diff --git a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy
--- a/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy
+++ b/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy
@@ -1,1007 +1,1007 @@
 section \<open>Accuracy without cutoff\label{sec:accuracy_wo_cutoff}\<close>
 
 text \<open>This section verifies that each of the $l$ estimate have the required accuracy with high
 probability assuming that there was no cut-off, i.e., that $s=0$. Section~\ref{sec:accuracy} will
 then show that this remains true as long as the cut-off is below @{term "t f"} the subsampling
 threshold.\<close>
 
 theory Distributed_Distinct_Elements_Accuracy_Without_Cutoff
   imports
     Distributed_Distinct_Elements_Inner_Algorithm
     Distributed_Distinct_Elements_Balls_and_Bins
 begin
 
 no_notation Polynomials.var ("X\<index>")
 
 locale inner_algorithm_fix_A = inner_algorithm +
   fixes A
   assumes A_range: "A \<subseteq> {..<n}"
   assumes A_nonempty: "{} \<noteq> A"
 begin
 
 definition X :: nat where "X = card A"
 
 definition q_max where "q_max = nat (\<lceil>log 2 X\<rceil> - b_exp)"
 
 definition t :: "(nat \<Rightarrow> nat) \<Rightarrow> int"
   where "t f = int (Max (f ` A)) - b_exp + 9"
 
 definition s :: "(nat \<Rightarrow> nat) \<Rightarrow> nat"
   where "s f = nat (t f)"
 
 definition R :: "(nat \<Rightarrow> nat) \<Rightarrow> nat set"
   where "R f = {a. a \<in> A \<and> f a \<ge> s f}"
 
 definition r :: "nat \<Rightarrow> (nat \<Rightarrow> nat) \<Rightarrow> nat"
   where "r x f = card {a. a \<in> A \<and> f a \<ge> x}"
 
 definition p where "p = (\<lambda>(f,g,h). card {j\<in> {..<b}. \<tau>\<^sub>1 (f,g,h) A 0 j \<ge> s f})"
 
 definition Y where "Y = (\<lambda>(f,g,h). 2 ^ s f * \<rho>_inv (p (f,g,h)))"
 
 lemma fin_A: "finite A"
   using A_range finite_nat_iff_bounded by auto
 
 lemma X_le_n: "X \<le> n"
 proof -
   have "card A \<le> card {..<n}"
     by (intro card_mono A_range) simp
   thus ?thesis
     unfolding X_def by simp
 qed
 
 lemma X_ge_1: "X \<ge> 1"
   unfolding X_def
   using fin_A A_nonempty by (simp add: leI)
 
 lemma of_bool_square: "(of_bool x)\<^sup>2 = ((of_bool x)::real)"
   by (cases x, auto)
 
 lemma r_eq: "r x f = (\<Sum> a \<in> A.( of_bool( x \<le> f a) :: real))"
   unfolding r_def of_bool_def sum.If_cases[OF fin_A]
   by (simp add: Collect_conj_eq)
 
 lemma
   shows
     r_exp: "(\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1) = real X * (of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1) / 2^x)" and
     r_var: "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r x \<omega>)) \<le> (\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1)"
 proof -
   define V :: "nat \<Rightarrow> (nat \<Rightarrow> nat) \<Rightarrow> real" where "V = (\<lambda>a f. of_bool (x \<le> f a))"
 
   have V_exp: "(\<integral>\<omega>. V a \<omega> \<partial>\<Psi>\<^sub>1) = of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/2^x"
     (is "?L = ?R") if "a \<in> A" for a
   proof -
     have a_le_n: "a < n"
       using that A_range by auto
 
     have "?L = (\<integral>\<omega>. indicator {f. x \<le> f a} \<omega> \<partial> \<Psi>\<^sub>1)"
       unfolding V_def by (intro integral_cong_AE) auto
     also have "... = measure (map_pmf (\<lambda>\<omega>. \<omega> a) (sample_pmf \<Psi>\<^sub>1)) {f. x \<le> f}"
       by simp
     also have "... = measure (\<G> n_exp) {f. x \<le> f}"
       unfolding \<Psi>\<^sub>1.single[OF a_le_n] by simp
     also have "... = of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/2^x"
       unfolding \<G>_prob n_exp_def by simp
     finally show ?thesis by simp
   qed
 
   have b:"(\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1) = (\<Sum> a \<in> A. (\<integral>\<omega>. V a \<omega> \<partial>\<Psi>\<^sub>1))"
     unfolding r_eq V_def  using \<Psi>\<^sub>1.sample_space
     by (intro Bochner_Integration.integral_sum) auto
   also have "... = (\<Sum> a \<in> A.  of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/2^x)"
     using V_exp by (intro sum.cong) auto
   also have "... = X * (of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1) / 2^x)"
     using X_def by simp
   finally show "(\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1) = real X * (of_bool (x \<le> max (nat \<lceil>log 2 n\<rceil>) 1)/ 2^x)"
     by simp
 
   have "(\<integral>\<omega>. (V a \<omega>)^2 \<partial> \<Psi>\<^sub>1) = (\<integral>\<omega>. V a \<omega> \<partial> \<Psi>\<^sub>1)" for a
     unfolding V_def of_bool_square by simp
 
   hence a:"measure_pmf.variance \<Psi>\<^sub>1 (V a) \<le> measure_pmf.expectation \<Psi>\<^sub>1 (V a)"  for a
     using \<Psi>\<^sub>1.sample_space by (subst measure_pmf.variance_eq) auto
 
   have "J \<subseteq> A \<Longrightarrow> card J = 2 \<Longrightarrow> prob_space.indep_vars \<Psi>\<^sub>1 (\<lambda>_. borel) V J" for J
     unfolding V_def using A_range finite_subset[OF _ fin_A]
     by (intro prob_space.indep_vars_compose2[where Y="\<lambda>i y. of_bool(x \<le> y)" and M'="\<lambda>_. discrete"]
         prob_space.k_wise_indep_vars_subset[OF _ \<Psi>\<^sub>1.indep]) (auto simp:prob_space_measure_pmf)
   hence "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r x \<omega>)) = (\<Sum> a \<in> A. measure_pmf.variance \<Psi>\<^sub>1 (V a))"
     unfolding r_eq V_def using \<Psi>\<^sub>1.sample_space
-    by (intro measure_pmf.var_sum_pairwise_indep_2 fin_A) (simp_all)
+    by (intro measure_pmf.bienaymes_identity_pairwise_indep_2 fin_A) (simp_all)
   also have "... \<le> (\<Sum> a \<in> A. (\<integral>\<omega>. V a \<omega> \<partial> \<Psi>\<^sub>1))"
     by (intro sum_mono a)
   also have "... = (\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1)"
     unfolding b by simp
   finally show "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r x \<omega>)) \<le> (\<integral>\<omega>. real (r x \<omega>) \<partial> \<Psi>\<^sub>1)" by simp
 qed
 
 definition E\<^sub>1 where "E\<^sub>1 = (\<lambda>(f,g,h). 2 powr (-t f) * X \<in> {b/2^16..b/2})"
 
 lemma t_low:
   "measure \<Psi>\<^sub>1 {f. of_int (t f) < log 2 (real X) + 1 - b_exp} \<le> 1/2^7" (is "?L \<le> ?R")
 proof (cases "log 2 (real X) \<ge> 8")
   case True
   define Z :: "(nat \<Rightarrow> nat) \<Rightarrow> real" where "Z = r (nat \<lceil>log 2 (real X) - 8\<rceil>)"
 
   have "log 2 (real X) \<le> log 2 (real n)"
     using X_le_n X_ge_1 by (intro log_mono) auto
   hence "nat \<lceil>log 2 (real X) - 8\<rceil> \<le> nat \<lceil>log 2 (real n)\<rceil>"
     by (intro nat_mono ceiling_mono) simp
   hence a:"(nat \<lceil>log 2 (real X) - 8\<rceil> \<le> max (nat \<lceil>log 2 (real n)\<rceil>) 1)"
     by simp
 
   have b:"real (nat (\<lceil>log 2 (real X)\<rceil> - 8)) \<le> log 2 (real X) - 7"
     using True by linarith
 
   have "2 ^ 7 = real X / (2 powr (log 2 X) * 2 powr (-7))"
     using X_ge_1 by simp
   also have "... = real X / (2 powr (log 2 X - 7))"
     by (subst powr_add[symmetric]) simp
   also have "... \<le> real X / (2 powr (real (nat \<lceil>log 2 (real X) - 8\<rceil>)))"
     using b by (intro divide_left_mono powr_mono) auto
   also have "... = real X / 2 ^ nat \<lceil>log 2 (real X) - 8\<rceil>"
     by (subst powr_realpow) auto
   finally have "2 ^ 7 \<le> real X / 2 ^ nat \<lceil>log 2 (real X) - 8\<rceil>"
     by simp
   hence exp_Z_gt_2_7: "(\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<ge> 2^7"
     using a unfolding Z_def r_exp by simp
 
   have var_Z_le_exp_Z: "measure_pmf.variance \<Psi>\<^sub>1 Z \<le> (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)"
     unfolding Z_def by (intro r_var)
 
   have "?L \<le> measure \<Psi>\<^sub>1 {f. of_nat (Max (f ` A)) < log 2 (real X) - 8}"
     unfolding t_def by (intro pmf_mono) (auto simp add:int_of_nat_def)
   also have "... \<le> measure \<Psi>\<^sub>1 {f \<in> space \<Psi>\<^sub>1.  (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> \<bar>Z f - (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<bar>}"
   proof (rule pmf_mono)
     fix f assume "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)"
     have fin_f_A: "finite (f ` A)" using fin_A finite_imageI by blast
     assume " f \<in> {f. real (Max (f ` A)) < log 2 (real X) - 8}"
     hence "real (Max (f ` A)) < log 2 (real X) - 8" by auto
     hence "real (f a) < log 2 (real X) - 8" if "a \<in> A" for a
       using Max_ge[OF fin_f_A] imageI[OF that]  order_less_le_trans by fastforce
     hence "of_nat (f a) < \<lceil>log 2 (real X) - 8\<rceil>" if "a \<in> A" for a
       using that by (subst less_ceiling_iff) auto
     hence "f a < nat \<lceil>log 2 (real X) - 8\<rceil>" if "a \<in> A" for a
       using that True by fastforce
     hence "r (nat \<lceil>log 2 (real X) - 8\<rceil>) f = 0"
       unfolding r_def card_eq_0_iff using not_less by auto
     hence "Z f = 0"
       unfolding Z_def by simp
     thus "f \<in> {f \<in> space \<Psi>\<^sub>1.  (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> \<bar>Z f - (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)\<bar>}"
       by auto
   qed
   also have "... \<le> measure_pmf.variance \<Psi>\<^sub>1 Z / (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)^2"
     using exp_Z_gt_2_7 \<Psi>\<^sub>1.sample_space by (intro measure_pmf.second_moment_method) simp_all
   also have "... \<le> (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) / (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)^2"
     by (intro divide_right_mono var_Z_le_exp_Z) simp
   also have "... = 1 / (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1)"
     using exp_Z_gt_2_7 by (simp add:power2_eq_square)
   also have "... \<le> ?R"
     using exp_Z_gt_2_7 by (intro divide_left_mono) auto
   finally show ?thesis by simp
 next
   case "False"
   have "?L \<le> measure \<Psi>\<^sub>1 {f. of_nat (Max (f ` A)) < log 2 (real X) - 8}"
     unfolding t_def by (intro pmf_mono) (auto simp add:int_of_nat_def)
   also have "... \<le> measure \<Psi>\<^sub>1 {}"
     using False by (intro pmf_mono) simp
   also have "... = 0"
     by simp
   also have "... \<le> ?R" by simp
   finally show ?thesis by simp
 qed
 
 lemma t_high:
   "measure \<Psi>\<^sub>1 {f. of_int (t f) > log 2 (real X) + 16 - b_exp} \<le> 1/2^7" (is "?L \<le> ?R")
 proof -
   define Z :: "(nat \<Rightarrow> nat) \<Rightarrow> real" where "Z = r (nat \<lfloor>log 2 (real X) + 8\<rfloor>)"
 
   have Z_nonneg: "Z f \<ge> 0" for f
     unfolding Z_def r_def by simp
 
   have "(\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> real X / (2 ^ nat \<lfloor>log 2 (real X) + 8\<rfloor>)"
     unfolding Z_def r_exp by simp
   also have "... \<le> real X / (2 powr (real (nat \<lfloor>log 2 (real X) + 8\<rfloor>)))"
     by (subst powr_realpow) auto
   also have "... \<le> real X / (2 powr \<lfloor>log 2 (real X) + 8\<rfloor>)"
     by (intro divide_left_mono powr_mono) auto
   also have "... \<le> real X / (2 powr (log 2 (real X) + 7))"
     by (intro divide_left_mono powr_mono, linarith) auto
   also have "... = real X / 2 powr (log 2 (real X)) / 2 powr 7"
     by (subst powr_add) simp
   also have "... \<le> 1/2 powr 7"
     using X_ge_1 by (subst powr_log_cancel) auto
   finally have Z_exp: "(\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) \<le> 1/2^7"
     by simp
 
   have "?L \<le> measure \<Psi>\<^sub>1 {f. of_nat (Max (f ` A)) > log 2 (real X) + 7}"
     unfolding t_def  by (intro pmf_mono) (auto simp add:int_of_nat_def)
   also have "... \<le> measure \<Psi>\<^sub>1 {f. Z f \<ge> 1}"
   proof (rule pmf_mono)
     fix f assume "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)"
     assume " f \<in> {f. real (Max (f ` A)) > log 2 (real X) + 7}"
     hence "real (Max (f ` A)) > log 2 (real X) + 7" by simp
     hence "int (Max (f ` A)) \<ge> \<lfloor>log 2 (real X) + 8\<rfloor>"
       by linarith
     hence "Max (f ` A) \<ge> nat \<lfloor>log 2 (real X) + 8\<rfloor>"
       by simp
     moreover have "f ` A \<noteq> {}" "finite (f ` A)"
       using fin_A finite_imageI A_nonempty by auto
     ultimately obtain fa where "fa \<in> f ` A" " fa \<ge>  nat \<lfloor>log 2 (real X) + 8\<rfloor>"
       using Max_in by auto
     then obtain ae where ae_def: "ae \<in> A" "nat \<lfloor>log 2 (real X) + 8\<rfloor> \<le> f ae"
       by auto
     hence "r (nat \<lfloor>log 2 (real X) + 8\<rfloor>) f > 0"
       unfolding r_def card_gt_0_iff using fin_A by auto
     hence "Z f \<ge> 1"
       unfolding Z_def by simp
     thus "f \<in> {f. 1 \<le> Z f}" by simp
   qed
   also have "... \<le> (\<integral>\<omega>. Z \<omega> \<partial>\<Psi>\<^sub>1) / 1"
     using Z_nonneg using \<Psi>\<^sub>1.sample_space by (intro pmf_markov) auto
   also have "... \<le> ?R"
     using Z_exp by simp
   finally show ?thesis by simp
 qed
 
 lemma e_1: "measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi>} \<le> 1/2^6"
 proof -
   have "measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X \<notin> {real b/2^16..real b/2}} \<le>
     measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X < real b/2^16} +
     measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X > real b/2}"
     by (intro pmf_add) auto
   also have "... \<le> measure \<Psi>\<^sub>1 {f. of_int (t f) > log 2 X + 16 - b_exp} +
                    measure \<Psi>\<^sub>1 {f. of_int (t f) < log 2 X + 1 - b_exp}"
   proof (rule add_mono)
     show "measure \<Psi>\<^sub>1 {f. 2 powr (of_int (-t f)) * real X < real b/2^16} \<le>
     measure \<Psi>\<^sub>1 {f. of_int (t f) > log 2 X + 16 - b_exp}"
     proof (rule pmf_mono)
       fix f assume "f \<in> {f. 2 powr real_of_int (-t f) * real X < real b / 2 ^ 16}"
       hence "2 powr real_of_int (-t f) * real X < real b / 2 ^ 16"
         by simp
       hence "log 2 (2 powr of_int (-t f) * real X) < log 2 (real b / 2^16)"
         using b_min X_ge_1 by (intro iffD2[OF log_less_cancel_iff]) auto
       hence "of_int (-t f) + log  2 (real X) < log 2 (real b / 2^16)"
         using X_ge_1 by (subst (asm) log_mult) auto
       also have  "... = real b_exp - log 2 (2 powr 16)"
         unfolding b_def by (subst log_divide) auto
       also have "... = real b_exp - 16"
         by (subst log_powr_cancel) auto
       finally have "of_int (-t f) + log 2 (real X) < real b_exp - 16" by simp
       thus "f \<in> {f. of_int (t f) > log 2 (real X) + 16 - b_exp}"
         by simp
     qed
   next
     show "measure \<Psi>\<^sub>1 {f. 2 powr of_int (-t f) * real X > real b/2} \<le>
       measure \<Psi>\<^sub>1 {f. of_int (t f) < log 2 X + 1 - b_exp}"
     proof (rule pmf_mono)
       fix f assume "f \<in> {f. 2 powr real_of_int (-t f) * real X > real b / 2}"
       hence "2 powr real_of_int (-t f) * real X > real b / 2"
         by simp
       hence "log 2 (2 powr of_int (-t f) * real X) > log 2 (real b / 2)"
         using b_min X_ge_1 by (intro iffD2[OF log_less_cancel_iff]) auto
       hence "of_int (-t f) + log  2 (real X) > log 2 (real b / 2)"
         using X_ge_1 by (subst (asm) log_mult) auto
       hence  "of_int (-t f) + log  2 (real X) > real b_exp - 1"
         unfolding b_def by (subst (asm) log_divide) auto
       hence "of_int (t f) < log 2 (real X) + 1 - b_exp"
         by simp
       thus "f \<in> {f. of_int (t f) < log 2 (real X) + 1 - b_exp}"
         by simp
     qed
   qed
   also have "... \<le> 1/2^7 + 1/2^7"
     by (intro add_mono t_low t_high)
   also have "... = 1/2^6" by simp
   finally have "measure \<Psi>\<^sub>1 {f. 2 powr of_int (-t f) * real X \<notin> {real b/2^16..real b/2}} \<le> 1/2^6"
     by simp
 
   thus ?thesis
     unfolding sample_pmf_\<Psi> E\<^sub>1_def case_prod_beta
     by (subst pair_pmf_prob_left)
 qed
 
 definition E\<^sub>2 where "E\<^sub>2 = (\<lambda>(f,g,h). \<bar>card (R f) - X / 2^(s f)\<bar> \<le> \<epsilon>/3 * X / 2^(s f))"
 
 lemma e_2: "measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> \<not>E\<^sub>2 \<psi>} \<le> 1/2^6" (is "?L \<le> ?R")
 proof -
   define t\<^sub>m :: int where "t\<^sub>m = \<lfloor>log 2 (real X)\<rfloor> + 16 - b_exp"
 
   have t_m_bound: "t\<^sub>m \<le> \<lfloor>log 2 (real X)\<rfloor> - 10"
     unfolding t\<^sub>m_def using b_exp_ge_26 by simp
 
   have "real b / 2^16 = (real X * (1/ X)) * (real b / 2^16)"
     using X_ge_1 by simp
   also have "... = (real X * 2 powr (-log 2 X)) * (real b / 2^16)"
     using X_ge_1 by (subst powr_minus_divide) simp
   also have "... \<le> (real X * 2 powr (- \<lfloor>log 2 (real X)\<rfloor>)) * (2 powr b_exp / 2^16)"
     unfolding b_def using powr_realpow
     by (intro mult_mono powr_mono) auto
   also have "... = real X * (2 powr (- \<lfloor>log 2 (real X)\<rfloor>) * 2 powr(real b_exp-16))"
     by (subst powr_diff) simp
   also have "... = real X * 2 powr (- \<lfloor>log 2 (real X)\<rfloor> + (int b_exp - 16))"
     by (subst powr_add[symmetric]) simp
   also have "... = real X * 2 powr (-t\<^sub>m)"
     unfolding t\<^sub>m_def by (simp add:algebra_simps)
   finally have c:"real b / 2^16 \<le> real X * 2 powr (-t\<^sub>m)" by simp
 
   define T :: "nat set" where "T = {x. (real X / 2^x \<ge> real b / 2^16)}"
 
   have "x \<in> T \<longleftrightarrow> int x \<le> t\<^sub>m" for x
   proof -
     have "x \<in> T \<longleftrightarrow> 2^ x \<le> real X * 2^16 / b"
       using b_min by (simp add: field_simps T_def)
     also have "... \<longleftrightarrow> log 2 (2^x) \<le> log 2 (real X * 2^16 / b)"
       using X_ge_1 b_min by (intro log_le_cancel_iff[symmetric] divide_pos_pos) auto
     also have "... \<longleftrightarrow> x \<le> log 2 (real X * 2^16) - log 2 b"
       using X_ge_1 b_min by (subst log_divide) auto
     also have "... \<longleftrightarrow> x \<le> log 2 (real X) + log 2 (2 powr 16) - b_exp"
       unfolding b_def using X_ge_1 by (subst log_mult) auto
     also have "... \<longleftrightarrow> x \<le> \<lfloor>log 2 (real X) + log 2 (2 powr 16) - b_exp\<rfloor>"
       by linarith
     also have "... \<longleftrightarrow> x \<le> \<lfloor>log 2 (real X) + 16 - real_of_int (int b_exp)\<rfloor>"
       by (subst log_powr_cancel) auto
     also have "... \<longleftrightarrow> x \<le> t\<^sub>m"
       unfolding t\<^sub>m_def by linarith
     finally show ?thesis by simp
   qed
   hence T_eq: "T = {x. int x \<le> t\<^sub>m}" by auto
 
   have "T = {x. int x < t\<^sub>m+1}"
     unfolding T_eq by simp
   also have "... = {x. x < nat (t\<^sub>m + 1)}"
     unfolding zless_nat_eq_int_zless by simp
   finally have T_eq_2: "T = {x. x < nat (t\<^sub>m + 1)}"
     by simp
 
   have inj_1: "inj_on ((-) (nat t\<^sub>m)) T"
     unfolding T_eq by (intro inj_onI) simp
   have fin_T: "finite T"
     unfolding T_eq_2 by simp
 
   have r_exp: "(\<integral>\<omega>. real (r t \<omega>) \<partial>\<Psi>\<^sub>1) = real X / 2^t" if "t \<in> T" for t
   proof -
     have "t \<le> t\<^sub>m"
       using that unfolding T_eq by simp
     also have "... \<le> \<lfloor>log 2 (real X)\<rfloor> - 10"
       using t_m_bound by simp
     also have "... \<le> \<lfloor>log 2 (real X)\<rfloor>"
       by simp
     also have "... \<le> \<lfloor>log 2 (real n)\<rfloor>"
       using X_le_n X_ge_1 by (intro floor_mono log_mono) auto
     also have "... \<le> \<lceil>log 2 (real n)\<rceil>"
       by simp
     finally have "t \<le> \<lceil>log 2 (real n)\<rceil>" by simp
     hence "t \<le> max (nat \<lceil>log 2 (real n)\<rceil>) 1"by simp
     thus ?thesis
       unfolding r_exp by simp
   qed
 
   have r_var: "measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r t \<omega>)) \<le> real X / 2^t" if "t \<in> T" for t
     using r_exp[OF that] r_var by metis
 
   have "9 = C\<^sub>4 / \<epsilon>\<^sup>2 * \<epsilon>^2/2^23"
     using \<epsilon>_gt_0 by (simp add:C\<^sub>4_def)
   also have "... = 2 powr (log 2 (C\<^sub>4 /  \<epsilon>\<^sup>2)) *  \<epsilon>^2/2^23"
     using \<epsilon>_gt_0 C\<^sub>4_def by (subst powr_log_cancel) auto
   also have "... \<le> 2 powr b_exp * \<epsilon>^2/2^23"
     unfolding b_exp_def
     by (intro divide_right_mono mult_right_mono powr_mono, linarith) auto
   also have "... = b * \<epsilon>^2/2^23"
     using powr_realpow unfolding b_def by simp
   also have "... = (b/2^16) * (\<epsilon>^2/2^7)"
     by simp
   also have "... \<le> (X * 2 powr (-t\<^sub>m)) * (\<epsilon>^2/2^7)"
     by (intro mult_mono c) auto
   also have "... = X * (2 powr (-t\<^sub>m) * 2 powr (-7)) * \<epsilon>^2"
     using powr_realpow by simp
   also have "... = 2 powr (-t\<^sub>m-7) * (\<epsilon>^2 * X)"
     by (subst powr_add[symmetric]) (simp )
   finally have "9 \<le> 2 powr (-t\<^sub>m-7) * (\<epsilon>^2 * X)" by simp
   hence b: "9/ (\<epsilon>^2 * X) \<le> 2 powr (-t\<^sub>m -7)"
     using \<epsilon>_gt_0 X_ge_1
     by (subst pos_divide_le_eq) auto
 
   have a: "measure \<Psi>\<^sub>1 {f.\<bar>real (r t f)-real X/2^t\<bar>> \<epsilon>/3 *real X/2^t} \<le> 2 powr (real t-t\<^sub>m-7)"
     (is"?L1 \<le> ?R1") if "t \<in> T" for t
   proof -
     have "?L1 \<le> \<P>(f in \<Psi>\<^sub>1. \<bar>real (r t f) - real X / 2^t\<bar> \<ge>  \<epsilon>/3 * real X / 2^t)"
       by (intro pmf_mono) auto
     also have "... = \<P>(f in \<Psi>\<^sub>1. \<bar>real (r t f)-(\<integral>\<omega>. real (r t \<omega>) \<partial> \<Psi>\<^sub>1)\<bar> \<ge> \<epsilon>/3 * real X/2^t)"
       by (simp add: r_exp[OF that])
     also have "... \<le> measure_pmf.variance \<Psi>\<^sub>1 (\<lambda>\<omega>. real (r t \<omega>)) / (\<epsilon>/3 * real X / 2^t)^2"
       using X_ge_1 \<epsilon>_gt_0 \<Psi>\<^sub>1.sample_space
       by (intro measure_pmf.Chebyshev_inequality divide_pos_pos mult_pos_pos) auto
     also have "... \<le> (X / 2^t) / (\<epsilon>/3 * X / 2^t)^2"
       by (intro divide_right_mono r_var[OF that]) simp
     also have "... = 2^t*(9/ ( \<epsilon>^2 * X))"
       by (simp add:power2_eq_square algebra_simps)
     also have "... \<le> 2^t*(2 powr (-t\<^sub>m-7))"
       by (intro mult_left_mono b) simp
     also have "... = 2 powr t * 2 powr (-t\<^sub>m-7)"
       by (subst powr_realpow[symmetric]) auto
     also have "... = ?R1"
       by (subst powr_add[symmetric]) (simp add:algebra_simps)
     finally show "?L1 \<le> ?R1" by simp
   qed
 
   have "\<exists>y<nat (t\<^sub>m + 1). x = nat t\<^sub>m - y" if "x < nat (t\<^sub>m+1)" for x
     using that by (intro exI[where x="nat t\<^sub>m - x"]) simp
   hence T_reindex: "(-) (nat t\<^sub>m) ` {x. x < nat (t\<^sub>m + 1)} = {..<nat (t\<^sub>m + 1)}"
     by (auto simp add: set_eq_iff image_iff)
 
   have "?L \<le> measure \<Psi> {\<psi>. (\<exists>t \<in> T. \<bar>real (r t (fst \<psi>))-real X/2^t\<bar> > \<epsilon>/3 * real X / 2^t)}"
   proof (rule pmf_mono)
     fix \<psi>
     assume "\<psi> \<in> set_pmf (sample_pmf \<Psi>)"
     obtain f g h where \<psi>_def: "\<psi> = (f,g,h)" by (metis prod_cases3)
     assume "\<psi> \<in> {\<psi>. E\<^sub>1 \<psi> \<and> \<not> E\<^sub>2 \<psi>}"
     hence a:"2 powr ( -real_of_int (t f)) * real X \<in> {real b/2^16..real b/2}" and
       b:"\<bar>card (R f) - real X / 2^(s f)\<bar> >  \<epsilon>/3 * X / 2^(s f)"
       unfolding E\<^sub>1_def E\<^sub>2_def by (auto simp add:\<psi>_def)
     have "\<bar>card (R f) - X / 2^(s f)\<bar> = 0" if "s f= 0"
       using that by (simp add:R_def X_def)
     moreover have "( \<epsilon>/3) * (X / 2^s f) \<ge> 0"
       using \<epsilon>_gt_0 X_ge_1 by (intro mult_nonneg_nonneg) auto
     ultimately have "False" if "s f = 0"
       using b that by simp
     hence "s f > 0" by auto
     hence "t f = s f" unfolding s_def by simp
     hence "2 powr (-real (s f)) * X \<ge> b / 2^16"
       using a by simp
     hence "X / 2 powr (real (s f)) \<ge> b / 2^16"
       by (simp add: divide_powr_uminus mult.commute)
     hence "real X / 2 ^ (s f) \<ge> b / 2^16"
       by (subst (asm) powr_realpow, auto)
     hence "s f \<in> T" unfolding T_def by simp
     moreover have "\<bar>r (s f) f - X / 2^s f\<bar> >  \<epsilon>/3 * X / 2^s f"
       using R_def r_def b by simp
     ultimately have "\<exists>t \<in> T. \<bar>r t (fst \<psi>) - X / 2^t\<bar> >  \<epsilon>/3 * X / 2^t"
       using \<psi>_def by (intro bexI[where x="s f"]) simp
     thus "\<psi> \<in> {\<psi>. (\<exists>t \<in> T. \<bar>r t (fst \<psi>) - X / 2^t\<bar> >  \<epsilon>/3 * X / 2^t)}" by simp
   qed
   also have "... = measure \<Psi>\<^sub>1 {f. (\<exists>t \<in> T. \<bar>real (r t f)-real X / 2^t\<bar> > \<epsilon>/3 * real X/2^t)}"
     unfolding sample_pmf_\<Psi> by (intro pair_pmf_prob_left)
   also have "... = measure \<Psi>\<^sub>1 (\<Union>t \<in> T. {f. \<bar>real (r t f)-real X / 2^t\<bar> > \<epsilon>/3 * real X/2^t})"
     by (intro measure_pmf_cong) auto
   also have "... \<le> (\<Sum>t \<in> T. measure \<Psi>\<^sub>1 {f.\<bar>real (r t f)-real X / 2^t\<bar> > \<epsilon>/3 * real X/2^t})"
     by (intro measure_UNION_le fin_T) (simp)
   also have "... \<le> (\<Sum>t \<in> T.  2 powr (real t - of_int t\<^sub>m - 7))"
     by (intro sum_mono a)
   also have "... = (\<Sum>t \<in> T.  2 powr (-int (nat t\<^sub>m-t) - 7))"
     unfolding T_eq
     by (intro sum.cong refl arg_cong2[where f="(powr)"]) simp
   also have "... = (\<Sum>x \<in> (\<lambda>x. nat t\<^sub>m - x) ` T. 2 powr (-real x - 7))"
     by (subst sum.reindex[OF inj_1]) simp
   also have "... = (\<Sum>x \<in> (\<lambda>x. nat t\<^sub>m - x) ` T. 2 powr (-7) * 2 powr (-real x))"
     by (subst powr_add[symmetric]) (simp add:algebra_simps)
   also have "... = 1/2^7 * (\<Sum>x \<in> (\<lambda>x. nat t\<^sub>m - x) ` T. 2 powr (-real x))"
     by (subst sum_distrib_left) simp
   also have "... = 1/2^7 * (\<Sum>x <nat (t\<^sub>m+1). 2 powr (-real x))"
     unfolding T_eq_2 T_reindex
     by (intro arg_cong2[where f="(*)"] sum.cong) auto
   also have "... = 1/2^7 * (\<Sum>x <nat (t\<^sub>m+1). (2 powr (-1)) powr (real x))"
     by (subst powr_powr) simp
   also have "... = 1/2^7 * (\<Sum>x <nat (t\<^sub>m+1). (1/2)^x)"
     using powr_realpow by simp
   also have "... \<le> 1/2^7 * 2"
     by(subst geometric_sum) auto
   also have "... = 1/2^6" by simp
   finally show ?thesis by simp
 qed
 
 definition E\<^sub>3 where "E\<^sub>3 = (\<lambda>(f,g,h). inj_on g (R f))"
 
 lemma R_bound:
   fixes f g h
   assumes "E\<^sub>1 (f,g,h)"
   assumes "E\<^sub>2 (f,g,h)"
   shows "card (R f) \<le> 2/3 * b"
 proof -
   have "real (card (R f)) \<le> ( \<epsilon> / 3) * (real X / 2 ^ s f) + real X / 2 ^ s f"
     using assms(2) unfolding E\<^sub>2_def by simp
   also have "... \<le> (1/3) * (real X / 2 ^ s f) + real X / 2 ^ s f"
     using \<epsilon>_lt_1 by (intro add_mono mult_right_mono) auto
   also have "... = (4/3) * (real X / 2 powr s f)"
     using powr_realpow by simp
   also have "... \<le> (4/3) * (real X / 2 powr t f)"
     unfolding s_def
     by (intro mult_left_mono divide_left_mono powr_mono) auto
   also have "... = (4/3) * (2 powr (-(of_int (t f))) * real X)"
     by (subst powr_minus_divide) simp
   also have "... = (4/3) * (2 powr (- t f) * real X)"
     by simp
   also have "... \<le> (4/3) * (b/2)"
     using assms(1) unfolding E\<^sub>1_def
     by (intro mult_left_mono) auto
   also have "... \<le> (2/3) * b" by simp
   finally show ?thesis by simp
 qed
 
 lemma e_3: "measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> \<not>E\<^sub>3 \<psi>} \<le> 1/2^6" (is "?L \<le> ?R")
 proof -
   let ?\<alpha> = "(\<lambda>(z,x,y) f. z < C\<^sub>7*b^2 \<and> x \<in> R f \<and> y \<in> R f \<and> x < y)"
   let ?\<beta> = "(\<lambda>(z,x,y) g. g x = z \<and> g y = z)"
 
   have \<beta>_prob: "measure \<Psi>\<^sub>2 {g. ?\<beta> \<omega> g} \<le> (1/real (C\<^sub>7*b^2)^2)"
     if "?\<alpha> \<omega> f" for \<omega> f
   proof -
     obtain x y z where \<omega>_def: "\<omega> = (z,x,y)" by (metis prod_cases3)
     have a:"prob_space.k_wise_indep_vars \<Psi>\<^sub>2 2 (\<lambda>i. discrete) (\<lambda>x \<omega>. \<omega> x = z) {..<n}"
       by (intro prob_space.k_wise_indep_vars_compose[OF _ \<Psi>\<^sub>2.indep])
        (simp_all add:prob_space_measure_pmf)
 
     have "u \<in> R f \<Longrightarrow> u < n" for u
       unfolding R_def using A_range by auto
     hence b: "x < n" "y < n" "card {x, y} = 2"
       using that \<omega>_def by auto
     have c: "z < C\<^sub>7*b\<^sup>2" using \<omega>_def that by simp
 
     have "measure \<Psi>\<^sub>2 {g. ?\<beta> \<omega> g} = measure \<Psi>\<^sub>2 {g. (\<forall>\<xi> \<in> {x,y}. g \<xi> = z)}"
       by (simp add:\<omega>_def)
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure \<Psi>\<^sub>2 {g. g \<xi> = z})"
       using b by (intro measure_pmf.split_indep_events[OF refl, where I="{x,y}"]
           prob_space.k_wise_indep_vars_subset[OF _ a]) (simp_all add:prob_space_measure_pmf)
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure (map_pmf (\<lambda>\<omega>. \<omega> \<xi>) (sample_pmf \<Psi>\<^sub>2)) {g. g = z}) "
       by (simp add:vimage_def)
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure [C\<^sub>7 * b\<^sup>2]\<^sub>S {g. g=z})"
       using b \<Psi>\<^sub>2.single by (intro prod.cong) fastforce+
     also have "... = (\<Prod>\<xi> \<in> {x,y}. measure (pmf_of_set {..<C\<^sub>7 * b\<^sup>2}) {z})"
       by (subst nat_sample_pmf) simp
     also have "... = (measure (pmf_of_set {..<C\<^sub>7 * b\<^sup>2}) {z})^2"
       using b by simp
     also have "... \<le> (1 /(C\<^sub>7*b\<^sup>2))^2"
       using c by (subst measure_pmf_of_set) auto
     also have "... = (1 /(C\<^sub>7*b\<^sup>2)^2)"
       by (simp add:algebra_simps power2_eq_square)
     finally show ?thesis by simp
   qed
 
   have \<alpha>_card: "card {\<omega>. ?\<alpha> \<omega> f} \<le> (C\<^sub>7*b^2) * (card (R f) * (card (R f)-1)/2)"
     (is "?TL \<le> ?TR") and fin_\<alpha>: "finite {\<omega>. ?\<alpha> \<omega> f}" (is "?T2") for f
   proof -
     have t1: "{\<omega>. ?\<alpha> \<omega> f} \<subseteq> {..<C\<^sub>7*b^2} \<times> {(x,y) \<in> R f \<times> R f. x < y}"
       by (intro subsetI) auto
     moreover have "card ({..<C\<^sub>7*b^2} \<times> {(x,y) \<in> R f \<times> R f. x < y}) = ?TR"
       using  card_ordered_pairs'[where M="R f"]
       by (simp add: card_cartesian_product)
     moreover have "finite (R f)"
       unfolding R_def using fin_A finite_subset by simp
     hence "finite {(x, y). (x, y) \<in> R f \<times> R f \<and> x < y}"
       by (intro finite_subset[where B="R f \<times> R f", OF _ finite_cartesian_product]) auto
     hence t2: "finite ({..<C\<^sub>7*b^2} \<times> {(x,y) \<in> R f \<times> R f. x < y})"
       by (intro finite_cartesian_product) auto
     ultimately show "?TL \<le> ?TR"
       using card_mono of_nat_le_iff by (metis (no_types, lifting))
     show ?T2
       using finite_subset[OF t1 t2] by simp
   qed
 
   have "?L \<le> measure \<Psi> {(f,g,h). card (R f) \<le> b \<and> (\<exists> x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)}"
   proof (rule pmf_mono)
     fix \<psi> assume b:"\<psi> \<in> set_pmf (sample_pmf \<Psi>)"
     obtain f g h where \<psi>_def:"\<psi> = (f,g,h)" by (metis prod_cases3)
     have "(f,g,h) \<in> sample_set \<Psi>"
       using sample_space_alt[OF sample_space_\<Psi>] b \<psi>_def by simp
     hence c:"g x < C\<^sub>7*b^2" for x
       using g_range by simp
 
     assume a:"\<psi> \<in> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> \<not> E\<^sub>3 \<psi>}"
     hence "card (R f) \<le> 2/3 * b"
       using R_bound \<psi>_def by force
     moreover have "\<exists>a b. a \<in> R f \<and> b \<in> R f \<and> a \<noteq> b \<and> g a = g b"
       using a unfolding \<psi>_def E\<^sub>3_def inj_on_def by auto
     hence "\<exists>x y. x \<in> R f \<and> y \<in> R f \<and> x < y \<and> g x = g y"
       by (metis not_less_iff_gr_or_eq)
     hence "\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g"
       using c by blast
     ultimately show "\<psi> \<in> {(f, g, h). card (R f) \<le> b \<and> (\<exists> x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)}"
       unfolding \<psi>_def by auto
   qed
   also have "... = (\<integral>f. measure (pair_pmf \<Psi>\<^sub>2 \<Psi>\<^sub>3)
      {g. card (R f) \<le> b \<and> (\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) (fst g))} \<partial>\<Psi>\<^sub>1)"
     unfolding sample_pmf_\<Psi> split_pair_pmf by (simp add: case_prod_beta)
   also have
     "... = (\<integral>f. measure \<Psi>\<^sub>2 {g. card (R f) \<le> b \<and> (\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)} \<partial>\<Psi>\<^sub>1)"
     by (subst pair_pmf_prob_left) simp
   also have "... \<le> (\<integral>f. 1/real (2*C\<^sub>7) \<partial>\<Psi>\<^sub>1)"
   proof (rule pmf_exp_mono[OF integrable_sample_pmf[OF \<Psi>\<^sub>1.sample_space]
           integrable_sample_pmf[OF \<Psi>\<^sub>1.sample_space]])
     fix f assume "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)"
     show "measure \<Psi>\<^sub>2 {g. card (R f) \<le> b \<and> (\<exists>x y z. ?\<alpha> (x,y,z) f \<and> ?\<beta> (x,y,z) g)} \<le> 1 / real (2 * C\<^sub>7)"
       (is "?L1 \<le> ?R1")
     proof (cases "card (R f) \<le> b")
       case True
       have "?L1 \<le> measure \<Psi>\<^sub>2 (\<Union> \<omega> \<in> {\<omega>. ?\<alpha> \<omega> f}. {g. ?\<beta> \<omega> g})"
         by (intro pmf_mono) auto
       also have "... \<le> (\<Sum>\<omega> \<in> {\<omega>. ?\<alpha> \<omega> f}. measure \<Psi>\<^sub>2 {g. ?\<beta> \<omega> g})"
         by (intro measure_UNION_le fin_\<alpha>) auto
       also have "... \<le> (\<Sum>\<omega> \<in> {\<omega>. ?\<alpha> \<omega> f}. (1/real (C\<^sub>7*b^2)^2))"
         by (intro sum_mono \<beta>_prob) auto
       also have "... = card {\<omega>. ?\<alpha> \<omega> f} /(C\<^sub>7*b^2)^2"
         by simp
       also have "... \<le> (C\<^sub>7*b^2) * (card (R f) * (card (R f)-1)/2) / (C\<^sub>7*b^2)^2"
         by (intro \<alpha>_card divide_right_mono) simp
       also have "... \<le> (C\<^sub>7*b^2) * (b * b / 2)  / (C\<^sub>7*b^2)^2"
         unfolding C\<^sub>7_def using True
         by (intro divide_right_mono Nat.of_nat_mono mult_mono) auto
       also have "... = 1/(2*C\<^sub>7)"
         using b_min by (simp add:algebra_simps power2_eq_square)
       finally show ?thesis by simp
     next
       case False
       then show ?thesis by simp
     qed
   qed
   also have "... \<le> 1/2^6"
     unfolding C\<^sub>7_def by simp
   finally show ?thesis by simp
 qed
 
 definition E\<^sub>4 where "E\<^sub>4 = (\<lambda>(f,g,h). \<bar>p (f,g,h) - \<rho> (card (R f))\<bar> \<le>  \<epsilon>/12 * card (R f))"
 
 lemma e_4_h: "9 / sqrt b \<le> \<epsilon> / 12"
 proof -
   have "108 \<le> sqrt (C\<^sub>4)"
     unfolding C\<^sub>4_def by (approximation 5)
   also have "... \<le> sqrt( \<epsilon>^2 * real b)"
     using b_lower_bound \<epsilon>_gt_0
     by (intro real_sqrt_le_mono) (simp add: pos_divide_le_eq algebra_simps)
   also have "... =  \<epsilon> * sqrt b"
     using \<epsilon>_gt_0 by (simp add:real_sqrt_mult)
   finally have "108 \<le>  \<epsilon> * sqrt b"  by simp
   thus ?thesis
     using b_min by (simp add:pos_divide_le_eq)
 qed
 
 lemma e_4: "measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> E\<^sub>3 \<psi> \<and> \<not>E\<^sub>4 \<psi>} \<le> 1/2^6" (is "?L \<le> ?R")
 proof -
   have a: "measure \<Psi>\<^sub>3 {h. E\<^sub>1 (f,g,h) \<and> E\<^sub>2 (f,g,h) \<and> E\<^sub>3 (f,g,h) \<and> \<not>E\<^sub>4 (f,g,h)} \<le> 1/2^6"
     (is "?L1 \<le> ?R1") if "f \<in> set_pmf (sample_pmf \<Psi>\<^sub>1)" "g \<in> set_pmf(sample_pmf \<Psi>\<^sub>2)"
     for f g
   proof (cases "card (R f) \<le> b \<and> inj_on g (R f)")
     case True
 
     have g_inj: "inj_on g (R f)"
       using True by simp
 
     have fin_R: "finite (g ` R f)"
       unfolding R_def using fin_A
       by (intro finite_imageI) simp
 
     interpret B:balls_and_bins_abs "g ` R f" "{..<b}"
       using fin_R b_ne by unfold_locales auto
 
     have "range g \<subseteq> {..<C\<^sub>7 * b\<^sup>2}"
       using g_range_1 that(2) unfolding sample_space_alt[OF \<Psi>\<^sub>2.sample_space] by auto
     hence g_ran: "g ` R f \<subseteq> {..<C\<^sub>7 * b\<^sup>2}"
       by auto
 
     have "sample_pmf [b]\<^sub>S = pmf_of_set {..<b}"
       unfolding sample_pmf_def nat_sample_space_def by simp
     hence " map_pmf (\<lambda>\<omega>. \<omega> x) (sample_pmf (\<H> k (C\<^sub>7 * b\<^sup>2) [b]\<^sub>S)) = pmf_of_set {..<b}"
       if "x \<in> g ` R f" for x
       using g_ran \<Psi>\<^sub>3.single that by auto
     moreover have "prob_space.k_wise_indep_vars \<Psi>\<^sub>3 k (\<lambda>_. discrete) (\<lambda>x \<omega>. \<omega> x) (g ` R f)"
       by (intro prob_space.k_wise_indep_subset[OF _ _ \<Psi>\<^sub>3.indep] g_ran prob_space_measure_pmf)
     ultimately have lim_balls_and_bins: "B.lim_balls_and_bins k (sample_pmf (\<H> k (C\<^sub>7 * b\<^sup>2) [b]\<^sub>S))"
       unfolding B.lim_balls_and_bins_def by auto
 
     have card_g_R: "card (g ` R f) = card (R f)"
       using True card_image by auto
     hence b_mu: "\<rho> (card (R f)) = B.\<mu>"
       unfolding B.\<mu>_def \<rho>_def using b_min by (simp add:powr_realpow)
 
     have card_g_le_b: "card (g ` R f) \<le> card {..<b}"
       unfolding card_g_R using True by simp
 
     have "?L1 \<le> measure \<Psi>\<^sub>3 {h. \<bar>B.Y h - B.\<mu>\<bar> > 9 * real (card (g ` R f)) / sqrt (card {..<b})}"
     proof (rule pmf_mono)
       fix h assume "h \<in> {h. E\<^sub>1 (f,g,h) \<and> E\<^sub>2 (f,g,h) \<and> E\<^sub>3 (f,g,h) \<and> \<not>E\<^sub>4 (f,g,h)}"
       hence b: "\<bar>p (f,g,h) -\<rho> (card (R f))\<bar> >  \<epsilon>/12 * card (R f)"
         unfolding E\<^sub>4_def by simp
       assume "h \<in> set_pmf (sample_pmf \<Psi>\<^sub>3)"
       hence h_range: "h x < b" for x
         unfolding sample_space_alt[OF \<Psi>\<^sub>3.sample_space,symmetric] using h_range_1 by simp
 
       have "{j \<in> {..<b}. int (s f) \<le> \<tau>\<^sub>1 (f, g, h) A 0 j} =
         {j \<in> {..<b}. int (s f) \<le> max (Max ({int (f a) |a. a \<in> A \<and> h (g a) = j} \<union> {-1})) (- 1)}"
         unfolding \<tau>\<^sub>1_def by simp
       also have "... = {j \<in> {..<b}. int (s f) \<le> Max ({int (f a) |a. a \<in> A \<and> h (g a) = j} \<union> {-1})}"
         using fin_A by (subst max_absorb1) (auto intro: Max_ge)
       also have "... = {j \<in> {..<b}. (\<exists>a \<in> R f. h (g a) = j)}"
         unfolding R_def using fin_A by (subst Max_ge_iff) auto
       also have "... = {j. \<exists>a \<in> R f. h (g a) = j}"
         using h_range by auto
       also have "... = (h \<circ> g) ` (R f)"
         by (auto simp add:set_eq_iff image_iff)
       also have "... = h ` (g ` (R f))"
         by (simp add:image_image)
       finally have c:"{j \<in> {..<b}. int (s f) \<le> \<tau>\<^sub>1 (f, g, h) A 0 j} = h ` (g ` R f)"
         by simp
       have "9 * real (card (g ` R f)) / sqrt (card {..<b}) = 9/ sqrt b * real (card (R f))"
         using card_image[OF g_inj] by simp
       also have "... \<le>  \<epsilon>/12 * card (R f)"
         by (intro mult_right_mono e_4_h) simp
       also have "... < \<bar>B.Y h - B.\<mu>\<bar>"
         using b c unfolding B.Y_def p_def b_mu by simp
       finally show "h \<in> {h. \<bar>B.Y h - B.\<mu>\<bar> >  9 * real (card (g ` R f)) / sqrt (card {..<b})}"
         by simp
     qed
     also have "... \<le> 1/2^6"
       using k_min
       by (intro B.devitation_bound[OF card_g_le_b lim_balls_and_bins]) auto
     finally show ?thesis by simp
   next
     case False
     have "?L1 \<le> measure \<Psi>\<^sub>3 {}"
     proof (rule pmf_mono)
       fix h assume b:"h \<in> {h. E\<^sub>1 (f, g, h) \<and> E\<^sub>2 (f, g, h) \<and> E\<^sub>3 (f, g, h) \<and> \<not> E\<^sub>4 (f, g, h)}"
       hence "card (R f) \<le> (2/3)*b"
         by (auto intro!: R_bound[simplified])
       hence "card (R f) \<le> b"
         by simp
       moreover have "inj_on g (R f)"
         using b by (simp add:E\<^sub>3_def)
       ultimately have "False" using False by simp
       thus "h \<in> {}" by simp
     qed
     also have "... = 0" by simp
     finally show ?thesis by simp
   qed
 
   have "?L = (\<integral>f. (\<integral>g.
     measure \<Psi>\<^sub>3 {h. E\<^sub>1 (f,g,h) \<and> E\<^sub>2 (f,g,h) \<and> E\<^sub>3 (f,g,h) \<and> \<not>E\<^sub>4 (f,g,h)} \<partial>\<Psi>\<^sub>2) \<partial>\<Psi>\<^sub>1)"
     unfolding sample_pmf_\<Psi> split_pair_pmf by simp
   also have "... \<le> (\<integral>f. (\<integral>g.  1/2^6  \<partial>\<Psi>\<^sub>2) \<partial>\<Psi>\<^sub>1)"
     using a \<Psi>\<^sub>1.sample_space \<Psi>\<^sub>2.sample_space
     by (intro integral_mono_AE AE_pmfI) simp_all
   also have "... = 1/2^6"
     by simp
   finally show ?thesis by simp
 qed
 
 lemma \<rho>_inverse: "\<rho>_inv (\<rho> x) = x"
 proof -
   have a:"1-1/b \<noteq> 0"
     using b_min by simp
 
   have "\<rho> x = b * (1-(1-1/b) powr x)"
     unfolding \<rho>_def by simp
   hence "\<rho> x / real b = 1-(1-1/b) powr x" by simp
   hence "ln (1 - \<rho> x / real b) = ln ((1-1/b) powr x)" by simp
   also have "... = x * ln (1 - 1/ b)"
     using a by (intro ln_powr)
   finally have "ln (1 - \<rho> x / real b) = x * ln (1- 1/ b)"
     by simp
   moreover have "ln (1-1/b) < 0"
     using b_min by (subst ln_less_zero_iff) auto
   ultimately show ?thesis
     using \<rho>_inv_def by simp
 qed
 
 lemma rho_mono:
   assumes "x \<le> y"
   shows "\<rho> x \<le> \<rho> y"
 proof-
   have "(1 - 1 / real b) powr y \<le> (1 - 1 / real b) powr x"
     using b_min
     by (intro powr_mono_rev assms) auto
   thus ?thesis
     unfolding \<rho>_def by (intro mult_left_mono) auto
 qed
 
 lemma rho_two_thirds: "\<rho> (2/3 * b) \<le> 3/5 *b"
 proof -
   have "1/3 \<le> exp ( - 13 / 12::real )"
     by (approximation 8)
   also have "... \<le> exp ( - 1 - 2 / real b )"
     using b_min by (intro iffD2[OF exp_le_cancel_iff]) (simp add:algebra_simps)
   also have "... \<le> exp ( b * (-(1/real b)-2*(1/real b)^2))"
     using b_min by (simp add:algebra_simps power2_eq_square)
   also have  "... \<le> exp ( b * ln (1-1/real b))"
     using b_min
     by (intro iffD2[OF exp_le_cancel_iff] mult_left_mono ln_one_minus_pos_lower_bound) auto
   also have "... = exp ( ln ( (1-1/real b) powr b))"
     using b_min by (subst ln_powr) auto
   also have "... = (1-1/real b) powr b"
     using b_min by (subst exp_ln) auto
   finally have a:"1/3 \<le> (1-1/real b) powr b" by simp
 
   have "2/5 \<le> (1/3) powr (2/3::real)"
     by (approximation 5)
   also have "... \<le> ((1-1/real b) powr b) powr (2/3)"
     by (intro powr_mono2 a) auto
   also have "... = (1-1/real b) powr (2/3 * real b)"
     by (subst powr_powr) (simp add:algebra_simps)
   finally have "2/5 \<le> (1 - 1 / real b) powr (2 / 3 * real b)" by simp
   hence "1 - (1 - 1 / real b) powr (2 / 3 * real b) \<le> 3/5"
     by simp
   hence "\<rho> (2/3 * b) \<le> b * (3/5)"
     unfolding \<rho>_def by (intro mult_left_mono) auto
   thus ?thesis
     by simp
 qed
 
 definition \<rho>_inv' :: "real \<Rightarrow> real"
   where "\<rho>_inv' x = -1 / (real b * (1-x / real b) * ln (1 - 1 / real b))"
 
 lemma \<rho>_inv'_bound:
   assumes "x \<ge> 0"
   assumes "x \<le> 59/90*b"
   shows "\<bar>\<rho>_inv' x\<bar> \<le> 4"
 proof -
   have c:"ln (1 - 1 / real b) < 0"
     using b_min
     by (subst ln_less_zero_iff) auto
   hence d:"real b * (1 - x / real b) * ln (1 - 1 / real b) < 0"
     using b_min assms by (intro Rings.mult_pos_neg) auto
 
   have "(1::real) \<le> 31/30" by simp
   also have "... \<le> (31/30) * (b * -(- 1 / real b))"
     using b_min by simp
   also have "... \<le> (31/30) * (b * -ln (1 + (- 1 / real b)))"
     using b_min
     by (intro mult_left_mono le_imp_neg_le  ln_add_one_self_le_self2) auto
   also have "... \<le> 3 * (31/90) * (- b * ln (1 - 1 / real b))"
     by simp
   also have "... \<le> 3 * (1 - x / real b) * (- b * ln (1 - 1 / real b))"
     using assms b_min pos_divide_le_eq[where c="b"] c
     by (intro mult_right_mono mult_left_mono mult_nonpos_nonpos) auto
   also have "... \<le> 3 * (real b * (1 - x / real b) * (-ln (1 - 1 / real b)))"
     by (simp add:algebra_simps)
   finally have "3 * (real b * (1 - x / real b) * (-ln (1 - 1 / real b))) \<ge> 1" by simp
   hence "3 * (real b * (1 - x / real b) * ln (1 - 1 / real b)) \<le> -1" by simp
   hence "\<rho>_inv' x \<le> 3"
     unfolding \<rho>_inv'_def using d
     by (subst neg_divide_le_eq) auto
   moreover have "\<rho>_inv' x > 0"
     unfolding \<rho>_inv'_def using d by (intro divide_neg_neg) auto
   ultimately show ?thesis by simp
 qed
 
 lemma \<rho>_inv':
   fixes x :: real
   assumes "x < b"
   shows "DERIV \<rho>_inv x :> \<rho>_inv' x"
 proof -
   have "DERIV (ln \<circ> (\<lambda>x. (1 - x / real b))) x :> 1 / (1-x / real b) * (0 -1/b)"
     using assms b_min
     by (intro DERIV_chain DERIV_ln_divide DERIV_cdivide derivative_intros) auto
   hence "DERIV \<rho>_inv x :> (1 / (1-x / real b) * (-1/b)) / ln (1-1/real b)"
     unfolding comp_def \<rho>_inv_def by (intro DERIV_cdivide) auto
   thus ?thesis
     by (simp add:\<rho>_inv'_def algebra_simps)
 qed
 
 lemma accuracy_without_cutoff:
   "measure \<Psi> {(f,g,h). \<bar>Y (f,g,h) - real X\<bar> > \<epsilon> * X \<or> s f < q_max} \<le> 1/2^4"
   (is "?L \<le> ?R")
 proof -
   have "?L \<le> measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi> \<or>  \<not>E\<^sub>2 \<psi> \<or>  \<not>E\<^sub>3 \<psi> \<or>  \<not>E\<^sub>4 \<psi>}"
   proof (rule pmf_rev_mono)
     fix \<psi> assume "\<psi> \<in> set_pmf (sample_pmf \<Psi>)"
     obtain f g h where \<psi>_def: "\<psi> = (f,g,h)" by (metis prod_cases3)
 
     assume "\<psi> \<notin> {\<psi>. \<not> E\<^sub>1 \<psi> \<or> \<not> E\<^sub>2 \<psi> \<or> \<not> E\<^sub>3 \<psi> \<or> \<not> E\<^sub>4 \<psi>}"
     hence assms: "E\<^sub>1 (f,g,h)" "E\<^sub>2 (f,g,h)" "E\<^sub>3 (f,g,h)" "E\<^sub>4 (f,g,h)"
       unfolding \<psi>_def by auto
 
     define I :: "real set" where "I = {0..59/90*b}"
 
     have "p (f,g,h) \<le> \<rho> (card (R f)) + \<epsilon>/12 * card (R f)"
       using assms(4) E\<^sub>4_def unfolding abs_le_iff by simp
     also have "... \<le> \<rho>(2/3*b) + 1/12* (2/3*b)"
       using \<epsilon>_lt_1 R_bound[OF assms(1,2)]
       by (intro add_mono rho_mono mult_mono) auto
     also have "... \<le> 3/5 * b + 1/18*b"
       by (intro add_mono rho_two_thirds) auto
     also have "... \<le> 59/90 * b"
        by simp
     finally have "p (f,g,h) \<le> 59/90 * b" by simp
     hence p_in_I: "p (f,g,h) \<in> I"
       unfolding I_def by simp
 
     have "\<rho> (card (R f)) \<le> \<rho>(2/3 * b)"
       using  R_bound[OF assms(1,2)]
       by (intro rho_mono) auto
     also have "... \<le> 3/5 * b"
       using rho_two_thirds by simp
     also have "... \<le> b * 59/90" by simp
     finally have "\<rho> (card (R f)) \<le> b * 59/90" by simp
     moreover have "(1 - 1 / real b) powr (real (card (R f))) \<le> 1 powr (real (card (R f)))"
       using b_min by (intro powr_mono2) auto
     hence "\<rho> (card (R f)) \<ge> 0"
       unfolding \<rho>_def by (intro mult_nonneg_nonneg) auto
     ultimately have "\<rho> (card (R f)) \<in> I"
       unfolding I_def by simp
 
     moreover have "interval I"
       unfolding I_def interval_def by simp
     moreover have "59 / 90 * b < b"
       using b_min by simp
     hence "DERIV \<rho>_inv x :> \<rho>_inv' x" if "x \<in> I" for x
       using that I_def by (intro \<rho>_inv') simp
     ultimately obtain \<xi> :: real where \<xi>_def: "\<xi> \<in> I"
       "\<rho>_inv (p(f,g,h)) - \<rho>_inv (\<rho> (card (R f))) = (p (f,g,h) - \<rho>(card (R f))) * \<rho>_inv' \<xi>"
       using p_in_I MVT_interval by blast
 
     have "\<bar>\<rho>_inv(p (f,g,h)) - card (R f)\<bar> = \<bar>\<rho>_inv(p (f,g,h)) - \<rho>_inv(\<rho>(card (R f)))\<bar>"
       by (subst \<rho>_inverse) simp
     also have "... = \<bar>(p (f,g,h) - \<rho> (card (R f)))\<bar> * \<bar>\<rho>_inv' \<xi> \<bar>"
       using \<xi>_def(2) abs_mult by simp
     also have "... \<le> \<bar>p (f,g,h) - \<rho> (card (R f))\<bar> * 4"
       using \<xi>_def(1) I_def
       by (intro mult_left_mono \<rho>_inv'_bound) auto
     also have "... \<le> ( \<epsilon>/12 * card (R f)) * 4"
       using assms(4) E\<^sub>4_def by (intro mult_right_mono) auto
     also have "... = \<epsilon>/3 * card (R f)" by simp
     finally have b: "\<bar>\<rho>_inv(p (f,g,h)) - card (R f)\<bar> \<le> \<epsilon>/3 * card (R f)"  by simp
 
     have "\<bar>\<rho>_inv(p (f,g,h)) - X / 2 ^ (s f)\<bar> \<le>
       \<bar>\<rho>_inv(p (f,g,h)) - card (R f)\<bar> + \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       by simp
     also have "... \<le> \<epsilon>/3 * card (R f) + \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       by (intro add_mono b) auto
     also have "... =  \<epsilon>/3 * \<bar>X / 2 ^ (s f) + (card (R f) - X / 2 ^ (s f))\<bar> +
       \<bar>card (R f) - X / 2 ^ (s f)\<bar>" by simp
     also have "... \<le>  \<epsilon>/3 * (\<bar>X / 2 ^ (s f)\<bar> + \<bar>card (R f) - X / 2 ^ (s f)\<bar>) +
       \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       using \<epsilon>_gt_0 by (intro mult_left_mono add_mono abs_triangle_ineq) auto
     also have "... \<le>  \<epsilon>/3 * \<bar>X / 2 ^ (s f)\<bar> + (1+  \<epsilon>/3) * \<bar>card (R f) - X / 2 ^ (s f)\<bar>"
       using \<epsilon>_gt_0 \<epsilon>_lt_1 by (simp add:algebra_simps)
     also have "... \<le>  \<epsilon>/3 * \<bar>X / 2 ^ s f\<bar> + (4/3) * ( \<epsilon> / 3 * real X / 2 ^ s f)"
       using assms(2) \<epsilon>_gt_0 \<epsilon>_lt_1
       unfolding E\<^sub>2_def by (intro add_mono mult_mono) auto
     also have "... = (7/9) * \<epsilon> * real X / 2^s f"
       using X_ge_1 by (subst abs_of_nonneg) auto
     also have "... \<le> 1 * \<epsilon> * real X / 2^s f"
       using \<epsilon>_gt_0 by (intro mult_mono divide_right_mono) auto
     also have "... =  \<epsilon> * real X / 2^s f" by simp
     finally have a:"\<bar>\<rho>_inv(p (f,g,h)) - X / 2 ^ (s f)\<bar> \<le> \<epsilon> * X / 2 ^ (s f)"
       by simp
 
     have "\<bar>Y (f, g, h) - real X\<bar> = \<bar>2 ^ (s f)\<bar> * \<bar>\<rho>_inv(p (f,g,h)) - real X / 2 ^ (s f)\<bar>"
       unfolding Y_def by (subst abs_mult[symmetric]) (simp add:algebra_simps powr_add[symmetric])
     also have "... \<le> 2 ^ (s f) * (\<epsilon> * X / 2 ^ (s f))"
       by (intro mult_mono a) auto
     also have "... = \<epsilon> * X"
       by (simp add:algebra_simps powr_add[symmetric])
     finally have "\<bar>Y (f, g, h) - real X\<bar> \<le> \<epsilon> * X" by simp
     moreover have "2 powr (\<lceil>log 2 (real X)\<rceil> - t f) \<le> 2 powr b_exp" (is "?L1 \<le> ?R1")
     proof -
       have "?L1 \<le> 2 powr (1 + log 2 (real X)- t f)"
         by (intro powr_mono, linarith) auto
       also have "... = 2 powr 1 * 2 powr (log 2 (real X)) * 2 powr (- t f)"
         unfolding powr_add[symmetric] by simp
       also have "... = 2 * (2 powr (-t f) * X)"
         using X_ge_1 by simp
       also have "... \<le> 2 * (b/2)"
         using assms(1) unfolding E\<^sub>1_def by (intro mult_left_mono) auto
       also have "... = b" by simp
       also have "... = ?R1"
         unfolding b_def by (simp add: powr_realpow)
       finally show ?thesis by simp
     qed
     hence "\<lceil>log 2 (real X)\<rceil> - t f \<le> real b_exp"
       unfolding not_less[symmetric] using powr_less_mono[where x="2"] by simp
     hence "s f \<ge> q_max" unfolding s_def q_max_def by (intro nat_mono) auto
     ultimately show "\<psi> \<notin> {(f, g, h). \<epsilon> * X < \<bar>Y (f, g, h) - real X\<bar> \<or> s f < q_max}"
       unfolding \<psi>_def by auto
   qed
   also have "... \<le>
     measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi> \<or> \<not>E\<^sub>2 \<psi> \<or> \<not>E\<^sub>3 \<psi>} + measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> E\<^sub>3 \<psi> \<and> \<not>E\<^sub>4 \<psi>}"
     by (intro pmf_add) auto
   also have "... \<le> (measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi> \<or> \<not>E\<^sub>2 \<psi>} + measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> E\<^sub>2 \<psi> \<and> \<not>E\<^sub>3 \<psi>}) + 1/2^6"
     by (intro add_mono e_4 pmf_add) auto
   also have "... \<le> ((measure \<Psi> {\<psi>. \<not>E\<^sub>1 \<psi>} + measure \<Psi> {\<psi>. E\<^sub>1 \<psi> \<and> \<not>E\<^sub>2 \<psi>}) + 1/2^6) + 1/2^6"
     by (intro add_mono e_3 pmf_add) auto
   also have "... \<le> ((1/2^6 + 1/2^6) + 1/2^6) + 1/2^6"
     by (intro add_mono e_2 e_1) auto
   also have "... = ?R" by simp
   finally show ?thesis by simp
 qed
 
 end
 
 end
diff --git a/thys/Frequency_Moments/Frequency_Moment_0.thy b/thys/Frequency_Moments/Frequency_Moment_0.thy
--- a/thys/Frequency_Moments/Frequency_Moment_0.thy
+++ b/thys/Frequency_Moments/Frequency_Moment_0.thy
@@ -1,1314 +1,1314 @@
 section \<open>Frequency Moment $0$\label{sec:f0}\<close>
 
 theory Frequency_Moment_0
   imports
     Frequency_Moments_Preliminary_Results
     Median_Method.Median 
     K_Smallest 
     Universal_Hash_Families.Carter_Wegman_Hash_Family
     Frequency_Moments
     Landau_Ext 
     Product_PMF_Ext
     Universal_Hash_Families.Universal_Hash_Families_More_Finite_Fields
 begin
 
 text \<open>This section contains a formalization of a new algorithm for the zero-th frequency moment
 inspired by ideas described in \<^cite>\<open>"baryossef2002"\<close>.
 It is a KMV-type ($k$-minimum value) algorithm with a rounding method and matches the space complexity 
 of the best algorithm described in \<^cite>\<open>"baryossef2002"\<close>.
 
 In addition to the Isabelle proof here, there is also an informal hand-written proof in
 Appendix~\ref{sec:f0_proof}.\<close>
 
 type_synonym f0_state = "nat \<times> nat \<times> nat \<times> nat \<times> (nat \<Rightarrow> nat list) \<times> (nat \<Rightarrow> float set)"
 
 definition hash where "hash p = ring.hash (mod_ring p)"
 
 fun f0_init :: "rat \<Rightarrow> rat \<Rightarrow> nat \<Rightarrow> f0_state pmf" where
   "f0_init \<delta> \<epsilon> n =
     do {
       let s = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil>;
       let t = nat \<lceil>80 / (real_of_rat \<delta>)\<^sup>2\<rceil>;
       let p = prime_above (max n 19);
       let r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23); 
       h \<leftarrow> prod_pmf {..<s} (\<lambda>_. pmf_of_set (bounded_degree_polynomials (mod_ring p) 2));
       return_pmf (s, t, p, r, h, (\<lambda>_ \<in> {0..<s}. {}))
     }"
 
 fun f0_update :: "nat \<Rightarrow> f0_state \<Rightarrow> f0_state pmf" where
   "f0_update x (s, t, p, r, h, sketch) = 
     return_pmf (s, t, p, r, h, \<lambda>i \<in> {..<s}.
       least t (insert (float_of (truncate_down r (hash p x (h i)))) (sketch i)))"
 
 fun f0_result :: "f0_state \<Rightarrow> rat pmf" where
   "f0_result (s, t, p, r, h, sketch) = return_pmf (median s (\<lambda>i \<in> {..<s}.
       (if card (sketch i) < t then of_nat (card (sketch i)) else
         rat_of_nat t* rat_of_nat p / rat_of_float (Max (sketch i)))
     ))"
 
 fun f0_space_usage :: "(nat \<times> rat \<times> rat) \<Rightarrow> real" where
   "f0_space_usage (n, \<epsilon>, \<delta>) = (
     let s = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil> in 
     let r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23) in
     let t = nat \<lceil>80 / (real_of_rat \<delta>)\<^sup>2 \<rceil> in
     6 +
     2 * log 2 (real s + 1) +
     2 * log 2 (real t + 1) +
     2 * log 2 (real n + 21) +
     2 * log 2 (real r + 1) +
     real s * (5 + 2 * log 2 (21 + real n) +
     real t * (13 + 4 * r + 2 * log 2 (log 2 (real n + 13)))))"
 
 definition encode_f0_state :: "f0_state \<Rightarrow> bool list option" where
   "encode_f0_state = 
     N\<^sub>e \<Join>\<^sub>e (\<lambda>s. 
     N\<^sub>e \<times>\<^sub>e (
     N\<^sub>e \<Join>\<^sub>e (\<lambda>p. 
     N\<^sub>e \<times>\<^sub>e ( 
     ([0..<s] \<rightarrow>\<^sub>e (P\<^sub>e p 2)) \<times>\<^sub>e
     ([0..<s] \<rightarrow>\<^sub>e (S\<^sub>e F\<^sub>e))))))"
 
 lemma "inj_on encode_f0_state (dom encode_f0_state)"
 proof -
   have "is_encoding encode_f0_state" 
     unfolding encode_f0_state_def
     by (intro dependent_encoding exp_golomb_encoding poly_encoding fun_encoding set_encoding float_encoding)
   thus ?thesis  by (rule encoding_imp_inj)
 qed
 
 context
   fixes \<epsilon> \<delta> :: rat
   fixes n :: nat
   fixes as :: "nat list"
   fixes result
   assumes \<epsilon>_range: "\<epsilon> \<in> {0<..<1}"
   assumes \<delta>_range: "\<delta> \<in> {0<..<1}"
   assumes as_range: "set as \<subseteq> {..<n}"
   defines "result \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n) \<bind> f0_result"
 begin  
 
 private definition t where "t = nat \<lceil>80 / (real_of_rat \<delta>)\<^sup>2\<rceil>"
 private lemma t_gt_0: "t > 0" using \<delta>_range by (simp add:t_def)
 
 private definition s where "s = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil>"
 private lemma s_gt_0: "s > 0" using \<epsilon>_range by (simp add:s_def)
 
 private definition p where "p = prime_above (max n 19)"
 
 private lemma p_prime:"Factorial_Ring.prime p"
   using p_def prime_above_prime by presburger
 
 private lemma p_ge_18: "p \<ge> 18"
 proof -
   have "p \<ge> 19" 
     by (metis p_def prime_above_lower_bound max.bounded_iff)
   thus ?thesis by simp
 qed
 
 private lemma p_gt_0: "p > 0" using p_ge_18 by simp
 private lemma p_gt_1: "p > 1" using p_ge_18 by simp
 
 private lemma n_le_p: "n \<le> p"
 proof -
   have "n \<le> max n 19" by simp
   also have "... \<le> p"
     unfolding p_def by (rule prime_above_lower_bound)
   finally show ?thesis by simp
 qed
 
 private lemma p_le_n: "p \<le> 2*n + 40"
 proof -
   have "p \<le> 2 * (max n 19) + 2"
     by (subst p_def, rule prime_above_upper_bound)
   also have "... \<le> 2 * n + 40"
     by (cases "n \<ge> 19", auto)
   finally show ?thesis by simp
 qed
 
 private lemma as_lt_p: "\<And>x. x \<in> set as \<Longrightarrow> x < p" 
   using as_range atLeastLessThan_iff
   by (intro order_less_le_trans[OF _ n_le_p]) blast
 
 private lemma as_subset_p: "set as \<subseteq> {..<p}"
    using as_lt_p  by (simp add: subset_iff)
 
 private definition r where "r = nat (4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23)"
 
 private lemma r_bound: "4 * log 2 (1 / real_of_rat \<delta>) + 23 \<le> r"
 proof -
   have "0 \<le> log 2 (1 / real_of_rat \<delta>)" using \<delta>_range by simp 
   hence "0 \<le> \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil>" by simp
   hence "0 \<le> 4 * \<lceil>log 2 (1 / real_of_rat \<delta>)\<rceil> + 23"
     by (intro add_nonneg_nonneg mult_nonneg_nonneg, auto)
   thus ?thesis by (simp add:r_def)
 qed
 
 private lemma r_ge_23: "r \<ge> 23"
 proof -
   have "(23::real) = 0 + 23" by simp
   also have "... \<le> 4 * log 2 (1 / real_of_rat \<delta>) + 23" 
     using \<delta>_range by (intro add_mono mult_nonneg_nonneg, auto) 
   also have "... \<le> r" using r_bound by simp
   finally show "23 \<le> r" by simp
 qed
 
 private lemma two_pow_r_le_1: "0 < 1 - 2 powr - real r"
 proof -
   have a: "2 powr (0::real) = 1"
     by simp
   show ?thesis using r_ge_23 
     by (simp, subst a[symmetric], intro powr_less_mono, auto)
 qed
 
 interpretation carter_wegman_hash_family "mod_ring p" 2
   rewrites "ring.hash (mod_ring p) = Frequency_Moment_0.hash p"
   using carter_wegman_hash_familyI[OF mod_ring_is_field mod_ring_finite]
   using hash_def p_prime by auto
 
 private definition tr_hash where "tr_hash x \<omega> = truncate_down r (hash x \<omega>)"
 
 private definition sketch_rv where
   "sketch_rv \<omega> = least t ((\<lambda>x. float_of (tr_hash x \<omega>)) ` set as)"
 
 private definition estimate 
    where "estimate S = (if card S < t then of_nat (card S) else of_nat t * of_nat p / rat_of_float (Max S))"
 
 private definition sketch_rv' where "sketch_rv' \<omega> = least t ((\<lambda>x. tr_hash x \<omega>) ` set as)"
 private definition estimate' where "estimate' S = (if card S < t then real (card S) else real t * real p / Max S)"
 
 private definition \<Omega>\<^sub>0 where "\<Omega>\<^sub>0 = prod_pmf {..<s} (\<lambda>_. pmf_of_set space)"
 
 private lemma f0_alg_sketch:
   defines "sketch \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n)"
   shows "sketch = map_pmf (\<lambda>x. (s,t,p,r, x, \<lambda>i \<in> {..<s}. sketch_rv (x i))) \<Omega>\<^sub>0" 
   unfolding sketch_rv_def 
 proof (subst sketch_def, induction as rule:rev_induct)
   case Nil
   then show ?case
     by (simp add:s_def p_def[symmetric] map_pmf_def t_def r_def Let_def least_def restrict_def space_def \<Omega>\<^sub>0_def)
 next
   case (snoc x xs)
   let ?sketch = "\<lambda>\<omega> xs. least t ((\<lambda>a. float_of (tr_hash a \<omega>)) ` set xs)"
   have "fold (\<lambda>a state. state \<bind> f0_update a) (xs @ [x]) (f0_init \<delta> \<epsilon> n) =
      (map_pmf (\<lambda>\<omega>. (s, t, p, r, \<omega>, \<lambda>i \<in> {..<s}. ?sketch (\<omega> i) xs)) \<Omega>\<^sub>0) \<bind> f0_update x"
     by (simp add: restrict_def snoc del:f0_init.simps)
   also have "... = \<Omega>\<^sub>0 \<bind> (\<lambda>\<omega>. f0_update x (s, t, p, r, \<omega>, \<lambda>i\<in>{..<s}. ?sketch (\<omega> i) xs)) "
     by (simp add:map_pmf_def bind_assoc_pmf bind_return_pmf del:f0_update.simps)
   also have "... = map_pmf (\<lambda>\<omega>. (s, t, p, r, \<omega>, \<lambda>i\<in>{..<s}. ?sketch (\<omega> i) (xs@[x]))) \<Omega>\<^sub>0"
     by (simp add:least_insert map_pmf_def tr_hash_def cong:restrict_cong)
   finally show ?case by blast
 qed
 
 private lemma card_nat_in_ball:
   fixes x :: nat
   fixes q :: real
   assumes "q \<ge> 0"
   defines "A \<equiv> {k. abs (real x - real k) \<le> q \<and> k \<noteq> x}"
   shows "real (card A) \<le> 2 * q" and "finite A"
 proof -
   have a: "of_nat x \<in> {\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>}"
     using assms 
     by (simp add: ceiling_le_iff)
 
   have "card A = card (int ` A)"
     by (rule card_image[symmetric], simp)
   also have "... \<le> card ({\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>} - {of_nat x})"
     by (intro card_mono image_subsetI, simp_all add:A_def abs_le_iff, linarith)
   also have "... = card {\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>} - 1"
     by (rule card_Diff_singleton, rule a)
   also have "... = int (card {\<lceil>real x-q\<rceil>..\<lfloor>real x+q\<rfloor>}) - int 1"
     by (intro of_nat_diff)
      (metis a card_0_eq empty_iff finite_atLeastAtMost_int less_one linorder_not_le)
   also have "... \<le> \<lfloor>q+real x\<rfloor>+1 -\<lceil>real x-q\<rceil> - 1"
     using assms by (simp, linarith)
   also have "... \<le> 2*q"
     by linarith
   finally show "card A \<le> 2 * q"
     by simp
 
   have "A \<subseteq> {..x + nat \<lceil>q\<rceil>}"
     by (rule subsetI, simp add:A_def abs_le_iff, linarith)
   thus "finite A"
     by (rule finite_subset, simp)
 qed
 
 private lemma prob_degree_lt_1:
    "prob {\<omega>. degree \<omega> < 1} \<le> 1/real p" 
 proof -
   have "space \<inter> {\<omega>. length \<omega> \<le> Suc 0} = bounded_degree_polynomials (mod_ring p) 1"
     by (auto simp:set_eq_iff bounded_degree_polynomials_def space_def)
   moreover have "field_size = p" by (simp add:mod_ring_def)
   hence "real (card (bounded_degree_polynomials (mod_ring p) (Suc 0))) / real (card space) = 1 / real p"
     by (simp add:space_def bounded_degree_polynomials_card power2_eq_square)
   ultimately show ?thesis
     by (simp add:M_def measure_pmf_of_set)
 qed
 
 private lemma collision_prob:
   assumes "c \<ge> 1"
   shows "prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le> 
     (5/2) * (real (card (set as)))\<^sup>2 * c\<^sup>2 * 2 powr -(real r) / (real p)\<^sup>2 + 1/real p" (is "prob {\<omega>. ?l \<omega>} \<le> ?r1 + ?r2")
 proof -
   define \<rho> :: real where "\<rho> = 9/8"
 
   have rho_c_ge_0: "\<rho> * c \<ge> 0" unfolding \<rho>_def using assms by simp 
 
   have c_ge_0: "c\<ge>0" using assms by simp
   
   have "degree \<omega> \<ge> 1 \<Longrightarrow> \<omega> \<in> space \<Longrightarrow> degree \<omega> = 1" for \<omega>
     by (simp add:bounded_degree_polynomials_def space_def) 
      (metis One_nat_def Suc_1 le_less_Suc_eq less_imp_diff_less list.size(3) pos2)
 
   hence a: "\<And>\<omega> x y. x < p \<Longrightarrow> y < p \<Longrightarrow>  x \<noteq> y \<Longrightarrow> degree \<omega> \<ge> 1 \<Longrightarrow> \<omega> \<in> space \<Longrightarrow>  hash x \<omega> \<noteq> hash y \<omega>" 
     using inj_onD[OF inj_if_degree_1]  mod_ring_carr by blast 
 
   have b: "prob {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le> 5 * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2"
     if b_assms: "x \<in> set as"  "y \<in> set as"  "x < y" for x y
   proof -
     have c: "real u \<le> \<rho> * c \<and> \<bar>real u - real v\<bar> \<le> \<rho> * c * 2 powr (-real r)"
       if c_assms:"truncate_down r (real u) \<le> c" "truncate_down r (real u) = truncate_down r (real v)" for u v
     proof -
       have "9 * 2 powr - real r \<le> 9 * 2 powr (- real 23)" 
         using r_ge_23 by (intro mult_left_mono powr_mono, auto)
 
       also have "... \<le> 1" by simp
 
       finally have "9 * 2 powr - real r \<le> 1" by simp
 
       hence "1 \<le> \<rho> * (1 - 2 powr (- real r))" 
         by (simp add:\<rho>_def)
 
       hence d: "(c*1) / (1 - 2 powr (-real r)) \<le> c * \<rho>" 
         using assms two_pow_r_le_1 by (simp add: pos_divide_le_eq)
 
       have "\<And>x. truncate_down r (real x) \<le> c \<Longrightarrow> real x * (1 - 2 powr - real r) \<le> c * 1" 
         using  truncate_down_pos[OF of_nat_0_le_iff] order_trans by (simp, blast)
 
       hence "\<And>x. truncate_down r (real x) \<le>  c  \<Longrightarrow> real x \<le> c * \<rho>"
         using two_pow_r_le_1 by (intro order_trans[OF _ d], simp add: pos_le_divide_eq) 
 
       hence e: "real u \<le> c * \<rho>" "real v \<le> c * \<rho>" 
         using c_assms by auto
 
       have " \<bar>real u - real v\<bar> \<le> (max \<bar>real u\<bar> \<bar>real v\<bar>) * 2 powr (-real r)"
         using c_assms by (intro truncate_down_eq, simp)
 
       also have "... \<le> (c * \<rho>) * 2 powr (-real r)"
         using e by (intro mult_right_mono, auto)
 
       finally have "\<bar>real u - real v\<bar> \<le> \<rho> * c * 2 powr (-real r)"
         by (simp add:algebra_simps)
 
       thus ?thesis using e by (simp add:algebra_simps)
     qed
 
     have "prob {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash x \<omega> \<le> c \<and> tr_hash x \<omega> = tr_hash y \<omega>} \<le>
       prob (\<Union> i \<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and> truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}.
       {\<omega>.  hash x \<omega> = fst i \<and> hash y \<omega> = snd i})"
       using a by (intro pmf_mono[OF M_def], simp add:tr_hash_def) 
        (metis hash_range mod_ring_carr b_assms as_subset_p lessThan_iff nat_neq_iff subset_eq) 
 
     also have "... \<le> (\<Sum> i\<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and>
       truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}. 
       prob {\<omega>. hash x \<omega> = fst i \<and> hash  y \<omega> = snd i})"
       by (intro measure_UNION_le finite_cartesian_product finite_subset[where B="{0..<p} \<times> {0..<p}"])
        (auto simp add:M_def)
 
     also have "... \<le> (\<Sum> i\<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and>
       truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}. 
       prob {\<omega>. (\<forall>u \<in> {x,y}. hash u \<omega> = (if u = x then (fst i) else (snd i)))})" 
       by (intro sum_mono  pmf_mono[OF M_def]) force
 
     also have "... \<le> (\<Sum> i\<in> {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and>
       truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}. 1/(real p)\<^sup>2)"
       using assms as_subset_p b_assms
       by (intro sum_mono, subst hash_prob)  (auto simp add: mod_ring_def power2_eq_square)
 
     also have "... = 1/(real p)\<^sup>2 * 
       card {(u,v) \<in> {0..<p} \<times> {0..<p}. u \<noteq> v \<and> truncate_down r u \<le> c \<and> truncate_down r u = truncate_down r v}"
       by simp
 
     also have "... \<le> 1/(real p)\<^sup>2 * 
       card {(u,v) \<in> {..<p} \<times> {..<p}. u \<noteq> v \<and> real u \<le> \<rho> * c \<and> abs (real u - real v) \<le> \<rho> * c * 2 powr (-real r)}"
       using c
       by (intro mult_mono of_nat_mono card_mono finite_cartesian_product finite_subset[where B="{..<p}\<times>{..<p}"])
         auto
 
     also have "... \<le> 1/(real p)\<^sup>2 * card (\<Union>u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
         {(u::nat,v::nat). u = u' \<and> abs (real u - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'})"
       by (intro mult_left_mono of_nat_mono card_mono finite_cartesian_product finite_subset[where B="{..<p}\<times>{..<p}"])
        auto
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       card  {(u,v). u = u' \<and> abs (real u - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'})"
       by (intro mult_left_mono of_nat_mono card_UN_le, auto)
 
     also have "... = 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and>  real u \<le> \<rho> * c}.
       card ((\<lambda>x. (u' ,x)) ` {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'}))"
       by (intro arg_cong2[where f="(*)"] arg_cong[where f="real"] sum.cong arg_cong[where f="card"])
        (auto simp add:set_eq_iff)
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       card {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v < p \<and> v \<noteq> u'})"
       by (intro mult_left_mono of_nat_mono sum_mono card_image_le, auto)
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       card {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v \<noteq> u'})"
       by (intro mult_left_mono sum_mono of_nat_mono card_mono card_nat_in_ball subsetI)  auto
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}.
       real (card {v. abs (real u' - real v) \<le> \<rho> * c * 2 powr (-real r) \<and> v \<noteq> u'}))"
       by simp
 
     also have "... \<le> 1/(real p)\<^sup>2 * (\<Sum> u' \<in> {u. u < p \<and> real u \<le> \<rho> * c}. 2 * (\<rho> * c * 2 powr (-real r)))"
       by (intro mult_left_mono sum_mono card_nat_in_ball(1), auto)
 
     also have "... =  1/(real p)\<^sup>2 * (real (card {u. u < p \<and> real u \<le> \<rho> * c}) * (2 * (\<rho> * c * 2 powr (-real r))))"
       by simp
 
     also have "... \<le>  1/(real p)\<^sup>2 * (real (card {u. u \<le> nat (\<lfloor>\<rho> * c \<rfloor>)}) * (2 * (\<rho> * c * 2 powr (-real r))))"
       using rho_c_ge_0 le_nat_floor
       by (intro mult_left_mono mult_right_mono of_nat_mono card_mono subsetI) auto
 
     also have "... \<le>  1/(real p)\<^sup>2 * ((1+\<rho> * c) * (2 * (\<rho> * c * 2 powr (-real r))))"
       using rho_c_ge_0 by (intro mult_left_mono mult_right_mono, auto)
 
     also have "... \<le>  1/(real p)\<^sup>2 * (((1+\<rho>) * c) * (2 * (\<rho> * c * 2 powr (-real r))))" 
       using assms by (intro mult_mono, auto simp add:distrib_left distrib_right \<rho>_def)
 
     also have "... = (\<rho> * (2 + \<rho> * 2)) * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2"
       by (simp add:ac_simps power2_eq_square) 
 
     also have "... \<le> 5 * c\<^sup>2 *  2 powr (-real r) /(real p)\<^sup>2"
       by (intro divide_right_mono mult_right_mono) (auto simp add:\<rho>_def)
 
     finally show ?thesis by simp
   qed
 
   have "prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} \<le> 
     prob (\<Union> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash (fst i) \<omega> \<le> c \<and>
     tr_hash (fst i) \<omega> = tr_hash (snd i) \<omega>})"
     by (rule pmf_mono[OF M_def], simp, metis linorder_neqE_nat)
 
   also have "... \<le> (\<Sum> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. prob 
     {\<omega>. degree \<omega> \<ge> 1 \<and> tr_hash  (fst i) \<omega> \<le> c \<and> tr_hash (fst i) \<omega> = tr_hash (snd i) \<omega>})"
     unfolding M_def
     by (intro measure_UNION_le finite_cartesian_product finite_subset[where B="(set as) \<times> (set as)"])
       auto
 
   also have "... \<le> (\<Sum> i \<in> {(x,y) \<in> (set as) \<times> (set as). x < y}. 5  * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2)"
     using b by (intro sum_mono, simp add:case_prod_beta)
 
   also have "... =  ((5/2) * c\<^sup>2  * 2 powr (-real r) /(real p)\<^sup>2) * (2 * card  {(x,y) \<in> (set as) \<times> (set as). x < y})"
     by simp
 
   also have "... =  ((5/2) * c\<^sup>2  * 2 powr (-real r) /(real p)\<^sup>2) * (card (set as) * (card (set as) - 1))"
     by (subst card_ordered_pairs, auto) 
 
   also have "... \<le> ((5/2) * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2) * (real (card (set as)))\<^sup>2"
     by (intro mult_left_mono) (auto simp add:power2_eq_square mult_left_mono)
 
   also have "... = (5/2) * (real (card (set as)))\<^sup>2 * c\<^sup>2 * 2 powr (-real r) /(real p)\<^sup>2"
     by (simp add:algebra_simps)
 
   finally have f:"prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} \<le> ?r1" by simp
 
   have "prob {\<omega>. ?l \<omega>} \<le> prob {\<omega>. ?l \<omega> \<and> degree \<omega> \<ge> 1} + prob {\<omega>. degree \<omega> < 1}"
     by (rule pmf_add[OF M_def], auto)
   also have "... \<le> ?r1 + ?r2"
     by (intro add_mono f prob_degree_lt_1)
   finally show ?thesis by simp
 qed
 
 private lemma of_bool_square: "(of_bool x)\<^sup>2 = ((of_bool x)::real)"
   by (cases x, auto)
 
 private definition Q where "Q y \<omega> = card {x \<in> set as. int (hash x \<omega>) < y}"
 
 private definition m where "m = card (set as)"
 
 private lemma
   assumes "a \<ge> 0"
   assumes "a \<le> int p"
   shows exp_Q: "expectation (\<lambda>\<omega>. real (Q a \<omega>)) = real m * (of_int a) / p"
   and var_Q: "variance (\<lambda>\<omega>. real (Q a \<omega>)) \<le> real m * (of_int a) / p"
 proof -
   have exp_single: "expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)) = real_of_int a /real p"
     if a:"x \<in> set as" for x
   proof -
     have x_le_p: "x < p" using a as_lt_p by simp
     have "expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)) = expectation (indicat_real {\<omega>. int (Frequency_Moment_0.hash p x \<omega>) < a})"
       by (intro arg_cong2[where f="integral\<^sup>L"] ext, simp_all)
     also have "... = prob {\<omega>. hash x \<omega> \<in> {k. int k < a}}"
       by (simp add:M_def)
     also have "... = card ({k. int k < a} \<inter> {..<p}) / real p"
       by (subst prob_range, simp_all add: x_le_p mod_ring_def)
     also have "... = card {..<nat a} / real p"
       using assms by (intro arg_cong2[where f="(/)"] arg_cong[where f="real"] arg_cong[where f="card"])
        (auto simp add:set_eq_iff) 
     also have "... =  real_of_int a/real p"
       using assms by simp
     finally show "expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)) = real_of_int a /real p"
       by simp
   qed
 
   have "expectation(\<lambda>\<omega>. real (Q a \<omega>)) = expectation (\<lambda>\<omega>. (\<Sum>x \<in> set as. of_bool (int (hash x \<omega>) < a)))"
     by (simp add:Q_def Int_def)
   also have "... =  (\<Sum>x \<in> set as. expectation (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)))"
     by (rule Bochner_Integration.integral_sum, simp)
   also have "... = (\<Sum> x \<in> set as. a /real p)"
     by (rule sum.cong, simp, subst exp_single, simp, simp)
   also have "... = real m *  real_of_int a / real p"
     by (simp add:m_def)
   finally show "expectation (\<lambda>\<omega>. real (Q a \<omega>)) = real m * real_of_int a / p" by simp
 
   have indep: "J \<subseteq> set as \<Longrightarrow> card J = 2 \<Longrightarrow> indep_vars (\<lambda>_. borel) (\<lambda>i x. of_bool (int (hash i x) < a)) J" for J
     using as_subset_p mod_ring_carr
     by (intro indep_vars_compose2[where Y="\<lambda>i x. of_bool (int x < a)" and M'="\<lambda>_. discrete"]
         k_wise_indep_vars_subset[OF k_wise_indep] finite_subset[OF _ finite_set]) auto
 
   have rv: "\<And>x. x \<in> set as \<Longrightarrow> random_variable borel (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a))"
      by (simp add:M_def)
 
   have "variance (\<lambda>\<omega>. real (Q a \<omega>)) = variance (\<lambda>\<omega>. (\<Sum>x \<in> set as. of_bool (int (hash x \<omega>) < a)))"
     by (simp add:Q_def Int_def)
   also have "... = (\<Sum>x \<in> set as. variance (\<lambda>\<omega>. of_bool (int (hash x \<omega>) < a)))"
-    by (intro var_sum_pairwise_indep_2 indep rv) auto
+    by (intro bienaymes_identity_pairwise_indep_2 indep rv) auto
   also have "... \<le> (\<Sum> x \<in> set as. a / real p)"
     by (rule sum_mono, simp add: variance_eq of_bool_square, simp add: exp_single)
   also have "... = real m * real_of_int a /real p"
     by (simp add:m_def)
   finally show "variance (\<lambda>\<omega>. real (Q a \<omega>)) \<le> real m * real_of_int a / p"
     by simp
 qed
 
 private lemma t_bound: "t \<le> 81 / (real_of_rat \<delta>)\<^sup>2"
 proof -
   have "t \<le> 80 / (real_of_rat \<delta>)\<^sup>2 + 1" using t_def t_gt_0 by linarith
   also have "... \<le> 80 / (real_of_rat \<delta>)\<^sup>2 + 1 /  (real_of_rat \<delta>)\<^sup>2"
     using \<delta>_range by (intro add_mono, simp, simp add:power_le_one)
   also have "... = 81 / (real_of_rat \<delta>)\<^sup>2" by simp
   finally show ?thesis by simp
 qed
 
 private lemma t_r_bound:
   "18 * 40 * (real t)\<^sup>2 * 2 powr (-real r) \<le> 1"
 proof -
   have "720 * (real t)\<^sup>2 * 2 powr (-real r) \<le> 720 * (81 / (real_of_rat \<delta>)\<^sup>2)\<^sup>2 * 2 powr (-4 * log 2 (1 / real_of_rat \<delta>) - 23)"
     using r_bound t_bound by (intro mult_left_mono mult_mono power_mono powr_mono, auto)
 
   also have "... \<le> 720 * (81 / (real_of_rat \<delta>)\<^sup>2)\<^sup>2 * (2 powr (-4 * log 2 (1 / real_of_rat \<delta>)) * 2 powr (-23))"
     using \<delta>_range by (intro mult_left_mono mult_mono power_mono add_mono)
      (simp_all add:power_le_one powr_diff)
 
   also have "... = 720 * (81\<^sup>2 / (real_of_rat \<delta>)^4) * (2 powr (log 2 ((real_of_rat \<delta>)^4))  * 2 powr (-23))"
     using \<delta>_range by (intro arg_cong2[where f="(*)"])
       (simp_all add:power2_eq_square power4_eq_xxxx log_divide log_powr[symmetric])
 
   also have "... = 720 * 81\<^sup>2 * 2 powr (-23)" using \<delta>_range by simp
 
   also have "... \<le> 1" by simp
 
   finally show ?thesis by simp
 qed
 
 private lemma m_eq_F_0: "real m = of_rat (F 0 as)"
   by (simp add:m_def F_def)
 
 private lemma estimate'_bounds:
   "prob {\<omega>. of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le> 1/3"
 proof (cases "card (set as) \<ge> t")
   case True
   define \<delta>' where "\<delta>' = 3 * real_of_rat \<delta> / 4"
   define u where "u = \<lceil>real t * p / (m * (1+\<delta>'))\<rceil>"
   define v where "v = \<lfloor>real t * p / (m * (1-\<delta>'))\<rfloor>"
 
   define has_no_collision where 
     "has_no_collision = (\<lambda>\<omega>. \<forall>x\<in> set as. \<forall>y \<in> set as. (tr_hash x \<omega> = tr_hash y \<omega> \<longrightarrow> x = y) \<or> tr_hash x \<omega> > v)"
 
   have "2 powr (-real r) \<le> 2 powr (-(4 * log 2 (1 / real_of_rat \<delta>) + 23))"
     using r_bound by (intro powr_mono, linarith, simp)
   also have "... = 2 powr (-4 * log 2 (1 /real_of_rat \<delta>) -23)"
     by (rule arg_cong2[where f="(powr)"], auto simp add:algebra_simps)
   also have "... \<le> 2 powr ( -1 * log 2 (1 /real_of_rat \<delta>) -4)"
     using \<delta>_range by (intro powr_mono diff_mono, auto)
   also have "... = 2 powr ( -1 * log 2 (1 /real_of_rat \<delta>)) /  16"
     by (simp add: powr_diff)
   also have "... = real_of_rat \<delta> / 16"
     using \<delta>_range by (simp add:log_divide)
   also have "... < real_of_rat \<delta> / 8"
     using \<delta>_range by (subst pos_divide_less_eq, auto)
   finally have r_le_\<delta>: "2 powr (-real r) < real_of_rat \<delta> / 8"
     by simp
 
   have \<delta>'_gt_0: "\<delta>' > 0" using \<delta>_range by (simp add:\<delta>'_def)
   have "\<delta>' < 3/4" using \<delta>_range by (simp add:\<delta>'_def)+
   also have "... < 1" by simp
   finally have \<delta>'_lt_1: "\<delta>' < 1" by simp
 
   have "t \<le> 81 / (real_of_rat \<delta>)\<^sup>2"
     using t_bound by simp
   also have "... = (81*9/16) / (\<delta>')\<^sup>2"
     by (simp add:\<delta>'_def power2_eq_square)
   also have "... \<le> 46 / \<delta>'\<^sup>2"
     by (intro divide_right_mono, simp, simp)
   finally have t_le_\<delta>': "t \<le> 46/ \<delta>'\<^sup>2" by simp
 
   have "80 \<le> (real_of_rat \<delta>)\<^sup>2 * (80 / (real_of_rat \<delta>)\<^sup>2)" using \<delta>_range by simp
   also have "... \<le> (real_of_rat \<delta>)\<^sup>2 * t"
     by (intro mult_left_mono, simp add:t_def of_nat_ceiling, simp)
   finally have "80 \<le> (real_of_rat \<delta>)\<^sup>2 * t" by simp
   hence t_ge_\<delta>': "45 \<le> t * \<delta>' * \<delta>'" by (simp add:\<delta>'_def power2_eq_square)
 
   have "m \<le> card {..<n}" unfolding m_def using as_range by (intro card_mono, auto)
   also have "... \<le> p" using n_le_p by simp
   finally have m_le_p: "m \<le> p" by simp
 
   hence t_le_m: "t \<le> card (set as)" using True by simp
   have m_ge_0: "real m > 0" using m_def True t_gt_0 by simp
 
   have "v \<le> real t * real p / (real m * (1 - \<delta>'))" by (simp add:v_def)
 
   also have "... \<le> real t * real p / (real m * (1/4))"
     using \<delta>'_lt_1 m_ge_0 \<delta>_range
     by (intro divide_left_mono mult_left_mono mult_nonneg_nonneg mult_pos_pos, simp_all add:\<delta>'_def)
 
   finally have v_ubound: "v \<le> 4 * real t * real p / real m" by (simp add:algebra_simps)
 
   have a_ge_1: "u \<ge> 1" using \<delta>'_gt_0 p_gt_0 m_ge_0 t_gt_0
     by (auto intro!:mult_pos_pos divide_pos_pos simp add:u_def) 
   hence a_ge_0: "u \<ge> 0" by simp
   have "real m * (1 - \<delta>') < real m" using \<delta>'_gt_0 m_ge_0 by simp
   also have "... \<le> 1 * real p" using m_le_p by simp
   also have "... \<le> real t * real p" using t_gt_0 by (intro mult_right_mono, auto)
   finally have " real m * (1 - \<delta>') < real t * real p" by simp
   hence v_gt_0: "v > 0" using mult_pos_pos m_ge_0 \<delta>'_lt_1 by (simp add:v_def)
   hence v_ge_1: "real_of_int v \<ge> 1" by linarith
 
   have "real t \<le> real m" using True m_def by linarith
   also have "... < (1 + \<delta>') * real m" using \<delta>'_gt_0 m_ge_0 by force
   finally have a_le_p_aux: "real t < (1 + \<delta>') * real m"  by simp
 
   have "u \<le> real t * real p / (real m * (1 + \<delta>'))+1" by (simp add:u_def)
   also have "... < real p + 1" 
     using m_ge_0 \<delta>'_gt_0 a_le_p_aux  a_le_p_aux p_gt_0
     by (simp add: pos_divide_less_eq ac_simps) 
   finally have "u \<le> real p" 
     by (metis int_less_real_le not_less of_int_le_iff of_int_of_nat_eq)
   hence u_le_p: "u \<le> int p" by linarith
 
   have "prob {\<omega>. Q u \<omega> \<ge> t} \<le> prob {\<omega> \<in> Sigma_Algebra.space M. abs (real (Q u \<omega>) - 
     expectation (\<lambda>\<omega>. real (Q u \<omega>))) \<ge> 3 * sqrt (m * real_of_int u / p)}"
   proof (rule pmf_mono[OF M_def])
     fix \<omega>
     assume "\<omega> \<in> {\<omega>. t \<le> Q u \<omega>}"
     hence t_le: "t \<le> Q u \<omega>" by simp
     have "real m * real_of_int u / real p \<le> real m * (real t * real p / (real m * (1 + \<delta>'))+1) / real p"
       using m_ge_0 p_gt_0 by (intro divide_right_mono mult_left_mono, simp_all add: u_def)
     also have "... = real m * real t * real p / (real m * (1+\<delta>') * real p) + real m / real p"
       by (simp add:distrib_left add_divide_distrib)
     also have "... = real t / (1+\<delta>') + real m / real p"
       using p_gt_0 m_ge_0 by simp
     also have "... \<le> real t / (1+\<delta>') + 1"
       using m_le_p p_gt_0 by (intro add_mono, auto)
     finally have "real m * real_of_int u / real p \<le> real t / (1 + \<delta>') + 1"
       by simp
 
     hence "3 * sqrt (real m * of_int u / real p) + real m * of_int u / real p \<le> 
       3 * sqrt (t / (1+\<delta>')+1)+(t/(1+\<delta>')+1)"
       by (intro add_mono mult_left_mono real_sqrt_le_mono, auto)
     also have "... \<le> 3 * sqrt (real t+1) + ((t * (1 - \<delta>' / (1+\<delta>'))) + 1)"
       using \<delta>'_gt_0 t_gt_0 by (intro add_mono mult_left_mono real_sqrt_le_mono)
         (simp_all add: pos_divide_le_eq left_diff_distrib)
     also have "... = 3 * sqrt (real t+1) + (t - \<delta>' * t / (1+\<delta>')) + 1" by (simp add:algebra_simps)
     also have "... \<le> 3 * sqrt (46 / \<delta>'\<^sup>2 + 1 / \<delta>'\<^sup>2) + (t - \<delta>' * t/2) + 1 / \<delta>'"
       using \<delta>'_gt_0 t_gt_0 \<delta>'_lt_1 add_pos_pos  t_le_\<delta>'
       by (intro add_mono mult_left_mono real_sqrt_le_mono add_mono)
        (simp_all add: power_le_one pos_le_divide_eq)
     also have "... \<le> (21 / \<delta>' + (t - 45 / (2*\<delta>'))) + 1 / \<delta>'" 
       using \<delta>'_gt_0 t_ge_\<delta>' by (intro add_mono)
          (simp_all add:real_sqrt_divide divide_le_cancel real_le_lsqrt pos_divide_le_eq ac_simps)
     also have "... \<le> t" using \<delta>'_gt_0 by simp
     also have "... \<le> Q u \<omega>" using t_le by simp
     finally have "3 * sqrt (real m * of_int u / real p) + real m * of_int u / real p \<le> Q u \<omega>"
       by simp
     hence " 3 * sqrt (real m * real_of_int u / real p) \<le> \<bar>real (Q u \<omega>) - expectation (\<lambda>\<omega>. real (Q u \<omega>))\<bar>"
       using a_ge_0 u_le_p  True by (simp add:exp_Q abs_ge_iff)
 
     thus "\<omega> \<in> {\<omega> \<in> Sigma_Algebra.space M. 3 * sqrt (real m * real_of_int u / real p) \<le> 
       \<bar>real (Q u \<omega>) - expectation (\<lambda>\<omega>. real (Q u \<omega>))\<bar>}"
       by (simp add: M_def)
   qed
   also have "... \<le> variance  (\<lambda>\<omega>. real (Q u \<omega>)) / (3 * sqrt (real m * of_int u / real p))\<^sup>2"
     using a_ge_1 p_gt_0 m_ge_0 
     by (intro Chebyshev_inequality, simp add:M_def, auto) 
 
   also have "... \<le> (real m * real_of_int u / real p) / (3 * sqrt (real m * of_int u / real p))\<^sup>2"
     using a_ge_0 u_le_p by (intro divide_right_mono var_Q, auto)
 
   also have "... \<le> 1/9" using a_ge_0 by simp
 
   finally have case_1: "prob {\<omega>. Q u \<omega> \<ge> t} \<le> 1/9" by simp
 
   have case_2: "prob {\<omega>. Q v \<omega> < t} \<le> 1/9"
   proof (cases "v \<le> p")
     case True
     have "prob {\<omega>. Q v \<omega> < t} \<le> prob {\<omega> \<in> Sigma_Algebra.space M. abs (real (Q v \<omega>) - expectation (\<lambda>\<omega>. real (Q v \<omega>))) 
       \<ge> 3 * sqrt (m * real_of_int v / p)}"
     proof (rule pmf_mono[OF M_def])
       fix \<omega>
       assume "\<omega> \<in> set_pmf (pmf_of_set space)"
       have "(real t + 3 * sqrt (real t / (1 - \<delta>') )) * (1 - \<delta>') = real t - \<delta>' * t + 3 * ((1-\<delta>') * sqrt( real t / (1-\<delta>') ))"
         by (simp add:algebra_simps)
 
       also have "... = real t - \<delta>' * t + 3 * sqrt (  (1-\<delta>')\<^sup>2 * (real t /  (1-\<delta>')))"
         using \<delta>'_lt_1 by (subst real_sqrt_mult, simp)
 
       also have "... = real t - \<delta>' * t + 3 * sqrt ( real t * (1- \<delta>'))"
         by (simp add:power2_eq_square distrib_left)
 
       also have "... \<le> real t - 45/ \<delta>' + 3 * sqrt ( real t )"
         using \<delta>'_gt_0 t_ge_\<delta>' \<delta>'_lt_1 by (intro add_mono mult_left_mono real_sqrt_le_mono)
          (simp_all add:pos_divide_le_eq ac_simps left_diff_distrib power_le_one)
 
        also have "... \<le> real t - 45/ \<delta>' + 3 * sqrt ( 46 / \<delta>'\<^sup>2)"
          using  t_le_\<delta>' \<delta>'_lt_1 \<delta>'_gt_0
          by (intro add_mono mult_left_mono real_sqrt_le_mono, simp_all add:pos_divide_le_eq power_le_one)
 
       also have "... = real t + (3 * sqrt(46) - 45)/ \<delta>'"
         using \<delta>'_gt_0 by (simp add:real_sqrt_divide diff_divide_distrib)
 
       also have "... \<le> t"
         using \<delta>'_gt_0 by (simp add:pos_divide_le_eq real_le_lsqrt)
 
       finally have aux: "(real t + 3 * sqrt (real t / (1 - \<delta>'))) * (1 - \<delta>') \<le> real t "
         by simp
 
       assume "\<omega> \<in> {\<omega>. Q v \<omega> < t}"
       hence "Q v \<omega> < t" by simp
 
       hence "real (Q v \<omega>) + 3 * sqrt (real m * real_of_int v / real p) 
         \<le> real t - 1 + 3 * sqrt (real m * real_of_int v / real p)"
         using m_le_p p_gt_0 by (intro add_mono, auto simp add: algebra_simps add_divide_distrib)
 
       also have "... \<le> (real t-1) + 3 * sqrt (real m * (real t * real p / (real m * (1- \<delta>'))) / real p)"
         by (intro add_mono mult_left_mono real_sqrt_le_mono divide_right_mono)
          (auto simp add:v_def)
 
       also have "... \<le> real t + 3 * sqrt(real t / (1-\<delta>')) - 1"
         using m_ge_0 p_gt_0 by simp
 
       also have "... \<le> real t / (1-\<delta>')-1" 
         using \<delta>'_lt_1 aux by (simp add: pos_le_divide_eq)   
       also have "... \<le> real m * (real t * real p / (real m * (1-\<delta>'))) / real p - 1"
         using p_gt_0 m_ge_0 by simp
       also have "... \<le> real m * (real t * real p / (real m * (1-\<delta>'))) / real p - real m / real p"
           using m_le_p p_gt_0
           by (intro diff_mono, auto)
       also have "... = real m * (real t * real p / (real m * (1-\<delta>'))-1) / real p" 
           by (simp add: left_diff_distrib right_diff_distrib diff_divide_distrib)
       also have "... \<le>  real m * real_of_int v / real p"      
         by (intro divide_right_mono mult_left_mono, simp_all add:v_def)
 
       finally have "real (Q v \<omega>) + 3 * sqrt (real m * real_of_int v / real p) 
         \<le> real m * real_of_int v / real p" by simp
 
       hence " 3 * sqrt (real m * real_of_int v / real p) \<le> \<bar>real (Q v \<omega>) -expectation (\<lambda>\<omega>. real (Q v \<omega>))\<bar>"  
         using v_gt_0 True by (simp add: exp_Q abs_ge_iff)
 
       thus "\<omega> \<in> {\<omega>\<in> Sigma_Algebra.space M. 3 * sqrt (real m * real_of_int v / real p) \<le> 
         \<bar>real (Q v \<omega>) - expectation (\<lambda>\<omega>. real (Q v \<omega>))\<bar>}" 
         by (simp add:M_def)
     qed
     also have "... \<le> variance (\<lambda>\<omega>. real (Q v \<omega>)) / (3 * sqrt (real m * real_of_int v / real p))\<^sup>2" 
       using v_gt_0 p_gt_0 m_ge_0 
       by (intro Chebyshev_inequality, simp add:M_def, auto)
 
     also have "... \<le> (real m * real_of_int v / real p) / (3 * sqrt (real m * real_of_int v / real p))\<^sup>2"
       using  v_gt_0 True  by (intro divide_right_mono var_Q, auto)
 
     also have "... = 1/9"
       using p_gt_0 v_gt_0 m_ge_0 by (simp add:power2_eq_square)
 
     finally show ?thesis by simp
   next
     case False
     have "prob {\<omega>. Q v \<omega> < t} \<le> prob {\<omega>. False}"
     proof (rule pmf_mono[OF M_def])
       fix \<omega>
       assume a:"\<omega> \<in> {\<omega>. Q v \<omega> < t}"
       assume "\<omega> \<in> set_pmf (pmf_of_set space)"
       hence b:"\<And>x. x < p \<Longrightarrow> hash x \<omega> < p" 
         using hash_range mod_ring_carr by (simp add:M_def measure_pmf_inverse) 
       have "t \<le> card (set as)" using True by simp
       also have "... \<le> Q v \<omega>"
         unfolding Q_def  using b False as_lt_p by (intro card_mono subsetI, simp, force) 
       also have "... < t" using a by simp
       finally have "False" by auto
       thus "\<omega> \<in> {\<omega>. False}" by simp
     qed
     also have "... = 0" by auto
     finally show ?thesis by simp
   qed
 
   have "prob {\<omega>. \<not>has_no_collision \<omega>} \<le>
     prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real_of_int v \<and> tr_hash x \<omega> = tr_hash y \<omega>}"
     by (rule pmf_mono[OF M_def]) (simp add:has_no_collision_def M_def, force) 
 
   also have "... \<le> (5/2) * (real (card (set as)))\<^sup>2 * (real_of_int v)\<^sup>2 * 2 powr - real r / (real p)\<^sup>2 + 1 / real p"
     using collision_prob v_ge_1 by blast
 
   also have "... \<le> (5/2) * (real m)\<^sup>2 * (real_of_int v)\<^sup>2 * 2 powr - real r / (real p)\<^sup>2 + 1 / real p"
     by (intro divide_right_mono add_mono mult_right_mono mult_mono power_mono, simp_all add:m_def)
 
   also have "... \<le> (5/2) * (real m)\<^sup>2 * (4 * real t * real p / real m)\<^sup>2 * (2 powr - real r) / (real p)\<^sup>2 + 1 / real p"
     using v_def v_ge_1 v_ubound
     by (intro add_mono divide_right_mono  mult_right_mono  mult_left_mono, auto)
 
   also have "... = 40 * (real t)\<^sup>2 * (2 powr -real r) + 1 / real p"
     using p_gt_0 m_ge_0 t_gt_0 by (simp add:algebra_simps power2_eq_square)
 
   also have "... \<le> 1/18 + 1/18"
     using t_r_bound p_ge_18 by (intro add_mono, simp_all add: pos_le_divide_eq)
 
   also have "... = 1/9" by simp
 
   finally have case_3: "prob {\<omega>. \<not>has_no_collision \<omega>} \<le> 1/9" by simp
 
   have "prob {\<omega>. real_of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le> 
     prob {\<omega>. Q u \<omega> \<ge> t \<or> Q v \<omega> < t \<or> \<not>(has_no_collision \<omega>)}"
   proof (rule pmf_mono[OF M_def], rule ccontr)
     fix \<omega>
     assume "\<omega> \<in> set_pmf (pmf_of_set space)"
     assume "\<omega> \<in> {\<omega>. real_of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)\<bar>}"
     hence est: "real_of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)\<bar>" by simp
     assume "\<omega> \<notin> {\<omega>. t \<le> Q u \<omega> \<or> Q v \<omega> < t \<or> \<not> has_no_collision \<omega>}"
     hence "\<not>( t \<le> Q u \<omega> \<or> Q v \<omega> < t \<or> \<not> has_no_collision \<omega>)" by simp
     hence lb: "Q u \<omega> < t" and ub: "Q v \<omega> \<ge> t" and no_col: "has_no_collision \<omega>" by simp+
 
     define y where "y =  nth_mset (t-1) {#int (hash x \<omega>). x \<in># mset_set (set as)#}"
     define y' where "y' = nth_mset (t-1) {#tr_hash x \<omega>. x \<in># mset_set (set as)#}"
 
     have rank_t_lb: "u \<le> y"
       unfolding y_def using True t_gt_0 lb
       by (intro nth_mset_bound_left, simp_all add:count_less_def swap_filter_image Q_def)
   
     have rank_t_ub: "y \<le> v - 1"
       unfolding y_def using True t_gt_0 ub
       by (intro nth_mset_bound_right, simp_all add:Q_def swap_filter_image count_le_def)
 
     have y_ge_0: "real_of_int y \<ge> 0" using rank_t_lb a_ge_0 by linarith
 
     have "mono (\<lambda>x. truncate_down r (real_of_int x))" 
       by (metis truncate_down_mono mono_def of_int_le_iff)
     hence y'_eq: "y' = truncate_down r y"
       unfolding y_def y'_def  using True t_gt_0
       by (subst nth_mset_commute_mono[where f="(\<lambda>x. truncate_down r (of_int x))"]) 
         (simp_all add: multiset.map_comp comp_def tr_hash_def)
 
     have "real_of_int u * (1 - 2 powr -real r) \<le> real_of_int y * (1 - 2 powr (-real r))"
       using rank_t_lb of_int_le_iff two_pow_r_le_1
       by (intro mult_right_mono, auto)
     also have "... \<le> y'"
       using y'_eq truncate_down_pos[OF y_ge_0] by simp
     finally have rank_t_lb': "u * (1 - 2 powr -real r) \<le> y'" by simp
 
     have "y' \<le> real_of_int y"
       by (subst y'_eq, rule truncate_down_le, simp)
     also have "... \<le> real_of_int (v-1)"
       using rank_t_ub of_int_le_iff by blast
     finally have rank_t_ub': "y' \<le> v-1"
       by simp
 
     have "0 < u * (1-2 powr -real r)"
       using a_ge_1 two_pow_r_le_1 by (intro mult_pos_pos, auto)
     hence y'_pos: "y' > 0" using rank_t_lb' by linarith
 
     have no_col': "\<And>x. x \<le> y' \<Longrightarrow> count {#tr_hash x \<omega>. x \<in># mset_set (set as)#} x \<le> 1"
       using  rank_t_ub' no_col 
       by (simp add:vimage_def card_le_Suc0_iff_eq count_image_mset has_no_collision_def) force
 
     have h_1: "Max (sketch_rv' \<omega>) = y'"
       using True t_gt_0 no_col'
       by (simp add:sketch_rv'_def y'_def nth_mset_max)
 
     have "card (sketch_rv' \<omega>) = card (least ((t-1)+1) (set_mset {#tr_hash x \<omega>. x \<in># mset_set (set as)#}))"
       using t_gt_0 by (simp add:sketch_rv'_def)
     also have "... = (t-1) +1"
       using True t_gt_0 no_col' by (intro nth_mset_max(2), simp_all add:y'_def)
     also have "... = t" using t_gt_0 by simp
     finally have "card (sketch_rv' \<omega>) = t" by simp
     hence h_3: "estimate' (sketch_rv' \<omega>) = real t * real p / y'"
       using h_1 by (simp add:estimate'_def)
 
     have "(real t) * real p \<le>  (1 + \<delta>') * real m * ((real t) * real p / (real m * (1 + \<delta>')))" 
       using \<delta>'_lt_1 m_def True t_gt_0 \<delta>'_gt_0 by auto
     also have "... \<le> (1+\<delta>') * m * u"
       using \<delta>'_gt_0 by (intro mult_left_mono, simp_all add:u_def)
     also have "... < ((1 + real_of_rat \<delta>)*(1-real_of_rat \<delta>/8)) * m * u"
       using True m_def t_gt_0 a_ge_1 \<delta>_range
       by (intro mult_strict_right_mono, auto simp add:\<delta>'_def right_diff_distrib)
     also have "... \<le> ((1 + real_of_rat \<delta>)*(1-2 powr (-r))) * m * u"
       using r_le_\<delta> \<delta>_range a_ge_0 by (intro mult_right_mono mult_left_mono, auto)
     also have "... = (1 + real_of_rat \<delta>) * m * (u * (1-2 powr -real r))" 
       by simp
     also have "... \<le> (1 + real_of_rat \<delta>) * m * y'"
       using \<delta>_range by (intro mult_left_mono rank_t_lb', simp)
     finally have "real t * real p < (1 + real_of_rat \<delta>) * m * y'" by simp
     hence f_1: "estimate' (sketch_rv' \<omega>) < (1 + real_of_rat \<delta>) * m"
       using y'_pos by (simp add: h_3 pos_divide_less_eq)
 
     have "(1 - real_of_rat \<delta>) * m * y' \<le> (1 - real_of_rat \<delta>) * m * v" 
       using \<delta>_range rank_t_ub' y'_pos by (intro mult_mono rank_t_ub', simp_all)
     also have "... = (1-real_of_rat \<delta>) * (real m * v)"
       by simp
     also have "... < (1-\<delta>') * (real m * v)" 
       using \<delta>_range m_ge_0 v_ge_1
       by (intro mult_strict_right_mono mult_pos_pos, simp_all add:\<delta>'_def)
     also have "... \<le> (1-\<delta>') * (real m * (real t * real p / (real m * (1-\<delta>'))))"
       using \<delta>'_gt_0 \<delta>'_lt_1 by (intro mult_left_mono, auto simp add:v_def)
     also have "... = real t * real p"
       using \<delta>'_gt_0 \<delta>'_lt_1 t_gt_0 p_gt_0 m_ge_0 by auto
     finally have "(1 - real_of_rat \<delta>) * m * y' < real t * real p" by simp
     hence f_2: "estimate' (sketch_rv' \<omega>) > (1 - real_of_rat \<delta>) * m"
       using y'_pos by (simp add: h_3 pos_less_divide_eq)
 
     have "abs (estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)) < real_of_rat \<delta> * (real_of_rat (F 0 as))"
       using f_1 f_2 by (simp add:abs_less_iff algebra_simps m_eq_F_0)
     thus "False" using est by linarith
   qed
   also have "... \<le> 1/9 + (1/9 + 1/9)"
     by (intro pmf_add_2[OF M_def] case_1 case_2 case_3)
   also have "... = 1/3" by simp
   finally show ?thesis by simp
 next
   case False
   have "prob {\<omega>. real_of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - of_rat (F 0 as)\<bar>} \<le>
     prob {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real p \<and> tr_hash x \<omega> = tr_hash y \<omega>}" 
   proof (rule pmf_mono[OF M_def])
     fix \<omega>
     assume a:"\<omega> \<in> {\<omega>. real_of_rat \<delta> * real_of_rat (F 0 as) < \<bar>estimate' (sketch_rv' \<omega>) - real_of_rat (F 0 as)\<bar>}"
     assume b:"\<omega> \<in> set_pmf (pmf_of_set space)" 
     have c: "card (set as) < t" using False by auto
     hence "card ((\<lambda>x. tr_hash x \<omega>) ` set as) < t"
       using card_image_le order_le_less_trans by blast
     hence d:"card (sketch_rv' \<omega>) = card ((\<lambda>x. tr_hash x \<omega>) ` (set as))"
       by (simp add:sketch_rv'_def card_least)
     have "card (sketch_rv' \<omega>) < t"
       by (metis List.finite_set  c d card_image_le  order_le_less_trans)
     hence "estimate' (sketch_rv' \<omega>) = card (sketch_rv' \<omega>)" by (simp add:estimate'_def)
     hence "card (sketch_rv' \<omega>) \<noteq> real_of_rat (F 0 as)"
       using a \<delta>_range by simp 
         (metis abs_zero cancel_comm_monoid_add_class.diff_cancel of_nat_less_0_iff pos_prod_lt zero_less_of_rat_iff)
     hence "card (sketch_rv' \<omega>) \<noteq> card (set as)"
       using m_def m_eq_F_0 by linarith
     hence "\<not>inj_on (\<lambda>x. tr_hash x \<omega>) (set as)"
       using card_image d by auto
     moreover have "tr_hash x \<omega> \<le> real p" if a:"x \<in> set as" for x
     proof -
       have "hash x \<omega> < p" 
         using hash_range as_lt_p a b by (simp add:mod_ring_carr M_def)
       thus "tr_hash x \<omega> \<le> real p" using truncate_down_le by (simp add:tr_hash_def)
     qed
    ultimately show "\<omega> \<in> {\<omega>. \<exists>x \<in> set as. \<exists>y \<in> set as. x \<noteq> y \<and> tr_hash x \<omega> \<le> real p \<and> tr_hash x \<omega> = tr_hash y \<omega>}"
      by (simp add:inj_on_def, blast)
   qed
   also have "... \<le> (5/2) * (real (card (set as)))\<^sup>2 * (real p)\<^sup>2 * 2 powr - real r / (real p)\<^sup>2 + 1 / real p"
     using p_gt_0 by (intro collision_prob, auto)
   also have "... = (5/2) * (real (card (set as)))\<^sup>2 * 2 powr (- real r) + 1 / real p"
     using p_gt_0 by (simp add:ac_simps power2_eq_square)
   also have "... \<le> (5/2) * (real t)\<^sup>2 * 2 powr (-real r) + 1 / real p"
     using False by (intro add_mono mult_right_mono mult_left_mono power_mono, auto)
   also have "... \<le> 1/6 + 1/6"
     using t_r_bound p_ge_18 by (intro add_mono, simp_all)
   also have "... \<le> 1/3" by simp
   finally show ?thesis by simp
 qed
 
 private lemma median_bounds:
   "\<P>(\<omega> in measure_pmf \<Omega>\<^sub>0. \<bar>median s (\<lambda>i. estimate (sketch_rv (\<omega> i))) - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1 - real_of_rat \<epsilon>"
 proof -
   have "strict_mono_on A real_of_float" for A by (meson less_float.rep_eq strict_mono_onI)
   hence real_g_2: "\<And>\<omega>.  sketch_rv' \<omega> = real_of_float ` sketch_rv \<omega>" 
     by (simp add: sketch_rv'_def sketch_rv_def tr_hash_def least_mono_commute image_comp)
 
   moreover have "inj_on real_of_float A" for A
     using  real_of_float_inject by (simp add:inj_on_def)
   ultimately have card_eq: "\<And>\<omega>. card (sketch_rv \<omega>) = card (sketch_rv' \<omega>)" 
     using real_g_2 by (auto intro!: card_image[symmetric])
 
   have "Max (sketch_rv' \<omega>) = real_of_float (Max (sketch_rv \<omega>))" if a:"card (sketch_rv' \<omega>) \<ge> t" for \<omega> 
   proof -
     have "mono real_of_float"
       using less_eq_float.rep_eq mono_def by blast
     moreover have "finite (sketch_rv \<omega>)"
       by (simp add:sketch_rv_def least_def)
     moreover have " sketch_rv \<omega> \<noteq> {}"
       using card_eq[symmetric] card_gt_0_iff t_gt_0 a by (simp, force)  
     ultimately show ?thesis
       by (subst mono_Max_commute[where f="real_of_float"], simp_all add:real_g_2)
   qed
   hence real_g: "\<And>\<omega>. estimate' (sketch_rv' \<omega>) = real_of_rat (estimate (sketch_rv \<omega>))"
     by (simp add:estimate_def estimate'_def card_eq of_rat_divide of_rat_mult of_rat_add real_of_rat_of_float)
 
   have indep: "prob_space.indep_vars (measure_pmf \<Omega>\<^sub>0) (\<lambda>_. borel) (\<lambda>i \<omega>. estimate' (sketch_rv' (\<omega> i))) {0..<s}"
     unfolding \<Omega>\<^sub>0_def
     by (rule indep_vars_restrict_intro', auto simp add:restrict_dfl_def lessThan_atLeast0)
 
   moreover have "- (18 * ln (real_of_rat \<epsilon>)) \<le> real s"
     using of_nat_ceiling by (simp add:s_def) blast
 
   moreover have "i < s \<Longrightarrow> measure \<Omega>\<^sub>0 {\<omega>. of_rat \<delta> * of_rat (F 0 as) < \<bar>estimate' (sketch_rv' (\<omega> i)) - of_rat (F 0 as)\<bar>} \<le> 1/3"
     for i
     using estimate'_bounds unfolding \<Omega>\<^sub>0_def M_def
     by (subst prob_prod_pmf_slice, simp_all)
  
   ultimately have "1-real_of_rat \<epsilon> \<le> \<P>(\<omega> in measure_pmf \<Omega>\<^sub>0.
       \<bar>median s (\<lambda>i. estimate' (sketch_rv' (\<omega> i))) - real_of_rat (F 0 as)\<bar> \<le>  real_of_rat \<delta> * real_of_rat (F 0 as))"
     using \<epsilon>_range prob_space_measure_pmf
     by (intro prob_space.median_bound_2) auto
   also have "... = \<P>(\<omega> in measure_pmf \<Omega>\<^sub>0. 
       \<bar>median s (\<lambda>i. estimate (sketch_rv (\<omega> i))) - F 0 as\<bar> \<le>  \<delta> * F 0 as)"
     using s_gt_0 median_rat[symmetric] real_g by (intro arg_cong2[where f="measure"]) 
       (simp_all add:of_rat_diff[symmetric] of_rat_mult[symmetric] of_rat_less_eq)
   finally show "\<P>(\<omega> in measure_pmf \<Omega>\<^sub>0. \<bar>median s (\<lambda>i. estimate (sketch_rv (\<omega> i))) - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1-real_of_rat \<epsilon>"
     by blast
 qed
 
 lemma f0_alg_correct':
   "\<P>(\<omega> in measure_pmf result. \<bar>\<omega> - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1 - of_rat \<epsilon>"
 proof -
   have f0_result_elim: "\<And>x. f0_result (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i)) =
     return_pmf (median s (\<lambda>i. estimate (sketch_rv (x i))))"
     by (simp add:estimate_def, rule median_cong, simp)
  
   have "result = map_pmf (\<lambda>x. (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<Omega>\<^sub>0 \<bind> f0_result"
     by (subst result_def, subst f0_alg_sketch, simp)
   also have "... = \<Omega>\<^sub>0 \<bind> (\<lambda>x. return_pmf (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<bind> f0_result"
     by (simp add:t_def p_def r_def s_def map_pmf_def)
   also have "... = \<Omega>\<^sub>0 \<bind> (\<lambda>x. return_pmf (median s (\<lambda>i. estimate (sketch_rv (x i)))))"
     by (subst bind_assoc_pmf, subst bind_return_pmf, subst f0_result_elim)  simp
   finally have a:"result =  \<Omega>\<^sub>0 \<bind> (\<lambda>x. return_pmf (median s (\<lambda>i. estimate (sketch_rv (x i)))))"
     by simp
 
   show ?thesis
     using median_bounds by (simp add: a map_pmf_def[symmetric])
 qed
 
 private lemma f_subset:
   assumes "g ` A \<subseteq> h ` B"
   shows "(\<lambda>x. f (g x)) ` A \<subseteq> (\<lambda>x. f (h x)) ` B"
   using assms by auto
 
 lemma f0_exact_space_usage':
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n)"
   shows "AE \<omega> in \<Omega>. bit_count (encode_f0_state \<omega>) \<le> f0_space_usage (n, \<epsilon>, \<delta>)"
 proof -
   
   have log_2_4: "log 2 4 = 2" 
     by (metis log2_of_power_eq mult_2 numeral_Bit0 of_nat_numeral power2_eq_square)
 
   have a: "bit_count (F\<^sub>e (float_of (truncate_down r y))) \<le> 
     ereal (12 + 4 * real r + 2 * log 2 (log 2 (n+13)))" if a_1:"y \<in> {..<p}" for y
   proof (cases "y \<ge> 1")
     case True
 
     have aux_1: " 0 < 2 + log 2 (real y)" 
       using True by (intro add_pos_nonneg, auto)
     have aux_2: "0 < 2 + log 2 (real p)"
       using p_gt_1 by (intro add_pos_nonneg, auto)
 
     have "bit_count (F\<^sub>e (float_of (truncate_down r y))) \<le> 
       ereal (10 + 4 * real r + 2 * log 2 (2 + \<bar>log 2 \<bar>real y\<bar>\<bar>))"
       by (rule truncate_float_bit_count)
     also have "... = ereal (10 + 4 * real r + 2 * log 2 (2 + (log 2 (real y))))"
       using True by simp
     also have "... \<le> ereal (10 + 4 * real r + 2 * log 2 (2 + log 2 p))"
       using aux_1 aux_2 True p_gt_0 a_1 by simp
     also have "... \<le> ereal (10 + 4 * real r + 2 * log 2 (log 2 4 + log 2 (2 * n + 40)))"
       using log_2_4 p_le_n p_gt_0
       by (intro ereal_mono add_mono mult_left_mono log_mono of_nat_mono add_pos_nonneg, auto)
     also have "... = ereal (10 + 4 * real r + 2 * log 2 (log 2 (8 * n + 160)))"
       by (simp add:log_mult[symmetric])
     also have "... \<le> ereal (10 + 4 * real r + 2 * log 2 (log 2 ((n+13) powr 2)))"
       by (intro ereal_mono add_mono mult_left_mono log_mono of_nat_mono add_pos_nonneg)
        (auto simp add:power2_eq_square algebra_simps)
     also have "... = ereal (10 +  4 * real r + 2 * log 2 (log 2 4 * log 2 (n + 13)))"
       by (subst log_powr, simp_all add:log_2_4)
     also have "... = ereal (12 +  4 * real r + 2 * log 2 (log 2 (n + 13)))"
       by (subst log_mult, simp_all add:log_2_4)
     finally show ?thesis by simp
   next
     case False
     hence "y = 0" using a_1 by simp
     then show ?thesis by (simp add:float_bit_count_zero)
   qed
 
   have "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<le> 
         f0_space_usage (n, \<epsilon>, \<delta>)" if b: "x \<in> {..<s} \<rightarrow>\<^sub>E space" for x
   proof -
     have c: "x \<in> extensional {..<s}" using b by (simp add:PiE_def) 
 
     have d: "sketch_rv (x y) \<subseteq> (\<lambda>k. float_of (truncate_down r k)) ` {..<p} "
       if d_1: "y < s" for y
     proof -
       have "sketch_rv (x y) \<subseteq> (\<lambda>xa. float_of (truncate_down r (hash xa (x y)))) ` set as"
         using least_subset by (auto simp add:sketch_rv_def tr_hash_def) 
       also have "... \<subseteq> (\<lambda>k. float_of (truncate_down r (real k))) ` {..<p}"
         using b hash_range as_lt_p d_1
         by (intro f_subset[where f="\<lambda>x. float_of (truncate_down r (real x))"] image_subsetI)
          (simp add: PiE_iff mod_ring_carr)
       finally show ?thesis
         by simp
     qed
 
     have "\<And>y. y < s \<Longrightarrow> finite (sketch_rv (x y))"
       unfolding sketch_rv_def by (rule finite_subset[OF least_subset], simp)
     moreover have card_sketch: "\<And>y. y < s \<Longrightarrow> card (sketch_rv (x y)) \<le> t "
       by (simp add:sketch_rv_def card_least)
     moreover have "\<And>y z. y < s \<Longrightarrow> z \<in> sketch_rv (x y) \<Longrightarrow> 
       bit_count (F\<^sub>e z) \<le> ereal (12 + 4 * real r + 2 * log 2 (log 2 (real n + 13)))"
       using a d by auto
     ultimately have e: "\<And>y. y < s \<Longrightarrow> bit_count (S\<^sub>e F\<^sub>e (sketch_rv (x y))) 
       \<le> ereal (real t) * (ereal (12 + 4 * real r + 2 * log 2 (log 2 (real (n + 13)))) + 1) + 1"
       using float_encoding by (intro set_bit_count_est, auto)
 
     have f: "\<And>y. y < s \<Longrightarrow> bit_count (P\<^sub>e p 2 (x y)) \<le> ereal (real 2 * (log 2 (real p) + 1))"
       using p_gt_1 b
       by (intro bounded_degree_polynomial_bit_count) (simp_all add:space_def PiE_def Pi_def)
 
     have "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) =
       bit_count (N\<^sub>e s) + bit_count (N\<^sub>e t) +  bit_count (N\<^sub>e p) + bit_count (N\<^sub>e r) +
       bit_count (([0..<s] \<rightarrow>\<^sub>e P\<^sub>e p 2) x) +
       bit_count (([0..<s] \<rightarrow>\<^sub>e S\<^sub>e F\<^sub>e) (\<lambda>i\<in>{..<s}. sketch_rv (x i)))"
       by (simp add:encode_f0_state_def dependent_bit_count lessThan_atLeast0
         s_def[symmetric] t_def[symmetric] p_def[symmetric] r_def[symmetric] ac_simps)
     also have "... \<le> ereal (2* log 2 (real s + 1) + 1) + ereal  (2* log 2 (real t + 1) + 1)
       + ereal (2* log 2 (real p + 1) + 1) + ereal (2 * log 2 (real r + 1) + 1)
       + (ereal (real s) * (ereal (real 2 * (log 2 (real p) + 1)))) 
       + (ereal (real s) * ((ereal (real t) * 
             (ereal (12 + 4 * real r + 2 * log 2 (log 2 (real (n + 13)))) + 1) + 1)))"
       using c e f
       by (intro add_mono exp_golomb_bit_count fun_bit_count_est[where xs="[0..<s]", simplified])
        (simp_all add:lessThan_atLeast0)
     also have "... = ereal ( 4 + 2 * log 2 (real s + 1) + 2 * log 2 (real t + 1) + 
       2 * log 2 (real p + 1) + 2 * log 2 (real r + 1) + real s * (3 + 2 * log 2 (real p) + 
       real t * (13 + (4 * real r + 2 * log 2 (log 2 (real n + 13))))))"
       by (simp add:algebra_simps)
     also have "... \<le> ereal ( 4 + 2 * log 2 (real s + 1)  + 2 * log 2 (real t + 1) + 
       2 * log 2 (2 * (21 + real n)) + 2 * log 2 (real r + 1) + real s * (3 + 2 * log 2 (2 * (21 + real n)) + 
       real t * (13 + (4 * real r + 2 * log 2 (log 2 (real n + 13))))))"
       using p_le_n p_gt_0
       by (intro ereal_mono add_mono mult_left_mono, auto)
     also have "... =  ereal (6 + 2 * log 2 (real s + 1) + 2 * log 2 (real t + 1) + 
       2 * log 2 (21 + real n) + 2 * log 2 (real r + 1) + real s * (5 + 2 * log 2 (21 + real n) + 
       real t * (13 + (4 * real r + 2 * log 2 (log 2 (real n + 13))))))"
       by (subst (1 2) log_mult, auto)
     also have "... \<le> f0_space_usage (n, \<epsilon>, \<delta>)"
       by (simp add:s_def[symmetric] r_def[symmetric] t_def[symmetric] Let_def)
        (simp add:algebra_simps)
     finally show "bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i))) \<le> 
         f0_space_usage (n, \<epsilon>, \<delta>)" by simp
   qed
   hence "\<And>x. x \<in> set_pmf \<Omega>\<^sub>0 \<Longrightarrow>
          bit_count (encode_f0_state (s, t, p, r, x, \<lambda>i\<in>{..<s}. sketch_rv (x i)))  \<le> ereal (f0_space_usage (n, \<epsilon>, \<delta>))"
     by (simp add:\<Omega>\<^sub>0_def set_prod_pmf del:f0_space_usage.simps)
   hence "\<And>y. y \<in> set_pmf \<Omega> \<Longrightarrow> bit_count (encode_f0_state y) \<le> ereal (f0_space_usage (n, \<epsilon>, \<delta>))"
     by (simp add: \<Omega>_def f0_alg_sketch del:f0_space_usage.simps f0_init.simps)
      (metis (no_types, lifting) image_iff pmf.set_map)
   thus ?thesis
     by (simp add: AE_measure_pmf_iff del:f0_space_usage.simps)
 qed
 
 end
 
 text \<open>Main results of this section:\<close>
 
 theorem f0_alg_correct:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> \<in> {0<..<1}"
   assumes "set as \<subseteq> {..<n}"
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n) \<bind> f0_result"
   shows "\<P>(\<omega> in measure_pmf \<Omega>. \<bar>\<omega> - F 0 as\<bar> \<le> \<delta> * F 0 as) \<ge> 1 - of_rat \<epsilon>"
   using f0_alg_correct'[OF assms(1-3)] unfolding \<Omega>_def by blast
 
 theorem f0_exact_space_usage:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> \<in> {0<..<1}"
   assumes "set as \<subseteq> {..<n}"
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f0_update a) as (f0_init \<delta> \<epsilon> n)"
   shows "AE \<omega> in \<Omega>. bit_count (encode_f0_state \<omega>) \<le> f0_space_usage (n, \<epsilon>, \<delta>)"
   using f0_exact_space_usage'[OF assms(1-3)] unfolding \<Omega>_def by blast
 
 theorem f0_asymptotic_space_complexity:
   "f0_space_usage \<in> O[at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda>(n, \<epsilon>, \<delta>). ln (1 / of_rat \<epsilon>) * 
   (ln (real n) + 1 / (of_rat \<delta>)\<^sup>2 * (ln (ln (real n)) + ln (1 / of_rat \<delta>))))"
   (is "_ \<in> O[?F](?rhs)")
 proof -
   define n_of :: "nat \<times> rat \<times> rat \<Rightarrow> nat" where "n_of = (\<lambda>(n, \<epsilon>, \<delta>). n)"
   define \<epsilon>_of :: "nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<epsilon>_of = (\<lambda>(n, \<epsilon>, \<delta>). \<epsilon>)"
   define \<delta>_of :: "nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<delta>_of = (\<lambda>(n, \<epsilon>, \<delta>). \<delta>)"
   define t_of where "t_of = (\<lambda>x. nat \<lceil>80 / (real_of_rat (\<delta>_of x))\<^sup>2\<rceil>)"
   define s_of where "s_of = (\<lambda>x. nat \<lceil>-(18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>)"
   define r_of where "r_of = (\<lambda>x. nat (4 * \<lceil>log 2 (1 / real_of_rat (\<delta>_of x))\<rceil> + 23))"
 
   define g where "g = (\<lambda>x. ln (1 / of_rat (\<epsilon>_of x)) * (ln (real (n_of x)) + 
     1 / (of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / of_rat (\<delta>_of x)))))"
 
   have evt: "(\<And>x. 
     0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and> 
     1/real_of_rat (\<delta>_of x) \<ge> \<delta> \<and> 1/real_of_rat (\<epsilon>_of x) \<ge> \<epsilon> \<and>
     real (n_of x) \<ge> n \<Longrightarrow> P x) \<Longrightarrow> eventually P ?F"  (is "(\<And>x. ?prem x \<Longrightarrow> _) \<Longrightarrow> _")
     for \<delta> \<epsilon> n P
     apply (rule eventually_mono[where P="?prem" and Q="P"])
     apply (simp add:\<epsilon>_of_def case_prod_beta' \<delta>_of_def n_of_def)
      apply (intro eventually_conj eventually_prod1' eventually_prod2' 
         sequentially_inf eventually_at_right_less inv_at_right_0_inf)
     by (auto simp add:prod_filter_eq_bot)
 
   have exp_pos: "exp k \<le> real x \<Longrightarrow> x > 0" for k x
     using exp_gt_zero gr0I by force 
 
   have exp_gt_1: "exp 1 \<ge> (1::real)"
     by simp
 
   have 1: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (auto intro!:landau_o.big_mono evt[where \<epsilon>="exp 1"] iffD2[OF ln_ge_iff] simp add:abs_ge_iff)
 
   have 2: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<delta>_of x)))" 
     by (auto intro!:landau_o.big_mono evt[where \<delta>="exp 1"] iffD2[OF ln_ge_iff] simp add:abs_ge_iff)
 
   have 3: " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
     using exp_pos
     by (intro landau_sum_2 2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff], auto)
   have 4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)" 
     using one_le_power
     by (intro landau_o.big_mono evt[where \<delta>="1"], auto simp add:power_one_over[symmetric])
 
   have "(\<lambda>x. 80 * (1 / (real_of_rat (\<delta>_of x))\<^sup>2)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     by (subst landau_o.big.cmult_in_iff, auto)
   hence 5: "(\<lambda>x. real (t_of x)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     unfolding  t_of_def 
     by (intro landau_real_nat landau_ceil 4, auto)
 
   have "(\<lambda>x. ln (real_of_rat (\<epsilon>_of x))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono evt[where \<epsilon>="1"], auto simp add:ln_div)
   hence 6: "(\<lambda>x. real (s_of x)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     unfolding s_of_def by (intro landau_nat_ceil 1, simp)
 
   have 7: " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     using exp_pos by (auto intro!: landau_o.big_mono evt[where n="exp 1"] iffD2[OF ln_ge_iff] simp: abs_ge_iff)
 
   have 8:" (\<lambda>_. 1) \<in> 
     O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using order_trans[OF exp_gt_1] exp_pos
     by (intro landau_sum_1 7 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff] 
         mult_nonneg_nonneg add_nonneg_nonneg) auto
 
   have "(\<lambda>x. ln (real (s_of x) + 1)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_ln_3 sum_in_bigo 6 1, simp)
 
   hence 9: "(\<lambda>x. log 2 (real (s_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 8, auto simp:log_def)
   have 10: "(\<lambda>x. 1) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 8 1)
 
   have "(\<lambda>x. ln (real (t_of x) + 1)) \<in> 
     O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using 5 by (intro landau_o.big_mult_1 3 landau_ln_3 sum_in_bigo 4, simp_all)
   hence " (\<lambda>x. log 2 (real (t_of x) + 1)) \<in> 
   O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using order_trans[OF exp_gt_1] exp_pos
     by (intro landau_sum_2  evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff] 
         mult_nonneg_nonneg add_nonneg_nonneg) (auto simp add:log_def)
   hence 11: "(\<lambda>x. log 2 (real (t_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def  by (intro landau_o.big_mult_1' 1, auto)
   have " (\<lambda>x. 1) \<in> O[?F](\<lambda>x. real (n_of x))" 
     by (intro landau_o.big_mono evt[where n="1"], auto)
   hence "(\<lambda>x. ln (real (n_of x) + 21)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))" 
     by (intro landau_ln_2[where a="2"] evt[where n="2"] sum_in_bigo, auto)
 
   hence 12: "(\<lambda>x. log 2 (real (n_of x) + 21)) \<in> O[?F](g)"
     unfolding g_def using exp_pos order_trans[OF exp_gt_1]
     by (intro landau_o.big_mult_1' 1 landau_sum_1  evt[where n="exp 1" and \<delta>="1"] 
         ln_ge_zero  iffD2[OF ln_ge_iff] mult_nonneg_nonneg add_nonneg_nonneg)  (auto simp add:log_def)
 
   have "(\<lambda>x. ln (1 / real_of_rat (\<delta>_of x))) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)" 
     by (intro landau_ln_3 evt[where \<delta>="1"] landau_o.big_mono) 
       (auto simp add:power_one_over[symmetric] self_le_power)
   hence " (\<lambda>x. real (nat (4*\<lceil>log 2 (1 / real_of_rat (\<delta>_of x))\<rceil>+23))) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using 4 by (auto intro!: landau_real_nat sum_in_bigo landau_ceil simp:log_def)
   hence " (\<lambda>x. ln (real (r_of x) + 1)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     unfolding r_of_def
     by (intro landau_ln_3 sum_in_bigo 4, auto)
   hence " (\<lambda>x. log 2 (real (r_of x) + 1)) \<in> 
     O[?F](\<lambda>x. (1 / (real_of_rat (\<delta>_of x))\<^sup>2) * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     by (intro landau_o.big_mult_1 3, simp add:log_def)
   hence " (\<lambda>x. log 2 (real (r_of x) + 1)) \<in> 
     O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using exp_pos order_trans[OF exp_gt_1]
     by (intro landau_sum_2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  
         iffD2[OF ln_ge_iff] add_nonneg_nonneg mult_nonneg_nonneg) (auto)
   hence 13: "(\<lambda>x. log 2 (real (r_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def  by (intro landau_o.big_mult_1' 1, auto)
   have 14: "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. real (n_of x))" 
     by (intro landau_o.big_mono evt[where n="1"], auto)
 
   have "(\<lambda>x. ln (real (n_of x) + 13)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))" 
     using 14 by (intro landau_ln_2[where a="2"]  evt[where n="2"] sum_in_bigo, auto)
 
   hence "(\<lambda>x. ln (log 2 (real (n_of x) + 13))) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))))"
     using exp_pos by (intro landau_ln_2[where a="2"] iffD2[OF ln_ge_iff] evt[where n="exp 2"])
         (auto simp add:log_def)
 
   hence "(\<lambda>x. log 2 (log 2 (real (n_of x) + 13))) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
     using exp_pos by (intro landau_sum_1 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff])
      (auto simp add:log_def)
 
   moreover have  "(\<lambda>x. real (r_of x)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<delta>_of x)))"
     unfolding r_of_def using 2
     by (auto intro!: landau_real_nat sum_in_bigo landau_ceil simp:log_def)
   hence "(\<lambda>x. real (r_of x)) \<in> O[?F](\<lambda>x. ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
     using exp_pos 
     by (intro landau_sum_2 evt[where n="exp 1" and \<delta>="1"] ln_ge_zero  iffD2[OF ln_ge_iff], auto)
 
   ultimately have 15:" (\<lambda>x. real (t_of x) * (13 + 4 * real (r_of x) + 2 * log 2 (log 2 (real (n_of x) + 13))))
       \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
     using 5 3 
     by (intro landau_o.mult sum_in_bigo, auto)
 
   have "(\<lambda>x. 5 + 2 * log 2 (21 + real (n_of x)) + real (t_of x) * (13 + 4 * real (r_of x) + 2 * log 2 (log 2 (real (n_of x) + 13))))
       \<in> O[?F](\<lambda>x. ln (real (n_of x)) + 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x))))"
   proof -
     have "\<forall>\<^sub>F x in ?F. 0 \<le> ln (real (n_of x))" 
       by (intro evt[where n="1"] ln_ge_zero, auto)
     moreover have "\<forall>\<^sub>F x in ?F. 0 \<le> 1 / (real_of_rat (\<delta>_of x))\<^sup>2 * (ln (ln (real (n_of x))) + ln (1 / real_of_rat (\<delta>_of x)))"
       using exp_pos
       by (intro evt[where n="exp 1" and \<delta>="1"] mult_nonneg_nonneg add_nonneg_nonneg 
           ln_ge_zero iffD2[OF ln_ge_iff]) auto
     moreover have " (\<lambda>x. ln (21 + real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)))" 
       using 14 by (intro landau_ln_2[where a="2"] sum_in_bigo evt[where n="2"], auto)
     hence "(\<lambda>x. 5 + 2 * log 2 (21 + real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
       using 7  by (intro sum_in_bigo, auto simp add:log_def)
     ultimately show ?thesis
       using 15 by (rule landau_sum)
   qed
 
   hence 16: "(\<lambda>x. real (s_of x) * (5 + 2 * log 2 (21 + real (n_of x)) + real (t_of x) *
     (13 + 4 * real (r_of x) + 2 * log 2 (log 2 (real (n_of x) + 13)))))  \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.mult 6, auto)
 
   have "f0_space_usage = (\<lambda>x. f0_space_usage (n_of x, \<epsilon>_of x, \<delta>_of x))"
     by (simp add:case_prod_beta' n_of_def \<epsilon>_of_def \<delta>_of_def)
   also have "... \<in>  O[?F](g)"
     using 9 10 11 12 13 16
     by (simp add:fun_cong[OF s_of_def[symmetric]] fun_cong[OF t_of_def[symmetric]] 
         fun_cong[OF r_of_def[symmetric]] Let_def) (intro sum_in_bigo, auto)
   also have "... = O[?F](?rhs)"
     by (simp add:case_prod_beta' g_def n_of_def \<epsilon>_of_def \<delta>_of_def)
   finally show ?thesis
     by simp
 qed
 
 end
diff --git a/thys/Frequency_Moments/Frequency_Moment_2.thy b/thys/Frequency_Moments/Frequency_Moment_2.thy
--- a/thys/Frequency_Moments/Frequency_Moment_2.thy
+++ b/thys/Frequency_Moments/Frequency_Moment_2.thy
@@ -1,721 +1,721 @@
 section \<open>Frequency Moment $2$\<close>
 
 theory Frequency_Moment_2
   imports
     Universal_Hash_Families.Carter_Wegman_Hash_Family
     Universal_Hash_Families.Universal_Hash_Families_More_Finite_Fields
     Equivalence_Relation_Enumeration.Equivalence_Relation_Enumeration
     Landau_Ext
     Median_Method.Median
     Product_PMF_Ext
     Frequency_Moments 
 begin
 
 text \<open>This section contains a formalization of the algorithm for the second frequency moment.
 It is based on the algorithm described in \<^cite>\<open>\<open>\textsection 2.2\<close> in "alon1999"\<close>.
 The only difference is that the algorithm is adapted to work with prime field of odd order, which
 greatly reduces the implementation complexity.\<close>
 
 fun f2_hash where
   "f2_hash p h k = (if even (ring.hash (mod_ring p) k h) then int p - 1 else - int p - 1)"
 
 type_synonym f2_state = "nat \<times> nat \<times> nat \<times> (nat \<times> nat \<Rightarrow> nat list) \<times> (nat \<times> nat \<Rightarrow> int)"
 
 fun f2_init :: "rat \<Rightarrow> rat \<Rightarrow> nat \<Rightarrow> f2_state pmf" where
   "f2_init \<delta> \<epsilon> n =
     do {
       let s\<^sub>1 = nat \<lceil>6 / \<delta>\<^sup>2\<rceil>;
       let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil>;
       let p = prime_above (max n 3);
       h \<leftarrow> prod_pmf ({..<s\<^sub>1} \<times> {..<s\<^sub>2}) (\<lambda>_. pmf_of_set (bounded_degree_polynomials (mod_ring p) 4));
       return_pmf (s\<^sub>1, s\<^sub>2, p, h, (\<lambda>_ \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. (0 :: int)))
     }"
 
 fun f2_update :: "nat \<Rightarrow> f2_state \<Rightarrow> f2_state pmf" where
   "f2_update x (s\<^sub>1, s\<^sub>2, p, h, sketch) = 
     return_pmf (s\<^sub>1, s\<^sub>2, p, h, \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. f2_hash p (h i) x + sketch i)"
 
 fun f2_result :: "f2_state \<Rightarrow> rat pmf" where
   "f2_result (s\<^sub>1, s\<^sub>2, p, h, sketch) = 
     return_pmf (median s\<^sub>2 (\<lambda>i\<^sub>2 \<in> {..<s\<^sub>2}. 
       (\<Sum>i\<^sub>1\<in>{..<s\<^sub>1} . (rat_of_int (sketch (i\<^sub>1, i\<^sub>2)))\<^sup>2) / (((rat_of_nat p)\<^sup>2-1) * rat_of_nat s\<^sub>1)))"
 
 fun f2_space_usage :: "(nat \<times> nat \<times> rat \<times> rat) \<Rightarrow> real" where
   "f2_space_usage (n, m, \<epsilon>, \<delta>) = (
     let s\<^sub>1 = nat \<lceil>6 / \<delta>\<^sup>2 \<rceil> in
     let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil> in 
     3 +
     2 * log 2 (s\<^sub>1 + 1) +
     2 * log 2 (s\<^sub>2 + 1) +
     2 * log 2 (9 + 2 * real n) +
     s\<^sub>1 * s\<^sub>2 * (5 + 4*log 2 (8 + 2 * real n) + 2 * log 2 (real m * (18 + 4 * real n) + 1 )))"
 
 definition encode_f2_state :: "f2_state \<Rightarrow> bool list option" where
   "encode_f2_state = 
     N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>1. 
     N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>2. 
     N\<^sub>e \<Join>\<^sub>e (\<lambda>p. 
     (List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e P\<^sub>e p 4) \<times>\<^sub>e
     (List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e))))"
 
 lemma "inj_on encode_f2_state (dom encode_f2_state)"
 proof -
   have " is_encoding encode_f2_state"
     unfolding encode_f2_state_def
     by (intro dependent_encoding exp_golomb_encoding fun_encoding list_encoding int_encoding poly_encoding)
       
   thus ?thesis
     by (rule encoding_imp_inj)
 qed
 
 context
   fixes \<epsilon> \<delta> :: rat
   fixes n :: nat
   fixes as :: "nat list"
   fixes result
   assumes \<epsilon>_range: "\<epsilon> \<in> {0<..<1}"
   assumes \<delta>_range: "\<delta> > 0"
   assumes as_range: "set as \<subseteq> {..<n}"
   defines "result \<equiv> fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n) \<bind> f2_result"
 begin  
 
 private definition s\<^sub>1 where "s\<^sub>1 = nat \<lceil>6 / \<delta>\<^sup>2\<rceil>"
 
 lemma s1_gt_0: "s\<^sub>1 > 0"
     using \<delta>_range by (simp add:s\<^sub>1_def)
 
 private definition s\<^sub>2 where "s\<^sub>2 = nat \<lceil>-(18* ln (real_of_rat \<epsilon>))\<rceil>"
 
 lemma s2_gt_0: "s\<^sub>2 > 0"
     using \<epsilon>_range by (simp add:s\<^sub>2_def)
 
 private definition p where "p = prime_above (max n 3)"
  
 lemma p_prime: "Factorial_Ring.prime p" 
   unfolding p_def using prime_above_prime by blast
 
 lemma p_ge_3: "p \<ge> 3"
     unfolding p_def by (meson max.boundedE prime_above_lower_bound)
 
 lemma p_gt_0: "p > 0" using p_ge_3 by linarith
 
 lemma p_gt_1: "p > 1" using p_ge_3 by simp
 
 lemma p_ge_n: "p \<ge> n" unfolding p_def
   by (meson max.boundedE prime_above_lower_bound )
 
 interpretation carter_wegman_hash_family "mod_ring p" 4
   using carter_wegman_hash_familyI[OF mod_ring_is_field mod_ring_finite]
   using p_prime by auto
 
 definition sketch where "sketch = fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n)"
 private definition \<Omega> where"\<Omega> = prod_pmf ({..<s\<^sub>1} \<times> {..<s\<^sub>2}) (\<lambda>_. pmf_of_set space)" 
 private definition \<Omega>\<^sub>p where"\<Omega>\<^sub>p = measure_pmf \<Omega>" 
 private definition sketch_rv where "sketch_rv \<omega> = of_int (sum_list (map (f2_hash p \<omega>) as))^2"
 private definition mean_rv where "mean_rv \<omega> = (\<lambda>i\<^sub>2. (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) / (((of_nat p)\<^sup>2 - 1) * of_nat s\<^sub>1))"
 private definition result_rv where "result_rv \<omega> = median s\<^sub>2 (\<lambda>i\<^sub>2\<in>{..<s\<^sub>2}. mean_rv \<omega> i\<^sub>2)"
 
 lemma mean_rv_alg_sketch:
   "sketch = \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (\<omega> i)) as)))"
 proof -
   have "sketch =  fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n)"
     by (simp add:sketch_def)
   also have "... = \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, 
       \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (\<omega> i)) as)))"
   proof (induction as rule:rev_induct)
     case Nil
     then show ?case 
       by (simp add:s\<^sub>1_def s\<^sub>2_def space_def p_def[symmetric] \<Omega>_def restrict_def Let_def) 
   next
     case (snoc a as)
     have "fold (\<lambda>a state. state \<bind> f2_update a) (as @ [a]) (f2_init \<delta> \<epsilon> n) = \<Omega> \<bind> 
       (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, \<lambda>s \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. (\<Sum>x \<leftarrow> as.  f2_hash p (\<omega> s) x)) \<bind> f2_update a)"
       using snoc by (simp add: bind_assoc_pmf restrict_def del:f2_hash.simps f2_init.simps)
     also have "... =  \<Omega> \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1, s\<^sub>2, p, \<omega>, \<lambda>i \<in> {..<s\<^sub>1} \<times> {..<s\<^sub>2}. (\<Sum>x \<leftarrow> as@[a].  f2_hash p (\<omega> i) x)))"
       by (subst bind_return_pmf) (simp add: add.commute del:f2_hash.simps cong:restrict_cong)
     finally show ?case by blast
   qed
   finally show ?thesis by auto
 qed
 
 lemma distr:  "result = map_pmf result_rv \<Omega>"
 proof -
   have "result = sketch \<bind> f2_result"
     by (simp add:result_def sketch_def)
   also have "... = \<Omega> \<bind> (\<lambda>x. f2_result (s\<^sub>1, s\<^sub>2, p, x, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (x i)) as)))"
     by (simp add: mean_rv_alg_sketch  bind_assoc_pmf bind_return_pmf)
   also have "... = map_pmf result_rv \<Omega>"
     by (simp add:map_pmf_def result_rv_def mean_rv_def sketch_rv_def lessThan_atLeast0 cong:restrict_cong)
   finally show ?thesis by simp
 qed
 
 private lemma f2_hash_pow_exp:
   assumes "k < p"
   shows
     "expectation (\<lambda>\<omega>. real_of_int (f2_hash p \<omega> k) ^m) = 
      ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p)"
 proof -
 
   have "odd p" using p_prime p_ge_3 prime_odd_nat assms by simp
   then obtain t where t_def: "p=2*t+1" 
     using oddE by blast
 
   have "Collect even \<inter> {..<2 * t + 1} \<subseteq> (*) 2 ` {..<t + 1}" 
     by (rule in_image_by_witness[where g="\<lambda>x. x div 2"], simp, linarith)
   moreover have " (*) 2 ` {..<t + 1} \<subseteq> Collect even \<inter> {..<2 * t + 1}"
     by (rule image_subsetI, simp)
   ultimately have "card ({k. even k} \<inter> {..<p}) = card ((\<lambda>x. 2*x) ` {..<t+1})"
     unfolding t_def using order_antisym by metis
   also have "... = card {..<t+1}" 
     by (rule card_image, simp add: inj_on_mult)
   also have "... =  t+1" by simp
   finally have card_even: "card ({k. even k} \<inter> {..<p}) = t+1" by simp
   hence "card ({k. even k} \<inter> {..<p}) * 2 = (p+1)" by (simp add:t_def)
   hence prob_even: "prob {\<omega>. hash k \<omega> \<in> Collect even} = (real p + 1)/(2*real p)"
     using assms by (subst prob_range, auto simp:frac_eq_eq p_gt_0 mod_ring_def) 
 
   have "p = card {..<p}" by simp
   also have "... = card (({k. odd k} \<inter> {..<p}) \<union> ({k. even k} \<inter> {..<p}))" 
     by (rule arg_cong[where f="card"], auto)
   also have "... = card ({k. odd k} \<inter> {..<p}) +  card ({k. even k} \<inter> {..<p})"
     by (rule card_Un_disjoint, simp, simp, blast)
   also have "... = card ({k. odd k} \<inter> {..<p}) + t+1"
     by (simp add:card_even)
   finally have "p = card ({k. odd k} \<inter> {..<p}) + t+1"
     by simp
   hence "card ({k. odd k} \<inter> {..<p}) * 2 = (p-1)" 
     by (simp add:t_def)
   hence prob_odd: "prob {\<omega>. hash k \<omega> \<in> Collect odd} = (real p - 1)/(2*real p)"
     using assms by (subst prob_range, auto simp add: frac_eq_eq mod_ring_def)
 
   have "expectation (\<lambda>x. real_of_int (f2_hash p x k) ^ m) =
     expectation (\<lambda>\<omega>. indicator {\<omega>. even (hash k \<omega>)} \<omega> * (real p - 1)^m + 
       indicator {\<omega>. odd (hash k \<omega>)} \<omega> * (-real p - 1)^m)" 
     by (rule Bochner_Integration.integral_cong, simp, simp)
   also have "... = 
      prob {\<omega>. hash  k \<omega> \<in> Collect even}  * (real p - 1) ^ m  + 
      prob {\<omega>. hash  k \<omega> \<in> Collect odd}  * (-real p - 1) ^ m "
     by (simp, simp add:M_def)
   also have "... = (real p + 1) * (real p - 1) ^ m / (2 * real p) + (real p - 1) * (- real p - 1) ^ m / (2 * real p)"
     by (subst prob_even, subst prob_odd, simp)
   also have "... =  
     ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p)"
     by (simp add:add_divide_distrib ac_simps)
   finally show "expectation (\<lambda>x. real_of_int (f2_hash p x k) ^ m) = 
     ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p)" by simp
 qed
 
 lemma 
   shows var_sketch_rv:"variance sketch_rv \<le> 2*(real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2" (is "?A")
   and exp_sketch_rv:"expectation sketch_rv = real_of_rat (F 2 as) * ((real p)\<^sup>2-1)" (is "?B")
 proof -
   define h where "h = (\<lambda>\<omega> x. real_of_int (f2_hash p \<omega> x))"
   define c where "c = (\<lambda>x. real (count_list as x))"
   define r where "r = (\<lambda>(m::nat). ((real p - 1) ^ m * (real p + 1) + (- real p - 1) ^ m * (real p - 1)) / (2 * real p))"
   define h_prod where "h_prod = (\<lambda>as \<omega>. prod_list (map (h \<omega>) as))" 
 
   define exp_h_prod :: "nat list \<Rightarrow> real" where "exp_h_prod = (\<lambda>as. (\<Prod>i \<in> set as. r (count_list as i)))"
 
   have f_eq: "sketch_rv = (\<lambda>\<omega>. (\<Sum>x \<in> set as. c x * h \<omega> x)^2)"
     by (rule ext, simp add:sketch_rv_def c_def h_def sum_list_eval del:f2_hash.simps)
 
   have r_one: "r (Suc 0) = 0"
     by (simp add:r_def algebra_simps)
 
   have r_two: "r 2 = (real p^2-1)"
     using p_gt_0 unfolding r_def power2_eq_square 
     by (simp add:nonzero_divide_eq_eq, simp add:algebra_simps)
 
   have"(real p)^2 \<ge> 2^2"
     by (rule power_mono, use p_gt_1 in linarith, simp)
   hence p_square_ge_4: "(real p)\<^sup>2 \<ge> 4" by simp
 
   have "r 4 = (real p)^4+2*(real p)\<^sup>2 - 3" 
     using p_gt_0 unfolding r_def
     by (subst nonzero_divide_eq_eq, auto simp:power4_eq_xxxx power2_eq_square algebra_simps)
   also have "... \<le> (real p)^4+2*(real p)\<^sup>2 + 3"
     by simp
   also have "... \<le> 3 * r 2 * r 2"
     using p_square_ge_4
     by (simp add:r_two power4_eq_xxxx power2_eq_square algebra_simps mult_left_mono)
   finally have r_four_est: "r 4 \<le> 3 * r 2 * r 2"  by simp
 
   have exp_h_prod_elim: "exp_h_prod = (\<lambda>as. prod_list (map (r \<circ> count_list as) (remdups as)))" 
     by (simp add:exp_h_prod_def prod.set_conv_list[symmetric])
 
   have exp_h_prod: "\<And>x. set x \<subseteq> set as \<Longrightarrow> length x \<le> 4 \<Longrightarrow> expectation (h_prod x) = exp_h_prod x"
   proof -
     fix x 
     assume "set x \<subseteq> set as"
     hence x_sub_p: "set x \<subseteq> {..<p}" using as_range p_ge_n by auto
     hence x_le_p: "\<And>k. k \<in> set x \<Longrightarrow> k < p" by auto
     assume "length x \<le> 4"
     hence card_x: "card (set x) \<le> 4" using card_length dual_order.trans by blast
 
     have "set x \<subseteq> carrier (mod_ring p) "
       using x_sub_p by (simp add:mod_ring_def)
 
     hence h_indep: "indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. h \<omega> i ^ count_list x i) (set x)"
       using k_wise_indep_vars_subset[OF k_wise_indep] card_x as_range h_def
       by (auto intro:indep_vars_compose2[where X="hash" and M'=" (\<lambda>_. discrete)"])
 
     have "expectation (h_prod x) = expectation (\<lambda>\<omega>. \<Prod> i \<in> set x. h \<omega> i^(count_list x i))"
       by (simp add:h_prod_def prod_list_eval)
     also have "... = (\<Prod>i \<in> set x. expectation (\<lambda>\<omega>. h \<omega> i^(count_list x i)))"
       by (simp add: indep_vars_lebesgue_integral[OF _ h_indep])
     also have "... = (\<Prod>i \<in> set x. r (count_list x i))"
       using f2_hash_pow_exp x_le_p 
       by (simp add:h_def r_def M_def[symmetric] del:f2_hash.simps)
     also have "... = exp_h_prod x"
       by (simp add:exp_h_prod_def)
     finally show "expectation (h_prod x) = exp_h_prod x" by simp
   qed
 
   have "\<And>x y. kernel_of x = kernel_of y \<Longrightarrow> exp_h_prod x = exp_h_prod y" 
   proof -
     fix x y :: "nat list"
     assume a:"kernel_of x = kernel_of y"
     then obtain f where b:"bij_betw f (set x) (set y)" and c:"\<And>z. z \<in> set x \<Longrightarrow> count_list x z = count_list y (f z)"
       using kernel_of_eq_imp_bij by blast
     have "exp_h_prod x = prod ( (\<lambda>i. r(count_list y i)) \<circ> f) (set x)"
       by (simp add:exp_h_prod_def c)
     also have "... = (\<Prod>i \<in> f ` (set x). r(count_list y i))"
       by (metis b bij_betw_def prod.reindex)
     also have "... = exp_h_prod y"
       unfolding exp_h_prod_def
       by (rule prod.cong, metis b bij_betw_def) simp
     finally show "exp_h_prod x = exp_h_prod y" by simp
   qed
 
   hence exp_h_prod_cong: "\<And>p x. of_bool (kernel_of x = kernel_of p) * exp_h_prod p = 
     of_bool (kernel_of x = kernel_of p) * exp_h_prod x" 
     by (metis (full_types) of_bool_eq_0_iff vector_space_over_itself.scale_zero_left)
 
   have c:"(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * r) = r"
     if a:"length xs = n" for xs :: "nat list" and n and r :: real
   proof -
     have "(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * 1) = (1::real)"
       using equiv_rels_2[OF a[symmetric]] by (simp add:equiv_rels_def comp_def) 
     thus "(\<Sum>p\<leftarrow>enum_rgfs n. of_bool (kernel_of xs = kernel_of p) * r) = (r::real)" 
       by (simp add:sum_list_mult_const)
   qed
 
   have "expectation sketch_rv = (\<Sum>i\<in>set as. (\<Sum>j\<in>set as. c i * c j * expectation (h_prod [i,j])))"
     by (simp add:f_eq h_prod_def power2_eq_square sum_distrib_left sum_distrib_right Bochner_Integration.integral_sum algebra_simps)
   also have "... = (\<Sum>i\<in>set as. (\<Sum>j\<in>set as. c i * c j * exp_h_prod [i,j]))"
     by (simp add:exp_h_prod)
   also have "... = (\<Sum>i \<in> set as. (\<Sum>j \<in> set as.  
     c i * c j * (sum_list (map (\<lambda>p. of_bool (kernel_of [i,j] = kernel_of p) * exp_h_prod p) (enum_rgfs 2)))))"
     by (subst exp_h_prod_cong, simp add:c)
   also have "... = (\<Sum>i\<in>set as. c i * c i * r 2)"
     by (simp add: numeral_eq_Suc kernel_of_eq All_less_Suc exp_h_prod_elim r_one distrib_left sum.distrib sum_collapse)
   also have "... = real_of_rat (F 2 as) * ((real p)^2-1)"
     by (simp add: sum_distrib_right[symmetric] c_def F_def power2_eq_square of_rat_sum of_rat_mult r_two)
   finally show b:?B by simp
 
   have "expectation (\<lambda>x. (sketch_rv x)\<^sup>2) = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as.
     c i1 * c i2 * c i3 * c i4 * expectation (h_prod [i1, i2, i3, i4])))))"
     by (simp add:f_eq h_prod_def power4_eq_xxxx sum_distrib_left sum_distrib_right Bochner_Integration.integral_sum algebra_simps)
   also have "... = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as. 
     c i1 * c i2 * c i3 * c i4 * exp_h_prod [i1,i2,i3,i4]))))"
     by (simp add:exp_h_prod)
   also have "... = (\<Sum>i1 \<in> set as. (\<Sum>i2 \<in> set as. (\<Sum>i3 \<in> set as. (\<Sum>i4 \<in> set as. 
     c i1 * c i2 * c i3 * c i4 * 
     (sum_list (map (\<lambda>p. of_bool (kernel_of [i1,i2,i3,i4] = kernel_of p) * exp_h_prod p) (enum_rgfs 4)))))))"
     by (subst exp_h_prod_cong, simp add:c)
   also have "... = 
     3 * (\<Sum>i \<in> set as. (\<Sum>j \<in> set as. c i^2 * c j^2 * r 2 * r 2)) + ((\<Sum> i \<in> set as. c i^4 * r 4) - 3 *  (\<Sum> i \<in> set as. c i ^ 4 * r 2 * r 2))"
     apply (simp add: numeral_eq_Suc exp_h_prod_elim r_one) (* large intermediate terms *)
     apply (simp add: kernel_of_eq All_less_Suc numeral_eq_Suc distrib_left sum.distrib sum_collapse neq_commute of_bool_not_iff)
     apply (simp add: algebra_simps sum_subtractf sum_collapse)
     apply (simp add: sum_distrib_left algebra_simps)
     done
   also have "... = 3 * (\<Sum>i \<in> set as. c i^2 * r 2)^2 + (\<Sum> i \<in> set as. c i ^ 4 * (r 4 - 3 * r 2 * r 2))"
     by (simp add:power2_eq_square sum_distrib_left algebra_simps sum_subtractf)
   also have "... = 3 * (\<Sum>i \<in> set as. c i^2)^2 * (r 2)^2 + (\<Sum>i \<in> set as. c i ^ 4 * (r 4 - 3 * r 2 * r 2))"
     by (simp add:power_mult_distrib sum_distrib_right[symmetric])
   also have "... \<le> 3 * (\<Sum>i \<in> set as. c i^2)^2 * (r 2)^2 + (\<Sum>i \<in> set as. c i ^ 4 * 0)"
     using r_four_est  
     by (auto intro!: sum_nonpos simp add:mult_nonneg_nonpos)
   also have "... = 3 * (real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2" 
     by (simp add:c_def r_two F_def of_rat_sum of_rat_power)
   finally have "expectation (\<lambda>x. (sketch_rv x)\<^sup>2) \<le> 3 * (real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2"
     by simp
   
   thus "variance sketch_rv \<le> 2*(real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2"
      by (simp add: variance_eq, simp add:power_mult_distrib b)
 qed
 
 lemma space_omega_1 [simp]: "Sigma_Algebra.space \<Omega>\<^sub>p = UNIV"
     by (simp add:\<Omega>\<^sub>p_def)
 
 interpretation \<Omega>: prob_space "\<Omega>\<^sub>p"
   by (simp add:\<Omega>\<^sub>p_def prob_space_measure_pmf)
 
 lemma integrable_\<Omega>:
   fixes f :: "((nat \<times> nat) \<Rightarrow> (nat list)) \<Rightarrow> real"
   shows "integrable \<Omega>\<^sub>p f"
   unfolding \<Omega>\<^sub>p_def \<Omega>_def
   by (rule integrable_measure_pmf_finite, auto intro:finite_PiE simp:set_prod_pmf)
 
 lemma sketch_rv_exp:
   assumes "i\<^sub>2 < s\<^sub>2"
   assumes "i\<^sub>1 \<in> {0..<s\<^sub>1}"
   shows "\<Omega>.expectation (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) = real_of_rat (F 2 as) * ((real p)\<^sup>2 - 1)"
 proof -
   have "\<Omega>.expectation (\<lambda>\<omega>.  (sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) :: real) = expectation sketch_rv"
     using integrable_\<Omega> integrable_M assms
     unfolding \<Omega>_def \<Omega>\<^sub>p_def M_def
     by (subst expectation_Pi_pmf_slice, auto)
   also have "... = (real_of_rat (F 2 as)) * ((real p)\<^sup>2 - 1)"
     using exp_sketch_rv by simp
   finally show ?thesis by simp
 qed
 
 lemma sketch_rv_var:
   assumes "i\<^sub>2 < s\<^sub>2"
   assumes "i\<^sub>1 \<in> {0..<s\<^sub>1}"
   shows "\<Omega>.variance (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2))) \<le> 2 * (real_of_rat (F 2 as))\<^sup>2 * ((real p)\<^sup>2 - 1)\<^sup>2"
 proof -
   have "\<Omega>.variance (\<lambda>\<omega>. (sketch_rv (\<omega> (i\<^sub>1, i\<^sub>2)) :: real)) = variance sketch_rv"
     using integrable_\<Omega> integrable_M assms
     unfolding \<Omega>_def \<Omega>\<^sub>p_def M_def
     by (subst variance_prod_pmf_slice, auto)
   also have "... \<le>  2 * (real_of_rat (F 2 as))\<^sup>2 * ((real p)\<^sup>2 - 1)\<^sup>2"
     using var_sketch_rv by simp
   finally show ?thesis by simp
 qed
 
 lemma mean_rv_exp:
   assumes "i < s\<^sub>2"
   shows "\<Omega>.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = real_of_rat (F 2 as)"
 proof -
   have a:"(real p)\<^sup>2 > 1" using p_gt_1 by simp
 
   have "\<Omega>.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. \<Omega>.expectation (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i)))) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)"
     using assms integrable_\<Omega> by (simp add:mean_rv_def)
   also have "... = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. real_of_rat (F 2 as) * ((real p)\<^sup>2 - 1)) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)" 
     using sketch_rv_exp[OF assms] by simp
   also have "... = real_of_rat (F 2 as)"
     using s1_gt_0 a by simp
   finally show ?thesis by simp
 qed
 
 lemma mean_rv_var:
   assumes "i < s\<^sub>2"
   shows "\<Omega>.variance (\<lambda>\<omega>. mean_rv \<omega> i) \<le> (real_of_rat (\<delta> * F 2 as))\<^sup>2 / 3"
 proof -
   have a: "\<Omega>.indep_vars (\<lambda>_. borel) (\<lambda>i\<^sub>1 x. sketch_rv (x (i\<^sub>1, i))) {0..<s\<^sub>1}"
     using assms
     unfolding \<Omega>\<^sub>p_def \<Omega>_def
     by (intro indep_vars_restrict_intro'[where f="fst"])
      (auto simp add: restrict_dfl_def case_prod_beta lessThan_atLeast0)
 
   have p_sq_ne_1: "(real p)^2 \<noteq> 1" 
     by (metis p_gt_1 less_numeral_extra(4) of_nat_power one_less_power pos2 semiring_char_0_class.of_nat_eq_1_iff)
 
   have s1_bound: " 6 / (real_of_rat \<delta>)\<^sup>2 \<le> real s\<^sub>1"
     unfolding s\<^sub>1_def
     by  (metis (mono_tags, opaque_lifting) of_rat_ceiling of_rat_divide of_rat_numeral_eq of_rat_power real_nat_ceiling_ge)
 
   have "\<Omega>.variance (\<lambda>\<omega>. mean_rv \<omega> i) = \<Omega>.variance (\<lambda>\<omega>. \<Sum>i\<^sub>1 = 0..<s\<^sub>1. sketch_rv (\<omega> (i\<^sub>1, i))) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)\<^sup>2"
     unfolding mean_rv_def by (subst \<Omega>.variance_divide[OF integrable_\<Omega>], simp)
   also have "... = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. \<Omega>.variance (\<lambda>\<omega>. sketch_rv (\<omega> (i\<^sub>1, i)))) / (((real p)\<^sup>2 - 1) * real s\<^sub>1)\<^sup>2"
-    by (subst \<Omega>.var_sum_all_indep[OF _ _ integrable_\<Omega> a]) (auto simp: \<Omega>_def \<Omega>\<^sub>p_def)
+    by (subst \<Omega>.bienaymes_identity_full_indep[OF _ _ integrable_\<Omega> a]) (auto simp: \<Omega>_def \<Omega>\<^sub>p_def)
   also have "... \<le>  (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. 2*(real_of_rat (F 2 as)^2) * ((real p)\<^sup>2-1)\<^sup>2)  / (((real p)\<^sup>2 - 1) * real s\<^sub>1)\<^sup>2"
     by (rule divide_right_mono, rule sum_mono[OF sketch_rv_var[OF assms]], auto)
   also have "... = 2 * (real_of_rat (F 2 as)^2) / real s\<^sub>1"
     using p_sq_ne_1 s1_gt_0 by (subst frac_eq_eq, auto simp:power2_eq_square)
   also have "... \<le> 2 * (real_of_rat (F 2 as)^2) / (6 / (real_of_rat \<delta>)\<^sup>2)"
     using  s1_gt_0 \<delta>_range by (intro divide_left_mono mult_pos_pos s1_bound) auto
   also have "... = (real_of_rat (\<delta> * F 2 as))\<^sup>2 / 3"
     by (simp add:of_rat_mult algebra_simps)
   finally show ?thesis by simp
 qed
 
 lemma mean_rv_bounds:
   assumes "i < s\<^sub>2"
   shows "\<Omega>.prob {\<omega>. real_of_rat \<delta> * real_of_rat (F 2 as) < \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>} \<le> 1/3"
 proof (cases "as = []")
   case True
   then show ?thesis
     using assms by (subst mean_rv_def, subst sketch_rv_def, simp add:F_def)
 next
   case False
   hence "F 2 as > 0" using F_gr_0 by auto
 
   hence a: "0 < real_of_rat (\<delta> * F 2 as)"
     using \<delta>_range by simp
   have [simp]: "(\<lambda>\<omega>. mean_rv \<omega> i) \<in> borel_measurable \<Omega>\<^sub>p"
     by (simp add:\<Omega>_def \<Omega>\<^sub>p_def)
   have "\<Omega>.prob {\<omega>. real_of_rat \<delta> * real_of_rat (F 2 as) < \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>} \<le> 
       \<Omega>.prob {\<omega>. real_of_rat (\<delta> * F 2 as) \<le> \<bar>mean_rv \<omega> i - real_of_rat (F 2 as)\<bar>}"
     by (rule \<Omega>.pmf_mono[OF \<Omega>\<^sub>p_def], simp add:of_rat_mult)
   also have "... \<le>  \<Omega>.variance (\<lambda>\<omega>. mean_rv \<omega> i) / (real_of_rat (\<delta> * F 2 as))\<^sup>2"
     using \<Omega>.Chebyshev_inequality[where a="real_of_rat (\<delta> * F 2 as)" and f="\<lambda>\<omega>. mean_rv \<omega> i",simplified] 
       a prob_space_measure_pmf[where p="\<Omega>"] mean_rv_exp[OF assms] integrable_\<Omega> by simp
   also have "... \<le> ((real_of_rat (\<delta> * F 2 as))\<^sup>2/3) / (real_of_rat (\<delta> * F 2 as))\<^sup>2"
     by (rule divide_right_mono, rule mean_rv_var[OF assms], simp)
   also  have "... = 1/3" using a by force
   finally show ?thesis by blast
 qed
 
 lemma f2_alg_correct':
    "\<P>(\<omega> in measure_pmf result. \<bar>\<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as) \<ge> 1-of_rat \<epsilon>"
 proof -
   have a: "\<Omega>.indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. mean_rv \<omega> i) {0..<s\<^sub>2}" 
     using s1_gt_0 unfolding \<Omega>\<^sub>p_def \<Omega>_def
     by (intro indep_vars_restrict_intro'[where f="snd"])
       (auto simp: \<Omega>\<^sub>p_def \<Omega>_def mean_rv_def restrict_dfl_def)
 
   have b: "- 18 * ln (real_of_rat \<epsilon>) \<le> real s\<^sub>2" 
     unfolding  s\<^sub>2_def using of_nat_ceiling by auto
 
   have "1 - of_rat \<epsilon> \<le> \<Omega>.prob {\<omega>.  \<bar>median s\<^sub>2 (mean_rv \<omega>) -  real_of_rat (F 2 as) \<bar> \<le> of_rat \<delta> * of_rat (F 2 as)}"
     using \<epsilon>_range \<Omega>.median_bound_2[OF _ a b, where \<delta>="real_of_rat \<delta> * real_of_rat (F 2 as)"
         and \<mu>="real_of_rat (F 2 as)"] mean_rv_bounds
     by simp
   also have "... = \<Omega>.prob {\<omega>.  \<bar>real_of_rat (result_rv \<omega>) - of_rat (F 2 as) \<bar> \<le> of_rat \<delta> * of_rat (F 2 as)}"
     by (simp add:result_rv_def median_restrict lessThan_atLeast0 median_rat[OF s2_gt_0]
          mean_rv_def sketch_rv_def of_rat_divide of_rat_sum of_rat_mult of_rat_diff of_rat_power)
   also have "... = \<Omega>.prob {\<omega>. \<bar>result_rv \<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as} " 
     by (simp add:of_rat_less_eq of_rat_mult[symmetric]  of_rat_diff[symmetric] set_eq_iff)
   finally have "\<Omega>.prob {y. \<bar>result_rv y - F 2 as\<bar> \<le> \<delta> * F 2 as} \<ge> 1-of_rat \<epsilon> " by simp
   thus ?thesis by (simp add: distr \<Omega>\<^sub>p_def)
 qed
 
 lemma f2_exact_space_usage':
    "AE \<omega> in sketch . bit_count (encode_f2_state \<omega>) \<le> f2_space_usage (n, length as, \<epsilon>, \<delta>)"
 proof -
   have "p \<le> 2 * max n 3 + 2"
     by (subst p_def, rule prime_above_upper_bound)
   also have "... \<le> 2 * n + 8"
     by (cases "n \<le> 2", simp_all)
   finally have p_bound: "p \<le> 2 * n + 8" 
     by simp
   have "bit_count (N\<^sub>e p) \<le> ereal (2 * log 2 (real p + 1) + 1)"
     by (rule exp_golomb_bit_count)
   also have "... \<le> ereal (2 * log 2 (2 * real n + 9) + 1)"
     using p_bound by simp
   finally have p_bit_count: "bit_count (N\<^sub>e p) \<le> ereal (2 * log 2 (2 * real n + 9) + 1)"
     by simp
 
   have a: "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. 
       sum_list (map (f2_hash p (y i)) as))) \<le> ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))"
     if a:"y\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2} \<rightarrow>\<^sub>E bounded_degree_polynomials (mod_ring p) 4" for y
   proof -
     have "y \<in> extensional ({..<s\<^sub>1} \<times> {..<s\<^sub>2})" using a PiE_iff by blast
     hence y_ext: "y \<in> extensional (set (List.product [0..<s\<^sub>1] [0..<s\<^sub>2]))"
       by (simp add:lessThan_atLeast0)
 
     have h_bit_count_aux: "bit_count (P\<^sub>e p 4 (y x)) \<le> ereal (4 + 4 * log 2 (8 + 2 * real n))"
       if b:"x \<in>  set (List.product [0..<s\<^sub>1] [0..<s\<^sub>2])" for x
     proof -
       have "y x \<in> bounded_degree_polynomials (mod_ring p) 4"
         using b a by force
       hence "bit_count (P\<^sub>e p 4 (y x)) \<le> ereal (real 4 * (log 2 (real p) + 1))"
         by (rule bounded_degree_polynomial_bit_count[OF p_gt_1] )
       also have "... \<le> ereal (real 4 * (log 2 (8 + 2 * real n) + 1) )"
         using p_gt_0 p_bound by simp
       also have "... \<le> ereal (4 + 4 * log 2 (8 + 2 * real n))"
         by simp
       finally show ?thesis
         by blast
     qed
 
     have h_bit_count: 
       "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e P\<^sub>e p 4) y) \<le> ereal (real s\<^sub>1 * real s\<^sub>2 * (4 + 4 * log 2 (8 + 2 * real n)))"
       using fun_bit_count_est[where e="P\<^sub>e p 4", OF y_ext h_bit_count_aux]
       by simp
 
     have sketch_bit_count_aux:
       "bit_count (I\<^sub>e (sum_list (map (f2_hash p (y x)) as))) \<le> ereal (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1))" (is "?lhs \<le> ?rhs")
       if " x \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}" for x
     proof -
       have "\<bar>sum_list (map (f2_hash p (y x)) as)\<bar> \<le> sum_list (map (abs \<circ> (f2_hash p (y x))) as)" 
         by (subst map_map[symmetric])  (rule sum_list_abs)
       also have "... \<le>  sum_list (map (\<lambda>_. (int p+1)) as)"
         by (rule sum_list_mono) (simp add:p_gt_0) 
       also have "... = int (length as) * (int p+1)"
         by (simp add: sum_list_triv)
       also have "... \<le> int (length as) * (9+2*(int n))"
         using p_bound by (intro mult_mono, auto)
       finally  have "\<bar>sum_list (map (f2_hash p (y x)) as)\<bar> \<le> int (length as) * (9 + 2 * int n)" by simp
       hence "?lhs \<le> ereal (2 * log 2 (real_of_int (2* (int (length as) * (9 + 2 * int n)) + 1)) + 1)"
         by (rule int_bit_count_est)
       also have "... = ?rhs" by (simp add:algebra_simps)
       finally show "?thesis" by simp
     qed
 
     have 
       "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as)))
       \<le> ereal (real (length (List.product [0..<s\<^sub>1] [0..<s\<^sub>2]))) * (ereal (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1)))"
       by (intro fun_bit_count_est)  
        (simp_all add:extensional_def lessThan_atLeast0 sketch_bit_count_aux del:f2_hash.simps)
     also have "... = ereal (real s\<^sub>1 * real s\<^sub>2 * (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1)))"
       by simp
     finally have sketch_bit_count: 
        "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le>
       ereal (real s\<^sub>1 * real s\<^sub>2 * (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1)))" by simp
 
     have "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le> 
       bit_count (N\<^sub>e s\<^sub>1) + bit_count (N\<^sub>e s\<^sub>2) +bit_count (N\<^sub>e p) +
       bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e P\<^sub>e p 4) y) +
       bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e I\<^sub>e) (\<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as)))"   
       by (simp add:Let_def s\<^sub>1_def s\<^sub>2_def encode_f2_state_def dependent_bit_count add.assoc)
     also have "... \<le> ereal (2 * log 2 (real s\<^sub>1 + 1) + 1) + ereal (2 * log 2 (real s\<^sub>2 + 1) + 1) + ereal (2 * log 2 (2 * real n + 9) + 1) + 
       (ereal (real s\<^sub>1 * real s\<^sub>2) * (4 + 4 * log 2 (8 + 2 * real n))) + 
       (ereal (real s\<^sub>1 * real s\<^sub>2) * (1 + 2 * log 2 (real (length as) * (18 + 4 * real n) + 1) ))"
       by (intro add_mono exp_golomb_bit_count p_bit_count, auto intro: h_bit_count sketch_bit_count)
     also have "... = ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))"
       by (simp add:distrib_left add.commute s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric] Let_def)
     finally show "bit_count (encode_f2_state (s\<^sub>1, s\<^sub>2, p, y, \<lambda>i\<in>{..<s\<^sub>1} \<times> {..<s\<^sub>2}. sum_list (map (f2_hash p (y i)) as))) \<le>  
       ereal (f2_space_usage (n, length as, \<epsilon>, \<delta>))" 
       by simp
   qed
 
   have "set_pmf \<Omega> = {..<s\<^sub>1} \<times> {..<s\<^sub>2} \<rightarrow>\<^sub>E bounded_degree_polynomials (mod_ring p) 4"
     by (simp add: \<Omega>_def set_prod_pmf) (simp add: space_def)
   thus ?thesis
     by (simp  add:mean_rv_alg_sketch AE_measure_pmf_iff del:f2_space_usage.simps, metis a)
 qed
 
 end
 
 
 text \<open>Main results of this section:\<close>
 
 theorem f2_alg_correct:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "\<Omega> \<equiv> fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n) \<bind> f2_result"
   shows "\<P>(\<omega> in measure_pmf \<Omega>. \<bar>\<omega> - F 2 as\<bar> \<le> \<delta> * F 2 as) \<ge> 1-of_rat \<epsilon>"
   using f2_alg_correct'[OF assms(1,2,3)] \<Omega>_def by auto
 
 theorem f2_exact_space_usage:
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> f2_update a) as (f2_init \<delta> \<epsilon> n)"
   shows "AE \<omega> in M. bit_count (encode_f2_state \<omega>) \<le> f2_space_usage (n, length as, \<epsilon>, \<delta>)"
   using f2_exact_space_usage'[OF assms(1,2,3)]
   by (subst (asm) sketch_def[OF assms(1,2,3)], subst M_def, simp)
 
 theorem f2_asymptotic_space_complexity:
   "f2_space_usage \<in> O[at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda> (n, m, \<epsilon>, \<delta>). 
   (ln (1 / of_rat \<epsilon>)) / (of_rat \<delta>)\<^sup>2 * (ln (real n) + ln (real m)))"
   (is "_ \<in> O[?F](?rhs)")
 proof -
   define n_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "n_of = (\<lambda>(n, m, \<epsilon>, \<delta>). n)"
   define m_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "m_of = (\<lambda>(n, m, \<epsilon>, \<delta>). m)"
   define \<epsilon>_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<epsilon>_of = (\<lambda>(n, m, \<epsilon>, \<delta>). \<epsilon>)"
   define \<delta>_of :: "nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<delta>_of = (\<lambda>(n, m, \<epsilon>, \<delta>). \<delta>)"
 
   define g where "g = (\<lambda>x. (1/ (of_rat (\<delta>_of x))\<^sup>2) * (ln (1 / of_rat (\<epsilon>_of x))) * (ln (real (n_of x)) + ln (real (m_of x))))"
 
   have evt: "(\<And>x. 
     0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and> 
     1/real_of_rat (\<delta>_of x) \<ge> \<delta> \<and> 1/real_of_rat (\<epsilon>_of x) \<ge> \<epsilon> \<and>
     real (n_of x) \<ge> n \<and> real (m_of x) \<ge> m\<Longrightarrow> P x) 
     \<Longrightarrow> eventually P ?F"  (is "(\<And>x. ?prem x \<Longrightarrow> _) \<Longrightarrow> _")
     for \<delta> \<epsilon> n m P
     apply (rule eventually_mono[where P="?prem" and Q="P"])
     apply (simp add:\<epsilon>_of_def case_prod_beta' \<delta>_of_def n_of_def m_of_def)
      apply (intro eventually_conj eventually_prod1' eventually_prod2' 
         sequentially_inf eventually_at_right_less inv_at_right_0_inf)
     by (auto simp add:prod_filter_eq_bot)
 
   have unit_1: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using one_le_power
     by (intro landau_o.big_mono evt[where \<delta>="1"], auto simp add:power_one_over[symmetric])
 
   have unit_2: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono  evt[where \<epsilon>="exp 1"])
      (auto intro!:iffD2[OF ln_ge_iff] simp add:abs_ge_iff)
 
   have unit_3: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x))"
     by (intro landau_o.big_mono evt, auto)
 
   have unit_4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (m_of x))"
     by (intro landau_o.big_mono evt, auto)
 
   have unit_5: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     by (auto intro!: landau_o.big_mono evt[where n="exp 1"])
       (metis abs_ge_self linorder_not_le ln_ge_iff not_exp_le_zero order.trans)
 
   have unit_6: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1 evt unit_5 iffD2[OF ln_ge_iff], auto)
 
   have unit_7: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / real_of_rat (\<epsilon>_of x))"
     by (intro landau_o.big_mono  evt[where \<epsilon>="1"], auto)
  
   have unit_8: "(\<lambda>_. 1) \<in> O[?F](g)" 
     unfolding g_def by (intro landau_o.big_mult_1 unit_1 unit_2 unit_6)
 
   have unit_9: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x) * real (m_of x))"
     by (intro landau_o.big_mult_1 unit_3 unit_4)
 
   have " (\<lambda>x. 6 * (1 / (real_of_rat (\<delta>_of x))\<^sup>2)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     by (subst landau_o.big.cmult_in_iff, simp_all)
   hence l1: "(\<lambda>x. real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>)) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     by (intro landau_real_nat  landau_rat_ceil[OF unit_1]) (simp_all add:of_rat_divide of_rat_power)
 
   have "(\<lambda>x. - ( ln (real_of_rat (\<epsilon>_of x)))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_o.big_mono evt) (subst ln_div, auto)
   hence l2: "(\<lambda>x. real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     by (intro landau_real_nat landau_ceil[OF unit_2], simp)
 
   have l3_aux: " (\<lambda>x. real (m_of x) * (18 + 4 * real (n_of x)) + 1) \<in> O[?F](\<lambda>x. real (n_of x) * real (m_of x))"
     by (rule sum_in_bigo[OF _unit_9], subst mult.commute)
       (intro landau_o.mult sum_in_bigo, auto simp:unit_3)
 
   have "(\<lambda>x. ln (real (m_of x) * (18 + 4 * real (n_of x)) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x) * real (m_of x)))"
      apply (rule landau_ln_2[where a="2"], simp, simp)
       apply (rule evt[where m="2" and n="1"])
      apply (metis dual_order.trans mult_left_mono mult_of_nat_commute of_nat_0_le_iff verit_prod_simplify(1))
     using l3_aux by simp
   also have "(\<lambda>x. ln (real (n_of x) * real (m_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln(real (m_of x)))"
     by (intro landau_o.big_mono evt[where m="1" and n="1"], auto simp add:ln_mult)
   finally have l3: "(\<lambda>x. ln (real (m_of x) * (18 + 4 * real (n_of x)) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     using  landau_o.big_trans by simp
 
   have l4: "(\<lambda>x. ln (8 + 2 * real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1  evt[where n="2"] landau_ln_2[where a="2"] iffD2[OF ln_ge_iff])
      (auto intro!: sum_in_bigo simp add:unit_3)
 
   have l5: "(\<lambda>x. ln (9 + 2 * real (n_of x))) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1  evt[where n="2"] landau_ln_2[where a="2"] iffD2[OF ln_ge_iff])
      (auto intro!: sum_in_bigo simp add:unit_3)
 
   have l6: "(\<lambda>x. ln (real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>) + 1)) \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.big_mult_1 landau_ln_3 sum_in_bigo unit_6 unit_2 l1 unit_1, simp)
 
   have l7: "(\<lambda>x. ln (9 + 2 * real (n_of x))) \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.big_mult_1' unit_1 unit_2 l5)
 
   have l8: "(\<lambda>x. ln (real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>) + 1) ) \<in> O[?F](g)"
     unfolding g_def
     by (intro landau_o.big_mult_1 unit_6 landau_o.big_mult_1' unit_1 landau_ln_3 sum_in_bigo l2 unit_2) simp
 
   have l9: "(\<lambda>x. 5 + 4 * ln (8 + 2 * real (n_of x)) / ln 2 + 2 * ln (real (m_of x) * (18 + 4 * real (n_of x)) + 1) / ln 2)
       \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro sum_in_bigo, auto simp: l3 l4 unit_6)
 
   have l10: "(\<lambda>x. real (nat \<lceil>6 / (\<delta>_of x)\<^sup>2\<rceil>) * real (nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>) * 
       (5 + 4 * ln (8 + 2 * real (n_of x)) / ln 2 + 2 * ln(real (m_of x) * (18 + 4 * real (n_of x)) + 1) / ln 2))
       \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.mult, auto simp: l1 l2 l9)
 
   have "f2_space_usage = (\<lambda>x. f2_space_usage (n_of x, m_of x, \<epsilon>_of x, \<delta>_of x))"
     by (simp add:case_prod_beta' n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def)
   also have "... \<in> O[?F](g)"
     by (auto intro!:sum_in_bigo simp:Let_def log_def l6 l7 l8 l10 unit_8)
   also have "... = O[?F](?rhs)"
     by (simp add:case_prod_beta' g_def n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def)
   finally show ?thesis by simp
 qed
 
 end
diff --git a/thys/Frequency_Moments/Frequency_Moment_k.thy b/thys/Frequency_Moments/Frequency_Moment_k.thy
--- a/thys/Frequency_Moments/Frequency_Moment_k.thy
+++ b/thys/Frequency_Moments/Frequency_Moment_k.thy
@@ -1,1015 +1,1015 @@
 section \<open>Frequency Moment $k$\<close>
 
 theory Frequency_Moment_k
   imports 
     Frequency_Moments
     Landau_Ext 
     Lp.Lp
     Median_Method.Median
     Product_PMF_Ext 
 begin
 
 text \<open>This section contains a formalization of the algorithm for the $k$-th frequency moment.
 It is based on the algorithm described in \<^cite>\<open>\<open>\textsection 2.1\<close> in "alon1999"\<close>.\<close>
 
 type_synonym fk_state = "nat \<times> nat \<times> nat \<times> nat \<times> (nat \<times> nat \<Rightarrow> (nat \<times> nat))"
 
 fun fk_init :: "nat \<Rightarrow> rat \<Rightarrow> rat \<Rightarrow> nat \<Rightarrow> fk_state pmf" where
   "fk_init k \<delta> \<epsilon> n =
     do {
       let s\<^sub>1 = nat \<lceil>3 * real k * n powr (1-1/real k) / (real_of_rat \<delta>)\<^sup>2\<rceil>;
       let s\<^sub>2 = nat \<lceil>-18 * ln (real_of_rat \<epsilon>)\<rceil>;
       return_pmf (s\<^sub>1, s\<^sub>2, k, 0, (\<lambda>_ \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. (0,0)))
     }"
 
 fun fk_update :: "nat \<Rightarrow> fk_state \<Rightarrow> fk_state pmf" where
   "fk_update a (s\<^sub>1, s\<^sub>2, k, m, r) = 
     do {
       coins \<leftarrow> prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. bernoulli_pmf (1/(real m+1)));
       return_pmf (s\<^sub>1, s\<^sub>2, k, m+1, \<lambda>i \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. 
         if coins i then 
           (a,0) 
         else (
           let (x,l) = r i in (x, l + of_bool (x=a))
         )
       )
     }"
 
 fun fk_result :: "fk_state \<Rightarrow> rat pmf" where
   "fk_result (s\<^sub>1, s\<^sub>2, k, m, r) = 
     return_pmf (median s\<^sub>2 (\<lambda>i\<^sub>2 \<in> {0..<s\<^sub>2}.
       (\<Sum>i\<^sub>1\<in>{0..<s\<^sub>1}. rat_of_nat (let t = snd (r (i\<^sub>1, i\<^sub>2)) + 1 in m * (t^k - (t - 1)^k))) / (rat_of_nat s\<^sub>1))
     )"
 
 lemma bernoulli_pmf_1: "bernoulli_pmf 1 = return_pmf True"
   by (rule pmf_eqI, simp add:indicator_def)
 
 fun fk_space_usage :: "(nat \<times> nat \<times> nat \<times> rat \<times> rat) \<Rightarrow> real" where
   "fk_space_usage (k, n, m, \<epsilon>, \<delta>) = (
     let s\<^sub>1 = nat \<lceil>3*real k* (real n) powr (1-1/ real k) / (real_of_rat \<delta>)\<^sup>2 \<rceil> in
     let s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil> in 
     4 +
     2 * log 2 (s\<^sub>1 + 1) +
     2 * log 2 (s\<^sub>2 + 1) +
     2 * log 2 (real k + 1) +
     2 * log 2 (real m + 1) +
     s\<^sub>1 * s\<^sub>2 * (2 + 2 * log 2 (real n+1) + 2 * log 2 (real m+1)))"
 
 definition encode_fk_state :: "fk_state \<Rightarrow> bool list option" where
   "encode_fk_state = 
     N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>1. 
     N\<^sub>e \<Join>\<^sub>e (\<lambda>s\<^sub>2. 
     N\<^sub>e \<times>\<^sub>e  
     N\<^sub>e \<times>\<^sub>e  
     (List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e (N\<^sub>e \<times>\<^sub>e N\<^sub>e))))"
 
 lemma "inj_on encode_fk_state (dom encode_fk_state)"
 proof -
   have "is_encoding encode_fk_state"
     by (simp add:encode_fk_state_def)
      (intro dependent_encoding exp_golomb_encoding fun_encoding)
 
   thus ?thesis by (rule encoding_imp_inj)
 qed
 
 text \<open>This is an intermediate non-parallel form @{term "fk_update"} used only in the correctness proof.\<close>
 
 fun fk_update_2 :: "'a \<Rightarrow> (nat \<times> 'a \<times> nat) \<Rightarrow> (nat \<times> 'a \<times> nat) pmf" where
   "fk_update_2 a (m,x,l) = 
     do {
       coin \<leftarrow> bernoulli_pmf (1/(real m+1));
       return_pmf (m+1,if coin then (a,0) else (x, l + of_bool (x=a)))
     }"
 
 definition sketch where "sketch as i = (as ! i, count_list (drop (i+1) as) (as ! i))"
 
 lemma fk_update_2_distr:
   assumes "as \<noteq> []"
   shows "fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0,0,0)) =
   pmf_of_set {..<length as} \<bind> (\<lambda>k. return_pmf (length as, sketch as k))"
   using assms
 proof (induction as rule:rev_nonempty_induct)
   case (single x)
   show ?case using single 
     by (simp add:bind_return_pmf pmf_of_set_singleton bernoulli_pmf_1 lessThan_def sketch_def) 
 next
   case (snoc x xs)
   let ?h = "(\<lambda>xs k. count_list (drop (Suc k) xs) (xs ! k))"
   let ?q = "(\<lambda>xs k. (length xs, sketch xs k))"
 
   have non_empty: " {..<Suc (length xs)} \<noteq> {}" " {..<length xs} \<noteq> {}" using snoc by auto
 
   have fk_update_2_eta:"fk_update_2 x = (\<lambda>a. fk_update_2 x (fst a, fst (snd a), snd (snd a)))" 
     by auto
 
   have "pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k))) = 
     bernoulli_pmf (1 / (real (length xs) + 1)) \<bind> (\<lambda>y. pmf_of_set {..<length xs} \<bind>
       (\<lambda>k. return_pmf (if y then length xs else k)))"
     by (subst bind_commute_pmf, simp)
   also have "... = pmf_of_set {..<length xs + 1}"
     using snoc(1) non_empty
     by (intro pmf_eqI, simp add: pmf_bind measure_pmf_of_set)
      (simp add:indicator_def algebra_simps frac_eq_eq)
   finally have b: "pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k))) = pmf_of_set {..<length xs +1}" by simp
    
   have "fold (\<lambda>x s. (s \<bind> fk_update_2 x)) (xs@[x]) (return_pmf (0,0,0)) =
     (pmf_of_set {..<length xs} \<bind> (\<lambda>k. return_pmf (length xs, sketch xs k))) \<bind> fk_update_2 x"
     using snoc by (simp add:case_prod_beta')
   also have "... = (pmf_of_set {..<length xs} \<bind> (\<lambda>k. return_pmf (length xs, sketch xs k))) \<bind> 
     (\<lambda>(m,a,l). bernoulli_pmf (1 / (real m + 1)) \<bind> (\<lambda>coin. 
     return_pmf (m + 1, if coin then (x, 0) else (a, (l + of_bool (a = x))))))"
     by (subst fk_update_2_eta, subst fk_update_2.simps, simp add:case_prod_beta')
   also have "... = pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (length xs + 1, if coin then (x, 0) else (xs ! k, ?h xs k + of_bool (xs ! k = x)))))"
     by (subst bind_assoc_pmf, simp add: bind_return_pmf sketch_def)
   also have "... = pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k) \<bind> (\<lambda>k'. return_pmf (?q (xs@[x]) k'))))"
     using non_empty
     by (intro bind_pmf_cong, auto simp add:bind_return_pmf nth_append count_list_append sketch_def)
   also have "... = pmf_of_set {..<length xs} \<bind> (\<lambda>k. bernoulli_pmf (1 / (real (length xs) + 1)) \<bind>
     (\<lambda>coin. return_pmf (if coin then length xs else k))) \<bind> (\<lambda>k'. return_pmf (?q (xs@[x]) k'))"
     by (subst bind_assoc_pmf, subst bind_assoc_pmf, simp)
   also have "... = pmf_of_set {..<length (xs@[x])} \<bind> (\<lambda>k'. return_pmf (?q (xs@[x]) k'))"
     by (subst b, simp)
   finally show ?case by simp
 qed
 
 context
   fixes \<epsilon> \<delta> :: rat
   fixes n k :: nat
   fixes as
   assumes k_ge_1: "k \<ge> 1"
   assumes \<epsilon>_range: "\<epsilon> \<in> {0<..<1}"
   assumes \<delta>_range: "\<delta> > 0"
   assumes as_range: "set as \<subseteq> {..<n}"
 begin
 
 definition s\<^sub>1 where "s\<^sub>1 = nat \<lceil>3 * real k * (real n) powr (1-1/real k) / (real_of_rat \<delta>)\<^sup>2\<rceil>"
 definition s\<^sub>2 where "s\<^sub>2 = nat \<lceil>-(18 * ln (real_of_rat \<epsilon>))\<rceil>"
 
 definition "M\<^sub>1 = {(u, v). v < count_list as u}"
 definition "\<Omega>\<^sub>1 = measure_pmf (pmf_of_set M\<^sub>1)"
 
 definition "M\<^sub>2 = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set M\<^sub>1)"
 definition "\<Omega>\<^sub>2 = measure_pmf M\<^sub>2"
 
 interpretation prob_space "\<Omega>\<^sub>1"
   unfolding \<Omega>\<^sub>1_def by (simp add:prob_space_measure_pmf)
 
 interpretation \<Omega>\<^sub>2:prob_space "\<Omega>\<^sub>2"
   unfolding \<Omega>\<^sub>2_def by (simp add:prob_space_measure_pmf)
 
 lemma split_space: "(\<Sum>a\<in>M\<^sub>1. f (snd a)) = (\<Sum>u \<in> set as. (\<Sum>v \<in>{0..<count_list as u}. f v))"
 proof -
   define A where "A = (\<lambda>u. {u} \<times> {v. v < count_list as u})"
 
   have a: "inj_on snd (A x)" for x 
     by (simp add:A_def inj_on_def) 
 
   have "\<And>u v. u < count_list as v \<Longrightarrow> v \<in> set as"
     by (subst count_list_gr_1, force)
   hence "M\<^sub>1 = \<Union> (A ` set as)"
     by (auto simp add:set_eq_iff A_def M\<^sub>1_def)
   hence "(\<Sum>a\<in>M\<^sub>1. f (snd a)) = sum (f \<circ> snd)  (\<Union> (A ` set as))"
     by (intro sum.cong, auto)
   also have "... = sum (\<lambda>x. sum (f \<circ> snd) (A x)) (set as)"
     by (rule sum.UNION_disjoint, simp, simp add:A_def, simp add:A_def, blast) 
   also have "... = sum (\<lambda>x. sum f (snd ` A x)) (set as)"
     by (intro sum.cong, auto simp add:sum.reindex[OF a])
   also have "... = (\<Sum>u \<in> set as. (\<Sum>v \<in>{0..<count_list as u}. f v))"
     unfolding A_def by (intro sum.cong, auto)
   finally show ?thesis by blast
 qed
 
 lemma
   assumes "as \<noteq> []"
   shows fin_space: "finite M\<^sub>1" 
     and non_empty_space: "M\<^sub>1 \<noteq> {}"
     and card_space: "card M\<^sub>1 = length as"
 proof -
   have "M\<^sub>1 \<subseteq> set as \<times> {k. k < length as}"
   proof (rule subsetI)
     fix x
     assume a:"x \<in> M\<^sub>1"
     have "fst x \<in> set as"
       using a by (simp add:case_prod_beta count_list_gr_1 M\<^sub>1_def)
     moreover have "snd x < length as"
       using a count_le_length order_less_le_trans
       by (simp add:case_prod_beta M\<^sub>1_def) fast
     ultimately show "x \<in> set as \<times> {k. k < length as}"
       by (simp add:mem_Times_iff)
   qed
   thus fin_space: "finite M\<^sub>1"
     using finite_subset by blast
 
   have "(as ! 0, 0) \<in> M\<^sub>1" 
     using assms(1) unfolding M\<^sub>1_def
     by (simp, metis count_list_gr_1 gr0I length_greater_0_conv not_one_le_zero nth_mem)
   thus "M\<^sub>1 \<noteq> {}" by blast
 
   show "card M\<^sub>1 = length as"
     using fin_space split_space[where f="\<lambda>_. (1::nat)"]
     by (simp add:sum_count_set[where X="set as" and xs="as", simplified])
 qed
 
 lemma
   assumes "as \<noteq> []"
   shows integrable_1: "integrable \<Omega>\<^sub>1 (f :: _ \<Rightarrow> real)" and
     integrable_2: "integrable \<Omega>\<^sub>2 (g :: _ \<Rightarrow> real)"
 proof -
   have fin_omega: "finite (set_pmf (pmf_of_set M\<^sub>1))"
     using fin_space[OF assms] non_empty_space[OF assms] by auto
   thus "integrable \<Omega>\<^sub>1 f"
     unfolding \<Omega>\<^sub>1_def
     by (rule integrable_measure_pmf_finite)
 
   have "finite (set_pmf M\<^sub>2)"
     unfolding M\<^sub>2_def using fin_omega
     by (subst set_prod_pmf) (auto intro:finite_PiE)
 
   thus "integrable \<Omega>\<^sub>2 g"
     unfolding \<Omega>\<^sub>2_def by (intro integrable_measure_pmf_finite)
 qed
 
 lemma sketch_distr:
   assumes "as \<noteq> []"
   shows "pmf_of_set {..<length as} \<bind> (\<lambda>k. return_pmf (sketch as k)) = pmf_of_set M\<^sub>1"
 proof -
   have "x < y \<Longrightarrow> y < length as \<Longrightarrow> 
     count_list (drop (y+1) as) (as ! y) < count_list (drop (x+1) as) (as ! y)" for x y
     by (intro count_list_lt_suffix suffix_drop_drop, simp_all)
      (metis Suc_diff_Suc diff_Suc_Suc diff_add_inverse lessI less_natE)
   hence a1: "inj_on (sketch as) {k. k < length as}"
     unfolding sketch_def by (intro inj_onI) (metis Pair_inject mem_Collect_eq nat_neq_iff)
 
   have "x < length as \<Longrightarrow> count_list (drop (x+1) as) (as ! x) < count_list as (as ! x)" for x
     by (rule count_list_lt_suffix, auto simp add:suffix_drop)
   hence "sketch as ` {k. k < length as} \<subseteq> M\<^sub>1"
     by (intro image_subsetI, simp add:sketch_def M\<^sub>1_def)
   moreover have "card M\<^sub>1 \<le> card (sketch as ` {k. k < length as})"
     by (simp add: card_space[OF assms(1)] card_image[OF a1])
   ultimately have "sketch as ` {k. k < length as} = M\<^sub>1"
     using fin_space[OF assms(1)] by (intro card_seteq, simp_all)
   hence "bij_betw (sketch as) {k. k < length as} M\<^sub>1"
     using a1 by (simp add:bij_betw_def)
   hence "map_pmf (sketch as) (pmf_of_set {k. k < length as}) = pmf_of_set M\<^sub>1"
     using assms by (intro map_pmf_of_set_bij_betw, auto)
   thus ?thesis by (simp add: sketch_def map_pmf_def lessThan_def)
 qed
 
 lemma fk_update_distr:
   "fold (\<lambda>x s. s \<bind> fk_update x) as (fk_init k \<delta> \<epsilon> n) = 
   prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0,0,0))) 
     \<bind> (\<lambda>x. return_pmf (s\<^sub>1,s\<^sub>2,k, length as, \<lambda>i\<in>{0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. snd (x i)))"
 proof (induction as rule:rev_induct)
   case Nil
   then show ?case 
     by (auto simp:Let_def s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric] bind_return_pmf)
 next
   case (snoc x xs)
 
   have fk_update_2_eta:"fk_update_2 x = (\<lambda>a. fk_update_2 x (fst a, fst (snd a), snd (snd a)))" 
     by auto
 
   have a: "fk_update x (s\<^sub>1, s\<^sub>2, k, length xs, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (f i)) =
     prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i)) \<bind> 
     (\<lambda>a. return_pmf (s\<^sub>1,s\<^sub>2, k, Suc (length xs), \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (a i)))"
     if b: "f \<in> set_pmf (prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
                   (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) xs (return_pmf (0, 0, 0))))" for f
   proof -
     have c:"fst (f i) = length xs" if d:"i \<in> {0..<s\<^sub>1} \<times>{0..<s\<^sub>2}" for i
     proof (cases "xs = []")
       case True
       then show ?thesis using b d by (simp add: set_Pi_pmf)
     next  
       case False
       hence "{..<length xs} \<noteq> {}" by force
       thus ?thesis using b d 
         by (simp add:set_Pi_pmf fk_update_2_distr[OF False] PiE_dflt_def) force
     qed
     show ?thesis
       apply (subst fk_update_2_eta, subst fk_update_2.simps, simp)
       apply (simp add: Pi_pmf_bind_return[where d'="undefined"] bind_assoc_pmf)
       apply (rule bind_pmf_cong, simp add:c cong:Pi_pmf_cong)
       by (auto simp add:bind_return_pmf case_prod_beta)
   qed
  
   have "fold (\<lambda>x s. s \<bind> fk_update x) (xs @ [x]) (fk_init k \<delta> \<epsilon> n) = 
      prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) xs (return_pmf (0,0,0))) 
     \<bind> (\<lambda>\<omega>. return_pmf (s\<^sub>1,s\<^sub>2,k, length xs, \<lambda>i\<in>{0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. snd (\<omega> i)) \<bind> fk_update x)"
     using snoc
     by (simp add:restrict_def bind_assoc_pmf del:fk_init.simps)
   also have "... =  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
     (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) xs (return_pmf (0, 0, 0))) \<bind>
     (\<lambda>f. prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i)) \<bind>
     (\<lambda>a. return_pmf (s\<^sub>1, s\<^sub>2, k, Suc (length xs), \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (a i))))"
     using a
     by (intro bind_pmf_cong, simp_all add:bind_return_pmf del:fk_update.simps)
   also have "... =  prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
     (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) xs (return_pmf (0, 0, 0))) \<bind>
     (\<lambda>f. prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>i. fk_update_2 x (f i))) \<bind>
     (\<lambda>a. return_pmf (s\<^sub>1, s\<^sub>2, k, Suc (length xs), \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (a i)))"
     by (simp add:bind_assoc_pmf)
   also have "... = (prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
     (\<lambda>_. fold (\<lambda>a s. s \<bind> fk_update_2 a) (xs@[x]) (return_pmf (0,0,0))) 
     \<bind> (\<lambda>a. return_pmf (s\<^sub>1,s\<^sub>2,k, length (xs@[x]), \<lambda>i\<in>{0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. snd (a i))))"
     by (simp, subst Pi_pmf_bind, auto)
 
   finally show ?case by blast
 qed
 
 lemma power_diff_sum:
   fixes a b :: "'a :: {comm_ring_1,power}"
   assumes "k > 0"
   shows "a^k - b^k = (a-b) * (\<Sum>i = 0..<k. a ^ i * b ^ (k - 1 - i))" (is "?lhs = ?rhs")
 proof -
   have insert_lb: "m < n \<Longrightarrow> insert m {Suc m..<n} = {m..<n}" for m n :: nat
     by auto
 
   have "?rhs = sum (\<lambda>i. a * (a^i * b^(k-1-i))) {0..<k} - 
     sum (\<lambda>i. b * (a^i * b^(k-1-i))) {0..<k}"
     by (simp add: sum_distrib_left[symmetric] algebra_simps)
   also have "... = sum ((\<lambda>i. (a^i * b^(k-i))) \<circ> (\<lambda>i. i+1)) {0..<k} - 
     sum (\<lambda>i. (a^i * (b^(1+(k-1-i))))) {0..<k}"
     by (simp add:algebra_simps)
   also have "... = sum ((\<lambda>i. (a^i * b^(k-i))) \<circ> (\<lambda>i. i+1)) {0..<k} - 
     sum (\<lambda>i. (a^i * b^(k-i))) {0..<k}"
     by (intro arg_cong2[where f="(-)"] sum.cong arg_cong2[where f="(*)"] 
         arg_cong2[where f="(\<lambda>x y. x ^ y)"]) auto
   also have "... = sum (\<lambda>i. (a^i * b^(k-i))) (insert k {1..<k}) - 
     sum (\<lambda>i. (a^i * b^(k-i))) (insert 0 {Suc 0..<k})"
     using assms
     by (subst sum.reindex[symmetric], simp, subst insert_lb, auto)
   also have "... = ?lhs"
     by simp
   finally show ?thesis by presburger
 qed
 
 lemma power_diff_est:
   assumes "k > 0"
   assumes "(a :: real) \<ge> b"
   assumes "b \<ge> 0"
   shows "a^k -b^k \<le> (a-b) * k * a^(k-1)"
 proof -
   have " \<And>i. i < k \<Longrightarrow> a ^ i * b ^ (k - 1 - i) \<le> a ^ i * a ^ (k-1-i)"
     using assms by (intro mult_left_mono power_mono) auto
   also have "\<And>i. i < k \<Longrightarrow> a ^ i * a ^ (k - 1 - i) = a ^ (k - Suc 0)"
     using assms(1) by (subst power_add[symmetric], simp)
   finally have a: "\<And>i. i < k \<Longrightarrow> a ^ i * b ^ (k - 1 - i) \<le> a ^ (k - Suc 0)"
     by blast
   have "a^k - b^k = (a-b) * (\<Sum>i = 0..<k. a ^ i * b ^ (k - 1 - i))"
     by (rule power_diff_sum[OF assms(1)])
   also have "... \<le> (a-b) * (\<Sum>i = 0..<k.  a^(k-1))"
     using a assms by (intro mult_left_mono sum_mono, auto)
   also have "... = (a-b) * (k * a^(k-Suc 0))"
     by simp
   finally show ?thesis by simp
 qed
 
 text \<open>Specialization of the Hoelder inquality for sums.\<close>
 lemma Holder_inequality_sum:
   assumes "p > (0::real)" "q > 0" "1/p + 1/q = 1"
   assumes "finite A"
   shows "\<bar>\<Sum>x\<in>A. f x * g x\<bar> \<le> (\<Sum>x\<in>A. \<bar>f x\<bar> powr p) powr (1/p) * (\<Sum>x\<in>A. \<bar>g x\<bar> powr q) powr (1/q)"
 proof -
   have "\<bar>LINT x|count_space A. f x * g x\<bar> \<le> 
     (LINT x|count_space A. \<bar>f x\<bar> powr p) powr (1 / p) * 
     (LINT x|count_space A. \<bar>g x\<bar> powr q) powr (1 / q)"
     using assms integrable_count_space
     by (intro Lp.Holder_inequality, auto)
   thus ?thesis
     using assms by (simp add: lebesgue_integral_count_space_finite[symmetric])
 qed
 
 lemma real_count_list_pos:
   assumes "x \<in> set as"
   shows "real (count_list as x) > 0"
   using count_list_gr_1 assms by force
 
 lemma fk_estimate:
   assumes "as \<noteq> []"
   shows "length as * of_rat (F (2*k-1) as) \<le> n powr (1 - 1 / real k) * (of_rat (F k as))^2"
   (is "?lhs \<le> ?rhs")
 proof (cases "k \<ge> 2")
   case True
   define M where "M = Max (count_list as ` set as)" 
   have "M \<in> count_list as ` set as"
     unfolding M_def using assms by (intro Max_in, auto)
   then obtain m where m_in: "m \<in> set as" and m_def: "M = count_list as m"
     by blast
 
   have a: "real M > 0" using m_in count_list_gr_1 by (simp add:m_def, force)
   have b: "2*k-1 = (k-1) + k" by simp
 
   have " 0 < real (count_list as m)" 
     using m_in count_list_gr_1 by force
   hence "M powr k = real (count_list as m) ^ k"
     by (simp add: powr_realpow m_def)
   also have "... \<le> (\<Sum>x\<in>set as. real (count_list as x) ^ k)"
     using m_in by (intro member_le_sum, simp_all)
   also have "... \<le> real_of_rat (F k as)"
     by (simp add:F_def of_rat_sum of_rat_power)
   finally have d: "M powr k \<le> real_of_rat (F k as)" by simp
 
   have e: "0 \<le> real_of_rat (F k as)" 
     using F_gr_0[OF assms(1)] by (simp add: order_le_less)
 
   have "real (k - 1) / real k + 1 = real (k - 1) / real k + real k / real k"
     using assms True by simp
   also have "... =  real (2 * k - 1) / real k"
     using b by (subst add_divide_distrib[symmetric], force)
   finally have f: "real (k - 1) / real k + 1 = real (2 * k - 1) / real k"
     by blast
 
   have "real_of_rat (F (2*k-1) as) = 
     (\<Sum>x\<in>set as. real (count_list as x) ^ (k - 1) * real (count_list as x) ^ k)" 
     using b by (simp add:F_def of_rat_sum sum_distrib_left of_rat_mult power_add of_rat_power)
   also have "... \<le> (\<Sum>x\<in>set as. real M ^ (k - 1) * real (count_list as x) ^ k)"
     by (intro sum_mono mult_right_mono power_mono of_nat_mono) (auto simp:M_def)
   also have "... = M powr (k-1) * of_rat (F k as)" using a
     by (simp add:sum_distrib_left F_def of_rat_mult of_rat_sum of_rat_power powr_realpow)
   also have "... = (M powr k) powr (real (k - 1) / real k) * of_rat (F k as) powr 1"
     using e by (simp add:powr_powr)
   also have "... \<le>  (real_of_rat (F k as)) powr ((k-1)/k) * (real_of_rat (F k as) powr 1)"
     using d by (intro mult_right_mono powr_mono2, auto)
   also have "... = (real_of_rat (F k as)) powr ((2*k-1) / k)"
     by (subst powr_add[symmetric], subst f, simp)
   finally have a: "real_of_rat (F (2*k-1) as) \<le> (real_of_rat (F k as)) powr ((2*k-1) / k)"
     by blast
 
   have g: "card (set as) \<le> n"
     using card_mono[OF _ as_range] by simp
 
   have "length as = abs (sum (\<lambda>x. real (count_list as x)) (set as))"
     by (subst of_nat_sum[symmetric], simp add: sum_count_set)
   also have "... \<le> card (set as) powr ((k-Suc 0)/k) * 
     (sum (\<lambda>x. \<bar>real (count_list as x)\<bar> powr k) (set as)) powr (1/k)"
     using assms True
     by (intro Holder_inequality_sum[where p="k/(k-1)" and q="k" and f="\<lambda>_.1", simplified])
      (auto simp add:algebra_simps add_divide_distrib[symmetric])
   also have "... = (card (set as)) powr ((k-1) / real k) * of_rat (F k as) powr (1/ k)"
     using real_count_list_pos
     by (simp add:F_def of_rat_sum of_rat_power powr_realpow)
   also have "... = (card (set as)) powr (1 - 1 / real k) * of_rat (F k as) powr (1/ k)"
     using k_ge_1
     by (subst of_nat_diff[OF k_ge_1], subst diff_divide_distrib, simp)
   also have "... \<le> n powr (1 - 1 / real k) * of_rat (F k as) powr (1/ k)"
     using k_ge_1 g
     by (intro mult_right_mono powr_mono2, auto)
   finally have h: "length as \<le> n powr (1 - 1 / real k) * of_rat (F k as) powr (1/real k)"
     by blast
 
   have i:"1 / real k + real (2 * k - 1) / real k = real 2"
     using True by (subst add_divide_distrib[symmetric], simp_all add:of_nat_diff)
 
   have "?lhs \<le> n powr (1 - 1/k) * of_rat (F k as) powr (1/k) * (of_rat (F k as)) powr ((2*k-1) / k)"
     using a h F_ge_0 by (intro mult_mono mult_nonneg_nonneg, auto)
   also have "... = ?rhs"
     using i F_gr_0[OF assms] by (simp add:powr_add[symmetric] powr_realpow[symmetric])
   finally show ?thesis
     by blast
 next
   case False
   have "n = 0 \<Longrightarrow> False"
     using as_range assms by auto
   hence "n > 0" 
     by auto
   moreover have "k = 1"
     using assms k_ge_1 False by linarith
   moreover have "length as = real_of_rat (F (Suc 0) as)"
     by (simp add:F_def sum_count_set of_nat_sum[symmetric] del:of_nat_sum)
   ultimately show ?thesis
     by (simp add:power2_eq_square)
 qed
 
 definition result
   where "result a = of_nat (length as) * of_nat (Suc (snd a) ^ k - snd a ^ k)"
 
 lemma result_exp_1:
   assumes "as \<noteq> []"
   shows "expectation result = real_of_rat (F k as)"
 proof -
   have "expectation result = (\<Sum>a\<in>M\<^sub>1. result a * pmf (pmf_of_set M\<^sub>1) a)"
     unfolding \<Omega>\<^sub>1_def using non_empty_space assms fin_space
     by (subst integral_measure_pmf_real) auto
   also have "... = (\<Sum>a\<in>M\<^sub>1. result a / real (length as))"
    using non_empty_space assms fin_space card_space by simp
   also have "... = (\<Sum>a\<in>M\<^sub>1. real (Suc (snd a) ^ k - snd a ^ k))"
     using assms by (simp add:result_def)
   also have "... = (\<Sum>u\<in>set as. \<Sum>v = 0..<count_list as u. real (Suc v ^ k) - real (v ^ k))"
     using k_ge_1 by (subst split_space, simp add:of_nat_diff)
   also have "... = (\<Sum>u\<in>set as. real (count_list as u)^k)"
     using k_ge_1 by (subst sum_Suc_diff') (auto simp add:zero_power)
   also have "... = of_rat (F k as)"
     by (simp add:F_def of_rat_sum of_rat_power)
   finally show ?thesis by simp
 qed
 
 lemma result_var_1:
   assumes "as \<noteq> []"
   shows "variance result \<le> (of_rat (F k as))\<^sup>2 * k * n powr (1 - 1 / real k)"
 proof -  
   have k_gt_0: "k > 0" using k_ge_1 by linarith
 
   have c:"real (Suc v ^ k) - real (v ^ k) \<le> k * real (count_list as a) ^ (k - Suc 0)"
     if c_1: "v < count_list as a" for a v
   proof -
     have "real (Suc v ^ k) - real (v ^ k) \<le> (real (v+1) - real v) * k * (1 + real v) ^ (k - Suc 0)"
       using k_gt_0 power_diff_est[where a="Suc v" and b="v"] by simp
     moreover have "(real (v+1) - real v) = 1" by auto
     ultimately have "real (Suc v ^ k) - real (v ^ k) \<le> k * (1 + real v) ^ (k - Suc 0)"
       by auto
     also have "... \<le> k * real (count_list as a) ^ (k- Suc 0)"
       using c_1 by (intro mult_left_mono power_mono, auto)
     finally show ?thesis by blast
   qed
       
   have "length as * (\<Sum>a\<in> M\<^sub>1. (real (Suc (snd a)  ^ k - (snd a) ^ k))\<^sup>2) =
     length as * (\<Sum>a\<in> set as. (\<Sum>v \<in> {0..<count_list as a}. 
     real (Suc v ^ k - v ^ k) * real (Suc v ^ k - v^k)))"
     by (subst split_space, simp add:power2_eq_square)
   also have "... \<le> length as * (\<Sum>a\<in> set as. (\<Sum>v \<in> {0..<count_list as a}. 
     k * real (count_list as a) ^ (k-1) * real (Suc v ^ k - v ^ k)))"
     using c by (intro mult_left_mono sum_mono mult_right_mono) (auto simp:power_mono of_nat_diff)
   also have "... = length as * k * (\<Sum>a\<in> set as. real (count_list as a) ^ (k-1) * 
     (\<Sum>v \<in> {0..<count_list as a}. real (Suc v ^ k) - real (v ^ k)))"
     by (simp add:sum_distrib_left ac_simps of_nat_diff power_mono)
   also have "... = length as * k * (\<Sum>a\<in> set as. real (count_list as a ^ (2*k-1)))"
     using assms k_ge_1
     by (subst sum_Suc_diff', auto simp: zero_power[OF k_gt_0] mult_2 power_add[symmetric])
   also have "... = k * (length as * of_rat (F (2*k-1) as))"
     by (simp add:sum_distrib_left[symmetric] F_def of_rat_sum of_rat_power)
   also have "... \<le> k * (of_rat (F k as)^2 * n powr (1 - 1 / real k))"
     using fk_estimate[OF assms] by (intro mult_left_mono) (auto simp: mult.commute)
   finally have b: "real (length as) * (\<Sum>a\<in> M\<^sub>1. (real (Suc (snd a) ^ k - (snd a) ^ k))\<^sup>2) \<le> 
     k * ((of_rat (F k as))\<^sup>2 * n powr (1 - 1 / real k))"
     by blast
 
   have "expectation (\<lambda>\<omega>. (result \<omega> :: real)^2) - (expectation result)^2 \<le> expectation (\<lambda>\<omega>. result \<omega>^2)"
     by simp
   also have "... = (\<Sum>a\<in>M\<^sub>1. (length as * real (Suc (snd a) ^ k - snd a ^ k))\<^sup>2 * pmf (pmf_of_set M\<^sub>1) a)"
     using fin_space non_empty_space assms unfolding \<Omega>\<^sub>1_def result_def
     by (subst integral_measure_pmf_real[where A="M\<^sub>1"], auto)
   also have "... = (\<Sum>a\<in>M\<^sub>1. length as * (real (Suc (snd a) ^ k - snd a ^ k))\<^sup>2)"
     using assms non_empty_space fin_space by (subst pmf_of_set)
      (simp_all add:card_space power_mult_distrib power2_eq_square ac_simps)
   also have "... \<le> k * ((of_rat (F k as))\<^sup>2 * n powr (1 - 1 / real k))"
     using b by (simp add:sum_distrib_left[symmetric])
   also have "... = of_rat (F k as)^2 * k * n powr (1 - 1 / real k)"
     by (simp add:ac_simps)
   finally have "expectation (\<lambda>\<omega>. result \<omega>^2) - (expectation result)^2 \<le> 
     of_rat (F k as)^2 * k * n powr (1 - 1 / real k)"
     by blast
 
   thus ?thesis
     using integrable_1[OF assms] by (simp add:variance_eq)
 qed
 
 theorem fk_alg_sketch:
   assumes "as \<noteq> []"
   shows "fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) = 
     map_pmf (\<lambda>x. (s\<^sub>1,s\<^sub>2,k,length as, x)) M\<^sub>2" (is "?lhs = ?rhs")
 proof -
   have "?lhs = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) 
     (\<lambda>_. fold (\<lambda>x s. s \<bind> fk_update_2 x) as (return_pmf (0, 0, 0))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst fk_update_distr, simp)
   also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
     (\<lambda>k. return_pmf (length as, sketch as k))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst fk_update_2_distr[OF assms], simp)
   also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
     (\<lambda>k. return_pmf (sketch as k)) \<bind> (\<lambda>s. return_pmf (length as, s))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst bind_assoc_pmf, subst bind_return_pmf, simp)
   also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
     (\<lambda>k. return_pmf (sketch as k))) \<bind>
     (\<lambda>x. return_pmf (\<lambda>i \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. (length as, x i))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, \<lambda>i\<in>{0..<s\<^sub>1} \<times> {0..<s\<^sub>2}. snd (x i)))"
     by (subst Pi_pmf_bind_return[where d'="undefined"], simp, simp add:restrict_def)
   also have "... = prod_pmf ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2}) (\<lambda>_. pmf_of_set {..<length as} \<bind> 
     (\<lambda>k. return_pmf (sketch as k))) \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, restrict x ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})))"
     by (subst bind_assoc_pmf, simp add:bind_return_pmf cong:restrict_cong)
   also have "... = M\<^sub>2 \<bind>
     (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, restrict x ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})))"
     by (subst sketch_distr[OF assms], simp add:M\<^sub>2_def)
   also have "... = M\<^sub>2 \<bind> (\<lambda>x. return_pmf (s\<^sub>1, s\<^sub>2, k, length as, x))"
     by (rule bind_pmf_cong, auto simp add:PiE_dflt_def M\<^sub>2_def set_Pi_pmf) 
   also have "... = ?rhs"
     by (simp add:map_pmf_def)
   finally show ?thesis by simp
 qed
 
 definition mean_rv 
   where "mean_rv \<omega> i\<^sub>2 = (\<Sum>i\<^sub>1 = 0..<s\<^sub>1. result (\<omega> (i\<^sub>1, i\<^sub>2))) / of_nat s\<^sub>1"
 
 definition median_rv 
     where "median_rv \<omega> = median s\<^sub>2 (\<lambda>i\<^sub>2. mean_rv \<omega> i\<^sub>2)"
 
 lemma fk_alg_correct':
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) \<bind> fk_result"
   shows "\<P>(\<omega> in measure_pmf M. \<bar>\<omega> - F k as\<bar> \<le> \<delta> * F k as) \<ge> 1 - of_rat \<epsilon>"
 proof (cases "as = []")
   case True
   have a: "nat \<lceil>- (18 * ln (real_of_rat \<epsilon>))\<rceil> > 0"  using \<epsilon>_range by simp 
   show ?thesis using True \<epsilon>_range 
     by (simp add:F_def M_def bind_return_pmf median_const[OF a] Let_def)
 next
   case False
 
   have "set as \<noteq> {}" using assms False by blast
   hence n_nonzero: "n > 0" using as_range by fastforce
 
   have fk_nonzero: "F k as > 0"
     using F_gr_0[OF False] by simp
 
   have s1_nonzero: "s\<^sub>1 > 0"
     using \<delta>_range k_ge_1 n_nonzero by (simp add:s\<^sub>1_def)
   have s2_nonzero: "s\<^sub>2 > 0"
     using \<epsilon>_range by (simp add:s\<^sub>2_def) 
 
   have real_of_rat_mean_rv: "\<And>x i. mean_rv x = (\<lambda>i. real_of_rat (mean_rv x i))"
     by (rule ext, simp add:of_rat_divide of_rat_sum of_rat_mult result_def mean_rv_def)
   have real_of_rat_median_rv: "\<And>x. median_rv x = real_of_rat (median_rv x)"
     unfolding median_rv_def using s2_nonzero
     by (subst real_of_rat_mean_rv, simp add: median_rat median_restrict)
 
 
   have space_\<Omega>\<^sub>2: "space \<Omega>\<^sub>2 = UNIV" by (simp add:\<Omega>\<^sub>2_def)
 
   have fk_result_eta: "fk_result = (\<lambda>(x,y,z,u,v). fk_result (x,y,z,u,v))" 
     by auto 
 
   have a:"fold (\<lambda>x state. state \<bind> fk_update x) as (fk_init k \<delta> \<epsilon> n) = 
     map_pmf (\<lambda>x. (s\<^sub>1,s\<^sub>2,k,length as, x)) M\<^sub>2"
     by (subst fk_alg_sketch[OF False]) (simp add:s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric])
 
   have "M =  map_pmf (\<lambda>x. (s\<^sub>1, s\<^sub>2, k, length as, x)) M\<^sub>2 \<bind> fk_result"
     by (subst M_def, subst a, simp)
   also have "... = M\<^sub>2 \<bind> return_pmf \<circ> median_rv"
     by (subst fk_result_eta)
      (auto simp add:map_pmf_def bind_assoc_pmf bind_return_pmf median_rv_def mean_rv_def comp_def 
        M\<^sub>1_def result_def median_restrict)
   finally have b: "M = M\<^sub>2 \<bind> return_pmf \<circ> median_rv"
     by simp
 
   have result_exp: 
     "i\<^sub>1 < s\<^sub>1 \<Longrightarrow> i\<^sub>2 < s\<^sub>2 \<Longrightarrow> \<Omega>\<^sub>2.expectation (\<lambda>x. result (x (i\<^sub>1, i\<^sub>2))) = real_of_rat (F k as)"
     for i\<^sub>1 i\<^sub>2
     unfolding \<Omega>\<^sub>2_def M\<^sub>2_def
     using integrable_1[OF False] result_exp_1[OF False]
     by (subst expectation_Pi_pmf_slice, auto simp:\<Omega>\<^sub>1_def)
 
 
   have result_var: "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (i\<^sub>1, i\<^sub>2))) \<le> of_rat (\<delta> * F k as)^2 * real s\<^sub>1 / 3" 
     if result_var_assms: "i\<^sub>1 < s\<^sub>1" "i\<^sub>2 < s\<^sub>2" for i\<^sub>1 i\<^sub>2
   proof -
     have "3 * real k * n powr (1 - 1 / real k) =
       (of_rat \<delta>)\<^sup>2 * (3 * real k * n powr (1 - 1 / real k) / (of_rat \<delta>)\<^sup>2)"
       using \<delta>_range by simp
     also have "... \<le>  (real_of_rat \<delta>)\<^sup>2 * (real s\<^sub>1)"
       unfolding s\<^sub>1_def
       by (intro mult_mono of_nat_ceiling, simp_all)
     finally have f2_var_2: "3 * real k * n powr (1 - 1 / real k) \<le> (of_rat \<delta>)\<^sup>2 * (real s\<^sub>1)"
       by blast
 
     have "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (i\<^sub>1, i\<^sub>2)) :: real)  = variance result"
       using result_var_assms integrable_1[OF False]
       unfolding \<Omega>\<^sub>2_def M\<^sub>2_def \<Omega>\<^sub>1_def 
       by (subst variance_prod_pmf_slice, auto)
     also have "... \<le> of_rat (F k as)^2 * real k * n powr (1 - 1 / real k)"
       using assms False result_var_1 \<Omega>\<^sub>1_def by simp
     also have "... =
       of_rat (F k as)^2 * (real k * n powr (1 - 1 / real k))"
       by (simp add:ac_simps)
     also have "... \<le> of_rat (F k as)^2 * (of_rat \<delta>^2 * (real s\<^sub>1 / 3))"
       using f2_var_2 by (intro mult_left_mono, auto) 
     also have "... = of_rat (F k as * \<delta>)^2 * (real s\<^sub>1 / 3)"
       by (simp add: of_rat_mult power_mult_distrib) 
     also have "... = of_rat (\<delta> * F k as)^2 * real s\<^sub>1 / 3"
       by (simp add:ac_simps)
     finally show ?thesis
       by simp
   qed
 
   have mean_rv_exp: "\<Omega>\<^sub>2.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = real_of_rat (F k as)"
     if mean_rv_exp_assms: "i < s\<^sub>2" for i
   proof -
     have "\<Omega>\<^sub>2.expectation (\<lambda>\<omega>. mean_rv \<omega> i) = \<Omega>\<^sub>2.expectation (\<lambda>\<omega>. \<Sum>n = 0..<s\<^sub>1. result (\<omega> (n, i)) / real s\<^sub>1)"
       by (simp add:mean_rv_def sum_divide_distrib)
     also have "... = (\<Sum>n = 0..<s\<^sub>1. \<Omega>\<^sub>2.expectation (\<lambda>\<omega>. result (\<omega> (n, i))) / real s\<^sub>1)"
       using integrable_2[OF False]
       by (subst Bochner_Integration.integral_sum, auto)
     also have "... = of_rat (F k as)"
       using s1_nonzero mean_rv_exp_assms
       by (simp add:result_exp)
     finally show ?thesis by simp
   qed
 
   have mean_rv_var: "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i) \<le> real_of_rat (\<delta> * F k as)^2/3" 
     if mean_rv_var_assms: "i < s\<^sub>2" for i
   proof -
     have a:"\<Omega>\<^sub>2.indep_vars (\<lambda>_. borel) (\<lambda>n x. result (x (n, i)) / real s\<^sub>1) {0..<s\<^sub>1}"
       unfolding \<Omega>\<^sub>2_def M\<^sub>2_def using mean_rv_var_assms
       by (intro indep_vars_restrict_intro'[where f="fst"], simp, simp add:restrict_dfl_def, simp, simp)
     have "\<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i) = \<Omega>\<^sub>2.variance (\<lambda>\<omega>. \<Sum>j = 0..<s\<^sub>1. result (\<omega> (j, i)) / real s\<^sub>1)"
       by (simp add:mean_rv_def sum_divide_distrib)
     also have "... = (\<Sum>j = 0..<s\<^sub>1. \<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (j, i)) / real s\<^sub>1))"
       using a integrable_2[OF False]
-      by (subst \<Omega>\<^sub>2.var_sum_all_indep, auto simp add:\<Omega>\<^sub>2_def)
+      by (subst \<Omega>\<^sub>2.bienaymes_identity_full_indep, auto simp add:\<Omega>\<^sub>2_def)
     also have "... = (\<Sum>j = 0..<s\<^sub>1. \<Omega>\<^sub>2.variance (\<lambda>\<omega>. result (\<omega> (j, i))) / real s\<^sub>1^2)"
       using integrable_2[OF False]
       by (subst \<Omega>\<^sub>2.variance_divide, auto)
     also have "... \<le> (\<Sum>j = 0..<s\<^sub>1. ((real_of_rat (\<delta> * F k as))\<^sup>2 * real s\<^sub>1 / 3) / (real s\<^sub>1^2))"
       using result_var[OF _ mean_rv_var_assms]
       by (intro sum_mono divide_right_mono, auto)
     also have "... = real_of_rat (\<delta> * F k as)^2/3"
       using s1_nonzero
       by (simp add:algebra_simps power2_eq_square)
     finally show ?thesis by simp
   qed
 
   have "\<Omega>\<^sub>2.prob {y. of_rat (\<delta> * F k as) < \<bar>mean_rv y i - real_of_rat (F k as)\<bar>} \<le> 1/3" 
     (is "?lhs \<le> _") if c_assms: "i < s\<^sub>2" for i
   proof -
     define a where "a = real_of_rat (\<delta> * F k as)"
     have c: "0 < a" unfolding  a_def
       using assms \<delta>_range fk_nonzero
       by (metis zero_less_of_rat_iff mult_pos_pos)
     have "?lhs \<le> \<Omega>\<^sub>2.prob {y \<in> space \<Omega>\<^sub>2. a \<le> \<bar>mean_rv y i -  \<Omega>\<^sub>2.expectation (\<lambda>\<omega>. mean_rv \<omega> i)\<bar>}"
       by (intro \<Omega>\<^sub>2.pmf_mono[OF \<Omega>\<^sub>2_def], simp add:a_def mean_rv_exp[OF c_assms] space_\<Omega>\<^sub>2) 
     also have "... \<le> \<Omega>\<^sub>2.variance (\<lambda>\<omega>. mean_rv \<omega> i)/a^2"
       by (intro \<Omega>\<^sub>2.Chebyshev_inequality integrable_2 c False)  (simp add:\<Omega>\<^sub>2_def)
     also have "... \<le> 1/3" using c
       using mean_rv_var[OF c_assms] 
       by (simp add:algebra_simps, simp add:a_def)
     finally show ?thesis
       by blast
   qed
 
   moreover have "\<Omega>\<^sub>2.indep_vars (\<lambda>_. borel) (\<lambda>i \<omega>. mean_rv \<omega> i) {0..<s\<^sub>2}"
     using s1_nonzero unfolding \<Omega>\<^sub>2_def M\<^sub>2_def
     by (intro indep_vars_restrict_intro'[where f="snd"] finite_cartesian_product)
      (simp_all add:mean_rv_def restrict_dfl_def space_\<Omega>\<^sub>2)
   moreover have " - (18 * ln (real_of_rat \<epsilon>)) \<le> real s\<^sub>2"
     by (simp add:s\<^sub>2_def, linarith)
   ultimately have "1 - of_rat \<epsilon> \<le> 
     \<Omega>\<^sub>2.prob {y \<in> space \<Omega>\<^sub>2. \<bar>median s\<^sub>2 (mean_rv y) - real_of_rat (F k as)\<bar> \<le> of_rat (\<delta> * F k as)}" 
     using \<epsilon>_range
     by (intro \<Omega>\<^sub>2.median_bound_2, simp_all add:space_\<Omega>\<^sub>2)
   also have "... = \<Omega>\<^sub>2.prob {y. \<bar>median_rv y - real_of_rat (F k as)\<bar> \<le> real_of_rat (\<delta> * F k as)}" 
     by (simp add:median_rv_def space_\<Omega>\<^sub>2)
   also have "... =  \<Omega>\<^sub>2.prob {y. \<bar>median_rv y - F k as\<bar> \<le> \<delta> * F k as}"
     by (simp add:real_of_rat_median_rv of_rat_less_eq flip: of_rat_diff)
   also have "... = \<P>(\<omega> in measure_pmf M. \<bar>\<omega> - F k as\<bar> \<le> \<delta> * F k as)"
     by (simp add: b comp_def map_pmf_def[symmetric] \<Omega>\<^sub>2_def)
   finally show ?thesis by simp
 qed
 
 lemma fk_exact_space_usage':
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n)"
   shows "AE \<omega> in M. bit_count (encode_fk_state \<omega>) \<le> fk_space_usage (k, n, length as, \<epsilon>, \<delta>)"
     (is "AE \<omega> in M. (_  \<le> ?rhs)")
 proof -
   define H where "H = (if as = [] then return_pmf (\<lambda>i\<in> {0..<s\<^sub>1}\<times>{0..<s\<^sub>2}. (0,0)) else M\<^sub>2)"
 
   have a:"M = map_pmf (\<lambda>x.(s\<^sub>1,s\<^sub>2,k,length as, x)) H"
   proof (cases "as \<noteq> []")
     case True
     then show ?thesis 
       unfolding M_def fk_alg_sketch[OF True] H_def
       by (simp add:M\<^sub>2_def)
   next
     case False
     then show ?thesis
       by (simp add:H_def M_def s\<^sub>1_def[symmetric] Let_def s\<^sub>2_def[symmetric] map_pmf_def bind_return_pmf)
   qed
 
   have "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le> ?rhs"
     if b:"y \<in> set_pmf H" for y
   proof -
     have b0:" as \<noteq> [] \<Longrightarrow> y \<in> {0..<s\<^sub>1} \<times> {0..<s\<^sub>2} \<rightarrow>\<^sub>E M\<^sub>1"
       using b non_empty_space fin_space by (simp add:H_def M\<^sub>2_def set_prod_pmf)
 
     have "bit_count ((N\<^sub>e \<times>\<^sub>e N\<^sub>e) (y x)) \<le> 
       ereal (2 * log 2 (real n + 1) + 1) + ereal (2 * log 2 (real (length as) + 1) + 1)"
       (is "_ \<le> ?rhs1")
       if b1_assms: "x \<in> {0..<s\<^sub>1}\<times>{0..<s\<^sub>2}" for x
     proof -
       have "fst (y x) \<le> n"
       proof (cases "as = []")
         case True
         then show ?thesis using b b1_assms by (simp add:H_def)
       next
         case False
         hence "1 \<le> count_list as (fst (y x))"
           using b0 b1_assms by (simp add:PiE_iff case_prod_beta M\<^sub>1_def, fastforce)
         hence "fst (y x) \<in> set as"
           using count_list_gr_1 by metis
         then show ?thesis 
           by (meson lessThan_iff less_imp_le_nat subsetD as_range)
       qed
       moreover have "snd (y x) \<le> length as" 
       proof (cases "as = []")
         case True
         then show ?thesis using b b1_assms by (simp add:H_def)
       next
         case False
         hence "(y x) \<in> M\<^sub>1"
           using b0 b1_assms by auto
         hence "snd (y x) \<le> count_list as (fst (y x))"
           by (simp add:M\<^sub>1_def case_prod_beta)
         then show ?thesis using count_le_length by (metis order_trans)
       qed
       ultimately have "bit_count (N\<^sub>e (fst (y x))) + bit_count (N\<^sub>e (snd (y x))) \<le> ?rhs1"
         using exp_golomb_bit_count_est  by (intro add_mono, auto)
       thus ?thesis
         by (subst dependent_bit_count_2, simp)
     qed
 
     moreover have "y \<in> extensional ({0..<s\<^sub>1} \<times> {0..<s\<^sub>2})"
       using b0 b PiE_iff by (cases "as = []", auto simp:H_def PiE_iff)
 
     ultimately have "bit_count ((List.product [0..<s\<^sub>1] [0..<s\<^sub>2] \<rightarrow>\<^sub>e N\<^sub>e \<times>\<^sub>e N\<^sub>e) y) \<le> 
       ereal (real s\<^sub>1 * real s\<^sub>2) * (ereal (2 * log 2 (real n + 1) + 1) +
       ereal (2 * log 2 (real (length as) + 1) + 1))"
       by (intro fun_bit_count_est[where xs="(List.product [0..<s\<^sub>1] [0..<s\<^sub>2])", simplified], auto)
     hence "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le> 
        ereal (2 * log 2 (real s\<^sub>1 + 1) + 1) + 
       (ereal (2 * log 2 (real s\<^sub>2 + 1) + 1) +  
       (ereal (2 * log 2 (real k + 1) + 1) + 
       (ereal (2 * log 2 (real (length as) + 1) + 1) +  
       (ereal (real s\<^sub>1 * real s\<^sub>2) * (ereal (2 * log 2 (real n+1) + 1) + 
        ereal (2 * log 2 (real (length as)+1) + 1))))))"
       unfolding encode_fk_state_def dependent_bit_count
       by (intro add_mono exp_golomb_bit_count, auto)
     also have "... \<le> ?rhs" 
       by (simp add: s\<^sub>1_def[symmetric] s\<^sub>2_def[symmetric] Let_def) (simp add:ac_simps)
     finally show "bit_count (encode_fk_state (s\<^sub>1, s\<^sub>2, k, length as, y)) \<le> ?rhs"
       by blast
   qed
   thus ?thesis
     by (simp add: a AE_measure_pmf_iff del:fk_space_usage.simps)
 qed
 
 end
 
 text \<open>Main results of this section:\<close>
 
 theorem fk_alg_correct:
   assumes "k \<ge> 1"
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n) \<bind> fk_result"
   shows "\<P>(\<omega> in measure_pmf M. \<bar>\<omega> - F k as\<bar> \<le> \<delta> * F k as) \<ge> 1 - of_rat \<epsilon>"
   unfolding M_def using fk_alg_correct'[OF assms(1-4)] by blast
 
 theorem fk_exact_space_usage:
   assumes "k \<ge> 1"
   assumes "\<epsilon> \<in> {0<..<1}"
   assumes "\<delta> > 0"
   assumes "set as \<subseteq> {..<n}"
   defines "M \<equiv> fold (\<lambda>a state. state \<bind> fk_update a) as (fk_init k \<delta> \<epsilon> n)"
   shows "AE \<omega> in M. bit_count (encode_fk_state \<omega>) \<le> fk_space_usage (k, n, length as, \<epsilon>, \<delta>)"
   unfolding M_def using fk_exact_space_usage'[OF assms(1-4)] by blast
 
 theorem fk_asymptotic_space_complexity:
   "fk_space_usage \<in> 
   O[at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_top \<times>\<^sub>F at_right (0::rat) \<times>\<^sub>F at_right (0::rat)](\<lambda> (k, n, m, \<epsilon>, \<delta>).
   real k * real n powr (1-1/ real k) / (of_rat \<delta>)\<^sup>2 * (ln (1 / of_rat \<epsilon>)) * (ln (real n) + ln (real m)))"
   (is "_ \<in> O[?F](?rhs)")
 proof -
   define k_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "k_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). k)"
   define n_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "n_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). n)"
   define m_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> nat" where "m_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). m)"
   define \<epsilon>_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<epsilon>_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). \<epsilon>)"
   define \<delta>_of :: "nat \<times> nat \<times> nat \<times> rat \<times> rat \<Rightarrow> rat" where "\<delta>_of = (\<lambda>(k, n, m, \<epsilon>, \<delta>). \<delta>)"
 
   define g1 where 
     "g1 = (\<lambda>x. real (k_of x)*(real (n_of x)) powr (1-1/ real (k_of x)) * (1 / of_rat (\<delta>_of x)^2))"
 
   define g where 
     "g = (\<lambda>x. g1 x * (ln (1 / of_rat (\<epsilon>_of x))) * (ln (real (n_of x)) + ln (real (m_of x))))"
 
   define s1_of where "s1_of = (\<lambda>x. 
     nat \<lceil>3 * real (k_of x) * real (n_of x) powr (1 - 1 / real (k_of x)) / (real_of_rat (\<delta>_of x))\<^sup>2\<rceil>)"
   define s2_of where "s2_of = (\<lambda>x. nat \<lceil>- (18 * ln (real_of_rat (\<epsilon>_of x)))\<rceil>)"
 
   have evt: "(\<And>x. 
     0 < real_of_rat (\<delta>_of x) \<and> 0 < real_of_rat (\<epsilon>_of x) \<and> 
     1/real_of_rat (\<delta>_of x) \<ge> \<delta> \<and> 1/real_of_rat (\<epsilon>_of x) \<ge> \<epsilon> \<and>
     real (n_of x) \<ge> n \<and> real (k_of x) \<ge> k \<and> real (m_of x) \<ge> m\<Longrightarrow> P x) 
     \<Longrightarrow> eventually P ?F"  (is "(\<And>x. ?prem x \<Longrightarrow> _) \<Longrightarrow> _")
     for \<delta> \<epsilon> n k m P
     apply (rule eventually_mono[where P="?prem" and Q="P"])
     apply (simp add:\<epsilon>_of_def case_prod_beta' \<delta>_of_def n_of_def k_of_def m_of_def)
      apply (intro eventually_conj eventually_prod1' eventually_prod2'
         sequentially_inf eventually_at_right_less inv_at_right_0_inf)
     by (auto simp add:prod_filter_eq_bot)
 
   have 1: 
     "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x))"
     "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (m_of x))"
     "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (k_of x))"
     by (intro landau_o.big_mono eventually_mono[OF evt], auto)+
 
 
   have "(\<lambda>x. ln (real (m_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (m_of x)))"
     by (intro landau_ln_2[where a="2"] evt[where m="2"] sum_in_bigo 1, auto)
   hence 2: " (\<lambda>x. log 2 (real (m_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_2  eventually_mono[OF evt[where n="1" and m="1"]])
      (auto simp add:log_def)
 
   have 3: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))" 
     using order_less_le_trans[OF exp_gt_zero] ln_ge_iff
     by (intro landau_o.big_mono  evt[where \<epsilon>="exp 1"])
      (simp add: abs_ge_iff, blast)
 
   have 4: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. 1 / (real_of_rat (\<delta>_of x))\<^sup>2)"
     using one_le_power
     by (intro landau_o.big_mono evt[where \<delta>="1"])
      (simp add:power_one_over[symmetric], blast)
 
   have "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     using order_less_le_trans[OF exp_gt_zero] ln_ge_iff
     by (intro landau_o.big_mono  evt[where n="exp 1"])
      (simp add: abs_ge_iff, blast)
 
   hence 5: "(\<lambda>x. 1) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1 evt[where n="1" and m="1"], auto)
 
   have "(\<lambda>x. -ln(of_rat (\<epsilon>_of x))) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))" 
     by (intro landau_o.big_mono evt) (auto simp add:ln_div)
   hence 6: "(\<lambda>x. real (s2_of x)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     unfolding s2_of_def
     by (intro landau_nat_ceil 3, simp)
 
   have 7: "(\<lambda>_. 1) \<in> O[?F](\<lambda>x. real (n_of x) powr (1 - 1 / real (k_of x)))"
     by (intro landau_o.big_mono evt[where n="1" and k="1"])
      (auto simp add: ge_one_powr_ge_zero)
 
   have 8: "(\<lambda>_. 1) \<in> O[?F](g1)"
     unfolding g1_def by (intro landau_o.big_mult_1 1 7 4)
 
   have "(\<lambda>x. 3 * (real (k_of x) * (n_of x) powr (1 - 1 / real (k_of x)) / (of_rat (\<delta>_of x))\<^sup>2))
     \<in> O[?F](g1)"
     by (subst landau_o.big.cmult_in_iff, simp, simp add:g1_def)
   hence 9: "(\<lambda>x. real (s1_of x)) \<in> O[?F](g1)"
     unfolding s1_of_def by (intro landau_nat_ceil 8, auto simp:ac_simps)
 
   have 10: "(\<lambda>_. 1) \<in> O[?F](g)" 
     unfolding g_def by (intro landau_o.big_mult_1 8 3 5)
   
   have "(\<lambda>x. real (s1_of x)) \<in> O[?F](g)"
     unfolding g_def by (intro landau_o.big_mult_1 5 3 9)
   hence "(\<lambda>x. ln (real (s1_of x) + 1)) \<in> O[?F](g)"
     using 10 by (intro landau_ln_3 sum_in_bigo, auto)
   hence 11: "(\<lambda>x. log 2 (real (s1_of x) + 1)) \<in> O[?F](g)"
     by (simp add:log_def)
 
   have 12: " (\<lambda>x. ln (real (s2_of x) + 1)) \<in> O[?F](\<lambda>x. ln (1 / real_of_rat (\<epsilon>_of x)))"
     using evt[where \<epsilon>="2"] 6 3
     by (intro landau_ln_3 sum_in_bigo, auto)
 
   have 13: "(\<lambda>x. log 2 (real (s2_of x) + 1)) \<in> O[?F](g)" 
     unfolding g_def 
     by (rule landau_o.big_mult_1, rule landau_o.big_mult_1', auto simp add: 8 5 12 log_def)
 
   have "(\<lambda>x. real (k_of x)) \<in> O[?F](g1)"
     unfolding g1_def using 7 4
     by (intro landau_o.big_mult_1, simp_all)
   hence "(\<lambda>x. log 2 (real (k_of x) + 1)) \<in> O[?F](g1)"
     by (simp add:log_def) (intro landau_ln_3 sum_in_bigo 8, auto)
   hence 14: "(\<lambda>x. log 2 (real (k_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def  by (intro landau_o.big_mult_1 3 5)
 
   have 15: "(\<lambda>x. log 2 (real (m_of x) + 1)) \<in> O[?F](g)"
     unfolding g_def using 2 8 3
     by (intro landau_o.big_mult_1', simp_all)
 
   have "(\<lambda>x. ln (real (n_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)))"
     by (intro landau_ln_2[where a="2"] eventually_mono[OF evt[where n="2"]] sum_in_bigo 1, auto)
   hence " (\<lambda>x. log 2 (real (n_of x) + 1)) \<in> O[?F](\<lambda>x. ln (real (n_of x)) + ln (real (m_of x)))"
     by (intro landau_sum_1 evt[where n="1" and m="1"])
      (auto simp add:log_def)
   hence 16: "(\<lambda>x. real (s1_of x) * real (s2_of x) *
     (2 + 2 * log 2 (real (n_of x) + 1) + 2 * log 2 (real (m_of x) + 1))) \<in> O[?F](g)" 
     unfolding g_def using 9 6 5 2
     by (intro landau_o.mult sum_in_bigo, auto)
 
   have "fk_space_usage = (\<lambda>x. fk_space_usage (k_of x, n_of x, m_of x, \<epsilon>_of x, \<delta>_of x))"
     by (simp add:case_prod_beta' k_of_def n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def)
   also have "... \<in> O[?F](g)"
     using 10 11 13 14 15 16
     by (simp add:fun_cong[OF s1_of_def[symmetric]] fun_cong[OF s2_of_def[symmetric]] Let_def)
      (intro sum_in_bigo, auto)
   also have "... = O[?F](?rhs)"
     by (simp add:case_prod_beta' g1_def g_def n_of_def \<epsilon>_of_def \<delta>_of_def m_of_def k_of_def)
   finally show ?thesis by simp
 qed
 
 end
diff --git a/thys/Frequency_Moments/Probability_Ext.thy b/thys/Frequency_Moments/Probability_Ext.thy
--- a/thys/Frequency_Moments/Probability_Ext.thy
+++ b/thys/Frequency_Moments/Probability_Ext.thy
@@ -1,328 +1,82 @@
 section \<open>Probability Spaces\<close>
 
 text \<open>Some additional results about probability spaces in addition to "HOL-Probability".\<close>
 
 theory Probability_Ext
   imports
     "HOL-Probability.Stream_Space"
+    Concentration_Inequalities.Bienaymes_Identity
     Universal_Hash_Families.Carter_Wegman_Hash_Family
     Frequency_Moments_Preliminary_Results
 begin
 
-text \<open>Random variables that depend on disjoint sets of the components of a product space are
-independent.\<close>
-
-lemma make_ext: 
-  assumes "\<And>x. P x = P (restrict x I)" 
-  shows "(\<forall>x \<in> Pi I A. P x) = (\<forall>x \<in> PiE I A. P x)"
-  using assms by (simp add:PiE_def Pi_def set_eq_iff, force)
+text \<open>The following aliases are here to prevent possible merge-conflicts. The lemmas have been
+moved to @{theory Concentration_Inequalities.Bienaymes_Identity} and/or
+@{theory Concentration_Inequalities.Concentration_Inequalities_Preliminary}.\<close>
 
-lemma PiE_reindex:
-  assumes "inj_on f I"
-  shows "PiE I (A \<circ> f) = (\<lambda>a. restrict (a \<circ> f) I) ` PiE (f ` I) A" (is "?lhs = ?g ` ?rhs")
-proof -
-  have "?lhs \<subseteq> ?g` ?rhs"
-  proof (rule subsetI)
-    fix x
-    assume a:"x \<in> Pi\<^sub>E I (A \<circ> f)"
-    define y where y_def: "y = (\<lambda>k. if k \<in> f ` I then x (the_inv_into I f k) else undefined)"
-    have b:"y \<in> PiE (f ` I) A" 
-      using a assms the_inv_into_f_eq[OF assms]
-      by (simp add: y_def PiE_iff extensional_def)
-    have c: "x = (\<lambda>a. restrict (a \<circ> f) I) y"
-      using a assms the_inv_into_f_eq extensional_arb
-      by (intro ext, simp add:y_def PiE_iff, fastforce) 
-    show "x \<in> ?g ` ?rhs" using b c by blast
-  qed
-  moreover have "?g ` ?rhs \<subseteq> ?lhs"
-    by (rule image_subsetI, simp add:Pi_def PiE_def)
-  ultimately show ?thesis by blast
-qed
+lemmas make_ext = forall_Pi_to_PiE
+lemmas PiE_reindex = PiE_reindex
 
 context prob_space
 begin
 
-lemma indep_sets_reindex:
-  assumes "inj_on f I"
-  shows "indep_sets A (f ` I) = indep_sets (\<lambda>i. A (f i)) I"
-proof -
-  have a:"\<And>J g. J \<subseteq> I \<Longrightarrow> (\<Prod>j \<in> f ` J. g j) = (\<Prod>j \<in> J. g (f j))"
-    by (metis assms prod.reindex_cong subset_inj_on)
-
-  have "J \<subseteq> I \<Longrightarrow> (\<Pi>\<^sub>E i \<in> J. A (f i)) = (\<lambda>a. restrict (a \<circ> f) J) ` PiE (f ` J) A" for J
-    using assms inj_on_subset 
-    by (subst PiE_reindex[symmetric]) auto
-
-  hence b:"\<And>P J. J \<subseteq> I \<Longrightarrow>  (\<And>x. P x = P (restrict x J)) \<Longrightarrow> (\<forall>A' \<in> \<Pi>\<^sub>E i \<in> J. A (f i). P A') =  (\<forall>A'\<in>PiE (f ` J) A. P (A' \<circ> f))"
-    by simp
-
-  have c:"\<And>J. J \<subseteq> I \<Longrightarrow> finite (f ` J) = finite J" 
-    by (meson assms finite_image_iff inj_on_subset)
-
-  show ?thesis
-    by (simp add:indep_sets_def all_subset_image a c)
-     (simp add:make_ext b cong:restrict_cong)+
-qed
-
-lemma indep_vars_cong_AE:
-  assumes "AE x in M. (\<forall>i \<in> I. X' i x = Y' i x)"
-  assumes "indep_vars M' X' I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> random_variable (M' i) (Y' i)"
-  shows "indep_vars M' Y' I"
-proof (cases "I \<noteq> {}")
-  case True
-
-  have a: "AE x in M. (\<lambda>i\<in>I. Y' i x) = (\<lambda>i\<in>I. X' i x)"
-    by (rule AE_mp[OF assms(1)], rule AE_I2, simp cong:restrict_cong)
-  have b: "\<And>i. i \<in> I \<Longrightarrow> random_variable (M' i) (X' i)" 
-    using assms(2) by (simp add:indep_vars_def2)
-  have c: "\<And>x. x \<in> I \<Longrightarrow> AE xa in M. X' x xa = Y' x xa" 
-    by (rule AE_mp[OF assms(1)], rule AE_I2, simp)
-
-  have "distr M (Pi\<^sub>M I M') (\<lambda>x. \<lambda>i\<in>I. Y' i x) = distr M (Pi\<^sub>M I M') (\<lambda>x. \<lambda>i\<in>I. X' i x)"
-    by (intro distr_cong_AE measurable_restrict a b assms(3)) auto
-  also have "... =  Pi\<^sub>M I (\<lambda>i. distr M (M' i) (X' i))"
-    using assms True b by (subst indep_vars_iff_distr_eq_PiM'[symmetric]) auto
-  also have "... =  Pi\<^sub>M I (\<lambda>i. distr M (M' i) (Y' i))"
-    by (intro PiM_cong distr_cong_AE c assms(3) b) auto
-  finally have "distr M (Pi\<^sub>M I M') (\<lambda>x. \<lambda>i\<in>I. Y' i x) = Pi\<^sub>M I (\<lambda>i. distr M (M' i) (Y' i))"
-    by simp
-
-  thus ?thesis
-    using True assms(3)
-    by (subst indep_vars_iff_distr_eq_PiM') auto
-next
-  case False
-  then show ?thesis
-    by (simp add:indep_vars_def2 indep_sets_def)
-qed
-
-lemma indep_vars_reindex:
-  assumes "inj_on f I"
-  assumes "indep_vars M' X' (f ` I)"
-  shows "indep_vars (M' \<circ> f) (\<lambda>k \<omega>. X' (f k) \<omega>) I"
-  using assms by (simp add:indep_vars_def2 indep_sets_reindex)
-
-lemma variance_divide:
-  fixes f :: "'a \<Rightarrow> real"
-  assumes "integrable M f"
-  shows "variance (\<lambda>\<omega>. f \<omega> / r) = variance f / r^2"
-  using assms
-  by (subst Bochner_Integration.integral_divide[OF assms(1)])
-    (simp add:diff_divide_distrib[symmetric] power2_eq_square algebra_simps)
+lemmas indep_sets_reindex = indep_sets_reindex
+lemmas indep_vars_cong_AE = indep_vars_cong_AE
+lemmas indep_vars_reindex = indep_vars_reindex
+lemmas variance_divide = variance_divide
+lemmas covariance_def = covariance_def
+lemmas real_prod_integrable = cauchy_schwartz(1)
+lemmas covariance_eq = covariance_eq
+lemmas covar_integrable = covar_integrable
+lemmas sum_square_int = sum_square_int
+lemmas var_sum_1 = bienaymes_identity
+lemmas covar_self_eq = covar_self_eq
+lemmas covar_indep_eq_zero = covar_indep_eq_zero
+lemmas var_sum_2 = bienaymes_identity_2
+lemmas var_sum_pairwise_indep = bienaymes_identity_pairwise_indep
+lemmas indep_var_from_indep_vars = indep_var_from_indep_vars
+lemmas var_sum_pairwise_indep_2 = bienaymes_identity_pairwise_indep_2
+lemmas var_sum_all_indep = bienaymes_identity_full_indep
 
 lemma pmf_mono:
   assumes "M = measure_pmf p"
   assumes "\<And>x. x \<in> P \<Longrightarrow> x \<in> set_pmf p \<Longrightarrow> x \<in> Q"
   shows "prob P \<le> prob Q"
 proof -
   have "prob P = prob (P \<inter> (set_pmf p))"
     by (rule  measure_pmf_eq[OF assms(1)], blast)
   also have "... \<le> prob Q"
     using assms by (intro finite_measure.finite_measure_mono, auto)
   finally show ?thesis by simp
 qed
 
 lemma pmf_add:
   assumes "M = measure_pmf p"
   assumes  "\<And>x. x \<in> P \<Longrightarrow> x \<in> set_pmf p \<Longrightarrow> x \<in> Q \<or> x \<in> R"
   shows "prob P \<le> prob Q + prob R"
 proof -
   have [simp]:"events = UNIV" by (subst assms(1), simp)
   have "prob P \<le> prob (Q \<union> R)"
     using assms by (intro pmf_mono[OF assms(1)], blast)
   also have "... \<le> prob Q + prob R"
     by (rule measure_subadditive, auto)
   finally show ?thesis by simp
 qed
 
 lemma pmf_add_2:
   assumes "M = measure_pmf p"
   assumes "prob {\<omega>. P \<omega>} \<le> r1"
   assumes "prob {\<omega>. Q \<omega>} \<le> r2"
   shows "prob {\<omega>. P \<omega> \<or> Q \<omega>} \<le> r1 + r2" (is "?lhs \<le> ?rhs")
 proof -
   have "?lhs \<le> prob {\<omega>. P \<omega>} + prob {\<omega>. Q \<omega>}"
     by (intro pmf_add[OF assms(1)], auto)
   also have "... \<le> ?rhs"
     by (intro add_mono assms(2-3))
   finally show ?thesis
     by simp
 qed
 
-definition covariance where 
-  "covariance f g = expectation (\<lambda>\<omega>. (f \<omega> - expectation f) * (g \<omega> - expectation g))"
-
-lemma real_prod_integrable:
-  fixes f g :: "'a \<Rightarrow> real"
-  assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
-  assumes sq_int: "integrable M (\<lambda>\<omega>. f \<omega>^2)" "integrable M (\<lambda>\<omega>. g \<omega>^2)"
-  shows "integrable M (\<lambda>\<omega>. f \<omega> * g \<omega>)"
-  unfolding integrable_iff_bounded
-proof
-  have "(\<integral>\<^sup>+ \<omega>. ennreal (norm (f \<omega> * g \<omega>)) \<partial>M)\<^sup>2 = (\<integral>\<^sup>+ \<omega>. ennreal \<bar>f \<omega>\<bar> * ennreal \<bar>g \<omega>\<bar> \<partial>M)\<^sup>2" 
-    by (simp add: abs_mult ennreal_mult)
-  also have "... \<le>  (\<integral>\<^sup>+ \<omega>. ennreal \<bar>f \<omega>\<bar>^2 \<partial>M) * (\<integral>\<^sup>+ \<omega>. ennreal \<bar>g \<omega>\<bar>^2 \<partial>M)"
-    by (rule Cauchy_Schwarz_nn_integral, auto)
-  also have "... < \<infinity>" 
-    using sq_int by (auto simp: integrable_iff_bounded ennreal_power ennreal_mult_less_top)
-  finally have "(\<integral>\<^sup>+ x. ennreal (norm (f x * g x)) \<partial>M)\<^sup>2 < \<infinity>" 
-    by simp
-  thus "(\<integral>\<^sup>+ x. ennreal (norm (f x * g x)) \<partial>M) < \<infinity>" 
-    by (simp add: power_less_top_ennreal)
-qed auto
-
-lemma covariance_eq:
-  fixes f :: "'a \<Rightarrow> real"
-  assumes "f \<in> borel_measurable M" "g \<in> borel_measurable M"
-  assumes "integrable M (\<lambda>\<omega>. f \<omega>^2)" "integrable M (\<lambda>\<omega>. g \<omega>^2)"
-  shows "covariance f g = expectation (\<lambda>\<omega>. f \<omega> * g \<omega>) - expectation f * expectation g"
-proof -
-  have "integrable M f" using square_integrable_imp_integrable assms by auto
-  moreover have "integrable M g" using square_integrable_imp_integrable assms by auto
-  ultimately show ?thesis
-    using assms real_prod_integrable
-    by (simp add:covariance_def algebra_simps prob_space)
-qed
-
-lemma covar_integrable:
-  fixes f g :: "'a \<Rightarrow> real"
-  assumes "f \<in> borel_measurable M" "g \<in> borel_measurable M"
-  assumes "integrable M (\<lambda>\<omega>. f \<omega>^2)" "integrable M (\<lambda>\<omega>. g \<omega>^2)"
-  shows "integrable M (\<lambda>\<omega>. (f \<omega> - expectation f) * (g \<omega> - expectation g))"
-proof -
-  have "integrable M f" using square_integrable_imp_integrable assms by auto
-  moreover have "integrable M g" using square_integrable_imp_integrable assms by auto
-  ultimately show ?thesis using assms real_prod_integrable by (simp add: algebra_simps)
-qed
-
-lemma sum_square_int:
-  fixes f :: "'b \<Rightarrow> 'a \<Rightarrow> real"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. f i \<omega>^2)"
-  shows "integrable M (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)\<^sup>2)"
-proof -
-  have " integrable M (\<lambda>\<omega>. \<Sum>i\<in>I. \<Sum>j\<in>I. f j \<omega> * f i \<omega>)"
-    using assms
-    by (intro Bochner_Integration.integrable_sum real_prod_integrable, auto)
-  thus ?thesis
-    by (simp add:power2_eq_square sum_distrib_left sum_distrib_right)
-qed
-
-lemma var_sum_1:
-  fixes f :: "'b \<Rightarrow> 'a \<Rightarrow> real"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. f i \<omega>^2)"
-  shows 
-    "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = (\<Sum>i \<in> I. (\<Sum>j \<in> I. covariance (f i) (f j)))"
-proof -
-  have a:"\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. (f i \<omega> - expectation (f i)) * (f j \<omega> - expectation (f j)))" 
-    using assms covar_integrable by simp
-  have "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = expectation (\<lambda>\<omega>. (\<Sum>i\<in>I. f i \<omega> - expectation (f i))\<^sup>2)"
-    using square_integrable_imp_integrable[OF assms(2,3)]
-    by (simp add: Bochner_Integration.integral_sum  sum_subtractf)
-  also have "... = expectation (\<lambda>\<omega>. (\<Sum>i \<in> I. (\<Sum>j \<in> I. (f i \<omega> - expectation (f i)) *  (f j \<omega> - expectation (f j)))))"
-    by (simp add: power2_eq_square sum_distrib_right sum_distrib_left mult.commute)
-  also have "... = (\<Sum>i \<in> I. (\<Sum>j \<in> I. covariance (f i) (f j)))"
-    using a by (simp add: Bochner_Integration.integral_sum covariance_def) 
-  finally show ?thesis by simp
-qed
-
-lemma covar_self_eq:
-  fixes f :: "'a \<Rightarrow> real"
-  shows "covariance f f = variance f"
-  by (simp add:covariance_def power2_eq_square)
-
-lemma covar_indep_eq_zero:
-  fixes f g :: "'a \<Rightarrow> real"
-  assumes "integrable M f"
-  assumes "integrable M g"
-  assumes "indep_var borel f borel g"
-  shows "covariance f g = 0"
-proof -
-  have a:"indep_var borel ((\<lambda>t. t - expectation f) \<circ> f) borel ((\<lambda>t. t - expectation g) \<circ> g)"
-    by (rule indep_var_compose[OF assms(3)], auto)
-
-  have b:"expectation (\<lambda>\<omega>. (f \<omega> - expectation f) * (g \<omega> - expectation g)) = 0" 
-    using a assms by (subst indep_var_lebesgue_integral, auto simp add:comp_def prob_space)
-
-  thus ?thesis by (simp add:covariance_def)
-qed
-
-lemma var_sum_2:
-  fixes f :: "'b \<Rightarrow> 'a \<Rightarrow> real"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. f i \<omega>^2)"
-  shows "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = 
-      (\<Sum>i \<in> I. variance (f i)) + (\<Sum>i \<in> I. \<Sum>j \<in> I - {i}. covariance (f i) (f j))"
-proof -
-  have "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = (\<Sum>i\<in>I. \<Sum>j\<in>I. covariance (f i) (f j))"
-    by (simp add: var_sum_1[OF assms(1,2,3)])
-  also have "... = (\<Sum>i\<in>I. covariance (f i) (f i) + (\<Sum>j\<in>I-{i}. covariance (f i) (f j)))"
-    using assms by (subst sum.insert[symmetric], auto simp add:insert_absorb)
-  also have "... = (\<Sum>i\<in>I. variance (f i)) +  (\<Sum>i \<in> I. (\<Sum>j\<in>I-{i}. covariance (f i) (f j)))"
-    by (simp add: covar_self_eq[symmetric] sum.distrib)
-  finally show ?thesis by simp
-qed
-
-lemma var_sum_pairwise_indep:
-  fixes f :: "'b \<Rightarrow> 'a \<Rightarrow> real"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. f i \<omega>^2)"
-  assumes "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> i \<noteq> j \<Longrightarrow> indep_var borel (f i) borel (f j)"
-  shows "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = (\<Sum>i \<in> I. variance (f i))"
-proof -
-  have "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I - {i} \<Longrightarrow> covariance (f i) (f j) = 0" 
-    using covar_indep_eq_zero assms(4) square_integrable_imp_integrable[OF assms(2,3)] by auto
-  hence a:"(\<Sum>i \<in> I. \<Sum>j \<in> I - {i}. covariance (f i) (f j)) = 0"
-    by simp
-  thus ?thesis by (simp add: var_sum_2[OF assms(1,2,3)])
-qed
-
-lemma indep_var_from_indep_vars:
-  assumes "i \<noteq> j"
-  assumes "indep_vars (\<lambda>_. M') f {i, j}" 
-  shows "indep_var M' (f i) M' (f j)"
-proof -
-  have a:"inj (case_bool i j)" using assms(1) 
-    by (simp add: bool.case_eq_if inj_def)
-  have b:"range (case_bool i j) = {i,j}" 
-    by (simp add: UNIV_bool insert_commute)
-  have c:"indep_vars (\<lambda>_. M') f (range (case_bool i j))" using assms(2) b by simp
-
-  have "True = indep_vars (\<lambda>x. M') (\<lambda>x. f (case_bool i j x)) UNIV" 
-    using indep_vars_reindex[OF a c]
-    by (simp add:comp_def)
-  also have "... = indep_vars (\<lambda>x. case_bool M' M' x) (\<lambda>x. case_bool (f i) (f j) x) UNIV"
-    by (rule indep_vars_cong, auto simp:bool.case_distrib bool.case_eq_if)
-  also have "... = ?thesis"
-    by (simp add: indep_var_def)
-  finally show ?thesis by simp
-qed
-
-lemma var_sum_pairwise_indep_2:
-  fixes f :: "'b \<Rightarrow> 'a \<Rightarrow> real"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. f i \<omega>^2)"
-  assumes "\<And>J. J \<subseteq> I \<Longrightarrow> card J = 2 \<Longrightarrow> indep_vars (\<lambda> _. borel) f J"
-  shows "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = (\<Sum>i \<in> I. variance (f i))"
-  using assms(4)
-  by (intro var_sum_pairwise_indep[OF assms(1,2,3)] indep_var_from_indep_vars, auto)
-
-lemma var_sum_all_indep:
-  fixes f :: "'b \<Rightarrow> 'a \<Rightarrow> real"
-  assumes "finite I"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
-  assumes "\<And>i. i \<in> I \<Longrightarrow> integrable M (\<lambda>\<omega>. f i \<omega>^2)"
-  assumes "indep_vars (\<lambda> _. borel) f I"
-  shows "variance (\<lambda>\<omega>. (\<Sum>i \<in> I. f i \<omega>)) = (\<Sum>i \<in> I. variance (f i))"
-  by (intro var_sum_pairwise_indep_2[OF assms(1,2,3)] indep_vars_subset[OF assms(4)],  auto)
-
 end
 
 end
diff --git a/thys/Frequency_Moments/ROOT b/thys/Frequency_Moments/ROOT
--- a/thys/Frequency_Moments/ROOT
+++ b/thys/Frequency_Moments/ROOT
@@ -1,26 +1,27 @@
 chapter AFP
 
 session Frequency_Moments = "HOL-Probability" +
   options [timeout = 1200]
   sessions
     Bertrands_Postulate
+    Concentration_Inequalities
     Equivalence_Relation_Enumeration
     "HOL-Algebra"
     Interpolation_Polynomials_HOL_Algebra
     Lp
     Prefix_Free_Code_Combinators
     Median_Method
     Universal_Hash_Families
   theories
     Frequency_Moments_Preliminary_Results
     Frequency_Moments
     Frequency_Moment_0
     Frequency_Moment_2
     Frequency_Moment_k
     Landau_Ext
     K_Smallest
     Probability_Ext
     Product_PMF_Ext
   document_files
     "root.tex"
     "root.bib"