ptr by auto 
-  ultimately show "h2 \<turnstile> get_parent child \<rightarrow>\<^sub>r None"                     
+    using \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> known_ptrs local.known_ptrs_known_ptr by auto
+  ultimately show "h2 \<turnstile> get_parent child \<rightarrow>\<^sub>r None"
     apply(auto simp add: get_parent_def intro!: bind_pure_returns_result_I filter_M_pure_I bind_pure_I)[1]
   proof -
     have "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child |\<in>| object_ptr_kinds h"
       using get_owner_document_ptr_in_heap owner_document by blast
     then show "h2 \<turnstile> check_in_heap (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r ()"
       by (simp add: \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> check_in_heap_def)
   next
-    show "(\<And>other_ptr other_children. h2 \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children 
+    show "(\<And>other_ptr other_children. h2 \<turnstile> get_child_nodes other_ptr \<rightarrow>\<^sub>r other_children
          \<Longrightarrow> child \<notin> set other_children) \<Longrightarrow>
     ptrs = sorted_list_of_set (fset (object_ptr_kinds h2)) \<Longrightarrow>
     (\<And>ptr. ptr |\<in>| object_ptr_kinds h2 \<Longrightarrow> h2 \<turnstile> ok get_child_nodes ptr) \<Longrightarrow>
-    h2 \<turnstile> filter_M (\<lambda>ptr. Heap_Error_Monad.bind (get_child_nodes ptr) 
+    h2 \<turnstile> filter_M (\<lambda>ptr. Heap_Error_Monad.bind (get_child_nodes ptr)
        (\<lambda>children. return (child \<in> set children))) (sorted_list_of_set (fset (object_ptr_kinds h2))) \<rightarrow>\<^sub>r []"
       by(auto intro!: filter_M_empty_I bind_pure_I)
   qed
 qed
 end
 
 locale l_remove_child_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_remove_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma remove_child_parent_child_rel_subset:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'"
     and "known_ptrs h"
     and type_wf: "type_wf h"
   shows "parent_child_rel h' \<subseteq> parent_child_rel h"
 proof (standard, safe)
 
   obtain owner_document children_h h2 disconnected_nodes_h where
     owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document" and
-    children_h: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h" and 
+    children_h: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h" and
     child_in_children_h: "child \<in> set children_h" and
     disconnected_nodes_h: "h \<turnstile>  get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h" and
     h2: "h \<turnstile>  set_disconnected_nodes owner_document (child # disconnected_nodes_h) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> set_child_nodes ptr (remove1 child children_h) \<rightarrow>\<^sub>h h'"
     using assms(2)
-    apply(auto simp add: remove_child_def elim!: bind_returns_heap_E 
-               dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-                      pure_returns_heap_eq[rotated, OF get_child_nodes_pure] 
-               split: if_splits)[1]
+    apply(auto simp add: remove_child_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_child_nodes_pure]
+        split: if_splits)[1]
     using pure_returns_heap_eq by fastforce
   have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF remove_child_writes assms(2)])  
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes assms(2)])
     unfolding remove_child_locs_def
-    using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
+    using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_eq: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     unfolding object_ptr_kinds_M_defs by simp
   then have object_ptr_kinds_eq2: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     using select_result_eq by force
   then have node_ptr_kinds_eq2: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by auto
   then have node_ptr_kinds_eq3: "node_ptr_kinds h = node_ptr_kinds h'"
     using node_ptr_kinds_M_eq by auto
   have document_ptr_kinds_eq2: "|h \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_eq2 document_ptr_kinds_M_eq by auto
   then have document_ptr_kinds_eq3: "document_ptr_kinds h = document_ptr_kinds h'"
     using document_ptr_kinds_M_eq by auto
-  have children_eq: 
-    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
-    apply(rule reads_writes_preserved[OF get_child_nodes_reads remove_child_writes assms(2)]) 
+  have children_eq:
+    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow>
+h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children =h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    apply(rule reads_writes_preserved[OF get_child_nodes_reads remove_child_writes assms(2)])
     unfolding remove_child_locs_def
-    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers 
+    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers
     by fast
-  then have children_eq2: 
+  then have children_eq2:
     "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq: 
-   "\<And>document_ptr disconnected_nodes. document_ptr \<noteq> owner_document 
+  have disconnected_nodes_eq:
+    "\<And>document_ptr disconnected_nodes. document_ptr \<noteq> owner_document
        \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes
          = h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes"
-    apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads remove_child_writes assms(2)])  
+    apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads remove_child_writes assms(2)])
     unfolding remove_child_locs_def
     using set_child_nodes_get_disconnected_nodes set_disconnected_nodes_get_disconnected_nodes_different_pointers
     by (metis (no_types, lifting) Un_iff owner_document select_result_I2)
-  then have disconnected_nodes_eq2: 
-    "\<And>document_ptr. document_ptr \<noteq> owner_document 
+  then have disconnected_nodes_eq2:
+    "\<And>document_ptr. document_ptr \<noteq> owner_document
        \<Longrightarrow> |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h"
-    apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes h2 children_h] )
+    apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes
+          h2 children_h] )
     by (simp add: set_disconnected_nodes_get_child_nodes)
 
   have "known_ptr ptr"
     using assms(3)
     using children_h get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr by blast
   have "type_wf h2"
-    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h2]
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes
+        h2]
     using set_disconnected_nodes_types_preserved type_wf
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_child_nodes_writes h']
-    using  set_child_nodes_types_preserved  
+    using  set_child_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r remove1 child children_h"
     using assms(2) owner_document h2 disconnected_nodes_h children_h
     apply(auto simp add: remove_child_def split: if_splits)[1]
     apply(drule bind_returns_heap_E3)
       apply(auto split: if_splits)[1]
      apply(simp)
     apply(auto split: if_splits)[1]
     apply(drule bind_returns_heap_E3)
       apply(auto)[1]
      apply(simp)
     apply(drule bind_returns_heap_E3)
       apply(auto)[1]
      apply(simp)
     apply(drule bind_returns_heap_E4)
       apply(auto)[1]
      apply(simp)
     using \<open>type_wf h2\<close> set_child_nodes_get_child_nodes \<open>known_ptr ptr\<close> h'
     by blast
 
   fix parent child
   assume a1: "(parent, child) \<in> parent_child_rel h'"
   then show "(parent, child) \<in> parent_child_rel h"
   proof (cases "parent = ptr")
     case True
     then show ?thesis
-      using a1 remove_child_removes_parent[OF assms(1) assms(2)] children_h children_h' 
-            get_child_nodes_ptr_in_heap
+      using a1 remove_child_removes_parent[OF assms(1) assms(2)] children_h children_h'
+        get_child_nodes_ptr_in_heap
       apply(auto simp add: parent_child_rel_def object_ptr_kinds_eq )[1]
       by (metis notin_set_remove1)
   next
     case False
     then show ?thesis
       using a1
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq3 children_eq2)
   qed
 qed
 
 
 lemma remove_child_heap_is_wellformed_preserved:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'"
     and "known_ptrs h"
     and type_wf: "type_wf h"
   shows "type_wf h'" and "known_ptrs h'" and "heap_is_wellformed h'"
 proof -
   obtain owner_document children_h h2 disconnected_nodes_h where
     owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document" and
-    children_h: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h" and 
+    children_h: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h" and
     child_in_children_h: "child \<in> set children_h" and
     disconnected_nodes_h: "h \<turnstile>  get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h" and
     h2: "h \<turnstile>  set_disconnected_nodes owner_document (child # disconnected_nodes_h) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> set_child_nodes ptr (remove1 child children_h) \<rightarrow>\<^sub>h h'"
     using assms(2)
     apply(auto simp add: remove_child_def elim!: bind_returns_heap_E
-               dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-                      pure_returns_heap_eq[rotated, OF get_child_nodes_pure] split: if_splits)[1]
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_child_nodes_pure] split: if_splits)[1]
     using pure_returns_heap_eq by fastforce
 
   have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
-                                OF remove_child_writes assms(2)])  
+          OF remove_child_writes assms(2)])
     unfolding remove_child_locs_def
-    using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
+    using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_eq: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     unfolding object_ptr_kinds_M_defs by simp
   then have object_ptr_kinds_eq2: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     using select_result_eq by force
   then have node_ptr_kinds_eq2: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by auto
   then have node_ptr_kinds_eq3: "node_ptr_kinds h = node_ptr_kinds h'"
     using node_ptr_kinds_M_eq by auto
   have document_ptr_kinds_eq2: "|h \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_eq2 document_ptr_kinds_M_eq by auto
   then have document_ptr_kinds_eq3: "document_ptr_kinds h = document_ptr_kinds h'"
     using document_ptr_kinds_M_eq by auto
-  have children_eq: 
-    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
-    apply(rule reads_writes_preserved[OF get_child_nodes_reads remove_child_writes assms(2)])  
+  have children_eq:
+    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow>
+h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    apply(rule reads_writes_preserved[OF get_child_nodes_reads remove_child_writes assms(2)])
     unfolding remove_child_locs_def
-    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers 
+    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers
     by fast
-  then have children_eq2: 
-      "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2:
+    "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq: "\<And>document_ptr disconnected_nodes. document_ptr \<noteq> owner_document 
-         \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes 
+  have disconnected_nodes_eq: "\<And>document_ptr disconnected_nodes. document_ptr \<noteq> owner_document
+         \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes
              = h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes"
-    apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads remove_child_writes assms(2)]) 
+    apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads remove_child_writes assms(2)])
     unfolding remove_child_locs_def
     using set_child_nodes_get_disconnected_nodes set_disconnected_nodes_get_disconnected_nodes_different_pointers
     by (metis (no_types, lifting) Un_iff owner_document select_result_I2)
-  then have disconnected_nodes_eq2: 
-   "\<And>document_ptr. document_ptr \<noteq> owner_document 
+  then have disconnected_nodes_eq2:
+    "\<And>document_ptr. document_ptr \<noteq> owner_document
     \<Longrightarrow> |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h"
-    apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes h2 children_h] )
+    apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes
+          h2 children_h] )
     by (simp add: set_disconnected_nodes_get_child_nodes)
 
   show "known_ptrs h'"
     using object_ptr_kinds_eq3 known_ptrs_preserved \<open>known_ptrs h\<close> by blast
 
   have "known_ptr ptr"
     using assms(3)
     using children_h get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr by blast
-have "type_wf h2"
-    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h2]
+  have "type_wf h2"
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'",
+        OF set_disconnected_nodes_writes h2]
     using set_disconnected_nodes_types_preserved type_wf
     by(auto simp add: reflp_def transp_def)
   then show "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_child_nodes_writes h']
-    using  set_child_nodes_types_preserved  
+    using  set_child_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r remove1 child children_h"
     using assms(2) owner_document h2 disconnected_nodes_h children_h
     apply(auto simp add: remove_child_def split: if_splits)[1]
     apply(drule bind_returns_heap_E3)
       apply(auto split: if_splits)[1]
      apply(simp)
     apply(auto split: if_splits)[1]
     apply(drule bind_returns_heap_E3)
       apply(auto)[1]
      apply(simp)
     apply(drule bind_returns_heap_E3)
       apply(auto)[1]
      apply(simp)
     apply(drule bind_returns_heap_E4)
       apply(auto)[1]
      apply simp
     using \<open>type_wf h2\<close> set_child_nodes_get_child_nodes \<open>known_ptr ptr\<close> h'
     by blast
 
   have disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r child # disconnected_nodes_h"
     using owner_document assms(2) h2 disconnected_nodes_h
     apply (auto simp add: remove_child_def  split: if_splits)[1]
     apply(drule bind_returns_heap_E2)
       apply(auto split: if_splits)[1]
      apply(simp)
     by(auto simp add: local.set_disconnected_nodes_get_disconnected_nodes split: if_splits)
   then have disconnected_nodes_h': "h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r child # disconnected_nodes_h"
     apply(rule reads_writes_separate_forwards[OF get_disconnected_nodes_reads set_child_nodes_writes h'])
     by (simp add: set_child_nodes_get_disconnected_nodes)
 
   moreover have "a_acyclic_heap h"
     using assms(1)  by (simp add: heap_is_wellformed_def)
   have "parent_child_rel h' \<subseteq> parent_child_rel h"
   proof (standard, safe)
     fix parent child
     assume a1: "(parent, child) \<in> parent_child_rel h'"
     then show "(parent, child) \<in> parent_child_rel h"
     proof (cases "parent = ptr")
       case True
       then show ?thesis
-        using a1 remove_child_removes_parent[OF assms(1) assms(2)] children_h children_h' 
-              get_child_nodes_ptr_in_heap
+        using a1 remove_child_removes_parent[OF assms(1) assms(2)] children_h children_h'
+          get_child_nodes_ptr_in_heap
         apply(auto simp add: parent_child_rel_def object_ptr_kinds_eq )[1]
         by (metis imageI notin_set_remove1)
     next
       case False
       then show ?thesis
         using a1
         by(auto simp add: parent_child_rel_def object_ptr_kinds_eq3 children_eq2)
     qed
   qed
   then have "a_acyclic_heap h'"
     using \<open>a_acyclic_heap h\<close> acyclic_heap_def acyclic_subset by blast
 
   moreover have "a_all_ptrs_in_heap h"
     using assms(1)  by (simp add: heap_is_wellformed_def)
   then have "a_all_ptrs_in_heap h'"
     apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3 disconnected_nodes_eq)[1]
-    apply (metis (no_types, lifting) \<open>type_wf h'\<close> assms(2) assms(3) local.get_child_nodes_ok local.known_ptrs_known_ptr local.remove_child_children_subset notin_fset object_ptr_kinds_eq3 returns_result_select_result subset_code(1) type_wf)
-  apply (metis (no_types, lifting) assms(2) disconnected_nodes_eq2 disconnected_nodes_h disconnected_nodes_h' document_ptr_kinds_eq3 finite_set_in local.remove_child_child_in_heap node_ptr_kinds_eq3 select_result_I2 set_ConsD subset_code(1))
+     apply (metis (no_types, lifting) \<open>type_wf h'\<close> assms(2) assms(3) local.get_child_nodes_ok
+        local.known_ptrs_known_ptr local.remove_child_children_subset notin_fset object_ptr_kinds_eq3
+        returns_result_select_result subset_code(1) type_wf)
+    apply (metis (no_types, lifting) assms(2) disconnected_nodes_eq2 disconnected_nodes_h
+        disconnected_nodes_h' document_ptr_kinds_eq3 finite_set_in local.remove_child_child_in_heap
+        node_ptr_kinds_eq3 select_result_I2 set_ConsD subset_code(1))
     done
   moreover have "a_owner_document_valid h"
     using assms(1)  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
-    apply(auto simp add: a_owner_document_valid_def object_ptr_kinds_eq3 document_ptr_kinds_eq3 
-                         node_ptr_kinds_eq3)[1]
+    apply(auto simp add: a_owner_document_valid_def object_ptr_kinds_eq3 document_ptr_kinds_eq3
+        node_ptr_kinds_eq3)[1]
   proof -
     fix node_ptr
-assume 0: "\<forall>node_ptr\<in>fset (node_ptr_kinds h'). (\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h' \<and> node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) \<or> (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<and> node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
-    and 1: "node_ptr |\<in>| node_ptr_kinds h'"
-    and 2: "\<forall>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<longrightarrow> node_ptr \<notin> set |h' \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
-    then show "\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h' 
+    assume 0: "\<forall>node_ptr\<in>fset (node_ptr_kinds h'). (\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h' \<and>
+node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) \<or>
+(\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<and> node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
+      and 1: "node_ptr |\<in>| node_ptr_kinds h'"
+      and 2: "\<forall>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<longrightarrow>
+node_ptr \<notin> set |h' \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
+    then show "\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h'
                        \<and> node_ptr \<in> set |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     proof (cases "node_ptr = child")
       case True
-      show ?thesis 
+      show ?thesis
         apply(rule exI[where x=owner_document])
         using children_eq2 disconnected_nodes_eq2 children_h children_h' disconnected_nodes_h' True
-        by (metis (no_types, lifting) get_disconnected_nodes_ptr_in_heap is_OK_returns_result_I 
-                                      list.set_intros(1) select_result_I2)
+        by (metis (no_types, lifting) get_disconnected_nodes_ptr_in_heap is_OK_returns_result_I
+            list.set_intros(1) select_result_I2)
     next
       case False
       then show ?thesis
-        using 0 1 2 children_eq2 children_h children_h' disconnected_nodes_eq2 disconnected_nodes_h 
-              disconnected_nodes_h' 
+        using 0 1 2 children_eq2 children_h children_h' disconnected_nodes_eq2 disconnected_nodes_h
+          disconnected_nodes_h'
         apply(auto simp add: children_eq2 disconnected_nodes_eq2 dest!: select_result_I2)[1]
         by (metis children_eq2 disconnected_nodes_eq2 finite_set_in in_set_remove1 list.set_intros(2))
     qed
   qed
 
-  moreover 
+  moreover
   {
     have h0: "a_distinct_lists h"
       using assms(1)  by (simp add: heap_is_wellformed_def)
-    moreover have ha1: "(\<Union>x\<in>set |h \<turnstile> object_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_child_nodes x|\<^sub>r) 
+    moreover have ha1: "(\<Union>x\<in>set |h \<turnstile> object_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_child_nodes x|\<^sub>r)
                  \<inter> (\<Union>x\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       using \<open>a_distinct_lists h\<close>
       unfolding a_distinct_lists_def
       by(auto)
     have ha2: "ptr |\<in>| object_ptr_kinds h"
       using children_h get_child_nodes_ptr_in_heap by blast
     have ha3: "child \<in> set |h \<turnstile> get_child_nodes ptr|\<^sub>r"
       using child_in_children_h children_h
       by(simp)
-    have child_not_in: "\<And>document_ptr. document_ptr |\<in>| document_ptr_kinds h 
+    have child_not_in: "\<And>document_ptr. document_ptr |\<in>| document_ptr_kinds h
                           \<Longrightarrow> child \<notin> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
-      using ha1 ha2 ha3 
+      using ha1 ha2 ha3
       apply(simp)
       using IntI by fastforce
     moreover have "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
       apply(rule select_result_I)
       by(auto simp add: object_ptr_kinds_M_defs)
     moreover have "distinct |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
       apply(rule select_result_I)
       by(auto simp add: document_ptr_kinds_M_defs)
     ultimately have "a_distinct_lists h'"
     proof(simp (no_asm) add: a_distinct_lists_def, safe)
       assume 1: "a_distinct_lists h"
         and 3: "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
 
       assume 1: "a_distinct_lists h"
         and 3: "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
       have 4: "distinct (concat ((map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r)))"
         using 1 by(auto simp add: a_distinct_lists_def)
-      show "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r) 
+      show "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
                      (sorted_list_of_set (fset (object_ptr_kinds h')))))"
       proof(rule distinct_concat_map_I[OF 3[unfolded object_ptr_kinds_eq2], simplified])
         fix x
         assume 5: "x |\<in>| object_ptr_kinds h'"
         then have 6: "distinct |h \<turnstile> get_child_nodes x|\<^sub>r"
           using 4 distinct_concat_map_E object_ptr_kinds_eq2 by fastforce
-        obtain children where children: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children" 
-                        and distinct_children: "distinct children"
-          by (metis "5" "6" type_wf assms(3) get_child_nodes_ok local.known_ptrs_known_ptr 
-                            object_ptr_kinds_eq3 select_result_I)
+        obtain children where children: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children"
+          and distinct_children: "distinct children"
+          by (metis "5" "6" type_wf assms(3) get_child_nodes_ok local.known_ptrs_known_ptr
+              object_ptr_kinds_eq3 select_result_I)
         obtain children' where children': "h' \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children'"
           using children children_eq children_h' by fastforce
         then have "distinct children'"
         proof (cases "ptr = x")
           case True
-          then show ?thesis 
+          then show ?thesis
             using children distinct_children children_h children_h'
             by (metis children' distinct_remove1 returns_result_eq)
         next
           case False
-          then show ?thesis 
+          then show ?thesis
             using children distinct_children children_eq[OF False]
             using children' distinct_lists_children h0
             using select_result_I2 by fastforce
         qed
 
         then show "distinct |h' \<turnstile> get_child_nodes x|\<^sub>r"
           using children' by(auto simp add: )
       next
         fix x y
         assume 5: "x |\<in>| object_ptr_kinds h'" and 6: "y |\<in>| object_ptr_kinds h'" and 7: "x \<noteq> y"
         obtain children_x where children_x: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children_x"
-          by (metis "5" type_wf assms(3) get_child_nodes_ok is_OK_returns_result_E 
-                    local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+          by (metis "5" type_wf assms(3) get_child_nodes_ok is_OK_returns_result_E
+              local.known_ptrs_known_ptr object_ptr_kinds_eq3)
         obtain children_y where children_y: "h \<turnstile> get_child_nodes y \<rightarrow>\<^sub>r children_y"
-          by (metis "6" type_wf assms(3) get_child_nodes_ok is_OK_returns_result_E 
-                    local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+          by (metis "6" type_wf assms(3) get_child_nodes_ok is_OK_returns_result_E
+              local.known_ptrs_known_ptr object_ptr_kinds_eq3)
         obtain children_x' where children_x': "h' \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children_x'"
           using children_eq children_h' children_x by fastforce
         obtain children_y' where children_y': "h' \<turnstile> get_child_nodes y \<rightarrow>\<^sub>r children_y'"
           using children_eq children_h' children_y by fastforce
         have "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r))"
           using h0 by(auto simp add: a_distinct_lists_def)
         then have 8: "set children_x \<inter> set children_y = {}"
           using "7" assms(1) children_x children_y local.heap_is_wellformed_one_parent by blast
         have "set children_x' \<inter> set children_y' = {}"
         proof (cases "ptr = x")
           case True
           then have "ptr \<noteq> y"
             by(simp add: 7)
           have "children_x' = remove1 child children_x"
             using children_h children_h' children_x children_x' True returns_result_eq by fastforce
           moreover have "children_y' = children_y"
             using children_y children_y' children_eq[OF \<open>ptr \<noteq> y\<close>] by auto
           ultimately show ?thesis
             using 8 set_remove1_subset by fastforce
         next
           case False
           then show ?thesis
           proof (cases "ptr = y")
             case True
             have "children_y' = remove1 child children_y"
               using children_h children_h' children_y children_y' True returns_result_eq by fastforce
             moreover have "children_x' = children_x"
               using children_x children_x' children_eq[OF \<open>ptr \<noteq> x\<close>] by auto
             ultimately show ?thesis
               using 8 set_remove1_subset by fastforce
           next
             case False
             have "children_x' = children_x"
               using children_x children_x' children_eq[OF \<open>ptr \<noteq> x\<close>] by auto
             moreover have "children_y' = children_y"
               using children_y children_y' children_eq[OF \<open>ptr \<noteq> y\<close>] by auto
             ultimately show ?thesis
               using 8 by simp
           qed
         qed
         then show "set |h' \<turnstile> get_child_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_child_nodes y|\<^sub>r = {}"
           using children_x' children_y'
           by (metis (no_types, lifting) select_result_I2)
       qed
     next
       assume 2: "distinct |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
       then have 4: "distinct  (sorted_list_of_set (fset (document_ptr_kinds h')))"
         by simp
-      have 3: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+      have 3: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                         (sorted_list_of_set (fset (document_ptr_kinds h')))))"
         using h0
         by(simp add: a_distinct_lists_def document_ptr_kinds_eq3)
 
-      show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+      show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                          (sorted_list_of_set (fset (document_ptr_kinds h')))))"
       proof(rule distinct_concat_map_I[OF 4[unfolded document_ptr_kinds_eq3]])
         fix x
         assume 4: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
         have 5: "distinct |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
           using distinct_lists_disconnected_nodes[OF h0] 4 get_disconnected_nodes_ok
           by (simp add: type_wf document_ptr_kinds_eq3 select_result_I)
         show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
         proof (cases "x = owner_document")
           case True
           have "child \<notin> set |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
             using child_not_in  document_ptr_kinds_eq2 "4" by fastforce
           moreover have "|h' \<turnstile> get_disconnected_nodes x|\<^sub>r = child # |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
             using disconnected_nodes_h' disconnected_nodes_h unfolding True
             by(simp)
           ultimately show ?thesis
             using 5 unfolding True
-            by simp 
+            by simp
         next
           case False
           show ?thesis
             using "5" False disconnected_nodes_eq2 by auto
         qed
       next
         fix x y
         assume 4: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
           and 5: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))" and "x \<noteq> y"
         obtain disc_nodes_x where disc_nodes_x: "h \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r disc_nodes_x"
           using 4 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of x] document_ptr_kinds_eq2
           by auto
         obtain disc_nodes_y where disc_nodes_y: "h \<turnstile> get_disconnected_nodes y \<rightarrow>\<^sub>r disc_nodes_y"
           using 5 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of y] document_ptr_kinds_eq2
           by auto
         obtain disc_nodes_x' where disc_nodes_x': "h' \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r disc_nodes_x'"
           using 4 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of x] document_ptr_kinds_eq2
           by auto
         obtain disc_nodes_y' where disc_nodes_y': "h' \<turnstile> get_disconnected_nodes y \<rightarrow>\<^sub>r disc_nodes_y'"
           using 5 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of y] document_ptr_kinds_eq2
           by auto
-        have "distinct 
+        have "distinct
                (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) |h \<turnstile> document_ptr_kinds_M|\<^sub>r))"
           using h0 by (simp add: a_distinct_lists_def)
         then have 6: "set disc_nodes_x \<inter> set disc_nodes_y = {}"
-          using \<open>x \<noteq> y\<close> assms(1) disc_nodes_x disc_nodes_y local.heap_is_wellformed_one_disc_parent 
+          using \<open>x \<noteq> y\<close> assms(1) disc_nodes_x disc_nodes_y local.heap_is_wellformed_one_disc_parent
           by blast
 
         have "set disc_nodes_x' \<inter> set disc_nodes_y' = {}"
         proof (cases "x = owner_document")
           case True
           then have "y \<noteq> owner_document"
             using \<open>x \<noteq> y\<close> by simp
           then have "disc_nodes_y' = disc_nodes_y"
-            using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y' 
+            using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y'
             by auto
           have "disc_nodes_x' = child # disc_nodes_x"
-            using disconnected_nodes_h' disc_nodes_x disc_nodes_x' True disconnected_nodes_h returns_result_eq 
+            using disconnected_nodes_h' disc_nodes_x disc_nodes_x' True disconnected_nodes_h
+              returns_result_eq
             by fastforce
           have "child \<notin> set disc_nodes_y"
             using child_not_in  disc_nodes_y 5
             using document_ptr_kinds_eq2  by fastforce
           then show ?thesis
             apply(unfold \<open>disc_nodes_x' = child # disc_nodes_x\<close> \<open>disc_nodes_y' = disc_nodes_y\<close>)
             using 6 by auto
         next
           case False
           then show ?thesis
           proof (cases "y = owner_document")
             case True
             then have "disc_nodes_x' = disc_nodes_x"
-              using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x' by auto
+              using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x'
+              by auto
             have "disc_nodes_y' = child # disc_nodes_y"
-              using disconnected_nodes_h' disc_nodes_y disc_nodes_y' True disconnected_nodes_h returns_result_eq 
+              using disconnected_nodes_h' disc_nodes_y disc_nodes_y' True disconnected_nodes_h
+                returns_result_eq
               by fastforce
             have "child \<notin> set disc_nodes_x"
               using child_not_in  disc_nodes_x 4
               using document_ptr_kinds_eq2  by fastforce
             then show ?thesis
               apply(unfold \<open>disc_nodes_y' = child # disc_nodes_y\<close> \<open>disc_nodes_x' = disc_nodes_x\<close>)
               using 6 by auto
           next
             case False
             have "disc_nodes_x' = disc_nodes_x"
-              using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x' by auto
+              using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x'
+              by auto
             have "disc_nodes_y' = disc_nodes_y"
-              using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y' by auto
-            then show ?thesis 
+              using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y'
+              by auto
+            then show ?thesis
               apply(unfold \<open>disc_nodes_y' = disc_nodes_y\<close> \<open>disc_nodes_x' = disc_nodes_x\<close>)
               using 6 by auto
           qed
         qed
         then show "set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
           using disc_nodes_x' disc_nodes_y' by auto
       qed
     next
-fix x xa xb
-assume 1: "xa \<in> fset (object_ptr_kinds h')"
-    and 2: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
-    and 3: "xb \<in> fset (document_ptr_kinds h')"
-    and 4: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+      fix x xa xb
+      assume 1: "xa \<in> fset (object_ptr_kinds h')"
+        and 2: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+        and 3: "xb \<in> fset (document_ptr_kinds h')"
+        and 4: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
       obtain disc_nodes where disc_nodes: "h \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r disc_nodes"
         using 3 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of xb] document_ptr_kinds_eq2 by auto
       obtain disc_nodes' where disc_nodes': "h' \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r disc_nodes'"
         using 3 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of xb]  document_ptr_kinds_eq2 by auto
 
       obtain children where children: "h \<turnstile> get_child_nodes xa \<rightarrow>\<^sub>r children"
-        by (metis "1" type_wf assms(3) finite_set_in get_child_nodes_ok is_OK_returns_result_E 
-                  local.known_ptrs_known_ptr object_ptr_kinds_eq3)
+        by (metis "1" type_wf assms(3) finite_set_in get_child_nodes_ok is_OK_returns_result_E
+            local.known_ptrs_known_ptr object_ptr_kinds_eq3)
       obtain children' where children': "h' \<turnstile> get_child_nodes xa \<rightarrow>\<^sub>r children'"
         using children children_eq children_h' by fastforce
       have "\<And>x. x \<in> set |h \<turnstile> get_child_nodes xa|\<^sub>r \<Longrightarrow> x \<in> set |h \<turnstile> get_disconnected_nodes xb|\<^sub>r \<Longrightarrow> False"
-        using 1 3 
-        apply(fold \<open> object_ptr_kinds h =  object_ptr_kinds h'\<close>) 
-        apply(fold \<open> document_ptr_kinds h =  document_ptr_kinds h'\<close>) 
+        using 1 3
+        apply(fold \<open> object_ptr_kinds h =  object_ptr_kinds h'\<close>)
+        apply(fold \<open> document_ptr_kinds h =  document_ptr_kinds h'\<close>)
         using children disc_nodes h0 apply(auto simp add: a_distinct_lists_def)[1]
-      by (metis (no_types, lifting) h0 local.distinct_lists_no_parent select_result_I2)
+        by (metis (no_types, lifting) h0 local.distinct_lists_no_parent select_result_I2)
       then have 5: "\<And>x. x \<in> set children \<Longrightarrow> x \<in> set disc_nodes \<Longrightarrow> False"
         using children disc_nodes  by fastforce
       have 6: "|h' \<turnstile> get_child_nodes xa|\<^sub>r = children'"
         using children' by (simp add: )
       have 7: "|h' \<turnstile> get_disconnected_nodes xb|\<^sub>r = disc_nodes'"
         using disc_nodes' by (simp add: )
       have "False"
       proof (cases "xa = ptr")
         case True
         have "distinct children_h"
           using children_h distinct_lists_children h0 \<open>known_ptr ptr\<close> by blast
         have "|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h"
           using children_h'
           by(simp add: )
         have "children = children_h"
           using True children children_h by auto
         show ?thesis
           using disc_nodes' children' 5 2 4 children_h \<open>distinct children_h\<close> disconnected_nodes_h'
-          apply(auto simp add: 6 7 
-                \<open>xa = ptr\<close> \<open>|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h\<close> \<open>children = children_h\<close>)[1]
-          by (metis (no_types, lifting) disc_nodes disconnected_nodes_eq2 disconnected_nodes_h 
-                                        select_result_I2 set_ConsD)
+          apply(auto simp add: 6 7
+              \<open>xa = ptr\<close> \<open>|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h\<close> \<open>children = children_h\<close>)[1]
+          by (metis (no_types, lifting) disc_nodes disconnected_nodes_eq2 disconnected_nodes_h
+              select_result_I2 set_ConsD)
       next
         case False
         have "children' = children"
           using children' children children_eq[OF False[symmetric]]
-          by auto                      
+          by auto
         then show ?thesis
         proof (cases "xb = owner_document")
           case True
           then show ?thesis
             using disc_nodes disconnected_nodes_h disconnected_nodes_h'
-            using "2" "4" "5" "6" "7" False \<open>children' = children\<close> assms(1) child_in_children_h 
-                   child_parent_dual children children_h disc_nodes' get_child_nodes_ptr_in_heap 
-                   list.set_cases list.simps(3) option.simps(1) returns_result_eq set_ConsD 
+            using "2" "4" "5" "6" "7" False \<open>children' = children\<close> assms(1) child_in_children_h
+              child_parent_dual children children_h disc_nodes' get_child_nodes_ptr_in_heap
+              list.set_cases list.simps(3) option.simps(1) returns_result_eq set_ConsD
             by (metis (no_types, hide_lams) assms(3) type_wf)
         next
           case False
           then show ?thesis
-            using "2" "4" "5" "6" "7" \<open>children' = children\<close> disc_nodes disc_nodes' 
-                  disconnected_nodes_eq returns_result_eq 
+            using "2" "4" "5" "6" "7" \<open>children' = children\<close> disc_nodes disc_nodes'
+              disconnected_nodes_eq returns_result_eq
             by metis
         qed
       qed
       then show "x \<in> {}"
         by simp
     qed
   }
 
   ultimately show "heap_is_wellformed h'"
     using heap_is_wellformed_def by blast
 qed
 
 lemma remove_heap_is_wellformed_preserved:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> remove child \<rightarrow>\<^sub>h h'"
     and "known_ptrs h"
     and type_wf: "type_wf h"
   shows "type_wf h'" and "known_ptrs h'" and "heap_is_wellformed h'"
   using assms
-  by(auto simp add: remove_def intro: remove_child_heap_is_wellformed_preserved elim!: bind_returns_heap_E2 split: option.splits)
+  by(auto simp add: remove_def intro: remove_child_heap_is_wellformed_preserved
+      elim!: bind_returns_heap_E2 split: option.splits)
 
 lemma remove_child_removes_child:
   assumes wellformed: "heap_is_wellformed h"
     and remove_child: "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h'"
     and children: "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
-and known_ptrs: "known_ptrs h"
-and type_wf: "type_wf h"
-shows "child \<notin> set children"
+    and known_ptrs: "known_ptrs h"
+    and type_wf: "type_wf h"
+  shows "child \<notin> set children"
 proof -
   obtain owner_document children_h h2 disconnected_nodes_h where
     owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document" and
-    children_h: "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children_h" and 
+    children_h: "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children_h" and
     child_in_children_h: "child \<in> set children_h" and
     disconnected_nodes_h: "h \<turnstile>  get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h" and
     h2: "h \<turnstile>  set_disconnected_nodes owner_document (child # disconnected_nodes_h) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> set_child_nodes ptr' (remove1 child children_h) \<rightarrow>\<^sub>h h'"
     using assms(2)
-    apply(auto simp add: remove_child_def elim!: bind_returns_heap_E 
-               dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-                      pure_returns_heap_eq[rotated, OF get_child_nodes_pure] 
-               split: if_splits)[1]
+    apply(auto simp add: remove_child_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_child_nodes_pure]
+        split: if_splits)[1]
     using pure_returns_heap_eq
     by fastforce
   have "object_ptr_kinds h = object_ptr_kinds h'"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF remove_child_writes remove_child]) 
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes remove_child])
     unfolding remove_child_locs_def
     using set_child_nodes_pointers_preserved set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   moreover have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF remove_child_writes assms(2)]
     using set_child_nodes_types_preserved set_disconnected_nodes_types_preserved type_wf
     unfolding remove_child_locs_def
     apply(auto simp add: reflp_def transp_def)[1]
     by blast
   ultimately show ?thesis
     using remove_child_removes_parent remove_child_heap_is_wellformed_preserved child_parent_dual
-    by (meson children known_ptrs local.known_ptrs_preserved option.distinct(1) remove_child 
-              returns_result_eq type_wf wellformed)
+    by (meson children known_ptrs local.known_ptrs_preserved option.distinct(1) remove_child
+        returns_result_eq type_wf wellformed)
 qed
 
 lemma remove_child_removes_first_child:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children"
   assumes "h \<turnstile> remove_child ptr node_ptr \<rightarrow>\<^sub>h h'"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
 proof -
   obtain h2 disc_nodes owner_document where
     "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r owner_document" and
     "h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes" and
     h2: "h \<turnstile> set_disconnected_nodes owner_document (node_ptr # disc_nodes) \<rightarrow>\<^sub>h h2" and
     "h2 \<turnstile> set_child_nodes ptr children \<rightarrow>\<^sub>h h'"
     using assms(5)
-    apply(auto simp add: remove_child_def 
-               dest!: bind_returns_heap_E3[rotated, OF assms(4) get_child_nodes_pure, rotated])[1]
+    apply(auto simp add: remove_child_def
+        dest!: bind_returns_heap_E3[rotated, OF assms(4) get_child_nodes_pure, rotated])[1]
     by(auto elim!: bind_returns_heap_E
-                   bind_returns_heap_E2[rotated,OF get_owner_document_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])
+        bind_returns_heap_E2[rotated,OF get_owner_document_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])
   have "known_ptr ptr"
     by (meson assms(3) assms(4) is_OK_returns_result_I get_child_nodes_ptr_in_heap known_ptrs_known_ptr)
   moreover have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children"
     apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes h2 assms(4)])
-    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers 
+    using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers
     by fast
   moreover have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h2]
     using \<open>type_wf h\<close> set_disconnected_nodes_types_preserved
     by(auto simp add:  reflp_def transp_def)
   ultimately show ?thesis
     using set_child_nodes_get_child_nodes\<open>h2 \<turnstile> set_child_nodes ptr children \<rightarrow>\<^sub>h h'\<close>
     by fast
 qed
 
 lemma remove_removes_child:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children"
   assumes "h \<turnstile> remove node_ptr \<rightarrow>\<^sub>h h'"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
 proof -
   have "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some ptr"
     using child_parent_dual assms by fastforce
   show ?thesis
     using assms remove_child_removes_first_child
-    by(auto simp add: remove_def 
-            dest!: bind_returns_heap_E3[rotated, OF \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some ptr\<close>, rotated] 
-                   bind_returns_heap_E3[rotated, OF assms(4) get_child_nodes_pure, rotated])
+    by(auto simp add: remove_def
+        dest!: bind_returns_heap_E3[rotated, OF \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some ptr\<close>, rotated]
+        bind_returns_heap_E3[rotated, OF assms(4) get_child_nodes_pure, rotated])
 qed
 
 lemma remove_for_all_empty_children:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "h \<turnstile> forall_M remove children \<rightarrow>\<^sub>h h'"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r []"
   using assms
 proof(induct children arbitrary: h h')
   case Nil
-  then show ?case 
+  then show ?case
     by simp
 next
   case (Cons a children)
   have "h \<turnstile> get_parent a \<rightarrow>\<^sub>r Some ptr"
     using child_parent_dual Cons by fastforce
   with Cons show ?case
   proof(auto elim!: bind_returns_heap_E)[1]
     fix h2
-    assume 0: "(\<And>h h'. heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                   \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
+    assume 0: "(\<And>h h'. heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                   \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
                        \<Longrightarrow> h \<turnstile> forall_M remove children \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r [])"
       and 1: "heap_is_wellformed h"
       and 2: "type_wf h"
       and 3: "known_ptrs h"
       and 4: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r a # children"
       and 5: "h \<turnstile> get_parent a \<rightarrow>\<^sub>r Some ptr"
       and 7: "h \<turnstile> remove a \<rightarrow>\<^sub>h h2"
       and 8: "h2 \<turnstile> forall_M remove children \<rightarrow>\<^sub>h h'"
     then have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using remove_removes_child by blast
 
     moreover have "heap_is_wellformed h2"
       using 7 1 2 3 remove_child_heap_is_wellformed_preserved(3)
       by(auto simp add: remove_def
-               elim!: bind_returns_heap_E 
-                      bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] 
-               split: option.splits)
+          elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+          split: option.splits)
     moreover have "type_wf h2"
       using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF remove_writes 7]
       using \<open>type_wf h\<close> remove_child_types_preserved
       by(auto simp add: a_remove_child_locs_def reflp_def transp_def)
     moreover have "object_ptr_kinds h = object_ptr_kinds h2"
       using 7
-      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                  OF remove_writes])
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+            OF remove_writes])
       using remove_child_pointers_preserved
       by (auto simp add: reflp_def transp_def)
     then have "known_ptrs h2"
       using 3  known_ptrs_preserved by blast
 
     ultimately show "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r []"
       using 0 8 by fast
   qed
 qed
 end
 
-locale l_remove_child_wf2 = l_type_wf + l_known_ptrs + l_remove_child_defs + l_heap_is_wellformed_defs 
-                            + l_get_child_nodes_defs + l_remove_defs +
-  assumes remove_child_preserves_type_wf: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h' 
+locale l_remove_child_wf2 = l_type_wf + l_known_ptrs + l_remove_child_defs + l_heap_is_wellformed_defs
+  + l_get_child_nodes_defs + l_remove_defs +
+  assumes remove_child_preserves_type_wf:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> type_wf h'"
-  assumes remove_child_preserves_known_ptrs: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h' 
+  assumes remove_child_preserves_known_ptrs:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> known_ptrs h'"
   assumes remove_child_heap_is_wellformed_preserved:
     "type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> heap_is_wellformed h \<Longrightarrow> h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'
                \<Longrightarrow> heap_is_wellformed h'"
-  assumes remove_preserves_type_wf: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove child \<rightarrow>\<^sub>h h' 
+  assumes remove_preserves_type_wf:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove child \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> type_wf h'"
-  assumes remove_preserves_known_ptrs: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove child \<rightarrow>\<^sub>h h' 
+  assumes remove_preserves_known_ptrs:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> remove child \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> known_ptrs h'"
   assumes remove_heap_is_wellformed_preserved:
     "type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> heap_is_wellformed h \<Longrightarrow> h \<turnstile> remove child \<rightarrow>\<^sub>h h'
                \<Longrightarrow> heap_is_wellformed h'"
   assumes remove_child_removes_child:
     "heap_is_wellformed h \<Longrightarrow> h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
                           \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h
                           \<Longrightarrow> child \<notin> set children"
-  assumes remove_child_removes_first_child: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                          \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children 
-                          \<Longrightarrow> h \<turnstile> remove_child ptr node_ptr \<rightarrow>\<^sub>h h' 
+  assumes remove_child_removes_first_child:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                          \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children
+                          \<Longrightarrow> h \<turnstile> remove_child ptr node_ptr \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
-  assumes remove_removes_child: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                          \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children 
+  assumes remove_removes_child:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                          \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children
                           \<Longrightarrow> h \<turnstile> remove node_ptr \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
-  assumes remove_for_all_empty_children: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children 
+  assumes remove_for_all_empty_children:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
                           \<Longrightarrow> h \<turnstile> forall_M remove children \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r []"
 
-interpretation i_remove_child_wf2?: l_remove_child_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_child_nodes get_child_nodes_locs 
-     set_child_nodes set_child_nodes_locs get_parent get_parent_locs get_owner_document 
-     get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes 
-     set_disconnected_nodes_locs remove_child remove_child_locs remove type_wf known_ptr known_ptrs 
-     heap_is_wellformed parent_child_rel
+interpretation i_remove_child_wf2?: l_remove_child_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_child_nodes get_child_nodes_locs
+  set_child_nodes set_child_nodes_locs get_parent get_parent_locs get_owner_document
+  get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs remove_child remove_child_locs remove type_wf known_ptr known_ptrs
+  heap_is_wellformed parent_child_rel
   by unfold_locales
 
-lemma remove_child_wf2_is_l_remove_child_wf2 [instances]: 
+lemma remove_child_wf2_is_l_remove_child_wf2 [instances]:
   "l_remove_child_wf2 type_wf known_ptr known_ptrs remove_child heap_is_wellformed get_child_nodes remove"
   apply(auto simp add: l_remove_child_wf2_def l_remove_child_wf2_axioms_def instances)[1]
   using remove_child_heap_is_wellformed_preserved apply(fast, fast, fast)
   using remove_heap_is_wellformed_preserved apply(fast, fast, fast)
   using remove_child_removes_child apply fast
   using remove_child_removes_first_child apply fast
   using remove_removes_child apply fast
   using remove_for_all_empty_children apply fast
   done
-  
+
 
 
 subsection \<open>adopt\_node\<close>
-                     
+
 locale l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_parent_wf +
   l_get_owner_document_wf +
   l_remove_child_wf2 +
   l_heap_is_wellformed
 begin
 lemma adopt_node_removes_first_child:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r node # children"
   shows "h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
 proof -
   obtain old_document parent_opt h2 where
     old_document: "h \<turnstile> get_owner_document (cast node) \<rightarrow>\<^sub>r old_document" and
     parent_opt: "h \<turnstile> get_parent node \<rightarrow>\<^sub>r parent_opt" and
-    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> do { remove_child parent node } 
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> do { remove_child parent node }
                                | None \<Rightarrow> do { return ()}) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> (if owner_document \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 node old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes owner_document;
         set_disconnected_nodes owner_document (node # disc_nodes)
       } else do { return () }) \<rightarrow>\<^sub>h h'"
     using assms(4)
-    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E 
-            dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-                   pure_returns_heap_eq[rotated, OF get_parent_pure])
+    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_parent_pure])
   have "h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using h2 remove_child_removes_first_child assms(1) assms(2) assms(3) assms(5)
     by (metis list.set_intros(1) local.child_parent_dual option.simps(5) parent_opt returns_result_eq)
   then
   show ?thesis
     using h'
-    by(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] 
-            dest!: reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes] 
-            split: if_splits)
+    by(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        dest!: reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes]
+        split: if_splits)
 qed
 
 
-lemma adopt_node_document_in_heap: 
+lemma adopt_node_document_in_heap:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> ok (adopt_node owner_document node)"
   shows "owner_document |\<in>| document_ptr_kinds h"
 proof -
   obtain old_document parent_opt h2 h' where
     old_document: "h \<turnstile> get_owner_document (cast node) \<rightarrow>\<^sub>r old_document" and
     parent_opt: "h \<turnstile> get_parent node \<rightarrow>\<^sub>r parent_opt" and
-    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> do { remove_child parent node } | None \<Rightarrow> do { return ()}) \<rightarrow>\<^sub>h h2" 
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> do { remove_child parent node } | None \<Rightarrow> do { return ()}) \<rightarrow>\<^sub>h h2"
     and
     h': "h2 \<turnstile> (if owner_document \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 node old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes owner_document;
         set_disconnected_nodes owner_document (node # disc_nodes)
       } else do { return () }) \<rightarrow>\<^sub>h h'"
     using assms(4)
-    by(auto simp add: adopt_node_def 
-            elim!: bind_returns_heap_E 
-            dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-            pure_returns_heap_eq[rotated, OF get_parent_pure])
+    by(auto simp add: adopt_node_def
+        elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_parent_pure])
   show ?thesis
   proof (cases "owner_document = old_document")
     case True
     then show ?thesis
       using old_document get_owner_document_owner_document_in_heap assms(1) assms(2) assms(3)
       by auto
   next
     case False
 
     then obtain h3 old_disc_nodes disc_nodes where
       old_disc_nodes: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r old_disc_nodes" and
       h3: "h2 \<turnstile> set_disconnected_nodes old_document (remove1 node old_disc_nodes) \<rightarrow>\<^sub>h h3" and
       old_disc_nodes: "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes" and
       h': "h3 \<turnstile> set_disconnected_nodes owner_document (node # disc_nodes) \<rightarrow>\<^sub>h h'"
       using h'
-      by(auto elim!: bind_returns_heap_E 
-          bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] ) 
+      by(auto elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
     then have "owner_document |\<in>| document_ptr_kinds h3"
       by (meson is_OK_returns_result_I local.get_disconnected_nodes_ptr_in_heap)
 
     moreover have "object_ptr_kinds h = object_ptr_kinds h2"
       using h2 apply(simp split: option.splits)
-      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
             OF remove_child_writes])
       using remove_child_pointers_preserved
       by (auto simp add: reflp_def transp_def)
     moreover have "object_ptr_kinds h2 = object_ptr_kinds h3"
-      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
             OF set_disconnected_nodes_writes h3])
-      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
+      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       by (auto simp add: reflp_def transp_def)
 
     ultimately show ?thesis
       by(auto simp add: document_ptr_kinds_def)
   qed
 qed
 end
-                     
+
 locale l_adopt_node_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_parent_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_root_node +
   l_get_owner_document_wf +
   l_remove_child_wf2 +
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
-lemma adopt_node_removes_child:
+lemma adopt_node_removes_child_step:
   assumes wellformed: "heap_is_wellformed h"
     and adopt_node: "h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h2"
     and children: "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "node_ptr \<notin> set children"
 proof -
   obtain old_document parent_opt h' where
     old_document: "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r old_document" and
     parent_opt: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt" and
     h': "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent node_ptr | None \<Rightarrow> return () ) \<rightarrow>\<^sub>h h'"
-    using adopt_node get_parent_pure 
+    using adopt_node get_parent_pure
     by(auto simp add: adopt_node_def
-            elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] 
-            split: if_splits)
+        elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        split: if_splits)
 
   then have "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
-    using adopt_node                                                                                            
-    apply(auto simp add: adopt_node_def  
-                    dest!: bind_returns_heap_E3[rotated, OF old_document, rotated] 
-                           bind_returns_heap_E3[rotated, OF parent_opt, rotated] 
-                    elim!: bind_returns_heap_E4[rotated, OF h', rotated])[1]
-    apply(auto split: if_splits 
-               elim!: bind_returns_heap_E 
-                      bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])[1]
-     apply (simp add: set_disconnected_nodes_get_child_nodes children 
-                      reads_writes_preserved[OF get_child_nodes_reads set_disconnected_nodes_writes])
+    using adopt_node
+    apply(auto simp add: adopt_node_def
+        dest!: bind_returns_heap_E3[rotated, OF old_document, rotated]
+        bind_returns_heap_E3[rotated, OF parent_opt, rotated]
+        elim!: bind_returns_heap_E4[rotated, OF h', rotated])[1]
+    apply(auto split: if_splits
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])[1]
+     apply (simp add: set_disconnected_nodes_get_child_nodes children
+        reads_writes_preserved[OF get_child_nodes_reads set_disconnected_nodes_writes])
     using children by blast
   show ?thesis
   proof(insert parent_opt h', induct parent_opt)
     case None
     then show ?case
-      using child_parent_dual wellformed known_ptrs type_wf 
-            \<open>h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children\<close> returns_result_eq
+      using child_parent_dual wellformed known_ptrs type_wf
+        \<open>h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children\<close> returns_result_eq
       by fastforce
   next
     case (Some option)
     then show ?case
-      using remove_child_removes_child \<open>h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children\<close> known_ptrs type_wf 
-            wellformed
+      using remove_child_removes_child \<open>h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children\<close> known_ptrs type_wf
+        wellformed
       by auto
   qed
 qed
 
-lemma adopt_node_removes_child_thesis:
+lemma adopt_node_removes_child:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h'"
-shows "\<And>ptr' children'.
+  shows "\<And>ptr' children'.
   h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children' \<Longrightarrow> node_ptr \<notin> set children'"
-  using adopt_node_removes_child assms by blast
+  using adopt_node_removes_child_step assms by blast
 
 lemma adopt_node_preserves_wellformedness:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h'"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "heap_is_wellformed h'" and "known_ptrs h'" and "type_wf h'"
 proof -
   obtain old_document parent_opt h2 where
-    old_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r old_document" 
-  and
-    parent_opt: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r parent_opt" 
-  and
-    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2" 
-  and
+    old_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r old_document"
+    and
+    parent_opt: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r parent_opt"
+    and
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2"
+    and
     h': "h2 \<turnstile> (if document_ptr \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 child old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
         set_disconnected_nodes document_ptr (child # disc_nodes)
       } else do {
         return ()
       }) \<rightarrow>\<^sub>h h'"
     using assms(2)
-    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E 
-            dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-                   pure_returns_heap_eq[rotated, OF get_parent_pure])
+    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_parent_pure])
 
   have object_ptr_kinds_h_eq3: "object_ptr_kinds h = object_ptr_kinds h2"
     using h2 apply(simp split: option.splits)
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF remove_child_writes])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes])
     using remove_child_pointers_preserved
     by (auto simp add: reflp_def transp_def)
-  then have object_ptr_kinds_M_eq_h: 
-           "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+  then have object_ptr_kinds_M_eq_h:
+    "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     unfolding object_ptr_kinds_M_defs by simp
   then have object_ptr_kinds_eq_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
 
   have wellformed_h2: "heap_is_wellformed h2"
     using h2 remove_child_heap_is_wellformed_preserved known_ptrs type_wf
-    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure) 
+    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
   have "type_wf h2"
     using h2 remove_child_preserves_type_wf known_ptrs type_wf
-    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure) 
+    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
   have "known_ptrs h2"
     using h2 remove_child_preserves_known_ptrs known_ptrs type_wf
-    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure) 
+    by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
   have "heap_is_wellformed h' \<and> known_ptrs h' \<and> type_wf h'"
   proof(cases "document_ptr = old_document")
     case True
     then show ?thesis
       using h' wellformed_h2 \<open>type_wf h2\<close> \<open>known_ptrs h2\<close> by auto
   next
     case False
     then obtain h3 old_disc_nodes disc_nodes_document_ptr_h3 where
       docs_neq: "document_ptr \<noteq> old_document" and
       old_disc_nodes: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r old_disc_nodes" and
       h3: "h2 \<turnstile> set_disconnected_nodes old_document (remove1 child old_disc_nodes) \<rightarrow>\<^sub>h h3" and
-      disc_nodes_document_ptr_h3: 
-             "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3" and
+      disc_nodes_document_ptr_h3:
+      "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3" and
       h': "h3 \<turnstile> set_disconnected_nodes document_ptr (child # disc_nodes_document_ptr_h3) \<rightarrow>\<^sub>h h'"
       using h'
-      by(auto elim!: bind_returns_heap_E 
-                     bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+      by(auto elim!: bind_returns_heap_E
+          bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
 
     have object_ptr_kinds_h2_eq3: "object_ptr_kinds h2 = object_ptr_kinds h3"
-      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                  OF set_disconnected_nodes_writes h3])
-      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+            OF set_disconnected_nodes_writes h3])
+      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       by (auto simp add: reflp_def transp_def)
-    then have object_ptr_kinds_M_eq_h2: 
-              "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    then have object_ptr_kinds_M_eq_h2:
+      "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
       by(simp add: object_ptr_kinds_M_defs)
     then have object_ptr_kinds_eq_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
       by(simp)
     then have node_ptr_kinds_eq_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
       using node_ptr_kinds_M_eq by blast
     then have node_ptr_kinds_eq3_h2: "node_ptr_kinds h2 = node_ptr_kinds h3"
       by auto
     have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
       using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
     then have document_ptr_kinds_eq3_h2: "document_ptr_kinds h2 = document_ptr_kinds h3"
       using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
-    have children_eq_h2: 
+    have children_eq_h2:
       "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using get_child_nodes_reads set_disconnected_nodes_writes h3
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     then have children_eq2_h2: "\<And>ptr. |h2 \<turnstile> get_child_nodes ptr|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr|\<^sub>r"
       using select_result_eq by force
 
     have object_ptr_kinds_h3_eq3: "object_ptr_kinds h3 = object_ptr_kinds h'"
-      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                  OF set_disconnected_nodes_writes h'])
-      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+            OF set_disconnected_nodes_writes h'])
+      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       by (auto simp add: reflp_def transp_def)
-    then have object_ptr_kinds_M_eq_h3: 
+    then have object_ptr_kinds_M_eq_h3:
       "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
       by(simp add: object_ptr_kinds_M_defs)
     then have object_ptr_kinds_eq_h3: "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
       by(simp)
     then have node_ptr_kinds_eq_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
       using node_ptr_kinds_M_eq by blast
     then have node_ptr_kinds_eq3_h3: "node_ptr_kinds h3 = node_ptr_kinds h'"
       by auto
     have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
       using object_ptr_kinds_eq_h3 document_ptr_kinds_M_eq by auto
     then have document_ptr_kinds_eq3_h3: "document_ptr_kinds h3 = document_ptr_kinds h'"
       using object_ptr_kinds_eq_h3 document_ptr_kinds_M_eq by auto
-    have children_eq_h3: 
+    have children_eq_h3:
       "\<And>ptr children. h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using get_child_nodes_reads set_disconnected_nodes_writes h'
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     then have children_eq2_h3: "\<And>ptr. |h3 \<turnstile> get_child_nodes ptr|\<^sub>r = |h' \<turnstile> get_child_nodes ptr|\<^sub>r"
       using select_result_eq by force
 
-    have disconnected_nodes_eq_h2: 
-      "\<And>doc_ptr disc_nodes. old_document \<noteq> doc_ptr 
+    have disconnected_nodes_eq_h2:
+      "\<And>doc_ptr disc_nodes. old_document \<noteq> doc_ptr
       \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
       using get_disconnected_nodes_reads set_disconnected_nodes_writes h3
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-    then have disconnected_nodes_eq2_h2: 
-      "\<And>doc_ptr. old_document \<noteq> doc_ptr 
+    then have disconnected_nodes_eq2_h2:
+      "\<And>doc_ptr. old_document \<noteq> doc_ptr
        \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
       using select_result_eq by force
-    obtain disc_nodes_old_document_h2 where disc_nodes_old_document_h2: 
+    obtain disc_nodes_old_document_h2 where disc_nodes_old_document_h2:
       "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
       using old_disc_nodes by blast
     then have disc_nodes_old_document_h3:
       "h3 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r remove1 child disc_nodes_old_document_h2"
-      using h3 old_disc_nodes returns_result_eq set_disconnected_nodes_get_disconnected_nodes 
+      using h3 old_disc_nodes returns_result_eq set_disconnected_nodes_get_disconnected_nodes
       by fastforce
     have "distinct disc_nodes_old_document_h2"
-      using disc_nodes_old_document_h2 local.heap_is_wellformed_disconnected_nodes_distinct wellformed_h2 
+      using disc_nodes_old_document_h2 local.heap_is_wellformed_disconnected_nodes_distinct wellformed_h2
       by blast
 
 
     have "type_wf h2"
     proof (insert h2, induct  parent_opt)
       case None
       then show ?case
         using type_wf by simp
     next
       case (Some option)
       then show ?case
-        using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF remove_child_writes] 
-             type_wf remove_child_types_preserved
+        using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF remove_child_writes]
+          type_wf remove_child_types_preserved
         by (simp add: reflp_def transp_def)
     qed
     then have "type_wf h3"
-      using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-      using  set_disconnected_nodes_types_preserved  
+      using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'",
+          OF set_disconnected_nodes_writes h3]
+      using  set_disconnected_nodes_types_preserved
       by(auto simp add: reflp_def transp_def)
     then have "type_wf h'"
-      using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
-      using  set_disconnected_nodes_types_preserved  
+      using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'",
+          OF set_disconnected_nodes_writes h']
+      using  set_disconnected_nodes_types_preserved
       by(auto simp add: reflp_def transp_def)
 
     have "known_ptrs h3"
-      using known_ptrs local.known_ptrs_preserved object_ptr_kinds_h2_eq3 object_ptr_kinds_h_eq3 by blast
+      using known_ptrs local.known_ptrs_preserved object_ptr_kinds_h2_eq3 object_ptr_kinds_h_eq3
+      by blast
     then have "known_ptrs h'"
       using local.known_ptrs_preserved object_ptr_kinds_h3_eq3 by blast
 
-    have disconnected_nodes_eq_h3: 
-      "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr 
+    have disconnected_nodes_eq_h3:
+      "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
        \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
       using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-    then have disconnected_nodes_eq2_h3: 
-      "\<And>doc_ptr. document_ptr \<noteq> doc_ptr 
+    then have disconnected_nodes_eq2_h3:
+      "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
       \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
       using select_result_eq by force
-    have disc_nodes_document_ptr_h2: 
+    have disc_nodes_document_ptr_h2:
       "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3"
       using disconnected_nodes_eq_h2 docs_neq disc_nodes_document_ptr_h3 by auto
     have disc_nodes_document_ptr_h': "
       h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r child # disc_nodes_document_ptr_h3"
       using h' disc_nodes_document_ptr_h3
       using set_disconnected_nodes_get_disconnected_nodes by blast
 
     have document_ptr_in_heap: "document_ptr |\<in>| document_ptr_kinds h2"
       using disc_nodes_document_ptr_h3 document_ptr_kinds_eq2_h2 get_disconnected_nodes_ok assms(1)
       unfolding heap_is_wellformed_def
-      using disc_nodes_document_ptr_h2 get_disconnected_nodes_ptr_in_heap by blast 
+      using disc_nodes_document_ptr_h2 get_disconnected_nodes_ptr_in_heap by blast
     have old_document_in_heap: "old_document |\<in>| document_ptr_kinds h2"
       using disc_nodes_old_document_h3 document_ptr_kinds_eq2_h2 get_disconnected_nodes_ok assms(1)
       unfolding heap_is_wellformed_def
-      using get_disconnected_nodes_ptr_in_heap old_disc_nodes by blast 
+      using get_disconnected_nodes_ptr_in_heap old_disc_nodes by blast
 
     have "child \<in> set disc_nodes_old_document_h2"
     proof (insert parent_opt h2, induct parent_opt)
       case None
       then have "h = h2"
         by(auto)
       moreover have "a_owner_document_valid h"
         using assms(1) heap_is_wellformed_def by(simp add: heap_is_wellformed_def)
-      ultimately show ?case 
-        using old_document disc_nodes_old_document_h2 None(1) child_parent_dual[OF assms(1)] 
-              in_disconnected_nodes_no_parent assms(1) known_ptrs type_wf by blast
+      ultimately show ?case
+        using old_document disc_nodes_old_document_h2 None(1) child_parent_dual[OF assms(1)]
+          in_disconnected_nodes_no_parent assms(1) known_ptrs type_wf by blast
     next
       case (Some option)
       then show ?case
         apply(simp split: option.splits)
-        using assms(1) disc_nodes_old_document_h2 old_document remove_child_in_disconnected_nodes known_ptrs 
+        using assms(1) disc_nodes_old_document_h2 old_document remove_child_in_disconnected_nodes
+          known_ptrs
         by blast
     qed
     have "child \<notin> set (remove1 child disc_nodes_old_document_h2)"
-      using disc_nodes_old_document_h3 h3 known_ptrs wellformed_h2 \<open>distinct disc_nodes_old_document_h2\<close> 
+      using disc_nodes_old_document_h3 h3 known_ptrs wellformed_h2 \<open>distinct disc_nodes_old_document_h2\<close>
       by auto
     have "child \<notin> set disc_nodes_document_ptr_h3"
     proof -
       have "a_distinct_lists h2"
         using heap_is_wellformed_def wellformed_h2 by blast
-      then have 0: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+      then have 0: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                                           |h2 \<turnstile> document_ptr_kinds_M|\<^sub>r))"
         by(simp add: a_distinct_lists_def)
       show ?thesis
-        using distinct_concat_map_E(1)[OF 0] \<open>child \<in> set disc_nodes_old_document_h2\<close> 
-              disc_nodes_old_document_h2 disc_nodes_document_ptr_h2
-        by (meson \<open>type_wf h2\<close> docs_neq known_ptrs local.get_owner_document_disconnected_nodes 
-                  local.known_ptrs_preserved object_ptr_kinds_h_eq3 returns_result_eq wellformed_h2)
+        using distinct_concat_map_E(1)[OF 0] \<open>child \<in> set disc_nodes_old_document_h2\<close>
+          disc_nodes_old_document_h2 disc_nodes_document_ptr_h2
+        by (meson \<open>type_wf h2\<close> docs_neq known_ptrs local.get_owner_document_disconnected_nodes
+            local.known_ptrs_preserved object_ptr_kinds_h_eq3 returns_result_eq wellformed_h2)
     qed
 
     have child_in_heap: "child |\<in>| node_ptr_kinds h"
-      using get_owner_document_ptr_in_heap[OF is_OK_returns_result_I[OF old_document]] 
-            node_ptr_kinds_commutes by blast
+      using get_owner_document_ptr_in_heap[OF is_OK_returns_result_I[OF old_document]]
+        node_ptr_kinds_commutes by blast
     have "a_acyclic_heap h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     have "parent_child_rel h' \<subseteq> parent_child_rel h2"
     proof
       fix x
       assume "x \<in> parent_child_rel h'"
       then show "x \<in> parent_child_rel h2"
-        using object_ptr_kinds_h2_eq3  object_ptr_kinds_h3_eq3 children_eq2_h2 children_eq2_h3 
-              mem_Collect_eq object_ptr_kinds_M_eq_h3 select_result_eq split_cong
+        using object_ptr_kinds_h2_eq3  object_ptr_kinds_h3_eq3 children_eq2_h2 children_eq2_h3
+          mem_Collect_eq object_ptr_kinds_M_eq_h3 select_result_eq split_cong
         unfolding parent_child_rel_def
         by(simp)
     qed
     then have "a_acyclic_heap h'"
       using \<open>a_acyclic_heap h2\<close> acyclic_heap_def acyclic_subset by blast
 
     moreover have "a_all_ptrs_in_heap h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     then have "a_all_ptrs_in_heap h3"
       apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3_h2 children_eq_h2)[1]
        apply (simp add: children_eq2_h2 object_ptr_kinds_h2_eq3 subset_code(1))
-      by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> \<open>type_wf h2\<close> disc_nodes_old_document_h2 disc_nodes_old_document_h3 disconnected_nodes_eq2_h2 document_ptr_kinds_eq3_h2 in_set_remove1 local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2 returns_result_select_result select_result_I2 wellformed_h2)
-    then have "a_all_ptrs_in_heap h'"   
+      by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> \<open>type_wf h2\<close>
+          disc_nodes_old_document_h2 disc_nodes_old_document_h3 disconnected_nodes_eq2_h2
+          document_ptr_kinds_eq3_h2 in_set_remove1 local.get_disconnected_nodes_ok
+          local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2 returns_result_select_result
+          select_result_I2 wellformed_h2)
+    then have "a_all_ptrs_in_heap h'"
       apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3_h3 children_eq_h3)[1]
-      apply (simp add: children_eq2_h3 object_ptr_kinds_h3_eq3 subset_code(1))
-      by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq3_h3 finite_set_in local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2 node_ptr_kinds_eq3_h3 select_result_I2 set_ConsD subset_code(1) wellformed_h2)
+       apply (simp add: children_eq2_h3 object_ptr_kinds_h3_eq3 subset_code(1))
+      by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close>
+          disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2 disc_nodes_old_document_h2
+          disconnected_nodes_eq2_h3 document_ptr_kinds_eq3_h3 finite_set_in
+          local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2 node_ptr_kinds_eq3_h3
+          select_result_I2 set_ConsD subset_code(1) wellformed_h2)
 
     moreover have "a_owner_document_valid h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     then have "a_owner_document_valid h'"
-      apply(simp add: a_owner_document_valid_def node_ptr_kinds_eq_h2 node_ptr_kinds_eq3_h3 
-                      object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 document_ptr_kinds_eq2_h2 
-                      document_ptr_kinds_eq2_h3 children_eq2_h2 children_eq2_h3 )
-      by (smt  disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2 
-                           disc_nodes_old_document_h2 disc_nodes_old_document_h3 
-                           disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_in_heap 
-                           document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 in_set_remove1
-                           list.set_intros(1) list.set_intros(2) node_ptr_kinds_eq3_h2 
-                           node_ptr_kinds_eq3_h3 object_ptr_kinds_h2_eq3 object_ptr_kinds_h3_eq3 
-                           select_result_I2)
+      apply(simp add: a_owner_document_valid_def node_ptr_kinds_eq_h2 node_ptr_kinds_eq3_h3
+          object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 document_ptr_kinds_eq2_h2
+          document_ptr_kinds_eq2_h3 children_eq2_h2 children_eq2_h3 )
+      by (smt  disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2
+          disc_nodes_old_document_h2 disc_nodes_old_document_h3
+          disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_in_heap
+          document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 in_set_remove1
+          list.set_intros(1) list.set_intros(2) node_ptr_kinds_eq3_h2
+          node_ptr_kinds_eq3_h3 object_ptr_kinds_h2_eq3 object_ptr_kinds_h3_eq3
+          select_result_I2)
 
     have a_distinct_lists_h2: "a_distinct_lists h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     then have "a_distinct_lists h'"
-      apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h3 object_ptr_kinds_eq_h2 
-                          children_eq2_h2 children_eq2_h3)[1]
+      apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h3 object_ptr_kinds_eq_h2
+          children_eq2_h2 children_eq2_h3)[1]
     proof -
       assume 1: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
                           (sorted_list_of_set (fset (object_ptr_kinds h')))))"
-        and 2: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+        and 2: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                              (sorted_list_of_set (fset (document_ptr_kinds h2)))))"
-        and 3: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r) 
+        and 3: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h2). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
-      show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+      show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                               (sorted_list_of_set (fset (document_ptr_kinds h')))))"
       proof(rule distinct_concat_map_I)
         show "distinct (sorted_list_of_set (fset (document_ptr_kinds h')))"
           by(auto simp add: document_ptr_kinds_M_def )
       next
         fix x
         assume a1: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
         have 4: "distinct |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r"
-          using a_distinct_lists_h2 "2" a1 concat_map_all_distinct document_ptr_kinds_eq2_h2 
-                document_ptr_kinds_eq2_h3 
+          using a_distinct_lists_h2 "2" a1 concat_map_all_distinct document_ptr_kinds_eq2_h2
+            document_ptr_kinds_eq2_h3
           by fastforce
         then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
         proof (cases "old_document \<noteq> x")
           case True
-          then show ?thesis 
+          then show ?thesis
           proof (cases "document_ptr \<noteq> x")
             case True
-            then show ?thesis 
-              using disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>] 
-                    disconnected_nodes_eq2_h3[OF \<open>document_ptr \<noteq> x\<close>] 4
+            then show ?thesis
+              using disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>]
+                disconnected_nodes_eq2_h3[OF \<open>document_ptr \<noteq> x\<close>] 4
               by(auto)
           next
             case False
-            then show ?thesis 
+            then show ?thesis
               using  disc_nodes_document_ptr_h3 disc_nodes_document_ptr_h' 4
-                      \<open>child \<notin> set disc_nodes_document_ptr_h3\<close>
+                \<open>child \<notin> set disc_nodes_document_ptr_h3\<close>
               by(auto simp add: disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>] )
           qed
         next
           case False
           then show ?thesis
-            by (metis (no_types, hide_lams) \<open>distinct disc_nodes_old_document_h2\<close> 
-                      disc_nodes_old_document_h3 disconnected_nodes_eq2_h3 
-                      distinct_remove1 docs_neq select_result_I2)
+            by (metis (no_types, hide_lams) \<open>distinct disc_nodes_old_document_h2\<close>
+                disc_nodes_old_document_h3 disconnected_nodes_eq2_h3
+                distinct_remove1 docs_neq select_result_I2)
         qed
       next
         fix x y
         assume a0: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
           and a1: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
           and a2: "x \<noteq> y"
 
         moreover have 5: "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
-          using 2 calculation 
+          using 2 calculation
           by (auto simp add: document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 dest: distinct_concat_map_E(1))
         ultimately show "set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
         proof(cases "old_document = x")
           case True
           have "old_document \<noteq> y"
             using \<open>x \<noteq> y\<close> \<open>old_document = x\<close> by simp
           have "document_ptr \<noteq> x"
             using docs_neq \<open>old_document = x\<close> by auto
           show ?thesis
           proof(cases "document_ptr = y")
             case True
             then show ?thesis
-              using 5 True select_result_I2[OF disc_nodes_document_ptr_h'] 
+              using 5 True select_result_I2[OF disc_nodes_document_ptr_h']
                 select_result_I2[OF disc_nodes_document_ptr_h2]
                 select_result_I2[OF disc_nodes_old_document_h2]
                 select_result_I2[OF disc_nodes_old_document_h3] \<open>old_document = x\<close>
               by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close>
-                         \<open>document_ptr \<noteq> x\<close> disconnected_nodes_eq2_h3 disjoint_iff_not_equal 
-                         notin_set_remove1 set_ConsD) 
+                  \<open>document_ptr \<noteq> x\<close> disconnected_nodes_eq2_h3 disjoint_iff_not_equal
+                  notin_set_remove1 set_ConsD)
           next
             case False
-            then show ?thesis 
-              using 5 select_result_I2[OF disc_nodes_document_ptr_h'] 
+            then show ?thesis
+              using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                 select_result_I2[OF disc_nodes_document_ptr_h2]
-                select_result_I2[OF disc_nodes_old_document_h2] 
+                select_result_I2[OF disc_nodes_old_document_h2]
                 select_result_I2[OF disc_nodes_old_document_h3]
-                disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 \<open>old_document = x\<close> 
+                disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 \<open>old_document = x\<close>
                 docs_neq \<open>old_document \<noteq> y\<close>
               by (metis (no_types, lifting) disjoint_iff_not_equal notin_set_remove1)
           qed
         next
           case False
           then show ?thesis
           proof(cases "old_document = y")
             case True
             then show ?thesis
             proof(cases "document_ptr = x")
               case True
               show ?thesis
-                using 5 select_result_I2[OF disc_nodes_document_ptr_h'] 
-                        select_result_I2[OF disc_nodes_document_ptr_h2]
-                        select_result_I2[OF disc_nodes_old_document_h2] 
-                        select_result_I2[OF disc_nodes_old_document_h3]
-                        \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr = x\<close>
-              apply(simp)
-              by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close> 
-                        disconnected_nodes_eq2_h3 disjoint_iff_not_equal notin_set_remove1)
+                using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                  select_result_I2[OF disc_nodes_document_ptr_h2]
+                  select_result_I2[OF disc_nodes_old_document_h2]
+                  select_result_I2[OF disc_nodes_old_document_h3]
+                  \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr = x\<close>
+                apply(simp)
+                by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close>
+                    disconnected_nodes_eq2_h3 disjoint_iff_not_equal notin_set_remove1)
             next
               case False
               then show ?thesis
-                using 5 select_result_I2[OF disc_nodes_document_ptr_h'] 
-                      select_result_I2[OF disc_nodes_document_ptr_h2]
-                      select_result_I2[OF disc_nodes_old_document_h2] 
-                      select_result_I2[OF disc_nodes_old_document_h3] 
-                      \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr \<noteq> x\<close>
-                by (metis (no_types, lifting) disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 
-                          disjoint_iff_not_equal docs_neq notin_set_remove1)
+                using 5 select_result_I2[OF disc_nodes_document_ptr_h']
+                  select_result_I2[OF disc_nodes_document_ptr_h2]
+                  select_result_I2[OF disc_nodes_old_document_h2]
+                  select_result_I2[OF disc_nodes_old_document_h3]
+                  \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr \<noteq> x\<close>
+                by (metis (no_types, lifting) disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
+                    disjoint_iff_not_equal docs_neq notin_set_remove1)
             qed
           next
             case False
             have "set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}"
               by (metis DocumentMonad.ptr_kinds_M_ok DocumentMonad.ptr_kinds_M_ptr_kinds False
-                        \<open>type_wf h2\<close> a1 disc_nodes_old_document_h2 document_ptr_kinds_M_def 
-                        document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3 
-                        l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok
-                        local.heap_is_wellformed_one_disc_parent returns_result_select_result 
-                        wellformed_h2)
+                  \<open>type_wf h2\<close> a1 disc_nodes_old_document_h2 document_ptr_kinds_M_def
+                  document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
+                  l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok
+                  local.heap_is_wellformed_one_disc_parent returns_result_select_result
+                  wellformed_h2)
             then show ?thesis
             proof(cases "document_ptr = x")
               case True
               then have "document_ptr \<noteq> y"
                 using \<open>x \<noteq> y\<close> by auto
               have "set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}"
-                using \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close> 
+                using \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
                 by blast
-              then show ?thesis 
-                using 5 select_result_I2[OF disc_nodes_document_ptr_h'] 
+              then show ?thesis
+                using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                   select_result_I2[OF disc_nodes_document_ptr_h2]
-                  select_result_I2[OF disc_nodes_old_document_h2] 
-                  select_result_I2[OF disc_nodes_old_document_h3] 
+                  select_result_I2[OF disc_nodes_old_document_h2]
+                  select_result_I2[OF disc_nodes_old_document_h3]
                   \<open>old_document \<noteq> x\<close> \<open>old_document \<noteq> y\<close> \<open>document_ptr = x\<close> \<open>document_ptr \<noteq> y\<close>
-                  \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2 
+                  \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2
                   disconnected_nodes_eq2_h3
                   \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
                 by(auto)
             next
               case False
               then show ?thesis
               proof(cases "document_ptr = y")
                 case True
                 have f1: "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set disc_nodes_document_ptr_h3 = {}"
-                  using 2 a1 document_ptr_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3 
-                        \<open>document_ptr \<noteq> x\<close> select_result_I2[OF disc_nodes_document_ptr_h3, symmetric] 
-                        disconnected_nodes_eq2_h2[OF docs_neq[symmetric], symmetric]
+                  using 2 a1 document_ptr_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
+                    \<open>document_ptr \<noteq> x\<close> select_result_I2[OF disc_nodes_document_ptr_h3, symmetric]
+                    disconnected_nodes_eq2_h2[OF docs_neq[symmetric], symmetric]
                   by (simp add: "5" True)
-                moreover have f1: 
-                     "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = {}"
-                  using 2 a1 old_document_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3 
-                       \<open>old_document \<noteq> x\<close>
-                  by (metis (no_types, lifting) a0 distinct_concat_map_E(1) document_ptr_kinds_eq3_h2 
-                         document_ptr_kinds_eq3_h3 finite_fset fmember.rep_eq set_sorted_list_of_set) 
+                moreover have f1:
+                  "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = {}"
+                  using 2 a1 old_document_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
+                    \<open>old_document \<noteq> x\<close>
+                  by (metis (no_types, lifting) a0 distinct_concat_map_E(1) document_ptr_kinds_eq3_h2
+                      document_ptr_kinds_eq3_h3 finite_fset fmember.rep_eq set_sorted_list_of_set)
                 ultimately show ?thesis
                   using 5 select_result_I2[OF disc_nodes_document_ptr_h']
-                    select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>  
+                    select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>
                     \<open>document_ptr \<noteq> x\<close> \<open>document_ptr = y\<close>
-                    \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2 
-                    disconnected_nodes_eq2_h3 
+                    \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2
+                    disconnected_nodes_eq2_h3
                   by auto
               next
                 case False
                 then show ?thesis
-                  using 5 
-                    select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close> 
+                  using 5
+                    select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>
                     \<open>document_ptr \<noteq> x\<close> \<open>document_ptr \<noteq> y\<close>
-                    \<open>child \<in> set disc_nodes_old_document_h2\<close> 
+                    \<open>child \<in> set disc_nodes_old_document_h2\<close>
                     disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
-                  by (metis \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close> 
-                            empty_iff inf.idem) 
+                  by (metis \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
+                      empty_iff inf.idem)
               qed
             qed
           qed
         qed
       qed
     next
       fix x xa xb
-      assume 0: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r) 
+      assume 0: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
                                   (sorted_list_of_set (fset (object_ptr_kinds h')))))"
-          and 1: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+        and 1: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                    (sorted_list_of_set (fset (document_ptr_kinds h2)))))"
-          and 2: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
+        and 2: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                     \<inter> (\<Union>x\<in>fset (document_ptr_kinds h2). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
-          and 3: "xa |\<in>| object_ptr_kinds h'"
-          and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
-          and 5: "xb |\<in>| document_ptr_kinds h'"
-          and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
+        and 3: "xa |\<in>| object_ptr_kinds h'"
+        and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
+        and 5: "xb |\<in>| document_ptr_kinds h'"
+        and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
       then show False
         using \<open>child \<in> set disc_nodes_old_document_h2\<close> disc_nodes_document_ptr_h'
-               disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disc_nodes_old_document_h3 
-               disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq2_h2 
-               document_ptr_kinds_eq2_h3  old_document_in_heap
+          disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disc_nodes_old_document_h3
+          disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq2_h2
+          document_ptr_kinds_eq2_h3  old_document_in_heap
         apply(auto)[1]
         apply(cases "xb = old_document")
       proof -
         assume a1: "xb = old_document"
         assume a2: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
         assume a3: "h3 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r remove1 child disc_nodes_old_document_h2"
         assume a4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
         assume "document_ptr_kinds h2 = document_ptr_kinds h'"
-        assume a5: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r) 
+        assume a5: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
         have f6: "old_document |\<in>| document_ptr_kinds h'"
           using a1 \<open>xb |\<in>| document_ptr_kinds h'\<close> by blast
         have f7: "|h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = disc_nodes_old_document_h2"
           using a2 by simp
         have "x \<in> set disc_nodes_old_document_h2"
-          using f6 a3 a1 by (metis (no_types) \<open>type_wf h'\<close> \<open>x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r\<close> 
-                disconnected_nodes_eq_h3 docs_neq get_disconnected_nodes_ok returns_result_eq
-                returns_result_select_result set_remove1_subset subsetCE)
+          using f6 a3 a1 by (metis (no_types) \<open>type_wf h'\<close> \<open>x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r\<close>
+              disconnected_nodes_eq_h3 docs_neq get_disconnected_nodes_ok returns_result_eq
+              returns_result_select_result set_remove1_subset subsetCE)
         then have "set |h' \<turnstile> get_child_nodes xa|\<^sub>r \<inter>  set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r = {}"
           using f7 f6 a5 a4 \<open>xa |\<in>| object_ptr_kinds h'\<close>
-          by fastforce 
+          by fastforce
         then show ?thesis
           using \<open>x \<in> set disc_nodes_old_document_h2\<close> a1 a4 f7 by blast
       next
         assume a1: "xb \<noteq> old_document"
         assume a2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3"
         assume a3: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
         assume a4: "xa |\<in>| object_ptr_kinds h'"
         assume a5: "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r child # disc_nodes_document_ptr_h3"
         assume a6: "old_document |\<in>| document_ptr_kinds h'"
         assume a7: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
         assume a8: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
         assume a9: "document_ptr_kinds h2 = document_ptr_kinds h'"
-        assume a10: "\<And>doc_ptr. old_document \<noteq> doc_ptr 
+        assume a10: "\<And>doc_ptr. old_document \<noteq> doc_ptr
                \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
-        assume a11: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr 
+        assume a11: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
                \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
-        assume a12: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r) 
+        assume a12: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                     \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
         have f13: "\<And>d. d \<notin> set |h' \<turnstile> document_ptr_kinds_M|\<^sub>r \<or> h2 \<turnstile> ok get_disconnected_nodes d"
           using a9 \<open>type_wf h2\<close> get_disconnected_nodes_ok
           by simp
         then have f14: "|h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = disc_nodes_old_document_h2"
           using a6 a3 by simp
         have "x \<notin> set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r"
           using a12 a8 a4 \<open>xb |\<in>| document_ptr_kinds h'\<close>
           by (meson UN_I disjoint_iff_not_equal fmember.rep_eq)
         then have "x = child"
           using f13 a11 a10 a7 a5 a2 a1
-          by (metis (no_types, lifting) select_result_I2 set_ConsD) 
+          by (metis (no_types, lifting) select_result_I2 set_ConsD)
         then have "child \<notin> set disc_nodes_old_document_h2"
           using f14 a12 a8 a6 a4
-          by (metis \<open>type_wf h'\<close> adopt_node_removes_child assms(1) assms(2) type_wf 
-                    get_child_nodes_ok known_ptrs local.known_ptrs_known_ptr object_ptr_kinds_h2_eq3 
-                    object_ptr_kinds_h3_eq3 object_ptr_kinds_h_eq3 returns_result_select_result)
+          by (metis \<open>type_wf h'\<close> adopt_node_removes_child assms(1) assms(2) type_wf
+              get_child_nodes_ok known_ptrs local.known_ptrs_known_ptr object_ptr_kinds_h2_eq3
+              object_ptr_kinds_h3_eq3 object_ptr_kinds_h_eq3 returns_result_select_result)
         then show ?thesis
           using \<open>child \<in> set disc_nodes_old_document_h2\<close> by fastforce
       qed
     qed
     ultimately show ?thesis
       using \<open>type_wf h'\<close> \<open>known_ptrs h'\<close> \<open>a_owner_document_valid h'\<close> heap_is_wellformed_def by blast
   qed
   then show "heap_is_wellformed h'" and "known_ptrs h'" and "type_wf h'"
     by auto
 qed
 
 lemma adopt_node_node_in_disconnected_nodes:
   assumes wellformed: "heap_is_wellformed h"
     and adopt_node: "h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h'"
     and "h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "node_ptr \<in> set disc_nodes"
 proof -
   obtain old_document parent_opt h2 where
     old_document: "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r old_document" and
     parent_opt: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt" and
-    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent node_ptr | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2" 
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent node_ptr | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2"
     and
     h': "h2 \<turnstile> (if owner_document \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 node_ptr old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes owner_document;
         set_disconnected_nodes owner_document (node_ptr # disc_nodes)
       } else do {
         return ()
       }) \<rightarrow>\<^sub>h h'"
     using assms(2)
-    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E 
-            dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure] 
-                   pure_returns_heap_eq[rotated, OF get_parent_pure])
+    by(auto simp add: adopt_node_def elim!: bind_returns_heap_E
+        dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
+        pure_returns_heap_eq[rotated, OF get_parent_pure])
 
   show ?thesis
   proof (cases "owner_document = old_document")
     case True
     then show ?thesis
     proof (insert parent_opt h2, induct parent_opt)
       case None
       then have "h = h'"
         using h2 h' by(auto)
       then show ?case
         using in_disconnected_nodes_no_parent assms None old_document by blast
     next
       case (Some parent)
       then show ?case
         using remove_child_in_disconnected_nodes known_ptrs True h' assms(3) old_document by auto
     qed
   next
     case False
     then show ?thesis
       using assms(3)  h' list.set_intros(1) select_result_I2 set_disconnected_nodes_get_disconnected_nodes
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])[1]
     proof -
-      fix x  and h'a and xb 
+      fix x  and h'a and xb
       assume a1: "h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes"
-      assume a2: "\<And>h document_ptr disc_nodes h'. h \<turnstile> set_disconnected_nodes document_ptr disc_nodes \<rightarrow>\<^sub>h h' 
+      assume a2: "\<And>h document_ptr disc_nodes h'. h \<turnstile> set_disconnected_nodes document_ptr disc_nodes \<rightarrow>\<^sub>h h'
                  \<Longrightarrow> h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
       assume "h'a \<turnstile> set_disconnected_nodes owner_document (node_ptr # xb) \<rightarrow>\<^sub>h h'"
       then have "node_ptr # xb = disc_nodes"
         using a2 a1 by (meson returns_result_eq)
       then show ?thesis
         by (meson list.set_intros(1))
     qed
   qed
 qed
 end
 
-interpretation i_adopt_node_wf?: l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent get_parent_locs 
-               remove_child remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs 
-               set_disconnected_nodes set_disconnected_nodes_locs adopt_node adopt_node_locs known_ptr 
-               type_wf get_child_nodes get_child_nodes_locs known_ptrs set_child_nodes set_child_nodes_locs 
-               remove heap_is_wellformed parent_child_rel
+interpretation i_adopt_node_wf?: l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent get_parent_locs
+  remove_child remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs adopt_node adopt_node_locs known_ptr
+  type_wf get_child_nodes get_child_nodes_locs known_ptrs set_child_nodes set_child_nodes_locs
+  remove heap_is_wellformed parent_child_rel
   by(simp add: l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
-interpretation i_adopt_node_wf2?: l_adopt_node_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent get_parent_locs 
-               remove_child remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs 
-               set_disconnected_nodes set_disconnected_nodes_locs adopt_node adopt_node_locs known_ptr 
-               type_wf get_child_nodes get_child_nodes_locs known_ptrs set_child_nodes set_child_nodes_locs 
-               remove heap_is_wellformed parent_child_rel get_root_node get_root_node_locs
+interpretation i_adopt_node_wf2?: l_adopt_node_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent get_parent_locs
+  remove_child remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs adopt_node adopt_node_locs known_ptr
+  type_wf get_child_nodes get_child_nodes_locs known_ptrs set_child_nodes set_child_nodes_locs
+  remove heap_is_wellformed parent_child_rel get_root_node get_root_node_locs
   by(simp add: l_adopt_node_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_adopt_node_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms[instances]
 
 
-locale l_adopt_node_wf = l_heap_is_wellformed + l_known_ptrs + l_type_wf + l_adopt_node_defs 
-                       + l_get_child_nodes_defs + l_get_disconnected_nodes_defs +
+locale l_adopt_node_wf = l_heap_is_wellformed + l_known_ptrs + l_type_wf + l_adopt_node_defs
+  + l_get_child_nodes_defs + l_get_disconnected_nodes_defs +
   assumes adopt_node_preserves_wellformedness:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<Longrightarrow> known_ptrs h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> type_wf h \<Longrightarrow> heap_is_wellformed h'"
   assumes adopt_node_removes_child:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h2 
-                          \<Longrightarrow> h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> known_ptrs h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h2
+                          \<Longrightarrow> h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> type_wf h \<Longrightarrow> node_ptr \<notin> set children"
   assumes adopt_node_node_in_disconnected_nodes:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h' 
-                          \<Longrightarrow> h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h'
+                          \<Longrightarrow> h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes
                           \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h \<Longrightarrow> node_ptr \<in> set disc_nodes"
-  assumes adopt_node_removes_first_child: "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-                         \<Longrightarrow> h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h' 
-                         \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r node # children 
+  assumes adopt_node_removes_first_child: "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+                         \<Longrightarrow> h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h'
+                         \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r node # children
                          \<Longrightarrow> h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
   assumes adopt_node_document_in_heap: "heap_is_wellformed h \<Longrightarrow> known_ptrs h \<Longrightarrow> type_wf h
                         \<Longrightarrow> h \<turnstile> ok (adopt_node owner_document node)
                         \<Longrightarrow> owner_document |\<in>| document_ptr_kinds h"
   assumes adopt_node_preserves_type_wf:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<Longrightarrow> known_ptrs h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> type_wf h \<Longrightarrow> type_wf h'"
   assumes adopt_node_preserves_known_ptrs:
-    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<Longrightarrow> known_ptrs h 
+    "heap_is_wellformed h \<Longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<Longrightarrow> known_ptrs h
                           \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h'"
 
 
-lemma adopt_node_wf_is_l_adopt_node_wf [instances]: 
+lemma adopt_node_wf_is_l_adopt_node_wf [instances]:
   "l_adopt_node_wf type_wf known_ptr heap_is_wellformed parent_child_rel get_child_nodes
                    get_disconnected_nodes known_ptrs adopt_node"
   using heap_is_wellformed_is_l_heap_is_wellformed known_ptrs_is_l_known_ptrs
   apply(auto simp add: l_adopt_node_wf_def l_adopt_node_wf_axioms_def)[1]
   using adopt_node_preserves_wellformedness apply blast
   using adopt_node_removes_child apply blast
   using adopt_node_node_in_disconnected_nodes apply blast
   using adopt_node_removes_first_child apply blast
   using adopt_node_document_in_heap apply blast
   using adopt_node_preserves_wellformedness apply blast
   using adopt_node_preserves_wellformedness apply blast
   done
 
 
 subsection \<open>insert\_before\<close>
 
 locale l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node_wf +
   l_set_disconnected_nodes_get_child_nodes +
   l_heap_is_wellformed
 begin
 lemma insert_before_removes_child:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "ptr \<noteq> ptr'"
   assumes "h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r node # children"
   shows "h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
 proof -
   obtain owner_document h2 h3 disc_nodes reference_child where
     "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
     "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
     h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
     "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disc_nodes" and
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disc_nodes) \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
     using assms(5)
-    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def 
-            elim!: bind_returns_heap_E bind_returns_result_E 
-                   bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated] 
-                   bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] 
-            split: if_splits option.splits)
+    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        split: if_splits option.splits)
 
   have "h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using h2 adopt_node_removes_first_child assms(1) assms(2) assms(3) assms(6)
     by simp
   then have "h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using h3
-    by(auto simp add: set_disconnected_nodes_get_child_nodes 
-            dest!: reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes])
+    by(auto simp add: set_disconnected_nodes_get_child_nodes
+        dest!: reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes])
   then show ?thesis
     using h' assms(4)
-    apply(auto simp add: a_insert_node_def  
-               elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated])[1]
-    by(auto simp add: set_child_nodes_get_child_nodes_different_pointers 
-            elim!: reads_writes_separate_forwards[OF get_child_nodes_reads set_child_nodes_writes])
+    apply(auto simp add: a_insert_node_def
+        elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated])[1]
+    by(auto simp add: set_child_nodes_get_child_nodes_different_pointers
+        elim!: reads_writes_separate_forwards[OF get_child_nodes_reads set_child_nodes_writes])
 qed
 end
 
-locale l_insert_before_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs 
-                          + l_insert_before_defs + l_get_child_nodes_defs +
-assumes insert_before_removes_child: 
-  "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> ptr \<noteq> ptr' 
-                        \<Longrightarrow> h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h' 
-                        \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r node # children 
+locale l_insert_before_wf = l_heap_is_wellformed_defs + l_type_wf + l_known_ptrs
+  + l_insert_before_defs + l_get_child_nodes_defs +
+  assumes insert_before_removes_child:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> ptr \<noteq> ptr'
+                        \<Longrightarrow> h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'
+                        \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r node # children
                         \<Longrightarrow> h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
 
-interpretation i_insert_before_wf?: l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_parent get_parent_locs 
-                                    get_child_nodes get_child_nodes_locs set_child_nodes 
-                                    set_child_nodes_locs get_ancestors get_ancestors_locs 
-                                    adopt_node adopt_node_locs set_disconnected_nodes 
-                                    set_disconnected_nodes_locs get_disconnected_nodes 
-                                    get_disconnected_nodes_locs get_owner_document insert_before 
-                                    insert_before_locs append_child type_wf known_ptr known_ptrs 
-                                    heap_is_wellformed parent_child_rel
+interpretation i_insert_before_wf?: l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_parent get_parent_locs
+  get_child_nodes get_child_nodes_locs set_child_nodes
+  set_child_nodes_locs get_ancestors get_ancestors_locs
+  adopt_node adopt_node_locs set_disconnected_nodes
+  set_disconnected_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs get_owner_document insert_before
+  insert_before_locs append_child type_wf known_ptr known_ptrs
+  heap_is_wellformed parent_child_rel
   by(simp add: l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
-lemma insert_before_wf_is_l_insert_before_wf [instances]: 
+lemma insert_before_wf_is_l_insert_before_wf [instances]:
   "l_insert_before_wf heap_is_wellformed type_wf known_ptr known_ptrs insert_before get_child_nodes"
   apply(auto simp add: l_insert_before_wf_def l_insert_before_wf_axioms_def instances)[1]
   using insert_before_removes_child apply fast
   done
 
 locale l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_child_nodes_get_disconnected_nodes +
   l_remove_child +
   l_get_root_node_wf +
   l_set_disconnected_nodes_get_disconnected_nodes_wf +
   l_set_disconnected_nodes_get_ancestors +
   l_get_ancestors_wf +
   l_get_owner_document +
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document_wf
 begin
 
-lemma insert_before_preserves_acyclitity_thesis:
+lemma insert_before_preserves_acyclitity:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'"
-shows "acyclic (parent_child_rel h')"
+  shows "acyclic (parent_child_rel h')"
 proof -
   obtain ancestors reference_child owner_document h2 h3
     disconnected_nodes_h2
-  where
-    ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
-    node_not_in_ancestors: "cast node \<notin> set ancestors" and
-    reference_child:
-       "h \<turnstile> (if Some node = child then a_next_sibling node
+    where
+      ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
+      node_not_in_ancestors: "cast node \<notin> set ancestors" and
+      reference_child:
+      "h \<turnstile> (if Some node = child then a_next_sibling node
          else return child) \<rightarrow>\<^sub>r reference_child" and
-    owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
-    h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
-    disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document
+      owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
+      h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
+      disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document
       \<rightarrow>\<^sub>r disconnected_nodes_h2" and
-    h3: "h2 \<turnstile> set_disconnected_nodes owner_document
+      h3: "h2 \<turnstile> set_disconnected_nodes owner_document
       (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
-    h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
-      using assms(4)
-    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def 
-            elim!: bind_returns_heap_E bind_returns_result_E
-                 bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
-          split: if_splits option.splits)
+      h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
+    using assms(4)
+    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        split: if_splits option.splits)
 
   have "known_ptr ptr"
-    by (meson get_owner_document_ptr_in_heap is_OK_returns_result_I assms 
-              l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms owner_document)
+    by (meson get_owner_document_ptr_in_heap is_OK_returns_result_I assms
+        l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms owner_document)
 
   have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF adopt_node_writes h2]
     using assms adopt_node_types_preserved
     by(auto simp add: a_remove_child_locs_def reflp_def transp_def)
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF insert_node_writes h']
-    using set_child_nodes_types_preserved  
+    using set_child_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have object_ptr_kinds_M_eq3_h: "object_ptr_kinds h = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF adopt_node_writes h2])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF adopt_node_writes h2])
     using adopt_node_pointers_preserved
-    apply blast
+      apply blast
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs )
   then have object_ptr_kinds_M_eq2_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
 
   have "known_ptrs h2"
     using assms object_ptr_kinds_M_eq3_h known_ptrs_preserved by blast
 
   have wellformed_h2: "heap_is_wellformed h2"
     using adopt_node_preserves_wellformedness[OF assms(1) h2] assms by simp
 
   have object_ptr_kinds_M_eq3_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF set_disconnected_nodes_writes h3])  
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_disconnected_nodes_writes h3])
     unfolding a_remove_child_locs_def
-    using set_disconnected_nodes_pointers_preserved 
+    using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h2: "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_M_eq2_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h2 document_ptr_kinds_M_eq by auto
 
   have "known_ptrs h3"
     using object_ptr_kinds_M_eq3_h2 known_ptrs_preserved \<open>known_ptrs h2\<close> by blast
-  
+
   have object_ptr_kinds_M_eq3_h': "object_ptr_kinds h3 = object_ptr_kinds h'"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF insert_node_writes h']) 
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF insert_node_writes h'])
     unfolding a_remove_child_locs_def
-    using set_child_nodes_pointers_preserved 
+    using set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
-  then have object_ptr_kinds_M_eq_h3: 
+  then have object_ptr_kinds_M_eq_h3:
     "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
-  then have object_ptr_kinds_M_eq2_h3: 
+  then have object_ptr_kinds_M_eq2_h3:
     "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h3 document_ptr_kinds_M_eq by auto
 
   have "known_ptrs h'"
     using object_ptr_kinds_M_eq3_h' known_ptrs_preserved \<open>known_ptrs h3\<close> by blast
 
-  have disconnected_nodes_eq_h2: 
-    "\<And>doc_ptr disc_nodes. owner_document \<noteq> doc_ptr 
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. owner_document \<noteq> doc_ptr
       \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-  then have disconnected_nodes_eq2_h2: 
-     "\<And>doc_ptr. doc_ptr \<noteq> owner_document 
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. doc_ptr \<noteq> owner_document
      \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_h3: 
-   "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r remove1 node disconnected_nodes_h2"
+  have disconnected_nodes_h3:
+    "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r remove1 node disconnected_nodes_h2"
     using h3 set_disconnected_nodes_get_disconnected_nodes
     by blast
 
-  have disconnected_nodes_eq_h3: 
-    "\<And>doc_ptr disc_nodes. h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h3:
+    "\<And>doc_ptr disc_nodes. h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                         = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads insert_node_writes  h'
     apply(rule reads_writes_preserved)
     using set_child_nodes_get_disconnected_nodes by fast
-  then have disconnected_nodes_eq2_h3: 
+  then have disconnected_nodes_eq2_h3:
     "\<And>doc_ptr. |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h2: 
-     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_child_nodes)
-  then have children_eq2_h2: 
-     "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2_h2:
+    "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h3: 
-    "\<And>ptr' children. ptr \<noteq> ptr' 
+  have children_eq_h3:
+    "\<And>ptr' children. ptr \<noteq> ptr'
         \<Longrightarrow> h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads insert_node_writes h'
     apply(rule reads_writes_preserved)
     by (auto simp add: set_child_nodes_get_child_nodes_different_pointers)
-  then have children_eq2_h3: 
-     "\<And>ptr'. ptr \<noteq> ptr' \<Longrightarrow> |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2_h3:
+    "\<And>ptr'. ptr \<noteq> ptr' \<Longrightarrow> |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   obtain children_h3 where children_h3: "h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h3"
     using h' a_insert_node_def by auto
   have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r insert_before_list node reference_child children_h3"
     using h' \<open>type_wf h3\<close> \<open>known_ptr ptr\<close>
-    by(auto simp add: a_insert_node_def elim!: bind_returns_heap_E2 
-            dest!: set_child_nodes_get_child_nodes returns_result_eq[OF children_h3])
+    by(auto simp add: a_insert_node_def elim!: bind_returns_heap_E2
+        dest!: set_child_nodes_get_child_nodes returns_result_eq[OF children_h3])
 
   have ptr_in_heap: "ptr |\<in>| object_ptr_kinds h3"
     using children_h3 get_child_nodes_ptr_in_heap by blast
   have node_in_heap: "node |\<in>| node_ptr_kinds h"
     using h2 adopt_node_child_in_heap by fast
-  have child_not_in_any_children: 
+  have child_not_in_any_children:
     "\<And>p children. h2 \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children \<Longrightarrow> node \<notin> set children"
     using assms h2 adopt_node_removes_child by auto
   have "node \<in> set disconnected_nodes_h2"
-    using disconnected_nodes_h2 h2 adopt_node_node_in_disconnected_nodes assms(1) 
-          \<open>type_wf h\<close> \<open>known_ptrs h\<close> by blast
-  have node_not_in_disconnected_nodes: 
-       "\<And>d. d |\<in>| document_ptr_kinds h3 \<Longrightarrow> node \<notin> set |h3 \<turnstile> get_disconnected_nodes d|\<^sub>r"
+    using disconnected_nodes_h2 h2 adopt_node_node_in_disconnected_nodes assms(1)
+      \<open>type_wf h\<close> \<open>known_ptrs h\<close> by blast
+  have node_not_in_disconnected_nodes:
+    "\<And>d. d |\<in>| document_ptr_kinds h3 \<Longrightarrow> node \<notin> set |h3 \<turnstile> get_disconnected_nodes d|\<^sub>r"
   proof -
     fix d
     assume "d |\<in>| document_ptr_kinds h3"
     show "node \<notin> set |h3 \<turnstile> get_disconnected_nodes d|\<^sub>r"
     proof (cases "d = owner_document")
       case True
       then show ?thesis
-        using disconnected_nodes_h2 wellformed_h2 h3 remove_from_disconnected_nodes_removes 
-              wellformed_h2 \<open>d |\<in>| document_ptr_kinds h3\<close> disconnected_nodes_h3 
+        using disconnected_nodes_h2 wellformed_h2 h3 remove_from_disconnected_nodes_removes
+          wellformed_h2 \<open>d |\<in>| document_ptr_kinds h3\<close> disconnected_nodes_h3
         by fastforce
     next
       case False
-      then have 
+      then have
         "set |h2 \<turnstile> get_disconnected_nodes d|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes owner_document|\<^sub>r = {}"
         using distinct_concat_map_E(1) wellformed_h2
-        by (metis (no_types, lifting) \<open>d |\<in>| document_ptr_kinds h3\<close> \<open>type_wf h2\<close> 
-                  disconnected_nodes_h2 document_ptr_kinds_M_def document_ptr_kinds_eq2_h2 
-                  l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok 
-                  local.heap_is_wellformed_one_disc_parent returns_result_select_result 
-                  select_result_I2) 
+        by (metis (no_types, lifting) \<open>d |\<in>| document_ptr_kinds h3\<close> \<open>type_wf h2\<close>
+            disconnected_nodes_h2 document_ptr_kinds_M_def document_ptr_kinds_eq2_h2
+            l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok
+            local.heap_is_wellformed_one_disc_parent returns_result_select_result
+            select_result_I2)
       then show ?thesis
-        using disconnected_nodes_eq2_h2[OF False] \<open>node \<in> set disconnected_nodes_h2\<close> 
-              disconnected_nodes_h2 by fastforce
+        using disconnected_nodes_eq2_h2[OF False] \<open>node \<in> set disconnected_nodes_h2\<close>
+          disconnected_nodes_h2 by fastforce
     qed
   qed
 
-  have "cast node \<noteq> ptr"                         
+  have "cast node \<noteq> ptr"
     using ancestors node_not_in_ancestors get_ancestors_ptr
     by fast
 
   obtain ancestors_h2 where ancestors_h2: "h2 \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors_h2"
     using get_ancestors_ok object_ptr_kinds_M_eq2_h2 \<open>known_ptrs h2\<close> \<open>type_wf h2\<close>
     by (metis is_OK_returns_result_E object_ptr_kinds_M_eq3_h2 ptr_in_heap wellformed_h2)
   have ancestors_h3: "h3 \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors_h2"
     using get_ancestors_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_separate_forwards)
-    using \<open>heap_is_wellformed h2\<close> ancestors_h2  
+    using \<open>heap_is_wellformed h2\<close> ancestors_h2
     by (auto simp add: set_disconnected_nodes_get_ancestors)
   have node_not_in_ancestors_h2: "cast node \<notin> set ancestors_h2"
     apply(rule get_ancestors_remains_not_in_ancestors[OF assms(1) wellformed_h2 ancestors ancestors_h2])
     using adopt_node_children_subset using h2 \<open>known_ptrs h\<close> \<open> type_wf h\<close> apply(blast)
     using node_not_in_ancestors apply(blast)
     using object_ptr_kinds_M_eq3_h apply(blast)
     using \<open>known_ptrs h\<close> apply(blast)
     using \<open>type_wf h\<close> apply(blast)
     using \<open>type_wf h2\<close> by blast
 
-    have "acyclic (parent_child_rel h2)"
-      using wellformed_h2  by (simp add: heap_is_wellformed_def acyclic_heap_def)
-    then have "acyclic (parent_child_rel h3)"
-      by(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h2 children_eq2_h2)
-    moreover
+  have "acyclic (parent_child_rel h2)"
+    using wellformed_h2  by (simp add: heap_is_wellformed_def acyclic_heap_def)
+  then have "acyclic (parent_child_rel h3)"
+    by(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h2 children_eq2_h2)
+  moreover
 
   have "cast node \<notin> {x. (x, ptr) \<in> (parent_child_rel h2)\<^sup>*}"
     using adopt_node_removes_child
     using ancestors node_not_in_ancestors
-    using \<open>known_ptrs h2\<close> \<open>type_wf h2\<close> ancestors_h2 local.get_ancestors_parent_child_rel node_not_in_ancestors_h2 wellformed_h2
+    using \<open>known_ptrs h2\<close> \<open>type_wf h2\<close> ancestors_h2 local.get_ancestors_parent_child_rel
+      node_not_in_ancestors_h2 wellformed_h2
     by blast
   then have "cast node \<notin> {x. (x, ptr) \<in> (parent_child_rel h3)\<^sup>*}"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h2 children_eq2_h2)
   moreover have "parent_child_rel h'
       = insert (ptr, cast node) ((parent_child_rel h3))"
     using  children_h3 children_h' ptr_in_heap
-    apply(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h' children_eq2_h3  
-        insert_before_list_node_in_set)[1] 
+    apply(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h' children_eq2_h3
+        insert_before_list_node_in_set)[1]
      apply (metis (no_types, lifting) children_eq2_h3 insert_before_list_in_set select_result_I2)
     by (metis (no_types, lifting) children_eq2_h3 imageI insert_before_list_in_set select_result_I2)
   ultimately show "acyclic (parent_child_rel h')"
     by (auto simp add: heap_is_wellformed_def)
 qed
 
 lemma insert_before_heap_is_wellformed_preserved:
   assumes wellformed: "heap_is_wellformed h"
     and insert_before: "h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "heap_is_wellformed h'" and "type_wf h'" and "known_ptrs h'"
 proof -
   obtain ancestors reference_child owner_document h2 h3 disconnected_nodes_h2 where
     ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
     node_not_in_ancestors: "cast node \<notin> set ancestors" and
     reference_child:
-       "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
+    "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
     owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
     h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
     disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2" and
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
     using assms(2)
-    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def 
-            elim!: bind_returns_heap_E bind_returns_result_E
-                 bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
-          split: if_splits option.splits)
+    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        split: if_splits option.splits)
 
   have "known_ptr ptr"
-    by (meson get_owner_document_ptr_in_heap is_OK_returns_result_I known_ptrs 
-              l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms owner_document)
+    by (meson get_owner_document_ptr_in_heap is_OK_returns_result_I known_ptrs
+        l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms owner_document)
 
   have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF adopt_node_writes h2]
     using type_wf adopt_node_types_preserved
     by(auto simp add: a_remove_child_locs_def reflp_def transp_def)
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
   then show "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF insert_node_writes h']
-    using set_child_nodes_types_preserved  
+    using set_child_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have object_ptr_kinds_M_eq3_h: "object_ptr_kinds h = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF adopt_node_writes h2])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF adopt_node_writes h2])
     using adopt_node_pointers_preserved
-    apply blast
+      apply blast
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs )
   then have object_ptr_kinds_M_eq2_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
 
   have "known_ptrs h2"
     using known_ptrs object_ptr_kinds_M_eq3_h known_ptrs_preserved by blast
 
   have wellformed_h2: "heap_is_wellformed h2"
     using adopt_node_preserves_wellformedness[OF wellformed h2] known_ptrs type_wf .
 
   have object_ptr_kinds_M_eq3_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF set_disconnected_nodes_writes h3])  
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_disconnected_nodes_writes h3])
     unfolding a_remove_child_locs_def
-    using set_disconnected_nodes_pointers_preserved 
+    using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h2: "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_M_eq2_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h2 document_ptr_kinds_M_eq by auto
 
   have "known_ptrs h3"
     using object_ptr_kinds_M_eq3_h2 known_ptrs_preserved \<open>known_ptrs h2\<close> by blast
-  
+
   have object_ptr_kinds_M_eq3_h': "object_ptr_kinds h3 = object_ptr_kinds h'"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF insert_node_writes h']) 
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF insert_node_writes h'])
     unfolding a_remove_child_locs_def
-    using set_child_nodes_pointers_preserved 
+    using set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
-  then have object_ptr_kinds_M_eq_h3: 
+  then have object_ptr_kinds_M_eq_h3:
     "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
-  then have object_ptr_kinds_M_eq2_h3: 
+  then have object_ptr_kinds_M_eq2_h3:
     "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h3 document_ptr_kinds_M_eq by auto
 
   show "known_ptrs h'"
     using object_ptr_kinds_M_eq3_h' known_ptrs_preserved \<open>known_ptrs h3\<close> by blast
 
-  have disconnected_nodes_eq_h2: 
-    "\<And>doc_ptr disc_nodes. owner_document \<noteq> doc_ptr 
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. owner_document \<noteq> doc_ptr
       \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-  then have disconnected_nodes_eq2_h2: 
-     "\<And>doc_ptr. doc_ptr \<noteq> owner_document 
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. doc_ptr \<noteq> owner_document
      \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_h3: 
-   "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r remove1 node disconnected_nodes_h2"
+  have disconnected_nodes_h3:
+    "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r remove1 node disconnected_nodes_h2"
     using h3 set_disconnected_nodes_get_disconnected_nodes
     by blast
 
-  have disconnected_nodes_eq_h3: 
-    "\<And>doc_ptr disc_nodes. h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h3:
+    "\<And>doc_ptr disc_nodes. h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                         = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads insert_node_writes  h'
     apply(rule reads_writes_preserved)
     using set_child_nodes_get_disconnected_nodes by fast
-  then have disconnected_nodes_eq2_h3: 
+  then have disconnected_nodes_eq2_h3:
     "\<And>doc_ptr. |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h2: 
-     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_child_nodes)
-  then have children_eq2_h2: 
-     "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2_h2:
+    "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h3: 
-    "\<And>ptr' children. ptr \<noteq> ptr' 
+  have children_eq_h3:
+    "\<And>ptr' children. ptr \<noteq> ptr'
         \<Longrightarrow> h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads insert_node_writes h'
     apply(rule reads_writes_preserved)
     by (auto simp add: set_child_nodes_get_child_nodes_different_pointers)
-  then have children_eq2_h3: 
-     "\<And>ptr'. ptr \<noteq> ptr' \<Longrightarrow> |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2_h3:
+    "\<And>ptr'. ptr \<noteq> ptr' \<Longrightarrow> |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   obtain children_h3 where children_h3: "h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h3"
     using h' a_insert_node_def by auto
   have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r insert_before_list node reference_child children_h3"
     using h' \<open>type_wf h3\<close> \<open>known_ptr ptr\<close>
-    by(auto simp add: a_insert_node_def elim!: bind_returns_heap_E2 
-            dest!: set_child_nodes_get_child_nodes returns_result_eq[OF children_h3])
+    by(auto simp add: a_insert_node_def elim!: bind_returns_heap_E2
+        dest!: set_child_nodes_get_child_nodes returns_result_eq[OF children_h3])
 
   have ptr_in_heap: "ptr |\<in>| object_ptr_kinds h3"
     using children_h3 get_child_nodes_ptr_in_heap by blast
   have node_in_heap: "node |\<in>| node_ptr_kinds h"
     using h2 adopt_node_child_in_heap by fast
-  have child_not_in_any_children: 
+  have child_not_in_any_children:
     "\<And>p children. h2 \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children \<Longrightarrow> node \<notin> set children"
     using wellformed h2 adopt_node_removes_child \<open>type_wf h\<close> \<open>known_ptrs h\<close> by auto
   have "node \<in> set disconnected_nodes_h2"
-    using disconnected_nodes_h2 h2 adopt_node_node_in_disconnected_nodes assms(1) 
-          \<open>type_wf h\<close> \<open>known_ptrs h\<close> by blast
-  have node_not_in_disconnected_nodes: 
-       "\<And>d. d |\<in>| document_ptr_kinds h3 \<Longrightarrow> node \<notin> set |h3 \<turnstile> get_disconnected_nodes d|\<^sub>r"
+    using disconnected_nodes_h2 h2 adopt_node_node_in_disconnected_nodes assms(1)
+      \<open>type_wf h\<close> \<open>known_ptrs h\<close> by blast
+  have node_not_in_disconnected_nodes:
+    "\<And>d. d |\<in>| document_ptr_kinds h3 \<Longrightarrow> node \<notin> set |h3 \<turnstile> get_disconnected_nodes d|\<^sub>r"
   proof -
     fix d
     assume "d |\<in>| document_ptr_kinds h3"
     show "node \<notin> set |h3 \<turnstile> get_disconnected_nodes d|\<^sub>r"
     proof (cases "d = owner_document")
       case True
       then show ?thesis
-        using disconnected_nodes_h2 wellformed_h2 h3 remove_from_disconnected_nodes_removes 
-              wellformed_h2 \<open>d |\<in>| document_ptr_kinds h3\<close> disconnected_nodes_h3 
+        using disconnected_nodes_h2 wellformed_h2 h3 remove_from_disconnected_nodes_removes
+          wellformed_h2 \<open>d |\<in>| document_ptr_kinds h3\<close> disconnected_nodes_h3
         by fastforce
     next
       case False
-      then have 
+      then have
         "set |h2 \<turnstile> get_disconnected_nodes d|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes owner_document|\<^sub>r = {}"
         using distinct_concat_map_E(1) wellformed_h2
-        by (metis (no_types, lifting) \<open>d |\<in>| document_ptr_kinds h3\<close> \<open>type_wf h2\<close> 
-                  disconnected_nodes_h2 document_ptr_kinds_M_def document_ptr_kinds_eq2_h2 
-                  l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok 
-                  local.heap_is_wellformed_one_disc_parent returns_result_select_result 
-                  select_result_I2) 
+        by (metis (no_types, lifting) \<open>d |\<in>| document_ptr_kinds h3\<close> \<open>type_wf h2\<close>
+            disconnected_nodes_h2 document_ptr_kinds_M_def document_ptr_kinds_eq2_h2
+            l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok
+            local.heap_is_wellformed_one_disc_parent returns_result_select_result
+            select_result_I2)
       then show ?thesis
-        using disconnected_nodes_eq2_h2[OF False] \<open>node \<in> set disconnected_nodes_h2\<close> 
-              disconnected_nodes_h2 by fastforce
+        using disconnected_nodes_eq2_h2[OF False] \<open>node \<in> set disconnected_nodes_h2\<close>
+          disconnected_nodes_h2 by fastforce
     qed
   qed
 
-  have "cast node \<noteq> ptr"                         
+  have "cast node \<noteq> ptr"
     using ancestors node_not_in_ancestors get_ancestors_ptr
     by fast
 
   obtain ancestors_h2 where ancestors_h2: "h2 \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors_h2"
     using get_ancestors_ok object_ptr_kinds_M_eq2_h2 \<open>known_ptrs h2\<close> \<open>type_wf h2\<close>
     by (metis is_OK_returns_result_E object_ptr_kinds_M_eq3_h2 ptr_in_heap wellformed_h2)
   have ancestors_h3: "h3 \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors_h2"
     using get_ancestors_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_separate_forwards)
-    using \<open>heap_is_wellformed h2\<close> ancestors_h2  
+    using \<open>heap_is_wellformed h2\<close> ancestors_h2
     by (auto simp add: set_disconnected_nodes_get_ancestors)
   have node_not_in_ancestors_h2: "cast node \<notin> set ancestors_h2"
     apply(rule get_ancestors_remains_not_in_ancestors[OF assms(1) wellformed_h2 ancestors ancestors_h2])
     using adopt_node_children_subset using h2 \<open>known_ptrs h\<close> \<open> type_wf h\<close> apply(blast)
     using node_not_in_ancestors apply(blast)
     using object_ptr_kinds_M_eq3_h apply(blast)
     using \<open>known_ptrs h\<close> apply(blast)
     using \<open>type_wf h\<close> apply(blast)
     using \<open>type_wf h2\<close> by blast
 
   moreover have "a_acyclic_heap h'"
   proof -
     have "acyclic (parent_child_rel h2)"
       using wellformed_h2  by (simp add: heap_is_wellformed_def acyclic_heap_def)
     then have "acyclic (parent_child_rel h3)"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h2 children_eq2_h2)
     moreover have "cast node \<notin> {x. (x, ptr) \<in> (parent_child_rel h2)\<^sup>*}"
       using get_ancestors_parent_child_rel node_not_in_ancestors_h2 \<open>known_ptrs h2\<close> \<open>type_wf h2\<close>
       using ancestors_h2 wellformed_h2 by blast
     then have "cast node \<notin> {x. (x, ptr) \<in> (parent_child_rel h3)\<^sup>*}"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h2 children_eq2_h2)
     moreover have "parent_child_rel h' = insert (ptr, cast node) ((parent_child_rel h3))"
       using  children_h3 children_h' ptr_in_heap
-      apply(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h' children_eq2_h3  
-                           insert_before_list_node_in_set)[1] 
-      apply (metis (no_types, lifting) children_eq2_h3 insert_before_list_in_set select_result_I2)
+      apply(auto simp add: parent_child_rel_def object_ptr_kinds_M_eq3_h' children_eq2_h3
+          insert_before_list_node_in_set)[1]
+       apply (metis (no_types, lifting) children_eq2_h3 insert_before_list_in_set select_result_I2)
       by (metis (no_types, lifting) children_eq2_h3 imageI insert_before_list_in_set select_result_I2)
     ultimately show ?thesis
       by(auto simp add: acyclic_heap_def)
   qed
-    
+
 
   moreover have "a_all_ptrs_in_heap h2"
     using wellformed_h2  by (simp add: heap_is_wellformed_def)
   have "a_all_ptrs_in_heap h'"
   proof -
     have "a_all_ptrs_in_heap h3"
       using \<open>a_all_ptrs_in_heap h2\<close>
-      apply(auto simp add: a_all_ptrs_in_heap_def object_ptr_kinds_M_eq2_h2 node_ptr_kinds_eq2_h2 
-                           children_eq_h2)[1]
+      apply(auto simp add: a_all_ptrs_in_heap_def object_ptr_kinds_M_eq2_h2 node_ptr_kinds_eq2_h2
+          children_eq_h2)[1]
       using disconnected_nodes_eq2_h2 disconnected_nodes_h2 disconnected_nodes_h3
       using node_ptr_kinds_eq2_h2 apply auto[1]
-       apply (metis \<open>known_ptrs h2\<close> \<open>type_wf h3\<close> children_eq_h2 local.get_child_nodes_ok local.heap_is_wellformed_children_in_heap local.known_ptrs_known_ptr object_ptr_kinds_M_eq3_h2 returns_result_select_result wellformed_h2)
-      by (metis (no_types, lifting) disconnected_nodes_eq2_h2 disconnected_nodes_h2 disconnected_nodes_h3 document_ptr_kinds_commutes finite_set_in node_ptr_kinds_commutes object_ptr_kinds_M_eq3_h2 select_result_I2 set_remove1_subset subsetD)
+       apply (metis \<open>known_ptrs h2\<close> \<open>type_wf h3\<close> children_eq_h2 local.get_child_nodes_ok
+          local.heap_is_wellformed_children_in_heap local.known_ptrs_known_ptr object_ptr_kinds_M_eq3_h2
+          returns_result_select_result wellformed_h2)
+      by (metis (no_types, lifting) disconnected_nodes_eq2_h2 disconnected_nodes_h2
+          disconnected_nodes_h3 document_ptr_kinds_commutes finite_set_in node_ptr_kinds_commutes
+          object_ptr_kinds_M_eq3_h2 select_result_I2 set_remove1_subset subsetD)
 
     have "set children_h3  \<subseteq> set |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
-      using children_h3 \<open>a_all_ptrs_in_heap h3\<close> 
+      using children_h3 \<open>a_all_ptrs_in_heap h3\<close>
       apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq2_h3)[1]
-      by (metis children_eq_h2 l_heap_is_wellformed.heap_is_wellformed_children_in_heap local.l_heap_is_wellformed_axioms node_ptr_kinds_commutes object_ptr_kinds_M_eq3_h' object_ptr_kinds_M_eq3_h2 wellformed_h2)
+      by (metis children_eq_h2 l_heap_is_wellformed.heap_is_wellformed_children_in_heap
+          local.l_heap_is_wellformed_axioms node_ptr_kinds_commutes object_ptr_kinds_M_eq3_h'
+          object_ptr_kinds_M_eq3_h2 wellformed_h2)
 
     then have "set (insert_before_list node reference_child children_h3) \<subseteq> set |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
       using node_in_heap
       apply(auto simp add: node_ptr_kinds_eq2_h node_ptr_kinds_eq2_h2 node_ptr_kinds_eq2_h3)[1]
-      by (metis (no_types, hide_lams) contra_subsetD finite_set_in insert_before_list_in_set 
-                node_ptr_kinds_commutes object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h' 
-                object_ptr_kinds_M_eq3_h2)
+      by (metis (no_types, hide_lams) contra_subsetD finite_set_in insert_before_list_in_set
+          node_ptr_kinds_commutes object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h'
+          object_ptr_kinds_M_eq3_h2)
     then show ?thesis
       using \<open>a_all_ptrs_in_heap h3\<close>
-      apply(auto simp add: object_ptr_kinds_M_eq3_h' a_all_ptrs_in_heap_def node_ptr_kinds_def 
-                           node_ptr_kinds_eq2_h3 disconnected_nodes_eq_h3)[1]
+      apply(auto simp add: object_ptr_kinds_M_eq3_h' a_all_ptrs_in_heap_def node_ptr_kinds_def
+          node_ptr_kinds_eq2_h3 disconnected_nodes_eq_h3)[1]
       using children_eq_h3 children_h'
        apply (metis (no_types, lifting) children_eq2_h3 finite_set_in select_result_I2 subsetD)
-      by (metis (no_types) \<open>type_wf h'\<close> disconnected_nodes_eq2_h3 disconnected_nodes_eq_h3 finite_set_in is_OK_returns_result_I local.get_disconnected_nodes_ok local.get_disconnected_nodes_ptr_in_heap returns_result_select_result subsetD)
+      by (metis (no_types) \<open>type_wf h'\<close> disconnected_nodes_eq2_h3 disconnected_nodes_eq_h3
+          finite_set_in is_OK_returns_result_I local.get_disconnected_nodes_ok
+          local.get_disconnected_nodes_ptr_in_heap returns_result_select_result subsetD)
   qed
 
   moreover have "a_distinct_lists h2"
     using wellformed_h2  by (simp add: heap_is_wellformed_def)
   then have "a_distinct_lists h3"
-  proof(auto simp add: a_distinct_lists_def object_ptr_kinds_M_eq2_h2 document_ptr_kinds_eq2_h2 
-                       children_eq2_h2 intro!: distinct_concat_map_I)[1]
+  proof(auto simp add: a_distinct_lists_def object_ptr_kinds_M_eq2_h2 document_ptr_kinds_eq2_h2
+      children_eq2_h2 intro!: distinct_concat_map_I)[1]
     fix x
     assume 1: "x |\<in>| document_ptr_kinds h3"
-      and 2: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+      and 2: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                         (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
     show "distinct |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r"
-      using distinct_concat_map_E(2)[OF 2] select_result_I2[OF disconnected_nodes_h3] 
-            disconnected_nodes_eq2_h2 select_result_I2[OF disconnected_nodes_h2] 1
+      using distinct_concat_map_E(2)[OF 2] select_result_I2[OF disconnected_nodes_h3]
+        disconnected_nodes_eq2_h2 select_result_I2[OF disconnected_nodes_h2] 1
       by (metis (full_types) distinct_remove1 finite_fset fmember.rep_eq set_sorted_list_of_set)
-  next      
+  next
     fix x y xa
-    assume 1: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+    assume 1: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                           (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and 2: "x |\<in>| document_ptr_kinds h3"
       and 3: "y |\<in>| document_ptr_kinds h3"
       and 4: "x \<noteq> y"
       and 5: "xa \<in> set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r"
       and 6: "xa \<in> set |h3 \<turnstile> get_disconnected_nodes y|\<^sub>r"
     show False
     proof (cases "x = owner_document")
       case True
       then have "y \<noteq> owner_document"
         using 4 by simp
-      show ?thesis 
-        using distinct_concat_map_E(1)[OF 1]   
+      show ?thesis
+        using distinct_concat_map_E(1)[OF 1]
         using 2 3 4 5 6 select_result_I2[OF disconnected_nodes_h3]  select_result_I2[OF disconnected_nodes_h2]
         apply(auto simp add: True disconnected_nodes_eq2_h2[OF \<open>y \<noteq> owner_document\<close>])[1]
         by (metis (no_types, hide_lams) disconnected_nodes_eq2_h2 disjoint_iff_not_equal notin_set_remove1)
     next
       case False
       then show ?thesis
       proof (cases "y = owner_document")
         case True
-        then show ?thesis 
-        using distinct_concat_map_E(1)[OF 1]   
-        using 2 3 4 5 6 select_result_I2[OF disconnected_nodes_h3]  select_result_I2[OF disconnected_nodes_h2]
-        apply(auto simp add: True disconnected_nodes_eq2_h2[OF \<open>x \<noteq> owner_document\<close>])[1]
-        by (metis (no_types, hide_lams) disconnected_nodes_eq2_h2 disjoint_iff_not_equal notin_set_remove1)
+        then show ?thesis
+          using distinct_concat_map_E(1)[OF 1]
+          using 2 3 4 5 6 select_result_I2[OF disconnected_nodes_h3]  select_result_I2[OF disconnected_nodes_h2]
+          apply(auto simp add: True disconnected_nodes_eq2_h2[OF \<open>x \<noteq> owner_document\<close>])[1]
+          by (metis (no_types, hide_lams) disconnected_nodes_eq2_h2 disjoint_iff_not_equal notin_set_remove1)
       next
         case False
-        then show ?thesis 
+        then show ?thesis
           using distinct_concat_map_E(1)[OF 1, simplified, OF 2 3 4] 5 6
-          using disconnected_nodes_eq2_h2 disconnected_nodes_h2 disconnected_nodes_h3 
-               disjoint_iff_not_equal finite_fset fmember.rep_eq notin_set_remove1 select_result_I2 
-                 set_sorted_list_of_set
+          using disconnected_nodes_eq2_h2 disconnected_nodes_h2 disconnected_nodes_h3
+            disjoint_iff_not_equal finite_fset fmember.rep_eq notin_set_remove1 select_result_I2
+            set_sorted_list_of_set
           by (metis (no_types, lifting))
       qed
     qed
   next
     fix x xa xb
     assume 1: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h3 \<turnstile> get_child_nodes x|\<^sub>r)
                      \<inter> (\<Union>x\<in>fset (document_ptr_kinds h3). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       and 2: "xa |\<in>| object_ptr_kinds h3"
       and 3: "x \<in> set |h3 \<turnstile> get_child_nodes xa|\<^sub>r"
       and 4: "xb |\<in>| document_ptr_kinds h3"
       and 5: "x \<in> set |h3 \<turnstile> get_disconnected_nodes xb|\<^sub>r"
     have 6: "set |h3 \<turnstile> get_child_nodes xa|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r = {}"
       using 1 2 4
-      by (metis \<open>type_wf h2\<close> children_eq2_h2 document_ptr_kinds_commutes known_ptrs 
-                local.get_child_nodes_ok local.get_disconnected_nodes_ok 
-                local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr 
-                object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h2 returns_result_select_result 
-                wellformed_h2)
+      by (metis \<open>type_wf h2\<close> children_eq2_h2 document_ptr_kinds_commutes known_ptrs
+          local.get_child_nodes_ok local.get_disconnected_nodes_ok
+          local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr
+          object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h2 returns_result_select_result
+          wellformed_h2)
     show False
     proof (cases "xb = owner_document")
       case True
-      then show ?thesis 
+      then show ?thesis
         using select_result_I2[OF disconnected_nodes_h3,folded select_result_I2[OF disconnected_nodes_h2]]
         by (metis (no_types, lifting) "3" "5" "6" disjoint_iff_not_equal notin_set_remove1)
     next
       case False
       show ?thesis
         using 2 3 4 5 6 unfolding disconnected_nodes_eq2_h2[OF False] by auto
     qed
   qed
   then have "a_distinct_lists h'"
-  proof(auto simp add: a_distinct_lists_def document_ptr_kinds_eq2_h3 object_ptr_kinds_M_eq2_h3 
-                       disconnected_nodes_eq2_h3 intro!: distinct_concat_map_I)[1]
+  proof(auto simp add: a_distinct_lists_def document_ptr_kinds_eq2_h3 object_ptr_kinds_M_eq2_h3
+      disconnected_nodes_eq2_h3 intro!: distinct_concat_map_I)[1]
     fix x
     assume 1: "distinct (concat (map (\<lambda>ptr. |h3 \<turnstile> get_child_nodes ptr|\<^sub>r)
                                       (sorted_list_of_set (fset (object_ptr_kinds h')))))" and
-           2: "x |\<in>| object_ptr_kinds h'"
+      2: "x |\<in>| object_ptr_kinds h'"
     have 3: "\<And>p. p |\<in>| object_ptr_kinds h' \<Longrightarrow> distinct |h3 \<turnstile> get_child_nodes p|\<^sub>r"
       using 1  by (auto elim: distinct_concat_map_E)
     show "distinct |h' \<turnstile> get_child_nodes x|\<^sub>r"
     proof(cases "ptr = x")
       case True
       show ?thesis
-        using 3[OF 2] children_h3 children_h' 
-        by(auto simp add: True  insert_before_list_distinct 
-                dest: child_not_in_any_children[unfolded children_eq_h2])
+        using 3[OF 2] children_h3 children_h'
+        by(auto simp add: True  insert_before_list_distinct
+            dest: child_not_in_any_children[unfolded children_eq_h2])
     next
       case False
-      show ?thesis 
+      show ?thesis
         using children_eq2_h3[OF False] 3[OF 2] by auto
     qed
   next
     fix x y xa
-    assume 1: "distinct (concat (map (\<lambda>ptr. |h3 \<turnstile> get_child_nodes ptr|\<^sub>r) 
+    assume 1: "distinct (concat (map (\<lambda>ptr. |h3 \<turnstile> get_child_nodes ptr|\<^sub>r)
                      (sorted_list_of_set (fset (object_ptr_kinds h')))))"
       and 2: "x |\<in>| object_ptr_kinds h'"
       and 3: "y |\<in>| object_ptr_kinds h'"
       and 4: "x \<noteq> y"
       and 5: "xa \<in> set |h' \<turnstile> get_child_nodes x|\<^sub>r"
       and 6: "xa \<in> set |h' \<turnstile> get_child_nodes y|\<^sub>r"
     have 7:"set |h3 \<turnstile> get_child_nodes x|\<^sub>r \<inter> set |h3 \<turnstile> get_child_nodes y|\<^sub>r = {}"
       using distinct_concat_map_E(1)[OF 1] 2 3 4 by auto
     show False
     proof (cases "ptr = x")
       case True
       then have "ptr \<noteq> y"
         using 4 by simp
       then show ?thesis
         using  children_h3 children_h' child_not_in_any_children[unfolded children_eq_h2] 5 6
         apply(auto simp add:  True children_eq2_h3[OF \<open>ptr \<noteq> y\<close>])[1]
-        by (metis (no_types, hide_lams) "3" "7" \<open>type_wf h3\<close> children_eq2_h3 disjoint_iff_not_equal 
-                  get_child_nodes_ok insert_before_list_in_set known_ptrs local.known_ptrs_known_ptr 
-                  object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h' 
-                  object_ptr_kinds_M_eq3_h2 returns_result_select_result select_result_I2)
+        by (metis (no_types, hide_lams) "3" "7" \<open>type_wf h3\<close> children_eq2_h3 disjoint_iff_not_equal
+            get_child_nodes_ok insert_before_list_in_set known_ptrs local.known_ptrs_known_ptr
+            object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h'
+            object_ptr_kinds_M_eq3_h2 returns_result_select_result select_result_I2)
     next
       case False
       then show ?thesis
       proof (cases "ptr = y")
         case True
-        then show ?thesis 
+        then show ?thesis
           using  children_h3 children_h' child_not_in_any_children[unfolded children_eq_h2] 5 6
           apply(auto simp add:  True children_eq2_h3[OF \<open>ptr \<noteq> x\<close>])[1]
           by (metis (no_types, hide_lams) "2" "4" "7" IntI \<open>known_ptrs h3\<close> \<open>type_wf h'\<close>
-                     children_eq_h3 empty_iff insert_before_list_in_set local.get_child_nodes_ok
-                     local.known_ptrs_known_ptr object_ptr_kinds_M_eq3_h'
-                     returns_result_select_result select_result_I2)
-        next
+              children_eq_h3 empty_iff insert_before_list_in_set local.get_child_nodes_ok
+              local.known_ptrs_known_ptr object_ptr_kinds_M_eq3_h'
+              returns_result_select_result select_result_I2)
+      next
         case False
         then show ?thesis
           using children_eq2_h3[OF \<open>ptr \<noteq> x\<close>] children_eq2_h3[OF \<open>ptr \<noteq> y\<close>] 5 6 7 by auto
       qed
     qed
   next
     fix x xa xb
-    assume 1: " (\<Union>x\<in>fset (object_ptr_kinds h'). set |h3 \<turnstile> get_child_nodes x|\<^sub>r) 
+    assume 1: " (\<Union>x\<in>fset (object_ptr_kinds h'). set |h3 \<turnstile> get_child_nodes x|\<^sub>r)
                   \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r) = {} "
       and 2: "xa |\<in>| object_ptr_kinds h'"
       and 3: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
       and 4: "xb |\<in>| document_ptr_kinds h'"
       and 5: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
     have 6: "set |h3 \<turnstile> get_child_nodes xa|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r = {}"
       using 1 2 3 4 5
     proof -
       have "\<forall>h d. \<not> type_wf h \<or> d |\<notin>| document_ptr_kinds h \<or> h \<turnstile> ok get_disconnected_nodes d"
         using local.get_disconnected_nodes_ok by satx
       then have "h' \<turnstile> ok get_disconnected_nodes xb"
         using "4" \<open>type_wf h'\<close> by fastforce
       then have f1: "h3 \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
         by (simp add: disconnected_nodes_eq_h3)
       have "xa |\<in>| object_ptr_kinds h3"
-        using "2" object_ptr_kinds_M_eq3_h' by blast 
+        using "2" object_ptr_kinds_M_eq3_h' by blast
       then show ?thesis
         using f1 \<open>local.a_distinct_lists h3\<close> local.distinct_lists_no_parent by fastforce
     qed
     show False
     proof (cases "ptr = xa")
       case True
       show ?thesis
-        using 6 node_not_in_disconnected_nodes  3 4 5  select_result_I2[OF children_h'] 
-              select_result_I2[OF children_h3] True disconnected_nodes_eq2_h3
-        by (metis (no_types, lifting) "2" DocumentMonad.ptr_kinds_ptr_kinds_M 
-                  \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disconnected_nodes_eq_h3 
-                  distinct_lists_no_parent document_ptr_kinds_eq2_h3 get_disconnected_nodes_ok 
-                  insert_before_list_in_set object_ptr_kinds_M_eq3_h' returns_result_select_result)
-
-      next
+        using 6 node_not_in_disconnected_nodes  3 4 5  select_result_I2[OF children_h']
+          select_result_I2[OF children_h3] True disconnected_nodes_eq2_h3
+        by (metis (no_types, lifting) "2" DocumentMonad.ptr_kinds_ptr_kinds_M
+            \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disconnected_nodes_eq_h3
+            distinct_lists_no_parent document_ptr_kinds_eq2_h3 get_disconnected_nodes_ok
+            insert_before_list_in_set object_ptr_kinds_M_eq3_h' returns_result_select_result)
+
+    next
       case False
       then show ?thesis
-        using 1 2 3 4 5 children_eq2_h3[OF False] by fastforce 
+        using 1 2 3 4 5 children_eq2_h3[OF False] by fastforce
     qed
   qed
 
   moreover have "a_owner_document_valid h2"
     using wellformed_h2  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
     apply(auto simp add: a_owner_document_valid_def object_ptr_kinds_M_eq2_h2
-                         object_ptr_kinds_M_eq2_h3 node_ptr_kinds_eq2_h2 node_ptr_kinds_eq2_h3 
-                         document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3 children_eq2_h2)[1]
-    apply(auto simp add: document_ptr_kinds_eq2_h2[simplified]  document_ptr_kinds_eq2_h3[simplified] 
-                         object_ptr_kinds_M_eq2_h2[simplified] object_ptr_kinds_M_eq2_h3[simplified] 
-                         node_ptr_kinds_eq2_h2[simplified] node_ptr_kinds_eq2_h3[simplified])[1]
+        object_ptr_kinds_M_eq2_h3 node_ptr_kinds_eq2_h2 node_ptr_kinds_eq2_h3
+        document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3 children_eq2_h2)[1]
+    apply(auto simp add: document_ptr_kinds_eq2_h2[simplified]  document_ptr_kinds_eq2_h3[simplified]
+        object_ptr_kinds_M_eq2_h2[simplified] object_ptr_kinds_M_eq2_h3[simplified]
+        node_ptr_kinds_eq2_h2[simplified] node_ptr_kinds_eq2_h3[simplified])[1]
     apply(auto simp add: disconnected_nodes_eq2_h3[symmetric])[1]
-    by (smt children_eq2_h3 children_h' children_h3 disconnected_nodes_eq2_h2 disconnected_nodes_h2 disconnected_nodes_h3 finite_set_in in_set_remove1 insert_before_list_in_set object_ptr_kinds_M_eq3_h' ptr_in_heap select_result_I2)
+    by (smt children_eq2_h3 children_h' children_h3 disconnected_nodes_eq2_h2 disconnected_nodes_h2
+        disconnected_nodes_h3 finite_set_in in_set_remove1 insert_before_list_in_set object_ptr_kinds_M_eq3_h'
+        ptr_in_heap select_result_I2)
 
   ultimately show "heap_is_wellformed h'"
     by (simp add: heap_is_wellformed_def)
 qed
 
-lemma adopt_node_children_remain_distinct_thesis:
+lemma adopt_node_children_remain_distinct:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> adopt_node owner_document node_ptr \<rightarrow>\<^sub>h h'"
-shows "\<And>ptr' children'.
+  shows "\<And>ptr' children'.
   h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children' \<Longrightarrow> distinct children'"
-  using assms(1) assms(2) assms(3) assms(4) local.adopt_node_preserves_wellformedness local.heap_is_wellformed_children_distinct
+  using assms(1) assms(2) assms(3) assms(4) local.adopt_node_preserves_wellformedness
+    local.heap_is_wellformed_children_distinct
   by blast
 
 
-lemma insert_node_children_remain_distinct_thesis:
+lemma insert_node_children_remain_distinct:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> a_insert_node ptr new_child reference_child_opt \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "new_child \<notin> set children"
-shows "\<And>children'.
+  shows "\<And>children'.
   h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children' \<Longrightarrow> distinct children'"
 proof -
   fix children'
   assume a1: "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children'"
   have "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r (insert_before_list new_child reference_child_opt children)"
     using assms(4) assms(5) apply(auto simp add: a_insert_node_def elim!: bind_returns_heap_E)[1]
     using returns_result_eq set_child_nodes_get_child_nodes assms(2) assms(3)
-    by (metis is_OK_returns_result_I local.get_child_nodes_ptr_in_heap local.get_child_nodes_pure local.known_ptrs_known_ptr pure_returns_heap_eq)
+    by (metis is_OK_returns_result_I local.get_child_nodes_ptr_in_heap local.get_child_nodes_pure
+        local.known_ptrs_known_ptr pure_returns_heap_eq)
   moreover have "a_distinct_lists h"
     using assms local.heap_is_wellformed_def by blast
   then have "\<And>children. h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
     \<Longrightarrow> distinct children"
     using assms local.heap_is_wellformed_children_distinct by blast
   ultimately show "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children' \<Longrightarrow> distinct children'"
     using assms(5) assms(6) insert_before_list_distinct returns_result_eq by fastforce
 qed
 
-lemma insert_before_children_remain_distinct_thesis:
+lemma insert_before_children_remain_distinct:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> insert_before ptr new_child child_opt \<rightarrow>\<^sub>h h'"
-shows "\<And>ptr' children'.
+  shows "\<And>ptr' children'.
   h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children' \<Longrightarrow> distinct children'"
 proof -
   obtain reference_child owner_document h2 h3 disconnected_nodes_h2 where
     reference_child:
-       "h \<turnstile> (if Some new_child = child_opt then a_next_sibling new_child else return child_opt) \<rightarrow>\<^sub>r reference_child" and
+    "h \<turnstile> (if Some new_child = child_opt then a_next_sibling new_child else return child_opt) \<rightarrow>\<^sub>r reference_child" and
     owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
     h2: "h \<turnstile> adopt_node owner_document new_child \<rightarrow>\<^sub>h h2" and
     disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2" and
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 new_child disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> a_insert_node ptr new_child reference_child \<rightarrow>\<^sub>h h'"
     using assms(4)
-    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def 
-            elim!: bind_returns_heap_E bind_returns_result_E
-                 bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
-          split: if_splits option.splits)
+    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        split: if_splits option.splits)
 
   have "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
       \<Longrightarrow> distinct children"
-    using adopt_node_children_remain_distinct_thesis
+    using adopt_node_children_remain_distinct
     using assms(1) assms(2) assms(3) h2
     by blast
   moreover have "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
       \<Longrightarrow> new_child \<notin> set children"
     using adopt_node_removes_child
     using assms(1) assms(2) assms(3) h2
     by blast
   moreover have "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_child_nodes)
   ultimately show "\<And>ptr children. h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
       \<Longrightarrow> distinct children"
     using insert_node_children_remain_distinct
-    by (meson assms(1) assms(2) assms(3) assms(4) insert_before_heap_is_wellformed_preserved(1) local.heap_is_wellformed_children_distinct)
+    by (meson assms(1) assms(2) assms(3) assms(4) insert_before_heap_is_wellformed_preserved(1)
+        local.heap_is_wellformed_children_distinct)
 qed
 
 
-lemma insert_before_removes_child_thesis:
+lemma insert_before_removes_child:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'"
   assumes "ptr \<noteq> ptr'"
   shows "\<And>children'. h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children' \<Longrightarrow> node \<notin> set children'"
 proof -
   fix children'
   assume a1: "h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children'"
   obtain ancestors reference_child owner_document h2 h3 disconnected_nodes_h2 where
     ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
     node_not_in_ancestors: "cast node \<notin> set ancestors" and
     reference_child:
-       "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
+    "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
     owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
     h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
     disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2" and
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
     using assms(4)
-    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def 
-            elim!: bind_returns_heap_E bind_returns_result_E
-                 bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
-          split: if_splits option.splits)
+    by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        split: if_splits option.splits)
 
   have "known_ptr ptr"
-    by (meson get_owner_document_ptr_in_heap is_OK_returns_result_I assms(2) 
-              l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms owner_document)
+    by (meson get_owner_document_ptr_in_heap is_OK_returns_result_I assms(2)
+        l_known_ptrs.known_ptrs_known_ptr l_known_ptrs_axioms owner_document)
 
   have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF adopt_node_writes h2]
     using assms(3) adopt_node_types_preserved
     by(auto simp add: a_remove_child_locs_def reflp_def transp_def)
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF insert_node_writes h']
-    using set_child_nodes_types_preserved  
+    using set_child_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have object_ptr_kinds_M_eq3_h: "object_ptr_kinds h = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF adopt_node_writes h2])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF adopt_node_writes h2])
     using adopt_node_pointers_preserved
-    apply blast
+      apply blast
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs )
   then have object_ptr_kinds_M_eq2_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
 
   have "known_ptrs h2"
     using assms object_ptr_kinds_M_eq3_h known_ptrs_preserved by blast
 
   have wellformed_h2: "heap_is_wellformed h2"
     using adopt_node_preserves_wellformedness[OF assms(1) h2] assms by simp
 
   have object_ptr_kinds_M_eq3_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF set_disconnected_nodes_writes h3])  
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_disconnected_nodes_writes h3])
     unfolding a_remove_child_locs_def
-    using set_disconnected_nodes_pointers_preserved 
+    using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
-  then have object_ptr_kinds_M_eq_h2: "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+  then have object_ptr_kinds_M_eq_h2:
+    "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_M_eq2_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h2 document_ptr_kinds_M_eq by auto
 
   have "known_ptrs h3"
     using object_ptr_kinds_M_eq3_h2 known_ptrs_preserved \<open>known_ptrs h2\<close> by blast
-  
+
   have object_ptr_kinds_M_eq3_h': "object_ptr_kinds h3 = object_ptr_kinds h'"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF insert_node_writes h']) 
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF insert_node_writes h'])
     unfolding a_remove_child_locs_def
-    using set_child_nodes_pointers_preserved 
+    using set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
-  then have object_ptr_kinds_M_eq_h3: 
+  then have object_ptr_kinds_M_eq_h3:
     "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
-  then have object_ptr_kinds_M_eq2_h3: 
+  then have object_ptr_kinds_M_eq2_h3:
     "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h3 document_ptr_kinds_M_eq by auto
 
   have "known_ptrs h'"
     using object_ptr_kinds_M_eq3_h' known_ptrs_preserved \<open>known_ptrs h3\<close> by blast
 
-  have disconnected_nodes_eq_h2: 
-    "\<And>doc_ptr disc_nodes. owner_document \<noteq> doc_ptr 
-      \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. owner_document \<noteq> doc_ptr
+      \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes =
+h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-  then have disconnected_nodes_eq2_h2: 
-     "\<And>doc_ptr. doc_ptr \<noteq> owner_document 
+  then have disconnected_nodes_eq2_h2:
+    "\<And>doc_ptr. doc_ptr \<noteq> owner_document
      \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_h3: 
-   "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r remove1 node disconnected_nodes_h2"
+  have disconnected_nodes_h3:
+    "h3 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r remove1 node disconnected_nodes_h2"
     using h3 set_disconnected_nodes_get_disconnected_nodes
     by blast
 
-  have disconnected_nodes_eq_h3: 
-    "\<And>doc_ptr disc_nodes. h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h3:
+    "\<And>doc_ptr disc_nodes. h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                         = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads insert_node_writes  h'
     apply(rule reads_writes_preserved)
     using set_child_nodes_get_disconnected_nodes by fast
-  then have disconnected_nodes_eq2_h3: 
+  then have disconnected_nodes_eq2_h3:
     "\<And>doc_ptr. |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h2: 
-     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+  have children_eq_h2:
+    "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h3
     apply(rule reads_writes_preserved)
     by (auto simp add: set_disconnected_nodes_get_child_nodes)
-  then have children_eq2_h2: 
-     "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2_h2:
+    "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h3: 
-    "\<And>ptr' children. ptr \<noteq> ptr' 
+  have children_eq_h3:
+    "\<And>ptr' children. ptr \<noteq> ptr'
         \<Longrightarrow> h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads insert_node_writes h'
     apply(rule reads_writes_preserved)
     by (auto simp add: set_child_nodes_get_child_nodes_different_pointers)
-  then have children_eq2_h3: 
-     "\<And>ptr'. ptr \<noteq> ptr' \<Longrightarrow> |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
+  then have children_eq2_h3:
+    "\<And>ptr'. ptr \<noteq> ptr' \<Longrightarrow> |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   obtain children_h3 where children_h3: "h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h3"
     using h' a_insert_node_def by auto
   have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r insert_before_list node reference_child children_h3"
     using h' \<open>type_wf h3\<close> \<open>known_ptr ptr\<close>
-    by(auto simp add: a_insert_node_def elim!: bind_returns_heap_E2 
-            dest!: set_child_nodes_get_child_nodes returns_result_eq[OF children_h3])
+    by(auto simp add: a_insert_node_def elim!: bind_returns_heap_E2
+        dest!: set_child_nodes_get_child_nodes returns_result_eq[OF children_h3])
 
   have ptr_in_heap: "ptr |\<in>| object_ptr_kinds h3"
     using children_h3 get_child_nodes_ptr_in_heap by blast
   have node_in_heap: "node |\<in>| node_ptr_kinds h"
     using h2 adopt_node_child_in_heap by fast
-  have child_not_in_any_children: 
+  have child_not_in_any_children:
     "\<And>p children. h2 \<turnstile> get_child_nodes p \<rightarrow>\<^sub>r children \<Longrightarrow> node \<notin> set children"
     using assms(1) assms(2) assms(3) h2 local.adopt_node_removes_child by blast
   show "node \<notin> set children'"
     using a1 assms(5) child_not_in_any_children children_eq_h2 children_eq_h3 by blast
 qed
 
 lemma ensure_pre_insertion_validity_ok:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   assumes "\<not>is_character_data_ptr_kind parent"
   assumes "cast node \<notin> set |h \<turnstile> get_ancestors parent|\<^sub>r"
   assumes "h \<turnstile> get_parent ref \<rightarrow>\<^sub>r Some parent"
   assumes "is_document_ptr parent \<Longrightarrow> h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r []"
   assumes "is_document_ptr parent \<Longrightarrow> \<not>is_character_data_ptr_kind node"
   shows "h \<turnstile> ok (a_ensure_pre_insertion_validity node parent (Some ref))"
 proof -
   have "h \<turnstile> (if is_character_data_ptr_kind parent
         then error HierarchyRequestError else return ()) \<rightarrow>\<^sub>r ()"
     using assms
     by (simp add: assms(4))
   moreover have "h \<turnstile> do {
       ancestors \<leftarrow> get_ancestors parent;
       (if cast node \<in> set ancestors then error HierarchyRequestError else return ())
   } \<rightarrow>\<^sub>r ()"
     using assms(6)
     apply(auto intro!: bind_pure_returns_result_I)[1]
-    using assms(1) assms(2) assms(3) assms(7) local.get_ancestors_ok local.get_parent_parent_in_heap by auto
-    
+    using assms(1) assms(2) assms(3) assms(7) local.get_ancestors_ok local.get_parent_parent_in_heap
+    by auto
+
   moreover have "h \<turnstile> do {
       (case Some ref of
         Some child \<Rightarrow> do {
           child_parent \<leftarrow> get_parent child;
           (if child_parent \<noteq> Some parent then error NotFoundError else return ())}
       | None \<Rightarrow> return ())
   } \<rightarrow>\<^sub>r ()"
     using assms(7)
     by(auto split: option.splits)
   moreover have "h \<turnstile> do {
       children \<leftarrow> get_child_nodes parent;
       (if children \<noteq> [] \<and> is_document_ptr parent
         then error HierarchyRequestError else return ())
   } \<rightarrow>\<^sub>r ()"
     using assms(8)
-    by (smt assms(5) assms(7) bind_pure_returns_result_I2 calculation(1) is_OK_returns_result_I local.get_child_nodes_pure local.get_parent_child_dual returns_result_eq)
+    by (smt assms(5) assms(7) bind_pure_returns_result_I2 calculation(1) is_OK_returns_result_I
+        local.get_child_nodes_pure local.get_parent_child_dual returns_result_eq)
 
   moreover have "h \<turnstile> do {
       (if is_character_data_ptr node \<and> is_document_ptr parent
         then error HierarchyRequestError else return ())
   } \<rightarrow>\<^sub>r ()"
     using assms
     using is_character_data_ptr_kind_none by force
   ultimately show ?thesis
     unfolding a_ensure_pre_insertion_validity_def
     apply(intro bind_is_OK_pure_I)
                 apply auto[1]
                apply auto[1]
               apply auto[1]
-    using assms(1) assms(2) assms(3) assms(7) local.get_ancestors_ok local.get_parent_parent_in_heap 
+    using assms(1) assms(2) assms(3) assms(7) local.get_ancestors_ok local.get_parent_parent_in_heap
              apply blast
             apply auto[1]
            apply auto[1]
     using assms(6)
-           apply auto[1] 
-    using assms(1) assms(2) assms(3) assms(7) local.get_ancestors_ok local.get_parent_parent_in_heap 
-          apply auto[1] 
-          apply (smt bind_returns_heap_E is_OK_returns_heap_E local.get_parent_pure pure_def 
-                     pure_returns_heap_eq return_returns_heap returns_result_eq) 
+           apply auto[1]
+    using assms(1) assms(2) assms(3) assms(7) local.get_ancestors_ok local.get_parent_parent_in_heap
+          apply auto[1]
+          apply (smt bind_returns_heap_E is_OK_returns_heap_E local.get_parent_pure pure_def
+        pure_returns_heap_eq return_returns_heap returns_result_eq)
          apply(blast)
-    using local.get_child_nodes_pure 
-        apply blast 
-     apply (meson assms(7) is_OK_returns_result_I local.get_parent_child_dual)
+    using local.get_child_nodes_pure
+        apply blast
+       apply (meson assms(7) is_OK_returns_result_I local.get_parent_child_dual)
       apply (simp)
-     apply (smt assms(5) assms(8) is_OK_returns_result_I returns_result_eq) 
-    by(auto)       
+     apply (smt assms(5) assms(8) is_OK_returns_result_I returns_result_eq)
+    by(auto)
 qed
 end
 
-locale l_insert_before_wf2 = l_type_wf + l_known_ptrs + l_insert_before_defs 
-                           + l_heap_is_wellformed_defs + l_get_child_nodes_defs + l_remove_defs +
-  assumes insert_before_preserves_type_wf: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> insert_before ptr child ref \<rightarrow>\<^sub>h h' 
+locale l_insert_before_wf2 = l_type_wf + l_known_ptrs + l_insert_before_defs
+  + l_heap_is_wellformed_defs + l_get_child_nodes_defs + l_remove_defs +
+  assumes insert_before_preserves_type_wf:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> insert_before ptr child ref \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> type_wf h'"
-  assumes insert_before_preserves_known_ptrs: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> insert_before ptr child ref \<rightarrow>\<^sub>h h' 
+  assumes insert_before_preserves_known_ptrs:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> insert_before ptr child ref \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> known_ptrs h'"
   assumes insert_before_heap_is_wellformed_preserved:
     "type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> heap_is_wellformed h \<Longrightarrow> h \<turnstile> insert_before ptr child ref \<rightarrow>\<^sub>h h'
                \<Longrightarrow> heap_is_wellformed h'"
 
-interpretation i_insert_before_wf2?: l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_parent get_parent_locs 
-                                     get_child_nodes get_child_nodes_locs set_child_nodes 
-                                     set_child_nodes_locs get_ancestors get_ancestors_locs 
-                                     adopt_node adopt_node_locs set_disconnected_nodes 
-                                     set_disconnected_nodes_locs get_disconnected_nodes 
-                                     get_disconnected_nodes_locs get_owner_document insert_before 
-                                     insert_before_locs append_child type_wf known_ptr known_ptrs 
-                                     heap_is_wellformed parent_child_rel remove_child 
-                                     remove_child_locs get_root_node get_root_node_locs
+interpretation i_insert_before_wf2?: l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_parent get_parent_locs
+  get_child_nodes get_child_nodes_locs set_child_nodes
+  set_child_nodes_locs get_ancestors get_ancestors_locs
+  adopt_node adopt_node_locs set_disconnected_nodes
+  set_disconnected_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs get_owner_document insert_before
+  insert_before_locs append_child type_wf known_ptr known_ptrs
+  heap_is_wellformed parent_child_rel remove_child
+  remove_child_locs get_root_node get_root_node_locs
   by(simp add: l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
-lemma insert_before_wf2_is_l_insert_before_wf2 [instances]: 
+lemma insert_before_wf2_is_l_insert_before_wf2 [instances]:
   "l_insert_before_wf2 type_wf known_ptr known_ptrs insert_before heap_is_wellformed"
   apply(auto simp add: l_insert_before_wf2_def l_insert_before_wf2_axioms_def instances)[1]
   using insert_before_heap_is_wellformed_preserved apply(fast, fast, fast)
   done
 
 
 
 locale l_insert_before_wf3\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_child_nodes_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_child_wf2
 begin
 
 lemma next_sibling_ok:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "node_ptr |\<in>| node_ptr_kinds h"
   shows "h \<turnstile> ok (a_next_sibling node_ptr)"
 proof -
   have "known_ptr (cast node_ptr)"
     using assms(2) assms(4) local.known_ptrs_known_ptr node_ptr_kinds_commutes by blast
   then show ?thesis
-  using assms
-  apply(auto simp add: a_next_sibling_def intro!: bind_is_OK_pure_I split: option.splits list.splits)
-  using get_child_nodes_ok local.get_parent_parent_in_heap local.known_ptrs_known_ptr by blast
+    using assms
+    apply(auto simp add: a_next_sibling_def intro!: bind_is_OK_pure_I split: option.splits list.splits)[1]
+    using get_child_nodes_ok local.get_parent_parent_in_heap local.known_ptrs_known_ptr by blast
 qed
 
 lemma remove_child_ok:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "child \<in> set children"
   shows "h \<turnstile> ok (remove_child ptr child)"
 proof -
 
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4) local.get_child_nodes_ptr_in_heap by blast
   have "child |\<in>| node_ptr_kinds h"
     using assms(1) assms(4) assms(5) local.heap_is_wellformed_children_in_heap by blast
   have "\<not>is_character_data_ptr ptr"
   proof (rule ccontr, simp)
     assume "is_character_data_ptr ptr"
     then have "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r []"
       using \<open>ptr |\<in>| object_ptr_kinds h\<close>
       apply(simp add: get_child_nodes_def a_get_child_nodes_tups_def)
       apply(split invoke_splits)+
       by(auto simp add: get_child_nodes\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I split: option.splits)
     then
     show False
       using assms returns_result_eq by fastforce
-    qed
+  qed
   have "is_character_data_ptr child \<Longrightarrow> \<not>is_document_ptr_kind ptr"
   proof (rule ccontr, simp)
     assume "is_character_data_ptr\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r child"
-    and "is_document_ptr_kind ptr"
+      and "is_document_ptr_kind ptr"
     then show False
       using assms
       using \<open>ptr |\<in>| object_ptr_kinds h\<close>
       apply(simp add: get_child_nodes_def a_get_child_nodes_tups_def)
       apply(split invoke_splits)+
-         apply(auto split: option.splits)
-        apply (meson invoke_empty is_OK_returns_result_I)
-       apply (meson invoke_empty is_OK_returns_result_I)
+         apply(auto split: option.splits)[1]
+          apply (meson invoke_empty is_OK_returns_result_I)
+         apply (meson invoke_empty is_OK_returns_result_I)
       by(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 split: option.splits)
   qed
 
   obtain owner_document where
     owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
-    by (meson \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_owner_document_ok node_ptr_kinds_commutes)
+    by (meson \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
+        local.get_owner_document_ok node_ptr_kinds_commutes)
   obtain disconnected_nodes_h where
-    disconnected_nodes_h: "h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h" 
-    by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap owner_document)
+    disconnected_nodes_h: "h \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h"
+    by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_disconnected_nodes_ok
+        local.get_owner_document_owner_document_in_heap owner_document)
   obtain h2 where
     h2: "h \<turnstile> set_disconnected_nodes owner_document (child # disconnected_nodes_h) \<rightarrow>\<^sub>h h2"
-    by (meson assms(1) assms(2) assms(3) is_OK_returns_heap_E l_set_disconnected_nodes.set_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap local.l_set_disconnected_nodes_axioms owner_document)
+    by (meson assms(1) assms(2) assms(3) is_OK_returns_heap_E
+        l_set_disconnected_nodes.set_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap
+        local.l_set_disconnected_nodes_axioms owner_document)
 
   have "known_ptr ptr"
     using assms(2) assms(4) local.known_ptrs_known_ptr
-      using \<open>ptr |\<in>| object_ptr_kinds h\<close> by blast
-
-    have "type_wf h2"
+    using \<open>ptr |\<in>| object_ptr_kinds h\<close> by blast
+
+  have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h2]
     using set_disconnected_nodes_types_preserved assms(3)
     by(auto simp add: reflp_def transp_def)
 
   have "object_ptr_kinds h = object_ptr_kinds h2"
     using h2
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF set_disconnected_nodes_writes])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_disconnected_nodes_writes])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
 
   have "h2 \<turnstile> ok (set_child_nodes ptr (remove1 child children))"
   proof (cases "is_element_ptr_kind ptr")
     case True
     then show ?thesis
-      using set_child_nodes_element_ok \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> \<open>type_wf h2\<close> assms(4)
+      using set_child_nodes_element_ok \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close>
+        \<open>type_wf h2\<close> assms(4)
       using \<open>ptr |\<in>| object_ptr_kinds h\<close> by blast
   next
     case False
     then have "is_document_ptr_kind ptr"
       using \<open>known_ptr ptr\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> \<open>\<not>is_character_data_ptr ptr\<close>
-      by(auto simp add:known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+      by(auto simp add:known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
     moreover have "is_document_ptr ptr"
       using \<open>known_ptr ptr\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> False  \<open>\<not>is_character_data_ptr ptr\<close>
-      by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+      by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
     ultimately show ?thesis
       using assms(4)
-      apply(auto simp add: get_child_nodes_def a_get_child_nodes_tups_def)
+      apply(auto simp add: get_child_nodes_def a_get_child_nodes_tups_def)[1]
       apply(split invoke_splits)+
-         apply(auto elim!: bind_returns_result_E2 split: option.splits)
-      apply(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 split: option.splits)
-      using \<open>ptr |\<in>| object_ptr_kinds h\<close> \<open>is_document_ptr_kind ptr\<close> \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> \<open>type_wf h2\<close> assms(4) local.set_child_nodes_document1_ok apply blast
-      using \<open>ptr |\<in>| object_ptr_kinds h\<close> \<open>is_document_ptr_kind ptr\<close> \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> \<open>type_wf h2\<close> assms(4) local.set_child_nodes_document1_ok apply blast
-      using \<open>ptr |\<in>| object_ptr_kinds h\<close> \<open>is_document_ptr_kind ptr\<close> \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> \<open>type_wf h2\<close> assms(4) is_element_ptr_kind_cast local.set_child_nodes_document2_ok by blast
+         apply(auto elim!: bind_returns_result_E2 split: option.splits)[1]
+        apply(auto simp add: get_child_nodes\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def elim!: bind_returns_result_E2 split: option.splits)[1]
+      using assms(5) apply auto[1]
+      using \<open>is_document_ptr_kind ptr\<close> \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close>
+        \<open>ptr |\<in>| object_ptr_kinds h\<close> \<open>type_wf h2\<close> local.set_child_nodes_document1_ok apply blast
+      using \<open>is_document_ptr_kind ptr\<close> \<open>known_ptr ptr\<close> \<open>object_ptr_kinds h = object_ptr_kinds h2\<close>
+        \<open>ptr |\<in>| object_ptr_kinds h\<close> \<open>type_wf h2\<close> is_element_ptr_kind_cast local.set_child_nodes_document2_ok
+        apply blast
+      using \<open>\<not> is_character_data_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ptr\<close> apply blast
+      by (metis False is_element_ptr_implies_kind option.case_eq_if)
   qed
   then
   obtain h' where
     h': "h2 \<turnstile> set_child_nodes ptr (remove1 child children) \<rightarrow>\<^sub>h h'"
     by auto
 
   show ?thesis
     using assms
     apply(auto simp add: remove_child_def
-        simp add: is_OK_returns_heap_I[OF h2] is_OK_returns_heap_I[OF h'] is_OK_returns_result_I[OF assms(4)] is_OK_returns_result_I[OF owner_document] is_OK_returns_result_I[OF disconnected_nodes_h]
+        simp add: is_OK_returns_heap_I[OF h2] is_OK_returns_heap_I[OF h']
+        is_OK_returns_result_I[OF assms(4)] is_OK_returns_result_I[OF owner_document]
+        is_OK_returns_result_I[OF disconnected_nodes_h]
         intro!: bind_is_OK_pure_I[OF get_owner_document_pure]
         bind_is_OK_pure_I[OF get_child_nodes_pure]
         bind_is_OK_pure_I[OF get_disconnected_nodes_pure]
         bind_is_OK_I[rotated, OF h2]
-        dest!: returns_result_eq[OF assms(4)] returns_result_eq[OF owner_document] returns_result_eq[OF disconnected_nodes_h]
-)
+        dest!: returns_result_eq[OF assms(4)] returns_result_eq[OF owner_document]
+        returns_result_eq[OF disconnected_nodes_h]
+        )[1]
     using h2 returns_result_select_result by force
 qed
 
 lemma adopt_node_ok:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "document_ptr |\<in>| document_ptr_kinds h"
   assumes "child |\<in>| node_ptr_kinds h"
   shows "h \<turnstile> ok (adopt_node document_ptr child)"
 proof -
   obtain old_document where
-    old_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r old_document" 
-    by (meson assms(1) assms(2) assms(3) assms(5) is_OK_returns_result_E local.get_owner_document_ok node_ptr_kinds_commutes)
+    old_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r old_document"
+    by (meson assms(1) assms(2) assms(3) assms(5) is_OK_returns_result_E local.get_owner_document_ok
+        node_ptr_kinds_commutes)
   then have "h \<turnstile> ok (get_owner_document (cast child))"
     by auto
   obtain parent_opt where
     parent_opt: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r parent_opt"
-    by (meson assms(2) assms(3) is_OK_returns_result_I l_get_owner_document.get_owner_document_ptr_in_heap 
-              local.get_parent_ok local.l_get_owner_document_axioms node_ptr_kinds_commutes old_document 
-              returns_result_select_result)
+    by (meson assms(2) assms(3) is_OK_returns_result_I l_get_owner_document.get_owner_document_ptr_in_heap
+        local.get_parent_ok local.l_get_owner_document_axioms node_ptr_kinds_commutes old_document
+        returns_result_select_result)
   then have "h \<turnstile> ok (get_parent child)"
     by auto
 
   have "h \<turnstile> ok (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ())"
     apply(auto split: option.splits)[1]
     using remove_child_ok
     by (metis assms(1) assms(2) assms(3) local.get_parent_child_dual parent_opt)
   then
   obtain h2 where
-    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2" 
+    h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2"
     by auto
 
   have "object_ptr_kinds h = object_ptr_kinds h2"
     using h2 apply(simp split: option.splits)
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF remove_child_writes])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes])
     using remove_child_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then
   have "old_document |\<in>| document_ptr_kinds h2"
-    using assms(1) assms(2) assms(3) document_ptr_kinds_commutes local.get_owner_document_owner_document_in_heap old_document by blast
-
-  
+    using assms(1) assms(2) assms(3) document_ptr_kinds_commutes
+      local.get_owner_document_owner_document_in_heap old_document
+    by blast
+
+
   have wellformed_h2: "heap_is_wellformed h2"
     using h2 remove_child_heap_is_wellformed_preserved assms
-    by(auto split: option.splits) 
+    by(auto split: option.splits)
   have "type_wf h2"
     using h2 remove_child_preserves_type_wf assms
-    by(auto split: option.splits) 
+    by(auto split: option.splits)
   have "known_ptrs h2"
     using h2 remove_child_preserves_known_ptrs assms
-    by(auto split: option.splits) 
-
- 
+    by(auto split: option.splits)
+
+
   have "object_ptr_kinds h = object_ptr_kinds h2"
     using h2 apply(simp split: option.splits)
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF remove_child_writes])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF remove_child_writes])
     using remove_child_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have "document_ptr_kinds h = document_ptr_kinds h2"
     by(auto simp add: document_ptr_kinds_def)
 
   have "h2 \<turnstile> ok (if document_ptr \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 child old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
         set_disconnected_nodes document_ptr (child # disc_nodes)
       } else do {
         return ()
       })"
   proof(cases "document_ptr = old_document")
     case True
     then show ?thesis
       by simp
   next
     case False
     then have "h2 \<turnstile> ok (get_disconnected_nodes old_document)"
       by (simp add: \<open>old_document |\<in>| document_ptr_kinds h2\<close> \<open>type_wf h2\<close> local.get_disconnected_nodes_ok)
     then obtain old_disc_nodes where
       old_disc_nodes: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r old_disc_nodes"
       by auto
 
     have "h2 \<turnstile> ok (set_disconnected_nodes old_document (remove1 child old_disc_nodes))"
       by (simp add: \<open>old_document |\<in>| document_ptr_kinds h2\<close> \<open>type_wf h2\<close> local.set_disconnected_nodes_ok)
     then obtain h3 where
       h3: "h2 \<turnstile> set_disconnected_nodes old_document (remove1 child old_disc_nodes) \<rightarrow>\<^sub>h h3"
       by auto
 
 
     have object_ptr_kinds_h2_eq3: "object_ptr_kinds h2 = object_ptr_kinds h3"
-      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                  OF set_disconnected_nodes_writes h3])
-      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved 
+      apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+            OF set_disconnected_nodes_writes h3])
+      using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       by (auto simp add: reflp_def transp_def)
-    then have object_ptr_kinds_M_eq_h2: 
-              "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
+    then have object_ptr_kinds_M_eq_h2:
+      "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
       by(simp add: object_ptr_kinds_M_defs)
     then have object_ptr_kinds_eq_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
       by(simp)
     then have node_ptr_kinds_eq_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
       using node_ptr_kinds_M_eq by blast
     then have node_ptr_kinds_eq3_h2: "node_ptr_kinds h2 = node_ptr_kinds h3"
       by auto
     have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
       using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
     then have document_ptr_kinds_eq3_h2: "document_ptr_kinds h2 = document_ptr_kinds h3"
       using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
-    have children_eq_h2: 
+    have children_eq_h2:
       "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using get_child_nodes_reads set_disconnected_nodes_writes h3
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     then have children_eq2_h2: "\<And>ptr. |h2 \<turnstile> get_child_nodes ptr|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr|\<^sub>r"
       using select_result_eq by force
 
     have "type_wf h3"
       using \<open>type_wf h2\<close>
       using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-      using  set_disconnected_nodes_types_preserved  
+      using  set_disconnected_nodes_types_preserved
       by(auto simp add: reflp_def transp_def)
     moreover have "document_ptr |\<in>| document_ptr_kinds h3"
       using \<open>document_ptr_kinds h = document_ptr_kinds h2\<close> assms(4) document_ptr_kinds_eq3_h2 by auto
     ultimately have "h3 \<turnstile> ok (get_disconnected_nodes document_ptr)"
       by (simp add: local.get_disconnected_nodes_ok)
 
     then obtain disc_nodes where
       disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes"
       by auto
 
 
     have "h3 \<turnstile> ok (set_disconnected_nodes document_ptr (child # disc_nodes))"
       using \<open>document_ptr |\<in>| document_ptr_kinds h3\<close> \<open>type_wf h3\<close> local.set_disconnected_nodes_ok by auto
     then obtain h' where
       h': "h3 \<turnstile> set_disconnected_nodes document_ptr (child # disc_nodes) \<rightarrow>\<^sub>h h'"
       by auto
 
     then show ?thesis
       using False
       using \<open>h2 \<turnstile> ok get_disconnected_nodes old_document\<close>
       using \<open>h3 \<turnstile> ok get_disconnected_nodes document_ptr\<close>
       apply(auto dest!: returns_result_eq[OF old_disc_nodes] returns_result_eq[OF disc_nodes]
-          intro!: bind_is_OK_I[rotated, OF h3] bind_is_OK_pure_I[OF get_disconnected_nodes_pure] )
+          intro!: bind_is_OK_I[rotated, OF h3] bind_is_OK_pure_I[OF get_disconnected_nodes_pure] )[1]
       using \<open>h2 \<turnstile> ok set_disconnected_nodes old_document (remove1 child old_disc_nodes)\<close> by auto
   qed
   then obtain h' where
     h': "h2 \<turnstile> (if document_ptr \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 child old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
         set_disconnected_nodes document_ptr (child # disc_nodes)
       } else do {
         return ()
       }) \<rightarrow>\<^sub>h h'"
     by auto
 
   show ?thesis
     using \<open>h \<turnstile> ok (get_owner_document (cast child))\<close>
     using \<open>h \<turnstile> ok (get_parent child)\<close>
     using h2 h'
     apply(auto simp add: adopt_node_def
         simp add: is_OK_returns_heap_I[OF h2]
         intro!: bind_is_OK_pure_I[OF get_owner_document_pure]
         bind_is_OK_pure_I[OF get_parent_pure]
         bind_is_OK_I[rotated, OF h2]
-        dest!: returns_result_eq[OF parent_opt] returns_result_eq[OF old_document])
+        dest!: returns_result_eq[OF parent_opt] returns_result_eq[OF old_document])[1]
     using \<open>h \<turnstile> ok (case parent_opt of None \<Rightarrow> return () | Some parent \<Rightarrow> remove_child parent child)\<close>
     by auto
 qed
 
 lemma insert_node_ok:
   assumes "known_ptr parent" and "type_wf h"
   assumes "parent |\<in>| object_ptr_kinds h"
   assumes "\<not>is_character_data_ptr_kind parent"
   assumes "is_document_ptr parent \<Longrightarrow> h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r []"
   assumes "is_document_ptr parent \<Longrightarrow> \<not>is_character_data_ptr_kind node"
   assumes "known_ptr (cast node)"
   shows "h \<turnstile> ok (a_insert_node parent node ref)"
-proof(auto simp add: a_insert_node_def get_child_nodes_ok[OF assms(1) assms(2) assms(3)] intro!: bind_is_OK_pure_I)
+proof(auto simp add: a_insert_node_def get_child_nodes_ok[OF assms(1) assms(2) assms(3)]
+    intro!: bind_is_OK_pure_I)
   fix children'
   assume "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children'"
 
   show "h \<turnstile> ok set_child_nodes parent (insert_before_list node ref children')"
   proof (cases "is_element_ptr_kind parent")
     case True
-    then show ?thesis 
+    then show ?thesis
       using set_child_nodes_element_ok
       using assms(1) assms(2) assms(3) by blast
   next
     case False
     then have "is_document_ptr_kind parent"
       using assms(4) assms(1)
-      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
     then have "is_document_ptr parent"
       using assms(1)
-      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
+      by(auto simp add: known_ptr_impl DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
+          ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
     then obtain children where children: "h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children" and "children = []"
       using assms(5) by blast
 
     have "insert_before_list node ref children' = [node]"
-      by (metis \<open>children = []\<close> \<open>h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children'\<close> append.left_neutral children insert_Nil l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.insert_before_list.elims l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.insert_before_list.simps(3) neq_Nil_conv returns_result_eq)
+      by (metis \<open>children = []\<close> \<open>h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r children'\<close> append.left_neutral
+          children insert_Nil l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.insert_before_list.elims
+          l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.insert_before_list.simps(3) neq_Nil_conv returns_result_eq)
     moreover have "\<not>is_character_data_ptr_kind node"
       using \<open>is_document_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r parent\<close> assms(6) by blast
-      then have "is_element_ptr_kind node"
-      by (metis (no_types, lifting) CharacterDataClass.a_known_ptr_def DocumentClass.a_known_ptr_def ElementClass.a_known_ptr_def NodeClass.a_known_ptr_def assms(7) cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document_ptr_no_node_ptr_cast is_character_data_ptr_kind_none is_document_ptr_kind_none is_element_ptr_implies_kind is_node_ptr_kind_cast local.known_ptr_impl node_ptr_casts_commute3 option.case_eq_if)
+    then have "is_element_ptr_kind node"
+      by (metis (no_types, lifting) CharacterDataClass.a_known_ptr_def DocumentClass.a_known_ptr_def
+          ElementClass.a_known_ptr_def NodeClass.a_known_ptr_def assms(7) cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
+          document_ptr_no_node_ptr_cast is_character_data_ptr_kind_none is_document_ptr_kind_none
+          is_element_ptr_implies_kind is_node_ptr_kind_cast local.known_ptr_impl node_ptr_casts_commute3
+          option.case_eq_if)
     ultimately
     show ?thesis
       using set_child_nodes_document2_ok
-      by (metis \<open>is_document_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r parent\<close> assms(1) assms(2) assms(3) assms(5) is_document_ptr_kind_none option.case_eq_if)
+      by (metis \<open>is_document_ptr\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r parent\<close> assms(1) assms(2) assms(3) assms(5)
+          is_document_ptr_kind_none option.case_eq_if)
   qed
 qed
 
 lemma insert_before_ok:
   assumes "heap_is_wellformed h" and "known_ptrs h" and "type_wf h"
   assumes "parent |\<in>| object_ptr_kinds h"
   assumes "node |\<in>| node_ptr_kinds h"
   assumes "\<not>is_character_data_ptr_kind parent"
   assumes "cast node \<notin> set |h \<turnstile> get_ancestors parent|\<^sub>r"
   assumes "h \<turnstile> get_parent ref \<rightarrow>\<^sub>r Some parent"
   assumes "is_document_ptr parent \<Longrightarrow> h \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r []"
   assumes "is_document_ptr parent \<Longrightarrow> \<not>is_character_data_ptr_kind node"
   shows "h \<turnstile> ok (insert_before parent node (Some ref))"
 proof -
   have "h \<turnstile> ok (a_ensure_pre_insertion_validity node parent (Some ref))"
     using assms ensure_pre_insertion_validity_ok by blast
   have "h \<turnstile> ok (if Some node = Some ref
-        then a_next_sibling node                                         
+        then a_next_sibling node
         else return (Some ref))" (is "h \<turnstile> ok ?P")
     apply(auto split: if_splits)[1]
     using assms(1) assms(2) assms(3) assms(5) next_sibling_ok by blast
 
   then obtain reference_child where
     reference_child: "h \<turnstile> ?P \<rightarrow>\<^sub>r reference_child"
     by auto
 
   obtain owner_document where
     owner_document: "h \<turnstile> get_owner_document parent \<rightarrow>\<^sub>r owner_document"
     using assms get_owner_document_ok
     by (meson returns_result_select_result)
   then have "h \<turnstile> ok (get_owner_document parent)"
     by auto
   have "owner_document |\<in>| document_ptr_kinds h"
-    using assms(1) assms(2) assms(3) local.get_owner_document_owner_document_in_heap owner_document by blast
-
-  obtain h2 where 
+    using assms(1) assms(2) assms(3) local.get_owner_document_owner_document_in_heap owner_document
+    by blast
+
+  obtain h2 where
     h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2"
-    by (meson assms(1) assms(2) assms(3) assms(5) is_OK_returns_heap_E adopt_node_ok l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms 
-              local.get_owner_document_owner_document_in_heap owner_document)
+    by (meson assms(1) assms(2) assms(3) assms(5) is_OK_returns_heap_E adopt_node_ok
+        l_insert_before_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
+        local.get_owner_document_owner_document_in_heap owner_document)
   then have "h \<turnstile> ok (adopt_node owner_document node)"
     by auto
   have "object_ptr_kinds h = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF adopt_node_writes h2])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF adopt_node_writes h2])
     using adopt_node_pointers_preserved
-    apply blast
+      apply blast
     by (auto simp add: reflp_def transp_def)
   then have "document_ptr_kinds h = document_ptr_kinds h2"
     by(auto simp add: document_ptr_kinds_def)
   have "heap_is_wellformed h2"
     using h2 adopt_node_preserves_wellformedness assms by blast
   have "known_ptrs h2"
     using h2 adopt_node_preserves_known_ptrs assms by blast
   have "type_wf h2"
     using h2 adopt_node_preserves_type_wf assms by blast
 
   obtain disconnected_nodes_h2 where
     disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2"
-    by (metis \<open>document_ptr_kinds h = document_ptr_kinds h2\<close> \<open>type_wf h2\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap owner_document)
-  
+    by (metis \<open>document_ptr_kinds h = document_ptr_kinds h2\<close> \<open>type_wf h2\<close> assms(1) assms(2) assms(3)
+        is_OK_returns_result_E local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap
+        owner_document)
+
   obtain h3 where
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3"
-    by (metis \<open>document_ptr_kinds h = document_ptr_kinds h2\<close> \<open>owner_document |\<in>| document_ptr_kinds h\<close> \<open>type_wf h2\<close> document_ptr_kinds_def is_OK_returns_heap_E l_set_disconnected_nodes.set_disconnected_nodes_ok local.l_set_disconnected_nodes_axioms)
+    by (metis \<open>document_ptr_kinds h = document_ptr_kinds h2\<close> \<open>owner_document |\<in>| document_ptr_kinds h\<close>
+        \<open>type_wf h2\<close> document_ptr_kinds_def is_OK_returns_heap_E
+        l_set_disconnected_nodes.set_disconnected_nodes_ok local.l_set_disconnected_nodes_axioms)
 
   have "type_wf h3"
     using \<open>type_wf h2\<close>
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have object_ptr_kinds_M_eq3_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'", 
-                                OF set_disconnected_nodes_writes h3])  
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
+          OF set_disconnected_nodes_writes h3])
     unfolding a_remove_child_locs_def
-    using set_disconnected_nodes_pointers_preserved 
+    using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
 
   have "parent |\<in>| object_ptr_kinds h3"
     using \<open>object_ptr_kinds h = object_ptr_kinds h2\<close> assms(4) object_ptr_kinds_M_eq3_h2 by blast
   moreover have "known_ptr parent"
     using assms(2) assms(4) local.known_ptrs_known_ptr by blast
   moreover have "known_ptr (cast node)"
     using assms(2) assms(5) local.known_ptrs_known_ptr node_ptr_kinds_commutes by blast
   moreover have "is_document_ptr parent \<Longrightarrow> h3 \<turnstile> get_child_nodes parent \<rightarrow>\<^sub>r []"
-    by (metis assms(8) assms(9) distinct.simps(2) distinct_singleton local.get_parent_child_dual returns_result_eq)
+    by (metis assms(8) assms(9) distinct.simps(2) distinct_singleton local.get_parent_child_dual
+        returns_result_eq)
   ultimately obtain h' where
     h': "h3 \<turnstile> a_insert_node parent node reference_child \<rightarrow>\<^sub>h h'"
     using insert_node_ok \<open>type_wf h3\<close> assms by blast
 
   show ?thesis
     using \<open>h \<turnstile> ok (a_ensure_pre_insertion_validity node parent (Some ref))\<close>
-    using reference_child \<open>h \<turnstile> ok (get_owner_document parent)\<close> \<open>h \<turnstile> ok (adopt_node owner_document node)\<close> h3 h'
+    using reference_child \<open>h \<turnstile> ok (get_owner_document parent)\<close> \<open>h \<turnstile> ok (adopt_node owner_document node)\<close>
+      h3 h'
     apply(auto simp add: insert_before_def
-        simp add: is_OK_returns_result_I[OF disconnected_nodes_h2] 
+        simp add: is_OK_returns_result_I[OF disconnected_nodes_h2]
         simp add: is_OK_returns_heap_I[OF h3] is_OK_returns_heap_I[OF h']
         intro!: bind_is_OK_I2
         bind_is_OK_pure_I[OF ensure_pre_insertion_validity_pure]
         bind_is_OK_pure_I[OF next_sibling_pure]
         bind_is_OK_pure_I[OF get_owner_document_pure]
         bind_is_OK_pure_I[OF get_disconnected_nodes_pure]
-        dest!: returns_result_eq[OF owner_document] returns_result_eq[OF disconnected_nodes_h2] returns_heap_eq[OF h2] returns_heap_eq[OF h3] 
+        dest!: returns_result_eq[OF owner_document] returns_result_eq[OF disconnected_nodes_h2]
+        returns_heap_eq[OF h2] returns_heap_eq[OF h3]
         dest!: sym[of node ref]
-        )
+        )[1]
     using returns_result_eq by fastforce
 qed
 end
 
 interpretation i_insert_before_wf3?: l_insert_before_wf3\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    get_parent get_parent_locs get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs get_ancestors get_ancestors_locs adopt_node adopt_node_locs set_disconnected_nodes set_disconnected_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_owner_document insert_before insert_before_locs append_child type_wf known_ptr known_ptrs heap_is_wellformed parent_child_rel remove_child remove_child_locs get_root_node get_root_node_locs remove
+  get_parent get_parent_locs get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs
+  get_ancestors get_ancestors_locs adopt_node adopt_node_locs set_disconnected_nodes
+  set_disconnected_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_owner_document
+  insert_before insert_before_locs append_child type_wf known_ptr known_ptrs heap_is_wellformed
+  parent_child_rel remove_child remove_child_locs get_root_node get_root_node_locs remove
   by(auto simp add: l_insert_before_wf3\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_insert_before_wf3\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 locale l_append_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_insert_before_wf +
   l_insert_before_wf2  +
   l_get_child_nodes
 begin
 
 
 lemma append_child_heap_is_wellformed_preserved:
   assumes wellformed: "heap_is_wellformed h"
     and append_child: "h \<turnstile> append_child ptr node \<rightarrow>\<^sub>h h'"
     and known_ptrs: "known_ptrs h"
     and type_wf: "type_wf h"
   shows "heap_is_wellformed h'" and "type_wf h'" and "known_ptrs h'"
   using assms
-  by(auto simp add: append_child_def intro: insert_before_preserves_type_wf insert_before_preserves_known_ptrs insert_before_heap_is_wellformed_preserved)
+  by(auto simp add: append_child_def intro: insert_before_preserves_type_wf
+      insert_before_preserves_known_ptrs insert_before_heap_is_wellformed_preserved)
 
 lemma append_child_children:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs"
   assumes "h \<turnstile> append_child ptr node \<rightarrow>\<^sub>h h'"
   assumes "node \<notin> set xs"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs @ [node]"
 proof -
 
   obtain ancestors owner_document h2 h3 disconnected_nodes_h2 where
     ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
     node_not_in_ancestors: "cast node \<notin> set ancestors" and
     owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
     h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
     disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2" and
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> a_insert_node ptr node None \<rightarrow>\<^sub>h h'"
     using assms(5)
-    by(auto simp add: append_child_def insert_before_def a_ensure_pre_insertion_validity_def 
-            elim!: bind_returns_heap_E bind_returns_result_E
-         bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
-                 bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
-          split: if_splits option.splits)
+    by(auto simp add: append_child_def insert_before_def a_ensure_pre_insertion_validity_def
+        elim!: bind_returns_heap_E bind_returns_result_E
+        bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
+        bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
+        bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
+        split: if_splits option.splits)
 
   have "\<And>parent. |h \<turnstile> get_parent node|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr"
     using assms(1) assms(4) assms(6)
-    by (metis (no_types, lifting) assms(2) assms(3) h2 is_OK_returns_heap_I is_OK_returns_result_E 
-              local.adopt_node_child_in_heap local.get_parent_child_dual local.get_parent_ok 
-              select_result_I2)
+    by (metis (no_types, lifting) assms(2) assms(3) h2 is_OK_returns_heap_I is_OK_returns_result_E
+        local.adopt_node_child_in_heap local.get_parent_child_dual local.get_parent_ok
+        select_result_I2)
   have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs"
     using get_child_nodes_reads adopt_node_writes h2 assms(4)
     apply(rule reads_writes_separate_forwards)
     using \<open>\<And>parent. |h \<turnstile> get_parent node|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>
     apply(auto simp add: adopt_node_locs_def remove_child_locs_def)[1]
     by (meson local.set_child_nodes_get_child_nodes_different_pointers)
 
   have "h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs"
     using get_child_nodes_reads set_disconnected_nodes_writes h3 \<open>h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs\<close>
     apply(rule reads_writes_separate_forwards)
     by(auto)
 
   have "ptr |\<in>| object_ptr_kinds h"
     by (meson ancestors is_OK_returns_result_I local.get_ancestors_ptr_in_heap)
   then
   have "known_ptr ptr"
     using assms(3)
     using local.known_ptrs_known_ptr by blast
 
   have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF adopt_node_writes h2]
     using adopt_node_types_preserved  \<open>type_wf h\<close>
     by(auto simp add: adopt_node_locs_def remove_child_locs_def reflp_def transp_def split: if_splits)
   then
   have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   show "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs@[node]"
-    using h'  
-    apply(auto simp add: a_insert_node_def 
-               dest!: bind_returns_heap_E3[rotated, OF \<open>h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs\<close> 
-                      get_child_nodes_pure, rotated])[1]
+    using h'
+    apply(auto simp add: a_insert_node_def
+        dest!: bind_returns_heap_E3[rotated, OF \<open>h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs\<close>
+          get_child_nodes_pure, rotated])[1]
     using \<open>type_wf h3\<close> set_child_nodes_get_child_nodes \<open>known_ptr ptr\<close>
     by metis
 qed
 
 lemma append_child_for_all_on_children:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs"
   assumes "h \<turnstile> forall_M (append_child ptr) nodes \<rightarrow>\<^sub>h h'"
   assumes "set nodes \<inter> set xs = {}"
   assumes "distinct nodes"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs@nodes"
   using assms
   apply(induct nodes arbitrary: h xs)
-  apply(simp)
+   apply(simp)
 proof(auto elim!: bind_returns_heap_E)[1]fix a nodes h xs h'a
-  assume 0: "(\<And>h xs. heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h 
-              \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs \<Longrightarrow> h \<turnstile> forall_M (append_child ptr) nodes \<rightarrow>\<^sub>h h' 
+  assume 0: "(\<And>h xs. heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h
+              \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs \<Longrightarrow> h \<turnstile> forall_M (append_child ptr) nodes \<rightarrow>\<^sub>h h'
               \<Longrightarrow> set nodes \<inter> set xs = {} \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs @ nodes)"
     and 1: "heap_is_wellformed h"
     and 2: "type_wf h"
     and 3: "known_ptrs h"
     and 4: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs"
     and 5: "h \<turnstile> append_child ptr a \<rightarrow>\<^sub>r ()"
     and 6: "h \<turnstile> append_child ptr a \<rightarrow>\<^sub>h h'a"
     and 7: "h'a \<turnstile> forall_M (append_child ptr) nodes \<rightarrow>\<^sub>h h'"
     and 8: "a \<notin> set xs"
     and 9: "set nodes \<inter> set xs = {}"
     and 10: "a \<notin> set nodes"
     and 11: "distinct nodes"
   then have "h'a \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs @ [a]"
     using append_child_children 6
     using "1" "2" "3" "4" "8" by blast
 
   moreover have "heap_is_wellformed h'a" and "type_wf h'a" and "known_ptrs h'a"
-    using insert_before_heap_is_wellformed_preserved insert_before_preserves_known_ptrs 
-          insert_before_preserves_type_wf 1 2 3 6 append_child_def
+    using insert_before_heap_is_wellformed_preserved insert_before_preserves_known_ptrs
+      insert_before_preserves_type_wf 1 2 3 6 append_child_def
     by metis+
   moreover have "set nodes \<inter> set (xs @ [a]) = {}"
     using 9 10
     by auto
   ultimately show "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r xs @ a # nodes"
     using 0 7
     by fastforce
 qed
 
 
 lemma append_child_for_all_on_no_children:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r []"
   assumes "h \<turnstile> forall_M (append_child ptr) nodes \<rightarrow>\<^sub>h h'"
   assumes "distinct nodes"
   shows "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r nodes"
   using assms append_child_for_all_on_children
   by force
 end
 
 locale l_append_child_wf = l_type_wf + l_known_ptrs + l_append_child_defs + l_heap_is_wellformed_defs +
-  assumes append_child_preserves_type_wf: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h' 
+  assumes append_child_preserves_type_wf:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> type_wf h'"
-  assumes append_child_preserves_known_ptrs: 
-    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h' 
+  assumes append_child_preserves_known_ptrs:
+    "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'
                           \<Longrightarrow> known_ptrs h'"
   assumes append_child_heap_is_wellformed_preserved:
     "type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> heap_is_wellformed h \<Longrightarrow> h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'
                \<Longrightarrow> heap_is_wellformed h'"
 
-interpretation i_append_child_wf?: l_append_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent 
-                                   get_parent_locs remove_child remove_child_locs 
-                                   get_disconnected_nodes get_disconnected_nodes_locs 
-                                   set_disconnected_nodes set_disconnected_nodes_locs 
-                                   adopt_node adopt_node_locs known_ptr type_wf get_child_nodes 
-                                   get_child_nodes_locs known_ptrs set_child_nodes 
-                                   set_child_nodes_locs remove get_ancestors get_ancestors_locs 
-                                   insert_before insert_before_locs append_child heap_is_wellformed
-                                   parent_child_rel
+interpretation i_append_child_wf?: l_append_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_owner_document get_parent
+  get_parent_locs remove_child remove_child_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs
+  adopt_node adopt_node_locs known_ptr type_wf get_child_nodes
+  get_child_nodes_locs known_ptrs set_child_nodes
+  set_child_nodes_locs remove get_ancestors get_ancestors_locs
+  insert_before insert_before_locs append_child heap_is_wellformed
+  parent_child_rel
   by(auto simp add: l_append_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 
-lemma append_child_wf_is_l_append_child_wf [instances]: "l_append_child_wf type_wf known_ptr known_ptrs append_child heap_is_wellformed"
+lemma append_child_wf_is_l_append_child_wf [instances]: "l_append_child_wf type_wf known_ptr
+known_ptrs append_child heap_is_wellformed"
   apply(auto simp add: l_append_child_wf_def l_append_child_wf_axioms_def instances)[1]
   using append_child_heap_is_wellformed_preserved by fast+
 
 
 subsection \<open>create\_element\<close>
 
 locale l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
-  l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes get_child_nodes_locs 
-                             get_disconnected_nodes get_disconnected_nodes_locs 
-                             heap_is_wellformed parent_child_rel +
+  l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes get_child_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
+  heap_is_wellformed parent_child_rel +
   l_new_element_get_disconnected_nodes get_disconnected_nodes get_disconnected_nodes_locs +
-  l_set_tag_type_get_disconnected_nodes type_wf set_tag_type set_tag_type_locs 
-                             get_disconnected_nodes get_disconnected_nodes_locs +
-  l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes 
-                        set_disconnected_nodes_locs set_tag_type set_tag_type_locs type_wf create_element known_ptr +
+  l_set_tag_name_get_disconnected_nodes type_wf set_tag_name set_tag_name_locs
+  get_disconnected_nodes get_disconnected_nodes_locs +
+  l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs set_tag_name set_tag_name_locs type_wf create_element known_ptr +
   l_new_element_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs +
-  l_set_tag_type_get_child_nodes type_wf set_tag_type set_tag_type_locs known_ptr 
-                          get_child_nodes get_child_nodes_locs +
-  l_set_disconnected_nodes_get_child_nodes set_disconnected_nodes set_disconnected_nodes_locs 
-                          get_child_nodes get_child_nodes_locs +
+  l_set_tag_name_get_child_nodes type_wf set_tag_name set_tag_name_locs known_ptr
+  get_child_nodes get_child_nodes_locs +
+  l_set_disconnected_nodes_get_child_nodes set_disconnected_nodes set_disconnected_nodes_locs
+  get_child_nodes get_child_nodes_locs +
   l_set_disconnected_nodes type_wf set_disconnected_nodes set_disconnected_nodes_locs +
-  l_set_disconnected_nodes_get_disconnected_nodes  type_wf get_disconnected_nodes 
-                   get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs +
+  l_set_disconnected_nodes_get_disconnected_nodes  type_wf get_disconnected_nodes
+  get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs +
   l_new_element type_wf +
   l_known_ptrs known_ptr known_ptrs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and known_ptrs :: "(_) heap \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and set_tag_type :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_tag_type_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and create_element :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr) prog"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and set_tag_name :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and create_element :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr) prog"
 begin
 lemma create_element_preserves_wellformedness:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
     and "type_wf h"
     and "known_ptrs h"
   shows "heap_is_wellformed h'" and "type_wf h'" and "known_ptrs h'"
 proof -
   obtain new_element_ptr h2 h3 disc_nodes_h3 where
     new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
     h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
-    h3: "h2 \<turnstile> set_tag_type new_element_ptr tag \<rightarrow>\<^sub>h h3" and
+    h3: "h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
-    using assms(2) 
+    using assms(2)
     by(auto simp add: create_element_def
-            elim!: bind_returns_heap_E 
-                   bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
   then have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
     apply(auto simp add: create_element_def intro!: bind_returns_result_I)[1]
-    apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
-    apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure pure_returns_heap_eq)
+      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+     apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
+        pure_returns_heap_eq)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
 
   have "new_element_ptr \<notin> set |h \<turnstile> element_ptr_kinds_M|\<^sub>r"
     using new_element_ptr ElementMonad.ptr_kinds_ptr_kinds_M h2
-    using new_element_ptr_not_in_heap by blast  
+    using new_element_ptr_not_in_heap by blast
   then have "cast new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
     by simp
   then have "cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
   have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     using new_element_new_ptr h2 new_element_ptr by blast
   then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
     apply(simp add: element_ptr_kinds_def)
     by force
   have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_tag_type_writes h3])
-    using set_tag_type_pointers_preserved
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_tag_name_writes h3])
+    using set_tag_name_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
-    using object_ptr_kinds_eq_h2 
+    using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", 
-                                OF set_disconnected_nodes_writes h'])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
   have "known_ptr (cast new_element_ptr)"
-    using \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> local.create_element_known_ptr by blast
+    using \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> local.create_element_known_ptr
+    by blast
   then
   have "known_ptrs h2"
     using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
     by blast
   then
   have "known_ptrs h3"
     using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
   then
   show "known_ptrs h'"
     using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
-    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2 
-          get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
-  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_element_ptr 
+  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_element_ptr
               \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_element[rotated, OF new_element_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
-  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_element_ptr 
+  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_element_ptr
                                     \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
-    using new_element_ptr h2 new_element_ptr_in_heap[OF h2 new_element_ptr] 
-          new_element_is_element_ptr[OF new_element_ptr] new_element_no_child_nodes
+    using new_element_ptr h2 new_element_ptr_in_heap[OF h2 new_element_ptr]
+      new_element_is_element_ptr[OF new_element_ptr] new_element_no_child_nodes
     by blast
-  have disconnected_nodes_eq_h: 
-    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                              = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads h2 get_disconnected_nodes_new_element[OF new_element_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
-  then have disconnected_nodes_eq2_h: 
+  then have disconnected_nodes_eq2_h:
     "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h2: 
+  have children_eq_h2:
     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
-    using get_child_nodes_reads set_tag_type_writes h3
+    using get_child_nodes_reads set_tag_name_writes h3
     apply(rule reads_writes_preserved)
-    by(auto simp add: set_tag_type_get_child_nodes)
+    by(auto simp add: set_tag_name_get_child_nodes)
   then have children_eq2_h2: "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq_h2: 
-    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                                = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
-    using get_disconnected_nodes_reads set_tag_type_writes h3
+    using get_disconnected_nodes_reads set_tag_name_writes h3
     apply(rule reads_writes_preserved)
-    by(auto simp add: set_tag_type_get_disconnected_nodes)
-  then have disconnected_nodes_eq2_h2: 
+    by(auto simp add: set_tag_name_get_disconnected_nodes)
+  then have disconnected_nodes_eq2_h2:
     "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "type_wf h2"
     using \<open>type_wf h\<close> new_element_types_preserved h2 by blast
   then have "type_wf h3"
-    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_tag_type_writes h3]
-    using  set_tag_type_types_preserved  
+    using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_tag_name_writes h3]
+    using  set_tag_name_types_preserved
     by(auto simp add: reflp_def transp_def)
   then show "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
-  have children_eq_h3: 
+  have children_eq_h3:
     "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_child_nodes)
   then have children_eq2_h3: "\<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq_h3: 
-    "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr 
-       \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h3:
+    "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+       \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                                = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-  then have disconnected_nodes_eq2_h3: 
-    "\<And>doc_ptr. document_ptr \<noteq> doc_ptr 
+  then have disconnected_nodes_eq2_h3:
+    "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
                 \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
-  
+
   have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
   then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h by auto
   then have "cast new_element_ptr \<notin> set disc_nodes_h3"
-    using \<open>heap_is_wellformed h\<close> 
-    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> 
-          a_all_ptrs_in_heap_def heap_is_wellformed_def
+    using \<open>heap_is_wellformed h\<close>
+    using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      a_all_ptrs_in_heap_def heap_is_wellformed_def
     using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
 
   have "acyclic (parent_child_rel h)"
-    using \<open>heap_is_wellformed h\<close> 
+    using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def acyclic_heap_def)
   also have "parent_child_rel h = parent_child_rel h2"
   proof(auto simp add: parent_child_rel_def)[1]
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h2"
       by (simp add: object_ptr_kinds_eq_h)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
-      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M 
-             \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h2"
-        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h"
       using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
       by(auto)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h2"
       and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
-      by (metis (no_types, lifting) 
-                               \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> 
-                               children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+      by (metis (no_types, lifting)
+          \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
+          children_eq2_h empty_iff empty_set image_eqI select_result_I2)
   qed
   also have "\<dots> = parent_child_rel h3"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
   also have "\<dots> = parent_child_rel h'"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
   finally have "a_acyclic_heap h'"
     by (simp add: acyclic_heap_def)
 
   have "a_all_ptrs_in_heap h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_all_ptrs_in_heap h2"
     apply(auto simp add: a_all_ptrs_in_heap_def)[1]
-    apply (metis \<open>known_ptrs h2\<close> \<open>parent_child_rel h = parent_child_rel h2\<close> \<open>type_wf h2\<close> assms(1) assms(3) funion_iff local.get_child_nodes_ok local.known_ptrs_known_ptr local.parent_child_rel_child_in_heap local.parent_child_rel_child_nodes2 node_ptr_kinds_commutes node_ptr_kinds_eq_h returns_result_select_result)
-    by (metis assms(1) assms(3) disconnected_nodes_eq2_h document_ptr_kinds_eq_h funion_iff local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq_h returns_result_select_result)
+     apply (metis \<open>known_ptrs h2\<close> \<open>parent_child_rel h = parent_child_rel h2\<close> \<open>type_wf h2\<close> assms(1)
+        assms(3) funion_iff local.get_child_nodes_ok local.known_ptrs_known_ptr
+        local.parent_child_rel_child_in_heap local.parent_child_rel_child_nodes2 node_ptr_kinds_commutes
+        node_ptr_kinds_eq_h returns_result_select_result)
+    by (metis assms(1) assms(3) disconnected_nodes_eq2_h document_ptr_kinds_eq_h funion_iff
+        local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq_h
+        returns_result_select_result)
   then have "a_all_ptrs_in_heap h3"
-  by (simp add: children_eq2_h2 disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2 local.a_all_ptrs_in_heap_def node_ptr_kinds_eq_h2 object_ptr_kinds_eq_h2)
+    by (simp add: children_eq2_h2 disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
+        local.a_all_ptrs_in_heap_def node_ptr_kinds_eq_h2 object_ptr_kinds_eq_h2)
   then have "a_all_ptrs_in_heap h'"
-    by (smt \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> children_eq2_h3 disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h3 finite_set_in h' is_OK_returns_result_I l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes local.a_all_ptrs_in_heap_def local.get_child_nodes_ptr_in_heap local.l_set_disconnected_nodes_get_disconnected_nodes_axioms node_ptr_kinds_commutes object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 select_result_I2 set_ConsD subset_code(1))
+    by (smt \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> children_eq2_h3
+        disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h3
+        finite_set_in h' is_OK_returns_result_I set_disconnected_nodes_get_disconnected_nodes
+        local.a_all_ptrs_in_heap_def local.get_child_nodes_ptr_in_heap node_ptr_kinds_commutes
+        object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 select_result_I2 set_ConsD subset_code(1))
 
   have "\<And>p. p |\<in>| object_ptr_kinds h \<Longrightarrow> cast new_element_ptr \<notin> set |h \<turnstile> get_child_nodes p|\<^sub>r"
-    using \<open>heap_is_wellformed h\<close> \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> 
-          heap_is_wellformed_children_in_heap
-    by (meson NodeMonad.ptr_kinds_ptr_kinds_M a_all_ptrs_in_heap_def assms(3) assms(4) fset_mp 
-              fset_of_list_elem get_child_nodes_ok known_ptrs_known_ptr returns_result_select_result) 
+    using \<open>heap_is_wellformed h\<close> \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      heap_is_wellformed_children_in_heap
+    by (meson NodeMonad.ptr_kinds_ptr_kinds_M a_all_ptrs_in_heap_def assms(3) assms(4) fset_mp
+        fset_of_list_elem get_child_nodes_ok known_ptrs_known_ptr returns_result_select_result)
   then have "\<And>p. p |\<in>| object_ptr_kinds h2 \<Longrightarrow> cast new_element_ptr \<notin> set |h2 \<turnstile> get_child_nodes p|\<^sub>r"
     using children_eq2_h
     apply(auto simp add: object_ptr_kinds_eq_h)[1]
     using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> apply auto[1]
-    by (metis ObjectMonad.ptr_kinds_ptr_kinds_M 
-              \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>)
+    by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>)
   then have "\<And>p. p |\<in>| object_ptr_kinds h3 \<Longrightarrow> cast new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r"
     using object_ptr_kinds_eq_h2 children_eq2_h2 by auto
-  then have new_element_ptr_not_in_any_children: 
+  then have new_element_ptr_not_in_any_children:
     "\<And>p. p |\<in>| object_ptr_kinds h' \<Longrightarrow> cast new_element_ptr \<notin> set |h' \<turnstile> get_child_nodes p|\<^sub>r"
     using object_ptr_kinds_eq_h3 children_eq2_h3 by auto
 
   have "a_distinct_lists h"
-    using \<open>heap_is_wellformed h\<close> 
+    using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def)
   then have "a_distinct_lists h2"
 
     using \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
-    apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h document_ptr_kinds_eq_h  
+    apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h document_ptr_kinds_eq_h
         disconnected_nodes_eq2_h intro!: distinct_concat_map_I)[1]
        apply (metis distinct_sorted_list_of_set finite_fset sorted_list_of_set_insert)
       apply(case_tac "x=cast new_element_ptr")
        apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
       apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
      apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
-     apply (metis IntI assms(1) assms(3) assms(4) empty_iff local.get_child_nodes_ok 
+     apply (metis IntI assms(1) assms(3) assms(4) empty_iff local.get_child_nodes_ok
         local.heap_is_wellformed_one_parent local.known_ptrs_known_ptr returns_result_select_result)
     apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
-    by (metis \<open>local.a_distinct_lists h\<close> \<open>type_wf h2\<close> disconnected_nodes_eq_h document_ptr_kinds_eq_h 
+    by (metis \<open>local.a_distinct_lists h\<close> \<open>type_wf h2\<close> disconnected_nodes_eq_h document_ptr_kinds_eq_h
         local.distinct_lists_no_parent local.get_disconnected_nodes_ok returns_result_select_result)
-    
+
   then have "a_distinct_lists h3"
-    by(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2 
-                      children_eq2_h2 object_ptr_kinds_eq_h2)
+    by(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
+        children_eq2_h2 object_ptr_kinds_eq_h2)
   then have "a_distinct_lists h'"
-  proof(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h3 children_eq2_h3 
-                       object_ptr_kinds_eq_h3 document_ptr_kinds_eq_h3 
-             intro!: distinct_concat_map_I)[1]
+  proof(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h3 children_eq2_h3
+      object_ptr_kinds_eq_h3 document_ptr_kinds_eq_h3
+      intro!: distinct_concat_map_I)[1]
     fix x
-    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                               (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and "x |\<in>| document_ptr_kinds h3"
     then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
       using document_ptr_kinds_eq_h3 disconnected_nodes_eq_h3 h' set_disconnected_nodes_get_disconnected_nodes
-      by (metis (no_types, lifting) \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set disc_nodes_h3\<close> 
-                \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disc_nodes_h3 distinct.simps(2) 
-                distinct_lists_disconnected_nodes get_disconnected_nodes_ok returns_result_eq 
-                returns_result_select_result)
+      by (metis (no_types, lifting) \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set disc_nodes_h3\<close>
+          \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disc_nodes_h3 distinct.simps(2)
+          distinct_lists_disconnected_nodes get_disconnected_nodes_ok returns_result_eq
+          returns_result_select_result)
   next
     fix x y xa
-    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                             (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and "x |\<in>| document_ptr_kinds h3"
       and "y |\<in>| document_ptr_kinds h3"
       and "x \<noteq> y"
       and "xa \<in> set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
       and "xa \<in> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r"
     moreover have "set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h3 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
       using calculation by(auto dest: distinct_concat_map_E(1))
     ultimately show "False"
       apply(-)
       apply(cases "x = document_ptr")
-      apply (smt NodeMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> \<open>local.a_all_ptrs_in_heap h\<close> 
-                 disc_nodes_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 
-                 disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h' 
-                 l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes 
-                 local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms 
-                 select_result_I2 set_ConsD subsetD)
-      by (smt NodeMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> \<open>local.a_all_ptrs_in_heap h\<close> 
-              disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
-              disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h' 
-              l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes 
-              local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms 
-              select_result_I2 set_ConsD subsetD)
+       apply (smt NodeMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+          \<open>local.a_all_ptrs_in_heap h\<close>
+          disc_nodes_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
+          disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
+          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
+          select_result_I2 set_ConsD subsetD)
+      by (smt NodeMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+          \<open>local.a_all_ptrs_in_heap h\<close>
+          disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
+          disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
+          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
+          select_result_I2 set_ConsD subsetD)
   next
     fix x xa xb
-    assume 2: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h' \<turnstile> get_child_nodes x|\<^sub>r) 
+    assume 2: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h3). set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       and 3: "xa |\<in>| object_ptr_kinds h3"
       and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
       and 5: "xb |\<in>| document_ptr_kinds h3"
       and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
-     show "False"
+    show "False"
       using disc_nodes_document_ptr_h disconnected_nodes_eq2_h3
       apply -
       apply(cases "xb = document_ptr")
-       apply (metis (no_types, hide_lams) "3" "4" "6" 
-                     \<open>\<And>p. p |\<in>| object_ptr_kinds h3 
-                      \<Longrightarrow> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r\<close> 
-                    \<open>a_distinct_lists h3\<close> children_eq2_h3 disc_nodes_h3 distinct_lists_no_parent h' 
-                    select_result_I2 set_ConsD set_disconnected_nodes_get_disconnected_nodes)
-      by (metis "3" "4" "5" "6" \<open>a_distinct_lists h3\<close> \<open>type_wf h3\<close> children_eq2_h3 
-                distinct_lists_no_parent get_disconnected_nodes_ok returns_result_select_result)
+       apply (metis (no_types, hide_lams) "3" "4" "6"
+          \<open>\<And>p. p |\<in>| object_ptr_kinds h3
+                      \<Longrightarrow> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r\<close>
+          \<open>a_distinct_lists h3\<close> children_eq2_h3 disc_nodes_h3 distinct_lists_no_parent h'
+          select_result_I2 set_ConsD set_disconnected_nodes_get_disconnected_nodes)
+      by (metis "3" "4" "5" "6" \<open>a_distinct_lists h3\<close> \<open>type_wf h3\<close> children_eq2_h3
+          distinct_lists_no_parent get_disconnected_nodes_ok returns_result_select_result)
   qed
 
   have "a_owner_document_valid h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
     using disc_nodes_h3 \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
     apply(auto simp add: a_owner_document_valid_def)[1]
     apply(auto simp add:  object_ptr_kinds_eq_h object_ptr_kinds_eq_h3 )[1]
     apply(auto simp add: object_ptr_kinds_eq_h2)[1]
     apply(auto simp add:  document_ptr_kinds_eq_h document_ptr_kinds_eq_h3 )[1]
     apply(auto simp add: document_ptr_kinds_eq_h2)[1]
     apply(auto simp add:  node_ptr_kinds_eq_h node_ptr_kinds_eq_h3 )[1]
     apply(auto simp add: node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h )[1]
-     apply(auto simp add: children_eq2_h2[symmetric] children_eq2_h3[symmetric] 
-        disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 
+     apply(auto simp add: children_eq2_h2[symmetric] children_eq2_h3[symmetric]
+        disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
         disconnected_nodes_eq2_h3)[1]
-     apply (metis (no_types, lifting) document_ptr_kinds_eq_h h' list.set_intros(1) 
-        local.set_disconnected_nodes_get_disconnected_nodes select_result_I2) 
+     apply (metis (no_types, lifting) document_ptr_kinds_eq_h h' list.set_intros(1)
+        local.set_disconnected_nodes_get_disconnected_nodes select_result_I2)
     apply(simp add: object_ptr_kinds_eq_h)
-    by(metis (no_types, lifting) NodeMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> children_eq2_h children_eq2_h2 children_eq2_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h finite_set_in h' l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes list.set_intros(2) local.l_set_disconnected_nodes_get_disconnected_nodes_axioms node_ptr_kinds_commutes select_result_I2)
+    by (smt ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h
+        children_eq2_h2 children_eq2_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
+        disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h finite_set_in h' list.set_intros(2)
+        local.set_disconnected_nodes_get_disconnected_nodes select_result_I2)
 
   show "heap_is_wellformed h'"
     using \<open>a_acyclic_heap h'\<close> \<open>a_all_ptrs_in_heap h'\<close> \<open>a_distinct_lists h'\<close> \<open>a_owner_document_valid h'\<close>
     by(simp add: heap_is_wellformed_def)
 qed
 end
 
-interpretation i_create_element_wf?: l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr known_ptrs type_wf 
-                                     get_child_nodes get_child_nodes_locs get_disconnected_nodes 
-                                     get_disconnected_nodes_locs heap_is_wellformed parent_child_rel 
-                                     set_tag_type set_tag_type_locs
-     set_disconnected_nodes set_disconnected_nodes_locs create_element
+interpretation i_create_element_wf?: l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr known_ptrs type_wf
+  get_child_nodes get_child_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
+  set_tag_name set_tag_name_locs
+  set_disconnected_nodes set_disconnected_nodes_locs create_element
   using instances
   by(auto simp add: l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>create\_character\_data\<close>
 
 locale l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr type_wf get_child_nodes get_child_nodes_locs get_disconnected_nodes 
-    get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
+  known_ptr type_wf get_child_nodes get_child_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
   + l_new_character_data_get_disconnected_nodes
-    get_disconnected_nodes get_disconnected_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
   + l_set_val_get_disconnected_nodes
-    type_wf set_val set_val_locs get_disconnected_nodes get_disconnected_nodes_locs
+  type_wf set_val set_val_locs get_disconnected_nodes get_disconnected_nodes_locs
   + l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
-    set_disconnected_nodes_locs set_val set_val_locs type_wf create_character_data known_ptr
+  get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs set_val set_val_locs type_wf create_character_data known_ptr
   + l_new_character_data_get_child_nodes
-    type_wf known_ptr get_child_nodes get_child_nodes_locs
+  type_wf known_ptr get_child_nodes get_child_nodes_locs
   + l_set_val_get_child_nodes
-    type_wf set_val set_val_locs known_ptr get_child_nodes get_child_nodes_locs
+  type_wf set_val set_val_locs known_ptr get_child_nodes get_child_nodes_locs
   + l_set_disconnected_nodes_get_child_nodes
-    set_disconnected_nodes set_disconnected_nodes_locs get_child_nodes get_child_nodes_locs
+  set_disconnected_nodes set_disconnected_nodes_locs get_child_nodes get_child_nodes_locs
   + l_set_disconnected_nodes
-    type_wf set_disconnected_nodes set_disconnected_nodes_locs
+  type_wf set_disconnected_nodes set_disconnected_nodes_locs
   + l_set_disconnected_nodes_get_disconnected_nodes
-    type_wf get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes 
-    set_disconnected_nodes_locs
+  type_wf get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
+  set_disconnected_nodes_locs
   + l_new_character_data
-    type_wf
+  type_wf
   + l_known_ptrs
-    known_ptr known_ptrs
+  known_ptr known_ptrs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and set_disconnected_nodes :: 
-      "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and create_character_data :: 
-      "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) character_data_ptr) prog"
-  and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and set_disconnected_nodes ::
+    "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and create_character_data ::
+    "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) character_data_ptr) prog"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
 begin
 
 lemma create_character_data_preserves_wellformedness:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
     and "type_wf h"
     and "known_ptrs h"
   shows "heap_is_wellformed h'" and "type_wf h'" and "known_ptrs h'"
 proof -
   obtain new_character_data_ptr h2 h3 disc_nodes_h3 where
     new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
     h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
-    using assms(2) 
-    by(auto simp add: create_character_data_def 
-            elim!: bind_returns_heap_E 
-                   bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
+    using assms(2)
+    by(auto simp add: create_character_data_def
+        elim!: bind_returns_heap_E
+        bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
   then
   have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
-    apply(auto simp add: create_character_data_def intro!: bind_returns_result_I)
-    apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
-    apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure pure_returns_heap_eq)
+    apply(auto simp add: create_character_data_def intro!: bind_returns_result_I)[1]
+      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
+     apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
+        pure_returns_heap_eq)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
 
 
   have "new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r"
     using new_character_data_ptr CharacterDataMonad.ptr_kinds_ptr_kinds_M h2
-    using new_character_data_ptr_not_in_heap by blast  
+    using new_character_data_ptr_not_in_heap by blast
   then have "cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
     by simp
   then have "cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
 
 
-  have object_ptr_kinds_eq_h: 
+  have object_ptr_kinds_eq_h:
     "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using new_character_data_new_ptr h2 new_character_data_ptr by blast
-  then have node_ptr_kinds_eq_h: 
+  then have node_ptr_kinds_eq_h:
     "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
-  then have character_data_ptr_kinds_eq_h: 
-    "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
-    apply(simp add: character_data_ptr_kinds_def)
-    by force
-  have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
-    using object_ptr_kinds_eq_h
-    by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
-  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
-    using object_ptr_kinds_eq_h
-    by(auto simp add: document_ptr_kinds_def)
-
-  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", 
-                                OF set_val_writes h3])
-    using set_val_pointers_preserved
-    by (auto simp add: reflp_def transp_def)
-  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
-    by (auto simp add: document_ptr_kinds_def)
-  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
-    using object_ptr_kinds_eq_h2 
-    by(auto simp add: node_ptr_kinds_def)
-
-  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", 
-                                OF set_disconnected_nodes_writes h'])
-    using set_disconnected_nodes_pointers_preserved
-    by (auto simp add: reflp_def transp_def)
-  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
-    by (auto simp add: document_ptr_kinds_def)
-  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
-    using object_ptr_kinds_eq_h3
-    by(auto simp add: node_ptr_kinds_def)
-
-
-  have "document_ptr |\<in>| document_ptr_kinds h"
-    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2 
-          get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
-    by (metis is_OK_returns_result_I)
-
-  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr 
-                  \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
-    using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
-    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
-    by blast+
-  then have children_eq2_h: 
-    "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr 
-      \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
-    using select_result_eq by force
-  have object_ptr_kinds_eq_h: 
-    "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
-    using new_character_data_new_ptr h2 new_character_data_ptr by blast
-  then have node_ptr_kinds_eq_h: 
-    "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
-    apply(simp add: node_ptr_kinds_def)
-    by force
-  then have character_data_ptr_kinds_eq_h: 
+  then have character_data_ptr_kinds_eq_h:
     "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
     apply(simp add: character_data_ptr_kinds_def)
     by force
   have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", 
-                               OF set_val_writes h3])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
     using set_val_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
-    using object_ptr_kinds_eq_h2 
+    using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
-    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", 
-                                OF set_disconnected_nodes_writes h'])
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
-    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2 
-          get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
-  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr 
+  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr
+                  \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
+    using get_child_nodes_reads h2
+      get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by blast+
+  then have children_eq2_h:
+    "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
+      \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
+    using select_result_eq by force
+  have object_ptr_kinds_eq_h:
+    "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    using new_character_data_new_ptr h2 new_character_data_ptr by blast
+  then have node_ptr_kinds_eq_h:
+    "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
+    apply(simp add: node_ptr_kinds_def)
+    by force
+  then have character_data_ptr_kinds_eq_h:
+    "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
+    apply(simp add: character_data_ptr_kinds_def)
+    by force
+  have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
+  have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
+    using object_ptr_kinds_eq_h
+    by(auto simp add: document_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_val_writes h3])
+    using set_val_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
+    using object_ptr_kinds_eq_h2
+    by(auto simp add: node_ptr_kinds_def)
+
+  have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
+    apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
+          OF set_disconnected_nodes_writes h'])
+    using set_disconnected_nodes_pointers_preserved
+    by (auto simp add: reflp_def transp_def)
+  then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
+    by (auto simp add: document_ptr_kinds_def)
+  have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
+    using object_ptr_kinds_eq_h3
+    by(auto simp add: node_ptr_kinds_def)
+
+
+  have "document_ptr |\<in>| document_ptr_kinds h"
+    using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
+      get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
+    by (metis is_OK_returns_result_I)
+
+  have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr
                 \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
-  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr 
+  then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
                                  \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
-    using new_character_data_ptr h2 new_character_data_ptr_in_heap[OF h2 new_character_data_ptr] 
-          new_character_data_is_character_data_ptr[OF new_character_data_ptr] 
-          new_character_data_no_child_nodes
+    using new_character_data_ptr h2 new_character_data_ptr_in_heap[OF h2 new_character_data_ptr]
+      new_character_data_is_character_data_ptr[OF new_character_data_ptr]
+      new_character_data_no_child_nodes
     by blast
-  have disconnected_nodes_eq_h: 
-    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                              = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
-    using get_disconnected_nodes_reads h2 
-          get_disconnected_nodes_new_character_data[OF new_character_data_ptr h2]
+    using get_disconnected_nodes_reads h2
+      get_disconnected_nodes_new_character_data[OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
-  then have disconnected_nodes_eq2_h: 
+  then have disconnected_nodes_eq2_h:
     "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
-  have children_eq_h2: 
+  have children_eq_h2:
     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_val_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_val_get_child_nodes)
-  then have children_eq2_h2: 
+  then have children_eq2_h2:
     "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq_h2: 
-    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h2:
+    "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                               = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_val_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_val_get_disconnected_nodes)
-  then have disconnected_nodes_eq2_h2: 
+  then have disconnected_nodes_eq2_h2:
     "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "type_wf h2"
     using \<open>type_wf h\<close> new_character_data_types_preserved h2 by blast
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_val_writes h3]
-    using  set_val_types_preserved  
+    using  set_val_types_preserved
     by(auto simp add: reflp_def transp_def)
   then show "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
-    using  set_disconnected_nodes_types_preserved  
+    using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
-  have children_eq_h3: 
+  have children_eq_h3:
     "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_child_nodes)
-  then have children_eq2_h3: 
+  then have children_eq2_h3:
     " \<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
-  have disconnected_nodes_eq_h3: "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr 
-    \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes 
+  have disconnected_nodes_eq_h3: "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
+    \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                             = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
-  then have disconnected_nodes_eq2_h3: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr 
+  then have disconnected_nodes_eq2_h3: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
              \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
-  
+
   have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
   then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h by auto
   then have "cast new_character_data_ptr \<notin> set disc_nodes_h3"
     using \<open>heap_is_wellformed h\<close> using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
-           a_all_ptrs_in_heap_def heap_is_wellformed_def
+      a_all_ptrs_in_heap_def heap_is_wellformed_def
     using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
 
   have "acyclic (parent_child_rel h)"
-    using \<open>heap_is_wellformed h\<close> 
+    using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def acyclic_heap_def)
   also have "parent_child_rel h = parent_child_rel h2"
   proof(auto simp add: parent_child_rel_def)[1]
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h2"
       by (simp add: object_ptr_kinds_eq_h)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
-      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M 
-                \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
+      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h2"
-        and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
+      and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h"
       using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
       by(auto)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h2"
       and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
-      by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close> 
-                children_eq2_h empty_iff empty_set image_eqI select_result_I2)
+      by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+          children_eq2_h empty_iff empty_set image_eqI select_result_I2)
   qed
   also have "\<dots> = parent_child_rel h3"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
   also have "\<dots> = parent_child_rel h'"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
   finally have "a_acyclic_heap h'"
     by (simp add: acyclic_heap_def)
 
   have "a_all_ptrs_in_heap h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_all_ptrs_in_heap h2"
     apply(auto simp add: a_all_ptrs_in_heap_def)[1]
-    using node_ptr_kinds_eq_h \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> 
-          \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
-     apply (metis (no_types, lifting) NodeMonad.ptr_kinds_ptr_kinds_M \<open>parent_child_rel h = parent_child_rel h2\<close> 
-                  children_eq2_h finite_set_in finsert_iff funion_finsert_right local.parent_child_rel_child 
-                  local.parent_child_rel_parent_in_heap node_ptr_kinds_commutes object_ptr_kinds_eq_h 
-                  select_result_I2 subsetD sup_bot.right_neutral)
-    by (metis assms(1) assms(3) disconnected_nodes_eq2_h document_ptr_kinds_eq_h funionI1 
-                   local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap 
-                   node_ptr_kinds_eq_h returns_result_select_result)
+    using node_ptr_kinds_eq_h \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+      \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
+     apply (metis (no_types, lifting) NodeMonad.ptr_kinds_ptr_kinds_M \<open>parent_child_rel h = parent_child_rel h2\<close>
+        children_eq2_h finite_set_in finsert_iff funion_finsert_right local.parent_child_rel_child
+        local.parent_child_rel_parent_in_heap node_ptr_kinds_commutes object_ptr_kinds_eq_h
+        select_result_I2 subsetD sup_bot.right_neutral)
+    by (metis assms(1) assms(3) disconnected_nodes_eq2_h document_ptr_kinds_eq_h funionI1
+        local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap
+        node_ptr_kinds_eq_h returns_result_select_result)
   then have "a_all_ptrs_in_heap h3"
-    by (simp add: children_eq2_h2 disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2 
-                  local.a_all_ptrs_in_heap_def node_ptr_kinds_eq_h2 object_ptr_kinds_eq_h2)
+    by (simp add: children_eq2_h2 disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
+        local.a_all_ptrs_in_heap_def node_ptr_kinds_eq_h2 object_ptr_kinds_eq_h2)
   then have "a_all_ptrs_in_heap h'"
-    by (smt   character_data_ptr_kinds_commutes children_eq2_h3 disc_nodes_document_ptr_h2 
-              disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h3 
-              finite_set_in h' h2 local.a_all_ptrs_in_heap_def 
-              local.set_disconnected_nodes_get_disconnected_nodes new_character_data_ptr 
-              new_character_data_ptr_in_heap node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h3 
-              object_ptr_kinds_eq_h3 select_result_I2 set_ConsD subset_code(1))
+    by (smt   character_data_ptr_kinds_commutes children_eq2_h3 disc_nodes_document_ptr_h2
+        disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h3
+        finite_set_in h' h2 local.a_all_ptrs_in_heap_def
+        local.set_disconnected_nodes_get_disconnected_nodes new_character_data_ptr
+        new_character_data_ptr_in_heap node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h3
+        object_ptr_kinds_eq_h3 select_result_I2 set_ConsD subset_code(1))
   have "\<And>p. p |\<in>| object_ptr_kinds h \<Longrightarrow> cast new_character_data_ptr \<notin> set |h \<turnstile> get_child_nodes p|\<^sub>r"
     using \<open>heap_is_wellformed h\<close> \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
-          heap_is_wellformed_children_in_heap
-    by (meson NodeMonad.ptr_kinds_ptr_kinds_M a_all_ptrs_in_heap_def assms(3) assms(4) fset_mp 
-      fset_of_list_elem get_child_nodes_ok known_ptrs_known_ptr returns_result_select_result) 
+      heap_is_wellformed_children_in_heap
+    by (meson NodeMonad.ptr_kinds_ptr_kinds_M a_all_ptrs_in_heap_def assms(3) assms(4) fset_mp
+        fset_of_list_elem get_child_nodes_ok known_ptrs_known_ptr returns_result_select_result)
   then have "\<And>p. p |\<in>| object_ptr_kinds h2 \<Longrightarrow> cast new_character_data_ptr \<notin> set |h2 \<turnstile> get_child_nodes p|\<^sub>r"
     using children_eq2_h
     apply(auto simp add: object_ptr_kinds_eq_h)[1]
     using \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close> apply auto[1]
     by (metis ObjectMonad.ptr_kinds_ptr_kinds_M \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>)
   then have "\<And>p. p |\<in>| object_ptr_kinds h3 \<Longrightarrow> cast new_character_data_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r"
     using object_ptr_kinds_eq_h2 children_eq2_h2 by auto
-  then have new_character_data_ptr_not_in_any_children: 
+  then have new_character_data_ptr_not_in_any_children:
     "\<And>p. p |\<in>| object_ptr_kinds h' \<Longrightarrow> cast new_character_data_ptr \<notin> set |h' \<turnstile> get_child_nodes p|\<^sub>r"
     using object_ptr_kinds_eq_h3 children_eq2_h3 by auto
 
   have "a_distinct_lists h"
-    using \<open>heap_is_wellformed h\<close> 
+    using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def)
   then have "a_distinct_lists h2"
     using \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
-    apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h document_ptr_kinds_eq_h  
+    apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h document_ptr_kinds_eq_h
         disconnected_nodes_eq2_h intro!: distinct_concat_map_I)[1]
        apply (metis distinct_sorted_list_of_set finite_fset sorted_list_of_set_insert)
       apply(case_tac "x=cast new_character_data_ptr")
        apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
       apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
      apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
-     apply (metis IntI assms(1) assms(3) assms(4) empty_iff local.get_child_nodes_ok 
-        local.heap_is_wellformed_one_parent local.known_ptrs_known_ptr 
+     apply (metis IntI assms(1) assms(3) assms(4) empty_iff local.get_child_nodes_ok
+        local.heap_is_wellformed_one_parent local.known_ptrs_known_ptr
         returns_result_select_result)
     apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
-    by (metis \<open>local.a_distinct_lists h\<close> \<open>type_wf h2\<close> disconnected_nodes_eq_h document_ptr_kinds_eq_h 
+    by (metis \<open>local.a_distinct_lists h\<close> \<open>type_wf h2\<close> disconnected_nodes_eq_h document_ptr_kinds_eq_h
         local.distinct_lists_no_parent local.get_disconnected_nodes_ok returns_result_select_result)
   then have "a_distinct_lists h3"
-    by(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2 
-                      children_eq2_h2 object_ptr_kinds_eq_h2)[1]
+    by(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
+        children_eq2_h2 object_ptr_kinds_eq_h2)[1]
   then have "a_distinct_lists h'"
-  proof(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h3 children_eq2_h3 
-                       object_ptr_kinds_eq_h3 document_ptr_kinds_eq_h3 intro!: distinct_concat_map_I)[1]
+  proof(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h3 children_eq2_h3
+      object_ptr_kinds_eq_h3 document_ptr_kinds_eq_h3 intro!: distinct_concat_map_I)[1]
     fix x
-    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+    assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                       (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and "x |\<in>| document_ptr_kinds h3"
     then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
       using document_ptr_kinds_eq_h3 disconnected_nodes_eq_h3 h' set_disconnected_nodes_get_disconnected_nodes
-      by (metis (no_types, lifting) \<open>cast new_character_data_ptr \<notin> set disc_nodes_h3\<close> 
-                \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disc_nodes_h3 distinct.simps(2) 
-                distinct_lists_disconnected_nodes get_disconnected_nodes_ok returns_result_eq 
-                returns_result_select_result)
+      by (metis (no_types, lifting) \<open>cast new_character_data_ptr \<notin> set disc_nodes_h3\<close>
+          \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disc_nodes_h3 distinct.simps(2)
+          distinct_lists_disconnected_nodes get_disconnected_nodes_ok returns_result_eq
+          returns_result_select_result)
   next
     fix x y xa
     assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                             (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and "x |\<in>| document_ptr_kinds h3"
       and "y |\<in>| document_ptr_kinds h3"
       and "x \<noteq> y"
       and "xa \<in> set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
       and "xa \<in> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r"
     moreover have "set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h3 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
       using calculation by(auto dest: distinct_concat_map_E(1))
     ultimately show "False"
-      by (smt NodeMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> 
-              \<open>local.a_all_ptrs_in_heap h\<close> disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h 
-              disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 disjoint_iff_not_equal 
-              document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h' 
-              l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes 
-              local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms 
-              select_result_I2 set_ConsD subsetD)
+      by (smt NodeMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
+          \<open>local.a_all_ptrs_in_heap h\<close> disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h
+          disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 disjoint_iff_not_equal
+          document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
+          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
+          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
+          select_result_I2 set_ConsD subsetD)
   next
     fix x xa xb
-    assume 2: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h' \<turnstile> get_child_nodes x|\<^sub>r) 
+    assume 2: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                   \<inter> (\<Union>x\<in>fset (document_ptr_kinds h3). set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       and 3: "xa |\<in>| object_ptr_kinds h3"
       and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
       and 5: "xb |\<in>| document_ptr_kinds h3"
       and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
     show "False"
       using disc_nodes_document_ptr_h disconnected_nodes_eq2_h3
       apply(cases "xb = document_ptr")
        apply (metis (no_types, hide_lams) "3" "4" "6"
-                    \<open>\<And>p. p |\<in>| object_ptr_kinds h3 \<Longrightarrow> cast new_character_data_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r\<close> 
-                    \<open>a_distinct_lists h3\<close> children_eq2_h3 disc_nodes_h3 distinct_lists_no_parent h'
-                    select_result_I2 set_ConsD set_disconnected_nodes_get_disconnected_nodes)
-      by (metis "3" "4" "5" "6" \<open>a_distinct_lists h3\<close> \<open>type_wf h3\<close> children_eq2_h3 
-                distinct_lists_no_parent get_disconnected_nodes_ok returns_result_select_result)
+          \<open>\<And>p. p |\<in>| object_ptr_kinds h3 \<Longrightarrow> cast new_character_data_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r\<close>
+          \<open>a_distinct_lists h3\<close> children_eq2_h3 disc_nodes_h3 distinct_lists_no_parent h'
+          select_result_I2 set_ConsD set_disconnected_nodes_get_disconnected_nodes)
+      by (metis "3" "4" "5" "6" \<open>a_distinct_lists h3\<close> \<open>type_wf h3\<close> children_eq2_h3
+          distinct_lists_no_parent get_disconnected_nodes_ok returns_result_select_result)
   qed
 
   have "a_owner_document_valid h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
     using disc_nodes_h3 \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
     apply(simp add: a_owner_document_valid_def)
     apply(simp add: object_ptr_kinds_eq_h object_ptr_kinds_eq_h3 )
     apply(simp add: object_ptr_kinds_eq_h2)
     apply(simp add: document_ptr_kinds_eq_h document_ptr_kinds_eq_h3 )
     apply(simp add: document_ptr_kinds_eq_h2)
     apply(simp add: node_ptr_kinds_eq_h node_ptr_kinds_eq_h3 )
     apply(simp add: node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h )
-    apply(auto simp add: children_eq2_h2[symmetric] children_eq2_h3[symmetric] disconnected_nodes_eq2_h 
-                         disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3)[1]
-     apply (metis (no_types, lifting) document_ptr_kinds_eq_h h' list.set_intros(1) 
-                          local.set_disconnected_nodes_get_disconnected_nodes select_result_I2) 
+    apply(auto simp add: children_eq2_h2[symmetric] children_eq2_h3[symmetric] disconnected_nodes_eq2_h
+        disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3)[1]
+     apply (metis (no_types, lifting) document_ptr_kinds_eq_h h' list.set_intros(1)
+        local.set_disconnected_nodes_get_disconnected_nodes select_result_I2)
     apply(simp add: object_ptr_kinds_eq_h)
-    by (metis (mono_tags, lifting) \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> 
-              children_eq2_h disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h finite_set_in h' 
-              l_ptr_kinds_M.ptr_kinds_ptr_kinds_M 
-              l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes 
-              list.set_intros(2) local.l_set_disconnected_nodes_get_disconnected_nodes_axioms object_ptr_kinds_M_def 
-              select_result_I2)
+    by (smt ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h
+        disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h finite_set_in h' list.set_intros(2)
+        local.set_disconnected_nodes_get_disconnected_nodes select_result_I2)
 
   have "known_ptr (cast new_character_data_ptr)"
-    using \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> local.create_character_data_known_ptr by blast
+    using \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
+      local.create_character_data_known_ptr by blast
   then
   have "known_ptrs h2"
     using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
     by blast
   then
   have "known_ptrs h3"
     using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
   then
   show "known_ptrs h'"
     using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
 
   show "heap_is_wellformed h'"
     using \<open>a_acyclic_heap h'\<close> \<open>a_all_ptrs_in_heap h'\<close> \<open>a_distinct_lists h'\<close> \<open>a_owner_document_valid h'\<close>
     by(simp add: heap_is_wellformed_def)
 qed
 end
 
-interpretation i_create_character_data_wf?: l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf 
-     get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs 
-      heap_is_wellformed parent_child_rel set_val set_val_locs set_disconnected_nodes
-     set_disconnected_nodes_locs create_character_data known_ptrs
+interpretation i_create_character_data_wf?: l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf
+  get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
+  heap_is_wellformed parent_child_rel set_val set_val_locs set_disconnected_nodes
+  set_disconnected_nodes_locs create_character_data known_ptrs
   using instances
   by (auto simp add: l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>create\_document\<close>
 
 locale l_create_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    known_ptr type_wf get_child_nodes get_child_nodes_locs get_disconnected_nodes 
-    get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
+  known_ptr type_wf get_child_nodes get_child_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
   + l_new_document_get_disconnected_nodes
-    get_disconnected_nodes get_disconnected_nodes_locs
+  get_disconnected_nodes get_disconnected_nodes_locs
   + l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
-    create_document
+  create_document
   + l_new_document_get_child_nodes
-    type_wf known_ptr get_child_nodes get_child_nodes_locs
- + l_new_document
-    type_wf
+  type_wf known_ptr get_child_nodes get_child_nodes_locs
+  + l_new_document
+  type_wf
   + l_known_ptrs
-    known_ptr known_ptrs
+  known_ptr known_ptrs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
-  and type_wf :: "(_) heap \<Rightarrow> bool"
-  and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
-  and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
-  and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
-  and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
-  and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
-  and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
-  and create_document :: "((_) heap, exception, (_) document_ptr) prog"
-  and known_ptrs :: "(_) heap \<Rightarrow> bool"
+    and type_wf :: "(_) heap \<Rightarrow> bool"
+    and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
+    and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
+    and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
+    and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
+    and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
+    and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
+    and create_document :: "((_) heap, exception, (_) document_ptr) prog"
+    and known_ptrs :: "(_) heap \<Rightarrow> bool"
 begin
 
 lemma create_document_preserves_wellformedness:
   assumes "heap_is_wellformed h"
     and "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
     and "type_wf h"
     and "known_ptrs h"
   shows "heap_is_wellformed h'"
 proof -
   obtain new_document_ptr where
     new_document_ptr: "h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr" and
     h': "h \<turnstile> new_document \<rightarrow>\<^sub>h h'"
-    using assms(2) 
+    using assms(2)
     apply(simp add: create_document_def)
     using new_document_ok by blast
 
   have "new_document_ptr \<notin> set |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using new_document_ptr DocumentMonad.ptr_kinds_ptr_kinds_M
     using new_document_ptr_not_in_heap h' by blast
   then have "cast new_document_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
   have "new_document_ptr |\<notin>| document_ptr_kinds h"
     using new_document_ptr DocumentMonad.ptr_kinds_ptr_kinds_M
     using new_document_ptr_not_in_heap h' by blast
   then have "cast new_document_ptr |\<notin>| object_ptr_kinds h"
     by simp
 
   have object_ptr_kinds_eq: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_document_ptr|}"
     using new_document_new_ptr h' new_document_ptr by blast
   then have node_ptr_kinds_eq: "node_ptr_kinds h' = node_ptr_kinds h"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h' = character_data_ptr_kinds h"
     by(simp add: character_data_ptr_kinds_def)
   have element_ptr_kinds_eq_h: "element_ptr_kinds h' = element_ptr_kinds h"
     using object_ptr_kinds_eq
     by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h' = document_ptr_kinds h |\<union>| {|new_document_ptr|}"
     using object_ptr_kinds_eq
     apply(auto simp add: document_ptr_kinds_def)[1]
     by (metis (no_types, lifting) document_ptr_kinds_commutes document_ptr_kinds_def finsertI1 fset.map_comp)
 
 
-  have children_eq: 
-     "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_document_ptr 
+  have children_eq:
+    "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_document_ptr
              \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h' get_child_nodes_new_document[rotated, OF new_document_ptr h']
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
-  then have children_eq2: "\<And>ptr'. ptr' \<noteq> cast new_document_ptr 
+  then have children_eq2: "\<And>ptr'. ptr' \<noteq> cast new_document_ptr
                                     \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
 
   have "h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []"
-    using new_document_ptr h' new_document_ptr_in_heap[OF h' new_document_ptr] 
-                   new_document_is_document_ptr[OF new_document_ptr] new_document_no_child_nodes
+    using new_document_ptr h' new_document_ptr_in_heap[OF h' new_document_ptr]
+      new_document_is_document_ptr[OF new_document_ptr] new_document_no_child_nodes
     by blast
-  have disconnected_nodes_eq_h: 
-    "\<And>doc_ptr disc_nodes. doc_ptr \<noteq> new_document_ptr 
+  have disconnected_nodes_eq_h:
+    "\<And>doc_ptr disc_nodes. doc_ptr \<noteq> new_document_ptr
     \<Longrightarrow> h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads h' get_disconnected_nodes_new_document_different_pointers new_document_ptr
-    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1] 
-    by (metis(full_types) \<open>\<And>thesis. (\<And>new_document_ptr. 
-             \<lbrakk>h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr; h \<turnstile> new_document \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> 
-             local.get_disconnected_nodes_new_document_different_pointers new_document_ptr)+
-  then have disconnected_nodes_eq2_h: "\<And>doc_ptr. doc_ptr \<noteq> new_document_ptr 
+    apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
+    by (metis(full_types) \<open>\<And>thesis. (\<And>new_document_ptr.
+             \<lbrakk>h \<turnstile> new_document \<rightarrow>\<^sub>r new_document_ptr; h \<turnstile> new_document \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
+        local.get_disconnected_nodes_new_document_different_pointers new_document_ptr)+
+  then have disconnected_nodes_eq2_h: "\<And>doc_ptr. doc_ptr \<noteq> new_document_ptr
                  \<Longrightarrow> |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
   have "h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []"
     using h' local.new_document_no_disconnected_nodes new_document_ptr by blast
 
   have "type_wf h'"
     using \<open>type_wf h\<close> new_document_types_preserved h' by blast
 
   have "acyclic (parent_child_rel h)"
-    using \<open>heap_is_wellformed h\<close> 
+    using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def acyclic_heap_def)
   also have "parent_child_rel h = parent_child_rel h'"
   proof(auto simp add: parent_child_rel_def)[1]
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h'"
       by (simp add: object_ptr_kinds_eq)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h' \<turnstile> get_child_nodes a|\<^sub>r"
-      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M 
-                \<open>cast new_document_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2)
+      by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
+          \<open>cast new_document_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h'"
-        and 1: "x \<in> set |h' \<turnstile> get_child_nodes a|\<^sub>r"
+      and 1: "x \<in> set |h' \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h"
       using object_ptr_kinds_eq \<open>h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []\<close>
       by(auto)
-  next                
+  next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h'"
       and 1: "x \<in> set |h' \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
-      by (metis (no_types, lifting) \<open>h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []\<close> 
-                                        children_eq2 empty_iff empty_set image_eqI select_result_I2)
+      by (metis (no_types, lifting) \<open>h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []\<close>
+          children_eq2 empty_iff empty_set image_eqI select_result_I2)
   qed
   finally have "a_acyclic_heap h'"
     by (simp add: acyclic_heap_def)
 
   have "a_all_ptrs_in_heap h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
-  then have "a_all_ptrs_in_heap h'" 
+  then have "a_all_ptrs_in_heap h'"
     apply(auto simp add: a_all_ptrs_in_heap_def)[1]
-    using ObjectMonad.ptr_kinds_ptr_kinds_M 
-          \<open>cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> 
-          \<open>parent_child_rel h = parent_child_rel h'\<close> assms(1) children_eq fset_of_list_elem 
-          local.heap_is_wellformed_children_in_heap local.parent_child_rel_child 
-          local.parent_child_rel_parent_in_heap node_ptr_kinds_eq
-     apply (metis (no_types, lifting) \<open>h' \<turnstile> get_child_nodes (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr) \<rightarrow>\<^sub>r []\<close> 
-                  children_eq2 finite_set_in finsert_iff funion_finsert_right object_ptr_kinds_eq select_result_I2 subsetD sup_bot.right_neutral)
-    by (metis (no_types, lifting) \<open>cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr |\<notin>| object_ptr_kinds h\<close> 
-              \<open>h' \<turnstile> get_child_nodes (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr) \<rightarrow>\<^sub>r []\<close> 
-              \<open>h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []\<close> \<open>parent_child_rel h = parent_child_rel h'\<close> \<open>type_wf h'\<close> assms(1) disconnected_nodes_eq_h local.get_disconnected_nodes_ok 
-              local.heap_is_wellformed_disc_nodes_in_heap local.parent_child_rel_child local.parent_child_rel_parent_in_heap 
-              node_ptr_kinds_eq returns_result_select_result select_result_I2) 
+    using ObjectMonad.ptr_kinds_ptr_kinds_M
+      \<open>cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+      \<open>parent_child_rel h = parent_child_rel h'\<close> assms(1) children_eq fset_of_list_elem
+      local.heap_is_wellformed_children_in_heap local.parent_child_rel_child
+      local.parent_child_rel_parent_in_heap node_ptr_kinds_eq
+     apply (metis (no_types, lifting) \<open>h' \<turnstile> get_child_nodes (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr) \<rightarrow>\<^sub>r []\<close>
+        children_eq2 finite_set_in finsert_iff funion_finsert_right object_ptr_kinds_eq
+        select_result_I2 subsetD sup_bot.right_neutral)
+    by (metis (no_types, lifting) \<open>cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr |\<notin>| object_ptr_kinds h\<close>
+        \<open>h' \<turnstile> get_child_nodes (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr) \<rightarrow>\<^sub>r []\<close>
+        \<open>h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []\<close>
+        \<open>parent_child_rel h = parent_child_rel h'\<close> \<open>type_wf h'\<close> assms(1) disconnected_nodes_eq_h
+        local.get_disconnected_nodes_ok
+        local.heap_is_wellformed_disc_nodes_in_heap local.parent_child_rel_child
+        local.parent_child_rel_parent_in_heap
+        node_ptr_kinds_eq returns_result_select_result select_result_I2)
   have "a_distinct_lists h"
-    using \<open>heap_is_wellformed h\<close> 
+    using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def)
   then have "a_distinct_lists h'"
-    using \<open>h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []\<close> 
-          \<open>h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []\<close>
-
-    apply(auto simp add: children_eq2[symmetric] a_distinct_lists_def insort_split object_ptr_kinds_eq 
-                         document_ptr_kinds_eq_h  disconnected_nodes_eq2_h intro!: distinct_concat_map_I)[1]
+    using \<open>h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []\<close>
+      \<open>h' \<turnstile> get_child_nodes (cast new_document_ptr) \<rightarrow>\<^sub>r []\<close>
+
+    apply(auto simp add: children_eq2[symmetric] a_distinct_lists_def insort_split object_ptr_kinds_eq
+        document_ptr_kinds_eq_h  disconnected_nodes_eq2_h intro!: distinct_concat_map_I)[1]
     apply (metis distinct_sorted_list_of_set finite_fset sorted_list_of_set_insert)
 
     apply(auto simp add:  dest: distinct_concat_map_E)[1]
     apply(auto simp add:  dest: distinct_concat_map_E)[1]
     using \<open>new_document_ptr |\<notin>| document_ptr_kinds h\<close>
     apply(auto simp add: distinct_insort dest: distinct_concat_map_E)[1]
     using disconnected_nodes_eq_h
-    apply (metis assms(1) assms(3) disconnected_nodes_eq2_h local.get_disconnected_nodes_ok 
-                          local.heap_is_wellformed_disconnected_nodes_distinct 
-                          returns_result_select_result)
+    apply (metis assms(1) assms(3) disconnected_nodes_eq2_h local.get_disconnected_nodes_ok
+        local.heap_is_wellformed_disconnected_nodes_distinct
+        returns_result_select_result)
   proof -
     fix x :: "(_) document_ptr" and y :: "(_) document_ptr" and xa :: "(_) node_ptr"
     assume a1: "x \<noteq> y"
     assume a2: "x |\<in>| document_ptr_kinds h"
     assume a3: "x \<noteq> new_document_ptr"
     assume a4: "y |\<in>| document_ptr_kinds h"
     assume a5: "y \<noteq> new_document_ptr"
-    assume a6: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+    assume a6: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                               (sorted_list_of_set (fset (document_ptr_kinds h)))))"
     assume a7: "xa \<in> set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
     assume a8: "xa \<in> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r"
     have f9: "xa \<in> set |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
       using a7 a3 disconnected_nodes_eq2_h by presburger
     have f10: "xa \<in> set |h \<turnstile> get_disconnected_nodes y|\<^sub>r"
       using a8 a5 disconnected_nodes_eq2_h by presburger
     have f11: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h)))"
       using a4 by simp
     have "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h)))"
       using a2 by simp
     then show False
       using f11 f10 f9 a6 a1 by (meson disjoint_iff_not_equal distinct_concat_map_E(1))
   next
     fix x xa xb
     assume 0: "h' \<turnstile> get_disconnected_nodes new_document_ptr \<rightarrow>\<^sub>r []"
       and 1: "h' \<turnstile> get_child_nodes (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr) \<rightarrow>\<^sub>r []"
-      and 2: "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) 
+      and 2: "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r)
                                                   (sorted_list_of_set (fset (object_ptr_kinds h)))))"
-      and 3: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) 
+      and 3: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                               (sorted_list_of_set (fset (document_ptr_kinds h)))))"
-      and 4: "(\<Union>x\<in>fset (object_ptr_kinds h). set |h \<turnstile> get_child_nodes x|\<^sub>r) 
+      and 4: "(\<Union>x\<in>fset (object_ptr_kinds h). set |h \<turnstile> get_child_nodes x|\<^sub>r)
                       \<inter> (\<Union>x\<in>fset (document_ptr_kinds h). set |h \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       and 5: "x \<in> set |h \<turnstile> get_child_nodes xa|\<^sub>r"
       and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
       and 7: "xa |\<in>| object_ptr_kinds h"
       and 8: "xa \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr"
       and 9: "xb |\<in>| document_ptr_kinds h"
       and 10: "xb \<noteq> new_document_ptr"
     then show "False"
 
-      by (metis \<open>local.a_distinct_lists h\<close> assms(3) disconnected_nodes_eq2_h 
-                local.distinct_lists_no_parent local.get_disconnected_nodes_ok
-                 returns_result_select_result)
+      by (metis \<open>local.a_distinct_lists h\<close> assms(3) disconnected_nodes_eq2_h
+          local.distinct_lists_no_parent local.get_disconnected_nodes_ok
+          returns_result_select_result)
   qed
 
   have "a_owner_document_valid h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
     apply(auto simp add: a_owner_document_valid_def)[1]
-    by (metis \<open>cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr |\<notin>| object_ptr_kinds h\<close> 
-              children_eq2 disconnected_nodes_eq2_h document_ptr_kinds_commutes finite_set_in funion_iff node_ptr_kinds_eq object_ptr_kinds_eq)
+    by (metis \<open>cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_document_ptr |\<notin>| object_ptr_kinds h\<close>
+        children_eq2 disconnected_nodes_eq2_h document_ptr_kinds_commutes finite_set_in
+        funion_iff node_ptr_kinds_eq object_ptr_kinds_eq)
   show "heap_is_wellformed h'"
     using \<open>a_acyclic_heap h'\<close> \<open>a_all_ptrs_in_heap h'\<close> \<open>a_distinct_lists h'\<close> \<open>a_owner_document_valid h'\<close>
     by(simp add: heap_is_wellformed_def)
 qed
 end
 
-interpretation i_create_document_wf?: l_create_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes 
-                                      get_child_nodes_locs get_disconnected_nodes 
-                                      get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
-                                      set_val set_val_locs set_disconnected_nodes 
-                                      set_disconnected_nodes_locs create_document known_ptrs
+interpretation i_create_document_wf?: l_create_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes
+  get_child_nodes_locs get_disconnected_nodes
+  get_disconnected_nodes_locs heap_is_wellformed parent_child_rel
+  set_val set_val_locs set_disconnected_nodes
+  set_disconnected_nodes_locs create_document known_ptrs
   using instances
   by (auto simp add: l_create_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def)
 declare l_create_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 end
diff --git a/thys/Core_DOM/standard/classes/ElementClass.thy b/thys/Core_DOM/standard/classes/ElementClass.thy
--- a/thys/Core_DOM/standard/classes/ElementClass.thy
+++ b/thys/Core_DOM/standard/classes/ElementClass.thy
@@ -1,314 +1,328 @@
 (***********************************************************************************
  * Copyright (c) 2016-2018 The University of Sheffield, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  * 
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section\<open>Element\<close>
 text\<open>In this theory, we introduce the types for the Element  class.\<close>
 theory ElementClass
   imports
     "NodeClass"
     "ShadowRootPointer"
 begin
 text\<open>The type @{type "DOMString"} is a type synonym for @{type "string"}, define 
      in \autoref{sec:Core_DOM_Basic_Datatypes}.\<close>
 type_synonym attr_key = DOMString 
 type_synonym attr_value = DOMString
 type_synonym attrs = "(attr_key, attr_value) fmap"
-type_synonym tag_type = DOMString
+type_synonym tag_name = DOMString
 record ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr) RElement = RNode +
   nothing :: unit
-  tag_type :: tag_type
+  tag_name :: tag_name
   child_nodes :: "('node_ptr, 'element_ptr, 'character_data_ptr) node_ptr list"
   attrs :: attrs
   shadow_root_opt :: "'shadow_root_ptr shadow_root_ptr option"
 type_synonym 
   ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element) Element
-  = "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option) RElement_scheme"
+  = "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option)
+RElement_scheme"
 register_default_tvars 
   "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element) Element"
 type_synonym 
   ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Node, 'Element) Node
-  = "(('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option) RElement_ext + 'Node) Node"
+  = "(('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option) RElement_ext
++ 'Node) Node"
 register_default_tvars 
   "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Node, 'Element) Node"
 type_synonym 
   ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Object, 'Node, 'Element) Object
-  = "('Object, ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option) RElement_ext + 'Node) Object"
+  = "('Object, ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option)
+RElement_ext + 'Node) Object"
 register_default_tvars 
   "('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Object, 'Node, 'Element) Object"
 
 type_synonym
-  ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 'shadow_root_ptr, 'Object, 'Node, 'Element) heap
-  = "('document_ptr document_ptr + 'shadow_root_ptr shadow_root_ptr + 'object_ptr, 'element_ptr element_ptr + 'character_data_ptr character_data_ptr + 'node_ptr, 'Object,
-      ('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option) RElement_ext + 'Node) heap" 
+  ('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 'shadow_root_ptr,
+    'Object, 'Node, 'Element) heap
+  = "('document_ptr document_ptr + 'shadow_root_ptr shadow_root_ptr + 'object_ptr,
+'element_ptr element_ptr + 'character_data_ptr character_data_ptr + 'node_ptr, 'Object,
+('node_ptr, 'element_ptr, 'character_data_ptr, 'shadow_root_ptr, 'Element option) RElement_ext +
+'Node) heap"
 register_default_tvars
-  "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 'shadow_root_ptr, 'Object, 'Node, 'Element) heap" 
+  "('object_ptr, 'node_ptr, 'element_ptr, 'character_data_ptr, 'document_ptr, 'shadow_root_ptr,
+'Object, 'Node, 'Element) heap"
 type_synonym heap\<^sub>f\<^sub>i\<^sub>n\<^sub>a\<^sub>l = "(unit, unit, unit, unit, unit, unit, unit, unit, unit) heap"
 
 definition element_ptr_kinds :: "(_) heap \<Rightarrow> (_) element_ptr fset"
   where
-    "element_ptr_kinds heap = the |`| (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |`| (ffilter is_element_ptr_kind (node_ptr_kinds heap)))"
+    "element_ptr_kinds heap =
+the |`| (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |`| (ffilter is_element_ptr_kind (node_ptr_kinds heap)))"
 
 lemma element_ptr_kinds_simp [simp]: 
-  "element_ptr_kinds (Heap (fmupd (cast element_ptr) element (the_heap h))) = {|element_ptr|} |\<union>| element_ptr_kinds h"
+  "element_ptr_kinds (Heap (fmupd (cast element_ptr) element (the_heap h))) =
+{|element_ptr|} |\<union>| element_ptr_kinds h"
   apply(auto simp add: element_ptr_kinds_def)[1]
   by force
 
 definition element_ptrs :: "(_) heap \<Rightarrow> (_) element_ptr fset"
   where
     "element_ptrs heap = ffilter is_element_ptr (element_ptr_kinds heap)"
 
 definition cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) Node \<Rightarrow> (_) Element option"
   where
-    "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t node = (case RNode.more node of Inl element \<Rightarrow> Some (RNode.extend (RNode.truncate node) element) | _ \<Rightarrow> None)"
+    "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t node =
+(case RNode.more node of Inl element \<Rightarrow> Some (RNode.extend (RNode.truncate node) element) | _ \<Rightarrow> None)"
 adhoc_overloading cast cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 abbreviation cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) Object \<Rightarrow> (_) Element option"
   where
     "cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t obj \<equiv> (case cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e obj of Some node \<Rightarrow> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t node | None \<Rightarrow> None)"
 adhoc_overloading cast cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 definition cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) Element \<Rightarrow> (_) Node"
   where
     "cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e element = RNode.extend (RNode.truncate element) (Inl (RNode.more element))"
 adhoc_overloading cast cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 
 abbreviation cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) Element \<Rightarrow> (_) Object"
   where
     "cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr \<equiv> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t (cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr)"
 adhoc_overloading cast cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 consts is_element_kind :: 'a
 definition is_element_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e :: "(_) Node \<Rightarrow> bool"
   where
     "is_element_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr \<longleftrightarrow> cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr \<noteq> None"
 
 adhoc_overloading is_element_kind is_element_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e
 lemmas is_element_kind_def = is_element_kind\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
 
 abbreviation is_element_kind\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t :: "(_) Object \<Rightarrow> bool"
   where
     "is_element_kind\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr \<equiv> cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr \<noteq> None"
 adhoc_overloading is_element_kind is_element_kind\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
 
 lemma element_ptr_kinds_commutes [simp]: 
   "cast element_ptr |\<in>| node_ptr_kinds h \<longleftrightarrow> element_ptr |\<in>| element_ptr_kinds h"
   apply(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)[1]
   by (metis (no_types, lifting) element_ptr_casts_commute2 ffmember_filter fimage_eqI 
       fset.map_comp is_element_ptr_kind_none node_ptr_casts_commute3 
       node_ptr_kinds_commutes node_ptr_kinds_def option.sel option.simps(3))
 
 definition get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) element_ptr \<Rightarrow> (_) heap \<Rightarrow> (_) Element option"
   where                             
     "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr h = Option.bind (get\<^sub>N\<^sub>o\<^sub>d\<^sub>e (cast element_ptr) h) cast"
 adhoc_overloading get get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 
 locale l_type_wf_def\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 definition a_type_wf :: "(_) heap \<Rightarrow> bool"
   where
     "a_type_wf h = (NodeClass.type_wf h \<and> (\<forall>element_ptr \<in> fset (element_ptr_kinds h).
                                                                   get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr h \<noteq> None))"
 end
 global_interpretation l_type_wf_def\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t defines type_wf = a_type_wf .
 lemmas type_wf_defs = a_type_wf_def
 
 locale l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t = l_type_wf type_wf for type_wf :: "((_) heap \<Rightarrow> bool)" +
   assumes type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t: "type_wf h \<Longrightarrow> ElementClass.type_wf h"
 
 sublocale l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t \<subseteq> l_type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e
   apply(unfold_locales)
   using NodeClass.a_type_wf_def
   by (meson ElementClass.a_type_wf_def l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_axioms l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 locale l_get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas = l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 sublocale l_get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_lemmas by unfold_locales
 
 lemma get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_type_wf:
   assumes "type_wf h"
   shows "element_ptr |\<in>| element_ptr_kinds h \<longleftrightarrow> get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr h \<noteq> None"
   using l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_axioms assms
   apply(simp add: type_wf_defs get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
   by (metis NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf bind_eq_None_conv element_ptr_kinds_commutes notin_fset
       option.distinct(1))
 end
 
 global_interpretation l_get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_lemmas type_wf
   by unfold_locales
 
 definition put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) element_ptr \<Rightarrow> (_) Element \<Rightarrow> (_) heap \<Rightarrow> (_) heap"
   where                                     
     "put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr element = put\<^sub>N\<^sub>o\<^sub>d\<^sub>e (cast element_ptr) (cast element)"
 adhoc_overloading put put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t      
 
 lemma put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap:
   assumes "put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr element h = h'"
   shows "element_ptr |\<in>| element_ptr_kinds h'"
   using assms
   unfolding put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def element_ptr_kinds_def
   by (metis element_ptr_kinds_commutes element_ptr_kinds_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_ptr_in_heap)
 
 lemma put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_put_ptrs:
   assumes "put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr element h = h'"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast element_ptr|}"
   using assms
   by (simp add: put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_put_ptrs)
 
 
 
 lemma cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inject [simp]: 
   "cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e x = cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e y \<longleftrightarrow> x = y"
   apply(simp add: cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RObject.extend_def RNode.extend_def)
   by (metis (full_types) RNode.surjective old.unit.exhaust)
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_none [simp]: 
   "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t node = None \<longleftrightarrow> \<not> (\<exists>element. cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e element = node)"
   apply(auto simp add: cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RObject.extend_def RNode.extend_def 
       split: sum.splits)[1]
   by (metis (full_types) RNode.select_convs(2) RNode.surjective old.unit.exhaust)
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_some [simp]: 
   "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t node = Some element \<longleftrightarrow> cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e element = node"
   by(auto simp add: cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def RObject.extend_def RNode.extend_def 
       split: sum.splits)
 
 lemma cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_inv [simp]: "cast\<^sub>N\<^sub>o\<^sub>d\<^sub>e\<^sub>2\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t (cast\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e element) = Some element"
   by simp
 
 lemma get_elment_ptr_simp1 [simp]: 
   "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr (put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr element h) = Some element"
   by(auto simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 lemma get_elment_ptr_simp2 [simp]: 
   "element_ptr \<noteq> element_ptr' 
   \<Longrightarrow> get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr (put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr' element h) = get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t element_ptr h"
   by(auto simp add: get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 
-abbreviation "create_element_obj tag_type_arg child_nodes_arg attrs_arg shadow_root_opt_arg
+abbreviation "create_element_obj tag_name_arg child_nodes_arg attrs_arg shadow_root_opt_arg
   \<equiv> \<lparr> RObject.nothing = (), RNode.nothing = (), RElement.nothing = (),
-      tag_type = tag_type_arg, Element.child_nodes = child_nodes_arg, attrs = attrs_arg,
+      tag_name = tag_name_arg, Element.child_nodes = child_nodes_arg, attrs = attrs_arg,
       shadow_root_opt = shadow_root_opt_arg, \<dots> = None \<rparr>"
 
 definition new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t :: "(_) heap \<Rightarrow> ((_) element_ptr \<times> (_) heap)"
   where
     "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = 
       (let new_element_ptr = element_ptr.Ref (Suc (fMax (finsert 0 (element_ptr.the_ref 
                                  |`| (element_ptrs h))))) 
        in
       (new_element_ptr, put new_element_ptr (create_element_obj '''' [] fmempty None) h))"
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   shows "new_element_ptr |\<in>| element_ptr_kinds h'"
   using assms
   unfolding new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def
   using put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_in_heap by blast
 
 lemma new_element_ptr_new: 
   "element_ptr.Ref (Suc (fMax (finsert 0 (element_ptr.the_ref |`| element_ptrs h)))) |\<notin>| element_ptrs h"
   by (metis Suc_n_not_le_n element_ptr.sel(1) fMax_ge fimage_finsert finsertI1 finsertI2 set_finsert)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_ptr_not_in_heap:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   shows "new_element_ptr |\<notin>| element_ptr_kinds h"
   using assms
   unfolding new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
   by (metis Pair_inject element_ptrs_def ffmember_filter new_element_ptr_new is_element_ptr_ref)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_new_ptr:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   shows "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
   using assms
   by (metis Pair_inject new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_put_ptrs)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_is_element_ptr:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   shows "is_element_ptr new_element_ptr"
   using assms
   by(auto simp add: new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t [simp]:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   assumes "ptr \<noteq> cast new_element_ptr"
   shows "get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h = get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>N\<^sub>o\<^sub>d\<^sub>e [simp]:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   assumes "ptr \<noteq> cast new_element_ptr"
   shows "get\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr h = get\<^sub>N\<^sub>o\<^sub>d\<^sub>e ptr h'"
   using assms
   by(auto simp add: new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
 
 lemma new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
   assumes "new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_element_ptr, h')"
   assumes "ptr \<noteq> new_element_ptr"
   shows "get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
   using assms
   by(auto simp add: new\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)
 
 locale l_known_ptr\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
 begin
 definition a_known_ptr :: "(_) object_ptr \<Rightarrow> bool"
   where
     "a_known_ptr ptr = (known_ptr ptr \<or> is_element_ptr ptr)"
 
 lemma known_ptr_not_element_ptr: "\<not>is_element_ptr ptr \<Longrightarrow> a_known_ptr ptr \<Longrightarrow> known_ptr ptr"
   by(simp add: a_known_ptr_def)
 end
 global_interpretation l_known_ptr\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t defines known_ptr = a_known_ptr .
 lemmas known_ptr_defs = a_known_ptr_def
 
 
 locale l_known_ptrs\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t = l_known_ptr known_ptr for known_ptr :: "(_) object_ptr \<Rightarrow> bool"
 begin
 definition a_known_ptrs :: "(_) heap \<Rightarrow> bool"
   where
     "a_known_ptrs h = (\<forall>ptr \<in> fset (object_ptr_kinds h). known_ptr ptr)"
 
 lemma known_ptrs_known_ptr: 
   "ptr |\<in>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> known_ptr ptr"
   apply(simp add: a_known_ptrs_def)
   using notin_fset by fastforce
 
-lemma known_ptrs_preserved: "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
+lemma known_ptrs_preserved:
+  "object_ptr_kinds h = object_ptr_kinds h' \<Longrightarrow> a_known_ptrs h = a_known_ptrs h'"
   by(auto simp add: a_known_ptrs_def)
-lemma known_ptrs_subset: "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_subset:
+  "object_ptr_kinds h' |\<subseteq>| object_ptr_kinds h \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def less_eq_fset.rep_eq subsetD)
-lemma known_ptrs_new_ptr: "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow> a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
+lemma known_ptrs_new_ptr:
+  "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|new_ptr|} \<Longrightarrow> known_ptr new_ptr \<Longrightarrow>
+a_known_ptrs h \<Longrightarrow> a_known_ptrs h'"
   by(simp add: a_known_ptrs_def)
 end
 global_interpretation l_known_ptrs\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t known_ptr defines known_ptrs = a_known_ptrs .
 lemmas known_ptrs_defs = a_known_ptrs_def
 
 lemma known_ptrs_is_l_known_ptrs: "l_known_ptrs known_ptr known_ptrs"
   using known_ptrs_known_ptr known_ptrs_preserved  known_ptrs_subset known_ptrs_new_ptr l_known_ptrs_def by blast
 
 end