diff --git a/thys/Independence_CH/Definitions_Main.thy b/thys/Independence_CH/Definitions_Main.thy
--- a/thys/Independence_CH/Definitions_Main.thy
+++ b/thys/Independence_CH/Definitions_Main.thy
@@ -1,640 +1,640 @@
 section\<open>Main definitions of the development\label{sec:main-definitions}\<close>
 
 theory Definitions_Main
   imports
     Absolute_Versions
 begin
 
 text\<open>This theory gathers the main definitions of the
 \<^session>\<open>Transitive_Models\<close> session and the present one.
 
 It might be considered as the bare minimum reading requisite to
 trust that our development indeed formalizes the theory of
 forcing. This should be mathematically clear since this is the
 only known method for obtaining proper extensions of ctms while
 preserving the ordinals.
 
 The main theorem of this session and all of its relevant definitions
 appear in Section~\ref{sec:def-main-forcing}. The reader trusting
 all the libraries on which our development is based, might jump
 directly to Section~\ref{sec:relative-arith}, which treats relative
 cardinal arithmetic as implemented in
 \<^session>\<open>Transitive_Models\<close>. But in case one wants to dive deeper, the
 following sections treat some basic concepts of the ZF logic
 (Section~\ref{sec:def-main-ZF}) and in the
 ZF-Constructible library (Section~\ref{sec:def-main-relative})
 on which our definitions are built.
 \<close>
 
 declare [[show_question_marks=false]]
 
 subsection\<open>ZF\label{sec:def-main-ZF}\<close>
 
 text\<open>For the basic logic ZF we restrict ourselves to just a few
 concepts.\<close>
 
 thm bij_def[unfolded inj_def surj_def]
 text\<open>@{thm [display] bij_def[unfolded inj_def surj_def]}\<close>
 (*
 bij(A, B) \<equiv>
   {f \<in> A \<rightarrow> B . \<forall>w\<in>A. \<forall>x\<in>A. f ` w = f ` x \<longrightarrow> w = x} \<inter>
   {f \<in> A \<rightarrow> B . \<forall>y\<in>B. \<exists>x\<in>A. f ` x = y}
 *)
 
 thm eqpoll_def
 text\<open>@{thm [display] eqpoll_def}\<close>
 (*
   A \<approx> B \<equiv> \<exists>f. f \<in> bij(A, B)
 *)
 
 thm Transset_def
 text\<open>@{thm [display] Transset_def}\<close>
 (*
   Transset(i) \<equiv> \<forall>x\<in>i. x \<subseteq> i
 *)
 
 thm Ord_def
 text\<open>@{thm [display] Ord_def}\<close>
 (*
   Ord(i) \<equiv> Transset(i) \<and> (\<forall>x\<in>i. Transset(x))
 *)
 
 thm lt_def le_iff
 text\<open>@{thm [display] lt_def le_iff}\<close>
 (*
   i < j \<equiv> i \<in> j \<and> Ord(j)
   i \<le> j \<longleftrightarrow> i < j \<or> i = j \<and> Ord(j)
 *)
 
 text\<open>With the concepts of empty set and successor in place,\<close>
 lemma empty_def': "\<forall>x. x \<notin> 0" by simp
 lemma succ_def': "succ(i) = i \<union> {i}" by blast
 
 text\<open>we can define the set of natural numbers \<^term>\<open>\<omega>\<close>. In the
 sources, it is  defined as a fixpoint, but here we just write
 its characterization as the first limit ordinal.\<close>
 thm Limit_nat[unfolded Limit_def] nat_le_Limit[unfolded Limit_def]
 text\<open>@{thm [display] Limit_nat[unfolded Limit_def]
  nat_le_Limit[unfolded Limit_def]}\<close>
 (*
   Ord(\<omega>) \<and> 0 < \<omega> \<and> (\<forall>y. y < \<omega> \<longrightarrow> succ(y) < \<omega>)
   Ord(i) \<and> 0 < i \<and> (\<forall>y. y < i \<longrightarrow> succ(y) < i) \<Longrightarrow> \<omega> \<le> i
 *)
 
 text\<open>Then, addition and predecessor on \<^term>\<open>\<omega>\<close> are inductively
 characterized as follows:\<close>
 thm add_0_right add_succ_right pred_0 pred_succ_eq
 text\<open>@{thm [display] add_succ_right add_0_right pred_0 pred_succ_eq}\<close>
 (*
   m \<in> \<omega> \<Longrightarrow> m +\<^sub>\<omega> 0 = m
   m +\<^sub>\<omega> succ(n) = succ(m +\<^sub>\<omega> n)
 
   pred(0) = 0
   pred(succ(y)) = y
 *)
 
 text\<open>Lists on a set \<^term>\<open>A\<close> can be characterized by being
 recursively generated from the empty list \<^term>\<open>[]\<close> and the
 operation \<^term>\<open>Cons\<close> that adds a new element to the left end;
 the induction theorem for them shows that the characterization is
 “complete”.\<close>
 
 thm Nil Cons list.induct
 text\<open>@{thm [display] Nil Cons list.induct }\<close>
 (*
   [] \<in> list(A)
   a \<in> A \<Longrightarrow> l \<in> list(A) \<Longrightarrow> Cons(a, l) \<in> list(A)
   x \<in> list(A) \<Longrightarrow>
   P([]) \<Longrightarrow> (\<And>a l. a \<in> A \<Longrightarrow> l \<in> list(A) \<Longrightarrow> P(l) \<Longrightarrow> P(Cons(a, l))) \<Longrightarrow> P(x)
 *)
 
 text\<open>Length, concatenation, and \<^term>\<open>n\<close>th element of lists are
 recursively characterized as follows.\<close>
 thm length.simps app.simps nth_0 nth_Cons
 text\<open>@{thm [display] length.simps app.simps nth_0 nth_Cons}\<close>
 (*
   length([]) = 0
   length(Cons(a, l)) = succ(length(l))
 
   [] @ ys = ys
   Cons(a, l) @ ys = Cons(a, l @ ys)
 
   nth(0, Cons(a, l)) = a
   n \<in> \<omega> \<Longrightarrow> nth(succ(n), Cons(a, l)) = nth(n, l)
 *)
 text\<open>We have the usual Haskell-like notation for iterated applications
 of \<^term>\<open>Cons\<close>:\<close>
 lemma Cons_app: "[a,b,c] = Cons(a,Cons(b,Cons(c,[])))" ..
 
 text\<open>Relative quantifiers restrict the range of the bound variable to a
 class \<^term>\<open>M\<close> of type \<^typ>\<open>i\<Rightarrow>o\<close>; that is, a truth-valued function with
 set arguments.\<close>
 lemma "\<forall>x[M]. P(x) \<equiv> \<forall>x. M(x) \<longrightarrow> P(x)"
       "\<exists>x[M]. P(x) \<equiv> \<exists>x. M(x) \<and> P(x)"
   unfolding rall_def rex_def .
 
 text\<open>Finally, a set can be viewed (“cast”) as a class using the
 following function of type \<^typ>\<open>i\<Rightarrow>(i\<Rightarrow>o)\<close>.\<close>
 thm setclass_iff
 text\<open>@{thm [display] setclass_iff}\<close>
 (*
   (##A)(x) \<longleftrightarrow> x \<in> A
 *)
 
 subsection\<open>Relative concepts\label{sec:def-main-relative}\<close>
 text\<open>A list of relative concepts (mostly from the ZF-Constructible
     library) follows next.\<close>
 
 thm big_union_def
 text\<open>@{thm [display] big_union_def}\<close>
 (*
   big_union(M, A, z) \<equiv> \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y \<in> A \<and> x \<in> y)
 *)
 
 thm upair_def
 text\<open>@{thm [display] upair_def}\<close>
 (*
   upair(M, a, b, z) \<equiv> a \<in> z \<and> b \<in> z \<and> (\<forall>x[M]. x \<in> z \<longrightarrow> x = a \<or> x = b)
 *)
 
 thm pair_def
 text\<open>@{thm [display] pair_def}\<close>
 (*
   pair(M, a, b, z) \<equiv> \<exists>x[M]. upair(M, a, a, x) \<and>
                         (\<exists>y[M]. upair(M, a, b, y) \<and> upair(M, x, y, z))
 *)
 
 thm successor_def[unfolded is_cons_def union_def]
 text\<open>@{thm [display] successor_def[unfolded is_cons_def union_def]}\<close>
 (*
   successor(M, a, z) \<equiv> \<exists>x[M]. upair(M, a, a, x) \<and> (\<forall>xa[M]. xa \<in> z \<longleftrightarrow> xa \<in> x \<or> xa \<in> a)
 *)
 
 thm empty_def
 text\<open>@{thm [display] empty_def}\<close>
 (*
   empty(M, z) \<equiv> \<forall>x[M]. x \<notin> z
 *)
 
 thm transitive_set_def[unfolded subset_def]
 text\<open>@{thm [display] transitive_set_def[unfolded subset_def]}\<close>
 (*
   transitive_set(M, a) \<equiv> \<forall>x[M]. x \<in> a \<longrightarrow> (\<forall>xa[M]. xa \<in> x \<longrightarrow> xa \<in> a)
 *)
 
 
 thm ordinal_def
 text\<open>@{thm [display] ordinal_def}\<close>
 (*
   ordinal(M, a) \<equiv> transitive_set(M, a) \<and> (\<forall>x[M]. x \<in> a \<longrightarrow>
                                               transitive_set(M, x))
 *)
 
 thm image_def
 text\<open>@{thm [display] image_def}\<close>
 (*
   image(M, r, A, z) \<equiv> \<forall>y[M]. y \<in> z \<longleftrightarrow>
                 (\<exists>w[M]. w \<in> r \<and> (\<exists>x[M]. x \<in> A \<and> pair(M, x, y, w)))
 *)
 
 thm fun_apply_def
 text\<open>@{thm [display] fun_apply_def}\<close>
 (*
   fun_apply(M, f, x, y) \<equiv> \<exists>xs[M]. \<exists>fxs[M]. upair(M, x, x, xs) \<and>
                        image(M, f, xs, fxs) \<and> big_union(M, fxs, y)
 *)
 
 thm is_function_def
 text\<open>@{thm [display] is_function_def}\<close>
 (*
   is_function(M, r) \<equiv> \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
        pair(M, x, y, p) \<longrightarrow> pair(M, x, y', p') \<longrightarrow> p \<in> r \<longrightarrow> p' \<in> r \<longrightarrow> y = y'
 *)
 
 thm is_relation_def
 text\<open>@{thm [display] is_relation_def}\<close>
 (*
   is_relation(M, r) \<equiv> \<forall>z[M]. z \<in> r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M, x, y, z))
 *)
 
 thm is_domain_def
 text\<open>@{thm [display] is_domain_def}\<close>
 (*
   is_domain(M, r, z) \<equiv> \<forall>x[M]. x \<in> z \<longleftrightarrow>
                         (\<exists>w[M]. w \<in> r \<and> (\<exists>y[M]. pair(M, x, y, w)))
 *)
 
 thm typed_function_def
 text\<open>@{thm [display] typed_function_def}\<close>
 (*
   typed_function(M, A, B, r) \<equiv> is_function(M, r) \<and> is_relation(M, r) \<and>
                                 is_domain(M, r, A) \<and>
             (\<forall>u[M]. u \<in> r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M, x, y, u) \<longrightarrow> y \<in> B))
 *)
 
 thm is_function_space_def[unfolded is_funspace_def]
   function_space_rel_def surjection_def
 text\<open>@{thm [display] is_function_space_def[unfolded is_funspace_def]
   function_space_rel_def surjection_def}\<close>
 (*
   is_function_space(M, A, B, fs) \<equiv>
   M(fs) \<and> (\<forall>f[M]. f \<in> fs \<longleftrightarrow> typed_function(M, A, B, f))
 
   A \<rightarrow>\<^bsup>M\<^esup> B \<equiv> THE d. is_function_space(M, A, B, d)
 
   surjection(M, A, B, f) \<equiv>
   typed_function(M, A, B, f) \<and>
   (\<forall>y[M]. y \<in> B \<longrightarrow> (\<exists>x[M]. x \<in> A \<and> is_apply(M, f, x, y)))
 *)
 
 
 text\<open>Relative version of the $\ZFC$ axioms\<close>
 thm extensionality_def
 text\<open>@{thm [display] extensionality_def}\<close>
 (*
   extensionality(M) \<equiv> \<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x \<longleftrightarrow> z \<in> y) \<longrightarrow> x = y
 *)
 
 thm foundation_ax_def
 text\<open>@{thm [display] foundation_ax_def}\<close>
 (*
   foundation_ax(M) \<equiv> \<forall>x[M]. (\<exists>y[M]. y \<in> x) \<longrightarrow> (\<exists>y[M]. y \<in> x \<and> \<not> (\<exists>z[M]. z \<in> x \<and> z \<in> y))
 *)
 
 thm upair_ax_def
 text\<open>@{thm [display] upair_ax_def}\<close>
 (*
   upair_ax(M) \<equiv> \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M, x, y, z)
 *)
 
 thm Union_ax_def
 text\<open>@{thm [display] Union_ax_def}\<close>
 (*
   Union_ax(M) \<equiv> \<forall>x[M]. \<exists>z[M]. \<forall>xa[M]. xa \<in> z \<longleftrightarrow> (\<exists>y[M]. y \<in> x \<and> xa \<in> y)
 *)
 
 thm power_ax_def[unfolded powerset_def subset_def]
 text\<open>@{thm [display] power_ax_def[unfolded powerset_def subset_def]}\<close>
 (*
   power_ax(M) \<equiv> \<forall>x[M]. \<exists>z[M]. \<forall>xa[M]. xa \<in> z \<longleftrightarrow> (\<forall>xb[M]. xb \<in> xa \<longrightarrow> xb \<in> x)
 *)
 
 thm infinity_ax_def
 text\<open>@{thm [display] infinity_ax_def}\<close>
 (*
   infinity_ax(M) \<equiv> \<exists>I[M]. (\<exists>z[M]. empty(M, z) \<and> z \<in> I) \<and> (\<forall>y[M]. y \<in> I \<longrightarrow>
                         (\<exists>sy[M]. successor(M, y, sy) \<and> sy \<in> I))
 *)
 
 thm choice_ax_def
 text\<open>@{thm [display] choice_ax_def}\<close>
 (*
   choice_ax(M) \<equiv> \<forall>x[M]. \<exists>a[M]. \<exists>f[M]. ordinal(M, a) \<and> surjection(M, a, x, f)
 *)
 
 thm separation_def
 text\<open>@{thm [display] separation_def}\<close>
 (*
   separation(M, P) \<equiv> \<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z \<and> P(x)
 *)
 
 thm univalent_def
 text\<open>@{thm [display] univalent_def}\<close>
 (*
   univalent(M, A, P) \<equiv> \<forall>x[M]. x \<in> A \<longrightarrow>
                           (\<forall>y[M]. \<forall>z[M]. P(x, y) \<and> P(x, z) \<longrightarrow> y = z)
 *)
 
 thm strong_replacement_def
 text\<open>@{thm [display] strong_replacement_def}\<close>
 (*
   strong_replacement(M, P) \<equiv> \<forall>A[M]. univalent(M, A, P) \<longrightarrow>
        (\<exists>Y[M]. \<forall>b[M]. b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x \<in> A \<and> P(x, b)))
 *)
 
 text\<open>Internalized formulas\<close>
 
 text\<open>“Codes” for formulas (as sets) are constructed from natural
 numbers using \<^term>\<open>Member\<close>, \<^term>\<open>Equal\<close>, \<^term>\<open>Nand\<close>,
 and \<^term>\<open>Forall\<close>.\<close>
 
 thm Member Equal Nand Forall formula.induct
 text\<open>@{thm [display] Member Equal Nand Forall formula.induct}\<close>
 (*
   x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> \<cdot>x \<in> y\<cdot> \<in> formula
   x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> \<cdot>x = y\<cdot> \<in> formula
   p \<in> formula \<Longrightarrow> q \<in> formula \<Longrightarrow> \<cdot>\<not>(p \<and> q)\<cdot> \<in> formula
   p \<in> formula \<Longrightarrow> (\<forall>p) \<in> formula
 
   x \<in> formula \<Longrightarrow>
   (\<And>x y. x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> P(\<cdot>x \<in> y\<cdot>)) \<Longrightarrow>
   (\<And>x y. x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> P(\<cdot>x = y\<cdot>)) \<Longrightarrow>
   (\<And>p q. p \<in> formula \<Longrightarrow> P(p) \<Longrightarrow> q \<in> formula \<Longrightarrow> P(q) \<Longrightarrow> P(\<cdot>\<not>(p \<and> q)\<cdot>)) \<Longrightarrow>
   (\<And>p. p \<in> formula \<Longrightarrow> P(p) \<Longrightarrow> P((\<forall>p))) \<Longrightarrow> P(x)
 *)
 
 text\<open>Definitions for the other connectives and the internal existential
 quantifier are also provided. For instance, negation:\<close>
 thm Neg_def
 text\<open>@{thm [display] Neg_def}\<close>
 (*
   \<cdot>\<not>p\<cdot> \<equiv> \<cdot>\<not>(p \<and> p)\<cdot>
 *)
 
 thm arity.simps
 text\<open>@{thm [display] arity.simps}\<close>
 (*
   arity(\<cdot>x \<in> y\<cdot>) = succ(x) \<union> succ(y)
   arity(\<cdot>x = y\<cdot>) = succ(x) \<union> succ(y)
   arity(\<cdot>\<not>(p \<and> q)\<cdot>) = arity(p) \<union> arity(q)
   arity((\<forall>p)) = pred(arity(p))
 *)
 
 text\<open>We have the satisfaction relation between $\in$-models and
     first order formulas (given a “environment” list representing
     the assignment of free variables),\<close>
 thm mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff
 text\<open>@{thm [display] mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff}\<close>
 (*
   nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> env \<in> list(A) \<Longrightarrow> x \<in> y \<longleftrightarrow> A, env \<Turnstile> \<cdot>i \<in> j\<cdot>
   nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> env \<in> list(A) \<Longrightarrow> x = y \<longleftrightarrow> A, env \<Turnstile> \<cdot>i = j\<cdot>
   env \<in> list(A) \<Longrightarrow> (A, env \<Turnstile> \<cdot>\<not>(p \<and> q)\<cdot>) \<longleftrightarrow> \<not> ((A, env \<Turnstile> p) \<and> (A, env \<Turnstile> q))
   env \<in> list(A) \<Longrightarrow> (A, env \<Turnstile> (\<cdot>\<forall>p\<cdot>)) \<longleftrightarrow> (\<forall>x\<in>A. A, Cons(x, env) \<Turnstile> p)*)
 
 text\<open>as well as the satisfaction of an arbitrary set of sentences.\<close>
 thm satT_def
 text\<open>@{thm [display] satT_def}\<close>
 (*
   A \<Turnstile> \<Phi>  \<equiv>  \<forall>\<phi>\<in>\<Phi>. A, [] \<Turnstile> \<phi>
 *)
 
 text\<open>The internalized (viz. as elements of the set \<^term>\<open>formula\<close>)
     version of the axioms follow next.\<close>
 
 thm ZF_union_iff_sats ZF_power_iff_sats ZF_pairing_iff_sats
   ZF_foundation_iff_sats ZF_extensionality_iff_sats
   ZF_infinity_iff_sats sats_ZF_separation_fm_iff
   sats_ZF_replacement_fm_iff ZF_choice_iff_sats
 text\<open>@{thm [display] ZF_union_iff_sats ZF_power_iff_sats
   ZF_pairing_iff_sats
   ZF_foundation_iff_sats ZF_extensionality_iff_sats
   ZF_infinity_iff_sats sats_ZF_separation_fm_iff
   sats_ZF_replacement_fm_iff ZF_choice_iff_sats}\<close>
 (*
   Union_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Union Ax\<cdot>
   power_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Powerset Ax\<cdot>
   upair_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Pairing\<cdot>
   foundation_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Foundation\<cdot>
   extensionality(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Extensionality\<cdot>
   infinity_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Infinity\<cdot>
 
   \<phi> \<in> formula \<Longrightarrow>
   (M, [] \<Turnstile> \<cdot>Separation(\<phi>)\<cdot>) \<longleftrightarrow>
   (\<forall>env\<in>list(M).
       arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<longrightarrow> separation(##M, \<lambda>x. M, [x] @ env \<Turnstile> \<phi>))
 
   \<phi> \<in> formula \<Longrightarrow>
   (M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>) \<longleftrightarrow> (\<forall>env. replacement_assm(M, env, \<phi>))
 
   choice_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>AC\<cdot>
 *)
 
 text\<open>Above, we use the following:\<close>
 
 thm replacement_assm_def
 text\<open>@{thm [display] replacement_assm_def}\<close>
 (*
 replacement_assm(M, env, \<phi>) \<equiv>
 \<phi> \<in> formula \<longrightarrow>
 env \<in> list(M) \<longrightarrow>
 arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
 strong_replacement(##M, \<lambda>x y. M, [x, y] @ env \<Turnstile> \<phi>
 *)
 
 text\<open>Finally, the axiom sets are defined as follows.\<close>
 
 thm ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def ZFC_def
 text\<open>@{thm [display] ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def
   ZFC_def}\<close>
 (*
   ZF_fin \<equiv> {\<cdot>Extensionality\<cdot>, \<cdot>Foundation\<cdot>, \<cdot>Pairing\<cdot>, \<cdot>Union Ax\<cdot>, \<cdot>Infinity\<cdot>, \<cdot>Powerset Ax\<cdot>}
   ZF_schemes \<equiv> {\<cdot>Separation(p)\<cdot> . p \<in> formula} \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> formula}
   \<cdot>Z\<cdot> \<equiv> ZF_fin \<union> {\<cdot>Separation(p)\<cdot> . p \<in> formula}
   ZC \<equiv> \<cdot>Z\<cdot> \<union> {\<cdot>AC\<cdot>}
   ZF \<equiv> ZF_schemes \<union> ZF_fin
   ZFC \<equiv> ZF \<union> {\<cdot>AC\<cdot>}
 *)
 
 subsection\<open>Relativization of infinitary arithmetic\label{sec:relative-arith}\<close>
 
 text\<open>In order to state the defining property of the relative
     equipotence relation, we work under the assumptions of the
     locale \<^term>\<open>M_cardinals\<close>. They comprise a finite set
     of instances of Separation and Replacement to prove
     closure properties of the transitive class \<^term>\<open>M\<close>.\<close>
 
 lemma (in M_cardinals) eqpoll_def':
   assumes "M(A)" "M(B)" shows "A \<approx>\<^bsup>M\<^esup> B \<longleftrightarrow> (\<exists>f[M]. f \<in> bij(A,B))"
   using assms unfolding eqpoll_rel_def by auto
 
 text\<open>Below, $\mu$ denotes the minimum operator on the ordinals.\<close>
 lemma cardinalities_defs:
   fixes M::"i\<Rightarrow>o"
   shows
     "|A|\<^bsup>M\<^esup> \<equiv> \<mu> i. M(i) \<and> i \<approx>\<^bsup>M\<^esup> A"
     "Card\<^bsup>M\<^esup>(\<alpha>) \<equiv> \<alpha> = |\<alpha>|\<^bsup>M\<^esup>"
     "\<kappa>\<^bsup>\<up>\<nu>,M\<^esup> \<equiv> |\<nu> \<rightarrow>\<^bsup>M\<^esup> \<kappa>|\<^bsup>M\<^esup>"
     "(\<kappa>\<^sup>+)\<^bsup>M\<^esup> \<equiv> \<mu> x. M(x) \<and> Card\<^bsup>M\<^esup>(x) \<and> \<kappa> < x"
   unfolding cardinal_rel_def cexp_rel_def
     csucc_rel_def Card_rel_def .
 
 context M_aleph
 begin
 
 text\<open>Analogous to the previous Lemma @{thm [source] eqpoll_def'}, we are now under
     the assumptions of the locale \<^term>\<open>M_aleph\<close>. The axiom instances
     included are sufficient to state and prove the defining
     properties of the relativized \<^term>\<open>Aleph\<close> function
     (in particular, the required ability to perform transfinite recursions).\<close>
 
 thm Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit
 text\<open>@{thm [display] Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit}\<close>
 (*
   \<aleph>\<^bsub>0\<^esub>\<^bsup>M\<^esup> = \<omega>
   Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>succ(\<alpha>)\<^esub>\<^bsup>M\<^esup> = (\<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup>\<^sup>+)\<^bsup>M\<^esup>
   Limit(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup> = (\<Union>j\<in>\<alpha>. \<aleph>\<^bsub>j\<^esub>\<^bsup>M\<^esup>)
 *)
 
 end \<comment> \<open>\<^locale>\<open>M_aleph\<close>\<close>
 
 lemma ContHyp_rel_def':
   fixes N::"i\<Rightarrow>o"
   shows
     "CH\<^bsup>N\<^esup> \<equiv> \<aleph>\<^bsub>1\<^esub>\<^bsup>N\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>N\<^esup>,N\<^esup>"
   unfolding ContHyp_rel_def .
 
 text\<open>Under appropriate hypotheses (this time, from the locale \<^term>\<open>M_ZF_library\<close>),
    \<^term>\<open>CH\<^bsup>M\<^esup>\<close> is equivalent to its fully relational version \<^term>\<open>is_ContHyp\<close>.
     As a sanity check, we see that if the transitive class is indeed \<^term>\<open>\<V>\<close>,
     we recover the original $\CH$.\<close>
 
 thm M_ZF_library.is_ContHyp_iff is_ContHyp_iff_CH[unfolded ContHyp_def]
 text\<open>@{thm [display] M_ZF_library.is_ContHyp_iff
     is_ContHyp_iff_CH[unfolded ContHyp_def]}\<close>
 (*
   M_ZF_library(M) \<Longrightarrow> is_ContHyp(M) \<longleftrightarrow> CH\<^bsup>M\<^esup>
   is_ContHyp(\<V>) \<longleftrightarrow> \<aleph>\<^bsub>1\<^esub> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^esup>
 *)
 
 text\<open>In turn, the fully relational version evaluated on a nonempty
     transitive \<^term>\<open>A\<close> is equivalent to the satisfaction of the
     first-order formula \<^term>\<open>\<cdot>CH\<cdot>\<close>.\<close>
 thm is_ContHyp_iff_sats
 text\<open>@{thm [display] is_ContHyp_iff_sats}\<close>
 (*
   env \<in> list(A) \<Longrightarrow> 0 \<in> A \<Longrightarrow> is_ContHyp(##A) \<longleftrightarrow> A, env \<Turnstile> \<cdot>CH\<cdot>
 *)
 
 
 subsection\<open>Forcing \label{sec:def-main-forcing}\<close>
 
 text\<open>Our first milestone was to obtain a proper extension using forcing.
 Its original proof didn't required the previous developments involving
 the relativization of material on cardinal arithmetic. Now it is
 derived from a stronger result, namely @{thm [source] extensions_of_ctms}
 below.\<close>
 
 thm extensions_of_ctms_ZF
 text\<open>@{thm [display] extensions_of_ctms_ZF}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZF \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZF \<and> M \<noteq> N \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N) \<and> ((M, [] \<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC)
 *)
 
 text\<open>We can finally state our main results, namely, the existence of models
 for $\ZFC + \CH$ and $\ZFC + \neg\CH$ under the assumption of a ctm of $\ZFC$.\<close>
 
 thm ctm_ZFC_imp_ctm_not_CH
 text\<open>@{thm [display] ctm_ZFC_imp_ctm_not_CH}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZFC \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 thm ctm_ZFC_imp_ctm_CH
 text\<open>@{thm [display] ctm_ZFC_imp_ctm_CH}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZFC \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and>
       N \<approx> \<omega> \<and>
       Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>CH\<cdot>} \<and> (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 text\<open>These results can be strengthened by enumerating six finite sets of
 replacement instances which are sufficient to develop forcing and for
 the construction of the aforementioned models: \<^term>\<open>instances1_fms\<close>
 through \<^term>\<open>instances3_fms\<close>, \<^term>\<open>instances_ground_fms\<close>, and
 \<^term>\<open>instances_ground_notCH_fms\<close>,
 which are then collected into the $31$-element set \<^term>\<open>overhead_notCH\<close>.
 For example, we have:\<close>
 
 thm instances1_fms_def
 text\<open>@{thm [display] instances1_fms_def}\<close>
 (*
 instances1_fms \<equiv>
-{ eclose_repl1_intf_fm, eclose_repl2_intf_fm,
-  wfrec_rank_fm, trans_repl_HVFrom_fm }
+{ eclose_closed_fm, eclose_abs_fm,
+  wfrec_rank_fm, transrec_VFrom_fm }
 *)
 
 thm overhead_def overhead_notCH_def
 text\<open>@{thm [display] overhead_def overhead_notCH_def overhead_CH_def}\<close>
 (*
   overhead \<equiv> instances1_fms \<union> instances_ground_fms
 
   overhead_notCH \<equiv> overhead \<union>
     instances2_fms \<union> instances3_fms \<union> instances_ground_notCH_fms
 *)
 
 text\<open>One further instance is needed to force $\CH$, with a total count
 of $32$ instances:\<close>
 thm overhead_CH_def
 text\<open>@{thm [display] overhead_CH_def}\<close>
 (*
-  overhead_CH \<equiv> overhead_notCH \<union> {replacement_dcwit_repl_body_fm}
+  overhead_CH \<equiv> overhead_notCH \<union> {dc_abs_fm}
 *)
 
 thm extensions_of_ctms
 text\<open>@{thm [display] extensions_of_ctms}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     M \<noteq> N \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N) \<and>
     ((M, [] \<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}
 *)
 
 thm ctm_of_not_CH
 text\<open>@{thm [display] ctm_of_not_CH}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     N \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 thm ctm_of_CH
 text\<open>@{thm [display] ctm_of_CH}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     N \<Turnstile> ZC \<union> {\<cdot>CH\<cdot>} \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 text\<open>In the above three statements, the function \<^term>\<open>ground_repl_fm\<close>
 takes an element \<^term>\<open>\<phi>\<close> of \<^term>\<open>formula\<close> and returns the
 replacement instance in the ground model that produces the
 \<^term>\<open>\<phi>\<close>-replacement instance in the generic extension. The next
 result is stated in the context \<^locale>\<open>G_generic1\<close>, which assumes
 the existence of a generic filter.\<close>
 
 context G_generic1
 begin
 
 thm sats_ground_repl_fm_imp_sats_ZF_replacement_fm
 text\<open>@{thm [display] sats_ground_repl_fm_imp_sats_ZF_replacement_fm}\<close>
 (*
   \<phi> \<in> formula \<Longrightarrow>
   M, [] \<Turnstile> \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> \<Longrightarrow> M[G], [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>
 *)
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Fm_Definitions.thy b/thys/Independence_CH/Fm_Definitions.thy
--- a/thys/Independence_CH/Fm_Definitions.thy
+++ b/thys/Independence_CH/Fm_Definitions.thy
@@ -1,1011 +1,1011 @@
 section\<open>Concepts involved in instances of Replacement\<close>
 theory Fm_Definitions
   imports
     Transitive_Models.Renaming_Auto
     Transitive_Models.Aleph_Relative
     FrecR_Arities
 begin
 
 (* Really, I have no idea why is this needed again. At the end of the
    imported theories, notation works just fine. *)
 no_notation Aleph (\<open>\<aleph>_\<close> [90] 90)
 
 text\<open>In this theory we put every concept that should be synthesized in a formula
 to have an instance of replacement.
 
 The automatic synthesis of a concept /foo/ requires that every concept used to
 define /foo/ is already synthesized. We try to use our meta-programs to synthesize
 concepts: given the absolute concept /foo/ we relativize in relational form
 obtaining /is\_foo/ and the we synthesize the formula /is\_foo\_fm/.
 The meta-program that synthesizes formulas also produce satisfactions lemmas.
 
 Having one file to collect every formula needed for replacements breaks
 the reading flow: we need to introduce the concept in this theory in order
 to use the meta-programs; moreover there are some concepts for which we prove
 here the satisfaction lemmas manually, while for others we prove them
 on its theory.
 \<close>
 
 declare arity_subset_fm [simp del] arity_ordinal_fm[simp del, arity] arity_transset_fm[simp del]
   FOL_arities[simp del]
 
 synthesize "setdiff" from_definition "setdiff" assuming "nonempty"
 arity_theorem for "setdiff_fm"
 
 synthesize "is_converse" from_definition assuming "nonempty"
 arity_theorem for "is_converse_fm"
 
 relationalize "first_rel" "is_first" external
 synthesize "first_fm" from_definition "is_first" assuming "nonempty"
 
 relationalize "minimum_rel" "is_minimum" external
 definition is_minimum' where
   "is_minimum'(M,R,X,u) \<equiv> (M(u) \<and> u \<in> X \<and> (\<forall>v[M]. \<exists>a[M]. (v \<in> X \<longrightarrow> v \<noteq> u \<longrightarrow> a \<in> R) \<and> pair(M, u, v, a))) \<and>
     (\<exists>x[M].
         (M(x) \<and> x \<in> X \<and> (\<forall>v[M]. \<exists>a[M]. (v \<in> X \<longrightarrow> v \<noteq> x \<longrightarrow> a \<in> R) \<and> pair(M, x, v, a))) \<and>
         (\<forall>y[M]. M(y) \<and> y \<in> X \<and> (\<forall>v[M]. \<exists>a[M]. (v \<in> X \<longrightarrow> v \<noteq> y \<longrightarrow> a \<in> R) \<and> pair(M, y, v, a)) \<longrightarrow> y = x)) \<or>
     \<not> (\<exists>x[M]. (M(x) \<and> x \<in> X \<and> (\<forall>v[M]. \<exists>a[M]. (v \<in> X \<longrightarrow> v \<noteq> x \<longrightarrow> a \<in> R) \<and> pair(M, x, v, a))) \<and>
                (\<forall>y[M]. M(y) \<and> y \<in> X \<and> (\<forall>v[M]. \<exists>a[M]. (v \<in> X \<longrightarrow> v \<noteq> y \<longrightarrow> a \<in> R) \<and> pair(M, y, v, a)) \<longrightarrow> y = x)) \<and>
     empty(M, u)"
 
 synthesize "minimum" from_definition "is_minimum'" assuming "nonempty"
 arity_theorem for "minimum_fm"
 
 lemma is_lambda_iff_sats[iff_sats]:
   assumes is_F_iff_sats:
     "!!a0 a1 a2.
         [|a0\<in>Aa; a1\<in>Aa; a2\<in>Aa|]
         ==> is_F(a1, a0) \<longleftrightarrow> sats(Aa, is_F_fm, Cons(a0,Cons(a1,Cons(a2,env))))"
   shows
     "nth(A, env) = Ab \<Longrightarrow>
     nth(r, env) = ra \<Longrightarrow>
     A \<in> nat \<Longrightarrow>
     r \<in> nat \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     is_lambda(##Aa, Ab, is_F, ra) \<longleftrightarrow> Aa, env \<Turnstile> lambda_fm(is_F_fm,A, r)"
   using sats_lambda_fm[OF assms, of A r] by simp
 
 \<comment> \<open>same as @{thm [source] sats_is_wfrec_fm}, but changing length assumptions to
     \<^term>\<open>0\<close> being in the model\<close>
 lemma sats_is_wfrec_fm':
   assumes MH_iff_sats:
     "!!a0 a1 a2 a3 a4.
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A|]
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
   shows
     "[|x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A); 0 \<in> A|]
        ==> sats(A, is_wfrec_fm(p,x,y,z), env) \<longleftrightarrow>
            is_wfrec(##A, MH, nth(x,env), nth(y,env), nth(z,env))"
   using MH_iff_sats [THEN iff_sym] nth_closed sats_is_recfun_fm
   by (simp add: is_wfrec_fm_def is_wfrec_def) blast
 
 lemma is_wfrec_iff_sats'[iff_sats]:
   assumes MH_iff_sats:
     "!!a0 a1 a2 a3 a4.
         [|a0\<in>Aa; a1\<in>Aa; a2\<in>Aa; a3\<in>Aa; a4\<in>Aa|]
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(Aa, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
     "nth(x, env) = xx" "nth(y, env) = yy" "nth(z, env) = zz"
     "x \<in> nat" "y \<in> nat" "z \<in> nat" "env \<in> list(Aa)" "0 \<in> Aa"
   shows
     "is_wfrec(##Aa, MH, xx, yy, zz) \<longleftrightarrow> Aa, env \<Turnstile> is_wfrec_fm(p,x,y,z)"
   using assms(2-4) sats_is_wfrec_fm'[OF assms(1,5-9)] by simp
 
 lemma is_wfrec_on_iff_sats[iff_sats]:
   assumes MH_iff_sats:
     "!!a0 a1 a2 a3 a4.
         [|a0\<in>Aa; a1\<in>Aa; a2\<in>Aa; a3\<in>Aa; a4\<in>Aa|]
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(Aa, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
   shows
     "nth(x, env) = xx \<Longrightarrow>
     nth(y, env) = yy \<Longrightarrow>
     nth(z, env) = zz \<Longrightarrow>
     x \<in> nat \<Longrightarrow>
     y \<in> nat \<Longrightarrow>
     z \<in> nat \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow> is_wfrec_on(##Aa, MH, aa,xx, yy, zz) \<longleftrightarrow> Aa, env \<Turnstile> is_wfrec_fm(p,x,y,z)"
   using assms sats_is_wfrec_fm'[OF assms] unfolding is_wfrec_on_def by simp
 
 text\<open>Formulas for particular replacement instances\<close>
 
 text\<open>Now we introduce some definitions used in the definition of check; which
 is defined by well-founded recursion using replacement in the recursive call.\<close>
 
 \<comment> \<open>The well-founded relation for defining check.\<close>
 definition
   rcheck :: "i \<Rightarrow> i" where
   "rcheck(x) \<equiv> Memrel(eclose({x}))^+"
 
 relativize "rcheck" "is_rcheck"
 synthesize "is_rcheck" from_definition
 arity_theorem for "is_rcheck_fm"
 
 \<comment> \<open>The function used for the replacement.\<close>
 definition
   PHcheck :: "[i\<Rightarrow>o,i,i,i,i] \<Rightarrow> o" where
   "PHcheck(M,o,f,y,p) \<equiv> M(p) \<and> (\<exists>fy[M]. fun_apply(M,f,y,fy) \<and> pair(M,fy,o,p))"
 
 synthesize "PHcheck" from_definition assuming "nonempty"
 arity_theorem for "PHcheck_fm"
 
 \<comment> \<open>The recursive call for check. We could use the meta-program relationalize for
 this; but it makes some proofs more involved.\<close>
 definition
   is_Hcheck :: "[i\<Rightarrow>o,i,i,i,i] \<Rightarrow> o" where
   "is_Hcheck(M,o,z,f,hc)  \<equiv> is_Replace(M,z,PHcheck(M,o,f),hc)"
 
 synthesize "is_Hcheck" from_definition assuming "nonempty"
 
 lemma arity_is_Hcheck_fm:
   assumes "m\<in>nat" "n\<in>nat" "p\<in>nat" "o\<in>nat"
   shows "arity(is_Hcheck_fm(m,n,p,o)) = succ(o) \<union> succ(n) \<union> succ(p) \<union> succ(m) "
   unfolding is_Hcheck_fm_def
   using assms arity_Replace_fm[rule_format,OF PHcheck_fm_type _ _ _ arity_PHcheck_fm]
     pred_Un_distrib Un_assoc Un_nat_type
   by simp
 
 \<comment> \<open>The relational version of check is hand-made because our automatic tool
 does not handle \<^term>\<open>wfrec\<close>.\<close>
 definition
   is_check :: "[i\<Rightarrow>o,i,i,i] \<Rightarrow> o" where
   "is_check(M,o,x,z) \<equiv> \<exists>rch[M]. is_rcheck(M,x,rch) \<and>
       is_wfrec(M,is_Hcheck(M,o),rch,x,z)"
 
 \<comment> \<open>Finally, we internalize the formula.\<close>
 definition
   check_fm :: "[i,i,i] \<Rightarrow> i" where
   "check_fm(o,x,z) \<equiv> Exists(And(is_rcheck_fm(1+\<^sub>\<omega>x,0),
                       is_wfrec_fm(is_Hcheck_fm(6+\<^sub>\<omega>o,2,1,0),0,1+\<^sub>\<omega>x,1+\<^sub>\<omega>z)))"
 
 lemma check_fm_type[TC]: "x\<in>nat \<Longrightarrow> o\<in>nat \<Longrightarrow> z\<in>nat \<Longrightarrow> check_fm(x,o,z) \<in> formula"
   by (simp add:check_fm_def)
 
 lemma sats_check_fm :
   assumes
     "o\<in>nat" "x\<in>nat" "z\<in>nat" "env\<in>list(M)" "0\<in>M"
   shows
     "(M , env \<Turnstile> check_fm(o,x,z)) \<longleftrightarrow> is_check(##M,nth(o,env),nth(x,env),nth(z,env))"
 proof -
   have sats_is_Hcheck_fm:
     "\<And>a0 a1 a2 a3 a4 a6. \<lbrakk> a0\<in>M; a1\<in>M; a2\<in>M; a3\<in>M; a4\<in>M;a6 \<in>M\<rbrakk> \<Longrightarrow>
          is_Hcheck(##M,a6,a2, a1, a0) \<longleftrightarrow>
          (M , [a0,a1,a2,a3,a4,r,a6]@env \<Turnstile> is_Hcheck_fm(6,2,1,0))" if "r\<in>M" for r
     using that assms
     by simp
   then
   have "(M , [r]@env \<Turnstile> is_wfrec_fm(is_Hcheck_fm(6+\<^sub>\<omega>o,2,1,0),0,1+\<^sub>\<omega>x,1+\<^sub>\<omega>z))
         \<longleftrightarrow> is_wfrec(##M,is_Hcheck(##M,nth(o,env)),r,nth(x,env),nth(z,env))"
     if "r\<in>M" for r
     using that assms is_wfrec_iff_sats'[symmetric]
     by simp
   then
   show ?thesis
     unfolding is_check_def check_fm_def
     using assms is_rcheck_iff_sats[symmetric]
     by simp
 qed
 
 lemma iff_sats_check_fm[iff_sats] :
   assumes
     "nth(o, env) = oa" "nth(x, env) = xa" "nth(z, env) = za" "o \<in> nat" "x \<in> nat" "z \<in> nat" "env \<in> list(A)" "0 \<in> A"
   shows "is_check(##A, oa,xa, za) \<longleftrightarrow> A, env \<Turnstile> check_fm(o,x,z)"
   using assms sats_check_fm[symmetric]
   by auto
 
 lemma arity_check_fm[arity]:
   assumes "m\<in>nat" "n\<in>nat" "o\<in>nat"
   shows "arity(check_fm(m,n,o)) = succ(o) \<union> succ(n) \<union> succ(m) "
   unfolding check_fm_def
   using assms arity_is_wfrec_fm[rule_format,OF _ _ _ _ _ arity_is_Hcheck_fm]
     pred_Un_distrib Un_assoc arity_tran_closure_fm
   by (auto simp add:arity)
 
 notation check_fm (\<open>\<cdot>_\<^sup>v_ is _\<cdot>\<close>)
 
 \<comment> \<open>The pair of elements belongs to some set. The intended set is the preorder.\<close>
 definition
   is_leq :: "[i\<Rightarrow>o,i,i,i] \<Rightarrow> o" where
   "is_leq(A,l,q,p) \<equiv> \<exists>qp[A]. (pair(A,q,p,qp) \<and> qp\<in>l)"
 
 synthesize "is_leq" from_definition assuming "nonempty"
 arity_theorem for "is_leq_fm"
 
 abbreviation
   fm_leq :: "[i,i,i] \<Rightarrow> i" (\<open>\<cdot>_\<preceq>\<^bsup>_\<^esup>_\<cdot>\<close>) where
   "fm_leq(A,l,B) \<equiv> is_leq_fm(l,A,B)"
 
 subsection\<open>Formulas used to prove some generic instances.\<close>
 
 definition \<rho>_repl :: "i\<Rightarrow>i" where
   "\<rho>_repl(l) \<equiv> rsum({\<langle>0, 1\<rangle>, \<langle>1, 0\<rangle>}, id(l), 2, 3, l)"
 
 lemma f_type : "{\<langle>0, 1\<rangle>, \<langle>1, 0\<rangle>} \<in> 2 \<rightarrow> 3"
   using Pi_iff unfolding function_def by auto
 
 \<comment> \<open>thm\<open>Internalize.sum_type\<close> clashes with thm\<open>Renaming.sum_type\<close>.\<close>
 hide_fact Internalize.sum_type
 
 lemma ren_type :
   assumes "l\<in>nat"
   shows "\<rho>_repl(l) : 2+\<^sub>\<omega>l \<rightarrow> 3+\<^sub>\<omega>l"
   using sum_type[of 2 3 l l "{\<langle>0, 1\<rangle>, \<langle>1, 0\<rangle>}" "id(l)"] f_type assms id_type
   unfolding \<rho>_repl_def by auto
 
 definition Lambda_in_M_fm where [simp]:"Lambda_in_M_fm(\<phi>,len) \<equiv>
   \<cdot>(\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and>
    ren(\<phi>) ` (2 +\<^sub>\<omega> len) ` (3 +\<^sub>\<omega> len) ` \<rho>_repl(len) \<cdot>\<cdot>) \<and> \<cdot>0 \<in> len +\<^sub>\<omega> 2\<cdot>\<cdot>"
 
 lemma Lambda_in_M_fm_type[TC]: "\<phi>\<in>formula \<Longrightarrow> len\<in>nat \<Longrightarrow> Lambda_in_M_fm(\<phi>,len) \<in>formula"
   using ren_tc[of \<phi> "2+\<^sub>\<omega>len" "3+\<^sub>\<omega>len" "\<rho>_repl(len)"] ren_type
   unfolding Lambda_in_M_fm_def
   by simp
 
 definition \<rho>_pair_repl :: "i\<Rightarrow>i" where
   "\<rho>_pair_repl(l) \<equiv> rsum({\<langle>0, 0\<rangle>, \<langle>1, 1\<rangle>, \<langle>2, 3\<rangle>}, id(l), 3, 4, l)"
 
 definition LambdaPair_in_M_fm where "LambdaPair_in_M_fm(\<phi>,len) \<equiv>
   \<cdot>(\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and>
              ren((\<cdot>\<exists>(\<cdot>\<exists>\<cdot>\<cdot>fst(2) is 0\<cdot> \<and> \<cdot>\<cdot>snd(2) is 1\<cdot> \<and> ren(\<phi>) ` (3 +\<^sub>\<omega> len) ` (4 +\<^sub>\<omega> len) ` \<rho>_pair_repl(len) \<cdot>\<cdot>\<cdot>)\<cdot>)) ` (2 +\<^sub>\<omega> len) `
              (3 +\<^sub>\<omega> len) `
              \<rho>_repl(len) \<cdot>\<cdot>) \<and>
           \<cdot>0 \<in> len +\<^sub>\<omega> 2\<cdot>\<cdot> "
 
 lemma f_type' : "{\<langle>0,0 \<rangle>, \<langle>1, 1\<rangle>, \<langle>2, 3\<rangle>} \<in> 3 \<rightarrow> 4"
   using Pi_iff unfolding function_def by auto
 
 lemma ren_type' :
   assumes "l\<in>nat"
   shows "\<rho>_pair_repl(l) : 3+\<^sub>\<omega>l \<rightarrow> 4+\<^sub>\<omega>l"
   using sum_type[of 3 4 l l "{\<langle>0, 0\<rangle>, \<langle>1, 1\<rangle>, \<langle>2, 3\<rangle>}" "id(l)"] f_type' assms id_type
   unfolding \<rho>_pair_repl_def by auto
 
 lemma LambdaPair_in_M_fm_type[TC]: "\<phi>\<in>formula \<Longrightarrow> len\<in>nat \<Longrightarrow> LambdaPair_in_M_fm(\<phi>,len) \<in>formula"
   using ren_tc[OF _ _ _ ren_type',of \<phi> "len"] Lambda_in_M_fm_type
   unfolding LambdaPair_in_M_fm_def
   by simp
 
 subsection\<open>The relation \<^term>\<open>frecrel\<close>\<close>
 
 definition
   frecrelP :: "[i\<Rightarrow>o,i] \<Rightarrow> o" where
   "frecrelP(M,xy) \<equiv> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,xy) \<and> is_frecR(M,x,y))"
 
 synthesize "frecrelP" from_definition
 arity_theorem for "frecrelP_fm"
 
 definition
   is_frecrel :: "[i\<Rightarrow>o,i,i] \<Rightarrow> o" where
   "is_frecrel(M,A,r) \<equiv> \<exists>A2[M]. cartprod(M,A,A,A2) \<and> is_Collect(M,A2, frecrelP(M) ,r)"
 
 synthesize "frecrel" from_definition "is_frecrel"
 arity_theorem for "frecrel_fm"
 
 definition
   names_below :: "i \<Rightarrow> i \<Rightarrow> i" where
   "names_below(P,x) \<equiv> 2\<times>ecloseN(x)\<times>ecloseN(x)\<times>P"
 
 lemma names_belowsD:
   assumes "x \<in> names_below(P,z)"
   obtains f n1 n2 p where
     "x = \<langle>f,n1,n2,p\<rangle>" "f\<in>2" "n1\<in>ecloseN(z)" "n2\<in>ecloseN(z)" "p\<in>P"
   using assms unfolding names_below_def by auto
 
 synthesize "number2" from_definition
 
 lemma number2_iff :
   "(A)(c) \<Longrightarrow> number2(A,c) \<longleftrightarrow> (\<exists>b[A]. \<exists>a[A]. successor(A, b, c) \<and> successor(A, a, b) \<and> empty(A, a))"
   unfolding number2_def number1_def by auto
 arity_theorem for "number2_fm"
 
 reldb_add "ecloseN" "is_ecloseN"
 relativize "names_below" "is_names_below"
 synthesize "is_names_below" from_definition
 arity_theorem for "is_names_below_fm"
 
 definition
   is_tuple :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "is_tuple(M,z,t1,t2,p,t) \<equiv> \<exists>t1t2p[M]. \<exists>t2p[M]. pair(M,t2,p,t2p) \<and> pair(M,t1,t2p,t1t2p) \<and>
                                                   pair(M,z,t1t2p,t)"
 
 synthesize "is_tuple" from_definition
 arity_theorem for "is_tuple_fm"
 
 subsection\<open>Definition of Forces\<close>
 
 subsubsection\<open>Definition of \<^term>\<open>forces\<close> for equality and membership\<close>
 text\<open>$p\forces \tau = \theta$ if for every $q\leqslant p$ both $q\forces \sigma \in \tau$
 and $q\forces \sigma \in \theta$ hold for all $\sigma \in \dom(\tau)\cup \dom(\theta)$.\<close>
 definition
   eq_case :: "[i,i,i,i,i,i] \<Rightarrow> o" where
   "eq_case(\<tau>,\<theta>,p,P,leq,f) \<equiv> \<forall>\<sigma>. \<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>) \<longrightarrow>
       (\<forall>q. q\<in>P \<and> \<langle>q,p\<rangle>\<in>leq \<longrightarrow> (f`\<langle>1,\<sigma>,\<tau>,q\<rangle>=1  \<longleftrightarrow> f`\<langle>1,\<sigma>,\<theta>,q\<rangle> =1))"
 
 relativize "eq_case" "is_eq_case"
 synthesize "eq_case" from_definition "is_eq_case"
 
 text\<open>$p\forces \tau \in \theta$ if for every $v\leqslant p$
   there exist $q$, $r$, and $\sigma$ such that
   $v\leqslant q$, $q\leqslant r$, $\langle \sigma,r\rangle \in \tau$, and
   $q\forces \pi = \sigma$.\<close>
 definition
   mem_case :: "[i,i,i,i,i,i] \<Rightarrow> o" where
   "mem_case(\<tau>,\<theta>,p,P,leq,f) \<equiv> \<forall>v\<in>P. \<langle>v,p\<rangle>\<in>leq \<longrightarrow>
     (\<exists>q. \<exists>\<sigma>. \<exists>r. r\<in>P \<and> q\<in>P \<and> \<langle>q,v\<rangle>\<in>leq \<and> \<langle>\<sigma>,r\<rangle> \<in> \<theta> \<and> \<langle>q,r\<rangle>\<in>leq \<and>  f`\<langle>0,\<tau>,\<sigma>,q\<rangle> = 1)"
 
 relativize "mem_case" "is_mem_case"
 synthesize "mem_case" from_definition "is_mem_case"
 arity_theorem intermediate for "eq_case_fm"
 lemma arity_eq_case_fm[arity]:
   assumes
     "n1\<in>nat" "n2\<in>nat" "p\<in>nat" "P\<in>nat" "leq\<in>nat" "f\<in>nat"
   shows
     "arity(eq_case_fm(n1,n2,p,P,leq,f)) =
     succ(n1) \<union> succ(n2) \<union> succ(p) \<union> succ(P) \<union> succ(leq) \<union> succ(f)"
   using assms arity_eq_case_fm'
   by auto
 
 arity_theorem intermediate for "mem_case_fm"
 lemma arity_mem_case_fm[arity] :
   assumes
     "n1\<in>nat" "n2\<in>nat" "p\<in>nat" "P\<in>nat" "leq\<in>nat" "f\<in>nat"
   shows
     "arity(mem_case_fm(n1,n2,p,P,leq,f)) =
     succ(n1) \<union> succ(n2) \<union> succ(p) \<union> succ(P) \<union> succ(leq) \<union> succ(f)"
   using assms arity_mem_case_fm'
   by auto
 
 definition
   Hfrc :: "[i,i,i,i] \<Rightarrow> o" where
   "Hfrc(P,leq,fnnc,f) \<equiv> \<exists>ft. \<exists>\<tau>. \<exists>\<theta>. \<exists>p. p\<in>P \<and> fnnc = \<langle>ft,\<tau>,\<theta>,p\<rangle> \<and>
      (  ft = 0 \<and>  eq_case(\<tau>,\<theta>,p,P,leq,f)
       \<or> ft = 1 \<and> mem_case(\<tau>,\<theta>,p,P,leq,f))"
 
 relativize "Hfrc" "is_Hfrc"
 synthesize "Hfrc" from_definition "is_Hfrc"
 
 definition
   is_Hfrc_at :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "is_Hfrc_at(M,P,leq,fnnc,f,b) \<equiv>
             (empty(M,b) \<and> \<not> is_Hfrc(M,P,leq,fnnc,f))
           \<or> (number1(M,b) \<and> is_Hfrc(M,P,leq,fnnc,f))"
 
 synthesize "Hfrc_at" from_definition "is_Hfrc_at"
 arity_theorem intermediate for "Hfrc_fm"
 
 lemma arity_Hfrc_fm[arity] :
   assumes
     "P\<in>nat" "leq\<in>nat" "fnnc\<in>nat" "f\<in>nat"
   shows
     "arity(Hfrc_fm(P,leq,fnnc,f)) = succ(P) \<union> succ(leq) \<union> succ(fnnc) \<union> succ(f)"
   using assms arity_Hfrc_fm'
   by auto
 
 arity_theorem for "Hfrc_at_fm"
 
 subsubsection\<open>The well-founded relation \<^term>\<open>forcerel\<close>\<close>
 definition
   forcerel :: "i \<Rightarrow> i \<Rightarrow> i" where
   "forcerel(P,x) \<equiv> frecrel(names_below(P,x))^+"
 
 definition
   is_forcerel :: "[i\<Rightarrow>o,i,i,i] \<Rightarrow> o" where
   "is_forcerel(M,P,x,z) \<equiv> \<exists>r[M]. \<exists>nb[M]. tran_closure(M,r,z) \<and>
                         (is_names_below(M,P,x,nb) \<and> is_frecrel(M,nb,r))"
 synthesize "is_forcerel" from_definition
 arity_theorem for "is_forcerel_fm"
 
 subsection\<open>\<^term>\<open>frc_at\<close>, forcing for atomic formulas\<close>
 definition
   frc_at :: "[i,i,i] \<Rightarrow> i" where
   "frc_at(P,leq,fnnc) \<equiv> wfrec(frecrel(names_below(P,fnnc)),fnnc,
                               \<lambda>x f. bool_of_o(Hfrc(P,leq,x,f)))"
 
 \<comment> \<open>The relational form is defined manually because it uses \<^term>\<open>wfrec\<close>.\<close>
 definition
   is_frc_at :: "[i\<Rightarrow>o,i,i,i,i] \<Rightarrow> o" where
   "is_frc_at(M,P,leq,x,z) \<equiv> \<exists>r[M]. is_forcerel(M,P,x,r) \<and>
                                     is_wfrec(M,is_Hfrc_at(M,P,leq),r,x,z)"
 
 definition
   frc_at_fm :: "[i,i,i,i] \<Rightarrow> i" where
   "frc_at_fm(p,l,x,z) \<equiv> Exists(And(is_forcerel_fm(succ(p),succ(x),0),
           is_wfrec_fm(Hfrc_at_fm(6+\<^sub>\<omega>p,6+\<^sub>\<omega>l,2,1,0),0,succ(x),succ(z))))"
 
 lemma frc_at_fm_type [TC] :
   "\<lbrakk>p\<in>nat;l\<in>nat;x\<in>nat;z\<in>nat\<rbrakk> \<Longrightarrow> frc_at_fm(p,l,x,z)\<in>formula"
   unfolding frc_at_fm_def by simp
 
 lemma arity_frc_at_fm[arity] :
   assumes "p\<in>nat" "l\<in>nat" "x\<in>nat" "z\<in>nat"
   shows "arity(frc_at_fm(p,l,x,z)) = succ(p) \<union> succ(l) \<union> succ(x) \<union> succ(z)"
 proof -
   let ?\<phi> = "Hfrc_at_fm(6 +\<^sub>\<omega> p, 6 +\<^sub>\<omega> l, 2, 1, 0)"
   note assms
   moreover from this
   have  "arity(?\<phi>) = (7+\<^sub>\<omega>p) \<union> (7+\<^sub>\<omega>l)" "?\<phi> \<in> formula"
     using arity_Hfrc_at_fm ord_simp_union
     by auto
   moreover from calculation
   have "arity(is_wfrec_fm(?\<phi>, 0, succ(x), succ(z))) = 2+\<^sub>\<omega>p \<union> (2+\<^sub>\<omega>l) \<union> (2+\<^sub>\<omega>x) \<union> (2+\<^sub>\<omega>z)"
     using arity_is_wfrec_fm[OF \<open>?\<phi>\<in>_\<close> _ _ _ _ \<open>arity(?\<phi>) = _\<close>] pred_Un_distrib pred_succ_eq
       union_abs1
     by auto
   moreover from assms
   have "arity(is_forcerel_fm(succ(p),succ(x),0)) = 2+\<^sub>\<omega>p \<union> (2+\<^sub>\<omega>x)"
     using arity_is_forcerel_fm ord_simp_union
     by auto
   ultimately
   show ?thesis
     unfolding frc_at_fm_def
     using arity_is_forcerel_fm pred_Un_distrib
     by (auto simp:FOL_arities)
 qed
 
 lemma sats_frc_at_fm :
   assumes
     "p\<in>nat" "l\<in>nat" "i\<in>nat" "j\<in>nat" "env\<in>list(A)" "i < length(env)" "j < length(env)"
   shows
     "(A , env \<Turnstile> frc_at_fm(p,l,i,j)) \<longleftrightarrow>
      is_frc_at(##A,nth(p,env),nth(l,env),nth(i,env),nth(j,env))"
 proof -
   {
     fix r pp ll
     assume "r\<in>A"
     have "is_Hfrc_at(##A,nth(p,env),nth(l,env),a2, a1, a0) \<longleftrightarrow>
          (A, [a0,a1,a2,a3,a4,r]@env \<Turnstile> Hfrc_at_fm(6+\<^sub>\<omega>p,6+\<^sub>\<omega>l,2,1,0))"
       if "a0\<in>A" "a1\<in>A" "a2\<in>A" "a3\<in>A" "a4\<in>A" for a0 a1 a2 a3 a4
       using  that assms \<open>r\<in>A\<close>
         Hfrc_at_iff_sats[of "6+\<^sub>\<omega>p" "6+\<^sub>\<omega>l" 2 1 0 "[a0,a1,a2,a3,a4,r]@env" A]  by simp
     with \<open>r\<in>A\<close>
     have "(A,[r]@env \<Turnstile> is_wfrec_fm(Hfrc_at_fm(6+\<^sub>\<omega>p, 6+\<^sub>\<omega>l,2,1,0),0, i+\<^sub>\<omega>1, j+\<^sub>\<omega>1)) \<longleftrightarrow>
          is_wfrec(##A, is_Hfrc_at(##A, nth(p,env), nth(l,env)), r,nth(i, env), nth(j, env))"
       using assms sats_is_wfrec_fm
       by simp
   }
   moreover
   have "(A, Cons(r, env) \<Turnstile> is_forcerel_fm(succ(p), succ(i), 0)) \<longleftrightarrow>
         is_forcerel(##A,nth(p,env),nth(i,env),r)" if "r\<in>A" for r
     using assms sats_is_forcerel_fm that
     by simp
   ultimately
   show ?thesis
     unfolding is_frc_at_def frc_at_fm_def
     using assms
     by simp
 qed
 
 lemma frc_at_fm_iff_sats:
   assumes "nth(i,env) = w" "nth(j,env) = x" "nth(k,env) = y" "nth(l,env) = z"
     "i \<in> nat" "j \<in> nat" "k \<in> nat" "l\<in>nat" "env \<in> list(A)" "k<length(env)" "l<length(env)"
   shows "is_frc_at(##A, w, x, y,z) \<longleftrightarrow> (A , env \<Turnstile> frc_at_fm(i,j,k,l))"
   using assms sats_frc_at_fm
   by simp
 
 declare frc_at_fm_iff_sats [iff_sats]
 
 definition
   forces_eq' :: "[i,i,i,i,i] \<Rightarrow> o" where
   "forces_eq'(P,l,p,t1,t2) \<equiv> frc_at(P,l,\<langle>0,t1,t2,p\<rangle>) = 1"
 
 definition
   forces_mem' :: "[i,i,i,i,i] \<Rightarrow> o" where
   "forces_mem'(P,l,p,t1,t2) \<equiv> frc_at(P,l,\<langle>1,t1,t2,p\<rangle>) = 1"
 
 definition
   forces_neq' :: "[i,i,i,i,i] \<Rightarrow> o" where
   "forces_neq'(P,l,p,t1,t2) \<equiv> \<not> (\<exists>q\<in>P. \<langle>q,p\<rangle>\<in>l \<and> forces_eq'(P,l,q,t1,t2))"
 
 definition
   forces_nmem' :: "[i,i,i,i,i] \<Rightarrow> o" where
   "forces_nmem'(P,l,p,t1,t2) \<equiv> \<not> (\<exists>q\<in>P. \<langle>q,p\<rangle>\<in>l \<and> forces_mem'(P,l,q,t1,t2))"
 
 \<comment> \<open>The following definitions are explicitly defined to avoid the expansion
 of concepts.\<close>
 definition
   is_forces_eq' :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "is_forces_eq'(M,P,l,p,t1,t2) \<equiv> \<exists>o[M]. \<exists>z[M]. \<exists>t[M]. number1(M,o) \<and> empty(M,z) \<and>
                                 is_tuple(M,z,t1,t2,p,t) \<and> is_frc_at(M,P,l,t,o)"
 
 definition
   is_forces_mem' :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "is_forces_mem'(M,P,l,p,t1,t2) \<equiv> \<exists>o[M]. \<exists>t[M]. number1(M,o) \<and>
                                 is_tuple(M,o,t1,t2,p,t) \<and> is_frc_at(M,P,l,t,o)"
 
 definition
   is_forces_neq' :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "is_forces_neq'(M,P,l,p,t1,t2) \<equiv>
       \<not> (\<exists>q[M]. q\<in>P \<and> (\<exists>qp[M]. pair(M,q,p,qp) \<and> qp\<in>l \<and> is_forces_eq'(M,P,l,q,t1,t2)))"
 
 definition
   is_forces_nmem' :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "is_forces_nmem'(M,P,l,p,t1,t2) \<equiv>
       \<not> (\<exists>q[M]. \<exists>qp[M]. q\<in>P \<and> pair(M,q,p,qp) \<and> qp\<in>l \<and> is_forces_mem'(M,P,l,q,t1,t2))"
 
 synthesize "forces_eq" from_definition "is_forces_eq'"
 synthesize "forces_mem" from_definition "is_forces_mem'"
 synthesize "forces_neq" from_definition "is_forces_neq'" assuming "nonempty"
 synthesize "forces_nmem" from_definition "is_forces_nmem'" assuming "nonempty"
 
 context
   notes Un_assoc[simp] Un_trasposition_aux2[simp]
 begin
 arity_theorem for "forces_eq_fm"
 arity_theorem for "forces_mem_fm"
 arity_theorem for "forces_neq_fm"
 arity_theorem for "forces_nmem_fm"
 end
 
 subsection\<open>Forcing for general formulas\<close>
 
 definition
   ren_forces_nand :: "i\<Rightarrow>i" where
   "ren_forces_nand(\<phi>) \<equiv> Exists(And(Equal(0,1),iterates(\<lambda>p. incr_bv(p)`1 , 2, \<phi>)))"
 
 lemma ren_forces_nand_type[TC] :
   "\<phi>\<in>formula \<Longrightarrow> ren_forces_nand(\<phi>) \<in>formula"
   unfolding ren_forces_nand_def
   by simp
 
 lemma arity_ren_forces_nand :
   assumes "\<phi>\<in>formula"
   shows "arity(ren_forces_nand(\<phi>)) \<le> succ(arity(\<phi>))"
 proof -
   consider (lt) "1<arity(\<phi>)" | (ge) "\<not> 1 < arity(\<phi>)"
     by auto
   then
   show ?thesis
   proof cases
     case lt
     with \<open>\<phi>\<in>_\<close>
     have "2 < succ(arity(\<phi>))" "2<arity(\<phi>)+\<^sub>\<omega>2"
       using succ_ltI by auto
     with \<open>\<phi>\<in>_\<close>
     have "arity(iterates(\<lambda>p. incr_bv(p)`1,2,\<phi>)) = 2+\<^sub>\<omega>arity(\<phi>)"
       using arity_incr_bv_lemma lt
       by auto
     with \<open>\<phi>\<in>_\<close>
     show ?thesis
       unfolding ren_forces_nand_def
       using lt pred_Un_distrib union_abs1 Un_assoc[symmetric] Un_le_compat
       by (simp add:FOL_arities)
   next
     case ge
     with \<open>\<phi>\<in>_\<close>
     have "arity(\<phi>) \<le> 1" "pred(arity(\<phi>)) \<le> 1"
       using not_lt_iff_le le_trans[OF le_pred]
       by simp_all
     with \<open>\<phi>\<in>_\<close>
     have "arity(iterates(\<lambda>p. incr_bv(p)`1,2,\<phi>)) = (arity(\<phi>))"
       using arity_incr_bv_lemma ge
       by simp
     with \<open>arity(\<phi>) \<le> 1\<close> \<open>\<phi>\<in>_\<close> \<open>pred(_) \<le> 1\<close>
     show ?thesis
       unfolding ren_forces_nand_def
       using  pred_Un_distrib union_abs1 Un_assoc[symmetric] union_abs2
       by (simp add:FOL_arities)
   qed
 qed
 
 lemma sats_ren_forces_nand:
   "[q,P,leq,o,p] @ env \<in> list(M) \<Longrightarrow> \<phi>\<in>formula \<Longrightarrow>
    (M, [q,p,P,leq,o] @ env \<Turnstile> ren_forces_nand(\<phi>)) \<longleftrightarrow> (M, [q,P,leq,o] @ env \<Turnstile> \<phi>)"
   unfolding ren_forces_nand_def
   using sats_incr_bv_iff [of _ _ M _ "[q]"]
   by simp
 
 
 definition
   ren_forces_forall :: "i\<Rightarrow>i" where
   "ren_forces_forall(\<phi>) \<equiv>
       Exists(Exists(Exists(Exists(Exists(
         And(Equal(0,6),And(Equal(1,7),And(Equal(2,8),And(Equal(3,9),
         And(Equal(4,5),iterates(\<lambda>p. incr_bv(p)`5 , 5, \<phi>)))))))))))"
 
 lemma arity_ren_forces_all :
   assumes "\<phi>\<in>formula"
   shows "arity(ren_forces_forall(\<phi>)) = 5 \<union> arity(\<phi>)"
 proof -
   consider (lt) "5<arity(\<phi>)" | (ge) "\<not> 5 < arity(\<phi>)"
     by auto
   then
   show ?thesis
   proof cases
     case lt
     with \<open>\<phi>\<in>_\<close>
     have "5 < succ(arity(\<phi>))" "5<arity(\<phi>)+\<^sub>\<omega>2"  "5<arity(\<phi>)+\<^sub>\<omega>3"  "5<arity(\<phi>)+\<^sub>\<omega>4"
       using succ_ltI by auto
     with \<open>\<phi>\<in>_\<close>
     have "arity(iterates(\<lambda>p. incr_bv(p)`5,5,\<phi>)) = 5+\<^sub>\<omega>arity(\<phi>)"
       using arity_incr_bv_lemma lt
       by simp
     with \<open>\<phi>\<in>_\<close>
     show ?thesis
       unfolding ren_forces_forall_def
       using pred_Un_distrib union_abs1 Un_assoc[symmetric] union_abs2
       by (simp add:FOL_arities)
   next
     case ge
     with \<open>\<phi>\<in>_\<close>
     have "arity(\<phi>) \<le> 5" "pred^5(arity(\<phi>)) \<le> 5"
       using not_lt_iff_le le_trans[OF le_pred]
       by simp_all
     with \<open>\<phi>\<in>_\<close>
     have "arity(iterates(\<lambda>p. incr_bv(p)`5,5,\<phi>)) = arity(\<phi>)"
       using arity_incr_bv_lemma ge
       by simp
     with \<open>arity(\<phi>) \<le> 5\<close> \<open>\<phi>\<in>_\<close> \<open>pred^5(_) \<le> 5\<close>
     show ?thesis
       unfolding ren_forces_forall_def
       using  pred_Un_distrib union_abs1 Un_assoc[symmetric] union_abs2
       by (simp add:FOL_arities)
   qed
 qed
 
 lemma ren_forces_forall_type[TC] :
   "\<phi>\<in>formula \<Longrightarrow> ren_forces_forall(\<phi>) \<in>formula"
   unfolding ren_forces_forall_def by simp
 
 lemma sats_ren_forces_forall :
   "[x,P,leq,o,p] @ env \<in> list(M) \<Longrightarrow> \<phi>\<in>formula \<Longrightarrow>
     (M, [x,p,P,leq,o] @ env \<Turnstile> ren_forces_forall(\<phi>)) \<longleftrightarrow> (M, [p,P,leq,o,x] @ env \<Turnstile> \<phi>)"
   unfolding ren_forces_forall_def
   using sats_incr_bv_iff [of _ _ M _ "[p,P,leq,o,x]"]
   by simp
 
 subsubsection\<open>The primitive recursion\<close>
 
 consts forces' :: "i\<Rightarrow>i"
 primrec
   "forces'(Member(x,y)) = forces_mem_fm(1,2,0,x+\<^sub>\<omega>4,y+\<^sub>\<omega>4)"
   "forces'(Equal(x,y))  = forces_eq_fm(1,2,0,x+\<^sub>\<omega>4,y+\<^sub>\<omega>4)"
   "forces'(Nand(p,q))   =
         Neg(Exists(And(Member(0,2),And(is_leq_fm(3,0,1),And(ren_forces_nand(forces'(p)),
                                          ren_forces_nand(forces'(q)))))))"
   "forces'(Forall(p))   = Forall(ren_forces_forall(forces'(p)))"
 
 
 definition
   forces :: "i\<Rightarrow>i" where
   "forces(\<phi>) \<equiv> And(Member(0,1),forces'(\<phi>))"
 
 lemma forces'_type [TC]:  "\<phi>\<in>formula \<Longrightarrow> forces'(\<phi>) \<in> formula"
   by (induct \<phi> set:formula; simp)
 
 lemma forces_type[TC] : "\<phi>\<in>formula \<Longrightarrow> forces(\<phi>) \<in> formula"
   unfolding forces_def by simp
 
 subsection\<open>The arity of \<^term>\<open>forces\<close>\<close>
 
 lemma arity_forces_at:
   assumes  "x \<in> nat" "y \<in> nat"
   shows "arity(forces(Member(x, y))) = (succ(x) \<union> succ(y)) +\<^sub>\<omega> 4"
     "arity(forces(Equal(x, y))) = (succ(x) \<union> succ(y)) +\<^sub>\<omega> 4"
   unfolding forces_def
   using assms arity_forces_mem_fm arity_forces_eq_fm succ_Un_distrib ord_simp_union
   by (auto simp:FOL_arities,(rule_tac le_anti_sym,simp_all,(rule_tac not_le_anti_sym,simp_all))+)
 
 lemma arity_forces':
   assumes "\<phi>\<in>formula"
   shows "arity(forces'(\<phi>)) \<le> arity(\<phi>) +\<^sub>\<omega> 4"
   using assms
 proof (induct set:formula)
   case (Member x y)
   then
   show ?case
     using arity_forces_mem_fm succ_Un_distrib ord_simp_union leI not_le_iff_lt
     by simp
 next
   case (Equal x y)
   then
   show ?case
     using arity_forces_eq_fm succ_Un_distrib ord_simp_union leI not_le_iff_lt
     by simp
 next
   case (Nand \<phi> \<psi>)
   let ?\<phi>' = "ren_forces_nand(forces'(\<phi>))"
   let ?\<psi>' = "ren_forces_nand(forces'(\<psi>))"
   have "arity(is_leq_fm(3, 0, 1)) = 4"
     using arity_is_leq_fm succ_Un_distrib ord_simp_union
     by simp
   have "3 \<le> (4+\<^sub>\<omega>arity(\<phi>)) \<union> (4+\<^sub>\<omega>arity(\<psi>))" (is "_ \<le> ?rhs")
     using ord_simp_union by simp
   from \<open>\<phi>\<in>_\<close> Nand
   have "pred(arity(?\<phi>')) \<le> ?rhs"  "pred(arity(?\<psi>')) \<le> ?rhs"
   proof -
     from \<open>\<phi>\<in>_\<close> \<open>\<psi>\<in>_\<close>
     have A:"pred(arity(?\<phi>')) \<le> arity(forces'(\<phi>))"
       "pred(arity(?\<psi>')) \<le> arity(forces'(\<psi>))"
       using pred_mono[OF _  arity_ren_forces_nand] pred_succ_eq
       by simp_all
     from Nand
     have "3 \<union> arity(forces'(\<phi>)) \<le> arity(\<phi>) +\<^sub>\<omega> 4"
       "3 \<union> arity(forces'(\<psi>)) \<le> arity(\<psi>) +\<^sub>\<omega> 4"
       using Un_le by simp_all
     with Nand
     show "pred(arity(?\<phi>')) \<le> ?rhs"
       "pred(arity(?\<psi>')) \<le> ?rhs"
       using le_trans[OF A(1)] le_trans[OF A(2)] le_Un_iff
       by simp_all
   qed
   with Nand \<open>_=4\<close>
   show ?case
     using pred_Un_distrib Un_assoc[symmetric] succ_Un_distrib union_abs1 Un_leI3[OF \<open>3 \<le> ?rhs\<close>]
     by (simp add:FOL_arities)
 next
   case (Forall \<phi>)
   let ?\<phi>' = "ren_forces_forall(forces'(\<phi>))"
   show ?case
   proof (cases "arity(\<phi>) = 0")
     case True
     with Forall
     show ?thesis
     proof -
       from Forall True
       have "arity(forces'(\<phi>)) \<le> 5"
         using le_trans[of _ 4 5] by auto
       with \<open>\<phi>\<in>_\<close>
       have "arity(?\<phi>') \<le> 5"
         using arity_ren_forces_all[OF forces'_type[OF \<open>\<phi>\<in>_\<close>]] union_abs2
         by auto
       with Forall True
       show ?thesis
         using pred_mono[OF _ \<open>arity(?\<phi>') \<le> 5\<close>]
         by simp
     qed
   next
     case False
     with Forall
     show ?thesis
     proof -
       from Forall False
       have "arity(?\<phi>') = 5 \<union> arity(forces'(\<phi>))"
         "arity(forces'(\<phi>)) \<le> 5 +\<^sub>\<omega> arity(\<phi>)"
         "4 \<le> 3+\<^sub>\<omega>arity(\<phi>)"
         using Ord_0_lt arity_ren_forces_all
           le_trans[OF _ add_le_mono[of 4 5, OF _ le_refl]]
         by auto
       with \<open>\<phi>\<in>_\<close>
       have "5 \<union> arity(forces'(\<phi>)) \<le> 5+\<^sub>\<omega>arity(\<phi>)"
         using ord_simp_union by auto
       with \<open>\<phi>\<in>_\<close> \<open>arity(?\<phi>') = 5 \<union> _\<close>
       show ?thesis
         using pred_Un_distrib succ_pred_eq[OF _ \<open>arity(\<phi>)\<noteq>0\<close>]
           pred_mono[OF _ Forall(2)] Un_le[OF \<open>4\<le>3+\<^sub>\<omega>arity(\<phi>)\<close>]
         by simp
     qed
   qed
 qed
 
 lemma arity_forces :
   assumes "\<phi>\<in>formula"
   shows "arity(forces(\<phi>)) \<le> 4+\<^sub>\<omega>arity(\<phi>)"
   unfolding forces_def
   using assms arity_forces' le_trans ord_simp_union FOL_arities by auto
 
 lemma arity_forces_le :
   assumes "\<phi>\<in>formula" "n\<in>nat" "arity(\<phi>) \<le> n"
   shows "arity(forces(\<phi>)) \<le> 4+\<^sub>\<omega>n"
   using assms le_trans[OF _ add_le_mono[OF le_refl[of 5] \<open>arity(\<phi>)\<le>_\<close>]] arity_forces
   by auto
 
 definition rename_split_fm where
   "rename_split_fm(\<phi>) \<equiv> (\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>\<cdot>\<cdot>snd(9) is 0\<cdot> \<and> \<cdot>\<cdot>fst(9) is 4\<cdot> \<and> \<cdot>\<cdot>1=11\<cdot> \<and>
     \<cdot>\<cdot>2=12\<cdot> \<and> \<cdot>\<cdot>3=13\<cdot> \<and> \<cdot>\<cdot>5=7\<cdot> \<and>
     (\<lambda>p. incr_bv(p)`6)^8(forces(\<phi>)) \<cdot>\<cdot>\<cdot>\<cdot>\<cdot>\<cdot>\<cdot>)\<cdot>)\<cdot>)\<cdot>)\<cdot>)\<cdot>)"
 
 lemma rename_split_fm_type[TC]: "\<phi>\<in>formula \<Longrightarrow> rename_split_fm(\<phi>)\<in>formula"
   unfolding rename_split_fm_def by simp
 
 schematic_goal arity_rename_split_fm: "\<phi>\<in>formula \<Longrightarrow> arity(rename_split_fm(\<phi>)) = ?m"
   using arity_forces[of \<phi>] forces_type unfolding rename_split_fm_def
   by (simp add:arity Un_assoc[symmetric] union_abs1)
 
 lemma arity_rename_split_fm_le:
   assumes "\<phi>\<in>formula"
   shows "arity(rename_split_fm(\<phi>)) \<le> 8 \<union> (6 +\<^sub>\<omega> arity(\<phi>))"
 proof -
   from assms
   have arity_forces_6: "\<not> 1 < arity(\<phi>) \<Longrightarrow> 6 \<le> n \<Longrightarrow> arity(forces(\<phi>)) \<le> n" for n
     using le_trans lt_trans[of _ 5 n] not_lt_iff_le[of 1 "arity(\<phi>)"]
     by (auto intro!:le_trans[OF arity_forces])
   have pred1_arity_forces: "\<not> 1 < arity(\<phi>) \<Longrightarrow> pred^n(arity(forces(\<phi>))) \<le> 8" if "n\<in>nat" for n
     using that pred_le[of 7] le_succ[THEN [2] le_trans] arity_forces_6
     by (induct rule:nat_induct) auto
   have arity_forces_le_succ6: "pred^n(arity(forces(\<phi>))) \<le> succ(succ(succ(succ(succ(succ(arity(\<phi>)))))))"
     if "n\<in>nat" for n
     using that assms arity_forces[of \<phi>, THEN le_trans,
         OF _ le_succ, THEN le_trans, OF _ _ le_succ] le_trans[OF pred_le[OF _ le_succ]]
     by (induct rule:nat_induct) auto
   note trivial_arities = arity_forces_6
     arity_forces_le_succ6[of 1, simplified] arity_forces_le_succ6[of 2, simplified]
     arity_forces_le_succ6[of 3, simplified] arity_forces_le_succ6[of 4, simplified]
     arity_forces_le_succ6[of 5, simplified] arity_forces_le_succ6[of 6, simplified]
     pred1_arity_forces[of 1, simplified] pred1_arity_forces[of 2, simplified]
     pred1_arity_forces[of 3, simplified] pred1_arity_forces[of 4, simplified]
     pred1_arity_forces[of 5, simplified] pred1_arity_forces[of 6, simplified]
   show ?thesis
     using assms arity_forces[of \<phi>] arity_forces[of \<phi>, THEN le_trans, OF _ le_succ]
       arity_forces[of \<phi>, THEN le_trans, OF _ le_succ, THEN le_trans, OF _ _ le_succ]
     unfolding rename_split_fm_def
     by (simp add:arity Un_assoc[symmetric] union_abs1 arity_forces[of \<phi>] forces_type)
       ((subst arity_incr_bv_lemma; auto simp: arity ord_simp_union forces_type trivial_arities)+)
 qed
 
 definition body_ground_repl_fm where
   "body_ground_repl_fm(\<phi>) \<equiv> (\<cdot>\<exists>(\<cdot>\<exists>\<cdot>is_Vset_fm(2, 0) \<and> \<cdot>\<cdot>1 \<in> 0\<cdot> \<and> rename_split_fm(\<phi>) \<cdot>\<cdot>\<cdot>)\<cdot>)"
 
 lemma body_ground_repl_fm_type[TC]: "\<phi>\<in>formula \<Longrightarrow> body_ground_repl_fm(\<phi>)\<in>formula"
   unfolding body_ground_repl_fm_def by simp
 
 lemma arity_body_ground_repl_fm_le:
   notes le_trans[trans]
   assumes "\<phi>\<in>formula"
   shows "arity(body_ground_repl_fm(\<phi>)) \<le> 6 \<union> (arity(\<phi>) +\<^sub>\<omega> 4)"
 proof -
   from \<open>\<phi>\<in>formula\<close>
   have ineq: "n \<union> pred(pred(arity(rename_split_fm(\<phi>))))
     \<le> m \<union> pred(pred(8 \<union> (arity(\<phi>) +\<^sub>\<omega>6 )))" if "n \<le> m" "n\<in>nat" "m\<in>nat" for n m
     using that arity_rename_split_fm_le[of \<phi>, THEN [2] pred_mono, THEN [2] pred_mono,
         THEN [2] Un_mono[THEN subset_imp_le, OF _ le_imp_subset]] le_imp_subset
     by auto
   moreover
   have eq1: "pred(pred(pred(4 \<union> 2 \<union> pred(pred(pred(
     pred(pred(pred(pred(pred(9 \<union> 1 \<union> 3 \<union> 2))))))))))) = 1"
     by (auto simp:pred_Un_distrib)
   ultimately
   have "pred(pred(pred(4 \<union> 2 \<union> pred(pred(pred(
     pred(pred(pred(pred(pred(9 \<union> 1 \<union> 3 \<union> 2))))))))))) \<union>
     pred(pred(arity(rename_split_fm(\<phi>)))) \<le>
     1 \<union> pred(pred(8 \<union> (arity(\<phi>) +\<^sub>\<omega>6 )))"
     by auto
   also from \<open>\<phi>\<in>formula\<close>
   have "1 \<union> pred(pred(8 \<union> (arity(\<phi>) +\<^sub>\<omega>6 ))) \<le> 6 \<union> (4+\<^sub>\<omega>arity(\<phi>))"
     by (auto simp:pred_Un_distrib Un_assoc[symmetric] ord_simp_union)
   finally
   show ?thesis
     using  \<open>\<phi>\<in>formula\<close> unfolding body_ground_repl_fm_def
     by (simp add:arity pred_Un_distrib, subst arity_transrec_fm[of "is_HVfrom_fm(8,2,1,0)" 3 1])
       (simp add:arity pred_Un_distrib,simp_all,
         auto simp add:eq1 arity_is_HVfrom_fm[of 8 2 1 0])
 qed
 
 definition ground_repl_fm where
   "ground_repl_fm(\<phi>) \<equiv> least_fm(body_ground_repl_fm(\<phi>), 1)"
 
 lemma ground_repl_fm_type[TC]:
   "\<phi>\<in>formula \<Longrightarrow> ground_repl_fm(\<phi>) \<in> formula"
   unfolding ground_repl_fm_def by simp
 
 lemma arity_ground_repl_fm:
   assumes "\<phi>\<in>formula"
   shows "arity(ground_repl_fm(\<phi>)) \<le> 5 \<union> (3 +\<^sub>\<omega> arity(\<phi>))"
 proof -
   from assms
   have "pred(arity(body_ground_repl_fm(\<phi>))) \<le> 5 \<union> (3 +\<^sub>\<omega> arity(\<phi>))"
     using arity_body_ground_repl_fm_le pred_mono succ_Un_distrib
     by (rule_tac pred_le) auto
   with assms
   have "2 \<union> pred(arity(body_ground_repl_fm(\<phi>))) \<le> 5 \<union> (3 +\<^sub>\<omega> arity(\<phi>))"
     using Un_le le_Un_iff by auto
   then
   show ?thesis
     using assms arity_forces arity_body_ground_repl_fm_le
     unfolding least_fm_def ground_repl_fm_def
     apply (auto simp add:arity Un_assoc[symmetric])
     apply (simp add: pred_Un Un_assoc, simp add: Un_assoc[symmetric] union_abs1 pred_Un)
     by(simp only: Un_commute, subst Un_commute, simp add:ord_simp_union,force)
 qed
 
 synthesize "is_ordermap" from_definition assuming "nonempty"
 
 synthesize "is_ordertype" from_definition assuming "nonempty"
 
 synthesize "is_order_body" from_definition assuming "nonempty"
 arity_theorem for "is_order_body_fm"
 
 definition omap_wfrec_body where
   "omap_wfrec_body(A,r) \<equiv> (\<cdot>\<exists>\<cdot>image_fm(2, 0, 1) \<and> pred_set_fm(9+\<^sub>\<omega>A, 3,9+\<^sub>\<omega>r, 0) \<cdot>\<cdot>)"
 
 lemma type_omap_wfrec_body_fm :"A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> omap_wfrec_body(A,r)\<in>formula"
   unfolding omap_wfrec_body_def by simp
 
 lemma arity_omap_wfrec_aux : "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> arity(omap_wfrec_body(A,r)) = (9+\<^sub>\<omega>A) \<union> (9+\<^sub>\<omega>r)"
   unfolding omap_wfrec_body_def
   using arity_image_fm arity_pred_set_fm pred_Un_distrib union_abs2[of 3] union_abs1
   by (simp add:FOL_arities, auto simp add:Un_assoc[symmetric] union_abs1)
 
 lemma arity_omap_wfrec: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>
   arity(is_wfrec_fm(omap_wfrec_body(A,r),r+\<^sub>\<omega>3, 1, 0)) = (4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)"
   using Arities.arity_is_wfrec_fm[OF _ _ _ _ _ arity_omap_wfrec_aux,of A r "3+\<^sub>\<omega>r" 1 0]
     pred_Un_distrib union_abs1 union_abs2 type_omap_wfrec_body_fm
   by auto
 
 lemma arity_isordermap: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordermap_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordermap_fm_def
   using arity_lambda_fm[where i="(4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)",OF _ _ _ _ arity_omap_wfrec,
       unfolded omap_wfrec_body_def] pred_Un_distrib union_abs1
   by auto
 
 lemma arity_is_ordertype: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordertype_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordertype_fm_def
   using arity_isordermap arity_image_fm pred_Un_distrib FOL_arities
   by auto
 
 lemma arity_is_order_body: "arity(is_order_body_fm(0,1)) = 2"
   using arity_is_order_body_fm arity_is_ordertype ord_simp_union
   by (simp add:FOL_arities)
 
 definition H_order_pred where
   "H_order_pred(A,r) \<equiv>  \<lambda>x f . f `` Order.pred(A, x, r)"
 
 relationalize "H_order_pred" "is_H_order_pred"
 
 synthesize "is_H_order_pred" from_definition assuming "nonempty"
 
 definition order_pred_wfrec_body where
   "order_pred_wfrec_body(M,A,r,z,x) \<equiv> \<exists>y[M].
                 pair(M, x, y, z) \<and>
                 (\<exists>f[M].
                     (\<forall>z[M].
                         z \<in> f \<longleftrightarrow>
                         (\<exists>xa[M].
                             \<exists>y[M].
                                \<exists>xaa[M].
                                   \<exists>sx[M].
                                      \<exists>r_sx[M].
                                         \<exists>f_r_sx[M].
                                            pair(M, xa, y, z) \<and>
                                            pair(M, xa, x, xaa) \<and>
                                            upair(M, xa, xa, sx) \<and>
                                            pre_image(M, r, sx, r_sx) \<and>
                                            restriction(M, f, r_sx, f_r_sx) \<and>
                                            xaa \<in> r \<and> (\<exists>a[M]. image(M, f_r_sx, a, y) \<and> pred_set(M, A, xa, r, a)))) \<and>
                     (\<exists>a[M]. image(M, f, a, y) \<and> pred_set(M, A, x, r, a)))"
 
 
 synthesize "order_pred_wfrec_body" from_definition
 arity_theorem for "order_pred_wfrec_body_fm"
 
-definition replacement_is_order_body_fm where "replacement_is_order_body_fm \<equiv>  (\<cdot>\<exists>\<cdot>is_order_body_fm(1, 0) \<and> \<cdot>\<langle>1,0\<rangle> is 2 \<cdot>\<cdot>\<cdot>)"
-definition wfrec_replacement_order_pred_fm where "wfrec_replacement_order_pred_fm \<equiv> order_pred_wfrec_body_fm(3,2,1,0)"
+definition ordtype_replacement_fm where "ordtype_replacement_fm \<equiv>  (\<cdot>\<exists>\<cdot>is_order_body_fm(1, 0) \<and> \<cdot>\<langle>1,0\<rangle> is 2 \<cdot>\<cdot>\<cdot>)"
+definition wfrec_ordertype_fm where "wfrec_ordertype_fm \<equiv> order_pred_wfrec_body_fm(3,2,1,0)"
 definition replacement_is_aleph_fm where "replacement_is_aleph_fm \<equiv> \<cdot>\<cdot>0 is ordinal\<cdot> \<and> \<cdot>\<aleph>(0) is 1\<cdot>\<cdot>"
 
 definition
   funspace_succ_rep_intf where
   "funspace_succ_rep_intf \<equiv> \<lambda>p z n. \<exists>f b. p = <f,b> & z = {cons(<n,b>, f)}"
 
 relativize functional "funspace_succ_rep_intf" "funspace_succ_rep_intf_rel"
 
 \<comment> \<open>The definition obtained next uses \<^term>\<open>is_cons\<close> instead of \<^term>\<open>upair\<close>
   as in Paulson's \<^file>\<open>~~/src/ZF/Constructible/Relative.thy\<close>.\<close>
 relationalize "funspace_succ_rep_intf_rel" "is_funspace_succ_rep_intf"
 
 synthesize "is_funspace_succ_rep_intf" from_definition
 
 arity_theorem for "is_funspace_succ_rep_intf_fm"
 
 definition wfrec_Hfrc_at_fm where "wfrec_Hfrc_at_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(Hfrc_at_fm(8, 9, 2, 1, 0), 5, 1, 0) \<cdot>\<cdot>)"
 definition list_repl1_intf_fm where "list_repl1_intf_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(iterates_MH_fm(list_functor_fm(13, 1, 0), 10, 2, 1, 0), 3, 1, 0) \<cdot>\<cdot>)"
 definition list_repl2_intf_fm where "list_repl2_intf_fm \<equiv> \<cdot>\<cdot>0 \<in> 4\<cdot> \<and> is_iterates_fm(list_functor_fm(13, 1, 0), 3, 0, 1) \<cdot>"
 definition formula_repl2_intf_fm where "formula_repl2_intf_fm \<equiv> \<cdot>\<cdot>0 \<in> 3\<cdot> \<and> is_iterates_fm(formula_functor_fm(1, 0), 2, 0, 1) \<cdot>"
-definition eclose_repl2_intf_fm where "eclose_repl2_intf_fm \<equiv> \<cdot>\<cdot>0 \<in> 3\<cdot> \<and> is_iterates_fm(\<cdot>\<Union>1 is 0\<cdot>, 2, 0, 1) \<cdot>"
+definition eclose_abs_fm where "eclose_abs_fm \<equiv> \<cdot>\<cdot>0 \<in> 3\<cdot> \<and> is_iterates_fm(\<cdot>\<Union>1 is 0\<cdot>, 2, 0, 1) \<cdot>"
 definition powapply_repl_fm where "powapply_repl_fm \<equiv> is_Powapply_fm(2,0,1)"
 definition wfrec_rank_fm where "wfrec_rank_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(is_Hrank_fm(2, 1, 0), 3, 1, 0) \<cdot>\<cdot>)"
-definition trans_repl_HVFrom_fm where "trans_repl_HVFrom_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(is_HVfrom_fm(8, 2, 1, 0), 4, 1, 0) \<cdot>\<cdot>)"
+definition transrec_VFrom_fm where "transrec_VFrom_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(is_HVfrom_fm(8, 2, 1, 0), 4, 1, 0) \<cdot>\<cdot>)"
 definition wfrec_Hcheck_fm where "wfrec_Hcheck_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(is_Hcheck_fm(8, 2, 1, 0), 4, 1, 0) \<cdot>\<cdot>) "
 definition repl_PHcheck_fm where "repl_PHcheck_fm \<equiv> PHcheck_fm(2,3,0,1)"
 definition tl_repl_intf_fm where "tl_repl_intf_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(iterates_MH_fm(tl_fm(1,0), 9, 2, 1, 0), 3, 1, 0) \<cdot>\<cdot>)"
 definition formula_repl1_intf_fm where "formula_repl1_intf_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(iterates_MH_fm(formula_functor_fm(1,0), 9, 2, 1, 0), 3, 1, 0) \<cdot>\<cdot>)"
-definition eclose_repl1_intf_fm where "eclose_repl1_intf_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(iterates_MH_fm(\<cdot>\<Union>1 is 0\<cdot>, 9, 2, 1, 0), 3, 1, 0) \<cdot>\<cdot>)"
+definition eclose_closed_fm where "eclose_closed_fm \<equiv> (\<cdot>\<exists>\<cdot>pair_fm(1, 0, 2) \<and> is_wfrec_fm(iterates_MH_fm(\<cdot>\<Union>1 is 0\<cdot>, 9, 2, 1, 0), 3, 1, 0) \<cdot>\<cdot>)"
 
 definition replacement_assm where
   "replacement_assm(M,env,\<phi>) \<equiv> \<phi> \<in> formula \<longrightarrow> env \<in> list(M) \<longrightarrow>
   arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
     strong_replacement(##M,\<lambda>x y. (M , [x,y]@env \<Turnstile> \<phi>))"
 
 definition ground_replacement_assm where
   "ground_replacement_assm(M,env,\<phi>) \<equiv> replacement_assm(M,env,ground_repl_fm(\<phi>))"
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Interface.thy b/thys/Independence_CH/Interface.thy
--- a/thys/Independence_CH/Interface.thy
+++ b/thys/Independence_CH/Interface.thy
@@ -1,1498 +1,1498 @@
 section\<open>Interface between set models and Constructibility\<close>
 
 text\<open>This theory provides an interface between Paulson's
 relativization results and set models of ZFC. In particular,
 it is used to prove that the locale \<^term>\<open>forcing_data\<close> is
 a sublocale of all relevant locales in \<^session>\<open>ZF-Constructible\<close>
 (\<^term>\<open>M_trivial\<close>, \<^term>\<open>M_basic\<close>, \<^term>\<open>M_eclose\<close>, etc).
 
 In order to interpret the locales in \<^session>\<open>ZF-Constructible\<close> we
 introduce new locales, each stronger than the previous one, assuming
 only the instances of Replacement needed to interpret the subsequent
 locales of that session. From the start we assume Separation for
 every internalized formula (with one parameter, but this is not a
 problem since we can use pairing).\<close>
 
 theory Interface
   imports
     Fm_Definitions
     Transitive_Models.Cardinal_AC_Relative
 begin
 
 locale M_Z_basic =
   fixes M
   assumes
     upair_ax:      "upair_ax(##M)" and
     Union_ax:      "Union_ax(##M)" and
     power_ax:      "power_ax(##M)" and
     extensionality:"extensionality(##M)" and
     foundation_ax: "foundation_ax(##M)" and
     infinity_ax:   "infinity_ax(##M)" and
     separation_ax: "\<phi> \<in> formula \<Longrightarrow> env \<in> list(M) \<Longrightarrow>
                     arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<Longrightarrow>
                     separation(##M,\<lambda>x. (M, [x] @ env \<Turnstile> \<phi>))"
 
 locale M_transset =
   fixes M
   assumes
     trans_M:       "Transset(M)"
 
 locale M_Z_trans = M_Z_basic + M_transset
 
 locale M_ZF1 = M_Z_basic +
   assumes
     replacement_ax1:
-    "replacement_assm(M,env,eclose_repl1_intf_fm)"
-    "replacement_assm(M,env,eclose_repl2_intf_fm)"
+    "replacement_assm(M,env,eclose_closed_fm)"
+    "replacement_assm(M,env,eclose_abs_fm)"
     "replacement_assm(M,env,wfrec_rank_fm)"
-    "replacement_assm(M,env,trans_repl_HVFrom_fm)"
+    "replacement_assm(M,env,transrec_VFrom_fm)"
 
 definition instances1_fms where "instances1_fms \<equiv>
-  { eclose_repl1_intf_fm,
-    eclose_repl2_intf_fm,
+  { eclose_closed_fm,
+    eclose_abs_fm,
     wfrec_rank_fm,
-    trans_repl_HVFrom_fm
+    transrec_VFrom_fm
  }"
 
 text\<open>This set has 4 internalized formulas.\<close>
 
 lemmas replacement_instances1_defs =
   list_repl1_intf_fm_def list_repl2_intf_fm_def
   formula_repl1_intf_fm_def formula_repl2_intf_fm_def
-  eclose_repl1_intf_fm_def eclose_repl2_intf_fm_def
-  wfrec_rank_fm_def trans_repl_HVFrom_fm_def tl_repl_intf_fm_def
+  eclose_closed_fm_def eclose_abs_fm_def
+  wfrec_rank_fm_def transrec_VFrom_fm_def tl_repl_intf_fm_def
 
 lemma instances1_fms_type[TC]: "instances1_fms \<subseteq> formula"
   using Lambda_in_M_fm_type
   unfolding replacement_instances1_defs instances1_fms_def by simp
 
 declare (in M_ZF1) replacement_instances1_defs[simp]
 
 locale M_ZF1_trans = M_ZF1 + M_Z_trans
 
 context M_Z_trans
 begin
 
 lemmas transitivity = Transset_intf[OF trans_M]
 
 subsection\<open>Interface with \<^term>\<open>M_trivial\<close>\<close>
 
 lemma zero_in_M:  "0 \<in> M"
 proof -
   obtain z where "empty(##M,z)"  "z\<in>M"
     using empty_intf[OF infinity_ax]
     by auto
   moreover from this
   have "z=0"
     using transitivity empty_def
     by auto
   ultimately
   show ?thesis
     by simp
 qed
 
 lemma separation_in_ctm :
   assumes
     "\<phi> \<in> formula" "env\<in>list(M)"
     "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" and
     satsQ: "\<And>x. x\<in>M \<Longrightarrow> (M, [x]@env \<Turnstile> \<phi>) \<longleftrightarrow> Q(x)"
   shows
     "separation(##M,Q)"
   using assms separation_ax satsQ transitivity
     separation_cong[of "##M" "\<lambda>y. (M, [y]@env \<Turnstile> \<phi>)" "Q"]
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 locale M_ZC_basic = M_Z_basic + M_AC "##M"
 
 locale M_ZFC1 = M_ZF1 + M_ZC_basic
 
 locale M_ZFC1_trans = M_ZF1_trans + M_ZFC1
 
 sublocale M_Z_trans \<subseteq> M_trans "##M"
   using transitivity zero_in_M exI[of "\<lambda>x. x\<in>M"]
   by unfold_locales simp_all
 
 sublocale M_Z_trans \<subseteq> M_trivial "##M"
   using upair_ax Union_ax by unfold_locales
 
 subsection\<open>Interface with \<^term>\<open>M_basic\<close>\<close>
 
 definition Intersection where
   "Intersection(N,B,x) \<equiv> (\<forall>y[N]. y\<in>B \<longrightarrow> x\<in>y)"
 
 synthesize "Intersection" from_definition "Intersection" assuming "nonempty"
 arity_theorem for "Intersection_fm"
 
 definition CartProd where
   "CartProd(N,B,C,z) \<equiv> (\<exists>x[N]. x\<in>B \<and> (\<exists>y[N]. y\<in>C \<and> pair(N,x,y,z)))"
 
 synthesize "CartProd" from_definition "CartProd" assuming "nonempty"
 arity_theorem for "CartProd_fm"
 
 definition ImageSep where
   "ImageSep(N,B,r,y) \<equiv> (\<exists>p[N]. p\<in>r \<and> (\<exists>x[N]. x\<in>B \<and> pair(N,x,y,p)))"
 
 synthesize "ImageSep" from_definition  assuming "nonempty"
 arity_theorem for "ImageSep_fm"
 
 definition Converse where
   "Converse(N,R,z) \<equiv> \<exists>p[N]. p\<in>R \<and> (\<exists>x[N].\<exists>y[N]. pair(N,x,y,p) \<and> pair(N,y,x,z))"
 
 synthesize "Converse" from_definition "Converse" assuming "nonempty"
 arity_theorem for "Converse_fm"
 
 definition Restrict where
   "Restrict(N,A,z) \<equiv> \<exists>x[N]. x\<in>A \<and> (\<exists>y[N]. pair(N,x,y,z))"
 
 synthesize "Restrict" from_definition "Restrict" assuming "nonempty"
 arity_theorem for "Restrict_fm"
 
 definition Comp where
   "Comp(N,R,S,xz) \<equiv> \<exists>x[N]. \<exists>y[N]. \<exists>z[N]. \<exists>xy[N]. \<exists>yz[N].
               pair(N,x,z,xz) \<and> pair(N,x,y,xy) \<and> pair(N,y,z,yz) \<and> xy\<in>S \<and> yz\<in>R"
 
 synthesize "Comp" from_definition "Comp" assuming "nonempty"
 arity_theorem for "Comp_fm"
 
 definition Pred where
   "Pred(N,R,X,y) \<equiv> \<exists>p[N]. p\<in>R \<and> pair(N,y,X,p)"
 
 synthesize "Pred" from_definition "Pred" assuming "nonempty"
 arity_theorem for "Pred_fm"
 
 definition is_Memrel where
   "is_Memrel(N,z) \<equiv> \<exists>x[N]. \<exists>y[N]. pair(N,x,y,z) \<and> x \<in> y"
 
 synthesize "is_Memrel" from_definition "is_Memrel" assuming "nonempty"
 arity_theorem for "is_Memrel_fm"
 
 definition RecFun where
   "RecFun(N,r,f,g,a,b,x) \<equiv> \<exists>xa[N]. \<exists>xb[N].
                     pair(N,x,a,xa) \<and> xa \<in> r \<and> pair(N,x,b,xb) \<and> xb \<in> r \<and>
                     (\<exists>fx[N]. \<exists>gx[N]. fun_apply(N,f,x,fx) \<and> fun_apply(N,g,x,gx) \<and>
                                      fx \<noteq> gx)"
 
 synthesize "RecFun" from_definition "RecFun" assuming "nonempty"
 arity_theorem for "RecFun_fm"
 
 arity_theorem for "rtran_closure_mem_fm"
 
 synthesize "wellfounded_trancl" from_definition assuming "nonempty"
 arity_theorem for "wellfounded_trancl_fm"
 
 context M_Z_trans
 begin
 
 lemma inter_sep_intf :
   assumes "A\<in>M"
   shows "separation(##M,\<lambda>x . \<forall>y\<in>M . y\<in>A \<longrightarrow> x\<in>y)"
   using assms separation_in_ctm[of "Intersection_fm(1,0)" "[A]" "Intersection(##M,A)"]
     Intersection_iff_sats[of 1 "[_,A]" A 0 _ M] arity_Intersection_fm Intersection_fm_type
     ord_simp_union zero_in_M
   unfolding Intersection_def
   by simp
 
 lemma diff_sep_intf :
   assumes "B\<in>M"
   shows "separation(##M,\<lambda>x . x\<notin>B)"
   using assms separation_in_ctm[of "Neg(Member(0,1))" "[B]" "\<lambda>x . x\<notin>B"] ord_simp_union
   by simp
 
 lemma cartprod_sep_intf :
   assumes "A\<in>M" and "B\<in>M"
   shows "separation(##M,\<lambda>z. \<exists>x\<in>M. x\<in>A \<and> (\<exists>y\<in>M. y\<in>B \<and> pair(##M,x,y,z)))"
   using assms separation_in_ctm[of "CartProd_fm(1,2,0)" "[A,B]" "CartProd(##M,A,B)"]
     CartProd_iff_sats[of 1 "[_,A,B]" A 2 B 0 _ M] arity_CartProd_fm  CartProd_fm_type
     ord_simp_union zero_in_M
   unfolding CartProd_def
   by simp
 
 lemma image_sep_intf :
   assumes "A\<in>M" and "B\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>p\<in>M. p\<in>B \<and> (\<exists>x\<in>M. x\<in>A \<and> pair(##M,x,y,p)))"
   using assms separation_in_ctm[of "ImageSep_fm(1,2,0)" "[A,B]" "ImageSep(##M,A,B)"]
     ImageSep_iff_sats[of 1 "[_,A,B]" _ 2 _ 0 _ M] arity_ImageSep_fm ImageSep_fm_type
     ord_simp_union zero_in_M
   unfolding ImageSep_def
   by simp
 
 lemma converse_sep_intf :
   assumes "R\<in>M"
   shows "separation(##M,\<lambda>z. \<exists>p\<in>M. p\<in>R \<and> (\<exists>x\<in>M.\<exists>y\<in>M. pair(##M,x,y,p) \<and> pair(##M,y,x,z)))"
   using assms separation_in_ctm[of "Converse_fm(1,0)" "[R]" "Converse(##M,R)"]
     Converse_iff_sats[of 1 "[_,R]" _ 0 _ M] arity_Converse_fm Converse_fm_type
     ord_simp_union zero_in_M
   unfolding Converse_def
   by simp
 
 lemma restrict_sep_intf :
   assumes "A\<in>M"
   shows "separation(##M,\<lambda>z. \<exists>x\<in>M. x\<in>A \<and> (\<exists>y\<in>M. pair(##M,x,y,z)))"
   using assms separation_in_ctm[of "Restrict_fm(1,0)" "[A]" "Restrict(##M,A)"]
     Restrict_iff_sats[of 1 "[_,A]" _ 0 _ M] arity_Restrict_fm Restrict_fm_type
     ord_simp_union zero_in_M
   unfolding Restrict_def
   by simp
 
 lemma comp_sep_intf :
   assumes "R\<in>M" and "S\<in>M"
   shows "separation(##M,\<lambda>xz. \<exists>x\<in>M. \<exists>y\<in>M. \<exists>z\<in>M. \<exists>xy\<in>M. \<exists>yz\<in>M.
            pair(##M,x,z,xz) \<and> pair(##M,x,y,xy) \<and> pair(##M,y,z,yz) \<and> xy\<in>S \<and> yz\<in>R)"
   using assms separation_in_ctm[of "Comp_fm(1,2,0)" "[R,S]" "Comp(##M,R,S)"]
     Comp_iff_sats[of 1 "[_,R,S]" _ 2 _ 0 _ M] arity_Comp_fm Comp_fm_type
     ord_simp_union zero_in_M
   unfolding Comp_def
   by simp
 
 lemma pred_sep_intf:
   assumes "R\<in>M" and "X\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>p\<in>M. p\<in>R \<and> pair(##M,y,X,p))"
   using assms separation_in_ctm[of "Pred_fm(1,2,0)" "[R,X]" "Pred(##M,R,X)"]
     Pred_iff_sats[of 1 "[_,R,X]" _ 2 _ 0 _ M] arity_Pred_fm Pred_fm_type
     ord_simp_union zero_in_M
   unfolding Pred_def
   by simp
 
 lemma memrel_sep_intf:
   "separation(##M, \<lambda>z. \<exists>x\<in>M. \<exists>y\<in>M. pair(##M,x,y,z) \<and> x \<in> y)"
   using separation_in_ctm[of "is_Memrel_fm(0)" "[]" "is_Memrel(##M)"]
     is_Memrel_iff_sats[of 0 "[_]" _ M] arity_is_Memrel_fm is_Memrel_fm_type
     ord_simp_union zero_in_M
   unfolding is_Memrel_def
   by simp
 
 lemma is_recfun_sep_intf :
   assumes "r\<in>M" "f\<in>M" "g\<in>M" "a\<in>M" "b\<in>M"
   shows "separation(##M,\<lambda>x. \<exists>xa\<in>M. \<exists>xb\<in>M.
                     pair(##M,x,a,xa) \<and> xa \<in> r \<and> pair(##M,x,b,xb) \<and> xb \<in> r \<and>
                     (\<exists>fx\<in>M. \<exists>gx\<in>M. fun_apply(##M,f,x,fx) \<and> fun_apply(##M,g,x,gx) \<and>
                                      fx \<noteq> gx))"
   using assms separation_in_ctm[of "RecFun_fm(1,2,3,4,5,0)" "[r,f,g,a,b]" "RecFun(##M,r,f,g,a,b)"]
     RecFun_iff_sats[of 1 "[_,r,f,g,a,b]" _ 2 _ 3 _ 4 _ 5 _ 0 _ M] arity_RecFun_fm RecFun_fm_type
     ord_simp_union zero_in_M
   unfolding RecFun_def
   by simp
 
 lemmas M_basic_sep_instances =
   inter_sep_intf diff_sep_intf cartprod_sep_intf
   image_sep_intf converse_sep_intf restrict_sep_intf
   pred_sep_intf memrel_sep_intf comp_sep_intf is_recfun_sep_intf
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 sublocale M_Z_trans \<subseteq> M_basic_no_repl "##M"
   using power_ax M_basic_sep_instances
   by unfold_locales simp_all
 
 lemma Replace_eq_Collect:
   assumes "\<And>x y y'. x\<in>A \<Longrightarrow> P(x,y) \<Longrightarrow> P(x,y') \<Longrightarrow> y=y'" "{y . x \<in> A, P(x, y)} \<subseteq> B"
   shows "{y . x \<in> A, P(x, y)} = {y\<in>B . \<exists>x\<in>A. P(x,y)}"
   using assms by blast
 
 context M_Z_trans
 begin
 
 lemma Pow_inter_M_closed: assumes "A \<in> M" shows "Pow(A) \<inter> M \<in> M"
 proof -
   have "{a \<in> Pow(A) . a \<in> M} = Pow(A) \<inter> M" by auto
   then
   show ?thesis
     using power_ax powerset_abs assms unfolding power_ax_def
     by auto
 qed
 
 lemma Pow'_inter_M_closed: assumes "A \<in> M" shows "{a \<in> Pow(A) . a \<in> M} \<in> M"
   using power_ax powerset_abs assms unfolding power_ax_def by auto
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 context M_basic_no_repl
 begin
 
 lemma Replace_funspace_succ_rep_intf_sub:
   assumes
     "M(A)" "M(n)"
   shows
     "{z . p \<in> A, funspace_succ_rep_intf_rel(M,p,z,n)}
       \<subseteq> Pow\<^bsup>M\<^esup>(Pow\<^bsup>M\<^esup>(\<Union>domain(A) \<union> ({n} \<times> range(A)) \<union> (\<Union>({n} \<times> range(A)))))"
   unfolding funspace_succ_rep_intf_rel_def using assms mem_Pow_rel_abs
   by clarsimp (auto simp: cartprod_def)
 
 lemma funspace_succ_rep_intf_uniq:
   assumes
     "funspace_succ_rep_intf_rel(M,p,z,n)" "funspace_succ_rep_intf_rel(M,p,z',n)"
   shows
     "z = z'"
   using assms unfolding funspace_succ_rep_intf_rel_def by auto
 
 lemma Replace_funspace_succ_rep_intf_eq:
   assumes
     "M(A)" "M(n)"
   shows
     "{z . p \<in> A, funspace_succ_rep_intf_rel(M,p,z,n)} =
      {z \<in> Pow\<^bsup>M\<^esup>(Pow\<^bsup>M\<^esup>(\<Union>domain(A) \<union> ({n} \<times> range(A)) \<union> (\<Union>({n} \<times> range(A))))) .
         \<exists>p\<in>A. funspace_succ_rep_intf_rel(M,p,z,n)}"
   using assms Replace_eq_Collect[OF funspace_succ_rep_intf_uniq, of A,
       OF _ _ Replace_funspace_succ_rep_intf_sub[of A n], of "\<lambda>x y z. x" "\<lambda>x y z. n"]
   by (intro equalityI)
     (auto dest:transM simp:funspace_succ_rep_intf_rel_def)
 
 end \<comment> \<open>\<^locale>\<open>M_basic_no_repl\<close>\<close>
 
 definition fsri where
   "fsri(N,A,B) \<equiv> \<lambda>z. \<exists>p\<in>A. \<exists>f[N]. \<exists>b[N]. p = \<langle>f, b\<rangle> \<and> z = {cons(\<langle>B, b\<rangle>, f)}"
 
 relationalize "fsri" "is_fsri"
 synthesize "is_fsri" from_definition assuming "nonempty"
 arity_theorem for "is_fsri_fm"
 
 
 context M_Z_trans
 begin
 
 lemma separation_fsri:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> separation(##M, is_fsri(##M,A,B))"
   using separation_in_ctm[where env="[A,B]" and \<phi>="is_fsri_fm(1,2,0)"]
     zero_in_M is_fsri_iff_sats[symmetric] arity_is_fsri_fm is_fsri_fm_type
   by (simp_all add: ord_simp_union)
 
 lemma separation_funspace_succ_rep_intf_rel:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> separation(##M, \<lambda>z. \<exists>p\<in>A. funspace_succ_rep_intf_rel(##M,p,z,B))"
   using separation_fsri zero_in_M
   by (rule_tac separation_cong[THEN iffD1, of _ "is_fsri(##M,A,B)"])
     (auto simp flip:setclass_iff dest:transM
       simp:is_fsri_def funspace_succ_rep_intf_rel_def, force)
 
 lemma Replace_funspace_succ_rep_intf_in_M:
   assumes
     "A \<in> M" "n \<in> M"
   shows
     "{z . p \<in> A, funspace_succ_rep_intf_rel(##M,p,z,n)} \<in> M"
 proof -
   have "(##M)({z \<in> Pow\<^bsup>M\<^esup>(Pow\<^bsup>M\<^esup>(\<Union>domain(A) \<union> ({n} \<times> range(A)) \<union> (\<Union>({n} \<times> range(A))))) .
         \<exists>p\<in>A. funspace_succ_rep_intf_rel(##M,p,z,n)})"
     using assms separation_funspace_succ_rep_intf_rel
     by (intro separation_closed) (auto simp flip:setclass_iff)
   with assms
   show ?thesis
     using Replace_funspace_succ_rep_intf_eq by auto
 qed
 
 lemma funspace_succ_rep_intf:
   assumes "n\<in>M"
   shows
     "strong_replacement(##M,
           \<lambda>p z. \<exists>f\<in>M. \<exists>b\<in>M. \<exists>nb\<in>M. \<exists>cnbf\<in>M.
                 pair(##M,f,b,p) \<and> pair(##M,n,b,nb) \<and> is_cons(##M,nb,f,cnbf) \<and>
                 upair(##M,cnbf,cnbf,z))"
   using assms pair_in_M_iff[simplified] cons_closed[simplified]
   unfolding strong_replacement_def univalent_def
   apply (clarsimp, rename_tac A)
   apply (rule_tac x="{z . p \<in> A, funspace_succ_rep_intf_rel(##M,p,z,n)}" in bexI)
    apply (auto simp:funspace_succ_rep_intf_rel_def
       Replace_funspace_succ_rep_intf_in_M[unfolded funspace_succ_rep_intf_rel_def, simplified])
   done
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 sublocale M_Z_trans \<subseteq> M_basic "##M"
   using power_ax M_basic_sep_instances funspace_succ_rep_intf
   by unfold_locales auto
 
 subsection\<open>Interface with \<^term>\<open>M_trancl\<close>\<close>
 
 context M_ZF1_trans
 begin
 
 lemma rtrancl_separation_intf:
   assumes "r\<in>M" "A\<in>M"
   shows "separation (##M, rtran_closure_mem(##M,A,r))"
   using assms separation_in_ctm[of "rtran_closure_mem_fm(1,2,0)" "[A,r]" "rtran_closure_mem(##M,A,r)"]
     arity_rtran_closure_mem_fm ord_simp_union zero_in_M
   by simp
 
 lemma wftrancl_separation_intf:
   assumes "r\<in>M" and "Z\<in>M"
   shows "separation (##M, wellfounded_trancl(##M,Z,r))"
   using assms separation_in_ctm[of "wellfounded_trancl_fm(1,2,0)" "[Z,r]" "wellfounded_trancl(##M,Z,r)"]
     arity_wellfounded_trancl_fm ord_simp_union zero_in_M
   by simp
 
 text\<open>To prove \<^term>\<open>nat \<in> M\<close> we get an infinite set \<^term>\<open>I\<close> from \<^term>\<open>infinity_ax\<close>
 closed under \<^term>\<open>0\<close> and \<^term>\<open>succ\<close>; that shows \<^term>\<open>nat\<subseteq>I\<close>. Then we
 can separate \<^term>\<open>I\<close> with the predicate \<^term>\<open>\<lambda>x. x\<in>nat\<close>.\<close>
 lemma finite_sep_intf: "separation(##M, \<lambda>x. x\<in>nat)"
 proof -
   have "(\<forall>v\<in>M. separation(##M,\<lambda>x. (M, [x,v] \<Turnstile> finite_ordinal_fm(0))))"
     using separation_ax arity_finite_ordinal_fm
     by simp
   then
   have "(\<forall>v\<in>M. separation(##M,finite_ordinal(##M)))"
     unfolding separation_def
     by simp
   then
   have "separation(##M,finite_ordinal(##M))"
     using separation_in_ctm zero_in_M
     by auto
   then
   show ?thesis
     unfolding separation_def
     by simp
 qed
 
 lemma nat_subset_I: "\<exists>I\<in>M. nat \<subseteq> I"
 proof -
   have "nat \<subseteq> I"
     if "I\<in>M" and "0\<in>I" and "\<And>x. x\<in>I \<Longrightarrow> succ(x)\<in>I" for I
     using that
     by (rule_tac subsetI,induct_tac x,simp_all)
   moreover
   obtain I where
     "I\<in>M" "0\<in>I" "\<And>x. x\<in>I \<Longrightarrow> succ(x)\<in>I"
     using infinity_ax transitivity
     unfolding infinity_ax_def
     by auto
   ultimately
   show ?thesis
     by auto
 qed
 
 lemma nat_in_M: "nat \<in> M"
 proof -
   have "{x\<in>B . x\<in>A}=A" if "A\<subseteq>B" for A B
     using that by auto
   moreover
   obtain I where
     "I\<in>M" "nat\<subseteq>I"
     using nat_subset_I by auto
   moreover from this
   have "{x\<in>I . x\<in>nat} \<in> M"
     using finite_sep_intf separation_closed[of "\<lambda>x . x\<in>nat"]
     by simp
   ultimately
   show ?thesis
     by simp
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 sublocale M_ZF1_trans \<subseteq> M_trancl "##M"
   using rtrancl_separation_intf wftrancl_separation_intf nat_in_M
     wellfounded_trancl_def
   by unfold_locales auto
 
 subsection\<open>Interface with \<^term>\<open>M_eclose\<close>\<close>
 
 lemma repl_sats:
   assumes
     sat:"\<And>x z. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> (M, Cons(x,Cons(z,env)) \<Turnstile> \<phi>) \<longleftrightarrow> P(x,z)"
   shows
     "strong_replacement(##M,\<lambda>x z. (M, Cons(x,Cons(z,env)) \<Turnstile> \<phi>)) \<longleftrightarrow>
    strong_replacement(##M,P)"
   by (rule strong_replacement_cong,simp add:sat)
 
 arity_theorem for "list_functor_fm"
 arity_theorem for "formula_functor_fm"
 arity_theorem for "Inl_fm"
 arity_theorem for "Inr_fm"
 arity_theorem for "Nil_fm"
 arity_theorem for "Cons_fm"
 arity_theorem for "quasilist_fm"
 arity_theorem for "tl_fm"
 arity_theorem for "big_union_fm"
 
 context M_ZF1_trans
 begin
 
 text\<open>This lemma obtains \<^term>\<open>iterates_replacement\<close> for predicates
 without parameters.\<close>
 lemma iterates_repl_intf :
   assumes
     "v\<in>M" and
     isfm:"is_F_fm \<in> formula" and
     arty:"arity(is_F_fm)=2" and
     satsf: "\<And>a b env'. \<lbrakk> a\<in>M ; b\<in>M ; env'\<in>list(M) \<rbrakk>
               \<Longrightarrow> is_F(a,b) \<longleftrightarrow> (M,  [b,a]@env' \<Turnstile>  is_F_fm)"
     and is_F_fm_replacement:
     "\<And>env. (\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>) \<in> formula \<Longrightarrow> env \<in> list(M) \<Longrightarrow>
       arity((\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>)) \<le> 2 +\<^sub>\<omega> length(env) \<Longrightarrow>
      strong_replacement(##M,\<lambda>x y.
          M, [x,y] @ env \<Turnstile> (\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>))"
   shows
     "iterates_replacement(##M,is_F,v)"
 proof -
   let ?f="(\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>)"
   have "arity(?f) = 4" "?f\<in>formula"
     using arity_iterates_MH_fm[where isF=is_F_fm and i=2]
       arity_wfrec_replacement_fm[where i=10] isfm arty ord_simp_union
     by simp_all
   {
     fix n
     assume "n\<in>nat"
     then
     have "Memrel(succ(n))\<in>M"
       using nat_into_M Memrel_closed
       by simp
     moreover
     {
       fix a0 a1 a2 a3 a4 y x z
       assume "[a0,a1,a2,a3,a4,y,x,z]\<in>list(M)"
       moreover
       note \<open>v\<in>M\<close> \<open>Memrel(succ(n))\<in>M\<close>
       moreover from calculation
       have "(M, [b,a,c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v] \<Turnstile> is_F_fm) \<longleftrightarrow>
            is_F(a,b)"
         if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" for a b c d
         using that satsf[of a b "[c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v]"]
         by simp
       moreover from calculation
       have "(M, [a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v] \<Turnstile> iterates_MH_fm(is_F_fm,9,2,1,0)) \<longleftrightarrow>
            iterates_MH(##M,is_F,v,a2, a1, a0)"
         using sats_iterates_MH_fm[of M "is_F" "is_F_fm"]
         by simp
     }
     moreover from calculation
     have "(M, [y,x,z,Memrel(succ(n)),v] \<Turnstile> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0)) \<longleftrightarrow>
           is_wfrec(##M, iterates_MH(##M,is_F,v),Memrel(succ(n)), x, y)"
       if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
       using that sats_is_wfrec_fm \<open>v\<in>M\<close> by simp
     moreover from calculation
     have "(M, [x,z,Memrel(succ(n)),v] \<Turnstile> ?f) \<longleftrightarrow>
 
         (\<exists>y\<in>M. pair(##M,x,y,z) \<and>
         is_wfrec(##M, iterates_MH(##M,is_F,v) , Memrel(succ(n)), x, y))"
       if "x\<in>M" "z\<in>M" for x z
       using that \<open>v\<in>M\<close>
       by (simp del:pair_abs)
     moreover
     note \<open>arity(?f) = 4\<close> \<open>?f\<in>formula\<close>
     moreover from calculation \<open>v\<in>_\<close>
     have "strong_replacement(##M,\<lambda>x z. (M, [x,z,Memrel(succ(n)),v] \<Turnstile> ?f))"
       using is_F_fm_replacement
       by simp
     ultimately
     have "strong_replacement(##M,\<lambda>x z.
           \<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, iterates_MH(##M,is_F,v) ,
                 Memrel(succ(n)), x, y))"
       using repl_sats[of M ?f "[Memrel(succ(n)),v]"]
       by (simp del:pair_abs)
   }
   then
   show ?thesis
     unfolding iterates_replacement_def wfrec_replacement_def
     by simp
 qed
 
 lemma eclose_repl1_intf:
   assumes "A\<in>M"
   shows "iterates_replacement(##M, big_union(##M), A)"
   using assms arity_big_union_fm
     iterates_repl_intf[where is_F_fm="big_union_fm(1,0)"]
     replacement_ax1(1)[unfolded replacement_assm_def]
     ord_simp_union
   by simp
 
 lemma eclose_repl2_intf:
   assumes "A\<in>M"
   shows "strong_replacement(##M,\<lambda>n y. n\<in>nat \<and> is_iterates(##M, big_union(##M), A, n, y))"
 proof -
   let ?f = "And(Member(0,3),is_iterates_fm(big_union_fm(1,0),2,0,1))"
   note nat_in_M \<open>A\<in>M\<close>
   moreover from this
   have "big_union(##M,a,b) \<longleftrightarrow>
         (M, [b,a,c,d,e,f,g,h,i,j,k,n,y,A,nat] \<Turnstile> big_union_fm(1,0))"
     if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "f\<in>M""g\<in>M""h\<in>M""i\<in>M""j\<in>M" "k\<in>M" "n\<in>M" "y\<in>M"
     for a b c d e f g h i j k n y
     using that by simp
   moreover from calculation
   have "(M, [n,y,A,nat] \<Turnstile> is_iterates_fm(big_union_fm(1,0),2,0,1)) \<longleftrightarrow>
            is_iterates(##M, big_union(##M), A, n , y)"
     if "n\<in>M" "y\<in>M" for n y
     using that sats_is_iterates_fm[of M "big_union(##M)"]
     by simp
   moreover from calculation
   have "(M, [n,y,A,nat] \<Turnstile> ?f) \<longleftrightarrow>
         n\<in>nat \<and> is_iterates(##M, big_union(##M), A, n, y)"
     if "n\<in>M" "y\<in>M" for n y
     using that
     by simp
   moreover
   have "arity(?f) = 4"
     using arity_is_iterates_fm[where p="big_union_fm(1,0)" and i=2]
       arity_big_union_fm arity_And ord_simp_union
     by simp
   ultimately
   show ?thesis
     using repl_sats[of M ?f "[A,nat]"] replacement_ax1(2)[unfolded replacement_assm_def]
     by simp
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 sublocale M_ZF1_trans \<subseteq> M_eclose "##M"
   using eclose_repl1_intf eclose_repl2_intf
   by unfold_locales auto
 
 text\<open>Interface with \<^locale>\<open>M_eclose\<close>.\<close>
 
 schematic_goal sats_is_Vset_fm_auto:
   assumes
     "i\<in>nat" "v\<in>nat" "env\<in>list(A)" "0\<in>A"
     "i < length(env)" "v < length(env)"
   shows
     "is_Vset(##A,nth(i, env),nth(v, env)) \<longleftrightarrow> (A, env \<Turnstile> ?ivs_fm(i,v))"
   unfolding is_Vset_def is_Vfrom_def
   by (insert assms; (rule sep_rules is_HVfrom_iff_sats is_transrec_iff_sats | simp)+)
 
 synthesize "is_Vset" from_schematic "sats_is_Vset_fm_auto"
 arity_theorem for "is_Vset_fm"
 
 declare is_Hrank_fm_def[fm_definitions add]
 
 context M_ZF1_trans
 begin
 
 lemma wfrec_rank :
   assumes "X\<in>M"
   shows "wfrec_replacement(##M,is_Hrank(##M),rrank(X))"
 proof -
   let ?f="Exists(And(pair_fm(1,0,2),is_wfrec_fm(is_Hrank_fm(2,1,0),3,1,0)))"
   note assms zero_in_M
   moreover from this
   have
     "is_Hrank(##M,a2, a1, a0) \<longleftrightarrow>
              (M, [a0,a1,a2,a3,a4,y,x,z,rrank(X)] \<Turnstile> is_Hrank_fm(2,1,0))"
     if "a4\<in>M" "a3\<in>M" "a2\<in>M" "a1\<in>M" "a0\<in>M" "y\<in>M" "x\<in>M" "z\<in>M" for a4 a3 a2 a1 a0 y x z
     using that rrank_in_M is_Hrank_iff_sats
     by simp
   moreover from calculation
   have "(M, [y,x,z,rrank(X)] \<Turnstile> is_wfrec_fm(is_Hrank_fm(2,1,0),3,1,0)) \<longleftrightarrow>
    is_wfrec(##M, is_Hrank(##M) ,rrank(X), x, y)"
     if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
     using that rrank_in_M sats_is_wfrec_fm
     by simp
   moreover from calculation
   have "(M, [x,z,rrank(X)] \<Turnstile> ?f) \<longleftrightarrow>
                (\<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, is_Hrank(##M) , rrank(X), x, y))"
     if "x\<in>M" "z\<in>M" for x z
     using that rrank_in_M
     by (simp del:pair_abs)
   moreover
   have "arity(?f) = 3"
     using arity_wfrec_replacement_fm[where p="is_Hrank_fm(2,1,0)" and i=3,simplified]
       arity_is_Hrank_fm[of 2 1 0,simplified] ord_simp_union
     by simp
   moreover from calculation
   have "strong_replacement(##M,\<lambda>x z. (M, [x,z,rrank(X)] \<Turnstile> ?f))"
     using replacement_ax1(3)[unfolded replacement_assm_def] rrank_in_M
     by simp
   ultimately
   show ?thesis
     using repl_sats[of M ?f "[rrank(X)]"]
     unfolding wfrec_replacement_def
     by (simp del:pair_abs)
 qed
 
 lemma trans_repl_HVFrom :
   assumes "A\<in>M" "i\<in>M"
   shows "transrec_replacement(##M,is_HVfrom(##M,A),i)"
 proof -
   let ?f="Exists(And(pair_fm(1,0,2),is_wfrec_fm(is_HVfrom_fm(8,2,1,0),4,1,0)))"
   note facts = assms zero_in_M
   moreover
   have "\<exists>sa\<in>M. \<exists>esa\<in>M. \<exists>mesa\<in>M.
        upair(##M,a,a,sa) \<and> is_eclose(##M,sa,esa) \<and> membership(##M,esa,mesa)"
     if "a\<in>M" for a
     using that upair_ax eclose_closed Memrel_closed
     unfolding upair_ax_def
     by (simp del:upair_abs)
   moreover
   {
     fix mesa
     assume "mesa\<in>M"
     moreover
     note facts
     moreover from calculation
     have "is_HVfrom(##M,A,a2, a1, a0) \<longleftrightarrow>
       (M, [a0,a1,a2,a3,a4,y,x,z,A,mesa] \<Turnstile> is_HVfrom_fm(8,2,1,0))"
       if "a4\<in>M" "a3\<in>M" "a2\<in>M" "a1\<in>M" "a0\<in>M" "y\<in>M" "x\<in>M" "z\<in>M" for a4 a3 a2 a1 a0 y x z
       using that sats_is_HVfrom_fm
       by simp
     moreover from calculation
     have "(M, [y,x,z,A,mesa] \<Turnstile> is_wfrec_fm(is_HVfrom_fm(8,2,1,0),4,1,0)) \<longleftrightarrow>
          is_wfrec(##M, is_HVfrom(##M,A),mesa, x, y)"
       if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
       using that sats_is_wfrec_fm
       by simp
     moreover from calculation
     have "(M, [x,z,A,mesa] \<Turnstile> ?f) \<longleftrightarrow>
                (\<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, is_HVfrom(##M,A) , mesa, x, y))"
       if "x\<in>M" "z\<in>M" for x z
       using that
       by (simp del:pair_abs)
     moreover
     have "arity(?f) = 4"
       using arity_wfrec_replacement_fm[where p="is_HVfrom_fm(8,2,1,0)" and i=9]
         arity_is_HVfrom_fm ord_simp_union
       by simp
     moreover from calculation
     have "strong_replacement(##M,\<lambda>x z. (M, [x,z,A,mesa] \<Turnstile> ?f))"
       using replacement_ax1(4)[unfolded replacement_assm_def]
       by simp
     ultimately
     have "wfrec_replacement(##M,is_HVfrom(##M,A),mesa)"
       using repl_sats[of M ?f "[A,mesa]"]
       unfolding wfrec_replacement_def
       by (simp del:pair_abs)
   }
   ultimately
   show ?thesis
     unfolding transrec_replacement_def
     by simp
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 subsection\<open>Interface for proving Collects and Replace in M.\<close>
 context M_ZF1_trans
 begin
 
 lemma Collect_in_M :
   assumes
     "\<phi> \<in> formula" "env\<in>list(M)"
     "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" "A\<in>M" and
     satsQ: "\<And>x. x\<in>M \<Longrightarrow> (M, [x]@env \<Turnstile> \<phi>) \<longleftrightarrow> Q(x)"
   shows
     "{y\<in>A . Q(y)}\<in>M"
 proof -
   have "separation(##M,\<lambda>x. (M, [x] @ env \<Turnstile> \<phi>))"
     using assms separation_ax by simp
   then
   show ?thesis
     using \<open>A\<in>M\<close> satsQ transitivity separation_closed
       separation_cong[of "##M" "\<lambda>y. (M, [y]@env \<Turnstile> \<phi>)" "Q"]
     by simp
 qed
 
 \<comment> \<open>This version has a weaker assumption.\<close>
 lemma separation_in_M :
   assumes
     "\<phi> \<in> formula" "env\<in>list(M)"
     "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" "A\<in>M" and
     satsQ: "\<And>x. x\<in>A \<Longrightarrow> (M, [x]@env \<Turnstile> \<phi>) \<longleftrightarrow> Q(x)"
   shows
     "{y\<in>A . Q(y)} \<in> M"
 proof -
   let ?\<phi>' = "And(\<phi>,Member(0,length(env)+\<^sub>\<omega>1))"
   note assms
   moreover
   have "arity(?\<phi>') \<le> 1 +\<^sub>\<omega> length(env@[A])"
     using assms Un_le le_trans[of "arity(\<phi>)" "1+\<^sub>\<omega>length(env)" "2+\<^sub>\<omega>length(env)"]
     by (force simp:FOL_arities)
   moreover from calculation
   have "?\<phi>'\<in>formula" "nth(length(env), env @ [A]) = A"
     using nth_append
     by auto
   moreover from calculation
   have "\<And> x . x \<in> M \<Longrightarrow> (M, [x]@env@[A] \<Turnstile> ?\<phi>') \<longleftrightarrow> Q(x) \<and> x\<in>A"
     using arity_sats_iff[of _ "[A]" _ "[_]@env"]
     by auto
   ultimately
   show ?thesis
     using Collect_in_M[of ?\<phi>' "env@[A]" _ "\<lambda>x . Q(x) \<and> x\<in>A", OF _ _ _ \<open>A\<in>M\<close>]
     by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 context M_Z_trans
 begin
 
 lemma strong_replacement_in_ctm:
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>M \<Longrightarrow> f(x) \<in> M" and
     phi_replacement:"replacement_assm(M,env,\<phi>)" and
     "env\<in>list(M)"
   shows "strong_replacement(##M, \<lambda>x y . y = f(x))"
   using assms
     strong_replacement_cong[of "##M" "\<lambda>x y. M,[x,y]@env\<Turnstile>\<phi>" "\<lambda>x y. y = f(x)"]
   unfolding replacement_assm_def
   by auto
 
 lemma strong_replacement_rel_in_ctm :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> f(x,y)"  and
     phi_replacement:"replacement_assm(M,env,\<phi>)" and
     "env\<in>list(M)"
   shows "strong_replacement(##M, f)"
   using assms
     strong_replacement_cong[of "##M" "\<lambda>x y. M,[x,y]@env\<Turnstile>\<phi>" "f"]
   unfolding replacement_assm_def
   by auto
 
 lemma Replace_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>A \<Longrightarrow> f(x) \<in> M"  and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement:"replacement_assm(M,env@[A], \<cdot>\<phi> \<and> \<cdot>0 \<in> length(env) +\<^sub>\<omega> 2\<cdot>\<cdot> )"
   shows "{f(x) . x\<in>A}\<in>M"
 proof -
   let ?\<phi>' = "And(\<phi>,Member(0,length(env)+\<^sub>\<omega>2))"
   note assms
   moreover from this
   have "arity(?\<phi>') \<le> 2 +\<^sub>\<omega> length(env@[A])"
     using Un_le le_trans[of "arity(\<phi>)" "2+\<^sub>\<omega>(length(env))" "3+\<^sub>\<omega>length(env)"]
     by (force simp:FOL_arities)
   moreover from calculation
   have "?\<phi>'\<in>formula" "nth(length(env), env @ [A]) = A"
     using nth_append by auto
   moreover from calculation
   have "\<And> x y. x \<in> M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env@[A]\<Turnstile>?\<phi>') \<longleftrightarrow> y=f(x) \<and>x\<in>A"
     using arity_sats_iff[of _ "[A]" _ "[_,_]@env"]
     by auto
   moreover from calculation
   have "strong_replacement(##M, \<lambda>x y. M,[x,y]@env@[A] \<Turnstile> ?\<phi>')"
     using phi'_replacement assms(1-6) unfolding replacement_assm_def by simp
   ultimately
   have 4:"strong_replacement(##M, \<lambda>x y. y = f(x) \<and> x\<in>A)"
     using
       strong_replacement_cong[of "##M" "\<lambda>x y. M,[x,y]@env@[A]\<Turnstile>?\<phi>'" "\<lambda>x y. y = f(x) \<and> x\<in>A"]
     by simp
   then
   have "{y . x\<in>A , y = f(x)} \<in> M"
     using \<open>A\<in>M\<close> strong_replacement_closed[OF 4,of A] fclosed by simp
   moreover
   have "{f(x). x\<in>A} = { y . x\<in>A , y = f(x)}"
     by auto
   ultimately
   show ?thesis by simp
 qed
 
 lemma Replace_relativized_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,y)" and
     fabs:  "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>A \<Longrightarrow> f(x) \<in> M"  and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement:"replacement_assm(M,env@[A], \<cdot>\<phi> \<and> \<cdot>0 \<in> length(env) +\<^sub>\<omega> 2\<cdot>\<cdot> )"
   shows "{f(x) . x\<in>A}\<in>M"
   using assms Replace_in_M[of \<phi>] by auto
 
 lemma ren_action :
   assumes
     "env\<in>list(M)" "x\<in>M" "y\<in>M" "z\<in>M"
   shows "\<forall> i . i < 2+\<^sub>\<omega>length(env) \<longrightarrow>
           nth(i,[x,z]@env) = nth(\<rho>_repl(length(env))`i,[z,x,y]@env)"
 proof -
   let ?f="{\<langle>0, 1\<rangle>, \<langle>1, 0\<rangle>}"
   have 1:"(\<And>j. j < length(env) \<Longrightarrow> nth(j, env) = nth(id(length(env)) ` j, env))"
     using assms ltD by simp
   have 2:"nth(j, [x,z]) = nth(?f ` j, [z,x,y])" if "j<2" for j
   proof -
     consider "j=0" | "j=1" using  ltD[OF \<open>j<2\<close>] by auto
     then show ?thesis
     proof(cases)
       case 1
       then show ?thesis using apply_equality f_type by simp
     next
       case 2
       then show ?thesis using apply_equality f_type by simp
     qed
   qed
   show ?thesis
     using sum_action[OF _ _ _ _ f_type id_type _ _ _ _ _ _ _ 2 1,simplified] assms
     unfolding \<rho>_repl_def by simp
 qed
 
 lemma Lambda_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,y)" and
     fabs:  "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>A \<Longrightarrow> f(x) \<in> M" and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement2: "replacement_assm(M,env@[A],Lambda_in_M_fm(\<phi>,length(env)))"
   shows "(\<lambda>x\<in>A . f(x)) \<in>M"
   unfolding lam_def
 proof -
   let ?ren="\<rho>_repl(length(env))"
   let ?j="2+\<^sub>\<omega>length(env)"
   let ?k="3+\<^sub>\<omega>length(env)"
   let ?\<psi>="ren(\<phi>)`?j`?k`?ren"
   let ?\<phi>'="Exists(And(pair_fm(1,0,2),?\<psi>))"
   let ?p="\<lambda>x y. \<exists>z\<in>M. pair(##M,x,z,y) \<and> is_f(x,z)"
   have "?\<phi>'\<in>formula" "?\<psi>\<in>formula"
     using \<open>env\<in>_\<close> length_type f_fm ren_type ren_tc[of \<phi> "2+\<^sub>\<omega>length(env)" "3+\<^sub>\<omega>length(env)" ?ren]
     by simp_all
   moreover from this
   have "arity(?\<psi>)\<le>3+\<^sub>\<omega>(length(env))" "arity(?\<psi>)\<in>nat"
     using assms arity_ren[OF f_fm _ _ ren_type,of "length(env)"] by simp_all
   then
   have "arity(?\<phi>') \<le> 2+\<^sub>\<omega>(length(env))"
     using Un_le pred_Un_distrib assms pred_le
     by (simp add:arity)
   moreover from this calculation
   have "x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(x,y)" for x y
     using \<open>env\<in>_\<close> length_type[OF \<open>env\<in>_\<close>] assms transitivity[OF _ \<open>A\<in>M\<close>]
       sats_iff_sats_ren[OF f_fm _ _ _ _ ren_type f_ar ren_action[rule_format,of _ x y],of _ M ]
     by auto
   moreover
   have "x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> ?p(x,y) \<longleftrightarrow> y = <x,f(x)>" for x y
     using assms transitivity[OF _ \<open>A\<in>_\<close>] fclosed
     by simp
   moreover
   have "\<And> x . x\<in>A \<Longrightarrow> <x,f(x)> \<in> M"
     using transitivity[OF _ \<open>A\<in>M\<close>] pair_in_M_iff fclosed by simp
   ultimately
   show "{\<langle>x,f(x)\<rangle> . x\<in>A } \<in> M"
     using Replace_in_M[of ?\<phi>' env A] phi'_replacement2 \<open>A\<in>M\<close> \<open>env\<in>_\<close>
     by simp
 qed
 
 lemma ren_action' :
   assumes
     "env\<in>list(M)" "x\<in>M" "y\<in>M" "z\<in>M" "u\<in>M"
   shows "\<forall> i . i < 3+\<^sub>\<omega>length(env) \<longrightarrow>
           nth(i,[x,z,u]@env) = nth(\<rho>_pair_repl(length(env))`i,[x,z,y,u]@env)"
 proof -
   let ?f="{\<langle>0, 0\<rangle>, \<langle>1, 1\<rangle>, \<langle>2,3\<rangle>}"
   have 1:"(\<And>j. j < length(env) \<Longrightarrow> nth(j, env) = nth(id(length(env)) ` j, env))"
     using assms ltD by simp
   have 2:"nth(j, [x,z,u]) = nth(?f ` j, [x,z,y,u])" if "j<3" for j
   proof -
     consider "j=0" | "j=1" | "j=2" using  ltD[OF \<open>j<3\<close>] by auto
     then show ?thesis
     proof(cases)
       case 1
       then show ?thesis using apply_equality f_type' by simp
     next
       case 2
       then show ?thesis using apply_equality f_type' by simp
     next
       case 3
       then show ?thesis using apply_equality f_type' by simp
     qed
   qed
   show ?thesis
     using sum_action[OF _ _ _ _ f_type' id_type _ _ _ _ _ _ _ 2 1,simplified] assms
     unfolding \<rho>_pair_repl_def by simp
 qed
 
 lemma LambdaPair_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 3 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> (M,[x,z,r]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,z,r)" and
     fabs:  "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> is_f(x,z,r) \<longleftrightarrow> r = f(x,z)" and
     fclosed: "\<And>x z. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> f(x,z) \<in> M" and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement3: "replacement_assm(M,env@[A],LambdaPair_in_M_fm(\<phi>,length(env)))"
   shows "(\<lambda>x\<in>A . f(fst(x),snd(x))) \<in>M"
 proof -
   let ?ren="\<rho>_pair_repl(length(env))"
   let ?j="3+\<^sub>\<omega>length(env)"
   let ?k="4+\<^sub>\<omega>length(env)"
   let ?\<psi>="ren(\<phi>)`?j`?k`?ren"
   let ?\<phi>'="Exists(Exists(And(fst_fm(2,0),(And(snd_fm(2,1),?\<psi>)))))"
   let ?p="\<lambda>x y. is_f(fst(x),snd(x),y)"
   have "?\<phi>'\<in>formula" "?\<psi>\<in>formula"
     using \<open>env\<in>_\<close> length_type f_fm ren_type' ren_tc[of \<phi> ?j ?k ?ren]
     by simp_all
   moreover from this
   have "arity(?\<psi>)\<le>4+\<^sub>\<omega>(length(env))" "arity(?\<psi>)\<in>nat"
     using assms arity_ren[OF f_fm _ _ ren_type',of "length(env)"] by simp_all
   moreover from calculation
   have 1:"arity(?\<phi>') \<le> 2+\<^sub>\<omega>(length(env))" "?\<phi>'\<in>formula"
     using Un_le pred_Un_distrib assms pred_le
     by (simp_all add:arity)
   moreover from this calculation
   have 2:"x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(x,y)" for x y
     using
       sats_iff_sats_ren[OF f_fm _ _ _ _ ren_type' f_ar
         ren_action'[rule_format,of _ "fst(x)" x "snd(x)" y],simplified]
       \<open>env\<in>_\<close> length_type[OF \<open>env\<in>_\<close>] transitivity[OF _ \<open>A\<in>M\<close>]
       fst_snd_closed pair_in_M_iff fsats[of "fst(x)" "snd(x)" y,symmetric]
       fst_abs snd_abs
     by auto
   moreover from assms
   have 3:"x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> ?p(x,y) \<longleftrightarrow> y = f(fst(x),snd(x))" for x y
     using fclosed fst_snd_closed pair_in_M_iff fabs transitivity
     by auto
   moreover
   have 4:"\<And> x . x\<in>A \<Longrightarrow> <x,f(fst(x),snd(x))> \<in> M" "\<And> x . x\<in>A \<Longrightarrow> f(fst(x),snd(x)) \<in> M"
     using transitivity[OF _ \<open>A\<in>M\<close>] pair_in_M_iff fclosed fst_snd_closed
     by simp_all
   ultimately
   show ?thesis
     using Lambda_in_M[unfolded Lambda_in_M_fm_def, of ?\<phi>', OF _ _ _ _ _ _ _
         phi'_replacement3[unfolded LambdaPair_in_M_fm_def]]
       \<open>env\<in>_\<close> \<open>A\<in>_\<close> by simp
 
 qed
 
 lemma (in M_ZF1_trans) lam_replacement2_in_ctm :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 3 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> (M,[x,z,r]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,z,r)" and
     fabs:  "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> is_f(x,z,r) \<longleftrightarrow> r = f(x,z)" and
     fclosed: "\<And>x z. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> f(x,z) \<in> M" and
     "env\<in>list(M)" and
     phi'_replacement3: "\<And>A. A\<in>M \<Longrightarrow> replacement_assm(M,env@[A],LambdaPair_in_M_fm(\<phi>,length(env)))"
   shows "lam_replacement(##M , \<lambda>x . f(fst(x),snd(x)))"
   using
     LambdaPair_in_M fabs
     f_ar ord_simp_union transitivity assms fst_snd_closed
   by (rule_tac lam_replacement_iff_lam_closed[THEN iffD2],simp_all)
 
 simple_rename "ren_U" src "[z1,x_P, x_leq, x_o, x_t, z2_c]"
   tgt "[z2_c,z1,z,x_P, x_leq, x_o, x_t]"
 
 simple_rename "ren_V" src "[fz,x_P, x_leq, x_o,x_f, x_t, gz]"
   tgt "[gz,fz,z,x_P, x_leq, x_o,x_f, x_t]"
 
 simple_rename "ren_V3" src "[fz,x_P, x_leq, x_o,x_f, gz, hz]"
   tgt "[hz,gz,fz,z,x_P, x_leq, x_o,x_f]"
 
 lemma separation_sat_after_function_1:
   assumes "[a,b,c,d]\<in>list(M)" and  "\<chi>\<in>formula" and "arity(\<chi>) \<le> 6"
     and
     f_fm:  "f_fm \<in> formula" and
     f_ar:  "arity(f_fm) \<le> 6" and
     fsats: "\<And> fx x. fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[fx,x]@[a, b, c, d] \<Turnstile> f_fm) \<longleftrightarrow> fx=f(x)" and
     fclosed: "\<And>x . x\<in>M \<Longrightarrow> f(x) \<in> M" and
     g_fm:  "g_fm \<in> formula" and
     g_ar:  "arity(g_fm) \<le> 7" and
     gsats: "\<And> gx fx x. gx\<in>M \<Longrightarrow>  fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[gx,fx,x]@[a, b, c, d] \<Turnstile> g_fm) \<longleftrightarrow> gx=g(x)" and
     gclosed: "\<And>x . x\<in>M \<Longrightarrow> g(x) \<in> M"
   shows  "separation(##M, \<lambda>r. M, [f(r), a, b, c, d, g(r)] \<Turnstile> \<chi>)"
 proof -
   note types = assms(1-4)
   let ?\<psi>="ren(\<chi>)`6`7`ren_U_fn"
   let  ?\<psi>'="Exists(And(f_fm,Exists(And(g_fm,?\<psi>))))"
   let ?\<rho>="\<lambda>z.[f(z), a, b, c, d, g(z)]"
   let ?env="[a, b, c, d]"
   let ?\<eta>="\<lambda>z.[g(z),f(z),z]@?env"
   note types
   moreover from this
   have "arity(\<chi>) \<le> 7" "?\<psi>\<in>formula"
     using ord_simp_union ren_tc ren_U_thm(2)[folded ren_U_fn_def] le_trans[of "arity(\<chi>)" 6]
     by simp_all
   moreover from calculation
   have "arity(?\<psi>) \<le> 7" "?\<psi>'\<in>formula"
     using arity_ren ren_U_thm(2)[folded ren_U_fn_def] f_fm g_fm
     by simp_all
   moreover from calculation f_ar g_ar f_fm g_fm
   have "arity(?\<psi>') \<le> 5"
     using ord_simp_union pred_le arity_type
     by (simp add:arity)
   moreover from calculation fclosed gclosed
   have 0:"(M, [f(z), a, b, c, d,  g(z)] \<Turnstile> \<chi>) \<longleftrightarrow> (M,?\<eta>(z)\<Turnstile> ?\<psi>)" if "(##M)(z)" for z
     using sats_iff_sats_ren[of \<chi> 6 7 _ _ "?\<eta>(z)"]
       ren_U_thm(1)[where A=M,folded ren_U_fn_def] ren_U_thm(2)[folded ren_U_fn_def] that
     by simp
   moreover from calculation
   have 1:"(M,?\<eta>(z)\<Turnstile> ?\<psi>) \<longleftrightarrow> M,[z]@?env\<Turnstile>?\<psi>'" if "(##M)(z)" for z
     using that fsats[OF fclosed[of z],of z]  gsats[of "g(z)" "f(z)" z] fclosed gclosed f_fm g_fm
   proof(rule_tac iffI,simp,rule_tac rev_bexI[where x="f(z)"],simp,(auto)[1])
     assume "M, [z] @ [a, b, c, d] \<Turnstile> (\<cdot>\<exists>\<cdot>f_fm \<and> (\<cdot>\<exists>\<cdot>g_fm \<and> ren(\<chi>) ` 6 ` 7 ` ren_U_fn\<cdot>\<cdot>)\<cdot>\<cdot>)"
     then
     have "\<exists>xa\<in>M. (M, [xa, z, a, b, c, d] \<Turnstile> f_fm) \<and>
           (\<exists>x\<in>M. (M, [x, xa, z, a, b, c, d] \<Turnstile> g_fm) \<and>
             (M, [x, xa, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 6 ` 7 ` ren_U_fn))"
       using that calculation by auto
     then
     obtain xa x where "x\<in>M" "xa\<in>M" "M, [xa, z, a, b, c, d] \<Turnstile> f_fm"
       "(M, [x, xa, z, a, b, c, d] \<Turnstile> g_fm)"
       "(M, [x, xa, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 6 ` 7 ` ren_U_fn)"
       using that calculation by auto
     moreover from this
     have "xa=f(z)" "x=g(z)" using fsats[of xa]  gsats[of x xa] that by simp_all
     ultimately
     show "M, [g(z), f(z), z] @ [a, b, c, d] \<Turnstile> ren(\<chi>) ` 6 ` 7 ` ren_U_fn"
       by auto
   qed
   moreover from calculation
   have "separation(##M, \<lambda>z. (M,[z]@?env \<Turnstile> ?\<psi>'))"
     using separation_ax
     by simp_all
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2,OF iff_trans[OF 0 1]],clarify,force)
 qed
 
 lemma separation_sat_after_function3:
   assumes "[a, b, c, d]\<in>list(M)" and  "\<chi>\<in>formula" and "arity(\<chi>) \<le> 7"
     and
     f_fm:  "f_fm \<in> formula" and
     f_ar:  "arity(f_fm) \<le> 6" and
     fsats: "\<And> fx x. fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[fx,x]@[a, b, c, d] \<Turnstile> f_fm) \<longleftrightarrow> fx=f(x)" and
     fclosed: "\<And>x . x\<in>M \<Longrightarrow> f(x) \<in> M" and
     g_fm:  "g_fm \<in> formula" and
     g_ar:  "arity(g_fm) \<le> 7" and
     gsats: "\<And> gx fx x. gx\<in>M \<Longrightarrow> fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[gx,fx,x]@[a, b, c, d] \<Turnstile> g_fm) \<longleftrightarrow> gx=g(x)" and
     gclosed: "\<And>x . x\<in>M \<Longrightarrow> g(x) \<in> M" and
     h_fm:  "h_fm \<in> formula" and
     h_ar:  "arity(h_fm) \<le> 8" and
     hsats: "\<And> hx gx fx x. hx\<in>M \<Longrightarrow> gx\<in>M \<Longrightarrow> fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[hx,gx,fx,x]@[a, b, c, d] \<Turnstile> h_fm) \<longleftrightarrow> hx=h(x)" and
     hclosed: "\<And>x . x\<in>M \<Longrightarrow> h(x) \<in> M"
   shows  "separation(##M, \<lambda>r. M, [f(r), a, b, c, d, g(r), h(r)] \<Turnstile> \<chi>)"
 proof -
   note types = assms(1-3)
   let ?\<phi>="\<chi>"
   let ?\<psi>="ren(?\<phi>)`7`8`ren_V3_fn"
   let ?\<psi>'="Exists(And(f_fm,Exists(And(g_fm,Exists(And(h_fm,?\<psi>))))))"
   let ?\<rho>="\<lambda>z.[f(z), a, b, c, d,g(z), h(z)]"
   let ?env="[a, b, c, d]"
   let ?\<eta>="\<lambda>z.[h(z),g(z),f(z),z]@?env"
   note types
   moreover from this
   have "?\<phi>\<in>formula" by simp
   moreover from calculation
   have "arity(?\<phi>) \<le> 9" "?\<psi>\<in>formula"
     using ord_simp_union ren_tc ren_V3_thm(2)[folded ren_V3_fn_def] le_trans[of "arity(\<chi>)" 7]
     by simp_all
   moreover from calculation
   have "arity(?\<psi>) \<le> 8" "?\<psi>'\<in>formula"
     using arity_ren ren_V3_thm(2)[folded ren_V3_fn_def] f_fm g_fm h_fm
     by (simp_all)
   moreover from this f_ar g_ar f_fm g_fm h_fm h_ar \<open>?\<psi>'\<in>_\<close>
   have "arity(?\<psi>') \<le> 5"
     using ord_simp_union arity_type nat_into_Ord
     by (simp add:arity,(rule_tac pred_le,simp,rule_tac Un_le,simp)+,simp_all add: \<open>?\<psi>\<in>_\<close>)
   moreover from calculation fclosed gclosed hclosed
   have 0:"(M, ?\<rho>(z) \<Turnstile> ?\<phi>) \<longleftrightarrow> (M,?\<eta>(z)\<Turnstile> ?\<psi>)" if "(##M)(z)" for z
     using sats_iff_sats_ren[of ?\<phi> 7 8 "?\<rho>(z)" M "?\<eta>(z)"]
       ren_V3_thm(1)[where A=M,folded ren_V3_fn_def,simplified] ren_V3_thm(2)[folded ren_V3_fn_def] that
     by simp
   moreover from calculation
   have 1:"(M,?\<eta>(z)\<Turnstile> ?\<psi>) \<longleftrightarrow> M,[z]@?env\<Turnstile>?\<psi>'" if "(##M)(z)" for z
     using that fsats[OF fclosed[of z],of z] gsats[of "g(z)" "f(z)" z]
       hsats[of "h(z)" "g(z)" "f(z)" z]
       fclosed gclosed hclosed f_fm g_fm h_fm
     apply(rule_tac iffI,simp,rule_tac rev_bexI[where x="f(z)"],simp)
      apply(rule_tac conjI,simp,rule_tac rev_bexI[where x="g(z)"],simp)
      apply(rule_tac conjI,simp,rule_tac rev_bexI[where x="h(z)"],simp,rule_tac conjI,simp,simp)
   proof -
     assume "M, [z] @ [a, b, c, d] \<Turnstile> (\<cdot>\<exists>\<cdot>f_fm \<and> (\<cdot>\<exists>\<cdot>g_fm \<and> (\<cdot>\<exists>\<cdot>h_fm \<and> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn\<cdot>\<cdot>)\<cdot>\<cdot>)\<cdot>\<cdot>)"
     with calculation that
     have "\<exists>x\<in>M. (M, [x, z, a, b, c, d] \<Turnstile> f_fm) \<and>
            (\<exists>xa\<in>M. (M, [xa, x, z, a, b, c, d] \<Turnstile> g_fm) \<and> (\<exists>xb\<in>M. (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm) \<and> (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn)))"
       by auto
     with calculation
     obtain x where "x\<in>M" "(M, [x, z, a, b, c, d] \<Turnstile> f_fm)"
       "(\<exists>xa\<in>M. (M, [xa, x, z, a, b, c, d] \<Turnstile> g_fm) \<and> (\<exists>xb\<in>M. (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm) \<and> (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn)))"
       by force
     moreover from this
     have "x=f(z)" using fsats[of x] that by simp
     moreover from calculation
     obtain xa where "xa\<in>M" "(M, [xa, x, z, a, b, c, d] \<Turnstile> g_fm)"
       "(\<exists>xb\<in>M. (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm) \<and> (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn))"
       by auto
     moreover from calculation
     have "xa=g(z)" using gsats[of xa x] that by simp
     moreover from calculation
     obtain xb where "xb\<in>M" "(M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm)"
       "(M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn)"
       by auto
     moreover from calculation
     have "xb=h(z)" using hsats[of xb xa x] that by simp
     ultimately
     show "M, [h(z), g(z), f(z), z] @ [a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn"
       by auto
   qed
   moreover from calculation \<open>?\<psi>'\<in>_\<close>
   have "separation(##M, \<lambda>z. (M,[z]@?env \<Turnstile> ?\<psi>'))"
     using separation_ax
     by simp
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2,OF iff_trans[OF 0 1]],clarify,force)
 qed
 
 lemma separation_sat_after_function:
   assumes "[a, b, c, d, \<tau>]\<in>list(M)" and  "\<chi>\<in>formula" and "arity(\<chi>) \<le> 7"
     and
     f_fm:  "f_fm \<in> formula" and
     f_ar:  "arity(f_fm) \<le> 7" and
     fsats: "\<And> fx x. fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[fx,x]@[a, b, c, d, \<tau>] \<Turnstile> f_fm) \<longleftrightarrow> fx=f(x)" and
     fclosed: "\<And>x . x\<in>M \<Longrightarrow> f(x) \<in> M" and
     g_fm:  "g_fm \<in> formula" and
     g_ar:  "arity(g_fm) \<le> 8" and
     gsats: "\<And> gx fx x. gx\<in>M \<Longrightarrow>  fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[gx,fx,x]@[a, b, c, d, \<tau>] \<Turnstile> g_fm) \<longleftrightarrow> gx=g(x)" and
     gclosed: "\<And>x . x\<in>M \<Longrightarrow> g(x) \<in> M"
   shows  "separation(##M, \<lambda>r. M, [f(r), a, b, c, d, \<tau>, g(r)] \<Turnstile> \<chi>)"
 proof -
   note types = assms(1-3)
   let ?\<phi>="\<chi>"
   let ?\<psi>="ren(?\<phi>)`7`8`ren_V_fn"
   let  ?\<psi>'="Exists(And(f_fm,Exists(And(g_fm,?\<psi>))))"
   let ?\<rho>="\<lambda>z.[f(z), a, b, c, d, \<tau>, g(z)]"
   let ?env="[a, b, c, d, \<tau>]"
   let ?\<eta>="\<lambda>z.[g(z),f(z),z]@?env"
   note types
   moreover from this
   have "?\<phi>\<in>formula" by simp
   moreover from calculation
   have "arity(?\<phi>) \<le> 8" "?\<psi>\<in>formula"
     using ord_simp_union ren_tc ren_V_thm(2)[folded ren_V_fn_def] le_trans[of "arity(\<chi>)" 7]
     by simp_all
   moreover from calculation
   have "arity(?\<psi>) \<le> 8" "?\<psi>'\<in>formula"
     using arity_ren ren_V_thm(2)[folded ren_V_fn_def] f_fm g_fm
     by (simp_all)
   moreover from calculation f_ar g_ar f_fm g_fm
   have "arity(?\<psi>') \<le> 6"
     using ord_simp_union pred_le arity_type
     by (simp add:arity)
   moreover from calculation fclosed gclosed
   have 0:"(M, ?\<rho>(z) \<Turnstile> ?\<phi>) \<longleftrightarrow> (M,?\<eta>(z)\<Turnstile> ?\<psi>)" if "(##M)(z)" for z
     using sats_iff_sats_ren[of ?\<phi> 7 8 "?\<rho>(z)" _ "?\<eta>(z)"]
       ren_V_thm(1)[where A=M,folded ren_V_fn_def] ren_V_thm(2)[folded ren_V_fn_def] that
     by simp
   moreover from calculation
   have 1:"(M,?\<eta>(z)\<Turnstile> ?\<psi>) \<longleftrightarrow> M,[z]@?env\<Turnstile>?\<psi>'" if "(##M)(z)" for z
     using that fsats[OF fclosed[of z],of z]  gsats[of "g(z)" "f(z)" z]
       fclosed gclosed f_fm g_fm
     apply(rule_tac iffI,simp,rule_tac rev_bexI[where x="f(z)"],simp)
      apply(auto)[1]
   proof -
     assume "M, [z] @ [a, b, c, d, \<tau>] \<Turnstile> (\<cdot>\<exists>\<cdot>f_fm \<and> (\<cdot>\<exists>\<cdot>g_fm \<and> ren(\<chi>) ` 7 ` 8 ` ren_V_fn\<cdot>\<cdot>)\<cdot>\<cdot>)"
     then have "\<exists>xa\<in>M. (M, [xa, z, a, b, c, d, \<tau>] \<Turnstile> f_fm) \<and>
        (\<exists>x\<in>M. (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> g_fm) \<and> (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn))"
       using that calculation by auto
     then
     obtain xa where "xa\<in>M" "M, [xa, z, a, b, c, d, \<tau>] \<Turnstile> f_fm"
       "(\<exists>x\<in>M. (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> g_fm) \<and> (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn))"
       by auto
     moreover from this
     have "xa=f(z)" using fsats[of xa] that by simp
     moreover from calculation
     obtain x where "x\<in>M" "M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> g_fm" "M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn"
       by auto
     moreover from calculation
     have "x=g(z)" using gsats[of x xa] that by simp
     ultimately
     show "M, [g(z), f(z), z] @ [a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn"
       by auto
   qed
   moreover from calculation
   have "separation(##M, \<lambda>z. (M,[z]@?env \<Turnstile> ?\<psi>'))"
     using separation_ax
     by simp_all
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2,OF iff_trans[OF 0 1]],clarify,force)
 qed
 end
 
 definition separation_assm_fm :: "[i,i,i] \<Rightarrow> i"
   where
   "separation_assm_fm(A,x,f_fm) \<equiv> (\<cdot>\<exists> (\<cdot>\<exists> \<cdot>\<cdot>0 \<in> A +\<^sub>\<omega> 2\<cdot> \<and> \<cdot>\<cdot>\<langle>0,1\<rangle> is x+\<^sub>\<omega> 2 \<cdot> \<and> f_fm \<cdot>\<cdot>\<cdot>)\<cdot>)" 
 
 lemma separation_assm_fm_type[TC]: 
   "A \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow> separation_assm_fm(A, y,f_fm) \<in> formula"
   unfolding separation_assm_fm_def
   by simp
 
 lemma arity_separation_assm_fm : "A \<in> \<omega> \<Longrightarrow> x \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow>
   arity(separation_assm_fm(A, x, f_fm)) = succ(A) \<union> succ(x) \<union> pred(pred(arity(f_fm)))"
   using pred_Un_distrib
   unfolding separation_assm_fm_def
   by (auto simp add:arity)
 
 definition separation_assm_bin_fm where
   "separation_assm_bin_fm(A,y,f_fm) \<equiv> 
     (\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>(\<cdot>\<cdot>3 \<in> A +\<^sub>\<omega> 4\<cdot> \<and>  \<cdot>\<langle>3,2\<rangle> is y +\<^sub>\<omega> 4\<cdot>\<cdot> ) \<and> \<cdot>f_fm \<and> \<cdot> \<cdot>fst(3) is 0 \<cdot> \<and> \<cdot>snd(3) is 1\<cdot>\<cdot>\<cdot>\<cdot> ) \<cdot>)\<cdot>)\<cdot>)\<cdot>) "
 
 lemma separation_assm_bin_fm_type[TC]: 
   "A \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow> separation_assm_bin_fm(A, y,f_fm) \<in> formula"
   unfolding separation_assm_bin_fm_def
   by simp
 
 lemma arity_separation_assm_bin_fm : "A \<in> \<omega> \<Longrightarrow> x \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow>
   arity(separation_assm_bin_fm(A, x, f_fm)) = succ(A) \<union> succ(x) \<union> (pred^4(arity(f_fm)))"
   using pred_Un_distrib
   unfolding separation_assm_bin_fm_def
   by (auto simp add:arity)
 
 context M_Z_trans
 begin
 
 lemma separation_assm_sats : 
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>) = 2" and
     fsats: "\<And>env x y. env\<in>list(M) \<Longrightarrow> x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,y)" and
     fabs:  "\<And>x y. x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>M \<Longrightarrow> f(x) \<in> M" and
     "A\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, f(x)\<rangle>)"
 proof -
   let ?\<phi>'="separation_assm_fm(1,0,\<phi>)"
   let ?p="\<lambda>y. \<exists>x\<in>M . x\<in>A \<and> y = \<langle>x, f(x)\<rangle>"
   from f_fm
   have "?\<phi>'\<in>formula"
      by simp
   moreover from this f_ar f_fm
   have "arity(?\<phi>') = 2"
     using arity_separation_assm_fm[of 1 0 \<phi>] ord_simp_union  
     by simp
   moreover from \<open>A\<in>M\<close> calculation
   have "separation(##M,\<lambda>y . M,[y,A] \<Turnstile> ?\<phi>')"
     using separation_ax by auto
   moreover
   have "y\<in>M \<Longrightarrow> (M,[y,A] \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(y)" for y
     using assms transitivity[OF _ \<open>A\<in>M\<close>]
     unfolding separation_assm_fm_def
     by auto  
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD1],auto)
 qed
 
 lemma separation_assm_bin_sats :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>) = 3" and
     fsats: "\<And>env x z y. env\<in>list(M) \<Longrightarrow> x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,z,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,z,y)" and
     fabs:  "\<And>x z y. x\<in>M \<Longrightarrow>  z\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,z,y) \<longleftrightarrow> y = f(x,z)" and
     fclosed: "\<And>x z . x\<in>M \<Longrightarrow>  z\<in>M \<Longrightarrow> f(x,z) \<in> M" and
     "A\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, f(fst(x),snd(x))\<rangle>)"
 proof -
   let ?\<phi>'="separation_assm_bin_fm(1,0,\<phi>)"
   let ?p="\<lambda>y. \<exists>x\<in>M . x\<in>A \<and> y = \<langle>x, f(fst(x),snd(x))\<rangle>"
   from f_fm
   have "?\<phi>'\<in>formula"
      by simp
   moreover from this f_ar f_fm
   have "arity(?\<phi>') = 2"
     using arity_separation_assm_bin_fm[of 1 0 \<phi>] ord_simp_union  
     by simp
   moreover from \<open>A\<in>M\<close> calculation
   have "separation(##M,\<lambda>y . M,[y,A] \<Turnstile> ?\<phi>')"
     using separation_ax by auto
   moreover
   have "y\<in>M \<Longrightarrow> (M,[y,A] \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(y)" for y
     using assms transitivity[OF _ \<open>A\<in>M\<close>] pair_in_M_iff fst_abs snd_abs fst_closed snd_closed
     unfolding separation_assm_bin_fm_def
     by auto
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD1],auto)
 qed
 
 lemma separation_Union: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, Union(x)\<rangle>)"
   using separation_assm_sats[of "big_union_fm(0,1)"] arity_big_union_fm ord_simp_union
     Union_closed[simplified]
   by simp
 
 lemma lam_replacement_Union: "lam_replacement(##M, Union)"
   using lam_replacement_Union' separation_Union transM by simp
 
 lemma separation_fst: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, fst(x)\<rangle>)"
   using separation_assm_sats[of "fst_fm(0,1)"] arity_fst_fm ord_simp_union
     fst_closed fst_abs
   by simp
 
 lemma lam_replacement_fst: "lam_replacement(##M, fst)"
   using lam_replacement_fst' separation_fst transM by simp
 
 lemma separation_snd: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, snd(x)\<rangle>)"
   using separation_assm_sats[of "snd_fm(0,1)"] arity_snd_fm ord_simp_union
     snd_closed[simplified] snd_abs
   by simp
 
 lemma lam_replacement_snd: "lam_replacement(##M, snd)"
   using lam_replacement_snd' separation_snd transM by simp
 
 text\<open>Binary lambda-replacements\<close>
 
 lemma separation_Image: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, fst(x) `` snd(x)\<rangle>)"
   using  arity_image_fm ord_simp_union
     nonempty image_closed image_abs
   by (rule_tac separation_assm_bin_sats[of "image_fm(0,1,2)"],auto)
 
 lemma lam_replacement_Image: "lam_replacement(##M, \<lambda>x . fst(x) `` snd(x))"
   using lam_replacement_Image' separation_Image
   by simp
 
 lemma separation_middle_del: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, middle_del(fst(x), snd(x))\<rangle>)"
  using  arity_is_middle_del_fm ord_simp_union nonempty
     fst_abs snd_abs fst_closed snd_closed pair_in_M_iff
   by (rule_tac separation_assm_bin_sats[of "is_middle_del_fm(0,1,2)"],
       auto simp:is_middle_del_def middle_del_def)
 
 lemma lam_replacement_middle_del: "lam_replacement(##M, \<lambda>r . middle_del(fst(r),snd(r)))"
   using lam_replacement_middle_del' separation_middle_del
   by simp
 
 lemma separation_prodRepl: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, prodRepl(fst(x), snd(x))\<rangle>)"
    using  arity_is_prodRepl_fm ord_simp_union nonempty
     fst_abs snd_abs fst_closed snd_closed pair_in_M_iff
   by (rule_tac separation_assm_bin_sats[of "is_prodRepl_fm(0,1,2)"],
       auto simp:is_prodRepl_def prodRepl_def)
 
 lemma lam_replacement_prodRepl: "lam_replacement(##M, \<lambda>r . prodRepl(fst(r),snd(r)))"
   using lam_replacement_prodRepl' separation_prodRepl
   by simp
 
 end  \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 context M_trivial
 begin
 
 lemma first_closed:
   "M(B) \<Longrightarrow> M(r) \<Longrightarrow> first(u,r,B) \<Longrightarrow> M(u)"
   using transM[OF first_is_elem] by simp
 
 is_iff_rel for "first"
   unfolding is_first_def first_rel_def by auto
 
 is_iff_rel for "minimum"
   unfolding is_minimum_def minimum_rel_def
   using is_first_iff The_abs nonempty
   by force
 
 end \<comment> \<open>\<^locale>\<open>M_trivial\<close>\<close>
 
 context M_Z_trans
 begin
 
 lemma (in M_basic) is_minimum_equivalence :
   "M(R) \<Longrightarrow> M(X) \<Longrightarrow> M(u) \<Longrightarrow> is_minimum(M,R,X,u) \<longleftrightarrow> is_minimum'(M,R,X,u)"
   unfolding is_minimum_def is_minimum'_def is_The_def is_first_def by simp
 
 lemma separation_minimum: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, minimum(fst(x), snd(x))\<rangle>)"
   using  arity_minimum_fm ord_simp_union is_minimum_iff minimum_abs
     is_minimum_equivalence nonempty minimum_closed minimum_abs
   by (rule_tac separation_assm_bin_sats[of "minimum_fm(0,1,2)"], auto)
 
 lemma lam_replacement_minimum: "lam_replacement(##M, \<lambda>x . minimum(fst(x),snd(x)))"
   using lam_replacement_minimum' separation_minimum
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Names.thy b/thys/Independence_CH/Names.thy
--- a/thys/Independence_CH/Names.thy
+++ b/thys/Independence_CH/Names.thy
@@ -1,637 +1,641 @@
 section\<open>Names and generic extensions\<close>
 
 theory Names
   imports
     Forcing_Data
     FrecR_Arities
     ZF_Trans_Interpretations
 begin
 
 definition
   Hv :: "[i,i,i]\<Rightarrow>i" where
   "Hv(G,x,f) \<equiv> { z . y\<in> domain(x), (\<exists>p\<in>G. \<langle>y,p\<rangle> \<in> x) \<and> z=f`y}"
 
 text\<open>The funcion \<^term>\<open>val\<close> interprets a name in \<^term>\<open>M\<close>
 according to a (generic) filter \<^term>\<open>G\<close>. Note the definition
 in terms of the well-founded recursor.\<close>
 
 definition
   val :: "[i,i]\<Rightarrow>i" where
   "val(G,\<tau>) \<equiv> wfrec(edrel(eclose({\<tau>})), \<tau> ,Hv(G))"
 
 definition
   GenExt :: "[i,i]\<Rightarrow>i"     ("_[_]" [71,1])
   where "M[G] \<equiv> {val(G,\<tau>). \<tau> \<in> M}"
 
 lemma map_val_in_MG:
   assumes
     "env\<in>list(M)"
   shows
     "map(val(G),env)\<in>list(M[G])"
   unfolding GenExt_def using assms map_type2 by simp
 
 subsection\<open>Values and check-names\<close>
 context forcing_data1
 begin
 
 lemma name_components_in_M:
   assumes "\<langle>\<sigma>,p\<rangle>\<in>\<theta>" "\<theta> \<in> M"
   shows   "\<sigma>\<in>M" "p\<in>M"
   using assms transitivity pair_in_M_iff
   by auto
 
 definition
   Hcheck :: "[i,i] \<Rightarrow> i" where
   "Hcheck(z,f)  \<equiv> { \<langle>f`y,\<one>\<rangle> . y \<in> z}"
 
 definition
   check :: "i \<Rightarrow> i" where
   "check(x) \<equiv> transrec(x , Hcheck)"
 
 lemma checkD:
   "check(x) =  wfrec(Memrel(eclose({x})), x, Hcheck)"
   unfolding check_def transrec_def ..
 
 lemma Hcheck_trancl:"Hcheck(y, restrict(f,Memrel(eclose({x}))-``{y}))
                    = Hcheck(y, restrict(f,(Memrel(eclose({x}))^+)-``{y}))"
   unfolding Hcheck_def
   using restrict_trans_eq by simp
 
 lemma check_trancl: "check(x) = wfrec(rcheck(x), x, Hcheck)"
   using checkD wf_eq_trancl Hcheck_trancl unfolding rcheck_def by simp
 
 lemma rcheck_in_M : "x \<in> M \<Longrightarrow> rcheck(x) \<in> M"
   unfolding rcheck_def by (simp flip: setclass_iff)
 
 lemma rcheck_subset_M : "x \<in> M \<Longrightarrow> field(rcheck(x)) \<subseteq> eclose({x})"
   unfolding rcheck_def using field_Memrel field_trancl by auto
 
 lemma  aux_def_check: "x \<in> y \<Longrightarrow>
   wfrec(Memrel(eclose({y})), x, Hcheck) =
   wfrec(Memrel(eclose({x})), x, Hcheck)"
   by (rule wfrec_eclose_eq,auto simp add: arg_into_eclose eclose_sing)
 
 lemma def_check : "check(y) = { \<langle>check(w),\<one>\<rangle> . w \<in> y}"
 proof -
   let
     ?r="\<lambda>y. Memrel(eclose({y}))"
   have wfr:   "\<forall>w . wf(?r(w))"
     using wf_Memrel ..
   then
   have "check(y)= Hcheck( y, \<lambda>x\<in>?r(y) -`` {y}. wfrec(?r(y), x, Hcheck))"
     using wfrec[of "?r(y)" y "Hcheck"] checkD by simp
   also
   have " ... = Hcheck( y, \<lambda>x\<in>y. wfrec(?r(y), x, Hcheck))"
     using under_Memrel_eclose arg_into_eclose by simp
   also
   have " ... = Hcheck( y, \<lambda>x\<in>y. check(x))"
     using aux_def_check checkD by simp
   finally
   show ?thesis
     using Hcheck_def by simp
 qed
 
 lemma def_checkS :
   fixes n
   assumes "n \<in> nat"
   shows "check(succ(n)) = check(n) \<union> {\<langle>check(n),\<one>\<rangle>}"
 proof -
   have "check(succ(n)) = {\<langle>check(i),\<one>\<rangle> . i \<in> succ(n)} "
     using def_check by blast
   also
   have "... = {\<langle>check(i),\<one>\<rangle> . i \<in> n} \<union> {\<langle>check(n),\<one>\<rangle>}"
     by blast
   also
   have "... = check(n) \<union> {\<langle>check(n),\<one>\<rangle>}"
     using def_check[of n,symmetric] by simp
   finally
   show ?thesis .
 qed
 
 lemma field_Memrel2 :
   assumes "x \<in> M"
   shows "field(Memrel(eclose({x}))) \<subseteq> M"
 proof -
   have "field(Memrel(eclose({x}))) \<subseteq> eclose({x})" "eclose({x}) \<subseteq> M"
     using Ordinal.Memrel_type field_rel_subset assms eclose_least[OF trans_M] by auto
   then
   show ?thesis
     using subset_trans by simp
 qed
 
 lemma aux_def_val:
   assumes "z \<in> domain(x)"
   shows "wfrec(edrel(eclose({x})),z,Hv(G)) = wfrec(edrel(eclose({z})),z,Hv(G))"
 proof -
   let ?r="\<lambda>x . edrel(eclose({x}))"
   have "z\<in>eclose({z})"
     using arg_in_eclose_sing .
   moreover
   have "relation(?r(x))"
     using relation_edrel .
   moreover
   have "wf(?r(x))"
     using wf_edrel .
   moreover from assms
   have "tr_down(?r(x),z) \<subseteq> eclose({z})"
     using tr_edrel_subset by simp
   ultimately
   have "wfrec(?r(x),z,Hv(G)) = wfrec[eclose({z})](?r(x),z,Hv(G))"
     using wfrec_restr by simp
   also from \<open>z\<in>domain(x)\<close>
   have "... = wfrec(?r(z),z,Hv(G))"
     using restrict_edrel_eq wfrec_restr_eq by simp
   finally
   show ?thesis .
 qed
 
 text\<open>The next lemma provides the usual recursive expresion for the definition of \<^term>\<open>val\<close>.\<close>
 
 lemma def_val:  "val(G,x) = {z . t\<in>domain(x) , (\<exists>p\<in>G .  \<langle>t,p\<rangle>\<in>x) \<and> z=val(G,t)}"
 proof -
   let
     ?r="\<lambda>\<tau> . edrel(eclose({\<tau>}))"
   let
     ?f="\<lambda>z\<in>?r(x)-``{x}. wfrec(?r(x),z,Hv(G))"
   have "\<forall>\<tau>. wf(?r(\<tau>))"
     using wf_edrel by simp
   with wfrec [of _ x]
   have "val(G,x) = Hv(G,x,?f)"
     using val_def by simp
   also
   have " ... = Hv(G,x,\<lambda>z\<in>domain(x). wfrec(?r(x),z,Hv(G)))"
     using dom_under_edrel_eclose by simp
   also
   have " ... = Hv(G,x,\<lambda>z\<in>domain(x). val(G,z))"
     using aux_def_val val_def by simp
   finally
   show ?thesis
     using Hv_def by simp
 qed
 
 lemma val_mono : "x\<subseteq>y \<Longrightarrow> val(G,x) \<subseteq> val(G,y)"
   by (subst (1 2) def_val, force)
 
 text\<open>Check-names are the canonical names for elements of the
 ground model. Here we show that this is the case.\<close>
 
 lemma val_check : "\<one> \<in> G \<Longrightarrow>  \<one> \<in> \<bbbP> \<Longrightarrow> val(G,check(y))  = y"
 proof (induct rule:eps_induct)
   case (1 y)
   then show ?case
   proof -
     have "check(y) = { \<langle>check(w), \<one>\<rangle> . w \<in> y}"  (is "_ = ?C")
       using def_check .
     then
     have "val(G,check(y)) = val(G, {\<langle>check(w), \<one>\<rangle> . w \<in> y})"
       by simp
     also
     have " ...  = {z . t\<in>domain(?C) , (\<exists>p\<in>G .  \<langle>t, p\<rangle>\<in>?C ) \<and> z=val(G,t) }"
       using def_val by blast
     also
     have " ... =  {z . t\<in>domain(?C) , (\<exists>w\<in>y. t=check(w)) \<and> z=val(G,t) }"
       using 1 by simp
     also
     have " ... = {val(G,check(w)) . w\<in>y }"
       by force
     finally
     show "val(G,check(y)) = y"
       using 1 by simp
   qed
 qed
 
 lemma val_of_name :
   "val(G,{x\<in>A\<times>\<bbbP>. Q(x)}) = {z . t\<in>A , (\<exists>p\<in>\<bbbP> .  Q(\<langle>t,p\<rangle>) \<and> p \<in> G) \<and> z=val(G,t)}"
 proof -
   let
     ?n="{x\<in>A\<times>\<bbbP>. Q(x)}" and
     ?r="\<lambda>\<tau> . edrel(eclose({\<tau>}))"
   let
     ?f="\<lambda>z\<in>?r(?n)-``{?n}. val(G,z)"
   have
     wfR : "wf(?r(\<tau>))" for \<tau>
     by (simp add: wf_edrel)
   have "domain(?n) \<subseteq> A" by auto
   { fix t
     assume H:"t \<in> domain({x \<in> A \<times> \<bbbP> . Q(x)})"
     then have "?f ` t = (if t \<in> ?r(?n)-``{?n} then val(G,t) else 0)"
       by simp
     moreover have "... = val(G,t)"
       using dom_under_edrel_eclose H if_P by auto
   }
   then
   have Eq1: "t \<in> domain({x \<in> A \<times> \<bbbP> . Q(x)}) \<Longrightarrow> val(G,t) = ?f` t"  for t
     by simp
   have "val(G,?n) = {z . t\<in>domain(?n), (\<exists>p \<in> G . \<langle>t,p\<rangle> \<in> ?n) \<and> z=val(G,t)}"
     by (subst def_val,simp)
   also
   have "... = {z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=?f`t}"
     unfolding Hv_def
     by (auto simp add:Eq1)
   also
   have "... = {z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=(if t\<in>?r(?n)-``{?n} then val(G,t) else 0)}"
     by (simp)
   also
   have "... = { z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
   proof -
     have "domain(?n) \<subseteq> ?r(?n)-``{?n}"
       using dom_under_edrel_eclose by simp
     then
     have "\<forall>t\<in>domain(?n). (if t\<in>?r(?n)-``{?n} then val(G,t) else 0) = val(G,t)"
       by auto
     then
     show "{ z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=(if t\<in>?r(?n)-``{?n} then val(G,t) else 0)} =
           { z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
       by auto
   qed
   also
   have " ... = { z . t\<in>A, (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
     by force
   finally
   show " val(G,?n)  = { z . t\<in>A, (\<exists>p\<in>\<bbbP> . Q(\<langle>t,p\<rangle>) \<and> p\<in>G) \<and> z=val(G,t)}"
     by auto
 qed
 
 lemma val_of_name_alt :
   "val(G,{x\<in>A\<times>\<bbbP>. Q(x)}) = {z . t\<in>A , (\<exists>p\<in>\<bbbP>\<inter>G .  Q(\<langle>t,p\<rangle>)) \<and> z=val(G,t) }"
   using val_of_name by force
 
 lemma val_only_names: "val(F,\<tau>) = val(F,{x\<in>\<tau>. \<exists>t\<in>domain(\<tau>). \<exists>p\<in>F. x=\<langle>t,p\<rangle>})"
   (is "_ = val(F,?name)")
 proof -
   have "val(F,?name) = {z . t\<in>domain(?name), (\<exists>p\<in>F. \<langle>t, p\<rangle> \<in> ?name) \<and> z=val(F, t)}"
     using def_val by blast
   also
   have " ... = {val(F, t). t\<in>{y\<in>domain(\<tau>). \<exists>p\<in>F. \<langle>y, p\<rangle> \<in> \<tau> }}"
     by blast
   also
   have " ... = {z . t\<in>domain(\<tau>), (\<exists>p\<in>F. \<langle>t, p\<rangle> \<in> \<tau>) \<and> z=val(F, t)}"
     by blast
   also
   have " ... = val(F, \<tau>)"
     using def_val[symmetric] by blast
   finally
   show ?thesis ..
 qed
 
 lemma val_only_pairs: "val(F,\<tau>) = val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>})"
 proof
   have "val(F,\<tau>) = val(F,{x\<in>\<tau>. \<exists>t\<in>domain(\<tau>). \<exists>p\<in>F. x=\<langle>t,p\<rangle>})" (is "_ = val(F,?name)")
     using val_only_names .
   also
   have "... \<subseteq> val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>})"
     using val_mono[of ?name "{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>}"] by auto
   finally
   show "val(F,\<tau>) \<subseteq> val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>})" by simp
 next
   show "val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>}) \<subseteq> val(F,\<tau>)"
     using val_mono[of "{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>}"] by auto
 qed
 
 lemma val_subset_domain_times_range: "val(F,\<tau>) \<subseteq> val(F,domain(\<tau>)\<times>range(\<tau>))"
   using val_only_pairs[THEN equalityD1]
     val_mono[of "{x \<in> \<tau> . \<exists>t p. x = \<langle>t, p\<rangle>}" "domain(\<tau>)\<times>range(\<tau>)"] by blast
 
 lemma val_of_elem: "\<langle>\<theta>,p\<rangle> \<in> \<pi> \<Longrightarrow> p\<in>G \<Longrightarrow> val(G,\<theta>) \<in> val(G,\<pi>)"
 proof -
   assume "\<langle>\<theta>,p\<rangle> \<in> \<pi>"
   then
   have "\<theta>\<in>domain(\<pi>)"
     by auto
   assume "p\<in>G"
   with \<open>\<theta>\<in>domain(\<pi>)\<close> \<open>\<langle>\<theta>,p\<rangle> \<in> \<pi>\<close>
   have "val(G,\<theta>) \<in> {z . t\<in>domain(\<pi>) , (\<exists>p\<in>G .  \<langle>t, p\<rangle>\<in>\<pi>) \<and> z=val(G,t) }"
     by auto
   then
   show ?thesis
     by (subst def_val)
 qed
 
 lemma elem_of_val: "x\<in>val(G,\<pi>) \<Longrightarrow> \<exists>\<theta>\<in>domain(\<pi>). val(G,\<theta>) = x"
   by (subst (asm) def_val,auto)
 
 lemma elem_of_val_pair: "x\<in>val(G,\<pi>) \<Longrightarrow> \<exists>\<theta>. \<exists>p\<in>G.  \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x"
   by (subst (asm) def_val,auto)
 
 lemma elem_of_val_pair':
   assumes "\<pi>\<in>M" "x\<in>val(G,\<pi>)"
   shows "\<exists>\<theta>\<in>M. \<exists>p\<in>G.  \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x"
 proof -
   from assms
   obtain \<theta> p where "p\<in>G" "\<langle>\<theta>,p\<rangle>\<in>\<pi>" "val(G,\<theta>) = x"
     using elem_of_val_pair by blast
   moreover from this \<open>\<pi>\<in>M\<close>
   have "\<theta>\<in>M"
     using pair_in_M_iff[THEN iffD1, THEN conjunct1, simplified]
       transitivity by blast
   ultimately
   show ?thesis
     by blast
 qed
 
 lemma GenExtD: "x \<in> M[G] \<Longrightarrow> \<exists>\<tau>\<in>M. x = val(G,\<tau>)"
   by (simp add:GenExt_def)
 
 lemma GenExtI: "x \<in> M \<Longrightarrow> val(G,x) \<in> M[G]"
   by (auto simp add: GenExt_def)
 
 lemma Transset_MG : "Transset(M[G])"
 proof -
   { fix vc y
     assume "vc \<in> M[G]" and "y \<in> vc"
     then
     obtain c where "c\<in>M" "val(G,c)\<in>M[G]" "y \<in> val(G,c)"
       using GenExtD by auto
     from \<open>y \<in> val(G,c)\<close>
     obtain \<theta> where "\<theta>\<in>domain(c)" "val(G,\<theta>) = y"
       using elem_of_val by blast
     with trans_M \<open>c\<in>M\<close>
     have "y \<in> M[G]"
       using domain_trans GenExtI by blast
   }
   then
   show ?thesis
     using Transset_def by auto
 qed
 
 lemmas transitivity_MG = Transset_intf[OF Transset_MG]
 
 text\<open>This lemma can be proved before having \<^term>\<open>check_in_M\<close>. At some point Miguel naïvely
 thought that the \<^term>\<open>check_in_M\<close> could be proved using this argument.\<close>
 lemma check_nat_M :
   assumes "n \<in> nat"
   shows "check(n) \<in> M"
   using assms
 proof (induct n)
   case 0
   then
   show ?case
     using zero_in_M by (subst def_check,simp)
 next
   case (succ x)
   have "\<one> \<in> M"
     using one_in_P P_sub_M subsetD by simp
   with \<open>check(x)\<in>M\<close>
   have "\<langle>check(x),\<one>\<rangle> \<in> M"
     using pair_in_M_iff by simp
   then
   have "{\<langle>check(x),\<one>\<rangle>} \<in> M"
     using singleton_closed by simp
   with \<open>check(x)\<in>M\<close>
   have "check(x) \<union> {\<langle>check(x),\<one>\<rangle>} \<in> M"
     using Un_closed by simp
   then
   show ?case
     using \<open>x\<in>nat\<close> def_checkS by simp
 qed
 
 lemma def_PHcheck:
   assumes
     "z\<in>M" "f\<in>M"
   shows
     "Hcheck(z,f) = Replace(z,PHcheck(##M,\<one>,f))"
 proof -
   from assms
   have "\<langle>f`x,\<one>\<rangle> \<in> M" "f`x\<in>M" if "x\<in>z" for x
     using pair_in_M_iff transitivity that apply_closed by simp_all
   then
   have "{y . x \<in> z, y = \<langle>f ` x, \<one>\<rangle>} =  {y . x \<in> z, y = \<langle>f ` x, \<one>\<rangle> \<and> y\<in>M \<and> f`x\<in>M}"
     by simp
   then
   show ?thesis
     using \<open>z\<in>M\<close> \<open>f\<in>M\<close> transitivity
     unfolding Hcheck_def PHcheck_def RepFun_def
     by auto
 qed
 
 (* instance of replacement for hcheck *)
 lemma wfrec_Hcheck :
   assumes "X\<in>M"
   shows "wfrec_replacement(##M,is_Hcheck(##M,\<one>),rcheck(X))"
 proof -
   let ?f="Exists(And(pair_fm(1,0,2),
                is_wfrec_fm(is_Hcheck_fm(8,2,1,0),4,1,0)))"
   have "is_Hcheck(##M,\<one>,a,b,c) \<longleftrightarrow>
         sats(M,is_Hcheck_fm(8,2,1,0),[c,b,a,d,e,y,x,z,\<one>,rcheck(x)])"
     if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "y\<in>M" "x\<in>M" "z\<in>M"
     for a b c d e y x z
     using that \<open>X\<in>M\<close> rcheck_in_M is_Hcheck_iff_sats zero_in_M
     by simp
   then
   have "sats(M,is_wfrec_fm(is_Hcheck_fm(8,2,1,0),4,1,0), [y,x,z,\<one>,rcheck(X)])
         \<longleftrightarrow> is_wfrec(##M, is_Hcheck(##M,\<one>),rcheck(X), x, y)"
     if "x\<in>M" "y\<in>M" "z\<in>M" for x y z
     using that sats_is_wfrec_fm \<open>X\<in>M\<close> rcheck_in_M zero_in_M
     by simp
   moreover from this
   have satsf:"sats(M, ?f, [x,z,\<one>,rcheck(X)]) \<longleftrightarrow>
               (\<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hcheck(##M,\<one>),rcheck(X), x, y))"
     if "x\<in>M" "z\<in>M" for x z
     using that \<open>X\<in>M\<close> rcheck_in_M
     by (simp del:pair_abs)
   moreover
   have artyf:"arity(?f) = 4"
     using arity_wfrec_replacement_fm[where p="is_Hcheck_fm(8, 2, 1, 0)" and i=9]
       arity_is_Hcheck_fm ord_simp_union
     by simp
   ultimately
   have "strong_replacement(##M,\<lambda>x z. sats(M,?f,[x,z,\<one>,rcheck(X)]))"
     using ZF_ground_replacements(2) artyf \<open>X\<in>M\<close> rcheck_in_M
     unfolding replacement_assm_def wfrec_Hcheck_fm_def by simp
   then
   have "strong_replacement(##M,\<lambda>x z.
           \<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hcheck(##M,\<one>),rcheck(X), x, y))"
     using repl_sats[of M ?f "[\<one>,rcheck(X)]"] satsf by (simp del:pair_abs)
   then
   show ?thesis
     unfolding wfrec_replacement_def by simp
 qed
 
 lemma Hcheck_closed' : "f\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> {f ` x . x \<in> z} \<in> M"
   using RepFun_closed[OF lam_replacement_imp_strong_replacement]
           lam_replacement_apply apply_closed transM[of _ z]
   by simp
 
 lemma repl_PHcheck :
   assumes "f\<in>M"
   shows "lam_replacement(##M,\<lambda>x. Hcheck(x,f))"
 proof -
   have "Hcheck(x,f) = {f`y . y\<in>x}\<times>{\<one>}" for x
     unfolding Hcheck_def by auto
   moreover
   note assms
   moreover from this
   have 1:"lam_replacement(##M, \<lambda>x . {f`y . y\<in>x}\<times>{\<one>})"
     using lam_replacement_RepFun_apply
       lam_replacement_constant lam_replacement_fst lam_replacement_snd
       singleton_closed cartprod_closed fst_snd_closed Hcheck_closed'
     by (rule_tac lam_replacement_CartProd[THEN [5] lam_replacement_hcomp2],simp_all)
   ultimately
   show ?thesis
     using singleton_closed cartprod_closed Hcheck_closed'
     by(rule_tac lam_replacement_cong[OF 1],auto)
 qed
 
 lemma univ_PHcheck : "\<lbrakk> z\<in>M ; f\<in>M \<rbrakk> \<Longrightarrow> univalent(##M,z,PHcheck(##M,\<one>,f))"
   unfolding univalent_def PHcheck_def
   by simp
 
 lemma PHcheck_closed : "\<lbrakk>z\<in>M ; f\<in>M ; x\<in>z; PHcheck(##M,\<one>,f,x,y) \<rbrakk> \<Longrightarrow> (##M)(y)"
   unfolding PHcheck_def by simp
 
 lemma relation2_Hcheck : "relation2(##M,is_Hcheck(##M,\<one>),Hcheck)"
 proof -
   have "is_Replace(##M,z,PHcheck(##M,\<one>,f),hc) \<longleftrightarrow> hc = Replace(z,PHcheck(##M,\<one>,f))"
     if "z\<in>M" "f\<in>M" "hc\<in>M" for z f hc
     using that Replace_abs[OF _ _ univ_PHcheck] PHcheck_closed[of z f]
     by simp
   with def_PHcheck
   show ?thesis
     unfolding relation2_def is_Hcheck_def Hcheck_def
     by simp
 qed
 
 lemma Hcheck_closed : "\<forall>y\<in>M. \<forall>g\<in>M.  Hcheck(y,g)\<in>M"
 proof -
   have eq:"Hcheck(x,f) = {f`y . y\<in>x}\<times>{\<one>}" for f x
     unfolding Hcheck_def by auto
   then
   have "Hcheck(y,g)\<in>M" if "y\<in>M" "g\<in>M" for y g
     using eq that Hcheck_closed' cartprod_closed singleton_closed
     by simp
   then
   show ?thesis
     by auto
 qed
 
 lemma wf_rcheck : "x\<in>M \<Longrightarrow> wf(rcheck(x))"
   unfolding rcheck_def using wf_trancl[OF wf_Memrel] .
 
 lemma trans_rcheck : "x\<in>M \<Longrightarrow> trans(rcheck(x))"
   unfolding rcheck_def using trans_trancl .
 
 lemma relation_rcheck : "x\<in>M \<Longrightarrow> relation(rcheck(x))"
   unfolding rcheck_def using relation_trancl .
 
 lemma check_in_M : "x\<in>M \<Longrightarrow> check(x) \<in> M"
   using wfrec_Hcheck[of x] check_trancl wf_rcheck trans_rcheck relation_rcheck rcheck_in_M
     Hcheck_closed relation2_Hcheck trans_wfrec_closed[of "rcheck(x)"]
   by simp
 
 (* Internalization and absoluteness of rcheck\<close> *)
 lemma rcheck_abs[Rel] : "\<lbrakk> x\<in>M ; r\<in>M \<rbrakk> \<Longrightarrow> is_rcheck(##M,x,r) \<longleftrightarrow> r = rcheck(x)"
   unfolding rcheck_def is_rcheck_def
   using singleton_closed trancl_closed Memrel_closed eclose_closed zero_in_M
   by simp
 
 lemma check_abs[Rel] :
   assumes "x\<in>M" "z\<in>M"
   shows "is_check(##M,\<one>,x,z) \<longleftrightarrow> z = check(x)"
 proof -
   have "is_check(##M,\<one>,x,z) \<longleftrightarrow> is_wfrec(##M,is_Hcheck(##M,\<one>),rcheck(x),x,z)"
     unfolding is_check_def
     using assms rcheck_abs rcheck_in_M zero_in_M
     unfolding check_trancl is_check_def
     by simp
   then
   show ?thesis
     unfolding check_trancl
     using assms wfrec_Hcheck[of x] wf_rcheck trans_rcheck relation_rcheck rcheck_in_M
       Hcheck_closed relation2_Hcheck trans_wfrec_abs[of "rcheck(x)" x z "is_Hcheck(##M,\<one>)" Hcheck]
     by (simp flip: setclass_iff)
 qed
 
 lemma check_lam_replacement: "lam_replacement(##M,check)"
 proof -
   have "arity(check_fm(2,0,1)) = 3"
     by (simp add:ord_simp_union arity)
   then
   have "Lambda(A, check) \<in> M" if "A\<in>M" for A
     using that check_in_M transitivity[of _ A]
       sats_check_fm check_abs zero_in_M
       check_fm_type ZF_ground_replacements(3)
     by(rule_tac Lambda_in_M [of "check_fm(2,0,1)" "[\<one>]"],simp_all)
   then
   show ?thesis
     using check_in_M lam_replacement_iff_lam_closed[THEN iffD2]
     by simp
 qed
 
 lemma check_replacement: "{check(x). x\<in>\<bbbP>} \<in> M"
   using lam_replacement_imp_strong_replacement_aux[OF check_lam_replacement]
     transitivity check_in_M RepFun_closed
     by simp_all
 
 lemma M_subset_MG : "\<one> \<in> G \<Longrightarrow> M \<subseteq> M[G]"
   using check_in_M GenExtI
   by (intro subsetI, subst val_check [of G,symmetric], auto)
 
 text\<open>The name for the generic filter\<close>
 definition
   G_dot :: "i" where
   "G_dot \<equiv> {\<langle>check(p),p\<rangle> . p\<in>\<bbbP>}"
 
 lemma G_dot_in_M : "G_dot \<in> M"
   using lam_replacement_Pair[THEN [5] lam_replacement_hcomp2,OF
     check_lam_replacement lam_replacement_identity]
     check_in_M lam_replacement_imp_strong_replacement_aux
     transitivity check_in_M RepFun_closed pair_in_M_iff
   unfolding G_dot_def
   by simp
 
 lemma zero_in_MG : "0 \<in> M[G]"
 proof -
   have "0 = val(G,0)"
     using zero_in_M elem_of_val by auto
   also
   have "... \<in> M[G]"
     using GenExtI zero_in_M by simp
   finally
   show ?thesis .
 qed
 
 declare check_in_M [simp,intro]
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 context G_generic1
 begin
 
 lemma val_G_dot : "val(G,G_dot) = G"
 proof (intro equalityI subsetI)
   fix x
   assume "x\<in>val(G,G_dot)"
   then obtain \<theta> p where "p\<in>G" "\<langle>\<theta>,p\<rangle> \<in> G_dot" "val(G,\<theta>) = x" "\<theta> = check(p)"
     unfolding G_dot_def using elem_of_val_pair G_dot_in_M
     by force
   then
   show "x \<in> G"
     using G_subset_P one_in_G val_check P_sub_M by auto
 next
   fix p
   assume "p\<in>G"
   have "\<langle>check(q),q\<rangle> \<in> G_dot" if "q\<in>\<bbbP>" for q
     unfolding G_dot_def using that by simp
   with \<open>p\<in>G\<close>
   have "val(G,check(p)) \<in> val(G,G_dot)"
     using val_of_elem G_dot_in_M by blast
   with \<open>p\<in>G\<close>
   show "p \<in> val(G,G_dot)"
     using one_in_G G_subset_P P_sub_M val_check by auto
 qed
 
 lemma G_in_Gen_Ext : "G \<in> M[G]"
   using G_subset_P one_in_G val_G_dot GenExtI[of _ G] G_dot_in_M
   by force
 
 lemmas generic_simps = val_check[OF one_in_G one_in_P]
   M_subset_MG[OF one_in_G, THEN subsetD]
   GenExtI P_in_M
 
 lemmas generic_dests = M_genericD M_generic_compatD
 
 bundle G_generic1_lemmas = generic_simps[simp] generic_dests[dest]
 
 end  \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
+sublocale G_generic1 \<subseteq> ext: M_trans "##M[G]"
+  using generic transitivity_MG zero_in_MG
+  by unfold_locales force+
+
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Powerset_Axiom.thy b/thys/Independence_CH/Powerset_Axiom.thy
--- a/thys/Independence_CH/Powerset_Axiom.thy
+++ b/thys/Independence_CH/Powerset_Axiom.thy
@@ -1,266 +1,231 @@
 section\<open>The Powerset Axiom in $M[G]$\<close>
+
 theory Powerset_Axiom
-  imports Separation_Axiom Pairing_Axiom Union_Axiom
+  imports
+    Separation_Axiom Pairing_Axiom Union_Axiom
 begin
 
 simple_rename "perm_pow" src "[ss,p,l,o,fs,\<chi>]" tgt "[fs,ss,sp,p,l,o,\<chi>]"
 
-lemma Collect_inter_Transset:
-  assumes
-    "Transset(M)" "b \<in> M"
-  shows
-    "{x\<in>b . P(x)} = {x\<in>b . P(x)} \<inter> M"
-  using assms unfolding Transset_def
-  by (auto)
-
 context G_generic1
 begin
 
 lemma sats_fst_snd_in_M:
   assumes
     "A\<in>M" "B\<in>M" "\<phi> \<in> formula" "p\<in>M" "l\<in>M" "o\<in>M" "\<chi>\<in>M" "arity(\<phi>) \<le> 6"
   shows "{\<langle>s,q\<rangle>\<in>A\<times>B . M, [q,p,l,o,s,\<chi>] \<Turnstile> \<phi>} \<in> M" (is "?\<theta> \<in> M")
 proof -
   let ?\<phi>' = "ren(\<phi>)`6`7`perm_pow_fn"
   from \<open>A\<in>M\<close> \<open>B\<in>M\<close>
   have "A\<times>B \<in> M"
     using cartprod_closed by simp
   from \<open>arity(\<phi>) \<le> 6\<close> \<open>\<phi>\<in> formula\<close>
   have "?\<phi>' \<in> formula" "arity(?\<phi>')\<le>7"
     unfolding perm_pow_fn_def
     using perm_pow_thm  arity_ren ren_tc Nil_type
     by auto
   with \<open>?\<phi>' \<in> formula\<close>
   have arty: "arity(Exists(Exists(And(pair_fm(0,1,2),?\<phi>'))))\<le>5" (is "arity(?\<psi>)\<le>5")
     using ord_simp_union pred_le
     by (auto simp:arity)
   {
     fix sp
     note \<open>A\<times>B \<in> M\<close> \<open>A\<in>M\<close> \<open>B\<in>M\<close>
     moreover
     assume "sp \<in> A\<times>B"
     moreover from calculation
     have "fst(sp) \<in> A" "snd(sp) \<in> B"
       using fst_type snd_type by simp_all
     ultimately
     have "sp \<in> M" "fst(sp) \<in> M" "snd(sp) \<in> M"
       using transitivity
       by simp_all
     note inM = \<open>A\<in>M\<close> \<open>B\<in>M\<close> \<open>p\<in>M\<close> \<open>l\<in>M\<close> \<open>o\<in>M\<close> \<open>\<chi>\<in>M\<close>
       \<open>sp\<in>M\<close> \<open>fst(sp)\<in>M\<close> \<open>snd(sp)\<in>M\<close>
     with arty \<open>sp \<in> M\<close> \<open>?\<phi>' \<in> formula\<close>
     have "(M, [sp,p,l,o,\<chi>]@[p] \<Turnstile> ?\<psi>) \<longleftrightarrow> M,[sp,p,l,o,\<chi>] \<Turnstile> ?\<psi>" (is "(M,?env0@ _\<Turnstile>_) \<longleftrightarrow> _")
       using arity_sats_iff[of ?\<psi> "[p]" M ?env0] by auto
     also from inM \<open>sp \<in> A\<times>B\<close>
     have "... \<longleftrightarrow> sats(M,?\<phi>',[fst(sp),snd(sp),sp,p,l,o,\<chi>])"
       by auto
     also from inM \<open>\<phi> \<in> formula\<close> \<open>arity(\<phi>) \<le> 6\<close>
     have "... \<longleftrightarrow> M, [snd(sp),p,l,o,fst(sp),\<chi>] \<Turnstile> \<phi>"
       (is "sats(_,_,?env1) \<longleftrightarrow> sats(_,_,?env2)")
       using sats_iff_sats_ren[of \<phi> 6 7 ?env2 M ?env1 perm_pow_fn] perm_pow_thm
       unfolding perm_pow_fn_def by simp
     finally
     have "(M,[sp,p,l,o,\<chi>,p] \<Turnstile> ?\<psi>) \<longleftrightarrow> M, [snd(sp),p,l,o,fst(sp),\<chi>] \<Turnstile> \<phi>"
       by simp
   }
   then
   have "?\<theta> = {sp\<in>A\<times>B . sats(M,?\<psi>,[sp,p,l,o,\<chi>,p])}"
     by auto
   with assms \<open>A\<times>B\<in>M\<close>
   show ?thesis
     using separation_ax separation_iff arty leI \<open>?\<phi>' \<in> formula\<close>
     by simp
 qed
 
 declare nat_into_M[rule del, simplified setclass_iff, intro]
-lemmas ssimps = domain_closed cartprod_closed cons_closed
+lemmas ssimps = domain_closed cartprod_closed cons_closed Pow_rel_closed
 declare ssimps [simp del, simplified setclass_iff, simp, intro]
 
+\<comment> \<open>We keep \<^term>\<open>Pow(a) \<inter> M[G]\<close> to be consistent with Kunen.\<close>
 lemma Pow_inter_MG:
   assumes "a\<in>M[G]"
   shows "Pow(a) \<inter> M[G] \<in> M[G]"
 proof -
   from assms
   obtain \<tau> where "\<tau> \<in> M" "val(G, \<tau>) = a"
     using GenExtD by auto
-  let ?Q="Pow(domain(\<tau>)\<times>\<bbbP>) \<inter> M"
+  let ?Q="Pow\<^bsup>M\<^esup>(domain(\<tau>)\<times>\<bbbP>)"
+  let ?\<pi>="?Q\<times>{\<one>}"
+  let ?b="val(G,?\<pi>)"
   from \<open>\<tau>\<in>M\<close>
   have "domain(\<tau>)\<times>\<bbbP> \<in> M" "domain(\<tau>) \<in> M"
     by simp_all
   then
-  have "?Q \<in> M"
-  proof -
-    from power_ax \<open>domain(\<tau>)\<times>\<bbbP> \<in> M\<close>
-    obtain Q where "powerset(##M,domain(\<tau>)\<times>\<bbbP>,Q)" "Q \<in> M"
-      unfolding power_ax_def by auto
-    moreover from calculation
-    have "z\<in>Q \<Longrightarrow> z\<in>M" for z
-      using transitivity by blast
-    ultimately
-    have "Q = {a\<in>Pow(domain(\<tau>)\<times>\<bbbP>) . a\<in>M}"
-      using \<open>domain(\<tau>)\<times>\<bbbP> \<in> M\<close> powerset_abs[of "domain(\<tau>)\<times>\<bbbP>" Q]
-      by (simp flip: setclass_iff)
-    also
-    have " ... = ?Q"
-      by auto
-    finally
-    show ?thesis
-      using \<open>Q\<in>M\<close> by simp
-  qed
-  let ?\<pi>="?Q\<times>{\<one>}"
-  let ?b="val(G,?\<pi>)"
-  from \<open>?Q\<in>M\<close>
-  have "?\<pi>\<in>M"
-    by auto
-  then
   have "?b \<in> M[G]"
-    using GenExtI by simp
+    by (auto intro!:GenExtI)
   have "Pow(a) \<inter> M[G] \<subseteq> ?b"
   proof
     fix c
     assume "c \<in> Pow(a) \<inter> M[G]"
     then
     obtain \<chi> where "c\<in>M[G]" "\<chi> \<in> M" "val(G,\<chi>) = c"
       using GenExt_iff by auto
     let ?\<theta>="{\<langle>\<sigma>,p\<rangle> \<in>domain(\<tau>)\<times>\<bbbP> . p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>] }"
-    have "arity(forces(Member(0,1))) = 6"
+    have "arity(forces( \<cdot>0 \<in> 1\<cdot> )) = 6"
       using arity_forces_at by auto
     with \<open>domain(\<tau>) \<in> M\<close> \<open>\<chi> \<in> M\<close>
     have "?\<theta> \<in> M"
       using sats_fst_snd_in_M
       by simp
-    then
-    have "?\<theta> \<in> ?Q" by auto
-    then
-    have "val(G,?\<theta>) \<in> ?b"
-      using one_in_G generic val_of_elem [of ?\<theta> \<one> ?\<pi> G]
-      by auto
+    with \<open>domain(\<tau>)\<times>\<bbbP> \<in> M\<close>
+    have "?\<theta> \<in> ?Q"
+      using Pow_rel_char by auto
     have "val(G,?\<theta>) = c"
     proof(intro equalityI subsetI)
       fix x
       assume "x \<in> val(G,?\<theta>)"
       then
       obtain \<sigma> p where 1: "\<langle>\<sigma>,p\<rangle>\<in>?\<theta>" "p\<in>G" "val(G,\<sigma>) =  x"
         using elem_of_val_pair
         by blast
       moreover from \<open>\<langle>\<sigma>,p\<rangle>\<in>?\<theta>\<close> \<open>?\<theta> \<in> M\<close>
       have "\<sigma>\<in>M"
         using name_components_in_M[of _ _ ?\<theta>] by auto
       moreover from 1
       have "p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>]" "p\<in>\<bbbP>"
         by simp_all
       moreover
       note \<open>val(G,\<chi>) = c\<close> \<open>\<chi> \<in> M\<close>
       ultimately
       have "M[G], [x, c] \<Turnstile> \<cdot>0 \<in> 1\<cdot>"
         using generic definition_of_forcing[where \<phi>="\<cdot>0 \<in> 1\<cdot>"] ord_simp_union
         by auto
       moreover from \<open>\<sigma>\<in>M\<close> \<open>\<chi>\<in>M\<close>
       have "x\<in>M[G]"
         using \<open>val(G,\<sigma>) = x\<close> GenExtI by blast
       ultimately
       show "x\<in>c"
         using \<open>c\<in>M[G]\<close> by simp
     next
       fix x
       assume "x \<in> c"
       with \<open>c \<in> Pow(a) \<inter> M[G]\<close>
       have "x \<in> a" "c\<in>M[G]" "x\<in>M[G]"
         using transitivity_MG by auto
       with \<open>val(G, \<tau>) = a\<close>
       obtain \<sigma> where "\<sigma>\<in>domain(\<tau>)" "val(G,\<sigma>) = x"
         using elem_of_val by blast
       moreover
       note \<open>x\<in>c\<close> \<open>val(G,\<chi>) = c\<close> \<open>c\<in>M[G]\<close> \<open>x\<in>M[G]\<close>
       moreover from calculation
       have "val(G,\<sigma>) \<in> val(G,\<chi>)"
         by simp
       moreover from calculation
       have "M[G], [x, c] \<Turnstile> \<cdot>0 \<in> 1\<cdot>"
         by simp
       moreover
       have "\<sigma>\<in>M"
       proof -
         from \<open>\<sigma>\<in>domain(\<tau>)\<close>
         obtain p where "\<langle>\<sigma>,p\<rangle> \<in> \<tau>"
           by auto
         with \<open>\<tau>\<in>M\<close>
         show ?thesis
           using name_components_in_M by blast
       qed
       moreover
       note \<open>\<chi> \<in> M\<close>
       ultimately
       obtain p where "p\<in>G" "p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>]"
         using generic truth_lemma[of "\<cdot>0 \<in> 1\<cdot>" "[\<sigma>,\<chi>]" ] ord_simp_union
         by auto
       moreover from \<open>p\<in>G\<close>
       have "p\<in>\<bbbP>"
         using generic by blast
       ultimately
       have "\<langle>\<sigma>,p\<rangle>\<in>?\<theta>"
         using \<open>\<sigma>\<in>domain(\<tau>)\<close> by simp
       with \<open>val(G,\<sigma>) =  x\<close> \<open>p\<in>G\<close>
       show "x\<in>val(G,?\<theta>)"
         using val_of_elem [of _ _ "?\<theta>" G] by auto
     qed
-    with \<open>val(G,?\<theta>) \<in> ?b\<close>
+    with \<open>?\<theta> \<in> ?Q\<close>
     show "c\<in>?b"
-      by simp
+      using one_in_G generic val_of_elem [of ?\<theta> \<one> ?\<pi> G]
+      by auto
   qed
   then
   have "Pow(a) \<inter> M[G] = {x\<in>?b . x\<subseteq>a \<and> x\<in>M[G]}"
     by auto
   also from \<open>a\<in>M[G]\<close>
-  have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> ) \<and> x\<in>M[G]}"
+  have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> )} \<inter> M[G]"
     using Transset_MG by force
-  also
-  have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> )} \<inter> M[G]"
-    by auto
   also from \<open>?b\<in>M[G]\<close>
   have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> )}"
-    using Collect_inter_Transset Transset_MG
-    by simp
+    by (intro equalityI) (auto dest:ext.transM)
   also from \<open>?b\<in>M[G]\<close> \<open>a\<in>M[G]\<close>
   have " ... \<in> M[G]"
     using Collect_sats_in_MG GenExtI ord_simp_union by (simp add:arity)
   finally
   show ?thesis .
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 sublocale G_generic1 \<subseteq> ext: M_trivial "##M[G]"
-  using generic Union_MG pairing_in_MG zero_in_MG transitivity_MG
-  unfolding M_trivial_def M_trans_def M_trivial_axioms_def
-  by (simp; blast)
+  using generic Union_MG pairing_in_MG
+  by unfold_locales (simp; blast)
 
 context G_generic1 begin
 
 theorem power_in_MG : "power_ax(##(M[G]))"
   unfolding power_ax_def
 proof (intro rallI, simp only:setclass_iff rex_setclass_is_bex)
   fix a
   text\<open>After simplification, we have to show that for every
   \<^term>\<open>a\<in>M[G]\<close> there exists some \<^term>\<open>x\<in>M[G]\<close> satisfying
   \<^term>\<open>powerset(##M[G],a,x)\<close>\<close>
   assume "a \<in> M[G]"
   have "{x\<in>Pow(a) . x \<in> M[G]} = Pow(a) \<inter> M[G]"
     by auto
   also from \<open>a\<in>M[G]\<close>
   have " ... \<in> M[G]"
     using Pow_inter_MG by simp
   finally
   have "{x\<in>Pow(a) . x \<in> M[G]} \<in> M[G]" .
   moreover from \<open>a\<in>M[G]\<close> this
   have "powerset(##M[G], a, {x\<in>Pow(a) . x \<in> M[G]})"
     using ext.powerset_abs
     by simp
   ultimately
   show "\<exists>x\<in>M[G] . powerset(##M[G], a, x)"
     by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Replacement_Instances.thy b/thys/Independence_CH/Replacement_Instances.thy
--- a/thys/Independence_CH/Replacement_Instances.thy
+++ b/thys/Independence_CH/Replacement_Instances.thy
@@ -1,1301 +1,1302 @@
 section\<open>More Instances of Replacement\<close>
 
 theory Replacement_Instances
   imports
     Separation_Instances
     Transitive_Models.Pointed_DC_Relative
 begin
 
 lemma composition_fm_type[TC]: "a0 \<in> \<omega> \<Longrightarrow> a1 \<in> \<omega> \<Longrightarrow> a2 \<in> \<omega> \<Longrightarrow>
    composition_fm(a0,a1,a2) \<in> formula"
   unfolding composition_fm_def by simp
 
 arity_theorem for "composition_fm"
 
 definition is_omega_funspace :: "[i\<Rightarrow>o,i,i,i]\<Rightarrow>o" where
   "is_omega_funspace(N,B,n,z) \<equiv>  \<exists>o[N]. omega(N,o) \<and> n\<in>o \<and> is_funspace(N, n, B, z)"
 
 synthesize "omega_funspace" from_definition "is_omega_funspace" assuming "nonempty"
 arity_theorem for "omega_funspace_fm"
 
 definition HAleph_wfrec_repl_body where
   "HAleph_wfrec_repl_body(N,mesa,x,z) \<equiv> \<exists>y[N].
                    pair(N, x, y, z) \<and>
                    (\<exists>g[N].
                        (\<forall>u[N].
                            u \<in> g \<longleftrightarrow>
                            (\<exists>a[N].
                                \<exists>y[N].
                                   \<exists>ax[N].
                                      \<exists>sx[N].
                                         \<exists>r_sx[N].
                                            \<exists>f_r_sx[N].
                                               pair(N, a, y, u) \<and>
                                               pair(N, a, x, ax) \<and>
                                               upair(N, a, a, sx) \<and>
                                               pre_image(N, mesa, sx, r_sx) \<and>
       restriction(N, g, r_sx, f_r_sx) \<and> ax \<in> mesa \<and> is_HAleph(N, a, f_r_sx, y))) \<and>
                        is_HAleph(N, x, g, y))"
 
 (* MOVE THIS to an appropriate place *)
 arity_theorem for "ordinal_fm"
 arity_theorem for "is_Limit_fm"
 arity_theorem for "empty_fm"
 arity_theorem for "fun_apply_fm"
 
 synthesize "HAleph_wfrec_repl_body" from_definition assuming "nonempty"
 arity_theorem for "HAleph_wfrec_repl_body_fm"
 
 definition dcwit_repl_body where
   "dcwit_repl_body(N,mesa,A,a,s,R) \<equiv> \<lambda>x z. \<exists>y[N]. pair(N, x, y, z) \<and>
                                 is_wfrec
                                  (N, \<lambda>n f. is_nat_case
                                              (N, a,
                                               \<lambda>m bmfm.
                                                  \<exists>fm[N].
                                                     \<exists>cp[N].
                                                        is_apply(N, f, m, fm) \<and>
                                                        is_Collect(N, A, \<lambda>x. \<exists>fmx[N]. (N(x) \<and> fmx \<in> R) \<and> pair(N, fm, x, fmx), cp) \<and>
                                                        is_apply(N, s, cp, bmfm),
                                               n),
                                   mesa, x, y)"
 
 manual_schematic for "dcwit_repl_body" assuming "nonempty"
   unfolding dcwit_repl_body_def
   by (rule iff_sats is_nat_case_iff_sats is_eclose_iff_sats sep_rules | simp)+
 
 synthesize "dcwit_repl_body" from_schematic
 
 definition dcwit_aux_fm where
   "dcwit_aux_fm(A,s,R) \<equiv> (\<cdot>\<exists>\<cdot>\<cdot>4`2 is 0\<cdot> \<and>
                (\<cdot>\<exists>\<cdot>Collect_fm
                    (succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(A)))))))))),
                     (\<cdot>\<exists>\<cdot>\<cdot>0 \<in>
                        succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(R)))))))))))) \<cdot> \<and>
                        pair_fm(3, 1, 0) \<cdot>\<cdot>),
                     0) \<and>
                   \<cdot> succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(s))))))))))`0 is 2\<cdot>\<cdot>\<cdot>)\<cdot>\<cdot>)"
 
 arity_theorem for "dcwit_aux_fm"
 
 lemma dcwit_aux_fm_type[TC]: "A \<in> \<omega> \<Longrightarrow> s \<in> \<omega> \<Longrightarrow> R \<in> \<omega> \<Longrightarrow> dcwit_aux_fm(A,s,R) \<in> formula"
   by (simp_all add: dcwit_aux_fm_def)
 
 definition is_nat_case_dcwit_aux_fm where
   "is_nat_case_dcwit_aux_fm(A,a,s,R) \<equiv> is_nat_case_fm
            (succ(succ(succ(succ(succ(succ(a)))))),dcwit_aux_fm(A,s,R),
             2, 0)"
 
 lemma is_nat_case_dcwit_aux_fm_type[TC]: "A \<in> \<omega> \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> s \<in> \<omega> \<Longrightarrow> R \<in> \<omega> \<Longrightarrow> is_nat_case_dcwit_aux_fm(A,a,s,R) \<in> formula"
   by (simp_all add: is_nat_case_dcwit_aux_fm_def)
 
 manual_arity for "is_nat_case_dcwit_aux_fm"
   unfolding is_nat_case_dcwit_aux_fm_def
   by (rule arity_dcwit_aux_fm[THEN [6] arity_is_nat_case_fm]) simp_all
 
 manual_arity for "dcwit_repl_body_fm"
   using arity_is_nat_case_dcwit_aux_fm[THEN [6] arity_is_wfrec_fm]
   unfolding dcwit_repl_body_fm_def  is_nat_case_dcwit_aux_fm_def dcwit_aux_fm_def
   by (auto simp add: arity(1-33))
 
 lemma arity_dcwit_repl_body: "arity(dcwit_repl_body_fm(6,5,4,3,2,0,1)) = 7"
   by (simp_all add: FOL_arities arity_dcwit_repl_body_fm ord_simp_union)
 
 definition fst2_snd2
   where "fst2_snd2(x) \<equiv> \<langle>fst(fst(x)), snd(snd(x))\<rangle>"
 
 relativize functional "fst2_snd2" "fst2_snd2_rel"
 relationalize "fst2_snd2_rel" "is_fst2_snd2"
 
 lemma (in M_trivial) fst2_snd2_abs:
   assumes "M(x)" "M(res)"
   shows "is_fst2_snd2(M, x, res) \<longleftrightarrow> res = fst2_snd2(x)"
   unfolding is_fst2_snd2_def fst2_snd2_def
   using fst_rel_abs snd_rel_abs fst_abs snd_abs assms
   by simp
 
 synthesize "is_fst2_snd2" from_definition assuming "nonempty"
 arity_theorem for "is_fst2_snd2_fm"
 
 definition sndfst_fst2_snd2
   where "sndfst_fst2_snd2(x) \<equiv> \<langle>snd(fst(x)), fst(fst(x)), snd(snd(x))\<rangle>"
 
 relativize functional "sndfst_fst2_snd2" "sndfst_fst2_snd2_rel"
 relationalize "sndfst_fst2_snd2_rel" "is_sndfst_fst2_snd2"
 synthesize "is_sndfst_fst2_snd2" from_definition assuming "nonempty"
 arity_theorem for "is_sndfst_fst2_snd2_fm"
 
 definition order_eq_map where
   "order_eq_map(M,A,r,a,z) \<equiv> \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M].
              ordinal(M,x) & pair(M,a,x,z) & membership(M,x,mx) &
              pred_set(M,A,a,r,par) & order_isomorphism(M,par,r,x,mx,g)"
 
 synthesize "order_eq_map" from_definition assuming "nonempty"
 arity_theorem for "is_ord_iso_fm"
 arity_theorem for "order_eq_map_fm"
 
 (* Banach *)
 synthesize "is_banach_functor" from_definition assuming "nonempty"
 arity_theorem for "is_banach_functor_fm"
 
 definition banach_body_iterates where
   "banach_body_iterates(M,X,Y,f,g,W,n,x,z) \<equiv>
 \<exists>y[M].
                    pair(M, x, y, z) \<and>
                    (\<exists>fa[M].
                        (\<forall>z[M].
                            z \<in> fa \<longleftrightarrow>
                            (\<exists>xa[M].
                                \<exists>y[M].
                                   \<exists>xaa[M].
                                      \<exists>sx[M].
                                         \<exists>r_sx[M].
                                            \<exists>f_r_sx[M]. \<exists>sn[M]. \<exists>msn[M]. successor(M,n,sn) \<and>
                                               membership(M,sn,msn) \<and>
                                               pair(M, xa, y, z) \<and>
                                               pair(M, xa, x, xaa) \<and>
                                               upair(M, xa, xa, sx) \<and>
                                               pre_image(M, msn, sx, r_sx) \<and>
                                               restriction(M, fa, r_sx, f_r_sx) \<and>
                                               xaa \<in> msn \<and>
                                               (empty(M, xa) \<longrightarrow> y = W) \<and>
                                               (\<forall>m[M].
                                                   successor(M, m, xa) \<longrightarrow>
                                                   (\<exists>gm[M].
                                                       is_apply(M, f_r_sx, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                                               (is_quasinat(M, xa) \<or> empty(M, y)))) \<and>
                        (empty(M, x) \<longrightarrow> y = W) \<and>
                        (\<forall>m[M].
                            successor(M, m, x) \<longrightarrow>
                            (\<exists>gm[M]. is_apply(M, fa, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                        (is_quasinat(M, x) \<or> empty(M, y)))"
 
 synthesize "is_quasinat" from_definition assuming "nonempty"
 arity_theorem for "is_quasinat_fm"
 
 synthesize "banach_body_iterates" from_definition assuming "nonempty"
 arity_theorem for "banach_body_iterates_fm"
 
 definition banach_is_iterates_body where
   "banach_is_iterates_body(M,X,Y,f,g,W,n,y) \<equiv> \<exists>om[M]. omega(M,om) \<and> n \<in> om \<and>
              (\<exists>sn[M].
                  \<exists>msn[M].
                     successor(M, n, sn) \<and>
                     membership(M, sn, msn) \<and>
                     (\<exists>fa[M].
                         (\<forall>z[M].
                             z \<in> fa \<longleftrightarrow>
                             (\<exists>x[M].
                                 \<exists>y[M].
                                    \<exists>xa[M].
                                       \<exists>sx[M].
                                          \<exists>r_sx[M].
                                             \<exists>f_r_sx[M].
                                                pair(M, x, y, z) \<and>
                                                pair(M, x, n, xa) \<and>
                                                upair(M, x, x, sx) \<and>
                                                pre_image(M, msn, sx, r_sx) \<and>
                                                restriction(M, fa, r_sx, f_r_sx) \<and>
                                                xa \<in> msn \<and>
                                                (empty(M, x) \<longrightarrow> y = W) \<and>
                                                (\<forall>m[M].
                                                    successor(M, m, x) \<longrightarrow>
                                                    (\<exists>gm[M].
                                                        fun_apply(M, f_r_sx, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                                                (is_quasinat(M, x) \<or> empty(M, y)))) \<and>
                         (empty(M, n) \<longrightarrow> y = W) \<and>
                         (\<forall>m[M].
                             successor(M, m, n) \<longrightarrow>
                             (\<exists>gm[M]. fun_apply(M, fa, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                         (is_quasinat(M, n) \<or> empty(M, y))))"
 
 synthesize "banach_is_iterates_body" from_definition assuming "nonempty"
 arity_theorem for "banach_is_iterates_body_fm"
 
 (* (##M)(f) \<Longrightarrow> strong_replacement(##M, \<lambda>x y. y = \<langle>x, transrec(x, \<lambda>a g. f ` (g `` a))\<rangle>) *)
 
 definition trans_apply_image where
   "trans_apply_image(f) \<equiv> \<lambda>a g. f ` (g `` a)"
 
 relativize functional "trans_apply_image" "trans_apply_image_rel"
 relationalize "trans_apply_image" "is_trans_apply_image"
 
 (* MOVE THIS to an appropriate place *)
 schematic_goal arity_is_recfun_fm[arity]:
   "p \<in> formula \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> r \<in> \<omega> \<Longrightarrow> arity(is_recfun_fm(p, a, z ,r)) = ?ar"
   unfolding is_recfun_fm_def
   by (simp add:arity) (* clean simpset from arities, use correct attrib *)
     (* Don't know why it doesn't use the theorem at \<^file>\<open>Arities\<close> *)
 schematic_goal arity_is_wfrec_fm[arity]:
   "p \<in> formula \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> r \<in> \<omega> \<Longrightarrow> arity(is_wfrec_fm(p, a, z ,r)) = ?ar"
   unfolding is_wfrec_fm_def
   by (simp add:arity)
 schematic_goal arity_is_transrec_fm[arity]:
   "p \<in> formula \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> arity(is_transrec_fm(p, a, z)) = ?ar"
   unfolding is_transrec_fm_def
   by (simp add:arity)
 
 synthesize "is_trans_apply_image" from_definition assuming "nonempty"
 arity_theorem for "is_trans_apply_image_fm"
 
 
 definition transrec_apply_image_body where
   "transrec_apply_image_body(M,f,mesa,x,z) \<equiv>  \<exists>y[M]. pair(M, x, y, z) \<and>
                                 (\<exists>fa[M].
                                     (\<forall>z[M].
                                         z \<in> fa \<longleftrightarrow>
                                         (\<exists>xa[M].
                                             \<exists>y[M].
                                                \<exists>xaa[M].
                                                   \<exists>sx[M].
                                                      \<exists>r_sx[M].
                                                         \<exists>f_r_sx[M].
                                                            pair(M, xa, y, z) \<and>
                                                            pair(M, xa, x, xaa) \<and>
                                                            upair(M, xa, xa, sx) \<and>
                                                            pre_image(M, mesa, sx, r_sx) \<and>
                                                            restriction(M, fa, r_sx, f_r_sx) \<and>
                                                            xaa \<in> mesa \<and> is_trans_apply_image(M, f, xa, f_r_sx, y))) \<and>
                                     is_trans_apply_image(M, f, x, fa, y))"
 
 synthesize "transrec_apply_image_body" from_definition assuming "nonempty"
 arity_theorem for "transrec_apply_image_body_fm"
 
  definition is_trans_apply_image_body where
   "is_trans_apply_image_body(M,f,\<beta>,a,w) \<equiv> \<exists>z[M]. pair(M,a,z,w) \<and> a\<in>\<beta> \<and> (\<exists>sa[M].
                  \<exists>esa[M].
                     \<exists>mesa[M].
                       upair(M, a, a, sa) \<and>
                        is_eclose(M, sa, esa) \<and>
                       membership(M, esa, mesa) \<and>
                       (\<exists>fa[M].
                           (\<forall>z[M].
                               z \<in> fa \<longleftrightarrow>
                               (\<exists>x[M].
                                   \<exists>y[M].
                                      \<exists>xa[M].
                                         \<exists>sx[M].
                                            \<exists>r_sx[M].
                                               \<exists>f_r_sx[M].
                                                  pair(M, x, y, z) \<and>
                                                  pair(M, x, a, xa) \<and>
                                                  upair(M, x, x, sx) \<and>
                                                  pre_image(M, mesa, sx, r_sx) \<and>
                                                  restriction(M, fa, r_sx, f_r_sx) \<and>
                                                  xa \<in> mesa \<and> is_trans_apply_image(M, f, x, f_r_sx, y))) \<and>
                           is_trans_apply_image(M, f, a, fa, z)))"
 
 
 synthesize "is_trans_apply_image_body" from_definition assuming "nonempty"
 arity_theorem for "is_trans_apply_image_body_fm"
 
 definition replacement_is_omega_funspace_fm where "replacement_is_omega_funspace_fm \<equiv>  omega_funspace_fm(2,0,1)"
-definition replacement_HAleph_wfrec_repl_body_fm where "replacement_HAleph_wfrec_repl_body_fm \<equiv>  HAleph_wfrec_repl_body_fm(2,0,1)"
+definition wfrec_Aleph_fm where "wfrec_Aleph_fm \<equiv>  HAleph_wfrec_repl_body_fm(2,0,1)"
 definition replacement_is_fst2_snd2_fm where "replacement_is_fst2_snd2_fm \<equiv>  is_fst2_snd2_fm(0,1)"
 definition replacement_is_sndfst_fst2_snd2_fm where "replacement_is_sndfst_fst2_snd2_fm \<equiv>  is_sndfst_fst2_snd2_fm(0,1)"
-definition replacement_is_order_eq_map_fm where "replacement_is_order_eq_map_fm \<equiv>  order_eq_map_fm(2,3,0,1)"
-definition replacement_transrec_apply_image_body_fm where "replacement_transrec_apply_image_body_fm \<equiv>  transrec_apply_image_body_fm(3,2,0,1)"
+definition omap_replacement_fm where "omap_replacement_fm \<equiv>  order_eq_map_fm(2,3,0,1)"
+definition recursive_construction_abs_fm where "recursive_construction_abs_fm \<equiv>  transrec_apply_image_body_fm(3,2,0,1)"
 definition banach_replacement_iterates_fm where "banach_replacement_iterates_fm \<equiv> banach_is_iterates_body_fm(6,5,4,3,2,0,1)"
-definition replacement_is_trans_apply_image_fm where "replacement_is_trans_apply_image_fm \<equiv> is_trans_apply_image_body_fm(3,2,0,1)"
+definition recursive_construction_fm where "recursive_construction_fm \<equiv> is_trans_apply_image_body_fm(3,2,0,1)"
 (* definition banach_iterates_fm where "banach_iterates_fm \<equiv> banach_body_iterates_fm(7,6,5,4,3,2,0,1)" *)
-definition replacement_dcwit_repl_body_fm where "replacement_dcwit_repl_body_fm \<equiv> dcwit_repl_body_fm(6,5,4,3,2,0,1)"
+definition dc_abs_fm where "dc_abs_fm \<equiv> dcwit_repl_body_fm(6,5,4,3,2,0,1)"
+definition lam_replacement_check_fm where "lam_replacement_check_fm \<equiv> Lambda_in_M_fm(check_fm(2,0,1),1)"
 
 text\<open>The following instances are needed only on the ground model. The
 first one corresponds to the recursive definition of forces for atomic
 formulas; the next two corresponds to \<^term>\<open>PHcheck\<close>; the following
 is used to get a generic filter using some form of choice.\<close>
 
 locale M_ZF_ground = M_ZF1 +
   assumes
     ZF_ground_replacements:
     "replacement_assm(M,env,wfrec_Hfrc_at_fm)"
     "replacement_assm(M,env,wfrec_Hcheck_fm)"
-    "replacement_assm(M,env,Lambda_in_M_fm(check_fm(2,0,1),1))"
+    "replacement_assm(M,env,lam_replacement_check_fm)"
 
 locale M_ZF_ground_trans = M_ZF1_trans + M_ZF_ground
 
 definition instances_ground_fms where "instances_ground_fms \<equiv>
   { wfrec_Hfrc_at_fm,
     wfrec_Hcheck_fm,
-    Lambda_in_M_fm(check_fm(2,0,1),1) }"
+    lam_replacement_check_fm }"
 
 lemmas replacement_instances_ground_defs =
-  wfrec_Hfrc_at_fm_def wfrec_Hcheck_fm_def
+  wfrec_Hfrc_at_fm_def wfrec_Hcheck_fm_def lam_replacement_check_fm_def
 
 declare (in M_ZF_ground) replacement_instances_ground_defs [simp]
 
 lemma instances_ground_fms_type[TC]: "instances_ground_fms \<subseteq> formula"
   using Lambda_in_M_fm_type
   unfolding instances_ground_fms_def replacement_instances_ground_defs
   by simp
 
 locale M_ZF_ground_notCH = M_ZF_ground +
   assumes
     ZF_ground_notCH_replacements:
-    "replacement_assm(M,env,replacement_transrec_apply_image_body_fm)"
-    "replacement_assm(M,env,replacement_is_trans_apply_image_fm)"
+    "replacement_assm(M,env,recursive_construction_abs_fm)"
+    "replacement_assm(M,env,recursive_construction_fm)"
 
 definition instances_ground_notCH_fms where "instances_ground_notCH_fms \<equiv>
-  { replacement_transrec_apply_image_body_fm,
-    replacement_is_trans_apply_image_fm }"
+  { recursive_construction_abs_fm,
+    recursive_construction_fm }"
 
 lemma instances_ground_notCH_fms_type[TC]: "instances_ground_notCH_fms \<subseteq> formula"
-  unfolding instances_ground_notCH_fms_def replacement_transrec_apply_image_body_fm_def
-    replacement_is_trans_apply_image_fm_def
+  unfolding instances_ground_notCH_fms_def recursive_construction_abs_fm_def
+    recursive_construction_fm_def
   by simp
 
-declare (in M_ZF_ground_notCH) replacement_transrec_apply_image_body_fm_def[simp]
-  replacement_is_trans_apply_image_fm_def[simp]
+declare (in M_ZF_ground_notCH) recursive_construction_abs_fm_def[simp]
+  recursive_construction_fm_def[simp]
 
 locale M_ZF_ground_notCH_trans = M_ZF_ground_trans + M_ZF_ground_notCH
 
 locale M_ZF_ground_CH = M_ZF_ground_notCH +
   assumes
-    dcwit_replacement: "replacement_assm(M,env,replacement_dcwit_repl_body_fm)"
+    dcwit_replacement: "replacement_assm(M,env,dc_abs_fm)"
 
-declare (in M_ZF_ground_CH) replacement_dcwit_repl_body_fm_def [simp]
+declare (in M_ZF_ground_CH) dc_abs_fm_def [simp]
 
 locale M_ZF_ground_CH_trans = M_ZF_ground_notCH_trans + M_ZF_ground_CH
 
 locale M_ctm1 = M_ZF1_trans + M_ZF_ground_trans +
   fixes enum
   assumes M_countable:      "enum\<in>bij(nat,M)"
 
 locale M_ctm1_AC = M_ctm1 + M_ZFC1_trans
 
 context M_ZF_ground_CH_trans
 begin
 
 lemma replacement_dcwit_repl_body:
   "(##M)(mesa) \<Longrightarrow> (##M)(A) \<Longrightarrow> (##M)(a) \<Longrightarrow> (##M)(s) \<Longrightarrow> (##M)(R) \<Longrightarrow>
    strong_replacement(##M, dcwit_repl_body(##M,mesa,A,a,s,R))"
   using strong_replacement_rel_in_ctm[where \<phi>="dcwit_repl_body_fm(6,5,4,3,2,0,1)"
       and env="[R,s,a,A,mesa]" and f="dcwit_repl_body(##M,mesa,A,a,s,R)"]
     zero_in_M arity_dcwit_repl_body dcwit_replacement
-  unfolding replacement_dcwit_repl_body_fm_def
+  unfolding dc_abs_fm_def
   by simp
 
 lemma dcwit_repl:
   "(##M)(sa) \<Longrightarrow>
         (##M)(esa) \<Longrightarrow>
         (##M)(mesa) \<Longrightarrow> (##M)(A) \<Longrightarrow> (##M)(a) \<Longrightarrow> (##M)(s) \<Longrightarrow> (##M)(R) \<Longrightarrow>
         strong_replacement
               ((##M), \<lambda>x z. \<exists>y[(##M)]. pair((##M), x, y, z) \<and>
                                 is_wfrec
                                  ((##M), \<lambda>n f. is_nat_case
                                              ((##M), a,
                                               \<lambda>m bmfm.
                                                  \<exists>fm[(##M)].
                                                     \<exists>cp[(##M)].
                                                        is_apply((##M), f, m, fm) \<and>
                                                        is_Collect((##M), A, \<lambda>x. \<exists>fmx[(##M)]. ((##M)(x) \<and> fmx \<in> R) \<and> pair((##M), fm, x, fmx), cp) \<and>
                                                        is_apply((##M), s, cp, bmfm),
                                               n),
                                   mesa, x, y))"
   using replacement_dcwit_repl_body unfolding dcwit_repl_body_def by simp
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_ground_CH_trans\<close>\<close>
 
 context M_ZF1_trans
 begin
 
 lemmas M_replacement_ZF_instances = lam_replacement_fst lam_replacement_snd
   lam_replacement_Union lam_replacement_Image
   lam_replacement_middle_del lam_replacement_prodRepl
 
 lemmas M_separation_ZF_instances = separation_fstsnd_in_sndsnd separation_sndfst_eq_fstsnd
 
 lemma separation_is_dcwit_body:
   assumes "(##M)(A)" "(##M)(a)" "(##M)(g)" "(##M)(R)"
   shows "separation(##M,is_dcwit_body(##M, A, a, g, R))"
   using assms separation_in_ctm[where env="[A,a,g,R]" and \<phi>="is_dcwit_body_fm(1,2,3,4,0)",
       OF _ _ _ is_dcwit_body_iff_sats[symmetric],
       of "\<lambda>_.A" "\<lambda>_.a" "\<lambda>_.g" "\<lambda>_.R" "\<lambda>x. x"]
     nonempty arity_is_dcwit_body_fm is_dcwit_body_fm_type
   by (simp add:ord_simp_union)
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 sublocale M_ZF1_trans \<subseteq> M_replacement "##M"
   using M_replacement_ZF_instances M_separation_ZF_instances
   by unfold_locales simp
 
 context M_ZF1_trans
 begin
 
 lemma separation_Pow_rel: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, Pow\<^bsup>##M\<^esup>(x)\<rangle>)"
   using separation_assm_sats[of "is_Pow_fm(0,1)"] arity_is_Pow_fm ord_simp_union
     Pow_rel_closed nonempty Pow_rel_iff
   by simp
 
 lemma strong_replacement_Powapply_rel:
   "f\<in>M \<Longrightarrow> strong_replacement(##M, \<lambda>x y. y = Powapply\<^bsup>##M\<^esup>(f,x))"
   using Powapply_rel_replacement separation_Pow_rel transM
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 sublocale M_ZF1_trans \<subseteq> M_Vfrom "##M"
   using power_ax strong_replacement_Powapply_rel phrank_repl trans_repl_HVFrom wfrec_rank
   by unfold_locales auto
 
 sublocale M_ZF1_trans \<subseteq> M_Perm "##M"
   using separation_PiP_rel separation_injP_rel separation_surjP_rel
     lam_replacement_imp_strong_replacement[OF
       lam_replacement_Sigfun[OF lam_replacement_constant]]
     Pi_replacement1 unfolding Sigfun_def
   by unfold_locales simp_all
 
 sublocale M_ZF1_trans \<subseteq> M_pre_seqspace "##M"
   by unfold_locales
 
 context M_ZF1_trans
 begin
 
 lemma separation_inj_rel: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, inj_rel(##M,fst(x), snd(x))\<rangle>)"
   using arity_is_inj_fm ord_simp_union
     nonempty inj_rel_closed[simplified] inj_rel_iff[simplified]
   by (rule_tac separation_assm_bin_sats[of "is_inj_fm(0,1,2)"])
     (simp_all add:setclass_def)
 
 lemma lam_replacement_inj_rel: "lam_replacement(##M, \<lambda>x . inj_rel(##M,fst(x),snd(x)))"
   using lam_replacement_inj_rel' separation_inj_rel
   by simp
 
 (*
 
 These lemmas were required for the original proof of Schröder-Bernstein.
 
 lemma banach_iterates:
   assumes "X\<in>M" "Y\<in>M" "f\<in>M" "g\<in>M" "W\<in>M"
   shows "iterates_replacement(##M, is_banach_functor(##M,X,Y,f,g), W)"
 proof -
   have "strong_replacement(##M, \<lambda> x z . banach_body_iterates(##M,X,Y,f,g,W,n,x,z))" if "n\<in>\<omega>" for n
     using assms that arity_banach_body_iterates_fm ord_simp_union nat_into_M
       strong_replacement_rel_in_ctm[where \<phi>="banach_body_iterates_fm(7,6,5,4,3,2,0,1)"
         and env="[n,W,g,f,Y,X]"] replacement_ax2(3)
     by simp
   then
   show ?thesis
     using assms nat_into_M Memrel_closed
     unfolding iterates_replacement_def wfrec_replacement_def is_wfrec_def M_is_recfun_def
       is_nat_case_def iterates_MH_def banach_body_iterates_def
     by simp
 qed
 
 lemma separation_banach_functor_iterates:
   assumes "X\<in>M" "Y\<in>M" "f\<in>M" "g\<in>M" "A\<in>M"
   shows "separation(##M, \<lambda>b. \<exists>x\<in>A. x \<in> \<omega> \<and> b = banach_functor(X, Y, f, g)^x (0))"
 proof -
   have " (\<exists>xa\<in>M. xa \<in> A \<and> xa \<in> \<omega> \<and> banach_is_iterates_body(##M, X, Y, f, g, 0, xa, x)) \<longleftrightarrow>
          (\<exists>n\<in>A. n \<in> \<omega> \<and> banach_is_iterates_body(##M, X, Y, f, g, 0, n, x))" if "x\<in>M" for x
     using assms nat_into_M nat_in_M transM[of _ A] transM[of _ \<omega>] that
     by auto
   then
   have "separation(##M, \<lambda> z . \<exists>n\<in>A . n\<in>\<omega> \<and> banach_is_iterates_body(##M,X,Y,f,g,0,n,z))"
     using assms nat_into_M nat_in_M
       arity_banach_is_iterates_body_fm[of 6 5 4 3 2 0 1] ord_simp_union
       separation_in_ctm[where \<phi>="(\<cdot>\<exists> \<cdot>\<cdot>0\<in>7\<cdot> \<and> \<cdot>\<cdot>0\<in>8\<cdot> \<and> banach_is_iterates_body_fm(6,5,4,3,2,0,1) \<cdot>\<cdot>\<cdot>)"
         and env="[0,g,f,Y,X,A,\<omega>]"]
     by (simp add:arity_Exists arity_And)
   moreover from assms
   have "(\<exists>x\<in>A. x \<in> \<omega> \<and> is_iterates(##M,is_banach_functor(##M,X, Y, f, g),0,x,z)) \<longleftrightarrow>
           (\<exists>n\<in>A . n\<in>\<omega> \<and> banach_is_iterates_body(##M,X,Y,f,g,0,n,z))" if "z\<in>M" for z
     using nat_in_M nat_into_M transM[of _ A] transM[of _ \<omega>]
     unfolding is_iterates_def wfrec_replacement_def is_wfrec_def M_is_recfun_def
       is_nat_case_def iterates_MH_def banach_body_iterates_def banach_is_iterates_body_def
     by simp
   moreover from assms
   have "(\<exists>x\<in>A. x \<in> \<omega> \<and> is_iterates(##M,is_banach_functor(##M,X, Y, f, g),0,x,z)) \<longleftrightarrow>
           (\<exists>x\<in>A. x \<in> \<omega> \<and> z = banach_functor(X, Y, f, g)^x (0))" if "z\<in>M" for z
     using transM[of _ A] nat_in_M nat_into_M that
       iterates_abs[OF banach_iterates banach_functor_abs] banach_functor_closed
     by auto
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2],auto)
 qed
 
 lemma banach_replacement:
   assumes "X\<in>M" "Y\<in>M" "f\<in>M" "g\<in>M"
   shows "strong_replacement(##M, \<lambda>n y. n\<in>nat \<and> y = banach_functor(X, Y, f, g)^n (0))"
   using assms banach_repl_iter' separation_banach_functor_iterates
   by simp
 
 *)
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 lemma (in M_basic) rel2_trans_apply:
   "M(f) \<Longrightarrow> relation2(M,is_trans_apply_image(M,f),trans_apply_image(f))"
   unfolding is_trans_apply_image_def trans_apply_image_def relation2_def
   by auto
 
 lemma (in M_basic) apply_image_closed:
   shows "M(f) \<Longrightarrow> \<forall>x[M]. \<forall>g[M]. M(trans_apply_image(f, x, g))"
   unfolding trans_apply_image_def by simp
 
 context M_ZF_ground_notCH_trans
 begin
 
 lemma replacement_transrec_apply_image_body :
   "(##M)(f) \<Longrightarrow> (##M)(mesa) \<Longrightarrow> strong_replacement(##M,transrec_apply_image_body(##M,f,mesa))"
   using strong_replacement_rel_in_ctm[where \<phi>="transrec_apply_image_body_fm(3,2,0,1)" and env="[mesa,f]"]
     zero_in_M arity_transrec_apply_image_body_fm ord_simp_union
     ZF_ground_notCH_replacements(1)
   by simp
 
 lemma transrec_replacement_apply_image:
   assumes "(##M)(f)" "(##M)(\<alpha>)"
   shows "transrec_replacement(##M, is_trans_apply_image(##M, f), \<alpha>)"
   using replacement_transrec_apply_image_body[unfolded transrec_apply_image_body_def] assms
     Memrel_closed singleton_closed eclose_closed
   unfolding transrec_replacement_def wfrec_replacement_def is_wfrec_def M_is_recfun_def
   by simp
 
 lemma rec_trans_apply_image_abs:
   assumes "(##M)(f)" "(##M)(x)" "(##M)(y)" "Ord(x)"
   shows "is_transrec(##M,is_trans_apply_image(##M, f),x,y) \<longleftrightarrow> y = transrec(x,trans_apply_image(f))"
   using transrec_abs[OF transrec_replacement_apply_image rel2_trans_apply] assms apply_image_closed
   by simp
 
 lemma replacement_is_trans_apply_image:
   "(##M)(f) \<Longrightarrow> (##M)(\<beta>) \<Longrightarrow> strong_replacement(##M, \<lambda> x z .
     \<exists>y[##M]. pair(##M,x,y,z) \<and> x\<in>\<beta> \<and> (is_transrec(##M,is_trans_apply_image(##M, f),x,y)))"
   unfolding is_transrec_def is_wfrec_def M_is_recfun_def
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x z. M,[x,z,\<beta>,f] \<Turnstile> is_trans_apply_image_body_fm(3,2,0,1)",THEN iffD1])
    apply(rule_tac is_trans_apply_image_body_iff_sats[symmetric,unfolded is_trans_apply_image_body_def,where env="[_,_,\<beta>,f]"])
             apply(simp_all add:zero_in_M)
   apply(rule_tac ZF_ground_notCH_replacements(2)[unfolded replacement_assm_def, rule_format, where env="[\<beta>,f]",simplified])
     apply(simp_all add: arity_is_trans_apply_image_body_fm is_trans_apply_image_body_fm_type ord_simp_union)
   done
 
 lemma trans_apply_abs:
   "(##M)(f) \<Longrightarrow> (##M)(\<beta>) \<Longrightarrow> Ord(\<beta>) \<Longrightarrow> (##M)(x) \<Longrightarrow> (##M)(z) \<Longrightarrow>
     (x\<in>\<beta> \<and> z = \<langle>x, transrec(x, \<lambda>a g. f ` (g `` a)) \<rangle>) \<longleftrightarrow>
     (\<exists>y[##M]. pair(##M,x,y,z) \<and> x\<in>\<beta> \<and> (is_transrec(##M,is_trans_apply_image(##M, f),x,y)))"
   using rec_trans_apply_image_abs Ord_in_Ord
     transrec_closed[OF transrec_replacement_apply_image rel2_trans_apply,of f,simplified]
     apply_image_closed
   unfolding trans_apply_image_def
   by auto
 
 lemma replacement_trans_apply_image:
   "(##M)(f) \<Longrightarrow> (##M)(\<beta>) \<Longrightarrow> Ord(\<beta>) \<Longrightarrow>
   strong_replacement(##M, \<lambda>x y. x\<in>\<beta> \<and> y = \<langle>x, transrec(x, \<lambda>a g. f ` (g `` a))\<rangle>)"
   using strong_replacement_cong[THEN iffD1,OF _ replacement_is_trans_apply_image,simplified]
     trans_apply_abs Ord_in_Ord
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_ground_notCH_trans\<close>\<close>
 
 definition ifrFb_body where
   "ifrFb_body(M,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then
   if M(converse(f) ` i) then converse(f) ` i else 0 else 0 else if M(i) then i else 0)"
 
 relativize functional "ifrFb_body" "ifrFb_body_rel"
 relationalize "ifrFb_body_rel" "is_ifrFb_body"
 
 synthesize "is_ifrFb_body" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body_fm"
 
 definition ifrangeF_body :: "[i\<Rightarrow>o,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body(M,A,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body(M,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body" "ifrangeF_body_rel"
 relationalize "ifrangeF_body_rel" "is_ifrangeF_body"
 
 synthesize "is_ifrangeF_body" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body:
   "(##M)(A) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body(##M,A,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body_fm(1,2,3,0)" and env="[A,r,s]"]
     zero_in_M arity_is_ifrangeF_body_fm ord_simp_union is_ifrangeF_body_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body_closed: "M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body(M, r, s, x, i) \<Longrightarrow> M(i)"
   unfolding ifrangeF_body_def is_ifrangeF_body_def is_ifrFb_body_def If_abs
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body_abs:
   assumes "(##M)(A)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body(##M,A,r,s,x) \<longleftrightarrow> ifrangeF_body(##M,A,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body(##M, r, s, z, i))= (\<mu> i. is_ifrFb_body(##M, r, s, z, i))" for z
       using is_ifrFb_body_closed[of r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body(##M,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body(##M, r, s, z, i))= (\<mu> i. ifrFb_body(##M, r, s, z, i))" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body(##M,r,s,z,i)" "\<lambda>i. ifrFb_body(##M,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close>
       show "is_ifrFb_body(##M, r, s, z, y) \<longleftrightarrow> ifrFb_body(##M, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body_def is_ifrFb_body_def
         by (cases "y\<in>M"; cases "y\<in>range(s)"; cases "converse(s)`y \<in> M";
             auto dest:transM split del: split_if del:iffI)
           (auto simp flip:setclass_iff; (force simp only:setclass_iff))+
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body(##M, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body(##M, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body(##M,r,s,z,i)" a]
       by simp
     ultimately
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body(##M, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body(##M, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body_def is_ifrangeF_body_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body:
   "(##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow> separation
         (##M, \<lambda>y.  \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>x. if (##M)(x) then x else 0, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body ifrangeF_body_abs
     separation_cong[where P="is_ifrangeF_body(##M,A,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body_def if_range_F_def if_range_F_else_F_def ifrFb_body_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. if (##M)(a) then G`a else 0, b, f, i)\<rangle>) *)
 
 definition ifrFb_body2 where
   "ifrFb_body2(M,G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then
   if M(converse(f) ` i) then G`(converse(f) ` i) else 0 else 0 else if M(i) then G`i else 0)"
 
 relativize functional "ifrFb_body2" "ifrFb_body2_rel"
 relationalize "ifrFb_body2_rel" "is_ifrFb_body2"
 
 synthesize "is_ifrFb_body2" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body2_fm"
 
 definition ifrangeF_body2 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body2(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body2(M,G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body2" "ifrangeF_body2_rel"
 relationalize "ifrangeF_body2_rel" "is_ifrangeF_body2"
 
 synthesize "is_ifrangeF_body2" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body2_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body2:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body2(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body2_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body2_fm ord_simp_union is_ifrangeF_body2_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body2_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body2(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   unfolding ifrangeF_body2_def is_ifrangeF_body2_def is_ifrFb_body2_def If_abs
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body2_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body2(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body2(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body2(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body2(##M, G, r, s, z, i))" for z
       using is_ifrFb_body2_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body2(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body2(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body2(##M, G, r, s, z, i))" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body2(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body2(##M,G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close>
       show "is_ifrFb_body2(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body2(##M, G, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body2_def is_ifrFb_body2_def
         by (cases "y\<in>M"; cases "y\<in>range(s)"; cases "converse(s)`y \<in> M";
             auto dest:transM split del: split_if del:iffI)
           (auto simp flip:setclass_iff; (force simp only:setclass_iff))+
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body2(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body2(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body2(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body2(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body2(##M, G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body2_def is_ifrangeF_body2_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body2:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation
         (##M,
          \<lambda>y. \<exists>x\<in>A.
                 y =
                 \<langle>x, \<mu> i. x \<in>
                          if_range_F_else_F(\<lambda>a. if (##M)(a) then G ` a else 0, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body2 ifrangeF_body2_abs
     separation_cong[where P="is_ifrangeF_body2(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body2_def if_range_F_def if_range_F_else_F_def ifrFb_body2_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow> (##M)(F) \<Longrightarrow>
   separation(##M,
     \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. if (##M)(a) then F -`` {a} else 0, b, f, i)\<rangle>) *)
 
 definition ifrFb_body3 where
   "ifrFb_body3(M,G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then
   if M(converse(f) ` i) then G-``{converse(f) ` i} else 0 else 0 else if M(i) then G-``{i} else 0)"
 
 relativize functional "ifrFb_body3" "ifrFb_body3_rel"
 relationalize "ifrFb_body3_rel" "is_ifrFb_body3"
 
 synthesize "is_ifrFb_body3" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body3_fm"
 
 definition ifrangeF_body3 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body3(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body3(M,G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body3" "ifrangeF_body3_rel"
 relationalize "ifrangeF_body3_rel" "is_ifrangeF_body3"
 
 synthesize "is_ifrangeF_body3" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body3_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body3:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body3(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body3_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body3_fm ord_simp_union is_ifrangeF_body3_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body3_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body3(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   unfolding ifrangeF_body3_def is_ifrangeF_body3_def is_ifrFb_body3_def If_abs
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body3_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body3(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body3(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body3(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body3(##M, G, r, s, z, i))" for z
       using is_ifrFb_body3_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body3(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body3(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body3(##M, G, r, s, z, i))" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body3(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body3(##M,G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close>
       show "is_ifrFb_body3(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body3(##M, G, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body3_def is_ifrFb_body3_def
         by (cases "y\<in>M"; cases "y\<in>range(s)"; cases "converse(s)`y \<in> M";
             auto dest:transM split del: split_if del:iffI)
           (auto simp flip:setclass_iff; (force simp only:setclass_iff))+
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body3(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body3(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body3(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body3(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body3(##M, G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body3_def is_ifrangeF_body3_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body3:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation
         (##M,
          \<lambda>y. \<exists>x\<in>A.
                 y =
                 \<langle>x, \<mu> i. x \<in>
                          if_range_F_else_F(\<lambda>a. if (##M)(a) then G-``{a} else 0, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body3 ifrangeF_body3_abs
     separation_cong[where P="is_ifrangeF_body3(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body3_def if_range_F_def if_range_F_else_F_def ifrFb_body3_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow> (##M)(A') \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F((`)(A), b, f, i)\<rangle>) *)
 
 definition ifrFb_body4 where
   "ifrFb_body4(G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then G`(converse(f) ` i) else 0 else G`i)"
 
 relativize functional "ifrFb_body4" "ifrFb_body4_rel"
 relationalize "ifrFb_body4_rel" "is_ifrFb_body4"
 
 synthesize "is_ifrFb_body4" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body4_fm"
 
 definition ifrangeF_body4 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body4(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body4(G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body4" "ifrangeF_body4_rel"
 relationalize "ifrangeF_body4_rel" "is_ifrangeF_body4"
 
 synthesize "is_ifrangeF_body4" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body4_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body4:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body4(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body4_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body4_fm ord_simp_union is_ifrangeF_body4_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body4_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body4(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body4_def is_ifrangeF_body4_def is_ifrFb_body4_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body4_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body4(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body4(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body4(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body4(##M, G, r, s, z, i))" for z
       using is_ifrFb_body4_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body4(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body4(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body4(G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body4(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body4(G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       show "is_ifrFb_body4(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body4(G, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body4_def is_ifrFb_body4_def
         apply (cases "y\<in>M"; cases "y\<in>range(s)"; cases "r=0"; cases "y\<in>domain(G)";
             auto dest:transM split del: split_if del:iffI)
         by (auto simp flip:setclass_iff; (force simp only: fun_apply_def setclass_iff))
           (auto simp flip:setclass_iff simp: fun_apply_def )
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body4(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body4(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body4(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body4(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body4(G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body4_def is_ifrangeF_body4_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body4:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation(##M, \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F((`)(G), b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body4 ifrangeF_body4_abs
     separation_cong[where P="is_ifrangeF_body4(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body4_def if_range_F_def if_range_F_else_F_def ifrFb_body4_def
   by simp
 
 (* (##M)(G) \<Longrightarrow> (##M)(A) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>x. {xa \<in> G . x \<in> xa}, b, f, i)\<rangle>) *)
 
 definition ifrFb_body5 where
   "ifrFb_body5(G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then {xa \<in> G . converse(f) ` i \<in> xa} else 0 else {xa \<in> G . i \<in> xa})"
 
 relativize functional "ifrFb_body5" "ifrFb_body5_rel"
 relationalize "ifrFb_body5_rel" "is_ifrFb_body5"
 
 synthesize "is_ifrFb_body5" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body5_fm"
 
 definition ifrangeF_body5 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body5(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body5(G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body5" "ifrangeF_body5_rel"
 relationalize "ifrangeF_body5_rel" "is_ifrangeF_body5"
 
 synthesize "is_ifrangeF_body5" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body5_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body5:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body5(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body5_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body5_fm ord_simp_union is_ifrangeF_body5_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body5_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body5(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body5_def is_ifrangeF_body5_def is_ifrFb_body5_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body5_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body5(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body5(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body5(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body5(##M, G, r, s, z, i))" for z
       using is_ifrFb_body5_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body5(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body5(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body5(G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body5(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body5(G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       show "is_ifrFb_body5(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body5(G, r, s, z, y)"
         using If_abs apply_0 separation_in_constant separation_in_rev
         unfolding ifrFb_body5_def is_ifrFb_body5_def
         apply (cases "y\<in>M"; cases "y\<in>range(s)"; cases "r=0"; cases "y\<in>domain(G)";
             auto dest:transM split del: split_if del:iffI)
               apply (auto simp flip:setclass_iff; (force simp only: fun_apply_def setclass_iff))
              apply (auto simp flip:setclass_iff simp: fun_apply_def)
         apply (auto dest:transM)
         done
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body5(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body5(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body5(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body5(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body5(G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body5_def is_ifrangeF_body5_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body5:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation(##M, \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>x. {xa \<in> G . x \<in> xa}, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body5 ifrangeF_body5_abs
     separation_cong[where P="is_ifrangeF_body5(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body5_def if_range_F_def if_range_F_else_F_def ifrFb_body5_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. {p \<in> A . domain(p) = a}, b, f, i)\<rangle>) *)
 
 definition ifrFb_body6 where
   "ifrFb_body6(G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then {p\<in>G . domain(p) = converse(f) ` i} else 0 else {p\<in>G . domain(p) = i})"
 
 relativize functional "ifrFb_body6" "ifrFb_body6_rel"
 relationalize "ifrFb_body6_rel" "is_ifrFb_body6"
 
 synthesize "is_ifrFb_body6" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body6_fm"
 
 definition ifrangeF_body6 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body6(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body6(G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body6" "ifrangeF_body6_rel"
 relationalize "ifrangeF_body6_rel" "is_ifrangeF_body6"
 
 synthesize "is_ifrangeF_body6" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body6_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body6:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body6(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body6_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body6_fm ord_simp_union is_ifrangeF_body6_fm_type
   by simp
 
 lemma (in M_basic) ifrFb_body6_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> ifrFb_body6(G, r, s, x, i) \<longleftrightarrow>  M(i) \<and> ifrFb_body6(G, r, s, x, i)"
   using If_abs
   unfolding ifrangeF_body6_def is_ifrangeF_body6_def ifrFb_body6_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_basic) is_ifrFb_body6_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body6(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body6_def is_ifrangeF_body6_def is_ifrFb_body6_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body6_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body6(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body6(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body6(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body6(##M, G, r, s, z, i))" for z
       using is_ifrFb_body6_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body6(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. i\<in>M \<and> is_ifrFb_body6(##M, G, r, s, z, i))= (\<mu> i. i\<in>M \<and>  ifrFb_body6(G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body6(##M,G,r,s,z,i)" "\<lambda>i. i\<in>M \<and> ifrFb_body6(G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       show "y\<in>M \<and> is_ifrFb_body6(##M, G, r, s, z, y) \<longleftrightarrow> y\<in>M \<and> ifrFb_body6(G, r, s, z, y)"
         using If_abs apply_0 separation_in_constant transitivity[of _ G]
           separation_closed converse_closed apply_closed range_closed zero_in_M
           separation_cong[OF eq_commute,THEN iffD1,OF domain_eq_separation]
         unfolding ifrFb_body6_def is_ifrFb_body6_def
         by auto
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body6(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body6(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body6(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body6(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body6(G, r, s, z,i))" for z
       using Least_cong[OF ifrFb_body6_closed[of G r s]] assms
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body6_def is_ifrangeF_body6_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body6:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. {p \<in> G . domain(p) = a}, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body6 ifrangeF_body6_abs
     separation_cong[where P="is_ifrangeF_body6(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body6_def if_range_F_def if_range_F_else_F_def ifrFb_body6_def
   by simp
 
 
 
 (* (##M)(A) \<Longrightarrow> (##M)(f) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(D) \<Longrightarrow> (##M)(r') \<Longrightarrow> (##M)(A') \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(drSR_Y(r', D, A), b, f, i)\<rangle>) *)
 
 definition ifrFb_body7 where
   "ifrFb_body7(B,D,A,b,f,x,i) \<equiv> x \<in>
     (if b = 0 then if i \<in> range(f) then
         {d \<in> D . \<exists>r\<in>A. restrict(r, B) = converse(f) ` i \<and> d = domain(r)} else 0
        else {d \<in> D . \<exists>r\<in>A. restrict(r, B) = i \<and> d = domain(r)})"
 
 relativize functional "ifrFb_body7" "ifrFb_body7_rel"
 relationalize "ifrFb_body7_rel" "is_ifrFb_body7"
 
 synthesize "is_ifrFb_body7" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body7_fm"
 
 definition ifrangeF_body7 :: "[i\<Rightarrow>o,i,i,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body7(M,A,B,D,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body7(B,D,G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body7" "ifrangeF_body7_rel"
 relationalize "ifrangeF_body7_rel" "is_ifrangeF_body7"
 
 synthesize "is_ifrangeF_body7" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body7_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body7:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> (##M)(D) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body7(##M,A,B,D,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body7_fm(1,2,3,4,5,6,0)" and env="[A,B,D,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body7_fm ord_simp_union is_ifrangeF_body7_fm_type
   by simp
 
 lemma (in M_basic) ifrFb_body7_closed: "M(B) \<Longrightarrow> M(D) \<Longrightarrow> M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow>
   ifrFb_body7(B,D,G, r, s, x, i) \<longleftrightarrow>  M(i) \<and> ifrFb_body7(B,D,G, r, s, x, i)"
   using If_abs
   unfolding ifrangeF_body7_def is_ifrangeF_body7_def ifrFb_body7_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_basic) is_ifrFb_body7_closed: "M(B) \<Longrightarrow> M(D) \<Longrightarrow> M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow>
   is_ifrFb_body7(M, B,D,G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body7_def is_ifrangeF_body7_def is_ifrFb_body7_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body7_abs:
   assumes "(##M)(A)"  "(##M)(B)" "(##M)(D)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body7(##M,A,B,D,G,r,s,x) \<longleftrightarrow> ifrangeF_body7(##M,A,B,D,G,r,s,x)"
 proof -
   from assms
   have sep_dr: "y\<in>M \<Longrightarrow> separation(##M, \<lambda>d . \<exists>r\<in>M . r\<in>G \<and> y = restrict(r, B) \<and> d = domain(r))" for y
     by(rule_tac separation_cong[where P'="\<lambda>d . \<exists>r\<in> M . r\<in>G \<and> y = restrict(r, B) \<and> d = domain(r)",THEN iffD1,OF _
           separation_restrict_eq_dom_eq[rule_format,of G B y]],auto simp:transitivity[of _ G])
   from assms
   have sep_dr'': "y\<in>M \<Longrightarrow> separation(##M, \<lambda>d . \<exists>r\<in>M. r \<in> G \<and> d = domain(r) \<and> converse(s) ` y = restrict(r, B))" for y
     by(rule_tac separation_cong[THEN iffD1,OF _ separation_restrict_eq_dom_eq[rule_format,of G B "converse(s) ` y "]],
         auto simp:transitivity[of _ G] apply_closed[simplified] converse_closed[simplified])
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body7(##M, B,D,G, r, s, z, i))= (\<mu> i. is_ifrFb_body7(##M,B,D, G, r, s, z, i))" for z
       using is_ifrFb_body7_closed[of B D G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body7(##M,B,D,G,r,s,z,i)"]) auto
     moreover from this
     have "(\<mu> i. i\<in>M \<and> is_ifrFb_body7(##M, B,D,G, r, s, z, i))= (\<mu> i. i\<in>M \<and>  ifrFb_body7(B,D,G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body7(##M,B,D,G,r,s,z,i)" "\<lambda>i. i\<in>M \<and> ifrFb_body7(B,D,G,r,s,z,i)"])
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       have "is_ifrFb_body7(##M, B,D,G, r, s, z, y) \<longleftrightarrow> ifrFb_body7(B,D,G, r, s, z, y)" if "y\<in>M" for y
         using If_abs apply_0
           separation_closed converse_closed apply_closed range_closed zero_in_M
           transitivity[of _ D] transitivity[of _ G] that sep_dr sep_dr''
         unfolding ifrFb_body7_def is_ifrFb_body7_def
         by auto
       then
       show " y \<in> M \<and> is_ifrFb_body7(##M, B, D, G, r, s, z, y) \<longleftrightarrow> y \<in> M \<and> ifrFb_body7(B, D, G, r, s, z, y)" for y
         using conj_cong
         by simp
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body7(##M, B,D,G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body7(##M,B,D,G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body7(##M,B,D,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body7(##M,B,D,G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body7(B,D,G, r, s, z,i))" for z
       using Least_cong[OF ifrFb_body7_closed[of B D G r s]] assms
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body7_def is_ifrangeF_body7_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body7:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> (##M)(D) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(drSR_Y(B, D, G), b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body7 ifrangeF_body7_abs drSR_Y_equality
     separation_cong[where P="is_ifrangeF_body7(##M,A,B,D,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body7_def if_range_F_def if_range_F_else_F_def ifrFb_body7_def
   by simp
 
 definition omfunspace :: "[i,i] \<Rightarrow> o" where
   "omfunspace(B) \<equiv> \<lambda>z. \<exists>x. \<exists>n\<in>\<omega>. z\<in>x \<and> x = n\<rightarrow>B"
 relativize functional "omfunspace" "omfunspace_rel"
 relationalize "omfunspace_rel" "is_omfunspace"
 synthesize "is_omfunspace" from_definition assuming "nonempty"
 arity_theorem for "is_omfunspace_fm"
 
 context M_pre_seqspace
 begin
 
 is_iff_rel for "omfunspace"
   using is_function_space_iff
   unfolding omfunspace_rel_def is_omfunspace_def
   by (simp add:absolut)
 
 end \<comment> \<open>\<^locale>\<open>M_pre_seqspace\<close>\<close>
 
 context M_ZF1_trans
 begin
 
 lemma separation_omfunspace:
   assumes "(##M)(B)"
   shows "separation(##M, \<lambda>z. \<exists>x[##M]. \<exists>n[##M]. n \<in> \<omega> \<and> z \<in> x \<and> x = n \<rightarrow>\<^bsup>M\<^esup> B)"
   using assms separation_in_ctm[where env="[B]" and \<phi>="is_omfunspace_fm(1,0)"
       and Q="is_omfunspace(##M,B)"]
     nonempty is_omfunspace_iff[of B, THEN separation_cong, of "##M"]
     arity_is_omfunspace_fm is_omfunspace_fm_type
   unfolding omfunspace_rel_def
   by (auto simp add:ord_simp_union)
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 sublocale M_ZF1_trans \<subseteq> M_seqspace "##M"
   using separation_omfunspace by unfold_locales
 
 definition cdltgamma :: "[i,i] \<Rightarrow> o" where
   "cdltgamma(\<gamma>) \<equiv> \<lambda>Z . |Z| < \<gamma>"
 relativize functional "cdltgamma" "cdltgamma_rel"
 relationalize "cdltgamma_rel" "is_cdltgamma"
 synthesize "is_cdltgamma" from_definition assuming "nonempty"
 arity_theorem for "is_cdltgamma_fm"
 
 definition cdeqgamma :: "[i] \<Rightarrow> o" where
   "cdeqgamma \<equiv> \<lambda>Z . |fst(Z)| = snd(Z)"
 relativize functional "cdeqgamma" "cdeqgamma_rel"
 relationalize "cdeqgamma_rel" "is_cdeqgamma"
 synthesize "is_cdeqgamma" from_definition assuming "nonempty"
 arity_theorem for "is_cdeqgamma_fm"
 
 context M_Perm
 begin
 
 is_iff_rel for "cdltgamma"
   using is_cardinal_iff
   unfolding cdltgamma_rel_def is_cdltgamma_def
   by (simp add:absolut)
 
 is_iff_rel for "cdeqgamma"
   using is_cardinal_iff fst_rel_abs snd_rel_abs
   unfolding cdeqgamma_rel_def is_cdeqgamma_def
   by (auto simp add:absolut)
 
 lemma is_cdeqgamma_iff_split: "M(Z) \<Longrightarrow> cdeqgamma_rel(M, Z) \<longleftrightarrow> (\<lambda>\<langle>x,y\<rangle>. |x|\<^bsup>M\<^esup> = y)(Z)"
   using  fst_rel_abs snd_rel_abs
   unfolding cdeqgamma_rel_def split_def
   by simp
 
 end
 
 context M_ZF1_trans
 begin
 
 lemma separation_cdltgamma:
   assumes "(##M)(\<gamma>)"
   shows "separation(##M, \<lambda>Z . cardinal_rel(##M,Z) < \<gamma>)"
   using assms separation_in_ctm[where env="[\<gamma>]" and \<phi>="is_cdltgamma_fm(1,0)"
       and Q="cdltgamma_rel(##M,\<gamma>)"]
     nonempty is_cdltgamma_iff[of \<gamma>] arity_is_cdltgamma_fm is_cdltgamma_fm_type
   unfolding cdltgamma_rel_def
   by (auto simp add:ord_simp_union)
 
 lemma separation_cdeqgamma:
   shows "separation(##M, \<lambda>Z. (\<lambda>\<langle>x,y\<rangle> . cardinal_rel(##M,x) = y)(Z))"
   using separation_in_ctm[where env="[]" and \<phi>="is_cdeqgamma_fm(0)"
       and Q="cdeqgamma_rel(##M)"] is_cdeqgamma_iff_split
     nonempty is_cdeqgamma_iff arity_is_cdeqgamma_fm is_cdeqgamma_fm_type
     separation_cong[OF is_cdeqgamma_iff_split, of "##M"]
   unfolding cdeqgamma_rel_def
   by (simp add:ord_simp_union)
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/ZF_Trans_Interpretations.thy b/thys/Independence_CH/ZF_Trans_Interpretations.thy
--- a/thys/Independence_CH/ZF_Trans_Interpretations.thy
+++ b/thys/Independence_CH/ZF_Trans_Interpretations.thy
@@ -1,677 +1,677 @@
 section\<open>Further instances of axiom-schemes\<close>
 
 theory ZF_Trans_Interpretations
   imports
     Internal_ZFC_Axioms
     Replacement_Instances
 
 begin
 
 locale M_ZF2 = M_ZF1 +
   assumes
     replacement_ax2:
-    "replacement_assm(M,env,replacement_is_order_body_fm)"
-    "replacement_assm(M,env,wfrec_replacement_order_pred_fm)"
-    "replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
-    "replacement_assm(M,env,replacement_is_order_eq_map_fm)"
+    "replacement_assm(M,env,ordtype_replacement_fm)"
+    "replacement_assm(M,env,wfrec_ordertype_fm)"
+    "replacement_assm(M,env,wfrec_Aleph_fm)"
+    "replacement_assm(M,env,omap_replacement_fm)"
 
 definition instances2_fms where "instances2_fms \<equiv>
-  { replacement_is_order_body_fm,
-    wfrec_replacement_order_pred_fm,
-    replacement_HAleph_wfrec_repl_body_fm,
-    replacement_is_order_eq_map_fm }"
+  { ordtype_replacement_fm,
+    wfrec_ordertype_fm,
+    wfrec_Aleph_fm,
+    omap_replacement_fm }"
 
 lemmas replacement_instances2_defs =
-  replacement_is_order_body_fm_def wfrec_replacement_order_pred_fm_def
-  replacement_HAleph_wfrec_repl_body_fm_def replacement_is_order_eq_map_fm_def
+  ordtype_replacement_fm_def wfrec_ordertype_fm_def
+  wfrec_Aleph_fm_def omap_replacement_fm_def
 
 declare (in M_ZF2) replacement_instances2_defs [simp]
 
 locale M_ZF2_trans = M_ZF1_trans + M_ZF2
 
 locale M_ZFC2 = M_ZFC1 + M_ZF2
 
 locale M_ZFC2_trans = M_ZFC1_trans + M_ZF2_trans + M_ZFC2
 
 locale M_ZF2_ground_notCH = M_ZF2 + M_ZF_ground_notCH
 
 locale M_ZF2_ground_notCH_trans = M_ZF2_trans + M_ZF2_ground_notCH + M_ZF_ground_notCH_trans
 
 locale M_ZFC2_ground_notCH = M_ZFC2 + M_ZF2_ground_notCH
 
 locale M_ZFC2_ground_notCH_trans = M_ZFC2_trans + M_ZFC2_ground_notCH + M_ZF2_ground_notCH_trans
 
 locale M_ZFC2_ground_CH_trans = M_ZFC2_ground_notCH_trans + M_ZF_ground_CH_trans
 
 locale M_ctm2 = M_ctm1 + M_ZF2_ground_notCH_trans
 
 locale M_ctm2_AC = M_ctm2 + M_ctm1_AC + M_ZFC2_ground_notCH_trans
 
 locale M_ctm2_AC_CH = M_ctm2_AC + M_ZFC2_ground_CH_trans
 
 lemmas (in M_ZF1_trans) separation_instances =
   separation_well_ord_iso
   separation_obase_equals separation_is_obase
   separation_PiP_rel separation_surjP_rel
   separation_radd_body separation_rmult_body
 
 context M_ZF2_trans
 begin
 
 lemma replacement_HAleph_wfrec_repl_body:
   "B\<in>M \<Longrightarrow> strong_replacement(##M, HAleph_wfrec_repl_body(##M,B))"
   using strong_replacement_rel_in_ctm[where \<phi>="HAleph_wfrec_repl_body_fm(2,0,1)" and env="[B]"]
     zero_in_M arity_HAleph_wfrec_repl_body_fm replacement_ax2(3) ord_simp_union
   by simp
 
 lemma HAleph_wfrec_repl:
   "(##M)(sa) \<Longrightarrow>
         (##M)(esa) \<Longrightarrow>
         (##M)(mesa) \<Longrightarrow>
         strong_replacement
          (##M,
           \<lambda>x z. \<exists>y[##M].
                    pair(##M, x, y, z) \<and>
                    (\<exists>f[##M].
                        (\<forall>z[##M].
                            z \<in> f \<longleftrightarrow>
                            (\<exists>xa[##M].
                                \<exists>y[##M].
                                   \<exists>xaa[##M].
                                      \<exists>sx[##M].
                                         \<exists>r_sx[##M].
                                            \<exists>f_r_sx[##M].
                                               pair(##M, xa, y, z) \<and>
                                               pair(##M, xa, x, xaa) \<and>
                                               upair(##M, xa, xa, sx) \<and>
                                               pre_image(##M, mesa, sx, r_sx) \<and> restriction(##M, f, r_sx, f_r_sx) \<and> xaa \<in> mesa \<and> is_HAleph(##M, xa, f_r_sx, y))) \<and>
                        is_HAleph(##M, x, f, y)))"
   using replacement_HAleph_wfrec_repl_body unfolding HAleph_wfrec_repl_body_def by simp
 
 lemma replacement_is_order_eq_map:
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> strong_replacement(##M, order_eq_map(##M,A,r))"
   using strong_replacement_rel_in_ctm[where \<phi>="order_eq_map_fm(2,3,0,1)" and env="[A,r]"  and f="order_eq_map(##M,A,r)"]
     order_eq_map_iff_sats[where env="[_,_,A,r]"] zero_in_M fst_snd_closed pair_in_M_iff
     arity_order_eq_map_fm ord_simp_union replacement_ax2(4)
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_ZF2_trans\<close>\<close>
 
 definition omap_wfrec_body where
   "omap_wfrec_body(A,r) \<equiv> (\<cdot>\<exists>\<cdot>image_fm(2, 0, 1) \<and> pred_set_fm(A #+ 9, 3, r #+ 9, 0) \<cdot>\<cdot>)"
 
 lemma type_omap_wfrec_body_fm :"A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> omap_wfrec_body(A,r)\<in>formula"
   unfolding omap_wfrec_body_def by simp
 
 lemma arity_aux : "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> arity(omap_wfrec_body(A,r)) = (9+\<^sub>\<omega>A) \<union> (9+\<^sub>\<omega>r)"
   unfolding omap_wfrec_body_def
   using arity_image_fm arity_pred_set_fm pred_Un_distrib union_abs2[of 3] union_abs1
   by (simp add:FOL_arities, auto simp add:Un_assoc[symmetric] union_abs1)
 
 lemma arity_omap_wfrec: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>
   arity(is_wfrec_fm(omap_wfrec_body(A,r),succ(succ(succ(r))), 1, 0)) =
   (4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)"
   using Arities.arity_is_wfrec_fm[OF _ _ _ _ _ arity_aux,of A r "3+\<^sub>\<omega>r" 1 0] pred_Un_distrib
     union_abs1 union_abs2 type_omap_wfrec_body_fm
   by auto
 
 lemma arity_isordermap: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordermap_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordermap_fm_def
   using arity_lambda_fm[where i="(4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)",OF _ _ _ _ arity_omap_wfrec,
       unfolded omap_wfrec_body_def] pred_Un_distrib union_abs1
   by auto
 
 lemma arity_is_ordertype: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordertype_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordertype_fm_def
   using arity_isordermap arity_image_fm pred_Un_distrib FOL_arities
   by auto
 
 lemma arity_is_order_body: "arity(is_order_body_fm(1,0)) = 2"
    using arity_is_order_body_fm arity_is_ordertype ord_simp_union
    by (simp add:FOL_arities)
 
 
 lemma (in M_ZF2_trans) replacement_is_order_body:
   "strong_replacement(##M, \<lambda>x z . \<exists>y[##M]. is_order_body(##M,x,y) \<and> z = \<langle>x,y\<rangle>)"
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x f. M,[x,f] \<Turnstile> (\<cdot>\<exists> \<cdot>is_order_body_fm(1,0) \<and> pair_fm(1,0,2) \<cdot>\<cdot>)",THEN iffD1])
    apply(simp add: is_order_body_iff_sats[where env="[_,_]",symmetric])
    apply(simp_all add:zero_in_M )
   apply(rule_tac replacement_ax2(1)[unfolded replacement_assm_def, rule_format, where env="[]",simplified])
     apply(simp_all add:arity_is_order_body arity pred_Un_distrib ord_simp_union)
   done
 
 definition H_order_pred where
   "H_order_pred(A,r) \<equiv>  \<lambda>x f . f `` Order.pred(A, x, r)"
 
 relationalize "H_order_pred" "is_H_order_pred"
 
 lemma (in M_basic) H_order_pred_abs :
   "M(A) \<Longrightarrow> M(r) \<Longrightarrow> M(x) \<Longrightarrow> M(f) \<Longrightarrow> M(z) \<Longrightarrow>
     is_H_order_pred(M,A,r,x,f,z) \<longleftrightarrow> z = H_order_pred(A,r,x,f)"
   unfolding is_H_order_pred_def H_order_pred_def
   by simp
 
 synthesize "is_H_order_pred" from_definition assuming "nonempty"
 
 lemma (in M_ZF2_trans) wfrec_replacement_order_pred:
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> wfrec_replacement(##M, \<lambda>x g z. is_H_order_pred(##M,A,r,x,g,z) , r)"
   unfolding wfrec_replacement_def is_wfrec_def M_is_recfun_def is_H_order_pred_def
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x f. M,[x,f,r,A] \<Turnstile> order_pred_wfrec_body_fm(3,2,1,0)",THEN iffD1])
    apply(subst order_pred_wfrec_body_def[symmetric])
    apply(rule_tac order_pred_wfrec_body_iff_sats[where env="[_,_,r,A]",symmetric])
            apply(simp_all add:zero_in_M)
   apply(rule_tac replacement_ax2(2)[unfolded replacement_assm_def, rule_format, where env="[r,A]",simplified])
     apply(simp_all add: arity_order_pred_wfrec_body_fm ord_simp_union)
   done
 
 lemma (in M_ZF2_trans) wfrec_replacement_order_pred':
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> wfrec_replacement(##M, \<lambda>x g z. z = H_order_pred(A,r,x,g) , r)"
   using wfrec_replacement_cong[OF H_order_pred_abs[of A r,rule_format] refl,THEN iffD1,
       OF _ _ _ _ _ wfrec_replacement_order_pred[of A r]]
   by simp
 
 sublocale M_ZF2_trans \<subseteq> M_pre_cardinal_arith "##M"
   using separation_instances wfrec_replacement_order_pred'[unfolded H_order_pred_def]
     replacement_is_order_eq_map[unfolded order_eq_map_def]
   by unfold_locales simp_all
 
 
 definition is_well_ord_fst_snd where
   "is_well_ord_fst_snd(A,x) \<equiv> (\<exists>a[A]. \<exists>b[A]. is_well_ord(A,a,b) \<and> is_snd(A, x, b) \<and> is_fst(A, x, a))"
 
 synthesize "is_well_ord_fst_snd" from_definition assuming "nonempty"
 arity_theorem for "is_well_ord_fst_snd_fm"
 
 lemma (in M_ZF2_trans) separation_well_ord: "separation(##M, \<lambda>x. is_well_ord(##M,fst(x), snd(x)))"
   using arity_is_well_ord_fst_snd_fm is_well_ord_iff_sats[symmetric] nonempty
     fst_closed snd_closed fst_abs snd_abs
     separation_in_ctm[where env="[]" and \<phi>="is_well_ord_fst_snd_fm(0)"]
   by(simp_all add: is_well_ord_fst_snd_def)
 
 
 sublocale M_ZF2_trans \<subseteq> M_pre_aleph "##M"
   using HAleph_wfrec_repl replacement_is_order_body
     separation_well_ord separation_Pow_rel
   by unfold_locales (simp_all add: transrec_replacement_def
       wfrec_replacement_def is_wfrec_def M_is_recfun_def flip:setclass_iff)
 
 arity_theorem intermediate for "is_HAleph_fm"
 lemma arity_is_HAleph_fm: "arity(is_HAleph_fm(2, 1, 0)) = 3"
   using arity_fun_apply_fm[of "11" 0 1,simplified]
     arity_is_HAleph_fm' arity_ordinal_fm arity_is_If_fm
     arity_empty_fm arity_is_Limit_fm
     arity_is_If_fm
     arity_is_Limit_fm arity_empty_fm
     arity_Replace_fm[where i="12" and v=10 and n=3]
     pred_Un_distrib ord_simp_union
   by (simp add:FOL_arities)
 
 lemma arity_is_Aleph[arity]: "arity(is_Aleph_fm(0, 1)) = 2"
   unfolding is_Aleph_fm_def
   using arity_transrec_fm[OF _ _ _ _ arity_is_HAleph_fm] ord_simp_union
   by simp
 
 definition bex_Aleph_rel :: "[i\<Rightarrow>o,i,i] \<Rightarrow> o" where
   "bex_Aleph_rel(M,x) \<equiv> \<lambda>y. \<exists>z\<in>x. y = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
 
 relationalize "bex_Aleph_rel" "is_bex_Aleph"
 
 schematic_goal sats_is_bex_Aleph_fm_auto:
   "a \<in> nat \<Longrightarrow> c \<in> nat \<Longrightarrow> env \<in> list(A) \<Longrightarrow>
   a < length(env) \<Longrightarrow> c < length(env) \<Longrightarrow> 0 \<in> A \<Longrightarrow>
   is_bex_Aleph(##A, nth(a, env), nth(c, env)) \<longleftrightarrow> A, env \<Turnstile> ?fm(a, c)"
   unfolding is_bex_Aleph_def
   by (rule iff_sats | simp)+
 
 synthesize_notc "is_bex_Aleph" from_schematic
 
 lemma is_bex_Aleph_fm_type [TC]:
     "x \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> is_bex_Aleph_fm(x, z) \<in> formula"
   unfolding is_bex_Aleph_fm_def by simp
 
 lemma sats_is_bex_Aleph_fm:
     "x \<in> \<omega> \<Longrightarrow>
     z \<in> \<omega> \<Longrightarrow> x < length(env) \<Longrightarrow> z < length(env) \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow>
     (Aa, env \<Turnstile> is_bex_Aleph_fm(x, z)) \<longleftrightarrow>
     is_bex_Aleph(##Aa,nth(x, env), nth(z, env))"
   using sats_is_bex_Aleph_fm_auto unfolding is_bex_Aleph_def is_bex_Aleph_fm_def
   by simp
 
 lemma is_bex_Aleph_iff_sats [iff_sats]:
     "nth(x, env) = xa \<Longrightarrow>
     nth(z, env) = za \<Longrightarrow>
     x \<in> \<omega> \<Longrightarrow>
     z \<in> \<omega> \<Longrightarrow> x < length(env) \<Longrightarrow> z < length(env) \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow>
     is_bex_Aleph(##Aa, xa, za) \<longleftrightarrow>
     Aa, env \<Turnstile> is_bex_Aleph_fm(x, z)"
   using sats_is_bex_Aleph_fm by simp
 
 arity_theorem for "is_bex_Aleph_fm"
 
 lemma (in M_ZF1_trans) separation_is_bex_Aleph:
   assumes "(##M)(A)"
   shows "separation(##M,is_bex_Aleph(##M, A))"
   using assms separation_in_ctm[where env="[A]" and \<phi>="is_bex_Aleph_fm(1,0)",
       OF _ _ _ is_bex_Aleph_iff_sats[symmetric],
       of "\<lambda>_.A"]
     nonempty arity_is_bex_Aleph_fm is_bex_Aleph_fm_type
   by (simp add:ord_simp_union)
 
 lemma (in M_pre_aleph) bex_Aleph_rel_abs:
   assumes "Ord(u)" "M(u)" "M(v)"
   shows "is_bex_Aleph(M, u, v) \<longleftrightarrow> bex_Aleph_rel(M,u,v)"
   unfolding is_bex_Aleph_def bex_Aleph_rel_def
   using assms is_Aleph_iff transM[of _ u] Ord_in_Ord
   by simp
 
 lemma (in M_ZF2_trans) separation_bex_Aleph_rel:
   "Ord(x) \<Longrightarrow> (##M)(x) \<Longrightarrow> separation(##M, bex_Aleph_rel(##M,x))"
   using separation_is_bex_Aleph bex_Aleph_rel_abs
     separation_cong[where P="is_bex_Aleph(##M,x)" and M="##M",THEN iffD1]
   unfolding bex_Aleph_rel_def
   by simp
 
 sublocale M_ZF2_trans \<subseteq> M_aleph "##M"
   using separation_bex_Aleph_rel[unfolded bex_Aleph_rel_def]
   by unfold_locales
 
 sublocale M_ZF1_trans \<subseteq> M_FiniteFun "##M"
   using separation_is_function separation_omfunspace
   by unfold_locales simp
 
 sublocale M_ZFC2_trans \<subseteq> M_cardinal_AC "##M"
   using lam_replacement_minimum
   by unfold_locales simp
 
 (* TopLevel *)
 
 lemma (in M_ZF1_trans) separation_cardinal_rel_lesspoll_rel:
   "(##M)(\<kappa>) \<Longrightarrow> separation(##M, \<lambda>x. x \<prec>\<^bsup>M\<^esup> \<kappa>)"
   using separation_in_ctm[where \<phi>="( \<cdot>0 \<prec> 1\<cdot> )" and env="[\<kappa>]"]
     is_lesspoll_iff nonempty
     arity_is_cardinal_fm arity_is_lesspoll_fm arity_is_bij_fm ord_simp_union
   by (simp add:FOL_arities)
 
 sublocale M_ZFC2_trans \<subseteq> M_library "##M"
   using separation_cardinal_rel_lesspoll_rel lam_replacement_minimum
   by unfold_locales simp_all
 
 locale M_ZF3 = M_ZF2 +
   assumes
     ground_replacements3:
-    "ground_replacement_assm(M,env,replacement_is_order_body_fm)"
-    "ground_replacement_assm(M,env,wfrec_replacement_order_pred_fm)"
-    "ground_replacement_assm(M,env,eclose_repl2_intf_fm)"
+    "ground_replacement_assm(M,env,ordtype_replacement_fm)"
+    "ground_replacement_assm(M,env,wfrec_ordertype_fm)"
+    "ground_replacement_assm(M,env,eclose_abs_fm)"
     "ground_replacement_assm(M,env,wfrec_rank_fm)"
-    "ground_replacement_assm(M,env,trans_repl_HVFrom_fm)"
-    "ground_replacement_assm(M,env,eclose_repl1_intf_fm)"
-    "ground_replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
-    "ground_replacement_assm(M,env,replacement_is_order_eq_map_fm)"
+    "ground_replacement_assm(M,env,transrec_VFrom_fm)"
+    "ground_replacement_assm(M,env,eclose_closed_fm)"
+    "ground_replacement_assm(M,env,wfrec_Aleph_fm)"
+    "ground_replacement_assm(M,env,omap_replacement_fm)"
 
 definition instances3_fms where "instances3_fms \<equiv>
-  { ground_repl_fm(replacement_is_order_body_fm),
-    ground_repl_fm(wfrec_replacement_order_pred_fm),
-    ground_repl_fm(eclose_repl2_intf_fm),
+  { ground_repl_fm(ordtype_replacement_fm),
+    ground_repl_fm(wfrec_ordertype_fm),
+    ground_repl_fm(eclose_abs_fm),
     ground_repl_fm(wfrec_rank_fm),
-    ground_repl_fm(trans_repl_HVFrom_fm),
-    ground_repl_fm(eclose_repl1_intf_fm),
-    ground_repl_fm(replacement_HAleph_wfrec_repl_body_fm),
-    ground_repl_fm(replacement_is_order_eq_map_fm) }"
+    ground_repl_fm(transrec_VFrom_fm),
+    ground_repl_fm(eclose_closed_fm),
+    ground_repl_fm(wfrec_Aleph_fm),
+    ground_repl_fm(omap_replacement_fm) }"
 
 text\<open>This set has $8$ internalized formulas, corresponding to the total
 count of previous replacement instances (apart from those $5$ in
 \<^term>\<open>instances_ground_fms\<close> and \<^term>\<open>instances_ground_notCH_fms\<close>,
-and \<^term>\<open>replacement_dcwit_repl_body_fm\<close>).\<close>
+and \<^term>\<open>dc_abs_fm\<close>).\<close>
 
 definition overhead where
   "overhead \<equiv> instances1_fms \<union> instances_ground_fms"
 
 definition overhead_notCH where
   "overhead_notCH \<equiv> overhead \<union> instances2_fms \<union>
      instances3_fms \<union> instances_ground_notCH_fms"
 
 definition overhead_CH where
-  "overhead_CH \<equiv> overhead_notCH \<union> { replacement_dcwit_repl_body_fm }"
+  "overhead_CH \<equiv> overhead_notCH \<union> { dc_abs_fm }"
 
 text\<open>Hence, the “overhead” to create a proper extension of a ctm by forcing
 consists of $7$ replacement instances. To force $\neg\CH$,
 21 instances are need, and one further instance is required to
 force $\CH$.\<close>
 
 lemma instances2_fms_type[TC] : "instances2_fms \<subseteq> formula"
   unfolding instances2_fms_def replacement_instances2_defs
   by (auto simp del: Lambda_in_M_fm_def)
 
 lemma overhead_type: "overhead \<subseteq> formula"
   using instances1_fms_type instances_ground_fms_type
   unfolding overhead_def replacement_instances1_defs
   by simp
 
 lemma overhead_notCH_type: "overhead_notCH \<subseteq> formula"
   using overhead_type
-  unfolding overhead_notCH_def replacement_transrec_apply_image_body_fm_def
-    replacement_is_trans_apply_image_fm_def instances_ground_notCH_fms_def
+  unfolding overhead_notCH_def recursive_construction_abs_fm_def
+    recursive_construction_fm_def instances_ground_notCH_fms_def
     instances2_fms_def instances3_fms_def
   by (auto simp: replacement_instances1_defs
       replacement_instances2_defs simp del: Lambda_in_M_fm_def)
 
 lemma overhead_CH_type: "overhead_CH \<subseteq> formula"
-  using overhead_notCH_type unfolding overhead_CH_def replacement_dcwit_repl_body_fm_def
+  using overhead_notCH_type unfolding overhead_CH_def dc_abs_fm_def
   by auto
 
 locale M_ZF3_trans = M_ZF2_trans + M_ZF3
 
 locale M_ZFC3 = M_ZFC2 + M_ZF3
 
 locale M_ZFC3_trans = M_ZFC2_trans + M_ZF3_trans + M_ZFC3
 
 locale M_ctm3 = M_ctm2 + M_ZF3_trans
 
 locale M_ctm3_AC = M_ctm3 + M_ctm1_AC + M_ZFC3_trans
 
 lemma M_satT_imp_M_ZF2: "(M \<Turnstile> ZF) \<Longrightarrow> M_ZF1(M)"
 proof -
   assume "M \<Turnstile> ZF"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   {
     fix \<phi> env
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     moreover from \<open>M \<Turnstile> ZF\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
       unfolding ZF_def ZF_schemes_def by auto
     moreover from calculation
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff
       unfolding replacement_assm_def by simp_all
   }
   with fin
   show "M_ZF1(M)"
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 lemma M_satT_imp_M_ZFC1:
   shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC1(M)"
 proof -
   have "(M \<Turnstile> ZF) \<and> choice_ax(##M) \<longrightarrow> M_ZFC1(M)"
     using M_satT_imp_M_ZF2[of M]
     unfolding M_ZFC1_def M_ZC_basic_def M_ZF1_def M_AC_def
     by auto
   then
   show ?thesis
     unfolding ZFC_def by auto
 qed
 
 lemma M_satT_instances1_imp_M_ZF1:
   assumes "(M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms })"
   shows "M_ZF1(M)"
 proof -
   from assms
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_fin_def Zermelo_fms_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   moreover
   {
     fix \<phi> env
     from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       unfolding Zermelo_fms_def ZF_def instances1_fms_def
       by auto
     moreover
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     ultimately
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       using sats_ZF_separation_fm_iff by simp_all
   }
   moreover
   {
     fix \<phi> env
     assume "\<phi> \<in> instances1_fms" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] instances1_fms_type
       unfolding replacement_assm_def by auto
   }
   ultimately
   show ?thesis
     unfolding instances1_fms_def
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_trans:
   assumes "Transset(M)" "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead}"
   shows "M_ZF_ground_trans(M)"
 proof -
   from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> _\<close>
   have "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }"
        "M \<Turnstile> {\<cdot>Replacement(p)\<cdot> . p \<in> instances_ground_fms }"
     unfolding overhead_def by auto
   then
   interpret M_ZF1 M
     using M_satT_instances1_imp_M_ZF1
     by simp
   from \<open>Transset(M)\<close>
   interpret M_ZF1_trans M
     using M_satT_imp_M_ZF2
     by unfold_locales
   {
     fix \<phi> env
     assume "\<phi> \<in> instances_ground_fms" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> {\<cdot>Replacement(p)\<cdot> . p \<in> instances_ground_fms}\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_fms_type
       unfolding replacement_assm_def by auto
   }
   then
   show ?thesis
     unfolding instances_ground_fms_def
     by unfold_locales (simp_all add:replacement_assm_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_notCH_trans:
   assumes
     "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
   shows "M_ZF_ground_notCH_trans(M)"
 proof -
   from assms
   interpret M_ZF_ground_trans M
     using M_satT_imp_M_ZF_ground_trans unfolding overhead_notCH_def by force
   {
     fix \<phi> env
     assume "\<phi> \<in> instances_ground_notCH_fms" "env\<in>list(M)"
     moreover from this and assms
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>"
       unfolding overhead_notCH_def by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_notCH_fms_type
       unfolding replacement_assm_def by auto
   }
   then
   show ?thesis
     by unfold_locales (simp_all add:replacement_assm_def instances_ground_notCH_fms_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_CH_trans:
   assumes
     "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH }"
   shows "M_ZF_ground_CH_trans(M)"
 proof -
   from assms
   interpret M_ZF_ground_notCH_trans M
     using M_satT_imp_M_ZF_ground_notCH_trans unfolding overhead_CH_def by auto
   {
     fix env
     assume "env \<in> list(M)"
     moreover from assms
-    have "M, [] \<Turnstile> \<cdot>Replacement(replacement_dcwit_repl_body_fm)\<cdot>"
+    have "M, [] \<Turnstile> \<cdot>Replacement(dc_abs_fm)\<cdot>"
       unfolding overhead_CH_def by auto
     ultimately
-    have "arity(replacement_dcwit_repl_body_fm) \<le> succ(succ(length(env)))
-      \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,replacement_dcwit_repl_body_fm,Cons(x,Cons(y, env))))"
-      using sats_ZF_replacement_fm_iff[of replacement_dcwit_repl_body_fm]
+    have "arity(dc_abs_fm) \<le> succ(succ(length(env)))
+      \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,dc_abs_fm,Cons(x,Cons(y, env))))"
+      using sats_ZF_replacement_fm_iff[of dc_abs_fm]
       unfolding replacement_assm_def
-      by (auto simp:replacement_dcwit_repl_body_fm_def)
+      by (auto simp:dc_abs_fm_def)
   }
   then
   show ?thesis
     by unfold_locales (simp_all add:replacement_assm_def)
 qed
 
 lemma (in M_Z_basic) M_satT_Zermelo_fms: "M \<Turnstile> \<cdot>Z\<cdot>"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff
   unfolding Zermelo_fms_def ZF_fin_def
   by auto
 
 lemma (in M_ZFC1) M_satT_ZC: "M \<Turnstile> ZC"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff choice_ax
   unfolding ZC_def Zermelo_fms_def ZF_fin_def
   by auto
 
 locale M_ZF = M_Z_basic +
   assumes
     replacement_ax:"replacement_assm(M,env,\<phi>)"
 
 sublocale M_ZF \<subseteq> M_ZF3
   using replacement_ax
   by unfold_locales (simp_all add:ground_replacement_assm_def)
 
 lemma M_satT_imp_M_ZF: " M \<Turnstile> ZF \<Longrightarrow> M_ZF(M)"
 proof -
   assume "M \<Turnstile> ZF"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   {
     fix \<phi> env
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     moreover from \<open>M \<Turnstile> ZF\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
       unfolding ZF_def ZF_schemes_def by auto
     moreover from calculation
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff
       unfolding replacement_assm_def by simp_all
   }
   with fin
   show "M_ZF(M)"
     unfolding M_ZF_def M_Z_basic_def M_ZF_axioms_def replacement_assm_def by simp
 qed
 
 lemma (in M_ZF) M_satT_ZF: "M \<Turnstile> ZF"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff
     replacement_ax sats_ZF_replacement_fm_iff
   unfolding ZF_def ZF_schemes_def ZF_fin_def replacement_assm_def
   by auto
 
 lemma M_ZF_iff_M_satT: "M_ZF(M) \<longleftrightarrow> (M \<Turnstile> ZF)"
   using M_ZF.M_satT_ZF M_satT_imp_M_ZF
   by auto
 
 locale M_ZFC = M_ZF + M_ZC_basic
 
 sublocale M_ZFC \<subseteq> M_ZFC3
   by unfold_locales
 
 lemma M_ZFC_iff_M_satT:
   notes iff_trans[trans]
   shows "M_ZFC(M) \<longleftrightarrow> (M \<Turnstile> ZFC)"
 proof -
   have "M_ZFC(M) \<longleftrightarrow> (M \<Turnstile> ZF) \<and> choice_ax(##M)"
     using M_ZF_iff_M_satT
     unfolding M_ZFC_def M_ZC_basic_def M_AC_def M_ZF_def by auto
   also
   have " \<dots> \<longleftrightarrow> M \<Turnstile> ZFC"
     unfolding ZFC_def by auto
   ultimately
   show ?thesis by simp
 qed
 
 lemma M_satT_imp_M_ZF3: "(M \<Turnstile> ZF) \<longrightarrow> M_ZF3(M)"
 proof
   assume "M \<Turnstile> ZF"
   then
   interpret M_ZF M
     using M_satT_imp_M_ZF by simp
   show "M_ZF3(M)"
     by unfold_locales
 qed
 
 lemma M_satT_imp_M_ZFC3:
   shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC3(M)"
 proof
   assume "M \<Turnstile> ZFC"
   then
   interpret M_ZFC M
     using M_ZFC_iff_M_satT  by simp
   show "M_ZFC3(M)"
     by unfold_locales
 qed
 
 lemma M_satT_overhead_imp_M_ZF3:
   "(M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}) \<longrightarrow> M_ZFC3(M)"
 proof
   assume "M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)" "choice_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZC_def ZF_fin_def Zermelo_fms_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   moreover
   {
     fix \<phi> env
     from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       unfolding ZC_def Zermelo_fms_def ZF_def by auto
     moreover
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     ultimately
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       using sats_ZF_separation_fm_iff by simp_all
   }
   moreover
   {
     fix \<phi> env
     assume "\<phi> \<in> overhead_notCH" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] overhead_notCH_type
       unfolding replacement_assm_def by auto
   }
   ultimately
   show "M_ZFC3(M)"
     unfolding overhead_def overhead_notCH_def instances1_fms_def
       instances2_fms_def instances3_fms_def
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/document/root.tex b/thys/Independence_CH/document/root.tex
--- a/thys/Independence_CH/document/root.tex
+++ b/thys/Independence_CH/document/root.tex
@@ -1,124 +1,125 @@
 \documentclass[11pt,a4paper,english]{article}
 \usepackage{isabelle,isabellesym}
 \usepackage[numbers]{natbib}
 \usepackage{babel}
+\renewcommand{\isasymbbbP}{\isamath{\mathbb{P}}}
 
 \usepackage{relsize}
 \DeclareRobustCommand{\isactrlbsub}{\emph\bgroup\math{}\sb\bgroup\mbox\bgroup\isaspacing\itshape\smaller}
 \DeclareRobustCommand{\isactrlesub}{\egroup\egroup\endmath\egroup}
 \DeclareRobustCommand{\isactrlbsup}{\emph\bgroup\math{}\sp\bgroup\mbox\bgroup\isaspacing\itshape\smaller}
 \DeclareRobustCommand{\isactrlesup}{\egroup\egroup\endmath\egroup}
 
 % further packages required for unusual symbols (see also
 % isabellesym.sty), use only when needed
 
 \usepackage{amssymb}
   %for \<leadsto>, \<box>, \<diamond>, \<sqsupset>, \<mho>, \<Join>,
   %\<lhd>, \<lesssim>, \<greatersim>, \<lessapprox>, \<greaterapprox>,
   %\<triangleq>, \<yen>, \<lozenge>
 
 %\usepackage{eurosym}
   %for \<euro>
 
 %\usepackage[only,bigsqcap]{stmaryrd}
   %for \<Sqinter>
 
 %\usepackage{eufrak}
   %for \<AA> ... \<ZZ>, \<aa> ... \<zz> (also included in amssymb)
 
 %\usepackage{textcomp}
   %for \<onequarter>, \<onehalf>, \<threequarters>, \<degree>, \<cent>,
   %\<currency>
 
 % this should be the last package used
 \usepackage{pdfsetup}
 
 % urls in roman style, theory text in math-similar italics
 \urlstyle{rm}
 \isabellestyle{it}
 
 % for uniform font size
 %\renewcommand{\isastyle}{\isastyleminor}
 \newcommand{\forces}{\Vdash}
 \newcommand{\dom}{\mathsf{dom}}
 \renewcommand{\isacharunderscorekeyword}{\mbox{\_}}
 \renewcommand{\isacharunderscore}{\mbox{\_}}
 \renewcommand{\isasymtturnstile}{\isamath{\Vdash}}
 \renewcommand{\isacharminus}{-}
 \newcommand{\session}[1]{\textit{#1}}
 \newcommand{\theory}[1]{\texttt{#1}}
 \newcommand{\axiomas}[1]{\mathit{#1}}
 \newcommand{\ZFC}{\axiomas{ZFC}}
 \newcommand{\ZF}{\axiomas{ZF}}
 \newcommand{\AC}{\axiomas{AC}}
 \newcommand{\CH}{\axiomas{CH}}
 \newcommand{\calV}{\mathcal{V}}
 
 \begin{document}
 
 \title{The Independence of the Continuum Hypothesis in Isabelle/ZF}
 \author{Emmanuel Gunther\thanks{Universidad Nacional de C\'ordoba. 
     Facultad de Matem\'atica, Astronom\'{\i}a,  F\'{\i}sica y
     Computaci\'on.}
   \and
   Miguel Pagano\footnotemark[1]
   \and
   Pedro S\'anchez Terraf\footnotemark[1] \thanks{Centro de Investigaci\'on y Estudios de Matem\'atica
     (CIEM-FaMAF), Conicet. C\'ordoba. Argentina.
     Supported by Secyt-UNC project 33620180100465CB.}
   \and
   Mat\'{\i}as Steinberg\footnotemark[1]
 }
 \maketitle
 
 \begin{abstract}
   We redeveloped our formalization of forcing in the set theory framework of
   Isabelle/ZF. Under the assumption of the existence of a countable
   transitive model of $\ZFC$, we construct proper generic extensions 
   that satisfy the Continuum Hypothesis and its negation.
 \end{abstract}
 
 
 \tableofcontents
 
 % sane default for proof documents
 \parindent 0pt\parskip 0.5ex
 
 \section{Introduction}
 We formalize the theory of forcing. We work on top of the Isabelle/ZF
 framework developed by \citet{DBLP:journals/jar/PaulsonG96}. Our
 mechanization is described in more detail in our papers
 \cite{2018arXiv180705174G} (LSFA 2018), \cite{2019arXiv190103313G},
 and \cite{2020arXiv200109715G} (IJCAR 2020).
 
 The main entry point of the present session is
 \theory{Definitions\_Main.thy} (Section~\ref{sec:main-definitions}),
 in which a path from fundamental set
 theoretic concepts formalized in Isabelle reaching to our main theorems
 is expounded. Cross-references to major milestones are provided there.
 
 In order to provide evidence for the correctness of several of our relativized
 definitions, we needed to assume the Axiom of Choice ($\AC$) during the
 aforementioned theory. Nevertheless, the whole of our development is
 independent of $\AC$, and the theory \theory{CH.thy} already provides
 all of our results and does not import that axiom.
 
 \subsection*{Release notes}
 \label{sec:release-notes}
 
 Previous versions of this development can be found at
 \url{https://cs.famaf.unc.edu.ar/~pedro/forcing/}.
 
 % generated text of all theories
 \input{session}
 
 % optional bibliography
 \bibliographystyle{root}
 \bibliography{root}
 
 \end{document}
 
 %%% Local Variables:
 %%% mode: latex
 %%% TeX-master: t
 %%% End: