diff --git a/thys/Ergodic_Theory/Gouezel_Karlsson.thy b/thys/Ergodic_Theory/Gouezel_Karlsson.thy
--- a/thys/Ergodic_Theory/Gouezel_Karlsson.thy
+++ b/thys/Ergodic_Theory/Gouezel_Karlsson.thy
@@ -1,1810 +1,1810 @@
 (*  Author:  Sébastien Gouëzel   sebastien.gouezel@univ-rennes1.fr
     License: BSD
 *)
 
 section \<open>Gouezel-Karlsson\<close>
 
 theory Gouezel_Karlsson
   imports Asymptotic_Density Kingman
 begin
 
 text \<open>This section is devoted to the proof of the main ergodic result of
 the article "Subadditive and multiplicative ergodic theorems" by Gouezel and
 Karlsson~\cite{gouezel_karlsson}. It is a version of Kingman
 theorem ensuring that, for subadditive cocycles, there are almost surely
 many times $n$ where the cocycle is nearly additive at \emph{all} times
 between $0$ and $n$.
 
 This theorem is then used in this article to construct horofunctions
 characterizing the behavior at infinity of compositions
 of semi-contractions. This requires too many further notions to be implemented
 in current Isabelle/HOL, but the main ergodic result is completely
 proved below, in Theorem~\verb+Gouezel_Karlsson+, following the arguments in the paper (but in a
 slightly more general setting here as we are not making any ergodicity assumption).
 
 To simplify the exposition, the theorem is proved assuming that the limit of the subcocycle
 vanishes almost everywhere, in the locale \verb+Gouezel_Karlsson_Kingman+.
 The final result is proved by an easy reduction to this case.
 
 The main steps of the proof are as follows:
 \begin{itemize}
 \item assume first that the map is invertible, and consider the inverse map and the corresponding
 inverse subcocycle. With combinatorial arguments that only work for this inverse subcocycle, we
 control the density of bad times given some allowed error $d>0$, in a precise quantitative way, in
 Lemmas~\verb+upper_density_all_times+ and~\verb+upper_density_large_k+. We put these estimates
 together in Lemma~\verb+upper_density_delta+.
 \item These estimates are then transfered to the original time direction and the original subcocycle in
 Lemma~\verb+upper_density_good_direction_invertible+. The fact that we have quantitative estimates
 in terms of asymptotic densities is central here, just having some infiniteness statement would not be
 enough.
 \item The invertibility assumption is removed in Lemma~\verb+upper_density_good_direction+ by
 using the result in the natural extension.
 \item Finally, the main result is deduced in Lemma~\verb+infinite_AE+ (still assuming that the
 asymptotic limit vanishes almost everywhere), and in full generality in
 Theorem~\verb+Gouezel_Karlsson_Kingman+.
 \end{itemize}
 \<close>
 
 
 lemma upper_density_eventually_measure:
   fixes a::real
   assumes [measurable]: "\<And>n. {x \<in> space M. P x n} \<in> sets M"
     and "emeasure M {x \<in> space M. upper_asymptotic_density {n. P x n} < a} > b"
   shows "\<exists>N. emeasure M {x \<in> space M. \<forall>n \<ge> N. card ({n. P x n} \<inter> {..<n}) < a * n} > b"
 proof -
   define G where "G = {x \<in> space M. upper_asymptotic_density {n. P x n} < a}"
   define H where "H = (\<lambda>N. {x \<in> space M. \<forall>n \<ge> N. card ({n. P x n} \<inter> {..<n}) < a * n})"
   have [measurable]: "G \<in> sets M" "\<And>N. H N \<in> sets M" unfolding G_def H_def by auto
   have "G \<subseteq> (\<Union>N. H N)"
   proof
     fix x assume "x \<in> G"
     then have "x \<in> space M" unfolding G_def by simp
     have "eventually (\<lambda>n. card({n. P x n} \<inter> {..<n}) < a * n) sequentially"
       using \<open>x \<in> G\<close> unfolding G_def using upper_asymptotic_densityD by auto
     then obtain N where "\<And>n. n \<ge> N \<Longrightarrow> card({n. P x n} \<inter> {..<n}) < a * n"
       using eventually_sequentially by auto
     then have "x \<in> H N" unfolding H_def using \<open>x \<in> space M\<close> by auto
     then show "x \<in> (\<Union>N. H N)" by blast
   qed
   have "b < emeasure M G" using assms(2) unfolding G_def by simp
   also have "... \<le> emeasure M (\<Union>N. H N)"
     apply (rule emeasure_mono) using \<open>G \<subseteq> (\<Union>N. H N)\<close> by auto
   finally have "emeasure M (\<Union>N. H N) > b" by simp
   moreover have "(\<lambda>N. emeasure M (H N)) \<longlonglongrightarrow> emeasure M (\<Union>N. H N)"
     apply (rule Lim_emeasure_incseq) unfolding H_def incseq_def by auto
   ultimately have "eventually (\<lambda>N. emeasure M (H N) > b) sequentially"
     by (simp add: order_tendsto_iff)
   then obtain N where "emeasure M (H N) > b"
     using eventually_False_sequentially eventually_mono by blast
   then show ?thesis unfolding H_def by blast
 qed
 
 
 locale Gouezel_Karlsson_Kingman = pmpt +
   fixes u::"nat \<Rightarrow> 'a \<Rightarrow> real"
   assumes subu: "subcocycle u"
     and subu_fin: "subcocycle_avg_ereal u > -\<infinity>"
     and subu_0: "AE x in M. subcocycle_lim u x = 0"
 begin
 
 lemma int_u [measurable]:
   "integrable M (u n)"
 using subu unfolding subcocycle_def by auto
 
 text \<open>Next lemma is Lemma 2.1 in~\cite{gouezel_karlsson}.\<close>
 
 lemma upper_density_all_times:
   assumes "d > (0::real)"
   shows "\<exists>c> (0::real).
         emeasure M {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - c * l} < d} > 1 - d"
 proof -
   define f where "f = (\<lambda>x. abs (u 1 x))"
   have [measurable]: "f \<in> borel_measurable M" unfolding f_def by auto
   define G where "G = {x \<in> space M. (\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x
                       \<and> (\<lambda>n. u n x / n) \<longlonglongrightarrow> 0}"
   have [measurable]: "G \<in> sets M" unfolding G_def by auto
   have "AE x in M. (\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
     apply (rule birkhoff_theorem_AE_nonergodic) using subu unfolding f_def subcocycle_def by auto
   moreover have "AE x in M. (\<lambda>n. u n x / n) \<longlonglongrightarrow> 0"
     using subu_0 kingman_theorem_nonergodic(1)[OF subu subu_fin] by auto
   ultimately have "AE x in M. x \<in> G" unfolding G_def by auto
   then have "emeasure M G = 1" by (simp add: emeasure_eq_1_AE)
 
   define V where "V = (\<lambda>c x. {n. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - c * l})"
   define Good where "Good = (\<lambda>c. {x \<in> G. upper_asymptotic_density (V c x) < d})"
   have [measurable]: "Good c \<in> sets M" for c unfolding Good_def V_def by auto
 
   have I: "upper_asymptotic_density (V c x) \<le> real_cond_exp M Invariants f x / c" if "c>0" "x \<in> G" for c x
   proof -
     have [simp]: "c>0" "c \<noteq> 0" "c \<ge> 0" using \<open>c>0\<close> by auto
     define U where "U = (\<lambda>n. abs(u 0 x) + birkhoff_sum f n x - c * card (V c x \<inter> {1..n}))"
     have main: "u n x \<le> U n" for n
     proof (rule nat_less_induct)
       fix n assume H: "\<forall>m<n. u m x \<le> U m"
       consider "n = 0" | "n\<ge>1 \<and> n \<notin> V c x" | "n\<ge>1 \<and> n \<in> V c x" by linarith
       then show "u n x \<le> U n"
       proof (cases)
         assume "n = 0"
         then show ?thesis unfolding U_def by auto
       next
         assume A: "n\<ge>1 \<and> n \<notin> V c x"
         then have "n \<ge> 1" by simp
         then have "n-1<n" by simp
         have "{1..n} = {1..n-1} \<union> {n}" using \<open>1 \<le> n\<close> atLeastLessThanSuc by auto
         then have *: "card (V c x \<inter> {1..n}) = card (V c x \<inter> {1..n-1})" using A by auto
         have "u n x \<le> u (n-1) x + u 1 ((T^^(n-1)) x)"
           using \<open>n\<ge>1\<close> subu unfolding subcocycle_def by (metis le_add_diff_inverse2)
         also have "... \<le> U (n-1) + f ((T^^(n-1)) x)" unfolding f_def using H \<open>n-1<n\<close> by auto
         also have "... = abs(u 0 x) + birkhoff_sum f (n-1) x + f ((T^^(n-1)) x) - c * card (V c x \<inter> {1..n-1})"
           unfolding U_def by auto
         also have "... = abs(u 0 x) + birkhoff_sum f n x - c * card (V c x \<inter> {1..n})"
           using * birkhoff_sum_cocycle[of f "n-1" 1 x] \<open>1 \<le> n\<close> by auto
         also have "... = U n" unfolding U_def by simp
         finally show ?thesis by auto
       next
         assume B: "n\<ge>1 \<and> n \<in> V c x"
         then obtain l where l: "l\<in>{1..n}" "u n x - u (n-l) x \<le> - c * l" unfolding V_def by blast
         then have "n-l < n" by simp
         have m: "- (r * ra) - r * rb = - (r * (rb + ra))" for r ra rb::real
           by (simp add: algebra_simps)
 
         have "card(V c x \<inter> {1..n}) \<le> card ((V c x \<inter> {1..n-l}) \<union> {n-l+1..n})"
           by (rule card_mono, auto)
         also have "... \<le> card (V c x \<inter> {1..n-l}) + card {n-l+1..n}"
           by (rule card_Un_le)
         also have "... \<le> card (V c x \<inter> {1..n-l}) + l" by auto
         finally have "card(V c x \<inter> {1..n}) \<le> card (V c x \<inter> {1..n-l}) + real l" by auto
         then have *: "-c * card (V c x \<inter> {1..n-l}) - c * l \<le> -c * card(V c x \<inter> {1..n})"
           using m by auto
 
         have "birkhoff_sum f ((n-l) + l) x = birkhoff_sum f (n-l) x + birkhoff_sum f l ((T^^(n-l))x)"
           by (rule birkhoff_sum_cocycle)
         moreover have "birkhoff_sum f l ((T^^(n-l))x) \<ge> 0"
           unfolding f_def birkhoff_sum_def using sum_nonneg by auto
         ultimately have **: "birkhoff_sum f (n-l) x \<le> birkhoff_sum f n x" using l(1) by auto
 
         have "u n x \<le> u (n-l) x - c * l" using l by simp
         also have "... \<le> U (n-l) - c* l" using H \<open>n-l < n\<close> by auto
         also have "... = abs(u 0 x) + birkhoff_sum f (n-l) x - c * card (V c x \<inter> {1..n-l}) - c*l"
           unfolding U_def by auto
         also have "... \<le> abs(u 0 x) + birkhoff_sum f n x - c * card (V c x \<inter> {1..n})"
           using * ** by simp
         finally show ?thesis unfolding U_def by auto
       qed
     qed
 
     have "(\<lambda>n. abs(u 0 x) * (1/n) + birkhoff_sum f n x / n - u n x / n) \<longlonglongrightarrow> abs(u 0 x) * 0 + real_cond_exp M Invariants f x - 0"
       apply (intro tendsto_intros) using \<open>x \<in> G\<close> unfolding G_def by auto
     moreover have "(abs(u 0 x) + birkhoff_sum f n x - u n x)/n = abs(u 0 x) * (1/n) + birkhoff_sum f n x / n - u n x / n" for n
       by (auto simp add: add_divide_distrib diff_divide_distrib)
     ultimately have "(\<lambda>n. (abs(u 0 x) + birkhoff_sum f n x - u n x)/n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
       by auto
     then have a: "limsup (\<lambda>n. (abs(u 0 x) + birkhoff_sum f n x - u n x)/n) = real_cond_exp M Invariants f x"
       by (simp add: assms lim_imp_Limsup)
 
     have "c * card (V c x \<inter> {1..n})/n \<le> (abs(u 0 x) + birkhoff_sum f n x - u n x)/n" for n
       using main[of n] unfolding U_def by (simp add: divide_right_mono)
     then have "limsup (\<lambda>n. c * card (V c x \<inter> {1..n})/n) \<le> limsup (\<lambda>n. (abs(u 0 x) + birkhoff_sum f n x - u n x)/n)"
       by (simp add: Limsup_mono)
     then have b: "limsup (\<lambda>n. c * card (V c x \<inter> {1..n})/n) \<le> real_cond_exp M Invariants f x"
       using a by simp
 
     have "ereal(upper_asymptotic_density (V c x)) = limsup (\<lambda>n. card (V c x \<inter> {1..n})/n)"
       using upper_asymptotic_density_shift[of "V c x" 1 0] by auto
     also have "... = limsup (\<lambda>n. ereal(1/c) * ereal(c * card (V c x \<inter> {1..n})/n))"
       by auto
     also have "... = (1/c) * limsup (\<lambda>n. c * card (V c x \<inter> {1..n})/n)"
       by (rule limsup_ereal_mult_left, auto)
     also have "... \<le> ereal (1/c) * real_cond_exp M Invariants f x"
       by (rule ereal_mult_left_mono[OF b], auto)
     finally show "upper_asymptotic_density (V c x) \<le> real_cond_exp M Invariants f x / c"
       by auto
   qed
 
   {
     fix r::real
     obtain c::nat where "r / d < c" using reals_Archimedean2 by auto
     then have "r/d < real c+1" by auto
     then have "r / (real c+1) < d" using \<open>d>0\<close> by (simp add: divide_less_eq mult.commute)
     then have "\<exists>c::nat. r / (real c+1) < d" by auto
   }
   then have unG: "(\<Union>c::nat. {x \<in> G. real_cond_exp M Invariants f x / (c+1) < d}) = G"
     by auto
 
   have *: "r < d * (real n + 1)" if "m \<le> n" "r < d * (real m + 1)" for m n r
   proof -
     have "d * (real m + 1) \<le> d * (real n + 1)" using \<open>d>0\<close> \<open>m \<le> n\<close> by auto
     then show ?thesis using \<open>r < d * (real m + 1)\<close> by auto
   qed
   have "(\<lambda>c. emeasure M {x \<in> G. real_cond_exp M Invariants f x / (real c+1) < d})
           \<longlonglongrightarrow> emeasure M (\<Union>c::nat. {x \<in> G. real_cond_exp M Invariants f x / (c+1) < d})"
     apply (rule Lim_emeasure_incseq) unfolding incseq_def by (auto simp add: divide_simps *)
   then have "(\<lambda>c. emeasure M {x \<in> G. real_cond_exp M Invariants f x / (real c+1) < d}) \<longlonglongrightarrow> emeasure M G"
     using unG by auto
   then have "(\<lambda>c. emeasure M {x \<in> G. real_cond_exp M Invariants f x / (real c+1) < d}) \<longlonglongrightarrow> 1"
     using \<open>emeasure M G = 1\<close> by simp
   then have "eventually (\<lambda>c. emeasure M {x \<in> G. real_cond_exp M Invariants f x / (real c+1) < d} > 1 - d) sequentially"
     apply (rule order_tendstoD)
     apply (insert \<open>0<d\<close>, auto simp add: ennreal_1[symmetric] ennreal_lessI simp del: ennreal_1)
     done
   then obtain c0 where c0: "emeasure M {x \<in> G. real_cond_exp M Invariants f x / (real c0+1) < d} > 1 - d"
     using eventually_sequentially by auto
   define c where "c = real c0 + 1"
   then have "c > 0" by auto
   have *: "emeasure M {x \<in> G. real_cond_exp M Invariants f x / c < d} > 1 - d"
     unfolding c_def using c0 by auto
   have "{x \<in> G. real_cond_exp M Invariants f x / c < d} \<subseteq> {x \<in> space M. upper_asymptotic_density (V c x) < d}"
     apply auto
     using G_def apply blast
     using I[OF \<open>c>0\<close>] by fastforce
   then have "emeasure M {x \<in> G. real_cond_exp M Invariants f x / c < d} \<le> emeasure M {x \<in> space M. upper_asymptotic_density (V c x) < d}"
     apply (rule emeasure_mono) unfolding V_def by auto
   then have "emeasure M {x \<in> space M. upper_asymptotic_density (V c x) < d} > 1 - d" using * by auto
   then show ?thesis unfolding V_def using \<open>c>0\<close> by auto
 qed
 
 text \<open>Next lemma is Lemma 2.2 in~\cite{gouezel_karlsson}.\<close>
 
 lemma upper_density_large_k:
   assumes "d > (0::real)" "d \<le> 1"
   shows "\<exists>k::nat.
         emeasure M {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} < d} > 1 - d"
 proof -
   have [simp]: "d>0" "d \<noteq> 0" "d \<ge> 0" using \<open>d>0\<close> by auto
   define rho where "rho = d * d * d / 4"
   have [simp]: "rho > 0" "rho \<noteq> 0" "rho \<ge> 0" unfolding rho_def using assms by auto
 
   text \<open>First step: choose a time scale $s$ at which all the computations will be done. the
   integral of $u_s$ should be suitably small -- how small precisely is given by $\rho$.\<close>
   have "ennreal(\<integral>x. abs(u n x / n) \<partial>M) = (\<integral>\<^sup>+x. abs(u n x /n - subcocycle_lim u x) \<partial>M)" for n
   proof -
     have "ennreal(\<integral>x. abs(u n x / n) \<partial>M) = (\<integral>\<^sup>+x. abs(u n x /n) \<partial>M)"
       apply (rule nn_integral_eq_integral[symmetric]) using int_u by auto
     also have "... = (\<integral>\<^sup>+x. abs(u n x /n - subcocycle_lim u x) \<partial>M)"
       apply (rule nn_integral_cong_AE) using subu_0 by auto
     finally show ?thesis by simp
   qed
   moreover have "(\<lambda>n. \<integral>\<^sup>+x. abs(u n x /n - subcocycle_lim u x) \<partial>M) \<longlonglongrightarrow> 0"
     by (rule kingman_theorem_nonergodic(3)[OF subu subu_fin])
   ultimately have "(\<lambda>n. ennreal(\<integral>x. abs(u n x / n) \<partial>M)) \<longlonglongrightarrow> 0"
     by auto
   then have "(\<lambda>n. (\<integral>x. abs(u n x / n) \<partial>M)) \<longlonglongrightarrow> 0"
     by (simp add: ennreal_0[symmetric] del: ennreal_0)
   then have "eventually (\<lambda>n. (\<integral>x. abs(u n x / n) \<partial>M) < rho) sequentially"
     by (rule order_tendstoD(2), auto)
   then obtain s::nat where [simp]: "s>0" and s_int: "(\<integral>x. abs(u s x / s) \<partial>M) < rho"
     by (metis (mono_tags, lifting) neq0_conv eventually_sequentially gr_implies_not0
         linorder_not_le of_nat_0_eq_iff order_refl zero_neq_one)
 
   text \<open>Second step: a truncation argument, to decompose $|u_1|$ as a sum of a constant (its
   contribution will be small if $k$ is large at the end of the argument) and of a function with
   small integral).\<close>
 
   have "(\<lambda>n. (\<integral>x. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x \<partial>M)) \<longlonglongrightarrow> (\<integral>x. 0 \<partial>M)"
   proof (rule integral_dominated_convergence[where ?w = "\<lambda>x. abs(u 1 x)"])
     show "AE x in M. norm (abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x) \<le> abs(u 1 x)" for n
       unfolding indicator_def by auto
     {
       fix x
       have "abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x = (0::real)" if "n > abs(u 1 x)" for n::nat
         unfolding indicator_def using that by auto
       then have "eventually (\<lambda>n. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x = 0) sequentially"
         by (metis (mono_tags, lifting) eventually_at_top_linorder reals_Archimedean2 less_le_trans of_nat_le_iff)
       then have "(\<lambda>n. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x) \<longlonglongrightarrow> 0"
         by (rule tendsto_eventually)
     }
     then show "AE x in M. (\<lambda>n. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x) \<longlonglongrightarrow> 0"
       by simp
   qed (auto simp add: int_u)
   then have "eventually (\<lambda>n. (\<integral>x. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> n} x \<partial>M) < rho) sequentially"
     by (rule order_tendstoD(2), auto)
   then obtain Knat::nat where Knat: "Knat > 0" "(\<integral>x. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> Knat} x \<partial>M) < rho"
     by (metis (mono_tags, lifting) eventually_sequentially gr_implies_not0 neq0_conv
         linorder_not_le of_nat_0_eq_iff order_refl zero_neq_one)
   define K where "K = real Knat"
   then have [simp]: "K \<ge> 0" "K>0" and K: "(\<integral>x. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> K} x \<partial>M) < rho"
     using Knat by auto
 
   define F where "F = (\<lambda>x. abs(u 1 x) * indicator {x. abs(u 1 x) \<ge> K} x)"
   have int_F [measurable]: "integrable M F"
     unfolding F_def apply (rule Bochner_Integration.integrable_bound[where ?f = "\<lambda>x. abs(u 1 x)"])
     unfolding indicator_def by (auto simp add: int_u)
   have "(\<integral>x. F x \<partial>M) = (\<integral>x. abs(u 1 x) * indicator {x \<in> space M. abs(u 1 x) \<ge> K} x \<partial>M)"
     apply (rule integral_cong_AE) unfolding F_def by (auto simp add: indicator_def)
   then have F_int: "(\<integral>x. F x \<partial>M) < rho" using K by auto
   have F_pos: "F x \<ge> 0" for x unfolding F_def by auto
   have u1_bound: "abs(u 1 x) \<le> K + F x" for x
     unfolding F_def indicator_def apply (cases "x \<in> {x \<in> space M. K \<le> \<bar>u 1 x\<bar>}") by auto
 
   define F2 where "F2 = (\<lambda>x. F x + abs(u s x/s))"
   have int_F2 [measurable]: "integrable M F2"
     unfolding F2_def using int_F int_u[of s] by auto
   have F2_pos: "F2 x \<ge> 0" for x unfolding F2_def using F_pos by auto
   have "(\<integral>x. F2 x \<partial>M) = (\<integral>x. F x \<partial>M) + (\<integral>x. abs(u s x/s) \<partial>M)"
     unfolding F2_def apply (rule Bochner_Integration.integral_add) using int_F int_u by auto
   then have F2_int: "(\<integral>x. F2 x \<partial>M) < 2 * rho"
     using F_int s_int by auto
 
   text \<open>We can now choose $k$, large enough. The reason for our choice will only appear
   at the end of the proof.\<close>
   define k where "k = max (2 * s + 1) (nat(ceiling((2 * d * s + 2 * K * s)/(d/2))))"
   have "k > 2 * s" unfolding k_def by auto
   have "k \<ge> (2 * d * s + 2 * K * s)/(d/2)"
     unfolding k_def by linarith
   then have "(2 * d * s + 2 * K * s)/k \<le> d/2"
     using \<open>k > 2 * s\<close> by (simp add: divide_simps mult.commute)
 
 
   text \<open>Third step: definition of a good set $G$ where everything goes well.\<close>
 
   define G where "G = {x \<in> space M. (\<lambda>n. u n x / n) \<longlonglongrightarrow> 0
                       \<and> (\<lambda>n. birkhoff_sum (\<lambda>x. abs(u s x / s)) n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. abs(u s x / s)) x
                       \<and> (\<lambda>n. birkhoff_sum F n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants F x
                       \<and> real_cond_exp M Invariants F x + real_cond_exp M Invariants (\<lambda>x. abs(u s x / s)) x = real_cond_exp M Invariants F2 x}"
   have [measurable]: "G \<in> sets M" unfolding G_def by auto
   have "AE x in M. (\<lambda>n. u n x / n) \<longlonglongrightarrow> 0"
     using kingman_theorem_nonergodic(1)[OF subu subu_fin] subu_0 by auto
   moreover have "AE x in M.(\<lambda>n. birkhoff_sum (\<lambda>x. abs(u s x / s)) n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. abs(u s x / s)) x"
     apply (rule birkhoff_theorem_AE_nonergodic) using int_u[of s] by auto
   moreover have "AE x in M. (\<lambda>n. birkhoff_sum F n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants F x"
     by (rule birkhoff_theorem_AE_nonergodic[OF int_F])
   moreover have "AE x in M. real_cond_exp M Invariants F x + real_cond_exp M Invariants (\<lambda>x. abs(u s x / s)) x = real_cond_exp M Invariants F2 x"
     unfolding F2_def apply (rule AE_symmetric[OF real_cond_exp_add]) using int_u[of s] int_F int_u[of s] by auto
   ultimately have "AE x in M. x \<in> G" unfolding G_def by auto
   then have "emeasure M G = 1" by (simp add: emeasure_eq_1_AE)
 
   text \<open>Estimation of asymptotic densities of bad times, for points in $G$.
   There is a trivial part, named $U$ below, that has to be treated separately because it creates
   problematic boundary effects.\<close>
 
   define U where "U = (\<lambda>x. {n. \<exists>l \<in> {n-s<..n}. u n x - u (n-l) x \<le> - d * l})"
   define V where "V = (\<lambda>x. {n. \<exists>l \<in> {k..n-s}. u n x - u (n-l) x \<le> - d * l})"
 
   text \<open>Trivial estimate for $U(x)$: this set is finite for $x\in G$.\<close>
 
   have densU: "upper_asymptotic_density (U x) = 0" if "x \<in> G" for x
   proof -
     define C where "C = Max {abs(u m x) |m. m<s} + d * s"
     have *: "U x \<subseteq> {n. u n x \<le> C - d * n}"
     proof (auto)
       fix n assume "n \<in> U x"
       then obtain l where l: "l\<in> {n-s <..n}" "u n x - u (n-l) x \<le> - d * l" unfolding U_def by auto
       define m where "m = n-l"
       have "m < s" unfolding m_def using l by auto
       have "u n x \<le> u m x - d * l" using l m_def by auto
       also have "... \<le> abs(u m x) - d * n + d * m" unfolding m_def using l
         by (simp add: algebra_simps of_nat_diff)
       also have "... \<le> Max {abs(u m x) |m. m<s} - d * n + d * m"
         using \<open>m < s\<close> apply (auto) by (rule Max_ge, auto)
       also have "... \<le> Max {abs(u m x) |m. m<s} + d * s - d * n"
         using \<open>m < s\<close> \<open>d>0\<close> by auto
       finally show "u n x \<le> C - d * n"
         unfolding C_def by auto
     qed
     have "eventually (\<lambda>n. u n x / n > -d/2) sequentially"
       apply (rule order_tendstoD(1)) using \<open>x \<in> G\<close> \<open>d>0\<close> unfolding G_def by auto
     then obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> u n x / n > - d/2"
       using eventually_sequentially by auto
     {
       fix n assume *: "u n x \<le> C - d * n" "n > N"
       then have "n \<ge> N" "n > 0" by auto
       have "2 * u n x \<le> 2 * C - 2 * d * n" using * by auto
       moreover have "2 * u n x \<ge> - d * n" using N[OF \<open>n \<ge> N\<close>] \<open>n > 0\<close> by (simp add: divide_simps)
       ultimately have "- d * n \<le> 2 * C - 2 * d * n" by auto
       then have "d * n \<le> 2 * C" by auto
       then have "n \<le> 2 * C / d" using \<open>d>0\<close> by (simp add: mult.commute divide_simps)
     }
     then have "{n. u n x \<le> C - d * n} \<subseteq> {..max (nat (floor(2*C/d))) N}"
       by (auto, meson le_max_iff_disj le_nat_floor not_le)
     then have "finite {n. u n x \<le> C - d * n}"
       using finite_subset by blast
     then have "finite (U x)" using * finite_subset by blast
     then show ?thesis using upper_asymptotic_density_finite by auto
   qed
 
   text \<open>Main step: control of $u$ along the sequence $ns+t$, with a term
   $-(d/2) Card(V(x) \cap [1,ns+t])$ on the right.
   Then, after averaging in $t$, Birkhoff theorem will imply that
   $Card(V(x) \cap [1,n])$ is suitably small.\<close>
 
   define Z where "Z = (\<lambda>t n x. Max {u i x|i. i< s} + (\<Sum>i<n. abs(u s ((T^^(i * s + t))x)))
                   + birkhoff_sum F (n * s + t) x - (d/2) * card(V x \<inter> {1..n * s + t}))"
   have Main: "u (n * s + t) x \<le> Z t n x" if "t < s" for n x t
   proof (rule nat_less_induct[where ?n = n])
     fix n assume H: "\<forall>m<n. u (m * s + t) x \<le> Z t m x"
     consider "n = 0"|"n>0 \<and> V x \<inter> {(n-1) * s+t<..n * s+t} = {}"|"n>0 \<and> V x \<inter> {(n-1) * s+t<..n * s+t} \<noteq> {}" by auto
     then show "u (n * s+t) x \<le> Z t n x"
     proof (cases)
       assume "n = 0"
       then have "V x \<inter> {1..n * s + t} = {}" unfolding V_def using \<open>t<s\<close> \<open>k>2* s\<close> by auto
       then have *: "card(V x \<inter> {1..n * s+t}) = 0" by simp
       have **: "0 \<le> (\<Sum>i<t. F ((T ^^ i) x))" by (rule sum_nonneg, simp add: F_pos)
       have "u (n * s + t) x = u t x" using \<open>n = 0\<close> by auto
       also have "... \<le> Max {u i x|i. i< s}" by (rule Max_ge, auto simp add: \<open>t<s\<close>)
       also have "... \<le> Z t n x"
         unfolding Z_def birkhoff_sum_def using \<open>n = 0\<close> * ** by auto
       finally show ?thesis by simp
     next
       assume A: "n>0 \<and> V x \<inter> {(n-1) * s+t<..n * s+t} = {}"
       then have "n\<ge>1" by simp
       have "n * s + t = (n-1) * s + t + s" using \<open>n\<ge>1\<close> by (simp add: add.commute add.left_commute mult_eq_if)
       have "V x \<inter> {1..n * s + t} = V x \<inter> {1..(n-1) * s + t} \<union> V x \<inter> {(n-1) * s + t<..n * s + t}"
         using \<open>n\<ge>1\<close> by (auto, simp add: mult_eq_if)
       then have *: "card(V x \<inter> {1..n * s+t}) = card(V x \<inter> {1..(n-1) * s+t})" using A by auto
 
       have **: "birkhoff_sum F ((n-1) * s + t) x \<le> birkhoff_sum F (n * s + t) x"
         unfolding birkhoff_sum_def apply (rule sum_mono2)
         using \<open>n * s+t = (n-1) * s+t + s\<close> F_pos by auto
 
       have "(\<Sum>i<n-1. abs(u s ((T^^(i * s+t))x))) + u s ((T^^((n-1) * s+t)) x)
         \<le> (\<Sum>i<n-1. abs(u s ((T^^(i * s+t))x))) + abs(u s ((T^^((n-1) * s+t)) x))" by auto
       also have "... \<le> (\<Sum>i<n. abs(u s ((T^^(i* s+t))x)))"
         using \<open>n\<ge>1\<close> lessThan_Suc_atMost sum.lessThan_Suc[of "\<lambda>i. abs(u s ((T^^(i* s+t))x))" "n-1", symmetric] by auto
       finally have ***: "(\<Sum>i<n-1. abs(u s ((T^^(i* s+t))x))) + u s ((T^^((n-1) * s+t)) x) \<le> (\<Sum>i<n. abs(u s ((T^^(i* s+t))x)))"
         by simp
 
       have "u (n * s+t) x = u ((n-1) * s+t + s) x"
         using \<open>n\<ge>1\<close> by (simp add: add.commute add.left_commute mult_eq_if)
       also have "... \<le> u ((n-1) * s+t) x + u s ((T^^((n-1) * s+t)) x)"
         using subcocycle_ineq[OF subu, of "(n-1) * s+t" s x] by simp
       also have "... \<le> Max {u i x|i. i< s} + (\<Sum>i<n-1. abs(u s ((T^^(i* s+t))x)))
         + birkhoff_sum F ((n-1) * s+t) x - (d/2) * card(V x \<inter> {1..(n-1) * s+t}) + u s ((T^^((n-1) * s+t)) x)"
         using H \<open>n\<ge>1\<close> unfolding Z_def by auto
       also have "... \<le> Max {u i x|i. i< s} + (\<Sum>i<n. abs(u s ((T^^(i* s+t))x)))
         + birkhoff_sum F (n * s+t) x - (d/2) * card(V x \<inter> {1..n * s+t})"
         using * ** *** by auto
       also have "... \<le> Z t n x" unfolding Z_def by (auto simp add: divide_simps)
       finally show ?thesis by simp
     next
       assume B: "n>0 \<and> V x \<inter> {(n-1) * s+t<..n * s+t} \<noteq> {}"
       then have [simp]: "n>0" "n\<ge>1" "n \<noteq> 0" by auto
       obtain m where m: "m \<in> V x \<inter> {(n-1) * s + t<..n * s + t}" using B by blast
       then obtain l where l: "l \<in> {k..m-s}" "u m x - u (m-l) x \<le> - d * l" unfolding V_def by auto
       then have "m-s>0" using \<open>k>2* s\<close> by auto
       then have "m-l \<ge> s" using l by auto
       define p where "p = (m-l-t) div s"
       have p1: "m-l \<ge> p * s + t"
         unfolding p_def using \<open>m-l \<ge> s\<close> \<open>s>t\<close> minus_mod_eq_div_mult [symmetric, of "m - l - t" s]
         by simp
       have p2: "m-l < p* s + t + s"
         unfolding p_def using \<open>m-l \<ge> s\<close> \<open>s>t\<close>
         div_mult_mod_eq[of "m-l-t" s] mod_less_divisor[OF \<open>s>0\<close>, of "m-l-t"] by linarith
       then have "l \<ge> m - p * s - t -s" by auto
       then have "l \<ge> (n-1) * s + t -p * s - t- s" using m by auto
       then have "l + 2 * s\<ge> (n * s + t) - (p * s+t)" by (simp add: diff_mult_distrib)
       have "(p+1) * s + t \<le> (n-1) * s + t"
         using \<open>k> 2 * s\<close> m l(1) p1 by (auto simp add: algebra_simps)
       then have "p+1 \<le> n-1"
         using \<open>s>0\<close> by (meson add_le_cancel_right mult_le_cancel2)
       then have "p \<le> n-1" "p<n" by auto
       have "(p* s + t) + k \<le> (n * s + t)"
         using m l(1) p1 by (auto simp add: algebra_simps)
       then have "(1::real) \<le> ((n * s + t) - (p* s + t)) / k"
         using \<open>k > 2* s\<close> by auto
 
       have In: "u (n * s + t) x \<le> u m x + (\<Sum>i \<in> {(n-1) * s + t..<n * s + t}. abs(u 1 ((T^^i) x)))"
       proof (cases "m = n * s + t")
         case True
         have "(\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x))) \<ge> 0"
           by (rule sum_nonneg, auto)
         then show ?thesis using True by auto
       next
         case False
         then have m2: "n * s + t - m >0" "(n-1) * s+t \<le> m" using m by auto
         have "birkhoff_sum (u 1) (n * s+t-m) ((T^^m) x) = (\<Sum>i<n * s+t-m. u 1 ((T^^i)((T^^m) x)))"
           unfolding birkhoff_sum_def by auto
         also have "... = (\<Sum>i<n * s+t-m. u 1 ((T^^(i+m)) x))"
           by (simp add: funpow_add)
         also have "... = (\<Sum>j \<in> {m..<n * s+t}. u 1 ((T^^j) x))"
           by (rule sum.reindex_bij_betw, rule bij_betw_byWitness[where ?f' = "\<lambda>i. i - m"], auto)
         also have "... \<le> (\<Sum>j \<in> {m..<n * s+t}. abs(u 1 ((T^^j) x)))"
           by (rule sum_mono, auto)
         also have "... \<le> (\<Sum>j \<in> {(n-1) * s+t..<m}. abs(u 1 ((T^^j) x))) + (\<Sum>j \<in> {m..<n * s+t}. abs(u 1 ((T^^j) x)))"
           by auto
         also have "... = (\<Sum>j \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^j) x)))"
           apply (rule sum.atLeastLessThan_concat) using m2 by auto
         finally have *: "birkhoff_sum (u 1) (n * s+t-m) ((T^^m) x) \<le> (\<Sum>j \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^j) x)))"
           by auto
 
         have "u (n * s+t) x \<le> u m x + u (n * s+t-m) ((T^^m) x)"
           using subcocycle_ineq[OF subu, of m "n * s+t-m"] m2 by auto
         also have "... \<le> u m x + birkhoff_sum (u 1) (n * s+t-m) ((T^^m) x)"
           using subcocycle_bounded_by_birkhoff1[OF subu \<open>n * s+t - m >0\<close>, of "(T^^m)x"] by simp
         finally show ?thesis using * by auto
       qed
 
       have Ip: "u (m-l) x \<le> u (p* s+t) x + (\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x)))"
       proof (cases "m-l = p* s+t")
         case True
         have "(\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x))) \<ge> 0"
           by (rule sum_nonneg, auto)
         then show ?thesis using True by auto
       next
         case False
         then have "m-l - (p* s+t) > 0" using p1 by auto
         have I: "p * s + t + (m - l - (p * s + t)) = m - l" using p1 by auto
 
         have "birkhoff_sum (u 1) (m-l - (p* s+t)) ((T^^(p* s+t)) x) = (\<Sum>i<m-l - (p* s+t). u 1 ((T^^i) ((T^^(p* s+t)) x)))"
           unfolding birkhoff_sum_def by auto
         also have "... = (\<Sum>i<m-l - (p* s+t). u 1 ((T^^(i+p* s+t)) x))"
           by (simp add: funpow_add)
         also have "... = (\<Sum>j \<in> {p* s+t..<m-l}. u 1 ((T^^j) x))"
           by (rule sum.reindex_bij_betw, rule bij_betw_byWitness[where ?f' = "\<lambda>i. i - (p* s+t)"], auto)
         also have "... \<le> (\<Sum>j \<in> {p* s+t..<m-l}. abs(u 1 ((T^^j) x)))"
           by (rule sum_mono, auto)
         also have "... \<le> (\<Sum>j \<in> {p* s+t..<m-l}. abs(u 1 ((T^^j) x))) + (\<Sum>j \<in> {m-l..<(p+1)* s+t}. abs(u 1 ((T^^j) x)))"
           by auto
         also have "... = (\<Sum>j \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^j) x)))"
           apply (rule sum.atLeastLessThan_concat) using p1 p2 by auto
         finally have *: "birkhoff_sum (u 1) (m-l - (p* s+t)) ((T^^(p* s+t)) x)
           \<le> (\<Sum>j \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^j) x)))"
           by auto
 
         have "u (m-l) x \<le> u (p* s+t) x + u (m-l - (p* s+t)) ((T^^(p* s+t)) x)"
           using subcocycle_ineq[OF subu, of "p* s+t" "m-l - (p* s+t)" x] I by auto
         also have "... \<le> u (p* s+t) x + birkhoff_sum (u 1) (m-l - (p* s+t)) ((T^^(p* s+t)) x)"
           using subcocycle_bounded_by_birkhoff1[OF subu \<open>m-l - (p* s+t) > 0\<close>, of "(T^^(p* s+t)) x"] by simp
         finally show ?thesis using * by auto
       qed
 
       have "(\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x))) \<le> (\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. K + F ((T^^i) x))"
         apply (rule sum_mono) using u1_bound by auto
       moreover have "(\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x))) \<le> (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. K + F ((T^^i) x))"
         apply (rule sum_mono) using u1_bound by auto
       ultimately have "(\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x))) + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x)))
         \<le> (\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. K + F ((T^^i) x)) + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. K + F ((T^^i) x))"
         by auto
       also have "... = 2* K* s + (\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. F ((T^^i) x)) + (\<Sum>i \<in>{(n-1) * s+t..<n * s+t}. F ((T^^i) x))"
         by (auto simp add: mult_eq_if sum.distrib)
       also have "... \<le> 2* K * s + (\<Sum>i \<in> {p* s+t..<(n-1) * s+t}. F ((T^^i) x)) + (\<Sum>i \<in>{(n-1) * s+t..<n * s+t}. F ((T^^i) x))"
         apply (auto, rule sum_mono2) using \<open>(p+1)* s+t\<le>(n-1) * s+t\<close> F_pos by auto
       also have "... = 2* K * s + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x))"
         apply (auto, rule sum.atLeastLessThan_concat) using \<open>p\<le>n-1\<close> by auto
       finally have A0: "(\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x))) + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x)))
         \<le> 2* K * s + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x))"
         by simp
 
       have "card(V x \<inter> {p * s + t<.. n * s+t}) \<le> card {p * s + t<.. n * s+t}" by (rule card_mono, auto)
       have "2 * d * s + 2 * K * s > 0" using \<open>K>0\<close> \<open>s>0\<close> \<open>d>0\<close>
         by (metis add_pos_pos mult_2 mult_zero_left of_nat_0_less_iff pos_divide_less_eq times_divide_eq_right)
       then have "2 * d * s + 2 * K * s \<le> ((n * s + t) - (p* s + t)) * ((2 * d * s + 2 * K * s) / k)"
         using \<open>1 \<le> ((n * s + t) - (p* s + t)) / k\<close> by (simp add: le_divide_eq_1 pos_le_divide_eq)
       also have "... \<le> ((n * s + t) - (p* s + t)) * (d/2)"
         apply (rule mult_left_mono) using \<open>(2 * d * s + 2 * K * s)/k \<le> d/2\<close> by auto
       finally have "2 * d * s + 2 * K * s \<le> ((n * s + t) - (p* s + t)) * (d/2)"
         by auto
       then have "-d * ((n * s+t) - (p* s+t)) + 2 * d * s + 2 * K * s \<le> -d * ((n * s+t) - (p* s+t)) + ((n * s + t) - (p* s + t)) * (d/2)"
         by linarith
       also have "... = (-d/2) * card {p * s + t<.. n * s+t}"
         by auto
       also have "... \<le> (-d/2) * card(V x \<inter> {p * s + t<.. n * s+t})"
         using \<open>card(V x \<inter> {p * s + t<.. n * s+t}) \<le> card {p * s + t<.. n * s+t}\<close> by auto
       finally have A1: "-d * ((n * s+t) - (p* s+t)) + 2 * d * s + 2 * K * s \<le> (-d/2) * card(V x \<inter> {p * s + t<.. n * s+t})"
         by simp
 
       have "V x \<inter> {1.. n * s+t} = V x \<inter> {1..p * s + t} \<union> V x \<inter> {p * s + t<.. n * s+t}"
         using \<open>p * s + t + k \<le> n * s + t\<close> by auto
       then have "card (V x \<inter> {1.. n * s+t}) = card(V x \<inter> {1..p * s + t} \<union> V x \<inter> {p * s + t<.. n * s+t})"
         by auto
       also have "... = card (V x \<inter> {1..p * s + t}) + card (V x \<inter> {p * s + t<.. n * s+t})"
         by (rule card_Un_disjoint, auto)
       finally have A2: "card (V x \<inter> {1..p * s + t}) + card (V x \<inter> {p * s + t<.. n * s+t}) = card (V x \<inter> {1.. n * s+t})"
         by simp
 
       have A3: "(\<Sum>i<p. abs(u s ((T ^^ (i * s + t)) x))) \<le> (\<Sum>i<n. abs(u s ((T ^^ (i * s + t)) x)))"
         apply (rule sum_mono2) using \<open>p\<le>n-1\<close> by auto
 
       have A4: "birkhoff_sum F (p * s + t) x + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x)) = birkhoff_sum F (n * s + t) x"
         unfolding birkhoff_sum_def apply (subst atLeast0LessThan[symmetric])+ apply (rule sum.atLeastLessThan_concat)
         using \<open>p\<le>n-1\<close> by auto
 
       have "u (n * s+t) x \<le> u m x + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x)))"
         using In by simp
       also have "... \<le> (u m x - u (m-l) x) + u (m-l) x + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x)))"
         by simp
       also have "... \<le> - d * l + u (p* s+t) x + (\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x))) + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x)))"
         using Ip l by auto
       also have "... \<le> - d * ((n * s+t) - (p* s+t)) + 2*d* s + u (p* s+t) x + (\<Sum>i \<in> {p* s+t..<(p+1)* s+t}. abs(u 1 ((T^^i) x))) + (\<Sum>i \<in> {(n-1) * s+t..<n * s+t}. abs(u 1 ((T^^i) x)))"
         using \<open>l + 2* s\<ge> (n * s+t) - (p* s+t)\<close> apply (auto simp add: algebra_simps)
         by (metis assms(1) distrib_left mult.commute mult_2 of_nat_add of_nat_le_iff real_mult_le_cancel_iff2)
       also have "... \<le> -d * ((n * s+t) - (p* s+t)) + 2*d* s + Z t p x + 2* K * s + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x))"
         using A0 H \<open>p<n\<close> by auto
       also have "... \<le> Z t p x - d/2 * card(V x \<inter> {p * s + t<.. n * s+t}) + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x))"
         using A1 by auto
       also have "... = Max {u i x |i. i < s} + (\<Sum>i<p. abs(u s ((T ^^ (i * s + t)) x))) + birkhoff_sum F (p * s + t) x
           - d / 2 * card (V x \<inter> {1..p * s + t}) - d/2 * card(V x \<inter> {p * s + t<.. n * s+t}) + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x))"
         unfolding Z_def by auto
       also have "... \<le> Max {u i x |i. i < s} + (\<Sum>i<n. abs(u s ((T ^^ (i * s + t)) x)))
         + (birkhoff_sum F (p * s + t) x + (\<Sum>i \<in> {p* s+t..<n * s+t}. F ((T^^i) x)))
         - d/2 * card (V x \<inter> {1..p * s + t}) - d/2 * card(V x \<inter> {p * s + t<.. n * s+t})"
         using A3 by auto
       also have "... = Z t n x"
         unfolding Z_def using A2 A4 by (auto simp add: algebra_simps, metis distrib_left of_nat_add)
       finally show ?thesis by simp
     qed
   qed
 
   have Main2: "(d/2) * card(V x \<inter> {1..n}) \<le> Max {u i x|i. i< s} + birkhoff_sum (\<lambda>x. abs(u s x/ s)) (n+2* s) x
     + birkhoff_sum F (n + 2 * s) x + (1/s) * (\<Sum>i< 2 * s. abs(u (n+i) x))" for n x
   proof -
     define N where "N = (n div s) + 1"
     then have "n \<le> N * s"
       using \<open>s > 0\<close> dividend_less_div_times less_or_eq_imp_le by auto
     have "N * s \<le> n + s"
       by (auto simp add: N_def)
     have eq_t: "(d/2) * card(V x \<inter> {1..n}) \<le> abs(u(N* s+t) x) + (Max {u i x|i. i< s} + birkhoff_sum F (n + 2* s) x)
             + (\<Sum>i<N. abs(u s ((T^^(i * s+t))x)))"
       if "t<s" for t
     proof -
       have *: "birkhoff_sum F (N * s+t) x \<le> birkhoff_sum F (n+ 2* s) x"
         unfolding birkhoff_sum_def apply (rule sum_mono2) using F_pos \<open>N * s \<le> n + s\<close> \<open>t<s\<close> by auto
 
       have "card(V x \<inter> {1..n}) \<le> card(V x \<inter> {1..N* s+t})"
         apply (rule card_mono) using \<open>n \<le> N * s\<close> by auto
       then have "(d/2) * card(V x \<inter> {1..n}) \<le> (d/2) * card(V x \<inter> {1..N* s+t})"
         by auto
       also have "... \<le> - u (N* s+t) x + Max {u i x|i. i< s} + (\<Sum>i<N. abs(u s ((T^^(i* s+t))x))) + birkhoff_sum F (N * s+t) x"
         using Main[OF \<open>t < s\<close>, of N x] unfolding Z_def by auto
       also have "... \<le> abs(u(N* s+t) x) + Max {u i x|i. i< s} + birkhoff_sum F (n + 2* s) x + (\<Sum>i<N. abs(u s ((T^^(i* s+t))x)))"
         using * by auto
       finally show ?thesis by simp
     qed
 
     have "(\<Sum>t<s. abs(u(N* s+t) x)) = (\<Sum>i\<in>{N* s..<N* s+s}. abs (u i x))"
       by (rule sum.reindex_bij_betw, rule bij_betw_byWitness[where ?f' = "\<lambda>i. i - N* s"], auto)
     also have "... \<le> (\<Sum>i\<in>{n..<n + 2* s}. abs (u i x))"
       apply (rule sum_mono2) using \<open>n \<le> N * s\<close> \<open>N * s \<le> n + s\<close> by auto
     also have "... = (\<Sum>i<2* s. abs (u (n+i) x))"
       by (rule sum.reindex_bij_betw[symmetric], rule bij_betw_byWitness[where ?f' = "\<lambda>i. i - n"], auto)
     finally have **: "(\<Sum>t<s. abs(u(N* s+t) x)) \<le> (\<Sum>i<2* s. abs (u (n+i) x))"
       by simp
 
     have "(\<Sum>t<s. (\<Sum>i<N. abs(u s ((T^^(i* s+t))x)))) = (\<Sum>i<N* s. abs(u s ((T^^i) x)))"
       by (rule sum_arith_progression)
     also have "... \<le> (\<Sum>i<n + 2* s. abs(u s ((T^^i) x)))"
       apply (rule sum_mono2) using \<open>N * s \<le> n + s\<close> by auto
     finally have ***: "(\<Sum>t<s. (\<Sum>i<N. abs(u s ((T^^(i* s+t))x)))) \<le> s * birkhoff_sum (\<lambda>x. abs(u s x/ s)) (n+2* s) x"
       unfolding birkhoff_sum_def using \<open>s>0\<close> by (auto simp add: sum_divide_distrib[symmetric])
 
     have ****: "s * (\<Sum>i<n + 2* s. abs(u s ((T^^i) x)) /s) = (\<Sum>i<n + 2* s. abs(u s ((T^^i) x)))"
       by (auto simp add: sum_divide_distrib[symmetric])
 
     have "s * (d/2) * card(V x \<inter> {1..n}) = (\<Sum>t<s. (d/2) * card(V x \<inter> {1..n}))"
       by auto
     also have "... \<le> (\<Sum>t<s. abs(u(N* s+t) x) + (Max {u i x|i. i< s} + birkhoff_sum F (n + 2* s) x)
             + (\<Sum>i<N. abs(u s ((T^^(i* s+t))x))))"
       apply (rule sum_mono) using eq_t by auto
     also have "... = (\<Sum>t<s. abs(u(N* s+t) x)) + (\<Sum>t<s. Max {u i x|i. i< s} + birkhoff_sum F (n + 2* s) x) + (\<Sum>t<s. (\<Sum>i<N. abs(u s ((T^^(i* s+t))x))))"
       by (auto simp add: sum.distrib)
     also have "... \<le> (\<Sum>i<2* s. abs (u (n+i) x)) + s * (Max {u i x|i. i< s} + birkhoff_sum F (n + 2* s) x) + s * birkhoff_sum (\<lambda>x. abs(u s x/ s)) (n+2* s) x"
       using ** *** by auto
     also have "... = s * ((1/s) * (\<Sum>i<2* s. abs (u (n+i) x)) + Max {u i x|i. i< s} + birkhoff_sum F (n + 2* s) x + birkhoff_sum (\<lambda>x. abs(u s x/ s)) (n+2* s) x)"
       by (auto simp add: divide_simps mult.commute distrib_left)
     finally show ?thesis
       by auto
   qed
 
   have densV: "upper_asymptotic_density (V x) \<le> (2/d) * real_cond_exp M Invariants F2 x" if "x \<in> G" for x
   proof -
     have *: "(\<lambda>n. abs(u n x/n)) \<longlonglongrightarrow> 0"
       apply (rule tendsto_rabs_zero) using \<open>x\<in>G\<close> unfolding G_def by auto
 
     define Bound where "Bound = (\<lambda>n. (Max {u i x|i. i< s}*(1/n) + birkhoff_sum (\<lambda>x. abs(u s x/ s)) (n+2* s) x / n
       + birkhoff_sum F (n + 2* s) x / n + (1/s) * (\<Sum>i<2* s. abs(u (n+i) x) / n)))"
     have "Bound \<longlonglongrightarrow> (Max {u i x|i. i< s} * 0 + real_cond_exp M Invariants (\<lambda>x. abs(u s x/s)) x
                       + real_cond_exp M Invariants F x + (1/s) * (\<Sum>i < 2 * s. 0))"
       unfolding Bound_def apply (intro tendsto_intros)
       using \<open>x\<in>G\<close> * unfolding G_def by auto
     moreover have "real_cond_exp M Invariants (\<lambda>x. abs(u s x/s)) x + real_cond_exp M Invariants F x = real_cond_exp M Invariants F2 x"
       using \<open>x \<in> G\<close> unfolding G_def by auto
     ultimately have B_conv: "Bound \<longlonglongrightarrow> real_cond_exp M Invariants F2 x" by simp
 
     have *: "(d/2) * card(V x \<inter> {1..n}) / n \<le> Bound n" for n
     proof -
       have "(d/2) * card(V x \<inter> {1..n}) / n \<le> (Max {u i x|i. i< s} + birkhoff_sum (\<lambda>x. abs(u s x/ s)) (n+2* s) x
         + birkhoff_sum F (n + 2* s) x + (1/s) * (\<Sum>i<2* s. abs(u (n+i) x)))/n"
         using Main2[of x n] using divide_right_mono of_nat_0_le_iff by blast
       also have "... = Bound n"
         unfolding Bound_def by (auto simp add: add_divide_distrib sum_divide_distrib[symmetric])
       finally show ?thesis by simp
     qed
 
     have "ereal(d/2 * upper_asymptotic_density (V x)) = ereal(d/2) * ereal(upper_asymptotic_density (V x))"
       by auto
     also have "... = ereal (d/2) * limsup(\<lambda>n. card(V x \<inter> {1..n}) / n)"
       using upper_asymptotic_density_shift[of "V x" 1 0] by auto
     also have "... = limsup(\<lambda>n. ereal (d/2) * (card(V x \<inter> {1..n}) / n))"
       by (rule limsup_ereal_mult_left[symmetric], auto)
     also have "... \<le> limsup Bound"
       apply (rule Limsup_mono) using * not_eventuallyD by auto
     also have "... = ereal(real_cond_exp M Invariants F2 x)"
       using B_conv convergent_limsup_cl convergent_def convergent_real_imp_convergent_ereal limI by force
     finally have "d/2 * upper_asymptotic_density (V x) \<le> real_cond_exp M Invariants F2 x"
       by auto
     then show ?thesis
       by (simp add: divide_simps mult.commute)
   qed
 
   define epsilon where "epsilon = 2 * rho / d"
   have [simp]: "epsilon > 0" "epsilon \<noteq> 0" "epsilon \<ge> 0" unfolding epsilon_def by auto
   have "emeasure M {x\<in>space M. real_cond_exp M Invariants F2 x \<ge> epsilon} \<le> (1/epsilon) * (\<integral>x. real_cond_exp M Invariants F2 x \<partial>M)"
     apply (intro integral_Markov_inequality real_cond_exp_pos real_cond_exp_int(1))
     by (auto simp add: int_F2 F2_pos)
   also have "... = (1/epsilon) * (\<integral>x. F2 x \<partial>M)"
     apply (intro arg_cong[where f = ennreal])
     by (simp, rule real_cond_exp_int(2), simp add: int_F2)
   also have "... < (1/epsilon) * 2 * rho"
     using F2_int by (intro ennreal_lessI) (auto simp add: divide_simps)
   also have "... = d"
     unfolding epsilon_def by auto
   finally have *: "emeasure M {x\<in>space M. real_cond_exp M Invariants F2 x \<ge> epsilon} < d"
     by simp
 
   define G2 where "G2 = {x \<in> G. real_cond_exp M Invariants F2 x < epsilon}"
   have [measurable]: "G2 \<in> sets M" unfolding G2_def by simp
   have "1 = emeasure M G"
     using \<open>emeasure M G = 1\<close> by simp
   also have "... \<le> emeasure M (G2 \<union> {x\<in>space M. real_cond_exp M Invariants F2 x \<ge> epsilon})"
     apply (rule emeasure_mono) unfolding G2_def using sets.sets_into_space[OF \<open>G \<in> sets M\<close>] by auto
   also have "... \<le> emeasure M G2 + emeasure M {x\<in>space M. real_cond_exp M Invariants F2 x \<ge> epsilon}"
     by (rule emeasure_subadditive, auto)
   also have "... < emeasure M G2 + d"
     using * by auto
   finally have "1 - d < emeasure M G2"
     using emeasure_eq_measure \<open>d \<le> 1\<close> by (auto intro!: ennreal_less_iff[THEN iffD2] simp del: ennreal_plus simp add: ennreal_plus[symmetric])
 
   have "upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} < d"
     if "x \<in> G2" for x
   proof -
     have "x \<in> G" using \<open>x \<in> G2\<close> unfolding G2_def by auto
     have "{n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} \<subseteq> U x \<union> V x"
       unfolding U_def V_def by fastforce
     then have "upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} \<le> upper_asymptotic_density (U x \<union> V x)"
       by (rule upper_asymptotic_density_subset)
     also have "... \<le> upper_asymptotic_density (U x) + upper_asymptotic_density (V x)"
       by (rule upper_asymptotic_density_union)
     also have "... \<le> (2/d) * real_cond_exp M Invariants F2 x"
       using densU[OF \<open>x \<in> G\<close>] densV[OF \<open>x \<in> G\<close>] by auto
     also have "... < (2/d) * epsilon"
       using \<open>x \<in> G2\<close> unfolding G2_def by (simp add: divide_simps)
     text \<open>This is where the choice of $\rho$ at the beginning of the proof is relevant:
     we choose it so that the above term is at most $d$.\<close>
     also have "... = d" unfolding epsilon_def rho_def by auto
     finally show ?thesis by simp
   qed
   then have "G2 \<subseteq> {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} < d}"
     using sets.sets_into_space[OF \<open>G2 \<in> sets M\<close>] by blast
   then have "emeasure M G2 \<le> emeasure M {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} < d}"
     by (rule emeasure_mono, auto)
   then have "emeasure M {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - d * l} < d} > 1 -d"
     using \<open>emeasure M G2 > 1 - d\<close> by auto
   then show ?thesis by blast
 qed
 
 text \<open>The two previous lemmas are put together in the following lemma,
 corresponding to Lemma 2.3 in~\cite{gouezel_karlsson}.\<close>
 
 lemma upper_density_delta:
   fixes d::real
   assumes "d > 0" "d \<le> 1"
   shows "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
         emeasure M {x \<in> space M. \<forall>(N::nat). card {n \<in>{..<N}. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - delta l * l} \<le> d * N} > 1 - d"
 proof -
   define d2 where "d2 = d/2"
   have [simp]: "d2 > 0" unfolding d2_def using assms by simp
   then have "\<not> d2 < 0" using not_less [of d2 0] by (simp add: less_le)
   have "d2/2 > 0" by simp
   obtain c0 where c0: "c0> (0::real)" "emeasure M {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - c0 * l} < d2/2} > 1 - (d2/2)"
     using upper_density_all_times[OF \<open>d2/2 > 0\<close>] by blast
   have "\<exists>N. emeasure M {x \<in> space M. \<forall>n \<ge> N. card ({n. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - c0 * l} \<inter> {..<n}) < (d2/2) * n} > 1 - (d2/2)"
     apply (rule upper_density_eventually_measure) using c0(2) by auto
   then obtain N1 where N1: "emeasure M {x \<in> space M. \<forall>B \<ge> N1. card ({n. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - c0 * l} \<inter> {..<B}) < (d2/2) * B} > 1 - (d2/2)"
     by blast
   define O1 where "O1 = {x \<in> space M. \<forall>B \<ge> N1. card ({n. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - c0 * l} \<inter> {..<B}) < (d2/2) * B}"
   have [measurable]: "O1 \<in> sets M" unfolding O1_def by auto
   have "emeasure M O1 > 1 - (d2/2)" unfolding O1_def using N1 by auto
 
   have *: "\<exists>N. emeasure M {x \<in> space M. \<forall>B \<ge> N. card({n. \<exists>l \<in> {N..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B} > 1 - e"
     if "e>0" "e \<le> 1" for e::real
   proof -
     obtain k where k: "emeasure M {x \<in> space M. upper_asymptotic_density {n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - e * l} < e} > 1 - e"
       using upper_density_large_k[OF \<open>e>0\<close> \<open>e \<le> 1\<close>] by blast
     then obtain N0 where N0: "emeasure M {x \<in> space M. \<forall>B \<ge> N0. card({n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B} > 1 - e"
       using upper_density_eventually_measure[OF _ k] by auto
     define N where "N = max k N0"
     have "emeasure M {x \<in> space M. \<forall>B \<ge> N0. card({n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B}
             \<le> emeasure M {x \<in> space M. \<forall>B \<ge> N. card({n. \<exists>l \<in> {N..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B}"
     proof (rule emeasure_mono, auto)
       fix x B assume H: "x \<in> space M" "\<forall>B\<ge>N0. card ({n. \<exists>l\<in>{k..n}. u n x - u (n - l) x \<le> - (e * real l)} \<inter> {..<B}) < e * B" "N \<le> B"
 
       have "card({n. \<exists>l \<in> {N..n}. u n x - u (n-l) x \<le> - (e * real l)} \<inter> {..<B}) \<le> card({n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> -(e * real l)} \<inter> {..<B})"
         unfolding N_def by (rule card_mono, auto)
       then have "real(card({n. \<exists>l \<in> {N..n}. u n x - u (n-l) x \<le> - (e * real l)} \<inter> {..<B})) \<le> card({n. \<exists>l \<in> {k..n}. u n x - u (n-l) x \<le> -(e * real l)} \<inter> {..<B})"
         by simp
       also have "... < e * B" using H(2) \<open>B\<ge>N\<close> unfolding N_def by auto
       finally show "card ({n. \<exists>l\<in>{N..n}. u n x - u (n - l) x \<le> - (e * real l)} \<inter> {..<B}) < e * B"
         by auto
     qed
     then have "emeasure M {x \<in> space M. \<forall>B \<ge> N. card({n. \<exists>l \<in> {N..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B} > 1 - e"
       using N0 by simp
     then show ?thesis by auto
   qed
 
   define Ne where "Ne = (\<lambda>(e::real). SOME N. emeasure M {x \<in> space M. \<forall>B \<ge> N. card({n. \<exists>l \<in> {N..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B} > 1 - e)"
   have Ne: "emeasure M {x \<in> space M. \<forall>B \<ge> Ne e. card({n. \<exists>l \<in> {Ne e..n}. u n x - u (n-l) x \<le> - e * l} \<inter> {..<B}) < e * B} > 1 - e"
     if "e>0" "e \<le> 1" for e::real
   unfolding Ne_def by (rule someI_ex[OF *[OF that]])
   define eps where "eps = (\<lambda>(n::nat). d2 * (1/2)^n)"
   have [simp]: "eps n > 0" for n unfolding eps_def by auto
   then have [simp]: "eps n \<ge> 0" for n by (rule less_imp_le)
 
   have "eps n \<le> (1 / 2) * 1" for n
     unfolding eps_def d2_def
     using \<open>d \<le> 1\<close> by (intro mult_mono power_le_one) auto
   also have "\<dots> < 1" by auto
   finally have [simp]: "eps n < 1" for n by simp
   then have [simp]: "eps n \<le> 1" for n by (rule less_imp_le)
 
   have "(\<lambda>n. d2 * (1/2)^n) \<longlonglongrightarrow> d2 * 0"
     by (rule tendsto_mult, auto simp add: LIMSEQ_realpow_zero)
   then have "eps \<longlonglongrightarrow> 0" unfolding eps_def by auto
 
   define Nf where "Nf = (\<lambda>N. (if (N = 0) then 0
                 else if (N = 1) then N1 + 1
                 else max (N1+1) (Max {Ne(eps n)|n. n \<le> N}) + N))"
   have "Nf N < Nf (N+1)" for N
   proof -
     consider "N = 0" | "N = 1" | "N>1" by fastforce
     then show ?thesis
     proof (cases)
       assume "N>1"
       have "Max {Ne (eps n) |n. n \<le> N} \<le> Max {Ne (eps n) |n. n \<le> Suc N}"
         by (rule Max_mono, auto)
       then show ?thesis unfolding Nf_def by auto
     qed (auto simp add: Nf_def)
   qed
   then have "strict_mono Nf"
     using strict_mono_Suc_iff by auto
 
   define On where "On = (\<lambda>(N::nat).
     (if (N = 1) then O1
     else {x \<in> space M. \<forall>B \<ge> Nf N. card({n. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N) * l} \<inter> {..<B}) < (eps N) * B}))"
   have [measurable]: "On N \<in> sets M" for N unfolding On_def by auto
   have "emeasure M (On N) > 1 - eps N" if "N>0" for N
   proof -
     consider "N = 1" | "N>1" using \<open>N>0\<close> by linarith
     then show ?thesis
     proof (cases)
       case 1
       then show ?thesis unfolding On_def eps_def using \<open>emeasure M O1 > 1 - (d2/2)\<close> by auto
     next
       case 2
       have "Ne (eps N) \<le> Max {Ne(eps n)|n. n \<le> N}"
         by (rule Max.coboundedI, auto)
       also have "... \<le> Nf N" unfolding Nf_def using \<open>N>1\<close> by auto
       finally have "Ne (eps N) \<le> Nf N" by simp
       have "1 - eps N < emeasure M {x \<in> space M. \<forall>B \<ge> Ne(eps N). card({n. \<exists>l \<in> {Ne(eps N)..n}. u n x - u (n-l) x \<le> - (eps N) * l} \<inter> {..<B}) < (eps N) * B}"
         by (rule Ne) simp_all
       also have "... \<le> emeasure M {x \<in> space M. \<forall>B \<ge> Nf N. card({n. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N) * l} \<inter> {..<B}) < (eps N) * B}"
       proof (rule emeasure_mono, auto)
         fix x n assume H: "x \<in> space M"
                           "\<forall>n\<ge>Ne (eps N). card ({n. \<exists>l\<in>{Ne (eps N)..n}. u n x - u (n - l) x \<le> - (eps N * l)} \<inter> {..<n}) < eps N * n"
                           "Nf N \<le> n"
         have "card({n. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<n}) \<le> card({n. \<exists>l \<in> {Ne(eps N)..n}. u n x - u (n-l) x \<le> -(eps N) * l} \<inter> {..<n})"
           apply (rule card_mono) using \<open>Ne (eps N) \<le> Nf N\<close> by auto
         then have "real(card({n. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<n})) \<le> card({n. \<exists>l \<in> {Ne(eps N)..n}. u n x - u (n-l) x \<le> -(eps N) * l} \<inter> {..<n})"
           by simp
         also have "... < (eps N) * n" using H(2) \<open>n \<ge> Nf N\<close> \<open>Ne (eps N) \<le> Nf N\<close> by auto
         finally show "real (card ({n. \<exists>l\<in>{Nf N..n}. u n x - u (n - l) x \<le> - (eps N * l)} \<inter> {..<n})) < eps N * real n"
           by auto
       qed
       also have "... = emeasure M (On N)"
         unfolding On_def using \<open>N>1\<close> by auto
       finally show ?thesis by simp
     qed
   qed
   then have *: "emeasure M (On (N+1)) > 1 - eps (N+1)" for N by simp
 
   define Ogood where "Ogood = (\<Inter>N. On (N+1))"
   have [measurable]: "Ogood \<in> sets M" unfolding Ogood_def by auto
   have "emeasure M Ogood \<ge> 1 - (\<Sum>N. eps(N+1))"
     unfolding Ogood_def
     apply (intro emeasure_intersection, auto)
     using * by (auto simp add: eps_def summable_mult summable_divide summable_geometric less_imp_le)
   moreover have "(\<Sum>N. eps(N+1)) = d2"
     unfolding eps_def apply (subst suminf_mult)
     using sums_unique[OF power_half_series, symmetric] by (auto intro!: summable_divide summable_geometric)
   finally have "emeasure M Ogood \<ge> 1 - d2" by simp
   then have "emeasure M Ogood > 1 - d" unfolding d2_def using \<open>d>0\<close> \<open>d \<le> 1\<close>
     by (simp add: emeasure_eq_measure field_sum_of_halves ennreal_less_iff)
 
   have Ogood_union: "Ogood = (\<Union>(K::nat). Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)})"
   apply auto using sets.sets_into_space[OF \<open>Ogood \<in> sets M\<close>] apply blast
   proof -
     fix x
     define M where "M = Max {abs(u n x - u (n-l) x)/l | n l. n \<in> {1..Nf 1} \<and> l \<in> {1..n}}"
     obtain N::nat where "N > M" using reals_Archimedean2 by blast
 
     have "finite { (n, l) | n l. n \<in> {1..Nf 1} \<and> l \<in> {1..n}}"
       by (rule finite_subset[where ?B = "{1.. Nf 1} \<times> {1..Nf 1}"], auto)
     moreover have "{abs(u n x - u (n-l) x)/l | n l. n \<in> {1..Nf 1} \<and> l \<in> {1..n}}
       = (\<lambda> (n, l). abs(u n x - u (n-l) x)/l)` { (n, l) | n l. n \<in> {1..Nf 1} \<and> l \<in> {1..n}}"
       by auto
     ultimately have fin: "finite {abs(u n x - u (n-l) x)/l | n l. n \<in> {1..Nf 1} \<and> l \<in> {1..n}}"
       by auto
     {
       fix n l assume nl: "n \<in> {1..Nf 1} \<and> l \<in> {1..n}"
       then have "real l>0" by simp
       have "abs(u n x - u (n-l) x)/l \<le> M"
         unfolding M_def apply (rule Max_ge) using fin nl by auto
       then have "abs(u n x - u (n-l) x)/l < real N" using \<open>N>M\<close> by simp
       then have "abs(u n x - u (n-l) x)< real N * l" using \<open>0 < real l\<close> pos_divide_less_eq by blast
       then have "u n x - u (n-l) x > - (real N * l)" by simp
     }
     then have "\<forall>n\<in>{Suc 0..Nf (Suc 0)}. \<forall>l\<in>{Suc 0..n}. - (real N * real l) < u n x - u (n - l) x"
       by auto
     then show "\<exists>N. \<forall>n\<in>{Suc 0..Nf (Suc 0)}. \<forall>l\<in>{Suc 0..n}. - (real N * real l) < u n x - u (n - l) x"
       by auto
   qed
   have "(\<lambda>K. emeasure M (Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)}))
     \<longlonglongrightarrow> emeasure M (\<Union>(K::nat). Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)})"
     apply (rule Lim_emeasure_incseq, auto)
     unfolding incseq_def apply auto
     proof -
       fix m n x na l
       assume "m \<le> (n::nat)" "\<forall>n\<in>{Suc 0..Nf (Suc 0)}. \<forall>l\<in>{Suc 0..n}. - (real m * real l) < u n x - u (n - l) x"
              "Suc 0 \<le> l" "l \<le> na" "na \<le> Nf (Suc 0)"
       then have "- (real m * real l) < u na x - u (na - l) x" by auto
       moreover have "- (real n * real l) \<le> - (real m * real l)" using \<open>m \<le> n\<close> by (simp add: mult_mono)
       ultimately show "- (real n * real l) < u na x - u (na - l) x" by auto
     qed
   moreover have "emeasure M (\<Union>(K::nat). Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)}) > 1 - d"
     using Ogood_union \<open>emeasure M Ogood > 1 - d\<close> by auto
   ultimately have a: "eventually (\<lambda>K. emeasure M (Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)}) > 1 - d) sequentially"
     by (rule order_tendstoD(1))
   have b: "eventually (\<lambda>K. K \<ge> max c0 d2) sequentially"
     using eventually_at_top_linorder nat_ceiling_le_eq by blast
   have "eventually (\<lambda>K. K \<ge> max c0 d2 \<and> emeasure M (Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)}) > 1 - d) sequentially"
     by (rule eventually_elim2[OF a b], auto)
   then obtain K where K: "K\<ge>max c0 d2" "emeasure M (Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)}) > 1 - d"
     using eventually_False_sequentially eventually_elim2 by blast
 
   define Og where "Og = Ogood \<inter> {x \<in> space M. \<forall>n \<in> {1..Nf 1}. \<forall>l \<in> {1..n}. u n x - u (n-l) x > - (real K * l)}"
   have [measurable]: "Og \<in> sets M" unfolding Og_def by simp
   have "emeasure M Og > 1 - d" unfolding Og_def using K by simp
 
   have fin: "finite {N. Nf N \<le> n}" for n
     using pseudo_inverse_finite_set[OF filterlim_subseq[OF \<open>strict_mono Nf\<close>]] by auto
   define prev_N where "prev_N = (\<lambda>n. Max {N. Nf N \<le> n})"
   define delta where "delta = (\<lambda>l. if (prev_N l \<le> 1) then K else eps (prev_N l))"
   have "\<forall>l. delta l > 0"
     unfolding delta_def using \<open>K\<ge>max c0 d2\<close> \<open>c0>0\<close> by auto
 
   have "LIM n sequentially. prev_N n :> at_top"
     unfolding prev_N_def apply (rule tendsto_at_top_pseudo_inverse2)
     using \<open>strict_mono Nf\<close> by (simp add: filterlim_subseq)
   then have "eventually (\<lambda>l. prev_N l > 1) sequentially"
     by (simp add: filterlim_iff)
   then have "eventually (\<lambda>l. delta l = eps(prev_N l)) sequentially"
     unfolding delta_def by (simp add: eventually_mono)
   moreover have "(\<lambda>l. eps(prev_N l)) \<longlonglongrightarrow> 0"
     by (rule filterlim_compose[OF \<open>eps \<longlonglongrightarrow> 0\<close> \<open>LIM n sequentially. prev_N n :> at_top\<close>])
   ultimately have "delta \<longlonglongrightarrow> 0" by (simp add: filterlim_cong)
 
   have "delta n \<le> K" for n
   proof -
     have *: "d2 * (1 / 2) ^ prev_N n \<le> real K * 1"
       apply (rule mult_mono') using \<open>K \<ge> max c0 d2\<close> \<open>d2>0\<close> by (auto simp add: power_le_one less_imp_le)
     then show ?thesis unfolding delta_def apply auto unfolding eps_def using * by auto
   qed
 
   define bad_times where "bad_times = (\<lambda>x. {n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<union>
                       (\<Union>N\<in>{2..}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)}))"
   have card_bad_times: "card (bad_times x \<inter> {..<B}) \<le> d2 * B" if "x \<in> Og" for x B
   proof -
     have "(\<Sum>N\<in>{..<B}. (1/(2::real))^N) \<le> (\<Sum>N. (1/2)^N)"
       by (rule sum_le_suminf, auto simp add: summable_geometric)
     also have "... = 2" using suminf_geometric[of "1/(2::real)"] by auto
     finally have *: "(\<Sum>N\<in>{..<B}. (1/(2::real))^N) \<le> 2" by simp
 
     have "(\<Sum> N \<in> {2..<B}. eps N * B) \<le> (\<Sum> N \<in> {2..<B+2}. eps N * B)"
       by (rule sum_mono2, auto)
     also have "... = (\<Sum>N\<in>{2..<B+2}. d2 * (1/2)^N * B)"
       unfolding eps_def by auto
     also have "... = (\<Sum>N\<in>{..<B}. d2 * (1/2)^(N+2) * B)"
       by (rule sum.reindex_bij_betw[symmetric],rule bij_betw_byWitness[where ?f' = "\<lambda>i. i-2"], auto)
     also have "... = (\<Sum>N\<in>{..<B}. (d2 * (1/4) * B) * (1/2)^N)"
       by (auto, metis (lifting) mult.commute mult.left_commute)
     also have "... = (d2 * (1/4) * B) * (\<Sum>N\<in>{..<B}. (1/2)^N)"
       by (rule sum_distrib_left[symmetric])
     also have "... \<le> (d2 * (1/4) * B) * 2"
       apply (rule mult_left_mono) using * \<open>d2 > 0\<close> apply auto
       by (metis \<open>0 < d2\<close> mult_eq_0_iff mult_le_0_iff not_le of_nat_eq_0_iff of_nat_le_0_iff)
     finally have I: "(\<Sum> N \<in> {2..<B}. eps N * B) \<le> d2/2 * B"
       by auto
 
     have "x \<in> On 1" using \<open>x \<in> Og\<close> unfolding Og_def Ogood_def by auto
     then have "x \<in> O1" unfolding On_def by auto
     have B1: "real(card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B})) \<le> (d2/2) * B" for B
     proof (cases "B \<ge> N1")
       case True
       have "card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B})
         \<le> card({n. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B})"
         by (rule card_mono, auto)
       also have "... \<le> (d2/2) * B"
         using \<open>x \<in> O1\<close> unfolding O1_def using True by auto
       finally show ?thesis by auto
     next
       case False
       then have "B < Nf 1" unfolding Nf_def by auto
       then have "{n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B} = {}"
         by auto
       then have "card ({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B}) = 0"
         by auto
       also have "... \<le> (d2/2) * B"
         using \<open>\<not> d2 < 0\<close> by simp
       finally show ?thesis by simp
     qed
 
     have BN: "real(card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})) \<le> eps N * B" if "N \<ge> 2" for N B
     proof -
       have "x \<in> On ((N-1) + 1)" using \<open>x \<in> Og\<close> unfolding Og_def Ogood_def by auto
       then have "x \<in> On N" using \<open>N\<ge>2\<close> by auto
       show ?thesis
       proof (cases "B \<ge> Nf N")
         case True
         have "card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B}) \<le>
           card ({n. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})"
           by (rule card_mono, auto)
         also have "... \<le> eps N * B"
           using \<open>x \<in> On N\<close> \<open>N\<ge>2\<close> True unfolding On_def by auto
         finally show ?thesis by simp
       next
         case False
         then have "{n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B} = {}"
           by auto
         then have "card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B}) = 0"
           by auto
         also have "... \<le> eps N * B"
           by (metis \<open>\<And>n. 0 < eps n\<close> le_less mult_eq_0_iff mult_pos_pos of_nat_0 of_nat_0_le_iff)
         finally show ?thesis by simp
       qed
     qed
 
     {
       fix N assume "N \<ge> B"
       have "Nf N \<ge> B" using seq_suble[OF \<open>strict_mono Nf\<close>, of N] \<open>N \<ge> B\<close> by simp
       then have "{Nf N..} \<inter> {..<B} = {}" by auto
       then have "{n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B} = {}" by auto
     }
     then have *: "(\<Union>N\<in>{B..}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B}) = {}"
       by auto
 
     have "{2..} \<subseteq> {2..<B} \<union> {B..}" by auto
     then have "(\<Union>N\<in>{2..}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})
       \<subseteq> (\<Union>N\<in>{2..<B}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})
         \<union> (\<Union>N\<in>{B..}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})"
       by auto
     also have "... = (\<Union>N\<in>{2..<B}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})"
       using * by auto
     finally have *: "bad_times x \<inter> {..<B} \<subseteq> {n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B}
             \<union> (\<Union>N\<in>{2..<B}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})"
       unfolding bad_times_def by auto
     have "card(bad_times x \<inter> {..<B}) \<le> card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B}
         \<union> (\<Union>N\<in>{2..<B}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B}))"
       by (rule card_mono[OF _ *], auto)
     also have "... \<le> card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B}) +
       card (\<Union>N\<in>{2..<B}. {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})"
       by (rule card_Un_le)
     also have "... \<le> card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B}) +
       (\<Sum> N\<in>{2..<B}. card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B}))"
-      by (simp del: UN_simps, rule card_finite_union, auto)
+      by (simp del: UN_simps, rule card_UN_le, auto)
     finally have "real (card(bad_times x \<inter> {..<B})) \<le>
       real(card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B})
       + (\<Sum> N\<in>{2..<B}. card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})))"
       by (subst of_nat_le_iff, simp)
     also have "... = real(card({n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)} \<inter> {..<B}))
       + (\<Sum> N\<in>{2..<B}. real(card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})))"
       by auto
     also have "... \<le> (d2/2 * B) + (\<Sum> N\<in>{2..<B}. real(card ({n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)} \<inter> {..<B})))"
       using B1 by simp
     also have "... \<le> (d2/2 * B) + (\<Sum> N \<in> {2..<B}. eps N * B)"
       apply (simp, rule sum_mono) using BN by auto
     also have "... \<le> (d2/2 * B) + (d2/2*B)"
       using I by auto
     finally show ?thesis by simp
   qed
 
   have ineq_on_Og: "u n x - u (n-l) x > - delta l * l" if "l \<in> {1..n}" "n \<notin> bad_times x" "x \<in> Og" for n x l
   proof -
     consider "n < Nf 1" | "n \<ge> Nf 1 \<and> prev_N l \<le> 1" | "n \<ge> Nf 1 \<and> prev_N l \<ge> 2" by linarith
     then show ?thesis
     proof (cases)
       assume "n < Nf 1"
       then have "{N. Nf N \<le> n} = {0}"
         apply auto using \<open>strict_mono Nf\<close> unfolding strict_mono_def
         apply (metis le_trans less_Suc0 less_imp_le_nat linorder_neqE_nat not_less)
         unfolding Nf_def by auto
       then have "prev_N n = 0" unfolding prev_N_def by auto
       moreover have "prev_N l \<le> prev_N n"
         unfolding prev_N_def apply (rule Max_mono) using \<open>l \<in> {1..n}\<close> fin apply auto
         unfolding Nf_def by auto
       ultimately have "prev_N l = 0" using \<open>prev_N l \<le> prev_N n\<close> by auto
       then have "delta l = K" unfolding delta_def by auto
       have "1 \<notin> {N. Nf N \<le> n}" using fin[of n]
         by (metis (full_types) Max_ge \<open>prev_N n = 0\<close> fin not_one_le_zero prev_N_def)
       then have "n < Nf 1" by auto
       moreover have "n \<ge> 1" using \<open>l \<in> {1..n}\<close> by auto
       ultimately have "n \<in> {1..Nf 1}" by auto
       then have "u n x - u (n-l) x > - (real K * l)" using \<open>x \<in> Og\<close> unfolding Og_def using \<open>l \<in> {1..n}\<close> by auto
       then show ?thesis using \<open>delta l = K\<close> by auto
     next
       assume H: "n \<ge> Nf 1 \<and> prev_N l \<le> 1"
       then have "delta l = K" unfolding delta_def by auto
       have "n \<notin> {n \<in> {Nf 1..}. \<exists>l\<in>{1..n}. u n x - u (n-l) x \<le> - (c0 * l)}"
         using \<open>n \<notin> bad_times x\<close> unfolding bad_times_def by auto
       then have "u n x - u (n-l) x > - (c0 * l)"
         using H \<open>l \<in> {1..n}\<close> by force
       moreover have "- (c0 * l) \<ge> - (real K * l)" using K(1) by (simp add: mult_mono)
       ultimately show ?thesis using \<open>delta l = K\<close> by auto
     next
       assume H: "n \<ge> Nf 1 \<and> prev_N l \<ge> 2"
       define N where "N = prev_N l"
       have "N \<ge> 2" unfolding N_def using H by auto
       have "prev_N l \<in> {N. Nf N \<le> l}"
         unfolding prev_N_def apply (rule Max_in, auto simp add: fin)
         unfolding Nf_def by auto
       then have "Nf N \<le> l" unfolding N_def by auto
       then have "Nf N \<le> n" using \<open>l \<in> {1..n}\<close> by auto
       have "n \<notin> {n \<in> {Nf N..}. \<exists>l \<in> {Nf N..n}. u n x - u (n-l) x \<le> - (eps N * l)}"
         using \<open>n \<notin> bad_times x\<close> \<open>N\<ge>2\<close> unfolding bad_times_def by auto
       then have "u n x - u (n-l) x > - (eps N * l)"
         using \<open>Nf N \<le> n\<close> \<open>Nf N \<le> l\<close> \<open>l \<in> {1..n}\<close> by force
       moreover have "eps N = delta l" unfolding delta_def N_def using H by auto
       ultimately show ?thesis by auto
     qed
   qed
 
   have "Og \<subseteq> {x \<in> space M. \<forall>(B::nat). card {n \<in>{..<B}. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - delta l * l} \<le> d * B}"
   proof (auto)
     fix x assume "x \<in> Og"
     then show "x \<in> space M" unfolding Og_def by auto
   next
     fix x B assume "x \<in> Og"
     have *: "{n. n < B \<and> (\<exists>l\<in>{Suc 0..n}. u n x - u (n - l) x \<le> - (delta l * real l))} \<subseteq> bad_times x \<inter> {..<B}"
       using ineq_on_Og \<open>x\<in>Og\<close> by force
     have "card {n. n < B \<and> (\<exists>l\<in>{Suc 0..n}. u n x - u (n - l) x \<le> - (delta l * real l))} \<le> card (bad_times x \<inter> {..<B})"
       apply (rule card_mono, simp) using * by auto
     also have "... \<le> d2 * B" using card_bad_times \<open>x \<in> Og\<close> by auto
     also have "... \<le> d * B" unfolding d2_def using \<open>d>0\<close> by auto
     finally show "card {n. n < B \<and> (\<exists>l\<in>{Suc 0..n}. u n x - u (n - l) x \<le> - (delta l * real l))} \<le> d * B"
       by simp
   qed
   then have "emeasure M Og \<le> emeasure M {x \<in> space M. \<forall>(B::nat). card {n \<in>{..<B}. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - delta l * l} \<le> d * B}"
     by (rule emeasure_mono, auto)
   then have "emeasure M {x \<in> space M. \<forall>(B::nat). card {n \<in>{..<B}. \<exists>l \<in> {1..n}. u n x - u (n-l) x \<le> - delta l * l} \<le> d * B} > 1-d"
     using \<open>emeasure M Og > 1 - d\<close> by auto
   then show ?thesis using \<open>delta \<longlonglongrightarrow> 0\<close> \<open>\<forall>l. delta l > 0\<close> by auto
 qed
 
 text \<open>We go back to the natural time direction, by using the previous result for the inverse map
 and the inverse subcocycle, and a change of variables argument. The price to pay is that the
 estimates we get are weaker: we have a control on a set of upper asymptotic density close to $1$, while
 having a set of lower asymptotic density close to $1$ as before would be stronger. This will
 nevertheless be sufficient for our purposes below.\<close>
 
 lemma upper_density_good_direction_invertible:
   assumes "invertible_qmpt"
           "d>(0::real)" "d \<le> 1"
   shows "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
         emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} \<ge> 1-d} \<ge> ennreal(1-d)"
 proof -
   interpret I: Gouezel_Karlsson_Kingman M Tinv "(\<lambda>n x. u n ((Tinv^^n) x))"
   proof
     show "Tinv \<in> quasi_measure_preserving M M"
       using Tinv_qmpt[OF \<open>invertible_qmpt\<close>] unfolding qmpt_def qmpt_axioms_def by simp
     show "Tinv \<in> measure_preserving M M"
       using Tinv_mpt[OF \<open>invertible_qmpt\<close>] unfolding mpt_def mpt_axioms_def by simp
     show "mpt.subcocycle M Tinv (\<lambda>n x. u n ((Tinv ^^ n) x))"
       using subcocycle_u_Tinv[OF subu \<open>invertible_qmpt\<close>] by simp
     show "- \<infinity> < subcocycle_avg_ereal (\<lambda>n x. u n ((Tinv ^^ n) x))"
       using subcocycle_avg_ereal_Tinv[OF subu \<open>invertible_qmpt\<close>] subu_fin by simp
     show "AE x in M. fmpt.subcocycle_lim M Tinv (\<lambda>n x. u n ((Tinv ^^ n) x)) x = 0"
       using subcocycle_lim_Tinv[OF subu \<open>invertible_qmpt\<close>] subu_0 by auto
   qed
   have bij: "bij T" using \<open>invertible_qmpt\<close> unfolding invertible_qmpt_def by simp
 
   define e where "e = d * d / 2"
   have "e>0" "e\<le>1" unfolding e_def using \<open>d>0\<close> \<open>d \<le> 1\<close>
     by (auto, meson less_imp_le mult_left_le one_le_numeral order_trans)
   obtain delta::"nat \<Rightarrow> real" where d: "\<And>l. delta l > 0"
                                        "delta \<longlonglongrightarrow> 0"
         "emeasure M {x \<in> space M. \<forall>N.
         card {n \<in> {..<N}. \<exists>l\<in>{1..n}. u n ((Tinv ^^ n) x) - u (n - l) ((Tinv ^^ (n - l)) x) \<le> - delta l * real l} \<le> e * real N}
         > 1-e"
     using I.upper_density_delta[OF \<open>e>0\<close> \<open>e\<le>1\<close>] by blast
 
   define S where "S = {x \<in> space M. \<forall>N.
           card {n \<in> {..<N}. \<exists>l\<in>{1..n}. u n ((Tinv ^^ n) x) - u (n - l) ((Tinv ^^ (n - l)) x) \<le> - delta l * real l} \<le> e * real N}"
   have [measurable]: "S \<in> sets M" unfolding S_def by auto
   have "emeasure M S > 1 - e" unfolding S_def using d(3) by simp
 
   define Og where "Og = (\<lambda>n. {x \<in> space M. \<forall>l\<in>{1..n}. u n ((Tinv ^^ n) x) - u (n - l) ((Tinv ^^ (n - l)) x) > - delta l * real l})"
   have [measurable]: "Og n \<in> sets M" for n unfolding Og_def by auto
   define Pg where "Pg = (\<lambda>n. {x \<in> space M. \<forall>l\<in>{1..n}. u n x - u (n - l) ((T^^l) x) > - delta l * real l})"
   have [measurable]: "Pg n \<in> sets M" for n unfolding Pg_def by auto
 
   define Bad where "Bad = (\<lambda>i::nat. {x \<in> space M. \<forall>N\<ge>i. card {n \<in> {..<N}. x \<in> Pg n} \<le> (1-d) * real N})"
   have [measurable]: "Bad i \<in> sets M" for i unfolding Bad_def by auto
   then have "range Bad \<subseteq> sets M" by auto
   have "incseq Bad"
     unfolding Bad_def incseq_def by auto
   have inc: "{x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d}
         \<subseteq> (\<Union>i. Bad i)"
   proof
     fix x assume H: "x \<in> {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d}"
     then have "x \<in> space M" by simp
     define A where "A = {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l}"
     have "upper_asymptotic_density A < 1-d" using H unfolding A_def by simp
     then have "\<exists>i. \<forall>N\<ge>i. card (A \<inter> {..<N}) \<le> (1-d)* real N"
       using upper_asymptotic_densityD[of A "1-d"] by (metis (no_types, lifting) eventually_sequentially less_imp_le)
     then obtain i where "card (A \<inter> {..<N}) \<le> (1-d)* real N" if "N\<ge>i" for N by blast
     moreover have "A \<inter> {..<N} = {n. n<N \<and> (\<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l)}" for N
       unfolding A_def by auto
     ultimately have "x \<in> Bad i" unfolding Bad_def Pg_def using \<open>x \<in> space M\<close>
       by auto
     then show "x \<in> (\<Union>i. Bad i)" by blast
   qed
 
   have "emeasure M (Og n) \<le> emeasure M (Pg n)" for n
   proof -
     have *: "(T^^n)-`(Og n) \<inter> space M \<subseteq> Pg n" for n
     proof
       fix x assume x: "x \<in> (T^^n)-`(Og n) \<inter> space M"
       define y where "y = (T^^n) x"
       then have "y \<in> Og n" using x by auto
       have "y \<in> space M" using sets.sets_into_space[OF \<open>Og n \<in> sets M\<close>] \<open>y \<in> Og n\<close> by auto
       have "x = (Tinv^^n) y"
         unfolding y_def Tinv_def using inv_fn_o_fn_is_id[OF bij, of n] by (metis comp_apply)
       {
         fix l assume "l \<in> {1..n}"
         have "(T^^l) x = (T^^l) ((Tinv^^l) ((Tinv^^(n-l))y))"
           apply (subst \<open>x = (Tinv^^n) y\<close>) using funpow_add[of l "n-l" Tinv] \<open>l \<in> {1..n}\<close> by fastforce
         then have *: "(T^^l) x = (Tinv^^(n-l)) y"
           unfolding Tinv_def using fn_o_inv_fn_is_id[OF bij] by (metis comp_apply)
         then have "u n x - u (n-l) ((T^^l) x) = u n ((Tinv^^n) y) - u (n-l) ((Tinv^^(n-l)) y)"
           using \<open>x = (Tinv^^n) y\<close> by auto
         also have "... > - delta l * real l"
           using \<open>y \<in> Og n\<close> \<open>l \<in> {1..n}\<close> unfolding Og_def by auto
         finally have "u n x - u (n-l) ((T^^l) x) > - delta l * real l" by simp
       }
       then show "x \<in> Pg n"
         unfolding Pg_def using x by auto
     qed
     have "emeasure M (Og n) = emeasure M ((T^^n)-`(Og n) \<inter> space M)"
       using T_vrestr_same_emeasure(2) unfolding vimage_restr_def by auto
     also have "... \<le> emeasure M (Pg n)"
       apply (rule emeasure_mono) using * by auto
     finally show ?thesis by simp
   qed
 
   {
     fix N::nat assume "N \<ge> 1"
     have I: "card {n\<in>{..<N}. x \<in> Og n} \<ge> (1-e) * real N" if "x \<in> S" for x
     proof -
       have "x \<in> space M" using \<open>x \<in> S\<close> sets.sets_into_space[OF \<open>S \<in> sets M\<close>] by auto
       have a: "real (card {n. n < N \<and> (\<exists>l\<in>{Suc 0..n}. u n ((Tinv ^^ n) x) - u (n - l) ((Tinv ^^ (n - l)) x) \<le> - (delta l * real l))}) \<le> e * real N"
         using \<open>x \<in> S\<close> unfolding S_def by auto
       have *: "{n. n < N} = {n. n < N \<and> (\<exists>l\<in>{Suc 0..n}. u n ((Tinv ^^ n) x) - u (n - l) ((Tinv ^^ (n - l)) x) \<le> - (delta l * real l))}
               \<union> {n. n < N \<and> x \<in> Og n}" unfolding Og_def using \<open>x \<in> space M\<close>
         by (auto, meson atLeastAtMost_iff linorder_not_le)
       have "N = card {n. n < N}" by auto
       also have "... = card {n. n < N \<and> (\<exists>l\<in>{Suc 0..n}. u n ((Tinv ^^ n) x) - u (n - l) ((Tinv ^^ (n - l)) x) \<le> - (delta l * real l))}
               + card {n. n < N \<and> x \<in> Og n}"
         apply (subst *, rule card_Un_disjoint) unfolding Og_def by auto
       ultimately have "real N \<le> e * real N + card {n. n < N \<and> x \<in> Og n}"
         using a by auto
       then show ?thesis
         by (auto simp add: algebra_simps)
     qed
 
     define m where "m = measure M (Bad N)"
     have "m \<ge> 0" "1-m \<ge> 0" unfolding m_def by auto
 
     have *: "1-e \<le> emeasure M S" using \<open>emeasure M S > 1 - e\<close> by auto
     have "ennreal((1-e) * ((1-e) * real N)) = ennreal(1-e) * ennreal((1-e) * real N)"
       apply (rule ennreal_mult) using \<open>e \<le> 1\<close> by auto
     also have "... \<le> emeasure M S * ennreal((1-e) * real N)"
       using mult_right_mono[OF *] by simp
     also have "... = (\<integral>\<^sup>+ x\<in>S. ((1-e) * real N) \<partial>M)"
       by (metis \<open>S \<in> events\<close> mult.commute nn_integral_cmult_indicator)
     also have "... \<le> (\<integral>\<^sup>+x \<in> S. ennreal(card {n\<in>{..<N}. x \<in> Og n}) \<partial>M)"
       apply (rule nn_integral_mono) using I unfolding indicator_def by (simp)
     also have "... \<le> (\<integral>\<^sup>+x \<in> space M. ennreal(card {n\<in>{..<N}. x \<in> Og n}) \<partial>M)"
       by (rule nn_set_integral_set_mono, simp only: sets.sets_into_space[OF \<open>S \<in> sets M\<close>])
     also have "... = (\<integral>\<^sup>+x. ennreal(card {n\<in>{..<N}. x \<in> Og n}) \<partial>M)"
       by (rule nn_set_integral_space)
     also have "... = (\<integral>\<^sup>+x. ennreal (\<Sum>n\<in>{..<N}. ((indicator (Og n) x)::nat)) \<partial>M)"
       apply (rule nn_integral_cong) using sum_indicator_eq_card2[of "{..<N}" Og] by auto
     also have "... = (\<integral>\<^sup>+x. (\<Sum>n\<in>{..<N}. indicator (Og n) x) \<partial>M)"
       apply (rule nn_integral_cong, auto, simp only: sum_ennreal[symmetric])
       by (metis ennreal_0 ennreal_eq_1 indicator_eq_1_iff indicator_simps(2) real_of_nat_indicator)
     also have "... = (\<Sum>n \<in>{..<N}. (\<integral>\<^sup>+x. (indicator (Og n) x) \<partial>M))"
       by (rule nn_integral_sum, simp)
     also have "... = (\<Sum>n \<in>{..<N}. emeasure M (Og n))"
       by simp
     also have "... \<le> (\<Sum>n \<in>{..<N}. emeasure M (Pg n))"
       apply (rule sum_mono) using \<open>\<And>n. emeasure M (Og n) \<le> emeasure M (Pg n)\<close> by simp
     also have "... = (\<Sum>n \<in>{..<N}. (\<integral>\<^sup>+x. (indicator (Pg n) x) \<partial>M))"
       by simp
     also have "... = (\<integral>\<^sup>+x. (\<Sum>n\<in>{..<N}. indicator (Pg n) x) \<partial>M)"
       by (rule nn_integral_sum[symmetric], simp)
     also have "... = (\<integral>\<^sup>+x. ennreal (\<Sum>n\<in>{..<N}. ((indicator (Pg n) x)::nat)) \<partial>M)"
       apply (rule nn_integral_cong, auto, simp only: sum_ennreal[symmetric])
       by (metis ennreal_0 ennreal_eq_1 indicator_eq_1_iff indicator_simps(2) real_of_nat_indicator)
     also have "... = (\<integral>\<^sup>+x. ennreal(card {n\<in>{..<N}. x \<in> Pg n}) \<partial>M)"
       apply (rule nn_integral_cong) using sum_indicator_eq_card2[of "{..<N}" Pg] by auto
     also have "... = (\<integral>\<^sup>+x \<in> space M. ennreal(card {n\<in>{..<N}. x \<in> Pg n}) \<partial>M)"
       by (rule nn_set_integral_space[symmetric])
     also have "... = (\<integral>\<^sup>+x \<in> Bad N \<union> (space M - Bad N). ennreal(card {n\<in>{..<N}. x \<in> Pg n}) \<partial>M)"
       apply (rule nn_integral_cong) unfolding indicator_def by auto
     also have "... = (\<integral>\<^sup>+x \<in> Bad N. ennreal(card {n\<in>{..<N}. x \<in> Pg n}) \<partial>M)
                       + (\<integral>\<^sup>+x \<in> space M - Bad N. ennreal(card {n\<in>{..<N}. x \<in> Pg n}) \<partial>M)"
       by (rule nn_integral_disjoint_pair, auto)
     also have "... \<le> (\<integral>\<^sup>+x \<in> Bad N. ennreal((1-d) * real N) \<partial>M) + (\<integral>\<^sup>+x \<in> space M - Bad N. ennreal(real N) \<partial>M)"
       apply (rule add_mono)
       apply (rule nn_integral_mono, simp add: Bad_def indicator_def, auto)
       apply (rule nn_integral_mono, simp add: indicator_def, auto)
       using card_Collect_less_nat[of N] card_mono[of "{n. n < N}"] by (simp add: Collect_mono_iff)
     also have "... = ennreal((1-d) * real N) * emeasure M (Bad N) + ennreal(real N) * emeasure M (space M - Bad N)"
       by (simp add: nn_integral_cmult_indicator)
     also have "... = ennreal((1-d) * real N) * ennreal(m) + ennreal(real N) * ennreal(1-m)"
       unfolding m_def by (simp add: emeasure_eq_measure prob_compl)
     also have "... = ennreal((1-d) * real N * m + real N * (1-m))"
       using \<open>m \<ge> 0\<close> \<open>1-m \<ge> 0\<close> \<open>d \<le> 1\<close> ennreal_plus ennreal_mult by auto
     finally have "ennreal((1-e) * ((1-e) * real N)) \<le> ennreal((1-d) * real N * m + real N * (1-m))"
       by simp
     moreover have "(1-d) * real N * m + real N * (1-m) \<ge> 0"
       using \<open>m \<ge> 0\<close> \<open>1-m \<ge> 0\<close> \<open>d \<le> 1\<close> by auto
     ultimately have "(1-e) * ((1-e) * real N) \<le> (1-d) * real N * m + real N * (1-m)"
       using ennreal_le_iff by auto
     then have "0 \<le> (e * 2 - d * m - e * e) * real N"
       by (auto simp add: algebra_simps)
     then have "0 \<le> e * 2 - d * m - e * e"
       using \<open>N \<ge> 1\<close> by (simp add: zero_le_mult_iff)
     also have "... \<le> e * 2 - d * m"
       using \<open>e > 0\<close> by auto
     finally have "m \<le> e * 2 / d"
       using \<open>d>0\<close> by (auto simp add: algebra_simps divide_simps)
     then have "m \<le> d"
       unfolding e_def using \<open>d>0\<close> by (auto simp add: divide_simps)
     then have "emeasure M (Bad N) \<le> d"
       unfolding m_def by (simp add: emeasure_eq_measure ennreal_leI)
   }
   then have "emeasure M (\<Union>i. Bad i) \<le> d"
     using LIMSEQ_le_const2[OF Lim_emeasure_incseq[OF \<open>range Bad \<subseteq> sets M\<close> \<open>incseq Bad\<close>]] by auto
   then have "emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d} \<le> d"
     using emeasure_mono[OF inc, of M] by auto
   then have *: "measure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d} \<le> d"
     using emeasure_eq_measure \<open>d>0\<close> by fastforce
 
   have "{x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} \<ge> 1-d}
         = space M - {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d}"
     by auto
   then have "measure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} \<ge> 1-d}
     = measure M (space M - {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d})"
     by simp
   also have "... = measure M (space M)
     - measure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} < 1-d}"
     by (rule measure_Diff, auto)
   also have "... \<ge> 1 - d"
     using * prob_space by linarith
   finally have "emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} \<ge> 1-d} \<ge> 1 - d"
     using emeasure_eq_measure by auto
   then show ?thesis using d(1) d(2) by blast
 qed
 
 text \<open>Now, we want to remove the invertibility assumption in the previous lemma. The idea is to
 go to the natural extension of the system, use the result there and project it back.
 However, if the system is not defined on a polish space, there is no reason why it should have
 a natural extension, so we have first to project the original system on a polish space on which
 the subcocycle is defined. This system is obtained by considering the joint distribution of the
 subcocycle and all its iterates (this is indeed a polish system, as a space of functions from
 $\mathbb{N}^2$ to $\mathbb{R}$).\<close>
 
 lemma upper_density_good_direction:
   assumes "d>(0::real)" "d \<le> 1"
   shows "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
         emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l} \<ge> 1-d} \<ge> ennreal(1-d)"
 proof -
   define U where "U = (\<lambda>x. (\<lambda>n. u n x))"
   define projJ where "projJ = (\<lambda>x. (\<lambda>n. U ((T^^n)x)))"
   define MJ where "MJ = (distr M borel (\<lambda>x. (\<lambda>n. U ((T^^n)x))))"
   define TJ::"(nat \<Rightarrow> nat \<Rightarrow> real) \<Rightarrow> (nat \<Rightarrow> nat \<Rightarrow> real)" where "TJ = nat_left_shift"
   have *: "mpt_factor projJ MJ TJ"
     unfolding projJ_def MJ_def TJ_def apply (rule fmpt_factor_projection)
     unfolding U_def by (rule measurable_coordinatewise_then_product, simp)
   interpret J: polish_pmpt MJ TJ
     unfolding projJ_def polish_pmpt_def apply (auto)
     apply (rule pmpt_factor) using * apply simp
     unfolding polish_pmpt_axioms_def MJ_def by auto
   have [simp]: "projJ \<in> measure_preserving M MJ" using mpt_factorE(1)[OF *] by simp
   then have [measurable]: "projJ \<in> measurable M MJ" by (simp add: measure_preservingE(1))
 
   text \<open>We define a subcocycle $uJ$ in the projection corresponding to the original
         subcocycle $u$ above. (With the natural definition, it is only a subcocycle almost
         everywhere.) We check that it shares most properties of $u$.\<close>
 
   define uJ::"nat \<Rightarrow> (nat \<Rightarrow> nat \<Rightarrow> real) \<Rightarrow> real" where "uJ = (\<lambda>n x. x 0 n)"
   have [measurable]: "uJ n \<in> borel_measurable borel" for n
     unfolding uJ_def by (metis measurable_product_coordinates measurable_product_then_coordinatewise)
   moreover have "measurable borel borel = measurable MJ borel"
     apply (rule measurable_cong_sets) unfolding MJ_def by auto
   ultimately have [measurable]: "uJ n \<in> borel_measurable MJ" for n by fast
   have uJ_proj: "u n x = uJ n (projJ x)" for n x
     unfolding uJ_def projJ_def U_def by auto
   have uJ_int: "integrable MJ (uJ n)" for n
     apply (rule measure_preserving_preserves_integral'(1)[OF \<open>projJ \<in> measure_preserving M MJ\<close>])
     apply (subst uJ_proj[of n, symmetric]) using int_u[of n] by auto
   have uJ_int2: "(\<integral>x. uJ n x \<partial>MJ) = (\<integral>x. u n x \<partial>M)" for n
     unfolding uJ_proj
     apply (rule measure_preserving_preserves_integral'(2)[OF \<open>projJ \<in> measure_preserving M MJ\<close>])
     apply (subst uJ_proj[of n, symmetric]) using int_u[of n] by auto
   have uJ_AE: "AE x in MJ. uJ (n+m) x \<le> uJ n x + uJ m ((TJ^^n) x)" for m n
   proof -
     have "AE x in M. uJ (n+m) (projJ x) \<le> uJ n (projJ x) + uJ m (projJ ((T^^n) x))"
       unfolding uJ_proj[symmetric] using subcocycle_ineq[OF subu] by auto
     moreover have "AE x in M. projJ ((T^^n) x) = (TJ^^n) (projJ x)"
       using qmpt_factor_iterates[OF mpt_factor_is_qmpt_factor[OF *]] by auto
     ultimately have *: "AE x in M. uJ (n+m) (projJ x) \<le> uJ n (projJ x) + uJ m ((TJ^^n) (projJ x))"
       by auto
     show ?thesis
       apply (rule quasi_measure_preserving_AE'[OF measure_preserving_is_quasi_measure_preserving[OF \<open>projJ \<in> measure_preserving M MJ\<close>], OF *])
       by auto
   qed
   have uJ_0: "AE x in MJ. (\<lambda>n. uJ n x / n) \<longlonglongrightarrow> 0"
   proof -
     have "AE x in M. (\<lambda>n. u n x / n) \<longlonglongrightarrow> subcocycle_lim u x"
       by (rule kingman_theorem_nonergodic(1)[OF subu subu_fin])
     moreover have "AE x in M. subcocycle_lim u x = 0"
       using subu_0 by simp
     ultimately have *: "AE x in M. (\<lambda>n. uJ n (projJ x) / n) \<longlonglongrightarrow> 0"
       unfolding uJ_proj by auto
     show ?thesis
       apply (rule quasi_measure_preserving_AE'[OF measure_preserving_is_quasi_measure_preserving[OF \<open>projJ \<in> measure_preserving M MJ\<close>], OF *])
       by auto
   qed
 
   text \<open>Then, we go to the natural extension of $TJ$, to have an invertible system.\<close>
 
   define MI where "MI = J.natural_extension_measure"
   define TI where "TI = J.natural_extension_map"
   define projI where "projI = J.natural_extension_proj"
   interpret I: pmpt MI TI unfolding MI_def TI_def by (rule J.natural_extension(1))
   have "I.mpt_factor projI MJ TJ" unfolding projI_def
     using I.mpt_factorE(1) J.natural_extension(3) MI_def TI_def by auto
   then have [simp]: "projI \<in> measure_preserving MI MJ" using I.mpt_factorE(1) by auto
   then have [measurable]: "projI \<in> measurable MI MJ" by (simp add: measure_preservingE(1))
   have "I.invertible_qmpt"
     using J.natural_extension(2) MI_def TI_def by auto
 
   text \<open>We define a natural subcocycle $uI$ there, and check its properties.\<close>
 
   define uI where uI_proj: "uI = (\<lambda>n x. uJ n (projI x))"
   have [measurable]: "uI n \<in> borel_measurable MI" for n unfolding uI_proj by auto
   have uI_int: "integrable MI (uI n)" for n
     unfolding uI_proj by (rule measure_preserving_preserves_integral(1)[OF \<open>projI \<in> measure_preserving MI MJ\<close> uJ_int])
   have "(\<integral>x. uJ n x \<partial>MJ) = (\<integral>x. uI n x \<partial>MI)" for n
     unfolding uI_proj by (rule measure_preserving_preserves_integral(2)[OF \<open>projI \<in> measure_preserving MI MJ\<close> uJ_int])
   then have uI_int2: "(\<integral>x. uI n x \<partial>MI) = (\<integral>x. u n x \<partial>M)" for n
     using uJ_int2 by simp
   have uI_AE: "AE x in MI. uI (n+m) x \<le> uI n x + uI m (((TI)^^n) x)" for m n
   proof -
     have "AE x in MI. uJ (n+m) (projI x) \<le> uJ n (projI x) + uJ m (((TJ)^^n) (projI x))"
       apply (rule quasi_measure_preserving_AE[OF measure_preserving_is_quasi_measure_preserving[OF \<open>projI \<in> measure_preserving MI MJ\<close>]])
       using uJ_AE by auto
     moreover have "AE x in MI. ((TJ)^^n) (projI x) = projI (((TI)^^n) x)"
       using I.qmpt_factor_iterates[OF I.mpt_factor_is_qmpt_factor[OF \<open>I.mpt_factor projI MJ TJ\<close>]]
       by auto
     ultimately show ?thesis unfolding uI_proj by auto
   qed
   have uI_0: "AE x in MI. (\<lambda>n. uI n x / n) \<longlonglongrightarrow> 0"
     unfolding uI_proj
     apply (rule quasi_measure_preserving_AE[OF measure_preserving_is_quasi_measure_preserving[OF \<open>projI \<in> measure_preserving MI MJ\<close>]])
     using uJ_0 by simp
 
   text \<open>As $uI$ is only a subcocycle almost everywhere, we correct it to get a genuine subcocycle,
         to which we will apply Lemma \verb+upper_density_good_direction_invertible+.\<close>
 
   obtain vI where H: "I.subcocycle vI" "AE x in MI. \<forall>n. vI n x = uI n x"
     using I.subcocycle_AE[OF uI_AE uI_int] by blast
   have [measurable]: "\<And>n. vI n \<in> borel_measurable MI" "\<And>n. integrable MI (vI n)"
     using I.subcocycle_integrable[OF H(1)] by auto
   have "(\<integral>x. vI n x \<partial>MI) = (\<integral>x. uI n x \<partial>MI)" for n
     apply (rule integral_cong_AE) using H(2) by auto
   then have "(\<integral>x. vI n x \<partial>MI) = (\<integral>x. u n x \<partial>M)" for n
     using uI_int2 by simp
   then have "I.subcocycle_avg_ereal vI = subcocycle_avg_ereal u"
     unfolding I.subcocycle_avg_ereal_def subcocycle_avg_ereal_def by auto
   then have vI_fin: "I.subcocycle_avg_ereal vI > -\<infinity>" using subu_fin by simp
   have "AE x in MI. (\<lambda>n. vI n x / n) \<longlonglongrightarrow> 0"
     using uI_0 H(2) by auto
   moreover have "AE x in MI. (\<lambda>n. vI n x / n) \<longlonglongrightarrow> I.subcocycle_lim vI x"
     by (rule I.kingman_theorem_nonergodic(1)[OF H(1) vI_fin])
   ultimately have vI_0: "AE x in MI. I.subcocycle_lim vI x = 0"
     using LIMSEQ_unique by auto
 
   interpret GKK: Gouezel_Karlsson_Kingman MI TI vI
     apply standard
     using H(1) vI_fin vI_0 by auto
   obtain delta where delta: "\<And>l. delta l > 0" "delta \<longlonglongrightarrow> 0"
       "emeasure MI {x \<in> space MI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < vI n x - vI (n - l) ((TI ^^ l) x)} \<ge> 1 - d } \<ge> 1 - d"
     using GKK.upper_density_good_direction_invertible[OF \<open>I.invertible_qmpt\<close> \<open>d>0\<close> \<open>d\<le>1\<close>] by blast
 
   text \<open>Then, we need to go back to the original system, showing that the estimates for $TI$ carry
         over. First, we go to $TJ$.\<close>
 
   have BJ: "emeasure MJ {x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d } \<ge> 1 - d"
   proof -
     have *: "AE x in MI. uJ n (projI x) = vI n x" for n
       using uI_proj H(2) by auto
     have **: "AE x in MI. \<forall>n. uJ n (projI x) = vI n x"
       by (subst AE_all_countable, auto intro: *)
     have "AE x in MI. \<forall>m n. uJ n (projI ((TI^^m) x)) = vI n ((TI^^m) x)"
       by (rule I.T_AE_iterates[OF **])
     then have "AE x in MI. (\<forall>m n. uJ n (projI ((TI^^m) x)) = vI n ((TI^^m) x)) \<and> (\<forall>n. projI ((TI^^n) x) = (TJ^^n) (projI x))"
       using I.qmpt_factor_iterates[OF I.mpt_factor_is_qmpt_factor[OF \<open>I.mpt_factor projI MJ TJ\<close>]] by auto
     then obtain ZI where ZI: "\<And>x. x \<in> space MI - ZI \<Longrightarrow> (\<forall>m n. uJ n (projI ((TI^^m) x)) = vI n ((TI^^m) x)) \<and> (\<forall>n. projI ((TI^^n) x) = (TJ^^n) (projI x))"
                              "ZI \<in> null_sets MI"
       using AE_E3 by blast
 
     have *: "uJ n (projI x) - uJ (n - l) ((TJ ^^ l) (projI x)) = vI n x - vI (n - l) ((TI ^^ l) x)" if "x \<in> space MI - ZI" for x n l
     proof -
       have "(TI^^0) x = x" "(TJ^^0) (projI x) = (projI x)" by auto
       then show ?thesis using ZI(1)[OF that] by metis
     qed
     have "projI-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space MI - ZI
           = {x \<in> space MI - ZI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n (projI x) - uJ (n - l) ((TJ ^^ l) (projI x))} \<ge> 1 - d}"
       by (auto simp add: measurable_space[OF \<open>projI \<in> measurable MI MJ\<close>])
     also have "... = {x \<in> space MI - ZI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < vI n x - vI (n - l) ((TI ^^ l) x)} \<ge> 1 - d}"
       using * by auto
     also have "... = {x \<in> space MI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < vI n x - vI (n - l) ((TI ^^ l) x)} \<ge> 1 - d} - ZI"
       by auto
     finally have *: "projI-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space MI - ZI
       = {x \<in> space MI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < vI n x - vI (n - l) ((TI ^^ l) x)} \<ge> 1 - d} - ZI"
       by simp
 
     have "emeasure MJ {x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d}
           = emeasure MI (projI-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space MI)"
       by (rule measure_preservingE(2)[symmetric], auto)
     also have "... = emeasure MI ((projI-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space MI) - ZI)"
       by (rule emeasure_Diff_null_set[OF \<open>ZI \<in> null_sets MI\<close>, symmetric], measurable)
     also have "... = emeasure MI ({x \<in> space MI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < vI n x - vI (n - l) ((TI ^^ l) x)} \<ge> 1 - d} - ZI)"
       using * by simp
     also have "... = emeasure MI {x \<in> space MI. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < vI n x - vI (n - l) ((TI ^^ l) x)} \<ge> 1 - d}"
       by (rule emeasure_Diff_null_set[OF \<open>ZI \<in> null_sets MI\<close>], measurable)
     also have "... \<ge> 1-d"
       using delta(3) by simp
     finally show ?thesis by simp
   qed
 
   text \<open>Then, we go back to $T$ with virtually the same argument.\<close>
 
   have "emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < u n x - u (n - l) ((T ^^ l) x)} \<ge> 1 - d } \<ge> 1 - d"
   proof -
       obtain Z where Z: "\<And>x. x \<in> space M - Z \<Longrightarrow> (\<forall>n. projJ ((T^^n) x) = (TJ^^n) (projJ x))"
                         "Z \<in> null_sets M"
       using AE_E3[OF qmpt_factor_iterates[OF mpt_factor_is_qmpt_factor[OF \<open>mpt_factor projJ MJ TJ\<close>]]] by blast
 
     have *: "uJ n (projJ x) - uJ (n - l) ((TJ ^^ l) (projJ x)) = u n x - u (n - l) ((T^^ l) x)" if "x \<in> space M - Z" for x n l
     proof -
       have "(T^^0) x = x" "(TJ^^0) (projJ x) = (projJ x)" by auto
       then show ?thesis using Z(1)[OF that] uJ_proj by metis
     qed
     have "projJ-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space M - Z
           = {x \<in> space M - Z. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n (projJ x) - uJ (n - l) ((TJ ^^ l) (projJ x))} \<ge> 1 - d}"
       by (auto simp add: measurable_space[OF \<open>projJ \<in> measurable M MJ\<close>])
     also have "... = {x \<in> space M - Z. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < u n x - u (n - l) ((T ^^ l) x)} \<ge> 1 - d}"
       using * by auto
     also have "... = {x \<in> space M. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < u n x - u (n - l) ((T ^^ l) x)} \<ge> 1 - d} - Z"
       by auto
     finally have *: "projJ-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space M - Z
       = {x \<in> space M. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < u n x - u (n - l) ((T ^^ l) x)} \<ge> 1 - d} - Z"
       by simp
 
     have "emeasure MJ {x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d}
         = emeasure M (projJ-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space M)"
       by (rule measure_preservingE(2)[symmetric], auto)
     also have "... = emeasure M ((projJ-`{x \<in> space MJ. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < uJ n x - uJ (n - l) ((TJ ^^ l) x)} \<ge> 1 - d} \<inter> space M) - Z)"
       by (rule emeasure_Diff_null_set[OF \<open>Z \<in> null_sets M\<close>, symmetric], measurable)
     also have "... = emeasure M ({x \<in> space M. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < u n x - u (n - l) ((T ^^ l) x)} \<ge> 1 - d} - Z)"
       using * by simp
     also have "... = emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l\<in>{1..n}. - delta l * real l < u n x - u (n - l) ((T ^^ l) x)} \<ge> 1 - d}"
       by (rule emeasure_Diff_null_set[OF \<open>Z \<in> null_sets M\<close>], measurable)
     finally show ?thesis using BJ by simp
   qed
   then show ?thesis using delta(1) delta(2) by auto
 qed
 
 text \<open>From the quantitative lemma above, we deduce the qualitative statement we are after,
 still in the setting of the locale.\<close>
 
 lemma infinite_AE:
   shows "AE x in M. \<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l})"
 proof -
   have "\<exists>deltaf::real \<Rightarrow> nat \<Rightarrow> real. \<forall>d. ((d > 0 \<and> d \<le> 1) \<longrightarrow> ((\<forall>l. deltaf d l > 0) \<and> (deltaf d \<longlonglongrightarrow> 0) \<and>
         emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - (deltaf d l) * l} \<ge> 1-d} \<ge> ennreal(1-d)))"
     apply (subst choice_iff'[symmetric]) using upper_density_good_direction by auto
   then obtain deltaf::"real \<Rightarrow> nat \<Rightarrow> real" where H: "\<And>d. d > 0 \<and> d \<le>1 \<Longrightarrow> (\<forall>l. deltaf d l > 0) \<and> (deltaf d \<longlonglongrightarrow> 0) \<and>
       emeasure M {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - (deltaf d l) * l} \<ge> 1-d} \<ge> ennreal(1-d)"
     by blast
 
   define U where "U = (\<lambda>d. {x \<in> space M. upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - (deltaf d l) * l} \<ge> 1-d})"
   have [measurable]: "U d \<in> sets M" for d
     unfolding U_def by auto
   have *: "emeasure M (U d) \<ge> 1 - d" if "d>0 \<and> d\<le> 1" for d
     unfolding U_def using H that by auto
   define V where "V = (\<Union>n::nat. U (1/(n+2)))"
   have [measurable]: "V \<in> sets M"
     unfolding V_def by auto
   have a: "emeasure M V \<ge> 1 - 1 / (n + 2)" for n::nat
   proof -
     have "1 - 1 / (n + 2) = 1 - 1 / (real n + 2)"
       by auto
     also have "... \<le> emeasure M (U (1/(real n+2)))"
       using *[of "1 / (real n + 2)"] by auto
     also have "... \<le> emeasure M V"
       apply (rule Measure_Space.emeasure_mono) unfolding V_def by auto
     finally show ?thesis by simp
   qed
   have b: "(\<lambda>n::nat. 1 - 1 / (n + 2)) \<longlonglongrightarrow> ennreal(1 - 0)"
     by (intro tendsto_intros LIMSEQ_ignore_initial_segment)
   have "emeasure M V \<ge> 1 - 0"
     apply (rule Lim_bounded) using a b by auto
   then have "emeasure M V = 1"
     by (simp add: emeasure_ge_1_iff)
   then have "AE x in M. x \<in> V"
     by (simp add: emeasure_eq_measure prob_eq_1)
   moreover
   {
     fix x assume "x \<in> V"
     then obtain n::nat where "x \<in> U (1/(real n+2))" unfolding V_def by blast
     define d where "d = 1/(real n + 2)"
     have "0 < d" "d\<le>1" unfolding d_def by auto
     have "0 < 1-d" unfolding d_def by auto
     also have "... \<le> upper_asymptotic_density {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - (deltaf d l) * l}"
       using \<open>x \<in> U (1/(real n+2))\<close> unfolding U_def d_def by auto
     finally have "infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - (deltaf d l) * l}"
       using upper_asymptotic_density_finite by force
     then have "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) > - delta l * l})"
       using H \<open>0 < d\<close> \<open>d\<le>1\<close> by auto
   }
   ultimately show ?thesis by auto
 qed
 
 end
 
 text \<open>Finally, we obtain the full statement, by reducing to the previous situation where the
 asymptotic average vanishes.\<close>
 
 theorem (in pmpt) Gouezel_Karlsson_Kingman:
   assumes "subcocycle u" "subcocycle_avg_ereal u > -\<infinity>"
   shows "AE x in M. \<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > - delta l * l})"
 proof -
   have [measurable]: "integrable M (u n)" "u n \<in> borel_measurable M" for n
     using subcocycle_integrable[OF assms(1)] by auto
 
   define v where "v = birkhoff_sum (\<lambda>x. -subcocycle_lim u x)"
   have int [measurable]: "integrable M (\<lambda>x. -subcocycle_lim u x)"
     using kingman_theorem_nonergodic(2)[OF assms] by auto
   have "subcocycle v" unfolding v_def
     apply (rule subcocycle_birkhoff)
     using assms \<open>integrable M (\<lambda>x. -subcocycle_lim u x)\<close> unfolding subcocycle_def by auto
   have "subcocycle_avg_ereal v > - \<infinity>"
     unfolding v_def using subcocycle_avg_ereal_birkhoff[OF int] kingman_theorem_nonergodic(2)[OF assms] by auto
   have "AE x in M. subcocycle_lim v x = real_cond_exp M Invariants (\<lambda>x. -subcocycle_lim u x) x"
     unfolding v_def by (rule subcocycle_lim_birkhoff[OF int])
   moreover have "AE x in M. real_cond_exp M Invariants (\<lambda>x. - subcocycle_lim u x) x = - subcocycle_lim u x"
     by (rule real_cond_exp_F_meas[OF int], auto)
   ultimately have AEv: "AE x in M. subcocycle_lim v x = - subcocycle_lim u x"
     by auto
 
   define w where "w = (\<lambda>n x. u n x + v n x)"
   have a: "subcocycle w"
     unfolding w_def by (rule subcocycle_add[OF assms(1) \<open>subcocycle v\<close>])
   have b: "subcocycle_avg_ereal w > -\<infinity>"
     unfolding w_def by (rule subcocycle_avg_add(1)[OF assms(1) \<open>subcocycle v\<close> assms(2) \<open>subcocycle_avg_ereal v > - \<infinity>\<close>])
   have "AE x in M. subcocycle_lim w x = subcocycle_lim u x + subcocycle_lim v x"
     unfolding w_def by (rule subcocycle_lim_add[OF assms(1) \<open>subcocycle v\<close> assms(2) \<open>subcocycle_avg_ereal v > - \<infinity>\<close>])
   then have c: "AE x in M. subcocycle_lim w x = 0"
     using AEv by auto
 
   interpret Gouezel_Karlsson_Kingman M T w
     apply standard using a b c by auto
   have "AE x in M. \<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. w n x - w (n-l) ((T^^l) x) > - delta l * l})"
     using infinite_AE by auto
   moreover
   {
     fix x assume H: "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. w n x - w (n-l) ((T^^l) x) > - delta l * l})"
             "x \<in> space M"
     have *: "v n x = - n * subcocycle_lim u x" for n
       unfolding v_def using birkhoff_sum_of_invariants[OF _ \<open>x \<in> space M\<close>] by auto
     have **: "v n ((T^^l) x) = - n * subcocycle_lim u x" for n l
     proof -
       have "v n ((T^^l) x) = - n * subcocycle_lim u ((T^^l) x)"
         unfolding v_def using birkhoff_sum_of_invariants[OF _ T_spaceM_stable(2)[OF \<open>x \<in> space M\<close>]] by auto
       also have "... = - n * subcocycle_lim u x"
         using Invariants_func_is_invariant_n[OF subcocycle_lim_meas_Inv(2) \<open>x \<in> space M\<close>] by auto
       finally show ?thesis by simp
     qed
     have "w n x - w (n-l) ((T^^l) x) = u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x" if "l \<in> {1..n}" for n l
       unfolding w_def using *[of n] **[of "n-l" l] that apply (auto simp add: algebra_simps)
       by (metis comm_semiring_class.distrib diff_add_inverse nat_le_iff_add of_nat_add)
     then have "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > - delta l * l})"
       using H(1) by auto
   }
   ultimately show ?thesis by auto
 qed
 
 text \<open>The previous theorem only contains a lower bound. The corresponding upper bound follows
 readily from Kingman's theorem. The next statement combines both upper and lower bounds.\<close>
 
 theorem (in pmpt) Gouezel_Karlsson_Kingman':
   assumes "subcocycle u" "subcocycle_avg_ereal u > -\<infinity>"
   shows "AE x in M. \<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. abs(u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x) < delta l * l})"
 proof -
   {
     fix x assume x: "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > - delta l * l})"
                     "(\<lambda>l. u l x/l) \<longlonglongrightarrow> subcocycle_lim u x"
     then obtain alpha::"nat \<Rightarrow> real" where a: "\<And>l. alpha l > 0" "alpha \<longlonglongrightarrow> 0"
         "infinite {n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > - alpha l * l}"
       by auto
     define delta::"nat \<Rightarrow> real" where "delta = (\<lambda>l. alpha l + norm(u l x / l - subcocycle_lim u x))"
     {
       fix n assume *: "\<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > - alpha l * l"
       have H: "x > -a \<Longrightarrow> x < a \<Longrightarrow> abs x < a" for a x::real by simp
       have "abs(u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x) < delta l * l" if "l\<in>{1..n}" for l
       proof (rule H)
         have "u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x \<le> u l x - l * subcocycle_lim u x"
           using assms(1) subcocycle_ineq[OF assms(1), of l "n-l" x] that by auto
         also have "... \<le> l * norm(u l x/l - subcocycle_lim u x)"
           using that by (auto simp add: algebra_simps divide_simps)
         also have "... < delta l * l"
           unfolding delta_def using a(1)[of l] that by auto
         finally show "u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x < delta l * l" by simp
 
         have "- (delta l * l) \<le> -alpha l * l"
           unfolding delta_def by (auto simp add: algebra_simps)
         also have "... < u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x"
           using * that by auto
         finally show "u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > -(delta l * l)"
           by simp
       qed
       then have "\<forall>l \<in> {1..n}. abs(u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x) < delta l * l"
         by auto
     }
     then have "{n. \<forall>l \<in> {1..n}. u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x > - alpha l * l}
           \<subseteq> {n. \<forall>l \<in> {1..n}. abs(u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x) < delta l * l}"
       by auto
     then have "infinite {n. \<forall>l \<in> {1..n}. abs(u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x) < delta l * l}"
       using a(3) finite_subset by blast
     moreover have "delta \<longlonglongrightarrow> 0 + 0"
       unfolding delta_def using x(2) by (intro tendsto_intros a(2) tendsto_norm_zero LIM_zero)
     moreover have "delta l > 0" for l unfolding delta_def using a(1)[of l] by auto
     ultimately have "\<exists>delta::nat\<Rightarrow>real. (\<forall>l. delta l > 0) \<and> (delta \<longlonglongrightarrow> 0) \<and>
           (infinite {n. \<forall>l \<in> {1..n}. abs(u n x - u (n-l) ((T^^l) x) - l * subcocycle_lim u x) < delta l * l})"
       by auto
   }
   then show ?thesis
     using Gouezel_Karlsson_Kingman[OF assms] kingman_theorem_nonergodic(1)[OF assms] by auto
 qed
 
 end (*of Gouezel_Karlsson.thy*)
diff --git a/thys/Ergodic_Theory/Invariants.thy b/thys/Ergodic_Theory/Invariants.thy
--- a/thys/Ergodic_Theory/Invariants.thy
+++ b/thys/Ergodic_Theory/Invariants.thy
@@ -1,1796 +1,1796 @@
 (*  Author:  Sébastien Gouëzel   sebastien.gouezel@univ-rennes1.fr
     License: BSD
 *)
 
 section \<open>The invariant sigma-algebra, Birkhoff theorem\<close>
 
 theory Invariants
   imports Recurrence "HOL-Probability.Conditional_Expectation"
 begin
 
 subsection \<open>The sigma-algebra of invariant subsets\<close>
 
 text \<open>The invariant sigma-algebra of a qmpt is made of those sets that are invariant under the
 dynamics. When the transformation is ergodic, it is made of sets of zero or full measure. In
 general, the Birkhoff theorem is expressed in terms of the conditional expectation of an integrable
 function with respect to the invariant sigma-algebra.\<close>
 
 context qmpt begin
 
 text \<open>We define the invariant sigma-algebra, as the sigma algebra of sets which are invariant
 under the dynamics, i.e., they coincide with their preimage under $T$.\<close>
 
 definition Invariants where "Invariants = sigma (space M) {A \<in> sets M. T-`A \<inter> space M = A}"
 
 text \<open>For this definition to make sense, we need to check that it really defines a sigma-algebra:
 otherwise, the \verb+sigma+ operation would make garbage out of it. This is the content of the next
 lemma.\<close>
 
 lemma Invariants_sets: "sets Invariants = {A \<in> sets M. T-`A \<inter> space M = A}"
 proof -
   have "sigma_algebra (space M) {A \<in> sets M. T-`A \<inter> space M = A}"
   proof -
     define I where "I = {A. T-`A \<inter> space M = A}"
     have i: "\<And>A. A \<in> I \<Longrightarrow> A \<subseteq> space M" unfolding I_def by auto
     have "algebra (space M) I"
     proof (subst algebra_iff_Un)
       have a: "I \<subseteq> Pow (space M)" using i by auto
       have b: "{} \<in> I" unfolding I_def by auto
       {
         fix A assume *: "A \<in> I"
         then have "T-`(space M - A) = T-`(space M) - T-`A" by auto
         then have "T-`(space M - A) \<inter> space M = T-`(space M) \<inter> (space M) - T-`A \<inter> (space M)" by auto
         also have "... = space M - A" using * I_def by (simp add: inf_absorb2 subsetI)
         finally have "space M - A \<in> I" unfolding I_def by simp
       }
       then have c: "(\<forall>a\<in>I. space M - a \<in> I)" by simp
       have d: "(\<forall>a\<in>I. \<forall>b\<in>I. a \<union> b \<in> I)" unfolding I_def by auto
       show "I \<subseteq> Pow (space M) \<and> {} \<in> I \<and> (\<forall>a\<in>I. space M - a \<in> I) \<and> (\<forall>a\<in>I. \<forall>b\<in>I. a \<union> b \<in> I)"
         using a b c d by blast
     qed
     moreover have "(\<forall>F. range F \<subseteq> I \<longrightarrow> (\<Union>i::nat. F i) \<in> I)" unfolding I_def by auto
     ultimately have "sigma_algebra (space M) I" using sigma_algebra_iff by auto
     moreover have "sigma_algebra (space M) (sets M)" using measure_space measure_space_def by auto
     ultimately have "sigma_algebra (space M) (I \<inter> (sets M))" using sigma_algebra_intersection by auto
     moreover have "I \<inter> sets M = {A \<in> sets M. T-`A \<inter> space M = A}" unfolding I_def by auto
     ultimately show ?thesis by simp
   qed
   then show ?thesis unfolding Invariants_def using sigma_algebra.sets_measure_of_eq by blast
 qed
 
 text \<open>By definition, the invariant subalgebra is a subalgebra of the original algebra. This is
 expressed in the following lemmas.\<close>
 
 lemma Invariants_is_subalg: "subalgebra M Invariants"
   unfolding subalgebra_def
   using Invariants_sets Invariants_def by (simp add: space_measure_of_conv)
 
 lemma Invariants_in_sets:
   assumes "A \<in> sets Invariants"
   shows "A \<in> sets M"
 using Invariants_sets assms by blast
 
 lemma Invariants_measurable_func:
   assumes "f \<in> measurable Invariants N"
   shows "f \<in> measurable M N"
 using Invariants_is_subalg measurable_from_subalg assms by auto
 
 text \<open>We give several trivial characterizations of invariant sets or functions.\<close>
 
 lemma Invariants_vrestr:
   assumes "A \<in> sets Invariants"
   shows "T--`A = A"
 using assms Invariants_sets Invariants_in_sets[OF assms] by auto
 
 lemma Invariants_points:
   assumes "A \<in> sets Invariants" "x \<in> A"
   shows "T x \<in> A"
 using assms Invariants_sets by auto
 
 lemma Invariants_func_is_invariant:
   fixes f::"_ \<Rightarrow> 'b::t2_space"
   assumes "f \<in> borel_measurable Invariants" "x \<in> space M"
   shows "f (T x) = f x"
 proof -
   have "{f x} \<in> sets borel" by simp
   then have "f-`({f x}) \<inter> space M \<in> Invariants" using assms(1)
     by (metis (no_types, lifting) Invariants_def measurable_sets space_measure_of_conv)
   moreover have "x \<in> f-`({f x}) \<inter> space M" using assms(2) by blast
   ultimately have "T x \<in> f-`({f x}) \<inter> space M" by (rule Invariants_points)
   then show ?thesis by simp
 qed
 
 lemma Invariants_func_is_invariant_n:
   fixes f::"_ \<Rightarrow> 'b::t2_space"
   assumes "f \<in> borel_measurable Invariants" "x \<in> space M"
   shows "f ((T^^n) x) = f x"
 by (induction n, auto simp add: assms Invariants_func_is_invariant)
 
 lemma Invariants_func_charac:
   assumes [measurable]: "f \<in> measurable M N"
       and "\<And>x. x \<in> space M \<Longrightarrow> f(T x) = f x"
   shows "f \<in> measurable Invariants N"
 proof (rule measurableI)
   fix A assume "A \<in> sets N"
   have "space Invariants = space M" using Invariants_is_subalg subalgebra_def by force
   show "f -` A \<inter> space Invariants \<in> sets Invariants"
     apply (subst Invariants_sets)
     apply (auto simp add: assms \<open>A \<in> sets N\<close> \<open>space Invariants = space M\<close>)
     using \<open>A \<in> sets N\<close> assms(1) measurable_sets by blast
 next
   fix x assume "x \<in> space Invariants"
   have "space Invariants = space M" using Invariants_is_subalg subalgebra_def by force
   then show "f x \<in> space N" using assms(1) \<open>x \<in> space Invariants\<close> by (metis measurable_space)
 qed
 
 lemma birkhoff_sum_of_invariants:
   fixes f::" _ \<Rightarrow> real"
   assumes "f \<in> borel_measurable Invariants" "x \<in> space M"
   shows "birkhoff_sum f n x = n * f x"
 unfolding birkhoff_sum_def using Invariants_func_is_invariant_n[OF assms] by auto
 
 text \<open>There are two possible definitions of the invariant sigma-algebra, competing in the
 literature: one could also use the sets such that $T^{-1}A$ coincides with $A$ up to
 a measure $0$ set. It turns out that this is equivalent to being invariant (in our sense) up
 to a measure $0$ set. Therefore, for all interesting purposes, the two definitions would
 give the same results.
 
 For the proof, we start from an almost invariant set, and build a genuinely invariant set that
 coincides with it by adding or throwing away null parts.
 \<close>
 
 proposition Invariants_quasi_Invariants_sets:
   assumes [measurable]: "A \<in> sets M"
   shows "(\<exists>B \<in> sets Invariants. A \<Delta> B \<in> null_sets M) \<longleftrightarrow> (T--`A \<Delta> A \<in> null_sets M)"
 proof
   assume "\<exists>B \<in> sets Invariants. A \<Delta> B \<in> null_sets M"
   then obtain B where "B \<in> sets Invariants" "A \<Delta> B \<in> null_sets M" by auto
   then have [measurable]: "B \<in> sets M" using Invariants_in_sets by simp
 
   have "B = T--` B" using Invariants_vrestr \<open>B \<in> sets Invariants\<close> by simp
   then have "T--`A \<Delta> B = T--`(A \<Delta> B)" by simp
   moreover have "T--`(A \<Delta> B) \<in> null_sets M"
     by (rule T_quasi_preserves_null2(1)[OF \<open>A \<Delta> B \<in> null_sets M\<close>])
   ultimately have "T--`A \<Delta> B \<in> null_sets M" by simp
   then show "T--`A \<Delta> A \<in> null_sets M"
     by (rule null_sym_diff_transitive) (auto simp add: \<open>A \<Delta> B \<in> null_sets M\<close> Un_commute)
 next
   assume H: "T --` A \<Delta> A \<in> null_sets M"
   have [measurable]: "\<And>n. (T^^n)--`A \<in> sets M" by simp
   {
     fix K assume [measurable]: "K \<in> sets M" and "T--`K \<Delta> K \<in> null_sets M"
     fix n::nat
     have "(T^^n)--`K \<Delta> K \<in> null_sets M"
     proof (induction n)
       case 0
       have "(T^^0)--` K = K" using T_vrestr_0 by simp
       then show ?case using Diff_cancel sup.idem by (metis null_sets.empty_sets)
     next
       case (Suc n)
       have "T--`((T^^n)--`K \<Delta> K) \<in> null_sets M"
         using Suc.IH T_quasi_preserves_null(1)[of "((T^^n)--`K \<Delta> K)"] by simp
       then have *: "(T^^(Suc n))--`K \<Delta> T--`K \<in> null_sets M" using T_vrestr_composed(2)[OF \<open>K \<in> sets M\<close>] by simp
       then show ?case
         by (rule null_sym_diff_transitive, simp add: \<open>T--`K \<Delta> K \<in> null_sets M\<close> \<open>K \<in> sets M\<close>, measurable)
     qed
   } note * = this
 
   define C where "C = (\<Inter>n. (T^^n)--`A)"
   have [measurable]: "C \<in> sets M" unfolding C_def by simp
   have "C \<Delta> A \<subseteq> (\<Union>n. (T^^n)--`A \<Delta> A)" unfolding C_def by auto
   moreover have "(\<Union>n. (T^^n)--`A \<Delta> A) \<in> null_sets M"
     using * null_sets_UN assms \<open>T --` A \<Delta> A \<in> null_sets M\<close> by auto
   ultimately have CA: "C \<Delta> A \<in> null_sets M" by (meson \<open>C \<in> sets M\<close> assms sets.Diff sets.Un null_sets_subset)
   then have "T--`(C \<Delta> A) \<in> null_sets M" by (rule T_quasi_preserves_null2(1))
   then have "T--`C \<Delta> T--`A \<in> null_sets M" by simp
   then have "T--`C \<Delta> A \<in> null_sets M"
     by (rule null_sym_diff_transitive, auto simp add: H)
   then have TCC: "T--`C \<Delta> C \<in> null_sets M"
     apply (rule null_sym_diff_transitive) using CA by (auto simp add: Un_commute)
 
   have "C \<subseteq> (\<Inter>n\<in>{1..}. (T^^n)--`A)" unfolding C_def by auto
   moreover have "T--`C = (\<Inter>n\<in>{1..}. (T^^n)--`A)"
     using T_vrestr_composed(2)[OF assms] by (simp add: C_def atLeast_Suc_greaterThan greaterThan_0)
   ultimately have "C \<subseteq> T--`C" by blast
   then have "(T^^0)--`C \<subseteq> (T^^1)--`C" using T_vrestr_0 by auto
   moreover have "(T^^1)--`C \<subseteq> (\<Union>n\<in>{1..}. (T^^n)--`C)" by auto
   ultimately have "(T^^0)--`C \<subseteq> (\<Union>n\<in>{1..}. (T^^n)--`C)" by auto
   then have "(T^^0)--`C \<union> (\<Union>n\<in>{1..}. (T^^n)--`C) = (\<Union>n\<in>{1..}. (T^^n)--`C)" by auto
   moreover have "(\<Union>n. (T^^n)--`C) = (T^^0)--`C \<union> (\<Union>n\<in>{1..}. (T^^n)--`C)" by (rule union_insert_0)
   ultimately have C2: "(\<Union>n. (T^^n)--`C) = (\<Union>n\<in>{1..}. (T^^n)--`C)" by simp
 
   define B where "B = (\<Union>n. (T^^n)--`C)"
   have [measurable]: "B \<in> sets M" unfolding B_def by simp
   have "B \<Delta> C \<subseteq> (\<Union>n. (T^^n)--`C \<Delta> C)" unfolding B_def by auto
   moreover have "(\<Union>n. (T^^n)--`C \<Delta> C) \<in> null_sets M"
     using * null_sets_UN assms TCC by auto
   ultimately have "B \<Delta> C \<in> null_sets M" by (meson \<open>B \<in> sets M\<close> \<open>C \<in> sets M\<close> assms sets.Diff sets.Un null_sets_subset)
   then have "B \<Delta> A \<in> null_sets M"
     by (rule null_sym_diff_transitive, auto simp add: CA)
   then have a: "A \<Delta> B \<in> null_sets M" by (simp add: Un_commute)
 
   have "T--`B = (\<Union>n\<in>{1..}. (T^^n)--`C)"
     using T_vrestr_composed(2)[OF \<open>C \<in> sets M\<close>] by (simp add: B_def atLeast_Suc_greaterThan greaterThan_0)
   then have "T--`B = B" unfolding B_def using C2 by simp
   then have "B \<in> sets Invariants" using Invariants_sets vimage_restr_def by auto
 
   then show "\<exists>B \<in> sets Invariants. A \<Delta> B \<in> null_sets M" using a by blast
 qed
 
 text \<open>In a conservative setting, it is enough to be included in its image or its preimage to be
 almost invariant: otherwise, since the difference set has disjoint preimages, and is therefore
 null by conservativity.\<close>
 
 lemma (in conservative) preimage_included_then_almost_invariant:
   assumes [measurable]: "A \<in> sets M" and "T--`A \<subseteq> A"
   shows "A \<Delta> (T--`A) \<in> null_sets M"
 proof -
   define B where "B = A - T--`A"
   then have [measurable]: "B \<in> sets M" by simp
   have "(T^^(Suc n))--`A \<subseteq> (T^^n)--`A" for n using T_vrestr_composed(3)[OF assms(1)] vrestr_inclusion[OF assms(2)] by auto
   then have "disjoint_family (\<lambda>n. (T^^n)--`A - (T^^(Suc n))--`A)" by (rule disjoint_family_Suc2[where ?A = "\<lambda>n. (T^^n)--`A"])
   moreover have "(T^^n)--`A - (T^^(Suc n))--`A = (T^^n)--`B" for n unfolding B_def Suc_eq_plus1 using T_vrestr_composed(3)[OF assms(1)] by auto
   ultimately have "disjoint_family (\<lambda>n. (T^^n)--` B)" by simp
   then have "\<And>n. n \<noteq> 0 \<Longrightarrow> ((T^^n)--`B) \<inter> B = {}" unfolding disjoint_family_on_def by (metis UNIV_I T_vrestr_0(1)[OF \<open>B \<in> sets M\<close>])
   then have "\<And>n. n > 0 \<Longrightarrow> (T^^n)-`B \<inter> B = {}" unfolding vimage_restr_def by (simp add: Int_assoc)
   then have "B \<in> null_sets M" using disjoint_then_null[OF \<open>B \<in> sets M\<close>] Int_commute by auto
   then show ?thesis unfolding B_def using assms(2) by (simp add: Diff_mono Un_absorb2)
 qed
 
 lemma (in conservative) preimage_includes_then_almost_invariant:
   assumes [measurable]: "A \<in> sets M" and "A \<subseteq> T--`A"
   shows "A \<Delta> (T--`A) \<in> null_sets M"
 proof -
   define B where "B = T--`A - A"
   then have [measurable]: "B \<in> sets M" by simp
   have "\<And>n. (T^^(Suc n))--`A \<supseteq> (T^^n)--`A" using T_vrestr_composed(3)[OF assms(1)] vrestr_inclusion[OF assms(2)] by auto
   then have "disjoint_family (\<lambda>n. (T^^(Suc n))--`A - (T^^n)--`A)" by (rule disjoint_family_Suc[where ?A = "\<lambda>n. (T^^n)--`A"])
   moreover have "\<And>n. (T^^(Suc n))--`A - (T^^n)--`A = (T^^n)--`B" unfolding B_def Suc_eq_plus1 using T_vrestr_composed(3)[OF assms(1)] by auto
   ultimately have "disjoint_family (\<lambda>n. (T^^n)--` B)" by simp
   then have "\<And>n. n \<noteq> 0 \<Longrightarrow> ((T^^n)--`B) \<inter> B = {}" unfolding disjoint_family_on_def by (metis UNIV_I T_vrestr_0(1)[OF \<open>B \<in> sets M\<close>])
   then have "\<And>n. n > 0 \<Longrightarrow> (T^^n)-`B \<inter> B = {}" unfolding vimage_restr_def by (simp add: Int_assoc)
   then have "B \<in> null_sets M" using disjoint_then_null[OF \<open>B \<in> sets M\<close>] Int_commute by auto
   then show ?thesis unfolding B_def using assms(2) by (simp add: Diff_mono Un_absorb1)
 qed
 
 text \<open>The above properties for sets are also true for functions: if $f$ and $f \circ T$
 coincide almost everywhere, i.e., $f$ is almost invariant, then $f$ coincides almost everywhere
 with a true invariant function.
 
 The idea of the proof is straightforward: throw away the orbits on
 which $f$ is not really invariant (say this is the complement of the good set),
 and replace it by $0$ there. However, this does not work
 directly: the good set is not invariant, some points may have a non-constant value of $f$ on their
 orbit but reach the good set eventually. One can however define $g$ to be equal to the
 eventual value of $f$ along the orbit, if the orbit reaches the good set, and $0$ elsewhere.\<close>
 
 proposition Invariants_quasi_Invariants_functions:
   fixes f::"_ \<Rightarrow> 'b::{second_countable_topology, t2_space}"
   assumes f_meas [measurable]: "f \<in> borel_measurable M"
   shows "(\<exists>g \<in> borel_measurable Invariants. AE x in M. f x = g x) \<longleftrightarrow> (AE x in M. f(T x) = f x)"
 proof
   assume "\<exists>g\<in>borel_measurable Invariants. AE x in M. f x = g x"
   then obtain g where g:"g\<in>borel_measurable Invariants" "AE x in M. f x = g x" by blast
   then have [measurable]: "g \<in> borel_measurable M" using Invariants_measurable_func by auto
   define A where "A = {x \<in> space M. f x = g x}"
   have [measurable]: "A \<in> sets M" unfolding A_def by simp
   define B where "B = space M - A"
   have [measurable]: "B \<in> sets M" unfolding B_def by simp
   moreover have "AE x in M. x \<notin> B" unfolding B_def A_def using g(2) by auto
   ultimately have "B \<in> null_sets M" using AE_iff_null_sets by blast
   then have "T--`B \<in> null_sets M" by (rule T_quasi_preserves_null2(1))
   then have "B \<union> T--`B \<in> null_sets M" using \<open>B \<in> null_sets M\<close> by auto
   then have "AE x in M. x \<notin> (B \<union> T--`B)" using AE_iff_null_sets null_setsD2 by blast
   then have i: "AE x in M. x \<in> space M - (B \<union> T--`B)" by auto
   {
     fix x assume *: "x \<in> space M - (B \<union> T--`B)"
     then have "x \<in> A" unfolding B_def by blast
     then have "f x = g x" unfolding A_def by blast
     have "T x \<in> A" using * B_def by auto
     then have "f(T x) = g(T x)" unfolding A_def by blast
     moreover have "g(T x) = g x"
       apply (rule Invariants_func_is_invariant) using * by (auto simp add: assms \<open>g\<in>borel_measurable Invariants\<close>)
     ultimately have "f(T x) = f x" using \<open>f x = g x\<close> by simp
   }
   then show "AE x in M. f(T x) = f x" using i by auto
 next
   assume *: "AE x in M. f (T x) = f x"
   text \<open>\verb+good_set+ is the set of points for which $f$ is constant on their orbit. Here, we define
   $g = f$. If a point ever enters \verb+good_set+, then we take $g$ to be the value of $f$ there. Otherwise,
   $g$ takes an arbitrary value, say $y_0$.\<close>
   define good_set where "good_set = {x \<in> space M. \<forall>n. f((T^^(Suc n)) x) = f((T^^n) x)}"
   define good_time where "good_time = (\<lambda>x. Inf {n. (T^^n) x \<in> good_set})"
   have "AE x in M. x \<in> good_set" using T_AE_iterates[OF *] by (simp add: good_set_def)
   have [measurable]: "good_set \<in> sets M" unfolding good_set_def by auto
   obtain y0::'b where True by auto
   define g where "g = (\<lambda>x. if (\<exists>n. (T^^n) x \<in> good_set) then f((T^^(good_time x)) x) else y0)"
   have [measurable]: "good_time \<in> measurable M (count_space UNIV)" unfolding good_time_def by measurable
   have [measurable]: "g \<in> borel_measurable M" unfolding g_def by measurable
 
   have "f x = g x" if "x \<in> good_set" for x
   proof -
     have a: "0 \<in> {n. (T^^n) x \<in> good_set}" using that by simp
     have "good_time x = 0"
       unfolding good_time_def apply (intro cInf_eq_non_empty) using a by blast+
     moreover have "{n. (T^^n) x \<in> good_set} \<noteq> {}" using a by blast
     ultimately show "f x = g x" unfolding g_def by auto
   qed
   then have "AE x in M. f x = g x" using \<open>AE x in M. x \<in> good_set\<close> by auto
 
   have *: "f((T^^(Suc 0)) x) = f((T^^0) x)" if "x \<in> good_set" for x
     using that unfolding good_set_def by blast
   have good_1: "T x \<in> good_set \<and> f(T x) = f x" if "x \<in> good_set" for x
     using *[OF that] that unfolding good_set_def apply (auto)
     unfolding T_Tn_T_compose by blast
   then have good_k: "\<And>x. x \<in> good_set \<Longrightarrow> (T^^k) x \<in> good_set \<and> f((T^^k) x) = f x" for k
       by (induction k, auto)
 
   have "g(T x) = g x" if "x \<in> space M" for x
   proof (cases)
     assume *: "\<exists>n. (T^^n) (T x) \<in> good_set"
     define n where "n = Inf {n. (T^^n) (T x) \<in> good_set}"
     have "(T^^n)(T x) \<in> good_set" using * Inf_nat_def1 by (metis empty_iff mem_Collect_eq n_def)
     then have a: "(T^^(n+1)) x \<in> good_set" by (metis Suc_eq_plus1 comp_eq_dest_lhs funpow.simps(2) funpow_swap1)
     then have **: "\<exists>m. (T^^m) x \<in> good_set" by blast
     define m where "m = Inf {m. (T^^m) x \<in> good_set}"
     then have "(T^^m) x \<in> good_set" using ** Inf_nat_def1 by (metis empty_iff mem_Collect_eq)
     have "n+1 \<in> {m. (T^^m) x \<in> good_set}" using a by simp
     then have "m \<le> n+1" using m_def by (simp add: Inf_nat_def Least_le)
     then obtain k where "n+1 = m + k" using le_iff_add by blast
     have "g x = f((T^^m) x)" unfolding g_def good_time_def using ** m_def by simp
     also have "... = f((T^^k) ((T^^m) x))" using \<open>(T^^m) x \<in> good_set\<close> good_k by simp
     also have "... = f((T^^(n+1))x)" using \<open>n+1 = m + k\<close>[symmetric] funpow_add by (metis add.commute comp_apply)
     also have "... = f((T^^n) (T x))" using funpow_Suc_right by (metis Suc_eq_plus1 comp_apply)
     also have "... = g(T x)" unfolding g_def good_time_def using * n_def by simp
     finally show "g(T x) = g x" by simp
   next
     assume *: "\<not>(\<exists>n. (T^^n) (T x) \<in> good_set)"
     then have "g(T x) = y0" unfolding g_def by simp
     have **: "\<not>(\<exists>n. (T^^(Suc n)) x \<in> good_set)" using funpow_Suc_right * by (metis comp_apply)
     have "T x \<notin> good_set" using good_k * by blast
     then have "x \<notin> good_set" using good_1 by auto
     then have "\<not>(\<exists>n. (T^^n) x \<in> good_set)" using ** using good_1 by fastforce
     then have "g x = y0" unfolding g_def by simp
     then show "g(T x) = g x" using \<open>g(T x) = y0\<close> by simp
   qed
   then have "g \<in> borel_measurable Invariants" by (rule Invariants_func_charac[OF \<open>g \<in> borel_measurable M\<close>])
   then show "\<exists>g\<in>borel_measurable Invariants. AE x in M. f x = g x" using \<open>AE x in M. f x = g x\<close> by blast
 qed
 
 text \<open>In a conservative setting, it suffices to have an almost everywhere inequality to get
 an almost everywhere equality, as the set where there is strict inequality has $0$ measure
 as its iterates are disjoint, by conservativity.\<close>
 
 proposition (in conservative) AE_decreasing_then_invariant:
   fixes f::"_ \<Rightarrow> 'b::{linorder_topology, second_countable_topology}"
   assumes "AE x in M. f(T x) \<le> f x"
     and [measurable]: "f \<in> borel_measurable M"
   shows "AE x in M. f(T x) = f x"
 proof -
   obtain D::"'b set" where D: "countable D" "(\<forall>x y. x < y \<longrightarrow> (\<exists>d \<in> D. x \<le> d \<and> d < y))"
     using countable_separating_set_linorder2 by blast
 
   define A where "A = {x \<in> space M. f(T x) \<le> f x}"
   then have [measurable]: "A \<in> sets M" by simp
   define B where "B = {x \<in> space M. \<forall>n. f((T^^(n+1)) x) \<le> f((T^^n)x)}"
   then have [measurable]: "B \<in> sets M" by simp
 
   have "space M - A \<in> null_sets M" unfolding A_def using assms by (simp add: assms(1) AE_iff_null_sets)
   then have "(\<Union>n. (T^^n)--`(space M - A)) \<in> null_sets M" by (metis null_sets_UN T_quasi_preserves_null2(2))
   moreover have "space M - B = (\<Union>n. (T^^n)--`(space M - A))"
     unfolding B_def A_def by auto
   ultimately have "space M - B \<in> null_sets M" by simp
 
   have *: "B = (\<Inter>n. (T^^n)--`A)"
     unfolding B_def A_def by auto
   then have "T--`B = (\<Inter>n. T--` (T^^n)--`A)" by auto
   also have "... = (\<Inter>n. (T^^(n+1))--`A)" using T_vrestr_composed(2)[OF \<open>A \<in> sets M\<close>] by simp
   also have "... \<supseteq> (\<Inter>n. (T^^n)--`A)" by blast
   finally have B1: "B \<subseteq> T--`B" using * by simp
   have "B \<subseteq> A" using * T_vrestr_0[OF \<open>A \<in> sets M\<close>] by blast
   then have B2: "\<And>x. x \<in> B \<Longrightarrow> f(T x) \<le> f x" unfolding A_def by auto
 
   define C where "C = (\<lambda>t. {x \<in> B. f x \<le> t})"
   {
     fix t
     have "C t = B \<inter> f-`{..t} \<inter> space M" unfolding C_def using sets.sets_into_space[OF \<open>B \<in> sets M\<close>] by auto
     then have [measurable]: "C t \<in> sets M" using assms(2) by simp
     have "C t \<subseteq> T--`(C t)" using B1 unfolding C_def vimage_restr_def apply auto using B2 order_trans by blast
     then have "T--`(C t) - C t \<in> null_sets M" by (metis Diff_mono Un_absorb1 preimage_includes_then_almost_invariant[OF \<open>C t \<in> sets M\<close>])
   }
   then have "(\<Union>d\<in>D. T--`(C d) - C d) \<in> null_sets M" using \<open>countable D\<close> by (simp add: null_sets_UN')
   then have "(space M - B) \<union> (\<Union>d\<in>D. T--`(C d) - C d) \<in> null_sets M" using \<open>space M - B \<in> null_sets M\<close> by auto
   then have "AE x in M. x \<notin> (space M - B) \<union> (\<Union>d\<in>D. T--`(C d) - C d)" using AE_not_in by blast
   moreover
   {
     fix x assume x: "x \<in> space M" "x \<notin> (space M - B) \<union> (\<Union>d\<in>D. T--`(C d) - C d)"
     then have "x \<in> B" by simp
     then have "T x \<in> B" using B1 by auto
     have "f(T x) = f x"
     proof (rule ccontr)
       assume "f(T x) \<noteq> f x"
       then have "f(T x) < f x" using B2[OF \<open>x \<in> B\<close>] by simp
       then obtain d where d: "d \<in> D" "f(T x) \<le> d \<and> d < f x" using D by auto
       then have "T x \<in> C d" using \<open>T x \<in> B\<close> unfolding C_def by simp
       then have "x \<in> T--`(C d)" using \<open>x \<in> space M\<close> by simp
       then have "x \<in> C d" using x \<open>d \<in> D\<close> by simp
       then have "f x \<le> d" unfolding C_def by simp
       then show False using d by auto
     qed
   }
   ultimately show ?thesis by auto
 qed
 
 proposition (in conservative) AE_increasing_then_invariant:
   fixes f::"_ \<Rightarrow> 'b::{linorder_topology, second_countable_topology}"
   assumes "AE x in M. f(T x) \<ge> f x"
     and [measurable]: "f \<in> borel_measurable M"
   shows "AE x in M. f(T x) = f x"
 proof -
   obtain D::"'b set" where D: "countable D" "(\<forall>x y. x < y \<longrightarrow> (\<exists>d \<in> D. x < d \<and> d \<le> y))"
     using countable_separating_set_linorder1 by blast
 
   define A where "A = {x \<in> space M. f(T x) \<ge> f x}"
   then have [measurable]: "A \<in> sets M" by simp
   define B where "B = {x \<in> space M. \<forall>n. f((T^^(n+1)) x) \<ge> f((T^^n)x)}"
   then have [measurable]: "B \<in> sets M" by simp
 
   have "space M - A \<in> null_sets M" unfolding A_def using assms by (simp add: assms(1) AE_iff_null_sets)
   then have "(\<Union>n. (T^^n)--`(space M - A)) \<in> null_sets M" by (metis null_sets_UN T_quasi_preserves_null2(2))
   moreover have "space M - B = (\<Union>n. (T^^n)--`(space M - A))"
     unfolding B_def A_def by auto
   ultimately have "space M - B \<in> null_sets M" by simp
 
   have *: "B = (\<Inter>n. (T^^n)--`A)"
     unfolding B_def A_def by auto
   then have "T--`B = (\<Inter>n. T--` (T^^n)--`A)" by auto
   also have "... = (\<Inter>n. (T^^(n+1))--`A)" using T_vrestr_composed(2)[OF \<open>A \<in> sets M\<close>] by simp
   also have "... \<supseteq> (\<Inter>n. (T^^n)--`A)" by blast
   finally have B1: "B \<subseteq> T--`B" using * by simp
   have "B \<subseteq> A" using * T_vrestr_0[OF \<open>A \<in> sets M\<close>] by blast
   then have B2: "\<And>x. x \<in> B \<Longrightarrow> f(T x) \<ge> f x" unfolding A_def by auto
 
   define C where "C = (\<lambda>t. {x \<in> B. f x \<ge> t})"
   {
     fix t
     have "C t = B \<inter> f-`{t..} \<inter> space M" unfolding C_def using sets.sets_into_space[OF \<open>B \<in> sets M\<close>] by auto
     then have [measurable]: "C t \<in> sets M" using assms(2) by simp
     have "C t \<subseteq> T--`(C t)" using B1 unfolding C_def vimage_restr_def apply auto using B2 order_trans by blast
     then have "T--`(C t) - C t \<in> null_sets M" by (metis Diff_mono Un_absorb1 preimage_includes_then_almost_invariant[OF \<open>C t \<in> sets M\<close>])
   }
   then have "(\<Union>d\<in>D. T--`(C d) - C d) \<in> null_sets M" using \<open>countable D\<close> by (simp add: null_sets_UN')
   then have "(space M - B) \<union> (\<Union>d\<in>D. T--`(C d) - C d) \<in> null_sets M" using \<open>space M - B \<in> null_sets M\<close> by auto
   then have "AE x in M. x \<notin> (space M - B) \<union> (\<Union>d\<in>D. T--`(C d) - C d)" using AE_not_in by blast
   moreover
   {
     fix x assume x: "x \<in> space M" "x \<notin> (space M - B) \<union> (\<Union>d\<in>D. T--`(C d) - C d)"
     then have "x \<in> B" by simp
     then have "T x \<in> B" using B1 by auto
     have "f(T x) = f x"
     proof (rule ccontr)
       assume "f(T x) \<noteq> f x"
       then have "f(T x) > f x" using B2[OF \<open>x \<in> B\<close>] by simp
       then obtain d where d: "d \<in> D" "f(T x) \<ge> d \<and> d > f x" using D by auto
       then have "T x \<in> C d" using \<open>T x \<in> B\<close> unfolding C_def by simp
       then have "x \<in> T--`(C d)" using \<open>x \<in> space M\<close> by simp
       then have "x \<in> C d" using x \<open>d \<in> D\<close> by simp
       then have "f x \<ge> d" unfolding C_def by simp
       then show False using d by auto
     qed
   }
   ultimately show ?thesis by auto
 qed
 
 text \<open>For an invertible map, the invariants of $T$ and $T^{-1}$ are the same.\<close>
 
 lemma Invariants_Tinv:
   assumes "invertible_qmpt"
   shows "qmpt.Invariants M Tinv = Invariants"
 proof -
   interpret I: qmpt M Tinv using Tinv_qmpt[OF assms] by auto
   have "(T -` A \<inter> space M = A) \<longleftrightarrow> (Tinv -` A \<inter> space M = A)" if "A \<in> sets M" for A
   proof
     assume "T -` A \<inter> space M = A"
     then show "Tinv -` A \<inter> space M = A"
       using assms that unfolding Tinv_def invertible_qmpt_def
       apply auto
       apply (metis IntE UNIV_I bij_def imageE inv_f_f vimageE)
       apply (metis I.T_spaceM_stable(1) Int_iff Tinv_def bij_inv_eq_iff vimageI)
       done
   next
     assume "Tinv -` A \<inter> space M = A"
     then show "T -` A \<inter> space M = A"
       using assms that unfolding Tinv_def invertible_qmpt_def
       apply auto
       apply (metis IntE bij_def inv_f_f vimageE)
       apply (metis T_Tinv_of_set T_meas Tinv_def assms qmpt.vrestr_of_set qmpt_axioms vrestr_image(3))
       done
   qed
   then have "{A \<in> sets M. Tinv -` A \<inter> space M = A} = {A \<in> sets M. T -` A \<inter> space M = A}"
     by blast
   then show ?thesis unfolding Invariants_def I.Invariants_def by auto
 qed
 
 end
 
 sublocale fmpt \<subseteq> finite_measure_subalgebra M Invariants
   unfolding finite_measure_subalgebra_def finite_measure_subalgebra_axioms_def
   using Invariants_is_subalg by (simp add: finite_measureI)
 
 context fmpt
 begin
 
 text \<open>The conditional expectation with respect to the invariant sigma-algebra is the same
 for $f$ or $f \circ T$, essentially by definition.\<close>
 
 lemma Invariants_of_foTn:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   shows "AE x in M. real_cond_exp M Invariants (f o (T^^n)) x = real_cond_exp M Invariants f x"
 proof (rule real_cond_exp_charact)
   fix A assume [measurable]: "A \<in> sets Invariants"
   then have [measurable]: "A \<in> sets M" using Invariants_in_sets by blast
   then have ind_meas [measurable]: "((indicator A)::('a \<Rightarrow> real)) \<in> borel_measurable Invariants" by auto
 
   have "set_lebesgue_integral M A (f \<circ> (T^^n)) = (\<integral>x. indicator A x * f((T^^n) x) \<partial>M)"
     by (auto simp: comp_def set_lebesgue_integral_def)
   also have "... = (\<integral>x. indicator A ((T^^n) x) * f ((T^^n) x) \<partial>M)"
     by (rule Bochner_Integration.integral_cong, auto simp add: Invariants_func_is_invariant_n[OF ind_meas])
   also have "... = (\<integral>x. indicator A x * f x \<partial>M)"
     apply (rule Tn_integral_preserving(2)) using integrable_mult_indicator[OF \<open>A \<in> sets M\<close> assms] by auto
   also have "... = (\<integral>x. indicator A x * real_cond_exp M Invariants f x \<partial>M)"
     apply (rule real_cond_exp_intg(2)[symmetric]) using integrable_mult_indicator[OF \<open>A \<in> sets M\<close> assms] by auto
   also have "... = set_lebesgue_integral M A (real_cond_exp M Invariants f)"
     by (auto simp: set_lebesgue_integral_def)
   finally show "set_lebesgue_integral M A (f \<circ> (T^^n)) = set_lebesgue_integral M A (real_cond_exp M Invariants f)"
     by simp
 qed (auto simp add: assms real_cond_exp_int Tn_integral_preserving(1)[OF assms] comp_def)
 
 lemma Invariants_of_foT:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   shows "AE x in M. real_cond_exp M Invariants f x = real_cond_exp M Invariants (f o T) x"
 using Invariants_of_foTn[OF assms, where ?n = 1] by auto
 
 lemma birkhoff_sum_Invariants:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   shows "AE x in M. real_cond_exp M Invariants (birkhoff_sum f n) x = n * real_cond_exp M Invariants f x"
 proof -
   define F where "F = (\<lambda>i. f o (T^^i))"
   have [measurable]: "\<And>i. F i \<in> borel_measurable M" unfolding F_def by auto
   have *: "integrable M (F i)" for i unfolding F_def
     by (subst comp_def, rule Tn_integral_preserving(1)[OF assms, of i])
 
   have "AE x in M. n * real_cond_exp M Invariants f x = (\<Sum>i\<in>{..<n}. real_cond_exp M Invariants f x)" by auto
   moreover have "AE x in M. (\<Sum>i\<in>{..<n}. real_cond_exp M Invariants f x) = (\<Sum>i\<in>{..<n}. real_cond_exp M Invariants (F i) x)"
     apply (rule AE_symmetric[OF AE_equal_sum]) unfolding F_def using Invariants_of_foTn[OF assms] by simp
   moreover have "AE x in M. (\<Sum>i\<in>{..<n}. real_cond_exp M Invariants (F i) x) = real_cond_exp M Invariants (\<lambda>x. \<Sum>i\<in>{..<n}. F i x) x"
     by (rule AE_symmetric[OF real_cond_exp_sum [OF *]])
   moreover have "AE x in M. real_cond_exp M Invariants (\<lambda>x. \<Sum>i\<in>{..<n}. F i x) x = real_cond_exp M Invariants (birkhoff_sum f n) x"
     apply (rule real_cond_exp_cong) unfolding F_def using birkhoff_sum_def[symmetric] by auto
   ultimately show ?thesis by auto
 qed
 
 end (* of context fmpt *)
 
 subsection \<open>Birkhoff theorem\<close>
 
 subsubsection \<open>Almost everywhere version of Birkhoff theorem\<close>
 
 text \<open>This paragraph is devoted to the proof of Birkhoff theorem, arguably
 the most fundamental result of ergodic theory.
 This theorem asserts that Birkhoff averages of an integrable function $f$ converge almost surely,
 to the conditional expectation of $f$ with respect to the invariant sigma algebra.
 
 This result implies for instance the strong law of large numbers (in probability theory).
 
 There are numerous proofs of this statement, but none is really easy. We follow the very efficient
 argument given in Katok-Hasselblatt. To help the reader, here is the same proof informally. The
 first part of the proof is formalized in \verb+birkhoff_lemma1+, the second one in
 \verb+birkhoff_lemma+, and the conclusion in \verb+birkhoff_theorem+.
 
 Start with an integrable function $g$. let $G_n(x) = \max_{k\leq n} S_k g(x)$. Then $\limsup S_n g/n
 \leq 0$ outside of $A$, the set where $G_n$ tends to infinity. Moreover, $G_{n+1} - G_n \circ T$ is
 bounded by $g$, and tends to $g$ on $A$. It follows from the dominated convergence theorem that
 $\int_A G_{n+1} - G_n \circ T \to \int_A g$. As $\int_A G_{n+1} - G_n \circ T = \int_A G_{n+1} - G_n
 \geq 0$, we obtain $\int_A g \geq 0$.
 
 Apply now this result to the function $g = f - E(f | I) - \epsilon$, where $\epsilon>0$ is fixed.
 Then $\int_A g = -\epsilon \mu(A)$, then have $\mu(A) = 0$. Thus, almost surely, $\limsup S_n
 g/n\leq 0$, i.e., $\limsup S_n f/n \leq E(f|I)+\epsilon$. Letting $\epsilon$ tend to $0$ gives
 $\limsup S_n f/n \leq E(f|I)$.
 
 Applying the same result to $-f$ gives $S_n f/n \to E(f|I)$.
 \<close>
 
 context fmpt
 begin
 
 lemma birkhoff_aux1:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   defines "A \<equiv> {x \<in> space M. limsup (\<lambda>n. ereal(birkhoff_sum f n x)) = \<infinity>}"
     shows "A \<in> sets Invariants" "(\<integral>x. f x * indicator A x \<partial>M) \<ge> 0"
 proof -
   let ?bsf = "birkhoff_sum f"
   have [measurable]: "A \<in> sets M" unfolding A_def by simp
   have Ainv: "x \<in> A \<longleftrightarrow> T x \<in> A" if "x \<in> space M" for x
   proof -
     have "ereal(?bsf (1 + n) x) = ereal(f x) + ereal(?bsf n (T x))" for n
       unfolding birkhoff_sum_cocycle birkhoff_sum_1 by simp
     moreover have "limsup (\<lambda>n. ereal(f x) + ereal(?bsf n (T x)))
                     = ereal(f x) + limsup(\<lambda>n. ereal(?bsf n (T x)))"
       by (rule ereal_limsup_lim_add, auto)
     moreover have "limsup (\<lambda>n. ereal(?bsf (n+1) x)) = limsup (\<lambda>n. ereal(?bsf n x))" using limsup_shift by simp
     ultimately have "limsup (\<lambda>n. ereal(birkhoff_sum f n x)) = ereal(f x) + limsup (\<lambda>n. ereal(?bsf n (T x)))" by simp
     then have "limsup (\<lambda>n. ereal(?bsf n x)) = \<infinity> \<longleftrightarrow> limsup (\<lambda>n. ereal(?bsf n (T x))) = \<infinity>" by simp
     then show "x \<in> A \<longleftrightarrow> T x \<in> A" using \<open>x \<in> space M\<close> A_def by simp
   qed
   then show "A \<in> sets Invariants" using assms(2) Invariants_sets by auto
 
   define F where "F = (\<lambda>n x. MAX k \<in>{0..n}. ?bsf k x)"
   have [measurable]: "\<And>n. F n \<in> borel_measurable M" unfolding F_def by measurable
   have intFn: "integrable M (F n)" for n
     unfolding F_def by (rule integrable_MAX, auto simp add: birkhoff_sum_integral(1)[OF assms(1)])
 
   have Frec: "F (n+1) x - F n (T x) = max (-F n (T x)) (f x)" for n x
   proof -
     have "{0..n+1} = {0} \<union> {1..n+1}" by auto
     then have "(\<lambda>k. ?bsf k x) ` {0..n+1} = (\<lambda>k. ?bsf k x) ` {0} \<union> (\<lambda>k. ?bsf k x) ` {1..n+1}" by blast
     then have *: "(\<lambda>k. ?bsf k x) ` {0..n+1} = {0} \<union> (\<lambda>k. ?bsf k x) ` {1..n+1}" using birkhoff_sum_1(1) by simp
     have b: "F (n+1) x = max (Max {0}) (MAX k \<in>{1..n+1}. ?bsf k x)"
       by (subst F_def, subst *, rule Max.union, auto)
 
     have "(\<lambda>k. ?bsf k x) ` {1..n+1} = (\<lambda>k. ?bsf (1+k) x) ` {0..n}" using Suc_le_D by fastforce
     also have "... = (\<lambda>k. f x + ?bsf k (T x)) ` {0..n}"
       by (subst birkhoff_sum_cocycle, subst birkhoff_sum_1(2), auto)
     finally have c: "F (n+1) x = max 0 (MAX k \<in>{0..n}. ?bsf k (T x) + f x)" using b by (simp add: add_ac)
 
     have "{f x + birkhoff_sum f k (T x) |k. k \<in>{0..n}} = (+) (f x) ` {birkhoff_sum f k (T x) |k. k \<in>{0..n}}" by blast
     have "(MAX k \<in>{0..n}. ?bsf k (T x) + f x) = (MAX k \<in>{0..n}. ?bsf k (T x)) + f x"
       by (rule Max_add_commute) auto
     also have "... = F n (T x) + f x" unfolding F_def by simp
     finally have "(MAX k \<in>{0..n}. ?bsf k (T x) + f x) = f x + F n (T x)" by simp
     then have "F (n+1) x = max 0 (f x + F n (T x))" using c by simp
     then show "F (n+1) x - F n (T x) = max (-F n (T x)) (f x)" by auto
   qed
 
   have a: "abs((F (n+1) x - F n (T x)) * indicator A x) \<le> abs(f x)" for n x
   proof -
     have "F (n+1) x -F n (T x) \<ge> f x" using Frec by simp
     then have *: "F (n+1) x -F n (T x) \<ge> - abs(f x)" by simp
 
     have "F n (T x) \<ge> birkhoff_sum f 0 (T x)"
       unfolding F_def apply (rule Max_ge, simp) using atLeastAtMost_iff by blast
     then have "F n (T x) \<ge> 0" using birkhoff_sum_1(1) by simp
     then have "-F n (T x) \<le> abs (f x)" by simp
     moreover have "f x \<le> abs(f x)" by simp
     ultimately have "F (n+1) x -F n (T x) \<le> abs(f x)" using Frec by simp
     then have "abs(F (n+1) x - F n (T x)) \<le> abs(f x)" using * by simp
     then show "abs((F (n+1) x - F n (T x)) * indicator A x) \<le> abs(f x)" unfolding indicator_def by auto
   qed
   have b: "(\<lambda>n. (F (n+1) x - F n (T x)) * indicator A x) \<longlonglongrightarrow> f x * indicator A x" for x
   proof (rule tendsto_eventually, cases)
     assume "x \<in> A"
     then have "T x \<in> A" using Ainv A_def by auto
     then have "limsup (\<lambda>n. ereal(birkhoff_sum f n (T x))) > ereal(-f x)" unfolding A_def by simp
     then obtain N where "ereal(?bsf N (T x)) > ereal(-f x)" using Limsup_obtain by blast
     then have *: "?bsf N (T x) > -f x" by simp
     {
       fix n assume "n\<ge>N"
       then have "?bsf N (T x) \<in> (\<lambda>k. ?bsf k (T x)) ` {0..n}" by auto
       then have "F n (T x) \<ge> ?bsf N (T x)" unfolding F_def by simp
       then have "F n (T x) \<ge> -f x" using * by simp
       then have "max (-F n (T x)) (f x) = f x" by simp
       then have "F (n+1) x - F n (T x) = f x" using Frec by simp
       then have "(F (n+1) x - F n (T x)) * indicator A x = f x * indicator A x" by simp
     }
     then show "eventually (\<lambda>n. (F (n+1) x - F n (T x)) * indicator A x = f x * indicator A x) sequentially"
       using eventually_sequentially by blast
   next
     assume "\<not>(x \<in> A)"
     then have "indicator A x = (0::real)" by simp
     then show "eventually (\<lambda>n. (F (n+1) x - F n (T x)) * indicator A x = f x * indicator A x) sequentially" by auto
   qed
   have lim: "(\<lambda>n. (\<integral>x. (F (n+1) x - F n (T x)) * indicator A x \<partial>M)) \<longlonglongrightarrow> (\<integral>x. f x * indicator A x \<partial>M)"
   proof (rule integral_dominated_convergence[where ?w = "(\<lambda>x. abs(f x))"])
     show "integrable M (\<lambda>x. \<bar>f x\<bar>)" using assms(1) by auto
     show "AE x in M. (\<lambda>n. (F (n + 1) x - F n (T x)) * indicator A x) \<longlonglongrightarrow> f x * indicator A x" using b by auto
     show "\<And>n. AE x in M. norm ((F (n + 1) x - F n (T x)) * indicator A x) \<le> \<bar>f x\<bar>" using a by auto
   qed (simp_all)
 
   have "(\<integral>x. (F (n+1) x - F n (T x)) * indicator A x \<partial>M) \<ge> 0" for n
   proof -
     have "(\<integral>x. F n (T x) * indicator A x \<partial>M) = (\<integral>x. (\<lambda>x. F n x * indicator A x) (T x) \<partial>M)"
       by (rule Bochner_Integration.integral_cong, auto simp add: Ainv indicator_def)
     also have "... = (\<integral>x. F n x * indicator A x \<partial>M)"
       by (rule T_integral_preserving, auto simp add: intFn integrable_real_mult_indicator)
     finally have i: "(\<integral>x. F n (T x) * indicator A x \<partial>M) = (\<integral>x. F n x * indicator A x \<partial>M)" by simp
 
     have "(\<integral>x. (F (n+1) x - F n (T x)) * indicator A x \<partial>M) = (\<integral>x. F (n+1) x * indicator A x - F n (T x) * indicator A x \<partial>M)"
       by (simp add: mult.commute right_diff_distrib)
     also have "... = (\<integral>x. F (n+1) x * indicator A x \<partial>M) - (\<integral>x. F n (T x) * indicator A x \<partial>M)"
       by (rule Bochner_Integration.integral_diff, auto simp add: intFn integrable_real_mult_indicator T_meas T_integral_preserving(1))
     also have "... = (\<integral>x. F (n+1) x * indicator A x \<partial>M) - (\<integral>x. F n x * indicator A x \<partial>M)"
       using i by simp
     also have "... = (\<integral>x. F (n+1) x * indicator A x - F n x * indicator A x \<partial>M)"
       by (rule Bochner_Integration.integral_diff[symmetric], auto simp add: intFn integrable_real_mult_indicator)
     also have "... = (\<integral>x. (F (n+1) x - F n x) * indicator A x \<partial>M)"
       by (simp add: mult.commute right_diff_distrib)
     finally have *: "(\<integral>x. (F (n+1) x - F n (T x)) * indicator A x \<partial>M) = (\<integral>x. (F (n+1) x - F n x) * indicator A x \<partial>M)"
       by simp
 
     have "F n x \<le> F (n+1) x" for x unfolding F_def by (rule Max_mono, auto)
     then have "(F (n+1) x - F n x) * indicator A x \<ge> 0" for x by simp
     then have "integral\<^sup>L M (\<lambda>x. 0) \<le> integral\<^sup>L M (\<lambda>x. (F (n+1) x - F n x) * indicator A x)"
       by (auto simp add: intFn integrable_real_mult_indicator intro: integral_mono)
     then have "(\<integral>x. (F (n+1) x - F n x) * indicator A x \<partial>M) \<ge> 0" by simp
     then show "(\<integral>x. (F (n+1) x - F n (T x)) * indicator A x \<partial>M) \<ge> 0" using * by simp
   qed
   then show "(\<integral>x. f x * indicator A x \<partial>M) \<ge> 0" using lim by (simp add: LIMSEQ_le_const)
 qed
 
 lemma birkhoff_aux2:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   shows "AE x in M. limsup (\<lambda>n. ereal(birkhoff_sum f n x / n)) \<le> real_cond_exp M Invariants f x"
 proof -
   {
     fix \<epsilon> assume "\<epsilon> > (0::real)"
     define g where "g = (\<lambda>x. f x - real_cond_exp M Invariants f x - \<epsilon>)"
     then have intg: "integrable M g" using assms real_cond_exp_int(1) assms by auto
     define A where "A = {x \<in> space M. limsup (\<lambda>n. ereal(birkhoff_sum g n x)) = \<infinity>}"
     have Ag: "A \<in> sets Invariants" "(\<integral>x. g x * indicator A x \<partial>M) \<ge> 0"
       unfolding A_def by (rule birkhoff_aux1[where ?f = g, OF intg])+
     then have [measurable]: "A \<in> sets M" by (simp add: Invariants_in_sets)
 
     have eq: "(\<integral>x. indicator A x * real_cond_exp M Invariants f x \<partial>M) = (\<integral>x. indicator A x * f x \<partial>M)"
     proof (rule real_cond_exp_intg[where ?f = "\<lambda>x. (indicator A x)::real" and ?g = f])
       have "(\<lambda>x. indicator A x * f x) = (\<lambda>x. f x * indicator A x)" by auto
       then show "integrable M (\<lambda>x. indicator A x * f x)"
         using integrable_real_mult_indicator[OF \<open>A \<in> sets M\<close> assms] by simp
       show "indicator A \<in> borel_measurable Invariants" using \<open>A \<in> sets Invariants\<close> by measurable
     qed (simp)
 
     have "0 \<le> (\<integral>x. g x * indicator A x \<partial>M)" using Ag by simp
     also have "... = (\<integral>x. f x * indicator A x - real_cond_exp M Invariants f x * indicator A x - \<epsilon> * indicator A x \<partial>M)"
       unfolding g_def by (simp add: left_diff_distrib)
     also have "... = (\<integral>x. f x * indicator A x \<partial>M) - (\<integral>x. real_cond_exp M Invariants f x * indicator A x \<partial>M) - (\<integral>x. \<epsilon> * indicator A x \<partial>M)"
       using assms real_cond_exp_int(1)[OF assms] integrable_real_mult_indicator[OF \<open>A \<in> sets M\<close>]
       by (auto simp: simp del: integrable_mult_left_iff)
     also have "... = - (\<integral>x. \<epsilon> * indicator A x \<partial>M)"
       by (auto simp add: eq mult.commute)
     also have "... = - \<epsilon> * measure M A" by auto
     finally have "0 \<le> - \<epsilon> * measure M A" by simp
     then have "measure M A = 0" using \<open>\<epsilon> > 0\<close> by (simp add: measure_le_0_iff mult_le_0_iff)
     then have "A \<in> null_sets M" by (simp add: emeasure_eq_measure null_setsI)
     then have "AE x in M. x \<in> space M - A" by (metis (no_types, lifting) AE_cong Diff_iff AE_not_in)
     moreover
     {
       fix x assume "x \<in> space M - A"
       then have "limsup (\<lambda>n. ereal(birkhoff_sum g n x)) < \<infinity>" unfolding A_def by auto
       then obtain C where C: "\<And>n. birkhoff_sum g n x \<le> C" using limsup_finite_then_bounded by presburger
       {
         fix n::nat assume "n > 0"
         have "birkhoff_sum g n x = birkhoff_sum f n x - birkhoff_sum (real_cond_exp M Invariants f) n x - birkhoff_sum (\<lambda>x. \<epsilon>) n x"
           unfolding g_def using birkhoff_sum_add birkhoff_sum_diff by auto
         moreover have "birkhoff_sum (real_cond_exp M Invariants f) n x = n * real_cond_exp M Invariants f x"
           using birkhoff_sum_of_invariants using \<open>x \<in> space M - A\<close> by auto
         moreover have "birkhoff_sum (\<lambda>x. \<epsilon>) n x = n * \<epsilon>" unfolding birkhoff_sum_def by auto
         ultimately have "birkhoff_sum g n x = birkhoff_sum f n x - n * real_cond_exp M Invariants f x - n * \<epsilon>"
           by simp
         then have "birkhoff_sum f n x = birkhoff_sum g n x + n * real_cond_exp M Invariants f x + n * \<epsilon>"
           by simp
         then have "birkhoff_sum f n x / n = birkhoff_sum g n x / n + real_cond_exp M Invariants f x + \<epsilon>"
           using \<open>n > 0\<close> by (simp add: field_simps)
         then have "birkhoff_sum f n x / n \<le> C/n + real_cond_exp M Invariants f x + \<epsilon>"
           using C[of n] \<open>n > 0\<close> by (simp add: divide_right_mono)
         then have "ereal(birkhoff_sum f n x / n) \<le> ereal(C/n + real_cond_exp M Invariants f x + \<epsilon>)"
           by simp
       }
       then have "eventually (\<lambda>n. ereal(birkhoff_sum f n x / n) \<le> ereal(C/n + real_cond_exp M Invariants f x + \<epsilon>)) sequentially"
         by (simp add: eventually_at_top_dense)
       then have b: "limsup (\<lambda>n. ereal(birkhoff_sum f n x / n)) \<le> limsup (\<lambda>n. ereal(C/n + real_cond_exp M Invariants f x + \<epsilon>))"
         by (simp add: Limsup_mono)
 
       have "(\<lambda>n. ereal(C*(1/real n) + real_cond_exp M Invariants f x + \<epsilon>)) \<longlonglongrightarrow> ereal(C * 0 + real_cond_exp M Invariants f x + \<epsilon>)"
         by (intro tendsto_intros)
       then have "limsup (\<lambda>n. ereal(C/real n + real_cond_exp M Invariants f x + \<epsilon>)) = real_cond_exp M Invariants f x + \<epsilon>"
         using sequentially_bot tendsto_iff_Liminf_eq_Limsup by force
       then have "limsup (\<lambda>n. ereal(birkhoff_sum f n x / n)) \<le> real_cond_exp M Invariants f x + \<epsilon>"
         using b by simp
     }
     ultimately have "AE x in M. limsup (\<lambda>n. ereal(birkhoff_sum f n x / n)) \<le> real_cond_exp M Invariants f x + \<epsilon>"
       by auto
     then have "AE x in M. limsup (\<lambda>n. ereal(birkhoff_sum f n x / n)) \<le> ereal(real_cond_exp M Invariants f x) + \<epsilon>"
       by auto
   }
   then show ?thesis
     by (rule AE_upper_bound_inf_ereal)
 qed
 
 theorem birkhoff_theorem_AE_nonergodic:
   fixes f::"'a \<Rightarrow> real"
   assumes "integrable M f"
   shows "AE x in M. (\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
 proof -
   {
     fix x assume i: "limsup (\<lambda>n. ereal(birkhoff_sum f n x /n)) \<le> real_cond_exp M Invariants f x"
              and ii: "limsup (\<lambda>n. ereal(birkhoff_sum (\<lambda>x. -f x) n x / n)) \<le> real_cond_exp M Invariants (\<lambda>x. -f x) x"
              and iii: "real_cond_exp M Invariants (\<lambda>x. -f x) x = - real_cond_exp M Invariants f x"
     have "\<And>n. birkhoff_sum (\<lambda>x. -f x) n x = - birkhoff_sum f n x"
       using birkhoff_sum_cmult[where ?c = "-1" and ?f = f] by auto
     then have "\<And>n. ereal(birkhoff_sum (\<lambda>x. -f x) n x / n) = - ereal(birkhoff_sum f n x / n)" by auto
     moreover have "limsup (\<lambda>n. - ereal(birkhoff_sum f n x / n)) = - liminf (\<lambda>n. ereal(birkhoff_sum f n x /n))"
       by (rule ereal_Limsup_uminus)
     ultimately have "-liminf (\<lambda>n. ereal(birkhoff_sum f n x /n)) = limsup (\<lambda>n. ereal(birkhoff_sum (\<lambda>x. -f x) n x / n))"
       by simp
     then have "-liminf (\<lambda>n. ereal(birkhoff_sum f n x /n)) \<le> - real_cond_exp M Invariants f x"
       using ii iii by simp
     then have "liminf (\<lambda>n. ereal(birkhoff_sum f n x /n)) \<ge> real_cond_exp M Invariants f x"
       by (simp add: ereal_uminus_le_reorder)
     then have "(\<lambda>n. birkhoff_sum f n x /n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
       using i by (simp add: limsup_le_liminf_real)
   } note * = this
   moreover have "AE x in M. limsup (\<lambda>n. ereal(birkhoff_sum f n x /n)) \<le> real_cond_exp M Invariants f x"
     using birkhoff_aux2 assms by simp
   moreover have "AE x in M. limsup (\<lambda>n. ereal(birkhoff_sum (\<lambda>x. -f x) n x / n)) \<le> real_cond_exp M Invariants (\<lambda>x. -f x) x"
     using birkhoff_aux2 assms by simp
   moreover have "AE x in M. real_cond_exp M Invariants (\<lambda>x. -f x) x = - real_cond_exp M Invariants f x"
     using real_cond_exp_cmult[where ?c = "-1"] assms by force
   ultimately show ?thesis by auto
 qed
 
 text \<open>If a function $f$ is integrable, then $E(f\circ T - f | I) = E(f\circ T | I) - E(f|I) = 0$.
 Hence, $S_n(f \circ T - f) / n$ converges almost everywhere to $0$, i.e., $f(T^n x)/n \to 0$.
 It is remarkable (and sometimes useful) that this holds under the weaker condition that
 $f\circ T - f$ is integrable (but not necessarily $f$), where this naive argument fails.
 
 The reason is that the Birkhoff sum of $f \circ T - f$ is $f\circ T^n - f$. If $n$ is such that $x$
 and $T^n(x)$ belong to a set where $f$ is bounded, it follows that this Birkhoff sum is also
 bounded. Along such a sequence of times, $S_n(f\circ T - f)/n$ tends to $0$.
 By Poincare recurrence theorem, there are such times for almost every points. As it also converges
 to $E(f \circ T - f | I)$, it follows that this function is almost everywhere $0$. Then
 $f (T^n x)/n = S_n(f\circ T^n - f)/n - f/n$ tends almost surely to $E(f\circ T-f |I) = 0$.
 \<close>
 
 lemma limit_foTn_over_n:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "f \<in> borel_measurable M"
       and "integrable M (\<lambda>x. f(T x) - f x)"
   shows "AE x in M. real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x = 0"
         "AE x in M. (\<lambda>n. f((T^^n) x) / n) \<longlonglongrightarrow> 0"
 proof -
   define E::"nat \<Rightarrow> 'a set" where "E k = {x \<in> space M. \<bar>f x\<bar> \<le> k}" for k
   have [measurable]: "E k \<in> sets M" for k unfolding E_def by auto
   have *: "(\<Union>k. E k) = space M" unfolding E_def by (auto simp add: real_arch_simple)
   define F::"nat \<Rightarrow> 'a set" where "F k = recurrent_subset_infty (E k)" for k
   have [measurable]: "F k \<in> sets M" for k unfolding F_def by auto
   have **: "E k - F k \<in> null_sets M" for k unfolding F_def using Poincare_recurrence_thm by auto
   have "space M - (\<Union>k. F k) \<in> null_sets M"
     apply (rule null_sets_subset[of "(\<Union>k. E k - F k)"]) unfolding *[symmetric] using ** by auto
   with AE_not_in[OF this] have "AE x in M. x \<in> (\<Union>k. F k)" by auto
   moreover have "AE x in M. (\<lambda>n. birkhoff_sum (\<lambda>x. f(T x) - f x) n x / n)
       \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x"
     by (rule birkhoff_theorem_AE_nonergodic[OF assms(2)])
   moreover have "real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x = 0 \<and> (\<lambda>n. f((T^^n) x) / n) \<longlonglongrightarrow> 0"
     if H: "(\<lambda>n. birkhoff_sum (\<lambda>x. f(T x) - f x) n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x"
           "x \<in> (\<Union>k. F k)" for x
   proof -
     have "f((T^^n) x) = birkhoff_sum (\<lambda>x. f(T x) - f x) n x + f x" for n
       unfolding birkhoff_sum_def by (induction n, auto)
     then have "f((T^^n) x) / n = birkhoff_sum (\<lambda>x. f(T x) - f x) n x / n + f x * (1/n)" for n
       by (auto simp add: divide_simps)
     moreover have "(\<lambda>n. birkhoff_sum (\<lambda>x. f(T x) - f x) n x / n + f x * (1/n)) \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x + f x * 0"
       by (intro tendsto_intros H(1))
     ultimately have lim: "(\<lambda>n. f((T^^n) x) / n) \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x"
       by auto
 
     obtain k where "x \<in> F k" using H(2) by auto
     then have "infinite {n. (T^^n) x \<in> E k}"
       unfolding F_def recurrent_subset_infty_inf_returns by auto
     with infinite_enumerate[OF this] obtain r :: "nat \<Rightarrow> nat"
       where r: "strict_mono r" "\<And>n. r n \<in> {n. (T^^n) x \<in> E k}"
       by auto
     have A: "(\<lambda>n. k * (1/r n)) \<longlonglongrightarrow> real k * 0"
       apply (intro tendsto_intros)
       using LIMSEQ_subseq_LIMSEQ[OF lim_1_over_n \<open>strict_mono r\<close>] unfolding comp_def by auto
     have B: "\<bar>f((T^^(r n)) x) / r n\<bar> \<le> k / (r n)" for n
       using r(2) unfolding E_def by (auto simp add: divide_simps)
     have "(\<lambda>n. f((T^^(r n)) x) / r n) \<longlonglongrightarrow> 0"
       apply (rule tendsto_rabs_zero_cancel, rule tendsto_sandwich[of "\<lambda>n. 0" _ _ "\<lambda>n. k * (1/r n)"])
       using A B by auto
     moreover have "(\<lambda>n. f((T^^(r n)) x) / r n) \<longlonglongrightarrow> real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x"
       using LIMSEQ_subseq_LIMSEQ[OF lim \<open>strict_mono r\<close>] unfolding comp_def by auto
     ultimately have *: "real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x = 0"
       using LIMSEQ_unique by auto
     then have "(\<lambda>n. f((T^^n) x) / n) \<longlonglongrightarrow> 0" using lim by auto
     then show ?thesis using * by auto
   qed
   ultimately show "AE x in M. real_cond_exp M Invariants (\<lambda>x. f(T x) - f x) x = 0"
                   "AE x in M. (\<lambda>n. f((T^^n) x) / n) \<longlonglongrightarrow> 0"
     by auto
 qed
 
 text \<open>We specialize the previous statement to the case where $f$ itself is integrable.\<close>
 
 lemma limit_foTn_over_n':
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   shows "AE x in M. (\<lambda>n. f((T^^n) x) / n) \<longlonglongrightarrow> 0"
 by (rule limit_foTn_over_n, simp, rule Bochner_Integration.integrable_diff)
    (auto intro: assms T_integral_preserving(1))
 
 text \<open>It is often useful to show that a function is cohomologous to a nicer function, i.e., to
 prove that a given $f$ can be written as $f = g + u - u \circ T$ where $g$ is nicer than $f$. We
 show below that any integrable function is cohomologous to a function which is arbitrarily close to
 $E(f|I)$. This is an improved version of Lemma 2.1 in [Benoist-Quint, Annals of maths, 2011]. Note
 that the function $g$ to which $f$ is cohomologous is very nice (and, in particular, integrable),
 but the transfer function is only measurable in this argument. The fact that the control on
 conditional expectation is nevertheless preserved throughout the argument follows from
 Lemma~\verb+limit_foTn_over_n+ above.\<close>
 
 text \<open>We start with the lemma (and the proof) of [BQ2011]. It shows that, if a function has a
 conditional expectation with respect to invariants which is positive, then it is cohomologous to a
 nonnegative function. The argument is the clever remark that $g = \max (0, \inf_n S_n f)$ and $u =
 \min (0, \inf_n S_n f)$ work (where these expressions are well defined as $S_n f$ tends to infinity
 thanks to our assumption).\<close>
 
 lemma cohomologous_approx_cond_exp_aux:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
       and "AE x in M. real_cond_exp M Invariants f x > 0"
     shows "\<exists>u g. u \<in> borel_measurable M \<and> (integrable M g) \<and> (AE x in M. g x \<ge> 0 \<and> g x \<le> max 0 (f x)) \<and> (\<forall>x. f x = g x + u x - u (T x))"
 proof -
   define h::"'a \<Rightarrow> real" where "h = (\<lambda>x. (INF n\<in>{1..}. birkhoff_sum f n x))"
   define u where "u = (\<lambda>x. min (h x) 0)"
   define g where "g = (\<lambda>x. f x - u x + u (T x))"
   have [measurable]: "h \<in> borel_measurable M" "u \<in> borel_measurable M" "g \<in> borel_measurable M"
     unfolding g_def h_def u_def by auto
   have "f x = g x + u x - u (T x)" for x unfolding g_def by auto
   {
     fix x assume H: "real_cond_exp M Invariants f x > 0"
                     "(\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
     have "eventually (\<lambda>n. ereal(birkhoff_sum f n x / n) * ereal n = ereal(birkhoff_sum f n x)) sequentially"
       unfolding eventually_sequentially by (rule exI[of _ 1], auto)
     moreover have "(\<lambda>n. ereal(birkhoff_sum f n x / n) * ereal n) \<longlonglongrightarrow> ereal(real_cond_exp M Invariants f x) * \<infinity>"
       apply (intro tendsto_intros) using H by auto
     ultimately have "(\<lambda>n. ereal(birkhoff_sum f n x)) \<longlonglongrightarrow> ereal(real_cond_exp M Invariants f x) * \<infinity>"
       by (blast intro: Lim_transform_eventually)
     then have "(\<lambda>n. ereal(birkhoff_sum f n x)) \<longlonglongrightarrow> \<infinity>"
       using H by auto
     then have B: "\<exists>C. \<forall>n. C \<le> birkhoff_sum f n x"
       by (intro liminf_finite_then_bounded_below, simp add: liminf_PInfty)
 
     have "h x \<le> f x"
       unfolding h_def apply (rule cInf_lower) using B by force+
 
     have "{birkhoff_sum f n (T x) |n. n \<in> {1..}} = {birkhoff_sum f (1+n) (x) - f x |n. n \<in> {1..}}"
       unfolding birkhoff_sum_cocycle by auto
     also have "... = {birkhoff_sum f n x - f x |n. n \<in> {2..}}"
       by (metis (no_types, hide_lams) Suc_1 Suc_eq_plus1_left Suc_le_D Suc_le_mono atLeast_iff)
     finally have *: "{birkhoff_sum f n (T x) |n. n \<in> {1..}} = (\<lambda>t. t - (f x))`{birkhoff_sum f n x |n. n \<in> {2..}}"
       by auto
 
     have "h(T x) = Inf {birkhoff_sum f n (T x) |n. n \<in> {1..}}"
       unfolding h_def by (metis Setcompr_eq_image)
     also have "... =  (\<Sqinter>t\<in>{birkhoff_sum f n x |n. n \<in> {2..}}. t - f x)"
       by (simp only: *)
     also have "... = (\<lambda>t. t - (f x)) (Inf {birkhoff_sum f n x |n. n \<in> {2..}})"
       using B by (auto intro!: monoI bijI mono_bij_cInf [symmetric])
     finally have I: "Inf {birkhoff_sum f n x |n. n \<in> {2..}} = f x + h (T x)" by auto
     have "max 0 (h x) + u x = h x"
       unfolding u_def by auto
     also have "... = Inf {birkhoff_sum f n x |n. n \<in> {1..}}"
       unfolding h_def by (metis Setcompr_eq_image)
     also have "... = Inf ({birkhoff_sum f n x |n. n \<in> {1}} \<union> {birkhoff_sum f n x |n. n \<in> {2..}})"
       by (auto intro!: arg_cong[of _ _ Inf], metis One_nat_def Suc_1 antisym birkhoff_sum_1(2) not_less_eq_eq, force)
     also have "Inf ({birkhoff_sum f n x |n. n \<in> {1}} \<union> {birkhoff_sum f n x |n. n \<in> {2..}})
       = min (Inf {birkhoff_sum f n x |n. n \<in> {1}}) (Inf {birkhoff_sum f n x |n. n \<in> {2..}})"
       unfolding inf_min[symmetric] apply (intro cInf_union_distrib) using B by auto
     also have "... = min (f x) (f x + h (T x))" using I by auto
     also have "... = f x + u (T x)" unfolding u_def by auto
     finally have "max 0 (h x) = f x + u (T x) - u x" by auto
     then have "g x = max 0 (h x)" unfolding g_def by auto
     then have "g x \<ge> 0 \<and> g x \<le> max 0 (f x)" using \<open>h x \<le> f x\<close> by auto
   }
   then have *: "AE x in M. g x \<ge> 0 \<and> g x \<le> max 0 (f x)"
     using assms(2) birkhoff_theorem_AE_nonergodic[OF assms(1)] by auto
   moreover have "integrable M g"
     apply (rule Bochner_Integration.integrable_bound[of _ f]) using * by (auto simp add: assms)
   ultimately have "u \<in> borel_measurable M \<and> integrable M g \<and> (AE x in M. 0 \<le> g x \<and> g x \<le> max 0 (f x)) \<and> (\<forall>x. f x = g x + u x - u (T x))"
     using \<open>\<And>x. f x = g x + u x - u (T x)\<close> \<open>u \<in> borel_measurable M\<close> by auto
   then show ?thesis by blast
 qed
 
 text \<open>To deduce the stronger version that $f$ is cohomologous to an arbitrarily good approximation
 of $E(f|I)$, we apply the previous lemma twice, to control successively the negative and the
 positive side. The sign control in the conclusion of the previous lemma implies that the second step
 does not spoil the first one.\<close>
 
 lemma cohomologous_approx_cond_exp:
   fixes f::"'a \<Rightarrow> real" and B::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f" "B \<in> borel_measurable M"
       and "AE x in M. B x > 0"
     shows "\<exists>g u. u \<in> borel_measurable M
               \<and> integrable M g
               \<and> (\<forall>x. f x = g x + u x - u (T x))
               \<and> (AE x in M. abs(g x - real_cond_exp M Invariants f x) \<le> B x)"
 proof -
   define C where "C = (\<lambda>x. min (B x) 1)"
   have [measurable]: "integrable M C"
     apply (rule Bochner_Integration.integrable_bound[of _ "\<lambda>_. (1::real)"], auto)
     unfolding C_def using assms(3) by auto
   have "C x \<le> B x" for x unfolding C_def by auto
   have "AE x in M. C x > 0" unfolding C_def using assms(3) by auto
   have AECI: "AE x in M. real_cond_exp M Invariants C x > 0"
     by (intro real_cond_exp_gr_c \<open>integrable M C\<close> \<open>AE x in M. C x > 0\<close>)
 
   define f1 where "f1 = (\<lambda>x. f x - real_cond_exp M Invariants f x)"
   have "integrable M f1"
     unfolding f1_def by (intro Bochner_Integration.integrable_diff \<open>integrable M f\<close> real_cond_exp_int(1))
   have "AE x in M. real_cond_exp M Invariants f1 x = real_cond_exp M Invariants f x - real_cond_exp M Invariants (real_cond_exp M Invariants f) x"
     unfolding f1_def apply (rule real_cond_exp_diff) by (intro Bochner_Integration.integrable_diff
                 \<open>integrable M f\<close> \<open>integrable M C\<close> real_cond_exp_int(1))+
   moreover have "AE x in M. real_cond_exp M Invariants (real_cond_exp M Invariants f) x = real_cond_exp M Invariants f x"
     by (intro real_cond_exp_nested_subalg subalg \<open>integrable M f\<close>, auto)
   ultimately have AEf1: "AE x in M. real_cond_exp M Invariants f1 x = 0" by auto
 
   have A [measurable]: "integrable M (\<lambda>x. f1 x + C x)"
     by (intro Bochner_Integration.integrable_add \<open>integrable M f1\<close> \<open>integrable M C\<close>)
   have "AE x in M. real_cond_exp M Invariants (\<lambda>x. f1 x + C x) x = real_cond_exp M Invariants f1 x + real_cond_exp M Invariants C x"
     by (intro real_cond_exp_add \<open>integrable M f1\<close> \<open>integrable M C\<close>)
   then have B: "AE x in M. real_cond_exp M Invariants (\<lambda>x. f1 x + C x) x > 0"
     using AECI AEf1 by auto
 
   obtain u2 g2 where H2: "u2 \<in> borel_measurable M" "integrable M g2" "AE x in M. g2 x \<ge> 0 \<and> g2 x \<le> max 0 (f1 x + C x)" "\<And>x. f1 x + C x = g2 x + u2 x - u2 (T x)"
     using cohomologous_approx_cond_exp_aux[OF A B] by blast
 
   define f2 where "f2 = (\<lambda>x. (g2 x - C x))"
   have *: "u2(T x) - u2 x = f2 x -f1 x" for x unfolding f2_def using H2(4)[of x] by auto
   have "AE x in M. f2 x \<ge> - C x" using H2(3) unfolding f2_def by auto
   have "integrable M f2"
     unfolding f2_def by (intro Bochner_Integration.integrable_diff \<open>integrable M g2\<close> \<open>integrable M C\<close>)
   have "AE x in M. real_cond_exp M Invariants (\<lambda>x. u2(T x) - u2 x) x = 0"
   proof (rule limit_foTn_over_n)
     show "integrable M (\<lambda>x. u2(T x) - u2 x)"
       unfolding * by (intro Bochner_Integration.integrable_diff \<open>integrable M f1\<close> \<open>integrable M f2\<close>)
   qed (simp add: \<open>u2 \<in> borel_measurable M\<close>)
   then have "AE x in M. real_cond_exp M Invariants (\<lambda>x. f2 x - f1 x) x = 0"
     unfolding * by simp
   moreover have "AE x in M. real_cond_exp M Invariants (\<lambda>x. f2 x - f1 x) x = real_cond_exp M Invariants f2 x - real_cond_exp M Invariants f1 x"
     by (intro real_cond_exp_diff \<open>integrable M f2\<close> \<open>integrable M f1\<close>)
   ultimately have AEf2: "AE x in M. real_cond_exp M Invariants f2 x = 0"
     using AEf1 by auto
 
   have A [measurable]: "integrable M (\<lambda>x. C x - f2 x)"
     by (intro Bochner_Integration.integrable_diff \<open>integrable M f2\<close> \<open>integrable M C\<close>)
   have "AE x in M. real_cond_exp M Invariants (\<lambda>x. C x - f2 x) x = real_cond_exp M Invariants C x - real_cond_exp M Invariants f2 x"
     by (intro real_cond_exp_diff \<open>integrable M f2\<close> \<open>integrable M C\<close>)
   then have B: "AE x in M. real_cond_exp M Invariants (\<lambda>x. C x - f2 x) x > 0"
     using AECI AEf2 by auto
 
   obtain u3 g3 where H3: "u3 \<in> borel_measurable M" "integrable M g3" "AE x in M. g3 x \<ge> 0 \<and> g3 x \<le> max 0 (C x - f2 x)" "\<And>x. C x - f2 x = g3 x + u3 x - u3 (T x)"
     using cohomologous_approx_cond_exp_aux[OF A B] by blast
 
   define f3 where "f3 = (\<lambda>x. C x - g3 x)"
   have "AE x in M. f3 x \<ge> min (C x) (f2 x)" unfolding f3_def using H3(3) by auto
   then have "AE x in M. f3 x \<ge> -C x" using \<open>AE x in M. f2 x \<ge> - C x\<close> \<open>AE x in M. C x > 0\<close> by auto
   moreover have "AE x in M. f3 x \<le> C x" unfolding f3_def using H3(3) by auto
   ultimately have "AE x in M. abs(f3 x) \<le> C x" by auto
   then have *: "AE x in M. abs(f3 x) \<le> B x" using order_trans[OF _ \<open>\<And>x. C x \<le> B x\<close>] by auto
 
   define g where "g = (\<lambda>x. f3 x + real_cond_exp M Invariants f x)"
   define u where "u = (\<lambda>x. u2 x - u3 x)"
   have "AE x in M. abs (g x - real_cond_exp M Invariants f x) \<le> B x"
     unfolding g_def using * by auto
   moreover have "f x = g x + u x - u(T x)" for x
     using H3(4)[of x] H2(4)[of x] unfolding u_def g_def f3_def f2_def f1_def by auto
   moreover have "u \<in> borel_measurable M"
     unfolding u_def using \<open>u2 \<in> borel_measurable M\<close> \<open>u3 \<in> borel_measurable M\<close> by auto
   moreover have "integrable M g"
     unfolding g_def f3_def by (intro Bochner_Integration.integrable_add Bochner_Integration.integrable_diff
     \<open>integrable M C\<close> \<open>integrable M g3\<close> \<open>integrable M f\<close> real_cond_exp_int(1))
   ultimately show ?thesis by auto
 qed
 
 
 subsubsection \<open>$L^1$ version of Birkhoff theorem\<close>
 
 text \<open>The $L^1$ convergence in Birkhoff theorem follows from the almost everywhere convergence and
 general considerations on $L^1$ convergence (Scheffe's lemma) explained
 in \verb+AE_and_int_bound_implies_L1_conv2+.
 This argument works neatly for nonnegative functions, the general case reduces to this one by taking
 the positive and negative parts of a given function.
 
 One could also prove it by truncation: for bounded functions, the $L^1$ convergence follows
 from the boundedness and almost sure convergence. The general case follows by density, but it
 is a little bit tedious to write as one need to make sure that the conditional expectation
 of the truncation converges to the conditional expectation of the original function. This is true
 in $L^1$ as the conditional expectation is a contraction in $L^1$, it follows almost everywhere
 after taking a subsequence. All in all, the argument based on Scheffe's lemma seems more
 economical.\<close>
 
 lemma birkhoff_lemma_L1:
   fixes f::"'a \<Rightarrow> real"
   assumes "\<And>x. f x \<ge> 0"
       and [measurable]: "integrable M f"
   shows "(\<lambda>n. \<integral>\<^sup>+x. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<partial>M) \<longlonglongrightarrow> 0"
 proof (rule Scheffe_lemma2)
   show i: "integrable M (real_cond_exp M Invariants f)" using assms by (simp add: real_cond_exp_int(1))
   show "AE x in M. (\<lambda>n. birkhoff_sum f n x / real n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
     using birkhoff_theorem_AE_nonergodic assms by simp
   fix n
   have [measurable]: "(\<lambda>x. ennreal \<bar>birkhoff_sum f n x\<bar>) \<in> borel_measurable M" by measurable
   show [measurable]: "(\<lambda>x. birkhoff_sum f n x / real n) \<in> borel_measurable M" by measurable
 
   have "AE x in M. real_cond_exp M Invariants f x \<ge> 0" using assms(1) real_cond_exp_pos by simp
   then have *: "AE x in M. norm (real_cond_exp M Invariants f x) = real_cond_exp M Invariants f x" by auto
   have **: "(\<integral> x. norm (real_cond_exp M Invariants f x) \<partial>M) = (\<integral> x. real_cond_exp M Invariants f x \<partial>M)"
     apply (rule integral_cong_AE) using * by auto
 
   have "(\<integral>\<^sup>+x. ennreal (norm (real_cond_exp M Invariants f x)) \<partial>M) = (\<integral> x. norm (real_cond_exp M Invariants f x) \<partial>M)"
     by (rule nn_integral_eq_integral) (auto simp add: i)
   also have "... = (\<integral> x. real_cond_exp M Invariants f x \<partial>M)"
     using ** by simp
   also have "... = (\<integral> x. f x \<partial>M)"
     using real_cond_exp_int(2) assms(2) by auto
   also have "... = (\<integral>x. norm(f x) \<partial>M)" using assms by auto
   also have "... = (\<integral>\<^sup>+x. norm(f x) \<partial>M)"
     by (rule nn_integral_eq_integral[symmetric], auto simp add: assms(2))
   finally have eq: "(\<integral>\<^sup>+ x. norm (real_cond_exp M Invariants f x) \<partial>M) = (\<integral>\<^sup>+ x. norm(f x) \<partial>M)" by simp
 
   {
     fix x
     have "norm(birkhoff_sum f n x) \<le> birkhoff_sum (\<lambda>x. norm(f x)) n x"
       using birkhoff_sum_abs by fastforce
     then have "norm(birkhoff_sum f n x) \<le> birkhoff_sum (\<lambda>x. ennreal(norm(f x))) n x"
       unfolding birkhoff_sum_def by auto
   }
   then have "(\<integral>\<^sup>+x. norm(birkhoff_sum f n x) \<partial>M) \<le> (\<integral>\<^sup>+x. birkhoff_sum (\<lambda>x. ennreal(norm(f x))) n x \<partial>M)"
     by (simp add: nn_integral_mono)
   also have "... = n * (\<integral>\<^sup>+x. norm(f x) \<partial>M)"
     by (rule birkhoff_sum_nn_integral, auto)
   also have "... = n * (\<integral>\<^sup>+ x. norm (real_cond_exp M Invariants f x) \<partial>M)"
     using eq by simp
   finally have *: "(\<integral>\<^sup>+x. norm(birkhoff_sum f n x) \<partial>M) \<le> n * (\<integral>\<^sup>+ x. norm (real_cond_exp M Invariants f x) \<partial>M)"
     by simp
 
   show "(\<integral>\<^sup>+ x. ennreal (norm (birkhoff_sum f n x / real n)) \<partial>M) \<le> (\<integral>\<^sup>+ x. norm (real_cond_exp M Invariants f x) \<partial>M)"
   proof (cases)
     assume "n = 0"
     then show ?thesis by auto
   next
     assume "\<not>(n = 0)"
     then have "n > 0" by simp
     then have "1/ennreal(real n) \<ge> 0" by simp
     have "(\<integral>\<^sup>+ x. ennreal (norm (birkhoff_sum f n x / real n)) \<partial>M) = (\<integral>\<^sup>+ x. ennreal (norm (birkhoff_sum f n x)) / ennreal(real n) \<partial>M)"
       using \<open>n > 0\<close> by (auto simp: divide_ennreal)
     also have "... = (\<integral>\<^sup>+ x. (1/ennreal(real n)) * ennreal (norm (birkhoff_sum f n x)) \<partial>M)"
       by (simp add: \<open>0 < n\<close> divide_ennreal_def mult.commute)
     also have "... = (1/ennreal(real n) * (\<integral>\<^sup>+ x. ennreal (norm (birkhoff_sum f n x)) \<partial>M))"
       by (subst nn_integral_cmult) auto
     also have "... \<le> (1/ennreal(real n)) * (ennreal(real n) * (\<integral>\<^sup>+ x. norm (real_cond_exp M Invariants f x) \<partial>M))"
       using * by (intro mult_mono) (auto simp: ennreal_of_nat_eq_real_of_nat)
     also have "... = (\<integral>\<^sup>+ x. norm (real_cond_exp M Invariants f x) \<partial>M)"
       using \<open>n > 0\<close>
       by (auto simp del: ennreal_1 simp add: ennreal_1[symmetric] divide_ennreal ennreal_mult[symmetric] mult.assoc[symmetric])
         simp
     finally show ?thesis by simp
   qed
 qed
 
 theorem birkhoff_theorem_L1_nonergodic:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
   shows "(\<lambda>n. \<integral>\<^sup>+x. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<partial>M) \<longlonglongrightarrow> 0"
 proof -
   define g where "g = (\<lambda>x. max (f x) 0)"
   have g_int [measurable]: "integrable M g" unfolding g_def using assms by auto
   define h where "h = (\<lambda>x. max (-f x) 0)"
   have h_int [measurable]: "integrable M h" unfolding h_def using assms by auto
   have "f = (\<lambda>x. g x - h x)" unfolding g_def h_def by auto
   {
     fix n::nat assume "n > 0"
     have "\<And>x. birkhoff_sum f n x = birkhoff_sum g n x - birkhoff_sum h n x" using birkhoff_sum_diff \<open>f = (\<lambda>x. g x - h x)\<close> by auto
     then have "\<And>x. birkhoff_sum f n x / n = birkhoff_sum g n x / n - birkhoff_sum h n x / n" using \<open>n > 0\<close> by (simp add: diff_divide_distrib)
     moreover have "AE x in M. real_cond_exp M Invariants g x - real_cond_exp M Invariants h x = real_cond_exp M Invariants f x"
       using AE_symmetric[OF real_cond_exp_diff] g_int h_int \<open>f = (\<lambda>x. g x - h x)\<close> by auto
     ultimately have "AE x in M. birkhoff_sum f n x / n - real_cond_exp M Invariants f x =
         (birkhoff_sum g n x / n - real_cond_exp M Invariants g x) - (birkhoff_sum h n x / n - real_cond_exp M Invariants h x)"
       by auto
     then have *: "AE x in M. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<le>
       norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x) + norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x)"
       by auto
     have "(\<integral>\<^sup>+ x. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<partial>M) \<le>
       (\<integral>\<^sup>+ x. ennreal(norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x)) + norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x) \<partial>M)"
       apply (rule nn_integral_mono_AE) using * by (simp add: ennreal_plus[symmetric] del: ennreal_plus)
     also have "... = (\<integral>\<^sup>+ x. norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x) \<partial>M) + (\<integral>\<^sup>+ x. norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x) \<partial>M)"
       apply (rule nn_integral_add) apply auto using real_cond_exp_F_meas borel_measurable_cond_exp2 by measurable
     finally have "(\<integral>\<^sup>+ x. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<partial>M) \<le>
       (\<integral>\<^sup>+ x. norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x) \<partial>M) + (\<integral>\<^sup>+ x. norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x) \<partial>M)"
       by simp
   }
   then have *: "eventually (\<lambda>n. (\<integral>\<^sup>+ x. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<partial>M) \<le>
       (\<integral>\<^sup>+ x. norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x) \<partial>M) + (\<integral>\<^sup>+ x. norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x) \<partial>M))
       sequentially"
     using eventually_at_top_dense by auto
   have **: "eventually (\<lambda>n. (\<integral>\<^sup>+ x. norm(birkhoff_sum f n x / n - real_cond_exp M Invariants f x) \<partial>M) \<ge> 0) sequentially"
     by simp
 
   have "(\<lambda>n. (\<integral>\<^sup>+ x. norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x) \<partial>M)) \<longlonglongrightarrow> 0"
     apply (rule birkhoff_lemma_L1, auto simp add: g_int) unfolding g_def by auto
   moreover have "(\<lambda>n. (\<integral>\<^sup>+ x. norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x) \<partial>M)) \<longlonglongrightarrow> 0"
     apply (rule birkhoff_lemma_L1, auto simp add: h_int) unfolding h_def by auto
   ultimately have "(\<lambda>n. (\<integral>\<^sup>+ x. norm(birkhoff_sum g n x / n - real_cond_exp M Invariants g x) \<partial>M) + (\<integral>\<^sup>+ x. norm(birkhoff_sum h n x / n - real_cond_exp M Invariants h x) \<partial>M)) \<longlonglongrightarrow> 0"
     using tendsto_add[of _ 0 _ _ 0] by auto
   then show ?thesis
     using tendsto_sandwich[OF ** *] by auto
 qed
 
 
 subsubsection \<open>Conservativity of skew products\<close>
 
 text \<open>The behaviour of skew-products of the form $(x, y) \mapsto (Tx, y + f x)$ is directly related
 to Birkhoff theorem, as the iterates involve the Birkhoff sums in the fiber. Birkhoff theorem
 implies that such a skew product is conservative when the function $f$ has vanishing conditional
 expectation.
 
 To prove the theorem, assume by contradiction that a set $A$ with positive measure does not
 intersect its preimages. Replacing $A$ with a smaller set $C$, we can assume that $C$ is bounded in
 the $y$-direction, by a constant $N$, and also that all its nonempty vertical fibers, above the
 projection $Cx$, have a measure bounded from below. Then, by Birkhoff theorem, for any $r>0$, most
 of the first $n$ preimages of $C$ are contained in the set $\{|y| \leq r n+N\}$, of measure $O(r
 n)$. Hence, they can not be disjoint if $r < \mu(C)$. To make this argument rigorous, one should
 only consider the preimages whose $x$-component belongs to a set $Dx$ where the Birkhoff sums are
 small. This condition has a positive measure if $\mu(Cx) + \mu(Dx) > \mu(M)$, which one can ensure
 by taking $Dx$ large enough.\<close>
 
 theorem (in fmpt) skew_product_conservative:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f"
     and "AE x in M. real_cond_exp M Invariants f x = 0"
   shows "conservative_mpt (M \<Otimes>\<^sub>M lborel) (\<lambda>(x,y). (T x, y + f x))"
 proof (rule conservative_mptI)
   let ?TS = "(\<lambda>(x,y). (T x, y + f x))"
   let ?MS = "M \<Otimes>\<^sub>M (lborel::real measure)"
 
   have f_meas [measurable]: "f \<in> borel_measurable M" by auto
   have "mpt M T" by (simp add: mpt_axioms)
   with mpt_skew_product_real[OF this f_meas] show "mpt ?MS ?TS" by simp
   then interpret TS: mpt ?MS ?TS by auto
 
   fix A::"('a \<times> real) set"
   assume A1 [measurable]: "A \<in> sets ?MS" and A2: "emeasure ?MS A > 0"
   have "A = (\<Union>N::nat. A \<inter> {(x,y). abs(y) \<le> N})" by (auto simp add: real_arch_simple)
   then have *: "emeasure ?MS (\<Union>N::nat. A \<inter> {(x,y). abs(y) \<le> N}) > 0"
     using A2 by simp
 
   have "space ?MS = space M \<times> space (lborel::real measure)" using space_pair_measure by auto
   then have A_inc: "A \<subseteq> space M \<times> space (lborel::real measure)" using sets.sets_into_space[OF A1] by auto
 
   {
     fix N::nat
     have "{(x, y). abs(y) \<le> real N \<and> x \<in> space M} = space M \<times> {-(real N)..(real N)}" by auto
     then have "{(x, y). \<bar>y\<bar> \<le> real N \<and> x \<in> space M} \<in> sets ?MS" by auto
     then have "A \<inter> {(x, y). \<bar>y\<bar> \<le> real N \<and> x \<in> space M} \<in> sets ?MS" using A1 by auto
     moreover have "A \<inter> {(x,y). abs(y) \<le> real N} = A \<inter> {(x, y). \<bar>y\<bar> \<le> real N \<and> x \<in> space M}"
       using A_inc by blast
     ultimately have "A \<inter> {(x,y). abs(y) \<le> real N} \<in> sets ?MS" by auto
   }
   then have [measurable]: "\<And>N::nat. A \<inter> {(x, y). \<bar>y\<bar> \<le> real N} \<in> sets (M \<Otimes>\<^sub>M borel)" by auto
 
   have "\<exists>N::nat. emeasure ?MS (A \<inter> {(x,y). abs(y) \<le> N}) > 0"
     apply (rule emeasure_pos_unionE) using * by auto
   then obtain N::nat where N: "emeasure ?MS (A \<inter> {(x,y). abs(y) \<le> N}) > 0"
     by auto
 
   define B where "B = A \<inter> {(x,y). abs(y) \<le> N}"
   have B_meas [measurable]: "B \<in> sets (M \<Otimes>\<^sub>M lborel)" unfolding B_def by auto
   have "0 < emeasure (M \<Otimes>\<^sub>M lborel) B" unfolding B_def using N by auto
   also have "... = (\<integral>\<^sup>+x. emeasure lborel (Pair x -` B) \<partial>M)"
     apply (rule sigma_finite_measure.emeasure_pair_measure_alt)
     using B_meas by (auto simp add: lborel.sigma_finite_measure_axioms)
   finally have *: "(\<integral>\<^sup>+x. emeasure lborel (Pair x -` B) \<partial>M) > 0" by simp
 
   have "\<exists>Cx\<in>sets M. \<exists>e::real>0. emeasure M Cx > 0 \<and> (\<forall>x \<in> Cx. emeasure lborel (Pair x -` B) \<ge> e)"
     by (rule not_AE_zero_int_ennreal_E, auto simp add: *)
   then obtain Cx e where [measurable]: "Cx \<in> sets M" and Cxe: "e>(0::real)" "emeasure M Cx > 0" "\<And>x. x \<in> Cx \<Longrightarrow> emeasure lborel (Pair x -` B) \<ge> e"
     by blast
   define C where "C = B \<inter> (Cx \<times> (UNIV::real set))"
   have C_meas [measurable]: "C \<in> sets (M \<Otimes>\<^sub>M lborel)" unfolding C_def using B_meas by auto
   have Cx_fibers: "\<And>x. x \<in> Cx \<Longrightarrow> emeasure lborel (Pair x -` C) \<ge> e" using Cxe(3) C_def by auto
 
   define c where "c = (measure M Cx)/2"
   have "c > 0" unfolding c_def using Cxe(2) by (simp add: emeasure_eq_measure)
 
   text \<open>We will apply Birkhoff theorem to show that most preimages of $C$ at time $n$ are contained in a cylinder
   of height roughly $r n$, for some suitably small $r$. How small $r$ should be to get a
   contradiction can be determined at the end of the proof. It turns out that the good condition
   is the following one -- this is by no means obvious now.\<close>
 
   define r where "r = (if measure M (space M) = 0 then 1 else e * c / (4 * measure M (space M)))"
   have "r > 0" using \<open>e > 0\<close> \<open>c > 0\<close> unfolding r_def
     apply auto using measure_le_0_iff by fastforce
   have pos: "e*c-2*r*measure M (space M) > 0" using \<open>e > 0\<close> \<open>c > 0\<close> unfolding r_def by auto
 
   define Bgood where "Bgood = {x \<in> space M. (\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> 0}"
   have [measurable]: "Bgood \<in> sets M" unfolding Bgood_def by auto
   have *: "AE x in M. x \<in> Bgood" unfolding Bgood_def using birkhoff_theorem_AE_nonergodic[OF assms(1)] assms(2) by auto
   then have "emeasure M Bgood = emeasure M (space M)"
     by (intro emeasure_eq_AE) auto
 
   {
     fix x assume "x \<in> Bgood"
     then have "x \<in> space M" unfolding Bgood_def by auto
     have "(\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> 0" using \<open>x \<in> Bgood\<close> unfolding Bgood_def by auto
     moreover have "0 \<in> {-r<..<r}" "open {-r<..<r}" using \<open>r>0\<close> by auto
     ultimately have "eventually (\<lambda>n. birkhoff_sum f n x / n \<in> {-r<..<r}) sequentially"
       using topological_tendstoD by blast
     then obtain n0 where n0: "n0>0" "\<And>n. n \<ge> n0 \<Longrightarrow> birkhoff_sum f n x / n \<in> {-r<..<r}"
       using eventually_sequentially by (metis (mono_tags, lifting) le0 le_simps(3) neq0_conv)
     {
       fix n assume "n \<ge> n0"
       then have "n>0" using \<open>n0>0\<close> by auto
       with n0(2)[OF \<open>n \<ge> n0\<close>] have "abs(birkhoff_sum f n x / n) \<le> r" by auto
       then have "abs(birkhoff_sum f n x) \<le> r * n" using \<open>n>0\<close> by (simp add: divide_le_eq)
     }
     then have "x \<in> (\<Union>n0. {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n})" using \<open>x \<in> space M\<close> by blast
   }
   then have "AE x in M. x \<notin> space M - (\<Union>n0. {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n})"
     using * by auto
   then have eqM: "emeasure M (\<Union>n0. {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n}) = emeasure M (space M)"
     by (intro emeasure_eq_AE) auto
 
   have "(\<lambda>n0. emeasure M {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n} + c)
           \<longlonglongrightarrow> emeasure M (\<Union>n0. {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n}) + c"
     by (intro tendsto_intros Lim_emeasure_incseq) (auto simp add: incseq_def)
   moreover have "emeasure M (\<Union>n0. {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n}) + c > emeasure M (space M)"
     using eqM \<open>c > 0\<close> emeasure_eq_measure by auto
   ultimately have "eventually (\<lambda>n0. emeasure M {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n} + c > emeasure M (space M)) sequentially"
     unfolding order_tendsto_iff by auto
   then obtain n0 where n0: "emeasure M {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n} + c > emeasure M (space M)"
     using eventually_sequentially by auto
 
   define Dx where "Dx = {x \<in> space M. \<forall>n\<in>{n0..}. abs(birkhoff_sum f n x) \<le> r * n}"
   have Dx_meas [measurable]: "Dx \<in> sets M" unfolding Dx_def by auto
   have "emeasure M Dx + c \<ge> emeasure M (space M)" using n0 Dx_def by auto
 
   obtain n1::nat where n1: "n1 > max n0 ((measure M (space M) * 2 * N + e*c*n0 - e*c) / (e*c-2*r*measure M (space M)))"
     by (metis mult.commute mult.left_neutral numeral_One reals_Archimedean3 zero_less_numeral)
   then have "n1 > n0" by auto
   have n1_ineq: "n1 * (e*c-2*r*measure M (space M)) > (measure M (space M) * 2 * N + e*c*n0 - e*c)"
     using n1 pos by (simp add: pos_divide_less_eq)
 
   define D where "D = (\<lambda>n. Dx \<times> {-r*n1-N..r*n1+N} \<inter> (?TS^^n)-`C)"
   have Dn_meas [measurable]: "D n \<in> sets (M \<Otimes>\<^sub>M lborel)" for n
     unfolding D_def apply (rule TS.T_intersec_meas(2)) using C_meas by auto
 
   have "emeasure ?MS (D n) \<ge> e * c" if "n \<in> {n0..n1}" for n
   proof -
     have "n \<ge> n0" "n \<le> n1" using that by auto
     {
       fix x assume [simp]: "x \<in> space M"
 
       define F where "F = {y \<in> {-r*n1-N..r*n1+N}. y + birkhoff_sum f n x \<in> Pair ((T^^n)x) -`C}"
       have [measurable]: "F \<in> sets lborel" unfolding F_def by measurable
       {
         fix y::real
         have "(?TS^^n)(x,y) = ((T^^n)x, y + birkhoff_sum f n x)"
           using skew_product_real_iterates by simp
         then have "(indicator C ((?TS^^n) (x,y))::ennreal) = indicator Cx ((T^^n)x) * indicator (Pair ((T^^n)x) -`C) (y + birkhoff_sum f n x)"
           using C_def by (simp add: indicator_def)
         moreover have "(indicator (D n) (x, y)::ennreal) = indicator Dx x * indicator {-r*n1-N..r*n1+N} y * indicator C ((?TS^^n) (x,y))"
           unfolding D_def by (simp add: indicator_def)
         ultimately have "(indicator (D n) (x, y)::ennreal) = indicator Dx x * indicator {-r*n1-N..r*n1+N} y
             * indicator Cx ((T^^n)x) * indicator (Pair ((T^^n)x) -`C) (y + birkhoff_sum f n x)"
           by (simp add: mult.assoc)
         then have "(indicator (D n) (x, y)::ennreal) = indicator (Dx \<inter> (T^^n)-`Cx) x * indicator F y"
           unfolding F_def by (simp add: indicator_def)
       }
       then have "(\<integral>\<^sup>+y. indicator (D n) (x, y) \<partial>lborel) = (\<integral>\<^sup>+y. indicator (Dx \<inter> (T^^n)-`Cx) x * indicator F y \<partial>lborel)"
         by auto
       also have "... = indicator (Dx \<inter> (T^^n)-`Cx) x * (\<integral>\<^sup>+y. indicator F y \<partial>lborel)"
         by (rule nn_integral_cmult, auto)
       also have "... = indicator (Dx \<inter> (T^^n)-`Cx) x * emeasure lborel F" using \<open>F \<in> sets lborel\<close> by auto
       finally have A: "(\<integral>\<^sup>+y. indicator (D n) (x, y) \<partial>lborel) = indicator (Dx \<inter> (T^^n)-`Cx) x * emeasure lborel F"
         by simp
 
       have "(\<integral>\<^sup>+y. indicator (D n) (x, y) \<partial>lborel) \<ge> ennreal e * indicator (Dx \<inter> (T^^n)-`Cx) x"
       proof (cases)
         assume "indicator (Dx \<inter> (T^^n)-`Cx) x = (0::ennreal)"
         then show ?thesis by auto
       next
         assume "\<not>(indicator (Dx \<inter> (T^^n)-`Cx) x = (0::ennreal))"
         then have "x \<in> Dx \<inter> (T^^n)-`Cx" by (simp add: indicator_eq_0_iff)
         then have "x \<in> Dx" "(T^^n) x \<in> Cx" by auto
         then have "abs(birkhoff_sum f n x) \<le> r * n" using \<open>n \<in> {n0..n1}\<close> Dx_def by auto
         then have *: "abs(birkhoff_sum f n x) \<le> r * n1" using \<open>n \<le> n1\<close> \<open>r>0\<close>
           by (meson of_nat_le_iff order_trans real_mult_le_cancel_iff2)
 
         have F_expr: "F = {-r*n1-N..r*n1+N} \<inter> (+)(birkhoff_sum f n x) -` (Pair ((T^^n)x) -`C)"
           unfolding F_def by (auto simp add: add.commute)
         have "(Pair ((T^^n)x) -`C) \<subseteq> {real_of_int (- int N)..real N}" unfolding C_def B_def by auto
         then have "((+)(birkhoff_sum f n x)) -` (Pair ((T^^n)x) -`C) \<subseteq> {-N-birkhoff_sum f n x..N-birkhoff_sum f n x}"
           by auto
         also have "... \<subseteq> {-r * n1 - N .. r * n1 + N}" using * by auto
         finally have "F = ((+)(birkhoff_sum f n x)) -` (Pair ((T^^n)x) -`C)" unfolding F_expr by auto
 
         then have "emeasure lborel F = emeasure lborel ((+)(birkhoff_sum f n x) -` (Pair ((T^^n)x) -`C))" by auto
         also have "... = emeasure lborel (((+)(birkhoff_sum f n x) -` (Pair ((T^^n)x) -`C)) \<inter> space lborel)" by simp
         also have "... = emeasure (distr lborel borel ((+) (birkhoff_sum f n x))) (Pair ((T^^n)x) -`C)"
           apply (rule emeasure_distr[symmetric]) using C_meas by auto
         also have "... = emeasure lborel (Pair ((T^^n)x) -`C)" using lborel_distr_plus[of "birkhoff_sum f n x"] by simp
         also have "... \<ge> e" using Cx_fibers \<open>(T^^n) x \<in> Cx\<close> by auto
         finally have "emeasure lborel F \<ge> e" by auto
         then show ?thesis using A by (simp add: indicator_def)
       qed
     }
     moreover have "emeasure ?MS (D n) = (\<integral>\<^sup>+x. (\<integral>\<^sup>+y. indicator (D n) (x, y) \<partial>lborel) \<partial>M)"
       using Dn_meas lborel.emeasure_pair_measure by blast
     ultimately have "emeasure ?MS (D n) \<ge> (\<integral>\<^sup>+x. ennreal e * indicator (Dx \<inter> (T ^^ n) -` Cx) x \<partial>M)"
       by (simp add: nn_integral_mono)
     also have "(\<integral>\<^sup>+x. ennreal e * indicator (Dx \<inter> (T ^^ n) -` Cx) x \<partial>M) = e * (\<integral>\<^sup>+x. indicator (Dx \<inter> (T ^^ n) -` Cx) x \<partial>M)"
       apply (rule nn_integral_cmult) using \<open>e>0\<close> by auto
     also have "... = ennreal e * emeasure M (Dx \<inter> (T ^^ n) -` Cx)" by simp
     finally have *: "emeasure ?MS (D n) \<ge> ennreal e * emeasure M (Dx \<inter> (T ^^ n) -` Cx)" by auto
 
     have "c + emeasure M (space M) \<le> emeasure M Dx + emeasure M Cx"
       using \<open>emeasure M Dx + c \<ge> emeasure M (space M)\<close> unfolding c_def
       by (auto simp: emeasure_eq_measure ennreal_plus[symmetric] simp del: ennreal_plus)
     also have "... = emeasure M Dx + emeasure M ((T^^n)--`Cx)"
       by (simp add: T_vrestr_same_emeasure(2))
     also have "... = emeasure M (Dx \<union> ((T^^n)--`Cx)) + emeasure M (Dx \<inter> ((T^^n)--`Cx))"
-      by (rule emeasure_union_inter, auto)
+      by (rule emeasure_Un_Int, auto)
     also have "... \<le> emeasure M (space M) + emeasure M (Dx \<inter> ((T^^n)-`Cx))"
     proof -
       have "emeasure M (Dx \<union> ((T^^n)--`Cx)) \<le> emeasure M (space M)"
         by (rule emeasure_mono, auto simp add: sets.sets_into_space)
       moreover have "Dx \<inter> ((T^^n)--`Cx) = Dx \<inter> ((T^^n)-`Cx)"
         by (simp add: vrestr_intersec_in_space)
       ultimately show ?thesis by (metis add.commute add_left_mono)
     qed
     finally have "emeasure M (Dx \<inter> ((T^^n)-`Cx)) \<ge> c" by (simp add: emeasure_eq_measure)
     then have "ennreal e * emeasure M (Dx \<inter> ((T^^n)-`Cx)) \<ge> ennreal e * c" using \<open>e > 0\<close>
       using mult_left_mono by fastforce
     with * show "emeasure ?MS (D n) \<ge> e * c"
       using \<open>0<c\<close> \<open>0<e\<close> by (auto simp: ennreal_mult[symmetric])
   qed
 
   have "\<not>(disjoint_family_on D {n0..n1})"
   proof
     assume D: "disjoint_family_on D {n0..n1}"
     have "emeasure lborel {-r*n1-N..r*n1+N} = (r * real n1 + real N) - (- r * real n1 - real N)"
       apply (rule emeasure_lborel_Icc) using \<open>r>0\<close> by auto
     then have *: "emeasure lborel {-r*n1-N..r*n1+N} = ennreal(2 * r * real n1 + 2 * real N)"
       by (auto simp: ac_simps)
 
     have "ennreal(e * c) * (real n1 - real n0 + 1) = ennreal(e*c) * card {n0..n1}"
       using \<open>n1 > n0\<close> by (auto simp: ennreal_of_nat_eq_real_of_nat Suc_diff_le ac_simps of_nat_diff)
     also have "... = (\<Sum>n\<in>{n0..n1}. ennreal(e*c))"
       by (simp add: ac_simps)
     also have "... \<le> (\<Sum>n\<in>{n0..n1}. emeasure ?MS (D n))"
       using \<open>\<And>n. n \<in> {n0..n1} \<Longrightarrow> emeasure ?MS (D n) \<ge> e * c\<close> by (meson sum_mono)
     also have "... = emeasure ?MS (\<Union>n\<in>{n0..n1}. D n)"
       apply (rule sum_emeasure) using Dn_meas by (auto simp add: D)
     also have "... \<le> emeasure ?MS (space M \<times> {-r*n1-N..r*n1+N})"
       apply (rule emeasure_mono) unfolding D_def using sets.sets_into_space[OF Dx_meas] by auto
     also have "... = emeasure M (space M) * emeasure lborel {-r*n1-N..r*n1+N}"
       by (rule sigma_finite_measure.emeasure_pair_measure_Times, auto simp add: lborel.sigma_finite_measure_axioms)
     also have "... = emeasure M (space M) * ennreal(2 * r * real n1 + 2 * real N)"
       using * by auto
     finally have "ennreal(e * c) * (real n1- real n0+1) \<le> emeasure M (space M) * ennreal(2 * r * real n1 + 2 * real N)" by simp
     then have "e*c * (real n1- real n0 + 1) \<le> measure M (space M) * (2 * r * real n1 + 2 * real N)"
       using \<open>0<r\<close> \<open>0<e\<close> \<open>0<c\<close> \<open>n0 < n1\<close> emeasure_eq_measure by (auto simp: ennreal_mult'[symmetric] simp del: ennreal_plus)
     then have "0 \<le> measure M (space M) * (2 * r * real n1 + 2 * real N) - e*c * (real n1- real n0 + 1)" by auto
     also have "... = (measure M (space M) * 2 * N + e*c*n0 - e*c) - n1 * (e*c-2*r*measure M (space M))"
       by algebra
     finally have "n1 * (e*c-2*r*measure M (space M)) \<le> measure M (space M) * 2 * N + e*c*n0 - e*c"
       by linarith
     then show False using n1_ineq by auto
   qed
   then obtain n m where nm: "n<m" "D m \<inter> D n \<noteq> {}" unfolding disjoint_family_on_def by (metis inf_sup_aci(1) linorder_cases)
   define k where "k = m-n"
   then have "k>0" "D (n+k) \<inter> D n \<noteq> {}" using nm by auto
   then have "((?TS^^(n+k))-`A) \<inter> ((?TS^^n)-`A) \<noteq> {}" unfolding D_def C_def B_def by auto
   moreover have "((?TS^^(n+k))-`A) \<inter> ((?TS^^n)-`A) = (?TS^^n)-`(((?TS^^k)-`A) \<inter> A)"
     using funpow_add by (simp add: add.commute funpow_add set.compositionality)
   ultimately have "((?TS^^k)-`A) \<inter> A \<noteq> {}" by auto
   then show "\<exists>k>0. ((?TS^^k)-`A) \<inter> A \<noteq> {}" using \<open>k>0\<close> by auto
 qed
 
 
 
 subsubsection \<open>Oscillations around the limit in Birkhoff theorem\<close>
 
 text \<open>In this paragraph, we prove that, in Birkhoff theorem with vanishing limit, the Birkhoff sums
 are infinitely many times arbitrarily close to $0$, both on the positive and the negative side.
 
 In the ergodic case, this statement implies for instance that if the Birkhoff sums of an integrable
 function tend to infinity almost everywhere, then the integral of the function can not vanish, it
 has to be strictly positive (while Birkhoff theorem per se does not exclude the convergence to
 infinity, at a rate slower than linear). This converts a qualitative information (convergence to
 infinity at an unknown rate) to a quantitative information (linear convergence to infinity). This
 result (sometimes known as Atkinson's Lemma) has been reinvented many times, for instance by Kesten
 and by Guivarch. It plays an important role in the study of random products of matrices.
 
 This is essentially a consequence of the conservativity of the corresponding skew-product, proved in
 \verb+skew_product_conservative+. Indeed, this implies that, starting from a small set $X \times
 [-e/2, e/2]$, the skew-product comes back infinitely often to itself, which implies that the
 Birkhoff sums at these times are bounded by $e$.
 
 To show that the Birkhoff sums come back to $[0,e]$ is a little bit more tricky. Argue by
 contradiction, and induce on $A \times [0,e/2]$ where $A$ is the set of points where the Birkhoff
 sums don't come back to $[0,e]$. Then the second coordinate decreases strictly when one iterates the
 skew product, which is not compatible with conservativity.\<close>
 
 lemma birkhoff_sum_small_asymp_lemma:
   assumes [measurable]: "integrable M f"
     and "AE x in M. real_cond_exp M Invariants f x = 0" "e>(0::real)"
   shows "AE x in M. infinite {n. birkhoff_sum f n x \<in> {0..e}}"
 proof -
   have [measurable]: "f \<in> borel_measurable M" by auto
   have [measurable]: "\<And>N. {x \<in> space M. \<exists>N. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}} \<in> sets M" by auto
 
   {
     fix N assume "N>(0::nat)"
     define Ax where "Ax = {x \<in> space M. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}}"
     then have [measurable]: "Ax \<in> sets M" by auto
     define A where "A = Ax \<times> {0..e/2}"
     then have A_meas [measurable]: "A \<in> sets (M \<Otimes>\<^sub>M lborel)" by auto
 
     define TN where "TN = T^^N"
     interpret TN: fmpt M TN
       unfolding TN_def using fmpt_power by auto
     define fN where "fN = birkhoff_sum f N"
     have "TN.birkhoff_sum fN n x = birkhoff_sum f (n*N) x" for n x
     proof (induction n)
       case 0
       then show ?case by auto
     next
       case (Suc n)
       have "TN.birkhoff_sum fN (Suc n) x = TN.birkhoff_sum fN n x + fN ((TN^^n) x)"
         using TN.birkhoff_sum_cocycle[of fN n 1] by auto
       also have "... = birkhoff_sum f (n*N) x + birkhoff_sum f N ((TN^^n) x)"
         using Suc.IH fN_def by auto
       also have "... = birkhoff_sum f (n*N+N) x" unfolding TN_def
         by (subst funpow_mult, subst mult.commute[of N n], rule birkhoff_sum_cocycle[of f "n*N" N x, symmetric])
       finally show ?case by (simp add: add.commute)
     qed
     then have not0e: "\<And>x n. x \<in> Ax \<Longrightarrow> n \<noteq> 0 \<Longrightarrow> TN.birkhoff_sum fN n x \<notin> {0..e}" unfolding Ax_def by auto
 
     let ?TS = "(\<lambda>(x,y). (T x, y + f x))"
     let ?MS = "M \<Otimes>\<^sub>M (lborel::real measure)"
     interpret TS: conservative_mpt ?MS ?TS
       by (rule skew_product_conservative, auto simp add: assms)
 
     let ?TSN = "(\<lambda>(x,y). (TN x, y + fN x))"
     have *:"?TSN = ?TS^^N" unfolding TN_def fN_def using skew_product_real_iterates by auto
     interpret TSN: conservative_mpt ?MS ?TSN
       using * TS.conservative_mpt_power by auto
 
     define MA TA where "MA = restrict_space ?MS A" and "TA = TSN.induced_map A"
     interpret TA: conservative_mpt MA TA unfolding MA_def TA_def
       by (rule TSN.induced_map_conservative_mpt, measurable)
     have *: "\<And> x y. snd (TA (x,y)) = snd (x,y) + TN.birkhoff_sum fN (TSN.return_time_function A (x,y)) x"
       unfolding TA_def TSN.induced_map_def using TN.skew_product_real_iterates Pair_def by auto
     have [measurable]: "snd \<in> borel_measurable ?MS" by auto
     then have [measurable]: "snd \<in> borel_measurable MA" unfolding MA_def using measurable_restrict_space1 by blast
 
     have "AE z in MA. z \<in> TSN.recurrent_subset A"
       unfolding MA_def using TSN.induced_map_recurrent_typical(1)[OF A_meas].
     moreover
     {
       fix z assume z: "z \<in> TSN.recurrent_subset A"
       define x y where "x = fst z" and "y = snd z"
       then have "z = (x,y)" by simp
       have "z \<in> A" using z "TSN.recurrent_subset_incl"(1) by auto
       then have "x \<in> Ax" "y \<in> {0..e/2}" unfolding A_def x_def y_def by auto
       define y2 where "y2 = y + TN.birkhoff_sum fN (TSN.return_time_function A (x,y)) x"
       have "y2 = snd (TA z)" unfolding y2_def using * \<open>z = (x, y)\<close> by force
       moreover have "TA z \<in> A" unfolding TA_def using \<open>z \<in> A\<close> TSN.induced_map_stabilizes_A by auto
       ultimately have "y2 \<in> {0..e/2}" unfolding A_def by auto
 
       have "TSN.return_time_function A (x,y) \<noteq> 0"
         using \<open>z = (x,y)\<close> \<open>z \<in> TSN.recurrent_subset A\<close> TSN.return_time0[of A] by fast
       then have "TN.birkhoff_sum fN (TSN.return_time_function A (x,y)) x \<notin> {0..e}"
         using not0e[OF \<open>x \<in> Ax\<close>] by auto
       moreover have "TN.birkhoff_sum fN (TSN.return_time_function A (x,y)) x \<in> {-e..e}"
         using \<open>y \<in> {0..e/2}\<close> \<open>y2 \<in> {0..e/2}\<close> y2_def by auto
       ultimately have "TN.birkhoff_sum fN (TSN.return_time_function A (x,y)) x \<in> {-e..<0}"
         by auto
       then have "y2 < y" using y2_def by auto
       then have "snd(TA z) < snd z" unfolding y_def using \<open>y2 = snd (TA z)\<close> by auto
     }
     ultimately have a: "AE z in MA. snd(TA z) < snd z" by auto
     then have "AE z in MA. snd(TA z) \<le> snd z" by auto
     then have "AE z in MA. snd(TA z) = snd z" using TA.AE_decreasing_then_invariant[of snd] by auto
     then have "AE z in MA. False" using a by auto
     then have "space MA \<in> null_sets MA" by (simp add: AE_iff_null_sets)
     then have "emeasure MA A = 0" by (metis A_meas MA_def null_setsD1 space_restrict_space2)
     then have "emeasure ?MS A = 0" unfolding MA_def
       by (metis A_meas emeasure_restrict_space sets.sets_into_space sets.top space_restrict_space space_restrict_space2)
     moreover have "emeasure ?MS A = emeasure M Ax * emeasure lborel {0..e/2}"
       unfolding A_def by (intro lborel.emeasure_pair_measure_Times) auto
     ultimately have "emeasure M {x \<in> space M. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}} = 0" using \<open>e>0\<close> Ax_def by simp
     then have "{x \<in> space M. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}} \<in> null_sets M" by auto
   }
   then have "(\<Union>N\<in>{0<..}. {x \<in> space M. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}}) \<in> null_sets M" by (auto simp: greaterThan_0)
   moreover have "{x \<in> space M. \<not>(infinite {n. birkhoff_sum f n x \<in> {0..e}})} \<subseteq> (\<Union>N\<in>{0<..}. {x \<in> space M. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}})"
   proof
     fix x assume H: "x \<in> {x \<in> space M. \<not>(infinite {n. birkhoff_sum f n x \<in> {0..e}})}"
     then have "x \<in> space M" by auto
     have *: "finite {n. birkhoff_sum f n x \<in> {0..e}}" using H by auto
     then obtain N where "\<And>n. n \<ge> N \<Longrightarrow> n \<notin> {n. birkhoff_sum f n x \<in> {0..e}}"
       by (metis finite_nat_set_iff_bounded not_less)
     then have "x \<in> {x \<in> space M. \<forall>n\<in>{N+1..}. birkhoff_sum f n x \<notin> {0..e}}" using \<open>x \<in> space M\<close> by auto
     moreover have "N+1>0" by auto
     ultimately show "x \<in> (\<Union>N\<in>{0<..}. {x \<in> space M. \<forall>n\<in>{N..}. birkhoff_sum f n x \<notin> {0..e}})" by auto
   qed
   ultimately show ?thesis unfolding eventually_ae_filter by auto
 qed
 
 theorem birkhoff_sum_small_asymp_pos_nonergodic:
   assumes [measurable]: "integrable M f" and "e > (0::real)"
   shows "AE x in M. infinite {n. birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x .. n * real_cond_exp M Invariants f x + e}}"
 proof -
   define g where "g = (\<lambda>x. f x - real_cond_exp M Invariants f x)"
   have g_meas [measurable]: "integrable M g" unfolding g_def using real_cond_exp_int(1)[OF assms(1)] assms(1) by auto
   have "AE x in M. real_cond_exp M Invariants (real_cond_exp M Invariants f) x = real_cond_exp M Invariants f x"
     by (rule real_cond_exp_F_meas, auto simp add: real_cond_exp_int(1)[OF assms(1)])
   then have *: "AE x in M. real_cond_exp M Invariants g x = 0"
     unfolding g_def using real_cond_exp_diff[OF assms(1) real_cond_exp_int(1)[OF assms(1)]] by auto
   have "AE x in M. infinite {n. birkhoff_sum g n x \<in> {0..e}}"
     by (rule birkhoff_sum_small_asymp_lemma, auto simp add: \<open>e>0\<close> * g_meas)
   moreover
   {
     fix x assume "x \<in> space M" "infinite {n. birkhoff_sum g n x \<in> {0..e}}"
     {
       fix n assume H: "birkhoff_sum g n x \<in> {0..e}"
       have "birkhoff_sum g n x = birkhoff_sum f n x - birkhoff_sum (real_cond_exp M Invariants f) n x"
         unfolding g_def using birkhoff_sum_diff by auto
       also have "... = birkhoff_sum f n x - n * real_cond_exp M Invariants f x"
         using birkhoff_sum_of_invariants \<open>x \<in> space M\<close> by auto
       finally have "birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x .. n * real_cond_exp M Invariants f x + e}" using H by simp
     }
     then have "{n. birkhoff_sum g n x \<in> {0..e}} \<subseteq> {n. birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x .. n * real_cond_exp M Invariants f x + e}}"
       by auto
     then have "infinite {n. birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x .. n * real_cond_exp M Invariants f x + e}}"
       using \<open>infinite {n. birkhoff_sum g n x \<in> {0..e}}\<close> finite_subset by blast
   }
   ultimately show ?thesis by auto
 qed
 
 theorem birkhoff_sum_small_asymp_neg_nonergodic:
   assumes [measurable]: "integrable M f" and "e > (0::real)"
   shows "AE x in M. infinite {n. birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x - e .. n * real_cond_exp M Invariants f x}}"
 proof -
   define g where "g = (\<lambda>x. real_cond_exp M Invariants f x - f x)"
   have g_meas [measurable]: "integrable M g" unfolding g_def using real_cond_exp_int(1)[OF assms(1)] assms(1) by auto
   have "AE x in M. real_cond_exp M Invariants (real_cond_exp M Invariants f) x = real_cond_exp M Invariants f x"
     by (rule real_cond_exp_F_meas, auto simp add: real_cond_exp_int(1)[OF assms(1)])
   then have *: "AE x in M. real_cond_exp M Invariants g x = 0"
     unfolding g_def using real_cond_exp_diff[OF real_cond_exp_int(1)[OF assms(1)] assms(1)] by auto
   have "AE x in M. infinite {n. birkhoff_sum g n x \<in> {0..e}}"
     by (rule birkhoff_sum_small_asymp_lemma, auto simp add: \<open>e>0\<close> * g_meas)
   moreover
   {
     fix x assume "x \<in> space M" "infinite {n. birkhoff_sum g n x \<in> {0..e}}"
     {
       fix n assume H: "birkhoff_sum g n x \<in> {0..e}"
       have "birkhoff_sum g n x = birkhoff_sum (real_cond_exp M Invariants f) n x - birkhoff_sum f n x"
         unfolding g_def using birkhoff_sum_diff by auto
       also have "... = n * real_cond_exp M Invariants f x - birkhoff_sum f n x"
         using birkhoff_sum_of_invariants \<open>x \<in> space M\<close> by auto
       finally have "birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x - e .. n * real_cond_exp M Invariants f x}" using H by simp
     }
     then have "{n. birkhoff_sum g n x \<in> {0..e}} \<subseteq> {n. birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x - e .. n * real_cond_exp M Invariants f x}}"
       by auto
     then have "infinite {n. birkhoff_sum f n x \<in> {n * real_cond_exp M Invariants f x - e .. n * real_cond_exp M Invariants f x}}"
       using \<open>infinite {n. birkhoff_sum g n x \<in> {0..e}}\<close> finite_subset by blast
   }
   ultimately show ?thesis by auto
 qed
 
 
 subsubsection \<open>Conditional expectation for the induced map\<close>
 
 text \<open>Thanks to Birkhoff theorem, one can relate conditional expectations with respect to the invariant
 sigma algebra, for a map and for a corresponding induced map, as follows.\<close>
 
 proposition Invariants_cond_exp_induced_map:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "A \<in> sets M" "integrable M f"
   defines "MA \<equiv> restrict_space M A" and "TA \<equiv> induced_map A" and "fA \<equiv> induced_function A f"
   shows "AE x in MA. real_cond_exp MA (qmpt.Invariants MA TA) fA x
       = real_cond_exp M Invariants f x * real_cond_exp MA (qmpt.Invariants MA TA) (return_time_function A) x"
 proof -
   interpret A: fmpt MA TA unfolding MA_def TA_def by (rule induced_map_fmpt[OF assms(1)])
 
   have "integrable M fA" unfolding fA_def using induced_function_integral_nonergodic(1) assms by auto
   then have "integrable MA fA" unfolding MA_def
     by (metis assms(1) integrable_mult_indicator integrable_restrict_space sets.Int_space_eq2)
   then have a: "AE x in MA. (\<lambda>n. A.birkhoff_sum fA n x / n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants fA x"
     using A.birkhoff_theorem_AE_nonergodic by auto
 
   have "AE x in M. (\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
     using birkhoff_theorem_AE_nonergodic assms(2) by auto
   then have b: "AE x in MA. (\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
     unfolding MA_def by (metis (mono_tags, lifting) AE_restrict_space_iff assms(1) eventually_mono sets.Int_space_eq2)
 
   define phiA where "phiA = (\<lambda>x. return_time_function A x)"
   have "integrable M phiA" unfolding phiA_def using return_time_integrable by auto
   then have "integrable MA phiA" unfolding MA_def
     by (metis assms(1) integrable_mult_indicator integrable_restrict_space sets.Int_space_eq2)
   then have c: "AE x in MA. (\<lambda>n. A.birkhoff_sum (\<lambda>x. real(phiA x)) n x / n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants phiA x"
     using A.birkhoff_theorem_AE_nonergodic by auto
 
   have "A-recurrent_subset A \<in> null_sets M" using Poincare_recurrence_thm(1)[OF assms(1)] by auto
   then have "A - recurrent_subset A \<in> null_sets MA" unfolding MA_def
     by (metis Diff_subset assms(1) emeasure_restrict_space null_setsD1 null_setsD2 null_setsI sets.Int_space_eq2 sets_restrict_space_iff)
   then have "AE x in MA. x \<in> recurrent_subset A"
     by (simp add: AE_iff_null MA_def null_setsD2 set_diff_eq space_restrict_space2)
   moreover have "\<And>x. x \<in> recurrent_subset A \<Longrightarrow> phiA x > 0" unfolding phiA_def using return_time0 by fastforce
   ultimately have *: "AE x in MA. phiA x > 0" by auto
   have d: "AE x in MA. real_cond_exp MA A.Invariants phiA x > 0"
     by (rule A.real_cond_exp_gr_c, auto simp add: * \<open>integrable MA phiA\<close>)
 
   {
     fix x
     assume A: "(\<lambda>n. A.birkhoff_sum fA n x / n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants fA x"
        and B: "(\<lambda>n. birkhoff_sum f n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x"
        and C: "(\<lambda>n. A.birkhoff_sum (\<lambda>x. real(phiA x)) n x / n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants phiA x"
        and D: "real_cond_exp MA A.Invariants phiA x > 0"
     define R where "R = (\<lambda>n. A.birkhoff_sum phiA n x)"
 
     have D2: "ereal(real_cond_exp MA A.Invariants phiA x) > 0" using D by simp
     have "\<And>n. real(R n)/ n = A.birkhoff_sum (\<lambda>x. real(phiA x)) n x / n" unfolding R_def A.birkhoff_sum_def by auto
     moreover have "(\<lambda>n. A.birkhoff_sum (\<lambda>x. real(phiA x)) n x / n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants phiA x" using C by auto
     ultimately have Rnn: "(\<lambda>n. real(R n)/n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants phiA x" by presburger
 
     have "\<And>n. ereal(real(R n))/ n = ereal(A.birkhoff_sum (\<lambda>x. real(phiA x)) n x / n)" unfolding R_def A.birkhoff_sum_def by auto
     moreover have "(\<lambda>n. ereal(A.birkhoff_sum (\<lambda>x. real(phiA x)) n x / n)) \<longlonglongrightarrow> real_cond_exp MA A.Invariants phiA x" using C by auto
     ultimately have i: "(\<lambda>n. ereal(real(R n))/n) \<longlonglongrightarrow> real_cond_exp MA A.Invariants phiA x" by auto
     have ii: "(\<lambda>n. real n) \<longlonglongrightarrow> \<infinity>" by (rule id_nat_ereal_tendsto_PInf)
     have iii: "(\<lambda>n. ereal(real(R n))/n * real n) \<longlonglongrightarrow> \<infinity>" using tendsto_mult_ereal_PInf[OF i D2 ii] by simp
     have "\<And>n. n > 0 \<Longrightarrow> ereal(real(R n))/n * real n = R n" by auto
     then have "eventually (\<lambda>n. ereal(real(R n))/n * real n = R n) sequentially" using eventually_at_top_dense by auto
     then have "(\<lambda>n. real(R n)) \<longlonglongrightarrow> \<infinity>" using iii by (simp add: filterlim_cong)
     then have "(\<lambda>n. birkhoff_sum f (R n) x / (R n)) \<longlonglongrightarrow> real_cond_exp M Invariants f x" using limit_along_weak_subseq B by auto
     then have l: "(\<lambda>n. (birkhoff_sum f (R n) x / (R n)) * ((R n)/n)) \<longlonglongrightarrow> real_cond_exp M Invariants f x * real_cond_exp MA A.Invariants phiA x"
       by (rule tendsto_mult, simp add: Rnn)
     obtain N where N: "\<And>n. n > N \<Longrightarrow> R n > 0" using \<open>(\<lambda>n. real(R n)) \<longlonglongrightarrow> \<infinity>\<close>
       by (metis (full_types) eventually_at_top_dense filterlim_iff filterlim_weak_subseq)
     then have "\<And>n. n > N \<Longrightarrow> (birkhoff_sum f (R n) x / (R n)) * ((R n)/n) = birkhoff_sum f (R n) x / n"
       by auto
     then have "eventually (\<lambda>n. (birkhoff_sum f (R n) x / (R n)) * ((R n)/n) = birkhoff_sum f (R n) x / n) sequentially"
       by simp
     with tendsto_cong[OF this] have main_limit: "(\<lambda>n. birkhoff_sum f (R n) x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x * real_cond_exp MA A.Invariants phiA x"
       using l by auto
     have "\<And>n. birkhoff_sum f (R n) x = A.birkhoff_sum fA n x"
       unfolding R_def fA_def phiA_def TA_def using induced_function_birkhoff_sum[OF assms(1)] by simp
     then have "\<And>n. birkhoff_sum f (R n) x /n = A.birkhoff_sum fA n x / n" by simp
     then have "(\<lambda>n. A.birkhoff_sum fA n x / n) \<longlonglongrightarrow> real_cond_exp M Invariants f x * real_cond_exp MA A.Invariants phiA x"
       using main_limit by presburger
     then have "real_cond_exp MA A.Invariants fA x = real_cond_exp M Invariants f x * real_cond_exp MA A.Invariants phiA x"
       using A LIMSEQ_unique by auto
   }
   then show ?thesis using a b c d unfolding phiA_def by auto
 qed
 
 corollary Invariants_cond_exp_induced_map_0:
   fixes f::"'a \<Rightarrow> real"
   assumes [measurable]: "A \<in> sets M" "integrable M f" and "AE x in M. real_cond_exp M Invariants f x = 0"
   defines "MA \<equiv> restrict_space M A" and "TA \<equiv> induced_map A" and "fA \<equiv> induced_function A f"
   shows "AE x in MA. real_cond_exp MA (qmpt.Invariants MA TA) fA x = 0"
 proof -
   have "AE x in MA. real_cond_exp M Invariants f x = 0" unfolding MA_def
     apply (subst AE_restrict_space_iff) using assms(3) by auto
   then show ?thesis unfolding MA_def TA_def fA_def using Invariants_cond_exp_induced_map[OF assms(1) assms(2)]
     by auto
 qed
 
 end (*of locale fmpt*)
 end (*of Invariants.thy*)
 
diff --git a/thys/Ergodic_Theory/Measure_Preserving_Transformations.thy b/thys/Ergodic_Theory/Measure_Preserving_Transformations.thy
--- a/thys/Ergodic_Theory/Measure_Preserving_Transformations.thy
+++ b/thys/Ergodic_Theory/Measure_Preserving_Transformations.thy
@@ -1,1638 +1,1638 @@
 (*  Author:  Sébastien Gouëzel   sebastien.gouezel@univ-rennes1.fr
     License: BSD
 *)
 
 section \<open>Measure preserving or quasi-preserving maps\<close>
 
 theory Measure_Preserving_Transformations
   imports SG_Library_Complement
 begin
 
 text \<open>Ergodic theory in general is the study of the properties of measure preserving or
 quasi-preserving dynamical systems. In this section, we introduce the basic definitions
 in this respect.\<close>
 
 subsection \<open>The different classes of transformations\<close>
 
 definition quasi_measure_preserving::"'a measure \<Rightarrow> 'b measure \<Rightarrow> ('a \<Rightarrow> 'b) set"
   where "quasi_measure_preserving M N
     = {f \<in> measurable M N. \<forall> A \<in> sets N. (f -` A \<inter> space M \<in> null_sets M) = (A \<in> null_sets N)}"
 
 lemma quasi_measure_preservingI [intro]:
   assumes "f \<in> measurable M N"
           "\<And>A. A \<in> sets N \<Longrightarrow> (f -` A \<inter> space M \<in> null_sets M) = (A \<in> null_sets N)"
   shows "f \<in> quasi_measure_preserving M N"
 using assms unfolding quasi_measure_preserving_def by auto
 
 lemma quasi_measure_preservingE:
   assumes "f \<in> quasi_measure_preserving M N"
   shows "f \<in> measurable M N"
         "\<And>A. A \<in> sets N \<Longrightarrow> (f -` A \<inter> space M \<in> null_sets M) = (A \<in> null_sets N)"
 using assms unfolding quasi_measure_preserving_def by auto
 
 lemma id_quasi_measure_preserving:
   "(\<lambda>x. x) \<in> quasi_measure_preserving M M"
 unfolding quasi_measure_preserving_def by auto
 
 lemma quasi_measure_preserving_composition:
   assumes "f \<in> quasi_measure_preserving M N"
           "g \<in> quasi_measure_preserving N P"
   shows "(\<lambda>x. g(f x)) \<in> quasi_measure_preserving M P"
 proof (rule quasi_measure_preservingI)
   have f_meas [measurable]: "f \<in> measurable M N" by (rule quasi_measure_preservingE(1)[OF assms(1)])
   have g_meas [measurable]: "g \<in> measurable N P" by (rule quasi_measure_preservingE(1)[OF assms(2)])
   then show [measurable]: "(\<lambda>x. g (f x)) \<in> measurable M P" by auto
 
   fix C assume [measurable]: "C \<in> sets P"
   define B where "B = g-`C \<inter> space N"
   have [measurable]: "B \<in> sets N" unfolding B_def by simp
   have *: "B \<in> null_sets N \<longleftrightarrow> C \<in> null_sets P"
     unfolding B_def using quasi_measure_preservingE(2)[OF assms(2)] by simp
 
   define A where "A = f-`B \<inter> space M"
   have [measurable]: "A \<in> sets M" unfolding A_def by simp
   have "A \<in> null_sets M \<longleftrightarrow> B \<in> null_sets N"
     unfolding A_def using quasi_measure_preservingE(2)[OF assms(1)] by simp
 
   then have "A \<in> null_sets M \<longleftrightarrow> C \<in> null_sets P" using * by simp
   moreover have "A = (\<lambda>x. g (f x)) -` C \<inter> space M"
     by (auto simp add: A_def B_def) (meson f_meas measurable_space)
   ultimately show "((\<lambda>x. g (f x)) -` C \<inter> space M \<in> null_sets M) \<longleftrightarrow> C \<in> null_sets P" by simp
 qed
 
 lemma quasi_measure_preserving_comp:
   assumes "f \<in> quasi_measure_preserving M N"
           "g \<in> quasi_measure_preserving N P"
   shows "g o f \<in> quasi_measure_preserving M P"
 unfolding comp_def using assms quasi_measure_preserving_composition by blast
 
 lemma quasi_measure_preserving_AE:
   assumes "f \<in> quasi_measure_preserving M N"
           "AE x in N. P x"
   shows "AE x in M. P (f x)"
 proof -
   obtain A where "\<And>x. x \<in> space N - A \<Longrightarrow> P x" "A \<in> null_sets N"
     using AE_E3[OF assms(2)] by blast
   define B where "B = f-`A \<inter> space M"
   have "B \<in> null_sets M"
     unfolding B_def using quasi_measure_preservingE(2)[OF assms(1)] \<open>A \<in> null_sets N\<close> by auto
   moreover have "x \<in> space M - B \<Longrightarrow> P (f x)" for x
     using \<open>\<And>x. x \<in> space N - A \<Longrightarrow> P x\<close> quasi_measure_preservingE(1)[OF assms(1)]
     unfolding B_def by (metis (no_types, lifting) Diff_iff IntI measurable_space vimage_eq)
   ultimately show ?thesis using AE_not_in AE_space by force
 qed
 
 lemma quasi_measure_preserving_AE':
   assumes "f \<in> quasi_measure_preserving M N"
           "AE x in M. P (f x)"
           "{x \<in> space N. P x} \<in> sets N"
   shows "AE x in N. P x"
 proof -
   have [measurable]: "f \<in> measurable M N" using quasi_measure_preservingE(1)[OF assms(1)] by simp
   define U where "U = {x \<in> space N. \<not>(P x)}"
   have [measurable]: "U \<in> sets N" unfolding U_def using assms(3) by auto
   have "f-`U \<inter> space M = {x \<in> space M. \<not>(P (f x))}"
     unfolding U_def using \<open>f \<in> measurable M N\<close> by (auto, meson measurable_space)
   also have "... \<in> null_sets M"
     apply (subst AE_iff_null[symmetric]) using assms by auto
   finally have "U \<in> null_sets N"
     using quasi_measure_preservingE(2)[OF assms(1) \<open>U \<in> sets N\<close>] by auto
   then show ?thesis unfolding U_def using AE_iff_null by blast
 qed
 
 text \<open>The push-forward under a quasi-measure preserving map $f$ of a measure absolutely
 continuous with respect to $M$ is absolutely continuous with respect to $N$.\<close>
 lemma quasi_measure_preserving_absolutely_continuous:
   assumes "f \<in> quasi_measure_preserving M N"
           "u \<in> borel_measurable M"
   shows "absolutely_continuous N (distr (density M u) N f)"
 proof -
   have [measurable]: "f \<in> measurable M N" using quasi_measure_preservingE[OF assms(1)] by auto
   have "S \<in> null_sets (distr (density M u) N f)" if [measurable]: "S \<in> null_sets N" for S
   proof -
     have [measurable]: "S \<in> sets N" using null_setsD2[OF that] by auto
     have *: "AE x in N. x \<notin> S"
       by (metis AE_not_in that)
     have "AE x in M. f x \<notin> S"
       by (rule quasi_measure_preserving_AE[OF _ *], simp add: assms)
     then have *: "AE x in M. indicator S (f x) * u x = 0"
       by force
 
     have "emeasure (distr (density M u) N f) S = (\<integral>\<^sup>+x. indicator S x \<partial>(distr (density M u) N f))"
       by auto
     also have "... = (\<integral>\<^sup>+x. indicator S (f x) \<partial>(density M u))"
       by (rule nn_integral_distr, auto)
     also have "... = (\<integral>\<^sup>+x. indicator S (f x) * u x \<partial>M)"
       by (rule nn_integral_densityR[symmetric], auto simp add: assms)
     also have "... = (\<integral>\<^sup>+x. 0 \<partial>M)"
       using * by (rule nn_integral_cong_AE)
     finally have "emeasure (distr (density M u) N f) S = 0" by auto
     then show ?thesis by auto
   qed
   then show ?thesis unfolding absolutely_continuous_def by auto
 qed
 
 definition measure_preserving::"'a measure \<Rightarrow> 'b measure \<Rightarrow> ('a \<Rightarrow> 'b) set"
   where "measure_preserving M N
           = {f \<in> measurable M N. (\<forall> A \<in> sets N. emeasure M (f-`A \<inter> space M) = emeasure N A)}"
 
 lemma measure_preservingE:
   assumes "f \<in> measure_preserving M N"
   shows "f \<in> measurable M N"
         "\<And>A. A \<in> sets N \<Longrightarrow> emeasure M (f-`A \<inter> space M) = emeasure N A"
 using assms unfolding measure_preserving_def by auto
 
 lemma measure_preservingI [intro]:
   assumes "f \<in> measurable M N"
           "\<And>A. A \<in> sets N \<Longrightarrow> emeasure M (f-`A \<inter> space M) = emeasure N A"
   shows "f \<in> measure_preserving M N"
 using assms unfolding measure_preserving_def by auto
 
 lemma measure_preserving_distr:
   assumes "f \<in> measure_preserving M N"
   shows "distr M N f = N"
 proof -
   let ?N2 = "distr M N f"
   have "sets ?N2 = sets N" by simp
   moreover have "emeasure ?N2 A = emeasure N A" if "A \<in> sets N" for A
   proof -
     have "emeasure ?N2 A = emeasure M (f-`A \<inter> space M)"
       using \<open>A \<in> sets N\<close> assms emeasure_distr measure_preservingE(1)[OF assms] by blast
     then show "emeasure ?N2 A = emeasure N A"
       using \<open>A \<in> sets N\<close> measure_preservingE(2)[OF assms] by auto
   qed
   ultimately show ?thesis by (metis measure_eqI)
 qed
 
 lemma measure_preserving_distr':
   assumes "f \<in> measurable M N"
   shows "f \<in> measure_preserving M (distr M N f)"
 proof (rule measure_preservingI)
   show "f \<in> measurable M (distr M N f)" using assms(1) by auto
   show "emeasure M (f-`A \<inter> space M) = emeasure (distr M N f) A" if "A \<in> sets (distr M N f)" for A
     using that emeasure_distr[OF assms] by auto
 qed
 
 lemma measure_preserving_preserves_nn_integral:
   assumes "T \<in> measure_preserving M N"
           "f \<in> borel_measurable N"
   shows "(\<integral>\<^sup>+x. f x \<partial>N) = (\<integral>\<^sup>+x. f (T x) \<partial>M)"
 proof -
   have "(\<integral>\<^sup>+x. f (T x) \<partial>M) = (\<integral>\<^sup>+y. f y \<partial>distr M N T)"
     using assms nn_integral_distr[of T M N f, OF measure_preservingE(1)[OF assms(1)]] by simp
   also have "... = (\<integral>\<^sup>+y. f y \<partial>N)"
     using measure_preserving_distr[OF assms(1)] by simp
   finally show ?thesis by simp
 qed
 
 lemma measure_preserving_preserves_integral:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "T \<in> measure_preserving M N"
       and [measurable]: "integrable N f"
   shows "integrable M (\<lambda>x. f(T x))" "(\<integral>x. f x \<partial>N) = (\<integral>x. f (T x) \<partial>M)"
 proof -
   have a [measurable]: "T \<in> measurable M N" by (rule measure_preservingE(1)[OF assms(1)])
   have b [measurable]: "f \<in> borel_measurable N" by simp
   have "distr M N T = N" using measure_preserving_distr[OF assms(1)] by simp
   then have "integrable (distr M N T) f" using assms(2) by simp
   then show "integrable M (\<lambda>x. f(T x))" using integrable_distr_eq[OF a b] by simp
 
   have "(\<integral>x. f (T x) \<partial>M) = (\<integral>y. f y \<partial>distr M N T)" using integral_distr[OF a b] by simp
   then show "(\<integral>x. f x \<partial>N) = (\<integral>x. f (T x) \<partial>M)" using \<open>distr M N T = N\<close> by simp
 qed
 
 lemma measure_preserving_preserves_integral':
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "T \<in> measure_preserving M N"
       and [measurable]: "integrable M (\<lambda>x. f (T x))" "f \<in> borel_measurable N"
   shows "integrable N f" "(\<integral>x. f x \<partial>N) = (\<integral>x. f (T x) \<partial>M)"
 proof -
   have a [measurable]: "T \<in> measurable M N" by (rule measure_preservingE(1)[OF assms(1)])
   have "integrable M (\<lambda>x. f(T x))" using assms(2) unfolding comp_def by auto
   then have "integrable (distr M N T) f"
     using integrable_distr_eq[OF a assms(3)] by simp
   then show *: "integrable N f" using measure_preserving_distr[OF assms(1)] by simp
 
   then show "(\<integral>x. f x \<partial>N) = (\<integral>x. f (T x) \<partial>M)"
     using measure_preserving_preserves_integral[OF assms(1) *] by simp
 qed
 
 lemma id_measure_preserving:
   "(\<lambda>x. x) \<in> measure_preserving M M"
 unfolding measure_preserving_def by auto
 
 lemma measure_preserving_is_quasi_measure_preserving:
   assumes "f \<in> measure_preserving M N"
   shows "f \<in> quasi_measure_preserving M N"
 using assms unfolding measure_preserving_def quasi_measure_preserving_def apply auto
 by (metis null_setsD1 null_setsI, metis measurable_sets null_setsD1 null_setsI)
 
 lemma measure_preserving_composition:
   assumes "f \<in> measure_preserving M N"
           "g \<in> measure_preserving N P"
   shows "(\<lambda>x. g(f x)) \<in> measure_preserving M P"
 proof (rule measure_preservingI)
   have f [measurable]: "f \<in> measurable M N" by (rule measure_preservingE(1)[OF assms(1)])
   have g [measurable]: "g \<in> measurable N P" by (rule measure_preservingE(1)[OF assms(2)])
   show [measurable]: "(\<lambda>x. g (f x)) \<in> measurable M P" by auto
 
   fix C assume [measurable]: "C \<in> sets P"
   define B where "B = g-`C \<inter> space N"
   have [measurable]: "B \<in> sets N" unfolding B_def by simp
   have *: "emeasure N B = emeasure P C"
     unfolding B_def using measure_preservingE(2)[OF assms(2)] by simp
 
   define A where "A = f-`B \<inter> space M"
   have [measurable]: "A \<in> sets M" unfolding A_def by simp
   have "emeasure M A = emeasure N B"
     unfolding A_def using measure_preservingE(2)[OF assms(1)] by simp
 
   then have "emeasure M A = emeasure P C" using * by simp
   moreover have "A = (\<lambda>x. g(f x))-`C \<inter> space M"
     by (auto simp add: A_def B_def) (meson f measurable_space)
   ultimately show "emeasure M ((\<lambda>x. g(f x))-`C \<inter> space M) = emeasure P C" by simp
 qed
 
 lemma measure_preserving_comp:
   assumes "f \<in> measure_preserving M N"
           "g \<in> measure_preserving N P"
   shows "g o f \<in> measure_preserving M P"
 unfolding o_def using measure_preserving_composition assms by blast
 
 lemma measure_preserving_total_measure:
   assumes "f \<in> measure_preserving M N"
   shows "emeasure M (space M) = emeasure N (space N)"
 proof -
   have "f \<in> measurable M N" by (rule measure_preservingE(1)[OF assms(1)])
   then have "f-`(space N) \<inter> space M = space M" by (meson Int_absorb1 measurable_space subsetI vimageI)
   then show "emeasure M (space M) = emeasure N (space N)"
     by (metis (mono_tags, lifting) measure_preservingE(2)[OF assms(1)] sets.top)
 qed
 
 lemma measure_preserving_finite_measure:
   assumes "f \<in> measure_preserving M N"
   shows "finite_measure M \<longleftrightarrow> finite_measure N"
 using measure_preserving_total_measure[OF assms]
 by (metis finite_measure.emeasure_finite finite_measureI infinity_ennreal_def)
 
 lemma measure_preserving_prob_space:
   assumes "f \<in> measure_preserving M N"
   shows "prob_space M \<longleftrightarrow> prob_space N"
 using measure_preserving_total_measure[OF assms] by (metis prob_space.emeasure_space_1 prob_spaceI)
 
 locale qmpt = sigma_finite_measure +
   fixes T
   assumes Tqm: "T \<in> quasi_measure_preserving M M"
 
 locale mpt = qmpt +
   assumes Tm: "T \<in> measure_preserving M M"
 
 locale fmpt = mpt + finite_measure
 
 locale pmpt = fmpt + prob_space
 
 lemma qmpt_I:
   assumes "sigma_finite_measure M"
           "T \<in> measurable M M"
           "\<And>A. A \<in> sets M \<Longrightarrow> ((T-`A \<inter> space M) \<in> null_sets M) \<longleftrightarrow> (A \<in> null_sets M)"
   shows "qmpt M T"
 unfolding qmpt_def qmpt_axioms_def quasi_measure_preserving_def
 by (auto simp add: assms)
 
 lemma mpt_I:
   assumes "sigma_finite_measure M"
           "T \<in> measurable M M"
           "\<And>A. A \<in> sets M \<Longrightarrow> emeasure M (T-`A \<inter> space M) = emeasure M A"
   shows "mpt M T"
 proof -
   have *: "T \<in> measure_preserving M M"
     by (rule measure_preservingI[OF assms(2) assms(3)])
   then have **: "T \<in> quasi_measure_preserving M M"
     using measure_preserving_is_quasi_measure_preserving by auto
   show "mpt M T"
     unfolding mpt_def qmpt_def qmpt_axioms_def mpt_axioms_def using * ** assms(1) by auto
 qed
 
 lemma fmpt_I:
   assumes "finite_measure M"
           "T \<in> measurable M M"
           "\<And>A. A \<in> sets M \<Longrightarrow> emeasure M (T-`A \<inter> space M) = emeasure M A"
   shows "fmpt M T"
 proof -
   have *: "T \<in> measure_preserving M M"
     by (rule measure_preservingI[OF assms(2) assms(3)])
   then have **: "T \<in> quasi_measure_preserving M M"
     using measure_preserving_is_quasi_measure_preserving by auto
   show "fmpt M T"
     unfolding fmpt_def mpt_def qmpt_def mpt_axioms_def qmpt_axioms_def
     using * ** assms(1) finite_measure_def by auto
 qed
 
 lemma pmpt_I:
   assumes "prob_space M"
           "T \<in> measurable M M"
           "\<And>A. A \<in> sets M \<Longrightarrow> emeasure M (T-`A \<inter> space M) = emeasure M A"
   shows "pmpt M T"
 proof -
   have *: "T \<in> measure_preserving M M"
     by (rule measure_preservingI[OF assms(2) assms(3)])
   then have **: "T \<in> quasi_measure_preserving M M"
     using measure_preserving_is_quasi_measure_preserving by auto
   show "pmpt M T"
     unfolding pmpt_def fmpt_def mpt_def qmpt_def mpt_axioms_def qmpt_axioms_def
     using * ** assms(1) prob_space_imp_sigma_finite prob_space.finite_measure by auto
 qed
 
 subsection \<open>Examples\<close>
 
 lemma fmpt_null_space:
   assumes "emeasure M (space M) = 0"
           "T \<in> measurable M M"
   shows "fmpt M T"
 apply (rule fmpt_I)
 apply (auto simp add: assms finite_measureI)
 apply (metis assms emeasure_eq_0 measurable_sets sets.sets_into_space sets.top)
 done
 
 lemma fmpt_empty_space:
   assumes "space M = {}"
   shows "fmpt M T"
 by (rule fmpt_null_space, auto simp add: assms measurable_empty_iff)
 
 text \<open>Translations are measure-preserving\<close>
 
 lemma mpt_translation:
   fixes c :: "'a::euclidean_space"
   shows "mpt lborel (\<lambda>x. x + c)"
 proof (rule mpt_I, auto simp add: lborel.sigma_finite_measure_axioms)
   fix A::"'a set" assume [measurable]: "A \<in> sets borel"
   have "emeasure lborel ((\<lambda>x. x + c) -` A) = emeasure lborel ((((+))c)-`A)" by (meson add.commute)
   also have "... = emeasure lborel ((((+))c)-`A \<inter> space lborel)" by simp
   also have "... = emeasure (distr lborel borel ((+) c)) A" by (rule emeasure_distr[symmetric], auto)
-  also have "... = emeasure lborel A" using lborel_distr_plus2[of c] by simp
+  also have "... = emeasure lborel A" using lborel_distr_plus[of c] by simp
   finally show "emeasure lborel ((\<lambda>x. x + c) -` A) = emeasure lborel A" by simp
 qed
 
 text \<open>Skew products are fibered maps of the form $(x,y)\mapsto (Tx, U(x,y))$. If the base map
 and the fiber maps all are measure preserving, so is the skew product.\<close>
 
 lemma pair_measure_null_product:
   assumes "emeasure M (space M) = 0"
   shows "emeasure (M \<Otimes>\<^sub>M N) (space (M \<Otimes>\<^sub>M N)) = 0"
 proof -
   have "(\<integral>\<^sup>+x. (\<integral>\<^sup>+y. indicator X (x,y) \<partial>N) \<partial>M) = 0" for X
   proof -
     have "(\<integral>\<^sup>+x. (\<integral>\<^sup>+y. indicator X (x,y) \<partial>N) \<partial>M) = (\<integral>\<^sup>+x. 0 \<partial>M)"
       by (intro nn_integral_cong_AE emeasure_0_AE[OF assms])
     then show ?thesis by auto
   qed
   then have "M \<Otimes>\<^sub>M N = measure_of (space M \<times> space N)
       {a \<times> b | a b. a \<in> sets M \<and> b \<in> sets N}
       (\<lambda>X. 0)"
     unfolding pair_measure_def by auto
   then show ?thesis by (simp add: emeasure_sigma)
 qed
 
 lemma mpt_skew_product:
   assumes "mpt M T"
           "AE x in M. mpt N (U x)"
     and [measurable]: "(\<lambda>(x,y). U x y) \<in> measurable (M \<Otimes>\<^sub>M N) N"
   shows "mpt (M \<Otimes>\<^sub>M N) (\<lambda>(x,y). (T x, U x y))"
 proof (cases)
   assume H: "emeasure M (space M) = 0"
   then have *: "emeasure (M \<Otimes>\<^sub>M N) (space (M \<Otimes>\<^sub>M N)) = 0"
     using pair_measure_null_product by auto
   have [measurable]: "T \<in> measurable M M"
     using assms(1) unfolding mpt_def qmpt_def qmpt_axioms_def quasi_measure_preserving_def by auto
   then have [measurable]: "(\<lambda>(x, y). (T x, U x y)) \<in> measurable (M \<Otimes>\<^sub>M N) (M \<Otimes>\<^sub>M N)" by auto
   with fmpt_null_space[OF *] show ?thesis by (simp add: fmpt.axioms(1))
 next
   assume "\<not>(emeasure M (space M) = 0)"
   show ?thesis
   proof (rule mpt_I)
     have "sigma_finite_measure M" using assms(1) unfolding mpt_def qmpt_def by auto
     then interpret M: sigma_finite_measure M .
 
     have "\<exists>p. \<not> almost_everywhere M p"
       by (metis (lifting) AE_E \<open>emeasure M (space M) \<noteq> 0\<close> emeasure_eq_AE emeasure_notin_sets)
     then have "\<exists>x. mpt N (U x)" using assms(2) \<open>\<not>(emeasure M (space M) = 0)\<close>
       by (metis (full_types) \<open>AE x in M. mpt N (U x)\<close> eventually_mono)
     then have "sigma_finite_measure N" unfolding mpt_def qmpt_def by auto
     then interpret N: sigma_finite_measure N .
     show "sigma_finite_measure (M \<Otimes>\<^sub>M N)"
       by (rule sigma_finite_pair_measure) standard+
 
     have [measurable]: "T \<in> measurable M M"
       using assms(1) unfolding mpt_def qmpt_def qmpt_axioms_def quasi_measure_preserving_def by auto
     show [measurable]: "(\<lambda>(x, y). (T x, U x y)) \<in> measurable (M \<Otimes>\<^sub>M N) (M \<Otimes>\<^sub>M N)" by auto
     have "T \<in> measure_preserving M M" using assms(1) by (simp add: mpt.Tm)
 
     fix A assume [measurable]: "A \<in> sets (M \<Otimes>\<^sub>M N)"
     then have [measurable]: "(\<lambda> (x,y). (indicator A (x,y))::ennreal) \<in> borel_measurable (M \<Otimes>\<^sub>M N)" by auto
     then have [measurable]: "(\<lambda>x. \<integral>\<^sup>+ y. indicator A (x, y) \<partial>N) \<in> borel_measurable M"
       by simp
 
     define B where "B = (\<lambda>(x, y). (T x, U x y)) -` A \<inter> space (M \<Otimes>\<^sub>M N)"
     then have [measurable]: "B \<in> sets (M \<Otimes>\<^sub>M N)" by auto
 
     have "(\<integral>\<^sup>+y. indicator B (x,y) \<partial>N) = (\<integral>\<^sup>+y. indicator A (T x, y) \<partial>N)" if "x \<in> space M" "mpt N (U x)" for x
     proof -
       have "T x \<in> space M" by (meson \<open>T \<in> measurable M M\<close> \<open>x \<in> space M\<close> measurable_space)
       then have 1: "(\<lambda>y. (indicator A (T x, y))::ennreal) \<in> borel_measurable N" using \<open>A \<in> sets (M \<Otimes>\<^sub>M N)\<close> by auto
       have 2: "\<And>y. ((indicator B (x, y))::ennreal) = indicator A (T x, U x y) * indicator (space M) x * indicator (space N) y"
         unfolding B_def by (simp add: indicator_def space_pair_measure)
       have 3: "U x \<in> measure_preserving N N" using assms(2) that(2) by (simp add: mpt.Tm)
 
       have "(\<integral>\<^sup>+y. indicator B (x,y) \<partial>N) = (\<integral>\<^sup>+y. indicator A (T x, U x y) \<partial>N)"
         using 2 by (intro nn_integral_cong_simp) (auto simp add: indicator_def \<open>x \<in> space M\<close>)
       also have "... = (\<integral>\<^sup>+y. indicator A (T x, y) \<partial>N)"
         by (rule measure_preserving_preserves_nn_integral[OF 3, symmetric], metis 1)
       finally show ?thesis by simp
     qed
     then have *: "AE x in M. (\<integral>\<^sup>+y. indicator B (x,y) \<partial>N) = (\<integral>\<^sup>+y. indicator A (T x, y) \<partial>N)"
       using assms(2) by auto
 
     have "emeasure (M \<Otimes>\<^sub>M N) B = (\<integral>\<^sup>+ x. (\<integral>\<^sup>+y. indicator B (x,y) \<partial>N) \<partial>M)"
       using \<open>B \<in> sets (M \<Otimes>\<^sub>M N)\<close> \<open>sigma_finite_measure N\<close> sigma_finite_measure.emeasure_pair_measure by fastforce
     also have "... = (\<integral>\<^sup>+ x. (\<integral>\<^sup>+y. indicator A (T x, y) \<partial>N) \<partial>M)"
       by (intro nn_integral_cong_AE *)
     also have "... = (\<integral>\<^sup>+ x. (\<integral>\<^sup>+y. indicator A (x, y) \<partial>N) \<partial>M)"
       by (rule measure_preserving_preserves_nn_integral[OF \<open>T \<in> measure_preserving M M\<close>, symmetric]) auto
     also have "... = emeasure (M \<Otimes>\<^sub>M N) A"
       by (simp add: \<open>sigma_finite_measure N\<close> sigma_finite_measure.emeasure_pair_measure)
     finally show "emeasure (M \<Otimes>\<^sub>M N) ((\<lambda>(x, y). (T x, U x y)) -` A \<inter> space (M \<Otimes>\<^sub>M N)) = emeasure (M \<Otimes>\<^sub>M N) A"
       unfolding B_def by simp
   qed
 qed
 
 lemma mpt_skew_product_real:
   fixes f::"'a \<Rightarrow> 'b::euclidean_space"
   assumes "mpt M T" and [measurable]: "f \<in> borel_measurable M"
   shows "mpt (M \<Otimes>\<^sub>M lborel) (\<lambda>(x,y). (T x, y + f x))"
 by (rule mpt_skew_product, auto simp add: mpt_translation assms(1))
 
 
 subsection \<open>Preimages restricted to $space M$\<close>
 
 context qmpt begin
 
 text \<open>One is all the time lead to take the preimages of sets, and restrict them to
 \verb+space M+ where the dynamics is living. We introduce a shortcut for this notion.\<close>
 
 definition vimage_restr :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a set \<Rightarrow> 'a set" (infixr "--`" 90)
 where
   "f --` A \<equiv> f-` (A \<inter> space M) \<inter> space M"
 
 lemma vrestr_eq [simp]:
   "a \<in> f--` A \<longleftrightarrow> a \<in> space M \<and> f a \<in> A \<inter> space M"
 unfolding vimage_restr_def by auto
 
 lemma vrestr_intersec [simp]:
   "f--` (A \<inter> B) = (f--`A) \<inter> (f--` B)"
 using vimage_restr_def by auto
 
 lemma vrestr_union [simp]:
   "f--` (A \<union> B) = f--`A \<union> f--`B"
 using vimage_restr_def by auto
 
 lemma vrestr_difference [simp]:
   "f--`(A-B) = f--`A - f--`B"
 using vimage_restr_def by auto
 
 lemma vrestr_inclusion:
   "A \<subseteq> B \<Longrightarrow> f--`A \<subseteq> f--`B"
 using vimage_restr_def by auto
 
 lemma vrestr_Union [simp]:
   "f --` (\<Union>A) = (\<Union>X\<in>A. f --` X)"
 using vimage_restr_def by auto
 
 lemma vrestr_UN [simp]:
   "f --` (\<Union>x\<in>A. B x) = (\<Union>x\<in>A. f --` B x)"
 using vimage_restr_def by auto
 
 lemma vrestr_Inter [simp]:
   assumes "A \<noteq> {}"
   shows "f --` (\<Inter>A) = (\<Inter>X\<in>A. f --` X)"
 using vimage_restr_def assms by auto
 
 lemma vrestr_INT [simp]:
   assumes "A \<noteq> {}"
   shows "f --` (\<Inter>x\<in>A. B x) = (\<Inter>x\<in>A. f --` B x)"
 using vimage_restr_def assms by auto
 
 lemma vrestr_empty [simp]:
   "f--`{} = {}"
 using vimage_restr_def by auto
 
 lemma vrestr_sym_diff [simp]:
   "f--`(A \<Delta> B) = (f--`A) \<Delta> (f--`B)"
 by auto
 
 lemma vrestr_image:
   assumes "x \<in> f--`A"
   shows "x \<in> space M" "f x \<in> space M" "f x \<in> A"
 using assms unfolding vimage_restr_def by auto
 
 lemma vrestr_intersec_in_space:
   assumes "A \<in> sets M" "B \<in> sets M"
   shows "A \<inter> f--`B = A \<inter> f-`B"
 unfolding vimage_restr_def using assms sets.sets_into_space by auto
 
 lemma vrestr_compose:
   assumes "g \<in> measurable M M"
   shows "(\<lambda> x. f(g x))--` A = g--` (f--` A)"
 proof -
   define B where "B = A \<inter> space M"
   have "(\<lambda> x. f(g x))--` A = (\<lambda> x. f(g x)) -` B \<inter> space M"
     using B_def vimage_restr_def by blast
   moreover have "(\<lambda> x. f(g x)) -` B \<inter> space M = g-` (f-` B \<inter> space M) \<inter> space M"
     using measurable_space[OF \<open>g \<in> measurable M M\<close>] by auto
   moreover have "g-` (f-` B \<inter> space M) \<inter> space M = g--` (f--` A)"
     using B_def vimage_restr_def by simp
   ultimately show ?thesis by auto
 qed
 
 lemma vrestr_comp:
   assumes "g \<in> measurable M M"
   shows "(f o g)--` A = g--` (f--` A)"
 proof -
   have "f o g = (\<lambda> x. f(g x))" by auto
   then have "(f o g)--` A = (\<lambda> x. f(g x))--` A" by auto
   moreover have "(\<lambda> x. f(g x))--` A = g--` (f--` A)" using vrestr_compose assms by auto
   ultimately show ?thesis by simp
 qed
 
 lemma vrestr_of_set:
   assumes "g \<in> measurable M M"
   shows "A \<in> sets M \<Longrightarrow> g--`A = g-`A \<inter> space M"
 by (simp add: vimage_restr_def)
 
 lemma vrestr_meas [measurable (raw)]:
   assumes "g \<in> measurable M M"
           "A \<in> sets M"
   shows "g--`A \<in> sets M"
 using assms vimage_restr_def by auto
 
 lemma vrestr_same_emeasure_f:
   assumes "f \<in> measure_preserving M M"
           "A \<in> sets M"
   shows "emeasure M (f--`A) = emeasure M A"
 by (metis (mono_tags, lifting) assms measure_preserving_def mem_Collect_eq sets.Int_space_eq2 vimage_restr_def)
 
 lemma vrestr_same_measure_f:
   assumes "f \<in> measure_preserving M M"
           "A \<in> sets M"
   shows "measure M (f--`A) = measure M A"
 proof -
   have "measure M (f--`A) = enn2real (emeasure M (f--`A))" by (simp add: Sigma_Algebra.measure_def)
   also have "... = enn2real (emeasure M A)" using vrestr_same_emeasure_f[OF assms] by simp
   also have "... = measure M A" by (simp add: Sigma_Algebra.measure_def)
   finally show "measure M (f--` A) = measure M A" by simp
 qed
 
 
 subsection \<open>Basic properties of qmpt\<close>
 
 lemma T_meas [measurable (raw)]:
   "T \<in> measurable M M"
 by (rule quasi_measure_preservingE(1)[OF Tqm])
 
 lemma Tn_quasi_measure_preserving:
   "T^^n \<in> quasi_measure_preserving M M"
 proof (induction n)
     case 0
     show ?case using id_quasi_measure_preserving by simp
   next
     case (Suc n)
     then show ?case using Tqm quasi_measure_preserving_comp by (metis funpow_Suc_right)
 qed
 
 lemma Tn_meas [measurable (raw)]:
   "T^^n \<in> measurable M M"
 by (rule quasi_measure_preservingE(1)[OF Tn_quasi_measure_preserving])
 
 lemma T_vrestr_meas [measurable]:
   assumes "A \<in> sets M"
   shows "T--` A \<in> sets M"
         "(T^^n)--` A \<in> sets M"
 by (auto simp add: vrestr_meas assms)
 
 text \<open>We state the next lemma both with $T^0$ and with $id$ as sometimes the simplifier
 simplifies $T^0$ to $id$ before applying the first instance of the lemma.\<close>
 
 lemma T_vrestr_0 [simp]:
   assumes "A \<in> sets M"
   shows "(T^^0)--`A = A"
         "id--`A = A"
 using sets.sets_into_space[OF assms] by auto
 
 lemma T_vrestr_composed:
   assumes "A \<in> sets M"
   shows "(T^^n)--` (T^^m)--` A = (T^^(n+m))--` A"
         "T--` (T^^m)--` A = (T^^(m+1))--` A"
         "(T^^m)--` T--` A = (T^^(m+1))--` A"
 proof -
   show "(T^^n)--` (T^^m)--` A = (T^^(n+m))--` A"
     by (simp add: Tn_meas funpow_add add.commute vrestr_comp)
   show "T--` (T^^m)--` A = (T^^(m+1))--` A"
     by (metis Suc_eq_plus1 T_meas funpow_Suc_right vrestr_comp)
   show "(T^^m)--` T--` A = (T^^(m+1))--` A"
     by (simp add: Tn_meas vrestr_comp)
 qed
 
 text \<open>In the next two lemmas, we give measurability statements that show up all the time
 for the usual preimage.\<close>
 
 lemma T_intersec_meas [measurable]:
   assumes [measurable]: "A \<in> sets M" "B \<in> sets M"
   shows "A \<inter> T-`B \<in> sets M"
         "A \<inter> (T^^n)-`B \<in> sets M"
         "T-`A \<inter> B \<in> sets M"
         "(T^^n)-`A \<inter> B \<in> sets M"
         "A \<inter> (T \<circ> T ^^ n) -` B \<in> sets M"
         "(T \<circ> T ^^ n) -` A \<inter> B \<in> sets M"
 by (metis T_meas Tn_meas assms(1) assms(2) measurable_comp sets.Int inf_commute
       vrestr_intersec_in_space vrestr_meas)+
 
 lemma T_diff_meas [measurable]:
   assumes [measurable]: "A \<in> sets M" "B \<in> sets M"
   shows "A - T-`B \<in> sets M"
         "A - (T^^n)-`B \<in> sets M"
 proof -
   have "A - T-`B = A \<inter> space M - (T-`B \<inter> space M)"
     using sets.sets_into_space[OF assms(1)] by auto
   then show "A - T-`B \<in> sets M" by auto
   have "A - (T^^n)-`B = A \<inter> space M - ((T^^n)-`B \<inter> space M)"
     using sets.sets_into_space[OF assms(1)] by auto
   then show "A - (T^^n)-`B \<in> sets M" by auto
 qed
 
 lemma T_spaceM_stable [simp]:
   assumes "x \<in> space M"
   shows "T x \<in> space M"
         "(T^^n) x \<in> space M"
 proof -
   show "T x \<in> space M" by (meson measurable_space T_meas measurable_def assms)
   show "(T^^n) x \<in> space M" by (meson measurable_space Tn_meas measurable_def assms)
 qed
 
 lemma T_quasi_preserves_null:
   assumes "A \<in> sets M"
   shows "A \<in> null_sets M \<longleftrightarrow> T--` A \<in> null_sets M"
         "A \<in> null_sets M \<longleftrightarrow> (T^^n)--` A \<in> null_sets M"
 using Tqm Tn_quasi_measure_preserving unfolding quasi_measure_preserving_def
 by (auto simp add: assms vimage_restr_def)
 
 lemma T_quasi_preserves:
   assumes "A \<in> sets M"
   shows "emeasure M A = 0 \<longleftrightarrow> emeasure M (T--` A) = 0"
         "emeasure M A = 0 \<longleftrightarrow> emeasure M ((T^^n)--` A) = 0"
 using T_quasi_preserves_null[OF assms] T_vrestr_meas assms by blast+
 
 lemma T_quasi_preserves_null2:
   assumes "A \<in> null_sets M"
   shows "T--` A \<in> null_sets M"
         "(T^^n)--` A \<in> null_sets M"
 using T_quasi_preserves_null[OF null_setsD2[OF assms]] assms by auto
 
 lemma T_composition_borel [measurable]:
   assumes "f \<in> borel_measurable M"
   shows "(\<lambda>x. f(T x)) \<in> borel_measurable M" "(\<lambda>x. f((T^^k) x)) \<in> borel_measurable M"
 using T_meas Tn_meas assms measurable_compose by auto
 
 lemma T_AE_iterates:
   assumes "AE x in M. P x"
   shows "AE x in M. \<forall>n. P ((T^^n) x)"
 proof -
   have "AE x in M. P ((T^^n) x)" for n
     by (rule quasi_measure_preserving_AE[OF Tn_quasi_measure_preserving[of n] assms])
   then show ?thesis unfolding AE_all_countable by simp
 qed
 
 lemma qmpt_power:
   "qmpt M (T^^n)"
 by (standard, simp add: Tn_quasi_measure_preserving)
 
 lemma T_Tn_T_compose:
   "T ((T^^n) x) = (T^^(Suc n)) x"
   "(T^^n) (T x) = (T^^(Suc n)) x"
 by (auto simp add: funpow_swap1)
 
 lemma (in qmpt) qmpt_density:
   assumes [measurable]: "h \<in> borel_measurable M"
       and "AE x in M. h x \<noteq> 0" "AE x in M. h x \<noteq> \<infinity>"
   shows "qmpt (density M h) T"
 proof -
   interpret A: sigma_finite_measure "density M h"
     apply (subst sigma_finite_iff_density_finite) using assms by auto
   show ?thesis
     apply (standard) apply (rule quasi_measure_preservingI)
     unfolding null_sets_density[OF \<open>h \<in> borel_measurable M\<close> \<open>AE x in M. h x \<noteq> 0\<close>] sets_density space_density
     using quasi_measure_preservingE(2)[OF Tqm] by auto
 qed
 
 end
 
 
 
 
 subsection \<open>Basic properties of mpt\<close>
 
 context mpt
 begin
 
 lemma Tn_measure_preserving:
   "T^^n \<in> measure_preserving M M"
 proof (induction n)
     case (Suc n)
     then show ?case using Tm measure_preserving_comp by (metis funpow_Suc_right)
 qed (simp add: id_measure_preserving)
 
 lemma T_integral_preserving:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "integrable M f"
   shows "integrable M (\<lambda>x. f(T x))" "(\<integral>x. f(T x) \<partial>M) = (\<integral>x. f x \<partial>M)"
 using measure_preserving_preserves_integral[OF Tm assms] by auto
 
 lemma Tn_integral_preserving:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "integrable M f"
   shows "integrable M (\<lambda>x. f((T^^n) x))" "(\<integral>x. f((T^^n) x) \<partial>M) = (\<integral>x. f x \<partial>M)"
 using measure_preserving_preserves_integral[OF Tn_measure_preserving assms] by auto
 
 lemma T_nn_integral_preserving:
   fixes f :: "'a \<Rightarrow> ennreal"
   assumes "f \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+x. f(T x) \<partial>M) = (\<integral>\<^sup>+x. f x \<partial>M)"
 using measure_preserving_preserves_nn_integral[OF Tm assms] by auto
 
 lemma Tn_nn_integral_preserving:
   fixes f :: "'a \<Rightarrow> ennreal"
   assumes "f \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+x. f((T^^n) x) \<partial>M) = (\<integral>\<^sup>+x. f x \<partial>M)"
 using measure_preserving_preserves_nn_integral[OF Tn_measure_preserving assms(1)] by auto
 
 lemma mpt_power:
   "mpt M (T^^n)"
 by (standard, simp_all add: Tn_quasi_measure_preserving Tn_measure_preserving)
 
 lemma T_vrestr_same_emeasure:
   assumes "A \<in> sets M"
   shows "emeasure M (T--` A) = emeasure M A"
         "emeasure M ((T ^^ n)--`A) = emeasure M A"
 by (auto simp add: vrestr_same_emeasure_f Tm Tn_measure_preserving assms)
 
 lemma T_vrestr_same_measure:
   assumes "A \<in> sets M"
   shows "measure M (T--` A) = measure M A"
         "measure M ((T ^^ n)--`A) = measure M A"
 by (auto simp add: vrestr_same_measure_f Tm Tn_measure_preserving assms)
 
 lemma (in fmpt) fmpt_power:
   "fmpt M (T^^n)"
 by (standard, simp_all add: Tn_quasi_measure_preserving Tn_measure_preserving)
 
 
 end
 
 
 subsection \<open>Birkhoff sums\<close>
 
 text \<open>Birkhoff sums, obtained by summing a function along the orbit of a map, are basic objects
 to be understood in ergodic theory.\<close>
 
 context qmpt
 begin
 
 definition birkhoff_sum::"('a \<Rightarrow> 'b::comm_monoid_add) \<Rightarrow> nat \<Rightarrow> 'a \<Rightarrow> 'b"
   where "birkhoff_sum f n x = (\<Sum>i\<in>{..<n}. f((T^^i)x))"
 
 lemma birkhoff_sum_meas [measurable]:
   fixes f::"'a \<Rightarrow> 'b::{second_countable_topology, topological_comm_monoid_add}"
   assumes "f \<in> borel_measurable M"
   shows "birkhoff_sum f n \<in> borel_measurable M"
 proof -
   define F where "F = (\<lambda>i x. f((T^^i)x))"
   have "\<And>i. F i \<in> borel_measurable M" using assms F_def by auto
   then have "(\<lambda>x. (\<Sum>i<n. F i x)) \<in> borel_measurable M" by measurable
   then have "(\<lambda>x. birkhoff_sum f n x) \<in> borel_measurable M" unfolding birkhoff_sum_def F_def by auto
   then show ?thesis by simp
 qed
 
 lemma birkhoff_sum_1 [simp]:
   "birkhoff_sum f 0 x = 0"
   "birkhoff_sum f 1 x = f x"
   "birkhoff_sum f (Suc 0) x = f x"
 unfolding birkhoff_sum_def by auto
 
 lemma birkhoff_sum_cocycle:
   "birkhoff_sum f (n+m) x = birkhoff_sum f n x + birkhoff_sum f m ((T^^n)x)"
 proof -
   have "(\<Sum>i<m. f ((T ^^ i) ((T ^^ n) x))) = (\<Sum>i<m. f ((T ^^ (i+n)) x))" by (simp add: funpow_add)
   also have "... = (\<Sum>j\<in>{n..< m+n}. f ((T ^^j) x))"
     using atLeast0LessThan sum.shift_bounds_nat_ivl[where ?g = "\<lambda>j. f((T^^j)x)" and ?k = n and ?m = 0 and ?n = m, symmetric]
           add.commute add.left_neutral by auto
   finally have *: "birkhoff_sum f m ((T^^n)x) = (\<Sum>j\<in>{n..< m+n}. f ((T ^^j) x))" unfolding birkhoff_sum_def by auto
   have "birkhoff_sum f (n+m) x = (\<Sum>i<n. f((T^^i)x)) + (\<Sum>i\<in>{n..<m+n}. f((T^^i)x))"
     unfolding birkhoff_sum_def by (metis add.commute add.right_neutral atLeast0LessThan le_add2 sum.atLeastLessThan_concat)
   also have "... = birkhoff_sum f n x + (\<Sum>i\<in>{n..<m+n}. f((T^^i)x))" unfolding birkhoff_sum_def by simp
   finally show ?thesis using * by simp
 qed
 
 lemma birkhoff_sum_mono:
   fixes f g::"_ \<Rightarrow> real"
   assumes "\<And>x. f x \<le> g x"
   shows "birkhoff_sum f n x \<le> birkhoff_sum g n x"
 unfolding birkhoff_sum_def by (simp add: assms sum_mono)
 
 lemma birkhoff_sum_abs:
   fixes f::"_ \<Rightarrow> 'b::real_normed_vector"
   shows "norm(birkhoff_sum f n x) \<le> birkhoff_sum (\<lambda>x. norm(f x)) n x"
 unfolding birkhoff_sum_def using norm_sum by auto
 
 lemma birkhoff_sum_add:
   "birkhoff_sum (\<lambda>x. f x + g x) n x = birkhoff_sum f n x + birkhoff_sum g n x"
 unfolding birkhoff_sum_def by (simp add: sum.distrib)
 
 lemma birkhoff_sum_diff:
   fixes f g::"_ \<Rightarrow> real"
   shows "birkhoff_sum (\<lambda>x. f x - g x) n x = birkhoff_sum f n x - birkhoff_sum g n x"
 unfolding birkhoff_sum_def by (simp add: sum_subtractf)
 
 lemma birkhoff_sum_cmult:
   fixes f::"_ \<Rightarrow> real"
   shows "birkhoff_sum (\<lambda>x. c * f x) n x = c * birkhoff_sum f n x"
 unfolding birkhoff_sum_def by (simp add: sum_distrib_left)
 
 lemma skew_product_real_iterates:
   fixes f::"'a \<Rightarrow> real"
   shows "((\<lambda>(x,y). (T x, y + f x))^^n) (x,y) = ((T^^n) x, y + birkhoff_sum f n x)"
 apply (induction n)
 apply (auto)
 apply (metis (no_types, lifting) Suc_eq_plus1 birkhoff_sum_cocycle qmpt.birkhoff_sum_1(2) qmpt_axioms)
 done
 
 end
 
 lemma (in mpt) birkhoff_sum_integral:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "integrable M f"
   shows "integrable M (birkhoff_sum f n)" "(\<integral>x. birkhoff_sum f n x \<partial>M) = n *\<^sub>R (\<integral>x. f x \<partial>M)"
 proof -
   have a: "\<And>k. integrable M (\<lambda>x. f((T^^k) x))"
     using Tn_integral_preserving(1) assms by blast
   then have "integrable M (\<lambda>x. \<Sum>k\<in>{..<n}. f((T^^k) x))" by simp
   then have "integrable M (\<lambda>x. birkhoff_sum f n x)" unfolding birkhoff_sum_def by auto
   then show "integrable M (birkhoff_sum f n)" by simp
 
   have b: "\<And>k. (\<integral>x. f((T^^k)x) \<partial>M) = (\<integral>x. f x \<partial>M)"
     using Tn_integral_preserving(2) assms by blast
   have "(\<integral>x. birkhoff_sum f n x \<partial>M) = (\<integral>x. (\<Sum>k\<in>{..<n}. f((T^^k) x)) \<partial>M)"
     unfolding birkhoff_sum_def by blast
   also have "... = (\<Sum>k\<in>{..<n}. (\<integral>x. f((T^^k) x) \<partial>M))"
     by (rule Bochner_Integration.integral_sum, simp add: a)
   also have "... = (\<Sum>k\<in>{..<n}. (\<integral>x. f x \<partial>M))" using b by simp
   also have "... = n *\<^sub>R (\<integral>x. f x \<partial>M)" by (simp add: sum_constant_scaleR)
   finally show "(\<integral>x. birkhoff_sum f n x \<partial>M) = n *\<^sub>R (\<integral>x. f x \<partial>M)" by simp
 qed
 
 lemma (in mpt) birkhoff_sum_nn_integral:
   fixes f :: "'a \<Rightarrow> ennreal"
   assumes [measurable]: "f \<in> borel_measurable M" and pos: "\<And>x. f x \<ge> 0"
   shows "(\<integral>\<^sup>+x. birkhoff_sum f n x \<partial>M) = n * (\<integral>\<^sup>+x. f x \<partial>M)"
 proof -
   have [measurable]: "\<And>k. (\<lambda>x. f((T^^k)x)) \<in> borel_measurable M" by simp
   have posk: "\<And>k x. f((T^^k)x) \<ge> 0" using pos by simp
   have b: "\<And>k. (\<integral>\<^sup>+x. f((T^^k)x) \<partial>M) = (\<integral>\<^sup>+x. f x \<partial>M)"
     using Tn_nn_integral_preserving assms by blast
   have "(\<integral>\<^sup>+x. birkhoff_sum f n x \<partial>M) = (\<integral>\<^sup>+x. (\<Sum>k\<in>{..<n}. f((T^^k) x)) \<partial>M)"
     unfolding birkhoff_sum_def by blast
   also have "... = (\<Sum>k\<in>{..<n}. (\<integral>\<^sup>+x. f((T^^k) x) \<partial>M))"
     by (rule nn_integral_sum, auto simp add: posk)
   also have "... = (\<Sum>k\<in>{..<n}. (\<integral>\<^sup>+x. f x \<partial>M))" using b by simp
   also have "... = n * (\<integral>\<^sup>+x. f x \<partial>M)" by simp
   finally show "(\<integral>\<^sup>+x. birkhoff_sum f n x \<partial>M) = n * (\<integral>\<^sup>+x. f x \<partial>M)" by simp
 qed
 
 
 subsection \<open>Inverse map\<close>
 
 context qmpt begin
 
 definition
   "invertible_qmpt \<equiv> (bij T \<and> inv T \<in> measurable M M)"
 
 definition
   "Tinv \<equiv> inv T"
 
 lemma T_Tinv_of_set:
   assumes "invertible_qmpt"
           "A \<in> sets M"
   shows "T-`(Tinv-`A \<inter> space M) \<inter> space M = A"
 using assms sets.sets_into_space unfolding Tinv_def invertible_qmpt_def
 apply (auto simp add: bij_betw_def)
 using T_spaceM_stable(1) by blast
 
 lemma Tinv_quasi_measure_preserving:
   assumes "invertible_qmpt"
   shows "Tinv \<in> quasi_measure_preserving M M"
 proof (rule quasi_measure_preservingI, auto)
   fix A assume [measurable]: "A \<in> sets M" "Tinv -` A \<inter> space M \<in> null_sets M"
   then have "T-`(Tinv -` A \<inter> space M) \<inter> space M \<in> null_sets M"
     by (metis T_quasi_preserves_null2(1) null_sets.Int_space_eq2 vimage_restr_def)
   then show "A \<in> null_sets M"
     using T_Tinv_of_set[OF assms \<open>A \<in> sets M\<close>] by auto
 next
   show [measurable]: "Tinv \<in> measurable M M"
     using assms unfolding Tinv_def invertible_qmpt_def by blast
   fix A assume [measurable]: "A \<in> sets M" "A \<in> null_sets M"
   then have "T-`(Tinv -` A \<inter> space M) \<inter> space M \<in> null_sets M"
     using T_Tinv_of_set[OF assms \<open>A \<in> sets M\<close>] by auto
   moreover have [measurable]: "Tinv-`A \<inter> space M \<in> sets M"
     by auto
   ultimately show "Tinv -` A \<inter> space M \<in> null_sets M"
     using T_meas T_quasi_preserves_null(1) vrestr_of_set by presburger
 qed
 
 lemma Tinv_qmpt:
   assumes "invertible_qmpt"
   shows "qmpt M Tinv"
 unfolding qmpt_def qmpt_axioms_def using Tinv_quasi_measure_preserving[OF assms]
 by (simp add: sigma_finite_measure_axioms)
 
 end
 
 lemma (in mpt) Tinv_measure_preserving:
   assumes "invertible_qmpt"
   shows "Tinv \<in> measure_preserving M M"
 proof (rule measure_preservingI)
   show [measurable]: "Tinv \<in> measurable M M"
     using assms unfolding Tinv_def invertible_qmpt_def by blast
   fix A assume [measurable]: "A \<in> sets M"
   have "A = T-`(Tinv -` A \<inter> space M) \<inter> space M"
     using T_Tinv_of_set[OF assms \<open>A \<in> sets M\<close>] by auto
   then show "emeasure M (Tinv -` A \<inter> space M) = emeasure M A"
     by (metis T_vrestr_same_emeasure(1) \<open>A \<in> sets M\<close> \<open>Tinv \<in> M \<rightarrow>\<^sub>M M\<close> measurable_sets sets.Int_space_eq2 vimage_restr_def)
 qed
 
 lemma (in mpt) Tinv_mpt:
   assumes "invertible_qmpt"
   shows "mpt M Tinv"
 unfolding mpt_def mpt_axioms_def using Tinv_qmpt[OF assms] Tinv_measure_preserving[OF assms] by auto
 
 lemma (in fmpt) Tinv_fmpt:
   assumes "invertible_qmpt"
   shows "fmpt M Tinv"
 unfolding fmpt_def using Tinv_mpt[OF assms] by (simp add: finite_measure_axioms)
 
 lemma (in pmpt) Tinv_fmpt:
   assumes "invertible_qmpt"
   shows "pmpt M Tinv"
 unfolding pmpt_def using Tinv_fmpt[OF assms] by (simp add: prob_space_axioms)
 
 
 subsection \<open>Factors\<close>
 
 text \<open>Factors of a system are quotients of this system, i.e., systems that can be obtained by
 a projection, forgetting some part of the dynamics. It is sometimes possible to transfer a result
 from a factor to the original system, making it possible to prove theorems by reduction to a
 simpler situation.
 
 The dual notion, extension, is equally important and useful. We only mention factors below, as
 the results for extension readily follow by considering the original system as a factor of its
 extension.
 
 In this paragraph, we define factors both in the qmpt and mpt categories, and prove their basic
 properties.
 \<close>
 
 definition (in qmpt) qmpt_factor::"('a \<Rightarrow> 'b) \<Rightarrow> ('b measure) \<Rightarrow> ('b \<Rightarrow> 'b) \<Rightarrow> bool"
   where "qmpt_factor proj M2 T2 =
     ((proj \<in> quasi_measure_preserving M M2) \<and> (AE x in M. proj (T x) = T2 (proj x)) \<and> qmpt M2 T2)"
 
 lemma (in qmpt) qmpt_factorE:
   assumes "qmpt_factor proj M2 T2"
   shows "proj \<in> quasi_measure_preserving M M2"
         "AE x in M. proj (T x) = T2 (proj x)"
         "qmpt M2 T2"
 using assms unfolding qmpt_factor_def by auto
 
 lemma (in qmpt) qmpt_factor_iterates:
   assumes "qmpt_factor proj M2 T2"
   shows "AE x in M. \<forall>n. proj ((T^^n) x) = (T2^^n) (proj x)"
 proof -
   have "AE x in M. \<forall>n. proj (T ((T^^n) x)) = T2 (proj ((T^^n) x))"
     by (rule T_AE_iterates[OF qmpt_factorE(2)[OF assms]])
   moreover
   {
     fix x assume "\<forall>n. proj (T ((T^^n) x)) = T2 (proj ((T^^n) x))"
     then have H: "proj (T ((T^^n) x)) = T2 (proj ((T^^n) x))" for n by auto
     have "proj ((T^^n) x) = (T2^^n) (proj x)" for n
       apply (induction n) using H by auto
     then have "\<forall>n. proj ((T^^n) x) = (T2^^n) (proj x)" by auto
   }
   ultimately show ?thesis by fast
 qed
 
 lemma (in qmpt) qmpt_factorI:
   assumes "proj \<in> quasi_measure_preserving M M2"
           "AE x in M. proj (T x) = T2 (proj x)"
           "qmpt M2 T2"
   shows "qmpt_factor proj M2 T2"
 using assms unfolding qmpt_factor_def by auto
 
 text \<open>When there is a quasi-measure-preserving projection, then the quotient map
 automatically is quasi-measure-preserving. The same goes for measure-preservation below.\<close>
 
 lemma (in qmpt) qmpt_factorI':
   assumes "proj \<in> quasi_measure_preserving M M2"
           "AE x in M. proj (T x) = T2 (proj x)"
           "sigma_finite_measure M2"
           "T2 \<in> measurable M2 M2"
   shows "qmpt_factor proj M2 T2"
 proof -
   have [measurable]: "T \<in> measurable M M"
                      "T2 \<in> measurable M2 M2"
                      "proj \<in> measurable M M2"
     using assms(4) quasi_measure_preservingE(1)[OF assms(1)] by auto
 
   have *: "(T2 -` A \<inter> space M2 \<in> null_sets M2) = (A \<in> null_sets M2)" if "A \<in> sets M2" for A
   proof -
     obtain U where U: "\<And>x. x \<in> space M - U \<Longrightarrow> proj (T x) = T2 (proj x)" "U \<in> null_sets M"
       using AE_E3[OF assms(2)] by blast
 
     then have [measurable]: "U \<in> sets M" by auto
     have [measurable]: "A \<in> sets M2" using that by simp
     have e1: "(T-`(proj-`A \<inter> space M)) \<inter> space M = T-`(proj-`A) \<inter> space M"
       using subset_eq by auto
     have e2: "T-`(proj-`A) \<inter> space M - U = proj-`(T2-`A) \<inter> space M - U"
       using U(1) by auto
     have e3: "proj-`(T2-`A) \<inter> space M = proj-`(T2-`A \<inter> space M2) \<inter> space M"
       by (auto, meson \<open>proj \<in> M \<rightarrow>\<^sub>M M2\<close> measurable_space)
 
     have "A \<in> null_sets M2 \<longleftrightarrow> proj-`A \<inter> space M \<in> null_sets M"
       using quasi_measure_preservingE(2)[OF assms(1)] by simp
     also have "... \<longleftrightarrow> (T-`(proj-`A \<inter> space M)) \<inter> space M \<in> null_sets M"
       by (rule quasi_measure_preservingE(2)[OF Tqm, symmetric], auto)
     also have "... \<longleftrightarrow> T-`(proj-`A) \<inter> space M \<in> null_sets M"
       using e1 by simp
     also have "... \<longleftrightarrow> T-`(proj-`A) \<inter> space M - U \<in> null_sets M"
       using emeasure_Diff_null_set[OF \<open>U \<in> null_sets M\<close>] unfolding null_sets_def by auto
     also have "... \<longleftrightarrow> proj-`(T2-`A) \<inter> space M - U \<in> null_sets M"
       using e2 by simp
     also have "... \<longleftrightarrow> proj-`(T2-`A) \<inter> space M \<in> null_sets M"
       using emeasure_Diff_null_set[OF \<open>U \<in> null_sets M\<close>] unfolding null_sets_def by auto
     also have "... \<longleftrightarrow> proj-`(T2-`A \<inter> space M2) \<inter> space M \<in> null_sets M"
       using e3 by simp
     also have "... \<longleftrightarrow> T2-`A \<inter> space M2 \<in> null_sets M2"
       using quasi_measure_preservingE(2)[OF assms(1), of "T2-`A \<inter> space M2"] by simp
     finally show "T2-`A \<inter> space M2 \<in> null_sets M2 \<longleftrightarrow> A \<in> null_sets M2"
       by simp
   qed
   show ?thesis
     by (intro qmpt_factorI qmpt_I) (auto simp add: assms *)
 qed
 
 lemma qmpt_factor_compose:
   assumes "qmpt M1 T1"
           "qmpt.qmpt_factor M1 T1 proj1 M2 T2"
           "qmpt.qmpt_factor M2 T2 proj2 M3 T3"
   shows "qmpt.qmpt_factor M1 T1 (proj2 o proj1) M3 T3"
 proof -
   have *: "proj1 \<in> quasi_measure_preserving M1 M2 \<Longrightarrow> AE x in M2. proj2 (T2 x) = T3 (proj2 x)
       \<Longrightarrow> (AE x in M1. proj1 (T1 x) = T2 (proj1 x) \<longrightarrow> proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x)))"
   proof -
     assume "AE y in M2. proj2 (T2 y) = T3 (proj2 y)"
            "proj1 \<in> quasi_measure_preserving M1 M2"
     then have "AE x in M1. proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
       using quasi_measure_preserving_AE by auto
     moreover
     {
       fix x assume "proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
       then have "proj1 (T1 x) = T2 (proj1 x) \<longrightarrow> proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
         by auto
     }
     ultimately show "AE x in M1. proj1 (T1 x) = T2 (proj1 x) \<longrightarrow> proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
       by auto
   qed
 
   interpret I: qmpt M1 T1 using assms(1) by simp
   interpret J: qmpt M2 T2 using I.qmpt_factorE(3)[OF assms(2)] by simp
   show "I.qmpt_factor (proj2 o proj1) M3 T3"
     apply (rule I.qmpt_factorI)
     using I.qmpt_factorE[OF assms(2)] J.qmpt_factorE[OF assms(3)]
     by (auto simp add: quasi_measure_preserving_comp *)
 qed
 
 text \<open>The left shift on natural integers is a very natural dynamical system, that can be used to
 model many systems as we see below. For invertible systems, one uses rather all the integers.\<close>
 
 definition nat_left_shift::"(nat \<Rightarrow> 'a) \<Rightarrow> (nat \<Rightarrow> 'a)"
   where "nat_left_shift x = (\<lambda>i. x (i+1))"
 
 lemma nat_left_shift_continuous [intro, continuous_intros]:
   "continuous_on UNIV nat_left_shift"
 by (rule continuous_on_coordinatewise_then_product, auto simp add: nat_left_shift_def)
 
 lemma nat_left_shift_measurable [intro, measurable]:
   "nat_left_shift \<in> measurable borel borel"
 by (rule borel_measurable_continuous_onI, auto)
 
 definition int_left_shift::"(int \<Rightarrow> 'a) \<Rightarrow> (int \<Rightarrow> 'a)"
   where "int_left_shift x = (\<lambda>i. x (i+1))"
 
 definition int_right_shift::"(int \<Rightarrow> 'a) \<Rightarrow> (int \<Rightarrow> 'a)"
   where "int_right_shift x = (\<lambda>i. x (i-1))"
 
 lemma int_shift_continuous [intro, continuous_intros]:
   "continuous_on UNIV int_left_shift"
   "continuous_on UNIV int_right_shift"
 apply (rule continuous_on_coordinatewise_then_product, auto simp add: int_left_shift_def)
 apply (rule continuous_on_coordinatewise_then_product, auto simp add: int_right_shift_def)
 done
 
 lemma int_shift_measurable [intro, measurable]:
   "int_left_shift \<in> measurable borel borel"
   "int_right_shift \<in> measurable borel borel"
 by (rule borel_measurable_continuous_onI, auto)+
 
 lemma int_shift_bij:
   "bij int_left_shift" "inv int_left_shift = int_right_shift"
   "bij int_right_shift" "inv int_right_shift = int_left_shift"
 proof -
   show "bij int_left_shift"
     apply (rule bij_betw_byWitness[where ?f' = "\<lambda>x. (\<lambda>i. x (i-1))"]) unfolding int_left_shift_def by auto
   show "inv int_left_shift = int_right_shift"
     apply (rule inv_equality)
     unfolding int_left_shift_def int_right_shift_def by auto
   show "bij int_right_shift"
     apply (rule bij_betw_byWitness[where ?f' = "\<lambda>x. (\<lambda>i. x (i+1))"]) unfolding int_right_shift_def by auto
   show "inv int_right_shift = int_left_shift"
     apply (rule inv_equality)
     unfolding int_left_shift_def int_right_shift_def by auto
 qed
 
 lemma (in qmpt) qmpt_factor_projection:
   fixes f::"'a \<Rightarrow> ('b::second_countable_topology)"
   assumes [measurable]: "f \<in> borel_measurable M"
       and "sigma_finite_measure (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
   shows "qmpt_factor (\<lambda>x. (\<lambda>n. f ((T^^n)x))) (distr M borel (\<lambda>x. (\<lambda>n. f ((T^^n)x)))) nat_left_shift"
 proof (rule qmpt_factorI')
   have * [measurable]: "(\<lambda>x. (\<lambda>n. f ((T^^n)x))) \<in> borel_measurable M"
     using measurable_coordinatewise_then_product by measurable
   show "(\<lambda>x n. f ((T ^^ n) x)) \<in> quasi_measure_preserving M (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
     by (rule measure_preserving_is_quasi_measure_preserving[OF measure_preserving_distr'[OF *]])
   have "(\<lambda>n. f ((T ^^ n) (T x))) = nat_left_shift (\<lambda>n. f ((T ^^ n) x))" for x
     unfolding nat_left_shift_def by (auto simp add: funpow_swap1)
   then show "AE x in M. (\<lambda>n. f ((T ^^ n) (T x))) = nat_left_shift (\<lambda>n. f ((T ^^ n) x))"
     by simp
 qed (auto simp add: assms(2))
 
 
 text \<open>Let us now define factors of measure-preserving transformations, in the same way
 as above.\<close>
 
 definition (in mpt) mpt_factor::"('a \<Rightarrow> 'b) \<Rightarrow> ('b measure) \<Rightarrow> ('b \<Rightarrow> 'b) \<Rightarrow> bool"
   where "mpt_factor proj M2 T2 =
     ((proj \<in> measure_preserving M M2) \<and> (AE x in M. proj (T x) = T2 (proj x)) \<and> mpt M2 T2)"
 
 lemma (in mpt) mpt_factor_is_qmpt_factor:
   assumes "mpt_factor proj M2 T2"
   shows "qmpt_factor proj M2 T2"
 using assms unfolding mpt_factor_def qmpt_factor_def
 by (simp add: measure_preserving_is_quasi_measure_preserving mpt_def)
 
 lemma (in mpt) mpt_factorE:
   assumes "mpt_factor proj M2 T2"
   shows "proj \<in> measure_preserving M M2"
         "AE x in M. proj (T x) = T2 (proj x)"
         "mpt M2 T2"
 using assms unfolding mpt_factor_def by auto
 
 lemma (in mpt) mpt_factorI:
   assumes "proj \<in> measure_preserving M M2"
           "AE x in M. proj (T x) = T2 (proj x)"
           "mpt M2 T2"
   shows "mpt_factor proj M2 T2"
 using assms unfolding mpt_factor_def by auto
 
 text \<open>When there is a measure-preserving projection commuting with the dynamics, and the
 dynamics above preserves the measure, then so does the dynamics below.\<close>
 
 lemma (in mpt) mpt_factorI':
   assumes "proj \<in> measure_preserving M M2"
           "AE x in M. proj (T x) = T2 (proj x)"
           "sigma_finite_measure M2"
           "T2 \<in> measurable M2 M2"
   shows "mpt_factor proj M2 T2"
 proof -
   have [measurable]: "T \<in> measurable M M"
                      "T2 \<in> measurable M2 M2"
                      "proj \<in> measurable M M2"
     using assms(4) measure_preservingE(1)[OF assms(1)] by auto
 
   have *: "emeasure M2 (T2 -` A \<inter> space M2) = emeasure M2 A" if "A \<in> sets M2" for A
   proof -
     obtain U where U: "\<And>x. x \<in> space M - U \<Longrightarrow> proj (T x) = T2 (proj x)" "U \<in> null_sets M"
       using AE_E3[OF assms(2)] by blast
 
     then have [measurable]: "U \<in> sets M" by auto
     have [measurable]: "A \<in> sets M2" using that by simp
     have e1: "(T-`(proj-`A \<inter> space M)) \<inter> space M = T-`(proj-`A) \<inter> space M"
       using subset_eq by auto
     have e2: "T-`(proj-`A) \<inter> space M - U = proj-`(T2-`A) \<inter> space M - U"
       using U(1) by auto
     have e3: "proj-`(T2-`A) \<inter> space M = proj-`(T2-`A \<inter> space M2) \<inter> space M"
       by (auto, meson \<open>proj \<in> M \<rightarrow>\<^sub>M M2\<close> measurable_space)
 
     have "emeasure M2 A = emeasure M (proj-`A \<inter> space M)"
       using measure_preservingE(2)[OF assms(1)] by simp
     also have "... = emeasure M (T-`(proj-`A \<inter> space M) \<inter> space M)"
       by (rule measure_preservingE(2)[OF Tm, symmetric], auto)
     also have "... = emeasure M (T-`(proj-`A) \<inter> space M)"
       using e1 by simp
     also have "... = emeasure M (T-`(proj-`A) \<inter> space M - U)"
       using emeasure_Diff_null_set[OF \<open>U \<in> null_sets M\<close>] by auto
     also have "... = emeasure M (proj-`(T2-`A) \<inter> space M - U)"
       using e2 by simp
     also have "... = emeasure M (proj-`(T2-`A) \<inter> space M)"
       using emeasure_Diff_null_set[OF \<open>U \<in> null_sets M\<close>] by auto
     also have "... = emeasure M (proj-`(T2-`A \<inter> space M2) \<inter> space M)"
       using e3 by simp
     also have "... = emeasure M2 (T2-`A \<inter> space M2)"
       using measure_preservingE(2)[OF assms(1), of "T2-`A \<inter> space M2"] by simp
     finally show "emeasure M2 (T2-`A \<inter> space M2) = emeasure M2 A"
       by simp
   qed
   show ?thesis
     by (intro mpt_factorI mpt_I) (auto simp add: assms *)
 qed
 
 lemma (in fmpt) mpt_factorI'':
   assumes "proj \<in> measure_preserving M M2"
           "AE x in M. proj (T x) = T2 (proj x)"
           "T2 \<in> measurable M2 M2"
   shows "mpt_factor proj M2 T2"
 apply (rule mpt_factorI', auto simp add: assms)
 using measure_preserving_finite_measure[OF assms(1)] finite_measure_axioms finite_measure_def by blast
 
 lemma (in fmpt) fmpt_factor:
   assumes "mpt_factor proj M2 T2"
   shows "fmpt M2 T2"
 unfolding fmpt_def using mpt_factorE(3)[OF assms]
 measure_preserving_finite_measure[OF mpt_factorE(1)[OF assms]] finite_measure_axioms by auto
 
 lemma (in pmpt) pmpt_factor:
   assumes "mpt_factor proj M2 T2"
   shows "pmpt M2 T2"
 unfolding pmpt_def using fmpt_factor[OF assms]
 measure_preserving_prob_space[OF mpt_factorE(1)[OF assms]] prob_space_axioms by auto
 
 lemma mpt_factor_compose:
   assumes "mpt M1 T1"
           "mpt.mpt_factor M1 T1 proj1 M2 T2"
           "mpt.mpt_factor M2 T2 proj2 M3 T3"
   shows "mpt.mpt_factor M1 T1 (proj2 o proj1) M3 T3"
 proof -
   have *: "proj1 \<in> measure_preserving M1 M2 \<Longrightarrow> AE x in M2. proj2 (T2 x) = T3 (proj2 x) \<Longrightarrow>
     (AE x in M1. proj1 (T1 x) = T2 (proj1 x) \<longrightarrow> proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x)))"
   proof -
     assume "AE y in M2. proj2 (T2 y) = T3 (proj2 y)"
            "proj1 \<in> measure_preserving M1 M2"
     then have "AE x in M1. proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
       using quasi_measure_preserving_AE measure_preserving_is_quasi_measure_preserving by blast
     moreover
     {
       fix x assume "proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
       then have "proj1 (T1 x) = T2 (proj1 x) \<longrightarrow> proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
         by auto
     }
     ultimately show "AE x in M1. proj1 (T1 x) = T2 (proj1 x) \<longrightarrow> proj2 (T2 (proj1 x)) = T3 (proj2 (proj1 x))"
       by auto
   qed
 
   interpret I: mpt M1 T1 using assms(1) by simp
   interpret J: mpt M2 T2 using I.mpt_factorE(3)[OF assms(2)] by simp
   show "I.mpt_factor (proj2 o proj1) M3 T3"
     apply (rule I.mpt_factorI)
     using I.mpt_factorE[OF assms(2)] J.mpt_factorE[OF assms(3)]
     by (auto simp add: measure_preserving_comp *)
 qed
 
 text \<open>Left shifts are naturally factors of finite measure preserving transformations.\<close>
 
 lemma (in mpt) mpt_factor_projection:
   fixes f::"'a \<Rightarrow> ('b::second_countable_topology)"
   assumes [measurable]: "f \<in> borel_measurable M"
       and "sigma_finite_measure (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
   shows "mpt_factor (\<lambda>x. (\<lambda>n. f ((T^^n)x))) (distr M borel (\<lambda>x. (\<lambda>n. f ((T^^n)x)))) nat_left_shift"
 proof (rule mpt_factorI')
   have * [measurable]: "(\<lambda>x. (\<lambda>n. f ((T^^n)x))) \<in> borel_measurable M"
     using measurable_coordinatewise_then_product by measurable
   show "(\<lambda>x n. f ((T ^^ n) x)) \<in> measure_preserving M (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
     by (rule measure_preserving_distr'[OF *])
   have "(\<lambda>n. f ((T ^^ n) (T x))) = nat_left_shift (\<lambda>n. f ((T ^^ n) x))" for x
     unfolding nat_left_shift_def by (auto simp add: funpow_swap1)
   then show "AE x in M. (\<lambda>n. f ((T ^^ n) (T x))) = nat_left_shift (\<lambda>n. f ((T ^^ n) x))"
     by simp
 qed (auto simp add: assms(2))
 
 lemma (in fmpt) fmpt_factor_projection:
   fixes f::"'a \<Rightarrow> ('b::second_countable_topology)"
   assumes [measurable]: "f \<in> borel_measurable M"
   shows "mpt_factor (\<lambda>x. (\<lambda>n. f ((T^^n)x))) (distr M borel (\<lambda>x. (\<lambda>n. f ((T^^n)x)))) nat_left_shift"
 proof (rule mpt_factor_projection, simp add: assms)
   have * [measurable]: "(\<lambda>x. (\<lambda>n. f ((T^^n)x))) \<in> borel_measurable M"
     using measurable_coordinatewise_then_product by measurable
   have **: "(\<lambda>x n. f ((T ^^ n) x)) \<in> measure_preserving M (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
     by (rule measure_preserving_distr'[OF *])
   have a: "finite_measure (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
     using measure_preserving_finite_measure[OF **] finite_measure_axioms by blast
   then show "sigma_finite_measure (distr M borel (\<lambda>x n. f ((T ^^ n) x)))"
     by (simp add: finite_measure_def)
 qed
 
 
 subsection \<open>Natural extension\<close>
 
 text \<open>Many probability preserving dynamical systems are not invertible, while invertibility is
 often useful in proofs. The notion of natural extension is a solution to this problem: it shows that
 (essentially) any system has an extension which is invertible.
 
 This extension is constructed by considering the space of orbits indexed by integer numbers, with
 the left shift acting on it. If one considers the orbits starting from time $-N$
 (for some fixed $N$), then there is a natural measure on this space: such an orbit is
 parameterized by its starting point at time $-N$, hence one may use the original measure on this
 point. The invariance of the measure ensures that these measures are compatible with each other.
 Their projective limit (when $N$ tends to infinity) is thus an invariant measure on the bilateral
 shift. The shift with this measure is the desired extension of the original system.
 
 There is a difficulty in the above argument: one needs to make sure that the projective limit of
 a system of compatible measures is well defined. This requires some topological conditions on the
 measures (they should be inner regular, i.e., the measure of any set should be approximated from
 below by compact subsets -- this is automatic on polish spaces). The existence of projective limits
 is proved in \verb+Projective_Limits.thy+ under the (sufficient) polish condition. We use this
 theory, so we need the underlying space to be a polish space and the measure to be a Borel
 measure. This is almost completely satisfactory.
 
 What is not completely satisfactory is that the completion of a Borel measure on a polish space
 (i.e., we add all subsets of sets of measure $0$ into the sigma algebra) does not fit into this
 setting, while this is an important framework in dynamical systems. It would readily follow
 once \verb+Projective_Limits.thy+ is extended to the more general inner regularity setting
 (the completion of a Borel measure on a polish space is always inner regular).
 \<close>
 
 locale polish_pmpt = pmpt "M::('a::polish_space measure)" T for M T
   + assumes M_eq_borel: "sets M = sets borel"
 begin
 
 definition natural_extension_map
   where "natural_extension_map = (int_left_shift::((int \<Rightarrow> 'a) \<Rightarrow> (int \<Rightarrow> 'a)))"
 
 definition natural_extension_measure::"(int \<Rightarrow> 'a) measure"
   where "natural_extension_measure =
     projective_family.lim UNIV (\<lambda>I. distr M (\<Pi>\<^sub>M i\<in>I. borel) (\<lambda>x. (\<lambda>i\<in>I. (T^^(nat(i- Min I))) x))) (\<lambda>i. borel)"
 
 definition natural_extension_proj::"(int \<Rightarrow> 'a) \<Rightarrow> 'a"
   where "natural_extension_proj = (\<lambda>x. x 0)"
 
 theorem natural_extension:
   "pmpt natural_extension_measure natural_extension_map"
   "qmpt.invertible_qmpt natural_extension_measure natural_extension_map"
   "mpt.mpt_factor natural_extension_measure natural_extension_map natural_extension_proj M T"
 proof -
   define P::"int set \<Rightarrow> (int \<Rightarrow> 'a) measure" where
     "P = (\<lambda>I. distr M (\<Pi>\<^sub>M i\<in>I. borel) (\<lambda>x. (\<lambda>i\<in>I. (T^^(nat(i- Min I))) x)))"
   have [measurable]: "(T^^n) \<in> measurable M borel" for n
     using M_eq_borel by auto
 
   interpret polish_projective UNIV P
   unfolding polish_projective_def projective_family_def
   proof (auto)
     show "prob_space (P I)" if "finite I" for I unfolding P_def by (rule prob_space_distr, auto)
     fix J H::"int set" assume "J \<subseteq> H" "finite H"
     then have "H \<inter> J = J" by blast
 
     have "((\<lambda>f. restrict f J) o (\<lambda>x. (\<lambda>i\<in>H. (T^^(nat(i- Min H))) x))) x
         = ((\<lambda>x. (\<lambda>i\<in>J. (T^^(nat(i- Min J))) x)) o (T^^(nat(Min J - Min H)))) x" for x
     proof -
       have "nat(i- Min H) = nat(i- Min J) + nat(Min J - Min H)" if "i \<in> J" for i
       proof -
         have "finite J" using \<open>J \<subseteq> H\<close> \<open>finite H\<close> finite_subset by auto
         then have "Min J \<in> J" using Min_in \<open>i \<in> J\<close> by auto
         then have "Min J \<in> H" using \<open>J \<subseteq> H\<close> by blast
         then have "Min H \<le> Min J" using Min.coboundedI[OF \<open>finite H\<close>] by auto
         moreover have "Min J \<le> i" using Min.coboundedI[OF \<open>finite J\<close> \<open>i \<in> J\<close>] by auto
         ultimately show ?thesis by auto
       qed
       then show ?thesis
         unfolding comp_def by (auto simp add: \<open>H \<inter> J = J\<close> funpow_add)
     qed
     then have *: "(\<lambda>f. restrict f J) o (\<lambda>x. (\<lambda>i\<in>H. (T^^(nat(i- Min H))) x))
         = (\<lambda>x. (\<lambda>i\<in>J. (T^^(nat(i- Min J))) x)) o (T^^(nat(Min J - Min H)))"
       by auto
 
     have "distr (P H) (Pi\<^sub>M J (\<lambda>_. borel)) (\<lambda>f. restrict f J)
             = distr M (\<Pi>\<^sub>M i\<in>J. borel) ((\<lambda>f. restrict f J) o (\<lambda>x. (\<lambda>i\<in>H. (T^^(nat(i- Min H))) x)))"
       unfolding P_def by (rule distr_distr, auto simp add: \<open>J \<subseteq> H\<close> measurable_restrict_subset)
     also have "... = distr M (\<Pi>\<^sub>M i\<in>J. borel) ((\<lambda>x. (\<lambda>i\<in>J. (T^^(nat(i- Min J))) x)) o (T^^(nat(Min J - Min H))))"
       using * by auto
     also have "... = distr (distr M M (T^^(nat(Min J - Min H)))) (\<Pi>\<^sub>M i\<in>J. borel) (\<lambda>x. (\<lambda>i\<in>J. (T^^(nat(i- Min J))) x))"
       by (rule distr_distr[symmetric], auto)
     also have "... = distr M (\<Pi>\<^sub>M i\<in>J. borel) (\<lambda>x. (\<lambda>i\<in>J. (T^^(nat(i- Min J))) x))"
       using measure_preserving_distr[OF Tn_measure_preserving] by auto
     also have "... = P J"
       unfolding P_def by auto
     finally show "P J = distr (P H) (Pi\<^sub>M J (\<lambda>_. borel)) (\<lambda>f. restrict f J)"
       by simp
   qed
 
   have S: "sets (Pi\<^sub>M UNIV (\<lambda>_. borel)) = sets (borel::(int \<Rightarrow> 'a) measure)"
     by (rule sets_PiM_equal_borel)
   have "natural_extension_measure = lim"
     unfolding natural_extension_measure_def P_def by simp
   have "measurable lim lim = measurable borel borel"
     by (rule measurable_cong_sets, auto simp add: S)
   then have [measurable]: "int_left_shift \<in> measurable lim lim" "int_right_shift \<in> measurable lim lim"
     using int_shift_measurable by fast+
   have [simp]: "space lim = UNIV"
     unfolding space_lim space_PiM space_borel by auto
 
   show "pmpt natural_extension_measure natural_extension_map"
   proof (rule pmpt_I)
     show "prob_space natural_extension_measure"
       unfolding \<open>natural_extension_measure = lim\<close> by (simp add: P.prob_space_axioms)
     show "natural_extension_map \<in> measurable natural_extension_measure natural_extension_measure"
       unfolding natural_extension_map_def \<open>natural_extension_measure = lim\<close> by simp
 
     define E where "E = {(\<Pi>\<^sub>E i\<in>UNIV. X i) |X::(int \<Rightarrow> 'a set). (\<forall>i. X i \<in> sets borel) \<and> finite {i. X i \<noteq> UNIV}}"
     have "lim = distr lim lim int_left_shift"
     proof (rule measure_eqI_generator_eq[of E UNIV, where ?A = "\<lambda>_. UNIV"])
       show "sets lim = sigma_sets UNIV E"
         unfolding E_def using sets_PiM_finite[of "UNIV::int set" "\<lambda>_. (borel::'a measure)"]
         by (simp add: PiE_def)
       moreover have "sets (distr lim lim int_left_shift) = sets lim" by auto
       ultimately show "sets (distr lim lim int_left_shift) = sigma_sets UNIV E" by simp
 
       show "emeasure lim UNIV \<noteq> \<infinity>" by (simp add: P.prob_space_axioms)
       have "UNIV = (\<Pi>\<^sub>E i\<in>(UNIV::int set). (UNIV::'a set))" by (simp add: PiE_def)
       moreover have "... \<in> E" unfolding E_def by auto
       ultimately show "range (\<lambda>(i::nat). (UNIV::(int \<Rightarrow> 'a) set)) \<subseteq> E"
         by auto
 
       show "Int_stable E"
       proof (rule Int_stableI)
         fix U V assume "U \<in> E" "V \<in> E"
         then obtain X Y where H: "U = (\<Pi>\<^sub>E i\<in>UNIV. X i)" "\<And>i. X i \<in> sets borel" "finite {i. X i \<noteq> UNIV}"
                                  "V = (\<Pi>\<^sub>E i\<in>UNIV. Y i)" "\<And>i. Y i \<in> sets borel" "finite {i. Y i \<noteq> UNIV}"
           unfolding E_def by blast
         define Z where "Z = (\<lambda>i. X i \<inter> Y i)"
         have "{i. Z i \<noteq> UNIV} \<subseteq> {i. X i \<noteq> UNIV} \<union> {i. Y i \<noteq> UNIV}"
           unfolding Z_def by auto
         then have "finite {i. Z i \<noteq> UNIV}"
           using H(3) H(6) finite_subset by auto
         moreover have "U \<inter> V = (\<Pi>\<^sub>E i\<in>UNIV. Z i)"
           unfolding Z_def using H(1) H(4) by auto
         moreover have "\<And>i. Z i \<in> sets borel"
           unfolding Z_def using H(2) H(5) by auto
         ultimately show "U \<inter> V \<in> E"
           unfolding E_def by auto
       qed
 
       fix U assume "U \<in> E"
       then obtain X where H [measurable]: "U = (\<Pi>\<^sub>E i\<in>UNIV. X i)" "\<And>i. X i \<in> sets borel" "finite {i. X i \<noteq> UNIV}"
         unfolding E_def by blast
       define I where "I = {i. X i \<noteq> UNIV}"
       have [simp]: "finite I" unfolding I_def using H(3) by auto
       have [measurable]: "(\<Pi>\<^sub>E i\<in>I. X i) \<in> sets (Pi\<^sub>M I (\<lambda>i. borel))" using H(2) by simp
       have *: "U = emb UNIV I (\<Pi>\<^sub>E i\<in>I. X i)"
         unfolding H(1) I_def prod_emb_def space_borel apply (auto simp add: PiE_def)
         by (metis (mono_tags, lifting) PiE UNIV_I mem_Collect_eq restrict_Pi_cancel)
       have "emeasure lim U = emeasure lim (int_left_shift-`U)"
       proof (cases "I = {}")
         case True
         then have "U = UNIV" unfolding H(1) I_def by auto
         then show ?thesis by auto
       next
         case False
         have "emeasure lim U = emeasure (P I) (\<Pi>\<^sub>E i\<in>I. X i)"
           unfolding * by (rule emeasure_lim_emb, auto)
         also have "... = emeasure M (((\<lambda>x. (\<lambda>i\<in>I. (T^^(nat(i- Min I))) x)))-`(\<Pi>\<^sub>E i\<in>I. X i) \<inter> space M)"
           unfolding P_def by (rule emeasure_distr, auto)
         finally have A: "emeasure lim U = emeasure M (((\<lambda>x. (\<lambda>i\<in>I. (T^^(nat(i- Min I))) x)))-`(\<Pi>\<^sub>E i\<in>I. X i) \<inter> space M)"
           by simp
 
         have i: "int_left_shift-`U = (\<Pi>\<^sub>E i\<in>UNIV. X (i-1))"
           unfolding H(1) apply (auto simp add: int_left_shift_def PiE_def)
           by (metis PiE UNIV_I diff_add_cancel, metis Pi_mem add.commute add_diff_cancel_left' iso_tuple_UNIV_I)
         define Im where "Im = {i. X (i-1) \<noteq> UNIV}"
         have "Im = (\<lambda>i. i+1)`I"
           unfolding I_def Im_def using image_iff by (auto, fastforce)
         then have [simp]: "finite Im" by auto
         have *: "int_left_shift-`U = emb UNIV Im (\<Pi>\<^sub>E i\<in>Im. X (i-1))"
           unfolding i Im_def prod_emb_def space_borel apply (auto simp add: PiE_def)
           by (metis (mono_tags, lifting) PiE UNIV_I mem_Collect_eq restrict_Pi_cancel)
         have "emeasure lim (int_left_shift-`U) = emeasure (P Im) (\<Pi>\<^sub>E i\<in>Im. X (i-1))"
           unfolding * by (rule emeasure_lim_emb, auto)
         also have "... = emeasure M (((\<lambda>x. (\<lambda>i\<in>Im. (T^^(nat(i- Min Im))) x)))-`(\<Pi>\<^sub>E i\<in>Im. X (i-1)) \<inter> space M)"
           unfolding P_def by (rule emeasure_distr, auto)
         finally have B: "emeasure lim (int_left_shift-`U) = emeasure M (((\<lambda>x. (\<lambda>i\<in>Im. (T^^(nat(i- Min Im))) x)))-`(\<Pi>\<^sub>E i\<in>Im. X (i-1)) \<inter> space M)"
           by simp
 
         have "Min Im = Min I + 1" unfolding \<open>Im = (\<lambda>i. i+1)`I\<close>
           by (rule mono_Min_commute[symmetric], auto simp add: False monoI)
         have "((\<lambda>x. (\<lambda>i\<in>Im. (T^^(nat(i- Min Im))) x)))-`(\<Pi>\<^sub>E i\<in>Im. X (i-1)) = ((\<lambda>x. (\<lambda>i\<in>I. (T^^(nat(i- Min I))) x)))-`(\<Pi>\<^sub>E i\<in>I. X i)"
           unfolding \<open>Min Im = Min I + 1\<close> unfolding \<open>Im = (\<lambda>i. i+1)`I\<close> by (auto simp add: Pi_iff)
         then show "emeasure lim U = emeasure lim (int_left_shift -` U)" using A B by auto
       qed
       also have "... = emeasure lim (int_left_shift-`U \<inter> space lim)"
         unfolding \<open>space lim = UNIV\<close> by auto
       also have "... = emeasure (distr lim lim int_left_shift) U"
         apply (rule emeasure_distr[symmetric], auto) using * by auto
       finally show "emeasure lim U = emeasure (distr lim lim int_left_shift) U"
         by simp
     qed (auto)
 
     fix U assume "U \<in> sets natural_extension_measure"
     then have [measurable]: "U \<in> sets lim" using \<open>natural_extension_measure = lim\<close> by simp
     have "emeasure natural_extension_measure (natural_extension_map -` U \<inter> space natural_extension_measure)
           = emeasure lim (int_left_shift-`U \<inter> space lim)"
       unfolding \<open>natural_extension_measure = lim\<close> natural_extension_map_def by simp
     also have "... = emeasure (distr lim lim int_left_shift) U"
       apply (rule emeasure_distr[symmetric], auto) using \<open>U \<in> P.events\<close> by auto
     also have "... = emeasure lim U"
       using \<open>lim = distr lim lim int_left_shift\<close> by simp
     also have "... = emeasure natural_extension_measure U"
       using \<open>natural_extension_measure = lim\<close> by simp
     finally show "emeasure natural_extension_measure (natural_extension_map -` U \<inter> space natural_extension_measure)
                   = emeasure natural_extension_measure U"
       by simp
   qed
   then interpret I: pmpt natural_extension_measure natural_extension_map by simp
 
   show "I.invertible_qmpt"
     unfolding I.invertible_qmpt_def unfolding natural_extension_map_def \<open>natural_extension_measure = lim\<close>
     by (auto simp add: int_shift_bij)
 
   show "I.mpt_factor natural_extension_proj M T" unfolding I.mpt_factor_def
   proof (auto)
     show "mpt M T" by (simp add: mpt_axioms)
     show "natural_extension_proj \<in> measure_preserving natural_extension_measure M"
     unfolding \<open>natural_extension_measure = lim\<close>
     proof
       have *: "measurable lim M = measurable borel borel"
         apply (rule measurable_cong_sets) using sets_PiM_equal_borel M_eq_borel by auto
       show "natural_extension_proj \<in> measurable lim M"
         unfolding * natural_extension_proj_def by auto
 
       fix U assume [measurable]: "U \<in> sets M"
       have *: "(((\<lambda>x. \<lambda>i\<in>{0}. (T ^^ nat (i - Min {0})) x))-` ({0} \<rightarrow>\<^sub>E U) \<inter> space M) = U"
         using sets.sets_into_space[OF \<open>U \<in> sets M\<close>] by auto
 
       have "natural_extension_proj-`U \<inter> space lim = emb UNIV {0} (\<Pi>\<^sub>E i\<in>{0}. U)"
         unfolding \<open>space lim = UNIV\<close> natural_extension_proj_def prod_emb_def by (auto simp add: PiE_iff)
       then have "emeasure lim (natural_extension_proj-`U \<inter> space lim) = emeasure lim (emb UNIV {0} (\<Pi>\<^sub>E i\<in>{0}. U))"
         by simp
       also have "... = emeasure (P {0}) (\<Pi>\<^sub>E i\<in>{0}. U)"
         apply (rule emeasure_lim_emb, auto) using \<open>U \<in> sets M\<close> M_eq_borel by auto
       also have "... = emeasure M (((\<lambda>x. \<lambda>i\<in>{0}. (T ^^ nat (i - Min {0})) x))-` ({0} \<rightarrow>\<^sub>E U) \<inter> space M)"
         unfolding P_def apply (rule emeasure_distr) using \<open>U \<in> sets M\<close> M_eq_borel by auto
       also have "... = emeasure M U"
         using * by simp
       finally show "emeasure lim (natural_extension_proj-`U \<inter> space lim) = emeasure M U" by simp
     qed
 
     define U::"(int \<Rightarrow> 'a) set" where "U = {x \<in> space (Pi\<^sub>M {0, 1} (\<lambda>i. borel)). x 1 = T (x 0)}"
     have *: "((\<lambda>x. \<lambda>i\<in>{0, 1}. (T ^^ nat (i - Min {0, 1})) x))-` U \<inter> space M = space M"
       unfolding U_def space_PiM space_borel by auto
     have [measurable]: "T \<in> measurable borel borel"
       using M_eq_borel by auto
     have [measurable]: "U \<in> sets (Pi\<^sub>M {0, 1} (\<lambda>i. borel))"
       unfolding U_def by (rule measurable_equality_set, auto)
     have "emeasure natural_extension_measure (emb UNIV {0, 1} U) = emeasure (P {0, 1}) U"
       unfolding \<open>natural_extension_measure = lim\<close> by (rule emeasure_lim_emb, auto)
     also have "... = emeasure M (((\<lambda>x. \<lambda>i\<in>{0, 1}. (T ^^ nat (i - Min {0, 1})) x))-` U \<inter> space M)"
       unfolding P_def by (rule emeasure_distr, auto)
     also have "... = emeasure M (space M)"
       using * by simp
     also have "... = 1" by (simp add: emeasure_space_1)
     finally have *: "emeasure natural_extension_measure (emb UNIV {0, 1} U) = 1" by simp
     have "AE x in natural_extension_measure. x \<in> emb UNIV {0, 1} U"
       apply (rule I.AE_prob_1) using * by (simp add: I.emeasure_eq_measure)
     moreover
     {
       fix x assume "x \<in> emb UNIV {0, 1} U"
       then have "x 1 = T (x 0)" unfolding prod_emb_def U_def by auto
       then have "natural_extension_proj (natural_extension_map x) = T (natural_extension_proj x)"
         unfolding natural_extension_proj_def natural_extension_map_def int_left_shift_def by auto
     }
     ultimately show "AE x in natural_extension_measure.
         natural_extension_proj (natural_extension_map x) = T (natural_extension_proj x)"
       by auto
   qed
 qed
 
 end
 
 end (*of Measure_Preserving_Transformations.thy*)
diff --git a/thys/Ergodic_Theory/SG_Library_Complement.thy b/thys/Ergodic_Theory/SG_Library_Complement.thy
--- a/thys/Ergodic_Theory/SG_Library_Complement.thy
+++ b/thys/Ergodic_Theory/SG_Library_Complement.thy
@@ -1,1453 +1,1319 @@
 (*  Author:  Sébastien Gouëzel   sebastien.gouezel@univ-rennes1.fr
     License: BSD
 *)
 
 section \<open>SG Libary complements\<close>
 
 theory SG_Library_Complement
   imports "HOL-Probability.Probability"
 begin
 
 text \<open>In this file are included many statements that were useful to me, but belong rather
 naturally to existing theories. In a perfect world, some of these statements would get included
 into these files.
 
 I tried to indicate to which of these classical theories the statements could be added.
 \<close>
 
 subsection \<open>Basic logic\<close>
 
 text \<open>This one is certainly available, but I could not locate it...\<close>
 lemma equiv_neg:
   "\<lbrakk> P \<Longrightarrow> Q; \<not>P \<Longrightarrow> \<not>Q \<rbrakk> \<Longrightarrow> (P\<longleftrightarrow>Q)"
 by blast
 
 
 subsection \<open>Basic set theory\<close>
 
 lemma compl_compl_eq_id [simp]:
   "UNIV - (UNIV - s) = s"
 by auto
 
 abbreviation sym_diff :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a set" (infixl "\<Delta>" 70) where
   "sym_diff A B \<equiv> ((A - B) \<union> (B-A))"
 
 text \<open>Not sure the next lemmas are useful, as they are proved solely by auto, so they
 could be reproved automatically whenever necessary.\<close>
 
 lemma sym_diff_inc:
   "A \<Delta> C \<subseteq> A \<Delta> B \<union> B \<Delta> C"
 by auto
 
 lemma sym_diff_vimage [simp]:
   "f-`(A \<Delta> B) = (f-`A) \<Delta> (f-`B)"
 by auto
 
-lemma card_finite_union:
-  assumes "finite I"
-  shows "card(\<Union>i\<in>I. A i) \<le> (\<Sum>i\<in>I. card(A i))"
-using assms apply (induct, auto)
-using card_Un_le nat_add_left_cancel_le order_trans by blast
-
 
 subsection \<open>Set-Interval.thy\<close>
 
 text \<open>The next two lemmas belong naturally to \verb+Set_Interval.thy+, next to
 \verb+UN_le_add_shift+. They are not trivially equivalent to the corresponding lemmas
 with large inequalities, due to the difference when $n = 0$.\<close>
 
-lemma UN_le_add_shift_strict:
-  "(\<Union>i<n::nat. M(i+k)) = (\<Union>i\<in>{k..<n+k}. M i)" (is "?A = ?B")
-proof
-  show "?B \<subseteq> ?A"
-  proof
-    fix x assume "x \<in> ?B"
-    then obtain i where i: "i \<in> {k..<n+k}" "x \<in> M(i)" by auto
-    then have "i - k < n \<and> x \<in> M((i-k) + k)" by auto
-    then show "x \<in> ?A" using UN_le_add_shift by blast
-  qed
-qed (fastforce)
-
 lemma UN_le_eq_Un0_strict:
   "(\<Union>i<n+1::nat. M i) = (\<Union>i\<in>{1..<n+1}. M i) \<union> M 0" (is "?A = ?B")
 proof
   show "?A \<subseteq> ?B"
   proof
     fix x assume "x \<in> ?A"
     then obtain i where i: "i<n+1" "x \<in> M i" by auto
     show "x \<in> ?B"
     proof(cases i)
       case 0 with i show ?thesis by simp
     next
       case (Suc j) with i show ?thesis by auto
     qed
   qed
 qed (auto)
 
 text \<open>I use repeatedly this one, but I could not find it directly\<close>
 
 lemma union_insert_0:
   "(\<Union>n::nat. A n) = A 0 \<union> (\<Union>n\<in>{1..}. A n)"
 by (metis UN_insert Un_insert_left sup_bot.left_neutral One_nat_def atLeast_0 atLeast_Suc_greaterThan ivl_disj_un_singleton(1))
 
 text \<open>Next one could be close to \verb+sum.nat_group+\<close>
 
 lemma sum_arith_progression:
   "(\<Sum>r<(N::nat). (\<Sum>i<a. f (i*N+r))) = (\<Sum>j<a*N. f j)"
 proof -
   have *: "(\<Sum>r<N. f (i*N+r)) = (\<Sum> j \<in> {i*N..<i*N + N}. f j)" for i
     by (rule sum.reindex_bij_betw, rule bij_betw_byWitness[where ?f' = "\<lambda>r. r-i*N"], auto)
 
   have "(\<Sum>r<N. (\<Sum>i<a. f (i*N+r))) = (\<Sum>i<a. (\<Sum>r<N. f (i*N+r)))"
     using sum.swap by auto
   also have "... = (\<Sum>i<a. (\<Sum> j \<in> {i*N..<i*N + N}. f j))"
     using * by auto
   also have "... = (\<Sum>j<a*N. f j)"
     by (rule sum.nat_group)
   finally show ?thesis by simp
 qed
 
 
 subsection \<open>Miscellanous basic results\<close>
 
 lemma ind_from_1 [case_names 1 Suc, consumes 1]:
   assumes "n > 0"
   assumes "P 1"
       and "\<And>n. n > 0 \<Longrightarrow> P n \<Longrightarrow> P (Suc n)"
   shows "P n"
 proof -
   have "(n = 0) \<or> P n"
   proof (induction n)
     case 0 then show ?case by auto
   next
     case (Suc k)
     consider "Suc k = 1" | "Suc k > 1" by linarith
     then show ?case
       apply (cases) using assms Suc.IH by auto
   qed
   then show ?thesis using \<open>n > 0\<close> by auto
 qed
 
 text \<open>This lemma is certainly available somewhere, but I couldn't
 locate it\<close>
 
 lemma tends_to_real_e:
   fixes u::"nat \<Rightarrow> real"
-  assumes "u \<longlonglongrightarrow> l"
-          "e>0"
+  assumes "u \<longlonglongrightarrow> l" "e>0"
   shows "\<exists>N. \<forall>n>N. abs(u n -l) < e"
-proof-
-  have "eventually (\<lambda>n. dist (u n) l < e) sequentially" using assms tendstoD by auto
-  then have "\<forall>\<^sub>F n in sequentially. abs(u n - l) < e" using dist_real_def by auto
-  then show ?thesis by (simp add: eventually_at_top_dense)
-qed
+  by (metis assms dist_real_def le_less lim_sequentially)
 
 lemma nat_mod_cong:
   assumes "a = b+(c::nat)"
           "a mod n = b mod n"
   shows "c mod n = 0"
 proof -
   let ?k = "a mod n"
   obtain a1 where "a = a1*n + ?k" by (metis div_mult_mod_eq)
   moreover obtain b1 where "b = b1*n + ?k" using assms(2) by (metis div_mult_mod_eq)
   ultimately have "a1 * n + ?k = b1 * n + ?k + c" using assms(1) by arith
   then have "c = (a1 - b1) * n" by (simp add: diff_mult_distrib)
   then show ?thesis by simp
 qed
 
 lemma funpow_add': "(f ^^ (m + n)) x = (f ^^ m) ((f ^^ n) x)"
 by (simp add: funpow_add)
 
 text \<open>The next two lemmas are not directly equivalent, since $f$ might
 not be injective.\<close>
 
 lemma abs_Max_sum:
   fixes A::"real set"
   assumes "finite A" "A \<noteq> {}"
   shows "abs(Max A) \<le> (\<Sum>a\<in>A. abs(a))"
-using assms by (induct rule: finite_ne_induct, auto)
+  by (simp add: assms member_le_sum)
 
 lemma abs_Max_sum2:
   fixes f::"_ \<Rightarrow> real"
   assumes "finite A" "A \<noteq> {}"
   shows "abs(Max (f`A)) \<le> (\<Sum>a\<in>A. abs(f a))"
 using assms by (induct rule: finite_ne_induct, auto)
 
 subsection \<open>Conditionally-Complete-Lattices.thy\<close>
 
 lemma mono_cInf:
   fixes f :: "'a::conditionally_complete_lattice \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes "mono f" "A \<noteq> {}" "bdd_below A"
   shows "f(Inf A) \<le> Inf (f`A)"
 using assms by (simp add: cINF_greatest cInf_lower monoD)
 
 lemma mono_bij_cInf:
   fixes f :: "'a::conditionally_complete_linorder \<Rightarrow> 'b::conditionally_complete_linorder"
   assumes "mono f" "bij f" "A \<noteq> {}" "bdd_below A"
   shows "f (Inf A) = Inf (f`A)"
 proof -
   have "(inv f) (Inf (f`A)) \<le> Inf ((inv f)`(f`A))"
     apply (rule cInf_greatest, auto simp add: assms(3))
     using mono_inv[OF assms(1) assms(2)] assms by (simp add: mono_def bdd_below_image_mono cInf_lower)
   then have "Inf (f`A) \<le> f (Inf ((inv f)`(f`A)))"
     by (metis (no_types, lifting) assms(1) assms(2) mono_def bij_inv_eq_iff)
   also have "... = f(Inf A)"
     using assms by (simp add: bij_is_inj)
   finally show ?thesis using mono_cInf[OF assms(1) assms(3) assms(4)] by auto
 qed
 
 subsection \<open>Topological-spaces.thy\<close>
 
 lemma open_less_abs [simp]:
   "open {x. (C::real) < abs x}"
 proof -
   have *: "{x. C < abs x} = abs-`{C<..}" by auto
   show ?thesis unfolding * by (auto intro!: continuous_intros)
 qed
 
 lemma closed_le_abs [simp]:
   "closed {x. (C::real) \<le> abs x}"
 proof -
   have *: "{x. C \<le> \<bar>x\<bar>} = abs-`{C..}" by auto
   show ?thesis unfolding * by (auto intro!: continuous_intros)
 qed
 
 text \<open>The next statements come from the same statements for true subsequences\<close>
 
 lemma eventually_weak_subseq:
   fixes u::"nat \<Rightarrow> nat"
   assumes "(\<lambda>n. real(u n)) \<longlonglongrightarrow> \<infinity>" "eventually P sequentially"
   shows "eventually (\<lambda>n. P (u n)) sequentially"
 proof -
   obtain N where *: "\<forall>n\<ge>N. P n" using assms(2) unfolding eventually_sequentially by auto
   obtain M where "\<forall>m\<ge>M. ereal(u m) \<ge> N" using assms(1) by (meson Lim_PInfty)
   then have "\<And>m. m \<ge> M \<Longrightarrow> u m \<ge> N" by auto
   then have "\<And>m. m \<ge> M \<Longrightarrow> P(u m)" using \<open>\<forall>n\<ge>N. P n\<close> by simp
   then show ?thesis unfolding eventually_sequentially by auto
 qed
 
 lemma filterlim_weak_subseq:
   fixes u::"nat \<Rightarrow> nat"
   assumes "(\<lambda>n. real(u n)) \<longlonglongrightarrow> \<infinity>"
   shows "LIM n sequentially. u n:> at_top"
 unfolding filterlim_iff by (metis assms eventually_weak_subseq)
 
 lemma limit_along_weak_subseq:
   fixes u::"nat \<Rightarrow> nat" and v::"nat \<Rightarrow> _"
   assumes "(\<lambda>n. real(u n)) \<longlonglongrightarrow> \<infinity>" "v \<longlonglongrightarrow> l"
   shows "(\<lambda> n. v(u n)) \<longlonglongrightarrow> l"
 using filterlim_compose[of v, OF _ filterlim_weak_subseq] assms by auto
 
 lemma frontier_indist_le:
   assumes "x \<in> frontier {y. infdist y S \<le> r}"
   shows "infdist x S = r"
 proof -
   have "infdist x S = r" if H: "\<forall>e>0. (\<exists>y. infdist y S \<le> r \<and> dist x y < e) \<and> (\<exists>z. \<not> infdist z S \<le> r \<and> dist x z < e)"
   proof -
     have "infdist x S < r + e" if "e > 0" for e
     proof -
       obtain y where "infdist y S \<le> r" "dist x y < e"
         using H \<open>e > 0\<close> by blast
       then show ?thesis
         by (metis add.commute add_mono_thms_linordered_field(3) infdist_triangle le_less_trans)
     qed
     then have A: "infdist x S \<le> r"
       by (meson field_le_epsilon order.order_iff_strict)
     have "r < infdist x S + e" if "e > 0" for e
     proof -
       obtain y where "\<not>(infdist y S \<le> r)" "dist x y < e"
         using H \<open>e > 0\<close> by blast
       then have "r < infdist y S" by auto
       also have "... \<le> infdist x S + dist y x"
         by (rule infdist_triangle)
       finally show ?thesis using \<open>dist x y < e\<close>
         by (simp add: dist_commute)
       qed
     then have B: "r \<le> infdist x S"
       by (meson field_le_epsilon order.order_iff_strict)
     show ?thesis using A B by auto
   qed
   then show ?thesis
     using assms unfolding frontier_straddle by auto
 qed
 
 
-subsection \<open>Connected.thy\<close>
-
-text \<open>The next lemma is missing in the library, contrary to its cousin \verb+continuous_infdist+.\<close>
-
-lemma continuous_on_infdist [continuous_intros]:
-  assumes "continuous_on S f"
-  shows "continuous_on S (\<lambda>x. infdist (f x) A)"
-using assms unfolding continuous_on by (auto intro: tendsto_infdist)
-
-
-subsection \<open>Transcendental.thy\<close>
-
-text \<open>In \verb+Transcendental.thy+, the assumptions of the next two lemmas are
-$x > 0$ and $y > 0$, while large inequalities are sufficient, with the same proof.\<close>
-
-lemma powr_divide: "0 \<le> x \<Longrightarrow> 0 \<le> y \<Longrightarrow> (x / y) powr a = (x powr a) / (y powr a)"
-  for a b x :: real
-  apply (simp add: divide_inverse positive_imp_inverse_positive powr_mult)
-  apply (simp add: powr_def exp_minus [symmetric] exp_add [symmetric] ln_inverse)
-  done
-
-lemma powr_mult_base: "0 \<le> x \<Longrightarrow>x * x powr y = x powr (1 + y)"
-  for x :: real
-  by (auto simp: powr_add)
-
-
-
 subsection \<open>Limits\<close>
 
-text \<open>\verb+lim_1_over_n+ is very useful, it could --should?-- be declared as simp and tendsto-intros.\<close>
-
-declare lim_1_over_n [tendsto_intros]
-
 text \<open>The next lemmas are not very natural, but I needed them several times\<close>
 
 lemma tendsto_shift_1_over_n [tendsto_intros]:
   fixes f::"nat \<Rightarrow> real"
   assumes "(\<lambda>n. f n / n) \<longlonglongrightarrow> l"
   shows "(\<lambda>n. f (n+k) / n) \<longlonglongrightarrow> l"
 proof -
   have "(1+k*(1/n))* (f(n+k)/(n+k)) = f(n+k)/n" if "n>0" for n using that by (auto simp add: divide_simps)
   with eventually_mono[OF eventually_gt_at_top[of "0::nat"] this]
   have "eventually (\<lambda>n.(1+k*(1/n))* (f(n+k)/(n+k)) = f(n+k)/n) sequentially"
     by auto
   moreover have "(\<lambda>n. (1+k*(1/n))* (f(n+k)/(n+k))) \<longlonglongrightarrow> (1+real k*0) * l"
     by (intro tendsto_intros LIMSEQ_ignore_initial_segment assms)
   ultimately show ?thesis using Lim_transform_eventually by auto
 qed
 
 lemma tendsto_shift_1_over_n' [tendsto_intros]:
   fixes f::"nat \<Rightarrow> real"
   assumes "(\<lambda>n. f n / n) \<longlonglongrightarrow> l"
   shows "(\<lambda>n. f (n-k) / n) \<longlonglongrightarrow> l"
 proof -
   have "(1-k*(1/(n+k)))* (f n/ n) = f n/(n+k)" if "n>0" for n using that by (auto simp add: divide_simps)
   with eventually_mono[OF eventually_gt_at_top[of "0::nat"] this]
   have "eventually (\<lambda>n. (1-k*(1/(n+k)))* (f n/ n) = f n/(n+k)) sequentially"
     by auto
   moreover have "(\<lambda>n. (1-k*(1/(n+k)))* (f n/ n)) \<longlonglongrightarrow> (1-real k*0) * l"
     by (intro tendsto_intros assms LIMSEQ_ignore_initial_segment)
   ultimately have "(\<lambda>n. f n / (n+k)) \<longlonglongrightarrow> l" using Lim_transform_eventually by auto
   then have a: "(\<lambda>n. f(n-k)/(n-k+k)) \<longlonglongrightarrow> l" using seq_offset_neg by auto
 
   have "f(n-k)/(n-k+k) = f(n-k)/n" if "n>k" for n
     using that by auto
   with eventually_mono[OF eventually_gt_at_top[of k] this]
   have "eventually (\<lambda>n. f(n-k)/(n-k+k) = f(n-k)/n) sequentially"
     by auto
   with Lim_transform_eventually[OF a this]
   show ?thesis by auto
 qed
 
 declare LIMSEQ_realpow_zero [tendsto_intros]
 
 subsection \<open>Topology-Euclidean-Space\<close>
 
-lemma Inf_as_limit:
-  fixes A::"'a::{linorder_topology, first_countable_topology, complete_linorder} set"
-  assumes "A \<noteq> {}"
-  shows "\<exists>u. (\<forall>n. u n \<in> A) \<and> u \<longlonglongrightarrow> Inf A"
-proof (cases "Inf A \<in> A")
-  case True
-  show ?thesis
-    by (rule exI[of _ "\<lambda>n. Inf A"], auto simp add: True)
-next
-  case False
-  obtain y where "y \<in> A" using assms by auto
-  then have "Inf A < y" using False Inf_lower less_le by auto
-  obtain F :: "nat \<Rightarrow> 'a set" where F: "\<And>i. open (F i)" "\<And>i. Inf A \<in> F i"
-                                       "\<And>u. (\<forall>n. u n \<in> F n) \<Longrightarrow> u \<longlonglongrightarrow> Inf A"
-    by (metis first_countable_topology_class.countable_basis)
-  define u where "u = (\<lambda>n. SOME z. z \<in> F n \<and> z \<in> A)"
-  have "\<exists>z. z \<in> U \<and> z \<in> A" if "Inf A \<in> U" "open U" for U
-  proof -
-    obtain b where "b > Inf A" "{Inf A ..<b} \<subseteq> U"
-      using open_right[OF \<open>open U\<close> \<open>Inf A \<in> U\<close> \<open>Inf A < y\<close>] by auto
-    obtain z where "z < b" "z \<in> A"
-      using \<open>Inf A < b\<close> Inf_less_iff by auto
-    then have "z \<in> {Inf A ..<b}"
-      by (simp add: Inf_lower)
-    then show ?thesis using \<open>z \<in> A\<close> \<open>{Inf A ..<b} \<subseteq> U\<close> by auto
-  qed
-  then have *: "u n \<in> F n \<and> u n \<in> A" for n
-    using \<open>Inf A \<in> F n\<close> \<open>open (F n)\<close> unfolding u_def by (metis (no_types, lifting) someI_ex)
-  then have "u \<longlonglongrightarrow> Inf A" using F(3) by simp
-  then show ?thesis using * by auto
-qed
-
 text \<open>A (more usable) variation around \verb+continuous_on_closure_sequentially+. The assumption
 that the spaces are metric spaces is definitely too strong, but sufficient for most applications.\<close>
 
 lemma continuous_on_closure_sequentially':
   fixes f::"'a::metric_space \<Rightarrow> 'b::metric_space"
   assumes "continuous_on (closure C) f"
           "\<And>(n::nat). u n \<in> C"
           "u \<longlonglongrightarrow> l"
   shows "(\<lambda>n. f (u n)) \<longlonglongrightarrow> f l"
 proof -
   have "l \<in> closure C" unfolding closure_sequential using assms by auto
   then show ?thesis
     using \<open>continuous_on (closure C) f\<close> unfolding comp_def continuous_on_closure_sequentially
     using assms by auto
 qed
 
 
 subsection \<open>Convexity\<close>
 
 lemma convex_on_mean_ineq:
   fixes f::"real \<Rightarrow> real"
   assumes "convex_on A f" "x \<in> A" "y \<in> A"
   shows "f ((x+y)/2) \<le> (f x + f y) / 2"
 using convex_onD[OF assms(1), of "1/2" x y] using assms by (auto simp add: divide_simps)
 
 lemma convex_on_closure:
   assumes "convex (C::'a::real_normed_vector set)"
           "convex_on C f"
           "continuous_on (closure C) f"
   shows "convex_on (closure C) f"
 proof (rule convex_onI)
   fix x y::'a and t::real
   assume "x \<in> closure C" "y \<in> closure C" "0 < t" "t < 1"
   obtain u v::"nat \<Rightarrow> 'a" where *: "\<And>n. u n \<in> C" "u \<longlonglongrightarrow> x"
                                    "\<And>n. v n \<in> C" "v \<longlonglongrightarrow> y"
     using \<open>x \<in> closure C\<close> \<open>y \<in> closure C\<close> unfolding closure_sequential by blast
   define w where "w = (\<lambda>n. (1-t) *\<^sub>R (u n) + t *\<^sub>R (v n))"
   have "w n \<in> C" for n
     using \<open>0 < t\<close> \<open>t< 1\<close> convexD[OF \<open>convex C\<close> *(1)[of n] *(3)[of n]] unfolding w_def by auto
   have "w \<longlonglongrightarrow> ((1-t) *\<^sub>R x + t *\<^sub>R y)"
     unfolding w_def using *(2) *(4) by (intro tendsto_intros)
 
   have *: "f(w n) \<le> (1-t) * f(u n) + t * f (v n)" for n
     using *(1) *(3) \<open>convex_on C f\<close> \<open>0<t\<close> \<open>t<1\<close> less_imp_le unfolding w_def
     convex_on_alt[OF assms(1)] by (simp add: add.commute)
   have i: "(\<lambda>n. f (w n)) \<longlonglongrightarrow> f ((1-t) *\<^sub>R x + t *\<^sub>R y)"
     by (rule continuous_on_closure_sequentially'[OF assms(3) \<open>\<And>n. w n \<in> C\<close> \<open>w \<longlonglongrightarrow> ((1-t) *\<^sub>R x + t *\<^sub>R y)\<close>])
   have ii: "(\<lambda>n. (1-t) * f(u n) + t * f (v n)) \<longlonglongrightarrow> (1-t) * f x + t * f y"
     apply (intro tendsto_intros)
     apply (rule continuous_on_closure_sequentially'[OF assms(3) \<open>\<And>n. u n \<in> C\<close> \<open>u \<longlonglongrightarrow> x\<close>])
     apply (rule continuous_on_closure_sequentially'[OF assms(3) \<open>\<And>n. v n \<in> C\<close> \<open>v \<longlonglongrightarrow> y\<close>])
     done
   show "f ((1 - t) *\<^sub>R x + t *\<^sub>R y) \<le> (1 - t) * f x + t * f y"
     apply (rule LIMSEQ_le[OF i ii]) using * by auto
 qed
 
 lemma convex_on_norm [simp]:
   "convex_on UNIV (\<lambda>(x::'a::real_normed_vector). norm x)"
 using convex_on_dist[of UNIV "0::'a"] by auto
 
 lemma continuous_abs_powr [continuous_intros]:
   assumes "p > 0"
   shows "continuous_on UNIV (\<lambda>(x::real). \<bar>x\<bar> powr p)"
 apply (rule continuous_on_powr') using assms by (auto intro: continuous_intros)
 
 lemma continuous_mult_sgn [continuous_intros]:
   fixes f::"real \<Rightarrow> real"
   assumes "continuous_on UNIV f" "f 0 = 0"
   shows "continuous_on UNIV (\<lambda>x. sgn x * f x)"
 proof -
   have *: "continuous_on {0..} (\<lambda>x. sgn x * f x)"
     apply (subst continuous_on_cong[of "{0..}" "{0..}" _ f], auto simp add: sgn_real_def assms(2))
     by (rule continuous_on_subset[OF assms(1)], auto)
   have **: "continuous_on {..0} (\<lambda>x. sgn x * f x)"
     apply (subst continuous_on_cong[of "{..0}" "{..0}" _ "\<lambda>x. -f x"], auto simp add: sgn_real_def assms(2))
     by (rule continuous_on_subset[of UNIV], auto simp add: assms intro!: continuous_intros)
   show ?thesis
     using continuous_on_closed_Un[OF _ _ * **] apply (auto intro: continuous_intros)
     using continuous_on_subset by fastforce
 qed
 
 lemma DERIV_abs_powr [derivative_intros]:
   assumes "p > (1::real)"
   shows "DERIV (\<lambda>x. \<bar>x\<bar> powr p) x :> p * sgn x * \<bar>x\<bar> powr (p - 1)"
 proof -
   consider "x = 0" | "x>0" | "x < 0" by linarith
   then show ?thesis
   proof (cases)
     case 1
     have "continuous_on UNIV (\<lambda>x. sgn x * \<bar>x\<bar> powr (p - 1))"
       by (auto simp add: assms intro!:continuous_intros)
     then have "(\<lambda>h. sgn h * \<bar>h\<bar> powr (p-1)) \<midarrow>0\<rightarrow> (\<lambda>h. sgn h * \<bar>h\<bar> powr (p-1)) 0"
       using continuous_on_def by blast
     moreover have "\<bar>h\<bar> powr p / h = sgn h * \<bar>h\<bar> powr (p-1)" for h
     proof -
       have "\<bar>h\<bar> powr p / h = sgn h * \<bar>h\<bar> powr p / \<bar>h\<bar>"
         by (auto simp add: algebra_simps divide_simps sgn_real_def)
       also have "... = sgn h * \<bar>h\<bar> powr (p-1)"
         using assms apply (cases "h = 0") apply (auto)
         by (metis abs_ge_zero powr_diff [symmetric] powr_one_gt_zero_iff times_divide_eq_right)
       finally show ?thesis by simp
     qed
     ultimately have "(\<lambda>h. \<bar>h\<bar> powr p / h) \<midarrow>0\<rightarrow> 0" by auto
     then show ?thesis unfolding DERIV_def by (auto simp add: \<open>x = 0\<close>)
   next
     case 2
     have *: "\<forall>\<^sub>F y in nhds x. \<bar>y\<bar> powr p = y powr p"
       unfolding eventually_nhds apply (rule exI[of _ "{0<..}"]) using \<open>x > 0\<close> by auto
     show ?thesis
       apply (subst DERIV_cong_ev[of _ x _ "(\<lambda>x. x powr p)" _ "p * x powr (p-1)"])
       using \<open>x > 0\<close> by (auto simp add: * has_real_derivative_powr)
   next
     case 3
     have *: "\<forall>\<^sub>F y in nhds x. \<bar>y\<bar> powr p = (-y) powr p"
       unfolding eventually_nhds apply (rule exI[of _ "{..<0}"]) using \<open>x < 0\<close> by auto
     show ?thesis
       apply (subst DERIV_cong_ev[of _ x _ "(\<lambda>x. (-x) powr p)" _ "p * (- x) powr (p - real 1) * - 1"])
       using \<open>x < 0\<close> apply (simp, simp add: *, simp)
       apply (rule DERIV_fun_powr[of "\<lambda>y. -y" "-1" "x" p]) using \<open>x < 0\<close> by (auto simp add: derivative_intros)
   qed
 qed
 
 lemma convex_abs_powr:
   assumes "p \<ge> 1"
   shows "convex_on UNIV (\<lambda>x::real. \<bar>x\<bar> powr p)"
 proof (cases "p = 1")
   case True
   have "convex_on UNIV (\<lambda>x::real. norm x)"
     by (rule convex_on_norm)
   moreover have "\<bar>x\<bar> powr p = norm x" for x using True by auto
   ultimately show ?thesis by simp
 next
   case False
   then have "p > 1" using assms by auto
   define g where "g = (\<lambda>x::real. p * sgn x * \<bar>x\<bar> powr (p - 1))"
   have *: "DERIV (\<lambda>x. \<bar>x\<bar> powr p) x :> g x" for x
     unfolding g_def using \<open>p>1\<close> by (intro derivative_intros)
   have **: "g x \<le> g y" if "x \<le> y" for x y
   proof -
     consider "x \<ge> 0 \<and> y \<ge> 0" | "x \<le> 0 \<and> y \<le> 0" | "x < 0 \<and> y > 0" using \<open>x \<le> y\<close> by linarith
     then show ?thesis
     proof (cases)
       case 1
       then show ?thesis unfolding g_def sgn_real_def using \<open>p>1\<close> \<open>x \<le> y\<close> by (auto simp add: powr_mono2)
     next
       case 2
       then show ?thesis unfolding g_def sgn_real_def using \<open>p>1\<close> \<open>x \<le> y\<close> by (auto simp add: powr_mono2)
     next
       case 3
       then have "g x \<le> 0" "0 \<le> g y" unfolding g_def using \<open>p > 1\<close> by auto
       then show ?thesis by simp
     qed
   qed
   show ?thesis
     apply (rule convex_on_realI[of _ _ g]) using * ** by auto
 qed
 
 lemma convex_powr:
   assumes "p \<ge> 1"
   shows "convex_on {0..} (\<lambda>x::real. x powr p)"
 proof -
   have "convex_on {0..} (\<lambda>x::real. \<bar>x\<bar> powr p)"
     using convex_abs_powr[OF \<open>p \<ge> 1\<close>] convex_on_subset by auto
   moreover have "\<bar>x\<bar> powr p = x powr p" if "x \<in> {0..}" for x using that by auto
   ultimately show ?thesis by (simp add: convex_on_def)
 qed
 
 lemma convex_powr':
   assumes "p > 0" "p \<le> 1"
   shows "convex_on {0..} (\<lambda>x::real. - (x powr p))"
 proof -
   have "convex_on {0<..} (\<lambda>x::real. - (x powr p))"
     apply (rule convex_on_realI[of _ _ "\<lambda>x. -p * x powr (p-1)"])
     apply (auto intro!:derivative_intros simp add: has_real_derivative_powr)
     using \<open>p > 0\<close> \<open>p \<le> 1\<close> by (auto simp add: algebra_simps divide_simps powr_mono2')
   moreover have "continuous_on {0..} (\<lambda>x::real. - (x powr p))"
     by (rule continuous_on_minus, rule continuous_on_powr', auto simp add: \<open>p > 0\<close> intro!: continuous_intros)
   moreover have "{(0::real)..} = closure {0<..}" "convex {(0::real)<..}" by auto
   ultimately show ?thesis using convex_on_closure by metis
 qed
 
 lemma convex_fx_plus_fy_ineq:
   fixes f::"real \<Rightarrow> real"
   assumes "convex_on {0..} f"
           "x \<ge> 0" "y \<ge> 0" "f 0 = 0"
   shows "f x + f y \<le> f (x+y)"
 proof -
   have *: "f a + f b \<le> f (a+b)" if "a \<ge> 0" "b \<ge> a" for a b
   proof (cases "a = 0")
     case False
     then have "a > 0" "b > 0" using \<open>b \<ge> a\<close> \<open>a \<ge> 0\<close> by auto
     have "(f 0 - f a) / (0 - a) \<le> (f 0 - f (a+b))/ (0 - (a+b))"
       apply (rule convex_on_diff[OF \<open>convex_on {0..} f\<close>]) using \<open>a > 0\<close> \<open>b > 0\<close> by auto
     also have "... \<le> (f b - f (a+b)) / (b - (a+b))"
       apply (rule convex_on_diff[OF \<open>convex_on {0..} f\<close>]) using \<open>a > 0\<close> \<open>b > 0\<close> by auto
     finally show ?thesis
       using \<open>a > 0\<close> \<open>b > 0\<close> \<open>f 0 = 0\<close> by (auto simp add: divide_simps algebra_simps)
   qed (simp add: \<open>f 0 = 0\<close>)
   then show ?thesis
     using \<open>x \<ge> 0\<close> \<open>y \<ge> 0\<close> by (metis add.commute le_less not_le)
 qed
 
 lemma x_plus_y_p_le_xp_plus_yp:
   fixes p x y::real
   assumes "p > 0" "p \<le> 1" "x \<ge> 0" "y \<ge> 0"
   shows "(x + y) powr p \<le> x powr p + y powr p"
 using convex_fx_plus_fy_ineq[OF convex_powr'[OF \<open>p > 0\<close> \<open>p \<le> 1\<close>] \<open>x \<ge> 0\<close> \<open>y \<ge> 0\<close>] by auto
 
 
 subsection \<open>Nonnegative-extended-real.thy\<close>
 
 lemma x_plus_top_ennreal [simp]:
   "x + \<top> = (\<top>::ennreal)"
 by simp
 
 lemma ennreal_ge_nat_imp_PInf:
   fixes x::ennreal
   assumes "\<And>N. x \<ge> of_nat N"
   shows "x = \<infinity>"
 using assms apply (cases x, auto) by (meson not_less reals_Archimedean2)
 
 lemma ennreal_archimedean:
   assumes "x \<noteq> (\<infinity>::ennreal)"
   shows "\<exists>n::nat. x \<le> n"
-proof (cases x)
-  case (real r)
-  then show ?thesis using real_arch_simple[of r] by auto
-next
-  case top
-  then show ?thesis using assms by auto
-qed
+  using assms ennreal_ge_nat_imp_PInf linear by blast
 
 lemma e2ennreal_mult:
   fixes a b::ereal
   assumes "a \<ge> 0"
   shows "e2ennreal(a * b) = e2ennreal a * e2ennreal b"
 by (metis assms e2ennreal_neg eq_onp_same_args ereal_mult_le_0_iff linear times_ennreal.abs_eq)
 
 lemma e2ennreal_mult':
   fixes a b::ereal
   assumes "b \<ge> 0"
   shows "e2ennreal(a * b) = e2ennreal a * e2ennreal b"
 using e2ennreal_mult[OF assms, of a] by (simp add: mult.commute)
 
 lemma SUP_real_ennreal:
   assumes "A \<noteq> {}" "bdd_above (f`A)"
   shows "(SUP a\<in>A. ennreal (f a)) = ennreal(SUP a\<in>A. f a)"
 apply (rule antisym, simp add: SUP_least assms(2) cSUP_upper ennreal_leI)
 by (metis assms(1) ennreal_SUP ennreal_less_top le_less)
 
 lemma e2ennreal_Liminf:
   "F \<noteq> bot \<Longrightarrow> e2ennreal (Liminf F f) = Liminf F (\<lambda>n. e2ennreal (f n))"
   by (rule Liminf_compose_continuous_mono[symmetric])
      (auto simp: mono_def e2ennreal_mono continuous_on_e2ennreal)
 
 lemma e2ennreal_eq_infty[simp]: "0 \<le> x \<Longrightarrow> e2ennreal x = top \<longleftrightarrow> x = \<infinity>"
   by (cases x) (auto)
 
 lemma ennreal_Inf_cmult:
   assumes "c>(0::real)"
   shows "Inf {ennreal c * x |x. P x} = ennreal c * Inf {x. P x}"
 proof -
   have "(\<lambda>x::ennreal. c * x) (Inf {x::ennreal. P x}) = Inf ((\<lambda>x::ennreal. c * x)`{x::ennreal. P x})"
     apply (rule mono_bij_Inf)
     apply (simp add: monoI mult_left_mono)
     apply (rule bij_betw_byWitness[of _ "\<lambda>x. (x::ennreal) / c"], auto simp add: assms)
     apply (metis assms ennreal_lessI ennreal_neq_top mult.commute mult_divide_eq_ennreal not_less_zero)
     apply (metis assms divide_ennreal_def ennreal_less_zero_iff ennreal_neq_top less_irrefl mult.assoc mult.left_commute mult_divide_eq_ennreal)
     done
   then show ?thesis by (simp only: setcompr_eq_image[symmetric])
 qed
 
 lemma continuous_on_const_minus_ennreal:
   fixes f :: "'a :: topological_space \<Rightarrow> ennreal"
   shows "continuous_on A f \<Longrightarrow> continuous_on A (\<lambda>x. a - f x)"
   including ennreal.lifting
 proof (transfer fixing: A; clarsimp)
   fix f :: "'a \<Rightarrow> ereal" and a :: "ereal" assume "0 \<le> a" "\<forall>x. 0 \<le> f x" and f: "continuous_on A f"
   then show "continuous_on A (\<lambda>x. max 0 (a - f x))"
   proof cases
     assume "\<exists>r. a = ereal r"
     with f show ?thesis
       by (auto simp: continuous_on_def minus_ereal_def ereal_Lim_uminus[symmetric]
               intro!: tendsto_add_ereal_general tendsto_max)
   next
     assume "\<nexists>r. a = ereal r"
     with \<open>0 \<le> a\<close> have "a = \<infinity>"
       by (cases a) auto
     then show ?thesis
       by (simp add: continuous_on_const)
   qed
 qed
 
 lemma const_minus_Liminf_ennreal:
   fixes a :: ennreal
   shows "F \<noteq> bot \<Longrightarrow> a - Liminf F f = Limsup F (\<lambda>x. a - f x)"
 by (intro Limsup_compose_continuous_antimono[symmetric])
    (auto simp: antimono_def ennreal_mono_minus continuous_on_id continuous_on_const_minus_ennreal)
 
-declare tendsto_ennrealI [tendsto_intros]
-
-lemma tendsto_mult_ennreal [tendsto_intros]:
-  fixes f g::"_ \<Rightarrow> ennreal"
-  assumes "(f \<longlongrightarrow> l) F" "(g \<longlongrightarrow> m) F" "\<not>((l = 0 \<and> m = \<infinity>) \<or> (m = 0 \<and> l = \<infinity>))"
-  shows "((\<lambda>x. f x * g x) \<longlongrightarrow> l * m) F"
-proof -
-  have "((\<lambda>x. enn2ereal(f x) * enn2ereal(g x)) \<longlongrightarrow> enn2ereal l * enn2ereal m) F"
-    apply (auto intro!: tendsto_intros simp add: assms)
-    by (insert assms le_zero_eq less_eq_ennreal.rep_eq, fastforce)+
-  then have "((\<lambda>x. enn2ereal(f x * g x)) \<longlongrightarrow> enn2ereal(l * m)) F"
-    using times_ennreal.rep_eq by auto
-  then show ?thesis
-    by (auto intro!: tendsto_intros)
-qed
-
 lemma tendsto_cmult_ennreal [tendsto_intros]:
   fixes c l::ennreal
   assumes "\<not>(c = \<infinity> \<and> l = 0)"
           "(f \<longlongrightarrow> l) F"
   shows "((\<lambda>x. c * f x) \<longlongrightarrow> c * l) F"
 by (cases "c = 0", insert assms, auto intro!: tendsto_intros)
 
 
 subsection \<open>Indicator-Function.thy\<close>
 
 text \<open>There is something weird with \verb+sum_mult_indicator+: it is defined both
 in Indicator.thy and BochnerIntegration.thy, with a different meaning. I am surprised
 there is no name collision... Here, I am using the version from BochnerIntegration.\<close>
 
 lemma sum_indicator_eq_card2:
   assumes "finite I"
   shows "(\<Sum>i\<in>I. (indicator (P i) x)::nat) = card {i\<in>I. x \<in> P i}"
 using sum_mult_indicator [OF assms, of "\<lambda>y. 1::nat" P "\<lambda>y. x"]
 unfolding card_eq_sum by auto
 
 lemma disjoint_family_indicator_le_1:
   assumes "disjoint_family_on A I"
   shows "(\<Sum> i\<in> I. indicator (A i) x) \<le> (1::'a:: {comm_monoid_add,zero_less_one})"
 proof (cases "finite I")
   case True
   then have *: "(\<Sum> i\<in> I. indicator (A i) x) = ((indicator (\<Union>i\<in>I. A i) x)::'a)"
     by (simp add: indicator_UN_disjoint[OF True assms(1), of x])
   show ?thesis
     unfolding * unfolding indicator_def by (simp add: order_less_imp_le)
 next
   case False
   then show ?thesis by (simp add: order_less_imp_le)
 qed
 
 subsection \<open>sigma-algebra.thy\<close>
 
 lemma algebra_intersection:
   assumes "algebra \<Omega> A"
           "algebra \<Omega> B"
   shows "algebra \<Omega> (A \<inter> B)"
 apply (subst algebra_iff_Un) using assms by (auto simp add: algebra_iff_Un)
 
 lemma sigma_algebra_intersection:
   assumes "sigma_algebra \<Omega> A"
           "sigma_algebra \<Omega> B"
   shows "sigma_algebra \<Omega> (A \<inter> B)"
 apply (subst sigma_algebra_iff) using assms by (auto simp add: sigma_algebra_iff algebra_intersection)
 
 lemma subalgebra_M_M [simp]:
   "subalgebra M M"
 by (simp add: subalgebra_def)
 
 text \<open>The next one is \verb+disjoint_family_Suc+ with inclusions reversed.\<close>
 
 lemma disjoint_family_Suc2:
   assumes Suc: "\<And>n. A (Suc n) \<subseteq> A n"
   shows "disjoint_family (\<lambda>i. A i - A (Suc i))"
 proof -
   have "A (m+n) \<subseteq> A n" for m n
   proof (induct m)
     case 0 show ?case by simp
   next
     case (Suc m) then show ?case
       by (metis Suc_eq_plus1 assms add.commute add.left_commute subset_trans)
   qed
   then have "A m \<subseteq> A n" if "m > n" for m n
     by (metis that add.commute le_add_diff_inverse nat_less_le)
   then show ?thesis
     by (auto simp add: disjoint_family_on_def)
        (metis insert_absorb insert_subset le_SucE le_antisym not_le_imp_less)
 qed
 
 
 subsection \<open>Measure-Space.thy\<close>
 
-lemma emeasure_union_inter:
-  assumes "A \<in> sets M" "B \<in> sets M"
-  shows "emeasure M A + emeasure M B = emeasure M (A \<union> B) + emeasure M (A \<inter> B)"
-proof -
-  have "A = (A-B) \<union> (A \<inter> B)" by auto
-  then have 1: "emeasure M A = emeasure M (A-B) + emeasure M (A \<inter> B)"
-    by (metis Diff_Diff_Int Diff_disjoint assms(1) assms(2) plus_emeasure sets.Diff)
-
-  have "A \<union> B = (A-B) \<union> B" by auto
-  then have 2: "emeasure M (A \<union> B) = emeasure M (A-B) + emeasure M B"
-    by (metis Diff_disjoint Int_commute assms(1) assms(2) plus_emeasure sets.Diff)
-
-  show ?thesis using 1 2 by (metis add.assoc add.commute)
-qed
-
 lemma AE_equal_sum:
   assumes "\<And>i. AE x in M. f i x = g i x"
   shows "AE x in M. (\<Sum>i\<in>I. f i x) = (\<Sum>i\<in>I. g i x)"
 proof (cases)
   assume "finite I"
   have "\<exists>A. A \<in> null_sets M \<and> (\<forall>x\<in> (space M - A). f i x = g i x)" for i
     using assms(1)[of i] by (metis (mono_tags, lifting) AE_E3)
   then obtain A where A: "\<And>i. A i \<in> null_sets M \<and> (\<forall>x\<in> (space M -A i). f i x = g i x)"
     by metis
   define B where "B = (\<Union>i\<in>I. A i)"
   have "B \<in> null_sets M" using \<open>finite I\<close> A B_def by blast
   then have "AE x in M. x \<in> space M - B" by (simp add: AE_not_in)
   moreover
   {
     fix x assume "x \<in> space M - B"
     then have "\<And>i. i \<in> I \<Longrightarrow> f i x = g i x" unfolding B_def using A by auto
     then have "(\<Sum>i\<in>I. f i x) = (\<Sum>i\<in>I. g i x)" by auto
   }
   ultimately show ?thesis by auto
 qed (simp)
 
 lemma emeasure_pos_unionE:
   assumes "\<And> (N::nat). A N \<in> sets M"
           "emeasure M (\<Union>N. A N) > 0"
   shows "\<exists>N. emeasure M (A N) > 0"
 proof (rule ccontr)
   assume "\<not>(\<exists>N. emeasure M (A N) > 0)"
   then have "\<And>N. A N \<in> null_sets M"
     using assms(1) by auto
   then have "(\<Union>N. A N) \<in> null_sets M" by auto
   then show False using assms(2) by auto
 qed
 
 lemma (in prob_space) emeasure_intersection:
   fixes e::"nat \<Rightarrow> real"
   assumes [measurable]: "\<And>n. U n \<in> sets M"
       and [simp]: "\<And>n. 0 \<le> e n" "summable e"
       and ge: "\<And>n. emeasure M (U n) \<ge> 1 - (e n)"
   shows "emeasure M (\<Inter>n. U n) \<ge> 1 - (\<Sum>n. e n)"
 proof -
   define V where "V = (\<lambda>n. space M - (U n))"
   have [measurable]: "V n \<in> sets M" for n
     unfolding V_def by auto
   have *: "emeasure M (V n) \<le> e n" for n
     unfolding V_def using ge[of n] by (simp add: emeasure_eq_measure prob_compl ennreal_leI)
   have "emeasure M (\<Union>n. V n) \<le> (\<Sum>n. emeasure M (V n))"
     by (rule emeasure_subadditive_countably, auto)
   also have "... \<le> (\<Sum>n. ennreal (e n))"
     using * by (intro suminf_le) auto
   also have "... = ennreal (\<Sum>n. e n)"
     by (intro suminf_ennreal_eq) auto
   finally have "emeasure M (\<Union>n. V n) \<le> suminf e" by simp
   then have "1 - suminf e \<le> emeasure M (space M - (\<Union>n. V n))"
     by (simp add: emeasure_eq_measure prob_compl suminf_nonneg)
   also have "... \<le> emeasure M (\<Inter>n. U n)"
     by (rule emeasure_mono) (auto simp: V_def)
   finally show ?thesis by simp
 qed
 
 lemma null_sym_diff_transitive:
   assumes "A \<Delta> B \<in> null_sets M" "B \<Delta> C \<in> null_sets M"
       and [measurable]: "A \<in> sets M" "C \<in> sets M"
   shows "A \<Delta> C \<in> null_sets M"
 proof -
   have "A \<Delta> B \<union> B \<Delta> C \<in> null_sets M" using assms(1) assms(2) by auto
   moreover have "A \<Delta> C \<subseteq> A \<Delta> B \<union> B \<Delta> C" by auto
   ultimately show ?thesis by (meson null_sets_subset assms(3) assms(4) sets.Diff sets.Un)
 qed
 
 lemma Delta_null_of_null_is_null:
   assumes "B \<in> sets M" "A \<Delta> B \<in> null_sets M" "A \<in> null_sets M"
   shows "B \<in> null_sets M"
 proof -
   have "B \<subseteq> A \<union> (A \<Delta> B)" by auto
   then show ?thesis using assms by (meson null_sets.Un null_sets_subset)
 qed
 
 lemma Delta_null_same_emeasure:
   assumes "A \<Delta> B \<in> null_sets M" and [measurable]: "A \<in> sets M" "B \<in> sets M"
   shows "emeasure M A = emeasure M B"
 proof -
   have "A = (A \<inter> B) \<union> (A-B)" by blast
   moreover have "A-B \<in> null_sets M" using assms null_sets_subset by blast
   ultimately have a: "emeasure M A = emeasure M (A \<inter> B)" using emeasure_Un_null_set by (metis assms(2) assms(3) sets.Int)
 
   have "B = (A \<inter> B) \<union> (B-A)" by blast
   moreover have "B-A \<in> null_sets M" using assms null_sets_subset by blast
   ultimately have "emeasure M B = emeasure M (A \<inter> B)" using emeasure_Un_null_set by (metis assms(2) assms(3) sets.Int)
   then show ?thesis using a by auto
 qed
 
 lemma AE_upper_bound_inf_ereal:
   fixes F G::"'a \<Rightarrow> ereal"
   assumes "\<And>e. (e::real) > 0 \<Longrightarrow> AE x in M. F x \<le> G x + e"
   shows "AE x in M. F x \<le> G x"
 proof -
   have "AE x in M. \<forall>n::nat. F x \<le> G x + ereal (1 / Suc n)"
     using assms by (auto simp: AE_all_countable)
   then show ?thesis
   proof (eventually_elim)
     fix x assume x: "\<forall>n::nat. F x \<le> G x + ereal (1 / Suc n)"
     show "F x \<le> G x"
     proof (intro ereal_le_epsilon2[of _ "G x"] allI impI)
       fix e :: real assume "0 < e"
       then obtain n where n: "1 / Suc n < e"
         by (blast elim: nat_approx_posE)
       have "F x \<le> G x + 1 / Suc n"
         using x by simp
       also have "\<dots> \<le> G x + e"
         using n by (intro add_mono ennreal_leI) auto
       finally show "F x \<le> G x + ereal e" .
     qed
   qed
 qed
 
 
 text \<open>Egorov theorem asserts that, if a sequence of functions converges almost everywhere to a
 limit, then the convergence is uniform on a subset of close to full measure. The first step in the
 proof is the following lemma, often useful by itself, asserting the same result for predicates:
 if a property $P_n x$ is eventually true for almost every $x$, then there exists $N$
 such that $P_n x$ is true for all $n\geq N$ and all $x$ in a set of close to full measure.
 \<close>
 lemma (in finite_measure) Egorov_lemma:
   assumes [measurable]: "\<And>n. (P n) \<in> measurable M (count_space UNIV)"
       and "AE x in M. eventually (\<lambda>n. P n x) sequentially"
           "epsilon > 0"
   shows "\<exists>U N. U \<in> sets M \<and> (\<forall>n \<ge> N. \<forall>x \<in> U. P n x) \<and> emeasure M (space M - U) < epsilon"
 proof -
   define K where "K = (\<lambda>n. {x \<in> space M. \<exists>k\<ge>n. \<not>(P k x)})"
   have [measurable]: "K n \<in> sets M" for n
     unfolding K_def by auto
   have "x \<notin> (\<Inter>n. K n)" if "eventually (\<lambda>n. P n x) sequentially" for x
     unfolding K_def using that unfolding K_def eventually_sequentially by auto
   then have "AE x in M. x \<notin> (\<Inter>n. K n)" using assms by auto
   then have Z: "0 = emeasure M (\<Inter>n. K n)"
     using AE_iff_measurable[of "(\<Inter>n. K n)" M "\<lambda>x. x \<notin> (\<Inter>n. K n)"] unfolding K_def by auto
   have *: "(\<lambda>n. emeasure M (K n)) \<longlonglongrightarrow> 0"
     unfolding Z apply (rule Lim_emeasure_decseq) using order_trans by (auto simp add: K_def decseq_def)
   have "eventually (\<lambda>n. emeasure M (K n) < epsilon) sequentially"
     by (rule order_tendstoD(2)[OF * \<open>epsilon > 0\<close>])
   then obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> emeasure M (K n) < epsilon"
     unfolding eventually_sequentially by auto
   define U where "U = space M - K N"
   have A [measurable]: "U \<in> sets M" unfolding U_def by auto
   have "space M - U = K N"
     unfolding U_def K_def by auto
   then have B: "emeasure M (space M - U) < epsilon"
     using N by auto
   have "\<forall>n \<ge> N. \<forall>x \<in> U. P n x"
     unfolding U_def K_def by auto
   then show ?thesis using A B by blast
 qed
 
 text \<open>The next lemma asserts that, in an uncountable family of disjoint sets, then there is one
 set with zero measure (and in fact uncountably many). It is often applied to the boundaries of
 $r$-neighborhoods of a given set, to show that one could choose $r$ for which this boundary has
 zero measure (this shows up often in relation with weak convergence).\<close>
 
 lemma (in finite_measure) uncountable_disjoint_family_then_exists_zero_measure:
   assumes [measurable]: "\<And>i. i \<in> I \<Longrightarrow> A i \<in> sets M"
       and "uncountable I"
           "disjoint_family_on A I"
   shows "\<exists>i\<in>I. measure M (A i) = 0"
 proof -
   define f where "f = (\<lambda>(r::real). {i \<in> I. measure M (A i) > r})"
   have *: "finite (f r)" if "r > 0" for r
   proof -
     obtain N::nat where N: "measure M (space M)/r \<le> N"
       using real_arch_simple by blast
     have "finite (f r) \<and> card (f r) \<le> N"
     proof (rule finite_if_finite_subsets_card_bdd)
       fix G assume G: "G \<subseteq> f r" "finite G"
       then have "G \<subseteq> I" unfolding f_def by auto
       have "card G * r = (\<Sum>i \<in> G. r)" by auto
       also have "... \<le> (\<Sum>i \<in> G. measure M (A i))"
         apply (rule sum_mono) using G unfolding f_def by auto
       also have "... = measure M (\<Union>i\<in>G. A i)"
         apply (rule finite_measure_finite_Union[symmetric])
         using \<open>finite G\<close> \<open>G \<subseteq> I\<close> \<open>disjoint_family_on A I\<close> disjoint_family_on_mono by auto
       also have "... \<le> measure M (space M)"
         by (simp add: bounded_measure)
       finally have "card G \<le> measure M (space M)/r"
         using \<open>r > 0\<close> by (simp add: divide_simps)
       then show "card G \<le> N" using N by auto
     qed
     then show ?thesis by simp
   qed
   have "countable (\<Union>n. f (((1::real)/2)^n))"
     by (rule countable_UN, auto intro!: countable_finite *)
   then have "I - (\<Union>n. f (((1::real)/2)^n)) \<noteq> {}"
     using assms(2) by (metis countable_empty uncountable_minus_countable)
   then obtain i where "i \<in> I" "i \<notin> (\<Union>n. f ((1/2)^n))" by auto
   then have "measure M (A i) \<le> (1 / 2) ^ n" for n
     unfolding f_def using linorder_not_le by auto
   moreover have "(\<lambda>n. ((1::real) / 2) ^ n) \<longlonglongrightarrow> 0"
     by (intro tendsto_intros, auto)
   ultimately have "measure M (A i) \<le> 0"
     using LIMSEQ_le_const by force
   then have "measure M (A i) = 0"
     by (simp add: measure_le_0_iff)
   then show ?thesis using \<open>i \<in> I\<close> by auto
 qed
 
 text \<open>The next statements are useful measurability statements.\<close>
 
 lemma measurable_Inf [measurable]:
   assumes [measurable]: "\<And>(n::nat). P n \<in> measurable M (count_space UNIV)"
   shows "(\<lambda>x. Inf {n. P n x}) \<in> measurable M (count_space UNIV)" (is "?f \<in> _")
 proof -
   define A where "A = (\<lambda>n. (P n)-`{True} \<inter> space M - (\<Union>m<n. (P m)-`{True} \<inter> space M))"
   have A_meas [measurable]: "A n \<in> sets M" for n unfolding A_def by measurable
   define B where "B = (\<lambda>n. if n = 0 then (space M - (\<Union>n. A n)) else A (n-1))"
   show ?thesis
   proof (rule measurable_piecewise_restrict2[of B])
     show "B n \<in> sets M" for n unfolding B_def by simp
     show "space M = (\<Union>n. B n)"
       unfolding B_def using sets.sets_into_space [OF A_meas] by auto
     have *: "?f x = n" if "x \<in> A n" for x n
       apply (rule cInf_eq_minimum) using that unfolding A_def by auto
     moreover have **: "?f x = (Inf ({}::nat set))" if "x \<in> space M - (\<Union>n. A n)" for x
     proof -
       have "\<not>(P n x)" for n
         apply (induction n rule: nat_less_induct) using that unfolding A_def by auto
       then show ?thesis by simp
     qed
     ultimately have "\<exists>c. \<forall>x \<in> B n. ?f x = c" for n
       apply (cases "n = 0") unfolding B_def by auto
     then show "\<exists>h \<in> measurable M (count_space UNIV). \<forall>x \<in> B n. ?f x = h x" for n
       by fastforce
   qed
 qed
 
 lemma measurable_T_iter [measurable]:
   fixes f::"'a \<Rightarrow> nat"
   assumes [measurable]: "T \<in> measurable M M"
           "f \<in> measurable M (count_space UNIV)"
   shows "(\<lambda>x. (T^^(f x)) x) \<in> measurable M M"
 proof -
   have [measurable]: "(T^^n) \<in> measurable M M" for n::nat
     by (induction n, auto)
   show ?thesis
     by (rule measurable_compose_countable, auto)
 qed
 
 lemma measurable_infdist [measurable]:
   "(\<lambda>x. infdist x S) \<in> borel_measurable borel"
 by (rule borel_measurable_continuous_onI, intro continuous_intros)
 
 text \<open>The next lemma shows that, in a sigma finite measure space, sets with large measure
 can be approximated by sets with large but finite measure.\<close>
 
 lemma (in sigma_finite_measure) approx_with_finite_emeasure:
   assumes W_meas: "W \<in> sets M"
       and W_inf: "emeasure M W > C"
   obtains Z where "Z \<in> sets M" "Z \<subseteq> W" "emeasure M Z < \<infinity>" "emeasure M Z > C"
 proof (cases "emeasure M W = \<infinity>")
   case True
   obtain r where r: "C = ennreal r" using W_inf by (cases C, auto)
   obtain Z where "Z \<in> sets M" "Z \<subseteq> W" "emeasure M Z < \<infinity>" "emeasure M Z > C"
     unfolding r using approx_PInf_emeasure_with_finite[OF W_meas True, of r] by auto
   then show ?thesis using that by blast
 next
   case False
   then have "W \<in> sets M" "W \<subseteq> W" "emeasure M W < \<infinity>" "emeasure M W > C"
     using assms apply auto using top.not_eq_extremum by blast
   then show ?thesis using that by blast
 qed
 
 subsection \<open>Nonnegative-Lebesgue-Integration.thy\<close>
 
 text \<open>The next lemma is a variant of \verb+nn_integral_density+,
 with the density on the right instead of the left, as seems more common.\<close>
 
 lemma nn_integral_densityR:
   assumes [measurable]: "f \<in> borel_measurable F" "g \<in> borel_measurable F"
   shows "(\<integral>\<^sup>+ x. f x * g x \<partial>F) = (\<integral>\<^sup>+ x. f x \<partial>(density F g))"
 proof -
   have "(\<integral>\<^sup>+ x. f x * g x \<partial>F) = (\<integral>\<^sup>+ x. g x * f x \<partial>F)" by (simp add: mult.commute)
   also have "... = (\<integral>\<^sup>+ x. f x \<partial>(density F g))"
     by (rule nn_integral_density[symmetric], simp_all add: assms)
   finally show ?thesis by simp
 qed
 
 lemma not_AE_zero_int_ennreal_E:
   fixes f::"'a \<Rightarrow> ennreal"
   assumes "(\<integral>\<^sup>+x. f x \<partial>M) > 0"
       and [measurable]: "f \<in> borel_measurable M"
   shows "\<exists>A\<in>sets M. \<exists>e::real>0. emeasure M A > 0 \<and> (\<forall>x \<in> A. f x \<ge> e)"
 proof (rule not_AE_zero_ennreal_E, auto simp add: assms)
   assume *: "AE x in M. f x = 0"
   have "(\<integral>\<^sup>+x. f x \<partial>M) = (\<integral>\<^sup>+x. 0 \<partial>M)" by (rule nn_integral_cong_AE, simp add: *)
   then have "(\<integral>\<^sup>+x. f x \<partial>M) = 0" by simp
   then show False using assms by simp
 qed
 
 lemma (in finite_measure) nn_integral_bounded_eq_bound_then_AE:
   assumes "AE x in M. f x \<le> ennreal c" "(\<integral>\<^sup>+x. f x \<partial>M) = c * emeasure M (space M)"
       and [measurable]: "f \<in> borel_measurable M"
   shows "AE x in M. f x = c"
 proof (cases)
   assume "emeasure M (space M) = 0"
   then show ?thesis by (rule emeasure_0_AE)
 next
   assume "emeasure M (space M) \<noteq> 0"
   have fin: "AE x in M. f x \<noteq> top" using assms by (auto simp: top_unique)
   define g where "g = (\<lambda>x. c - f x)"
   have [measurable]: "g \<in> borel_measurable M" unfolding g_def by auto
   have "(\<integral>\<^sup>+x. g x \<partial>M) = (\<integral>\<^sup>+x. c \<partial>M) - (\<integral>\<^sup>+x. f x \<partial>M)"
     unfolding g_def by (rule nn_integral_diff, auto simp add: assms ennreal_mult_eq_top_iff)
   also have "\<dots> = 0" using assms(2) by (auto simp: ennreal_mult_eq_top_iff)
   finally have "AE x in M. g x = 0"
     by (subst nn_integral_0_iff_AE[symmetric]) auto
   then have "AE x in M. c \<le> f x" unfolding g_def using fin by (auto simp: ennreal_minus_eq_0)
   then show ?thesis using assms(1) by auto
 qed
 
 
 lemma null_sets_density:
   assumes [measurable]: "h \<in> borel_measurable M"
       and "AE x in M. h x \<noteq> 0"
   shows "null_sets (density M h) = null_sets M"
 proof -
   have *: "A \<in> sets M \<and> (AE x\<in>A in M. h x = 0) \<longleftrightarrow> A \<in> null_sets M" for A
   proof (auto)
     assume "A \<in> sets M" "AE x\<in>A in M. h x = 0"
     then show "A \<in> null_sets M"
       unfolding AE_iff_null_sets[OF \<open>A \<in> sets M\<close>] using assms(2) by auto
   next
     assume "A \<in> null_sets M"
     then show "AE x\<in>A in M. h x = 0"
       by (metis (mono_tags, lifting) AE_not_in eventually_mono)
   qed
   show ?thesis
     apply (rule set_eqI)
     unfolding null_sets_density_iff[OF \<open>h \<in> borel_measurable M\<close>] using * by auto
 qed
 
 
 text \<open>The next proposition asserts that, if a function $h$ is integrable, then its integral on
 any set with small enough measure is small. The good conceptual proof is by considering the
 distribution of the function $h$ on $\mathbb{R}$ and looking at its tails. However, there is a
 less conceptual but more direct proof, based on dominated convergence and a proof by contradiction.
 This is the proof we give below.\<close>
 
 proposition integrable_small_integral_on_small_sets:
   fixes h::"'a \<Rightarrow> real"
   assumes [measurable]: "integrable M h"
       and "delta > 0"
   shows "\<exists>epsilon>(0::real). \<forall>U \<in> sets M. emeasure M U < epsilon \<longrightarrow> abs (\<integral>x\<in>U. h x \<partial>M) < delta"
 proof (rule ccontr)
   assume H: "\<not> (\<exists>epsilon>0. \<forall>U\<in>sets M. emeasure M U < ennreal epsilon \<longrightarrow> abs(set_lebesgue_integral M U h) < delta)"
   have "\<exists>f. \<forall>epsilon\<in>{0<..}. f epsilon \<in>sets M \<and> emeasure M (f epsilon) < ennreal epsilon
                             \<and> \<not>(abs(set_lebesgue_integral M (f epsilon) h) < delta)"
     apply (rule bchoice) using H by auto
   then obtain f::"real \<Rightarrow> 'a set" where f:
               "\<And>epsilon. epsilon > 0 \<Longrightarrow> f epsilon \<in>sets M"
               "\<And>epsilon. epsilon > 0 \<Longrightarrow> emeasure M (f epsilon) < ennreal epsilon"
               "\<And>epsilon. epsilon > 0 \<Longrightarrow> \<not>(abs(set_lebesgue_integral M (f epsilon) h) < delta)"
     by blast
   define A where "A = (\<lambda>n::nat. f ((1/2)^n))"
   have [measurable]: "A n \<in> sets M" for n
     unfolding A_def using f(1) by auto
   have *: "emeasure M (A n) < ennreal ((1/2)^n)" for n
     unfolding A_def using f(2) by auto
   have Large: "\<not>(abs(set_lebesgue_integral M (A n) h) < delta)" for n
     unfolding A_def using f(3) by auto
 
   have S: "summable (\<lambda>n. Sigma_Algebra.measure M (A n))"
     apply (rule summable_comparison_test'[of "\<lambda>n. (1/2)^n" 0])
     apply (rule summable_geometric, auto)
     apply (subst ennreal_le_iff[symmetric], simp)
     using less_imp_le[OF *] by (metis * emeasure_eq_ennreal_measure top.extremum_strict)
   have "AE x in M. eventually (\<lambda>n. x \<in> space M - A n) sequentially"
     apply (rule borel_cantelli_AE1, auto simp add: S)
     by (metis * top.extremum_strict top.not_eq_extremum)
   moreover have "(\<lambda>n. indicator (A n) x * h x) \<longlonglongrightarrow> 0"
     if "eventually (\<lambda>n. x \<in> space M - A n) sequentially" for x
   proof -
     have "eventually (\<lambda>n. indicator (A n) x * h x = 0) sequentially"
       apply (rule eventually_mono[OF that]) unfolding indicator_def by auto
     then show ?thesis
       unfolding eventually_sequentially using lim_explicit by force
   qed
   ultimately have A: "AE x in M. ((\<lambda>n. indicator (A n) x * h x) \<longlonglongrightarrow> 0)"
     by auto
   have I: "integrable M (\<lambda>x. abs(h x))"
     using \<open>integrable M h\<close> by auto
   have L: "(\<lambda>n. abs (\<integral>x. indicator (A n) x * h x \<partial>M)) \<longlonglongrightarrow> abs (\<integral>x. 0 \<partial>M)"
     apply (intro tendsto_intros)
     apply (rule integral_dominated_convergence[OF _ _ I A])
     unfolding indicator_def by auto
   have "eventually (\<lambda>n. abs (\<integral>x. indicator (A n) x * h x \<partial>M) < delta) sequentially"
     apply (rule order_tendstoD[OF L]) using \<open>delta > 0\<close> by auto
   then show False
     using Large by (auto simp: set_lebesgue_integral_def)
 qed
 
 text \<open>We also give the version for nonnegative ennreal valued functions. It follows from the
 previous one.\<close>
 
 proposition small_nn_integral_on_small_sets:
   fixes h::"'a \<Rightarrow> ennreal"
   assumes [measurable]: "h \<in> borel_measurable M"
       and "delta > (0::real)" "(\<integral>\<^sup>+x. h x \<partial>M) \<noteq> \<infinity>"
   shows "\<exists>epsilon>(0::real). \<forall>U \<in> sets M. emeasure M U < epsilon \<longrightarrow> (\<integral>\<^sup>+x\<in>U. h x \<partial>M) < delta"
 proof -
   define f where "f = (\<lambda>x. enn2real(h x))"
   have "AE x in M. h x \<noteq> \<infinity>"
     using assms by (metis nn_integral_PInf_AE)
   then have *: "AE x in M. ennreal (f x) = h x"
     unfolding f_def using ennreal_enn2real_if by auto
   have **: "(\<integral>\<^sup>+x. ennreal (f x) \<partial>M) \<noteq> \<infinity>"
     using nn_integral_cong_AE[OF *] assms by auto
   have [measurable]: "f \<in> borel_measurable M" unfolding f_def by auto
   have "integrable M f"
     apply (rule integrableI_nonneg) using assms * f_def ** apply auto
     using top.not_eq_extremum by blast
   obtain epsilon::real where H: "epsilon > 0" "\<And>U. U \<in> sets M \<Longrightarrow> emeasure M U < epsilon \<Longrightarrow> abs(\<integral>x\<in>U. f x \<partial>M) < delta"
     using integrable_small_integral_on_small_sets[OF \<open>integrable M f\<close> \<open>delta > 0\<close>] by blast
   have "(\<integral>\<^sup>+x\<in>U. h x \<partial>M) < delta" if [measurable]: "U \<in> sets M" "emeasure M U < epsilon" for U
   proof -
     have "(\<integral>\<^sup>+x. indicator U x * h x \<partial>M) = (\<integral>\<^sup>+x. ennreal(indicator U x * f x) \<partial>M)"
       apply (rule nn_integral_cong_AE) using * unfolding indicator_def by auto
     also have "... = ennreal (\<integral>x. indicator U x * f x \<partial>M)"
       apply (rule nn_integral_eq_integral)
       apply (rule Bochner_Integration.integrable_bound[OF \<open>integrable M f\<close>])
       unfolding indicator_def f_def by auto
     also have "... < ennreal delta"
       apply (rule ennreal_lessI) using H(2)[OF that] by (auto simp: set_lebesgue_integral_def)
     finally show ?thesis by (auto simp add: mult.commute)
   qed
   then show ?thesis using \<open>epsilon > 0\<close> by auto
 qed
 
-subsection \<open>Lebesgue-Measure.thy\<close>
-
-text \<open>The next lemma is the same as \verb+lborel_distr_plus+ which is only formulated
-on the real line, but on any euclidean space\<close>
-
-lemma lborel_distr_plus2:
-  fixes c :: "'a::euclidean_space"
-  shows "distr lborel borel ((+) c) = lborel"
-by (subst lborel_affine[of 1 c], auto simp: density_1)
-
-
 subsection \<open>Probability-measure.thy\<close>
 
 text \<open>The next lemmas ensure that, if sets have a probability close to $1$, then their
 intersection also does.\<close>
 
 lemma (in prob_space) sum_measure_le_measure_inter:
   assumes "A \<in> sets M" "B \<in> sets M"
   shows "prob A + prob B \<le> 1 + prob (A \<inter> B)"
 proof -
   have "prob A + prob B = prob (A \<union> B) + prob (A \<inter> B)"
-    by (simp add: assms(1) assms(2) fmeasurable_eq_sets measure_Un3)
+    by (simp add: assms fmeasurable_eq_sets measure_Un3)
   also have "... \<le> 1 + prob (A \<inter> B)"
     by auto
   finally show ?thesis by simp
 qed
 
 lemma (in prob_space) sum_measure_le_measure_inter3:
   assumes [measurable]: "A \<in> sets M" "B \<in> sets M" "C \<in> sets M"
   shows "prob A + prob B + prob C \<le> 2 + prob (A \<inter> B \<inter> C)"
 using sum_measure_le_measure_inter[of B C] sum_measure_le_measure_inter[of A "B \<inter> C"]
 by (auto simp add: inf_assoc)
 
 lemma (in prob_space) sum_measure_le_measure_Inter:
   assumes [measurable]: "finite I" "I \<noteq> {}" "\<And>i. i \<in> I \<Longrightarrow> A i \<in> sets M"
   shows "(\<Sum>i\<in>I. prob (A i)) \<le> real(card I) - 1 + prob (\<Inter>i\<in>I. A i)"
 using assms proof (induct I rule: finite_ne_induct)
   fix x F assume H: "finite F" "F \<noteq> {}" "x \<notin> F"
             "((\<And>i. i \<in> F \<Longrightarrow> A i \<in> events) \<Longrightarrow> (\<Sum>i\<in>F. prob (A i)) \<le> real (card F) - 1 + prob (\<Inter>(A ` F)))"
         and [measurable]: "(\<And>i. i \<in> insert x F \<Longrightarrow> A i \<in> events)"
   have "(\<Inter>x\<in>F. A x) \<in> events" using \<open>finite F\<close> \<open>F \<noteq> {}\<close> by auto
   have "(\<Sum>i\<in>insert x F. prob (A i)) = (\<Sum>i\<in>F. prob (A i)) + prob (A x)"
     using H(1) H(3) by auto
   also have "... \<le> real (card F)-1 + prob (\<Inter>(A ` F)) + prob (A x)"
     using H(4) by auto
   also have "... \<le> real (card F) + prob ((\<Inter>(A ` F)) \<inter> A x)"
     using sum_measure_le_measure_inter[OF \<open>(\<Inter>x\<in>F. A x) \<in> events\<close>, of "A x"] by auto
   also have "... = real (card (insert x F)) - 1 + prob (\<Inter>(A ` (insert x F)))"
     using H(1) H(2) unfolding card_insert_disjoint[OF \<open>finite F\<close> \<open>x \<notin> F\<close>] by (simp add: inf_commute)
   finally show "(\<Sum>i\<in>insert x F. prob (A i)) \<le> real (card (insert x F)) - 1 + prob (\<Inter>(A ` (insert x F)))"
     by simp
 qed (auto)
 
 text \<open>A random variable gives a small mass to small neighborhoods of
 infinity.\<close>
 lemma (in prob_space) random_variable_small_tails:
   assumes "alpha > 0" and [measurable]: "f \<in> borel_measurable M"
   shows "\<exists>(C::real). prob {x \<in> space M. abs(f x) \<ge> C} < alpha \<and> C \<ge> K"
 proof -
   have *: "(\<Inter>(n::nat). {x\<in>space M. abs(f x) \<ge> n}) = {}"
     apply auto
     by (metis real_arch_simple add.right_neutral add_mono_thms_linordered_field(4) not_less zero_less_one)
   have **: "(\<lambda>n. prob {x \<in> space M. abs(f x) \<ge> n}) \<longlonglongrightarrow> prob (\<Inter>(n::nat). {x \<in> space M. abs(f x) \<ge> n})"
     by (rule finite_Lim_measure_decseq, auto simp add: decseq_def)
   have "eventually (\<lambda>n. prob {x \<in> space M. abs(f x) \<ge> n} < alpha) sequentially"
     apply (rule order_tendstoD[OF _ \<open>alpha > 0\<close>]) using ** unfolding * by auto
   then obtain N::nat where N: "\<And>n::nat. n \<ge> N \<Longrightarrow> prob {x \<in> space M. abs(f x) \<ge> n} < alpha"
     unfolding eventually_sequentially by blast
   have "\<exists>n::nat. n \<ge> N \<and> n \<ge> K"
     by (meson le_cases of_nat_le_iff order.trans real_arch_simple)
   then obtain n::nat where n: "n \<ge> N" "n \<ge> K" by blast
   show ?thesis
     apply (rule exI[of _ "of_nat n"]) using N n by auto
 qed
 
 subsection \<open>Distribution-functions.thy\<close>
 
 text \<open>There is a locale called \verb+finite_borel_measure+ in \verb+distribution-functions.thy+.
 However, it only deals with real measures, and real weak convergence. I will not need the
 weak convergence in more general settings, but still it seems more natural to me to do the
 proofs in the natural settings. Let me introduce the locale \verb+finite_borel_measure'+ for
 this, although it would be better to rename the locale in the library file.\<close>
 
 locale finite_borel_measure' = finite_measure M for M :: "('a::metric_space) measure" +
   assumes M_is_borel [simp, measurable_cong]: "sets M = sets borel"
 begin
 
 lemma space_eq_univ [simp]: "space M = UNIV"
   using M_is_borel[THEN sets_eq_imp_space_eq] by simp
 
 lemma measurable_finite_borel [simp]:
   "f \<in> borel_measurable borel \<Longrightarrow> f \<in> borel_measurable M"
   by (rule borel_measurable_subalgebra[where N = borel]) auto
 
 text \<open>Any closed set can be slightly enlarged to obtain a set whose boundary has $0$ measure.\<close>
 
 lemma approx_closed_set_with_set_zero_measure_boundary:
   assumes "closed S" "epsilon > 0" "S \<noteq> {}"
   shows "\<exists>r. r < epsilon \<and> r > 0 \<and> measure M {x. infdist x S = r} = 0 \<and> measure M {x. infdist x S \<le> r} < measure M S + epsilon"
 proof -
   have [measurable]: "S \<in> sets M"
     using \<open>closed S\<close> by auto
   define T where "T = (\<lambda>r. {x. infdist x S \<le> r})"
   have [measurable]: "T r \<in> sets borel" for r
     unfolding T_def by measurable
   have *: "(\<Inter>n. T ((1/2)^n)) = S"
   unfolding T_def proof (auto)
     fix x assume *: "\<forall>n. infdist x S \<le> (1 / 2) ^n"
     have "infdist x S \<le> 0"
       apply (rule LIMSEQ_le_const[of "\<lambda>n. (1/2)^n"], intro tendsto_intros) using * by auto
     then show "x \<in> S"
       using assms infdist_pos_not_in_closed by fastforce
   qed
   have A: "((1::real)/2)^n \<le> (1/2)^m" if "m \<le> n" for m n::nat
     using that by (simp add: power_decreasing)
   have "(\<lambda>n. measure M (T ((1/2)^n))) \<longlonglongrightarrow> measure M S"
     unfolding *[symmetric] apply (rule finite_Lim_measure_decseq, auto simp add: T_def decseq_def)
     using A order.trans by blast
   then have B: "eventually (\<lambda>n. measure M (T ((1/2)^n)) < measure M S + epsilon) sequentially"
     apply (rule order_tendstoD) using \<open>epsilon > 0\<close> by simp
   have C: "eventually (\<lambda>n. (1/2)^n < epsilon) sequentially"
     by (rule order_tendstoD[OF _ \<open>epsilon > 0\<close>], intro tendsto_intros, auto)
   obtain n where n: "(1/2)^n < epsilon" "measure M (T ((1/2)^n)) < measure M S + epsilon"
     using eventually_conj[OF B C] unfolding eventually_sequentially by auto
   have "\<exists>r\<in>{0<..<(1/2)^n}. measure M {x. infdist x S = r} = 0"
     apply (rule uncountable_disjoint_family_then_exists_zero_measure, auto simp add: disjoint_family_on_def)
     using uncountable_open_interval by fastforce
   then obtain r where r: "r\<in>{0<..<(1/2)^n}" "measure M {x. infdist x S = r} = 0"
     by blast
   then have r2: "r > 0" "r < epsilon" using n by auto
   have "measure M {x. infdist x S \<le> r} \<le> measure M {x. infdist x S \<le> (1/2)^n}"
     apply (rule finite_measure_mono) using r by auto
   then have "measure M {x. infdist x S \<le> r} < measure M S + epsilon"
     using n(2) unfolding T_def by auto
   then show ?thesis
     using r(2) r2 by auto
 qed
 end (* of locale finite_borel_measure'*)
 
 sublocale finite_borel_measure \<subseteq> finite_borel_measure'
   by (standard, simp add: M_is_borel)
 
 
 subsection \<open>Weak-convergence.thy\<close>
 
 text \<open>Since weak convergence is not implemented as a topology, the fact that the convergence of
 a sequence implies the convergence of a subsequence is not automatic. We prove it in the lemma
 below..\<close>
 
 lemma weak_conv_m_subseq:
   assumes "weak_conv_m M_seq M" "strict_mono r"
   shows "weak_conv_m (\<lambda>n. M_seq (r n)) M"
 using assms LIMSEQ_subseq_LIMSEQ unfolding weak_conv_m_def weak_conv_def comp_def by auto
 
 context
   fixes \<mu> :: "nat \<Rightarrow> real measure"
     and M :: "real measure"
   assumes \<mu>: "\<And>n. real_distribution (\<mu> n)"
   assumes M: "real_distribution M"
   assumes \<mu>_to_M: "weak_conv_m \<mu> M"
 begin
 
 text \<open>The measure of a closed set behaves upper semicontinuously with respect to weak convergence:
 if $\mu_n \to \mu$, then $\limsup \mu_n(F) \leq \mu(F)$ (and the inequality can be strict, think of
 the situation where $\mu$ is a Dirac mass at $0$ and $F = \{0\}$, but $\mu_n$ has a density so that
 $\mu_n(\{0\}) = 0$).\<close>
 
 lemma closed_set_weak_conv_usc:
   assumes "closed S" "measure M S < l"
   shows "eventually (\<lambda>n. measure (\<mu> n) S < l) sequentially"
 proof (cases "S = {}")
   case True
   then show ?thesis
     using \<open>measure M S < l\<close> by auto
 next
   case False
   interpret real_distribution M using M by simp
   define epsilon where "epsilon = l - measure M S"
   have "epsilon > 0" unfolding epsilon_def using assms(2) by auto
   obtain r where r: "r > 0" "r < epsilon" "measure M {x. infdist x S = r} = 0" "measure M {x. infdist x S \<le> r} < measure M S + epsilon"
     using approx_closed_set_with_set_zero_measure_boundary[OF \<open>closed S\<close> \<open>epsilon > 0\<close> \<open>S \<noteq> {}\<close>] by blast
   define T where "T = {x. infdist x S \<le> r}"
   have [measurable]: "T \<in> sets borel"
     unfolding T_def by auto
   have "S \<subseteq> T"
     unfolding T_def using \<open>closed S\<close> \<open>r > 0\<close> by auto
   have "measure M T < l"
     using r(4) unfolding T_def epsilon_def by auto
   have "measure M (frontier T) \<le> measure M {x. infdist x S = r}"
     apply (rule finite_measure_mono) unfolding T_def using frontier_indist_le by auto
   then have "measure M (frontier T) = 0"
     using \<open>measure M {x. infdist x S = r} = 0\<close> by (auto simp add: measure_le_0_iff)
   then have "(\<lambda>n. measure (\<mu> n) T) \<longlonglongrightarrow> measure M T"
     using \<mu>_to_M by (simp add: \<mu> emeasure_eq_measure real_distribution_axioms weak_conv_imp_continuity_set_conv)
   then have *: "eventually (\<lambda>n. measure (\<mu> n) T < l) sequentially"
     apply (rule order_tendstoD) using \<open>measure M T < l\<close> by simp
   have **: "measure (\<mu> n) S \<le> measure (\<mu> n) T" for n
     apply (rule finite_measure.finite_measure_mono)
     using \<mu> apply (simp add: finite_borel_measure.axioms(1) real_distribution.finite_borel_measure_M)
     using \<open>S \<subseteq> T\<close> apply simp
     by (simp add: \<mu> real_distribution.events_eq_borel)
   show ?thesis
     apply (rule eventually_mono[OF *]) using ** le_less_trans by auto
 qed
 
 text \<open>In the same way, the measure of an open set behaves lower semicontinuously with respect to
 weak convergence: if $\mu_n \to \mu$, then $\liminf \mu_n(U) \geq \mu(U)$ (and the inequality can be
 strict). This follows from the same statement for closed sets by passing to the complement.\<close>
 
 lemma open_set_weak_conv_lsc:
   assumes "open S" "measure M S > l"
   shows "eventually (\<lambda>n. measure (\<mu> n) S > l) sequentially"
 proof -
   interpret real_distribution M
     using M by auto
   have [measurable]: "S \<in> events" using assms(1) by auto
   have "eventually (\<lambda>n. measure (\<mu> n) (UNIV - S) < 1 - l) sequentially"
     apply (rule closed_set_weak_conv_usc)
     using assms prob_compl[of S] by auto
   moreover have "measure (\<mu> n) (UNIV - S) = 1 - measure (\<mu> n) S" for n
   proof -
     interpret mu: real_distribution "\<mu> n"
       using \<mu> by auto
     have "S \<in> mu.events" using assms(1) by auto
     then show ?thesis using mu.prob_compl[of S] by auto
   qed
   ultimately show ?thesis by auto
 qed
 
 end (*of context weak_conv_m*)
 
 end (*of SG_Library_Complement.thy*)
diff --git a/thys/Gromov_Hyperbolicity/Library_Complements.thy b/thys/Gromov_Hyperbolicity/Library_Complements.thy
--- a/thys/Gromov_Hyperbolicity/Library_Complements.thy
+++ b/thys/Gromov_Hyperbolicity/Library_Complements.thy
@@ -1,1765 +1,1760 @@
 (*  Author:  Sébastien Gouëzel   sebastien.gouezel@univ-rennes1.fr
     License: BSD
 *)
 
 section \<open>Additions to the library\<close>
 
 theory Library_Complements
   imports "HOL-Analysis.Analysis" "HOL-Cardinals.Cardinal_Order_Relation"
 begin
 
 subsection \<open>Mono intros\<close>
 
 text \<open>We have a lot of (large) inequalities to prove. It is very convenient to have a set of
 introduction rules for this purpose (a lot should be added to it, I have put here all the ones
 I needed).
 
 The typical use case is when one wants to prove some inequality, say
 $ \exp (x*x) \leq y + \exp(1 + z * z + y)$, assuming $y \geq 0$ and $0 \leq x \leq z$.
 One would write it has
 \begin{verbatim}
 have "0 + \exp(0 + x * x + 0) < = y + \exp(1 + z * z + y)"
 using `y > = 0` `x < = z` by (intro mono_intros)
 \end{verbatim}
 When the left and right hand terms are written in completely analogous ways as above, then the
 introduction rules (that contain monotonicity of addition, of the exponential, and so on) reduce
 this to comparison of elementary terms in the formula. This is a very naive strategy, that fails
 in many situations, but that is very efficient when used correctly.
 \<close>
 
 named_theorems mono_intros "structural introduction rules to prove inequalities"
 declare le_imp_neg_le [mono_intros]
 declare add_left_mono [mono_intros]
 declare add_right_mono [mono_intros]
 declare add_strict_left_mono [mono_intros]
 declare add_strict_right_mono [mono_intros]
 declare add_mono [mono_intros]
 declare add_less_le_mono [mono_intros]
 declare diff_right_mono [mono_intros]
 declare diff_left_mono [mono_intros]
 declare diff_mono [mono_intros]
 declare mult_left_mono [mono_intros]
 declare mult_right_mono [mono_intros]
 declare mult_mono [mono_intros]
 declare max.mono [mono_intros]
 declare min.mono [mono_intros]
 declare power_mono [mono_intros]
 declare ln_ge_zero [mono_intros]
 declare ln_le_minus_one [mono_intros]
 declare ennreal_minus_mono [mono_intros]
 declare ennreal_leI [mono_intros]
 declare e2ennreal_mono [mono_intros]
 declare enn2ereal_nonneg [mono_intros]
 declare zero_le [mono_intros]
 declare top_greatest [mono_intros]
 declare bot_least [mono_intros]
 declare dist_triangle [mono_intros]
 declare dist_triangle2 [mono_intros]
 declare dist_triangle3 [mono_intros]
 declare exp_ge_add_one_self [mono_intros]
 declare exp_gt_one [mono_intros]
 declare exp_less_mono [mono_intros]
 declare dist_triangle [mono_intros]
 declare abs_triangle_ineq [mono_intros]
 declare abs_triangle_ineq2 [mono_intros]
 declare abs_triangle_ineq2_sym [mono_intros]
 declare abs_triangle_ineq3 [mono_intros]
 declare abs_triangle_ineq4 [mono_intros]
 declare Liminf_le_Limsup [mono_intros]
 declare ereal_liminf_add_mono [mono_intros]
 declare le_of_int_ceiling [mono_intros]
 declare ereal_minus_mono [mono_intros]
 declare infdist_triangle [mono_intros]
 declare divide_right_mono [mono_intros]
 declare self_le_power [mono_intros]
 
 lemma ln_le_cancelI [mono_intros]:
   assumes "(0::real) < x" "x \<le> y"
   shows "ln x \<le> ln y"
 using assms by auto
 
 lemma exp_le_cancelI [mono_intros]:
   assumes "x \<le> (y::real)"
   shows "exp x \<le> exp y"
 using assms by simp
 
 lemma mult_ge1_mono [mono_intros]:
   assumes "a \<ge> (0::'a::linordered_idom)" "b \<ge> 1"
   shows "a \<le> a * b" "a \<le> b * a"
 using assms mult_le_cancel_left1 mult_le_cancel_right1 by force+
 
 text \<open>A few convexity inequalities we will need later on.\<close>
 
 lemma xy_le_uxx_vyy [mono_intros]:
   assumes "u > 0" "u * v = (1::real)"
   shows "x * y \<le> u * x^2/2 + v * y^2/2"
 proof -
   have "v > 0" using assms
     by (metis (full_types) dual_order.strict_implies_order le_less_linear mult_nonneg_nonpos not_one_le_zero)
   then have *: "sqrt u * sqrt v = 1"
     using assms by (metis real_sqrt_mult real_sqrt_one)
   have "(sqrt u * x - sqrt v * y)^2 \<ge> 0" by auto
   then have "u * x^2 + v * y^2 - 2 * 1 * x * y \<ge> 0"
     unfolding power2_eq_square *[symmetric] using \<open>u > 0\<close> \<open>v > 0\<close> by (auto simp add: algebra_simps)
   then show ?thesis by (auto simp add: algebra_simps divide_simps)
 qed
 
 lemma xy_le_xx_yy [mono_intros]:
   "x * y \<le> x^2/2 + y^2/2" for x y::real
 using xy_le_uxx_vyy[of 1 1] by auto
 
 lemma ln_squared_bound [mono_intros]:
   "(ln x)^2 \<le> 2 * x - 2" if "x \<ge> 1" for x::real
 proof -
   define f where "f = (\<lambda>x::real. 2 * x - 2 - ln x * ln x)"
   have *: "DERIV f x :> 2 - 2 * ln x / x" if "x > 0" for x::real
     unfolding f_def using that by (auto intro!: derivative_eq_intros)
   have "f 1 \<le> f x" if "x \<ge> 1" for x
   proof (rule DERIV_nonneg_imp_nondecreasing[OF that])
     fix t::real assume "t \<ge> 1"
     show "\<exists>y. (f has_real_derivative y) (at t) \<and> 0 \<le> y"
       apply (rule exI[of _ "2 - 2 * ln t / t"])
       using *[of t] \<open>t \<ge> 1\<close> by (auto simp add: divide_simps ln_bound)
   qed
   then show ?thesis unfolding f_def power2_eq_square using that by auto
 qed
 
 text \<open>In the next lemma, the assumptions are too strong (negative numbers
 less than $-1$ also work well to have a square larger than $1$), but in practice one proves
 inequalities with nonnegative numbers, so this version is really the useful one for
 \verb+mono_intros+.\<close>
 
 lemma mult_ge1_powers [mono_intros]:
   assumes "a \<ge> (1::'a::linordered_idom)"
   shows "1 \<le> a * a" "1 \<le> a * a * a" "1 \<le> a * a * a * a"
 using assms by (meson assms dual_order.trans mult_ge1_mono(1) zero_le_one)+
 
 lemmas [mono_intros] = ln_bound
 
 lemma mono_cSup:
   fixes f :: "'a::conditionally_complete_lattice \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes "bdd_above A" "A \<noteq> {}" "mono f"
   shows "Sup (f`A) \<le> f (Sup A)"
 by (metis assms(1) assms(2) assms(3) cSUP_least cSup_upper mono_def)
 
 lemma mono_cSup_bij:
   fixes f :: "'a::conditionally_complete_linorder \<Rightarrow> 'b::conditionally_complete_linorder"
   assumes "bdd_above A" "A \<noteq> {}" "mono f" "bij f"
   shows "Sup (f`A) = f(Sup A)"
 proof -
   have "Sup ((inv f)`(f`A)) \<le> (inv f) (Sup (f`A))"
     apply (rule mono_cSup)
     using mono_inv[OF assms(3) assms(4)] assms(2) bdd_above_image_mono[OF assms(3) assms(1)] by auto
   then have "f (Sup ((inv f)`(f`A))) \<le> Sup (f`A)"
     using assms mono_def by (metis (no_types, hide_lams) bij_betw_imp_surj_on surj_f_inv_f)
   moreover have "f (Sup ((inv f)`(f`A))) = f(Sup A)"
     using assms by (simp add: bij_is_inj)
   ultimately show ?thesis using mono_cSup[OF assms(1) assms(2) assms(3)] by auto
 qed
 
 subsection \<open>More topology\<close>
 
 text \<open>In situations of interest to us later on, convergence is well controlled only for sequences
 living in some dense subset of the space (but the limit can be anywhere). This is enough to
 establish continuity of the function, if the target space is well enough separated.
 
 The statement we give below is very general,
 as we do not assume that the function is continuous inside the original set $S$, it will typically
 only be continuous at a set $T$ contained in the closure of $S$. In many applications, $T$ will
 be the closure of $S$, but we are also thinking of the case where one constructs an extension
 of a function inside a space, to its boundary, and the behaviour at the boundary is better than
 inside the space. The example we have in mind is the extension of a quasi-isometry to the boundary
 of a Gromov hyperbolic space.
 
 In the following criterion, we assume that if $u_n$ inside $S$ converges to a point at the boundary
 $T$, then $f(u_n)$ converges (where $f$ is some function inside). Then, we can extend the function $f$ at
 the boundary, by picking the limit value of $f(u_n)$ for some sequence converging to $u_n$. Then
 the lemma asserts that $f$ is continuous at every point $b$ on the boundary.
 
 The proof is done in two steps:
 \begin{enumerate}
 \item First, if $v_n$ is another inside sequence tending to
 the same point $b$ on the boundary, then $f(v_n)$ converges to the same value as $f(u_n)$: this is
 proved by considering the sequence $w$ equal to $u$ at even times and to $v$ at odd times, and
 saying that $f(w_n)$ converges. Its limit is equal to the limit of $f(u_n)$ and of $f(v_n)$, so they
 have to coincide.
 \item Now, consider a general sequence $v$ (in the space or the boundary) converging to $b$. We want
 to show that $f(v_n)$ tends to $f(b)$. If $v_n$ is inside $S$, we have already done it in the first
 step. If it is on the boundary, on the other hand, we can approximate it by an inside point $w_n$
 for which $f(w_n)$ is very close to $f(v_n)$. Then $w_n$ is an inside sequence converging to $b$,
 hence $f(w_n)$ converges to $f(b)$ by the first step, and then $f(v_n)$ also converges to $f(b)$.
 The precise argument is more conveniently written by contradiction. It requires good separation
 properties of the target space.
 \end{enumerate}\<close>
 
 text \<open>First, we introduce the material to interpolate between two sequences, one at even times
 and the other one at odd times.\<close>
 
 definition even_odd_interpolate::"(nat \<Rightarrow> 'a) \<Rightarrow> (nat \<Rightarrow> 'a) \<Rightarrow> (nat \<Rightarrow> 'a)"
   where "even_odd_interpolate u v n = (if even n then u (n div 2) else v (n div 2))"
 
 lemma even_odd_interpolate_compose:
   "even_odd_interpolate (f o u) (f o v) = f o (even_odd_interpolate u v)"
   unfolding even_odd_interpolate_def comp_def by auto
 
 lemma even_odd_interpolate_filterlim:
   "filterlim u F sequentially \<and> filterlim v F sequentially \<longleftrightarrow> filterlim (even_odd_interpolate u v) F sequentially"
 proof (auto)
   assume H: "filterlim (even_odd_interpolate u v) F sequentially"
   define r::"nat \<Rightarrow> nat" where "r = (\<lambda>n. 2 * n)"
   have "strict_mono r" unfolding r_def strict_mono_def by auto
   then have "filterlim r sequentially sequentially"
     by (simp add: filterlim_subseq)
   have "filterlim (\<lambda>n. (even_odd_interpolate u v) (r n)) F sequentially"
     by (rule filterlim_compose[OF H filterlim_subseq[OF \<open>strict_mono r\<close>]])
   moreover have "even_odd_interpolate u v (r n) = u n" for n
     unfolding r_def even_odd_interpolate_def by auto
   ultimately show "filterlim u F sequentially" by auto
   define r::"nat \<Rightarrow> nat" where "r = (\<lambda>n. 2 * n + 1)"
   have "strict_mono r" unfolding r_def strict_mono_def by auto
   then have "filterlim r sequentially sequentially"
     by (simp add: filterlim_subseq)
   have "filterlim (\<lambda>n. (even_odd_interpolate u v) (r n)) F sequentially"
     by (rule filterlim_compose[OF H filterlim_subseq[OF \<open>strict_mono r\<close>]])
   moreover have "even_odd_interpolate u v (r n) = v n" for n
     unfolding r_def even_odd_interpolate_def by auto
   ultimately show "filterlim v F sequentially" by auto
 next
   assume H: "filterlim u F sequentially" "filterlim v F sequentially"
   show "filterlim (even_odd_interpolate u v) F sequentially"
   unfolding filterlim_iff eventually_sequentially proof (auto)
     fix P assume *: "eventually P F"
     obtain N1 where N1: "\<And>n. n \<ge> N1 \<Longrightarrow> P (u n)"
       using H(1) unfolding filterlim_iff eventually_sequentially using * by auto
     obtain N2 where N2: "\<And>n. n \<ge> N2 \<Longrightarrow> P (v n)"
       using H(2) unfolding filterlim_iff eventually_sequentially using * by auto
     have "P (even_odd_interpolate u v n)" if "n \<ge> 2 * N1 + 2 * N2" for n
     proof (cases "even n")
       case True
       have "n div 2 \<ge> N1" using that by auto
       then show ?thesis unfolding even_odd_interpolate_def using True N1 by auto
     next
       case False
       have "n div 2 \<ge> N2" using that by auto
       then show ?thesis unfolding even_odd_interpolate_def using False N2 by auto
     qed
     then show "\<exists>N. \<forall>n \<ge> N. P (even_odd_interpolate u v n)" by auto
   qed
 qed
 
 text \<open>Then, we prove the continuity criterion for extensions of functions to the boundary $T$ of a set
 $S$. The first assumption is that $f(u_n)$ converges when $f$ converges to the boundary, and the
 second one that the extension of $f$ to the boundary has been defined using the limit along some
 sequence tending to the point under consideration. The following criterion is the most general one,
 but this is not the version that is most commonly applied so we use a prime in its name.\<close>
 
 lemma continuous_at_extension_sequentially':
   fixes f :: "'a::{first_countable_topology, t2_space} \<Rightarrow> 'b::t3_space"
   assumes "b \<in> T"
           "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> b \<in> T \<Longrightarrow> u \<longlonglongrightarrow> b \<Longrightarrow> convergent (\<lambda>n. f (u n))"
           "\<And>b. b \<in> T \<Longrightarrow> \<exists>u. (\<forall>n. u n \<in> S) \<and> u \<longlonglongrightarrow> b \<and> ((\<lambda>n. f (u n)) \<longlonglongrightarrow> f b)"
   shows "continuous (at b within (S \<union> T)) f"
 proof -
   have first_step: "(\<lambda>n. f (u n)) \<longlonglongrightarrow> f c" if "\<And>n. u n \<in> S" "u \<longlonglongrightarrow> c" "c \<in> T" for u c
   proof -
     obtain v where v: "\<And>n. v n \<in> S" "v \<longlonglongrightarrow> c" "(\<lambda>n. f (v n)) \<longlonglongrightarrow> f c"
       using assms(3)[OF \<open>c \<in> T\<close>] by blast
     then have A: "even_odd_interpolate u v \<longlonglongrightarrow> c"
       unfolding even_odd_interpolate_filterlim[symmetric] using \<open>u \<longlonglongrightarrow> c\<close> by auto
     moreover have B: "\<forall>n. even_odd_interpolate u v n \<in> S"
       using \<open>\<And>n. u n \<in> S\<close> \<open>\<And>n. v n \<in> S\<close> unfolding even_odd_interpolate_def by auto
     have "convergent (\<lambda>n. f (even_odd_interpolate u v n))"
       by (rule assms(2)[OF B \<open>c \<in> T\<close> A])
     then obtain m where "(\<lambda>n. f (even_odd_interpolate u v n)) \<longlonglongrightarrow> m"
       unfolding convergent_def by auto
     then have "even_odd_interpolate (f o u) (f o v) \<longlonglongrightarrow> m"
       unfolding even_odd_interpolate_compose unfolding comp_def by auto
     then have "(f o u) \<longlonglongrightarrow> m" "(f o v) \<longlonglongrightarrow> m"
       unfolding even_odd_interpolate_filterlim[symmetric] by auto
     then have "m = f c" using v(3) unfolding comp_def using LIMSEQ_unique by auto
     then show ?thesis using \<open>(f o u) \<longlonglongrightarrow> m\<close> unfolding comp_def by auto
   qed
   show "continuous (at b within (S \<union> T)) f"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then obtain U where U: "open U" "f b \<in> U" "\<not>(\<forall>\<^sub>F x in at b within S \<union> T. f x \<in> U)"
       unfolding continuous_within tendsto_def[where l = "f b"] using sequentially_imp_eventually_nhds_within by auto
     have "\<exists>V W. open V \<and> open W \<and> f b \<in> V \<and> (UNIV - U) \<subseteq> W \<and> V \<inter> W = {}"
       apply (rule t3_space) using U by auto
     then obtain V W where VW: "open V" "open W" "f b \<in> V" "UNIV - U \<subseteq> W" "V \<inter> W = {}"
       by auto
 
     obtain A :: "nat \<Rightarrow> 'a set" where *:
       "\<And>i. open (A i)"
       "\<And>i. b \<in> A i"
       "\<And>F. \<forall>n. F n \<in> A n \<Longrightarrow> F \<longlonglongrightarrow> b"
       by (rule first_countable_topology_class.countable_basis) blast
     with * U(3) have "\<exists>F. \<forall>n. F n \<in> S \<union> T \<and> F n \<in> A n \<and> \<not> (f(F n) \<in> U)"
       unfolding at_within_def eventually_inf_principal eventually_nhds
       by (intro choice) (meson DiffE)
     then obtain F where F: "\<And>n. F n \<in> S \<union> T" "\<And>n. F n \<in> A n" "\<And>n. f(F n) \<notin> U"
       by auto
 
     have "\<exists>y. y \<in> S \<and> y \<in> A n \<and> f y \<in> W" for n
     proof (cases "F n \<in> S")
       case True
       show ?thesis apply (rule exI[of _ "F n"]) using F VW True by auto
     next
       case False
       then have "F n \<in> T" using \<open>F n \<in> S \<union> T\<close> by auto
       obtain u where u: "\<And>p. u p \<in> S" "u \<longlonglongrightarrow> F n" "(\<lambda>p. f (u p)) \<longlonglongrightarrow> f(F n)"
         using assms(3)[OF \<open>F n \<in> T\<close>] by auto
       moreover have "f(F n) \<in> W" using F VW by auto
       ultimately have "eventually (\<lambda>p. f (u p) \<in> W) sequentially"
         using \<open>open W\<close> by (simp add: tendsto_def)
       moreover have "eventually (\<lambda>p. u p \<in> A n) sequentially"
         using \<open>F n \<in> A n\<close> u \<open>open (A n)\<close> by (simp add: tendsto_def)
       ultimately have "\<exists>p. f(u p) \<in> W \<and> u p \<in> A n"
         using eventually_False_sequentially eventually_elim2 by blast
       then show ?thesis using u(1) by auto
     qed
     then have "\<exists>u. \<forall>n. u n \<in> S \<and> u n \<in> A n \<and> f (u n) \<in> W"
       by (auto intro: choice)
     then obtain u where u: "\<And>n. u n \<in> S" "\<And>n. u n \<in> A n" "\<And>n. f (u n) \<in> W"
       by blast
     then have "u \<longlonglongrightarrow> b" using *(3) by auto
     then have "(\<lambda>n. f (u n)) \<longlonglongrightarrow> f b" using first_step assms u by auto
     then have "eventually (\<lambda>n. f (u n) \<in> V) sequentially"
       using VW by (simp add: tendsto_def)
     then have "\<exists>n. f (u n) \<in> V"
       using eventually_False_sequentially eventually_elim2 by blast
     then show False
       using u(3) \<open>V \<inter> W = {}\<close> by auto
   qed
 qed
 
 text \<open>We can specialize the previous statement to the common case where one already knows the
 sequential continuity of $f$ along sequences in $S$ converging to a point in $T$. This will be the
 case in most --but not all-- applications. This is a straightforward application of the above
 criterion.\<close>
 
 proposition continuous_at_extension_sequentially:
   fixes f :: "'a::{first_countable_topology, t2_space} \<Rightarrow> 'b::t3_space"
   assumes "a \<in> T"
           "T \<subseteq> closure S"
           "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> b \<in> T \<Longrightarrow> u \<longlonglongrightarrow> b \<Longrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f b"
   shows "continuous (at a within (S \<union> T)) f"
 apply (rule continuous_at_extension_sequentially'[OF \<open>a \<in> T\<close>])
 using assms(3) convergent_def apply blast
 by (metis assms(2) assms(3) closure_sequential subset_iff)
 
 text \<open>We also give global versions. We can only express the continuity on $T$, so
 this is slightly weaker than the previous statements since we are not saying anything on inside
 sequences tending to $T$ -- but in cases where $T$ contains $S$ these statements contain all the
 information.\<close>
 
 lemma continuous_on_extension_sequentially':
   fixes f :: "'a::{first_countable_topology, t2_space} \<Rightarrow> 'b::t3_space"
   assumes "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> b \<in> T \<Longrightarrow> u \<longlonglongrightarrow> b \<Longrightarrow> convergent (\<lambda>n. f (u n))"
           "\<And>b. b \<in> T \<Longrightarrow> \<exists>u. (\<forall>n. u n \<in> S) \<and> u \<longlonglongrightarrow> b \<and> ((\<lambda>n. f (u n)) \<longlonglongrightarrow> f b)"
   shows "continuous_on T f"
 unfolding continuous_on_eq_continuous_within apply (auto intro!: continuous_within_subset[of _ "S \<union> T" f T])
 by (intro continuous_at_extension_sequentially'[OF _ assms], auto)
 
 lemma continuous_on_extension_sequentially:
   fixes f :: "'a::{first_countable_topology, t2_space} \<Rightarrow> 'b::t3_space"
   assumes "T \<subseteq> closure S"
           "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> b \<in> T \<Longrightarrow> u \<longlonglongrightarrow> b \<Longrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f b"
   shows "continuous_on T f"
 unfolding continuous_on_eq_continuous_within apply (auto intro!: continuous_within_subset[of _ "S \<union> T" f T])
 by (intro continuous_at_extension_sequentially[OF _ assms], auto)
 
 
 subsubsection \<open>Homeomorphisms\<close>
 
 lemma homeomorphism_cong:
   "homeomorphism X' Y' f' g'" if "homeomorphism X Y f g"
     "X' = X" "Y' = Y" "\<And>x. x \<in> X \<Longrightarrow> f' x = f x" "\<And>y. y \<in> Y \<Longrightarrow> g' y = g y"
   using that by (auto simp add: homeomorphism_def)
 
 lemma homeomorphism_empty [simp]:
   "homeomorphism {} {} f g"
 unfolding homeomorphism_def by auto
 
 text \<open>A variant around the notion of homeomorphism, which is only expressed in terms of the
 function and not of its inverse.\<close>
 
 definition homeomorphism_on::"'a set \<Rightarrow> ('a::topological_space \<Rightarrow> 'b::topological_space) \<Rightarrow> bool"
   where "homeomorphism_on S f = (\<exists>g. homeomorphism S (f`S) f g)"
 
 lemma homeomorphism_on_continuous:
   assumes "homeomorphism_on S f"
   shows "continuous_on S f"
 using assms unfolding homeomorphism_on_def homeomorphism_def by auto
 
 lemma homeomorphism_on_bij:
   assumes "homeomorphism_on S f"
   shows "bij_betw f S (f`S)"
 using assms unfolding homeomorphism_on_def homeomorphism_def by auto (metis inj_on_def inj_on_imp_bij_betw)
 
 lemma homeomorphism_on_homeomorphic:
   assumes "homeomorphism_on S f"
   shows "S homeomorphic (f`S)"
 using assms unfolding homeomorphism_on_def homeomorphic_def by auto
 
 lemma homeomorphism_on_compact:
   fixes f::"'a::topological_space \<Rightarrow> 'b::t2_space"
   assumes "continuous_on S f"
           "compact S"
           "inj_on f S"
   shows "homeomorphism_on S f"
 unfolding homeomorphism_on_def using homeomorphism_compact[OF assms(2) assms(1) _ assms(3)] by auto
 
 lemma homeomorphism_on_subset:
   assumes "homeomorphism_on S f"
           "T \<subseteq> S"
   shows "homeomorphism_on T f"
 using assms homeomorphism_of_subsets unfolding homeomorphism_on_def by blast
 
 lemma homeomorphism_on_empty [simp]:
   "homeomorphism_on {} f"
 unfolding homeomorphism_on_def using homeomorphism_empty[of f] by auto
 
 lemma homeomorphism_on_cong:
   assumes "homeomorphism_on X f"
           "X' = X" "\<And>x. x \<in> X \<Longrightarrow> f' x = f x"
   shows "homeomorphism_on X' f'"
 proof -
   obtain g where g:"homeomorphism X (f`X) f g"
     using assms unfolding homeomorphism_on_def by auto
   have "homeomorphism X' (f'`X') f' g"
     apply (rule homeomorphism_cong[OF g]) using assms by (auto simp add: rev_image_eqI)
   then show ?thesis
     unfolding homeomorphism_on_def by auto
 qed
 
 lemma homeomorphism_on_inverse:
   fixes f::"'a::topological_space \<Rightarrow> 'b::topological_space"
   assumes "homeomorphism_on X f"
   shows "homeomorphism_on (f`X) (inv_into X f)"
 proof -
   obtain g where g: "homeomorphism X (f`X) f g"
     using assms unfolding homeomorphism_on_def by auto
   then have "g`f`X = X"
     by (simp add: homeomorphism_def)
   then have "homeomorphism_on (f`X) g"
     unfolding homeomorphism_on_def using homeomorphism_symD[OF g] by auto
   moreover have "g x = inv_into X f x" if "x \<in> f`X" for x
     using g that unfolding homeomorphism_def by (auto, metis f_inv_into_f inv_into_into that)
   ultimately show ?thesis
     using homeomorphism_on_cong by force
 qed
 
 text \<open>Characterization of homeomorphisms in terms of sequences: a map is a homeomorphism if and
 only if it respects convergent sequences.\<close>
 
 lemma homeomorphism_on_compose:
   assumes "homeomorphism_on S f"
           "x \<in> S"
           "eventually (\<lambda>n. u n \<in> S) F"
   shows "(u \<longlongrightarrow> x) F \<longleftrightarrow> ((\<lambda>n. f (u n)) \<longlongrightarrow> f x) F"
 proof
   assume "(u \<longlongrightarrow> x) F"
   then show "((\<lambda>n. f (u n)) \<longlongrightarrow> f x) F"
     using continuous_on_tendsto_compose[OF homeomorphism_on_continuous[OF assms(1)] _ assms(2) assms(3)] by simp
 next
   assume *: "((\<lambda>n. f (u n)) \<longlongrightarrow> f x) F"
   have I: "inv_into S f (f y) = y" if "y \<in> S" for y
     using homeomorphism_on_bij[OF assms(1)] by (meson bij_betw_inv_into_left that)
   then have A: "eventually (\<lambda>n. u n = inv_into S f (f (u n))) F"
     using assms eventually_mono by force
   have "((\<lambda>n. (inv_into S f) (f (u n))) \<longlongrightarrow> (inv_into S f) (f x)) F"
     apply (rule continuous_on_tendsto_compose[OF homeomorphism_on_continuous[OF homeomorphism_on_inverse[OF assms(1)]] *])
     using assms eventually_mono by (auto) fastforce
   then show "(u \<longlongrightarrow> x) F"
     unfolding tendsto_cong[OF A] I[OF \<open>x \<in> S\<close>] by simp
 qed
 
 lemma homeomorphism_on_sequentially:
   fixes f::"'a::{first_countable_topology, t2_space} \<Rightarrow> 'b::{first_countable_topology, t2_space}"
   assumes "\<And>x u. x \<in> S \<Longrightarrow> (\<forall>n. u n \<in> S) \<Longrightarrow> u \<longlonglongrightarrow> x \<longleftrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f x"
   shows "homeomorphism_on S f"
 proof -
   have "x = y" if "f x = f y" "x \<in> S" "y \<in> S" for x y
   proof -
     have "(\<lambda>n. f x) \<longlonglongrightarrow> f y" using that by auto
     then have "(\<lambda>n. x) \<longlonglongrightarrow> y" using assms(1) that by auto
     then show "x = y" using LIMSEQ_unique by auto
   qed
   then have "inj_on f S" by (simp add: inj_on_def)
 
   have Cf: "continuous_on S f"
     apply (rule continuous_on_sequentiallyI) using assms by auto
   define g where "g = inv_into S f"
   have Cg: "continuous_on (f`S) g"
   proof (rule continuous_on_sequentiallyI)
     fix v b assume H: "\<forall>n. v n \<in> f ` S" "b \<in> f ` S" "v \<longlonglongrightarrow> b"
     define u where "u = (\<lambda>n. g (v n))"
     define a where "a = g b"
     have "u n \<in> S" "f (u n) = v n" for n
       unfolding u_def g_def using H(1) by (auto simp add: inv_into_into f_inv_into_f)
     have "a \<in> S" "f a = b"
       unfolding a_def g_def using H(2) by (auto simp add: inv_into_into f_inv_into_f)
     show "(\<lambda>n. g(v n)) \<longlonglongrightarrow> g b"
       unfolding u_def[symmetric] a_def[symmetric] apply (rule iffD2[OF assms])
       using \<open>\<And>n. u n \<in> S\<close> \<open>a \<in> S\<close> \<open>v \<longlonglongrightarrow> b\<close>
       unfolding \<open>\<And>n. f (u n) = v n\<close> \<open>f a = b\<close> by auto
   qed
   have "homeomorphism S (f`S) f g"
     apply (rule homeomorphismI[OF Cf Cg]) unfolding g_def using \<open>inj_on f S\<close> by auto
   then show ?thesis
     unfolding homeomorphism_on_def by auto
 qed
 
 lemma homeomorphism_on_UNIV_sequentially:
   fixes f::"'a::{first_countable_topology, t2_space} \<Rightarrow> 'b::{first_countable_topology, t2_space}"
   assumes "\<And>x u. u \<longlonglongrightarrow> x \<longleftrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f x"
   shows "homeomorphism_on UNIV f"
 using assms by (auto intro!: homeomorphism_on_sequentially)
 
 text \<open>Now, we give similar characterizations in terms of sequences living in a dense subset. As
 in the sequential continuity criteria above, we first give a very general criterion, where the map
 does not have to be continuous on the approximating set $S$, only on the limit set $T$, without
 any a priori identification of the limit. Then, we specialize this statement to a less general
 but often more usable version.\<close>
 
 lemma homeomorphism_on_extension_sequentially_precise:
   fixes f::"'a::{first_countable_topology, t3_space} \<Rightarrow> 'b::{first_countable_topology, t3_space}"
   assumes "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> b \<in> T \<Longrightarrow> u \<longlonglongrightarrow> b \<Longrightarrow> convergent (\<lambda>n. f (u n))"
           "\<And>u c. (\<forall>n. u n \<in> S) \<Longrightarrow> c \<in> f`T \<Longrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> c \<Longrightarrow> convergent u"
           "\<And>b. b \<in> T \<Longrightarrow> \<exists>u. (\<forall>n. u n \<in> S) \<and> u \<longlonglongrightarrow> b \<and> ((\<lambda>n. f (u n)) \<longlonglongrightarrow> f b)"
           "\<And>n. u n \<in> S \<union> T" "l \<in> T"
   shows "u \<longlonglongrightarrow> l \<longleftrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f l"
 proof
   assume H: "u \<longlonglongrightarrow> l"
   have "continuous (at l within (S \<union> T)) f"
     apply (rule continuous_at_extension_sequentially'[OF \<open>l \<in> T\<close>]) using assms(1) assms(3) by auto
   then show "(\<lambda>n. f (u n)) \<longlonglongrightarrow> f l"
     apply (rule continuous_within_tendsto_compose) using H assms(4) by auto
 next
   text \<open>For the reverse implication, we would like to use the continuity criterion
   \verb+ continuous_at_extension_sequentially'+ applied to the inverse of $f$. Unfortunately, this
   inverse is only well defined on $T$, while our sequence takes values in $S \cup T$. So, instead,
   we redo by hand the proof of the continuity criterion, but in the opposite direction.\<close>
   assume H: "(\<lambda>n. f (u n)) \<longlonglongrightarrow> f l"
   show "u \<longlonglongrightarrow> l"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then obtain U where U: "open U" "l \<in> U" "\<not>(\<forall>\<^sub>F n in sequentially. u n \<in> U)"
       unfolding continuous_within tendsto_def[where l = l] using sequentially_imp_eventually_nhds_within by auto
     obtain A :: "nat \<Rightarrow> 'b set" where *:
       "\<And>i. open (A i)"
       "\<And>i. f l \<in> A i"
       "\<And>F. \<forall>n. F n \<in> A n \<Longrightarrow> F \<longlonglongrightarrow> f l"
       by (rule first_countable_topology_class.countable_basis) blast
     have B: "eventually (\<lambda>n. f (u n) \<in> A i) sequentially" for i
       using \<open>open (A i)\<close> \<open>f l \<in> A i\<close> H topological_tendstoD by fastforce
     have M: "\<exists>r. r \<ge> N \<and> (u r \<notin> U) \<and> f (u r) \<in> A i" for N i
       using U(3) B[of i] unfolding eventually_sequentially by (meson dual_order.trans le_cases)
     have "\<exists>r. \<forall>n. (u (r n) \<notin> U \<and> f (u (r n)) \<in> A n) \<and> r (Suc n) \<ge> r n + 1"
       apply (rule dependent_nat_choice) using M by auto
     then obtain r where r: "\<And>n. u (r n) \<notin> U" "\<And>n. f (u (r n)) \<in> A n" "\<And>n. r (Suc n) \<ge> r n + 1"
       by auto
     then have "strict_mono r"
       by (metis Suc_eq_plus1 Suc_le_lessD strict_monoI_Suc)
 
     have "\<exists>V W. open V \<and> open W \<and> l \<in> V \<and> (UNIV - U) \<subseteq> W \<and> V \<inter> W = {}"
       apply (rule t3_space) using U by auto
     then obtain V W where VW: "open V" "open W" "l \<in> V" "UNIV - U \<subseteq> W" "V \<inter> W = {}"
       by auto
 
     have "\<exists>z. z \<in> S \<and> f z \<in> A n \<and> z \<in> W" for n
     proof -
       define z where "z = u (r n)"
       have "f z \<in> A n" unfolding z_def using r(2) by auto
       have "z \<in> S \<union> T" "z \<notin> U"
         unfolding z_def using r(1) assms(4) by auto
       then have "z \<in> W" using VW by auto
       show ?thesis
       proof (cases "z \<in> T")
         case True
         obtain u::"nat \<Rightarrow> 'a" where u: "\<And>p. u p \<in> S" "u \<longlonglongrightarrow> z" "(\<lambda>p. f (u p)) \<longlonglongrightarrow> f z"
           using assms(3)[OF \<open>z \<in> T\<close>] by auto
         then have "eventually (\<lambda>p. f (u p) \<in> A n) sequentially"
           using \<open>open (A n)\<close> \<open>f z \<in> A n\<close> unfolding tendsto_def by simp
         moreover have "eventually (\<lambda>p. u p \<in> W) sequentially"
           using \<open>open W\<close> \<open>z \<in> W\<close> u unfolding tendsto_def by simp
         ultimately have "\<exists>p. u p \<in> W \<and> f (u p) \<in> A n"
           using eventually_False_sequentially eventually_elim2 by blast
         then show ?thesis using u(1) by auto
       next
         case False
         then have "z \<in> S" using \<open>z \<in> S \<union> T\<close> by auto
         then show ?thesis using \<open>f z \<in> A n\<close> \<open>z \<in> W\<close> by auto
       qed
     qed
     then have "\<exists>v. \<forall>n. v n \<in> S \<and> f (v n) \<in> A n \<and> v n \<in> W"
       by (auto intro: choice)
     then obtain v where v: "\<And>n. v n \<in> S" "\<And>n. f (v n) \<in> A n" "\<And>n. v n \<in> W"
       by blast
     then have I: "(\<lambda>n. f (v n)) \<longlonglongrightarrow> f l" using *(3) by auto
 
     obtain w where w: "\<And>n. w n \<in> S" "w \<longlonglongrightarrow> l" "((\<lambda>n. f (w n)) \<longlonglongrightarrow> f l)"
       using assms(3)[OF \<open>l \<in> T\<close>] by auto
     have "even_odd_interpolate (f o v) (f o w) \<longlonglongrightarrow> f l"
       unfolding even_odd_interpolate_filterlim[symmetric] comp_def using v w I by auto
     then have *: "(\<lambda>n. f (even_odd_interpolate v w n)) \<longlonglongrightarrow> f l"
       unfolding even_odd_interpolate_compose unfolding comp_def by auto
     have "convergent (even_odd_interpolate v w)"
       apply (rule assms(2)[OF _ _ *])
       unfolding even_odd_interpolate_def using v(1) w(1) \<open>l \<in> T\<close> by auto
     then obtain z where "even_odd_interpolate v w \<longlonglongrightarrow> z"
       unfolding convergent_def by auto
     then have *: "v \<longlonglongrightarrow> z" "w \<longlonglongrightarrow> z" unfolding even_odd_interpolate_filterlim[symmetric] by auto
     then have "z = l" using v(2) w(2) LIMSEQ_unique by auto
     then have "v \<longlonglongrightarrow> l" using * by simp
     then have "eventually (\<lambda>n. v n \<in> V) sequentially"
       using VW by (simp add: tendsto_def)
     then have "\<exists>n. v n \<in> V"
       using eventually_False_sequentially eventually_elim2 by blast
     then show False
       using v(3) \<open>V \<inter> W = {}\<close> by auto
   qed
 qed
 
 lemma homeomorphism_on_extension_sequentially':
   fixes f::"'a::{first_countable_topology, t3_space} \<Rightarrow> 'b::{first_countable_topology, t3_space}"
   assumes "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> b \<in> T \<Longrightarrow> u \<longlonglongrightarrow> b \<Longrightarrow> convergent (\<lambda>n. f (u n))"
           "\<And>u c. (\<forall>n. u n \<in> S) \<Longrightarrow> c \<in> f`T \<Longrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> c \<Longrightarrow> convergent u"
           "\<And>b. b \<in> T \<Longrightarrow> \<exists>u. (\<forall>n. u n \<in> S) \<and> u \<longlonglongrightarrow> b \<and> ((\<lambda>n. f (u n)) \<longlonglongrightarrow> f b)"
   shows "homeomorphism_on T f"
 apply (rule homeomorphism_on_sequentially, rule homeomorphism_on_extension_sequentially_precise[of S T])
 using assms by auto
 
 proposition homeomorphism_on_extension_sequentially:
   fixes f::"'a::{first_countable_topology, t3_space} \<Rightarrow> 'b::{first_countable_topology, t3_space}"
   assumes "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> u \<longlonglongrightarrow> b \<longleftrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f b"
           "T \<subseteq> closure S"
   shows "homeomorphism_on T f"
 apply (rule homeomorphism_on_extension_sequentially'[of S])
 using assms(1) convergent_def apply fastforce
 using assms(1) convergent_def apply blast
 by (metis assms(1) assms(2) closure_sequential subsetCE)
 
 lemma homeomorphism_on_UNIV_extension_sequentially:
   fixes f::"'a::{first_countable_topology, t3_space} \<Rightarrow> 'b::{first_countable_topology, t3_space}"
   assumes "\<And>u b. (\<forall>n. u n \<in> S) \<Longrightarrow> u \<longlonglongrightarrow> b \<longleftrightarrow> (\<lambda>n. f (u n)) \<longlonglongrightarrow> f b"
           "closure S = UNIV"
   shows "homeomorphism_on UNIV f"
 apply (rule homeomorphism_on_extension_sequentially[of S]) using assms by auto
 
 
 subsubsection \<open>Proper spaces\<close>
 
 text \<open>Proper spaces, i.e., spaces in which every closed ball is compact -- or, equivalently,
 any closed bounded set is compact.\<close>
 
 definition proper::"('a::metric_space) set \<Rightarrow> bool"
   where "proper S \<equiv> (\<forall> x r. compact (cball x r \<inter> S))"
 
 lemma properI:
   assumes "\<And>x r. compact (cball x r \<inter> S)"
   shows "proper S"
 using assms unfolding proper_def by auto
 
 lemma proper_compact_cball:
   assumes "proper (UNIV::'a::metric_space set)"
   shows "compact (cball (x::'a) r)"
 using assms unfolding proper_def by auto
 
 lemma proper_compact_bounded_closed:
   assumes "proper (UNIV::'a::metric_space set)" "closed (S::'a set)" "bounded S"
   shows "compact S"
 proof -
   obtain x r where "S \<subseteq> cball x r"
     using \<open>bounded S\<close> bounded_subset_cball by blast
   then have *: "S = S \<inter> cball x r"
     by auto
   show ?thesis
     apply (subst *, rule closed_Int_compact) using assms unfolding proper_def by auto
 qed
 
 lemma proper_real [simp]:
   "proper (UNIV::real set)"
 unfolding proper_def by auto
 
 lemma complete_of_proper:
   assumes "proper S"
   shows "complete S"
 proof -
   have "\<exists>l\<in>S. u \<longlonglongrightarrow> l" if "Cauchy u" "\<And>n. u n \<in> S" for u
   proof -
     have "bounded (range u)"
       using \<open>Cauchy u\<close> cauchy_imp_bounded by auto
     then obtain x r where *: "\<And>n. dist x (u n) \<le> r"
       unfolding bounded_def by auto
     then have "u n \<in> (cball x r) \<inter> S" for n using \<open>u n \<in> S\<close> by auto
     moreover have "complete ((cball x r) \<inter> S)"
       apply (rule compact_imp_complete) using assms unfolding proper_def by auto
     ultimately show ?thesis
       unfolding complete_def using \<open>Cauchy u\<close> by auto
   qed
   then show ?thesis
     unfolding complete_def by auto
 qed
 
 lemma proper_of_compact:
   assumes "compact S"
   shows "proper S"
 using assms by (auto intro: properI)
 
 lemma proper_Un:
   assumes "proper A" "proper B"
   shows "proper (A \<union> B)"
 using assms unfolding proper_def by (auto simp add: compact_Un inf_sup_distrib1)
 
 subsubsection \<open>Miscellaneous topology\<close>
 
 text \<open>When manipulating the triangle inequality, it is very frequent to deal with 4 points
 (and automation has trouble doing it automatically). Even sometimes with 5 points...\<close>
 
 lemma dist_triangle4 [mono_intros]:
   "dist x t \<le> dist x y + dist y z + dist z t"
 using dist_triangle[of x z y] dist_triangle[of x t z] by auto
 
 lemma dist_triangle5 [mono_intros]:
   "dist x u \<le> dist x y + dist y z + dist z t + dist t u"
 using dist_triangle4[of x u y z] dist_triangle[of z u t] by auto
 
 text \<open>A thickening of a compact set is closed.\<close>
 
 lemma compact_has_closed_thickening:
   assumes "compact C"
           "continuous_on C f"
   shows "closed (\<Union>x\<in>C. cball x (f x))"
 proof (auto simp add: closed_sequential_limits)
   fix u l assume *: "\<forall>n::nat. \<exists>x\<in>C. dist x (u n) \<le> f x" "u \<longlonglongrightarrow> l"
   have "\<exists>x::nat\<Rightarrow>'a. \<forall>n. x n \<in> C \<and> dist (x n) (u n) \<le> f (x n)"
     apply (rule choice) using * by auto
   then obtain x::"nat \<Rightarrow> 'a" where x: "\<And>n. x n \<in> C" "\<And>n. dist (x n) (u n) \<le> f (x n)"
     by blast
   obtain r c where "strict_mono r" "c \<in> C" "(x o r) \<longlonglongrightarrow> c"
     using x(1) \<open>compact C\<close> by (meson compact_eq_seq_compact_metric seq_compact_def)
   then have "c \<in> C" using x(1) \<open>compact C\<close> by auto
   have lim: "(\<lambda>n. f (x (r n)) - dist (x (r n)) (u (r n))) \<longlonglongrightarrow> f c - dist c l"
     apply (intro tendsto_intros, rule continuous_on_tendsto_compose[of C f])
     using *(2) x(1) \<open>(x o r) \<longlonglongrightarrow> c\<close> \<open>continuous_on C f\<close> \<open>c \<in> C\<close> \<open>strict_mono r\<close> LIMSEQ_subseq_LIMSEQ
     unfolding comp_def by auto
   have "f c - dist c l \<ge> 0" apply (rule LIMSEQ_le_const[OF lim]) using x(2) by auto
   then show "\<exists>x\<in>C. dist x l \<le> f x" using \<open>c \<in> C\<close> by auto
 qed
 
 text \<open>congruence rule for continuity. The assumption that $f y = g y$ is necessary since \verb+at x+
 is the pointed neighborhood at $x$.\<close>
 
 lemma continuous_within_cong:
   assumes "continuous (at y within S) f"
           "eventually (\<lambda>x. f x = g x) (at y within S)"
           "f y = g y"
   shows "continuous (at y within S) g"
 using assms(1) assms(2) Lim_transform_eventually unfolding continuous_within assms(3) by auto
 
 text \<open>A function which tends to infinity at infinity, on a proper set, realizes its infimum\<close>
 
 lemma continuous_attains_inf_proper:
   fixes f :: "'a::metric_space \<Rightarrow> 'b::linorder_topology"
   assumes "proper s" "a \<in> s"
           "continuous_on s f"
           "\<And>z. z \<in> s - cball a r \<Longrightarrow> f z \<ge> f a"
   shows "\<exists>x\<in>s. \<forall>y\<in>s. f x \<le> f y"
 proof (cases "r \<ge> 0")
   case True
   have "\<exists>x\<in>cball a r \<inter> s. \<forall>y \<in> cball a r \<inter> s. f x \<le> f y"
     apply (rule continuous_attains_inf) using assms True unfolding proper_def apply (auto simp add: continuous_on_subset)
     using centre_in_cball by blast
   then obtain x where x: "x \<in> cball a r \<inter> s" "\<And>y. y \<in> cball a r \<inter> s \<Longrightarrow> f x \<le> f y"
     by auto
   have "f x \<le> f y" if "y \<in> s" for y
   proof (cases "y \<in> cball a r")
     case True
     then show ?thesis using x(2) that by auto
   next
     case False
     have "f x \<le> f a"
       apply (rule x(2)) using assms True by auto
     then show ?thesis using assms(4)[of y] that False by auto
   qed
   then show ?thesis using x(1) by auto
 next
   case False
   show ?thesis
     apply (rule bexI[of _ a]) using assms False by auto
 qed
 
 subsubsection \<open>Measure of balls\<close>
 
 text \<open>The image of a ball by an affine map is still a ball, with explicit center and radius.\<close>
 
 lemma affine_image_ball [simp]:
   "(\<lambda>y. R *\<^sub>R y + x) ` cball 0 1 = cball (x::('a::real_normed_vector)) \<bar>R\<bar>"
 proof
   have "dist x (R *\<^sub>R y + x) \<le> \<bar>R\<bar>" if "dist 0 y \<le> 1" for y
   proof -
     have "dist x (R *\<^sub>R y + x) = norm ((R *\<^sub>R y + x) - x)" by (simp add: dist_norm)
     also have "... = \<bar>R\<bar> * norm y" by auto
     finally show ?thesis using that by (simp add: mult_left_le)
   qed
   then show "(\<lambda>y. R *\<^sub>R y + x) ` cball 0 1 \<subseteq> cball x \<bar>R\<bar>" by auto
 
   show "cball x \<bar>R\<bar> \<subseteq> (\<lambda>y. R *\<^sub>R y + x) ` cball 0 1"
   proof (cases "\<bar>R\<bar> = 0")
     case True
     then have "cball x \<bar>R\<bar> = {x}" by auto
     moreover have "x = R *\<^sub>R 0 + x \<and> 0 \<in> cball 0 1" by auto
     ultimately show ?thesis by auto
   next
     case False
     have "z \<in> (\<lambda>y. R *\<^sub>R y + x) ` cball 0 1" if "z \<in> cball x \<bar>R\<bar>" for z
     proof -
       define y where "y = (z - x) /\<^sub>R R"
       have "R *\<^sub>R y + x = z" unfolding y_def using False by auto
       moreover have "y \<in> cball 0 1"
         using \<open>z \<in> cball x \<bar>R\<bar>\<close> False unfolding y_def by (auto simp add: dist_norm[symmetric] divide_simps dist_commute)
       ultimately show ?thesis by auto
     qed
     then show ?thesis by auto
   qed
 qed
 
 text \<open>From the rescaling properties of Lebesgue measure in a euclidean space, it follows that
 the measure of any ball can be expressed in terms of the measure of the unit ball.\<close>
 
 lemma lebesgue_measure_ball:
   assumes "R \<ge> 0"
   shows "measure lborel (cball (x::('a::euclidean_space)) R) = R^(DIM('a)) * measure lborel (cball (0::'a) 1)"
         "emeasure lborel (cball (x::('a::euclidean_space)) R) = R^(DIM('a)) * emeasure lborel (cball (0::'a) 1)"
 using measure_lebesgue_affine[of R x "cball 0 1"] emeasure_lebesgue_affine[of R x "cball 0 1"] assms
 unfolding affine_image_ball by (auto simp add: ennreal_power)
 
 text \<open>We show that the unit ball has positive measure -- this is obvious, but useful. We could
 show it by arguing that it contains a box, whose measure can be computed, but instead we say
 that if the measure vanished then the measure of any ball would also vanish, contradicting the
 fact that the space has infinite measure. This avoids all computations.\<close>
 
 lemma lebesgue_measure_ball_pos:
   "emeasure lborel (cball (0::'a::euclidean_space) 1) > 0"
   "measure lborel (cball (0::'a::euclidean_space) 1) > 0"
 proof -
   show "emeasure lborel (cball (0::'a::euclidean_space) 1) > 0"
   proof (rule ccontr)
     assume "\<not>(emeasure lborel (cball (0::'a::euclidean_space) 1) > 0)"
     then have "emeasure lborel (cball (0::'a) 1) = 0" by auto
     then have "emeasure lborel (cball (0::'a) n) = 0" for n::nat
       using lebesgue_measure_ball(2)[of "real n" 0] by (metis mult_zero_right of_nat_0_le_iff)
     then have "emeasure lborel (\<Union>n. cball (0::'a) (real n)) = 0"
       by (metis (mono_tags, lifting) borel_closed closed_cball emeasure_UN_eq_0 imageE sets_lborel subsetI)
     moreover have "(\<Union>n. cball (0::'a) (real n)) = UNIV" by (auto simp add: real_arch_simple)
     ultimately show False
       by simp
   qed
   moreover have "emeasure lborel (cball (0::'a::euclidean_space) 1) < \<infinity>"
     by (rule emeasure_bounded_finite, auto)
   ultimately show "measure lborel (cball (0::'a::euclidean_space) 1) > 0"
     by (metis borel_closed closed_cball ennreal_0 has_integral_iff_emeasure_lborel has_integral_measure_lborel less_irrefl order_refl zero_less_measure_iff)
 qed
 
 subsubsection \<open>infdist and closest point projection\<close>
 
 text \<open>The distance to a union of two sets is the minimum of the distance to the two sets.\<close>
 
 lemma infdist_union_min [mono_intros]:
   assumes "A \<noteq> {}" "B \<noteq> {}"
   shows "infdist x (A \<union> B) = min (infdist x A) (infdist x B)"
 using assms by (simp add: infdist_def cINF_union inf_real_def)
 
 text \<open>The distance to a set is non-increasing with the set.\<close>
 
 lemma infdist_mono [mono_intros]:
   assumes "A \<subseteq> B" "A \<noteq> {}"
   shows "infdist x B \<le> infdist x A"
 proof -
   have "(INF a\<in>B. dist x a) \<le> (INF a\<in>A. dist x a)"
     by (rule cINF_superset_mono[OF assms(2) _ assms(1)], auto)
   then show ?thesis
     unfolding infdist_def using assms by auto
 qed
 
 text \<open>If a set is proper, then the infimum of the distances to this set is attained.\<close>
 
 lemma infdist_proper_attained:
   assumes "proper C" "C \<noteq> {}"
   shows "\<exists>c\<in>C. infdist x C = dist x c"
 proof -
   obtain a where "a \<in> C" using assms by auto
   have *: "dist x a \<le> dist x z" if "dist a z \<ge> 2 * dist a x" for z
   proof -
     have "2 * dist a x \<le> dist a z" using that by simp
     also have "... \<le> dist a x + dist x z" by (intro mono_intros)
     finally show ?thesis by (simp add: dist_commute)
   qed
   have "\<exists>c\<in>C. \<forall>d\<in>C. dist x c \<le> dist x d"
     apply (rule continuous_attains_inf_proper[OF assms(1) \<open>a \<in> C\<close>, of _ "2 * dist a x"])
     using * by (auto intro: continuous_intros)
   then show ?thesis unfolding infdist_def using \<open>C \<noteq> {}\<close>
     by (metis antisym bdd_below_image_dist cINF_lower le_cINF_iff)
 qed
 
 lemma infdist_almost_attained:
   assumes "infdist x X < a" "X \<noteq> {}"
   shows "\<exists>y\<in>X. dist x y < a"
 using assms using cInf_less_iff[of "(dist x)`X"] unfolding infdist_def by auto
 
 lemma infdist_triangle_abs [mono_intros]:
   "\<bar>infdist x A - infdist y A\<bar> \<le> dist x y"
 by (metis (full_types) abs_diff_le_iff diff_le_eq dist_commute infdist_triangle)
 
 text \<open>The next lemma is missing in the library, contrary to its cousin \verb+continuous_infdist+.\<close>
 
-lemma continuous_on_infdist [continuous_intros]:
-  assumes "continuous_on S f"
-  shows "continuous_on S (\<lambda>x. infdist (f x) A)"
-using assms unfolding continuous_on by (auto intro: tendsto_infdist)
-
 text \<open>The infimum of the distance to a singleton set is simply the distance to the unique
 member of the set.\<close>
 
 lemma infdist_point [simp]:
   "infdist x {y} = dist x y"
 unfolding infdist_def by (metis cInf_singleton image_empty image_insert insert_not_empty)
 
 text \<open>The closest point projection of $x$ on $A$. It is not unique, so we choose one point realizing the minimal
 distance. And if there is no such point, then we use $x$, to make some statements true without any
 assumption.\<close>
 
 definition proj_set::"'a::metric_space \<Rightarrow> 'a set \<Rightarrow> 'a set"
   where "proj_set x A = {y \<in> A. dist x y = infdist x A}"
 
 definition distproj::"'a::metric_space \<Rightarrow> 'a set \<Rightarrow> 'a"
   where "distproj x A = (if proj_set x A \<noteq> {} then SOME y. y \<in> proj_set x A else x)"
 
 lemma proj_setD:
   assumes "y \<in> proj_set x A"
   shows "y \<in> A" "dist x y = infdist x A"
 using assms unfolding proj_set_def by auto
 
 lemma proj_setI:
   assumes "y \<in> A" "dist x y \<le> infdist x A"
   shows "y \<in> proj_set x A"
 using assms infdist_le[OF \<open>y \<in> A\<close>, of x] unfolding proj_set_def by auto
 
 lemma proj_setI':
   assumes "y \<in> A" "\<And>z. z \<in> A \<Longrightarrow> dist x y \<le> dist x z"
   shows "y \<in> proj_set x A"
 proof (rule proj_setI[OF \<open>y \<in> A\<close>])
   show "dist x y \<le> infdist x A"
     apply (subst infdist_notempty)
     using assms by (auto intro!: cInf_greatest)
 qed
 
 lemma distproj_in_proj_set:
   assumes "proj_set x A \<noteq> {}"
   shows "distproj x A \<in> proj_set x A"
         "distproj x A \<in> A"
         "dist x (distproj x A) = infdist x A"
 proof -
   show "distproj x A \<in> proj_set x A"
     using assms unfolding distproj_def using some_in_eq by auto
   then show "distproj x A \<in> A" "dist x (distproj x A) = infdist x A"
     unfolding proj_set_def by auto
 qed
 
 lemma proj_set_nonempty_of_proper:
   assumes "proper A" "A \<noteq> {}"
   shows "proj_set x A \<noteq> {}"
 proof -
   have "\<exists>y. y \<in> A \<and> dist x y = infdist x A"
     using infdist_proper_attained[OF assms, of x] by auto
   then show "proj_set x A \<noteq> {}" unfolding proj_set_def by auto
 qed
 
 lemma distproj_self [simp]:
   assumes "x \<in> A"
   shows "proj_set x A = {x}"
         "distproj x A = x"
 proof -
   show "proj_set x A = {x}"
     unfolding proj_set_def using assms by auto
   then show "distproj x A = x"
     unfolding distproj_def by auto
 qed
 
 lemma distproj_closure [simp]:
   assumes "x \<in> closure A"
   shows "distproj x A = x"
 proof (cases "proj_set x A \<noteq> {}")
   case True
   show ?thesis
     using distproj_in_proj_set(3)[OF True] assms
     by (metis closure_empty dist_eq_0_iff distproj_self(2) in_closure_iff_infdist_zero)
 next
   case False
   then show ?thesis unfolding distproj_def by auto
 qed
 
 lemma distproj_le:
   assumes "y \<in> A"
   shows "dist x (distproj x A) \<le> dist x y"
 proof (cases "proj_set x A \<noteq> {}")
   case True
   show ?thesis using distproj_in_proj_set(3)[OF True] infdist_le[OF assms] by auto
 next
   case False
   then show ?thesis unfolding distproj_def by auto
 qed
 
 lemma proj_set_dist_le:
   assumes "y \<in> A" "p \<in> proj_set x A"
   shows "dist x p \<le> dist x y"
   using assms infdist_le unfolding proj_set_def by auto
 
 subsection \<open>Material on ereal and ennreal\<close>
 
 text \<open>We add the simp rules that we needed to make all computations become more or less automatic.\<close>
 
 lemma ereal_of_real_of_ereal_iff [simp]:
   "ereal(real_of_ereal x) = x \<longleftrightarrow> x \<noteq> \<infinity> \<and> x \<noteq> - \<infinity>"
   "x = ereal(real_of_ereal x) \<longleftrightarrow> x \<noteq> \<infinity> \<and> x \<noteq> - \<infinity>"
 by (metis MInfty_neq_ereal(1) PInfty_neq_ereal(2) real_of_ereal.elims)+
 
 lemma inverse_eq_infinity_iff_eq_zero [simp]:
   "1/(x::ereal) = \<infinity> \<longleftrightarrow> x = 0"
 by (simp add: divide_ereal_def)
 
 declare ereal_inverse_eq_0 [simp]
 declare ereal_0_gt_inverse [simp]
 declare ereal_inverse_le_0_iff [simp]
 declare ereal_divide_eq_0_iff [simp]
 declare ereal_mult_le_0_iff [simp]
 declare ereal_zero_le_0_iff [simp]
 declare ereal_mult_less_0_iff [simp]
 declare ereal_zero_less_0_iff [simp]
 declare ereal_uminus_eq_reorder [simp]
 declare ereal_minus_le_iff [simp]
 
 lemma ereal_inverse_noteq_minus_infinity [simp]:
   "1/(x::ereal) \<noteq> -\<infinity>"
 by (simp add: divide_ereal_def)
 
 lemma ereal_inverse_positive_iff_nonneg_not_infinity [simp]:
   "0 < 1/(x::ereal) \<longleftrightarrow> (x \<ge> 0 \<and> x \<noteq> \<infinity>)"
 by (cases x, auto simp add: one_ereal_def)
 
 lemma ereal_inverse_negative_iff_nonpos_not_infinity' [simp]:
   "0 > inverse (x::ereal) \<longleftrightarrow> (x < 0 \<and> x \<noteq> -\<infinity>)"
 by (cases x, auto simp add: one_ereal_def)
 
 lemma ereal_divide_pos_iff [simp]:
   "0 < x/(y::ereal) \<longleftrightarrow> (y \<noteq> \<infinity> \<and> y \<noteq> -\<infinity>) \<and> ((x > 0 \<and> y > 0) \<or> (x < 0 \<and> y < 0) \<or> (y = 0 \<and> x > 0))"
 unfolding divide_ereal_def by auto
 
 lemma ereal_divide_neg_iff [simp]:
   "0 > x/(y::ereal) \<longleftrightarrow> (y \<noteq> \<infinity> \<and> y \<noteq> -\<infinity>) \<and> ((x > 0 \<and> y < 0) \<or> (x < 0 \<and> y > 0) \<or> (y = 0 \<and> x < 0))"
 unfolding divide_ereal_def by auto
 
 lemma ereal_distrib_left:
   fixes a b c :: ereal
   assumes "a \<noteq> \<infinity> \<or> b \<noteq> -\<infinity>"
     and "a \<noteq> -\<infinity> \<or> b \<noteq> \<infinity>"
     and "\<bar>c\<bar> \<noteq> \<infinity>"
   shows "c * (a + b) = c * a + c * b"
 using assms
 by (cases rule: ereal3_cases[of a b c]) (simp_all add: field_simps)
 
 lemma ereal_distrib_minus_left:
   fixes a b c :: ereal
   assumes "a \<noteq> \<infinity> \<or> b \<noteq> \<infinity>"
     and "a \<noteq> -\<infinity> \<or> b \<noteq> -\<infinity>"
     and "\<bar>c\<bar> \<noteq> \<infinity>"
   shows "c * (a - b) = c * a - c * b"
 using assms
 by (cases rule: ereal3_cases[of a b c]) (simp_all add: field_simps)
 
 lemma ereal_distrib_minus_right:
   fixes a b c :: ereal
   assumes "a \<noteq> \<infinity> \<or> b \<noteq> \<infinity>"
     and "a \<noteq> -\<infinity> \<or> b \<noteq> -\<infinity>"
     and "\<bar>c\<bar> \<noteq> \<infinity>"
   shows "(a - b) * c = a * c - b * c"
 using assms
 by (cases rule: ereal3_cases[of a b c]) (simp_all add: field_simps)
 
 text \<open>The next one is missing close to its friend \verb+Liminf_ereal_mult_right+.\<close>
 
 lemma Liminf_ereal_mult_left:
   assumes "F \<noteq> bot" "(c::real) \<ge> 0"
     shows "Liminf F (\<lambda>n. ereal c * f n) = ereal c * Liminf F f"
 using Liminf_ereal_mult_right[OF assms] by (subst (1 2) mult.commute)
 
 
 text \<open>More additions to \verb+mono_intros+.\<close>
 
 lemma ereal_leq_imp_neg_leq [mono_intros]:
   fixes x y::ereal
   assumes "x \<le> y"
   shows "-y \<le> -x"
 using assms by auto
 
 lemma ereal_le_imp_neg_le [mono_intros]:
   fixes x y::ereal
   assumes "x < y"
   shows "-y < -x"
 using assms by auto
 
 declare ereal_mult_left_mono [mono_intros]
 declare ereal_mult_right_mono [mono_intros]
 declare ereal_mult_strict_right_mono [mono_intros]
 declare ereal_mult_strict_left_mono [mono_intros]
 
 text \<open>Monotonicity of basic inclusions.\<close>
 
 lemma ennreal_mono':
   "mono ennreal"
 by (simp add: ennreal_leI monoI)
 
 lemma enn2ereal_mono':
   "mono enn2ereal"
 by (simp add: less_eq_ennreal.rep_eq mono_def)
 
 lemma e2ennreal_mono':
   "mono e2ennreal"
 by (simp add: e2ennreal_mono mono_def)
 
 lemma enn2ereal_mono [mono_intros]:
   assumes "x \<le> y"
   shows "enn2ereal x \<le> enn2ereal y"
 using assms less_eq_ennreal.rep_eq by auto
 
 lemma ereal_mono:
   "mono ereal"
 unfolding mono_def by auto
 
 lemma ereal_strict_mono:
   "strict_mono ereal"
 unfolding strict_mono_def by auto
 
 lemma ereal_mono2 [mono_intros]:
   assumes "x \<le> y"
   shows "ereal x \<le> ereal y"
 by (simp add: assms)
 
 lemma ereal_strict_mono2 [mono_intros]:
   assumes "x < y"
   shows "ereal x < ereal y"
 using assms by auto
 
 lemma enn2ereal_a_minus_b_plus_b [mono_intros]:
   "enn2ereal a \<le> enn2ereal (a - b) + enn2ereal b"
 by (metis diff_add_self_ennreal less_eq_ennreal.rep_eq linear plus_ennreal.rep_eq)
 
 text \<open>The next lemma follows from the same assertion in ereals.\<close>
 
 lemma enn2ereal_strict_mono [mono_intros]:
   assumes "x < y"
   shows "enn2ereal x < enn2ereal y"
 using assms less_ennreal.rep_eq by auto
 
 declare ennreal_mult_strict_left_mono [mono_intros]
 declare ennreal_mult_strict_right_mono [mono_intros]
 
 lemma ennreal_ge_0 [mono_intros]:
   assumes "0 < x"
   shows "0 < ennreal x"
 by (simp add: assms)
 
 
 text \<open>The next lemma is true and useful in ereal. Note that variants such as $a + b \leq c + d$
 implies $a-d \leq c -b$ are not true -- take $a = c = \infty$ and $b = d = 0$...\<close>
 
 lemma ereal_minus_le_minus_plus [mono_intros]:
   fixes a b c::ereal
   assumes "a \<le> b + c"
   shows "-b \<le> -a + c"
   using assms apply (cases a, cases b, cases c, auto)
   using ereal_infty_less_eq2(2) ereal_plus_1(4) by fastforce
 
 lemma tendsto_ennreal_0 [tendsto_intros]:
   assumes "(u \<longlongrightarrow> 0) F"
   shows "((\<lambda>n. ennreal(u n)) \<longlongrightarrow> 0) F"
 unfolding ennreal_0[symmetric] by (intro tendsto_intros assms)
 
 lemma tendsto_ennreal_1 [tendsto_intros]:
   assumes "(u \<longlongrightarrow> 1) F"
   shows "((\<lambda>n. ennreal(u n)) \<longlongrightarrow> 1) F"
 unfolding ennreal_1[symmetric] by (intro tendsto_intros assms)
 
 subsection \<open>Miscellaneous\<close>
 
 declare lim_1_over_n [tendsto_intros]
 declare lim_ln_over_n [tendsto_intros]
 
 lemma lim_log_over_n [tendsto_intros]:
   "(\<lambda>n. log k n/n) \<longlonglongrightarrow> 0"
 proof -
   have *: "log k n/n = (1/ln k) * (ln n / n)" for n
     unfolding log_def by auto
   have "(\<lambda>n. (1/ln k) * (ln n / n)) \<longlonglongrightarrow> (1/ln k) * 0"
     by (intro tendsto_intros)
   then show ?thesis
     unfolding * by auto
 qed
 
 lemma lim_ceiling_over_n [tendsto_intros]:
   assumes "(\<lambda>n. u n/n) \<longlonglongrightarrow> l"
   shows "(\<lambda>n. ceiling(u n)/n) \<longlonglongrightarrow> l"
 proof (rule tendsto_sandwich[of "\<lambda>n. u n/n" _ _ "\<lambda>n. u n/n + 1/n"])
   show "\<forall>\<^sub>F n in sequentially. u n / real n \<le> real_of_int \<lceil>u n\<rceil> / real n"
     unfolding eventually_sequentially by (rule exI[of _ 1], auto simp add: divide_simps)
   show "\<forall>\<^sub>F n in sequentially. real_of_int \<lceil>u n\<rceil> / real n \<le> u n / real n + 1 / real n"
     unfolding eventually_sequentially by (rule exI[of _ 1], auto simp add: divide_simps)
   have "(\<lambda>n. u n / real n + 1 / real n) \<longlonglongrightarrow> l + 0"
     by (intro tendsto_intros assms)
   then show "(\<lambda>n. u n / real n + 1 / real n) \<longlonglongrightarrow> l" by auto
 qed (simp add: assms)
 
 lemma power4_eq_xxxx:
   fixes x::"'a::monoid_mult"
   shows "x^4 = x * x * x * x"
 by (simp add: mult.assoc power_numeral_even)
 
 subsubsection \<open>Liminfs and Limsups\<close>
 
 text \<open>More facts on liminfs and limsups\<close>
 
 lemma Limsup_obtain':
   fixes u::"'a \<Rightarrow> 'b::complete_linorder"
   assumes "Limsup F u > c" "eventually P F"
   shows "\<exists>n. P n \<and> u n > c"
 proof -
   have *: "(INF P\<in>{P. eventually P F}. SUP x\<in>{x. P x}. u x) > c" using assms by (simp add: Limsup_def)
   have **: "c < (SUP x\<in>{x. P x}. u x)" using less_INF_D[OF *, of P] assms by auto
   then show ?thesis by (simp add: less_SUP_iff)
 qed
 
 lemma limsup_obtain:
   fixes u::"nat \<Rightarrow> 'a :: complete_linorder"
   assumes "limsup u > c"
   shows "\<exists>n \<ge> N. u n > c"
 using Limsup_obtain'[OF assms, of "\<lambda>n. n \<ge> N"] unfolding eventually_sequentially by auto
 
 lemma Liminf_obtain':
   fixes u::"'a \<Rightarrow> 'b::complete_linorder"
   assumes "Liminf F u < c" "eventually P F"
   shows "\<exists>n. P n \<and> u n < c"
 proof -
   have *: "(SUP P\<in>{P. eventually P F}. INF x\<in>{x. P x}. u x) < c" using assms by (simp add: Liminf_def)
   have **: "(INF x\<in>{x. P x}. u x) < c" using SUP_lessD[OF *, of P] assms by auto
   then show ?thesis by (simp add: INF_less_iff)
 qed
 
 lemma liminf_obtain:
   fixes u::"nat \<Rightarrow> 'a :: complete_linorder"
   assumes "liminf u < c"
   shows "\<exists>n \<ge> N. u n < c"
 using Liminf_obtain'[OF assms, of "\<lambda>n. n \<ge> N"] unfolding eventually_sequentially by auto
 
 text \<open>The Liminf of a minimum is the minimum of the Liminfs.\<close>
 
 lemma Liminf_min_eq_min_Liminf:
   fixes u v::"nat \<Rightarrow> 'a::complete_linorder"
   shows "Liminf F (\<lambda>n. min (u n) (v n)) = min (Liminf F u) (Liminf F v)"
 proof (rule order_antisym)
   show "Liminf F (\<lambda>n. min (u n) (v n)) \<le> min (Liminf F u) (Liminf F v)"
     by (auto simp add: Liminf_mono)
 
   have "Liminf F (\<lambda>n. min (u n) (v n)) > w" if H: "min (Liminf F u) (Liminf F v) > w" for w
   proof (cases "{w<..<min (Liminf F u) (Liminf F v)} = {}")
     case True
     have "eventually (\<lambda>n. u n > w) F" "eventually (\<lambda>n. v n > w) F"
       using H le_Liminf_iff by fastforce+
     then have "eventually (\<lambda>n. min (u n) (v n) > w) F"
       apply auto using eventually_elim2 by fastforce
     moreover have "z > w \<Longrightarrow> z \<ge> min (Liminf F u) (Liminf F v)" for z
       using H True not_le_imp_less by fastforce
     ultimately have "eventually (\<lambda>n. min (u n) (v n) \<ge> min (Liminf F u) (Liminf F v)) F"
       by (simp add: eventually_mono)
     then have "min (Liminf F u) (Liminf F v) \<le> Liminf F (\<lambda>n. min (u n) (v n))"
       by (metis Liminf_bounded)
     then show ?thesis using H less_le_trans by blast
   next
     case False
     then obtain z where "z \<in> {w<..<min (Liminf F u) (Liminf F v)}"
       by blast
     then have H: "w < z" "z < min (Liminf F u) (Liminf F v)"
       by auto
     then have "eventually (\<lambda>n. u n > z) F" "eventually (\<lambda>n. v n > z) F"
       using le_Liminf_iff by fastforce+
     then have "eventually (\<lambda>n. min (u n) (v n) > z) F"
       apply auto using eventually_elim2 by fastforce
     then have "Liminf F (\<lambda>n. min (u n) (v n)) \<ge> z"
       by (simp add: Liminf_bounded eventually_mono less_imp_le)
     then show ?thesis using H(1)
       by auto
   qed
   then show "min (Liminf F u) (Liminf F v) \<le> Liminf F (\<lambda>n. min (u n) (v n))"
     using not_le_imp_less by blast
 qed
 
 text \<open>The Limsup of a maximum is the maximum of the Limsups.\<close>
 
 lemma Limsup_max_eq_max_Limsup:
   fixes u::"'a \<Rightarrow> 'b::complete_linorder"
   shows "Limsup F (\<lambda>n. max (u n) (v n)) = max (Limsup F u) (Limsup F v)"
 proof (rule order_antisym)
   show "max (Limsup F u) (Limsup F v) \<le> Limsup F (\<lambda>n. max (u n) (v n))"
     by (auto intro: Limsup_mono)
 
   have "Limsup F (\<lambda>n. max (u n) (v n)) < e" if "max (Limsup F u) (Limsup F v) < e" for e
   proof (cases "\<exists>t. max (Limsup F u) (Limsup F v) < t \<and> t < e")
     case True
     then obtain t where t: "t < e" "max (Limsup F u) (Limsup F v) < t" by auto
     then have "Limsup F u < t" "Limsup F v < t" using that max_def by auto
     then have *: "eventually (\<lambda>n. u n < t) F" "eventually (\<lambda>n. v n < t) F"
       by (auto simp: Limsup_lessD)
     have "eventually (\<lambda>n. max (u n) (v n) < t) F"
       using eventually_mono[OF eventually_conj[OF *]] by auto
     then have "Limsup F (\<lambda>n. max (u n) (v n)) \<le> t"
       by (meson Limsup_obtain' not_le_imp_less order.asym)
     then show ?thesis
       using t by auto
   next
     case False
     have "Limsup F u < e" "Limsup F v < e" using that max_def by auto
     then have *: "eventually (\<lambda>n. u n < e) F" "eventually (\<lambda>n. v n < e) F"
       by (auto simp: Limsup_lessD)
     have "eventually (\<lambda>n. max (u n) (v n) \<le> max (Limsup F u) (Limsup F v)) F"
       apply (rule eventually_mono[OF eventually_conj[OF *]]) using False not_le_imp_less by force
     then have "Limsup F (\<lambda>n. max (u n) (v n)) \<le> max (Limsup F u) (Limsup F v)"
       by (meson Limsup_obtain' leD leI)
     then show ?thesis using that le_less_trans by blast
   qed
   then show "Limsup F (\<lambda>n. max (u n) (v n)) \<le> max (Limsup F u) (Limsup F v)"
     using not_le_imp_less by blast
 qed
 
 subsubsection \<open>Bounding the cardinality of a finite set\<close>
 
 text \<open>A variation with real bounds.\<close>
 
 lemma finite_finite_subset_caract':
   fixes C::real
   assumes "\<And>G. G \<subseteq> F \<Longrightarrow> finite G \<Longrightarrow> card G \<le> C"
   shows "finite F \<and> card F \<le> C"
 by (meson assms finite_if_finite_subsets_card_bdd le_nat_floor order_refl)
 
 text \<open>To show that a set has cardinality at most one, it suffices to show that any two of its
 elements coincide.\<close>
 
 lemma finite_at_most_singleton:
   assumes "\<And>x y. x \<in> F \<Longrightarrow> y \<in> F \<Longrightarrow> x = y"
   shows "finite F \<and> card F \<le> 1"
 proof (cases "F = {}")
   case True
   then show ?thesis by auto
 next
   case False
   then obtain x where "x \<in> F" by auto
   then have "F = {x}" using assms by auto
   then show ?thesis by auto
 qed
 
 text \<open>Bounded sets of integers are finite.\<close>
 
 lemma finite_real_int_interval [simp]:
   "finite (range real_of_int \<inter> {a..b})"
 proof -
   have "range real_of_int \<inter> {a..b} \<subseteq> real_of_int`{floor a..ceiling b}"
     by (auto, metis atLeastAtMost_iff ceiling_mono ceiling_of_int floor_mono floor_of_int image_eqI)
   then show ?thesis using finite_subset by blast
 qed
 
 text \<open>Well separated sets of real numbers are finite, with controlled cardinality.\<close>
 
 lemma separated_in_real_card_bound:
   assumes "T \<subseteq> {a..(b::real)}" "d > 0" "\<And>x y. x \<in> T \<Longrightarrow> y \<in> T \<Longrightarrow> y > x \<Longrightarrow> y \<ge> x + d"
   shows "finite T" "card T \<le> nat (floor ((b-a)/d) + 1)"
 proof -
   define f where "f = (\<lambda>x. floor ((x-a) / d))"
   have "f`{a..b} \<subseteq> {0..floor ((b-a)/d)}"
     unfolding f_def using \<open>d > 0\<close> by (auto simp add: floor_mono frac_le)
   then have *: "f`T \<subseteq> {0..floor ((b-a)/d)}" using \<open>T \<subseteq> {a..b}\<close> by auto
   then have "finite (f`T)" by (rule finite_subset, auto)
   have "card (f`T) \<le> card {0..floor ((b-a)/d)}" apply (rule card_mono) using * by auto
   then have card_le: "card (f`T) \<le> nat (floor ((b-a)/d) + 1)" using card_atLeastAtMost_int by auto
 
   have *: "f x \<noteq> f y" if "y \<ge> x + d" for x y
   proof -
     have "(y-a)/d \<ge> (x-a)/d + 1" using \<open>d > 0\<close> that by (auto simp add: divide_simps)
     then show ?thesis unfolding f_def by linarith
   qed
   have "inj_on f T"
     unfolding inj_on_def using * assms(3) by (auto, metis not_less_iff_gr_or_eq)
   show "finite T"
     using \<open>finite (f`T)\<close> \<open>inj_on f T\<close> finite_image_iff by blast
   have "card T = card (f`T)"
     using \<open>inj_on f T\<close> by (simp add: card_image)
   then show "card T \<le> nat (floor ((b-a)/d) + 1)"
     using card_le by auto
 qed
 
 
 subsection \<open>Manipulating finite ordered sets\<close>
 
 text \<open>We will need below to contruct finite sets of real numbers with good properties expressed
 in terms of consecutive elements of the set. We introduce tools to manipulate such sets,
 expressing in particular the next and the previous element of the set and controlling how they
 evolve when one inserts a new element in the set. It works in fact in any linorder, and could
 also prove useful to construct sets of integer numbers.
 
 Manipulating the next and previous elements work well, except at the top (respectively bottom).
 In our constructions, these will be fixed and called $b$ and $a$.\<close>
 
 text \<open>Notations for the next and the previous elements.\<close>
 
 definition next_in::"'a set \<Rightarrow> 'a \<Rightarrow> ('a::linorder)"
   where "next_in A u = Min (A \<inter> {u<..})"
 
 definition prev_in::"'a set \<Rightarrow> 'a \<Rightarrow> ('a::linorder)"
   where "prev_in A u = Max (A \<inter> {..<u})"
 
 context
   fixes A::"('a::linorder) set" and a b::'a
   assumes A: "finite A" "A \<subseteq> {a..b}" "a \<in> A" "b \<in> A" "a < b"
 begin
 
 text \<open>Basic properties of the next element, when one starts from an element different from top.\<close>
 
 lemma next_in_basics:
   assumes "u \<in> {a..<b}"
   shows "next_in A u \<in> A"
         "next_in A u > u"
         "A \<inter> {u<..<next_in A u} = {}"
 proof -
   have next_in_A: "next_in A u \<in> A \<inter> {u<..}"
     unfolding next_in_def apply (rule Min_in)
     using assms \<open>finite A\<close> \<open>b \<in> A\<close> by auto
   then show "next_in A u \<in> A" "next_in A u > u" by auto
   show "A \<inter> {u<..<next_in A u} = {}"
     unfolding next_in_def using A by (auto simp add: leD)
 qed
 
 lemma next_inI:
   assumes "u \<in> {a..<b}"
           "v \<in> A"
           "v > u"
           "{u<..<v} \<inter> A = {}"
   shows "next_in A u = v"
 using assms next_in_basics[OF \<open>u \<in> {a..<b}\<close>] by fastforce
 
 text \<open>Basic properties of the previous element, when one starts from an element different from
 bottom.\<close>
 
 lemma prev_in_basics:
   assumes "u \<in> {a<..b}"
   shows "prev_in A u \<in> A"
         "prev_in A u < u"
         "A \<inter> {prev_in A u<..<u} = {}"
 proof -
   have prev_in_A: "prev_in A u \<in> A \<inter> {..<u}"
     unfolding prev_in_def apply (rule Max_in)
     using assms \<open>finite A\<close> \<open>a \<in> A\<close> by auto
   then show "prev_in A u \<in> A" "prev_in A u < u" by auto
   show "A \<inter> {prev_in A u<..<u} = {}"
     unfolding prev_in_def using A by (auto simp add: leD)
 qed
 
 lemma prev_inI:
   assumes "u \<in> {a<..b}"
           "v \<in> A"
           "v < u"
           "{v<..<u} \<inter> A = {}"
   shows "prev_in A u = v"
 using assms prev_in_basics[OF \<open>u \<in> {a<..b}\<close>]
 by (meson disjoint_iff_not_equal greaterThanLessThan_iff less_linear)
 
 text \<open>The interval $[a,b]$ is covered by the intervals between the consecutive elements of $A$.\<close>
 
 lemma intervals_decomposition:
   "(\<Union> U \<in> {{u..next_in A u} | u. u \<in> A - {b}}. U) = {a..b}"
 proof
   show "(\<Union>U\<in>{{u..next_in A u} |u. u \<in> A - {b}}. U) \<subseteq> {a..b}"
     using \<open>A \<subseteq> {a..b}\<close> next_in_basics(1) apply auto apply fastforce
     by (metis \<open>A \<subseteq> {a..b}\<close> atLeastAtMost_iff eq_iff le_less_trans less_eq_real_def not_less subset_eq subset_iff_psubset_eq)
 
   have "x \<in> (\<Union>U\<in>{{u..next_in A u} |u. u \<in> A - {b}}. U)" if "x \<in> {a..b}" for x
   proof -
     consider "x = b" | "x \<in> A - {b}" | "x \<notin> A" by blast
     then show ?thesis
     proof(cases)
       case 1
       define u where "u = prev_in A b"
       have "b \<in> {a<..b}" using \<open>a < b\<close> by simp
       have "u \<in> A - {b}" unfolding u_def using prev_in_basics[OF \<open>b \<in> {a<..b}\<close>] by simp
       then have "u \<in> {a..<b}" using \<open>A \<subseteq> {a..b}\<close> \<open>a < b\<close> by fastforce
       have "next_in A u = b"
         using prev_in_basics[OF \<open>b \<in> {a<..b}\<close>] next_in_basics[OF \<open>u \<in> {a..<b}\<close>] \<open>A \<subseteq> {a..b}\<close> unfolding u_def by force
       then have "x \<in> {u..next_in A u}" unfolding 1 using prev_in_basics[OF \<open>b \<in> {a<..b}\<close>] u_def by auto
       then show ?thesis using \<open>u \<in> A - {b}\<close> by auto
     next
       case 2
       then have "x \<in> {a..<b}" using \<open>A \<subseteq> {a..b}\<close> \<open>a < b\<close> by fastforce
       have "x \<in> {x.. next_in A x}" using next_in_basics[OF \<open>x \<in> {a..<b}\<close>] by auto
       then show ?thesis using 2 by auto
     next
       case 3
       then have "x \<in> {a<..b}" using that \<open>a \<in> A\<close> leI by fastforce
       define u where "u = prev_in A x"
       have "u \<in> A - {b}" unfolding u_def using prev_in_basics[OF \<open>x \<in> {a<..b}\<close>] that by auto
       then have "u \<in> {a..<b}" using \<open>A \<subseteq> {a..b}\<close> \<open>a < b\<close> by fastforce
       have "x \<in> {u..next_in A u}"
         using prev_in_basics[OF \<open>x \<in> {a<..b}\<close>] next_in_basics[OF \<open>u \<in> {a..<b}\<close>] unfolding u_def by auto
       then show ?thesis using \<open>u \<in> A - {b}\<close> by auto
     qed
   qed
   then show "{a..b} \<subseteq> (\<Union>U\<in>{{u..next_in A u} |u. u \<in> A - {b}}. U)" by auto
 qed
 end
 
 text \<open>If one inserts an additional element, then next and previous elements are not modified,
 except at the location of the insertion.\<close>
 
 lemma next_in_insert:
   assumes A: "finite A" "A \<subseteq> {a..b}" "a \<in> A" "b \<in> A" "a < b"
       and "x \<in> {a..b} - A"
   shows "\<And>u. u \<in> A - {b, prev_in A x} \<Longrightarrow> next_in (insert x A) u = next_in A u"
         "next_in (insert x A) x = next_in A x"
         "next_in (insert x A) (prev_in A x) = x"
 proof -
   define B where "B = insert x A"
   have B: "finite B" "B \<subseteq> {a..b}" "a \<in> B" "b \<in> B" "a < b"
     using assms unfolding B_def by auto
   have x: "x \<in> {a..<b}" "x \<in> {a<..b}" using assms leI by fastforce+
   show "next_in B x = next_in A x"
     unfolding B_def by (auto simp add: next_in_def)
 
   show "next_in B (prev_in A x) = x"
     apply (rule next_inI[OF B])
     unfolding B_def using prev_in_basics[OF A \<open>x \<in> {a<..b}\<close>] \<open>A \<subseteq> {a..b}\<close> x by auto
 
   fix u assume "u \<in> A - {b, prev_in A x}"
   then have "u \<in> {a..<b}" using assms by fastforce
   have "x \<notin> {u<..<next_in A u}"
   proof (rule ccontr)
     assume "\<not>(x \<notin> {u<..<next_in A u})"
     then have *: "x \<in> {u<..<next_in A u}" by auto
     have "prev_in A x = u"
       apply (rule prev_inI[OF A \<open>x \<in> {a<..b}\<close>])
       using \<open>u \<in> A - {b, prev_in A x}\<close> * next_in_basics[OF A \<open>u \<in> {a..<b}\<close>] apply auto
       by (meson disjoint_iff_not_equal greaterThanLessThan_iff less_trans)
     then show False using \<open>u \<in> A - {b, prev_in A x}\<close> by auto
   qed
   show "next_in B u = next_in A u"
     apply (rule next_inI[OF B \<open>u \<in> {a..<b}\<close>]) unfolding B_def
     using next_in_basics[OF A \<open>u \<in> {a..<b}\<close>] \<open>x \<notin> {u<..<next_in A u}\<close> by auto
 qed
 
 text \<open>If consecutive elements are enough separated, this implies a simple bound on the
 cardinality of the set.\<close>
 
 lemma separated_in_real_card_bound2:
   fixes A::"real set"
   assumes A: "finite A" "A \<subseteq> {a..b}" "a \<in> A" "b \<in> A" "a < b"
       and B: "\<And>u. u \<in> A - {b} \<Longrightarrow> next_in A u \<ge> u + d" "d > 0"
   shows "card A \<le> nat (floor ((b-a)/d) + 1)"
 proof (rule separated_in_real_card_bound[OF \<open>A \<subseteq> {a..b}\<close> \<open>d > 0\<close>])
   fix x y assume "x \<in> A" "y \<in> A" "y > x"
   then have "x \<in> A - {b}" "x \<in> {a..<b}" using \<open>A \<subseteq> {a..b}\<close> by auto
   have "y \<ge> next_in A x"
     using next_in_basics[OF A \<open>x \<in> {a..<b}\<close>] \<open>y \<in> A\<close> \<open>y > x\<close> by auto
   then show "y \<ge> x + d" using B(1)[OF \<open>x \<in> A - {b}\<close>] by auto
 qed
 
 
 subsection \<open>Well-orders\<close>
 
 text \<open>In this subsection, we give additional lemmas on well-orders or cardinals or whatever,
 that would well belong to the library, and will be needed below.\<close>
 
 lemma (in wo_rel) max2_underS [simp]:
   assumes "x \<in> underS z" "y \<in> underS z"
   shows "max2 x y \<in> underS z"
 using assms max2_def by auto
 
 lemma (in wo_rel) max2_underS' [simp]:
   assumes "x \<in> underS y"
   shows "max2 x y = y" "max2 y x = y"
 apply (simp add: underS_E assms max2_def)
 using assms max2_def ANTISYM antisym_def underS_E by fastforce
 
 lemma (in wo_rel) max2_xx [simp]:
   "max2 x x = x"
 using max2_def by auto
 
 declare underS_notIn [simp]
 
 text \<open>The abbrevation $=o$ is used both in \verb+Set_Algebras+ and Cardinals.
 We disable the one from \verb+Set_Algebras+.\<close>
 
 no_notation elt_set_eq (infix "=o" 50)
 
 lemma regularCard_ordIso:
   assumes "Card_order r" "regularCard r" "s =o r"
   shows "regularCard s"
 unfolding regularCard_def
 proof (auto)
   fix K assume K: "K \<subseteq> Field s" "cofinal K s"
   obtain f where f: "bij_betw f (Field s) (Field r)" "embed s r f" using \<open>s =o r\<close> unfolding ordIso_def iso_def by auto
   have "f`K \<subseteq> Field r" using K(1) f(1) bij_betw_imp_surj_on by blast
   have "cofinal (f`K) r" unfolding cofinal_def
   proof
     fix a assume "a \<in> Field r"
     then obtain a' where a: "a' \<in> Field s" "f a' = a" using f
       by (metis bij_betw_imp_surj_on imageE)
     then obtain b' where b: "b' \<in> K" "a' \<noteq> b' \<and> (a', b') \<in> s"
       using \<open>cofinal K s\<close> unfolding cofinal_def by auto
     have P1: "f b' \<in> f`K" using b(1) by auto
     have "a' \<noteq> b'" "a' \<in> Field s" "b' \<in> Field s" using a(1) b K(1) by auto
     then have P2: "a \<noteq> f b'" unfolding a(2)[symmetric] using f(1) unfolding bij_betw_def inj_on_def by auto
     have "(a', b') \<in> s" using b by auto
     then have P3: "(a, f b') \<in> r" unfolding a(2)[symmetric] using f
       by (meson FieldI1 FieldI2 Card_order_ordIso[OF assms(1) assms(3)] card_order_on_def iso_defs(1) iso_iff2)
     show "\<exists>b\<in>f ` K. a \<noteq> b \<and> (a, b) \<in> r"
       using P1 P2 P3 by blast
   qed
   then have "|f`K| =o r"
     using \<open>regularCard r\<close> \<open>f`K \<subseteq> Field r\<close> unfolding regularCard_def by auto
   moreover have "|f`K| =o |K|" using f(1) K(1)
     by (meson bij_betw_subset card_of_ordIsoI ordIso_symmetric)
   ultimately show "|K| =o s"
     using \<open>s =o r\<close> by (meson ordIso_symmetric ordIso_transitive)
 qed
 
 lemma AboveS_not_empty_in_regularCard:
   assumes "|S| <o r" "S \<subseteq> Field r"
   assumes r: "Card_order r" "regularCard r" "\<not>finite (Field r)"
   shows "AboveS r S \<noteq> {}"
 proof -
   have "\<not>(cofinal S r)"
     using assms not_ordLess_ordIso unfolding regularCard_def by auto
   then obtain a where a: "a \<in> Field r" "\<forall>b\<in>S. \<not>(a \<noteq> b \<and> (a,b) \<in> r)"
     unfolding cofinal_def by auto
   have *: "a = b \<or> (b, a) \<in> r" if "b \<in> S" for b
   proof -
     have "a = b \<or> (a,b) \<notin> r" using a that by auto
     then show ?thesis
       using \<open>Card_order r\<close> \<open>a \<in> Field r\<close> \<open>b \<in> S\<close> \<open>S \<subseteq> Field r\<close> unfolding card_order_on_def well_order_on_def linear_order_on_def total_on_def
       by auto
   qed
   obtain c where "c \<in> Field r" "c \<noteq> a" "(a, c) \<in> r"
     using a(1) r infinite_Card_order_limit by fastforce
   then have "c \<in> AboveS r S"
     unfolding AboveS_def apply simp using Card_order_trans[OF r(1)] by (metis *)
   then show ?thesis by auto
 qed
 
 lemma AboveS_not_empty_in_regularCard':
   assumes "|S| <o r" "f`S \<subseteq> Field r" "T \<subseteq> S"
   assumes r: "Card_order r" "regularCard r" "\<not>finite (Field r)"
   shows "AboveS r (f`T) \<noteq> {}"
 proof -
   have "|f`T| \<le>o |T|" by simp
   moreover have "|T| \<le>o |S|" using \<open>T \<subseteq> S\<close> by simp
   ultimately have *: "|f`T| <o r" using \<open>|S| <o r\<close> by (meson ordLeq_ordLess_trans)
   show ?thesis using AboveS_not_empty_in_regularCard[OF * _ r] \<open>T \<subseteq> S\<close> \<open>f`S \<subseteq> Field r\<close> by auto
 qed
 
 lemma Well_order_extend:
 assumes WELL: "well_order_on A r" and SUB: "A \<subseteq> B"
 shows "\<exists>r'. well_order_on B r' \<and> r \<subseteq> r'"
 proof-
   have r: "Well_order r \<and> Field r = A" using WELL well_order_on_Well_order by blast
   let ?C = "B - A"
   obtain r'' where "well_order_on ?C r''" using well_order_on by blast
   then have r'': "Well_order r'' \<and> Field r'' = ?C"
     using well_order_on_Well_order by blast
   let ?r' = "r Osum r''"
   have "Field r Int Field r'' = {}" using r r'' by auto
   then have "r \<le>o ?r'" using Osum_ordLeq[of r r''] r r'' by blast
   then have "Well_order ?r'" unfolding ordLeq_def by auto
   moreover have "Field ?r' = B" using r r'' SUB by (auto simp add: Field_Osum)
   ultimately have "well_order_on B ?r'" by auto
   moreover have "r \<subseteq> ?r'" by (simp add: Osum_def subrelI)
   ultimately show ?thesis by blast
 qed
 
 text \<open>The next lemma shows that, if the range of a function is endowed with a wellorder,
 then one can pull back this wellorder by the function, and then extend it in the fibers
 of the function in order to keep the wellorder property.
 
 The proof is done by taking an arbitrary family of wellorders on each of the fibers, and using
 the lexicographic order: one has $x < y$ if $f x < f y$, or if $f x = f y$ and, in the corresponding
 fiber of $f$, one has $x < y$.
 
 To formalize it, it is however more efficient to use one single wellorder, and restrict it
 to each fiber.\<close>
 
 lemma Well_order_pullback:
   assumes "Well_order r"
   shows "\<exists>s. Well_order s \<and> Field s = UNIV \<and> (\<forall>x y. (f x, f y) \<in> (r-Id) \<longrightarrow> (x, y) \<in> s)"
 proof -
   obtain r2 where r2: "Well_order r2" "Field r2 = UNIV" "r \<subseteq> r2"
     using Well_order_extend[OF assms, of UNIV] well_order_on_Well_order by auto
   obtain s2 where s2: "Well_order s2" "Field s2 = (UNIV::'b set)"
     by (meson well_ordering)
 
   have r2s2:
     "\<And>x y z. (x, y) \<in> s2 \<Longrightarrow> (y, z) \<in> s2 \<Longrightarrow> (x, z) \<in> s2"
     "\<And>x. (x, x) \<in> s2"
     "\<And>x y. (x, y) \<in> s2 \<or> (y, x) \<in> s2"
     "\<And>x y. (x, y) \<in> s2 \<Longrightarrow> (y, x) \<in> s2 \<Longrightarrow> x = y"
     "\<And>x y z. (x, y) \<in> r2 \<Longrightarrow> (y, z) \<in> r2 \<Longrightarrow> (x, z) \<in> r2"
     "\<And>x. (x, x) \<in> r2"
     "\<And>x y. (x, y) \<in> r2 \<or> (y, x) \<in> r2"
     "\<And>x y. (x, y) \<in> r2 \<Longrightarrow> (y, x) \<in> r2 \<Longrightarrow> x = y"
     using r2 s2 unfolding well_order_on_def linear_order_on_def partial_order_on_def total_on_def preorder_on_def antisym_def refl_on_def trans_def
     by (metis UNIV_I)+
 
   define s where "s = {(x,y). (f x, f y) \<in> r2 \<and> (f x = f y \<longrightarrow> (x, y) \<in> s2)}"
   have "linear_order s"
   unfolding linear_order_on_def partial_order_on_def preorder_on_def
   proof (auto)
     show "total_on UNIV s"
       unfolding s_def apply (rule total_onI, auto) using r2s2 by metis+
     show "refl_on UNIV s"
       unfolding s_def apply (rule refl_onI, auto) using r2s2 by blast+
     show "trans s"
       unfolding s_def apply (rule transI, auto) using r2s2 by metis+
     show "antisym s"
       unfolding s_def apply (rule antisymI, auto) using r2s2 by metis+
   qed
   moreover have "wf (s - Id)"
   proof (rule wfI_min)
     fix x::'b and Q assume "x \<in> Q"
     obtain z' where z': "z' \<in> f`Q" "\<And>y. (y, z') \<in> r2 - Id \<longrightarrow> y \<notin> f`Q"
     proof (rule wfE_min[of "r2-Id" "f x" "f`Q"], auto)
       show "wf(r2-Id)" using \<open>Well_order r2\<close> unfolding well_order_on_def by auto
       show "f x \<in> f`Q" using \<open>x \<in> Q\<close> by auto
     qed
     define Q2 where "Q2 = Q \<inter> f-`{z'}"
     obtain z where z: "z \<in> Q2" "\<And>y. (y, z) \<in> s2 - Id \<longrightarrow> y \<notin> Q2"
     proof (rule wfE_min'[of "s2-Id" "Q2"], auto)
       show "wf(s2-Id)" using \<open>Well_order s2\<close> unfolding well_order_on_def by auto
       assume "Q2 = {}"
       then show False unfolding Q2_def using \<open>z' \<in> f`Q\<close> by blast
     qed
     have "(y, z) \<in> (s-Id) \<Longrightarrow> y \<notin> Q" for y
       unfolding s_def using z' z Q2_def by auto
     then show "\<exists>z\<in>Q. \<forall>y. (y, z) \<in> s - Id \<longrightarrow> y \<notin> Q"
       using \<open>z \<in> Q2\<close> Q2_def by auto
   qed
   ultimately have "well_order_on UNIV s" unfolding well_order_on_def by simp
   moreover have "(f x, f y) \<in> (r-Id) \<longrightarrow> (x, y) \<in> s" for x y
     unfolding s_def using \<open>r \<subseteq> r2\<close> by auto
   ultimately show ?thesis using well_order_on_Well_order by metis
 qed
 
 end (*of theory Library_Complements*)